java.lang.Object | |
↳ | com.pnfsoftware.jeb.core.units.code.asm.analyzer.AbstractAnalyzerExtension<InsnType extends com.pnfsoftware.jeb.core.units.code.IInstruction> |
Extension of the INativeCodeAnalyzer
.
Fields | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
protected INativeCodeAnalyzer<InsnType extends IInstruction> | gca | ||||||||||
protected BinaryPatternVerifier | paddingVerifier | ||||||||||
protected BinaryPatternVerifier | prologueVerifier |
Public Constructors | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
AbstractAnalyzerExtension() |
Public Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ChainedOperationResult<Boolean> |
customizeInstructionItem(INativeInstructionItem item)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
determinePotentialPointers(long address, InsnType insn, List<PointerDescription> values)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
determinePotentialPointersInProtoBlock(IBasicBlockSkeleton<InsnType> blk, List<PointerLocation> values)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Integer> |
determineRoutineStackPointerDelta(CFG<InsnType> routine)
The default result (
getResult() ) is null. | ||||||||||
ChainedOperationResult<SwitchInformation> |
determineSwitchInformation(long branchInstructionAddress, IBasicBlockSkeleton<InsnType> branchInstructionBlock, List<IBasicBlockSkeleton<InsnType>> knownBlocks)
The default result (
getResult() ) is null. | ||||||||||
ChainedOperationResult<Long> |
getPossiblePaddingSize(long address, long addressMax)
Default implementation checks the patterns stored in
paddingVerifier . | ||||||||||
ChainedOperationResult<NativeDecompilationStage> |
getPreferredAdvancedAnalysisStage(INativeMethodItem routine)
The default result (
getResult() ) is SIMULATION . | ||||||||||
ChainedOperationResult<IFlowInformation> |
getPreferredBreakingFlow(long address, InsnType insn)
The default result (
getResult() ) is null. | ||||||||||
IPrimitiveSizes |
getPrimitiveSizes(SubsystemType subsystemType, CompilerType compilerType)
The default implementation returns null.
| ||||||||||
ChainedOperationResult<List<EntryPointDescription>> |
getProbableEntryPoints(long address, long addressMax)
Get the likely entry points in the given memory area.
| ||||||||||
ChainedOperationResult<EntryPointDescription> |
getPrologueLooking(long address, long addressMax)
Default implementation checks the patterns stored in
prologueVerifier . | ||||||||||
ChainedOperationResult<? extends PointerDescription> |
getTrampolineTarget(CFG<InsnType> routine)
The default result (
getResult() ) is null. | ||||||||||
INativeCodeUnit<InsnType> |
getUnit()
Get the code unit managing
INativeCodeAnalyzer . | ||||||||||
void |
initialize(INativeCodeAnalyzer<InsnType> analyzer)
Must be called by the GCA.
| ||||||||||
ChainedOperationResult<Boolean> |
isCandidateSwitchDispatcher(long branchInstructionAddress, InsnType branchInstruction, IBasicBlockSkeleton<InsnType> branchInstructionBlock)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
isNonReturningRoutine(INativeMethodItem routine)
Determine if the given routine is non-returning.
| ||||||||||
ChainedOperationResult<Boolean> |
postprocessImage(int passIndex)
This method is called after the standard analysis pass completes (i.e., before any optional
advanced analysis takes place).
| ||||||||||
ChainedOperationResult<Boolean> |
preprocessImage(int passIndex)
This method is called before an analysis pass is performed.
| ||||||||||
ChainedOperationResult<Boolean> |
shouldForceRoutineEnd(long address, InsnType insn)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
sigMatchingPostProcess(int passIndex)
This method is called after signatures matching was performed.
| ||||||||||
void |
typeManagerInitialized(ITypeManager typeman)
The default implementation does nothing.
| ||||||||||
ChainedOperationResult<Boolean> |
verifyGapRoutineCandidate(long address)
The default implementation returns true, that is a candidate address for a routine creation
in a gap will be authorized by default.
|
Protected Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
void |
initializePaddingPatterns(BinaryPatternVerifier paddingVerifier)
The default implementation does nothing.
| ||||||||||
void |
initializeProloguePatterns(BinaryPatternVerifier prologueVerifier)
The default implementation does nothing.
|
[Expand]
Inherited Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
![]() | |||||||||||
![]() |
The default result (getResult()
) is false.
The default result (getResult()
) is false.
address | address of the instruction |
---|---|
insn | instruction to be examined |
values | output collection of pointers |
getResult()
; false to let the code
analyzer proceed with its own (generic) pointer discovery algorithm; true to instruct
it to skip it
The default result (getResult()
) is false.
blk | preliminary basic block to be examined |
---|---|
values | output collection of pointers |
The default result (getResult()
) is null.
getResult()
, null if the routine failed
to determine the stack pointer delta
The default result (getResult()
) is null.
SwitchInformation
in getResult()
(might be
empty), null if the routine failed
Default implementation checks the patterns stored in paddingVerifier
. When alignment
information are present, only unaligned data is considered padding. If nothing is found,
result (getResult()
) is 0L.
address | address to be examined (inclusive) |
---|---|
addressMax | end address to be examined (exclusive) |
getResult()
; the size of the padding-like
area from address, 0L if it does not look like padding
The default result (getResult()
) is SIMULATION
.
The default result (getResult()
) is null.
The default implementation returns null.
subsystemType | optional hint |
---|---|
compilerType | optional hint |
Get the likely entry points in the given memory area. It might provide several entry points (with different modes) ordered by their likelihood.
This method is not guaranteed to give the correct result, and should be considered an heuristic. It is intended to be used before the actual disassembly of code; it may provide a hint on the entry point to disassemble with.
getResult()
, ordered from the most probable to the
least probable. The list will be empty if none could be determined
Default implementation checks the patterns stored in prologueVerifier
. Can be
overridden, but sub-class should call super-method first. If nothing is found, result
(getResult()
) is null.
address | address to be examined (inclusive) |
---|---|
addressMax | end address to be examined (exclusive) |
EntryPointDescription
in getResult()
if a
prologue was found, possibly at a different address than address parameter, null if
no prologue was found.
The default result (getResult()
) is null.
PointerDescription
in getResult()
for the
target, null if none (i.e. routine is not a trampoline, or target could not be
retrieved) (the return value is not the target itself, but a pointer to the target)
Get the code unit managing INativeCodeAnalyzer
. This method allows extensions to
easily retrieve properties of the managing code unit.
Important: no guarantee is given on the unit's state; this method should be used preferably to retrieve static features (eg, unit's properties).
Must be called by the GCA. We cannot use @SerCustomInit here, as the GCA may not exist yet (eg, unprocessed unit).
The default result (getResult()
) is false.
getResult()
; true if the instruction
might correspond to a switch-like statement, false otherwise
Determine if the given routine is non-returning.
getResult()
; true if the routine does not
return, false otherwise, null when no determination could be made
This method is called after the standard analysis pass completes (i.e., before any optional advanced analysis takes place).
passIndex | 0-based analysis pass index |
---|
This method is called before an analysis pass is performed.
passIndex | 0-based analysis pass index |
---|
The default result (getResult()
) is false.
insn | parsed instruction at the provided address |
---|
getResult()
; true if the address should
be considered a routine termination, false otherwise
This method is called after signatures matching was performed.
passIndex | 0-based analysis pass index |
---|
The default implementation returns true, that is a candidate address for a routine creation in a gap will be authorized by default. Extensions that need to perform additional checks can override this method.
address | routine start address |
---|
The default implementation does nothing.
The default implementation does nothing.