elfmaster / binflow Goto Github PK
View Code? Open in Web Editor NEWThis is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)
This is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)
Is it reasonable to request that this software be made easily extensible to other architectures, such as ARM and RISC-V? I, personally, would find great use in such a tool and would work to the best of my ability on it.
Just found this, looks like a cool project!
Just some comments on how Capstone engine is used:
Latest version 3.0.2 is more complete, smaller & faster than v2.1.2, so please update.
The API cs_disasm_ex()
is still supported (but deprecated) but it is better to use the new API name cs_disasm()
now.
Rather than checking instruction mnemonic string, you can use instruction id (cs_insn.id
), such as X86_INS_JAE
, for example.
In Capstone 3.0.2, you can easily check if an instruction is a JUMP instruction by using the API cs_insn_group()
with group id X86_GRP_JUMP
, like followings:
if (cs_insn_group(handle, insn, X86_GRP_JUMP)) { /* this is a jump instruction */ }
We also have other groups such for CALL, INT, IRET etc. See x86.h
for more info.
For more details, see tests\test_x86.c
on how to take advantage of some other API (such as turning on DETAIL mode for above instruction details)
Thanks.
I feel that your tool is great, but sometimes I have some problems, so I hope that you can continue to update to solve these bugs, thank you.
No matter whether tracing with -b
or -p
, binflow always crashes with a segfault.
trace:
Stack trace of thread 20472:
#0 0x000000000040375f n/a (binflow)
#1 0x0000000000403ee0 n/a (binflow)
#2 0x0000000000402f7a n/a (binflow)
#3 0x00007fc9b65ea291 __libc_start_main (libc.so.6)
#4 0x0000000000402949 n/a (binflow)
Runing on Arch linux x86_64 4.8.13-1
$binflow -s -b /bin/ls
PLT_call@0x4049c4: _setjmp("AWAVAUATUS")
LOCAL_call@0x41395c: sub_4022d0()
PLT_call@0x40da7e: lseek("/bin/ls", 0x2f)
PLT_call@0x40ccf5: getenv("BLOCK_SIZE", 0x61f148)
PLT_call@0x40cd0b: getenv((text_t *)4189ec, 0x61f148)
PLT_call@0x40cd21: getenv("POSIXLY_CORRECT", 0x61f148)
PLT_call@0x40ebe7: strncmp()
LOCAL_call@0x40ec06: sub_411830()
LOCAL_call@0x41183f: sub_411680(0x38)
PLT_call@0x411684: ungetc(0x38, 0x38, 0x1)
PLT_call@0x40ebe7: strncmp()
LOCAL_call@0x40ec06: sub_411830()
LOCAL_call@0x41183f: sub_411680(0x38)
PLT_call@0x411684: ungetc(0x38, 0x38, 0x38)
pid_read() failed: Input/output error <0x0>
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.