/* Chrysalide - Outil d'analyse de fichiers binaires
* header.c - annotation des en-têtes de binaires DEX
*
* Copyright (C) 2016 Cyrille Bagard
*
* This file is part of Chrysalide.
*
* OpenIDA is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* OpenIDA is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Foobar. If not, see .
*/
#include "header.h"
#include
#include
#include
#include
/******************************************************************************
* *
* Paramètres : format = description de l'exécutable à compléter. *
* *
* Description : Charge tous les symboles de l'en-tête DEX. *
* *
* Retour : Bilan de l'opération. *
* *
* Remarques : - *
* *
******************************************************************************/
bool annotate_dex_header(GDexFormat *format)
{
GBinContent *content; /* Contenu binaire à lire */
SourceEndian endian; /* Boutisme utilisé */
vmpa2t pos; /* Tête de lecture des symboles*/
vmpa2t start; /* Localisation des symboles */
GArchInstruction *instr; /* Instruction décodée */
GArchOperand *operand; /* Opérande à venir modifier */
GDbComment *comment; /* Définition de commentaire */
GBinSymbol *symbol; /* Symbole à intégrer */
content = g_binary_format_get_content(G_BIN_FORMAT(format));
endian = SRE_LITTLE;//g_dex_format_get_endianness(format);
if (!g_exe_format_translate_offset_into_vmpa(G_EXE_FORMAT(format), 0, &pos))
return false;
/* magic */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_8_BITS, DEX_FILE_MAGIC_LEN, &pos, endian);
g_raw_instruction_mark_as_string(G_RAW_INSTRUCTION(instr), true);
SET_IMM_DISPLAY(instr, operand, 0, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 1, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 2, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 3, IOD_HEX);
SET_IMM_DISPLAY(instr, operand, 4, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 5, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 6, IOD_CHAR);
SET_IMM_DISPLAY(instr, operand, 7, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("DEX magic number"));
g_binary_symbol_define_as_block_start(symbol, true);
/* checksum */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("adler32 checksum used to detect file corruption"));
/* signature */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 5, &pos, endian);
g_arch_instruction_set_displayed_max_length(instr, 4);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("SHA-1 signature used to uniquely identify files"));
/* file_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Size of the entire file in bytes"));
/* header_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Size of the header in bytes"));
/* endian_tag */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Endianness tag ; 0x12345678 for little-endian"));
/* link_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Size of the link section"));
/* link_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the link section"));
/* map_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the map item"));
/* string_ids_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of strings in the string identifiers list"));
/* string_ids_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the string identifiers list"));
/* type_ids_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of elements in the type identifiers list"));
/* type_ids_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the type identifiers list"));
/* proto_ids_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of elements in the prototype identifiers list"));
/* proto_ids_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the prototype identifiers list"));
/* field_ids_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of elements in the field identifiers list"));
/* field_ids_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the field identifiers list"));
/* method_ids_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of elements in the method identifiers list"));
/* method_ids_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the method identifiers list"));
/* class_defs_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Count of elements in the class definitions list"));
/* class_defs_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the class definitions list"));
/* data_size */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Size of data section in bytes"));
/* data_off */
copy_vmpa(&start, &pos);
instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian);
SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX);
ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Offset to the start of the data section"));
g_object_unref(G_OBJECT(content));
return true;
}