retdec
pe_heuristics.h
Go to the documentation of this file.
1 
7 #ifndef RETDEC_CPDETECT_HEURISTICS_PE_HEURISTICS_H
8 #define RETDEC_CPDETECT_HEURISTICS_PE_HEURISTICS_H
9 
12 
13 namespace retdec {
14 namespace cpdetect {
15 
17 {
18  // Note: Having "(const) std::string" instead of "const char *" here
19  // makes MS Visual Studio 2017 compiler (v 15.9.8) exit with
20  // "fatal error C1001: An internal error has occurred in the compiler"
21  // const std::string headerStyle;
22  const char * headerStyle;
23  uint16_t headerWords[0x0D];
24 };
25 
29 class PeHeuristics : public Heuristics
30 {
31  private:
33 
34  std::size_t declaredLength;
35  std::size_t loadedLength;
36 
39  std::string getEnigmaVersion();
40  std::string getUpxAdditionalInfo(std::size_t metadataPos);
42 
45  void getGoHeuristics();
46  void getAutoItHeuristics();
47  void getDotNetHeuristics();
50 
53  std::int32_t getInt32Unaligned(const std::uint8_t * codePtr);
54  const std::uint8_t * skip_NOP_JMP8_JMP32(
55  const std::uint8_t * codeBegin,
56  const std::uint8_t * codePtr,
57  const std::uint8_t * codeEnd,
58  std::size_t maxCount);
60  void getSlashedSignatures();
61  void getMorphineHeuristics();
63  void getSafeDiscHeuristics();
65  const char * fileData,
66  const char * fileDataEnd,
67  uint32_t FileOffset);
68  void getSecuROMHeuristics();
69  void getMPRMMGVAHeuristics();
71  void getRLPackHeuristics();
72  void getPetiteHeuristics();
73  void getPelockHeuristics();
75  void getUpxHeuristics();
76  void getFsgHeuristics();
78  void getAndpakkHeuristics();
79  void getEnigmaHeuristics();
80  void getVBoxHeuristics();
83  void getCodeLockHeuristics();
84  void getNetHeuristic();
88  void getBeRoHeuristics();
90  void getArmadilloHeuristic();
91  void getStarforceHeuristic();
93  void getRdataHeuristic();
94  void getNullsoftHeuristic();
95  void getManifestHeuristic();
96  void getSevenZipHeuristics();
101 
102  protected:
105  virtual void getFormatSpecificCompilerHeuristics() override;
106  virtual void getFormatSpecificLanguageHeuristics() override;
108 
109  public:
110  PeHeuristics(
111  retdec::fileformat::PeFormat &parser, Search &searcher,
113 };
114 
115 } // namespace cpdetect
116 } // namespace retdec
117 
118 #endif
Definition: heuristics.h:21
ToolInformation & toolInfo
results - detected tools
Definition: heuristics.h:69
Definition: pe_heuristics.h:30
virtual void getFormatSpecificLanguageHeuristics() override
Definition: pe_heuristics.cpp:2159
void getAndpakkHeuristics()
Definition: pe_heuristics.cpp:1019
retdec::fileformat::PeFormat & peParser
parser of input PE file
Definition: pe_heuristics.h:32
void getExcelsiorHeuristics()
Definition: pe_heuristics.cpp:1270
void getEnigmaHeuristics()
Definition: pe_heuristics.cpp:1037
std::string getUpxAdditionalInfo(std::size_t metadataPos)
Definition: pe_heuristics.cpp:213
void getAutoItHeuristics()
Definition: pe_heuristics.cpp:292
PeHeuristics(retdec::fileformat::PeFormat &parser, Search &searcher, ToolInformation &toolInfo)
Definition: pe_heuristics.cpp:162
void getPeCompactHeuristics()
Definition: pe_heuristics.cpp:982
void getRdataHeuristic()
Definition: pe_heuristics.cpp:1618
void getDotNetHeuristics()
Definition: pe_heuristics.cpp:317
void getNetHeuristic()
Definition: pe_heuristics.cpp:1186
void getAdeptProtectorHeuristics()
Definition: pe_heuristics.cpp:1151
void getMPRMMGVAHeuristics()
Definition: pe_heuristics.cpp:720
void getBorlandDelphiHeuristics()
Definition: pe_heuristics.cpp:1352
std::string getEnigmaVersion()
Definition: pe_heuristics.cpp:177
void getSafeDiscHeuristics()
Definition: pe_heuristics.cpp:591
void getSecuROMHeuristics()
Definition: pe_heuristics.cpp:669
void getPelockHeuristics()
Definition: pe_heuristics.cpp:814
const std::uint8_t * skip_NOP_JMP8_JMP32(const std::uint8_t *codeBegin, const std::uint8_t *codePtr, const std::uint8_t *codeEnd, std::size_t maxCount)
Definition: pe_heuristics.cpp:353
void getPeSectionHeuristics()
Definition: pe_heuristics.cpp:1907
virtual void getFormatSpecificCompilerHeuristics() override
Definition: pe_heuristics.cpp:2167
void getMorphineHeuristics()
Definition: pe_heuristics.cpp:469
void getMsvcIntelHeuristics()
Definition: pe_heuristics.cpp:1405
void getActiveMarkHeuristics()
Definition: pe_heuristics.cpp:759
void getUpxHeuristics()
Definition: pe_heuristics.cpp:901
void getPetiteHeuristics()
Definition: pe_heuristics.cpp:792
void getCodeLockHeuristics()
Definition: pe_heuristics.cpp:1171
std::int32_t getInt32Unaligned(const std::uint8_t *codePtr)
Definition: pe_heuristics.cpp:341
void getLinkerVersionHeuristic()
Definition: pe_heuristics.cpp:1498
void getSlashedSignatures()
Definition: pe_heuristics.cpp:430
void getFsgHeuristics()
Definition: pe_heuristics.cpp:965
void getVisualBasicHeuristics()
Definition: pe_heuristics.cpp:328
void getStarForceHeuristics()
Definition: pe_heuristics.cpp:505
void getMewSectionHeuristics()
Definition: pe_heuristics.cpp:1844
void getBeRoHeuristics()
Definition: pe_heuristics.cpp:1388
void getGoHeuristics()
Definition: pe_heuristics.cpp:265
void getStarforceHeuristic()
Definition: pe_heuristics.cpp:1457
std::size_t loadedLength
actual loaded length of file
Definition: pe_heuristics.h:35
void getEzirizReactorHeuristics()
Definition: pe_heuristics.cpp:834
bool checkSecuROMSignature(const char *fileData, const char *fileDataEnd, uint32_t FileOffset)
Definition: pe_heuristics.cpp:635
void getNullsoftHeuristic()
Definition: pe_heuristics.cpp:1663
void getVBoxHeuristics()
Definition: pe_heuristics.cpp:1107
void getRLPackHeuristics()
Definition: pe_heuristics.cpp:776
void getManifestHeuristic()
Definition: pe_heuristics.cpp:1682
void getArmadilloHeuristic()
Definition: pe_heuristics.cpp:1435
std::size_t declaredLength
declared length of file
Definition: pe_heuristics.h:34
void getNsPackSectionHeuristics()
Definition: pe_heuristics.cpp:1872
void getSevenZipHeuristics()
Definition: pe_heuristics.cpp:1782
void getActiveDeliveryHeuristics()
Definition: pe_heuristics.cpp:1133
void getVmProtectHeuristics()
Definition: pe_heuristics.cpp:1288
void getHeaderStyleHeuristics()
Definition: pe_heuristics.cpp:401
Definition: search.h:20
Definition: pe_format.h:28
Class for heuristics detection.
Definition: archive_wrapper.h:19
Definition of PeFormat class.
Definition: pe_heuristics.h:17
const char * headerStyle
Definition: pe_heuristics.h:22
uint16_t headerWords[0x0D]
Definition: pe_heuristics.h:23
Definition: cptypes.h:177