search

DanielBenHayoun / automatic_functionality_detection

educational project for automation of functionality detection of binary files - in progress
1 stars 0 forks source link

process #5

Closed DanielBenHayoun closed 4 years ago

DanielBenHayoun commented 4 years ago

run` code2seq and use angr to replace memory addresses instructions to MEM and any absolute value with IMM :

mov EBX,6000 becomes mov EBX,IMM
mov EBX,[0x3435423] becomes mov EBX,MEM
 while the instruction mov EAX,[EBP−8] is not modified