retdec
|
IDR knowledge base pattern extractor. More...
#include <cstdint>
#include <fstream>
#include <iomanip>
#include <istream>
#include <map>
#include <set>
#include <vector>
#include "retdec/utils/conversion.h"
#include "retdec/utils/io/log.h"
#include "yaramod/builder/yara_expression_builder.h"
#include "yaramod/builder/yara_hex_string_builder.h"
#include "yaramod/builder/yara_rule_builder.h"
Typedefs | |
using | Relocation = std::pair< std::uint32_t, std::string > |
Functions | |
bool | getWord (std::uint16_t &result, std::ifstream &inputStream) |
bool | getDword (std::uint32_t &result, std::ifstream &inputStream) |
bool | getString (std::string &result, std::ifstream &inputStream) |
void | skip (const std::size_t &N, std::ifstream &inputStream) |
std::string | getRelocationsAsString (const std::vector< Relocation > &relocations) |
void | readFunction (std::ifstream &inputStream, const std::size_t &index) |
bool | readDatabase (std::ifstream &inputStream, std::string &errorMessage) |
int | printError (const std::string &message) |
int | main (int argc, char **argv) |
IDR knowledge base pattern extractor.
using Relocation = std::pair<std::uint32_t, std::string> |
Offset - Name relocation pair type.
bool getDword | ( | std::uint32_t & | result, |
std::ifstream & | inputStream | ||
) |
Get one DWORD from input stream.
result | where to store result |
inputStream | stream with correct position |
true
if value was read, false
otherwise std::string getRelocationsAsString | ( | const std::vector< Relocation > & | relocations | ) |
Get string from relocations.
relocations | vector with relocation pairs |
bool getString | ( | std::string & | result, |
std::ifstream & | inputStream | ||
) |
Get zero terminated string with size information from input stream.
result | where to store result |
inputStream | stream with correct position |
true
if value was read, false
otherwise bool getWord | ( | std::uint16_t & | result, |
std::ifstream & | inputStream | ||
) |
Get one WORD from input stream.
result | where to store result |
inputStream | stream with correct position |
true
if value was read, false
otherwise int main | ( | int | argc, |
char ** | argv | ||
) |
int printError | ( | const std::string & | message | ) |
Print error and return.
message | error message |
bool readDatabase | ( | std::ifstream & | inputStream, |
std::string & | errorMessage | ||
) |
Read database and print function rules.
inputStream | source input stream |
errorMessage | possible error message if false is returned |
true
if information was read correctly, false
otherwise void readFunction | ( | std::ifstream & | inputStream, |
const std::size_t & | index | ||
) |
Read one function or procedure from KB.
inputStream | stream with correct position |
index | index of function |
void skip | ( | const std::size_t & | N, |
std::ifstream & | inputStream | ||
) |
Skip N bytes in input stream at actual position.
N | number of bytes to skip |
inputStream | stream with correct position |