ROSE  0.11.109.0
ModulesPe.h
1 #ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesPe_H
2 #define ROSE_BinaryAnalysis_Partitioner2_ModulesPe_H
3 #include <featureTests.h>
4 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
5 
6 #include <Rose/BinaryAnalysis/Partitioner2/Function.h>
7 #include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
8 #include <Sawyer/Map.h>
9 
10 namespace Rose {
11 namespace BinaryAnalysis {
12 namespace Partitioner2 {
13 
15 namespace ModulesPe {
16 
24 std::string systemFunctionName(const std::string&);
25 
32 
39 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmPEFileHeader*);
40 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmInterpretation*);
41 size_t findExportFunctions(const Partitioner&, SgAsmInterpretation*, std::vector<Function::Ptr>&);
51 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmPEFileHeader*);
52 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmInterpretation*);
53 size_t findImportFunctions(const Partitioner&, SgAsmPEFileHeader*, const ImportIndex&, std::vector<Function::Ptr>&);
59 ImportIndex getImportIndex(const Partitioner&, SgAsmPEFileHeader*);
60 ImportIndex getImportIndex(const Partitioner&, SgAsmInterpretation*);
61 size_t getImportIndex(const Partitioner&, SgAsmPEFileHeader*, ImportIndex&);
65 void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index);
66 
73 
76 
83 public:
86 
88  struct DispatchEntry { // one entry of PEScrambler's dispatch table
89  uint32_t returnVa; // return address for dispatcher call
90  uint32_t calleeVa; // address if function that should have been called
91  DispatchEntry(): returnVa(0), calleeVa(0) {}
92  DispatchEntry(uint32_t returnVa, uint32_t calleeVa): returnVa(returnVa), calleeVa(calleeVa) {}
93  };
94 
100  typedef std::vector<DispatchEntry> DispatchTable;
101 
102 private:
103  rose_addr_t dispatcherVa_; // address of PEScrambler's indirection decoder and dispatcher
104  rose_addr_t dispatchTableVa_; // address of PEScrambler's dispatch table
105  bool reachedEndOfTable_; // true when we cannot read any more table entries
106  bool checkedPreconditions_; // true after we did some first-call precondition checking
107  static const size_t sizeofDispatcherFunction = 65; // default size of PEscrambler dispatcher function in bytes
108  static const size_t bitsPerWord = 32; // this callback only works for 32-bit specimens
109  DispatchTable dispatchTable_; // the entire dispatch table (and possibly more)
110 
111 protected:
112  // Non-subclass users: please use the instance() method instead; these objects are reference counted.
113  PeDescrambler(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
114  : dispatcherVa_(dispatcherVa), dispatchTableVa_(dispatchTableVa), reachedEndOfTable_(false),
115  checkedPreconditions_(false) {}
116 
117 public:
124  static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa) {
125  return Ptr(new PeDescrambler(dispatcherVa, dispatchTableVa));
126  }
127 
132  static Ptr instance(rose_addr_t dispatcherVa) {
133  return Ptr(new PeDescrambler(dispatcherVa, dispatcherVa + sizeofDispatcherFunction));
134  }
135 
140 
142  rose_addr_t dispatcherVa() const { return dispatcherVa_; }
143 
145  rose_addr_t dispatchTableVa() const { return dispatchTableVa_; }
146 
155  const DispatchTable& dispatchTable() const { return dispatchTable_; }
156  DispatchTable& dispatchTable() { return dispatchTable_; }
159  // Callback invoked by the partitioner each time an instruction is appended to a basic block.
160  virtual bool operator()(bool chain, const Args&) override;
161 
162 private:
163  // True if the only CFG successor for the specified block is the PEScrambler dispatcher and the block ends with a CALL
164  // instruction.
165  bool basicBlockCallsDispatcher(const Partitioner&, const BasicBlock::Ptr&);
166 
167  // Look up the return address in the PEScrambler dispatch table as if we were the dispatcher and return it if found.
168  Sawyer::Optional<rose_addr_t> findCalleeAddress(const Partitioner&, rose_addr_t returnVa);
169 };
170 
171 } // namespace
172 } // namespace
173 } // namespace
174 } // namespace
175 
176 #endif
177 #endif
void nameImportThunks(const Partitioner &, SgAsmInterpretation *)
Names functions that look like they're thunks for imports.
rose_addr_t dispatcherVa() const
Virtual address of PEScrambler dispatch function.
Definition: ModulesPe.h:142
rose_addr_t dispatchTableVa() const
Virtual address of PEScrambler dispatch table.
Definition: ModulesPe.h:145
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:42
std::vector< DispatchEntry > DispatchTable
The function dispatch table.
Definition: ModulesPe.h:100
std::string systemFunctionName(const std::string &)
Convert function name to system representation.
static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:124
Callback to restore PEScrambler function call edges.
Definition: ModulesPe.h:82
Main namespace for the ROSE library.
std::vector< Function::Ptr > findImportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE import sections to find functions.
Reference-counting intrusive smart pointer.
Definition: SharedPointer.h:68
void nameKeyAddresses(Partitioner &)
Name certain addresses in the specimen.
Sawyer::SharedPointer< PeDescrambler > Ptr
Shared-ownership pointer to a PeDescrambler.
Definition: ModulesPe.h:85
const DispatchTable & dispatchTable() const
Dispatch table.
Definition: ModulesPe.h:155
virtual bool operator()(bool chain, const Args &) override
Callback method.
void buildMayReturnLists(Partitioner &)
Build may-return white and black lists.
ImportIndex getImportIndex(const Partitioner &, SgAsmPEFileHeader *)
Scans PE import sections to build an index.
void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index)
Update import address tables to reflect addresses of imported functions.
static Ptr instance(rose_addr_t dispatcherVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:132
Sawyer::Container::Map< rose_addr_t, SgAsmPEImportItem * > ImportIndex
Index for PE import addresses.
Definition: ModulesPe.h:31
Windows PE file header.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:294
std::vector< Function::Ptr > findExportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE export sections to find functions.
Represents an interpretation of a binary container.
Container associating values with keys.
Definition: Sawyer/Map.h:66