capa icon indicating copy to clipboard operation
capa copied to clipboard

Published 20 hours ago • verified publisher icon mandiant

viv: x86: extract function call arguments

Open williballenthin opened this issue 3 years ago • 1 comments

supporting #771, figure out how to extract function call arguments with vivisect against x86 programs.

williballenthin avatar Mar 24 '22 16:03 williballenthin

potential strategy: do an emulation pass (such as via viv-utils FullCoverageEmulatorDriver) and extract reg/stack context at each call site. then use calling convention and API definition info to extract arguments.

can use the metadata from the ruleset to figure out which API calls are ever inspected and only extracte/evaluate the scope when there's at least one rule interested in the API.

williballenthin avatar Mar 24 '22 16:03 williballenthin