Skip to content
This repository was archived by the owner on Aug 23, 2022. It is now read-only.

Latest commit

 

History

History
28 lines (20 loc) · 2.25 KB

CommandLineReference.md

File metadata and controls

28 lines (20 loc) · 2.25 KB

McSema Command Line Reference

mcsema-disass

Usage: mcsema-disass --disassembler path-to-IDA --os operating-system --arch architecture --output cfg-path --binary input-binary --entrypoint function [--log_file log-path]

Where:

  • path-to-IDA = the path to your IDA Pro disassembler executable, e.g., ~/ida-6.9/idal64
  • operating-system = the OS of the binary being disassembled: linux, or windows
  • architecture = the instruction set architecture of the binary being disassembled: amd64, amd64_avx, x86, x86_avx, or aarch64 (64-bit ARMv8)
  • cfg-path = the path a .cfg file where you want the recovered control flow graph to be saved
  • input-binary = the path to a binary executable to be disassembled
  • function = the entry point function where the disassembler should start recovering control flow, e.g., main
  • log-path = (optional) the path to a log file to save the logging output of McSema

mcsema-lift

Usage: mcsema-lift-${version} --arch architecture --os platform --cfg cfg-path [--output output-path] [--libc_constructor init-function] [--libc_destructor fini-function]

Where:

  • architecture = architecture to use for the instruction semantics during lifting: amd64, amd64_avx, x86, x86_avx, or aarch64 (64-bit ARMv8)
  • platform = the operating system of the binary that was disassembled to generate this CFG. Currently the valid options are linux or windows. This option is required for certain aspects of translation, like ABI compatibility for external functions, etc.
  • cfg-path = path to the control flow graph file emitted by mcsema-disass that you want to convert into bitcode
  • output-path = path to a .bc file where you want the lifted code to be saved. If the --output option is not specified, the bitcode will be written to stdout
  • init-function = constructor function for running pre-main initializers. It is executed before the main and constructs the global objects. This feature is important for lifting the C++ programs. On GNU-based systems, this is typically __libc_csu_init.
  • fini-function = destructor function for running post-main finalizers. It is executed after the main function at program exit. On GNU-based systems, this is typically __libc_csu_fini.