Extend the reference library with assembly-level and runtime reading
Add references/assembly-idioms.md: the x86/x64 conventions, frame and epilogue fingerprints, string-instruction and x87 idioms, virtual dispatch, and WOW64 path redirection, each stated with what it changes about reading or patching a routine. Add the managed-decompilation, Unity IL2CPP and packaged-Python references, with the capability registry, host-probe and plan entries they depend on. Register all four in the routing index, symptom table, route inventory, coverage and evidence records, and add P37 for a 32-bit target's registry and file views.
This commit is contained in:
@@ -136,7 +136,9 @@ an evidence record.
|
||||
What it covers, and what it deliberately does not, is stated in the skill itself
|
||||
(`skills/exe-reverse/references/coverage-and-limits.md`). The short version: Windows PE on x86 and
|
||||
x64, deep on the layers that have been worked through — triage, patching, signatures, licensing
|
||||
classification, protectors, managed code, and the hardware-observation route map. Defeating a
|
||||
classification, protectors, managed code, and the hardware-observation route map. Two
|
||||
application-runtime layers — Unity IL2CPP metadata recovery and packaged Python — are documented
|
||||
from public write-ups, and are graded `unverified` for that reason. Defeating a
|
||||
server-side authority, a fully automated general-purpose devirtualiser, defeating a named commercial
|
||||
protector as a product claim, and any guarantee on a Windows build this repository has not measured
|
||||
are **not** covered, and the skill is written to say so and stop rather than apply the nearest
|
||||
@@ -176,6 +178,8 @@ exercise.
|
||||
|
||||
---
|
||||
|
||||
Proudly supported by the [LINUX DO](https://linux.do) community.
|
||||
|
||||
## Disclaimer
|
||||
|
||||
The material is provided *as is*, without warranty of any kind. Results are recorded as they were
|
||||
|
||||
Reference in New Issue
Block a user