capa
capa copied to clipboard
viv: x86: extract function call arguments
supporting #771, figure out how to extract function call arguments with vivisect against x86 programs.
potential strategy: do an emulation pass (such as via viv-utils FullCoverageEmulatorDriver
) and extract reg/stack context at each call site. then use calling convention and API definition info to extract arguments.
can use the metadata from the ruleset to figure out which API calls are ever inspected and only extracte/evaluate the scope when there's at least one rule interested in the API.