diff --git a/FIDL/decompiler_utils.py b/FIDL/decompiler_utils.py index df6320f..da639ae 100644 --- a/FIDL/decompiler_utils.py +++ b/FIDL/decompiler_utils.py @@ -12,8 +12,7 @@ # # =========================================================================== -__version__ = '1.0' -__codename__ = 'nerdilicious' +__version__ = '1.1' from idc import * from idaapi import * @@ -2247,7 +2246,7 @@ def get_all_vars_in_node(cex): return var_indexes -def find_all_calls_to(f_name, ea): +def find_all_calls_to_within(f_name, ea): """Finds all calls to a function with the given name \ within the function containing the ``ea`` address. @@ -2266,7 +2265,7 @@ def find_all_calls_to(f_name, ea): try: c = controlFlowinator(ea=ea, fast=False) except Exception as e: - print("Failed to find_all_calls_to {}".format(f_name)) + print("Failed to find_all_calls_to_within {}".format(f_name)) print(e) return [] @@ -2285,6 +2284,43 @@ def find_all_calls_to(f_name, ea): return call_objs +def find_all_calls_to(f_name): + """Finds all calls to a function with the given name + + Note that the string comparison is relaxed to find variants of it, that is, + searching for ``malloc`` will match as well ``_malloc``, ``malloc_0``, etc. + + :param f_name: the function name to search for + :type f_name: string + :return: a list of :class:`callObj` + :rtype: list + """ + + f_ea = get_name_ea_simple(f_name) + if f_ea == BADADDR: + print("Failed to resolve address for {}".format(f_name)) + return [] + + callz = [] + callers = set() + + for ref in XrefsTo(f_ea, True): + if not ref.iscode: + continue + + # Get a set of unique *function* callers + f = get_func(ref.frm) + f_ea = f.start_ea + callers.add(f_ea) + + for caller_ea in callers: + c = find_all_calls_to_within(f_name, caller_ea) + print("{:X}".format(caller_ea), len(c)) + callz += c + + return callz + + def find_elements_of_type(cex, element_type, elements=None): """Recursively extracts expression elements until \ a :class:`cexpr_t` from a specific group is found diff --git a/FIDL/docs/_build/html/_sources/tutorial.rst.txt b/FIDL/docs/_build/html/_sources/tutorial.rst.txt index 37baf71..429c462 100644 --- a/FIDL/docs/_build/html/_sources/tutorial.rst.txt +++ b/FIDL/docs/_build/html/_sources/tutorial.rst.txt @@ -449,7 +449,7 @@ The following script implements this: import FIDL.decompiler_utils as du - callz = du.find_all_calls_to(f_name='GetProcAddress', ea=here()) + callz = du.find_all_calls_to_within(f_name='GetProcAddress', ea=here()) for co in callz: # The *second* argument of ``GetProcAddress`` is the API name api_name = co.args[1].val @@ -540,8 +540,8 @@ The example script can be found on the **examples** directory of the source code results = [] suspicious_lens = [] - mallocz = du.find_all_calls_to('malloc', c.ea) - memcpyz = du.find_all_calls_to('memcpy', c.ea) + mallocz = du.find_all_calls_to_within('malloc', c.ea) + memcpyz = du.find_all_calls_to_within('memcpy', c.ea) if not mallocz or not memcpyz: return [] @@ -617,7 +617,7 @@ The example script can be found on the **examples** directory of the source code As we can see, :ref:`controlFlowinator_label` object is indeed the central piece of this API. It is the only argument of the function ``find_possible_malloc_issues`` at line 14. The convenience function ``do_for_all_funcs`` (line 89) is used to iterate over all functions on a binary, calculate their ``controlFlowinator`` and call a function with it as parameter (see line 90) and the API documentation for more information about this wrapper. -At lines 27, 28 all occurrences of calls to ``malloc`` and ``memcpy`` are calculated. The result of ``find_all_calls_to`` are so called ``callObj``, a complex data structure containing a lot of information about the *call* (name, arguments, location, etc.) +At lines 27, 28 all occurrences of calls to ``malloc`` and ``memcpy`` are calculated. The result of ``find_all_calls_to_within`` are so called ``callObj``, a complex data structure containing a lot of information about the *call* (name, arguments, location, etc.) The argument of ``malloc`` is used as a parameter of ``is_arithmetic_expression`` (line 41), an auxiliary function returning a *boolean*, indicating whether the expression is arithmetic (that is, addition, substraction, multiplication, etc. or a combination of them). In this specific case we specify a second parameter to restrict the search to additions only. diff --git a/FIDL/docs/_build/html/api.html b/FIDL/docs/_build/html/api.html index e50696c..cb5b1cd 100644 --- a/FIDL/docs/_build/html/api.html +++ b/FIDL/docs/_build/html/api.html @@ -548,8 +548,8 @@
-
-decompiler_utils.find_all_calls_to(f_name, ea)
+
+decompiler_utils.find_all_calls_to_within(f_name, ea)

Finds all calls to a function with the given name within the function containing the ea address.

Note that the string comparison is relaxed to find variants of it, that is, searching for malloc will match as well _malloc, malloc_0, etc.

diff --git a/FIDL/docs/_build/html/api_overview.html b/FIDL/docs/_build/html/api_overview.html index ab37fae..f826012 100644 --- a/FIDL/docs/_build/html/api_overview.html +++ b/FIDL/docs/_build/html/api_overview.html @@ -597,8 +597,8 @@
-
-decompiler_utils.find_all_calls_to(f_name, ea)
+
+decompiler_utils.find_all_calls_to_within(f_name, ea)

Finds all calls to a function with the given name within the function containing the ea address

diff --git a/FIDL/docs/_build/html/genindex.html b/FIDL/docs/_build/html/genindex.html index 3f3504d..2560bb9 100644 --- a/FIDL/docs/_build/html/genindex.html +++ b/FIDL/docs/_build/html/genindex.html @@ -260,7 +260,7 @@

D

F

    diff --git a/FIDL/docs/_build/html/searchindex.js b/FIDL/docs/_build/html/searchindex.js index 79df99b..10e41e5 100644 --- a/FIDL/docs/_build/html/searchindex.js +++ b/FIDL/docs/_build/html/searchindex.js @@ -1 +1 @@ -Search.setIndex({docnames:["api","gotchas","index","installation","tutorial"],envversion:{"sphinx.domains.c":1,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":1,"sphinx.domains.javascript":1,"sphinx.domains.math":2,"sphinx.domains.python":1,"sphinx.domains.rst":1,"sphinx.domains.std":1,sphinx:56},filenames:["api.rst","gotchas.rst","index.rst","installation.rst","tutorial.rst"],objects:{"":{decompiler_utils:[0,0,0,"-"]},"decompiler_utils.BBGraph":{find_connected_paths:[0,2,1,""],get_node:[0,2,1,""]},"decompiler_utils.cImporter":{get_imports_info:[0,2,1,""]},"decompiler_utils.controlFlowinator":{dump_cfg:[0,2,1,""],dump_i_cfg:[0,2,1,""]},"decompiler_utils.pseudoViewer":{OPEN_NEW:[0,4,1,""],REUSE_IF_PSEUDOCODE:[0,4,1,""],USE_EXISTING:[0,4,1,""],close:[0,2,1,""],show:[0,2,1,""]},decompiler_utils:{BBGraph:[0,1,1,""],NonLibFunctions:[0,3,1,""],all_paths_between:[0,3,1,""],assigns_to_var:[0,3,1,""],blowup_expression:[0,3,1,""],cImporter:[0,1,1,""],callObj:[0,1,1,""],citem2higher:[0,3,1,""],controlFlowinator:[0,1,1,""],create_comment:[0,3,1,""],debug_blownup_expressions:[0,3,1,""],debug_get_break_statements:[0,3,1,""],debug_stahp:[0,3,1,""],decast:[0,3,1,""],display_all_calls_to:[0,3,1,""],display_line_at:[0,3,1,""],display_node:[0,3,1,""],display_path:[0,3,1,""],do_for_all_funcs:[0,3,1,""],does_constrain:[0,3,1,""],dprint:[0,3,1,""],dump_lvars:[0,3,1,""],dump_pseudocode:[0,3,1,""],find_all_calls_to:[0,3,1,""],find_elements_of_type:[0,3,1,""],get_all_vars_in_node:[0,3,1,""],get_cfg_for_ea:[0,3,1,""],get_cond_from_statement:[0,3,1,""],get_function_vars:[0,3,1,""],get_interesting_calls:[0,3,1,""],get_return_type:[0,3,1,""],is_arithmetic_expression:[0,3,1,""],is_array_indexing:[0,3,1,""],is_asg:[0,3,1,""],is_binary_truncation:[0,3,1,""],is_call:[0,3,1,""],is_cast:[0,3,1,""],is_final_expr:[0,3,1,""],is_global_var:[0,3,1,""],is_if:[0,3,1,""],is_number:[0,3,1,""],is_ptr:[0,3,1,""],is_read:[0,3,1,""],is_ref:[0,3,1,""],is_string:[0,3,1,""],is_var:[0,3,1,""],is_write:[0,3,1,""],lex_citem_indexes:[0,3,1,""],lines_and_code:[0,3,1,""],main:[0,3,1,""],map_citem2line:[0,3,1,""],map_line2citem:[0,3,1,""],map_line2node:[0,3,1,""],map_node2lines:[0,3,1,""],my_decompile:[0,3,1,""],my_get_func_name:[0,3,1,""],my_var_t:[0,1,1,""],num_value:[0,3,1,""],points_to:[0,3,1,""],pseudoViewer:[0,1,1,""],ref2var:[0,3,1,""],ref_to:[0,3,1,""],string_value:[0,3,1,""],value_of_global:[0,3,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","class","Python class"],"2":["py","method","Python method"],"3":["py","function","Python function"],"4":["py","attribute","Python attribute"]},objtypes:{"0":"py:module","1":"py:class","2":"py:method","3":"py:function","4":"py:attribute"},terms:{"0i64":4,"0x0":4,"0x00000176b566be48":4,"0x000001d756db21c8":4,"0x000002a0b67f5b08":4,"0x1":4,"0x100l":4,"0x140055674":4,"0x2":4,"0x3":4,"0x3eal":4,"0x55":4,"0xffff":0,"1002l":4,"14000f698":4,"14000fcfc":4,"1400588f6":4,"14005892e":4,"1400909a8":4,"1i64":4,"3rd":4,"40118a":4,"401c88":4,"401cba":4,"4198400l":4,"abstract":4,"boolean":[0,4],"break":4,"case":[0,4],"char":4,"class":[0,4],"const":4,"default":[0,4],"final":[0,4],"function":0,"goto":4,"import":[0,4],"int":[0,4],"long":4,"new":[0,1,4],"return":[0,4],"static":4,"true":[0,4],"try":[0,1,2,4],"var":[0,4],"void":4,"while":[0,3],AND:4,Are:4,BUT:4,FOR:4,For:4,Its:[0,4],NOT:4,Not:0,THE:4,That:4,The:[0,1,2],There:[3,4],These:0,USE:4,Use:[0,3],Useful:0,Uses:0,WITH:4,__doc__:4,__fastcal:4,__init__:4,__int16:4,__int64:4,__m128i:4,__main__:4,__module__:4,__name__:4,__repr__:4,_dword:[0,4],_fidl_:1,_get_var_typ:4,_malloc:0,abl:3,about:4,abov:4,access:4,action:4,activ:0,add:[0,4],addit:4,addr:0,address:[0,4],adress:0,after:[0,4],afterward:[0,4],aggreg:0,ahmad:4,algo:0,alik:0,all:[0,4],all_paths_between:0,all_simple_path:0,alloc:4,allow:[0,2,3],along:4,alt:3,alwai:0,analysi:[0,2,4],analyz:[0,1,4],andrea:4,ani:[0,4],anoth:[3,4],answer:0,api:[2,4],api_nam:4,append:4,appli:0,arg:4,argument:0,aris:4,arithmet:[0,4],around:[0,4],arr:0,arrai:[0,4],array_len:4,array_typ:4,ask:2,assembl:[0,4],assign:[0,4],assigns_to_var:0,associ:[0,4],assum:4,attribut:[0,4],autom:4,auxiliari:[0,4],avoid:0,barri:4,base:0,basic:[0,2,4],bath:4,bb_end:0,bb_start:0,bbgraph:0,becaus:0,been:[0,4],being:[0,1,4],belong:4,below:4,ben:4,best:0,better:[0,2,4],between:[0,4],binari:[0,1,2,4],blacklist:0,block:0,blown:0,blowup_express:0,bool:[0,4],both:[0,4],bradford:4,bug:2,build:0,cach:0,calcul:[0,4],call:[0,1],call_to_func:4,callobj:[0,4],callz:4,can:[0,4],cast:0,cat:4,central:4,certain:0,cex:0,cexpr_t:0,cfg:[0,4],cfunc:0,cfunc_t:0,cfuncptr_t:0,cgp_sneaky_direct_asg:4,chanc:0,chang:3,charg:4,check:[0,4],christoph:4,cimport:0,cinsn_t:0,citem2high:0,citem:0,claim:4,clariti:0,classic:4,cleaner:4,close:0,code:[0,4],codemin:4,colin:4,collect:0,color:0,combin:4,comctl32:4,comment:0,common:[0,4],commonli:0,compar:4,comparison:0,compiler_const:0,complex:[0,4],complex_75_sub_140062678:4,complex_typ:4,condit:[0,4],connect:[0,4],consid:4,constant:[0,4],constrain:0,construct:[0,4],contain:[0,3,4],continu:4,contract:4,contriv:4,control:[0,4],controlflowin:0,conveni:[0,4],convers:0,convert:0,copi:[3,4],copyright:4,core:[2,4],corner:0,correspond:0,cost:0,cot_:0,cot_add:[0,4],cot_xxx:0,could:4,cpu:0,creat:[0,3,4],create_com:0,ctree:0,current:[0,4],cursor:4,cutoff:0,damag:4,danger:4,data:[0,3,4],deal:[0,4],debug:0,debug_blownup_express:0,debug_get_break_stat:0,debug_stahp:0,decast:0,decompil:[0,1,4],decompilation_text:0,decompiler_util:[0,1,4],decompos:0,def:4,defin:[0,4],delchev:4,delian:4,deliber:4,depend:0,determin:0,dev:3,develop:[0,3],dialogfunc:4,dict:[0,4],dictionari:[0,4],difficult:2,dir:4,directori:[0,3,4],disassembl:0,displai:[0,4],display_all_calls_to:0,display_line_at:0,display_nod:0,display_path:0,distribut:4,dll:4,do_for_all_func:[0,4],docum:4,document:[0,2,4],doe:0,does_constrain:0,don:0,done:[0,4],dot:0,dot_ex:0,doubl:4,dprint:0,drawinsert:4,dst:4,dump:0,dump_cfg:0,dump_i_cfg:0,dump_lvar:0,dump_pseudocod:0,dynam:4,each:0,easi:[3,4],easili:4,eax:4,ebx:4,edit:3,edx:4,element:[0,4],element_typ:0,els:4,end:4,end_nod:0,enddialog:4,enhanc:0,entat:4,equal:0,error:[0,1],esi:4,essenti:[0,4],etc:[0,4],evalu:0,even:0,event:4,ever:2,everi:[3,4],exclus:0,exe:[0,4],execut:[3,4],exercis:4,exist:0,expect:4,explicitli:4,explos:0,expr:0,express:[0,4],extract:[0,4],f_ea:0,f_name:[0,4],fab:4,fabs0x0:4,fact:0,fail:[0,1],fairli:4,fals:[0,4],fast:[0,4],fidl:[0,1,2,3,4],file:[0,3,4],filter:0,final_operand:0,find:[0,4],find_all_calls_to:[0,4],find_connected_path:0,find_elements_of_typ:0,find_possible_malloc_issu:4,first:[0,4],fit:4,fixm:0,flag:0,flow:[0,4],fly:3,follow:[1,4],forc:0,form:[0,1,4],format:[0,4],found:[0,4],four:4,free:4,from:[0,1,4],func:0,func_nam:0,furlong:4,furnish:4,further:0,g_addr:4,g_ptr_:4,g_ptr_drawinsert:4,g_ptr_initcommoncontrol:4,g_ptr_lbitemfrompt:4,g_ptr_makedraglist:4,gener:0,get:[0,1],get_all_vars_in_nod:0,get_cfg_for_ea:0,get_cond_from_stat:0,get_func_nam:0,get_function_var:0,get_imports_info:0,get_interesting_cal:0,get_nod:0,get_return_typ:0,getprocaddr_renaming_glob:4,getprocaddress:4,give:0,given:0,global:[0,4],global_var:4,good:[2,4],got:1,gotcha:2,grant:4,graph:[0,4],graphic:0,group:0,gui:4,hack:0,hand:4,handl:0,happen:4,hard:0,harri:4,has:[0,4],have:[2,4],haywir:0,help:3,helper:0,here:[0,4],herebi:4,herwis:4,heurist:0,hex:[1,2,4],hexrai:0,hglobal:4,high:4,higher:0,hmodul:4,holder:4,hood:4,how:[0,2,4],howev:[0,4],http:4,hwnd:4,hwnd__:4,i64:[3,4],i_cfg:0,ida:[0,1,3,4],ida_hexrai:[0,4],idb:[3,4],idea:4,ight:4,illustr:4,imag:0,imm:4,immedi:4,implement:[0,4],impli:4,includ:0,inde:4,index:[0,2,4],indic:4,individu:[0,4],inform:[0,2,4],initcommoncontrol:4,initi:0,inject:0,input:0,ins:0,insid:0,insn_t:0,inspect:[0,4],instal:2,instanc:4,instead:3,int_ptr:4,intend:0,intens:0,interest:[0,4],interim:0,intern:0,introduc:4,invis:0,involv:[0,4],is_a_function_of:4,is_arg:[0,4],is_ari:4,is_arithmetic_express:[0,4],is_arrai:[0,4],is_array_index:0,is_asg:[0,4],is_binary_trunc:0,is_cal:0,is_cast:0,is_constrain:[0,4],is_final_expr:0,is_global_var:[0,4],is_if:0,is_initi:[0,4],is_numb:[0,4],is_point:[0,4],is_ptr:0,is_read:0,is_ref:0,is_sign:[0,4],is_str:0,is_taint:4,is_var:[0,4],is_writ:0,issu:[2,3],item:0,iter:4,its:[0,4],itself:4,jeroen:4,joern:4,jori:4,json:[0,4],just:3,justin:4,kei:4,khalifa:4,kind:[0,4],know:[2,4],known:[0,2],kuhn:4,kwarg:0,label_11:4,larg:4,later:4,lbitemfrompt:4,leaner:4,left:4,len:4,length:[0,4],let:4,level:4,leverag:[0,2],lex:0,lex_citem_index:0,lhs:4,liabil:4,liabl:4,lib:0,librari:0,lic:4,licenc:4,licens:4,lifecycl:0,lighthous:0,like:[0,2,4],limit:[0,4],line2citem:0,line2nod:0,line:[0,4],lines_and_cod:0,link:3,linter:3,list:[0,2,4],live:3,load:[1,3],local:[0,3],locat:4,logic:0,look:[0,2,4],lot:4,lucki:2,lvar:[0,4],lvar_t:0,m_arg:4,mai:[0,4],main:[0,4],mainli:0,make:3,makedraglist:4,makenam:4,malcolm:4,malloc:[0,4],malloc_0:0,mallocz:4,mandatori:0,mani:[0,4],manual:0,map:0,map_citem2lin:0,map_line2citem:0,map_line2nod:0,map_node2lin:0,mark:0,marku:4,massar:4,match:[0,4],maximum:0,mean:1,melt:0,memcpi:4,memcpyz:4,memori:4,merchant:4,merg:4,messag:[0,1],method:4,min_siz:[0,4],minimum:0,mit:4,mix:4,mode:[0,3],modifi:[3,4],modul:[2,4],moment:3,monstruou:0,more:0,most:[0,4],movi:0,msg:4,much:0,multipl:4,mutual:0,my_decompil:0,my_get_func_nam:0,my_str:4,my_var:4,my_var_t:[0,4],name:[0,1,4],neatli:0,necessari:[0,4],need:[0,3],neglig:0,networkx:0,new_nam:4,next:4,nice:0,nicola:4,nobodi:0,node:[0,4],non:0,none:[0,4],noninfring:4,nonlibfunct:0,normal:0,note:[0,4],notic:4,notori:2,now:[0,3,4],npermiss:4,nportion:4,nthe:4,num_valu:0,number:[0,4],numer:[0,4],object:[0,4],obtain:4,occurr:[0,4],off:0,one:[0,4],onli:[0,4],only_arg:0,only_loc:0,only_thes:[0,4],open_new:0,oper:4,operand:4,option:0,opyright:4,order:0,org:4,orphan:0,other:4,otherwis:4,our:2,out:4,out_dir:0,output:[0,4],over:4,overflow:4,own:1,packag:3,pair:4,paralel:0,param:[0,4],paramet:[0,4],part:0,particular:4,path:0,pattern:4,pdf:4,peek:0,penalti:0,per:4,perform:[0,2],permiss:4,permit:4,person:4,pictur:4,piec:[0,4],pip:3,place:0,pleas:4,plug:0,plugin:[0,1],png:0,point:4,pointed_typ:4,pointer:[0,4],points_to:0,popul:0,portion:4,posit:4,possibl:[0,4],potenti:4,power:[0,2],present:4,pretti:[0,4],preview:4,previous:0,primit:0,print:[0,4],problem:[0,4],process:0,produc:[0,4],program:[1,4],programat:4,project:4,properti:4,prototyp:4,provid:[0,4],pseudocod:0,pseudoview:0,publish:4,purpos:[0,4],putti:[3,4],pytest:3,pytest_fidl:3,python3:3,python:[1,3,4],queri:4,question:[0,2],quickli:[0,4],quirk:2,qword_1400c0dd0:4,qword_1400c0dd8:4,qword_1400c0de0:4,qword_1400c0de8:4,r12:4,r13:4,r14:4,r15:4,rai:[1,2,4],rantwijk:4,rather:0,rax:4,rbx:4,rdi:4,reach:[0,3],read:0,reader:4,real_var:4,recogn:4,recommend:4,recreat:0,recurs:0,reduc:0,ref2var:[0,4],ref:[0,4],ref_to:0,refer:[0,4],reinstal:3,relat:3,relationship:0,relax:0,releas:3,rememb:[0,4],remov:0,renam:4,rep:4,report:2,repositori:3,repres:[0,4],represent:[0,4],res:4,resolv:[0,4],restor:4,restrict:4,result:[0,1,4],ret:4,reus:0,reuse_if_pseudocod:0,revers:4,rhs:4,richer:0,right:4,robert:4,rough:0,roughli:4,rtype:4,run:4,runtim:4,same:4,save:4,scale:4,schultz:4,script:[3,4],sdi:4,search:[0,2,4],second:4,section:[0,4],see:[0,4],sell:4,serv:0,set:0,setdlgitemtexta:4,setup:3,setwindowtexta:4,sever:0,shall:4,share:4,should:0,show:0,showcas:4,shown:4,side:4,silent:0,similar:4,simon:4,simpl:[0,4],simpli:3,sinc:[0,4],size:[0,4],size_t:4,skin:4,small:0,smith:4,snip:4,snippet:4,softwar:4,solv:4,some:[0,3,4],someth:[0,4],somewher:4,sourc:4,span:0,specif:[0,2,4],specifi:[0,4],src:4,stackoverflow:2,stait:4,start:[0,2],start_ea:0,start_nod:0,statement:0,still:1,store:4,str:0,straightforward:4,streamlin:0,strictli:4,string:[0,4],string_valu:0,structur:[0,4],sub_14000f698:4,sub_14000fcfc:4,sub_140021f58:4,sub_140065b68:4,subject:4,sublicens:4,substanti:4,substr:0,substract:4,suppli:0,suspici:4,suspicious_len:4,symbol:3,tag:2,take:4,taken:4,talk:4,target:4,task:4,tatham:4,tell:0,test:[0,4],text:0,thei:[0,4],them:[0,4],thi:[0,3,4],thing:[0,2],third:4,thu:0,time:[3,4],tinfo_t:0,todo:0,toggl:0,token:0,tool:4,tort:4,tpng:0,tracker:2,translat:4,tri:[0,2],troubl:2,truncat:0,tupl:4,turn:0,two:[0,3,4],type:[0,4],type_nam:[0,4],typic:[0,4],undefin:4,under:[3,4],understand:4,unicod:0,uninterest:0,unk:4,unless:0,unsign:4,until:0,uppercas:1,usabl:0,usag:[2,4],use:[0,1,2,4],use_exist:0,used:[0,4],useful:[0,4],useless:0,user_defin:0,using:[2,4],usual:[0,1,4],v10:4,v11:4,v12:4,v13:4,v17:4,v21:0,v38:0,v86:4,v_name:4,val:4,valid:4,valu:[0,4],value_of_glob:[0,4],van:4,var_ref_t:[0,4],var_t:0,variabl:0,variant:0,vars30:4,verbos:[0,4],veri:4,verifi:2,version:[0,1,4],via:[0,4],view:4,visit:0,visual:4,vulner:4,wai:[0,3,4],want:0,warranti:4,watson:4,wchar:4,well:[0,4],wez:4,when:[0,4],where:4,whether:[0,4],which:[0,4],whom:4,whose:0,widecharstr:4,widget:0,window:4,within:[0,3,4],without:[1,3,4],word:4,work:[0,1,3,4],workaround:0,world:0,would:4,wrap:[0,2,4],wrapper:[0,4],write:[0,4],x86:1,x86_64:1,yield:0,you:[0,1,2,3,4],your:[1,3],yourself:4},titles:["Core API","Known gotchas","FLARE IDA DECOMPILER LIBRARY","Installation","Getting started"],titleterms:{"function":4,"import":1,The:4,api:0,argument:4,batteri:4,bit:1,call:4,complet:4,controlflowin:4,core:0,decompil:2,exampl:4,first:2,flare:2,from:3,get:[2,4],gotcha:1,help:2,ida:2,includ:4,instal:3,known:1,librari:2,littl:4,local:4,mismatch:1,modul:1,more:4,overview:0,pypi:3,run:3,sourc:3,start:4,step:2,test:3,variabl:4,what:2,why:2}}) \ No newline at end of file +Search.setIndex({docnames:["api","gotchas","index","installation","tutorial"],envversion:{"sphinx.domains.c":1,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":1,"sphinx.domains.javascript":1,"sphinx.domains.math":2,"sphinx.domains.python":1,"sphinx.domains.rst":1,"sphinx.domains.std":1,sphinx:56},filenames:["api.rst","gotchas.rst","index.rst","installation.rst","tutorial.rst"],objects:{"":{decompiler_utils:[0,0,0,"-"]},"decompiler_utils.BBGraph":{find_connected_paths:[0,2,1,""],get_node:[0,2,1,""]},"decompiler_utils.cImporter":{get_imports_info:[0,2,1,""]},"decompiler_utils.controlFlowinator":{dump_cfg:[0,2,1,""],dump_i_cfg:[0,2,1,""]},"decompiler_utils.pseudoViewer":{OPEN_NEW:[0,4,1,""],REUSE_IF_PSEUDOCODE:[0,4,1,""],USE_EXISTING:[0,4,1,""],close:[0,2,1,""],show:[0,2,1,""]},decompiler_utils:{BBGraph:[0,1,1,""],NonLibFunctions:[0,3,1,""],all_paths_between:[0,3,1,""],assigns_to_var:[0,3,1,""],blowup_expression:[0,3,1,""],cImporter:[0,1,1,""],callObj:[0,1,1,""],citem2higher:[0,3,1,""],controlFlowinator:[0,1,1,""],create_comment:[0,3,1,""],debug_blownup_expressions:[0,3,1,""],debug_get_break_statements:[0,3,1,""],debug_stahp:[0,3,1,""],decast:[0,3,1,""],display_all_calls_to:[0,3,1,""],display_line_at:[0,3,1,""],display_node:[0,3,1,""],display_path:[0,3,1,""],do_for_all_funcs:[0,3,1,""],does_constrain:[0,3,1,""],dprint:[0,3,1,""],dump_lvars:[0,3,1,""],dump_pseudocode:[0,3,1,""],find_all_calls_to_within:[0,3,1,""],find_elements_of_type:[0,3,1,""],get_all_vars_in_node:[0,3,1,""],get_cfg_for_ea:[0,3,1,""],get_cond_from_statement:[0,3,1,""],get_function_vars:[0,3,1,""],get_interesting_calls:[0,3,1,""],get_return_type:[0,3,1,""],is_arithmetic_expression:[0,3,1,""],is_array_indexing:[0,3,1,""],is_asg:[0,3,1,""],is_binary_truncation:[0,3,1,""],is_call:[0,3,1,""],is_cast:[0,3,1,""],is_final_expr:[0,3,1,""],is_global_var:[0,3,1,""],is_if:[0,3,1,""],is_number:[0,3,1,""],is_ptr:[0,3,1,""],is_read:[0,3,1,""],is_ref:[0,3,1,""],is_string:[0,3,1,""],is_var:[0,3,1,""],is_write:[0,3,1,""],lex_citem_indexes:[0,3,1,""],lines_and_code:[0,3,1,""],main:[0,3,1,""],map_citem2line:[0,3,1,""],map_line2citem:[0,3,1,""],map_line2node:[0,3,1,""],map_node2lines:[0,3,1,""],my_decompile:[0,3,1,""],my_get_func_name:[0,3,1,""],my_var_t:[0,1,1,""],num_value:[0,3,1,""],points_to:[0,3,1,""],pseudoViewer:[0,1,1,""],ref2var:[0,3,1,""],ref_to:[0,3,1,""],string_value:[0,3,1,""],value_of_global:[0,3,1,""]}},objnames:{"0":["py","module","Python module"],"1":["py","class","Python class"],"2":["py","method","Python method"],"3":["py","function","Python function"],"4":["py","attribute","Python attribute"]},objtypes:{"0":"py:module","1":"py:class","2":"py:method","3":"py:function","4":"py:attribute"},terms:{"0i64":4,"0x0":4,"0x00000176b566be48":4,"0x000001d756db21c8":4,"0x000002a0b67f5b08":4,"0x1":4,"0x100l":4,"0x140055674":4,"0x2":4,"0x3":4,"0x3eal":4,"0x55":4,"0xffff":0,"1002l":4,"14000f698":4,"14000fcfc":4,"1400588f6":4,"14005892e":4,"1400909a8":4,"1i64":4,"3rd":4,"40118a":4,"401c88":4,"401cba":4,"4198400l":4,"abstract":4,"boolean":[0,4],"break":4,"case":[0,4],"char":4,"class":[0,4],"const":4,"default":[0,4],"final":[0,4],"function":0,"goto":4,"import":[0,4],"int":[0,4],"long":4,"new":[0,1,4],"return":[0,4],"static":4,"true":[0,4],"try":[0,1,2,4],"var":[0,4],"void":4,"while":[0,3],AND:4,Are:4,BUT:4,FOR:4,For:4,Its:[0,4],NOT:4,Not:0,THE:4,That:4,The:[0,1,2],There:[3,4],These:0,USE:4,Use:[0,3],Useful:0,Uses:0,WITH:4,__doc__:4,__fastcal:4,__init__:4,__int16:4,__int64:4,__m128i:4,__main__:4,__module__:4,__name__:4,__repr__:4,_dword:[0,4],_fidl_:1,_get_var_typ:4,_malloc:0,abl:3,about:4,abov:4,access:4,action:4,activ:0,add:[0,4],addit:4,addr:0,address:[0,4],adress:0,after:[0,4],afterward:[0,4],aggreg:0,ahmad:4,algo:0,alik:0,all:[0,4],all_paths_between:0,all_simple_path:0,alloc:4,allow:[0,2,3],along:4,alt:3,alwai:0,analysi:[0,2,4],analyz:[0,1,4],andrea:4,ani:[0,4],anoth:[3,4],answer:0,api:[2,4],api_nam:4,append:4,appli:0,arg:4,argument:0,aris:4,arithmet:[0,4],around:[0,4],arr:0,arrai:[0,4],array_len:4,array_typ:4,ask:2,assembl:[0,4],assign:[0,4],assigns_to_var:0,associ:[0,4],assum:4,attribut:[0,4],autom:4,auxiliari:[0,4],avoid:0,barri:4,base:0,basic:[0,2,4],bath:4,bb_end:0,bb_start:0,bbgraph:0,becaus:0,been:[0,4],being:[0,1,4],belong:4,below:4,ben:4,best:0,better:[0,2,4],between:[0,4],binari:[0,1,2,4],blacklist:0,block:0,blown:0,blowup_express:0,bool:[0,4],both:[0,4],bradford:4,bug:2,build:0,cach:0,calcul:[0,4],call:[0,1],call_to_func:4,callobj:[0,4],callz:4,can:[0,4],cast:0,cat:4,central:4,certain:0,cex:0,cexpr_t:0,cfg:[0,4],cfunc:0,cfunc_t:0,cfuncptr_t:0,cgp_sneaky_direct_asg:4,chanc:0,chang:3,charg:4,check:[0,4],christoph:4,cimport:0,cinsn_t:0,citem2high:0,citem:0,claim:4,clariti:0,classic:4,cleaner:4,close:0,code:[0,4],codemin:4,colin:4,collect:0,color:0,combin:4,comctl32:4,comment:0,common:[0,4],commonli:0,compar:4,comparison:0,compiler_const:0,complex:[0,4],complex_75_sub_140062678:4,complex_typ:4,condit:[0,4],connect:[0,4],consid:4,constant:[0,4],constrain:0,construct:[0,4],contain:[0,3,4],continu:4,contract:4,contriv:4,control:[0,4],controlflowin:0,conveni:[0,4],convers:0,convert:0,copi:[3,4],copyright:4,core:[2,4],corner:0,correspond:0,cost:0,cot_:0,cot_add:[0,4],cot_xxx:0,could:4,cpu:0,creat:[0,3,4],create_com:0,ctree:0,current:[0,4],cursor:4,cutoff:0,damag:4,danger:4,data:[0,3,4],deal:[0,4],debug:0,debug_blownup_express:0,debug_get_break_stat:0,debug_stahp:0,decast:0,decompil:[0,1,4],decompilation_text:0,decompiler_util:[0,1,4],decompos:0,def:4,defin:[0,4],delchev:4,delian:4,deliber:4,depend:0,determin:0,dev:3,develop:[0,3],dialogfunc:4,dict:[0,4],dictionari:[0,4],difficult:2,dir:4,directori:[0,3,4],disassembl:0,displai:[0,4],display_all_calls_to:0,display_line_at:0,display_nod:0,display_path:0,distribut:4,dll:4,do_for_all_func:[0,4],docum:4,document:[0,2,4],doe:0,does_constrain:0,don:0,done:[0,4],dot:0,dot_ex:0,doubl:4,dprint:0,drawinsert:4,dst:4,dump:0,dump_cfg:0,dump_i_cfg:0,dump_lvar:0,dump_pseudocod:0,dynam:4,each:0,easi:[3,4],easili:4,eax:4,ebx:4,edit:3,edx:4,element:[0,4],element_typ:0,els:4,end:4,end_nod:0,enddialog:4,enhanc:0,entat:4,equal:0,error:[0,1],esi:4,essenti:[0,4],etc:[0,4],evalu:0,even:0,event:4,ever:2,everi:[3,4],exclus:0,exe:[0,4],execut:[3,4],exercis:4,exist:0,expect:4,explicitli:4,explos:0,expr:0,express:[0,4],extract:[0,4],f_ea:0,f_name:[0,4],fab:4,fabs0x0:4,fact:0,fail:[0,1],fairli:4,fals:[0,4],fast:[0,4],fidl:[0,1,2,3,4],file:[0,3,4],filter:0,final_operand:0,find:[0,4],find_all_calls_to_within:[0,4],find_connected_path:0,find_elements_of_typ:0,find_possible_malloc_issu:4,first:[0,4],fit:4,fixm:0,flag:0,flow:[0,4],fly:3,follow:[1,4],forc:0,form:[0,1,4],format:[0,4],found:[0,4],four:4,free:4,from:[0,1,4],func:0,func_nam:0,furlong:4,furnish:4,further:0,g_addr:4,g_ptr_:4,g_ptr_drawinsert:4,g_ptr_initcommoncontrol:4,g_ptr_lbitemfrompt:4,g_ptr_makedraglist:4,gener:0,get:[0,1],get_all_vars_in_nod:0,get_cfg_for_ea:0,get_cond_from_stat:0,get_func_nam:0,get_function_var:0,get_imports_info:0,get_interesting_cal:0,get_nod:0,get_return_typ:0,getprocaddr_renaming_glob:4,getprocaddress:4,give:0,given:0,global:[0,4],global_var:4,good:[2,4],got:1,gotcha:2,grant:4,graph:[0,4],graphic:0,group:0,gui:4,hack:0,hand:4,handl:0,happen:4,hard:0,harri:4,has:[0,4],have:[2,4],haywir:0,help:3,helper:0,here:[0,4],herebi:4,herwis:4,heurist:0,hex:[1,2,4],hexrai:0,hglobal:4,high:4,higher:0,hmodul:4,holder:4,hood:4,how:[0,2,4],howev:[0,4],http:4,hwnd:4,hwnd__:4,i64:[3,4],i_cfg:0,ida:[0,1,3,4],ida_hexrai:[0,4],idb:[3,4],idea:4,ight:4,illustr:4,imag:0,imm:4,immedi:4,implement:[0,4],impli:4,includ:0,inde:4,index:[0,2,4],indic:4,individu:[0,4],inform:[0,2,4],initcommoncontrol:4,initi:0,inject:0,input:0,ins:0,insid:0,insn_t:0,inspect:[0,4],instal:2,instanc:4,instead:3,int_ptr:4,intend:0,intens:0,interest:[0,4],interim:0,intern:0,introduc:4,invis:0,involv:[0,4],is_a_function_of:4,is_arg:[0,4],is_ari:4,is_arithmetic_express:[0,4],is_arrai:[0,4],is_array_index:0,is_asg:[0,4],is_binary_trunc:0,is_cal:0,is_cast:0,is_constrain:[0,4],is_final_expr:0,is_global_var:[0,4],is_if:0,is_initi:[0,4],is_numb:[0,4],is_point:[0,4],is_ptr:0,is_read:0,is_ref:0,is_sign:[0,4],is_str:0,is_taint:4,is_var:[0,4],is_writ:0,issu:[2,3],item:0,iter:4,its:[0,4],itself:4,jeroen:4,joern:4,jori:4,json:[0,4],just:3,justin:4,kei:4,khalifa:4,kind:[0,4],know:[2,4],known:[0,2],kuhn:4,kwarg:0,label_11:4,larg:4,later:4,lbitemfrompt:4,leaner:4,left:4,len:4,length:[0,4],let:4,level:4,leverag:[0,2],lex:0,lex_citem_index:0,lhs:4,liabil:4,liabl:4,lib:0,librari:0,lic:4,licenc:4,licens:4,lifecycl:0,lighthous:0,like:[0,2,4],limit:[0,4],line2citem:0,line2nod:0,line:[0,4],lines_and_cod:0,link:3,linter:3,list:[0,2,4],live:3,load:[1,3],local:[0,3],locat:4,logic:0,look:[0,2,4],lot:4,lucki:2,lvar:[0,4],lvar_t:0,m_arg:4,mai:[0,4],main:[0,4],mainli:0,make:3,makedraglist:4,makenam:4,malcolm:4,malloc:[0,4],malloc_0:0,mallocz:4,mandatori:0,mani:[0,4],manual:0,map:0,map_citem2lin:0,map_line2citem:0,map_line2nod:0,map_node2lin:0,mark:0,marku:4,massar:4,match:[0,4],maximum:0,mean:1,melt:0,memcpi:4,memcpyz:4,memori:4,merchant:4,merg:4,messag:[0,1],method:4,min_siz:[0,4],minimum:0,mit:4,mix:4,mode:[0,3],modifi:[3,4],modul:[2,4],moment:3,monstruou:0,more:0,most:[0,4],movi:0,msg:4,much:0,multipl:4,mutual:0,my_decompil:0,my_get_func_nam:0,my_str:4,my_var:4,my_var_t:[0,4],name:[0,1,4],neatli:0,necessari:[0,4],need:[0,3],neglig:0,networkx:0,new_nam:4,next:4,nice:0,nicola:4,nobodi:0,node:[0,4],non:0,none:[0,4],noninfring:4,nonlibfunct:0,normal:0,note:[0,4],notic:4,notori:2,now:[0,3,4],npermiss:4,nportion:4,nthe:4,num_valu:0,number:[0,4],numer:[0,4],object:[0,4],obtain:4,occurr:[0,4],off:0,one:[0,4],onli:[0,4],only_arg:0,only_loc:0,only_thes:[0,4],open_new:0,oper:4,operand:4,option:0,opyright:4,order:0,org:4,orphan:0,other:4,otherwis:4,our:2,out:4,out_dir:0,output:[0,4],over:4,overflow:4,own:1,packag:3,pair:4,paralel:0,param:[0,4],paramet:[0,4],part:0,particular:4,path:0,pattern:4,pdf:4,peek:0,penalti:0,per:4,perform:[0,2],permiss:4,permit:4,person:4,pictur:4,piec:[0,4],pip:3,place:0,pleas:4,plug:0,plugin:[0,1],png:0,point:4,pointed_typ:4,pointer:[0,4],points_to:0,popul:0,portion:4,posit:4,possibl:[0,4],potenti:4,power:[0,2],present:4,pretti:[0,4],preview:4,previous:0,primit:0,print:[0,4],problem:[0,4],process:0,produc:[0,4],program:[1,4],programat:4,project:4,properti:4,prototyp:4,provid:[0,4],pseudocod:0,pseudoview:0,publish:4,purpos:[0,4],putti:[3,4],pytest:3,pytest_fidl:3,python3:3,python:[1,3,4],queri:4,question:[0,2],quickli:[0,4],quirk:2,qword_1400c0dd0:4,qword_1400c0dd8:4,qword_1400c0de0:4,qword_1400c0de8:4,r12:4,r13:4,r14:4,r15:4,rai:[1,2,4],rantwijk:4,rather:0,rax:4,rbx:4,rdi:4,reach:[0,3],read:0,reader:4,real_var:4,recogn:4,recommend:4,recreat:0,recurs:0,reduc:0,ref2var:[0,4],ref:[0,4],ref_to:0,refer:[0,4],reinstal:3,relat:3,relationship:0,relax:0,releas:3,rememb:[0,4],remov:0,renam:4,rep:4,report:2,repositori:3,repres:[0,4],represent:[0,4],res:4,resolv:[0,4],restor:4,restrict:4,result:[0,1,4],ret:4,reus:0,reuse_if_pseudocod:0,revers:4,rhs:4,richer:0,right:4,robert:4,rough:0,roughli:4,rtype:4,run:4,runtim:4,same:4,save:4,scale:4,schultz:4,script:[3,4],sdi:4,search:[0,2,4],second:4,section:[0,4],see:[0,4],sell:4,serv:0,set:0,setdlgitemtexta:4,setup:3,setwindowtexta:4,sever:0,shall:4,share:4,should:0,show:0,showcas:4,shown:4,side:4,silent:0,similar:4,simon:4,simpl:[0,4],simpli:3,sinc:[0,4],size:[0,4],size_t:4,skin:4,small:0,smith:4,snip:4,snippet:4,softwar:4,solv:4,some:[0,3,4],someth:[0,4],somewher:4,sourc:4,span:0,specif:[0,2,4],specifi:[0,4],src:4,stackoverflow:2,stait:4,start:[0,2],start_ea:0,start_nod:0,statement:0,still:1,store:4,str:0,straightforward:4,streamlin:0,strictli:4,string:[0,4],string_valu:0,structur:[0,4],sub_14000f698:4,sub_14000fcfc:4,sub_140021f58:4,sub_140065b68:4,subject:4,sublicens:4,substanti:4,substr:0,substract:4,suppli:0,suspici:4,suspicious_len:4,symbol:3,tag:2,take:4,taken:4,talk:4,target:4,task:4,tatham:4,tell:0,test:[0,4],text:0,thei:[0,4],them:[0,4],thi:[0,3,4],thing:[0,2],third:4,thu:0,time:[3,4],tinfo_t:0,todo:0,toggl:0,token:0,tool:4,tort:4,tpng:0,tracker:2,translat:4,tri:[0,2],troubl:2,truncat:0,tupl:4,turn:0,two:[0,3,4],type:[0,4],type_nam:[0,4],typic:[0,4],undefin:4,under:[3,4],understand:4,unicod:0,uninterest:0,unk:4,unless:0,unsign:4,until:0,uppercas:1,usabl:0,usag:[2,4],use:[0,1,2,4],use_exist:0,used:[0,4],useful:[0,4],useless:0,user_defin:0,using:[2,4],usual:[0,1,4],v10:4,v11:4,v12:4,v13:4,v17:4,v21:0,v38:0,v86:4,v_name:4,val:4,valid:4,valu:[0,4],value_of_glob:[0,4],van:4,var_ref_t:[0,4],var_t:0,variabl:0,variant:0,vars30:4,verbos:[0,4],veri:4,verifi:2,version:[0,1,4],via:[0,4],view:4,visit:0,visual:4,vulner:4,wai:[0,3,4],want:0,warranti:4,watson:4,wchar:4,well:[0,4],wez:4,when:[0,4],where:4,whether:[0,4],which:[0,4],whom:4,whose:0,widecharstr:4,widget:0,window:4,within:[0,3,4],without:[1,3,4],word:4,work:[0,1,3,4],workaround:0,world:0,would:4,wrap:[0,2,4],wrapper:[0,4],write:[0,4],x86:1,x86_64:1,yield:0,you:[0,1,2,3,4],your:[1,3],yourself:4},titles:["Core API","Known gotchas","FLARE IDA DECOMPILER LIBRARY","Installation","Getting started"],titleterms:{"function":4,"import":1,The:4,api:0,argument:4,batteri:4,bit:1,call:4,complet:4,controlflowin:4,core:0,decompil:2,exampl:4,first:2,flare:2,from:3,get:[2,4],gotcha:1,help:2,ida:2,includ:4,instal:3,known:1,librari:2,littl:4,local:4,mismatch:1,modul:1,more:4,overview:0,pypi:3,run:3,sourc:3,start:4,step:2,test:3,variabl:4,what:2,why:2}}) \ No newline at end of file diff --git a/FIDL/docs/_build/html/tutorial.html b/FIDL/docs/_build/html/tutorial.html index 1844505..2759fa4 100644 --- a/FIDL/docs/_build/html/tutorial.html +++ b/FIDL/docs/_build/html/tutorial.html @@ -800,7 +800,7 @@

    A little example
    import FIDL.decompiler_utils as du
 
 
-callz = du.find_all_calls_to(f_name='GetProcAddress', ea=here())
+callz = du.find_all_calls_to_within(f_name='GetProcAddress', ea=here())
 for co in callz:
     # The *second* argument of ``GetProcAddress`` is the API name
     api_name = co.args[1].val
@@ -1001,8 +1001,8 @@ 
    A more complete exampleresults = []
     suspicious_lens = []
 
-    mallocz = du.find_all_calls_to('malloc', c.ea)
-    memcpyz = du.find_all_calls_to('memcpy', c.ea)
+    mallocz = du.find_all_calls_to_within('malloc', c.ea)
+    memcpyz = du.find_all_calls_to_within('memcpy', c.ea)
 
     if not mallocz or not memcpyz:
         return []
@@ -1077,7 +1077,7 @@ 
    A more complete example

As we can see, The ControlFlowinator object is indeed the central piece of this API. It is the only argument of the function find_possible_malloc_issues at line 14. The convenience function do_for_all_funcs (line 89) is used to iterate over all functions on a binary, calculate their controlFlowinator and call a function with it as parameter (see line 90) and the API documentation for more information about this wrapper.

-

At lines 27, 28 all occurrences of calls to malloc and memcpy are calculated. The result of find_all_calls_to are so called callObj, a complex data structure containing a lot of information about the call (name, arguments, location, etc.)

+

At lines 27, 28 all occurrences of calls to malloc and memcpy are calculated. The result of find_all_calls_to_within are so called callObj, a complex data structure containing a lot of information about the call (name, arguments, location, etc.)

The argument of malloc is used as a parameter of is_arithmetic_expression (line 41), an auxiliary function returning a boolean, indicating whether the expression is arithmetic (that is, addition, substraction, multiplication, etc. or a combination of them). In this specific case we specify a second parameter to restrict the search to additions only.

If an expression representing an addition (a + b) is found we extract their operands {a, b} (lines 49, 50). Afterwards, we check whether the operands are of the type we are looking for, that is, a variable and a number (line 52). If this is true, we have found one of these len variables of interest, so we create my_var_t object and save it in a list for later usage (lines 59, 61). For more information on my_var_t objects please refer to the Local variables section.

Now that we have a list of suspicious len variables in this function is time to go over all calls to memcpy, get their third arguments (line 68) and get their names (line 73). This is done only in the case that the size parameter is a variable (line 72), since it could be a constant value as well.

diff --git a/FIDL/docs/tutorial.rst b/FIDL/docs/tutorial.rst index 37baf71..429c462 100644 --- a/FIDL/docs/tutorial.rst +++ b/FIDL/docs/tutorial.rst @@ -449,7 +449,7 @@ The following script implements this: import FIDL.decompiler_utils as du - callz = du.find_all_calls_to(f_name='GetProcAddress', ea=here()) + callz = du.find_all_calls_to_within(f_name='GetProcAddress', ea=here()) for co in callz: # The *second* argument of ``GetProcAddress`` is the API name api_name = co.args[1].val @@ -540,8 +540,8 @@ The example script can be found on the **examples** directory of the source code results = [] suspicious_lens = [] - mallocz = du.find_all_calls_to('malloc', c.ea) - memcpyz = du.find_all_calls_to('memcpy', c.ea) + mallocz = du.find_all_calls_to_within('malloc', c.ea) + memcpyz = du.find_all_calls_to_within('memcpy', c.ea) if not mallocz or not memcpyz: return [] @@ -617,7 +617,7 @@ The example script can be found on the **examples** directory of the source code As we can see, :ref:`controlFlowinator_label` object is indeed the central piece of this API. It is the only argument of the function ``find_possible_malloc_issues`` at line 14. The convenience function ``do_for_all_funcs`` (line 89) is used to iterate over all functions on a binary, calculate their ``controlFlowinator`` and call a function with it as parameter (see line 90) and the API documentation for more information about this wrapper. -At lines 27, 28 all occurrences of calls to ``malloc`` and ``memcpy`` are calculated. The result of ``find_all_calls_to`` are so called ``callObj``, a complex data structure containing a lot of information about the *call* (name, arguments, location, etc.) +At lines 27, 28 all occurrences of calls to ``malloc`` and ``memcpy`` are calculated. The result of ``find_all_calls_to_within`` are so called ``callObj``, a complex data structure containing a lot of information about the *call* (name, arguments, location, etc.) The argument of ``malloc`` is used as a parameter of ``is_arithmetic_expression`` (line 41), an auxiliary function returning a *boolean*, indicating whether the expression is arithmetic (that is, addition, substraction, multiplication, etc. or a combination of them). In this specific case we specify a second parameter to restrict the search to additions only. diff --git a/FIDL/examples/getprocaddr_renaming_globals.py b/FIDL/examples/getprocaddr_renaming_globals.py index 02d82f4..0215d04 100644 --- a/FIDL/examples/getprocaddr_renaming_globals.py +++ b/FIDL/examples/getprocaddr_renaming_globals.py @@ -3,7 +3,7 @@ import FIDL.decompiler_utils as du -callz = du.find_all_calls_to(f_name='GetProcAddress', ea=here()) +callz = du.find_all_calls_to_within(f_name='GetProcAddress', ea=here()) for co in callz: # The *second* argument of ``GetProcAddress`` is the API name api_name = co.args[1].val diff --git a/FIDL/examples/possible_malloc_issue.py b/FIDL/examples/possible_malloc_issue.py index d051036..28ba014 100644 --- a/FIDL/examples/possible_malloc_issue.py +++ b/FIDL/examples/possible_malloc_issue.py @@ -24,8 +24,8 @@ def find_possible_malloc_issues(c=None): results = [] suspicious_lens = [] - mallocz = du.find_all_calls_to('malloc', c.ea) - memcpyz = du.find_all_calls_to('memcpy', c.ea) + mallocz = du.find_all_calls_to_within('malloc', c.ea) + memcpyz = du.find_all_calls_to_within('memcpy', c.ea) if not mallocz or not memcpyz: return [] diff --git a/setup.py b/setup.py index e8bfe0a..7128ca5 100644 --- a/setup.py +++ b/setup.py @@ -7,12 +7,12 @@ def readme(): setup(name='FIDL', - version='1.0', - description='Wrapper for the IDA decompiler API', + version='1.1', + description='Wrapper for Hex-Rays decompiler API', classifiers=[ 'Development Status :: 4 - Beta', 'License :: OSI Approved :: MIT License', - 'Programming Language :: Python :: 2.7', + 'Programming Language :: Python :: 3', 'Topic :: Software Development :: Disassemblers', ], keywords='ida decompiler api vulnerability research reversing malware',