diff options
Diffstat (limited to 'python/examples')
| -rw-r--r-- | python/examples/jump-table.py | 63 | ||||
| -rw-r--r-- | python/examples/nes.py | 33 |
2 files changed, 89 insertions, 7 deletions
diff --git a/python/examples/jump-table.py b/python/examples/jump-table.py new file mode 100644 index 00000000..f057f52c --- /dev/null +++ b/python/examples/jump-table.py @@ -0,0 +1,63 @@ +# This plugin will attempt to resolve simple jump tables (an array of code pointers) and add the desintations +# as indirect branch targets so that the flow graph reflects the jump table's control flow. +from binaryninja import * +import struct + +def find_jump_table(bv, addr): + for block in bv.get_basic_blocks_at(addr): + func = block.function + arch = func.arch + addrsize = arch.address_size + + # Grab the instruction tokens so that we can look for the table's starting address + tokens, length = arch.get_instruction_text(bv.read(addr, 16), addr) + + # Look for the next jump instruction, which may be the current instruction. Some jump tables will + # compute the address first then jump to the computed address as a separate instruction. + jump_addr = addr + while jump_addr < block.end: + info = arch.get_instruction_info(bv.read(jump_addr, 16), jump_addr) + if len(info.branches) != 0: + break + jump_addr += info.length + if jump_addr >= block.end: + print "Unable to find jump after instruction 0x%x" % addr + continue + print "Jump at 0x%x" % jump_addr + + # Collect the branch targets for any tables referenced by the clicked instruction + branches = [] + for token in tokens: + if token.type == "PossibleAddressToken": # Table addresses will be a "possible address" token + tbl = token.value + print "Found possible table at 0x%x" % tbl + i = 0 + while True: + # Read the next pointer from the table + data = bv.read(tbl + (i * addrsize), addrsize) + if len(data) == addrsize: + if addrsize == 4: + ptr = struct.unpack("<I", data)[0] + else: + ptr = struct.unpack("<Q", data)[0] + + # If the pointer is within the binary, add it as a destination and continue + # to the next entry + if (ptr >= bv.start) and (ptr < bv.end): + print "Found destination 0x%x" % ptr + branches.append((arch, ptr)) + else: + # Once a value that is not a pointer is encountered, the jump table is ended + break + else: + # Reading invalid memory + break + + i += 1 + + # Set the indirect branch targets on the jump instruction to be the list of targets discovered + func.set_user_indirect_branches(arch, jump_addr, branches) + +# Create a plugin command so that the user can right click on an instruction referencing a jump table and +# invoke the command +PluginCommand.register_for_address("Process jump table", "Look for jump table destinations", find_jump_table) diff --git a/python/examples/nes.py b/python/examples/nes.py index 8387ad74..21b02dfa 100644 --- a/python/examples/nes.py +++ b/python/examples/nes.py @@ -231,8 +231,8 @@ OperandIL = [ def cond_branch(il, cond, dest): t = None - if il[dest].operation == "LLIL_CONST": - t = il.get_label_for_address(Architecture['6502'].standalone_platform, il[dest].value) + if il[dest].operation == LLIL_CONST: + t = il.get_label_for_address(Architecture['6502'], il[dest].value) if t is None: t = LowLevelILLabel() indirect = True @@ -248,8 +248,8 @@ def cond_branch(il, cond, dest): def jump(il, dest): label = None - if il[dest].operation == "LLIL_CONST": - label = il.get_label_for_address(Architecture['6502'].standalone_platform, il[dest].value) + if il[dest].operation == LLIL_CONST: + label = il.get_label_for_address(Architecture['6502'], il[dest].value) if label is None: il.append(il.jump(dest)) else: @@ -291,9 +291,9 @@ InstructionIL = { "bcs": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_ULT), operand), "beq": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_E), operand), "bit": lambda il, operand: il.and_expr(1, il.reg(1, "a"), operand, flags = "czs"), - "bmi": lambda il, operand: cond_branch(il, il.flag("s"), operand), + "bmi": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_NEG), operand), "bne": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_NE), operand), - "bpl": lambda il, operand: cond_branch(il, il.not_expr(0, il.flag("s")), operand), + "bpl": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_POS), operand), "brk": lambda il, operand: il.system_call(), "bvc": lambda il, operand: cond_branch(il, il.not_expr(0, il.flag("v")), operand), "bvs": lambda il, operand: cond_branch(il, il.flag("v"), operand), @@ -358,6 +358,26 @@ class M6502(Architecture): stack_pointer = "s" flags = ["c", "z", "i", "d", "b", "v", "s"] flag_write_types = ["*", "czs", "zvs", "zs"] + flag_roles = { + "c": SpecialFlagRole, # Not a normal carry flag, subtract result is inverted + "z": ZeroFlagRole, + "v": OverflowFlagRole, + "s": NegativeSignFlagRole + } + flags_required_for_flag_condition = { + LLFC_UGE: ["c"], + LLFC_ULT: ["c"], + LLFC_E: ["z"], + LLFC_NE: ["z"], + LLFC_NEG: ["s"], + LLFC_POS: ["s"] + } + flags_written_by_flag_write_type = { + "*": ["c", "z", "v", "s"], + "czs": ["c", "z", "s"], + "zvs": ["z", "v", "s"], + "zs": ["z", "s"] + } def decode_instruction(self, data, addr): if len(data) < 1: @@ -678,4 +698,3 @@ for i in xrange(0, 32): NESViewBank.register() M6502.register() - |