1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/zucchini/zucchini_tools.h"
#include <stddef.h>
#include <stdint.h>
#include <algorithm>
#include <memory>
#include <ostream>
#include <utility>
#include "base/check_op.h"
#include "base/functional/bind.h"
#include "base/strings/stringprintf.h"
#include "components/zucchini/disassembler.h"
#include "components/zucchini/element_detection.h"
#include "components/zucchini/ensemble_matcher.h"
#include "components/zucchini/heuristic_ensemble_matcher.h"
#include "components/zucchini/imposed_ensemble_matcher.h"
#include "components/zucchini/io_utils.h"
namespace zucchini {
status::Code ReadReferences(ConstBufferView image,
bool do_dump,
std::ostream& out) {
std::unique_ptr<Disassembler> disasm = MakeDisassemblerWithoutFallback(image);
if (!disasm) {
out << "Input file not recognized as executable." << std::endl;
return status::kStatusInvalidOldImage;
}
std::vector<offset_t> targets;
for (const auto& group : disasm->MakeReferenceGroups()) {
targets.clear();
auto refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref.has_value(); ref = refs->GetNext())
targets.push_back(ref->target);
size_t num_locations = targets.size();
std::sort(targets.begin(), targets.end());
targets.erase(std::unique(targets.begin(), targets.end()), targets.end());
size_t num_targets = targets.size();
out << "Type " << int(group.type_tag().value())
<< ": Pool=" << static_cast<uint32_t>(group.pool_tag().value())
<< ", width=" << group.width() << ", #locations=" << num_locations
<< ", #targets=" << num_targets;
if (num_targets > 0) {
double ratio = static_cast<double>(num_locations) / num_targets;
out << " (ratio=" << base::StringPrintf("%.4f", ratio) << ")";
}
out << std::endl;
if (do_dump) {
refs = group.GetReader(disasm.get());
for (auto ref = refs->GetNext(); ref; ref = refs->GetNext()) {
out << " " << AsHex<8>(ref->location) << " " << AsHex<8>(ref->target)
<< std::endl;
}
}
}
return status::kStatusSuccess;
}
status::Code DetectAll(ConstBufferView image,
const GenerateOptions& options,
std::ostream& out,
std::vector<ConstBufferView>* sub_image_list) {
DCHECK_NE(sub_image_list, nullptr);
sub_image_list->clear();
const size_t size = image.size();
size_t last_out_pos = 0;
size_t total_bytes_found = 0;
auto print_range = [&out](size_t pos, size_t size, const std::string& msg) {
out << "-- " << AsHex<8, size_t>(pos) << " +" << AsHex<8, size_t>(size)
<< ": " << msg << std::endl;
};
std::unique_ptr<ElementFinder> element_finder =
std::make_unique<ElementFinder>(
image, base::BindRepeating(DetectElementFromDisassembler),
options.start_scan_at);
for (auto element = element_finder->GetNext(); element.has_value();
element = element_finder->GetNext()) {
ConstBufferView sub_image = image[element->region()];
sub_image_list->push_back(sub_image);
size_t pos = sub_image.begin() - image.begin();
size_t prog_size = sub_image.size();
if (last_out_pos < pos)
print_range(last_out_pos, pos - last_out_pos, "?");
auto disasm = MakeDisassemblerOfType(sub_image, element->exe_type);
print_range(pos, prog_size, disasm->GetExeTypeString());
total_bytes_found += prog_size;
last_out_pos = pos + prog_size;
}
if (last_out_pos < size)
print_range(last_out_pos, size - last_out_pos, "?");
out << std::endl;
// Print summary, using decimal instead of hexadecimal.
out << "Detected " << total_bytes_found << "/" << size << " bytes => ";
double percent = total_bytes_found * 100.0 / size;
out << base::StringPrintf("%.2f", percent) << "%." << std::endl;
return status::kStatusSuccess;
}
status::Code MatchAll(ConstBufferView old_image,
ConstBufferView new_image,
const GenerateOptions& options,
std::ostream& out) {
std::unique_ptr<EnsembleMatcher> matcher;
if (options.imposed_matches.empty()) {
matcher =
std::make_unique<HeuristicEnsembleMatcher>(options.start_scan_at, &out);
} else {
if (options.start_scan_at > 0) {
LOG(WARNING) << "-start_scan_at option is meaningless under -imposed.";
}
matcher = std::make_unique<ImposedEnsembleMatcher>(options.imposed_matches);
}
if (!matcher->RunMatch(old_image, new_image)) {
out << "RunMatch() failed.";
return status::kStatusFatal;
}
out << "Found " << matcher->matches().size() << " nontrivial matches and "
<< matcher->num_identical() << " identical matches." << std::endl
<< "To impose the same matches by command line, use: " << std::endl
<< " -impose=";
PrefixSep sep(",");
for (const ElementMatch& match : matcher->matches())
out << sep << match.ToString();
out << std::endl;
return status::kStatusSuccess;
}
} // namespace zucchini
|
