Quokka: A Fast and Accurate Binary Exporter

Alexis Challande (1, 2, 3) , Robin David (1) , Guénaël Renault (3, 4, 2)

1 Quarkslab
2 X - École polytechnique
3 GRACE - Geometry, arithmetic, algorithms, codes and encryption
4 ANSSI - Agence nationale de la sécurité des systèmes d'information

Disassembling is the backbone for multiple workflows in binary analysis and offloaded to specialized tools. However, programmatically manipulating the dissembler's results is cumbersome. Thus, we introduce Quokka, a binary exporter helping security practitioners to reuse the disassembler results in an offline context. Quokka is an open-source IDA plugin exporting a 20 MB program in less than 4 seconds to a compact binary format (7.4 MB). In this paper, we describe its inner workings and detail some of its usages.

Domaines: Cryptographie et sécurité [cs.CR]

Alexis Challande, Robin David, Guénaël Renault. Quokka: A Fast and Accurate Binary Exporter. GreHack 2022 - 10th International Symposium on Research in Grey-Hat Hacking, Nov 2022, Grenoble, France. ⟨hal-03845728⟩