Skip to content

Commit ddc7ec6

Browse files
authored
Merge pull request #10 from syjcnss/doc/update-readme-file
Doc: update readme file
2 parents e9855d6 + bc25969 commit ddc7ec6

File tree

6 files changed

+124
-0
lines changed

6 files changed

+124
-0
lines changed

Diff for: README.md

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# Mothra
2+
3+
A Ghidra extension that supports EVM bytecode reverse engineering.
4+
5+
- [Mothra](#mothra)
6+
- [Features](#features)
7+
- [Installation](#installation)
8+
- [User](#user)
9+
- [Developer](#developer)
10+
- [Usage](#usage)
11+
- [Loader](#loader)
12+
- [Analyzer](#analyzer)
13+
- [Contribution](#contribution)
14+
- [Fork the Repository](#fork-the-repository)
15+
- [Create a Branch](#create-a-branch)
16+
- [Create PR on GitHub](#create-pr-on-github)
17+
18+
## Features
19+
20+
Ghidra is an open-source interactive reverse engineering tool that provides features including disassembly, control flow graphs, decompilation, and scripting support in Java or Python for automated analysis.
21+
22+
However, it does not natively support the EVM architecture, a big-endian machine with a unique 256-bit word size, unlike traditional architectures such as x86, ARM, or MIPS.
23+
24+
To address this limitation, Mothra extends Ghidra with support for the 256-bit word size and introduces EVM analyzers to facilitate reverse engineering of EVM bytecode.
25+
26+
+ Supports 256-bit word size for EVM architecture compatibility
27+
+ Compatible with all EVM opcodes, including those introduced in the Cancun upgrade
28+
+ Custom loader enabling users to provide contract addresses or bytecode for analysis
29+
+ Decodes and displays smart contract metadata
30+
+ Identifies all internal function boundaries
31+
+ Determines the number of input arguments for internal functions
32+
+ Detects function dispatch patterns and labels function selectors
33+
34+
## Installation
35+
36+
Download Ghidra, please refers to the `Install` section
37+
38+
### User
39+
40+
1. Download the latest Mothra release package to the `Mothra/dist/` directory.
41+
2. Launch Ghidra using the command `./ghidraRun` (refer to the Ghidra documentation for more details).
42+
3. Navigate to the `File` menu and select `Install Extensions`.
43+
4. Click the green `+` button and choose the zip file downloaded in step 1.
44+
5. Click `OK` and restart Ghidra.
45+
6. Begin reverse engineering with Mothra!
46+
47+
Installation Guidance
48+
49+
![Installation-1](./images/Installation-1.png)
50+
51+
Click on the `File` menu and select `Install Extension`.
52+
53+
![Installation-2](./images/Installation-2.png)
54+
55+
Click the green `+` button and select the release package.
56+
57+
### Developer
58+
1. Download and install the Eclipse IDE for Java development.
59+
2. Set up the `GhidraDev` extension in Eclipse.
60+
3. Clone or fork this repository to your local machine.
61+
4. In Eclipse, navigate to the `GhidraDev` options, click `Ghidra Module Source`, and select this repository.
62+
5. The repository will appear in the Eclipse IDE.
63+
6. Go to the `Run` menu, select `Run As`, and choose the first option (not the headless option).
64+
7. Mothra will launch - start reverse engineering
65+
with Mothra!
66+
67+
Installation Guidance
68+
69+
![Installation](./images/Installation-3.png)
70+
71+
Select the `Run` menu, then choose `Run As`, and pick the first option.
72+
73+
## Usage
74+
75+
### Loader
76+
77+
Our team developed a custom loader that allows users to provide either (1) a contract address or (2) contract bytecode.
78+
79+
To use it, click on the `File` menu and select `Download Bytecode`. The loader supports two modes:
80+
81+
1. `By Address`: Select the network, provide the contract address, enter the desired file name, and click `By Address`.
82+
83+
2. `By Bytecode`: Enter the desired file name, input the contract bytecode, and click `By Bytecode`.
84+
85+
The contract metadata is automatically decoded and displayed. The structure and content of the metadata are detailed here.
86+
87+
![Smart Contract Metadata Decoding](./images/Metadata.png)
88+
89+
### Analyzer
90+
91+
Several analyzers are supported, and their descriptions are provided below:
92+
93+
| Analyzer Name | Analyzer Description |
94+
|-----------------------------------|------------------------------------------------------------------------------------------------------|
95+
| EVM Function Analyzer | Identifies the boundaries for all internal functions. |
96+
| [EVM Bit Extend Analyzer](https://github.com/syjcnss/Mothra/pull/8) | Detects data types exceeding Ghidra's 64-bit limit, extends functionality using bit operations, and labels them in Mothra for clarity. |
97+
| [Internal Function Arguments Analyzer](https://github.com/syjcnss/Mothra/pull/9) | Detects the number of input arguments for internal functions. |
98+
| [Function Selector Analyzer](https://github.com/syjcnss/Mothra/pull/7) | Detects function dispatching patterns, extracts function selectors, and labels them for clarity. |
99+
100+
Analyzer Menu: The analyzers developed by us are selected by default.
101+
102+
![Analyzer Menu](./images/Analyzer.png)
103+
104+
## Contribution
105+
106+
Thank you for considering contributing to this project! We welcome contributions of all kinds, including bug fixes, new features, documentation improvements, and more.
107+
108+
There are some guideline for contribution:
109+
110+
### Fork the Repository
111+
112+
+ Fork the project repository by clicking the Fork button on GitHub.
113+
+ Clone your forked repository to your local machine.
114+
115+
### Create a Branch
116+
+ Create a new branch for your changes
117+
+ Use a descriptive name for your branch (e.g., `fix/issue-123` or `feature/add-login`).
118+
119+
### Create PR on GitHub
120+
+ Push your branch to your forked repository
121+
+ Submit a Pull Request
122+
+ describe your changes clearly in the pull request, please include `summary`, `description` and `verification` section.
123+
124+
Examples: [Feat: add function selector analyzer](https://github.com/syjcnss/Mothra/pull/7)

Diff for: images/Analyzer.png

219 KB
Loading

Diff for: images/Installation-1.png

322 KB
Loading

Diff for: images/Installation-2.png

392 KB
Loading

Diff for: images/Installation-3.png

1.06 MB
Loading

Diff for: images/Metadata.png

118 KB
Loading

0 commit comments

Comments
 (0)