ROSE  0.9.9.109
Public Attributes | List of all members
Rose::BinaryAnalysis::Strings::StringFinder::Settings Struct Reference

Description

Settings and properties.

These properties can be set directly or by the command-line parser.

Definition at line 807 of file BinaryString.h.

#include <BinaryString.h>

Public Attributes

size_t minLength
 Minimum length of matched strings. More...
 
size_t maxLength
 Maximum length of matched strings. More...
 
size_t maxOverlap
 Whether to allow overlapping strings. More...
 
bool keepingOnlyLongest
 Whether to keep only longest non-overlapping strings. More...
 

Member Data Documentation

size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::minLength

Minimum length of matched strings.

Strings having fewer than this many code points are discarded. If minLength is larger than maxLength then no strings will be matched.

Definition at line 812 of file BinaryString.h.

size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::maxLength

Maximum length of matched strings.

Strings having more than this many code points are discarded. If maxLength is smaller than minLength then no strings will be matched.

Definition at line 818 of file BinaryString.h.

size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::maxOverlap

Whether to allow overlapping strings.

The number of strings that can overlap at a single address per encoder. For instance, for C-style NUL-terminated ASCII strings encoded as bytes, if memory contains the consecutive values 'a', 'n', 'i', 'm', 'a', 'l', '\0' then up to seven strings are possible: "animal", "nimal", "imal", "mal", "al", "l", and "". If the maximum overlap is set to three then only "animal", "nimal", and "imal" are found. Setting the maximum overlap to zero has the same effect as setting it to one: no overlapping is allowed. The overlap limits are applied before results are pruned based on length, so if the minimum legnth is four, the "imal" and shorter strings won't be found even though they are decoded under the covers.

A maximum overlap of at least two is recommended if two-byte-per-character encoding is used when detecting NUL-terminated ASCII strings. The reason is that one decoder will be active at one address while another decoder is desired for the next address; then if the first address proves to not be part of a string, the second address can still be detected as a string. Similarly, a maximum overlap of at least four is recommended for four-byte-per-character encodings. Length-encoded strings will have similar issues.

Definition at line 835 of file BinaryString.h.

bool Rose::BinaryAnalysis::Strings::StringFinder::Settings::keepingOnlyLongest

Whether to keep only longest non-overlapping strings.

If set, then only the longest detected strings are kept. The algorithm sorts all detected strings by decreasing length, then removes any string whose memory addresses overlap with any prior string in the list.

Definition at line 841 of file BinaryString.h.


The documentation for this struct was generated from the following file: