analysis

Documentation

Index

• type Candidate
  • func EvaluateDirectReferences(f *exe.File, strRange *address.Range) ([]Candidate, error)
  • func EvaluateIndirectReferences(f *exe.File, strRange *address.Range) ([]Candidate, error)

Types

type Candidate

type Candidate struct {
	Addr     uint64   // address where the string resides
	Len      uint64   // length of the string
	RefAddrs []uint64 // addresses that reference the string
}

Candidate is a potential candidate string reference

func EvaluateDirectReferences

func EvaluateDirectReferences(f *exe.File, strRange *address.Range) ([]Candidate, error)

EvaluateDirectReferences scans for direct references to the supplied address range and returns candidates

func EvaluateIndirectReferences

func EvaluateIndirectReferences(f *exe.File, strRange *address.Range) ([]Candidate, error)

EvaluateIndirectReferences scans for indirect references to the supplied address range and returns candidates