Skip to content

Commit

Permalink
修复连续省略参数函数
Browse files Browse the repository at this point in the history
  • Loading branch information
fjqisba committed Aug 31, 2022
1 parent 1e9eb5b commit 8639627
Show file tree
Hide file tree
Showing 7 changed files with 43 additions and 198 deletions.
1 change: 1 addition & 0 deletions E-Decompiler/EDecompiler.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
#include "ECSigParser.h"
#include "ImportsParser.h"
#include <hexrays.hpp>
#include <frame.hpp>
#include "./Module/ShowEventList.h"
#include "./Module/ShowImports.h"

Expand Down
27 changes: 19 additions & 8 deletions E-Decompiler/ESymbol.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -268,7 +268,7 @@ bool ESymbol::scanBasicFunction()
else if (funcName == "连续省略参数") {
IDAWrapper::apply_cdecl(pFunc->start_ea, "void __usercall pushDefaultParam(int argCount@<ebx>);");
eSymbolFuncTypeMap[pFunc->start_ea] = eFunc_PushDefaultArg;
handlePushDefaultArgFunc(pFunc->start_ea);
handleFuncPushDefaultArg(pFunc->start_ea);
}
else if (funcName == "文本比较") {
IDAWrapper::apply_cdecl(pFunc->start_ea, "int __cdecl strcmp(char* _Str1,char* _Str2);");
Expand All @@ -277,13 +277,6 @@ bool ESymbol::scanBasicFunction()
return true;
}

bool ESymbol::handlePushDefaultArgFunc(unsigned int funcAddr)
{
std::vector<unsigned int> xrefList = IDAWrapper::getAllCodeXrefAddr(funcAddr);

return true;
}

bool ESymbol::loadKrnlInterface(unsigned int lpKrnlEntry)
{
qstring jmpOtherHelpHex;
Expand Down Expand Up @@ -573,6 +566,24 @@ bool ESymbol::loadUserImports(unsigned int dwApiCount, unsigned int lpModuleName
return true;
}

bool ESymbol::handleFuncPushDefaultArg(unsigned int callAddr)
{
std::vector<unsigned int> xRefList = IDAWrapper::getAllCodeXrefAddr(callAddr);
for (unsigned int n = 0; n < xRefList.size(); ++n) {
insn_t tmpIns;
if (decode_prev_insn(&tmpIns, xRefList[n]) == BADADDR) {
continue;
}
//mov ebx,xxx
if (tmpIns.itype != NN_mov || tmpIns.ops[0].reg != 0x3) {
continue;
}
unsigned int argCount = tmpIns.ops[1].value;
IDAWrapper::add_user_stkpnt(xRefList[n] + 5, -(argCount * 4));
}
return true;
}

bool ESymbol::scanEClassTable()
{
//不信有区段大于0x1000000
Expand Down
5 changes: 2 additions & 3 deletions E-Decompiler/ESymbol.h
Original file line number Diff line number Diff line change
Expand Up @@ -246,15 +246,14 @@ class ESymbol
bool scanELibFunction(unsigned int lpLibStartAddr, unsigned int dwLibCount);
//扫描并识别易语言基础命令
bool scanBasicFunction();
//处理连续省略参数函数
bool handlePushDefaultArgFunc(unsigned int funcAddr);
//加载易语言核心函数
bool loadKrnlInterface(unsigned int lpKrnlEntry);
//加载界面资源信息
bool loadGUIResource(unsigned int lpGUIStart, unsigned int infoSize);
//加载用户导入表
bool loadUserImports(unsigned int dwApiCount, unsigned int lpModuleName, unsigned int lpApiName);

//处理连续省略参数
bool handleFuncPushDefaultArg(unsigned int callAddr);
//扫描易语言类虚表
bool scanEClassTable();
//解析控件基础属性
Expand Down
194 changes: 8 additions & 186 deletions E-Decompiler/Module/CTreeFixer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
#include "../EAppControl/EAppControl.h"
#include "../Utils/Strings.h"
#include <typeinf.hpp>
#include <frame.hpp>

//嗯,现阶段目的是让代码可读化,不是直接到源码,因此没必要在代码转换细节进行过度优化

Expand Down Expand Up @@ -181,181 +182,15 @@ void copyBlock(mblock_t* dst,mblock_t* src)
}
}

// Insert new empty block with attributes copied from src
mblock_t* copyBlockEmpty(mblock_t* src, int insertBefore) {

mblock_t* dst = src->mba->insert_block(insertBefore);

// Copy struct members
dst->flags = src->flags;
dst->start = src->start;
dst->end = src->end;
dst->type = src->type;

// Copy lists
dst->dead_at_start = src->dead_at_start;
dst->mustbuse = src->mustbuse;
dst->maybuse = src->maybuse;
dst->mustbdef = src->mustbdef;
dst->maybdef = src->maybdef;
dst->dnu = src->dnu;

// Copy sval_t
//dst->maxbsp = src->maxbsp;
//dst->minbstkref = src->minbstkref;
//dst->minbargref = src->minbargref;

dst->mark_lists_dirty();
return dst;

}



void debug_testInert(mblock_t* nextBlk)
{
auto addr = nextBlk->head->ea - 0x1;
minsn_t* tmpIns = new minsn_t(addr);
tmpIns->opcode = m_stx;
tmpIns->l.make_reg(0x30, 4);
tmpIns->r.make_reg(0x54, 2);
tmpIns->d.make_reg(0x50, 4);
nextBlk->insert_into_block(tmpIns, 0);

tmpIns = new minsn_t(addr);
tmpIns->opcode = m_mov;
tmpIns->l.make_reg(0x64, 2);
tmpIns->d.make_reg(0x54, 2);
nextBlk->insert_into_block(tmpIns, 0);

tmpIns = new minsn_t(addr);
tmpIns->opcode = m_mov;
tmpIns->l.make_reg(0x18, 4);
tmpIns->d.make_reg(0x50, 4);
nextBlk->insert_into_block(tmpIns, 0);

tmpIns = new minsn_t(addr);
tmpIns->opcode = m_mov;
tmpIns->l.make_reg(0x38, 4);
tmpIns->d.make_reg(0x30, 4);
nextBlk->insert_into_block(tmpIns, 0);

tmpIns = new minsn_t(addr);
tmpIns->opcode = m_mov;
tmpIns->l.make_number(0x0, 4);
tmpIns->d.make_reg(0x38, 4);
nextBlk->insert_into_block(tmpIns, 0);
}

void debug_checkIns(mblock_t* blk)
{
minsn_t* nextIns = blk->head;
while (nextIns != NULL) {
if (nextIns->ea == 0x0401035) {
blk->remove_from_block(nextIns);
}
nextIns = nextIns->next;
}
debug_testInert(blk);
}

void debug_updateIns(mblock_t* blk,minsn_t* updateIns)
{
for (unsigned int n = 0; n < 15; ++n) {
minsn_t* tmpIns = new minsn_t(updateIns->ea + 0x1);
tmpIns->opcode = m_push;
tmpIns->l.make_number(0, 4);
blk->insert_into_block(tmpIns, updateIns);
}
}

void checkBlock(mba_t* mba, mblock_t* blk)
{
auto nextIns = blk->head;
while (nextIns != nullptr) {
if (nextIns->ea == 0x00401016) {
const char* aaa = nextIns->dstr();
debug_updateIns(blk,nextIns);
break;
}
nextIns = nextIns->next;
}

//再遍历一次
nextIns = blk->head;
while (nextIns != nullptr) {
if (nextIns->ea == 0x00401016) {
minsn_t* insToRemove = nextIns;
nextIns = nextIns->next;
blk->remove_from_block(insToRemove);
continue;
}
nextIns = nextIns->next;
}


return;
if (!blk->tail) {
return;
}
if (blk->tail->opcode != m_call) {
return;
}




mblock_t* nextBlk = blk->nextb;
//nextBlk->head->l.make_number(0x12345678, 4);

for (unsigned int n = 0; n < 6; ++n) {
debug_testInert(nextBlk);
continue;
minsn_t* tmpIns = new minsn_t(nextBlk->head->ea);
tmpIns->opcode = m_sub;
tmpIns->l.make_reg(0x18, 4);
tmpIns->r.make_number(4, 4);
tmpIns->d.make_reg(0x18, 4);
nextBlk->insert_into_block(tmpIns, 0);
}

mba->copy_block(blk,nextBlk->serial);
//minsn_t* coreCallIns = blk->tail->prev;
//minsn_t* lastIns = blk->tail->prev;
//while (lastIns != NULL) {
// minsn_t* copyIns = new minsn_t(*lastIns);
// nextBlk->insert_into_block(copyIns, 0);
// lastIns = lastIns->prev;
//}
mba->remove_block(blk);
//nextBlk->build_lists(true);
//nextBlk->maxbsp = nextBlk->maxbsp + 24;

//nextBlk->optimize_block();
//copyBlockEmpty(nextBlk,nextBlk->serial);
//mba->remove_block(nextBlk);
//对于新出来的block
/*mblock_t* newBlock = mba->insert_block(nextBlk->serial);
copyBlock(newBlock, nextBlk);*/

//newBlock->mark_lists_dirty();
return;
}

void tryFixMicroCode(mba_t* mba, ESymbol& symbolTable)
{
mblock_t* startBlock = mba->get_mblock(0);
while (startBlock != NULL) {
checkBlock(mba,startBlock);
startBlock = startBlock->nextb;
}
//mblock_t* startBlock = mba->get_mblock(0);
//while (startBlock != NULL) {
// checkBlock(mba,startBlock);
// startBlock = startBlock->nextb;
//}

mba->tmpstk_size = 0x30;
//mba->fullsize = 0x140;
//mba->stacksize = 0x3c;
//mba->inargoff = 0x40;
//mba->minargref = 0x40;
//mba->spd_adjust = 0x0;
//for (unsigned int n = 0; n < finder.pushArgList.size(); ++n) {
// minsn_t* callIns = finder.pushArgList[n];
// mblock_t* blk = finder.pushBlockList[n];
Expand All @@ -373,6 +208,7 @@ void tryFixMicroCode(mba_t* mba, ESymbol& symbolTable)
//}
}


ssize_t idaapi CTreeFixCallback(void* ud, hexrays_event_t e, va_list va)
{
ESymbol* symbol = (ESymbol*)ud;
Expand All @@ -391,24 +227,11 @@ ssize_t idaapi CTreeFixCallback(void* ud, hexrays_event_t e, va_list va)
case hxe_microcode:
{
mba_t* mba = va_arg(va, mba_t*);
//tryFixMicroCode(mba,*symbol);
//tryFixMicroCode(mba, *symbol);
return 0;
}
break;
case hxe_func_printed:
{
cfunc_t* cfunc = va_arg(va, cfunc_t*);
//strvec_t& svList = cfunc->sv;
//for (unsigned int n = 0; n < svList.size(); ++n) {
// if (svList[n].line.find("ReadProperty") != -1) {
//
// }
//}
//int a = 0;
}
break;
}

return 0;
}

Expand All @@ -420,7 +243,6 @@ CTreeFixer::CTreeFixer(ESymbol& symbol):eSymbol(symbol)

CTreeFixer::~CTreeFixer()
{
mba_t* mba;

}

Expand Down
9 changes: 9 additions & 0 deletions E-Decompiler/Utils/IDAWrapper.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
#include <diskio.hpp>
#include <name.hpp>
#include <typeinf.hpp>
#include <frame.hpp>

void IDAWrapper::show_wait_box(const char* msg)
{
Expand Down Expand Up @@ -77,6 +78,9 @@ void IDAWrapper::msg(const char* format, ...)
bool IDAWrapper::apply_cdecl(unsigned int ea, const char* decl, int flags /*= 0*/)
{
til_t* idati = (til_t*)get_idati();
if (!idati) {
return false;
}
return ::apply_cdecl(idati, ea, decl, flags);
}

Expand All @@ -91,3 +95,8 @@ std::vector<unsigned int> IDAWrapper::getAllCodeXrefAddr(unsigned int addr)
}
return retXrefList;
}

bool IDAWrapper::add_user_stkpnt(unsigned int ea, int delta)
{
return ::add_user_stkpnt(ea,delta);
}
2 changes: 2 additions & 0 deletions E-Decompiler/Utils/IDAWrapper.h
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,6 @@ namespace IDAWrapper{

//获取代码交叉引用地址
std::vector<unsigned int> getAllCodeXrefAddr(unsigned int addr);

bool add_user_stkpnt(unsigned int ea, int delta);
}
3 changes: 2 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,9 @@
反编译核心部分

- [x] 控件的交叉引用,控件事件的展示。
- [ ] 易语言基础特征函数的优化。
- [ ] 易语言基础特征函数的优化、易语言数组操作
- [x] DLL命令调用函数的优化。
- [ ] 错误回调函数的优化。

本项目完全是由个人利用业余时间开发,不定时更新。

Expand Down

0 comments on commit 8639627

Please sign in to comment.