speedup the analysis process due autocomments

The new version cef97919f87d999c4b5c14be0f61edc5000639f5 of x64_dbg provides DbgSetAutoComments as in Issue #2.

README.md

@@ -1,6 +1,19 @@
 x64dbg-StaticAnalysis
 =====================
 
-x64dbg-StaticAnalysis
+- plugin for x64_dbg
+- see [release page](https://github.com/x64dbg/x64dbg-StaticAnalysis/releases) for a working plugin
 
-a plugin for www.x64dbg.com
+##Roadmap
+see [dev branch](https://github.com/x64dbg/x64dbg-StaticAnalysis/tree/enhance)
+
+- x64 calling convention (x64 version)
+- Stackemulator (for MingGM-argument-passing)
+- function-finder
+- case-switch detection
+- "MB_OK"-like symbols
+- loop-detection
+- flow-heuristic against obfuscation instead of linear scanning
+
+## License
+GLPv3

src/AnalysisRunner.cpp

@@ -35,6 +35,10 @@ void AnalysisRunner::start(){
 	_plugin_logputs("[StaticAnalysis] analysis finished ...");
 }
 
+const duint AnalysisRunner::baseAddress() const{
+	return mBaseAddress;
+}
+
 void AnalysisRunner::run()
 {
 	unsigned char* data = new unsigned char[mSize];

src/AnalysisRunner.h

@@ -46,5 +46,6 @@ public:
 	void clear( );
 	void think( );
 	void initialise();
+	const duint baseAddress() const;
 };
 

src/ApiDB.cpp

@@ -86,10 +86,12 @@ ApiDB::~ApiDB(void)
 
 APIFunction ApiDB::find( std::string name )
 {
+	if(name[0]=='&')
+		name.erase (0,1); 
 	APIFunction f;
 	f.invalid = true;
 	
-
+	//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] search data %s \n",name.c_str() );
 	std::list<APIFunction>::iterator it = mInfo.begin();
 
 	while(it!=mInfo.end()){

src/S_IntermodularCallsX86.cpp

@@ -87,7 +87,8 @@ bool S_IntermodularCalls::think()
 				// yeah we know everything about the api-call!
 				std::string functionComment;
 				functionComment = f.ReturnType + " " + f.Name + "(...)";
-				DbgSetCommentAt(c->RVA ,functionComment.c_str());
+				DbgSetAutoCommentAt(c->RVA ,functionComment.c_str());
+				//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %s at %X\n",functionComment , c->RVA);
 				int pos=0;
 				// set comments for the arguments
 				if( (f.Arguments.size() > 0)  && (c->arguments.size() > 0) ){
@@ -98,7 +99,7 @@ bool S_IntermodularCalls::think()
 							break;
 
 						std::string ArgComment = f.arg(pos).Type + " "+ f.arg(pos).Name;
-						DbgSetCommentAt((*a) ,ArgComment.c_str());
+						DbgSetAutoCommentAt((*a) ,ArgComment.c_str());
 						pos++;
 					}
 				}

src/S_IntermodularCallsX86.h

@@ -44,7 +44,7 @@ class S_IntermodularCalls : public ICommand
 		}
 		bool operator<(const _JumpFF& rhs) const
 		{
-			return RVA < rhs.RVA;
+			return (RVA < rhs.RVA);
 		}
 	};
 

src/x64_dbg_analysisplugin.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 11.00
 # Visual Studio 2010
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "x64_dbg_analysisplugin", "x64_dbg_analysisplugin.vcxproj", "{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}"
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "x64_dbg_analysisplugin", "x64_dbg_analysisplugin.vcxproj", "{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
@@ -9,10 +9,10 @@ Global
 		Release|x64 = Release|x64
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|Win32.ActiveCfg = Release|Win32
-		{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|Win32.Build.0 = Release|Win32
-		{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|x64.ActiveCfg = Release|x64
-		{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|x64.Build.0 = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.ActiveCfg = Release|Win32
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.Build.0 = Release|Win32
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.ActiveCfg = Release|x64
+		{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.Build.0 = Release|x64
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE