diff options
Diffstat (limited to 'platform/windows-kernel/platform_windows_kernel.cpp')
| -rw-r--r-- | platform/windows-kernel/platform_windows_kernel.cpp | 167 |
1 files changed, 167 insertions, 0 deletions
diff --git a/platform/windows-kernel/platform_windows_kernel.cpp b/platform/windows-kernel/platform_windows_kernel.cpp new file mode 100644 index 00000000..85fdc4cd --- /dev/null +++ b/platform/windows-kernel/platform_windows_kernel.cpp @@ -0,0 +1,167 @@ +#include "binaryninjaapi.h" +#include "lowlevelilinstruction.h" + +using namespace BinaryNinja; +using namespace std; + + +Ref<Platform> g_windowsKernelX86, g_windowsKernelX64, g_windowsKernelArm64; + + +class WindowsKernelX86Platform : public Platform +{ +public: + WindowsKernelX86Platform(Architecture* arch) : Platform(arch, "windows-kernel-x86") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("cdecl"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + } + + cc = arch->GetCallingConventionByName("fastcall"); + if (cc) + RegisterFastcallCallingConvention(cc); + + cc = arch->GetCallingConventionByName("stdcall"); + if (cc) + RegisterStdcallCallingConvention(cc); + + cc = arch->GetCallingConventionByName("thiscall"); + if (cc) + RegisterCallingConvention(cc); + + // Linux-style register convention is commonly used by Borland compilers + cc = arch->GetCallingConventionByName("regparm"); + if (cc) + RegisterCallingConvention(cc); + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() == 1) // IMAGE_SUBSYSTEM_NATIVE + return g_windowsKernelX86; + return nullptr; + } +}; + + +class WindowsKernelX64Platform : public Platform +{ +public: + WindowsKernelX64Platform(Architecture* arch) : Platform(arch, "windows-kernel-x86_64") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("win64"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + RegisterFastcallCallingConvention(cc); + RegisterStdcallCallingConvention(cc); + } + + // Linux-style calling convention is sometimes used internally by WindowsKernel applications + cc = arch->GetCallingConventionByName("sysv"); + RegisterCallingConvention(cc); + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() == 1) // IMAGE_SUBSYSTEM_NATIVE + return g_windowsKernelX64; + return nullptr; + } +}; + + + +class WindowsKernelArm64Platform : public Platform +{ +public: + WindowsKernelArm64Platform(Architecture* arch) : Platform(arch, "windows-kernel-windows-aarch64") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("cdecl"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + RegisterFastcallCallingConvention(cc); + RegisterStdcallCallingConvention(cc); + } + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() == 1) // IMAGE_SUBSYSTEM_NATIVE + return g_windowsKernelArm64; + return nullptr; + } +}; + + +extern "C" +{ + BN_DECLARE_CORE_ABI_VERSION + +#ifndef DEMO_VERSION + BINARYNINJAPLUGIN void CorePluginDependencies() + { + AddOptionalPluginDependency("arch_x86"); + AddOptionalPluginDependency("arch_arm64"); + AddOptionalPluginDependency("view_pe"); + } +#endif + +#ifdef DEMO_VERSION + bool WindowsKernelPluginInit() +#else + BINARYNINJAPLUGIN bool CorePluginInit() +#endif + { + Ref<BinaryViewType> pe = BinaryViewType::GetByName("PE"); + if (pe) + { + Ref<Architecture> x86 = Architecture::GetByName("x86"); + if (x86) + { + g_windowsKernelX86 = new WindowsKernelX86Platform(x86); + Platform::Register("windows-kernel", g_windowsKernelX86); + pe->RegisterPlatformRecognizer(0x14c, LittleEndian, WindowsKernelX86Platform::Recognize); + } + + Ref<Architecture> x64 = Architecture::GetByName("x86_64"); + if (x64) + { + g_windowsKernelX64 = new WindowsKernelX64Platform(x64); + Platform::Register("windows-kernel", g_windowsKernelX64); + pe->RegisterPlatformRecognizer(0x8664, LittleEndian, WindowsKernelX64Platform::Recognize); + } + + Ref<Architecture> arm64 = Architecture::GetByName("aarch64"); + if (arm64) + { + g_windowsKernelArm64 = new WindowsKernelArm64Platform(arm64); + Platform::Register("windows-kernel", g_windowsKernelArm64); + pe->RegisterPlatformRecognizer(0xaa64, LittleEndian, WindowsKernelArm64Platform::Recognize); + } + } + + return true; + } +} |