xbe_analy.cc

Go to the documentation of this file.

/*
 *      HT Editor
 *      xbe_analy.cc
 *
 *      Copyright (C) 2003 Stefan Esser
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License version 2 as
 *      published by the Free Software Foundation.
 *
 *      This program is distributed in the hope that it will be useful,
 *      but WITHOUT ANY WARRANTY; without even the implied warranty of
 *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *      GNU General Public License for more details.
 *
 *      You should have received a copy of the GNU General Public License
 *      along with this program; if not, write to the Free Software
 *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "analy.h"
#include "analy_alpha.h"
#include "analy_ia64.h"
#include "analy_il.h"
#include "analy_names.h"
#include "analy_register.h"
#include "analy_ppc.h"
#include "analy_x86.h"
#include "global.h"
#include "htctrl.h"
#include "htdebug.h"
#include "htiobox.h"
#include "htxbeimp.h"
#include "htxbe.h"
#include "htstring.h"
#include "ilopc.h"
#include "xbe_analy.h"
#include "xbestruct.h"
#include "snprintf.h"
#include "x86asm.h"

/*
 *
 */
void    XBEAnalyser::init(ht_xbe_shared_data *XBE_shared, ht_streamfile *File)
{
        xbe_shared = XBE_shared;
        file = File;

        validarea = new Area();
        validarea->init();

        Analyser::init();
}


/*
 *
 */
int     XBEAnalyser::load(ht_object_stream *f)
{
        GET_OBJECT(f, validarea);
        return Analyser::load(f);
}

/*
 *
 */
void    XBEAnalyser::done()
{
        validarea->done();
        delete validarea;
        Analyser::done();
}

/*
 *
 */
void XBEAnalyser::beginAnalysis()
{
        char    buffer[1024];

        setLocationTreeOptimizeThreshold(100);
        setSymbolTreeOptimizeThreshold(100);

        /*
         *      entrypoint
         */
        Address *entry;

        entry = createAddress32(xbe_shared->header.entry_point);
        pushAddress(entry, entry);
        
        /*
         * give all sections a descriptive comment:
         */

        XBE_SECTION_HEADER *s=xbe_shared->sections.sections;
        char blub[100];
        for (UINT i=0; i<xbe_shared->sections.number_of_sections; i++) {
                Address *secaddr;

                secaddr = createAddress32(s->virtual_address);

                ht_snprintf(blub, sizeof blub, ";  TEST section %d <%s>", i+1, getSegmentNameByAddress(secaddr));
                addComment(secaddr, 0, "");
                addComment(secaddr, 0, ";******************************************************************");
                addComment(secaddr, 0, blub);
                ht_snprintf(blub, sizeof blub, ";  virtual address  %08x  virtual size   %08x", s->virtual_address, s->virtual_size);
                addComment(secaddr, 0, blub);
                ht_snprintf(blub, sizeof blub, ";  file offset      %08x  file size      %08x", s->raw_address, s->raw_size);
                addComment(secaddr, 0, blub);
                addComment(secaddr, 0, ";******************************************************************");

                // mark end of sections
                ht_snprintf(blub, sizeof blub, ";  end of section <%s>", getSegmentNameByAddress(secaddr));
                Address *secend_addr = (Address *)secaddr->duplicate();
                secend_addr->add(MAX(s->virtual_size, s->raw_size));
                newLocation(secend_addr)->flags |= AF_FUNCTION_END;
                addComment(secend_addr, 0, "");
                addComment(secend_addr, 0, ";******************************************************************");
                addComment(secend_addr, 0, blub);
                addComment(secend_addr, 0, ";******************************************************************");

                validarea->add(secaddr, secend_addr);
                Address *seciniaddr = (Address *)secaddr->duplicate();
                seciniaddr->add(MIN(s->virtual_size, s->raw_size));
                if (validAddress(secaddr, scinitialized) && validAddress(seciniaddr, scinitialized)) {
                        initialized->add(secaddr, seciniaddr);
                }
                s++;
                delete secaddr;
                delete secend_addr;
                delete seciniaddr;
        }

        int import_count=xbe_shared->imports.funcs->count();
        int *entropy = random_permutation(import_count);
        for (int i=0; i<import_count; i++) {
                ht_xbe_import_function *f=(ht_xbe_import_function *)xbe_shared->imports.funcs->get(*(entropy+i));
//              ht_pe_import_library *d=(ht_pe_import_library *)pe_shared->imports.libs->get(f->libidx);
                char *label;
                label = import_func_name("NTOSKRNL.EXE", (f->byname) ? f->name.name : NULL, f->ordinal);
                Address *faddr;

                faddr = createAddress32(f->address+xbe_shared->header.base_address);

                addComment(faddr, 0, "");
                if (!assignSymbol(faddr, label, label_func)) {
                        // multiple import of a function (duplicate labelname)
                        // -> mangle name a bit more
                        addComment(faddr, 0, "; duplicate import");               
                        ht_snprintf(buffer, sizeof buffer, "%s_%x", label, f->address);
                        assignSymbol(faddr, buffer, label_func);
                }
                data->setIntAddressType(faddr, dst_idword, 4);
                free(label);
                delete faddr;
        }
        if (entropy) free(entropy);


        addComment(entry, 0, "");
        addComment(entry, 0, ";****************************");
        addComment(entry, 0, ";  program entry point");
        addComment(entry, 0, ";****************************");
        assignSymbol(entry, "entrypoint", label_func);

        setLocationTreeOptimizeThreshold(1000);
        setSymbolTreeOptimizeThreshold(1000);
        delete entry;

        Address *tls;
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+0);
        assignSymbol(tls, "tls.data_start_address", label_data);
        free(tls);
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+4);
        assignSymbol(tls, "tls.data_end_address", label_data);
        free(tls);
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+8);
        assignSymbol(tls, "tls.index_address", label_data);
        free(tls);
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+12);
        assignSymbol(tls, "tls.callback_address", label_data);
        free(tls);
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+16);
        assignSymbol(tls, "tls.size_of_zero_fill", label_data);
        free(tls);
        tls = createAddress32(xbe_shared->header.tls_address+xbe_shared->header.base_address+20);
        assignSymbol(tls, "tls.characteristics", label_data);
        free(tls);

        Analyser::beginAnalysis();
}

/*
 *
 */
OBJECT_ID       XBEAnalyser::object_id() const
{
        return ATOM_XBE_ANALYSER;
}

/*
 *
 */
UINT XBEAnalyser::bufPtr(Address *Addr, byte *buf, int size)
{
        FILEOFS ofs = addressToFileofs(Addr);
/*      if (ofs == INVALID_FILE_OFS) {
                int as=0;
        }*/
        assert(ofs != INVALID_FILE_OFS);
        file->seek(ofs);
        return file->read(buf, size);
}

bool XBEAnalyser::convertAddressToRVA(Address *addr, RVA *r)
{
        OBJECT_ID oid = addr->object_id();
        if (oid==ATOM_ADDRESS_FLAT_32) {
                *r = ((AddressFlat32*)addr)->addr - xbe_shared->header.base_address;
                return true;
        } else if (oid == ATOM_ADDRESS_X86_FLAT_32) {
                *r = ((AddressX86Flat32*)addr)->addr - xbe_shared->header.base_address;
                return true;
        }
//      *r = ((AddressFlat32*)addr)->addr - xbe_shared->header.base_address;
//      *r = ((AddressX86Flat32*)addr)->addr - xbe_shared->header.base_address;
        return false;
}

/*
 *
 */
Address *XBEAnalyser::createAddress32(dword addr)
{
        return new AddressX86Flat32(addr);
//      return new AddressFlat32(addr);
}

/*
 *
 */
Address *XBEAnalyser::createAddress64(qword addr)
{
        return NULL;
}

Address *XBEAnalyser::createAddress()
{
        return new AddressX86Flat32();
//      return new AddressFlat32();
}

/*
 *
 */
Assembler *XBEAnalyser::createAssembler()
{
        Assembler *a = new x86asm(X86_OPSIZE32, X86_ADDRSIZE32);
        a->init();
        return a;
}

/*
 *
 */
FILEOFS XBEAnalyser::addressToFileofs(Address *Addr)
{
/*     char tbuf[1024];
        Addr->stringify(tbuf, 1024, 0);
        printf("ADDR=%s", tbuf);*/
        if (validAddress(Addr, scinitialized)) {
//      printf(" v1\n");
                FILEOFS ofs;
                RVA r;
                if (!convertAddressToRVA(Addr, &r)) return INVALID_FILE_OFS;
                if (!xbe_rva_to_ofs(&xbe_shared->sections, r, &ofs)) return INVALID_FILE_OFS;
                return ofs;
        } else {
//      printf(" IV1\n");
                return INVALID_FILE_OFS;
        }
}

/*
 *
 */
char *XBEAnalyser::getSegmentNameByAddress(Address *Addr)
{
        static char sectionname[9];
        xbe_section_headers *sections=&xbe_shared->sections;
        int i;
        RVA r;
        bool b;

//      Addr-=pe_shared->pe32.header_nt.image_base;
        if (!convertAddressToRVA(Addr, &r)) return NULL;
        
//      { FILE *f;f=fopen("/tmp/rva","a+");if (f){fprintf(f,"rva: %08x\n",r);fclose(f);} }
        
        xbe_rva_to_section(sections, r, &i);
//      XBE_SECTION_HEADER *s=sections->sections+i;
        b = xbe_rva_is_valid(sections, r);
//      { FILE *f;f=fopen("/tmp/rva","a+");if (f){fprintf(f,"rva: %08x %u\n",r,(UINT)b);fclose(f);} }
        
        if (!b) return NULL;

        memmove(sectionname, "<notyet>", 8);
        sectionname[8]=0;
        return sectionname;
}

/*
 *
 */
const char *XBEAnalyser::getName()
{
        return file->get_desc();
}

/*
 *
 */
const char *XBEAnalyser::getType()
{
        return "XBE/Analyser";
}

/*
 *
 */
void XBEAnalyser::initCodeAnalyser()
{
        Analyser::initCodeAnalyser();
}
/*
static char *string_func(dword ofs, void *context)
{
        char str[1024];
        static char str2[1024];
        ht_pe_shared_data *pe = (ht_pe_shared_data*)context;
        if (ofs < pe->il->string_pool_size) {
                dword length;
                dword o = ILunpackDword(length, (byte*)&pe->il->string_pool[ofs], 10);
                wide_char_to_multi_byte(str, (byte*)&pe->il->string_pool[ofs+o], length/2+1);
                escape_special_str(str2, sizeof str2, str, "\"");
                return str2;
        } else {
                return NULL;
        }
}

static char *token_func(dword token, void *context)
{
        static char tokenstr[1024];
        switch (token & IL_META_TOKEN_MASK) {
                case IL_META_TOKEN_TYPE_REF:
                case IL_META_TOKEN_TYPE_DEF: {
                        sprintf(tokenstr, "typedef");
                        break;
                }
                case IL_META_TOKEN_FIELD_DEF: {
                        sprintf(tokenstr, "fielddef");
                        break;
                }
                case IL_META_TOKEN_METHOD_DEF: {
                        sprintf(tokenstr, "methoddef");
                        break;
                }
                case IL_META_TOKEN_MEMBER_REF: {
                        sprintf(tokenstr, "memberref");
                        break;
                }
                case IL_META_TOKEN_TYPE_SPEC: {
                        sprintf(tokenstr, "typespec");
                        break;
                }
                default:
                        return NULL;
        }
        return tokenstr;
}
*/

/*
 *
 */
void XBEAnalyser::initUnasm()
{
        DPRINTF("xbe_analy: ");

        DPRINTF("initing analy_x86_disassembler\n");
        analy_disasm = new AnalyX86Disassembler();
        ((AnalyX86Disassembler *)analy_disasm)->init(this, 0);
}

/*
 *
 */
void XBEAnalyser::log(const char *msg)
{
        /*
         *      log() creates to much traffic so dont log
         *   perhaps we reactivate this later
         *
         */
/*      LOG(msg);*/
}

/*
 *
 */
Address *XBEAnalyser::nextValid(Address *Addr)
{
        return (Address *)validarea->findNext(Addr);
}

/*
 *
 */
void XBEAnalyser::store(ht_object_stream *st)
{
        /*
        ht_pe_shared_data       *pe_shared;
        ht_stream               *file;
        area                            *validarea;
        */
        PUT_OBJECT(st, validarea);
        Analyser::store(st);
}

/*
 *
 */
int     XBEAnalyser::queryConfig(int mode)
{
        switch (mode) {
                case Q_DO_ANALYSIS:
                case Q_ENGAGE_CODE_ANALYSER:
                case Q_ENGAGE_DATA_ANALYSER:
                        return true;
                default:
                        return 0;
        }
}

/*
 *
 */
Address *XBEAnalyser::fileofsToAddress(FILEOFS fileofs)
{
        RVA r;
        if (xbe_ofs_to_rva(&xbe_shared->sections, fileofs, &r)) {
                return createAddress32(r+xbe_shared->header.base_address);
        } else {
                return new InvalidAddress();
        }
}

/*
 *
 */
bool XBEAnalyser::validAddress(Address *Addr, tsectype action)
{
        xbe_section_headers *sections=&xbe_shared->sections;
        int sec;
        RVA r;
        if (!convertAddressToRVA(Addr, &r)) return false;
        if (!xbe_rva_to_section(sections, r, &sec)) return false;
        XBE_SECTION_HEADER *s=sections->sections+sec;
        switch (action) {
                case scvalid:
                        return true;
                case scread:
                        return true;
                case scwrite:
                        return s->section_flags & XBE_SECTION_FLAGS_WRITABLE;
                case screadwrite:
                        return s->section_flags & XBE_SECTION_FLAGS_WRITABLE;
                case sccode:
                        if (!xbe_rva_is_physical(sections, r)) return false;
                        return s->section_flags & XBE_SECTION_FLAGS_EXECUTABLE;
                case scinitialized:
                        if (!xbe_rva_is_physical(sections, r)) return false;
                        return true;
        }
        return false;
}

---