ROSE  0.9.9.139
ModulesPe.h
1 #ifndef ROSE_Partitioner2_ModulesPe_H
2 #define ROSE_Partitioner2_ModulesPe_H
3 
4 #include <Partitioner2/Function.h>
5 #include <Partitioner2/Modules.h>
6 
7 namespace Rose {
8 namespace BinaryAnalysis {
9 namespace Partitioner2 {
10 namespace ModulesPe {
11 
19 std::string systemFunctionName(const std::string&);
20 
27 
34 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmPEFileHeader*);
35 std::vector<Function::Ptr> findExportFunctions(const Partitioner&, SgAsmInterpretation*);
36 size_t findExportFunctions(const Partitioner&, SgAsmInterpretation*, std::vector<Function::Ptr>&);
46 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmPEFileHeader*);
47 std::vector<Function::Ptr> findImportFunctions(const Partitioner&, SgAsmInterpretation*);
48 size_t findImportFunctions(const Partitioner&, SgAsmPEFileHeader*, const ImportIndex&, std::vector<Function::Ptr>&);
54 ImportIndex getImportIndex(const Partitioner&, SgAsmPEFileHeader*);
55 ImportIndex getImportIndex(const Partitioner&, SgAsmInterpretation*);
56 size_t getImportIndex(const Partitioner&, SgAsmPEFileHeader*, ImportIndex&);
60 void rebaseImportAddressTables(Partitioner &partitioner, const ImportIndex &index);
61 
67 void nameImportThunks(const Partitioner&, SgAsmInterpretation*);
68 
70 void buildMayReturnLists(Partitioner&);
71 
78 public:
81 
83  struct DispatchEntry { // one entry of PEScrambler's dispatch table
84  uint32_t returnVa; // return address for dispatcher call
85  uint32_t calleeVa; // address if function that should have been called
86  DispatchEntry(): returnVa(0), calleeVa(0) {}
87  DispatchEntry(uint32_t returnVa, uint32_t calleeVa): returnVa(returnVa), calleeVa(calleeVa) {}
88  };
89 
95  typedef std::vector<DispatchEntry> DispatchTable;
96 
97 private:
98  rose_addr_t dispatcherVa_; // address of PEScrambler's indirection decoder and dispatcher
99  rose_addr_t dispatchTableVa_; // address of PEScrambler's dispatch table
100  bool reachedEndOfTable_; // true when we cannot read any more table entries
101  bool checkedPreconditions_; // true after we did some first-call precondition checking
102  static const size_t sizeofDispatcherFunction = 65; // default size of PEscrambler dispatcher function in bytes
103  static const size_t bitsPerWord = 32; // this callback only works for 32-bit specimens
104  DispatchTable dispatchTable_; // the entire dispatch table (and possibly more)
105 
106 protected:
107  // Non-subclass users: please use the instance() method instead; these objects are reference counted.
108  PeDescrambler(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
109  : dispatcherVa_(dispatcherVa), dispatchTableVa_(dispatchTableVa), reachedEndOfTable_(false),
110  checkedPreconditions_(false) {}
111 
112 public:
119  static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa) {
120  return Ptr(new PeDescrambler(dispatcherVa, dispatchTableVa));
121  }
122 
127  static Ptr instance(rose_addr_t dispatcherVa) {
128  return Ptr(new PeDescrambler(dispatcherVa, dispatcherVa + sizeofDispatcherFunction));
129  }
130 
135 
137  rose_addr_t dispatcherVa() const { return dispatcherVa_; }
138 
140  rose_addr_t dispatchTableVa() const { return dispatchTableVa_; }
141 
150  const DispatchTable& dispatchTable() const { return dispatchTable_; }
151  DispatchTable& dispatchTable() { return dispatchTable_; }
154  // Callback invoked by the partitioner each time an instruction is appended to a basic block.
155  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
156 
157 private:
158  // True if the only CFG successor for the specified block is the PEScrambler dispatcher and the block ends with a CALL
159  // instruction.
160  bool basicBlockCallsDispatcher(const Partitioner&, const BasicBlock::Ptr&);
161 
162  // Look up the return address in the PEScrambler dispatch table as if we were the dispatcher and return it if found.
163  Sawyer::Optional<rose_addr_t> findCalleeAddress(const Partitioner&, rose_addr_t returnVa);
164 };
165 
166 } // namespace
167 } // namespace
168 } // namespace
169 } // namespace
170 
171 #endif
rose_addr_t dispatcherVa() const
Virtual address of PEScrambler dispatch function.
Definition: ModulesPe.h:137
rose_addr_t dispatchTableVa() const
Virtual address of PEScrambler dispatch table.
Definition: ModulesPe.h:140
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:38
std::vector< DispatchEntry > DispatchTable
The function dispatch table.
Definition: ModulesPe.h:95
static Ptr instance(rose_addr_t dispatcherVa, rose_addr_t dispatchTableVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:119
Callback to restore PEScrambler function call edges.
Definition: ModulesPe.h:77
Main namespace for the ROSE library.
Reference-counting smart pointer.
Definition: SharedPointer.h:34
Name space for the entire library.
Definition: Access.h:11
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
void nameKeyAddresses(Partitioner &)
Name certain addresses in the specimen.
Sawyer::SharedPointer< PeDescrambler > Ptr
Shared-ownership pointer to a PeDescrambler.
Definition: ModulesPe.h:80
const DispatchTable & dispatchTable() const
Dispatch table.
Definition: ModulesPe.h:150
static Ptr instance(rose_addr_t dispatcherVa)
Construct a new PeDescrambler.
Definition: ModulesPe.h:127
Windows PE file header.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:290
Represents an interpretation of a binary container.
Container associating values with keys.
Definition: Sawyer/Map.h:64