retdec
Classes | Private Types | Private Member Functions | Private Attributes | List of all members
retdec::stacofin::Finder Class Reference

#include <stacofin.h>

Collaboration diagram for retdec::stacofin::Finder:
Collaboration graph
[legend]

Classes

struct  DetectedFunctionComp
 

Public Member Functions

Actions.
void search (const retdec::loader::Image &image, const std::string &yaraFile)
 
void search (const retdec::loader::Image &image, const std::set< std::string > &yaraFiles)
 
void search (const retdec::loader::Image &image, const retdec::config::Config &config)
 
void searchAndConfirm (const retdec::loader::Image &image, const retdec::config::Config &config)
 
Getters.
CoveredCode getCoveredCode ()
 
const DetectedFunctionsMultimapgetAllDetections () const
 
const DetectedFunctionsPtrMapgetConfirmedDetections () const
 

Private Types

using ByteData = typename std::pair< const std::uint8_t *, std::size_t >
 

Private Member Functions

bool initDisassembler ()
 
void solveReferences ()
 
common::Address getAddressFromRef (common::Address ref)
 
common::Address getAddressFromRef_x86 (common::Address ref)
 
common::Address getAddressFromRef_mips (common::Address ref)
 
common::Address getAddressFromRef_arm (common::Address ref)
 
common::Address getAddressFromRef_ppc (common::Address ref)
 
void checkRef (Reference &ref)
 
void checkRef_x86 (Reference &ref)
 
void confirmWithoutRefs ()
 
void confirmAllRefsOk (std::size_t minFncSzWithoutRefs=0x20)
 
void confirmPartialRefsOk (float okShare=0.5)
 
void confirmFunction (DetectedFunction *f)
 

Private Attributes

CoveredCode coveredCode
 Code coverage. More...
 
DetectedFunctionsMultimap _allDetections
 
DetectedFunctionsPtrMap _confirmedDetections
 
DetectedFunctionsPtrMultimap _rejectedDetections
 
std::set< DetectedFunction *, DetectedFunctionComp_worklistDetections
 
const retdec::config::Config_config = nullptr
 
const retdec::loader::Image_image = nullptr
 
csh _ce = 0
 
cs_mode _ceMode = CS_MODE_LITTLE_ENDIAN
 
cs_insn * _ceInsn = nullptr
 
std::map< common::Address, std::string > _imports
 
std::set< std::string > _sectionNames
 

Detailed Description

Finder implementation using Yara.

Member Typedef Documentation

◆ ByteData

using retdec::stacofin::Finder::ByteData = typename std::pair<const std::uint8_t*, std::size_t>
private

Member Function Documentation

◆ checkRef()

void retdec::stacofin::Finder::checkRef ( Reference ref)
private

◆ checkRef_x86()

void retdec::stacofin::Finder::checkRef_x86 ( Reference ref)
private

◆ confirmAllRefsOk()

void retdec::stacofin::Finder::confirmAllRefsOk ( std::size_t  minFncSzWithoutRefs = 0x20)
private

◆ confirmFunction()

void retdec::stacofin::Finder::confirmFunction ( DetectedFunction f)
private

◆ confirmPartialRefsOk()

void retdec::stacofin::Finder::confirmPartialRefsOk ( float  okShare = 0.5)
private

◆ confirmWithoutRefs()

void retdec::stacofin::Finder::confirmWithoutRefs ( )
private

Sometimes, we don't need references to solve detections. e.g. on PIC32 detected function '_scanf_cdnopuxX' is in section .text._scanf_cdnopuxX. Sort detected functions.

Functions are sorted by their address, if detection address is same bigger detection is first.

◆ getAddressFromRef()

common::Address retdec::stacofin::Finder::getAddressFromRef ( common::Address  ref)
private

◆ getAddressFromRef_arm()

common::Address retdec::stacofin::Finder::getAddressFromRef_arm ( common::Address  ref)
private

On ARM, reference may be an instruction that needs to be disassembled and inspected for reference target, or a word after the function that just needs to be read (it should point somewhere to the loaded image, but that is checked later).

◆ getAddressFromRef_mips()

common::Address retdec::stacofin::Finder::getAddressFromRef_mips ( common::Address  ref)
private

On MIPS, reference is an instruction that needs to be disassembled and inspected for reference target.

◆ getAddressFromRef_ppc()

common::Address retdec::stacofin::Finder::getAddressFromRef_ppc ( common::Address  ref)
private

◆ getAddressFromRef_x86()

common::Address retdec::stacofin::Finder::getAddressFromRef_x86 ( common::Address  ref)
private

◆ getAllDetections()

const DetectedFunctionsMultimap & retdec::stacofin::Finder::getAllDetections ( ) const

◆ getConfirmedDetections()

const DetectedFunctionsPtrMap & retdec::stacofin::Finder::getConfirmedDetections ( ) const

◆ getCoveredCode()

CoveredCode retdec::stacofin::Finder::getCoveredCode ( )

Return detected code coverage.

Returns
covered code

◆ initDisassembler()

bool retdec::stacofin::Finder::initDisassembler ( )
private
Returns
False of everything ok, true otherwise.

◆ search() [1/3]

void retdec::stacofin::Finder::search ( const retdec::loader::Image image,
const retdec::config::Config config 
)

Search for static code in input file based on information in config file.

Parameters
imageinput file image
configconfig file

◆ search() [2/3]

void retdec::stacofin::Finder::search ( const retdec::loader::Image image,
const std::set< std::string > &  yaraFiles 
)

Search for static code in input file.

Parameters
imageinput file image
yaraFilesstatic code signature files

◆ search() [3/3]

void retdec::stacofin::Finder::search ( const retdec::loader::Image image,
const std::string &  yaraFile 
)

Search for static code in input file.

Parameters
imageinput file image
yaraFilestatic code signature file

◆ searchAndConfirm()

void retdec::stacofin::Finder::searchAndConfirm ( const retdec::loader::Image image,
const retdec::config::Config config 
)

◆ solveReferences()

void retdec::stacofin::Finder::solveReferences ( )
private

Member Data Documentation

◆ _allDetections

DetectedFunctionsMultimap retdec::stacofin::Finder::_allDetections
private

◆ _ce

csh retdec::stacofin::Finder::_ce = 0
private

◆ _ceInsn

cs_insn* retdec::stacofin::Finder::_ceInsn = nullptr
private

◆ _ceMode

cs_mode retdec::stacofin::Finder::_ceMode = CS_MODE_LITTLE_ENDIAN
private

◆ _config

const retdec::config::Config* retdec::stacofin::Finder::_config = nullptr
private

◆ _confirmedDetections

DetectedFunctionsPtrMap retdec::stacofin::Finder::_confirmedDetections
private

◆ _image

const retdec::loader::Image* retdec::stacofin::Finder::_image = nullptr
private

◆ _imports

std::map<common::Address, std::string> retdec::stacofin::Finder::_imports
private

◆ _rejectedDetections

DetectedFunctionsPtrMultimap retdec::stacofin::Finder::_rejectedDetections
private

◆ _sectionNames

std::set<std::string> retdec::stacofin::Finder::_sectionNames
private

◆ _worklistDetections

std::set<DetectedFunction*, DetectedFunctionComp> retdec::stacofin::Finder::_worklistDetections
private

◆ coveredCode

CoveredCode retdec::stacofin::Finder::coveredCode
private

Code coverage.


The documentation for this class was generated from the following files: