Tag: News

This version of Cerbero Suite comes with a variety of improvements:

• We have greatly improved macOS support and squashed all the bugs we could find.
• We have improved the hex editor: it can now open folders and on Windows it can edit logical drives, physical disks and the memory of processes.
• We have further improved the native UI for Ghidra.
• We have improved the ARM64 support in our Carbon disassembler.
• We have improved the entropy view.
• We have improved system integration on Windows and macOS and theme support.

This is the full list of news for version 4.7:

– added open folder to hex editor
– added open drive/disk to hex editor on Windows
– added open process to hex editor on Windows
– added system settings
– improved native Ghidra UI
– improved ARM64 disassembly
– improved entropy view
– small improvements to the GZ format support
– improved theme support
– fixed Ghidra Native UI execution on macOS
– fixed UI glitches on macOS
– fixed some bugs

Hex Editor

It is now possible to open an entire folder in the hex editor, either by context menu, command line or UI.

Furthermore, on Windows it is also possible to edit logical drives, physical disks and the memory of processes.

Logical drives:

Physical disks:

Processes:

Improved native UI for Ghidra

Now, when launching the native UI for Ghidra, the Java UI is automatically minimized (configurable from the settings). You can create and delete functions, and we try to keep the function list view updated without having to do a manual refresh. You can switch back to the Java UI from the native UI and you can also launch an additional native UI directly from the native UI.

Improved Carbon ARM64 support

We have improved ARM64 support in our Carbon disassembler in order to recognize additional multi-instruction jump patterns.

Improved entropy view

We have improved our entropy view making it dependent from the parent view and enabling clicks on it. When you click somewhere on the plot it will bring you to the point in the hex editor of the entropy you want to inspect.

System Settings

On both Windows and macOS it’s now possible to configure the integration of Cerbero Suite with the Explorer/Finder context menu.

Up until now, on Windows it was possible to configure the integration with Explorer only during the setup and not at a granular level.

Windows:

macOS:

You can now access the tools of Cerbero Suite directly from the context menu of Finder:

Improved theme support

Since on macOS the native system style may result in cluttered UIs, we have introduced an additional theme called “Fusion”. It comes with the same colors as the default theme, but with a different style for widgets.

Default theme on macOS:

Fusion theme:

If we see that our users prefer this theme, we might make it the default one on macOS.

Improved macOS support

Apart from adding system integration and improving theme support for macOS, we have also squashed all the macOS bugs we could find. We fixed some UI glitches and a bug which affected the launch of the native Ghidra UI on macOS. The UI experience on macOS should be a smooth one now!

Because of some bureaucratic slowdowns this release took longer than usual. On the upside, it comes packed with news!

We have added support for the XLSB format (via pyxlsb2), so that now Cerbero Suite decompiles both XLS and XLSB formulas. Not only that, Cerbero Suite now previews spreadsheets even better than Microsoft Excel does!

But even more exciting, we have introduced the Silicon Excel Emulator to emulate Microsoft Excel formulas.

In order to emulate a formula, it’s enough to select it in the spreadsheet and to press “Ctrl+E” (or using the context menu).

While the emulator doesn’t support all the functions available in Excel, we made it extremely simple to extend it from Python. When a function is not supported, the emulator simply prints out its arguments:

warning: unimplemented function 'CALL'
    arg_0: "Shell32"
    arg_1: "ShellExecuteA"
    arg_2: "JJCCCCJ"
    arg_3: 0
    arg_4: "Open"
    arg_5: "C:\ProgramData\nCjBmqQ.exe"
    arg_6: 
    arg_7: 0
    arg_8: 0

In most cases, this is enough to understand what’s happening. When it isn’t and we need something more, we can easily hook into the emulator engine via Python and extend it:

from Pro.SiliconSpreadsheet import *
from Pro.UI import proContext

class EmulatorHelper(SiliconExcelEmulatorHelper):

    def __init__(self):
        super(EmulatorHelper, self).__init__()
        
    def evaluateFunction(self, emu, ctx, opts, depth, e):
        function_name = e.toString()
        print(function_name)
        return SiliconExcelEmulatorValue()

v = proContext().findView("Analysis [file name]")
if v.isValid():
    view = SiliconSpreadsheetWorkspaceView(v)
    helper = EmulatorHelper()
    emu = view.getExcelEmulator()
    emu.setHelper(helper)
else:
    print("error: couldn't find view")

This little snippet of Python code does nothing else than to hook the Silicon Excel Emulator being used in a spreadsheet preview and to log every function being called. We can, however, just as easily modify the behavior of a function or implement its functionality by returning a valid value. We’ll show you how to do this in future articles and videos.

The new version of Cerbero Suite comes also with other improvements. For instance, it is now possible to edit the prototype of functions in the decompiler by pressing “Y”.

And you can now edit the prototype of a function in the same way also in the native UI for Ghidra.

This is the complete list of news for version 4.5:

– added spreadsheet preview for XLS and XLSB files
– added XLSB format support
+ added Microsoft Excel macro emulator
+ added editing of function prototypes in the decompiler
+ added editing of function prototypes in the native UI for Ghidra
+ improved Ghidra native UI
– improved XLS macro decompiler
– improved XLS format support
– exposed XLS classes to Python
– exposed new cell table view to Python
– minor improvements

We’ll soon publish material to demonstrate how to reverse engineer malicious Excel documents.

Happy hacking!

This time it took a bit longer for the release as we’re undergoing some organizational changes, but we’ll make up for it in the upcoming months!

This is the list of news for version 4.4:

– added Excel macro decompiler
– added word highlighting to text editor
– added password brute-forcers
+ improved C++ support in the decompiler
+ improved disassembly view
– improved detection of Excel malware

Excel Macro Decompiler

The major news of this release is the addition of a decompiler for Excel macros. We’ll continue to build and improve upon this feature in the upcoming releases!

C++ Decompiler Improvements

We have improved C++ support in the decompiler. A small improvement makes the code much easier to read!

Text Editor: Word Highlighting

Cerbero Suite now provides the word highlighting feature available in the disassembly/decompiler also in the text editor. This makes the analysis of VBA macros, JavaScript and other managed languages much easier.

Password Brute-Forcers

“infected” is such an ubiquitous password for sharing Zip archives containing malware that starting with this release you don’t even have to enter it when opening a file.

We’ve also added optional common passwords dictionary-based brute-forcers as a bonus. You can activate them from the extensions page.

More is coming soon…

Happy hacking!

Cerbero Suite 4.3 is out and it comes with Decryption of Microsoft Office Documents!

– added Microsoft Office document decryption
– improved CFBF support
– minor improvements
– fixed bugs

More is coming soon…

Happy hacking!

The new version of Cerbero Suite is out with the following news:

– added CAB format support
– added convert/from_array and convert/to_array filters
– added detection of external resources in Office documents
+ improved renaming of variables in the decompiler
– improved dev/array filter
– included OpenSSL executable
– fixed bugs

We’ll be soon publishing videos detailing some of these additions!

The new version of Cerbero Suite is out with the following news:

+ added Carbon option to import PDB types into the project header
+ improved x86/x64 decompiler
– fixed bugs

The option in Carbon to import types into the header of a project when loading a PDB comes handy when a crash dump is associated to a structure.

In this case the BugCheck information tells us that at a specific address there’s an EPROCESS structure. By importing the types along with the symbols of ntoskrnl.exe, we import the correct EPROCESS structure to map onto memory.

Of course, Cerbero Suite contains kernel symbols for all version of Windows x86/x64, but by relying on the structures in the PDB we don’t need to load the correct Windows header from the headers folder: just import the types and then open the header of the project!

We’re happy to announce the release of Cerbero Suite 3.4!

This release comes with tons of improvements:

– added script editor for Python and JavaScript
– added Python editor workspace
– added Python snippet action
– added Mariana theme
– improved deployment on OS X
+ improved Ghidra native UI
– improved filters
– improved hex workspace
– improved JS debugger
– improved Monokai theme
+ updated Ghidra support to 9.1-BETA
– fixed Header Manager crash due to themes
– fixed some bugs

As you can see from the screen-shots in this post, we have introduced the Mariana theme. I think it’s even easier on the eyes, than the Monokai one.

The Ghidra native UI is now compatible with the latest 9.1-BETA and has been further improved!

Deployment on OS X has been greatly improved by removing the external Python dependency. Just as in the Windows and Linux version, the OS X version now embeds Python.

Also interesting for OS X users: a new instance of Cerbero can be spawned from anywhere in the program by pressing Ctrl+Alt+N (or by clicking the relative toolbar button). This works on other platforms as well, but on OS X it’s especially useful.

The main new feature is the introduction of a script editor for Python and JavaScript. You can open as many editor as you like in a single workspace by running the relative action (or in the case of the Python editor by clicking on on the toolbar button).

Script editors are intended to make writing scripts and executing them extremely fast. They provide a simple mechanism to save scripts and open them by just setting the name of the script. The JavaScript editor also offers a debugging shortcut.

To make the writing of scripts even easier, there’s a new action to insert a Python code snippet.

You can choose from a selection of useful snippets.

This is especially useful to avoid looking up the SDK even for simple things and in time the selection of snippets will grow.

We also improved and added new misc filters.

I personally played many CTFs using Cerbero Suite before working on this release and the improvements are directly related to that. I hope that our users will enjoy these improvements as much as we do!

Happy hacking!