Uses of Class
com.pnfsoftware.jeb.core.units.code.asm.ChainedOperationResult
Package
Description
This package and sub-packages contains types used by the native code analysis pipeline, including
gendec
(the generic decompiler).Types relating to the disassembler engine.
This package and its sub-packages contain the types used to access
gendec
, JEB's generic
decompiler.Types specific to code objects, such as Windows PE, Linux ELF, or Apple Mach-O.
-
Uses of ChainedOperationResult in com.pnfsoftware.jeb.core.units.code.asm
Modifier and TypeFieldDescriptionstatic final ChainedOperationResult<Boolean>
ChainedOperationResult.FALSE_CONTINUE
static final ChainedOperationResult<Boolean>
ChainedOperationResult.FALSE_IGNORE
static final ChainedOperationResult<Boolean>
ChainedOperationResult.FALSE_STOP
static final ChainedOperationResult<Boolean>
ChainedOperationResult.TRUE_CONTINUE
static final ChainedOperationResult<Boolean>
ChainedOperationResult.TRUE_STOP
common resultsstatic final ChainedOperationResult<Long>
ChainedOperationResult.ZEROL_CONTINUE
Modifier and TypeMethodDescriptionstatic <T> ChainedOperationResult<T>
ChainedOperationResult.continue_()
static <T> ChainedOperationResult<T>
ChainedOperationResult.ignore()
static <T> ChainedOperationResult<T>
ChainedOperationResult.stop()
static ChainedOperationResult<Boolean>
ChainedOperationResult.stop
(boolean result) -
Uses of ChainedOperationResult in com.pnfsoftware.jeb.core.units.code.asm.analyzer
Modifier and TypeMethodDescriptionAbstractAnalyzerExtension.customizeInstructionItem
(INativeInstructionItem item) The default result (getResult()
) is false.INativeCodeAnalyzerExtension.customizeInstructionItem
(INativeInstructionItem item) Customize an instruction item just after its creation by the code analyzer.AbstractAnalyzerExtension.determinePotentialPointers
(long address, InsnType insn, List<Pointer> values) The default result (getResult()
) is false.INativeCodeAnalyzerExtension.determinePotentialPointers
(long address, InsnType insn, List<Pointer> values) Determine pointers (addresses to data or code) contained in the provided instruction, to let the code analyzer enqueue them for additional analysis.AbstractAnalyzerExtension.determinePotentialPointersInProtoBlock
(IBasicBlockSkeleton<InsnType> blk, List<PointerLocation> values) The default result (getResult()
) is false.INativeCodeAnalyzerExtension.determinePotentialPointersInProtoBlock
(IBasicBlockSkeleton<InsnType> blk, List<PointerLocation> values) Determine additional pointers to be analyzed (addresses to data or code) that may be inferred from the analysis of the provided basic block skeleton (proto-basic block).AbstractAnalyzerExtension.determineRoutineStackPointerDelta
(CFG<InsnType> routine) The default result (getResult()
) is null.INativeCodeAnalyzerExtension.determineRoutineStackPointerDelta
(CFG<InsnType> routine) Determine (heuristically) the stack pointer delta generated by the execution of a routine.AbstractAnalyzerExtension.determineSwitchInformation
(long branchInstructionAddress, IBasicBlockSkeleton<InsnType> branchInstructionBlock, List<IBasicBlockSkeleton<InsnType>> knownBlocks) The default result (getResult()
) is null.INativeCodeAnalyzerExtension.determineSwitchInformation
(long branchInstructionAddress, IBasicBlockSkeleton<InsnType> branchInstructionBlock, List<IBasicBlockSkeleton<InsnType>> knownBlocks) Determine (heuristically) the information related to a switch-like statement, i.e.AbstractAnalyzerExtension.getPossiblePaddingSize
(long address, long addressMax) Default implementation checks the patterns stored inAbstractAnalyzerExtension.paddingVerifier
.INativeCodeAnalyzerExtension.getPossiblePaddingSize
(long address, long addressMax) Determine if a given memory area looks like (could be) starting with padding, and provides the size of the padding looking area, if any.AbstractAnalyzerExtension.getPreferredAdvancedAnalysisStage
(INativeMethodItem routine) The default result (getResult()
) isNativeDecompilationStage.SIMULATION
.INativeCodeAnalyzerExtension.getPreferredAdvancedAnalysisStage
(INativeMethodItem routine) Determine whichNativeDecompilationStage
should be used byINativeCodeAdvancedAnalyzer
for the given routine.AbstractAnalyzerExtension.getPreferredBreakingFlow
(long address, InsnType insn) The default result (getResult()
) is null.INativeCodeAnalyzerExtension.getPreferredBreakingFlow
(long address, InsnType insn) Provide alternate/custom breaking-flow information.AbstractAnalyzerExtension.getProbableEntryPoints
(long address, long addressMax) INativeCodeAnalyzerExtension.getProbableEntryPoints
(long address, long addressMax) Get the likely entry points in the given memory area.AbstractAnalyzerExtension.getPrologueLooking
(long address, long addressMax) Default implementation checks the patterns stored inAbstractAnalyzerExtension.prologueVerifier
.INativeCodeAnalyzerExtension.getPrologueLooking
(long address, long addressMax) Determine if a given memory area looks like (could be) the beginning of a routine.ChainedOperationResult<? extends Pointer>
AbstractAnalyzerExtension.getTrampolineTarget
(CFG<InsnType> routine) The default result (getResult()
) is null.ChainedOperationResult<? extends Pointer>
INativeCodeAnalyzerExtension.getTrampolineTarget
(CFG<InsnType> routine) Get the location targeted by a trampoline routine -- a routine that only branches to another location --, if any.AbstractAnalyzerExtension.isCandidateSwitchDispatcher
(long branchInstructionAddress, InsnType branchInstruction, IBasicBlockSkeleton<InsnType> branchInstructionBlock) The default result (getResult()
) is false.INativeCodeAnalyzerExtension.isCandidateSwitchDispatcher
(long branchInstructionAddress, InsnType branchInstruction, IBasicBlockSkeleton<InsnType> branchInstructionBlock) Determine (heuristically) if the provided branching instruction (jump/call/...) could be the dispatcher of a switch-like statement.AbstractAnalyzerExtension.isNonReturningRoutine
(INativeMethodItem routine) INativeCodeAnalyzerExtension.isNonReturningRoutine
(INativeMethodItem routine) Determine if the given routine is non-returning.AbstractAnalyzerExtension.postprocessImage
(int passIndex) INativeCodeAnalyzerExtension.postprocessImage
(int passIndex) This method is called after the standard analysis pass completes (i.e., before any optional advanced analysis takes place).AbstractAnalyzerExtension.preprocessImage
(int passIndex) INativeCodeAnalyzerExtension.preprocessImage
(int passIndex) This method is called before an analysis pass is performed.AbstractAnalyzerExtension.shouldForceRoutineEnd
(long address, InsnType insn) The default result (getResult()
) is false.INativeCodeAnalyzerExtension.shouldForceRoutineEnd
(long address, InsnType insn) Determine if the address is the last instruction of a routine.AbstractAnalyzerExtension.sigMatchingPostProcess
(int passIndex) INativeCodeAnalyzerExtension.sigMatchingPostProcess
(int passIndex) This method is called after signatures matching was performed.AbstractAnalyzerExtension.verifyGapRoutineCandidate
(long address) The default implementation returns true, that is a candidate address for a routine creation in a gap will be authorized by default.INativeCodeAnalyzerExtension.verifyGapRoutineCandidate
(long address) Determine whether a candidate routine in a gap should be considered as valid. -
Uses of ChainedOperationResult in com.pnfsoftware.jeb.core.units.code.asm.decompiler
Modifier and TypeMethodDescriptionAbstractNativeDecompilerExtension.applyAdditionalTypes
(IDecompiledMethod target, CFG<IEStatement> cfg) The default implementation does nothing and requests continuation.INativeDecompilerExtension.applyAdditionalTypes
(IDecompiledMethod target, CFG<IEStatement> cfg) This method is called by the decompiler just before type propagation on the IR-CFG takes place.AbstractNativeDecompilerExtension.augmentSimulationContext
(INativeDecompilerContext decompiler, IERoutineContext ctx, IESimulationResults simulationContext, long offset, IEStatement insn, EState state) The default implementation does nothing and requests continuation.INativeDecompilerExtension.augmentSimulationContext
(INativeDecompilerContext decompiler, IERoutineContext ctx, IESimulationResults simulationContext, long offset, IEStatement insn, EState state) This method is called during the early simulation phase (unoptimized IR emulation) in the decompilation pipeline.AbstractNativeDecompilerExtension.collectCandidateMemoryDerefs
(IEGeneric exp, EDefUseInfo defuse, boolean isDef) The default implementation does nothing and requests continuation.INativeDecompilerExtension.collectCandidateMemoryDerefs
(IEGeneric exp, EDefUseInfo defuse, boolean isDef) This method is called potentially-used/defined variables (candidates) are being collected forIEMem
IR expressions.AbstractNativeDecompilerExtension.convertInstruction
(IEConverter<?> converter, IERoutineContext ctx, ConverterInstructionEntry<?> e) The default implementation does nothing and requests continuation.INativeDecompilerExtension.convertInstruction
(IEConverter<?> converter, IERoutineContext ctx, ConverterInstructionEntry<?> e) Convert a native instruction to IR code.AbstractNativeDecompilerExtension.convertToInlinedCall
(IEConverter<?> converter, IERoutineContext ctx, ConverterInstructionEntry<?> e, long target) The default implementation does nothing and requests continuation.INativeDecompilerExtension.convertToInlinedCall
(IEConverter<?> converter, IERoutineContext ctx, ConverterInstructionEntry<?> e, long target) AbstractNativeDecompilerExtension.customizeIntermediateOptimizer
(INativeDecompilerContext decompiler, IEMasterOptimizer mo) The default implementation does nothing and requests continuation.INativeDecompilerExtension.customizeIntermediateOptimizer
(INativeDecompilerContext decompiler, IEMasterOptimizer mo) This method is called by a decompiler unit to customize a master IR optimizer.AbstractNativeDecompilerExtension.executePostPipelineStage
(NativeDecompilationStage stage, IDecompiledMethod target) The default implementation returnsIN_PROCESS
and requests continuation.INativeDecompilerExtension.executePostPipelineStage
(NativeDecompilationStage stage, IDecompiledMethod target) Extensions may customize the decompilation pipeline by implementing this method.AbstractNativeDecompilerExtension.executePrePipelineStage
(NativeDecompilationStage stage, IDecompiledMethod target) The default implementation returnsIN_PROCESS
and requests continuation.INativeDecompilerExtension.executePrePipelineStage
(NativeDecompilationStage stage, IDecompiledMethod target) Extensions may customize the decompilation pipeline by implementing this method.AbstractNativeDecompilerExtension.isMemoryResolutionAllowed
(INativeDecompilerContext decompiler, IERoutineContext ctx, IEMem mem) The default implementation does nothing and requests continuation.INativeDecompilerExtension.isMemoryResolutionAllowed
(INativeDecompilerContext decompiler, IERoutineContext ctx, IEMem mem) This method is called when the decompiler is attempting to dereference memory in order to replace a memory access by an actual immediate value.AbstractNativeDecompilerExtension.isOpaquePointerType
(IWildcardType t) The default implementation returns false and requests continuation.INativeDecompilerExtension.isOpaquePointerType
(IWildcardType t) This method is called duringIECall
's def-use determination on parameters that are unresolved pointer types.AbstractNativeDecompilerExtension.resolveVariableArgumentInformation
(IERoutineContext ctx, CFG<IEStatement> cfg, int iblk, IWildcardPrototype proto) INativeDecompilerExtension.resolveVariableArgumentInformation
(IERoutineContext ctx, CFG<IEStatement> cfg, int iblk, IWildcardPrototype proto) -
Uses of ChainedOperationResult in com.pnfsoftware.jeb.core.units.codeobject
Modifier and TypeMethodDescriptionIELFSectionProcessor.process
(IELFUnit elf, IELFSectionEntry sectionHeader, ByteBuffer sectionData) Process a section.