GrammaTech / ddisasm

A fast and accurate disassembler
https://grammatech.github.io/ddisasm/
GNU Affero General Public License v3.0
645 stars 60 forks source link

Question: What's the best practice to write analysis based on relations generated by ddisasm? #42

Open 5c4lar opened 2 years ago

5c4lar commented 2 years ago

I'm trying to write some analysis with datalog based on ddisasm, but it's not convenient to reuse the existing results when implementing a pass. Should I write some datalog program and include it from main.dl or are there any recommended ways?

aeflores commented 2 years ago

Hi @ucasqsl, I see you started adding code as a pass in the passes directory. This is certainly a feasible approach. However, we are currently working on an alternative way to allow users to leverage existing results of ddisasm in a way that is decoupled from the main ddisasm code.

Currently, you can run ddisasm with --with-souffle-relations, which will store all the output relations of the souffle program into an AuxData table in the gtirb file. Thus, you could have a standalone module that loads the gtirb and extracts those relations as facts for your own analysis. What we are trying to do next is to more clearly define which relations are "public" (and relatively stable) which are "private" (can change anytime). This way, downstream analyses won't break with every change that we do in the main ddisasm code.

We will post updates in this issue.

5c4lar commented 2 years ago

Currently, you can run ddisasm with --with-souffle-relations, which will store all the output relations of the souffle program into an AuxData table in the gtirb file. Thus, you could have a standalone module that loads the gtirb and extracts those relations as facts for your own analysis. What we are trying to do next is to more clearly define which relations are "public" (and relatively stable) which are "private" (can change anytime). This way, downstream analyses won't break with every change that we do in the main ddisasm code.

Thanks, this info is helpful, if I've ever read that option more closely, I think I'd use it. Looking forward to the updates.