te.h File Reference

#include <rz_types.h>
#include <rz_util.h>
#include <rz_lib.h>
#include <rz_bin.h>

Go to the source code of this file.

Classes
struct	rz_bin_te_section_t
struct	rz_bin_te_string_t
struct	rz_bin_te_obj_t

Macros
#define	RZ_BIN_TE_SCN_IS_SHAREABLE(x)   x &TE_IMAGE_SCN_MEM_SHARED
#define	RZ_BIN_TE_SCN_IS_EXECUTABLE(x)   x &TE_IMAGE_SCN_MEM_EXECUTE
#define	RZ_BIN_TE_SCN_IS_READABLE(x)   x &TE_IMAGE_SCN_MEM_READ
#define	RZ_BIN_TE_SCN_IS_WRITABLE(x)   x &TE_IMAGE_SCN_MEM_WRITE

Functions
char *	rz_bin_te_get_arch (struct rz_bin_te_obj_t *bin)
RzBinAddr *	rz_bin_te_get_entrypoint (struct rz_bin_te_obj_t *bin)
ut64	rz_bin_te_get_main_paddr (struct rz_bin_te_obj_t *bin)
ut64	rz_bin_te_get_image_base (struct rz_bin_te_obj_t *bin)
int	rz_bin_te_get_image_size (struct rz_bin_te_obj_t *bin)
char *	rz_bin_te_get_machine (struct rz_bin_te_obj_t *bin)
int	rz_bin_te_get_bits (struct rz_bin_te_obj_t *bin)
char *	rz_bin_te_get_os (struct rz_bin_te_obj_t *bin)
struct rz_bin_te_section_t *	rz_bin_te_get_sections (struct rz_bin_te_obj_t *bin)
char *	rz_bin_te_get_subsystem (struct rz_bin_te_obj_t *bin)
void *	rz_bin_te_free (struct rz_bin_te_obj_t *bin)
struct rz_bin_te_obj_t *	rz_bin_te_new (const char *file)
struct rz_bin_te_obj_t *	rz_bin_te_new_buf (RzBuffer *buf)

Macro Definition Documentation

RZ_BIN_TE_SCN_IS_EXECUTABLE

#define RZ_BIN_TE_SCN_IS_EXECUTABLE

(

x

)

x &TE_IMAGE_SCN_MEM_EXECUTE

Definition at line 14 of file te.h.

RZ_BIN_TE_SCN_IS_READABLE

#define RZ_BIN_TE_SCN_IS_READABLE

(

x

)

x &TE_IMAGE_SCN_MEM_READ

Definition at line 15 of file te.h.

RZ_BIN_TE_SCN_IS_SHAREABLE

#define RZ_BIN_TE_SCN_IS_SHAREABLE

(

x

)

x &TE_IMAGE_SCN_MEM_SHARED

Definition at line 13 of file te.h.

RZ_BIN_TE_SCN_IS_WRITABLE

#define RZ_BIN_TE_SCN_IS_WRITABLE

(

x

)

x &TE_IMAGE_SCN_MEM_WRITE

Definition at line 16 of file te.h.

Function Documentation

rz_bin_te_free()

void* rz_bin_te_free

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 431 of file te.c.

                                                  {
    if (!bin) {
        return NULL;
    }
    free(bin->header);
    free(bin->section_header);
    rz_buf_free(bin->b);
    free(bin);
    return NULL;
}

References free(), NULL, and rz_buf_free().

Referenced by destroy(), rz_bin_te_new(), and rz_bin_te_new_buf().

rz_bin_te_get_arch()

char* rz_bin_te_get_arch

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 167 of file te.c.

                                                      {
    char *arch;
    if (!bin) {
        return NULL;
    }
    switch (bin->header->Machine) {
    case TE_IMAGE_FILE_MACHINE_ALPHA:
    case TE_IMAGE_FILE_MACHINE_ALPHA64:
        arch = strdup("alpha");
        break;
    case TE_IMAGE_FILE_MACHINE_ARM:
    case TE_IMAGE_FILE_MACHINE_THUMB:
        arch = strdup("arm");
        break;
    case TE_IMAGE_FILE_MACHINE_M68K:
        arch = strdup("m68k");
        break;
    case TE_IMAGE_FILE_MACHINE_MIPS16:
    case TE_IMAGE_FILE_MACHINE_MIPSFPU:
    case TE_IMAGE_FILE_MACHINE_MIPSFPU16:
    case TE_IMAGE_FILE_MACHINE_WCEMIPSV2:
        arch = strdup("mips");
        break;
    case TE_IMAGE_FILE_MACHINE_POWERPC:
    case TE_IMAGE_FILE_MACHINE_POWERPCFP:
        arch = strdup("ppc");
        break;
    default:
        arch = strdup("x86");
    }
    return arch;
}

References arch, NULL, strdup(), TE_IMAGE_FILE_MACHINE_ALPHA, TE_IMAGE_FILE_MACHINE_ALPHA64, TE_IMAGE_FILE_MACHINE_ARM, TE_IMAGE_FILE_MACHINE_M68K, TE_IMAGE_FILE_MACHINE_MIPS16, TE_IMAGE_FILE_MACHINE_MIPSFPU, TE_IMAGE_FILE_MACHINE_MIPSFPU16, TE_IMAGE_FILE_MACHINE_POWERPC, TE_IMAGE_FILE_MACHINE_POWERPCFP, TE_IMAGE_FILE_MACHINE_THUMB, and TE_IMAGE_FILE_MACHINE_WCEMIPSV2.

Referenced by info().

rz_bin_te_get_bits()

int rz_bin_te_get_bits

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 200 of file te.c.

                                                    {
    return 32; // It is always 32 bit by now
}

Referenced by info().

rz_bin_te_get_entrypoint()

RzBinAddr* rz_bin_te_get_entrypoint

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 204 of file te.c.

                                                                 {
    RzBinAddr *entry = NULL;
 
    if (!bin || !bin->header) {
        return NULL;
    }
    if (!(entry = malloc(sizeof(RzBinAddr)))) {
        perror("malloc (entrypoint)");
        return NULL;
    }
    entry->vaddr = bin->header->AddressOfEntryPoint - rz_bin_te_get_stripped_delta(bin);
    if (entry->vaddr == 0) { // in TE if EP = 0 then EP = baddr
        entry->vaddr = bin->header->ImageBase;
    }
    entry->paddr = rz_bin_te_vaddr_to_paddr(bin, entry->vaddr);
    return entry;
}

References malloc(), NULL, rz_bin_te_get_stripped_delta(), and rz_bin_te_vaddr_to_paddr().

Referenced by entries(), and rz_bin_te_get_main_paddr().

rz_bin_te_get_image_base()

ut64 rz_bin_te_get_image_base

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 222 of file te.c.

                                                           {
    if (bin && bin->header) {
        return (ut64)bin->header->ImageBase;
    }
    return 0LL;
}

References ut64().

Referenced by baddr().

rz_bin_te_get_image_size()

int rz_bin_te_get_image_size

(

struct rz_bin_te_obj_t *

bin

)

rz_bin_te_get_machine()

char* rz_bin_te_get_machine

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 229 of file te.c.

                                                         {
    char *machine;
    if (!bin) {
        return NULL;
    }
    switch (bin->header->Machine) {
    case TE_IMAGE_FILE_MACHINE_ALPHA:
        machine = strdup("Alpha");
        break;
    case TE_IMAGE_FILE_MACHINE_ALPHA64:
        machine = strdup("Alpha 64");
        break;
    case TE_IMAGE_FILE_MACHINE_AM33:
        machine = strdup("AM33");
        break;
    case TE_IMAGE_FILE_MACHINE_AMD64:
        machine = strdup("AMD 64");
        break;
    case TE_IMAGE_FILE_MACHINE_ARM:
        machine = strdup("ARM");
        break;
    case TE_IMAGE_FILE_MACHINE_CEE:
        machine = strdup("CEE");
        break;
    case TE_IMAGE_FILE_MACHINE_CEF:
        machine = strdup("CEF");
        break;
    case TE_IMAGE_FILE_MACHINE_EBC:
        machine = strdup("EBC");
        break;
    case TE_IMAGE_FILE_MACHINE_I386:
        machine = strdup("i386");
        break;
    case TE_IMAGE_FILE_MACHINE_IA64:
        machine = strdup("ia64");
        break;
    case TE_IMAGE_FILE_MACHINE_M32R:
        machine = strdup("M32R");
        break;
    case TE_IMAGE_FILE_MACHINE_M68K:
        machine = strdup("M68K");
        break;
    case TE_IMAGE_FILE_MACHINE_MIPS16:
        machine = strdup("Mips 16");
        break;
    case TE_IMAGE_FILE_MACHINE_MIPSFPU:
        machine = strdup("Mips FPU");
        break;
    case TE_IMAGE_FILE_MACHINE_MIPSFPU16:
        machine = strdup("Mips FPU 16");
        break;
    case TE_IMAGE_FILE_MACHINE_POWERPC:
        machine = strdup("PowerPC");
        break;
    case TE_IMAGE_FILE_MACHINE_POWERPCFP:
        machine = strdup("PowerPC FP");
        break;
    case TE_IMAGE_FILE_MACHINE_R10000:
        machine = strdup("R10000");
        break;
    case TE_IMAGE_FILE_MACHINE_R3000:
        machine = strdup("R3000");
        break;
    case TE_IMAGE_FILE_MACHINE_R4000:
        machine = strdup("R4000");
        break;
    case TE_IMAGE_FILE_MACHINE_SH3:
        machine = strdup("SH3");
        break;
    case TE_IMAGE_FILE_MACHINE_SH3DSP:
        machine = strdup("SH3DSP");
        break;
    case TE_IMAGE_FILE_MACHINE_SH3E:
        machine = strdup("SH3E");
        break;
    case TE_IMAGE_FILE_MACHINE_SH4:
        machine = strdup("SH4");
        break;
    case TE_IMAGE_FILE_MACHINE_SH5:
        machine = strdup("SH5");
        break;
    case TE_IMAGE_FILE_MACHINE_THUMB:
        machine = strdup("Thumb");
        break;
    case TE_IMAGE_FILE_MACHINE_TRICORE:
        machine = strdup("Tricore");
        break;
    case TE_IMAGE_FILE_MACHINE_WCEMIPSV2:
        machine = strdup("WCE Mips V2");
        break;
    default:
        machine = strdup("unknown");
    }
    return machine;
}

References NULL, strdup(), TE_IMAGE_FILE_MACHINE_ALPHA, TE_IMAGE_FILE_MACHINE_ALPHA64, TE_IMAGE_FILE_MACHINE_AM33, TE_IMAGE_FILE_MACHINE_AMD64, TE_IMAGE_FILE_MACHINE_ARM, TE_IMAGE_FILE_MACHINE_CEE, TE_IMAGE_FILE_MACHINE_CEF, TE_IMAGE_FILE_MACHINE_EBC, TE_IMAGE_FILE_MACHINE_I386, TE_IMAGE_FILE_MACHINE_IA64, TE_IMAGE_FILE_MACHINE_M32R, TE_IMAGE_FILE_MACHINE_M68K, TE_IMAGE_FILE_MACHINE_MIPS16, TE_IMAGE_FILE_MACHINE_MIPSFPU, TE_IMAGE_FILE_MACHINE_MIPSFPU16, TE_IMAGE_FILE_MACHINE_POWERPC, TE_IMAGE_FILE_MACHINE_POWERPCFP, TE_IMAGE_FILE_MACHINE_R10000, TE_IMAGE_FILE_MACHINE_R3000, TE_IMAGE_FILE_MACHINE_R4000, TE_IMAGE_FILE_MACHINE_SH3, TE_IMAGE_FILE_MACHINE_SH3DSP, TE_IMAGE_FILE_MACHINE_SH3E, TE_IMAGE_FILE_MACHINE_SH4, TE_IMAGE_FILE_MACHINE_SH5, TE_IMAGE_FILE_MACHINE_THUMB, TE_IMAGE_FILE_MACHINE_TRICORE, and TE_IMAGE_FILE_MACHINE_WCEMIPSV2.

Referenced by info().

rz_bin_te_get_main_paddr()

ut64 rz_bin_te_get_main_paddr

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 95 of file te.c.

                                                           {
    RzBinAddr *entry = rz_bin_te_get_entrypoint(bin);
    ut64 addr = 0LL;
    ut8 buf[512];
    if (!bin) {
        return 0LL;
    }
    if (rz_buf_read_at(bin->b, entry->paddr, buf, sizeof(buf)) == -1) {
        eprintf("Error: read (entry)\n");
    } else {
        if (buf[367] == 0xe8) {
            int delta = (buf[368] | buf[369] << 8 | buf[370] << 16 | buf[371] << 24);
            delta += 367 + 5;
            addr = entry->vaddr;
            if (delta >= (UT64_MAX - addr)) {
                free(entry);
                return UT64_MAX;
            }
            addr += delta;
        }
    }
    free(entry);
    return addr;
}

References addr, delta, eprintf, free(), rz_bin_te_get_entrypoint(), rz_buf_read_at(), ut64(), and UT64_MAX.

Referenced by binsym().

rz_bin_te_get_os()

char* rz_bin_te_get_os

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 325 of file te.c.

                                                    {
    char *os;
    if (!bin) {
        return NULL;
    }
 
    switch (bin->header->Subsystem) {
    case TE_IMAGE_SUBSYSTEM_NATIVE:
        os = strdup("native");
        break;
    case TE_IMAGE_SUBSYSTEM_WINDOWS_GUI:
    case TE_IMAGE_SUBSYSTEM_WINDOWS_CUI:
    case TE_IMAGE_SUBSYSTEM_WINDOWS_CE_GUI:
        os = strdup("windows");
        break;
    case TE_IMAGE_SUBSYSTEM_POSIX_CUI:
        os = strdup("posix");
        break;
    case TE_IMAGE_SUBSYSTEM_EFI_APPLICATION:
    case TE_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
    case TE_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
    case TE_IMAGE_SUBSYSTEM_EFI_ROM:
        os = strdup("efi");
        break;
    case TE_IMAGE_SUBSYSTEM_XBOX:
        os = strdup("xbox");
        break;
    default:
        // XXX: this is unknown
        os = strdup("windows");
    }
    return os;
}

References NULL, strdup(), TE_IMAGE_SUBSYSTEM_EFI_APPLICATION, TE_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER, TE_IMAGE_SUBSYSTEM_EFI_ROM, TE_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER, TE_IMAGE_SUBSYSTEM_NATIVE, TE_IMAGE_SUBSYSTEM_POSIX_CUI, TE_IMAGE_SUBSYSTEM_WINDOWS_CE_GUI, TE_IMAGE_SUBSYSTEM_WINDOWS_CUI, TE_IMAGE_SUBSYSTEM_WINDOWS_GUI, and TE_IMAGE_SUBSYSTEM_XBOX.

Referenced by info().

rz_bin_te_get_sections()

struct rz_bin_te_section_t* rz_bin_te_get_sections

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 359 of file te.c.

                                                                                {
    struct rz_bin_te_section_t *sections = NULL;
    TE_image_section_header *shdr;
    int i, sections_count;
    if (!bin) {
        return NULL;
    }
    shdr = bin->section_header;
    sections_count = bin->header->NumberOfSections;
 
    if (!(sections = calloc((sections_count + 1), sizeof(struct rz_bin_te_section_t)))) {
        perror("malloc (sections)");
        return NULL;
    }
    for (i = 0; i < sections_count; i++) {
        memcpy(sections[i].name, shdr[i].Name, TE_IMAGE_SIZEOF_NAME);
        // not a null terminated string if len==buflen
        // sections[i].name[TE_IMAGE_SIZEOF_NAME] = '\0';
        sections[i].vaddr = shdr[i].VirtualAddress - rz_bin_te_get_stripped_delta(bin);
        sections[i].size = shdr[i].SizeOfRawData;
        sections[i].vsize = shdr[i].VirtualSize;
        sections[i].paddr = shdr[i].PointerToRawData - rz_bin_te_get_stripped_delta(bin);
        sections[i].flags = shdr[i].Characteristics;
        sections[i].last = 0;
    }
    sections[i].last = 1;
    return sections;
}

References calloc(), TE_image_section_header::Characteristics, i, memcpy(), NULL, TE_image_section_header::PointerToRawData, rz_bin_te_get_stripped_delta(), sections(), TE_image_section_header::SizeOfRawData, TE_IMAGE_SIZEOF_NAME, TE_image_section_header::VirtualAddress, and TE_image_section_header::VirtualSize.

Referenced by sections().

rz_bin_te_get_subsystem()

char* rz_bin_te_get_subsystem

(

struct rz_bin_te_obj_t *

bin

)

Definition at line 388 of file te.c.

                                                           {
    char *subsystem;
 
    if (!bin) {
        return NULL;
    }
    switch (bin->header->Subsystem) {
    case TE_IMAGE_SUBSYSTEM_NATIVE:
        subsystem = strdup("Native");
        break;
    case TE_IMAGE_SUBSYSTEM_WINDOWS_GUI:
        subsystem = strdup("Windows GUI");
        break;
    case TE_IMAGE_SUBSYSTEM_WINDOWS_CUI:
        subsystem = strdup("Windows CUI");
        break;
    case TE_IMAGE_SUBSYSTEM_POSIX_CUI:
        subsystem = strdup("POSIX CUI");
        break;
    case TE_IMAGE_SUBSYSTEM_WINDOWS_CE_GUI:
        subsystem = strdup("Windows CE GUI");
        break;
    case TE_IMAGE_SUBSYSTEM_EFI_APPLICATION:
        subsystem = strdup("EFI Application");
        break;
    case TE_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
        subsystem = strdup("EFI Boot Service Driver");
        break;
    case TE_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
        subsystem = strdup("EFI Runtime Driver");
        break;
    case TE_IMAGE_SUBSYSTEM_EFI_ROM:
        subsystem = strdup("EFI ROM");
        break;
    case TE_IMAGE_SUBSYSTEM_XBOX:
        subsystem = strdup("XBOX");
        break;
    default:
        subsystem = strdup("Unknown");
    }
    return subsystem;
}

References NULL, strdup(), TE_IMAGE_SUBSYSTEM_EFI_APPLICATION, TE_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER, TE_IMAGE_SUBSYSTEM_EFI_ROM, TE_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER, TE_IMAGE_SUBSYSTEM_NATIVE, TE_IMAGE_SUBSYSTEM_POSIX_CUI, TE_IMAGE_SUBSYSTEM_WINDOWS_CE_GUI, TE_IMAGE_SUBSYSTEM_WINDOWS_CUI, TE_IMAGE_SUBSYSTEM_WINDOWS_GUI, and TE_IMAGE_SUBSYSTEM_XBOX.

Referenced by info().

rz_bin_te_new()

struct rz_bin_te_obj_t* rz_bin_te_new

(

const char *

file

)

Definition at line 442 of file te.c.

                                                        {
    struct rz_bin_te_obj_t *bin = RZ_NEW0(struct rz_bin_te_obj_t);
    if (!bin) {
        return NULL;
    }
    bin->file = file;
    size_t binsz;
    ut8 *buf = (ut8 *)rz_file_slurp(file, &binsz);
    bin->size = binsz;
    if (!buf) {
        return rz_bin_te_free(bin);
    }
    bin->b = rz_buf_new_with_bytes(NULL, 0);
    if (!rz_buf_set_bytes(bin->b, buf, bin->size)) {
        free(buf);
        return rz_bin_te_free(bin);
    }
    free(buf);
    if (!rz_bin_te_init(bin)) {
        return rz_bin_te_free(bin);
    }
    return bin;
}

References file, free(), NULL, rz_bin_te_free(), rz_bin_te_init(), rz_buf_new_with_bytes(), rz_buf_set_bytes(), rz_file_slurp(), and RZ_NEW0.

rz_bin_te_new_buf()

struct rz_bin_te_obj_t* rz_bin_te_new_buf

(

RzBuffer *

buf

)

Definition at line 466 of file te.c.

                                                         {
    struct rz_bin_te_obj_t *bin = RZ_NEW0(struct rz_bin_te_obj_t);
    if (!bin) {
        return NULL;
    }
    bin->kv = sdb_new0();
    bin->size = rz_buf_size(buf);
    bin->b = rz_buf_new_with_buf(buf);
    if (!bin->b) {
        return rz_bin_te_free(bin);
    }
    if (!rz_bin_te_init(bin)) {
        return rz_bin_te_free(bin);
    }
    return bin;
}

References NULL, rz_bin_te_free(), rz_bin_te_init(), rz_buf_new_with_buf(), rz_buf_size(), RZ_NEW0, and sdb_new0().

Referenced by load_buffer().