cpu_rec_rs

Determine which CPU architecture is used in a binary file. Example:

$ cpu_rec_rs /bin/bash /usr/lib/firmware/rtlwifi/rtl8821aefw*
Loading corpus from cpu_rec_corpus/*.corpus
----------------------------------------------------------------------------------------
                      File                       |     Range     | Detected Architecture
----------------------------------------------------------------------------------------
/bin/bash                                        | Whole file    | X86-64
/usr/lib/firmware/rtlwifi/rtl8821aefw_29.bin     | 0x3200-0x4400 | 8051
/usr/lib/firmware/rtlwifi/rtl8821aefw_29.bin     | 0x4600-0x5000 | 8051
/usr/lib/firmware/rtlwifi/rtl8821aefw_29.bin     | 0x6000-0x6600 | 8051
/usr/lib/firmware/rtlwifi/rtl8821aefw_29.bin     | 0x6600-0x6c00 | 8051
/usr/lib/firmware/rtlwifi/rtl8821aefw.bin        | Whole file    | 8051
/usr/lib/firmware/rtlwifi/rtl8821aefw_wowlan.bin | Whole file    | 8051
----------------------------------------------

Note: as the approach is based on statistics, false positives are definitely possible. You should cross check with other sources and validate the results with a disassembler.

In particular, small files are more prone to false positives, as well as smaller sliding windows. Common false positives include:

• xmos_xs2a
• NDS32

About

cpu_rec_rs is a Rust reimplementation of the original cpu_rec. Why reimplement it?

• Performance
• Code simplification
• Rust practice

The original cpu_rec contains a lot of code necessary for experimenting and updating the corpus. If you want to play with various settings for prediction, please use cpu_rec. It also contains documentation and links to the theory behind it (SSTIC presentation).