|
__init__(self,
imm,
dictionaryfiles=None)
This class try to recognize a function using different methods
(address/signature/heuristic). |
source code
|
|
STRING
|
|
INTEGER
|
checkHeuristic(self,
address,
reference,
refFirstCall=[])
Check a given address with a precomputed hash of a function. |
source code
|
|
|
|
|
makeFunctionHashHeuristic(self,
address,
compressed=False,
followCalls=True)
Consider:
- Control Flow Graph
- generalized instructions that:
access memory/write memory/use registers/use constant/call/jmp/jmc
and all his combinations. |
source code
|
|
UNSIGNED LONG
|
|
LIST
|
|
LIST
|
_searchFunctionByHeuristic(self,
search,
functionhash=None,
firstcallhash=None,
exact=None,
heuristic=90,
module=None,
firstbb=None)
Search memory to find a function that fullfit the options. |
source code
|
|
LIST
|
|
STRING
|
|
LIST
|
makeFunctionHash(self,
address,
compressed=False)
Return a list with the best BB to use for a search and the heuristic
hash of the function. |
source code
|
|
|
|
LIST
|
generalizeFunction(self,
address)
Take an address an return a generalized version of the function,
dismissing address and register dependant information. |
source code
|
|
STRING
|
|
DWORD|None
|
|
DWORD|None
|
findFirstBB(self,
address,
recursive=False)
The main idea is traverse a function backward following Xrefs until
we reach a point where there's no more Xrefs other than CALLs |
source code
|
|