Package IDAscope :: Package idascope :: Package core :: Module SemanticIdentifier :: Class SemanticIdentifier
[hide private]
[frames] | no frames]

Class SemanticIdentifier

source code

A module to analyze and explore an IDB for semantics. For a set of API names, references to these are identified and used for creating context and allowing tagging of them.

Instance Methods [hide private]
 
__init__(self, config_filename) source code
 
load_config(self, config_filename)
Loads a semantic configuration file and collects all definitions from it.
source code
 
calculate_number_of_basic_blocks_for_function_address(self, function_address)
Calculates the number of basic blocks for a given function by walking its FlowChart.
source code
 
get_number_of_basic_blocks_for_function_address(self, address)
returns the number of basic blocks for the function containing the queried address, based on the value stored in the last scan result.
source code
 
scan(self)
Scan the whole IDB with all available techniques.
source code
 
scan_by_references(self)
Scan by references to API names, based on the definitions loaded from the config file.
source code
 
scan_all_code(self)
Not implemented yet.
source code
 
get_function_address_for_address(self, address)
Get a function address containing the queried address.
source code
 
calculate_number_of_functions(self)
Calculate the number of functions in all segments.
source code
 
get_identified_function_addresses(self)
Get all function address that have been covered by the last scanning.
source code
 
get_identified_dummy_function_addresses(self)
Get all function address with a dummy name that have been covered by the last scanning.
source code
 
get_tags(self)
Get all the tags that have been covered by the last scanning.
source code
 
get_tags_for_function_address(self, address)
Get all tags found for the function containing the queried address.
source code
 
get_tag_count_for_function_address(self, tag, address)
Get the number of occurrences for a certain tag for the function containing the queried address.
source code
 
get_tagged_apis_for_function_address(self, address)
Get all call contexts for the function containing the queried address.
source code
 
get_address_tag_pairs_ordered_by_function(self)
Get all call contexts for all functions
source code
 
get_functions_to_rename(self)
Get all functions that can be renamed according to the last scan result.
source code
 
rename_functions(self)
Perform the renaming of functions according to the last scan result.
source code
 
rename_potential_wrapper_functions(self) source code
 
get_parameters_for_call_address(self, call_address)
Get the parameters for the given address of a function call.
source code
 
_resolve_api_call(self, call_context)
Resolve the parameters for an API calls based on a call context for this API call.
source code
 
_match_push_addresses_to_signature(self, push_addresses, api_signature)
Combine the results of _get_push_addresses_before_target_address and _get_api_signature in order to produce a list of ParameterContext data objects.
source code
 
_get_api_signature(self, api_name)
Get the signature for a function by using IDA's GetType().
source code
 
_get_push_addresses_before_target_address(self, address)
Get the addresses of all push instructions in the basic block preceding the given address.
source code
 
get_last_result(self)
Get the last scan result as retrieved by scan_by_references.
source code
 
print_last_result(self)
nicely print the last scan result (mostly used for debugging)
source code
Method Details [hide private]

load_config(self, config_filename)

source code 

Loads a semantic configuration file and collects all definitions from it.

Parameters:
  • config_filename (str) - filename of a semantic configuration file

calculate_number_of_basic_blocks_for_function_address(self, function_address)

source code 

Calculates the number of basic blocks for a given function by walking its FlowChart.

Parameters:
  • function_address (int) - function address to calculate the block count for

get_number_of_basic_blocks_for_function_address(self, address)

source code 

returns the number of basic blocks for the function containing the queried address, based on the value stored in the last scan result.

If the number of basic blocks for this function has never been calculated, zero is returned.

Parameters:
  • function_address (int) - function address to get the block count for
Returns:
(int) The number of blocks in th e function

scan_by_references(self)

source code 

Scan by references to API names, based on the definitions loaded from the config file. This is highly efficient because we only touch places in the IDB that actually have references to our API names of interest.

scan_all_code(self)

source code 

Not implemented yet. In the long run, this function shall perform a full enumeration of all instructions, gathering information like number of instructions, number of basic blocks, references to and from functions etc.

get_function_address_for_address(self, address)

source code 

Get a function address containing the queried address.

Parameters:
  • address (int) - address to check the function address for
Returns:
(int) The start address of the function containing this address

calculate_number_of_functions(self)

source code 

Calculate the number of functions in all segments.

Returns:
(int) the number of functions found.

get_identified_function_addresses(self)

source code 

Get all function address that have been covered by the last scanning.

Returns:
(list of int) The addresses of covered functions.

get_identified_dummy_function_addresses(self)

source code 

Get all function address with a dummy name that have been covered by the last scanning.

Returns:
(list of int) The addresses of covered functions.

get_tags(self)

source code 

Get all the tags that have been covered by the last scanning. @return (list of str) The tags found.

get_tags_for_function_address(self, address)

source code 

Get all tags found for the function containing the queried address.

Parameters:
  • address (int) - address in the target function
Returns:
(list of str) The tags for the function containing the queried address

get_tag_count_for_function_address(self, tag, address)

source code 

Get the number of occurrences for a certain tag for the function containing the queried address.

Parameters:
  • tag (str) - a tag as included in semantic definitions
  • address (int) - address in the target function
Returns:
(int) The number of occurrences for this tag in the function

get_tagged_apis_for_function_address(self, address)

source code 

Get all call contexts for the function containing the queried address.

Parameters:
  • address (int) - address in the target function
Returns:
(list of CallContext data objects) The call contexts identified by the scanning of this function

get_address_tag_pairs_ordered_by_function(self)

source code 

Get all call contexts for all functions

Returns:
a dictionary with key/value entries of the following form: (function_address, dict((call_address, tag)))

get_functions_to_rename(self)

source code 

Get all functions that can be renamed according to the last scan result. Only functions with the standard IDA name sub_[0-9A-F]+ will be considered for renaming.

Returns:
a list of dictionaries, each consisting of three tuples: ("old_function_name", str), ("new_function_name", str), ("function_address", int)

get_parameters_for_call_address(self, call_address)

source code 

Get the parameters for the given address of a function call.

Parameters:
  • call_address (int) - address of the target call to inspect
Returns:
a list of ParameterContext data objects.

_resolve_api_call(self, call_context)

source code 

Resolve the parameters for an API calls based on a call context for this API call.

Parameters:
  • call_context (a CallContext data object) - the call context to get the parameter information for
Returns:
a list of ParameterContext data objects.

_match_push_addresses_to_signature(self, push_addresses, api_signature)

source code 

Combine the results of _get_push_addresses_before_target_address and _get_api_signature in order to produce a list of ParameterContext data objects.

Parameters:
  • push_addresses (a list of int) - the identified push addresses before a function call that shall be matched to a function signature
  • api_signature (a dictionary with the layout as returned by _get_api_signature) - information about a function definition with parameter names, types, and so on.
Returns:
a list of ParameterContext data objects.

_get_api_signature(self, api_name)

source code 

Get the signature for a function by using IDA's GetType(). The string is then parsed with a Regex and returned as a dictionary.

Parameters:
  • api_name (str) - name of the API / function to get type information for
Returns:
a dictionary with key/value entries of the following form: ("return_type", str), ("parameters", [dict(("type", str), ("name", str))])

_get_push_addresses_before_target_address(self, address)

source code 

Get the addresses of all push instructions in the basic block preceding the given address.

Parameters:
  • address (int) - address to get the push addresses for.
Returns:
a list of int

get_last_result(self)

source code 

Get the last scan result as retrieved by scan_by_references.

Returns:
a dictionary with key/value entries of the following form: (function_address, FunctionContext)