ghidra.program.model.address.Address Java Examples

/**
 * Searches a function for a tag.
 * 
 * @param name the tag to search for
 * @param program the program to search
 * @param address the address of the function, as a string
 * @return true if found
 */
private boolean isTagInFunction(String name, Program program, String address) {

	Address entryPoint = addr(address, program);

	FunctionManagerDB functionManagerDB = (FunctionManagerDB) program.getFunctionManager();
	Function function = functionManagerDB.getFunctionAt(entryPoint);
	Collection<FunctionTag> tags = function.getTags();
	for (FunctionTag tag : tags) {
		if (tag.getName().equals(name)) {
			return true;
		}
	}

	return false;
}
 

@Override
public Collection<VTAssociation> getRelatedAssociationsByDestinationAddress(
		Address destinationAddress) {
	lock.acquire();
	try {
		long destinationID = session.getLongFromDestinationAddress(destinationAddress);
		Set<Record> relatedRecords =
			associationTableAdapter.getRelatedAssociationRecordsByDestinationAddress(
				destinationID);
		List<VTAssociation> associations = new ArrayList<>();
		for (Record record : relatedRecords) {
			associations.add(getAssociationForRecord(record));
		}
		return associations;
	}
	catch (IOException e) {
		session.dbError(e);
	}
	finally {
		lock.release();
	}
	return Collections.emptyList();
}
 

@Test
public void testFindAndApplyMarkupItem_Add_MultipleSourceLabel_WithNoExistingDestinationLabels()
		throws Exception {
	Address labelAddress = addr("0x01002d06", sourceProgram);

	Symbol sourceSymbol1 = addLabel(labelAddress, sourceProgram);
	Symbol sourceSymbol2 = addLabel(labelAddress, sourceProgram);
	Symbol sourceSymbol3 = addLabel(labelAddress, sourceProgram);

	Symbol[] sourceSymbols = new Symbol[3];
	sourceSymbols[0] = sourceSymbol1;
	sourceSymbols[1] = sourceSymbol2;
	sourceSymbols[2] = sourceSymbol3;

	Symbol[] destinationSymbols = null;

	Symbol[] expectedSymbols = sourceSymbols;

	LabelValidator validator = new LabelValidator("0x01002cf5", "0x01002cf5", labelAddress,
		sourceSymbols, destinationSymbols, expectedSymbols, LabelChoices.ADD, sourceSymbols[0]);
	doTestFindAndApplyMarkupItem(validator);
}
 

@Test
public void testDisplayString_AddressLocation_MultipleCodeUnits() {

	int cuOffset = 0;
	int cuCount = 4;
	Address address = addr(TEST_ADDRESS);
	AddressFieldLocation location = new AddressFieldLocation(program, address);
	CodeUnitTableCellData data =
		new CodeUnitTableCellData(location, formatter, cuOffset, cuCount);
	String preview = data.getDisplayString();

	// location defaults to the mnemonic display
	//@formatter:off
	String results =
		MNEMONIC_DISPLAY_STRING +
		"\nCALL dword ptr [DAT_0100115c]" +
		"\nMOV ECX,dword ptr [DAT_01008844]" +
		"\nMOV dword ptr [EAX],ECX";
	//@formatter:on
	assertEquals(results, preview);
}
 

@Test
public void testReplaceUndefinedOnlySmallDataTypeWithLargerThatFits() throws Exception {

	Address sourceAddress = addr("0x010074e6", sourceProgram); // LoadCursorW
	TerminatedStringDataType sourceDataType = new TerminatedStringDataType();
	Data sourceData = setDataType(sourceProgram, sourceAddress, sourceDataType, -1); // Get "LoadCursorW".

	Address destinationAddress = addr("0x010074e6", destinationProgram); // LoadCursorW
	StringDataType destinationDataType = new StringDataType();
	Data destinationData =
		setDataType(destinationProgram, destinationAddress, destinationDataType, 4); // Get "Load".

	DataTypeValidator validator = new DataTypeValidator(sourceData, destinationData,
		ReplaceDataChoices.REPLACE_UNDEFINED_DATA_ONLY);
	doTestFindAndApplyMarkupItem_NoEffect(validator);
}
 

@Override
public void rightLocationChanged(ProgramLocation rightLocation) {
	if (addressCorrelation == null) {
		return; // Do nothing since no address correlator.
	}
	Address rightAddress = rightLocation.getAddress();
	if (rightAddress == null) {
		return; // Do nothing since can't get a location address.
	}
	// The correlation only gives a left side address for a right side address that is a code unit minimum.
	Address leftAddress = addressCorrelation.getAddressInFirst(rightAddress);
	if (leftAddress == null) {
		return; // Do nothing since can't get a matching address.
	}
	// Got an address so let's try to lock the two panels at the indexes for the matching addresses.
	setLockedAddresses(leftAddress, rightAddress);

	FieldPanel fp = dualListingPanel.getRightPanel().getFieldPanel();
	adjustFieldPanel(fp);
}
 

private Reference getOperandReference(ListingActionContext context) {
	if (!(context.getLocation() instanceof OperandFieldLocation)) {
		return null;
	}
	OperandFieldLocation opLoc = (OperandFieldLocation) context.getLocation();
	Address address = opLoc.getAddress();
	int opIndex = opLoc.getOperandIndex();

	Data dataComp = getDataComponent(context);
	if (dataComp != null) {
		if (isInUnion(dataComp)) {
			return null;
		}
		address = dataComp.getMinAddress();
	}

	ReferenceManager refMgr = context.getProgram().getReferenceManager();
	//SymbolTable st = currentProgram.getSymbolTable();

	return refMgr.getPrimaryReferenceFrom(address, opIndex);
}
 

private void setHeaderComment(MachHeader header, Address machAddress) {
	StringBuffer comments = new StringBuffer();
	comments.append("File type: ");
	comments.append(MachHeaderFileTypes.getFileTypeName(header.getFileType()));
	comments.append('\n');
	comments.append('\t');
	comments.append(MachHeaderFileTypes.getFileTypeDescription(header.getFileType()));
	comments.append('\n');
	comments.append('\n');
	comments.append("Flags:");
	List<String> flags = MachHeaderFlags.getFlags(header.getFlags());
	for (String flag : flags) {
		comments.append('\t');
		comments.append(flag);
		comments.append('\n');
	}
	setPlateComment(machAddress, comments.toString());
}
 

private void assertScalarsFromCompositeDataInTable() {

		Listing listing = program.getListing();
		DataIterator compositeData = listing.getCompositeData(true);
		Data composite = compositeData.next();
		assertTrue("Expected array; found: " + composite, composite.getDataType() instanceof Array);

		//@formatter:off
		List<ScalarRowObject> data = getTableData();
		List<Address> addresses =
			data.stream()
				.map(rowObject -> rowObject.getAddress())
				.collect(Collectors.toList())
				;
		//@formatter:on

		int n = composite.getNumComponents();
		for (int i = 0; i < n; i++) {
			Data child = composite.getComponent(i);
			Address a = child.getAddress();
			assertTrue(addresses.contains(a));
		}
	}
 

private Address getAddressOfNextPreviousUndefined(TaskMonitor monitor, Program program,
		Address address, boolean forward) throws CancelledException {
	if (address == null) {
		return null;
	}

	CodeUnitIterator codeUnits = program.getListing().getCodeUnits(address, forward);
	while (codeUnits.hasNext()) {
		monitor.checkCanceled();
		CodeUnit codeUnit = codeUnits.next();
		if (codeUnit instanceof Data) {
			if (!((Data) codeUnit).isDefined()) {
				return codeUnit.getAddress();
			}
		}
	}
	return null;
}
 

/**
 * Create the data field for the exception handler frame pointer. Also create the associated 
 * reference, and add an identifying comment.
 * 
 * @param curAddress address of the frame pointer field
 * @param eh_frame_hdr the frame header with encoding information
 * @param curMemBlock the memory block containing this header
 * @return the next address after the frame pointer field
 * @throws MemoryAccessException if the field's memory can't be read
 */
private Address processEncodedFramePointer(Address curAddress,
		ExceptionHandlerFrameHeader eh_frame_hdr, MemoryBlock curMemBlock)
		throws MemoryAccessException {

	/* Create the encoded Exception Handler Frame Pointer */
	DwarfEHDecoder frmPtrDecoder =
		DwarfDecoderFactory.getDecoder(eh_frame_hdr.getEh_FramePtrEncoding());
	Address frmPtrAddr =
		frmPtrDecoder.decodeAddress(new DwarfDecodeContext(program, curAddress, curMemBlock));

	program.getReferenceManager().addMemoryReference(curAddress, frmPtrAddr, RefType.DATA,
		SourceType.ANALYSIS, 0);

	DataType frmPtrDataType = frmPtrDecoder.getDataType(program);

	CreateDataCmd dataCmd = new CreateDataCmd(curAddress, frmPtrDataType);
	dataCmd.applyTo(program);

	SetCommentCmd commentCmd =
		new SetCommentCmd(curAddress, CodeUnit.EOL_COMMENT, "Encoded eh_frame_ptr");
	commentCmd.applyTo(program);

	curAddress = curAddress.add(frmPtrDataType.getLength());
	return curAddress;
}
 

public void applyTo() throws Exception {
	if (_state.beenApplied.contains(_index)) {
		return;
	}
	_state.beenApplied.add(_index);

	Address address =
		_state.program.getAddressFactory().getDefaultAddressSpace().getAddress(_index);
	DataType dt = toDataType();
	try {
		_state.program.getListing().createData(address, dt);
	}
	catch (Exception e) {
	}

	if (symbolTable != null) {
		symbolTable.applyTo();
	}
}
 

@Override
protected void actionPerformed(ListingActionContext context) {
	// The location indicates the program for the current listing.
	ProgramLocation location = context.getLocation();
	Program program = location.getProgram();
	ListingMergePanel listingMergePanel =
		(ListingMergePanel) listingMergePanelPlugin.getProvider().getComponent();
	String version = listingMergePanel.getVersionName(program);
	Address address = location.getAddress();
	CodeUnit cu = program.getListing().getCodeUnitContaining(address);
	String detailString = CodeUnitDetails.getInstructionDetails(cu);
	String title = version + " version's Instruction Details @ " + address.toString();
	Dialog dialog = new Dialog(title, createDetailsPane(detailString));

	dialog.setHelpLocation(HELP_LOCATION);

	listingMergePanelPlugin.getTool().showDialog(dialog, listingMergePanel);
}
 

/**
 * Set the function info.
 * @param function function used to get function info to transfer 
 */
public void setFunction(Function function) {
	functionName = function.getName();
	functionComments = function.getCommentAsArray();

	Variable[] vars = function.getAllVariables();
	Variable[] stackVars = function.getVariables(VariableFilter.STACK_VARIABLE_FILTER);

	stackVarNames = new String[stackVars.length];
	stackVarSources = new SourceType[stackVars.length];
	stackOffsets = new int[stackVars.length];
	stackVarFUOffsets = new int[stackVars.length];
	stackVarComments = new String[stackVars.length];
	setStackVarInfo(stackVars);

	int nonStackVariableCount = vars.length - stackVars.length;
	varNames = new String[nonStackVariableCount];
	varSources = new SourceType[nonStackVariableCount];
	varAddrs = new Address[nonStackVariableCount];
	varFUOffsets = new int[nonStackVariableCount];
	varComments = new String[nonStackVariableCount];
	setNonStackVarInfo(vars);
}
 

private int computeEntropy(Address address) {
	if (address == null) {
		return 0;
	}
	MemoryBlock block = program.getMemory().getBlock(address);
	if (block == null) {
		return 0;
	}
	Address chunkStartAddress = getChunkStartAddress(block, address);
	try {
		int bytesRead = block.getBytes(chunkStartAddress, chunkBuffer);
		computeHistogram(bytesRead);
		return quantizeChunk();
	}
	catch (MemoryAccessException e) {
		return 0;  // no bytes, no entropy
	}
}
 

/**
 * Creates a symbol with the given name at the specified address.
 * The symbol will be created in a name space with the name of
 * the memory block that contains the address.
 */
public static Symbol createSymbolUsingMemoryBlockAsNamespace(Program program, Address address,
		String name, SourceType sourceType)
		throws DuplicateNameException, InvalidInputException {

	SymbolTable symbolTable = program.getSymbolTable();
	Memory memory = program.getMemory();

	MemoryBlock block = memory.getBlock(address);
	String namespaceName = block.getName();

	Namespace namespace = symbolTable.getNamespace(namespaceName, program.getGlobalNamespace());
	if (namespace == null) {
		namespace = symbolTable.createNameSpace(program.getGlobalNamespace(), namespaceName,
			sourceType);
	}

	return symbolTable.createLabel(address, name, namespace, SourceType.ANALYSIS);
}
 

@Override
public String getToolTipText(Address address) {
	if (address == null) {
		return null;
	}
	int entropyScaled = computeEntropy(address);
	double entropy = (entropyScaled * 8.0d) / 255; 	// convert back from palette scale to original entropy value
	StringBuilder buffer = new StringBuilder();
	buffer.append("<b>");
	buffer.append(HTMLUtilities.escapeHTML(getName()));
	buffer.append("</b>\n");
	buffer.append(" ");
	buffer.append(formatter.format(entropy));
	buffer.append(" ");
	buffer.append(HTMLUtilities.escapeHTML(getKnotName(entropyScaled)));
	buffer.append(" ");
	buffer.append(" &nbsp&nbsp&nbsp(");
	buffer.append(HTMLUtilities.escapeHTML(getBlockName(address)));
	buffer.append(" ");
	buffer.append(HTMLUtilities.escapeHTML(address.toString()));
	buffer.append(" )");
	return HTMLUtilities.toWrappedHTML(buffer.toString(), 0);
}
 

private Point2D maybeGetGroupDestinationPoint(Map<FGVertex, Point2D> locations) {
	Set<FGVertex> toBeRemoved = getVerticesToBeRemoved();
	if (!toBeRemoved.contains(groupVertex)) {
		return null; // we are not removing the group vertex (must be a grouping operation)
	}

	// We want the group vertex to fade away into another vertex.  We also want to be 
	// consistent, so just merge to the root vertex of the group vertex.
	Address vertexAddress = groupVertex.getVertexAddress();
	Set<FGVertex> vertices = groupVertex.getVertices();
	for (FGVertex vertex : vertices) {
		if (vertex.containsAddress(vertexAddress)) {
			// just graph any vertex--we just need somewhere for the group to merge to
			Set<FGVertex> centerOverVertices = getNewVertices();
			return locations.get(centerOverVertices.iterator().next());
		}
	}

	throw new AssertException(
		"How did we not have a grouped vertex with the same address as the group vertex?");
}
 

public void setLocation(Register register, Address address) {
	if (!followLocation) {
		return;
	}
	if (register != null) {
		tree.selectRegister(register);
	}
	values.setAddress(address);
}
 

public boolean isMatch(Address srcAddr, Address destAddr) {
	List<VTMatchSet> matchSets = session.getMatchSets();
	for (int i = 0; i < matchSets.size(); i++) {
		VTMatchSet matchSet = matchSets.get(i);
		if (matchSet.getMatches(srcAddr, destAddr).size() > 0) {
			return true;
		}
	}
	return false;
}
 

VariableStorage getVariableStorage(Address variableAddr) throws IOException {
	MyVariableStorage myStorage = getMyVariableStorage(variableAddr);
	if (myStorage != null) {
		return myStorage.getVariableStorage();
	}
	return null;
}
 

@Override
public int compareTo(DisplayableAddress otherDisplayableAddress) {
	if (otherDisplayableAddress == null) {
		return 1;
	}
	Address otherAddress = otherDisplayableAddress.getAddress();
	if (address == null) {
		return (otherAddress == null) ? 0 : -1;
	}
	if (otherAddress == null) {
		return 1;
	}
	return address.compareTo(otherAddress);
}
 

private void createLabel(Address addr, String name) throws Exception {
	int txId = program.startTransaction("Add label");
	try {
		program.getSymbolTable().createLabel(addr, name, SourceType.USER_DEFINED);
	}
	finally {
		program.endTransaction(txId, true);
	}
	waitForSwing();
}
 

@Test
public void testValidV1FuncInfo64() throws Exception {
	ProgramBuilder builder = build64BitX86();
	ProgramDB program = builder.getProgram();
	setupV1FuncInfo64(builder, 0x101003340L, EHFunctionInfoModel.EH_MAGIC_NUMBER_V1, 3,
		"0x101003368", 2, "0x101003380", 4, "0x1010033d0", 0x00000200);
	Address address = builder.addr(0x101003340L);
	EHFunctionInfoModel model =
		new EHFunctionInfoModel(program, address, defaultValidationOptions);
	model.validate();
	model.validateCounts(1000);
	model.validateLocationsInSameBlock();
	assertEquals(address, model.getAddress());
	assertEquals(0, model.getBbtFlags());
	assertEquals(EHFunctionInfoModel.EH_MAGIC_NUMBER_V1, model.getMagicNumber());
	assertEquals(3, model.getUnwindCount());
	assertEquals(builder.addr(0x101003368L), model.getUnwindMapAddress());
	assertEquals(2, model.getTryBlockCount());
	assertEquals(builder.addr(0x101003380L), model.getTryBlockMapAddress());
	assertEquals(4, model.getIPToStateCount());
	assertEquals(builder.addr(0x1010033d0L), model.getIPToStateMapAddress());
	assertEquals(0x200, model.getUnwindHelpDisplacement());
	try {
		model.getESTypeListAddress();
		model.getEHFlags();
		fail(
			"Shouldn't be able to retrieve TypeListAddress or EH flags in a version1 FuncInfo.");
	}
	catch (UndefinedValueException e) {
		// We expect to get this.
	}
}
 

protected void goToDataAddressField(Address a, int row) {
	openData(a);

	AddressFieldLocation location =
		new AddressFieldLocation(program, a, new int[] { row }, a.toString(), 0);
	ProgramLocationPluginEvent event =
		new ProgramLocationPluginEvent("Test", location, program);
	tool.firePluginEvent(event);
}
 

private String[] getFlexArrayComment(Data data, Address addr) {

		int levelsToIgnore = 0;
		String label = null;

		int[] cpath = data.getComponentPath();
		if (cpath != null && cpath.length > 0) {
			// check previous sibling data within composite
			if (cpath[cpath.length - 1] <= 0) {
				return null; // case not handled
			}
			data = data.getParent().getComponent(cpath[cpath.length - 1] - 1);
			if (data == null || !data.isStructure()) {
				return null;
			}
			levelsToIgnore = cpath.length - 1;
		}
		else {
			Program p = data.getProgram();
			data = p.getListing().getDefinedDataContaining(addr);
			if (data == null || !data.isStructure()) {
				return null;
			}
			Symbol s = p.getSymbolTable().getPrimarySymbol(data.getAddress());
			label = s != null ? s.getName(true) : data.getDataType().getName();
		}

		// locate deepest structure containing addr which will be checked for flex array
		while (true) {
			int offset = (int) addr.subtract(data.getMinAddress());
			Data component = data.getComponentAt(offset);
			if (component == null || !component.isStructure()) {
				break;
			}
			data = component;
		}

		return buildFlexArrayComment(data, levelsToIgnore, label);
	}
 

@Test
public void testValidRtti4_32NoFollowData() throws Exception {
	ProgramBuilder builder = build32BitX86();
	ProgramDB program = builder.getProgram();
	setupRtti4_32(builder, 0x01001340L, 0, 0, 0, "0x01005364", "0x0100137c");
	Address address = builder.addr(0x01001340L);
	Rtti4Model model = new Rtti4Model(program, address, noFollowValidationOptions);
	model.validate();
	assertEquals(address, model.getAddress());
	assertEquals(0, model.getSignature());
	assertEquals(0, model.getVbTableOffset());
	assertEquals(0, model.getConstructorOffset());
	assertEquals(builder.addr(0x01005364L), model.getRtti0Address());
	assertEquals(builder.addr(0x0100137cL), model.getRtti3Address());
}
 

public PefDebug(Memory memory, Address address) throws MemoryAccessException {
	unknown = memory.getInt(address);
	type = memory.getInt(address.add(0x4));
	flags = memory.getInt(address.add(0x8));
	distance = memory.getInt(address.add(0xc));
	nameLength = memory.getShort(address.add(0x10)) & 0xffff;
	byte [] stringBytes = new byte[nameLength];
	memory.getBytes(address.add(0x12), stringBytes);
	name = new String(stringBytes);
}
 

/**
 *     10: or
 *  +- 12: brds   20   
 *  |  14: _or   <-----+
 *  |  16: ret         |
 *  |                  |
 *  +->20: or          |
 *     22: breq 14 ----+
 *     24: ret
 *     
 * branch into delay slot
 */
@Test
public void testFlowUnconditionalBranchDelaySlot() throws Exception {

	programBuilder.addBytesFallthrough(10);
	programBuilder.addBytesBranchWithDelaySlot(12, 20);
	programBuilder.addBytesReturn(16);

	programBuilder.addBytesFallthrough(20);
	programBuilder.addBytesBranchConditional(22, 14);
	programBuilder.addBytesReturn(24);

	programBuilder.disassemble(toHex(10), 6, false);
	programBuilder.disassemble(toHex(16), 2, false);
	programBuilder.disassemble(toHex(20), 6, false);

	Address addr = address(10);
	AddressSet addressSet = new AddressSet(addr);
	FlowType[] flowsNotToFollow = new FlowType[] {};
	FollowFlow followFlow = new FollowFlow(program, addressSet, flowsNotToFollow); // FollowAllFlows
	AddressSet flowAddresses = followFlow.getFlowAddressSet(TaskMonitorAdapter.DUMMY_MONITOR);

	AddressSet expectedAddresses = new AddressSet();
	expectedAddresses.add(address(10), address(15));
	expectedAddresses.add(address(20), address(25));

	assertEquals(new MySelection(expectedAddresses), new MySelection(flowAddresses));

}
 

private void createThunkToExternal(String addressString) throws Exception {

		int txId = program.startTransaction("Set External Location");
		try {

			program.getExternalManager().setExternalPath("ADVAPI32.dll", "/FILE1", true);

			Address address = addr(addressString);
			CreateFunctionCmd cmd = new CreateFunctionCmd(address);
			cmd.applyTo(program);

			String extAddress = "0x1001000";
			ExternalManager em = program.getExternalManager();

			// "ADVAPI32.dll", "externalFunctionXyz", "_Zxyz"
			ExternalLocation externalLocation =
				em.addExtFunction(Library.UNKNOWN, "_Zxyz", addr(extAddress), SourceType.IMPORTED);
			Library lib = em.addExternalLibraryName("ADVAPI32.dll", SourceType.IMPORTED);
			externalLocation.setName(lib, "externalFunctionXyz", SourceType.IMPORTED);

			Function function = program.getFunctionManager().getFunctionAt(addr(addressString));
			function.setThunkedFunction(externalLocation.getFunction());
		}
		finally {
			program.endTransaction(txId, true);
		}

		program.flushEvents();
		waitForSwing();
	}