ROSE  0.9.10.95
ModulesPe.h
1 #ifndef ROSE_Partitioner2_ModulesPe_H
2 #define ROSE_Partitioner2_ModulesPe_H
3 
4 #include <Partitioner2/Function.h>
5 #include <Partitioner2/Modules.h>
6 #include <Sawyer/Map.h>
7 
8 namespace Rose {
9 namespace BinaryAnalysis {
10 namespace Partitioner2 {
11 
13 namespace ModulesPe {
14 
22 std::string systemFunctionName(const std::string&);
23 
30 
37 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmPEFileHeader*);
38 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmInterpretation*);
39 size_t findExportFunctions(const Partitioner&, SgAsmInterpretation*, std::vector<Function::Ptr>&);
49 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmPEFileHeader*);
50 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmInterpretation*);
51 size_t findImportFunctions(const Partitioner&, SgAsmPEFileHeader*, const ImportIndex&, std::vector<Function::Ptr>&);
57 ImportIndex getImportIndex(const Partitioner&, SgAsmPEFileHeader*);
58 ImportIndex getImportIndex(const Partitioner&, SgAsmInterpretation*);
59 size_t getImportIndex(const Partitioner&, SgAsmPEFileHeader*, ImportIndex&);
63 void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index);
64 
71 
74 
81 public:
84 
86  struct DispatchEntry { // one entry of PEScrambler's dispatch table
87  uint32_t returnVa; // return address for dispatcher call
88  uint32_t calleeVa; // address if function that should have been called
89  DispatchEntry(): returnVa(0), calleeVa(0) {}
90  DispatchEntry(uint32_t returnVa, uint32_t calleeVa): returnVa(returnVa), calleeVa(calleeVa) {}
91  };
92 
98  typedef std::vector<DispatchEntry> DispatchTable;
99 
100 private:
101  rose_addr_t dispatcherVa_; // address of PEScrambler's indirection decoder and dispatcher
102  rose_addr_t dispatchTableVa_; // address of PEScrambler's dispatch table
103  bool reachedEndOfTable_; // true when we cannot read any more table entries
104  bool checkedPreconditions_; // true after we did some first-call precondition checking
105  static const size_t sizeofDispatcherFunction = 65; // default size of PEscrambler dispatcher function in bytes
106  static const size_t bitsPerWord = 32; // this callback only works for 32-bit specimens
107  DispatchTable dispatchTable_; // the entire dispatch table (and possibly more)
108 
109 protected:
110  // Non-subclass users: please use the instance() method instead; these objects are reference counted.
111  PeDescrambler(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
112  : dispatcherVa_(dispatcherVa), dispatchTableVa_(dispatchTableVa), reachedEndOfTable_(false),
113  checkedPreconditions_(false) {}
114 
115 public:
122  static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa) {
123  return Ptr(new PeDescrambler(dispatcherVa, dispatchTableVa));
124  }
125 
130  static Ptr instance(rose_addr_t dispatcherVa) {
131  return Ptr(new PeDescrambler(dispatcherVa, dispatcherVa + sizeofDispatcherFunction));
132  }
133 
138 
140  rose_addr_t dispatcherVa() const { return dispatcherVa_; }
141 
143  rose_addr_t dispatchTableVa() const { return dispatchTableVa_; }
144 
153  const DispatchTable& dispatchTable() const { return dispatchTable_; }
154  DispatchTable& dispatchTable() { return dispatchTable_; }
157  // Callback invoked by the partitioner each time an instruction is appended to a basic block.
158  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
159 
160 private:
161  // True if the only CFG successor for the specified block is the PEScrambler dispatcher and the block ends with a CALL
162  // instruction.
163  bool basicBlockCallsDispatcher(const Partitioner&, const BasicBlock::Ptr&);
164 
165  // Look up the return address in the PEScrambler dispatch table as if we were the dispatcher and return it if found.
166  Sawyer::Optional<rose_addr_t> findCalleeAddress(const Partitioner&, rose_addr_t returnVa);
167 };
168 
169 } // namespace
170 } // namespace
171 } // namespace
172 } // namespace
173 
174 #endif
void nameImportThunks(const Partitioner &, SgAsmInterpretation *)
Names functions that look like they're thunks for imports.
rose_addr_t dispatcherVa() const
Virtual address of PEScrambler dispatch function.
Definition: ModulesPe.h:140
rose_addr_t dispatchTableVa() const
Virtual address of PEScrambler dispatch table.
Definition: ModulesPe.h:143
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:38
std::vector< DispatchEntry > DispatchTable
The function dispatch table.
Definition: ModulesPe.h:98
std::string systemFunctionName(const std::string &)
Convert function name to system representation.
static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:122
Callback to restore PEScrambler function call edges.
Definition: ModulesPe.h:80
Main namespace for the ROSE library.
std::vector< Function::Ptr > findImportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE import sections to find functions.
Reference-counting smart pointer.
Definition: SharedPointer.h:34
Name space for the entire library.
Definition: Access.h:13
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
void nameKeyAddresses(Partitioner &)
Name certain addresses in the specimen.
Sawyer::SharedPointer< PeDescrambler > Ptr
Shared-ownership pointer to a PeDescrambler.
Definition: ModulesPe.h:83
const DispatchTable & dispatchTable() const
Dispatch table.
Definition: ModulesPe.h:153
void buildMayReturnLists(Partitioner &)
Build may-return white and black lists.
ImportIndex getImportIndex(const Partitioner &, SgAsmPEFileHeader *)
Scans PE import sections to build an index.
void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index)
Update import address tables to reflect addresses of imported functions.
static Ptr instance(rose_addr_t dispatcherVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:130
Sawyer::Container::Map< rose_addr_t, SgAsmPEImportItem * > ImportIndex
Index for PE import addresses.
Definition: ModulesPe.h:29
Windows PE file header.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:293
std::vector< Function::Ptr > findExportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE export sections to find functions.
Represents an interpretation of a binary container.
Container associating values with keys.
Definition: Sawyer/Map.h:66