---

CodeParser Class Reference

#include <codeglob.h>

Inheritance diagram for CodeParser:

List of all members.

Public Methods
void	AddExportTempFlow (vma_t to, enum ByteInfo::TPriority priority)
bool	AddTempFlow (enum FlowTypes flow, vma_t from, const Instruction &instruction, vma_t instAddress, enum ByteInfo::TPriority priority, bool bAddComplex=true)
void	AddTempFlow (enum FlowTypes flow, vma_t from, vma_t to, enum ByteInfo::TPriority priority)
bool	ExtractTempRef (TempReference &tempRef)
void	_ReverseScan (IScanning *scanning, vma_t address, IMachineStatus *status)
void	ReverseScan (IScanning *scanning, vma_t address)
bool	ExecuteComplexReference (vma_t address)
bool	ExecuteComplexReferenceMemory (vma_t address, const Instruction &instruction)
bool	ExecuteComplexReferenceReg (vma_t address, const Instruction &instruction)
bool	CheckCodeRecursively (vma_t address, ByteInfo::TPriority priority, bool _bSetLabel=true)
bool	CheckCode (vma_t &address, ByteInfo::TPriority priority, bool bSetLabel=true)
bool	IsApiReference (const Param &arg) const
bool	ContainValidAddress (const Param &param) const
Private Types
enum	TScanCodeResult {   scanCodeAlreadyProcessed, scanCodeNoError, scanCodeOverlapped, scanCodeInvalidJump,   scanCodeInvalid, scanCodeMax = scanCodeInvalid }
Private Methods
void	Parse (CSignFile &_file, uint32_t imageBase, vma_t entryPoint, const RVAFileTranslator &rva, const Symbols &api, const Symbols &exportedApi, bool hasRelocation, const RelocationInfos &relocationInfos)
void	ExcludeFileRange (CSignFile &_file, const RVAFileTranslator &rva, uint32_t imageBase)
enum TScanCodeResult	ScanCode (vma_t &address, ByteInfo::TPriority priority, bool bSetLabel=true)
void	CheckForAddress (vma_t instAddress, const Instruction &instruction, enum ByteInfo::TPriority priority)
void	SetCodeRange (const range< vma_t > &r, ByteInfo::TPriority priority, bool bSetLabel=true)
void	ResetCodeRange (const range< vma_t > &r)
void	CheckImmediateCodeAddress (const Instruction &instruction)
void	GetStringStats (vma_t address, unsigned &len, unsigned &num_printable)
void	GetPointerArrayStats (vma_t address, PointerArrayStat &stat)
void	GetBitStat (vma_t address, unsigned numBytes, BitStat &stat)
void	CheckReference (vma_t address)
void	CheckJumpReference (vma_t address, const Instruction &instruction)
void	WriteCode ()
void	WriteString (vma_t address, int len) const
void	WriteBegin (vma_t address, int num_bytes) const
Friends
void	ParseCode (CSignFile &file, uint32_t imageBase, vma_t entryPoint, const RVAFileTranslator &rva, const Symbols &symbols, const Symbols &exportedSymbols, bool hasRelocation, const RelocationInfos &relocationInfos)

---

Member Enumeration Documentation

enum CodeParser::TScanCodeResult [private]

Enumeration values: scanCodeAlreadyProcessed  scanCodeNoError  scanCodeOverlapped  scanCodeInvalidJump  scanCodeInvalid  scanCodeMax  Definition at line 164 of file codeglob.h. Referenced by CheckCode(), CheckCodeRecursively(), and ScanCode(). { scanCodeAlreadyProcessed, scanCodeNoError, scanCodeOverlapped, scanCodeInvalidJump, scanCodeInvalid, scanCodeMax = scanCodeInvalid };

---

Member Function Documentation

void CodeParser::_ReverseScan (  IScanning *    scanning, vma_t    address, IMachineStatus *    status )

Definition at line 53 of file codescan.cpp. References _DEBUG_, _PRG_ASSERT, IstrReferences::beginReferenceTo(), CodeInfo::byteInfo, IMachineStatus::Clone(), IstrReferences::endReferenceTo(), GetInstruction(), ByteInfos::GetIstrLen(), CodeInfo::istrReferences, IstrReferences::iterator, CodeInfo::module, IScanning::ProcessInstruction(), and vma_t. Referenced by ReverseScan(). { _PRG_ASSERT(scanning != NULL); _PRG_ASSERT(status != NULL); _PRG_ASSERT(&*module != NULL); vma_t addr = address; // !!! check for loop for(;;) { // processa riferimenti IstrReferences::iterator i = istrReferences.beginReferenceTo(addr); IstrReferences::iterator end = istrReferences.endReferenceTo(addr); for(;i != end; ++i) { if ( !(*i).direct ) { IMachineStatus* newStatus = status->Clone(); _ReverseScan(scanning,(*i).to,newStatus); delete newStatus; } } // testa se esiste un'istruzione precedente if (!byteInfo[addr].IsPrevInstruction()) break; // cerca istruzione precedente _DEBUG_(vma_t debug_temp_addr = addr); while (byteInfo.GetIstrLen(--addr) == 0); // !!! bug this can be a bastard overlapped code or non exit call // !!! only in max priority _PRG_ASSERT(byteInfo.GetIstrLen(addr) == (debug_temp_addr-addr)); // leggi istruzione precedente Instruction currInstruction; int result = GetInstruction(*module,addr,currInstruction); if (!result) { _PRG_ASSERT(0); return; } // processa istruzione if (!scanning->ProcessInstruction(addr,currInstruction,status,*this)) break; } }

void CodeParser::AddExportTempFlow (  vma_t    to, enum ByteInfo::TPriority    priority )

Definition at line 233 of file code.cpp. References _PRG_ASSERT, IstrReferences::beginReferenceTo(), IstrReferences::endReferenceTo(), FLOW_NONE, IstrReference::from, CodeInfo::istrReferences, TempReference::priority, CodeInfo::pTempRefs, IstrReference::to, ByteInfo::TPriority, IstrReference::type, and vma_t. Referenced by CheckCodeRecursively(), and Parse(). { _PRG_ASSERT(pTempRefs != NULL); // !!! funzione ?? if ( istrReferences.beginReferenceTo(to) != istrReferences.endReferenceTo(to) ) return; TempReference tempRef; tempRef.from = 0; // !!! tempRef.type = FLOW_NONE; tempRef.to = to; tempRef.priority = static_cast<uchar>(priority); pTempRefs->push(tempRef); }

void CodeParser::AddTempFlow (  enum FlowTypes    flow, vma_t    from, vma_t    to, enum ByteInfo::TPriority    priority )

Definition at line 144 of file code.cpp. References FLOW_CALL, FLOW_CJUMP, FLOW_JUMP, FLOW_NONE, FLOW_RET, FlowTypes, IstrReference::from, IstrReferences::IsPresent(), CodeInfo::istrReferences, ByteInfo::priCheckOnly, TempReference::priority, CodeInfo::pTempRefs, IstrReference::to, ByteInfo::TPriority, IstrReference::type, and vma_t. { if (flow == FLOW_NONE || flow == FLOW_RET) return; // non aggiungere se usato solo per check #ifdef DEBUG int inc = (priority == ByteInfo::priCheckOnly)?0:1; #endif TempReference tempRef; tempRef.from = from; tempRef.type = flow; tempRef.to = to; tempRef.priority = static_cast<uchar>(priority); if (istrReferences.IsPresent(tempRef.from,tempRef.to)) return; switch(flow) { case FLOW_CALL: pTempRefs->push(tempRef); #ifdef DEBUG calls += inc; #endif break; case FLOW_CJUMP: case FLOW_JUMP: pTempRefs->push(tempRef); #ifdef DEBUG jumps += inc; #endif break; } }

bool CodeParser::AddTempFlow (  enum FlowTypes    flow, vma_t    from, const Instruction &    instruction, vma_t    instAddress, enum ByteInfo::TPriority    priority, bool    bAddComplex = true )

Definition at line 183 of file code.cpp. References CodeInfo::apiAlias, Instruction::Args, CodeInfo::complexReference, ContainValidAddress(), FLOW_JUMP, FLOW_NONE, FLOW_RET, FlowTypes, ObjectModule::GetSymbols(), Param::literal, Param::mem_reg1, Param::mem_reg2, CodeInfo::module, null_reg, ByteInfo::priCheckOnly, Param::t_literal, Param::t_memory, ByteInfo::TPriority, Param::type, vma_t, and WriteInstruction(). Referenced by ExecuteComplexReferenceMemory(), ScanningComplexReg::ProcessInstruction(), and ScanCode(). { if (flow == FLOW_NONE || flow == FLOW_RET) return true; const Param &param = instruction.Args[0]; if (param.type != Param::t_literal) { // se memoria e solo offset registra indirizzo, vedi se chiamata DLL if (param.type == Param::t_memory) if (param.mem_reg1 == null_reg && param.mem_reg2 == null_reg) { if ( ContainValidAddress(param) ) { pair<Symbols::iterator,Symbols::iterator> sym = module->GetSymbols()[param.literal]; if ( sym.first != sym.second ) { if (flow == FLOW_JUMP) { apiAlias[from] = param.literal; } return true; // ok! chiamata/salto a DLL } } } // !!! finish // se registro scandire indietro e vedere possibili valori // (se costanti o variabili caricate) // se memoria del tipo [4*reg+const] provare tabella if (bAddComplex && priority != ByteInfo::priCheckOnly) complexReference.insert(instAddress); #if 0 #ifdef DEBUG fprintf(stderr,"Debug: (Flow) "); WriteInstruction(instruction,stderr); #endif #endif return false; } // !!! check relocation ?? // !!! se codice a 16 bit e chiamata far dovrebbe esserci rilocazione AddTempFlow(flow,from,instruction.Args[0].literal,priority); return true; }

bool CodeParser::CheckCode (  vma_t &    address, ByteInfo::TPriority    priority, bool    bSetLabel = true )

Definition at line 506 of file code.cpp. References _PRG_ASSERT, ExtractTempRef(), ByteInfo::priCheckOnly, CodeInfo::pTempRefs, ResetCodeRange(), ScanCode(), scanCodeInvalid, scanCodeNoError, SetCodeRange(), ByteInfo::TPriority, TScanCodeResult, and vma_t. Referenced by Parse(). { _PRG_ASSERT(pTempRefs->size() == 0); TScanCodeResult lastResult = scanCodeNoError; // testa se il codice e' corretto vma_t start = address; vma_t scanAddress; try { scanAddress = start; lastResult = ScanCode(scanAddress,ByteInfo::priCheckOnly,bSetLabel); } catch(const ObjectModule::OutOfAddress&) { lastResult = scanCodeInvalid; } for (TempReference tempRef;ExtractTempRef(tempRef);); // setta o resetta codice if (lastResult <= scanCodeNoError) SetCodeRange(range<vma_t>(start,scanAddress),priority,bSetLabel); else ResetCodeRange(range<vma_t>(start,scanAddress)); {for (TempReference tempRef;ExtractTempRef(tempRef););} address = scanAddress; return (lastResult <= scanCodeNoError); }

bool CodeParser::CheckCodeRecursively (  vma_t    address, ByteInfo::TPriority    priority, bool    _bSetLabel = true )

Definition at line 549 of file code.cpp. References _PRG_ASSERT, AddExportTempFlow(), range_set< T >::begin(), range_set< T >::end(), ExtractTempRef(), range_set< T >::insert(), ByteInfo::priCheckOnly, CodeInfo::pTempRefs, ResetCodeRange(), ScanCode(), scanCodeInvalid, scanCodeNoError, SetCodeRange(), TAddresses, IstrReference::to, ByteInfo::TPriority, TScanCodeResult, and vma_t. Referenced by Parse(), and THeuristicMotor::Process(). { _PRG_ASSERT(pTempRefs->size() == 0); // insieme di codice scannato range_set<vma_t> ranges; // handle one instruction (jmp/ret) process TAddresses addresses; TScanCodeResult lastResult = scanCodeNoError; bool bSetLabel = _bSetLabel; // scandisci a partire dall'entry AddExportTempFlow(address,ByteInfo::priCheckOnly); for (;;) { TempReference tempRef; if (!ExtractTempRef(tempRef)) break; // scandisci il codice vma_t address = tempRef.to; try { lastResult = ScanCode(address,ByteInfo::priCheckOnly,bSetLabel); } catch(const ObjectModule::OutOfAddress&) { lastResult = scanCodeInvalid; } // solo al primo non marcare label bSetLabel = true; // marca il codice scandito _PRG_ASSERT(tempRef.to <= address); if ( tempRef.to == address) addresses.insert(tempRef.to); else ranges.insert(range<vma_t>(tempRef.to,address)); // se errore fermati if (lastResult > scanCodeNoError) break; } // scandisce tutti i range possibili { typedef range_set<vma_t>::iterator iterator; iterator i = ranges.begin(); iterator end = ranges.end(); for(;i!=end;++i) { if (lastResult <= scanCodeNoError) SetCodeRange(*i,priority,_bSetLabel || (*i).begin != address); else // !!! se il codice e' scandito con successo setta priorita' anche // nella cella end. Non inserisce inst_offset+1 in ranges altrimenti // se e' un ret ScanCode successivo si ferma a meta' range ResetCodeRange(*i); } } // scandisce tutti gli indirizzi possibili { typedef TAddresses::iterator iterator; iterator i = addresses.begin(); iterator end = addresses.end(); for(;i!=end;++i) { if (lastResult <= scanCodeNoError) SetCodeRange(range<vma_t>(*i,*i),priority,_bSetLabel || (*i) != address); else // !!! se il codice e' scandito con successo setta priorita' anche // nella cella end. Non inserisce inst_offset+1 in ranges altrimenti // se e' un ret ScanCode successivo si ferma a meta' range ResetCodeRange(range<vma_t>(*i,*i)); } } // estrae tutti i reference temporanei for (TempReference tempRef;ExtractTempRef(tempRef);); return (lastResult <= scanCodeNoError); }

void CodeParser::CheckForAddress (  vma_t    instAddress, const Instruction &    instruction, enum ByteInfo::TPriority    priority )  [private]

Definition at line 60 of file code.cpp. References IstrReferences::Add(), CodeInfo::addrGeneral, Instruction::Args, CodeInfo::byteInfo, ContainValidAddress(), FLOW_NONE, Param::GetLiteralSize(), Param::GetMemSize(), ByteInfo::GetPriority(), ByteInfos::IsOccupied(), ByteInfo::len, Param::literal, Param::mem_reg1, Param::mem_reg2, null_reg, Instruction::numArg, ByteInfo::SetIsLabel(), ByteInfo::SetPriority(), ByteInfo::SetType(), Param::t_literal, Param::t_memory, ByteInfo::TPriority, Param::type, ByteInfo::typeInteger, CodeInfo::varReferences, and vma_t. Referenced by ScanCode(). { for (int n=0; n < instruction.numArg; ++n) { const Param *param = &instruction.Args[n]; switch (param->type) { case Param::t_literal: if (param->GetLiteralSize() != addr_bytes) break; // testa indirizzo if (!ContainValidAddress(*param)) break; // inserisci indirizzo corrente addrGeneral.insert(param->literal); break; case Param::t_memory: // testa indirizzo if (!ContainValidAddress(*param)) break; // testa indirizzamento diretto if (param->mem_reg1 == null_reg && param->mem_reg2 == null_reg) { // verifica che la memoria punti effettivamente a qualcosa, // altrimenti e' solo un riferimento if ( param->GetMemSize() != 0 ) { varReferences.Add(instAddress,param->literal,FLOW_NONE); // !!! se priorita' piu alta ? if (!byteInfo.IsOccupied(param->literal,param->GetMemSize())) { ByteInfo& info = byteInfo[param->literal]; if (info.GetPriority() < priority) { info.len = param->GetMemSize(); // !!! not only Integer, can be float or a structure (for save state) info.SetType(ByteInfo::typeInteger); info.SetPriority(priority); info.SetIsLabel(); } } break; } } // inserisci indirizzo corrente addrGeneral.insert(param->literal); break; } } }

void CodeParser::CheckImmediateCodeAddress (  const Instruction &    instruction )  [private]

Definition at line 113 of file code.cpp. References _PRG_ASSERT, CodeInfo::addrConstants, Instruction::Args, ContainValidAddress(), Param::GetLiteralSize(), Instruction::instruction, Param::literal, Instruction::numArg, Param::t_literal, Param::type, and vma_t. Referenced by ScanCode(). { vma_t address; const Param *param; switch(instruction.instruction) { // solo mov e push dato che il parametro non e' usato per operazioni // (presuppongono assegnazione o copia) // !!! non portatile case istr_mov: _PRG_ASSERT(instruction.numArg >= 2); _PRG_ASSERT(instruction.Args[1].type != Param::t_literal || instruction.Args[1].GetLiteralSize() != 0); param = &instruction.Args[1]; goto addr_ok; case istr_push: param = &instruction.Args[0]; addr_ok: // verifica dimensione e if ( param->type != Param::t_literal || param->GetLiteralSize() != addr_bytes ) break; address = param->literal; // testa codice if (!ContainValidAddress(*param)) break; // inserisci indirizzo corrente addrConstants.insert(address); break; } }

void CodeParser::CheckJumpReference (  vma_t    address, const Instruction &    instruction )  [private]

Definition at line 129 of file codeprn.cpp. References CodeInfo::apiAlias, Instruction::Args, ObjectModule::GetExportSymbols(), ObjectModule::GetSymbols(), IsPresent(), Param::literal, Param::mem_reg1, Param::mem_reg2, CodeInfo::module, null_reg, Instruction::numArg, StartBeginComment(), Param::t_literal, Param::t_memory, Param::type, and vma_t. Referenced by WriteCode(). { // check for api reference for (int i=0; i<instruction.numArg; ++i) { const Param &arg = instruction.Args[i]; if (arg.type == Param::t_memory) { // call/jmp dword ptr [constant] if (arg.mem_reg1 == null_reg && arg.mem_reg2 == null_reg) { pair<Symbols::iterator,Symbols::iterator> sym = module->GetSymbols()[arg.literal]; for(;sym.first != sym.second;++sym.first) { StartBeginComment(); printf("Reference to %s",(*sym.first).name.c_str()); } } } if (arg.type == Param::t_literal) { // salti a jmp ad api if (IsPresent(apiAlias,arg.literal)) { pair<Symbols::iterator,Symbols::iterator> sym = module->GetSymbols()[apiAlias[arg.literal]]; for(;sym.first != sym.second;++sym.first) { StartBeginComment(); printf("Reference to %s",(*sym.first).name.c_str()); } } // salti a funzioni esportate pair<Symbols::iterator,Symbols::iterator> sym = module->GetExportSymbols()[arg.literal]; for(;sym.first != sym.second;++sym.first) { StartBeginComment(); printf("Reference to %s",(*sym.first).name.c_str()); } } } }

void CodeParser::CheckReference (  vma_t    address )  [private]

Definition at line 102 of file codeprn.cpp. References IstrReferences::beginReferenceTo(), IstrReferences::endReferenceTo(), ObjectModule::GetEntryPoint(), ObjectModule::GetExportSymbols(), CodeInfo::istrReferences, CodeInfo::module, StartBeginComment(), and vma_t. Referenced by WriteCode(). { // entry point if (address == module->GetEntryPoint()) { StartBeginComment(); printf("Program entry point"); } // export // !!! manca ordinal pair<Symbols::iterator,Symbols::iterator> sym = module->GetExportSymbols()[address]; for(;sym.first != sym.second;++sym.first) { StartBeginComment(); printf("Exported function %s",(*sym.first).name.c_str()); } // testa presenza riferimento std::for_each(istrReferences.beginReferenceTo(address), istrReferences.endReferenceTo(address), CheckRef()); }

bool CodeParser::ContainValidAddress (  const Param &    param )  const

Definition at line 33 of file codeglob.cpp. References ObjectModule::HasRelocation(), ObjectModule::IsValid(), Param::literal, CodeInfo::module, and Param::relocation. Referenced by AddTempFlow(), CheckForAddress(), CheckImmediateCodeAddress(), ExecuteComplexReferenceMemory(), IsApiReference(), and THeuristicMotor::THeuristicMotor(). { if (!module->HasRelocation()) return module->IsValid(param.literal); return param.relocation != NULL; }

void CodeParser::ExcludeFileRange (  CSignFile &    _file, const RVAFileTranslator &    rva, uint32_t    imageBase )  [private]

Definition at line 642 of file code.cpp. References range< T >::begin, range_set< T >::begin(), CodeInfo::byteInfo, range< T >::end, range_set< T >::end(), RVAFileTranslator::File2RVASafe(), CSignFile::GetRanges(), RVAFileTranslator::GetSection(), ByteInfo::priMax, PeSection::RawAddress, PeSection::RawSize, ByteInfo::SetPriority(), ByteInfo::SetType(), ByteInfo::typeLoader, and vma_t. Referenced by Parse(). { range_set<long> excludeRange = _file.GetRanges(); range_set<long>::iterator i = excludeRange.begin(); range_set<long>::iterator end = excludeRange.end(); for( ;i!= end; ++i) { // !!! troppo dipendente da formato Pe vma_t start; vma_t finish; try { start = rva.File2RVASafe((*i).begin) + imageBase; finish = rva.File2RVASafe((*i).end-1) + imageBase; } catch(std::runtime_error&) { continue; } // _DEBUG_(fprintf(stderr,"start: %08lX end: %08lX\n",start,finish)); range<long> r = *i; // !!! bug finire // testa per piu' sezioni while( (finish-start+1) != static_cast<unsigned long>(r.end - r.begin) ) { // trova prima sezione const PeSection *p; for(unsigned n=0;; ++n) { p = rva.GetSection(n); if (p == NULL) { throw runtime_error("I think there is a bug inside"); } if ((unsigned long)r.begin >= p->RawAddress && ((unsigned long)r.begin-p->RawAddress) < p->RawSize) { // elimina questa sezione ByteInfo& info = byteInfo[start]; info.SetPriority(ByteInfo::priMax); info.SetType(ByteInfo::typeLoader); // setta la lunghezza lunga // _DEBUG_(fprintf(stderr,"len setted: %lX\n",p->RawSize - (r.begin-p->RawAddress))); byteInfo.SetLen(start,p->RawSize - (r.begin-p->RawAddress) ); // vai alla prossima sezione r.begin = p->RawAddress+p->RawSize; start = rva.File2RVASafe(r.begin) + imageBase; break; } } } // setta informazioni ByteInfo& info = byteInfo[start]; info.SetPriority(ByteInfo::priMax); info.SetType(ByteInfo::typeLoader); // setta la lunghezza lunga // _DEBUG_(fprintf(stderr,"len setted: %lX\n",finish-start+1)); byteInfo.SetLen(start,finish-start+1); } }

bool CodeParser::ExecuteComplexReference (  vma_t    address )

Definition at line 400 of file codescan.cpp. References _PRG_ASSERT, Instruction::Args, ExecuteComplexReferenceMemory(), ExecuteComplexReferenceReg(), GetInstruction(), CodeInfo::module, Instruction::numArg, Param::t_memory, Param::t_registry, Param::type, and vma_t. Referenced by Parse(). { _PRG_ASSERT(&*module != NULL); // leggi prossima istruzione Instruction currInstruction; int result = GetInstruction(*module,address,currInstruction); if (!result || currInstruction.numArg != 1) { // !!! _PRG_ASSERT(0); return false; } if ( currInstruction.Args[0].type == Param::t_registry ) return ExecuteComplexReferenceReg(address,currInstruction); if ( currInstruction.Args[0].type == Param::t_memory ) return ExecuteComplexReferenceMemory(address,currInstruction); return false; }

bool CodeParser::ExecuteComplexReferenceMemory (  vma_t    address, const Instruction &    instruction )

Definition at line 268 of file codescan.cpp. References _PRG_ASSERT, AddTempFlow(), Instruction::Args, IstrReferences::beginReferenceTo(), CodeInfo::byteInfo, ContainValidAddress(), IstrReferences::endReferenceTo(), f77_min(), Param::factor, ObjectModule::GetDataReader(), Instruction::GetFlowType(), GetInstruction(), Param::GetMemSize(), ByteInfo::GetPriority(), RelocationInfos::GetRelocation(), ObjectModule::GetRelocationInfos(), ObjectModule::GetSection(), ObjectModule::HasRelocation(), Instruction::instruction, IsCodePointer(), IsNullAddress(), ByteInfos::IsOccupied(), IstrReferences::iterator, ByteInfo::len, Param::literal, Param::mem_reg1, Param::mem_reg2, CodeInfo::module, null_reg, Instruction::numArg, ObjectModule::DataReader::ReadDword(), ByteInfo::SetPriority(), ByteInfo::SetType(), Param::t_literal, Param::t_memory, ObjectModule::DataReader::Tell(), ByteInfo::TPriority, Param::type, ByteInfo::typePointer, CodeInfo::varReferences, and vma_t. Referenced by ExecuteComplexReference(), and ScanningComplexReg::ProcessInstruction(). { _PRG_ASSERT(instruction.numArg == 1); _PRG_ASSERT(instruction.Args[0].type == Param::t_memory); _PRG_ASSERT(&*module != NULL); const Param& arg = instruction.Args[0]; // check for simple jmp dword ptr[reg*4+const] // !!! not portable // !!! un pochino semplificato if (arg.mem_reg1 == null_reg && arg.mem_reg2 != null_reg && arg.factor == addr_bytes) { // !!! gestire sovrapposizioni con codice if (ContainValidAddress(arg)) { unsigned count = 0; bool isFirstValid = true; // !!! size constant try { ObjectModule::DataReader reader = module->GetDataReader(arg.literal); for(;;) { for(;;) { vma_t addr; // !!! la seconda volta sono gia' marcati if (byteInfo.IsOccupied(reader.Tell(),addr_bytes)) { if (!IsCodePointer(byteInfo,reader.Tell())) break; } if (module->HasRelocation() && !module->GetRelocationInfos().GetRelocation(reader.Tell())) break; addr = reader.ReadDword(); if (!module->GetSection(addr)->IsCode()) break; ++count; } if (count !=0) break; // ignora errore se e' il primo ++count; isFirstValid = false; // starting skipping first entry reader = reader = module->GetDataReader(arg.literal+addr_bytes); } } catch(const ObjectModule::OutOfAddress&) {} if (!isFirstValid) --count; if (count<=2) // !!! costante return false; // aggiunge tutti i puntatori per scandire codice enum ByteInfo::TPriority priority = byteInfo[address].GetPriority(); vma_t tableAddress = arg.literal + (isFirstValid ? 0 : addr_bytes); ObjectModule::DataReader reader = module->GetDataReader(tableAddress); for(; count != 0 ; --count) { ByteInfo& info = byteInfo[reader.Tell()]; info.len = addr_bytes; info.SetType(ByteInfo::typePointer); info.SetPriority(priority); vma_t pointer = reader.ReadDword(); AddTempFlow(instruction.GetFlowType(),address,pointer,priority); } byteInfo[tableAddress].SetIsLabel(); return true; } } if (arg.mem_reg1 == null_reg && arg.mem_reg2 == null_reg && arg.GetMemSize() == (unsigned int)addr_bytes) { // se non e' un indirizzo invalido esci if (!ContainValidAddress(arg)) return false; // processa contenuto corrente if (!module->HasRelocation() || module->GetRelocationInfos().GetRelocation(arg.literal)) { vma_t addr; ObjectModule::DataReader reader = module->GetDataReader(arg.literal); addr = reader.ReadDword(); if (!IsNullAddress(addr) && module->GetSection(addr)->IsCode()) { AddTempFlow(instruction.GetFlowType(),address,addr, byteInfo[address].GetPriority()); } } // processa riferimenti IstrReferences::iterator i = varReferences.beginReferenceTo(arg.literal); IstrReferences::iterator end = varReferences.endReferenceTo(arg.literal); const ByteInfo& info = byteInfo[arg.literal]; for(;i != end; ++i) { if ( !(*i).direct ) { // la priorita' della chiamata e' la minima tra chiamata e memoria enum ByteInfo::TPriority priority = f77_min(byteInfo[address].GetPriority(),info.GetPriority()); // leggi istruzione Instruction instruction; int result = GetInstruction(*module,(*i).to,instruction); if (!result) return false; // !!! test brutale mov [xxx],xxx if (instruction.instruction == istr_mov && instruction.Args[0].type == Param::t_memory && instruction.Args[1].type == Param::t_literal) { _PRG_ASSERT(instruction.Args[0].mem_reg1 == null_reg); _PRG_ASSERT(instruction.Args[0].mem_reg2 == null_reg); _PRG_ASSERT(instruction.Args[0].literal == arg.literal); if (ContainValidAddress(instruction.Args[1])) AddTempFlow(instruction.GetFlowType(),address, instruction.Args[1].literal, priority); } } } return true; } return false; }

bool CodeParser::ExecuteComplexReferenceReg (  vma_t    address, const Instruction &    instruction )

Definition at line 248 of file codescan.cpp. References _PRG_ASSERT, Instruction::Args, ScanningComplexReg::GetResult(), Param::mem_reg1, Instruction::numArg, reg_t, ReverseScan(), Param::t_registry, Param::type, and vma_t. Referenced by ExecuteComplexReference(). { _PRG_ASSERT(instruction.numArg == 1); _PRG_ASSERT(instruction.Args[0].type == Param::t_registry); reg_t reg = instruction.Args[0].mem_reg1; ScanningComplexReg scan(address,reg); ReverseScan(&scan,address); return scan.GetResult(); }

bool CodeParser::ExtractTempRef (  TempReference &    tempRef )

Definition at line 252 of file code.cpp. References _PRG_ASSERT, IstrReferences::Add(), FLOW_CALL, FLOW_CJUMP, FLOW_JUMP, IstrReference::from, CodeInfo::istrReferences, ByteInfo::priCheckOnly, TempReference::priority, CodeInfo::pTempRefs, IstrReference::to, and IstrReference::type. Referenced by CheckCode(), CheckCodeRecursively(), and Parse(). { // assicurati che riferimenti sia inizializzato _PRG_ASSERT((pTempRefs!=NULL)); if (pTempRefs->empty()) return false; // estrae elemento tempRef = pTempRefs->top(); pTempRefs->pop(); // non aggiungere se usato solo per check if (tempRef.priority == ByteInfo::priCheckOnly) return true; // decrementa contatori e aggiungere reference fissi switch(tempRef.type) { case FLOW_CALL: istrReferences.Add(tempRef.from,tempRef.to,tempRef.type); #ifdef DEBUG --calls; #endif break; case FLOW_CJUMP: case FLOW_JUMP: istrReferences.Add(tempRef.from,tempRef.to,tempRef.type); #ifdef DEBUG --jumps; #endif break; } return true; }

void CodeParser::GetBitStat (  vma_t    address, unsigned    numBytes, BitStat &    stat )  [private]

Definition at line 120 of file data.cpp. References CodeParser::BitStat::bit16, CodeParser::BitStat::bit32, CodeParser::BitStat::bit8, byte, CodeInfo::byteInfo, ObjectModule::GetDataReader(), ByteInfos::IsOccupied(), CodeInfo::module, ObjectModule::DataReader::ReadByte(), ObjectModule::DataReader::Tell(), and vma_t. { // init counters fill(stat.bit8,stat.bit8+8,0); fill(stat.bit16,stat.bit16+16,0); fill(stat.bit32,stat.bit32+32,0); unsigned n; try { ObjectModule::DataReader reader = module->GetDataReader(address); for (n=0;n<numBytes;++n) { if (byteInfo.IsOccupied(reader.Tell())) break; uint8_t byte = reader.ReadByte(); // increment counters unsigned *pCount = &stat.bit32[(n%4u)*8u]; for(unsigned n=1;n != (1<<8);++pCount,n<<=1) if(byte & n) ++*pCount; } } catch(const ObjectModule::OutOfAddress&) {}; // se errore lettura si ferma // group counters for(n=0;n < 16;++n) stat.bit16[n] = stat.bit32[n] + stat.bit32[n+16]; for(n=0;n < 8;++n) stat.bit8[n] = stat.bit16[n] + stat.bit16[n+8]; }

void CodeParser::GetPointerArrayStats (  vma_t    address, PointerArrayStat &    stat )  [private]

Definition at line 79 of file data.cpp. References CodeInfo::byteInfo, ObjectModule::GetDataReader(), ObjectModule::GetSection(), IsNullAddress(), ByteInfos::IsOccupied(), ObjectModule::IsValid(), CodeInfo::module, CodeParser::PointerArrayStat::nCodePointer, CodeParser::PointerArrayStat::nFirstNull, CodeParser::PointerArrayStat::nNull, CodeParser::PointerArrayStat::nPointer, ObjectModule::DataReader::ReadDword(), ObjectModule::DataReader::Tell(), and vma_t. Referenced by Parse(). { // inizializza statistiche stat.nCodePointer = 0; stat.nPointer = 0; stat.nNull = 0; stat.nFirstNull = 0; bool bFirstNull = false; try { ObjectModule::DataReader reader = module->GetDataReader(address); for (unsigned n=0;;++n) { // testa sovrapposizione if (byteInfo.IsOccupied(reader.Tell(),addr_bytes)) break; // !!! vma_t addr = reader.ReadDword(); // se puntatore nullo incrementa e testa se primo if (IsNullAddress(addr)) { ++stat.nNull; // se primo puntatore nullo segna posizione if (!bFirstNull) stat.nFirstNull = n; bFirstNull = true; } // fermati primo indirizzo invalido non nullo else if (!module->IsValid(addr)) break; ++stat.nPointer; if (module->GetSection(addr)->IsCode()) ++stat.nCodePointer; } } catch(const ObjectModule::OutOfAddress&) {}; // se errore lettura si ferma // se non trovati puntatori nulli metti il primo puntatore nullo cella dopo if (!bFirstNull) stat.nFirstNull = stat.nPointer; }

void CodeParser::GetStringStats (  vma_t    address, unsigned &    len, unsigned &    num_printable )  [private]

Definition at line 40 of file data.cpp. References CodeInfo::byteInfo, ObjectModule::GetDataReader(), RelocationInfos::GetRelocation(), ObjectModule::GetRelocationInfos(), ObjectModule::HasRelocation(), ByteInfos::IsOccupied(), CodeInfo::module, ObjectModule::DataReader::ReadByte(), ObjectModule::DataReader::Tell(), and vma_t. Referenced by Parse(). { try { ObjectModule::DataReader reader = module->GetDataReader(address); unsigned n = 0; num_printable = 0; for (;;) { // se rilocazioni ritorna if (module->HasRelocation() && module->GetRelocationInfos().GetRelocation(reader.Tell())) { len = num_printable = 0; return; } // se codice occupato ritorna if (byteInfo.IsOccupied(reader.Tell())) { len = num_printable = 0; return; } uint8_t car = reader.ReadByte(); if (isprint(car)) ++num_printable; ++n; if (car == 0) break; } len = n; } catch(const ObjectModule::OutOfAddress&) { len = num_printable = 0; } }

bool CodeParser::IsApiReference (  const Param &    arg )  const

Definition at line 290 of file code.cpp. References _PRG_ASSERT, CodeInfo::apiAlias, ContainValidAddress(), ObjectModule::GetSymbols(), Symbols::IsValid(), Param::literal, Param::mem_reg1, Param::mem_reg2, CodeInfo::module, null_reg, Param::t_literal, Param::t_memory, and Param::type. Referenced by THeuristicMotor::THeuristicMotor(). { // !!! aggiungere parametro *string e se valido e true settarlo if (arg.type == Param::t_memory) { // !!! function if (ContainValidAddress(arg)) if (arg.mem_reg1 == null_reg && arg.mem_reg2 == null_reg) { _PRG_ASSERT(module!=NULL); if (module->GetSymbols().IsValid(arg.literal)) return true; } return false; } if (arg.type == Param::t_literal) { // salti a jmp ad api TApiAlias::const_iterator i = apiAlias.find(arg.literal); if (i != apiAlias.end()) { _PRG_ASSERT(module!=NULL); if (module->GetSymbols().IsValid((*i).second)) return true; } // // // salti a funzioni esportate // _PRG_ASSERT(exportedApi!=NULL); // std::string func = (*exportedApi)[arg.literal]; // if (func != "") // { // printf("\n* Reference to %s\n|\n",func.c_str()); // } } return false; }

void CodeParser::Parse (  CSignFile &    _file, uint32_t    imageBase, vma_t    entryPoint, const RVAFileTranslator &    rva, const Symbols &    api, const Symbols &    exportedApi, bool    hasRelocation, const RelocationInfos &    relocationInfos )  [private]

Definition at line 706 of file code.cpp. References _DEBUG_, _PRG_ASSERT, AddExportTempFlow(), CodeInfo::addrConstants, CodeInfo::byteInfo, CheckCode(), CheckCodeRecursively(), CodeInfo::complexReference, ExcludeFileRange(), ExecuteComplexReference(), ExtractTempRef(), FOR_EACH_SECTION_CODE_BEGIN, FOR_EACH_SECTION_CODE_END, ObjectModule::GetDataReader(), ObjectModule::GetEntryPoint(), ObjectModule::GetExportSymbols(), GetInstruction(), ByteInfos::GetIstrLen(), Symbols::GetNextValid(), GetPointerArrayStats(), RelocationInfos::GetRelocation(), ObjectModule::GetRelocationInfos(), ObjectModule::GetSection(), GetStringStats(), Instruction::instruction, IsNullAddress(), ByteInfo::len, CodeInfo::module, CodeParser::PointerArrayStat::nCodePointer, CodeParser::PointerArrayStat::nFirstNull, CodeParser::PointerArrayStat::nPointer, ByteInfo::priConstant, ByteInfo::priEntryPoint, ByteInfo::priExport, ByteInfo::priFiller, TempReference::priority, CodeInfo::pTempRefs, ObjectModule::DataReader::ReadByte(), ObjectModule::DataReader::ReadDword(), RelocationInfos::relError, ScanCode(), scanCodeAlreadyProcessed, ByteInfo::SetPriority(), ByteInfo::SetType(), IstrReference::to, TTempRefs, ByteInfo::typeASCIIZ, ByteInfo::typeInteger, ByteInfo::typePointer, vma_t, WriteCode(), and x86instructions_names. Referenced by ParseCode(). { // istrReferences.insert(IstrReference(10,20,true,FLOW_CALL)); // istrReferences.insert(IstrReference(10,20,false,FLOW_CALL)); // if ( !(*istrReferences.begin()).direct ) // printf("0\n"); // istrReferences.insert(IstrReference(11,20,true,FLOW_CALL)); // if (istrReferences.lower_bound(IstrReference(10,0)) == // istrReferences.lower_bound(IstrReference(11,0))) // printf("1\n"); // if (istrReferences.lower_bound(IstrReference(9,0)) != // istrReferences.lower_bound(IstrReference(10,0))) // printf("2\n"); // if (istrReferences.lower_bound(IstrReference(11,0)) == // istrReferences.lower_bound(IstrReference(12,0))) // printf("3\n"); // if (istrReferences.lower_bound(IstrReference(12,0)) != // istrReferences.lower_bound(IstrReference(13,0))) // printf("4\n"); // if (istrReferences.lower_bound(IstrReference(12,0)) != // istrReferences.end()) // printf("5\n"); // if (!IsPresent(istrReferences,IstrReference(10,20))) // printf("6\n"); #ifdef DEBUG unsigned maxStringInCode = 0; unsigned currStringLen = 0; unsigned istrCount[num_instructions]; memset(&istrCount,0,sizeof(istrCount)); #endif // escludi bytes letti da file ExcludeFileRange(_file,rva,imageBase); ObjectModule _module(_file,rva,imageBase,hasRelocation,relocationInfos, _symbols,_exportedSymbols,_entryPoint); // !!! creare interno classe this->module = &_module; vma_t end; // verifica che ci sia qualcosa da disassemblare int numCodeSections = 0; FOR_EACH_SECTION_CODE_BEGIN(module,p) if ( (*p).IsCode() ) ++numCodeSections; FOR_EACH_SECTION_CODE_END(module,p) if (numCodeSections == 0) return; #ifdef DEBUG bytes = 0; bytes = jumps = calls = 0; loopCount = 0; #endif pTempRefs = new TTempRefs; // prima scansione, entrypoint ed Export // !!! solo se punta a codice for(vma_t address = module->GetExportSymbols().GetNextValid(0); !IsNullAddress(address); address = module->GetExportSymbols().GetNextValid(address)) if (module->GetSection(address)->IsCode()) { // scandisce testando (elimina export a dati) CheckCodeRecursively(address,ByteInfo::priExport); } if (!IsNullAddress(module->GetEntryPoint())) AddExportTempFlow(module->GetEntryPoint(),ByteInfo::priEntryPoint); bool bProcessed = false; // processato del codice ? // ha scandito altro codice dal controllo dei reference?? bool bFlowChangedSinceReference = false; // ha scandito altro codice dal controllo api?? bool bFlowChangedSinceApi = false; // c'e' qualcosa di incognito (reference, api) ? bool bSomeUnknown = false; bool bUseConstantPrinted = false; freddy77::auto_delete_ptr<THeuristicMotor> heuristics; // esegui finche' c'e' qualcos'altro da fare for(;;) { // !!! se processati heuristico o costanti i reference sono gia' eliminati, // non riprocessa jump complessi e API // scandisci codici da salti/chiamate incontrate // bProcessed = false; for(;;) { // estrae un reference TempReference tempRef; if (!ExtractTempRef(tempRef)) break; // processa reference vma_t address = tempRef.to; if (ScanCode(address,static_cast<ByteInfo::TPriority>(tempRef.priority)) != scanCodeAlreadyProcessed && address != tempRef.to) // if (CheckCode(address,static_cast<ByteInfo::TPriority>(tempRef.priority)) && address != tempRef.to) bProcessed = true; } // se processato forza riscansione if (bProcessed) { bFlowChangedSinceApi = true; bFlowChangedSinceReference = true; bSomeUnknown = false; } // cerca di usare chiamate/salti complessi (indirizzo in memoria o registro) if (bFlowChangedSinceReference && !bSomeUnknown) for(bProcessed = false;;) { bFlowChangedSinceReference = false; // !!! la dimensione del container puo' variare dentro il loop // estrae reference complessi (non leverli dal container??) if ( complexReference.empty() ) break; #if 0 #ifdef DEBUG { TTempComplexReference::iterator i = complexReference.begin(); for(int n=1;i != complexReference.end();++i,++n) { if ( (n%6) == 1 ) fprintf(stderr,"Debug: (Complex) "); fprintf(stderr,(n%6==0)?"%08lX\n":"%08lX ",unsigned(*i)); } fprintf(stderr,"\n"); } #endif #endif // cerca di "eseguire" reference TTempComplexReference::iterator i = complexReference.begin(); #ifdef DEBUG unsigned numUnknown = 0; unsigned numKnown = 0; #endif for(;i != complexReference.end();++i) { if (!ExecuteComplexReference(*i)) { // se non riuscito a processare tutti i salti possibili // segnalo bSomeUnknown = true; _DEBUG_(++numUnknown); } else { // se trova altri salti da fare aggiungili alla lista bProcessed = true; _DEBUG_(++numKnown); } } #ifdef DEBUG if ( (numKnown+numUnknown) != 0 ) fprintf(stderr,"Debug: (Complex) Perc %f\n", float(((double)numKnown*100)/(numKnown+numUnknown))); #endif // se eseguito segna esecuzione e togli // !!! no, potrebbe variare il flusso del codice break; } if (bProcessed) { // !!! fa schifo bProcessed = false; continue; } // !!! finish !!! // cerca di avere tutte le info per il codice delle chiamate alle api // se c'e' gia' qualcosa di sbagliato alla fine ce ne sara' comunque if (bFlowChangedSinceApi && !bSomeUnknown) for(bProcessed = false;;) { bFlowChangedSinceApi = false; bSomeUnknown = true; // !!! // !!! la dimensione del container puo' variare dentro il loop // estrae reference complessi (non leverli dal container??) break; // cerca di "eseguire" api /* // se trova altri indirizzi codice aggiungili alla lista bProcessed = true; // se non tolti tutti // segnalo bSomeUnknown = true; */ } if (bProcessed) { // !!! fa schifo bProcessed = false; continue; } /* // Il programma non e' abbastanza preciso per questo!! // non c'e' niente antro da scandire // !!! e le costanti puntate dal codice sopra ??? if (!bSomeUnknown) { #ifdef DEBUG { unsigned bytes = 0; FOR_EACH_SECTION_CODE_BEGIN(module,p) vma_t address = (*p).begin; end = (*p).end; for(; address<end; ) { int len = byteInfo.GetIstrLen(address); if (len != 0) { bytes += len; address += len; } else ++address; } FOR_EACH_SECTION_CODE_END(module,p) unsigned codeSize = 0; FOR_EACH_SECTION_CODE_BEGIN(module,p) codeSize += (*p).end - (*p).begin; FOR_EACH_SECTION_CODE_END(module,p) if (codeSize) fprintf(stderr,"\"Secure code\" %.1f%%\n", float(((double)bytes*100)/codeSize) ); } #endif break; } */ // metodo euristico, migliore degli export // !!! solo se non processato tutto, fa un test globale if (!&*heuristics) heuristics = new THeuristicMotor(*this); // heuristics.reset(new THeuristicMotor()); if ( (bProcessed=heuristics->ProcessSecure(*this)) != false ) continue; if (!bUseConstantPrinted) { #ifdef DEBUG { unsigned bytes = 0; FOR_EACH_SECTION_CODE_BEGIN(module,p) vma_t address = (*p).begin; end = (*p).end; for(; address<end; ) { int len = byteInfo.GetIstrLen(address); if (len != 0) { bytes += len; address += len; } else ++address; } FOR_EACH_SECTION_CODE_END(module,p) unsigned codeSize = 0; FOR_EACH_SECTION_CODE_BEGIN(module,p) codeSize += (*p).end - (*p).begin; FOR_EACH_SECTION_CODE_END(module,p) if (codeSize) fprintf(stderr,"\"Secure code\" %.1f%%\n", float(((double)bytes*100)/codeSize) ); } #endif // !!! log windows ?? fprintf(stderr,"Warning: Constant processed\n"); if (complexReference.empty()) fprintf(stderr,"Wow: complex reference is empty\n"); if (addrConstants.empty()) fprintf(stderr,"Wow: Constants address empty\n"); bUseConstantPrinted = true; } // unsafe heuristic code process // !!! commented for priority reason purpose (less safe than constant??) // if ( (bProcessed=heuristics->ProcessUnsecure(*this)) != false ) // continue; // cerca altro codice date le costanti salvate // questa e' l'ultima risorsa per riempire i buchi // testa prima che il codice sia valido for(;;) { if ( addrConstants.begin() == addrConstants.end() ) break; vma_t address = *addrConstants.begin(); addrConstants.erase(addrConstants.begin()); // !!! aggiungere caso per indirizzo a dati non inizializzati // prova a vedere se e' una stringa unsigned len,printable; GetStringStats(address,len,printable); // se caratteri stampabili >= 75% assumi stringa if ( len >0 && printable>2 && printable*100 > (len-1)*75 ) { ByteInfo& info = byteInfo[address]; //info.len = len; info.SetPriority(ByteInfo::priConstant); info.SetType(ByteInfo::typeASCIIZ); // setta la lunghezza lunga byteInfo.SetLen(address,len); continue; } // prova a vedere se array di puntatori PointerArrayStat pStat; GetPointerArrayStats(address,pStat); // piu' di due puntatori non nulli, assumi array puntatori if ( pStat.nFirstNull >= 2 ) // !!! constant { // testa se puntatori a codice // !!! module non ammette Seek al byte subito dopo end if (pStat.nCodePointer >= pStat.nFirstNull) { for(unsigned n=0; n<pStat.nPointer;++n,address+=addr_bytes) { // marca come DWORD ByteInfo& info = byteInfo[address]; info.len = addr_bytes; info.SetType(ByteInfo::typePointer); info.SetPriority(ByteInfo::priConstant); // "esegui" puntatore ObjectModule::DataReader reader = module->GetDataReader(address); vma_t addr = reader.ReadDword(); if (IsNullAddress(addr)) // fermarsi a ptr nullo { // fermati al primo indirizzo non al codice if (!module->GetSection(addr)->IsCode()) break; // !!! prima dovrebbe testarli tutti if (CheckCodeRecursively(addr,ByteInfo::priConstant)) bProcessed = true; } } } continue; } // !!! aggiungere parte check bit & range //BitStat bitStat; //GetBitStat(address,16*11,bitStat); // !!! assume sia codice if (module->GetSection(address)->IsCode()) if (CheckCodeRecursively(address,ByteInfo::priConstant)) { bProcessed = true; } } if (bProcessed) continue; _PRG_ASSERT(pTempRefs->empty()); _PRG_ASSERT(addrConstants.empty()); // !!! testa istruzioni sovrapposte // !!! test overlapped instruction break; } // scandisce tutto il codice alla ricerca di codice non decompilato // salta bytes tutti a 0 // scan all code for undisassembled code // skip zeroes bytes FOR_EACH_SECTION_CODE_BEGIN(module,p) vma_t address = (*p).begin; end = (*p).end; for(; address<end; ) { ObjectModule::DataReader reader = module->GetDataReader(address); int len = byteInfo.GetIstrLen(address); // se gia' passato salta istruzione if (len != 0) { #ifdef DEBUG // capture some statistics on code // parse instruction Instruction currInstruction; int result = GetInstruction(*module,address,currInstruction); if (result) { _PRG_ASSERT(currInstruction.instruction>=0); _PRG_ASSERT(currInstruction.instruction<=num_instructions); ++istrCount[currInstruction.instruction]; ObjectModule::DataReader reader = module->GetDataReader(address); for (int i=0;i<len;++i) { int c = reader.ReadByte(); if (isprint(c)) { ++currStringLen; if ( currStringLen > maxStringInCode ) { maxStringInCode = currStringLen; } } else currStringLen = 0; } } #endif address += len; continue; } _DEBUG_(currStringLen = 0); // if relocation it must be a pointer to somewhere const Relocation *rel = module->GetRelocationInfos().GetRelocation(address,addr_bytes); if (rel && rel != &RelocationInfos::relError) { ByteInfo& info = byteInfo[address]; info.len = addr_bytes; info.SetType(ByteInfo::typeInteger); info.SetPriority(ByteInfo::priFiller); address += addr_bytes; continue; } // read next byte int c; try { c = reader.ReadByte(); } catch (ObjectModule::OutOfAddress&) { return; // !!! } // se 0 leggi fino a che sono zeri o istruzione occupata _PRG_ASSERT(len ==0); if ( c==0 ) { _DEBUG_(currStringLen = 0); do { try { c = reader.ReadByte(); } catch (ObjectModule::OutOfAddress&) { c = -1; } len = byteInfo.GetIstrLen(++address); } while ( c==0 && len==0 && !module->GetRelocationInfos().GetRelocation(address) && address<end ); continue; } // tutto ok , posso scandire il codice da qui vma_t checkAddr = address; if ( !CheckCode(checkAddr,ByteInfo::priFiller) ) { // try on next byte // skipping all code that seam valid // (doing address = checkAddr+1) can skip relocation ++address; } // se trova qualcosa di meglio da scandire ben venga // !!! non serve cercare la logica nell'illogico } FOR_EACH_SECTION_CODE_END(module,p) // estrae tutti i reference temporanei for (TempReference tempRef;ExtractTempRef(tempRef);); #ifdef DEBUG fprintf(stderr,"Stat: (Code) MaxStringLenInCode: %u\n",maxStringInCode); for (unsigned ni=0; ni<num_instructions; ++ni) if (istrCount[ni]) fprintf(stderr,"Stat: (Instr) %s: %u\n", x86instructions_names[ni],istrCount[ni]); #endif WriteCode(); // mettere nel distruttore !!! delete pTempRefs; pTempRefs = NULL; // !!! this->module = NULL; }

void CodeParser::ResetCodeRange (  const range< vma_t > &    r )  [private]

Definition at line 467 of file code.cpp. References _PRG_ASSERT, range< T >::begin, CodeInfo::byteInfo, range< T >::end, ByteInfo::GetPriority(), ByteInfo::len, ByteInfo::priCheckOnly, ByteInfo::Reset(), and vma_t. Referenced by CheckCode(), and CheckCodeRecursively(). { for(vma_t address = r.begin;;) { _PRG_ASSERT(address <= r.end); ByteInfo& info = byteInfo[address]; _PRG_ASSERT(info.len != 0 || address == r.end); _PRG_ASSERT(info.GetPriority() == ByteInfo::priCheckOnly || address == r.end); int len = info.len; if (info.GetPriority() == ByteInfo::priCheckOnly) { // se errore leva marcatura info.Reset(); } if (address == r.end) break; address += len; } }

void CodeParser::ReverseScan (  IScanning *    scanning, vma_t    address )

Definition at line 103 of file codescan.cpp. References _PRG_ASSERT, _ReverseScan(), IScanning::CreateMachineStatus(), CodeInfo::module, and vma_t. Referenced by ExecuteComplexReferenceReg(). { _PRG_ASSERT(scanning != NULL); IMachineStatus* status = scanning->CreateMachineStatus(); _PRG_ASSERT(status != NULL); _PRG_ASSERT(&*module != NULL); _ReverseScan(scanning,address,status); delete status; }

enum CodeParser::TScanCodeResult CodeParser::ScanCode (  vma_t &    address, ByteInfo::TPriority    priority, bool    bSetLabel = true )  [private]

Definition at line 339 of file code.cpp. References AddTempFlow(), Instruction::Args, CodeInfo::byteInfo, CheckForAddress(), CheckImmediateCodeAddress(), InstructionDecoder::Decode(), FLOW_CALL, FLOW_CJUMP, FLOW_JUMP, FLOW_RET, FlowTypes, ObjectModule::GetDataReader(), Instruction::GetFlowType(), ByteInfos::GetIstrLen(), ByteInfo::GetPriority(), ObjectModule::GetRelocationInfos(), ObjectModule::GetSection(), ByteInfo::GetType(), ByteInfos::IsOccupied(), ByteInfo::len, Param::literal, CodeInfo::module, ByteInfo::priCheckOnly, ByteInfo::priConstant, ByteInfo::priMax, scanCodeAlreadyProcessed, scanCodeInvalid, scanCodeInvalidJump, scanCodeNoError, scanCodeOverlapped, ByteInfo::SetIsLabel(), ByteInfo::SetIsPrevInstruction(), ByteInfo::SetPriority(), Param::t_literal, ByteInfo::TPriority, TScanCodeResult, Param::type, ByteInfo::typeInstruction, vma_t, and WriteInstruction(). Referenced by CheckCode(), CheckCodeRecursively(), Parse(), and SetCodeRange(). { InstructionDecoder decoder(module->GetRelocationInfos()); // verifica se la prima istruzione e' sovrapposta if ( priority != ByteInfo::priMax && byteInfo.GetIstrLen(address)==0 && byteInfo.IsOccupied(address) ) { return scanCodeOverlapped; } bool bFirst = true; ObjectModule::DataReader reader = module->GetDataReader(address); for(;;) { #ifdef DEBUG // fprintf(stderr,"%08lX\t",address); // printIstr = (address >= 0x7FAC699Alu); #endif ByteInfo &info = byteInfo[address]; // !!! a volte e' utile non settare label anche se si analizza // setta label iniziale if (bFirst && bSetLabel) info.SetIsLabel(); // check se l'istruzione e' gia' stata attraversata if ( info.len != 0 && priority <= info.GetPriority() ) { // setta istruzione precedente // !!! priorita' per bCheckOnly if (!bFirst && priority != ByteInfo::priCheckOnly) info.SetIsPrevInstruction(); if (bFirst) return scanCodeAlreadyProcessed; if (info.GetType() != ByteInfo::typeInstruction) return scanCodeInvalid; break; // !!! ritornare un valore diverso ?? } // leggi successiva istruzione Instruction currInstruction; int result = decoder.Decode(currInstruction,reader); // !!! // if (result == 0 && priority == ByteInfo::priMax) // throw std::runtime_error("Unknown code in max priority"); if (!result) return scanCodeInvalid; #ifdef DEBUG if (printIstr) WriteInstruction(currInstruction); #endif // non sovraporre a codice gia' esistente if ( priority != ByteInfo::priMax && byteInfo.GetIstrLen(address)==0 && byteInfo.IsOccupied(address+result-1) ) { // !!! sicuro di questo ? non invalidare precedenti ? return scanCodeOverlapped; } // calcola tipo istruzione enum FlowTypes flow = currInstruction.GetFlowType(); // verifica che il salto sia corretto // !!! verificare solo che il codice sia esatto ?? if ( priority <= ByteInfo::priConstant ) if ( flow == FLOW_JUMP || flow == FLOW_CJUMP || flow == FLOW_CALL ) if ( currInstruction.Args[0].type == Param::t_literal ) { if (!module->GetSection(currInstruction.Args[0].literal)->IsCode()) return scanCodeInvalidJump; } // aggiornamento processo #ifdef DEBUG if ( ((++loopCount) & 0x3f) == 0 ) fprintf(stderr,"Process: (Code) bytes: %lu calls: %lu jumps: %lu\n", bytes,calls,jumps); #endif // aggiunge dati sulla lunghezza info.len = (uchar)result; // setta priorita' massima if (info.GetPriority() < priority) { info.SetPriority(priority); #ifdef DEBUG bytes += result; #endif } // prima di questa esiste un'istruzione if (!bFirst) info.SetIsPrevInstruction(); //bytes += result; // aggiungi istruzione di flusso // !!! un po' strano, o no ? AddTempFlow(flow,address,currInstruction,address,priority); // salva costanti che possano puntare al codice // !!! if (priority != ByteInfo::priCheckOnly) { CheckImmediateCodeAddress(currInstruction); CheckForAddress(address,currInstruction,priority); } // fermati se salto incondizionale o ritorno if (flow == FLOW_JUMP || flow == FLOW_RET) { break; } // va avanti address += result; bFirst = false; } return scanCodeNoError; }

void CodeParser::SetCodeRange (  const range< vma_t > &    r, ByteInfo::TPriority    priority, bool    bSetLabel = true )  [private]

Definition at line 487 of file code.cpp. References range< T >::begin, ScanCode(), ByteInfo::TPriority, and vma_t. Referenced by CheckCode(), and CheckCodeRecursively(). { vma_t begin = r.begin; #ifdef DEBUG // TScanCodeResult res = #endif ScanCode(begin,priority,bSetLabel); // !!! per procedure che non ritornano puo' accadere un errore //_PRG_ASSERT(res <= scanCodeNoError); // !!! si processano prima export e poi heuristic, // ma priorita heuristic > priorita export //_PRG_ASSERT(begin == (*i).end); }

void CodeParser::WriteBegin (  vma_t    address, int    num_bytes )  const [private]

Definition at line 213 of file codeprn.cpp. References EndComment(), ObjectModule::GetDataReader(), CodeInfo::module, ObjectModule::DataReader::ReadByte(), and vma_t. Referenced by WriteCode(). { int x=0,c; EndComment(); printf("%08lX ",(long int)address); if (::options.showBytes) { ObjectModule::DataReader reader = module->GetDataReader(address); for (int i=0;i<num_bytes;++i) { if ( i%10 == 0 ) { x = 0; if (i != 0) printf("\n "); } c = reader.ReadByte(); printf("%02X",c); x += 2; } for (;x!=20;x+=2) printf(" "); } printf("\t"); }

void CodeParser::WriteCode (    )  [private]

Definition at line 271 of file codeprn.cpp. References _DEBUG_, _PRG_ASSERT, CodeInfo::byteInfo, CheckJumpReference(), CheckReference(), InstructionDecoder::Decode(), FOR_EACH_SECTION_CODE_BEGIN, FOR_EACH_SECTION_CODE_END, ObjectModule::GetDataReader(), ByteInfos::GetIstrLen(), ByteInfos::GetLen(), ObjectModule::GetRelocationInfos(), ByteInfo::GetType(), ByteInfos::IsOccupied(), CodeInfo::module, ObjectModule::DataReader::ReadByte(), ObjectModule::DataReader::ReadDword(), ObjectModule::DataReader::ReadWord(), StartBeginComment(), ByteInfo::TPriority, ByteInfo::typeASCIIZ, ByteInfo::typeInteger, ByteInfo::typeLoader, ByteInfo::typePointer, vma_t, WriteBegin(), WriteInstruction(), WritePriority(), and WriteString(). Referenced by Parse(). { vma_t end; // disassembly vero e proprio FOR_EACH_SECTION_CODE_BEGIN(module,p) InstructionDecoder decoder(module->GetRelocationInfos()); // init as invalid priority ByteInfo::TPriority priority = ByteInfo::TPriority(-1); vma_t pc = (*p).begin; end = (*p).end; for(; pc<end; ) { ObjectModule::DataReader reader = module->GetDataReader(pc); int c; Instruction currInstruction; // testa cambio priorita if (options.showPriority) { ByteInfo::TPriority currPriority = byteInfo[pc].GetPriority(); if (currPriority != priority) { WritePriority(currPriority); priority = currPriority; } } // test for reference CheckReference(pc); // testa se tipo conosciuto unsigned len = byteInfo.GetLen(pc); bool isInstruction = true; if (len != 0) { isInstruction = false; const ByteInfo& info = byteInfo[pc]; switch (info.GetType()) { case ByteInfo::typeInteger: { uint32_t i; switch (len) { case 1: i = reader.ReadByte(); WriteBegin(pc,len); printf("BYTE %02X\n",i); break; case 2: i = reader.ReadWord(); WriteBegin(pc,len); printf("WORD %04X\n",i); break; case 4: i = reader.ReadDword(); WriteBegin(pc,len); printf("DWORD %08X\n",i); break; default: // !!! scrive come bytes normali //_PRG_ASSERT(0); WriteString(pc,len); } pc += len; } break; case ByteInfo::typePointer: { _PRG_ASSERT(len == (unsigned int)addr_bytes); vma_t address = reader.ReadDword(); WriteBegin(pc,len); printf("DWORD %08lX\n",(long int)address); pc += len; } break; case ByteInfo::typeLoader: StartBeginComment(); printf("Loader bytes"); WriteString(pc,len); pc += len; break; case ByteInfo::typeASCIIZ: _DEBUG_(fprintf(stderr,"Debug: (String) reached\n")); WriteString(pc,len); pc += len; break; default: isInstruction = true; } } if (isInstruction) { // leggi successiva istruzione int result = decoder.Decode(currInstruction,reader); if ( !result || (byteInfo.GetIstrLen(pc)==0 && byteInfo.IsOccupied(pc,result)) ) { reader = module->GetDataReader(pc); c = reader.ReadByte(); WriteBegin(pc,1); printf("BYTE\t%02X\n",c); pc += 1; } else { CheckJumpReference(pc,currInstruction); // !!! aggiungere codice per reference a stringhe o altro WriteBegin(pc,result); WriteInstruction(currInstruction); // va avanti pc += result; } } } FOR_EACH_SECTION_CODE_END(module,p) }

void CodeParser::WriteString (  vma_t    address, int    len )  const [private]

Definition at line 174 of file codeprn.cpp. References _PRG_ASSERT, EndComment(), ObjectModule::GetDataReader(), CodeInfo::module, ObjectModule::DataReader::ReadByte(), and vma_t. Referenced by WriteCode(). { EndComment(); _PRG_ASSERT(&*module != NULL); _PRG_ASSERT(len>0); ObjectModule::DataReader reader = module->GetDataReader(address); const unsigned nCarInRow = 16; char buffer[3*nCarInRow+nCarInRow+10]; for(unsigned n=0;;++n) { unsigned part = n%nCarInRow; if (part==0) { if (n>=nCarInRow) { buffer[nCarInRow*3+nCarInRow+1] = '\0'; printf("%08X %s\n",address+n-nCarInRow,buffer); if (n>=(unsigned int)len) return; } // inizializza buffer memset(buffer,' ',sizeof(buffer)); } if (n<(unsigned int)len) { uint8_t car = reader.ReadByte(); // scrive il carattere in esadecimale e carattere relativo sprintf(buffer+part*3,"%02X",car); buffer[part*3+2] = part==(nCarInRow/2-1)?'-':' '; // !!! settare come opzione carattere ? buffer[nCarInRow*3+1+part] = isprint(car)?car:'.'; } } }

---

Friends And Related Function Documentation

void ParseCode (  CSignFile &    file, uint32_t    imageBase, vma_t    entryPoint, const RVAFileTranslator &    rva, const Symbols &    symbols, const Symbols &    exportedSymbols, bool    hasRelocation, const RelocationInfos &    relocationInfos )  [friend]

Definition at line 1217 of file code.cpp. { CodeParser* p = new CodeParser; p->Parse(file,imageBase,entryPoint,rva,symbols,exportedSymbols,hasRelocation,relocationInfos); delete p; }

---

The documentation for this class was generated from the following files:

• codeglob.h
• code.cpp
• codeglob.cpp
• codeprn.cpp
• codescan.cpp
• data.cpp

---