But I don’t want to use Eclipse or Netbeans. I want to use Vim.

Enter Eclim, which is a way to use Eclipse’s wide array of features in Vim. Check out the site, it gives a better idea of how it’s used than I can. Unfortunately, only binaries for Linux and Windows are available, so we’re going to have to do this the hard way on OSX. Let’s get started.

The first thing we’ll need is Eclipse. I’m using Eclipse 3.4.3, which I downloaded, uncompressed and moved to /Applications/Eclipse (so the full path is /Applications/Eclipse/Eclipse.app, this is important for later).

Next, let’s grab Eclim from the sourceforge site, the tar.gz file (not the .exe or the .sh). I’m using Eclim 1.4.7. Untar and wait a second, we’ll need to grab something before we can build Eclim.

Eclim requires Ant 1.7.1 in order to build (OSX ships with Ant 1.7.0 instead), so download the Ant 1.7.1 binary for OSX from Apache’s sites, untar, but don’t worry about installing it.

Lastly, grab the latest Vim 7.2 tarball from vim.org. Unfortunately, Apple decided not to compile the system vim with ‘sign’ support, so we’ll have to roll our own version of vim.

Now, let’s begin:

First, we’ll need a folder for the vim plugins, which needs to be created manually or Eclim will complain:

[~]% mkdir ~/.vim/eclim

Next, compile the Eclim files from the eclim directory using the ant 1.7.1 binary. In this example I’m only compiling the ant and jdt plugins for Eclim, because the CDT and PDT plugins require other Eclipse libraries, and I only use Eclipse for Java development anyway. Be sure to change your eclipse.home setting if you didn’t put it in the same place as me:

[~/code/eclim_1.4.7]% ../apache-ant-1.7.1/bin/ant -Declipse.home=/Applications/Eclipse/ -Dplugins=ant,jdt

The Ant command will build and install the files at the same time, so afterwards you shouldn’t have to manually install any Vim or Eclim files.

Next, we need to recompile Vim with sign support, here’s how I compiled my version, make sure to keep the –enable-gui=no and –without-x options, or else vim will start X11 every time you run in:

[~/code/vim72]% ./configure --enable-gui=no --without-x --with-features=huge --prefix=/usr/local
[~/code/vim72]% make
[~/code/vim72]% sudo make install

Switch out the system vim for the one we just created:

[~/code/vim72]% sudo mv /usr/bin/vim /usr/bin/vim.mac.old

We’ll need some way to start the Eclim daemon that was installed, and eclimd doesn’t care for symlinks, so I created an alias in my .zshrc (or .bashrc if you use bash):

alias eclimd='/Applications/Eclipse/eclimd'

Next, we need to fix the /Applications/Eclipse/eclimd shell script, because Apple’s readlink command does NOT support the -f option, so change this line:

RESOLVED=`readlink -f "$0"`

To this:

RESOLVED=`readlink "$0"`

Now, after all that, start up eclimd:

[~]% eclimd

You should see something like this (screenshot):

Alrighty, now we can start Vim, give these two commands a try to see if eclimd communication can be established:

:PingEclim (Will output the Eclipse and Eclim version if everything is working)
:EclimValidate (You should get: “Result: OK, required settings are valid.”)

Hopefully you were able to get a connection. If not, leave a comment and I’ll try to help you out

Okay, so it’s set up, congratulations! Now what can you do with it, well I suggest checking out Eclim’s Java page to see what you can do, but the features I end up using the most are validation, completion and correction. Validation will validate the Java file every time you save it, marking the lines where errors in compilation occur. See the following screenshot (notice the red “>>” markers):

Completion (through Ctrl+x-Ctrl+u) gives you the awesome completion that Eclipse has, like so:

Correction allows you to go to a line with an error marker, and have Eclipse suggestion a fix, just like it would in the IDE, to apply the fix, put the cursor on the red line and hit Enter:

Now go read all the documentation to see the neat things you can do

I usually end up doing the actual project management (adding files, adding external jars to the classpath, generating ant build.xml files and other gui-type stuff) from Eclipse still, but for the actual coding, I’m all about Vim.

Oh yea, one other thing I should mention, so Vim settings for your .vimrc that are really helpful for this:

If you use Supertab (tab-completion with tab instead of Ctrl+x-Ctrl+u):

" Supertab settings
" supertab + eclim == java win
let g:SuperTabDefaultCompletionTypeDiscovery = [
\ "&completefunc:<c-x><c-u>",
\ "&omnifunc:<c-x><c-o>",
\ ]
let g:SuperTabLongestHighlight = 1

And some Eclim .vimrc settings that I use:

" Eclim settings
" ,i imports whatever is needed for current line
nnoremap <silent> <LocalLeader>i :JavaImport<cr>
" ,d opens javadoc for statement in browser
nnoremap <silent> <LocalLeader>d :JavaDocSearch -x declarations<cr>
" ,<enter> searches context for statement
nnoremap <silent> <LocalLeader><cr> :JavaSearchContext<cr>
" ,jv validates current java file
nnoremap <silent> <LocalLeader>jv :Validate<cr>
" ,jc shows corrections for the current line of java
nnoremap <silent> <LocalLeader>jc :JavaCorrect<cr>
" 'open' on OSX will open the url in the default browser without issue
let g:EclimBrowser='open'

Enjoy!

You can download NSM-Console here:

http://writequit.org/projects/nsm-console/files/nsm-console-0.3.tar.gz

This release was focused a bit more on usability, features and bugfixes rather than the addition of new modules, however, there were still a couple that were added. Since this release has some pretty big changes, let’s start by going over some of the notable ones:

- Logfile changes
I decided I wanted a way to track the exit status of each module command that was executed, so the logfile will now prepend each executed command with “[exit: #]” (# is the exit status of the command). I’m hoping this will help with module debugging.

- Output directory changes
The default output directory has been changed from “output” to “${PCAP_BASE}-output”, I’m hoping this helps to provide a more meaningful output directory name. Note that when you perform analysis on a directory of files, multiple output directories will be created, if you want all the output in 1 folder, change output not to have ${PCAP_BASE} in it.

- Modules
The following modules were added, use “info <module>” to get more information about a module: iploc, fl0p, argus

- e command
“e” is now a shortcut for exec, who likes typing that all out anyway?

- eval command
The “eval” command allows an analyst to evaluate a line of ruby, this is extremely powerful to anyone that knows ruby. Note that all the variables and methods I’ve written for nsm-console are available for use with eval also. Here are two examples:

nsm> eval 9 * 6
=> 54

nsm> eval m = get_mod_by_name("aimsnarf"); puts m.get_commands
=> aimsnarf -r ${PCAP_FILE} > ${OUTPUT_DIR}/${OUTPUT_FILE}

- Better tab completion
I added things like “PCAP_FILE” and “OUTPUT_DIR” to the list of tab-completed words, there is a much larger list now. (If you really want a list you can use: “eval puts $tabstrings” to print them all out)

- encode/decode commands
Here are the two commands I think a lot of packet analysts are going to find extremely useful. They allow someone to easily translate from one encoding to a different encoding. Rather than explain with text, let me show you a screenshot:

Right now encode and decode support a handful of formats (see screenshot for the list), but I’m hard at work on many many more formats to encode and decode. Thanks go to Geek00l, who gave me the idea for this feature (especially how it would be useful in something like this). This should allow for quicker analysis as performing inline encoding and encoding should be much easier to perform. Take a look at the TODO file in the tarball and let me know if there is an encoding missing that should be available.

- Licensing
NSM-Console is now released under a LGPL version 2.1 license, you can read the license agreement in the LICENSE file or online here.

- Bugfixes
Whitespace handling fixes, better handling of commands not found, category reading fix and many more

- Code cleanup and organization
Cleanup is always good.

See the CHANGELOG file for more detail about what has changed. The TODO file lists features that I am currently working on. If you aren’t sure what nsm-console is, I recommend you watch the screencast I recently created.

As always, I welcome any feedback, comments, criticism, support and patches.

• Snort module with community rules
  • self-contained snort module will all the community rules and configuration file, this’ll generate alerts into a file after reading the pcap file. I wasn’t sure whether to use community or bleeding edge rules, it’s still easy to point the snort module to your own snort.conf file and do it that way.
• Exec command will do substitution now on the following variables:
  • ${PCAP_FILE}
  • ${PCAP_BASE}
  • ${MODULE_DIR}
  • ${OUTPUT_DIR}
  • This’ll let you do something like “exec tcpdump -X -n -r ${PCAP_FILE}“
  • In addition, exec now logs all the commands run into the regular logfile
• The ‘logfile’ command, real simple, just specifies a new logfile
• Whitespace is handled much much better, there were a lot of bugs with whitespace being handled correctly for the “set” command (among others), it should be handled much better now.
• Category loading now handles non-files much better, before, if you left a “CVS” directory in the categories folder, it would read it but when it went to do a “toggle all”, it would error out, this has been fixed.
• Lots of bugfixes

You can grab the new version here:

http://writequit.org/projects/nsm-console/files/nsm-console-0.3-DEVEL.tar.gz

It’s definitely stable enough for daily use, highly recommended over the older versions. I’m still hoping to get cvs-web interface up to be able to browse the code.