Exemple #1
0
        public ScanResults ScanImage(ScanResults sr)
        {
            this.sr = sr;

            // sr.WatchedAddresses.Add(Address.Ptr64(0x0000000000405EF3)); //$DEBUG

            // At this point, we have some entries in the image map
            // that are data, and unscanned ranges in betweeen. We
            // have hopefully a bunch of procedure addresses to
            // break up the unscanned ranges.

            if (ScanInstructions(sr) == null)
            {
                return(sr);
            }

            var the_blocks = BuildBasicBlocks(sr);

            sr.BreakOnWatchedAddress(the_blocks.Select(q => q.Key));
            the_blocks = RemoveInvalidBlocks(sr, the_blocks);

            // Remove blocks that fall off the end of the segment
            // or into data.
            Probe(sr);
            sr.ICFG = BuildIcfg(the_blocks);
            Probe(sr);
            sr.Dump("After shingle scan");

            // On processors with variable length instructions,
            // there may be many blocks that partially overlap the
            // "real" blocks that would actually have been executed
            // by the processor. Starting with known "roots", try to
            // remove as many invalid blocks as possible.

            var hsc = new HeuristicProcedureScanner(
                program,
                sr,
                program.SegmentMap.IsValidAddress,
                host);

            Probe(sr);
            hsc.ResolveBlockConflicts(sr.KnownProcedures.Concat(sr.DirectlyCalledAddresses.Keys));
            Probe(sr);
            sr.Dump("After block conflict resolution");
            // Collect weakly connected components and create
            // procedures from them.
            var pd    = new ProcedureDetector(program, sr, this.eventListener);
            var procs = pd.DetectProcedures();

            sr.Procedures = procs;
            return(sr);
        }
Exemple #2
0
        public ScanResults ScanImage(ScanResults sr)
        {
            // At this point, we have some entries in the image map
            // that are data, and unscanned ranges in betweeen. We
            // have hopefully a bunch of procedure addresses to
            // break up the unscanned ranges.

            var ranges = FindUnscannedRanges();

            var  stopwatch = new Stopwatch();
            var  dasm      = new ShingledScanner(program, host, storageBinder, sr, eventListener);
            bool unscanned = false;

            foreach (var range in ranges)
            {
                unscanned = true;
                try
                {
                    dasm.ScanRange(range.Item1,
                                   range.Item2,
                                   range.Item3,
                                   range.Item3.ToLinear() - range.Item2.ToLinear());
                }
                catch (AddressCorrelatedException aex)
                {
                    host.Error(aex.Address, aex.Message);
                }
            }
            if (!unscanned)
            {
                // No unscanned blocks were found.
                return(null);
            }
            // Remove blocks that fall off the end of the segment
            // or into data.
            Probe(sr);
            dasm.Dump("After shingle scan graph built");
            var deadNodes = dasm.RemoveBadInstructionsFromGraph();

            dasm.BuildIcfg(deadNodes);
            Probe(sr);
            sr.Dump("After shingle scan");

            // On processors with variable length instructions,
            // there may be many blocks that partially overlap the
            // "real" blocks that would actually have been executed
            // by the processor. Starting with known "roots", try to
            // remove as many invalid blocks as possible.

            var hsc = new HeuristicProcedureScanner(
                program,
                sr,
                program.SegmentMap.IsValidAddress,
                host);

            RemoveInvalidBlocks(sr);
            Probe(sr);
            hsc.ResolveBlockConflicts(sr.KnownProcedures.Concat(sr.DirectlyCalledAddresses.Keys));
            Probe(sr);
            sr.Dump("After block conflict resolution");
            var pd    = new ProcedureDetector(program, sr, this.eventListener);
            var procs = pd.DetectProcedures();

            sr.Procedures = procs;
            return(sr);
        }