CheckPointSW / Karta

Karta - source code assisted fast binary matching plugin for IDA

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

unable to recognize zlib and openssl in so file

Pr0214 opened this issue · comments

Dear developer, when I first saw this project, I was attracted by your ideas and it's prospects, but when I used it to test a so, it contains obvious zlib and openssl features, it Failed,.I'm so confused .Looking forward to hearing from you.
image
Karta Identifier - libnh.so:

Identified Open Sources:

(none)

Identified Closed Sources:

(none)

Missing Open Sources:

libpng: Was not found
zlib: Was not found
OpenSSL: Was not found
OpenSSH: Was not found
net-snmp: Was not found
gSOAP: Was not found
libxml2: Was not found
libtiff: Was not found
mDNSResponder: Was not found
MAC-Telnet: Was not found
libjpeg-turbo: Was not found
libjpeg: Was not found
icu: Was not found
libvpx: Was not found

Hi, I think there might be some misunderstanding about how Karta works. Karta was designed to find statically compiled open sources (such as zlib and OpenSSL) in binaries. While I don't have your libnh.so library to test against, it still looks like your dealing with dynamically linked libraries.

The IDA Pro decompiler snapshot that you've uploaded shows the function j_inflate(), which looks like IDA automatically identified the function's name, probably from the imports section. If zlib / OpenSSL are dynamically imported, than there is no need for Karta to match those functions, as they are already linked with symbols from the need to import them (as listed in the imports section).

If your binary includes some static compiled open sources in it, than Karta would be effective in identifying them, and matching them. As it seems that this isn't the case, I am closing this issue.