ampotos / dynStruct

Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
MIT License
314 stars 34 forks source link

Add static analysis when no context is available #10

Open ampotos opened 8 years ago

ampotos commented 8 years ago

For some accesses the context instruction does not provide any context. When it's the case for every access of a member the type stay the default one.

The data gatherer will not record more instructions, but dynStruct.py can do a bit of static analysis for member with a default type. The idea here is to check the isntructions and the context isntruction are really the same (if not it can be auto-modifying code and in that case stop the static analysis). If they are the same looking maximum X instructions before/after (depending if it is a read or a write access) to see if some context may be available and use it for recovering the type of the member.

The main issue here will be to follow the execution flow of the function (especially backward) maybe limiting the static analysis to the basic block containing the access is a good start.