A SPIRIT SUITE TOOL
Spirit PacketPuller analyses IDA-generated pseudocode for packet structure and opcodes.
An open-source Flutter-based re-implementation of the GUI implementation of MaplePacketPuller.
The core analysis logic inherits MaplePacketPuller's in-header opcode extraction logic. Normal and aggressive modes have been re-designed.
An out-header opcode extraction feature may or may not be added in the future.
NOTE: Normal Mode does not support multiple same-level nested blocks. The decode functions will be extracted correctly, but the indentations will be off. Please use Aggressive Mode instead.
| Target: | State: |
|---|---|
| GUI Design: | |
| GUI Logic: | |
| Core Logic | |
| Simple Accuracy Test |
Current Status: Release Candidate 2 (v0.2.1-alpha) is out now!
Download the releases here
Known issues for building from source:
- Currently waiting for the Flutter team to handle a similar problem as described here.
| Target Platform: | Tested: |
|---|---|
| Windows 10 Version 2004 | Windows 10 Version 1809 |
Kindly on to the list as done, if you ran with a previously untested version successfully:
- Windows 10 1909 or earlier (skip 1809)
- Windows 8
- Windows 7
This pseudocode analysis tool is intended to be used alongside the Spirit IDA Plugin, which allows users to extract pseudocode into text files automatically.
- Click Refresh to get the list of files.
- Click on items in the
Files Detectedlist to select them.- Similarly click on items in the
Files Selectedlist to deselect them.
- Similarly click on items in the
- Click on the options at the bottom if you would like to use an advanced mode.
- Normal Analysis will attempt to extract the packet structure from the provided pseudocode files, and then attempt to beautify them for increased legibility.
- This mode is only recommended for analysing simple pseudocode.
- Agressive Analysis gives significantly more accurate results, at the cost of aesthetics/legibility.
- This mode is recommended for more complex pseudocode.
- Opcode Analysis strips out (and retains only) the in-header opcodes for ease of reference.
- Normal Analysis will attempt to extract the packet structure from the provided pseudocode files, and then attempt to beautify them for increased legibility.
- Click
Processto start analysing.
WARNING: THIS PROJECT IS INTENDED TO RUN ON WINDOWS ONLY!
The Flutter Desktop builds are currently experimental and in either Alpha or (in the case of Linux) Beta testing stages.
At the moment, they may only be build on the target platform.
Windows 10 Version 2004 is the official target platform for this project.
Refer to the inner README for an overview of the folder structure.
- Install Flutter Desktop.
Clone/Forkthe repository.- Navigate to the porject directory in a CLI (I use PowerShell 7), and use command
flutter pub getto grab all dependencies.
Closed-source Library: Packet Structure Extraction Engine
Note: These screenshots of the API Docs were from v0.0.2. There have been backwards-compatible changes made since that version.
