Beispiel #1
0
        public string getCallArgumentString(List <int> rows)
        {
            // Generates a merged argument string for the specified call rows.
            if (rows.Any() && dataVis != null)
            {
                // Sort the rows, arguments will be displayed in call order
                rows.Sort();
                // Check the first datapoint
                oSingleData datapoint = dataVis.getData(rows[0]);
                if (datapoint == null)
                {
                    return(string.Empty);
                }
                if (oFunctionMaster.destinationToFunction.ContainsKey(datapoint.destination))
                {
                    // Loop through, printing the calls
                    string result = "";
                    for (int i = 0; i < rows.Count; i++)
                    {
                        datapoint = dataVis.getData(rows[i]);
                        oFunction function = ((oFunction)oFunctionMaster.destinationToFunction[datapoint.destination]);
                        result = result + datapoint.source.ToString("X") + " -> " + datapoint.destination.ToString("X") + Environment.NewLine + function.getArgumentString(datapoint).toString() + Environment.NewLine + Environment.NewLine;
                    }

                    // Finished merging
                    return(result.Trim());
                }
                return("ERROR: The function corresponding to address " + datapoint.destination.ToString("X") + " was not found.");
            }
            return("");
        }
Beispiel #2
0
 public bool isStackGood(oSingleData call)
 {
     if (addressRange.firstValue is uint)
     {
         // See if one of the calls satisfies this short range
         return(call.esp >= (uint)addressRange.firstValue && call.esp <= (uint)addressRange.secondValue);
     }
     return(false);
 }
Beispiel #3
0
 public bool isFunctionAddress(oSingleData call)
 {
     if (call.destination == functionAddress)
     {
         return(true);
     }
     {
         return(false);
     }
 }
Beispiel #4
0
 public bool isArgumentGood(oSingleData call)
 {
     if (type == 1)
     {
         return(oMemoryFunctions.LookupAddressInMap(map, (uint)call.source).heapAddress !=
                oMemoryFunctions.LookupAddressInMap(map, (uint)call.destination).heapAddress);
     }
     return(oMemoryFunctions.LookupAddressInMap(map, (uint)call.source).heapAddress ==
            oMemoryFunctions.LookupAddressInMap(map, (uint)call.destination).heapAddress);
 }
Beispiel #5
0
        public bool fillOutHeapsStack(oSingleData call)
        {
            // Check to see if this is already in the heaps list
            HEAP_INFO heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.esp);

            if (selectedHeaps.Contains(heap.heapAddress))
            {
                return(false);
            }
            selectedHeaps.Add(heap.heapAddress, heap);
            return(false);
        }
Beispiel #6
0
        public bool hasDereferenceBinaryMatch(oSingleData call)
        {
            if (data.Length == 0)
            {
                return(true);
            }

            for (int i = 0; i < call.dereferences.Count(); i++)
            {
                // Ask the dereference if it is a match
                if (call.dereferences[i].isBinaryMatch(data, onlyStartWith))
                {
                    return(true);
                }
            }
            return(false); // No derference match found
        }
Beispiel #7
0
        public bool hasDereferenceStringMatch(oSingleData call)
        {
            if (textMatch.Length == 0)
            {
                return(true);
            }

            for (int i = 0; i < call.dereferences.Count(); i++)
            {
                // Ask the dereference if it is a match
                if (call.dereferences[i].isStringMatch(textMatch, caseSensitive))
                {
                    return(true);
                }
            }
            return(false); // No derference match found
        }
Beispiel #8
0
        /// <summary>
        /// This generates the argument string based on the calling convention of this
        /// function. It truncates the arguments at around the specified pixel width of the column.
        /// </summary>
        /// <param name="callRecording"></param>
        /// <param name="columnWidth"></param>
        /// <returns></returns>
        public ARGUMENT_STRING_COLLECTION getArgumentString(oSingleData callRecording, int columnWidth, Font font)
        {
            // Get the argument string collection
            ARGUMENT_STRING_COLLECTION arguments = getArgumentString(callRecording);

            // Truncate the string values to approximately the right size
            for (int i = 0; i < arguments.values.Count; i++)
            {
                // Test the indexTooLong value
                string value = arguments.values[i];
                string name  = arguments.names[i];
                Size   size  = TextRenderer.MeasureText(name + "=" + value, font);
                if (size.Width > columnWidth - 2 && value.Length > 5)
                {
                    // Too long of a string

                    int indexTooLong  = value.Length;
                    int indexTooShort = 0;

                    // Make our next guess, that will reduce the set in half
                    int guess = (indexTooLong - indexTooShort) / 2 + indexTooShort; // Rounding down is nice.

                    while (guess != indexTooShort)
                    {
                        // Test this guess length
                        if (TextRenderer.MeasureText(name + "=" + value.Substring(0, guess) + "...", font).Width > columnWidth - 2)
                        {
                            indexTooLong = guess;
                        }
                        else
                        {
                            indexTooShort = guess;
                        }

                        // Make the next guess
                        guess = (indexTooLong - indexTooShort) / 2 + indexTooShort;
                    }

                    // We found the prefect length that is just shorter than the column width with the "..."
                    arguments.values[i] = value.Substring(0, guess) + "...";
                }
            }

            return(arguments);
        }
Beispiel #9
0
 public bool isArgumentGood(oSingleData call)
 {
     if (call.arguments.Length > 0)
     {
         if (argumentRange.firstValue is byte)
         {
             // See if one of the calls satisfies this byte range
             if ((call.eax & 0xff) >= (byte)argumentRange.firstValue && (call.eax & 0xff) <= (byte)argumentRange.secondValue)
             {
                 return(true);
             }
             if ((call.ecx & 0xff) >= (byte)argumentRange.firstValue && (call.ecx & 0xff) <= (byte)argumentRange.secondValue)
             {
                 return(true);
             }
             if ((call.edx & 0xff) >= (byte)argumentRange.firstValue && (call.edx & 0xff) <= (byte)argumentRange.secondValue)
             {
                 return(true);
             }
             return(call.arguments.Any(t => ((t & 0x000000ff) >= (byte)argumentRange.firstValue) && ((t & 0x000000ff) <= (byte)argumentRange.secondValue)));
         }
         if (argumentRange.firstValue is short)
         {
             // See if one of the calls satisfies this short range
             if ((call.eax & 0xffff) >= (short)argumentRange.firstValue && (call.eax & 0xffff) <= (short)argumentRange.secondValue)
             {
                 return(true);
             }
             if ((call.ecx & 0xffff) >= (short)argumentRange.firstValue && (call.ecx & 0xffff) <= (short)argumentRange.secondValue)
             {
                 return(true);
             }
             if ((call.edx & 0xffff) >= (short)argumentRange.firstValue && (call.edx & 0xffff) <= (short)argumentRange.secondValue)
             {
                 return(true);
             }
             return(call.arguments.Any(t => ((t & 0x0000ffff) >= (short)argumentRange.firstValue) && ((t & 0x0000ffff) <= (short)argumentRange.secondValue)));
         }
         if (argumentRange.firstValue is int)
         {
             // See if one of the calls satisfies this short range
             if (call.eax >= (int)argumentRange.firstValue && call.eax <= (int)argumentRange.secondValue)
             {
                 return(true);
             }
             if (call.ecx >= (int)argumentRange.firstValue && call.ecx <= (int)argumentRange.secondValue)
             {
                 return(true);
             }
             if (call.edx >= (int)argumentRange.firstValue && call.edx <= (int)argumentRange.secondValue)
             {
                 return(true);
             }
             return(call.arguments.Any(t => (t >= (int)argumentRange.firstValue) && (t <= (int)argumentRange.secondValue)));
         }
         if (argumentRange.firstValue is uint)
         {
             // See if one of the calls satisfies this short range
             if (call.eax >= (uint)argumentRange.firstValue && call.eax <= (uint)argumentRange.secondValue)
             {
                 return(true);
             }
             if (call.ecx >= (uint)argumentRange.firstValue && call.ecx <= (uint)argumentRange.secondValue)
             {
                 return(true);
             }
             if (call.edx >= (uint)argumentRange.firstValue && call.edx <= (uint)argumentRange.secondValue)
             {
                 return(true);
             }
             return(call.arguments.Any(t => (t >= (uint)argumentRange.firstValue) && (t <= (uint)argumentRange.secondValue)));
         }
         if (argumentRange.firstValue is double)
         {
             // See if one of the calls satisfies this float range
             if (oMemoryFunctions.IntToFloat(call.eax) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.eax) <= (float)(double)argumentRange.secondValue)
             {
                 return(true);
             }
             if (oMemoryFunctions.IntToFloat(call.ecx) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.ecx) <= (float)(double)argumentRange.secondValue)
             {
                 return(true);
             }
             if (oMemoryFunctions.IntToFloat(call.edx) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.edx) <= (float)(double)argumentRange.secondValue)
             {
                 return(true);
             }
             return(call.arguments.Any(t => (oMemoryFunctions.IntToFloat((uint)t) >= (float)(double)argumentRange.firstValue) && (oMemoryFunctions.IntToFloat((uint)t) <= (float)(double)argumentRange.secondValue)));
         }
     }
     return(false);
 }
Beispiel #10
0
 public bool isCallTo(oSingleData call)
 {
     return(functions.Contains(call.destination));
 }
Beispiel #11
0
 public bool isArgumentGood(oSingleData call)
 {
     return(call.arguments.Count() <= maxArgCount && call.arguments.Count() >= minArgCount);
 }
Beispiel #12
0
 public bool hasStringDereference(oSingleData call)
 {
     // Figure out if this dereference has a string dereference
     return(call.hasStringDereference());
 }
Beispiel #13
0
 public bool hasDereference(oSingleData call)
 {
     return(call.dereferences.Count() > 0);
 }
Beispiel #14
0
        /// <summary>
        /// This generates the argument string based on the calling convention of this
        /// function.
        /// </summary>
        /// <param name="callRecording"></param>
        public ARGUMENT_STRING_COLLECTION getArgumentString(oSingleData callRecording)
        {
            ARGUMENT_STRING_COLLECTION result = new ARGUMENT_STRING_COLLECTION();

            result.names  = new List <string>((int)numParams + 3);
            result.values = new List <string>((int)numParams + 3);
            if (arguments.Count < 3)  // Must have all three registers at least.
            {
                return(result);
            }

            int    dereferenceIndex = callRecording.dereferences.Count() - 1;
            string deref;

            // ECX, __fastcall argument 1, __thiscall 'this' pointer
            if (dereferenceIndex >= 0 &&
                callRecording.dereferences[dereferenceIndex].argumentIndex == 0)
            {
                // ECX with dereference
                result.values.Add(arguments[0].getValueString(callRecording.ecx, callRecording.dereferences[dereferenceIndex]));
                result.names.Add(arguments[0].getName());
                dereferenceIndex--;
            }
            else
            {
                // ECX no dereference
                result.values.Add(arguments[0].getValueString(callRecording.ecx));
                result.names.Add(arguments[0].getName());
            }

            // EDX, __fastcall argument 2
            if (dereferenceIndex >= 0 &&
                callRecording.dereferences[dereferenceIndex].argumentIndex == 1)
            {
                // EDX with dereference
                result.values.Add(arguments[1].getValueString(callRecording.edx, callRecording.dereferences[dereferenceIndex]));
                result.names.Add(arguments[1].getName());
                dereferenceIndex--;
            }
            else
            {
                // EDX no dereference
                result.values.Add(arguments[1].getValueString(callRecording.edx));
                result.names.Add(arguments[1].getName());
            }

            // EAX, __fastcall argument 3 on borland
            if (dereferenceIndex >= 0 &&
                callRecording.dereferences[dereferenceIndex].argumentIndex == 2)
            {
                // EAX with dereference
                result.values.Add(arguments[2].getValueString(callRecording.eax, callRecording.dereferences[dereferenceIndex]));
                result.names.Add(arguments[2].getName());
                dereferenceIndex--;
            }
            else
            {
                // EAX no dereference
                result.values.Add(arguments[2].getValueString(callRecording.eax));
                result.names.Add(arguments[2].getName());
            }

            // STACK ARGUMENTS

            // Create room for the variables
            for (int i = 0; i < callRecording.arguments.Count(); i++)
            {
                result.values.Add("");
                result.names.Add("");
            }

            // Load the data into the variables
            for (int i = callRecording.arguments.Count() - 1; i >= 0; i--)
            {
                if (dereferenceIndex >= 0 &&
                    callRecording.dereferences[dereferenceIndex].argumentIndex == i + 4)
                {
                    // Stack argument with dereference
                    result.values[i + 3] = (arguments[i + 3].getValueString(callRecording.arguments[i], callRecording.dereferences[dereferenceIndex]));
                    result.names[i + 3]  = arguments[i + 3].getName();
                    dereferenceIndex--;
                }
                else
                {
                    // Stack argument no dereference
                    result.values[i + 3] = arguments[i + 3].getValueString(callRecording.arguments[i]);
                    result.names[i + 3]  = arguments[i + 3].getName();
                }
            }

            return(result);
        }
Beispiel #15
0
        /// <summary>
        /// Returns the row and column text for a listgridview of calls.
        /// </summary>
        /// <param name="row">Cell row</param>
        /// <param name="column">Cell column</param>
        /// <returns></returns>
        public Object getCallListCell(int row, int column, int columnWidth, Font font)
        {
            if (dataVis == null)
            {
                return("");
            }

            // Get this row and column
            if (row < dataVis.getCallCount() && row >= 0)
            {
                // Get the call in question
                oSingleData call = dataVis.getData(row);
                if (call == null)
                {
                    return("");
                }

                HEAP_INFO heap;
                string    name;
                switch (column)
                {
                case 0:
                    return(row.ToString());

                case 1:
                    // Source address
                    heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.source);

                    // Generate the string representation of this address
                    if (heap.associatedModule != null)
                    {
                        name = heap.associatedModule.ModuleName + " + 0x" +
                               (call.source - (uint)heap.associatedModule.BaseAddress).ToString("X") +
                               " (0x" + call.source.ToString("X") + ")";
                    }
                    else
                    {
                        name = "0x" + call.source.ToString("X");
                    }
                    return(name);

                case 2:
                    // Destination address
                    heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.destination);

                    // Generate the string representation of this address
                    if (heap.associatedModule != null)
                    {
                        name = heap.associatedModule.ModuleName + " + 0x" +
                               (call.destination - (uint)heap.associatedModule.BaseAddress).ToString("X")
                               + " (0x" + call.destination.ToString("X") + ")";
                    }
                    else
                    {
                        name = "0x" + call.destination.ToString("X");
                    }

                    // Add the function name if known
                    if (oFunctionMaster.destinationToFunction.ContainsKey(call.destination))
                    {
                        oFunction function = (oFunction)oFunctionMaster.destinationToFunction[call.destination];
                        if (function.name != "")
                        {
                            name = function.name + " - " + name;
                        }
                        if (function.disabled)
                        {
                            name = @"DISABLED - " + name;
                        }
                    }
                    return(name);

                case 3:
                    // Arguments
                    oFunction functionBase = (oFunction)oFunctionMaster.destinationToFunction[call.destination];
                    if (functionBase == null)
                    {
                        return("error, null associated function");
                    }

                    // Return the function data pair with the specified column width restriction
                    if (columnWidth > 0)
                    {
                        return(functionBase.getArgumentString(call, columnWidth, font).toString());
                    }
                    return(functionBase.getArgumentString(call).toString());

                default:
                    return("?");
                }
            }
            return("?");
        }
Beispiel #16
0
 public bool contains(oSingleData rowData)
 {
     // Check if this dataset contains rowData
     return(this.data.Contains(rowData));
 }