radare2/libr/sign
2010-07-23 12:19:39 +02:00
..
t * Fix build 2010-07-23 12:19:39 +02:00
Makefile * r_anal 2010-05-16 14:04:08 +02:00
README * Use RList in r_bp 2010-06-30 01:13:09 +02:00
sign.c * Fix some bugs reported by edu in the signature module 2010-07-21 11:12:24 +02:00

r_sign: signature api for radare2
=================================

// XXX: this documentation does not reflects the reality. must remove, keep it just for inspiration

Plugins are used to implement data collectors for r_sign.

A data collector is a piece of code that feeds the r_sign
database with information about symbols.

r_sign is configured to weight each attribute with some properties
to be able to determine the semblance between a collector source
information and the playground where r_sign tries to find valid
duplicates of the information stored previously following the
configured attributes and then we have output plugins to 

Plugin types:
=============
collectors - collects initial signatures (libc, libm, ...)        [  INPUT ]
playground - find collected info using the configured attributes  [  INPUT ]
dumpers    - dump the resulting information in ascii              [ OUTPUT ]
             - dump signature
             - dump results of the signature analysis

Items in stored database
========================
Should contain something like:

 // raw byte search //
 typedef struct {
     char *name;
     ut8 *bytes;
     int len;
     RList hits;
 } RSignItem;

We need some way to store other kind of properties for signature types..

r_sign_item_new ();
r_sign_item_add (sign, s_item);


Matchers should allow some ranges.. for example. we can accept two matching sequences with a distance of X

Schematics
-----------
                                             PLUGINS
+-----------+
| collector | (signature file, elf binary, radare database, ida...)
+---.-------+
    |
    |     +------------+
    |     | playground | (plugins to find information on target file)
    |     +------------+
. . | . . . . .| . . . . . . . . . . . . . . . . . . . . . . . . . . . .
    |          |      .
    |     +--------+  .  +----------------+
    `---->| r_sign |---->| signature file | output file (screen, disk)
          +--------+  .  +----------------+
                      .
waka waka!            .
----,----             .
  _            LIB    .                       OUTPUT
 (_<  . . . . . . . . .


                                                      --pancake