vtable.c File Reference

#include "rz_util.h"
#include "rz_analysis.h"

Go to the source code of this file.

Macros
#define	VTABLE_BUFF_SIZE   10
#define	VTABLE_READ_ADDR_FUNC(fname, read_fname, sz)

Functions
RZ_API void	rz_analysis_vtable_info_free (RVTableInfo *vtable)
RZ_API ut64	rz_analysis_vtable_info_get_size (RVTableContext *context, RVTableInfo *vtable)
RZ_API bool	rz_analysis_vtable_begin (RzAnalysis *analysis, RVTableContext *context)
static bool	vtable_addr_in_text_section (RVTableContext *context, ut64 curAddress)
static bool	vtable_is_value_in_text_section (RVTableContext *context, ut64 curAddress, ut64 *value)
static bool	vtable_section_can_contain_vtables (RzBinSection *section)
static bool	section_can_contain_rtti (RzBinSection *section)
static bool	vtable_is_addr_vtable_start_itanium (RVTableContext *context, RzBinSection *section, ut64 curAddress)
static bool	vtable_is_addr_vtable_start_msvc (RVTableContext *context, ut64 curAddress)
static bool	vtable_is_addr_vtable_start (RVTableContext *context, RzBinSection *section, ut64 curAddress)
RZ_API RVTableInfo *	rz_analysis_vtable_parse_at (RVTableContext *context, ut64 addr)
RZ_API RzList *	rz_analysis_vtable_search (RVTableContext *context)
RZ_API void	rz_analysis_list_vtables (RzAnalysis *analysis, RzOutputMode mode)

Macro Definition Documentation

VTABLE_BUFF_SIZE

#define VTABLE_BUFF_SIZE   10

Definition at line 9 of file vtable.c.

VTABLE_READ_ADDR_FUNC

#define VTABLE_READ_ADDR_FUNC	(		fname,
			read_fname,
			sz
	)

Value:

    static bool fname(RzAnalysis *analysis, ut64 addr, ut64 *buf) { \
        ut8 tmp[sz]; \
        if (!analysis->iob.read_at(analysis->iob.io, addr, tmp, sz)) { \
            return false; \
        } \
        *buf = read_fname(tmp); \
        return true; \
    }

Definition at line 11 of file vtable.c.

Function Documentation

rz_analysis_list_vtables()

RZ_API void rz_analysis_list_vtables	(	RzAnalysis *	analysis,
		RzOutputMode	mode
	)

Definition at line 288 of file vtable.c.

                                                                              {
    RVTableContext context;
    rz_analysis_vtable_begin(analysis, &context);
 
    const char *noMethodName = "No Name found";
    RVTableMethodInfo *curMethod;
    RzListIter *vtableIter;
    RVTableInfo *table;
 
    RzList *vtables = rz_analysis_vtable_search(&context);
 
    if (mode == RZ_OUTPUT_MODE_JSON) {
        PJ *pj = pj_new();
        if (!pj) {
            rz_list_free(vtables);
            return;
        }
        pj_a(pj);
        rz_list_foreach (vtables, vtableIter, table) {
            pj_o(pj);
            pj_kN(pj, "offset", table->saddr);
            pj_ka(pj, "methods");
            rz_vector_foreach(&table->methods, curMethod) {
                RzAnalysisFunction *fcn = rz_analysis_get_fcn_in(analysis, curMethod->addr, 0);
                const char *const name = fcn ? fcn->name : NULL;
                pj_o(pj);
                pj_kN(pj, "offset", curMethod->addr);
                pj_ks(pj, "name", name ? name : noMethodName);
                pj_end(pj);
            }
            pj_end(pj);
            pj_end(pj);
        }
        pj_end(pj);
        rz_cons_println(pj_string(pj));
        pj_free(pj);
    } else if (mode == RZ_OUTPUT_MODE_RIZIN) {
        rz_list_foreach (vtables, vtableIter, table) {
            rz_cons_printf("f vtable.0x%08" PFMT64x " %" PFMT64d " @ 0x%08" PFMT64x "\n",
                table->saddr,
                rz_analysis_vtable_info_get_size(&context, table),
                table->saddr);
            rz_vector_foreach(&table->methods, curMethod) {
                rz_cons_printf("Cd %d @ 0x%08" PFMT64x "\n", context.word_size, table->saddr + curMethod->vtable_offset);
                RzAnalysisFunction *fcn = rz_analysis_get_fcn_in(analysis, curMethod->addr, 0);
                const char *const name = fcn ? fcn->name : NULL;
                if (name) {
                    rz_cons_printf("f %s @ 0x%08" PFMT64x "\n", name, curMethod->addr);
                } else {
                    rz_cons_printf("f method.virtual.0x%08" PFMT64x " @ 0x%08" PFMT64x "\n", curMethod->addr, curMethod->addr);
                }
            }
        }
    } else {
        rz_list_foreach (vtables, vtableIter, table) {
            ut64 vtableStartAddress = table->saddr;
            rz_cons_printf("\nVtable Found at 0x%08" PFMT64x "\n", vtableStartAddress);
            rz_vector_foreach(&table->methods, curMethod) {
                RzAnalysisFunction *fcn = rz_analysis_get_fcn_in(analysis, curMethod->addr, 0);
                const char *const name = fcn ? fcn->name : NULL;
                rz_cons_printf("0x%08" PFMT64x " : %s\n", vtableStartAddress, name ? name : noMethodName);
                vtableStartAddress += context.word_size;
            }
            rz_cons_newline();
        }
    }
    rz_list_free(vtables);
}

References rz_analysis_function_t::name, NULL, PFMT64d, PFMT64x, pj_a(), pj_end(), pj_free(), pj_ka(), pj_kN(), pj_ks(), pj_new(), pj_o(), pj_string(), rz_analysis_get_fcn_in(), rz_analysis_vtable_begin(), rz_analysis_vtable_info_get_size(), rz_analysis_vtable_search(), rz_cons_newline(), rz_cons_printf(), rz_cons_println(), rz_list_free(), RZ_OUTPUT_MODE_JSON, RZ_OUTPUT_MODE_RIZIN, rz_vector_foreach, and ut64().

Referenced by rz_analysis_list_vtables_handler().

rz_analysis_vtable_begin()

RZ_API bool rz_analysis_vtable_begin	(	RzAnalysis *	analysis,
		RVTableContext *	context
	)

Definition at line 41 of file vtable.c.

                                                                                    {
    context->analysis = analysis;
    context->abi = analysis->cpp_abi;
    context->word_size = (ut8)(analysis->bits / 8);
    const bool is_arm = analysis->cur->arch && rz_str_startswith(analysis->cur->arch, "arm");
    if (is_arm && context->word_size < 4) {
        context->word_size = 4;
    }
    switch (context->word_size) {
    case 1:
        context->read_addr = analysis->big_endian ? vtable_read_addr_be8 : vtable_read_addr_le8;
        break;
    case 2:
        context->read_addr = analysis->big_endian ? vtable_read_addr_be16 : vtable_read_addr_le16;
        break;
    case 4:
        context->read_addr = analysis->big_endian ? vtable_read_addr_be32 : vtable_read_addr_le32;
        break;
    case 8:
        context->read_addr = analysis->big_endian ? vtable_read_addr_be64 : vtable_read_addr_le64;
        break;
    default:
        return false;
    }
    return true;
}

References rz_analysis_plugin_t::arch, rz_analysis_t::big_endian, rz_analysis_t::bits, rz_analysis_t::cpp_abi, rz_analysis_t::cur, is_arm(), rz_str_startswith(), and ut8.

Referenced by list_all_functions_at_vtable_offset(), rz_analysis_list_vtables(), rz_analysis_rtti_demangle_class_name(), rz_analysis_rtti_print_all(), rz_analysis_rtti_print_at_vtable(), and rz_analysis_rtti_recover_all().

rz_analysis_vtable_info_free()

RZ_API void rz_analysis_vtable_info_free

(

RVTableInfo *

vtable

)

Definition at line 29 of file vtable.c.

                                                              {
    if (!vtable) {
        return;
    }
    rz_vector_clear(&vtable->methods);
    free(vtable);
}

References free(), and rz_vector_clear().

Referenced by rz_analysis_rtti_msvc_recover_all(), and rz_analysis_vtable_search().

rz_analysis_vtable_info_get_size()

RZ_API ut64 rz_analysis_vtable_info_get_size	(	RVTableContext *	context,
		RVTableInfo *	vtable
	)

Definition at line 37 of file vtable.c.

                                                                                           {
    return (ut64)vtable->methods.len * context->word_size;
}

References ut64().

Referenced by recovery_apply_vtable(), rz_analysis_list_vtables(), and rz_analysis_vtable_search().

rz_analysis_vtable_parse_at()

RZ_API RVTableInfo* rz_analysis_vtable_parse_at	(	RVTableContext *	context,
		ut64	addr
	)

Definition at line 184 of file vtable.c.

                                                                                    {
    ut64 offset_to_top;
    if (!context->read_addr(context->analysis, addr - 2 * context->word_size, &offset_to_top)) {
        return NULL;
    }
 
    RVTableInfo *vtable = calloc(1, sizeof(RVTableInfo));
    if (!vtable) {
        return NULL;
    }
 
    vtable->saddr = addr;
 
    rz_vector_init(&vtable->methods, sizeof(RVTableMethodInfo), NULL, NULL);
 
    RVTableMethodInfo meth;
    while (vtable_is_value_in_text_section(context, addr, &meth.addr)) {
        meth.vtable_offset = addr - vtable->saddr;
        if (!rz_vector_push(&vtable->methods, &meth)) {
            break;
        }
 
        addr += context->word_size;
 
        // a ref means the vtable has ended
        RzList *ll = rz_analysis_xrefs_get_to(context->analysis, addr);
        if (!rz_list_empty(ll)) {
            rz_list_free(ll);
            break;
        }
        rz_list_free(ll);
    }
    return vtable;
}

References addr, calloc(), NULL, rz_analysis_xrefs_get_to(), rz_list_free(), rz_vector_init(), rz_vector_push(), ut64(), and vtable_is_value_in_text_section().

Referenced by rz_analysis_vtable_search().

rz_analysis_vtable_search()

RZ_API RzList* rz_analysis_vtable_search

(

RVTableContext *

context

)

Definition at line 219 of file vtable.c.

                                                                    {
    RzAnalysis *analysis = context->analysis;
    if (!analysis) {
        return NULL;
    }
 
    RzList *vtables = rz_list_newf((RzListFree)rz_analysis_vtable_info_free);
    if (!vtables) {
        return NULL;
    }
 
    RzList *sections = analysis->binb.get_sections(analysis->binb.bin);
    if (!sections) {
        rz_list_free(vtables);
        return NULL;
    }
 
    rz_cons_break_push(NULL, NULL);
 
    RzListIter *iter;
    RzBinSection *section;
    rz_list_foreach (sections, iter, section) {
        if (rz_cons_is_breaked()) {
            break;
        }
 
        if (!vtable_section_can_contain_vtables(section)) {
            continue;
        }
 
        ut64 startAddress = section->vaddr;
        ut64 endAddress = startAddress + (section->vsize) - context->word_size;
        ut64 ss = endAddress - startAddress;
        if (ss > ST32_MAX) {
            break;
        }
        while (startAddress <= endAddress) {
            if (rz_cons_is_breaked()) {
                break;
            }
            if (!analysis->iob.is_valid_offset(analysis->iob.io, startAddress, 0)) {
                break;
            }
 
            if (vtable_is_addr_vtable_start(context, section, startAddress)) {
                RVTableInfo *vtable = rz_analysis_vtable_parse_at(context, startAddress);
                if (vtable) {
                    rz_list_append(vtables, vtable);
                    ut64 size = rz_analysis_vtable_info_get_size(context, vtable);
                    if (size > 0) {
                        startAddress += size;
                        continue;
                    }
                }
            }
            startAddress += context->word_size;
        }
    }
 
    rz_cons_break_pop();
 
    if (rz_list_empty(vtables)) {
        // stripped binary?
        rz_list_free(vtables);
        return NULL;
    }
    return vtables;
}

References rz_bin_bind_t::bin, rz_analysis_t::binb, rz_bin_bind_t::get_sections, if(), rz_io_bind_t::io, rz_analysis_t::iob, rz_io_bind_t::is_valid_offset, NULL, rz_analysis_vtable_info_free(), rz_analysis_vtable_info_get_size(), rz_analysis_vtable_parse_at(), rz_cons_break_pop(), rz_cons_break_push(), rz_cons_is_breaked(), rz_list_append(), rz_list_free(), rz_list_newf(), sections(), ST32_MAX, ut64(), vtable_is_addr_vtable_start(), and vtable_section_can_contain_vtables().

Referenced by rz_analysis_list_vtables(), rz_analysis_rtti_print_all(), and rz_analysis_rtti_recover_all().

section_can_contain_rtti()

static bool section_can_contain_rtti ( RzBinSection *  section )

static

Definition at line 100 of file vtable.c.

                                                            {
    if (!section) {
        return false;
    }
    if (section->is_data) {
        return true;
    }
    return !strcmp(section->name, ".data.rel.ro") ||
        !strcmp(section->name, ".data.rel.ro.local") ||
        rz_str_endswith(section->name, "__const");
}

References rz_str_endswith().

Referenced by vtable_is_addr_vtable_start_itanium().

vtable_addr_in_text_section()

static bool vtable_addr_in_text_section ( RVTableContext *  context, ut64  curAddress  )

static

Definition at line 68 of file vtable.c.

                                                                                  {
    // section of the curAddress
    RzBinSection *value = context->analysis->binb.get_vsect_at(context->analysis->binb.bin, curAddress);
    // If the pointed value lies in .text section
    return value && strstr(value->name, "text") && (value->perm & 1) != 0;
}

References value.

Referenced by vtable_is_addr_vtable_start_msvc(), and vtable_is_value_in_text_section().

vtable_is_addr_vtable_start()

static bool vtable_is_addr_vtable_start ( RVTableContext *  context, RzBinSection *  section, ut64  curAddress  )

static

Definition at line 174 of file vtable.c.

                                                                                                         {
    if (context->abi == RZ_ANALYSIS_CPP_ABI_MSVC) {
        return vtable_is_addr_vtable_start_msvc(context, curAddress);
    }
    if (context->abi == RZ_ANALYSIS_CPP_ABI_ITANIUM) {
        return vtable_is_addr_vtable_start_itanium(context, section, curAddress);
    }
    rz_return_val_if_reached(false);
}

References RZ_ANALYSIS_CPP_ABI_ITANIUM, RZ_ANALYSIS_CPP_ABI_MSVC, rz_return_val_if_reached, vtable_is_addr_vtable_start_itanium(), and vtable_is_addr_vtable_start_msvc().

Referenced by rz_analysis_vtable_search().

vtable_is_addr_vtable_start_itanium()

static bool vtable_is_addr_vtable_start_itanium ( RVTableContext *  context, RzBinSection *  section, ut64  curAddress  )

static

Definition at line 112 of file vtable.c.

                                                                                                                 {
    ut64 value;
    if (!curAddress || curAddress == UT64_MAX) {
        return false;
    }
    if (curAddress && !vtable_is_value_in_text_section(context, curAddress, NULL)) { // Vtable beginning referenced from the code
        return false;
    }
    if (!context->read_addr(context->analysis, curAddress - context->word_size, &value)) { // get the RTTI pointer
        return false;
    }
    RzBinSection *rtti_section = context->analysis->binb.get_vsect_at(context->analysis->binb.bin, value);
    if (value && !section_can_contain_rtti(rtti_section)) { // RTTI ptr must point somewhere in the data section
        return false;
    }
    if (!context->read_addr(context->analysis, curAddress - 2 * context->word_size, &value)) { // Offset to top
        return false;
    }
    if ((st32)value > 0) { // Offset to top has to be negative
        return false;
    }
    return true;
}

References NULL, section_can_contain_rtti(), st32, ut64(), UT64_MAX, value, and vtable_is_value_in_text_section().

Referenced by vtable_is_addr_vtable_start().

vtable_is_addr_vtable_start_msvc()

static bool vtable_is_addr_vtable_start_msvc ( RVTableContext *  context, ut64  curAddress  )

static

Definition at line 136 of file vtable.c.

                                                                                       {
    RzAnalysisXRef *xref;
    RzListIter *xrefIter;
 
    if (!curAddress || curAddress == UT64_MAX) {
        return false;
    }
    if (curAddress && !vtable_is_value_in_text_section(context, curAddress, NULL)) {
        return false;
    }
    // total xref's to curAddress
    RzList *xrefs = rz_analysis_xrefs_get_to(context->analysis, curAddress);
    if (rz_list_empty(xrefs)) {
        rz_list_free(xrefs);
        return false;
    }
    rz_list_foreach (xrefs, xrefIter, xref) {
        // section in which currenct xref lies
        if (vtable_addr_in_text_section(context, xref->from)) {
            ut8 buf[VTABLE_BUFF_SIZE];
            context->analysis->iob.read_at(context->analysis->iob.io, xref->from, buf, sizeof(buf));
 
            RzAnalysisOp analop = { 0 };
            rz_analysis_op(context->analysis, &analop, xref->from, buf, sizeof(buf), RZ_ANALYSIS_OP_MASK_BASIC);
 
            if (analop.type == RZ_ANALYSIS_OP_TYPE_MOV || analop.type == RZ_ANALYSIS_OP_TYPE_LEA) {
                rz_list_free(xrefs);
                rz_analysis_op_fini(&analop);
                return true;
            }
 
            rz_analysis_op_fini(&analop);
        }
    }
    rz_list_free(xrefs);
    return false;
}

References analop(), rz_analysis_ref_t::from, NULL, rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_TYPE_LEA, RZ_ANALYSIS_OP_TYPE_MOV, rz_analysis_xrefs_get_to(), rz_list_free(), UT64_MAX, vtable_addr_in_text_section(), VTABLE_BUFF_SIZE, and vtable_is_value_in_text_section().

Referenced by vtable_is_addr_vtable_start().

vtable_is_value_in_text_section()

static bool vtable_is_value_in_text_section ( RVTableContext *  context, ut64  curAddress, ut64 *  value  )

static

Definition at line 75 of file vtable.c.

                                                                                                   {
    // value at the current address
    ut64 curAddressValue;
    if (!context->read_addr(context->analysis, curAddress, &curAddressValue)) {
        return false;
    }
    // if the value is in text section
    bool ret = vtable_addr_in_text_section(context, curAddressValue);
    if (value) {
        *value = curAddressValue;
    }
    return ret;
}

References ut64(), value, and vtable_addr_in_text_section().

Referenced by rz_analysis_vtable_parse_at(), vtable_is_addr_vtable_start_itanium(), and vtable_is_addr_vtable_start_msvc().

vtable_section_can_contain_vtables()

static bool vtable_section_can_contain_vtables ( RzBinSection *  section )

static

Definition at line 89 of file vtable.c.

                                                                      {
    if (section->is_segment) {
        return false;
    }
    return !strcmp(section->name, ".rodata") ||
        !strcmp(section->name, ".rdata") ||
        !strcmp(section->name, ".data.rel.ro") ||
        !strcmp(section->name, ".data.rel.ro.local") ||
        rz_str_endswith(section->name, "__const");
}

References rz_str_endswith().

Referenced by rz_analysis_vtable_search().