Usability Clarification

[jgarci40]

I have a question about this note in the README:

Note: Currently, this repository contains the executable files and partial source code of VulSeeker. After we have the source code ready, we will open all of them in a few days. We will remove duplicate files and provide clearer documentation later. Thank you for your understanding.

Does this note mean that the code in the repo is not completely usable yet? Will I be able to completely use VulSeeker with the current contents of the repo? I don't need to edit source code at the moment. I just want to use VulSeeker to analyze native binaries.

[buptsseGJ]

I have a question about this note in the README:

Note: Currently, this repository contains the executable files and partial source code of VulSeeker. After we have the source code ready, we will open all of them in a few days. We will remove duplicate files and provide clearer documentation later. Thank you for your understanding.

Does this note mean that the code in the repo is not completely usable yet? Will I be able to completely use VulSeeker with the current contents of the repo? I don't need to edit source code at the moment. I just want to use VulSeeker to analyze native binaries.

Hello, thank you for your attention to our work. I just tried it, it works well and the source code is completely usable. If you want to extract features, generate DFG and CFG, you can refer to the README.md to modify the config.py file and place the features and graphs into the correct directory. So, this note will be deleted right now. If you have any other questions when using this tool, please do not hesitate to contact me or leave a message.

[jgarci40]

Thank you very much for the help.

Also, about this note in the README:

Note: Because the IDA Pro is installed in the Windows system, we complete the feature extraction and LSFG construction in Windows. Other steps can be executed in either the Linux system or the Windows system.

Does this mean I really need a Windows license of IDA Pro? I primarily work on Mac and Linux, so I want to verify this restriction.

[buptsseGJ]

Thank you very much for the help.

Also, about this note in the README:

Note: Because the IDA Pro is installed in the Windows system, we complete the feature extraction and LSFG construction in Windows. Other steps can be executed in either the Linux system or the Windows system.

Does this mean I really need a Windows license of IDA Pro? I primarily work on Mac and Linux, so I want to verify this restriction.

We mainly use IDA Pro to generate LSFGs and extract features. But because we don't have IDA Pro license for other OSs, we extract features on the Windows OS. If you have an IDA Pro installed on Linux or Mac, the code will also work well.

[jgarci40]

Thanks again for the help and clarification.

[jgarci40]

Would the freeware IDA version work in place of the pro version for VulSeeker? Here's a link to the free version:

https://www.hex-rays.com/products/ida/support/download_freeware.shtml

[jgarci40]

Has anyone had a chance to look into my question about the compatibility of VulSeeker with free versions of IDA? Thanks again for the help.

[buptsseGJ]

Has anyone had a chance to look into my question about the compatibility of VulSeeker with free versions of IDA? Thanks again for the help.

Sorry，I didn't see that issue before. The free version of IDA only provides support for single processor type, so it has limitations on the cross-platform analysis.

[salmanee]

Hi,

I've tried running Vulseeker on my machine using the free version of IDA. I run into the following error after running search_by_list_vulseeker.py:
ImportError: dlopen(/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so, 2): no suitable image found. Did find:
/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00
/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00

Any idea why this error Is showing up?

Thanks

[buptsseGJ]

Hi,

I've tried running Vulseeker on my machine using the free version of IDA. I run into the following error after running search_by_list_vulseeker.py:
ImportError: dlopen(/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so, 2): no suitable image found. Did find:
/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00
/Users/sumaya/Desktop/VulSeeker/VulSeeker/future_builtins.so: unknown file type, first eight bytes: 0x7F 0x45 0x4C 0x46 0x02 0x01 0x01 0x00

Any idea why this error Is showing up?

Thanks

Which processor architecture is your machine? and which type is the future_builtins.so? You may try to use the 'file' command to identify.
In addition, you can open the future_builtins.so within the free version of IDA. It will check whether the IDA supports this ELF file type.

[salmanee]

Thank you for your response!
It seems that the future_builtins.so is supported by the free version of IDA..
(the file was successfully loaded into the database)...

-My processor architecture is x86_64 (MacOS High Sierra 10.13.6 i7 Processor)
-future_builtins.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked

[buptsseGJ]

Thank you for your response!
It seems that the future_builtins.so is supported by the free version of IDA..
(the file was successfully loaded into the database)...

-My processor architecture is x86_64 (MacOS High Sierra 10.13.6 i7 Processor)
-future_builtins.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked

Thank you for your question. Could you tell me which file is running that causes this problem? I will try to reproduce it in the ubuntu and windows system. I found that the future_builtins.so is a dynamically linked library provided by us. I don't know if the system has an impact on it.

[salmanee]

I was running “search_by_list_vulseeker.py” when this error showed up.
Running command.py seems to work fine

[buptsseGJ]

I was running “search_by_list_vulseeker.py” when this error showed up.
Running command.py seems to work fine

We have run these files in Ubuntu and Windows, they worked well. So the problem is that you need to provide a complete running environment, such as installing tensorflow, networkx and so on. You can refer to the build VulSeeker from source code in README.md.
Hope this will help you.

[salmanee]

I build this from source code and it seems that tensor flow and the remaining depenecnies are installed.
I cloned into the Vulseeker directory and tried running command.py then search_by_list. I came across this issue:
[7003] Failed to execute script 7_search_model_vulseeker
it also says in the error stack that it failed loading the native tensor flow runtime which I think is strange giving the fact that I managed to test its installation by importing it and testing some of its functionalties in python.

I would really appreciate any help and assistance with this!

Thanks,

[buptsseGJ]

Has the 6_gen_search_tfrecord_vulseeker.py file been executed? It will store LSFGs into a TFRecord file in the 6_Search_TFRecord directory. Then you can run the 7_search_model_vulseeker.py file. And it seems that we don't have the 7_search_model_vulseeker script.

[salmanee]

thank you for your quick response!
Im not sure if 6_gen_search_tfrecord_vulseeker.py got executed. However, under the TFRecord/VulSeeker folder there's 2 folders both with a generated .tfrecord file so I assume it got executed succesfully.

Just to confirm: Im supposed to run the command.py file followed by search_by_list_seeker.. correct? no other commands are needed here?