miasm
Reverse engineering framework
|
Public Member Functions | |
def | reduce_int (self, node, **kwargs) |
def | reduce_ptr_struct (self, node, **kwargs) |
def | reduce_ptr_plus_int (self, node, **kwargs) |
def | reduce_cst_op (self, node, **kwargs) |
def | reduce_at_struct_ptr (self, node, **kwargs) |
Public Member Functions inherited from miasm.expression.expression_reduce.ExprReducer | |
def | expr2node (self, expr) |
def | reduce (self, expr, **kwargs) |
def | categorize (self, node, lvl=0, **kwargs) |
def | apply_rules (self, node, lvl=0, **kwargs) |
Static Public Attributes | |
string | CST = "CST" |
string | FIELD_A_PTR = "FIELD_A_PTR" |
string | FIELD_A = "FIELD_A" |
list | reduction_rules |
Static Public Attributes inherited from miasm.expression.expression_reduce.ExprReducer | |
list | reduction_rules = [] |
bool | allow_none_result = False |
ExprReduce example. This example retrieve the nature of a given expression Input: ECX is a pointer on a structure STRUCT_A Reduction rules: ECX -> FIELD_A_PTR ECX + CST -> FIELD_A_PTR ECX + CST*CST... -> FIELD_A_PTR @ECX -> FIELD_A @(ECX + CST) -> FIELD_A
def expr_reduce.StructLookup.reduce_at_struct_ptr | ( | self, | |
node, | |||
** | kwargs | ||
) |
Reduction: @FIELD_A_PTR -> FIELD_A
def expr_reduce.StructLookup.reduce_cst_op | ( | self, | |
node, | |||
** | kwargs | ||
) |
Reduction: CST + CST -> CST
def expr_reduce.StructLookup.reduce_int | ( | self, | |
node, | |||
** | kwargs | ||
) |
Reduction: int -> CST
def expr_reduce.StructLookup.reduce_ptr_plus_int | ( | self, | |
node, | |||
** | kwargs | ||
) |
Reduction: ECX + CST -> FIELD_A_PTR
def expr_reduce.StructLookup.reduce_ptr_struct | ( | self, | |
node, | |||
** | kwargs | ||
) |
Reduction: ECX -> FIELD_A_PTR
|
static |
|
static |
|
static |
|
static |