Libs.libanalize

103 - def __init__(self, imm, addr):

104 self.imm = imm 105 self.address = addr 106 self.operand = []

107 108

109 - def _getfromtuple(self, opcode):

110 self.ip=opcode[0] # Instruction pointer 111 self.dump=opcode[1] # Hexadecimal dump of the command 112 self.result=opcode[2] # Disassembled command 113 self.comment=opcode[3] # Brief comment 114 self.opinfo=opcode[4] # Comments to command's operands (tuple[3]) 115 self.cmdtype=opcode[5] # One of C_xxx 116 self.memtype=opcode[6] # Type of addressed variable in memory 117 self.nprefix=opcode[7] # Number of prefixes 118 self.indexed=opcode[8] # Address contains register(s) 119 self.jmpconst=opcode[9] # Constant jump address 120 self.jmptable=opcode[10] # Possible address of switch table 121 self.adrconst=opcode[11] # Constant part of address 122 self.immconst=opcode[12] # Immediate constant 123 self.zeroconst=opcode[13] # Whether contains zero constant 124 self.fixupoffset=opcode[14] # Possible offset of 32-bit fixups 125 self.fixupsize=opcode[15] # Possible total size of fixups or 0 126 self.jmpaddr=opcode[16] # Destination of jump/call/return 127 self.condition=opcode[17] # 0xFF:unconditional, 0:false, 1:true 128 self.error=opcode[18] # Error while disassembling command 129 self.warnings=opcode[19] # Combination of DAW_xxx 130 self.optype=opcode[20] # Type of operand (extended set DEC_xxx) (tuple[3]) 131 self.operandsize=opcode[21] # Size of operand, bytes (tuple[3]) 132 self.opsize=opcode[22] #common opsize in bytes (this is the one you want, almost sure) 133 self.opgood=opcode[23] # Whether address and data valid (tuple[3]) 134 self.opaddr=opcode[24] # Address if memory, index if register (tuple[3]) 135 self.opdata=opcode[25] # Actual value (only integer operands) (tuple[3]) 136 #NOTE ABOUT self.operand: 137 #self.operand[n][0] = operand type DEC_xxx (mem) or DECR_xxx (reg,const) 138 #self.operand[n][1] = operand size 139 #self.operand[n][2][x] = where x any reg value from 0 to 7 = scales of registers 140 #self.operand[n][3] segment register 141 #self.operand[n][4] Constant 142 self.operand=opcode[26] # Full description of operand (tuple[3]) 143 144 145 self.regdata=opcode[27] # Registers after command is executed / status of registers list[(reg,status)] 146 self.addrdata=opcode[28] # Traced memory address 147 self.addrstatus=opcode[29] # Status of addrdata, one of RST_xxx 148 self.regstack=opcode[30] # Stack tracing buffer / status of stack items list[(stack,status)]

149 #self.nregstack=opcode[32] # Number of items in stack trace buffer 150 151 # We need to include more than one register 152 # ex: [EAX+EDI+2]

153 - def getOperandRegister(self, num):

154 try: 155 return RegisterName[ self.operand[num][2] ] 156 except KeyError: 157 return "[]"

158

159 - def getIP(self):

160 return self.ip

161

162 - def getAddress(self):

163 return self.address

164

165 - def getDump(self):

166 return self.dump

167

168 - def getResult(self):

169 return self.result

170

171 - def getDisasm(self):

172 return self.result

173

174 - def getComment(self):

175 return self.comment

176

177 - def getOpInfo(self):

178 return self.opinfo

179

180 - def isCmd(self):

181 return self.getCmdType() == C_CMD

182

183 - def isPush(self):

184 return self.getCmdType() == C_PSH

185

186 - def isPop(self):

187 return self.getCmdType() == C_POP

188

189 - def isCall(self):

190 return self.getCmdType() == C_CAL

191

192 - def isJmp(self):

193 return self.getCmdType() == C_JMP

194

195 - def isConditionalJmp(self):

196 return self.getCmdType() == C_JMC

197

198 - def isRet(self):

199 return self.getCmdType() == C_RET

200

201 - def isRep(self):

202 return self.getCmdType() == C_REP

203

204 - def getCmd(self):

205 return self.cmdtype

206

207 - def getCmdType(self):

208 # types are defined as C_* 209 return self.cmdtype & C_TYPEMASK

210

211 - def getMemType(self):

212 return self.memtype

213

214 - def getnPrefix(self):

215 return self.nprefix

216

217 - def getIndexed(self):

218 return self.indexed

219

220 - def getJmpConst(self):

221 return self.jmpconst

222

223 - def getJmpTable(self):

224 return self.jmptable

225

226 - def getAddrConst(self):

227 return self.adrconst

228

229 - def getImmConst(self):

230 return self.immconst

231

232 - def getZeroConst(self):

233 return self.zeroconst

234

235 - def getFixUpOffset(self):

236 return self.fixupoffset

237

238 - def getFixUpSize(self):

239 return self.fixupsize

240

241 - def getJmpAddr(self):

242 return self.jmpaddr

243

244 - def getCondition(self):

245 return self.condition

246

247 - def getError(self):

248 return self.error

249

250 - def getWarnings(self):

251 return self.warnings

252

253 - def getOpType(self):

254 return self.optype

255

256 - def getOpSize(self):

257 return self.opsize

258

259 - def getSize(self):

260 return self.opsize

261

262 - def getOpGood(self):

263 return self.opgood

264

265 - def getOpAddr(self):

266 return self.opaddr

267

268 - def getOpData(self):

269 return self.opdata

270

271 - def getRegData(self):

272 return self.regdata

273

274 - def getRegStatus(self):

275 return self.regdata

276

277 - def getAddrData(self):

278 return self.addrdata

279

280 - def getAddrStatus(self):

281 return self.addrstatus

282

283 - def getRegStack(self):

284 return self.regstack

285

286 - def getRstStatus(self):

287 return self.regstack

288

289 - def getnRegStack(self):

290 return "deprecated"

291 292 #NOTE: info panel is runtime information, no matter which opcode you use to fetch it 293 # you'll have the info IP linked. 294

295 - def getInfoPanel(self):

296 return debugger.Getinfopanel()

Source Code for Module Libs.libanalize