Examiner v0.5 ============= *> Intro The Examiner is a tool that uses objdump to generate a disassembled assembly file. It then parses through the file and comments on the disassembled source. This can be real useful head start when analyzing a foreign binary. This tool was originally created to assist in analyzing foreign binary executables placed on machines. It could have some additional purposes besides forensics such as simply reverse engineering a file when you don't have it's source. *> Features [] Automates objdump usage [] Can generate cross-reference files of functions, interrupts and other useful things [] Locates functions within the binary [] Understands the stack and comments on its state [] Can parse and understand the contents of the .rodata section [] Cross references .rodata calls and comments on them [] Locates .data pointer references to .rodata [] Provides an easy to read CALL syntax for comments [] Understands and looks up interrupts calls [] Utilizes Linux source headers to determine function names based on what interrupt is called [] Can differentiate all of the socketcall functions [] Can comment on some C like constants for function calls [] Separates functions based on ret calls [] Can recognize and attempts to decode UPX compressed binaries [] Can detect crippled ELF executables and burneye executables [] Recognizes symbols and will cross-reference dynamic libraries *> Supported Platforms Linux ELF binary executables. i386 platform - Fully tested FreeBSD i386 - Seems to work fine but the testing isn't as extensive OpenBSD i386 - Runs but doesn't do much <yet> *> HOW TO USE For more information on how to use Examiner please read the man page or the TUTORIAL. *> Special Thanks I would sincerely like to thank the HoneyNet project <http://projects.honeynet.org> for inspiring the create of this utility. Mike Hunter-Linville for testing And the Academic Underground for hosting some cool research <http://AcademicUnderground.org> *> Contact Info Craig Smith <csmith@cardinalsolutions.com> Project Site: <http://AcademicUnderground.org/examiner>
