1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
29 """
30 This class is an information container for the arithmetic / logic heuristic of the
31 crypto identifier
32 """
33
35 self.arith_log_instructions = [
36 "aaa",
37 "aad",
38 "aam",
39 "aas",
40 "adc",
41 "add",
42 "and",
43 "daa",
44 "cdq"
45 "das",
46 "dec",
47 "div",
48 "imul",
49 "inc",
50 "neg",
51 "not",
52 "or",
53 "rcl",
54 "rcr",
55 "rol",
56 "ror",
57 "sal",
58 "salc",
59 "sar",
60 "sbb",
61 "shl",
62 "shld",
63 "shr",
64 "shrd",
65 "sub",
66 "test",
67 "xadd",
68 "xor",
69 ]
70 self.self_nullifying_instructions = ["xor", "sbb", "sub"]
71 self.start_ea = start_ea
72 self.end_ea = end_ea
73 self.num_instructions = 0
74 self.num_log_arit_instructions = 0
75 self.num_zeroing_instructions = 0
76 self.num_calls_in_function = 0
77 self.aritlog_rating = -1
78 self.nonzeroing_aritlog_rating = -1
79
81 """
82 Calculates and returns the rating for this basic block
83 @param is_nonzeroing_rating: determines whether zeroing instructions like xor eax, eax
84 shall be taken into account or not.
85 @type: is_nonzeroing_rating: boolean
86 @return: the rating for this basic block
87 """
88 try:
89 if is_nonzeroing_rating:
90 self.nonzeroing_aritlog_rating = 1.0 * (self.num_log_arit_instructions - \
91 self.num_zeroing_instructions) / self.num_instructions
92 return self.nonzeroing_aritlog_rating
93 else:
94 self.aritlog_rating = 1.0 * self.num_log_arit_instructions / self.num_instructions
95 return self.aritlog_rating
96 except ZeroDivisionError:
97 return 0
98
100 """
101 Update the instruction count for this basic block.
102 @param instruction: The mnemonic for a instruction of this block, as returned by IDA's I{GetMnem()}'
103 @type: instruction: str
104 @param has_identical_operands: determines if this instruction has two identical operands. Important for
105 deciding whether the instruction zeroes a register or not
106 @type: has_identical_operands: boolean
107 """
108 if instruction in self.arith_log_instructions:
109 self.num_log_arit_instructions += 1
110 if instruction in self.self_nullifying_instructions and has_identical_operands:
111 self.num_zeroing_instructions += 1
112 self.num_instructions += 1
113
115 """
116 Convenience function.
117 @return: a nice string representation for this object
118 """
119 return "0x%x - 0x%x (%d), aritlog: %02.2f%% (%02.2f%%)" % (self.start_ea, self.end_ea, \
120 self.num_instructions, self.aritlog_rating * 100.0, self.nonzeroing_aritlog_rating * 100.0)
121
123 """
124 Convenience function for ordering.
125 @param other: another I{AritLogBasicBlock}
126 @type other: I{AritLogBasicBlock}
127 @return: less if rating is less than of the other
128 """
129 return self.aritlog_rating() < other.aritlog_rating()
130