Skip to content

v0.4.2

Compare
Choose a tag to compare
@williballenthin williballenthin released this 08 Sep 19:58
· 573 commits to master since this release

adds:

  • analysis::pe::get_functions that returns local functions, thunks, and imports
  • analysis::pe::runtime_functions that parse x64 exception data in .pdata section
  • more x64 function prologue patterns
  • detection (and removal of) thunks from functions list
lancelot vs SoK test suite
  functions:
    precision: 0.871
    recall:    0.850
  basic blocks:
    precision: 0.987
    recall:    0.885
  instructions:
    precision: 0.995
    recall:    0.903

worst performing function recall:
--------  ------------------------------------
0.540136  SoK-windows-testsuite/cl_O2/tee
0.540136  SoK-windows-testsuite/cl_Ox/tee
0.5403    SoK-windows-testsuite/cl_O1/tee
0.5403    SoK-windows-testsuite/cl_Od/tee
0.544627  SoK-windows-testsuite/cl_O2/xxd
0.544627  SoK-windows-testsuite/cl_Ox/xxd
0.545105  SoK-windows-testsuite/cl_O1/xxd
--------  ------------------------------------

worst performing function precision:
--------  ---------------------------------------
0.454656  SoK-windows-testsuite/cl_Ox/libxml2
0.456754  SoK-windows-testsuite/cl_O2/libxml2
0.517874  SoK-windows-testsuite/cl_O2/tiffcrop
0.520982  SoK-windows-testsuite/cl_O2/vim
0.522531  SoK-windows-testsuite/cl_Ox/tiffcrop
0.541377  SoK-windows-testsuite/cl_Ox/vim