mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2026-05-28 18:58:02 +08:00
GP-4911 removed old memory search code
This commit is contained in:
-169
@@ -1,169 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import java.awt.FlowLayout;
|
|
||||||
import java.awt.event.ActionEvent;
|
|
||||||
import java.awt.event.ActionListener;
|
|
||||||
import java.nio.charset.Charset;
|
|
||||||
import java.nio.charset.StandardCharsets;
|
|
||||||
import java.util.Arrays;
|
|
||||||
|
|
||||||
import javax.swing.*;
|
|
||||||
import javax.swing.border.TitledBorder;
|
|
||||||
import javax.swing.event.ChangeEvent;
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
import docking.widgets.checkbox.GCheckBox;
|
|
||||||
import docking.widgets.combobox.GComboBox;
|
|
||||||
import docking.widgets.label.GDLabel;
|
|
||||||
import ghidra.util.StringUtilities;
|
|
||||||
|
|
||||||
public class AsciiSearchFormat extends SearchFormat {
|
|
||||||
private JLabel searchType;
|
|
||||||
private JComboBox<Charset> encodingCB;
|
|
||||||
private JCheckBox caseSensitiveCkB;
|
|
||||||
private JCheckBox escapeSequencesCkB;
|
|
||||||
private Charset[] supportedCharsets =
|
|
||||||
{ StandardCharsets.US_ASCII, StandardCharsets.UTF_8, StandardCharsets.UTF_16 };
|
|
||||||
|
|
||||||
public AsciiSearchFormat(ChangeListener listener) {
|
|
||||||
super("String", listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String getToolTip() {
|
|
||||||
return "Interpret value as a sequence of characters.";
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public JPanel getOptionsPanel() {
|
|
||||||
ActionListener al = new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent e) {
|
|
||||||
changeListener.stateChanged(new ChangeEvent(this));
|
|
||||||
}
|
|
||||||
};
|
|
||||||
searchType = new GDLabel("Encoding: ");
|
|
||||||
|
|
||||||
encodingCB = new GComboBox<>(supportedCharsets);
|
|
||||||
encodingCB.setName("Encoding Options");
|
|
||||||
encodingCB.setSelectedIndex(0);
|
|
||||||
encodingCB.addActionListener(al);
|
|
||||||
|
|
||||||
caseSensitiveCkB = new GCheckBox("Case Sensitive");
|
|
||||||
caseSensitiveCkB.setToolTipText("Allows for case sensitive searching.");
|
|
||||||
caseSensitiveCkB.addActionListener(al);
|
|
||||||
|
|
||||||
escapeSequencesCkB = new GCheckBox("Escape Sequences");
|
|
||||||
escapeSequencesCkB.setToolTipText(
|
|
||||||
"Allows specifying control characters using escape sequences " +
|
|
||||||
"(i.e., allows \\n to be searched for as a single line feed character).");
|
|
||||||
escapeSequencesCkB.addActionListener(al);
|
|
||||||
|
|
||||||
JPanel stringOptionsPanel = new JPanel();
|
|
||||||
stringOptionsPanel.setLayout(new BoxLayout(stringOptionsPanel, BoxLayout.Y_AXIS));
|
|
||||||
stringOptionsPanel.setBorder(new TitledBorder("Format Options"));
|
|
||||||
JPanel encodingOptionsPanel = new JPanel(new FlowLayout(FlowLayout.LEFT));
|
|
||||||
encodingOptionsPanel.add(searchType);
|
|
||||||
encodingOptionsPanel.add(encodingCB);
|
|
||||||
stringOptionsPanel.add(encodingOptionsPanel);
|
|
||||||
JPanel caseSensitivePanel = new JPanel(new FlowLayout(FlowLayout.LEFT));
|
|
||||||
caseSensitivePanel.add(caseSensitiveCkB);
|
|
||||||
stringOptionsPanel.add(caseSensitivePanel);
|
|
||||||
JPanel escapeSequencesPanel = new JPanel(new FlowLayout(FlowLayout.LEFT));
|
|
||||||
escapeSequencesPanel.add(escapeSequencesCkB);
|
|
||||||
stringOptionsPanel.add(escapeSequencesPanel);
|
|
||||||
return stringOptionsPanel;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public boolean usesEndieness() {
|
|
||||||
return encodingCB.getSelectedItem() == StandardCharsets.UTF_16; // Only UTF-16 uses Endianness.
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public SearchData getSearchData(String input) {
|
|
||||||
final byte MASK_BYTE = (byte) 0xdf;
|
|
||||||
|
|
||||||
int inputLength = input.length();
|
|
||||||
Charset encodingSelection = (Charset) encodingCB.getSelectedItem();
|
|
||||||
if (encodingSelection == StandardCharsets.UTF_16) {
|
|
||||||
encodingSelection =
|
|
||||||
(isBigEndian) ? StandardCharsets.UTF_16BE : StandardCharsets.UTF_16LE;
|
|
||||||
}
|
|
||||||
|
|
||||||
//Escape sequences in the "input" are 2 Characters long.
|
|
||||||
if (escapeSequencesCkB.isSelected() && inputLength >= 2) {
|
|
||||||
input = StringUtilities.convertEscapeSequences(input);
|
|
||||||
}
|
|
||||||
byte[] byteArray = input.getBytes(encodingSelection);
|
|
||||||
byte[] maskArray = new byte[byteArray.length];
|
|
||||||
Arrays.fill(maskArray, (byte) 0xff);
|
|
||||||
|
|
||||||
// Time to mask some bytes for case insensitive searching.
|
|
||||||
if (!caseSensitiveCkB.isSelected()) {
|
|
||||||
int i = 0;
|
|
||||||
while (i < byteArray.length) {
|
|
||||||
if (encodingSelection == StandardCharsets.US_ASCII &&
|
|
||||||
Character.isLetter(byteArray[i])) {
|
|
||||||
maskArray[i] = MASK_BYTE;
|
|
||||||
i++;
|
|
||||||
}
|
|
||||||
else if (encodingSelection == StandardCharsets.UTF_8) {
|
|
||||||
int numBytes = bytesPerCharUTF8(byteArray[i]);
|
|
||||||
if (numBytes == 1 && Character.isLetter(byteArray[i])) {
|
|
||||||
maskArray[i] = MASK_BYTE;
|
|
||||||
}
|
|
||||||
i += numBytes;
|
|
||||||
}
|
|
||||||
// Assumes UTF-16 will return 2 Bytes for each character.
|
|
||||||
// 4-byte UTF-16 will never satisfy the below checks because
|
|
||||||
// none of their bytes can ever be 0.
|
|
||||||
else if (encodingSelection == StandardCharsets.UTF_16BE) {
|
|
||||||
if (byteArray[i] == (byte) 0x0 && Character.isLetter(byteArray[i + 1])) { // Checks if ascii character.
|
|
||||||
maskArray[i + 1] = MASK_BYTE;
|
|
||||||
}
|
|
||||||
i += 2;
|
|
||||||
}
|
|
||||||
else if (encodingSelection == StandardCharsets.UTF_16LE) {
|
|
||||||
if (byteArray[i + 1] == (byte) 0x0 && Character.isLetter(byteArray[i])) { // Checks if ascii character.
|
|
||||||
maskArray[i] = MASK_BYTE;
|
|
||||||
}
|
|
||||||
i += 2;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
i++;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return SearchData.createSearchData(input, byteArray, maskArray);
|
|
||||||
}
|
|
||||||
|
|
||||||
private int bytesPerCharUTF8(byte zByte) {
|
|
||||||
// This method is intended for UTF-8 encoding.
|
|
||||||
// The first byte in a sequence of UTF-8 bytes can tell
|
|
||||||
// us how many bytes make up a char.
|
|
||||||
int offset = 1;
|
|
||||||
// If the char is ascii, this loop will be skipped.
|
|
||||||
while ((zByte & 0x80) != 0x00) {
|
|
||||||
zByte <<= 1;
|
|
||||||
offset++;
|
|
||||||
}
|
|
||||||
return offset;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-116
@@ -1,116 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import java.util.*;
|
|
||||||
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
import ghidra.util.HTMLUtilities;
|
|
||||||
|
|
||||||
public class BinarySearchFormat extends SearchFormat {
|
|
||||||
private static final String VALID_CHARS = "01x?.";
|
|
||||||
private String statusText;
|
|
||||||
|
|
||||||
public BinarySearchFormat(ChangeListener listener) {
|
|
||||||
super("Binary", listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String getToolTip() {
|
|
||||||
return HTMLUtilities.toHTML(
|
|
||||||
"Interpret value as a sequence of binary digits.\n"+
|
|
||||||
"Spaces will start the next byte. Bit sequences less\n"+
|
|
||||||
"than 8 bits are padded with 0's to the left. \n"+
|
|
||||||
"Enter 'x', '.' or '?' for a wildcard bit");
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public SearchData getSearchData(String input) {
|
|
||||||
StringTokenizer st = new StringTokenizer(input);
|
|
||||||
int n = st.countTokens();
|
|
||||||
byte[] bytes = new byte[n];
|
|
||||||
byte[] mask = new byte[n];
|
|
||||||
|
|
||||||
int index = 0;
|
|
||||||
while (st.hasMoreTokens()) {
|
|
||||||
String token = st.nextToken();
|
|
||||||
|
|
||||||
if (!isValidBinary(token)) {
|
|
||||||
return SearchData.createInvalidInputSearchData(statusText);
|
|
||||||
}
|
|
||||||
bytes[index] = getByte(token);
|
|
||||||
mask[index] = getMask(token);
|
|
||||||
index++;
|
|
||||||
}
|
|
||||||
return SearchData.createSearchData(input, bytes, mask);
|
|
||||||
}
|
|
||||||
|
|
||||||
private boolean isValidBinary(String str) {
|
|
||||||
if (str.length() > 8) {
|
|
||||||
statusText = "Max group size exceeded. Enter <space> to add more.";
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
statusText = "";
|
|
||||||
for(int i=0;i<str.length();i++) {
|
|
||||||
if (VALID_CHARS.indexOf(str.charAt(i)) < 0) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
private byte getByte(String token) {
|
|
||||||
byte b = 0;
|
|
||||||
for(int i=0;i<token.length();i++) {
|
|
||||||
b <<= 1;
|
|
||||||
char c = token.charAt(i);
|
|
||||||
if (c == '1') {
|
|
||||||
b |= 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return b;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Return a mask byte that has a bit set to 1 for each bit that is not a wildcard. Any bits
|
|
||||||
* that aren't specified (i.e. token.lenght < 8) are treated as valid test bits.
|
|
||||||
* @param token the string of bits to determine a mask for.
|
|
||||||
*/
|
|
||||||
private byte getMask(String token) {
|
|
||||||
byte b = 0;
|
|
||||||
for(int i=0;i<8;i++) {
|
|
||||||
b <<= 1;
|
|
||||||
if (i < token.length()) {
|
|
||||||
char c = token.charAt(i);
|
|
||||||
if (c == '1' || c == '0') {
|
|
||||||
b |= 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
b |= 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
return b;
|
|
||||||
}
|
|
||||||
@Override
|
|
||||||
public boolean usesEndieness() {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-235
@@ -1,235 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import java.awt.GridLayout;
|
|
||||||
import java.awt.event.ActionEvent;
|
|
||||||
import java.awt.event.ActionListener;
|
|
||||||
import java.util.*;
|
|
||||||
|
|
||||||
import javax.swing.*;
|
|
||||||
import javax.swing.event.ChangeEvent;
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
import docking.widgets.button.GRadioButton;
|
|
||||||
import ghidra.util.HTMLUtilities;
|
|
||||||
import ghidra.util.exception.AssertException;
|
|
||||||
|
|
||||||
public class DecimalSearchFormat extends SearchFormat {
|
|
||||||
|
|
||||||
private static final String MINUS_SIGN = "-";
|
|
||||||
private static final int BYTE = 0;
|
|
||||||
private static final int WORD = 1;
|
|
||||||
private static final int DWORD = 2;
|
|
||||||
private static final int QWORD = 3;
|
|
||||||
private static final int FLOAT = 4;
|
|
||||||
private static final int DOUBLE = 5;
|
|
||||||
|
|
||||||
private int decimalFormat = WORD;
|
|
||||||
|
|
||||||
public DecimalSearchFormat(ChangeListener listener) {
|
|
||||||
super("Decimal", listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String getToolTip() {
|
|
||||||
return HTMLUtilities.toHTML(
|
|
||||||
"Interpret values as a sequence of\n" + "decimal numbers, separated by spaces");
|
|
||||||
}
|
|
||||||
|
|
||||||
private void setDecimalFormat(int format) {
|
|
||||||
decimalFormat = format;
|
|
||||||
changeListener.stateChanged(new ChangeEvent(this));
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public JPanel getOptionsPanel() {
|
|
||||||
ButtonGroup decimalGroup = new ButtonGroup();
|
|
||||||
|
|
||||||
GRadioButton decimalByte = new GRadioButton("Byte", false);
|
|
||||||
GRadioButton decimalWord = new GRadioButton("Word", true);
|
|
||||||
GRadioButton decimalDWord = new GRadioButton("DWord", false);
|
|
||||||
GRadioButton decimalQWord = new GRadioButton("QWord", false);
|
|
||||||
GRadioButton decimalFloat = new GRadioButton("Float", false);
|
|
||||||
GRadioButton decimalDouble = new GRadioButton("Double", false);
|
|
||||||
|
|
||||||
decimalByte.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(BYTE);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
decimalWord.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(WORD);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
decimalDWord.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(DWORD);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
decimalQWord.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(QWORD);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
decimalFloat.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(FLOAT);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
decimalDouble.addActionListener(new ActionListener() {
|
|
||||||
@Override
|
|
||||||
public void actionPerformed(ActionEvent ev) {
|
|
||||||
setDecimalFormat(DOUBLE);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
decimalGroup.add(decimalByte);
|
|
||||||
decimalGroup.add(decimalWord);
|
|
||||||
decimalGroup.add(decimalDWord);
|
|
||||||
decimalGroup.add(decimalQWord);
|
|
||||||
decimalGroup.add(decimalFloat);
|
|
||||||
decimalGroup.add(decimalDouble);
|
|
||||||
|
|
||||||
JPanel decimalOptionsPanel = new JPanel();
|
|
||||||
decimalOptionsPanel.setLayout(new GridLayout(3, 2));
|
|
||||||
decimalOptionsPanel.add(decimalByte);
|
|
||||||
decimalOptionsPanel.add(decimalWord);
|
|
||||||
decimalOptionsPanel.add(decimalDWord);
|
|
||||||
decimalOptionsPanel.add(decimalQWord);
|
|
||||||
decimalOptionsPanel.add(decimalFloat);
|
|
||||||
decimalOptionsPanel.add(decimalDouble);
|
|
||||||
decimalOptionsPanel.setBorder(BorderFactory.createTitledBorder("Format Options"));
|
|
||||||
|
|
||||||
return decimalOptionsPanel;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public SearchData getSearchData(String input) {
|
|
||||||
List<Byte> bytesList = new ArrayList<>();
|
|
||||||
StringTokenizer tokenizer = new StringTokenizer(input);
|
|
||||||
while (tokenizer.hasMoreTokens()) {
|
|
||||||
String tok = tokenizer.nextToken();
|
|
||||||
if (tok.equals(MINUS_SIGN)) {
|
|
||||||
if (!input.endsWith(MINUS_SIGN)) {
|
|
||||||
return SearchData.createInvalidInputSearchData("Cannot have space after a '-'");
|
|
||||||
}
|
|
||||||
return SearchData.createIncompleteSearchData("");
|
|
||||||
}
|
|
||||||
try {
|
|
||||||
bytesList.addAll(getBytes(tok));
|
|
||||||
}
|
|
||||||
catch (NumberFormatException ex) {
|
|
||||||
return SearchData.createInvalidInputSearchData("");
|
|
||||||
}
|
|
||||||
catch (RuntimeException re) {
|
|
||||||
return SearchData.createInvalidInputSearchData(re.getMessage());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return SearchData.createSearchData(input, getDataBytes(bytesList), null);
|
|
||||||
}
|
|
||||||
|
|
||||||
private byte[] getDataBytes(List<Byte> bytesList) {
|
|
||||||
byte[] bytes = new byte[bytesList.size()];
|
|
||||||
for (int i = 0; i < bytes.length; i++) {
|
|
||||||
bytes[i] = (bytesList.get(i)).byteValue();
|
|
||||||
}
|
|
||||||
return bytes;
|
|
||||||
}
|
|
||||||
|
|
||||||
private List<Byte> getBytes(long value, int n) {
|
|
||||||
List<Byte> list = new ArrayList<>();
|
|
||||||
|
|
||||||
for (int i = 0; i < n; i++) {
|
|
||||||
byte b = (byte) value;
|
|
||||||
list.add(Byte.valueOf(b));
|
|
||||||
value >>= 8;
|
|
||||||
}
|
|
||||||
if (isBigEndian) {
|
|
||||||
Collections.reverse(list);
|
|
||||||
}
|
|
||||||
return list;
|
|
||||||
}
|
|
||||||
|
|
||||||
private void checkValue(long value, long min, long max) {
|
|
||||||
if (value < min || value > max) {
|
|
||||||
// I know, icky
|
|
||||||
throw new RuntimeException("Number must be in the range [" + min + "," + max + "]");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private List<Byte> getBytes(String tok) {
|
|
||||||
switch (decimalFormat) {
|
|
||||||
case BYTE:
|
|
||||||
long value = Short.parseShort(tok);
|
|
||||||
checkValue(value, Byte.MIN_VALUE, 255);
|
|
||||||
return getBytes(value, 1);
|
|
||||||
case WORD:
|
|
||||||
value = Integer.parseInt(tok);
|
|
||||||
checkValue(value, Short.MIN_VALUE, 65535);
|
|
||||||
return getBytes(value, 2);
|
|
||||||
case DWORD:
|
|
||||||
value = Long.parseLong(tok);
|
|
||||||
checkValue(value, Integer.MIN_VALUE, 4294967295l);
|
|
||||||
return getBytes(value, 4);
|
|
||||||
case QWORD:
|
|
||||||
value = Long.parseLong(tok);
|
|
||||||
return getBytes(value, 8);
|
|
||||||
case FLOAT:
|
|
||||||
tok = preProcessFloat(tok);
|
|
||||||
float floatValue = Float.parseFloat(tok);
|
|
||||||
value = Float.floatToIntBits(floatValue);
|
|
||||||
return getBytes(value, 4);
|
|
||||||
case DOUBLE:
|
|
||||||
tok = preProcessFloat(tok);
|
|
||||||
double dvalue = Double.parseDouble(tok);
|
|
||||||
value = Double.doubleToLongBits(dvalue);
|
|
||||||
return getBytes(value, 8);
|
|
||||||
default:
|
|
||||||
throw new AssertException("Unexpected format type");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Checks for parsable characters that we don't want to allow (dDfF) and removes
|
|
||||||
* the start of an exponent expression (example 2.34e would become 2.34. So woudl 2.34-)
|
|
||||||
* @param the string that will be parsed into a float or double
|
|
||||||
* @return the parsable string
|
|
||||||
* @exception NumberFormatException thrown if the the tok contains any of "dDfF".
|
|
||||||
*/
|
|
||||||
private String preProcessFloat(String tok) {
|
|
||||||
if ((tok.indexOf('d') >= 0) || (tok.indexOf('D') >= 0) || (tok.indexOf('F') >= 0) ||
|
|
||||||
(tok.indexOf('f') >= 0)) {
|
|
||||||
throw new NumberFormatException();
|
|
||||||
}
|
|
||||||
if (tok.endsWith("E") || tok.endsWith("e")) {
|
|
||||||
tok = tok.substring(0, tok.length() - 1);
|
|
||||||
}
|
|
||||||
if (tok.endsWith("E-") || tok.endsWith("e-")) {
|
|
||||||
tok = tok.substring(0, tok.length() - 2);
|
|
||||||
}
|
|
||||||
|
|
||||||
return tok;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-158
@@ -1,158 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import java.util.*;
|
|
||||||
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
import ghidra.util.HTMLUtilities;
|
|
||||||
|
|
||||||
public class HexSearchFormat extends SearchFormat {
|
|
||||||
|
|
||||||
private static final String WILD_CARDS = ".?";
|
|
||||||
private static final String HEX_CHARS = "0123456789abcdefABCDEF" + WILD_CARDS;
|
|
||||||
private String statusText;
|
|
||||||
|
|
||||||
public HexSearchFormat(ChangeListener listener) {
|
|
||||||
super("Hex", listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String getToolTip() {
|
|
||||||
return HTMLUtilities.toHTML("Interpret value as a sequence of\n" +
|
|
||||||
"hex numbers, separated by spaces.\n" + "Enter '.' or '?' for a wildcard match");
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public SearchData getSearchData(String input) {
|
|
||||||
List<String> list = new ArrayList<String>();
|
|
||||||
StringTokenizer st = new StringTokenizer(input);
|
|
||||||
while (st.hasMoreTokens()) {
|
|
||||||
String token = st.nextToken();
|
|
||||||
|
|
||||||
if (!isValidHex(token)) {
|
|
||||||
return SearchData.createInvalidInputSearchData(statusText);
|
|
||||||
}
|
|
||||||
|
|
||||||
List<String> byteList = getByteStrings(token);
|
|
||||||
if (!isBigEndian) {
|
|
||||||
Collections.reverse(byteList);
|
|
||||||
}
|
|
||||||
list.addAll(byteList);
|
|
||||||
}
|
|
||||||
byte[] bytes = new byte[list.size()];
|
|
||||||
byte[] mask = new byte[list.size()];
|
|
||||||
for (int i = 0; i < list.size(); i++) {
|
|
||||||
String byteString = list.get(i);
|
|
||||||
bytes[i] = getByte(byteString);
|
|
||||||
mask[i] = getMask(byteString);
|
|
||||||
}
|
|
||||||
return SearchData.createSearchData(input, bytes, mask);
|
|
||||||
}
|
|
||||||
|
|
||||||
private List<String> getByteStrings(String token) {
|
|
||||||
|
|
||||||
if (isSingleWildCardChar(token)) {
|
|
||||||
// treat single wildcards as a double wildcard entry, as this is more intuitive to users
|
|
||||||
token += token;
|
|
||||||
}
|
|
||||||
else if (token.length() % 2 != 0) {
|
|
||||||
// pad an odd number of nibbles with 0; assuming users leave off leading 0
|
|
||||||
token = "0" + token;
|
|
||||||
}
|
|
||||||
|
|
||||||
int n = token.length() / 2;
|
|
||||||
List<String> list = new ArrayList<String>(n);
|
|
||||||
for (int i = 0; i < n; i++) {
|
|
||||||
list.add(token.substring(i * 2, i * 2 + 2));
|
|
||||||
}
|
|
||||||
return list;
|
|
||||||
}
|
|
||||||
|
|
||||||
private boolean isSingleWildCardChar(String token) {
|
|
||||||
if (token.length() == 1) {
|
|
||||||
char c = token.charAt(0);
|
|
||||||
return WILD_CARDS.indexOf(c) >= 0;
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
private boolean isValidHex(String str) {
|
|
||||||
if (str.length() > 16) {
|
|
||||||
statusText = "Max group size exceeded. Enter <space> to add more.";
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
statusText = "";
|
|
||||||
for (int i = 0; i < str.length(); i++) {
|
|
||||||
if (HEX_CHARS.indexOf(str.charAt(i)) < 0) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the byte value to be used for the given hex bytes. Handles wildcard characters by
|
|
||||||
* return treating them as 0s.
|
|
||||||
*/
|
|
||||||
private byte getByte(String tok) {
|
|
||||||
char c1 = tok.charAt(0);
|
|
||||||
char c2 = tok.charAt(1);
|
|
||||||
// note: the hexValueOf() method will turn wildcard chars into 0s
|
|
||||||
return (byte) (hexValueOf(c1) * 16 + hexValueOf(c2));
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the search mask for the given hex byte string. Normal hex digits result
|
|
||||||
* in a "1111" mask and wildcard digits result in a "0000" mask.
|
|
||||||
*/
|
|
||||||
private byte getMask(String tok) {
|
|
||||||
char c1 = tok.charAt(0);
|
|
||||||
char c2 = tok.charAt(1);
|
|
||||||
int index1 = WILD_CARDS.indexOf(c1);
|
|
||||||
int index2 = WILD_CARDS.indexOf(c2);
|
|
||||||
if (index1 >= 0 && index2 >= 0) {
|
|
||||||
return (byte) 0x00;
|
|
||||||
}
|
|
||||||
if (index1 >= 0 && index2 < 0) {
|
|
||||||
return (byte) 0x0F;
|
|
||||||
}
|
|
||||||
if (index1 < 0 && index2 >= 0) {
|
|
||||||
return (byte) 0xF0;
|
|
||||||
}
|
|
||||||
return (byte) 0xFF;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the value of the given hex digit character.
|
|
||||||
*/
|
|
||||||
private int hexValueOf(char c) {
|
|
||||||
if ((c >= '0') && (c <= '9')) {
|
|
||||||
return c - '0';
|
|
||||||
}
|
|
||||||
else if ((c >= 'a') && (c <= 'f')) {
|
|
||||||
return c - 'a' + 10;
|
|
||||||
}
|
|
||||||
else if ((c >= 'A') && (c <= 'F')) {
|
|
||||||
return c - 'A' + 10;
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-848
File diff suppressed because it is too large
Load Diff
-907
File diff suppressed because it is too large
Load Diff
-32
@@ -1,32 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import ghidra.framework.plugintool.ServiceProvider;
|
|
||||||
import ghidra.program.model.address.Address;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.util.search.memory.MemSearchResult;
|
|
||||||
import ghidra.util.table.ProgramLocationTableRowMapper;
|
|
||||||
|
|
||||||
public class MemSearchResultToAddressTableRowMapper
|
|
||||||
extends ProgramLocationTableRowMapper<MemSearchResult, Address> {
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public Address map(MemSearchResult rowObject, Program data, ServiceProvider serviceProvider) {
|
|
||||||
return rowObject.getAddress();
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-33
@@ -1,33 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import ghidra.framework.plugintool.ServiceProvider;
|
|
||||||
import ghidra.program.model.listing.*;
|
|
||||||
import ghidra.util.search.memory.MemSearchResult;
|
|
||||||
import ghidra.util.table.ProgramLocationTableRowMapper;
|
|
||||||
|
|
||||||
public class MemSearchResultToFunctionTableRowMapper
|
|
||||||
extends ProgramLocationTableRowMapper<MemSearchResult, Function> {
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public Function map(MemSearchResult rowObject, Program program,
|
|
||||||
ServiceProvider serviceProvider) {
|
|
||||||
FunctionManager functionManager = program.getFunctionManager();
|
|
||||||
return functionManager.getFunctionContaining(rowObject.getAddress());
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-33
@@ -1,33 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import ghidra.framework.plugintool.ServiceProvider;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.program.util.ProgramLocation;
|
|
||||||
import ghidra.util.search.memory.MemSearchResult;
|
|
||||||
import ghidra.util.table.ProgramLocationTableRowMapper;
|
|
||||||
|
|
||||||
public class MemSearchResultToProgramLocationTableRowMapper
|
|
||||||
extends ProgramLocationTableRowMapper<MemSearchResult, ProgramLocation> {
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public ProgramLocation map(MemSearchResult rowObject, Program program,
|
|
||||||
ServiceProvider serviceProvider) {
|
|
||||||
return new ProgramLocation(program, rowObject.getAddress());
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-106
@@ -1,106 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import docking.widgets.table.*;
|
|
||||||
import ghidra.framework.plugintool.ServiceProvider;
|
|
||||||
import ghidra.program.model.address.*;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.program.util.*;
|
|
||||||
import ghidra.util.datastruct.Accumulator;
|
|
||||||
import ghidra.util.exception.CancelledException;
|
|
||||||
import ghidra.util.search.memory.*;
|
|
||||||
import ghidra.util.table.AddressBasedTableModel;
|
|
||||||
import ghidra.util.table.field.AddressTableColumn;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
public class MemSearchTableModel extends AddressBasedTableModel<MemSearchResult> {
|
|
||||||
|
|
||||||
private SearchInfo searchInfo;
|
|
||||||
private ProgramSelection selection;
|
|
||||||
private Address startAddress;
|
|
||||||
private MemorySearchAlgorithm algorithm;
|
|
||||||
|
|
||||||
MemSearchTableModel(ServiceProvider serviceProvider, Program program, SearchInfo searchInfo,
|
|
||||||
Address searchStartAddress, ProgramSelection programSelection) {
|
|
||||||
super("Memory Search", serviceProvider, program, null, true);
|
|
||||||
this.searchInfo = searchInfo;
|
|
||||||
this.startAddress = searchStartAddress;
|
|
||||||
this.selection = programSelection;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSortedOnAddress() {
|
|
||||||
TableSortState sortState = getTableSortState();
|
|
||||||
if (sortState.isUnsorted()) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
ColumnSortState primaryState = sortState.getAllSortStates().get(0);
|
|
||||||
DynamicTableColumn<MemSearchResult, ?, ?> column =
|
|
||||||
getColumn(primaryState.getColumnModelIndex());
|
|
||||||
String name = column.getColumnName();
|
|
||||||
if (AddressTableColumn.NAME.equals(name)) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected void doLoad(Accumulator<MemSearchResult> accumulator, TaskMonitor monitor)
|
|
||||||
throws CancelledException {
|
|
||||||
algorithm = searchInfo.createSearchAlgorithm(getProgram(), startAddress, selection);
|
|
||||||
algorithm.search(accumulator, monitor);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public ProgramLocation getProgramLocation(int row, int column) {
|
|
||||||
Program p = getProgram();
|
|
||||||
if (p == null) {
|
|
||||||
return null; // we've been disposed
|
|
||||||
}
|
|
||||||
|
|
||||||
ProgramLocation loc = super.getProgramLocation(row, column);
|
|
||||||
if (loc != null && p.getMemory().contains(loc.getByteAddress())) {
|
|
||||||
return new BytesFieldLocation(p, loc.getByteAddress());
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public Address getAddress(int row) {
|
|
||||||
MemSearchResult result = getRowObject(row);
|
|
||||||
return result.getAddress();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public ProgramSelection getProgramSelection(int[] rows) {
|
|
||||||
AddressSet addressSet = new AddressSet();
|
|
||||||
for (int row : rows) {
|
|
||||||
MemSearchResult result = getRowObject(row);
|
|
||||||
int addOn = result.getLength() - 1;
|
|
||||||
Address minAddr = getAddress(row);
|
|
||||||
Address maxAddr = minAddr;
|
|
||||||
try {
|
|
||||||
maxAddr = minAddr.addNoWrap(addOn);
|
|
||||||
addressSet.addRange(minAddr, maxAddr);
|
|
||||||
}
|
|
||||||
catch (AddressOverflowException e) {
|
|
||||||
// I guess we don't care--not sure why this is undocumented :(
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return new ProgramSelection(addressSet);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-50
@@ -1,50 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
* REVIEWED: YES
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import java.util.regex.Pattern;
|
|
||||||
import java.util.regex.PatternSyntaxException;
|
|
||||||
|
|
||||||
public class RegExSearchData extends SearchData {
|
|
||||||
private Pattern pattern;
|
|
||||||
|
|
||||||
public static RegExSearchData createRegExSearchData( String inputString ) {
|
|
||||||
RegExSearchData regExSearchData = new RegExSearchData( inputString );
|
|
||||||
if ( regExSearchData.errorMessage != null ) {
|
|
||||||
throw new IllegalArgumentException( "Problem creating search data: " +
|
|
||||||
regExSearchData.errorMessage );
|
|
||||||
}
|
|
||||||
return regExSearchData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public RegExSearchData(String inputString) {
|
|
||||||
super(inputString, new byte[0], null);
|
|
||||||
try {
|
|
||||||
pattern = Pattern.compile(inputString, Pattern.DOTALL);
|
|
||||||
} catch (PatternSyntaxException pse) {
|
|
||||||
errorMessage = pse.getMessage();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public boolean isValidSearchData() {
|
|
||||||
return pattern != null;
|
|
||||||
}
|
|
||||||
public Pattern getRegExPattern() {
|
|
||||||
return pattern;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-44
@@ -1,44 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
public class RegExSearchFormat extends SearchFormat {
|
|
||||||
|
|
||||||
public RegExSearchFormat(ChangeListener listener) {
|
|
||||||
super("Regular Expression", listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String getToolTip() {
|
|
||||||
return "Interpret value as a regular expression.";
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public boolean usesEndieness() {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
@Override
|
|
||||||
public boolean supportsBackwardsSearch() {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
@Override
|
|
||||||
public SearchData getSearchData( String input ) {
|
|
||||||
return new RegExSearchData(input);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-55
@@ -1,55 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import ghidra.program.model.address.Address;
|
|
||||||
import ghidra.program.model.address.AddressSetView;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.program.model.mem.Memory;
|
|
||||||
import ghidra.program.util.ProgramSelection;
|
|
||||||
import ghidra.util.search.memory.CodeUnitSearchInfo;
|
|
||||||
import ghidra.util.search.memory.SearchInfo;
|
|
||||||
|
|
||||||
class SearchAllSearchInfo extends SearchInfo {
|
|
||||||
|
|
||||||
public SearchAllSearchInfo(SearchData searchData, int matchLimit, boolean searchSelection,
|
|
||||||
boolean forwardSearch, int alignment, boolean includeNonLoadedBlocks,
|
|
||||||
CodeUnitSearchInfo codeUnitSearchInfo) {
|
|
||||||
super(searchData, matchLimit, searchSelection, forwardSearch, alignment,
|
|
||||||
includeNonLoadedBlocks, codeUnitSearchInfo, null /* search all uses a different listener mechanism */);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected AddressSetView getSearchableAddressSet(Program program, Address address,
|
|
||||||
ProgramSelection selection) {
|
|
||||||
|
|
||||||
// in the search all case, we don't care about the starting address.
|
|
||||||
|
|
||||||
Memory memory = program.getMemory();
|
|
||||||
AddressSetView set =
|
|
||||||
this.includeNonLoadedBlocks ? memory.getAllInitializedAddressSet()
|
|
||||||
: memory.getLoadedAndInitializedAddressSet();
|
|
||||||
if (searchSelection && selection != null && !selection.isEmpty()) {
|
|
||||||
set = set.intersect(selection);
|
|
||||||
}
|
|
||||||
return set;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public boolean isSearchAll() {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,92 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
public class SearchData {
|
|
||||||
|
|
||||||
private String inputString;
|
|
||||||
protected String errorMessage;
|
|
||||||
private byte[] bytes;
|
|
||||||
private byte[] mask;
|
|
||||||
private boolean isValidInputData;
|
|
||||||
private boolean isValidSearchData;
|
|
||||||
|
|
||||||
// valid input and search data with mask
|
|
||||||
protected SearchData(String inputString, byte[] searchBytes, byte[] mask) {
|
|
||||||
this.isValidInputData = true;
|
|
||||||
this.isValidSearchData = true;
|
|
||||||
this.inputString = inputString;
|
|
||||||
this.bytes = searchBytes == null ? new byte[0] : searchBytes;
|
|
||||||
this.mask = mask;
|
|
||||||
}
|
|
||||||
|
|
||||||
// valid input, bad search data
|
|
||||||
private SearchData(String errorMessage, boolean isValidInputData) {
|
|
||||||
this.isValidInputData = isValidInputData;
|
|
||||||
this.isValidSearchData = false;
|
|
||||||
bytes = new byte[0];
|
|
||||||
this.errorMessage = errorMessage;
|
|
||||||
}
|
|
||||||
|
|
||||||
public static SearchData createSearchData(String inputString, byte[] searchBytes, byte[] mask) {
|
|
||||||
return new SearchData(inputString, searchBytes, mask);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static SearchData createIncompleteSearchData(String errorMessage) {
|
|
||||||
return new SearchData(errorMessage, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static SearchData createInvalidInputSearchData(String errorMessage) {
|
|
||||||
return new SearchData(errorMessage, false);
|
|
||||||
}
|
|
||||||
|
|
||||||
public byte[] getBytes() {
|
|
||||||
return bytes;
|
|
||||||
}
|
|
||||||
|
|
||||||
public byte[] getMask() {
|
|
||||||
return mask;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isValidInputData() {
|
|
||||||
return isValidInputData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isValidSearchData() {
|
|
||||||
return isValidSearchData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public String getInputString() {
|
|
||||||
return inputString;
|
|
||||||
}
|
|
||||||
|
|
||||||
public String getStatusMessage() {
|
|
||||||
return errorMessage;
|
|
||||||
}
|
|
||||||
|
|
||||||
public String getHexString() {
|
|
||||||
StringBuilder buf = new StringBuilder();
|
|
||||||
for (byte element : bytes) {
|
|
||||||
String hexString = Integer.toHexString(element & 0xff);
|
|
||||||
if (hexString.length() == 1) {
|
|
||||||
buf.append("0");
|
|
||||||
}
|
|
||||||
buf.append(hexString);
|
|
||||||
buf.append(" ");
|
|
||||||
}
|
|
||||||
return buf.toString();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,57 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
* REVIEWED: YES
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.app.plugin.core.searchmem;
|
|
||||||
|
|
||||||
import javax.swing.BorderFactory;
|
|
||||||
import javax.swing.JPanel;
|
|
||||||
import javax.swing.event.ChangeListener;
|
|
||||||
|
|
||||||
public abstract class SearchFormat {
|
|
||||||
private String name;
|
|
||||||
protected boolean isBigEndian;
|
|
||||||
protected ChangeListener changeListener;
|
|
||||||
|
|
||||||
protected SearchFormat(String name, ChangeListener listener) {
|
|
||||||
this.name = name;
|
|
||||||
this.changeListener = listener;
|
|
||||||
}
|
|
||||||
public String getName() {
|
|
||||||
return name;
|
|
||||||
}
|
|
||||||
|
|
||||||
public JPanel getOptionsPanel() {
|
|
||||||
JPanel noOptionsPanel = new JPanel();
|
|
||||||
noOptionsPanel.setBorder(BorderFactory.createTitledBorder("Format Options"));
|
|
||||||
return noOptionsPanel;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void setEndieness(boolean isBigEndian) {
|
|
||||||
this.isBigEndian = isBigEndian;
|
|
||||||
}
|
|
||||||
public boolean usesEndieness() {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
public boolean supportsBackwardsSearch() {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
public abstract String getToolTip();
|
|
||||||
|
|
||||||
public abstract SearchData getSearchData( String input );
|
|
||||||
|
|
||||||
|
|
||||||
}
|
|
||||||
+2
-2
@@ -56,7 +56,7 @@ public class MemorySearcher {
|
|||||||
* @param searchLimit the max number of hits before stopping
|
* @param searchLimit the max number of hits before stopping
|
||||||
*/
|
*/
|
||||||
public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher,
|
public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher,
|
||||||
AddressSet addresses, int searchLimit) {
|
AddressSetView addresses, int searchLimit) {
|
||||||
this(byteSource, matcher, addresses, searchLimit, DEFAULT_CHUNK_SIZE);
|
this(byteSource, matcher, addresses, searchLimit, DEFAULT_CHUNK_SIZE);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -69,7 +69,7 @@ public class MemorySearcher {
|
|||||||
* @param chunkSize the maximum number of bytes to feed to the matcher at any one time.
|
* @param chunkSize the maximum number of bytes to feed to the matcher at any one time.
|
||||||
*/
|
*/
|
||||||
public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher,
|
public MemorySearcher(AddressableByteSource byteSource, ByteMatcher matcher,
|
||||||
AddressSet addresses, int searchLimit, int chunkSize) {
|
AddressSetView addresses, int searchLimit, int chunkSize) {
|
||||||
this.matcher = matcher;
|
this.matcher = matcher;
|
||||||
this.searchSet = addresses;
|
this.searchSet = addresses;
|
||||||
this.searchLimit = searchLimit;
|
this.searchLimit = searchLimit;
|
||||||
|
|||||||
@@ -29,8 +29,14 @@ import ghidra.app.cmd.label.SetLabelPrimaryCmd;
|
|||||||
import ghidra.app.plugin.core.analysis.AutoAnalysisManager;
|
import ghidra.app.plugin.core.analysis.AutoAnalysisManager;
|
||||||
import ghidra.app.plugin.core.clear.ClearCmd;
|
import ghidra.app.plugin.core.clear.ClearCmd;
|
||||||
import ghidra.app.plugin.core.clear.ClearOptions;
|
import ghidra.app.plugin.core.clear.ClearOptions;
|
||||||
import ghidra.app.plugin.core.searchmem.RegExSearchData;
|
|
||||||
import ghidra.app.script.GhidraScript;
|
import ghidra.app.script.GhidraScript;
|
||||||
|
import ghidra.features.base.memsearch.bytesource.AddressableByteSource;
|
||||||
|
import ghidra.features.base.memsearch.bytesource.ProgramByteSource;
|
||||||
|
import ghidra.features.base.memsearch.gui.SearchSettings;
|
||||||
|
import ghidra.features.base.memsearch.matcher.ByteMatcher;
|
||||||
|
import ghidra.features.base.memsearch.matcher.RegExByteMatcher;
|
||||||
|
import ghidra.features.base.memsearch.searcher.MemoryMatch;
|
||||||
|
import ghidra.features.base.memsearch.searcher.MemorySearcher;
|
||||||
import ghidra.framework.main.AppInfo;
|
import ghidra.framework.main.AppInfo;
|
||||||
import ghidra.framework.model.*;
|
import ghidra.framework.model.*;
|
||||||
import ghidra.framework.plugintool.PluginTool;
|
import ghidra.framework.plugintool.PluginTool;
|
||||||
@@ -49,7 +55,6 @@ import ghidra.util.ascii.AsciiCharSetRecognizer;
|
|||||||
import ghidra.util.datastruct.Accumulator;
|
import ghidra.util.datastruct.Accumulator;
|
||||||
import ghidra.util.datastruct.ListAccumulator;
|
import ghidra.util.datastruct.ListAccumulator;
|
||||||
import ghidra.util.exception.*;
|
import ghidra.util.exception.*;
|
||||||
import ghidra.util.search.memory.*;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
import ghidra.util.task.TaskMonitor;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -771,15 +776,38 @@ public class FlatProgramAPI {
|
|||||||
public final Address[] findBytes(AddressSetView set, String byteString, int matchLimit,
|
public final Address[] findBytes(AddressSetView set, String byteString, int matchLimit,
|
||||||
int alignment) {
|
int alignment) {
|
||||||
|
|
||||||
return findBytes(set, byteString, matchLimit, alignment, false);
|
if (matchLimit <= 0) {
|
||||||
|
matchLimit = 500;
|
||||||
|
}
|
||||||
|
|
||||||
|
SearchSettings settings = new SearchSettings().withAlignment(alignment);
|
||||||
|
ByteMatcher matcher = new RegExByteMatcher(byteString, settings);
|
||||||
|
AddressableByteSource byteSource = new ProgramByteSource(currentProgram);
|
||||||
|
Memory memory = currentProgram.getMemory();
|
||||||
|
AddressSet intersection = memory.getLoadedAndInitializedAddressSet().intersect(set);
|
||||||
|
|
||||||
|
MemorySearcher searcher = new MemorySearcher(byteSource, matcher, intersection, matchLimit);
|
||||||
|
Accumulator<MemoryMatch> accumulator = new ListAccumulator<>();
|
||||||
|
searcher.findAll(accumulator, monitor);
|
||||||
|
|
||||||
|
//@formatter:off
|
||||||
|
List<Address> addresses =
|
||||||
|
accumulator.stream()
|
||||||
|
.map(r -> r.getAddress())
|
||||||
|
.collect(Collectors.toList());
|
||||||
|
//@formatter:on
|
||||||
|
return addresses.toArray(new Address[addresses.size()]);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
* This method has been deprecated, use {@link #findBytes(Address, String, int, int)} instead.
|
||||||
|
* The concept of searching and finding matches that span gaps (address ranges where no memory
|
||||||
|
* blocks have been defined), is no longer supported. If this capability has value to anyone,
|
||||||
|
* please contact the Ghidra team and let us know.
|
||||||
|
* <P>
|
||||||
* Finds a byte pattern within an addressSet.
|
* Finds a byte pattern within an addressSet.
|
||||||
*
|
*
|
||||||
* Note: When searchAcrossAddressGaps is set to true, the ranges within the addressSet are
|
* Note: The ranges within the addressSet are NOT treated as a contiguous set when searching
|
||||||
* treated as a contiguous set when searching.
|
|
||||||
*
|
|
||||||
* <p>
|
* <p>
|
||||||
* The <code>byteString</code> may contain regular expressions. The following
|
* The <code>byteString</code> may contain regular expressions. The following
|
||||||
* highlights some example search strings (note the use of double backslashes ("\\")):
|
* highlights some example search strings (note the use of double backslashes ("\\")):
|
||||||
@@ -794,49 +822,21 @@ public class FlatProgramAPI {
|
|||||||
* @param byteString the byte pattern for which to search
|
* @param byteString the byte pattern for which to search
|
||||||
* @param matchLimit The number of matches to which the search should be restricted
|
* @param matchLimit The number of matches to which the search should be restricted
|
||||||
* @param alignment byte alignment to use for search starts. For example, a value of
|
* @param alignment byte alignment to use for search starts. For example, a value of
|
||||||
* 1 searches from every byte. A value of 2 only matches runs that begin on a even
|
* 1 searches from every byte. A value of 2 only matches runs that begin on a even
|
||||||
* address boundary.
|
* address boundary.
|
||||||
* @param searchAcrossAddressGaps when set to 'true' searches for matches across the gaps
|
* @param searchAcrossAddressGaps This parameter is no longer supported and its value is
|
||||||
* of each addressRange contained in the addresSet.
|
* ignored. Previously, if true, match results were allowed to span non-continguous memory
|
||||||
|
* ranges.
|
||||||
* @return the start addresses that contain byte patterns that match the given byteString
|
* @return the start addresses that contain byte patterns that match the given byteString
|
||||||
* @throws IllegalArgumentException if the byteString is not a valid regular expression
|
* @throws IllegalArgumentException if the byteString is not a valid regular expression
|
||||||
* @see #findBytes(Address, String)
|
* @see #findBytes(Address, String)
|
||||||
|
*
|
||||||
|
* @deprecated see description for details.
|
||||||
*/
|
*/
|
||||||
|
@Deprecated(since = "11.3", forRemoval = true)
|
||||||
public final Address[] findBytes(AddressSetView set, String byteString, int matchLimit,
|
public final Address[] findBytes(AddressSetView set, String byteString, int matchLimit,
|
||||||
int alignment, boolean searchAcrossAddressGaps) {
|
int alignment, boolean searchAcrossAddressGaps) {
|
||||||
|
return findBytes(set, byteString, matchLimit, alignment);
|
||||||
if (matchLimit <= 0) {
|
|
||||||
matchLimit = 500;
|
|
||||||
}
|
|
||||||
|
|
||||||
RegExSearchData searchData = RegExSearchData.createRegExSearchData(byteString);
|
|
||||||
|
|
||||||
//@formatter:off
|
|
||||||
SearchInfo searchInfo = new SearchInfo(searchData,
|
|
||||||
matchLimit,
|
|
||||||
false, // search selection
|
|
||||||
true, // search forward
|
|
||||||
alignment,
|
|
||||||
true, // include non-loaded blocks
|
|
||||||
null);
|
|
||||||
//@formatter:on
|
|
||||||
|
|
||||||
Memory memory = currentProgram.getMemory();
|
|
||||||
AddressSet intersection = memory.getLoadedAndInitializedAddressSet().intersect(set);
|
|
||||||
|
|
||||||
RegExMemSearcherAlgorithm searcher = new RegExMemSearcherAlgorithm(searchInfo, intersection,
|
|
||||||
currentProgram, searchAcrossAddressGaps);
|
|
||||||
|
|
||||||
Accumulator<MemSearchResult> accumulator = new ListAccumulator<>();
|
|
||||||
searcher.search(accumulator, monitor);
|
|
||||||
|
|
||||||
//@formatter:off
|
|
||||||
List<Address> addresses =
|
|
||||||
accumulator.stream()
|
|
||||||
.map(r -> r.getAddress())
|
|
||||||
.collect(Collectors.toList());
|
|
||||||
//@formatter:on
|
|
||||||
return addresses.toArray(new Address[addresses.size()]);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -1512,21 +1512,21 @@ public class FlatProgramAPI {
|
|||||||
public final Namespace getNamespace(Namespace parent, String namespaceName) {
|
public final Namespace getNamespace(Namespace parent, String namespaceName) {
|
||||||
return currentProgram.getSymbolTable().getNamespace(namespaceName, parent);
|
return currentProgram.getSymbolTable().getNamespace(namespaceName, parent);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates a new {@link Namespace} with the given name contained inside the
|
* Creates a new {@link Namespace} with the given name contained inside the
|
||||||
* specified parent namespace.
|
* specified parent namespace.
|
||||||
* Pass <code>null</code> for parent to indicate the global namespace.
|
* Pass <code>null</code> for parent to indicate the global namespace.
|
||||||
* If a {@link Namespace} or {@link GhidraClass} with the given name already exists, the
|
* If a {@link Namespace} or {@link GhidraClass} with the given name already exists, the
|
||||||
* existing one will be returned.
|
* existing one will be returned.
|
||||||
* @param parent the parent namespace, or null for global namespace
|
* @param parent the parent namespace, or null for global namespace
|
||||||
* @param namespaceName the requested namespace's name
|
* @param namespaceName the requested namespace's name
|
||||||
* @return the namespace with the given name
|
* @return the namespace with the given name
|
||||||
* @throws DuplicateNameException if a {@link Library} symbol exists with the given name
|
* @throws DuplicateNameException if a {@link Library} symbol exists with the given name
|
||||||
* @throws InvalidInputException if the name is invalid
|
* @throws InvalidInputException if the name is invalid
|
||||||
* @throws IllegalArgumentException if parent Namespace does not correspond to
|
* @throws IllegalArgumentException if parent Namespace does not correspond to
|
||||||
* <code>currerntProgram</code>
|
* <code>currerntProgram</code>
|
||||||
*/
|
*/
|
||||||
public final Namespace createNamespace(Namespace parent, String namespaceName)
|
public final Namespace createNamespace(Namespace parent, String namespaceName)
|
||||||
throws DuplicateNameException, InvalidInputException {
|
throws DuplicateNameException, InvalidInputException {
|
||||||
SymbolTable symbolTable = currentProgram.getSymbolTable();
|
SymbolTable symbolTable = currentProgram.getSymbolTable();
|
||||||
@@ -1539,7 +1539,7 @@ public class FlatProgramAPI {
|
|||||||
}
|
}
|
||||||
return symbolTable.createNameSpace(parent, namespaceName, SourceType.USER_DEFINED);
|
return symbolTable.createNameSpace(parent, namespaceName, SourceType.USER_DEFINED);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates a new {@link GhidraClass} with the given name contained inside the
|
* Creates a new {@link GhidraClass} with the given name contained inside the
|
||||||
* specified parent namespace.
|
* specified parent namespace.
|
||||||
|
|||||||
@@ -1,46 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
public class CodeUnitSearchInfo {
|
|
||||||
|
|
||||||
private final boolean searchInstructions;
|
|
||||||
private final boolean searchDefinedData;
|
|
||||||
private final boolean searchUndefinedData;
|
|
||||||
|
|
||||||
public CodeUnitSearchInfo( boolean searchInstructions, boolean searchDefinedData,
|
|
||||||
boolean searchUndefinedData ) {
|
|
||||||
this.searchInstructions = searchInstructions;
|
|
||||||
this.searchDefinedData = searchDefinedData;
|
|
||||||
this.searchUndefinedData = searchUndefinedData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSearchInstructions() {
|
|
||||||
return searchInstructions;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSearchDefinedData() {
|
|
||||||
return searchDefinedData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSearchUndefinedData() {
|
|
||||||
return searchUndefinedData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean searchAll() {
|
|
||||||
return searchInstructions && searchDefinedData && searchUndefinedData;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import java.util.Objects;
|
|
||||||
|
|
||||||
import ghidra.program.model.address.Address;
|
|
||||||
import ghidra.util.SystemUtilities;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* A class that represents a memory search hit at an address.
|
|
||||||
*/
|
|
||||||
public class MemSearchResult implements Comparable<MemSearchResult> {
|
|
||||||
|
|
||||||
private Address address;
|
|
||||||
private int length;
|
|
||||||
private byte[] bytes;
|
|
||||||
|
|
||||||
public MemSearchResult(Address address, int length) {
|
|
||||||
this.address = Objects.requireNonNull(address);
|
|
||||||
|
|
||||||
if (length <= 0) {
|
|
||||||
throw new IllegalArgumentException("Length must be greater than 0");
|
|
||||||
}
|
|
||||||
this.length = length;
|
|
||||||
}
|
|
||||||
|
|
||||||
public MemSearchResult(Address address, byte[] bytes) {
|
|
||||||
if (bytes == null || bytes.length < 1) {
|
|
||||||
throw new IllegalArgumentException("Must provide at least 1 byte");
|
|
||||||
}
|
|
||||||
this.address = Objects.requireNonNull(address);
|
|
||||||
this.bytes = bytes;
|
|
||||||
this.length = bytes.length;
|
|
||||||
}
|
|
||||||
|
|
||||||
public Address getAddress() {
|
|
||||||
return address;
|
|
||||||
}
|
|
||||||
|
|
||||||
public int getLength() {
|
|
||||||
return length;
|
|
||||||
}
|
|
||||||
|
|
||||||
public byte[] getBytes() {
|
|
||||||
return bytes;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public int compareTo(MemSearchResult o) {
|
|
||||||
return address.compareTo(o.address);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public int hashCode() {
|
|
||||||
final int prime = 31;
|
|
||||||
int result = 1;
|
|
||||||
result = prime * result + ((address == null) ? 0 : address.hashCode());
|
|
||||||
return result;
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public boolean equals(Object obj) {
|
|
||||||
if (this == obj) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
if (obj == null) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
if (getClass() != obj.getClass()) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
MemSearchResult other = (MemSearchResult) obj;
|
|
||||||
return SystemUtilities.isEqual(address, other.address);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public String toString() {
|
|
||||||
return address.toString();
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns true if the given address equals the address of this search result
|
|
||||||
* @param a the other address
|
|
||||||
* @return true if the given address equals the address of this search result
|
|
||||||
*/
|
|
||||||
public boolean addressEquals(Address a) {
|
|
||||||
return address.equals(a);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-138
@@ -1,138 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import ghidra.app.plugin.core.searchmem.SearchData;
|
|
||||||
import ghidra.program.model.address.*;
|
|
||||||
import ghidra.program.model.listing.*;
|
|
||||||
import ghidra.program.model.mem.Memory;
|
|
||||||
import ghidra.util.datastruct.Accumulator;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Search memory using the provided search text.
|
|
||||||
*/
|
|
||||||
public class MemSearcherAlgorithm implements MemorySearchAlgorithm {
|
|
||||||
|
|
||||||
private boolean forwardSearch;
|
|
||||||
private SearchData searchData;
|
|
||||||
private AddressSetView searchSet;
|
|
||||||
protected int searchLimit;
|
|
||||||
private Program program;
|
|
||||||
private int alignment;
|
|
||||||
private CodeUnitSearchInfo codeUnitSearchInfo;
|
|
||||||
|
|
||||||
MemSearcherAlgorithm(SearchInfo searchInfo, AddressSetView searchSet, Program program) {
|
|
||||||
|
|
||||||
this.searchData = searchInfo.getSearchData();
|
|
||||||
this.forwardSearch = searchInfo.isSearchForward();
|
|
||||||
this.alignment = searchInfo.getAlignment();
|
|
||||||
this.searchSet = searchSet;
|
|
||||||
this.searchLimit = searchInfo.getSearchLimit();
|
|
||||||
this.program = program;
|
|
||||||
this.codeUnitSearchInfo = searchInfo.getCodeUnitSearchInfo();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void search(Accumulator<MemSearchResult> accumulator, TaskMonitor monitor) {
|
|
||||||
AddressRangeIterator addressRanges = searchSet.getAddressRanges(forwardSearch);
|
|
||||||
monitor.initialize(searchSet.getNumAddresses());
|
|
||||||
int progressCount = 0;
|
|
||||||
|
|
||||||
while (addressRanges.hasNext() && !monitor.isCancelled()) {
|
|
||||||
|
|
||||||
AddressRange range = addressRanges.next();
|
|
||||||
searchRange(accumulator, range, monitor, progressCount);
|
|
||||||
progressCount += range.getLength();
|
|
||||||
monitor.setProgress(progressCount);
|
|
||||||
if (accumulator.size() >= searchLimit) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private void searchRange(Accumulator<MemSearchResult> accumulator, AddressRange range,
|
|
||||||
TaskMonitor monitor, int progressCount) {
|
|
||||||
|
|
||||||
Memory mem = program.getMemory();
|
|
||||||
Address startAddress = forwardSearch ? range.getMinAddress() : range.getMaxAddress();
|
|
||||||
Address endAddress = forwardSearch ? range.getMaxAddress() : range.getMinAddress();
|
|
||||||
int length = searchData.getBytes().length;
|
|
||||||
while (startAddress != null && !monitor.isCancelled()) {
|
|
||||||
Address matchAddress = mem.findBytes(startAddress, endAddress, searchData.getBytes(),
|
|
||||||
searchData.getMask(), forwardSearch, monitor);
|
|
||||||
|
|
||||||
if (isMatchingAddress(matchAddress)) {
|
|
||||||
MemSearchResult result = new MemSearchResult(matchAddress, length);
|
|
||||||
accumulator.add(result);
|
|
||||||
if (accumulator.size() >= searchLimit) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
monitor.setProgress(progressCount + getRangeDifference(range, matchAddress));
|
|
||||||
}
|
|
||||||
startAddress = getNextAddress(matchAddress, range);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private boolean isMatchingAddress(Address address) {
|
|
||||||
if (address == null) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((address.getOffset() % alignment) != 0) {
|
|
||||||
return false; // wrong alignment
|
|
||||||
}
|
|
||||||
|
|
||||||
if (codeUnitSearchInfo.searchAll()) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
Listing listing = program.getListing();
|
|
||||||
CodeUnit codeUnit = listing.getCodeUnitContaining(address);
|
|
||||||
if (codeUnit instanceof Instruction) {
|
|
||||||
return codeUnitSearchInfo.isSearchInstructions();
|
|
||||||
}
|
|
||||||
else if (codeUnit instanceof Data) {
|
|
||||||
Data data = (Data) codeUnit;
|
|
||||||
if (data.isDefined()) {
|
|
||||||
return codeUnitSearchInfo.isSearchDefinedData();
|
|
||||||
}
|
|
||||||
return codeUnitSearchInfo.isSearchUndefinedData();
|
|
||||||
}
|
|
||||||
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
private int getRangeDifference(AddressRange range, Address address) {
|
|
||||||
return (int) (forwardSearch ? address.subtract(range.getMinAddress())
|
|
||||||
: range.getMaxAddress().subtract(address));
|
|
||||||
}
|
|
||||||
|
|
||||||
private Address getNextAddress(Address currentAddress, AddressRange range) {
|
|
||||||
if (currentAddress == null) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (forwardSearch) {
|
|
||||||
return currentAddress.equals(range.getMaxAddress()) ? null : currentAddress.next();
|
|
||||||
}
|
|
||||||
return currentAddress.equals(range.getMinAddress()) ? null : currentAddress.previous();
|
|
||||||
}
|
|
||||||
|
|
||||||
AddressSetView getSearchSet() {
|
|
||||||
return searchSet;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import java.util.List;
|
|
||||||
|
|
||||||
import ghidra.util.datastruct.ListAccumulator;
|
|
||||||
import ghidra.util.task.Task;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
public class MemSearcherTask extends Task {
|
|
||||||
|
|
||||||
private MemorySearchAlgorithm algorithm;
|
|
||||||
private List<MemSearchResult> results;
|
|
||||||
|
|
||||||
public MemSearcherTask(SearchInfo searchInfo, MemorySearchAlgorithm algorithm) {
|
|
||||||
super("Search Memory", true, true, false);
|
|
||||||
|
|
||||||
this.algorithm = algorithm;
|
|
||||||
addTaskListener(searchInfo.getListener());
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void run(TaskMonitor monitor) {
|
|
||||||
|
|
||||||
ListAccumulator<MemSearchResult> accumulator = new ListAccumulator<>();
|
|
||||||
algorithm.search(accumulator, monitor);
|
|
||||||
this.results = accumulator.asList();
|
|
||||||
}
|
|
||||||
|
|
||||||
public List<MemSearchResult> getMatchingAddresses() {
|
|
||||||
return results;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
-103
@@ -1,103 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import ghidra.program.model.address.*;
|
|
||||||
import ghidra.program.model.mem.Memory;
|
|
||||||
import ghidra.program.model.mem.MemoryAccessException;
|
|
||||||
import ghidra.util.exception.AssertException;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* This class implements the CharSequence interface using Memory and an AddressSet. The
|
|
||||||
* idea is that each byte in memory at the addresses specified in the AddressSet will form
|
|
||||||
* a contiguous sequence of characters.
|
|
||||||
*/
|
|
||||||
|
|
||||||
public class MemoryAddressSetCharSequence implements CharSequence {
|
|
||||||
|
|
||||||
private final Memory memory;
|
|
||||||
private final AddressSetView set;
|
|
||||||
private final AddressSetMapping mapping;
|
|
||||||
|
|
||||||
public MemoryAddressSetCharSequence(Memory memory, AddressSetView addressSet)
|
|
||||||
throws MemoryAccessException {
|
|
||||||
this.memory = memory;
|
|
||||||
this.set = addressSet;
|
|
||||||
|
|
||||||
if (addressSet.getNumAddresses() > Integer.MAX_VALUE) {
|
|
||||||
throw new AssertException(
|
|
||||||
"The MemAddressSetCharSequence class only supports address sets of size <= 0x7ffffffff byte addresses.");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!memory.getAllInitializedAddressSet().contains(addressSet)) {
|
|
||||||
throw new MemoryAccessException(
|
|
||||||
"Not all addresses in given address set are in memory!");
|
|
||||||
}
|
|
||||||
|
|
||||||
mapping = new AddressSetMapping(addressSet);
|
|
||||||
}
|
|
||||||
|
|
||||||
public MemoryAddressSetCharSequence(Memory memory, Address start, Address end)
|
|
||||||
throws MemoryAccessException {
|
|
||||||
this(memory, new AddressSet(start, end));
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Takes an index and returns the matching Address
|
|
||||||
* @param index index to search on
|
|
||||||
* @return Address address matched to index
|
|
||||||
*/
|
|
||||||
public Address getAddressAtIndex(int index) {
|
|
||||||
return mapping.getAddress(index);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public int length() {
|
|
||||||
return (int) set.getNumAddresses(); //safe cast because we check in constructor
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public char charAt(int index) {
|
|
||||||
Address address = getAddressAtIndex(index);
|
|
||||||
|
|
||||||
try {
|
|
||||||
byte b = memory.getByte(address);
|
|
||||||
return (char) (b & 0xff);
|
|
||||||
}
|
|
||||||
catch (MemoryAccessException e) {
|
|
||||||
throw new AssertException("Can't happen since we already checked in constructor");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public CharSequence subSequence(int start, int end) {
|
|
||||||
if (start < 0 || start >= length() || end < 0 || end >= length()) {
|
|
||||||
throw new IndexOutOfBoundsException("Start and end must be in [0, " + (length() - 1));
|
|
||||||
}
|
|
||||||
|
|
||||||
Address startAddress = getAddressAtIndex(start);
|
|
||||||
Address endAddress = getAddressAtIndex(end);
|
|
||||||
AddressSet intersectSet = set.intersectRange(startAddress, endAddress);
|
|
||||||
|
|
||||||
try {
|
|
||||||
return new MemoryAddressSetCharSequence(memory, intersectSet);
|
|
||||||
}
|
|
||||||
catch (MemoryAccessException e) {
|
|
||||||
throw new AssertException("Can't happen since we already checked");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
-33
@@ -1,33 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import ghidra.util.datastruct.Accumulator;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* An interface to unify the different methods for searching memory.
|
|
||||||
*/
|
|
||||||
public interface MemorySearchAlgorithm {
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Perform the search
|
|
||||||
*
|
|
||||||
* @param accumulator the results accumulator
|
|
||||||
* @param monitor the monitor
|
|
||||||
*/
|
|
||||||
public void search(Accumulator<MemSearchResult> accumulator, TaskMonitor monitor);
|
|
||||||
}
|
|
||||||
-186
@@ -1,186 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import java.util.ArrayList;
|
|
||||||
import java.util.List;
|
|
||||||
import java.util.regex.Matcher;
|
|
||||||
import java.util.regex.Pattern;
|
|
||||||
|
|
||||||
import ghidra.app.plugin.core.searchmem.RegExSearchData;
|
|
||||||
import ghidra.app.plugin.core.searchmem.SearchData;
|
|
||||||
import ghidra.program.model.address.*;
|
|
||||||
import ghidra.program.model.listing.*;
|
|
||||||
import ghidra.program.model.mem.*;
|
|
||||||
import ghidra.util.Msg;
|
|
||||||
import ghidra.util.datastruct.Accumulator;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Search memory using the provided regular expression.
|
|
||||||
*/
|
|
||||||
public class RegExMemSearcherAlgorithm implements MemorySearchAlgorithm {
|
|
||||||
|
|
||||||
private SearchInfo searchInfo;
|
|
||||||
private AddressSetView searchSet;
|
|
||||||
private Program program;
|
|
||||||
private boolean spanAddressGaps;
|
|
||||||
private int alignment;
|
|
||||||
private CodeUnitSearchInfo codeUnitSearchInfo;
|
|
||||||
|
|
||||||
public RegExMemSearcherAlgorithm(SearchInfo searchInfo, AddressSetView searchSet,
|
|
||||||
Program program, boolean searchAcrossAddressGaps) {
|
|
||||||
|
|
||||||
SearchData data = searchInfo.getSearchData();
|
|
||||||
if (!(data instanceof RegExSearchData)) {
|
|
||||||
throw new IllegalArgumentException(
|
|
||||||
"The given SearchInfo does not contain a RegExSearchData");
|
|
||||||
}
|
|
||||||
|
|
||||||
this.searchInfo = searchInfo;
|
|
||||||
this.searchSet = searchSet;
|
|
||||||
this.program = program;
|
|
||||||
this.spanAddressGaps = searchAcrossAddressGaps;
|
|
||||||
this.alignment = searchInfo.getAlignment();
|
|
||||||
this.codeUnitSearchInfo = searchInfo.getCodeUnitSearchInfo();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void search(Accumulator<MemSearchResult> accumulator, TaskMonitor monitor) {
|
|
||||||
monitor.initialize(searchSet.getNumAddresses());
|
|
||||||
|
|
||||||
if (spanAddressGaps) {
|
|
||||||
searchAddressSet(searchSet, accumulator, monitor, 0);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
AddressRangeIterator rangeIterator = searchSet.getAddressRanges();
|
|
||||||
int progress = 0;
|
|
||||||
int searchLimit = searchInfo.getSearchLimit();
|
|
||||||
while (rangeIterator.hasNext()) {
|
|
||||||
AddressRange range = rangeIterator.next();
|
|
||||||
searchAddressSet(new AddressSet(range), accumulator, monitor, progress);
|
|
||||||
progress += (int) range.getLength();
|
|
||||||
monitor.setProgress(progress);
|
|
||||||
|
|
||||||
if (accumulator.size() >= searchLimit) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private void searchAddressSet(AddressSetView addressSet,
|
|
||||||
Accumulator<MemSearchResult> accumulator, TaskMonitor monitor, int progressCount) {
|
|
||||||
|
|
||||||
if (addressSet.getNumAddresses() <= Integer.MAX_VALUE) {
|
|
||||||
searchSubAddressSet(addressSet, accumulator, monitor, progressCount);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
List<AddressSet> sets = breakSetsByMemoryBlock(addressSet);
|
|
||||||
int searchLimit = searchInfo.getSearchLimit();
|
|
||||||
for (AddressSet set : sets) {
|
|
||||||
searchSubAddressSet(set, accumulator, monitor, progressCount);
|
|
||||||
|
|
||||||
if (accumulator.size() >= searchLimit) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private List<AddressSet> breakSetsByMemoryBlock(AddressSetView addressSet) {
|
|
||||||
Memory mem = program.getMemory();
|
|
||||||
List<AddressSet> list = new ArrayList<>();
|
|
||||||
MemoryBlock[] blocks = mem.getBlocks();
|
|
||||||
for (MemoryBlock memoryBlock : blocks) {
|
|
||||||
|
|
||||||
AddressSet set =
|
|
||||||
addressSet.intersectRange(memoryBlock.getStart(), memoryBlock.getEnd());
|
|
||||||
if (!set.isEmpty()) {
|
|
||||||
list.add(set);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return list;
|
|
||||||
}
|
|
||||||
|
|
||||||
private void searchSubAddressSet(AddressSetView addressSet,
|
|
||||||
Accumulator<MemSearchResult> accumulator, TaskMonitor monitor, int progressCount) {
|
|
||||||
|
|
||||||
SearchData searchData = searchInfo.getSearchData();
|
|
||||||
Pattern pattern = ((RegExSearchData) searchData).getRegExPattern();
|
|
||||||
Memory memory = program.getMemory();
|
|
||||||
int searchLimit = searchInfo.getSearchLimit();
|
|
||||||
|
|
||||||
try {
|
|
||||||
MemoryAddressSetCharSequence charSet =
|
|
||||||
new MemoryAddressSetCharSequence(memory, addressSet);
|
|
||||||
Matcher matcher = pattern.matcher(charSet);
|
|
||||||
|
|
||||||
int searchFrom = 0;
|
|
||||||
while (matcher.find(searchFrom) && !monitor.isCancelled()) {
|
|
||||||
int startIndex = matcher.start();
|
|
||||||
int length = matcher.end() - startIndex;
|
|
||||||
Address address = charSet.getAddressAtIndex(startIndex);
|
|
||||||
if (isMatchingAddress(address, length)) {
|
|
||||||
|
|
||||||
MemSearchResult result = new MemSearchResult(address, length);
|
|
||||||
accumulator.add(result);
|
|
||||||
monitor.setProgress(progressCount + startIndex);
|
|
||||||
|
|
||||||
if (accumulator.size() >= searchLimit) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// move forward by one byte to check for matches within matches
|
|
||||||
searchFrom = startIndex + 1;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
catch (MemoryAccessException e) {
|
|
||||||
Msg.error(this, "Unexpected Exception: " + e.getMessage(), e);
|
|
||||||
monitor.setMessage("Error: Could not read memory");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
protected boolean isMatchingAddress(Address address, long matchSize) {
|
|
||||||
if (address == null) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((address.getOffset() % alignment) != 0) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (codeUnitSearchInfo.searchAll()) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
Listing listing = program.getListing();
|
|
||||||
CodeUnit codeUnit = listing.getCodeUnitContaining(address);
|
|
||||||
if (codeUnit instanceof Instruction) {
|
|
||||||
return codeUnitSearchInfo.isSearchInstructions();
|
|
||||||
}
|
|
||||||
else if (codeUnit instanceof Data) {
|
|
||||||
Data data = (Data) codeUnit;
|
|
||||||
if (data.isDefined()) {
|
|
||||||
return codeUnitSearchInfo.isSearchDefinedData();
|
|
||||||
}
|
|
||||||
return codeUnitSearchInfo.isSearchUndefinedData();
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
@@ -1,133 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search.memory;
|
|
||||||
|
|
||||||
import ghidra.app.plugin.core.searchmem.RegExSearchData;
|
|
||||||
import ghidra.app.plugin.core.searchmem.SearchData;
|
|
||||||
import ghidra.program.model.address.*;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.program.model.mem.Memory;
|
|
||||||
import ghidra.program.util.ProgramSelection;
|
|
||||||
import ghidra.util.task.TaskListener;
|
|
||||||
|
|
||||||
public class SearchInfo {
|
|
||||||
private final SearchData searchData;
|
|
||||||
private int searchLimit;
|
|
||||||
private final boolean forwardSearch;
|
|
||||||
protected final boolean searchSelection;
|
|
||||||
private final int alignment;
|
|
||||||
private final CodeUnitSearchInfo codeUnitSearchInfo;
|
|
||||||
private final TaskListener listener;
|
|
||||||
protected final boolean includeNonLoadedBlocks;
|
|
||||||
|
|
||||||
public SearchInfo(SearchData searchData, int matchLimit, boolean searchSelection,
|
|
||||||
boolean forwardSearch, int alignment, boolean includeNonLoadedBlocks,
|
|
||||||
TaskListener listener) {
|
|
||||||
this(searchData, matchLimit, searchSelection, forwardSearch, alignment,
|
|
||||||
includeNonLoadedBlocks, new CodeUnitSearchInfo(true, true, true), listener);
|
|
||||||
}
|
|
||||||
|
|
||||||
public SearchInfo(SearchData searchData, int searchLimit, boolean searchSelection,
|
|
||||||
boolean forwardSearch, int alignment, boolean includeNonLoadedBlocks,
|
|
||||||
CodeUnitSearchInfo codeUnitSearchInfo, TaskListener listener) {
|
|
||||||
this.searchData = searchData;
|
|
||||||
this.searchLimit = searchLimit;
|
|
||||||
this.searchSelection = searchSelection;
|
|
||||||
this.forwardSearch = forwardSearch;
|
|
||||||
this.alignment = alignment;
|
|
||||||
this.listener = listener;
|
|
||||||
this.codeUnitSearchInfo = codeUnitSearchInfo;
|
|
||||||
this.includeNonLoadedBlocks = includeNonLoadedBlocks;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Generate an address set which only includes initialized memory
|
|
||||||
*
|
|
||||||
* @param program the program
|
|
||||||
* @param startAddress starting point for search or null to start from the top of memory
|
|
||||||
* @param selection addresses to be searched or null to search all memory
|
|
||||||
* @return searchable address set
|
|
||||||
*/
|
|
||||||
protected AddressSetView getSearchableAddressSet(Program program, Address startAddress,
|
|
||||||
ProgramSelection selection) {
|
|
||||||
|
|
||||||
if (startAddress == null) {
|
|
||||||
return new AddressSet(); // special case if we are at the first address going backwards
|
|
||||||
// or the last address going forwards
|
|
||||||
}
|
|
||||||
|
|
||||||
Memory memory = program.getMemory();
|
|
||||||
AddressSetView set = includeNonLoadedBlocks ? memory.getAllInitializedAddressSet()
|
|
||||||
: memory.getLoadedAndInitializedAddressSet();
|
|
||||||
if (searchSelection && selection != null && !selection.isEmpty()) {
|
|
||||||
set = set.intersect(selection);
|
|
||||||
}
|
|
||||||
Address start = forwardSearch ? startAddress : memory.getMinAddress();
|
|
||||||
Address end = forwardSearch ? memory.getMaxAddress() : startAddress;
|
|
||||||
if (start.compareTo(end) > 0) {
|
|
||||||
return new AddressSet();
|
|
||||||
}
|
|
||||||
AddressSet addressSet = program.getAddressFactory().getAddressSet(start, end);
|
|
||||||
return set.intersect(addressSet);
|
|
||||||
}
|
|
||||||
|
|
||||||
public MemorySearchAlgorithm createSearchAlgorithm(Program p, Address start,
|
|
||||||
ProgramSelection selection) {
|
|
||||||
|
|
||||||
AddressSetView asView = getSearchableAddressSet(p, start, selection);
|
|
||||||
|
|
||||||
// note: this should probably be true--is there a reason not to do this?
|
|
||||||
// -also, shouldn't the non-regex searcher cross 'gaps' as well?
|
|
||||||
boolean searchAcrossGaps = false;
|
|
||||||
|
|
||||||
if (searchData instanceof RegExSearchData) {
|
|
||||||
return new RegExMemSearcherAlgorithm(this, asView, p, searchAcrossGaps);
|
|
||||||
}
|
|
||||||
return new MemSearcherAlgorithm(this, asView, p);
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSearchForward() {
|
|
||||||
return forwardSearch;
|
|
||||||
}
|
|
||||||
|
|
||||||
public boolean isSearchAll() {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
public int getAlignment() {
|
|
||||||
return alignment;
|
|
||||||
}
|
|
||||||
|
|
||||||
public TaskListener getListener() {
|
|
||||||
return listener;
|
|
||||||
}
|
|
||||||
|
|
||||||
public SearchData getSearchData() {
|
|
||||||
return searchData;
|
|
||||||
}
|
|
||||||
|
|
||||||
public CodeUnitSearchInfo getCodeUnitSearchInfo() {
|
|
||||||
return codeUnitSearchInfo;
|
|
||||||
}
|
|
||||||
|
|
||||||
public int getSearchLimit() {
|
|
||||||
return searchLimit;
|
|
||||||
}
|
|
||||||
|
|
||||||
public void setSearchLimit(int searchLimit) {
|
|
||||||
this.searchLimit = searchLimit;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+2
-21
@@ -4,9 +4,9 @@
|
|||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
* you may not use this file except in compliance with the License.
|
* you may not use this file except in compliance with the License.
|
||||||
* You may obtain a copy of the License at
|
* You may obtain a copy of the License at
|
||||||
*
|
*
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
*
|
*
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
@@ -160,25 +160,6 @@ public class GhidraScriptRealProgramTest extends AbstractGhidraHeadedIntegration
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
@Test
|
|
||||||
public void testFindBytesAcrossGap() throws Exception {
|
|
||||||
GhidraScript script = getScript();
|
|
||||||
|
|
||||||
AddressSet set = new AddressSet();
|
|
||||||
|
|
||||||
//Match charAt 0x010064db, 0x010064df
|
|
||||||
set.addRange(script.toAddr(0x10064d5), script.toAddr(0x010064db));
|
|
||||||
set.addRange(script.toAddr(0x010064df), script.toAddr(0x010064e3));
|
|
||||||
|
|
||||||
String byteString = "\\x51\\x52";
|
|
||||||
|
|
||||||
Address[] results = script.findBytes(set, byteString, 20, 1, true);
|
|
||||||
|
|
||||||
assertEquals(1, results.length);
|
|
||||||
assertEquals(script.toAddr(0x010064db), results[0]);
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
@Test
|
||||||
public void testFindText() throws Exception {
|
public void testFindText() throws Exception {
|
||||||
GhidraScript script = getScript();
|
GhidraScript script = getScript();
|
||||||
|
|||||||
+2
-2
@@ -26,8 +26,8 @@ import ghidra.app.events.ProgramSelectionPluginEvent;
|
|||||||
import ghidra.app.plugin.core.codebrowser.CodeBrowserPlugin;
|
import ghidra.app.plugin.core.codebrowser.CodeBrowserPlugin;
|
||||||
import ghidra.app.plugin.core.marker.MarkerManagerPlugin;
|
import ghidra.app.plugin.core.marker.MarkerManagerPlugin;
|
||||||
import ghidra.app.plugin.core.programtree.ProgramTreePlugin;
|
import ghidra.app.plugin.core.programtree.ProgramTreePlugin;
|
||||||
import ghidra.app.plugin.core.searchmem.MemSearchPlugin;
|
|
||||||
import ghidra.app.services.ProgramManager;
|
import ghidra.app.services.ProgramManager;
|
||||||
|
import ghidra.features.base.memsearch.gui.MemorySearchPlugin;
|
||||||
import ghidra.features.base.memsearch.gui.MemorySearchProvider;
|
import ghidra.features.base.memsearch.gui.MemorySearchProvider;
|
||||||
import ghidra.features.base.memsearch.mnemonic.MnemonicSearchPlugin;
|
import ghidra.features.base.memsearch.mnemonic.MnemonicSearchPlugin;
|
||||||
import ghidra.framework.plugintool.PluginTool;
|
import ghidra.framework.plugintool.PluginTool;
|
||||||
@@ -58,7 +58,7 @@ public class MnemonicSearchPluginTest extends AbstractGhidraHeadedIntegrationTes
|
|||||||
tool.addPlugin(ProgramTreePlugin.class.getName());
|
tool.addPlugin(ProgramTreePlugin.class.getName());
|
||||||
tool.addPlugin(CodeBrowserPlugin.class.getName());
|
tool.addPlugin(CodeBrowserPlugin.class.getName());
|
||||||
tool.addPlugin(MarkerManagerPlugin.class.getName());
|
tool.addPlugin(MarkerManagerPlugin.class.getName());
|
||||||
tool.addPlugin(MemSearchPlugin.class.getName());
|
tool.addPlugin(MemorySearchPlugin.class.getName());
|
||||||
tool.addPlugin(MnemonicSearchPlugin.class.getName());
|
tool.addPlugin(MnemonicSearchPlugin.class.getName());
|
||||||
plugin = env.getPlugin(MnemonicSearchPlugin.class);
|
plugin = env.getPlugin(MnemonicSearchPlugin.class);
|
||||||
cb = env.getPlugin(CodeBrowserPlugin.class);
|
cb = env.getPlugin(CodeBrowserPlugin.class);
|
||||||
|
|||||||
-97
@@ -1,97 +0,0 @@
|
|||||||
/* ###
|
|
||||||
* IP: GHIDRA
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package ghidra.util.search;
|
|
||||||
|
|
||||||
import static org.junit.Assert.assertEquals;
|
|
||||||
|
|
||||||
import java.util.List;
|
|
||||||
|
|
||||||
import org.junit.Test;
|
|
||||||
|
|
||||||
import ghidra.app.plugin.core.searchmem.RegExSearchData;
|
|
||||||
import ghidra.program.database.ProgramBuilder;
|
|
||||||
import ghidra.program.model.address.AddressSetView;
|
|
||||||
import ghidra.program.model.listing.Program;
|
|
||||||
import ghidra.test.AbstractGhidraHeadlessIntegrationTest;
|
|
||||||
import ghidra.util.datastruct.ListAccumulator;
|
|
||||||
import ghidra.util.search.memory.*;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
|
||||||
|
|
||||||
public class RegExMemSearcherTaskTest extends AbstractGhidraHeadlessIntegrationTest {
|
|
||||||
|
|
||||||
private Program buildProgram() throws Exception {
|
|
||||||
ProgramBuilder builder = new ProgramBuilder("TestX86", ProgramBuilder._X86);
|
|
||||||
builder.createMemory(".text", Long.toHexString(0x1001000), 0x100);
|
|
||||||
builder.createMemory(".text1", Long.toHexString(0x1002000), 0x100);
|
|
||||||
return builder.getProgram();
|
|
||||||
}
|
|
||||||
|
|
||||||
private Program buildLargeProgram() throws Exception {
|
|
||||||
ProgramBuilder builder = new ProgramBuilder("TestX86", ProgramBuilder._X86);
|
|
||||||
builder.createMemory(".text", Long.toHexString(0x1001000), Integer.MAX_VALUE);
|
|
||||||
builder.createMemory(".text1", Long.toHexString(0x1001000 + Integer.MAX_VALUE), 0x100);
|
|
||||||
return builder.getProgram();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
public void testFindMatchesWithinMatches() throws Exception {
|
|
||||||
|
|
||||||
Program p = buildProgram();
|
|
||||||
String regex = "\\x00\\x00\\x00\\x00";
|
|
||||||
RegExSearchData searchData = new RegExSearchData(regex);
|
|
||||||
int max = 50;
|
|
||||||
SearchInfo searchInfo = new SearchInfo(searchData, max, false, true, 1, false, null);
|
|
||||||
AddressSetView addrs = p.getMemory().getLoadedAndInitializedAddressSet();
|
|
||||||
|
|
||||||
RegExMemSearcherAlgorithm searcher =
|
|
||||||
new RegExMemSearcherAlgorithm(searchInfo, addrs, p, false);
|
|
||||||
|
|
||||||
ListAccumulator<MemSearchResult> accumulator = new ListAccumulator<>();
|
|
||||||
searcher.search(accumulator, TaskMonitor.DUMMY);
|
|
||||||
List<MemSearchResult> results = accumulator.asList();
|
|
||||||
|
|
||||||
assertEquals(max, results.size());
|
|
||||||
|
|
||||||
assertEquals(0x1001000, results.get(0).getAddress().getOffset());
|
|
||||||
assertEquals(0x1001001, results.get(1).getAddress().getOffset());
|
|
||||||
assertEquals(0x1001002, results.get(2).getAddress().getOffset());
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test
|
|
||||||
public void testFindMatchesWithinMatchesLargeProgram() throws Exception {
|
|
||||||
|
|
||||||
Program p = buildLargeProgram();
|
|
||||||
String regex = "\\x00\\x00\\x00\\x00";
|
|
||||||
RegExSearchData searchData = new RegExSearchData(regex);
|
|
||||||
int max = 50;
|
|
||||||
SearchInfo searchInfo = new SearchInfo(searchData, max, false, true, 1, false, null);
|
|
||||||
AddressSetView addrs = p.getMemory().getLoadedAndInitializedAddressSet();
|
|
||||||
|
|
||||||
RegExMemSearcherAlgorithm searcher =
|
|
||||||
new RegExMemSearcherAlgorithm(searchInfo, addrs, p, false);
|
|
||||||
|
|
||||||
ListAccumulator<MemSearchResult> accumulator = new ListAccumulator<>();
|
|
||||||
searcher.search(accumulator, TaskMonitor.DUMMY);
|
|
||||||
List<MemSearchResult> results = accumulator.asList();
|
|
||||||
|
|
||||||
assertEquals(max, results.size());
|
|
||||||
|
|
||||||
assertEquals(0x1001000, results.get(0).getAddress().getOffset());
|
|
||||||
assertEquals(0x1001001, results.get(1).getAddress().getOffset());
|
|
||||||
assertEquals(0x1001002, results.get(2).getAddress().getOffset());
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
+28
-20
@@ -4,9 +4,9 @@
|
|||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
* you may not use this file except in compliance with the License.
|
* you may not use this file except in compliance with the License.
|
||||||
* You may obtain a copy of the License at
|
* You may obtain a copy of the License at
|
||||||
*
|
*
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
*
|
*
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
@@ -19,20 +19,26 @@ import java.util.List;
|
|||||||
|
|
||||||
import ghidra.app.cmd.data.exceptionhandling.CreateEHFuncInfoBackgroundCmd;
|
import ghidra.app.cmd.data.exceptionhandling.CreateEHFuncInfoBackgroundCmd;
|
||||||
import ghidra.app.cmd.data.exceptionhandling.EHFunctionInfoModel;
|
import ghidra.app.cmd.data.exceptionhandling.EHFunctionInfoModel;
|
||||||
import ghidra.app.plugin.core.searchmem.RegExSearchData;
|
|
||||||
import ghidra.app.services.*;
|
import ghidra.app.services.*;
|
||||||
import ghidra.app.util.datatype.microsoft.DataApplyOptions;
|
import ghidra.app.util.datatype.microsoft.DataApplyOptions;
|
||||||
import ghidra.app.util.datatype.microsoft.DataValidationOptions;
|
import ghidra.app.util.datatype.microsoft.DataValidationOptions;
|
||||||
import ghidra.app.util.importer.MessageLog;
|
import ghidra.app.util.importer.MessageLog;
|
||||||
|
import ghidra.features.base.memsearch.bytesource.AddressableByteSource;
|
||||||
|
import ghidra.features.base.memsearch.bytesource.ProgramByteSource;
|
||||||
|
import ghidra.features.base.memsearch.gui.SearchSettings;
|
||||||
|
import ghidra.features.base.memsearch.matcher.ByteMatcher;
|
||||||
|
import ghidra.features.base.memsearch.matcher.RegExByteMatcher;
|
||||||
|
import ghidra.features.base.memsearch.searcher.MemoryMatch;
|
||||||
|
import ghidra.features.base.memsearch.searcher.MemorySearcher;
|
||||||
import ghidra.framework.cmd.Command;
|
import ghidra.framework.cmd.Command;
|
||||||
import ghidra.program.model.address.*;
|
import ghidra.program.model.address.*;
|
||||||
import ghidra.program.model.data.InvalidDataTypeException;
|
import ghidra.program.model.data.InvalidDataTypeException;
|
||||||
import ghidra.program.model.listing.Program;
|
import ghidra.program.model.listing.Program;
|
||||||
|
import ghidra.program.model.mem.Memory;
|
||||||
import ghidra.program.model.mem.MemoryBlock;
|
import ghidra.program.model.mem.MemoryBlock;
|
||||||
import ghidra.program.util.ProgramMemoryUtil;
|
import ghidra.program.util.ProgramMemoryUtil;
|
||||||
import ghidra.util.datastruct.ListAccumulator;
|
import ghidra.util.datastruct.ListAccumulator;
|
||||||
import ghidra.util.exception.CancelledException;
|
import ghidra.util.exception.CancelledException;
|
||||||
import ghidra.util.search.memory.*;
|
|
||||||
import ghidra.util.task.TaskMonitor;
|
import ghidra.util.task.TaskMonitor;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -81,24 +87,26 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
|
|||||||
"[\\x20,\\x21,\\x22]\\x05\\x93[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]";
|
"[\\x20,\\x21,\\x22]\\x05\\x93[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]";
|
||||||
String bePattern =
|
String bePattern =
|
||||||
"[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]\\x93\\x05[\\x20,\\x21,\\x22]";
|
"[\\x19,\\x39,\\x59,\\x79,\\x99,\\xb9,\\xd9,\\xf9]\\x93\\x05[\\x20,\\x21,\\x22]";
|
||||||
RegExSearchData regExSearchData = RegExSearchData.createRegExSearchData(
|
|
||||||
program.getLanguage().isBigEndian() ? bePattern : lePattern);
|
String pattern = program.getLanguage().isBigEndian() ? bePattern : lePattern;
|
||||||
int alignment = 4;
|
int alignment = 4;
|
||||||
SearchInfo searchInfo = new SearchInfo(regExSearchData, MATCH_LIMIT, false, true, alignment,
|
|
||||||
false, new CodeUnitSearchInfo(false, true, true), null);
|
|
||||||
|
|
||||||
// Only want to search loaded and initialized addresses.
|
SearchSettings settings = new SearchSettings().withAlignment(alignment);
|
||||||
AddressSet intersection =
|
settings = settings.withIncludeInstructions(false); // only search data
|
||||||
program.getMemory().getLoadedAndInitializedAddressSet().intersect(set);
|
|
||||||
|
ByteMatcher matcher = new RegExByteMatcher(pattern, settings);
|
||||||
|
AddressableByteSource byteSource = new ProgramByteSource(program);
|
||||||
|
Memory memory = program.getMemory();
|
||||||
|
AddressSet addresses = memory.getLoadedAndInitializedAddressSet().intersect(set);
|
||||||
|
|
||||||
// Only want to search exception handling memory blocks.
|
// Only want to search exception handling memory blocks.
|
||||||
intersection = getAddressSet(ehBlocks).intersect(intersection);
|
addresses = getAddressSet(ehBlocks).intersect(addresses);
|
||||||
|
|
||||||
RegExMemSearcherAlgorithm searcher =
|
MemorySearcher searcher = new MemorySearcher(byteSource, matcher, addresses, MATCH_LIMIT);
|
||||||
new RegExMemSearcherAlgorithm(searchInfo, intersection, program, true);
|
|
||||||
|
|
||||||
ListAccumulator<MemSearchResult> accumulator = new ListAccumulator<>();
|
ListAccumulator<MemoryMatch> accumulator = new ListAccumulator<>();
|
||||||
searcher.search(accumulator, monitor);
|
searcher.findAll(accumulator, monitor);
|
||||||
List<MemSearchResult> results = accumulator.asList();
|
List<MemoryMatch> results = accumulator.asList();
|
||||||
|
|
||||||
// Establish the options to use when creating the exception handling data.
|
// Establish the options to use when creating the exception handling data.
|
||||||
// For now these are fixed. Later these may need to come from analysis options.
|
// For now these are fixed. Later these may need to come from analysis options.
|
||||||
@@ -109,14 +117,14 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
|
|||||||
|
|
||||||
// Attempt to create data at each address if it appears to be valid for the data type.
|
// Attempt to create data at each address if it appears to be valid for the data type.
|
||||||
int count = 0;
|
int count = 0;
|
||||||
for (MemSearchResult result : results) {
|
for (MemoryMatch match : results) {
|
||||||
|
|
||||||
monitor.setProgress(count++);
|
monitor.setProgress(count++);
|
||||||
if (monitor.isCancelled()) {
|
if (monitor.isCancelled()) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
Address address = result.getAddress();
|
Address address = match.getAddress();
|
||||||
if (address.getOffset() % alignment != 0) {
|
if (address.getOffset() % alignment != 0) {
|
||||||
continue; // Skip non-aligned addresses.
|
continue; // Skip non-aligned addresses.
|
||||||
}
|
}
|
||||||
@@ -130,7 +138,7 @@ public class PEExceptionAnalyzer extends AbstractAnalyzer {
|
|||||||
|
|
||||||
// Create FuncInfo data at the address of the magic number, if the data appears valid.
|
// Create FuncInfo data at the address of the magic number, if the data appears valid.
|
||||||
// This can also create associated exception handling data based on the options.
|
// This can also create associated exception handling data based on the options.
|
||||||
Command cmd =
|
Command<Program> cmd =
|
||||||
new CreateEHFuncInfoBackgroundCmd(address, validationOptions, applyOptions);
|
new CreateEHFuncInfoBackgroundCmd(address, validationOptions, applyOptions);
|
||||||
cmd.applyTo(program);
|
cmd.applyTo(program);
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user