=0&&(p-=t[n-e][2][2],g-=t[n-e][2][3]);var u=t[n][0],c=g?p/g:0;if(h)if(g){var y=0>c?0:c,_=g,v=l*Math.sqrt(y*(1-y)/_+l*l/(4*_*_)),f=1+l*l/g;i=(y+l*l/(2*g)-v)/f,r=(y+l*l/(2*g)+v)/f,s[n]=[u,y*d,[i*d,r*d]]}else s[n]=[u,0,[0,0]];else o=g?l*Math.sqrt(c*(1-c)/g):1,s[n]=[u,d*c,[d*(c-o),d*(c+o)]]}return s}}();
6 | //# sourceMappingURL=dygraph-combined.js.map
--------------------------------------------------------------------------------
/codemap/ui/interaction.js:
--------------------------------------------------------------------------------
1 | // Code for a variety of interaction models. Used in interaction.html, but split out from
2 | // that file so they can be tested in isolation.
3 | //
4 | function downV3(event, g, context) {
5 | context.initializeMouseDown(event, g, context);
6 | if (event.altKey || event.shiftKey) {
7 | Dygraph.startZoom(event, g, context);
8 | } else {
9 | Dygraph.startPan(event, g, context);
10 | }
11 | }
12 |
13 | function moveV3(event, g, context) {
14 | if (context.isPanning) {
15 | Dygraph.movePan(event, g, context);
16 | } else if (context.isZooming) {
17 | Dygraph.moveZoom(event, g, context);
18 | }
19 | }
20 |
21 | function upV3(event, g, context) {
22 | if (context.isPanning) {
23 | Dygraph.endPan(event, g, context);
24 | } else if (context.isZooming) {
25 | Dygraph.endZoom(event, g, context);
26 | }
27 | }
28 |
29 | // Take the offset of a mouse event on the dygraph canvas and
30 | // convert it to a pair of percentages from the bottom left.
31 | // (Not top left, bottom is where the lower value is.)
32 | function offsetToPercentage(g, offsetX, offsetY) {
33 | // This is calculating the pixel offset of the leftmost date.
34 | var xOffset = g.toDomCoords(g.xAxisRange()[0], null)[0];
35 | var yar0 = g.yAxisRange(0);
36 |
37 | // This is calculating the pixel of the higest value. (Top pixel)
38 | var yOffset = g.toDomCoords(null, yar0[1])[1];
39 |
40 | // x y w and h are relative to the corner of the drawing area,
41 | // so that the upper corner of the drawing area is (0, 0).
42 | var x = offsetX - xOffset;
43 | var y = offsetY - yOffset;
44 |
45 | // This is computing the rightmost pixel, effectively defining the
46 | // width.
47 | var w = g.toDomCoords(g.xAxisRange()[1], null)[0] - xOffset;
48 |
49 | // This is computing the lowest pixel, effectively defining the height.
50 | var h = g.toDomCoords(null, yar0[0])[1] - yOffset;
51 |
52 | // Percentage from the left.
53 | var xPct = w == 0 ? 0 : (x / w);
54 | // Percentage from the top.
55 | var yPct = h == 0 ? 0 : (y / h);
56 |
57 | // The (1-) part below changes it from "% distance down from the top"
58 | // to "% distance up from the bottom".
59 | return [xPct, (1-yPct)];
60 | }
61 |
62 | function dblClickV3(event, g, context) {
63 | // Reducing by 20% makes it 80% the original size, which means
64 | // to restore to original size it must grow by 25%
65 |
66 | if (!(event.offsetX && event.offsetY)){
67 | event.offsetX = event.layerX - event.target.offsetLeft;
68 | event.offsetY = event.layerY - event.target.offsetTop;
69 | }
70 |
71 | var percentages = offsetToPercentage(g, event.offsetX, event.offsetY);
72 | var xPct = percentages[0];
73 | var yPct = percentages[1];
74 |
75 | if (event.ctrlKey) {
76 | zoom(g, -.25, xPct, yPct);
77 | } else {
78 | zoom(g, +.2, xPct, yPct);
79 | }
80 | }
81 |
82 | var lastClickedGraph = null;
83 |
84 | function clickV3(event, g, context) {
85 | lastClickedGraph = g;
86 | Dygraph.cancelEvent(event);
87 | }
88 |
89 | function scrollV3(event, g, context) {
90 | if (lastClickedGraph != g) {
91 | return;
92 | }
93 | var normal = event.detail ? event.detail * -1 : event.wheelDelta / 40;
94 | // For me the normalized value shows 0.075 for one click. If I took
95 | // that verbatim, it would be a 7.5%.
96 | var percentage = normal / 50;
97 |
98 | if (!(event.offsetX && event.offsetY)){
99 | event.offsetX = event.layerX - event.target.offsetLeft;
100 | event.offsetY = event.layerY - event.target.offsetTop;
101 | }
102 |
103 | var percentages = offsetToPercentage(g, event.offsetX, event.offsetY);
104 | var xPct = percentages[0];
105 | var yPct = percentages[1];
106 |
107 | zoom(g, percentage, xPct, yPct);
108 | Dygraph.cancelEvent(event);
109 | }
110 |
111 | // Adjusts [x, y] toward each other by zoomInPercentage%
112 | // Split it so the left/bottom axis gets xBias/yBias of that change and
113 | // tight/top gets (1-xBias)/(1-yBias) of that change.
114 | //
115 | // If a bias is missing it splits it down the middle.
116 | function zoom(g, zoomInPercentage, xBias, yBias) {
117 | xBias = xBias || 0.5;
118 | yBias = yBias || 0.5;
119 | function adjustAxis(axis, zoomInPercentage, bias) {
120 | var delta = axis[1] - axis[0];
121 | var increment = delta * zoomInPercentage;
122 | var foo = [increment * bias, increment * (1-bias)];
123 | return [ axis[0] + foo[0], axis[1] - foo[1] ];
124 | }
125 | var yAxes = g.yAxisRanges();
126 | var newYAxes = [];
127 | for (var i = 0; i < yAxes.length; i++) {
128 | newYAxes[i] = adjustAxis(yAxes[i], zoomInPercentage, yBias);
129 | }
130 |
131 | g.updateOptions({
132 | dateWindow: adjustAxis(g.xAxisRange(), zoomInPercentage, xBias),
133 | valueRange: newYAxes[0]
134 | });
135 | }
136 |
137 | var v4Active = false;
138 | var v4Canvas = null;
139 |
140 | function downV4(event, g, context) {
141 | context.initializeMouseDown(event, g, context);
142 | v4Active = true;
143 | moveV4(event, g, context); // in case the mouse went down on a data point.
144 | }
145 |
146 | var processed = [];
147 |
148 | function moveV4(event, g, context) {
149 | var RANGE = 7;
150 |
151 | if (v4Active) {
152 | var graphPos = Dygraph.findPos(g.graphDiv);
153 | var canvasx = Dygraph.pageX(event) - graphPos.x;
154 | var canvasy = Dygraph.pageY(event) - graphPos.y;
155 |
156 | var rows = g.numRows();
157 | // Row layout:
158 | // [date, [val1, stdev1], [val2, stdev2]]
159 | for (var row = 0; row < rows; row++) {
160 | var date = g.getValue(row, 0);
161 | var x = g.toDomCoords(date, null)[0];
162 | var diff = Math.abs(canvasx - x);
163 | if (diff < RANGE) {
164 | for (var col = 1; col < 3; col++) {
165 | // TODO(konigsberg): these will throw exceptions as data is removed.
166 | var vals = g.getValue(row, col);
167 | if (vals == null) { continue; }
168 | var val = vals[0];
169 | var y = g.toDomCoords(null, val)[1];
170 | var diff2 = Math.abs(canvasy - y);
171 | if (diff2 < RANGE) {
172 | var found = false;
173 | for (var i in processed) {
174 | var stored = processed[i];
175 | if(stored[0] == row && stored[1] == col) {
176 | found = true;
177 | break;
178 | }
179 | }
180 | if (!found) {
181 | processed.push([row, col]);
182 | drawV4(x, y);
183 | }
184 | return;
185 | }
186 | }
187 | }
188 | }
189 | }
190 | }
191 |
192 | function upV4(event, g, context) {
193 | if (v4Active) {
194 | v4Active = false;
195 | }
196 | }
197 |
198 | function dblClickV4(event, g, context) {
199 | restorePositioning(g);
200 | }
201 |
202 | function drawV4(x, y) {
203 | var ctx = v4Canvas;
204 |
205 | ctx.strokeStyle = "#000000";
206 | ctx.fillStyle = "#FFFF00";
207 | ctx.beginPath();
208 | ctx.arc(x,y,5,0,Math.PI*2,true);
209 | ctx.closePath();
210 | ctx.stroke();
211 | ctx.fill();
212 | }
213 |
214 | function captureCanvas(canvas, area, g) {
215 | v4Canvas = canvas;
216 | }
217 |
218 | function restorePositioning(g) {
219 | g.updateOptions({
220 | dateWindow: null,
221 | valueRange: null
222 | });
223 | }
--------------------------------------------------------------------------------
/codemap/ui/skel.htm:
--------------------------------------------------------------------------------
1 |
2 |
3 | Codemap - IDA plugin for runtrace visualization.
4 |
5 |
6 |
7 |
8 |
9 |
40 |
41 |
42 |
43 | / runtime module base : --BASEADDR-- / input IDA static module base :
44 |
45 | / pause Codemap to see accurate trace result.
46 |
47 | Move cursor to execution flow graph.
48 |
133 |
134 |
135 |
--------------------------------------------------------------------------------
/idapythonrc.py:
--------------------------------------------------------------------------------
1 | # C:\Users\[USERNAME]\AppData\Roaming\Hex-Rays\IDA Pro\idapythonrc.py
2 | from idaapi import *
3 | import idc
4 | import zlib
5 | import traceback
6 | import webbrowser
7 | import datetime
8 | from codemap import codemap
9 |
10 | __version__ = '2.0'
11 |
12 | codemap = codemap.Codemap()
13 |
14 |
15 | def IDA_State():
16 | if get_root_filename() is None:
17 | return 'empty'
18 | try:
19 | a = idc.GetRegValue('esp')
20 | return 'running'
21 | except:
22 | return 'static'
23 |
24 |
25 | # batch function break point script - daehee
26 | def Functions(start=None, end=None):
27 | if not start:
28 | start = cvar.inf.minEA
29 | if not end:
30 | end = cvar.inf.maxEA
31 | chunk = get_fchunk(start)
32 | if not chunk:
33 | chunk = get_next_fchunk(start)
34 | while chunk and chunk.startEA < end and (chunk.flags & FUNC_TAIL) != 0:
35 | chunk = get_next_fchunk(chunk.startEA)
36 | func = chunk
37 | while func and func.startEA < end:
38 | yield (func)
39 | func = get_next_func(func.startEA)
40 |
41 |
42 | def FuncItems(start):
43 | func = get_func(start)
44 | if not func:
45 | return
46 | fii = func_item_iterator_t()
47 | ok = fii.set(func)
48 | while ok:
49 | yield fii.current()
50 | ok = fii.next_code()
51 |
52 | '''
53 | Returns a list of module objects with name,size,base and the rebase_to
54 | '''
55 | def Modules():
56 | mod = idaapi.module_info_t()
57 | result = idaapi.get_first_module(mod)
58 | while result:
59 | yield idaapi.object_t(name=mod.name, size=mod.size, base=mod.base, rebase_to=mod.rebase_to)
60 | result = idaapi.get_next_module(mod)
61 |
62 |
63 | # print slows IDA down
64 | class IDAHook(DBG_Hooks):
65 | global codemap
66 |
67 | def dbg_process_exit(self, pid, tid, ea, code):
68 | codemap.db_insert()
69 | codemap.init_codemap()
70 | print("Process exited pid=%d tid=%d ea=0x%x code=%d" %
71 | (pid, tid, ea, code))
72 |
73 | def dbg_bpt(self, tid, ea):
74 | if codemap.pause is True:
75 | return 0 # stop visualizing
76 |
77 | codemap.set_data()
78 | codemap.db_insert_queue()
79 | continue_process() # continue
80 | return 0 # no warning
81 |
82 |
83 | def hook_ida():
84 | global debughook
85 | # Remove an existing debug hook
86 | try:
87 | if debughook:
88 | print("Removing previous hook ...")
89 | debughook.unhook()
90 | except:
91 | pass
92 | # Install the debug hook
93 | debughook = IDAHook()
94 | debughook.hook()
95 | debughook.steps = 0
96 |
97 | '''
98 | - SetRangeBP -
99 | Get address range from user and setup bp to all instruction in that range.
100 | '''
101 | def SetRangeBP():
102 | if IDA_State() == 'empty':
103 | print 'no program loaded'
104 | return
105 | start_addr = AskStr('', 'Start Addr? (e.g. 0x8000) : ')
106 | end_addr = AskStr('', 'End Addr? (e.g. 0xC000) : ')
107 |
108 | start_addr = int(start_addr.replace('0x', ''), 16)
109 | end_addr = int(end_addr.replace('0x', ''), 16)
110 |
111 | for e in Heads(start_addr, end_addr):
112 | if get_bpt(e, bpt_t()) is False:
113 | add_bpt(e, 0, BPT_SOFT)
114 | else:
115 | del_bpt(e)
116 |
117 |
118 | '''
119 | - SetFunctionBP -
120 | put cursor inside the IDA-recognized function then call this.
121 | bp will be set to all instructions of function
122 | '''
123 | def SetFunctionBP():
124 | if IDA_State() == 'empty':
125 | print 'no program loaded'
126 | return
127 | ea = ScreenEA()
128 | target = 0
129 | for e in Functions():
130 | if e.startEA <= ea and ea <= e.endEA:
131 | target = e.startEA
132 |
133 | if target != 0:
134 | for e in FuncItems(target):
135 | if get_bpt(e, bpt_t()) is False:
136 | add_bpt(e, 0, BPT_SOFT)
137 | else:
138 | del_bpt(e)
139 | else:
140 | Warning('put cursor in the function body')
141 |
142 |
143 | '''
144 | - Start Trace -
145 | setup all bp's you want(maybe using GETBPLIST or SetFunctionBP or manually)
146 | then execute this script in order to create dygraph trace.
147 | '''
148 | def StartTracing():
149 | global codemap
150 | if codemap.start is False and IDA_State() != 'running':
151 | print 'IDA debugger not running'
152 | return
153 |
154 | if codemap.start is True:
155 | codemap.pause = not codemap.pause
156 | print 'Codemap Paused? : ', codemap.pause
157 | if codemap.pause is False: # resume tracing
158 | continue_process()
159 | else:
160 | codemap.db_insert()
161 | suspend_process()
162 | return
163 |
164 | # set current uid. if there is existing codemap instance, save it to prev_uids
165 | if codemap.uid != None:
166 | codemap.prev_uids.append( codemap.uid )
167 |
168 | codemap.uid = datetime.datetime.fromtimestamp(
169 | time.time()).strftime('%Y%m%d%H%M%S')
170 |
171 |
172 | codemap.init_arch()
173 | hook_ida()
174 |
175 | print 'hook ida done.'
176 | print 'homedir : ', codemap.homedir
177 | print 'making table...'
178 | # initialize sqlite3 db
179 | print codemap.db_create()
180 |
181 | # set default SQL
182 | if codemap.arch.name == 'x86':
183 | codemap.query = "select eip from trace{0}".format(codemap.uid)
184 | if codemap.arch.name == 'x64':
185 | codemap.query = "select rip from trace{0}".format(codemap.uid)
186 |
187 | print 'start HTTP server'
188 | # start HTTP server
189 | codemap.start_webserver()
190 |
191 | # fire up chrome!
192 | result = 'http://{0}:{1}/{2}'.format(codemap.server,
193 | codemap.port,
194 | codemap.uid)
195 | webbrowser.open(result)
196 | print 'start tracing...'
197 | codemap.start = True
198 | continue_process()
199 |
200 |
201 | '''
202 | - SaveModuleBP -
203 | open a dll file with IDA and execute this script after IDA analysis is done.
204 | the function offset information of dll will be saved to file inside Codemap directory
205 | '''
206 | def SaveModuleBP():
207 | global codemap
208 | try:
209 | modname = AskStr('', 'module name : ')
210 | bpo = ''
211 | for e in Functions():
212 | func = e.startEA
213 | length = e.endEA - e.startEA
214 | if length < codemap.func_min_size:
215 | continue
216 | offset = func - get_imagebase()
217 | bpo += str(offset) + '\n'
218 | print 'bp offset generation complete! ' + str(len(bpo))
219 | payload = bpo
220 | with open(codemap.homedir + modname + '.bpo', 'wb') as f:
221 | f.write(zlib.compress(payload))
222 | except:
223 | traceback.print_exc(file=sys.stdout)
224 |
225 | '''
226 | - LoadModuleBP -
227 | while debugging the target app, put cursor somewhere inside the target module code.
228 | execute the script and bp will be set for all functions specified in .bpo file
229 | '''
230 | def LoadModuleBP():
231 | global codemap
232 | try:
233 | # get current cursor
234 | cur = get_screen_ea()
235 | baseaddr = 0
236 | modname = ''
237 | # what module is my cursor pointing?
238 | for i in Modules():
239 | if cur > i.base and cur < i.base + i.size:
240 | modname = i.name.split('\x00')[0]
241 | modname = modname.split('\\')[-1:][0]
242 | baseaddr = i.base
243 |
244 | codemap.base = baseaddr # this is needed.
245 | modname = AskStr('', 'module name : ')
246 | payload = ''
247 | with open(codemap.homedir + modname + '.bpo', 'rb') as f:
248 | payload = zlib.decompress(f.read())
249 | bps = payload.split()
250 | code = bytearray()
251 | for bp in bps:
252 | code += 'add_bpt({0}, 0, BPT_SOFT);'.format(baseaddr + int(bp))
253 | print 'setting breakpoints...'
254 | # set bp!
255 | exec(str(code))
256 | except:
257 | traceback.print_exc(file=sys.stdout)
258 |
259 | def SetModuleBP():
260 | global codemap
261 | if codemap.start is False and IDA_State() is 'static':
262 | SaveModuleBP()
263 | if codemap.start is False and IDA_State() is 'running':
264 | LoadModuleBP()
265 |
266 | def ListenCodemap():
267 | global codemap
268 | codemap.start_websocketserver()
269 | print "Listning to codemap connection..."
270 |
271 | CompileLine('static key_1() { RunPythonStatement("StartTracing()"); }')
272 | CompileLine('static key_2() { RunPythonStatement("SetFunctionBP()"); }')
273 | CompileLine('static key_3() { RunPythonStatement("SetRangeBP()"); }')
274 | CompileLine('static key_4() { RunPythonStatement("SetModuleBP()"); }')
275 | CompileLine('static key_5() { RunPythonStatement("ListenCodemap()"); }')
276 |
277 | AddHotkey('Alt-1', 'key_1')
278 | AddHotkey('Alt-2', 'key_2')
279 | AddHotkey('Alt-3', 'key_3')
280 | AddHotkey('Alt-4', 'key_4')
281 | AddHotkey('Alt-5', 'key_5')
282 |
283 | print 'ALT-1 : Start(Resume)/Pause Codemap'
284 | print 'ALT-2 : Set Function BP'
285 | print 'ALT-3 : Set Range BP'
286 | print 'ALT-4 : Create/Setup Module BP'
287 | print 'ALT-5 : Connect Codemap Graph with IDA'
288 | print 'Codemap Python Plugin is ready. enjoy. - by daehee'
289 |
--------------------------------------------------------------------------------
/install.py:
--------------------------------------------------------------------------------
1 | import os
2 | import shutil
3 | import platform
4 |
5 | sysname = platform.system()
6 | g_idadir = ''
7 | g_homedir = ''
8 |
9 | if sysname == 'Darwin' or sysname == 'Linux':
10 | g_idadir = '%s/.idapro' % os.environ['HOME']
11 | g_homedir = '%s/.idapro/codemap/' % os.environ['HOME']
12 | elif sysname == 'Windows':
13 | g_idadir = '%s\\Hex-Rays\\IDA Pro\\' % os.environ['APPDATA']
14 | g_homedir = '%s\\Hex-Rays\\IDA Pro\\codemap\\' % os.environ['APPDATA']
15 |
16 | if not os.path.exists(g_idadir):
17 | print 'IDA Pro is not installed!'
18 | os._exit(0)
19 |
20 | if os.path.exists(g_homedir):
21 | print 'Codemap is already installed. Do you want to reinstall it? (y/n)'
22 | cmd = raw_input()
23 | if cmd is not 'y':
24 | os._exit(0)
25 | else:
26 | try:
27 | shutil.rmtree(g_homedir)
28 | except:
29 | print 'cannot remove existing files!! maybe Codemap files are locked by some application..'
30 |
31 | if os.path.exists(g_idadir + 'idapythonrc.py'):
32 | print 'Codemap uses idapythonrc.py to place its code. it seems there already is idapythonrc.py'
33 | print 'Do you want to overwrite this? (y/n)'
34 | cmd = raw_input()
35 | if cmd is not 'y':
36 | os._exit(0)
37 |
38 | shutil.copytree('codemap', g_homedir)
39 | shutil.copy2('idapythonrc.py', g_idadir)
40 |
41 | print 'Codemap install complete! run IDA Pro now.'
42 |
--------------------------------------------------------------------------------