reven2.ossi.ossi.Binary

class documentation

class Binary:

Light model of a binary file.

It provides useful information such as the guest filesytem path or the list of available symbols.

Warnings

Must not be directly constructed but retrieved through the following examples. Using an instance of Binary directly constructed could lead to an AssertionError.

Examples

>>> # From a Transition
>>> transition.context_before().ossi.location().binary # from the context before the transition
>>> transition.context_after().ossi.location().binary  # from the context after the transition

>>> # From a Context
>>> context.location().binary

>>> # From a Symbol
>>> symbol.binary

Method	`__eq__`	Compares the instance for equality with an object.
Method	`__hash__`	Returns the hash for this value.
Method	`__init__`	Undocumented
Method	`__ne__`	Compares the instance for equality with an object.
Method	`__repr__`	Undocumented
Method	`__str__`	Returns the nicely printable string representation of this instance.
Method	`data_symbols`	Undocumented
Method	`exact_type`	Get the `reven2.types.Type` with the specified name in the debug object associated with this binary.
Method	`function_symbols`	Undocumented
Method	`symbols`	Get a generator over symbols of the binary.
Method	`types`	Get the `reven2.types.Type` with the specified name in the debug object associated with this binary.
Property	`filename`	Property: The filename of the binary (including the extension).
Property	`name`	Property: The filename of the binary without the extension.
Property	`path`	Property: The path to the binary in the guest filesystem.
Instance Variable	`_datasource`	Undocumented
Instance Variable	`_id`	Undocumented

def __eq__(self, other):

Compares the instance for equality with an object.

if the object is not a Binary, returns False.

Parameters
other:`_Any`	Undocumented
Returns
`bool`	Undocumented

def __hash__(self):

Returns the hash for this value.

Returns
`int`	Undocumented

def __init__(self, _datasource, _id):

Undocumented

Parameters
_datasource:`DataSource`	Undocumented
_id:`str`	Undocumented

def __ne__(self, other):

Compares the instance for equality with an object.

if the object is not a Binary, returns True.

Parameters
other:`_Any`	Undocumented
Returns
`bool`	Undocumented

def __repr__(self):

Undocumented

Returns
`str`	Undocumented

def __str__(self):

Returns the nicely printable string representation of this instance.

Returns
`str`	Undocumented

def data_symbols(self, pattern=None, case_sensitive=False):

Undocumented

Parameters
pattern:`_Optional[str]`	Undocumented
case_sensitive:`bool`	Undocumented
Returns
`_Iterator[DataSymbol]`	Undocumented

def exact_type(self, name):

Get the reven2.types.Type with the specified name in the debug object associated with this binary.

Example

>>> # Reading a type in ntoskrnl, then reading an address as an instance of this type
>>> file_object_type: Struct = ntoskrnl.exact_type("_FILE_OBJECT")
>>> file_object: StructInstance = ctx.read(file_object_addr, file_object_type)

Information

Parameters
name:`str`	the exact name of the type, as it appears in the debug object.
Returns
`_Type`	Undocumented
Raises
`KeyError`	if the type with the requested name cannot be produced, e.g. because: it doesn't exist in the debug object there are multiple objects with this name in the debug object the type exists in the debug object, but couldn't be parsed (unsupported or erroneous debug object) The error message will specify the cause of the error.

def function_symbols(self, pattern=None, case_sensitive=False):

Undocumented

Parameters
pattern:`_Optional[str]`	Undocumented
case_sensitive:`bool`	Undocumented
Returns
`_Iterator[FunctionSymbol]`	Undocumented

def symbols(self, pattern=None, case_sensitive=False):

Get a generator over symbols of the binary.

Symbols can be filtered by their name:

filter enabled if the `pattern` argument is not None.
a `contains` approach is used.
the filter pattern is a regular expression.
case sensitive depending on the `case_sensitive` argument

They are fetched from the binary file itself and its related debug file, if any.

Warnings

It depends on the OSSI feature. If unavailable, an exception will be raised.

If the binary file is not accessible from the provided filesystem, no symbols will be returned.

Examples

>>> for symbol in binary.symbols():
...     print(symbol)
'toto'
'tata'

>>> for symbol in binary.symbols('toto'):
...     print(symbol)
'toto'

Information

Parameters
pattern:`_Optional[str]`	a regular expression used to compare symbols.
case_sensitive:`bool`	Whether the symbols comparison is case sensitive or not.
Returns
`_Iterator[_Union[FunctionSymbol, DataSymbol]]`	A generator on the binary's `Symbol`s .
Raises
`RuntimeError`	if OSSI feature is unavailable.

def types(self, name):

Get the reven2.types.Type with the specified name in the debug object associated with this binary.

Information

Parameters
name:`str`	the exact name of the type, as it appears in the debug object.
Returns
`_Iterator[_Union[_Type, _ErrorType]]`	Undocumented

@property
filename: str =

Property: The filename of the binary (including the extension).

Examples

>>> binary.path
'c:/windows/system32/ntoskrnl.exe'
>>> binary.filename
'ntoskrnl.exe'

Information

Returns
A `string`.

@property
name: str =

Property: The filename of the binary without the extension.

Examples

>>> binary.path
'c:/windows/system32/ntoskrnl.exe'
>>> binary.name
'ntoskrnl'

Information

Returns
A `string`.

@property
path: str =

Property: The path to the binary in the guest filesystem.

Path Format:

Using / as file separator.

Examples

>>> binary.path
'c:/windows/system32/ntoskrnl.exe'

Information

Returns
A `string`.

_datasource =

Undocumented

_id =

Undocumented