java.lang.Object | |
↳ | com.pnfsoftware.jeb.core.units.code.asm.analyzer.AbstractAnalyzerExtension<InsnType extends com.pnfsoftware.jeb.core.units.code.IInstruction> |
Extension of the INativeCodeAnalyzer
.
Fields | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
protected INativeCodeAnalyzer<InsnType extends IInstruction> | gca | ||||||||||
protected BinaryPatternVerifier | paddingVerifier | ||||||||||
protected BinaryPatternVerifier | prologueVerifier |
Public Constructors | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
AbstractAnalyzerExtension() |
Public Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
ChainedOperationResult<Boolean> |
determinePotentialPointers(long address, InsnType insn, List<PointerDescription> values)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Integer> |
determineRoutineStackPointerDelta(CFG<InsnType> routine)
The default result (
getResult() ) is null. | ||||||||||
ChainedOperationResult<SwitchInformation> |
determineSwitchInformation(long branchInstructionAddress, IBasicBlockSkeleton<InsnType> branchInstructionBlock, List<IBasicBlockSkeleton<InsnType>> knownBlocks)
The default result (
getResult() ) is null. | ||||||||||
ChainedOperationResult<Long> |
getPossiblePaddingSize(long address, long addressMax)
Default implementation checks the patterns stored in
paddingVerifier . | ||||||||||
ChainedOperationResult<NativeDecompilationStage> |
getPreferredAdvancedAnalysisStage(INativeMethodItem routine)
Determine which
NativeDecompilationStage should be used by
INativeCodeAdvancedAnalyzer for the given routine. | ||||||||||
ChainedOperationResult<List<EntryPointDescription>> |
getProbableEntryPoints(long address, long addressMax)
Determine the likely entry points in the given memory area.
| ||||||||||
ChainedOperationResult<EntryPointDescription> |
getPrologueLooking(long address, long addressMax)
Default implementation checks the patterns stored in
prologueVerifier . | ||||||||||
void |
initialize(INativeCodeAnalyzer<InsnType> analyzer)
Must be called by the GCA.
| ||||||||||
ChainedOperationResult<Boolean> |
isCandidateSwitchDispatcher(long address, InsnType insn, List<InsnType> insns)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
isNonReturningRoutine(INativeMethodItem routine)
Determine if the given routine is non-returning.
| ||||||||||
ChainedOperationResult<? extends PointerDescription> |
isTrampolineToDynResRoutine(CFG<InsnType> routine)
The default result (
getResult() ) is null. | ||||||||||
ChainedOperationResult<Boolean> |
postprocessImage(int passIndex)
This method is called after an analysis pass was performed.
| ||||||||||
ChainedOperationResult<Boolean> |
preprocessImage(int passIndex)
This method is called before an analysis pass is performed.
| ||||||||||
ChainedOperationResult<Boolean> |
shouldForceRoutineEnd(long address, InsnType insn)
The default result (
getResult() ) is false. | ||||||||||
ChainedOperationResult<Boolean> |
sigMatchingPostProcess(int passIndex)
This method is called after signatures matching was performed.
| ||||||||||
void |
typeManagerInitialized(ITypeManager typeman)
The default implementation does nothing.
|
Protected Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
IBinaryPattern |
checkBinaryPattern(BinaryPatternVerifier verifier, long address, long addressMax)
Convenience method to check if a given binary pattern verifier matches at the start of the
given memory range.
| ||||||||||
void |
initializePaddingPatterns(BinaryPatternVerifier paddingVerifier)
The default implementation does nothing.
| ||||||||||
void |
initializeProloguePatterns(BinaryPatternVerifier prologueVerifier)
The default implementation does nothing.
|
[Expand]
Inherited Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
![]() | |||||||||||
![]() |
The default result (getResult()
) is false.
getResult()
; false to let the
code analyzer proceed with its own (generic) pointer discovery algorithm; true to
instruct it to skip it
The default result (getResult()
) is null.
getResult()
, null if the
routine failed to determine the stack pointer delta
The default result (getResult()
) is null.
SwitchInformation
in getResult()
(might be empty), null if the routine failed
Default implementation checks the patterns stored in paddingVerifier
. When alignment
information are present, only unaligned data is considered padding. If nothing is found,
result (getResult()
) is 0L.
address | address to be examined (inclusive) |
---|---|
addressMax | end address to be examined (exclusive) |
getResult()
; the size of the
padding-like area from address, 0L if it does not look like padding
Determine which NativeDecompilationStage
should be used by
INativeCodeAdvancedAnalyzer
for the given routine.
The default implementation returns SIMULATION_COMPLETED
Determine the likely entry points in the given memory area. It might provide several entry points (with different modes) ordered by their likelihood.
This method is not guaranteed to give the correct result, and should be considered an heuristic. It is intended to be used before the actual disassembly of code; it may provide a hint on the entry point to disassemble with.
getResult()
, ordered from the most probable
to the least probable. The list will be empty if none could be determined
Default implementation checks the patterns stored in prologueVerifier
. Can be
overridden, but sub-class should call super-method first. If nothing is found, result
(getResult()
) is null.
address | address to be examined (inclusive) |
---|---|
addressMax | end address to be examined (exclusive) |
EntryPointDescription
in
getResult()
if a prologue was found,
possibly at a different address than address parameter, null if no prologue was
found.
Must be called by the GCA. We cannot use @SerCustomInit here, as the GCA may not exist yet (eg, unprocessed unit).
The default result (getResult()
) is false.
address | address of the branching instruction |
---|---|
insn | branching instruction |
insns | list of all instructions in the current basic block |
getResult()
; true if the
instruction might correspond to a switch-like statement, false otherwise
Determine if the given routine is non-returning.
getResult()
; true if the
routine does not return, false otherwise, null when no determination could be made
The default result (getResult()
) is null.
PointerDescription
in getResult()
for the target, null if none
This method is called after an analysis pass was performed.
passIndex | 0-based analysis pass index |
---|
This method is called before an analysis pass is performed.
passIndex | 0-based analysis pass index |
---|
The default result (getResult()
) is false.
insn | parsed instruction at the provided address |
---|
getResult()
; true if the
address should be considered a routine termination, false otherwise
This method is called after signatures matching was performed.
passIndex | 0-based analysis pass index |
---|
Convenience method to check if a given binary pattern verifier matches at the start of the given memory range.
The default implementation does nothing.
The default implementation does nothing.