The release of the Rizin reverse engineering framework and its associated graphical interface Cutter has taken place. The Rizin project began as a fork of the Radare2 framework and has continued its development with an emphasis on a user-friendly API and a focus on code analysis without forensics. Since the fork, the project has transitioned to a fundamentally different session-saving mechanism (‘projects’) based on serialization. In addition, the codebase has been significantly restructured for ease of maintenance. The project code is written in C and is distributed under the LGPLv3 license.
The graphical interface Cutter is written in C++ using Qt and is distributed under the GPLv3 license. Cutter, like Rizin itself, is aimed at the reverse engineering process of programs in machine code or bytecode (such as JVM or PYC). There are decompilation plugins available for Cutter/Rizin based on Ghidra, JSdec, and RetDec.
In the new release:
- Support for creating FLIRT signatures has been added, which can then be loaded into IDA Pro;
- A database of standard signatures for popular libraries has been included;
- Improved recognition of functions and strings in executable files for Go targeting x86/x64/PowerPC/MIPS/ARM/RISC-V;
- A new intermediate representation language, RzIL, based on BAP Core Theory (SMT-like language), has been implemented;
- The ability to auto-determine the base address for 'raw' files has been added;
- Support for loading memory 'snapshots' in debug mode based on Windows PageDump/Minidump formats has been implemented;
- Improved compatibility with remote debuggers based on WinDbg/KD.
- Currently, support for architectures ARMv7/ARMv8, AVR, 6052, brainfuck has been ported to the new RzIL. The next release plans to complete the port for SuperH, PowerPC, and partially x86.
Also additionally released are:
- rz-libyara – a plugin for Rizin/Cutter for supporting the loading and creation of signatures in Yara format;
- rz-libdemangle – a library for demangling function names for C++/ObjC/Rust/Swift/Java;
- rz-ghidra – a plugin for Rizin/Cutter for decompilation (based on Ghidra's C++ code);
- jsdec – a plugin for Rizin/Cutter for decompilation of original development;
- rz-retdec – a plugin for Rizin/Cutter for decompilation (based on RetDec);
- rz-tracetest – a utility for cross-checking the correctness of the translation of machine code to RzIL by comparing it with the trace of emulation (based on QEMU, VICE).
Source: opennet.ru
