retdec
Typedefs | Functions
idr2pat.cpp File Reference

IDR knowledge base pattern extractor. More...

#include <cstdint>
#include <fstream>
#include <iomanip>
#include <istream>
#include <map>
#include <set>
#include <vector>
#include "retdec/utils/conversion.h"
#include "retdec/utils/io/log.h"
#include "yaramod/builder/yara_expression_builder.h"
#include "yaramod/builder/yara_hex_string_builder.h"
#include "yaramod/builder/yara_rule_builder.h"

Typedefs

using Relocation = std::pair< std::uint32_t, std::string >
 

Functions

bool getWord (std::uint16_t &result, std::ifstream &inputStream)
 
bool getDword (std::uint32_t &result, std::ifstream &inputStream)
 
bool getString (std::string &result, std::ifstream &inputStream)
 
void skip (const std::size_t &N, std::ifstream &inputStream)
 
std::string getRelocationsAsString (const std::vector< Relocation > &relocations)
 
void readFunction (std::ifstream &inputStream, const std::size_t &index)
 
bool readDatabase (std::ifstream &inputStream, std::string &errorMessage)
 
int printError (const std::string &message)
 
int main (int argc, char **argv)
 

Detailed Description

IDR knowledge base pattern extractor.

Typedef Documentation

◆ Relocation

using Relocation = std::pair<std::uint32_t, std::string>

Offset - Name relocation pair type.

Function Documentation

◆ getDword()

bool getDword ( std::uint32_t &  result,
std::ifstream &  inputStream 
)

Get one DWORD from input stream.

Parameters
resultwhere to store result
inputStreamstream with correct position
Returns
true if value was read, false otherwise

◆ getRelocationsAsString()

std::string getRelocationsAsString ( const std::vector< Relocation > &  relocations)

Get string from relocations.

Parameters
relocationsvector with relocation pairs
Returns
formatted string

◆ getString()

bool getString ( std::string &  result,
std::ifstream &  inputStream 
)

Get zero terminated string with size information from input stream.

Parameters
resultwhere to store result
inputStreamstream with correct position
Returns
true if value was read, false otherwise

◆ getWord()

bool getWord ( std::uint16_t &  result,
std::ifstream &  inputStream 
)

Get one WORD from input stream.

Parameters
resultwhere to store result
inputStreamstream with correct position
Returns
true if value was read, false otherwise

◆ main()

int main ( int  argc,
char **  argv 
)

◆ printError()

int printError ( const std::string &  message)

Print error and return.

Parameters
messageerror message
Returns
non-zero value

◆ readDatabase()

bool readDatabase ( std::ifstream &  inputStream,
std::string &  errorMessage 
)

Read database and print function rules.

Parameters
inputStreamsource input stream
errorMessagepossible error message if false is returned
Returns
true if information was read correctly, false otherwise

◆ readFunction()

void readFunction ( std::ifstream &  inputStream,
const std::size_t &  index 
)

Read one function or procedure from KB.

Parameters
inputStreamstream with correct position
indexindex of function

◆ skip()

void skip ( const std::size_t &  N,
std::ifstream &  inputStream 
)

Skip N bytes in input stream at actual position.

Parameters
Nnumber of bytes to skip
inputStreamstream with correct position