From 93e0a64e77169c29960a1cbd9bdedadfeb4a5f7e Mon Sep 17 00:00:00 2001
From: Mason Reed <mason@vector35.com>
Date: Wed, 23 Oct 2024 22:10:17 -0400
Subject: Add MSVC RTTI plugin

Adds two commands that must be run manually "MSVC\\Find RTTI" and "MSVC\\Find VFTs" both of which will apply their respective data to the view AND store metadata for scripts to use under the "msvc" key.
---
 plugins/msvc_rtti/plugin.cpp | 70 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 plugins/msvc_rtti/plugin.cpp

(limited to 'plugins/msvc_rtti/plugin.cpp')

diff --git a/plugins/msvc_rtti/plugin.cpp b/plugins/msvc_rtti/plugin.cpp
new file mode 100644
index 00000000..452ef9f4
--- /dev/null
+++ b/plugins/msvc_rtti/plugin.cpp
@@ -0,0 +1,70 @@
+#include "rtti.h"
+
+#include <thread>
+
+using namespace BinaryNinja;
+
+static Ref<BackgroundTask> rttiBackgroundTask = nullptr;
+static Ref<BackgroundTask> vftBackgroundTask = nullptr;
+
+void ScanRTTI(Ref<BinaryView> view)
+{
+	std::thread scanThread([view = std::move(view)]() {
+		rttiBackgroundTask = new BackgroundTask("Scanning for RTTI...", false);
+		auto processor = MicrosoftRTTIProcessor(view);
+		processor.ProcessRTTI();
+		view->StoreMetadata(VIEW_METADATA_MSVC, processor.SerializedMetadata(), true);
+		rttiBackgroundTask->Finish();
+	});
+	scanThread.detach();
+}
+
+void ScanVFT(Ref<BinaryView> view)
+{
+	std::thread scanThread([view = std::move(view)]() {
+		vftBackgroundTask = new BackgroundTask("Scanning for VFTs...", false);
+		auto processor = MicrosoftRTTIProcessor(view);
+		processor.ProcessVFT();
+		view->StoreMetadata(VIEW_METADATA_MSVC, processor.SerializedMetadata(), true);
+		vftBackgroundTask->Finish();
+	});
+	scanThread.detach();
+}
+
+bool MetadataExists(Ref<BinaryView> view)
+{
+	return view->QueryMetadata(VIEW_METADATA_MSVC) != nullptr;
+}
+
+
+extern "C" {
+	BN_DECLARE_CORE_ABI_VERSION
+
+	BINARYNINJAPLUGIN bool CorePluginInit()
+	{
+		// TODO: In the future we will have a module level workflow which:
+		// TODO:	1. Symbolizes RTTI information
+		// TODO:	2. Creates Virtual Function Tables
+		// TODO:	3. Populates MSVC metadata entry
+		// TODO: And a function level workflow which:
+		// TODO:	1. Uses MSVC metadata to identify if a function is apart of a VFT
+		// TODO:	2. Identify if the function is unique to a class, renaming and retyping if true
+		// TODO:	3. Identify functions which address a VFT and are probably a constructor (alloc use), retyping if true
+		// TODO:	4. Identify functions which address a VFT and are probably a deconstructor (free use), retyping if true
+
+		// Ref<Workflow> msvcWorkflow = Workflow::Instance("core.function.defaultAnalysis")->Clone("MSVCWorkflow");
+		// msvcWorkflow->RegisterActivity(new Activity("extension.msvc.rttiAnalysis", &RTTIAnalysis));
+		// msvcWorkflow->Insert("core.module.defaultAnalysis", "extension.msvc.rttiAnalysis");
+		// Workflow::RegisterWorkflow(msvcWorkflow,
+		// 	R"#({
+		// 	"title" : "MSVC Workflow",
+		// 	"description" : "Analyze MSVC RTTI",
+		// 	"capabilities" : []
+		// 	})#");
+
+		PluginCommand::Register("MSVC\\Find RTTI", "Scans for all RTTI in view.", ScanRTTI);
+		PluginCommand::Register("MSVC\\Find VFTs", "Scans for all VFTs in the view.", ScanVFT, MetadataExists);
+
+		return true;
+	}
+}
\ No newline at end of file
-- 
cgit v1.3.1