Package com.pnfsoftware.jeb.core.units.code.asm.sig.codeless

Class CodelessSignatureManager

java.lang.Object
com.pnfsoftware.jeb.core.units.code.asm.sig.codeless.CodelessSignatureManager
All Implemented Interfaces:
IEventListener
public class CodelessSignatureManager extends Object implements IEventListener
Manage a set of codeless signature models, such that an unknown binary can be matched against these models (see match(INativeCodeUnit, CodelessSignaturePackageEntry)), or identified as containing code from the models (see identifyLibraries(INativeCodeUnit)).

This manager is intended to be used in post analysis 'one shot' style; in particular it does not keep any storage of already loaded/matched signatures.

  • Field Details

    • CODELESS_SIGS_EXTENSION

      public static final String CODELESS_SIGS_EXTENSION
      Extension of codeless signature package files.
      See Also:

    • CODELESS_FOLDER_DEFAULT_NAME

      public static final String CODELESS_FOLDER_DEFAULT_NAME
      Default folder name for codeless signature packages.
      See Also:

  • Method Details

    • getInstance

      public static CodelessSignatureManager getInstance(IEnginesContext enginesContext)
      Get the singleton codeless signature manager.
      Parameters:
      enginesContext - engines context used by the manager
      Returns:
      singleton manager

    • addFolder

      public void addFolder(File folder, boolean doRescan)
      Add a folder to scan for codeless signature packages.
      Parameters:
      folder - folder to add
      doRescan - if true, scan folders immediately after adding the folder

    • getAvailablePackages

      public List<CodelessSignaturePackageEntry> getAvailablePackages()
      Provides the list of available signature packages entries (never null). The corresponding packages are not necessarily loaded.
      Returns:
      available package entries

    • rescan

      public void rescan()
      Rescan registered folders.

    • scan

      public List<CodelessSignaturePackageEntry> scan()
      Scan default folder to provide list of available packages.

      This method should be executed once at startup.

      Returns:
      available package entries

    • isMatched

      public boolean isMatched(INativeCodeUnit<IInstruction> codeUnit, CodelessSignaturePackageEntry entry)
      Check if a signature package has been matched against given code unit.
      Parameters:
      codeUnit - code unit to query
      entry - package entry to query
      Returns:
      true if the package has been matched against the code unit

    • getMatchableUnit

      public INativeCodeUnit<IInstruction> getMatchableUnit()
      Search first suitable code unit that can be matched, in current project.

      FIXME: replace by a proper search for all compatible units, and let client decides which ones should be matched.

      Returns:
      first matchable code unit, or null

    • match

      public MatchingState match(INativeCodeUnit<IInstruction> codeUnit, CodelessSignaturePackageEntry entry)
      Match given unit against given reference model.

      Note that a new Matcher is instantiated each time.

      Parameters:
      codeUnit - code unit to match
      entry - codeless signature package entry to match against
      Returns:
      final matching state, null if matching failed

    • importState

      public boolean importState(INativeCodeUnit<IInstruction> codeUnit, MatchingState state)
      Import a matching state into a code unit.
      Parameters:
      codeUnit - target code unit
      state - matching state to import
      Returns:
      true if the state was imported

    • identifyLibraries

      public LibraryIdentificationResults identifyLibraries(INativeCodeUnit<IInstruction> codeUnit)
      Identify libraries present in a code unit.
      Parameters:
      codeUnit - code unit to inspect
      Returns:
      library identification results

    • onEvent

      public void onEvent(IEvent event)
      Description copied from interface: IEventListener
      Handle an event.
      Specified by:
      onEvent in interface IEventListener
      Parameters:
      event - event to handle