smda 2.0.2__tar.gz → 2.2.0__tar.gz

smda-2.2.0/PKG-INFO

@@ -0,0 +1,140 @@
+Metadata-Version: 2.1
+Name: smda
+Version: 2.2.0
+Summary: A recursive disassmbler optimized for CFG recovery from memory dumps. Based on capstone.
+Home-page: https://github.com/danielplohmann/smda
+Author: Daniel Plohmann
+Author-email: daniel.plohmann@mailbox.org
+License: BSD 2-Clause
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Disassemblers
+Description-Content-Type: text/markdown
+License-File: LICENSE
+
+
+# SMDA
+
+SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.
+It is based on [Capstone](http://www.capstone-engine.org/) and currently supports x86/x64 Intel machine code.
+As input, arbitrary memory dumps (ideally with known base address) can be processed.
+The output is a collection of functions, basic blocks, and instructions with their respective edges between blocks and functions (in/out).
+Optionally, references to the Windows API can be inferred by using the ApiScout method.
+
+## Installation
+
+With version 1.2.0, we have finally simplified things by moving to [PyPI](https://pypi.org/project/smda/)!  
+So installation now is as easy as:
+
+```
+$ pip install smda
+```
+
+## Usage
+
+A typical workflow using SMDA could like this:
+
+```
+>>> from smda.Disassembler import Disassembler
+>>> disassembler = Disassembler()
+>>> report = disassembler.disassembleFile("/bin/cat")
+>>> print(report)
+ 0.777s -> (architecture: intel.64bit, base_addr: 0x00000000): 143 functions
+>>> for fn in report.getFunctions():
+...     print(fn)
+...     for ins in fn.getInstructions():
+...         print(ins)
+...
+0x00001720: (->   1,    1->)   3 blocks,    7 instructions.
+0x00001720: (      4883ec08) - sub rsp, 8
+0x00001724: (488b05bd682000) - mov rax, qword ptr [rip + 0x2068bd]
+0x0000172b: (        4885c0) - test rax, rax
+0x0000172e: (          7402) - je 0x1732
+0x00001730: (          ffd0) - call rax
+0x00001732: (      4883c408) - add rsp, 8
+0x00001736: (            c3) - ret 
+0x00001ad0: (->   1,    4->)   1 blocks,   12 instructions.
+[...]
+>>> json_report = report.toDict()
+``` 
+
+There is also a demo script:
+
+* analyze.py -- example usage: perform disassembly on a file or memory dump and optionally store results in JSON to a given output path.
+
+The code should be fully compatible with Python 3.8+.
+Further explanation on the innerworkings follow in separate publications but will be referenced here.
+
+To take full advantage of SMDA's capabilities, make sure to (optionally) install:
+ * lief 
+ * pdbparse (currently as fork from https://github.com/VPaulV/pdbparse to support Python3)
+
+## Version History
+ * 2025-06-13: v2.1.0 - Support for export from IDA 9.0+ (THX to @jershmagersh for the update!).
+ * 2025-02-26: v2.0.2 - Adjusting relative import, adding init file.
+ * 2025-02-25: v2.0.0 - Initial experimental support for CIL (.NET) disassembly.
+ * 2025-02-24: v1.14.3 - PicHashing can now be disabled via SmdaConfig to save some processing time. (THX to @Nalexander-hanel!)
+ * 2025-02-24: v1.14.2 - We are Python 3.8+ compatible again (changed UTC usage) and (DWARF) PE symbols for PE files should be extracted again (THX to @N0fix for the update!)
+ * 2025-02-21: v1.14.1 - Fixed changed field names in LIEF usage that broke ELF parsing, added tests for ELF+macOS parsing (THX to @N0fix for the update!)
+ * 2025-01-29: v1.14.0 - Bump to LIEF 0.16.0+ (THX to @huettenhain for the ping!). Migrated tests to `pytest`, UTC datetime handling fixes.
+ * 2025-01-26: v1.13.24 - Added functionality to import and export SMDA reports as JSON. Fixed byte patterns matching special regex chars (THX to @alexander-hanel!).
+ * 2024-07-26: v1.13.23 - Now using OEP as symbol function candidate when available (THX to @alexander-hanel for reporting!).
+ * 2024-05-10: v1.13.22 - Handled odd case where disassembly with capstone and IDA would return different results (THX to @r0ny123 for reporting!).
+ * 2024-04-17: v1.13.21 - Fixed handling of Go binaries for version 1.20+ (THX to @Manny684!).
+ * 2024-04-08: v1.13.20 - Fixed handling of bnd prefix in CFG instructions to help with parsing PLT (THX to @Manny684!).
+ * 2024-04-02: v1.13.19 - Fixed bug in string parsing, added tests, strings now no longer are hex-encoded as they are always printable anyway.
+ * 2024-03-12: v1.13.18 - Added functionality to extract and store all referenced strings along SmdaFunctions (has to be enabled via SmdaConfig).
+ * 2024-03-12: v1.13.17 - Extended disassembleBuffer() to now take additional arguments `code_areas` and `oep`.
+ * 2024-02-21: v1.13.16 - BREAKING IntelInstructionEscaper.escapeMnemonic: Escaper now handles another 200 instruction names found in other capstone source files (THX for reporting @malwarefrank!).
+ * 2024-02-15: v1.13.15 - Fixed issues with version recognition in SmdaFunction which cause issues in MCRIT (THX to @
+malwarefrank!) 
+ * 2024-02-02: v1.13.12 - Versions might be non-numerical, addressed that in SmdaFunction.
+ * 2024-01-23: v1.13.11 - Introduced indicator in SmdaConfig for compatibility of instruction escaping.
+ * 2024-01-23: v1.13.10 - Parsing of PE files should work again with lief >=0.14.0.
+ * 2024-01-23: v1.13.9  - Improved parsing robustness for section/segment tables in ELF files, also now padding with zeroes when finding less content than expected physical size in a segment (THX for reporting @schrodyn!).
+ * 2024-01-23: v1.13.8  - BREAKING adjustments to IntelInstructionEscaper.escapeMnemonic: Escaper now is capable of handling all known x86/x64 instructions in capstone (THX for reporting @schrodyn!).
+ * 2023-12-01: v1.13.7  - Skip processing of Delphi structs for large files, workaround until this is properly reimplemented.
+ * 2023-11-29: v1.13.6  - Made OpcodeHash an attribute with on-demand calculation to save processing time.
+ * 2023-11-29: v1.13.3  - Implemented an alternative queue working with reference count based brackets in pursuit of accelerated processing.
+ * 2023-11-28: v1.13.2  - IndirectCallAnalyzer will now analyze at most a configurable amount of calls per basic block, default 50.
+ * 2023-11-21: v1.13.1  - SmdaBasicBlock now has `getPredecessors()` and `getSuccessors()`.
+ * 2023-11-21: v1.13.0  - BREAKING adjustments to PicHashing (now wildcarding intraprocedural jumps in functions, additionally more immediates if within address space). Introduction of OpcodeHash (OpcHash), which wildcards all but prefixes and opcode bytes.
+ * 2023-10-12: v1.12.7  - Bugfix for parsing Delphi structs.
+ * 2023-09-15: v1.12.6  - Bugfix in BlockLocator (THX to @cccs-ay!).
+ * 2023-08-28: v1.12.5  - Bugfix for address dereferencing where buffer sizes were not properly checked (THX to @yankovs!).
+ * 2023-08-08: v1.12.4  - SmdaBasicBlock can now do getPicBlockHash().
+ * 2023-05-23: v1.12.3  - Fixed bugs in PE parser and Go parser.
+ * 2023-05-08: v1.12.1  - Get rid of deprecation warning in IDA 8.0+.
+ * 2023-03-24: v1.12.0  - SMDA now parses PE export directories for symbols, as well as MinGW DWARF information if available.
+ * 2023-03-14: v1.11.2  - SMDA report now also contains SHA1 and MD5.
+ * 2023-03-14: v1.11.1  - rendering dotGraph can now include API references instead of plain calls.
+ * 2023-02-06: v1.11.0  - SmdaReport now has functionality to find a function/block by a given offset contained within in (THX to @cccs-ay!).
+ * 2023-02-06: v1.10.0  - Adjusted to LIEF 0.12.3 API for binary parsing (THX to @lainswork!).
+ * 2022-08-12: v1.9.1   - Added support for parsing intel MachO files, including Go parsing.
+ * 2022-08-01: v1.8.0   - Added support for parsing Go function information (THX to @danielenders1!).
+ * 2022-01-27: v1.7.0   - SmdaReports now contains a field `oep`; SmdaFunctions now indicate `is_exported` and can provide CodeXrefs via `getCodeInrefs()` and `getCodeOutrefs()`. (THX for the ideas: @mr-tz)
+ * 2021-08-20: v1.6.0   - Bugfix for alignment calculation of binary mappings. (THX: @williballenthin)
+ * 2021-08-19: v1.6.0   - Bugfix for truncation during ELF segment/section loading. API usage in ELF files is now resolved as well! (THX: @williballenthin)
+ * 2020-10-30: v1.5.0   - PE section table now contained in SmdaReport and added `SmdaReport.getSection(offset)`.
+ * 2020-10-26: v1.4.0   - Adding SmdaBasicBlock. Some convenience code to ease intgration with capa. (GeekWeek edition!) 
+ * 2020-06-22: v1.3.0   - Added DominatorTree (Implementation by Armin Rigo) to calculate function nesting depth, shortened PIC hash to 8 byte, added some missing instructions for the InstructionEscaper, IdaInterface now demangles names.
+ * 2020-04-29: v1.2.0   - Restructured config.py into smda/SmdaConfig.py to similfy usage and now available via PyPI! The smda/Disassembler.py now emits a report object (smda.common.SmdaReport) that allows direct (pythonic) interaction with the results - a JSON can still be easily generated by using toDict() on the report.
+ * 2020-04-28: v1.1.0   - Several improvements, including: x64 jump table handling, better data flow handling for calls using registers and tailcalls, extended list of common prologues based on much more groundtruth data, extended padding instruction list for gap function discovery, adjusted weights in candidate priority score, filtering code areas based on section tables, using exported symbols as candidates, new function output metadata: confidence score based on instruction mnemonic histogram, PIC hash based on escaped binary instruction sequence
+ * 2018-07-01: v1.0.0   - Initial Release.
+
+
+## Credits
+
+Thanks to Steffen Enders for his extensive contributions to this project!
+Thanks to Paul Hordiienko for adding symbol parsing support (ELF+PDB)!
+Thanks to Jonathan Crussell for helping me to beef up SMDA enough to make it a disassembler backend in capa!
+Thanks to Willi Ballenthin for improving handling of ELF files, including properly handling API usage!
+Thanks to Daniel Enders for his contributions to the parsing of the Golang function registry and label information!
+The project uses the implementation of Tarjan's Algorithm by Bas Westerbaan and the implementation of Lengauer-Tarjan's Algorithm for the DominatorTree by Armin Rigo.
+
+Pull requests welcome! :)
+

{smda-2.0.2 → smda-2.2.0}/README.md

@@ -56,6 +56,7 @@ To take full advantage of SMDA's capabilities, make sure to (optionally) install
  * pdbparse (currently as fork from https://github.com/VPaulV/pdbparse to support Python3)
 
 ## Version History
+ * 2025-06-13: v2.1.0 - Support for export from IDA 9.0+ (THX to @jershmagersh for the update!).
  * 2025-02-26: v2.0.2 - Adjusting relative import, adding init file.
  * 2025-02-25: v2.0.0 - Initial experimental support for CIL (.NET) disassembly.
  * 2025-02-24: v1.14.3 - PicHashing can now be disabled via SmdaConfig to save some processing time. (THX to @Nalexander-hanel!)

{smda-2.0.2 → smda-2.2.0}/setup.py

@@ -19,7 +19,7 @@ else:
 setup(
     name='smda',
     # note to self: always change this in config as well.
-    version='2.0.2',
+    version='2.2.0',
     description='A recursive disassmbler optimized for CFG recovery from memory dumps. Based on capstone.',
     long_description_content_type="text/markdown",
     long_description=long_description,

{smda-2.0.2 → smda-2.2.0}/smda/Disassembler.py

@@ -10,6 +10,7 @@ from smda.utility.MemoryFileLoader import MemoryFileLoader
 from smda.utility.StringExtractor import extract_strings
 from smda.SmdaConfig import SmdaConfig
 from smda.common.BinaryInfo import BinaryInfo
+from smda.common.labelprovider.GoLabelProvider import GoSymbolProvider
 from smda.common.SmdaReport import SmdaReport
 from smda.intel.IntelDisassembler import IntelDisassembler
 from smda.cil.CilDisassembler import CilDisassembler
@@ -54,12 +55,18 @@ class Disassembler(object):
         LOGGER.debug("Current analysis callback time %s", (time_diff))
         return time_diff.seconds >= self._timeout
 
-    def _addStringsToReport(self, smda_report, buffer):
+    def _addStringsToReport(self, smda_report, buffer, mode=None):
         smda_report.buffer = buffer
         for smda_function in smda_report.getFunctions():
-            function_strings = {}
-            for string, addr in extract_strings(smda_function):
-                function_strings[addr] = string
+            function_strings = []
+            for string_result in extract_strings(smda_function, mode=mode):
+                string, referencing_addr, string_addr, string_type = string_result
+                function_strings.append({
+                    "string": string,
+                    "ins_addr": referencing_addr,
+                    "data_addr": string_addr,
+                    "type": string_type
+                })
             smda_function.stringrefs = function_strings
 
     def disassembleFile(self, file_path, pdb_path=""):
@@ -82,7 +89,9 @@ class Disassembler(object):
             self.disassembler.addPdbFile(binary_info, pdb_path)
             smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
             if self.config.WITH_STRINGS:
-                self._addStringsToReport(smda_report, file_content)
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
             if self.config.STORE_BUFFER:
                 smda_report.buffer = file_content
         except Exception as exc:
@@ -110,7 +119,9 @@ class Disassembler(object):
         try:
             smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
             if self.config.WITH_STRINGS:
-                self._addStringsToReport(smda_report, file_content)
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
             if self.config.STORE_BUFFER:
                 smda_report.buffer = file_content
         except Exception as exc:
@@ -136,7 +147,9 @@ class Disassembler(object):
         try:
             smda_report = self._disassemble(binary_info, timeout=self.config.TIMEOUT)
             if self.config.WITH_STRINGS:
-                self._addStringsToReport(smda_report, file_content)
+                is_go_binary = GoSymbolProvider(None).getPcLntabOffset(binary_info.binary)
+                string_mode = "go" if is_go_binary else None
+                self._addStringsToReport(smda_report, file_content, mode=string_mode)
             if self.config.STORE_BUFFER:
                 smda_report.buffer = file_content
         except Exception as exc:

{smda-2.0.2 → smda-2.2.0}/smda/SmdaConfig.py

@@ -5,7 +5,7 @@ import logging
 class SmdaConfig(object):
 
     # note to self: always change this in setup.py as well!
-    VERSION = "2.0.2"
+    VERSION = "2.2.0"
     ESCAPER_DOWNWARD_COMPATIBILITY = "1.13.16"
     CONFIG_FILE_PATH = str(os.path.abspath(__file__))
     PROJECT_ROOT = str(os.path.abspath(os.sep.join([CONFIG_FILE_PATH, "..", ".."])))

{smda-2.0.2 → smda-2.2.0}/smda/common/BinaryInfo.py

@@ -3,6 +3,9 @@ import hashlib
 import lief
 lief.logging.disable()
 
+from smda.common.labelprovider.PeSymbolProvider import PeSymbolProvider
+from smda.common.labelprovider.ElfSymbolProvider import ElfSymbolProvider
+
 
 class BinaryInfo(object):
     """ simple DTO to contain most information related to the binary/buffer to be analyzed """
@@ -24,6 +27,7 @@ class BinaryInfo(object):
     md5 = ""
     version = ""
     exported_functions = None
+    imported_functions = None
     oep = None
 
     def __init__(self, binary):
@@ -46,11 +50,21 @@ class BinaryInfo(object):
     def getExportedFunctions(self):
         if self.exported_functions is None:
             lief_result = lief.parse(self.raw_data)
-            if isinstance(lief_result, lief.PE.Binary) or isinstance(lief_result, lief.ELF.Binary):
-                self.exported_functions = {}
-                for function in lief_result.exported_functions:
-                    self.exported_functions[function.address] = function.name
+            if isinstance(lief_result, lief.PE.Binary):
+                self.exported_functions = PeSymbolProvider(None).parseExports(lief_result)
+            elif isinstance(lief_result, lief.ELF.Binary):
+                self.exported_functions = ElfSymbolProvider(None).parseExports(lief_result)
         return self.exported_functions
+    
+    def getImportedFunctions(self):
+        if self.imported_functions is None:
+            lief_result = lief.parse(self.raw_data)
+            if isinstance(lief_result, lief.PE.Binary):
+                imports = PeSymbolProvider(None).parseSymbols(lief_result)
+                self.imported_functions = PeSymbolProvider(None).parseImports(lief_result)
+            elif isinstance(lief_result, lief.ELF.Binary):
+                self.imported_functions = ElfSymbolProvider(None).parseSymbols(lief_result.dynamic_symbols)
+        return self.imported_functions
 
     def getSections(self):
         pefile = lief.parse(self.raw_data)
@@ -75,3 +89,12 @@ class BinaryInfo(object):
         else:
             is_inside = any([a[0] <= address < a[1] for a in self.code_areas])
         return is_inside
+
+    def getHeaderBytes(self):
+        if self.raw_data:
+            lief_result = lief.parse(self.raw_data)
+            if isinstance(lief_result, lief.PE.Binary):
+                return self.raw_data[:0x400]
+            elif isinstance(lief_result, lief.ELF.Binary):
+                return self.raw_data[:0x40]
+        return None

{smda-2.0.2 → smda-2.2.0}/smda/common/SmdaFunction.py

@@ -227,7 +227,7 @@ class SmdaFunction(object):
         smda_function.pic_hash = function_dict["metadata"]["pic_hash"] if "pic_hash" in function_dict["metadata"] else None
         smda_function.strongly_connected_components = function_dict["metadata"]["strongly_connected_components"]
         smda_function.tfidf = function_dict["metadata"]["tfidf"]
-        smda_function.stringrefs = {addr: string for addr, string in function_dict["stringrefs"].items()} if "stringrefs" in function_dict else {}
+        smda_function.stringrefs = function_dict["stringrefs"] if "stringrefs" in function_dict else {}
         if binary_info and binary_info.architecture:
             smda_function._escaper = IntelInstructionEscaper if binary_info.architecture in ["intel"] else None
         else:
@@ -264,7 +264,7 @@ class SmdaFunction(object):
             "offset": self.offset,
             "blocks": blocks_as_dict,
             "apirefs": self.apirefs,
-            "stringrefs": {addr: string for addr, string in self.stringrefs.items()} if self.stringrefs is not None else {},
+            "stringrefs": self.stringrefs if self.stringrefs is not None else {},
             "blockrefs": self.blockrefs,
             "inrefs": self.inrefs,
             "outrefs": self.outrefs,

{smda-2.0.2 → smda-2.2.0}/smda/common/SmdaReport.py

@@ -55,6 +55,7 @@ class SmdaReport(object):
     timestamp = None
     version = None
     xcfg = None
+    xheader = None
 
     # on first usage, initialize codexrefs objects for all functions based on inrefs/outrefs (requires knowledge about all functions)
     _has_codexrefs = False
@@ -95,6 +96,11 @@ class SmdaReport(object):
             self.timestamp = datetime.datetime.now(datetime.timezone.utc)
             self.version = disassembly.binary_info.version
             self.xcfg = self._convertCfg(disassembly, config=config)
+            self.xheader = disassembly.binary_info.getHeaderBytes()
+            self.xmetadata = {
+                "exported_functions": disassembly.binary_info.getExportedFunctions(),
+                "imported_functions": disassembly.binary_info.getImportedFunctions(),
+            }
 
     def _convertCfg(self, disassembly, config=None):
         function_results = {}
@@ -257,6 +263,8 @@ class SmdaReport(object):
         binary_info.binary_size = smda_report.binary_size
         binary_info.oep = smda_report.oep
         smda_report.xcfg = {int(function_addr): SmdaFunction.fromDict(function_dict, binary_info=binary_info, version=smda_report.smda_version, smda_report=smda_report) for function_addr, function_dict in report_dict["xcfg"].items()}
+        smda_report.xheader = bytes.fromhex(report_dict["xheader"]) if "xheader" in report_dict else None
+        smda_report.xmetadata = report_dict["xmetadata"] if "xmetadata" in report_dict else None
         return smda_report
 
     def toDict(self) -> dict:
@@ -289,7 +297,9 @@ class SmdaReport(object):
             "statistics": self.statistics.toDict(),
             "status": self.status,
             "timestamp": self.timestamp.strftime("%Y-%m-%dT%H-%M-%S"),
-            "xcfg": {function_addr: smda_function.toDict() for function_addr, smda_function in self.xcfg.items()}
+            "xcfg": {function_addr: smda_function.toDict() for function_addr, smda_function in self.xcfg.items()},
+            "xheader": self.xheader.hex() if self.xheader else "",
+            "xmetadata": self.xmetadata,
         }
 
     @classmethod

{smda-2.0.2 → smda-2.2.0}/smda/common/labelprovider/ElfSymbolProvider.py

@@ -46,27 +46,31 @@ class ElfSymbolProvider(AbstractLabelProvider):
         lief_binary = lief.parse(data)
         self._parseOep(lief_binary)
         # TODO split resolution into API/dynamic part and local symbols
-        self._parseExports(lief_binary)
-        self._parseSymbols(lief_binary.symtab_symbols)
-        self._parseSymbols(lief_binary.dynamic_symbols)
+        self._func_symbols.update(self.parseExports(lief_binary))
+        self._func_symbols.update(self.parseSymbols(lief_binary.symtab_symbols))
+        self._func_symbols.update(self.parseSymbols(lief_binary.dynamic_symbols))
         for reloc in lief_binary.relocations:
             if reloc.has_symbol:
                 self._func_symbols[reloc.address] = reloc.symbol.name
 
-    def _parseExports(self, binary):
+    def parseExports(self, binary):
+        function_symbols = {}
         for function in binary.exported_functions:
-            self._func_symbols[function.address] = function.name
+            function_symbols[function.address] = function.name
+        return function_symbols
 
-    def _parseSymbols(self, symbols):
+    def parseSymbols(self, symbols):
+        function_symbols = {}
         for symbol in symbols:
-            if symbol.is_function:
+            if symbol is not None and symbol.is_function:
                 if symbol.value != 0:
                     func_name = ""
                     try:
                         func_name = symbol.demangled_name
                     except:
                         func_name = symbol.name
-                    self._func_symbols[symbol.value] = func_name
+                    function_symbols[symbol.value] = func_name
+        return function_symbols
 
     def getSymbol(self, address):
         return self._func_symbols.get(address, "")

{smda-2.0.2 → smda-2.2.0}/smda/common/labelprovider/GoLabelProvider.py

@@ -19,8 +19,7 @@ class GoSymbolProvider(AbstractLabelProvider):
         # addr:func_name
         self._func_symbols = {}
 
-    def update(self, binary_info):
-        binary = binary_info.binary
+    def getPcLntabOffset(self, binary):
         pclntab_offset = None
         try:
             lief_binary = lief.parse(binary)
@@ -37,10 +36,13 @@ class GoSymbolProvider(AbstractLabelProvider):
             # scan for offset of structure
             pclntab_regex = re.compile(b".\xFF\xFF\xFF\x00\x00\x01(\x04|\x08)")
             hits = [match.start() for match in re.finditer(pclntab_regex, binary)]
-            if len(hits) > 1:
-                logging.error("GoLabelProvider found too many candidates for pclntab")
-            elif len(hits) == 1:
+            if len(hits) == 1:
                 pclntab_offset = hits[0]
+        return pclntab_offset is not None
+
+    def update(self, binary_info):
+        binary = binary_info.binary
+        pclntab_offset = self.getPcLntabOffset(binary)
         # if we found a valid offset, do the pclntab parsing
         if pclntab_offset:
             try:

{smda-2.0.2 → smda-2.2.0}/smda/common/labelprovider/PeSymbolProvider.py

@@ -2,6 +2,7 @@
 
 import logging
 from .AbstractLabelProvider import AbstractLabelProvider
+from smda.common.labelprovider.OrdinalHelper import OrdinalHelper
 
 LOGGER = logging.getLogger(__name__)
 
@@ -42,11 +43,12 @@ class PeSymbolProvider(AbstractLabelProvider):
         lief_binary = lief.parse(binary_info.file_path)
         if lief_binary is not None:
             self._parseOep(lief_binary)
-            self._parseExports(lief_binary)
-            self._parseSymbols(lief_binary)
+            self._func_symbols.update(self.parseExports(lief_binary))
+            self._func_symbols.update(self.parseSymbols(lief_binary))
 
-    def _parseExports(self, binary):
-        for function in binary.exported_functions:
+    def parseExports(self, lief_binary):
+        function_symbols = {}
+        for function in lief_binary.exported_functions:
             function_name = ""
             try:
                 # here may occur a LIEF exception that we want to skip ->
@@ -54,11 +56,13 @@ class PeSymbolProvider(AbstractLabelProvider):
                 function_name = function.name
             except:
                 pass
-            if function_name and all(c in range(0x20, 0x7f) for c in function_name):
-                self._func_symbols[binary.imagebase + function.address] = function_name
+            if function_name and all(ord(c) in range(0x20, 0x7f) for c in function_name):
+                function_symbols[lief_binary.imagebase + function.address] = function_name
+        return function_symbols
 
-    def _parseSymbols(self, lief_binary):
+    def parseSymbols(self, lief_binary):
         # find VA of first code section
+        function_symbols = {}
         code_base_address = None
         for section in lief_binary.sections:
             if section.characteristics & 0x20000000:
@@ -78,8 +82,21 @@ class PeSymbolProvider(AbstractLabelProvider):
                 if function_name and all(ord(c) in range(0x20, 0x7f) for c in function_name):
                     # for some reason, we need to add the section_offset of .text here
                     function_offset = code_base_address + symbol.value
-                    if function_offset not in self._func_symbols:
-                        self._func_symbols[function_offset] = function_name
+                    if function_offset not in function_symbols:
+                        function_symbols[function_offset] = function_name
+        return function_symbols
+    
+    def parseImports(self, lief_binary):  
+        import_symbols = {}
+        for imported_library in lief_binary.imports:
+            for func in imported_library.entries:
+                if func.name:
+                    import_symbols[func.iat_address + lief_binary.imagebase] = (imported_library.name.lower(), func.name)
+                elif func.is_ordinal:
+                    resolved_ordinal = OrdinalHelper.resolveOrdinal(imported_library.name.lower(), func.ordinal)
+                    ordinal_name = resolved_ordinal if resolved_ordinal else "#%s" % func.ordinal
+                    import_symbols[func.iat_address + lief_binary.imagebase] = (imported_library.name.lower(), ordinal_name)
+        return import_symbols
 
     def getSymbol(self, address):
         return self._func_symbols.get(address, "")

{smda-2.0.2 → smda-2.2.0}/smda/ida/IdaInterface.py

@@ -32,8 +32,10 @@ class IdaInterface(object):
     instance = None
     def __init__(self):
         if not IdaInterface.instance:
-            if idaapi.IDA_SDK_VERSION >= 740:
+            if idaapi.IDA_SDK_VERSION >= 740 and idaapi.IDA_SDK_VERSION < 900:
                 IdaInterface.instance = Ida74Interface()
+            if idaapi.IDA_SDK_VERSION >= 900:
+                IdaInterface.instance = Ida90Interface()
             else:
                 IdaInterface.instance = Ida73Interface()
 
@@ -283,3 +285,119 @@ class Ida73Interface(BackendInterface):
         else:
             self._api_map[addr] = name
         return True
+
+class Ida90Interface(BackendInterface):
+
+    def __init__(self):
+        self.version = "IDA Pro 9.0"
+        self._processor_map = {
+            "metapc": "intel"
+        }
+        self._api_map = {}
+        self._import_module_name = ""
+
+    def getArchitecture(self):
+        procname = idaapi.inf_get_procname()
+        if procname in self._processor_map:
+            return self._processor_map[procname]
+        else:
+            raise ValueError("Unsupported Architecture")
+
+    def getBitness(self):
+        # https://blog.junron.dev/IDAPython%20Research/IDAPython%208%20to%209.html#idaapi-get-inf-structure
+        bits = None
+        if idaapi.inf_is_64bit():
+            bits = 64
+        elif idaapi.inf_is_32bit_exactly():
+            bits = 32
+        else:
+            bits = 16
+        return bits
+
+    def getFunctions(self):
+        return sorted([offset for offset in idautils.Functions()])
+
+    def getBlocks(self, function_offset):
+        blocks = []
+        function_chart = ida_gdl.FlowChart(ida_funcs.get_func(function_offset))
+        for block in function_chart:
+            extracted_block = []
+            for instruction in idautils.Heads(block.start_ea, block.end_ea):
+                if ida_bytes.is_code(ida_bytes.get_flags(instruction)):
+                    extracted_block.append(instruction)
+            if extracted_block:
+                blocks.append(extracted_block)
+        return sorted(blocks)
+
+    def getInstructionBytes(self, offset):
+        ins = idautils.DecodeInstruction(offset)
+        ins_bytes = ida_bytes.get_bytes(offset, ins.size)
+        return ins_bytes
+
+    def getCodeInRefs(self, offset):
+        return [(ref_from, offset) for ref_from in idautils.CodeRefsTo(offset, True)]
+
+    def getCodeOutRefs(self, offset):
+        return [(offset, ref_to) for ref_to in idautils.CodeRefsFrom(offset, True)]
+
+    def getFunctionSymbols(self, demangle=False):
+        function_symbols = {}
+        function_offsets = self.getFunctions()
+        for function_offset in function_offsets:
+            function_name = ida_funcs.get_func_name(function_offset)
+            # apply demangling if required
+            if demangle and "@" in function_name:
+                demangled = ida_name.demangle_name(function_name, 0)
+                if demangled:
+                    function_name = demangled
+            if not re.match("sub_[0-9a-fA-F]+", function_name):
+                function_symbols[function_offset] = function_name
+        return function_symbols
+
+    def getBaseAddr(self):
+        base_addr = 0
+        segment_starts = [ea for ea in idautils.Segments()]
+        if segment_starts:
+            first_segment_start = segment_starts[0]
+            # re-align by 0x10000 to reflect typically allocation behaviour for IDA-mapped binaries
+            first_segment_start = (first_segment_start / 0x10000) * 0x10000
+            base_addr = int(first_segment_start)
+        return base_addr
+
+    def getBinary(self):
+        result = b""
+        segment = ida_segment.get_first_seg()
+        while segment:
+            result += ida_bytes.get_bytes(segment.start_ea, segment.end_ea - segment.start_ea)
+            segment = ida_segment.get_next_seg(segment.end_ea)
+        return result
+
+    def getApiMap(self):
+        self._api_map = {}
+        num_imports = ida_nalt.get_import_module_qty()
+        for i in range(0, num_imports):
+            self._import_module_name = ida_nalt.get_import_module_name(i)
+            ida_nalt.enum_import_names(i, self._cbEnumImports)
+        return self._api_map
+
+    def isExternalFunction(self, function_offset):
+        function_segment = ida_segment.getseg(function_offset)
+        function_segment_name = ida_segment.get_segm_name(function_segment)
+        is_extern = function_segment_name in ["extern", "UNDEF"]
+        return is_extern
+
+    def makeFunction(self, instruction):
+        return ida_funcs.add_func(instruction)
+
+    def makeNameEx(self, address, name, warning_level=None):
+        if warning_level is None:
+            warning_level=idc.SN_NOWARN
+        return idc.set_name(address, name, warning_level)
+
+    def _cbEnumImports(self, addr, name, ordinal):
+        # potentially use: idc.Name(addr)
+        if self._import_module_name:
+            self._api_map[addr] = self._import_module_name + "!" + name
+        else:
+            self._api_map[addr] = name
+        return True