Summary: Methods | [Expand All]
public interface

INativeCodeAnalyzerExtension

com.pnfsoftware.jeb.core.units.code.asm.analyzer.INativeCodeAnalyzerExtension<InsnType extends com.pnfsoftware.jeb.core.units.code.IInstruction>
Known Indirect Subclasses

Class Overview

GCA extensions. A collection of heuristics to improve the generic code analyzer. Clients should inherit from AbstractAnalyzerExtension, which provides default implementations, and implement only the needed methods.

Summary

Public Methods
abstract NativeCodeAnalyzerExtensionResult<Boolean> determinePotentialPointers(long address, InsnType insn, List<PointerDescription> values)
Determine pointers (addresses to data or code) contained in the provided instruction, to let the code analyzer enqueue them for additional analysis.
abstract NativeCodeAnalyzerExtensionResult<Integer> determineRoutineStackPointerDelta(CFG<InsnType> routine)
Determine (heuristically) the stack pointer delta generated by the execution of a routine.
abstract NativeCodeAnalyzerExtensionResult<SwitchInformation> determineSwitchInformation(long address, long base, Map<Long, List<InsnType>> inBlocks, Map<Long, List<Long>> dstBlocks)
Determine (heuristically) the information related to a switch-like statement, i.e.
abstract NativeCodeAnalyzerExtensionResult<Long> getPossiblePaddingSize(long address, long addressMax)
Determine if a given memory area looks like (could be) starting with padding, and provides the size of the padding looking area, if any.
abstract NativeCodeAnalyzerExtensionResult<List<EntryPointDescription>> getProbableEntryPoints(long address, long addressMax)
Determine the likely entry points in the given memory area.
abstract NativeCodeAnalyzerExtensionResult<EntryPointDescription> getPrologueLooking(long address, long addressMax)
Determine if a given memory area looks like (could be) the beginning of a routine.
abstract void initialize(INativeCodeAnalyzer<InsnType> analyzer)
Implementors will receive a reference to the main analyzer.
abstract NativeCodeAnalyzerExtensionResult<Boolean> isCandidateSwitchDispatcher(long address, InsnType insn, List<InsnType> insns)
Determine (heuristically) if the provided branching instruction (jump/call/...) could be the dispatcher of a switch-like statement.
abstract NativeCodeAnalyzerExtensionResult<Boolean> isNonReturningRoutine(INativeMethodItem routine)
Determine if the given routine is non-returning.
abstract NativeCodeAnalyzerExtensionResult<? extends PointerDescription> isTrampolineToDynResRoutine(CFG<InsnType> routine)
Determine if a routine is a trampoline stub to another code location.
abstract NativeCodeAnalyzerExtensionResult<Boolean> postprocessImage()
This method is called after the first analysis pass was performed.
abstract NativeCodeAnalyzerExtensionResult<Boolean> preprocessImage()
This method is called before the first analysis pass is performed.
abstract NativeCodeAnalyzerExtensionResult<Boolean> shouldForceRoutineEnd(long address, InsnType insn)
Determine if the address is the last instruction of a routine.

Public Methods

public abstract NativeCodeAnalyzerExtensionResult<Boolean> determinePotentialPointers (long address, InsnType insn, List<PointerDescription> values)

Determine pointers (addresses to data or code) contained in the provided instruction, to let the code analyzer enqueue them for additional analysis. This method is called by the INativeCodeAnalyzer before it tries to determine such additions itself.

Returns
  • a Boolean in getResult(); false to let the code analyzer proceed with its own (generic) pointer discovery algorithm; true to instruct it to skip it

public abstract NativeCodeAnalyzerExtensionResult<Integer> determineRoutineStackPointerDelta (CFG<InsnType> routine)

Determine (heuristically) the stack pointer delta generated by the execution of a routine.

Returns
  • an Integer in getResult(), null if the routine failed to determine the stack pointer delta

public abstract NativeCodeAnalyzerExtensionResult<SwitchInformation> determineSwitchInformation (long address, long base, Map<Long, List<InsnType>> inBlocks, Map<Long, List<Long>> dstBlocks)

Determine (heuristically) the information related to a switch-like statement, i.e. the list of reachable EntryPointDescription (case handlers) and the jump table addresses (if any).

Parameters
address base address of the switch instruction
base base address of the basic block to analyze
inBlocks all known basic blocks. The map index is the base address and it must at least contains the switch candidate, but not necessarily all the blocks (and at least a path to the switch candidate).
dstBlocks map that indicates the destination offsets per basic block base address.
Returns

public abstract NativeCodeAnalyzerExtensionResult<Long> getPossiblePaddingSize (long address, long addressMax)

Determine if a given memory area looks like (could be) starting with padding, and provides the size of the padding looking area, if any.

Parameters
address address to be examined (inclusive)
addressMax end address to be examined (exclusive)
Returns
  • a Long in getResult(); the size of the padding-like area from address, 0L if it does not look like padding

public abstract NativeCodeAnalyzerExtensionResult<List<EntryPointDescription>> getProbableEntryPoints (long address, long addressMax)

Determine the likely entry points in the given memory area. It might provide several entry points (with different modes) ordered by their likelihood.

This method is not guaranteed to give the correct result, and should be considered an heuristic. It is intended to be used before the actual disassembly of code; it may provide a hint on the entry point to disassemble with.

Returns
  • a list of Integer representing entry points in getResult(), ordered from the most probable to the least probable. The list will be empty if none could be determined

public abstract NativeCodeAnalyzerExtensionResult<EntryPointDescription> getPrologueLooking (long address, long addressMax)

Determine if a given memory area looks like (could be) the beginning of a routine.

Parameters
address address to be examined (inclusive)
addressMax end address to be examined (exclusive)
Returns

public abstract void initialize (INativeCodeAnalyzer<InsnType> analyzer)

Implementors will receive a reference to the main analyzer. This method is not to be called by third-party code. It will be called by the GCA when the extension object (this object) is being initialized.

public abstract NativeCodeAnalyzerExtensionResult<Boolean> isCandidateSwitchDispatcher (long address, InsnType insn, List<InsnType> insns)

Determine (heuristically) if the provided branching instruction (jump/call/...) could be the dispatcher of a switch-like statement.

Parameters
address address of the branching instruction
insn branching instruction
insns list of all instructions in the current basic block
Returns
  • a boolean in getResult(); true if the instruction might correspond to a switch-like statement, false otherwise

public abstract NativeCodeAnalyzerExtensionResult<Boolean> isNonReturningRoutine (INativeMethodItem routine)

Determine if the given routine is non-returning.

Returns
  • a Boolean in getResult(); true if the routine does not return, false otherwise, null when no determination could be made

public abstract NativeCodeAnalyzerExtensionResult<? extends PointerDescription> isTrampolineToDynResRoutine (CFG<InsnType> routine)

Determine if a routine is a trampoline stub to another code location.

Returns

public abstract NativeCodeAnalyzerExtensionResult<Boolean> postprocessImage ()

This method is called after the first analysis pass was performed.

Returns
  • true if some processing

public abstract NativeCodeAnalyzerExtensionResult<Boolean> preprocessImage ()

This method is called before the first analysis pass is performed.

Returns
  • true if some processing

public abstract NativeCodeAnalyzerExtensionResult<Boolean> shouldForceRoutineEnd (long address, InsnType insn)

Determine if the address is the last instruction of a routine. If true, the basic block containing the provided instruction will be closed, i.e. it will be as if the instruction breaks the flow to nothing.

When working with delay slots, this method will indicate routine end for the jump instruction that precedes the delay slot(s), not for the delay slot.

Parameters
insn parsed instruction at the provided address
Returns
  • a Boolean in getResult(); true if the address should be considered a routine termination, false otherwise