Cerberus is the tool you want to use to make RUST and GO static analysis a lot easier.
Based on hashing and scoring systems, it can retrieve lots of symbol names.
After analyzing your ELF/PE binary to find the used libraries, Cerberus will download and build them.
Then the tool will hash (in various ways) the functions in your file and in the libraries to make matches.
Installation
Download a release
Build the tool with Docker
Build the tool on host
How to use ?
Syntax
Parameters
Flags
Example
Warning
Check the Releases tab on the Github project and download the latest one.
- Clone the repository
git clone https://github.com/h311d1n3r/Cerberus && cd cerberus
. - Check the available Dockerfiles under
Cerberus/docker/{OS}
. - Build the docker image of your choice
docker build -f ./docker/{OS}/Dockerfile-{version} .
. - You can run Cerberus from inside the docker or extract the binary on your host. This second choice needs to install the libraries listed in this section.
- You need to have libarchive, libcurl4-openssl, zlib1g, libelf and the uuid-dev libraries installed on your system.
With APT just doapt -y install libarchive-dev libcurl4-openssl-dev zlib1g-dev libelf-dev
- Clone the repository
git clone https://github.com/h311d1n3r/Cerberus && cd cerberus
. - Initialize git dependencies :
git submodule update --init
- Create the build directory
mkdir build && cd build
. - Run CMake to configure the project
cmake ..
. - Run make to compile the project
make
.
cerberus binary [-param value] [--flag]
output
-> Specifies the path for the resulting ELF file.
part_hash_len
-> Specifies the length of a part hash
. The part hash
of a function is just a reduction of the function with a linear pace.
This technique is used to prevent fixed addresses from corrupting a standard hash. Default value : 20
part_hash_trust
-> Specifies minimum ratio of similarity between the two hashed functions to compare. The kept function will be the one with the most matches anyway.
Increasing this value will reduce the number of matched functions but speed up execution time. Default value : 0.6
min_func_size
-> The minimum length a function must be to get analyzed. Decreasing this value will increase matches but also false positives. Default value : 10
help
-> Displays a help message.
debug
-> Displays outputs of commands.
no-prompt
-> Automatically skips user prompts.
The following command will try to unstrip the file ./rust_example into a new ELF called ./rust_example_syms.
cerberus ./rust_example -output ./rust_example_syms
Here is a comparison of the main function in the two files using Binary Ninja :
This software must only be used to carry out lawful experiments and I am not responsible for any breach of this rule !