miasm
Reverse engineering framework
expr_reduce.StructLookup Class Reference
Inheritance diagram for expr_reduce.StructLookup:
Collaboration diagram for expr_reduce.StructLookup:

Public Member Functions

def reduce_int (self, node, **kwargs)
 
def reduce_ptr_struct (self, node, **kwargs)
 
def reduce_ptr_plus_int (self, node, **kwargs)
 
def reduce_cst_op (self, node, **kwargs)
 
def reduce_at_struct_ptr (self, node, **kwargs)
 
- Public Member Functions inherited from miasm.expression.expression_reduce.ExprReducer
def expr2node (self, expr)
 
def reduce (self, expr, **kwargs)
 
def categorize (self, node, lvl=0, **kwargs)
 
def apply_rules (self, node, lvl=0, **kwargs)
 

Static Public Attributes

string CST = "CST"
 
string FIELD_A_PTR = "FIELD_A_PTR"
 
string FIELD_A = "FIELD_A"
 
list reduction_rules
 
- Static Public Attributes inherited from miasm.expression.expression_reduce.ExprReducer
list reduction_rules = []
 
bool allow_none_result = False
 

Detailed Description

ExprReduce example.
This example retrieve the nature of a given expression
Input:
ECX is a pointer on a structure STRUCT_A

Reduction rules:
ECX              -> FIELD_A_PTR
ECX + CST        -> FIELD_A_PTR
ECX + CST*CST... -> FIELD_A_PTR
@ECX             -> FIELD_A
@(ECX + CST)     -> FIELD_A

Member Function Documentation

◆ reduce_at_struct_ptr()

def expr_reduce.StructLookup.reduce_at_struct_ptr (   self,
  node,
**  kwargs 
)
Reduction: @FIELD_A_PTR -> FIELD_A

◆ reduce_cst_op()

def expr_reduce.StructLookup.reduce_cst_op (   self,
  node,
**  kwargs 
)
Reduction: CST + CST -> CST

◆ reduce_int()

def expr_reduce.StructLookup.reduce_int (   self,
  node,
**  kwargs 
)
Reduction: int -> CST

◆ reduce_ptr_plus_int()

def expr_reduce.StructLookup.reduce_ptr_plus_int (   self,
  node,
**  kwargs 
)
Reduction: ECX + CST -> FIELD_A_PTR

◆ reduce_ptr_struct()

def expr_reduce.StructLookup.reduce_ptr_struct (   self,
  node,
**  kwargs 
)
Reduction: ECX -> FIELD_A_PTR

Member Data Documentation

◆ CST

string expr_reduce.StructLookup.CST = "CST"
static

◆ FIELD_A

string expr_reduce.StructLookup.FIELD_A = "FIELD_A"
static

◆ FIELD_A_PTR

string expr_reduce.StructLookup.FIELD_A_PTR = "FIELD_A_PTR"
static

◆ reduction_rules

list expr_reduce.StructLookup.reduction_rules
static
Initial value:
= [reduce_int,
reduce_ptr_struct,
reduce_ptr_plus_int,
reduce_cst_op,
reduce_at_struct_ptr
]

The documentation for this class was generated from the following file: