public abstract class

AbstractAnalyzerExtension

extends Object
implements INativeCodeAnalyzerExtension<InsnType extends IInstruction>
java.lang.Object
   ↳ com.pnfsoftware.jeb.core.units.code.asm.analyzer.AbstractAnalyzerExtension<InsnType extends com.pnfsoftware.jeb.core.units.code.IInstruction>

Class Overview

Extension of the INativeCodeAnalyzer.

Summary

Fields
protected INativeCodeAnalyzer<InsnType extends IInstruction> gca
protected BinaryPatternVerifier paddingVerifier
protected BinaryPatternVerifier prologueVerifier
Public Constructors
AbstractAnalyzerExtension()
Public Methods
NativeCodeAnalyzerExtensionResult<Boolean> determinePotentialPointers(long address, InsnType insn, List<PointerDescription> values)
The default result (getResult()) is false.
NativeCodeAnalyzerExtensionResult<Integer> determineRoutineStackPointerDelta(CFG<InsnType> routine)
The default result (getResult()) is null.
NativeCodeAnalyzerExtensionResult<SwitchInformation> determineSwitchInformation(long address, long base, Map<Long, List<InsnType>> inBlocks, Map<Long, List<Long>> dstBlocks)
The default result (getResult()) is null.
NativeCodeAnalyzerExtensionResult<Long> getPossiblePaddingSize(long address, long addressMax)
Default implementation checks the patterns stored in paddingVerifier.
NativeCodeAnalyzerExtensionResult<List<EntryPointDescription>> getProbableEntryPoints(long address, long addressMax)
Determine the likely entry points in the given memory area.
NativeCodeAnalyzerExtensionResult<EntryPointDescription> getPrologueLooking(long address, long addressMax)
Default implementation checks the patterns stored in prologueVerifier.
void initialize(INativeCodeAnalyzer<InsnType> analyzer)
Must be called by the GCA.
NativeCodeAnalyzerExtensionResult<Boolean> isCandidateSwitchDispatcher(long address, InsnType insn, List<InsnType> insns)
The default result (getResult()) is false.
NativeCodeAnalyzerExtensionResult<Boolean> isNonReturningRoutine(INativeMethodItem routine)
Determine if the given routine is non-returning.
NativeCodeAnalyzerExtensionResult<? extends PointerDescription> isTrampolineToDynResRoutine(CFG<InsnType> routine)
The default result (getResult()) is null.
NativeCodeAnalyzerExtensionResult<Boolean> postprocessImage()
This method is called after the first analysis pass was performed.
NativeCodeAnalyzerExtensionResult<Boolean> preprocessImage()
This method is called before the first analysis pass is performed.
NativeCodeAnalyzerExtensionResult<Boolean> shouldForceRoutineEnd(long address, InsnType insn)
The default result (getResult()) is false.
Protected Methods
void initializePaddingPatterns(BinaryPatternVerifier paddingVerifier)
The default implementation does nothing.
void initializeProloguePatterns(BinaryPatternVerifier prologueVerifier)
The default implementation does nothing.
[Expand]
Inherited Methods
From class java.lang.Object
From interface com.pnfsoftware.jeb.core.units.code.asm.analyzer.INativeCodeAnalyzerExtension

Fields

protected INativeCodeAnalyzer<InsnType extends IInstruction> gca

protected BinaryPatternVerifier paddingVerifier

protected BinaryPatternVerifier prologueVerifier

Public Constructors

public AbstractAnalyzerExtension ()

Public Methods

public NativeCodeAnalyzerExtensionResult<Boolean> determinePotentialPointers (long address, InsnType insn, List<PointerDescription> values)

The default result (getResult()) is false.

Returns
  • a Boolean in getResult(); false to let the code analyzer proceed with its own (generic) pointer discovery algorithm; true to instruct it to skip it

public NativeCodeAnalyzerExtensionResult<Integer> determineRoutineStackPointerDelta (CFG<InsnType> routine)

The default result (getResult()) is null.

Returns
  • an Integer in getResult(), null if the routine failed to determine the stack pointer delta

public NativeCodeAnalyzerExtensionResult<SwitchInformation> determineSwitchInformation (long address, long base, Map<Long, List<InsnType>> inBlocks, Map<Long, List<Long>> dstBlocks)

The default result (getResult()) is null.

Parameters
address base address of the switch instruction
base base address of the basic block to analyze
inBlocks all known basic blocks. The map index is the base address and it must at least contains the switch candidate, but not necessarily all the blocks (and at least a path to the switch candidate).
dstBlocks map that indicates the destination offsets per basic block base address.
Returns

public NativeCodeAnalyzerExtensionResult<Long> getPossiblePaddingSize (long address, long addressMax)

Default implementation checks the patterns stored in paddingVerifier. When alignment information are present, only unaligned data is considered padding. If nothing is found, result (getResult()) is 0L.

Parameters
address address to be examined (inclusive)
addressMax end address to be examined (exclusive)
Returns
  • a Long in getResult(); the size of the padding-like area from address, 0L if it does not look like padding

public NativeCodeAnalyzerExtensionResult<List<EntryPointDescription>> getProbableEntryPoints (long address, long addressMax)

Determine the likely entry points in the given memory area. It might provide several entry points (with different modes) ordered by their likelihood.

This method is not guaranteed to give the correct result, and should be considered an heuristic. It is intended to be used before the actual disassembly of code; it may provide a hint on the entry point to disassemble with.

Returns
  • a list of Integer representing entry points in getResult(), ordered from the most probable to the least probable. The list will be empty if none could be determined

public NativeCodeAnalyzerExtensionResult<EntryPointDescription> getPrologueLooking (long address, long addressMax)

Default implementation checks the patterns stored in prologueVerifier. Can be overridden, but sub-class should call super-method first. If nothing is found, result (getResult()) is null.

Parameters
address address to be examined (inclusive)
addressMax end address to be examined (exclusive)
Returns

public void initialize (INativeCodeAnalyzer<InsnType> analyzer)

Must be called by the GCA. We cannot use @SerCustomInit here, as the GCA may not exist yet (eg, unprocessed unit).

public NativeCodeAnalyzerExtensionResult<Boolean> isCandidateSwitchDispatcher (long address, InsnType insn, List<InsnType> insns)

The default result (getResult()) is false.

Parameters
address address of the branching instruction
insn branching instruction
insns list of all instructions in the current basic block
Returns
  • a boolean in getResult(); true if the instruction might correspond to a switch-like statement, false otherwise

public NativeCodeAnalyzerExtensionResult<Boolean> isNonReturningRoutine (INativeMethodItem routine)

Determine if the given routine is non-returning.

Returns
  • a Boolean in getResult(); true if the routine does not return, false otherwise, null when no determination could be made

public NativeCodeAnalyzerExtensionResult<? extends PointerDescription> isTrampolineToDynResRoutine (CFG<InsnType> routine)

The default result (getResult()) is null.

Returns

public NativeCodeAnalyzerExtensionResult<Boolean> postprocessImage ()

This method is called after the first analysis pass was performed.

Returns
  • true if some processing

public NativeCodeAnalyzerExtensionResult<Boolean> preprocessImage ()

This method is called before the first analysis pass is performed.

Returns
  • true if some processing

public NativeCodeAnalyzerExtensionResult<Boolean> shouldForceRoutineEnd (long address, InsnType insn)

The default result (getResult()) is false.

Parameters
insn parsed instruction at the provided address
Returns
  • a Boolean in getResult(); true if the address should be considered a routine termination, false otherwise

Protected Methods

protected void initializePaddingPatterns (BinaryPatternVerifier paddingVerifier)

The default implementation does nothing.

protected void initializeProloguePatterns (BinaryPatternVerifier prologueVerifier)

The default implementation does nothing.