search

geohot / qira

QEMU Interactive Runtime Analyser
MIT License
3.93k stars 469 forks source link

I'm still using QIRA 1.0 in CTFs #83

Open geohot opened 9 years ago

geohot commented 9 years ago

There's a lot of stuff broken in trunk, in the middle of codegate now, but why????

geohot commented 9 years ago

Now that codegate is over, there's a lot of work to be done. The analyzer broke, we need to have better tests. QIRA is becoming a fairly complicated piece of code, and it isn't just me writing it anymore.

The static2 refactor was never finished either. I think it's time we commit to it full tilt, and assume we'll have static for every program. Rip out the shitty hacks. Commit 0564060a2cf341571928db06088bac5b68c1b478 is a good example of the direction this needs to go.

nedwill commented 9 years ago

I agree that getting static fully ready and continuing on testing and refactoring is critical so things like the calll bug don't go under the radar again. Progress has been slower that I'd like, so if I put some serious deadlines in place things might go more smoothly. Finishing up regression testing in the CI might be the first thing to do so stuff like the analyzer being broken don't get missed again, and we might catch some other low hanging fruit if we test over a large corpus of programs.

And thanks for the example commit; that is helpful.

geohot commented 9 years ago

You've done more on QIRA than I have this year :)

Regression testing is a good idea. Also, I turned static on by default. I think it's come to a point where we just have to commit, go through a period where QIRA is crappy, and work until what comes out at the end is better. And we can now make the assumption that static is always present.

nedwill commented 9 years ago

I appreciate the recognition but the core of the project is all you. And Tim has been doing a lot of work that's just in other branches (research code haha).

Anyways, yeah, that static on assumption will help a lot in the cleanup. I might look at code coverage tools to make sure we have unit tests to hit all of the important code. I wonder to what extent things like Coveralls (just learned about this recently) are complementary to Travis. They might be mutually exclusive. But if there's a way to make writing tests more fun (going for 100% coverage), then I'll probably do a better job of it!

geohot commented 9 years ago

Woah https://github.com/tim-becker/qira/tree/bap+qira is exciting! Can't wait to see it merged.

And documentation so I can figure out how to use it! One of the things that really helped keep QIRA on track last summer was those CTF problem writeups I did with it. It kept all features grounded in helping me solve problems faster. I'm convinced this was the reason for the actual usability of QIRA vs the EDAs.

ivg commented 9 years ago

@tim-becker, why did you use all this if/elif/elif/... in your validate_bil, instead of the Visitor? @geohot, sorry for creating a noise in this thread, I think that we will move to another thread, if it would be needed.

tim-becker commented 9 years ago

@ivg Honestly, because I didn't know how to use it when I started writing this. I've just rewritten it using Visitor, and it's much nicer. The latest work on this can be found at https://github.com/tim-becker/qira/tree/concrete_execution