Open karlek opened 5 years ago
File format reverse engineering mode. Annotate, color, document, select and mark field as length or offset, reserved, etc. Inspired by yours truly.
For binary instrumentation, investigate using uprobes (instead of ptrace) as we wish to get execution context for every instruction. For this purpose, uprobes should be more performant than ptrace.
Putting this here to have easy access to the links.
For emulation, rather than relying on e.g. QEMU, we should look into Unicorn (by the same people that wrote Capstone).
Slides from 2015: https://www.unicorn-engine.org/BHUSA2015-unicorn.pdf
Stumbled upon this, as I'd love to play around with the Tiny Code Generator of QEMU, and as it turns out, Unicorn is essentially QEMU without "bloat" (or rather features useful for emulation, but feature we will not need for static and dynamic analysis of binaries).
Surrounding
Interactive
Dynamic
Static
IR (thesis)
Call graph
Control flow analysis (control flow primitive recovery)
Data flow analysis
Symbolic execution
Pseudo code generation (decompilation)
Type analysis
printf
Corpus (static library detection)
Shingled graph
Recursive Descent Disassembly
Syscalls
Compiler version detection based on analysis of output when compiling a given function with several different versions of the same compiler (e.g. one docker per compiler version)
Future aspirational