From 5d4fc5f1fb7a0c368d2a048a5d750564c970c9c9 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 13 Oct 2025 19:35:01 -0400 Subject: Add derived strings and string recognizer API --- python/examples/encoded_strings.py | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) (limited to 'python/examples/encoded_strings.py') diff --git a/python/examples/encoded_strings.py b/python/examples/encoded_strings.py index ce7d02db..691d116c 100644 --- a/python/examples/encoded_strings.py +++ b/python/examples/encoded_strings.py @@ -1,8 +1,11 @@ -from binaryninja import (ConstantRenderer, PointerType, InstructionTextToken, InstructionTextTokenType, DataBuffer) +from binaryninja import (StringRecognizer, CustomStringType, DataBuffer, DerivedString, DerivedStringLocation, + DerivedStringLocationType, PointerType, InstructionTextToken, InstructionTextTokenType) +encoded_string_type = CustomStringType.register("Encoded", "", "_enc") -class EncodedStringConstantRenderer(ConstantRenderer): - renderer_name = "encoded_strings" + +class EncodedStringRecognizer(StringRecognizer): + recognizer_name = "encoded_strings" decoders = { "xor_encoded": lambda encoded, key: encoded ^ key, "sub_encoded": lambda encoded, key: (encoded - key) & 0xff, @@ -17,9 +20,9 @@ class EncodedStringConstantRenderer(ConstantRenderer): return True return False - def render_constant_pointer(self, instr, type, val, tokens, settings, precedence): + def recognize_constant_pointer(self, instr, type, val): if not isinstance(type, PointerType): - return False + return None values = None decoder = None @@ -29,9 +32,9 @@ class EncodedStringConstantRenderer(ConstantRenderer): values = bytes.fromhex(type.target.attributes[name]) decoder = self.__class__.decoders[name] except: - return False + return None if values is None or decoder is None: - return False + return None encoded_null = "encoded_null" in type.target.attributes @@ -49,10 +52,8 @@ class EncodedStringConstantRenderer(ConstantRenderer): result += bytes([byte]) i += 1 - tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, "\"")) - tokens.append(InstructionTextToken(InstructionTextTokenType.StringToken, DataBuffer(result).escape())) - tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, "\"_enc")) - return True + loc = DerivedStringLocation(DerivedStringLocationType.DataBackedStringLocation, val, i) + return DerivedString(result, loc, encoded_string_type) -EncodedStringConstantRenderer().register() +EncodedStringRecognizer().register() -- cgit v1.3.1