diff options
Diffstat (limited to 'platform')
| -rw-r--r-- | platform/efi/CMakeLists.txt | 33 | ||||
| -rw-r--r-- | platform/efi/LICENSE | 13 | ||||
| -rw-r--r-- | platform/efi/README.md | 23 | ||||
| -rw-r--r-- | platform/efi/platform_efi.cpp | 211 |
4 files changed, 280 insertions, 0 deletions
diff --git a/platform/efi/CMakeLists.txt b/platform/efi/CMakeLists.txt new file mode 100644 index 00000000..62078907 --- /dev/null +++ b/platform/efi/CMakeLists.txt @@ -0,0 +1,33 @@ +cmake_minimum_required(VERSION 3.9 FATAL_ERROR) + +project(platform_efi) + +if(NOT BN_INTERNAL_BUILD) + add_subdirectory(${PROJECT_SOURCE_DIR}/.. ${PROJECT_BINARY_DIR}/api) +endif() + +file(GLOB SOURCES + *.cpp + *.h) + +if(DEMO) + add_library(platform_efi STATIC ${SOURCES}) +else() + add_library(platform_efi SHARED ${SOURCES}) +endif() + +target_link_libraries(platform_efi binaryninjaapi) + +set_target_properties(platform_efi PROPERTIES + CXX_STANDARD 17 + CXX_VISIBILITY_PRESET hidden + CXX_STANDARD_REQUIRED ON + VISIBILITY_INLINES_HIDDEN ON + POSITION_INDEPENDENT_CODE ON) + +if(BN_INTERNAL_BUILD) + plugin_rpath(platform_efi) + set_target_properties(platform_efi PROPERTIES + LIBRARY_OUTPUT_DIRECTORY ${BN_CORE_PLUGIN_DIR} + RUNTIME_OUTPUT_DIRECTORY ${BN_CORE_PLUGIN_DIR}) +endif() diff --git a/platform/efi/LICENSE b/platform/efi/LICENSE new file mode 100644 index 00000000..265883c5 --- /dev/null +++ b/platform/efi/LICENSE @@ -0,0 +1,13 @@ +Copyright 2021 Vector 35 Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/platform/efi/README.md b/platform/efi/README.md new file mode 100644 index 00000000..4b73558a --- /dev/null +++ b/platform/efi/README.md @@ -0,0 +1,23 @@ +# platform-efi +This is the EFI platform plugin that ships with Binary Ninja. + +## Building + +Building the architecture plugin requires `cmake` 3.9 or above. You will also need the +[Binary Ninja API source](https://github.com/Vector35/binaryninja-api). + +Run `cmake`. This can be done either from a separate build directory or from the source +directory. Once that is complete, run `make` in the build directory to compile the plugin. + +The plugin can be found in the root of the build directory as `libplatform_efi.so`, +`libplatform_efi.dylib` or `platform_efi.dll` depending on your platform. + +To install the plugin, first launch Binary Ninja and uncheck the "EFI platform plugin" +option in the "Core Plugins" section. This will cause Binary Ninja to stop loading the +bundled plugin so that its replacement can be loaded. Once this is complete, you can copy +the plugin into the user plugins directory (you can locate this by using the "Open Plugin Folder" +option in the Binary Ninja UI). + +**Do not replace the architecture plugin in the Binary Ninja install directory. This will +be overwritten every time there is a Binary Ninja update. Use the above process to ensure that +updates do not automatically uninstall your custom build.** diff --git a/platform/efi/platform_efi.cpp b/platform/efi/platform_efi.cpp new file mode 100644 index 00000000..bc5dc208 --- /dev/null +++ b/platform/efi/platform_efi.cpp @@ -0,0 +1,211 @@ +#include "binaryninjaapi.h" +#include "lowlevelilinstruction.h" + +using namespace BinaryNinja; +using namespace std; + + +Ref<Platform> g_efiX86, g_efiX64, g_efiArm, g_efiThumb, g_efiArm64; + + +class EFIX86Platform : public Platform +{ +public: + EFIX86Platform(Architecture* arch) : Platform(arch, "efi-x86") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("cdecl"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + } + + cc = arch->GetCallingConventionByName("fastcall"); + if (cc) + RegisterFastcallCallingConvention(cc); + + cc = arch->GetCallingConventionByName("stdcall"); + if (cc) + RegisterStdcallCallingConvention(cc); + + cc = arch->GetCallingConventionByName("thiscall"); + if (cc) + RegisterCallingConvention(cc); + + // Linux-style register convention is commonly used by Borland compilers + cc = arch->GetCallingConventionByName("regparm"); + if (cc) + RegisterCallingConvention(cc); + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() >= 10 && subsystem->GetUnsignedInteger() <= 13) + return g_efiX86; + return nullptr; + } +}; + + +class EFIX64Platform : public Platform +{ +public: + EFIX64Platform(Architecture* arch) : Platform(arch, "efi-x86_64") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("win64"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + RegisterFastcallCallingConvention(cc); + RegisterStdcallCallingConvention(cc); + } + + // Linux-style calling convention is sometimes used internally by EFI applications + cc = arch->GetCallingConventionByName("sysv"); + RegisterCallingConvention(cc); + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() >= 10 && subsystem->GetUnsignedInteger() <= 13) + return g_efiX64; + return nullptr; + } +}; + + +class EFIArmv7Platform : public Platform +{ +public: + EFIArmv7Platform(Architecture* arch, const std::string& name) : Platform(arch, name) + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("cdecl"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + RegisterFastcallCallingConvention(cc); + RegisterStdcallCallingConvention(cc); + } + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() >= 10 && subsystem->GetUnsignedInteger() <= 13) + return g_efiArm; + return nullptr; + } +}; + + +class EFIArm64Platform : public Platform +{ +public: + EFIArm64Platform(Architecture* arch) : Platform(arch, "efi-aarch64") + { + Ref<CallingConvention> cc; + + cc = arch->GetCallingConventionByName("cdecl"); + if (cc) + { + RegisterDefaultCallingConvention(cc); + RegisterCdeclCallingConvention(cc); + RegisterFastcallCallingConvention(cc); + RegisterStdcallCallingConvention(cc); + } + } + + static Ref<Platform> Recognize(BinaryView* view, Metadata* metadata) + { + Ref<Metadata> subsystem = metadata->Get("Subsystem"); + if (!subsystem || !subsystem->IsUnsignedInteger()) + return nullptr; + if (subsystem->GetUnsignedInteger() >= 10 && subsystem->GetUnsignedInteger() <= 13) + return g_efiArm64; + return nullptr; + } +}; + + +extern "C" +{ + BN_DECLARE_CORE_ABI_VERSION + +#ifndef DEMO_VERSION + BINARYNINJAPLUGIN void CorePluginDependencies() + { + AddOptionalPluginDependency("arch_x86"); + AddOptionalPluginDependency("arch_armv7"); + AddOptionalPluginDependency("arch_arm64"); + AddOptionalPluginDependency("view_pe"); + } +#endif + +#ifdef DEMO_VERSION + bool EFIPluginInit() +#else + BINARYNINJAPLUGIN bool CorePluginInit() +#endif + { + Ref<BinaryViewType> pe = BinaryViewType::GetByName("PE"); + if (pe) + { + Ref<Architecture> x86 = Architecture::GetByName("x86"); + if (x86) + { + g_efiX86 = new EFIX86Platform(x86); + Platform::Register("efi", g_efiX86); + pe->RegisterPlatformRecognizer(0x14c, LittleEndian, EFIX86Platform::Recognize); + } + + Ref<Architecture> x64 = Architecture::GetByName("x86_64"); + if (x64) + { + g_efiX64 = new EFIX64Platform(x64); + Platform::Register("efi", g_efiX64); + pe->RegisterPlatformRecognizer(0x8664, LittleEndian, EFIX64Platform::Recognize); + } + + Ref<Architecture> armv7 = Architecture::GetByName("armv7"); + Ref<Architecture> thumb2 = Architecture::GetByName("thumb2"); + if (armv7 && thumb2) + { + g_efiArm = new EFIArmv7Platform(armv7, "efi-armv7"); + g_efiThumb = new EFIArmv7Platform(thumb2, "efi-thumb2"); + g_efiArm->AddRelatedPlatform(thumb2, g_efiThumb); + g_efiThumb->AddRelatedPlatform(armv7, g_efiArm); + Platform::Register("efi", g_efiArm); + Platform::Register("efi", g_efiThumb); + pe->RegisterPlatformRecognizer(0x1c0, LittleEndian, EFIArmv7Platform::Recognize); + pe->RegisterPlatformRecognizer(0x1c2, LittleEndian, EFIArmv7Platform::Recognize); + pe->RegisterPlatformRecognizer(0x1c4, LittleEndian, EFIArmv7Platform::Recognize); + } + + Ref<Architecture> arm64 = Architecture::GetByName("aarch64"); + if (arm64) + { + g_efiArm64 = new EFIArm64Platform(arm64); + Platform::Register("efi", g_efiArm64); + pe->RegisterPlatformRecognizer(0xaa64, LittleEndian, EFIArm64Platform::Recognize); + } + } + + return true; + } +} |