flirt.c File Reference

#include <rz_lib.h>
#include <rz_flirt.h>

Go to the source code of this file.

Classes
struct	idasig_v5_t
struct	idasig_v6_v7_t
struct	idasig_v8_v9_t
struct	idasig_v10_t
struct	parse_status_t

Macros
#define	MAX_WBITS   15
#define	sig_dbg(...)
#define	sig_dbg_buffer(n, b, s)
#define	rz_buf_append_le_bits(buffer, tmp, value, bits)
#define	rz_buf_append_be_bits(buffer, tmp, value, bits)
#define	IDASIG_FEATURE_NONE   0x00
#define	IDASIG_FEATURE_STARTUP   0x01
#define	IDASIG_FEATURE_CTYPE_CRC   0x02
#define	IDASIG_FEATURE_2BYTE_CTYPE   0x04
#define	IDASIG_FEATURE_ALT_CTYPE_CRC   0x08
#define	IDASIG_FEATURE_COMPRESSED   0x10
#define	IDASIG_PARSE_MORE_PUBLIC_NAMES   0x01
#define	IDASIG_PARSE_READ_TAIL_BYTES   0x02
#define	IDASIG_PARSE_READ_REFERENCED_FUNCTIONS   0x04
#define	IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC   0x08
#define	IDASIG_PARSE_MORE_MODULES   0x10
#define	IDASIG_FUNCTION_LOCAL   0x02
#define	IDASIG_FUNCTION_UNRESOLVED_COLLISION   0x08
#define	is_status_err_or_eof(p)   (p->eof || p->error)
#define	POLY   0x8408

Typedefs
typedef struct idasig_v5_t	idasig_v5_t
typedef struct idasig_v6_v7_t	idasig_v6_v7_t
typedef struct idasig_v8_v9_t	idasig_v8_v9_t
typedef struct idasig_v10_t	idasig_v10_t
typedef struct parse_status_t	ParseStatus

Functions
ut16	flirt_crc16 (const ut8 *data_p, size_t length)
static ut8	read_byte (ParseStatus *b)
static ut16	read_short (ParseStatus *b)
static ut32	read_word (ParseStatus *b)
static ut16	read_max_2_bytes (ParseStatus *b)
static ut32	read_multiple_bytes (ParseStatus *b)
void	module_free (RzFlirtModule *module)
RZ_API void	rz_sign_flirt_node_free (RZ_NULLABLE RzFlirtNode *node)
	Frees an RzFlirtNode struct. More...
RZ_API void	rz_sign_flirt_info_fini (RZ_NULLABLE RzFlirtInfo *info)
	Frees an RzFlirtInfo struct elements without freeing the pointer. More...
static bool	is_pattern_matching (ut32 p_size, const ut8 *pattern, const ut8 *mask, const ut8 *b, ut32 b_size)
	Checks if a pattern does match the buffer data. More...
static int	module_match_buffer (RzAnalysis *analysis, const RzFlirtModule *module, ut8 *b, ut64 address, ut32 buf_size)
	Checks if the module matches the buffer and renames the matched functions. More...
static int	node_match_buffer (RzAnalysis *analysis, const RzFlirtNode *node, ut8 *b, ut64 address, ut32 buf_size, ut32 buf_idx)
static bool	node_match_functions (RzAnalysis *analysis, const RzFlirtNode *root_node)
	Tries to find matching functions between the signature infos in root_node and the analyzed functions in analysis. More...
static ut8	read_module_tail_bytes (RzFlirtModule *module, ParseStatus *b)
static ut8	read_module_referenced_functions (RzFlirtModule *module, ParseStatus *b)
static ut8	read_module_public_functions (RzFlirtModule *module, ParseStatus *b, ut8 *flags)
static ut8	parse_leaf (ParseStatus *b, RzFlirtNode *node)
static bool	read_node_length (RzFlirtNode *node, ParseStatus *b)
static bool	read_node_variant_mask (RzFlirtNode *node, ParseStatus *b)
static bool	read_node_bytes (RzFlirtNode *node, ParseStatus *b)
static ut8	parse_tree (ParseStatus *b, RzFlirtNode *root_node)
static bool	parse_v5_header (RzBuffer *buf, idasig_v5_t *header)
static int	parse_v6_v7_header (RzBuffer *buf, idasig_v6_v7_t *header)
static int	parse_v8_v9_header (RzBuffer *buf, idasig_v8_v9_t *header)
static int	parse_v10_header (RzBuffer *buf, idasig_v10_t *header)
static ut8	flirt_parse_version (RzBuffer *buffer)
	Returns the FLIRT file version read from the RzBuffer This function returns the FLIRT file version, when it fails returns 0. More...
RZ_API RZ_OWN bool	rz_sign_flirt_parse_header_compressed_pattern_from_buffer (RZ_NONNULL RzBuffer *flirt_buf, RZ_NONNULL RzFlirtInfo *info)
	Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtInfo. More...
RZ_API RZ_OWN RzFlirtNode *	rz_sign_flirt_parse_compressed_pattern_from_buffer (RZ_NONNULL RzBuffer *flirt_buf, ut8 expected_arch, RZ_NULLABLE RzFlirtInfo *info)
	Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode. More...
RZ_API bool	rz_sign_flirt_apply (RZ_NONNULL RzAnalysis *analysis, RZ_NONNULL const char *flirt_file, ut8 expected_arch)
	Parses the FLIRT file and applies the signatures. More...
RZ_API ut32	rz_sign_flirt_node_count_nodes (RZ_NONNULL const RzFlirtNode *node)
	Counts the number of FLIRT signatures in the node. More...
static bool	rz_write_vle16 (RzBuffer *buffer, ut16 val)
static bool	rz_write_vle32 (RzBuffer *buffer, ut32 val)
static bool	rz_write_vle64 (RzBuffer *buffer, ut64 val)
static bool	flirt_has_references (RZ_NONNULL const RzFlirtModule *module)
static bool	rz_write_versioned_vle (RzBuffer *buffer, ut32 value, ut8 version)
static bool	flirt_write_module (RZ_NONNULL const RzFlirtModule *module, RZ_NONNULL RzBuffer *buffer, ut8 flags, ut8 version, bool first)
static bool	flirt_write_node (RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer, ut8 version)
RZ_API bool	rz_sign_flirt_write_compressed_pattern_to_buffer (RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer, RzFlirtCompressedOptions *options)
	Writes in the the RzBuffer the FLIRT signatures in compressed format. More...

Macro Definition Documentation

IDASIG_FEATURE_2BYTE_CTYPE

#define IDASIG_FEATURE_2BYTE_CTYPE   0x04

Definition at line 133 of file flirt.c.

IDASIG_FEATURE_ALT_CTYPE_CRC

#define IDASIG_FEATURE_ALT_CTYPE_CRC   0x08

Definition at line 134 of file flirt.c.

IDASIG_FEATURE_COMPRESSED

#define IDASIG_FEATURE_COMPRESSED   0x10

Definition at line 135 of file flirt.c.

IDASIG_FEATURE_CTYPE_CRC

#define IDASIG_FEATURE_CTYPE_CRC   0x02

Definition at line 132 of file flirt.c.

IDASIG_FEATURE_NONE

#define IDASIG_FEATURE_NONE   0x00

Definition at line 130 of file flirt.c.

IDASIG_FEATURE_STARTUP

#define IDASIG_FEATURE_STARTUP   0x01

Definition at line 131 of file flirt.c.

IDASIG_FUNCTION_LOCAL

#define IDASIG_FUNCTION_LOCAL   0x02

Definition at line 145 of file flirt.c.

IDASIG_FUNCTION_UNRESOLVED_COLLISION

#define IDASIG_FUNCTION_UNRESOLVED_COLLISION   0x08

Definition at line 146 of file flirt.c.

IDASIG_PARSE_MORE_MODULES

#define IDASIG_PARSE_MORE_MODULES   0x10

Definition at line 142 of file flirt.c.

IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC

#define IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC   0x08

Definition at line 141 of file flirt.c.

IDASIG_PARSE_MORE_PUBLIC_NAMES

#define IDASIG_PARSE_MORE_PUBLIC_NAMES   0x01

Definition at line 138 of file flirt.c.

IDASIG_PARSE_READ_REFERENCED_FUNCTIONS

#define IDASIG_PARSE_READ_REFERENCED_FUNCTIONS   0x04

Definition at line 140 of file flirt.c.

IDASIG_PARSE_READ_TAIL_BYTES

#define IDASIG_PARSE_READ_TAIL_BYTES   0x02

Definition at line 139 of file flirt.c.

is_status_err_or_eof

#define is_status_err_or_eof

(

p

)

(p->eof || p->error)

Definition at line 183 of file flirt.c.

MAX_WBITS

#define MAX_WBITS   15

Definition at line 105 of file flirt.c.

POLY

#define POLY   0x8408

Definition at line 203 of file flirt.c.

rz_buf_append_be_bits

#define rz_buf_append_be_bits	(		buffer,
			tmp,
			value,
			bits
	)

Value:

    rz_write_be##bits(tmp, value); \
    rz_buf_append_bytes(buffer, tmp, sizeof(ut##bits))

Definition at line 125 of file flirt.c.

rz_buf_append_le_bits

#define rz_buf_append_le_bits	(		buffer,
			tmp,
			value,
			bits
	)

Value:

    rz_write_le##bits(tmp, value); \
    rz_buf_append_bytes(buffer, tmp, sizeof(ut##bits))

Definition at line 121 of file flirt.c.

sig_dbg

#define sig_dbg

(

...

)

Definition at line 117 of file flirt.c.

sig_dbg_buffer

#define sig_dbg_buffer	(		n,
			b,
			s
	)

Definition at line 118 of file flirt.c.

Typedef Documentation

idasig_v10_t

typedef struct idasig_v10_t idasig_v10_t

idasig_v5_t

typedef struct idasig_v5_t idasig_v5_t

idasig_v6_v7_t

typedef struct idasig_v6_v7_t idasig_v6_v7_t

idasig_v8_v9_t

typedef struct idasig_v8_v9_t idasig_v8_v9_t

ParseStatus

typedef struct parse_status_t ParseStatus

Function Documentation

flirt_crc16()

ut16 flirt_crc16	(	const ut8 *	data_p,
		size_t	length
	)

Definition at line 204 of file flirt.c.

                                                   {
    ut8 i;
    ut32 data;
    ut32 crc = 0xFFFF;
 
    if (length == 0) {
        return 0;
    }
    do {
        data = *data_p++;
        for (i = 0; i < 8; i++) {
            if ((crc ^ data) & 1) {
                crc = (crc >> 1) ^ POLY;
            } else {
                crc >>= 1;
            }
            data >>= 1;
        }
    } while (--length > 0);
 
    crc = ~crc;
    data = crc;
    crc = (crc << 8) | ((data >> 8) & 0xff);
    return (ut16)(crc);
}

References i, length, and POLY.

Referenced by flirt_module_new(), and module_match_buffer().

flirt_has_references()

static bool flirt_has_references ( RZ_NONNULL const RzFlirtModule *  module )

static

Definition at line 1402 of file flirt.c.

                                                                         {
    return module->referenced_functions && rz_list_length(module->referenced_functions) > 0;
}

References rz_list_length().

Referenced by flirt_write_module().

flirt_parse_version()

static ut8 flirt_parse_version ( RzBuffer *  buffer )

static

Returns the FLIRT file version read from the RzBuffer This function returns the FLIRT file version, when it fails returns 0.

Parameters

buffer

The buffer to read

Returns

Parsed FLIRT version

Definition at line 1021 of file flirt.c.

                                                 {
    ut8 ret = 0;
 
    idasig_v5_t *header = RZ_NEW0(idasig_v5_t);
    if (!header) {
        goto exit;
    }
 
    if (rz_buf_read(buffer, header->magic, sizeof(header->magic)) != sizeof(header->magic)) {
        RZ_LOG_ERROR("FLIRT: invalid sig file (EOF in v5 header magic).\n");
        goto exit;
    }
 
    if (memcmp((const char *)header->magic, "IDASGN", 6)) {
        RZ_LOG_ERROR("FLIRT: invalid sig magic.\n");
        goto exit;
    }
 
    if (rz_buf_read(buffer, &header->version, sizeof(header->version)) != sizeof(header->version)) {
        RZ_LOG_ERROR("FLIRT: invalid sig file (EOF in v5 header version).\n");
        goto exit;
    }
 
    ret = header->version;
 
exit:
    free(header);
    return ret;
}

References test-lz4-list::exit, free(), header, rz_buf_read(), RZ_LOG_ERROR, and RZ_NEW0.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer().

flirt_write_module()

static bool flirt_write_module ( RZ_NONNULL const RzFlirtModule *  module, RZ_NONNULL RzBuffer *  buffer, ut8  flags, ut8  version, bool  first  )

static

Definition at line 1413 of file flirt.c.

                                                                                                                                        {
    ut8 tmp[4];
    size_t value = 0;
    ut32 base_offset = 0;
    RzListIter *it;
    RzFlirtFunction *func;
    RzFlirtTailByte *byte;
    bool has_ref = flirt_has_references(module);
 
    if (first) {
        rz_buf_append_le_bits(buffer, tmp, module->crc_length, 8);
 
        rz_buf_append_be_bits(buffer, tmp, module->crc16, 16);
    }
    rz_write_vle32(buffer, module->length);
 
    if (has_ref) {
        flags |= IDASIG_PARSE_READ_REFERENCED_FUNCTIONS;
    }
    if (rz_list_length(module->tail_bytes) > 0) {
        flags |= IDASIG_PARSE_READ_TAIL_BYTES;
    }
 
    rz_list_foreach (module->public_functions, it, func) {
        if (value > 0) {
            tmp[0] = IDASIG_PARSE_MORE_PUBLIC_NAMES;
            rz_buf_append_bytes(buffer, tmp, 1);
        }
        rz_write_vle32(buffer, func->offset - base_offset);
        base_offset = func->offset;
        tmp[0] = 0;
        if (func->is_local) {
            tmp[0] |= IDASIG_FUNCTION_LOCAL;
        }
        if (func->is_collision) {
            tmp[0] |= IDASIG_FUNCTION_UNRESOLVED_COLLISION;
        }
        if (tmp[0]) {
            rz_buf_append_bytes(buffer, tmp, 1);
        }
        rz_buf_append_string(buffer, func->name);
        value++;
    }
 
    if (value > 0) {
        rz_buf_append_bytes(buffer, &flags, 1);
    }
 
    value = rz_list_length(module->tail_bytes);
    if (value) {
        if (version >= 8) {
            // n of tail bytes.
            rz_write_versioned_vle(buffer, value, version);
        }
        value = 0;
        rz_list_foreach (module->tail_bytes, it, byte) {
            if (version < 8 && value > 1) {
                RZ_LOG_WARN("FLIRT: the number of tail bytes (%u) is > 1 when version %u does allow only 1\n", rz_list_length(module->tail_bytes), version);
                break;
            }
            value++;
 
            rz_write_versioned_vle(buffer, byte->offset, version);
            rz_buf_append_le_bits(buffer, tmp, byte->value, 8);
        }
    }
 
    if (has_ref) {
        // on sig files, it is not allowed to have multiple references.
        tmp[0] = 1;
        rz_buf_append_bytes(buffer, tmp, 1);
 
        value = 0;
        rz_list_foreach (module->referenced_functions, it, func) {
            if (value > 0) {
                break;
            }
            value++;
 
            rz_write_versioned_vle(buffer, func->offset, version);
 
            ut32 length = strlen(func->name);
            if (length > 0x7F) {
                tmp[0] = 0; // when name length is > 0x7F the length is preceeded by a 0x00
                rz_buf_append_bytes(buffer, tmp, 1);
            }
            rz_write_vle16(buffer, length);
            rz_buf_append_bytes(buffer, (ut8 *)func->name, length);
        }
    }
 
    return true;
}

References flags, flirt_has_references(), IDASIG_FUNCTION_LOCAL, IDASIG_FUNCTION_UNRESOLVED_COLLISION, IDASIG_PARSE_MORE_PUBLIC_NAMES, IDASIG_PARSE_READ_REFERENCED_FUNCTIONS, IDASIG_PARSE_READ_TAIL_BYTES, rz_flirt_function_t::is_collision, rz_flirt_function_t::is_local, length, rz_flirt_function_t::name, rz_flirt_tail_byte_t::offset, rz_flirt_function_t::offset, rz_buf_append_be_bits, rz_buf_append_bytes(), rz_buf_append_le_bits, rz_buf_append_string(), rz_list_length(), RZ_LOG_WARN, rz_write_versioned_vle(), rz_write_vle16(), rz_write_vle32(), autogen_x86imm::tmp, value, and rz_flirt_tail_byte_t::value.

Referenced by flirt_write_node().

flirt_write_node()

static bool flirt_write_node ( RZ_NONNULL const RzFlirtNode *  node, RZ_NONNULL RzBuffer *  buffer, ut8  version  )

static

Definition at line 1507 of file flirt.c.

                                                                                                           {
    if (node->length > 64) {
        RZ_LOG_ERROR("FLIRT: pattern mask size is > 64.\n");
        return false;
    }
 
    RzListIter *it;
    RzFlirtNode *child;
    RzFlirtModule *module;
 
    ut32 n_childs = rz_list_length(node->child_list);
    rz_write_vle32(buffer, n_childs);
 
    if (n_childs < 1) {
        // leaf
        ut8 flags = 0;
 
        RzFlirtModule *last = rz_list_last(node->module_list);
        rz_list_foreach (node->module_list, it, module) {
            bool already_found = !(flags & IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC);
            if (last != module) {
                RzFlirtModule *next = rz_list_iter_get_next_data(it);
                if (next && next->crc16 == module->crc16) {
                    flags = IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC;
                } else {
                    flags = IDASIG_PARSE_MORE_MODULES;
                }
            } else {
                flags = 0;
            }
            if (!flirt_write_module(module, buffer, flags, version, already_found)) {
                return false;
            }
        }
        return true;
    }
 
    // tree
    rz_list_foreach (node->child_list, it, child) {
        // pattern mask size
        ut8 plen = child->length;
        rz_buf_append_bytes(buffer, &plen, 1);
        if (child->length < 0x10) {
            rz_write_vle16(buffer, child->variant_mask & UT16_MAX);
        } else if (child->length <= 0x20) {
            rz_write_vle32(buffer, child->variant_mask & UT32_MAX);
        } else if (child->length <= 0x40) {
            rz_write_vle64(buffer, child->variant_mask);
        } else {
            RZ_LOG_ERROR("FLIRT: pattern mask size cannot be > 64 bits\n");
            return false;
        }
        for (ut32 i = 0; i < child->length; i++) {
            if (child->pattern_mask[i] != 0xFF) {
                continue;
            }
            rz_buf_append_bytes(buffer, &child->pattern_bytes[i], 1);
        }
        if (!flirt_write_node(child, buffer, version)) {
            return false;
        }
    }
 
    return true;
}

References rz_flirt_module_t::crc16, flags, flirt_write_module(), i, IDASIG_PARSE_MORE_MODULES, IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC, rz_flirt_node_t::length, rz_flirt_node_t::pattern_bytes, rz_flirt_node_t::pattern_mask, rz_buf_append_bytes(), rz_list_iter_get_next_data(), rz_list_last(), rz_list_length(), RZ_LOG_ERROR, rz_write_vle16(), rz_write_vle32(), rz_write_vle64(), UT16_MAX, UT32_MAX, and rz_flirt_node_t::variant_mask.

Referenced by rz_sign_flirt_write_compressed_pattern_to_buffer().

is_pattern_matching()

static bool is_pattern_matching ( ut32  p_size, const ut8 *  pattern, const ut8 *  mask, const ut8 *  b, ut32  b_size  )

static

Checks if a pattern does match the buffer data.

Parameters

p_size	The pattern size
pattern	The pattern to check agains
mask	The pattern mask
b	Buffer to check
b_size	Size of the buffer to check

Returns

True if pattern does match, false otherwise.

Definition at line 336 of file flirt.c.

                                                                                                             {
    if (b_size < p_size) {
        return false;
    }
    for (ut32 i = 0; i < p_size; i++) {
        if (mask[i] == 0xFF && pattern[i] != b[i]) {
            return false;
        }
    }
    return true;
}

References b, i, and mask.

Referenced by node_match_buffer().

module_free()

void module_free

(

RzFlirtModule *

module

)

Definition at line 284 of file flirt.c.

                                        {
    if (!module) {
        return;
    }
    rz_list_free(module->public_functions);
    rz_list_free(module->tail_bytes);
    rz_list_free(module->referenced_functions);
    free(module);
}

References free(), and rz_list_free().

Referenced by flirt_create_child(), flirt_create_child_from_analysis(), flirt_module_new(), flirt_pat_parse_line(), and parse_leaf().

module_match_buffer()

static int module_match_buffer ( RzAnalysis *  analysis, const RzFlirtModule *  module, ut8 *  b, ut64  address, ut32  buf_size  )

static

Checks if the module matches the buffer and renames the matched functions.

Parameters

analysis	The RzAnalysis struct from where to fetch and modify the functions
module	The FLIRT module to match against the buffer
b	Buffer to check
address	Function address
buf_size	Size of the buffer to check

Returns

True if pattern does match, false otherwise.

Definition at line 359 of file flirt.c.

                                                                                                                       {
    RzFlirtFunction *flirt_func;
    RzAnalysisFunction *next_module_function;
    RzListIter *tail_byte_it, *flirt_func_it;
    RzFlirtTailByte *tail_byte;
    ut32 name_index = 0;
 
    if (32 + module->crc_length < buf_size &&
        module->crc16 != flirt_crc16(b + 32, module->crc_length)) {
        return false;
    }
    if (module->tail_bytes) {
        rz_list_foreach (module->tail_bytes, tail_byte_it, tail_byte) {
            if (32 + module->crc_length + tail_byte->offset < buf_size &&
                b[32 + module->crc_length + tail_byte->offset] != tail_byte->value) {
                return false;
            }
        }
    }
 
    rz_list_foreach (module->public_functions, flirt_func_it, flirt_func) {
        // Once the first module function is found, we need to go through the module->public_functions
        // list to identify the others. See flirt doc for more information
 
        next_module_function = rz_analysis_get_function_at((RzAnalysis *)analysis, address + flirt_func->offset);
        if (next_module_function) {
            ut32 next_module_function_size;
 
            // get function size from flirt signature
            ut64 flirt_fcn_size = module->length - flirt_func->offset;
            RzFlirtFunction *next_flirt_func;
            RzListIter *next_flirt_func_it = flirt_func_it->n;
            while (next_flirt_func_it) {
                next_flirt_func = next_flirt_func_it->data;
                if (!next_flirt_func->is_local && !next_flirt_func->negative_offset) {
                    flirt_fcn_size = next_flirt_func->offset - flirt_func->offset;
                    break;
                }
                next_flirt_func_it = next_flirt_func_it->n;
            }
            // resize function if needed
            next_module_function_size = rz_analysis_function_linear_size(next_module_function);
            if (next_module_function_size < flirt_fcn_size) {
                RzListIter *iter;
                RzListIter *iter_tmp;
                RzAnalysisFunction *fcn;
                rz_list_foreach_safe (analysis->fcns, iter, iter_tmp, fcn) {
                    if (fcn != next_module_function &&
                        fcn->addr >= next_module_function->addr + next_module_function_size &&
                        fcn->addr < next_module_function->addr + flirt_fcn_size) {
                        RzListIter *iter_bb;
                        RzAnalysisBlock *block;
                        rz_list_foreach (fcn->bbs, iter_bb, block) {
                            rz_analysis_function_add_block(next_module_function, block);
                        }
                        next_module_function->ninstr += fcn->ninstr;
                        rz_analysis_function_delete(fcn);
                    }
                }
                rz_analysis_function_resize(next_module_function, flirt_fcn_size);
                next_module_function_size = rz_analysis_function_linear_size(next_module_function);
                rz_analysis_trim_jmprefs((RzAnalysis *)analysis, next_module_function);
            }
 
            // filter name
            rz_name_filter(flirt_func->name, -1, true);
 
            // verify that the name is unique
            char *name = rz_str_newf("flirt.%s", flirt_func->name);
            if (!name) {
                RZ_LOG_ERROR("FLIRT: cannot allocate string buffer for name\n");
                return false;
            }
 
            while (!rz_analysis_function_rename(next_module_function, name)) {
                free(name);
                name_index++;
                name = rz_str_newf("flirt.%s_%u", flirt_func->name, name_index);
                if (!name) {
                    RZ_LOG_ERROR("FLIRT: cannot allocate string buffer for name\n");
                    return false;
                }
            }
 
            // remove old flag
            RzFlagItem *fit = analysis->flb.get_at_by_spaces(analysis->flb.f, next_module_function->addr, "fcn.", "func.", NULL);
            if (fit) {
                analysis->flb.unset(analysis->flb.f, fit);
            }
 
            // set new flag
            analysis->flb.set(analysis->flb.f, name, next_module_function->addr, next_module_function_size);
            RZ_LOG_DEBUG("FLIRT: Found %s\n", next_module_function->name);
            free(name);
        }
    }
    return true;
}

References rz_analysis_function_t::addr, b, rz_analysis_function_t::bbs, buf_size, rz_list_iter_t::data, rz_flag_bind_t::f, rz_analysis_t::fcns, rz_analysis_t::flb, flirt_crc16(), free(), rz_flag_bind_t::get_at_by_spaces, rz_flirt_function_t::is_local, rz_list_iter_t::n, rz_analysis_function_t::name, rz_flirt_function_t::name, rz_flirt_function_t::negative_offset, rz_analysis_function_t::ninstr, NULL, rz_flirt_tail_byte_t::offset, rz_flirt_function_t::offset, rz_analysis_function_add_block(), rz_analysis_function_delete(), rz_analysis_function_linear_size(), rz_analysis_function_rename(), rz_analysis_function_resize(), rz_analysis_get_function_at(), rz_analysis_trim_jmprefs(), RZ_LOG_DEBUG, RZ_LOG_ERROR, rz_name_filter(), rz_str_newf(), rz_flag_bind_t::set, rz_flag_bind_t::unset, ut64(), and rz_flirt_tail_byte_t::value.

Referenced by node_match_buffer().

node_match_buffer()

static int node_match_buffer ( RzAnalysis *  analysis, const RzFlirtNode *  node, ut8 *  b, ut64  address, ut32  buf_size, ut32  buf_idx  )

static

Definition at line 458 of file flirt.c.

                                                                                                                               {
    RzListIter *node_child_it, *module_it;
    RzFlirtNode *child;
    RzFlirtModule *module;
 
    if (is_pattern_matching(node->length, node->pattern_bytes, node->pattern_mask, b + buf_idx, buf_size - buf_idx)) {
        if (node->child_list) {
            rz_list_foreach (node->child_list, node_child_it, child) {
                if (node_match_buffer(analysis, child, b, address, buf_size, buf_idx + node->length)) {
                    return true;
                }
            }
        } else if (node->module_list) {
            rz_list_foreach (node->module_list, module_it, module) {
                if (module_match_buffer(analysis, module, b, address, buf_size)) {
                    return true;
                }
            }
        }
    }
 
    return false;
}

References b, buf_size, rz_flirt_node_t::child_list, is_pattern_matching(), rz_flirt_node_t::length, rz_flirt_node_t::module_list, module_match_buffer(), rz_flirt_node_t::pattern_bytes, and rz_flirt_node_t::pattern_mask.

Referenced by node_match_functions().

node_match_functions()

static bool node_match_functions ( RzAnalysis *  analysis, const RzFlirtNode *  root_node  )

static

Tries to find matching functions between the signature infos in root_node and the analyzed functions in analysis.

Parameters

analysis	The analysis
root_node	The root node

Returns

False on error, otherwise true

Definition at line 490 of file flirt.c.

                                                                                     {
    bool ret = true;
 
    if (rz_list_length(analysis->fcns) == 0) {
        RZ_LOG_ERROR("FLIRT: There are no analyzed functions. Have you run 'aa'?\n");
        return ret;
    }
 
    analysis->flb.push_fs(analysis->flb.f, "flirt");
    RzListIter *it_func;
    RzAnalysisFunction *func;
    rz_list_foreach (analysis->fcns, it_func, func) {
        if (func->type != RZ_ANALYSIS_FCN_TYPE_FCN && func->type != RZ_ANALYSIS_FCN_TYPE_LOC) { // scan only for unknown functions
            continue;
        }
 
        ut64 func_size = rz_analysis_function_linear_size(func);
        ut8 *func_buf = malloc(func_size);
        if (!func_buf) {
            ret = false;
            break;
        }
        if (!analysis->iob.read_at(analysis->iob.io, func->addr, func_buf, (int)func_size)) {
            RZ_LOG_ERROR("FLIRT: Couldn't read function %s at 0x%" PFMT64x "\n", func->name, func->addr);
            RZ_FREE(func_buf);
            ret = false;
            break;
        }
        RzListIter *node_child_it;
        RzFlirtNode *child;
        rz_list_foreach (root_node->child_list, node_child_it, child) {
            if (node_match_buffer(analysis, child, func_buf, func->addr, func_size, 0)) {
                break;
            }
        }
        RZ_FREE(func_buf);
    }
    analysis->flb.pop_fs(analysis->flb.f);
 
    return ret;
}

References rz_analysis_function_t::addr, rz_flirt_node_t::child_list, rz_flag_bind_t::f, rz_analysis_t::fcns, rz_analysis_t::flb, rz_io_bind_t::io, rz_analysis_t::iob, malloc(), rz_analysis_function_t::name, node_match_buffer(), PFMT64x, rz_flag_bind_t::pop_fs, rz_flag_bind_t::push_fs, rz_io_bind_t::read_at, RZ_ANALYSIS_FCN_TYPE_FCN, RZ_ANALYSIS_FCN_TYPE_LOC, rz_analysis_function_linear_size(), RZ_FREE, rz_list_length(), RZ_LOG_ERROR, rz_analysis_function_t::type, and ut64().

Referenced by rz_sign_flirt_apply().

parse_leaf()

static ut8 parse_leaf ( ParseStatus *  b, RzFlirtNode *  node  )

static

Definition at line 762 of file flirt.c.

                                                         {
    /* parses a signature leaf: modules with same leading pattern */
    /* returns false on parsing error */
    ut8 flags, crc_length;
    ut16 crc16;
    RzFlirtModule *module = NULL;
 
    node->module_list = rz_list_newf((RzListFree)module_free);
    do { // loop for all modules having the same prefix
 
        crc_length = read_byte(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read crc16 length.\n");
            goto err_exit;
        }
        crc16 = read_short(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read crc16.\n");
            goto err_exit;
        }
        sig_dbg("dbg: crc_len: %02X crc16: %04X\n", crc_length, crc16);
 
        do { // loop for all modules having the same crc
            module = RZ_NEW0(RzFlirtModule);
            if (!module) {
                RZ_LOG_ERROR("FLIRT: failed to allocate RzFlirtModule.\n");
                goto err_exit;
            }
 
            module->crc_length = crc_length;
            module->crc16 = crc16;
 
            if (b->version >= 9) { // seems like version 9 introduced some larger length
                /*/!\ XXX don't trust ./zipsig output because it will write a version 9 header, but keep the old version offsets*/
                module->length = read_multiple_bytes(b); // should be < 0x8000
                if (is_status_err_or_eof(b)) {
                    RZ_LOG_ERROR("FLIRT: failed to read module length because EOF (version >= 9).\n");
                    goto err_exit;
                }
            } else {
                module->length = read_max_2_bytes(b); // should be < 0x8000
                if (is_status_err_or_eof(b)) {
                    RZ_LOG_ERROR("FLIRT: failed to read module length because EOF.\n");
                    goto err_exit;
                }
            }
            sig_dbg("dbg: module_length: %04X\n", module->length);
 
            if (!read_module_public_functions(module, b, &flags)) {
                goto err_exit;
            }
 
            if (flags & IDASIG_PARSE_READ_TAIL_BYTES) { // we need to read some tail bytes because in this leaf we have functions with same crc
                if (!read_module_tail_bytes(module, b)) {
                    goto err_exit;
                }
            }
            if (flags & IDASIG_PARSE_READ_REFERENCED_FUNCTIONS) { // we need to read some referenced functions
                if (!read_module_referenced_functions(module, b)) {
                    goto err_exit;
                }
            }
 
            rz_list_append(node->module_list, module);
        } while (flags & IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC);
    } while (flags & IDASIG_PARSE_MORE_MODULES); // same prefix but different crc
 
    return true;
 
err_exit:
    module_free(module);
    return false;
}

References b, flags, IDASIG_PARSE_MORE_MODULES, IDASIG_PARSE_MORE_MODULES_WITH_SAME_CRC, IDASIG_PARSE_READ_REFERENCED_FUNCTIONS, IDASIG_PARSE_READ_TAIL_BYTES, is_status_err_or_eof, module_free(), rz_flirt_node_t::module_list, NULL, read_byte(), read_max_2_bytes(), read_module_public_functions(), read_module_referenced_functions(), read_module_tail_bytes(), read_multiple_bytes(), read_short(), rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, and sig_dbg.

Referenced by parse_tree().

parse_tree()

static ut8 parse_tree ( ParseStatus *  b, RzFlirtNode *  root_node  )

static

Definition at line 902 of file flirt.c.

                                                              {
    /* parse a signature pattern tree or sub-tree */
    /* returns false on parsing error */
    RzFlirtNode *node = NULL;
    int i, tree_nodes = read_multiple_bytes(b); // confirmed it's not read_byte(), XXX could it be read_max_2_bytes() ???
    if (is_status_err_or_eof(b)) {
        RZ_LOG_ERROR("FLIRT: failed to read tree node number because EOF.\n");
        return false;
    }
    sig_dbg("dbg: tree_nodes %02x\n", tree_nodes);
    if (tree_nodes == 0) { // if there's no tree nodes remaining, that means we are on the leaf
        return parse_leaf(b, root_node);
    }
    root_node->child_list = rz_list_newf((RzListFree)rz_sign_flirt_node_free);
 
    for (i = 0; i < tree_nodes; i++) {
        if (!(node = RZ_NEW0(RzFlirtNode))) {
            RZ_LOG_ERROR("FLIRT: failed to allocate child tree node.\n");
            goto err_exit;
        }
        if (!read_node_length(node, b) || node->length > 0x40) {
            RZ_LOG_ERROR("FLIRT: failed to read pattern mask length (length %u).\n", node->length);
            goto err_exit;
        }
        if (!read_node_variant_mask(node, b)) {
            RZ_LOG_ERROR("FLIRT: failed to read variant mask.\n");
            goto err_exit;
        }
        if (!read_node_bytes(node, b)) {
            RZ_LOG_ERROR("FLIRT: failed to read pattern.\n");
            goto err_exit;
        }
        if (!parse_tree(b, node)) {
            goto err_exit; // parse child nodes
        }
        rz_list_append(root_node->child_list, node);
    }
    return true;
err_exit:
    rz_sign_flirt_node_free(node);
    return false;
}

References b, rz_flirt_node_t::child_list, i, is_status_err_or_eof, rz_flirt_node_t::length, NULL, parse_leaf(), read_multiple_bytes(), read_node_bytes(), read_node_length(), read_node_variant_mask(), rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, rz_sign_flirt_node_free(), and sig_dbg.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer().

parse_v10_header()

static int parse_v10_header ( RzBuffer *  buf, idasig_v10_t *  header  )

static

Definition at line 1005 of file flirt.c.

                                                                 {
    if (!rz_buf_read_le16(buf, &header->unknown)) {
        RZ_LOG_ERROR("FLIRT: invalid sig file (EOF in v10 header).\n");
        return false;
    }
 
    return true;
}

References header, rz_buf_read_le16, and RZ_LOG_ERROR.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer(), and rz_sign_flirt_parse_header_compressed_pattern_from_buffer().

parse_v5_header()

static bool parse_v5_header ( RzBuffer *  buf, idasig_v5_t *  header  )

static

Definition at line 945 of file flirt.c.

                                                                {
    rz_buf_seek(buf, 0, RZ_BUF_SET);
    if (rz_buf_read(buf, header->magic, sizeof(header->magic)) != sizeof(header->magic)) {
        return false;
    }
    if (rz_buf_read(buf, &header->version, sizeof(header->version)) != sizeof(header->version)) {
        return false;
    }
    if (rz_buf_read(buf, &header->arch, sizeof(header->arch)) != sizeof(header->arch)) {
        return false;
    }
    if (!rz_buf_read_le32(buf, &header->file_types)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->os_types)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->app_types)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->features)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->old_n_functions)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->crc16)) {
        return false;
    }
    if (rz_buf_read(buf, header->ctype, sizeof(header->ctype)) != sizeof(header->ctype)) {
        return false;
    }
    if (rz_buf_read(buf, (unsigned char *)&header->library_name_len, sizeof(header->library_name_len)) != sizeof(header->library_name_len)) {
        return false;
    }
    if (!rz_buf_read_le16(buf, &header->ctypes_crc16)) {
        return false;
    }
 
    return true;
}

References header, rz_buf_read(), rz_buf_read_le16, rz_buf_read_le32, rz_buf_seek(), and RZ_BUF_SET.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer(), and rz_sign_flirt_parse_header_compressed_pattern_from_buffer().

parse_v6_v7_header()

static int parse_v6_v7_header ( RzBuffer *  buf, idasig_v6_v7_t *  header  )

static

Definition at line 987 of file flirt.c.

                                                                     {
    if (!rz_buf_read_le32(buf, &header->n_functions)) {
        RZ_LOG_ERROR("FLIRT: invalid sig file (EOF in v6/v7 header).\n");
        return false;
    }
 
    return true;
}

References header, rz_buf_read_le32, and RZ_LOG_ERROR.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer(), and rz_sign_flirt_parse_header_compressed_pattern_from_buffer().

parse_v8_v9_header()

static int parse_v8_v9_header ( RzBuffer *  buf, idasig_v8_v9_t *  header  )

static

Definition at line 996 of file flirt.c.

                                                                     {
    if (!rz_buf_read_le16(buf, &header->pattern_size)) {
        RZ_LOG_ERROR("FLIRT: invalid sig file (EOF in v8/v9 header).\n");
        return false;
    }
 
    return true;
}

References header, rz_buf_read_le16, and RZ_LOG_ERROR.

Referenced by rz_sign_flirt_parse_compressed_pattern_from_buffer(), and rz_sign_flirt_parse_header_compressed_pattern_from_buffer().

read_byte()

static ut8 read_byte ( ParseStatus *  b )

static

Definition at line 230 of file flirt.c.

                                     {
    ut8 r = 0;
    int length;
 
    if (b->eof || b->error) {
        return 0;
    }
    if ((length = rz_buf_read(b->buffer, &r, 1)) != 1) {
        if (length == -1) {
            b->error = true;
        }
        if (length == 0) {
            b->eof = true;
        }
        return 0;
    }
    return r;
}

References b, length, r, and rz_buf_read().

Referenced by parse_leaf(), read_max_2_bytes(), read_module_public_functions(), read_module_referenced_functions(), read_module_tail_bytes(), read_multiple_bytes(), read_node_bytes(), read_node_length(), and read_short().

read_max_2_bytes()

static ut16 read_max_2_bytes ( ParseStatus *  b )

static

Definition at line 261 of file flirt.c.

                                             {
    ut16 r = read_byte(b);
    return (r & 0x80)
        ? ((r & 0x7f) << 8) + read_byte(b)
        : r;
}

References b, r, and read_byte().

Referenced by parse_leaf(), read_module_public_functions(), read_module_referenced_functions(), read_module_tail_bytes(), and read_node_variant_mask().

read_module_public_functions()

static ut8 read_module_public_functions ( RzFlirtModule *  module, ParseStatus *  b, ut8 *  flags  )

static

Definition at line 687 of file flirt.c.

                                                                                           {
    /* Reads and set the public functions names and offsets associated within a module */
    /* returns false on parsing error */
    int i;
    ut32 offset = 0;
    ut8 current_byte;
    RzFlirtFunction *function = NULL;
 
    module->public_functions = rz_list_newf((RzListFree)free);
 
    do {
        function = RZ_NEW0(RzFlirtFunction);
        if (b->version >= 9) { // seems like version 9 introduced some larger offsets
            offset += read_multiple_bytes(b); // offsets are dependent of the previous ones
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read public function offset because EOF (version >= 9).\n");
                goto err_exit;
            }
        } else {
            offset += read_max_2_bytes(b); // offsets are dependent of the previous ones
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read public function offset because EOF.\n");
                goto err_exit;
            }
        }
        function->offset = offset;
 
        current_byte = read_byte(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read public function flags because EOF.\n");
            goto err_exit;
        }
        if (current_byte < 0x20) {
            if (current_byte & IDASIG_FUNCTION_LOCAL) { // static function
                function->is_local = true;
            }
            if (current_byte & IDASIG_FUNCTION_UNRESOLVED_COLLISION) {
                // unresolved collision (happens in *.exc while creating .sig from .pat)
                function->is_collision = true;
            }
            current_byte = read_byte(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read public function current byte because EOF.\n");
                goto err_exit;
            }
        }
 
        for (i = 0; current_byte >= 0x20 && i < RZ_FLIRT_NAME_MAX; i++) {
            function->name[i] = current_byte;
            current_byte = read_byte(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read public function name[%u] because EOF.\n", i);
                goto err_exit;
            }
        }
 
        if (i == RZ_FLIRT_NAME_MAX) {
            RZ_LOG_WARN("FLIRT: public function name is too long\n");
            function->name[RZ_FLIRT_NAME_MAX - 1] = '\0';
        } else {
            function->name[i] = '\0';
        }
 
        sig_dbg("dbg: %04X: %s \n", function->offset, function->name);
        *flags = current_byte;
        rz_list_append(module->public_functions, function);
    } while (*flags & IDASIG_PARSE_MORE_PUBLIC_NAMES);
 
    return true;
 
err_exit:
    free(function);
    return false;
}

References b, flags, free(), i, IDASIG_FUNCTION_LOCAL, IDASIG_FUNCTION_UNRESOLVED_COLLISION, IDASIG_PARSE_MORE_PUBLIC_NAMES, is_status_err_or_eof, NULL, read_byte(), read_max_2_bytes(), read_multiple_bytes(), RZ_FLIRT_NAME_MAX, rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_LOG_WARN, RZ_NEW0, and sig_dbg.

Referenced by parse_leaf().

read_module_referenced_functions()

static ut8 read_module_referenced_functions ( RzFlirtModule *  module, ParseStatus *  b  )

static

Definition at line 597 of file flirt.c.

                                                                                   {
    /* parses a module referenced functions */
    /* returns false on parsing error */
    ut32 i, j;
    ut32 number_of_referenced_functions;
    ut32 ref_function_name_length;
    RzFlirtFunction *ref_function = NULL;
 
    module->referenced_functions = rz_list_newf((RzListFree)free);
 
    if (b->version == 8 || b->version == 9) {
        // this counter was introduced in version 8 and kept in version 9
        number_of_referenced_functions = read_max_2_bytes(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read referenced function count because EOF (version 8 or 9).\n");
            goto err_exit;
        }
    } else if (b->version > 9) {
        // this counter was changed from version 10
        number_of_referenced_functions = read_multiple_bytes(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read referenced function count because EOF (version > 9).\n");
            goto err_exit;
        }
    } else { // suppose there's only one
        number_of_referenced_functions = 1;
    }
    sig_dbg("dbg: n refs: %02X\n", number_of_referenced_functions);
 
    for (i = 0; i < number_of_referenced_functions; i++) {
        ref_function = RZ_NEW0(RzFlirtFunction);
        if (!ref_function) {
            RZ_LOG_ERROR("FLIRT: failed to allocate RzFlirtFunction.\n");
            goto err_exit;
        }
        if (b->version >= 9) {
            ref_function->offset = read_multiple_bytes(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read referenced function offset because EOF (version >= 9).\n");
                goto err_exit;
            }
        } else {
            ref_function->offset = read_max_2_bytes(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read referenced function offset because EOF.\n");
                goto err_exit;
            }
        }
        ref_function_name_length = read_byte(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read referenced function name length because EOF.\n");
            goto err_exit;
        }
        if (!ref_function_name_length) {
            // not sure why it's not read_multiple_bytes() in the first place
            ref_function_name_length = read_multiple_bytes(b); // XXX might be read_max_2_bytes, need more data
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read referenced function name length because EOF (2).\n");
                goto err_exit;
            }
        }
        if (ref_function_name_length >= RZ_FLIRT_NAME_MAX) {
            RZ_LOG_ERROR("FLIRT: invalid referenced function name length (%u >= %u).\n", ref_function_name_length, RZ_FLIRT_NAME_MAX);
            goto err_exit;
        }
        sig_dbg("dbg: REF length %02X\n", ref_function_name_length);
        for (j = 0; j < ref_function_name_length; j++) {
            ref_function->name[j] = read_byte(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read referenced function name[%u] because EOF.\n", j);
                goto err_exit;
            }
        }
        if (!ref_function->name[ref_function_name_length]) {
            // if the last byte of the name is 0, it means the offset is negative
            ref_function->negative_offset = true;
        } else {
            ref_function->name[ref_function_name_length] = '\0';
        }
        rz_list_append(module->referenced_functions, ref_function);
        sig_dbg("dbg: (REF: %04X: %s)\n", ref_function->offset, ref_function->name);
    }
 
    return true;
 
err_exit:
    free(ref_function);
    return false;
}

References b, free(), i, is_status_err_or_eof, rz_flirt_function_t::name, rz_flirt_function_t::negative_offset, NULL, rz_flirt_function_t::offset, read_byte(), read_max_2_bytes(), read_multiple_bytes(), RZ_FLIRT_NAME_MAX, rz_list_append(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, and sig_dbg.

Referenced by parse_leaf().

read_module_tail_bytes()

static ut8 read_module_tail_bytes ( RzFlirtModule *  module, ParseStatus *  b  )

static

Definition at line 532 of file flirt.c.

                                                                         {
    /* parses a module tail bytes */
    /* returns false on parsing error */
    int i;
    ut32 number_of_tail_bytes;
    RzFlirtTailByte *tail_byte = NULL;
    if (!(module->tail_bytes = rz_list_newf((RzListFree)free))) {
        RZ_LOG_ERROR("FLIRT: failed to allocate tail bytes list.\n");
        goto err_exit;
    }
 
    if (b->version == 8 || b->version == 9) {
        // this counter was introduced in version 8 and kept in version 9
        number_of_tail_bytes = read_max_2_bytes(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read referenced function count because EOF (version 8 or 9).\n");
            goto err_exit;
        }
    } else if (b->version > 9) {
        // this counter was changed from version 10
        number_of_tail_bytes = read_multiple_bytes(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read referenced function count because EOF (version > 9).\n");
            goto err_exit;
        }
    } else { // suppose there's only one
        number_of_tail_bytes = 1;
    }
 
    for (i = 0; i < number_of_tail_bytes; i++) {
        tail_byte = RZ_NEW0(RzFlirtTailByte);
        if (!tail_byte) {
            return false;
        }
        if (b->version >= 9) {
            /*/!\ XXX don't trust ./zipsig output because it will write a version 9 header, but keep the old version offsets*/
            tail_byte->offset = read_multiple_bytes(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read tail byte offset because EOF (version >= 9).\n");
                goto err_exit;
            }
        } else {
            tail_byte->offset = read_max_2_bytes(b);
            if (is_status_err_or_eof(b)) {
                RZ_LOG_ERROR("FLIRT: failed to read tail byte offset because EOF.\n");
                goto err_exit;
            }
        }
        tail_byte->value = read_byte(b);
        if (is_status_err_or_eof(b)) {
            RZ_LOG_ERROR("FLIRT: failed to read tail byte value because EOF.\n");
            goto err_exit;
        }
        rz_list_append(module->tail_bytes, tail_byte);
        sig_dbg("dbg: read tail byte: %04X: %02X\n", tail_byte->offset, tail_byte->value);
    }
 
    return true;
 
err_exit:
    free(tail_byte);
    rz_list_free(module->tail_bytes);
    return false;
}

References b, free(), i, is_status_err_or_eof, NULL, rz_flirt_tail_byte_t::offset, read_byte(), read_max_2_bytes(), read_multiple_bytes(), rz_list_append(), rz_list_free(), rz_list_newf(), RZ_LOG_ERROR, RZ_NEW0, sig_dbg, and rz_flirt_tail_byte_t::value.

Referenced by parse_leaf().

read_multiple_bytes()

static ut32 read_multiple_bytes ( ParseStatus *  b )

static

Definition at line 268 of file flirt.c.

                                                {
    ut32 r = read_byte(b);
    if ((r & 0x80) != 0x80) {
        return r;
    }
    if ((r & 0xc0) != 0xc0) {
        return ((r & 0x7f) << 8) + read_byte(b);
    }
    if ((r & 0xe0) != 0xe0) {
        r = ((r & 0x3f) << 24) + (read_byte(b) << 16);
        r += read_short(b);
        return r;
    }
    return read_word(b);
}

References b, r, read_byte(), read_short(), and read_word().

Referenced by parse_leaf(), parse_tree(), read_module_public_functions(), read_module_referenced_functions(), read_module_tail_bytes(), and read_node_variant_mask().

read_node_bytes()

static bool read_node_bytes ( RzFlirtNode *  node, ParseStatus *  b  )

static

Definition at line 870 of file flirt.c.

                                                               {
    /* Reads the node bytes, and also sets the variant bytes in pattern_mask */
    /* returns false on parsing error */
    int i;
    ut64 current_mask_bit = 0;
    if ((int)node->length < 0) {
        return false;
    }
    current_mask_bit = 1ULL << (node->length - 1);
    if (!(node->pattern_bytes = malloc(node->length))) {
        return false;
    }
    if (!(node->pattern_mask = malloc(node->length))) {
        return false;
    }
    for (i = 0; i < node->length; i++, current_mask_bit >>= 1) {
        if (node->variant_mask & current_mask_bit) {
            node->pattern_bytes[i] = 0;
            node->pattern_mask[i] = 0;
        } else {
            node->pattern_bytes[i] = read_byte(b);
            node->pattern_mask[i] = 0xFF;
            if (is_status_err_or_eof(b)) {
                return false;
            }
        }
    }
    sig_dbg_buffer("bytes", node->pattern_bytes, node->length);
    sig_dbg_buffer("mask ", node->pattern_mask, node->length);
    return true;
}

References b, i, is_status_err_or_eof, rz_flirt_node_t::length, malloc(), rz_flirt_node_t::pattern_bytes, rz_flirt_node_t::pattern_mask, read_byte(), sig_dbg_buffer, ut64(), and rz_flirt_node_t::variant_mask.

Referenced by parse_tree().

read_node_length()

static bool read_node_length ( RzFlirtNode *  node, ParseStatus *  b  )

static

Definition at line 836 of file flirt.c.

                                                                {
    node->length = read_byte(b);
    if (is_status_err_or_eof(b)) {
        return false;
    }
    sig_dbg("dbg: node length: %02X\n", node->length);
    return true;
}

References b, is_status_err_or_eof, rz_flirt_node_t::length, read_byte(), and sig_dbg.

Referenced by parse_tree().

read_node_variant_mask()

static bool read_node_variant_mask ( RzFlirtNode *  node, ParseStatus *  b  )

static

Definition at line 845 of file flirt.c.

                                                                      {
    /* Reads and sets a node's variant bytes mask. This mask is then used to */
    /* read the non-variant bytes following. */
    /* returns false on parsing error */
    if (node->length < 0x10) {
        node->variant_mask = read_max_2_bytes(b);
        if (is_status_err_or_eof(b)) {
            return false;
        }
    } else if (node->length <= 0x20) {
        node->variant_mask = read_multiple_bytes(b);
        if (is_status_err_or_eof(b)) {
            return false;
        }
    } else if (node->length <= 0x40) { // it shouldn't be more than 64 bytes
        node->variant_mask = ((ut64)read_multiple_bytes(b) << 32) + read_multiple_bytes(b);
        if (is_status_err_or_eof(b)) {
            return false;
        }
    }
 
    sig_dbg("dbg: variant_mask %08llx\n", node->variant_mask);
    return true;
}

References b, is_status_err_or_eof, rz_flirt_node_t::length, read_max_2_bytes(), read_multiple_bytes(), sig_dbg, ut64(), and rz_flirt_node_t::variant_mask.

Referenced by parse_tree().

read_short()

static ut16 read_short ( ParseStatus *  b )

static

Definition at line 249 of file flirt.c.

                                       {
    ut16 r = (read_byte(b) << 8);
    r += read_byte(b);
    return r;
}

References b, r, and read_byte().

Referenced by parse_leaf(), read_multiple_bytes(), and read_word().

read_word()

static ut32 read_word ( ParseStatus *  b )

static

Definition at line 255 of file flirt.c.

                                      {
    ut32 r = ((ut32)(read_short(b)) << 16);
    r += read_short(b);
    return r;
}

References b, r, and read_short().

Referenced by read_multiple_bytes().

rz_sign_flirt_apply()

RZ_API bool rz_sign_flirt_apply	(	RZ_NONNULL RzAnalysis *	analysis,
		RZ_NONNULL const char *	flirt_file,
		ut8	expected_arch
	)

Parses the FLIRT file and applies the signatures.

Parameters

analysis	The RzAnalysis structure
flirt_file	The FLIRT file to parse

Returns

true if the signatures were sucessfully applied to the file

Definition at line 1289 of file flirt.c.

                                                                                                                       {
    rz_return_val_if_fail(analysis && RZ_STR_ISNOTEMPTY(flirt_file), false);
    RzBuffer *flirt_buf = NULL;
    RzFlirtNode *node = NULL;
 
    if (expected_arch > RZ_FLIRT_SIG_ARCH_ANY) {
        RZ_LOG_ERROR("FLIRT: unknown architecture %u\n", expected_arch);
        return false;
    }
 
    const char *extension = rz_str_lchr(flirt_file, '.');
    if (RZ_STR_ISEMPTY(extension) || (strcmp(extension, ".sig") != 0 && strcmp(extension, ".pat") != 0)) {
        RZ_LOG_ERROR("FLIRT: unknown extension '%s'\n", extension);
        return false;
    }
 
    if (!(flirt_buf = rz_buf_new_slurp(flirt_file))) {
        RZ_LOG_ERROR("FLIRT: Can't open %s\n", flirt_file);
        return false;
    }
 
    if (!strcmp(extension, ".pat")) {
        node = rz_sign_flirt_parse_string_pattern_from_buffer(flirt_buf, RZ_FLIRT_NODE_OPTIMIZE_MAX, NULL);
    } else {
        node = rz_sign_flirt_parse_compressed_pattern_from_buffer(flirt_buf, expected_arch, NULL);
    }
 
    rz_buf_free(flirt_buf);
    if (node) {
        if (!node_match_functions(analysis, node)) {
            RZ_LOG_ERROR("FLIRT: Error while scanning the file %s\n", flirt_file);
        }
        rz_sign_flirt_node_free(node);
        return true;
    }
    RZ_LOG_ERROR("FLIRT: We encountered an error while parsing the file %s. Sorry.\n", flirt_file);
    return false;
}

References node_match_functions(), NULL, rz_buf_free(), rz_buf_new_slurp(), RZ_FLIRT_NODE_OPTIMIZE_MAX, RZ_FLIRT_SIG_ARCH_ANY, RZ_LOG_ERROR, rz_return_val_if_fail, rz_sign_flirt_node_free(), rz_sign_flirt_parse_compressed_pattern_from_buffer(), rz_sign_flirt_parse_string_pattern_from_buffer(), RZ_STR_ISEMPTY, RZ_STR_ISNOTEMPTY, and rz_str_lchr().

Referenced by rz_core_analysis_sigdb_apply(), and rz_flirt_scan_handler().

rz_sign_flirt_info_fini()

RZ_API void rz_sign_flirt_info_fini

(

RZ_NULLABLE RzFlirtInfo *

info

)

Frees an RzFlirtInfo struct elements without freeing the pointer.

Parameters

RzFlirtInfo

The RzFlirtInfo elements to be freed

Definition at line 315 of file flirt.c.

                                                                   {
    if (!info) {
        return;
    }
    if (info->type == RZ_FLIRT_FILE_TYPE_SIG) {
        free(info->u.sig.name);
    }
    memset(info, 0, sizeof(RzFlirtInfo));
}

References free(), info(), memset(), RZ_FLIRT_FILE_TYPE_SIG, and rz_bin_info_t::type.

Referenced by rz_core_flirt_dump_file(), and sigdb_signature_resolve_details().

rz_sign_flirt_node_count_nodes()

RZ_API ut32 rz_sign_flirt_node_count_nodes

(

RZ_NONNULL const RzFlirtNode *

node

)

Counts the number of FLIRT signatures in the node.

Parameters

flirt_file

The FLIRT node to use to count

Returns

Number of signatures

Definition at line 1334 of file flirt.c.

                                                                               {
    rz_return_val_if_fail(node, 0);
    ut32 count = 0;
    RzListIter *it;
    RzFlirtNode *child;
    rz_list_foreach (node->child_list, it, child) {
        count += rz_sign_flirt_node_count_nodes(child);
    }
    if (rz_list_length(node->module_list) > 0) {
        count += 1;
    }
    return count;
}

References count, rz_list_length(), rz_return_val_if_fail, and rz_sign_flirt_node_count_nodes().

Referenced by rz_core_flirt_create_file(), rz_sign_flirt_node_count_nodes(), rz_sign_flirt_parse_compressed_pattern_from_buffer(), rz_sign_flirt_parse_string_pattern_from_buffer(), and rz_sign_flirt_write_compressed_pattern_to_buffer().

rz_sign_flirt_node_free()

RZ_API void rz_sign_flirt_node_free

(

RZ_NULLABLE RzFlirtNode *

node

)

Frees an RzFlirtNode struct.

Parameters

RzFlirtNode

The RzFlirtNode to be freed

Definition at line 299 of file flirt.c.

                                                                   {
    if (!node) {
        return;
    }
    free(node->pattern_mask);
    free(node->pattern_bytes);
    rz_list_free(node->module_list);
    rz_list_free(node->child_list);
    free(node);
}

References free(), and rz_list_free().

Referenced by flirt_create_child(), flirt_create_child_from_analysis(), flirt_node_optimize(), flirt_node_shorten_and_insert(), flirt_pat_parse_line(), parse_tree(), rz_core_flirt_convert_file(), rz_core_flirt_create_file(), rz_core_flirt_dump_file(), rz_sign_flirt_apply(), rz_sign_flirt_node_new(), rz_sign_flirt_parse_string_pattern_from_buffer(), and sigdb_signature_resolve_details().

rz_sign_flirt_parse_compressed_pattern_from_buffer()

RZ_API RZ_OWN RzFlirtNode* rz_sign_flirt_parse_compressed_pattern_from_buffer	(	RZ_NONNULL RzBuffer *	flirt_buf,
		ut8	expected_arch,
		RZ_NULLABLE RzFlirtInfo *	info
	)

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode.

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode if expected_arch matches the id or RZ_FLIRT_SIG_ARCH_ANY is set.

Parameters

flirt_buf	The buffer to read
expected_arch	The expected arch to be used for the buffer
info	Pointer to a RzFlirtInfo that can be used to get info about the sig file

Returns

Parsed FLIRT node

Definition at line 1136 of file flirt.c.

                                                                                                                                                                {
    rz_return_val_if_fail(flirt_buf && expected_arch <= RZ_FLIRT_SIG_ARCH_ANY, NULL);
 
    ut8 *name = NULL;
    ut8 *buf = NULL, *decompressed_buf = NULL;
    RzBuffer *rz_buf = NULL;
    int size, decompressed_size;
    RzFlirtNode *node = NULL;
    RzFlirtNode *ret = NULL;
    idasig_v5_t *header = NULL;
    idasig_v6_v7_t *v6_v7 = NULL;
    idasig_v8_v9_t *v8_v9 = NULL;
    idasig_v10_t *v10 = NULL;
 
    ParseStatus ps = { 0 };
 
    if (!(ps.version = flirt_parse_version(flirt_buf))) {
        goto exit;
    }
 
    if (ps.version < 5 || ps.version > 10) {
        RZ_LOG_ERROR("FLIRT: Unsupported flirt signature version\n");
        goto exit;
    }
 
    if (!(header = RZ_NEW0(idasig_v5_t))) {
        goto exit;
    }
 
    parse_v5_header(flirt_buf, header);
 
    if (expected_arch != RZ_FLIRT_SIG_ARCH_ANY && header->arch != expected_arch) {
        RZ_LOG_ERROR("FLIRT: the binary architecture did not match the .sig one.\n");
        goto exit;
    }
 
    if (ps.version >= 6) {
        if (!(v6_v7 = RZ_NEW0(idasig_v6_v7_t))) {
            goto exit;
        }
        if (!parse_v6_v7_header(flirt_buf, v6_v7)) {
            goto exit;
        }
 
        if (ps.version >= 8) {
            if (!(v8_v9 = RZ_NEW0(idasig_v8_v9_t))) {
                goto exit;
            }
            if (!parse_v8_v9_header(flirt_buf, v8_v9)) {
                goto exit;
            }
 
            if (ps.version >= 10) {
                if (!(v10 = RZ_NEW0(idasig_v10_t))) {
                    goto exit;
                }
                if (!parse_v10_header(flirt_buf, v10)) {
                    goto exit;
                }
            }
        }
    }
 
    name = malloc(header->library_name_len + 1);
    if (!name) {
        RZ_LOG_ERROR("FLIRT: failed to allocate library name\n");
        goto exit;
    }
 
    if (rz_buf_read(flirt_buf, name, header->library_name_len) != header->library_name_len) {
        RZ_LOG_ERROR("FLIRT: failed to read library name\n");
        goto exit;
    }
 
    name[header->library_name_len] = '\0';
 
    size = rz_buf_size(flirt_buf) - rz_buf_tell(flirt_buf);
    buf = malloc(size);
    if (!buf) {
        RZ_LOG_ERROR("FLIRT: failed to allocate buffer for signature body\n");
        goto exit;
    }
 
    if (rz_buf_read(flirt_buf, buf, size) != size) {
        RZ_LOG_ERROR("FLIRT: failed to read signature body\n");
        goto exit;
    }
 
    if (header->features & IDASIG_FEATURE_COMPRESSED) {
        if (ps.version >= 5 && ps.version < 7) {
            if (!(decompressed_buf = rz_inflate_ignore_header(buf, size, NULL, &decompressed_size))) {
                RZ_LOG_ERROR("FLIRT: Failed to decompress buffer.\n");
                goto exit;
            }
        } else if (ps.version >= 7) {
            if (!(decompressed_buf = rz_inflate(buf, size, NULL, &decompressed_size))) {
                RZ_LOG_ERROR("FLIRT: Failed to decompress buffer.\n");
                goto exit;
            }
        } else {
            RZ_LOG_ERROR("FLIRT: Sorry we do not support compressed signatures with version %d.\n", ps.version);
            goto exit;
        }
 
        RZ_FREE(buf);
        buf = decompressed_buf;
        size = decompressed_size;
    }
    rz_buf = rz_buf_new_with_pointers(buf, size, false);
    if (!rz_buf) {
        RZ_LOG_ERROR("FLIRT: failed to allocate new RzBuffer\n");
        goto exit;
    }
    ps.buffer = rz_buf;
 
    if (!(node = RZ_NEW0(RzFlirtNode))) {
        RZ_LOG_ERROR("FLIRT: failed to allocate root RzFlirtNode\n");
        goto exit;
    }
 
    if (parse_tree(&ps, node)) {
        ret = node;
    } else {
        free(node);
    }
 
    if (info && ret) {
        info->type = RZ_FLIRT_FILE_TYPE_SIG;
        info->u.sig.version = ps.version;
        info->u.sig.architecture = header->arch;
        info->u.sig.n_modules = rz_sign_flirt_node_count_nodes(ret);
        info->u.sig.name = (char *)name;
        name = NULL;
    }
 
exit:
    free(buf);
    rz_buf_free(rz_buf);
    free(header);
    free(v6_v7);
    free(v8_v9);
    free(v10);
    free(name);
    return ret;
}

References parse_status_t::buffer, test-lz4-list::exit, flirt_parse_version(), free(), header, IDASIG_FEATURE_COMPRESSED, info(), malloc(), NULL, parse_tree(), parse_v10_header(), parse_v5_header(), parse_v6_v7_header(), parse_v8_v9_header(), rz_buf_free(), rz_buf_new_with_pointers(), rz_buf_read(), rz_buf_size(), rz_buf_tell(), RZ_FLIRT_FILE_TYPE_SIG, RZ_FLIRT_SIG_ARCH_ANY, RZ_FREE, rz_inflate(), rz_inflate_ignore_header(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, rz_sign_flirt_node_count_nodes(), rz_bin_info_t::type, and parse_status_t::version.

Referenced by rz_core_flirt_convert_file(), rz_core_flirt_dump_file(), and rz_sign_flirt_apply().

rz_sign_flirt_parse_header_compressed_pattern_from_buffer()

RZ_API RZ_OWN bool rz_sign_flirt_parse_header_compressed_pattern_from_buffer	(	RZ_NONNULL RzBuffer *	flirt_buf,
		RZ_NONNULL RzFlirtInfo *	info
	)

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtInfo.

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode if expected_arch matches the id or RZ_FLIRT_SIG_ARCH_ANY is set.

Parameters

flirt_buf	The buffer to read
expected_arch	The expected arch to be used for the buffer
info	Pointer to a RzFlirtInfo that can be used to get info about the sig file

Returns

Parsed FLIRT node

Definition at line 1062 of file flirt.c.

                                                                                                                                           {
    rz_return_val_if_fail(flirt_buf && info, false);
 
    bool res = false;
    ut8 *name = NULL;
    idasig_v5_t v5 = { 0 };
    idasig_v6_v7_t v6_v7 = { 0 };
    idasig_v8_v9_t v8_v9 = { 0 };
    idasig_v10_t v10 = { 0 };
 
    if (!parse_v5_header(flirt_buf, &v5)) {
        RZ_LOG_ERROR("FLIRT: invalid sig header.\n");
        goto exit;
    }
 
    if (memcmp((const char *)v5.magic, "IDASGN", 6)) {
        RZ_LOG_ERROR("FLIRT: invalid sig magic.\n");
        goto exit;
    }
 
    if (v5.version < 5 || v5.version > 10) {
        RZ_LOG_ERROR("FLIRT: Unsupported flirt signature version\n");
        goto exit;
    }
 
    if (v5.version >= 6 && !parse_v6_v7_header(flirt_buf, &v6_v7)) {
        goto exit;
    }
 
    if (v5.version >= 8 && !parse_v8_v9_header(flirt_buf, &v8_v9)) {
        goto exit;
    }
 
    if (v5.version >= 10 && !parse_v10_header(flirt_buf, &v10)) {
        goto exit;
    }
 
    name = malloc(v5.library_name_len + 1);
    if (!name) {
        RZ_LOG_ERROR("FLIRT: failed to allocate library name\n");
        goto exit;
    }
 
    if (rz_buf_read(flirt_buf, name, v5.library_name_len) != v5.library_name_len) {
        RZ_LOG_ERROR("FLIRT: failed to read library name\n");
        goto exit;
    }
 
    name[v5.library_name_len] = '\0';
 
    info->type = RZ_FLIRT_FILE_TYPE_SIG;
    info->u.sig.version = v5.version;
    info->u.sig.architecture = v5.arch;
    info->u.sig.n_modules = v5.version < 6 ? v5.old_n_functions : v6_v7.n_functions;
    info->u.sig.name = (char *)name;
    name = NULL;
    res = true;
 
exit:
    free(name);
    return res;
}

References idasig_v5_t::arch, test-lz4-list::exit, free(), info(), idasig_v5_t::library_name_len, idasig_v5_t::magic, malloc(), idasig_v6_v7_t::n_functions, NULL, idasig_v5_t::old_n_functions, parse_v10_header(), parse_v5_header(), parse_v6_v7_header(), parse_v8_v9_header(), rz_buf_read(), RZ_FLIRT_FILE_TYPE_SIG, RZ_LOG_ERROR, rz_return_val_if_fail, rz_bin_info_t::type, and idasig_v5_t::version.

Referenced by sigdb_signature_resolve_details().

rz_sign_flirt_write_compressed_pattern_to_buffer()

RZ_API bool rz_sign_flirt_write_compressed_pattern_to_buffer	(	RZ_NONNULL const RzFlirtNode *	node,
		RZ_NONNULL RzBuffer *	buffer,
		RzFlirtCompressedOptions *	options
	)

Writes in the the RzBuffer the FLIRT signatures in compressed format.

Parameters

node	The FLIRT node to use as input
buffer	The buffer to write to

Returns

Parsed FLIRT node

Definition at line 1580 of file flirt.c.

                                                                                                                                                                 {
    rz_return_val_if_fail(node && buffer && options, false);
    RzBuffer *body = buffer;
 
    if (options->version < 5 || options->version > 10) {
        RZ_LOG_ERROR("FLIRT: unsupported sig type version %u\n", options->version);
        return false;
    } else if (options->arch >= RZ_FLIRT_SIG_ARCH_ANY) {
        RZ_LOG_ERROR("FLIRT: unsupported architecture %u\n", options->arch);
        return false;
    } else if (RZ_STR_ISEMPTY(options->libname)) {
        RZ_LOG_ERROR("FLIRT: library name is empty\n");
        return false;
    }
 
    size_t library_name_len = strlen(options->libname);
    if (library_name_len > RZ_FLIRT_LIBRARY_NAME_MAX) {
        RZ_LOG_ERROR("FLIRT: library name is too big. max size is %u\n", RZ_FLIRT_LIBRARY_NAME_MAX);
        return false;
    }
 
    if (options->deflate) {
        if (options->version < 7) {
            RZ_LOG_ERROR("FLIRT: cannot deflate body due FLIRT version being < 7\n");
            return false;
        }
 
        body = rz_buf_new_empty(0);
        if (!body) {
            RZ_LOG_ERROR("FLIRT: cannot allocate body buffer\n");
            return false;
        }
    }
 
    ut8 tmp[32];
    ut32 n_functions = rz_sign_flirt_node_count_nodes(node);
 
    // magic
    rz_buf_append_string(buffer, "IDASGN");
 
    // version
    rz_buf_append_le_bits(buffer, tmp, options->version, 8);
 
    // arch
    rz_buf_append_le_bits(buffer, tmp, options->arch, 8);
 
    // file_types (little endian)
    rz_buf_append_le_bits(buffer, tmp, options->file, 32);
 
    // os_types (little endian)
    rz_buf_append_le_bits(buffer, tmp, options->os, 16);
 
    // app_types (little endian)
    rz_buf_append_le_bits(buffer, tmp, options->app, 16);
 
    // features (little endian)
    rz_buf_append_le_bits(buffer, tmp, options->deflate ? IDASIG_FEATURE_COMPRESSED : IDASIG_FEATURE_NONE, 16);
 
    // n_functions (little endian) - used only in v5.
    rz_buf_append_le_bits(buffer, tmp, options->version >= 6 ? 0 : n_functions, 16);
 
    // crc16 (little endian)
    rz_buf_append_le_bits(buffer, tmp, 0, 16);
 
    // ctype (little endian)
    memset(tmp, 0, 12);
    rz_buf_append_bytes(buffer, tmp, 12);
 
    // library_name_len (max 255)
    rz_buf_append_le_bits(buffer, tmp, library_name_len, 8);
 
    // crc16_ctypes (little endian)
    rz_buf_append_le_bits(buffer, tmp, IDASIG_FEATURE_NONE, 16);
 
    if (options->version >= 6) {
        // n_functions (little endian)
        rz_buf_append_le_bits(buffer, tmp, n_functions, 32);
    }
 
    if (options->version >= 8) {
        // pattern_size (little endian) - we always use 32 bytes prelude
        rz_buf_append_le_bits(buffer, tmp, 32, 16);
    }
 
    if (options->version >= 10) {
        // unknown (little endian)
        rz_buf_append_le_bits(buffer, tmp, 0, 16);
    }
 
    // library name
    rz_buf_append_string(buffer, options->libname);
 
    if (!flirt_write_node(node, body, options->version)) {
        rz_buf_free(body);
        return false;
    }
 
    bool ret = true;
    if (options->deflate) {
        ut64 block_size = 1ull << 20; // 1 Mb
        if (!rz_deflatew_buf(body, buffer, block_size, NULL, 15)) {
            RZ_LOG_ERROR("FLIRT: cannot deflate body\n");
            ret = false;
        }
        rz_buf_free(body);
    }
    return ret;
}

References flirt_write_node(), IDASIG_FEATURE_COMPRESSED, IDASIG_FEATURE_NONE, memset(), NULL, options, rz_buf_append_bytes(), rz_buf_append_le_bits, rz_buf_append_string(), rz_buf_free(), rz_buf_new_empty(), rz_deflatew_buf(), RZ_FLIRT_LIBRARY_NAME_MAX, RZ_FLIRT_SIG_ARCH_ANY, RZ_LOG_ERROR, rz_return_val_if_fail, rz_sign_flirt_node_count_nodes(), RZ_STR_ISEMPTY, autogen_x86imm::tmp, and ut64().

Referenced by rz_core_flirt_convert_file(), and rz_core_flirt_create_file().

rz_write_versioned_vle()

static bool rz_write_versioned_vle ( RzBuffer *  buffer, ut32  value, ut8  version  )

static

Definition at line 1406 of file flirt.c.

                                                                              {
    if (version < 9) {
        return rz_write_vle16(buffer, value);
    }
    return rz_write_vle32(buffer, value);
}

References rz_write_vle16(), rz_write_vle32(), and value.

Referenced by flirt_write_module().

rz_write_vle16()

static bool rz_write_vle16 ( RzBuffer *  buffer, ut16  val  )

inlinestatic

Definition at line 1348 of file flirt.c.

                                                              {
    ut8 tmp[10];
    ut32 n_bytes = 0;
    if (val > 0x7FFF) {
        RZ_LOG_ERROR("FLIRT: the variable length value is too big\n");
        return false;
    } else if (val > 0x7F) {
        // 16 bit value with max value 0x1FFF
        n_bytes = 2;
        tmp[0] = 0x80 | (val >> 8);
        tmp[1] = val & 0xFF;
    } else {
        // 8 bit value with max value 0x1F
        n_bytes = 1;
        tmp[0] = val;
    }
    rz_buf_append_bytes(buffer, tmp, n_bytes);
    return true;
}

References rz_buf_append_bytes(), RZ_LOG_ERROR, autogen_x86imm::tmp, and val.

Referenced by flirt_write_module(), flirt_write_node(), and rz_write_versioned_vle().

rz_write_vle32()

static bool rz_write_vle32 ( RzBuffer *  buffer, ut32  val  )

inlinestatic

Definition at line 1368 of file flirt.c.

                                                              {
    ut8 tmp[10];
    ut32 n_bytes = 0;
 
    if (val > 0x1FFFFFFF) {
        n_bytes = 5;
        tmp[0] = 0xFF; // includes the 0xE0 mask
        tmp[1] = (val >> 24) & 0xFF;
        tmp[2] = (val >> 16) & 0xFF;
        tmp[3] = (val >> 8) & 0xFF;
        tmp[4] = val & 0xFF;
    } else if (val > 0x3FFF) {
        n_bytes = 4;
        tmp[0] = 0xC0 | ((val >> 24) & 0x3F);
        tmp[1] = (val >> 16) & 0xFF;
        tmp[2] = (val >> 8) & 0xFF;
        tmp[3] = val & 0xFF;
    } else if (val > 0x7F) {
        n_bytes = 2;
        tmp[0] = 0x80 | ((val >> 8) & 0x3F);
        tmp[1] = val & 0xFF;
    } else {
        n_bytes = 1;
        tmp[0] = val;
    }
 
    rz_buf_append_bytes(buffer, tmp, n_bytes);
    return true;
}

References rz_buf_append_bytes(), autogen_x86imm::tmp, and val.

Referenced by flirt_write_module(), flirt_write_node(), rz_write_versioned_vle(), and rz_write_vle64().

rz_write_vle64()

static bool rz_write_vle64 ( RzBuffer *  buffer, ut64  val  )

inlinestatic

Definition at line 1398 of file flirt.c.

                                                              {
    return rz_write_vle32(buffer, (val >> 32) & UT32_MAX) && rz_write_vle32(buffer, val & UT32_MAX);
}

References rz_write_vle32(), UT32_MAX, and val.

Referenced by flirt_write_node().