Fravia's TOOLS OF OUR TRADE Messageboard ~ Moderated
An advanced profiler - a flow tracker - a smartcheck written by us
Tuesday, 16-Feb-99 03:06:05

> so you may have a subroutine that copys
> a string from point a to point b which turns
> out to be one of the most heavily used
> 'functions' or 'code areas' --having maybe
> 900 iterations-- according to the profiler,
> but which is in a larger routine that is
> only called once.

And yet... would that not be quite useful nevertheless for our purposes?

An 'advanced profiler' should do exactly this: imagine -to give you a clearer frame- an intelligent smartcheck, written by a reverser, and not by a code-developer. You would have the SAME results, more or less, yet presented in a much more useful way -for us- . Ahah! Filewrite! Ahah! Stringcompare! Ahah! Datecheck... imagine MANY big red arrows and imagine they are pointing to the relevant parts of your salami source code. I wouldn't call that a telephatic tool, infact that's what smartcheck already does, yet heavily clobbered by a wealth of informations and a type of presentation and a lack of specific filter functionalities that make its use at times a nightmare.

Once more, maybe I'm not the best smartchecking specialist and there are really ways of getting ONLY the reversing relevant information out of it. I'm still compelled to have quick eyes to write down on paper where, more or less, its event sequence seems to be when something happens, in order to slowly crawl back into the relevant parts of its listing later.

Surely there SHOULD be a better way and a better tool to accomplish more or less the same task. Of course the program should know what to monitor, that's the whole point of it, yet would it be so difficult to implement a dozen of switches?

Note that this would indeed be tantamount to "write a program to run another, watch it, then print out a report with a big red arrow saying *here is where the protection is*". Yeah, that's more or less what I was thinking of, yet not limited to protection schemes. Wanna know where in an unknown target is the 'printing' routine? Run our new tool on your target with switch -p, relax and get a ONE page listing.
Wanna know where it does save? Run with switch -s, and so on. Quicker than creating a 20 megabytes dead listing and grepping it afterwards, and more flexible as well, or am I mistaken? You get the idea?

IMO the fact that in the past reverser have not much used a profiler does not meen, as svd correctly writes on this same thread, that this kind of tools -if AMELIORATED- wouldn't be quite useful for reversing purposes as well.

OK, noone seems to know much about the existence of such a tool, yet it cannot be so difficult to write it. I'll have a more thorough look by myself, searching code that can be tweaked 'on a quickye' starting with old dos profiler tools and will post the results as soon as I have anything that seems to work. I bet something like this could be even written in Visual Basic and would have quite a 'market' among reversers :-)

Thanks anyway, good guys.

cu
Giglio

Giglio