public class

NativeSignatureDBManager

extends Object
java.lang.Object
   ↳ com.pnfsoftware.jeb.core.units.code.asm.sig.NativeSignatureDBManager

Class Overview

Manage a set of INativeSignaturePackage, such that a native item (routine, basic block, instruction or data) can be matched against the INativeSignature contained in such package.

Conflicts resolution, i.e. when several signature match, and processing of signatures' attributes are the client's responsibility.

Warning: for now the only signature target fully managed is routine.

Summary

Constants
String SIGLIB_EXTENSION
Public Constructors
NativeSignatureDBManager()
NativeSignatureDBManager(File folder)
Creates a NSDBManager with an initial folder that will be scanned.
Public Methods
void addFolder(File folder, boolean doRescan)
Add a new folder to search for native signature packages.
List<NativeSignaturePackageEntry> getAvailablePackages()
Provides the list of available signature packages entries.
List<NativeSignaturePackageEntry> getLoadedPackages()
Provides the list of signature packages entries for which the corresponding signatures are loaded in memory.
int getNumberLoadedSigs()
boolean isActive()
boolean loadPackage(INativeCodeAnalyzer<IInstruction> gca, NativeSignaturePackageEntry entry)
Loads a specific package for the given analysis.
boolean loadPackage(NativeSignaturePackageEntry entry)
Loads a specific package for all analysis known to the manager.
void loadPackages(INativeCodeAnalyzer<IInstruction> gca)
Loads in memory the available packages suitable for the given analysis.
List<NativeSignatureMatchResult> match(INativeCodeAnalyzer<IInstruction> _gca, Collection<INativeMethodDataItem> routines, boolean uniqueMatchOnly, boolean maximumConfidenceLevel)
Match a list of native routines against the currently loaded signatures packages for this analysis.
void removeAllFolders()
Empties the list of scanned folders
void removeAllPackages()
Empties the list of available packages.
void removeFolder(File folder, boolean doRescan)
Remove a folder from the list of folders to search for native signature packages.
void rescan()
Rescan registered folders to register/unregister native signature packages.
void setActive(boolean isActive)
void unloadPackages(INativeCodeAnalyzer<IInstruction> gca)
Unloads from memory the signatures packages used by the given analysis.
[Expand]
Inherited Methods
From class java.lang.Object

Constants

public static final String SIGLIB_EXTENSION

Constant Value: ".siglib"

Public Constructors

public NativeSignatureDBManager ()

public NativeSignatureDBManager (File folder)

Creates a NSDBManager with an initial folder that will be scanned.

Public Methods

public void addFolder (File folder, boolean doRescan)

Add a new folder to search for native signature packages.

Parameters
doRescan if true all registered folders are scanned for signature packages after the addition

public List<NativeSignaturePackageEntry> getAvailablePackages ()

Provides the list of available signature packages entries. The corresponding packages are not necessarily loaded.

public List<NativeSignaturePackageEntry> getLoadedPackages ()

Provides the list of signature packages entries for which the corresponding signatures are loaded in memory.

public int getNumberLoadedSigs ()

public boolean isActive ()

public boolean loadPackage (INativeCodeAnalyzer<IInstruction> gca, NativeSignaturePackageEntry entry)

Loads a specific package for the given analysis.

public boolean loadPackage (NativeSignaturePackageEntry entry)

Loads a specific package for all analysis known to the manager.

public void loadPackages (INativeCodeAnalyzer<IInstruction> gca)

Loads in memory the available packages suitable for the given analysis. The determination of the suitable packages is based on:

  • the processor type of the analysis
  • the detected compiler, if any

public List<NativeSignatureMatchResult> match (INativeCodeAnalyzer<IInstruction> _gca, Collection<INativeMethodDataItem> routines, boolean uniqueMatchOnly, boolean maximumConfidenceLevel)

Match a list of native routines against the currently loaded signatures packages for this analysis. For each routine the algorithm searches for signatures whose all INativeFeatures match the routine.

The result can be incomplete: if a unique match was asked we stop the search as soon as we found two matches and report an incomplete result, see isComplete().

Parameters
uniqueMatchOnly if true the complete results are the ones for which there is only one matching signature
maximumConfidenceLevel if true the matching signatures -- if any -- will all be of the maximum possible level of confidence. For example, if two matching signatures have MEDIUM and one has LOW, only the first two will be kept in the results. Otherwise, all matching signatures are kept.
Returns
  • list of results, empty if none

public void removeAllFolders ()

Empties the list of scanned folders

public void removeAllPackages ()

Empties the list of available packages.

public void removeFolder (File folder, boolean doRescan)

Remove a folder from the list of folders to search for native signature packages.

Parameters
doRescan if true all registered folders are scanned for signature packages after the removal

public void rescan ()

Rescan registered folders to register/unregister native signature packages. Such package names end with SIGLIB_EXTENSION.

public void setActive (boolean isActive)

public void unloadPackages (INativeCodeAnalyzer<IInstruction> gca)

Unloads from memory the signatures packages used by the given analysis. Only the signatures storage specific to this analysis will be removed, i.e. if another analysis uses the same package it will be untouched.