/* Chrysalide - Outil d'analyse de fichiers binaires * header.c - annotation des en-têtes de binaires DEX * * Copyright (C) 2016 Cyrille Bagard * * This file is part of Chrysalide. * * Chrysalide is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * Chrysalide is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Foobar. If not, see . */ #include "header.h" #include #include #include #include /****************************************************************************** * * * Paramètres : format = description de l'exécutable à compléter. * * * * Description : Charge tous les symboles de l'en-tête DEX. * * * * Retour : Bilan de l'opération. * * * * Remarques : - * * * ******************************************************************************/ bool annotate_dex_header(GDexFormat *format) { GBinContent *content; /* Contenu binaire à lire */ SourceEndian endian; /* Boutisme utilisé */ vmpa2t pos; /* Tête de lecture des symboles*/ GArchInstruction *instr; /* Instruction décodée */ GArchOperand *operand; /* Opérande à venir modifier */ GDbComment *comment; /* Définition de commentaire */ GBinSymbol *symbol; /* Symbole à intégrer */ content = g_binary_format_get_content(G_BIN_FORMAT(format)); endian = SRE_LITTLE;//g_dex_format_get_endianness(format); if (!g_exe_format_translate_offset_into_vmpa(G_EXE_FORMAT(format), 0, &pos)) return false; /* magic */ instr = g_raw_instruction_new_array(content, MDS_8_BITS, DEX_FILE_MAGIC_LEN, &pos, endian); g_raw_instruction_mark_as_string(G_RAW_INSTRUCTION(instr), true); SET_IMM_DISPLAY(instr, operand, 0, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 1, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 2, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 3, IOD_HEX); SET_IMM_DISPLAY(instr, operand, 4, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 5, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 6, IOD_CHAR); SET_IMM_DISPLAY(instr, operand, 7, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("DEX magic number")); g_binary_symbol_define_as_block_start(symbol, true); /* checksum */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("adler32 checksum used to detect file corruption")); /* signature */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 5, &pos, endian); g_arch_instruction_set_displayed_max_length(instr, 4); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("SHA-1 signature used to uniquely identify files")); /* file_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Size of the entire file in bytes")); /* header_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Size of the header in bytes")); /* endian_tag */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Endianness tag ; 0x12345678 for little-endian")); /* link_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Size of the link section")); /* link_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the link section")); /* map_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the map item")); /* string_ids_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of strings in the string identifiers list")); /* string_ids_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the string identifiers list")); /* type_ids_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of elements in the type identifiers list")); /* type_ids_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the type identifiers list")); /* proto_ids_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of elements in the prototype identifiers list")); /* proto_ids_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the prototype identifiers list")); /* field_ids_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of elements in the field identifiers list")); /* field_ids_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the field identifiers list")); /* method_ids_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of elements in the method identifiers list")); /* method_ids_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the method identifiers list")); /* class_defs_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Count of elements in the class definitions list")); /* class_defs_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the class definitions list")); /* data_size */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Size of data section in bytes")); /* data_off */ instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); SET_IMM_DISPLAY(instr, operand, 0, IOD_HEX); ADD_RAW_AS_SYM(format, symbol, instr, comment, _("Offset to the start of the data section")); g_object_unref(G_OBJECT(content)); return true; }