retdec
Public Member Functions | Private Attributes | List of all members
retdec::cpdetect::PeHeuristics Class Reference

#include <pe_heuristics.h>

Inheritance diagram for retdec::cpdetect::PeHeuristics:
Inheritance graph
[legend]
Collaboration diagram for retdec::cpdetect::PeHeuristics:
Collaboration graph
[legend]

Public Member Functions

 PeHeuristics (retdec::fileformat::PeFormat &parser, Search &searcher, ToolInformation &toolInfo)
 
- Public Member Functions inherited from retdec::cpdetect::Heuristics
 Heuristics (retdec::fileformat::FileFormat &parser, Search &searcher, ToolInformation &toolInfo)
 
virtual ~Heuristics ()=default
 
void getAllHeuristics ()
 

Protected Member Functions

Virtual methods
virtual void getFormatSpecificCompilerHeuristics () override
 
virtual void getFormatSpecificLanguageHeuristics () override
 
- Protected Member Functions inherited from retdec::cpdetect::Heuristics
std::string getUpxVersion ()
 
const DetectResultisDetected (const std::string &name, const DetectionStrength minStrength=DetectionStrength::LOW)
 
void addCompiler (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addLinker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addInstaller (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addPacker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addCompiler (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addPacker (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false)
 
void addPriorityLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false)
 
std::size_t findSectionName (const std::string &sectionName) const
 
std::size_t findSectionNameStart (const std::string &sectionName) const
 

Private Member Functions

Auxiliary methods
std::string getEnigmaVersion ()
 
std::string getUpxAdditionalInfo (std::size_t metadataPos)
 
Heuristics for detection of original language
void getGoHeuristics ()
 
void getAutoItHeuristics ()
 
void getDotNetHeuristics ()
 
void getVisualBasicHeuristics ()
 
Heuristics for detection of used compiler or packer
std::int32_t getInt32Unaligned (const std::uint8_t *codePtr)
 
const std::uint8_t * skip_NOP_JMP8_JMP32 (const std::uint8_t *codeBegin, const std::uint8_t *codePtr, const std::uint8_t *codeEnd, std::size_t maxCount)
 
void getHeaderStyleHeuristics ()
 
void getSlashedSignatures ()
 
void getMorphineHeuristics ()
 
void getStarForceHeuristics ()
 
void getSafeDiscHeuristics ()
 
bool checkSecuROMSignature (const char *fileData, const char *fileDataEnd, uint32_t FileOffset)
 
void getSecuROMHeuristics ()
 
void getMPRMMGVAHeuristics ()
 
void getActiveMarkHeuristics ()
 
void getRLPackHeuristics ()
 
void getPetiteHeuristics ()
 
void getPelockHeuristics ()
 
void getEzirizReactorHeuristics ()
 
void getUpxHeuristics ()
 
void getFsgHeuristics ()
 
void getPeCompactHeuristics ()
 
void getAndpakkHeuristics ()
 
void getEnigmaHeuristics ()
 
void getVBoxHeuristics ()
 
void getActiveDeliveryHeuristics ()
 
void getAdeptProtectorHeuristics ()
 
void getCodeLockHeuristics ()
 
void getNetHeuristic ()
 
void getExcelsiorHeuristics ()
 
void getVmProtectHeuristics ()
 
void getBorlandDelphiHeuristics ()
 
void getBeRoHeuristics ()
 
void getMsvcIntelHeuristics ()
 
void getArmadilloHeuristic ()
 
void getStarforceHeuristic ()
 
void getLinkerVersionHeuristic ()
 
void getRdataHeuristic ()
 
void getNullsoftHeuristic ()
 
void getManifestHeuristic ()
 
void getSevenZipHeuristics ()
 
void getMewSectionHeuristics ()
 
void getNsPackSectionHeuristics ()
 
void getPeSectionHeuristics ()
 

Private Attributes

retdec::fileformat::PeFormatpeParser
 parser of input PE file More...
 
std::size_t declaredLength
 declared length of file More...
 
std::size_t loadedLength
 actual loaded length of file More...
 

Additional Inherited Members

- Protected Attributes inherited from retdec::cpdetect::Heuristics
retdec::fileformat::FileFormatfileParser
 input file parser More...
 
Searchsearch
 signature search engine More...
 
bool canSearch
 true if we can use search engine More...
 
ToolInformationtoolInfo
 results - detected tools More...
 
std::vector< const retdec::fileformat::Section * > sections
 section information More...
 
std::map< std::string, std::size_t > sectionNameMap
 section name counts More...
 
std::size_t noOfSections
 section count More...
 
bool priorityLanguageIsSet = false
 

Detailed Description

PE-specific heuristics

Constructor & Destructor Documentation

◆ PeHeuristics()

retdec::cpdetect::PeHeuristics::PeHeuristics ( retdec::fileformat::PeFormat parser,
Search searcher,
ToolInformation toolInfo 
)

Constructor

Member Function Documentation

◆ checkSecuROMSignature()

bool retdec::cpdetect::PeHeuristics::checkSecuROMSignature ( const char *  fileData,
const char *  fileDataEnd,
uint32_t  FileOffset 
)
private

◆ getActiveDeliveryHeuristics()

void retdec::cpdetect::PeHeuristics::getActiveDeliveryHeuristics ( )
private

Try to detect Active Delivery

◆ getActiveMarkHeuristics()

void retdec::cpdetect::PeHeuristics::getActiveMarkHeuristics ( )
private

Detection of ActiveMark packer

◆ getAdeptProtectorHeuristics()

void retdec::cpdetect::PeHeuristics::getAdeptProtectorHeuristics ( )
private

Try to detect Adept Protector

◆ getAndpakkHeuristics()

void retdec::cpdetect::PeHeuristics::getAndpakkHeuristics ( )
private

Try to detect ANDpakk packer

◆ getArmadilloHeuristic()

void retdec::cpdetect::PeHeuristics::getArmadilloHeuristic ( )
private

Try to detect Armadillo packer

◆ getAutoItHeuristics()

void retdec::cpdetect::PeHeuristics::getAutoItHeuristics ( )
private

Try to detect AutoIt programming language

◆ getBeRoHeuristics()

void retdec::cpdetect::PeHeuristics::getBeRoHeuristics ( )
private

Try to detect BeRo Tiny Pascal

◆ getBorlandDelphiHeuristics()

void retdec::cpdetect::PeHeuristics::getBorlandDelphiHeuristics ( )
private

Try to detect Borland Delphi

◆ getCodeLockHeuristics()

void retdec::cpdetect::PeHeuristics::getCodeLockHeuristics ( )
private

Try to detect Code-Lock

◆ getDotNetHeuristics()

void retdec::cpdetect::PeHeuristics::getDotNetHeuristics ( )
private

Try to detect CIL/.NET

◆ getEnigmaHeuristics()

void retdec::cpdetect::PeHeuristics::getEnigmaHeuristics ( )
private

Try to detect ENIGMA protector

◆ getEnigmaVersion()

std::string retdec::cpdetect::PeHeuristics::getEnigmaVersion ( )
private

Try detect version of Enigma protector

Returns
Detected version of Enigma or empty string if version is not detected

◆ getExcelsiorHeuristics()

void retdec::cpdetect::PeHeuristics::getExcelsiorHeuristics ( )
private

Try to detect Excelsior Installer

◆ getEzirizReactorHeuristics()

void retdec::cpdetect::PeHeuristics::getEzirizReactorHeuristics ( )
private

Try to detect Eziriz .NET Reactor packer

◆ getFormatSpecificCompilerHeuristics()

void retdec::cpdetect::PeHeuristics::getFormatSpecificCompilerHeuristics ( )
overrideprotectedvirtual

Get all compiler heuristics which are specific for one file format

Reimplemented from retdec::cpdetect::Heuristics.

◆ getFormatSpecificLanguageHeuristics()

void retdec::cpdetect::PeHeuristics::getFormatSpecificLanguageHeuristics ( )
overrideprotectedvirtual

Get all language heuristics which are specific for one file format

Reimplemented from retdec::cpdetect::Heuristics.

◆ getFsgHeuristics()

void retdec::cpdetect::PeHeuristics::getFsgHeuristics ( )
private

Try to detect FSG packer based on heuristics

◆ getGoHeuristics()

void retdec::cpdetect::PeHeuristics::getGoHeuristics ( )
private

Try to detect Go language binaries

◆ getHeaderStyleHeuristics()

void retdec::cpdetect::PeHeuristics::getHeaderStyleHeuristics ( )
private

Detect header heuristics

◆ getInt32Unaligned()

std::int32_t retdec::cpdetect::PeHeuristics::getInt32Unaligned ( const std::uint8_t *  codePtr)
private

◆ getLinkerVersionHeuristic()

void retdec::cpdetect::PeHeuristics::getLinkerVersionHeuristic ( )
private

Try to detect compiler by linker version

◆ getManifestHeuristic()

void retdec::cpdetect::PeHeuristics::getManifestHeuristic ( )
private

Search manifest for possible tool clues

◆ getMewSectionHeuristics()

void retdec::cpdetect::PeHeuristics::getMewSectionHeuristics ( )
private

Try to detect MEW packer

◆ getMorphineHeuristics()

void retdec::cpdetect::PeHeuristics::getMorphineHeuristics ( )
private

Try to detect Morphine encryptor

◆ getMPRMMGVAHeuristics()

void retdec::cpdetect::PeHeuristics::getMPRMMGVAHeuristics ( )
private

Detection of MPRMMGVA packer

◆ getMsvcIntelHeuristics()

void retdec::cpdetect::PeHeuristics::getMsvcIntelHeuristics ( )
private

Try to detect Microsoft Visual C++ compiler or Intel XE compiler

◆ getNetHeuristic()

void retdec::cpdetect::PeHeuristics::getNetHeuristic ( )
private

Try to detect various .NET tools

◆ getNsPackSectionHeuristics()

void retdec::cpdetect::PeHeuristics::getNsPackSectionHeuristics ( )
private

Try to detect NsPack packer

◆ getNullsoftHeuristic()

void retdec::cpdetect::PeHeuristics::getNullsoftHeuristic ( )
private

Search for NSIS installer

◆ getPeCompactHeuristics()

void retdec::cpdetect::PeHeuristics::getPeCompactHeuristics ( )
private

Try to detect PECompact based on heuristics

◆ getPelockHeuristics()

void retdec::cpdetect::PeHeuristics::getPelockHeuristics ( )
private

Try to detect PELock packer

◆ getPeSectionHeuristics()

void retdec::cpdetect::PeHeuristics::getPeSectionHeuristics ( )
private

Detect tools by specific section names

◆ getPetiteHeuristics()

void retdec::cpdetect::PeHeuristics::getPetiteHeuristics ( )
private

Detection of Petite packer

◆ getRdataHeuristic()

void retdec::cpdetect::PeHeuristics::getRdataHeuristic ( )
private

Various PE specific .rdata section heuristics

◆ getRLPackHeuristics()

void retdec::cpdetect::PeHeuristics::getRLPackHeuristics ( )
private

Detection of RLPack packer

◆ getSafeDiscHeuristics()

void retdec::cpdetect::PeHeuristics::getSafeDiscHeuristics ( )
private

Try to detect SafeDisc From ntdll!LdrpCheckForSafeDiscImage

◆ getSecuROMHeuristics()

void retdec::cpdetect::PeHeuristics::getSecuROMHeuristics ( )
private

Try to detect SecuROM protection From ntdll!LdrpCheckForSecuROMImage

◆ getSevenZipHeuristics()

void retdec::cpdetect::PeHeuristics::getSevenZipHeuristics ( )
private

Try to detect 7-zip SFX

◆ getSlashedSignatures()

void retdec::cpdetect::PeHeuristics::getSlashedSignatures ( )
private

Try to detect used compiler or packer based on slashed signatures

◆ getStarforceHeuristic()

void retdec::cpdetect::PeHeuristics::getStarforceHeuristic ( )
private

Try to detect StarForce packer

◆ getStarForceHeuristics()

void retdec::cpdetect::PeHeuristics::getStarForceHeuristics ( )
private

Try to detect StarForce protection

◆ getUpxAdditionalInfo()

std::string retdec::cpdetect::PeHeuristics::getUpxAdditionalInfo ( std::size_t  metadataPos)
private

Try detect additional information of UPX packer

Returns
Additional information

Each information is enclosed in square brackets separated by the space.

◆ getUpxHeuristics()

void retdec::cpdetect::PeHeuristics::getUpxHeuristics ( )
private

Try to detect UPX (Ultimate packer for executables)

◆ getVBoxHeuristics()

void retdec::cpdetect::PeHeuristics::getVBoxHeuristics ( )
private

Try to detect VBox

◆ getVisualBasicHeuristics()

void retdec::cpdetect::PeHeuristics::getVisualBasicHeuristics ( )
private

Try to detect Visual Basic

◆ getVmProtectHeuristics()

void retdec::cpdetect::PeHeuristics::getVmProtectHeuristics ( )
private

Try to detect VM Protect

◆ skip_NOP_JMP8_JMP32()

const std::uint8_t * retdec::cpdetect::PeHeuristics::skip_NOP_JMP8_JMP32 ( const std::uint8_t *  codeBegin,
const std::uint8_t *  codePtr,
const std::uint8_t *  codeEnd,
std::size_t  maxCount 
)
private

Parses the code, follows NOPs or JMPs

Member Data Documentation

◆ declaredLength

std::size_t retdec::cpdetect::PeHeuristics::declaredLength
private

declared length of file

◆ loadedLength

std::size_t retdec::cpdetect::PeHeuristics::loadedLength
private

actual loaded length of file

◆ peParser

retdec::fileformat::PeFormat& retdec::cpdetect::PeHeuristics::peParser
private

parser of input PE file


The documentation for this class was generated from the following files: