alephsecurity / alephsecurity/xnu-qemu-arm64-tools

[GHIDRA] Trace inspection

Abierto
#3 0 comentarios 0 reacciones 0 asignados Ver en GitHub
enhancement
Lenguaje dominante
C
Estrellas
181
Forks
46
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

### Description
A Ghidra script that will get a recorded trace file from qemu(attached) as input and will produce a way to track the flow of the program from the “Listing” window, or any other option the developer will find the best.
Two sub-features here:
- List the addresses the RET instruction will jump to
- List the addresses the [Branch and Control](http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/Cihfddaf.html) instructions will jump to

For example on instruction that looks like:
![image](https://user-images.githubusercontent.com/9990629/69981299-bcea9c80-153a-11ea-9864-d0b0f7cf5d31.png)

We would like to know the list of the pointers LR holds in that moment. Can be implemented with the hovering feature, comments or another method the developer will find preferable.
### Resources
The executed instruction can be retrieved by following regular expression (Group 3):
```
((Trace \d: 0x.+? \[.+?\/)(.+)(\/.+\] ))
```

[TraceExample.txt](https://github.com/alephsecurity/xnu-qemu-arm64-scripts/files/3912492/TraceExample.txt)

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.