966 lines
218 KiB
HTML
Executable File
966 lines
218 KiB
HTML
Executable File
<?xml version="1.0" encoding="ascii"?>
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
<head>
|
|
<title>Libs.librecognition</title>
|
|
<link rel="stylesheet" href="epydoc.css" type="text/css" />
|
|
<script type="text/javascript" src="epydoc.js"></script>
|
|
</head>
|
|
|
|
<body bgcolor="white" text="black" link="blue" vlink="#204080"
|
|
alink="#204080">
|
|
<!-- ==================== NAVIGATION BAR ==================== -->
|
|
<table class="navbar" border="0" width="100%" cellpadding="0"
|
|
bgcolor="#a0c0ff" cellspacing="0">
|
|
<tr valign="middle">
|
|
|
|
<!-- Tree link -->
|
|
<th> <a
|
|
href="module-tree.html">Trees</a> </th>
|
|
|
|
<!-- Index link -->
|
|
<th> <a
|
|
href="identifier-index.html">Indices</a> </th>
|
|
|
|
<!-- Help link -->
|
|
<th> <a
|
|
href="help.html">Help</a> </th>
|
|
|
|
<!-- Project homepage -->
|
|
<th class="navbar" align="right" width="100%">
|
|
<table border="0" cellpadding="0" cellspacing="0">
|
|
<tr><th class="navbar" align="center"
|
|
>Immunity Debugger API Reference</th>
|
|
</tr></table></th>
|
|
</tr>
|
|
</table>
|
|
<table width="100%" cellpadding="0" cellspacing="0">
|
|
<tr valign="top">
|
|
<td width="100%">
|
|
<span class="breadcrumbs">
|
|
Package Libs ::
|
|
Module librecognition
|
|
</span>
|
|
</td>
|
|
<td>
|
|
<table cellpadding="0" cellspacing="0">
|
|
<!-- hide/show private -->
|
|
<tr><td align="right"><span class="options">[<a href="javascript:void(0);" class="privatelink"
|
|
onclick="toggle_private();">hide private</a>]</span></td></tr>
|
|
<tr><td align="right"><span class="options"
|
|
>[<a href="frames.html" target="_top">frames</a
|
|
>] | <a href="Libs.librecognition-pysrc.html"
|
|
target="_top">no frames</a>]</span></td></tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<h1 class="epydoc">Source Code for <a href="Libs.librecognition-module.html">Module Libs.librecognition</a></h1>
|
|
<pre class="py-src">
|
|
<a name="L1"></a><tt class="py-lineno"> 1</tt> <tt class="py-line"><tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L2"></a><tt class="py-lineno"> 2</tt> <tt class="py-line"><tt class="py-docstring">(c) Immunity, Inc. 2004-2007</tt> </tt>
|
|
<a name="L3"></a><tt class="py-lineno"> 3</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L4"></a><tt class="py-lineno"> 4</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L5"></a><tt class="py-lineno"> 5</tt> <tt class="py-line"><tt class="py-docstring">U{Immunity Inc.<http://www.immunityinc.com>}</tt> </tt>
|
|
<a name="L6"></a><tt class="py-lineno"> 6</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L7"></a><tt class="py-lineno"> 7</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L8"></a><tt class="py-lineno"> 8</tt> <tt class="py-line"><tt class="py-docstring">Library for function recognizing</tt> </tt>
|
|
<a name="L9"></a><tt class="py-lineno"> 9</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L10"></a><tt class="py-lineno"> 10</tt> <tt class="py-line"><tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L11"></a><tt class="py-lineno"> 11</tt> <tt class="py-line"><tt id="link-0" class="py-name" targets="Variable Libs.immlib.__VERSION__=Libs.immlib-module.html#__VERSION__,Variable Libs.immutils.__VERSION__=Libs.immutils-module.html#__VERSION__,Variable Libs.immvcglib.__VERSION__=Libs.immvcglib-module.html#__VERSION__,Variable Libs.internals.__VERSION__=Libs.internals-module.html#__VERSION__,Variable Libs.libanalyze.__VERSION__=Libs.libanalyze-module.html#__VERSION__,Variable Libs.libdatatype.__VERSION__=Libs.libdatatype-module.html#__VERSION__,Variable Libs.libevent.__VERSION__=Libs.libevent-module.html#__VERSION__,Variable Libs.libheap.__VERSION__=Libs.libheap-module.html#__VERSION__,Variable Libs.libhook.__VERSION__=Libs.libhook-module.html#__VERSION__,Variable Libs.librecognition.__VERSION__=Libs.librecognition-module.html#__VERSION__,Variable Libs.pelib.__VERSION__=Libs.pelib-module.html#__VERSION__"><a title="Libs.immlib.__VERSION__
|
|
Libs.immutils.__VERSION__
|
|
Libs.immvcglib.__VERSION__
|
|
Libs.internals.__VERSION__
|
|
Libs.libanalyze.__VERSION__
|
|
Libs.libdatatype.__VERSION__
|
|
Libs.libevent.__VERSION__
|
|
Libs.libheap.__VERSION__
|
|
Libs.libhook.__VERSION__
|
|
Libs.librecognition.__VERSION__
|
|
Libs.pelib.__VERSION__" class="py-name" href="#" onclick="return doclink('link-0', '__VERSION__', 'link-0');">__VERSION__</a></tt> <tt class="py-op">=</tt> <tt class="py-string">'1.2'</tt> </tt>
|
|
<a name="L12"></a><tt class="py-lineno"> 12</tt> <tt class="py-line"> </tt>
|
|
<a name="L13"></a><tt class="py-lineno"> 13</tt> <tt class="py-line"> </tt>
|
|
<a name="L14"></a><tt class="py-lineno"> 14</tt> <tt class="py-line"><tt class="py-keyword">from</tt> <tt id="link-1" class="py-name" targets="Module Libs.libanalyze=Libs.libanalyze-module.html"><a title="Libs.libanalyze" class="py-name" href="#" onclick="return doclink('link-1', 'libanalyze', 'link-1');">libanalyze</a></tt> <tt class="py-keyword">import</tt> <tt class="py-op">*</tt> </tt>
|
|
<a name="L15"></a><tt class="py-lineno"> 15</tt> <tt class="py-line"><tt class="py-keyword">from</tt> <tt id="link-2" class="py-name" targets="Module Libs.libdatatype=Libs.libdatatype-module.html"><a title="Libs.libdatatype" class="py-name" href="#" onclick="return doclink('link-2', 'libdatatype', 'link-2');">libdatatype</a></tt> <tt class="py-keyword">import</tt> <tt class="py-op">*</tt> </tt>
|
|
<a name="L16"></a><tt class="py-lineno"> 16</tt> <tt class="py-line"><tt class="py-keyword">from</tt> <tt class="py-name">libstackanalyze</tt> <tt class="py-keyword">import</tt> <tt class="py-op">*</tt> </tt>
|
|
<a name="L17"></a><tt class="py-lineno"> 17</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">binascii</tt> </tt>
|
|
<a name="L18"></a><tt class="py-lineno"> 18</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">struct</tt> </tt>
|
|
<a name="L19"></a><tt class="py-lineno"> 19</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">hashlib</tt> </tt>
|
|
<a name="L20"></a><tt class="py-lineno"> 20</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">re</tt> </tt>
|
|
<a name="L21"></a><tt class="py-lineno"> 21</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">string</tt> </tt>
|
|
<a name="L22"></a><tt class="py-lineno"> 22</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">debugger</tt> </tt>
|
|
<a name="L23"></a><tt class="py-lineno"> 23</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">csv</tt> </tt>
|
|
<a name="L24"></a><tt class="py-lineno"> 24</tt> <tt class="py-line"><tt class="py-keyword">import</tt> <tt class="py-name">os</tt> </tt>
|
|
<a name="L25"></a><tt class="py-lineno"> 25</tt> <tt class="py-line"> </tt>
|
|
<a name="MultiCSVIterator"></a><div id="MultiCSVIterator-def"><a name="L26"></a><tt class="py-lineno"> 26</tt> <a class="py-toggle" href="#" id="MultiCSVIterator-toggle" onclick="return toggle('MultiCSVIterator');">-</a><tt class="py-line"><tt class="py-keyword">class</tt> <a class="py-def-name" href="Libs.librecognition.MultiCSVIterator-class.html">MultiCSVIterator</a><tt class="py-op">:</tt> </tt>
|
|
</div><div id="MultiCSVIterator-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="MultiCSVIterator-expanded"><a name="MultiCSVIterator.__init__"></a><div id="MultiCSVIterator.__init__-def"><a name="L27"></a><tt class="py-lineno"> 27</tt> <a class="py-toggle" href="#" id="MultiCSVIterator.__init__-toggle" onclick="return toggle('MultiCSVIterator.__init__');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.MultiCSVIterator-class.html#__init__">__init__</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">dictionaries</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="MultiCSVIterator.__init__-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="MultiCSVIterator.__init__-expanded"><a name="L28"></a><tt class="py-lineno"> 28</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">isinstance</tt><tt class="py-op">(</tt><tt class="py-name">dictionaries</tt><tt class="py-op">,</tt> <tt class="py-name">list</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L29"></a><tt class="py-lineno"> 29</tt> <tt class="py-line"> <tt class="py-name">dictionaries</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt> <tt class="py-name">dictionaries</tt> <tt class="py-op">]</tt> </tt>
|
|
<a name="L30"></a><tt class="py-lineno"> 30</tt> <tt class="py-line"> </tt>
|
|
<a name="L31"></a><tt class="py-lineno"> 31</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L32"></a><tt class="py-lineno"> 32</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L33"></a><tt class="py-lineno"> 33</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L34"></a><tt class="py-lineno"> 34</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">d</tt> <tt class="py-keyword">in</tt> <tt class="py-name">dictionaries</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L35"></a><tt class="py-lineno"> 35</tt> <tt class="py-line"> <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L36"></a><tt class="py-lineno"> 36</tt> <tt class="py-line"> <tt class="py-name">fd</tt> <tt class="py-op">=</tt> <tt class="py-name">open</tt><tt class="py-op">(</tt><tt class="py-name">d</tt><tt class="py-op">,</tt> <tt class="py-string">"rb"</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L37"></a><tt class="py-lineno"> 37</tt> <tt class="py-line"> <tt class="py-keyword">except</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L38"></a><tt class="py-lineno"> 38</tt> <tt class="py-line"> <tt class="py-name">fd</tt> <tt class="py-op">=</tt> <tt class="py-name">open</tt><tt class="py-op">(</tt><tt class="py-name">d</tt><tt class="py-op">,</tt> <tt class="py-string">"w+b"</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L39"></a><tt class="py-lineno"> 39</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt><tt class="py-op">.</tt><tt id="link-3" class="py-name" targets="Method Libs.libheap.PLook.append()=Libs.libheap.PLook-class.html#append"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-3', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">csv</tt><tt class="py-op">.</tt><tt class="py-name">reader</tt><tt class="py-op">(</tt><tt class="py-name">fd</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L40"></a><tt class="py-lineno"> 40</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt><tt class="py-op">.</tt><tt id="link-4" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-4', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">fd</tt><tt class="py-op">)</tt> </tt>
|
|
</div><a name="MultiCSVIterator.__iter__"></a><div id="MultiCSVIterator.__iter__-def"><a name="L41"></a><tt class="py-lineno"> 41</tt> <a class="py-toggle" href="#" id="MultiCSVIterator.__iter__-toggle" onclick="return toggle('MultiCSVIterator.__iter__');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.MultiCSVIterator-class.html#__iter__">__iter__</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="MultiCSVIterator.__iter__-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="MultiCSVIterator.__iter__-expanded"><a name="L42"></a><tt class="py-lineno"> 42</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">i</tt> <tt class="py-keyword">in</tt> <tt class="py-name">range</tt><tt class="py-op">(</tt><tt class="py-number">0</tt><tt class="py-op">,</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L43"></a><tt class="py-lineno"> 43</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt><tt class="py-op">[</tt><tt class="py-name">i</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">seek</tt><tt class="py-op">(</tt><tt class="py-number">0</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L44"></a><tt class="py-lineno"> 44</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L45"></a><tt class="py-lineno"> 45</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">self</tt> </tt>
|
|
</div><a name="L46"></a><tt class="py-lineno"> 46</tt> <tt class="py-line"> </tt>
|
|
<a name="MultiCSVIterator.__del__"></a><div id="MultiCSVIterator.__del__-def"><a name="L47"></a><tt class="py-lineno"> 47</tt> <a class="py-toggle" href="#" id="MultiCSVIterator.__del__-toggle" onclick="return toggle('MultiCSVIterator.__del__');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.MultiCSVIterator-class.html#__del__">__del__</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="MultiCSVIterator.__del__-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="MultiCSVIterator.__del__-expanded"><a name="L48"></a><tt class="py-lineno"> 48</tt> <tt class="py-line"> <tt class="py-keyword">while</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L49"></a><tt class="py-lineno"> 49</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L50"></a><tt class="py-lineno"> 50</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">fd</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L51"></a><tt class="py-lineno"> 51</tt> <tt class="py-line"> <tt class="py-name">fd</tt><tt class="py-op">.</tt><tt class="py-name">close</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L52"></a><tt class="py-lineno"> 52</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt> </tt>
|
|
</div><a name="L53"></a><tt class="py-lineno"> 53</tt> <tt class="py-line"> </tt>
|
|
<a name="MultiCSVIterator.next"></a><div id="MultiCSVIterator.next-def"><a name="L54"></a><tt class="py-lineno"> 54</tt> <a class="py-toggle" href="#" id="MultiCSVIterator.next-toggle" onclick="return toggle('MultiCSVIterator.next');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.MultiCSVIterator-class.html#next">next</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="MultiCSVIterator.next-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="MultiCSVIterator.next-expanded"><a name="L55"></a><tt class="py-lineno"> 55</tt> <tt class="py-line"> <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L56"></a><tt class="py-lineno"> 56</tt> <tt class="py-line"> <tt class="py-name">data</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt><tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt id="link-5" class="py-name" targets="Method Libs.librecognition.MultiCSVIterator.next()=Libs.librecognition.MultiCSVIterator-class.html#next"><a title="Libs.librecognition.MultiCSVIterator.next" class="py-name" href="#" onclick="return doclink('link-5', 'next', 'link-5');">next</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L57"></a><tt class="py-lineno"> 57</tt> <tt class="py-line"> <tt class="py-keyword">except</tt> <tt class="py-name">StopIteration</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L58"></a><tt class="py-lineno"> 58</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">iterators</tt><tt class="py-op">)</tt> <tt class="py-op">></tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt><tt class="py-op">+</tt><tt class="py-number">1</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L59"></a><tt class="py-lineno"> 59</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L60"></a><tt class="py-lineno"> 60</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-6" class="py-name"><a title="Libs.librecognition.MultiCSVIterator.next" class="py-name" href="#" onclick="return doclink('link-6', 'next', 'link-5');">next</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L61"></a><tt class="py-lineno"> 61</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L62"></a><tt class="py-lineno"> 62</tt> <tt class="py-line"> <tt class="py-keyword">raise</tt> <tt class="py-name">StopIteration</tt> </tt>
|
|
<a name="L63"></a><tt class="py-lineno"> 63</tt> <tt class="py-line"> <tt class="py-comment">#append the filename to each line</tt> </tt>
|
|
<a name="L64"></a><tt class="py-lineno"> 64</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">data</tt><tt class="py-op">.</tt><tt id="link-7" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-7', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">fds</tt><tt class="py-op">[</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">idx</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">name</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L65"></a><tt class="py-lineno"> 65</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">data</tt> </tt>
|
|
</div></div><a name="L66"></a><tt class="py-lineno"> 66</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition"></a><div id="FunctionRecognition-def"><a name="L67"></a><tt class="py-lineno"> 67</tt> <a class="py-toggle" href="#" id="FunctionRecognition-toggle" onclick="return toggle('FunctionRecognition');">-</a><tt class="py-line"><tt class="py-keyword">class</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html">FunctionRecognition</a><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition-collapsed" style="display:none;" pad="+++" indent="++++"></div><div id="FunctionRecognition-expanded"><a name="FunctionRecognition.__init__"></a><div id="FunctionRecognition.__init__-def"><a name="L68"></a><tt class="py-lineno"> 68</tt> <a class="py-toggle" href="#" id="FunctionRecognition.__init__-toggle" onclick="return toggle('FunctionRecognition.__init__');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#__init__">__init__</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">imm</tt><tt class="py-op">,</tt> <tt class="py-param">dictionaryfiles</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.__init__-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.__init__-expanded"><a name="L69"></a><tt class="py-lineno"> 69</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L70"></a><tt class="py-lineno"> 70</tt> <tt class="py-line"><tt class="py-docstring"> This class try to recognize a function using different methods </tt> </tt>
|
|
<a name="L71"></a><tt class="py-lineno"> 71</tt> <tt class="py-line"><tt class="py-docstring"> (address/signature/heuristic).</tt> </tt>
|
|
<a name="L72"></a><tt class="py-lineno"> 72</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L73"></a><tt class="py-lineno"> 73</tt> <tt class="py-line"><tt class="py-docstring"> @type imm: Debbuger OBJECT</tt> </tt>
|
|
<a name="L74"></a><tt class="py-lineno"> 74</tt> <tt class="py-line"><tt class="py-docstring"> @param imm: Debbuger instance</tt> </tt>
|
|
<a name="L75"></a><tt class="py-lineno"> 75</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L76"></a><tt class="py-lineno"> 76</tt> <tt class="py-line"><tt class="py-docstring"> @type dictionaryfiles: STRING|LIST</tt> </tt>
|
|
<a name="L77"></a><tt class="py-lineno"> 77</tt> <tt class="py-line"><tt class="py-docstring"> @param dictionaryfiles: Name, or list of names, of .dat files inside the Data folder, where're stored the function </tt> </tt>
|
|
<a name="L78"></a><tt class="py-lineno"> 78</tt> <tt class="py-line"><tt class="py-docstring"> patterns. Use an empty string to use all .dat files in Data folder.</tt> </tt>
|
|
<a name="L79"></a><tt class="py-lineno"> 79</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L80"></a><tt class="py-lineno"> 80</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt> <tt class="py-op">=</tt> <tt class="py-name">imm</tt> </tt>
|
|
<a name="L81"></a><tt class="py-lineno"> 81</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicReferencesCache</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L82"></a><tt class="py-lineno"> 82</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicCache</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L83"></a><tt class="py-lineno"> 83</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L84"></a><tt class="py-lineno"> 84</tt> <tt class="py-line"> </tt>
|
|
<a name="L85"></a><tt class="py-lineno"> 85</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">dictionaryfiles</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L86"></a><tt class="py-lineno"> 86</tt> <tt class="py-line"> <tt class="py-name">dictionaryfiles</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L87"></a><tt class="py-lineno"> 87</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">file</tt> <tt class="py-keyword">in</tt> <tt class="py-name">os</tt><tt class="py-op">.</tt><tt class="py-name">listdir</tt><tt class="py-op">(</tt><tt class="py-string">"Data"</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L88"></a><tt class="py-lineno"> 88</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">file</tt><tt class="py-op">[</tt><tt class="py-op">-</tt><tt class="py-number">4</tt><tt class="py-op">:</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-string">".dat"</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L89"></a><tt class="py-lineno"> 89</tt> <tt class="py-line"> <tt class="py-name">dictionaryfiles</tt><tt class="py-op">.</tt><tt id="link-8" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-8', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">os</tt><tt class="py-op">.</tt><tt class="py-name">path</tt><tt class="py-op">.</tt><tt class="py-name">join</tt><tt class="py-op">(</tt><tt class="py-string">"Data"</tt><tt class="py-op">,</tt> <tt class="py-name">file</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L90"></a><tt class="py-lineno"> 90</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">dictionaries</tt> <tt class="py-op">=</tt> <tt id="link-9" class="py-name" targets="Class Libs.librecognition.MultiCSVIterator=Libs.librecognition.MultiCSVIterator-class.html"><a title="Libs.librecognition.MultiCSVIterator" class="py-name" href="#" onclick="return doclink('link-9', 'MultiCSVIterator', 'link-9');">MultiCSVIterator</a></tt><tt class="py-op">(</tt><tt class="py-name">dictionaryfiles</tt><tt class="py-op">)</tt> </tt>
|
|
</div><a name="L91"></a><tt class="py-lineno"> 91</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.resolvFunctionByAddress"></a><div id="FunctionRecognition.resolvFunctionByAddress-def"><a name="L92"></a><tt class="py-lineno"> 92</tt> <a class="py-toggle" href="#" id="FunctionRecognition.resolvFunctionByAddress-toggle" onclick="return toggle('FunctionRecognition.resolvFunctionByAddress');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#resolvFunctionByAddress">resolvFunctionByAddress</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">heuristic</tt><tt class="py-op">=</tt><tt class="py-number">90</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.resolvFunctionByAddress-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.resolvFunctionByAddress-expanded"><a name="L93"></a><tt class="py-lineno"> 93</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L94"></a><tt class="py-lineno"> 94</tt> <tt class="py-line"><tt class="py-docstring"> Look up into our dictionaries to find a function match.</tt> </tt>
|
|
<a name="L95"></a><tt class="py-lineno"> 95</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L96"></a><tt class="py-lineno"> 96</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L97"></a><tt class="py-lineno"> 97</tt> <tt class="py-line"><tt class="py-docstring"> @param address: Address of the function to search</tt> </tt>
|
|
<a name="L98"></a><tt class="py-lineno"> 98</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L99"></a><tt class="py-lineno"> 99</tt> <tt class="py-line"><tt class="py-docstring"> @type heuristic: INTEGER</tt> </tt>
|
|
<a name="L100"></a><tt class="py-lineno">100</tt> <tt class="py-line"><tt class="py-docstring"> @param heuristic: heuristic threasold to consider a real function match</tt> </tt>
|
|
<a name="L101"></a><tt class="py-lineno">101</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L102"></a><tt class="py-lineno">102</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: STRING</tt> </tt>
|
|
<a name="L103"></a><tt class="py-lineno">103</tt> <tt class="py-line"><tt class="py-docstring"> @return: a STRING with the function's real name or the given address if there's no match</tt> </tt>
|
|
<a name="L104"></a><tt class="py-lineno">104</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L105"></a><tt class="py-lineno">105</tt> <tt class="py-line"> </tt>
|
|
<a name="L106"></a><tt class="py-lineno">106</tt> <tt class="py-line"> <tt class="py-comment">#cache the answers</tt> </tt>
|
|
<a name="L107"></a><tt class="py-lineno">107</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L108"></a><tt class="py-lineno">108</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L109"></a><tt class="py-lineno">109</tt> <tt class="py-line"> </tt>
|
|
<a name="L110"></a><tt class="py-lineno">110</tt> <tt class="py-line"> <tt class="py-comment">#try the exact hash method</tt> </tt>
|
|
<a name="L111"></a><tt class="py-lineno">111</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">exact</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-10" class="py-name" targets="Method Libs.immlib.Debugger.makeFunctionHashExact()=Libs.immlib.Debugger-class.html#makeFunctionHashExact,Method Libs.librecognition.FunctionRecognition.makeFunctionHashExact()=Libs.librecognition.FunctionRecognition-class.html#makeFunctionHashExact"><a title="Libs.immlib.Debugger.makeFunctionHashExact
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashExact" class="py-name" href="#" onclick="return doclink('link-10', 'makeFunctionHashExact', 'link-10');">makeFunctionHashExact</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L112"></a><tt class="py-lineno">112</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">data</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">dictionaries</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L113"></a><tt class="py-lineno">113</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">exact</tt> <tt class="py-op">==</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L114"></a><tt class="py-lineno">114</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L115"></a><tt class="py-lineno">115</tt> <tt class="py-line"> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L116"></a><tt class="py-lineno">116</tt> <tt class="py-line"> </tt>
|
|
<a name="L117"></a><tt class="py-lineno">117</tt> <tt class="py-line"> <tt class="py-comment">#try the heuristic method</tt> </tt>
|
|
<a name="L118"></a><tt class="py-lineno">118</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L119"></a><tt class="py-lineno">119</tt> <tt class="py-line"> <tt class="py-name">ref</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-11" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.selectBasicBlock()=Libs.librecognition.FunctionRecognition-class.html#selectBasicBlock"><a title="Libs.librecognition.FunctionRecognition.selectBasicBlock" class="py-name" href="#" onclick="return doclink('link-11', 'selectBasicBlock', 'link-11');">selectBasicBlock</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L120"></a><tt class="py-lineno">120</tt> <tt class="py-line"> <tt class="py-name">posThreshold</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L121"></a><tt class="py-lineno">121</tt> <tt class="py-line"> <tt class="py-name">posName</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> </tt>
|
|
<a name="L122"></a><tt class="py-lineno">122</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">data</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">dictionaries</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L123"></a><tt class="py-lineno">123</tt> <tt class="py-line"> <tt class="py-comment">#cut down the possibilities, because the performance, reproducing the BB selection and comparing the result</tt> </tt>
|
|
<a name="L124"></a><tt class="py-lineno">124</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#XXX: it's not a perfect way, thinking of supporting version changes</tt> </tt>
|
|
<a name="L125"></a><tt class="py-lineno">125</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">ref</tt> <tt class="py-op">==</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L126"></a><tt class="py-lineno">126</tt> <tt class="py-line"> <tt class="py-name">perc</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-12" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.checkHeuristic()=Libs.librecognition.FunctionRecognition-class.html#checkHeuristic"><a title="Libs.librecognition.FunctionRecognition.checkHeuristic" class="py-name" href="#" onclick="return doclink('link-12', 'checkHeuristic', 'link-12');">checkHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">3</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L127"></a><tt class="py-lineno">127</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("similar to function %s in %d%%" % (data[0], perc))</tt> </tt>
|
|
<a name="L128"></a><tt class="py-lineno">128</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">perc</tt> <tt class="py-op">>=</tt> <tt class="py-name">heuristic</tt> <tt class="py-keyword">and</tt> <tt class="py-name">perc</tt> <tt class="py-op">></tt> <tt class="py-name">posThreshold</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L129"></a><tt class="py-lineno">129</tt> <tt class="py-line"> <tt class="py-name">posThreshold</tt> <tt class="py-op">=</tt> <tt class="py-name">perc</tt> </tt>
|
|
<a name="L130"></a><tt class="py-lineno">130</tt> <tt class="py-line"> <tt class="py-name">posName</tt> <tt class="py-op">=</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L131"></a><tt class="py-lineno">131</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">posName</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L132"></a><tt class="py-lineno">132</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">posName</tt> </tt>
|
|
<a name="L133"></a><tt class="py-lineno">133</tt> <tt class="py-line"> </tt>
|
|
<a name="L134"></a><tt class="py-lineno">134</tt> <tt class="py-line"> <tt class="py-comment">#cache the negative answer</tt> </tt>
|
|
<a name="L135"></a><tt class="py-lineno">135</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L136"></a><tt class="py-lineno">136</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">"%08X"</tt> <tt class="py-op">%</tt> <tt class="py-name">address</tt> </tt>
|
|
<a name="L137"></a><tt class="py-lineno">137</tt> <tt class="py-line"> </tt>
|
|
<a name="L138"></a><tt class="py-lineno">138</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">resolvCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> </tt>
|
|
</div><a name="L139"></a><tt class="py-lineno">139</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.checkHeuristic"></a><div id="FunctionRecognition.checkHeuristic-def"><a name="L140"></a><tt class="py-lineno">140</tt> <a class="py-toggle" href="#" id="FunctionRecognition.checkHeuristic-toggle" onclick="return toggle('FunctionRecognition.checkHeuristic');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#checkHeuristic">checkHeuristic</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">reference</tt><tt class="py-op">,</tt> <tt class="py-param">refFirstCall</tt><tt class="py-op">=</tt><tt class="py-op">[</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.checkHeuristic-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.checkHeuristic-expanded"><a name="L141"></a><tt class="py-lineno">141</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L142"></a><tt class="py-lineno">142</tt> <tt class="py-line"><tt class="py-docstring"> Check a given address with a precomputed hash of a function.</tt> </tt>
|
|
<a name="L143"></a><tt class="py-lineno">143</tt> <tt class="py-line"><tt class="py-docstring"> Return a percentage of match (you can use a threasold to consider a real match)</tt> </tt>
|
|
<a name="L144"></a><tt class="py-lineno">144</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L145"></a><tt class="py-lineno">145</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L146"></a><tt class="py-lineno">146</tt> <tt class="py-line"><tt class="py-docstring"> @param address: Address of the function to compare</tt> </tt>
|
|
<a name="L147"></a><tt class="py-lineno">147</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L148"></a><tt class="py-lineno">148</tt> <tt class="py-line"><tt class="py-docstring"> @type reference: STRING</tt> </tt>
|
|
<a name="L149"></a><tt class="py-lineno">149</tt> <tt class="py-line"><tt class="py-docstring"> @param reference: base64 representation of the compressed information about the function</tt> </tt>
|
|
<a name="L150"></a><tt class="py-lineno">150</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L151"></a><tt class="py-lineno">151</tt> <tt class="py-line"><tt class="py-docstring"> @type refFirstCall: STRING</tt> </tt>
|
|
<a name="L152"></a><tt class="py-lineno">152</tt> <tt class="py-line"><tt class="py-docstring"> @param refFirstCall: the same, but following the function pointed by the first call in the first BB.</tt> </tt>
|
|
<a name="L153"></a><tt class="py-lineno">153</tt> <tt class="py-line"><tt class="py-docstring"> (OPTIONAL)</tt> </tt>
|
|
<a name="L154"></a><tt class="py-lineno">154</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L155"></a><tt class="py-lineno">155</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: INTEGER</tt> </tt>
|
|
<a name="L156"></a><tt class="py-lineno">156</tt> <tt class="py-line"><tt class="py-docstring"> @return: heuristic threasold to consider a real function match</tt> </tt>
|
|
<a name="L157"></a><tt class="py-lineno">157</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L158"></a><tt class="py-lineno">158</tt> <tt class="py-line"> </tt>
|
|
<a name="L159"></a><tt class="py-lineno">159</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("checking heuristically: %08X" % address)</tt> </tt>
|
|
<a name="L160"></a><tt class="py-lineno">160</tt> <tt class="py-line"><tt class="py-comment"></tt> </tt>
|
|
<a name="L161"></a><tt class="py-lineno">161</tt> <tt class="py-line"> <tt class="py-comment">#do the hard work just one time</tt> </tt>
|
|
<a name="L162"></a><tt class="py-lineno">162</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicCache</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L163"></a><tt class="py-lineno">163</tt> <tt class="py-line"> <tt class="py-name">cfg</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L164"></a><tt class="py-lineno">164</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L165"></a><tt class="py-lineno">165</tt> <tt class="py-line"> <tt class="py-name">cfg</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-13" class="py-name" targets="Method Libs.immlib.Debugger.makeFunctionHashHeuristic()=Libs.immlib.Debugger-class.html#makeFunctionHashHeuristic,Method Libs.librecognition.FunctionRecognition.makeFunctionHashHeuristic()=Libs.librecognition.FunctionRecognition-class.html#makeFunctionHashHeuristic"><a title="Libs.immlib.Debugger.makeFunctionHashHeuristic
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashHeuristic" class="py-name" href="#" onclick="return doclink('link-13', 'makeFunctionHashHeuristic', 'link-13');">makeFunctionHashHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L166"></a><tt class="py-lineno">166</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicCache</tt><tt class="py-op">[</tt><tt class="py-name">address</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">cfg</tt> </tt>
|
|
<a name="L167"></a><tt class="py-lineno">167</tt> <tt class="py-line"> </tt>
|
|
<a name="L168"></a><tt class="py-lineno">168</tt> <tt class="py-line"> <tt class="py-comment">#check reference against our cache</tt> </tt>
|
|
<a name="L169"></a><tt class="py-lineno">169</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">sha1</tt> <tt class="py-op">=</tt> <tt class="py-name">hashlib</tt><tt class="py-op">.</tt><tt class="py-name">sha1</tt><tt class="py-op">(</tt><tt class="py-name">reference</tt><tt class="py-op">+</tt><tt class="py-name">refFirstCall</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">digest</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L170"></a><tt class="py-lineno">170</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicReferencesCache</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">sha1</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L171"></a><tt class="py-lineno">171</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicReferencesCache</tt><tt class="py-op">[</tt><tt class="py-name">sha1</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L172"></a><tt class="py-lineno">172</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L173"></a><tt class="py-lineno">173</tt> <tt class="py-line"> <tt class="py-comment">#This's the reference hash to compare with (uncompress just once and cache the results)</tt> </tt>
|
|
<a name="L174"></a><tt class="py-lineno">174</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#Decode each BB-hash</tt> </tt>
|
|
<a name="L175"></a><tt class="py-lineno">175</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">refcfg</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L176"></a><tt class="py-lineno">176</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt><tt class="py-op">.</tt><tt id="link-14" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-14', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-op">[</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L177"></a><tt class="py-lineno">177</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt><tt class="py-op">.</tt><tt id="link-15" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-15', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-op">[</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L178"></a><tt class="py-lineno">178</tt> <tt class="py-line"> <tt class="py-name">data</tt> <tt class="py-op">=</tt> <tt class="py-name">binascii</tt><tt class="py-op">.</tt><tt class="py-name">a2b_base64</tt><tt class="py-op">(</tt><tt class="py-name">reference</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L179"></a><tt class="py-lineno">179</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">o</tt> <tt class="py-keyword">in</tt> <tt class="py-name">range</tt><tt class="py-op">(</tt><tt class="py-number">0</tt><tt class="py-op">,</tt><tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">data</tt><tt class="py-op">)</tt><tt class="py-op">,</tt><tt class="py-number">12</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L180"></a><tt class="py-lineno">180</tt> <tt class="py-line"> <tt class="py-op">(</tt><tt class="py-name">start</tt><tt class="py-op">,</tt> <tt class="py-name">left</tt><tt class="py-op">,</tt> <tt class="py-name">right</tt><tt class="py-op">)</tt> <tt class="py-op">=</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">unpack</tt><tt class="py-op">(</tt><tt class="py-string">"LLL"</tt><tt class="py-op">,</tt><tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-name">o</tt><tt class="py-op">:</tt><tt class="py-name">o</tt><tt class="py-op">+</tt><tt class="py-number">12</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L181"></a><tt class="py-lineno">181</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt id="link-16" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-16', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-op">[</tt> <tt class="py-name">start</tt><tt class="py-op">,</tt> <tt class="py-name">left</tt><tt class="py-op">,</tt> <tt class="py-name">right</tt> <tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L182"></a><tt class="py-lineno">182</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">refFirstCall</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L183"></a><tt class="py-lineno">183</tt> <tt class="py-line"> <tt class="py-name">data</tt> <tt class="py-op">=</tt> <tt class="py-name">binascii</tt><tt class="py-op">.</tt><tt class="py-name">a2b_base64</tt><tt class="py-op">(</tt><tt class="py-name">refFirstCall</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L184"></a><tt class="py-lineno">184</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">o</tt> <tt class="py-keyword">in</tt> <tt class="py-name">range</tt><tt class="py-op">(</tt><tt class="py-number">0</tt><tt class="py-op">,</tt><tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">data</tt><tt class="py-op">)</tt><tt class="py-op">,</tt><tt class="py-number">12</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L185"></a><tt class="py-lineno">185</tt> <tt class="py-line"> <tt class="py-op">(</tt><tt class="py-name">start</tt><tt class="py-op">,</tt> <tt class="py-name">left</tt><tt class="py-op">,</tt> <tt class="py-name">right</tt><tt class="py-op">)</tt> <tt class="py-op">=</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">unpack</tt><tt class="py-op">(</tt><tt class="py-string">"LLL"</tt><tt class="py-op">,</tt><tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-name">o</tt><tt class="py-op">:</tt><tt class="py-name">o</tt><tt class="py-op">+</tt><tt class="py-number">12</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L186"></a><tt class="py-lineno">186</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt id="link-17" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-17', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-op">[</tt> <tt class="py-name">start</tt><tt class="py-op">,</tt> <tt class="py-name">left</tt><tt class="py-op">,</tt> <tt class="py-name">right</tt> <tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L187"></a><tt class="py-lineno">187</tt> <tt class="py-line"> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">heuristicReferencesCache</tt><tt class="py-op">[</tt><tt class="py-name">sha1</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">refcfg</tt> </tt>
|
|
<a name="L188"></a><tt class="py-lineno">188</tt> <tt class="py-line"> </tt>
|
|
<a name="L189"></a><tt class="py-lineno">189</tt> <tt class="py-line"> <tt class="py-name">perc1</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-18" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.compareHeuristic()=Libs.librecognition.FunctionRecognition-class.html#compareHeuristic"><a title="Libs.librecognition.FunctionRecognition.compareHeuristic" class="py-name" href="#" onclick="return doclink('link-18', 'compareHeuristic', 'link-18');">compareHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">cfg</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">refcfg</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L190"></a><tt class="py-lineno">190</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">cfg</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-keyword">or</tt> <tt class="py-name">refcfg</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L191"></a><tt class="py-lineno">191</tt> <tt class="py-line"> <tt class="py-name">perc2</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-19" class="py-name"><a title="Libs.librecognition.FunctionRecognition.compareHeuristic" class="py-name" href="#" onclick="return doclink('link-19', 'compareHeuristic', 'link-18');">compareHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">cfg</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">refcfg</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L192"></a><tt class="py-lineno">192</tt> <tt class="py-line"> <tt class="py-comment">#use the average</tt> </tt>
|
|
<a name="L193"></a><tt class="py-lineno">193</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">perc</tt> <tt class="py-op">=</tt> <tt class="py-op">(</tt><tt class="py-name">perc1</tt> <tt class="py-op">+</tt> <tt class="py-name">perc2</tt><tt class="py-op">)</tt> <tt class="py-op">/</tt> <tt class="py-number">2</tt> </tt>
|
|
<a name="L194"></a><tt class="py-lineno">194</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L195"></a><tt class="py-lineno">195</tt> <tt class="py-line"> <tt class="py-name">perc</tt> <tt class="py-op">=</tt> <tt class="py-name">perc1</tt> </tt>
|
|
<a name="L196"></a><tt class="py-lineno">196</tt> <tt class="py-line"> </tt>
|
|
<a name="L197"></a><tt class="py-lineno">197</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">perc</tt> </tt>
|
|
</div><a name="L198"></a><tt class="py-lineno">198</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.compareHeuristic"></a><div id="FunctionRecognition.compareHeuristic-def"><a name="L199"></a><tt class="py-lineno">199</tt> <a class="py-toggle" href="#" id="FunctionRecognition.compareHeuristic-toggle" onclick="return toggle('FunctionRecognition.compareHeuristic');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#compareHeuristic">compareHeuristic</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">cfg</tt><tt class="py-op">,</tt> <tt class="py-param">refcfg</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.compareHeuristic-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.compareHeuristic-expanded"><a name="L200"></a><tt class="py-lineno">200</tt> <tt class="py-line"> <tt class="py-comment">#for tmp in cfg:</tt> </tt>
|
|
<a name="L201"></a><tt class="py-lineno">201</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#self.imm.Log("check start: %08X - left: %08X - right: %08X" % (tmp[0],tmp[1],tmp[2]))</tt> </tt>
|
|
<a name="L202"></a><tt class="py-lineno">202</tt> <tt class="py-line"><tt class="py-comment"></tt> </tt>
|
|
<a name="L203"></a><tt class="py-lineno">203</tt> <tt class="py-line"> <tt class="py-comment">#for tmp in refcfg:</tt> </tt>
|
|
<a name="L204"></a><tt class="py-lineno">204</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#self.imm.Log("ref start: %08X - left: %08X - right: %08X" % (tmp[0],tmp[1],tmp[2]))</tt> </tt>
|
|
<a name="L205"></a><tt class="py-lineno">205</tt> <tt class="py-line"><tt class="py-comment"></tt> </tt>
|
|
<a name="L206"></a><tt class="py-lineno">206</tt> <tt class="py-line"> <tt class="py-name">diff</tt> <tt class="py-op">=</tt> <tt class="py-name">eq</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L207"></a><tt class="py-lineno">207</tt> <tt class="py-line"> <tt class="py-name">checked</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L208"></a><tt class="py-lineno">208</tt> <tt class="py-line"> <tt class="py-comment">#Compare each BB-hash</tt> </tt>
|
|
<a name="L209"></a><tt class="py-lineno">209</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">info</tt> <tt class="py-keyword">in</tt> <tt class="py-name">cfg</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L210"></a><tt class="py-lineno">210</tt> <tt class="py-line"> <tt class="py-name">bbeq</tt> <tt class="py-op">=</tt> <tt class="py-name">value</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L211"></a><tt class="py-lineno">211</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">rinfo</tt> <tt class="py-keyword">in</tt> <tt class="py-name">refcfg</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L212"></a><tt class="py-lineno">212</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L213"></a><tt class="py-lineno">213</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L214"></a><tt class="py-lineno">214</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L215"></a><tt class="py-lineno">215</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L216"></a><tt class="py-lineno">216</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt> <tt class="py-op">></tt> <tt class="py-name">bbeq</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L217"></a><tt class="py-lineno">217</tt> <tt class="py-line"> <tt class="py-name">bbeq</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt> </tt>
|
|
<a name="L218"></a><tt class="py-lineno">218</tt> <tt class="py-line"> <tt class="py-name">value</tt> <tt class="py-op">=</tt> <tt class="py-name">rinfo</tt> </tt>
|
|
<a name="L219"></a><tt class="py-lineno">219</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">bbeq</tt> <tt class="py-op">==</tt> <tt class="py-number">3</tt><tt class="py-op">:</tt> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L220"></a><tt class="py-lineno">220</tt> <tt class="py-line"> <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L221"></a><tt class="py-lineno">221</tt> <tt class="py-line"> <tt class="py-name">idx</tt><tt class="py-op">=</tt><tt class="py-name">refcfg</tt><tt class="py-op">.</tt><tt class="py-name">index</tt><tt class="py-op">(</tt><tt class="py-name">value</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L222"></a><tt class="py-lineno">222</tt> <tt class="py-line"> <tt class="py-name">refcfg</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-name">idx</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L223"></a><tt class="py-lineno">223</tt> <tt class="py-line"> <tt class="py-keyword">except</tt> <tt class="py-name">ValueError</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L224"></a><tt class="py-lineno">224</tt> <tt class="py-line"> <tt class="py-keyword">pass</tt> </tt>
|
|
<a name="L225"></a><tt class="py-lineno">225</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("value %s not found in refcfg" % value)</tt> </tt>
|
|
<a name="L226"></a><tt class="py-lineno">226</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">eq</tt> <tt class="py-op">+=</tt> <tt class="py-name">bbeq</tt> </tt>
|
|
<a name="L227"></a><tt class="py-lineno">227</tt> <tt class="py-line"> <tt class="py-name">diff</tt> <tt class="py-op">+=</tt> <tt class="py-number">3</tt> <tt class="py-op">-</tt> <tt class="py-name">bbeq</tt> </tt>
|
|
<a name="L228"></a><tt class="py-lineno">228</tt> <tt class="py-line"> </tt>
|
|
<a name="L229"></a><tt class="py-lineno">229</tt> <tt class="py-line"> <tt class="py-comment">#crossed check</tt> </tt>
|
|
<a name="L230"></a><tt class="py-lineno">230</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">rinfo</tt> <tt class="py-keyword">in</tt> <tt class="py-name">refcfg</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L231"></a><tt class="py-lineno">231</tt> <tt class="py-line"> <tt class="py-name">bbeq</tt> <tt class="py-op">=</tt> <tt class="py-name">value</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L232"></a><tt class="py-lineno">232</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">info</tt> <tt class="py-keyword">in</tt> <tt class="py-name">cfg</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L233"></a><tt class="py-lineno">233</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L234"></a><tt class="py-lineno">234</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L235"></a><tt class="py-lineno">235</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L236"></a><tt class="py-lineno">236</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt class="py-name">rinfo</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> <tt class="py-name">tmp</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L237"></a><tt class="py-lineno">237</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt> <tt class="py-op">></tt> <tt class="py-name">bbeq</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L238"></a><tt class="py-lineno">238</tt> <tt class="py-line"> <tt class="py-name">bbeq</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt> </tt>
|
|
<a name="L239"></a><tt class="py-lineno">239</tt> <tt class="py-line"> <tt class="py-name">value</tt> <tt class="py-op">=</tt> <tt class="py-name">rinfo</tt> </tt>
|
|
<a name="L240"></a><tt class="py-lineno">240</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">bbeq</tt> <tt class="py-op">==</tt> <tt class="py-number">3</tt><tt class="py-op">:</tt> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L241"></a><tt class="py-lineno">241</tt> <tt class="py-line"> <tt class="py-keyword">try</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L242"></a><tt class="py-lineno">242</tt> <tt class="py-line"> <tt class="py-name">idx</tt><tt class="py-op">=</tt><tt class="py-name">cfg</tt><tt class="py-op">.</tt><tt class="py-name">index</tt><tt class="py-op">(</tt><tt class="py-name">value</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L243"></a><tt class="py-lineno">243</tt> <tt class="py-line"> <tt class="py-name">cfg</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-name">idx</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L244"></a><tt class="py-lineno">244</tt> <tt class="py-line"> <tt class="py-keyword">except</tt> <tt class="py-name">ValueError</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L245"></a><tt class="py-lineno">245</tt> <tt class="py-line"> <tt class="py-keyword">pass</tt> </tt>
|
|
<a name="L246"></a><tt class="py-lineno">246</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("value %s not found in cfg" % value)</tt> </tt>
|
|
<a name="L247"></a><tt class="py-lineno">247</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">eq</tt> <tt class="py-op">+=</tt> <tt class="py-name">bbeq</tt> </tt>
|
|
<a name="L248"></a><tt class="py-lineno">248</tt> <tt class="py-line"> <tt class="py-name">diff</tt> <tt class="py-op">+=</tt> <tt class="py-number">3</tt> <tt class="py-op">-</tt> <tt class="py-name">bbeq</tt> </tt>
|
|
<a name="L249"></a><tt class="py-lineno">249</tt> <tt class="py-line"> </tt>
|
|
<a name="L250"></a><tt class="py-lineno">250</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("eq=%d, diff=%d" % (eq,diff))</tt> </tt>
|
|
<a name="L251"></a><tt class="py-lineno">251</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">return</tt> <tt class="py-name">eq</tt> <tt class="py-op">*</tt> <tt class="py-number">100</tt> <tt class="py-op">/</tt> <tt class="py-op">(</tt><tt class="py-name">eq</tt> <tt class="py-op">+</tt> <tt class="py-name">diff</tt><tt class="py-op">)</tt> </tt>
|
|
</div><a name="L252"></a><tt class="py-lineno">252</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.makeFunctionHashHeuristic"></a><div id="FunctionRecognition.makeFunctionHashHeuristic-def"><a name="L253"></a><tt class="py-lineno">253</tt> <a class="py-toggle" href="#" id="FunctionRecognition.makeFunctionHashHeuristic-toggle" onclick="return toggle('FunctionRecognition.makeFunctionHashHeuristic');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#makeFunctionHashHeuristic">makeFunctionHashHeuristic</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">compressed</tt> <tt class="py-op">=</tt> <tt class="py-name">False</tt><tt class="py-op">,</tt> <tt class="py-param">followCalls</tt> <tt class="py-op">=</tt> <tt class="py-name">True</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.makeFunctionHashHeuristic-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.makeFunctionHashHeuristic-expanded"><a name="L254"></a><tt class="py-lineno">254</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L255"></a><tt class="py-lineno">255</tt> <tt class="py-line"><tt class="py-docstring"> Consider:</tt> </tt>
|
|
<a name="L256"></a><tt class="py-lineno">256</tt> <tt class="py-line"><tt class="py-docstring"> - Control Flow Graph</tt> </tt>
|
|
<a name="L257"></a><tt class="py-lineno">257</tt> <tt class="py-line"><tt class="py-docstring"> - generalized instructions that:</tt> </tt>
|
|
<a name="L258"></a><tt class="py-lineno">258</tt> <tt class="py-line"><tt class="py-docstring"> access memory/write memory/use registers/use constant/call/jmp/jmc</tt> </tt>
|
|
<a name="L259"></a><tt class="py-lineno">259</tt> <tt class="py-line"><tt class="py-docstring"> and all his combinations.</tt> </tt>
|
|
<a name="L260"></a><tt class="py-lineno">260</tt> <tt class="py-line"><tt class="py-docstring"> - special case of functions with just 1 BB and a couple of calls (follow the first call)</tt> </tt>
|
|
<a name="L261"></a><tt class="py-lineno">261</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L262"></a><tt class="py-lineno">262</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L263"></a><tt class="py-lineno">263</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address of the function to hash</tt> </tt>
|
|
<a name="L264"></a><tt class="py-lineno">264</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L265"></a><tt class="py-lineno">265</tt> <tt class="py-line"><tt class="py-docstring"> @type compressed: Boolean</tt> </tt>
|
|
<a name="L266"></a><tt class="py-lineno">266</tt> <tt class="py-line"><tt class="py-docstring"> @param compressed: return a compressed base64 representation or the raw data</tt> </tt>
|
|
<a name="L267"></a><tt class="py-lineno">267</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L268"></a><tt class="py-lineno">268</tt> <tt class="py-line"><tt class="py-docstring"> @type followCalls: Boolean</tt> </tt>
|
|
<a name="L269"></a><tt class="py-lineno">269</tt> <tt class="py-line"><tt class="py-docstring"> @param followCalls: follow the first call in a single basic block function</tt> </tt>
|
|
<a name="L270"></a><tt class="py-lineno">270</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L271"></a><tt class="py-lineno">271</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L272"></a><tt class="py-lineno">272</tt> <tt class="py-line"><tt class="py-docstring"> @return: the first element is described below and the second is the result of this same function but over the first</tt> </tt>
|
|
<a name="L273"></a><tt class="py-lineno">273</tt> <tt class="py-line"><tt class="py-docstring"> call of a single basic block function (if applies), each element is like this:</tt> </tt>
|
|
<a name="L274"></a><tt class="py-lineno">274</tt> <tt class="py-line"><tt class="py-docstring"> a base64 representation of the compressed version of each bb hash:</tt> </tt>
|
|
<a name="L275"></a><tt class="py-lineno">275</tt> <tt class="py-line"><tt class="py-docstring"> [4 bytes BB(i) start][4 bytes BB(i) 1st edge][4 bytes BB(i) 2nd edge]</tt> </tt>
|
|
<a name="L276"></a><tt class="py-lineno">276</tt> <tt class="py-line"><tt class="py-docstring"> 0 <= i < BB count</tt> </tt>
|
|
<a name="L277"></a><tt class="py-lineno">277</tt> <tt class="py-line"><tt class="py-docstring"> or the same but like a LIST with raw data.</tt> </tt>
|
|
<a name="L278"></a><tt class="py-lineno">278</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L279"></a><tt class="py-lineno">279</tt> <tt class="py-line"> </tt>
|
|
<a name="L280"></a><tt class="py-lineno">280</tt> <tt class="py-line"> <tt class="py-name">f</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-20" class="py-name" targets="Method Libs.immlib.Debugger.getFunction()=Libs.immlib.Debugger-class.html#getFunction,Method Libs.libanalyze.BasicBlock.getFunction()=Libs.libanalyze.BasicBlock-class.html#getFunction"><a title="Libs.immlib.Debugger.getFunction
|
|
Libs.libanalyze.BasicBlock.getFunction" class="py-name" href="#" onclick="return doclink('link-20', 'getFunction', 'link-20');">getFunction</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L281"></a><tt class="py-lineno">281</tt> <tt class="py-line"> <tt class="py-name">bbs</tt> <tt class="py-op">=</tt> <tt class="py-name">f</tt><tt class="py-op">.</tt><tt id="link-21" class="py-name" targets="Method Libs.libanalyze.Function.getBasicBlocks()=Libs.libanalyze.Function-class.html#getBasicBlocks"><a title="Libs.libanalyze.Function.getBasicBlocks" class="py-name" href="#" onclick="return doclink('link-21', 'getBasicBlocks', 'link-21');">getBasicBlocks</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L282"></a><tt class="py-lineno">282</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L283"></a><tt class="py-lineno">283</tt> <tt class="py-line"> <tt class="py-name">cfg</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L284"></a><tt class="py-lineno">284</tt> <tt class="py-line"> </tt>
|
|
<a name="L285"></a><tt class="py-lineno">285</tt> <tt class="py-line"> <tt class="py-comment">#Make a control flow graph</tt> </tt>
|
|
<a name="L286"></a><tt class="py-lineno">286</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">bb</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bbs</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L287"></a><tt class="py-lineno">287</tt> <tt class="py-line"> <tt class="py-name">cfg</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-22" class="py-name" targets="Method Libs.libanalyze.BasicBlock.getStart()=Libs.libanalyze.BasicBlock-class.html#getStart,Method Libs.libanalyze.Function.getStart()=Libs.libanalyze.Function-class.html#getStart"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-22', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-23" class="py-name" targets="Method Libs.graphclass.Graph.getEdges()=Libs.graphclass.Graph-class.html#getEdges,Method Libs.libanalyze.BasicBlock.getEdges()=Libs.libanalyze.BasicBlock-class.html#getEdges"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-23', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L288"></a><tt class="py-lineno">288</tt> <tt class="py-line"> </tt>
|
|
<a name="L289"></a><tt class="py-lineno">289</tt> <tt class="py-line"> <tt class="py-comment">#Make a hash of each BB</tt> </tt>
|
|
<a name="L290"></a><tt class="py-lineno">290</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">bb</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bbs</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L291"></a><tt class="py-lineno">291</tt> <tt class="py-line"> <tt class="py-name">bbhash_data</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L292"></a><tt class="py-lineno">292</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">op</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-24" class="py-name" targets="Method Libs.libanalyze.BasicBlock.getInstructions()=Libs.libanalyze.BasicBlock-class.html#getInstructions"><a title="Libs.libanalyze.BasicBlock.getInstructions" class="py-name" href="#" onclick="return doclink('link-24', 'getInstructions', 'link-24');">getInstructions</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L293"></a><tt class="py-lineno">293</tt> <tt class="py-line"> <tt class="py-comment">#take into account just information about the opcode</tt> </tt>
|
|
<a name="L294"></a><tt class="py-lineno">294</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">instr</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L295"></a><tt class="py-lineno">295</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-25" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-25', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-26" class="py-name" targets="Method Libs.libanalyze.opCode.getMemType()=Libs.libanalyze.opCode-class.html#getMemType"><a title="Libs.libanalyze.opCode.getMemType" class="py-name" href="#" onclick="return doclink('link-26', 'getMemType', 'link-26');">getMemType</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L296"></a><tt class="py-lineno">296</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-27" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-27', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">indexed</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L297"></a><tt class="py-lineno">297</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-28" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-28', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-29" class="py-name" targets="Method Libs.libanalyze.opCode.getCmdType()=Libs.libanalyze.opCode-class.html#getCmdType"><a title="Libs.libanalyze.opCode.getCmdType" class="py-name" href="#" onclick="return doclink('link-29', 'getCmdType', 'link-29');">getCmdType</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L298"></a><tt class="py-lineno">298</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-30" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-30', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">optype</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L299"></a><tt class="py-lineno">299</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-31" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-31', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">optype</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L300"></a><tt class="py-lineno">300</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-32" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-32', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">optype</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L301"></a><tt class="py-lineno">301</tt> <tt class="py-line"> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt id="link-33" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-33', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-34" class="py-name" targets="Method Libs.debugtypes.MemoryPage.getSize()=Libs.debugtypes.MemoryPage-class.html#getSize,Method Libs.debugtypes.Module.getSize()=Libs.debugtypes.Module-class.html#getSize,Method Libs.libanalyze.BasicBlock.getSize()=Libs.libanalyze.BasicBlock-class.html#getSize,Method Libs.libanalyze.opCode.getSize()=Libs.libanalyze.opCode-class.html#getSize,Method Libs.libdatatype.Data.getSize()=Libs.libdatatype.Data-class.html#getSize,Method Libs.libheap.PLook.getSize()=Libs.libheap.PLook-class.html#getSize,Method Libs.libheap.UserData.getSize()=Libs.libheap.UserData-class.html#getSize,Method Libs.pelib.Directory.getSize()=Libs.pelib.Directory-class.html#getSize,Method Libs.pelib.IMGOPThdr.getSize()=Libs.pelib.IMGOPThdr-class.html#getSize,Method Libs.pelib.IMGhdr.getSize()=Libs.pelib.IMGhdr-class.html#getSize,Method Libs.pelib.ImageExportDirectory.getSize()=Libs.pelib.ImageExportDirectory-class.html#getSize,Method Libs.pelib.ImageImportByName.getSize()=Libs.pelib.ImageImportByName-class.html#getSize,Method Libs.pelib.ImportDescriptor.getSize()=Libs.pelib.ImportDescriptor-class.html#getSize,Method Libs.pelib.MZ.getSize()=Libs.pelib.MZ-class.html#getSize,Method Libs.pelib.Section.getSize()=Libs.pelib.Section-class.html#getSize"><a title="Libs.debugtypes.MemoryPage.getSize
|
|
Libs.debugtypes.Module.getSize
|
|
Libs.libanalyze.BasicBlock.getSize
|
|
Libs.libanalyze.opCode.getSize
|
|
Libs.libdatatype.Data.getSize
|
|
Libs.libheap.PLook.getSize
|
|
Libs.libheap.UserData.getSize
|
|
Libs.pelib.Directory.getSize
|
|
Libs.pelib.IMGOPThdr.getSize
|
|
Libs.pelib.IMGhdr.getSize
|
|
Libs.pelib.ImageExportDirectory.getSize
|
|
Libs.pelib.ImageImportByName.getSize
|
|
Libs.pelib.ImportDescriptor.getSize
|
|
Libs.pelib.MZ.getSize
|
|
Libs.pelib.Section.getSize" class="py-name" href="#" onclick="return doclink('link-34', 'getSize', 'link-34');">getSize</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L302"></a><tt class="py-lineno">302</tt> <tt class="py-line"> <tt class="py-name">bbhash_data</tt><tt class="py-op">.</tt><tt id="link-35" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-35', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-36" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.hash_a_list()=Libs.librecognition.FunctionRecognition-class.html#hash_a_list"><a title="Libs.librecognition.FunctionRecognition.hash_a_list" class="py-name" href="#" onclick="return doclink('link-36', 'hash_a_list', 'link-36');">hash_a_list</a></tt><tt class="py-op">(</tt><tt class="py-name">instr</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L303"></a><tt class="py-lineno">303</tt> <tt class="py-line"> <tt class="py-name">bbhash</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-37" class="py-name"><a title="Libs.librecognition.FunctionRecognition.hash_a_list" class="py-name" href="#" onclick="return doclink('link-37', 'hash_a_list', 'link-36');">hash_a_list</a></tt><tt class="py-op">(</tt><tt class="py-name">bbhash_data</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L304"></a><tt class="py-lineno">304</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-38" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-38', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbhash</tt> </tt>
|
|
<a name="L305"></a><tt class="py-lineno">305</tt> <tt class="py-line"> </tt>
|
|
<a name="L306"></a><tt class="py-lineno">306</tt> <tt class="py-line"> <tt class="py-comment">#Replace BB addresses with hashes</tt> </tt>
|
|
<a name="L307"></a><tt class="py-lineno">307</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">rcfg</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L308"></a><tt class="py-lineno">308</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">start</tt><tt class="py-op">,</tt><tt class="py-name">edges</tt> <tt class="py-keyword">in</tt> <tt class="py-name">cfg</tt><tt class="py-op">.</tt><tt class="py-name">iteritems</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L309"></a><tt class="py-lineno">309</tt> <tt class="py-line"> <tt class="py-name">rstart</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L310"></a><tt class="py-lineno">310</tt> <tt class="py-line"> <tt class="py-name">redges</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">,</tt> <tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L311"></a><tt class="py-lineno">311</tt> <tt class="py-line"> <tt class="py-name">rstart</tt> <tt class="py-op">=</tt> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">start</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L312"></a><tt class="py-lineno">312</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">bbmap</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">edges</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L313"></a><tt class="py-lineno">313</tt> <tt class="py-line"> <tt class="py-name">redges</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">edges</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L314"></a><tt class="py-lineno">314</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">bbmap</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">edges</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L315"></a><tt class="py-lineno">315</tt> <tt class="py-line"> <tt class="py-name">redges</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">edges</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L316"></a><tt class="py-lineno">316</tt> <tt class="py-line"> <tt class="py-name">rcfg</tt><tt class="py-op">.</tt><tt id="link-39" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-39', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-op">[</tt> <tt class="py-name">rstart</tt><tt class="py-op">,</tt><tt class="py-name">redges</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">,</tt><tt class="py-name">redges</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L317"></a><tt class="py-lineno">317</tt> <tt class="py-line"> </tt>
|
|
<a name="L318"></a><tt class="py-lineno">318</tt> <tt class="py-line"> <tt class="py-comment">#special case for functions with just one basic block and one or more calls</tt> </tt>
|
|
<a name="L319"></a><tt class="py-lineno">319</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">firstcall</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L320"></a><tt class="py-lineno">320</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">followCalls</tt> <tt class="py-keyword">and</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">bbs</tt><tt class="py-op">)</tt> <tt class="py-op">==</tt> <tt class="py-number">1</tt> <tt class="py-keyword">and</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">bbs</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt id="link-40" class="py-name" targets="Method Libs.libanalyze.BasicBlock.getCalls()=Libs.libanalyze.BasicBlock-class.html#getCalls"><a title="Libs.libanalyze.BasicBlock.getCalls" class="py-name" href="#" onclick="return doclink('link-40', 'getCalls', 'link-40');">getCalls</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> <tt class="py-op">></tt> <tt class="py-number">0</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L321"></a><tt class="py-lineno">321</tt> <tt class="py-line"> <tt class="py-comment">#we follow the first call and do the same work there, but avoiding recursion</tt> </tt>
|
|
<a name="L322"></a><tt class="py-lineno">322</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#XXX: why the first?</tt> </tt>
|
|
<a name="L323"></a><tt class="py-lineno">323</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">op</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-41" class="py-name" targets="Method Libs.immlib.Debugger.Disasm()=Libs.immlib.Debugger-class.html#Disasm"><a title="Libs.immlib.Debugger.Disasm" class="py-name" href="#" onclick="return doclink('link-41', 'Disasm', 'link-41');">Disasm</a></tt><tt class="py-op">(</tt><tt class="py-name">bbs</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt id="link-42" class="py-name"><a title="Libs.libanalyze.BasicBlock.getCalls" class="py-name" href="#" onclick="return doclink('link-42', 'getCalls', 'link-40');">getCalls</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L324"></a><tt class="py-lineno">324</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-43" class="py-name" targets="Method Libs.libanalyze.opCode.getJmpConst()=Libs.libanalyze.opCode-class.html#getJmpConst"><a title="Libs.libanalyze.opCode.getJmpConst" class="py-name" href="#" onclick="return doclink('link-43', 'getJmpConst', 'link-43');">getJmpConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L325"></a><tt class="py-lineno">325</tt> <tt class="py-line"> <tt class="py-name">firstcall</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-44" class="py-name"><a title="Libs.immlib.Debugger.makeFunctionHashHeuristic
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashHeuristic" class="py-name" href="#" onclick="return doclink('link-44', 'makeFunctionHashHeuristic', 'link-13');">makeFunctionHashHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-45" class="py-name"><a title="Libs.libanalyze.opCode.getJmpConst" class="py-name" href="#" onclick="return doclink('link-45', 'getJmpConst', 'link-43');">getJmpConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">compressed</tt><tt class="py-op">,</tt> <tt class="py-name">followCalls</tt><tt class="py-op">=</tt><tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L326"></a><tt class="py-lineno">326</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("following first call to: %08X" % op.getJmpConst())</tt> </tt>
|
|
<a name="L327"></a><tt class="py-lineno">327</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">del</tt> <tt class="py-name">op</tt> </tt>
|
|
<a name="L328"></a><tt class="py-lineno">328</tt> <tt class="py-line"> </tt>
|
|
<a name="L329"></a><tt class="py-lineno">329</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">bbs</tt> </tt>
|
|
<a name="L330"></a><tt class="py-lineno">330</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">f</tt> </tt>
|
|
<a name="L331"></a><tt class="py-lineno">331</tt> <tt class="py-line"> <tt class="py-name">rcfg</tt><tt class="py-op">.</tt><tt class="py-name">sort</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L332"></a><tt class="py-lineno">332</tt> <tt class="py-line"> </tt>
|
|
<a name="L333"></a><tt class="py-lineno">333</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">compressed</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L334"></a><tt class="py-lineno">334</tt> <tt class="py-line"> <tt class="py-comment">#make the final hash</tt> </tt>
|
|
<a name="L335"></a><tt class="py-lineno">335</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">fhash</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> </tt>
|
|
<a name="L336"></a><tt class="py-lineno">336</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">data</tt> <tt class="py-keyword">in</tt> <tt class="py-name">rcfg</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L337"></a><tt class="py-lineno">337</tt> <tt class="py-line"> <tt class="py-comment">#[4 bytes BB(i) start][4 bytes BB(i) 1st edge][4 bytes BB(i) 2nd edge]</tt> </tt>
|
|
<a name="L338"></a><tt class="py-lineno">338</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">fhash</tt> <tt class="py-op">+=</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">pack</tt><tt class="py-op">(</tt><tt class="py-string">"LLL"</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L339"></a><tt class="py-lineno">339</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-op">[</tt> <tt class="py-name">binascii</tt><tt class="py-op">.</tt><tt class="py-name">b2a_base64</tt><tt class="py-op">(</tt><tt class="py-name">fhash</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">-</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">firstcall</tt> <tt class="py-op">]</tt> </tt>
|
|
<a name="L340"></a><tt class="py-lineno">340</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L341"></a><tt class="py-lineno">341</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-op">[</tt> <tt class="py-name">rcfg</tt><tt class="py-op">,</tt> <tt class="py-name">firstcall</tt> <tt class="py-op">]</tt> </tt>
|
|
</div><a name="L342"></a><tt class="py-lineno">342</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.hash_a_list"></a><div id="FunctionRecognition.hash_a_list-def"><a name="L343"></a><tt class="py-lineno">343</tt> <a class="py-toggle" href="#" id="FunctionRecognition.hash_a_list-toggle" onclick="return toggle('FunctionRecognition.hash_a_list');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#hash_a_list">hash_a_list</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt><tt class="py-param">data</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.hash_a_list-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.hash_a_list-expanded"><a name="L344"></a><tt class="py-lineno">344</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L345"></a><tt class="py-lineno">345</tt> <tt class="py-line"><tt class="py-docstring"> Take a list and return a binary representation of his CRC32.</tt> </tt>
|
|
<a name="L346"></a><tt class="py-lineno">346</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L347"></a><tt class="py-lineno">347</tt> <tt class="py-line"><tt class="py-docstring"> @type data: LIST</tt> </tt>
|
|
<a name="L348"></a><tt class="py-lineno">348</tt> <tt class="py-line"><tt class="py-docstring"> @param data: a list of elements to make the hash</tt> </tt>
|
|
<a name="L349"></a><tt class="py-lineno">349</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L350"></a><tt class="py-lineno">350</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: UNSIGNED LONG</tt> </tt>
|
|
<a name="L351"></a><tt class="py-lineno">351</tt> <tt class="py-line"><tt class="py-docstring"> @return: a hash of the given values</tt> </tt>
|
|
<a name="L352"></a><tt class="py-lineno">352</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L353"></a><tt class="py-lineno">353</tt> <tt class="py-line"> </tt>
|
|
<a name="L354"></a><tt class="py-lineno">354</tt> <tt class="py-line"> <tt class="py-name">ret</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L355"></a><tt class="py-lineno">355</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">elem</tt> <tt class="py-keyword">in</tt> <tt class="py-name">data</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L356"></a><tt class="py-lineno">356</tt> <tt class="py-line"> <tt class="py-name">ret</tt> <tt class="py-op">=</tt> <tt class="py-name">binascii</tt><tt class="py-op">.</tt><tt class="py-name">crc32</tt><tt class="py-op">(</tt><tt class="py-name">str</tt><tt class="py-op">(</tt><tt class="py-name">elem</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">ret</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L357"></a><tt class="py-lineno">357</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">unpack</tt><tt class="py-op">(</tt><tt class="py-string">"L"</tt><tt class="py-op">,</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">pack</tt><tt class="py-op">(</tt><tt class="py-string">"l"</tt><tt class="py-op">,</tt><tt class="py-name">ret</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
</div><a name="L358"></a><tt class="py-lineno">358</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.searchFunctionByHeuristic"></a><div id="FunctionRecognition.searchFunctionByHeuristic-def"><a name="L359"></a><tt class="py-lineno">359</tt> <a class="py-toggle" href="#" id="FunctionRecognition.searchFunctionByHeuristic-toggle" onclick="return toggle('FunctionRecognition.searchFunctionByHeuristic');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#searchFunctionByHeuristic">searchFunctionByHeuristic</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">csvline</tt><tt class="py-op">,</tt> <tt class="py-param">heuristic</tt> <tt class="py-op">=</tt> <tt class="py-number">90</tt><tt class="py-op">,</tt> <tt class="py-param">module</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.searchFunctionByHeuristic-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.searchFunctionByHeuristic-expanded"><a name="L360"></a><tt class="py-lineno">360</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L361"></a><tt class="py-lineno">361</tt> <tt class="py-line"><tt class="py-docstring"> Search memory to find a function that fullfit the options.</tt> </tt>
|
|
<a name="L362"></a><tt class="py-lineno">362</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L363"></a><tt class="py-lineno">363</tt> <tt class="py-line"><tt class="py-docstring"> @type csvline: STRING</tt> </tt>
|
|
<a name="L364"></a><tt class="py-lineno">364</tt> <tt class="py-line"><tt class="py-docstring"> @param csvline: A line of a Data CSV file. This's a simple support for copy 'n paste from a CSV file. </tt> </tt>
|
|
<a name="L365"></a><tt class="py-lineno">365</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L366"></a><tt class="py-lineno">366</tt> <tt class="py-line"><tt class="py-docstring"> @type heuristic: INTEGER</tt> </tt>
|
|
<a name="L367"></a><tt class="py-lineno">367</tt> <tt class="py-line"><tt class="py-docstring"> @param heuristic: heuristic threasold to consider a real function match</tt> </tt>
|
|
<a name="L368"></a><tt class="py-lineno">368</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L369"></a><tt class="py-lineno">369</tt> <tt class="py-line"><tt class="py-docstring"> @type module: STRING</tt> </tt>
|
|
<a name="L370"></a><tt class="py-lineno">370</tt> <tt class="py-line"><tt class="py-docstring"> @param module: name of a module to restrict the search</tt> </tt>
|
|
<a name="L371"></a><tt class="py-lineno">371</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L372"></a><tt class="py-lineno">372</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L373"></a><tt class="py-lineno">373</tt> <tt class="py-line"><tt class="py-docstring"> @return: a list of tuples with possible function's addresses and the heauristic match percentage </tt> </tt>
|
|
<a name="L374"></a><tt class="py-lineno">374</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L375"></a><tt class="py-lineno">375</tt> <tt class="py-line"> </tt>
|
|
<a name="L376"></a><tt class="py-lineno">376</tt> <tt class="py-line"> <tt class="py-name">line</tt> <tt class="py-op">=</tt> <tt class="py-name">csv</tt><tt class="py-op">.</tt><tt class="py-name">reader</tt><tt class="py-op">(</tt><tt class="py-op">[</tt><tt class="py-name">csvline</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt id="link-46" class="py-name"><a title="Libs.librecognition.MultiCSVIterator.next" class="py-name" href="#" onclick="return doclink('link-46', 'next', 'link-5');">next</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L377"></a><tt class="py-lineno">377</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">line</tt><tt class="py-op">)</tt> <tt class="py-op"><</tt> <tt class="py-number">9</tt><tt class="py-op">:</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">7</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> <tt class="py-comment">#support for older entries</tt> </tt>
|
|
<a name="L378"></a><tt class="py-lineno">378</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-47" class="py-name" targets="Method Libs.librecognition.FunctionRecognition._searchFunctionByHeuristic()=Libs.librecognition.FunctionRecognition-class.html#_searchFunctionByHeuristic"><a title="Libs.librecognition.FunctionRecognition._searchFunctionByHeuristic" class="py-name" href="#" onclick="return doclink('link-47', '_searchFunctionByHeuristic', 'link-47');">_searchFunctionByHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">3</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">heuristic</tt><tt class="py-op">,</tt> <tt class="py-name">module</tt><tt class="py-op">,</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-name">line</tt><tt class="py-op">[</tt><tt class="py-number">7</tt><tt class="py-op">]</tt><tt class="py-op">,</tt><tt class="py-string">"|"</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
</div><a name="L379"></a><tt class="py-lineno">379</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition._searchFunctionByHeuristic"></a><div id="FunctionRecognition._searchFunctionByHeuristic-def"><a name="L380"></a><tt class="py-lineno">380</tt> <a class="py-toggle" href="#" id="FunctionRecognition._searchFunctionByHeuristic-toggle" onclick="return toggle('FunctionRecognition._searchFunctionByHeuristic');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#_searchFunctionByHeuristic">_searchFunctionByHeuristic</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">search</tt><tt class="py-op">,</tt> <tt class="py-param">functionhash</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">firstcallhash</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">exact</tt><tt class="py-op">=</tt><tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">heuristic</tt> <tt class="py-op">=</tt> <tt class="py-number">90</tt><tt class="py-op">,</tt> <tt class="py-param">module</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">firstbb</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition._searchFunctionByHeuristic-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition._searchFunctionByHeuristic-expanded"><a name="L381"></a><tt class="py-lineno">381</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L382"></a><tt class="py-lineno">382</tt> <tt class="py-line"><tt class="py-docstring"> Search memory to find a function that fullfit the options.</tt> </tt>
|
|
<a name="L383"></a><tt class="py-lineno">383</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L384"></a><tt class="py-lineno">384</tt> <tt class="py-line"><tt class="py-docstring"> @type search: STRING</tt> </tt>
|
|
<a name="L385"></a><tt class="py-lineno">385</tt> <tt class="py-line"><tt class="py-docstring"> @param search: searchCommand string to make the first selection</tt> </tt>
|
|
<a name="L386"></a><tt class="py-lineno">386</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L387"></a><tt class="py-lineno">387</tt> <tt class="py-line"><tt class="py-docstring"> @type functionhash: STRING</tt> </tt>
|
|
<a name="L388"></a><tt class="py-lineno">388</tt> <tt class="py-line"><tt class="py-docstring"> @param functionhash: the primary function hash (use makeFunctionHash to generate this value)</tt> </tt>
|
|
<a name="L389"></a><tt class="py-lineno">389</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L390"></a><tt class="py-lineno">390</tt> <tt class="py-line"><tt class="py-docstring"> @type firstcallhash: STRING</tt> </tt>
|
|
<a name="L391"></a><tt class="py-lineno">391</tt> <tt class="py-line"><tt class="py-docstring"> @param firstcallhash: the hash of the first call on single BB functions (use makeFunctionHash to generate this value)</tt> </tt>
|
|
<a name="L392"></a><tt class="py-lineno">392</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L393"></a><tt class="py-lineno">393</tt> <tt class="py-line"><tt class="py-docstring"> @type exact: STRING</tt> </tt>
|
|
<a name="L394"></a><tt class="py-lineno">394</tt> <tt class="py-line"><tt class="py-docstring"> @param exact: an exact function hash, this's a binary byte-per-byte hash (use makeFunctionHash to generate this value)</tt> </tt>
|
|
<a name="L395"></a><tt class="py-lineno">395</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L396"></a><tt class="py-lineno">396</tt> <tt class="py-line"><tt class="py-docstring"> @type heuristic: INTEGER</tt> </tt>
|
|
<a name="L397"></a><tt class="py-lineno">397</tt> <tt class="py-line"><tt class="py-docstring"> @param heuristic: heuristic threasold to consider a real function match</tt> </tt>
|
|
<a name="L398"></a><tt class="py-lineno">398</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L399"></a><tt class="py-lineno">399</tt> <tt class="py-line"><tt class="py-docstring"> @type module: STRING</tt> </tt>
|
|
<a name="L400"></a><tt class="py-lineno">400</tt> <tt class="py-line"><tt class="py-docstring"> @param module: name of a module to restrict the search</tt> </tt>
|
|
<a name="L401"></a><tt class="py-lineno">401</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L402"></a><tt class="py-lineno">402</tt> <tt class="py-line"><tt class="py-docstring"> @type firstbb: STRING</tt> </tt>
|
|
<a name="L403"></a><tt class="py-lineno">403</tt> <tt class="py-line"><tt class="py-docstring"> @param firstbb: generalized assembler of the first BB (to search function begin)</tt> </tt>
|
|
<a name="L404"></a><tt class="py-lineno">404</tt> <tt class="py-line"><tt class="py-docstring"></tt> </tt>
|
|
<a name="L405"></a><tt class="py-lineno">405</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L406"></a><tt class="py-lineno">406</tt> <tt class="py-line"><tt class="py-docstring"> @return: a list of tuples with possible function's addresses and the heauristic match percentage </tt> </tt>
|
|
<a name="L407"></a><tt class="py-lineno">407</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L408"></a><tt class="py-lineno">408</tt> <tt class="py-line"> </tt>
|
|
<a name="L409"></a><tt class="py-lineno">409</tt> <tt class="py-line"> <tt class="py-comment">#if the first argument is a LIST, decode it to each real argument of the function, following the order in the CSV file.</tt> </tt>
|
|
<a name="L410"></a><tt class="py-lineno">410</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#this give us a simple support for copy 'n paste from the CSV file.</tt> </tt>
|
|
<a name="L411"></a><tt class="py-lineno">411</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">isinstance</tt><tt class="py-op">(</tt><tt id="link-48" class="py-name" targets="Method Libs.debugtypes.MemoryPage.search()=Libs.debugtypes.MemoryPage-class.html#search"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-48', 'search', 'link-48');">search</a></tt><tt class="py-op">,</tt> <tt class="py-name">list</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L412"></a><tt class="py-lineno">412</tt> <tt class="py-line"> <tt id="link-49" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-49', 'search', 'link-48');">search</a></tt><tt class="py-op">.</tt><tt class="py-name">reverse</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L413"></a><tt class="py-lineno">413</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt id="link-50" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-50', 'search', 'link-48');">search</a></tt><tt class="py-op">[</tt><tt class="py-op">:</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L414"></a><tt class="py-lineno">414</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt id="link-51" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-51', 'search', 'link-48');">search</a></tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L415"></a><tt class="py-lineno">415</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">functionhash</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L416"></a><tt class="py-lineno">416</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">firstcallhash</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L417"></a><tt class="py-lineno">417</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">exact</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L418"></a><tt class="py-lineno">418</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">version</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L419"></a><tt class="py-lineno">419</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">file</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L420"></a><tt class="py-lineno">420</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> <tt class="py-name">firstbb</tt> <tt class="py-op">=</tt> <tt class="py-name">tmp</tt><tt class="py-op">.</tt><tt class="py-name">pop</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L421"></a><tt class="py-lineno">421</tt> <tt class="py-line"> </tt>
|
|
<a name="L422"></a><tt class="py-lineno">422</tt> <tt class="py-line"> <tt class="py-comment">#this arguments are mandatory</tt> </tt>
|
|
<a name="L423"></a><tt class="py-lineno">423</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt id="link-52" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-52', 'search', 'link-48');">search</a></tt> <tt class="py-keyword">or</tt> <tt class="py-keyword">not</tt> <tt class="py-name">functionhash</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L424"></a><tt class="py-lineno">424</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">None</tt> </tt>
|
|
<a name="L425"></a><tt class="py-lineno">425</tt> <tt class="py-line"> </tt>
|
|
<a name="L426"></a><tt class="py-lineno">426</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">firstcallhash</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L427"></a><tt class="py-lineno">427</tt> <tt class="py-line"> <tt class="py-name">firstcallhash</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> </tt>
|
|
<a name="L428"></a><tt class="py-lineno">428</tt> <tt class="py-line"> </tt>
|
|
<a name="L429"></a><tt class="py-lineno">429</tt> <tt class="py-line"> <tt class="py-name">heu_addy</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt> </tt>
|
|
<a name="L430"></a><tt class="py-lineno">430</tt> <tt class="py-line"> <tt class="py-name">heu_perc</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L431"></a><tt class="py-lineno">431</tt> <tt class="py-line"> <tt class="py-name">poss_functions</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L432"></a><tt class="py-lineno">432</tt> <tt class="py-line"> <tt class="py-name">poss_return</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L433"></a><tt class="py-lineno">433</tt> <tt class="py-line"> <tt id="link-53" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-53', 'search', 'link-48');">search</a></tt> <tt class="py-op">=</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">replace</tt><tt class="py-op">(</tt><tt id="link-54" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-54', 'search', 'link-48');">search</a></tt><tt class="py-op">,</tt> <tt class="py-string">"\\n"</tt><tt class="py-op">,</tt><tt class="py-string">"\n"</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L434"></a><tt class="py-lineno">434</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt id="link-55" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-55', 'search', 'link-48');">search</a></tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L435"></a><tt class="py-lineno">435</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">module</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L436"></a><tt class="py-lineno">436</tt> <tt class="py-line"> <tt class="py-comment">#XXX: access directly isn't the best way to do this</tt> </tt>
|
|
<a name="L437"></a><tt class="py-lineno">437</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">key</tt><tt class="py-op">,</tt><tt class="py-name">mod</tt> <tt class="py-keyword">in</tt> <tt class="py-name">debugger</tt><tt class="py-op">.</tt><tt class="py-name">Getallmodules</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">iteritems</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L438"></a><tt class="py-lineno">438</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">module</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-keyword">in</tt> <tt class="py-name">key</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L439"></a><tt class="py-lineno">439</tt> <tt class="py-line"> <tt class="py-name">poss_functions</tt> <tt class="py-op">+=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-56" class="py-name" targets="Method Libs.immlib.Debugger.searchCommandsOnModule()=Libs.immlib.Debugger-class.html#searchCommandsOnModule"><a title="Libs.immlib.Debugger.searchCommandsOnModule" class="py-name" href="#" onclick="return doclink('link-56', 'searchCommandsOnModule', 'link-56');">searchCommandsOnModule</a></tt><tt class="py-op">(</tt><tt class="py-name">mod</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt id="link-57" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-57', 'search', 'link-48');">search</a></tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L440"></a><tt class="py-lineno">440</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L441"></a><tt class="py-lineno">441</tt> <tt class="py-line"> <tt class="py-name">poss_functions</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-58" class="py-name" targets="Method Libs.immlib.Debugger.searchCommands()=Libs.immlib.Debugger-class.html#searchCommands"><a title="Libs.immlib.Debugger.searchCommands" class="py-name" href="#" onclick="return doclink('link-58', 'searchCommands', 'link-58');">searchCommands</a></tt><tt class="py-op">(</tt><tt id="link-59" class="py-name"><a title="Libs.debugtypes.MemoryPage.search" class="py-name" href="#" onclick="return doclink('link-59', 'search', 'link-48');">search</a></tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L442"></a><tt class="py-lineno">442</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">poss_functions</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L443"></a><tt class="py-lineno">443</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">poss</tt> <tt class="py-keyword">in</tt> <tt class="py-name">poss_functions</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L444"></a><tt class="py-lineno">444</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("possible funct: %08X" % poss[0])</tt> </tt>
|
|
<a name="L445"></a><tt class="py-lineno">445</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">addy</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-60" class="py-name" targets="Method Libs.immlib.Debugger.getFunctionBegin()=Libs.immlib.Debugger-class.html#getFunctionBegin"><a title="Libs.immlib.Debugger.getFunctionBegin" class="py-name" href="#" onclick="return doclink('link-60', 'getFunctionBegin', 'link-60');">getFunctionBegin</a></tt><tt class="py-op">(</tt><tt class="py-name">poss</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L446"></a><tt class="py-lineno">446</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">addy</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L447"></a><tt class="py-lineno">447</tt> <tt class="py-line"> <tt class="py-comment">#check entrypoint routine</tt> </tt>
|
|
<a name="L448"></a><tt class="py-lineno">448</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">mod</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-61" class="py-name" targets="Method Libs.immlib.Debugger.getAllModules()=Libs.immlib.Debugger-class.html#getAllModules"><a title="Libs.immlib.Debugger.getAllModules" class="py-name" href="#" onclick="return doclink('link-61', 'getAllModules', 'link-61');">getAllModules</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">values</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L449"></a><tt class="py-lineno">449</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">mod</tt><tt class="py-op">.</tt><tt id="link-62" class="py-name" targets="Method Libs.debugtypes.Module.getMainentry()=Libs.debugtypes.Module-class.html#getMainentry"><a title="Libs.debugtypes.Module.getMainentry" class="py-name" href="#" onclick="return doclink('link-62', 'getMainentry', 'link-62');">getMainentry</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L450"></a><tt class="py-lineno">450</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("mainentry: %08X" % mod.getMainentry())</tt> </tt>
|
|
<a name="L451"></a><tt class="py-lineno">451</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">f</tt> <tt class="py-op">=</tt> <tt class="py-name">StackFunction</tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">,</tt> <tt class="py-name">mod</tt><tt class="py-op">.</tt><tt id="link-63" class="py-name"><a title="Libs.debugtypes.Module.getMainentry" class="py-name" href="#" onclick="return doclink('link-63', 'getMainentry', 'link-62');">getMainentry</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L452"></a><tt class="py-lineno">452</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">f</tt><tt class="py-op">.</tt><tt class="py-name">isInsideFunction</tt><tt class="py-op">(</tt><tt class="py-name">poss</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L453"></a><tt class="py-lineno">453</tt> <tt class="py-line"> <tt class="py-name">addy</tt> <tt class="py-op">=</tt> <tt class="py-name">mod</tt><tt class="py-op">.</tt><tt id="link-64" class="py-name"><a title="Libs.debugtypes.Module.getMainentry" class="py-name" href="#" onclick="return doclink('link-64', 'getMainentry', 'link-62');">getMainentry</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L454"></a><tt class="py-lineno">454</tt> <tt class="py-line"> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L455"></a><tt class="py-lineno">455</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">addy</tt> <tt class="py-keyword">and</tt> <tt class="py-name">firstbb</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L456"></a><tt class="py-lineno">456</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("Trying with the new firstbb")</tt> </tt>
|
|
<a name="L457"></a><tt class="py-lineno">457</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">addy</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-65" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.findBasicBlockHeuristically()=Libs.librecognition.FunctionRecognition-class.html#findBasicBlockHeuristically"><a title="Libs.librecognition.FunctionRecognition.findBasicBlockHeuristically" class="py-name" href="#" onclick="return doclink('link-65', 'findBasicBlockHeuristically', 'link-65');">findBasicBlockHeuristically</a></tt><tt class="py-op">(</tt><tt class="py-name">poss</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">firstbb</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L458"></a><tt class="py-lineno">458</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">addy</tt> <tt class="py-keyword">and</tt> <tt class="py-name">firstbb</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L459"></a><tt class="py-lineno">459</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-66" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.findFirstBB()=Libs.librecognition.FunctionRecognition-class.html#findFirstBB"><a title="Libs.librecognition.FunctionRecognition.findFirstBB" class="py-name" href="#" onclick="return doclink('link-66', 'findFirstBB', 'link-66');">findFirstBB</a></tt><tt class="py-op">(</tt><tt class="py-name">poss</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L460"></a><tt class="py-lineno">460</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L461"></a><tt class="py-lineno">461</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("Trying with the new firstbb 2nd try:%X"%tmp,tmp)</tt> </tt>
|
|
<a name="L462"></a><tt class="py-lineno">462</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">addy</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-67" class="py-name"><a title="Libs.librecognition.FunctionRecognition.findBasicBlockHeuristically" class="py-name" href="#" onclick="return doclink('link-67', 'findBasicBlockHeuristically', 'link-65');">findBasicBlockHeuristically</a></tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">,</tt> <tt class="py-name">firstbb</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L463"></a><tt class="py-lineno">463</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">addy</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L464"></a><tt class="py-lineno">464</tt> <tt class="py-line"> <tt class="py-name">addy</tt> <tt class="py-op">=</tt> <tt class="py-name">poss</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L465"></a><tt class="py-lineno">465</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("possible start: %08X" % addy)</tt> </tt>
|
|
<a name="L466"></a><tt class="py-lineno">466</tt> <tt class="py-line"><tt class="py-comment"></tt> </tt>
|
|
<a name="L467"></a><tt class="py-lineno">467</tt> <tt class="py-line"> <tt class="py-comment">#Make a comparision using an Exact Hash</tt> </tt>
|
|
<a name="L468"></a><tt class="py-lineno">468</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">exact</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L469"></a><tt class="py-lineno">469</tt> <tt class="py-line"> <tt class="py-name">test</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-68" class="py-name"><a title="Libs.immlib.Debugger.makeFunctionHashExact
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashExact" class="py-name" href="#" onclick="return doclink('link-68', 'makeFunctionHashExact', 'link-10');">makeFunctionHashExact</a></tt><tt class="py-op">(</tt><tt class="py-name">addy</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L470"></a><tt class="py-lineno">470</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">exact</tt> <tt class="py-op">==</tt> <tt class="py-name">test</tt> <tt class="py-keyword">and</tt> <tt class="py-keyword">not</tt> <tt class="py-name">firstcallhash</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L471"></a><tt class="py-lineno">471</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("EXACT match")</tt> </tt>
|
|
<a name="L472"></a><tt class="py-lineno">472</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#when we find an exact match, we don't need to search anymore</tt> </tt>
|
|
<a name="L473"></a><tt class="py-lineno">473</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">return</tt> <tt class="py-op">[</tt> <tt class="py-op">(</tt><tt class="py-name">addy</tt><tt class="py-op">,</tt> <tt class="py-number">100</tt><tt class="py-op">)</tt> <tt class="py-op">]</tt> </tt>
|
|
<a name="L474"></a><tt class="py-lineno">474</tt> <tt class="py-line"> </tt>
|
|
<a name="L475"></a><tt class="py-lineno">475</tt> <tt class="py-line"> <tt class="py-name">perc</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-69" class="py-name"><a title="Libs.librecognition.FunctionRecognition.checkHeuristic" class="py-name" href="#" onclick="return doclink('link-69', 'checkHeuristic', 'link-12');">checkHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">addy</tt><tt class="py-op">,</tt> <tt class="py-name">functionhash</tt><tt class="py-op">,</tt> <tt class="py-name">firstcallhash</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L476"></a><tt class="py-lineno">476</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("function %08X similar in %d%%" % (addy, perc))</tt> </tt>
|
|
<a name="L477"></a><tt class="py-lineno">477</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">perc</tt> <tt class="py-op">>=</tt> <tt class="py-name">heuristic</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L478"></a><tt class="py-lineno">478</tt> <tt class="py-line"> <tt class="py-name">poss_return</tt><tt class="py-op">.</tt><tt id="link-70" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-70', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt> <tt class="py-op">(</tt><tt class="py-name">addy</tt><tt class="py-op">,</tt><tt class="py-name">perc</tt><tt class="py-op">)</tt> <tt class="py-op">)</tt> </tt>
|
|
<a name="L479"></a><tt class="py-lineno">479</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("HEURISTIC match")</tt> </tt>
|
|
<a name="L480"></a><tt class="py-lineno">480</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">return</tt> <tt class="py-name">poss_return</tt> </tt>
|
|
</div><a name="L481"></a><tt class="py-lineno">481</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.searchFunctionByName"></a><div id="FunctionRecognition.searchFunctionByName-def"><a name="L482"></a><tt class="py-lineno">482</tt> <a class="py-toggle" href="#" id="FunctionRecognition.searchFunctionByName-toggle" onclick="return toggle('FunctionRecognition.searchFunctionByName');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#searchFunctionByName">searchFunctionByName</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">name</tt><tt class="py-op">,</tt> <tt class="py-param">heuristic</tt> <tt class="py-op">=</tt> <tt class="py-number">90</tt><tt class="py-op">,</tt> <tt class="py-param">module</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt><tt class="py-op">,</tt> <tt class="py-param">version</tt> <tt class="py-op">=</tt> <tt class="py-name">None</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.searchFunctionByName-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.searchFunctionByName-expanded"><a name="L483"></a><tt class="py-lineno">483</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L484"></a><tt class="py-lineno">484</tt> <tt class="py-line"><tt class="py-docstring"> Look up into our dictionaries to find a function match.</tt> </tt>
|
|
<a name="L485"></a><tt class="py-lineno">485</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L486"></a><tt class="py-lineno">486</tt> <tt class="py-line"><tt class="py-docstring"> @type name: STRING</tt> </tt>
|
|
<a name="L487"></a><tt class="py-lineno">487</tt> <tt class="py-line"><tt class="py-docstring"> @param name: Name of the function to search</tt> </tt>
|
|
<a name="L488"></a><tt class="py-lineno">488</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L489"></a><tt class="py-lineno">489</tt> <tt class="py-line"><tt class="py-docstring"> @type module: STRING</tt> </tt>
|
|
<a name="L490"></a><tt class="py-lineno">490</tt> <tt class="py-line"><tt class="py-docstring"> @param module: name of a module to restrict the search</tt> </tt>
|
|
<a name="L491"></a><tt class="py-lineno">491</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L492"></a><tt class="py-lineno">492</tt> <tt class="py-line"><tt class="py-docstring"> @type version: STRING</tt> </tt>
|
|
<a name="L493"></a><tt class="py-lineno">493</tt> <tt class="py-line"><tt class="py-docstring"> @param version: restrict the search to the given version</tt> </tt>
|
|
<a name="L494"></a><tt class="py-lineno">494</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L495"></a><tt class="py-lineno">495</tt> <tt class="py-line"><tt class="py-docstring"> @type heuristic: INTEGER</tt> </tt>
|
|
<a name="L496"></a><tt class="py-lineno">496</tt> <tt class="py-line"><tt class="py-docstring"> @param heuristic: heuristic threasold to consider a real function match</tt> </tt>
|
|
<a name="L497"></a><tt class="py-lineno">497</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L498"></a><tt class="py-lineno">498</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L499"></a><tt class="py-lineno">499</tt> <tt class="py-line"><tt class="py-docstring"> @return: a list of tuples with possible function's addresses and the heauristic match percentage </tt> </tt>
|
|
<a name="L500"></a><tt class="py-lineno">500</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L501"></a><tt class="py-lineno">501</tt> <tt class="py-line"> <tt class="py-comment">#the name is case insensitive</tt> </tt>
|
|
<a name="L502"></a><tt class="py-lineno">502</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">name</tt> <tt class="py-op">=</tt> <tt class="py-name">name</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L503"></a><tt class="py-lineno">503</tt> <tt class="py-line"> </tt>
|
|
<a name="L504"></a><tt class="py-lineno">504</tt> <tt class="py-line"> <tt class="py-comment">#Heuristic search</tt> </tt>
|
|
<a name="L505"></a><tt class="py-lineno">505</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">poss_return</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L506"></a><tt class="py-lineno">506</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">data</tt> <tt class="py-keyword">in</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">dictionaries</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L507"></a><tt class="py-lineno">507</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">name</tt> <tt class="py-op">==</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L508"></a><tt class="py-lineno">508</tt> <tt class="py-line"> <tt class="py-comment">#support version matching</tt> </tt>
|
|
<a name="L509"></a><tt class="py-lineno">509</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">version</tt> <tt class="py-keyword">and</tt> <tt class="py-name">version</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-op">!=</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">6</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">lower</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L510"></a><tt class="py-lineno">510</tt> <tt class="py-line"> <tt class="py-keyword">continue</tt> </tt>
|
|
<a name="L511"></a><tt class="py-lineno">511</tt> <tt class="py-line"> </tt>
|
|
<a name="L512"></a><tt class="py-lineno">512</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("trying with: %s, version: %s" % ( data[0], data[5]))</tt> </tt>
|
|
<a name="L513"></a><tt class="py-lineno">513</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">data</tt><tt class="py-op">)</tt> <tt class="py-op"><</tt> <tt class="py-number">9</tt><tt class="py-op">:</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">7</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> <tt class="py-comment">#support for older entries</tt> </tt>
|
|
<a name="L514"></a><tt class="py-lineno">514</tt> <tt class="py-line"> <tt class="py-name">poss_return</tt> <tt class="py-op">+=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-71" class="py-name"><a title="Libs.librecognition.FunctionRecognition._searchFunctionByHeuristic" class="py-name" href="#" onclick="return doclink('link-71', '_searchFunctionByHeuristic', 'link-47');">_searchFunctionByHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">2</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">3</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">4</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">heuristic</tt><tt class="py-op">,</tt> <tt class="py-name">module</tt><tt class="py-op">,</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-number">7</tt><tt class="py-op">]</tt><tt class="py-op">,</tt><tt class="py-string">"|"</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L515"></a><tt class="py-lineno">515</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">poss_return</tt> </tt>
|
|
</div><a name="L516"></a><tt class="py-lineno">516</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.makeFunctionHashExact"></a><div id="FunctionRecognition.makeFunctionHashExact-def"><a name="L517"></a><tt class="py-lineno">517</tt> <a class="py-toggle" href="#" id="FunctionRecognition.makeFunctionHashExact-toggle" onclick="return toggle('FunctionRecognition.makeFunctionHashExact');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#makeFunctionHashExact">makeFunctionHashExact</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.makeFunctionHashExact-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.makeFunctionHashExact-expanded"><a name="L518"></a><tt class="py-lineno">518</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L519"></a><tt class="py-lineno">519</tt> <tt class="py-line"><tt class="py-docstring"> Return a SHA-1 hash of the function, taking the raw bytes as data.</tt> </tt>
|
|
<a name="L520"></a><tt class="py-lineno">520</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L521"></a><tt class="py-lineno">521</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L522"></a><tt class="py-lineno">522</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address of the function to hash</tt> </tt>
|
|
<a name="L523"></a><tt class="py-lineno">523</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L524"></a><tt class="py-lineno">524</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: STRING</tt> </tt>
|
|
<a name="L525"></a><tt class="py-lineno">525</tt> <tt class="py-line"><tt class="py-docstring"> @return: SHA-1 hash of the function</tt> </tt>
|
|
<a name="L526"></a><tt class="py-lineno">526</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L527"></a><tt class="py-lineno">527</tt> <tt class="py-line"> </tt>
|
|
<a name="L528"></a><tt class="py-lineno">528</tt> <tt class="py-line"> <tt class="py-name">f</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-72" class="py-name"><a title="Libs.immlib.Debugger.getFunction
|
|
Libs.libanalyze.BasicBlock.getFunction" class="py-name" href="#" onclick="return doclink('link-72', 'getFunction', 'link-20');">getFunction</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L529"></a><tt class="py-lineno">529</tt> <tt class="py-line"> <tt class="py-name">bbs</tt> <tt class="py-op">=</tt> <tt class="py-name">f</tt><tt class="py-op">.</tt><tt id="link-73" class="py-name"><a title="Libs.libanalyze.Function.getBasicBlocks" class="py-name" href="#" onclick="return doclink('link-73', 'getBasicBlocks', 'link-21');">getBasicBlocks</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L530"></a><tt class="py-lineno">530</tt> <tt class="py-line"> <tt class="py-name">bucket</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> </tt>
|
|
<a name="L531"></a><tt class="py-lineno">531</tt> <tt class="py-line"> <tt class="py-name">data</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L532"></a><tt class="py-lineno">532</tt> <tt class="py-line"> </tt>
|
|
<a name="L533"></a><tt class="py-lineno">533</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">bb</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bbs</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L534"></a><tt class="py-lineno">534</tt> <tt class="py-line"> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-74" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-74', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-75" class="py-name" targets="Method Libs.immlib.Debugger.readMemory()=Libs.immlib.Debugger-class.html#readMemory"><a title="Libs.immlib.Debugger.readMemory" class="py-name" href="#" onclick="return doclink('link-75', 'readMemory', 'link-75');">readMemory</a></tt><tt class="py-op">(</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-76" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-76', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-77" class="py-name"><a title="Libs.debugtypes.MemoryPage.getSize
|
|
Libs.debugtypes.Module.getSize
|
|
Libs.libanalyze.BasicBlock.getSize
|
|
Libs.libanalyze.opCode.getSize
|
|
Libs.libdatatype.Data.getSize
|
|
Libs.libheap.PLook.getSize
|
|
Libs.libheap.UserData.getSize
|
|
Libs.pelib.Directory.getSize
|
|
Libs.pelib.IMGOPThdr.getSize
|
|
Libs.pelib.IMGhdr.getSize
|
|
Libs.pelib.ImageExportDirectory.getSize
|
|
Libs.pelib.ImageImportByName.getSize
|
|
Libs.pelib.ImportDescriptor.getSize
|
|
Libs.pelib.MZ.getSize
|
|
Libs.pelib.Section.getSize" class="py-name" href="#" onclick="return doclink('link-77', 'getSize', 'link-34');">getSize</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L535"></a><tt class="py-lineno">535</tt> <tt class="py-line"> </tt>
|
|
<a name="L536"></a><tt class="py-lineno">536</tt> <tt class="py-line"> <tt class="py-name">keys</tt> <tt class="py-op">=</tt> <tt class="py-name">data</tt><tt class="py-op">.</tt><tt class="py-name">keys</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L537"></a><tt class="py-lineno">537</tt> <tt class="py-line"> <tt class="py-name">keys</tt><tt class="py-op">.</tt><tt class="py-name">sort</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L538"></a><tt class="py-lineno">538</tt> <tt class="py-line"> </tt>
|
|
<a name="L539"></a><tt class="py-lineno">539</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">key</tt> <tt class="py-keyword">in</tt> <tt class="py-name">keys</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L540"></a><tt class="py-lineno">540</tt> <tt class="py-line"> <tt class="py-name">bucket</tt> <tt class="py-op">+=</tt> <tt class="py-name">data</tt><tt class="py-op">[</tt><tt class="py-name">key</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L541"></a><tt class="py-lineno">541</tt> <tt class="py-line"> </tt>
|
|
<a name="L542"></a><tt class="py-lineno">542</tt> <tt class="py-line"> <tt class="py-name">hash</tt> <tt class="py-op">=</tt> <tt class="py-name">hashlib</tt><tt class="py-op">.</tt><tt class="py-name">sha1</tt><tt class="py-op">(</tt><tt class="py-name">bucket</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt class="py-name">hexdigest</tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L543"></a><tt class="py-lineno">543</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">bucket</tt> </tt>
|
|
<a name="L544"></a><tt class="py-lineno">544</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">bbs</tt> </tt>
|
|
<a name="L545"></a><tt class="py-lineno">545</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">f</tt> </tt>
|
|
<a name="L546"></a><tt class="py-lineno">546</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">hash</tt> </tt>
|
|
</div><a name="L547"></a><tt class="py-lineno">547</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.makeFunctionHash"></a><div id="FunctionRecognition.makeFunctionHash-def"><a name="L548"></a><tt class="py-lineno">548</tt> <a class="py-toggle" href="#" id="FunctionRecognition.makeFunctionHash-toggle" onclick="return toggle('FunctionRecognition.makeFunctionHash');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#makeFunctionHash">makeFunctionHash</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">compressed</tt> <tt class="py-op">=</tt> <tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.makeFunctionHash-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.makeFunctionHash-expanded"><a name="L549"></a><tt class="py-lineno">549</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L550"></a><tt class="py-lineno">550</tt> <tt class="py-line"><tt class="py-docstring"> Return a list with the best BB to use for a search and the heuristic hash</tt> </tt>
|
|
<a name="L551"></a><tt class="py-lineno">551</tt> <tt class="py-line"><tt class="py-docstring"> of the function. This two components are the function hash.</tt> </tt>
|
|
<a name="L552"></a><tt class="py-lineno">552</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L553"></a><tt class="py-lineno">553</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L554"></a><tt class="py-lineno">554</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address of the function to hash</tt> </tt>
|
|
<a name="L555"></a><tt class="py-lineno">555</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L556"></a><tt class="py-lineno">556</tt> <tt class="py-line"><tt class="py-docstring"> @type compressed: Boolean</tt> </tt>
|
|
<a name="L557"></a><tt class="py-lineno">557</tt> <tt class="py-line"><tt class="py-docstring"> @param compressed: return a compressed base64 representation or the raw data</tt> </tt>
|
|
<a name="L558"></a><tt class="py-lineno">558</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L559"></a><tt class="py-lineno">559</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L560"></a><tt class="py-lineno">560</tt> <tt class="py-line"><tt class="py-docstring"> @return: 1st element is the generalized instructions to use with searchCommand</tt> </tt>
|
|
<a name="L561"></a><tt class="py-lineno">561</tt> <tt class="py-line"><tt class="py-docstring"> 2nd element is the heuristic function hash (makeFunctionHashHeuristic)</tt> </tt>
|
|
<a name="L562"></a><tt class="py-lineno">562</tt> <tt class="py-line"><tt class="py-docstring"> 3rd element is an exact hash of the function (makeFunctionHashExact)</tt> </tt>
|
|
<a name="L563"></a><tt class="py-lineno">563</tt> <tt class="py-line"><tt class="py-docstring"> 4th element is a LIST of generalized instructions of the first BB (to find the function begin)</tt> </tt>
|
|
<a name="L564"></a><tt class="py-lineno">564</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L565"></a><tt class="py-lineno">565</tt> <tt class="py-line"> </tt>
|
|
<a name="L566"></a><tt class="py-lineno">566</tt> <tt class="py-line"> <tt class="py-name">ret</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L567"></a><tt class="py-lineno">567</tt> <tt class="py-line"> <tt class="py-name">ret</tt><tt class="py-op">.</tt><tt id="link-78" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-78', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-79" class="py-name"><a title="Libs.librecognition.FunctionRecognition.selectBasicBlock" class="py-name" href="#" onclick="return doclink('link-79', 'selectBasicBlock', 'link-11');">selectBasicBlock</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L568"></a><tt class="py-lineno">568</tt> <tt class="py-line"> <tt class="py-name">ret</tt><tt class="py-op">.</tt><tt id="link-80" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-80', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-81" class="py-name"><a title="Libs.immlib.Debugger.makeFunctionHashHeuristic
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashHeuristic" class="py-name" href="#" onclick="return doclink('link-81', 'makeFunctionHashHeuristic', 'link-13');">makeFunctionHashHeuristic</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">,</tt> <tt class="py-name">compressed</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L569"></a><tt class="py-lineno">569</tt> <tt class="py-line"> <tt class="py-name">ret</tt><tt class="py-op">.</tt><tt id="link-82" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-82', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-83" class="py-name"><a title="Libs.immlib.Debugger.makeFunctionHashExact
|
|
Libs.librecognition.FunctionRecognition.makeFunctionHashExact" class="py-name" href="#" onclick="return doclink('link-83', 'makeFunctionHashExact', 'link-10');">makeFunctionHashExact</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L570"></a><tt class="py-lineno">570</tt> <tt class="py-line"> <tt class="py-name">ret</tt><tt class="py-op">.</tt><tt id="link-84" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-84', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-85" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.generalizeFunction()=Libs.librecognition.FunctionRecognition-class.html#generalizeFunction"><a title="Libs.librecognition.FunctionRecognition.generalizeFunction" class="py-name" href="#" onclick="return doclink('link-85', 'generalizeFunction', 'link-85');">generalizeFunction</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L571"></a><tt class="py-lineno">571</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">ret</tt> </tt>
|
|
</div><a name="L572"></a><tt class="py-lineno">572</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.selectBasicBlock"></a><div id="FunctionRecognition.selectBasicBlock-def"><a name="L573"></a><tt class="py-lineno">573</tt> <a class="py-toggle" href="#" id="FunctionRecognition.selectBasicBlock-toggle" onclick="return toggle('FunctionRecognition.selectBasicBlock');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#selectBasicBlock">selectBasicBlock</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.selectBasicBlock-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.selectBasicBlock-expanded"><a name="L574"></a><tt class="py-lineno">574</tt> <tt class="py-line"> <tt class="py-name">bbs</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-86" class="py-name"><a title="Libs.librecognition.FunctionRecognition.generalizeFunction" class="py-name" href="#" onclick="return doclink('link-86', 'generalizeFunction', 'link-85');">generalizeFunction</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L575"></a><tt class="py-lineno">575</tt> <tt class="py-line"> </tt>
|
|
<a name="L576"></a><tt class="py-lineno">576</tt> <tt class="py-line"> <tt class="py-comment">#make some punctuation to get the BB with major diversity and </tt> </tt>
|
|
<a name="L577"></a><tt class="py-lineno">577</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#quantity of instructions</tt> </tt>
|
|
<a name="L578"></a><tt class="py-lineno">578</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">hpoints</tt> <tt class="py-op">=</tt> <tt class="py-name">bb</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L579"></a><tt class="py-lineno">579</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">id</tt><tt class="py-op">,</tt> <tt class="py-name">instrs</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bbs</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">.</tt><tt class="py-name">iteritems</tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L580"></a><tt class="py-lineno">580</tt> <tt class="py-line"> <tt class="py-name">map</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L581"></a><tt class="py-lineno">581</tt> <tt class="py-line"> <tt class="py-name">sum</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L582"></a><tt class="py-lineno">582</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">instr</tt> <tt class="py-keyword">in</tt> <tt class="py-name">instrs</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L583"></a><tt class="py-lineno">583</tt> <tt class="py-line"> <tt class="py-name">sum</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L584"></a><tt class="py-lineno">584</tt> <tt class="py-line"> <tt class="py-name">base</tt> <tt class="py-op">=</tt> <tt class="py-name">instr</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-string">" "</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L585"></a><tt class="py-lineno">585</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-string">"REP"</tt> <tt class="py-keyword">in</tt> <tt class="py-name">base</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L586"></a><tt class="py-lineno">586</tt> <tt class="py-line"> <tt class="py-name">base</tt> <tt class="py-op">=</tt> <tt class="py-name">base</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">+</tt> <tt class="py-string">" "</tt> <tt class="py-op">+</tt> <tt class="py-name">base</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L587"></a><tt class="py-lineno">587</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L588"></a><tt class="py-lineno">588</tt> <tt class="py-line"> <tt class="py-name">base</tt> <tt class="py-op">=</tt> <tt class="py-name">base</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L589"></a><tt class="py-lineno">589</tt> <tt class="py-line"> <tt class="py-name">map</tt><tt class="py-op">[</tt><tt class="py-name">base</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">True</tt> </tt>
|
|
<a name="L590"></a><tt class="py-lineno">590</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">sum</tt> <tt class="py-op">></tt> <tt class="py-number">7</tt><tt class="py-op">:</tt> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L591"></a><tt class="py-lineno">591</tt> <tt class="py-line"> </tt>
|
|
<a name="L592"></a><tt class="py-lineno">592</tt> <tt class="py-line"> <tt class="py-comment">#it's four times more important diversity than quantity</tt> </tt>
|
|
<a name="L593"></a><tt class="py-lineno">593</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#We can use 8 instructions to search, so priorize diversity</tt> </tt>
|
|
<a name="L594"></a><tt class="py-lineno">594</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">points</tt> <tt class="py-op">=</tt> <tt class="py-name">sum</tt> <tt class="py-op">+</tt> <tt class="py-name">len</tt><tt class="py-op">(</tt><tt class="py-name">map</tt><tt class="py-op">)</tt><tt class="py-op">*</tt><tt class="py-number">4</tt> </tt>
|
|
<a name="L595"></a><tt class="py-lineno">595</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">points</tt> <tt class="py-op">></tt> <tt class="py-name">hpoints</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L596"></a><tt class="py-lineno">596</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("new hpoint (%d, last %d): %s" % (points,hpoints,instrs[0:8]))</tt> </tt>
|
|
<a name="L597"></a><tt class="py-lineno">597</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#self.imm.Log("sum: %d diver: %d" % (sum, len(map)))</tt> </tt>
|
|
<a name="L598"></a><tt class="py-lineno">598</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">hpoints</tt> <tt class="py-op">=</tt> <tt class="py-name">points</tt> </tt>
|
|
<a name="L599"></a><tt class="py-lineno">599</tt> <tt class="py-line"> <tt class="py-name">bb</tt> <tt class="py-op">=</tt> <tt class="py-name">id</tt> </tt>
|
|
<a name="L600"></a><tt class="py-lineno">600</tt> <tt class="py-line"> <tt class="py-name">ret</tt> <tt class="py-op">=</tt> <tt class="py-string">""</tt> </tt>
|
|
<a name="L601"></a><tt class="py-lineno">601</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">bb</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L602"></a><tt class="py-lineno">602</tt> <tt class="py-line"> <tt class="py-name">ret</tt> <tt class="py-op">=</tt> <tt class="py-name">string</tt><tt class="py-op">.</tt><tt class="py-name">join</tt><tt class="py-op">(</tt><tt class="py-name">bbs</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">:</tt><tt class="py-number">8</tt><tt class="py-op">]</tt><tt class="py-op">,</tt><tt class="py-string">"\\n"</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L603"></a><tt class="py-lineno">603</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">bbs</tt> </tt>
|
|
<a name="L604"></a><tt class="py-lineno">604</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">ret</tt> </tt>
|
|
</div><a name="L605"></a><tt class="py-lineno">605</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.generalizeFunction"></a><div id="FunctionRecognition.generalizeFunction-def"><a name="L606"></a><tt class="py-lineno">606</tt> <a class="py-toggle" href="#" id="FunctionRecognition.generalizeFunction-toggle" onclick="return toggle('FunctionRecognition.generalizeFunction');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#generalizeFunction">generalizeFunction</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.generalizeFunction-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.generalizeFunction-expanded"><a name="L607"></a><tt class="py-lineno">607</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L608"></a><tt class="py-lineno">608</tt> <tt class="py-line"><tt class="py-docstring"> Take an address an return a generalized version of the function, dismissing</tt> </tt>
|
|
<a name="L609"></a><tt class="py-lineno">609</tt> <tt class="py-line"><tt class="py-docstring"> address and register dependant information.</tt> </tt>
|
|
<a name="L610"></a><tt class="py-lineno">610</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L611"></a><tt class="py-lineno">611</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L612"></a><tt class="py-lineno">612</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address to the function begin</tt> </tt>
|
|
<a name="L613"></a><tt class="py-lineno">613</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L614"></a><tt class="py-lineno">614</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: LIST</tt> </tt>
|
|
<a name="L615"></a><tt class="py-lineno">615</tt> <tt class="py-line"><tt class="py-docstring"> @return: the 1st value is a DICTIONARY of a Control Flow Graph of the </tt> </tt>
|
|
<a name="L616"></a><tt class="py-lineno">616</tt> <tt class="py-line"><tt class="py-docstring"> BB conexions (each BB have an arbitrary ID)</tt> </tt>
|
|
<a name="L617"></a><tt class="py-lineno">617</tt> <tt class="py-line"><tt class="py-docstring"> the 2nd value is a DICTIONARY using this arbitrary BB ID as the key</tt> </tt>
|
|
<a name="L618"></a><tt class="py-lineno">618</tt> <tt class="py-line"><tt class="py-docstring"> and a LIST of searchCommand suitable, generalized instructions.</tt> </tt>
|
|
<a name="L619"></a><tt class="py-lineno">619</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L620"></a><tt class="py-lineno">620</tt> <tt class="py-line"> <tt class="py-name">bbcount</tt> <tt class="py-op">=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L621"></a><tt class="py-lineno">621</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L622"></a><tt class="py-lineno">622</tt> <tt class="py-line"> <tt class="py-name">cfg</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L623"></a><tt class="py-lineno">623</tt> <tt class="py-line"> <tt class="py-name">bbinfo</tt> <tt class="py-op">=</tt> <tt class="py-op">{</tt><tt class="py-op">}</tt> </tt>
|
|
<a name="L624"></a><tt class="py-lineno">624</tt> <tt class="py-line"> </tt>
|
|
<a name="L625"></a><tt class="py-lineno">625</tt> <tt class="py-line"> <tt class="py-name">f</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-87" class="py-name"><a title="Libs.immlib.Debugger.getFunction
|
|
Libs.libanalyze.BasicBlock.getFunction" class="py-name" href="#" onclick="return doclink('link-87', 'getFunction', 'link-20');">getFunction</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L626"></a><tt class="py-lineno">626</tt> <tt class="py-line"> <tt class="py-name">bbs</tt> <tt class="py-op">=</tt> <tt class="py-name">f</tt><tt class="py-op">.</tt><tt id="link-88" class="py-name"><a title="Libs.libanalyze.Function.getBasicBlocks" class="py-name" href="#" onclick="return doclink('link-88', 'getBasicBlocks', 'link-21');">getBasicBlocks</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L627"></a><tt class="py-lineno">627</tt> <tt class="py-line"> </tt>
|
|
<a name="L628"></a><tt class="py-lineno">628</tt> <tt class="py-line"> <tt class="py-comment">#Make a control flow graph</tt> </tt>
|
|
<a name="L629"></a><tt class="py-lineno">629</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">bb</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bbs</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L630"></a><tt class="py-lineno">630</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">bbmap</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-89" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-89', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L631"></a><tt class="py-lineno">631</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-90" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-90', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbcount</tt> </tt>
|
|
<a name="L632"></a><tt class="py-lineno">632</tt> <tt class="py-line"> <tt class="py-name">bbcount</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L633"></a><tt class="py-lineno">633</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">bbmap</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-91" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-91', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L634"></a><tt class="py-lineno">634</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-92" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-92', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbcount</tt> </tt>
|
|
<a name="L635"></a><tt class="py-lineno">635</tt> <tt class="py-line"> <tt class="py-name">bbcount</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L636"></a><tt class="py-lineno">636</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">bbmap</tt><tt class="py-op">.</tt><tt class="py-name">has_key</tt><tt class="py-op">(</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-93" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-93', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L637"></a><tt class="py-lineno">637</tt> <tt class="py-line"> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-94" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-94', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">bbcount</tt> </tt>
|
|
<a name="L638"></a><tt class="py-lineno">638</tt> <tt class="py-line"> <tt class="py-name">bbcount</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L639"></a><tt class="py-lineno">639</tt> <tt class="py-line"> </tt>
|
|
<a name="L640"></a><tt class="py-lineno">640</tt> <tt class="py-line"> <tt class="py-name">cfg</tt><tt class="py-op">[</tt><tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-95" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-95', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-96" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-96', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">]</tt><tt class="py-op">,</tt> <tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-97" class="py-name"><a title="Libs.graphclass.Graph.getEdges
|
|
Libs.libanalyze.BasicBlock.getEdges" class="py-name" href="#" onclick="return doclink('link-97', 'getEdges', 'link-23');">getEdges</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">]</tt> </tt>
|
|
<a name="L641"></a><tt class="py-lineno">641</tt> <tt class="py-line"> </tt>
|
|
<a name="L642"></a><tt class="py-lineno">642</tt> <tt class="py-line"> <tt class="py-name">regex</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L643"></a><tt class="py-lineno">643</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">op</tt> <tt class="py-keyword">in</tt> <tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-98" class="py-name"><a title="Libs.libanalyze.BasicBlock.getInstructions" class="py-name" href="#" onclick="return doclink('link-98', 'getInstructions', 'link-24');">getInstructions</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L644"></a><tt class="py-lineno">644</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-99" class="py-name" targets="Method Libs.librecognition.FunctionRecognition.generalizeInstruction()=Libs.librecognition.FunctionRecognition-class.html#generalizeInstruction"><a title="Libs.librecognition.FunctionRecognition.generalizeInstruction" class="py-name" href="#" onclick="return doclink('link-99', 'generalizeInstruction', 'link-99');">generalizeInstruction</a></tt><tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L645"></a><tt class="py-lineno">645</tt> <tt class="py-line"> <tt class="py-name">regex</tt><tt class="py-op">.</tt><tt id="link-100" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-100', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L646"></a><tt class="py-lineno">646</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("%s --> %s" % (op.getDisasm(), asm))</tt> </tt>
|
|
<a name="L647"></a><tt class="py-lineno">647</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">bbinfo</tt><tt class="py-op">[</tt><tt class="py-name">bbmap</tt><tt class="py-op">[</tt><tt class="py-name">bb</tt><tt class="py-op">.</tt><tt id="link-101" class="py-name"><a title="Libs.libanalyze.BasicBlock.getStart
|
|
Libs.libanalyze.Function.getStart" class="py-name" href="#" onclick="return doclink('link-101', 'getStart', 'link-22');">getStart</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">]</tt><tt class="py-op">]</tt> <tt class="py-op">=</tt> <tt class="py-name">regex</tt> </tt>
|
|
<a name="L648"></a><tt class="py-lineno">648</tt> <tt class="py-line"> </tt>
|
|
<a name="L649"></a><tt class="py-lineno">649</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">bbs</tt> </tt>
|
|
<a name="L650"></a><tt class="py-lineno">650</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">f</tt> </tt>
|
|
<a name="L651"></a><tt class="py-lineno">651</tt> <tt class="py-line"> <tt class="py-keyword">del</tt> <tt class="py-name">regex</tt> </tt>
|
|
<a name="L652"></a><tt class="py-lineno">652</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-op">[</tt> <tt class="py-name">cfg</tt><tt class="py-op">,</tt> <tt class="py-name">bbinfo</tt> <tt class="py-op">]</tt> </tt>
|
|
</div><a name="L653"></a><tt class="py-lineno">653</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.generalizeInstruction"></a><div id="FunctionRecognition.generalizeInstruction-def"><a name="L654"></a><tt class="py-lineno">654</tt> <a class="py-toggle" href="#" id="FunctionRecognition.generalizeInstruction-toggle" onclick="return toggle('FunctionRecognition.generalizeInstruction');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#generalizeInstruction">generalizeInstruction</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">inp</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.generalizeInstruction-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.generalizeInstruction-expanded"><a name="L655"></a><tt class="py-lineno">655</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L656"></a><tt class="py-lineno">656</tt> <tt class="py-line"><tt class="py-docstring"> Generalize an instruction given an address or an opCode instance</tt> </tt>
|
|
<a name="L657"></a><tt class="py-lineno">657</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L658"></a><tt class="py-lineno">658</tt> <tt class="py-line"><tt class="py-docstring"> @type inp: DWORD|OpCode OBJECT</tt> </tt>
|
|
<a name="L659"></a><tt class="py-lineno">659</tt> <tt class="py-line"><tt class="py-docstring"> @param inp: address to generalize or opcode to generalize</tt> </tt>
|
|
<a name="L660"></a><tt class="py-lineno">660</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L661"></a><tt class="py-lineno">661</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: STRING</tt> </tt>
|
|
<a name="L662"></a><tt class="py-lineno">662</tt> <tt class="py-line"><tt class="py-docstring"> @return: a generalized assembler instruction</tt> </tt>
|
|
<a name="L663"></a><tt class="py-lineno">663</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L664"></a><tt class="py-lineno">664</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">isinstance</tt><tt class="py-op">(</tt><tt class="py-name">inp</tt><tt class="py-op">,</tt> <tt id="link-102" class="py-name" targets="Class Libs.libanalyze.opCode=Libs.libanalyze.opCode-class.html"><a title="Libs.libanalyze.opCode" class="py-name" href="#" onclick="return doclink('link-102', 'opCode', 'link-102');">opCode</a></tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L665"></a><tt class="py-lineno">665</tt> <tt class="py-line"> <tt class="py-name">op</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-103" class="py-name"><a title="Libs.immlib.Debugger.Disasm" class="py-name" href="#" onclick="return doclink('link-103', 'Disasm', 'link-41');">Disasm</a></tt><tt class="py-op">(</tt><tt class="py-name">inp</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L666"></a><tt class="py-lineno">666</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> <tt class="py-name">op</tt> <tt class="py-op">=</tt> <tt class="py-name">inp</tt> </tt>
|
|
<a name="L667"></a><tt class="py-lineno">667</tt> <tt class="py-line"> </tt>
|
|
<a name="L668"></a><tt class="py-lineno">668</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-104" class="py-name" targets="Method Libs.libanalyze.opCode.getDisasm()=Libs.libanalyze.opCode-class.html#getDisasm"><a title="Libs.libanalyze.opCode.getDisasm" class="py-name" href="#" onclick="return doclink('link-104', 'getDisasm', 'link-104');">getDisasm</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L669"></a><tt class="py-lineno">669</tt> <tt class="py-line"> </tt>
|
|
<a name="L670"></a><tt class="py-lineno">670</tt> <tt class="py-line"> <tt class="py-comment">#replace the constants inside the opcode to the word CONST</tt> </tt>
|
|
<a name="L671"></a><tt class="py-lineno">671</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-105" class="py-name" targets="Method Libs.libanalyze.BasicBlock.isConditionalJmp()=Libs.libanalyze.BasicBlock-class.html#isConditionalJmp,Method Libs.libanalyze.opCode.isConditionalJmp()=Libs.libanalyze.opCode-class.html#isConditionalJmp"><a title="Libs.libanalyze.BasicBlock.isConditionalJmp
|
|
Libs.libanalyze.opCode.isConditionalJmp" class="py-name" href="#" onclick="return doclink('link-105', 'isConditionalJmp', 'link-105');">isConditionalJmp</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L672"></a><tt class="py-lineno">672</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-string">"JCC CONST"</tt> </tt>
|
|
<a name="L673"></a><tt class="py-lineno">673</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-106" class="py-name" targets="Method Libs.libanalyze.opCode.getImmConst()=Libs.libanalyze.opCode-class.html#getImmConst"><a title="Libs.libanalyze.opCode.getImmConst" class="py-name" href="#" onclick="return doclink('link-106', 'getImmConst', 'link-106');">getImmConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-keyword">or</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">operand</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt> <tt class="py-op">==</tt> <tt id="link-107" class="py-name" targets="Variable Libs.immlib.DEC_CONST=Libs.immlib-module.html#DEC_CONST,Variable Libs.libanalyze.DEC_CONST=Libs.libanalyze-module.html#DEC_CONST,Variable Libs.librecognition.DEC_CONST=Libs.librecognition-module.html#DEC_CONST"><a title="Libs.immlib.DEC_CONST
|
|
Libs.libanalyze.DEC_CONST
|
|
Libs.librecognition.DEC_CONST" class="py-name" href="#" onclick="return doclink('link-107', 'DEC_CONST', 'link-107');">DEC_CONST</a></tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L674"></a><tt class="py-lineno">674</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("const part:%X"%op.getImmConst())</tt> </tt>
|
|
<a name="L675"></a><tt class="py-lineno">675</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">r</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">compile</tt><tt class="py-op">(</tt><tt class="py-string">"(?<=[ ,\[])[a-z0-9_\.\@\-]*%X"</tt> <tt class="py-op">%</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-108" class="py-name"><a title="Libs.libanalyze.opCode.getImmConst" class="py-name" href="#" onclick="return doclink('link-108', 'getImmConst', 'link-106');">getImmConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">I</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L676"></a><tt class="py-lineno">676</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">r</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">'CONST'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L677"></a><tt class="py-lineno">677</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-109" class="py-name"><a title="Libs.libanalyze.opCode.getImmConst" class="py-name" href="#" onclick="return doclink('link-109', 'getImmConst', 'link-106');">getImmConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-op">></tt> <tt class="py-number">0xFFFFBFFF</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L678"></a><tt class="py-lineno">678</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("neg part!. %X: %X"%(op.getImmConst(),op.getImmConst()-0x100000000))</tt> </tt>
|
|
<a name="L679"></a><tt class="py-lineno">679</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">r</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">compile</tt><tt class="py-op">(</tt><tt class="py-string">"(?<=[ ,\[])[a-z0-9_\.\@\-]*\%X"</tt> <tt class="py-op">%</tt> <tt class="py-op">(</tt><tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-110" class="py-name"><a title="Libs.libanalyze.opCode.getImmConst" class="py-name" href="#" onclick="return doclink('link-110', 'getImmConst', 'link-106');">getImmConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">-</tt><tt class="py-number">0x100000000</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">I</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L680"></a><tt class="py-lineno">680</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">r</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">'CONST'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L681"></a><tt class="py-lineno">681</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-111" class="py-name" targets="Method Libs.libanalyze.opCode.getAddrConst()=Libs.libanalyze.opCode-class.html#getAddrConst"><a title="Libs.libanalyze.opCode.getAddrConst" class="py-name" href="#" onclick="return doclink('link-111', 'getAddrConst', 'link-111');">getAddrConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L682"></a><tt class="py-lineno">682</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">indexed</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L683"></a><tt class="py-lineno">683</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">asm</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-string">"["</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">+</tt><tt class="py-string">"[CONST]"</tt><tt class="py-op">+</tt><tt class="py-name">asm</tt><tt class="py-op">.</tt><tt class="py-name">split</tt><tt class="py-op">(</tt><tt class="py-string">"]"</tt><tt class="py-op">)</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L684"></a><tt class="py-lineno">684</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L685"></a><tt class="py-lineno">685</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-string">"%+X"</tt> <tt class="py-op">%</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">unpack</tt><tt class="py-op">(</tt><tt class="py-string">"l"</tt><tt class="py-op">,</tt> <tt class="py-name">struct</tt><tt class="py-op">.</tt><tt class="py-name">pack</tt><tt class="py-op">(</tt><tt class="py-string">"L"</tt><tt class="py-op">,</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-112" class="py-name"><a title="Libs.libanalyze.opCode.getAddrConst" class="py-name" href="#" onclick="return doclink('link-112', 'getAddrConst', 'link-111');">getAddrConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L686"></a><tt class="py-lineno">686</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">asm</tt><tt class="py-op">.</tt><tt class="py-name">replace</tt><tt class="py-op">(</tt><tt class="py-name">tmp</tt><tt class="py-op">,</tt><tt class="py-string">"+CONST"</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L687"></a><tt class="py-lineno">687</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-113" class="py-name"><a title="Libs.libanalyze.opCode.getJmpConst" class="py-name" href="#" onclick="return doclink('link-113', 'getJmpConst', 'link-43');">getJmpConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L688"></a><tt class="py-lineno">688</tt> <tt class="py-line"> <tt class="py-name">r</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">compile</tt><tt class="py-op">(</tt><tt class="py-string">"(?<=[ ,\[])[a-z0-9_\.\-\@]*%X"</tt> <tt class="py-op">%</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-114" class="py-name"><a title="Libs.libanalyze.opCode.getJmpConst" class="py-name" href="#" onclick="return doclink('link-114', 'getJmpConst', 'link-43');">getJmpConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt><tt class="py-op">,</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">I</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L689"></a><tt class="py-lineno">689</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">r</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">'CONST'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L690"></a><tt class="py-lineno">690</tt> <tt class="py-line"> </tt>
|
|
<a name="L691"></a><tt class="py-lineno">691</tt> <tt class="py-line"> <tt class="py-comment">#<JMP &msvcrt._initterm> --> CONST</tt> </tt>
|
|
<a name="L692"></a><tt class="py-lineno">692</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)<[a-z\.&_0-9\@\-]+>'</tt><tt class="py-op">,</tt> <tt class="py-string">"CONST"</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L693"></a><tt class="py-lineno">693</tt> <tt class="py-line"> </tt>
|
|
<a name="L694"></a><tt class="py-lineno">694</tt> <tt class="py-line"> <tt class="py-comment">#CALL schannel._SetWrapNoEncrypt@12 --> CONST</tt> </tt>
|
|
<a name="L695"></a><tt class="py-lineno">695</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)[a-z\.&_0-9\@\-]+\.[a-z\.&_0-9\@\-]+'</tt><tt class="py-op">,</tt><tt class="py-string">"CONST"</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L696"></a><tt class="py-lineno">696</tt> <tt class="py-line"> </tt>
|
|
<a name="L697"></a><tt class="py-lineno">697</tt> <tt class="py-line"> <tt class="py-comment">#generalize registers</tt> </tt>
|
|
<a name="L698"></a><tt class="py-lineno">698</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt id="link-115" class="py-name"><a title="Libs.libanalyze.opCode.getAddrConst" class="py-name" href="#" onclick="return doclink('link-115', 'getAddrConst', 'link-111');">getAddrConst</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> <tt class="py-keyword">or</tt> <tt class="py-keyword">not</tt> <tt class="py-name">op</tt><tt class="py-op">.</tt><tt class="py-name">indexed</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L699"></a><tt class="py-lineno">699</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)(?<![A-Z])E([ABCD]X|[SD]I)(?![A-Z])'</tt><tt class="py-op">,</tt> <tt class="py-string">'R32'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L700"></a><tt class="py-lineno">700</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L701"></a><tt class="py-lineno">701</tt> <tt class="py-line"> <tt class="py-comment">#this's a workaround until we fix wildcard searching</tt> </tt>
|
|
<a name="L702"></a><tt class="py-lineno">702</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)(?<![A-Z\+\-\[])E([ABCD]X|[SD]I)(?![A-Z])'</tt><tt class="py-op">,</tt> <tt class="py-string">'R32'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L703"></a><tt class="py-lineno">703</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)(?<![A-Z])([ABCD]X|[SD]I)(?![A-Z])'</tt><tt class="py-op">,</tt> <tt class="py-string">'R16'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L704"></a><tt class="py-lineno">704</tt> <tt class="py-line"> <tt class="py-name">asm</tt> <tt class="py-op">=</tt> <tt class="py-name">re</tt><tt class="py-op">.</tt><tt class="py-name">sub</tt><tt class="py-op">(</tt><tt class="py-string">r'(?i)(?<![A-Z])[ABCD][HL](?![A-Z])'</tt><tt class="py-op">,</tt> <tt class="py-string">'R8'</tt><tt class="py-op">,</tt> <tt class="py-name">asm</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L705"></a><tt class="py-lineno">705</tt> <tt class="py-line"> </tt>
|
|
<a name="L706"></a><tt class="py-lineno">706</tt> <tt class="py-line"> <tt class="py-comment">#XXX: we can decide to forget some opcodes using ANY n</tt> </tt>
|
|
<a name="L707"></a><tt class="py-lineno">707</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-comment">#XXX: we can support replacing registers with RA and RB</tt> </tt>
|
|
<a name="L708"></a><tt class="py-lineno">708</tt> <tt class="py-line"><tt class="py-comment"></tt> </tt>
|
|
<a name="L709"></a><tt class="py-lineno">709</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">asm</tt> </tt>
|
|
</div><a name="L710"></a><tt class="py-lineno">710</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.findBasicBlockHeuristically"></a><div id="FunctionRecognition.findBasicBlockHeuristically-def"><a name="L711"></a><tt class="py-lineno">711</tt> <a class="py-toggle" href="#" id="FunctionRecognition.findBasicBlockHeuristically-toggle" onclick="return toggle('FunctionRecognition.findBasicBlockHeuristically');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#findBasicBlockHeuristically">findBasicBlockHeuristically</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">firstbb</tt><tt class="py-op">,</tt> <tt class="py-param">maxsteps</tt><tt class="py-op">=</tt><tt class="py-number">20</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.findBasicBlockHeuristically-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.findBasicBlockHeuristically-expanded"><a name="L712"></a><tt class="py-lineno">712</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L713"></a><tt class="py-lineno">713</tt> <tt class="py-line"><tt class="py-docstring"> Try to match a generalized BB with an address range (moving backward).</tt> </tt>
|
|
<a name="L714"></a><tt class="py-lineno">714</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L715"></a><tt class="py-lineno">715</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L716"></a><tt class="py-lineno">716</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address used to match with the generalized BB</tt> </tt>
|
|
<a name="L717"></a><tt class="py-lineno">717</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L718"></a><tt class="py-lineno">718</tt> <tt class="py-line"><tt class="py-docstring"> @type firstbb: LIST</tt> </tt>
|
|
<a name="L719"></a><tt class="py-lineno">719</tt> <tt class="py-line"><tt class="py-docstring"> @param firstbb: a list of generalized assembler instructions</tt> </tt>
|
|
<a name="L720"></a><tt class="py-lineno">720</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L721"></a><tt class="py-lineno">721</tt> <tt class="py-line"><tt class="py-docstring"> @type maxsteps: INTEGER</tt> </tt>
|
|
<a name="L722"></a><tt class="py-lineno">722</tt> <tt class="py-line"><tt class="py-docstring"> @param maxsteps: max amount of steps to go backward looking for a BB</tt> </tt>
|
|
<a name="L723"></a><tt class="py-lineno">723</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L724"></a><tt class="py-lineno">724</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: DWORD|None</tt> </tt>
|
|
<a name="L725"></a><tt class="py-lineno">725</tt> <tt class="py-line"><tt class="py-docstring"> @return: starting address of the BB that match with the generalized version or None if we don't find it</tt> </tt>
|
|
<a name="L726"></a><tt class="py-lineno">726</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L727"></a><tt class="py-lineno">727</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("whole firstbb: %s" % firstbb)</tt> </tt>
|
|
<a name="L728"></a><tt class="py-lineno">728</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">index</tt> <tt class="py-op">=</tt> <tt class="py-name">address</tt> </tt>
|
|
<a name="L729"></a><tt class="py-lineno">729</tt> <tt class="py-line"> <tt class="py-name">instr</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L730"></a><tt class="py-lineno">730</tt> <tt class="py-line"> <tt class="py-keyword">while</tt> <tt class="py-name">instr</tt> <tt class="py-op"><</tt> <tt class="py-name">maxsteps</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L731"></a><tt class="py-lineno">731</tt> <tt class="py-line"> <tt class="py-name">num</tt> <tt class="py-op">=</tt> <tt class="py-number">0</tt> </tt>
|
|
<a name="L732"></a><tt class="py-lineno">732</tt> <tt class="py-line"> <tt class="py-name">notmatch</tt> <tt class="py-op">=</tt> <tt class="py-name">False</tt> </tt>
|
|
<a name="L733"></a><tt class="py-lineno">733</tt> <tt class="py-line"> <tt class="py-comment">#compare the whole BB</tt> </tt>
|
|
<a name="L734"></a><tt class="py-lineno">734</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">for</tt> <tt class="py-name">cmp</tt> <tt class="py-keyword">in</tt> <tt class="py-name">firstbb</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L735"></a><tt class="py-lineno">735</tt> <tt class="py-line"> <tt class="py-name">gen</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-116" class="py-name"><a title="Libs.librecognition.FunctionRecognition.generalizeInstruction" class="py-name" href="#" onclick="return doclink('link-116', 'generalizeInstruction', 'link-99');">generalizeInstruction</a></tt><tt class="py-op">(</tt><tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-117" class="py-name" targets="Method Libs.immlib.Debugger.disasmForward()=Libs.immlib.Debugger-class.html#disasmForward"><a title="Libs.immlib.Debugger.disasmForward" class="py-name" href="#" onclick="return doclink('link-117', 'disasmForward', 'link-117');">disasmForward</a></tt><tt class="py-op">(</tt><tt class="py-name">index</tt><tt class="py-op">,</tt> <tt class="py-name">num</tt><tt class="py-op">)</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L736"></a><tt class="py-lineno">736</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">gen</tt> <tt class="py-op">!=</tt> <tt class="py-name">cmp</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L737"></a><tt class="py-lineno">737</tt> <tt class="py-line"> <tt class="py-name">notmatch</tt> <tt class="py-op">=</tt> <tt class="py-name">True</tt> </tt>
|
|
<a name="L738"></a><tt class="py-lineno">738</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("%s != %s. idx=%08X - num=%d" % (gen,cmp,index,num))</tt> </tt>
|
|
<a name="L739"></a><tt class="py-lineno">739</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">break</tt> </tt>
|
|
<a name="L740"></a><tt class="py-lineno">740</tt> <tt class="py-line"> <tt class="py-name">num</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L741"></a><tt class="py-lineno">741</tt> <tt class="py-line"> </tt>
|
|
<a name="L742"></a><tt class="py-lineno">742</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">notmatch</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L743"></a><tt class="py-lineno">743</tt> <tt class="py-line"> <tt class="py-name">index</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-118" class="py-name" targets="Method Libs.immlib.Debugger.disasmBackward()=Libs.immlib.Debugger-class.html#disasmBackward"><a title="Libs.immlib.Debugger.disasmBackward" class="py-name" href="#" onclick="return doclink('link-118', 'disasmBackward', 'link-118');">disasmBackward</a></tt><tt class="py-op">(</tt><tt class="py-name">index</tt><tt class="py-op">,</tt> <tt class="py-number">1</tt><tt class="py-op">)</tt><tt class="py-op">.</tt><tt id="link-119" class="py-name" targets="Method Libs.debugtypes.Stack.getAddress()=Libs.debugtypes.Stack-class.html#getAddress,Method Libs.debugtypes.Symbol.getAddress()=Libs.debugtypes.Symbol-class.html#getAddress,Method Libs.immlib.Debugger.getAddress()=Libs.immlib.Debugger-class.html#getAddress,Method Libs.libanalyze.opCode.getAddress()=Libs.libanalyze.opCode-class.html#getAddress,Method Libs.libdatatype.Data.getAddress()=Libs.libdatatype.Data-class.html#getAddress"><a title="Libs.debugtypes.Stack.getAddress
|
|
Libs.debugtypes.Symbol.getAddress
|
|
Libs.immlib.Debugger.getAddress
|
|
Libs.libanalyze.opCode.getAddress
|
|
Libs.libdatatype.Data.getAddress" class="py-name" href="#" onclick="return doclink('link-119', 'getAddress', 'link-119');">getAddress</a></tt><tt class="py-op">(</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L744"></a><tt class="py-lineno">744</tt> <tt class="py-line"> <tt class="py-name">instr</tt> <tt class="py-op">+=</tt> <tt class="py-number">1</tt> </tt>
|
|
<a name="L745"></a><tt class="py-lineno">745</tt> <tt class="py-line"> <tt class="py-keyword">else</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L746"></a><tt class="py-lineno">746</tt> <tt class="py-line"> <tt class="py-comment">#self.imm.Log("BB found using heuristic", index)</tt> </tt>
|
|
<a name="L747"></a><tt class="py-lineno">747</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-keyword">return</tt> <tt class="py-name">index</tt> </tt>
|
|
<a name="L748"></a><tt class="py-lineno">748</tt> <tt class="py-line"> </tt>
|
|
<a name="L749"></a><tt class="py-lineno">749</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">None</tt> </tt>
|
|
</div><a name="L750"></a><tt class="py-lineno">750</tt> <tt class="py-line"> </tt>
|
|
<a name="FunctionRecognition.findFirstBB"></a><div id="FunctionRecognition.findFirstBB-def"><a name="L751"></a><tt class="py-lineno">751</tt> <a class="py-toggle" href="#" id="FunctionRecognition.findFirstBB-toggle" onclick="return toggle('FunctionRecognition.findFirstBB');">-</a><tt class="py-line"> <tt class="py-keyword">def</tt> <a class="py-def-name" href="Libs.librecognition.FunctionRecognition-class.html#findFirstBB">findFirstBB</a><tt class="py-op">(</tt><tt class="py-param">self</tt><tt class="py-op">,</tt> <tt class="py-param">address</tt><tt class="py-op">,</tt> <tt class="py-param">recursive</tt><tt class="py-op">=</tt><tt class="py-name">False</tt><tt class="py-op">)</tt><tt class="py-op">:</tt> </tt>
|
|
</div><div id="FunctionRecognition.findFirstBB-collapsed" style="display:none;" pad="+++" indent="++++++++"></div><div id="FunctionRecognition.findFirstBB-expanded"><a name="L752"></a><tt class="py-lineno">752</tt> <tt class="py-line"> <tt class="py-docstring">"""</tt> </tt>
|
|
<a name="L753"></a><tt class="py-lineno">753</tt> <tt class="py-line"><tt class="py-docstring"> The main idea is traverse a function backward following Xrefs until we reach a point where there's no more Xrefs other than CALLs</tt> </tt>
|
|
<a name="L754"></a><tt class="py-lineno">754</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L755"></a><tt class="py-lineno">755</tt> <tt class="py-line"><tt class="py-docstring"> @type address: DWORD</tt> </tt>
|
|
<a name="L756"></a><tt class="py-lineno">756</tt> <tt class="py-line"><tt class="py-docstring"> @param address: address used find the first BB</tt> </tt>
|
|
<a name="L757"></a><tt class="py-lineno">757</tt> <tt class="py-line"><tt class="py-docstring"> </tt> </tt>
|
|
<a name="L758"></a><tt class="py-lineno">758</tt> <tt class="py-line"><tt class="py-docstring"> @rtype: DWORD|None</tt> </tt>
|
|
<a name="L759"></a><tt class="py-lineno">759</tt> <tt class="py-line"><tt class="py-docstring"> @return: Address of the first BB of the function or None if we don't find it</tt> </tt>
|
|
<a name="L760"></a><tt class="py-lineno">760</tt> <tt class="py-line"><tt class="py-docstring"> """</tt> </tt>
|
|
<a name="L761"></a><tt class="py-lineno">761</tt> <tt class="py-line"> </tt>
|
|
<a name="L762"></a><tt class="py-lineno">762</tt> <tt class="py-line"> <tt class="py-name">poss</tt> <tt class="py-op">=</tt> <tt class="py-op">[</tt><tt class="py-op">]</tt> </tt>
|
|
<a name="L763"></a><tt class="py-lineno">763</tt> <tt class="py-line"> </tt>
|
|
<a name="L764"></a><tt class="py-lineno">764</tt> <tt class="py-line"> <tt class="py-name">xref</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt class="py-name">imm</tt><tt class="py-op">.</tt><tt id="link-120" class="py-name" targets="Method Libs.debugtypes.Module.getXrefFrom()=Libs.debugtypes.Module-class.html#getXrefFrom,Method Libs.immlib.Debugger.getXrefFrom()=Libs.immlib.Debugger-class.html#getXrefFrom"><a title="Libs.debugtypes.Module.getXrefFrom
|
|
Libs.immlib.Debugger.getXrefFrom" class="py-name" href="#" onclick="return doclink('link-120', 'getXrefFrom', 'link-120');">getXrefFrom</a></tt><tt class="py-op">(</tt><tt class="py-name">address</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L765"></a><tt class="py-lineno">765</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">info</tt> <tt class="py-keyword">in</tt> <tt class="py-name">xref</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L766"></a><tt class="py-lineno">766</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">1</tt><tt class="py-op">]</tt> <tt class="py-op">!=</tt> <tt class="py-number">3</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L767"></a><tt class="py-lineno">767</tt> <tt class="py-line"> <tt class="py-comment">#not a CALL xref</tt> </tt>
|
|
<a name="L768"></a><tt class="py-lineno">768</tt> <tt class="py-line"><tt class="py-comment"></tt> <tt class="py-name">poss</tt><tt class="py-op">.</tt><tt id="link-121" class="py-name"><a title="Libs.libheap.PLook.append" class="py-name" href="#" onclick="return doclink('link-121', 'append', 'link-3');">append</a></tt><tt class="py-op">(</tt><tt class="py-name">info</tt><tt class="py-op">[</tt><tt class="py-number">0</tt><tt class="py-op">]</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L769"></a><tt class="py-lineno">769</tt> <tt class="py-line"> </tt>
|
|
<a name="L770"></a><tt class="py-lineno">770</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">xref</tt> <tt class="py-keyword">and</tt> <tt class="py-keyword">not</tt> <tt class="py-name">recursive</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L771"></a><tt class="py-lineno">771</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">None</tt> </tt>
|
|
<a name="L772"></a><tt class="py-lineno">772</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-keyword">not</tt> <tt class="py-name">poss</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L773"></a><tt class="py-lineno">773</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">address</tt> </tt>
|
|
<a name="L774"></a><tt class="py-lineno">774</tt> <tt class="py-line"> </tt>
|
|
<a name="L775"></a><tt class="py-lineno">775</tt> <tt class="py-line"> <tt class="py-keyword">for</tt> <tt class="py-name">addy</tt> <tt class="py-keyword">in</tt> <tt class="py-name">poss</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L776"></a><tt class="py-lineno">776</tt> <tt class="py-line"> <tt class="py-name">tmp</tt> <tt class="py-op">=</tt> <tt class="py-name">self</tt><tt class="py-op">.</tt><tt id="link-122" class="py-name"><a title="Libs.librecognition.FunctionRecognition.findFirstBB" class="py-name" href="#" onclick="return doclink('link-122', 'findFirstBB', 'link-66');">findFirstBB</a></tt><tt class="py-op">(</tt><tt class="py-name">addy</tt><tt class="py-op">,</tt> <tt class="py-name">True</tt><tt class="py-op">)</tt> </tt>
|
|
<a name="L777"></a><tt class="py-lineno">777</tt> <tt class="py-line"> <tt class="py-keyword">if</tt> <tt class="py-name">tmp</tt><tt class="py-op">:</tt> </tt>
|
|
<a name="L778"></a><tt class="py-lineno">778</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">addy</tt> </tt>
|
|
<a name="L779"></a><tt class="py-lineno">779</tt> <tt class="py-line"> </tt>
|
|
<a name="L780"></a><tt class="py-lineno">780</tt> <tt class="py-line"> <tt class="py-keyword">return</tt> <tt class="py-name">None</tt> </tt>
|
|
</div></div><a name="L781"></a><tt class="py-lineno">781</tt> <tt class="py-line"> </tt><script type="text/javascript">
|
|
<!--
|
|
expandto(location.href);
|
|
// -->
|
|
</script>
|
|
</pre>
|
|
<br />
|
|
<!-- ==================== NAVIGATION BAR ==================== -->
|
|
<table class="navbar" border="0" width="100%" cellpadding="0"
|
|
bgcolor="#a0c0ff" cellspacing="0">
|
|
<tr valign="middle">
|
|
|
|
<!-- Tree link -->
|
|
<th> <a
|
|
href="module-tree.html">Trees</a> </th>
|
|
|
|
<!-- Index link -->
|
|
<th> <a
|
|
href="identifier-index.html">Indices</a> </th>
|
|
|
|
<!-- Help link -->
|
|
<th> <a
|
|
href="help.html">Help</a> </th>
|
|
|
|
<!-- Project homepage -->
|
|
<th class="navbar" align="right" width="100%">
|
|
<table border="0" cellpadding="0" cellspacing="0">
|
|
<tr><th class="navbar" align="center"
|
|
>Immunity Debugger API Reference</th>
|
|
</tr></table></th>
|
|
</tr>
|
|
</table>
|
|
<table border="0" cellpadding="0" cellspacing="0" width="100%%">
|
|
<tr>
|
|
<td align="left" class="footer">
|
|
Generated by Epydoc 3.0.1 on Thu Sep 11 14:06:40 2008
|
|
</td>
|
|
<td align="right" class="footer">
|
|
<a target="mainFrame" href="http://epydoc.sourceforge.net"
|
|
>http://epydoc.sourceforge.net</a>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
|
|
<script type="text/javascript">
|
|
<!--
|
|
// Private objects are initially displayed (because if
|
|
// javascript is turned off then we want them to be
|
|
// visible); but by default, we want to hide them. So hide
|
|
// them unless we have a cookie that says to show them.
|
|
checkCookie();
|
|
// -->
|
|
</script>
|
|
</body>
|
|
</html>
|