public
class
DataStringUtil
extends Object| java.lang.Object | |
| ↳ | com.pnfsoftware.jeb.core.units.code.asm.items.DataStringUtil |
Class Overview
Utility methods to facilitate the creation of string items by the INativeDataAnalyzer.
Summary
| Constants | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| int | NAME_DEFAULT_LENGTH | ||||||||||
| String | NAME_PREFIX | ||||||||||
| int | maxStringItemNameLength | ||||||||||
| Public Constructors | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| DataStringUtil() | |||||||||||
| Public Methods | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| static INativeStringItem |
createFromMemory(INativeDataAnalyzer dataParser, ILabelManager labelman, IVirtualMemory mem, long address, long addressMax, StringEncoding stringType, int minChars, int maxChars)
Parse a memory area as a string.
| ||||||||||
| static String |
determineValue(StringEncoding st, byte[] buffer, int offset, int size, boolean reEncodingValidation)
Determine the value of a string.
| ||||||||||
| static String |
determineValue(INativeStringItem item, IVirtualMemory mem, boolean reEncodingValidation)
Determine the value of a given string data item.
| ||||||||||
| static String |
determineValue(StringEncoding st, IVirtualMemory mem, long address, int size, boolean reEncodingValidation)
Determine the value of a string.
| ||||||||||
| static String |
getStringAt(IVirtualMemory mem, long address, int minChars, int maxChars)
Attempt to create a string from the memory bytes located at the provided address.
| ||||||||||
| static String |
getStringAt(IVirtualMemory mem, long address, int minChars, int maxChars, StringEncoding[] atype)
Attempt to create a string from the memory bytes located at the provided address.
| ||||||||||
| static StringEntry |
getStringAt(IVirtualMemory mem, long address, long addressMax, int minChars, int maxChars)
Attempt to create a string from the memory bytes located at the provided address.
| ||||||||||
| static boolean | heurIsValidString(String s, int minChars) | ||||||||||
| static boolean |
isSafeAsciiStringAt(IVirtualMemory mem, long address, StringEncoding st, int minChars, int maxChars)
Indicate if a data in memory is a safe ASCII (meaning containing only printable character in
the ASCII range).
| ||||||||||
| static boolean | isSafeAsciiStringAt(IVirtualMemory mem, long address, int minChars, int maxChars) | ||||||||||
| static boolean |
isValidStringAt(IVirtualMemory mem, long address, int minChars, int maxChars)
Determine whether the memory bytes at the provided address look like a string.
| ||||||||||
|
[Expand]
Inherited Methods | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
From class
java.lang.Object
| |||||||||||
Constants
public static final int NAME_DEFAULT_LENGTH
Constant Value:
16
(0x00000010)
public static final String NAME_PREFIX
Constant Value:
"a"
public static final int maxStringItemNameLength
Constant Value:
64
(0x00000040)
Public Constructors
public DataStringUtil ()
Public Methods
public static INativeStringItem createFromMemory (INativeDataAnalyzer dataParser, ILabelManager labelman, IVirtualMemory mem, long address, long addressMax, StringEncoding stringType, int minChars, int maxChars)
Parse a memory area as a string. If a non-null string item is returned, it must be registered to a memory model or immediately disposed.
Parameters
| labelman | label manager |
|---|---|
| mem | virtual memory |
| address | mandatory start address |
| addressMax | optional maximum (final) address for the string; use -1 for no limit |
| stringType | the string type hint; null to let this method determine the best string type heuristically |
| minChars | minimum number of characters to be found in the string for it to be considered valid (inclusive); set to -1 for default (currently: 3) |
| maxChars | maximum number of characters (not bytes) to be parsed (exclusive); set to -1 for default (currently: 100_000) |
Returns
- a string item or null
public static String determineValue (StringEncoding st, byte[] buffer, int offset, int size, boolean reEncodingValidation)
Determine the value of a string.
Parameters
| st | string type |
|---|---|
| buffer | bytes |
| offset | offset to string in buffer |
| size | string size in byte, including the null terminator if any |
public static String determineValue (INativeStringItem item, IVirtualMemory mem, boolean reEncodingValidation)
Determine the value of a given string data item.
public static String determineValue (StringEncoding st, IVirtualMemory mem, long address, int size, boolean reEncodingValidation)
Determine the value of a string.
Parameters
| st | string type |
|---|---|
| mem | virtual memory |
| address | address to string in memory |
| size | string size in bytes, including the terminator if any |
public static String getStringAt (IVirtualMemory mem, long address, int minChars, int maxChars)
Attempt to create a string from the memory bytes located at the provided address.
Parameters
| mem | virtual memory |
|---|---|
| address | start address |
| minChars | minimum number of characters allowed for the string |
| maxChars | maximum number of characters allowed for the string |
Returns
- a string or null
public static String getStringAt (IVirtualMemory mem, long address, int minChars, int maxChars, StringEncoding[] atype)
Attempt to create a string from the memory bytes located at the provided address.
Parameters
| mem | virtual memory |
|---|---|
| address | start address |
| minChars | minimum number of characters allowed for the string |
| maxChars | maximum number of characters allowed for the string |
| atype | optional single-element array to collect the string output type |
Returns
- a string or null
public static StringEntry getStringAt (IVirtualMemory mem, long address, long addressMax, int minChars, int maxChars)
Attempt to create a string from the memory bytes located at the provided address.
Parameters
| mem | virtual memory |
|---|---|
| address | start address |
| addressMax | max address (use -1 to specify no-max) |
| minChars | minimum number of characters allowed for the string |
| maxChars | maximum number of characters allowed for the string |
Returns
- a string descriptor or null
public static boolean heurIsValidString (String s, int minChars)
public static boolean isSafeAsciiStringAt (IVirtualMemory mem, long address, StringEncoding st, int minChars, int maxChars)
Indicate if a data in memory is a safe ASCII (meaning containing only printable character in
the ASCII range). Does not consider extended ASCII. Note that String Type can be different
from ASCII_ZERO: it will still check the ASCII range.
Parameters
| mem | virtual memory |
|---|---|
| address | String address |
| st | String type |
| minChars | minimum number of characters expected |
| maxChars | maximum number of characters to be parsed (withouh the final zero if any) |
public static boolean isSafeAsciiStringAt (IVirtualMemory mem, long address, int minChars, int maxChars)
public static boolean isValidStringAt (IVirtualMemory mem, long address, int minChars, int maxChars)
Determine whether the memory bytes at the provided address look like a string.
Parameters
| mem | virtual memory |
|---|---|
| address | start address |
| minChars | minimum number of characters allowed for the string |
| maxChars | maximum number of characters allowed for the string |
Returns
- a string or null