retdec
stacofin.h
Go to the documentation of this file.
1 
7 #ifndef RETDEC_STACOFIN_STACOFIN_H
8 #define RETDEC_STACOFIN_STACOFIN_H
9 
10 #include <map>
11 #include <string>
12 #include <utility>
13 #include <vector>
14 
15 #include <capstone/capstone.h>
16 
17 #include "retdec/config/config.h"
18 #include "retdec/common/address.h"
19 
20 namespace retdec {
21 namespace loader {
22  class Image;
23 } // namespace loader
24 
25 namespace stacofin {
26 
27 struct DetectedFunction;
28 
33 
37 struct Reference
38 {
39  public:
40  Reference(
41  std::size_t o,
42  const std::string& n,
45  DetectedFunction* tf = nullptr,
46  bool k = false);
47 
48  public:
49  std::size_t offset = 0;
50  std::string name;
51 
55  bool ok = false;
56 };
57 
58 using References = std::vector<Reference>;
59 
64 {
65  public:
66  bool operator<(const DetectedFunction& o) const;
67 
68  bool allRefsOk() const;
69  std::size_t countRefsOk() const;
70  float refsOkShare() const;
71  std::string getName() const;
72  bool isTerminating() const;
73  bool isThumb() const;
74 
75  void setReferences(const std::string &refsString);
76 
79 
80  public:
82  std::size_t size;
83  // File offset.
84  std::size_t offset;
85 
87  std::vector<std::string> names;
90 
92  std::string signaturePath;
93 
94  private:
97 };
98 
99 using DetectedFunctionsPtrMap = typename std::map<
102 using DetectedFunctionsMultimap = typename std::multimap<
105 using DetectedFunctionsPtrMultimap = typename std::multimap<
108 
112 class Finder
113 {
114  public:
117  void search(
118  const retdec::loader::Image& image,
119  const std::string& yaraFile);
120  void search(
121  const retdec::loader::Image& image,
122  const std::set<std::string>& yaraFiles);
123  void search(
124  const retdec::loader::Image& image,
125  const retdec::config::Config& config);
126  void searchAndConfirm(
127  const retdec::loader::Image& image,
128  const retdec::config::Config& config);
130 
137 
138  private:
141 
145 
147  {
149  const DetectedFunction* a,
150  const DetectedFunction* b) const
151  {
152  return *a < *b;
153  }
154  };
155  std::set<DetectedFunction*, DetectedFunctionComp> _worklistDetections;
156 
157  private:
158  using ByteData = typename std::pair<const std::uint8_t*, std::size_t>;
159 
160  private:
161  bool initDisassembler();
162  void solveReferences();
163 
169 
170  void checkRef(Reference& ref);
171  void checkRef_x86(Reference& ref);
172 
173  void confirmWithoutRefs();
174  void confirmAllRefsOk(std::size_t minFncSzWithoutRefs = 0x20);
175  void confirmPartialRefsOk(float okShare = 0.5);
177 
178  private:
179  const retdec::config::Config* _config = nullptr;
180  const retdec::loader::Image* _image = nullptr;
181 
182  csh _ce = 0;
183  cs_mode _ceMode = CS_MODE_LITTLE_ENDIAN;
184  cs_insn* _ceInsn = nullptr;
185 
186  std::map<common::Address, std::string> _imports;
187  std::set<std::string> _sectionNames;
188 };
189 
190 } // namespace stacofin
191 } // namespace retdec
192 
193 #endif
Definition: address.h:21
static const uint64_t Undefined
Definition: address.h:47
Definition: range.h:281
Definition: config.h:30
Definition: image.h:22
Definition: stacofin.h:113
cs_mode _ceMode
Definition: stacofin.h:183
common::Address getAddressFromRef(common::Address ref)
Definition: stacofin.cpp:948
void search(const retdec::loader::Image &image, const std::string &yaraFile)
Definition: stacofin.cpp:695
void searchAndConfirm(const retdec::loader::Image &image, const retdec::config::Config &config)
Definition: stacofin.cpp:803
const DetectedFunctionsMultimap & getAllDetections() const
Definition: stacofin.cpp:679
const retdec::loader::Image * _image
Definition: stacofin.h:180
std::map< common::Address, std::string > _imports
Definition: stacofin.h:186
std::set< std::string > _sectionNames
Definition: stacofin.h:187
const DetectedFunctionsPtrMap & getConfirmedDetections() const
Definition: stacofin.cpp:684
common::Address getAddressFromRef_mips(common::Address ref)
Definition: stacofin.cpp:1088
void confirmAllRefsOk(std::size_t minFncSzWithoutRefs=0x20)
Definition: stacofin.cpp:1532
common::Address getAddressFromRef_ppc(common::Address ref)
Definition: stacofin.cpp:1257
void confirmFunction(DetectedFunction *f)
Definition: stacofin.cpp:1652
CoveredCode getCoveredCode()
Definition: stacofin.cpp:674
typename std::pair< const std::uint8_t *, std::size_t > ByteData
Definition: stacofin.h:158
DetectedFunctionsMultimap _allDetections
Definition: stacofin.h:142
void confirmPartialRefsOk(float okShare=0.5)
Definition: stacofin.cpp:1610
const retdec::config::Config * _config
Definition: stacofin.h:179
void solveReferences()
Definition: stacofin.cpp:914
bool initDisassembler()
Definition: stacofin.cpp:872
void confirmWithoutRefs()
Definition: stacofin.cpp:1482
csh _ce
Definition: stacofin.h:182
void checkRef_x86(Reference &ref)
Definition: stacofin.cpp:1431
DetectedFunctionsPtrMultimap _rejectedDetections
Definition: stacofin.h:144
DetectedFunctionsPtrMap _confirmedDetections
Definition: stacofin.h:143
common::Address getAddressFromRef_x86(common::Address ref)
Definition: stacofin.cpp:973
common::Address getAddressFromRef_arm(common::Address ref)
Definition: stacofin.cpp:1179
void checkRef(Reference &ref)
Definition: stacofin.cpp:1303
cs_insn * _ceInsn
Definition: stacofin.h:184
CoveredCode coveredCode
Code coverage.
Definition: stacofin.h:140
std::set< DetectedFunction *, DetectedFunctionComp > _worklistDetections
Definition: stacofin.h:155
Address, address pair and other derived class representation.
Decompilation configuration manipulation.
Generic loader.
RangeContainer< Address > AddressRangeContainer
Definition: address.h:56
retdec::common::Address Address
Address.
Definition: types.h:36
typename std::multimap< common::Address, DetectedFunction * > DetectedFunctionsPtrMultimap
Definition: stacofin.h:107
std::vector< Reference > References
Definition: stacofin.h:58
typename std::map< common::Address, DetectedFunction * > DetectedFunctionsPtrMap
Definition: stacofin.h:101
typename std::multimap< common::Address, DetectedFunction > DetectedFunctionsMultimap
Definition: stacofin.h:104
Definition: archive_wrapper.h:19
Definition: stacofin.h:64
bool isThumb() const
Definition: stacofin.cpp:617
std::size_t countRefsOk() const
Definition: stacofin.cpp:572
float refsOkShare() const
Definition: stacofin.cpp:584
void setReferences(const std::string &refsString)
Definition: stacofin.cpp:627
bool isTerminating() const
Definition: stacofin.cpp:596
void setAddress(retdec::common::Address a)
Definition: stacofin.cpp:649
std::string getName() const
Definition: stacofin.cpp:591
bool operator<(const DetectedFunction &o) const
Definition: stacofin.cpp:536
References references
Offset-name relocation pairs.
Definition: stacofin.h:89
retdec::common::Address address
Virtual address.
Definition: stacofin.h:96
retdec::common::Address getAddress() const
Definition: stacofin.cpp:658
std::size_t size
Original size of source.
Definition: stacofin.h:82
bool allRefsOk() const
Definition: stacofin.cpp:559
std::vector< std::string > names
Possible original names.
Definition: stacofin.h:87
std::size_t offset
Definition: stacofin.h:84
std::string signaturePath
Source signature path.
Definition: stacofin.h:92
bool operator()(const DetectedFunction *a, const DetectedFunction *b) const
Definition: stacofin.h:148
Definition: stacofin.h:38
Reference(std::size_t o, const std::string &n, common::Address a=common::Address::Undefined, common::Address t=common::Address::Undefined, DetectedFunction *tf=nullptr, bool k=false)
Definition: stacofin.cpp:512
std::string name
Definition: stacofin.h:50
common::Address address
Definition: stacofin.h:52
bool ok
Definition: stacofin.h:55
common::Address target
Definition: stacofin.h:53
DetectedFunction * targetFnc
Definition: stacofin.h:54
std::size_t offset
Definition: stacofin.h:49