Bases: StringRecognizer

__init__(handle: BNStringRecognizer)[source]¶

Parameters:

handle (BNStringRecognizer)

is_valid_for_type(func: HighLevelILFunction, type: Type) → bool[source]¶

Determines if the string recognizer should be called for the given expression type. It is optional to override this method. If the method isn’t overridden, all expression types are passed to the string recognizer.

Parameters:

• func (HighLevelILFunction) – HighLevelILFunction representing the high level function to be queried

• type (Type) – Type of the expression

Returns:

True if the expression should be passed to the string recognizer, False otherwise

Return type:

bool

recognize_constant(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for a constant that is not a pointer. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_constant_data(instr: HighLevelILInstruction) → DerivedString | None[source]¶

Can be overridden to recognize strings for constant data expressions (HLIL_CONST_DATA). These expressions are generated by the outline resolver when it recovers constant data streams from scattered stores. The instruction provides access to the data buffer and builtin type via its constant_data accessor.

If a string is found, return a DerivedString with the string information.

Parameters:

instr (HighLevelILInstruction) – High level expression containing the constant data

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_constant_pointer(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for a constant pointer. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_extern_pointer(instr: HighLevelILInstruction, type: Type, val: int, offset: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for an external symbol. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

• offset (int) – Offset into the external symbol

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_import(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for an imported symbol. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_struct_init(instr: HighLevelILInstruction, type: Type, vals: Dict[int, int]) → DerivedString | None[source]¶

Can be overridden to recognize strings for a structure initializer expression (HLIL_STRUCT_INIT). These are produced when the optimizer folds a run of structure field assignments into a single initializer. This is only called when all fields of the structure are assigned constants. The vals dictionary maps each field’s byte offset within the structure to the constant value assigned to that field. If no string is found, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level structure initializer expression

• type (Type) – Structure type of the initializer

• vals (Dict[int, int]) – Dictionary mapping field offset to the constant value assigned to that field

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

Bases: object

Represents a custom string type. String types contain the name of the string type and the prefix and postfix used to render them in code.

__init__(handle)[source]¶

static register(name: str, string_prefix='', string_postfix='') → CustomStringType[source]¶

Registers a new custom string type. This can be used when creating new DerivedString objects.

Parameters:

name (str)

Return type:

CustomStringType

property name: str¶

Name of the custom string type.

property string_postfix: str¶

Postfix added after the closing quote in a custom string.

property string_prefix: str¶

Prefix added before the opening quote in a custom string.

Bases: object

class StringRecognizer recognizes custom strings found in high level expressions.

The recognize_constant, recognize_constant_pointer, recognize_extern_pointer, and recognize_import methods will be called for the respective expression types. These methods can return a DerivedString containing the string information if a custom string is found for the expression. The is_valid_for_type method can be optionally overridden to call the recognizer methods only when the expression type matches a custom filter.

__init__(handle=None)[source]¶

is_valid_for_type(func: HighLevelILFunction, type: Type) → bool[source]¶

Determines if the string recognizer should be called for the given expression type. It is optional to override this method. If the method isn’t overridden, all expression types are passed to the string recognizer.

Parameters:

• func (HighLevelILFunction) – HighLevelILFunction representing the high level function to be queried

• type (Type) – Type of the expression

Returns:

True if the expression should be passed to the string recognizer, False otherwise

Return type:

bool

recognize_constant(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for a constant that is not a pointer. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_constant_data(instr: HighLevelILInstruction) → DerivedString | None[source]¶

Can be overridden to recognize strings for constant data expressions (HLIL_CONST_DATA). These expressions are generated by the outline resolver when it recovers constant data streams from scattered stores. The instruction provides access to the data buffer and builtin type via its constant_data accessor.

If a string is found, return a DerivedString with the string information.

Parameters:

instr (HighLevelILInstruction) – High level expression containing the constant data

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_constant_pointer(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for a constant pointer. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_extern_pointer(instr: HighLevelILInstruction, type: Type, val: int, offset: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for an external symbol. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

• offset (int) – Offset into the external symbol

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_import(instr: HighLevelILInstruction, type: Type, val: int) → DerivedString | None[source]¶

Can be overridden to recognize strings for an imported symbol. The expression type and value of the expression are given. If no string is found for this expression, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level expression

• type (Type) – Type of the expression

• val (int) – Value of the expression

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

recognize_struct_init(instr: HighLevelILInstruction, type: Type, vals: Dict[int, int]) → DerivedString | None[source]¶

Can be overridden to recognize strings for a structure initializer expression (HLIL_STRUCT_INIT). These are produced when the optimizer folds a run of structure field assignments into a single initializer. This is only called when all fields of the structure are assigned constants. The vals dictionary maps each field’s byte offset within the structure to the constant value assigned to that field. If no string is found, this method should return None.

If a string is found, return a DerivedString with the string information.

Parameters:

• instr (HighLevelILInstruction) – High level structure initializer expression

• type (Type) – Structure type of the initializer

• vals (Dict[int, int]) – Dictionary mapping field offset to the constant value assigned to that field

Returns:

Optional DerivedString for any string that is found.

Return type:

DerivedString | None

register()[source]¶

Registers the string recognizer.

property name: str¶

recognizer_name = None¶