Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Visual Basic Information Parsing, PCode detection #440

Merged
merged 33 commits into from
Mar 5, 2019
Merged
Show file tree
Hide file tree
Changes from 32 commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
58383a9
VB header parsing
pruzko Nov 16, 2018
023b90b
project info header parsing I.
pruzko Nov 16, 2018
0b37a1a
fileinfo wrapper
pruzko Dec 12, 2018
9ab607a
fileinfo wrapper
pruzko Dec 12, 2018
bf7494a
string utils
pruzko Dec 12, 2018
38f4512
etern table plain presentation
pruzko Dec 13, 2018
775f525
Visual Basic Objects presentation
pruzko Dec 13, 2018
d3e3ef0
some more presentation
pruzko Dec 18, 2018
3c85d1e
presentation of language and project related stuff
pruzko Jan 31, 2019
b275bbd
extern and object table hashes
pruzko Jan 31, 2019
0dea3e3
obj table hash presentation
pruzko Feb 1, 2019
17b8798
doxygen fix
pruzko Feb 1, 2019
5dacd58
basic json presentation
pruzko Feb 1, 2019
c6bad00
extern and object tables json presentation
pruzko Feb 1, 2019
433010a
COM Registration Data extraction and presentation + object Table GUID
pruzko Feb 4, 2019
8945254
prefix cut for project path
pruzko Feb 5, 2019
12bebfc
modification for clawler needs
pruzko Feb 5, 2019
998b227
addresses fixed
pruzko Feb 8, 2019
62d479f
export table extraction fixed
pruzko Feb 9, 2019
b722c0d
COM Registration Info parsed
pruzko Feb 9, 2019
699c1fb
COM Registration Info plain presentation
pruzko Feb 9, 2019
97c9246
COM Registration Info json presentation
pruzko Feb 9, 2019
9c2ca13
modification for crawler only
pruzko Feb 11, 2019
36ebaa1
ascii parsing fixed and VB presentation fixed
pruzko Feb 11, 2019
87ad687
relicts removed
pruzko Feb 11, 2019
c788ed1
empty object table presentation fixed
pruzko Feb 12, 2019
ae6882a
support of LCID to string added
pruzko Feb 16, 2019
4e1ae53
reference instead of copying
pruzko Feb 21, 2019
c41801f
DynamicBuffer moved
pruzko Feb 22, 2019
3338273
pow fixed
pruzko Feb 22, 2019
9da9543
doxygen fixed
pruzko Feb 23, 2019
1ec713c
DynamicBuffer used for VB parsing
pruzko Feb 23, 2019
a266aa7
header problems fixed
pruzko Feb 26, 2019
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions include/retdec/fileformat/file_format/pe/pe_format.h
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
#include "retdec/fileformat/types/dotnet_headers/string_stream.h"
#include "retdec/fileformat/types/dotnet_headers/user_string_stream.h"
#include "retdec/fileformat/types/dotnet_types/dotnet_class.h"
#include "retdec/fileformat/types/visual_basic/visual_basic_info.h"

namespace retdec {
namespace fileformat {
Expand All @@ -44,6 +45,7 @@ class PeFormat : public FileFormat
std::string typeRefHashCrc32; ///< .NET typeref table hash as CRC32
std::string typeRefHashMd5; ///< .NET typeref table hash as MD5
std::string typeRefHashSha256; ///< .NET typeref table hash as SHA256
VisualBasicInfo visualBasicInfo; ///< visual basic header information

/// @name Initialization methods
/// @{
Expand All @@ -65,6 +67,7 @@ class PeFormat : public FileFormat
void loadSymbols();
void loadImports();
void loadExports();
void loadVisualBasicHeader();
void loadPdbInfo();
void loadResourceNodes(std::vector<const PeLib::ResourceChild*> &nodes, const std::vector<std::size_t> &levels);
void loadResources();
Expand Down Expand Up @@ -93,6 +96,16 @@ class PeFormat : public FileFormat
std::uint64_t detectPossibleMetadataHeaderAddress() const;
void computeTypeRefHashes();
/// @}
/// @name Visual Basic methods
/// @{
bool parseVisualBasicProjectInfo(std::size_t structureOffset);
bool parseVisualBasicExternTable(std::size_t structureOffset, std::size_t nEntries);
bool parseVisualBasicObjectTable(std::size_t structureOffset);
bool parseVisualBasicObjects(std::size_t structureOffset, std::size_t nObjects);
bool parseVisualBasicComRegistrationData(std::size_t structureOffset);
bool parseVisualBasicComRegistrationInfo(std::size_t structureOffset,
std::size_t comRegDataOffset);
/// @}
protected:
PeLib::PeFile *file; ///< PeLib representation of PE file
PeLib::PeHeaderT<32> *peHeader32; ///< header of 32-bit PE file
Expand Down Expand Up @@ -180,6 +193,7 @@ class PeFormat : public FileFormat
const std::string& getTypeRefhashCrc32() const;
const std::string& getTypeRefhashMd5() const;
const std::string& getTypeRefhashSha256() const;
const VisualBasicInfo* getVisualBasicInfo() const;
/// @}
};

Expand Down
5 changes: 0 additions & 5 deletions include/retdec/fileformat/types/resource_table/bitmap_image.h
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,6 @@ class BitmapImage
const std::vector<std::vector<struct BitmapPixel>> &getImage() const;
/// @}

/// @name Setters
/// @{
// TODO
/// @}

/// @name Other methods
/// @{
bool parseDibFormat(const ResourceIcon &icon);
Expand Down
43 changes: 43 additions & 0 deletions include/retdec/fileformat/types/visual_basic/visual_basic_extern.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
/**
* @file include/retdec/fileformat/types/visual_basic/visual_basic_extern.h
* @brief Class for visual basic extern.
* @copyright (c) 2017 Avast Software, licensed under the MIT license
*/

#ifndef RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_EXTERN_H
#define RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_EXTERN_H

#include <string>

namespace retdec {
namespace fileformat {

/**
* Class for visual basic information
*/
class VisualBasicExtern
{
private:
std::string moduleName;
std::string apiName;
public:
VisualBasicExtern();
~VisualBasicExtern();

/// @name Getters
/// @{
const std::string &getModuleName() const;
const std::string &getApiName() const;
/// @}

/// @name Setters
/// @{
void setModuleName(const std::string &mName);
void setApiName(const std::string &aName);
/// @}
};

} // namespace fileformat
} // namespace retdec

#endif
166 changes: 166 additions & 0 deletions include/retdec/fileformat/types/visual_basic/visual_basic_info.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,166 @@
/**
* @file include/retdec/fileformat/types/visual_basic/visual_basic_info.h
* @brief Class for visual basic information.
* @copyright (c) 2017 Avast Software, licensed under the MIT license
*/

#ifndef RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_INFO_H
#define RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_INFO_H

#include <string>
#include <vector>
#include <memory>

#include "retdec/fileformat/types/visual_basic/visual_basic_object.h"
#include "retdec/fileformat/types/visual_basic/visual_basic_extern.h"

namespace retdec {
namespace fileformat {

/**
* Class for visual basic information
*/
class VisualBasicInfo
{
private:
// VB Header
std::string languageDLL;
std::string backupLanguageDLL;
std::string projectExeName;
std::string projectDescription;
std::string projectHelpFile;
std::string projectName;
std::uint32_t languageDLLPrimaryLCID;
std::uint32_t languageDLLSecondaryLCID;

// VB Proj Info
std::string projectPath;

// VB Object table
std::string objectTableGUID;
std::uint32_t projectPrimaryLCID;
std::uint32_t projectSecondaryLCID;
std::vector<std::unique_ptr<VisualBasicObject>> objects;

// VB extern table
std::vector<std::unique_ptr<VisualBasicExtern>> externs;

// COM register data
std::string typeLibCLSID;
std::uint32_t typeLibLCID;
std::uint16_t typeLibMajorVersion;
std::uint16_t typeLibMinorVersion;

// COM register info
std::string COMObjectName;
std::string COMObjectDescription;
std::string COMObjectCLSID;
std::string COMObjectInterfaceCLSID;
std::string COMObjectEventsCLSID;
std::string COMObjectType;

// others
std::string externTableHashCrc32;
std::string externTableHashMd5;
std::string externTableHashSha256;
std::string objectTableHashCrc32;
std::string objectTableHashMd5;
std::string objectTableHashSha256;

bool validLanguageDLLPrimaryLCID;
bool validLanguageDLLSecondaryLCID;
bool validProjectPrimaryLCID;
bool validProjectSecondaryLCID;
bool validTypeLibLCID;
bool validTypeLibMajorVersion;
bool validTypeLibMinorVersion;
bool pcodeFlag;

std::string guidToStr(const std::uint8_t data[16]);

public:
VisualBasicInfo();
~VisualBasicInfo();

/// @name Getters
/// @{
const std::string &getLanguageDLL() const;
const std::string &getBackupLanguageDLL() const;
const std::string &getProjectExeName() const;
const std::string &getProjectDescription() const;
const std::string &getProjectHelpFile() const;
const std::string &getProjectName() const;
bool getLanguageDLLPrimaryLCID(std::uint32_t &res) const;
bool getLanguageDLLSecondaryLCID(std::uint32_t &res) const;
const std::string &getProjectPath() const;
bool getProjectPrimaryLCID(std::uint32_t &res) const;
bool getProjectSecondaryLCID(std::uint32_t &res) const;
const std::vector<std::unique_ptr<VisualBasicObject>> &getObjects() const;
const std::vector<std::unique_ptr<VisualBasicExtern>> &getExterns() const;
const VisualBasicObject *getObject(std::size_t position) const;
const VisualBasicExtern *getExtern(std::size_t position) const;
std::size_t getNumberOfObjects() const;
std::size_t getNumberOfExterns() const;
const std::string &getObjectTableGUID() const;
const std::string &getTypeLibCLSID() const;
bool getTypeLibLCID(std::uint32_t &res) const;
bool getTypeLibMajorVersion(std::uint16_t &res) const;
bool getTypeLibMinorVersion(std::uint16_t &res) const;
const std::string &getCOMObjectName() const;
const std::string &getCOMObjectDescription() const;
const std::string &getCOMObjectCLSID() const;
const std::string &getCOMObjectInterfaceCLSID() const;
const std::string &getCOMObjectEventsCLSID() const;
const std::string &getCOMObjectType() const;
const std::string &getExternTableHashCrc32() const;
const std::string &getExternTableHashMd5() const;
const std::string &getExternTableHashSha256() const;
const std::string &getObjectTableHashCrc32() const;
const std::string &getObjectTableHashMd5() const;
const std::string &getObjectTableHashSha256() const;
/// @}

/// @name Setters
/// @{
void setLanguageDLL(const std::string &lDll);
void setBackupLanguageDLL(const std::string &blDll);
void setProjectExeName(const std::string &exeName);
void setProjectDescription(const std::string &desc);
void setProjectHelpFile(const std::string &helpFile);
void setProjectName(const std::string &name);
void setLanguageDLLPrimaryLCID(std::uint32_t lDllPrimLCID);
void setLanguageDLLSecondaryLCID(std::uint32_t lDllSecLCID);
void setProjectPath(const std::string &path);
void setProjectPrimaryLCID(std::uint32_t primLCID);
void setProjectSecondaryLCID(std::uint32_t secLCID);
void setTypeLibCLSID(const std::uint8_t data[16]);
void setTypeLibLCID(std::uint32_t tlbLCID);
void setPcode(bool set);
void setObjectTableGUID(const std::uint8_t data[16]);
void setTypeLibMajorVersion(std::uint16_t majVer);
void setTypeLibMinorVersion(std::uint16_t minVer);
void setCOMObjectName(const std::string &name);
void setCOMObjectDescription(const std::string &description);
void setCOMObjectCLSID(const std::uint8_t data[16]);
void setCOMObjectInterfaceCLSID(const std::uint8_t data[16]);
void setCOMObjectEventsCLSID(const std::uint8_t data[16]);
void setCOMObjectType(std::uint8_t type);
/// @}

/// @name Other methods
/// @{
void addObject(std::unique_ptr<VisualBasicObject>&& obj);
void addExtern(std::unique_ptr<VisualBasicExtern>&& ext);
bool hasProjectName() const;
bool hasProjectDescription() const;
bool hasProjectHelpFile() const;
bool isPcode() const;
void computeExternTableHashes();
void computeObjectTableHashes();
/// @}
};

} // namespace fileformat
} // namespace retdec

#endif
49 changes: 49 additions & 0 deletions include/retdec/fileformat/types/visual_basic/visual_basic_object.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
/**
* @file include/retdec/fileformat/types/visual_basic/visual_basic_object.h
* @brief Class for visual basic object.
* @copyright (c) 2017 Avast Software, licensed under the MIT license
*/

#ifndef RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_OBJECT_H
#define RETDEC_FILEFORMAT_TYPES_VISUAL_BASIC_VISUAL_BASIC_OBJECT_H

#include <string>
#include <vector>

namespace retdec {
namespace fileformat {

/**
* Class for visual basic information
*/
class VisualBasicObject
{
private:
std::string name;
std::vector<std::string> methods;
public:
VisualBasicObject();
~VisualBasicObject();

/// @name Getters
/// @{
const std::string &getName() const;
const std::vector<std::string> &getMethods() const;
std::size_t getNumberOfMethods() const;
/// @}

/// @name Setters
/// @{
void setName(const std::string &n);
/// @}

/// @name Other methods
/// @{
void addMethod(const std::string &method);
/// @}
};

} // namespace fileformat
} // namespace retdec

#endif
Loading