ROSE  0.11.22.0
ModulesPe.h
1 #ifndef ROSE_Partitioner2_ModulesPe_H
2 #define ROSE_Partitioner2_ModulesPe_H
3 
4 #include <featureTests.h>
5 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
6 
7 #include <Partitioner2/Function.h>
8 #include <Partitioner2/Modules.h>
9 #include <Sawyer/Map.h>
10 
11 namespace Rose {
12 namespace BinaryAnalysis {
13 namespace Partitioner2 {
14 
16 namespace ModulesPe {
17 
25 std::string systemFunctionName(const std::string&);
26 
33 
40 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmPEFileHeader*);
41 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmInterpretation*);
42 size_t findExportFunctions(const Partitioner&, SgAsmInterpretation*, std::vector<Function::Ptr>&);
52 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmPEFileHeader*);
53 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmInterpretation*);
54 size_t findImportFunctions(const Partitioner&, SgAsmPEFileHeader*, const ImportIndex&, std::vector<Function::Ptr>&);
60 ImportIndex getImportIndex(const Partitioner&, SgAsmPEFileHeader*);
61 ImportIndex getImportIndex(const Partitioner&, SgAsmInterpretation*);
62 size_t getImportIndex(const Partitioner&, SgAsmPEFileHeader*, ImportIndex&);
66 void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index);
67 
74 
77 
84 public:
87 
89  struct DispatchEntry { // one entry of PEScrambler's dispatch table
90  uint32_t returnVa; // return address for dispatcher call
91  uint32_t calleeVa; // address if function that should have been called
92  DispatchEntry(): returnVa(0), calleeVa(0) {}
93  DispatchEntry(uint32_t returnVa, uint32_t calleeVa): returnVa(returnVa), calleeVa(calleeVa) {}
94  };
95 
101  typedef std::vector<DispatchEntry> DispatchTable;
102 
103 private:
104  rose_addr_t dispatcherVa_; // address of PEScrambler's indirection decoder and dispatcher
105  rose_addr_t dispatchTableVa_; // address of PEScrambler's dispatch table
106  bool reachedEndOfTable_; // true when we cannot read any more table entries
107  bool checkedPreconditions_; // true after we did some first-call precondition checking
108  static const size_t sizeofDispatcherFunction = 65; // default size of PEscrambler dispatcher function in bytes
109  static const size_t bitsPerWord = 32; // this callback only works for 32-bit specimens
110  DispatchTable dispatchTable_; // the entire dispatch table (and possibly more)
111 
112 protected:
113  // Non-subclass users: please use the instance() method instead; these objects are reference counted.
114  PeDescrambler(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
115  : dispatcherVa_(dispatcherVa), dispatchTableVa_(dispatchTableVa), reachedEndOfTable_(false),
116  checkedPreconditions_(false) {}
117 
118 public:
125  static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa) {
126  return Ptr(new PeDescrambler(dispatcherVa, dispatchTableVa));
127  }
128 
133  static Ptr instance(rose_addr_t dispatcherVa) {
134  return Ptr(new PeDescrambler(dispatcherVa, dispatcherVa + sizeofDispatcherFunction));
135  }
136 
141 
143  rose_addr_t dispatcherVa() const { return dispatcherVa_; }
144 
146  rose_addr_t dispatchTableVa() const { return dispatchTableVa_; }
147 
156  const DispatchTable& dispatchTable() const { return dispatchTable_; }
157  DispatchTable& dispatchTable() { return dispatchTable_; }
160  // Callback invoked by the partitioner each time an instruction is appended to a basic block.
161  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
162 
163 private:
164  // True if the only CFG successor for the specified block is the PEScrambler dispatcher and the block ends with a CALL
165  // instruction.
166  bool basicBlockCallsDispatcher(const Partitioner&, const BasicBlock::Ptr&);
167 
168  // Look up the return address in the PEScrambler dispatch table as if we were the dispatcher and return it if found.
169  Sawyer::Optional<rose_addr_t> findCalleeAddress(const Partitioner&, rose_addr_t returnVa);
170 };
171 
172 } // namespace
173 } // namespace
174 } // namespace
175 } // namespace
176 
177 #endif
178 #endif
void nameImportThunks(const Partitioner &, SgAsmInterpretation *)
Names functions that look like they're thunks for imports.
rose_addr_t dispatcherVa() const
Virtual address of PEScrambler dispatch function.
Definition: ModulesPe.h:143
rose_addr_t dispatchTableVa() const
Virtual address of PEScrambler dispatch table.
Definition: ModulesPe.h:146
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:43
std::vector< DispatchEntry > DispatchTable
The function dispatch table.
Definition: ModulesPe.h:101
std::string systemFunctionName(const std::string &)
Convert function name to system representation.
static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:125
Callback to restore PEScrambler function call edges.
Definition: ModulesPe.h:83
Main namespace for the ROSE library.
std::vector< Function::Ptr > findImportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE import sections to find functions.
Reference-counting intrusive smart pointer.
Definition: SharedPointer.h:68
Name space for the entire library.
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
void nameKeyAddresses(Partitioner &)
Name certain addresses in the specimen.
Sawyer::SharedPointer< PeDescrambler > Ptr
Shared-ownership pointer to a PeDescrambler.
Definition: ModulesPe.h:86
const DispatchTable & dispatchTable() const
Dispatch table.
Definition: ModulesPe.h:156
void buildMayReturnLists(Partitioner &)
Build may-return white and black lists.
ImportIndex getImportIndex(const Partitioner &, SgAsmPEFileHeader *)
Scans PE import sections to build an index.
void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index)
Update import address tables to reflect addresses of imported functions.
static Ptr instance(rose_addr_t dispatcherVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:133
Sawyer::Container::Map< rose_addr_t, SgAsmPEImportItem * > ImportIndex
Index for PE import addresses.
Definition: ModulesPe.h:32
Windows PE file header.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:322
std::vector< Function::Ptr > findExportFunctions(const Partitioner &, SgAsmPEFileHeader *)
Reads PE export sections to find functions.
Represents an interpretation of a binary container.
Container associating values with keys.
Definition: Sawyer/Map.h:66