Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remote sync changes in Java code #7

Closed
mirek186 opened this issue Aug 9, 2024 · 4 comments
Closed

Remote sync changes in Java code #7

mirek186 opened this issue Aug 9, 2024 · 4 comments

Comments

@mirek186
Copy link

mirek186 commented Aug 9, 2024

Thanks a lot for the remote code change in the x64dbg plugin.
While testing I've spotted a few minor issues to fix.

  • The code is working, but there are no docs about the config file format being json but I've figured, e.g.
{
"X64SYNC_HOST":"192.168.56.125",
"X64SYNC_PORT":9100
}
  • I'm running Ghidra on Kali Linux and the Java code also needs a config file where you can specify HOST, PORT or the workaround for now, I'm just listening on all interfaces with the following change in Listener.java
    this.serverSocket = new ServerSocket(PORT, 0, InetAddress.getByAddress(new byte[] {0x00,0x00,0x00,0x00}));
  • Last change to get it to work is x64dbg plugin sends a full path of the module and when analyzing files in Ghidra, those are not in the same location, so the solution is to only compare filename, I know you might name clash but I think it's rare but I can't see another way around unless you want to recreate Windows folder structures on Linux. So there are two files LocationSync.java and HyperSync.java with the following changes:
for(; i < openpg.length; i++) {
                        String local_name = openpg[i].getExecutablePath().substring(openpg[i].getExecutablePath().lastIndexOf("/")+1);
                        String remote_name = ra.modPath.substring(ra.modPath.lastIndexOf("\\")+1);
                        if(local_name.equals(remote_name))
                        //if(openpg[i].getExecutablePath().substring(1).replace("/", "\\").equals(ra.modPath))
                                break;
                }

With the above it's all working brilliantly, big thank you for the plugin !!!
ghidra1

@diommsantos
Copy link
Owner

diommsantos commented Aug 9, 2024

  • I wrote the documentation for config.sync at Configuration. If you find it confusing or difficult to follow please give me some feedback on how I can improve it or submit a pull request :)
  • Ghidra has also a config file, if both Ghidra and x64Dbg are on the same file system is the same config.sync file. The variables relevant for Ghidra are: GSYNC_HOST and GSYNC_PORT. In your case you would write in your config.sync file in the Kali machine (should be located in $HOME/config.sync):
{
"GSYNC_HOST": "0.0.0.0",
"GSYNC_PORT":9100
}
  • Hadn't though about that problem when I allowed remote connections, I think that sending file hashes instead of file path would be a good solution that avoids naming collisions and allows the files to be on different file systems. I'll add this point to the TODO list

Thank you, if you like the plugin don't forget to share it ;)

@diommsantos
Copy link
Owner

I have implemented that instead of sending the module full path, it sends the module MD5 hash. This avoids name collisions and the paths being on different locations in the case of remote connections.

@mirek186
Copy link
Author

Hi,

I can confirm that everything is working really well. I've tested both 32 and 64 version. The config file also works fine. The only thing I've noticed I had to use : not = for the JSON config file but in the docs you have =

@diommsantos
Copy link
Owner

Replaced the = for : in the docs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants