Create some modifiers and handle match properties inside ROST.

1 files changed, 238 insertions, 32 deletions

diff --git a/src/analysis/scan/matches/bytes.c b/src/analysis/scan/matches/bytes.c
index 90fa27d..043170e 100644
--- a/src/analysis/scan/matches/bytes.c
+++ b/src/analysis/scan/matches/bytes.c
@@ -24,10 +24,14 @@
 #include "bytes.h"
 
 
+#include <assert.h>
 #include <ctype.h>
+#include <stdio.h>
 
 
 #include "bytes-int.h"
+#include "../../../common/cpp.h"
+#include "../../../core/logs.h"
 
 
 
@@ -35,24 +39,27 @@
 
 
 /* Initialise la classe des correspondances de chaînes. */
-static void g_bytes_match_class_init(GBytesMatchClass *);
+static void g_scan_bytes_match_class_init(GScanBytesMatchClass *);
 
 /* Initialise une instance de correspondance de chaîne trouvée. */
-static void g_bytes_match_init(GBytesMatch *);
+static void g_scan_bytes_match_init(GScanBytesMatch *);
 
 /* Supprime toutes les références externes. */
-static void g_bytes_match_dispose(GBytesMatch *);
+static void g_scan_bytes_match_dispose(GScanBytesMatch *);
 
 /* Procède à la libération totale de la mémoire. */
-static void g_bytes_match_finalize(GBytesMatch *);
+static void g_scan_bytes_match_finalize(GScanBytesMatch *);
 
 
 
 /* --------------------- IMPLEMENTATION DES FONCTIONS DE CLASSE --------------------- */
 
 
-/* Affiche une correspondance sur la sortie standard. */
-static void g_bytes_match_display(const GBytesMatch *);
+/* Affiche une correspondance au format texte. */
+static void g_scan_bytes_match_output_to_text(const GScanBytesMatch *, int);
+
+/* Affiche une correspondance au format JSON. */
+static void g_scan_bytes_match_output_to_json(const GScanBytesMatch *, const sized_string_t *, unsigned int, int);
 
 
 
@@ -62,7 +69,7 @@ static void g_bytes_match_display(const GBytesMatch *);
 
 
 /* Indique le type défini pour un correspondance de chaîne identifiée. */
-G_DEFINE_TYPE(GBytesMatch, g_bytes_match, G_TYPE_SCAN_MATCH);
+G_DEFINE_TYPE(GScanBytesMatch, g_scan_bytes_match, G_TYPE_SCAN_MATCH);
 
 
 /******************************************************************************
@@ -77,19 +84,20 @@ G_DEFINE_TYPE(GBytesMatch, g_bytes_match, G_TYPE_SCAN_MATCH);
 *                                                                             *
 ******************************************************************************/
 
-static void g_bytes_match_class_init(GBytesMatchClass *klass)
+static void g_scan_bytes_match_class_init(GScanBytesMatchClass *klass)
 {
     GObjectClass *object;                   /* Autre version de la classe  */
     GScanMatchClass *match;                 /* Version parente de la classe*/
 
     object = G_OBJECT_CLASS(klass);
 
-    object->dispose = (GObjectFinalizeFunc/* ! */)g_bytes_match_dispose;
-    object->finalize = (GObjectFinalizeFunc)g_bytes_match_finalize;
+    object->dispose = (GObjectFinalizeFunc/* ! */)g_scan_bytes_match_dispose;
+    object->finalize = (GObjectFinalizeFunc)g_scan_bytes_match_finalize;
 
     match = G_SCAN_MATCH_CLASS(klass);
 
-    match->display = (display_scan_match_fc)g_bytes_match_display;
+    match->to_text = (output_scan_match_to_text_fc)g_scan_bytes_match_output_to_text;
+    match->to_json = (output_scan_match_to_json_fc)g_scan_bytes_match_output_to_json;
 
 }
 
@@ -106,7 +114,7 @@ static void g_bytes_match_class_init(GBytesMatchClass *klass)
 *                                                                             *
 ******************************************************************************/
 
-static void g_bytes_match_init(GBytesMatch *match)
+static void g_scan_bytes_match_init(GScanBytesMatch *match)
 {
     match->content = NULL;
 
@@ -128,11 +136,11 @@ static void g_bytes_match_init(GBytesMatch *match)
 *                                                                             *
 ******************************************************************************/
 
-static void g_bytes_match_dispose(GBytesMatch *match)
+static void g_scan_bytes_match_dispose(GScanBytesMatch *match)
 {
     g_clear_object(&match->content);
 
-    G_OBJECT_CLASS(g_bytes_match_parent_class)->dispose(G_OBJECT(match));
+    G_OBJECT_CLASS(g_scan_bytes_match_parent_class)->dispose(G_OBJECT(match));
 
 }
 
@@ -149,9 +157,9 @@ static void g_bytes_match_dispose(GBytesMatch *match)
 *                                                                             *
 ******************************************************************************/
 
-static void g_bytes_match_finalize(GBytesMatch *match)
+static void g_scan_bytes_match_finalize(GScanBytesMatch *match)
 {
-    G_OBJECT_CLASS(g_bytes_match_parent_class)->finalize(G_OBJECT(match));
+    G_OBJECT_CLASS(g_scan_bytes_match_parent_class)->finalize(G_OBJECT(match));
 
 }
 
@@ -171,13 +179,13 @@ static void g_bytes_match_finalize(GBytesMatch *match)
 *                                                                             *
 ******************************************************************************/
 
-GScanMatch *g_bytes_match_new(GSearchPattern *source, GBinContent *content, phys_t start, phys_t len)
+GScanMatch *g_scan_bytes_match_new(GSearchPattern *source, GBinContent *content, phys_t start, phys_t len)
 {
     GScanMatch *result;                     /* Structure à retourner       */
 
-    result = g_object_new(G_TYPE_BYTES_MATCH, NULL);
+    result = g_object_new(G_TYPE_SCAN_BYTES_MATCH, NULL);
 
-    if (!g_bytes_match_create(G_BYTES_MATCH(result), source, content, start, len))
+    if (!g_scan_bytes_match_create(G_SCAN_BYTES_MATCH(result), source, content, start, len))
         g_clear_object(&result);
 
     return result;
@@ -201,7 +209,7 @@ GScanMatch *g_bytes_match_new(GSearchPattern *source, GBinContent *content, phys
 *                                                                             *
 ******************************************************************************/
 
-bool g_bytes_match_create(GBytesMatch *match, GSearchPattern *source, GBinContent *content, phys_t start, phys_t len)
+bool g_scan_bytes_match_create(GScanBytesMatch *match, GSearchPattern *source, GBinContent *content, phys_t start, phys_t len)
 {
     bool result;                            /* Bilan à retourner           */
     GScanMatch *base;                       /* Lien vers les infos de base */
@@ -224,6 +232,58 @@ bool g_bytes_match_create(GBytesMatch *match, GSearchPattern *source, GBinConten
 }
 
 
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : match = informations de correspondance à consulter.          *
+*                                                                             *
+*  Description : Fournit une référence au contenu lié à la correspondance.    *
+*                                                                             *
+*  Retour      : Content binaire associé au context.                          *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+GBinContent *g_scan_bytes_match_get_content(const GScanBytesMatch *match)
+{
+    GBinContent *result;                    /* Instance à retourner        */
+
+    result = match->content;
+
+    g_object_ref(G_OBJECT(result));
+
+    return result;
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : match = informations de correspondance à consulter.          *
+*                start = position de départ d'un motif détecté. [OUT]         *
+*                end   = position d'arrivée d'un motif détecté. [OUT]         *
+*                                                                             *
+*  Description : Indique la localisation d'une correspondance établie.        *
+*                                                                             *
+*  Retour      : Taille mesurée de la correspondance.                         *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+phys_t g_scan_bytes_match_get_location(const GScanBytesMatch *match, phys_t *start, phys_t *end)
+{
+    phys_t result;                          /* Taille à retourner          */
+
+    result = match->len;
+
+    *start = match->start;
+    *end = match->start + result;
+
+    return result;
+
+}
+
 
 /* ---------------------------------------------------------------------------------- */
 /*                       IMPLEMENTATION DES FONCTIONS DE CLASSE                       */
@@ -233,8 +293,9 @@ bool g_bytes_match_create(GBytesMatch *match, GSearchPattern *source, GBinConten
 /******************************************************************************
 *                                                                             *
 *  Paramètres  : match = définition de correspondance à manipuler.            *
+*                fd    = canal d'écriture.                                    *
 *                                                                             *
-*  Description : Affiche une correspondance sur la sortie standard.           *
+*  Description : Affiche une correspondance au format texte.                  *
 *                                                                             *
 *  Retour      : -                                                            *
 *                                                                             *
@@ -242,15 +303,34 @@ bool g_bytes_match_create(GBytesMatch *match, GSearchPattern *source, GBinConten
 *                                                                             *
 ******************************************************************************/
 
-static void g_bytes_match_display(const GBytesMatch *match)
+static void g_scan_bytes_match_output_to_text(const GScanBytesMatch *match, int fd)
 {
+    char value[2 + ULLONG_MAXLEN];          /* Impression de la position   */
+    int ret;                                /* Bilan d'une conversion      */
     GScanMatch *base;                       /* Lien vers les infos de base */
     const char *name;                       /* Désignation du motif ciblé  */
     vmpa2t pos;                             /* Tête de lecture             */
     const bin_t *data;                      /* Accès aux données brutes    */
-    phys_t i;                               /* Boucle de parcours          */
+    phys_t k;                               /* Boucle de parcours #2       */
+
+    /* Position dans le binaire (hexadécimal) */
+
+    ret = snprintf(value, ULLONG_MAXLEN, "0x%llx", (unsigned long long)match->start);
+
+    if (ret > 0)
+        write(fd, value, ret);
 
-    /* Affichage d'un repère */
+    else
+    {
+        log_simple_message(LMT_EXT_ERROR, "Error while converting offset to hex!");
+        write(fd, "\"<error>\"", 9);
+    }
+
+    write(fd, ":", 1);
+
+    /* Affichage de la désignation */
+
+    write(fd, "$", 1);
 
     base = G_SCAN_MATCH(match);
 
@@ -262,25 +342,151 @@ static void g_bytes_match_display(const GBytesMatch *match)
      * Cette absence de nom est supportée ici.
      */
 
-    if (name == NULL)
-        name = "";
+    if (name != NULL)
+        write(fd, name, strlen(name));
+
+    write(fd, ": ", 2);
+
+    /* Affichage du contenu */
+
+    init_vmpa(&pos, match->start, VMPA_NO_VIRTUAL);
+
+    data = g_binary_content_get_raw_access(match->content, &pos, match->len);
+
+    for (k = 0; k < match->len; k++)
+    {
+        if (isprint(data[k]))
+            write(fd, &data[k], 1);
+
+        else
+        {
+            write(fd, "\\x", 2);
+
+            ret = snprintf(value, ULLONG_MAXLEN, "%02hhx", data[k]);
+
+            if (ret > 0)
+            {
+                assert(ret == 2);
+                write(fd, value, ret);
+            }
+
+            else
+            {
+                log_simple_message(LMT_EXT_ERROR, "Error while converting data!");
+                write(fd, "??", 2);
+            }
+
+        }
+
+    }
+
+    write(fd, "\n", 1);
+
+}
+
+
+/******************************************************************************
+*                                                                             *
+*  Paramètres  : match   = définition de correspondance à manipuler.          *
+*                padding = éventuel bourrage initial à placer ou NULL.        *
+*                level   = profondeur actuelle.                               *
+*                fd      = canal d'écriture.                                  *
+*                                                                             *
+*  Description : Affiche une correspondance au format JSON.                   *
+*                                                                             *
+*  Retour      : -                                                            *
+*                                                                             *
+*  Remarques   : -                                                            *
+*                                                                             *
+******************************************************************************/
+
+static void g_scan_bytes_match_output_to_json(const GScanBytesMatch *match, const sized_string_t *padding, unsigned int level, int fd)
+{
+    unsigned int i;                         /* Boucle de parcours #1       */
+    vmpa2t pos;                             /* Tête de lecture             */
+    char value[4 + ULLONG_MAXLEN];          /* Impression de la position   */
+    int ret;                                /* Bilan d'une conversion      */
+    const bin_t *data;                      /* Accès aux données brutes    */
+    phys_t k;                               /* Boucle de parcours #2       */
+
+    /* Position dans le binaire (décimal) */
+
+    for (i = 0; i < level; i++)
+        write(fd, padding->data, padding->len);
+
+    write(fd, "\"offset\": ", 10);
+
+    ret = snprintf(value, ULLONG_MAXLEN, "%llu", (unsigned long long)match->start);
+
+    if (ret > 0)
+        write(fd, value, ret);
+
+    else
+    {
+        log_simple_message(LMT_EXT_ERROR, "Error while converting offset!");
+        write(fd, "null", 4);
+    }
+
+    write(fd, ",\n", 2);
+
+    /* Position dans le binaire (hexadécimal) */
+
+    for (i = 0; i < level; i++)
+        write(fd, padding->data, padding->len);
+
+    write(fd, "\"offset_hex\": ", 14);
 
-    printf("0x%llx:$%s: ", (unsigned long long)match->start, name);
+    ret = snprintf(value, ULLONG_MAXLEN, "\"0x%llx\"", (unsigned long long)match->start);
+
+    if (ret > 0)
+        write(fd, value, ret);
+
+    else
+    {
+        log_simple_message(LMT_EXT_ERROR, "Error while converting offset to hex!");
+        write(fd, "null", 4);
+    }
+
+    write(fd, ",\n", 2);
 
     /* Affichage du contenu */
 
+    for (i = 0; i < level; i++)
+        write(fd, padding->data, padding->len);
+
+    write(fd, "\"content\": \"", 12);
+
     init_vmpa(&pos, match->start, VMPA_NO_VIRTUAL);
 
     data = g_binary_content_get_raw_access(match->content, &pos, match->len);
 
-    for (i = 0; i < match->len; i++)
+    for (k = 0; k < match->len; k++)
     {
-        if (isprint(data[i]))
-            printf("%c", data[i]);
+        if (isprint(data[k]))
+            write(fd, &data[k], 1);
+
         else
-            printf("\\x%02hhx", data[i]);
+        {
+            write(fd, "\\x", 2);
+
+            ret = snprintf(value, ULLONG_MAXLEN, "%02hhx", data[k]);
+
+            if (ret > 0)
+            {
+                assert(ret == 2);
+                write(fd, value, ret);
+            }
+
+            else
+            {
+                log_simple_message(LMT_EXT_ERROR, "Error while converting data!");
+                write(fd, "??", 2);
+            }
+
+        }
+
     }
 
-    printf("\n");
+    write(fd, "\"\n", 2);
 
 }