Devirtualize Documentation

Transcription

1 Devirtualize Documentation Release 0.1 Adam Schwalm January 25, 2017

2

3 Contents 1 The basics Requirements Installation Usage Viewing the Inheritance Graph Package contents devirtualize.graph module devirtualize.itanium module devirtualize.type module devirtualize.utils module devirtualize.view module Contributing 11 4 Indices and tables 13 Python Module Index 15 i

4 ii

5 CHAPTER 1 The basics Devirtualize is an IDA plugin that rebuilds type information from the vtables and RTTI embedded in a binary. This information can then be used to devirtualize virtual function calls. Some additional features are provided like viewing inheritance graphs. 1.1 Requirements devirtualize was written using IDA Pro It may work with earlier versions but has not been tested. Additionally, the plugin makes use of the IDA Decompiler features, so the user must have a license for that. 1.2 Installation Because the project is built using the IDA python interface, there is no need for compilation. devirtualize folder and devirtualize_main.py file into your ida plugins directory. Just copy the 1.3 Usage Most features of the plugin will require that the user has first run the vtable analysis. To do this go to Edit->Plugins->Devirtualize. This process may take several minutes. After the analysis is completed, structures for each recovered type will be present in the Structures window in IDA. The actual devirtualization will occur automatically. When you have set the type of a local variable, the plugin will devirtualize anything it is able to using that information. For example, suppose you have the following type hierarchy: struct Mammal { Mammal() { std::cout << "Mammal::Mammal\n"; } virtual ~Mammal() {} virtual void walk() { std::cout << "Mammal::walk\n"; } }; struct Cat : Mammal { Cat() { std::cout << "Cat::Cat\n"; } virtual ~Cat() {} virtual void walk() { std::cout << "Cat::walk\n"; } }; 1

6 struct Dog : Mammal { Dog() { std::cout << "Dog::Dog\n"; } virtual ~Dog() {} virtual void walk() { std::cout << "Dog::walk\n"; } }; struct Bird { Bird() { std::cout << "Bird::Bird\n"; } virtual ~Bird() {} virtual void fly() { std::cout << "Bird::fly\n"; } }; // This may not be taxonomically accurate struct Bat : Bird, Mammal { Bat() { std::cout << "Bat::Bat\n"; } virtual ~Bat() {} virtual void fly() { std::cout << "Bat::fly\n"; } }; And a main that looks like: 1 int main() { 2 Bird *b; 3 Mammal* m; 4 if (rand() % 2) { 5 b = new Bat(); 6 m = new Cat(); 7 } else { 8 b = new Bird(); 9 m = new Dog(); 10 } 11 b->fly(); 12 m->walk(); 13 } Obviously the calls to fly and walk on lines 11 and 12 are virtual function calls. Which function is actually called depends on the output of rand. Here s how IDA might show main: 2 Chapter 1. The basics

7 Here the virtual function calls are visible on lines 28 and 29. If we run devirtualize, we can look at the Structures window to see what the plugin has been able to recover Usage 3

8 So devirtualize has correctly recovered the heirarchy, as well as the names using RTTI (if RTTI was disabled, the plugin will generate default names). Going back to the decompiled main output, we notice that lines 13, 16, 22, and 25 contain constructor calls (in future versions, devirtualize may rename the constructor to make this easier to see). If we then set a variable to one of these types, we can see the devirtualization. For example if we mark v3 as a Bat*: 4 Chapter 1. The basics

9 Notice that the virtual call on line 28 has been replaced with a normal function call. This function can be renamed, changed types, etc. It is as though a normal function call was actually there in source. 1.4 Viewing the Inheritance Graph If the user right clicks on v3 after setting its type to Bat*, an additional option Open Ancestor Type Graph will be available that will show an inheritance graph: 1.4. Viewing the Inheritance Graph 5

10 6 Chapter 1. The basics

11 CHAPTER 2 Package contents 2.1 devirtualize.graph module 2.2 devirtualize.itanium module This modules implements vtable, vtablegroup and typeinfo for the Itanium ABI. For reference, read class devirtualize.itanium.itaniumtypeinfo(ea) ItaniumTypeInfo is the RTTI typeinfo representation for the Itanium ABI. ea = None The address of the start of this RTTI object name = None The name present in this RTTI entry parents = None A list (in inheritance order) of the parent RTTI objects class devirtualize.itanium.itaniumvtablegroup(ea) A group of consecutive vtables in the Itanium ABI ea = None Start address of the table group primary_table() Same as self.tables[0] size The size in bytes of this table group tables = None A list of the tables comprising this group typeinfo A handle to the typeinfo for the primary table (and so, the full object associated with this table group). class devirtualize.itanium.itaniumvtable(ea) The Vtable representation for the Itanium ABI address_point = None The address of the start of the function array 7

12 ea = None The address of the start of this vtable functions = None A list of function addresses in this vtable (some may be NULL) offset_to_top = None The offset to the top of the object for a subobject with this vtable size = None The size in bytes of this vtable str_ea A string representation of self.ea, in hex. (Clickable when printed in IDA) typeinfo = None Handle to the RTTI object associated with this vtable (if any) 2.3 devirtualize.type module This module defines the generic Type interface for different ABIs. class devirtualize.type.type(tablegroup=none, typeinfo=none) This is the fundamental type in Devirtualize. Type is a flexible representation of a type that existed during compilation. Such a type may be discovered via RTTI or the presence of a TableGroup. ancestors A tree of the parent types for this type (and their parents, etc). For a heirarchy like this: A B \ / C D \ / E E s ancestors will be the nested dictionaries: { } C: { A: {}, B: {} }, D: {} Warning: Remember that dictionary traversal is not ordered, so the first item in the ancestors dictionary is not necessarily the first parent in the parents list. build_struct() Creates an IDA structure for this Type. children = None A list of this type s children constructors() A list of constructors associated with this type. The list will be empty for types not backed by tablegroups. 8 Chapter 2. Package contents

13 descendants A tree of the child types for this type (and their children, etc). For a heirarchy like this: A / \ B C / / \ D E F A s descendants will be the nested dictionaries: { } B: { D: {}, }, C: { E: {}, F: {} } destructors() A list of destructors associated with this type. The list will be empty for types not backed by tablegroups. family The set of Types that are the direct/indirect children and parents of this Type, as well as the children and parents of those types, recursively. is_ancestor_of(other) Returns True if other is a direct or indirect child of this Type. is_descendant_of(other) Returns True if other is a direct or indirect parent of this Type. parents = None A list of this type s parents in inheritance order table_for_cast(parent) Finds the table that would be used for virtual function lookups if this type was cast to parent. tablegroup = None Handle to the TableGroup backing this type (if any) typeinfo = None Handle to the RTTI typeinfo for this type (if any) devirtualize.type.types(regenerate=false) Returns a memoized list of Type objects for this binary devirtualize.type.fixup_this_arg_types(cfunc) Modifies a cfuncptr_t such that its first argument is a pointer to the Type that has this cfunc in its vtable (and is named this ) devirtualize.type.get_type_by_func(ea) Returns a Type with ea in its vtable. If there are multiple such types, the least derived type is returned (or the 1st found, if the multiple types have no known inheritance relationship). devirtualize.type.get_type_by_name(name) Returns any type object matching name 2.3. devirtualize.type module 9

14 devirtualize.type.get_type_by_tinfo(tinfo) Returns the Type that has a struct with the associated tinfo devirtualize.type.parents_from_destructors(type) Finds the direct parents of the Type associated with tablegroup by examining function calls in its destructor. devirtualize.type.save_type_info() Save the current state/relationships between types. This essentially saves the Devirtualize plugin. devirtualize.type.tables_from_heuristics(require_rtti=false) Yields addresses of VTableGroups found via heuristic methods devirtualize.type.tables_from_names() Yields addresses of VtableGroups if binary is not stripped devirtualize.type.type_matching_typeinfo(types, typeinfo) Get the type in types that is associated with typeinfo. 2.4 devirtualize.utils module 2.5 devirtualize.view module devirtualize.view.translate_vptr_references(cfunc) The real work function of Devirtualize. This function takes a cfuncptr and devirtualizes calls. 10 Chapter 2. Package contents

15 CHAPTER 3 Contributing Keeping in mind that this project is currently very unstable, please feel free to contribute by submitting a pull request to the Github project. 11

16 12 Chapter 3. Contributing

17 CHAPTER 4 Indices and tables genindex modindex search 13

18 14 Chapter 4. Indices and tables

19 Python Module Index d devirtualize.graph, 7 devirtualize.itanium, 7 devirtualize.type, 8 devirtualize.utils, 10 devirtualize.view, 10 15

20 16 Python Module Index

21 Index A address_point (devirtualize.itanium.itaniumvtable attribute), 7 ancestors (devirtualize.type.type attribute), 8 B build_struct() (devirtualize.type.type method), 8 C children (devirtualize.type.type attribute), 8 constructors() (devirtualize.type.type method), 8 D descendants (devirtualize.type.type attribute), 8 destructors() (devirtualize.type.type method), 9 devirtualize.graph (module), 7 devirtualize.itanium (module), 7 devirtualize.type (module), 8 devirtualize.utils (module), 10 devirtualize.view (module), 10 E ea (devirtualize.itanium.itaniumtypeinfo attribute), 7 ea (devirtualize.itanium.itaniumvtable attribute), 7 ea (devirtualize.itanium.itaniumvtablegroup attribute), 7 F family (devirtualize.type.type attribute), 9 fixup_this_arg_types() (in module devirtualize.type), 9 functions (devirtualize.itanium.itaniumvtable attribute), 8 G get_type_by_func() (in module devirtualize.type), 9 get_type_by_name() (in module devirtualize.type), 9 get_type_by_tinfo() (in module devirtualize.type), 9 I is_ancestor_of() (devirtualize.type.type method), 9 is_descendant_of() (devirtualize.type.type method), 9 ItaniumTypeInfo (class in devirtualize.itanium), 7 ItaniumVtable (class in devirtualize.itanium), 7 ItaniumVTableGroup (class in devirtualize.itanium), 7 N name (devirtualize.itanium.itaniumtypeinfo attribute), 7 O offset_to_top (devirtualize.itanium.itaniumvtable attribute), 8 P parents (devirtualize.itanium.itaniumtypeinfo attribute), 7 parents (devirtualize.type.type attribute), 9 parents_from_destructors() (in module devirtualize.type), 10 primary_table() (devirtualize.itanium.itaniumvtablegroup method), 7 S save_type_info() (in module devirtualize.type), 10 size (devirtualize.itanium.itaniumvtable attribute), 8 size (devirtualize.itanium.itaniumvtablegroup attribute), 7 str_ea (devirtualize.itanium.itaniumvtable attribute), 8 T table_for_cast() (devirtualize.type.type method), 9 tablegroup (devirtualize.type.type attribute), 9 tables (devirtualize.itanium.itaniumvtablegroup attribute), 7 tables_from_heuristics() (in module devirtualize.type), 10 tables_from_names() (in module devirtualize.type), 10 translate_vptr_references() (in module devirtualize.view), 10 Type (class in devirtualize.type), 8 17

22 type_matching_typeinfo() (in module devirtualize.type), 10 typeinfo (devirtualize.itanium.itaniumvtable attribute), 8 typeinfo (devirtualize.itanium.itaniumvtablegroup attribute), 7 typeinfo (devirtualize.type.type attribute), 9 Types() (in module devirtualize.type), 9 18 Index