QuasarApp/LIEF
4
0
Fork 0
mirror of https://github.com/QuasarApp/LIEF.git synced 2025-04-28 05:14:33 +00:00
Code Issues Projects Releases Wiki Activity

Remove hard coded verbose level

Browse Source
This commit is contained in:
Romain Thomas 2017-07-31 16:26:08 +02:00
parent 6837c87755
commit 45398952e1
23 changed files with 284 additions and 281 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CMakeLists.txt
View File

@ -352,6 +352,8 @@ source_group("easylogging" FILES ${ELG_SOURCE_DIR}/easylogging++.cc)
# Library definition
# ==================
add_definitions(-DELPP_NO_DEFAULT_LOG_FILE)
add_definitions(-DVDEBUG=9)
if (LIEF_ELF)
add_definitions(-DLIEF_ELF_MODULE)
endif()

1
include/LIEF/types.hpp
View File

@ -17,4 +17,5 @@
#define LIEF_TYPES_H_
#include <stdint.h>
#include <inttypes.h>
#endif

6
src/BinaryStream/VectorStream.cpp
View File

@ -63,9 +63,9 @@ uint64_t VectorStream::size(void) const {
const void* VectorStream::read(uint64_t offset, uint64_t size) const {
if (offset > this->size() or (offset + size) > this->size()) {
VLOG(3) << "Offset: " << std::hex << offset;
VLOG(3) << "Size: " << std::hex << size;
VLOG(3) << "Binary Size: " << std::hex << this->size();
VLOG(VDEBUG) << "Offset: " << std::hex << offset;
VLOG(VDEBUG) << "Size: " << std::hex << size;
VLOG(VDEBUG) << "Binary Size: " << std::hex << this->size();
if (offset > this->size()) {
throw LIEF::read_out_of_bound(offset);

28
src/ELF/Binary.cpp
View File

@ -625,7 +625,7 @@ Section& Binary::add_section(const Section& section, bool loaded) {
if (it_progbit_section == std::end(this->sections_)) {
throw not_found("Can't find a SHT_PROGBITS section.");
}
VLOG(3) << "First SHT_PROGBITS: " << **it_progbit_section << std::endl;
VLOG(VDEBUG) << "First SHT_PROGBITS: " << **it_progbit_section << std::endl;
new_section_index = static_cast<uint32_t>(std::distance(std::begin(this->sections_), it_progbit_section));
const Section* progbit_section = *it_progbit_section;
@ -645,8 +645,8 @@ Section& Binary::add_section(const Section& section, bool loaded) {
new_section->file_offset(new_section_offset);
}
VLOG(3) << "New section offset: 0x" << std::hex << new_section->file_offset();
VLOG(3) << "New section index: " << std::dec << new_section_index;
VLOG(VDEBUG) << "New section offset: 0x" << std::hex << new_section->file_offset();
VLOG(VDEBUG) << "New section index: " << std::dec << new_section_index;
// The section size must align on a pagesize
const uint64_t psize = static_cast<uint64_t>(getpagesize());
@ -993,7 +993,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
Section *progbit_section = *it_first_progbit;
VLOG(3) << "Data will be inserted before the section: " << *progbit_section;
VLOG(VDEBUG) << "Data will be inserted before the section: " << *progbit_section;
// We align on page size
const uint64_t psize = static_cast<uint64_t>(getpagesize());
@ -1002,12 +1002,12 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
// Virtual address of data inserted
const uint64_t stub_virtual_address = progbit_section->virtual_address();
VLOG(3) << "New data VA 0x" << std::hex << stub_virtual_address;
VLOG(VDEBUG) << "New data VA 0x" << std::hex << stub_virtual_address;
// Offset of data inserted
const uint64_t sectionOffset = progbit_section->file_offset();
VLOG(3) << "New data offset 0x" << std::hex << sectionOffset;
VLOG(VDEBUG) << "New data offset 0x" << std::hex << sectionOffset;
// To remove if we don't want to include data in the section
progbit_section->size(progbit_section->size() + new_section_size);
@ -1190,7 +1190,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
if(arch == ARCH::EM_ARM and relocation.type() == RELOC_ARM::R_ARM_RELATIVE) {
const uint64_t address = relocation.address();
VLOG(3) << "Patch ARM relative relocation at address: 0x" << std::hex << address;
VLOG(VDEBUG) << "Patch ARM relative relocation at address: 0x" << std::hex << address;
Section& section = this->section_from_virtual_address(address);
const uint64_t relative_offset = this->virtual_address_to_offset(address) - section.offset();
std::vector<uint8_t> section_content = section.content();
@ -1203,7 +1203,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
if(arch == ARCH::EM_386 and relocation.type() == RELOC_i386::R_386_RELATIVE) {
const uint64_t address = relocation.address();
VLOG(3) << "Patch i386 relative relocation at address: " << std::hex << address;
VLOG(VDEBUG) << "Patch i386 relative relocation at address: " << std::hex << address;
Section& section = this->section_from_virtual_address(address);
const uint64_t relative_offset = this->virtual_address_to_offset(address) - section.offset();
std::vector<uint8_t> section_content = section.content();
@ -1217,7 +1217,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
if((arch == ARCH::EM_X86_64 or arch == ARCH::EM_IA_64) and
relocation.type() == RELOC_x86_64::R_X86_64_RELATIVE) {
const uint64_t address = relocation.address();
VLOG(3) << "Patch R_X86_64_RELATIVE relocation at address: 0x" << std::hex << address;
VLOG(VDEBUG) << "Patch R_X86_64_RELATIVE relocation at address: 0x" << std::hex << address;
Section& section = this->section_from_virtual_address(address);
const uint64_t relative_offset = this->virtual_address_to_offset(address) - section.offset();
std::vector<uint8_t> section_content = section.content();
@ -1233,7 +1233,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
// PLT/GOT Relocations
// -------------------
VLOG(3) << "Patching plt/got relocations";
VLOG(VDEBUG) << "Patching plt/got relocations";
for (Relocation& relocation : this->get_pltgot_relocations()) {
if (relocation.address() >= stub_virtual_address) {
relocation.address(relocation.address() + new_section_size);
@ -1241,7 +1241,7 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
// R_X86_64_IRELATIVE
if ((arch == ARCH::EM_X86_64 or arch == ARCH::EM_IA_64) and relocation.type() == RELOC_x86_64::R_X86_64_IRELATIVE) {
VLOG(3) << "Patching R_X86_64_IRELATIVE";
VLOG(VDEBUG) << "Patching R_X86_64_IRELATIVE";
if (static_cast<uint64_t>(relocation.addend()) >= stub_virtual_address) {
relocation.addend(relocation.addend() + new_section_size);
}
@ -1250,13 +1250,13 @@ std::pair<uint64_t, uint64_t> Binary::insert_content(std::vector<uint8_t>& conte
if (((arch == ARCH::EM_X86_64 or arch == ARCH::EM_IA_64) and relocation.type() == RELOC_x86_64::R_X86_64_JUMP_SLOT) or
(arch == ARCH::EM_ARM and relocation.type() == RELOC_ARM::R_ARM_JUMP_SLOT) or
(arch == ARCH::EM_386 and relocation.type() == RELOC_i386::R_386_JUMP_SLOT)) {
VLOG(3) << "Patching JUMP_SLOT";
VLOG(VDEBUG) << "Patching JUMP_SLOT";
const uint64_t address = relocation.address();
Section& section = this->section_from_virtual_address(address);
std::vector<uint8_t> content = section.content();
const uint64_t relative_offset = address - section.virtual_address();
VLOG(3) << "Section associated with the relocation: " << section.name();
VLOG(VDEBUG) << "Section associated with the relocation: " << section.name();
if (this->type_ == ELF_CLASS::ELFCLASS64) {
uint64_t* value = reinterpret_cast<uint64_t*>(content.data() + relative_offset);
@ -1322,7 +1322,7 @@ uint64_t Binary::virtual_address_to_offset(uint64_t virtual_address) const {
});
if (it_segment == std::end(this->segments_)) {
VLOG(3) << "Address: 0x" << std::hex << virtual_address;
VLOG(VDEBUG) << "Address: 0x" << std::hex << virtual_address;
throw conversion_error("Invalid virtual address");
}
uint64_t baseAddress = (*it_segment)->virtual_address() - (*it_segment)->file_offset();

2
src/ELF/Builder.cpp
View File

@ -124,7 +124,7 @@ void Builder::build_empty_symbol_gnuhash(void) {
void Builder::build_symbol_version(void) {
VLOG(3) << "[+] Building symbol version" << std::endl;
VLOG(VDEBUG) << "[+] Building symbol version" << std::endl;
if (this->binary_->symbol_version_table_.size() != this->binary_->dynamic_symbols_.size()) {
LOG(WARNING) << "The number of symbol version is different from the number of dynamic symbols ("

6
src/ELF/DataHandler/Handler.cpp
View File

@ -49,9 +49,9 @@ const std::vector<uint8_t>& Handler::content(void) const {
*/
std::vector<uint8_t> Handler::content(uint64_t offset, uint64_t size, Node::Type type) {
if (offset > this->data_.size() or (offset + size) > this->data_.size()) {
VLOG(3) << "Offset: 0x" << std::hex << offset;
VLOG(3) << "Size: 0x" << std::hex << size;
VLOG(3) << "Data size" << std::hex << this->data_.size();
VLOG(VDEBUG) << "Offset: 0x" << std::hex << offset;
VLOG(VDEBUG) << "Size: 0x" << std::hex << size;
VLOG(VDEBUG) << "Data size" << std::hex << this->data_.size();
throw std::runtime_error("Invalid data access");
}
Node& node = this->find(offset, size, false, type);

18
src/ELF/Parser.cpp
View File

@ -60,7 +60,7 @@ Parser::Parser(const std::string& file, DYNSYM_COUNT_METHODS count_mtd) :
}
void Parser::init(const std::string& name) {
VLOG(3) << "Parsing binary: " << name << std::endl;
VLOG(VDEBUG) << "Parsing binary: " << name << std::endl;
this->binary_ = new Binary{};
this->binary_->original_size_ = this->binary_size_;
this->binary_->name(name);
@ -116,9 +116,9 @@ Binary* Parser::parse(
void Parser::parse_symbol_version(uint64_t symbol_version_offset) {
VLOG(3) << "[+] Parsing symbol version" << std::endl;
VLOG(VDEBUG) << "[+] Parsing symbol version" << std::endl;
VLOG(3) << "Symbol version offset: 0x" << std::hex << symbol_version_offset << std::endl;
VLOG(VDEBUG) << "Symbol version offset: 0x" << std::hex << symbol_version_offset << std::endl;
const uint32_t nb_entries = static_cast<uint32_t>(this->binary_->dynamic_symbols_.size());
const uint16_t* array = reinterpret_cast<const uint16_t*>(
@ -223,7 +223,7 @@ void Parser::link_symbol_version(void) {
void Parser::parse_symbol_sysv_hash(uint64_t offset) {
VLOG(3) << "[+] Build symbol SYSV hash";
VLOG(VDEBUG) << "[+] Build symbol SYSV hash";
SysvHash sysvhash;
uint64_t current_offset = offset;
@ -274,29 +274,29 @@ void Parser::parse_symbol_sysv_hash(uint64_t offset) {
}
void Parser::parse_notes(uint64_t offset, uint64_t size) {
VLOG(3) << "Parsing Note segment";
VLOG(VDEBUG) << "Parsing Note segment";
uint64_t current_offset = offset;
uint64_t last_offset = offset + size;
while(current_offset < last_offset) {
uint32_t namesz = this->stream_->read_integer<uint32_t>(current_offset);
current_offset += sizeof(uint32_t);
VLOG(3) << "Name size: " << std::hex << namesz;
VLOG(VDEBUG) << "Name size: " << std::hex << namesz;
uint32_t descsz = this->stream_->read_integer<uint32_t>(current_offset);
current_offset += sizeof(uint32_t);
VLOG(3) << "Description size: " << std::hex << descsz;
VLOG(VDEBUG) << "Description size: " << std::hex << descsz;
uint32_t type = this->stream_->read_integer<uint32_t>(current_offset);
current_offset += sizeof(uint32_t);
VLOG(3) << "Type: " << std::hex << type;
VLOG(VDEBUG) << "Type: " << std::hex << type;
if (namesz == 0) { // System reserves
break;
}
std::string name = {this->stream_->read_string(current_offset, namesz), namesz - 1};
VLOG(3) << "Name: " << name << std::endl;
VLOG(VDEBUG) << "Name: " << name << std::endl;
current_offset += namesz;
current_offset = align(current_offset, sizeof(uint32_t));

40
src/ELF/Parser.tcc
View File

@ -20,7 +20,7 @@ namespace LIEF {
namespace ELF {
template<typename ELF_T>
void Parser::parse_binary(void) {
VLOG(3) << "Start parsing";
VLOG(VDEBUG) << "Start parsing";
// Parse header
// ============
try {
@ -453,7 +453,7 @@ template<typename ELF_T>
void Parser::parse_header(void) {
using Elf_Ehdr = typename ELF_T::Elf_Ehdr;
VLOG(3) << "[+] Parsing Header";
VLOG(VDEBUG) << "[+] Parsing Header";
try {
this->binary_->header_ = {reinterpret_cast<const Elf_Ehdr*>(
this->stream_->read(0, sizeof(Elf_Ehdr)))};
@ -708,7 +708,7 @@ uint32_t Parser::nb_dynsym_gnu_hash(void) const {
template<typename ELF_T>
void Parser::parse_sections(void) {
using Elf_Shdr = typename ELF_T::Elf_Shdr;
VLOG(3) << "[+] Parsing Section";
VLOG(VDEBUG) << "[+] Parsing Section";
const uint64_t headers_offset = this->binary_->header_.section_headers_offset();
const uint32_t numberof_sections = this->binary_->header_.numberof_sections();
@ -719,7 +719,7 @@ void Parser::parse_sections(void) {
for (size_t i = 0; i < numberof_sections; ++i) {
VLOG(3) << "\t Parsing section " << std::dec << i;
VLOG(VDEBUG) << "\t Parsing section " << std::dec << i;
const Elf_Shdr* hdr = &(section_headers[i]);
Section* section = new Section{hdr};
section->datahandler_ = this->binary_->datahandler_;
@ -768,7 +768,7 @@ template<typename ELF_T>
void Parser::parse_segments(void) {
using Elf_Phdr = typename ELF_T::Elf_Phdr;
VLOG(3) << "[+] Parse Segments";
VLOG(VDEBUG) << "[+] Parse Segments";
const uint64_t segment_headers_offset = this->binary_->get_header().program_headers_offset();
const uint32_t nbof_segments = this->binary_->get_header().numberof_segments();
@ -817,7 +817,7 @@ void Parser::parse_segments(void) {
template<typename ELF_T>
void Parser::parse_dynamic_relocations(uint64_t relocations_offset, uint64_t size, bool isRela) {
VLOG(3) << "[+] Parsing dynamic relocations";
VLOG(VDEBUG) << "[+] Parsing dynamic relocations";
using Elf_Rela = typename ELF_T::Elf_Rela;
using Elf_Rel = typename ELF_T::Elf_Rel;
@ -881,7 +881,7 @@ template<typename ELF_T>
void Parser::parse_static_symbols(uint64_t offset, uint32_t nbSymbols, const Section* string_section) {
using Elf_Sym = typename ELF_T::Elf_Sym;
VLOG(3) << "[+] Parsing static symbols";
VLOG(VDEBUG) << "[+] Parsing static symbols";
const Elf_Sym* symbol_headers = reinterpret_cast<const Elf_Sym*>(
this->stream_->read(offset, nbSymbols * sizeof(Elf_Sym)));
@ -903,7 +903,7 @@ void Parser::parse_static_symbols(uint64_t offset, uint32_t nbSymbols, const Sec
template<typename ELF_T>
void Parser::parse_dynamic_symbols(uint64_t offset) {
using Elf_Sym = typename ELF_T::Elf_Sym;
VLOG(3) << "[+] Parsing dynamics symbols";
VLOG(VDEBUG) << "[+] Parsing dynamics symbols";
uint32_t nb_symbols = this->get_numberof_dynamic_symbols<ELF_T>(this->count_mtd_);
@ -939,13 +939,13 @@ template<typename ELF_T>
void Parser::parse_dynamic_entries(uint64_t offset, uint64_t size) {
using Elf_Dyn = typename ELF_T::Elf_Dyn;
using uint__ = typename ELF_T::uint;
VLOG(3) << "[+] Parsing dynamic section";
VLOG(VDEBUG) << "[+] Parsing dynamic section";
const uint64_t nb_entries = size / sizeof(Elf_Dyn);
VLOG(3) << "Size of the dynamic section: 0x" << std::hex << size;
VLOG(3) << "offset of the dynamic section: 0x" << std::hex << offset;
VLOG(3) << "Nb of entrie in DynSec = " << std::dec << nb_entries;
VLOG(VDEBUG) << "Size of the dynamic section: 0x" << std::hex << size;
VLOG(VDEBUG) << "offset of the dynamic section: 0x" << std::hex << offset;
VLOG(VDEBUG) << "Nb of entrie in DynSec = " << std::dec << nb_entries;
uint64_t dynamic_string_offset = 0;
try {
@ -1368,11 +1368,11 @@ void Parser::parse_symbol_version_requirement(uint64_t offset, uint32_t nb_entri
using Elf_Verneed = typename ELF_T::Elf_Verneed;
using Elf_Vernaux = typename ELF_T::Elf_Vernaux;
VLOG(3) << "[+] Build Symbol version requirement";
VLOG(VDEBUG) << "[+] Build Symbol version requirement";
const uint64_t svr_offset = offset;
VLOG(3) << "Symbol version requirement offset: 0x" << std::hex << svr_offset;
VLOG(VDEBUG) << "Symbol version requirement offset: 0x" << std::hex << svr_offset;
const uint64_t string_offset = this->get_dynamic_string_table();
@ -1519,7 +1519,7 @@ template<typename ELF_T>
void Parser::parse_symbol_gnu_hash(uint64_t offset) {
using uint__ = typename ELF_T::uint;
VLOG(3) << "[+] Build symbol GNU hash";
VLOG(VDEBUG) << "[+] Build symbol GNU hash";
GnuHash gnuhash;
uint64_t current_offset = offset;
@ -1541,10 +1541,10 @@ void Parser::parse_symbol_gnu_hash(uint64_t offset) {
LOG(WARNING) << "maskwords is not a power of 2";
}
//VLOG(3) << "nbuckets: %d",nbuckets;
//VLOG(3) << "symndx: %d", symndx;
//VLOG(3) << "maskwords: %" PRIx32 "", maskwords;
//VLOG(3) << "shift2: %" PRIx32 "", shift2;
//VLOG(VDEBUG) << "nbuckets: %d",nbuckets;
//VLOG(VDEBUG) << "symndx: %d", symndx;
//VLOG(VDEBUG) << "maskwords: %" PRIx32 "", maskwords;
//VLOG(VDEBUG) << "shift2: %" PRIx32 "", shift2;
try {
std::vector<uint64_t> bloom_filters(maskwords);
@ -1578,7 +1578,7 @@ void Parser::parse_symbol_gnu_hash(uint64_t offset) {
gnuhash.buckets_ = std::move(buckets);
const uint32_t dynsymcount = static_cast<uint32_t>(this->binary_->dynamic_symbols_.size());
//VLOG(3) << "dynsymcount: %" PRId32 "", dynsymcount;
//VLOG(VDEBUG) << "dynsymcount: %" PRId32 "", dynsymcount;
if (dynsymcount < symndx) {
throw corrupted("GNU Hash, symndx corrupted");
}

6
src/ELF/Section.cpp
View File

@ -183,15 +183,15 @@ uint64_t Section::alignment(void) const {
std::vector<uint8_t> Section::content(void) const {
if (this->size() == 0 or this->type() == SECTION_TYPES::SHT_NOBITS) {
VLOG(3) << "Section '" << this->name() << "' is empty";
VLOG(VDEBUG) << "Section '" << this->name() << "' is empty";
return {};
}
if (this->datahandler_ == nullptr) {
VLOG(3) << "Content from cache";
VLOG(VDEBUG) << "Content from cache";
return this->content_c_;
} else {
VLOG(3) << std::hex << "Content from Data Handler [0x" << this->offset_ << ", 0x" << this->size_ << "]";
VLOG(VDEBUG) << std::hex << "Content from Data Handler [0x" << this->offset_ << ", 0x" << this->size_ << "]";
return this->datahandler_->content(this->offset_, this->size_, DataHandler::Node::SECTION);
}
}

8
src/ELF/Segment.cpp
View File

@ -170,10 +170,10 @@ uint64_t Segment::alignment(void) const {
std::vector<uint8_t> Segment::content(void) const {
if (this->datahandler_ == nullptr) {
VLOG(3) << "Content from cache";
VLOG(VDEBUG) << "Content from cache";
return this->content_c_;
} else {
VLOG(3) << std::hex << "Content from Data Handler [0x" << this->file_offset() << ", 0x" << this->physical_size() << "]";
VLOG(VDEBUG) << std::hex << "Content from Data Handler [0x" << this->file_offset() << ", 0x" << this->physical_size() << "]";
return this->datahandler_->content(this->file_offset(), this->physical_size(), DataHandler::Node::SEGMENT);
}
}
@ -252,10 +252,10 @@ void Segment::type(SEGMENT_TYPES type) {
void Segment::content(const std::vector<uint8_t>& content) {
if (this->datahandler_ == nullptr) {
VLOG(3) << "Set content in the cache";
VLOG(VDEBUG) << "Set content in the cache";
this->content_c_ = content;
} else {
VLOG(3) << "Set content in the data handler [0x" << std::hex << this->file_offset() << ", 0x" << content.size() << "]";
VLOG(VDEBUG) << "Set content in the data handler [0x" << std::hex << this->file_offset() << ", 0x" << content.size() << "]";
this->datahandler_->content(this->file_offset(), content, DataHandler::Node::SEGMENT);
}

4
src/MachO/Binary.cpp
View File

@ -442,7 +442,7 @@ SegmentCommand& Binary::segment_from_offset(uint64_t offset) {
LoadCommand& Binary::insert_command(const LoadCommand& command) {
VLOG(3) << "Insert command" << std::endl;
VLOG(VDEBUG) << "Insert command" << std::endl;
//this->header().nb_cmds(this->header().nb_cmds() + 1);
@ -469,7 +469,7 @@ LoadCommand& Binary::insert_command(const LoadCommand& command) {
// });
//VLOG(3) << "Last offset: %x", last_offset << std::endl;
//VLOG(VDEBUG) << "Last offset: %x", last_offset << std::endl;
//command.command_offset(last_offset);
//this->header().sizeof_cmds(this->header().sizeof_cmds() + command.size());
//this->commands_.push_back(command);

2
src/MachO/BinaryParser.cpp
View File

@ -85,7 +85,7 @@ BinaryParser::BinaryParser(const std::string& file) :
}
void BinaryParser::init(void) {
VLOG(3) << "Parsing MachO" << std::endl;
VLOG(VDEBUG) << "Parsing MachO" << std::endl;
MACHO_TYPES type = static_cast<MACHO_TYPES>(
*reinterpret_cast<const uint32_t*>(this->stream_->read(0, sizeof(uint32_t))));

62
src/MachO/BinaryParser.tcc
View File

@ -79,7 +79,7 @@ void BinaryParser::parse_load_commands(void) {
using segment_command_t = typename MACHO_T::segment_command;
using section_t = typename MACHO_T::section;
VLOG(3) << "[+] Building Load commands";
VLOG(VDEBUG) << "[+] Building Load commands";
uint64_t loadcommands_offset = sizeof(header_t);
for (size_t i = 0; i < this->binary_->header().nb_cmds(); ++i) {
@ -149,7 +149,7 @@ void BinaryParser::parse_load_commands(void) {
// ====
case LOAD_COMMAND_TYPES::LC_UUID:
{
VLOG(3) << "[+] Building UUID";
VLOG(VDEBUG) << "[+] Building UUID";
const uuid_command* cmd =
reinterpret_cast<const uuid_command*>(
this->stream_->read(loadcommands_offset, sizeof(uuid_command)));
@ -182,7 +182,7 @@ void BinaryParser::parse_load_commands(void) {
// ==============
case LOAD_COMMAND_TYPES::LC_PREBOUND_DYLIB:
{
VLOG(3) << "[+] Parsing LC_PREBOUND_DYLIB";
VLOG(VDEBUG) << "[+] Parsing LC_PREBOUND_DYLIB";
load_command = new LoadCommand{command};
const prebound_dylib_command* cmd =
@ -205,14 +205,14 @@ void BinaryParser::parse_load_commands(void) {
case LOAD_COMMAND_TYPES::LC_THREAD:
case LOAD_COMMAND_TYPES::LC_UNIXTHREAD:
{
VLOG(3) << "[+] Parsing LC_THREAD";
VLOG(VDEBUG) << "[+] Parsing LC_THREAD";
load_command = new LoadCommand{command};
const thread_command* cmd =
reinterpret_cast<const thread_command*>(
this->stream_->read(loadcommands_offset, sizeof(thread_command)));
VLOG(3) << "FLAVOR: " << cmd->flavor << std::endl
VLOG(VDEBUG) << "FLAVOR: " << cmd->flavor << std::endl
<< "COUNT: " << cmd->count;
break;
}
@ -224,7 +224,7 @@ void BinaryParser::parse_load_commands(void) {
case LOAD_COMMAND_TYPES::LC_ROUTINES_64:
{
VLOG(3) << "[+] Parsing LC_ROUTINE";
VLOG(VDEBUG) << "[+] Parsing LC_ROUTINE";
load_command = new LoadCommand{command};
break;
@ -236,7 +236,7 @@ void BinaryParser::parse_load_commands(void) {
case LOAD_COMMAND_TYPES::LC_SYMTAB:
{
using nlist_t = typename MACHO_T::nlist;
VLOG(3) << "[+] Parsing symbols";
VLOG(VDEBUG) << "[+] Parsing symbols";
const symtab_command* cmd =
reinterpret_cast<const symtab_command*>(
@ -267,7 +267,7 @@ void BinaryParser::parse_load_commands(void) {
// ===============
case LOAD_COMMAND_TYPES::LC_DYSYMTAB:
{
VLOG(3) << "[+] Parsing dynamic symbols";
VLOG(VDEBUG) << "[+] Parsing dynamic symbols";
const dysymtab_command* cmd =
reinterpret_cast<const dysymtab_command*>(
this->stream_->read(loadcommands_offset, sizeof(dysymtab_command)));
@ -282,7 +282,7 @@ void BinaryParser::parse_load_commands(void) {
case LOAD_COMMAND_TYPES::LC_DYLD_INFO:
case LOAD_COMMAND_TYPES::LC_DYLD_INFO_ONLY:
{
VLOG(3) << "[+] Parsing dyld information";
VLOG(VDEBUG) << "[+] Parsing dyld information";
const dyld_info_command* cmd =
reinterpret_cast<const dyld_info_command*>(
this->stream_->read(loadcommands_offset, sizeof(dyld_info_command)));
@ -296,27 +296,27 @@ void BinaryParser::parse_load_commands(void) {
// ===============
case LOAD_COMMAND_TYPES::LC_SOURCE_VERSION:
{
VLOG(3) << "[+] Parsing LC_SOURCE_VERSION";
VLOG(VDEBUG) << "[+] Parsing LC_SOURCE_VERSION";
const source_version_command* cmd =
reinterpret_cast<const source_version_command*>(
this->stream_->read(loadcommands_offset, sizeof(version_min_command)));
load_command = new SourceVersion{cmd};
VLOG(3) << "Version: " << std::hex << cmd->version;
VLOG(VDEBUG) << "Version: " << std::hex << cmd->version;
break;
}
case LOAD_COMMAND_TYPES::LC_VERSION_MIN_MACOSX:
case LOAD_COMMAND_TYPES::LC_VERSION_MIN_IPHONEOS:
{
VLOG(3) << "[+] Parsing " << to_string(static_cast<LOAD_COMMAND_TYPES>(command->cmd));
VLOG(VDEBUG) << "[+] Parsing " << to_string(static_cast<LOAD_COMMAND_TYPES>(command->cmd));
const version_min_command* cmd =
reinterpret_cast<const version_min_command*>(
this->stream_->read(loadcommands_offset, sizeof(version_min_command)));
VLOG(3) << "Version: " << std::hex << cmd->version;
VLOG(3) << "SDK: " << std::hex << cmd->sdk;
VLOG(VDEBUG) << "Version: " << std::hex << cmd->version;
VLOG(VDEBUG) << "SDK: " << std::hex << cmd->sdk;
load_command = new VersionMin{cmd};
break;
@ -327,7 +327,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_TWOLEVEL_HINTS:
// {
// VLOG(3) << "[+] Parsing LC_TWOLEVEL_HINTS";
// VLOG(VDEBUG) << "[+] Parsing LC_TWOLEVEL_HINTS";
// load_command = new LoadCommand{command};
// break;
@ -335,7 +335,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_SUB_FRAMEWORK:
// {
// VLOG(3) << "[+] Parsing LC_SUB_FRAMEWORK";
// VLOG(VDEBUG) << "[+] Parsing LC_SUB_FRAMEWORK";
// load_command = new LoadCommand{command};
// break;
@ -343,7 +343,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_SUB_UMBRELLA:
// {
// VLOG(3) << "[+] Parsing LC_SUB_UMBRELLA";
// VLOG(VDEBUG) << "[+] Parsing LC_SUB_UMBRELLA";
// load_command = new LoadCommand{command};
// break;
@ -351,7 +351,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_SUB_LIBRARY:
// {
// VLOG(3) << "[+] Parsing LC_SUB_LIBRARY";
// VLOG(VDEBUG) << "[+] Parsing LC_SUB_LIBRARY";
// load_command = new LoadCommand{command};
// break;
@ -359,7 +359,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_SUB_CLIENT:
// {
// VLOG(3) << "[+] Parsing LC_SUB_CLIENT";
// VLOG(VDEBUG) << "[+] Parsing LC_SUB_CLIENT";
// load_command = new LoadCommand{command};
// break;
@ -370,7 +370,7 @@ void BinaryParser::parse_load_commands(void) {
// =======
case LOAD_COMMAND_TYPES::LC_MAIN:
{
VLOG(3) << "[+] Parsing LC_MAIN";
VLOG(VDEBUG) << "[+] Parsing LC_MAIN";
const entry_point_command* cmd =
reinterpret_cast<const entry_point_command*>(
@ -385,7 +385,7 @@ void BinaryParser::parse_load_commands(void) {
// ==================
case LOAD_COMMAND_TYPES::LC_FUNCTION_STARTS:
{
VLOG(3) << "[+] Parsing LC_FUNCTION_STARTS";
VLOG(VDEBUG) << "[+] Parsing LC_FUNCTION_STARTS";
const linkedit_data_command* cmd =
reinterpret_cast<const linkedit_data_command*>(
this->stream_->read(loadcommands_offset, sizeof(linkedit_data_command)));
@ -403,7 +403,7 @@ void BinaryParser::parse_load_commands(void) {
value += std::get<0>(value_delta);
offset += std::get<1>(value_delta);
VLOG(3) << "Value: " << std::hex << value;
VLOG(VDEBUG) << "Value: " << std::hex << value;
dynamic_cast<FunctionStarts*>(load_command)->add_function(value);
} while(offset < (cmd->dataoff + cmd->datasize) and std::get<0>(value_delta) > 0);
@ -412,7 +412,7 @@ void BinaryParser::parse_load_commands(void) {
//case LOAD_COMMAND_TYPES::LC_CODE_SIGNATURE:
// {
// VLOG(3) << "[+] Parsing LC_CODE_SIGNATURE";
// VLOG(VDEBUG) << "[+] Parsing LC_CODE_SIGNATURE";
// load_command = new LoadCommand{command};
// break;
// }
@ -446,11 +446,11 @@ void BinaryParser::parse_load_commands(void) {
template<class MACHO_T>
void BinaryParser::parse_relocations(Section& section) {
if (section.numberof_relocations() == 0) {
VLOG(3) << "No relocations in " << section.name();
VLOG(VDEBUG) << "No relocations in " << section.name();
return;
}
VLOG(3) << "Parse '" << section.name() << "' relocations (" << std::dec << section.numberof_relocations() << ")";
VLOG(VDEBUG) << "Parse '" << section.name() << "' relocations (" << std::dec << section.numberof_relocations() << ")";
uint64_t current_reloc_offset = section.relocation_offset();
size_t numberof_relocations = section.numberof_relocations();
@ -480,7 +480,7 @@ void BinaryParser::parse_relocations(Section& section) {
Relocation* relocation = section.relocations_.back();
relocation->symbol_ = &symbol;
VLOG(3) << "Symbol: " << symbol.name();
VLOG(VDEBUG) << "Symbol: " << symbol.name();
} else {
LOG(WARNING) << "Relocation #" << std::dec << i << " of " << section.name() << " symbol index is out-of-bound";
}
@ -492,7 +492,7 @@ void BinaryParser::parse_relocations(Section& section) {
Relocation* relocation = section.relocations_.back();
relocation->section_ = &relsec;
VLOG(3) << "Section: " << relsec.name();
VLOG(VDEBUG) << "Section: " << relsec.name();
} else {
LOG(WARNING) << "Relocation #" << std::dec << i << " of " << section.name() << " seems corrupted";
}
@ -503,7 +503,7 @@ void BinaryParser::parse_relocations(Section& section) {
section.relocations_[i]->section_ = &section;
}
section.relocations_[i]->architecture_ = this->binary_->header().cpu_type();
VLOG(3) << *section.relocations_.back();;
VLOG(VDEBUG) << *section.relocations_.back();;
current_reloc_offset += 2 * sizeof(uint32_t);
}
@ -673,7 +673,7 @@ void BinaryParser::parse_dyldinfo_rebases() {
Section& section = this->binary_->section_from_offset(offset);
relocation.section_ = &section;
} catch (const not_found& e) {
VLOG(3) << "Unable to tie a section with dyld relocation at 0x" << std::hex << relocation.address() << " - 0x" << offset;
VLOG(VDEBUG) << "Unable to tie a section with dyld relocation at 0x" << std::hex << relocation.address() << " - 0x" << offset;
}
}
}
@ -1343,7 +1343,7 @@ void BinaryParser::do_bind(BINDING_CLASS cls,
Section& section = this->binary_->section_from_offset(offset);
reloc->section_ = &section;
} catch (const not_found& e) {
VLOG(3) << "Unable to tie a section with dyld relocation at 0x" << std::hex << reloc->address();
VLOG(VDEBUG) << "Unable to tie a section with dyld relocation at 0x" << std::hex << reloc->address();
}
if (this->binary_->has_symbol(symbol_name)) {
@ -1360,7 +1360,7 @@ void BinaryParser::do_bind(BINDING_CLASS cls,
segment.relocations_.push_back(reloc);
}
this->binary_->dyld_info().binding_info_.push_back(binding_info);
VLOG(3) << to_string(cls) << segment.name() << " - " << symbol_name;
VLOG(VDEBUG) << to_string(cls) << segment.name() << " - " << symbol_name;
}
template<class MACHO_T>

10
src/MachO/Builder.cpp
View File

@ -64,7 +64,7 @@ void Builder::build(void) {
void Builder::build_header(void) {
VLOG(3) << "[+] Building header" << std::endl;
VLOG(VDEBUG) << "[+] Building header" << std::endl;
const Header& binary_header = this->binary_->header();
if (this->binary_->is64_) {
mach_header_64 header;
@ -101,7 +101,7 @@ void Builder::build_header(void) {
void Builder::build_load_commands(void) {
VLOG(3) << "[+] Building load segments" << std::endl;
VLOG(VDEBUG) << "[+] Building load segments" << std::endl;
const auto& binary = this->binaries_.back();
// Check if the number of segments is correct
@ -122,11 +122,11 @@ void Builder::build_load_commands(void) {
auto& data = command.data();
LOAD_COMMAND_TYPES cmd_type = command.command();
uint64_t loadCommandsOffset = command.command_offset();
VLOG(3) << "[+] Command offset: 0x" << std::hex << loadCommandsOffset << std::endl;
VLOG(VDEBUG) << "[+] Command offset: 0x" << std::hex << loadCommandsOffset << std::endl;
switch (cmd_type) {
//case LOAD_COMMAND_TYPES::LC_SYMTAB:
// {
// VLOG(3) << "\tProcessing Symbols %x", command->command() << std::endl;
// VLOG(VDEBUG) << "\tProcessing Symbols %x", command->command() << std::endl;
// auto symbol_command = static_cast<SymbolCommand*>(command);
// symtab_command command;
@ -195,7 +195,7 @@ void Builder::build_load_commands(void) {
case LOAD_COMMAND_TYPES::LC_SEGMENT_64:
case LOAD_COMMAND_TYPES::LC_SEGMENT:
{
VLOG(3) << "\tProcessing Load command " << to_string(cmd_type) << std::endl;
VLOG(VDEBUG) << "\tProcessing Load command " << to_string(cmd_type) << std::endl;
if (this->rawBinary_.size() < (loadCommandsOffset + data.size())) {
this->rawBinary_.resize(loadCommandsOffset + data.size());
}

8
src/MachO/Parser.cpp
View File

@ -89,7 +89,7 @@ void Parser::build_fat(void) {
const fat_header *header = reinterpret_cast<const fat_header*>(
this->stream_->read(0, sizeof(fat_header)));
uint32_t nb_arch = Swap4Bytes(header->nfat_arch);
VLOG(3) << "In this Fat binary there is " << std::dec << nb_arch << " archs" << std::endl;
VLOG(VDEBUG) << "In this Fat binary there is " << std::dec << nb_arch << " archs" << std::endl;
if (nb_arch > 10) {
throw parser_error("Too much architectures");
@ -103,9 +103,9 @@ void Parser::build_fat(void) {
const uint32_t offset = BinaryStream::swap_endian(arch[i].offset);
const uint32_t size = BinaryStream::swap_endian(arch[i].size);
VLOG(3) << "Dealing with arch[" << std::dec << i << "]" << std::endl;
VLOG(3) << "[" << std::dec << i << "] offset: 0x" << std::hex << offset << std::endl;
VLOG(3) << "[" << std::dec << i << "] size: 0x" << std::hex << size << std::endl;
VLOG(VDEBUG) << "Dealing with arch[" << std::dec << i << "]" << std::endl;
VLOG(VDEBUG) << "[" << std::dec << i << "] offset: 0x" << std::hex << offset << std::endl;
VLOG(VDEBUG) << "[" << std::dec << i << "] size: 0x" << std::hex << size << std::endl;
const uint8_t* raw = reinterpret_cast<const uint8_t*>(
this->stream_->read(offset, size));

4
src/PE/Binary.cpp
View File

@ -526,7 +526,7 @@ Section& Binary::add_section(const Section& section, SECTION_TYPES type) {
return std::max<uint64_t>(s->pointerto_raw_data() + s->sizeof_raw_data(), offset);
}), this->optional_header().file_alignment());
VLOG(3) << "New section offset: 0x" << std::hex << new_section_offset;
VLOG(VDEBUG) << "New section offset: 0x" << std::hex << new_section_offset;
// Compute new section Virtual address
@ -537,7 +537,7 @@ Section& Binary::add_section(const Section& section, SECTION_TYPES type) {
return std::max<uint64_t>(s->virtual_address() + s->virtual_size(), va);
}), this->optional_header().section_alignment());
VLOG(3) << "New section va: 0x" << std::hex << new_section_va;
VLOG(VDEBUG) << "New section va: 0x" << std::hex << new_section_va;
new_section->add_type(type);

32
src/PE/Builder.cpp
View File

@ -98,10 +98,10 @@ void Builder::write(const std::string& filename) const {
void Builder::build(void) {
VLOG(3) << "Rebuilding" << std::endl;
VLOG(VDEBUG) << "Rebuilding" << std::endl;
if (this->binary_->has_tls() and this->build_tls_) {
VLOG(3) << "[+] Rebuilding TLS" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding TLS" << std::endl;
if (this->binary_->type() == PE_TYPE::PE32) {
this->build_tls<PE32>();
} else {
@ -110,12 +110,12 @@ void Builder::build(void) {
}
if (this->binary_->has_relocations() and this->build_relocations_) {
VLOG(3) << "[+] Rebuilding relocations" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding relocations" << std::endl;
this->build_relocation();
}
if (this->binary_->has_resources() and this->binary_->resources_ != nullptr and this->build_resources_) {
VLOG(3) << "[+] Rebuilding resources" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding resources" << std::endl;
try {
this->build_resources();
} catch (not_found&) {
@ -123,7 +123,7 @@ void Builder::build(void) {
}
if (this->binary_->has_imports() and this->build_imports_) {
VLOG(3) << "[+] Rebuilding Import" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding Import" << std::endl;
if (this->binary_->type() == PE_TYPE::PE32) {
this->build_import_table<PE32>();
} else {
@ -131,7 +131,7 @@ void Builder::build(void) {
}
}
VLOG(3) << "[+] Rebuilding headers" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding headers" << std::endl;
*this << this->binary_->dos_header()
<< this->binary_->header()
@ -147,18 +147,18 @@ void Builder::build(void) {
*this << last_one;
VLOG(3) << "[+] Rebuilding sections" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding sections" << std::endl;
for (const Section& section : this->binary_->get_sections()) {
VLOG(3) << "Building section " << section.name();
VLOG(VDEBUG) << "Building section " << section.name();
*this << section;
}
VLOG(3) << "[+] Rebuilding symbols" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding symbols" << std::endl;
//this->build_symbols();
VLOG(3) << "[+] Rebuilding string table" << std::endl;
VLOG(VDEBUG) << "[+] Rebuilding string table" << std::endl;
//this->build_string_table();
if (this->binary_->overlay().size() > 0 and this->build_overlay_) {
@ -233,7 +233,7 @@ void Builder::build_relocation(void) {
// Build resources
//
void Builder::build_resources(void) {
VLOG(3) << "Building RSRC" << std::endl;
VLOG(VDEBUG) << "Building RSRC" << std::endl;
ResourceNode& node = this->binary_->get_resources();
//std::cout << ResourcesManager{this->binary_->resources_} << std::endl;
@ -379,7 +379,7 @@ void Builder::construct_resources(
}
} else {
//VLOG(3) << "Building Data" << std::endl;
//VLOG(VDEBUG) << "Building Data" << std::endl;
ResourceData *rsrc_data = dynamic_cast<ResourceData*>(&node);
pe_resource_data_entry data_header;
@ -416,7 +416,7 @@ void Builder::build_string_table(void) {
}
void Builder::build_overlay(void) {
VLOG(3) << "Building overlay";
VLOG(VDEBUG) << "Building overlay";
const uint64_t last_section_offset = std::accumulate(
std::begin(this->binary_->sections_),
@ -425,8 +425,8 @@ void Builder::build_overlay(void) {
return std::max<uint64_t>(section->offset() + section->size(), offset);
});
VLOG(3) << "Overlay offset: 0x" << std::hex << last_section_offset;
VLOG(3) << "Overlay size: " << std::dec << this->binary_->overlay().size();
VLOG(VDEBUG) << "Overlay offset: 0x" << std::hex << last_section_offset;
VLOG(VDEBUG) << "Overlay size: " << std::dec << this->binary_->overlay().size();
const size_t saved_offset = this->ios_.tellp();
this->ios_.seekp(last_section_offset);
@ -476,7 +476,7 @@ Builder& Builder::operator<<(const DosHeader& dos_header) {
Builder& Builder::operator<<(const Header& bHeader) {
VLOG(3) << "Building standard Header" << std::endl;
VLOG(VDEBUG) << "Building standard Header" << std::endl;
// Standard Header
pe_header header;
header.Machine = static_cast<uint16_t>(bHeader.machine());

114
src/PE/Parser.cpp
View File

@ -93,7 +93,7 @@ void Parser::build_dos_stub(void) {
}
const uint64_t sizeof_dos_stub = dos_header.addressof_new_exeheader() - sizeof(pe_dos_header);
VLOG(3) << "Size of dos stub: " << std::hex << sizeof_dos_stub;
VLOG(VDEBUG) << "Size of dos stub: " << std::hex << sizeof_dos_stub;
const uint8_t* ptr_to_dos_stub = reinterpret_cast<const uint8_t*>(this->stream_->read(
sizeof(pe_dos_header),
@ -103,7 +103,7 @@ void Parser::build_dos_stub(void) {
void Parser::build_rich_header(void) {
VLOG(3) << "Parsing Rich Header";
VLOG(VDEBUG) << "Parsing Rich Header";
const std::vector<uint8_t>& dos_stub = this->binary_->dos_stub();
VectorStream stream{dos_stub};
auto&& it_rich = std::search(
@ -113,18 +113,18 @@ void Parser::build_rich_header(void) {
std::end(Rich_Magic));
if (it_rich == std::end(dos_stub)) {
VLOG(3) << "Rich header not found";
VLOG(VDEBUG) << "Rich header not found";
return;
}
this->binary_->has_rich_header_ = true;
const uint64_t end_offset_rich_header = std::distance(std::begin(dos_stub), it_rich);
VLOG(3) << "Offset to rich header: " << std::hex << end_offset_rich_header;
VLOG(VDEBUG) << "Offset to rich header: " << std::hex << end_offset_rich_header;
const uint32_t xor_key = stream.read_integer<uint32_t>(end_offset_rich_header + sizeof(Rich_Magic));
this->binary_->rich_header().key(xor_key);
VLOG(3) << "XOR Key: " << std::hex << xor_key;
VLOG(VDEBUG) << "XOR Key: " << std::hex << xor_key;
uint64_t curent_offset = end_offset_rich_header - sizeof(Rich_Magic);
@ -152,14 +152,14 @@ void Parser::build_rich_header(void) {
uint16_t build_number = value & 0xFFFF;
uint16_t id = (value >> 16) & 0xFFFF;
VLOG(3) << "ID: " << std::hex << id << " "
VLOG(VDEBUG) << "ID: " << std::hex << id << " "
<< "Build Number: " << std::hex << build_number << " "
<< "Count: " << std::dec << count;
this->binary_->rich_header().add_entry(id, build_number, count);
}
VLOG(3) << this->binary_->rich_header();
VLOG(VDEBUG) << this->binary_->rich_header();
@ -174,7 +174,7 @@ void Parser::build_rich_header(void) {
// TODO: Check offset etc
void Parser::build_sections(void) {
VLOG(3) << "[+] Parsing sections";
VLOG(VDEBUG) << "[+] Parsing sections";
const uint32_t sections_offset =
this->binary_->dos_header().addressof_new_exeheader() +
@ -233,7 +233,7 @@ void Parser::build_sections(void) {
// Build relocations
//
void Parser::build_relocations(void) {
VLOG(3) << "[+] Parsing relocations";
VLOG(VDEBUG) << "[+] Parsing relocations";
this->binary_->has_relocations_ = true;
@ -278,15 +278,15 @@ void Parser::build_relocations(void) {
// Build ressources
//
void Parser::build_resources(void) {
VLOG(3) << "[+] Parsing resources";
VLOG(VDEBUG) << "[+] Parsing resources";
this->binary_->has_resources_ = true;
const uint32_t resources_rva = this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA();
VLOG(3) << "Resources RVA: 0x" << std::hex << resources_rva;
VLOG(VDEBUG) << "Resources RVA: 0x" << std::hex << resources_rva;
const uint32_t offset = this->binary_->rva_to_offset(resources_rva);
VLOG(3) << "Resources Offset: 0x" << std::hex << offset;
VLOG(VDEBUG) << "Resources Offset: 0x" << std::hex << offset;
const pe_resource_directory_table* directory_table = reinterpret_cast<const pe_resource_directory_table*>(
this->stream_->read(offset, sizeof(pe_resource_directory_table)));
@ -328,7 +328,7 @@ ResourceNode* Parser::build_resource_node(
this->stream_->read(string_offset, sizeof(uint16_t)));
if (length > 100) {
VLOG(3) << "Size: " << std::dec << length;
VLOG(VDEBUG) << "Size: " << std::dec << length;
throw LIEF::corrupted("Size error");
}
@ -402,7 +402,7 @@ ResourceNode* Parser::build_resource_node(
// Build string table
//
void Parser::build_string_table(void) {
VLOG(3) << "[+] Parsing string table";
VLOG(VDEBUG) << "[+] Parsing string table";
uint32_t stringTableOffset =
this->binary_->header().pointerto_symbol_table() +
this->binary_->header().numberof_symbols() * STRUCT_SIZES::Symbol16Size;
@ -426,7 +426,7 @@ void Parser::build_string_table(void) {
// Build Symbols
//
void Parser::build_symbols(void) {
VLOG(3) << "[+] Parsing symbols";
VLOG(VDEBUG) << "[+] Parsing symbols";
uint32_t symbolTableOffset = this->binary_->header().pointerto_symbol_table();
uint32_t numberOfSymbols = this->binary_->header().numberof_symbols();
uint32_t offsetToNextSymbol = symbolTableOffset;
@ -478,14 +478,14 @@ void Parser::build_symbols(void) {
// * Section Number: > 0
if (symbol.storage_class() == IMAGE_SYM_CLASS_EXTERNAL and
symbol.type() == 0x20 and symbol.section_number() > 0) {
VLOG(3) << "Format1";
VLOG(VDEBUG) << "Format1";
}
// Auxiliary Format 2: .bf and .ef Symbols
// * Storage class : FUNCTION
if (symbol.storage_class() == IMAGE_SYM_CLASS_FUNCTION) {
VLOG(3) << "Function";
VLOG(VDEBUG) << "Function";
}
// Auxiliary Format 3: Weak Externals
@ -494,21 +494,21 @@ void Parser::build_symbols(void) {
// * Value : 0
if (symbol.storage_class() == IMAGE_SYM_CLASS_EXTERNAL and
symbol.value() == 0 and symbol.section_number() == IMAGE_SYM_UNDEFINED) {
VLOG(3) << "Format 3";
VLOG(VDEBUG) << "Format 3";
}
// Auxiliary Format 4: Files
// * Storage class : FILE
// * Name **SHOULD** be: .file
if (symbol.storage_class() == IMAGE_SYM_CLASS_FILE) {
VLOG(3) << "Format 4";
VLOG(VDEBUG) << "Format 4";
//std::cout << reinterpret_cast<char*>(
}
// Auxiliary Format 5: Section Definitions
// * Storage class : STATIC
if (symbol.storage_class() == IMAGE_SYM_CLASS_STATIC) {
VLOG(3) << "Format 5";
VLOG(VDEBUG) << "Format 5";
}
offsetToNextSymbol += STRUCT_SIZES::Symbol16Size;
@ -528,7 +528,7 @@ void Parser::build_symbols(void) {
//
void Parser::build_debug(void) {
VLOG(3) << "[+] Parsing Debug";
VLOG(VDEBUG) << "[+] Parsing Debug";
this->binary_->has_debug_ = true;
@ -546,7 +546,7 @@ void Parser::build_debug(void) {
// Build configuration
//
void Parser::build_configuration(void) {
VLOG(3) << "[+] Parsing Load config";
VLOG(VDEBUG) << "[+] Parsing Load config";
this->binary_->has_configuration_ = true;
//uint32_t offset = rva_to_offset(this->binary_->sectionsList_, this->binary_->dataDirList_[LOAD_CONFIG_TABLE].getRVA());
//this->binary_->loadConfigure_ = *(reinterpret_cast<LoadConfiguration<uint32_t>*>(this->rawBinary_.data() + offset));
@ -557,7 +557,7 @@ void Parser::build_configuration(void) {
// Build Export
//
void Parser::build_exports(void) {
VLOG(3) << "[+] Parsing exports";
VLOG(VDEBUG) << "[+] Parsing exports";
this->binary_->has_exports_ = true;
@ -653,14 +653,14 @@ void Parser::build_exports(void) {
}
void Parser::build_signature(void) {
VLOG(3) << "[+] Parsing signature";
VLOG(VDEBUG) << "[+] Parsing signature";
/*** /!\ In this data directory, RVA is used as an **OFFSET** /!\ ****/
/*********************************************************************/
const uint32_t signature_offset = this->binary_->data_directory(DATA_DIRECTORY::CERTIFICATE_TABLE).RVA();
const uint32_t signature_size = this->binary_->data_directory(DATA_DIRECTORY::CERTIFICATE_TABLE).size();
VLOG(3) << "Signature Offset: 0x" << std::hex << signature_offset;
VLOG(3) << "Signature Size: 0x" << std::hex << signature_size;
VLOG(VDEBUG) << "Signature Offset: 0x" << std::hex << signature_offset;
VLOG(VDEBUG) << "Signature Size: 0x" << std::hex << signature_size;
const uint8_t* signature_ptr = reinterpret_cast<const uint8_t*>(this->stream_->read(signature_offset, signature_size));
std::vector<uint8_t> raw_signature = {signature_ptr, signature_ptr + signature_size};
@ -689,7 +689,7 @@ void Parser::build_signature(void) {
buf.p = p;
char oid_str[256] = { 0 };
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &buf);
VLOG(3) << "OID (signedData): " << oid_str;
VLOG(VDEBUG) << "OID (signedData): " << oid_str;
p += buf.len;
@ -713,7 +713,7 @@ void Parser::build_signature(void) {
throw corrupted("Signature corrupted");
}
VLOG(3) << "Version: " << std::dec << version;
VLOG(VDEBUG) << "Version: " << std::dec << version;
LOG_IF(version != 1, WARNING) << "Version should be equal to 1 (" << std::dec << version << ")";
signature.version_ = static_cast<uint32_t>(version);
@ -731,7 +731,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "digestAlgorithms: " << oid_str;
VLOG(VDEBUG) << "digestAlgorithms: " << oid_str;
signature.digest_algorithm_ = oid_str;
@ -761,7 +761,7 @@ void Parser::build_signature(void) {
if (MBEDTLS_OID_CMP(MBEDTLS_SPC_INDIRECT_DATA_OBJID, &content_type_oid) != 0) {
throw corrupted(std::string(oid_str) + " is not SPC_INDIRECT_DATA_OBJID");
}
VLOG(3) << "contentType: " << oid_str;
VLOG(VDEBUG) << "contentType: " << oid_str;
content_info.content_type_ = oid_str;
p += content_type_oid.len;
@ -769,7 +769,7 @@ void Parser::build_signature(void) {
// |_ SpcAttributeTypeAndOptionalValue
// |_ DigestInfo
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VLOG(3) << "Parsing SpcIndirectDataContent (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing SpcIndirectDataContent (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
throw corrupted("Signature corrupted");
}
@ -782,7 +782,7 @@ void Parser::build_signature(void) {
// |_ SPC_PE_IMAGE_DATAOBJ
// |_ SpcPeImageData
// ++++++++++++++++++++++++++++++++
VLOG(3) << "Parsing SpcAttributeTypeAndOptionalValue (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing SpcAttributeTypeAndOptionalValue (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
throw corrupted("Signature corrupted");
}
@ -795,7 +795,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << "SpcAttributeTypeAndOptionalValue->type " << oid_str;
VLOG(VDEBUG) << "SpcAttributeTypeAndOptionalValue->type " << oid_str;
content_info.type_ = oid_str;
p += content_type_oid.len;
@ -804,14 +804,14 @@ void Parser::build_signature(void) {
// |_ SpcPeImageFlags
// |_ SpcLink
// ++++++++++++++
VLOG(3) << "Parsing SpcPeImageData (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing SpcPeImageData (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
throw corrupted("Signature corrupted");
}
// SpcPeImageFlags
// ^^^^^^^^^^^^^^^
VLOG(3) << "Parsing SpcPeImageFlags (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing SpcPeImageFlags (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_BIT_STRING)) != 0) {
throw corrupted("Signature corrupted");
}
@ -836,7 +836,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "DigestInfo->digestAlgorithm: " << oid_str;
VLOG(VDEBUG) << "DigestInfo->digestAlgorithm: " << oid_str;
content_info.digest_algorithm_ = oid_str;
@ -852,7 +852,7 @@ void Parser::build_signature(void) {
// Certificates
// ============
VLOG(3) << "Parsing Certificates (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing Certificates (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
throw corrupted("Signature corrupted");
}
@ -869,7 +869,7 @@ void Parser::build_signature(void) {
signature.certificates_.emplace_back(ca);
mbedtls_x509_crt_info(buffer, sizeof(buffer), "", ca);
VLOG(3) << std::endl << buffer << std::endl;
VLOG(VDEBUG) << std::endl << buffer << std::endl;
if (ca->raw.len <= 0) {
break;
@ -893,13 +893,13 @@ void Parser::build_signature(void) {
throw corrupted("Signature corrupted");
}
VLOG(3) << "Version: " << std::dec << version;
VLOG(VDEBUG) << "Version: " << std::dec << version;
LOG_IF(version != 1, WARNING) << "SignerInfo's version should be equal to 1 (" << std::dec << version << ")";
signer_info.version_ = version;
// issuerAndSerialNumber
// ---------------------
VLOG(3) << "Parsing issuerAndSerialNumber (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing issuerAndSerialNumber (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
throw corrupted("Signature corrupted");
@ -932,7 +932,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << "Component ID: " << oid_str;
VLOG(VDEBUG) << "Component ID: " << oid_str;
p += content_type_oid.len;
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_PRINTABLE_STRING)) != 0) {
@ -941,7 +941,7 @@ void Parser::build_signature(void) {
std::string name{reinterpret_cast<char*>(p), tag};
issuer_name.emplace_back(oid_str, name);
VLOG(3) << "Name: " << name;
VLOG(VDEBUG) << "Name: " << name;
p += tag;
}
@ -962,14 +962,14 @@ void Parser::build_signature(void) {
// digestAlgorithm
// ---------------
VLOG(3) << "Parsing digestAlgorithm (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing digestAlgorithm (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_alg_null(&p, end, &alg_oid)) != 0) {
throw corrupted("Signature corrupted");
}
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "signerInfo->digestAlgorithm " << oid_str;
VLOG(VDEBUG) << "signerInfo->digestAlgorithm " << oid_str;
signer_info.digest_algorithm_ = oid_str;
@ -980,7 +980,7 @@ void Parser::build_signature(void) {
// -----------------------
AuthenticatedAttributes authenticated_attributes;
VLOG(3) << "Parsing authenticatedAttributes (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing authenticatedAttributes (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
throw corrupted("Signature corrupted");
}
@ -1000,7 +1000,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.2.840.113549.1.9.3 (PKCS #9 contentType)
VLOG(VDEBUG) << oid_str; // 1.2.840.113549.1.9.3 (PKCS #9 contentType)
p += content_type_oid.len;
@ -1018,7 +1018,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.2.840.113549.1.9.4
VLOG(VDEBUG) << oid_str; // 1.2.840.113549.1.9.4
p += content_type_oid.len;
//authenticated_attributes.content_type_ = oid_str;
@ -1033,7 +1033,7 @@ void Parser::build_signature(void) {
// |_ OID (PKCS #9 Message Disgest)
// |_ SET -> OCTET STING
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VLOG(3) << "Parsing messageDigest (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
VLOG(VDEBUG) << "Parsing messageDigest (offset: " << std::dec << (reinterpret_cast<size_t>(p) - reinterpret_cast<size_t>(signature_ptr)) << ")";
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
throw corrupted("Signature corrupted");
@ -1047,7 +1047,7 @@ void Parser::build_signature(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str << " (" << oid_to_string(oid_str) << ")"; // 1.2.840.113549.1.9.4
VLOG(VDEBUG) << oid_str << " (" << oid_to_string(oid_str) << ")"; // 1.2.840.113549.1.9.4
p += content_type_oid.len;
if ((ret = mbedtls_asn1_get_tag(&p, end, &tag, MBEDTLS_ASN1_SET | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
@ -1078,7 +1078,7 @@ void Parser::build_signature(void) {
content_type_oid.p = p;
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.3.6.1.4.1.311.2.1.12 (SpcSpOpusInfoObjId)
VLOG(VDEBUG) << oid_str; // 1.3.6.1.4.1.311.2.1.12 (SpcSpOpusInfoObjId)
p += content_type_oid.len;
// programName
@ -1102,7 +1102,7 @@ void Parser::build_signature(void) {
}
std::u16string progname{reinterpret_cast<char16_t*>(p + 1), tag / 2}; // programName
authenticated_attributes.program_name_ = progname;
VLOG(3) << "ProgName " << u16tou8(progname);
VLOG(VDEBUG) << "ProgName " << u16tou8(progname);
p += tag;
// moreInfo
@ -1118,7 +1118,7 @@ void Parser::build_signature(void) {
std::string more_info{reinterpret_cast<char*>(p), tag}; // moreInfo
authenticated_attributes.more_info_ = more_info;
VLOG(3) << more_info;
VLOG(VDEBUG) << more_info;
p += tag;
signer_info.authenticated_attributes_ = std::move(authenticated_attributes);
@ -1132,7 +1132,7 @@ void Parser::build_signature(void) {
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
signer_info.signature_algorithm_ = oid_str;
VLOG(3) << "digestEncryptionAlgorithm: " << oid_str;
VLOG(VDEBUG) << "digestEncryptionAlgorithm: " << oid_str;
// encryptedDigest
// ---------------
@ -1148,7 +1148,7 @@ void Parser::build_signature(void) {
signature.signer_info_ = std::move(signer_info);
VLOG(3) << "Signature: " << std::endl << signature;
VLOG(VDEBUG) << "Signature: " << std::endl << signature;
#endif
this->binary_->signature_ = SignatureParser::parse(raw_signature);
this->binary_->has_signature_ = true;
@ -1156,7 +1156,7 @@ void Parser::build_signature(void) {
void Parser::build_overlay(void) {
VLOG(3) << "Parsing Overlay";
VLOG(VDEBUG) << "Parsing Overlay";
const uint64_t last_section_offset = std::accumulate(
std::begin(this->binary_->sections_),
std::end(this->binary_->sections_), 0,
@ -1164,12 +1164,12 @@ void Parser::build_overlay(void) {
return std::max<uint64_t>(section->offset() + section->size(), offset);
});
VLOG(3) << "Overlay offset: 0x" << std::hex << last_section_offset;
VLOG(VDEBUG) << "Overlay offset: 0x" << std::hex << last_section_offset;
if (last_section_offset < this->stream_->size()) {
const uint64_t overlay_size = this->stream_->size() - last_section_offset;
VLOG(3) << "Overlay size: " << std::dec << overlay_size;
VLOG(VDEBUG) << "Overlay size: " << std::dec << overlay_size;
const uint8_t* ptr_to_overlay = reinterpret_cast<const uint8_t*>(this->stream_->read(
last_section_offset,

28
src/PE/Parser.tcc
View File

@ -27,7 +27,7 @@ void Parser::build(void) {
LOG(WARNING) << e.what();
}
VLOG(3) << "[+] Retreive Dos stub";
VLOG(VDEBUG) << "[+] Retreive Dos stub";
this->build_dos_stub();
@ -37,7 +37,7 @@ void Parser::build(void) {
LOG(WARNING) << e.what();
}
VLOG(3) << "[+] Decomposing Sections";
VLOG(VDEBUG) << "[+] Decomposing Sections";
try {
this->build_sections();
@ -45,7 +45,7 @@ void Parser::build(void) {
LOG(WARNING) << e.what();
}
VLOG(3) << "[+] Decomposing Data directories";
VLOG(VDEBUG) << "[+] Decomposing Data directories";
try {
this->build_data_directories<PE_T>();
} catch (const exception& e) {
@ -100,7 +100,7 @@ template<typename PE_T>
void Parser::build_data_directories(void) {
using pe_optional_header = typename PE_T::pe_optional_header;
VLOG(3) << "[+] Parsing data directories";
VLOG(VDEBUG) << "[+] Parsing data directories";
const uint32_t dirOffset =
this->binary_->dos_header().addressof_new_exeheader() +
@ -121,9 +121,9 @@ void Parser::build_data_directories(void) {
for (size_t i = 0; i < nbof_datadir; ++i) {
DataDirectory* directory = new DataDirectory{&dataDirectory[i], static_cast<DATA_DIRECTORY>(i)};
VLOG(3) << "Processing directory: " << to_string(static_cast<DATA_DIRECTORY>(i));
VLOG(3) << "- RVA: 0x" << std::hex << dataDirectory[i].RelativeVirtualAddress;
VLOG(3) << "- Size: 0x" << std::hex << dataDirectory[i].Size;
VLOG(VDEBUG) << "Processing directory: " << to_string(static_cast<DATA_DIRECTORY>(i));
VLOG(VDEBUG) << "- RVA: 0x" << std::hex << dataDirectory[i].RelativeVirtualAddress;
VLOG(VDEBUG) << "- Size: 0x" << std::hex << dataDirectory[i].Size;
if (directory->RVA() > 0) {
// Data directory is not always associated with section
const uint64_t offset = this->binary_->rva_to_offset(directory->RVA());
@ -140,7 +140,7 @@ void Parser::build_data_directories(void) {
try {
// Import Table
if (this->binary_->data_directory(DATA_DIRECTORY::IMPORT_TABLE).RVA() > 0) {
VLOG(3) << "[+] Decomposing Import Table";
VLOG(VDEBUG) << "[+] Decomposing Import Table";
const uint32_t import_rva = this->binary_->data_directory(DATA_DIRECTORY::IMPORT_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(import_rva);
@ -158,7 +158,7 @@ void Parser::build_data_directories(void) {
// Exports
if (this->binary_->data_directory(DATA_DIRECTORY::EXPORT_TABLE).RVA() > 0) {
VLOG(3) << "[+] Decomposing Exports";
VLOG(VDEBUG) << "[+] Decomposing Exports";
try {
this->build_exports();
@ -179,7 +179,7 @@ void Parser::build_data_directories(void) {
// TLS
if (this->binary_->data_directory(DATA_DIRECTORY::TLS_TABLE).RVA() > 0) {
VLOG(3) << "[+] Decomposing TLS";
VLOG(VDEBUG) << "[+] Decomposing TLS";
const uint32_t import_rva = this->binary_->data_directory(DATA_DIRECTORY::TLS_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(import_rva);
@ -197,7 +197,7 @@ void Parser::build_data_directories(void) {
// Relocations
if (this->binary_->data_directory(DATA_DIRECTORY::BASE_RELOCATION_TABLE).RVA() > 0) {
VLOG(3) << "[+] Decomposing relocations";
VLOG(VDEBUG) << "[+] Decomposing relocations";
const uint32_t relocation_rva = this->binary_->data_directory(DATA_DIRECTORY::BASE_RELOCATION_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(relocation_rva);
try {
@ -215,7 +215,7 @@ void Parser::build_data_directories(void) {
// Debug
if (this->binary_->data_directory(DATA_DIRECTORY::DEBUG).RVA() > 0) {
VLOG(3) << "[+] Decomposing debug";
VLOG(VDEBUG) << "[+] Decomposing debug";
const uint32_t rva = this->binary_->data_directory(DATA_DIRECTORY::DEBUG).RVA();
const uint64_t offset = this->binary_->rva_to_offset(rva);
try {
@ -233,7 +233,7 @@ void Parser::build_data_directories(void) {
// Resources
if (this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA() > 0) {
VLOG(3) << "[+] Decomposing resources";
VLOG(VDEBUG) << "[+] Decomposing resources";
const uint32_t resources_rva = this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(resources_rva);
try {
@ -353,7 +353,7 @@ void Parser::build_tls(void) {
using pe_tls = typename PE_T::pe_tls;
using uint__ = typename PE_T::uint;
VLOG(3) << "[+] Parsing TLS";
VLOG(VDEBUG) << "[+] Parsing TLS";
this->binary_->has_tls_ = true;

106
src/PE/ResourcesManager.cpp
View File

@ -238,12 +238,12 @@ ResourceVersion ResourcesManager::version(void) const {
// Size of the current "struct"
const uint16_t length = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
offset += sizeof(uint16_t);
VLOG(3) << "Lenght of the struct: 0x" << std::hex << length;
VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << length;
// Size of the fixed file info struct
const uint16_t value_length = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
offset += sizeof(uint16_t);
VLOG(3) << "Size of the 'FixedFileInfo' struct" << std::hex << value_length;
VLOG(VDEBUG) << "Size of the 'FixedFileInfo' struct" << std::hex << value_length;
// Type of the data in the version resource
// 1: Text data
@ -285,23 +285,23 @@ ResourceVersion ResourcesManager::version(void) const {
{ // First entry
VLOG(3) << "Parsing first entry";
VLOG(VDEBUG) << "Parsing first entry";
const uint16_t struct_file_info_length = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
uint64_t local_offset = offset;
VLOG(3) << "Length: " << std::hex << struct_file_info_length;
VLOG(VDEBUG) << "Length: " << std::hex << struct_file_info_length;
if (struct_file_info_length > 0) {
local_offset += sizeof(uint16_t);
const uint16_t struct_length = *reinterpret_cast<const uint16_t*>(stream.read(local_offset, sizeof(uint16_t)));
local_offset += sizeof(uint16_t);
VLOG(3) << "Lenght of the struct: 0x" << std::hex << struct_length;
VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << struct_length;
const uint16_t type = *reinterpret_cast<const uint16_t*>(stream.read(local_offset, sizeof(uint16_t)));
local_offset += sizeof(uint16_t);
VLOG(3) << "Type of the struct: " << std::dec << type;
VLOG(VDEBUG) << "Type of the struct: " << std::dec << type;
std::u16string key = {reinterpret_cast<const char16_t*>(content.data() + local_offset)};
VLOG(3) << "First entry (key) " << u16tou8(key);
VLOG(VDEBUG) << "First entry (key) " << u16tou8(key);
if (u16tou8(key) == "StringFileInfo") {
try {
version.string_file_info_ = this->get_string_file_info(stream, offset);
@ -325,25 +325,25 @@ ResourceVersion ResourcesManager::version(void) const {
{ // Second entry
VLOG(3) << "Parsing second entry";
VLOG(VDEBUG) << "Parsing second entry";
const uint16_t struct_file_info_length = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
uint64_t local_offset = offset;
VLOG(3) << "Length: " << std::hex << struct_file_info_length;
VLOG(VDEBUG) << "Length: " << std::hex << struct_file_info_length;
if (struct_file_info_length > 0) {
local_offset += sizeof(uint16_t);
const uint16_t struct_length = *reinterpret_cast<const uint16_t*>(stream.read(local_offset, sizeof(uint16_t)));
local_offset += sizeof(uint16_t);
VLOG(3) << "Lenght of the struct: 0x" << std::hex << struct_length;
VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << struct_length;
const uint16_t type = *reinterpret_cast<const uint16_t*>(stream.read(local_offset, sizeof(uint16_t)));
local_offset += sizeof(uint16_t);
VLOG(3) << "Type of the struct: " << std::dec << type;
VLOG(VDEBUG) << "Type of the struct: " << std::dec << type;
std::u16string key = {reinterpret_cast<const char16_t*>(content.data() + local_offset)};
VLOG(3) << "Second entry (key) " << u16tou8(key);
VLOG(VDEBUG) << "Second entry (key) " << u16tou8(key);
if (u16tou8(key) == "StringFileInfo") {
try {
version.string_file_info_ = this->get_string_file_info(stream, offset);
@ -369,7 +369,7 @@ ResourceVersion ResourcesManager::version(void) const {
ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream& stream, uint64_t& offset) const {
VLOG(3) << "Getting StringFileInfo object";
VLOG(VDEBUG) << "Getting StringFileInfo object";
// String File Info
// ================
@ -381,10 +381,10 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
const uint16_t value_length = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
str_local_offset += sizeof(uint16_t);
VLOG(3) << "Value length: " << std::dec << value_length << " (should be 0)";
VLOG(VDEBUG) << "Value length: " << std::dec << value_length << " (should be 0)";
const uint16_t type = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
VLOG(3) << "Type: " << std::dec << type;
VLOG(VDEBUG) << "Type: " << std::dec << type;
str_local_offset += sizeof(uint16_t);
string_file_info.type_ = type;
@ -400,7 +400,7 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
// Parse 'StringTable' childs
// ==========================
VLOG(3) << "Parsing 'StringTable' struct";
VLOG(VDEBUG) << "Parsing 'StringTable' struct";
while (str_local_offset < offset + string_file_info_length * sizeof(uint8_t)) {
LangCodeItem lang_code_item;
const uint16_t stringtable_length = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
@ -413,10 +413,10 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
const uint16_t stringtable_value_length = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
str_local_offset += sizeof(uint16_t);
VLOG(3) << "Value length: " << std::dec << stringtable_value_length << " (should be 0)";
VLOG(VDEBUG) << "Value length: " << std::dec << stringtable_value_length << " (should be 0)";
const uint16_t stringtable_type = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
VLOG(3) << "Type: " << std::dec << stringtable_type;
VLOG(VDEBUG) << "Type: " << std::dec << stringtable_type;
str_local_offset += sizeof(uint16_t);
// 1: Text data
@ -429,7 +429,7 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
std::u16string key = {reinterpret_cast<const char16_t*>(stream.content().data() + str_local_offset)};
lang_code_item.key_ = key;
VLOG(3) << "ID: " << u16tou8(key);
VLOG(VDEBUG) << "ID: " << u16tou8(key);
std::string key_str = u16tou8(key);
@ -438,8 +438,8 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
} else {
uint64_t lang_id = std::stoul(u16tou8(key.substr(0, 4)), 0, 16);
uint64_t code_page = std::stoul(u16tou8(key.substr(4, 8)), 0, 16);
VLOG(3) << "Lang ID: " << std::dec << lang_id;
VLOG(3) << "Code page: " << std::hex << code_page;
VLOG(VDEBUG) << "Lang ID: " << std::dec << lang_id;
VLOG(VDEBUG) << "Code page: " << std::hex << code_page;
}
str_local_offset += (key.size() + 1) * sizeof(char16_t);
@ -450,23 +450,23 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
while (str_local_offset < end_offset) {
const uint16_t string_length = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
str_local_offset += sizeof(uint16_t);
VLOG(3) << "Length of the 'string' struct: 0x" << std::hex << string_length;
VLOG(VDEBUG) << "Length of the 'string' struct: 0x" << std::hex << string_length;
const uint16_t string_value_length = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
str_local_offset += sizeof(uint16_t);
VLOG(3) << "Size of the 'value' member: 0x" << std::hex << string_value_length;
VLOG(VDEBUG) << "Size of the 'value' member: 0x" << std::hex << string_value_length;
const uint16_t string_type = *reinterpret_cast<const uint16_t*>(stream.read(str_local_offset, sizeof(uint16_t)));
str_local_offset += sizeof(uint16_t);
VLOG(3) << "Type of the 'string' struct: " << std::dec << string_type;
VLOG(VDEBUG) << "Type of the 'string' struct: " << std::dec << string_type;
std::u16string key = {reinterpret_cast<const char16_t*>(stream.content().data() + str_local_offset)};
VLOG(3) << "Key: " << u16tou8(key);
VLOG(VDEBUG) << "Key: " << u16tou8(key);
str_local_offset += (key.size() + 1) * sizeof(char16_t);
str_local_offset = align(str_local_offset, sizeof(uint32_t));
std::u16string value = {reinterpret_cast<const char16_t*>(stream.content().data() + str_local_offset)};
VLOG(3) << "Value: " << u16tou8(value);
VLOG(VDEBUG) << "Value: " << u16tou8(value);
str_local_offset += (value.size() + 1) * sizeof(char16_t);
str_local_offset = align(str_local_offset, sizeof(uint32_t));
@ -482,7 +482,7 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stream, uint64_t& offset) const {
VLOG(3) << "Getting VarFileInfo object";
VLOG(VDEBUG) << "Getting VarFileInfo object";
// Var file info
// =============
ResourceVarFileInfo var_file_info;
@ -494,12 +494,12 @@ ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stre
const uint16_t value_length = *reinterpret_cast<const uint16_t*>(stream.read(var_local_offset, sizeof(uint16_t)));
var_local_offset += sizeof(uint16_t);
VLOG(3) << "Value length: " << std::dec << value_length << " (should be 0)";
VLOG(VDEBUG) << "Value length: " << std::dec << value_length << " (should be 0)";
const uint16_t type = *reinterpret_cast<const uint16_t*>(stream.read(var_local_offset, sizeof(uint16_t)));
var_local_offset += sizeof(uint16_t);
var_file_info.type_ = type;
VLOG(3) << "Type: " << std::dec << type;
VLOG(VDEBUG) << "Type: " << std::dec << type;
std::u16string key = {reinterpret_cast<const char16_t*>(stream.content().data() + var_local_offset)};
if (u16tou8(key) != "VarFileInfo") {
@ -512,19 +512,19 @@ ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stre
// Parse 'Var' childs
// ==================
VLOG(3) << "Parsing 'Var' childs";
VLOG(VDEBUG) << "Parsing 'Var' childs";
while (var_local_offset < offset + var_file_info_length * sizeof(uint8_t)) {
const uint16_t var_length = *reinterpret_cast<const uint16_t*>(stream.read(var_local_offset, sizeof(uint16_t)));
var_local_offset += sizeof(uint16_t);
VLOG(3) << "Size of the 'Var' struct: 0x" << std::hex << var_length;
VLOG(VDEBUG) << "Size of the 'Var' struct: 0x" << std::hex << var_length;
const uint16_t var_value_length = *reinterpret_cast<const uint16_t*>(stream.read(var_local_offset, sizeof(uint16_t)));
var_local_offset += sizeof(uint16_t);
VLOG(3) << "Size of the 'Value' member: 0x" << std::hex << var_value_length;
VLOG(VDEBUG) << "Size of the 'Value' member: 0x" << std::hex << var_value_length;
const uint16_t var_type = *reinterpret_cast<const uint16_t*>(stream.read(var_local_offset, sizeof(uint16_t)));
var_local_offset += sizeof(uint16_t);
VLOG(3) << "Type: " << std::dec << var_type;
VLOG(VDEBUG) << "Type: " << std::dec << var_type;
std::u16string key = {reinterpret_cast<const char16_t*>(stream.content().data() + var_local_offset)};
if (u16tou8(key) != "Translation") {
@ -537,7 +537,7 @@ ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stre
const uint32_t *value_array = reinterpret_cast<const uint32_t*>(stream.read(var_local_offset, var_value_length * sizeof(uint8_t)));
const size_t nb_items = var_value_length / sizeof(uint32_t);
for (size_t i = 0; i < nb_items; ++i) {
VLOG(3) << "item[" << std::dec << i << "] = " << std::hex << value_array[i];
VLOG(VDEBUG) << "item[" << std::dec << i << "] = " << std::hex << value_array[i];
var_file_info.translations_.push_back(value_array[i]);
}
var_local_offset += var_value_length;
@ -618,8 +618,8 @@ std::vector<ResourceIcon> ResourcesManager::icons(void) const {
const pe_resource_icon_dir* group_icon_header = reinterpret_cast<const pe_resource_icon_dir*>(icon_group_content.data());
VLOG(3) << "Number of icons: " << std::dec << static_cast<uint32_t>(group_icon_header->count);
VLOG(3) << "Type: " << std::dec << static_cast<uint32_t>(group_icon_header->type);
VLOG(VDEBUG) << "Number of icons: " << std::dec << static_cast<uint32_t>(group_icon_header->count);
VLOG(VDEBUG) << "Type: " << std::dec << static_cast<uint32_t>(group_icon_header->type);
// Some checks
if (group_icon_header->type != 1) {
@ -777,7 +777,7 @@ void ResourcesManager::change_icon(const ResourceIcon& original, const ResourceI
i * sizeof(pe_resource_icon_group));
if (icon_header->ID == original.id()) {
VLOG(3) << "Group found: " << std::dec << i << "-nth";
VLOG(VDEBUG) << "Group found: " << std::dec << i << "-nth";
group = icon_header;
icon_header->width = newone.width();
icon_header->height = newone.height();
@ -863,7 +863,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
switch(menu_hint) {
case 0x0000:
{
VLOG(3) << "Dialog has not menu";
VLOG(VDEBUG) << "Dialog has not menu";
break;
}
@ -871,13 +871,13 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
{
const uint16_t menu_ordinal = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
offset += sizeof(uint16_t);
VLOG(3) << "Menu uses ordinal number " << std::dec << menu_ordinal;
VLOG(VDEBUG) << "Menu uses ordinal number " << std::dec << menu_ordinal;
break;
}
default:
{
VLOG(3) << "Menu uses unicode string";
VLOG(VDEBUG) << "Menu uses unicode string";
std::u16string menu_name = {reinterpret_cast<const char16_t*>(content.data() + offset)};
offset += (menu_name.size() + 1)* sizeof(char16_t);
}
@ -890,14 +890,14 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
switch(window_class_hint) {
case 0x0000:
{
VLOG(3) << "Windows class uses predefined dialog box";
VLOG(VDEBUG) << "Windows class uses predefined dialog box";
break;
}
case 0xFFFF:
{
const uint16_t windows_class_ordinal = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
VLOG(3) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
VLOG(VDEBUG) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
offset += sizeof(uint16_t);
break;
}
@ -905,7 +905,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
default:
{
VLOG(3) << "Windows class uses unicode string";
VLOG(VDEBUG) << "Windows class uses unicode string";
std::u16string window_class_name = {reinterpret_cast<const char16_t*>(content.data() + offset)};
offset += (window_class_name.size() + 1) * sizeof(char16_t);
}
@ -913,7 +913,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
// Title
// =====
VLOG(3) << "Title offset: " << std::hex << offset;
VLOG(VDEBUG) << "Title offset: " << std::hex << offset;
new_dialog.title_ = std::u16string{reinterpret_cast<const char16_t*>(content.data() + offset)};
offset += sizeof(uint16_t) * (new_dialog.title().size() + 1);
@ -941,21 +941,21 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
offset += (new_dialog.typeface().size() + 1) * sizeof(char16_t);
}
VLOG(3) << "Offset to the items: 0x" << std::hex << offset;
VLOG(3) << std::endl << std::endl << "####### Items #######" << std::endl;
VLOG(VDEBUG) << "Offset to the items: 0x" << std::hex << offset;
VLOG(VDEBUG) << std::endl << std::endl << "####### Items #######" << std::endl;
// Items
// =====
for (size_t i = 0; i < header->nbof_items; ++i) {
offset = align(offset, sizeof(uint32_t));
VLOG(3) << "item[" << std::dec << i << "] offset: 0x" << std::hex << offset;
VLOG(VDEBUG) << "item[" << std::dec << i << "] offset: 0x" << std::hex << offset;
ResourceDialogItem dialog_item;
if (new_dialog.is_extended()) {
const pe_dialog_item_template_ext* item_header = reinterpret_cast<const pe_dialog_item_template_ext*>(stream.read(offset, sizeof(pe_dialog_item_template_ext)));
offset += sizeof(pe_dialog_item_template_ext);
dialog_item = {item_header};
VLOG(3) << "Item ID: " << std::dec << item_header->id;
VLOG(VDEBUG) << "Item ID: " << std::dec << item_header->id;
} else {
const pe_dialog_item_template* item_header = reinterpret_cast<const pe_dialog_item_template*>(stream.read(offset, sizeof(pe_dialog_item_template)));
offset += sizeof(pe_dialog_item_template);
@ -970,10 +970,10 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
offset += sizeof(uint16_t);
if (window_class_hint == 0xFFFF) {
const uint16_t windows_class_ordinal = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
VLOG(3) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
VLOG(VDEBUG) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
offset += sizeof(uint16_t);
} else {
VLOG(3) << "Windows class uses unicode string";
VLOG(VDEBUG) << "Windows class uses unicode string";
std::u16string window_class_name = {reinterpret_cast<const char16_t*>(stream.read(offset, sizeof(uint16_t)))};
offset += (window_class_name.size() + 1) * sizeof(char16_t);
}
@ -986,12 +986,12 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
if (title_hint == 0xFFFF) {
offset += sizeof(uint16_t);
const uint16_t title_ordinal = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
VLOG(3) << "Title uses ordinal number " << std::dec << title_ordinal;
VLOG(VDEBUG) << "Title uses ordinal number " << std::dec << title_ordinal;
offset += sizeof(uint16_t);
} else {
std::u16string title_name = {reinterpret_cast<const char16_t*>(content.data() + offset)};
offset += (title_name.size() + 1) * sizeof(char16_t);
VLOG(3) << "Title uses unicode string: \"" << u16tou8(title_name) << "\"";
VLOG(VDEBUG) << "Title uses unicode string: \"" << u16tou8(title_name) << "\"";
dialog_item.title_ = std::u16string{title_name};
}
@ -999,7 +999,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
// -----------
const uint16_t extra_count = *reinterpret_cast<const uint16_t*>(stream.read(offset, sizeof(uint16_t)));
offset += sizeof(uint16_t);
VLOG(3) << "Extra count: " << std::hex << extra_count << std::endl;
VLOG(VDEBUG) << "Extra count: " << std::hex << extra_count << std::endl;
dialog_item.extra_count_ = extra_count;
offset += extra_count * sizeof(uint8_t);
new_dialog.items_.push_back(std::move(dialog_item));

68
src/PE/signature/SignatureParser.cpp
View File

@ -83,7 +83,7 @@ void SignatureParser::parse_header(void) {
buf.p = this->p_;
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &buf);
VLOG(3) << "OID (signedData): " << oid_str;
VLOG(VDEBUG) << "OID (signedData): " << oid_str;
this->p_ += buf.len;
if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS7_SIGNED_DATA, &buf) != 0) {
@ -105,7 +105,7 @@ void SignatureParser::parse_header(void) {
int32_t SignatureParser::get_signed_data_version(void) {
VLOG(3) << "Parse signed data - version";
VLOG(VDEBUG) << "Parse signed data - version";
int ret = 0;
int32_t version;
@ -113,14 +113,14 @@ int32_t SignatureParser::get_signed_data_version(void) {
throw corrupted("Signature corrupted");
}
VLOG(3) << "Version: " << std::dec << version;
VLOG(VDEBUG) << "Version: " << std::dec << version;
LOG_IF(version != 1, WARNING) << "Version should be equal to 1 (" << std::dec << version << ")";
return version;
}
std::string SignatureParser::get_signed_data_digest_algorithms(void) {
VLOG(3) << "Parse signed data - digest algorithm";
VLOG(VDEBUG) << "Parse signed data - digest algorithm";
int ret = 0;
size_t tag;
char oid_str[256] = { 0 };
@ -138,14 +138,14 @@ std::string SignatureParser::get_signed_data_digest_algorithms(void) {
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "digestAlgorithms: " << oid_str;
VLOG(VDEBUG) << "digestAlgorithms: " << oid_str;
return oid_str;
}
ContentInfo SignatureParser::parse_content_info(void) {
VLOG(3) << "Parse signed data - content info";
VLOG(VDEBUG) << "Parse signed data - content info";
int ret = 0;
size_t tag;
@ -162,7 +162,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
// |_ SpcAttributeTypeAndOptionalValue
// |_ DigestInfo
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VLOG(3) << "Parsing SpcIndirectDataContent (offset: "
VLOG(VDEBUG) << "Parsing SpcIndirectDataContent (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -183,7 +183,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
// |_ SPC_PE_IMAGE_DATAOBJ
// |_ SpcPeImageData
// ++++++++++++++++++++++++++++++++
VLOG(3) << "Parsing SpcAttributeTypeAndOptionalValue (offset: "
VLOG(VDEBUG) << "Parsing SpcAttributeTypeAndOptionalValue (offset: "
<< std::dec << this->current_offset()
<< ")";
if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
@ -199,7 +199,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << "SpcAttributeTypeAndOptionalValue->type " << oid_str;
VLOG(VDEBUG) << "SpcAttributeTypeAndOptionalValue->type " << oid_str;
content_info.type_ = oid_str;
this->p_ += content_type_oid.len;
@ -208,7 +208,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
// |_ SpcPeImageFlags
// |_ SpcLink
// ++++++++++++++
VLOG(3) << "Parsing SpcPeImageData (offset: "
VLOG(VDEBUG) << "Parsing SpcPeImageData (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -219,7 +219,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
// SpcPeImageFlags
// ^^^^^^^^^^^^^^^
VLOG(3) << "Parsing SpcPeImageFlags (offset: "
VLOG(VDEBUG) << "Parsing SpcPeImageFlags (offset: "
<< std::dec << this->current_offset()
<< ")";
if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_BIT_STRING)) != 0) {
@ -248,7 +248,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "DigestInfo->digestAlgorithm: " << oid_str;
VLOG(VDEBUG) << "DigestInfo->digestAlgorithm: " << oid_str;
content_info.digest_algorithm_ = oid_str;
@ -266,7 +266,7 @@ ContentInfo SignatureParser::parse_content_info(void) {
std::string SignatureParser::get_content_info_type(void) {
VLOG(3) << "Parse signed data - content info - content type";
VLOG(VDEBUG) << "Parse signed data - content info - content type";
mbedtls_asn1_buf content_type_oid;
int ret = 0;
@ -284,7 +284,7 @@ std::string SignatureParser::get_content_info_type(void) {
if (MBEDTLS_OID_CMP(MBEDTLS_SPC_INDIRECT_DATA_OBJID, &content_type_oid) != 0) {
throw corrupted(std::string(oid_str) + " is not SPC_INDIRECT_DATA_OBJID");
}
VLOG(3) << "contentType: " << oid_str << " (" << oid_to_string(oid_str) << ")";
VLOG(VDEBUG) << "contentType: " << oid_str << " (" << oid_to_string(oid_str) << ")";
this->p_ += content_type_oid.len;
return {oid_str};
@ -292,7 +292,7 @@ std::string SignatureParser::get_content_info_type(void) {
void SignatureParser::parse_certificates(void) {
VLOG(3) << "Parsing Certificates (offset: "
VLOG(VDEBUG) << "Parsing Certificates (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -318,7 +318,7 @@ void SignatureParser::parse_certificates(void) {
this->signature_.certificates_.emplace_back(ca);
mbedtls_x509_crt_info(buffer, sizeof(buffer), "", ca);
VLOG(3) << std::endl << buffer << std::endl;
VLOG(VDEBUG) << std::endl << buffer << std::endl;
this->p_ += ca->raw.len;
}
@ -326,7 +326,7 @@ void SignatureParser::parse_certificates(void) {
}
AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
VLOG(3) << "Parsing authenticatedAttributes (offset: "
VLOG(VDEBUG) << "Parsing authenticatedAttributes (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -358,7 +358,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.2.840.113549.1.9.3 (PKCS #9 contentType)
VLOG(VDEBUG) << oid_str; // 1.2.840.113549.1.9.3 (PKCS #9 contentType)
if (std::string(oid_str) != "1.2.840.113549.1.9.3") {
throw corrupted("Authenticated attributes corrupted: Wrong Content type OID (" + std::string(oid_str) + ")");
}
@ -379,7 +379,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.2.840.113549.1.9.4
VLOG(VDEBUG) << oid_str; // 1.2.840.113549.1.9.4
this->p_ += content_type_oid.len;
//authenticated_attributes.content_type_ = oid_str;
@ -395,7 +395,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
// |_ OID (PKCS #9 Message Disgest)
// |_ SET -> OCTET STING
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VLOG(3) << "Parsing messageDigest (offset: "
VLOG(VDEBUG) << "Parsing messageDigest (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -412,7 +412,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str << " (" << oid_to_string(oid_str) << ")"; // 1.2.840.113549.1.9.4
VLOG(VDEBUG) << oid_str << " (" << oid_to_string(oid_str) << ")"; // 1.2.840.113549.1.9.4
this->p_ += content_type_oid.len;
if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
@ -445,7 +445,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
content_type_oid.p = this->p_;
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << oid_str; // 1.3.6.1.4.1.311.2.1.12 (SpcSpOpusInfoObjId)
VLOG(VDEBUG) << oid_str; // 1.3.6.1.4.1.311.2.1.12 (SpcSpOpusInfoObjId)
this->p_ += content_type_oid.len;
// programName
@ -469,8 +469,8 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_CONTEXT_SPECIFIC)) != 0) {
throw corrupted("Authenticated attributes corrupted");
}
VLOG(3) << "Offset: " << std::dec << this->current_offset();
VLOG(3) << "Size: " << std::dec << tag;
VLOG(VDEBUG) << "Offset: " << std::dec << this->current_offset();
VLOG(VDEBUG) << "Size: " << std::dec << tag;
// u8 -> u16 due to endiness
std::string u8progname{reinterpret_cast<char*>(this->p_), tag};
@ -482,7 +482,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
}
authenticated_attributes.program_name_ = progname;
VLOG(3) << "ProgName " << u16tou8(progname);
VLOG(VDEBUG) << "ProgName " << u16tou8(progname);
this->p_ += tag;
// moreInfo
@ -499,7 +499,7 @@ AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
std::string more_info{reinterpret_cast<char*>(this->p_), tag}; // moreInfo
authenticated_attributes.more_info_ = more_info;
VLOG(3) << more_info;
VLOG(VDEBUG) << more_info;
this->p_ += tag;
return authenticated_attributes;
@ -529,13 +529,13 @@ SignerInfo SignatureParser::get_signer_info(void) {
throw corrupted("Signer info corrupted");
}
VLOG(3) << "Version: " << std::dec << version;
VLOG(VDEBUG) << "Version: " << std::dec << version;
LOG_IF(version != 1, WARNING) << "SignerInfo's version should be equal to 1 (" << std::dec << version << ")";
signer_info.version_ = version;
// issuerAndSerialNumber
// ---------------------
VLOG(3) << "Parsing issuerAndSerialNumber (offset: "
VLOG(VDEBUG) << "Parsing issuerAndSerialNumber (offset: "
<< std::dec << this->current_offset()
<< ")";
@ -574,7 +574,7 @@ SignerInfo SignatureParser::get_signer_info(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
VLOG(3) << "Component ID: " << oid_str;
VLOG(VDEBUG) << "Component ID: " << oid_str;
this->p_ += content_type_oid.len;
if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_PRINTABLE_STRING)) != 0) {
@ -583,7 +583,7 @@ SignerInfo SignatureParser::get_signer_info(void) {
std::string name{reinterpret_cast<char*>(this->p_), tag};
issuer_name.emplace_back(oid_str, name);
VLOG(3) << "Name: " << name;
VLOG(VDEBUG) << "Name: " << name;
this->p_ += tag;
}
@ -604,7 +604,7 @@ SignerInfo SignatureParser::get_signer_info(void) {
// digestAlgorithm
// ---------------
VLOG(3) << "Parsing digestAlgorithm (offset: "
VLOG(VDEBUG) << "Parsing digestAlgorithm (offset: "
<< std::dec << this->current_offset()
<< ")";
if ((ret = mbedtls_asn1_get_alg_null(&(this->p_), this->end_, &alg_oid)) != 0) {
@ -613,7 +613,7 @@ SignerInfo SignatureParser::get_signer_info(void) {
std::memset(oid_str, 0, sizeof(oid_str));
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
VLOG(3) << "signerInfo->digestAlgorithm " << oid_str;
VLOG(VDEBUG) << "signerInfo->digestAlgorithm " << oid_str;
signer_info.digest_algorithm_ = oid_str;
// authenticatedAttributes (IMPLICIT OPTIONAL)
@ -638,7 +638,7 @@ SignerInfo SignatureParser::get_signer_info(void) {
mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
signer_info.signature_algorithm_ = oid_str;
VLOG(3) << "digestEncryptionAlgorithm: " << oid_str;
VLOG(VDEBUG) << "digestEncryptionAlgorithm: " << oid_str;
// encryptedDigest
// ---------------
@ -701,7 +701,7 @@ void SignatureParser::parse_signature(void) {
catch (const corrupted& c) {
LOG(ERROR) << c.what();
}
VLOG(3) << "Signature: " << std::endl << this->signature_;
VLOG(VDEBUG) << "Signature: " << std::endl << this->signature_;
}

8
src/PE/utils.cpp
View File

@ -231,7 +231,7 @@ Import resolve_ordinals(const Import& import, bool strict) {
[] (const ImportEntry& entry) {
return not entry.is_ordinal();
})) {
VLOG(3) << "All imports use name. No ordinal!";
VLOG(VDEBUG) << "All imports use name. No ordinal!";
return import;
}
@ -248,19 +248,19 @@ Import resolve_ordinals(const Import& import, bool strict) {
if (strict) {
throw not_found(msg);
}
VLOG(3) << msg;
VLOG(VDEBUG) << msg;
return import;
}
Import resolved_import = import;
for (ImportEntry& entry : resolved_import.entries()) {
if (entry.is_ordinal()) {
VLOG(3) << "Dealing with: " << entry;
VLOG(VDEBUG) << "Dealing with: " << entry;
auto&& it_entry = it_library_lookup->second.find(static_cast<uint32_t>(entry.ordinal()));
if (it_entry == std::end(it_library_lookup->second)) {
if (strict) {
throw not_found("Unable to resolve ordinal: " + std::to_string(entry.ordinal()));
}
VLOG(3) << "Unable to resolve ordinal:" << std::hex << entry.ordinal();
VLOG(VDEBUG) << "Unable to resolve ordinal:" << std::hex << entry.ordinal();
continue;
}
entry.data(0);

2
src/logging.cpp
View File

@ -78,7 +78,7 @@ void Logger::set_level(LOGGING_LEVEL level) {
el::Loggers::setLoggingLevel(static_cast<el::Level>(level));
if (level == LOGGING_LEVEL::LOG_DEBUG) {
set_verbose_level(3);
set_verbose_level(VDEBUG);
}
}