drakvuf icon indicating copy to clipboard operation
drakvuf copied to clipboard

Support for Capstone Disassembler

Open aoshiken opened this issue 6 years ago • 1 comments

@tklengyel, I think adding support for the Capstone Disassembler would be very useful for setting traps inside functions because we're currently limited to symbols addresses or harcoded offsets inside these symbols.

The changes would be minimal, just adding the library search in configure.ac and perhaps checking for a minimal version (2.0 if you ask me).

Probably I'm shooting before loading the gun but... thoughts?

aoshiken avatar Nov 07 '18 13:11 aoshiken

Yes, if there is a particular usecase that requires trapping inside functions or programs without debug data, Capstone would be a good choice to use for dissassembly.

tklengyel avatar Nov 07 '18 13:11 tklengyel