search

pkgw / elfx86exts

Decode binaries and print out which instruction set extensions they use. This program's name is a lie: it supports not just x86/ELF but also ARM64, MachO, and possibly more.
MIT License
209 stars 14 forks source link

Proposal: use iced-x86 for your x86 decoding #47

Open woodruffw opened 3 years ago

woodruffw commented 3 years ago

Hey there! A coworker of mine shared this with me, and I thought it was very cool.

I noticed that you're using Capstone for your instruction decoding, and then mapping Capstone's internal "group" enum back to human-readable identifiers. I wanted to propose that you give iced-x86 a spin (no affiliation!); I think it has several features that you'll find advantageous:

  1. It has direct support for CPUID/feature-level extraction, via cpuid_features
  2. It's written in pure Rust, which means that your users won't need to install libcapstone
  3. It's much more correct than Capstone (from fuzzing), about on par with Intel's reference decoder (XED)

I'm happy to help with the work that would be involved in replacing Capstone, if you're interested! Feel free to close otherwise 🙂

pkgw commented 3 years ago

Hi — thanks for your interest!

The short story is that I am super busy these days and this tool is a very low priority for me, so this I am definitely not going to undertake this work myself anytime soon. But if someone's interested and wants to attempt this switch, I am more than happy to accept contributions! I'll leave this issue open for tracking purposes.

HanabishiRecca commented 1 year ago

I don't think it is worth doing here as it effectively requires rewriting the app from scratch. Latest fixes made the app perform well enough. Also ARM support is a thing.

I started a standalone X86-only tool instead: https://github.com/HanabishiRecca/bin-cpuflags-x86 Using iced-x86 it is 20-30x faster according to my tests.

pkgw commented 1 year ago

Impressive! @HanabishiRecca I am more than happy to update the README and other materials to recommend people to use your tool if/when it meets their needs — seeing as I only aim to put minimal maintenance effort into this tool, I absolutely do not mind any "competition". Feel free to submit a pull request on the topic if you'd like.

(Just to be clear, this invitation extends to anyone else who happens to read this as well!)

HanabishiRecca commented 1 year ago

Thank you. I think this project can benefit more from wider architectures support. As far as I can tell, at this point it downs to simply mapping existing Capstone groups to human-readable aliases.