1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/zucchini/zucchini_tools.h"
#include <stddef.h>
#include <stdint.h>
#include <algorithm>
#include <memory>
#include <ostream>
#include <utility>
#include "base/bind.h"
#include "base/check_op.h"
#include "base/strings/stringprintf.h"
#include "components/zucchini/disassembler.h"
#include "components/zucchini/element_detection.h"
#include "components/zucchini/ensemble_matcher.h"
#include "components/zucchini/heuristic_ensemble_matcher.h"
#include "components/zucchini/imposed_ensemble_matcher.h"
#include "components/zucchini/io_utils.h"
namespace zucchini {
status::Code ReadReferences(ConstBufferView image,
bool do_dump,
std::ostream& out) {
std::unique_ptr<Disassembler> disasm = MakeDisassemblerWithoutFallback(image);
if (!disasm) {
out << "Input file not recognized as executable." << std::endl;
return status::kStatusInvalidOldImage;
}
std::vector<offset_t> targets;
for (const auto& group : disasm->MakeReferenceGroups()) {
targets.clear();
auto refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref.has_value(); ref = refs->GetNext())
targets.push_back(ref->target);
size_t num_locations = targets.size();
std::sort(targets.begin(), targets.end());
targets.erase(std::unique(targets.begin(), targets.end()), targets.end());
size_t num_targets = targets.size();
out << "Type " << int(group.type_tag().value())
<< ": Pool=" << static_cast<uint32_t>(group.pool_tag().value())
<< ", width=" << group.width() << ", #locations=" << num_locations
<< ", #targets=" << num_targets;
if (num_targets > 0) {
double ratio = static_cast<double>(num_locations) / num_targets;
out << " (ratio=" << base::StringPrintf("%.4f", ratio) << ")";
}
out << std::endl;
if (do_dump) {
refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref; ref = refs->GetNext()) {
out << " " << AsHex<8>(ref->location) << " " << AsHex<8>(ref->target)
<< std::endl;
}
}
}
return status::kStatusSuccess;
}
status::Code DetectAll(ConstBufferView image,
std::ostream& out,
std::vector<ConstBufferView>* sub_image_list) {
DCHECK_NE(sub_image_list, nullptr);
sub_image_list->clear();
const size_t size = image.size();
size_t last_out_pos = 0;
size_t total_bytes_found = 0;
auto print_range = [&out](size_t pos, size_t size, const std::string& msg) {
out << "-- " << AsHex<8, size_t>(pos) << " +" << AsHex<8, size_t>(size)
<< ": " << msg << std::endl;
};
ElementFinder finder(image,
base::BindRepeating(DetectElementFromDisassembler));
for (auto element = finder.GetNext(); element.has_value();
element = finder.GetNext()) {
ConstBufferView sub_image = image[element->region()];
sub_image_list->push_back(sub_image);
size_t pos = sub_image.begin() - image.begin();
size_t prog_size = sub_image.size();
if (last_out_pos < pos)
print_range(last_out_pos, pos - last_out_pos, "?");
auto disasm = MakeDisassemblerOfType(sub_image, element->exe_type);
print_range(pos, prog_size, disasm->GetExeTypeString());
total_bytes_found += prog_size;
last_out_pos = pos + prog_size;
}
if (last_out_pos < size)
print_range(last_out_pos, size - last_out_pos, "?");
out << std::endl;
// Print summary, using decimal instead of hexadecimal.
out << "Detected " << total_bytes_found << "/" << size << " bytes => ";
double percent = total_bytes_found * 100.0 / size;
out << base::StringPrintf("%.2f", percent) << "%." << std::endl;
return status::kStatusSuccess;
}
status::Code MatchAll(ConstBufferView old_image,
ConstBufferView new_image,
std::string imposed_matches,
std::ostream& out) {
std::unique_ptr<EnsembleMatcher> matcher;
if (imposed_matches.empty()) {
matcher = std::make_unique<HeuristicEnsembleMatcher>(&out);
} else {
matcher =
std::make_unique<ImposedEnsembleMatcher>(std::move(imposed_matches));
}
if (!matcher->RunMatch(old_image, new_image)) {
out << "RunMatch() failed.";
return status::kStatusFatal;
}
out << "Found " << matcher->matches().size() << " nontrivial matches and "
<< matcher->num_identical() << " identical matches." << std::endl
<< "To impose the same matches by command line, use: " << std::endl
<< " -impose=";
PrefixSep sep(",");
for (const ElementMatch& match : matcher->matches())
out << sep << match.ToString();
out << std::endl;
return status::kStatusSuccess;
}
} // namespace zucchini
|
