Skip to content
http8080Public

About

Unified headless binary analysis CLI (IDA Pro + JEB)

Resources

Stars

1 star

Watchers

0 watching

Forks

Latest commit

ย 

History

7 Commits

Folders and files

NameName
Last commit message
Last commit date
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 

Repository files navigation

revkit

Unified headless binary analysis CLI framework for IDA Pro + JEB.

IDA Pro + JEB ํ†ตํ•ฉ headless ๋ฐ”์ด๋„ˆ๋ฆฌ ๋ถ„์„ CLI ํ”„๋ ˆ์ž„์›Œํฌ.

Supports local and remote modes with a Gateway for distributed analysis environments.

๋กœ์ปฌ/์›๊ฒฉ ๋ชจ๋“œ๋ฅผ ์ง€์›ํ•˜๋ฉฐ, Gateway๋ฅผ ํ†ตํ•œ ๋ถ„์‚ฐ ๋ถ„์„ ํ™˜๊ฒฝ์„ ์ œ๊ณตํ•œ๋‹ค.

Documentation / ๋ฌธ์„œ

Document Description / ์„ค๋ช…
README.md (this file) Installation, configuration, architecture / ์„ค์น˜, ์„ค์ •, ์•„ํ‚คํ…์ฒ˜
docs/README-IDA.md IDA Pro engine โ€” 62 commands, RPC methods, usage / IDA ๋ช…๋ น์–ด ์ƒ์„ธ
docs/README-JEB.md JEB Pro engine โ€” 72 commands, RPC methods, usage / JEB ๋ช…๋ น์–ด ์ƒ์„ธ
docs/README-Config.md Configuration reference โ€” all config.json keys / ์„ค์ • ๋ ˆํผ๋Ÿฐ์Šค
docs/README-Logging.md Logging system โ€” JSONL format, directory structure / ๋กœ๊น… ์‹œ์Šคํ…œ
docs/README-RPC.md RPC protocol reference โ€” 59 IDA + 57 JEB methods, auth, errors / RPC ํ”„๋กœํ† ์ฝœ ๋ ˆํผ๋Ÿฐ์Šค
docs/tutorials/ 14 hands-on tutorials โ€” install, IDA, JEB, scripts, dev, gateway, AI / 14๊ฐœ ์‹ค์Šต ํŠœํ† ๋ฆฌ์–ผ
docs/README-Setup.md Installation & setup guide / ์„ค์น˜ ๋ฐ ํ™˜๊ฒฝ ์„ค์ • ๊ฐ€์ด๋“œ

Architecture / ์•„ํ‚คํ…์ฒ˜

[Local Mode / ๋กœ์ปฌ ๋ชจ๋“œ]
  revkit CLI โ”€โ”€โ”€โ”€ JSON-RPC โ”€โ”€โ”€โ”€ Engine Server (IDA/JEB)

[Remote Mode / ์›๊ฒฉ ๋ชจ๋“œ]
  revkit CLI โ”€โ”€โ”€โ”€ HTTPS โ”€โ”€โ”€โ”€ Gateway Daemon โ”€โ”€โ”€โ”€ Engine Server (IDA/JEB)

Quick Start / ๋น ๋ฅธ ์‹œ์ž‘

Install / ์„ค์น˜

cd revkit && pip install -e .

# With optional dependencies / ์„ ํƒ์  ์˜์กด์„ฑ ํฌํ•จ
pip install -e ".[full]"   # psutil (process management / ํ”„๋กœ์„ธ์Šค ๊ด€๋ฆฌ)
pip install -e ".[dev]"    # pytest (testing / ํ…Œ์ŠคํŠธ)

Basic Usage / ๊ธฐ๋ณธ ์‚ฌ์šฉ๋ฒ•

# Start IDA analysis server / IDA ๋ถ„์„ ์„œ๋ฒ„ ์‹œ์ž‘
revkit ida start sample.exe

# Start JEB analysis server / JEB ๋ถ„์„ ์„œ๋ฒ„ ์‹œ์ž‘
revkit jeb start sample.apk

# Auto-detect engine (magic bytes + extension)
# ์—”์ง„ ์ž๋™ ๊ฐ์ง€ (magic bytes + ํ™•์žฅ์ž)
revkit start sample.exe    # โ†’ IDA
revkit start sample.apk    # โ†’ JEB

# List instances / ์ธ์Šคํ„ด์Šค ๋ชฉ๋ก
revkit ida list
revkit jeb list

# Stop instance / ์ธ์Šคํ„ด์Šค ์ค‘์ง€
revkit ida stop -i a3f2

Auto-detect Engine / ์—”์ง„ ์ž๋™ ๊ฐ์ง€

Magic Bytes Extension / ํ™•์žฅ์ž Engine
MZ .exe, .dll IDA
\x7fELF .so, .elf, .bin IDA
\xFE\xED\xFA .dylib IDA
PK\x03\x04 .apk JEB
dex\n .dex JEB
- .jar JEB

Requirements / ์š”๊ตฌ์‚ฌํ•ญ

  • Python 3.12+
  • IDA Pro 9.3+ (idalib) and/or JEB Pro โ€” at least one required / ์ตœ์†Œ ํ•˜๋‚˜ ํ•„์š”
  • psutil โ€” recommended; required on Windows for correct process detection (registry.py uses psutil.pid_exists(); falls back to os.kill on Unix if absent) / Windows์—์„œ ํ”„๋กœ์„ธ์Šค ๊ฐ์ง€์— ํ•„์š” (์—†์œผ๋ฉด Unix์—์„œ os.kill fallback)

IDA Pro Setup / IDA Pro ์„ค์ •

IDA Pro cannot be installed via pip and requires a separate license.

IDA Pro๋Š” pip๋กœ ์„ค์น˜ํ•  ์ˆ˜ ์—†์œผ๋ฉฐ, ๋ณ„๋„ ๋ผ์ด์„ ์Šค๊ฐ€ ํ•„์š”ํ•˜๋‹ค.

# 1. After installing IDA Pro, locate the idalib Python binding path
#    IDA Pro ์„ค์น˜ ํ›„ idalib Python binding ๊ฒฝ๋กœ ํ™•์ธ
#    e.g. /opt/ida/idalib/python, C:\IDA\idalib\python

# 2. Set the IDA install path in config.json
#    config.json์— IDA ์„ค์น˜ ๊ฒฝ๋กœ ์ง€์ •
cat ~/.revkit/config.json
{
    "ida": {
        "install_dir": "/opt/ida"
    }
}

# 3. Verify idalib is importable / import ๊ฐ€๋Šฅ ์—ฌ๋ถ€ ํ™•์ธ
python -c "import ida_loader; print('OK')"

# 4. Verify via revkit / revkit์œผ๋กœ ํ™•์ธ
revkit ida check

idalib is the headless API provided since IDA Pro 9.3+, including modules like ida_loader and ida_hexrays. IDA engine commands only work on machines with IDA installed. In remote mode, requests are forwarded to an IDA-equipped server via the Gateway.

idalib์€ IDA Pro 9.3+์—์„œ ์ œ๊ณตํ•˜๋Š” headless API์ด๋ฉฐ, ida_loader, ida_hexrays ๋“ฑ์˜ ๋ชจ๋“ˆ์„ ํฌํ•จํ•œ๋‹ค. IDA๊ฐ€ ์„ค์น˜๋œ ๋จธ์‹ ์—์„œ๋งŒ IDA ์—”์ง„ ๋ช…๋ น์–ด๊ฐ€ ๋™์ž‘ํ•˜๋ฉฐ, ์›๊ฒฉ ๋ชจ๋“œ์—์„œ๋Š” Gateway๋ฅผ ํ†ตํ•ด IDA ์„œ๋ฒ„๋กœ ์š”์ฒญ์„ ์ „๋‹ฌํ•œ๋‹ค.

For detailed IDA commands, see docs/README-IDA.md.

JEB Pro Setup / JEB Pro ์„ค์ •

JEB Pro also requires a separate license. / JEB Pro๋„ ๋ณ„๋„ ๋ผ์ด์„ ์Šค๊ฐ€ ํ•„์š”ํ•˜๋‹ค.

# 1. Set JEB install path in config.json
#    JEB Pro ์„ค์น˜ ๊ฒฝ๋กœ๋ฅผ config.json์— ์ง€์ •
cat ~/.revkit/config.json
{
    "jeb": {
        "install_dir": "/opt/jeb",
        "spawn_method": "wrapper",
        "java_home": "/usr/lib/jvm/java-17",
        "heap": {
            "auto": true,
            "default": "4G",
            "max": "16G"
        }
    }
}

# 2. Verify JEB CLI / JEB CLI ๋™์ž‘ ํ™•์ธ
/opt/jeb/jeb_wincon.bat --version   # Windows
/opt/jeb/jeb --version              # Linux
/opt/jeb/jeb_macos.sh --version     # macOS

# 3. Verify via revkit / revkit์œผ๋กœ ํ™•์ธ
revkit jeb check

JEB server runs on Jython 2.7 runtime and requires Java 17+.

JEB ์„œ๋ฒ„๋Š” Jython 2.7 ๋Ÿฐํƒ€์ž„ ์œ„์—์„œ ๋™์ž‘ํ•˜๋ฉฐ, Java 17+์ด ํ•„์š”ํ•˜๋‹ค.

For detailed JEB commands, see docs/README-JEB.md.


CLI Options / CLI ์˜ต์…˜

Option Description / ์„ค๋ช…
--config PATH Config file path (default: ~/.revkit/config.json) / ์„ค์ • ํŒŒ์ผ ๊ฒฝ๋กœ
--json JSON envelope output / JSON envelope ์ถœ๋ ฅ
--out FILE Save result to file / ๊ฒฐ๊ณผ๋ฅผ ํŒŒ์ผ๋กœ ์ €์žฅ
--remote URL Remote mode via Gateway / Gateway ๊ฒฝ์œ  ์›๊ฒฉ ๋ชจ๋“œ
-q / --quiet Suppress output / ์ถœ๋ ฅ ์–ต์ œ
-v / --verbose Verbose logging / ์ƒ์„ธ ๋กœ๊น…
-i ID Specify instance ID / ์ธ์Šคํ„ด์Šค ID ์ง€์ •
-b HINT Binary name hint / ๋ฐ”์ด๋„ˆ๋ฆฌ ์ด๋ฆ„ ํžŒํŠธ

Commands Overview / ๋ช…๋ น์–ด ๊ฐœ์š”

Tier 1 โ€” Common / ๊ณตํ†ต (5 commands)

Shared across all engines. / ์ „์ฒด ์—”์ง„ ๊ณตํ†ต.

Command Description / ์„ค๋ช…
start <binary> Start analysis server / ๋ถ„์„ ์„œ๋ฒ„ ์‹œ์ž‘
list List active instances / ํ™œ์„ฑ ์ธ์Šคํ„ด์Šค ๋ชฉ๋ก
stop Stop instance / ์ธ์Šคํ„ด์Šค ์ค‘์ง€
status Query instance status / ์ธ์Šคํ„ด์Šค ์ƒํƒœ ์กฐํšŒ
wait Wait for instance ready / ์ธ์Šคํ„ด์Šค ready ๋Œ€๊ธฐ

IDA Commands (62)

Analysis, modification, types, advanced, diff, report, batch, utility.

See docs/README-IDA.md for full command reference.

Category Example Commands
Analysis / ๋ถ„์„ decompile, disasm, segments, func-info, find-func, bytes, find-pattern
Modification / ์ˆ˜์ • rename, set-type, comment, patch, auto-rename, rename-batch
Types / ํƒ€์ž… structs, enums, type-info, vtables, sigs
Advanced / ๊ณ ๊ธ‰ callgraph, cross-refs, search-code, strings-xrefs, basic-blocks, stack-frame
Diff / ๋น„๊ต diff, compare, code-diff
Report / ๋ณด๊ณ ์„œ report, annotations, snapshot, bookmark, profile, export-script
Batch / ๋ฐฐ์น˜ batch (directory analysis)
Utility / ์œ ํ‹ธ๋ฆฌํ‹ฐ shell, update, completions

JEB Commands (72)

Analysis, modification, recon, search, xrefs, security, tooling, report, batch, config, utility.

See docs/README-JEB.md for full command reference.

Category Example Commands
Analysis / ๋ถ„์„ decompile, method, smali, classes, methods-of-class, fields-of-class, strings, native-methods
Modification / ์ˆ˜์ • rename, rename-class, rename-method, rename-field, rename-batch, auto-rename, set-comment, undo
Recon / ์ •์ฐฐ summary, permissions, components, info, manifest, main-activity, resources
Search / ๊ฒ€์ƒ‰ search-classes, search-methods, search-code, strings-xrefs
Xrefs xrefs, callers, callees, callgraph, cross-refs
Security / ๋ณด์•ˆ entry-points, security-scan
Tooling / ๋„๊ตฌ merge (split APK โ†’ {pkg}_merged.apk), gen-runner, patch, unpatch
Report / ๋ณด๊ณ ์„œ report, annotations, snapshot
Batch / ๋ฐฐ์น˜ batch (directory analysis)
Config / ์„ค์ • config-show, config-set
Utility / ์œ ํ‹ธ๋ฆฌํ‹ฐ exec, completion

Configuration / ์„ค์ •

Default path / ๊ธฐ๋ณธ ๊ฒฝ๋กœ: ~/.revkit/config.json

Full Config Example / ์ „์ฒด ์„ค์ • ์˜ˆ์‹œ

For detailed documentation of every key, see docs/README-Config.md.

๋ชจ๋“  ํ‚ค์˜ ์ƒ์„ธ ์„ค๋ช…์€ docs/README-Config.md ์ฐธ์กฐ.

Platform-specific paths / ํ”Œ๋žซํผ๋ณ„ ๊ฒฝ๋กœ:

Key Windows Linux
ida.install_dir "C:/Program Files/IDA Professional 9.3" "/opt/ida"
jeb.install_dir "C:/WorkSpace/bin/JEB-5.38" "/opt/jeb"
jeb.java_home "C:/Program Files/Java/jdk-21" "/usr/lib/jvm/java-21"
{
  "paths": {
    "idb_dir": "~/.revkit/ida/idb",
    "log_dir": "~/.revkit/logs",
    "registry": "~/.revkit/ida/registry.json",
    "project_dir": "~/.revkit/jeb/projects",
    "output_dir": "~/.revkit/output"
  },
  "analysis": {
    "max_instances": 3,
    "wait_poll_interval": 1.0,
    "wait_timeout": 120,
    "stale_threshold": 86400,
    "open_db_timeout": 300,
    "heartbeat_interval": 30,
    "auto_save": true
  },
  "security": {
    "auth_token_file": "~/.revkit/auth_tokens.json",
    "exec_enabled": false
  },
  "server": { "host": "127.0.0.1" },
  "log": { "max_size_mb": 10, "backup_count": 3, "stderr_capture": true },
  "output": { "default_count": 50, "max_count": 500, "encoding": "utf-8" },
  "ida": {
    "install_dir": "/opt/ida"
  },
  "jeb": {
    "install_dir": "/opt/jeb",
    "spawn_method": "wrapper",
    "java_home": "/usr/lib/jvm/java-21",
    "security": { "exec_enabled": false },
    "heap": {
      "auto": true, "default": "4G", "max": "16G",
      "rules": [
        {"max_mb": 50, "xmx": "2G"},
        {"max_mb": 200, "xmx": "4G"},
        {"max_mb": 500, "xmx": "8G"}
      ]
    }
  },
  "gateway": {
    "host": "0.0.0.0", "port": 8080,
    "max_upload_size_mb": 500, "upload_dir": "~/.revkit/uploads",
    "api_key": null, "allowed_ips": [], "trusted_proxies": [],
    "request_timeout": 60, "batch_timeout": 300,
    "log_rpc_params": false,
    "audit_path": "~/.revkit/logs/gateway/audit.jsonl",
    "audit_max_size_mb": 100
  }
}

Config Sections / ์„ค์ • ์„น์…˜ ์š”์•ฝ

Section Description / ์„ค๋ช…
paths Data directories โ€” IDB, logs, registry, projects, output / ๋ฐ์ดํ„ฐ ๋””๋ ‰ํ„ฐ๋ฆฌ
analysis Instance limits, timeouts, polling intervals / ๋ถ„์„ ์ธ์Šคํ„ด์Šค ์ œํ•œยทํƒ€์ž„์•„์›ƒ
security Auth token path, exec permission / ์ธ์ฆ ํ† ํฐ, exec ๊ถŒํ•œ
server Headless server bind host / ์„œ๋ฒ„ ๋ฐ”์ธ๋“œ ํ˜ธ์ŠคํŠธ
log Log rotation settings / ๋กœ๊ทธ ๋กœํ…Œ์ด์…˜
output Default output limits, encoding / ์ถœ๋ ฅ ์ œํ•œยท์ธ์ฝ”๋”ฉ
ida IDA Pro install path / IDA ์„ค์น˜ ๊ฒฝ๋กœ
jeb JEB install path, heap config, spawn method / JEB ์„ค์น˜ยทํž™ยท์‹คํ–‰ ๋ฐฉ์‹
gateway Gateway daemon settings / ๊ฒŒ์ดํŠธ์›จ์ด ์„ค์ •

Environment Variable Expansion / ํ™˜๊ฒฝ ๋ณ€์ˆ˜ ํ™•์žฅ

Config values support ~, $HOME, %USERPROFILE% expansion (cross-platform).

์„ค์ • ๊ฐ’์€ ~, $HOME, %USERPROFILE% ํ™•์žฅ์„ ์ง€์›ํ•œ๋‹ค (ํฌ๋กœ์Šค ํ”Œ๋žซํผ).

Local Config Override / ๋กœ์ปฌ ์„ค์ • ์˜ค๋ฒ„๋ผ์ด๋“œ

Place config.local.json in the project directory to override base config values.

ํ”„๋กœ์ ํŠธ ๋””๋ ‰ํ„ฐ๋ฆฌ์— config.local.json์„ ๋ฐฐ์น˜ํ•˜์—ฌ ๊ธฐ๋ณธ ์„ค์ •์„ ์˜ค๋ฒ„๋ผ์ด๋“œํ•  ์ˆ˜ ์žˆ๋‹ค.


Platform Support / ํ”Œ๋žซํผ ์ง€์›

revkit supports both Windows and Linux. / revkit์€ Windows์™€ Linux๋ฅผ ๋ชจ๋‘ ์ง€์›ํ•œ๋‹ค.

Feature / ๊ธฐ๋Šฅ Windows Linux
Process spawn / ํ”„๋กœ์„ธ์Šค ์ƒ์„ฑ CREATE_NO_WINDOW start_new_session
Process kill / ํ”„๋กœ์„ธ์Šค ์ข…๋ฃŒ taskkill /F /T (fallback) SIGKILL (fallback)
JEB launcher / JEB ๋Ÿฐ์ฒ˜ jeb_wincon.bat jeb (shell script)
JEB spawn method / JEB ์‹คํ–‰ ๋ฐฉ์‹ bat or wrapper wrapper only
Java binary / Java ๋ฐ”์ด๋„ˆ๋ฆฌ java.exe java
Classpath separator / ํด๋ž˜์ŠคํŒจ์Šค ๊ตฌ๋ถ„์ž ; :
RAM detection / RAM ๊ฐ์ง€ psutil > PowerShell > 8GB fallback cgroup > /proc/meminfo > psutil > 8GB fallback
Encoding / ์ธ์ฝ”๋”ฉ UTF-8 forced (cp949 override) UTF-8 native
Config paths / ์„ค์ • ๊ฒฝ๋กœ ~/.revkit/config.json (same) ~/.revkit/config.json (same)
Migration backward compat / ๋งˆ์ด๊ทธ๋ ˆ์ด์…˜ ํ˜ธํ™˜ Windows junction (mklink /J) Symlink (ln -s)

Note: psutil is recommended on both platforms but required on Windows for reliable process detection.

psutil์€ ์–‘์ชฝ ํ”Œ๋žซํผ ๋ชจ๋‘ ๊ถŒ์žฅํ•˜์ง€๋งŒ, Windows์—์„œ๋Š” ์•ˆ์ •์ ์ธ ํ”„๋กœ์„ธ์Šค ๊ฐ์ง€๋ฅผ ์œ„ํ•ด ํ•„์ˆ˜.


Remote Mode / ์›๊ฒฉ ๋ชจ๋“œ

# Remote analysis via Gateway / Gateway ๊ฒฝ์œ  ์›๊ฒฉ ๋ถ„์„
revkit --remote http://analysis-server:8080 ida start sample.exe

# Remote instance list / ์›๊ฒฉ ์ธ์Šคํ„ด์Šค ๋ชฉ๋ก
revkit --remote http://analysis-server:8080 list

# Remote RPC call (save locally with --out)
# ์›๊ฒฉ RPC ํ˜ธ์ถœ (--out์œผ๋กœ ๋กœ์ปฌ ์ €์žฅ)
revkit --remote http://srv:8080 ida decompile 0x401000 --out result.json

Remote Start Flow / ์›๊ฒฉ start ํ๋ฆ„

1. CLI: Upload binary to Gateway โ†’ get file_id
        ๋ฐ”์ด๋„ˆ๋ฆฌ๋ฅผ Gateway์— upload โ†’ file_id ํš๋“
2. CLI: POST /api/v1/engines/{engine}/start โ†’ instance_id
3. CLI: Poll until instance ready / polling์œผ๋กœ instance ready ๋Œ€๊ธฐ
4. CLI: Output instance_id โ†’ RPC calls available
        instance_id ์ถœ๋ ฅ โ†’ ์ดํ›„ RPC ํ˜ธ์ถœ ๊ฐ€๋Šฅ

Remote Functions / ์›๊ฒฉ ํ•จ์ˆ˜

Function Description / ์„ค๋ช…
upload_binary() Upload binary to Gateway (multipart) / ๋ฐ”์ด๋„ˆ๋ฆฌ ์—…๋กœ๋“œ
remote_start() Upload + start engine + return instance_id / ์—…๋กœ๋“œ + ์—”์ง„ ์‹œ์ž‘
remote_list() List remote instances / ์›๊ฒฉ ์ธ์Šคํ„ด์Šค ๋ชฉ๋ก
post_rpc_remote() Send RPC call via Gateway proxy / Gateway ํ”„๋ก์‹œ RPC ํ˜ธ์ถœ

Gateway

HTTP Gateway daemon with API key authentication, IP whitelist (CIDR), and audit logging.

HTTP Gateway daemon. API key ์ธ์ฆ, IP whitelist (CIDR), audit logging ์ง€์›.

# Start Gateway / Gateway ์‹œ์ž‘
python -m revkit.tools.gateway.daemon --config config.json

API Endpoints

Method Path Description / ์„ค๋ช…
GET /api/v1/health Health check (no auth / ์ธ์ฆ ๋ถˆํ•„์š”)
GET /api/v1/instances List all instances / ์ „์ฒด ์ธ์Šคํ„ด์Šค ๋ชฉ๋ก
POST /api/v1/instances/{id}/rpc JSON-RPC proxy / JSON-RPC ํ”„๋ก์‹œ
DELETE /api/v1/instances/{id} Delete instance / ์ธ์Šคํ„ด์Šค ์‚ญ์ œ
POST /api/v1/engines/{engine}/start Start engine / ์—”์ง„ ์‹œ์ž‘
POST /api/v1/upload Upload binary (multipart) / ๋ฐ”์ด๋„ˆ๋ฆฌ ์—…๋กœ๋“œ

Gateway Config / Gateway ์„ค์ •

{
    "gateway": {
        "host": "0.0.0.0",
        "port": 8080,
        "api_key": "your-secret-key",
        "allowed_ips": ["192.168.1.0/24"],
        "trusted_proxies": ["10.0.0.1"],
        "max_upload_size_mb": 500,
        "request_timeout": 60,
        "batch_timeout": 300,
        "upload_dir": "~/.revkit/uploads",
        "audit_path": "~/.revkit/gateway/audit.jsonl",
        "audit_max_size_mb": 100,
        "log_rpc_params": false
    }
}
Key Description / ์„ค๋ช… Default
host Bind address / ๋ฐ”์ธ๋“œ ์ฃผ์†Œ 0.0.0.0
port Port number / ํฌํŠธ ๋ฒˆํ˜ธ 8080
api_key API key (null = disabled) / API ํ‚ค null
allowed_ips IP whitelist (CIDR supported) / IP ํ™”์ดํŠธ๋ฆฌ์ŠคํŠธ [] (all)
trusted_proxies Trusted proxy IPs for X-Forwarded-For / ์‹ ๋ขฐํ•  ํ”„๋ก์‹œ []
max_upload_size_mb Max upload size (MB) / ์ตœ๋Œ€ ์—…๋กœ๋“œ ํฌ๊ธฐ 500
request_timeout RPC timeout (seconds) / RPC ํƒ€์ž„์•„์›ƒ 60
batch_timeout Batch RPC timeout / ๋ฐฐ์น˜ ํƒ€์ž„์•„์›ƒ 300
upload_dir Upload directory / ์—…๋กœ๋“œ ๋””๋ ‰ํ„ฐ๋ฆฌ ~/.revkit/uploads
log_rpc_params Log RPC params in audit / RPC ํŒŒ๋ผ๋ฏธํ„ฐ ๋กœ๊น… false

Authentication Flow / ์ธ์ฆ ํ๋ฆ„

1. Extract client IP (X-Forwarded-For if from trusted proxy)
   ํด๋ผ์ด์–ธํŠธ IP ์ถ”์ถœ (์‹ ๋ขฐํ•  ํ”„๋ก์‹œ์˜ ๊ฒฝ์šฐ X-Forwarded-For)
2. Check IP whitelist (CIDR matching) / IP ํ™”์ดํŠธ๋ฆฌ์ŠคํŠธ ํ™•์ธ
3. Validate API key (timing-safe comparison) / API ํ‚ค ๊ฒ€์ฆ (ํƒ€์ด๋ฐ ๊ณต๊ฒฉ ๋ฐฉ์ง€)

Audit Logging / ๊ฐ์‚ฌ ๋กœ๊น…

JSONL format, one event per line / JSONL ํ˜•์‹, ํ•œ ์ค„์— ํ•˜๋‚˜์˜ ์ด๋ฒคํŠธ:

{
    "ts": "2026-03-20T10:30:45.123456+00:00",
    "engine": "ida",
    "cmd": "decompile",
    "iid": "a3f2",
    "ok": true,
    "ms": 1234.56,
    "source_ip": "192.168.1.100"
}

Sensitive fields (code, script, exec_code) are automatically redacted.

๋ฏผ๊ฐ ํ•„๋“œ(code, script, exec_code)๋Š” ์ž๋™์œผ๋กœ ๋งˆ์Šคํ‚น๋œ๋‹ค.


Engine Support / ์—”์ง„ ์ง€์›

Feature IDA JEB
Binary formats / ๋ฐ”์ด๋„ˆ๋ฆฌ PE, ELF, Mach-O APK, DEX, JAR
DB extension / DB ํ™•์žฅ์ž .i64 .jdb2 (auto-saved to paths.project_dir, reused across sessions)
Identifier / ์‹๋ณ„์ž Memory address (0x401000) DEX signature (Lcom/example/Foo;)
Instance ID / ์ธ์Šคํ„ด์Šค ID 4-digit hex (a3f2) {name}_{4hex} (app-a3f2)
Server runtime / ์„œ๋ฒ„ ๋Ÿฐํƒ€์ž„ CPython 3.12+ Jython 2.7
Commands / ๋ช…๋ น์–ด 62 72
Detailed docs / ์ƒ์„ธ ๋ฌธ์„œ README-IDA.md README-JEB.md

JEB Project Persistence / JEB ํ”„๋กœ์ ํŠธ ์˜์†์„ฑ

JEB .jdb2 projects are saved to paths.project_dir (default: ~/.revkit/jeb/projects/) and automatically reused across sessions:

JEB .jdb2 ํ”„๋กœ์ ํŠธ๋Š” paths.project_dir (๊ธฐ๋ณธ: ~/.revkit/jeb/projects/)์— ์ €์žฅ๋˜๋ฉฐ, ์„ธ์…˜ ๊ฐ„ ์ž๋™ ์žฌ์‚ฌ์šฉ๋œ๋‹ค:

  1. Save: saveProject(key, path, null, null) โ€” saves to configured project directory, not JEB install dir.
  2. Load: On start, searches for existing .jdb2 by binary name prefix and loads it via loadProject().
  3. Fresh: Use start --fresh to skip .jdb2 reuse and create a new project.
  4. Cleanup: cleanup deletes orphaned .jdb2 files not linked to any active instance.

Core Infrastructure / ํ•ต์‹ฌ ์ธํ”„๋ผ

Instance Registry / ์ธ์Šคํ„ด์Šค ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ

Thread-safe JSON file with file locking. / ํŒŒ์ผ ๋ฝ์„ ์‚ฌ์šฉํ•œ ์Šค๋ ˆ๋“œ ์•ˆ์ „ JSON ํŒŒ์ผ.

Path / ๊ฒฝ๋กœ: ~/.revkit/{engine}/registry.json

{
    "id": "a3f2",
    "state": "ready",
    "path": "/path/to/binary",
    "binary": "sample.exe",
    "pid": 12345,
    "port": 18861,
    "started": 1234567890.0,
    "last_heartbeat": 1234567890.5
}

States / ์ƒํƒœ: initializing โ†’ analyzing โ†’ ready | error

Auto-cleanup: removes stale entries (dead process, no heartbeat > 120s). cleanup also deletes unused .jdb2 project files.

์ž๋™ ์ •๋ฆฌ: ์ฃฝ์€ ํ”„๋กœ์„ธ์Šค, 120์ดˆ ์ด์ƒ heartbeat ์—†๋Š” ํ•ญ๋ชฉ์„ ์ œ๊ฑฐํ•œ๋‹ค. cleanup์€ ๋ฏธ์‚ฌ์šฉ .jdb2 ํ”„๋กœ์ ํŠธ ํŒŒ์ผ๋„ ์‚ญ์ œํ•œ๋‹ค.

JSON-RPC Client

POST http://127.0.0.1:{port}/
Content-Type: application/json

{
    "method": "decompile",
    "params": {"addr": "0x401000"},
    "id": 1
}

Features / ๊ธฐ๋Šฅ:

  • Automatic retry (default: 3 attempts) / ์ž๋™ ์žฌ์‹œ๋„ (๊ธฐ๋ณธ 3ํšŒ)
  • Batch timeout support / ๋ฐฐ์น˜ ํƒ€์ž„์•„์›ƒ ์ง€์›
  • Auth token support / ์ธ์ฆ ํ† ํฐ ์ง€์›
  • Verbose logging / ์ƒ์„ธ ๋กœ๊น…

Process Management / ํ”„๋กœ์„ธ์Šค ๊ด€๋ฆฌ

  • Cross-platform detached process spawning / ํฌ๋กœ์Šค ํ”Œ๋žซํผ ๋ถ„๋ฆฌ ํ”„๋กœ์„ธ์Šค ์ƒ์„ฑ
    • Windows: CREATE_NO_WINDOW | CREATE_NEW_PROCESS_GROUP
    • Unix: start_new_session=True
  • Force kill with psutil fallback to os.kill / psutil fallback
  • Stderr redirected to log file / stderr๋Š” ๋กœ๊ทธ ํŒŒ์ผ๋กœ ๋ฆฌ๋‹ค์ด๋ ‰ํŠธ

Project Structure / ํ”„๋กœ์ ํŠธ ๊ตฌ์กฐ

revkit-private/
โ”œโ”€โ”€ .gitignore
โ”œโ”€โ”€ README.md
โ”œโ”€โ”€ requirements.txt
โ”œโ”€โ”€ docs/
โ”‚   โ”œโ”€โ”€ README-IDA.md               # IDA engine detailed docs / IDA ์ƒ์„ธ ๋ฌธ์„œ
โ”‚   โ”œโ”€โ”€ README-JEB.md               # JEB engine detailed docs / JEB ์ƒ์„ธ ๋ฌธ์„œ
โ”‚   โ”œโ”€โ”€ README-Config.md            # Configuration reference / ์„ค์ • ๋ ˆํผ๋Ÿฐ์Šค
โ”‚   โ”œโ”€โ”€ README-Logging.md           # Logging system / ๋กœ๊น… ์‹œ์Šคํ…œ
โ”‚   โ””โ”€โ”€ README-Setup.md             # Installation guide / ์„ค์น˜ ๊ฐ€์ด๋“œ
โ”œโ”€โ”€ Samples/                        # Test binaries / ํ…Œ์ŠคํŠธ์šฉ ๋ฐ”์ด๋„ˆ๋ฆฌ
โ”‚   โ”œโ”€โ”€ APK/                        #   APK (๊ธˆ์œต/๋ณธ์ธํ™•์ธ ์•ฑ ์ƒ˜ํ”Œ, UnCrackable)
โ”‚   โ”œโ”€โ”€ DEX/                        #   Memory-dumped DEX / ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„ DEX
โ”‚   โ”œโ”€โ”€ ELF/                        #   ELF (ARM64, ARMv7, Mips4, PowerPC, V850)
โ”‚   โ”œโ”€โ”€ EXE/                        #   PE (notepad.exe)
โ”‚   โ””โ”€โ”€ IPA/                        #   IPA (๊ธˆ์œต/๋ณธ์ธํ™•์ธ ์•ฑ ์ƒ˜ํ”Œ)
โ”œโ”€โ”€ guide/                          # Design docs & roadmap / ์„ค๊ณ„ ๋ฌธ์„œ + ๋กœ๋“œ๋งต
โ”‚   โ”œโ”€โ”€ integration_plan.md
โ”‚   โ”œโ”€โ”€ roadmap.md
โ”‚   โ”œโ”€โ”€ test_plan.md
โ”‚   โ”œโ”€โ”€ CHANGELOG.md
โ”‚   โ”œโ”€โ”€ Minutes/                    #   Review notes / ๋ฆฌ๋ทฐ ๊ธฐ๋ก
โ”‚   โ””โ”€โ”€ design/                     #   Phase 3 design (step01~step20)
โ””โ”€โ”€ revkit/
    โ”œโ”€โ”€ __init__.py
    โ”œโ”€โ”€ pyproject.toml
    โ”œโ”€โ”€ bin/                        # Wrapper scripts / ๋ž˜ํผ ์Šคํฌ๋ฆฝํŠธ
    โ”‚   โ”œโ”€โ”€ revkit                  #   Main CLI entrypoint / ๋ฉ”์ธ CLI ์—”ํŠธ๋ฆฌํฌ์ธํŠธ
    โ”‚   โ”œโ”€โ”€ jeb-cli                 #   Legacy JEB wrapper (deprecated)
    โ”‚   โ””โ”€โ”€ ida-cli.py              #   Legacy IDA wrapper (deprecated)
    โ”œโ”€โ”€ tools/
    โ”‚   โ”œโ”€โ”€ cli/                    # CLI
    โ”‚   โ”‚   โ”œโ”€โ”€ main.py             #   argparse + auto-detect engine
    โ”‚   โ”‚   โ”œโ”€โ”€ remote.py           #   Gateway remote mode client / ์›๊ฒฉ ๋ชจ๋“œ ํด๋ผ์ด์–ธํŠธ
    โ”‚   โ”‚   โ””โ”€โ”€ commands/
    โ”‚   โ”‚       โ””โ”€โ”€ common.py       #   Tier 1 handlers (start/list/stop/status/wait)
    โ”‚   โ”œโ”€โ”€ core/                   # Shared infrastructure / ๊ณตํ†ต ์ธํ”„๋ผ
    โ”‚   โ”‚   โ”œโ”€โ”€ config.py           #   Config load/save / ์„ค์ • ๋กœ๋“œยท์ €์žฅ
    โ”‚   โ”‚   โ”œโ”€โ”€ registry.py         #   Instance registry (JSON) / ์ธ์Šคํ„ด์Šค ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ
    โ”‚   โ”‚   โ”œโ”€โ”€ rpc.py              #   JSON-RPC client
    โ”‚   โ”‚   โ”œโ”€โ”€ audit.py            #   Audit logging (JSONL) / ๊ฐ์‚ฌ ๋กœ๊น…
    โ”‚   โ”‚   โ”œโ”€โ”€ logging_setup.py    #   JSONL logging system / ๋กœ๊น… ์‹œ์Šคํ…œ
    โ”‚   โ”‚   โ”œโ”€โ”€ instance.py         #   Instance management / ์ธ์Šคํ„ด์Šค ๊ด€๋ฆฌ
    โ”‚   โ”‚   โ”œโ”€โ”€ output.py           #   Output format (table/JSON) / ์ถœ๋ ฅ ํฌ๋งท
    โ”‚   โ”‚   โ”œโ”€โ”€ process.py          #   Process management (psutil fallback) / ํ”„๋กœ์„ธ์Šค ๊ด€๋ฆฌ
    โ”‚   โ”‚   โ””โ”€โ”€ utils.py            #   Utilities / ์œ ํ‹ธ๋ฆฌํ‹ฐ
    โ”‚   โ”œโ”€โ”€ engines/
    โ”‚   โ”‚   โ”œโ”€โ”€ base.py             #   EngineBase ABC + CmdContext
    โ”‚   โ”‚   โ”œโ”€โ”€ ida/                #   IDA Pro engine
    โ”‚   โ”‚   โ”‚   โ”œโ”€โ”€ engine.py       #     IDAEngine implementation / ๊ตฌํ˜„
    โ”‚   โ”‚   โ”‚   โ”œโ”€โ”€ commands/       #     CLI commands (9 modules / 9๋ชจ๋“ˆ)
    โ”‚   โ”‚   โ”‚   โ””โ”€โ”€ server/         #     JSON-RPC server + handlers (9 modules / 9๋ชจ๋“ˆ)
    โ”‚   โ”‚   โ””โ”€โ”€ jeb/                #   JEB Pro engine
    โ”‚   โ”‚       โ”œโ”€โ”€ engine.py       #     JEBEngine implementation / ๊ตฌํ˜„
    โ”‚   โ”‚       โ”œโ”€โ”€ commands/       #     CLI commands (13 modules / 13๋ชจ๋“ˆ)
    โ”‚   โ”‚       โ””โ”€โ”€ server/         #     JSON-RPC server + handlers (11 modules / 11๋ชจ๋“ˆ)
    โ”‚   โ”œโ”€โ”€ gateway/                # HTTP Gateway
    โ”‚   โ”‚   โ”œโ”€โ”€ daemon.py           #   ThreadingHTTPServer
    โ”‚   โ”‚   โ”œโ”€โ”€ auth.py             #   API key + IP whitelist + CIDR
    โ”‚   โ”‚   โ”œโ”€โ”€ router.py           #   URL routing + RPC proxy / ๋ผ์šฐํŒ… + RPC ํ”„๋ก์‹œ
    โ”‚   โ”‚   โ”œโ”€โ”€ upload.py           #   Multipart binary upload / ๋ฐ”์ด๋„ˆ๋ฆฌ ์—…๋กœ๋“œ
    โ”‚   โ”‚   โ”œโ”€โ”€ audit.py            #   Gateway audit logging / ๊ฐ์‚ฌ ๋กœ๊น…
    โ”‚   โ”‚   โ””โ”€โ”€ config.py           #   Gateway config / ์„ค์ •
    โ”‚   โ”œโ”€โ”€ libs/
    โ”‚   โ”‚   โ””โ”€โ”€ APKEditor-1.4.7.jar #   Split APK merge tool (REAndroid) / ๋ณ‘ํ•ฉ ๋„๊ตฌ
    โ”‚   โ””โ”€โ”€ scripts/                # Migration / ๋งˆ์ด๊ทธ๋ ˆ์ด์…˜
    โ”‚       โ”œโ”€โ”€ migrate.py          #   ~/.ida-headless + ~/.jeb-headless โ†’ ~/.revkit/
    โ”‚       โ””โ”€โ”€ verify_migration.py #   Migration verification / ๊ฒ€์ฆ
    โ””โ”€โ”€ tests/                      # 218 tests
        โ”œโ”€โ”€ conftest.py
        โ”œโ”€โ”€ test_cli/               #   CLI + remote (25)
        โ”œโ”€โ”€ test_core/              #   Core modules (61)
        โ”œโ”€โ”€ test_engines/           #   Engines (29)
        โ”œโ”€โ”€ test_gateway/           #   Gateway (61)
        โ”œโ”€โ”€ test_integration/       #   E2E + migration (22)
        โ””โ”€โ”€ test_security/          #   Path traversal (8)

Testing / ํ…Œ์ŠคํŠธ

cd revkit
pip install -e ".[dev]"
python -m pytest tests/ -v

218 tests across 6 categories / 218๊ฐœ ํ…Œ์ŠคํŠธ, 6๊ฐœ ์นดํ…Œ๊ณ ๋ฆฌ:

Category / ์นดํ…Œ๊ณ ๋ฆฌ Count / ์ˆ˜ Target / ๋Œ€์ƒ
core 61 config, registry, rpc, audit, instance, output, process, utils
engines 29 base, ida_engine, jeb_engine
cli 25 main, remote
gateway 61 auth, daemon, router, upload, audit
integration 22 local E2E, remote E2E, migration
security 8 path traversal

Migration / ๋งˆ์ด๊ทธ๋ ˆ์ด์…˜

Migrate from legacy directories to unified revkit structure.

๊ธฐ์กด ~/.ida-headless/ + ~/.jeb-headless/ โ†’ ~/.revkit/{ida,jeb}/ ๋งˆ์ด๊ทธ๋ ˆ์ด์…˜:

# Dry-run / ์‹œ๋ฎฌ๋ ˆ์ด์…˜
python -m revkit.tools.scripts.migrate --dry-run

# Execute / ์‹คํ–‰
python -m revkit.tools.scripts.migrate

# Verify / ๊ฒ€์ฆ
python -m revkit.tools.scripts.migrate --verify

License / ๋ผ์ด์„ ์Šค

Private. / ๋น„๊ณต๊ฐœ.

About

Unified headless binary analysis CLI (IDA Pro + JEB)

Resources

Stars

1 star

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages