# IDA2Obj | Static Binary Instrumentation

**URL:** <https://onehack.st/t/ida2obj-static-binary-instrumentation/212372>\
**Category:** Tools & Scripts\
**Tags:** tools, business, tips-tricks\
**Created:** [January 17, 2022, 12:28pm UTC](https://onehack.st/t/ida2obj-static-binary-instrumentation/212372 "2022-01-17T12:28:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [January 17, 2022, 12:28pm UTC](https://onehack.st/t/ida2obj-static-binary-instrumentation/212372/1 "2022-01-17T12:28:53Z")

</div>

[![image-20210813134907705](https://github.com/jhftss/IDA2Obj/raw/main/pics/README/image-20210813134907705.png)](https://github.com/jhftss/IDA2Obj/blob/main/pics/README/image-20210813134907705.png)

**IDA2Obj** is a tool to implement **SBI (Static Binary Instrumentation)**.

The working flow is simple:

- Dump **object files (COFF)** directly from one executable **binary**.
- **Link** the **object files** into a new binary, almost the same as the old one.
- During the dumping process, you can **insert any data/code at any location**.
  - **SBI** is just one of the using scenarios, especially useful for black-box fuzzing.

## How to use

1. Prepare the enviroment:

- Set `AUTOIMPORT_COMPAT_IDA695 = YES` in the `idapython.cfg` to support the API with old IDA 6.x style.
- Install dependency: `pip install cough`

1. Create a folder as the workspace.
2. Copy the target binary which you want to fuzz into the workspace.
3. Load the binary into IDA Pro, choose **Load resources** and **manually load** to load **all** the segments from the binary.[![image-20210813134907705](https://github.com/jhftss/IDA2Obj/raw/main/pics/README/image-20210813134907705.png)](https://github.com/jhftss/IDA2Obj/blob/main/pics/README/image-20210813134907705.png)
4. Wait for the auto-analysis done.
5. Dump object files by running the script `MagicIDA/main.py`.

- The output object files will be inside `${workspace}/${module}/objs/afl`.
- If you create an empty file named `TRACE_MODE` inside the workspace, then the output object files will be inside `${workspace}/${module}/objs/trace`.
- By the way, it will also generate 3 files inside `${workspace}/${module}` :
  - exports\_afl.def (used for linking)
  - exports\_trace.def (used for linking)
  - hint.txt (used for patching)

1. Generate lib files by running the script `utils/LibImports.py`.

- The output lib files will be inside `${workspace}/${module}/libs`, used for linking later.

1. Open a terminal and change the directory to the workspace.
2. Link all the object files and lib files by using `utils/link.bat`.

- e.g. `utils/link.bat GdiPlus dll afl /RELEASE`
- It will generate the new binary with the pdb file inside `${workspace}/${module}`.

1. Patch the new built binary by using `utils/PatchPEHeader.py`.

- e.g. `utils/PatchPEHeader.py GdiPlus/GdiPlus.afl.dll`
- For the first time, you may need to run `utils/register_msdia_run_as_administrator.bat` as administrator.

1. Run & Fuzz.

## More details

**HITB Slides** : [https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/HITB2021SIN%20-%20IDA2Obj%20-%20Mickey%20Jin.pdf](https://github.com/jhftss/jhftss.github.io/blob/main/res/slides/HITB2021SIN%20-%20IDA2Obj%20-%20Mickey%20Jin.pdf)

**Demo** : [https://drive.google.com/file/d/1N3DXJCts5jG0Y5B92CrJOTIHedWyEQKr/view?usp=sharing](https://drive.google.com/file/d/1N3DXJCts5jG0Y5B92CrJOTIHedWyEQKr/view?usp=sharing)

## GitHub:

[https://github.com/jhftss/IDA2Obj](https://github.com/jhftss/IDA2Obj)