Binary Ninja PE Utils
Bunch'a niche utilities for working with PE-based binaries.
Features
Resolve ordinal imports
Ordinal imports can be resolved to symbol names from external BNDBs. If you rename an exported function in the external BNDB, the name you defined will be used instead of the original export name.
Given an example import as shown below:
By loading a binary view for OLEAUT32.dll, we can update the import
names for the target binary view with the real name behind the import:
Synchronize symbol names and types across binaries
Types defined in external BNDBs can be transferred to the current binary view in order to aid with reversing.
Continuing from the above example, we can rename the arg of the function
SysStringLen from the external BNDB OLEAUT32.dll:
When synced, the IAT will be updated with the new argument:
We can also see that the new argument is exposed through other disassembly views, like MLIL:
As mentioned earlier, symbol names also get transferred between loaded BNDBs. Renaming the export from the external BNDB then resyncing, we can see that the changes is transferred to the target binary view:
