ampotos / dynStruct

Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
MIT License
314 stars 34 forks source link

monitor the stack #18

Open ampotos opened 8 years ago

ampotos commented 8 years ago

Add the mornitoring of the stack in the data gatherer. How to do that in a the best way will need some research.

My actual idea is: Register every stack frame as a block. Block created with a call and free on the return. Must change the size when a push is done. May have to do be 'cut' during the recovery process when a struct is detected.