Skip to content

Conversation

@dword64
Copy link
Contributor

@dword64 dword64 commented May 8, 2025

you know, if you know

@dword64
Copy link
Contributor Author

dword64 commented May 10, 2025

Image Just leaving this here. As discussed earlier, we're going to implement flags so that the user can override them.

  1. Global Default
  • Set once: symbolic or concrete.
  1. Section-Based Rules
  • .data → symbolic
  • .text → concrete (unless overridden)
  • Use ELF/PE headers to seed these defaults (RWX flags).
  1. Range Overrides
  • User defined: "from 0x401000 to 0x402000 → concrete"
  • Great for runtime mapped config blobs, custom packers.
  1. Runtime Hooking / Dynamic Paging
  • Callback or event system to change policies at runtime:
on_protect_change(addr, new_flags) {
    mem_policy.update(addr, page_flags_to_mode(new_flags));
}

Since this is a hot function (we're reading bytes while disassembling), introducing a branch could impact performance. If possible, we should use templates to handle the logic at compile time, avoiding runtime branches

@NaC-L
Copy link
Owner

NaC-L commented May 16, 2025

todo: fix passes

@NaC-L NaC-L dismissed their stale review June 30, 2025 03:15

lgtm

@NaC-L NaC-L merged commit 16cf84e into NaC-L:main Jun 30, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Lift whole function from bytes Let user concretize/symbolize memory operations Let user lift fully symbolicly, concretely, or emulate

2 participants