retdec
Public Member Functions | Protected Attributes | List of all members
retdec::cpdetect::Heuristics Class Reference

#include <heuristics.h>

Inheritance diagram for retdec::cpdetect::Heuristics:
Inheritance graph
[legend]
Collaboration diagram for retdec::cpdetect::Heuristics:
Collaboration graph
[legend]

Public Member Functions

 Heuristics (retdec::fileformat::FileFormat &parser, Search &searcher, ToolInformation &toolInfo)
 
virtual ~Heuristics ()=default
 

Protected Member Functions

Auxiliary methods
std::string getUpxVersion ()
 
const DetectResultisDetected (const std::string &name, const DetectionStrength minStrength=DetectionStrength::LOW)
 
Virtual methods
virtual void getFormatSpecificCompilerHeuristics ()
 
virtual void getFormatSpecificLanguageHeuristics ()
 
Add heuristic detection methods
void addCompiler (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addLinker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addInstaller (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addPacker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="")
 
Add signature detection methods
void addCompiler (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="")
 
void addPacker (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="")
 
Add language methods
void addLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false)
 
void addPriorityLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false)
 
Other methods
std::size_t findSectionName (const std::string &sectionName) const
 
std::size_t findSectionNameStart (const std::string &sectionName) const
 

Protected Attributes

retdec::fileformat::FileFormatfileParser
 input file parser More...
 
Searchsearch
 signature search engine More...
 
bool canSearch
 true if we can use search engine More...
 
ToolInformationtoolInfo
 results - detected tools More...
 
std::vector< const retdec::fileformat::Section * > sections
 section information More...
 
std::map< std::string, std::size_t > sectionNameMap
 section name counts More...
 
std::size_t noOfSections
 section count More...
 
bool priorityLanguageIsSet = false
 

Private Member Functions

Sections heuristics
void getSectionHeuristics ()
 
Comment sections heuristics
bool parseGccComment (const std::string &record)
 
bool parseGhcComment (const std::string &record)
 
bool parseOpen64Comment (const std::string &record)
 
void getCommentSectionsHeuristics ()
 
DWARF heuristics
bool parseGccProducer (const std::string &producer)
 
bool parseClangProducer (const std::string &producer)
 
bool parseTmsProducer (const std::string &producer)
 
void getDwarfInfo ()
 
Delphi specific heuristics
std::string getEmbarcaderoVersion ()
 
void getEmbarcaderoHeuristics ()
 
Symbol heuristics
void getSymbolHeuristic ()
 

Heuristics methods

void getCommonToolsHeuristics ()
 
void getCommonLanguageHeuristics ()
 
void getAllHeuristics ()
 

Detailed Description

Class for heuristics detection

Constructor & Destructor Documentation

◆ Heuristics()

retdec::cpdetect::Heuristics::Heuristics ( retdec::fileformat::FileFormat parser,
Search searcher,
ToolInformation toolInfo 
)

Constructor

Parameters
parserParser of input file
searcherSignature search engine
toolInfoStructure for information about detected tools

◆ ~Heuristics()

virtual retdec::cpdetect::Heuristics::~Heuristics ( )
virtualdefault

Member Function Documentation

◆ addCompiler() [1/2]

void retdec::cpdetect::Heuristics::addCompiler ( DetectionMethod  source,
DetectionStrength  strength,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected compiler

Parameters
sourceUsed detection method
strengthStrength of detection method
nameName of detected compiler
versionVersion of detected compiler
extraExtra information about compiler

◆ addCompiler() [2/2]

void retdec::cpdetect::Heuristics::addCompiler ( std::size_t  matchNibbles,
std::size_t  totalNibbles,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected compiler

Parameters
matchNibblesNumber of significant nibbles agreeing with file content
totalNibblesTotal number of significant nibbles of signature
nameName of detected compiler
versionVersion of detected compiler
extraExtra information about compiler

This method implies DetectResultSource::SIGNATURE. Strength is computed.

◆ addInstaller()

void retdec::cpdetect::Heuristics::addInstaller ( DetectionMethod  source,
DetectionStrength  strength,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected installer

Parameters
sourceUsed detection method
strengthStrength of detection method
nameName of detected installer
versionVersion of detected installer
extraExtra information about installer

◆ addLanguage()

void retdec::cpdetect::Heuristics::addLanguage ( const std::string &  name,
const std::string &  extraInfo = "",
bool  isBytecode = false 
)
protected

Add information about detected programming language

Parameters
nameName of detected programming language
extraInfoAdditional information about language
isBytecodetrue if detected language is bytecode, false otherwise

◆ addLinker()

void retdec::cpdetect::Heuristics::addLinker ( DetectionMethod  source,
DetectionStrength  strength,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected linker

Parameters
sourceUsed detection method
strengthStrength of detection method
nameName of detected linker
versionVersion of detected linker
extraExtra information about linker

◆ addPacker() [1/2]

void retdec::cpdetect::Heuristics::addPacker ( DetectionMethod  source,
DetectionStrength  strength,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected packer

Parameters
sourceUsed detection method
strengthStrength of detection method
nameName of detected packer
versionVersion of detected packer
extraExtra information about packer

◆ addPacker() [2/2]

void retdec::cpdetect::Heuristics::addPacker ( std::size_t  matchNibbles,
std::size_t  totalNibbles,
const std::string &  name,
const std::string &  version = "",
const std::string &  extra = "" 
)
protected

Save all information about detected packer

Parameters
matchNibblesNumber of significant nibbles agreeing with file content
totalNibblesTotal number of significant nibbles of signature
nameName of detected packer
versionVersion of detected packer
extraExtra information about packer

This method implies DetectResultSource::SIGNATURE. Strength is computed.

◆ addPriorityLanguage()

void retdec::cpdetect::Heuristics::addPriorityLanguage ( const std::string &  name,
const std::string &  extraInfo = "",
bool  isBytecode = false 
)
protected

Add information about detected programming language

Parameters
nameName of detected programming language
extraInfoAdditional information about language
isBytecodetrue if detected language is bytecode, false otherwise

This removes previously detected languages and prevents further detections

◆ findSectionName()

std::size_t retdec::cpdetect::Heuristics::findSectionName ( const std::string &  sectionName) const
protected

Get number of sections which have name equal to sectionName

Parameters
sectionNameRequired section name
Returns
Number of sections which have name equal to sectionName

◆ findSectionNameStart()

std::size_t retdec::cpdetect::Heuristics::findSectionNameStart ( const std::string &  sectionName) const
protected

Get number of sections with name starting with sectionName

Parameters
sectionNameRequired section name
Returns
Number of sections which have name equal to sectionName

◆ getAllHeuristics()

void retdec::cpdetect::Heuristics::getAllHeuristics ( )

Try detect compiler based on all available heuristics

◆ getCommentSectionsHeuristics()

void retdec::cpdetect::Heuristics::getCommentSectionsHeuristics ( )
private

Try to detect used compiler based on content of comment sections

Returns
true if used compiler was successfully detected, false otherwise

◆ getCommonLanguageHeuristics()

void retdec::cpdetect::Heuristics::getCommonLanguageHeuristics ( )
private

Try to detect original language

◆ getCommonToolsHeuristics()

void retdec::cpdetect::Heuristics::getCommonToolsHeuristics ( )
private

Try to detect tools

◆ getDwarfInfo()

void retdec::cpdetect::Heuristics::getDwarfInfo ( )
private

Try to detect compiler based on DWARF debugging information

◆ getEmbarcaderoHeuristics()

void retdec::cpdetect::Heuristics::getEmbarcaderoHeuristics ( )
private

Try to detect Embarcadero Delphi compiler

◆ getEmbarcaderoVersion()

std::string retdec::cpdetect::Heuristics::getEmbarcaderoVersion ( )
private

Get Embarcadero Delphi version

Returns
Delphi version

◆ getFormatSpecificCompilerHeuristics()

void retdec::cpdetect::Heuristics::getFormatSpecificCompilerHeuristics ( )
protectedvirtual

Get all compiler heuristics which are specific for one file format

Reimplemented in retdec::cpdetect::PeHeuristics, retdec::cpdetect::MachOHeuristics, and retdec::cpdetect::ElfHeuristics.

◆ getFormatSpecificLanguageHeuristics()

void retdec::cpdetect::Heuristics::getFormatSpecificLanguageHeuristics ( )
protectedvirtual

Get all language heuristics which are specific for one file format

Reimplemented in retdec::cpdetect::PeHeuristics.

◆ getSectionHeuristics()

void retdec::cpdetect::Heuristics::getSectionHeuristics ( )
private

Try to detect tools by section names

◆ getSymbolHeuristic()

void retdec::cpdetect::Heuristics::getSymbolHeuristic ( )
private

Try to detect compilers by specific symbol names

◆ getUpxVersion()

std::string retdec::cpdetect::Heuristics::getUpxVersion ( )
protected

Try detect version of UPX packer

Returns
Detected version of UPX or empty string is version is not detected

◆ isDetected()

const DetectResult * retdec::cpdetect::Heuristics::isDetected ( const std::string &  name,
const DetectionStrength  minStrength = DetectionStrength::LOW 
)
protected

Check if compiler is already detected

Parameters
nameName of compiler
minStrengthMinimal strength of used method
Returns
pointer to detection if compiler is detected, nullptr otherwise

◆ parseClangProducer()

bool retdec::cpdetect::Heuristics::parseClangProducer ( const std::string &  producer)
private

Parse clang producer from DWARF debug information

Parameters
producerDWARF record
Returns
true if clang was detected, false otherwise

◆ parseGccComment()

bool retdec::cpdetect::Heuristics::parseGccComment ( const std::string &  record)
private

Parse GCC record from comment section

Parameters
recordRecord from comment section
Returns
true if compiler was detected, false otherwise

◆ parseGccProducer()

bool retdec::cpdetect::Heuristics::parseGccProducer ( const std::string &  producer)
private

Parse GCC producer from DWARF debug information

Parameters
producerDWARF record
Returns
true if compiler was detected, false otherwise

◆ parseGhcComment()

bool retdec::cpdetect::Heuristics::parseGhcComment ( const std::string &  record)
private

Parse GHC record from comment section

Parameters
recordRecord from comment section
Returns
true if GHC was detected, false otherwise

◆ parseOpen64Comment()

bool retdec::cpdetect::Heuristics::parseOpen64Comment ( const std::string &  record)
private

Parse Open64 record from comment section

Parameters
recordRecord from comment section
Returns
true if Open64 was detected, false otherwise

◆ parseTmsProducer()

bool retdec::cpdetect::Heuristics::parseTmsProducer ( const std::string &  producer)
private

Parse Texas Instruments producer from DWARF debug information

Parameters
producerDWARF record
Returns
true if Texas Instruments was detected, false otherwise

Member Data Documentation

◆ canSearch

bool retdec::cpdetect::Heuristics::canSearch
protected

true if we can use search engine

◆ fileParser

retdec::fileformat::FileFormat& retdec::cpdetect::Heuristics::fileParser
protected

input file parser

◆ noOfSections

std::size_t retdec::cpdetect::Heuristics::noOfSections
protected

section count

◆ priorityLanguageIsSet

bool retdec::cpdetect::Heuristics::priorityLanguageIsSet = false
protected

If true original language is detected with high reliability. This disables further detection of used programming languages.

◆ search

Search& retdec::cpdetect::Heuristics::search
protected

signature search engine

◆ sectionNameMap

std::map<std::string, std::size_t> retdec::cpdetect::Heuristics::sectionNameMap
protected

section name counts

◆ sections

std::vector<const retdec::fileformat::Section*> retdec::cpdetect::Heuristics::sections
protected

section information

◆ toolInfo

ToolInformation& retdec::cpdetect::Heuristics::toolInfo
protected

results - detected tools


The documentation for this class was generated from the following files: