I think using only two modes, recommend and rank to determine what to incorporate in the analysis is not fine-grained and thus decreases usability for the researcher. Naturally recommend mode will always be wanted, but if there are some relevant functions that were filtered out, we'd have to switch to rank mode, which will include all, including those that are definitely not useful.
We'll make fuzzable operate strictly in recommend, and enable new flags:
--include-sym - analyze a symbol or symbol(s) that was filtered out
--include-nontop - don't filter out only top-level calls for fuzzable analysis, include child nodes too.
I'm going to opt out of doing something like --include-static or --include-imports since I won't imagine a need (and --include-sym would alleviate that for now).
This should also be reflected as an option in disassemblers, or maybe through something nice in the UI (ie checkboxes).
ex0dus-0x
commented
1 year ago
I think using only two modes,
recommendandrankto determine what to incorporate in the analysis is not fine-grained and thus decreases usability for the researcher. Naturallyrecommendmode will always be wanted, but if there are some relevant functions that were filtered out, we'd have to switch torankmode, which will include all, including those that are definitely not useful.We'll make fuzzable operate strictly in
recommend, and enable new flags:--include-sym- analyze a symbol or symbol(s) that was filtered out--include-nontop- don't filter out only top-level calls for fuzzable analysis, include child nodes too.I'm going to opt out of doing something like
--include-staticor--include-importssince I won't imagine a need (and--include-symwould alleviate that for now).This should also be reflected as an option in disassemblers, or maybe through something nice in the UI (ie checkboxes).