diff options
author | Cyrille Bagard <nocbos@gmail.com> | 2011-12-23 15:49:56 (GMT) |
---|---|---|
committer | Cyrille Bagard <nocbos@gmail.com> | 2011-12-23 15:49:56 (GMT) |
commit | 55c034aa3d975320dbaa7e643e68289732386eec (patch) | |
tree | 2011c2a619197eb8e17b5cbb2a3fe4dd35986e6b /src/arch/dalvik/pseudo | |
parent | a6f7f152b62dd79ec492c0b3f51a2b5d19732d27 (diff) |
Decoded Dalvik pseudo-instructions properly.
git-svn-id: svn://svn.gna.org/svn/chrysalide/trunk@216 abbe820e-26c8-41b2-8c08-b7b2b41f8b0a
Diffstat (limited to 'src/arch/dalvik/pseudo')
-rw-r--r-- | src/arch/dalvik/pseudo/Makefile.am | 17 | ||||
-rw-r--r-- | src/arch/dalvik/pseudo/fill.c | 214 | ||||
-rw-r--r-- | src/arch/dalvik/pseudo/fill.h | 57 | ||||
-rw-r--r-- | src/arch/dalvik/pseudo/switch.c | 217 | ||||
-rw-r--r-- | src/arch/dalvik/pseudo/switch.h | 57 |
5 files changed, 562 insertions, 0 deletions
diff --git a/src/arch/dalvik/pseudo/Makefile.am b/src/arch/dalvik/pseudo/Makefile.am new file mode 100644 index 0000000..05e361f --- /dev/null +++ b/src/arch/dalvik/pseudo/Makefile.am @@ -0,0 +1,17 @@ + +noinst_LTLIBRARIES = libarchdalvikpseudo.la + +libarchdalvikpseudo_la_SOURCES = \ + fill.h fill.c \ + switch.h switch.c + +libarchdalvikpseudo_la_LIBADD = + +libarchdalvikpseudo_la_CFLAGS = $(AM_CFLAGS) + + +INCLUDES = $(LIBGTK_CFLAGS) $(LIBXML_CFLAGS) + +AM_CPPFLAGS = + +AM_CFLAGS = $(DEBUG_CFLAGS) $(WARNING_FLAGS) $(COMPLIANCE_FLAGS) diff --git a/src/arch/dalvik/pseudo/fill.c b/src/arch/dalvik/pseudo/fill.c new file mode 100644 index 0000000..9573000 --- /dev/null +++ b/src/arch/dalvik/pseudo/fill.c @@ -0,0 +1,214 @@ + +/* OpenIDA - Outil d'analyse de fichiers binaires + * fill.c - prise en charge de l'instruction spéciale fill-array-data + * + * Copyright (C) 2011 Cyrille Bagard + * + * This file is part of OpenIDA. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "fill.h" + + +#include <string.h> + + +#include "../instruction-int.h" + + + +/* Définition générique d'une instruction d'architecture Dalvik (instance) */ +struct _GDalvikFillInstr +{ + GDalvikInstruction parent; /* A laisser en premier */ + + uint16_t array_width; /* Taille des éléments */ + uint32_t array_size; /* Taille du tableau */ + +}; + +/* Définition générique d'une instruction d'architecture Dalvik (classe) */ +struct _GDalvikFillInstrClass +{ + GDalvikInstructionClass parent; /* A laisser en premier */ + +}; + + + +/* Initialise la classe générique des instructions. */ +static void g_dalvik_fill_instr_class_init(GDalvikFillInstrClass *); + +/* Initialise une instance d'opérande d'architecture. */ +static void g_dalvik_fill_instr_init(GDalvikFillInstr *); + +/* Ajoute à un tampon GLib le contenu de l'instance spécifiée. */ +static void g_dalvik_fill_instr_print(const GDalvikFillInstr *, GCodeBuffer *, MemoryDataSize, const bin_t *, AsmSyntax); + + + +/* Indique le type défini pour une pseudo-instruction Dalvik de remplissage. */ +G_DEFINE_TYPE(GDalvikFillInstr, g_dalvik_fill_instr, G_TYPE_DALVIK_INSTRUCTION); + + +/****************************************************************************** +* * +* Paramètres : klass = classe à initialiser. * +* * +* Description : Initialise la classe générique des instructions. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_fill_instr_class_init(GDalvikFillInstrClass *klass) +{ + +} + + +/****************************************************************************** +* * +* Paramètres : instr = instance à initialiser. * +* * +* Description : Initialise une instance d'instruction d'architecture. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_fill_instr_init(GDalvikFillInstr *instr) +{ + GArchInstruction *parent; /* Instance parente */ + + parent = G_ARCH_INSTRUCTION(instr); + + parent->print = (print_instruction_fc)g_dalvik_fill_instr_print; + +} + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* addr = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * +* Description : Crée une pesudo-instruction Dalvik de remplissage. * +* * +* Retour : Instruction mise en place. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GArchInstruction *g_dalvik_fill_instr_new(const bin_t *data, off_t *pos, off_t len, vmpa_t addr, const GDalvikProcessor *proc) +{ + GDalvikFillInstr *result; /* Structure à retourner */ + uint16_t ident; /* Valeur lue dans le code */ + + result = g_object_new(G_TYPE_DALVIK_FILL_INSTR, NULL); + + if (!read_u16(&ident, data, pos, len, SRE_LITTLE)) + goto gdfin_bad; + + G_DALVIK_INSTRUCTION(result)->ptype = DPO_FILL_ARRAY_DATA; + + if (!read_u16(&result->array_width, data, pos, len, SRE_LITTLE)) + goto gdfin_bad; + if (!read_u32(&result->array_size, data, pos, len, SRE_LITTLE)) + goto gdfin_bad; + + *pos += result->array_width * result->array_size; + + return G_ARCH_INSTRUCTION(result); + + gdfin_bad: + + g_object_unref(result); + + return NULL; + +} + + +/****************************************************************************** +* * +* Paramètres : instr = instruction d'assemblage à représenter. * +* buffer = espace où placer ledit contenu. * +* syntax = type de représentation demandée. * +* * +* Description : Ajoute à un tampon GLib le contenu de l'instance spécifiée. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_fill_instr_print(const GDalvikFillInstr *instr, GCodeBuffer *buffer, MemoryDataSize msize, const bin_t *content, AsmSyntax syntax) +{ + GArchInstruction *base; /* Version basique de l'objet */ + GBufferLine *line; /* Ligne de destination */ + char address[VMPA_MAX_SIZE]; /* Adresse au format texte */ + size_t len; /* Taille de l'élément inséré */ + char *bin_code; /* Tampon du code binaire */ + off_t i; /* Boucle de parcours */ + const char *key; /* Mot clef principal */ + size_t klen; /* Taille de ce mot clef */ + + base = G_ARCH_INSTRUCTION(instr); + + line = g_code_buffer_append_new_line(buffer); + + /* Adresse virtuelle ou physique */ + + len = vmpa_to_string(base->address, msize, address); + + g_buffer_line_insert_text(line, BLC_ADDRESS, address, len, RTT_RAW); + + /* Code brut */ + + bin_code = (char *)calloc(3 * 3 + 3, sizeof(char)); + + for (i = 0; i < 3; i++) + { + if ((i + 1) < 3) + snprintf(&bin_code[i * (2 + 1)], 4, "%02hhx ", content[base->offset + i]); + else + snprintf(&bin_code[i * (2 + 1)], 6, "%02hhx...", content[base->offset + i]); + } + + g_buffer_line_insert_text(line, BLC_BINARY, + bin_code, 3 * 3 + 2, RTT_RAW_CODE); + + free(bin_code); + + /* Instruction proprement dite */ + + key = "<fill-array>"; + klen = strlen(key); + + g_buffer_line_insert_text(line, BLC_ASSEMBLY_HEAD, key, klen, RTT_INSTRUCTION); + +} diff --git a/src/arch/dalvik/pseudo/fill.h b/src/arch/dalvik/pseudo/fill.h new file mode 100644 index 0000000..058e67b --- /dev/null +++ b/src/arch/dalvik/pseudo/fill.h @@ -0,0 +1,57 @@ + +/* OpenIDA - Outil d'analyse de fichiers binaires + * fill.h - prototypes pour la prise en charge de l'instruction spéciale fill-array-data + * + * Copyright (C) 2011 Cyrille Bagard + * + * This file is part of OpenIDA. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _ARCH_DALVIK_PSEUDO_FILL_H +#define _ARCH_DALVIK_PSEUDO_FILL_H + + +#include "../instruction.h" +#include "../processor.h" + + +#include <glib-object.h> + + + +#define G_TYPE_DALVIK_FILL_INSTR g_dalvik_fill_instr_get_type() +#define G_DALVIK_FILL_INSTR(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), g_dalvik_fill_instr_get_type(), GDalvikFillInstr)) +#define G_IS_DALVIK_FILL_INSTR(obj) (G_TYPE_CHECK_INSTANCE_TYPE((obj), g_dalvik_fill_instr_get_type())) +#define G_DALVIK_FILL_INSTR_GET_IFACE(inst) (G_TYPE_INSTANCE_GET_INTERFACE((inst), g_dalvik_fill_instr_get_type(), GDalvikFillInstrIface)) + + +/* Définition générique d'une instruction d'architecture (instance) */ +typedef struct _GDalvikFillInstr GDalvikFillInstr; + +/* Définition générique d'une instruction d'architecture (classe) */ +typedef struct _GDalvikFillInstrClass GDalvikFillInstrClass; + + +/* Indique le type défini pour une pseudo-instruction Dalvik de remplissage. */ +GType g_dalvik_fill_instr_get_type(void); + +/* Crée une pesudo-instruction Dalvik de remplissage. */ +GArchInstruction *g_dalvik_fill_instr_new(const bin_t *, off_t *, off_t, vmpa_t, const GDalvikProcessor *); + + + +#endif /* _ARCH_DALVIK_PSEUDO_FILL_H */ diff --git a/src/arch/dalvik/pseudo/switch.c b/src/arch/dalvik/pseudo/switch.c new file mode 100644 index 0000000..30511ac --- /dev/null +++ b/src/arch/dalvik/pseudo/switch.c @@ -0,0 +1,217 @@ + +/* OpenIDA - Outil d'analyse de fichiers binaires + * switch.c - prise en charge des instructions spéciales (packed|sparse)switch + * + * Copyright (C) 2011 Cyrille Bagard + * + * This file is part of OpenIDA. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "switch.h" + + +#include <string.h> + + +#include "../instruction-int.h" + + + +/* Définition générique d'une instruction d'architecture Dalvik (instance) */ +struct _GDalvikSwitchInstr +{ + GDalvikInstruction parent; /* A laisser en premier */ + + uint16_t switch_size; /* Taille du switch considéré */ + +}; + +/* Définition générique d'une instruction d'architecture Dalvik (classe) */ +struct _GDalvikSwitchInstrClass +{ + GDalvikInstructionClass parent; /* A laisser en premier */ + +}; + + + +/* Initialise la classe générique des instructions. */ +static void g_dalvik_switch_instr_class_init(GDalvikSwitchInstrClass *); + +/* Initialise une instance d'opérande d'architecture. */ +static void g_dalvik_switch_instr_init(GDalvikSwitchInstr *); + +/* Ajoute à un tampon GLib le contenu de l'instance spécifiée. */ +static void g_dalvik_switch_instr_print(const GDalvikSwitchInstr *, GCodeBuffer *, MemoryDataSize, const bin_t *, AsmSyntax); + + + +/* Indique le type défini pour une pseudo-instruction Dalvik de remplissage. */ +G_DEFINE_TYPE(GDalvikSwitchInstr, g_dalvik_switch_instr, G_TYPE_DALVIK_INSTRUCTION); + + +/****************************************************************************** +* * +* Paramètres : klass = classe à initialiser. * +* * +* Description : Initialise la classe générique des instructions. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_switch_instr_class_init(GDalvikSwitchInstrClass *klass) +{ + +} + + +/****************************************************************************** +* * +* Paramètres : instr = instance à initialiser. * +* * +* Description : Initialise une instance d'instruction d'architecture. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_switch_instr_init(GDalvikSwitchInstr *instr) +{ + GArchInstruction *parent; /* Instance parente */ + + parent = G_ARCH_INSTRUCTION(instr); + + parent->print = (print_instruction_fc)g_dalvik_switch_instr_print; + +} + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* addr = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * +* Description : Crée une pesudo-instruction Dalvik de branchement. * +* * +* Retour : Instruction mise en place. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GArchInstruction *g_dalvik_switch_instr_new(const bin_t *data, off_t *pos, off_t len, vmpa_t addr, const GDalvikProcessor *proc) +{ + GDalvikSwitchInstr *result; /* Structure à retourner */ + uint16_t ident; /* Valeur lue dans le code */ + + result = g_object_new(G_TYPE_DALVIK_SWITCH_INSTR, NULL); + + if (!read_u16(&ident, data, pos, len, SRE_LITTLE)) + goto gdsin_bad; + + if (ident != DPO_PACKED_SWITCH && ident != DPO_SPARSE_SWITCH) + goto gdsin_bad; + + G_DALVIK_INSTRUCTION(result)->ptype = ident; + + if (!read_u16(&result->switch_size, data, pos, len, SRE_LITTLE)) + goto gdsin_bad; + + if (ident != DPO_PACKED_SWITCH) + *pos += (1 + result->switch_size) * sizeof(uint32_t); + else + *pos += (2 * result->switch_size) * sizeof(uint32_t); + + return G_ARCH_INSTRUCTION(result); + + gdsin_bad: + + g_object_unref(result); + + return NULL; + +} + + +/****************************************************************************** +* * +* Paramètres : instr = instruction d'assemblage à représenter. * +* buffer = espace où placer ledit contenu. * +* syntax = type de représentation demandée. * +* * +* Description : Ajoute à un tampon GLib le contenu de l'instance spécifiée. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_switch_instr_print(const GDalvikSwitchInstr *instr, GCodeBuffer *buffer, MemoryDataSize msize, const bin_t *content, AsmSyntax syntax) +{ + GArchInstruction *base; /* Version basique de l'objet */ + GBufferLine *line; /* Ligne de destination */ + char address[VMPA_MAX_SIZE]; /* Adresse au format texte */ + size_t len; /* Taille de l'élément inséré */ + char *bin_code; /* Tampon du code binaire */ + off_t i; /* Boucle de parcours */ + const char *key; /* Mot clef principal */ + size_t klen; /* Taille de ce mot clef */ + + base = G_ARCH_INSTRUCTION(instr); + + line = g_code_buffer_append_new_line(buffer); + + /* Adresse virtuelle ou physique */ + + len = vmpa_to_string(base->address, msize, address); + + g_buffer_line_insert_text(line, BLC_ADDRESS, address, len, RTT_RAW); + + /* Code brut */ + + bin_code = (char *)calloc(3 * 3 + 3, sizeof(char)); + + for (i = 0; i < 3; i++) + { + if ((i + 1) < 3) + snprintf(&bin_code[i * (2 + 1)], 4, "%02hhx ", content[base->offset + i]); + else + snprintf(&bin_code[i * (2 + 1)], 6, "%02hhx...", content[base->offset + i]); + } + + g_buffer_line_insert_text(line, BLC_BINARY, + bin_code, 3 * 3 + 2, RTT_RAW_CODE); + + free(bin_code); + + /* Instruction proprement dite */ + + key = "<fill-array>"; + klen = strlen(key); + + g_buffer_line_insert_text(line, BLC_ASSEMBLY_HEAD, key, klen, RTT_INSTRUCTION); + +} diff --git a/src/arch/dalvik/pseudo/switch.h b/src/arch/dalvik/pseudo/switch.h new file mode 100644 index 0000000..602af48 --- /dev/null +++ b/src/arch/dalvik/pseudo/switch.h @@ -0,0 +1,57 @@ + +/* OpenIDA - Outil d'analyse de fichiers binaires + * switch.h - prototypes pour la prise en charge des instructions spéciales (packed|sparse)switch + * + * Copyright (C) 2011 Cyrille Bagard + * + * This file is part of OpenIDA. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _ARCH_DALVIK_PSEUDO_SWITCH_H +#define _ARCH_DALVIK_PSEUDO_SWITCH_H + + +#include "../instruction.h" +#include "../processor.h" + + +#include <glib-object.h> + + + +#define G_TYPE_DALVIK_SWITCH_INSTR g_dalvik_switch_instr_get_type() +#define G_DALVIK_SWITCH_INSTR(obj) (G_TYPE_CHECK_INSTANCE_CAST((obj), g_dalvik_switch_instr_get_type(), GDalvikSwitchInstr)) +#define G_IS_DALVIK_SWITCH_INSTR(obj) (G_TYPE_CHECK_INSTANCE_TYPE((obj), g_dalvik_switch_instr_get_type())) +#define G_DALVIK_SWITCH_INSTR_GET_IFACE(inst) (G_TYPE_INSTANCE_GET_INTERFACE((inst), g_dalvik_switch_instr_get_type(), GDalvikSwitchInstrIface)) + + +/* Définition générique d'une instruction d'architecture (instance) */ +typedef struct _GDalvikSwitchInstr GDalvikSwitchInstr; + +/* Définition générique d'une instruction d'architecture (classe) */ +typedef struct _GDalvikSwitchInstrClass GDalvikSwitchInstrClass; + + +/* Indique le type défini pour une pseudo-instruction Dalvik de remplissage. */ +GType g_dalvik_switch_instr_get_type(void); + +/* Crée une pesudo-instruction Dalvik de branchement. */ +GArchInstruction *g_dalvik_switch_instr_new(const bin_t *, off_t *, off_t, vmpa_t, const GDalvikProcessor *); + + + +#endif /* _ARCH_DALVIK_PSEUDO_SWITCH_H */ |