Class: Relyze::ExecutableFileModel

Inherits:
FileModel
  • Object
show all
Defined in:
../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb

Defined Under Namespace

Classes: BasicBlock, CodeBlock, DataBlock, DataType, DataTypeFactory, FunctionDataType, Instruction, PointerDataType, Reference, Segment, StructureDataType

Instance Attribute Summary (collapse)

Attributes inherited from FileModel

#buffer

Instance Method Summary (collapse)

Methods inherited from FileModel

#abort, #add_auxiliary_text, #add_information, #current_file_name, #current_file_path, #file_size, #file_type, #get_entropy, #information, #origional_file_name, #origional_file_path, #read_buffer, #realloc_buffer, #remove_information, #restart, #run_plugin, #structure, #synchronize_read, #synchronize_write, #to_s, #write_buffer

Constructor Details

- (ExecutableFileModel) initialize

Returns a new instance of ExecutableFileModel



1576
1577
1578
1579
1580
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1576

def initialize
    super
    @data_type_factory = nil
    @auto_analyze      = true
end

Instance Attribute Details

- (Object) auto_analyze

Gets and Sets whether auto analysis is performed during operation that modify the executable model. If set to false, auto analysis is disabled. You can manually trigger auto analysis by calling the #analyze method at any time.



1572
1573
1574
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1572

def auto_analyze
  @auto_analyze
end

- (Object) data_type_factory (readonly) Also known as: dtf

Gets the DataTypeFactory for this model.



1567
1568
1569
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1567

def data_type_factory
  @data_type_factory
end

Instance Method Details

- (true, false) add_bookmark(rva, description)

Add a bookmark at a given RVA.

Parameters:

  • rva (FixNum)

    Add a bookmark at this RVA.

  • description (String)

    The bookmarks description.

Returns:

  • (true, false)


1781
1782
1783
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1781

def add_bookmark( rva, description )
    return false
end

- (true, false) add_comment(rva, comment)

Add a comment at a given RVA.

Parameters:

  • rva (FixNum)

    Add the comment at this RVA.

  • comment (String)

    The comment to add.

Returns:

  • (true, false)


1739
1740
1741
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1739

def add_comment( rva, comment )
    return false
end

- (Relyze::ExecutableFileModel::Segment?) add_segment(name, rva, initialized_length, uninitialized_length, readable, writeable, executable)

Add a new segment to this model. New segments cannot overlap existing segments.

Examples:

Create a new segment, write some data and convert it to code.

cm.synchronize_analyze do
    segment = cm.add_segment(
        "test",
        cm.last_segment.last_rva + 4096,
        4096,
        1024,
        true,
        true,
        true
    )

    segment.write_buffer( 0, "\x90\xCC" * 32 )

    block = cm.block( segment.rva )

    block.to_code
end

Parameters:

  • name (String)

    The segments name.

  • rva (FixNum)

    The segments base RVA.

  • initialized_length (FixNum)

    The segment initialized byte length.

  • uninitialized_length (FixNum)

    The segment uninitialized byte length.

  • readable (true, false)

    Whether this segment holds readable memory.

  • writeable (true, false)

    Whether this segment holds writeable memory.

  • executable (true, false)

    Whether this segment holds executable memory.

Returns:



1893
1894
1895
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1893

def add_segment( name, rva, initialized_length, uninitialized_length, readable, writeable, executable )
    return nil
end

- (FixNum?) address2rva(address)

Convert an address to an RVA, where address is the current address mode selected by the user, e.g. RVA mode, VA mode or Rebased VA mode.

Parameters:

  • address (FixNum)

    The address to convert.

Returns:

  • (FixNum, nil)

    The converted RVA or nil on failure.



1705
1706
1707
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1705

def address2rva( address )
    return nil
end

- (true, false) analysis_queue_push(queue, rva)

Add an address to the analysis queue for processing.

Examples:

cm.synchronize_analyze do
    entry_rva = cm.va2rva( cm.structure['Ident']['Header']['entry'].value )
    cm.analysis_queue_push( :code,     entry_rva )
    cm.analysis_queue_push( :function, entry_rva )
end

Parameters:

  • queue (Symbol)

    The queue to add to, :code, :data, :function, :jumptable, :indirectcall.

  • rva (FixNum)

    The RVA to add to the queue.

Returns:

  • (true, false)


2052
2053
2054
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2052

def analysis_queue_push( queue, rva )
    return false
end

- (true, false) analyze

Run the automatic analysis engine against any outstanding operations.

Note 1: Analysis cannot run while another thread holds either a read or write lock on this model, and will block until these locks are released.

Note 2: If the current thread holds either a read or write lock, then analysis cannot be multi threaded and will be forced to be single threaded. In this scenario, multi threaded analysis would not be possible as worker threads would be unable to to ever acquire the read or write locks as needed, as this thread cannot release the lock it holds until analysis completes.

Returns:

  • (true, false)


2036
2037
2038
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2036

def analyze
    return false
end

- (Symbol) arch

Get this models architecture.

Returns:

  • (Symbol)

    This models architecture, either :x86, :x64 or :arm.



1624
1625
1626
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1624

def arch
    return nil
end

- (true, false) assemble(rva, source, padd = true, arch = nil, mode = nil)

Edit an Instruction from a block which starts at a specific RVA location.

Parameters:

  • rva (FixNum)

    The RVA location of the start of an instruction.

  • source (String)

    The source to assemble

  • padd (true, false) (defaults to: true)

    If required, add padding bytes equivalent to a NOP instruction, to align to the next instruction boundary.

  • arch (Symbol, NilClass) (defaults to: nil)

    The architecture to assemble, either :x86, :x64 or :arm. If arch is nil, default to the models arch.

  • mode (Symbol, NilClass) (defaults to: nil)

    The instruction mode to use, default to nil. If arch is :arm, mode can be :thumb. If arch is nil, default to the models current processor mode.

Returns:

  • (true, false)


2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2140

def assemble( rva, source, padd=true, arch=nil, mode=nil )
    
    start_block = self.block( rva )
    if( start_block.nil? )
        return false
    end
    
    if( not start_block.code? )
        return false
    end
    
    arch = self.arch if arch.nil?
    
    mode = self.get_processor_mode( rva ) if mode.nil?
    
    resolver = lambda do | name |
    
        resolved_rva = self.name2rva( name )
        
        if( not resolved_rva.nil? )
            return self.rva2va( resolved_rva )
        end
        
        return nil
    end 
    
    buffer = Relyze::ExecutableFileModel::Instruction.assemble( source, arch, self.rva2va( rva ), mode, resolver )
    
    if( buffer.nil? )
        return false
    end
    
    pre_padd_buffer = ''
    
    if( padd )
        
        nearest_rva = start_block.nearest_boundary( rva )
    
        if( nearest_rva < rva )
        
            padd_length = rva - nearest_rva
            
            padd_buffer = Relyze::ExecutableFileModel::Instruction.assemble( 'nop', arch, self.rva2va( rva ), mode )
            
            if( padd_buffer.nil? )
                return false
            end
            
            pre_padd_buffer = padd_buffer * ( padd_length / padd_buffer.length )
            
            rva = nearest_rva
        end
    end
    
    post_padd_buffer = ''
    
    if( padd )

        last_rva = rva + pre_padd_buffer.length + buffer.length
        
        last_block = self.block( last_rva )
        
        if( not last_block.nil? and last_block.code? and last_rva != last_block.nearest_boundary( last_rva )  )

            next_rva = last_block.next_boundary( last_rva )
            
            if( next_rva > last_rva )
            
                padd_length = next_rva - last_rva

                padd_buffer = Relyze::ExecutableFileModel::Instruction.assemble( 'nop', arch, self.rva2va( rva ), mode )
                
                if( padd_buffer.nil? )
                    return false
                end
                
                post_padd_buffer = padd_buffer * ( padd_length / padd_buffer.length )
            end
        end
    end
    
    off = start_block.segment.rva2offset( rva )
    if( off.nil? )
        return false
    end
    
    buffer = pre_padd_buffer + buffer + post_padd_buffer
    
    if( start_block.segment.write_buffer( off, buffer ).nil? )
        return false
    end
    
    end_rva = rva + buffer.length
    
    self.synchronize_analyze do
    
        while( true )
        
            start_block = start_block.reprocess
            
            break if start_block.nil? 
            
            start_block = start_block.adjacent
            
            break if start_block.nil? 
                
            break if start_block.rva + start_block.length >= end_rva
            
        end
    end
    
    return true
end

- (FixNum) bits

Get this model architectures bit width.

Returns:

  • (FixNum)

    The number of bits in this architecture, either 32 or 64.



1610
1611
1612
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1610

def bits
    return 0
end

- (Relyze::ExecutableFileModel::BasicBlock?) block(rva)

Get the BasicBlock which contains this RVA, if any.

Parameters:

  • rva (FixNum)

    An RVA location.

Returns:



1928
1929
1930
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1928

def block( rva )
    return nil
end

- (Object) blocks {|basic_block| ... }

Get every BasicBlock in this model.

Yields:

  • (basic_block)

    yields the basic_block to the block.

Yield Parameters:



1920
1921
1922
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1920

def blocks
    return []
end

- (true, false) bookmark?(rva)

Check if a bookmark exists at a given RVA.

Parameters:

  • rva (FixNum)

    Check for a bookmark at this RVA.

Returns:

  • (true, false)


1772
1773
1774
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1772

def bookmark?( rva )
    return false
end

- (Object) bookmarks {|rva, description| ... }

Get every bookmark in this model.

Yields:

  • (rva, description)

    yields the RVA and description to the block.

Yield Parameters:

  • rva (FixNum)

    The bookmarks RVA.

  • description (String)

    The bookmarks description.



1764
1765
1766
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1764

def bookmarks
    return []
end

- (true, false) comment?(rva)

Check if a comment exists at a given RVA.

Parameters:

  • rva (FixNum)

    Check for a comment at this RVA.

Returns:

  • (true, false)


1730
1731
1732
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1730

def comment?( rva )
    return false
end

- (Object) comments {|rva, description| ... }

Get every user comment in this model.

Yields:

  • (rva, description)

    yields the RVA and description to the block.

Yield Parameters:

  • rva (FixNum)

    The comments RVA.

  • description (String)

    The comments description.



1722
1723
1724
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1722

def comments
    return []
end

- (true, false) delete_function(function)

Parameters:

Returns:

  • (true, false)


1953
1954
1955
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1953

def delete_function( function )
    return false
end

- (true, false) delete_segment(segment)

Delete a segment from this model.

Parameters:

Returns:

  • (true, false)


1901
1902
1903
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1901

def delete_segment( segment )
    return false
end

- (Relyze::DiffResults::DiffModelResult?) diff(model)

Perform a differential analysis of this model against another model.

Parameters:

Returns:



2060
2061
2062
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2060

def diff( model )
    nil
end

- (Object) endian

Get this models endianness.

return [Symbol] This models endianness, either :little or :big.



1617
1618
1619
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1617

def endian
    return nil
end

- (FixNum) entry_point

Get the RVA of this models initial entry point.

Returns:

  • (FixNum)

    The entry point RVA.



1655
1656
1657
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1655

def entry_point
    return nil
end

- (Object) exports {|rva, name| ... }

Get every export in this model.

Yields:

  • (rva, name)

    yields the rva and name to the block.

Yield Parameters:

  • rva (FixNum)

    The exports RVA.

  • name (String)

    The exports name.



1807
1808
1809
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1807

def exports
    return []
end

- (Relyze::ExecutableFileModel::Segment) first_segment

Get the first segment in this model.

Returns:



1856
1857
1858
1859
1860
1861
1862
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1856

def first_segment
    s = self.segments.sort do | a, b | 
        a.rva <=> b.rva
    end
    
    return s.first
end

- (Relyze::ExecutableFileModel::FunctionDataType?) function(rva)

Get a FunctionDataType in this model at a specific RVA.

Parameters:

  • rva (FixNum)

    The RVA of the root block in a function.

Returns:



1945
1946
1947
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1945

def function( rva )
    return nil
end

- (Object) functions(rva = nil) {|function| ... }

Get every FunctionDataType in this model.

Parameters:

  • rva (FixNum, nil) (defaults to: nil)

    If an RVA is given, then we get every function in this model which contains this RVA. If no RVA is given, then we get every function in this model.

Yields:

  • (function)

    yields the function to the block.

Yield Parameters:



1937
1938
1939
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1937

def functions( rva=nil )
    return []
end

- (String?) get_comment(rva)

Get a comment at a given RVA.

Parameters:

  • rva (FixNum)

    Get the comment at this RVA.

Returns:

  • (String, nil)

    The comment or nil if none exists.



1755
1756
1757
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1755

def get_comment( rva )
    return nil
end

- (Symbol, NilClass) get_processor_mode(rva)

Get the current processor mode.

Parameters:

  • rva (FixNum)

    The RVA to to get the current processor mode for.

Returns:

  • (Symbol, NilClass)

    The current processor mode. If arch is :arm, mode can be either :arm or :thumb.



1639
1640
1641
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1639

def get_processor_mode( rva )
    return nil
end

- (Object) imports {|rva, module_name, import_name| ... }

Get every import in this model.

Yields:

  • (rva, module_name, import_name)

    yields the rva, module_name and import_name to the block.

Yield Parameters:

  • rva (FixNum)

    The imports RVA.

  • module_name (String)

    The imports module name.

  • import_name (String)

    The imports name.



1817
1818
1819
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1817

def imports
    return []
end

- (Relyze::ExecutableFileModel::Segment) last_segment

Get the last segment in this model.

Returns:



1845
1846
1847
1848
1849
1850
1851
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1845

def last_segment
    s = self.segments.sort do | a, b | 
        a.rva <=> b.rva
    end
    
    return s.last
end

- (Object) lines {|rva, object_file, source_file, source_line, length| ... }

Get every symbol line for this model, if any.

Yields:

  • (rva, object_file, source_file, source_line, length)

    yields the rva, object_file, source_file, source_line and length to the block.

Yield Parameters:

  • rva (FixNum)

    This lines RVA.

  • object_file (String)

    This lines object file.

  • source_file (String)

    This lines source file.

  • source_line (FixNum)

    This lines source line number.

  • length (FixNum)

    This lines byte length.



1912
1913
1914
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1912

def lines
    return []
end

- (FixNum?) name2rva(name)

Resolve the name of a location in the model to its RVA.

Parameters:

  • name (String)

    The name of a block in the model.

Returns:

  • (FixNum, nil)

    The resolved RVA or nil on failure.



1713
1714
1715
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1713

def name2rva( name )
    return nil
end

- (FixNum?) offset2rva(offset)

Convert a file offset to an RVA or nil if not a valid RVA.

Parameters:

  • offset (FixNum)

    The file offset to convert.

Returns:

  • (FixNum, nil)

    The converted RVA or nil on failure.



1671
1672
1673
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1671

def offset2rva( offset )
    return nil
end

- (true, false) remove_bookmark(rva)

Remove a bookmark at a given RVA.

Parameters:

  • rva (FixNum)

    Remove a bookmark at this RVA.

Returns:

  • (true, false)


1789
1790
1791
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1789

def remove_bookmark( rva )
    return false
end

- (true, false) remove_comment(rva)

Remove a comment at a given RVA.

Parameters:

  • rva (FixNum)

    Remove the comment at this RVA.

Returns:

  • (true, false)


1747
1748
1749
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1747

def remove_comment( rva )
    return false
end

- (FixNum?) rva2address(rva)

Convert an RVA to an address, where address is the current address mode selected by the user, e.g. RVA mode, VA mode or Rebased VA mode.

Parameters:

  • rva (FixNum)

    The RVA to convert.

Returns:

  • (FixNum, nil)

    The converted address or nil on failure.



1696
1697
1698
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1696

def rva2address( rva )
    return nil
end

- (FixNum?) rva2offset(rva)

Convert an RVA to a file offset or nil if not a valid file offset.

Parameters:

  • rva (FixNum)

    The RVA to convert.

Returns:

  • (FixNum, nil)

    The converted file offset or nil on failure.



1663
1664
1665
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1663

def rva2offset( rva )
    return nil
end

- (FixNum?) rva2va(rva)

Convert an RVA to a virtual address (VA) or nil if not a valid virtual address.

Parameters:

  • rva (FixNum)

    The RVA to convert.

Returns:

  • (FixNum, nil)

    The converted virtual address or nil on failure.



1679
1680
1681
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1679

def rva2va( rva )
    return nil
end

- (Relyze::ExecutableFileModel::Segment?) segment(rva)

Get the Segment which contains this RVA, if any.

Parameters:

  • rva (FixNum)

    The RVA to whose segment we will return.

Returns:



1833
1834
1835
1836
1837
1838
1839
1840
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1833

def segment( rva )
    self.segments do | s |
        if( rva >= s.rva and rva < s.last_rva )
            return s
        end
    end
    return nil
end

- (Object) segments {|segment| ... }

Get every segment in this model. Note, they are not yielded in order or their location.

Yields:

  • (segment)

    yields the segment to the block.

Yield Parameters:



1825
1826
1827
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1825

def segments
    return []
end

- (Trueclass, FalseClass) set_function_prototype(rva, prototype, name = nil)

Create a function at this RVA or edit an existing function prototype.

Examples:

cm.set_function_prototype( cm.entry_point, "bool __stdcall foo( int count, char * buff )", "foo" )
@relyze.update_gui

Parameters:

Returns:



1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1967

def set_function_prototype( rva, prototype, name=nil )
    return self.synchronize_analyze do
        # Generate the FunctionDataType from the prototype string. Do this 
        # first do we can fail gracefully if we fail to create the type.
        type = self.data_type_factory.get( prototype )    
        if( type.nil? )
            break false
        end
        
        # Pull out the block containing this rva (may be data or code)
        blk = self.block( rva )
        if( blk.nil? )
            break false
        end
        
        # Split the block if we are creating the function inside the current block
        if( blk.rva != rva )
            blk = blk.split( rva, :code )
            if( blk.nil? )
                break false
            end
        else
            # If it is a data block, convert it to code
            if( blk.type == :data )
                blk = blk.to_code
                if( blk.nil? )
                    break false
                end
            end
        end
        
        blk.datatype = type
        
        if( not name.nil? )
            blk.name = name 
        end
    end
end

- (Object) set_jumptable(jump_rva, table_rva, table_count, table_type, entry_width, entry_base = nil)

Edit a jump table.

Examples:

cm.synchronize_analyze do
    cm.set_jumptable( 0xEB02, 0xEB6A, 8, :va, 32 )
end
@relyze.update_gui     

Parameters:

  • jump_rva (FixNum)

    The RVA of the indirect jump instruction.

  • table_rva (FixNum)

    The RVA of the table containing the jump locations.

  • table_count (FixNum)

    The number of locations in the jump table.

  • table_type (Symbol)

    The type entries in the jump table, either :va, :rva, :signedoffsetfromtable, :unsignedoffsetfromtable, :signedoffsetfromtabledoubled, :unsignedoffsetfromtabledoubled, :offsetfromjump, :signedoffsetfromcustomentrybase or :unsignedoffsetfromcustomentrybase.

  • entry_width (FixNum)

    The width of the entries in the jump table, either 64, 32, 16 or 8.

  • entry_base (nil, FixNum) (defaults to: nil)

    A custom entry base RVA for table_type of :signedoffsetfromcustomentrybase or :unsignedoffsetfromcustomentrybase.



2020
2021
2022
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2020

def set_jumptable( jump_rva, table_rva, table_count, table_type, entry_width, entry_base=nil )
    return false
end

- (true, false) set_processor_mode(rva, mode)

Set the current processor mode. Changing the mode will reprocess any effected code blocks.

Parameters:

  • rva (FixNum)

    The RVA to to set the current processor mode for.

  • mode (Symbol)

    The mode to to set. If arch is :arm, mode can be either :arm or :thumb.

Returns:

  • (true, false)


1648
1649
1650
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1648

def set_processor_mode( rva, mode )
    return false
end

- (Object) strings {|rva, value| ... }

Get every string in this model.

Yields:

  • (rva, value)

    yields the rva and value to the block.

Yield Parameters:

  • rva (FixNum)

    The strings RVA.

  • value (String)

    The strings value.



1798
1799
1800
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1798

def strings
    return []
end

- (Object) synchronize_analyze(&block)

call a block while holding the models write lock and disabling auto analysis. After calling the block, auto analysis is reset and the #analyze method is called.



1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1584

def synchronize_analyze( &block )
    result = self.synchronize_write do
        orig_auto_analyze = self.auto_analyze
        self.auto_analyze = false
        result = block.call
        self.auto_analyze = orig_auto_analyze
        result
    end
    # Call analyze _after_ synchronize_write so we can take advantage of multi threaded 
    # analysis. If we were to call analyze while holding the write lock, we would force 
    # single threaded analysis (as worker threads would never be able to acquire the 
    # model lock).
    self.analyze
    return result
end

- (Symbol) system_mode

Get this models system mode.

Returns:

  • (Symbol)

    This models architecture, either :user or :kernel.



1631
1632
1633
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1631

def system_mode
    return nil
end

- (Relyze::Graph::DirectedGraph) to_graph(display = {})

Generate a Graph::DirectedGraph object for this models call graph.

Examples:

# generate this models function call graph
graph = cm.to_graph
# post process the graph...
graph.nodes.each do | node |
    # set the nodes data to the function name so the nodes 
    # text content in the GUI becomes just the function name.
    node.data = node.data.name
end
# perform a circular layout based on the nodes in degree
graph.layout( { :layout => :circular, :order => :indegree } )
# display this graph in the GUI so user can interact with it...
@relyze.tab_display_graph( graph )

Parameters:

  • display (Hash) (defaults to: {})

    An optional hash of display options to pass to the graph.

Returns:



2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 2082

def to_graph( display={} )

    graph = Relyze::Graph::DirectedGraph.new(
        "CG",
        {
            :node_shape            => :circle,
            :font_justify          => :center,
            :edge_color            => '#16A085',
            :node_background_color => '#3498DB',
        }.merge!( display )
    )

    self.functions do | function |

        root_block = function.block( function.rva )

        root_block.references( :in ) do | ref |

            next if not ref.control_flow?

            next if ref.target_rva != root_block.rva
            
            n1 = graph.find_or_create_node( function )

            n1.display[:rva] = function.rva
            
            if( self.entry_point == function.rva )
                graph.root = n1
            end
                
            self.functions( ref.owner_rva ) do | caller_function |
            
                n2 = graph.find_or_create_node( caller_function )

                n2.display[:rva] = caller_function.rva
                
                if( self.entry_point == caller_function.rva )
                    graph.root = n2
                end
                
                if( not n2.edge?( n1 ) )
                    edge = graph.create_edge( n2, n1 )
                end
            end
        end
    end
    
    return graph
end

- (Symbol) type

Get the type of ExecutableFileModel

Returns:

  • (Symbol)

    This models type, either :elf, :pe, :coff or :flat.



1603
1604
1605
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1603

def type
    return nil
end

- (FixNum?) va2rva(va)

Convert an VA to an RVA or nil if not a valid RVA.

Parameters:

  • va (FixNum)

    The VA to convert.

Returns:

  • (FixNum, nil)

    The converted RVA nil on failure.



1687
1688
1689
# File '../Source/Plugin/RubyLib/relyze/core/executable_file_model.rb', line 1687

def va2rva( va )
    return nil
end