ampotos / dynStruct

Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
MIT License
316 stars 34 forks source link

pointer detection in the data gatherer #13

Open ampotos opened 8 years ago

ampotos commented 8 years ago

It's a lot more easier to detect pointer at runtime than after, even with some context. So the data gatherer may set a flag on the access_t structure when an offset is storing a value which can be a memory address. To know if a value is a memory address the size must be of a pointer size, and the value must point to a mapped address.

This must be implemented with a minimum overhead (that's why the value will not ba traced to know if it's used to do a memory access). To do that it is possible to store all section on an AVl tree and to check if the value stored is on that tree or in the block tree.