// readme

rhabdomancer

“The road to exploitable bugs is paved with unexploitable bugs.”

— Mark Dowd

Rhabdomancer is a blazing-fast IDA headless plugin that locates calls to potentially insecure API functions in a binary file. Auditors can backtrace from these candidate points to find pathways allowing access to untrusted input.

Features

  • Blazing-fast, headless user experience courtesy of IDA 9.x and idalib-rs Rust bindings.
  • Support for C/C++ binary targets compiled for any architecture implemented by IDA.
  • Bad API function call locations are printed to stdout and marked in the IDB.
    • Call locations in library code recognized by IDA (e.g., a statically linked runtime matched by FLIRT signatures) are labeled (lib).
    • Calls through stubs (e.g., the .plt entries of ELF binaries or the import stubs of PE and Mach-O binaries, listed as thunks) are traced back to their callers.
    • In ELF binaries, a function is deliberately listed twice with the same call locations: once as its .plt stub (marked as thunk) and once as its import. Each call location is marked only once in the IDB.
  • Known bad API functions are grouped in tiers of badness to help prioritize…