Class BpsTransformationEngine

java.lang.Object
ghidra.util.bytesearch.bytepatternsearch.BpsTransformationEngine
public class BpsTransformationEngine extends Object
This class performs byte pattern transformations in support of Ghidra's Byte Pattern Search capability.

The design of the Byte pattern Searcher and its supporting sub-capabilities and classes can be found in the "Search For Byte Patterns" page in the help viewer.

This transformer is used to prepare byte patterns parsed by the BpsXmlParser and populated in BpsSearchItem objects, prior to submitting them for search.

Supported transformations are as follows:

  • Little Endian - Reverse a big Endian byte array. This is determined either programmatically based on the program's endianness or is user-controlled.
  • Byte Splitting - If the pattern's word size is larger than the program's word boundary, split the pattern to fit the boundary. This is determined programmatically and is not user-controlled.
  • Byte Zero-Padding - If the pattern's word size is smaller than the program's word boundary, zero-pad the byte pattern to fit the program's word boundary. The decision to extend bytes is user-controlled.

A skip list is used to allow users to skip patterns at the BpsSearch and BpsSearchItem level.

  • Constructor Details

    • BpsTransformationEngine

      public BpsTransformationEngine()

  • Method Details

    • createPatterns

      public List<BpsPattern> createPatterns(List<BpsSearch> searchLibrary, ghidra.util.bytesearch.bytepatternsearch.BpsConfig config)
      Process an entire search library parsed by BpsXmlParser and populated in BpsSearch and BpsSearchItem objects in preparation for search submission.
      Parameters:
      searchLibrary - collection of search objects
      config - search preferences from user input and program details
      Returns:
      All patterns prepared for search submission

    • createPatterns

      public List<BpsPattern> createPatterns(List<BpsSearch> searchLibrary, Set<String> skipIds, ghidra.util.bytesearch.bytepatternsearch.BpsConfig config)
      Process an entire search library parsed by BpsXmlParser and populated in BpsSearch and BpsSearchItem objects in preparation for search submission.

      Skip over any patterns whose id's are included in a skip list.

      Parameters:
      searchLibrary - collection of search objects
      skipIds - list of BpsSearch and/or BpsSearchItem id's to skip over
      config - search preferences from user input and program details
      Returns:
      All patterns prepared for search submission