#analysis #panda #dynamic #callback #guest #bindings #syscalls

panda-re

The official library for interfacing with PANDA (Platform for Architecture-Neutral Dynamic Analysis)

45 breaking releases

0.48.0 Oct 31, 2024
0.46.2 Jan 31, 2024
0.46.1 Jul 12, 2023
0.46.0 Jan 3, 2023
0.3.0 Dec 18, 2020

#1 in #panda

Download history 36/week @ 2024-07-29 8/week @ 2024-08-05 1/week @ 2024-08-19 17/week @ 2024-08-26 140/week @ 2024-09-02 16/week @ 2024-09-09 33/week @ 2024-09-16 34/week @ 2024-09-23 20/week @ 2024-09-30 24/week @ 2024-10-07 16/week @ 2024-10-14 22/week @ 2024-10-21 138/week @ 2024-10-28 28/week @ 2024-11-04 22/week @ 2024-11-11

211 downloads per month

GPL-2.0 license

465KB
9K SLoC

panda-rs is a set of Rust bindings for PANDA.

The following are provided:

  • Callbacks to various PANDA events in the form of attribute macros
  • Callbacks for when guest syscalls happen
  • Bindings to various core PANDA plugins (hooks2, osi, etc)
  • Safe bindings to the core PANDA API
  • An API for driving PANDA via libpanda
  • Access to raw PANDA and QEMU API bindings via panda_sys

Feature flags:

  • libpanda - enable libpanda mode. This is used to allow for compiling as a binary that links against libpanda, for pypanda-style use.

Architecture-specific features

PANDA supports multiple architectures, but requires plugins to be compiled for each architecture. In order to target a specific guest arch, use exactly one of the following: x86_64, i386, arm, aarch64, mips, mipsel, mips64, ppc

Typically PANDA plugins forward each of these features in their Cargo.toml:

[features]
x86_64 = ["panda/x86_64"]
i386 = ["panda/i386"]
# ...

Callbacks

panda-rs makes extensive use of callbacks for handling analyses on various events. To use callbacks, you simply apply the callback's attribute to any functions which should be called for the given callback. In order to use a callback in a PANDA plugin (not to be confused with an application that uses libpanda), one function must be marked #[panda::init], otherwise the plugin will not work in PANDA.

Callbacks come in two forms: free form functions (which use the attribute macros) mentioned above) and closure callbacks, which use the Callback API.

libpanda Mode

PANDA also offers a dynamic library (libpanda). panda-rs allows linking against libpanda instead of linking as a PANDA plugin. This creates a executable that requires libpanda to run. To compile in libpanda mode, make sure the PANDA_PATH environment variable is set to your PANDA build folder.

Important Popular Callbacks Popular Plugins
init before_block_exec osi
Panda virt_mem_after_read proc_start_linux
[mod@hook] virt_mem_after_write hooks2
on_sys asid_changed guest_plugin_manager
uninit before_block_exec_invalidate_opt
regs insn_translate
PandaArgs insn_exec

Dependencies

~17MB
~475K SLoC