From 7f08117cfeb48a8f48d08e14cb498ee028efcef2 Mon Sep 17 00:00:00 2001
From: Zichuan Li <34680029+river-li@users.noreply.github.com>
Date: Thu, 15 Aug 2024 11:53:05 -0400
Subject: Move EFI Resolver to API

Support all existing features in EFI Resolver,
1. Doesn't support running on existing BNDBs (though we tried to support
this in python plugins, it doesn't work well)
2. Perform analysis on MLIL rather than HLIL, previous pattern matching
on HLIL constains many false negatives
---
 platform/efi/efi_resolver/src/GuidRenderer.cpp | 56 ++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 platform/efi/efi_resolver/src/GuidRenderer.cpp

(limited to 'platform/efi/efi_resolver/src/GuidRenderer.cpp')

diff --git a/platform/efi/efi_resolver/src/GuidRenderer.cpp b/platform/efi/efi_resolver/src/GuidRenderer.cpp
new file mode 100644
index 00000000..ef148094
--- /dev/null
+++ b/platform/efi/efi_resolver/src/GuidRenderer.cpp
@@ -0,0 +1,56 @@
+#include "GuidRenderer.h"
+
+bool isType(const vector<pair<Type*, size_t>>& context, const string& name)
+{
+    if (context.empty())
+        return false;
+
+    auto [deepestType, size] = context.back();
+    if (!deepestType->IsNamedTypeRefer())
+        return false;
+
+    return deepestType->GetTypeName().GetString() == name;
+}
+
+bool EfiGuidRenderer::IsValidForData(BinaryView* bv, uint64_t address, Type* type,
+    vector<pair<Type*, size_t>>& context)
+{
+    return isType(context, "EFI_GUID");
+}
+
+static string formatGuid(uint32_t data1, uint16_t data2, uint16_t data3, uint64_t data4)
+{
+    std::ostringstream oss;
+    oss << std::hex << std::uppercase << std::setfill('0')
+        << std::setw(8) << data1 << "-"
+        << std::setw(4) << data2 << "-"
+        << std::setw(4) << data3 << "-"
+        << std::setw(16) << data4;
+    return oss.str();
+}
+
+vector<DisassemblyTextLine> EfiGuidRenderer::GetLinesForData(
+    BinaryView* bv, uint64_t address, Type*, const vector<InstructionTextToken>& prefix,
+    size_t, vector<pair<Type*, size_t>>& context)
+{
+    BinaryReader reader(bv);
+    reader.Seek(address);
+    auto data1 = reader.Read32();
+    auto data2 = reader.Read16();
+    auto data3 = reader.Read16();
+    auto data4 = reader.ReadBE64();
+    string guidStr = formatGuid(data1, data2, data3, data4);
+
+    DisassemblyTextLine line;
+    line.addr = address;
+    line.tokens = prefix;
+    line.tokens.emplace_back(TextToken, "[EFI_GUID(\"");
+    line.tokens.emplace_back(StringToken, guidStr);
+    line.tokens.emplace_back(TextToken, "\")]");
+    return { line };
+}
+
+void EfiGuidRenderer::Register()
+{
+    DataRendererContainer::RegisterTypeSpecificDataRenderer(new EfiGuidRenderer());
+}
-- 
cgit v1.3.1