ampotos / dynStruct

Reverse engineering tool for automatic structure recovering and memory use analysis based on DynamoRIO and Capstone
MIT License
314 stars 34 forks source link

Recording base address used for memory access #5

Open ampotos opened 8 years ago

ampotos commented 8 years ago

When an access is record, if the access is of the form base + disp + scale * index record the base value. The base will change between each block and may change inside a block. So recording it in a AVL tree can be a gooo think. The tree can be store in the access_t structure and the data must store the base adrress and the number of time it was used for this offset. Record is a disp and/or scale*index was used to perform the access can also be a good idea (just storing a flag is nice, Idon't think we need the value).

Also this data have to be add on the ouptut, at least Json output (the console output may disappear soon).

This will be later used for inner struct or inner array during the structure recovery. It also be needed to when the monitoring of the stack will be add.