blob: b21a2a2740038c17f6ed43cd8f43c9f774c4fe94 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
/*
* Outputs the syscall numbers called by a binary.
*/
#include <sys/stat.h>
#include <iostream>
#include <cstdlib>
#include "binaryninjacore.h"
#include "binaryninjaapi.h"
#include "lowlevelilinstruction.h"
using namespace BinaryNinja;
using namespace std;
bool is_file(char* fname)
{
struct stat buf;
if (stat(fname, &buf) == 0 && (buf.st_mode & S_IFREG) == S_IFREG)
return true;
return false;
}
int main(int argc, char* argv[])
{
if (argc != 2)
{
cerr << "USAGE: " << argv[0] << " <file_name>" << endl;
exit(-1);
}
char* fname = argv[1];
if (!is_file(fname))
{
cerr << "Error: " << fname << " is not a regular file" << endl;
exit(-1);
}
/* In order to initiate the bundled plugins properly, the location
* of where bundled plugins directory is must be set.*/
SetBundledPluginDirectory(GetBundledPluginDirectory());
InitPlugins();
Ref<BinaryData> bd = new BinaryData(new FileMetadata(), argv[1]);
Ref<BinaryView> bv;
for (auto type : BinaryViewType::GetViewTypes())
{
if (type->IsTypeValidForData(bd) && type->GetName() != "Raw")
{
bv = type->Create(bd);
break;
}
}
if (!bv || bv->GetTypeName() == "Raw")
{
fprintf(stderr, "Input file does not appear to be an exectuable\n");
return -1;
}
bv->UpdateAnalysisAndWait();
auto arch = bv->GetDefaultArchitecture();
auto platform = bv->GetDefaultPlatform();
auto cc = platform->GetSystemCallConvention();
if (!cc)
{
cerr << "Error: No system call conventions found for " << platform->GetName() << endl;
exit(-1);
}
auto reg = cc->GetIntegerArgumentRegisters()[0];
for (Function* func : bv->GetAnalysisFunctionList())
{
auto il_func = func->GetLowLevelIL();
for (size_t i = 0; i < il_func->GetInstructionCount(); i++)
{
auto instr = (*il_func)[il_func->GetIndexForInstruction(i)];
if (instr.operation == LLIL_SYSCALL)
{
auto reg_value = il_func->GetRegisterValueAtInstruction(reg, i);
cout << "System call address: 0x" << hex << instr.address << " - " << dec << reg_value.value << endl;
}
}
}
// Shutting down is required to allow for clean exit of the core
BNShutdown();
return 0;
}
|
