(self)
Perform a full code scan on the target binary.
Perform a full code scan on the target binary.
Perform a full code scan on the target binary .
def _full_code_scan(self):
        """
        Perform a full code scan on the target binary.
        """

        # We gotta time this function
        start_time = datetime.now()

        traced_address = set()
        self.functions = set()
        self.call_map = networkx.DiGraph()
        self.cfg = networkx.DiGraph()
        initial_state = self.project.factory.blank_state(mode="fastpath")
        initial_options = initial_state.options - {o.TRACK_CONSTRAINTS} - o.refs
        initial_options |= {o.SUPER_FASTPATH}
        # initial_options.remove(o.COW_STATES)
        initial_state.options = initial_options
        # Sadly, not all calls to functions are explicitly made by call
        # instruction - they could be a jmp or b, or something else. So we
        # should record all exits from a single function, and then add
        # necessary calling edges in our call map during the post-processing
        # phase.
        function_exits = defaultdict(set)

        widgets = [progressbar.Percentage(),
                   ' ',
                   progressbar.Bar(marker=progressbar.RotatingMarker()),
                   ' ',
                   progressbar.Timer(),
                   ' ',
                   progressbar.ETA()
        ]

        pb = progressbar.ProgressBar(widgets=widgets, maxval=10000 * 100).start()

        while True:
            next_addr = self._get_next_code_addr(initial_state)
            percentage = self._seg_list.occupied_size * 100.0 / (self._valid_memory_region_size)
            if percentage > 100.0: percentage = 100.0
            pb.update(percentage * 10000)

            if next_addr is not None:
                l.info("Analyzing %xh, progress %0.04f%%", next_addr, percentage)
            else:
                l.info('No more addr to analyze. Progress %0.04f%%', percentage)
                break

            self.call_map.add_node(next_addr)

            self._scan_code(traced_address, function_exits, initial_state, next_addr)

        pb.finish()
        end_time = datetime.now()
        l.info("A full code scan takes %d seconds.", (end_time - start_time).seconds)
def _full_code_scan ( self ) : # We gotta time this function start_time = datetime . now ( ) traced_address = set ( ) self . functions = set ( ) self . call_map = networkx . DiGraph ( ) self . cfg = networkx . DiGraph ( ) initial_state = self . project . factory . blank_state ( mode = "fastpath" ) initial_options = initial_state . options - { o . TRACK_CONSTRAINTS } - o . refs initial_options |= { o . SUPER_FASTPATH } # initial_options.remove(o.COW_STATES) initial_state . options = initial_options # Sadly, not all calls to functions are explicitly made by call # instruction - they could be a jmp or b, or something else. So we # should record all exits from a single function, and then add # necessary calling edges in our call map during the post-processing # phase. function_exits = defaultdict ( set ) widgets = [ progressbar . Percentage ( ) , ' ' , progressbar . Bar ( marker = progressbar . RotatingMarker ( ) ) , ' ' , progressbar . Timer ( ) , ' ' , progressbar . ETA ( ) ] pb = progressbar . ProgressBar ( widgets = widgets , maxval = 10000 * 100 ) . start ( ) while True : next_addr = self . _get_next_code_addr ( initial_state ) percentage = self . _seg_list . occupied_size * 100.0 / ( self . _valid_memory_region_size ) if percentage > 100.0 : percentage = 100.0 pb . update ( percentage * 10000 ) if next_addr is not None : l . info ( "Analyzing %xh, progress %0.04f%%" , next_addr , percentage ) else : l . info ( 'No more addr to analyze. Progress %0.04f%%' , percentage ) break self . call_map . add_node ( next_addr ) self . _scan_code ( traced_address , function_exits , initial_state , next_addr ) pb . finish ( ) end_time = datetime . now ( ) l . info ( "A full code scan takes %d seconds." , ( end_time - start_time ) . seconds )