def scan_virtual_function(self, index):
     if Helper.is_imported_ea(self.virtual_functions[index].address):
         print "[INFO] Ignoring import function at 0x{0:08X}".format(
             self.address)
         return
     try:
         function = idaapi.decompile(self.virtual_functions[index].address)
     except idaapi.DecompilationFailure:
         print "[ERROR] Failed to decompile function at 0x{0:08X}".format(
             self.address)
         return
     if Helper.FunctionTouchVisitor(function).process():
         function = idaapi.decompile(self.virtual_functions[index].address)
     if function.arguments and function.arguments[
             0].is_arg_var and Helper.is_legal_type(
                 function.arguments[0].tif):
         print "[Info] Scanning virtual function at 0x{0:08X}".format(
             function.entry_ea)
         # TODO: Remove usage `temporary_structure' as global
         obj = Api.VariableObject(function.get_lvars()[0], 0)
         scanner = VariableScanner.NewDeepSearchVisitor(
             function, self.offset, obj, Cache.temporary_structure)
         scanner.process()
     else:
         print "[Warning] Bad type of first argument in virtual function at 0x{0:08X}".format(
             function.entry_ea)
예제 #2
0
    def _get_member(self, offset, cexpr, obj, tinfo=None, obj_ea=None):
        if offset < 0:
            logger.error(
                "Considered to be imposible: offset - {}, obj - {}".format(
                    offset, Helper.to_hex(self._find_asm_address(cexpr))))
            raise AssertionError

        applicable = not self.crippled
        cexpr_ea = self._find_asm_address(cexpr)
        scan_obj = ScannedObject.create(obj, cexpr_ea, self.__origin,
                                        applicable)
        if obj_ea:
            if TemporaryStructure.VirtualTable.check_address(obj_ea):
                return TemporaryStructure.VirtualTable(offset, obj_ea,
                                                       scan_obj, self.__origin)
            if Helper.is_code_ea(obj_ea):
                cfunc = Api.decompile_function(obj_ea)
                if cfunc:
                    tinfo = cfunc.type
                    tinfo.create_ptr(tinfo)
                else:
                    tinfo = Const.DUMMY_FUNC
                return TemporaryStructure.Member(offset, tinfo, scan_obj,
                                                 self.__origin)
            # logger.warn("Want to see this ea - {},".format(Helper.to_hex(cexpr_ea)))

        if not tinfo or tinfo.equals_to(Const.VOID_TINFO) or tinfo.equals_to(
                Const.CONST_VOID_TINFO):
            return TemporaryStructure.VoidMember(offset, scan_obj,
                                                 self.__origin)

        if tinfo.equals_to(Const.CHAR_TINFO):
            return TemporaryStructure.VoidMember(offset,
                                                 scan_obj,
                                                 self.__origin,
                                                 char=True)

        if tinfo.equals_to(Const.CONST_PCHAR_TINFO):
            tinfo = Const.PCHAR_TINFO
        elif tinfo.equals_to(Const.CONST_PVOID_TINFO):
            tinfo = Const.PVOID_TINFO
        else:
            tinfo.clr_const()
        return TemporaryStructure.Member(offset, tinfo, scan_obj,
                                         self.__origin)
예제 #3
0
 def __iter_callers(self):
     for ea in self.__callers_ea:
         cfunc = Api.decompile_function(ea)
         if cfunc:
             yield cfunc