Struct BinaryViewType

Source

pub struct BinaryViewType {
    pub handle: *mut BNBinaryViewType,
}

Expand description

A BinaryViewType acts as a factory for BinaryView objects.

Each file format will have its own type, such as PE, ELF, or Mach-O.

Custom view types can be implemented using CustomBinaryViewType.

Fields§

§handle: *mut BNBinaryViewType

Implementations§

Source §

impl BinaryViewType

Source

pub fn list_all() -> Array<BinaryViewType>

Source

pub fn valid_types_for_data(data: &BinaryView) -> Array<BinaryViewType>

Enumerates all view types and checks to see if the given raw BinaryView is valid, returning only those that are.

Source

pub fn by_name(name: &str) -> Option<Self>

Looks up a binary view type by its name (not the long name).

Source

pub fn name(&self) -> String

The given name for the binary view type.

Source

pub fn long_name(&self) -> String

The given long name for the binary view type.

Source

pub fn register_arch<A: Architecture>( &self, id: u32, endianness: Endianness, arch: &A, )

Register an architecture for selection via the id and endianness.

If you need to peak at the BinaryView to determine the architecture, use BinaryViewType::register_platform_recognizer instead of this.

Source

pub fn register_platform(&self, id: u32, plat: &Platform)

Register a platform for selection via the id.

If you need to peak at the BinaryView to determine the platform, use BinaryViewType::register_platform_recognizer instead of this.

Source

pub fn register_platform_recognizer<R>( &self, id: u32, endian: Endianness, recognizer: R, )
where R: 'static + Fn(&BinaryView, &Metadata) -> Option<Ref<Platform>> + Send + Sync,

Expanded identification of Platform for BinaryViewType’s. Supersedes BinaryViewType::register_arch and BinaryViewType::register_platform, as these have certain edge cases (overloaded elf families, for example) that can’t be represented.

The callback returns a Platform object or None (failure), and most recently added callbacks are called first to allow plugins to override any default behaviors. When a callback returns a platform, architecture will be derived from the identified platform.

The BinaryView is the parent view (usually ‘Raw’) that the BinaryView is being created for. This means that generally speaking, the callbacks need to be aware of the underlying file format. However, the BinaryView implementation may have created data variables in the ‘Raw’ view by the time the callback is invoked. Behavior regarding when this callback is invoked and what has been made available in the BinaryView passed as an argument to the callback is up to the discretion of the BinaryView implementation.

The id ind endian arguments are used as a filter to determine which registered Platform recognizer callbacks are invoked.

Support for this API tentatively requires explicit support in the BinaryView implementation.

Source

pub fn create(&self, data: &BinaryView) -> Result<Ref<BinaryView>, ()>

Creates a new instance of the binary view for this given type, constructed with data as the parent view.

This will also call the initialization routine for the view, after calling this you should be able to use the view as normal and ready to start analysis with BinaryView::update_analysis.

Source

pub fn parse(&self, data: &BinaryView) -> Result<Ref<BinaryView>, ()>

Creates a new instance of the binary view for parsing, this is a “specialize” version of the regular BinaryViewType::create and is expected to be used when you only want to have the view parsed and populated with information required for configuration, like with open with options.

Source

pub fn is_valid_for(&self, data: &BinaryView) -> bool

Is this BinaryViewType valid for the given the raw BinaryView?

Typical implementations will read the magic bytes (e.g. ‘MZ’), this is a performance-sensitive path so prefer inexpensive checks rather than comprehensive ones.

Source

pub fn is_deprecated(&self) -> bool

Is this BinaryViewType deprecated and should not be used?

We specify this such that the view type may still be used by existing databases, but not newly created views.

Source

pub fn is_force_loadable(&self) -> bool

Is this BinaryViewType able to be loaded forcefully?

If so, it will be shown in the drop-down when a user opens a file with options.

Source

pub fn has_no_initial_content(&self) -> bool

Do instances of this BinaryViewType start with no loaded content?

When true, the view has no meaningful default state: the user must make a selection (e.g. load images from a shared cache) before any content exists.

Callers can use this to suppress restoring the previously saved view state for files not being loaded from a database, since a saved layout would reference content that isn’t available on reopening.

Source