/* radare - LGPL - Copyright 2006-2014 - esteve, pancake */ #include "r_search.h" #include "r_print.h" #include #include #include #define CTXMINB 5 #define BSIZE (1024*1024) #define MAX_PATLEN 1024 typedef struct _fnditem { unsigned char str[MAX_PATLEN]; void* next; } fnditem; static fnditem* init_fi() { fnditem* n; n = (fnditem*) malloc (sizeof (fnditem)); n->next = NULL; return n; } static void fini_fi(fnditem* fi) { fnditem *fu; fu = fi; while (fi->next) { fu = fi; fi = fi->next; free (fu); fu = NULL; } free (fu); } static void add_fi (fnditem* n, unsigned char* blk, int patlen) { fnditem* p; for (p=n; p->next!=NULL; p=p->next); p->next = (fnditem*) malloc (sizeof (fnditem)); p = p->next; memcpy (p->str, blk, patlen); p->next = NULL; } static int is_fi_present(fnditem* n, unsigned char* blk , int patlen) { fnditem* p; for (p=n; p->next!=NULL; p=p->next) if (!memcmp (blk, p->str, patlen)) return R_TRUE; return R_FALSE; } R_API int r_search_pattern(RSearch *s, ut64 from, ut64 to) { ut8 block[BSIZE+MAX_PATLEN], sblk[BSIZE+MAX_PATLEN+1]; ut64 addr, bact, bytes, intaddr, rb, bproc = 0; int nr,i, moar=0, pcnt, cnt = 0, k = 0; int patlen = s->pattern_size; fnditem* root; eprintf ("Searching patterns between 0x%llx and 0x%llx\n", from, to); if (patlen < 1 || patlen > MAX_PATLEN) { eprintf ("Invalid pattern length (must be > 1 and < %d)\n", MAX_PATLEN); return R_FALSE; } bact = from; bytes = to; //bytes += bact; root = init_fi (); pcnt = -1; // bact = from // bytes = to // bproc = from2 while (bact < bytes) { addr = bact; if (r_print_is_interrupted ()) { break; } bproc = bact + patlen ; // read ( fd, sblk, patlen ); //XXX bytepattern should be used with a read callback nr = ((bytes-bproc) < BSIZE)?(bytes-bproc):BSIZE; //XXX radare_read_at(bact, sblk, patlen); rb = s->iob.read_at (s->iob.io, addr, sblk, nr); sblk[patlen] = 0; // XXX intaddr = bact; cnt = 0; while (bproc < bytes) { // TODO: handle ^C here nr = ((bytes-bproc) < BSIZE)?(bytes-bproc):BSIZE; nr += (patlen - (nr % patlen)); // tamany de bloc llegit multiple superior de tamany busqueda rb = s->iob.read_at (s->iob.io, bproc, block, nr); if (rb<1) { bproc +=nr; break; } nr = rb; addr += nr; moar = 0; for (i=0; i0) eprintf ("\ncount: %d: %d\n", pcnt, moar+1); bproc += rb; } bact += (moar>0)? patlen: 1; } eprintf ("\n"); fini_fi (root); return 0; }