Cleaning/doccing searchfilter and static search

elbee-cyber / RopView

A BinaryNinja plugin for contextual gadget analysis and semantic/hueristic based querying.

MIT License

47 stars 1 forks source link

Open elbee-cyber opened 6 months ago

elbee-cyber commented 6 months ago

Clean and optimize static search, finish filter keyword translating and preset translating.

Keywords:

Presets:

elbee-cyber commented 1 month ago

Presets:

Change execve -> "rax==0xdeadbeef or rdi==0xdeadbeef or rdx==0 or rsi==0 or (disasm.has('syscall') and inst_cnt==1)"
srop -> "rax==15 or (inst_cnt==1 and disasm.has('syscall'))"
csu -> "disasm.has('pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15') or disasm.has('mov rdx, r15 ; mov rsi, r14')" (depth needs to be high to detect full csu gadgets)

elbee-cyber commented 1 month ago

Add option to hide lower registers for amd64