search

HolmesProcessing / Holmes-Totem

Investigation Planner for fast running analysis with predictable execution time. For example, static analysis.
Apache License 2.0
29 stars 16 forks source link

Implementation of an objdump service #84

Closed ms-xy closed 8 years ago

ms-xy commented 8 years ago

Currently limited to a maximum amount of opcodes that needs to defined in the config. Cannot be unlimited. (no -1 or such option) This limitation is due to efficiency trimming.

Output format of the service: { "fileformat": "...", "number_of_opcodes": 1234, "sections": { ".init": { "name": ".init", "blocks": [ { "name":"blockname/undefined", "offset":"40103f", "opcodes":["jmp","nop","pushq",...] }, ... ] }, ... } }

Average run time for 10k opcodes should not exceed 200ms.

Contains a prototype implementation of a go version of the configuration parser that is available in the totem library (python).

cynexit commented 8 years ago

If you want to optimize this further take a look at profiling: https://blog.golang.org/profiling-go-programs

You might to also have a look at third party JSON implementations and/or build the final output by hand to shave off some more time.

webstergd commented 8 years ago

I just accepted #76 and this breaks some of your code. Would you mind refactoring your pull so it account for the change from Novetta to Holmesprocessing?

ms-xy commented 8 years ago

I'll close this pull request as I have to do a bunch of commits to test out the refactoring, I'll create a new pull request later (I'm not sure if I got each and every change right)