A fast IDA Pro plugin that finds calls to insecure API functions in binaries to aid vulnerability research.
Rhabdomancer is a headless IDA Pro plugin that automatically locates calls to potentially insecure API functions within binary files. It helps vulnerability researchers quickly identify candidate points from which to backtrace and find pathways to untrusted input, streamlining the initial stages of security assessment.
Vulnerability researchers and security auditors who use IDA Pro for binary analysis and need to efficiently identify potential security vulnerabilities in C/C++ binaries.
Developers choose Rhabdomancer for its blazing-fast, headless operation using IDA Pro 9.x and Binarly's idalib Rust bindings, its prioritized findings grouped into three tiers of badness to focus audit efforts, and its easily customizable rule set via a TOML configuration file.
Vulnerability research assistant that locates calls to potentially insecure API functions in a binary file.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages IDA Pro 9.x and Binarly's idalib Rust bindings for speed, enabling quick analysis without GUI overhead, as highlighted in the README's features section.
Groups insecure API functions into high, medium, and low priority tiers to help auditors focus on critical areas first, based on the configured TOML rules mentioned in the features.
Allows easy customization of tracked API functions via a TOML file, with the ability to override the default configuration using the RHABDOMANCER_CONFIG environment variable, as noted in the usage instructions.
Prints call locations to stdout and marks them directly in the IDA database with comments, streamlining follow-up analysis in IDA Pro's Bookmarks window, per the usage steps.
Requires a licensed copy of IDA Pro 9.x, which is proprietary and expensive, limiting accessibility for users without such resources, as emphasized in the installation prerequisites.
Installation involves setting multiple environment variables (e.g., IDADIR, LIBCLANG_PATH) and dependencies like LLVM/Clang, which can be error-prone, especially on Windows, as detailed in the compiling section.
The README's TODO list mentions enriching the known bad API function list, indicating that the default rule set may be incomplete and require manual expansion for comprehensive coverage.