fenris 0.07-m (6/24/2002)
by
Michal Zalewski
and other community contributors
Description
Fenris is a multipurpose tracer, GUI debugger, stateful analyzer and partial
decompiler intended to simplify bug tracking, security audits, code,
algorithm, protocol analysis and computer forensics - providing a structural
program trace, interactive debugging capabilities,
general information about
internal constructions, execution path,
memory operations, I/O, conditional
expressions and much more. Because it
does not require sources or any
particular compilation method, this
multi-component project can be very
helpful for black-box tests and evaluations - but
it will also be a great
tool
for open-source project audits, as an unmatched
real-time reconnaissance tool - especially when sources are too complex
or too badly written to be analyzed by hand in a reliable way and reasonable
time. Fenris does not rely on GNU libbfd for any critical tasks, and because
of that, it is possible and feasible to trace and analyze binaries modified
to fool debuggers, crypted, or otherwise tweaked.
Fenris components also support other, independent debuggers or
disassemblers, thanks to its capabilities to reconstruct symbol tables
for stripped, static binaries with no debugging or symbol information
whatsoever.
This project is not intended to find problems, bugs or security
vulnerabilities automatically. It is supposed to be a reliable,
useful tool that works in real world and can deliver valuable
information which can be used to detect known problems, but also
to spot unique or not so obvious dynamic conditions.
Among many other features, Fenris is able to perform traditional, instruction
by instruction or breakpoint to breakpoint interactive debugging enhanced
by additional structural data about the code delivered to the user; it is
able to fingerprint functions in static
binaries, reconstruct symbol tables in ELF files based on that information,
automatically detect common library code; able to deliver text-based
and graphical, browsable output that documents different aspects of
program activity on different abstraction layers; able
to perform partial analysis of single structural blocks. It is designed
to make things easier, filling the gap between existing
code analysis
and debugging tools
- but not to replace all of them. To read more about
its functionality, approach, usage and limitations, please
click here.
Demo and download
To see a brief demonstration of Fenris features,
you can follow this link.
Graphics-capable browser is strongly recommended.
Last stable version of Fenris can be downloaded here.
For most recent, but not always stable and not official code
snapshots, please visit
my development page.
Project status, news, credits
This code is distributed under terms and conditions
of GNU Public License, version 2. It is usable, but certainly not
finished. It lacks support for certain calls, needs to be ported to
platforms other than Linux/x86 and needs to support compilers other
than GCC framework. RAZOR believes that this project can and will benefit
from being an open-source development, and because of that, we encourage
all developers who find this code interesting to contribute and make
it better.
Fenris has proven its usability in
The Reverse Challenge from Project Honeynet.
Click here for brief hints
for the contestans on using this tool to make computer forensics easier.
06-25-2002
|
0.07-m: maintenance release: new fingeprints, bug-fixes
|
05-31-2002
|
0.06: SoftICE-alike GUI debugger, improved speed, new features
|
05-23-2002
|
0.05: interactive debugging capabilities introduced, burneye tracing
|
05-17-2002
|
0.03: some enhancements, new component ("dress") added
|
05-09-2002
|
0.02: many fixes, new fingerprints, options, optimizations
|
02-13-2002
|
initial 0.01 release
|
Below is the list of people outside RAZOR who contributed
to the project by providing their comments, suggestions, criticism or developing
new code:
Jose Nazario
Rafal Wojtczuk
dvorak
Mariusz Woloszyn
bighawk
Slawomir Krawczyk
Wojtek Kaniewski
Bulba
Solar Designer
Wojtek Walczak
Martin Kluge
Lluis Mora Hidalgo
dataspy
Jim Paris
Andrzej Szombierski
undefine
|
Robert W. Jaroszuk
Joe Van Andel
Neil Jerram
Hubert Lubaczewski
Yair K
Gregory Wright
Adam Byrtek
Gordon Sadler
Roger Luethi
Mariusz Marcinkiewicz
Lukasz Trabinski
Piotr Meyer
Fabio Vayr
Han Holl
Brian Finn
Gandalf
Piter
Krzysztof Gibas
Matthias Hofherr
|
Marcin Kaminski
Artur Byszko
Lukasz Biegaj
Przemyslaw Skowron
Gonçalo Gomes
Timothy Bogdala
Allen Noe
piggy
Stephen Kench
Bartlomiej Lidke
Marek Gutkowski
Tadeusz Wlodarczyk
Marcin Gozdalik
William Stearns
Greg
Dave Aitel
Daniel Polombo
lucipher
GoTaR
Paul van Maaren
Peter Lopen
|
|