Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Panopticon: A libre, cross platform disassembler for reverse engineering

panopticon.re

Post reply on HN
Print view View original

61–70 of 90 posts

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#61

Post by Someone »

dman wrote: post #31
Someone wrote: post #27

Earlier quoted context omitted.

Those do not remove any bugs; it just changes how they are handled (ignore and hope for the best vs print diagnostic and terminate program, and the latter not in all cases)

Assuming that tests exist, and have good coverage, wont the checked iterator implementations mentioned above catch most issues with invalid iterators?

For some definition of ‘good coverage’ and ‘most’: yes.

I do not think 100% coverage on the code you write alone is enough to get to ‘all', though. For example, if your test declares a vector and calls a function that does

    v.erase( i, v.end());
with i == v.end(), you get 100% coverage, but in production, that part of the code might be called with i == v.begin(), and that invalidates all iterators on the vector.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#62

Post by [deleted] »

kayamon wrote: post #60
jbaviat wrote: post #55

Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…

FYI you most definitely can beat LLVM in terms of quality. Its diassembler was designed originally only to support the instructions that the compiler could generate. While they've since filled out most of the instruction set, there are still a whole set of subtleties it can't deal with well, simply because the compiler part of it was never designed to output them. (e.g. see segment prefixes)

[deleted]

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#63

Post by jbaviat »

kayamon wrote: post #60
jbaviat wrote: post #55

Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…

FYI you most definitely can beat LLVM in terms of quality. Its diassembler was designed originally only to support the instructions that the compiler could generate. While they've since filled out most of the instruction set, there are still a whole set of subtleties it can't deal with well, simply because the compiler part of it was never designed to output them. (e.g. see segment prefixes)

It depends on what you are looking to achieve.

If you take a look to e.g. McSema https://github.com/trailofbits/mcsema, these guys have been able to use LLVM to transform assembly back to LLVM intermediate representation (IR). The IR is an abstract language used by LLVM during compilation to optimize the generated code. Being abstract basically allows to use optimizers across all LLVM supported architectures.

In these terms, I think LLVM has a clear advantage over competitors.

The following blog post give a nice overview of the McSema achievements: http://blog.trailofbits.com/2014/06/23/a-preview-of-mcsema/

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#64

Post by munin »

jbaviat wrote: post #63
kayamon wrote: post #60

Earlier quoted context omitted.

FYI you most definitely can beat LLVM in terms of quality. Its diassembler was designed originally only to support the instructions that the compiler could generate. While they've since filled out most of the instruction set, there are still a whole set of subtleties it can't deal with well, simply because the compiler part of it was never designed to output them. (e.g. see segment prefixes)

It depends on what you are looking to achieve. If you take a look to e.g. McSema https://github.com/trailofbits/mcsema , these guys have been able to use LLVM to transform assembly back to LLVM intermediate representation (IR). The IR is an abstract language used by LLVM during compilation to optimize the generated code. Being abstract basically allows to use optimizers across all LLVM supported architectures. In the…

hi, I'm one of the mcsema authors and the original author who was responsible for mcsema using the LLVM instruction decoder and it was a mistake. if I had a choice between going back in time and assassinating Hitler, or convincing myself to use XED instead of mcinst...

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#65

Post by jbaviat »

munin wrote: post #64
jbaviat wrote: post #63

Earlier quoted context omitted.

It depends on what you are looking to achieve. If you take a look to e.g. McSema https://github.com/trailofbits/mcsema , these guys have been able to use LLVM to transform assembly back to LLVM intermediate representation (IR). The IR is an abstract language used by LLVM during compilation to optimize the generated code. Being abstract basically allows to use optimizers across all LLVM supported architectures. In the…

hi, I'm one of the mcsema authors and the original author who was responsible for mcsema using the LLVM instruction decoder and it was a mistake. if I had a choice between going back in time and assassinating Hitler, or convincing myself to use XED instead of mcinst...

Hi Munin,

What you did with McSema was really impressive and I’m glad discussing with one of the authors! I get the point you regret using LLVM, it seemed to me to be the best choice since LLVM has wide instruction semantics implementations, that more basic tools such as Xed do not offer. If I get it correctly… you would rather re-implement such semantic yourself? Or have you got any other tool / idea I’m not aware of?

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#67

Post by munin »

jbaviat wrote: post #65
munin wrote: post #64

Earlier quoted context omitted.

hi, I'm one of the mcsema authors and the original author who was responsible for mcsema using the LLVM instruction decoder and it was a mistake. if I had a choice between going back in time and assassinating Hitler, or convincing myself to use XED instead of mcinst...

Hi Munin, What you did with McSema was really impressive and I’m glad discussing with one of the authors! I get the point you regret using LLVM, it seemed to me to be the best choice since LLVM has wide instruction semantics implementations, that more basic tools such as Xed do not offer. If I get it correctly… you would rather re-implement such semantic yourself? Or have you got any other tool / idea I’m not aware o…

I don't regret using LLVM at all. I regret using the instruction decoding features in LLVM. if I could do it again (and someone younger, smarter, and better looking than me is) I would combine the LLVM IR with the XED instruction decoder. we would still emit the semantics of the instructions as LLVM, but we would use XED to figure out which instruction we were decoding.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#69

Post by flanfly »

munin wrote: post #66

I noticed that this only supports AVR. what is your plan to support x86? would you think about linking against some external code that provides semantics for x86?

The README is a bit out of date. It support MOS 6502 and parts of x86_64 too. I currently writing the lifting code that translates x86 opcodes to a simpler intermediate language: https://github.com/flanfly/panopticon/blob/feature/rreil/lib...

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#70

Post by psifertex »

jbaviat wrote: post #55

Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…

There's also Binary Ninja. Still in beta, but available to anyone who requests to join the beta before it's public release: https://binary.ninja
Post reply on HN