├── LICENSE
├── README.md
├── imgs
├── img0.png
├── img1.png
├── img2.png
├── img3.png
├── img4.png
├── img5.png
└── img6.png
├── loaders
└── swf.py
├── plugins
└── klfdb.py
└── procs
└── as3.py
/LICENSE:
--------------------------------------------------------------------------------
1 | GNU GENERAL PUBLIC LICENSE
2 | Version 3, 29 June 2007
3 |
4 | Copyright (C) 2007 Free Software Foundation, Inc.
5 | Everyone is permitted to copy and distribute verbatim copies
6 | of this license document, but changing it is not allowed.
7 |
8 | Preamble
9 |
10 | The GNU General Public License is a free, copyleft license for
11 | software and other kinds of works.
12 |
13 | The licenses for most software and other practical works are designed
14 | to take away your freedom to share and change the works. By contrast,
15 | the GNU General Public License is intended to guarantee your freedom to
16 | share and change all versions of a program--to make sure it remains free
17 | software for all its users. We, the Free Software Foundation, use the
18 | GNU General Public License for most of our software; it applies also to
19 | any other work released this way by its authors. You can apply it to
20 | your programs, too.
21 |
22 | When we speak of free software, we are referring to freedom, not
23 | price. Our General Public Licenses are designed to make sure that you
24 | have the freedom to distribute copies of free software (and charge for
25 | them if you wish), that you receive source code or can get it if you
26 | want it, that you can change the software or use pieces of it in new
27 | free programs, and that you know you can do these things.
28 |
29 | To protect your rights, we need to prevent others from denying you
30 | these rights or asking you to surrender the rights. Therefore, you have
31 | certain responsibilities if you distribute copies of the software, or if
32 | you modify it: responsibilities to respect the freedom of others.
33 |
34 | For example, if you distribute copies of such a program, whether
35 | gratis or for a fee, you must pass on to the recipients the same
36 | freedoms that you received. You must make sure that they, too, receive
37 | or can get the source code. And you must show them these terms so they
38 | know their rights.
39 |
40 | Developers that use the GNU GPL protect your rights with two steps:
41 | (1) assert copyright on the software, and (2) offer you this License
42 | giving you legal permission to copy, distribute and/or modify it.
43 |
44 | For the developers' and authors' protection, the GPL clearly explains
45 | that there is no warranty for this free software. For both users' and
46 | authors' sake, the GPL requires that modified versions be marked as
47 | changed, so that their problems will not be attributed erroneously to
48 | authors of previous versions.
49 |
50 | Some devices are designed to deny users access to install or run
51 | modified versions of the software inside them, although the manufacturer
52 | can do so. This is fundamentally incompatible with the aim of
53 | protecting users' freedom to change the software. The systematic
54 | pattern of such abuse occurs in the area of products for individuals to
55 | use, which is precisely where it is most unacceptable. Therefore, we
56 | have designed this version of the GPL to prohibit the practice for those
57 | products. If such problems arise substantially in other domains, we
58 | stand ready to extend this provision to those domains in future versions
59 | of the GPL, as needed to protect the freedom of users.
60 |
61 | Finally, every program is threatened constantly by software patents.
62 | States should not allow patents to restrict development and use of
63 | software on general-purpose computers, but in those that do, we wish to
64 | avoid the special danger that patents applied to a free program could
65 | make it effectively proprietary. To prevent this, the GPL assures that
66 | patents cannot be used to render the program non-free.
67 |
68 | The precise terms and conditions for copying, distribution and
69 | modification follow.
70 |
71 | TERMS AND CONDITIONS
72 |
73 | 0. Definitions.
74 |
75 | "This License" refers to version 3 of the GNU General Public License.
76 |
77 | "Copyright" also means copyright-like laws that apply to other kinds of
78 | works, such as semiconductor masks.
79 |
80 | "The Program" refers to any copyrightable work licensed under this
81 | License. Each licensee is addressed as "you". "Licensees" and
82 | "recipients" may be individuals or organizations.
83 |
84 | To "modify" a work means to copy from or adapt all or part of the work
85 | in a fashion requiring copyright permission, other than the making of an
86 | exact copy. The resulting work is called a "modified version" of the
87 | earlier work or a work "based on" the earlier work.
88 |
89 | A "covered work" means either the unmodified Program or a work based
90 | on the Program.
91 |
92 | To "propagate" a work means to do anything with it that, without
93 | permission, would make you directly or secondarily liable for
94 | infringement under applicable copyright law, except executing it on a
95 | computer or modifying a private copy. Propagation includes copying,
96 | distribution (with or without modification), making available to the
97 | public, and in some countries other activities as well.
98 |
99 | To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies. Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 |
103 | An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License. If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 |
112 | 1. Source Code.
113 |
114 | The "source code" for a work means the preferred form of the work
115 | for making modifications to it. "Object code" means any non-source
116 | form of a work.
117 |
118 | A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 |
123 | The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form. A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 |
134 | The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities. However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work. For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 |
147 | The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 |
151 | The Corresponding Source for a work in source code form is that
152 | same work.
153 |
154 | 2. Basic Permissions.
155 |
156 | All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met. This License explicitly affirms your unlimited
159 | permission to run the unmodified Program. The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work. This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 |
164 | You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force. You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright. Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 |
175 | Conveying under any other circumstances is permitted solely under
176 | the conditions stated below. Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 |
179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 |
181 | No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 |
187 | When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 |
195 | 4. Conveying Verbatim Copies.
196 |
197 | You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 |
205 | You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 |
208 | 5. Conveying Modified Source Versions.
209 |
210 | You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 |
214 | a) The work must carry prominent notices stating that you modified
215 | it, and giving a relevant date.
216 |
217 | b) The work must carry prominent notices stating that it is
218 | released under this License and any conditions added under section
219 | 7. This requirement modifies the requirement in section 4 to
220 | "keep intact all notices".
221 |
222 | c) You must license the entire work, as a whole, under this
223 | License to anyone who comes into possession of a copy. This
224 | License will therefore apply, along with any applicable section 7
225 | additional terms, to the whole of the work, and all its parts,
226 | regardless of how they are packaged. This License gives no
227 | permission to license the work in any other way, but it does not
228 | invalidate such permission if you have separately received it.
229 |
230 | d) If the work has interactive user interfaces, each must display
231 | Appropriate Legal Notices; however, if the Program has interactive
232 | interfaces that do not display Appropriate Legal Notices, your
233 | work need not make them do so.
234 |
235 | A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit. Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 |
245 | 6. Conveying Non-Source Forms.
246 |
247 | You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 |
252 | a) Convey the object code in, or embodied in, a physical product
253 | (including a physical distribution medium), accompanied by the
254 | Corresponding Source fixed on a durable physical medium
255 | customarily used for software interchange.
256 |
257 | b) Convey the object code in, or embodied in, a physical product
258 | (including a physical distribution medium), accompanied by a
259 | written offer, valid for at least three years and valid for as
260 | long as you offer spare parts or customer support for that product
261 | model, to give anyone who possesses the object code either (1) a
262 | copy of the Corresponding Source for all the software in the
263 | product that is covered by this License, on a durable physical
264 | medium customarily used for software interchange, for a price no
265 | more than your reasonable cost of physically performing this
266 | conveying of source, or (2) access to copy the
267 | Corresponding Source from a network server at no charge.
268 |
269 | c) Convey individual copies of the object code with a copy of the
270 | written offer to provide the Corresponding Source. This
271 | alternative is allowed only occasionally and noncommercially, and
272 | only if you received the object code with such an offer, in accord
273 | with subsection 6b.
274 |
275 | d) Convey the object code by offering access from a designated
276 | place (gratis or for a charge), and offer equivalent access to the
277 | Corresponding Source in the same way through the same place at no
278 | further charge. You need not require recipients to copy the
279 | Corresponding Source along with the object code. If the place to
280 | copy the object code is a network server, the Corresponding Source
281 | may be on a different server (operated by you or a third party)
282 | that supports equivalent copying facilities, provided you maintain
283 | clear directions next to the object code saying where to find the
284 | Corresponding Source. Regardless of what server hosts the
285 | Corresponding Source, you remain obligated to ensure that it is
286 | available for as long as needed to satisfy these requirements.
287 |
288 | e) Convey the object code using peer-to-peer transmission, provided
289 | you inform other peers where the object code and Corresponding
290 | Source of the work are being offered to the general public at no
291 | charge under subsection 6d.
292 |
293 | A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 |
297 | A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling. In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage. For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product. A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 |
310 | "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source. The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 |
318 | If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information. But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 |
329 | The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed. Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 |
337 | Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 |
343 | 7. Additional Terms.
344 |
345 | "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law. If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 |
354 | When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it. (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.) You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 |
361 | Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 |
365 | a) Disclaiming warranty or limiting liability differently from the
366 | terms of sections 15 and 16 of this License; or
367 |
368 | b) Requiring preservation of specified reasonable legal notices or
369 | author attributions in that material or in the Appropriate Legal
370 | Notices displayed by works containing it; or
371 |
372 | c) Prohibiting misrepresentation of the origin of that material, or
373 | requiring that modified versions of such material be marked in
374 | reasonable ways as different from the original version; or
375 |
376 | d) Limiting the use for publicity purposes of names of licensors or
377 | authors of the material; or
378 |
379 | e) Declining to grant rights under trademark law for use of some
380 | trade names, trademarks, or service marks; or
381 |
382 | f) Requiring indemnification of licensors and authors of that
383 | material by anyone who conveys the material (or modified versions of
384 | it) with contractual assumptions of liability to the recipient, for
385 | any liability that these contractual assumptions directly impose on
386 | those licensors and authors.
387 |
388 | All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10. If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term. If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 |
398 | If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 |
403 | Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 |
407 | 8. Termination.
408 |
409 | You may not propagate or modify a covered work except as expressly
410 | provided under this License. Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 |
415 | However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 |
422 | Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 |
429 | Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License. If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 |
435 | 9. Acceptance Not Required for Having Copies.
436 |
437 | You are not required to accept this License in order to receive or
438 | run a copy of the Program. Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance. However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work. These actions infringe copyright if you do
443 | not accept this License. Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 |
446 | 10. Automatic Licensing of Downstream Recipients.
447 |
448 | Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License. You are not responsible
451 | for enforcing compliance by third parties with this License.
452 |
453 | An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations. If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 |
463 | You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License. For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 |
471 | 11. Patents.
472 |
473 | A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based. The
475 | work thus licensed is called the contributor's "contributor version".
476 |
477 | A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version. For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 |
487 | Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 |
492 | In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement). To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 |
499 | If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients. "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 |
513 | If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 |
521 | A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License. You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 |
536 | Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 |
540 | 12. No Surrender of Others' Freedom.
541 |
542 | If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License. If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all. For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 |
552 | 13. Use with the GNU Affero General Public License.
553 |
554 | Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work. The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 |
563 | 14. Revised Versions of this License.
564 |
565 | The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time. Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 |
570 | Each version is given a distinguishing version number. If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation. If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 |
579 | If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 |
584 | Later license versions may give you additional or different
585 | permissions. However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 |
589 | 15. Disclaimer of Warranty.
590 |
591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 |
600 | 16. Limitation of Liability.
601 |
602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 |
612 | 17. Interpretation of Sections 15 and 16.
613 |
614 | If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 |
621 | END OF TERMS AND CONDITIONS
622 |
623 | How to Apply These Terms to Your New Programs
624 |
625 | If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 |
629 | To do so, attach the following notices to the program. It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 |
634 |
635 | Copyright (C)
636 |
637 | This program is free software: you can redistribute it and/or modify
638 | it under the terms of the GNU General Public License as published by
639 | the Free Software Foundation, either version 3 of the License, or
640 | (at your option) any later version.
641 |
642 | This program is distributed in the hope that it will be useful,
643 | but WITHOUT ANY WARRANTY; without even the implied warranty of
644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
645 | GNU General Public License for more details.
646 |
647 | You should have received a copy of the GNU General Public License
648 | along with this program. If not, see .
649 |
650 | Also add information on how to contact you by electronic and paper mail.
651 |
652 | If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 |
655 | Copyright (C)
656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 | This is free software, and you are welcome to redistribute it
658 | under certain conditions; type `show c' for details.
659 |
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License. Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 |
664 | You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | .
668 |
669 | The GNU General Public License does not permit incorporating your program
670 | into proprietary programs. If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library. If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License. But first, please read
674 | .
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ## ActionScript3 IDA Pro
2 |
3 | # [Hex-Rays IDA Pro Plug-In Contest 2018](https://www.hex-rays.com/contests/2018/index.shtml)
4 |
5 | Author: [Boris Larin](https://twitter.com/oct0xor)
6 |
7 | This repository contains the SWF Loader, ActionScript3 processor module, and a debugger assist plugin named KLFDB.
8 |
9 |
10 |
11 |
29 |
30 |
35 |
36 |
47 |
48 |
53 |
54 |
59 |
60 |
)
520 | self.get_method_name_func = Appcall.proto(self.addr["getMethodName"],
521 | "void* __fastcall func(void*, bool);")
522 | return True
523 |
524 | def wait_event(self):
525 |
526 | timeout = time.time() + self.timeout_seconds
527 |
528 | try:
529 | idc.resume_process()
530 |
531 | val = 0
532 | while(val != idc.BREAKPOINT and val != idc.EXCEPTION):
533 | val = idc.wait_for_next_event(idc.WFNE_ANY, 5)
534 |
535 | if (val == idc.LIB_LOADED):
536 | # New library was loaded - maybe our module was rebased?
537 | if (self.base != self.get_base()):
538 | print("Flash module is rebased.")
539 |
540 | if (not self.init()):
541 | print("Re-initialize after rebase is failed.")
542 | return False
543 |
544 | if (time.time() > timeout):
545 |
546 | ret = ask_yn(-1, 'Timeout %d seconds. Would you like to continue execution?' % self.timeout_seconds)
547 |
548 | if (ret == 1):
549 | timeout = time.time() + self.timeout_seconds
550 | else:
551 | return False
552 |
553 | except Exception as e:
554 | return
555 |
556 | return True
557 |
558 | def get_method_name(self, esp):
559 |
560 | stringp = self.get_method_name_func(idc.get_wide_dword(esp + 4), 0)
561 | address = idc.get_wide_dword(stringp + 0x8)
562 | return idc.get_strlit_contents(address, -1, idc.STRTYPE_C)
563 |
564 | def rename_addr(self, addr, name):
565 |
566 | if (not has_user_name(get_full_flags(addr)) and name is not None):
567 | set_name(addr, name, SN_NOCHECK | SN_NOWARN)
568 |
569 | def get_func_end(self, start):
570 |
571 | if (idc.add_func(start)):
572 | return idc.find_func_end(start)
573 |
574 | ea = start
575 | while (idc.get_wide_byte(ea) != 0xCC):
576 | idc.create_insn(ea)
577 | ea += idc.get_item_size(ea)
578 |
579 | if (ea - start > self.jit_max_size):
580 | return 0
581 |
582 | return ea
583 |
584 | def get_stack_vars(self, start, end):
585 |
586 | stackvars = {}
587 |
588 | ea = start
589 | while (ea < end):
590 |
591 | if ("ebp" in idc.print_operand(ea, 0) and idc.get_operand_type(ea, 1) == idc.o_imm):
592 |
593 | op0 = idc.get_operand_value(ea, 0)
594 | op1 = idc.get_operand_value(ea, 1)
595 |
596 | if (op0 in stackvars):
597 | stackvars[op0]["values"].append(op1)
598 | else:
599 | stackvars[op0] = {"values": [], "hits": 0}
600 |
601 | ea += idc.get_item_size(ea)
602 |
603 | return stackvars
604 |
605 | def get_save_eip(self, method, stackvars):
606 |
607 | for offset in method["instructions"]:
608 | for var in stackvars:
609 | if (offset in stackvars[var]["values"]):
610 | stackvars[var]["hits"] += 1
611 |
612 | return sorted(stackvars.iteritems(), key=lambda (k,v): v['hits'], reverse=True)[0][0]
613 |
614 | def set_jit_info(self, method_id, start):
615 |
616 | end = self.get_func_end(start)
617 |
618 | if (end < start or end - start > self.jit_max_size):
619 | return
620 |
621 | method = next((x for x in self.as3dump if x["id"] == method_id), None)
622 |
623 | if (method is None):
624 | return
625 |
626 | stackvars = self.get_stack_vars(start, end)
627 | save_eip = self.get_save_eip(method, stackvars)
628 |
629 | ea = start
630 | while (ea < end):
631 |
632 | if ("ebp" in idc.print_operand(ea, 0) and idc.get_operand_type(ea, 1) == idc.o_imm):
633 |
634 | op0 = idc.get_operand_value(ea, 0)
635 | op1 = idc.get_operand_value(ea, 1)
636 |
637 | if (op0 == save_eip):
638 | idc.set_cmt(ea, method["instructions"][op1], 0)
639 |
640 | ea += idc.get_item_size(ea)
641 |
642 | def get_native_function(self):
643 |
644 | ecx = idc.get_reg_value("ECX")
645 | esp = idc.get_reg_value("ESP")
646 |
647 | method_name = self.get_method_name(esp)
648 |
649 | if (idc.get_wide_byte(idc.get_wide_dword(ecx + 8) + 0x38) != 0):
650 | function = idc.get_wide_dword(idc.get_wide_dword(esp + 4) + 0x28)
651 | else:
652 | function = idc.get_wide_dword(idc.get_wide_dword(esp + 4) + 0x24)
653 |
654 | print("Resolved native function: 0x%x - %s" % (function, method_name))
655 |
656 | if ((method_name not in self.ignore and not self.ignore_all) or
657 | (method_name in self.debug_if_equals) or
658 | (any(x for x in self.debug_if_contains if method_name is not None and x in method_name))):
659 | self.traced.append({"name": method_name, "ea": function, "type": "native", "hit": 0})
660 | idc.add_bpt(function)
661 |
662 | def get_jit_function(self):
663 |
664 | esp = idc.get_reg_value("ESP")
665 |
666 | method_name = self.get_method_name(esp)
667 | function = idc.get_wide_dword(esp + 8)
668 |
669 | method_id = idc.get_wide_dword(idc.get_wide_dword(esp + 4) + 0x20)
670 | abc_info_pos = idc.get_wide_dword(idc.get_wide_dword(esp + 4) + 0x1C)
671 | method_info = get_qword(abc_info_pos) + get_qword(abc_info_pos + 8)
672 |
673 | if (self.as3dump != []):
674 |
675 | method = next((x for x in self.as3dump if x["id"] == method_id), None)
676 |
677 | if (method is not None and method["info"] == method_info):
678 | method_name = method["name"]
679 | self.set_jit_info(method_id, function)
680 |
681 | print("Resolved jit function: 0x%x - %s" % (function, method_name))
682 |
683 | self.rename_addr(function, method_name)
684 |
685 | if ((method_name not in self.ignore and not self.ignore_all) or
686 | (method_name in self.debug_if_equals) or
687 | (any(x for x in self.debug_if_contains if method_name is not None and x in method_name))):
688 | self.traced.append({"name": method_name, "ea": function, "type": "jit", "hit": 0})
689 | idc.add_bpt(function)
690 |
691 | def get_interpreted_function(self, eip):
692 |
693 | if (eip == self.addr["setInterp"]):
694 |
695 | esp = idc.get_reg_value("ESP")
696 | self.method_name = self.get_method_name(esp)
697 |
698 | self.is_interpreted_state = True
699 |
700 | elif (eip == self.addr["setInterpRet"] and self.is_interpreted_state):
701 |
702 | function = idc.get_reg_value("EAX")
703 |
704 | print("Resolved interpreted function: 0x%x - %s" % (function, self.method_name))
705 |
706 | if ((self.method_name not in self.ignore and not self.ignore_all) or
707 | (self.method_name in self.debug_if_equals) or
708 | (any(x for x in self.debug_if_contains if self.method_name is not None and x in self.method_name))):
709 | self.traced.append({"name": self.method_name, "ea": function, "type": "interp", "hit": 0})
710 | idc.add_bpt(function)
711 |
712 | self.is_interpreted_state = False
713 |
714 | def force_save_eip_generation(self, eip):
715 |
716 | if (eip == self.addr["writePrologue"] and self.save_eip):
717 |
718 | self.is_write_prologue_state = True
719 |
720 | elif (eip == self.addr["hasReachableExceptionsRet"] and self.save_eip and self.is_write_prologue_state):
721 |
722 | idc.set_reg_value(1, "EAX")
723 | self.is_write_prologue_state = False
724 |
725 | def stop_execution(self, eip, break_on_next):
726 |
727 | function = next((x for x in self.traced if x["ea"] == eip), None)
728 |
729 | if (function is not None):
730 |
731 | function["hit"] += 1
732 |
733 | print("[*] Executing %s" % function["name"])
734 |
735 | if (function["hit"] == self.max_hit_count):
736 |
737 | ret = ask_yn(-1, 'Function "%s" was hit %d times. Would you like to exclude it from trace list?' % (function["name"], self.max_hit_count))
738 |
739 | if (ret == 1):
740 |
741 | if (function["name"]):
742 | self.ignore_appended.append(function["name"])
743 |
744 | idc.del_bpt(function["ea"])
745 |
746 | # Check if we want to debug it
747 |
748 | if (break_on_next):
749 | return True
750 |
751 | if (function["name"] is not None):
752 |
753 | if (function["name"] in self.debug_if_equals):
754 | return True
755 |
756 | if (any(x for x in self.debug_if_contains if x in function["name"])):
757 | return True
758 |
759 | return False
760 |
761 | return True
762 |
763 | def handler(self, break_on_next = False):
764 |
765 | if (not self.init()):
766 | return False
767 |
768 | timeout = time.time() + self.timeout_seconds
769 |
770 | while(self.wait_event()):
771 |
772 | eip = idc.get_reg_value("EIP")
773 |
774 | if (eip == self.addr["verifyNative"]):
775 | self.get_native_function()
776 |
777 | elif (eip == self.addr["setJit"]):
778 | self.get_jit_function()
779 |
780 | elif (eip == self.addr["setInterp"] or eip == self.addr["setInterpRet"]):
781 | self.get_interpreted_function(eip)
782 |
783 | elif (eip == self.addr["writePrologue"] or eip == self.addr["hasReachableExceptionsRet"]):
784 | self.force_save_eip_generation(eip)
785 |
786 | elif (self.stop_execution(eip, break_on_next)):
787 | break
788 |
789 | if (time.time() > timeout):
790 |
791 | ret = ask_yn(-1, 'Timeout %d seconds. Would you like to continue execution?' % self.timeout_seconds)
792 |
793 | if (ret == 1):
794 | timeout = time.time() + self.timeout_seconds
795 | else:
796 | return False
797 |
798 | return True
799 |
800 | def load_as3_dump(self):
801 |
802 | path = ask_file(0, "*.map", "Load listing")
803 |
804 | if (path is None):
805 | return False
806 |
807 | file = open(path, "rb")
808 | data = file.read()
809 | file.close()
810 |
811 | self.as3dump = cPickle.loads(data)
812 |
813 | self.debug_selected = []
814 | self.debug_appended = []
815 | self.ignore_selected = []
816 | self.ignore_appended = []
817 | self.ignore_all = False
818 |
819 | self.store_data()
820 |
821 | return True
822 |
823 | def clear_as3_dump(self):
824 |
825 | ret = ask_yn(-1, "This operation will remove map data. Are you sure?")
826 |
827 | if (ret == 1):
828 |
829 | self.as3dump = []
830 | self.debug_selected = []
831 | self.debug_appended = []
832 | self.ignore_selected = []
833 | self.ignore_appended = []
834 | self.ignore_all = False
835 |
836 | self.store_data()
837 |
838 | return True
839 |
840 | return False
841 |
842 | def debug_list(self):
843 |
844 | if (self.as3dump == []):
845 | self.load_as3_dump()
846 |
847 | app = QWidget()
848 |
849 | self.debug_selected, self.debug_appended = DebugListDialog.get_selected(
850 | self.as3dump, self.debug_selected, self.debug_appended)
851 |
852 | if (self.debug_selected == []):
853 | return False
854 | else:
855 | self.store_data()
856 | return True
857 |
858 | def ignore_list(self):
859 |
860 | app = QWidget()
861 |
862 | self.ignore_selected, self.ignore_appended, self.ignore_all = IgnoreListDialog.get_selected(
863 | self.ignore_selected, self.ignore_appended, self.ignore_all)
864 |
865 | if (self.ignore_selected == []):
866 | return False
867 | else:
868 | self.store_data()
869 | return True
870 |
871 | class KlfdbHundler(action_handler_t):
872 |
873 | def __init__(self):
874 | action_handler_t.__init__(self)
875 |
876 | def activate(self, ctx):
877 | global klfdb
878 |
879 | # Try to load stored data right before plugin usage
880 | if (not klfdb.data_loaded):
881 | klfdb.load_data()
882 | klfdb.data_loaded = True
883 |
884 | if (ctx.action == 'klfdb:run'):
885 | if (klfdb.debug_selected == []):
886 | if (not klfdb.debug_list()):
887 | return False
888 |
889 | return klfdb.handler()
890 |
891 | elif (ctx.action == 'klfdb:runnext'):
892 | return klfdb.handler(break_on_next = True)
893 |
894 | elif (ctx.action == 'klfdb:delbpts'):
895 | return klfdb.cleanup_breakpoints()
896 |
897 | elif (ctx.action == 'klfdb:setbpts'):
898 | return klfdb.debug_list()
899 |
900 | elif (ctx.action == 'klfdb:ignore'):
901 | return klfdb.ignore_list()
902 |
903 | elif (ctx.action == 'klfdb:loadmap'):
904 | return klfdb.load_as3_dump()
905 |
906 | elif (ctx.action == 'klfdb:delmap'):
907 | return klfdb.clear_as3_dump()
908 |
909 | else:
910 | return False
911 |
912 | def update(self, ctx):
913 |
914 | if (idc.get_inf_attr(idc.INF_PROCNAME) != "metapc"):
915 | return AST_DISABLE
916 |
917 | if (ctx.action == 'klfdb:run'):
918 | if (idc.get_process_state() == idc.DSTATE_SUSP):
919 | return AST_ENABLE
920 | return AST_DISABLE
921 |
922 | elif (ctx.action == 'klfdb:runnext'):
923 | if (idc.get_process_state() == idc.DSTATE_SUSP):
924 | return AST_ENABLE
925 | return AST_DISABLE
926 |
927 | elif (ctx.action == 'klfdb:delbpts'):
928 | return AST_ENABLE
929 |
930 | elif (ctx.action == 'klfdb:setbpts'):
931 | return AST_ENABLE
932 |
933 | elif (ctx.action == 'klfdb:ignore'):
934 | return AST_ENABLE
935 |
936 | elif (ctx.action == 'klfdb:loadmap'):
937 | return AST_ENABLE
938 |
939 | elif (ctx.action == 'klfdb:delmap'):
940 | return AST_ENABLE
941 |
942 | return AST_DISABLE
943 |
944 | def create_action_menu(self, handler, name, menupath, label, shortcut = None):
945 |
946 | if (shortcut):
947 | register_action(action_desc_t(name, label, handler, shortcut))
948 | else:
949 | register_action(action_desc_t(name, label, handler))
950 |
951 | attach_action_to_menu(menupath, name, SETMENU_APP)
952 |
953 | def add_menu_items(self):
954 |
955 | handler = self.KlfdbHundler()
956 | path = 'Edit/Klfdb/'
957 | self.create_action_menu(handler, 'klfdb:run', path, 'Run', 'Ctrl+Shift+F9')
958 | self.create_action_menu(handler, 'klfdb:runnext', path, 'Run to next function', 'Ctrl+Alt+F9')
959 | self.create_action_menu(handler, 'klfdb:delbpts', path, 'Remove trace breakpoints')
960 | self.create_action_menu(handler, 'klfdb:setbpts', path, 'Set breakpoints on ...')
961 | self.create_action_menu(handler, 'klfdb:ignore', path, 'Ignore traced function ...')
962 | self.create_action_menu(handler, 'klfdb:loadmap', path, 'Load new map file')
963 | self.create_action_menu(handler, 'klfdb:delmap', path, 'Remove map data')
964 |
965 | class klfdb_plugin_t(idaapi.plugin_t):
966 | flags = idaapi.PLUGIN_UNL
967 | comment = "Kaspersky Lab Flash Debugger Plugin"
968 |
969 | help = comment
970 | wanted_name = "Klfdb"
971 | wanted_hotkey = ""
972 |
973 | initialized = False
974 |
975 | def init(self):
976 |
977 | global klfdb
978 |
979 | if (not self.initialized):
980 | klfdb = Klfdb()
981 | klfdb.add_menu_items()
982 | initialized = True
983 |
984 | return idaapi.PLUGIN_OK
985 |
986 | def run(self, arg):
987 | print('Klfdb initialized. Go to "Edit\\Klfdb\\..."')
988 | return
989 |
990 | def term(self):
991 | return
992 |
993 | def PLUGIN_ENTRY():
994 | return klfdb_plugin_t()
995 |
--------------------------------------------------------------------------------
/procs/as3.py:
--------------------------------------------------------------------------------
1 | # Adobe Flash ActionScript3 processor module
2 | #
3 | # Copyright (C) 2018 Kaspersky Lab
4 | #
5 | # This program is free software: you can redistribute it and/or modify
6 | # it under the terms of the GNU General Public License as published by
7 | # the Free Software Foundation, either version 3 of the License, or
8 | # (at your option) any later version.
9 | # This program is distributed in the hope that it will be useful,
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 | # GNU General Public License for more details.
13 | # You should have received a copy of the GNU General Public License
14 | # along with this program. If not, see .
15 |
16 | import idaapi
17 | import idc
18 | from ida_idp import *
19 | from ida_bytes import *
20 | from ida_auto import *
21 | from ida_name import *
22 | from ida_lines import *
23 | from ida_xref import *
24 | from ida_ua import *
25 | from ida_segment import *
26 | from ida_problems import *
27 | from PyQt5 import QtWidgets
28 | import cPickle
29 | import string
30 | import struct
31 |
32 | class ConstKind:
33 |
34 | CONSTANT_Void = 0x00
35 | CONSTANT_Utf8 = 0x01
36 | CONSTANT_Float = 0x02
37 | CONSTANT_Int = 0x03
38 | CONSTANT_UInt = 0x04
39 | CONSTANT_PrivateNs = 0x05
40 | CONSTANT_Double = 0x06
41 | CONSTANT_Qname = 0x07
42 | CONSTANT_Namespace = 0x08
43 | CONSTANT_Multiname = 0x09
44 | CONSTANT_False = 0x0A
45 | CONSTANT_True = 0x0B
46 | CONSTANT_Null = 0x0C
47 | CONSTANT_QnameA = 0x0D
48 | CONSTANT_MultinameA = 0x0E
49 | CONSTANT_RTQname = 0x0F
50 | CONSTANT_RTQnameA = 0x10
51 | CONSTANT_RTQnameL = 0x11
52 | CONSTANT_RTQnameLA = 0x12
53 | CONSTANT_NamespaceSet = 0x15
54 | CONSTANT_PackageNamespace = 0x16
55 | CONSTANT_PackageInternalNs = 0x17
56 | CONSTANT_ProtectedNamespace = 0x18
57 | CONSTANT_ExplicitNamespace = 0x19
58 | CONSTANT_StaticProtectedNs = 0x1A
59 | CONSTANT_MultinameL = 0x1B
60 | CONSTANT_MultinameLA = 0x1C
61 | CONSTANT_TypeName = 0x1D
62 | CONSTANT_Float4 = 0x1E
63 |
64 | Names = [
65 | "Void",
66 | "Utf8",
67 | "Decimal",
68 | "Integer",
69 | "UInteger",
70 | "PrivateNamespace",
71 | "Double",
72 | "QName",
73 | "Namespace",
74 | "Multiname",
75 | "False",
76 | "True",
77 | "Null",
78 | "QNameA",
79 | "MultinameA",
80 | "RTQName",
81 | "RTQNameA",
82 | "RTQNameL",
83 | "RTQNameLA",
84 | "",
85 | "",
86 | "Namespace_Set",
87 | "PackageNamespace",
88 | "PackageInternalNs",
89 | "ProtectedNamespace",
90 | "ExplicitNamespace",
91 | "StaticProtectedNs",
92 | "MultinameL",
93 | "MultinameLA",
94 | "TypeName",
95 | "Float4",
96 | ]
97 |
98 | class MethodFlags:
99 |
100 | NEED_ARGUMENTS = 0x01
101 | NEED_ACTIVATION = 0x02
102 | NEED_REST = 0x04
103 | HAS_OPTIONAL = 0x08
104 | IGNORE_REST = 0x10
105 | NATIVE = 0x20
106 | SETS_DXNS = 0x40
107 | HAS_PARAM_NAMES = 0x80
108 |
109 | Names = [
110 | "NEED_ARGUMENTS",
111 | "NEED_ACTIVATION",
112 | "NEED_REST",
113 | "HAS_OPTIONAL",
114 | "IGNORE_REST",
115 | "NATIVE",
116 | "SETS_DXNS",
117 | "HAS_PARAM_NAMES"
118 | ]
119 |
120 | class InstanceFlags:
121 |
122 | CONSTANT_ClassSealed = 0x01
123 | CONSTANT_ClassFinal = 0x02
124 | CONSTANT_ClassInterface = 0x04
125 | CONSTANT_ClassProtectedNs = 0x08
126 |
127 | class TraitKind:
128 |
129 | TRAIT_Slot = 0x00
130 | TRAIT_Method = 0x01
131 | TRAIT_Getter = 0x02
132 | TRAIT_Setter = 0x03
133 | TRAIT_Class = 0x04
134 | TRAIT_Function = 0x05
135 | TRAIT_Const = 0x06
136 |
137 | Names = [
138 | "slot",
139 | "method",
140 | "getter",
141 | "setter",
142 | "class",
143 | "function",
144 | "const"
145 | ]
146 |
147 | class TraitAttributes:
148 |
149 | ATTR_Final = 0x10
150 | ATTR_Override = 0x20
151 | ATTR_Metadata = 0x40
152 |
153 | class OperandType:
154 |
155 | CONSTANT_Unknown = 0x00
156 | CONSTANT_ByteImm = 0x01
157 | CONSTANT_UByteImm = 0x02
158 | CONSTANT_IntImm = 0x03
159 | CONSTANT_UIntImm = 0x04
160 | CONSTANT_Int = 0x05
161 | CONSTANT_UInt = 0x06
162 | CONSTANT_Double = 0x07
163 | CONSTANT_String = 0x08
164 | CONSTANT_Namespace = 0x09
165 | CONSTANT_Multiname = 0x10
166 | CONSTANT_Class = 0x11
167 | CONSTANT_Method = 0x12
168 | CONSTANT_Label = 0x13
169 | CONSTANT_DefaultLabel = 0x14
170 | CONSTANT_LabelsList = 0x15
171 |
172 | class Reader:
173 |
174 | pos = 0
175 |
176 | @staticmethod
177 | def read_byte(insn=None):
178 |
179 | if (insn):
180 | b = insn.get_next_byte()
181 | else:
182 | b = idc.get_wide_byte(Reader.pos)
183 | Reader.pos += 1
184 | return b
185 |
186 | @staticmethod
187 | def read_encoded_u32(insn=None):
188 |
189 | value = 0
190 | for i in xrange(5):
191 |
192 | b = Reader.read_byte(insn)
193 |
194 | value |= (b & 0x7F) << (7 * i)
195 |
196 | if not (b & 0x80):
197 | break
198 |
199 | return value
200 |
201 | @staticmethod
202 | def read_s24(insn=None):
203 |
204 | b = Reader.read_byte(insn)
205 | value = b
206 | b = Reader.read_byte(insn)
207 | value |= b << 8
208 | b = Reader.read_byte(insn)
209 |
210 | value |= b << 0x10
211 |
212 | if (value & 0x00800000):
213 | value |= 0xFF000000
214 |
215 | return value
216 |
217 | @staticmethod
218 | def get_array_count():
219 | return Reader.read_encoded_u32()
220 |
221 | class Tag:
222 |
223 | def __init__(self):
224 | self.start = 0
225 | self.tag_code = 0
226 | self.tag_length = 0
227 | self.data_length = 0
228 | self.flags = 0
229 | self.name = ""
230 | self.minor_version = 0
231 | self.major_version = 0
232 |
233 | def find(self):
234 |
235 | ea = idc.get_first_seg()
236 |
237 | tags = []
238 | while (ea != ida_idaapi.BADADDR):
239 | if (idc.get_segm_name(ea) == "DoABC"):
240 | name = idc.get_strlit_contents(ea + 0xA)
241 | tags.append("%d - %s" % (ea, name))
242 |
243 | ea = idc.get_next_seg(ea)
244 |
245 | if (tags == []):
246 | return False
247 |
248 | if (len(tags) > 1):
249 | app = QtWidgets.QWidget()
250 | ea, ok = QtWidgets.QInputDialog.getItem(app, "Select DoABC tag",
251 | "List of DoABC tags",
252 | tags, 0, False)
253 |
254 | if (ea and ok):
255 | ea = long(ea.split()[0])
256 | else:
257 | return False
258 |
259 | else:
260 | ea = long(tags[0].split()[0])
261 |
262 | Reader.pos = ea
263 |
264 | return True
265 |
266 | def parse(self):
267 |
268 | self.start = Reader.pos
269 |
270 | tag_code_and_length = idc.get_wide_word(Reader.pos)
271 | Reader.pos += 2
272 |
273 | self.tag_code = tag_code_and_length >> 6
274 | self.tag_length = tag_code_and_length & 0x3F
275 |
276 | self.data_length = idc.get_wide_dword(Reader.pos)
277 | Reader.pos += 4
278 |
279 | if (self.tag_code != 0x48): # DoABC1
280 |
281 | self.flags = idc.get_wide_dword(Reader.pos)
282 | Reader.pos += 4
283 |
284 | self.name = idc.get_strlit_contents(Reader.pos)
285 |
286 | if (self.name is not None):
287 | Reader.pos += len(self.name)
288 |
289 | Reader.pos += 1
290 |
291 | self.minor_version = idc.get_wide_word(Reader.pos)
292 | Reader.pos += 2
293 |
294 | self.major_version = idc.get_wide_word(Reader.pos)
295 | Reader.pos += 2
296 |
297 | class ConstantPool:
298 |
299 | def __init__(self):
300 |
301 | self.abc_ints = [0]
302 | self.abc_uints = [0]
303 | self.abc_doubles = [0]
304 | self.abc_strings = ["null"]
305 | self.abc_namespaces = []
306 | self.abc_namespace_sets = []
307 | self.abc_multinames = []
308 | self.abc_methods = []
309 | self.abc_metadata = []
310 | self.abc_instances = []
311 | self.abc_scripts = []
312 | self.abc_bodies = []
313 |
314 | def parse_integers(self):
315 |
316 | start = Reader.pos
317 | idc.set_name(Reader.pos, "cpool_ints")
318 |
319 | count = Reader.get_array_count()
320 |
321 | for i in xrange(1, count, 1):
322 | self.abc_ints.append(Reader.read_encoded_u32())
323 |
324 | create_byte(start, Reader.pos - start)
325 |
326 | def parse_uintegers(self):
327 |
328 | start = Reader.pos
329 | idc.set_name(Reader.pos, "cpool_uints")
330 |
331 | count = Reader.get_array_count()
332 |
333 | for i in xrange(1, count, 1):
334 | self.abc_uints.append(Reader.read_encoded_u32())
335 |
336 | create_byte(start, Reader.pos - start)
337 |
338 | def parse_doubles(self):
339 |
340 | start = Reader.pos
341 | idc.set_name(Reader.pos, "cpool_doubles")
342 |
343 | count = Reader.get_array_count()
344 |
345 | for i in xrange(1, count, 1):
346 | self.abc_doubles.append(idc.get_qword(Reader.pos))
347 | Reader.pos += 8
348 |
349 | create_byte(start, Reader.pos - start)
350 |
351 | def parse_strings(self):
352 |
353 | idc.set_name(Reader.pos, "cpool_strings")
354 |
355 | count = Reader.get_array_count()
356 |
357 | for i in xrange(1, count, 1):
358 |
359 | size = Reader.read_encoded_u32()
360 |
361 | start = Reader.pos
362 |
363 | string = ""
364 | for i in xrange(size):
365 | string += chr(Reader.read_byte())
366 |
367 | self.abc_strings.append(string)
368 |
369 | create_strlit(start, size, idc.STRTYPE_C)
370 |
371 | def parse_namespaces(self):
372 |
373 | start = Reader.pos
374 | idc.set_name(Reader.pos, "cpool_namespaces")
375 |
376 | self.abc_namespaces.append({"kind": 0, "name": 0})
377 |
378 | count = Reader.get_array_count()
379 |
380 | for i in xrange(1, count, 1):
381 | kind = Reader.read_byte()
382 | name = Reader.read_encoded_u32()
383 | self.abc_namespaces.append({"kind": kind, "name": name})
384 |
385 | create_byte(start, Reader.pos - start)
386 |
387 | def parse_namespace_sets(self):
388 |
389 | start = Reader.pos
390 | idc.set_name(Reader.pos, "cpool_nsets")
391 |
392 | self.abc_namespace_sets.append([0])
393 |
394 | count = Reader.get_array_count()
395 |
396 | for i in xrange(1, count, 1):
397 |
398 | namespace_count = Reader.get_array_count()
399 | offsets = []
400 |
401 | for j in xrange(namespace_count):
402 | offsets.append(Reader.read_encoded_u32())
403 |
404 | self.abc_namespace_sets.append(offsets)
405 |
406 | create_byte(start, Reader.pos - start)
407 |
408 | def parse_multinames(self):
409 |
410 | start = Reader.pos
411 | idc.set_name(Reader.pos, "cpool_multinames")
412 |
413 | self.abc_multinames.append({})
414 |
415 | count = Reader.get_array_count()
416 |
417 | for i in xrange(1, count, 1):
418 |
419 | kind = Reader.read_byte()
420 |
421 | if (kind == ConstKind.CONSTANT_Qname or kind == ConstKind.CONSTANT_QnameA):
422 | ns = Reader.read_encoded_u32()
423 | name = Reader.read_encoded_u32()
424 | self.abc_multinames.append({"kind": kind, "name": name, "value": ns})
425 |
426 | elif (kind == ConstKind.CONSTANT_RTQname or kind == ConstKind.CONSTANT_RTQnameA):
427 | name = Reader.read_encoded_u32()
428 | self.abc_multinames.append({"kind": kind, "name": name})
429 |
430 | elif (kind == ConstKind.CONSTANT_RTQnameL or kind == ConstKind.CONSTANT_RTQnameLA):
431 | self.abc_multinames.append({"kind": kind})
432 |
433 | elif (kind == ConstKind.CONSTANT_Multiname or kind == ConstKind.CONSTANT_MultinameA):
434 | name = Reader.read_encoded_u32()
435 | ns_set = Reader.read_encoded_u32()
436 | self.abc_multinames.append({"kind": kind, "name": name, "value": ns_set})
437 |
438 | elif (kind == ConstKind.CONSTANT_MultinameL or kind == ConstKind.CONSTANT_MultinameLA):
439 | ns_set = Reader.read_encoded_u32()
440 | self.abc_multinames.append({"kind": kind, "value": ns_set})
441 |
442 | elif (kind == ConstKind.CONSTANT_TypeName):
443 | name = Reader.read_encoded_u32()
444 | param_count = Reader.get_array_count()
445 |
446 | params = []
447 | for j in xrange(param_count):
448 | params.append(Reader.read_encoded_u32())
449 |
450 | self.abc_multinames.append({"kind": kind, "name": name, "value": params})
451 |
452 | else:
453 | raise Exception("parse_multinames: unknown kind")
454 |
455 | create_byte(start, Reader.pos - start)
456 |
457 | def parse_methods(self):
458 |
459 | start = Reader.pos
460 | idc.set_name(Reader.pos, "cpool_methods")
461 |
462 | count = Reader.get_array_count()
463 |
464 | for i in xrange(count):
465 |
466 | pos = Reader.pos
467 |
468 | param_count = Reader.read_encoded_u32()
469 | return_type = Reader.read_encoded_u32()
470 |
471 | params = []
472 | for j in xrange(param_count):
473 | params.append(Reader.read_encoded_u32())
474 |
475 | name = Reader.read_encoded_u32()
476 | flags = Reader.read_byte()
477 |
478 | options = []
479 | if ((flags & MethodFlags.HAS_OPTIONAL) != 0):
480 |
481 | option_count = Reader.get_array_count()
482 |
483 | for j in xrange(option_count):
484 | value = Reader.read_encoded_u32()
485 | kind = Reader.read_byte()
486 | options.append({"kind": kind, "value": value})
487 |
488 | param_names = []
489 | if ((flags & MethodFlags.HAS_PARAM_NAMES) != 0):
490 |
491 | for j in xrange(param_count):
492 | param_names.append(Reader.read_encoded_u32())
493 |
494 | self.abc_methods.append({"paramtypes": params, "returntype": return_type, "name": name,
495 | "flags": flags, "options": options, "paramnames": param_names,
496 | "pos": pos, "id": i})
497 |
498 | create_byte(start, Reader.pos - start)
499 |
500 | def parse_metadata(self):
501 |
502 | start = Reader.pos
503 | idc.set_name(Reader.pos, "cpool_metadata")
504 |
505 | count = Reader.get_array_count()
506 |
507 | for i in xrange(count):
508 |
509 | name = Reader.read_encoded_u32()
510 | item_count = Reader.get_array_count()
511 |
512 | items = []
513 | for j in xrange(item_count):
514 | key = Reader.read_encoded_u32()
515 | value = Reader.read_encoded_u32()
516 | items.append({"key": key, "value": value})
517 |
518 | self.abc_metadata.append({"name": name, "items": items})
519 |
520 | create_byte(start, Reader.pos - start)
521 |
522 | def parse_traits(self):
523 |
524 | count = Reader.get_array_count()
525 |
526 | traits = []
527 | for i in xrange(count):
528 |
529 | name = Reader.read_encoded_u32()
530 |
531 | tag = Reader.read_byte()
532 | kind = tag & 0x0F
533 | attr = tag & 0xF0
534 |
535 | gen_id = Reader.read_encoded_u32()
536 | gen_index = Reader.read_encoded_u32()
537 |
538 | value_index = 0
539 | value_kind = 0
540 |
541 | if (kind == TraitKind.TRAIT_Slot or kind == TraitKind.TRAIT_Const):
542 | value_index = Reader.read_encoded_u32()
543 | if (value_index != 0):
544 | value_kind = Reader.read_byte()
545 |
546 | metadata = []
547 | if ((attr & TraitAttributes.ATTR_Metadata) != 0):
548 |
549 | metadata_count = Reader.get_array_count()
550 |
551 | for j in xrange(metadata_count):
552 | metadata.append(Reader.read_encoded_u32())
553 |
554 | traits.append({"name": name, "tkind": kind, "attr": attr, "metadata": metadata,
555 | "id": gen_id, "index": gen_index, "value_id": value_index,
556 | "value_kind": value_kind})
557 |
558 | return traits
559 |
560 | def parse_classes(self):
561 |
562 | start = Reader.pos
563 | idc.set_name(Reader.pos, "cpool_classes")
564 |
565 | count = Reader.get_array_count()
566 |
567 | # read instances
568 | for i in xrange(count):
569 |
570 | name = Reader.read_encoded_u32()
571 | super_name = Reader.read_encoded_u32()
572 | flags = Reader.read_byte()
573 |
574 | protected_ns = 0
575 | if ((flags & InstanceFlags.CONSTANT_ClassProtectedNs) != 0):
576 | protected_ns = Reader.read_encoded_u32()
577 |
578 | interface_count = Reader.get_array_count()
579 |
580 | interfaces = []
581 | for j in xrange(interface_count):
582 | interface = Reader.read_encoded_u32()
583 | interfaces.append(interface)
584 |
585 | interface_init = Reader.read_encoded_u32()
586 | interface_traits = self.parse_traits()
587 |
588 | self.abc_instances.append({"name": name, "supername": super_name, "flags": flags,
589 | "protectedns": protected_ns, "interfaces": interfaces,
590 | "iinit": interface_init, "itraits": interface_traits})
591 |
592 | # read classes
593 | for i in xrange(count):
594 |
595 | class_init = Reader.read_encoded_u32()
596 | class_traits = self.parse_traits()
597 |
598 | self.abc_instances[i]["cinit"] = class_init
599 | self.abc_instances[i]["ctraits"] = class_traits
600 |
601 | create_byte(start, Reader.pos - start)
602 |
603 | def parse_scripts(self):
604 |
605 | start = Reader.pos
606 | idc.set_name(Reader.pos, "cpool_scripts")
607 |
608 | count = Reader.get_array_count()
609 |
610 | for i in xrange(count):
611 |
612 | init = Reader.read_encoded_u32()
613 | traits = self.parse_traits()
614 |
615 | self.abc_scripts.append({"sinit": init, "traits": traits})
616 |
617 | create_byte(start, Reader.pos - start)
618 |
619 | def parse_method_bodies(self):
620 |
621 | count = Reader.get_array_count()
622 |
623 | for i in xrange(count):
624 |
625 | start = Reader.pos
626 | idc.set_name(Reader.pos, "cpool_method%d_bodyinfo" % i)
627 |
628 | method = Reader.read_encoded_u32()
629 | max_stack = Reader.read_encoded_u32()
630 | local_count = Reader.read_encoded_u32()
631 | init_scope_depth = Reader.read_encoded_u32()
632 | max_scope_depth = Reader.read_encoded_u32()
633 | code_length = Reader.read_encoded_u32()
634 | code_pos = Reader.pos
635 |
636 | create_byte(start, Reader.pos - start)
637 |
638 | Reader.pos += code_length
639 |
640 | start = Reader.pos
641 | idc.set_name(Reader.pos, "cpool_method%d_exceptions" % i)
642 |
643 | exception_count = Reader.get_array_count()
644 |
645 | exceptions = []
646 | for j in xrange(exception_count):
647 |
648 | exception_from = Reader.read_encoded_u32()
649 | exception_to = Reader.read_encoded_u32()
650 | exception_target = Reader.read_encoded_u32()
651 | exception_type = Reader.read_encoded_u32()
652 | exception_name = Reader.read_encoded_u32()
653 |
654 | exceptions.append({"from": exception_from, "to": exception_to, "target": exception_target,
655 | "type": exception_type, "name": exception_name})
656 |
657 | create_byte(start, Reader.pos - start)
658 |
659 | start = Reader.pos
660 | idc.set_name(Reader.pos, "cpool_method%d_traits" % i)
661 |
662 | traits = self.parse_traits()
663 |
664 | create_byte(start, Reader.pos - start)
665 |
666 | self.abc_bodies.append({"pos": code_pos, "length": code_length, "method": method,
667 | "maxstack": max_stack, "locals": local_count,
668 | "init_depth": init_scope_depth, "max_depth": max_scope_depth,
669 | "exceptions": exceptions, "traits": traits})
670 |
671 | def parse(self):
672 |
673 | self.parse_integers()
674 | self.parse_uintegers()
675 | self.parse_doubles()
676 | self.parse_strings()
677 | self.parse_namespaces()
678 | self.parse_namespace_sets()
679 | self.parse_multinames()
680 | self.parse_methods()
681 | self.parse_metadata()
682 | self.parse_classes()
683 | self.parse_scripts()
684 | self.parse_method_bodies()
685 |
686 | class ABC:
687 |
688 | def __init__(self, cpool):
689 |
690 | self.cpool = cpool
691 |
692 | self.namespaces = []
693 | self.namespace_sets = []
694 | self.multinames = []
695 | self.methods = []
696 | self.metadata = []
697 | self.classes = []
698 | self.instances = []
699 | self.scripts = []
700 |
701 | def get_int(self, index):
702 | return self.cpool.abc_ints[index]
703 |
704 | def get_uint(self, index):
705 | return self.cpool.abc_uints[index]
706 |
707 | def get_double(self, index):
708 | return self.cpool.abc_doubles[index]
709 |
710 | def get_string(self, index):
711 | return self.cpool.abc_strings[index]
712 |
713 | def get_namespace(self, ns):
714 | return '%s("%s")' % (ConstKind.Names[ns["kind"]], ns["name"])
715 |
716 | def get_namespace_set(self, ns_set):
717 |
718 | s = "["
719 | length = len(ns_set)
720 | for i in xrange(length):
721 | s += self.get_namespace(ns_set[i])
722 | if (i < length-1):
723 | s += ", "
724 | s += "]"
725 |
726 | return s
727 |
728 | def get_multiname(self, mn):
729 |
730 | kind = mn["kind"]
731 |
732 | if (kind == ConstKind.CONSTANT_Qname or kind == ConstKind.CONSTANT_QnameA):
733 | name = mn["name"]
734 | namespace = mn["ns"]
735 | s = '%s, "%s"' % (self.get_namespace(namespace), name)
736 |
737 | elif (kind == ConstKind.CONSTANT_RTQname or kind == ConstKind.CONSTANT_RTQnameA):
738 | name = mn["name"]
739 | s = '"%s"' % name
740 |
741 | elif (kind == ConstKind.CONSTANT_Multiname or kind == ConstKind.CONSTANT_MultinameA):
742 | name = mn["name"]
743 | namespace_set = mn["ns_set"]
744 | s = '"%s", %s' % (name, self.get_namespace_set(namespace_set))
745 |
746 | elif (kind == ConstKind.CONSTANT_MultinameL or kind == ConstKind.CONSTANT_MultinameLA):
747 | namespace_set = mn["ns_set"]
748 | s = self.get_namespace_set(namespace_set)
749 |
750 | elif (kind == ConstKind.CONSTANT_TypeName):
751 | name = mn["name"]
752 | params = mn["params"]
753 | s = self.get_multiname(name)
754 | s += "<"
755 | length = len(params)
756 | for i in xrange(length):
757 | self.get_multiname(params[i])
758 | if (i < length-1):
759 | s += ", "
760 | s += ">"
761 |
762 | return "%s(%s)" % (ConstKind.Names[kind], s)
763 |
764 | def get_value(self, value):
765 |
766 | if (value["kind"] == ConstKind.CONSTANT_Int):
767 | s = "%d" % value["value"]
768 |
769 | elif (value["kind"] == ConstKind.CONSTANT_UInt):
770 | s = "%d" % value["value"]
771 |
772 | elif (value["kind"] == ConstKind.CONSTANT_Double):
773 | s = "%g" % struct.unpack(">d", struct.pack(">Q", value["value"]))[0]
774 |
775 | elif (value["kind"] == ConstKind.CONSTANT_Utf8):
776 | s = value["value"]
777 |
778 | elif (value["kind"] == ConstKind.CONSTANT_Namespace or
779 | value["kind"] == ConstKind.CONSTANT_PackageNamespace or
780 | value["kind"] == ConstKind.CONSTANT_PackageInternalNs or
781 | value["kind"] == ConstKind.CONSTANT_ProtectedNamespace or
782 | value["kind"] == ConstKind.CONSTANT_ExplicitNamespace or
783 | value["kind"] == ConstKind.CONSTANT_StaticProtectedNs or
784 | value["kind"] == ConstKind.CONSTANT_PrivateNs):
785 | s = self.get_namespace(value["value"])
786 |
787 | else:
788 | s = ""
789 |
790 | return "%s(%s)" % (ConstKind.Names[value["kind"]], s)
791 |
792 | def convert_namespaces(self):
793 |
794 | for namespace in self.cpool.abc_namespaces:
795 |
796 | kind = namespace["kind"]
797 | name = self.get_string(namespace["name"])
798 |
799 | self.namespaces.append({"kind": kind, "name": name})
800 |
801 | def convert_namespace_sets(self):
802 |
803 | for namespace_set in self.cpool.abc_namespace_sets:
804 |
805 | ns_set = []
806 | for namespace in namespace_set:
807 | ns_set.append(self.namespaces[namespace])
808 |
809 | self.namespace_sets.append(ns_set)
810 |
811 | def convert_multinames(self):
812 |
813 | for multiname in self.cpool.abc_multinames:
814 |
815 | if (multiname == {}):
816 | self.multinames.append({})
817 | continue
818 |
819 | kind = multiname["kind"]
820 |
821 | if (kind == ConstKind.CONSTANT_Qname or kind == ConstKind.CONSTANT_QnameA):
822 | name = self.get_string(multiname["name"])
823 | ns = self.namespaces[multiname["value"]]
824 | self.multinames.append({"kind": kind, "ns": ns, "name": name})
825 |
826 | elif (kind == ConstKind.CONSTANT_RTQname or kind == ConstKind.CONSTANT_RTQnameA):
827 | name = self.get_string(multiname["name"])
828 | self.multinames.append({"kind": kind, "name": name})
829 |
830 | elif (kind == ConstKind.CONSTANT_RTQnameL or kind == ConstKind.CONSTANT_RTQnameLA):
831 | self.multinames.append({"kind": kind})
832 |
833 | elif (kind == ConstKind.CONSTANT_Multiname or kind == ConstKind.CONSTANT_MultinameA):
834 | name = self.get_string(multiname["name"])
835 | ns_set = self.namespace_sets[multiname["value"]]
836 | self.multinames.append({"kind": kind, "name": name, "ns_set": ns_set})
837 |
838 | elif (kind == ConstKind.CONSTANT_MultinameL or kind == ConstKind.CONSTANT_MultinameLA):
839 | ns_set = self.namespace_sets[multiname["value"]]
840 | self.multinames.append({"kind": kind, "ns_set": ns_set})
841 |
842 | elif (kind == ConstKind.CONSTANT_TypeName):
843 | self.multinames.append({"kind": kind})
844 |
845 | def convert_multiname_typenames(self):
846 |
847 | for i in xrange(len(self.cpool.abc_multinames)):
848 |
849 | multiname = self.cpool.abc_multinames[i]
850 |
851 | if (multiname == {}):
852 | continue
853 |
854 | kind = multiname["kind"]
855 |
856 | if (kind == ConstKind.CONSTANT_TypeName):
857 | name = self.multinames[multiname["name"]]
858 |
859 | params = []
860 | for param in multiname["value"]:
861 | params.append(self.multinames[param])
862 |
863 | self.multinames[i]["name"] = name
864 | self.multinames[i]["params"] = params
865 |
866 | def convert_value(self, kind, value):
867 |
868 | if (kind == ConstKind.CONSTANT_Int):
869 | return {"kind": kind, "value": self.get_int(value)}
870 |
871 | elif (kind == ConstKind.CONSTANT_UInt):
872 | return {"kind": kind, "value": self.get_uint(value)}
873 |
874 | elif (kind == ConstKind.CONSTANT_Double):
875 | return {"kind": kind, "value": self.get_double(value)}
876 |
877 | elif (kind == ConstKind.CONSTANT_Utf8):
878 | return {"kind": kind, "value": self.get_string(value)}
879 |
880 | elif (kind == ConstKind.CONSTANT_Namespace or
881 | kind == ConstKind.CONSTANT_PackageNamespace or
882 | kind == ConstKind.CONSTANT_PackageInternalNs or
883 | kind == ConstKind.CONSTANT_ProtectedNamespace or
884 | kind == ConstKind.CONSTANT_ExplicitNamespace or
885 | kind == ConstKind.CONSTANT_StaticProtectedNs or
886 | kind == ConstKind.CONSTANT_PrivateNs):
887 | return {"kind": kind, "value": self.namespaces[value]}
888 |
889 | elif (kind == ConstKind.CONSTANT_True or
890 | kind == ConstKind.CONSTANT_False or
891 | kind == ConstKind.CONSTANT_Null or
892 | kind == ConstKind.CONSTANT_Void):
893 | return {"kind": kind}
894 |
895 | else:
896 | raise Exception("convert_value: unknown kind")
897 |
898 | def convert_methods(self):
899 |
900 | for method in self.cpool.abc_methods:
901 |
902 | params = []
903 | for param in method["paramtypes"]:
904 | params.append(self.multinames[param])
905 |
906 | return_type = self.multinames[method["returntype"]]
907 | name = self.get_string(method["name"])
908 | flags = method["flags"]
909 |
910 | options = []
911 | for option in method["options"]:
912 | options.append(self.convert_value(option["kind"], option["value"]))
913 |
914 | param_names = []
915 | for param_name in method["paramnames"]:
916 | param_names.append(self.get_string(param_name))
917 |
918 | pos = method["pos"]
919 | index = method["id"]
920 |
921 | self.methods.append({"paramtypes": params, "returntype": return_type, "name": name,
922 | "flags": flags, "options": options, "paramnames": param_names,
923 | "pos": pos, "id": index, "refid": "", "body": None})
924 |
925 | def convert_metadata(self):
926 |
927 | for metadata in self.cpool.abc_metadata:
928 |
929 | name = self.get_string(metadata["name"])
930 |
931 | items = []
932 | for item in metadata["items"]:
933 | key = self.get_string(item["key"])
934 | value = self.get_string(item["value"])
935 | items.append({"key": key, "value": value})
936 |
937 | self.metadata.append({"name": name, "items": items})
938 |
939 | def convert_traits(self, traits):
940 |
941 | new_traits = []
942 |
943 | for trait in traits:
944 |
945 | name = self.multinames[trait["name"]]
946 | kind = trait["tkind"]
947 | attr = trait["attr"]
948 |
949 | new_trait = {"name": name, "tkind": kind, "attr": attr}
950 |
951 | if (kind == TraitKind.TRAIT_Slot or kind == TraitKind.TRAIT_Const):
952 | new_trait["slotid"] = trait["id"]
953 | new_trait["type"] = self.multinames[trait["index"]]
954 | new_trait["value"] = self.convert_value(trait["value_kind"], trait["value_id"])
955 |
956 | elif (kind == TraitKind.TRAIT_Class):
957 | new_trait["slotid"] = trait["id"]
958 | new_trait["class"] = self.classes[trait["index"]]
959 |
960 | elif (kind == TraitKind.TRAIT_Function):
961 | new_trait["slotid"] = trait["id"]
962 | new_trait["function"] = self.methods[trait["index"]]
963 |
964 | elif (kind == TraitKind.TRAIT_Method or
965 | kind == TraitKind.TRAIT_Getter or
966 | kind == TraitKind.TRAIT_Setter):
967 | new_trait["dispid"] = trait["id"]
968 | new_trait["method"] = self.methods[trait["index"]]
969 |
970 | else:
971 | raise Exception("convert_traits: unknown kind")
972 |
973 | metadata = []
974 | for entry in trait["metadata"]:
975 | metadata.append(self.metadata[entry])
976 |
977 | new_trait["metadata"] = metadata
978 |
979 | new_traits.append(new_trait)
980 |
981 | return new_traits
982 |
983 | def convert_instances(self):
984 |
985 | for instance in self.cpool.abc_instances:
986 |
987 | name = instance["name"]
988 | super_name = self.multinames[instance["supername"]]
989 | flags = instance["flags"]
990 | protected_ns = self.namespaces[instance["protectedns"]]
991 |
992 | interfaces = []
993 | for interface in instance["interfaces"]:
994 | interfaces.append(self.multinames[interface])
995 |
996 | init = self.methods[instance["iinit"]]
997 | traits = self.convert_traits(instance["itraits"])
998 |
999 | self.instances.append({"name": name, "supername": super_name, "flags": flags,
1000 | "protectedns": protected_ns, "interfaces": interfaces,
1001 | "iinit": init, "traits": traits})
1002 |
1003 | def convert_classes(self):
1004 |
1005 | for i in xrange(len(self.cpool.abc_instances)):
1006 |
1007 | abc_class = self.cpool.abc_instances[i]
1008 |
1009 | init = self.methods[abc_class["cinit"]]
1010 | traits = self.convert_traits(abc_class["ctraits"])
1011 | instance = self.instances[i]
1012 |
1013 | self.classes.append({"cinit": init, "traits": traits, "instance": instance})
1014 |
1015 | def convert_scripts(self):
1016 |
1017 | for script in self.cpool.abc_scripts:
1018 |
1019 | init = self.methods[script["sinit"]]
1020 | traits = self.convert_traits(script["traits"])
1021 |
1022 | self.scripts.append({"sinit": init, "traits": traits})
1023 |
1024 | def convert_method_bodies(self):
1025 |
1026 | for body in self.cpool.abc_bodies:
1027 |
1028 | code_pos = body["pos"]
1029 | code_length = body["length"]
1030 |
1031 | method = self.methods[body["method"]]
1032 | max_stack = body["maxstack"]
1033 | local_count = body["locals"]
1034 | init_scope_depth = body["init_depth"]
1035 | max_scope_depth = body["max_depth"]
1036 |
1037 | exceptions = []
1038 | for exception in body["exceptions"]:
1039 |
1040 | exception_from = exception["from"]
1041 | exception_to = exception["to"]
1042 | exception_target = exception["target"]
1043 | exception_type = self.multinames[exception["type"]]
1044 | exception_name = self.multinames[exception["name"]]
1045 |
1046 | exceptions.append({"from": exception_from, "to": exception_to, "target": exception_target,
1047 | "type": exception_type, "name": exception_name})
1048 |
1049 | traits = self.convert_traits(body["traits"])
1050 |
1051 | new_body = {"pos": code_pos, "length": code_length, "method": method,
1052 | "maxstack": max_stack, "locals": local_count,
1053 | "init_depth": init_scope_depth, "max_depth": max_scope_depth,
1054 | "exceptions": exceptions, "traits": traits}
1055 |
1056 | self.methods[body["method"]]["body"] = new_body
1057 |
1058 | def convert(self):
1059 |
1060 | self.convert_namespaces()
1061 | self.convert_namespace_sets()
1062 | self.convert_multinames()
1063 | self.convert_multiname_typenames()
1064 | self.convert_methods()
1065 | self.convert_metadata()
1066 | self.convert_instances()
1067 | self.convert_classes()
1068 | self.convert_scripts()
1069 | self.convert_method_bodies()
1070 |
1071 | class MultinameStrings:
1072 |
1073 | def __init__(self):
1074 |
1075 | self.names = {}
1076 | self.namespaces = {}
1077 | self.namespace_sets = {}
1078 |
1079 | def get_name_offset(self, name):
1080 | return self.names[name]
1081 |
1082 | def get_namespace_offset(self, ns):
1083 | return self.namespaces[ns]
1084 |
1085 | def get_namespace_set_offset(self, ns_set):
1086 | return self.namespace_sets[ns_set]
1087 |
1088 | def find_last_segment(self):
1089 |
1090 | ea = idc.get_first_seg()
1091 |
1092 | while(idc.get_next_seg(ea) != ida_idaapi.BADADDR):
1093 | ea = idc.get_next_seg(ea)
1094 |
1095 | return ea
1096 |
1097 | def find_last_address(self):
1098 |
1099 | ea = self.find_last_segment()
1100 |
1101 | # check if there are no segments
1102 | if (ea == ida_idaapi.BADADDR):
1103 | ea = 0
1104 |
1105 | # there might be data not mapped to segments
1106 | while(idc.next_addr(ea) != ida_idaapi.BADADDR):
1107 | ea = idc.next_addr(ea)
1108 |
1109 | return ea
1110 |
1111 | def get_multiname_strings(self, abc, mn):
1112 |
1113 | kind = mn["kind"]
1114 |
1115 | if (kind == ConstKind.CONSTANT_Qname or kind == ConstKind.CONSTANT_QnameA):
1116 |
1117 | name = mn["name"]
1118 | ns = abc.get_namespace(mn["ns"])
1119 |
1120 | if (ns not in self.namespaces):
1121 | self.namespaces[ns] = 0
1122 |
1123 | if (name not in self.names):
1124 | self.names[name] = 0
1125 |
1126 | elif (kind == ConstKind.CONSTANT_RTQname or kind == ConstKind.CONSTANT_RTQnameA):
1127 |
1128 | name = mn["name"]
1129 |
1130 | if (name not in self.names):
1131 | self.names[name] = 0
1132 |
1133 | elif (kind == ConstKind.CONSTANT_RTQnameL or kind == ConstKind.CONSTANT_RTQnameLA):
1134 | return
1135 |
1136 | elif (kind == ConstKind.CONSTANT_Multiname or kind == ConstKind.CONSTANT_MultinameA):
1137 |
1138 | name = mn["name"]
1139 | ns_set = abc.get_namespace_set(mn["ns_set"])
1140 |
1141 | if (name not in self.names):
1142 | self.names[name] = 0
1143 |
1144 | if (ns_set not in self.namespace_sets):
1145 | self.namespace_sets[ns_set] = 0
1146 |
1147 | elif (kind == ConstKind.CONSTANT_MultinameL or kind == ConstKind.CONSTANT_MultinameLA):
1148 |
1149 | ns_set = abc.get_namespace_set(mn["ns_set"])
1150 |
1151 | if (ns_set not in self.namespace_sets):
1152 | self.namespace_sets[ns_set] = 0
1153 |
1154 | elif (kind == ConstKind.CONSTANT_TypeName):
1155 |
1156 | name = mn["name"]
1157 | params = mn["params"]
1158 |
1159 | self.get_multiname_strings(abc, name)
1160 |
1161 | length = len(params)
1162 | for i in xrange(length):
1163 | self.get_multiname_strings(abc, params[i])
1164 |
1165 | def get_strings(self, abc):
1166 |
1167 | for mn in abc.multinames:
1168 |
1169 | if (mn == {}):
1170 | continue
1171 |
1172 | self.get_multiname_strings(abc, mn)
1173 |
1174 | def create_strings_segment(self):
1175 |
1176 | buf = ""
1177 |
1178 | addr = self.find_last_address() + 1
1179 |
1180 | for key in self.namespace_sets:
1181 | self.namespace_sets[key] = addr + len(buf)
1182 | buf += key.replace('"', "")[1:-1] + "\x00"
1183 |
1184 | for key in self.namespaces:
1185 |
1186 | ns_set = "[%s]" % key
1187 |
1188 | if (ns_set in self.namespace_sets):
1189 | self.namespaces[key] = self.namespace_sets[ns_set]
1190 | continue
1191 |
1192 | self.namespaces[key] = addr + len(buf)
1193 | buf += key.replace('"', "") + "\x00"
1194 |
1195 | for key in self.names:
1196 | self.names[key] = addr + len(buf)
1197 | buf += key.replace('"', "") + "\x00"
1198 |
1199 | add_segm(0, addr, addr + len(buf), "STRINGS", None)
1200 |
1201 | patch_bytes(addr, buf)
1202 |
1203 | idc.del_items(addr, idc.DELIT_SIMPLE, len(buf))
1204 |
1205 | for key in self.namespaces:
1206 |
1207 | name = key[:-1].split("(")[1][1:-1]
1208 |
1209 | if (name == ""):
1210 | name = "_"
1211 |
1212 | idc.set_name(self.namespaces[key], name, SN_NOCHECK | SN_NOWARN | SN_FORCE)
1213 |
1214 | for key in self.names:
1215 |
1216 | idc.set_name(self.names[key], key, SN_NOCHECK | SN_NOWARN | SN_FORCE)
1217 |
1218 | class Dumper:
1219 |
1220 | @staticmethod
1221 | def make_line(ctx, s):
1222 | ctx.out_line(s)
1223 | ctx.flush_outbuf(0)
1224 |
1225 | @staticmethod
1226 | def dump_string(ctx, abc, index):
1227 | ctx.out_line('"' + abc.get_string(index) + '"', COLOR_STRING)
1228 |
1229 | @staticmethod
1230 | def dump_namespace(ctx, ns):
1231 |
1232 | ctx.out_line(ConstKind.Names[ns["kind"]] + "(", COLOR_KEYWORD)
1233 | ctx.out_line('"' + ns["name"] + '"', COLOR_STRING)
1234 | ctx.out_line(")", COLOR_KEYWORD)
1235 |
1236 | @staticmethod
1237 | def dump_multiname(ctx, op, abc, strings, mn):
1238 |
1239 | kind = mn["kind"]
1240 |
1241 | ctx.out_line(ConstKind.Names[kind] + "(", COLOR_KEYWORD)
1242 |
1243 | if (kind == ConstKind.CONSTANT_Qname or kind == ConstKind.CONSTANT_QnameA):
1244 |
1245 | name = mn["name"]
1246 | namespace = abc.get_namespace(mn["ns"])
1247 |
1248 | ctx.out_name_expr(op, strings.get_namespace_offset(namespace), ida_idaapi.BADADDR)
1249 | ctx.out_line(", ", COLOR_KEYWORD)
1250 | ctx.out_name_expr(op, strings.get_name_offset(name), ida_idaapi.BADADDR)
1251 |
1252 | if (get_first_dref_from(ctx.insn.ea) == ida_idaapi.BADADDR):
1253 | add_dref(ctx.insn.ea, strings.get_namespace_offset(namespace), dr_I)
1254 | add_dref(ctx.insn.ea, strings.get_name_offset(name), dr_I)
1255 |
1256 | elif (kind == ConstKind.CONSTANT_RTQname or kind == ConstKind.CONSTANT_RTQnameA):
1257 |
1258 | name = mn["name"]
1259 |
1260 | ctx.out_name_expr(op, strings.get_name_offset(name), ida_idaapi.BADADDR)
1261 |
1262 | if (get_first_dref_from(ctx.insn.ea) == ida_idaapi.BADADDR):
1263 | add_dref(ctx.insn.ea, strings.get_name_offset(name), dr_I)
1264 |
1265 | elif (kind == ConstKind.CONSTANT_RTQnameL or kind == ConstKind.CONSTANT_RTQnameLA):
1266 | return
1267 |
1268 | elif (kind == ConstKind.CONSTANT_Multiname or kind == ConstKind.CONSTANT_MultinameA):
1269 |
1270 | name = mn["name"]
1271 | namespace_set = abc.get_namespace_set(mn["ns_set"])
1272 |
1273 | ctx.out_name_expr(op, strings.get_name_offset(name), ida_idaapi.BADADDR)
1274 | ctx.out_line(", [", COLOR_KEYWORD)
1275 | ctx.out_name_expr(op, strings.get_namespace_set_offset(namespace_set), ida_idaapi.BADADDR)
1276 | ctx.out_line("]", COLOR_KEYWORD)
1277 |
1278 | if (get_first_dref_from(ctx.insn.ea) == ida_idaapi.BADADDR):
1279 | add_dref(ctx.insn.ea, strings.get_name_offset(name), dr_I)
1280 | add_dref(ctx.insn.ea, strings.get_namespace_set_offset(namespace_set), dr_I)
1281 |
1282 | elif (kind == ConstKind.CONSTANT_MultinameL or kind == ConstKind.CONSTANT_MultinameLA):
1283 |
1284 | namespace_set = abc.get_namespace_set(mn["ns_set"])
1285 |
1286 | ctx.out_line("[", COLOR_KEYWORD)
1287 | ctx.out_name_expr(op, strings.get_namespace_set_offset(namespace_set), ida_idaapi.BADADDR)
1288 | ctx.out_line("]", COLOR_KEYWORD)
1289 |
1290 | if (get_first_dref_from(ctx.insn.ea) == ida_idaapi.BADADDR):
1291 | add_dref(ctx.insn.ea, strings.get_namespace_set_offset(namespace_set), dr_I)
1292 |
1293 | elif (kind == ConstKind.CONSTANT_TypeName):
1294 |
1295 | name = mn["name"]
1296 | params = mn["params"]
1297 |
1298 | Dumper.dump_multiname(ctx, op, abc, strings, name)
1299 | ctx.out_line("<", COLOR_KEYWORD)
1300 | length = len(params)
1301 | for i in xrange(length):
1302 | Dumper.dump_multiname(ctx, op, abc, strings, params[i])
1303 | if (i < length-1):
1304 | ctx.out_line(", ", COLOR_KEYWORD)
1305 | ctx.out_line(">", COLOR_KEYWORD)
1306 |
1307 | ctx.out_line(")", COLOR_KEYWORD)
1308 |
1309 | @staticmethod
1310 | def dump_class(ctx, abc, index):
1311 | ctx.out_line('"' + abc.multinames[abc.classes[index]["instance"]["name"]]["name"] + '"', COLOR_STRING)
1312 |
1313 | @staticmethod
1314 | def dump_flags(ctx, flags, names):
1315 | i = 0
1316 | while (flags != 0):
1317 |
1318 | if (flags & 1):
1319 | Dumper.make_line(ctx, "flag " + names[i])
1320 |
1321 | i += 1
1322 | flags >>= 1
1323 |
1324 | @staticmethod
1325 | def dump_traits(ctx, abc, traits):
1326 |
1327 | for trait in traits:
1328 |
1329 | kind = trait["tkind"]
1330 | name = abc.get_multiname(trait["name"])
1331 |
1332 | s = "trait %s %s" % (TraitKind.Names[kind], name)
1333 |
1334 | if (kind == TraitKind.TRAIT_Slot or kind == TraitKind.TRAIT_Const):
1335 |
1336 | s += " slotid %d" % trait["slotid"]
1337 |
1338 | if (trait["type"] != {}):
1339 |
1340 | s += " type "
1341 | s += abc.get_multiname(trait["type"])
1342 |
1343 | if (trait["value"]["kind"] != 0):
1344 |
1345 | s += " value "
1346 | s += abc.get_value(trait["value"])
1347 |
1348 | elif (kind == TraitKind.TRAIT_Class):
1349 |
1350 | s += " slotid %d" % trait["slotid"]
1351 |
1352 | elif (kind == TraitKind.TRAIT_Function):
1353 |
1354 | s += " slotid %d" % trait["slotid"]
1355 |
1356 | elif (kind == TraitKind.TRAIT_Method or
1357 | kind == TraitKind.TRAIT_Getter or
1358 | kind == TraitKind.TRAIT_Setter):
1359 |
1360 | s += " dispid %d" % trait["dispid"]
1361 |
1362 | Dumper.make_line(ctx, s)
1363 |
1364 | @staticmethod
1365 | def dump_method(ctx, abc, method):
1366 |
1367 | if (method is not None):
1368 |
1369 | if (method["refid"] != ""):
1370 | Dumper.make_line(ctx, 'refid "%s"' % method["refid"])
1371 |
1372 | for param in method["paramtypes"]:
1373 | if param != {}:
1374 | Dumper.make_line(ctx, "param %s" % abc.get_multiname(param))
1375 |
1376 | if method["returntype"] != {}:
1377 | Dumper.make_line(ctx, "returns %s" % abc.get_multiname(method["returntype"]))
1378 |
1379 | Dumper.dump_flags(ctx, method["flags"], MethodFlags.Names)
1380 |
1381 | for option in method["options"]:
1382 | if option != {}:
1383 | Dumper.make_line(ctx, "optional %s" % abc.get_value(option))
1384 |
1385 | for param_name in method["paramnames"]:
1386 | Dumper.make_line(ctx, "paramname %s" % param_name)
1387 |
1388 | Dumper.make_line(ctx, "maxstack %d" % method["body"]["maxstack"])
1389 | Dumper.make_line(ctx, "locals %d" % method["body"]["locals"])
1390 | Dumper.make_line(ctx, "init_depth %d" % method["body"]["init_depth"])
1391 | Dumper.make_line(ctx, "max_depth %d" % method["body"]["max_depth"])
1392 |
1393 | Dumper.dump_traits(ctx, abc, method["body"]["traits"])
1394 |
1395 | @staticmethod
1396 | def dump_exception(ctx, abc, exception):
1397 |
1398 | if (exception is not None):
1399 |
1400 | Dumper.make_line(ctx, "try")
1401 | Dumper.make_line(ctx, "from 0x%X" % exception["from"])
1402 | Dumper.make_line(ctx, "to 0x%X" % exception["to"])
1403 |
1404 | if (exception["type"] != {}):
1405 | Dumper.make_line(ctx, "type %s" % abc.get_multiname(exception["type"]))
1406 |
1407 | if (exception["name"] != {}):
1408 | Dumper.make_line(ctx, "name %s" % abc.get_multiname(exception["name"]))
1409 |
1410 | @staticmethod
1411 | def dump_name_expr(ctx, op, addr):
1412 |
1413 | r = ctx.out_name_expr(op, addr, ida_idaapi.BADADDR)
1414 | if not r:
1415 | ctx.out_tagon(COLOR_ERROR)
1416 | ctx.out_btoa(addr, 16)
1417 | ctx.out_tagoff(COLOR_ERROR)
1418 | remember_problem(PR_NONAME, ctx.insn.ea)
1419 |
1420 | class as3_processor_t(processor_t):
1421 |
1422 | PLFM_SWF_AS3 = 0x8A53
1423 |
1424 | # IDP id ( Numbers above 0x8000 are reserved for the third-party modules)
1425 | id = PLFM_SWF_AS3
1426 |
1427 | # Processor features
1428 | flag = PR_USE32 | PR_DEFSEG32 | PR_RNAMESOK | PRN_HEX | PR_NO_SEGMOVE
1429 |
1430 | # Number of bits in a byte for code segments (usually 8)
1431 | # IDA supports values up to 32 bits
1432 | cnbits = 8
1433 |
1434 | # Number of bits in a byte for non-code segments (usually 8)
1435 | # IDA supports values up to 32 bits
1436 | dnbits = 8
1437 |
1438 | # short processor names
1439 | # Each name should be shorter than 9 characters
1440 | psnames = ["SWF-AS3"]
1441 |
1442 | # long processor names
1443 | # No restriction on name lengthes.
1444 | plnames = ["SWF ActionScript3"]
1445 |
1446 | # size of a segment register in bytes
1447 | segreg_size = 0
1448 |
1449 | # icode of the first instruction
1450 | instruc_start = 0
1451 |
1452 | # Size of long double (tbyte) for this processor
1453 | # (meaningful only if ash.a_tbyte != NULL)
1454 | tbyte_size = 0
1455 |
1456 | # only one assembler is supported
1457 | assembler = {
1458 | # flag
1459 | 'flag' : ASH_HEXF3 | AS_UNEQU | AS_COLON | ASB_BINF4,
1460 |
1461 | # user defined flags (local only for IDP)
1462 | # you may define and use your own bits
1463 | 'uflag' : 0,
1464 |
1465 | # Assembler name (displayed in menus)
1466 | 'name': "SWF ActionScript3",
1467 |
1468 | # org directive
1469 | 'origin': "org",
1470 |
1471 | # end directive
1472 | 'end': "end",
1473 |
1474 | # comment string (see also cmnt2)
1475 | 'cmnt': ";",
1476 |
1477 | # ASCII string delimiter
1478 | 'ascsep': "\"",
1479 |
1480 | # ASCII char constant delimiter
1481 | 'accsep': "'",
1482 |
1483 | # ASCII special chars (they can't appear in character and ascii constants)
1484 | 'esccodes': "\"'",
1485 |
1486 | #
1487 | # Data representation (db,dw,...):
1488 | #
1489 | # ASCII string directive
1490 | 'a_ascii': "db",
1491 |
1492 | # byte directive
1493 | 'a_byte': "db",
1494 |
1495 | # word directive
1496 | 'a_word': "dw",
1497 |
1498 | # remove if not allowed
1499 | 'a_dword': "dd",
1500 |
1501 | # remove if not allowed
1502 | 'a_qword': "dq",
1503 |
1504 | # remove if not allowed
1505 | 'a_oword': "xmmword",
1506 |
1507 | # float; 4bytes; remove if not allowed
1508 | 'a_float': "dd",
1509 |
1510 | # double; 8bytes; NULL if not allowed
1511 | 'a_double': "dq",
1512 |
1513 | # long double; NULL if not allowed
1514 | 'a_tbyte': "dt",
1515 |
1516 | # array keyword. the following
1517 | # sequences may appear:
1518 | # #h - header
1519 | # #d - size
1520 | # #v - value
1521 | # #s(b,w,l,q,f,d,o) - size specifiers
1522 | # for byte,word,
1523 | # dword,qword,
1524 | # float,double,oword
1525 | 'a_dups': "#d dup(#v)",
1526 |
1527 | # uninitialized data directive (should include '%s' for the size of data)
1528 | 'a_bss': "%s dup ?",
1529 |
1530 | # 'seg ' prefix (example: push seg seg001)
1531 | 'a_seg': "seg",
1532 |
1533 | # current IP (instruction pointer) symbol in assembler
1534 | 'a_curip': "$",
1535 |
1536 | # "public" name keyword. NULL-gen default, ""-do not generate
1537 | 'a_public': "public",
1538 |
1539 | # "weak" name keyword. NULL-gen default, ""-do not generate
1540 | 'a_weak': "weak",
1541 |
1542 | # "extrn" name keyword
1543 | 'a_extrn': "extrn",
1544 |
1545 | # "comm" (communal variable)
1546 | 'a_comdef': "",
1547 |
1548 | # "align" keyword
1549 | 'a_align': "align",
1550 |
1551 | # Left and right braces used in complex expressions
1552 | 'lbrace': "(",
1553 | 'rbrace': ")",
1554 |
1555 | # % mod assembler time operation
1556 | 'a_mod': "%",
1557 |
1558 | # & bit and assembler time operation
1559 | 'a_band': "&",
1560 |
1561 | # | bit or assembler time operation
1562 | 'a_bor': "|",
1563 |
1564 | # ^ bit xor assembler time operation
1565 | 'a_xor': "^",
1566 |
1567 | # ~ bit not assembler time operation
1568 | 'a_bnot': "~",
1569 |
1570 | # << shift left assembler time operation
1571 | 'a_shl': "<<",
1572 |
1573 | # >> shift right assembler time operation
1574 | 'a_shr': ">>",
1575 |
1576 | # size of type (format string)
1577 | 'a_sizeof_fmt': "size %s",
1578 | } # Assembler
1579 |
1580 | tag = None
1581 | abc = None
1582 | multiname_strings = None
1583 |
1584 | switches = []
1585 | exceptions = []
1586 |
1587 | FLo_SIGNED = 0x0001 # This is a signed operand
1588 |
1589 | # ----------------------------------------------------------------------
1590 |
1591 | def analyze_instance_references(self, instance, line):
1592 |
1593 | if (instance["iinit"]["refid"] == ""):
1594 | instance["iinit"]["refid"] = "%s/instance/init" % line
1595 |
1596 | for trait in instance["traits"]:
1597 | name = instance["protectedns"]["name"]
1598 | self.analyze_trait_references(trait, "%s/instance" % line, name)
1599 |
1600 | def analyze_class_references(self, abc_class, line):
1601 |
1602 | if (abc_class["cinit"]["refid"] == ""):
1603 | abc_class["cinit"]["refid"] = "%s/class/init" % line
1604 |
1605 | for trait in abc_class["traits"]:
1606 | name = abc_class["instance"]["protectedns"]["name"]
1607 | self.analyze_trait_references(trait, "%s/class" % line, name)
1608 |
1609 | self.analyze_instance_references(abc_class["instance"], line)
1610 |
1611 | def analyze_trait_references(self, trait, line, namespace):
1612 |
1613 | kind = trait["tkind"]
1614 |
1615 | if (kind == TraitKind.TRAIT_Class):
1616 |
1617 | self.analyze_class_references(trait["class"], line)
1618 |
1619 | elif (kind == TraitKind.TRAIT_Function):
1620 |
1621 | if (trait["function"]["refid"] == ""):
1622 |
1623 | name = trait["name"]["name"]
1624 | namespace_kind = trait["name"]["ns"]["kind"]
1625 | namespace_name = trait["name"]["ns"]["name"]
1626 |
1627 | if (namespace_kind == ConstKind.CONSTANT_Namespace):
1628 | trait["function"]["refid"] = "%s/%s:%s" % (line, namespace_name, name)
1629 | elif (namespace_kind == ConstKind.CONSTANT_PrivateNamespace):
1630 | trait["function"]["refid"] = "%s/%s/%s" % (line, namespace, name)
1631 | else:
1632 | trait["function"]["refid"] = "%s/%s" % (line, name)
1633 |
1634 | elif (kind == TraitKind.TRAIT_Method or
1635 | kind == TraitKind.TRAIT_Getter or
1636 | kind == TraitKind.TRAIT_Setter):
1637 |
1638 | if (trait["method"]["refid"] == ""):
1639 |
1640 | name = trait["name"]["name"]
1641 | namespace_kind = trait["name"]["ns"]["kind"]
1642 | namespace_name = trait["name"]["ns"]["name"]
1643 |
1644 | if (trait["name"]["kind"] == ConstKind.CONSTANT_Qname and
1645 | (namespace_kind == ConstKind.CONSTANT_Namespace or
1646 | namespace_kind == ConstKind.CONSTANT_PrivateNs)):
1647 |
1648 | if (namespace_kind == ConstKind.CONSTANT_Namespace):
1649 | trait["method"]["refid"] = "%s/%s:%s" % (line, namespace_name, name)
1650 | elif (namespace_kind == ConstKind.CONSTANT_PrivateNs):
1651 | trait["method"]["refid"] = "%s/%s/%s" % (line, namespace, name)
1652 | else:
1653 | trait["method"]["refid"] = "%s/%s" % (line, name)
1654 |
1655 | if (kind == TraitKind.TRAIT_Getter):
1656 | trait["method"]["refid"] += "/getter"
1657 |
1658 | if (kind == TraitKind.TRAIT_Setter):
1659 | trait["method"]["refid"] += "/setter"
1660 |
1661 | def create_unique_references(self, abc):
1662 |
1663 | for method in self.abc.methods:
1664 |
1665 | if (method["refid"] == ""):
1666 | continue
1667 |
1668 | group = [m for m in self.abc.methods if m["refid"] == method["refid"]]
1669 |
1670 | if (len(group) > 1):
1671 |
1672 | for i in xrange(len(group)):
1673 | group[i]["refid"] += "_%d" % i
1674 |
1675 | def analyze_references(self, abc):
1676 |
1677 | for script in abc.scripts:
1678 |
1679 | for trait in script["traits"]:
1680 |
1681 | if (trait["name"]["kind"] == ConstKind.CONSTANT_Qname and
1682 | trait["name"]["ns"]["kind"] != ConstKind.CONSTANT_PrivateNs):
1683 |
1684 | name = trait["name"]["name"]
1685 | namespace_name = trait["name"]["ns"]["name"]
1686 |
1687 | if (namespace_name != ""):
1688 | line = "%s:%s" % (namespace_name, name)
1689 | else:
1690 | line = name
1691 |
1692 | script["sinit"]["refid"] = "%s/init" % line
1693 |
1694 | for trait in script["traits"]:
1695 |
1696 | self.analyze_trait_references(trait, line, None)
1697 |
1698 | elif (trait["name"]["kind"] == ConstKind.CONSTANT_Multiname):
1699 |
1700 | name = trait["name"]["name"]
1701 |
1702 | if (len(script["traits"]) == 1):
1703 | script["sinit"]["refid"] = "%s/init" % name
1704 |
1705 | self.analyze_trait_references(trait, name, None)
1706 |
1707 | self.create_unique_references(abc)
1708 |
1709 | def fix_bad_name(self, refid):
1710 |
1711 | name = ""
1712 |
1713 | for char in refid:
1714 |
1715 | if (char in string.digits or
1716 | char in string.lowercase or
1717 | char in string.uppercase or
1718 | ord(char) in [0x2E, 0x2F, 0x3A, 0x5F]):
1719 | name += char
1720 | else:
1721 | name += "\\x%02X" % ord(char)
1722 |
1723 | return name
1724 |
1725 | def analyze_code(self, is_new_file):
1726 |
1727 | for i in xrange(len(self.abc.methods)):
1728 |
1729 | if self.abc.methods[i]["body"] is not None:
1730 |
1731 | code_pos = self.abc.methods[i]["body"]["pos"]
1732 | code_length = self.abc.methods[i]["body"]["length"]
1733 | reference = self.abc.methods[i]["refid"]
1734 |
1735 | if (is_new_file):
1736 | print("%X - %X - %s" % (code_pos, code_length, reference))
1737 | auto_make_proc(code_pos)
1738 |
1739 | if (reference != ""):
1740 | idc.set_name(code_pos, self.fix_bad_name(reference), SN_NOCHECK)
1741 |
1742 | for exception in self.abc.methods[i]["body"]["exceptions"]:
1743 |
1744 | exception_from = code_pos + exception["from"]
1745 | exception_to = code_pos + exception["to"]
1746 | exception_target = code_pos + exception["target"]
1747 |
1748 | if (is_new_file):
1749 | auto_make_code(exception_target)
1750 | set_dummy_name(exception_from, exception_target)
1751 |
1752 | self.exceptions.append({"from": exception_from, "to": exception_to,
1753 | "target": exception_target, "type": exception["type"],
1754 | "name": exception["name"]})
1755 |
1756 | def load_file(self, is_new_file):
1757 |
1758 | self.tag = Tag()
1759 |
1760 | if not (self.tag.find()):
1761 | print('No "DoABC" tag!')
1762 | return
1763 |
1764 | self.tag.parse()
1765 |
1766 | if (is_new_file):
1767 | idc.del_items(self.tag.start, idc.DELIT_SIMPLE, self.tag.data_length)
1768 |
1769 | print("Parse ABC...")
1770 |
1771 | cpool = ConstantPool()
1772 | cpool.parse()
1773 |
1774 | print("Convert ABC...")
1775 |
1776 | self.abc = ABC(cpool)
1777 | self.abc.convert()
1778 |
1779 | self.multiname_strings = MultinameStrings()
1780 | self.multiname_strings.get_strings(self.abc)
1781 |
1782 | if (is_new_file):
1783 |
1784 | print("Create strings segment...")
1785 |
1786 | self.multiname_strings.create_strings_segment()
1787 |
1788 | print("Analyze references...")
1789 |
1790 | self.analyze_references(self.abc)
1791 |
1792 | print("Analyze code...")
1793 |
1794 | self.analyze_code(is_new_file)
1795 |
1796 | # ----------------------------------------------------------------------
1797 | def notify_gen_map_file(self, qfile):
1798 | """
1799 | Generate map file. If this function is absent then the kernel will create the map file.
1800 | This function returns number of lines in output file.
1801 | 0 - empty file, -1 - write error
1802 | """
1803 |
1804 | dump = []
1805 |
1806 | for method in self.abc.methods:
1807 |
1808 | if (method["body"] is None):
1809 | continue
1810 |
1811 | methodInfo1 = idc.get_qword(method["pos"])
1812 | methodInfo2 = idc.get_qword(method["pos"]+8)
1813 | index = method["id"]
1814 |
1815 | ea = method["body"]["pos"]
1816 | length = method["body"]["length"]
1817 |
1818 | name = get_name(ea)
1819 |
1820 | start = ea
1821 | end = ea + length
1822 |
1823 | instructions = {}
1824 |
1825 | while (ea < end):
1826 |
1827 | line = generate_disasm_line(ea, GENDSM_REMOVE_TAGS)
1828 | instructions[ea-start] = line
1829 |
1830 | ea += get_item_size(ea)
1831 |
1832 | dump.append({"id": index, "info": methodInfo1 + methodInfo2, "name": name, "instructions": instructions})
1833 |
1834 | data = cPickle.dumps(dump)
1835 |
1836 | qfile.write(data)
1837 |
1838 | return len(data.splitlines())
1839 |
1840 | # ----------------------------------------------------------------------
1841 | def notify_oldfile(self, filename):
1842 | self.load_file(False)
1843 |
1844 | # ----------------------------------------------------------------------
1845 | def notify_newfile(self, filename):
1846 | self.load_file(True)
1847 |
1848 | # ----------------------------------------------------------------------
1849 | def notify_get_autocmt(self, insn):
1850 | """
1851 | Get instruction comment. 'insn' describes the instruction in question
1852 | @return: None or the comment string
1853 | """
1854 | if "cmt" in self.instruc[insn.itype]:
1855 | return self.instruc[insn.itype]["cmt"]
1856 |
1857 | # ----------------------------------------------------------------------
1858 | def notify_can_have_type(self, op):
1859 | """
1860 | Can the operand have a type as offset, segment, decimal, etc.
1861 | (for example, a register AX can't have a type, meaning that the user can't
1862 | change its representation. see bytes.hpp for information about types and flags)
1863 | Returns: bool
1864 | """
1865 | return op.type == o_imm
1866 |
1867 | # ----------------------------------------------------------------------
1868 | def notify_out_header(self, ctx):
1869 | """function to produce start of disassembled text"""
1870 |
1871 | ctx.gen_block_cmt("+-------------------------------------------------------------------------+\n" \
1872 | "| Adobe Flash ActionScript3 processor module |\n" \
1873 | "| Author: Boris Larin |\n" \
1874 | "| |\n" \
1875 | "+-------------------------------------------------------------------------+", COLOR_DEFAULT)
1876 | ctx.flush_outbuf(0)
1877 |
1878 | # ----------------------------------------------------------------------
1879 | def notify_may_be_func(self, insn, state):
1880 | """
1881 | can a function start here?
1882 | the instruction is in 'insn'
1883 | arg: state -- autoanalysis phase
1884 | state == 0: creating functions
1885 | == 1: creating chunks
1886 | returns: probability 0..100
1887 | """
1888 |
1889 | return False
1890 |
1891 | # ----------------------------------------------------------------------
1892 | def handle_operand(self, insn, op, isRead):
1893 |
1894 | optype = op.type
1895 |
1896 | if optype == o_near:
1897 | itype = insn.itype
1898 | if itype == self.itype_newfunction or itype == self.itype_callstatic:
1899 | fl = fl_CN
1900 | else:
1901 | fl = fl_JN
1902 | insn.add_cref(op.addr, op.offb, fl)
1903 |
1904 | if optype == o_idpspec4:
1905 |
1906 | for target in self.switches[op.value]:
1907 | insn.add_cref(target, op.offb, fl_JN)
1908 |
1909 | # ----------------------------------------------------------------------
1910 | def notify_emu(self, insn):
1911 | """
1912 | Emulate instruction, create cross-references, plan to analyze
1913 | subsequent instructions, modify flags etc. Upon entrance to this function
1914 | all information about the instruction is in 'insn' structure.
1915 | If zero is returned, the kernel will delete the instruction.
1916 | """
1917 | aux = self.get_auxpref(insn)
1918 | feature = insn.get_canon_feature()
1919 |
1920 | if feature & CF_USE1:
1921 | self.handle_operand(insn, insn.Op1, 1)
1922 |
1923 | if feature & CF_USE2:
1924 | self.handle_operand(insn, insn.Op2, 1)
1925 |
1926 | if feature & CF_USE3:
1927 | self.handle_operand(insn, insn.Op3, 1)
1928 |
1929 | if feature & CF_USE4:
1930 | self.handle_operand(insn, insn.Op4, 1)
1931 |
1932 | if feature & CF_JUMP:
1933 | remember_problem(PR_JUMP, insn.ea)
1934 |
1935 | uncond_jmp = insn.itype in [self.itype_jump, self.itype_lookupswitch]
1936 |
1937 | if (feature & CF_STOP == 0) and not uncond_jmp:
1938 | add_cref(insn.ea, insn.ea + insn.size, fl_F)
1939 |
1940 | return True
1941 |
1942 | # ----------------------------------------------------------------------
1943 | def notify_out_operand(self, ctx, op):
1944 | """
1945 | Generate text representation of an instructon operand.
1946 | This function shouldn't change the database, flags or anything else.
1947 | All these actions should be performed only by u_emu() function.
1948 | The output text is placed in the output buffer initialized with init_output_buffer()
1949 | This function uses out_...() functions from ua.hpp to generate the operand text
1950 | Returns: 1-ok, 0-operand is hidden.
1951 | """
1952 |
1953 | optype = op.type
1954 | fl = op.specval
1955 | value = op.value
1956 | signed = OOF_SIGNED if fl & self.FLo_SIGNED != 0 else 0
1957 | def_arg = is_defarg(get_flags(ctx.insn.ea), op.n)
1958 |
1959 | if optype == o_imm:
1960 | ctx.out_value(op, OOFW_IMM | signed)
1961 |
1962 | elif optype == o_near:
1963 | Dumper.dump_name_expr(ctx, op, op.addr)
1964 |
1965 | elif optype == o_idpspec0:
1966 | Dumper.dump_string(ctx, self.abc, value)
1967 |
1968 | elif optype == o_idpspec1:
1969 | Dumper.dump_namespace(ctx, self.abc.namespaces[value])
1970 |
1971 | elif optype == o_idpspec2:
1972 | Dumper.dump_multiname(ctx, op, self.abc, self.multiname_strings, self.abc.multinames[value])
1973 |
1974 | elif optype == o_idpspec3:
1975 | Dumper.dump_class(ctx, self.abc, value)
1976 |
1977 | elif optype == o_idpspec4:
1978 |
1979 | for target in self.switches[value]:
1980 |
1981 | ctx.out_line(", ", COLOR_KEYWORD)
1982 | Dumper.dump_name_expr(ctx, op, target)
1983 |
1984 | else:
1985 | return False
1986 |
1987 | return True
1988 |
1989 | # ----------------------------------------------------------------------
1990 | # Generate the instruction mnemonics
1991 | def out_mnem(self, ctx):
1992 | # Init output buffer
1993 |
1994 | postfix = ""
1995 |
1996 | ctx.out_mnem(16, postfix)
1997 |
1998 | # ----------------------------------------------------------------------
1999 | # Generate text representation of an instruction in 'ctx.insn' structure.
2000 | # This function shouldn't change the database, flags or anything else.
2001 | # All these actions should be performed only by u_emu() function.
2002 | def notify_out_insn(self, ctx):
2003 |
2004 | ctx.out_mnemonic()
2005 |
2006 | ctx.out_one_operand(0)
2007 |
2008 | for i in xrange(1, 3):
2009 |
2010 | op = ctx.insn[i]
2011 |
2012 | if op.type == o_void:
2013 | break
2014 |
2015 | ctx.out_symbol(",")
2016 | ctx.out_char(" ")
2017 | ctx.out_one_operand(i)
2018 |
2019 | ctx.set_gen_cmt()
2020 | ctx.flush_outbuf()
2021 |
2022 | # ----------------------------------------------------------------------
2023 | def notify_out_label(self, ctx, label):
2024 | """
2025 | The kernel is going to generate an instruction label line
2026 | or a function header.
2027 | args:
2028 | ctx - output context
2029 | label - label to output
2030 | If returns value <0, then the kernel should not generate the label
2031 | """
2032 |
2033 | method = next((x for x in self.abc.methods if x["body"] is not None and x["body"]["pos"] == ctx.insn.ea), None)
2034 |
2035 | Dumper.dump_method(ctx, self.abc, method)
2036 |
2037 | exception = next((x for x in self.exceptions if x["target"] == ctx.insn.ea), None)
2038 |
2039 | Dumper.dump_exception(ctx, self.abc, exception)
2040 |
2041 | return True
2042 |
2043 | # ----------------------------------------------------------------------
2044 | def decode_instr(self, insn, opbyte):
2045 |
2046 | if (self.itable[opbyte].argtypes is None):
2047 | return True
2048 |
2049 | if (self.itable[opbyte].name == "debug"):
2050 |
2051 | ubytev = Reader.read_byte(insn)
2052 | insn.Op1.type = o_imm
2053 | insn.Op1.dtype = dt_byte
2054 | insn.Op1.value = ubytev
2055 |
2056 | index = Reader.read_encoded_u32(insn)
2057 | length = len(self.abc.cpool.abc_strings)
2058 |
2059 | if (index >= length):
2060 | print("Bad instr: %X - 0x%02X, %s, %X, %X" % (insn.ea, opbyte, self.itable[opbyte].name, index, length))
2061 | return False
2062 |
2063 | insn.Op2.type = o_idpspec0
2064 | insn.Op2.dtype = dt_string
2065 | insn.Op2.value = index
2066 |
2067 | ubytev = Reader.read_byte(insn)
2068 | insn.Op3.type = o_imm
2069 | insn.Op3.dtype = dt_byte
2070 | insn.Op3.value = ubytev
2071 |
2072 | uintv = Reader.read_encoded_u32(insn)
2073 | insn.Op4.type = o_imm
2074 | insn.Op4.dtype = dt_dword
2075 | insn.Op4.value = uintv
2076 |
2077 | return True
2078 |
2079 | for i in xrange(len(self.itable[opbyte].argtypes)):
2080 |
2081 | op_type = self.itable[opbyte].argtypes[i]
2082 |
2083 | if (op_type == OperandType.CONSTANT_Unknown):
2084 | print("Unknown operand: %s" % self.itable[opbyte].name)
2085 | return False
2086 |
2087 | elif (op_type == OperandType.CONSTANT_ByteImm):
2088 |
2089 | bytev = Reader.read_byte(insn)
2090 | insn.Op1.type = o_imm
2091 | insn.Op1.dtype = dt_byte
2092 | insn.Op1.value = bytev
2093 |
2094 | elif (op_type == OperandType.CONSTANT_UByteImm):
2095 |
2096 | ubytev = Reader.read_byte(insn)
2097 | insn.Op1.type = o_imm
2098 | insn.Op1.dtype = dt_byte
2099 | insn.Op1.value = ubytev
2100 |
2101 | elif (op_type == OperandType.CONSTANT_IntImm):
2102 |
2103 | intv = Reader.read_encoded_u32(insn)
2104 | insn.Op1.type = o_imm
2105 | insn.Op1.dtype = dt_dword
2106 | insn.Op1.value = intv
2107 | insn.Op1.specval = self.FLo_SIGNED
2108 |
2109 | elif (op_type == OperandType.CONSTANT_UIntImm):
2110 |
2111 | uintv = Reader.read_encoded_u32(insn)
2112 |
2113 | if (i == 0):
2114 | insn.Op1.type = o_imm
2115 | insn.Op1.dtype = dt_dword
2116 | insn.Op1.value = uintv
2117 | else:
2118 | insn.Op2.type = o_imm
2119 | insn.Op2.dtype = dt_dword
2120 | insn.Op2.value = uintv
2121 |
2122 | elif (op_type == OperandType.CONSTANT_Int or
2123 | op_type == OperandType.CONSTANT_UInt or
2124 | op_type == OperandType.CONSTANT_Double or
2125 | op_type == OperandType.CONSTANT_String or
2126 | op_type == OperandType.CONSTANT_Namespace or
2127 | op_type == OperandType.CONSTANT_Multiname or
2128 | op_type == OperandType.CONSTANT_Class or
2129 | op_type == OperandType.CONSTANT_Method):
2130 |
2131 | index = Reader.read_encoded_u32(insn)
2132 |
2133 | if (op_type == OperandType.CONSTANT_Int):
2134 | length = len(self.abc.cpool.abc_ints)
2135 | elif (op_type == OperandType.CONSTANT_UInt):
2136 | length = len(self.abc.cpool.abc_uints)
2137 | elif (op_type == OperandType.CONSTANT_Double):
2138 | length = len(self.abc.cpool.abc_doubles)
2139 | elif (op_type == OperandType.CONSTANT_String):
2140 | length = len(self.abc.cpool.abc_strings)
2141 | elif (op_type == OperandType.CONSTANT_Namespace):
2142 | length = len(self.abc.cpool.abc_namespaces)
2143 | elif (op_type == OperandType.CONSTANT_Multiname):
2144 | length = len(self.abc.cpool.abc_multinames)
2145 | elif (op_type == OperandType.CONSTANT_Class):
2146 | length = len(self.abc.cpool.abc_instances)
2147 | elif (op_type == OperandType.CONSTANT_Method):
2148 | length = len(self.abc.cpool.abc_methods)
2149 |
2150 | if (index >= length):
2151 | print("Bad instr: %X - 0x%02X, %s, %X, %X" % (insn.ea, opbyte, self.itable[opbyte].name, index, length))
2152 | return False
2153 |
2154 | if (op_type == OperandType.CONSTANT_Int):
2155 |
2156 | insn.Op1.type = o_imm
2157 | insn.Op1.dtype = dt_dword
2158 | insn.Op1.value = self.abc.get_int(index)
2159 | insn.Op1.specval = self.FLo_SIGNED
2160 |
2161 | elif (op_type == OperandType.CONSTANT_UInt):
2162 |
2163 | insn.Op1.type = o_imm
2164 | insn.Op1.dtype = dt_dword
2165 | insn.Op1.value = self.abc.get_uint(index)
2166 |
2167 | elif (op_type == OperandType.CONSTANT_Double):
2168 |
2169 | insn.Op1.type = o_imm
2170 | insn.Op1.dtype = dt_qword
2171 | insn.Op1.value = self.abc.get_double(index)
2172 |
2173 | elif (op_type == OperandType.CONSTANT_String):
2174 |
2175 | insn.Op1.type = o_idpspec0
2176 | insn.Op1.dtype = dt_string
2177 | insn.Op1.value = index
2178 |
2179 | elif (op_type == OperandType.CONSTANT_Namespace):
2180 |
2181 | insn.Op1.type = o_idpspec1
2182 | insn.Op1.dtype = dt_string
2183 | insn.Op1.value = index
2184 |
2185 | elif (op_type == OperandType.CONSTANT_Multiname):
2186 |
2187 | insn.Op1.type = o_idpspec2
2188 | insn.Op1.dtype = dt_string
2189 | insn.Op1.value = index
2190 |
2191 | elif (op_type == OperandType.CONSTANT_Class):
2192 |
2193 | insn.Op1.type = o_idpspec3
2194 | insn.Op1.dtype = dt_string
2195 | insn.Op1.value = index
2196 |
2197 | elif (op_type == OperandType.CONSTANT_Method):
2198 |
2199 | insn.Op1.type = o_near
2200 | insn.Op1.dtype = dt_dword
2201 |
2202 | if (index >= len(self.abc.methods) or self.abc.methods[index]["body"] is None):
2203 | print("Bad instr: %X - 0x%02X, %s, %X, %X" % (insn.ea, opbyte, self.itable[opbyte].name, index, length))
2204 | return False
2205 |
2206 | insn.Op1.addr = self.abc.methods[index]["body"]["pos"]
2207 |
2208 | elif (op_type == OperandType.CONSTANT_Label):
2209 |
2210 | delta = Reader.read_s24(insn)
2211 | target = insn.ea + insn.size + delta
2212 |
2213 | insn.Op1.type = o_near
2214 | insn.Op1.dtype = dt_dword
2215 | insn.Op1.addr = target
2216 |
2217 | elif (op_type == OperandType.CONSTANT_DefaultLabel):
2218 |
2219 | delta = Reader.read_s24(insn)
2220 | target = insn.ea + delta
2221 |
2222 | insn.Op1.type = o_near
2223 | insn.Op1.dtype = dt_dword
2224 | insn.Op1.addr = target
2225 |
2226 | elif (op_type == OperandType.CONSTANT_LabelsList):
2227 |
2228 | insn.Op2.type = o_idpspec4
2229 | insn.Op2.dtype = dt_dword
2230 | insn.Op2.value = len(self.switches)
2231 |
2232 | length = Reader.read_encoded_u32(insn)+1
2233 |
2234 | if (length > 0xFFFF):
2235 | print("Bad instr: %X - 0x%02X, %s, %X, %X" % (insn.ea, opbyte, self.itable[opbyte].name, index, length))
2236 | return False
2237 |
2238 | targets = []
2239 |
2240 | for label in xrange(length):
2241 | delta = Reader.read_s24(insn)
2242 | target = insn.ea + delta
2243 | targets.append(target)
2244 |
2245 | self.switches.append(targets)
2246 |
2247 | return True
2248 |
2249 | def notify_ana(self, insn):
2250 | """
2251 | Decodes an instruction into insn
2252 | """
2253 |
2254 | # take opcode byte
2255 | opcode = insn.get_next_byte()
2256 |
2257 | # opcode supported?
2258 | try:
2259 | ins = self.itable[opcode]
2260 | # set default itype
2261 | insn.itype = getattr(self, "itype_" + ins.name)
2262 | except:
2263 | return False
2264 | # call the decoder
2265 | return insn.size if self.decode_instr(insn, opcode) else 0
2266 |
2267 | # ----------------------------------------------------------------------
2268 | def init_instructions(self):
2269 | class idef:
2270 | """
2271 | Internal class that describes an instruction by:
2272 | - instruction name
2273 | - instruction decoding routine
2274 | - canonical flags used by IDA
2275 | """
2276 | def __init__(self, name, cf, argtypes, cmt = None):
2277 | self.name = name
2278 | self.cf = cf
2279 | self.argtypes = argtypes
2280 | self.cmt = cmt
2281 |
2282 | #
2283 | # Instructions table
2284 | #
2285 | self.itable = {
2286 |
2287 | #0x00:
2288 | 0x01: idef(name="bkpt", cmt="Breakpoint", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2289 | 0x02: idef(name="nop", cmt="No operation", cf = 0, argtypes=None),
2290 | 0x03: idef(name="throw", cmt="Throw exception", cf = 0, argtypes=None),
2291 | 0x04: idef(name="getsuper", cmt="Get parent class property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2292 | 0x05: idef(name="setsuper", cmt="Set parent class property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2293 | 0x06: idef(name="dxns", cmt="Set default XML namespace", cf = CF_USE1, argtypes=[OperandType.CONSTANT_String]),
2294 | 0x07: idef(name="dxnslate", cmt="Set default XML namespace at runtime", cf = 0, argtypes=None),
2295 | 0x08: idef(name="kill", cmt="Kill local register", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2296 | 0x09: idef(name="label", cmt="Target of a branch", cf = 0, argtypes=None),
2297 | #0x0A:
2298 | #0x0B:
2299 | 0x0C: idef(name="ifnlt", cmt="Branch if not lower than", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2300 | 0x0D: idef(name="ifnle", cmt="Branch if not lower or equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2301 | 0x0E: idef(name="ifngt", cmt="Branch if not greater than", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2302 | 0x0F: idef(name="ifnge", cmt="Branch if not greater ot equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2303 | 0x10: idef(name="jump", cmt="Jump to location", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2304 | 0x11: idef(name="iftrue", cmt="Branch if true", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2305 | 0x12: idef(name="iffalse", cmt="Branch if false", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2306 | 0x13: idef(name="ifeq", cmt="Branch if equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2307 | 0x14: idef(name="ifne", cmt="Branch if not equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2308 | 0x15: idef(name="iflt", cmt="Branch if lower than", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2309 | 0x16: idef(name="ifle", cmt="Branch if lower or equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2310 | 0x17: idef(name="ifgt", cmt="Branch if greater than", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2311 | 0x18: idef(name="ifge", cmt="Branch if greater or equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2312 | 0x19: idef(name="ifstricteq", cmt="Branch if strict equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2313 | 0x1A: idef(name="ifstrictne", cmt="Branch if not strict equal", cf = CF_USE1 | CF_JUMP, argtypes=[OperandType.CONSTANT_Label]),
2314 | 0x1B: idef(name="lookupswitch", cmt="Branch based on index", cf = CF_USE1 | CF_USE2 | CF_JUMP, argtypes=[OperandType.CONSTANT_DefaultLabel, OperandType.CONSTANT_LabelsList]),
2315 | 0x1C: idef(name="pushwith", cmt="Push with onto scope stack", cf = 0, argtypes=None),
2316 | 0x1D: idef(name="popscope", cmt="Pop from scope stack and discard value", cf = 0, argtypes=None),
2317 | 0x1E: idef(name="nextname", cmt="Get name of next property", cf = 0, argtypes=None),
2318 | 0x1F: idef(name="hasnext", cmt="Check if the object has more properties", cf = 0, argtypes=None),
2319 | 0x20: idef(name="pushnull", cmt="Push null value on stack", cf = 0, argtypes=None),
2320 | 0x21: idef(name="pushundefined", cmt="Push undefined value on stack", cf = 0, argtypes=None),
2321 | 0x22: idef(name="pushuninitialized", cmt="Push float value on stack", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2322 | 0x23: idef(name="nextvalue", cmt="Get value of next property", cf = 0, argtypes=None),
2323 | 0x24: idef(name="pushbyte", cmt="Push byte value on stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_ByteImm]),
2324 | 0x25: idef(name="pushshort", cmt="Push short value on stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_IntImm]),
2325 | 0x26: idef(name="pushtrue", cmt="Push true on stack", cf = 0, argtypes=None),
2326 | 0x27: idef(name="pushfalse", cmt="Push false on stack", cf = 0, argtypes=None),
2327 | 0x28: idef(name="pushnan", cmt="Push NaN value on stack", cf = 0, argtypes=None),
2328 | 0x29: idef(name="pop", cmt="Pop top value from stack", cf = 0, argtypes=None),
2329 | 0x2A: idef(name="dup", cmt="Duplicate value on stack", cf = 0, argtypes=None),
2330 | 0x2B: idef(name="swap", cmt="Swap two values on top of the stack", cf = 0, argtypes=None),
2331 | 0x2C: idef(name="pushstring", cmt="Push string value on the stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_String]),
2332 | 0x2D: idef(name="pushint", cmt="Push integer value on the stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Int]),
2333 | 0x2E: idef(name="pushuint", cmt="Push unsigned integer value on the stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UInt]),
2334 | 0x2F: idef(name="pushdouble", cmt="Push double precision value on the stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Double]),
2335 | 0x30: idef(name="pushscope", cmt="Push object on the scope stack", cf = 0, argtypes=None),
2336 | 0x31: idef(name="pushnamespace", cmt="Push namespace on the stack", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Namespace]),
2337 | 0x32: idef(name="hasnext2", cmt="Check if the object has more properties (register based)", cf = CF_USE1 | CF_USE2, argtypes=[OperandType.CONSTANT_UIntImm, OperandType.CONSTANT_UIntImm]),
2338 | 0x33: idef(name="pushdecimal", cmt="Push decimal value on the stack", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2339 | 0x34: idef(name="pushdnan", cmt="Push decimal NaN value on the stack", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2340 | 0x35: idef(name="li8", cmt="Load 8bit integer value", cf = 0, argtypes=None),
2341 | 0x36: idef(name="li16", cmt="Load 16bit integer value", cf = 0, argtypes=None),
2342 | 0x37: idef(name="li32", cmt="Load 32bit integer value", cf = 0, argtypes=None),
2343 | 0x38: idef(name="lf32", cmt="Load 32bit float value", cf = 0, argtypes=None),
2344 | 0x39: idef(name="lf64", cmt="Load 64bit float value", cf = 0, argtypes=None),
2345 | 0x3A: idef(name="si8", cmt="Store 8bit integer value", cf = 0, argtypes=None),
2346 | 0x3B: idef(name="si16", cmt="Store 16bit integer value", cf = 0, argtypes=None),
2347 | 0x3C: idef(name="si32", cmt="Store 32bit integer value", cf = 0, argtypes=None),
2348 | 0x3D: idef(name="sf32", cmt="Store 32bit float value", cf = 0, argtypes=None),
2349 | 0x3E: idef(name="sf64", cmt="Store 64bit float value", cf = 0, argtypes=None),
2350 | #0x3F:
2351 | 0x40: idef(name="newfunction", cmt="Create new Function object", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Method]),
2352 | 0x41: idef(name="call", cmt="Call function on the stack", cf = CF_USE1 | CF_CALL, argtypes=[OperandType.CONSTANT_UIntImm]),
2353 | 0x42: idef(name="construct", cmt="Call constructor function on the stack", cf = CF_USE1 | CF_CALL, argtypes=[OperandType.CONSTANT_UIntImm]),
2354 | 0x43: idef(name="callmethod", cmt="Call method of object by dispatch id", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_UIntImm, OperandType.CONSTANT_UIntImm]),
2355 | 0x44: idef(name="callstatic", cmt="Call method by method id in ABC file", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Method, OperandType.CONSTANT_UIntImm]),
2356 | 0x45: idef(name="callsuper", cmt="Call method on parent class", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2357 | 0x46: idef(name="callproperty", cmt="Call property", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2358 | 0x47: idef(name="returnvoid", cmt="Return from a method", cf = CF_STOP, argtypes=None),
2359 | 0x48: idef(name="returnvalue", cmt="Return value from a method", cf = CF_STOP, argtypes=None),
2360 | 0x49: idef(name="constructsuper", cmt="Call parent constructor of an object", cf = CF_USE1 | CF_CALL, argtypes=[OperandType.CONSTANT_UIntImm]),
2361 | 0x4A: idef(name="constructprop", cmt="Construct a property of an object", cf = CF_USE1 | CF_USE2, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2362 | 0x4B: idef(name="callsuperid", cmt="Call super id", cf = CF_CALL, argtypes=[OperandType.CONSTANT_Unknown]),
2363 | 0x4C: idef(name="callproplex", cmt="Call property with null as this", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2364 | 0x4D: idef(name="callinterface", cmt="Call interface", cf = CF_CALL, argtypes=[OperandType.CONSTANT_Unknown]),
2365 | 0x4E: idef(name="callsupervoid", cmt="Call method on parent class, discard return value", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2366 | 0x4F: idef(name="callpropvoid", cmt="Call property, discard return value", cf = CF_USE1 | CF_USE2 | CF_CALL, argtypes=[OperandType.CONSTANT_Multiname, OperandType.CONSTANT_UIntImm]),
2367 | 0x50: idef(name="sxi1", cmt="Sign extend 1bit value to 32bits", cf = 0, argtypes=None),
2368 | 0x51: idef(name="sxi8", cmt="Sign extend 8bit value to 32bits", cf = 0, argtypes=None),
2369 | 0x52: idef(name="sxi16", cmt="Sign extend 16bit value to 32bits", cf = 0, argtypes=None),
2370 | 0x53: idef(name="applytype", cmt="Apply type parameters", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2371 | #0x54:
2372 | 0x55: idef(name="newobject", cmt="Creates new object", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2373 | 0x56: idef(name="newarray", cmt="Creates new array", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2374 | 0x57: idef(name="newactivation", cmt="Creates new activation object", cf = 0, argtypes=None),
2375 | 0x58: idef(name="newclass", cmt="Creates new class", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Class]),
2376 | 0x59: idef(name="getdescendants", cmt="Get descendants", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2377 | 0x5A: idef(name="newcatch", cmt="Create new catch scope", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2378 | 0x5B: idef(name="deldescendants", cmt="Delete descendants", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2379 | #0x5C:
2380 | 0x5D: idef(name="findpropstrict", cmt="Search property in scope stack, error when not found", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2381 | 0x5E: idef(name="findproperty", cmt="Search property in scope stack, top object when not found", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2382 | 0x5F: idef(name="finddef", cmt="Search script level definition", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2383 | 0x60: idef(name="getlex", cmt="Find and get property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2384 | 0x61: idef(name="setproperty", cmt="Set property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2385 | 0x62: idef(name="getlocal", cmt="Get local register value", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2386 | 0x63: idef(name="setlocal", cmt="Set local register value", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2387 | 0x64: idef(name="getglobalscope", cmt="Get global scope", cf = 0, argtypes=None),
2388 | 0x65: idef(name="getscopeobject", cmt="Get scope object", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UByteImm]),
2389 | 0x66: idef(name="getproperty", cmt="Get property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2390 | 0x67: idef(name="getpropertylate", cmt="Get scope object on all levels", cf = 0, argtypes=None),
2391 | 0x68: idef(name="initproperty", cmt="Initialize property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2392 | 0x69: idef(name="setpropertylate", cmt="Set property (stack based)", cf = 0, argtypes=None),
2393 | 0x6A: idef(name="deleteproperty", cmt="Delete property", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2394 | 0x6B: idef(name="deletepropertylate", cmt="Delete property (stack based)", cf = 0, argtypes=None),
2395 | 0x6C: idef(name="getslot", cmt="Get value of a slot", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2396 | 0x6D: idef(name="setslot", cmt="Set value of a slot", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2397 | 0x6E: idef(name="getglobalslot", cmt="Get value of slot on global scope", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2398 | 0x6F: idef(name="setglobalslot", cmt="Set value of slot on global scope", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2399 | 0x70: idef(name="convert_s", cmt="Convert value to string", cf = 0, argtypes=None),
2400 | 0x71: idef(name="esc_xelem", cmt="Escape XML element", cf = 0, argtypes=None),
2401 | 0x72: idef(name="esc_xattr", cmt="Escape XML attribute", cf = 0, argtypes=None),
2402 | 0x73: idef(name="convert_i", cmt="Convert value to integer", cf = 0, argtypes=None),
2403 | 0x74: idef(name="convert_u", cmt="Convert value to unsigned integer", cf = 0, argtypes=None),
2404 | 0x75: idef(name="convert_d", cmt="Convert value to double", cf = 0, argtypes=None),
2405 | 0x76: idef(name="convert_b", cmt="Convert value to boolean", cf = 0, argtypes=None),
2406 | 0x77: idef(name="convert_o", cmt="Convert value to Object", cf = 0, argtypes=None),
2407 | 0x78: idef(name="checkfilter", cmt="Check that object can have filter operation applied", cf = 0, argtypes=None),
2408 | 0x79: idef(name="convert_m", cmt="Convert value to decimal", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2409 | 0x7A: idef(name="convert_m_p", cmt="Unary plus - coerce to numeric", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2410 | #0x7B:
2411 | #0x7C:
2412 | #0x7D:
2413 | #0x7E:
2414 | #0x7F:
2415 | 0x80: idef(name="coerce", cmt="Coerce value to specified type", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2416 | 0x81: idef(name="coerce_b", cmt="Coerce value to boolean", cf = 0, argtypes=None),
2417 | 0x82: idef(name="coerce_a", cmt="Coerce value to any type", cf = 0, argtypes=None),
2418 | 0x83: idef(name="coerce_i", cmt="Coerce value to integer", cf = 0, argtypes=None),
2419 | 0x84: idef(name="coerce_d", cmt="Coerce value to double", cf = 0, argtypes=None),
2420 | 0x85: idef(name="coerce_s", cmt="Coerce value to string", cf = 0, argtypes=None),
2421 | 0x86: idef(name="astype", cmt="Return same value or null if not specified type", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2422 | 0x87: idef(name="astypelate", cmt="Return same value or null if not specified type (stack based)", cf = 0, argtypes=None),
2423 | 0x88: idef(name="coerce_u", cmt="Coerce value to unsigned integer", cf = 0, argtypes=None),
2424 | 0x89: idef(name="coerce_o", cmt="Coerce value to Object", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2425 | #0x8A:
2426 | #0x8B:
2427 | #0x8C:
2428 | #0x8D:
2429 | #0x8E:
2430 | 0x8F: idef(name="negate_p", cmt="Negate value using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2431 | 0x90: idef(name="negate", cmt="Negate value", cf = 0, argtypes=None),
2432 | 0x91: idef(name="increment", cmt="Increment value", cf = 0, argtypes=None),
2433 | 0x92: idef(name="inclocal", cmt="Increment local register", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2434 | 0x93: idef(name="decrement", cmt="Decrement value", cf = 0, argtypes=None),
2435 | 0x94: idef(name="declocal", cmt="Decrement local register", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2436 | 0x95: idef(name="typeof", cmt="Get name of value type", cf = 0, argtypes=None),
2437 | 0x96: idef(name="not", cmt="Boolean negate", cf = 0, argtypes=None),
2438 | 0x97: idef(name="bitnot", cmt="Bitwise negate", cf = 0, argtypes=None),
2439 | #0x98:
2440 | #0x99:
2441 | 0x9A: idef(name="concat", cmt="Concat", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2442 | 0x9B: idef(name="add_d", cmt="Add_d", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2443 | 0x9C: idef(name="increment_p", cmt="Increment value using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2444 | 0x9D: idef(name="inclocal_p", cmt="Increment local register using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2445 | 0x9E: idef(name="decrement_p", cmt="Decrement value using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2446 | 0x9F: idef(name="declocal_p", cmt="Decrement local register using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2447 | 0xA0: idef(name="add", cmt="Add two values", cf = 0, argtypes=None),
2448 | 0xA1: idef(name="subtract", cmt="Subtract two values", cf = 0, argtypes=None),
2449 | 0xA2: idef(name="multiply", cmt="Multiply two values", cf = 0, argtypes=None),
2450 | 0xA3: idef(name="divide", cmt="Divide two values", cf = 0, argtypes=None),
2451 | 0xA4: idef(name="modulo", cmt="Modulo divide two values", cf = 0, argtypes=None),
2452 | 0xA5: idef(name="lshift", cmt="Bitwise left shift", cf = 0, argtypes=None),
2453 | 0xA6: idef(name="rshift", cmt="Bitwise right shift", cf = 0, argtypes=None),
2454 | 0xA7: idef(name="urshift", cmt="Unsigned bitwise right shift", cf = 0, argtypes=None),
2455 | 0xA8: idef(name="bitand", cmt="Bitwise and", cf = 0, argtypes=None),
2456 | 0xA9: idef(name="bitor", cmt="Bitwise or", cf = 0, argtypes=None),
2457 | 0xAA: idef(name="bitxor", cmt="Bitwise xor", cf = 0, argtypes=None),
2458 | 0xAB: idef(name="equals", cmt="Compare two values", cf = 0, argtypes=None),
2459 | 0xAC: idef(name="strictequals", cmt="Strict compare two values", cf = 0, argtypes=None),
2460 | 0xAD: idef(name="lessthan", cmt="Check that value is less than other value", cf = 0, argtypes=None),
2461 | 0xAE: idef(name="lessequals", cmt="Check that value is less or equal than other value", cf = 0, argtypes=None),
2462 | 0xAF: idef(name="greaterthan", cmt="Check that value is greater or equal than other value", cf = 0, argtypes=None),
2463 | 0xB0: idef(name="greaterequals", cmt="Check that value is greater or equal than other value", cf = 0, argtypes=None),
2464 | 0xB1: idef(name="instanceof", cmt="Check that type exists in object prototype chain", cf = 0, argtypes=None),
2465 | 0xB2: idef(name="istype", cmt="Check that object is of specified type", cf = CF_USE1, argtypes=[OperandType.CONSTANT_Multiname]),
2466 | 0xB3: idef(name="istypelate", cmt="Check that object is of specified type (stack based)", cf = 0, argtypes=None),
2467 | 0xB4: idef(name="in", cmt="Check that object has named property", cf = 0, argtypes=None),
2468 | 0xB5: idef(name="add_p", cmt="Add two values using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2469 | 0xB6: idef(name="subtract_p", cmt="Subtract two values using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2470 | 0xB7: idef(name="multiply_p", cmt="Multiply two values using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2471 | 0xB8: idef(name="divide_p", cmt="Divide two values using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2472 | 0xB9: idef(name="modulo_p", cmt="Modulo divide two values using number context", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2473 | #0xBA:
2474 | #0xBB:
2475 | #0xBC:
2476 | #0xBD:
2477 | #0xBE:
2478 | #0xBF:
2479 | 0xC0: idef(name="increment_i", cmt="Increment integer value", cf = 0, argtypes=None),
2480 | 0xC1: idef(name="decrement_i", cmt="Decrement integer value", cf = 0, argtypes=None),
2481 | 0xC2: idef(name="inclocal_i", cmt="Increment local register integer value", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2482 | 0xC3: idef(name="declocal_i", cmt="Decrement local register integer value", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2483 | 0xC4: idef(name="negate_i", cmt="Negate integer value", cf = 0, argtypes=None),
2484 | 0xC5: idef(name="add_i", cmt="Add two integer values", cf = 0, argtypes=None),
2485 | 0xC6: idef(name="subtract_i", cmt="Subtract two integer values", cf = 0, argtypes=None),
2486 | 0xC7: idef(name="multiply_i", cmt="Multiply two integer values", cf = 0, argtypes=None),
2487 | #0xC8:
2488 | #0xC9:
2489 | #0xCA:
2490 | #0xCB:
2491 | #0xCC:
2492 | #0xCD:
2493 | #0xCE:
2494 | #0xCF:
2495 | 0xD0: idef(name="getlocal0", cmt="Get local register 0", cf = 0, argtypes=None),
2496 | 0xD1: idef(name="getlocal1", cmt="Get local register 1", cf = 0, argtypes=None),
2497 | 0xD2: idef(name="getlocal2", cmt="Get local register 2", cf = 0, argtypes=None),
2498 | 0xD3: idef(name="getlocal3", cmt="Get local register 3", cf = 0, argtypes=None),
2499 | 0xD4: idef(name="setlocal0", cmt="Set local register 0", cf = 0, argtypes=None),
2500 | 0xD5: idef(name="setlocal1", cmt="Set local register 1", cf = 0, argtypes=None),
2501 | 0xD6: idef(name="setlocal2", cmt="Set local register 2", cf = 0, argtypes=None),
2502 | 0xD7: idef(name="setlocal3", cmt="Set local register 3", cf = 0, argtypes=None),
2503 | #0xD8:
2504 | #0xD9:
2505 | #0xDA:
2506 | #0xDB:
2507 | #0xDC:
2508 | #0xDD:
2509 | #0xDE:
2510 | #0xDF:
2511 | #0xE0:
2512 | #0xE1:
2513 | #0xE2:
2514 | #0xE3:
2515 | #0xE4:
2516 | #0xE5:
2517 | #0xE6:
2518 | #0xE7:
2519 | #0xE8:
2520 | #0xE9:
2521 | #0xEA:
2522 | #0xEB:
2523 | #0xEC:
2524 | #0xED:
2525 | #0xEE:
2526 | 0xEF: idef(name="debug", cmt="Debugging info", cf = CF_USE1 | CF_USE2 | CF_USE3 | CF_USE4, argtypes=[OperandType.CONSTANT_UByteImm, OperandType.CONSTANT_String, OperandType.CONSTANT_UByteImm, OperandType.CONSTANT_UIntImm]),
2527 | 0xF0: idef(name="debugline", cmt="Debugging line number info", cf = CF_USE1, argtypes=[OperandType.CONSTANT_UIntImm]),
2528 | 0xF1: idef(name="debugfile", cmt="Debugging file info", cf = CF_USE1, argtypes=[OperandType.CONSTANT_String]),
2529 | 0xF2: idef(name="bkptline", cmt="Breakpoint on line", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2530 | 0xF3: idef(name="timestamp", cmt="Timestamp", cf = 0, argtypes=[OperandType.CONSTANT_Unknown]),
2531 | #0xF4:
2532 | #0xF5:
2533 | #0xF6:
2534 | #0xF7:
2535 | #0xF8:
2536 | #0xF9:
2537 | #0xFA:
2538 | #0xFB:
2539 | #0xFC:
2540 | #0xFD:
2541 | #0xFE:
2542 | #0xFF:
2543 | }
2544 |
2545 | # Now create an instruction table compatible with IDA processor module requirements
2546 | Instructions = []
2547 | i = 0
2548 | for x in self.itable.values():
2549 | d = dict(name=x.name, feature=x.cf)
2550 | if x.cmt is not None:
2551 | d["cmt"] = x.cmt
2552 | Instructions.append(d)
2553 | setattr(self, "itype_" + x.name, i)
2554 | i += 1
2555 |
2556 | # icode of the last instruction + 1
2557 | self.instruc_end = len(Instructions) + 1
2558 |
2559 | # Array of instructions
2560 | self.instruc = Instructions
2561 |
2562 | # Icode of return instruction. It is ok to give any of possible return
2563 | # instructions
2564 | self.icode_return = self.itype_returnvoid
2565 |
2566 | # ----------------------------------------------------------------------
2567 | def init_registers(self):
2568 | """This function parses the register table and creates corresponding ireg_XXX constants"""
2569 |
2570 | # Registers definition
2571 | self.reg_names = [
2572 | # Fake segment registers
2573 | "CS",
2574 | "DS"
2575 | ]
2576 |
2577 | # Create the ireg_XXXX constants
2578 | for i in xrange(len(self.reg_names)):
2579 | setattr(self, "ireg_" + self.reg_names[i], i)
2580 |
2581 | # Segment register information (use virtual CS and DS registers if your
2582 | # processor doesn't have segment registers):
2583 | self.reg_first_sreg = self.ireg_CS
2584 | self.reg_last_sreg = self.ireg_DS
2585 |
2586 | # number of CS register
2587 | self.reg_code_sreg = self.ireg_CS
2588 |
2589 | # number of DS register
2590 | self.reg_data_sreg = self.ireg_DS
2591 |
2592 | # ----------------------------------------------------------------------
2593 | def __init__(self):
2594 | processor_t.__init__(self)
2595 | #self.PTRSZ = 4 # Assume PTRSZ = 4 by default
2596 | self.init_instructions()
2597 | self.init_registers()
2598 |
2599 | # ----------------------------------------------------------------------
2600 |
2601 | def PROCESSOR_ENTRY():
2602 | return as3_processor_t()
2603 |
--------------------------------------------------------------------------------