retdec
|
#include <heuristics.h>
Public Member Functions | |
Heuristics (retdec::fileformat::FileFormat &parser, Search &searcher, ToolInformation &toolInfo) | |
virtual | ~Heuristics ()=default |
Protected Member Functions | |
Auxiliary methods | |
std::string | getUpxVersion () |
const DetectResult * | isDetected (const std::string &name, const DetectionStrength minStrength=DetectionStrength::LOW) |
Virtual methods | |
virtual void | getFormatSpecificCompilerHeuristics () |
virtual void | getFormatSpecificLanguageHeuristics () |
Add heuristic detection methods | |
void | addCompiler (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="") |
void | addLinker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="") |
void | addInstaller (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="") |
void | addPacker (DetectionMethod source, DetectionStrength strength, const std::string &name, const std::string &version="", const std::string &extra="") |
Add signature detection methods | |
void | addCompiler (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="") |
void | addPacker (std::size_t matchNibbles, std::size_t totalNibbles, const std::string &name, const std::string &version="", const std::string &extra="") |
Add language methods | |
void | addLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false) |
void | addPriorityLanguage (const std::string &name, const std::string &extraInfo="", bool isBytecode=false) |
Other methods | |
std::size_t | findSectionName (const std::string §ionName) const |
std::size_t | findSectionNameStart (const std::string §ionName) const |
Protected Attributes | |
retdec::fileformat::FileFormat & | fileParser |
input file parser More... | |
Search & | search |
signature search engine More... | |
bool | canSearch |
true if we can use search engine More... | |
ToolInformation & | toolInfo |
results - detected tools More... | |
std::vector< const retdec::fileformat::Section * > | sections |
section information More... | |
std::map< std::string, std::size_t > | sectionNameMap |
section name counts More... | |
std::size_t | noOfSections |
section count More... | |
bool | priorityLanguageIsSet = false |
Private Member Functions | |
Sections heuristics | |
void | getSectionHeuristics () |
Comment sections heuristics | |
bool | parseGccComment (const std::string &record) |
bool | parseGhcComment (const std::string &record) |
bool | parseOpen64Comment (const std::string &record) |
void | getCommentSectionsHeuristics () |
DWARF heuristics | |
bool | parseGccProducer (const std::string &producer) |
bool | parseClangProducer (const std::string &producer) |
bool | parseTmsProducer (const std::string &producer) |
void | getDwarfInfo () |
Delphi specific heuristics | |
std::string | getEmbarcaderoVersion () |
void | getEmbarcaderoHeuristics () |
Symbol heuristics | |
void | getSymbolHeuristic () |
Heuristics methods | |
void | getCommonToolsHeuristics () |
void | getCommonLanguageHeuristics () |
void | getAllHeuristics () |
Class for heuristics detection
retdec::cpdetect::Heuristics::Heuristics | ( | retdec::fileformat::FileFormat & | parser, |
Search & | searcher, | ||
ToolInformation & | toolInfo | ||
) |
Constructor
parser | Parser of input file |
searcher | Signature search engine |
toolInfo | Structure for information about detected tools |
|
virtualdefault |
|
protected |
Save all information about detected compiler
source | Used detection method |
strength | Strength of detection method |
name | Name of detected compiler |
version | Version of detected compiler |
extra | Extra information about compiler |
|
protected |
Save all information about detected compiler
matchNibbles | Number of significant nibbles agreeing with file content |
totalNibbles | Total number of significant nibbles of signature |
name | Name of detected compiler |
version | Version of detected compiler |
extra | Extra information about compiler |
This method implies DetectResultSource::SIGNATURE. Strength is computed.
|
protected |
Save all information about detected installer
source | Used detection method |
strength | Strength of detection method |
name | Name of detected installer |
version | Version of detected installer |
extra | Extra information about installer |
|
protected |
Add information about detected programming language
name | Name of detected programming language |
extraInfo | Additional information about language |
isBytecode | true if detected language is bytecode, false otherwise |
|
protected |
Save all information about detected linker
source | Used detection method |
strength | Strength of detection method |
name | Name of detected linker |
version | Version of detected linker |
extra | Extra information about linker |
|
protected |
Save all information about detected packer
source | Used detection method |
strength | Strength of detection method |
name | Name of detected packer |
version | Version of detected packer |
extra | Extra information about packer |
|
protected |
Save all information about detected packer
matchNibbles | Number of significant nibbles agreeing with file content |
totalNibbles | Total number of significant nibbles of signature |
name | Name of detected packer |
version | Version of detected packer |
extra | Extra information about packer |
This method implies DetectResultSource::SIGNATURE. Strength is computed.
|
protected |
Add information about detected programming language
name | Name of detected programming language |
extraInfo | Additional information about language |
isBytecode | true if detected language is bytecode, false otherwise |
This removes previously detected languages and prevents further detections
|
protected |
Get number of sections which have name equal to sectionName
sectionName | Required section name |
|
protected |
Get number of sections with name starting with sectionName
sectionName | Required section name |
void retdec::cpdetect::Heuristics::getAllHeuristics | ( | ) |
Try detect compiler based on all available heuristics
|
private |
Try to detect used compiler based on content of comment sections
true
if used compiler was successfully detected, false
otherwise
|
private |
Try to detect original language
|
private |
Try to detect tools
|
private |
Try to detect compiler based on DWARF debugging information
|
private |
Try to detect Embarcadero Delphi compiler
|
private |
Get Embarcadero Delphi version
|
protectedvirtual |
Get all compiler heuristics which are specific for one file format
Reimplemented in retdec::cpdetect::PeHeuristics, retdec::cpdetect::MachOHeuristics, and retdec::cpdetect::ElfHeuristics.
|
protectedvirtual |
Get all language heuristics which are specific for one file format
Reimplemented in retdec::cpdetect::PeHeuristics.
|
private |
Try to detect tools by section names
|
private |
Try to detect compilers by specific symbol names
|
protected |
Try detect version of UPX packer
|
protected |
Check if compiler is already detected
name | Name of compiler |
minStrength | Minimal strength of used method |
|
private |
Parse clang producer from DWARF debug information
producer | DWARF record |
true
if clang was detected, false
otherwise
|
private |
Parse GCC record from comment section
record | Record from comment section |
true
if compiler was detected, false
otherwise
|
private |
Parse GCC producer from DWARF debug information
producer | DWARF record |
true
if compiler was detected, false
otherwise
|
private |
Parse GHC record from comment section
record | Record from comment section |
true
if GHC was detected, false
otherwise
|
private |
Parse Open64 record from comment section
record | Record from comment section |
true
if Open64 was detected, false
otherwise
|
private |
Parse Texas Instruments producer from DWARF debug information
producer | DWARF record |
true
if Texas Instruments was detected, false
otherwise
|
protected |
true
if we can use search engine
|
protected |
input file parser
|
protected |
section count
|
protected |
If true
original language is detected with high reliability. This disables further detection of used programming languages.
|
protected |
signature search engine
|
protected |
section name counts
|
protected |
section information
|
protected |
results - detected tools