ROSE 0.11.145.147
Classes | Typedefs | Functions
Rose::BinaryAnalysis::Partitioner2::ModulesPe Namespace Reference

Description

Disassembly and partitioning utilities for PE files.

Classes

class  PeDescrambler
 Callback to restore PEScrambler function call edges. More...
 

Typedefs

typedef Sawyer::Container::Map< rose_addr_t, SgAsmPEImportItem * > ImportIndex
 Index for PE import addresses.
 

Functions

std::string systemFunctionName (const std::string &)
 Convert function name to system representation.
 
void rebaseImportAddressTables (const PartitionerPtr &partitioner, const ImportIndex &index)
 Update import address tables to reflect addresses of imported functions.
 
void nameImportThunks (const PartitionerConstPtr &, SgAsmInterpretation *)
 Names functions that look like they're thunks for imports.
 
void buildMayReturnLists (const PartitionerPtr &)
 Build may-return white and black lists.
 
std::vector< FunctionPtrfindExportFunctions (const PartitionerConstPtr &, SgAsmPEFileHeader *)
 Reads PE export sections to find functions.
 
std::vector< FunctionPtrfindExportFunctions (const PartitionerConstPtr &, SgAsmInterpretation *)
 Reads PE export sections to find functions.
 
size_t findExportFunctions (const PartitionerConstPtr &, SgAsmInterpretation *, std::vector< FunctionPtr > &)
 Reads PE export sections to find functions.
 
std::vector< FunctionPtrfindImportFunctions (const PartitionerConstPtr &, SgAsmPEFileHeader *)
 Reads PE import sections to find functions.
 
std::vector< FunctionPtrfindImportFunctions (const PartitionerConstPtr &, SgAsmInterpretation *)
 Reads PE import sections to find functions.
 
size_t findImportFunctions (const PartitionerConstPtr &, SgAsmPEFileHeader *, const ImportIndex &, std::vector< FunctionPtr > &)
 Reads PE import sections to find functions.
 
ImportIndex getImportIndex (const PartitionerConstPtr &, SgAsmPEFileHeader *)
 Scans PE import sections to build an index.
 
ImportIndex getImportIndex (const PartitionerConstPtr &, SgAsmInterpretation *)
 Scans PE import sections to build an index.
 
size_t getImportIndex (const PartitionerConstPtr &, SgAsmPEFileHeader *, ImportIndex &)
 Scans PE import sections to build an index.
 

Typedef Documentation

◆ ImportIndex

Index for PE import addresses.

This is a map from possible import addresses to the item in the Import Address Table (IAT) that describes the function that will be imported to that address. The map probably contains at least two addresses per function, the absolute address and a relative address, because we're not sure which is contained in the IAT – it depends on whether a linker has run.

Definition at line 31 of file ModulesPe.h.

Function Documentation

◆ systemFunctionName()

std::string Rose::BinaryAnalysis::Partitioner2::ModulesPe::systemFunctionName ( const std::string &  )

Convert function name to system representation.

ROSE always stores library function names as "function@library", and this function rewrites such names to be similar to the way thy're typically presented on a particular operating system. For instance, "EncodePointer@KERNEL32.dll" will be rewritten to "KERNEL32.dll:EncodePointer" since that's how it typically appears in Windows tools.

See also
Modules::canonicalFunctionName

◆ findExportFunctions() [1/3]

std::vector< FunctionPtr > Rose::BinaryAnalysis::Partitioner2::ModulesPe::findExportFunctions ( const PartitionerConstPtr ,
SgAsmPEFileHeader  
)

Reads PE export sections to find functions.

Scans all PE export sections under the specified PE file header to obtain names and addresses for functions. Returns a list of new, unique functions sorted by entry address.

◆ findExportFunctions() [2/3]

std::vector< FunctionPtr > Rose::BinaryAnalysis::Partitioner2::ModulesPe::findExportFunctions ( const PartitionerConstPtr ,
SgAsmInterpretation  
)

Reads PE export sections to find functions.

Scans all PE export sections under the specified PE file header to obtain names and addresses for functions. Returns a list of new, unique functions sorted by entry address.

◆ findExportFunctions() [3/3]

size_t Rose::BinaryAnalysis::Partitioner2::ModulesPe::findExportFunctions ( const PartitionerConstPtr ,
SgAsmInterpretation ,
std::vector< FunctionPtr > &   
)

Reads PE export sections to find functions.

Scans all PE export sections under the specified PE file header to obtain names and addresses for functions. Returns a list of new, unique functions sorted by entry address.

◆ findImportFunctions() [1/3]

std::vector< FunctionPtr > Rose::BinaryAnalysis::Partitioner2::ModulesPe::findImportFunctions ( const PartitionerConstPtr ,
SgAsmPEFileHeader  
)

Reads PE import sections to find functions.

Scans all PE import sections in the specified interpretation to obtain addresses where imported functions will be mapped or have been mapped, depending on whether a dynamic linker has run. The return value is a list of new, unique functions sorted by entry address.

◆ findImportFunctions() [2/3]

std::vector< FunctionPtr > Rose::BinaryAnalysis::Partitioner2::ModulesPe::findImportFunctions ( const PartitionerConstPtr ,
SgAsmInterpretation  
)

Reads PE import sections to find functions.

Scans all PE import sections in the specified interpretation to obtain addresses where imported functions will be mapped or have been mapped, depending on whether a dynamic linker has run. The return value is a list of new, unique functions sorted by entry address.

◆ findImportFunctions() [3/3]

size_t Rose::BinaryAnalysis::Partitioner2::ModulesPe::findImportFunctions ( const PartitionerConstPtr ,
SgAsmPEFileHeader ,
const ImportIndex ,
std::vector< FunctionPtr > &   
)

Reads PE import sections to find functions.

Scans all PE import sections in the specified interpretation to obtain addresses where imported functions will be mapped or have been mapped, depending on whether a dynamic linker has run. The return value is a list of new, unique functions sorted by entry address.

◆ nameImportThunks()

void Rose::BinaryAnalysis::Partitioner2::ModulesPe::nameImportThunks ( const PartitionerConstPtr ,
SgAsmInterpretation  
)

Names functions that look like they're thunks for imports.

An import thunk is an indirect unconditional jump through a read-only import address table to a virtual address where an external function will be dynamically linked. The dynamic linking will have already taken place if a linker was used prior to disassembly.