hum the only problem is that while on Linux the `objdump d` osquery #core

hum, the only problem is that while on Linux the `...

Stefano Bonicatti

12/23/2020, 5:13 PM

hum, the only problem is that while on Linux the

objdump -d

can be parsed and the instructions extracted with a couple of

awk

calls, on Windows the format is all space separated

Copy code

00000001409E2444: 49 8B 5B 38        mov         rbx,qword ptr [r11+38h]

and then we have also things like:

Copy code

00000001409E245D: CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC  IIIIIIIIIIIIIIII