elm3nt/argon repository overview

⁠Argon

An automation tool to generate, obfuscate, compile and run symbolic execution on c source files

⁠Features

• Generate sample c source code with activation codes and passwords based authentication using Tigress⁠
• Compile c source files with different optimization levels using GCC⁠ and run it
• Compile c source files to bytecodes using Clang⁠
• Run symbolic execution using Angr⁠ and Klee⁠
• Generate analysis report of symbolic execution and run time

⁠Quick start

Install Docker⁠ and follow the commands

$ mkdir workspace
$ cd workspace
$ mkdir out
$ docker run -v $(pwd):/home/argon/workspace -ti --name=argon elm3nt/argon
$ cd ~/workspace

Above command downloads Argon image - elm3nt/argon⁠ from Docker Hub. Then it mounts workspace directory created in host machine to the container's home directory. This helps to easly access benchmark and test results files from host machine. For argon command line help refer to cli README⁠.

⁠Generate c source file with authentication function

Generate sample c source file using Tigress randomFunc option. You can provide either activation codes or passwords or both for authentication function.

Syntax

$ argon generate -o [output c file path] -c [code] -p [password]

Note: Please make sure you specify filename with c extension in output path

Example

$ argon generate -o out/code.c -c 18
$ argon generate -o out/password.c -p secret
$ argon generate -o out/codepass.c -c 18 -p secret

⁠Obfuscate generated c source file

Obfuscate generated c source file with Tigress transformations (Abstract, Control flow, Data and Virtualization). Use short code of each transformations. For e.g. A, C, D, V or any combinations of short codes such as AC, ADC, DACV.

Note: Make sure you use generated c source file from generate command. Your custom c source file might not work.

Syntax

$ argon obfuscate -i [input C file path] -o [output directory path] -nv [number of variants] -ol [obfuscation list]

Example

$ argon obfuscate -i out/codepass.c -o out/obs -nv 5 -ol A AC ADC DACV

⁠Execution time analysis

It takes input as c source file(s). You can provide single c source file path. Or if you provide directory path, it will recursively search for c source files in that direcotry. Then these c source files are compiled using GCC with provided optimiazation levels 0, 1, 2, 3, s, fast in the options. The analysis report is saved in analysis.csv file of output path.

Syntax to compile and execute c source file

$ argon run -i [input C file/dir path] -o [output directory path] -ol {0|1|2|3|s|fast} -c [code] -p [password]

Example

$ argon run -i out/codepass.c -o out/out-code -ol 0 1  -c 18
$ argon run -i out/codepass.c -o out/out-codepass -ol 0 1 2 3 s fast -c 18 -p secret

Analysis report

⁠Symbolic execution analysis

Generate symbolic execution analysis report of c source files using Klee or Angr or both. It takes input as c source file(s). You can provide single c source file path. Or if you provide directory path, it will recursively search for c source files in that direcotry. The analysis report is saved in analysis.csv file of output path.

• A c source file must have either c args based authentication or c standard stdin (e.g. scanf) based authentication or both
• If source program has c args based authentication, the command requires number of arguments and length of argument to perform symbolic execution
• Similarly if source program has c stdin based authentication, number of standard inputs and length of standard input is required
• If source file has both args and stdin based authentication provide both of them
• If you want validate whether symbolic execution tools cracked activation codes and passwords correctly, provide activation codes and passwords at the command
• Angr can run symbolic execution both for c source file and executable file with .out .exe extensions

Syntax

$ argon (angr|klee|all) -i [input C file/dir path] -o [output directory path] -na [number of arguments] -la [length of argument] -ni [number of inputs] -li [length of input] -c [authentication codes] -p [authentication passwords]

Example

$ argon angr -i out/password.c -o out/out-angr-password -ni 1 -li 6  # Does not verify password after running symbolic execution
$ argon klee -i out/obs/codepass/AC -o out/out-klee-ac -na 1 -la 2 -ni 1 -li 6 -c 18 -p secret # Varifies activation codes and password after running symbolic execution

Run symbolic execution using Angr, Klee and notes execution time as well

$ argon all -i out/obs/codepass/A -o out/out-all-a -na 1 -la 2 -ni 1 -li 8 -c 18 -p secret

Analysis report

⁠Authors

• Deepak Adhikari⁠
• Justin Nguyen⁠

⁠License

This source code is released under the MIT License⁠