Examples with IAddress com.google.security.zynamics.zylib.disassembly.IAddress used on opensource projects

Example 41 with IAddress

use of com.google.security.zynamics.zylib.disassembly.IAddress in project binnavi by google.

the class CTracking method track.

/**
 * Performs a register forward tracking operation.
 *
 * @param view The view where the operation happens.
 * @param startInstruction The start instruction.
 * @param trackedRegister The register to track.
 * @param options Register tracking options.
 *
 * @return The result of the register tracking operation.
 *
 * @throws InternalTranslationException Thrown if the graph from the code could not be translated
 *         to REIL.
 */
public static CTrackingResult track(final INaviView view, final INaviInstruction startInstruction, final String trackedRegister, final RegisterTrackingOptions options) throws InternalTranslationException {
    Preconditions.checkNotNull(view, "IE01660: View argument can not be null");
    Preconditions.checkNotNull(startInstruction, "IE01661: Start instruction argument can not be null");
    Preconditions.checkNotNull(trackedRegister, "IE01662: Register argument can not be null");
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(view.getContent().getReilCode(), startInstruction, trackedRegister, options);
    final Map<IAddress, INaviInstruction> instructionMap = CRegisterTrackingHelper.getInstructionMap(view);
    final List<CInstructionResult> instructionResultList = new ArrayList<CInstructionResult>();
    final Map<IAddress, RegisterSetLatticeElement> perInstructionElement = result.generateAddressToStateMapping(startInstruction, options.trackIncoming());
    for (final Map.Entry<IAddress, RegisterSetLatticeElement> addressToStateMapEntry : perInstructionElement.entrySet()) {
        final RegisterSetLatticeElement element = addressToStateMapEntry.getValue();
        if (!element.getReadRegisters().isEmpty() || !element.getNewlyTaintedRegisters().isEmpty() || !element.getUntaintedRegisters().isEmpty() || !element.getUpdatedRegisters().isEmpty()) {
            final CAddress concreteAddress = new CAddress(addressToStateMapEntry.getKey().toLong() >> 8);
            instructionResultList.add(new CInstructionResult(instructionMap.get(concreteAddress), addressToStateMapEntry.getValue()));
        }
    }
    return new CTrackingResult(startInstruction, trackedRegister, instructionResultList);
}

Example 42 with IAddress

use of com.google.security.zynamics.zylib.disassembly.IAddress in project binnavi by google.

the class ProcessManager method getModule.

/**
 * Returns the module that contains to the given address or null if no such module exists.
 *
 * @param address The address for which to find the corresponding memory module.
 * @return The module that contains the given address.
 */
public MemoryModule getModule(final RelocatedAddress address) {
    // Note: modules are non-overlapping so the head set either contains zero or one elements.
    final SortedSet<IAddress> moduleAddressesHeadSet = moduleAddresses.headSet(address.getAddress(), true);
    if (moduleAddressesHeadSet.isEmpty()) {
        return null;
    } else {
        final MemoryModule module = moduleByAddress.get(moduleAddressesHeadSet.last());
        final BigInteger endAddress = module.getBaseAddress().getAddress().toBigInteger().add(BigInteger.valueOf(module.getSize()));
        return address.getAddress().toBigInteger().compareTo(endAddress) <= 0 ? module : null;
    }
}

Example 43 with IAddress

use of com.google.security.zynamics.zylib.disassembly.IAddress in project binnavi by google.

the class CReilInstructionGraph method createInstructionEdge.

/**
 * Creates an instruction graph edge between the source node and the destination node and returns
 * the resulting yfiles edge.
 *
 * @param sourceNode The source node of the edge to be created.
 * @param destinationNode The destination node of the edge to be created.
 * @param isTrueEdge Boolean parameter to determine if the edge is a conditional true edge.
 *
 * @return The yfiles edge which has been created and inserted in the graph.
 */
private Edge createInstructionEdge(final Node sourceNode, final Node destinationNode, final boolean isTrueEdge) {
    final ReilInstruction reilInstruction = m_nodesMap.get(destinationNode).getReilInstruction();
    boolean isExitEdge = false;
    if (reilInstruction != null) {
        final IAddress reilInstructionAddress = reilInstruction.getAddress();
        if ((reilInstructionAddress.toLong() & 0xFF) == 0) {
            isExitEdge = true;
        }
    }
    final Edge edge = m_internalGraph.createEdge(sourceNode, destinationNode);
    m_edgesMap.put(edge, new ReilInstructionGraphEdge(isTrueEdge, isExitEdge));
    return edge;
}

Example 44 with IAddress

use of com.google.security.zynamics.zylib.disassembly.IAddress in project binnavi by google.

the class TestFollowZFIncomingBackwards method testRegisterTrackFlagDirectionUpMultiEdgeIn.

@Test
public void testRegisterTrackFlagDirectionUpMultiEdgeIn() {
    final MockInstruction startInstruction = new MockInstruction(Long.parseLong("4"), "jz", new ArrayList<MockOperandTree>());
    m_options = new RegisterTrackingOptions(true, new HashSet<String>(), true, AnalysisDirection.UP);
    final List<String> nop1 = new ArrayList<String>();
    nop1.add("100: nop [,,]");
    final List<String> nop2 = new ArrayList<String>();
    nop2.add("200: nop [,,]");
    final List<String> inst = new ArrayList<String>();
    inst.add("300: bisz [DWORD eax, EMPTY , BYTE ZF]");
    inst.add("400: jcc [BYTE ZF, EMPTY, DWORD 123456]");
    final List<List<String>> blocks = Lists.newArrayList();
    blocks.add(nop1);
    blocks.add(nop2);
    blocks.add(inst);
    final List<String> edgeStrings = new ArrayList<String>();
    edgeStrings.add("100 [JUMP_UNCONDITIONAL]-> 300");
    edgeStrings.add("200 [JUMP_UNCONDITIONAL]-> 300");
    generateReilGraph(blocks, edgeStrings);
    m_function = new ReilFunction("FOLLOWZF", m_graph1);
    final String trackedRegister = "ZF";
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(m_function, startInstruction, trackedRegister, m_options);
    final Map<IAddress, RegisterSetLatticeElement> resultMap = result.generateAddressToStateMapping(startInstruction, m_options.trackIncoming());
    for (final Entry<IAddress, RegisterSetLatticeElement> resultEntry : resultMap.entrySet()) {
        if (resultEntry.getKey().toLong() == Long.parseLong("100", 16)) {
            final RegisterSetLatticeElement jzElement = resultEntry.getValue();
            assertTrue(jzElement.getNewlyTaintedRegisters().isEmpty());
            assertTrue(jzElement.getReadRegisters().isEmpty());
            assertTrue(jzElement.getTaintedRegisters().contains("eax"));
            assertTrue(jzElement.getUntaintedRegisters().isEmpty());
            assertTrue(jzElement.getUpdatedRegisters().isEmpty());
        }
        if (resultEntry.getKey().toLong() == Long.parseLong("200", 16)) {
            final RegisterSetLatticeElement jzElement = resultEntry.getValue();
            assertTrue(jzElement.getNewlyTaintedRegisters().isEmpty());
            assertTrue(jzElement.getReadRegisters().isEmpty());
            assertTrue(jzElement.getTaintedRegisters().contains("eax"));
            assertTrue(jzElement.getUntaintedRegisters().isEmpty());
            assertTrue(jzElement.getUpdatedRegisters().isEmpty());
        }
        if (resultEntry.getKey().toLong() == Long.parseLong("300", 16)) {
            final RegisterSetLatticeElement jzElement = resultEntry.getValue();
            assertTrue(jzElement.getNewlyTaintedRegisters().contains("eax"));
            assertTrue(jzElement.getReadRegisters().contains("ZF"));
            assertTrue(jzElement.getTaintedRegisters().contains("eax"));
            assertTrue(jzElement.getUntaintedRegisters().contains("ZF"));
            assertTrue(jzElement.getUpdatedRegisters().isEmpty());
        }
        if (resultEntry.getKey().toLong() == Long.parseLong("400", 16)) {
            final RegisterSetLatticeElement jzElement = resultEntry.getValue();
            assertTrue(jzElement.getNewlyTaintedRegisters().contains("ZF"));
            assertTrue(jzElement.getReadRegisters().isEmpty());
            assertTrue(jzElement.getTaintedRegisters().contains("ZF"));
            assertTrue(jzElement.getUntaintedRegisters().isEmpty());
            assertTrue(jzElement.getUpdatedRegisters().isEmpty());
        }
    }
}

Example 45 with IAddress

use of com.google.security.zynamics.zylib.disassembly.IAddress in project binnavi by google.

the class TestFollowZFIncomingBackwards method testTransformFollowZFinStream1.

@Test
public void testTransformFollowZFinStream1() {
    final MockOperandTree operandTreeFirst1 = new MockOperandTree();
    operandTreeFirst1.root = new MockOperandTreeNode(ExpressionType.SIZE_PREFIX, "dword");
    operandTreeFirst1.root.m_children.add(new MockOperandTreeNode(ExpressionType.IMMEDIATE_INTEGER, "16827245"));
    final List<MockOperandTree> operandsFirst = Lists.newArrayList(operandTreeFirst1);
    conditionalJumpInstruction1 = new MockInstruction(Long.parseLong("100C32F", 16), "jz", operandsFirst);
    m_options = new RegisterTrackingOptions(true, new HashSet<String>(), true, AnalysisDirection.UP);
    final List<String> instructionStrings1 = new ArrayList<String>();
    // cmp
    instructionStrings1.add("0000000100C32C00: add [DWORD 12, DWORD ebp, QWORD t0]");
    instructionStrings1.add("0000000100C32C01: and [QWORD t0, DWORD 4294967295, DWORD t1]");
    instructionStrings1.add("0000000100C32C02: ldm [DWORD t1, EMPTY , BYTE t2]");
    instructionStrings1.add("0000000100C32C03: and [DWORD ebx, BYTE 255, BYTE t4]");
    instructionStrings1.add("0000000100C32C04: and [BYTE t2, BYTE 128, BYTE t5]");
    instructionStrings1.add("0000000100C32C05: and [BYTE t4, BYTE 128, BYTE t6]");
    instructionStrings1.add("0000000100C32C06: sub [BYTE t2, BYTE t4, WORD t7]");
    instructionStrings1.add("0000000100C32C07: and [WORD t7, WORD 128, BYTE t8]");
    instructionStrings1.add("0000000100C32C08: bsh [BYTE t8, BYTE -7, BYTE SF]");
    instructionStrings1.add("0000000100C32C09: xor [BYTE t5, BYTE t6, BYTE t9]");
    instructionStrings1.add("0000000100C32C0A: xor [BYTE t5, BYTE t8, BYTE t10]");
    instructionStrings1.add("0000000100C32C0B: and [BYTE t9, BYTE t10, BYTE t11]");
    instructionStrings1.add("0000000100C32C0C: bsh [BYTE t11, BYTE -7, BYTE OF]");
    instructionStrings1.add("0000000100C32C0D: and [WORD t7, WORD 256, WORD t12]");
    instructionStrings1.add("0000000100C32C0E: bsh [WORD t12, WORD -8, BYTE CF]");
    instructionStrings1.add("0000000100C32C0F: and [WORD t7, WORD 255, BYTE t13]");
    instructionStrings1.add("0000000100C32C10: bisz [BYTE t13, EMPTY , BYTE ZF]");
    // jz
    instructionStrings1.add("0000000100C32F00: jcc [BYTE ZF, EMPTY , DWORD 16827245]");
    final List<List<String>> reilBlocks = new ArrayList<List<String>>();
    reilBlocks.add(instructionStrings1);
    generateReilGraph(reilBlocks, new ArrayList<String>());
    m_function = new ReilFunction("FOLLOWZF", m_graph1);
    final String trackedRegister = "ZF";
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(m_function, conditionalJumpInstruction1, trackedRegister, m_options);
    final Map<IAddress, RegisterSetLatticeElement> resultMap = result.generateAddressToStateMapping(conditionalJumpInstruction1, m_options.trackIncoming());
    System.out.println(m_graph1.toString());
    for (final Entry<IAddress, RegisterSetLatticeElement> resultEntry : resultMap.entrySet()) {
        if (resultEntry.getKey().toLong() == Long.parseLong("0000000100C32F00", 16)) {
            final RegisterSetLatticeElement jzElement = resultEntry.getValue();
            assertTrue(jzElement.getNewlyTaintedRegisters().contains("ZF"));
            assertTrue(jzElement.getReadRegisters().isEmpty());
            assertTrue(jzElement.getTaintedRegisters().contains("ZF"));
            assertTrue(jzElement.getUntaintedRegisters().isEmpty());
            assertTrue(jzElement.getUpdatedRegisters().isEmpty());
        }
        if (resultEntry.getKey().toLong() == Long.parseLong("0000000100C32C00", 16)) {
            final RegisterSetLatticeElement cmpElement = resultEntry.getValue();
            assertTrue(cmpElement.getNewlyTaintedRegisters().contains("ebx"));
            assertTrue(cmpElement.getReadRegisters().contains("ZF"));
            assertTrue(cmpElement.getTaintedRegisters().contains("ebx"));
            assertTrue(cmpElement.getUntaintedRegisters().contains("ZF"));
            assertTrue(cmpElement.getUpdatedRegisters().isEmpty());
        }
    }
}