retdec
Classes | Enumerations | Functions | Variables
retdec::cpdetect Namespace Reference

Classes

class  CompilerDetector
 
struct  DetectParams
 
struct  DetectResult
 
struct  DetectLanguage
 
struct  ToolInformation
 
struct  Similarity
 
class  ElfHeuristics
 
class  Heuristics
 
class  MachOHeuristics
 
struct  PeHeaderStyle
 
class  PeHeuristics
 
class  Search
 
class  Signature
 

Enumerations

enum class  ReturnCode {
  OK , ARG , FILE_NOT_EXIST , FILE_PROBLEM ,
  ENTRY_POINT_DETECTION , UNKNOWN_FORMAT , FORMAT_PARSER_PROBLEM , MACHO_AR_DETECTED ,
  ARCHIVE_DETECTED , UNKNOWN_CP
}
 
enum class  SearchType { EXACT_MATCH , MOST_SIMILAR , SIM_LIST }
 
enum class  DetectionMethod {
  UNKNOWN , COMBINED , SIGNATURE , DWARF_DEBUG_H ,
  SECTION_TABLE_H , IMPORT_TABLE_H , EXPORT_TABLE_H , SYMBOL_TABLE_H ,
  LINKER_VERSION_H , LINKED_LIBRARIES_H , STRING_SEARCH_H , DYNAMIC_ENTRIES_H ,
  COMMENT_H , NOTE_H , MANIFEST_H , HEADER_H ,
  YARA_RULE , OTHER_H
}
 
enum class  DetectionStrength { LOW , MEDIUM , HIGH , SURE }
 
enum class  ToolType {
  UNKNOWN , COMPILER , LINKER , INSTALLER ,
  PACKER , OTHER
}
 
enum class  Packed { NOT_PACKED , PROBABLY_NO , PROBABLY_YES , PACKED }
 

Functions

std::string detectionMetodToString (DetectionMethod method)
 
std::string toolTypeToString (ToolType toolType)
 
std::string packedToString (Packed packed)
 
std::string getErrorMessage (ReturnCode errorCode, retdec::fileformat::Format format=retdec::fileformat::Format::UNKNOWN)
 
bool isFatalError (ReturnCode errorCode)
 

Variables

const std::size_t LIGHTWEIGHT_FILE_SCAN_AREA = 0x80000
 
const std::size_t EP_BYTES_SIZE = 50
 
const std::set< std::string > EXTERNAL_DATABASE_SUFFIXES
 
const std::string YARA_RULES_PATH
 

Enumeration Type Documentation

◆ DetectionMethod

Source from which result was obtained

Enumerator
UNKNOWN 

unknown detection method

COMBINED 

combination of methods

SIGNATURE 

yara or slashed signature

DWARF_DEBUG_H 

DWARF debug information.

SECTION_TABLE_H 

section table

IMPORT_TABLE_H 

import symbols

EXPORT_TABLE_H 

export symbols

SYMBOL_TABLE_H 

symbols

LINKER_VERSION_H 

linker version

LINKED_LIBRARIES_H 

specific libraries

STRING_SEARCH_H 

specific strings

DYNAMIC_ENTRIES_H 

.dynamic section

COMMENT_H 

.comment section

NOTE_H 

.note section

MANIFEST_H 

manifest resource

HEADER_H 

MZ header.

YARA_RULE 

Heuristic detection by a YARA rule.

OTHER_H 

other heuristic

◆ DetectionStrength

Strength of used heuristic

Enumerator
LOW 
MEDIUM 
HIGH 
SURE 

◆ Packed

Packing detection level

Enumerator
NOT_PACKED 
PROBABLY_NO 
PROBABLY_YES 
PACKED 

◆ ReturnCode

Error codes of library

Enumerator
OK 
ARG 
FILE_NOT_EXIST 
FILE_PROBLEM 
ENTRY_POINT_DETECTION 
UNKNOWN_FORMAT 
FORMAT_PARSER_PROBLEM 
MACHO_AR_DETECTED 
ARCHIVE_DETECTED 
UNKNOWN_CP 

◆ SearchType

Type of tool detection

Enumerator
EXACT_MATCH 

only identical signatures

MOST_SIMILAR 

the most similar signature

SIM_LIST 

list of similar signatures

◆ ToolType

Type of detected tool

Enumerator
UNKNOWN 
COMPILER 
LINKER 
INSTALLER 
PACKER 
OTHER 

Function Documentation

◆ detectionMetodToString()

std::string retdec::cpdetect::detectionMetodToString ( DetectionMethod  method)

Get detection method name as string

Parameters
methodmethod type
Returns
method name

◆ getErrorMessage()

std::string retdec::cpdetect::getErrorMessage ( ReturnCode  errorCode,
retdec::fileformat::Format  format 
)

Get a message describing the error for error code

Parameters
errorCodeInput error code
formatDetected format (optional)
Returns
Error message

◆ isFatalError()

bool retdec::cpdetect::isFatalError ( ReturnCode  errorCode)

Returns whether the given error code is fatal error code

Returns
true if error is fatal error, false otherwise.

◆ packedToString()

std::string retdec::cpdetect::packedToString ( Packed  packed)

Get packing info string from packing info

Parameters
packedpackings info
Returns
packing info as string

◆ toolTypeToString()

std::string retdec::cpdetect::toolTypeToString ( ToolType  toolType)

Get tool type name from type

Parameters
toolTypetype
Returns
type as string

Variable Documentation

◆ EP_BYTES_SIZE

const std::size_t retdec::cpdetect::EP_BYTES_SIZE = 50

◆ EXTERNAL_DATABASE_SUFFIXES

const std::set<std::string> retdec::cpdetect::EXTERNAL_DATABASE_SUFFIXES
Initial value:
=
{
".yar",
".yara",
".yarac"
}

◆ LIGHTWEIGHT_FILE_SCAN_AREA

const std::size_t retdec::cpdetect::LIGHTWEIGHT_FILE_SCAN_AREA = 0x80000

◆ YARA_RULES_PATH

const std::string retdec::cpdetect::YARA_RULES_PATH
Initial value:
=
"../share/retdec/support/generic/yara_patterns/tools/"