retdec
Functions
logic.cpp File Reference

Logic for yara patterns filter. More...

#include <cctype>
#include <regex>
#include "pat2yara/logic.h"
#include "yaramod/types/hex_string.h"
#include "yaramod/types/rule.h"

Functions

std::size_t getPureInformationSize (const std::shared_ptr< HexString > &pattern)
 
bool hasEnoughPureInformation (const std::shared_ptr< HexString > &pattern, std::size_t pureMinimum)
 
std::size_t getHexStringSize (const std::shared_ptr< HexString > &pattern)
 
std::size_t getTrailingNopSize (const std::shared_ptr< HexString > &pattern, const std::uint8_t nopOpCode)
 
std::size_t getNamedRelocationCount (const Rule *rule)
 
bool nameFilter (const Rule *rule)
 

Detailed Description

Logic for yara patterns filter.

Function Documentation

◆ getHexStringSize()

std::size_t getHexStringSize ( const std::shared_ptr< HexString > &  pattern)

Get HexString size in bytes.

Parameters
patterninput pattern
Returns
length of input pattern

◆ getNamedRelocationCount()

std::size_t getNamedRelocationCount ( const Rule *  rule)

Get number of named relocations.

Parameters
ruleinput rule
Returns
number of named relocations

◆ getPureInformationSize()

std::size_t getPureInformationSize ( const std::shared_ptr< HexString > &  pattern)

Get size of pure information (no wild-cards etc.) in HexString in bytes.

Parameters
patterninput pattern
Returns
amount of pure information in pattern

◆ getTrailingNopSize()

std::size_t getTrailingNopSize ( const std::shared_ptr< HexString > &  pattern,
const std::uint8_t  nopOpCode 
)

Get number of trailing NOP instructions used to align functions.

Parameters
patterninput pattern
nopOpCodecode for NOP instruction
Returns
number of trailing bytes of NOPs

◆ hasEnoughPureInformation()

bool hasEnoughPureInformation ( const std::shared_ptr< HexString > &  pattern,
std::size_t  pureMinimum 
)

Check if pattern has enough pure information.

Parameters
patterninput pattern
pureMinimumpure information requirement
Returns
true if pattern has enough pure information, false otherwise

◆ nameFilter()

bool nameFilter ( const Rule *  rule)

Check if this rule should be removed because of its name.

Parameters
ruleinput rule
Returns
true if rule should be removed, false otherwise