augur
A fast IDA Pro headless plugin that extracts strings and related pseudocode from binary files for reverse engineering.
What is augur?
Augur is a reverse engineering assistant that extracts strings and associated pseudocode from binary files. It operates as a headless plugin for IDA Pro, organizing decompiled function pseudocode into a structured directory tree based on string references to streamline vulnerability research.
Reverse engineers and security researchers who use IDA Pro for binary analysis and need to efficiently extract and organize pseudocode context around strings for vulnerability discovery.
Developers choose Augur for its blazing-fast, headless processing using IDA Pro 9.x and Rust bindings, and its organized output that automatically structures pseudocode by string references, accelerating analysis workflows.
Overview
Reverse engineering assistant that extracts strings and related pseudocode from a binary file.
Use Cases
Best For
- Extracting and organizing pseudocode from binaries for vulnerability research in a headless IDA Pro environment.
- Automating the collection of string-referencing function contexts to accelerate reverse engineering tasks.
- Processing binaries across multiple architectures supported by IDA Pro's Hex-Rays decompiler without a GUI.
- Integrating with existing IDA Pro workflows via Rust-based tooling for scriptable binary analysis.
- Storing decompiled function pseudocode in a clear directory structure for easy review and tool integration.
- Streamlining initial analysis phases by focusing on string cross-references to identify potential attack surfaces.
Not Ideal For
- Teams without an IDA Pro license or budget for proprietary tools
- Reverse engineers needing interactive, GUI-based disassembly and debugging
- Projects requiring comprehensive binary analysis beyond string cross-references, such as control flow or data flow analysis
- Environments where setup complexity (IDA Pro, LLVM/Clang) is a barrier
Pros & Cons
Pros
Leverages IDA Pro 9.x and Rust bindings for efficient, scriptable analysis without GUI overhead, as highlighted in the blog posts for streamlined workflows.
Works with any binary architecture supported by IDA Pro's Hex-Rays decompiler, ensuring broad compatibility for diverse targets.
Stores pseudocode in directories named after strings, making it easy to navigate and review extracted code contexts, as shown in the screenshot.
Uses the `decompile_to_file` API from haruspex for consistent pseudocode extraction, noted in the features for dependable results.
Cons
Requires IDA Pro with a valid license and LLVM/Clang, making setup costly and complex, especially on Windows with environment variable configurations.
Focuses only on functions referencing strings, missing other vulnerability research aspects like indirect calls or broader code patterns, as implied by the TODO list for future integrations.
The `traverse_xrefs` function may cause stack overflows or infinite loops in complex binaries, as admitted in the TODO list, requiring careful handling.
Frequently Asked Questions
Related Projects
rustscan🤖 The Modern Port Scanner 🤖
feroxbusterA fast, simple, recursive content discovery tool written in Rust.
rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.