Package IDAscope :: Package idascope :: Package core :: Package structures :: Module AritlogBasicBlock
[hide private]
[frames] | no frames]

Source Code for Module IDAscope.idascope.core.structures.AritlogBasicBlock

  1  #!/usr/bin/python 
  2  ######################################################################## 
  3  # Copyright (c) 2012 
  4  # Daniel Plohmann <daniel.plohmann<at>gmail<dot>com> 
  5  # Alexander Hanel <alexander.hanel<at>gmail<dot>com> 
  6  # All rights reserved. 
  7  ######################################################################## 
  8  # 
  9  #  This file is part of IDAscope 
 10  # 
 11  #  IDAscope is free software: you can redistribute it and/or modify it 
 12  #  under the terms of the GNU General Public License as published by 
 13  #  the Free Software Foundation, either version 3 of the License, or 
 14  #  (at your option) any later version. 
 15  # 
 16  #  This program is distributed in the hope that it will be useful, but 
 17  #  WITHOUT ANY WARRANTY; without even the implied warranty of 
 18  #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU 
 19  #  General Public License for more details. 
 20  # 
 21  #  You should have received a copy of the GNU General Public License 
 22  #  along with this program.  If not, see 
 23  #  <http://www.gnu.org/licenses/>. 
 24  # 
 25  ######################################################################## 
 26   
 27   
28 -class AritlogBasicBlock():
29 """ 30 This class is an information container for the arithmetic / logic heuristic of the 31 crypto identifier 32 """ 33
34 - def __init__(self, start_ea, end_ea):
35 self.arith_log_instructions = [ 36 "aaa", 37 "aad", 38 "aam", 39 "aas", 40 "adc", 41 "add", 42 "and", 43 "daa", 44 "cdq" 45 "das", 46 "dec", 47 "div", 48 "imul", 49 "inc", 50 "neg", 51 "not", 52 "or", 53 "rcl", 54 "rcr", 55 "rol", 56 "ror", 57 "sal", 58 "salc", 59 "sar", 60 "sbb", 61 "shl", 62 "shld", 63 "shr", 64 "shrd", 65 "sub", 66 "test", 67 "xadd", 68 "xor", 69 ] 70 self.self_nullifying_instructions = ["xor", "sbb", "sub"] 71 self.start_ea = start_ea 72 self.end_ea = end_ea 73 self.num_instructions = 0 74 self.num_log_arit_instructions = 0 75 self.num_zeroing_instructions = 0 76 self.num_calls_in_function = 0 77 self.aritlog_rating = -1 78 self.nonzeroing_aritlog_rating = -1
79
80 - def get_aritlog_rating(self, is_nonzeroing_rating=False):
81 """ 82 Calculates and returns the rating for this basic block 83 @param is_nonzeroing_rating: determines whether zeroing instructions like xor eax, eax 84 shall be taken into account or not. 85 @type: is_nonzeroing_rating: boolean 86 @return: the rating for this basic block 87 """ 88 try: 89 if is_nonzeroing_rating: 90 self.nonzeroing_aritlog_rating = 1.0 * (self.num_log_arit_instructions - \ 91 self.num_zeroing_instructions) / self.num_instructions 92 return self.nonzeroing_aritlog_rating 93 else: 94 self.aritlog_rating = 1.0 * self.num_log_arit_instructions / self.num_instructions 95 return self.aritlog_rating 96 except ZeroDivisionError: 97 return 0
98
99 - def update_instruction_count(self, instruction, has_identical_operands):
100 """ 101 Update the instruction count for this basic block. 102 @param instruction: The mnemonic for a instruction of this block, as returned by IDA's I{GetMnem()}' 103 @type: instruction: str 104 @param has_identical_operands: determines if this instruction has two identical operands. Important for 105 deciding whether the instruction zeroes a register or not 106 @type: has_identical_operands: boolean 107 """ 108 if instruction in self.arith_log_instructions: 109 self.num_log_arit_instructions += 1 110 if instruction in self.self_nullifying_instructions and has_identical_operands: 111 self.num_zeroing_instructions += 1 112 self.num_instructions += 1
113
114 - def __str__(self):
115 """ 116 Convenience function. 117 @return: a nice string representation for this object 118 """ 119 return "0x%x - 0x%x (%d), aritlog: %02.2f%% (%02.2f%%)" % (self.start_ea, self.end_ea, \ 120 self.num_instructions, self.aritlog_rating * 100.0, self.nonzeroing_aritlog_rating * 100.0)
121
122 - def __lt__(self, other):
123 """ 124 Convenience function for ordering. 125 @param other: another I{AritLogBasicBlock} 126 @type other: I{AritLogBasicBlock} 127 @return: less if rating is less than of the other 128 """ 129 return self.aritlog_rating() < other.aritlog_rating()
130