Package ghidra.util.bytesearch

Class PatternPairSet

java.lang.Object
ghidra.util.bytesearch.PatternPairSet
public class PatternPairSet extends Object
A set of "pre" DittedBitSequences and a set of "post" Patterns are paired to form a larger pattern. To match, a sequence from the "pre" sequence set must first match, then one of the "post" patterns is matched relative to the matching "pre" pattern. This class is really a storage object for the patterns and provides a mechanism to read the pre/post patterns from an XML file.

The larger pattern has the idea of bits of check, which means the number of bits that are fixed to a value when matching (not don't care). There is a pre pattern bits of check and post pattern bits of check. The bits of check are used to statistically gauge the accuracy of the pattern.

An example of the XML format follows: 

 
 <patternpairs totalbits="32" postbits="16">
   <prepatterns>
     <data>0xe12fff1.                  </data>
     <data>0xe12fff1e 0x46c0           </data>
     <data>0xe12fff1e 0xe1a00000       </data>
   </prepatterns>
    
   <postpatterns>
     <data> 0xe24dd...                              11101001 00101101 .1...... ....0000  </data>
     <data> 11101001 00101101 .1...... ....0000     0xe24dd...                           </data>
     <data> 11101001 00101101 .1...... ....0000     0x........ 0xe24dd...                </data>
     <align mark="0" bits="3"/>
     <setcontext name="TMode" value="0"/>
     <funcstart/>
   </postpatterns>
 </patternpairs>
Note: The post Patterns can also have a set of rules that must be satisfied along with one of the Pattern DittedBitSequence matches.

  • Constructor Details

    • PatternPairSet

      public PatternPairSet()
      Construct an empty PatternPairSet. Use XML to initialize the pattern sets.

  • Method Details

    • createFinalPatterns

      public void createFinalPatterns(ArrayList<Pattern> finalpats)

    • extractPostPatterns

      public void extractPostPatterns(ArrayList<Pattern> postpats)
      Add this PatternPairSets post patterns to an existing arraylist of patterns.
      Parameters:
      postpats - array to add this PatternPairSets post patterns into

    • restoreXml

      public void restoreXml(XmlPullParser parser, PatternFactory pfactory) throws IOException
      Restore PatternPairSet from XML pull parser
      Parameters:
      parser - XML pull parser
      pfactory - pattern factory user to construct patterns
      Throws:
      IOException - if pull parsing fails

    • getPreSequences

      public ArrayList<DittedBitSequence> getPreSequences()
      Get the "pre" parts of the patterns
      Returns:
      pre sequences

    • getPostPatterns

      public ArrayList<Pattern> getPostPatterns()
      Get the "post" parts of the patterns
      Returns:
      post patterns

    • getPostBitsOfCheck

      public int getPostBitsOfCheck()
      Get the required number of fixed bits after the prepattern
      Returns:
      number of post bits

    • getTotalBitsOfCheck

      public int getTotalBitsOfCheck()
      Get the required number of fixed bits in the whole pattern
      Returns:
      number of total fixed bits