yetangitu/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-10-04 18:29:37 +02:00
Code Issues Releases Wiki Activity

GP-4128 Adjust construction of SQL statements in OptionalTable

Browse source
This commit is contained in:
caheckman 2023-12-08 21:29:52 +00:00
parent ce5c48eba9
commit 4ca724e6d2
2 changed files with 82 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

68
Ghidra/Features/BSim/ghidra_scripts/CompareExecutablesScript.java
View file

@ -13,33 +13,87 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
// Calculate similarity/signifigance scores between executables by
// Calculate similarity/significance scores between executables by
// combining their function scores.
//@category BSim
import java.io.IOException;
import java.net.URL;
import java.security.InvalidParameterException;
import ghidra.app.script.GhidraScript;
import ghidra.features.bsim.query.BSimClientFactory;
import ghidra.features.bsim.query.FunctionDatabase;
import ghidra.features.bsim.query.client.*;
import ghidra.features.bsim.query.description.ExecutableRecord;
import ghidra.features.bsim.query.protocol.QueryExeInfo;
import ghidra.features.bsim.query.protocol.ResponseExe;
/**
* An example script using {@link ExecutableComparison} to compare executables within a BSim database.
* The user provides the URL of the database and the name of an executable within the database that
* will be compared against every other executable.
*
* Executables are considered similar if they share similar functions, as determined by the BSim similarity metric.
* Functions that are too common (high hitcount) or are too small (low self signficance) are not included
* in the score. A score of 1.0 means that all functions included in the score are shared between the two
* executables and each have a (function) similarity of 1.0.
*
* The script also computes a "library" score, which achieves 1.0 if the functions in the smaller of the two
* executables all have a perfect match in the bigger executable. The bigger executable may have many functions
* with no match in the smaller executable.
*
* For larger databases, repeated runs of this script can be made more efficient by allowing it to cache executable
* "self-scores" between runs. Uncomment one of two lines instantiating the {@link ScoreCaching} object below. The
* cache can be stored in the local file system or in an additional table/column in the BSim database.
*/
public class CompareExecutablesScript extends GhidraScript {
private ExecutableComparison exeCompare;
@Override
protected void run() throws Exception {
URL url = BSimClientFactory.deriveBSimURL("ghidra://localhost/repo");
String urlString = askString("Enter BSim database URL", "URL: ");
String execName =
askString("Enter name of executable to compare against database", "Name: ");
URL url = BSimClientFactory.deriveBSimURL(urlString);
try (FunctionDatabase database = BSimClientFactory.buildClient(url, true)) {
// FileScoreCaching cache = new FileScoreCaching("/tmp/test_scorecacher.txt");
TableScoreCaching cache = new TableScoreCaching(database);
exeCompare = new ExecutableComparison(database, 1000000,
"11111111111111111111111111111111", cache, monitor);
// Specify the list of executables to compare by giving their md5 hash
QueryExeInfo exeInfo = new QueryExeInfo();
exeInfo.filterExeName = execName;
ResponseExe exeResult = exeInfo.execute(database);
if (exeResult == null) {
String message = database.getLastError() != null ? database.getLastError().message
: "Unrecoverable error";
throw new IOException(message);
}
else if (exeResult.recordCount == 0) {
throw new InvalidParameterException(
"Executable " + execName + " is not present in database");
}
else if (exeResult.recordCount > 1) {
println("Multiple executables with the name - " + execName);
ExecutableRecord exeRecord = exeResult.records.get(0);
print("Using ");
println(exeRecord.printRaw());
}
String baseMd5 = exeResult.records.get(0).getMd5();
ScoreCaching cache = null; // If null, self scores will not be cached
// Scores can be cached in the local file system by using FileScoreCaching
// cache = new FileScoreCaching("/tmp/test_scorecacher.txt");
// Scores can be cached in a dedicated table within the database by using TableScoreCaching
// TableScoreCaching is currently only supported for the PostgreSQL back-end.
// cache = new TableScoreCaching(database);
exeCompare = new ExecutableComparison(database, 1000000, baseMd5, cache, monitor);
// Its possible to specify the executables to compare with the base executable by
// specifying their md5 hashes directly.
// exeCompare.addExecutable("22222222222222222222222222222222"); // 32 hex-digit string
// exeCompare.addExecutable("33333333333333333333333333333333");
// Otherwise specify that we should compare the base executable against all executables
exeCompare.addAllExecutables(5000);
ExecutableScorer scorer = exeCompare.getScorer();
if (!exeCompare.isConfigured()) {