diff options
Diffstat (limited to 'python/examples')
| -rw-r--r-- | python/examples/encoded_strings.py | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/python/examples/encoded_strings.py b/python/examples/encoded_strings.py index ce7d02db..691d116c 100644 --- a/python/examples/encoded_strings.py +++ b/python/examples/encoded_strings.py @@ -1,8 +1,11 @@ -from binaryninja import (ConstantRenderer, PointerType, InstructionTextToken, InstructionTextTokenType, DataBuffer) +from binaryninja import (StringRecognizer, CustomStringType, DataBuffer, DerivedString, DerivedStringLocation, + DerivedStringLocationType, PointerType, InstructionTextToken, InstructionTextTokenType) +encoded_string_type = CustomStringType.register("Encoded", "", "_enc") -class EncodedStringConstantRenderer(ConstantRenderer): - renderer_name = "encoded_strings" + +class EncodedStringRecognizer(StringRecognizer): + recognizer_name = "encoded_strings" decoders = { "xor_encoded": lambda encoded, key: encoded ^ key, "sub_encoded": lambda encoded, key: (encoded - key) & 0xff, @@ -17,9 +20,9 @@ class EncodedStringConstantRenderer(ConstantRenderer): return True return False - def render_constant_pointer(self, instr, type, val, tokens, settings, precedence): + def recognize_constant_pointer(self, instr, type, val): if not isinstance(type, PointerType): - return False + return None values = None decoder = None @@ -29,9 +32,9 @@ class EncodedStringConstantRenderer(ConstantRenderer): values = bytes.fromhex(type.target.attributes[name]) decoder = self.__class__.decoders[name] except: - return False + return None if values is None or decoder is None: - return False + return None encoded_null = "encoded_null" in type.target.attributes @@ -49,10 +52,8 @@ class EncodedStringConstantRenderer(ConstantRenderer): result += bytes([byte]) i += 1 - tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, "\"")) - tokens.append(InstructionTextToken(InstructionTextTokenType.StringToken, DataBuffer(result).escape())) - tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, "\"_enc")) - return True + loc = DerivedStringLocation(DerivedStringLocationType.DataBackedStringLocation, val, i) + return DerivedString(result, loc, encoded_string_type) -EncodedStringConstantRenderer().register() +EncodedStringRecognizer().register() |
