---

codescan.cpp

Go to the documentation of this file.

/*
PeRdr - PE file disassembler
Copyright (C) 1999-2003 Frediano Ziglio
-----

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-----

INFORMATION
  www: https://freddy77.tripod.com/perdr/
  e-mail: freddy77@angelfire.com
*/
#include "global.h"
#ifdef HAVE_HDRSTOP
#pragma hdrstop
#endif

#include "signfile.hpp"
#include "module.h"
#include "code.h"
#include "codeglob.h"
#include "x86istr.h"
#include "heuristic.h"
#include "codescan.h"
#ifdef DEBUG
#include <cctype>
#endif
#include "utils/f77auto_ptr"

using namespace std;

//extern IstrReferences varReferences;
//void AddTempFlow(enum FlowTypes flow,vma_t from,vma_t to,
//  enum ByteInfo::TPriority priority);
//bool AddTempFlow(enum FlowTypes flow,vma_t from,const Instruction& instruction,
//  enum ByteInfo::TPriority priority,bool bAddComplex=true);

// declarations
//bool ExecuteComplexReferenceMemory(vma_t address,const Instruction& instruction);

void CodeParser::_ReverseScan(IScanning* scanning,vma_t address,IMachineStatus* status)
{
  _PRG_ASSERT(scanning != NULL);
  _PRG_ASSERT(status != NULL);
  _PRG_ASSERT(&*module != NULL);
  vma_t addr = address;
  // !!! check for loop
  for(;;)
  {
          // processa riferimenti
    IstrReferences::iterator i   =
      istrReferences.beginReferenceTo(addr);
    IstrReferences::iterator end =
      istrReferences.endReferenceTo(addr);
    for(;i != end; ++i)
    {
      if ( !(*i).direct )
      {
        IMachineStatus* newStatus = status->Clone();
        _ReverseScan(scanning,(*i).to,newStatus);
        delete newStatus;
      }
    }

    // testa se esiste un'istruzione precedente
    if (!byteInfo[addr].IsPrevInstruction())
      break;

    // cerca istruzione precedente
    _DEBUG_(vma_t debug_temp_addr = addr);
    while (byteInfo.GetIstrLen(--addr) == 0);
    // !!! bug this can be a bastard overlapped code or non exit call
    // !!! only in max priority
    _PRG_ASSERT(byteInfo.GetIstrLen(addr) == (debug_temp_addr-addr));

    // leggi istruzione precedente
    Instruction currInstruction;
    int result = GetInstruction(*module,addr,currInstruction);
    if (!result)
    {
      _PRG_ASSERT(0);
      return;
    }

    // processa istruzione
    if (!scanning->ProcessInstruction(addr,currInstruction,status,*this))
      break;
  }
}

void CodeParser::ReverseScan(IScanning* scanning,vma_t address)
{
  _PRG_ASSERT(scanning != NULL);
  IMachineStatus* status = scanning->CreateMachineStatus();
  _PRG_ASSERT(status != NULL);
  _PRG_ASSERT(&*module != NULL);
  _ReverseScan(scanning,address,status);
  delete status;
}

class ScanningComplexReg;
class MachineStatusReg: public IMachineStatus
{
public:
  IMachineStatus* Clone() const { return new MachineStatusReg(*this); };
};

class ScanningComplexReg: public IScanning
{
public:
  ScanningComplexReg(vma_t _address,reg_t _reg):
    reg(_reg),address(_address),bResult(true)
  {};
  bool GetResult() const;
  IMachineStatus* CreateMachineStatus() const
  { return new MachineStatusReg(); };
  bool ProcessInstruction(vma_t address,const Instruction& instr,
                          IMachineStatus* status,CodeParser& codeInfo);
private:
  reg_t reg;
  vma_t address;
  bool bResult;

  bool CheckLoop(vma_t address) { return IsPresent(story,address); };
  void AddLabel(vma_t address) { story.insert(address); };
  std::set<vma_t, std::less<vma_t> > story;
};

bool ScanningComplexReg::GetResult() const
{
  return bResult;
}

#ifdef __BORLANDC__
#pragma argsused
#endif
bool ScanningComplexReg::ProcessInstruction(vma_t address,
  const Instruction& instr,IMachineStatus* status,CodeParser& codeInfo)
{
  // segna che abbiamo attraversato questa etichetta
  if ( codeInfo.byteInfo[address].IsLabel() )
  {
    // !!! non ci sono problemi dato che nel loop
    // non ci possono essere modifiche
    if (CheckLoop(address))
      return false; // !!!
    AddLabel(address);
  }

  // !!! cosa succede se ci sono chiamate ???
  enum FlowTypes flow = instr.GetFlowType();
  _PRG_ASSERT( flow != FLOW_JUMP);
  if ( flow == FLOW_CALL )
  {
    // !!! assumi che tutte le chiamate lascino inalterate ESI, EDI, EBX e EBP
    // !!! codice non portatile
    if ( REG(esi)!=reg && REG(edi)!=reg && REG(ebx)!=reg && REG(ebp)!=reg)
      if ( REG(si)!=reg && REG(di)!=reg && REG(bx)!=reg && REG(bp)!=reg )
      {
        bResult = false;
        return false;
      }
  }

  // semplificazione quasi completa
  // ci devono essere solo istruzioni per sovrascrivere registro
  // se un'istruzione non e' supportata ritorna errore
  enum Instruction::UseType useType;
  try
  {
    useType = instr.GetUseType(reg);
  }
  catch (const Instruction::UseTypeUnimplemented&)
  {
    return (bResult = false);
  }
#ifdef DEBUG
  // !!! corregge un errore del debugger di Borland C++ 5.01
  if (useType == 32) return (bResult = false);
#endif
  _PRG_ASSERT(useType != 32);

  if ( (useType&Instruction::useMaskChange) == Instruction::useModify )
  {
    bResult = false;
    return false;
  }

  if ( (useType&Instruction::useMaskChange) == Instruction::useOverwrite )
  {
    Instruction currInstruction;
    _DEBUG_(int res =) GetInstruction(*codeInfo.module,this->address,currInstruction);
    _PRG_ASSERT(res != 0);

    // !!! modify instruction
    _PRG_ASSERT(currInstruction.numArg == 1);
    instr.GetUseType(reg,&currInstruction.Args[0]);

    // caso special: puntatore nullo
    if (currInstruction.Args[0].type == Param::t_literal)
    {
      if (IsNullAddress(currInstruction.Args[0].literal))
        return false;
      if (!codeInfo.module->GetSection(currInstruction.Args[0].literal)->IsCode())
      {
        // !!! segna da qualche parte
        return false;
      }
    }

    // se memoria esegui complesso memoria
    if (currInstruction.Args[0].type == Param::t_memory)
    {
      bResult = codeInfo.ExecuteComplexReferenceMemory(this->address,currInstruction);
      return false;
    }

    // se il reference e' ancora complesso non bisogna aggiungerlo
    if (!codeInfo.AddTempFlow(currInstruction.GetFlowType(),this->address,
           currInstruction,address,
           codeInfo.byteInfo[this->address].GetPriority(),false))
    {
      // sovrascrittura complessa
      // !!! finish (chiama ricorsivamente sccaner per funzioni complesse)
#ifdef DEBUG
//      fprintf(stderr,"Debug: unknow flow\n");
#endif
      bResult = false;
    }
    return false;
  }

  return true;
}

bool CodeParser::ExecuteComplexReferenceReg(vma_t address,const Instruction& instruction)
{
  _PRG_ASSERT(instruction.numArg == 1);
  _PRG_ASSERT(instruction.Args[0].type == Param::t_registry);
  reg_t reg = instruction.Args[0].mem_reg1;
  ScanningComplexReg scan(address,reg);
  ReverseScan(&scan,address);
  return scan.GetResult();
}

bool IsCodePointer(const ByteInfos& byteInfo,vma_t address)
{
  const ByteInfo& info = byteInfo[address];
  if (info.len != addr_bytes)
    return false;
  if (info.GetType() != ByteInfo::typePointer)
    return false;
  return true;
}

bool CodeParser::ExecuteComplexReferenceMemory(vma_t address,const Instruction& instruction)
{
  _PRG_ASSERT(instruction.numArg == 1);
  _PRG_ASSERT(instruction.Args[0].type == Param::t_memory);
  _PRG_ASSERT(&*module != NULL);
  const Param& arg = instruction.Args[0];
  // check for simple jmp dword ptr[reg*4+const]
  // !!! not portable
  // !!! un pochino semplificato
  if (arg.mem_reg1 == null_reg && arg.mem_reg2 != null_reg && arg.factor == addr_bytes)
  {
    // !!! gestire sovrapposizioni con codice
    if (ContainValidAddress(arg))
    {
      unsigned count = 0;
      bool isFirstValid = true;
      // !!! size constant
      try
      {
                                ObjectModule::DataReader reader = module->GetDataReader(arg.literal);
        for(;;)
        {
          for(;;)
          {
            vma_t addr;
            // !!! la seconda volta sono gia' marcati
            if (byteInfo.IsOccupied(reader.Tell(),addr_bytes))
            {
              if (!IsCodePointer(byteInfo,reader.Tell()))
                break;
            }
            if (module->HasRelocation() && !module->GetRelocationInfos().GetRelocation(reader.Tell()))
              break;
            addr = reader.ReadDword();
            if (!module->GetSection(addr)->IsCode())
              break;
            ++count;
          }
          if (count !=0)
            break;
          // ignora errore se e' il primo
          ++count;
          isFirstValid = false;
                                        // starting skipping first entry
                                        reader = reader = module->GetDataReader(arg.literal+addr_bytes);
        }
      }
      catch(const ObjectModule::OutOfAddress&) {}
      if (!isFirstValid)
        --count;
      if (count<=2) // !!! costante
        return false;

      // aggiunge tutti i puntatori per scandire codice
      enum ByteInfo::TPriority priority = byteInfo[address].GetPriority();
      vma_t tableAddress = arg.literal + (isFirstValid ? 0 : addr_bytes);
                        ObjectModule::DataReader reader = module->GetDataReader(tableAddress);
      for(; count != 0 ; --count)
      {
        ByteInfo& info = byteInfo[reader.Tell()];
        info.len = addr_bytes;
        info.SetType(ByteInfo::typePointer);
        info.SetPriority(priority);
        vma_t pointer = reader.ReadDword();
        AddTempFlow(instruction.GetFlowType(),address,pointer,priority);
      }
      byteInfo[tableAddress].SetIsLabel();
      return true;
    }
  }

  if (arg.mem_reg1 == null_reg && arg.mem_reg2 == null_reg && arg.GetMemSize() == (unsigned int)addr_bytes)
  {
    // se non e' un indirizzo invalido esci
    if (!ContainValidAddress(arg))
      return false;

    // processa contenuto corrente
    if (!module->HasRelocation() || module->GetRelocationInfos().GetRelocation(arg.literal))
    {
      vma_t addr;
                        ObjectModule::DataReader reader = module->GetDataReader(arg.literal);
      addr = reader.ReadDword();
      if (!IsNullAddress(addr) && module->GetSection(addr)->IsCode())
      {
        AddTempFlow(instruction.GetFlowType(),address,addr,
                    byteInfo[address].GetPriority());
      }
    }

          // processa riferimenti
    IstrReferences::iterator i   =
      varReferences.beginReferenceTo(arg.literal);
    IstrReferences::iterator end =
      varReferences.endReferenceTo(arg.literal);

    const ByteInfo& info = byteInfo[arg.literal];

    for(;i != end; ++i)
    {
      if ( !(*i).direct )
      {
        // la priorita' della chiamata e' la minima tra chiamata e memoria
        enum ByteInfo::TPriority priority = 
          f77_min(byteInfo[address].GetPriority(),info.GetPriority());

        // leggi istruzione
        Instruction instruction;
        int result = GetInstruction(*module,(*i).to,instruction);
        if (!result)
          return false;

        // !!! test brutale mov [xxx],xxx
        if (instruction.instruction == istr_mov && instruction.Args[0].type == Param::t_memory && instruction.Args[1].type == Param::t_literal)
        {
          _PRG_ASSERT(instruction.Args[0].mem_reg1 == null_reg);
          _PRG_ASSERT(instruction.Args[0].mem_reg2 == null_reg);
          _PRG_ASSERT(instruction.Args[0].literal  == arg.literal);
          if (ContainValidAddress(instruction.Args[1]))
            AddTempFlow(instruction.GetFlowType(),address,
                    instruction.Args[1].literal,
                    priority);
        }
      }
    }
    return true;
  }

  return false;
}

// cerca di "eseguire" un salto complesso
bool CodeParser::ExecuteComplexReference(vma_t address)
{
  _PRG_ASSERT(&*module != NULL);

  // leggi prossima istruzione
  Instruction currInstruction;
  int result = GetInstruction(*module,address,currInstruction);
  if (!result || currInstruction.numArg != 1)
  {
    // !!!
    _PRG_ASSERT(0);
    return false;
  }

  if ( currInstruction.Args[0].type == Param::t_registry )
    return ExecuteComplexReferenceReg(address,currInstruction);

  if ( currInstruction.Args[0].type == Param::t_memory )
    return ExecuteComplexReferenceMemory(address,currInstruction);

  return false;
}

---