Rizin
unix-like reverse engineering framework and cli tools
Classes | Macros | Typedefs | Enumerations | Functions
rz_flirt.h File Reference
#include <rz_types.h>
#include <rz_list.h>
#include <rz_analysis.h>

Go to the source code of this file.

Classes

struct  rz_flirt_tail_byte_t
 
struct  rz_flirt_function_t
 
struct  rz_flirt_module_t
 
struct  rz_flirt_node_t
 
struct  rz_flirt_sig_info_t
 
struct  rz_flirt_pat_info_t
 
struct  rz_flirt_info_t
 
struct  rz_flirt_compressed_options_t
 
struct  rz_signature_database_entry_t
 
struct  rz_signature_db_t
 

Macros

#define RZ_FLIRT_NAME_MAX   1024
 
#define RZ_FLIRT_LIBRARY_NAME_MAX   0xFF
 
#define RZ_FLIRT_LIBRARY_NAME_DFL   "Built with rizin " RZ_VERSION
 
#define RZ_FLIRT_MAX_PRELUDE_SIZE   (32)
 
#define RZ_FLIRT_SIG_FILE_DOS_EXE_OLD   0x00000001
 
#define RZ_FLIRT_SIG_FILE_DOS_COM_OLD   0x00000002
 
#define RZ_FLIRT_SIG_FILE_BIN   0x00000004
 
#define RZ_FLIRT_SIG_FILE_DOSDRV   0x00000008
 
#define RZ_FLIRT_SIG_FILE_NE   0x00000010
 
#define RZ_FLIRT_SIG_FILE_INTELHEX   0x00000020
 
#define RZ_FLIRT_SIG_FILE_MOSHEX   0x00000040
 
#define RZ_FLIRT_SIG_FILE_LX   0x00000080
 
#define RZ_FLIRT_SIG_FILE_LE   0x00000100
 
#define RZ_FLIRT_SIG_FILE_NLM   0x00000200
 
#define RZ_FLIRT_SIG_FILE_COFF   0x00000400
 
#define RZ_FLIRT_SIG_FILE_PE   0x00000800
 
#define RZ_FLIRT_SIG_FILE_OMF   0x00001000
 
#define RZ_FLIRT_SIG_FILE_SREC   0x00002000
 
#define RZ_FLIRT_SIG_FILE_ZIP   0x00004000
 
#define RZ_FLIRT_SIG_FILE_OMFLIB   0x00008000
 
#define RZ_FLIRT_SIG_FILE_AR   0x00010000
 
#define RZ_FLIRT_SIG_FILE_LOADER   0x00020000
 
#define RZ_FLIRT_SIG_FILE_ELF   0x00040000
 
#define RZ_FLIRT_SIG_FILE_W32RUN   0x00080000
 
#define RZ_FLIRT_SIG_FILE_AOUT   0x00100000
 
#define RZ_FLIRT_SIG_FILE_PILOT   0x00200000
 
#define RZ_FLIRT_SIG_FILE_DOS_EXE   0x00400000
 
#define RZ_FLIRT_SIG_FILE_DOS_COM   0x00800000
 
#define RZ_FLIRT_SIG_FILE_AIXAR   0x01000000
 
#define RZ_FLIRT_SIG_FILE_ALL   0xFFFFFFFF
 
#define RZ_FLIRT_SIG_OS_MSDOS   0x0001
 
#define RZ_FLIRT_SIG_OS_WIN   0x0002
 
#define RZ_FLIRT_SIG_OS_OS2   0x0004
 
#define RZ_FLIRT_SIG_OS_NETWARE   0x0008
 
#define RZ_FLIRT_SIG_OS_UNIX   0x0010
 
#define RZ_FLIRT_SIG_OS_OTHER   0x0020
 
#define RZ_FLIRT_SIG_OS_ALL   0xFFFF
 
#define RZ_FLIRT_SIG_APP_CONSOLE   0x0001
 
#define RZ_FLIRT_SIG_APP_GRAPHICS   0x0002
 
#define RZ_FLIRT_SIG_APP_EXE   0x0004
 
#define RZ_FLIRT_SIG_APP_DLL   0x0008
 
#define RZ_FLIRT_SIG_APP_DRV   0x0010
 
#define RZ_FLIRT_SIG_APP_SINGLE_THREADED   0x0020
 
#define RZ_FLIRT_SIG_APP_MULTI_THREADED   0x0040
 
#define RZ_FLIRT_SIG_APP_16_BIT   0x0080
 
#define RZ_FLIRT_SIG_APP_32_BIT   0x0100
 
#define RZ_FLIRT_SIG_APP_64_BIT   0x0200
 
#define RZ_FLIRT_SIG_APP_ALL   0xFFFF
 

Typedefs

typedef struct rz_flirt_tail_byte_t RzFlirtTailByte
 
typedef struct rz_flirt_function_t RzFlirtFunction
 
typedef struct rz_flirt_module_t RzFlirtModule
 
typedef struct rz_flirt_node_t RzFlirtNode
 
typedef enum rz_flirt_file_type_t RzFlirtFileType
 
typedef struct rz_flirt_sig_info_t RzFlirtSigInfo
 
typedef struct rz_flirt_pat_info_t RzFlirtPatInfo
 
typedef struct rz_flirt_info_t RzFlirtInfo
 
typedef struct rz_flirt_compressed_options_t RzFlirtCompressedOptions
 
typedef struct rz_signature_database_entry_t RzSigDBEntry
 
typedef struct rz_signature_db_t RzSigDb
 

Enumerations

enum  rz_flirt_sig_arch_t {
  RZ_FLIRT_SIG_ARCH_386 = 0 , RZ_FLIRT_SIG_ARCH_Z80 , RZ_FLIRT_SIG_ARCH_I860 , RZ_FLIRT_SIG_ARCH_8051 ,
  RZ_FLIRT_SIG_ARCH_TMS , RZ_FLIRT_SIG_ARCH_6502 , RZ_FLIRT_SIG_ARCH_PDP , RZ_FLIRT_SIG_ARCH_68K ,
  RZ_FLIRT_SIG_ARCH_JAVA , RZ_FLIRT_SIG_ARCH_6800 , RZ_FLIRT_SIG_ARCH_ST7 , RZ_FLIRT_SIG_ARCH_MC6812 ,
  RZ_FLIRT_SIG_ARCH_MIPS , RZ_FLIRT_SIG_ARCH_ARM , RZ_FLIRT_SIG_ARCH_TMSC6 , RZ_FLIRT_SIG_ARCH_PPC ,
  RZ_FLIRT_SIG_ARCH_80196 , RZ_FLIRT_SIG_ARCH_Z8 , RZ_FLIRT_SIG_ARCH_SH , RZ_FLIRT_SIG_ARCH_NET ,
  RZ_FLIRT_SIG_ARCH_AVR , RZ_FLIRT_SIG_ARCH_H8 , RZ_FLIRT_SIG_ARCH_PIC , RZ_FLIRT_SIG_ARCH_SPARC ,
  RZ_FLIRT_SIG_ARCH_ALPHA , RZ_FLIRT_SIG_ARCH_HPPA , RZ_FLIRT_SIG_ARCH_H8500 , RZ_FLIRT_SIG_ARCH_TRICORE ,
  RZ_FLIRT_SIG_ARCH_DSP56K , RZ_FLIRT_SIG_ARCH_C166 , RZ_FLIRT_SIG_ARCH_ST20 , RZ_FLIRT_SIG_ARCH_IA64 ,
  RZ_FLIRT_SIG_ARCH_I960 , RZ_FLIRT_SIG_ARCH_F2MC , RZ_FLIRT_SIG_ARCH_TMS320C54 , RZ_FLIRT_SIG_ARCH_TMS320C55 ,
  RZ_FLIRT_SIG_ARCH_TRIMEDIA , RZ_FLIRT_SIG_ARCH_M32R , RZ_FLIRT_SIG_ARCH_NEC_78K0 , RZ_FLIRT_SIG_ARCH_NEC_78K0S ,
  RZ_FLIRT_SIG_ARCH_M740 , RZ_FLIRT_SIG_ARCH_M7700 , RZ_FLIRT_SIG_ARCH_ST9 , RZ_FLIRT_SIG_ARCH_FR ,
  RZ_FLIRT_SIG_ARCH_MC6816 , RZ_FLIRT_SIG_ARCH_M7900 , RZ_FLIRT_SIG_ARCH_TMS320C3 , RZ_FLIRT_SIG_ARCH_KR1878 ,
  RZ_FLIRT_SIG_ARCH_AD218X , RZ_FLIRT_SIG_ARCH_OAKDSP , RZ_FLIRT_SIG_ARCH_TLCS900 , RZ_FLIRT_SIG_ARCH_C39 ,
  RZ_FLIRT_SIG_ARCH_CR16 , RZ_FLIRT_SIG_ARCH_MN102L00 , RZ_FLIRT_SIG_ARCH_TMS320C1X , RZ_FLIRT_SIG_ARCH_NEC_V850X ,
  RZ_FLIRT_SIG_ARCH_SCR_ADPT , RZ_FLIRT_SIG_ARCH_EBC , RZ_FLIRT_SIG_ARCH_MSP430 , RZ_FLIRT_SIG_ARCH_SPU ,
  RZ_FLIRT_SIG_ARCH_DALVIK , RZ_FLIRT_SIG_ARCH_65C816 , RZ_FLIRT_SIG_ARCH_M16C , RZ_FLIRT_SIG_ARCH_ARC ,
  RZ_FLIRT_SIG_ARCH_UNSP , RZ_FLIRT_SIG_ARCH_TMS320C28 , RZ_FLIRT_SIG_ARCH_DSP96K , RZ_FLIRT_SIG_ARCH_SPC700 ,
  RZ_FLIRT_SIG_ARCH_AD2106X , RZ_FLIRT_SIG_ARCH_PIC16 , RZ_FLIRT_SIG_ARCH_S390 , RZ_FLIRT_SIG_ARCH_XTENSA ,
  RZ_FLIRT_SIG_ARCH_RISCV , RZ_FLIRT_SIG_ARCH_RL78 , RZ_FLIRT_SIG_ARCH_RX , RZ_FLIRT_SIG_ARCH_ANY
}
 
enum  rz_flirt_node_optimization_t { RZ_FLIRT_NODE_OPTIMIZE_NONE = 0 , RZ_FLIRT_NODE_OPTIMIZE_NORMAL , RZ_FLIRT_NODE_OPTIMIZE_MAX }
 
enum  rz_flirt_file_type_t { RZ_FLIRT_FILE_TYPE_UNKNOWN = 0 , RZ_FLIRT_FILE_TYPE_SIG , RZ_FLIRT_FILE_TYPE_PAT }
 

Functions

RZ_API ut32 rz_sign_flirt_node_count_nodes (RZ_NONNULL const RzFlirtNode *node)
 Counts the number of FLIRT signatures in the node. More...
 
RZ_API RZ_OWN RzFlirtNode * rz_sign_flirt_node_new (RZ_NONNULL RzAnalysis *analysis, ut32 optimization)
 Generates the FLIRT signatures and returns an RzFlirtNode. More...
 
RZ_API void rz_sign_flirt_node_free (RZ_NULLABLE RzFlirtNode *node)
 Frees an RzFlirtNode struct. More...
 
RZ_API void rz_sign_flirt_info_fini (RZ_NULLABLE RzFlirtInfo *info)
 Frees an RzFlirtInfo struct elements without freeing the pointer. More...
 
RZ_API bool rz_sign_flirt_apply (RZ_NONNULL RzAnalysis *analysis, RZ_NONNULL const char *flirt_file, ut8 expected_arch)
 Parses the FLIRT file and applies the signatures. More...
 
RZ_API RZ_OWN bool rz_sign_flirt_parse_header_compressed_pattern_from_buffer (RZ_NONNULL RzBuffer *flirt_buf, RZ_NONNULL RzFlirtInfo *info)
 Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtInfo. More...
 
RZ_API RZ_OWN RzFlirtNode * rz_sign_flirt_parse_compressed_pattern_from_buffer (RZ_NONNULL RzBuffer *flirt_buf, ut8 expected_arch, RZ_NULLABLE RzFlirtInfo *info)
 Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode. More...
 
RZ_API bool rz_sign_flirt_write_compressed_pattern_to_buffer (RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer, RzFlirtCompressedOptions *options)
 Writes in the the RzBuffer the FLIRT signatures in compressed format. More...
 
RZ_API RZ_OWN RzFlirtNode * rz_sign_flirt_parse_string_pattern_from_buffer (RZ_NONNULL RzBuffer *flirt_buf, ut32 optimization, RZ_NULLABLE RzFlirtInfo *info)
 Parses the RzBuffer containing a FLIRT signature in string format and returns an RzFlirtNode. More...
 
RZ_API bool rz_sign_flirt_write_string_pattern_to_buffer (RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer)
 Writes in the the RzBuffer the FLIRT signatures in string format. More...
 
RZ_API void rz_sign_sigdb_signature_free (RZ_NULLABLE RzSigDBEntry *entry)
 Frees a RzSigDBEntry structure. More...
 
RZ_API RZ_OWN RzSigDb * rz_sign_sigdb_new (void)
 Create a new empty RzSigDb instance. More...
 
RZ_API void rz_sign_sigdb_free (RzSigDb *db)
 
RZ_API RZ_OWN RzSigDb * rz_sign_sigdb_load_database (RZ_NONNULL const char *sigdb_path, bool with_details)
 Returns a database of signatures loaded from the signature database path. More...
 
RZ_API bool rz_sign_sigdb_add_entry (RZ_NONNULL RzSigDb *db, RZ_NONNULL const RzSigDBEntry *entry)
 Add a new signature entry to a database. More...
 
RZ_API bool rz_sign_sigdb_merge (RZ_NONNULL RzSigDb *db, RZ_NONNULL RzSigDb *db2)
 Merge the signatures from db2 into db. More...
 
RZ_API RZ_OWN RzList * rz_sign_sigdb_list (RZ_NONNULL const RzSigDb *db)
 Return the signature database as a list of entries. More...
 

Macro Definition Documentation

◆ RZ_FLIRT_LIBRARY_NAME_DFL

#define RZ_FLIRT_LIBRARY_NAME_DFL   "Built with rizin " RZ_VERSION

Definition at line 19 of file rz_flirt.h.

◆ RZ_FLIRT_LIBRARY_NAME_MAX

#define RZ_FLIRT_LIBRARY_NAME_MAX   0xFF

Definition at line 18 of file rz_flirt.h.

◆ RZ_FLIRT_MAX_PRELUDE_SIZE

#define RZ_FLIRT_MAX_PRELUDE_SIZE   (32)

Definition at line 20 of file rz_flirt.h.

◆ RZ_FLIRT_NAME_MAX

#define RZ_FLIRT_NAME_MAX   1024

Definition at line 17 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_16_BIT

#define RZ_FLIRT_SIG_APP_16_BIT   0x0080

Definition at line 147 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_32_BIT

#define RZ_FLIRT_SIG_APP_32_BIT   0x0100

Definition at line 148 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_64_BIT

#define RZ_FLIRT_SIG_APP_64_BIT   0x0200

Definition at line 149 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_ALL

#define RZ_FLIRT_SIG_APP_ALL   0xFFFF

Definition at line 150 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_CONSOLE

#define RZ_FLIRT_SIG_APP_CONSOLE   0x0001

Definition at line 140 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_DLL

#define RZ_FLIRT_SIG_APP_DLL   0x0008

Definition at line 143 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_DRV

#define RZ_FLIRT_SIG_APP_DRV   0x0010

Definition at line 144 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_EXE

#define RZ_FLIRT_SIG_APP_EXE   0x0004

Definition at line 142 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_GRAPHICS

#define RZ_FLIRT_SIG_APP_GRAPHICS   0x0002

Definition at line 141 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_MULTI_THREADED

#define RZ_FLIRT_SIG_APP_MULTI_THREADED   0x0040

Definition at line 146 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_APP_SINGLE_THREADED

#define RZ_FLIRT_SIG_APP_SINGLE_THREADED   0x0020

Definition at line 145 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_AIXAR

#define RZ_FLIRT_SIG_FILE_AIXAR   0x01000000

Definition at line 127 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_ALL

#define RZ_FLIRT_SIG_FILE_ALL   0xFFFFFFFF

Definition at line 128 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_AOUT

#define RZ_FLIRT_SIG_FILE_AOUT   0x00100000

Definition at line 123 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_AR

#define RZ_FLIRT_SIG_FILE_AR   0x00010000

Definition at line 119 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_BIN

#define RZ_FLIRT_SIG_FILE_BIN   0x00000004

Definition at line 105 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_COFF

#define RZ_FLIRT_SIG_FILE_COFF   0x00000400

Definition at line 113 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_DOS_COM

#define RZ_FLIRT_SIG_FILE_DOS_COM   0x00800000

Definition at line 126 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_DOS_COM_OLD

#define RZ_FLIRT_SIG_FILE_DOS_COM_OLD   0x00000002

Definition at line 104 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_DOS_EXE

#define RZ_FLIRT_SIG_FILE_DOS_EXE   0x00400000

Definition at line 125 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_DOS_EXE_OLD

#define RZ_FLIRT_SIG_FILE_DOS_EXE_OLD   0x00000001

Definition at line 103 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_DOSDRV

#define RZ_FLIRT_SIG_FILE_DOSDRV   0x00000008

Definition at line 106 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_ELF

#define RZ_FLIRT_SIG_FILE_ELF   0x00040000

Definition at line 121 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_INTELHEX

#define RZ_FLIRT_SIG_FILE_INTELHEX   0x00000020

Definition at line 108 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_LE

#define RZ_FLIRT_SIG_FILE_LE   0x00000100

Definition at line 111 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_LOADER

#define RZ_FLIRT_SIG_FILE_LOADER   0x00020000

Definition at line 120 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_LX

#define RZ_FLIRT_SIG_FILE_LX   0x00000080

Definition at line 110 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_MOSHEX

#define RZ_FLIRT_SIG_FILE_MOSHEX   0x00000040

Definition at line 109 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_NE

#define RZ_FLIRT_SIG_FILE_NE   0x00000010

Definition at line 107 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_NLM

#define RZ_FLIRT_SIG_FILE_NLM   0x00000200

Definition at line 112 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_OMF

#define RZ_FLIRT_SIG_FILE_OMF   0x00001000

Definition at line 115 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_OMFLIB

#define RZ_FLIRT_SIG_FILE_OMFLIB   0x00008000

Definition at line 118 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_PE

#define RZ_FLIRT_SIG_FILE_PE   0x00000800

Definition at line 114 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_PILOT

#define RZ_FLIRT_SIG_FILE_PILOT   0x00200000

Definition at line 124 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_SREC

#define RZ_FLIRT_SIG_FILE_SREC   0x00002000

Definition at line 116 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_W32RUN

#define RZ_FLIRT_SIG_FILE_W32RUN   0x00080000

Definition at line 122 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_FILE_ZIP

#define RZ_FLIRT_SIG_FILE_ZIP   0x00004000

Definition at line 117 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_ALL

#define RZ_FLIRT_SIG_OS_ALL   0xFFFF

Definition at line 137 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_MSDOS

#define RZ_FLIRT_SIG_OS_MSDOS   0x0001

Definition at line 131 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_NETWARE

#define RZ_FLIRT_SIG_OS_NETWARE   0x0008

Definition at line 134 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_OS2

#define RZ_FLIRT_SIG_OS_OS2   0x0004

Definition at line 133 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_OTHER

#define RZ_FLIRT_SIG_OS_OTHER   0x0020

Definition at line 136 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_UNIX

#define RZ_FLIRT_SIG_OS_UNIX   0x0010

Definition at line 135 of file rz_flirt.h.

◆ RZ_FLIRT_SIG_OS_WIN

#define RZ_FLIRT_SIG_OS_WIN   0x0002

Definition at line 132 of file rz_flirt.h.

Typedef Documentation

◆ RzFlirtCompressedOptions

typedef struct rz_flirt_compressed_options_t RzFlirtCompressedOptions

◆ RzFlirtFileType

typedef enum rz_flirt_file_type_t RzFlirtFileType

◆ RzFlirtFunction

typedef struct rz_flirt_function_t RzFlirtFunction

◆ RzFlirtInfo

typedef struct rz_flirt_info_t RzFlirtInfo

◆ RzFlirtModule

typedef struct rz_flirt_module_t RzFlirtModule

◆ RzFlirtNode

typedef struct rz_flirt_node_t RzFlirtNode

◆ RzFlirtPatInfo

typedef struct rz_flirt_pat_info_t RzFlirtPatInfo

◆ RzFlirtSigInfo

typedef struct rz_flirt_sig_info_t RzFlirtSigInfo

◆ RzFlirtTailByte

typedef struct rz_flirt_tail_byte_t RzFlirtTailByte

◆ RzSigDb

typedef struct rz_signature_db_t RzSigDb

◆ RzSigDBEntry

typedef struct rz_signature_database_entry_t RzSigDBEntry

Enumeration Type Documentation

◆ rz_flirt_file_type_t

enum rz_flirt_file_type_t
Enumerator
RZ_FLIRT_FILE_TYPE_UNKNOWN 

unknown type

RZ_FLIRT_FILE_TYPE_SIG 

.sig compressed pattern file

RZ_FLIRT_FILE_TYPE_PAT 

.pat text format pattern file

Definition at line 191 of file rz_flirt.h.

191  {
192  RZ_FLIRT_FILE_TYPE_UNKNOWN = 0,
193  RZ_FLIRT_FILE_TYPE_SIG,
194  RZ_FLIRT_FILE_TYPE_PAT,
195 } RzFlirtFileType;
RzFlirtFileType
enum rz_flirt_file_type_t RzFlirtFileType
RZ_FLIRT_FILE_TYPE_PAT
@ RZ_FLIRT_FILE_TYPE_PAT
.pat text format pattern file
Definition: rz_flirt.h:194
RZ_FLIRT_FILE_TYPE_SIG
@ RZ_FLIRT_FILE_TYPE_SIG
.sig compressed pattern file
Definition: rz_flirt.h:193
RZ_FLIRT_FILE_TYPE_UNKNOWN
@ RZ_FLIRT_FILE_TYPE_UNKNOWN
unknown type
Definition: rz_flirt.h:192

◆ rz_flirt_node_optimization_t

enum rz_flirt_node_optimization_t
Enumerator
RZ_FLIRT_NODE_OPTIMIZE_NONE 

keeps the structure flattened (keep the tail bytes)

RZ_FLIRT_NODE_OPTIMIZE_NORMAL 

optimize the tree structure (keeps the tail bytes)

RZ_FLIRT_NODE_OPTIMIZE_MAX 

optimize the tree structure and drops the tail bytes

Definition at line 185 of file rz_flirt.h.

185  {
186  RZ_FLIRT_NODE_OPTIMIZE_NONE = 0,
187  RZ_FLIRT_NODE_OPTIMIZE_NORMAL,
188  RZ_FLIRT_NODE_OPTIMIZE_MAX,
189 };
RZ_FLIRT_NODE_OPTIMIZE_NONE
@ RZ_FLIRT_NODE_OPTIMIZE_NONE
keeps the structure flattened (keep the tail bytes)
Definition: rz_flirt.h:186
RZ_FLIRT_NODE_OPTIMIZE_NORMAL
@ RZ_FLIRT_NODE_OPTIMIZE_NORMAL
optimize the tree structure (keeps the tail bytes)
Definition: rz_flirt.h:187
RZ_FLIRT_NODE_OPTIMIZE_MAX
@ RZ_FLIRT_NODE_OPTIMIZE_MAX
optimize the tree structure and drops the tail bytes
Definition: rz_flirt.h:188

◆ rz_flirt_sig_arch_t

enum rz_flirt_sig_arch_t
Enumerator
RZ_FLIRT_SIG_ARCH_386 
RZ_FLIRT_SIG_ARCH_Z80 
RZ_FLIRT_SIG_ARCH_I860 
RZ_FLIRT_SIG_ARCH_8051 
RZ_FLIRT_SIG_ARCH_TMS 
RZ_FLIRT_SIG_ARCH_6502 
RZ_FLIRT_SIG_ARCH_PDP 
RZ_FLIRT_SIG_ARCH_68K 
RZ_FLIRT_SIG_ARCH_JAVA 
RZ_FLIRT_SIG_ARCH_6800 
RZ_FLIRT_SIG_ARCH_ST7 
RZ_FLIRT_SIG_ARCH_MC6812 
RZ_FLIRT_SIG_ARCH_MIPS 
RZ_FLIRT_SIG_ARCH_ARM 
RZ_FLIRT_SIG_ARCH_TMSC6 
RZ_FLIRT_SIG_ARCH_PPC 
RZ_FLIRT_SIG_ARCH_80196 
RZ_FLIRT_SIG_ARCH_Z8 
RZ_FLIRT_SIG_ARCH_SH 
RZ_FLIRT_SIG_ARCH_NET 
RZ_FLIRT_SIG_ARCH_AVR 
RZ_FLIRT_SIG_ARCH_H8 
RZ_FLIRT_SIG_ARCH_PIC 
RZ_FLIRT_SIG_ARCH_SPARC 
RZ_FLIRT_SIG_ARCH_ALPHA 
RZ_FLIRT_SIG_ARCH_HPPA 
RZ_FLIRT_SIG_ARCH_H8500 
RZ_FLIRT_SIG_ARCH_TRICORE 
RZ_FLIRT_SIG_ARCH_DSP56K 
RZ_FLIRT_SIG_ARCH_C166 
RZ_FLIRT_SIG_ARCH_ST20 
RZ_FLIRT_SIG_ARCH_IA64 
RZ_FLIRT_SIG_ARCH_I960 
RZ_FLIRT_SIG_ARCH_F2MC 
RZ_FLIRT_SIG_ARCH_TMS320C54 
RZ_FLIRT_SIG_ARCH_TMS320C55 
RZ_FLIRT_SIG_ARCH_TRIMEDIA 
RZ_FLIRT_SIG_ARCH_M32R 
RZ_FLIRT_SIG_ARCH_NEC_78K0 
RZ_FLIRT_SIG_ARCH_NEC_78K0S 
RZ_FLIRT_SIG_ARCH_M740 
RZ_FLIRT_SIG_ARCH_M7700 
RZ_FLIRT_SIG_ARCH_ST9 
RZ_FLIRT_SIG_ARCH_FR 
RZ_FLIRT_SIG_ARCH_MC6816 
RZ_FLIRT_SIG_ARCH_M7900 
RZ_FLIRT_SIG_ARCH_TMS320C3 
RZ_FLIRT_SIG_ARCH_KR1878 
RZ_FLIRT_SIG_ARCH_AD218X 
RZ_FLIRT_SIG_ARCH_OAKDSP 
RZ_FLIRT_SIG_ARCH_TLCS900 
RZ_FLIRT_SIG_ARCH_C39 
RZ_FLIRT_SIG_ARCH_CR16 
RZ_FLIRT_SIG_ARCH_MN102L00 
RZ_FLIRT_SIG_ARCH_TMS320C1X 
RZ_FLIRT_SIG_ARCH_NEC_V850X 
RZ_FLIRT_SIG_ARCH_SCR_ADPT 
RZ_FLIRT_SIG_ARCH_EBC 
RZ_FLIRT_SIG_ARCH_MSP430 
RZ_FLIRT_SIG_ARCH_SPU 
RZ_FLIRT_SIG_ARCH_DALVIK 
RZ_FLIRT_SIG_ARCH_65C816 
RZ_FLIRT_SIG_ARCH_M16C 
RZ_FLIRT_SIG_ARCH_ARC 
RZ_FLIRT_SIG_ARCH_UNSP 
RZ_FLIRT_SIG_ARCH_TMS320C28 
RZ_FLIRT_SIG_ARCH_DSP96K 
RZ_FLIRT_SIG_ARCH_SPC700 
RZ_FLIRT_SIG_ARCH_AD2106X 
RZ_FLIRT_SIG_ARCH_PIC16 
RZ_FLIRT_SIG_ARCH_S390 
RZ_FLIRT_SIG_ARCH_XTENSA 
RZ_FLIRT_SIG_ARCH_RISCV 
RZ_FLIRT_SIG_ARCH_RL78 
RZ_FLIRT_SIG_ARCH_RX 
RZ_FLIRT_SIG_ARCH_ANY 

Definition at line 23 of file rz_flirt.h.

23  {
24  RZ_FLIRT_SIG_ARCH_386 = 0, // Intel 80x86
25  RZ_FLIRT_SIG_ARCH_Z80, // 8085, Z80
26  RZ_FLIRT_SIG_ARCH_I860, // Intel 860
27  RZ_FLIRT_SIG_ARCH_8051, // 8051
28  RZ_FLIRT_SIG_ARCH_TMS, // Texas Instruments TMS320C5x
29  RZ_FLIRT_SIG_ARCH_6502, // 6502
30  RZ_FLIRT_SIG_ARCH_PDP, // PDP11
31  RZ_FLIRT_SIG_ARCH_68K, // Motoroal 680x0
32  RZ_FLIRT_SIG_ARCH_JAVA, // Java
33  RZ_FLIRT_SIG_ARCH_6800, // Motorola 68xx
34  RZ_FLIRT_SIG_ARCH_ST7, // SGS-Thomson ST7
35  RZ_FLIRT_SIG_ARCH_MC6812, // Motorola 68HC12
36  RZ_FLIRT_SIG_ARCH_MIPS, // MIPS
37  RZ_FLIRT_SIG_ARCH_ARM, // Advanced RISC Machines
38  RZ_FLIRT_SIG_ARCH_TMSC6, // Texas Instruments TMS320C6x
39  RZ_FLIRT_SIG_ARCH_PPC, // PowerPC
40  RZ_FLIRT_SIG_ARCH_80196, // Intel 80196
41  RZ_FLIRT_SIG_ARCH_Z8, // Z8
42  RZ_FLIRT_SIG_ARCH_SH, // Renesas (formerly Hitachi) SuperH
43  RZ_FLIRT_SIG_ARCH_NET, // Microsoft Visual Studio.Net
44  RZ_FLIRT_SIG_ARCH_AVR, // Atmel 8-bit RISC processor(s)
45  RZ_FLIRT_SIG_ARCH_H8, // Hitachi H8/300, H8/2000
46  RZ_FLIRT_SIG_ARCH_PIC, // Microchip's PIC
47  RZ_FLIRT_SIG_ARCH_SPARC, // SPARC
48  RZ_FLIRT_SIG_ARCH_ALPHA, // DEC Alpha
49  RZ_FLIRT_SIG_ARCH_HPPA, // Hewlett-Packard PA-RISC
50  RZ_FLIRT_SIG_ARCH_H8500, // Renesas (formerly Hitachi) H8/500
51  RZ_FLIRT_SIG_ARCH_TRICORE, // Tricore
52  RZ_FLIRT_SIG_ARCH_DSP56K, // Motorola DSP5600x
53  RZ_FLIRT_SIG_ARCH_C166, // Siemens C166 family
54  RZ_FLIRT_SIG_ARCH_ST20, // SGS-Thomson ST20
55  RZ_FLIRT_SIG_ARCH_IA64, // Intel Itanium IA64
56  RZ_FLIRT_SIG_ARCH_I960, // Intel 960
57  RZ_FLIRT_SIG_ARCH_F2MC, // Fujitsu F2MC-16
58  RZ_FLIRT_SIG_ARCH_TMS320C54, // Texas Instruments TMS320C54xx
59  RZ_FLIRT_SIG_ARCH_TMS320C55, // Texas Instruments TMS320C55xx
60  RZ_FLIRT_SIG_ARCH_TRIMEDIA, // Trimedia
61  RZ_FLIRT_SIG_ARCH_M32R, // Mitsubishi 32bit RISC
62  RZ_FLIRT_SIG_ARCH_NEC_78K0, // NEC 78K0
63  RZ_FLIRT_SIG_ARCH_NEC_78K0S, // NEC 78K0S
64  RZ_FLIRT_SIG_ARCH_M740, // Mitsubishi 8bit
65  RZ_FLIRT_SIG_ARCH_M7700, // Mitsubishi 16bit
66  RZ_FLIRT_SIG_ARCH_ST9, // ST9+
67  RZ_FLIRT_SIG_ARCH_FR, // Fujitsu FR Family
68  RZ_FLIRT_SIG_ARCH_MC6816, // Motorola 68HC16
69  RZ_FLIRT_SIG_ARCH_M7900, // Mitsubishi 7900
70  RZ_FLIRT_SIG_ARCH_TMS320C3, // Texas Instruments TMS320C3
71  RZ_FLIRT_SIG_ARCH_KR1878, // Angstrem KR1878
72  RZ_FLIRT_SIG_ARCH_AD218X, // Analog Devices ADSP 218X
73  RZ_FLIRT_SIG_ARCH_OAKDSP, // Atmel OAK DSP
74  RZ_FLIRT_SIG_ARCH_TLCS900, // Toshiba TLCS-900
75  RZ_FLIRT_SIG_ARCH_C39, // Rockwell C39
76  RZ_FLIRT_SIG_ARCH_CR16, // NSC CR16
77  RZ_FLIRT_SIG_ARCH_MN102L00, // Panasonic MN10200
78  RZ_FLIRT_SIG_ARCH_TMS320C1X, // Texas Instruments TMS320C1x
79  RZ_FLIRT_SIG_ARCH_NEC_V850X, // NEC V850 and V850ES/E1/E2
80  RZ_FLIRT_SIG_ARCH_SCR_ADPT, // Processor module adapter for processor modules written in scripting languages
81  RZ_FLIRT_SIG_ARCH_EBC, // EFI Bytecode
82  RZ_FLIRT_SIG_ARCH_MSP430, // Texas Instruments MSP430
83  RZ_FLIRT_SIG_ARCH_SPU, // Cell Broadband Engine Synergistic Processor Unit
84  RZ_FLIRT_SIG_ARCH_DALVIK, // Android Dalvik Virtual Machine
85  RZ_FLIRT_SIG_ARCH_65C816, // 65802/65816
86  RZ_FLIRT_SIG_ARCH_M16C, // Renesas M16C
87  RZ_FLIRT_SIG_ARCH_ARC, // Argonaut RISC Core
88  RZ_FLIRT_SIG_ARCH_UNSP, // SunPlus unSP
89  RZ_FLIRT_SIG_ARCH_TMS320C28, // Texas Instruments TMS320C28x
90  RZ_FLIRT_SIG_ARCH_DSP96K, // Motorola DSP96000
91  RZ_FLIRT_SIG_ARCH_SPC700, // Sony SPC700
92  RZ_FLIRT_SIG_ARCH_AD2106X, // Analog Devices ADSP 2106X
93  RZ_FLIRT_SIG_ARCH_PIC16, // Microchip 16-bit PIC
94  RZ_FLIRT_SIG_ARCH_S390, // IBM's S390
95  RZ_FLIRT_SIG_ARCH_XTENSA, // Tensilica Xtensa
96  RZ_FLIRT_SIG_ARCH_RISCV, // RISC-V
97  RZ_FLIRT_SIG_ARCH_RL78, // Renesas RL78.
98  RZ_FLIRT_SIG_ARCH_RX, // Renesas RX.
99  RZ_FLIRT_SIG_ARCH_ANY,
100 };
RZ_FLIRT_SIG_ARCH_I860
@ RZ_FLIRT_SIG_ARCH_I860
Definition: rz_flirt.h:26
RZ_FLIRT_SIG_ARCH_M740
@ RZ_FLIRT_SIG_ARCH_M740
Definition: rz_flirt.h:64
RZ_FLIRT_SIG_ARCH_TMS320C28
@ RZ_FLIRT_SIG_ARCH_TMS320C28
Definition: rz_flirt.h:89
RZ_FLIRT_SIG_ARCH_SPC700
@ RZ_FLIRT_SIG_ARCH_SPC700
Definition: rz_flirt.h:91
RZ_FLIRT_SIG_ARCH_TMSC6
@ RZ_FLIRT_SIG_ARCH_TMSC6
Definition: rz_flirt.h:38
RZ_FLIRT_SIG_ARCH_M7700
@ RZ_FLIRT_SIG_ARCH_M7700
Definition: rz_flirt.h:65
RZ_FLIRT_SIG_ARCH_ST7
@ RZ_FLIRT_SIG_ARCH_ST7
Definition: rz_flirt.h:34
RZ_FLIRT_SIG_ARCH_65C816
@ RZ_FLIRT_SIG_ARCH_65C816
Definition: rz_flirt.h:85
RZ_FLIRT_SIG_ARCH_M32R
@ RZ_FLIRT_SIG_ARCH_M32R
Definition: rz_flirt.h:61
RZ_FLIRT_SIG_ARCH_6502
@ RZ_FLIRT_SIG_ARCH_6502
Definition: rz_flirt.h:29
RZ_FLIRT_SIG_ARCH_MC6812
@ RZ_FLIRT_SIG_ARCH_MC6812
Definition: rz_flirt.h:35
RZ_FLIRT_SIG_ARCH_386
@ RZ_FLIRT_SIG_ARCH_386
Definition: rz_flirt.h:24
RZ_FLIRT_SIG_ARCH_F2MC
@ RZ_FLIRT_SIG_ARCH_F2MC
Definition: rz_flirt.h:57
RZ_FLIRT_SIG_ARCH_I960
@ RZ_FLIRT_SIG_ARCH_I960
Definition: rz_flirt.h:56
RZ_FLIRT_SIG_ARCH_UNSP
@ RZ_FLIRT_SIG_ARCH_UNSP
Definition: rz_flirt.h:88
RZ_FLIRT_SIG_ARCH_EBC
@ RZ_FLIRT_SIG_ARCH_EBC
Definition: rz_flirt.h:81
RZ_FLIRT_SIG_ARCH_C39
@ RZ_FLIRT_SIG_ARCH_C39
Definition: rz_flirt.h:75
RZ_FLIRT_SIG_ARCH_68K
@ RZ_FLIRT_SIG_ARCH_68K
Definition: rz_flirt.h:31
RZ_FLIRT_SIG_ARCH_M7900
@ RZ_FLIRT_SIG_ARCH_M7900
Definition: rz_flirt.h:69
RZ_FLIRT_SIG_ARCH_AD218X
@ RZ_FLIRT_SIG_ARCH_AD218X
Definition: rz_flirt.h:72
RZ_FLIRT_SIG_ARCH_ARM
@ RZ_FLIRT_SIG_ARCH_ARM
Definition: rz_flirt.h:37
RZ_FLIRT_SIG_ARCH_8051
@ RZ_FLIRT_SIG_ARCH_8051
Definition: rz_flirt.h:27
RZ_FLIRT_SIG_ARCH_ST20
@ RZ_FLIRT_SIG_ARCH_ST20
Definition: rz_flirt.h:54
RZ_FLIRT_SIG_ARCH_TMS320C1X
@ RZ_FLIRT_SIG_ARCH_TMS320C1X
Definition: rz_flirt.h:78
RZ_FLIRT_SIG_ARCH_AD2106X
@ RZ_FLIRT_SIG_ARCH_AD2106X
Definition: rz_flirt.h:92
RZ_FLIRT_SIG_ARCH_S390
@ RZ_FLIRT_SIG_ARCH_S390
Definition: rz_flirt.h:94
RZ_FLIRT_SIG_ARCH_SH
@ RZ_FLIRT_SIG_ARCH_SH
Definition: rz_flirt.h:42
RZ_FLIRT_SIG_ARCH_ANY
@ RZ_FLIRT_SIG_ARCH_ANY
Definition: rz_flirt.h:99
RZ_FLIRT_SIG_ARCH_PDP
@ RZ_FLIRT_SIG_ARCH_PDP
Definition: rz_flirt.h:30
RZ_FLIRT_SIG_ARCH_TRIMEDIA
@ RZ_FLIRT_SIG_ARCH_TRIMEDIA
Definition: rz_flirt.h:60
RZ_FLIRT_SIG_ARCH_M16C
@ RZ_FLIRT_SIG_ARCH_M16C
Definition: rz_flirt.h:86
RZ_FLIRT_SIG_ARCH_NEC_V850X
@ RZ_FLIRT_SIG_ARCH_NEC_V850X
Definition: rz_flirt.h:79
RZ_FLIRT_SIG_ARCH_TMS320C55
@ RZ_FLIRT_SIG_ARCH_TMS320C55
Definition: rz_flirt.h:59
RZ_FLIRT_SIG_ARCH_NEC_78K0
@ RZ_FLIRT_SIG_ARCH_NEC_78K0
Definition: rz_flirt.h:62
RZ_FLIRT_SIG_ARCH_H8500
@ RZ_FLIRT_SIG_ARCH_H8500
Definition: rz_flirt.h:50
RZ_FLIRT_SIG_ARCH_TMS320C54
@ RZ_FLIRT_SIG_ARCH_TMS320C54
Definition: rz_flirt.h:58
RZ_FLIRT_SIG_ARCH_ALPHA
@ RZ_FLIRT_SIG_ARCH_ALPHA
Definition: rz_flirt.h:48
RZ_FLIRT_SIG_ARCH_RISCV
@ RZ_FLIRT_SIG_ARCH_RISCV
Definition: rz_flirt.h:96
RZ_FLIRT_SIG_ARCH_80196
@ RZ_FLIRT_SIG_ARCH_80196
Definition: rz_flirt.h:40
RZ_FLIRT_SIG_ARCH_SPU
@ RZ_FLIRT_SIG_ARCH_SPU
Definition: rz_flirt.h:83
RZ_FLIRT_SIG_ARCH_TMS320C3
@ RZ_FLIRT_SIG_ARCH_TMS320C3
Definition: rz_flirt.h:70
RZ_FLIRT_SIG_ARCH_TMS
@ RZ_FLIRT_SIG_ARCH_TMS
Definition: rz_flirt.h:28
RZ_FLIRT_SIG_ARCH_FR
@ RZ_FLIRT_SIG_ARCH_FR
Definition: rz_flirt.h:67
RZ_FLIRT_SIG_ARCH_DSP56K
@ RZ_FLIRT_SIG_ARCH_DSP56K
Definition: rz_flirt.h:52
RZ_FLIRT_SIG_ARCH_OAKDSP
@ RZ_FLIRT_SIG_ARCH_OAKDSP
Definition: rz_flirt.h:73
RZ_FLIRT_SIG_ARCH_SPARC
@ RZ_FLIRT_SIG_ARCH_SPARC
Definition: rz_flirt.h:47
RZ_FLIRT_SIG_ARCH_TRICORE
@ RZ_FLIRT_SIG_ARCH_TRICORE
Definition: rz_flirt.h:51
RZ_FLIRT_SIG_ARCH_ST9
@ RZ_FLIRT_SIG_ARCH_ST9
Definition: rz_flirt.h:66
RZ_FLIRT_SIG_ARCH_RL78
@ RZ_FLIRT_SIG_ARCH_RL78
Definition: rz_flirt.h:97
RZ_FLIRT_SIG_ARCH_MC6816
@ RZ_FLIRT_SIG_ARCH_MC6816
Definition: rz_flirt.h:68
RZ_FLIRT_SIG_ARCH_NET
@ RZ_FLIRT_SIG_ARCH_NET
Definition: rz_flirt.h:43
RZ_FLIRT_SIG_ARCH_Z80
@ RZ_FLIRT_SIG_ARCH_Z80
Definition: rz_flirt.h:25
RZ_FLIRT_SIG_ARCH_DALVIK
@ RZ_FLIRT_SIG_ARCH_DALVIK
Definition: rz_flirt.h:84
RZ_FLIRT_SIG_ARCH_C166
@ RZ_FLIRT_SIG_ARCH_C166
Definition: rz_flirt.h:53
RZ_FLIRT_SIG_ARCH_6800
@ RZ_FLIRT_SIG_ARCH_6800
Definition: rz_flirt.h:33
RZ_FLIRT_SIG_ARCH_SCR_ADPT
@ RZ_FLIRT_SIG_ARCH_SCR_ADPT
Definition: rz_flirt.h:80
RZ_FLIRT_SIG_ARCH_PIC16
@ RZ_FLIRT_SIG_ARCH_PIC16
Definition: rz_flirt.h:93
RZ_FLIRT_SIG_ARCH_AVR
@ RZ_FLIRT_SIG_ARCH_AVR
Definition: rz_flirt.h:44
RZ_FLIRT_SIG_ARCH_HPPA
@ RZ_FLIRT_SIG_ARCH_HPPA
Definition: rz_flirt.h:49
RZ_FLIRT_SIG_ARCH_ARC
@ RZ_FLIRT_SIG_ARCH_ARC
Definition: rz_flirt.h:87
RZ_FLIRT_SIG_ARCH_Z8
@ RZ_FLIRT_SIG_ARCH_Z8
Definition: rz_flirt.h:41
RZ_FLIRT_SIG_ARCH_MSP430
@ RZ_FLIRT_SIG_ARCH_MSP430
Definition: rz_flirt.h:82
RZ_FLIRT_SIG_ARCH_H8
@ RZ_FLIRT_SIG_ARCH_H8
Definition: rz_flirt.h:45
RZ_FLIRT_SIG_ARCH_RX
@ RZ_FLIRT_SIG_ARCH_RX
Definition: rz_flirt.h:98
RZ_FLIRT_SIG_ARCH_PPC
@ RZ_FLIRT_SIG_ARCH_PPC
Definition: rz_flirt.h:39
RZ_FLIRT_SIG_ARCH_KR1878
@ RZ_FLIRT_SIG_ARCH_KR1878
Definition: rz_flirt.h:71
RZ_FLIRT_SIG_ARCH_PIC
@ RZ_FLIRT_SIG_ARCH_PIC
Definition: rz_flirt.h:46
RZ_FLIRT_SIG_ARCH_DSP96K
@ RZ_FLIRT_SIG_ARCH_DSP96K
Definition: rz_flirt.h:90
RZ_FLIRT_SIG_ARCH_MIPS
@ RZ_FLIRT_SIG_ARCH_MIPS
Definition: rz_flirt.h:36
RZ_FLIRT_SIG_ARCH_TLCS900
@ RZ_FLIRT_SIG_ARCH_TLCS900
Definition: rz_flirt.h:74
RZ_FLIRT_SIG_ARCH_JAVA
@ RZ_FLIRT_SIG_ARCH_JAVA
Definition: rz_flirt.h:32
RZ_FLIRT_SIG_ARCH_NEC_78K0S
@ RZ_FLIRT_SIG_ARCH_NEC_78K0S
Definition: rz_flirt.h:63
RZ_FLIRT_SIG_ARCH_IA64
@ RZ_FLIRT_SIG_ARCH_IA64
Definition: rz_flirt.h:55
RZ_FLIRT_SIG_ARCH_XTENSA
@ RZ_FLIRT_SIG_ARCH_XTENSA
Definition: rz_flirt.h:95
RZ_FLIRT_SIG_ARCH_MN102L00
@ RZ_FLIRT_SIG_ARCH_MN102L00
Definition: rz_flirt.h:77
RZ_FLIRT_SIG_ARCH_CR16
@ RZ_FLIRT_SIG_ARCH_CR16
Definition: rz_flirt.h:76

Function Documentation

◆ rz_sign_flirt_apply()

RZ_API bool rz_sign_flirt_apply ( RZ_NONNULL RzAnalysis *  analysis,
RZ_NONNULL const char *  flirt_file,
ut8  expected_arch 
)

Parses the FLIRT file and applies the signatures.

Parameters
analysisThe RzAnalysis structure
flirt_fileThe FLIRT file to parse
Returns
true if the signatures were sucessfully applied to the file

Definition at line 1289 of file flirt.c.

1289  {
1290  rz_return_val_if_fail(analysis && RZ_STR_ISNOTEMPTY(flirt_file), false);
1291  RzBuffer *flirt_buf = NULL;
1292  RzFlirtNode *node = NULL;
1293 
1294  if (expected_arch > RZ_FLIRT_SIG_ARCH_ANY) {
1295  RZ_LOG_ERROR("FLIRT: unknown architecture %u\n", expected_arch);
1296  return false;
1297  }
1298 
1299  const char *extension = rz_str_lchr(flirt_file, '.');
1300  if (RZ_STR_ISEMPTY(extension) || (strcmp(extension, ".sig") != 0 && strcmp(extension, ".pat") != 0)) {
1301  RZ_LOG_ERROR("FLIRT: unknown extension '%s'\n", extension);
1302  return false;
1303  }
1304 
1305  if (!(flirt_buf = rz_buf_new_slurp(flirt_file))) {
1306  RZ_LOG_ERROR("FLIRT: Can't open %s\n", flirt_file);
1307  return false;
1308  }
1309 
1310  if (!strcmp(extension, ".pat")) {
1311  node = rz_sign_flirt_parse_string_pattern_from_buffer(flirt_buf, RZ_FLIRT_NODE_OPTIMIZE_MAX, NULL);
1312  } else {
1313  node = rz_sign_flirt_parse_compressed_pattern_from_buffer(flirt_buf, expected_arch, NULL);
1314  }
1315 
1316  rz_buf_free(flirt_buf);
1317  if (node) {
1318  if (!node_match_functions(analysis, node)) {
1319  RZ_LOG_ERROR("FLIRT: Error while scanning the file %s\n", flirt_file);
1320  }
1321  rz_sign_flirt_node_free(node);
1322  return true;
1323  }
1324  RZ_LOG_ERROR("FLIRT: We encountered an error while parsing the file %s. Sorry.\n", flirt_file);
1325  return false;
1326 }
NULL
#define NULL
Definition: cris-opc.c:27
rz_sign_flirt_node_free
RZ_API void rz_sign_flirt_node_free(RZ_NULLABLE RzFlirtNode *node)
Frees an RzFlirtNode struct.
Definition: flirt.c:299
node_match_functions
static bool node_match_functions(RzAnalysis *analysis, const RzFlirtNode *root_node)
Tries to find matching functions between the signature infos in root_node and the analyzed functions ...
Definition: flirt.c:490
rz_sign_flirt_parse_compressed_pattern_from_buffer
RZ_API RZ_OWN RzFlirtNode * rz_sign_flirt_parse_compressed_pattern_from_buffer(RZ_NONNULL RzBuffer *flirt_buf, ut8 expected_arch, RZ_NULLABLE RzFlirtInfo *info)
Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode.
Definition: flirt.c:1136
rz_return_val_if_fail
#define rz_return_val_if_fail(expr, val)
Definition: rz_assert.h:108
rz_buf_new_slurp
RZ_API RZ_OWN RzBuffer * rz_buf_new_slurp(const char *file)
Creates a new buffer from a file.
Definition: buf.c:384
rz_buf_free
RZ_API void rz_buf_free(RzBuffer *b)
Free all internal data hold by the buffer and the buffer.
Definition: buf.c:1253
rz_sign_flirt_parse_string_pattern_from_buffer
RZ_API RZ_OWN RzFlirtNode * rz_sign_flirt_parse_string_pattern_from_buffer(RZ_NONNULL RzBuffer *flirt_buf, ut32 optimization, RZ_NULLABLE RzFlirtInfo *info)
Parses the RzBuffer containing a FLIRT signature in string format and returns an RzFlirtNode.
Definition: pat.c:356
RZ_LOG_ERROR
#define RZ_LOG_ERROR(fmtstr,...)
Definition: rz_log.h:58
RZ_STR_ISNOTEMPTY
#define RZ_STR_ISNOTEMPTY(x)
Definition: rz_str.h:68
rz_str_lchr
RZ_API const char * rz_str_lchr(const char *str, char chr)
Definition: str.c:669
RZ_STR_ISEMPTY
#define RZ_STR_ISEMPTY(x)
Definition: rz_str.h:67
rz_buf_t
Definition: rz_buf.h:43
rz_flirt_node_t
Definition: rz_flirt.h:176

References node_match_functions(), NULL, rz_buf_free(), rz_buf_new_slurp(), RZ_FLIRT_NODE_OPTIMIZE_MAX, RZ_FLIRT_SIG_ARCH_ANY, RZ_LOG_ERROR, rz_return_val_if_fail, rz_sign_flirt_node_free(), rz_sign_flirt_parse_compressed_pattern_from_buffer(), rz_sign_flirt_parse_string_pattern_from_buffer(), RZ_STR_ISEMPTY, RZ_STR_ISNOTEMPTY, and rz_str_lchr().

Referenced by rz_core_analysis_sigdb_apply(), and rz_flirt_scan_handler().

◆ rz_sign_flirt_info_fini()

RZ_API void rz_sign_flirt_info_fini ( RZ_NULLABLE RzFlirtInfo *  info)

Frees an RzFlirtInfo struct elements without freeing the pointer.

Parameters
RzFlirtInfoThe RzFlirtInfo elements to be freed

Definition at line 315 of file flirt.c.

315  {
316  if (!info) {
317  return;
318  }
319  if (info->type == RZ_FLIRT_FILE_TYPE_SIG) {
320  free(info->u.sig.name);
321  }
322  memset(info, 0, sizeof(RzFlirtInfo));
323 }
info
RzBinInfo * info(RzBinFile *bf)
Definition: bin_ne.c:86
free
RZ_API void Ht_() free(HtName_(Ht) *ht)
Definition: ht_inc.c:130
memset
return memset(p, 0, total)
rz_bin_info_t::type
char * type
Definition: rz_bin.h:211
rz_flirt_info_t
Definition: rz_flirt.h:208

References free(), info(), memset(), RZ_FLIRT_FILE_TYPE_SIG, and rz_bin_info_t::type.

Referenced by rz_core_flirt_dump_file(), and sigdb_signature_resolve_details().

◆ rz_sign_flirt_node_count_nodes()

RZ_API ut32 rz_sign_flirt_node_count_nodes ( RZ_NONNULL const RzFlirtNode *  node)

Counts the number of FLIRT signatures in the node.

Parameters
flirt_fileThe FLIRT node to use to count
Returns
Number of signatures

Definition at line 1334 of file flirt.c.

1334  {
1335  rz_return_val_if_fail(node, 0);
1336  ut32 count = 0;
1337  RzListIter *it;
1338  RzFlirtNode *child;
1339  rz_list_foreach (node->child_list, it, child) {
1340  count += rz_sign_flirt_node_count_nodes(child);
1341  }
1342  if (rz_list_length(node->module_list) > 0) {
1343  count += 1;
1344  }
1345  return count;
1346 }
count
static static sync static getppid static getegid const char static filename char static len const char char static bufsiz static mask static vfork const void static prot static getpgrp const char static swapflags static arg static fd static protocol static who struct sockaddr static addrlen static backlog struct timeval struct timezone static tz const struct iovec static count static mode const void const struct sockaddr static tolen const char static pathname void count
Definition: sflib.h:98
ut32
uint32_t ut32
Definition: demangler_util.h:31
rz_sign_flirt_node_count_nodes
RZ_API ut32 rz_sign_flirt_node_count_nodes(RZ_NONNULL const RzFlirtNode *node)
Counts the number of FLIRT signatures in the node.
Definition: flirt.c:1334
rz_list_length
RZ_API ut32 rz_list_length(RZ_NONNULL const RzList *list)
Returns the length of the list.
Definition: list.c:109
rz_list_iter_t
Definition: rz_list.h:13

References count, rz_list_length(), rz_return_val_if_fail, and rz_sign_flirt_node_count_nodes().

Referenced by rz_core_flirt_create_file(), rz_sign_flirt_node_count_nodes(), rz_sign_flirt_parse_compressed_pattern_from_buffer(), rz_sign_flirt_parse_string_pattern_from_buffer(), and rz_sign_flirt_write_compressed_pattern_to_buffer().

◆ rz_sign_flirt_node_free()

RZ_API void rz_sign_flirt_node_free ( RZ_NULLABLE RzFlirtNode *  node)

Frees an RzFlirtNode struct.

Parameters
RzFlirtNodeThe RzFlirtNode to be freed

Definition at line 299 of file flirt.c.

299  {
300  if (!node) {
301  return;
302  }
303  free(node->pattern_mask);
304  free(node->pattern_bytes);
305  rz_list_free(node->module_list);
306  rz_list_free(node->child_list);
307  free(node);
308 }
rz_list_free
RZ_API void rz_list_free(RZ_NONNULL RzList *list)
Empties the list and frees the list pointer.
Definition: list.c:137

References free(), and rz_list_free().

Referenced by flirt_create_child(), flirt_create_child_from_analysis(), flirt_node_optimize(), flirt_node_shorten_and_insert(), flirt_pat_parse_line(), parse_tree(), rz_core_flirt_convert_file(), rz_core_flirt_create_file(), rz_core_flirt_dump_file(), rz_sign_flirt_apply(), rz_sign_flirt_node_new(), rz_sign_flirt_parse_string_pattern_from_buffer(), and sigdb_signature_resolve_details().

◆ rz_sign_flirt_node_new()

RZ_API RZ_OWN RzFlirtNode* rz_sign_flirt_node_new ( RZ_NONNULL RzAnalysis *  analysis,
ut32  optimization 
)

Generates the FLIRT signatures and returns an RzFlirtNode.

Parameters
analysisThe RzAnalysis structure to derive the signatures.
optimizationOptimization to apply after creation of the flatten nodes.
Returns
Generated FLIRT root node.

Definition at line 355 of file create.c.

355  {
356  rz_return_val_if_fail(analysis && analysis->coreb.core, NULL);
357  if (optimization > RZ_FLIRT_NODE_OPTIMIZE_MAX) {
358  RZ_LOG_ERROR("FLIRT: optimization value is invalid (%u > RZ_FLIRT_NODE_OPTIMIZE_MAX).\n", optimization);
359  return NULL;
360  }
361 
362  if (rz_list_length(analysis->fcns) < 1) {
363  RZ_LOG_ERROR("FLIRT: There are no analyzed functions. Have you run 'aa'?\n");
364  return NULL;
365  }
366  bool tail_bytes = optimization != RZ_FLIRT_NODE_OPTIMIZE_MAX;
367  RzFlirtNode *root = RZ_NEW0(RzFlirtNode);
368  if (!root) {
369  RZ_LOG_ERROR("FLIRT: cannot allocate root node.\n");
370  return NULL;
371  }
372  root->child_list = rz_list_newf((RzListFree)rz_sign_flirt_node_free);
373 
374  RzListIter *it;
375  RzAnalysisFunction *func;
376  rz_list_foreach (analysis->fcns, it, func) {
377  ut64 func_size = rz_analysis_function_linear_size(func);
378  if (!func->name) {
379  RZ_LOG_ERROR("FLIRT: function at 0x%" PFMT64x " has a null name. skipping function...\n", func->addr);
380  continue;
381  } else if ((func->type != RZ_ANALYSIS_FCN_TYPE_FCN &&
382  func->type != RZ_ANALYSIS_FCN_TYPE_LOC &&
383  func->type != RZ_ANALYSIS_FCN_TYPE_SYM) ||
384  func_size < 1 ||
385  starts_with_flag(func->name, "imp.") ||
386  starts_with_flag(func->name, "sym.imp.")) {
387  continue;
388  }
389 
390  if (func_size > ST32_MAX) {
391  RZ_LOG_ERROR("FLIRT: this function exceeds the max size allowed by iob->read_at.\n");
392  RZ_LOG_ERROR("FLIRT: this should never happen. please open a bug report.\n");
393  goto fail;
394  }
395 
396  ut8 *pattern = malloc(func_size);
397  if (!pattern) {
398  RZ_LOG_ERROR("FLIRT: cannot allocate function buffer.\n");
399  goto fail;
400  }
401 
402  if (!analysis->iob.read_at(analysis->iob.io, func->addr, pattern, (int)func_size)) {
403  RZ_LOG_WARN("FLIRT: couldn't read function %s at 0x%" PFMT64x ".\n", func->name, func->addr);
404  free(pattern);
405  continue;
406  }
407 
408  ut8 *mask = rz_analysis_mask(analysis, func_size, pattern, func->addr);
409  if (!mask) {
410  RZ_LOG_ERROR("FLIRT: cannot calculate pattern mask.\n");
411  free(pattern);
412  goto fail;
413  } else if (!is_valid_mask_prelude(mask, func_size)) {
414  free(pattern);
415  free(mask);
416  continue;
417  }
418 
419  for (ut32 i = func_size - 1; i > 1; --i) {
420  if (mask[i] != 0xFF) {
421  func_size--;
422  continue;
423  }
424  break;
425  }
426 
427  RzFlirtNode *child = flirt_create_child_from_analysis(analysis, func, pattern, mask, func_size, tail_bytes);
428  RZ_FREE(pattern);
429  free(mask);
430  if (!child || !rz_list_append(root->child_list, child)) {
431  RZ_LOG_ERROR("FLIRT: cannot append child to root list.\n");
432  rz_sign_flirt_node_free(child);
433  goto fail;
434  }
435  }
436 
437  if (rz_list_length(root->child_list) < 1) {
438  RZ_LOG_ERROR("FLIRT: cannot create signature file when i do not have signatures.\n");
439  goto fail;
440  }
441 
442  if (optimization == RZ_FLIRT_NODE_OPTIMIZE_NONE) {
443  rz_list_sort(root->child_list, (RzListComparator)flirt_compare_node);
444  } else if (!flirt_node_optimize(root)) {
445  goto fail;
446  }
447 
448  return root;
449 
450 fail:
451  rz_sign_flirt_node_free(root);
452  return NULL;
453 }
rz_analysis_function_linear_size
RZ_API ut64 rz_analysis_function_linear_size(RzAnalysisFunction *fcn)
Definition: function.c:318
rz_analysis_mask
RZ_API ut8 * rz_analysis_mask(RzAnalysis *analysis, ut32 size, const ut8 *data, ut64 at)
Definition: analysis.c:334
mask
#define mask()
Definition: analysis_h8300.c:39
i
lzma_index ** i
Definition: index.h:629
flirt_compare_node
int flirt_compare_node(const RzFlirtNode *a, const RzFlirtNode *b)
Definition: create.c:225
flirt_create_child_from_analysis
static RzFlirtNode * flirt_create_child_from_analysis(RzAnalysis *analysis, RzAnalysisFunction *func, const ut8 *buffer, const ut8 *mask, ut32 b_size, bool tail_bytes)
Definition: create.c:177
starts_with_flag
#define starts_with_flag(b, c)
Definition: create.c:12
flirt_node_optimize
bool flirt_node_optimize(RzFlirtNode *root)
Definition: create.c:316
is_valid_mask_prelude
static bool is_valid_mask_prelude(const ut8 *buffer, ut32 b_size)
Definition: create.c:207
root
int root
Definition: enough.c:226
ut8
uint8_t ut8
Definition: lh5801.h:11
rz_list_newf
RZ_API RZ_OWN RzList * rz_list_newf(RzListFree f)
Returns a new initialized RzList pointer and sets the free method.
Definition: list.c:248
rz_list_sort
RZ_API void rz_list_sort(RZ_NONNULL RzList *list, RZ_NONNULL RzListComparator cmp)
Sorts via merge sort or via insertion sort a list.
Definition: list.c:743
rz_list_append
RZ_API RZ_BORROW RzListIter * rz_list_append(RZ_NONNULL RzList *list, void *data)
Appends at the end of the list a new element.
Definition: list.c:288
malloc
void * malloc(size_t size)
Definition: malloc.c:123
RZ_ANALYSIS_FCN_TYPE_SYM
@ RZ_ANALYSIS_FCN_TYPE_SYM
Definition: rz_analysis.h:195
RZ_ANALYSIS_FCN_TYPE_LOC
@ RZ_ANALYSIS_FCN_TYPE_LOC
Definition: rz_analysis.h:194
RZ_ANALYSIS_FCN_TYPE_FCN
@ RZ_ANALYSIS_FCN_TYPE_FCN
Definition: rz_analysis.h:193
rz_sign_flirt_node_free
RZ_API void rz_sign_flirt_node_free(RZ_NULLABLE RzFlirtNode *node)
Frees an RzFlirtNode struct.
Definition: flirt.c:299
RzListFree
void(* RzListFree)(void *ptr)
Definition: rz_list.h:11
RzListComparator
int(* RzListComparator)(const void *value, const void *list_data)
Definition: rz_list.h:33
RZ_LOG_WARN
#define RZ_LOG_WARN(fmtstr,...)
Definition: rz_log.h:56
RZ_NEW0
#define RZ_NEW0(x)
Definition: rz_types.h:284
RZ_FREE
#define RZ_FREE(x)
Definition: rz_types.h:369
PFMT64x
#define PFMT64x
Definition: rz_types.h:393
ST32_MAX
#define ST32_MAX
Definition: rz_types_base.h:97
rz_analysis_function_t
Definition: rz_analysis.h:239
rz_analysis_function_t::name
char * name
Definition: rz_analysis.h:240
rz_analysis_function_t::addr
ut64 addr
Definition: rz_analysis.h:244
rz_analysis_function_t::type
int type
Definition: rz_analysis.h:242
fail
#define fail(test)
Definition: tests.h:29
ut64
ut64(WINAPI *w32_GetEnabledXStateFeatures)()

References rz_analysis_function_t::addr, fail, flirt_compare_node(), flirt_create_child_from_analysis(), flirt_node_optimize(), free(), i, is_valid_mask_prelude(), malloc(), mask, rz_analysis_function_t::name, NULL, PFMT64x, root, RZ_ANALYSIS_FCN_TYPE_FCN, RZ_ANALYSIS_FCN_TYPE_LOC, RZ_ANALYSIS_FCN_TYPE_SYM, rz_analysis_function_linear_size(), rz_analysis_mask(), RZ_FLIRT_NODE_OPTIMIZE_MAX, RZ_FLIRT_NODE_OPTIMIZE_NONE, RZ_FREE, rz_list_append(), rz_list_length(), rz_list_newf(), rz_list_sort(), RZ_LOG_ERROR, RZ_LOG_WARN, RZ_NEW0, rz_return_val_if_fail, rz_sign_flirt_node_free(), ST32_MAX, starts_with_flag, rz_analysis_function_t::type, and ut64().

Referenced by rz_core_flirt_create_file().

◆ rz_sign_flirt_parse_compressed_pattern_from_buffer()

RZ_API RZ_OWN RzFlirtNode* rz_sign_flirt_parse_compressed_pattern_from_buffer ( RZ_NONNULL RzBuffer *  flirt_buf,
ut8  expected_arch,
RZ_NULLABLE RzFlirtInfo *  info 
)

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode.

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode if expected_arch matches the id or RZ_FLIRT_SIG_ARCH_ANY is set.

Parameters
flirt_bufThe buffer to read
expected_archThe expected arch to be used for the buffer
infoPointer to a RzFlirtInfo that can be used to get info about the sig file
Returns
Parsed FLIRT node

Definition at line 1136 of file flirt.c.

1136  {
1137  rz_return_val_if_fail(flirt_buf && expected_arch <= RZ_FLIRT_SIG_ARCH_ANY, NULL);
1138 
1139  ut8 *name = NULL;
1140  ut8 *buf = NULL, *decompressed_buf = NULL;
1141  RzBuffer *rz_buf = NULL;
1142  int size, decompressed_size;
1143  RzFlirtNode *node = NULL;
1144  RzFlirtNode *ret = NULL;
1145  idasig_v5_t *header = NULL;
1146  idasig_v6_v7_t *v6_v7 = NULL;
1147  idasig_v8_v9_t *v8_v9 = NULL;
1148  idasig_v10_t *v10 = NULL;
1149 
1150  ParseStatus ps = { 0 };
1151 
1152  if (!(ps.version = flirt_parse_version(flirt_buf))) {
1153  goto exit;
1154  }
1155 
1156  if (ps.version < 5 || ps.version > 10) {
1157  RZ_LOG_ERROR("FLIRT: Unsupported flirt signature version\n");
1158  goto exit;
1159  }
1160 
1161  if (!(header = RZ_NEW0(idasig_v5_t))) {
1162  goto exit;
1163  }
1164 
1165  parse_v5_header(flirt_buf, header);
1166 
1167  if (expected_arch != RZ_FLIRT_SIG_ARCH_ANY && header->arch != expected_arch) {
1168  RZ_LOG_ERROR("FLIRT: the binary architecture did not match the .sig one.\n");
1169  goto exit;
1170  }
1171 
1172  if (ps.version >= 6) {
1173  if (!(v6_v7 = RZ_NEW0(idasig_v6_v7_t))) {
1174  goto exit;
1175  }
1176  if (!parse_v6_v7_header(flirt_buf, v6_v7)) {
1177  goto exit;
1178  }
1179 
1180  if (ps.version >= 8) {
1181  if (!(v8_v9 = RZ_NEW0(idasig_v8_v9_t))) {
1182  goto exit;
1183  }
1184  if (!parse_v8_v9_header(flirt_buf, v8_v9)) {
1185  goto exit;
1186  }
1187 
1188  if (ps.version >= 10) {
1189  if (!(v10 = RZ_NEW0(idasig_v10_t))) {
1190  goto exit;
1191  }
1192  if (!parse_v10_header(flirt_buf, v10)) {
1193  goto exit;
1194  }
1195  }
1196  }
1197  }
1198 
1199  name = malloc(header->library_name_len + 1);
1200  if (!name) {
1201  RZ_LOG_ERROR("FLIRT: failed to allocate library name\n");
1202  goto exit;
1203  }
1204 
1205  if (rz_buf_read(flirt_buf, name, header->library_name_len) != header->library_name_len) {
1206  RZ_LOG_ERROR("FLIRT: failed to read library name\n");
1207  goto exit;
1208  }
1209 
1210  name[header->library_name_len] = '\0';
1211 
1212  size = rz_buf_size(flirt_buf) - rz_buf_tell(flirt_buf);
1213  buf = malloc(size);
1214  if (!buf) {
1215  RZ_LOG_ERROR("FLIRT: failed to allocate buffer for signature body\n");
1216  goto exit;
1217  }
1218 
1219  if (rz_buf_read(flirt_buf, buf, size) != size) {
1220  RZ_LOG_ERROR("FLIRT: failed to read signature body\n");
1221  goto exit;
1222  }
1223 
1224  if (header->features & IDASIG_FEATURE_COMPRESSED) {
1225  if (ps.version >= 5 && ps.version < 7) {
1226  if (!(decompressed_buf = rz_inflate_ignore_header(buf, size, NULL, &decompressed_size))) {
1227  RZ_LOG_ERROR("FLIRT: Failed to decompress buffer.\n");
1228  goto exit;
1229  }
1230  } else if (ps.version >= 7) {
1231  if (!(decompressed_buf = rz_inflate(buf, size, NULL, &decompressed_size))) {
1232  RZ_LOG_ERROR("FLIRT: Failed to decompress buffer.\n");
1233  goto exit;
1234  }
1235  } else {
1236  RZ_LOG_ERROR("FLIRT: Sorry we do not support compressed signatures with version %d.\n", ps.version);
1237  goto exit;
1238  }
1239 
1240  RZ_FREE(buf);
1241  buf = decompressed_buf;
1242  size = decompressed_size;
1243  }
1244  rz_buf = rz_buf_new_with_pointers(buf, size, false);
1245  if (!rz_buf) {
1246  RZ_LOG_ERROR("FLIRT: failed to allocate new RzBuffer\n");
1247  goto exit;
1248  }
1249  ps.buffer = rz_buf;
1250 
1251  if (!(node = RZ_NEW0(RzFlirtNode))) {
1252  RZ_LOG_ERROR("FLIRT: failed to allocate root RzFlirtNode\n");
1253  goto exit;
1254  }
1255 
1256  if (parse_tree(&ps, node)) {
1257  ret = node;
1258  } else {
1259  free(node);
1260  }
1261 
1262  if (info && ret) {
1263  info->type = RZ_FLIRT_FILE_TYPE_SIG;
1264  info->u.sig.version = ps.version;
1265  info->u.sig.architecture = header->arch;
1266  info->u.sig.n_modules = rz_sign_flirt_node_count_nodes(ret);
1267  info->u.sig.name = (char *)name;
1268  name = NULL;
1269  }
1270 
1271 exit:
1272  free(buf);
1273  rz_buf_free(rz_buf);
1274  free(header);
1275  free(v6_v7);
1276  free(v8_v9);
1277  free(v10);
1278  free(name);
1279  return ret;
1280 }
parse_v10_header
static int parse_v10_header(RzBuffer *buf, idasig_v10_t *header)
Definition: flirt.c:1005
parse_tree
static ut8 parse_tree(ParseStatus *b, RzFlirtNode *root_node)
Definition: flirt.c:902
parse_v6_v7_header
static int parse_v6_v7_header(RzBuffer *buf, idasig_v6_v7_t *header)
Definition: flirt.c:987
flirt_parse_version
static ut8 flirt_parse_version(RzBuffer *buffer)
Returns the FLIRT file version read from the RzBuffer This function returns the FLIRT file version,...
Definition: flirt.c:1021
parse_v8_v9_header
static int parse_v8_v9_header(RzBuffer *buf, idasig_v8_v9_t *header)
Definition: flirt.c:996
parse_v5_header
static bool parse_v5_header(RzBuffer *buf, idasig_v5_t *header)
Definition: flirt.c:945
IDASIG_FEATURE_COMPRESSED
#define IDASIG_FEATURE_COMPRESSED
Definition: flirt.c:135
size
voidpf void uLong size
Definition: ioapi.h:138
buf
voidpf void * buf
Definition: ioapi.h:138
header
#define header(is_bt, len_min, ret_op)
Definition: lz_encoder_mf.c:191
rz_buf_tell
RZ_API ut64 rz_buf_tell(RZ_NONNULL RzBuffer *b)
Return the current cursor position.
Definition: buf.c:1238
rz_buf_new_with_pointers
RZ_API RZ_OWN RzBuffer * rz_buf_new_with_pointers(const ut8 *bytes, ut64 len, bool steal)
Creates a new buffer with a bytes array.
Definition: buf.c:552
rz_buf_read
RZ_API st64 rz_buf_read(RZ_NONNULL RzBuffer *b, RZ_NONNULL RZ_OUT ut8 *buf, ut64 len)
rz_buf_size
RZ_API ut64 rz_buf_size(RZ_NONNULL RzBuffer *b)
Return the size of the buffer.
Definition: buf.c:1225
rz_inflate_ignore_header
RZ_API ut8 * rz_inflate_ignore_header(RZ_NONNULL const ut8 *src, int srcLen, int *srcConsumed, int *dstLen)
inflate zlib compressed or gzipped. The input must be a raw stream with no header or trailer.
Definition: compression.c:28
rz_inflate
RZ_API ut8 * rz_inflate(RZ_NONNULL const ut8 *src, int srcLen, int *srcConsumed, int *dstLen)
inflate zlib compressed or gzipped, automatically accepts either the zlib or gzip format,...
Definition: compression.c:18
idasig_v10_t
Definition: flirt.c:172
idasig_v5_t
Definition: flirt.c:148
idasig_v6_v7_t
Definition: flirt.c:164
idasig_v8_v9_t
Definition: flirt.c:168
name
Definition: z80asm.h:102
parse_status_t
Definition: flirt.c:176
parse_status_t::version
ut8 version
Definition: flirt.c:180
parse_status_t::buffer
RzBuffer * buffer
Definition: flirt.c:177

References parse_status_t::buffer, test-lz4-list::exit, flirt_parse_version(), free(), header, IDASIG_FEATURE_COMPRESSED, info(), malloc(), NULL, parse_tree(), parse_v10_header(), parse_v5_header(), parse_v6_v7_header(), parse_v8_v9_header(), rz_buf_free(), rz_buf_new_with_pointers(), rz_buf_read(), rz_buf_size(), rz_buf_tell(), RZ_FLIRT_FILE_TYPE_SIG, RZ_FLIRT_SIG_ARCH_ANY, RZ_FREE, rz_inflate(), rz_inflate_ignore_header(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, rz_sign_flirt_node_count_nodes(), rz_bin_info_t::type, and parse_status_t::version.

Referenced by rz_core_flirt_convert_file(), rz_core_flirt_dump_file(), and rz_sign_flirt_apply().

◆ rz_sign_flirt_parse_header_compressed_pattern_from_buffer()

RZ_API RZ_OWN bool rz_sign_flirt_parse_header_compressed_pattern_from_buffer ( RZ_NONNULL RzBuffer *  flirt_buf,
RZ_NONNULL RzFlirtInfo *  info 
)

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtInfo.

Parses the RzBuffer containing a FLIRT structure and returns an RzFlirtNode if expected_arch matches the id or RZ_FLIRT_SIG_ARCH_ANY is set.

Parameters
flirt_bufThe buffer to read
expected_archThe expected arch to be used for the buffer
infoPointer to a RzFlirtInfo that can be used to get info about the sig file
Returns
Parsed FLIRT node

Definition at line 1062 of file flirt.c.

1062  {
1063  rz_return_val_if_fail(flirt_buf && info, false);
1064 
1065  bool res = false;
1066  ut8 *name = NULL;
1067  idasig_v5_t v5 = { 0 };
1068  idasig_v6_v7_t v6_v7 = { 0 };
1069  idasig_v8_v9_t v8_v9 = { 0 };
1070  idasig_v10_t v10 = { 0 };
1071 
1072  if (!parse_v5_header(flirt_buf, &v5)) {
1073  RZ_LOG_ERROR("FLIRT: invalid sig header.\n");
1074  goto exit;
1075  }
1076 
1077  if (memcmp((const char *)v5.magic, "IDASGN", 6)) {
1078  RZ_LOG_ERROR("FLIRT: invalid sig magic.\n");
1079  goto exit;
1080  }
1081 
1082  if (v5.version < 5 || v5.version > 10) {
1083  RZ_LOG_ERROR("FLIRT: Unsupported flirt signature version\n");
1084  goto exit;
1085  }
1086 
1087  if (v5.version >= 6 && !parse_v6_v7_header(flirt_buf, &v6_v7)) {
1088  goto exit;
1089  }
1090 
1091  if (v5.version >= 8 && !parse_v8_v9_header(flirt_buf, &v8_v9)) {
1092  goto exit;
1093  }
1094 
1095  if (v5.version >= 10 && !parse_v10_header(flirt_buf, &v10)) {
1096  goto exit;
1097  }
1098 
1099  name = malloc(v5.library_name_len + 1);
1100  if (!name) {
1101  RZ_LOG_ERROR("FLIRT: failed to allocate library name\n");
1102  goto exit;
1103  }
1104 
1105  if (rz_buf_read(flirt_buf, name, v5.library_name_len) != v5.library_name_len) {
1106  RZ_LOG_ERROR("FLIRT: failed to read library name\n");
1107  goto exit;
1108  }
1109 
1110  name[v5.library_name_len] = '\0';
1111 
1112  info->type = RZ_FLIRT_FILE_TYPE_SIG;
1113  info->u.sig.version = v5.version;
1114  info->u.sig.architecture = v5.arch;
1115  info->u.sig.n_modules = v5.version < 6 ? v5.old_n_functions : v6_v7.n_functions;
1116  info->u.sig.name = (char *)name;
1117  name = NULL;
1118  res = true;
1119 
1120 exit:
1121  free(name);
1122  return res;
1123 }
idasig_v5_t::magic
ut8 magic[6]
Definition: flirt.c:150
idasig_v5_t::arch
ut8 arch
Definition: flirt.c:152
idasig_v5_t::library_name_len
ut8 library_name_len
Definition: flirt.c:160
idasig_v5_t::version
ut8 version
Definition: flirt.c:151
idasig_v5_t::old_n_functions
ut16 old_n_functions
Definition: flirt.c:157
idasig_v6_v7_t::n_functions
ut32 n_functions
Definition: flirt.c:165

References idasig_v5_t::arch, test-lz4-list::exit, free(), info(), idasig_v5_t::library_name_len, idasig_v5_t::magic, malloc(), idasig_v6_v7_t::n_functions, NULL, idasig_v5_t::old_n_functions, parse_v10_header(), parse_v5_header(), parse_v6_v7_header(), parse_v8_v9_header(), rz_buf_read(), RZ_FLIRT_FILE_TYPE_SIG, RZ_LOG_ERROR, rz_return_val_if_fail, rz_bin_info_t::type, and idasig_v5_t::version.

Referenced by sigdb_signature_resolve_details().

◆ rz_sign_flirt_parse_string_pattern_from_buffer()

RZ_API RZ_OWN RzFlirtNode* rz_sign_flirt_parse_string_pattern_from_buffer ( RZ_NONNULL RzBuffer *  flirt_buf,
ut32  optimization,
RZ_NULLABLE RzFlirtInfo *  info 
)

Parses the RzBuffer containing a FLIRT signature in string format and returns an RzFlirtNode.

Parameters
flirt_bufThe buffer to read
optimizationOptimization to apply after creation of the flatten nodes.
infoPointer to a RzFlirtInfo that can be used to get info about the pat file
Returns
Parsed FLIRT node

Definition at line 356 of file pat.c.

356  {
357  rz_return_val_if_fail(flirt_buf, NULL);
358 
359  if (optimization > RZ_FLIRT_NODE_OPTIMIZE_MAX) {
360  RZ_LOG_ERROR("FLIRT: optimization value is invalid (%u > RZ_FLIRT_NODE_OPTIMIZE_MAX).\n", optimization);
361  return NULL;
362  }
363 
364  char buffer[PAT_LINE_BUFFER_SIZE];
365  const char *buffer_end = buffer + sizeof(buffer);
366  ut32 line_num = 1;
367  char *newline = NULL;
368  st64 read = 0;
369  RzFlirtNode *root = NULL;
370  RzStrBuf *line = NULL;
371 
372  root = RZ_NEW0(RzFlirtNode);
373  if (!root) {
374  RZ_LOG_ERROR("FLIRT: cannot allocate root node\n");
375  return NULL;
376  }
377 
378  root->child_list = rz_list_newf((RzListFree)rz_sign_flirt_node_free);
379  if (!root->child_list) {
380  free(root);
381  RZ_LOG_ERROR("FLIRT: cannot allocate root node child list\n");
382  return NULL;
383  }
384 
385  line = rz_strbuf_new("");
386  if (!line) {
387  rz_sign_flirt_node_free(root);
388  RZ_LOG_ERROR("FLIRT: cannot allocate line buffer\n");
389  return NULL;
390  }
391 
392  bool tail_bytes = optimization != RZ_FLIRT_NODE_OPTIMIZE_MAX;
393  do {
394  if (newline && rz_strbuf_length(line) > 0) {
395  char *p = newline + 1;
396  pat_dbg("%05u: %s\n", line_num, rz_strbuf_get(line));
397  bool parsed = flirt_pat_parse_line(root, line, line_num, tail_bytes);
398  rz_strbuf_fini(line);
399  rz_strbuf_init(line);
400  if (!parsed) {
401  break;
402  }
403  line_num++;
404  if (p < buffer_end && *p) {
405  if ((newline = strchr(p, '\n'))) {
406  newline[0] = 0;
407  }
408  rz_strbuf_append(line, p);
409  }
410  continue;
411  }
412  memset(buffer, 0, sizeof(buffer));
413  if ((read = rz_buf_read(flirt_buf, (ut8 *)buffer, sizeof(buffer) - 1)) < 1) {
414  break;
415  }
416  if ((newline = strchr(buffer, '\n'))) {
417  newline[0] = 0;
418  }
419  rz_strbuf_append(line, buffer);
420  } while (true);
421 
422  if (rz_strbuf_length(line) > 0) {
423  flirt_pat_parse_line(root, line, line_num, tail_bytes);
424  }
425 
426  rz_strbuf_free(line);
427 
428  if (optimization == RZ_FLIRT_NODE_OPTIMIZE_NONE) {
429  rz_list_sort(root->child_list, (RzListComparator)flirt_compare_node);
430  } else if (!flirt_node_optimize(root)) {
431  rz_sign_flirt_node_free(root);
432  return NULL;
433  }
434 
435  if (info) {
436  info->type = RZ_FLIRT_FILE_TYPE_PAT;
437  info->u.pat.n_modules = rz_sign_flirt_node_count_nodes(root);
438  }
439 
440  return root;
441 }
buffer
struct buffer buffer
p
void * p
Definition: libc.cpp:67
setup.line
line
Definition: setup.py:34
PAT_LINE_BUFFER_SIZE
#define PAT_LINE_BUFFER_SIZE
Definition: pat.c:52
flirt_compare_node
int flirt_compare_node(const RzFlirtNode *a, const RzFlirtNode *b)
Definition: create.c:225
flirt_pat_parse_line
static bool flirt_pat_parse_line(RzFlirtNode *root, RzStrBuf *sb, ut32 line_num, bool tail_bytes)
Definition: pat.c:140
flirt_node_optimize
bool flirt_node_optimize(RzFlirtNode *root)
Definition: create.c:316
pat_dbg
#define pat_dbg(...)
Definition: pat.c:49
rz_sign_flirt_node_count_nodes
RZ_API ut32 rz_sign_flirt_node_count_nodes(RZ_NONNULL const RzFlirtNode *node)
Counts the number of FLIRT signatures in the node.
Definition: flirt.c:1334
rz_strbuf_get
RZ_API char * rz_strbuf_get(RzStrBuf *sb)
Definition: strbuf.c:321
rz_strbuf_append
RZ_API bool rz_strbuf_append(RzStrBuf *sb, const char *s)
Definition: strbuf.c:222
rz_strbuf_fini
RZ_API void rz_strbuf_fini(RzStrBuf *sb)
Definition: strbuf.c:365
rz_strbuf_new
RZ_API RzStrBuf * rz_strbuf_new(const char *s)
Definition: strbuf.c:8
rz_strbuf_free
RZ_API void rz_strbuf_free(RzStrBuf *sb)
Definition: strbuf.c:358
rz_strbuf_init
RZ_API void rz_strbuf_init(RzStrBuf *sb)
Definition: strbuf.c:33
rz_strbuf_length
RZ_API int rz_strbuf_length(RzStrBuf *sb)
Definition: strbuf.c:28
st64
#define st64
Definition: rz_types_base.h:10
buffer
Definition: buffer.h:15
read
int read(izstream &zs, T *x, Items items)
Definition: zstream.h:115

References flirt_compare_node(), flirt_node_optimize(), flirt_pat_parse_line(), free(), info(), setup::line, memset(), NULL, p, pat_dbg, PAT_LINE_BUFFER_SIZE, read(), root, rz_buf_read(), RZ_FLIRT_FILE_TYPE_PAT, RZ_FLIRT_NODE_OPTIMIZE_MAX, RZ_FLIRT_NODE_OPTIMIZE_NONE, rz_list_newf(), rz_list_sort(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, rz_sign_flirt_node_count_nodes(), rz_sign_flirt_node_free(), rz_strbuf_append(), rz_strbuf_fini(), rz_strbuf_free(), rz_strbuf_get(), rz_strbuf_init(), rz_strbuf_length(), rz_strbuf_new(), st64, and rz_bin_info_t::type.

Referenced by rz_core_flirt_convert_file(), rz_core_flirt_dump_file(), rz_sign_flirt_apply(), and sigdb_signature_resolve_details().

◆ rz_sign_flirt_write_compressed_pattern_to_buffer()

RZ_API bool rz_sign_flirt_write_compressed_pattern_to_buffer ( RZ_NONNULL const RzFlirtNode *  node,
RZ_NONNULL RzBuffer *  buffer,
RzFlirtCompressedOptions *  options 
)

Writes in the the RzBuffer the FLIRT signatures in compressed format.

Parameters
nodeThe FLIRT node to use as input
bufferThe buffer to write to
Returns
Parsed FLIRT node

Definition at line 1580 of file flirt.c.

1580  {
1581  rz_return_val_if_fail(node && buffer && options, false);
1582  RzBuffer *body = buffer;
1583 
1584  if (options->version < 5 || options->version > 10) {
1585  RZ_LOG_ERROR("FLIRT: unsupported sig type version %u\n", options->version);
1586  return false;
1587  } else if (options->arch >= RZ_FLIRT_SIG_ARCH_ANY) {
1588  RZ_LOG_ERROR("FLIRT: unsupported architecture %u\n", options->arch);
1589  return false;
1590  } else if (RZ_STR_ISEMPTY(options->libname)) {
1591  RZ_LOG_ERROR("FLIRT: library name is empty\n");
1592  return false;
1593  }
1594 
1595  size_t library_name_len = strlen(options->libname);
1596  if (library_name_len > RZ_FLIRT_LIBRARY_NAME_MAX) {
1597  RZ_LOG_ERROR("FLIRT: library name is too big. max size is %u\n", RZ_FLIRT_LIBRARY_NAME_MAX);
1598  return false;
1599  }
1600 
1601  if (options->deflate) {
1602  if (options->version < 7) {
1603  RZ_LOG_ERROR("FLIRT: cannot deflate body due FLIRT version being < 7\n");
1604  return false;
1605  }
1606 
1607  body = rz_buf_new_empty(0);
1608  if (!body) {
1609  RZ_LOG_ERROR("FLIRT: cannot allocate body buffer\n");
1610  return false;
1611  }
1612  }
1613 
1614  ut8 tmp[32];
1615  ut32 n_functions = rz_sign_flirt_node_count_nodes(node);
1616 
1617  // magic
1618  rz_buf_append_string(buffer, "IDASGN");
1619 
1620  // version
1621  rz_buf_append_le_bits(buffer, tmp, options->version, 8);
1622 
1623  // arch
1624  rz_buf_append_le_bits(buffer, tmp, options->arch, 8);
1625 
1626  // file_types (little endian)
1627  rz_buf_append_le_bits(buffer, tmp, options->file, 32);
1628 
1629  // os_types (little endian)
1630  rz_buf_append_le_bits(buffer, tmp, options->os, 16);
1631 
1632  // app_types (little endian)
1633  rz_buf_append_le_bits(buffer, tmp, options->app, 16);
1634 
1635  // features (little endian)
1636  rz_buf_append_le_bits(buffer, tmp, options->deflate ? IDASIG_FEATURE_COMPRESSED : IDASIG_FEATURE_NONE, 16);
1637 
1638  // n_functions (little endian) - used only in v5.
1639  rz_buf_append_le_bits(buffer, tmp, options->version >= 6 ? 0 : n_functions, 16);
1640 
1641  // crc16 (little endian)
1642  rz_buf_append_le_bits(buffer, tmp, 0, 16);
1643 
1644  // ctype (little endian)
1645  memset(tmp, 0, 12);
1646  rz_buf_append_bytes(buffer, tmp, 12);
1647 
1648  // library_name_len (max 255)
1649  rz_buf_append_le_bits(buffer, tmp, library_name_len, 8);
1650 
1651  // crc16_ctypes (little endian)
1652  rz_buf_append_le_bits(buffer, tmp, IDASIG_FEATURE_NONE, 16);
1653 
1654  if (options->version >= 6) {
1655  // n_functions (little endian)
1656  rz_buf_append_le_bits(buffer, tmp, n_functions, 32);
1657  }
1658 
1659  if (options->version >= 8) {
1660  // pattern_size (little endian) - we always use 32 bytes prelude
1661  rz_buf_append_le_bits(buffer, tmp, 32, 16);
1662  }
1663 
1664  if (options->version >= 10) {
1665  // unknown (little endian)
1666  rz_buf_append_le_bits(buffer, tmp, 0, 16);
1667  }
1668 
1669  // library name
1670  rz_buf_append_string(buffer, options->libname);
1671 
1672  if (!flirt_write_node(node, body, options->version)) {
1673  rz_buf_free(body);
1674  return false;
1675  }
1676 
1677  bool ret = true;
1678  if (options->deflate) {
1679  ut64 block_size = 1ull << 20; // 1 Mb
1680  if (!rz_deflatew_buf(body, buffer, block_size, NULL, 15)) {
1681  RZ_LOG_ERROR("FLIRT: cannot deflate body\n");
1682  ret = false;
1683  }
1684  rz_buf_free(body);
1685  }
1686  return ret;
1687 }
flirt_write_node
static bool flirt_write_node(RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer, ut8 version)
Definition: flirt.c:1507
rz_buf_append_le_bits
#define rz_buf_append_le_bits(buffer, tmp, value, bits)
Definition: flirt.c:121
IDASIG_FEATURE_NONE
#define IDASIG_FEATURE_NONE
Definition: flirt.c:130
options
static const char struct stat static buf struct stat static buf static vhangup int options
Definition: sflib.h:145
autogen_x86imm.tmp
tmp
Definition: autogen_x86imm.py:12
rz_buf_append_bytes
RZ_API bool rz_buf_append_bytes(RZ_NONNULL RzBuffer *b, RZ_NONNULL const ut8 *buf, ut64 len)
Append an array of bytes to the buffer.
Definition: buf.c:732
rz_buf_append_string
RZ_API st64 rz_buf_append_string(RZ_NONNULL RzBuffer *b, RZ_NONNULL const char *str)
Append a string to the buffer.
Definition: buf.c:962
rz_buf_new_empty
RZ_API RZ_OWN RzBuffer * rz_buf_new_empty(ut64 len)
Creates a new empty buffer with a predefined size;.
Definition: buf.c:285
rz_deflatew_buf
RZ_API bool rz_deflatew_buf(RZ_NONNULL RzBuffer *src, RZ_NONNULL RzBuffer *dst, ut64 block_size, ut8 *src_consumed, int wbits)
Definition: compression.c:327
RZ_FLIRT_LIBRARY_NAME_MAX
#define RZ_FLIRT_LIBRARY_NAME_MAX
Definition: rz_flirt.h:18

References flirt_write_node(), IDASIG_FEATURE_COMPRESSED, IDASIG_FEATURE_NONE, memset(), NULL, options, rz_buf_append_bytes(), rz_buf_append_le_bits, rz_buf_append_string(), rz_buf_free(), rz_buf_new_empty(), rz_deflatew_buf(), RZ_FLIRT_LIBRARY_NAME_MAX, RZ_FLIRT_SIG_ARCH_ANY, RZ_LOG_ERROR, rz_return_val_if_fail, rz_sign_flirt_node_count_nodes(), RZ_STR_ISEMPTY, autogen_x86imm::tmp, and ut64().

Referenced by rz_core_flirt_convert_file(), and rz_core_flirt_create_file().

◆ rz_sign_flirt_write_string_pattern_to_buffer()

RZ_API bool rz_sign_flirt_write_string_pattern_to_buffer ( RZ_NONNULL const RzFlirtNode *  root,
RZ_NONNULL RzBuffer *  buffer 
)

Writes in the the RzBuffer the FLIRT signatures in string format.

Parameters
rootThe FLIRT root node to use as input
bufferThe buffer to write to
Returns
Parsed FLIRT node

Definition at line 529 of file pat.c.

529  {
530  rz_return_val_if_fail(root && buffer, false);
531  // 4154554889FD534889F3C60700E8........C6441DFF004189C485C07515BE2E 07 FAEE 003B :0000@ Curl_gethostname ^000E gethostname ^0027 strchr ........4885C07403C600004489E05B5D415CC3
532  RzStrBuf sb;
533 
534  RzListIter *it;
535  RzFlirtNode *child;
536  rz_list_foreach (root->child_list, it, child) {
537  rz_strbuf_init(&sb);
538  if (!flirt_pat_write_line(child, buffer, &sb)) {
539  return false;
540  }
541  rz_strbuf_fini(&sb);
542  }
543  rz_buf_append_string(buffer, "---\n");
544  return true;
545 }
sb
static SblHeader sb
Definition: bin_mbn.c:26
flirt_pat_write_line
static bool flirt_pat_write_line(RZ_NONNULL const RzFlirtNode *node, RZ_NONNULL RzBuffer *buffer, RzStrBuf *prelude)
Definition: pat.c:453

References flirt_pat_write_line(), root, rz_buf_append_string(), rz_return_val_if_fail, rz_strbuf_fini(), rz_strbuf_init(), and sb.

Referenced by rz_core_flirt_convert_file(), and rz_core_flirt_create_file().

◆ rz_sign_sigdb_add_entry()

RZ_API bool rz_sign_sigdb_add_entry ( RZ_NONNULL RzSigDb *  db,
RZ_NONNULL const RzSigDBEntry *  entry 
)

Add a new signature entry to a database.

Parameters
dbDatabase of signatures
entrySingle signature entry to add to the database
Returns
true if the signature entry was correctly added to the database, false otherwise

Definition at line 158 of file sigdb.c.

158  {
159  rz_return_val_if_fail(db && entry, NULL);
160  return ht_pu_insert(db->entries, entry, 1);
161 }
entry
Definition: zipcmp.c:77

References NULL, and rz_return_val_if_fail.

Referenced by rz_sign_sigdb_load_database(), and sigdb_move_entry().

◆ rz_sign_sigdb_free()

RZ_API void rz_sign_sigdb_free ( RzSigDb *  db)

Definition at line 277 of file sigdb.c.

277  {
278  if (!db) {
279  return;
280  }
281  ht_pu_free(db->entries);
282  free(db);
283 }
rz_signature_db_t::entries
HtPU * entries
Definition: rz_flirt.h:252

References rz_signature_db_t::entries, and free().

Referenced by analysis_sigdb_add(), and rz_sign_sigdb_load_database().

◆ rz_sign_sigdb_list()

RZ_API RZ_OWN RzList* rz_sign_sigdb_list ( RZ_NONNULL const RzSigDb *  db)

Return the signature database as a list of entries.

Definition at line 294 of file sigdb.c.

294  {
295  rz_return_val_if_fail(db, NULL);
296 
297  RzList *res = rz_list_new();
298  if (!res) {
299  return NULL;
300  }
301  ht_pu_foreach(db->entries, sigdb_to_list, res);
302  rz_list_sort(res, (RzListComparator)sigdb_signature_cmp);
303  return res;
304 }
rz_list_new
RZ_API RZ_OWN RzList * rz_list_new(void)
Returns a new initialized RzList pointer (free method is not initialized)
Definition: list.c:235
sigdb_signature_cmp
static int sigdb_signature_cmp(const RzSigDBEntry *a, const RzSigDBEntry *b)
Definition: sigdb.c:24
sigdb_to_list
static bool sigdb_to_list(void *user, const void *k, const ut64 v)
Definition: sigdb.c:285
rz_list_t
Definition: rz_list.h:18

References NULL, rz_list_new(), rz_list_sort(), rz_return_val_if_fail, sigdb_signature_cmp(), and sigdb_to_list().

Referenced by rz_core_analysis_sigdb_list().

◆ rz_sign_sigdb_load_database()

RZ_API RZ_OWN RzSigDb* rz_sign_sigdb_load_database ( RZ_NONNULL const char *  sigdb_path,
bool  with_details 
)

Returns a database of signatures loaded from the signature database path.

Parameters
sigdb_pathThe signature database path/location
with_detailsWhen true, opens each signature within the db for extra details
Returns
List of entries

Definition at line 105 of file sigdb.c.

105  {
106  rz_return_val_if_fail(RZ_STR_ISNOTEMPTY(sigdb_path), NULL);
107  char glob[1024];
108  if (!rz_file_is_directory(sigdb_path)) {
109  RZ_LOG_ERROR("sigdb path is unknown or invalid (path: %s)\n", sigdb_path);
110  return NULL;
111  }
112  size_t path_len = strlen(sigdb_path) + 1; // ignoring also the filesystem separator
113  RzSigDb *sigs = rz_sign_sigdb_new();
114  if (!sigs) {
115  RZ_LOG_ERROR("cannot allocate signature database\n");
116  return NULL;
117  }
118 
119  rz_strf(glob, RZ_JOIN_2_PATHS("%s", "**"), sigdb_path);
120  RzList *files = rz_file_globsearch(glob, 10);
121  char *file = NULL;
122  RzListIter *iter = NULL;
123  RzSigDBEntry *sig = NULL;
124 
125  rz_list_foreach (files, iter, file) {
126  if (!rz_str_endswith(file, ".pat") && !rz_str_endswith(file, ".sig")) {
127  continue;
128  }
129 
130  sig = RZ_NEW0(RzSigDBEntry);
131  if (!sig) {
132  goto fail;
133  }
134 
135  sig->file_path = strdup(file);
136  if (!sig->file_path || !sigdb_signature_resolve_details(sig, path_len, with_details)) {
137  rz_sign_sigdb_signature_free(sig);
138  goto fail;
139  }
140  rz_sign_sigdb_add_entry(sigs, sig);
141  }
142  rz_list_free(files);
143  return sigs;
144 
145 fail:
146  rz_list_free(files);
147  rz_sign_sigdb_free(sigs);
148  return NULL;
149 }
files
checking print the parsed form of the magic use in n conjunction with m to debug a new magic file n before installing it n output MIME type special files
Definition: file_opts.h:46
strdup
return strdup("=SP r13\n" "=LR r14\n" "=PC r15\n" "=A0 r0\n" "=A1 r1\n" "=A2 r2\n" "=A3 r3\n" "=ZF zf\n" "=SF nf\n" "=OF vf\n" "=CF cf\n" "=SN or0\n" "gpr lr .32 56 0\n" "gpr pc .32 60 0\n" "gpr cpsr .32 64 0 ____tfiae_________________qvczn\n" "gpr or0 .32 68 0\n" "gpr tf .1 64.5 0 thumb\n" "gpr ef .1 64.9 0 endian\n" "gpr jf .1 64.24 0 java\n" "gpr qf .1 64.27 0 sticky_overflow\n" "gpr vf .1 64.28 0 overflow\n" "gpr cf .1 64.29 0 carry\n" "gpr zf .1 64.30 0 zero\n" "gpr nf .1 64.31 0 negative\n" "gpr itc .4 64.10 0 if_then_count\n" "gpr gef .4 64.16 0 great_or_equal\n" "gpr r0 .32 0 0\n" "gpr r1 .32 4 0\n" "gpr r2 .32 8 0\n" "gpr r3 .32 12 0\n" "gpr r4 .32 16 0\n" "gpr r5 .32 20 0\n" "gpr r6 .32 24 0\n" "gpr r7 .32 28 0\n" "gpr r8 .32 32 0\n" "gpr r9 .32 36 0\n" "gpr r10 .32 40 0\n" "gpr r11 .32 44 0\n" "gpr r12 .32 48 0\n" "gpr r13 .32 52 0\n" "gpr r14 .32 56 0\n" "gpr r15 .32 60 0\n" "gpr r16 .32 64 0\n" "gpr r17 .32 68 0\n")
rz_file_is_directory
RZ_API bool rz_file_is_directory(const char *str)
Definition: file.c:167
rz_file_globsearch
RZ_API RzList * rz_file_globsearch(const char *globbed_path, int maxdepth)
Definition: file.c:1263
rz_str_endswith
RZ_API bool rz_str_endswith(RZ_NONNULL const char *str, RZ_NONNULL const char *needle)
Checks if a string ends with a specifc sequence of characters (case sensitive)
Definition: str.c:3329
rz_strf
#define rz_strf(buf,...)
Convenience macro for local temporary strings.
Definition: rz_str.h:59
RZ_JOIN_2_PATHS
#define RZ_JOIN_2_PATHS(p1, p2)
Definition: rz_types.h:224
rz_sign_sigdb_new
RZ_API RZ_OWN RzSigDb * rz_sign_sigdb_new(void)
Create a new empty RzSigDb instance.
Definition: sigdb.c:260
rz_sign_sigdb_free
RZ_API void rz_sign_sigdb_free(RzSigDb *db)
Definition: sigdb.c:277
sigdb_signature_resolve_details
static bool sigdb_signature_resolve_details(RzSigDBEntry *entry, size_t path_len, bool with_details)
Definition: sigdb.c:28
rz_sign_sigdb_add_entry
RZ_API bool rz_sign_sigdb_add_entry(RZ_NONNULL RzSigDb *db, RZ_NONNULL const RzSigDBEntry *entry)
Add a new signature entry to a database.
Definition: sigdb.c:158
rz_sign_sigdb_signature_free
RZ_API void rz_sign_sigdb_signature_free(RZ_NULLABLE RzSigDBEntry *entry)
Frees a RzSigDBEntry structure.
Definition: sigdb.c:12
file
Definition: gzappend.c:170
rz_signature_database_entry_t
Definition: rz_flirt.h:240
rz_signature_database_entry_t::file_path
char * file_path
full path to the signature file
Definition: rz_flirt.h:246
rz_signature_db_t
Definition: rz_flirt.h:251

References fail, rz_signature_database_entry_t::file_path, files, NULL, rz_file_globsearch(), rz_file_is_directory(), RZ_JOIN_2_PATHS, rz_list_free(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, rz_sign_sigdb_add_entry(), rz_sign_sigdb_free(), rz_sign_sigdb_new(), rz_sign_sigdb_signature_free(), rz_str_endswith(), RZ_STR_ISNOTEMPTY, rz_strf, sigdb_signature_resolve_details(), and strdup().

Referenced by analysis_sigdb_add().

◆ rz_sign_sigdb_merge()

RZ_API bool rz_sign_sigdb_merge ( RZ_NONNULL RzSigDb *  db,
RZ_NONNULL RzSigDb *  db2 
)

Merge the signatures from db2 into db.

Data within db2 is moved into db, making it empty.

Parameters
dbDatabase of signatures to extend
db2Database of signatures that need to be merged into db
Returns
true if the databases were correctly merged, false otherwise

Definition at line 184 of file sigdb.c.

184  {
185  rz_return_val_if_fail(db && db2, NULL);
186  struct sigdb_move_data_t opt = {
187  .src = db2,
188  .dst = db,
189  };
190  db2->entries->opt.freefn = NULL;
191  ht_pu_foreach(db2->entries, sigdb_move_entry, &opt);
192  return true;
193 }
sigdb_move_entry
static bool sigdb_move_entry(void *user, const void *k, const ut64 v)
Definition: sigdb.c:168
sigdb_move_data_t
Definition: sigdb.c:163
sigdb_move_data_t::src
RzSigDb * src
Definition: sigdb.c:164

References rz_signature_db_t::entries, NULL, rz_return_val_if_fail, sigdb_move_entry(), and sigdb_move_data_t::src.

Referenced by analysis_sigdb_add().

◆ rz_sign_sigdb_new()

RZ_API RZ_OWN RzSigDb* rz_sign_sigdb_new ( void  )

Create a new empty RzSigDb instance.

Definition at line 260 of file sigdb.c.

260  {
261  RzSigDb *db = RZ_NEW0(RzSigDb);
262  if (!db) {
263  return NULL;
264  }
265  HtPUOptions opt = { 0 };
266  opt.cmp = sigdb_entry_cmp,
267  opt.hashfn = sigdb_entry_hash,
268  opt.freefn = ht_pu_sigdb_freekv;
269  db->entries = ht_pu_new_opt(&opt);
270  if (!db->entries) {
271  free(db);
272  return NULL;
273  }
274  return db;
275 }
ht_pu_sigdb_freekv
static void ht_pu_sigdb_freekv(HtPUKv *kv)
Definition: sigdb.c:250
sigdb_entry_cmp
static int sigdb_entry_cmp(const void *a, const void *b)
Definition: sigdb.c:218
sigdb_entry_hash
static ut32 sigdb_entry_hash(const void *k)
Definition: sigdb.c:241

References rz_signature_db_t::entries, free(), ht_pu_sigdb_freekv(), NULL, RZ_NEW0, sigdb_entry_cmp(), and sigdb_entry_hash().

Referenced by rz_core_analysis_sigdb_list(), and rz_sign_sigdb_load_database().

◆ rz_sign_sigdb_signature_free()

RZ_API void rz_sign_sigdb_signature_free ( RZ_NULLABLE RzSigDBEntry *  entry)

Frees a RzSigDBEntry structure.

Parameters
[in]entryThe RzSigDBEntry to free

Definition at line 12 of file sigdb.c.

12  {
13  if (!entry) {
14  return;
15  }
16  // base_name points to file_path, so there is no need to call free
17  // short_path points to file_path, so there is no need to call free
18  free(entry->bin_name);
19  free(entry->arch_name);
20  free(entry->file_path);
21  free(entry);
22 }

References free().

Referenced by ht_pu_sigdb_freekv(), and rz_sign_sigdb_load_database().