0xPhoeniX / MazeWalker

Toolkit for enriching and speeding up static malware analysis
GNU Lesser General Public License v3.0
163 stars 34 forks source link

Visualize orphan basic blocks #14

Closed 0xPhoeniX closed 6 years ago

0xPhoeniX commented 6 years ago

Quiet often, there are chunks of code that IDA does not recognize as certain function or even code. As during tracing, MazeWalker logs all the basic blocks that were executed, it could be valuable to be aware of them during post execution static analysis.

I think of adding a new table beside the execution tree to list all the orphan BBL.

Appreciate other suggestions.

0xPhoeniX commented 6 years ago

Added.