full-disclosure - Re: [Dailydave] Capstone disassembly framework: looking for Beta-testers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALs2ch8HcvAqqUGqwsi9dPm8wHoAHySnJnggzL9gQf_5Xt3kYg@mail.gmail.com>
Date: Thu, 21 Nov 2013 23:07:06 +0800
From: Nguyen Anh Quynh <aquynh@...il.com>
To: Albert López <newbiesworld@...mail.com>
Cc: "dailydave@...ts.immunityinc.com" <dailydave@...ts.immunityinc.com>,
 "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: [Dailydave] Capstone disassembly framework:
	looking for Beta-testers

On Thu, Nov 21, 2013 at 10:40 PM, Nguyen Anh Quynh <aquynh@...il.com> wrote:

>
>
>
> On Thu, Nov 21, 2013 at 9:32 PM, Albert López <newbiesworld@...mail.com>wrote:
>
>>
>> Mmmm, I haven't played a lot with Radare, but I think that it already has
>> all (or almost all) your "unique features" ;)
>>
>> http://radare.org/ <http://radare.org/y/>
>>
>> Moreover, they have a great documentation:
>> http://radare.org/y/?p=documentation
>>
>> Just in case you don't know the tool :)
>>
>>
> cool, your observation is really interesting! yes, i am well aware of
> Radare, which is an excellent tool in my opinion. however, with all due
> respect, there are some differences that i want to elaborate here:
>
> - first of all, Radare is not really a "lightweight" disasm framework. in
> fact it is more like a tool set that includes a lot of small libs and tools
> inside. you can do, but i think it is not very trivial to use Radare as
> disasm framework, which is not its main task.
>
> - on supporting hardware architectures (X86 + ARM + ARM-64 + Mips): Radare
> relies on a bunch of disasm engines, but most of them are really outdated,
> with no support for newer instructions & CPU extensions. that is true on
> all above archs, with no exception i guess. on the other hand, we believe
> Capstone has better support for these archs. (of course Radare works for a
> lot other archs, but that is not what we focus on so far)
>
> - on decomposition functionality, as said above, Radare doesn't seem to do
> that itself, but relies on other frameworks (correct me if i am wrong
> here). and even Radare can do that, i doubt that it supports all above
> archs.
>
> - on instruction semantics, i am not sure if Radare give us the list of
> implicit registers read/written for disasm instructions, or if it can do
> that for all above archs. somebody can enlighten me here, if i am wrong.
>
> - on API, i am quite confident that Capstone API is as
> simple/clean/lightweight/intuitive as anything else, or even more. this is
> the key when we designed the API. lets see if this is true when the
> framework is released - soon after testing phase.
>
> - on bindings: i am not sure if Radare has a list of bindings like
> Capstone, which includes Python, Ruby, Ocaml, Java, C# & Go. and these
> bindings are all manually written to be lightweight and efficient, as we
> dont like bloated SWIG.
>

well, just found from the doc that Radare has a lot more bindings. thanks
to SWIG, i guess?

still i am not sure if the bindings can be used for disasm purpose,
however. soon enough, somebody will come here to enlighten me, i guess :-)

cheers,
Q

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/