x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 4 Activity

DBG (ANALYSIS): formatting

This commit is contained in:
Mr. eXoDia 2014-08-27 15:20:53 +02:00
parent 8399a77015
commit 3cb5805d5c
8 changed files with 224 additions and 218 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
x64_dbg_dbg/Analysis/AnalysisRunner.cpp
View File

@ -111,7 +111,7 @@ bool AnalysisRunner::disasmChilds(const duint subTreeStartAddress, const duint p
{ {
// disassemble instruction // disassemble instruction
const int instrLength = Disasm(&disasm); const int instrLength = Disasm(&disasm);
DISASM *disasm2 = new DISASM; DISASM* disasm2 = new DISASM;
*disasm2 = disasm; *disasm2 = disasm;
// everything ok? // everything ok?
if(instrLength != UNKNOWN_OPCODE) if(instrLength != UNKNOWN_OPCODE)
@ -304,7 +304,7 @@ void AnalysisRunner::emulateInstructions()
Register->emulate(&(it->second.BeaStruct)); Register->emulate(&(it->second.BeaStruct));
//for(std::vector<ClientInterface>::iterator itt = interfaces.begin();itt!=interfaces.end();itt++) //for(std::vector<ClientInterface>::iterator itt = interfaces.begin();itt!=interfaces.end();itt++)
a->see(it->second,Register,Stack); a->see(it->second, Register, Stack);
b->see(it->second, Register, Stack); b->see(it->second, Register, Stack);
// next instruction // next instruction
it++; it++;

9
x64_dbg_dbg/Analysis/ClientApiResolver.cpp
View File

@ -31,12 +31,13 @@ void ClientApiResolver::see(const Instruction_t Instr, const RegisterEmulator* r
{ {
if(n->outEdge->type == fa::CALL) if(n->outEdge->type == fa::CALL)
{ {
ttDebug("api: found call at "fhex" to "fhex" \n", (duint)Instr.BeaStruct.VirtualAddr,n->outEdge->end->vaddr); ttDebug("api: found call at "fhex" to "fhex" \n", (duint)Instr.BeaStruct.VirtualAddr, n->outEdge->end->vaddr);
// test if the end has an edge, too // test if the end has an edge, too
ttDebug("api: opcode is %x \n",(((n->outEdge->end))->instruction.BeaStruct.Instruction.Opcode)&0xFF); ttDebug("api: opcode is %x \n", (((n->outEdge->end))->instruction.BeaStruct.Instruction.Opcode) & 0xFF);
ttDebug("api: opcode is %x \n",Analysis->graph()->node(n->outEdge->end->vaddr)->instruction.BeaStruct.Instruction.Opcode); ttDebug("api: opcode is %x \n", Analysis->graph()->node(n->outEdge->end->vaddr)->instruction.BeaStruct.Instruction.Opcode);
if(((n->outEdge->end))->instruction.BeaStruct.Instruction.Opcode == 0xFF){ if(((n->outEdge->end))->instruction.BeaStruct.Instruction.Opcode == 0xFF)
{
tDebug("api: --> is API CALL\n", (duint)n->outEdge->end->instruction.BeaStruct.VirtualAddr); tDebug("api: --> is API CALL\n", (duint)n->outEdge->end->instruction.BeaStruct.VirtualAddr);
// there is an api call // there is an api call
//DbgSetAutoCommentAt((duint)Instr.BeaStruct.VirtualAddr, "hi"); //DbgSetAutoCommentAt((duint)Instr.BeaStruct.VirtualAddr, "hi");

5
x64_dbg_dbg/Analysis/ClientFunctionFinder.cpp
View File

@ -45,10 +45,11 @@ void ClientFunctionFinder::see(const Instruction_t Instr, const RegisterEmulator
// there is a branching! // there is a branching!
if(n->outEdge->type == fa::RET) if(n->outEdge->type == fa::RET)
{ {
if((duint) n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue != Analysis->oep()){ if((duint) n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue != Analysis->oep())
{
// internal call // internal call
DbgSetAutoFunctionAt((duint)n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue, (duint)Instr.BeaStruct.VirtualAddr); DbgSetAutoFunctionAt((duint)n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue, (duint)Instr.BeaStruct.VirtualAddr);
tDebug("add function from "fhex" to "fhex"\n",(duint) n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue, (duint)Instr.BeaStruct.VirtualAddr); tDebug("add function from "fhex" to "fhex"\n", (duint) n->outEdge->end->instruction.BeaStruct.Instruction.AddrValue, (duint)Instr.BeaStruct.VirtualAddr);
} }
} }

80
x64_dbg_dbg/Analysis/FlowGraph.cpp
View File

@ -6,40 +6,43 @@
namespace fa namespace fa
{ {
FlowGraph::FlowGraph(AnalysisRunner * ana) : analysis(ana) FlowGraph::FlowGraph(AnalysisRunner* ana) : analysis(ana)
{ {
} }
FlowGraph::~FlowGraph(void) FlowGraph::~FlowGraph(void)
{ {
} }
bool FlowGraph::insertNode(Node_t* node) bool FlowGraph::insertNode(Node_t* node)
{ {
// if (!contains(nodes,(duint)node->vaddr)) // if (!contains(nodes,(duint)node->vaddr))
// { // {
// return (nodes.insert(std::make_pair<duint,Node_t*>(node->vaddr,node))).second; // return (nodes.insert(std::make_pair<duint,Node_t*>(node->vaddr,node))).second;
// } // }
return true; return true;
} }
bool FlowGraph::insertEdge(Node_t* startNode, Node_t* endNode, EdgeType currentEdgeType) bool FlowGraph::insertEdge(Node_t* startNode, Node_t* endNode, EdgeType currentEdgeType)
{
Node_t* workStart;
Node_t* workEnd;
if(!contains(nodes, startNode->vaddr))
{ {
Node_t *workStart; nodes.insert(std::pair<duint, Node_t*>(startNode->vaddr, startNode));
Node_t *workEnd;
if(!contains(nodes,startNode->vaddr)){
nodes.insert(std::pair<duint,Node_t*>(startNode->vaddr, startNode));
} }
if(!contains(nodes,endNode->vaddr)){ if(!contains(nodes, endNode->vaddr))
nodes.insert(std::pair<duint,Node_t*>(endNode->vaddr, endNode)); {
nodes.insert(std::pair<duint, Node_t*>(endNode->vaddr, endNode));
} }
workStart = &*(nodes.find(startNode->vaddr)->second); workStart = &*(nodes.find(startNode->vaddr)->second);
workEnd = &*(nodes.find(endNode->vaddr)->second); workEnd = &*(nodes.find(endNode->vaddr)->second);
if (startNode->hasInstr && !((nodes.find(startNode->vaddr)->second))->hasInstr){ if(startNode->hasInstr && !((nodes.find(startNode->vaddr)->second))->hasInstr)
{
ttDebug("updating old startnode"); ttDebug("updating old startnode");
workStart->instruction = startNode->instruction; workStart->instruction = startNode->instruction;
} }
@ -49,8 +52,8 @@ namespace fa
Edge_t* edge = new Edge_t(workStart, workEnd, currentEdgeType); Edge_t* edge = new Edge_t(workStart, workEnd, currentEdgeType);
edges.insert(std::pair<duint,Edge_t*>(workStart->vaddr,edge)); edges.insert(std::pair<duint, Edge_t*>(workStart->vaddr, edge));
std::map<duint,Edge_t*>::iterator ansiter = edges.find(workStart->vaddr); std::map<duint, Edge_t*>::iterator ansiter = edges.find(workStart->vaddr);
edge = &*(ansiter->second); edge = &*(ansiter->second);
edge->start = workStart; edge->start = workStart;
edge->end = workEnd; edge->end = workEnd;
@ -60,11 +63,11 @@ namespace fa
return true; return true;
} }
void FlowGraph::clean() void FlowGraph::clean()
{ {
// first delete all edges whoses aks for it // first delete all edges whoses aks for it
std::map<duint, Edge_t*>::iterator e = edges.begin(); std::map<duint, Edge_t*>::iterator e = edges.begin();
while(e != edges.end()) while(e != edges.end())
@ -89,9 +92,9 @@ namespace fa
nodes.erase(current); nodes.erase(current);
} }
} }
} }
bool FlowGraph::find(const duint va , Node_t* node) bool FlowGraph::find(const duint va , Node_t* node)
{ {
if(contains(nodes, va)) if(contains(nodes, va))
{ {
std::map<duint, Node_t*>::iterator iter = nodes.find(va); std::map<duint, Node_t*>::iterator iter = nodes.find(va);
@ -104,9 +107,9 @@ namespace fa
} }
return false; return false;
} }
Node_t* FlowGraph::node(const duint va) Node_t* FlowGraph::node(const duint va)
{ {
if(contains(nodes, va)) if(contains(nodes, va))
{ {
std::map<duint, Node_t*>::iterator iter = nodes.find(va); std::map<duint, Node_t*>::iterator iter = nodes.find(va);
@ -115,17 +118,18 @@ namespace fa
} }
return NULL; return NULL;
} }
void FlowGraph::fillNodes() void FlowGraph::fillNodes()
{
for(std::map<duint, Node_t*>::iterator i = nodes.begin(); i != nodes.end(); i++)
{ {
for(std::map<duint, Node_t*>::iterator i=nodes.begin();i!=nodes.end();i++){ i->second->hasInstr = true;
i->second->hasInstr=true;
i->second->instruction.BeaStruct = analysis->instruction_t(i->first).BeaStruct; i->second->instruction.BeaStruct = analysis->instruction_t(i->first).BeaStruct;
if(i->second->instruction.BeaStruct.Instruction.Opcode == 0xFF) if(i->second->instruction.BeaStruct.Instruction.Opcode == 0xFF)
ttDebug("ext jump at %x",i->first); ttDebug("ext jump at %x", i->first);
}
} }
}

4
x64_dbg_dbg/Analysis/FlowGraph.h
View File

@ -18,9 +18,9 @@ class FlowGraph
// all existing nodes // all existing nodes
std::map<duint, Node_t*> nodes; std::map<duint, Node_t*> nodes;
AnalysisRunner *analysis; AnalysisRunner* analysis;
public: public:
FlowGraph(AnalysisRunner *ana); FlowGraph(AnalysisRunner* ana);
~FlowGraph(void); ~FlowGraph(void);
void clean(); void clean();
// insert a new node an returns the existing node if there was already the node // insert a new node an returns the existing node if there was already the node

32
x64_dbg_dbg/Analysis/Meta.h
View File

@ -28,14 +28,14 @@
namespace fa namespace fa
{ {
enum EdgeType{RET,CALL,EXTERNCALL,CONDJMP,UNCONDJMP,EXTERNJMP,INF,UNKOWN}; enum EdgeType {RET, CALL, EXTERNCALL, CONDJMP, UNCONDJMP, EXTERNJMP, INF, UNKOWN};
// every edge in the application flow graph is an instruction that active modifies the EIP // every edge in the application flow graph is an instruction that active modifies the EIP
typedef struct Instruction_t typedef struct Instruction_t
{ {
DISASM BeaStruct; DISASM BeaStruct;
unsigned int Length; unsigned int Length;
@ -50,10 +50,10 @@ namespace fa
BeaStruct = DISASM(); BeaStruct = DISASM();
Length = UNKNOWN_OPCODE; Length = UNKNOWN_OPCODE;
} }
} Instruction_t; } Instruction_t;
struct ArgumentInfo_t struct ArgumentInfo_t
{ {
std::string Type; std::string Type;
std::string Name; std::string Name;
@ -64,10 +64,10 @@ namespace fa
} }
ArgumentInfo_t() {} ArgumentInfo_t() {}
}; };
struct FunctionInfo_t struct FunctionInfo_t
{ {
std::string DLLName; std::string DLLName;
std::string ReturnType; std::string ReturnType;
std::string Name; std::string Name;
@ -104,16 +104,16 @@ namespace fa
} }
}; };
template<typename T, typename D> template<typename T, typename D>
bool contains(std::map<T, D> s, T key) bool contains(std::map<T, D> s, T key)
{ {
std::map<T, D>::iterator it = s.find(key); std::map<T, D>::iterator it = s.find(key);
return (it != s.end()); return (it != s.end());
} }
typedef std::map<duint, Instruction_t>::const_iterator instrIter; typedef std::map<duint, Instruction_t>::const_iterator instrIter;

2
x64_dbg_dbg/Analysis/Node_t.cpp
View File

@ -11,7 +11,7 @@ Node_t::Node_t(Instruction_t t)
outEdge = NULL; outEdge = NULL;
instruction = t; instruction = t;
vaddr = (duint)t.BeaStruct.VirtualAddr; vaddr = (duint)t.BeaStruct.VirtualAddr;
hasInstr=true; hasInstr = true;
} }
Node_t::Node_t(duint va) Node_t::Node_t(duint va)