ROSE 0.11.145.147
ModulesPe.h
1#ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesPe_H
2#define ROSE_BinaryAnalysis_Partitioner2_ModulesPe_H
3#include <featureTests.h>
4#ifdef ROSE_ENABLE_BINARY_ANALYSIS
5#include <Rose/BinaryAnalysis/Partitioner2/BasicTypes.h>
6
7#include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
8#include <Sawyer/Map.h>
9
10namespace Rose {
11namespace BinaryAnalysis {
12namespace Partitioner2 {
13
15namespace ModulesPe {
16
24std::string systemFunctionName(const std::string&);
25
32
41size_t findExportFunctions(const PartitionerConstPtr&, SgAsmInterpretation*, std::vector<FunctionPtr>&);
53size_t findImportFunctions(const PartitionerConstPtr&, SgAsmPEFileHeader*, const ImportIndex&, std::vector<FunctionPtr>&);
65void rebaseImportAddressTables(const PartitionerPtr &partitioner, const ImportIndex &index);
66
73
76
83public:
86
88 struct DispatchEntry { // one entry of PEScrambler's dispatch table
89 uint32_t returnVa; // return address for dispatcher call
90 uint32_t calleeVa; // address if function that should have been called
91 DispatchEntry(): returnVa(0), calleeVa(0) {}
92 DispatchEntry(uint32_t returnVa, uint32_t calleeVa): returnVa(returnVa), calleeVa(calleeVa) {}
93 };
94
100 typedef std::vector<DispatchEntry> DispatchTable;
101
102private:
103 rose_addr_t dispatcherVa_; // address of PEScrambler's indirection decoder and dispatcher
104 rose_addr_t dispatchTableVa_; // address of PEScrambler's dispatch table
105 bool reachedEndOfTable_; // true when we cannot read any more table entries
106 bool checkedPreconditions_; // true after we did some first-call precondition checking
107 static const size_t sizeofDispatcherFunction = 65; // default size of PEscrambler dispatcher function in bytes
108 static const size_t bitsPerWord = 32; // this callback only works for 32-bit specimens
109 DispatchTable dispatchTable_; // the entire dispatch table (and possibly more)
110
111protected:
112 // Non-subclass users: please use the instance() method instead; these objects are reference counted.
113 PeDescrambler(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
114 : dispatcherVa_(dispatcherVa), dispatchTableVa_(dispatchTableVa), reachedEndOfTable_(false),
115 checkedPreconditions_(false) {}
116
117public:
124 static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa) {
126 }
127
132 static Ptr instance(rose_addr_t dispatcherVa) {
133 return Ptr(new PeDescrambler(dispatcherVa, dispatcherVa + sizeofDispatcherFunction));
134 }
135
140
142 rose_addr_t dispatcherVa() const { return dispatcherVa_; }
143
145 rose_addr_t dispatchTableVa() const { return dispatchTableVa_; }
146
155 const DispatchTable& dispatchTable() const { return dispatchTable_; }
156 DispatchTable& dispatchTable() { return dispatchTable_; }
159 // Callback invoked by the partitioner each time an instruction is appended to a basic block.
160 virtual bool operator()(bool chain, const Args&) override;
161
162private:
163 // True if the only CFG successor for the specified block is the PEScrambler dispatcher and the block ends with a CALL
164 // instruction.
165 bool basicBlockCallsDispatcher(const PartitionerConstPtr&, const BasicBlockPtr&);
166
167 // Look up the return address in the PEScrambler dispatch table as if we were the dispatcher and return it if found.
168 Sawyer::Optional<rose_addr_t> findCalleeAddress(const PartitionerConstPtr&, rose_addr_t returnVa);
169};
170
171} // namespace
172} // namespace
173} // namespace
174} // namespace
175
176#endif
177#endif
Base class for adjusting basic blocks during discovery.
Definition Modules.h:39
Callback to restore PEScrambler function call edges.
Definition ModulesPe.h:82
void nameKeyAddresses(const PartitionerPtr &)
Name certain addresses in the specimen.
static Ptr instance(rose_addr_t dispatcherVa)
Construct a new PeDescrambler.
Definition ModulesPe.h:132
Sawyer::SharedPointer< PeDescrambler > Ptr
Shared-ownership pointer to a PeDescrambler.
Definition ModulesPe.h:85
virtual bool operator()(bool chain, const Args &) override
Callback method.
rose_addr_t dispatchTableVa() const
Virtual address of PEScrambler dispatch table.
Definition ModulesPe.h:145
std::vector< DispatchEntry > DispatchTable
The function dispatch table.
Definition ModulesPe.h:100
rose_addr_t dispatcherVa() const
Virtual address of PEScrambler dispatch function.
Definition ModulesPe.h:142
const DispatchTable & dispatchTable() const
Dispatch table.
Definition ModulesPe.h:155
static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
Construct a new PeDescrambler.
Definition ModulesPe.h:124
Container associating values with keys.
Definition Sawyer/Map.h:72
Holds a value or nothing.
Definition Optional.h:56
Represents an interpretation of a binary container.
Windows PE file header.
void nameImportThunks(const PartitionerConstPtr &, SgAsmInterpretation *)
Names functions that look like they're thunks for imports.
void rebaseImportAddressTables(const PartitionerPtr &partitioner, const ImportIndex &index)
Update import address tables to reflect addresses of imported functions.
std::string systemFunctionName(const std::string &)
Convert function name to system representation.
std::vector< FunctionPtr > findImportFunctions(const PartitionerConstPtr &, SgAsmPEFileHeader *)
Reads PE import sections to find functions.
std::vector< FunctionPtr > findExportFunctions(const PartitionerConstPtr &, SgAsmPEFileHeader *)
Reads PE export sections to find functions.
void buildMayReturnLists(const PartitionerPtr &)
Build may-return white and black lists.
ImportIndex getImportIndex(const PartitionerConstPtr &, SgAsmPEFileHeader *)
Scans PE import sections to build an index.
Sawyer::Container::Map< rose_addr_t, SgAsmPEImportItem * > ImportIndex
Index for PE import addresses.
Definition ModulesPe.h:31
The ROSE library.