corelan/mona — pull request #1 by niklasb (2012-02-29 13:09:41+00:00)
Title: memcompare improvements

Today I present you a fully dynamic programming approach to the (not so trivial) "what the heck did the app to my payload" problem. Basically the `compare` command is rewritten and extended by heuristics to detect byte expansions and swallowed bytes, as well as byte to byte translations.

By default, the new functionality is only enabled for the ASCII comparison mode, and only if only one memory location is found (e.g. when using the `-a [address]` option).

There is also a method `MemoryComparator.generate_pattern`, which is not used yet. Maybe we should add a command that creates such a pattern and outputs it as a Ruby/Perl/Python string.