retdec
|
#include <pattern_extractor.h>
Public Member Functions | |
PatternExtractor (const std::string &filePath, const std::string &groupName="unknown_group") | |
Constructors and destructor. More... | |
~PatternExtractor () | |
bool | isValid () const |
Error handling methods. More... | |
std::string | getErrorMessage () const |
std::vector< std::string > | getWarnings () const |
void | printRules (std::ostream &outputStream, const std::string &withNote="") const |
Output methods. More... | |
void | addRulesToBuilder (yaramod::YaraFileBuilder &builder, const std::string &withNote="") const |
Private Member Functions | |
bool | isPic32DataObjectOnlyFile () |
Strange PIC32 architecture files processing. More... | |
void | processPic32DataObjectOnly () |
bool | processFile () |
Processing methods. More... | |
bool | checkPPC64Sections () |
std::vector< const retdec::fileformat::Symbol * > | filterSymbols () |
void | processSymbol (const retdec::fileformat::Symbol *symbol) |
void | processSection (const retdec::fileformat::Section *section) |
void | addSectionPatterns (const retdec::fileformat::Section *section, std::vector< const retdec::fileformat::Symbol * > &symbols) |
void | addPattern (const retdec::fileformat::Section *section, const std::string &name, const unsigned long long offset, const unsigned long long size) |
std::string | getArchAsString () |
Private Attributes | |
std::unique_ptr< retdec::fileformat::FileFormat > | inputFile |
Parser. More... | |
bool | stateValid = false |
Extractor state. More... | |
std::string | errorMessage |
Error message if invalid state. More... | |
std::vector< std::string > | warnings |
Vector with possible warnings. More... | |
std::string | groupName |
Name for set of rules. More... | |
std::vector< SymbolPattern > | patterns |
Vector of patterns found. More... | |
Binary pattern extractor.
retdec::patterngen::PatternExtractor::PatternExtractor | ( | const std::string & | filePath, |
const std::string & | groupName = "unknown_group" |
||
) |
Constructors and destructor.
Constructor.
filePath | path to file to process |
groupName | optional prefix for rule names (default: 'unknown_group') |
|
default |
|
private |
Creates and stores one pattern from given symbol information.
section | pointer to symbol associated section |
name | name of the symbol |
offset | symbol offset from start of the section |
size | size of symbol |
void retdec::patterngen::PatternExtractor::addRulesToBuilder | ( | yaramod::YaraFileBuilder & | builder, |
const std::string & | withNote = "" |
||
) | const |
Add rules to YaraFileBuilder.
builder | YaraFileBuilder reference |
withNote | optional note that will be added to all rules |
|
private |
Add new patterns.
section | section to which symbols belong |
symbols | input symbols |
|
private |
Check if we can use this 64-bit PowerPC file.
Problem is there is only one '.opd' section common for all code sections. This is problem if multiple code sections are present because we do not know to which section symbol belongs so we have to work with only standard '.text' section and ignore files with multiple code sections.
true
if file can be processed, false
otherwise
|
private |
Filter symbols so that only first symbol for given address is used.
|
private |
Get architecture info as string.
This function should be replaced with unified way of interpreting architecture names when available.
std::string retdec::patterngen::PatternExtractor::getErrorMessage | ( | ) | const |
Get error message in case of invalid state.
std::vector< std::string > retdec::patterngen::PatternExtractor::getWarnings | ( | ) | const |
Get warning messages.
|
private |
Strange PIC32 architecture files processing.
Check if input is strange PIC32 object with DATA OBJECT functions.
true
if object has no common functions, false
otherwise bool retdec::patterngen::PatternExtractor::isValid | ( | ) | const |
Error handling methods.
Check state of extractor.
true
if extractor is in valid state, false
otherwise void retdec::patterngen::PatternExtractor::printRules | ( | std::ostream & | outputStream, |
const std::string & | withNote = "" |
||
) | const |
Output methods.
Print rules to output stream.
outputStream | stream to print rules to |
withNote | optional note that will be added to all rules |
|
private |
Processing methods.
Process loaded file.
|
private |
Process PIC32 DATA OBJECT only file.
|
private |
Process single section.
section | pointer to section to process |
|
private |
Process single symbol.
symbol | pointer to symbol to process |
|
private |
Error message if invalid state.
|
private |
Name for set of rules.
|
private |
Parser.
|
private |
Vector of patterns found.
|
private |
Extractor state.
|
private |
Vector with possible warnings.