The ERESI Reverse Engineering Software Interface is a unified multi-architecture binary analysis framework targeting operating systems based on the Executable & Linking Format (ELF) such as Linux, *BSD, Solaris, HP-UX, IRIX and BeOS.
ERESI is a general purpose hybrid framework : it includes both static analysis and runtime analysis capabilities. These features are accessed by primitives of the ERESI reverse engineering language which makes the framework more adaptable to the precise needs of her users. It brings an environment of choice for program analysis throught instrumentation, debugging, and tracing as it also provides more than ten exclusive major built-in features . ERESI can also be used for security auditing, hooking, integrity checking or logging binary programs. The project prones modularity and reusability of code and allows users to create their own project on top of the ERESI language interpreter in just a few lines. Among other features, the base code can display program graphs on demand using its automated flow analysis primitives. Our tools are enhanced for hardened or raw systems which have no executable data segments and no native debug API or even explicit program information.
The ERESI framework includes:
The ELF shell (elfsh), an interactive and scriptable ERESI interpreter dedicated to instrumentation of ELF binary files.
The Embedded ELF debugger (e2dbg), an interactive and scriptable high-performance userland debugger that works without standard debug API (namely without ptrace).
The Embedded ELF tracer (etrace), an interactive and scriptable userland tracer that works at full frequency of execution without generating traps.
The Kernel shell (kernsh), an interactive and scriptable userland ERESI interpreter to inject code and data in the OS kernel, but also infer, inspect and modify kernel structures directly in the ERESI language.
The Evarista static analyzer, a work in progress ERESI interpreter for program transformation and data-flow analysis of binary programs directly implemented in the ERESI language (no web page yet).
Beside those top-level components, the ERESI framework contains various libraries that can be used from one of the previously mentioned tools, or in a standalone third-party program:
libelfsh : the binary manipulation library on which ELFsh, E2dbg, and Etrace are based.
libe2dbg : the embedded debugger library which operates from inside the debuggee program.
libasm : the disassembly engine (x86 and sparc) that gives semantic attributes to instructions and operands.
libmjollnir : the code fingerprinting and graph manipulation library.
librevm : the Reverse Engineering Vector Machine, that contains the meta-language interpretor and the standard ERESI library.
libaspect : the type system and aspect library. It can define complex data-types to be manipulated ad-hoc by ERESI programs.
libedfmt : the ERESI debug format library which can convert dwarf and stabs debug formats to the ERESI debug format by automatically generating new ERESI types.
.::- Nov 30 2007 -::. ERESI reaches version 0.8a23 We have been working hard to do new improvements and factoring in the codebase. We now have new libraries in the tree: libstderesi: The ERESI standard library : a collection of 100+ builtin commands shared between many ERESI components. It was unmerged from librevm which is now only holding the ERESI language interpreter.
libetrace : The ERESI tracer library : a collection of generic routines to deal with program traces. It was unmerged from libelfsh which now only contains ELF dependent code. The next step is to make the Evarista static analyzer operational. We will reflect those latest changes on the web page as soon as possible.
