Class: Relyze::ExecutableFileModel

Inherits:
FileModel
  • Object
show all
Defined in:
C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb

Defined Under Namespace

Classes: BasicBlock, CodeBlock, DataBlock, DataType, DataTypeFactory, FunctionDataType, Instruction, PointerDataType, Reference, Segment, StructureDataType

Instance Attribute Summary collapse

Attributes inherited from FileModel

#buffer

Instance Method Summary collapse

Methods inherited from FileModel

#abort, #add_auxiliary_text, #add_entropy_marker, #add_information, #current_file_name, #current_file_path, #entropy_markers, #file_size, #file_type, #get_entropy, #information, #origional_file_name, #origional_file_path, #read_buffer, #realloc_buffer, #remove_information, #restart, #run_plugin, #structure, #synchronize_read, #synchronize_write, #to_s, #write_buffer

Constructor Details

#initializeExecutableFileModel

Returns a new instance of ExecutableFileModel.



1627
1628
1629
1630
1631
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1627

def initialize
    super
    @data_type_factory = nil
    @auto_analyze      = true
end

Instance Attribute Details

#auto_analyzeObject

Gets and Sets whether auto analysis is performed during operation that modify the executable model. If set to false, auto analysis is disabled. You can manually trigger auto analysis by calling the #analyze method at any time.



1623
1624
1625
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1623

def auto_analyze
  @auto_analyze
end

#data_type_factoryObject (readonly) Also known as: dtf

Gets the DataTypeFactory for this model.



1618
1619
1620
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1618

def data_type_factory
  @data_type_factory
end

Instance Method Details

#add_bookmark(rva, description) ⇒ true, false

Add a bookmark at a given RVA.

Parameters:

  • rva (Integer)

    Add a bookmark at this RVA.

  • description (String)

    The bookmarks description.

Returns:

  • (true, false)


1849
1850
1851
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1849

def add_bookmark( rva, description )
    return false
end

#add_comment(rva, comment) ⇒ true, false

Add a comment at a given RVA.

Parameters:

  • rva (Integer)

    Add the comment at this RVA.

  • comment (String)

    The comment to add.

Returns:

  • (true, false)


1790
1791
1792
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1790

def add_comment( rva, comment )
    return false
end

#add_segment(name, rva, initialized_length, uninitialized_length, readable, writeable, executable) ⇒ Relyze::ExecutableFileModel::Segment?

Add a new segment to this model. New segments cannot overlap existing segments.

Examples:

Create a new segment, write some data and convert it to code.

cm.synchronize_analyze do
    segment = cm.add_segment(
        "test",
        cm.last_segment.last_rva + 4096,
        4096,
        1024,
        true,
        true,
        true
    )

    segment.write_buffer( 0, "\x90\xCC" * 32 )

    block = cm.block( segment.rva )

    block.to_code
end

Parameters:

  • name (String)

    The segments name.

  • rva (Integer)

    The segments base RVA.

  • initialized_length (Integer)

    The segment initialized byte length.

  • uninitialized_length (Integer)

    The segment uninitialized byte length.

  • readable (true, false)

    Whether this segment holds readable memory.

  • writeable (true, false)

    Whether this segment holds writeable memory.

  • executable (true, false)

    Whether this segment holds executable memory.

Returns:



1961
1962
1963
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1961

def add_segment( name, rva, initialized_length, uninitialized_length, readable, writeable, executable )
    return nil
end

#address2rva(address) ⇒ Integer?

Convert an address to an RVA, where address is the current address mode selected by the user, e.g. RVA mode, VA mode or Rebased VA mode.

Parameters:

  • address (Integer)

    The address to convert.

Returns:

  • (Integer, nil)

    The converted RVA or nil on failure.



1756
1757
1758
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1756

def address2rva( address )
    return nil
end

#analysis_queue_push(queue, rva, name = nil, data_type = nil) ⇒ true, false

Add an address to the analysis queue for processing.

Examples:

cm.synchronize_analyze do
    entry_rva = cm.va2rva( cm.structure['Ident']['Header']['entry'].value )
    cm.analysis_queue_push( :function, entry_rva )
end

Parameters:

  • queue (Symbol)

    The queue to add to, :code, :data, :function, :jumptable, :indirectcall.

  • rva (Integer)

    The RVA to add to the queue.

  • name (nil, String) (defaults to: nil)

    Set the name of the BasicBlock at the given RVA.

  • data_type (nil, Relyze::ExecutableFileModel::DataType) (defaults to: nil)

    Set the data type of the BasicBlock at the given RVA.

Returns:

  • (true, false)


2125
2126
2127
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2125

def analysis_queue_push( queue, rva, name=nil, data_type=nil )
    return false
end

#analyzetrue, false

Run the automatic analysis engine against any outstanding operations.

Note 1: Analysis cannot run while another thread holds either a read or write lock on this model, and will block until these locks are released.

Note 2: If the current thread holds either a read or write lock, then analysis cannot be multi threaded and will be forced to be single threaded. In this scenario, multi threaded analysis would not be possible as worker threads would be unable to to ever acquire the read or write locks as needed, as this thread cannot release the lock it holds until analysis completes.

Returns:

  • (true, false)


2108
2109
2110
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2108

def analyze
    return false
end

#archSymbol

Get this models architecture.

Returns:

  • (Symbol)

    This models architecture, either :x86, :x64, :arm or :arm64.



1675
1676
1677
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1675

def arch
    return nil
end

#assemble(rva, source, padd = true, arch = nil, mode = nil) ⇒ true, false

Edit an Instruction from a block which starts at a specific RVA location.

Parameters:

  • rva (Integer)

    The RVA location of the start of an instruction.

  • source (String)

    The source to assemble

  • padd (true, false) (defaults to: true)

    If required, add padding bytes equivalent to a NOP instruction, to align to the next instruction boundary.

  • arch (Symbol, NilClass) (defaults to: nil)

    The architecture to assemble, either :x86, :x64, :arm or :arm64. If arch is nil, default to the models arch.

  • mode (Symbol, NilClass) (defaults to: nil)

    The instruction mode to use, default to nil. If arch is :arm, mode can be :thumb. If arch is nil, default to the models current processor mode.

Returns:

  • (true, false)


2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2218

def assemble( rva, source, padd=true, arch=nil, mode=nil )
    
    start_block = self.block( rva )
    if( start_block.nil? )
        return false
    end
    
    if( not start_block.code? )
        return false
    end
    
    arch = self.arch if arch.nil?
    
    mode = self.get_processor_mode( rva ) if mode.nil?
    
    resolver = lambda do | name |
    
        resolved_rva = self.name2rva( name )
        
        if( not resolved_rva.nil? )
            return self.rva2va( resolved_rva )
        end
        
        return nil
    end 
    
    buffer = Relyze::ExecutableFileModel::Instruction.assemble( source, arch, self.rva2va( rva ), mode, resolver )
    
    if( buffer.nil? )
        return false
    end
    
    pre_padd_buffer = ''
    
    if( padd )
        
        nearest_rva = start_block.nearest_boundary( rva )
    
        if( nearest_rva < rva )
        
            padd_length = rva - nearest_rva
            
            padd_buffer = Relyze::ExecutableFileModel::Instruction.assemble( 'nop', arch, self.rva2va( rva ), mode )
            
            if( padd_buffer.nil? )
                return false
            end
            
            pre_padd_buffer = padd_buffer * ( padd_length / padd_buffer.length )
            
            rva = nearest_rva
        end
    end
    
    post_padd_buffer = ''
    
    if( padd )

        last_rva = rva + pre_padd_buffer.length + buffer.length
        
        last_block = self.block( last_rva )
        
        if( not last_block.nil? and last_block.code? and last_rva != last_block.nearest_boundary( last_rva )  )

            next_rva = last_block.next_boundary( last_rva )
            
            if( next_rva > last_rva )
            
                padd_length = next_rva - last_rva

                padd_buffer = Relyze::ExecutableFileModel::Instruction.assemble( 'nop', arch, self.rva2va( rva ), mode )
                
                if( padd_buffer.nil? )
                    return false
                end
                
                post_padd_buffer = padd_buffer * ( padd_length / padd_buffer.length )
            end
        end
    end
    
    off = start_block.segment.rva2offset( rva )
    if( off.nil? )
        return false
    end
    
    buffer = pre_padd_buffer + buffer + post_padd_buffer
    
    if( start_block.segment.write_buffer( off, buffer ).nil? )
        return false
    end
    
    end_rva = rva + buffer.length
    
    self.synchronize_analyze do
    
        while( true )
        
            start_block = start_block.reprocess
            
            break if start_block.nil? 
            
            start_block = start_block.adjacent
            
            break if start_block.nil? 
                
            break if start_block.rva + start_block.length >= end_rva
            
        end
    end
    
    return true
end

#bitsInteger

Get this model architectures bit width.

Returns:

  • (Integer)

    The number of bits in this architecture, either 32 or 64.



1661
1662
1663
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1661

def bits
    return 0
end

#block(rva) ⇒ Relyze::ExecutableFileModel::BasicBlock?

Get the BasicBlock which contains this RVA, if any.

Parameters:

  • rva (Integer)

    An RVA location.

Returns:



1996
1997
1998
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1996

def block( rva )
    return nil
end

#blocks {|basic_block| ... } ⇒ Object

Get every BasicBlock in this model.

Yields:

  • (basic_block)

    yields the basic_block to the block.

Yield Parameters:



1988
1989
1990
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1988

def blocks
    return []
end

#bookmark?(rva) ⇒ true, false

Check if a bookmark exists at a given RVA.

Parameters:

  • rva (Integer)

    Check for a bookmark at this RVA.

Returns:

  • (true, false)


1840
1841
1842
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1840

def bookmark?( rva )
    return false
end

#bookmarks {|rva, description| ... } ⇒ Object

Get every bookmark in this model.

Yields:

  • (rva, description)

    yields the RVA and description to the block.

Yield Parameters:

  • rva (Integer)

    The bookmarks RVA.

  • description (String)

    The bookmarks description.



1832
1833
1834
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1832

def bookmarks
    return []
end

#comment?(rva) ⇒ true, false

Check if a comment exists at a given RVA.

Parameters:

  • rva (Integer)

    Check for a comment at this RVA.

Returns:

  • (true, false)


1781
1782
1783
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1781

def comment?( rva )
    return false
end

#comments {|rva, description| ... } ⇒ Object

Get every user comment in this model.

Yields:

  • (rva, description)

    yields the RVA and description to the block.

Yield Parameters:

  • rva (Integer)

    The comments RVA.

  • description (String)

    The comments description.



1773
1774
1775
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1773

def comments
    return []
end

#delete_function(function) ⇒ true, false

Parameters:

Returns:

  • (true, false)


2021
2022
2023
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2021

def delete_function( function )
    return false
end

#delete_segment(segment) ⇒ true, false

Delete a segment from this model.

Parameters:

Returns:

  • (true, false)


1969
1970
1971
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1969

def delete_segment( segment )
    return false
end

#diff(modelB, options = {}) ⇒ Relyze::DiffResults::DiffModelResult?

Perform a differential analysis of this model (side A) against another model (side B).

Parameters:

  • modelB (Relyze::ExecutableFileModel)

    The model to perform the differential analysis against.

  • options (Hash) (defaults to: {})

    An hash of options for the differential analysis.

Options Hash (options):

  • :includeA (Array<Integer>)

    An optional array of function RVA's from model A to include in the differential analysis. Functions not in this list are automatically excluded.

  • :includeB (Array<Integer>)

    An optional array of function RVA's from model B to include in the differential analysis. Functions not in this list are automatically excluded.

  • :excludeA (Array<Integer>)

    An optional array of function RVA's from model A to exclude from the differential analysis. Functions not in this list are automatically included.

  • :excludeB (Array<Integer>)

    An optional array of function RVA's from model B to exclude from the differential analysis. Functions not in this list are automatically included.

Returns:



2138
2139
2140
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2138

def diff( modelB, options={} )
    nil
end

#endianObject

Get this models endianness.

return [Symbol] This models endianness, either :little or :big.



1668
1669
1670
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1668

def endian
    return nil
end

#entry_pointInteger

Get the RVA of this models initial entry point.

Returns:

  • (Integer)

    The entry point RVA.



1706
1707
1708
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1706

def entry_point
    return nil
end

#exports {|rva, name| ... } ⇒ Object

Get every export in this model.

Yields:

  • (rva, name)

    yields the rva and name to the block.

Yield Parameters:

  • rva (Integer)

    The exports RVA.

  • name (String)

    The exports name.



1875
1876
1877
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1875

def exports
    return []
end

#first_segmentRelyze::ExecutableFileModel::Segment

Get the first segment in this model.

Returns:



1924
1925
1926
1927
1928
1929
1930
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1924

def first_segment
    s = self.segments.sort do | a, b |
        a.rva <=> b.rva
    end

    return s.first
end

#function(rva) ⇒ Relyze::ExecutableFileModel::FunctionDataType?

Get a FunctionDataType in this model at a specific RVA.

Parameters:

  • rva (Integer)

    The RVA of the root block in a function.

Returns:



2013
2014
2015
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2013

def function( rva )
    return nil
end

#functions(rva = nil) {|function| ... } ⇒ Object

Get every FunctionDataType in this model.

Parameters:

  • rva (Integer, nil) (defaults to: nil)

    If an RVA is given, then we get every function in this model which contains this RVA. If no RVA is given, then we get every function in this model.

Yields:

  • (function)

    yields the function to the block.

Yield Parameters:



2005
2006
2007
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2005

def functions( rva=nil )
    return []
end

#get_comment(rva) ⇒ String?

Get a comment at a given RVA.

Parameters:

  • rva (Integer)

    Get the comment at this RVA.

Returns:

  • (String, nil)

    The comment or nil if none exists.



1806
1807
1808
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1806

def get_comment( rva )
    return nil
end

#get_processor_mode(rva) ⇒ Symbol, NilClass

Get the current processor mode.

Parameters:

  • rva (Integer)

    The RVA to to get the current processor mode for.

Returns:

  • (Symbol, NilClass)

    The current processor mode. If arch is :arm, mode can be either :arm or :thumb.



1690
1691
1692
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1690

def get_processor_mode( rva )
    return nil
end

#imports {|rva, module_name, import_name| ... } ⇒ Object

Get every import in this model.

Yields:

  • (rva, module_name, import_name)

    yields the rva, module_name and import_name to the block.

Yield Parameters:

  • rva (Integer)

    The imports RVA.

  • module_name (String)

    The imports module name.

  • import_name (String)

    The imports name.



1885
1886
1887
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1885

def imports
    return []
end

#last_segmentRelyze::ExecutableFileModel::Segment

Get the last segment in this model.

Returns:



1913
1914
1915
1916
1917
1918
1919
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1913

def last_segment
    s = self.segments.sort do | a, b |
        a.rva <=> b.rva
    end

    return s.last
end

#lines {|rva, object_file, source_file, source_line, length| ... } ⇒ Object

Get every symbol line for this model, if any.

Yields:

  • (rva, object_file, source_file, source_line, length)

    yields the rva, object_file, source_file, source_line and length to the block.

Yield Parameters:

  • rva (Integer)

    This lines RVA.

  • object_file (String)

    This lines object file.

  • source_file (String)

    This lines source file.

  • source_line (Integer)

    This lines source line number.

  • length (Integer)

    This lines byte length.



1980
1981
1982
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1980

def lines
    return []
end

#name2rva(name) ⇒ Integer?

Resolve the name of a location in the model to its RVA.

Parameters:

  • name (String)

    The name of a block in the model.

Returns:

  • (Integer, nil)

    The resolved RVA or nil on failure.



1764
1765
1766
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1764

def name2rva( name )
    return nil
end

#offset2rva(offset) ⇒ Integer?

Convert a file offset to an RVA or nil if not a valid RVA.

Parameters:

  • offset (Integer)

    The file offset to convert.

Returns:

  • (Integer, nil)

    The converted RVA or nil on failure.



1722
1723
1724
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1722

def offset2rva( offset )
    return nil
end

#remove_bookmark(rva) ⇒ true, false

Remove a bookmark at a given RVA.

Parameters:

  • rva (Integer)

    Remove a bookmark at this RVA.

Returns:

  • (true, false)


1857
1858
1859
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1857

def remove_bookmark( rva )
    return false
end

#remove_comment(rva) ⇒ true, false

Remove a comment at a given RVA.

Parameters:

  • rva (Integer)

    Remove the comment at this RVA.

Returns:

  • (true, false)


1798
1799
1800
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1798

def remove_comment( rva )
    return false
end

#rva2address(rva) ⇒ Integer?

Convert an RVA to an address, where address is the current address mode selected by the user, e.g. RVA mode, VA mode or Rebased VA mode.

Parameters:

  • rva (Integer)

    The RVA to convert.

Returns:

  • (Integer, nil)

    The converted address or nil on failure.



1747
1748
1749
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1747

def rva2address( rva )
    return nil
end

#rva2offset(rva) ⇒ Integer?

Convert an RVA to a file offset or nil if not a valid file offset.

Parameters:

  • rva (Integer)

    The RVA to convert.

Returns:

  • (Integer, nil)

    The converted file offset or nil on failure.



1714
1715
1716
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1714

def rva2offset( rva )
    return nil
end

#rva2va(rva) ⇒ Integer?

Convert an RVA to a virtual address (VA) or nil if not a valid virtual address.

Parameters:

  • rva (Integer)

    The RVA to convert.

Returns:

  • (Integer, nil)

    The converted virtual address or nil on failure.



1730
1731
1732
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1730

def rva2va( rva )
    return nil
end

#segment(rva) ⇒ Relyze::ExecutableFileModel::Segment?

Get the Segment which contains this RVA, if any.

Parameters:

  • rva (Integer)

    The RVA to whose segment we will return.

Returns:



1901
1902
1903
1904
1905
1906
1907
1908
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1901

def segment( rva )
    self.segments do | s |
        if( rva >= s.rva and rva < s.last_rva )
            return s
        end
    end
    return nil
end

#segments {|segment| ... } ⇒ Object

Get every segment in this model. Note, they are not yielded in order or their location.

Yields:

  • (segment)

    yields the segment to the block.

Yield Parameters:



1893
1894
1895
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1893

def segments
    return []
end

#set_function_prototype(rva, prototype, name = nil) ⇒ Trueclass, FalseClass

Create a function at this RVA or edit an existing function prototype.

Examples:

cm.set_function_prototype( cm.entry_point, "bool __stdcall foo( int count, char * buff )", "foo" )
@relyze.update_gui

Parameters:

Returns:



2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2035

def set_function_prototype( rva, prototype, name=nil )
    return self.synchronize_analyze do
        # Generate the FunctionDataType from the prototype string. Do this
        # first do we can fail gracefully if we fail to create the type.
        type = self.data_type_factory.get( prototype )
        if( type.nil? )
            break false
        end

        # Pull out the block containing this rva (may be data or code)
        blk = self.block( rva )
        if( blk.nil? )
            break false
        end

        # Split the block if we are creating the function inside the current block
        if( blk.rva != rva )
            blk = blk.split( rva, :code )
            if( blk.nil? )
                break false
            end
        else
            # If it is a data block, convert it to code
            if( blk.type == :data )
                blk = blk.to_code
                if( blk.nil? )
                    break false
                end
            end
        end

        blk.datatype = type

        if( not name.nil? )
            blk.name = name
        end
    end
end

#set_jumptable(jump_rva, table_rva, table_count, table_type, entry_width, entry_base = nil, negative_index = false, default_case_rva = nil, case_table_rva = nil, entry_stride = 0) ⇒ Object

Edit a jump table.

Examples:

cm.synchronize_analyze do
    cm.set_jumptable( 0xEB02, 0xEB6A, 8, :va, 32 )
end
@relyze.update_gui

Parameters:

  • jump_rva (Integer)

    The RVA of the indirect jump instruction.

  • table_rva (Integer)

    The RVA of the table containing the jump locations.

  • table_count (Integer)

    The number of locations in the jump table.

  • table_type (Symbol)

    The type entries in the jump table, either :va, :rva, :signedoffsetfromtable, :unsignedoffsetfromtable, :offsetfromjump, :signedoffsetfromcustomentrybase or :unsignedoffsetfromcustomentrybase.

  • entry_width (Integer)

    The width of the entries in the jump table, either 64, 32, 16 or 8.

  • entry_base (nil, Integer) (defaults to: nil)

    A custom entry base RVA for table_type of :signedoffsetfromcustomentrybase or :unsignedoffsetfromcustomentrybase.



2092
2093
2094
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2092

def set_jumptable( jump_rva, table_rva, table_count, table_type, entry_width, entry_base=nil, negative_index=false, default_case_rva=nil, case_table_rva=nil, entry_stride=0 )
    return false
end

#set_processor_mode(rva, mode) ⇒ true, false

Set the current processor mode. Changing the mode will reprocess any effected code blocks.

Parameters:

  • rva (Integer)

    The RVA to to set the current processor mode for.

  • mode (Symbol)

    The mode to to set. If arch is :arm, mode can be either :arm or :thumb.

Returns:

  • (true, false)


1699
1700
1701
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1699

def set_processor_mode( rva, mode )
    return false
end

#signatures {|rva, length, name, description| ... } ⇒ Object

Get every signature that has been applied to this model during Static Library Analysis.

Examples:

Displaying every signature in the current model.


cm.signatures do |rva, length, name, description|
   print_message( "0x#{rva.to_s(16)} - #{name} - #{description}" )
end

Yields:

  • (rva, length, name, description)

    yields the signatures RVA , length and name and Static Library Package description to the block.

Yield Parameters:

  • rva (Integer)

    The signatures RVA.

  • length (Integer)

    The signatures length.

  • name (String)

    The signatures name.

  • description (String)

    The Static Library Package description.



1823
1824
1825
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1823

def signatures
    return []
end

#strings {|rva, value| ... } ⇒ Object

Get every string in this model.

Yields:

  • (rva, value)

    yields the rva and value to the block.

Yield Parameters:

  • rva (Integer)

    The strings RVA.

  • value (String)

    The strings value.



1866
1867
1868
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1866

def strings
    return []
end

#synchronize_analyze(&block) ⇒ Object

call a block while holding the models write lock and disabling auto analysis. After calling the block, auto analysis is reset and the #analyze method is called.



1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1635

def synchronize_analyze( &block )
    result = self.synchronize_write do
        orig_auto_analyze = self.auto_analyze
        self.auto_analyze = false
        result = block.call
        self.auto_analyze = orig_auto_analyze
        result
    end
    # Call analyze _after_ synchronize_write so we can take advantage of multi threaded 
    # analysis. If we were to call analyze while holding the write lock, we would force 
    # single threaded analysis (as worker threads would never be able to acquire the 
    # model lock).
    self.analyze
    return result
end

#system_modeSymbol

Get this models system mode.

Returns:

  • (Symbol)

    This models architecture, either :user or :kernel.



1682
1683
1684
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1682

def system_mode
    return nil
end

#to_graph(display = {}) ⇒ Relyze::Graph::DirectedGraph

Generate a Graph::DirectedGraph object for this models call graph.

Examples:

# generate this models function call graph
graph = cm.to_graph
# post process the graph...
graph.nodes.each do | node |
    # set the nodes data to the function name so the nodes
    # text content in the GUI becomes just the function name.
    node.data = node.data.name
end
# perform a circular layout based on the nodes in degree
graph.layout( { :layout => :circular, :order => :indegree } )
# display this graph in the GUI so user can interact with it...
@relyze.tab_display_graph( graph )

Parameters:

  • display (Hash) (defaults to: {})

    An optional hash of display options to pass to the graph.

Returns:



2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 2160

def to_graph( display={} )

    graph = Relyze::Graph::DirectedGraph.new(
        "CG",
        {
            :node_shape            => :circle,
            :font_justify          => :center,
            :edge_color            => '#16A085',
            :node_background_color => '#3498DB',
        }.merge!( display )
    )

    self.functions do | function |

        root_block = function.block( function.rva )

        root_block.references( :in ) do | ref |

            next if not ref.control_flow?

            next if ref.target_rva != root_block.rva

            n1 = graph.find_or_create_node( function )

            n1.display[:rva] = function.rva

            if( self.entry_point == function.rva )
                graph.root = n1
            end

            self.functions( ref.owner_rva ) do | caller_function |

                n2 = graph.find_or_create_node( caller_function )

                n2.display[:rva] = caller_function.rva

                if( self.entry_point == caller_function.rva )
                    graph.root = n2
                end

                if( not n2.edge?( n1 ) )
                    edge = graph.create_edge( n2, n1 )
                end
            end
        end
    end

    return graph
end

#typeSymbol

Get the type of ExecutableFileModel

Returns:

  • (Symbol)

    This models type, either :elf, :pe, :coff or :flat.



1654
1655
1656
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1654

def type
    return nil
end

#va2rva(va) ⇒ Integer?

Convert an VA to an RVA or nil if not a valid RVA.

Parameters:

  • va (Integer)

    The VA to convert.

Returns:

  • (Integer, nil)

    The converted RVA nil on failure.



1738
1739
1740
# File 'C:/Program Files/Relyze/lib/relyze/core/executable_file_model.rb', line 1738

def va2rva( va )
    return nil
end