Java Code Examples for ghidra.program.model.mem.MemoryBlock#getSize()

private void processSuperReferences(ObjectiveC2_State state) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Super References...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_SUPER_REFS);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
			address);
		address = address.add(state.pointerSize);
	}
}
 

@Override
public void createMapping(int width) {
	if (width <= 0) {
		return;
	}

	blocks = program.getMemory().getBlocks();
	pixels = new int[blocks.length];
	long totalSize = 0;
	for (MemoryBlock block : blocks) {
		totalSize += block.getSize();
	}
	addressesPerPixel = (float) totalSize / (float) width;
	for (int i = 0; i < blocks.length; i++) {
		pixels[i] = Math.round(blocks[i].getSize() / addressesPerPixel);
	}
}
 

private void processSelectorReferences(ObjectiveC2_State state) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Selector References...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_SELECTOR_REFS);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
			address);
		address = address.add(state.pointerSize);
	}
}
 

private void processNonLazyClassReferences(ObjectiveC2_State state) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Non-lazy Class Lists...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_NON_LAZY_CLASS_LIST);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
			address);
		address = address.add(state.pointerSize);
	}
}
 

private void processClassReferences(ObjectiveC2_State state) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Class References...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_CLASS_REFS);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
			address);
		address = address.add(state.pointerSize);
	}
}
 

private void processProtocolReferences(ObjectiveC2_State state) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Protocol References...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_PROTOCOL_REFS);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
			address);
		address = address.add(state.pointerSize);
	}
}
 

private long getNumToSearch(Program program, AddressSetView searchSet) {
	long numAddresses = 0;
	MemoryBlock[] blocks = program.getMemory().getBlocks();
	for (MemoryBlock block : blocks) {
		// check if entire block has anything that is searchable
		if (!block.isInitialized()) {
			continue;
		}
		if (doExecutableBlocksOnly && !block.isExecute()) {
			continue;
		}
		if (searchSet != null && !searchSet.isEmpty() &&
			!searchSet.intersects(block.getStart(), block.getEnd())) {
			continue;
		}
		numAddresses += block.getSize();
	}
	return numAddresses;
}
 

/**
 * Initialize this model using the given block.
 * @param newBlock block that will be expanded
 */
void initialize(MemoryBlock newBlock) {
	this.block = newBlock;
	length = newBlock.getSize();
	startAddr = newBlock.getStart();
	endAddr = newBlock.getEnd();
	blockStart = startAddr;
	message = "";
	listener.stateChanged(null);
}
 

/**
 * Search initialized memory blocks for all patterns(bytes/mask/action).
 * Call associated action for each pattern matched.
 * 
 * @param program to be searched
 * @param searchSet set of bytes to restrict search, if null or empty then search all memory blocks
 * @param monitor allow canceling and reporting of progress
 * 
 * @throws CancelledException if canceled
 */
public void search(Program program, AddressSetView searchSet, TaskMonitor monitor)
		throws CancelledException {
	if (root == null) {
		root = SequenceSearchState.buildStateMachine(patternList);
	}

	numToSearch = getNumToSearch(program, searchSet);
	monitor.setMessage(searchName + " Search");
	monitor.initialize(numToSearch);

	MemoryBlock[] blocks = program.getMemory().getBlocks();
	for (MemoryBlock block : blocks) {
		monitor.setProgress(numSearched);
		// check if entire block has anything that is searchable
		if (!block.isInitialized()) {
			continue;
		}
		if (doExecutableBlocksOnly && !block.isExecute()) {
			continue;
		}
		if (searchSet != null && !searchSet.isEmpty() &&
			!searchSet.intersects(block.getStart(), block.getEnd())) {
			continue;
		}

		try {
			searchBlock(root, program, block, searchSet, monitor);
		}
		catch (IOException e) {
			Msg.error(this, "Unable to scan block " + block.getName() + " for " + searchName);
		}
		numSearched += block.getSize();
	}
}
 

private void processCategoryList(ObjectiveC2_State state, BinaryReader reader) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Category Information...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_CATEGORY_LIST);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		Address categoryAddress =
			ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
				address);
		reader.setPointerIndex(categoryAddress.getOffset());
		ObjectiveC2_Category category = new ObjectiveC2_Category(state, reader);
		category.applyTo();
		address = address.add(state.pointerSize);
	}
}
 

private void processProtocolList(ObjectiveC2_State state, BinaryReader reader) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Protocol Information...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_PROTOCOL_LIST);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);

		Address protocolAddress =
			ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
				address);
		reader.setPointerIndex(protocolAddress.getOffset());

		ObjectiveC2_Protocol protocol = new ObjectiveC2_Protocol(state, reader);
		Namespace namespace =
			ObjectiveC1_Utilities.createNamespace(state.program,
				ObjectiveC1_Constants.NAMESPACE, "Protocols", protocol.getName());
		protocol.applyTo(namespace);
		address = address.add(state.pointerSize);
	}
}
 

private void processClassList(ObjectiveC2_State state, BinaryReader reader) throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Class Information...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_CLASS_LIST);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / state.pointerSize;

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);

		Address classAddress =
			ObjectiveC1_Utilities.createPointerAndReturnAddressBeingReferenced(state.program,
				address);
		reader.setPointerIndex(classAddress.getOffset());

		ObjectiveC2_Class clazz = new ObjectiveC2_Class(state, reader);
		clazz.applyTo();
		address = address.add(state.pointerSize);
	}
}
 

private void processMessageReferences(ObjectiveC2_State state, BinaryReader reader)
		throws Exception {
	state.monitor.setMessage("Objective-C 2.0 Message References...");

	MemoryBlock block =
		state.program.getMemory().getBlock(ObjectiveC2_Constants.OBJC2_MESSAGE_REFS);
	if (block == null) {
		return;
	}
	ObjectiveC1_Utilities.clear(state, block);

	long count = block.getSize() / ObjectiveC2_MessageReference.SIZEOF(state);

	state.monitor.initialize((int) count);

	Address address = block.getStart();

	for (int i = 0; i < count; ++i) {
		if (state.monitor.isCancelled()) {
			break;
		}
		state.monitor.setProgress(i);
		reader.setPointerIndex(address.getOffset());
		ObjectiveC2_MessageReference messageRef =
			new ObjectiveC2_MessageReference(state, reader);
		DataType dt = messageRef.toDataType();
		Data messageRefData = state.program.getListing().createData(address, dt);
		Data selData = messageRefData.getComponent(1);
		Object selAddress = selData.getValue();
		Data selStringData = state.program.getListing().getDataAt((Address) selAddress);
		Object selString = selStringData.getValue();
		ObjectiveC1_Utilities.createSymbol(state.program, null, selString + "_" +
			ObjectiveC2_MessageReference.NAME, address);
		address = address.add(dt.getLength());
	}
}
 

ElfSectionHeader(ElfHeader header, MemoryBlock block, int sh_name, long imageBase)
		throws MemoryAccessException {

	this.header = header;
	this.sh_name = sh_name;

	if (block.isInitialized()) {
		sh_type = ElfSectionHeaderConstants.SHT_PROGBITS;
	}
	else {
		sh_type = ElfSectionHeaderConstants.SHT_NOBITS;
	}
	sh_flags = ElfSectionHeaderConstants.SHF_ALLOC | ElfSectionHeaderConstants.SHF_WRITE |
		ElfSectionHeaderConstants.SHF_EXECINSTR;
	sh_addr = block.getStart().getOffset();
	sh_offset = block.getStart().getAddressableWordOffset() - imageBase;
	sh_size = block.getSize();
	sh_link = 0;
	sh_info = 0;
	sh_addralign = 0;
	sh_entsize = 0;
	name = block.getName();

	data = new byte[(int) sh_size];
	if (block.isInitialized()) {
		block.getBytes(block.getStart(), data);
	}

	modified = true;
}
 

private void processPLT(TaskMonitor monitor) throws CancelledException {

		// TODO: Handle case where PLT is non-executable pointer table

		if (elf.isRelocatable()) {
			return; //relocatable files do not have .PLT sections
		}

		MemoryBlock pltBlock = memory.getBlock(ElfSectionHeaderConstants.dot_plt);
		// TODO: This is a band-aid since there are many PLT implementations and this assumes only one.
		if (pltBlock == null || !pltBlock.isExecute() ||
			pltBlock.getSize() <= ElfConstants.PLT_ENTRY_SIZE) {
			return;
		}

		int skipPointers = ElfConstants.PLT_ENTRY_SIZE;

		// ARM, AARCH64 and others may not store pointers at start of .plt
		if (elf.e_machine() == ElfConstants.EM_ARM || elf.e_machine() == ElfConstants.EM_AARCH64) {
			// TODO: Should be handled by extension
			skipPointers = 0;
		}

		// Process PLT section
		Address minAddress = pltBlock.getStart().add(skipPointers);
		Address maxAddress = pltBlock.getEnd();
		processLinkageTable(ElfSectionHeaderConstants.dot_plt, minAddress, maxAddress, monitor);
	}
 

private void replaceBlock(MemoryBlock block, ByteBuffer buf) throws Exception {
    byte[] bytes = new byte[(int) block.getSize()];
    buf.get(bytes);
    if (!block.isInitialized()) {
        if (block instanceof MemoryBlockDB) {
            ((MemoryBlockDB) block).initializeBlock((byte) 0);
            block.setRead(true);
            block.setWrite(true);
        }
    }
    block.putBytes(block.getStart(), bytes);
}
 

/**
 * Search through bytes of a memory block using the finite state machine -root-
 * Apply any additional rules for matching patterns.
 * 
 * @param program is the Program being searched
 * @param block is the specific block of bytes being searched
 * 
 * @throws IOException exception during read of memory
 * @throws CancelledException canceled search
 */
private void searchBlock(SequenceSearchState rootState, Program program, MemoryBlock block,
		AddressSetView restrictSet, TaskMonitor monitor)
		throws IOException, CancelledException {

	// if no restricted set, make restrict set the full block
	AddressSet doneSet;
	if (restrictSet == null || restrictSet.isEmpty()) {
		doneSet = new AddressSet(block.getStart(), block.getEnd());
	}
	else {
		doneSet = restrictSet.intersectRange(block.getStart(), block.getEnd());
	}

	long numInDoneSet = doneSet.getNumAddresses();
	long numInBlock = block.getSize();

	Address blockStartAddr = block.getStart();

	// pull each range off the restricted set
	long progress = monitor.getProgress();
	AddressRangeIterator addressRanges = doneSet.getAddressRanges();
	long numDone = 0;
	while (addressRanges.hasNext()) {
		monitor.checkCanceled();
		monitor.setMessage(searchName + " Search");
		monitor.setProgress(progress + (long) (numInBlock * ((float) numDone / numInDoneSet)));
		AddressRange addressRange = addressRanges.next();
		long numAddressesInRange = addressRange.getLength();

		ArrayList<Match> mymatches = new ArrayList<>();

		long streamoffset = blockStartAddr.getOffset();

		// Give block a starting/ending point before this address to search
		//    patterns might start before, since they have a pre-pattern
		// TODO: this is dangerous, since pattern might be very big, but the set should be restricted
		//       normally only when we are searching for more matching patterns that had a postrule that didn't satisfy
		//       normally the whole memory blocks will get searched.
		long blockOffset = addressRange.getMinAddress().subtract(blockStartAddr);
		blockOffset = blockOffset - RESTRICTED_PATTERN_BYTE_RANGE;
		if (blockOffset <= 0) {
			// don't go before the block start
			blockOffset = 0;
		}

		// compute number of bytes in the range + 1, and don't search more than that.
		long maxBlockSearchLength =
			addressRange.getMaxAddress().subtract(blockStartAddr) - blockOffset + 1;

		InputStream data = block.getData();
		data.skip(blockOffset);

		rootState.apply(data, maxBlockSearchLength, mymatches, monitor);
		monitor.checkCanceled();

		monitor.setMessage(searchName + " (Examine Matches)");

		// TODO: DANGER there is much offset<-->address calculation here
		//       should be OK, since they are all relative to the block.
		long matchProgress = progress + (long) (numInBlock * ((float) numDone / numInDoneSet));
		for (int i = 0; i < mymatches.size(); ++i) {
			monitor.checkCanceled();
			monitor.setProgress(
				matchProgress + (long) (numAddressesInRange * ((float) i / mymatches.size())));
			Match match = mymatches.get(i);
			Address addr = blockStartAddr.add(match.getMarkOffset() + blockOffset);
			if (!match.checkPostRules(streamoffset + blockOffset)) {
				continue;
			}

			MatchAction[] matchactions = match.getMatchActions();
			preMatchApply(matchactions, addr);
			for (MatchAction matchaction : matchactions) {
				matchaction.apply(program, addr, match);
			}

			postMatchApply(matchactions, addr);
		}

		numDone += numAddressesInRange;
	}
}
 

private List<RegionDescriptor> analyzeSection(MemoryBlock curMemBlock)
		throws MemoryAccessException, AddressOutOfBoundsException, ExceptionHandlerFrameException {

	monitor.setMessage("Analyzing " + curMemBlock.getName() + " section");
	monitor.setShowProgressValue(true);
	monitor.setIndeterminate(false);
	long bytesInBlock = curMemBlock.getSize();
	monitor.initialize(bytesInBlock);

	Address startAddr = curMemBlock.getStart();
	ProgramLocation loc = new ProgramLocation(program, startAddr);
	Address curAddress = loc.getAddress();

	List<RegionDescriptor> regions = new ArrayList<>();


	while (curAddress != null && curAddress.compareTo(curMemBlock.getEnd()) < 0) {

		monitor.setProgress(curAddress.subtract(startAddr));

		/* Get the Common Information Entry (CIE) */
		Cie cie = getCie(curAddress);

		/* Check for the end of the frame record. */
		if (cie.isEndOfFrame()) {
			break;
		}

		curAddress = cie.getNextAddress();

		/* 
		 * Add each Frame Description Entry (FDE) for the current CIE.
		 */
		while (curAddress != null && (curAddress.compareTo(curMemBlock.getEnd()) < 0)) {

			monitor.setProgress(curAddress.subtract(startAddr));

			Address currFdeAddr = curAddress;

			try {

				FrameDescriptionEntry fde = new FrameDescriptionEntry(monitor, program, this);
				RegionDescriptor region = fde.create(curAddress);

				if (fde.isEndOfFrame()) {
					break;
				}

				if (region != null) {
					regions.add(region);
					createFdeComment(curAddress);
					monitor.incrementProgress(1);
				}

				curAddress = fde.getNextAddress(); // This can be null.

			} catch (ExceptionHandlerFrameException efe) {
				// May have run into another CIE.
				curAddress = currFdeAddr;
				break;
			}
		}

		createAugmentationData(regions, cie);
	}
	return regions;
}
 

/**
 * Handle the case where GOT entry offset are computed based upon EBX.  
 * This implementation replaces the old "magic map" which had previously been used.
 * @param elfLoadHelper
 * @param monitor
 * @throws CancelledException
 */
private void processX86Plt(ElfLoadHelper elfLoadHelper, TaskMonitor monitor) throws CancelledException {
	
	// TODO: Does 64-bit have a similar mechanism?

	// TODO: Would be better to use only dynamic table entries since sections may be stripped -
	// the unresolved issue is to determine the length of the PLT area without a section
	
	ElfHeader elfHeader = elfLoadHelper.getElfHeader();
	ElfSectionHeader pltSection = elfHeader.getSection(ElfSectionHeaderConstants.dot_plt);
	if (pltSection == null || !pltSection.isExecutable()) {
		return;
	}
	
	ElfDynamicTable dynamicTable = elfHeader.getDynamicTable();
	if (dynamicTable == null || !dynamicTable.containsDynamicValue(ElfDynamicType.DT_PLTGOT)) {
		return; // avoid NotFoundException which causes issues for importer
	}
	
	Program program = elfLoadHelper.getProgram();
	Memory memory = program.getMemory();
	
	// MemoryBlock pltBlock = getBlockPLT(pltSection);
	MemoryBlock pltBlock = memory.getBlock(pltSection.getNameAsString());
	// TODO: This is a band-aid since there are many PLT implementations and this assumes only one.
	if (pltBlock == null || pltBlock.getSize() <= ElfConstants.PLT_ENTRY_SIZE) {
		return;
	}

	// Paint pltgot base over .plt section to allow thunks to be resolved during analysis
	Register ebxReg = program.getRegister("EBX");
	try {
		long pltgotOffset = elfHeader.adjustAddressForPrelink(dynamicTable.getDynamicValue(
				ElfDynamicType.DT_PLTGOT));
		pltgotOffset = elfLoadHelper.getDefaultAddress(pltgotOffset).getOffset(); // adjusted for image base
		RegisterValue pltgotValue = new RegisterValue(ebxReg, BigInteger.valueOf(pltgotOffset));
		program.getProgramContext().setRegisterValue(pltBlock.getStart(), pltBlock.getEnd(), pltgotValue);
	} catch (NotFoundException | ContextChangeException e) {
		throw new AssertException("unexpected", e);
	}

}
 

private void processPpc64v2PltPointerTable(ElfLoadHelper elfLoadHelper, TaskMonitor monitor)
		throws CancelledException {

	ElfHeader elf = elfLoadHelper.getElfHeader();
	ElfSectionHeader pltSection = elf.getSection(ElfSectionHeaderConstants.dot_plt);
	if (pltSection == null) {
		return;
	}
	Program program = elfLoadHelper.getProgram();
	MemoryBlock pltBlock = program.getMemory().getBlock(pltSection.getNameAsString());
	// TODO: This is a band-aid since there are many PLT implementations and this assumes only one.
	if (pltBlock == null || pltBlock.getSize() <= ElfConstants.PLT_ENTRY_SIZE) {
		return;
	}
	if (pltSection.isExecutable()) {
		return;
	}

	// set pltBlock read-only to permit decompiler simplification
	pltBlock.setWrite(false);

	if (getPpc64ABIVersion(elf) != 2) {
		// TODO: add support for other PLT implementations
		return;
	}

	// TODO: Uncertain

	Address addr = pltBlock.getStart().add(ElfConstants.PLT_ENTRY_SIZE);
	try {
		while (addr.compareTo(pltBlock.getEnd()) < 0) {
			monitor.checkCanceled();
			if (elfLoadHelper.createData(addr, PointerDataType.dataType) == null) {
				break; // stop early if failed to create a pointer
			}
			addr = addr.addNoWrap(8);
		}
	}
	catch (AddressOverflowException e) {
		// ignore
	}

}