KUNAI Static Analyzer
Kunai is a library for doing static binary analysis of Dalvik.
Loading...
Searching...
No Matches
encoded.hpp
1//--------------------------------------------------------------------*- C++ -*-
2// Kunai-static-analyzer: library for doing analysis of dalvik files
3// @author Farenain <kunai.static.analysis@gmail.com>
4// @author Ernesto Java <javaernesto@gmail.com>
5//
6// @file encoded.hpp
7// @brief This file contains all the information from encoded data
8// these classes are for annotations, arrays, fields, try-catch
9// information, etc.
10
11#ifndef KUNAI_DEX_PARSER_ENCODED_HPP
12#define KUNAI_DEX_PARSER_ENCODED_HPP
13
14#include "Kunai/DEX/parser/strings.hpp"
15#include "Kunai/DEX/parser/fields.hpp"
16#include "Kunai/DEX/parser/fields.hpp"
17#include "Kunai/DEX/parser/methods.hpp"
18#include "Kunai/DEX/DVM/dvm_types.hpp"
19#include "Kunai/Utils/kunaistream.hpp"
20
21#include <iostream>
22#include <vector>
23
24namespace KUNAI
25{
26namespace DEX
27{
30 class EncodedValue;
31 using encodedvalue_t = std::unique_ptr<EncodedValue>;
32
35 {
37 std::uint64_t array_size;
39 std::vector<encodedvalue_t> values;
40 public:
42 EncodedArray() = default;
44 ~EncodedArray() = default;
45
51 Types* types,
52 Strings* strings);
53
56 std::uint64_t get_array_size() const
57 {
58 return array_size;
59 }
60
63 const std::vector<encodedvalue_t>& get_values() const
64 {
65 return values;
66 }
67
70 std::vector<encodedvalue_t>& get_values()
71 {
72 return values;
73 }
74 };
75
76 using encodedarray_t = std::unique_ptr<EncodedArray>;
77
81 {
83 std::string& name;
85 encodedvalue_t value;
86 public:
90 AnnotationElement(std::string& name, encodedvalue_t value)
91 : name(name), value(std::move(value))
92 {}
93
95 ~AnnotationElement() = default;
96
99 std::string& get_name()
100 {
101 return name;
102 }
103
107 {
108 return value.get();
109 }
110 };
111
112 using annotationelement_t = std::unique_ptr<AnnotationElement>;
113
117 {
120 DVMType* type;
122 std::uint64_t size;
124 std::vector<annotationelement_t> elements;
125 public:
127 EncodedAnnotation() = default;
130
136 stream::KunaiStream* stream,
137 Types* types,
138 Strings* strings
139 );
140
144 {
145 return type;
146 }
147
150 std::uint64_t get_size() const
151 {
152 return size;
153 }
154
157 const std::vector<annotationelement_t>& get_annotations() const
158 {
159 return elements;
160 }
161
164 std::vector<annotationelement_t>& get_annotations()
165 {
166 return elements;
167 }
168
173 };
174
177 {
179 TYPES::value_format value_type;
181 std::uint8_t value_args;
184 std::vector<std::uint8_t> values;
187 EncodedArray array_data;
190 EncodedAnnotation annotation;
191
192 public:
194 EncodedValue() = default;
196 ~EncodedValue() = default;
197
203 Types* types,
204 Strings* strings);
205
208 TYPES::value_format get_value_type() const
209 {
210 return value_type;
211 }
212
215 std::uint8_t size_of_value() const
216 {
217 return value_args;
218 }
219
222 const std::vector<std::uint8_t>& get_values() const
223 {
224 return values;
225 }
226
229 std::vector<std::uint8_t>& get_values()
230 {
231 return values;
232 }
233
236 const EncodedArray& get_array() const
237 {
238 return array_data;
239 }
240
244 {
245 return array_data;
246 }
247
251 {
252 return annotation;
253 }
254
258 {
259 return annotation;
260 }
261 };
262
266 {
268 FieldID * field_idx;
270 TYPES::access_flags flags;
272 EncodedArray* initial_value;
273 public:
277 EncodedField(FieldID * field_idx, TYPES::access_flags flags)
278 : field_idx(field_idx), flags(flags)
279 {
280 this->field_idx->set_encoded_field(this);
281 }
282
284 ~EncodedField() = default;
285
288 const FieldID* get_field() const
289 {
290 return field_idx;
291 }
292
296 {
297 return field_idx;
298 }
299
302 TYPES::access_flags get_access_flags() const
303 {
304 return flags;
305 }
306
309 void set_initial_value(EncodedArray* initial_value)
310 {
311 this->initial_value = initial_value;
312 }
313
314 EncodedArray* get_initial_value()
315 {
316 return initial_value;
317 }
318 };
319
320 using encodedfield_t = std::unique_ptr<EncodedField>;
321
324 {
326 DVMType * type;
328 std::uint64_t addr;
329 public:
333 EncodedTypePair(DVMType * type, std::uint64_t addr)
334 : type(type), addr(addr)
335 {}
337 ~EncodedTypePair() = default;
338
341 std::uint64_t get_addr() const
342 {
343 return addr;
344 }
345
349 {
350 return type;
351 }
352
356 {
357 return type;
358 }
359 };
360
361 using encodedtypepair_t = std::unique_ptr<EncodedTypePair>;
362
365 {
370 std::int64_t size;
372 std::vector<encodedtypepair_t> handlers;
375 std::uint64_t catch_all_addr = 0;
378 std::uint64_t offset;
379 public:
384
389 Types* types);
390
394 {
395 if (size >= 0)
396 return true; // user should check size of handlers
397 return false;
398 }
399
403 std::int64_t get_size() const
404 {
405 return size;
406 }
407
410 std::uint64_t get_catch_all_addr() const
411 {
412 return catch_all_addr;
413 }
414
417 const std::vector<encodedtypepair_t>& get_handlers() const
418 {
419 return handlers;
420 }
421
424 std::vector<encodedtypepair_t>& get_handlers()
425 {
426 return handlers;
427 }
428
431 std::uint64_t get_offset() const
432 {
433 return offset;
434 }
435
436 EncodedTypePair *get_handler_by_pos(std::uint64_t pos);
437 };
438
439 using encodedcatchhandler_t = std::unique_ptr<EncodedCatchHandler>;
440
445 {
446 public:
449#pragma pack(0)
451 {
452 std::uint32_t start_addr;
454 std::uint16_t insn_count;
455 std::uint16_t handler_off;
457 };
458#pragma pack()
459
460 private:
462 try_item_struct_t try_item_struct;
463
464 public:
466 TryItem() = default;
468 ~TryItem() = default;
472
475 std::uint32_t get_start_addr() const
476 {
477 return try_item_struct.start_addr;
478 }
479
482 std::uint16_t get_insn_count() const
483 {
484 return try_item_struct.insn_count;
485 }
486
489 std::uint16_t get_handler_off() const
490 {
491 return try_item_struct.handler_off;
492 }
493 };
494
495 using tryitem_t = std::unique_ptr<TryItem>;
496
499 {
500 public:
503 {
504 std::uint16_t registers_size;
505 std::uint16_t ins_size;
506 std::uint16_t outs_size;
508 std::uint16_t tries_size;
509 std::uint32_t debug_info_off;
510 std::uint32_t insns_size;
511 };
512 private:
514 code_item_struct_t code_item;
516 std::vector<std::uint8_t> instructions_raw;
518 std::vector<tryitem_t> try_items;
521 std::uint64_t encoded_catch_handler_list_offset;
523 std::uint64_t encoded_catch_handler_size;
525 std::vector<encodedcatchhandler_t> encoded_catch_handlers;
526 public:
528 CodeItemStruct() = default;
530 ~CodeItemStruct() = default;
531
536 stream::KunaiStream* stream,
537 Types* types
538 );
541 std::uint16_t get_registers_size() const
542 {
543 return code_item.registers_size;
544 }
545
548 std::uint16_t get_incomings_args() const
549 {
550 return code_item.ins_size;
551 }
552
555 std::uint16_t get_outgoing_args() const
556 {
557 return code_item.outs_size;
558 }
559
562 std::uint16_t get_number_try_items() const
563 {
564 return code_item.tries_size;
565 }
566
569 std::uint16_t get_offset_to_debug_info() const
570 {
571 return code_item.debug_info_off;
572 }
573
576 std::uint16_t get_instructions_size() const
577 {
578 return code_item.insns_size;
579 }
580
583 const std::vector<std::uint8_t>& get_bytecode() const
584 {
585 return instructions_raw;
586 }
587
590 std::vector<std::uint8_t>& get_bytecode()
591 {
592 return instructions_raw;
593 }
594
597 const std::vector<tryitem_t>& get_try_items() const
598 {
599 return try_items;
600 }
601
604 std::vector<tryitem_t>& get_try_items()
605 {
606 return try_items;
607 }
608
612 {
613 return encoded_catch_handler_list_offset;
614 }
615
618 const std::vector<encodedcatchhandler_t>& get_encoded_catch_handlers() const
619 {
620 return encoded_catch_handlers;
621 }
622
625 std::vector<encodedcatchhandler_t>& get_encoded_catch_handlers()
626 {
627 return encoded_catch_handlers;
628 }
629 };
630
631 using codeitemstruct_t = std::unique_ptr<CodeItemStruct>;
632
635 {
637 MethodID* method_id;
639 TYPES::access_flags access_flags;
641 CodeItemStruct code_item;
642 public:
646 EncodedMethod(MethodID* method_id, TYPES::access_flags access_flags)
647 : method_id(method_id), access_flags(access_flags)
648 {
649 this->method_id->set_encoded_method(this);
650 }
651
653 ~EncodedMethod() = default;
654
660 std::uint64_t code_off,
661 Types* types);
662
665 const MethodID* getMethodID() const
666 {
667 return method_id;
668 }
669
673 {
674 return method_id;
675 }
676
679 TYPES::access_flags get_access_flags() const
680 {
681 return access_flags;
682 }
683
687 {
688 return code_item;
689 }
690
694 {
695 return code_item;
696 }
697 };
698
699 using encodedmethod_t = std::unique_ptr<EncodedMethod>;
700} // namespace DEX
701} // namespace KUNAI
702
703
704#endif
Annotation element with value and a name this is contained in the EncodedAnnotation class.
Definition encoded.hpp:81
EncodedValue * get_value()
Get the value of the annotation.
Definition encoded.hpp:106
std::string & get_name()
Get the name of the annotation.
Definition encoded.hpp:99
AnnotationElement(std::string &name, encodedvalue_t value)
Constructor of the annotation element.
Definition encoded.hpp:90
~AnnotationElement()=default
Destructor of the annotation element.
Save the information of the code from a Method.
Definition encoded.hpp:499
std::uint64_t get_encoded_catch_handler_offset()
Return the offset where encoded catch handler is read.
Definition encoded.hpp:611
std::vector< tryitem_t > & get_try_items()
Get a reference to the vector of Try Items.
Definition encoded.hpp:604
std::uint16_t get_number_try_items() const
Get the number of try items in the method.
Definition encoded.hpp:562
std::uint16_t get_offset_to_debug_info() const
Get the offset to the debug information.
Definition encoded.hpp:569
const std::vector< encodedcatchhandler_t > & get_encoded_catch_handlers() const
Get a constant reference to the catch handlers vector.
Definition encoded.hpp:618
std::uint16_t get_registers_size() const
Get the number of registers used in a method.
Definition encoded.hpp:541
CodeItemStruct()=default
Constructor of CodeItemStruct.
void parse_code_item_struct(stream::KunaiStream *stream, Types *types)
Parser for the CodeItemStruct.
const std::vector< tryitem_t > & get_try_items() const
Get a constant reference to the vector of Try Items.
Definition encoded.hpp:597
std::uint16_t get_instructions_size() const
Get size of the dalvik instructions (number of opcodes)
Definition encoded.hpp:576
std::uint16_t get_incomings_args() const
Get the number of words incoming arguments to the method.
Definition encoded.hpp:548
std::vector< std::uint8_t > & get_bytecode()
Get a reference to the vector with the bytecode.
Definition encoded.hpp:590
~CodeItemStruct()=default
Destructor of CodeItemStruct.
std::vector< encodedcatchhandler_t > & get_encoded_catch_handlers()
Get a reference to the catch handlers vector.
Definition encoded.hpp:625
const std::vector< std::uint8_t > & get_bytecode() const
Get a constant reference to the vector with the bytecode.
Definition encoded.hpp:583
std::uint16_t get_outgoing_args() const
Get the number of words outgoing argument space required by the code.
Definition encoded.hpp:555
Represents the base class of a Type in the DVM we have different types.
Definition types.hpp:26
Class to parse and create a vector of Annotations.
Definition encoded.hpp:117
EncodedAnnotation()=default
Constructor from EncodedAnnotation.
~EncodedAnnotation()=default
Destructor from EncodedAnnotation.
DVMType * get_annotation_type()
Get the type of the annotations.
Definition encoded.hpp:143
std::uint64_t get_size() const
Get size of annotations.
Definition encoded.hpp:150
AnnotationElement * get_annotation_by_pos(std::uint32_t pos)
Get an annotation element by position.
void parse_encoded_annotation(stream::KunaiStream *stream, Types *types, Strings *strings)
Function to parse an encoded annotation.
std::vector< annotationelement_t > & get_annotations()
Get a reference to all the annotation elements.
Definition encoded.hpp:164
const std::vector< annotationelement_t > & get_annotations() const
Get a constant reference to all the annotation elements.
Definition encoded.hpp:157
Information of an array with encoded values.
Definition encoded.hpp:35
void parse_encoded_array(stream::KunaiStream *stream, Types *types, Strings *strings)
Parse the encoded Array.
const std::vector< encodedvalue_t > & get_values() const
Get constant reference to encoded values.
Definition encoded.hpp:63
~EncodedArray()=default
Destructor of encoded array.
std::uint64_t get_array_size() const
get the size of the array
Definition encoded.hpp:56
EncodedArray()=default
Constructor of the encoded array.
std::vector< encodedvalue_t > & get_values()
Get a reference to encoded values.
Definition encoded.hpp:70
Information of catch handlers.
Definition encoded.hpp:365
std::vector< encodedtypepair_t > & get_handlers()
Get a reference to the vector of EncodedTypePair.
Definition encoded.hpp:424
std::uint64_t get_offset() const
Get the offset where encoded catch handler is.
Definition encoded.hpp:431
std::int64_t get_size() const
Get the size of the EncodedCatchHandler.
Definition encoded.hpp:403
std::uint64_t get_catch_all_addr() const
Return the value from catch_all_addr.
Definition encoded.hpp:410
bool has_explicit_typed_catches() const
Check value of size to test if there are encodedtypepairs.
Definition encoded.hpp:393
~EncodedCatchHandler()=default
Destructor of EncodedCatchHandler.
EncodedCatchHandler()=default
Constructor of EncodedCatchHandler.
void parse_encoded_catch_handler(stream::KunaiStream *stream, Types *types)
Parse all the encoded type pairs.
const std::vector< encodedtypepair_t > & get_handlers() const
Get a constant reference to the vector of EncodedTypePair.
Definition encoded.hpp:417
Class that represent field information it contains a FieldID and also the access flags.
Definition encoded.hpp:266
~EncodedField()=default
Destructor of Encoded Field.
TYPES::access_flags get_access_flags() const
Get the access flags from the Field.
Definition encoded.hpp:302
const FieldID * get_field() const
Get a constant pointer to the FieldID.
Definition encoded.hpp:288
EncodedField(FieldID *field_idx, TYPES::access_flags flags)
Constructor of an encoded field.
Definition encoded.hpp:277
FieldID * get_field()
Get a pointer to the FieldID.
Definition encoded.hpp:295
void set_initial_value(EncodedArray *initial_value)
Those fields that are static contains an initial value.
Definition encoded.hpp:309
Class that represent the information from a Method.
Definition encoded.hpp:635
void parse_encoded_method(stream::KunaiStream *stream, std::uint64_t code_off, Types *types)
Parse the encoded method, this will parse the code item.
MethodID * getMethodID()
Get a pointer to the MethodID of the encoded method.
Definition encoded.hpp:672
EncodedMethod(MethodID *method_id, TYPES::access_flags access_flags)
Constructor of Encoded method.
Definition encoded.hpp:646
const CodeItemStruct & get_code_item() const
Get the code item from the encoded method.
Definition encoded.hpp:686
CodeItemStruct & get_code_item()
Get the code item from the encoded method.
Definition encoded.hpp:693
const MethodID * getMethodID() const
Get a constant pointer to the MethodID of the method.
Definition encoded.hpp:665
TYPES::access_flags get_access_flags() const
Get access flags from the encoded method.
Definition encoded.hpp:679
~EncodedMethod()=default
Destructor of Encoded method.
Type of exception to catch with its address.
Definition encoded.hpp:324
const DVMType * get_exception_type() const
Get a constant pointer to the exception type.
Definition encoded.hpp:348
DVMType * get_exception_type()
Get pointer to exception type.
Definition encoded.hpp:355
EncodedTypePair(DVMType *type, std::uint64_t addr)
Constructor for EncodedTypePair.
Definition encoded.hpp:333
std::uint64_t get_addr() const
Get the bytecode address of the associated exception handler.
Definition encoded.hpp:341
~EncodedTypePair()=default
Destructor of EncodedTypePair.
encoded piece of (nearly) arbitrary hierarchically structured data.
Definition encoded.hpp:177
EncodedArray & get_array()
get a reference to the array in case value is an array
Definition encoded.hpp:243
EncodedValue()=default
Constructor of EncodedValue.
std::uint8_t size_of_value() const
Return the size of the value.
Definition encoded.hpp:215
~EncodedValue()=default
Destructor of EncodedValue.
const EncodedAnnotation & get_annotation() const
get a reference to annotation in case it is annotation
Definition encoded.hpp:250
TYPES::value_format get_value_type() const
Get the enum with the value type.
Definition encoded.hpp:208
const std::vector< std::uint8_t > & get_values() const
Get a constant reference to the values.
Definition encoded.hpp:222
void parse_encoded_value(stream::KunaiStream *stream, Types *types, Strings *strings)
Parse the encoded value.
EncodedAnnotation & get_annotation()
get a reference to annotation in case it is annotation
Definition encoded.hpp:257
std::vector< std::uint8_t > & get_values()
Get a reference to the values.
Definition encoded.hpp:229
const EncodedArray & get_array() const
in case the value is an array return it
Definition encoded.hpp:236
FieldID represent one of the fields from the DEX file.
Definition fields.hpp:28
MethodID represents a single method from DEX file.
Definition methods.hpp:28
void set_encoded_method(EncodedMethod *e)
Set the encoded method from this MethodID.
Definition methods.hpp:62
Storage class for all the strings of the DEX file.
Definition strings.hpp:34
Class that specify the information from a try specifies address, number of instructions,...
Definition encoded.hpp:445
~TryItem()=default
Destructor of TryItem.
TryItem()=default
Constructor of TryItem.
std::uint16_t get_handler_off() const
Get offset of handler from try.
Definition encoded.hpp:489
std::uint16_t get_insn_count() const
Get the number of instruction counts from the try.
Definition encoded.hpp:482
std::uint32_t get_start_addr() const
Get the start address of the try block.
Definition encoded.hpp:475
void parse_try_item(stream::KunaiStream *stream)
Parse a try_item_struct_t from stream.
Definition types.hpp:305
Class to manage an input file stream given for the analysis.
Definition kunaistream.hpp:20
utilities
Definition analysis.hpp:23
Structure with information about a method code.
Definition encoded.hpp:503
std::uint16_t tries_size
Definition encoded.hpp:508
std::uint32_t debug_info_off
number of TryItem, can be 0
Definition encoded.hpp:509
std::uint16_t outs_size
number of words of incoming arguments to the method
Definition encoded.hpp:506
std::uint32_t insns_size
offset to debug_info_item
Definition encoded.hpp:510
std::uint16_t ins_size
number of registers used in the code
Definition encoded.hpp:505
Structure with the information from a Try code.
Definition encoded.hpp:451
std::uint16_t handler_off
number of 16-bit code units covered by this entry.
Definition encoded.hpp:455
std::uint16_t insn_count
Definition encoded.hpp:454