Add API to recognize strings from constant structure initializers

Author: D0ntPanic

binaryninjaapi.h

@@ -23303,6 +23303,22 @@ namespace BinaryNinja {
 		virtual std::optional<DerivedString> RecognizeConstantData(
 			const HighLevelILInstruction& instr);
 
+		/*! Can be overridden to recognize strings for a structure initializer expression
+			(HLIL_STRUCT_INIT). These are produced when the optimizer folds a run of structure field
+			assignments into a single initializer. This is only called when all fields of the
+			structure are assigned constants. The \c values map provides the constant value
+			assigned to each field, keyed by the field's byte offset within the structure.
+
+			If a string is found, return a \c DerivedString with the string information.
+
+		    \param instr High level structure initializer expression
+		    \param type Structure type of the initializer
+		    \param values Map from field offset to the constant value assigned to that field
+		    \return Optional \c DerivedString for any string that is found
+		*/
+		virtual std::optional<DerivedString> RecognizeStructInit(
+			const HighLevelILInstruction& instr, Type* type, const std::map<uint64_t, int64_t>& values);
+
 		/*! Registers the string recognizer.
 
 		    \param recognizer The string recognizer to register.
@@ -23324,6 +23340,8 @@ namespace BinaryNinja {
 			void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNType* type, int64_t val, BNDerivedString* result);
 		static bool RecognizeConstantDataCallback(
 			void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNDerivedString* result);
+		static bool RecognizeStructInitCallback(void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNType* type,
+			const uint64_t* fieldOffsets, const int64_t* fieldValues, size_t fieldCount, BNDerivedString* result);
 	};
 
 	class CoreStringRecognizer : public StringRecognizer
@@ -23341,6 +23359,8 @@ namespace BinaryNinja {
 			const HighLevelILInstruction& instr, Type* type, int64_t val) override;
 		std::optional<DerivedString> RecognizeConstantData(
 			const HighLevelILInstruction& instr) override;
+		std::optional<DerivedString> RecognizeStructInit(
+			const HighLevelILInstruction& instr, Type* type, const std::map<uint64_t, int64_t>& values) override;
 	};
 }  // namespace BinaryNinja
 

binaryninjacore.h

@@ -4241,6 +4241,8 @@ extern "C"
 			void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNType* type, int64_t val, BNDerivedString* result);
 		bool (*recognizeConstantData)(
 			void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNDerivedString* result);
+		bool (*recognizeStructInit)(void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNType* type,
+			const uint64_t* fieldOffsets, const int64_t* fieldValues, size_t fieldCount, BNDerivedString* result);
 	} BNCustomStringRecognizer;
 
 	typedef struct BNCustomStringTypeInfo
@@ -9409,6 +9411,9 @@ extern "C"
 		size_t exprIndex, BNType* type, int64_t val, BNDerivedString* out);
 	BINARYNINJACOREAPI bool BNStringRecognizerRecognizeConstantData(BNStringRecognizer* recognizer,
 		BNHighLevelILFunction* il, size_t exprIndex, BNDerivedString* out);
+	BINARYNINJACOREAPI bool BNStringRecognizerRecognizeStructInit(BNStringRecognizer* recognizer,
+		BNHighLevelILFunction* il, size_t exprIndex, BNType* type, const uint64_t* fieldOffsets,
+		const int64_t* fieldValues, size_t fieldCount, BNDerivedString* out);
 
 	// PossibleValueSet operations
 	BINARYNINJACOREAPI void BNFreePossibleValueSet(BNPossibleValueSet* object);

lang/c/pseudoc.cpp

@@ -3053,6 +3053,17 @@ void PseudoCFunction::GetExprTextInternal(const HighLevelILInstruction& instr, H
 	case HLIL_STRUCT_INIT:
 		[&]() {
 			const auto hlilFunc = GetHighLevelILFunction();
+			auto str = hlilFunc->GetDerivedStringReferenceForExpr(instr.exprIndex);
+			if (str.has_value() && str.value().customType)
+			{
+				tokens.Append(BraceToken, str.value().customType->GetStringPrefix() + string("\""));
+				tokens.Append(StringToken, DerivedStringReferenceTokenContext,
+					DataBuffer(str.value().value.c_str(), str.value().value.size()).ToEscapedString(), instr.address,
+					instr.exprIndex);
+				tokens.Append(BraceToken, string("\"") + str.value().customType->GetStringPostfix());
+				return;
+			}
+
 			auto type = instr.GetType();
 			if (type.GetValue())
 			{

lang/rust/pseudorust.cpp

@@ -2964,6 +2964,17 @@ void PseudoRustFunction::GetExprText(const HighLevelILInstruction& instr, HighLe
 	case HLIL_STRUCT_INIT:
 		[&]() {
 			const auto hlilFunc = GetHighLevelILFunction();
+			auto str = hlilFunc->GetDerivedStringReferenceForExpr(instr.exprIndex);
+			if (str.has_value() && str.value().customType)
+			{
+				tokens.Append(BraceToken, str.value().customType->GetStringPrefix() + string("\""));
+				tokens.Append(StringToken, DerivedStringReferenceTokenContext,
+					DataBuffer(str.value().value.c_str(), str.value().value.size()).ToEscapedString(), instr.address,
+					instr.exprIndex);
+				tokens.Append(BraceToken, string("\"") + str.value().customType->GetStringPostfix());
+				return;
+			}
+
 			auto type = instr.GetType();
 			if (type.GetValue())
 			{

python/examples/pseudo_python.py

@@ -24,7 +24,7 @@
                          HighLevelILTokenEmitter, HighLevelILOperation, OperatorPrecedence, ScopeType,
                          SymbolDisplayType, SymbolDisplayResult, SymbolType, BoolType, VoidType, PointerType,
                          NamedTypeReferenceType, StructureType, InstructionTextTokenContext, StructureMember,
-                         BinaryView, BuiltinType)
+                         BinaryView, BuiltinType, DataBuffer)
 from typing import Optional
 import struct
 
@@ -1166,6 +1166,19 @@ def perform_get_expr_text(
                 self.perform_get_expr_text(instr.low, tokens, settings)
                 tokens.append_close_paren()
             elif instr.operation == HighLevelILOperation.HLIL_STRUCT_INIT:
+                # Check for a recognized string before rendering as a structure initializer
+                derived_string = instr.derived_string_reference
+                if derived_string is not None and derived_string.custom_type is not None:
+                    prefix = derived_string.custom_type.string_prefix
+                    postfix = derived_string.custom_type.string_postfix
+                    tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, f'{prefix}"'))
+                    tokens.append(InstructionTextToken(InstructionTextTokenType.StringToken,
+                        DataBuffer(bytes(derived_string.value)).escape(),
+                        address=instr.address, value=instr.expr_index,
+                        context=InstructionTextTokenContext.DerivedStringReferenceTokenContext))
+                    tokens.append(InstructionTextToken(InstructionTextTokenType.BraceToken, f'"{postfix}'))
+                    return
+
                 # Render the structure type if it is known, otherwise just the `struct` keyword. Use
                 # Python-style constructor syntax for the initializer.
                 struct_type = instr.expr_type

python/stringrecognizer.py

@@ -18,7 +18,7 @@
 # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 # IN THE SOFTWARE.
 
-from typing import Optional, Union, Any
+from typing import Optional, Union, Any, Dict
 from dataclasses import dataclass
 import ctypes
 
@@ -198,6 +198,8 @@ def register(self):
 		if self.recognize_constant_data.__func__ != StringRecognizer.recognize_constant_data:
 			self._cb.recognizeConstantData = self._cb.recognizeConstantData.__class__(
 				self._recognize_constant_data)
+		if self.recognize_struct_init.__func__ != StringRecognizer.recognize_struct_init:
+			self._cb.recognizeStructInit = self._cb.recognizeStructInit.__class__(self._recognize_struct_init)
 		self.handle = core.BNRegisterStringRecognizer(self.__class__.recognizer_name, self._cb)
 		self.__class__._registered_recognizers.append(self)
 
@@ -279,6 +281,21 @@ def _recognize_constant_data(self, ctxt, hlil, expr, result):
 			log_error_for_exception("Unhandled Python exception in StringRecognizer._recognize_constant_data")
 			return False
 
+	def _recognize_struct_init(self, ctxt, hlil, expr, type, field_offsets, field_values, field_count, result):
+		try:
+			hlil = highlevelil.HighLevelILFunction(handle=core.BNNewHighLevelILFunctionReference(hlil))
+			type = types.Type.create(handle=core.BNNewTypeReference(type))
+			instr = hlil.get_expr(highlevelil.ExpressionIndex(expr))
+			vals = {field_offsets[i]: field_values[i] for i in range(field_count)}
+			ref = self.recognize_struct_init(instr, type, vals)
+			if ref is None:
+				return False
+			result[0] = ref._to_core_struct(True)
+			return True
+		except Exception:
+			log_error_for_exception("Unhandled Python exception in StringRecognizer._recognize_struct_init")
+			return False
+
 	@property
 	def name(self) -> str:
 		if hasattr(self, 'handle'):
@@ -379,6 +396,25 @@ def recognize_constant_data(
 		"""
 		return None
 
+	def recognize_struct_init(
+		self, instr: 'highlevelil.HighLevelILInstruction', type: 'types.Type', vals: Dict[int, int]
+	) -> Optional['binaryview.DerivedString']:
+		"""
+		Can be overridden to recognize strings for a structure initializer expression (HLIL_STRUCT_INIT).
+		These are produced when the optimizer folds a run of structure field assignments into a single
+		initializer. This is only called when all fields of the structure are assigned constants.
+		The ``vals`` dictionary maps each field's byte offset within the structure to the constant value
+		assigned to that field. If no string is found, this method should return `None`.
+
+		If a string is found, return a :py:class:`~binaryninja.binaryview.DerivedString` with the string information.
+
+		:param instr: High level structure initializer expression
+		:param type: Structure type of the initializer
+		:param vals: Dictionary mapping field offset to the constant value assigned to that field
+		:return: Optional :py:class:`~binaryninja.binaryview.DerivedString` for any string that is found.
+		"""
+		return None
+
 
 _recognizer_cache = {}
 
@@ -442,3 +478,17 @@ def recognize_constant_data(
 		if not core.BNStringRecognizerRecognizeConstantData(self.handle, instr.function.handle, instr.expr_index, string):
 			return None
 		return binaryview.DerivedString._from_core_struct(string, True)
+
+	def recognize_struct_init(
+		self, instr: 'highlevelil.HighLevelILInstruction', type: 'types.Type', vals: Dict[int, int]
+	) -> Optional['binaryview.DerivedString']:
+		count = len(vals)
+		field_offsets = (ctypes.c_ulonglong * count)()
+		field_values = (ctypes.c_longlong * count)()
+		for i, (offset, value) in enumerate(vals.items()):
+			field_offsets[i] = offset
+			field_values[i] = value
+		string = core.BNDerivedString()
+		if not core.BNStringRecognizerRecognizeStructInit(self.handle, instr.function.handle, instr.expr_index, type.handle, field_offsets, field_values, count, string):
+			return None
+		return binaryview.DerivedString._from_core_struct(string, True)

stringrecognizer.cpp

@@ -142,6 +142,13 @@ std::optional<DerivedString> StringRecognizer::RecognizeConstantData(const HighL
 }
 
 
+std::optional<DerivedString> StringRecognizer::RecognizeStructInit(
+	const HighLevelILInstruction&, Type*, const std::map<uint64_t, int64_t>&)
+{
+	return std::nullopt;
+}
+
+
 void StringRecognizer::Register(StringRecognizer* recognizer)
 {
 	BNCustomStringRecognizer callbacks;
@@ -152,6 +159,7 @@ void StringRecognizer::Register(StringRecognizer* recognizer)
 	callbacks.recognizeExternPointer = RecognizeExternPointerCallback;
 	callbacks.recognizeImport = RecognizeImportCallback;
 	callbacks.recognizeConstantData = RecognizeConstantDataCallback;
+	callbacks.recognizeStructInit = RecognizeStructInitCallback;
 
 	recognizer->AddRefForRegistration();
 	recognizer->m_object = BNRegisterStringRecognizer(recognizer->m_nameForRegister.c_str(), &callbacks);
@@ -241,6 +249,24 @@ bool StringRecognizer::RecognizeConstantDataCallback(
 }
 
 
+bool StringRecognizer::RecognizeStructInitCallback(void* ctxt, BNHighLevelILFunction* hlil, size_t expr, BNType* type,
+	const uint64_t* fieldOffsets, const int64_t* fieldValues, size_t fieldCount, BNDerivedString* result)
+{
+	StringRecognizer* recognizer = (StringRecognizer*)ctxt;
+	Ref<HighLevelILFunction> hlilObj = new HighLevelILFunction(BNNewHighLevelILFunctionReference(hlil));
+	HighLevelILInstruction instr = hlilObj->GetExpr(expr);
+	Ref<Type> typeObj = new Type(BNNewTypeReference(type));
+	std::map<uint64_t, int64_t> values;
+	for (size_t i = 0; i < fieldCount; i++)
+		values.emplace(fieldOffsets[i], fieldValues[i]);
+	auto str = recognizer->RecognizeStructInit(instr, typeObj, values);
+	if (!str.has_value())
+		return false;
+	*result = str->ToAPIObject(true);
+	return true;
+}
+
+
 Ref<StringRecognizer> StringRecognizer::GetByName(const std::string& name)
 {
 	BNStringRecognizer* recognizer = BNGetStringRecognizerByName(name.c_str());
@@ -329,3 +355,24 @@ std::optional<DerivedString> CoreStringRecognizer::RecognizeConstantData(
 		return std::nullopt;
 	return DerivedString::FromAPIObject(&str, true);
 }
+
+
+std::optional<DerivedString> CoreStringRecognizer::RecognizeStructInit(
+	const HighLevelILInstruction& instr, Type* type, const std::map<uint64_t, int64_t>& values)
+{
+	std::vector<uint64_t> fieldOffsets;
+	std::vector<int64_t> fieldValues;
+	fieldOffsets.reserve(values.size());
+	fieldValues.reserve(values.size());
+	for (auto [offset, value] : values)
+	{
+		fieldOffsets.push_back(offset);
+		fieldValues.push_back(value);
+	}
+
+	BNDerivedString str;
+	if (!BNStringRecognizerRecognizeStructInit(m_object, instr.function->GetObject(), instr.exprIndex,
+		type->GetObject(), fieldOffsets.data(), fieldValues.data(), values.size(), &str))
+		return std::nullopt;
+	return DerivedString::FromAPIObject(&str, true);
+}