1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
use crate::cache::cached_function_guid;
use crate::matcher::cached_function_matcher;
use binaryninja::background_task::BackgroundTask;
use binaryninja::binary_view::{BinaryView, BinaryViewExt};
use binaryninja::command::Command;
use binaryninja::low_level_il::function::RegularNonSSA;
use binaryninja::workflow::{Activity, AnalysisContext, Workflow};
use std::time::Instant;
pub const MATCHER_ACTIVITY_NAME: &str = "analysis.warp.matcher";
const MATCHER_ACTIVITY_CONFIG: &str = r#"{
"name": "analysis.warp.matcher",
"title" : "WARP Matcher",
"description": "This analysis step applies WARP info to matched functions...",
"eligibility": {
"auto": {},
"runOnce": true
}
}"#;
pub const GUID_ACTIVITY_NAME: &str = "analysis.warp.guid";
const GUID_ACTIVITY_CONFIG: &str = r#"{
"name": "analysis.warp.guid",
"title" : "WARP GUID Generator",
"description": "This analysis step generates the GUID for all analyzed functions...",
"eligibility": {
"auto": {},
"runOnce": true
}
}"#;
pub struct RunMatcher;
impl Command for RunMatcher {
fn action(&self, view: &BinaryView) {
let view = view.to_owned();
// TODO: Check to see if the GUID cache is empty and ask the user if they want to regenerate the guids.
std::thread::spawn(move || {
let undo_id = view.file().begin_undo_actions(true);
let background_task = BackgroundTask::new("Matching on functions...", false);
let start = Instant::now();
view.functions()
.iter()
.for_each(|function| cached_function_matcher(&function));
log::info!("Function matching took {:?}", start.elapsed());
background_task.finish();
view.file().commit_undo_actions(undo_id);
// Now we want to trigger re-analysis.
view.update_analysis();
});
}
fn valid(&self, _view: &BinaryView) -> bool {
true
}
}
pub fn insert_workflow() {
let matcher_activity = |ctx: &AnalysisContext| {
let view = ctx.view();
let undo_id = view.file().begin_undo_actions(true);
let background_task = BackgroundTask::new("Matching on functions...", false);
let start = Instant::now();
view.functions()
.iter()
.for_each(|function| cached_function_matcher(&function));
log::info!("Function matching took {:?}", start.elapsed());
background_task.finish();
view.file().commit_undo_actions(undo_id);
// Now we want to trigger re-analysis.
view.update_analysis();
};
let guid_activity = |ctx: &AnalysisContext| {
let function = ctx.function();
// TODO: Returning RegularNonSSA means we cant modify the il (the lifting code was written just for lifted il, that needs to be fixed)
if let Some(llil) = unsafe { ctx.llil_function::<RegularNonSSA>() } {
cached_function_guid(&function, &llil);
}
};
let old_function_meta_workflow = Workflow::instance("core.function.metaAnalysis");
let function_meta_workflow = old_function_meta_workflow.clone("core.function.metaAnalysis");
let guid_activity = Activity::new_with_action(GUID_ACTIVITY_CONFIG, guid_activity);
function_meta_workflow
.register_activity(&guid_activity)
.unwrap();
function_meta_workflow.insert("core.function.runFunctionRecognizers", [GUID_ACTIVITY_NAME]);
function_meta_workflow.register().unwrap();
let old_module_meta_workflow = Workflow::instance("core.module.metaAnalysis");
let module_meta_workflow = old_module_meta_workflow.clone("core.module.metaAnalysis");
let matcher_activity = Activity::new_with_action(MATCHER_ACTIVITY_CONFIG, matcher_activity);
module_meta_workflow
.register_activity(&matcher_activity)
.unwrap();
module_meta_workflow.insert(
"core.module.deleteUnusedAutoFunctions",
[MATCHER_ACTIVITY_NAME],
);
module_meta_workflow.register().unwrap();
}
|
