1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/zucchini/zucchini_tools.h"
#include <stddef.h>
#include <stdint.h>
#include <algorithm>
#include <memory>
#include <ostream>
#include <string>
#include "base/bind.h"
#include "base/logging.h"
#include "base/strings/stringprintf.h"
#include "components/zucchini/disassembler.h"
#include "components/zucchini/element_detection.h"
#include "components/zucchini/ensemble_matcher.h"
#include "components/zucchini/heuristic_ensemble_matcher.h"
#include "components/zucchini/io_utils.h"
namespace zucchini {
status::Code ReadReferences(ConstBufferView image,
bool do_dump,
std::ostream& out) {
std::unique_ptr<Disassembler> disasm = MakeDisassemblerWithoutFallback(image);
if (!disasm) {
out << "Input file not recognized as executable." << std::endl;
return status::kStatusInvalidOldImage;
}
std::vector<offset_t> targets;
for (const auto& group : disasm->MakeReferenceGroups()) {
targets.clear();
auto refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref.has_value(); ref = refs->GetNext())
targets.push_back(ref->target);
size_t num_locations = targets.size();
std::sort(targets.begin(), targets.end());
targets.erase(std::unique(targets.begin(), targets.end()), targets.end());
size_t num_targets = targets.size();
out << "Type " << int(group.type_tag().value());
out << ": Pool=" << static_cast<uint32_t>(group.pool_tag().value());
out << ", width=" << group.width();
out << ", #locations=" << num_locations;
out << ", #targets=" << num_targets;
if (num_targets > 0) {
double ratio = static_cast<double>(num_locations) / num_targets;
out << " (ratio=" << base::StringPrintf("%.4f", ratio) << ")";
}
out << std::endl;
if (do_dump) {
auto refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref; ref = refs->GetNext()) {
out << " " << AsHex<8>(ref->location);
out << " " << AsHex<8>(ref->target) << std::endl;
}
}
}
return status::kStatusSuccess;
}
status::Code DetectAll(ConstBufferView image,
std::ostream& out,
std::vector<ConstBufferView>* sub_image_list) {
DCHECK_NE(sub_image_list, nullptr);
sub_image_list->clear();
const size_t size = image.size();
size_t last_out_pos = 0;
size_t total_bytes_found = 0;
auto print_range = [&out](size_t pos, size_t size, const std::string& msg) {
out << "-- " << AsHex<8, size_t>(pos) << " +" << AsHex<8, size_t>(size)
<< ": " << msg << std::endl;
};
ElementFinder finder(image,
base::BindRepeating(DetectElementFromDisassembler));
for (auto element = finder.GetNext(); element.has_value();
element = finder.GetNext()) {
ConstBufferView sub_image = image[element->region()];
sub_image_list->push_back(sub_image);
size_t pos = sub_image.begin() - image.begin();
size_t prog_size = sub_image.size();
if (last_out_pos < pos)
print_range(last_out_pos, pos - last_out_pos, "?");
auto disasm = MakeDisassemblerOfType(sub_image, element->exe_type);
print_range(pos, prog_size, disasm->GetExeTypeString());
total_bytes_found += prog_size;
last_out_pos = pos + prog_size;
}
if (last_out_pos < size)
print_range(last_out_pos, size - last_out_pos, "?");
out << std::endl;
// Print summary, using decimal instead of hexadecimal.
out << "Detected " << total_bytes_found << "/" << size << " bytes => ";
double percent = total_bytes_found * 100.0 / size;
out << base::StringPrintf("%.2f", percent) << "%." << std::endl;
return status::kStatusSuccess;
}
status::Code MatchAll(ConstBufferView old_image,
ConstBufferView new_image,
std::ostream& out) {
HeuristicEnsembleMatcher matcher(&out);
if (!matcher.RunMatch(old_image, new_image)) {
out << "RunMatch() failed.";
return status::kStatusFatal;
}
out << "Found " << matcher.matches().size() << " nontrivial matches and "
<< matcher.num_identical() << " identical matches." << std::endl;
return status::kStatusSuccess;
}
} // namespace zucchini
|
