Willi Ballenthin

triage sok function recall

2

see https://github.com/williballenthin/lancelot/blob/master/resources/evaluation/SoK/analyze-sok.ipynb  pick a testcase: ```yml (env) user@hostname ~/c/l/r/e/SoK> python benchmark.py tee lancelot vs SoK test suite functions: precision: 0.971 recall: 0.529 basic blocks: precision: 0.990 recall: 0.813 instructions:...

document release workflow

1

- [ ] bump `./flirt/Cargo.toml::package::version` - [ ] bump `./core/Cargo.toml::package::version` - [ ] update `./core/Cargo.toml::dependencies::lancelot-flirt::version` - [ ] bump `./pylancelot/Cargo.toml::package::version` - [ ] bump `./bin/Cargo.toml::package::version` - [ ] update `./bin/Cargo.toml::dependencies::lancelot::version`...

`ClipUp.exe` is a license manager thing and seems to be packed. ``` user@hostname ~/c/lancelot> cargo run --bin smoke -- /mnt/c/Windows/System32/ClipUp.exe 101 v0.2.0-line! Finished dev [unoptimized + debuginfo] target(s) in 0.08s...

linear disassembler should ignore pointer tables

1

``` user@hostname ~/c/lancelot> cargo run --bin smoke -- /mnt/c/Windows/System32/d3d11sdklayers.dll -vv 101 v0.2.0-line! Finished dev [unoptimized + debuginfo] target(s) in 0.13s Running `target/debug/smoke /mnt/c/Windows/System32/d3d11sdklayers.dll -vv` 2020-06-10 12:31:03 [DEBUG] smoke input: /mnt/c/Windows/System32/d3d11sdklayers.dll...

07858d5562766d8239a7c961feea087c ``` 2020-05-14 11:05:26 [INFO ] auto-detected loader: Windows/x32/PE Run with RUST_BACKTRACE=full to include source snippets. Backtrace (most recent call first): File "", line 0, in lancelot::pagemap::PageMap::write File "", line...

failed to detect PE format

1

sample: 70744...

see example PE files here: https://github.com/NationalSecurityAgency/ghidra/pull/418#issuecomment-486889500

switch detection

4

samples: - cc688ff3a525bac5e1241d13fae8d97a:10001EA1

including: - dal - aam - unexpected `in` - das