public string getCallArgumentString(List <int> rows)
{
// Generates a merged argument string for the specified call rows.
if (rows.Any() && dataVis != null)
{
// Sort the rows, arguments will be displayed in call order
rows.Sort();
// Check the first datapoint
oSingleData datapoint = dataVis.getData(rows[0]);
if (datapoint == null)
{
return(string.Empty);
}
if (oFunctionMaster.destinationToFunction.ContainsKey(datapoint.destination))
{
// Loop through, printing the calls
string result = "";
for (int i = 0; i < rows.Count; i++)
{
datapoint = dataVis.getData(rows[i]);
oFunction function = ((oFunction)oFunctionMaster.destinationToFunction[datapoint.destination]);
result = result + datapoint.source.ToString("X") + " -> " + datapoint.destination.ToString("X") + Environment.NewLine + function.getArgumentString(datapoint).toString() + Environment.NewLine + Environment.NewLine;
}
// Finished merging
return(result.Trim());
}
return("ERROR: The function corresponding to address " + datapoint.destination.ToString("X") + " was not found.");
}
return("");
}
public bool isStackGood(oSingleData call)
{
if (addressRange.firstValue is uint)
{
// See if one of the calls satisfies this short range
return(call.esp >= (uint)addressRange.firstValue && call.esp <= (uint)addressRange.secondValue);
}
return(false);
}
public bool isFunctionAddress(oSingleData call)
{
if (call.destination == functionAddress)
{
return(true);
}
{
return(false);
}
}
public bool isArgumentGood(oSingleData call)
{
if (type == 1)
{
return(oMemoryFunctions.LookupAddressInMap(map, (uint)call.source).heapAddress !=
oMemoryFunctions.LookupAddressInMap(map, (uint)call.destination).heapAddress);
}
return(oMemoryFunctions.LookupAddressInMap(map, (uint)call.source).heapAddress ==
oMemoryFunctions.LookupAddressInMap(map, (uint)call.destination).heapAddress);
}
public bool fillOutHeapsStack(oSingleData call)
{
// Check to see if this is already in the heaps list
HEAP_INFO heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.esp);
if (selectedHeaps.Contains(heap.heapAddress))
{
return(false);
}
selectedHeaps.Add(heap.heapAddress, heap);
return(false);
}
public bool hasDereferenceBinaryMatch(oSingleData call)
{
if (data.Length == 0)
{
return(true);
}
for (int i = 0; i < call.dereferences.Count(); i++)
{
// Ask the dereference if it is a match
if (call.dereferences[i].isBinaryMatch(data, onlyStartWith))
{
return(true);
}
}
return(false); // No derference match found
}
public bool hasDereferenceStringMatch(oSingleData call)
{
if (textMatch.Length == 0)
{
return(true);
}
for (int i = 0; i < call.dereferences.Count(); i++)
{
// Ask the dereference if it is a match
if (call.dereferences[i].isStringMatch(textMatch, caseSensitive))
{
return(true);
}
}
return(false); // No derference match found
}
/// <summary>
/// This generates the argument string based on the calling convention of this
/// function. It truncates the arguments at around the specified pixel width of the column.
/// </summary>
/// <param name="callRecording"></param>
/// <param name="columnWidth"></param>
/// <returns></returns>
public ARGUMENT_STRING_COLLECTION getArgumentString(oSingleData callRecording, int columnWidth, Font font)
{
// Get the argument string collection
ARGUMENT_STRING_COLLECTION arguments = getArgumentString(callRecording);
// Truncate the string values to approximately the right size
for (int i = 0; i < arguments.values.Count; i++)
{
// Test the indexTooLong value
string value = arguments.values[i];
string name = arguments.names[i];
Size size = TextRenderer.MeasureText(name + "=" + value, font);
if (size.Width > columnWidth - 2 && value.Length > 5)
{
// Too long of a string
int indexTooLong = value.Length;
int indexTooShort = 0;
// Make our next guess, that will reduce the set in half
int guess = (indexTooLong - indexTooShort) / 2 + indexTooShort; // Rounding down is nice.
while (guess != indexTooShort)
{
// Test this guess length
if (TextRenderer.MeasureText(name + "=" + value.Substring(0, guess) + "...", font).Width > columnWidth - 2)
{
indexTooLong = guess;
}
else
{
indexTooShort = guess;
}
// Make the next guess
guess = (indexTooLong - indexTooShort) / 2 + indexTooShort;
}
// We found the prefect length that is just shorter than the column width with the "..."
arguments.values[i] = value.Substring(0, guess) + "...";
}
}
return(arguments);
}
public bool isArgumentGood(oSingleData call)
{
if (call.arguments.Length > 0)
{
if (argumentRange.firstValue is byte)
{
// See if one of the calls satisfies this byte range
if ((call.eax & 0xff) >= (byte)argumentRange.firstValue && (call.eax & 0xff) <= (byte)argumentRange.secondValue)
{
return(true);
}
if ((call.ecx & 0xff) >= (byte)argumentRange.firstValue && (call.ecx & 0xff) <= (byte)argumentRange.secondValue)
{
return(true);
}
if ((call.edx & 0xff) >= (byte)argumentRange.firstValue && (call.edx & 0xff) <= (byte)argumentRange.secondValue)
{
return(true);
}
return(call.arguments.Any(t => ((t & 0x000000ff) >= (byte)argumentRange.firstValue) && ((t & 0x000000ff) <= (byte)argumentRange.secondValue)));
}
if (argumentRange.firstValue is short)
{
// See if one of the calls satisfies this short range
if ((call.eax & 0xffff) >= (short)argumentRange.firstValue && (call.eax & 0xffff) <= (short)argumentRange.secondValue)
{
return(true);
}
if ((call.ecx & 0xffff) >= (short)argumentRange.firstValue && (call.ecx & 0xffff) <= (short)argumentRange.secondValue)
{
return(true);
}
if ((call.edx & 0xffff) >= (short)argumentRange.firstValue && (call.edx & 0xffff) <= (short)argumentRange.secondValue)
{
return(true);
}
return(call.arguments.Any(t => ((t & 0x0000ffff) >= (short)argumentRange.firstValue) && ((t & 0x0000ffff) <= (short)argumentRange.secondValue)));
}
if (argumentRange.firstValue is int)
{
// See if one of the calls satisfies this short range
if (call.eax >= (int)argumentRange.firstValue && call.eax <= (int)argumentRange.secondValue)
{
return(true);
}
if (call.ecx >= (int)argumentRange.firstValue && call.ecx <= (int)argumentRange.secondValue)
{
return(true);
}
if (call.edx >= (int)argumentRange.firstValue && call.edx <= (int)argumentRange.secondValue)
{
return(true);
}
return(call.arguments.Any(t => (t >= (int)argumentRange.firstValue) && (t <= (int)argumentRange.secondValue)));
}
if (argumentRange.firstValue is uint)
{
// See if one of the calls satisfies this short range
if (call.eax >= (uint)argumentRange.firstValue && call.eax <= (uint)argumentRange.secondValue)
{
return(true);
}
if (call.ecx >= (uint)argumentRange.firstValue && call.ecx <= (uint)argumentRange.secondValue)
{
return(true);
}
if (call.edx >= (uint)argumentRange.firstValue && call.edx <= (uint)argumentRange.secondValue)
{
return(true);
}
return(call.arguments.Any(t => (t >= (uint)argumentRange.firstValue) && (t <= (uint)argumentRange.secondValue)));
}
if (argumentRange.firstValue is double)
{
// See if one of the calls satisfies this float range
if (oMemoryFunctions.IntToFloat(call.eax) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.eax) <= (float)(double)argumentRange.secondValue)
{
return(true);
}
if (oMemoryFunctions.IntToFloat(call.ecx) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.ecx) <= (float)(double)argumentRange.secondValue)
{
return(true);
}
if (oMemoryFunctions.IntToFloat(call.edx) >= (float)(double)argumentRange.firstValue && oMemoryFunctions.IntToFloat(call.edx) <= (float)(double)argumentRange.secondValue)
{
return(true);
}
return(call.arguments.Any(t => (oMemoryFunctions.IntToFloat((uint)t) >= (float)(double)argumentRange.firstValue) && (oMemoryFunctions.IntToFloat((uint)t) <= (float)(double)argumentRange.secondValue)));
}
}
return(false);
}
public bool isCallTo(oSingleData call)
{
return(functions.Contains(call.destination));
}
public bool isArgumentGood(oSingleData call)
{
return(call.arguments.Count() <= maxArgCount && call.arguments.Count() >= minArgCount);
}
public bool hasStringDereference(oSingleData call)
{
// Figure out if this dereference has a string dereference
return(call.hasStringDereference());
}
public bool hasDereference(oSingleData call)
{
return(call.dereferences.Count() > 0);
}
/// <summary>
/// This generates the argument string based on the calling convention of this
/// function.
/// </summary>
/// <param name="callRecording"></param>
public ARGUMENT_STRING_COLLECTION getArgumentString(oSingleData callRecording)
{
ARGUMENT_STRING_COLLECTION result = new ARGUMENT_STRING_COLLECTION();
result.names = new List <string>((int)numParams + 3);
result.values = new List <string>((int)numParams + 3);
if (arguments.Count < 3) // Must have all three registers at least.
{
return(result);
}
int dereferenceIndex = callRecording.dereferences.Count() - 1;
string deref;
// ECX, __fastcall argument 1, __thiscall 'this' pointer
if (dereferenceIndex >= 0 &&
callRecording.dereferences[dereferenceIndex].argumentIndex == 0)
{
// ECX with dereference
result.values.Add(arguments[0].getValueString(callRecording.ecx, callRecording.dereferences[dereferenceIndex]));
result.names.Add(arguments[0].getName());
dereferenceIndex--;
}
else
{
// ECX no dereference
result.values.Add(arguments[0].getValueString(callRecording.ecx));
result.names.Add(arguments[0].getName());
}
// EDX, __fastcall argument 2
if (dereferenceIndex >= 0 &&
callRecording.dereferences[dereferenceIndex].argumentIndex == 1)
{
// EDX with dereference
result.values.Add(arguments[1].getValueString(callRecording.edx, callRecording.dereferences[dereferenceIndex]));
result.names.Add(arguments[1].getName());
dereferenceIndex--;
}
else
{
// EDX no dereference
result.values.Add(arguments[1].getValueString(callRecording.edx));
result.names.Add(arguments[1].getName());
}
// EAX, __fastcall argument 3 on borland
if (dereferenceIndex >= 0 &&
callRecording.dereferences[dereferenceIndex].argumentIndex == 2)
{
// EAX with dereference
result.values.Add(arguments[2].getValueString(callRecording.eax, callRecording.dereferences[dereferenceIndex]));
result.names.Add(arguments[2].getName());
dereferenceIndex--;
}
else
{
// EAX no dereference
result.values.Add(arguments[2].getValueString(callRecording.eax));
result.names.Add(arguments[2].getName());
}
// STACK ARGUMENTS
// Create room for the variables
for (int i = 0; i < callRecording.arguments.Count(); i++)
{
result.values.Add("");
result.names.Add("");
}
// Load the data into the variables
for (int i = callRecording.arguments.Count() - 1; i >= 0; i--)
{
if (dereferenceIndex >= 0 &&
callRecording.dereferences[dereferenceIndex].argumentIndex == i + 4)
{
// Stack argument with dereference
result.values[i + 3] = (arguments[i + 3].getValueString(callRecording.arguments[i], callRecording.dereferences[dereferenceIndex]));
result.names[i + 3] = arguments[i + 3].getName();
dereferenceIndex--;
}
else
{
// Stack argument no dereference
result.values[i + 3] = arguments[i + 3].getValueString(callRecording.arguments[i]);
result.names[i + 3] = arguments[i + 3].getName();
}
}
return(result);
}
/// <summary>
/// Returns the row and column text for a listgridview of calls.
/// </summary>
/// <param name="row">Cell row</param>
/// <param name="column">Cell column</param>
/// <returns></returns>
public Object getCallListCell(int row, int column, int columnWidth, Font font)
{
if (dataVis == null)
{
return("");
}
// Get this row and column
if (row < dataVis.getCallCount() && row >= 0)
{
// Get the call in question
oSingleData call = dataVis.getData(row);
if (call == null)
{
return("");
}
HEAP_INFO heap;
string name;
switch (column)
{
case 0:
return(row.ToString());
case 1:
// Source address
heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.source);
// Generate the string representation of this address
if (heap.associatedModule != null)
{
name = heap.associatedModule.ModuleName + " + 0x" +
(call.source - (uint)heap.associatedModule.BaseAddress).ToString("X") +
" (0x" + call.source.ToString("X") + ")";
}
else
{
name = "0x" + call.source.ToString("X");
}
return(name);
case 2:
// Destination address
heap = oMemoryFunctions.LookupAddressInMap(oProcess.map, call.destination);
// Generate the string representation of this address
if (heap.associatedModule != null)
{
name = heap.associatedModule.ModuleName + " + 0x" +
(call.destination - (uint)heap.associatedModule.BaseAddress).ToString("X")
+ " (0x" + call.destination.ToString("X") + ")";
}
else
{
name = "0x" + call.destination.ToString("X");
}
// Add the function name if known
if (oFunctionMaster.destinationToFunction.ContainsKey(call.destination))
{
oFunction function = (oFunction)oFunctionMaster.destinationToFunction[call.destination];
if (function.name != "")
{
name = function.name + " - " + name;
}
if (function.disabled)
{
name = @"DISABLED - " + name;
}
}
return(name);
case 3:
// Arguments
oFunction functionBase = (oFunction)oFunctionMaster.destinationToFunction[call.destination];
if (functionBase == null)
{
return("error, null associated function");
}
// Return the function data pair with the specified column width restriction
if (columnWidth > 0)
{
return(functionBase.getArgumentString(call, columnWidth, font).toString());
}
return(functionBase.getArgumentString(call).toString());
default:
return("?");
}
}
return("?");
}
public bool contains(oSingleData rowData)
{
// Check if this dataset contains rowData
return(this.data.Contains(rowData));
}