static-analysis-engineering / CodeHawk-Binary

CodeHawk Binary Analyzer for malware analysis and general reverse engineering
MIT License
24 stars 10 forks source link

Use the full context address to reference blocks in cfg diff json output #153

Closed waskyo closed 5 months ago

waskyo commented 5 months ago

it is exposed as a new attribute, id, since it can be used to uniquely identify the block, whereas the pure address can be shared among many blocks in the presence of really weird instructions, such as POPCC.

This also switches the cfg edges to use the id/context address and not the bare bones address. And the same applies to the block mapping. The only place that wasn't changed was the list of blocks changed in FunctionRelationalAnalysis, that felt like a much bigger change and I wasn't sure it was needed.

Some whitespace changes snuck in because of my editor settings, apologies.