Enabling Support for x64dbg Debugger

[the-wondersmith]

The more I use Binary Ninja the more enamored I become with it. To make a long post very short, I think it would be incredible if BN could use x64dbg as a back-end the way that it does gdb, lldb, and dbgeng.

Initially I looked at porting the ret-sync plugin so that x64dbg and BN could be used the same way that ret-sync allows x64dbg and Ghidra to be used together. I'm still fiddling with the idea, but it's a bit above my head to figure out if going that route is the best option.

On the one hand, there appears to be a ready-made example of how it works in the form of the existing IDA plugin which is extremely convenient given that BN supports pure-python plugins. However, it's equally possible that implementing support for either x64dbg itself, TitanEngine or GleeBug by extending BN's DebugAdapter class might be a better idea.

I have absolutely no idea, but I'm hoping someone here might. Thoughts?

[psifertex]

I think you're right that the best solution is port ret-sync to BN. We most certainly support pure-python plugins. In fact, all of the plugins in the current plugin manager are all python. :-)

I can't imagine there'd be a reason you couldn't just port https://github.com/bootleg/ret-sync/blob/master/ext_ida/SyncPlugin.py and the retsync folder to a BN plugin that would be able to connect to a ret-sync session with another backend.

If you do decide to take on such a task I'd recommend you join the public slack and ask around in the #api-help channel, lots of folks there would be happy to help give suggestions on how to implement the different APIs.

[the-wondersmith]

@psifertex Thank you for the feedback. I've (unsurprisingly) decided to go ahead and take a crack at porting ret-sync.

My main reason for wanting a more... native integration with the BN Debugger is the automatic IL updating features it has. I don't suppose you have any idea if it'd be possible to make things work that way?

[psifertex]

For something like self-modifying code?

[psifertex]

Just following up again to see what you mean by automatic IL updating.

[the-wondersmith]

SO sorry for the delay in replying, I got a bit mired in projects.

By automatic IL updating I meant maintaining the same behavior being displayed in the animation under Undiscovered Country in the BN Blog post about the debugger.

The explanation text reads:

If a function is purposely hidden or even just the result of a virtual function call or other indirect control flow, static analysis might miss it. But during runtime, analysis can be told the address of call destinations great improving function identification.

Prior to the call ebx, address 0x100000f25 is just data. But once this instruction is reached, Binja wisens up:

And the animation shows how BN intelligently re-works the IL in response to having discovered the aforementioned purposely hidden function.

[psifertex]

Ahh, yeah, gotcha. Yeah, I mean, you can totally do the same thing. The current debugger plugin is open source and it doesn't use any private APIs or anything, so you could definitely match that functionality up with an existing x64dbg session using something like retsync.