The CrowdRE client is now freely available as an IDA Pro plugin.
CrowdStrike maintains a central cloud for the community to share their
commits amongst each other. It is our goal to help building a public
database of known, well annotated functions to speed up the analysis of
standard components, somewhat similar to what BinCrowd (which is offline
nowadays) offered but with support for multiple co-existing commits for
the same function. We also supports list-based commit visibility to
give users control over who else can see and import their contributions.
This basic concept is sufficient for a collaborative workflow on a
per-function basis for a shared binary. One exciting feature is a
similarity hashing scheme that considers the basic block boundaries of a
function. Each function is mapped on a similarity preserving hash of
fixed size. A database query for such a functions similarity hash
returns a set of functions sorted by their similarity value, and the
analyst can choose amongst them. This is extremely helpful when
analyzing variants based on the same code or generations of a malware
family.
