Open mr-tz opened 3 years ago
this looks like an inlined memcpy to a destination on the stack. is it a stackstring??? jk i dont really want to debate that.
We currently only check if a mov
goes directly to the stack. Here it goes to a register first then to the stack.
I think this specific pattern is easy enough to adapt. Shall we? If so we should check for prevalence (see #424).
PMA Lab 01-04
no detection in IDA or viv of stackstring