library/src/blockclass/subclasses/BP_CommandLineOptionParser.cc
// Runs a buffer analysis (as found in BP-BufferAnalysis.h) against a provided buffer.  This allows
// the ability to generate statistics about any given string argument.  This is run before
// any argument parsing occurs, and the result is stored within the tokens value_buff_analysis member
// pointer.
Runs a buffer analysis (as found in BP-BufferAnalysis.h) against a provided buffer.  This allows
the ability to generate statistics about any given string argument.  This is run before
any argument parsing occurs, and the result is stored within the tokens value_buff_analysis member
pointer.
Runs a buffer analysis ( as found in BP - BufferAnalysis . h ) against a provided buffer . This allows the ability to generate statistics about any given string argument . This is run before any argument parsing occurs and the result is stored within the tokens value_buff_analysis member pointer .
BP_ERROR_T BP_CommandLineOptionParser::runBufferAnalysisAgainstTokenValue(unsigned char * buffer, size_t buff_len, P_BP_COMMAND_LINE_PARSER_TOKENS token)
{
	if(!buffer || !buff_len || !token)
		return ERR_FAILURE;
	if(token->value_buff_analysis)
	{
		BP_DestroyBufferAnalysis(token->value_buff_analysis);
		token->value_buff_analysis = NULL;
		token->value_contains_backticks              = false;
		token->value_contains_nonprintables          = false;
		token->value_contains_embedded_single_quotes = false;
		token->value_contains_embedded_double_quotes = false;
		token->value_contains_a_positive_number      = false;
		token->value_contains_a_negative_number      = false;
	}
	token->ascii_analysis_configuration.count_ascii                 = BP_TRUE;
	token->ascii_analysis_configuration.count_extended              = BP_TRUE;
	token->ascii_analysis_configuration.count_individual_characters = BP_TRUE;
	token->value_buff_analysis = BP_CreateBufferAnalysis
	(
		(unsigned char *) buffer,
		(size_t)          buff_len,
		&token->ascii_analysis_configuration
	);
	if(!token->value_buff_analysis)
		return ERR_FAILURE;
	if(token->value_buff_analysis->ascii->char_counts['`'])
		token->value_contains_backticks = true;
	if(token->value_buff_analysis->ascii->char_counts['\''])
		token->value_contains_embedded_single_quotes = true;
	if(token->value_buff_analysis->ascii->char_counts['"'])
		token->value_contains_embedded_double_quotes = true;
	if
	(
		token->value_buff_analysis->ascii->ascii_char_flag_counts.extended_n     ||
		token->value_buff_analysis->ascii->ascii_char_flag_counts.nonprintable_n ||
		token->value_buff_analysis->ascii->ascii_char_flag_counts.control_n
	)
	{
		token->value_contains_nonprintables = true;
	}
	if(token->value_buff_analysis->ascii->ascii_char_flag_counts.number_n == strnlen((char *) buffer, buff_len))
		token->value_contains_a_positive_number = true;
	if(buffer[0] == '-')
	if(token->value_buff_analysis->ascii->ascii_char_flag_counts.number_n == (strnlen((char *) buffer, buff_len)-1))
		token->value_contains_a_negative_number = true;
    BP_ASCII_CHAR_FLAGS positive_flags;
    BP_ZERO_STACK(positive_flags);
    BP_ASCII_CHAR_FLAGS negative_flags;
    BP_ZERO_STACK(negative_flags);
    positive_flags.is_printable = BP_TRUE;
    negative_flags.is_extended     = BP_TRUE;
    negative_flags.is_control      = BP_TRUE;
    negative_flags.is_nonprintable = BP_TRUE;
    BP_ExtractASCIIStringsFromAnalyzedBuffer
    (
    		token->value_buff_analysis,
            &positive_flags,
            BP_ASCII_CHAR_SEARCH_ALL_SEARCH_FLAG_CONDITIONS_MET,
            &negative_flags,
            BP_ASCII_CHAR_SEARCH_ALL_SEARCH_FLAG_CONDITIONS_MET_NEGATIVELY,
            NULL,
            0,
            NULL,
            0,
            8
    );
    BP_RunSecondaryStringAnalysisOnExtractedStrings(token->value_buff_analysis);
	return ERR_SUCCESS;
}
BP_ERROR_T BP_CommandLineOptionParser :: runBufferAnalysisAgainstTokenValue ( unsigned char * buffer , size_t buff_len , P_BP_COMMAND_LINE_PARSER_TOKENS token ) { if ( ! buffer || ! buff_len || ! token ) return ERR_FAILURE ; if ( token -> value_buff_analysis ) { BP_DestroyBufferAnalysis ( token -> value_buff_analysis ) ; token -> value_buff_analysis = NULL ; token -> value_contains_backticks = false ; token -> value_contains_nonprintables = false ; token -> value_contains_embedded_single_quotes = false ; token -> value_contains_embedded_double_quotes = false ; token -> value_contains_a_positive_number = false ; token -> value_contains_a_negative_number = false ; } token -> ascii_analysis_configuration . count_ascii = BP_TRUE ; token -> ascii_analysis_configuration . count_extended = BP_TRUE ; token -> ascii_analysis_configuration . count_individual_characters = BP_TRUE ; token -> value_buff_analysis = BP_CreateBufferAnalysis ( ( unsigned char * ) buffer , ( size_t ) buff_len , & token -> ascii_analysis_configuration ) ; if ( ! token -> value_buff_analysis ) return ERR_FAILURE ; if ( token -> value_buff_analysis -> ascii -> char_counts [ ' ' ] ) token -> value_contains_backticks = true ; if ( token -> value_buff_analysis -> ascii -> char_counts [ ' \' ' ] ) token -> value_contains_embedded_single_quotes = true ; if ( token -> value_buff_analysis -> ascii -> char_counts [ ' ' ] ) token -> value_contains_embedded_double_quotes = true ; if ( token -> value_buff_analysis -> ascii -> ascii_char_flag_counts . extended_n || token -> value_buff_analysis -> ascii -> ascii_char_flag_counts . nonprintable_n || token -> value_buff_analysis -> ascii -> ascii_char_flag_counts . control_n ) { token -> value_contains_nonprintables = true ; } if ( token -> value_buff_analysis -> ascii -> ascii_char_flag_counts . number_n == strnlen ( ( char * ) buffer , buff_len ) ) token -> value_contains_a_positive_number = true ; if ( buffer [ 0 ] == ' ' ) if ( token -> value_buff_analysis -> ascii -> ascii_char_flag_counts . number_n == ( strnlen ( ( char * ) buffer , buff_len ) - 1 ) ) token -> value_contains_a_negative_number = true ; BP_ASCII_CHAR_FLAGS positive_flags ; BP_ZERO_STACK ( positive_flags ) ; BP_ASCII_CHAR_FLAGS negative_flags ; BP_ZERO_STACK ( negative_flags ) ; positive_flags . is_printable = BP_TRUE ; negative_flags . is_extended = BP_TRUE ; negative_flags . is_control = BP_TRUE ; negative_flags . is_nonprintable = BP_TRUE ; BP_ExtractASCIIStringsFromAnalyzedBuffer ( token -> value_buff_analysis , & positive_flags , BP_ASCII_CHAR_SEARCH_ALL_SEARCH_FLAG_CONDITIONS_MET , & negative_flags , BP_ASCII_CHAR_SEARCH_ALL_SEARCH_FLAG_CONDITIONS_MET_NEGATIVELY , NULL , 0 , NULL , 0 , 8 ) ; BP_RunSecondaryStringAnalysisOnExtractedStrings ( token -> value_buff_analysis ) ; return ERR_SUCCESS ; }
Runs a buffer analysis (as found in BP-BufferAnalysis.h) against a provided buffer.
Runs a buffer analysis ( as found in BP - BufferAnalysis . h ) against a provided buffer .
// ensure we have a buffer to analyze, a length to check, and a token to attribute // the analysis to // if we already have an analysis for this token, destroy it first and // reset reference indicators // destroy first // nullify analysis // reset indicators // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run Buffer Analysis %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // set/reset analysis configurations // create the buffer analysis (counts characters, etc) // we need a buffer analysis to continue // check for backticks // check for embedded single quotes // check for embedded double quotes // check for nonprintables/extended/control // check if the buffer contains only numeric digits // check if it's a negative number // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run Basic String Extraction %%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // add some forced positive flags // add some forced negative flags // match must be printable character // match cannot be extended ascii // Extract all strings from the buffer only using positive // and negative match flags. // run secondary analysis (tests if things match up with known types, check if // files exist, etc. // return indicating success