hikaru - ELF32 Instruction Scraper
----------------------------------

Copyright (C) 2007 by Ben <comsatcat@earthlink.net>
Distributed under terms and conditions of GNU Public License version 2.

=============================================================================

Hikaru is a utility designed for one purpose, finding useful instruction 
sequences in an ELF32 object.  The basis of this tool is the article written
by Havov Shacham titled "The Geometry of Innocent Flesh on the Bone".  The
author described a utility to automate the process of finding sequences of
usable instructions (gadgets) which can be pieced together in a method 
similar to return-into-libc.  The ultimate goal of this application is to 
automate the task of analyzing a binary at different offsets, such that all
possible instructions are enumerated.  Hopefully it will save some people a
few hours of time spent examining memory in gdb.

This utility can also be used to analyze memory dumps gathered with 
utilities such as memfetch (http://lcamtuf.coredump.cx/).  Just give it a
.bin file that has a valid ELF32 header and away it goes.

Hikaru operates in two modes, either enalyze mode or process mode.
Both modes take a -f argument which defines a file to process.

Analyze mode has a single optional argument, -l, which will list
the elf header sections available for processing.  If Analyze mode
is run without the -l flag, it will analyze all executable sections
of the target binary displaying all instructions up to MAX_SIZE.

Process mode is similar to analyze, however it takes a specific
section to process and the size of the instruction to analyze in bytes.


Limitations, bugs and requirements: 

 1) libelf version 0.8.4 was used for development, I assume a more recent
    version should work.

 2) libdisasm version 0.21-pre2 is also required.

 3) As of this release, invalid operands are not displayed, however if
    a instruction sequence contains a ret and still has invalid operands
    before the ret instruction, all valid instructions up to the ret 
    will be displayed.

Please send your comments, bug-reports, enhancements and, beer to
comsatcat@earthlink.net
