From 274e9caf8d26d8b4deb122898f75093c30177417 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 17 Aug 2015 22:41:58 -0400 Subject: Architecture-specific function recognizers and ARM64 PLT analysis --- architecture.cpp | 6 ++++++ binaryninjaapi.h | 6 ++++++ binaryview.cpp | 7 +++++++ functionrecognizer.cpp | 9 +++++++++ 4 files changed, 28 insertions(+) diff --git a/architecture.cpp b/architecture.cpp index 6b9440d6..16ea982f 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -484,6 +484,12 @@ bool Architecture::SkipAndReturnValue(uint8_t*, uint64_t, size_t, uint64_t) } +void Architecture::RegisterFunctionRecognizer(FunctionRecognizer* recog) +{ + FunctionRecognizer::RegisterArchitectureFunctionRecognizer(this, recog); +} + + CoreArchitecture::CoreArchitecture(BNArchitecture* arch): Architecture(arch) { } diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 28ef54b6..c875eb5b 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -408,6 +408,8 @@ namespace BinaryNinja uint64_t GetAddress() const; bool IsAutoDefined() const; void SetAutoDefined(bool val); + + static Ref ImportedFunctionFromImportAddressSymbol(Symbol* sym, uint64_t addr); }; struct ReferenceSource @@ -797,6 +799,7 @@ namespace BinaryNinja }; class LowLevelILFunction; + class FunctionRecognizer; typedef size_t ExprId; @@ -882,6 +885,8 @@ namespace BinaryNinja virtual bool AlwaysBranch(uint8_t* data, uint64_t addr, size_t len); virtual bool InvertBranch(uint8_t* data, uint64_t addr, size_t len); virtual bool SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value); + + void RegisterFunctionRecognizer(FunctionRecognizer* recog); }; class CoreArchitecture: public Architecture @@ -1274,6 +1279,7 @@ namespace BinaryNinja FunctionRecognizer(); static void RegisterGlobalRecognizer(FunctionRecognizer* recog); + static void RegisterArchitectureFunctionRecognizer(Architecture* arch, FunctionRecognizer* recog); virtual bool RecognizeLowLevelIL(BinaryView* data, Function* func, LowLevelILFunction* il); }; diff --git a/binaryview.cpp b/binaryview.cpp index 7d9af62e..0c73918a 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -1,4 +1,5 @@ #include "binaryninjaapi.h" +#include "binaryview.h" using namespace BinaryNinja; using namespace std; @@ -142,6 +143,12 @@ void Symbol::SetAutoDefined(bool val) } +Ref Symbol::ImportedFunctionFromImportAddressSymbol(Symbol* sym, uint64_t addr) +{ + return new Symbol(BNImportedFunctionFromImportAddressSymbol(sym->GetSymbolObject(), addr)); +} + + BinaryView::BinaryView(const std::string& typeName, FileMetadata* file) { BNCustomBinaryView view; diff --git a/functionrecognizer.cpp b/functionrecognizer.cpp index 6aa89098..6943bf03 100644 --- a/functionrecognizer.cpp +++ b/functionrecognizer.cpp @@ -27,6 +27,15 @@ void FunctionRecognizer::RegisterGlobalRecognizer(FunctionRecognizer* recog) } +void FunctionRecognizer::RegisterArchitectureFunctionRecognizer(Architecture* arch, FunctionRecognizer* recog) +{ + BNFunctionRecognizer reg; + reg.context = recog; + reg.recognizeLowLevelIL = RecognizeLowLevelILCallback; + BNRegisterArchitectureFunctionRecognizer(arch->GetArchitectureObject(), ®); +} + + bool FunctionRecognizer::RecognizeLowLevelIL(BinaryView*, Function*, LowLevelILFunction*) { return false; -- cgit v1.3.1