···23## [Unreleased] - _TBD_
400000000000000000005## [v0.3.0] - 2023-08-22
06### Added
07- This changelog.
8- Support for IDA 8.1+ delete command.
9- Pooling for connections to database.
···13- Add Metrics for prometheus.
1415### Fixed
016- 8K stack size is too small for debug builds.
1718## [v0.2.0] - 2022-10-12
019### Added
020- Protocol: support for IDA 8.1+ user authentication.
21- Client connection duration limitations.
022### Changed
023- Tokio's thread size is reduced from 4M to 8K.
2425-## [v0.1.0] - 2021-01-21
26-This is Lumen's first tagged release. It contains a few fixes and dependency updates since the initial commit (2020-12-17).
2702829-[Unreleased]: https://github.com/naim94a/lumen/compare/v0.3.0...HEAD
030[v0.3.0]: https://github.com/naim94a/lumen/compare/v0.2.0...v0.3.0
31[v0.2.0]: https://github.com/naim94a/lumen/compare/v0.1.0...v0.2.0
32[v0.1.0]: https://github.com/naim94a/lumen/releases/tag/v0.1.0
···23## [Unreleased] - _TBD_
45+### Added
6+7+- User management
8+9+## [v0.4.0] - 2024-03-19
10+11+### Added
12+13+- Implemented the function histories command.
14+- Configurable time limits.
15+16+### Fixed
17+18+- RPC HelloResult will now report if deletes are enabled.
19+20+### Changes
21+22+- Applied code formatting using `cargo fmt`
23+24## [v0.3.0] - 2023-08-22
25+26### Added
27+28- This changelog.
29- Support for IDA 8.1+ delete command.
30- Pooling for connections to database.
···34- Add Metrics for prometheus.
3536### Fixed
37+38- 8K stack size is too small for debug builds.
3940## [v0.2.0] - 2022-10-12
41+42### Added
43+44- Protocol: support for IDA 8.1+ user authentication.
45- Client connection duration limitations.
46+47### Changed
48+49- Tokio's thread size is reduced from 4M to 8K.
5051+## [v0.1.0] - 2021-01-21
05253+This is Lumen's first tagged release. It contains a few fixes and dependency updates since the initial commit (2020-12-17).
5455+[Unreleased]: https://github.com/naim94a/lumen/compare/v0.4.0...HEAD
56+[v0.4.0]: https://github.com/naim94a/lumen/compare/v0.3.0...v0.4.0
57[v0.3.0]: https://github.com/naim94a/lumen/compare/v0.2.0...v0.3.0
58[v0.2.0]: https://github.com/naim94a/lumen/compare/v0.1.0...v0.2.0
59[v0.1.0]: https://github.com/naim94a/lumen/releases/tag/v0.1.0
···1-# Lumen
2-A private Lumina server that can be used with IDA Pro 7.2+.
3-4-[lumen.abda.nl](https://lumen.abda.nl/) runs this server.
5-6-You can read about the protocol research [here](https://abda.nl/posts/introducing-lumen/).
7-8-## Features
9-- Stores function signatures so you (and your team) can quickly identify functions that you found in the past using IDA's built-in Lumina features.
10-- Backed by PostgreSQL
11-- Experimental HTTP API that allows querying the database for comments by file or function hash.
12-13-## Getting Started
14-15-### Docker Method (Recommended)
16-In this method precompiled docker images will be downloaded, All you need is [docker-compose.yml](./docker-compose.yml).
17-18-1. Install `docker-engine` and `docker-compose`.
19-2. If using a custom TLS certificate, copy the private key (`.p12`/`.pfx` extension) to `./dockershare` and set the key password in `.env` as `PKCSPASSWD`.
20-3. If using a custom Lumen config, copy it to `./dockershare/config.toml`.
21-4. Otherwise, or if you have finished these steps, just run `docker-compose up`.
22-5. Regardless, if TLS is enabled in the `config.toml`, a `hexrays.crt` will be generated in `./dockershare` to be copied to the IDA install directory.
23-24-### Building from source with Rust
25-1. `git clone https://github.com/naim94a/lumen.git`
26-2. Get a rust toolchain: https://rustup.rs/
27-3. `cd lumen`
28-4. Setup a Postgres database and execute src/schema.sql on it
29-5. `cargo build --release`
30-31-### Usage
32-```
33-./lumen -c config.toml
34-```
35-36-### Configuring IDA
37-38-#### IDA Pro >= 8.1
39-If you used LUMEN in the past, remove the LUMINA settings in the ida.cfg or idauser.cfg files, otherwise you will get a warning about
40-bad config parameters.
41-42-##### Setup under Linux :
43-```
44-#!/bin/sh
45-export LUMINA_TLS=false
46-$1
47-```
48-- save as ida_lumen.sh, "chmod +x ida_lumen.sh", now you can run IDA using "./ida_lumen.sh ./ida" or "./ida_lumen ./ida64"
49-50-##### Setup under Windows :
51-```
52-set LUMINA_TLS=false
53-%1
54-```
55-- save as ida_lumen.bat, now you can run IDA using "./ida_lumen.bat ida.exe" or "./ida_lumen.bat ida64.exe"
56-57-##### Setup IDA
58-- Go to Options, General, Lumina. Select "Use a private server", then set your host and port and "guest" as username and password. Click on ok.
59-60-#### IDA Pro < 8.1
61-You will need IDA Pro 7.2 or above in order to use _lumen_.
62-63-> The following information may get sent to _lumen_ server: IDA key, Hostname, IDB path, original file path, file MD5, function signature, stack frames & comments.
64-65-- In your IDA's installation directory open "cfg\ida.cfg" with your favorite text editor _(Example: C:\Program Files\IDA Pro 7.5\cfg\ida.cfg)_
66-- Locate the commented out `LUMINA_HOST`, `LUMINA_PORT`, and change their values to the address of your _lumen_ server.
67-- If you didn't configure TLS, Add "LUMINA_TLS = NO" after the line with `LUMINA_PORT`.
68-69-Example:
70-```C
71-LUMINA_HOST = "192.168.1.1";
72-LUMINA_PORT = 1234
73-74-// Only if TLS isn't used:
75-LUMINA_TLS = NO
76-```
77-78-### Configuring TLS
79-IDA Pro uses a pinned certificate for Lumina's communcation, so adding a self-signed certificate to your root certificates won't work.
80-Luckily, we can override the hard-coded public key by writing a DER-base64 encoded certificate to "hexrays.crt" in IDA's install directory.
81-82-You may find the following commands useful:
83-```bash
84-# create a certificate
85-openssl req -x509 -newkey rsa:4096 -keyout lumen_key.pem -out lumen_crt.pem -days 365 -nodes
86-87-# convert to pkcs12 for lumen; used for `lumen.tls` in config
88-openssl pkcs12 -export -out lumen.p12 -inkey lumen_key.pem -in lumen_crt.pem
89-90-# export public-key for IDA; Copy hexrays.crt to IDA installation folder
91-openssl x509 -in lumen_crt.pem -out hexrays.crt
92-```
93-94-No attempt is made to merge function data - this may casuse a situation where metadata is inconsistent.
95-Instead, the metadata with the highest calculated score is returned to the user.
96-97-98----
99-100-Developed by [Naim A.](https://github.com/naim94a); License: MIT.
0000000000000000000000000
···1+# Lumen
2+3+A private Lumina server that can be used with IDA Pro 7.2+.
4+5+[lumen.abda.nl](https://lumen.abda.nl/) runs this server.
6+7+You can read about the protocol research [here](https://abda.nl/posts/introducing-lumen/).
8+9+## Features
10+11+- Stores function signatures so you (and your team) can quickly identify functions that you found in the past using IDA's built-in Lumina features.
12+- Backed by PostgreSQL
13+- Experimental HTTP API that allows querying the database for comments by file or function hash.
14+15+## Getting Started
16+17+### Docker Method (Recommended)
18+19+In this method precompiled docker images will be downloaded, All you need is [docker-compose.yml](./docker-compose.yml).
20+21+1. Install `docker-engine` and `docker-compose`.
22+2. If using a custom TLS certificate, copy the private key (`.p12`/`.pfx` extension) to `./dockershare` and set the key password in `.env` as `PKCSPASSWD`.
23+3. If using a custom Lumen config, copy it to `./dockershare/config.toml`.
24+4. Otherwise, or if you have finished these steps, just run `docker-compose up`.
25+5. Regardless, if TLS is enabled in the `config.toml`, a `hexrays.crt` will be generated in `./dockershare` to be copied to the IDA install directory.
26+27+### Building from source with Rust
28+29+1. `git clone https://github.com/naim94a/lumen.git`
30+2. Get a rust toolchain: https://rustup.rs/
31+3. `cd lumen`
32+4. Setup a the database
33+34+ - install postgres
35+ - install diesel-cli and run migrations:
36+37+ ```bash
38+ cargo install diesel_cli --no-default-features -Fpostgres
39+ diesel --config-file common/diesel.toml \
40+ --database-url postgres://postgres:password@localhost/lumen \
41+ migration run
42+ ```
43+44+5. `cargo build --release`
45+46+### Usage
47+48+```bash
49+./lumen -c config.toml
50+```
51+52+### Configuring IDA
53+54+#### IDA Pro >= 8.1
55+56+If you used LUMEN in the past, remove the LUMINA settings in the ida.cfg or idauser.cfg files, otherwise you will get a warning about
57+bad config parameters.
58+59+##### Setup under Linux :
60+61+```bash
62+#!/bin/sh
63+export LUMINA_TLS=false
64+$1
65+```
66+67+- save as ida_lumen.sh, "chmod +x ida_lumen.sh", now you can run IDA using "./ida_lumen.sh ./ida" or "./ida_lumen ./ida64"
68+69+##### Setup under Windows :
70+71+```batch
72+set LUMINA_TLS=false
73+%1
74+```
75+76+- save as ida_lumen.bat, now you can run IDA using "./ida_lumen.bat ida.exe" or "./ida_lumen.bat ida64.exe"
77+78+##### Setup IDA
79+80+- Go to Options, General, Lumina. Select "Use a private server", then set your host and port and "guest" as username and password. Click on ok.
81+82+#### IDA Pro < 8.1
83+84+You will need IDA Pro 7.2 or above in order to use _lumen_.
85+86+> The following information may get sent to _lumen_ server: IDA key, Hostname, IDB path, original file path, file MD5, function signature, stack frames & comments.
87+88+- In your IDA's installation directory open "cfg\ida.cfg" with your favorite text editor _(Example: C:\Program Files\IDA Pro 7.5\cfg\ida.cfg)_
89+- Locate the commented out `LUMINA_HOST`, `LUMINA_PORT`, and change their values to the address of your _lumen_ server.
90+- If you didn't configure TLS, Add "LUMINA_TLS = NO" after the line with `LUMINA_PORT`.
91+92+Example:
93+94+```C
95+LUMINA_HOST = "192.168.1.1";
96+LUMINA_PORT = 1234
97+98+// Only if TLS isn't used:
99+LUMINA_TLS = NO
100+```
101+102+### Configuring TLS
103+104+IDA Pro uses a pinned certificate for Lumina's communcation, so adding a self-signed certificate to your root certificates won't work.
105+Luckily, we can override the hard-coded public key by writing a DER-base64 encoded certificate to "hexrays.crt" in IDA's install directory.
106+107+You may find the following commands useful:
108+109+```bash
110+# create a certificate
111+openssl req -x509 -newkey rsa:4096 -keyout lumen_key.pem -out lumen_crt.pem -days 365 -nodes
112+113+# convert to pkcs12 for lumen; used for `lumen.tls` in config
114+openssl pkcs12 -export -out lumen.p12 -inkey lumen_key.pem -in lumen_crt.pem
115+116+# export public-key for IDA; Copy hexrays.crt to IDA installation folder
117+openssl x509 -in lumen_crt.pem -out hexrays.crt
118+```
119+120+No attempt is made to merge function data - this may cause a situation where metadata is inconsistent.
121+Instead, the metadata with the highest calculated score is returned to the user.
122+123+---
124+125+Developed by [Naim A.](https://github.com/naim94a); License: MIT.
···1+-- don't allow table to be modified until we're done...
2+LOCK TABLE users;
3+4+-- delete funcs that belong to users
5+DELETE FROM funcs USING dbs, users
6+WHERE dbs.id=funcs.db_id
7+ AND users.id=dbs.user_id
8+ AND users.cred_id IS NOT NULL;
9+10+-- delete dbs that belong to users
11+DELETE FROM dbs USING users WHERE dbs.user_id=users.id AND users.cred_id IS NOT NULL;
12+13+-- delete all users with creds...
14+DELETE FROM users WHERE cred_id is NOT NULL;
15+DROP TABLE creds CASCADE;
16+17+CREATE UNIQUE INDEX IF NOT EXISTS user_rec ON users(lic_id,lic_data,hostname);
18+CREATE UNIQUE INDEX IF NOT EXISTS user_hn_null ON users (lic_id,lic_data, (hostname IS NULL)) WHERE hostname is NULL;
19+DROP INDEX user_cred_idx;
20+21+ALTER TABLE users DROP COLUMN cred_id;
+22
common/migrations/2024-01-20-215809_users/up.sql
···0000000000000000000000
···1+CREATE TABLE creds (
2+ id SERIAL PRIMARY KEY,
3+4+ username VARCHAR(256) UNIQUE NOT NULL,
5+ email VARCHAR(256) UNIQUE NOT NULL,
6+7+ passwd_salt bytea,
8+ passwd_iters INTEGER NOT NULL DEFAULT 10000,
9+ passwd_hash bytea,
10+11+ last_active TIMESTAMPTZ,
12+ creation_dt TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL,
13+14+ is_admin BOOLEAN NOT NULL DEFAULT FALSE,
15+ is_enabled BOOLEAN NOT NULL DEFAULT TRUE
16+);
17+18+ALTER TABLE users ADD COLUMN cred_id INTEGER REFERENCES creds(id) ON DELETE CASCADE;
19+20+CREATE UNIQUE INDEX user_cred_idx ON users(lic_id,lic_data,hostname,cred_id) NULLS NOT DISTINCT;
21+DROP INDEX user_hn_null;
22+DROP INDEX user_rec;
+3-6
common/src/async_drop.rs
···1use futures_util::{future::BoxFuture, Future};
2use log::trace;
3-use tokio::{sync::mpsc::{UnboundedSender, unbounded_channel, WeakUnboundedSender}};
45enum AsyncDropperMsg {
6 Future(BoxFuture<'static, ()>),
···29 AsyncDropperMsg::Termination => {
30 trace!("term received for '{orig}'...");
31 break;
32- }
33 }
34 }
35 trace!("dropper '{orig}' exited.");
···41 /// Defers execution of a future to when the returned `AsyncDropGuard` is dropped
42 pub fn defer<F: Future<Output = ()> + Send + 'static>(&self, fut: F) -> AsyncDropGuard {
43 let tx = self.tx.downgrade();
44- AsyncDropGuard {
45- tx,
46- run: Some(Box::pin(fut))
47- }
48 }
49}
50impl Drop for AsyncDropper {
···1use futures_util::{future::BoxFuture, Future};
2use log::trace;
3+use tokio::sync::mpsc::{unbounded_channel, UnboundedSender, WeakUnboundedSender};
45enum AsyncDropperMsg {
6 Future(BoxFuture<'static, ()>),
···29 AsyncDropperMsg::Termination => {
30 trace!("term received for '{orig}'...");
31 break;
32+ },
33 }
34 }
35 trace!("dropper '{orig}' exited.");
···41 /// Defers execution of a future to when the returned `AsyncDropGuard` is dropped
42 pub fn defer<F: Future<Output = ()> + Send + 'static>(&self, fut: F) -> AsyncDropGuard {
43 let tx = self.tx.downgrade();
44+ AsyncDropGuard { tx, run: Some(Box::pin(fut)) }
00045 }
46}
47impl Drop for AsyncDropper {
···7server_name = "lumen"
89# Allow clients to delete metadata from the database?
10-allow_deletes = false
000000001112# only required when `use_tls` is set to true.
13[lumina.tls]
14-# Specify the server's certificate.
15# Clients connecting to the server must match this certificate.
16# If the certificate is password protected, the password can be specified in the `PKCSPASSWD` environment variable.
17server_cert = "path/to/server_crt"
···7server_name = "lumen"
89# Allow clients to delete metadata from the database?
10+allow_deletes = true
11+# How many function histories should we return? 0=Disabled.
12+get_history_limit = 50
13+14+[users]
15+# Enable guest accounts? disabling this will only allow IDA 8.1+ to connect.
16+allow_guests = true
17+# sets the amount of PBKDF2 iterations for storing passwords.
18+pbkdf2_iterations = 120000
1920# only required when `use_tls` is set to true.
21[lumina.tls]
22+# Specify the server's certificate.
23# Clients connecting to the server must match this certificate.
24# If the certificate is password protected, the password can be specified in the `PKCSPASSWD` environment variable.
25server_cert = "path/to/server_crt"