Sponsored by BindView
  Razor Home Razor Home Papers & Advisories Papers & Advisories Razor Tools Presentations Razor Tools Tools  

 fenris 0.07-m (6/24/2002)

by Michal Zalewski and other community contributors

Description
Fenris is a multipurpose tracer, GUI debugger, stateful analyzer and partial decompiler intended to simplify bug tracking, security audits, code, algorithm, protocol analysis and computer forensics - providing a structural program trace, interactive debugging capabilities, general information about internal constructions, execution path, memory operations, I/O, conditional expressions and much more. Because it does not require sources or any particular compilation method, this multi-component project can be very helpful for black-box tests and evaluations - but it will also be a great tool for open-source project audits, as an unmatched real-time reconnaissance tool - especially when sources are too complex or too badly written to be analyzed by hand in a reliable way and reasonable time. Fenris does not rely on GNU libbfd for any critical tasks, and because of that, it is possible and feasible to trace and analyze binaries modified to fool debuggers, crypted, or otherwise tweaked. Fenris components also support other, independent debuggers or disassemblers, thanks to its capabilities to reconstruct symbol tables for stripped, static binaries with no debugging or symbol information whatsoever.

This project is not intended to find problems, bugs or security vulnerabilities automatically. It is supposed to be a reliable, useful tool that works in real world and can deliver valuable information which can be used to detect known problems, but also to spot unique or not so obvious dynamic conditions. Among many other features, Fenris is able to perform traditional, instruction by instruction or breakpoint to breakpoint interactive debugging enhanced by additional structural data about the code delivered to the user; it is able to fingerprint functions in static binaries, reconstruct symbol tables in ELF files based on that information, automatically detect common library code; able to deliver text-based and graphical, browsable output that documents different aspects of program activity on different abstraction layers; able to perform partial analysis of single structural blocks. It is designed to make things easier, filling the gap between existing code analysis and debugging tools - but not to replace all of them. To read more about its functionality, approach, usage and limitations, please click here.

Demo and download
To see a brief demonstration of Fenris features, you can follow this link. Graphics-capable browser is strongly recommended.

Last stable version of Fenris can be downloaded here. For most recent, but not always stable and not official code snapshots, please visit my development page.

Project status, news, credits
This code is distributed under terms and conditions of GNU Public License, version 2. It is usable, but certainly not finished. It lacks support for certain calls, needs to be ported to platforms other than Linux/x86 and needs to support compilers other than GCC framework. RAZOR believes that this project can and will benefit from being an open-source development, and because of that, we encourage all developers who find this code interesting to contribute and make it better.

Fenris has proven its usability in The Reverse Challenge from Project Honeynet. Click here for brief hints for the contestans on using this tool to make computer forensics easier.

06-25-2002
0.07-m: maintenance release: new fingeprints, bug-fixes
05-31-2002
0.06: SoftICE-alike GUI debugger, improved speed, new features
05-23-2002
0.05: interactive debugging capabilities introduced, burneye tracing
05-17-2002
0.03: some enhancements, new component ("dress") added
05-09-2002
0.02: many fixes, new fingerprints, options, optimizations
02-13-2002
initial 0.01 release

Below is the list of people outside RAZOR who contributed to the project by providing their comments, suggestions, criticism or developing new code:

Jose Nazario
Rafal Wojtczuk
dvorak
Mariusz Woloszyn
bighawk
Slawomir Krawczyk
Wojtek Kaniewski
Bulba
Solar Designer
Wojtek Walczak
Martin Kluge
Lluis Mora Hidalgo
dataspy
Jim Paris
Andrzej Szombierski
undefine
Robert W. Jaroszuk
Joe Van Andel
Neil Jerram
Hubert Lubaczewski
Yair K
Gregory Wright
Adam Byrtek
Gordon Sadler
Roger Luethi
Mariusz Marcinkiewicz
Lukasz Trabinski
Piotr Meyer
Fabio Vayr
Han Holl
Brian Finn
Gandalf
Piter
Krzysztof Gibas
Matthias Hofherr
Marcin Kaminski
Artur Byszko
Lukasz Biegaj
Przemyslaw Skowron
Gonçalo Gomes
Timothy Bogdala
Allen Noe
piggy
Stephen Kench
Bartlomiej Lidke
Marek Gutkowski
Tadeusz Wlodarczyk
Marcin Gozdalik
William Stearns
Greg
Dave Aitel
Daniel Polombo
lucipher
GoTaR
Paul van Maaren
Peter Lopen



Contact:   info@razor.bindview.com | Fax: 508-485-0737 | Bindview Home