falcon 0.2.0

A Binary Analysis Framework in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

//! Experimental loader which takes a program specification in Json form.

use base64;
use loader::*;
use memory::backing::*;
use memory::MemoryPermissions;
use serde_json;
use serde_json::Value;
use std::fs::File;
use std::io::Read;
use std::path::Path;

/// Experimental loader which takes a program specification in Json form.
///
/// See the binary ninja script for an example use.
#[derive(Clone)]
pub struct Json {
    function_entries: Vec<FunctionEntry>,
    memory: Memory,
    architecture: Architecture,
    entry: u64
}


impl Json {
    /// Create a new `Json` loader from the given file.
    pub fn from_file(filename: &Path) -> Result<Json> {
        let mut file = File::open(filename)?;
        let mut buf = Vec::new();
        file.read_to_end(&mut buf)?;

        let root: Value = serde_json::from_str(&String::from_utf8(buf)?)?;

        let architecture = match root["arch"] {
            Value::String(ref architecture) => {
                if architecture == "x86" {
                    Architecture::X86
                }
                else {
                    bail!("unsupported architecture {}", root["arch"])
                }
            }
            _ => bail!("architecture missing")
        };

        let entry = match root["entry"] {
            Value::Number(ref number) => number.as_u64().unwrap(),
            _ => bail!("entry missing")
        };

        let mut function_entries = Vec::new();
        if let Value::Array(ref functions) = root["functions"] {
            for function in functions {
                let address = match function["address"] {
                    Value::Number(ref address) => match address.as_u64() {
                        Some(address) => address,
                        None => bail!("function address not u64")
                    },
                    _ => bail!("address missing for function")
                };

                let name = match function["name"] {
                    Value::String(ref name) => name.to_string(),
                    _ => bail!("name missing for function")
                };

                function_entries.push(FunctionEntry::new(address, Some(name)));
            }
        }
        else {
            bail!("functions missing");
        }

        let mut memory = Memory::new(architecture.endian());
        if let Value::Array(ref segments) = root["segments"] {
            for segment in segments {
                let address = match segment["address"] {
                    Value::Number(ref address) => match address.as_u64() {
                        Some(address) => address,
                        None => bail!("segment address not u64")
                    },
                    _ => bail!("address missing for segment")
                };

                let bytes = match segment["bytes"] {
                    Value::String(ref bytes) => base64::decode(&bytes)?,
                    _ => bail!("bytes missing for segment")
                };

                memory.set_memory(address, bytes, MemoryPermissions::ALL);
            }
        }
        else {
            bail!("segments missing");
        }

        Ok(Json{
            function_entries: function_entries,
            memory: memory,
            architecture: architecture,
            entry: entry
        })
    }
}



impl Loader for Json {
    fn memory(&self) -> Result<Memory> {
        Ok(self.memory.clone())
    }


    fn function_entries(&self) -> Result<Vec<FunctionEntry>> {
        Ok(self.function_entries.clone())
    }


    fn program_entry(&self) -> u64 {
        self.entry
    }


    fn architecture(&self) -> Result<Architecture> {
        Ok(self.architecture.clone())
    }
}