#include <memory>
#include <set>
#include <iostream>

#include <pro.h>
#include <prodir.h>
#include <ida.hpp>
#include <auto.hpp>
#include <expr.hpp>
#include <name.hpp>
#include <undo.hpp>
#include <name.hpp>
#include <diskio.hpp>
#include <loader.hpp>
#include <dirtree.hpp>
#include <kernwin.hpp>
#include <segment.hpp>
#include <parsejson.hpp>
#include <idalib.hpp>

//-------------------------------------------------------------------------
/// \brief Print application usage
/// \param exec_filename The application name (argv[0])
static void display_usage(const char *exec_filename)
{
  // Bad usage, need the input file
  std::cout << "Usage: " << std::endl << " " << exec_filename
            << " -f <binary-file-name>"
            << " [-s <script-file-name> [-a <script-arguments>]]"
            << " [-p 0/1]"
            << " [-g <signature-path> [-o signature-results]]"
            << " [-l 0/1]"
            << " [-v 0/1]"
            << " -h"
            << std::endl << std::endl
            << " -f <binary-file-name> specifies the file to be analyzed" << std::endl
            << " -s <script-file-name> provide an idc or python script file to be run" << std::endl
            << " -p <integer 0/1/2> produce signatures, generate .sig and .pat for current database, 1 only .pat, 2 both .sig and .pat" << std::endl
            << " -a <script-arguments> string used for passing arguments to Python script, the string will be passed in sys.argv" << std::endl
            << " -g <signature-path> provide a signature file or folder to be checked, if the path is a folder all existing sig files will be checked sequentially" << std::endl
            << " -o <signature-results> json output file where the signature applying results to be stored" << std::endl
            << " -l <boolean 0/1> list the segments" << std::endl
            << " -v <level 0/1> verbosity level 0 quiet, 1 show messages" << std::endl
            << " -h display help" << std::endl;
}

//-------------------------------------------------------------------------
/// \brief Function used to dump a memory address
/// \param addr the memory address
/// \return Textual represention of the address
static std::string dump_address(ea_t addr)
{
  // IDA style. call ea2str which decorates the address with segment
  qstring astext;
  ea2str(&astext, addr);
  return astext.c_str();
}

//-------------------------------------------------------------------------
/// @brief Structure containing all command line parameters
struct command_line_arguments
{
  qstring binary_file_name;
  qstring script_file_name;
  qstring script_file_args;
  qstring signature_path;
  qstring signature_res_file;
  bool list_segments = false;
  char produce_sig = 0;
  char verbosity = 1;
};

//-------------------------------------------------------------------------
/// \brief Parse application command line
/// \param argc main() argc argument
/// \param argv main() argv argument
/// \param arguments structure used for reading and passing app arguments
/// \return true on success
static bool parse_arguments(int argc, char *argv[], command_line_arguments &arguments)
{
  int opt = 0;
  char *opt_data = nullptr;
  char *optargument = nullptr;

  for ( int arg = 0; arg < argc; )
  {
    if ( ++arg >= argc )
      break;

    opt_data = argv[arg];
    optargument = nullptr;
    opt = 0;

    if ( (strlen(opt_data)) > 1 && opt_data[0] == '-' )
      opt = opt_data[1];
    else
      return false;

    if ( ++arg >= argc )
      break;

    opt_data = argv[arg];
    optargument = opt_data;

    switch ( opt )
    {
      case 'f':
        if ( !optargument )
          return false;
        arguments.binary_file_name = optargument;
        break;

      case 's':
        if ( !optargument )
          return false;
        arguments.script_file_name = optargument;
        break;

      case 'a':
        if ( !optargument )
          return false;
        arguments.script_file_args = optargument;
        break;

      case 'g':
        if ( !optargument )
          return false;
        arguments.signature_path = optargument;
        break;

      case 'o':
        if ( !optargument )
          return false;
        arguments.signature_res_file = optargument;
        break;

      case 'l':
        if ( !optargument )
          return false;
        arguments.list_segments = strcmp(optargument, "0") != 0 && strcmp(optargument, " 0") != 0;
        break;

      case 'p':
        if ( !optargument )
          return false;
        arguments.produce_sig = (char)atoi(optargument);
        break;

      case 'v':
        if ( !optargument )
          return false;
        arguments.verbosity = (char)atoi(optargument);
        break;

      case 'h':
        return false;

      default:
        return false;
    }
  }

  return !arguments.binary_file_name.empty();
}

//-------------------------------------------------------------------------
/// \brief Launch a script provided by the user, IDC or Python
/// \param fname script file name
/// \param args script file arguments
/// \return true on success
static bool execute_script(const char *fname, const char *args)
{
  std::cout << "Running script " << fname << "..." << std::endl;

  qstring errbuf;
  if ( !qfileexist(fname) )
  {
    std::cout << "Script file " << fname << " does not exists" << std::endl;
    return false;
  }

  // Parse extension
  const char *ext = get_file_ext(fname);
  const extlang_object_t el = find_extlang_by_ext(ext);
  if ( el == nullptr // execute as IDC
    || el->compile_file == nullptr
    || el->is_idc() )
  {
    // is idc file
    if ( !compile_idc_file(fname, &errbuf) )
    {
      std::cout << "Failed to compile IDC script file " << fname << ", error: " << errbuf.c_str() << std::endl;
      return false;
    }

    if ( !call_idc_func(nullptr, "main", nullptr, 0, &errbuf) )
    {
      std::cout << "Failed to call IDC script main function for file " << fname << ", error: " << errbuf.c_str() << std::endl;
      return false;
    }
    std::cout << "Script " << fname << " successfully run" << std::endl;
    return true;
  }

  // Run python script

  // If we have parameters, prepend the script with code that sets the sys.argv
  // (we cannot use compile_file which overrides the sys.argv with the script file name)
  if ( args && qstrlen(args) )
  {
    qstrvec_t script_args;
    if ( args && qstrlen(args) && !parse_command_line(&script_args, nullptr, args, 0) )
    {
      std::cout << "Script arguments could not be parsed" << args << std::endl;
      return false;
    }

    qstring script_code = "import sys\n";
    script_code += qstring("sys.argv = ['") + fname + qstring("']\n");
    for ( const auto &arg : script_args )
      script_code += qstring("sys.argv.append('") + arg + qstring("')\n");

    FILE *py_script_file = qfopen(fname, "r");
    if ( !py_script_file )
    {
      std::cout << "Script " << fname << " could not be read" << std::endl;
      return false;
    }

    char buf[4096];
    while ( true )
    {
      char *rv = qfgets(buf, sizeof(buf), py_script_file);
      if ( rv == nullptr )
        break;

      size_t line_len = strlen(buf);
      if ( line_len > 0 )
      {
        if ( buf[line_len-1] == '\n' )
          buf[line_len-1] = 0;
      }

      script_code += qstring(buf) + "\n";
    }

    qfclose(py_script_file);

    if ( !el->eval_snippet(script_code.c_str(), &errbuf) )
    {
      std::cout << "Failed to run script file " << fname << " with arguments, error: " << errbuf.c_str() << std::endl;
      return false;
    }

    return true;
  }

  // Run python without paremeters
  if ( !el->compile_file(fname, nullptr, &errbuf) )
  {
    std::cout << "Failed to run script file " << fname << ", error: " << errbuf.c_str() << std::endl;
    return false;
  }

  return true;
}

//-------------------------------------------------------------------------
/// \brief List the segments for the loaded binary
static void produce_signatures(int arg)
{
  std::cout << std::endl << "Making signatures..." << std::endl;
  if ( make_signatures(arg == 1) )
  {
    std::cout << std::endl << "Signatures generation completed successfully." << std::endl;
  }
  else
  {
    std::cout << std::endl << "Signatures generation failed." << std::endl;
  }
}

//-------------------------------------------------------------------------
/// \brief List the segments for the loaded binary
static void list_binary_segments()
{
  int nb_items = get_segm_qty();
  std::cout << std::endl << "Listing segments, there are " << nb_items << " segments:" << std::endl<< std::endl;
  for ( int seg_no = 0; seg_no < nb_items; ++seg_no )
  {
    segment_t *segment = getnseg(seg_no);
    if ( segment != nullptr )
    {
      qstring name;
      get_visible_segm_name(&name, segment);
      qstring sclass;
      get_segm_class(&sclass, segment);

      std::cout << seg_no + 1 << "." << "\tname: " << name.c_str() << std::endl;
      std::cout << "\tstart: " << dump_address(segment->start_ea) << std::endl;
      std::cout << "\talign: " << (int)segment->align << std::endl;
      std::cout << "\ttype: " <<  get_segment_combination(segment->comb) << std::endl;
      std::cout << "\tclass: " << (qstrlen(sclass.c_str()) > 0 ? sclass.c_str() : "unknown") << std::endl;
      std::cout << "\taddress bits: " << segment->abits() << std::endl;
      std::cout << std::endl;
    }
  }
}

//-------------------------------------------------------------------------
/// \brief Applies signatures from sig file provided by the user
/// \param fname sigantures file name
/// \param matches reference to variable that will be filled with number of matches
/// \return true on success and fill the matches
static bool apply_signatures(const char *fname, int &matches, qstring &title)
{
  title.clear();
  // add the signature file in the signatures queue
  int index = plan_to_apply_idasgn(fname);
  if ( index <= 0 )
    return false;

  // wait for the signatures to be applied, call auto_wait() to trigger the process
  auto_wait();

  // search our file in the list of signatures
  bool ok = false;
  for ( index = 0; index < get_idasgn_qty(); index++ )
  {
    qstring signame;
    qstring optlibs;
    matches = get_idasgn_desc(&signame, &optlibs, index);
    if ( signame.ends_with(fname) )
    {
      // just set the flag, let all sigs to be applied anyway
      ok = get_idasgn_title(&title, fname) > 0;
    }
  }

  return ok;
}

//-------------------------------------------------------------------------
/// \brief Local structure used to pass user data to IDB hook
struct idb_callback_user_data
mochaa / idapro-debugsource rpm

Products

About

Resources

Contact Gemfury
