Skip to content

Commit 60dc380

Browse files
committed
ci fixes on rustdoc
1 parent b122f6a commit 60dc380

17 files changed

Lines changed: 58 additions & 65 deletions

File tree

Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ license = "Apache-2.0"
1818
authors = ["Sriram <marirs@gmail.com>"]
1919
repository = "https://github.com/marirs/strix"
2020
description = "Extract obfuscated strings from binaries"
21-
keywords = ["malware", "strings", "deobfuscation", "reverse-engineering", "floss"]
21+
keywords = ["malware", "strings", "deobfuscation", "reverse-engineering", "binary-analysis"]
2222
categories = ["command-line-utilities", "parser-implementations"]
2323

2424
[workspace.dependencies]

crates/strix-cli/src/main.rs

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -200,10 +200,9 @@ fn main() -> Result<()> {
200200

201201
/// Render a human-readable grouped report.
202202
///
203-
/// Sections appear in a fixed order matching FLOSS conventions:
204-
/// static, language, decoded, stack, tight. Empty sections are
205-
/// skipped. Within a section, strings are sorted by address (if
206-
/// known) else by file offset.
203+
/// Sections appear in a fixed order — static, language, decoded,
204+
/// stack, tight — with empty sections skipped. Within a section,
205+
/// strings are sorted by address (if known) else by file offset.
207206
fn print_human(result: &ExtractionResult<'_>, out: &mut dyn Write, quiet: bool) -> io::Result<()> {
208207
let groups = group_strings(&result.strings);
209208
let order = [

crates/strix-core/src/lib.rs

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
//! Core types and JSON schema for the strix string-extraction library.
22
//!
3-
//! The JSON output is designed to be compatible with `flare-floss`'s
4-
//! `--json` output where it makes sense, so consumers can swap one for
5-
//! the other.
6-
//!
73
//! Lifetimes here are deliberate: every string-bearing struct carries
84
//! a `'a` so that extractors that scan the input file directly
95
//! (static, language) can borrow `&str` slices into the input bytes
@@ -25,8 +21,8 @@ pub use traits::Extractor;
2521

2622
/// The kind of string that was extracted.
2723
///
28-
/// This mirrors FLOSS's categories so the JSON output is intelligible to
29-
/// existing FLOSS tooling.
24+
/// String categories cover both raw printable runs (static / language)
25+
/// and bytes produced at runtime by decoders (stack / tight / decoded).
3026
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
3127
#[serde(rename_all = "snake_case")]
3228
pub enum StringKind {
@@ -143,15 +139,15 @@ impl<'a> ExtractedString<'a> {
143139
/// Options controlling extraction.
144140
#[derive(Debug, Clone)]
145141
pub struct ExtractOptions {
146-
/// Minimum string length (in characters) for static strings. FLOSS
147-
/// default is 4.
142+
/// Minimum string length (in characters) for static strings.
143+
/// Default is 4, matching the convention of classic `strings(1)`.
148144
pub min_length: usize,
149145
/// Which extractors to run. If `None`, run all available.
150146
pub enabled: Option<Vec<StringKind>>,
151147
/// Override file format detection. `None` = auto-detect.
152148
pub format_override: Option<FormatHint>,
153149
/// Hard upper bound on emulation work (per-function steps); applied
154-
/// only by the emulation extractors. FLOSS default analog is ~20_000.
150+
/// only by the emulation extractors. Reasonable default ~20_000.
155151
pub max_emulation_steps: u64,
156152
/// If true, drop duplicate strings from the result (matching on
157153
/// value + kind + encoding). The first occurrence is kept with its

crates/strix-emulator/src/analyzer.rs

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
//! Code-flow analyzer built on [`iced_x86`].
1+
//! Code-flow analyzer built on `iced_x86`.
22
//!
33
//! Discovers functions, basic blocks, and call-graph edges in an
44
//! executable. This is the analog of vivisect's analyzer in the
5-
//! original FLOSS Python code.
5+
//! intermediate code-flow representation the higher-level extractors
6+
//! consume.
67
//!
78
//! Two discovery strategies are combined:
89
//!

crates/strix-emulator/src/driver.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@
2020
//! * **Snapshot/restore of `.data`/`.bss` between runs.** Writes to
2121
//! the binary's writable sections leak across argument variations.
2222
//! * **Tight-string classification.** Stack writes inside a tight
23-
//! inner loop are FLOSS's "tight strings", currently lumped in
24-
//! with regular stack strings.
23+
//! inner loop are categorized as "tight strings", currently
24+
//! lumped in with regular stack strings.
2525
2626
#![allow(missing_docs)]
2727

@@ -426,7 +426,7 @@ impl EmulationDriver {
426426
self.run_function_with(entry, max_steps, &sets)
427427
}
428428

429-
/// Same as [`run_function_fuzzed`] but with caller-supplied arg
429+
/// Same as [`Self::run_function_fuzzed`] but with caller-supplied arg
430430
/// sets. Useful for tests that want to exercise a specific shape.
431431
pub fn run_function_with(
432432
&mut self,

crates/strix-emulator/src/emulator.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
//! `unicorn-engine` links a C library and users who only want static
55
//! or language-string extraction shouldn't have to pay for it.
66
//!
7-
//! # What this gives FLOSS's algorithms
7+
//! # What this gives the higher-level extractors
88
//!
9-
//! FLOSS's decoded/stack/tight extractors work by emulating candidate
9+
//! The decoded/stack/tight extractors work by emulating candidate
1010
//! functions and observing the bytes they write to memory. The
1111
//! primitives needed are:
1212
//!

crates/strix-emulator/src/heuristics.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
//! Heuristics for identifying candidate decoder routines.
22
//!
3-
//! FLOSS's decoder identification looks at several signals per
3+
//! Decoder identification looks at several signals per
44
//! function. We score each signal independently in `[0.0, 1.0]` and
55
//! combine them with tunable weights into a final `score`.
66
//!
@@ -18,8 +18,8 @@
1818
//! * **Caller count.** Decoders are typically called many times (each
1919
//! string callsite). Functions with no callers are deprioritized.
2020
//!
21-
//! Default weights are an educated guess; tune against the FLOSS test
22-
//! corpus once we can run on real binaries.
21+
//! Default weights are an educated guess; tune against the
22+
//! decoder-fixture corpus once we can run on real binaries.
2323
2424
use std::collections::BTreeMap;
2525

crates/strix-emulator/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ pub struct EmulationResults<'a> {
5454

5555
/// Minimum decoder score to bother emulating a candidate function.
5656
///
57-
/// Tuned empirically against the FLOSS test fixtures: 0.3 catches the
57+
/// Tuned empirically against the decoder fixtures: 0.3 catches the
5858
/// borderline decoders in `test-decode-from-heap*` and the 64-bit
5959
/// `single-byte-xor` / `base64` / `substitution-cipher` fixtures
6060
/// without exploding emulation time on real binaries.

crates/strix-emulator/src/stack_strings.rs

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@
1010
//! mov byte [rsp+3], 0
1111
//! ```
1212
//!
13-
//! FLOSS detects these via pattern analysis on the disassembly,
14-
//! independent of full CPU emulation. This module ports that
15-
//! approach. It runs entirely on iced-x86 — no Unicorn required —
16-
//! so it's available even when the `unicorn` feature is off, and
17-
//! it catches stack strings inside functions our brute-force
18-
//! emulator can't get into (faults early, indirect entry, etc.).
13+
//! We detect these via pattern analysis on the disassembly,
14+
//! independent of full CPU emulation. The matcher runs entirely on
15+
//! iced-x86 — no Unicorn required — so it's available even when the
16+
//! `unicorn` feature is off, and it catches stack strings inside
17+
//! functions our brute-force emulator can't get into (faults early,
18+
//! indirect entry, etc.).
1919
//!
2020
//! # Algorithm
2121
//!
@@ -37,8 +37,8 @@
3737
//! stores is preserved — which is what matters for the printable
3838
//! run.
3939
//! * **Register-relative stores.** `mov [rbp+N], imm` and stores via
40-
//! other base registers are not recognized. FLOSS treats `rbp` the
41-
//! same as `rsp`; adding that here is a one-line change.
40+
//! other base registers are not recognized. Adding the standard
41+
//! x86 base registers here is a localized one-line change.
4242
//! * **Multi-instruction patterns.** A common pattern is
4343
//! `mov eax, 0x6c6c6548; mov [rsp], eax` (writes "Hell" via a
4444
//! register). That requires tracking immediate-into-register

crates/strix-format/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
//! Binary file-format parsing for strix.
22
//!
3-
//! We use [`goblin`] to identify and parse PE, ELF, and Mach-O files,
3+
//! We use `goblin` to identify and parse PE, ELF, and Mach-O files,
44
//! plus a passthrough for raw shellcode. The result is a unified
55
//! [`ParsedInput`] structure describing the architecture, bitness,
66
//! and a flat list of [`Section`]s that string extractors can use to

0 commit comments

Comments
 (0)