@@ -50,13 +50,13 @@ Clone the code using:
5050 git clone --recursive https://github.com/pfalcon/ScratchABit
5151
5252If you cloned code without ` --recursive ` , run ` git submodule update --init `
53- in ScratchABit directory.
53+ in the ScratchABit directory.
5454
5555ScratchABit now ships with [ Capstone Engine] ( http://www.capstone-engine.org/ )
56- based CPU plugin(s), which allows access to a number of CPU architectures.
57- To use it, a recent Python bindings for Capstone should be installed
56+ based CPU plugin(s), which allow access to a number of CPU architectures.
57+ To use it, recent Python bindings module for Capstone should be installed
5858(in the preference to packages shipped by OS distributions, which are often
59- outdated). The easiest way to install it into the Python user packages
59+ outdated). The easiest way to install it is into the Python user packages
6060directory:
6161
6262 pip3 install --no-cache-dir --user capstone
@@ -71,8 +71,10 @@ the ScratchABit directory:
7171
7272Whenever you open a new terminal session to work with ScratchABit,
7373run ` source .venv/bin/activate ` command again to activate the virtual
74- environment. An alternative to using venv and activating it every time
75- is to install the capstone package system-wide:
74+ environment.
75+
76+ If nothing of the above works, you can try to install the capstone
77+ package system-wide (not recommended):
7678
7779 sudo pip3 install --system capstone
7880
@@ -92,26 +94,26 @@ to create a .def (definition) file, to specify what memory areas are
9294defined for the code, at which address to load binary file, etc. (Note:
9395a .def file may be useful for .elf and similar files too.) The repository
9496includes a simple x86_64 raw binary code, and the corresponding
95- [ example-x86_64.def] ( example-x86_64.def ) file (looks inside for
97+ [ example-x86_64.def] ( example-x86_64.def ) file (look inside for
9698description of available options):
9799
98100 python3 ScratchABit.py example-x86_64.def
99101
100102Press F9 to access menus (mouse works too in XTerm-compatible terminals).
101103Press F1 to get help about key bindings (most actions are also accessible
102- via menu). The workflow of the ScratchABit is similar to other interactive
103- dissamblers; some previous experience or background reading may be helpful).
104+ via menu). The workflow of ScratchABit is similar to other interactive
105+ dissamblers ( some previous experience or background reading may be helpful).
104106
105107Using Plugins
106108-------------
107109
108110IDAPython processor plugins can be loaded from anywhere on the Python
109- module path. Alternatively, you can symlink the plugin ` .py ` file into
110- the ` plugins/cpu/ ` subdirectory.
111+ module path. Alternatively, you can symlink/copy the plugin ` .py ` file(s)
112+ into the [ ` plugins/cpu/ ` ] ( plugins/cpu/ ) subdirectory.
111113
112114After the plugin is made available, create a new definition file based
113- on ` example-x86_64.def ` that sets the plugin module name in the ` cpu xxx `
114- line.
115+ on [ ` example-x86_64.def ` ] ( example-x86_64.def#L4 ) that sets the plugin module
116+ name (without ` .py ` extenstion) in the ` cpu xxx ` line.
115117
116118For a very simple example that uses an external plugin, see this
117119[ esp8266.def file] ( https://gist.github.com/projectgus/f898d5798e3e44240796 )
@@ -149,15 +151,18 @@ FAQ
149151A: ScratchABit doesn't support any processor architectures on its own,
150152it is fully retargettable using IDAPython API plugins. Many plugins are
151153available, writing a new plugin is easy. To let users test-drive
152- ScratchABit, a simple X86 processor plugin is included in the
154+ ScratchABit, a simple x86 processor plugin is included in the
153155distribution, using [ Pymsasid] ( https://github.com/pfalcon/pymsasid3 )
154156disassembler under the hood.
155157
156- From version 1.9 , [ Capstone] ( http://www.capstone-engine.org/ ) plugin
158+ From version 2.0 , [ Capstone] ( http://www.capstone-engine.org/ ) plugin
157159is also included, allowing access to a number of architectures,
158160including x86, ARM, MIPS, PowerPC, SPARC, etc. (architecture support
159161is enabled gradually based on user testing).
160162
163+ You can read about the plugins shipped together with ScratchABit in
164+ the [ README for ` plugins/cpu/ ` dir] ( plugins/cpu/ ) .
165+
161166> Q: Debugger?
162167
163168A: ScratchABit is dedicated to static analysis and easy support for
0 commit comments