int main(int argc, char *argv[])
{
PE_FILE pe;
FILE *fp = NULL;
if (argc < 2)
{
usage();
exit(1);
}
parse_options(argc, argv); // opcoes
if ((fp = fopen(argv[argc-1], "rb")) == NULL)
EXIT_ERROR("file not found or unreadable");
pe_init(&pe, fp); // inicializa o struct pe
if (!is_pe(&pe))
EXIT_ERROR("not a valid PE file");
// dos header
if (config.dos || config.all_headers || config.all)
{
IMAGE_DOS_HEADER dos;
if (pe_get_dos(&pe, &dos))
print_dos_header(&dos);
else { EXIT_ERROR("unable to read DOS header"); }
}
// coff/file header
if (config.coff || config.all_headers || config.all)
{
IMAGE_COFF_HEADER coff;
if (pe_get_coff(&pe, &coff))
print_coff_header(&coff);
else { EXIT_ERROR("unable to read COFF file header"); }
}
// optional header
if (config.opt || config.all_headers || config.all)
{
if (pe_get_optional(&pe))
print_optional_header(&pe);
else { EXIT_ERROR("unable to read Optional (Image) file header"); }
}
// directories
if (config.dirs || config.all)
{
if (pe_get_directories(&pe))
print_directories(&pe);
else { EXIT_ERROR("unable to read the Directories entry from Optional header"); }
}
// imports
if (config.imports || config.all)
{
if (pe_get_directories(&pe))
print_imports(&pe);
else { EXIT_ERROR("unable to read the Directories entry from Optional header"); }
}
// exports
if (config.exports || config.all)
{
if (pe_get_directories(&pe))
print_exports(&pe);
else
{ EXIT_ERROR("unable to read directories from optional header"); }
}
// sections
if (config.all_sections || config.all)
{
if (pe_get_sections(&pe))
print_sections(&pe);
else { EXIT_ERROR("unable to read sections"); }
}
// free
pe_deinit(&pe);
return 0;
}
void SkyriseAnalyst::slot_onEntryExecution(S2EExecutionState *state,
uint64_t pc)
{
assert(m_module.EntryPoint == pc);
assert(!(b_targetModule_exec));
// Disconnect entry point signals
regEntryHook.disconnect();
sig_EntryExec.disconnect();
// Set running flag
b_targetModule_exec = true;
// Parse PE import table of target module
if (!(m_monitor->getImports(state, m_module, imports))) {
std::cout << "[State " << std::dec
<< state->getID()
<< "] Error: Could not retrieve "
<< "imports from "
<< m_module.Name << '\n';
exit(1);
}
// Print APIs in import table
print_imports();
// Register imported API hooks
regImportHooks = s2e()->getCorePlugin()->onTranslateInstructionEnd.connect(
sigc::mem_fun(*this,
&SkyriseAnalyst::slot_registerImportHooks)
);
std::cout << "[+] Starting program execution at address 0x"
<< std::hex << pc << std::endl << std::endl;
/* State forking/switching
*
*/
s2e()->getCorePlugin()->onStateFork.connect(
sigc::mem_fun(*this,
&SkyriseAnalyst::slot_onStateFork)
);
s2e()->getCorePlugin()->onStateSwitch.connect(
sigc::mem_fun(*this,
&SkyriseAnalyst::slot_onStateSwitch)
);
/* Attempt to force re-translation so we can hook
* import functions. Surely adds less overhead than
* instrumenting *every* instruction.
*/
tb_flush(env);
throw CpuExitException();
}