retdec
Private Attributes | List of all members
retdec::patterngen::PatternExtractor Class Reference

#include <pattern_extractor.h>

Collaboration diagram for retdec::patterngen::PatternExtractor:
Collaboration graph
[legend]

Public Member Functions

 PatternExtractor (const std::string &filePath, const std::string &groupName="unknown_group")
 Constructors and destructor. More...
 
 ~PatternExtractor ()
 
bool isValid () const
 Error handling methods. More...
 
std::string getErrorMessage () const
 
std::vector< std::string > getWarnings () const
 
void printRules (std::ostream &outputStream, const std::string &withNote="") const
 Output methods. More...
 
void addRulesToBuilder (yaramod::YaraFileBuilder &builder, const std::string &withNote="") const
 

Private Member Functions

bool isPic32DataObjectOnlyFile ()
 Strange PIC32 architecture files processing. More...
 
void processPic32DataObjectOnly ()
 
bool processFile ()
 Processing methods. More...
 
bool checkPPC64Sections ()
 
std::vector< const retdec::fileformat::Symbol * > filterSymbols ()
 
void processSymbol (const retdec::fileformat::Symbol *symbol)
 
void processSection (const retdec::fileformat::Section *section)
 
void addSectionPatterns (const retdec::fileformat::Section *section, std::vector< const retdec::fileformat::Symbol * > &symbols)
 
void addPattern (const retdec::fileformat::Section *section, const std::string &name, const unsigned long long offset, const unsigned long long size)
 
std::string getArchAsString ()
 

Private Attributes

std::unique_ptr< retdec::fileformat::FileFormatinputFile
 Parser. More...
 
bool stateValid = false
 Extractor state. More...
 
std::string errorMessage
 Error message if invalid state. More...
 
std::vector< std::string > warnings
 Vector with possible warnings. More...
 
std::string groupName
 Name for set of rules. More...
 
std::vector< SymbolPatternpatterns
 Vector of patterns found. More...
 

Detailed Description

Binary pattern extractor.

Constructor & Destructor Documentation

◆ PatternExtractor()

retdec::patterngen::PatternExtractor::PatternExtractor ( const std::string &  filePath,
const std::string &  groupName = "unknown_group" 
)

Constructors and destructor.

Constructor.

Parameters
filePathpath to file to process
groupNameoptional prefix for rule names (default: 'unknown_group')

◆ ~PatternExtractor()

retdec::patterngen::PatternExtractor::~PatternExtractor ( )
default

Member Function Documentation

◆ addPattern()

void retdec::patterngen::PatternExtractor::addPattern ( const retdec::fileformat::Section section,
const std::string &  name,
const unsigned long long  offset,
const unsigned long long  size 
)
private

Creates and stores one pattern from given symbol information.

Parameters
sectionpointer to symbol associated section
namename of the symbol
offsetsymbol offset from start of the section
sizesize of symbol

◆ addRulesToBuilder()

void retdec::patterngen::PatternExtractor::addRulesToBuilder ( yaramod::YaraFileBuilder &  builder,
const std::string &  withNote = "" 
) const

Add rules to YaraFileBuilder.

Parameters
builderYaraFileBuilder reference
withNoteoptional note that will be added to all rules

◆ addSectionPatterns()

void retdec::patterngen::PatternExtractor::addSectionPatterns ( const retdec::fileformat::Section section,
std::vector< const retdec::fileformat::Symbol * > &  symbols 
)
private

Add new patterns.

Parameters
sectionsection to which symbols belong
symbolsinput symbols

◆ checkPPC64Sections()

bool retdec::patterngen::PatternExtractor::checkPPC64Sections ( )
private

Check if we can use this 64-bit PowerPC file.

Problem is there is only one '.opd' section common for all code sections. This is problem if multiple code sections are present because we do not know to which section symbol belongs so we have to work with only standard '.text' section and ignore files with multiple code sections.

Returns
true if file can be processed, false otherwise

◆ filterSymbols()

std::vector< const Symbol * > retdec::patterngen::PatternExtractor::filterSymbols ( )
private

Filter symbols so that only first symbol for given address is used.

Returns
vector with filtered symbols

◆ getArchAsString()

std::string retdec::patterngen::PatternExtractor::getArchAsString ( )
private

Get architecture info as string.

This function should be replaced with unified way of interpreting architecture names when available.

Returns
string describing architecture

◆ getErrorMessage()

std::string retdec::patterngen::PatternExtractor::getErrorMessage ( ) const

Get error message in case of invalid state.

Returns
error message

◆ getWarnings()

std::vector< std::string > retdec::patterngen::PatternExtractor::getWarnings ( ) const

Get warning messages.

Returns
vector with warning messages

◆ isPic32DataObjectOnlyFile()

bool retdec::patterngen::PatternExtractor::isPic32DataObjectOnlyFile ( )
private

Strange PIC32 architecture files processing.

Check if input is strange PIC32 object with DATA OBJECT functions.

Returns
true if object has no common functions, false otherwise

◆ isValid()

bool retdec::patterngen::PatternExtractor::isValid ( ) const

Error handling methods.

Check state of extractor.

Returns
true if extractor is in valid state, false otherwise

◆ printRules()

void retdec::patterngen::PatternExtractor::printRules ( std::ostream &  outputStream,
const std::string &  withNote = "" 
) const

Output methods.

Print rules to output stream.

Parameters
outputStreamstream to print rules to
withNoteoptional note that will be added to all rules

◆ processFile()

bool retdec::patterngen::PatternExtractor::processFile ( )
private

Processing methods.

Process loaded file.

◆ processPic32DataObjectOnly()

void retdec::patterngen::PatternExtractor::processPic32DataObjectOnly ( )
private

Process PIC32 DATA OBJECT only file.

◆ processSection()

void retdec::patterngen::PatternExtractor::processSection ( const retdec::fileformat::Section section)
private

Process single section.

Parameters
sectionpointer to section to process

◆ processSymbol()

void retdec::patterngen::PatternExtractor::processSymbol ( const retdec::fileformat::Symbol symbol)
private

Process single symbol.

Parameters
symbolpointer to symbol to process

Member Data Documentation

◆ errorMessage

std::string retdec::patterngen::PatternExtractor::errorMessage
private

Error message if invalid state.

◆ groupName

std::string retdec::patterngen::PatternExtractor::groupName
private

Name for set of rules.

◆ inputFile

std::unique_ptr<retdec::fileformat::FileFormat> retdec::patterngen::PatternExtractor::inputFile
private

Parser.

◆ patterns

std::vector<SymbolPattern> retdec::patterngen::PatternExtractor::patterns
private

Vector of patterns found.

◆ stateValid

bool retdec::patterngen::PatternExtractor::stateValid = false
private

Extractor state.

◆ warnings

std::vector<std::string> retdec::patterngen::PatternExtractor::warnings
private

Vector with possible warnings.


The documentation for this class was generated from the following files: