qs: tag for string that is not referenced by code

[williballenthin]

most strings (at least in the data section) should be referenced directly by code. but maybe there are strings that are embedded in binary data. we should find a way to differentiate these cases. this relies on having code/disassembly analysis (such as via idalib)

[williballenthin]

@vee1e fyi, as this came up in a brainstorming session today and we thought it was interesting.

[vee1e]

thanks for the tag @williballenthin! i'm currently packed with the drafting of my GSoC proposal, but this is an interesting differentiator to tag with. i'll try to find time to research on this and how we can use idalib to resolve these references.

[vee1e]

i'll take a look at this for the next few days. in the meantime @mr-tz @williballenthin i understand you're probably swamped with gsoc work right now, so no pressure, but if i could get a review on my few open PRs that would be really helpful!

[vee1e]

preliminary results on this using lancelot are interesting but show performance degradation: 66s on quantumstrand:go-hello64.exe vs 104s with my branch (before optimizations ignored it)

you can see my implementation on https://github.com/vee1e/flare-floss/tree/feat/unref-string

_get_code_ranges (now _analyze_code_ranges_and_references) now disassembles operands for each insn checking if any point directly to the address of the string inside a valid section. to avoid doing this for dense binaries (>120k strings for testing, can be changed) to avoid perf runaway.

i have IDA Pro and could probably implement this with idalib, but that would make it out of reach for hobbyist developers who don't have a license. let me know your thoughts!