coresight-decoder is an experimental CoreSight decoder dedicated to fuzzing purposes. It currently supports CoreSight trace from ARM64 ETMv4 or later. We tested it with ARM64 Ubuntu 20.04 and 18.04.
NOTE: coresight-decoder is in the early development stage. Not applicable for production use.
coresight-decoder depends on Capstone version 4.0 or later. This restriction is due to a bug in the ARM64 branch disassembly #1213. Please do not use older versions (e.g. libcapstone-dev from Ubuntu apt packages).
In the below example, install Capstone from the source.
git clone https://github.com/aquynh/capstone.git
cd capstone
git checkout 4.0.2 # checkout the latest version
sudo ./make.sh installNext, checkout and build coresight-decoder.
git clone https://github.com/RICSecLab/coresight-decoder.git
cd coresight-decoder
makeAfter the build is finished, the static library libcsdec.a and the simple decoder application processor should be in the root directory.
The Makefile also provides make test for testing and make debug for a debug build.
Refer to HOWTO for the library usage example.
To use libcsdec.a, link it with the -lcapstone flag to the Capstone shared library. The processor application will show usage when no argument is supplied.
Please open GitHub Issues and Pull Requests. All commits must include a Signed-off-by line using git commit --signoff to enforce the Developer Certificate of Origin (DCO).
coresight-decoder is released under the Apache License, Version 2.0.
This project has received funding from the Acquisition, Technology & Logistics Agency (ATLA) under the Innovative Science and Technology Initiative for Security 2020 (JPJ004596).