mirror of
https://github.com/x64dbg/StaticAnalysis.git
synced 2026-11-12 15:04:14 -10:00
Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
6c138af356 | ||
|
|
84f82f725a | ||
|
|
f64cfaa7ca | ||
|
|
b38053609d |
No files matched your search
@@ -1,6 +1,19 @@
|
||||
x64dbg-StaticAnalysis
|
||||
=====================
|
||||
|
||||
x64dbg-StaticAnalysis
|
||||
- plugin for x64_dbg
|
||||
- see [release page](https://github.com/x64dbg/x64dbg-StaticAnalysis/releases) for a working plugin
|
||||
|
||||
a plugin for www.x64dbg.com
|
||||
##Roadmap
|
||||
see [dev branch](https://github.com/x64dbg/x64dbg-StaticAnalysis/tree/enhance)
|
||||
|
||||
- x64 calling convention (x64 version)
|
||||
- Stackemulator (for MingGM-argument-passing)
|
||||
- function-finder
|
||||
- case-switch detection
|
||||
- "MB_OK"-like symbols
|
||||
- loop-detection
|
||||
- flow-heuristic against obfuscation instead of linear scanning
|
||||
|
||||
## License
|
||||
GLPv3
|
||||
@@ -35,6 +35,10 @@ void AnalysisRunner::start(){
|
||||
_plugin_logputs("[StaticAnalysis] analysis finished ...");
|
||||
}
|
||||
|
||||
const duint AnalysisRunner::baseAddress() const{
|
||||
return mBaseAddress;
|
||||
}
|
||||
|
||||
void AnalysisRunner::run()
|
||||
{
|
||||
unsigned char* data = new unsigned char[mSize];
|
||||
|
||||
@@ -46,5 +46,6 @@ public:
|
||||
void clear( );
|
||||
void think( );
|
||||
void initialise();
|
||||
const duint baseAddress() const;
|
||||
};
|
||||
|
||||
+3
-1
@@ -86,10 +86,12 @@ ApiDB::~ApiDB(void)
|
||||
|
||||
APIFunction ApiDB::find( std::string name )
|
||||
{
|
||||
if(name[0]=='&')
|
||||
name.erase (0,1);
|
||||
APIFunction f;
|
||||
f.invalid = true;
|
||||
|
||||
|
||||
//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] search data %s \n",name.c_str() );
|
||||
std::list<APIFunction>::iterator it = mInfo.begin();
|
||||
|
||||
while(it!=mInfo.end()){
|
||||
|
||||
@@ -87,7 +87,8 @@ bool S_IntermodularCalls::think()
|
||||
// yeah we know everything about the api-call!
|
||||
std::string functionComment;
|
||||
functionComment = f.ReturnType + " " + f.Name + "(...)";
|
||||
DbgSetCommentAt(c->RVA ,functionComment.c_str());
|
||||
DbgSetAutoCommentAt(c->RVA ,functionComment.c_str());
|
||||
//_plugin_logprintf("[StaticAnalysis:IntermodularCalls] found %s at %X\n",functionComment , c->RVA);
|
||||
int pos=0;
|
||||
// set comments for the arguments
|
||||
if( (f.Arguments.size() > 0) && (c->arguments.size() > 0) ){
|
||||
@@ -98,7 +99,7 @@ bool S_IntermodularCalls::think()
|
||||
break;
|
||||
|
||||
std::string ArgComment = f.arg(pos).Type + " "+ f.arg(pos).Name;
|
||||
DbgSetCommentAt((*a) ,ArgComment.c_str());
|
||||
DbgSetAutoCommentAt((*a) ,ArgComment.c_str());
|
||||
pos++;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,7 +44,7 @@ class S_IntermodularCalls : public ICommand
|
||||
}
|
||||
bool operator<(const _JumpFF& rhs) const
|
||||
{
|
||||
return RVA < rhs.RVA;
|
||||
return (RVA < rhs.RVA);
|
||||
}
|
||||
};
|
||||
|
||||
|
||||
Binary file not shown.
@@ -1,7 +1,7 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 11.00
|
||||
# Visual Studio 2010
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "x64_dbg_analysisplugin", "x64_dbg_analysisplugin.vcxproj", "{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}"
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "x64_dbg_analysisplugin", "x64_dbg_analysisplugin.vcxproj", "{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
@@ -9,10 +9,10 @@ Global
|
||||
Release|x64 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|Win32.ActiveCfg = Release|Win32
|
||||
{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|Win32.Build.0 = Release|Win32
|
||||
{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|x64.ActiveCfg = Release|x64
|
||||
{CB859ADC-243D-4B05-E4EA-4A9CD1F318A2}.Release|x64.Build.0 = Release|x64
|
||||
{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.ActiveCfg = Release|Win32
|
||||
{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|Win32.Build.0 = Release|Win32
|
||||
{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.ActiveCfg = Release|x64
|
||||
{56EC1214-EF57-5BB5-8D3B-E74ED52F6386}.Release|x64.Build.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
|
||||
Binary file not shown.
Reference in new issue
Block a user