Skip to content

Commit

Permalink
Merge pull request #20 from doronz88/refactor/global-unique-option
Browse files Browse the repository at this point in the history
commands: refactor commands to not perform unique upon each
  • Loading branch information
doronz88 committed Jul 19, 2020
2 parents ff1f3dd + 5e5a92d commit e52de65
Show file tree
Hide file tree
Showing 29 changed files with 138 additions and 144 deletions.
12 changes: 6 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ To view the list of available commands, [view the list below](#available-command
name: g_awsome_global,
instructions: [
# find the byte sequence '11 22 33 44'
find-bytes --or '11 22 33 44'
find-bytes '11 22 33 44'
# advance offset by 20
offset 20
Expand All @@ -139,7 +139,7 @@ To view the list of available commands, [view the list below](#available-command
name: free
instructions: [
# search the string "free"
find-str --or 'free' --null-terminated
find-str 'free' --null-terminated
# goto xref
xref
Expand Down Expand Up @@ -212,7 +212,7 @@ To view the list of available commands, [view the list below](#available-command
name: cool_functions
instructions: [
# find string
find-str --or 'init_stuff' --null-terminated
find-str 'init_stuff' --null-terminated
# goto to xref
xref
Expand Down Expand Up @@ -259,7 +259,7 @@ To view the list of available commands, [view the list below](#available-command
```python
from fa.commands.find_str import find_str
from fa.commands.set_name import set_name
from fa.commands.unique import unique
from fa.commands.verify_single import unique
from fa import context

def run(**kwargs):
Expand All @@ -283,7 +283,7 @@ def run(**kwargs):

```python
TEMPLATE = '''
find-str --or '{unique_string}'
find-str '{unique_string}'
xref
function-start
unique
Expand All @@ -310,7 +310,7 @@ from fa.commands.set_type import set_type
from fa import fa_types

TEMPLATE = '''
find-str --or '{unique_string}'
find-str '{unique_string}'
xref
'''

Expand Down
71 changes: 40 additions & 31 deletions commands.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ Below is the list of available commands:
- [verify-operand](#verify-operand)
- [verify-ref](#verify-ref)
- [verify-segment](#verify-segment)
- [verify-single](#verify-single)
- [verify-str](#verify-str)
- [xref](#xref)
- [xrefs-to](#xrefs-to)
Expand Down Expand Up @@ -168,7 +169,7 @@ optional arguments:
```
## find-bytes
```
usage: find-bytes [-h] [--or] hex_str
usage: find-bytes [-h] hex_str
expands the result-set with the occurrences of the given bytes
Expand All @@ -177,22 +178,21 @@ EXAMPLE:
0x00000004: 05 06 07 08
results = []
-> find-bytes --or 01020304
-> find-bytes 01020304
result = [0]
-> find-bytes --or 05060708
-> find-bytes 05060708
results = [0, 4]
positional arguments:
hex_str
optional arguments:
-h, --help show this help message and exit
--or
```
## find-bytes-ida
```
usage: find-bytes-ida [-h] [--or] expression
usage: find-bytes-ida [-h] expression
expands the result-set with the occurrences of the given bytes
expression in "ida bytes syntax"
Expand All @@ -202,22 +202,21 @@ EXAMPLE:
0x00000004: 05 06 07 08
results = []
-> find-bytes-ida --or '01 02 03 04'
-> find-bytes-ida '01 02 03 04'
result = [0]
-> find-bytes-ida --or '05 06 ?? 08'
-> find-bytes-ida '05 06 ?? 08'
results = [0, 4]
positional arguments:
expression
optional arguments:
-h, --help show this help message and exit
--or
```
## find-immediate
```
usage: find-immediate [-h] [--or] expression
usage: find-immediate [-h] expression
expands the result-set with the occurrences of the given
immediate in "ida immediate syntax"
Expand All @@ -227,19 +226,18 @@ EXAMPLE:
0x00000004: add r0, #2 ; 0x1236
results = []
-> find-immediate --or 0x1236
-> find-immediate 0x1236
result = [4]
positional arguments:
expression
optional arguments:
-h, --help show this help message and exit
--or
```
## find-str
```
usage: find-str [-h] [--or] [--null-terminated] hex_str
usage: find-str [-h] [--null-terminated] hex_str
expands the result-set with the occurrences of the given
string
Expand All @@ -250,7 +248,7 @@ EXAMPLE:
0x00000008: 30 31 32 33 -> ASCII '0123'
results = []
-> find-str --or '0123'
-> find-str '0123'
result = [8]
Expand All @@ -259,12 +257,11 @@ positional arguments:
optional arguments:
-h, --help show this help message and exit
--or
--null-terminated
```
## function-end
```
usage: function-end [-h] [--not-unique]
usage: function-end [-h]
goto function's end
Expand All @@ -278,8 +275,7 @@ EXAMPLE:
result = [0xf0]
optional arguments:
-h, --help show this help message and exit
--not-unique
-h, --help show this help message and exit
```
## function-lines
```
Expand All @@ -305,7 +301,7 @@ optional arguments:
```
## function-start
```
usage: function-start [-h] [--not-unique]
usage: function-start [-h]
goto function's start
Expand All @@ -319,8 +315,7 @@ EXAMPLE:
result = [0]
optional arguments:
-h, --help show this help message and exit
--not-unique
-h, --help show this help message and exit
```
## goto-ref
```
Expand Down Expand Up @@ -351,7 +346,7 @@ EXAMPLE:
0x00000004: mov r0, r1
results = []
-> keystone-find-opcodes --bele --or KS_ARCH_ARM KS_MODE_ARM 'mov r0, r1;'
-> keystone-find-opcodes --bele KS_ARCH_ARM KS_MODE_ARM 'mov r0, r1;'
result = [4]
positional arguments:
Expand All @@ -376,7 +371,7 @@ EXAMPLE:
0x00000004: mov r0, r1
results = [0, 4]
-> keystone-verify-opcodes --bele --or KS_ARCH_ARM KS_MODE_ARM 'mov r0, r1'
-> keystone-verify-opcodes --bele KS_ARCH_ARM KS_MODE_ARM 'mov r0, r1'
result = [4]
positional arguments:
Expand Down Expand Up @@ -608,17 +603,12 @@ optional arguments:
```
usage: unique [-h]
verifies the result-list contains a single value
EXAMPLE #1:
results = [4, 12, 0, 8]
-> unique
result = []
make the resultset unique
EXAMPLE #2:
results = [4]
EXAMPLE:
results = [0, 4, 8, 8, 12]
-> unique
result = [4]
result = [0, 4, 8, 12]
optional arguments:
-h, --help show this help message and exit
Expand Down Expand Up @@ -740,6 +730,25 @@ EXAMPLE:
positional arguments:
name segment name
optional arguments:
-h, --help show this help message and exit
```
## verify-single
```
usage: verify-single [-h]
verifies the result-list contains a single value
EXAMPLE #1:
results = [4, 12, 0, 8]
-> unique
result = []
EXAMPLE #2:
results = [4]
-> unique
result = [4]
optional arguments:
-h, --help show this help message and exit
```
Expand Down
1 change: 0 additions & 1 deletion fa/commands/add_offset_range.py
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ def get_parser():
return p


@utils.yield_unique
def add_offset_range(addresses, start, end, step):
for ea in addresses:
for i in range(start, end, step):
Expand Down
8 changes: 4 additions & 4 deletions fa/commands/alias
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
ppc32-big-find-all = keystone-find-opcodes --or KS_ARCH_PPC KS_MODE_BIG_ENDIAN|KS_MODE_PPC32
ppc32-find-all = keystone-find-opcodes --bele --or KS_ARCH_PPC KS_MODE_PPC32
ppc32-big-find-all = keystone-find-opcodes KS_ARCH_PPC KS_MODE_BIG_ENDIAN|KS_MODE_PPC32
ppc32-find-all = keystone-find-opcodes --bele KS_ARCH_PPC KS_MODE_PPC32
ppc32-big-verify = keystone-verify-opcodes KS_ARCH_PPC KS_MODE_BIG_ENDIAN|KS_MODE_PPC32
ppc32-verify = keystone-verify-opcodes --bele KS_ARCH_PPC KS_MODE_PPC32
arm-find-all = keystone-find-opcodes --bele --or KS_ARCH_ARM KS_MODE_ARM
thumb-find-all = keystone-find-opcodes --bele --or KS_ARCH_ARM KS_MODE_THUMB
arm-find-all = keystone-find-opcodes --bele KS_ARCH_ARM KS_MODE_ARM
thumb-find-all = keystone-find-opcodes --bele KS_ARCH_ARM KS_MODE_THUMB
arm-verify = keystone-verify-opcodes --bele KS_ARCH_ARM KS_MODE_ARM
find-imm = find-immediate
16 changes: 3 additions & 13 deletions fa/commands/find_bytes.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
from argparse import RawTextHelpFormatter
from collections import OrderedDict
import binascii

from fa import utils
Expand All @@ -11,10 +10,10 @@
0x00000004: 05 06 07 08
results = []
-> find-bytes --or 01020304
-> find-bytes 01020304
result = [0]
-> find-bytes --or 05060708
-> find-bytes 05060708
results = [0, 4]
'''

Expand All @@ -23,24 +22,15 @@ def get_parser():
p = utils.ArgumentParserNoExit('find-bytes',
description=DESCRIPTION,
formatter_class=RawTextHelpFormatter)
p.add_argument('--or', action='store_true')
p.add_argument('hex_str')
return p


@utils.yield_unique
def find_bytes(hex_str, segments=None):
needle = binascii.unhexlify(''.join(hex_str.split(' ')))
return utils.find_raw(needle, segments=segments)


def run(segments, args, addresses, interpreter=None, **kwargs):
results = list(find_bytes(args.hex_str, segments=segments))

retval = set(addresses)
if getattr(args, 'or'):
retval.update(results)
else:
raise ValueError("must specify --or option")

return list(OrderedDict.fromkeys(retval))
return addresses + results
16 changes: 3 additions & 13 deletions fa/commands/find_bytes_ida.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
from argparse import RawTextHelpFormatter
from collections import OrderedDict

from fa import utils, context

Expand All @@ -11,10 +10,10 @@
0x00000004: 05 06 07 08
results = []
-> find-bytes-ida --or '01 02 03 04'
-> find-bytes-ida '01 02 03 04'
result = [0]
-> find-bytes-ida --or '05 06 ?? 08'
-> find-bytes-ida '05 06 ?? 08'
results = [0, 4]
'''

Expand All @@ -23,25 +22,16 @@ def get_parser():
p = utils.ArgumentParserNoExit('find-bytes-ida',
description=DESCRIPTION,
formatter_class=RawTextHelpFormatter)
p.add_argument('--or', action='store_true')
p.add_argument('expression')
return p


@context.ida_context
@utils.yield_unique
def find_bytes_ida(expression, segments=None):
for address in utils.ida_find_all(expression):
yield address


def run(segments, args, addresses, interpreter=None, **kwargs):
results = find_bytes_ida(args.expression)

retval = set(addresses)
if getattr(args, 'or'):
retval.update(results)
else:
raise ValueError("must specify --or option")

return list(OrderedDict.fromkeys(retval))
return addresses + results
Loading

0 comments on commit e52de65

Please sign in to comment.