getting RTN function from address

[P0lako]

Hi,

I didn't use the code, but I'm working in something similar (probably I'will use parts of your code), for this reason, I was reading the code project, and I've identified that you are detecting the allocation function getting the RTN using the function name, but sometimes, is useful set the function using the address of the allocation function.

The following code is to Create the RTN from an addr.

RTN CreateRTNFromAddress(ADDRINT addr){
unsigned int i;
RTN func_rtn;
ADDRINT resolved_address;
func_rtn = RTN_FindByAddress(addr);
resolved_address = RTN_Address(func_rtn);
if (func_rtn == RTN_Invalid() || resolved_address != addr){

    for (i=0; i<2; i++){
        func_rtn = RTN_CreateAt((ADDRINT)addr+i, "A");

        if (func_rtn != RTN_Invalid())
            break;

    }

}

return func_rtn;

}

This code is useful if you using (for instance) membrush (ww.syssec-project.eu/m/page-media/3/membrush_wcre13.pdf) to identify the allocation functions.

[fedorova]

Thanks, I'll keep this in mind!

[P0lako]

I've modified the configuration parsing to support the following alloc.in structure

#module:func number size addr
test.exe:0x11CB -1 0 -1
#kernel32.dll:VirtualAlloc 4 2 -1

I've modified the function parseAllocFuncsProto, to support this

    while(!str.eof())
    {
        string word;
        str >> word;

        switch(iter)
        {
            case 0:

                fp->module_name = getModuleName(word);

                if (getFunctionName(word) != ""){
                    fp->name = getFunctionName(word);
                    fp->offset = -1;

                }
                else if (getFunctionOffset(word) != -1){
                    //specified offset
                    fp->offset = getFunctionOffset(word);
                    fp->name = "";
                }

struct _fname{
    string dll_name;
    string f_name;
};

struct _fname parseFunctionLine(string word){
    struct _fname n;
    n.dll_name =  word.substr(0, word.find(":"));
    n.f_name = word.substr(word.find(":")+1, word.length());

    return n;
}

ADDRINT getFunctionOffset(string word){
    struct _fname n;
    char *pEnd;
    n = parseFunctionLine(word);

    if (n.f_name.find("0x") == std::string::npos){
        return -1;
    }

    return (ADDRINT)strtol(n.f_name.c_str(), &pEnd, 16);

    //return strtol(n.f_name.c_str(), n.f_name.end(), 16);
}
string getModuleName(string word){
    struct _fname n;
    n = parseFunctionLine(word);
    return n.dll_name;
}

string getFunctionName(string word){
    struct _fname n;
    if ( n.f_name.find("0x") == std::string::npos){
        return "";
    }
    n = parseFunctionLine(word);
    return n.f_name;
}

Then, I've modified the function PatchAllocationFunction to add the calling to CreateRTNFromAddress.

This functionality was usefull to me.

Bye!