ghidra.app.util.bin.ByteProvider Java Examples

@Override
public Collection<LoadSpec> findSupportedLoadSpecs(ByteProvider provider) throws IOException {
	List<LoadSpec> loadSpecs = new ArrayList<>();

	BinaryReader reader = new BinaryReader(provider, true);
	try {
		DexHeader header = new DexHeader(reader);
		if (DexConstants.DEX_MAGIC_BASE.equals(new String(header.getMagic()))) {
			List<QueryResult> queries =
				QueryOpinionService.query(getName(), DexConstants.MACHINE, null);
			for (QueryResult result : queries) {
				loadSpecs.add(new LoadSpec(this, 0, result));
			}
			if (loadSpecs.isEmpty()) {
				loadSpecs.add(new LoadSpec(this, 0, true));
			}
		}
	}
	catch (Exception e) {
		//ignore
	}

	return loadSpecs;
}
 

/**
 * Scans the provider looking for PRELINK Mach-O headers.  
 * <p>
 * NOTE: The "System" Mach-O at offset 0 is not considered a PRELINK Mach-O.
 * <p>
 * NOTE: We used to scan on 0x1000, and then 0x10 byte boundaries.  Now iOS 12 seems to 
 * put them on 0x8-byte boundaries.
 * 
 * @param provider The provider to scan.
 * @param monitor A monitor.
 * @return A list of provider offsets where PRELINK Mach-O headers start (not including the
 *   "System" Mach-O at offset 0).
 * @throws IOException If there was an IO-related issue searching for PRELINK Mach-O headers.
 */
public static List<Long> findPrelinkMachoHeaderOffsets(ByteProvider provider,
		TaskMonitor monitor) throws IOException {
	monitor.setMessage("Finding PRELINK Mach-O headers...");
	monitor.initialize((int) provider.length());

	List<Long> list = new ArrayList<>(); // This list must maintain ordering...don't sort it		
	for (long offset = 0; offset < provider.length() - 4; offset += 8) {
		if (monitor.isCancelled()) {
			break;
		}
		monitor.setProgress((int) offset);

		if (getMachoLoadSpec(provider, offset) != null) {
			if (offset > 0) {
				// Don't put first "System" Mach-O in list
				list.add(offset);
			}
		}
		else if (offset == 0) {
			// if it doesn't start with a Mach-O, just quit
			break;
		}
	}
	return list;
}
 

@Override
public List<Option> getDefaultOptions(ByteProvider provider, LoadSpec loadSpec,
		DomainObject domainObject, boolean loadIntoProgram) {
	List<Option> list =
		super.getDefaultOptions(provider, loadSpec, domainObject, loadIntoProgram);
	if (!loadIntoProgram) {
		list.add(new Option(PROCESS_SYMBOLS_OPTION_NAME, PROCESS_SYMBOLS_OPTION_DEFAULT,
			Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-processSymbols"));
		list.add(
			new Option(CREATE_DYLIB_SECTIONS_OPTION_NAME, CREATE_DYLIB_SECTIONS_OPTION_DEFAULT,
				Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-createDylibSections"));
		list.add(
				new Option(ADD_RELOCATION_ENTRIES_OPTION_NAME, ADD_RELOCATION_ENTRIES_OPTION_DEFAULT,
					Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-addRelocationEntries"));
	}
	return list;
}
 

@Override
protected boolean loadProgramInto(ByteProvider provider, LoadSpec loadSpec,
		List<Option> options, MessageLog log, Program prog, TaskMonitor monitor)
		throws IOException, CancelledException {
	Address baseAddr = getBaseAddr(options);

	if (baseAddr == null) {
		baseAddr = prog.getAddressFactory().getDefaultAddressSpace().getAddress(0);
	}
	boolean success = false;
	try {
		processMotorolaHex(provider, options, prog, baseAddr, monitor);
		success = true;
	}
	catch (AddressOverflowException e) {
		throw new IOException(
			"Hex file specifies range greater than allowed address space - " + e.getMessage());
	}
	return success;
}
 

private void markupArchiveMemberHeader(ByteProvider provider, CoffArchiveHeader header)
		throws Exception {

	for (CoffArchiveMemberHeader archiveMemberHeader : header.getArchiveMemberHeaders()) {
		if (monitor.isCancelled()) {
			break;
		}
		DataType dt = archiveMemberHeader.toDataType();
		Address start = toAddr(archiveMemberHeader.getFileOffset());
		Address end = start.add(dt.getLength());
		createData(start, dt);
		createFragment("ArchiveMemberHeader", start, dt.getLength());

		if (!archiveMemberHeader.isCOFF()) {
			continue;
		}

		String name = SymbolUtilities.replaceInvalidChars(archiveMemberHeader.getName(), true);

		Address payloadAddress = end;
		createFragment(name, payloadAddress, archiveMemberHeader.getSize());
		createLabel(payloadAddress, name, true);
	}
}
 

@Override
public Collection<LoadSpec> findSupportedLoadSpecs(ByteProvider provider) throws IOException {
	List<LoadSpec> loadSpecs = new ArrayList<>();

	if (provider.getName() != null && provider.getName().toLowerCase().endsWith(".map") &&
		!parseExports(provider, null).isEmpty()) {
		List<QueryResult> results = QueryOpinionService.query(getName(), NO_MAGIC, null);
		for (QueryResult result : results) {
			loadSpecs.add(new LoadSpec(this, 0, result));
		}
		if (loadSpecs.isEmpty()) {
			loadSpecs.add(new LoadSpec(this, 0, true));
		}
	}

	return loadSpecs;
}
 

public final static DecryptedPacket decrypt(String firmwareName, String firmwarePath,
		ByteProvider provider, TaskMonitor monitor) throws IOException, CryptoException,
CancelledException {

	List<Decryptor> instances = ClassSearcher.getInstances(Decryptor.class);
	for (Decryptor decryptor : instances) {
		if (monitor.isCancelled()) {
			throw new CancelledException();
		}
		if (decryptor.isValid(provider)) {
			return decryptor.decrypt(firmwareName, firmwarePath, provider, monitor);
		}
	}
	throw new CryptoException("Unable to decrypt " + provider.getName() +
			" unable to locate decryption provider.");
}
 

private boolean verifyChecksum(ByteProvider provider, PortableExecutable pe)
		throws IOException {

	RichHeader rich = pe.getRichHeader();
	if (rich == null) {
		return true;
	}

	int checksum = computeChecksum(provider, pe);

	if (checksum != rich.getMask()) {
		printf("\nComputed checksum and table mask differ -- 0x%08x vs 0x%08x\n", checksum,
			rich.getMask());
		return false;
	}
	return true;
}
 

private static int computeChecksum(ByteProvider provider, PortableExecutable pe)
		throws IOException {

	RichHeader rich = pe.getRichHeader();

	int checksum = rich.getOffset();

	// Linker version 5 has a product ID of 0x14 and was the last version to use a slightly 
	// different checksumming algorithm; after v5, the DOS program was also included
	// in the checksum range.		

	int dosChecksum = checksumDosHeader(provider,
		isToolchainVersionAfterV5(rich) ? pe.getDOSHeader().getProgramLen() : 0);

	checksum += dosChecksum;

	for (RichHeaderRecord record : rich.getRecords()) {
		checksum += rol32(record.getCompId().getValue(), record.getObjectCount() & 0xFF);
	}
	return checksum;
}
 

@Override
public Collection<LoadSpec> findSupportedLoadSpecs(ByteProvider provider) throws IOException {
	List<LoadSpec> loadSpecs = new ArrayList<>();
	if (MotorolaHexLoader.isPossibleHexFile(provider)) {
		List<LanguageDescription> languageDescriptions =
			getLanguageService().getLanguageDescriptions(false);
		for (LanguageDescription languageDescription : languageDescriptions) {
			Collection<CompilerSpecDescription> compilerSpecDescriptions =
				languageDescription.getCompatibleCompilerSpecDescriptions();
			for (CompilerSpecDescription compilerSpecDescription : compilerSpecDescriptions) {
				LanguageCompilerSpecPair lcs =
					new LanguageCompilerSpecPair(languageDescription.getLanguageID(),
						compilerSpecDescription.getCompilerSpecID());
				loadSpecs.add(new LoadSpec(this, 0, lcs, false));
			}
		}
	}
	return loadSpecs;
}
 

public RELProgramBuilder(RELHeader rel, ByteProvider provider, Program program,
		TaskMonitor monitor, File originalFile, boolean autoloadMaps, boolean saveRelocations,
		boolean createDefaultMemSections, boolean specifyModuleMemAddrs)
				throws IOException, AddressOverflowException, AddressOutOfBoundsException, MemoryAccessException {
	this.rel = rel;
	this.program = program;
	this.monitor = monitor;
	this.autoloadMaps = autoloadMaps;
	this.saveRelocations = saveRelocations;
	this.specifyModuleMemAddrs = specifyModuleMemAddrs;
	this.binaryName = provider.getName();
	this.symbolInfoList = new ArrayList<Map<Long, SymbolInfo>>();
	
	this.load(provider, originalFile);
	if (createDefaultMemSections) {
		SystemMemorySections.Create(program);
	}
}
 

private void writeFile(CFragResourceMember member, File memberFile, ByteProvider provider)
		throws IOException {
	OutputStream out = new FileOutputStream(memberFile);
	int offset = member.getOffset();
	int length = member.getLength();
	try {
		for (int i = offset; i < offset + length; i += BUFFER) {
			if (i + BUFFER < offset + length) {
				out.write(provider.readBytes(i, BUFFER));
			}
			else {
				out.write(provider.readBytes(i, offset + length - i));
			}
		}
	}
	finally {
		out.close();
	}
}
 

@Override
public Collection<LoadSpec> findSupportedLoadSpecs(ByteProvider provider) throws IOException {
	List<LoadSpec> loadSpecs = new ArrayList<>();
	boolean validClass = false;

	if (checkClass(provider)) {
		validClass = true;
	}

	if (validClass) {
		loadSpecs.add(new LoadSpec(this, 0,
			new LanguageCompilerSpecPair("JVM:BE:32:default", "default"), true));
	}

	return loadSpecs;
}
 

@Override
public void load(ByteProvider provider, LoadSpec loadSpec, List<Option> options, Program prog,
		TaskMonitor monitor, MessageLog log) throws IOException {

	if (!prog.getExecutableFormat().equals(PeLoader.PE_NAME)) {
		throw new IOException("Program must be a " + PeLoader.PE_NAME);
	}

	SymbolTable symtab = prog.getSymbolTable();
	AddressSpace space = prog.getAddressFactory().getDefaultAddressSpace();
	List<MapExport> exports = parseExports(provider, log);
	int successCount = 0;
	for (MapExport exp : exports) {
		try {
			symtab.createLabel(space.getAddress(exp.addr), exp.name,
				SourceType.IMPORTED).setPrimary();
			successCount++;
		}
		catch (InvalidInputException e) {
			log.appendMsg(e.getMessage());
		}
	}
	log.appendMsg("Added " + successCount + " symbols.");
}
 

private void doLoad(ByteProvider provider, Program program, TaskMonitor monitor)
		throws LockException, MemoryConflictException, AddressOverflowException,
		CancelledException, DuplicateNameException, IOException {
	AddressFactory af = program.getAddressFactory();
	AddressSpace space = af.getAddressSpace(CONSTANT_POOL);
	Memory memory = program.getMemory();
	alignmentReg = program.getRegister("alignmentPad");

	BinaryReader reader = new BinaryReader(provider, false);
	ClassFileJava classFile = new ClassFileJava(reader);

	Address address = space.getAddress(0);

	// Create a block of memory with just the right size
	memory.createInitializedBlock("_" + provider.getName() + "_", address,
		provider.getInputStream(0), provider.length(), monitor, false);

	createMethodLookupMemoryBlock(program, monitor);
	createMethodMemoryBlocks(program, provider, classFile, monitor);

}
 

@Override
protected boolean loadProgramInto(ByteProvider provider, LoadSpec loadSpec,
		List<Option> options, MessageLog log, Program program, TaskMonitor monitor)
		throws CancelledException, IOException {

	LanguageCompilerSpecPair pair = loadSpec.getLanguageCompilerSpec();
	LanguageID languageID = program.getLanguageID();
	CompilerSpecID compilerSpecID = program.getCompilerSpec().getCompilerSpecID();
	if (!(pair.languageID.equals(languageID) && pair.compilerSpecID.equals(compilerSpecID))) {
		log.appendMsg(provider.getAbsolutePath() +
			" does not have the same language/compiler spec as program " + program.getName());
		return false;
	}
	log.appendMsg("----- Loading " + provider.getAbsolutePath() + " -----");
	load(provider, loadSpec, options, program, monitor, log);
	return true;
}
 

/**
 * Parses the provider looking for PRELINK XML.
 * 
 * @param provider The provider to parse.
 * @param monitor A monitor.
 * @return A list of discovered {@link PrelinkMap}s.  An empty list indicates that the provider
 *   did not represent valid Mach-O PRELINK binary.
 * @throws IOException if there was an IO-related issue.
 * @throws JDOMException if there was a issue parsing the PRELINK XML.
 */
public static List<PrelinkMap> parsePrelinkXml(ByteProvider provider, TaskMonitor monitor)
		throws IOException, JDOMException {

	try {
		MachHeader mainHeader =
			MachHeader.createMachHeader(RethrowContinuesFactory.INSTANCE, provider);
		mainHeader.parse(); // make sure first Mach-O header is valid....

		monitor.setMessage("Parsing PRELINK XML...");
		return new PrelinkParser(mainHeader, provider).parse(monitor);
	}
	catch (NoPreLinkSectionException | MachException e) {
		return Collections.emptyList();
	}
}
 

@Override
public String validateOptions(ByteProvider provider, LoadSpec loadSpec, List<Option> options, Program program) {
	Address baseAddr = null;

	for (Option option : options) {
		String optName = option.getName();
		try {
			if (optName.equals(OPTION_NAME_BASE_ADDRESS)) {
				baseAddr = (Address) option.getValue();
				if (baseAddr == null) {
					return "Invalid base address";
				}
			}
			else if (optName.equals(OPTION_NAME_BLOCK_NAME)) {
				if (!String.class.isAssignableFrom(option.getValueClass())) {
					return OPTION_NAME_BLOCK_NAME + " must be a String";
				}
			}
			else if (optName.equals(OPTION_NAME_IS_OVERLAY)) {
				if (!Boolean.class.isAssignableFrom(option.getValueClass())) {
					return OPTION_NAME_IS_OVERLAY + " must be a boolean";
				}
			}
			else {
				return "Unknown option: " + optName;
			}
		}
		catch (ClassCastException e) {
			return "Invalid type for option: " + optName + " - " + e.getMessage();
		}
	}
	return null;
}
 

@Override
public String validateOptions(ByteProvider provider, LoadSpec loadSpec, List<Option> options, Program program) {
	if (options != null && options.size() > 0) {
		return "GzfLoader takes no options";
	}
	return null;
}
 

public static Program importByUsingBestGuess(ByteProvider provider, DomainFolder programFolder,
		Object consumer, MessageLog messageLog, TaskMonitor monitor) throws IOException,
		CancelledException, DuplicateNameException, InvalidNameException, VersionException {
	List<Program> programs = importFresh(provider, programFolder, consumer, messageLog, monitor,
		LoaderService.ACCEPT_ALL, LoadSpecChooser.CHOOSE_THE_FIRST_PREFERRED, null,
		OptionChooser.DEFAULT_OPTIONS, MultipleProgramsStrategy.ONE_PROGRAM_OR_NULL);
	if (programs != null && programs.size() == 1) {
		return programs.get(0);
	}
	return null;
}
 

/**
 * Constructs a new instance of an new executable.
 * @param factory is the object factory to bundle with the reader
 * @param bp the byte provider
 * @param baseAddr the image base of the executable
 * @throws IOException if an I/O error occurs.
 */
public NewExecutable(GenericFactory factory, ByteProvider bp, SegmentedAddress baseAddr)
		throws IOException {
       reader = new FactoryBundledWithBinaryReader(factory, bp, true);
       dosHeader = DOSHeader.createDOSHeader(reader);

       if (dosHeader.isDosSignature()) {
           try {
			winHeader = new WindowsHeader(reader, baseAddr, (short) dosHeader.e_lfanew());
           }
           catch (InvalidWindowsHeaderException e) {
           }
       }
   }
 

@Override
public List<Option> getDefaultOptions(ByteProvider provider, LoadSpec loadSpec,
		DomainObject domainObject, boolean loadIntoProgram) {
	String blockName = "";
	boolean isOverlay = false;
	Address baseAddr = null;
	if (domainObject instanceof Program) {
		Program program = (Program) domainObject;
		AddressFactory addressFactory = program.getAddressFactory();
		if (addressFactory != null) {
			AddressSpace defaultAddressSpace = addressFactory.getDefaultAddressSpace();
			if (defaultAddressSpace != null) {
				baseAddr = defaultAddressSpace.getAddress(0);
			}
		}
	}

	ArrayList<Option> list = new ArrayList<Option>();

	if (loadIntoProgram) {
		list.add(new Option(OPTION_NAME_IS_OVERLAY, isOverlay));
		list.add(new Option(OPTION_NAME_BLOCK_NAME, blockName));
	}
	else {
		isOverlay = false;
	}
	if (baseAddr == null) {
		list.add(new Option(OPTION_NAME_BASE_ADDRESS, Address.class));
	}
	else {
		list.add(new Option(OPTION_NAME_BASE_ADDRESS, baseAddr));
	}
	return list;
}
 

private static boolean isGDTFile(ByteProvider provider) {
	if (!provider.getName().toLowerCase().endsWith(FileDataTypeManager.SUFFIX)) {
		return false;
	}
	boolean isGDT = false;
	try (InputStream inputStream = provider.getInputStream(0)) {
		isGDT = ItemSerializer.isPackedFile(inputStream);
	}
	catch (IOException e) {
		// ignore
	}
	return isGDT;
}
 

@Override
public boolean analysisWorkerCallback(Program program, Object workerContext, TaskMonitor monitor)
		throws Exception, CancelledException {
	Address address = program.getMinAddress();

	ByteProvider provider = new MemoryByteProvider(program.getMemory(), address);

	LzssCompressionHeader header = new LzssCompressionHeader(provider);

	if (header.getSignature() != LzssConstants.SIGNATURE_COMPRESSION) {
		return false;
	}
	if (header.getCompressionType() != LzssConstants.SIGNATURE_LZSS) {
		return false;
	}

	DataType headerDataType = header.toDataType();

	Data headerData = createData(program, address, headerDataType);

	createFragment(program, headerDataType.getName(), headerData.getMinAddress(),
		headerData.getMaxAddress().add(1));

	changeDataSettings(program, monitor);

	removeEmptyFragments(program);
	return true;
}
 

public static List<Program> importFresh(File file, DomainFolder programFolder, Object consumer,
		MessageLog messageLog, TaskMonitor monitor, Predicate<Loader> loaderFilter,
		LoadSpecChooser loadSpecChooser, String programNameOverride,
		OptionChooser optionChooser, MultipleProgramsStrategy multipleProgramsStrategy)
		throws IOException, CancelledException, DuplicateNameException, InvalidNameException,
		VersionException {
	if (file == null) {
		return null;
	}

	try (ByteProvider provider = new RandomAccessByteProvider(file)) {
		return importFresh(provider, programFolder, consumer, messageLog, monitor, loaderFilter,
			loadSpecChooser, programNameOverride, optionChooser, multipleProgramsStrategy);
	}
}
 

@Override
protected void load(ByteProvider provider, LoadSpec loadSpec, List<Option> options,
		Program program, TaskMonitor monitor, MessageLog log)
		throws IOException, CancelledException {

	boolean performFakeLinking = performFakeLinking(options);

	CoffFileHeader header = new CoffFileHeader(provider);
	header.parse(provider, monitor);

	Map<CoffSectionHeader, Address> sectionsMap = new HashMap<>();
	Map<CoffSymbol, Symbol> symbolsMap = new HashMap<>();

	FileBytes fileBytes = MemoryBlockUtils.createFileBytes(program, provider, monitor);

	int id = program.startTransaction("loading program from COFF");
	boolean success = false;
	try {
		processSectionHeaders(provider, header, program, fileBytes, monitor, log, sectionsMap,
			performFakeLinking);
		processSymbols(header, program, monitor, log, sectionsMap, symbolsMap);
		processEntryPoint(header, program, monitor, log);
		processRelocations(header, program, sectionsMap, symbolsMap, log, monitor);
		success = true;
	}
	catch (AddressOverflowException e) {
		throw new IOException(e);
	}
	finally {
		program.endTransaction(id, success);
	}
}
 

@Override
public OmfArchiveFileSystem create(FSRL containerFSRL, FSRLRoot targetFSRL,
		ByteProvider byteProvider, File containerFile, FileSystemService fsService,
		TaskMonitor monitor) throws IOException, CancelledException {

	OmfArchiveFileSystem fs = new OmfArchiveFileSystem(targetFSRL, byteProvider);
	fs.mount(monitor);
	return fs;
}
 

static void addOptions(List<Option> options, ByteProvider provider, LoadSpec loadSpec)
		throws ElfException, LanguageNotFoundException {

	// NOTE: add-to-program is not supported

	options.add(new Option(PERFORM_RELOCATIONS_NAME, PERFORM_RELOCATIONS_DEFAULT, Boolean.class,
		Loader.COMMAND_LINE_ARG_PREFIX + "-applyRelocations"));

	ElfHeader elf = ElfHeader.createElfHeader(RethrowContinuesFactory.INSTANCE, provider);

	long imageBase = elf.findImageBase();
	if (imageBase == 0 && (elf.isRelocatable() || elf.isSharedObject())) {
		imageBase = elf.is64Bit() ? IMAGE64_BASE_DEFAULT : IMAGE_BASE_DEFAULT;
	}
	Language language = loadSpec.getLanguageCompilerSpec().getLanguage();
	AddressSpace defaultSpace = language.getDefaultSpace();

	String hexValueStr = getBaseAddressOffsetString(imageBase, defaultSpace);
	options.add(new Option(IMAGE_BASE_OPTION_NAME, hexValueStr, String.class,
		Loader.COMMAND_LINE_ARG_PREFIX + "-imagebase"));
	
	if (includeDataImageBaseOption(elf, language)) {
		long minDataImageBase = getRecommendedMinimumDataImageBase(elf, language);
		hexValueStr =
			getBaseAddressOffsetString(minDataImageBase, language.getDefaultDataSpace());
		options.add(new Option(IMAGE_DATA_IMAGE_BASE_OPTION_NAME, hexValueStr, String.class,
			Loader.COMMAND_LINE_ARG_PREFIX + "-dataImageBase"));
	}

	options.add(new Option(INCLUDE_OTHER_BLOCKS, INCLUDE_OTHER_BLOCKS_DEFAULT, Boolean.class,
		Loader.COMMAND_LINE_ARG_PREFIX + "-includeOtherBlocks"));

	options.add(
		new Option(RESOLVE_EXTERNAL_SYMBOLS_OPTION_NAME, RESOLVE_EXTERNAL_SYMBOLS_DEFAULT,
			Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-resolveExternalSymbols"));
}
 

@Override
public List<Option> getDefaultOptions(ByteProvider provider, LoadSpec loadSpec,
		DomainObject domainObject, boolean isLoadIntoProgram) {
	List<Option> list =
		super.getDefaultOptions(provider, loadSpec, domainObject, isLoadIntoProgram);
	
	list.add(new Option(AUTOLOAD_MAPS_OPTION_NAME, true, Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-autoloadMaps"));
	list.add(new Option(ADD_RELOCATIONS_OPTION_NAME, false, Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-saveRelocations"));
	list.add(new Option(ADD_RESERVED_AND_HARDWAREREGISTERS, true, Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-addSystemMemorySections"));
	list.add(new Option(SPECIFY_BINARY_MEM_ADDRESSES, false, Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-specifyFileMemAddrs"));

	return list;
}
 

@Override
public boolean canApply(Program program) {
	try {
		ByteProvider provider =
			new MemoryByteProvider(program.getMemory(),
				program.getAddressFactory().getDefaultAddressSpace());
		new ContainerHeader(provider);
		return true;
	}
	catch (Exception e) {
		return false;
	}
}