sigdb.c File Reference

#include <rz_flirt.h>

Go to the source code of this file.

Classes
struct	sigdb_move_data_t

Macros
#define	field_cmp(fname, cmpfunction)

Functions
RZ_API void	rz_sign_sigdb_signature_free (RZ_NULLABLE RzSigDBEntry *entry)
	Frees a RzSigDBEntry structure. More...
static int	sigdb_signature_cmp (const RzSigDBEntry *a, const RzSigDBEntry *b)
static bool	sigdb_signature_resolve_details (RzSigDBEntry *entry, size_t path_len, bool with_details)
RZ_API RZ_OWN RzSigDb *	rz_sign_sigdb_load_database (RZ_NONNULL const char *sigdb_path, bool with_details)
	Returns a database of signatures loaded from the signature database path. More...
RZ_API bool	rz_sign_sigdb_add_entry (RZ_NONNULL RzSigDb *db, RZ_NONNULL const RzSigDBEntry *entry)
	Add a new signature entry to a database. More...
static bool	sigdb_move_entry (void *user, const void *k, const ut64 v)
RZ_API bool	rz_sign_sigdb_merge (RZ_NONNULL RzSigDb *db, RZ_NONNULL RzSigDb *db2)
	Merge the signatures from db2 into db. More...
static int	ut32cmp (int a, int b)
static int	strcmp_null (const char *a, const char *b)
static int	sigdb_entry_cmp (const void *a, const void *b)
static ut32	sigdb_entry_hash (const void *k)
static void	ht_pu_sigdb_freekv (HtPUKv *kv)
RZ_API RZ_OWN RzSigDb *	rz_sign_sigdb_new (void)
	Create a new empty RzSigDb instance. More...
RZ_API void	rz_sign_sigdb_free (RzSigDb *db)
static bool	sigdb_to_list (void *user, const void *k, const ut64 v)
RZ_API RZ_OWN RzList *	rz_sign_sigdb_list (RZ_NONNULL const RzSigDb *db)
	Return the signature database as a list of entries. More...

Macro Definition Documentation

field_cmp

#define field_cmp	(		fname,
			cmpfunction
	)

Value:

    do { \
        int r = cmpfunction(sa->fname, sb->fname); \
        if (r != 0) { \
            return r; \
        } \
    } while (0)

Function Documentation

ht_pu_sigdb_freekv()

static void ht_pu_sigdb_freekv ( HtPUKv *  kv )

static

Definition at line 250 of file sigdb.c.

                                           {
    if (!kv) {
        return;
    }
    rz_sign_sigdb_signature_free(kv->key);
}

References rz_sign_sigdb_signature_free().

Referenced by rz_sign_sigdb_new().

rz_sign_sigdb_add_entry()

RZ_API bool rz_sign_sigdb_add_entry	(	RZ_NONNULL RzSigDb *	db,
		RZ_NONNULL const RzSigDBEntry *	entry
	)

Add a new signature entry to a database.

Parameters

db	Database of signatures
entry	Single signature entry to add to the database

Returns

true if the signature entry was correctly added to the database, false otherwise

Definition at line 158 of file sigdb.c.

                                                                                                  {
    rz_return_val_if_fail(db && entry, NULL);
    return ht_pu_insert(db->entries, entry, 1);
}

References NULL, and rz_return_val_if_fail.

Referenced by rz_sign_sigdb_load_database(), and sigdb_move_entry().

rz_sign_sigdb_free()

RZ_API void rz_sign_sigdb_free

(

RzSigDb *

db

)

Definition at line 277 of file sigdb.c.

                                            {
    if (!db) {
        return;
    }
    ht_pu_free(db->entries);
    free(db);
}

References rz_signature_db_t::entries, and free().

Referenced by analysis_sigdb_add(), and rz_sign_sigdb_load_database().

rz_sign_sigdb_list()

RZ_API RZ_OWN RzList* rz_sign_sigdb_list

(

RZ_NONNULL const RzSigDb *

db

)

Return the signature database as a list of entries.

Definition at line 294 of file sigdb.c.

                                                                         {
    rz_return_val_if_fail(db, NULL);
 
    RzList *res = rz_list_new();
    if (!res) {
        return NULL;
    }
    ht_pu_foreach(db->entries, sigdb_to_list, res);
    rz_list_sort(res, (RzListComparator)sigdb_signature_cmp);
    return res;
}

References NULL, rz_list_new(), rz_list_sort(), rz_return_val_if_fail, sigdb_signature_cmp(), and sigdb_to_list().

Referenced by rz_core_analysis_sigdb_list().

rz_sign_sigdb_load_database()

RZ_API RZ_OWN RzSigDb* rz_sign_sigdb_load_database	(	RZ_NONNULL const char *	sigdb_path,
		bool	with_details
	)

Returns a database of signatures loaded from the signature database path.

Parameters

sigdb_path	The signature database path/location
with_details	When true, opens each signature within the db for extra details

Returns

List of entries

Definition at line 105 of file sigdb.c.

                                                                                                         {
    rz_return_val_if_fail(RZ_STR_ISNOTEMPTY(sigdb_path), NULL);
    char glob[1024];
    if (!rz_file_is_directory(sigdb_path)) {
        RZ_LOG_ERROR("sigdb path is unknown or invalid (path: %s)\n", sigdb_path);
        return NULL;
    }
    size_t path_len = strlen(sigdb_path) + 1; // ignoring also the filesystem separator
    RzSigDb *sigs = rz_sign_sigdb_new();
    if (!sigs) {
        RZ_LOG_ERROR("cannot allocate signature database\n");
        return NULL;
    }
 
    rz_strf(glob, RZ_JOIN_2_PATHS("%s", "**"), sigdb_path);
    RzList *files = rz_file_globsearch(glob, 10);
    char *file = NULL;
    RzListIter *iter = NULL;
    RzSigDBEntry *sig = NULL;
 
    rz_list_foreach (files, iter, file) {
        if (!rz_str_endswith(file, ".pat") && !rz_str_endswith(file, ".sig")) {
            continue;
        }
 
        sig = RZ_NEW0(RzSigDBEntry);
        if (!sig) {
            goto fail;
        }
 
        sig->file_path = strdup(file);
        if (!sig->file_path || !sigdb_signature_resolve_details(sig, path_len, with_details)) {
            rz_sign_sigdb_signature_free(sig);
            goto fail;
        }
        rz_sign_sigdb_add_entry(sigs, sig);
    }
    rz_list_free(files);
    return sigs;
 
fail:
    rz_list_free(files);
    rz_sign_sigdb_free(sigs);
    return NULL;
}

References fail, rz_signature_database_entry_t::file_path, files, NULL, rz_file_globsearch(), rz_file_is_directory(), RZ_JOIN_2_PATHS, rz_list_free(), RZ_LOG_ERROR, RZ_NEW0, rz_return_val_if_fail, rz_sign_sigdb_add_entry(), rz_sign_sigdb_free(), rz_sign_sigdb_new(), rz_sign_sigdb_signature_free(), rz_str_endswith(), RZ_STR_ISNOTEMPTY, rz_strf, sigdb_signature_resolve_details(), and strdup().

Referenced by analysis_sigdb_add().

rz_sign_sigdb_merge()

RZ_API bool rz_sign_sigdb_merge	(	RZ_NONNULL RzSigDb *	db,
		RZ_NONNULL RzSigDb *	db2
	)

Merge the signatures from db2 into db.

Data within db2 is moved into db, making it empty.

Parameters

db	Database of signatures to extend
db2	Database of signatures that need to be merged into db

Returns

true if the databases were correctly merged, false otherwise

Definition at line 184 of file sigdb.c.

                                                                                 {
    rz_return_val_if_fail(db && db2, NULL);
    struct sigdb_move_data_t opt = {
        .src = db2,
        .dst = db,
    };
    db2->entries->opt.freefn = NULL;
    ht_pu_foreach(db2->entries, sigdb_move_entry, &opt);
    return true;
}

References rz_signature_db_t::entries, NULL, rz_return_val_if_fail, sigdb_move_entry(), and sigdb_move_data_t::src.

Referenced by analysis_sigdb_add().

rz_sign_sigdb_new()

RZ_API RZ_OWN RzSigDb* rz_sign_sigdb_new

(

void

)

Create a new empty RzSigDb instance.

Definition at line 260 of file sigdb.c.

                                               {
    RzSigDb *db = RZ_NEW0(RzSigDb);
    if (!db) {
        return NULL;
    }
    HtPUOptions opt = { 0 };
    opt.cmp = sigdb_entry_cmp,
    opt.hashfn = sigdb_entry_hash,
    opt.freefn = ht_pu_sigdb_freekv;
    db->entries = ht_pu_new_opt(&opt);
    if (!db->entries) {
        free(db);
        return NULL;
    }
    return db;
}

References rz_signature_db_t::entries, free(), ht_pu_sigdb_freekv(), NULL, RZ_NEW0, sigdb_entry_cmp(), and sigdb_entry_hash().

Referenced by rz_core_analysis_sigdb_list(), and rz_sign_sigdb_load_database().

rz_sign_sigdb_signature_free()

RZ_API void rz_sign_sigdb_signature_free

(

RZ_NULLABLE RzSigDBEntry *

entry

)

Frees a RzSigDBEntry structure.

Parameters

[in]

entry

The RzSigDBEntry to free

Definition at line 12 of file sigdb.c.

                                                                          {
    if (!entry) {
        return;
    }
    // base_name points to file_path, so there is no need to call free
    // short_path points to file_path, so there is no need to call free
    free(entry->bin_name);
    free(entry->arch_name);
    free(entry->file_path);
    free(entry);
}

References free().

Referenced by ht_pu_sigdb_freekv(), and rz_sign_sigdb_load_database().

sigdb_entry_cmp()

static int sigdb_entry_cmp ( const void *  a, const void *  b  )

static

Definition at line 218 of file sigdb.c.

                                                         {
#define field_cmp(fname, cmpfunction) \
    do { \
        int r = cmpfunction(sa->fname, sb->fname); \
        if (r != 0) { \
            return r; \
        } \
    } while (0)
 
    const RzSigDBEntry *sa = (const RzSigDBEntry *)a;
    const RzSigDBEntry *sb = (const RzSigDBEntry *)b;
    field_cmp(bin_name, strcmp_null);
    field_cmp(arch_name, strcmp_null);
    field_cmp(arch_bits, ut32cmp);
    field_cmp(base_name, strcmp_null);
    field_cmp(short_path, strcmp_null);
    field_cmp(file_path, strcmp_null);
    field_cmp(details, strcmp_null);
    field_cmp(n_modules, ut32cmp);
    return 0;
#undef field_cmp
}

References a, b, field_cmp, sb, strcmp_null(), and ut32cmp().

Referenced by rz_sign_sigdb_new().

sigdb_entry_hash()

static ut32 sigdb_entry_hash ( const void *  k )

static

Definition at line 241 of file sigdb.c.

                                            {
    const RzSigDBEntry *s = (const RzSigDBEntry *)k;
    ut32 r = sdb_hash(s->bin_name);
    r ^= sdb_hash(s->arch_name);
    r ^= s->arch_bits;
    r ^= sdb_hash(s->short_path);
    return r;
}

References k, r, s, and sdb_hash().

Referenced by rz_sign_sigdb_new().

sigdb_move_entry()

static bool sigdb_move_entry ( void *  user, const void *  k, const ut64  v  )

static

Definition at line 168 of file sigdb.c.

                                                                      {
    struct sigdb_move_data_t *move_data = (struct sigdb_move_data_t *)user;
    rz_sign_sigdb_add_entry(move_data->dst, k);
    ht_pu_delete(move_data->src->entries, k);
    return true;
}

References sigdb_move_data_t::dst, rz_signature_db_t::entries, k, rz_sign_sigdb_add_entry(), and sigdb_move_data_t::src.

Referenced by rz_sign_sigdb_merge().

sigdb_signature_cmp()

static int sigdb_signature_cmp ( const RzSigDBEntry *  a, const RzSigDBEntry *  b  )

static

Definition at line 24 of file sigdb.c.

                                                                             {
    return strcmp(a->short_path, b->short_path);
}

References a, and b.

Referenced by rz_sign_sigdb_list().

sigdb_signature_resolve_details()

static bool sigdb_signature_resolve_details ( RzSigDBEntry *  entry, size_t  path_len, bool  with_details  )

static

Definition at line 28 of file sigdb.c.

                                                                                                     {
    char *bin_end = NULL;
    char *arch_end = NULL;
    char *bits_end = NULL;
    char copy_path[1024] = { 0 };
    RzFlirtNode *node = NULL;
    RzFlirtInfo info = { 0 };
    RzBuffer *buffer = NULL;
 
#if __WINDOWS__
    rz_str_replace_char(entry->file_path, '/', '\\');
#endif
    // expected path elf/x86/64/signature.sig/.pat
    strncpy(copy_path, entry->file_path + path_len, sizeof(copy_path) - 1);
    entry->base_name = rz_file_basename(entry->file_path);
    entry->short_path = entry->file_path + path_len;
 
    if (!(bin_end = strstr(copy_path, RZ_SYS_DIR))) {
        RZ_LOG_WARN("sigdb: folder structure is invalid (missing bin name).\n");
        return false;
    } else if (!(arch_end = strstr(bin_end + strlen(RZ_SYS_DIR), RZ_SYS_DIR))) {
        RZ_LOG_WARN("sigdb: folder structure is invalid (missing arch name).\n");
        return false;
    } else if (!(bits_end = strstr(arch_end + strlen(RZ_SYS_DIR), RZ_SYS_DIR))) {
        RZ_LOG_WARN("sigdb: folder structure is invalid (missing arch bits).\n");
        return false;
    }
 
    if (!with_details) {
        goto skip_details;
    }
 
    buffer = rz_buf_new_file(entry->file_path, O_RDONLY, 0);
    if (!buffer) {
        RZ_LOG_WARN("sigdb: cannot open signature file '%s'.\n", entry->file_path);
        return false;
    }
 
    if (rz_str_endswith(entry->base_name, ".sig")) {
        bool success = rz_sign_flirt_parse_header_compressed_pattern_from_buffer(buffer, &info);
        rz_buf_free(buffer);
        if (!success) {
            return false;
        }
 
        entry->details = RZ_STR_DUP(info.u.sig.name);
        entry->n_modules = info.u.sig.n_modules;
    } else {
        node = rz_sign_flirt_parse_string_pattern_from_buffer(buffer, RZ_FLIRT_NODE_OPTIMIZE_NONE, &info);
        rz_buf_free(buffer);
        if (!node) {
            return false;
        }
 
        entry->n_modules = info.u.pat.n_modules;
    }
    rz_sign_flirt_node_free(node);
    rz_sign_flirt_info_fini(&info);
 
skip_details:
    bin_end[0] = 0;
    entry->bin_name = strdup(copy_path);
    arch_end[0] = 0;
    entry->arch_name = strdup(bin_end + strlen(RZ_SYS_DIR));
    bits_end[0] = 0;
    entry->arch_bits = rz_get_input_num_value(NULL, arch_end + strlen(RZ_SYS_DIR));
 
    return true;
}

References info(), NULL, O_RDONLY, rz_buf_free(), rz_buf_new_file(), rz_file_basename(), RZ_FLIRT_NODE_OPTIMIZE_NONE, rz_get_input_num_value(), RZ_LOG_WARN, rz_sign_flirt_info_fini(), rz_sign_flirt_node_free(), rz_sign_flirt_parse_header_compressed_pattern_from_buffer(), rz_sign_flirt_parse_string_pattern_from_buffer(), RZ_STR_DUP, rz_str_endswith(), rz_str_replace_char(), RZ_SYS_DIR, and strdup().

Referenced by rz_sign_sigdb_load_database().

sigdb_to_list()

static bool sigdb_to_list ( void *  user, const void *  k, const ut64  v  )

static

Definition at line 285 of file sigdb.c.

                                                                   {
    RzList *l = (RzList *)user;
    rz_list_append(l, (void *)k);
    return true;
}

References k, and rz_list_append().

Referenced by rz_sign_sigdb_list().

strcmp_null()

static int strcmp_null ( const char *  a, const char *  b  )

static

Definition at line 205 of file sigdb.c.

                                                     {
    if (!a && !b) {
        return 0;
    }
    if (!a && b) {
        return -1;
    }
    if (a && !b) {
        return 1;
    }
    return strcmp(a, b);
}

References a, and b.

Referenced by sigdb_entry_cmp().

ut32cmp()

static int ut32cmp ( int  a, int  b  )

static

Definition at line 195 of file sigdb.c.

                                 {
    if (a < b) {
        return -1;
    }
    if (a > b) {
        return 1;
    }
    return 0;
}

References a, and b.

Referenced by sigdb_entry_cmp().