MCPcopy Create free account
hub / github.com/KasperskyLab/hrtng / getString

Method getString

src/appcall.cpp:376–447  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

374}
375
376bool Appcaller::getString(idc_value_t &r, qstring *decodedStr, qstring &error)
377{
378 switch(r.vtype) {
379 case VT_LONG:
380 case VT_INT64:
381 {
382 ea_t ea = r.vtype == VT_LONG ? r.num : (ea_t)r.i64;
383#if DEBUG_AC
384 Log(llFlood, "getString VT_LONG/VT_INT64 %a\n", ea);
385#endif //DEBUG_AC
386 if(is_mapped(ea)) {
387 if(resDisp != acsdArray) { //acsdAuto || acsdPointer
388 ea_t ea2 = get_ea(ea);
389 if(is_mapped(ea2)) {
390 if(getStringFromMem(ea2, decodedStr, strtype, resDisp == acsdAuto))
391 return true;
392 }
393 }
394 if(resDisp != acsdPointer) { //acsdAuto || acsdArray
395 if(getStringFromMem(ea, decodedStr, strtype, resDisp == acsdAuto))
396 return true;
397 }
398 }
399 error.cat_sprnt(" can't get string from %a, try to change type of expected string to void*", ea);
400 return false;
401 }
402 case VT_STR:
403 {
404#if DEBUG_AC
405 Log(llFlood, "getString VT_STR %d '%s'\n", r.qstr().length(), r.c_str());
406#endif //DEBUG_AC
407 if(resDisp != acsdArray && r.qstr().size() >= ea_size) { //acsdAuto || acsdPointer
408 ea_t ea2 = *(ea_t*)r.qstr().begin();
409 if(is_mapped(ea2)) {
410 if(getStringFromMem(ea2, decodedStr, strtype, resDisp == acsdAuto))
411 return true;
412 }
413 }
414 if(resDisp != acsdPointer) { //acsdAuto || acsdArray
415 if(getStringFromBuf(r.qstr().begin(), (int)r.qstr().size(), decodedStr, strtype, resDisp == acsdAuto))
416 return true;
417 }
418 if(strtype == STRTYPE_C_16)
419 return utf16_utf8(decodedStr, (const wchar16_t *)r.qstr().begin());
420 else
421 *decodedStr = r.qstr();
422 return true;
423 }
424 case VT_REF:
425 {
426#if DEBUG_AC
427 Log(llFlood, "getString VT_REF \n");
428#endif //DEBUG_AC
429 idc_value_t *v = deref_idcv(&r, VREF_ONCE);
430 bool ret = getString(*v, decodedStr, error);
431
432 //make advice
433 if(ret && !strlen(decodedStr->c_str()) && resArgNum > 0 /*&& resArgNum < fi.size()*/) {

Callers

nothing calls this directly

Calls 6

LogFunction · 0.85
getStringFromMemFunction · 0.85
getStringFromBufFunction · 0.85
sizeMethod · 0.80
beginMethod · 0.80
get_eaFunction · 0.70

Tested by

no test coverage detected