sibyl func now works also for PE and RAW binary

cea-sec / Sibyl

A Miasm2 based function divination.

Other

531 stars 55 forks source link

sibyl func now works also for PE and RAW binary #63

Open LRGH opened 7 years ago

LRGH commented 7 years ago

I should have included non-regression tests for sibyl func but I don't know how we are expected to include tests for PE files, which cannot be easily created by compilation on Travis CI virtual machines.

commial commented 7 years ago

Hi, Thanks for the PR. Regarding the implementation, Container.from_stream is actually taking an optional argument addr. To quote the associated docstring: "Base address for the binary. If set, force the unknown format". It does seems to match what you're looking for.

In addition, I'm not sure to see interest of shifting the mapping of a ELF or PE file. So, the fact that -m use will force the ContainerRaw is fine to me.

LRGH commented 7 years ago

Thanks. I have updated my patch to use this option of Container.from_stream.