AwesomeREA.org

Tool

Karta

Source-code-assisted IDA Python plugin from Check Point Research that finds and matches open-source libraries compiled into large binaries and firmware. Its identifier script reports which supported libraries, such as OpenSSL, zlib, libpng and net-snmp, are present and fingerprints their versions; the matcher then uses a JSON configuration built from that library version to locate its compiled files by their original function order, match their functions and the external libc functions they call, and export selected matches as IDA names. The bundled Thumbs Up scripts improve IDA's function analysis beforehand, including ARM/Thumb separation in firmware.

Requirements and limitations

  • Latest release at review: v2.1.0, published 2021-05-18; the reviewed master commit, from 2022-03-15, adds only README and CI workflow changes. The README says the original author can no longer maintain the repository after leaving Check Point Research, citing the IDA Pro versions and regression-test requirements involved.
  • Requires IDA Pro 7.4 or newer with Python 3; v1.2.0 is the last release for Python 2 and older IDA versions. setup.py installs dependencies including elementals, sark, click and scikit-learn, while requirements.txt still names the old sklearn package. The scripts are loaded through IDA's script-file menu rather than installed as plugins. IDA is the only implemented disassembler backend, although the docs describe an interface for adding others; compatibility with current IDA releases was not checked.
  • Run the scripts on a binary that IDA has already analyzed well, and select the Windows option for Windows-compiled binaries. Matching needs a configuration for the exact library version: the repository ships configurations for OpenSSL 1.0.1j, libpng 1.2.29, libtiff 4.0.8 and zlib 1.2.3 and 1.2.11, and others are generated with karta_analyze_src.py, which also drives IDA, from the static library and object files of a library you compile yourself, following the notes in compilations/. Upstream advises backing up the binary before Thumbs Up, which makes major changes to its analysis.
  • MIT license. The identifier covers 15 library modules, including the closed-source Treck library, which is detected only. Matches are heuristic proposals whose matching rules differ in accuracy and are shown in different colors, so they need analyst review. No binaries were analyzed.

About this entry

Type
Tool
Category
Binary comparison tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  2. docs/Installation.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  3. docs/Open%20Source%20Fingerprinting.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  4. docs/Matching%20supported%20libraries.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  5. docs/Compiling%20a%20configuration.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  6. docs/Thumbs%20Up.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  7. docs/disassembler.md GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  8. setup.py GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  9. requirements.txt GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  10. LICENSE GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  11. src/libs GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  12. configs GitHub · CheckPointSW/Karta · Revision 7a3d0d3
  13. https://github.com/CheckPointSW/Karta/releases/tag/v2.1.0