Skip to content
/ peutils Public

Binary Ninja plugin providing various niche utilities for working with PE binaries

License

Notifications You must be signed in to change notification settings

404d/peutils

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

15 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Binary Ninja PE Utils

Bunch'a niche utilities for working with PE-based binaries.

Features

Resolve ordinal imports

Ordinal imports can be resolved to symbol names from external BNDBs. If you rename an exported function in the external BNDB, the name you defined will be used instead of the original export name.

Given an example import as shown below:

Import table with unresolved ordinals

IAT with unresolved ordinals

By loading a binary view for OLEAUT32.dll, we can update the import names for the target binary view with the real name behind the import:

Import table with resolved ordinals

IAT with resolved ordinals

Synchronize symbol names and types across binaries

Types defined in external BNDBs can be transferred to the current binary view in order to aid with reversing.

Continuing from the above example, we can rename the arg of the function SysStringLen from the external BNDB OLEAUT32.dll:

Function with renamed argument

When synced, the IAT will be updated with the new argument:

IAT with renamed argument

We can also see that the new argument is exposed through other disassembly views, like MLIL:

MLIL call with renamed argument

As mentioned earlier, symbol names also get transferred between loaded BNDBs. Renaming the export from the external BNDB then resyncing, we can see that the changes is transferred to the target binary view:

Function with renamed symbol

MLIL call with renamed symbol

About

Binary Ninja plugin providing various niche utilities for working with PE binaries

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages