retdec
|
#include <stacofin.h>
Classes | |
struct | DetectedFunctionComp |
Public Member Functions | |
Actions. | |
void | search (const retdec::loader::Image &image, const std::string &yaraFile) |
void | search (const retdec::loader::Image &image, const std::set< std::string > &yaraFiles) |
void | search (const retdec::loader::Image &image, const retdec::config::Config &config) |
void | searchAndConfirm (const retdec::loader::Image &image, const retdec::config::Config &config) |
Getters. | |
CoveredCode | getCoveredCode () |
const DetectedFunctionsMultimap & | getAllDetections () const |
const DetectedFunctionsPtrMap & | getConfirmedDetections () const |
Private Types | |
using | ByteData = typename std::pair< const std::uint8_t *, std::size_t > |
Private Member Functions | |
bool | initDisassembler () |
void | solveReferences () |
common::Address | getAddressFromRef (common::Address ref) |
common::Address | getAddressFromRef_x86 (common::Address ref) |
common::Address | getAddressFromRef_mips (common::Address ref) |
common::Address | getAddressFromRef_arm (common::Address ref) |
common::Address | getAddressFromRef_ppc (common::Address ref) |
void | checkRef (Reference &ref) |
void | checkRef_x86 (Reference &ref) |
void | confirmWithoutRefs () |
void | confirmAllRefsOk (std::size_t minFncSzWithoutRefs=0x20) |
void | confirmPartialRefsOk (float okShare=0.5) |
void | confirmFunction (DetectedFunction *f) |
Private Attributes | |
CoveredCode | coveredCode |
Code coverage. More... | |
DetectedFunctionsMultimap | _allDetections |
DetectedFunctionsPtrMap | _confirmedDetections |
DetectedFunctionsPtrMultimap | _rejectedDetections |
std::set< DetectedFunction *, DetectedFunctionComp > | _worklistDetections |
const retdec::config::Config * | _config = nullptr |
const retdec::loader::Image * | _image = nullptr |
csh | _ce = 0 |
cs_mode | _ceMode = CS_MODE_LITTLE_ENDIAN |
cs_insn * | _ceInsn = nullptr |
std::map< common::Address, std::string > | _imports |
std::set< std::string > | _sectionNames |
Finder implementation using Yara.
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
Sometimes, we don't need references to solve detections. e.g. on PIC32 detected function '_scanf_cdnopuxX' is in section .text._scanf_cdnopuxX
. Sort detected functions.
Functions are sorted by their address, if detection address is same bigger detection is first.
|
private |
|
private |
On ARM, reference may be an instruction that needs to be disassembled and inspected for reference target, or a word after the function that just needs to be read (it should point somewhere to the loaded image, but that is checked later).
|
private |
On MIPS, reference is an instruction that needs to be disassembled and inspected for reference target.
|
private |
|
private |
const DetectedFunctionsMultimap & retdec::stacofin::Finder::getAllDetections | ( | ) | const |
const DetectedFunctionsPtrMap & retdec::stacofin::Finder::getConfirmedDetections | ( | ) | const |
CoveredCode retdec::stacofin::Finder::getCoveredCode | ( | ) |
Return detected code coverage.
|
private |
False
of everything ok, true
otherwise. void retdec::stacofin::Finder::search | ( | const retdec::loader::Image & | image, |
const retdec::config::Config & | config | ||
) |
Search for static code in input file based on information in config file.
image | input file image |
config | config file |
void retdec::stacofin::Finder::search | ( | const retdec::loader::Image & | image, |
const std::set< std::string > & | yaraFiles | ||
) |
Search for static code in input file.
image | input file image |
yaraFiles | static code signature files |
void retdec::stacofin::Finder::search | ( | const retdec::loader::Image & | image, |
const std::string & | yaraFile | ||
) |
Search for static code in input file.
image | input file image |
yaraFile | static code signature file |
void retdec::stacofin::Finder::searchAndConfirm | ( | const retdec::loader::Image & | image, |
const retdec::config::Config & | config | ||
) |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
|
private |
Code coverage.