seliaste/lief-iat-reconstruction
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

code formatting and newly created enums to clean up code

Browse source
This commit is contained in:
Aéna Aria 2026-04-02 14:02:07 +02:00
parent f46cc2438f
commit 6f4fccd350
5 changed files with 111 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

33
cfg_parser.py
View file

@ -1,38 +1,43 @@
import utils
def parse_wave_nodes(cfg,wave: int) -> list:
return list(filter(lambda node: node["wave"] == wave,cfg["nodes"]))
def parse_procaddr_calls(cfg,wave:int):
def parse_wave_nodes(cfg, wave: int) -> list:
return list(filter(lambda node: node["wave"] == wave, cfg["nodes"]))
def parse_procaddr_calls(cfg, wave: int) -> list:
res = []
wave_nodes:list[dict] = parse_wave_nodes(cfg,wave)
wave_nodes: list[dict] = parse_wave_nodes(cfg, wave)
for node in wave_nodes:
if "syscalls" in node.keys():
for syscall in node["syscalls"]:
if syscall["name"] == "KERNEL32.DLL!GetProcAddress":
funcname = syscall["arguments"][-1].split("\"")[1]
funcname = syscall["arguments"][-1].split('"')[1]
func_addr = syscall["return"]
res.append({"name": funcname, "addr": func_addr})
return res
def parse_syscalls(cfg,wave: int) -> list[dict[str, str]]:
res: list[dict[str,str]] = []
wave_nodes:list[dict] = parse_wave_nodes(cfg,wave)
def parse_syscalls(cfg, wave: int) -> list[dict[str, str]]:
res: list[dict[str, str]] = []
wave_nodes: list[dict] = parse_wave_nodes(cfg, wave)
no_repeat = []
for node in wave_nodes:
if "syscalls" in node.keys():
for syscall in node["syscalls"]:
if node["last_instr"] in no_repeat:
continue
adress = node["last_instr"] # call is at the end of the basic block
adress = node["last_instr"] # call is at the end of the basic block
name = syscall["name"]
current_instruction = node["instructions"][-1]["mnemonic"]
no_repeat.append(adress)
res.append({"adress":adress,"name":name})
res.append({"adress": adress, "name": name})
return res
def parse_wave_entrypoint(cfg,wave: int) -> int:
return int(parse_wave_nodes(cfg,wave)[0]["start"],16)
def parse_bb_registers(cfg,wave:int,n_bb:int) -> dict[str,str]:
return parse_wave_nodes(cfg,wave)[n_bb]["registers"]
def parse_wave_entrypoint(cfg, wave: int) -> int:
return int(parse_wave_nodes(cfg, wave)[0]["start"], 16)
def parse_bb_registers(cfg, wave: int, n_bb: int) -> dict[str, str]:
return parse_wave_nodes(cfg, wave)[n_bb]["registers"]