refactor: separate detectors from filters#44
Merged
Conversation
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
7 times, most recently
from
11d9de3 to
6596f13
Compare
maxgio92
changed the title
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
8 times, most recently
from
57c18d1 to
e7651b2
Compare
maxgio92
changed the title
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
13 times, most recently
from
479bfba to
d6dd226
Compare
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
4 times, most recently
from
54e78da to
c92ffe3
Compare
maxgio92
changed the title
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
4 times, most recently
from
7ca1b3b to
db02e61
Compare
Add CandidateDetector type symmetric with CandidateFilter, and WithDetectors option symmetric with WithFilters. DetectFunctionsFromELF is the only API now. EhFrameDetector emits CFI candidates from .eh_frame FDE records. EhFrameFilter is now a pure filter: retains only FDE-confirmed candidates and upgrades their confidence. It never appends. Default pipeline in DetectFunctionsFromELF: - detectors: [disasmDetector, EhFrameDetector] - filters: [CETFilter, EhFrameFilter, PLTFilter] Signed-off-by: Massimiliano Giovagnoli <maxgio92@pm.me>
maxgio92
force-pushed
the
refactor/detector-pipeline
branch
from
db02e61 to
6050525
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
EhFrameFilterwas doing double duty: emitting candidates from.eh_frameFDE records AND filtering disasm candidates against them. This mix of concerns made the pipeline hard to reason about and impossible to customize cleanly. The public API also had confusing overlap between multiple ELF-based entry points.What
The pipeline is now cleanly split:
*elf.File:DisasmDetector,EhFrameDetectorCETFilter,EhFrameFilter,PLTFilterWithDetectorsandWithFilterslet callers replace either pipelineDetectFunctionsFromELF(f *elf.File, opts ...Option)is the single ELF entry pointDetectProloguesandDetectCallSitesremain as the raw-bytes primitivesDetectProloguesFromELFandDetectCallSitesFromELFare removed - they were thin wrappers with no logic of their ownCloses #43.