|
| 1 | +# Mothra |
| 2 | + |
| 3 | +A Ghidra extension that supports EVM bytecode reverse engineering. |
| 4 | + |
| 5 | +- [Mothra](#mothra) |
| 6 | + - [Features](#features) |
| 7 | + - [Installation](#installation) |
| 8 | + - [User](#user) |
| 9 | + - [Developer](#developer) |
| 10 | + - [Usage](#usage) |
| 11 | + - [Loader](#loader) |
| 12 | + - [Analyzer](#analyzer) |
| 13 | + - [Contribution](#contribution) |
| 14 | + - [Fork the Repository](#fork-the-repository) |
| 15 | + - [Create a Branch](#create-a-branch) |
| 16 | + - [Create PR on GitHub](#create-pr-on-github) |
| 17 | + |
| 18 | +## Features |
| 19 | + |
| 20 | +Ghidra is an open-source interactive reverse engineering tool that provides features including disassembly, control flow graphs, decompilation, and scripting support in Java or Python for automated analysis. |
| 21 | + |
| 22 | +However, it does not natively support the EVM architecture, a big-endian machine with a unique 256-bit word size, unlike traditional architectures such as x86, ARM, or MIPS. |
| 23 | + |
| 24 | +To address this limitation, Mothra extends Ghidra with support for the 256-bit word size and introduces EVM analyzers to facilitate reverse engineering of EVM bytecode. |
| 25 | + |
| 26 | ++ Supports 256-bit word size for EVM architecture compatibility |
| 27 | ++ Compatible with all EVM opcodes, including those introduced in the Cancun upgrade |
| 28 | ++ Custom loader enabling users to provide contract addresses or bytecode for analysis |
| 29 | ++ Decodes and displays smart contract metadata |
| 30 | ++ Identifies all internal function boundaries |
| 31 | ++ Determines the number of input arguments for internal functions |
| 32 | ++ Detects function dispatch patterns and labels function selectors |
| 33 | + |
| 34 | +## Installation |
| 35 | + |
| 36 | +Download Ghidra, please refers to the `Install` section |
| 37 | + |
| 38 | +### User |
| 39 | + |
| 40 | +1. Download the latest Mothra release package to the `Mothra/dist/` directory. |
| 41 | +2. Launch Ghidra using the command `./ghidraRun` (refer to the Ghidra documentation for more details). |
| 42 | +3. Navigate to the `File` menu and select `Install Extensions`. |
| 43 | +4. Click the green `+` button and choose the zip file downloaded in step 1. |
| 44 | +5. Click `OK` and restart Ghidra. |
| 45 | +6. Begin reverse engineering with Mothra! |
| 46 | + |
| 47 | +Installation Guidance |
| 48 | + |
| 49 | + |
| 50 | + |
| 51 | +Click on the `File` menu and select `Install Extension`. |
| 52 | + |
| 53 | + |
| 54 | + |
| 55 | +Click the green `+` button and select the release package. |
| 56 | + |
| 57 | +### Developer |
| 58 | +1. Download and install the Eclipse IDE for Java development. |
| 59 | +2. Set up the `GhidraDev` extension in Eclipse. |
| 60 | +3. Clone or fork this repository to your local machine. |
| 61 | +4. In Eclipse, navigate to the `GhidraDev` options, click `Ghidra Module Source`, and select this repository. |
| 62 | +5. The repository will appear in the Eclipse IDE. |
| 63 | +6. Go to the `Run` menu, select `Run As`, and choose the first option (not the headless option). |
| 64 | +7. Mothra will launch - start reverse engineering |
| 65 | +with Mothra! |
| 66 | + |
| 67 | +Installation Guidance |
| 68 | + |
| 69 | + |
| 70 | + |
| 71 | +Select the `Run` menu, then choose `Run As`, and pick the first option. |
| 72 | + |
| 73 | +## Usage |
| 74 | + |
| 75 | +### Loader |
| 76 | + |
| 77 | +Our team developed a custom loader that allows users to provide either (1) a contract address or (2) contract bytecode. |
| 78 | + |
| 79 | +To use it, click on the `File` menu and select `Download Bytecode`. The loader supports two modes: |
| 80 | + |
| 81 | +1. `By Address`: Select the network, provide the contract address, enter the desired file name, and click `By Address`. |
| 82 | + |
| 83 | +2. `By Bytecode`: Enter the desired file name, input the contract bytecode, and click `By Bytecode`. |
| 84 | + |
| 85 | +The contract metadata is automatically decoded and displayed. The structure and content of the metadata are detailed here. |
| 86 | + |
| 87 | + |
| 88 | + |
| 89 | +### Analyzer |
| 90 | + |
| 91 | +Several analyzers are supported, and their descriptions are provided below: |
| 92 | + |
| 93 | +| Analyzer Name | Analyzer Description | |
| 94 | +|-----------------------------------|------------------------------------------------------------------------------------------------------| |
| 95 | +| EVM Function Analyzer | Identifies the boundaries for all internal functions. | |
| 96 | +| [EVM Bit Extend Analyzer](https://github.com/syjcnss/Mothra/pull/8) | Detects data types exceeding Ghidra's 64-bit limit, extends functionality using bit operations, and labels them in Mothra for clarity. | |
| 97 | +| [Internal Function Arguments Analyzer](https://github.com/syjcnss/Mothra/pull/9) | Detects the number of input arguments for internal functions. | |
| 98 | +| [Function Selector Analyzer](https://github.com/syjcnss/Mothra/pull/7) | Detects function dispatching patterns, extracts function selectors, and labels them for clarity. | |
| 99 | + |
| 100 | +Analyzer Menu: The analyzers developed by us are selected by default. |
| 101 | + |
| 102 | + |
| 103 | + |
| 104 | +## Contribution |
| 105 | + |
| 106 | +Thank you for considering contributing to this project! We welcome contributions of all kinds, including bug fixes, new features, documentation improvements, and more. |
| 107 | + |
| 108 | +There are some guideline for contribution: |
| 109 | + |
| 110 | +### Fork the Repository |
| 111 | + |
| 112 | ++ Fork the project repository by clicking the Fork button on GitHub. |
| 113 | ++ Clone your forked repository to your local machine. |
| 114 | + |
| 115 | +### Create a Branch |
| 116 | ++ Create a new branch for your changes |
| 117 | ++ Use a descriptive name for your branch (e.g., `fix/issue-123` or `feature/add-login`). |
| 118 | + |
| 119 | +### Create PR on GitHub |
| 120 | ++ Push your branch to your forked repository |
| 121 | ++ Submit a Pull Request |
| 122 | ++ describe your changes clearly in the pull request, please include `summary`, `description` and `verification` section. |
| 123 | + |
| 124 | +Examples: [Feat: add function selector analyzer](https://github.com/syjcnss/Mothra/pull/7) |
0 commit comments