1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
#pragma once
#include "binaryninjaapi.h"
#include "rtti.h"
namespace BinaryNinja::RTTI::Itanium {
enum TypeInfoVariant
{
TIVFundamental,
TIVArray,
TIVFunction,
TIVEnum,
TIVClass,
TIVSIClass,
TIVVMIClass,
TIVBasePointer,
TIVPointer,
TIVPointerToMember,
};
struct TypeInfo
{
// This might also be zero, and also this is at -1 offset.
uint64_t base;
std::string type_name;
TypeInfo(BinaryView *view, uint64_t address);
};
struct FundamentalTypeInfo : TypeInfo {};
struct ArrayTypeInfo : TypeInfo {};
struct FunctionTypeInfo : TypeInfo {};
struct EnumTypeInfo : TypeInfo {};
struct ClassTypeInfo : TypeInfo
{
ClassTypeInfo(BinaryView *view, uint64_t uint64) : TypeInfo(view, uint64) {}
};
struct SIClassTypeInfo : ClassTypeInfo
{
uint64_t base_type;
SIClassTypeInfo(BinaryView *view, uint64_t address);
};
enum OffsetFlagsMasks
{
virtual_mask = 0x1,
public_mask = 0x2,
offset_shift = 8
};
struct BaseClassTypeInfo
{
uint64_t base_type;
uint64_t offset_flags;
uint64_t offset_flags_masks;
BaseClassTypeInfo(BinaryView *view, uint64_t address);
};
struct VMIClassTypeInfo : ClassTypeInfo
{
uint64_t flags;
uint64_t base_count;
std::vector<BaseClassTypeInfo> base_info;
VMIClassTypeInfo(BinaryView *view, uint64_t address);
};
enum BasePointerMasks
{
// `pointee` type has const qualifier
const_mask = 0x1,
// `pointee` type has volatile qualifier
volatile_mask = 0x2,
// `pointee` type has restrict qualifier
restrict_mask = 0x4,
// `pointee` type is incomplete
incomplete_mask = 0x8,
// class containing `pointee` is incomplete (in pointer to member)
incomplete_class_mask = 0x10,
// `pointee` type is function type without the transaction-safe indication
transaction_safe_mask = 0x20,
// `pointee` type is function type without the exception specification
noexcept_mask = 0x40
};
struct BasePointerTypeInfo : TypeInfo
{
uint64_t flags;
uint64_t pointee;
BasePointerMasks masks;
BasePointerTypeInfo(BinaryView *view, uint64_t address);
};
struct PointerTypeInfo : BasePointerTypeInfo {};
struct PointerToMemberTypeInfo : BasePointerTypeInfo
{
uint64_t context;
PointerToMemberTypeInfo(BinaryView *view, uint64_t address);
};
class ItaniumRTTIProcessor : public RTTIProcessor
{
bool allowMangledClassNames;
bool checkWritableRData;
bool virtualFunctionTableSweep;
std::optional<BaseClassInfo> ProcessVFTBaseClassInfo(uint64_t vftAddr, ClassInfo &classInfo);
std::optional<ClassInfo> ProcessRTTI(uint64_t objectAddr) override;
std::optional<VirtualFunctionTableInfo> ProcessVFT(uint64_t vftAddr, ClassInfo &classInfo, std::optional<BaseClassInfo> baseClassInfo) override;
public:
explicit ItaniumRTTIProcessor(const Ref<BinaryView> &view, bool useMangled = true, bool checkRData = true, bool vttSweep = true);
void ProcessRTTI() override;
void ProcessVFT() override;
};
}
|
