Package ghidra.util.bytesearch

Class Pattern

java.lang.Object

ghidra.util.bytesearch.DittedBitSequence

ghidra.util.bytesearch.Pattern

All Implemented Interfaces:

BytePattern

Direct Known Subclasses:

GenericByteSequencePattern

public class Pattern
extends DittedBitSequence

Pattern is an association of a DittedBitSequence to match, a set of post rules after a match is found that must be satisfied, and a set of actions to be taken if the pattern matches. These patterns can be restored from an XML file.

Field Summary

Fields inherited from class ghidra.util.bytesearch.DittedBitSequence

popcount

Constructor Summary

Constructors

Change	Constructor	Description
	Pattern()	Construct an empty pattern.
	Pattern(DittedBitSequence seq, int offset, PostRule[] postArray, MatchAction[] matchArray)	Construct the pattern based on a DittedByteSequence a match offset, post matching rules, and a set of actions to take when the match occurs.

Method Summary

Change	Modifier and Type	Method	Description
NEW	boolean	checkPostRules(long offset)	Check that the possible post rules are satisfied
	int	getMarkOffset()
	MatchAction[]	getMatchActions()
	PostRule[]	getPostRules()
NEW	int	getPreSequenceLength()	Returns the number of bytes in this pattern that represent a pre-sequence that must match before the official start of the matching pattern.
	static void	readPatterns(ResourceFile file, ArrayList<Pattern> patlist, PatternFactory pfactory)	Read patterns from specified file
	static void	readPostPatterns(File file, ArrayList<Pattern> patternList, PatternFactory pfactory)	Read just the post patterns from the <patternpair> tags
	void	restoreXml(XmlPullParser parser, PatternFactory pfactory)
	static void	restoreXmlAttributes(ArrayList<PostRule> postrulelist, ArrayList<MatchAction> actionlist, XmlPullParser parser, PatternFactory pfactory)	Restore the PostRule and the MatchAction tags
	void	setMatchActions(MatchAction[] actions)

Methods inherited from class ghidra.util.bytesearch.DittedBitSequence

concatenate, equals, getHexString, getIndex, getMaskBytes, getNumFixedBits, getNumInitialFixedBits, getNumUncertainBits, getSize, getValueBytes, hashCode, isMatch, restoreXmlData, setIndex, toString, writeBits

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Details

Pattern

public Pattern()

Construct an empty pattern. Use XML to initialize

Pattern

public Pattern(DittedBitSequence seq,
 int offset,
 PostRule[] postArray,
 MatchAction[] matchArray)

Construct the pattern based on a DittedByteSequence a match offset, post matching rules, and a set of actions to take when the match occurs.

Parameters:

seq - DittedByteSequence

offset - offset from the actual match location to report a match

postArray - post set of rules to check for the match

matchArray - MatchActions to apply when a match occurs

Method Details

getPostRules

public PostRule[] getPostRules()

getMatchActions

public MatchAction[] getMatchActions()

setMatchActions

public void setMatchActions(MatchAction[] actions)

getMarkOffset

public int getMarkOffset()

restoreXmlAttributes

public static void restoreXmlAttributes(ArrayList<PostRule> postrulelist,
 ArrayList<MatchAction> actionlist,
 XmlPullParser parser,
 PatternFactory pfactory)
                                 throws IOException

Restore the PostRule and the MatchAction tags

Parameters:

parser - is the parser at the start of tags

pfactory - is the factory for the PostRule and MatchAction objects

Throws:

IOException

restoreXml

public void restoreXml(XmlPullParser parser,
 PatternFactory pfactory)
                throws IOException

Throws:

IOException

readPatterns

public static void readPatterns(ResourceFile file,
 ArrayList<Pattern> patlist,
 PatternFactory pfactory)
                         throws SAXException,
IOException

Read patterns from specified file

Parameters:

file - pattern file

patlist - list for patterns to be added to

pfactory - optional factory for use in parsing PostRule and MatchAction elements. If null such elements may not be present.

Throws:

SAXException

IOException

readPostPatterns

public static void readPostPatterns(File file,
 ArrayList<Pattern> patternList,
 PatternFactory pfactory)
                             throws SAXException,
IOException

Read just the post patterns from the <patternpair> tags

Parameters:

file - is the file to read from

patternList - collects the resulting Pattern objects

pfactory - is the factory for constructing postrules and matchactions

Throws:

IOException

SAXException

checkPostRules NEW

public boolean checkPostRules(long offset)

Check that the possible post rules are satisfied

Parameters:

offset - offset in stream to check postrules.

Returns:

true if post rules are satisfied

getPreSequenceLength NEW

public int getPreSequenceLength()

Description copied from interface: BytePattern

Returns the number of bytes in this pattern that represent a pre-sequence that must match before the official start of the matching pattern. For example if looking for a pattern of "abcd", but only if it follows "xyz", then the pattern would be "xyzabcd", with a pre sequence length of 3. So when this pattern matches, we want the "match to be at the position where the "a" is and not the "x". This is know as "look behind" when using regular expressions.

Specified by:

getPreSequenceLength in interface BytePattern

Overrides:

getPreSequenceLength in class DittedBitSequence

Returns:

the number of bytes in the pattern that represent a required pre sequence before the actual pattern we want to find the position of