|
ROSE 0.11.145.147
|
Settings and properties.
These properties can be set directly or by the command-line parser.
#include <Rose/BinaryAnalysis/String.h>
Public Attributes | |
| size_t | minLength |
| Minimum length of matched strings. | |
| size_t | maxLength |
| Maximum length of matched strings. | |
| size_t | maxOverlap |
| Whether to allow overlapping strings. | |
| bool | keepingOnlyLongest |
| Whether to keep only longest non-overlapping strings. | |
|
inline |
| size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::minLength |
| size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::maxLength |
| size_t Rose::BinaryAnalysis::Strings::StringFinder::Settings::maxOverlap |
Whether to allow overlapping strings.
The number of strings that can overlap at a single address per encoder. For instance, for C-style NUL-terminated ASCII strings encoded as bytes, if memory contains the consecutive values 'a', 'n', 'i', 'm', 'a', 'l', '\0' then up to seven strings are possible: "animal", "nimal", "imal", "mal", "al", "l", and "". If the maximum overlap is set to three then only "animal", "nimal", and "imal" are found. Setting the maximum overlap to zero has the same effect as setting it to one: no overlapping is allowed. The overlap limits are applied before results are pruned based on length, so if the minimum legnth is four, the "imal" and shorter strings won't be found even though they are decoded under the covers.
A maximum overlap of at least two is recommended if two-byte-per-character encoding is used when detecting NUL-terminated ASCII strings. The reason is that one decoder will be active at one address while another decoder is desired for the next address; then if the first address proves to not be part of a string, the second address can still be detected as a string. Similarly, a maximum overlap of at least four is recommended for four-byte-per-character encodings. Length-encoded strings will have similar issues.
| bool Rose::BinaryAnalysis::Strings::StringFinder::Settings::keepingOnlyLongest |
Whether to keep only longest non-overlapping strings.
If set, then only the longest detected strings are kept. The algorithm sorts all detected strings by decreasing length, then removes any string whose memory addresses overlap with any prior string in the list.
1.9.8