Skip to content

Commit 32013bf

Browse files
travisgoodspeedtravisgoodspeed
committed
Yara-X now has GUI support. #132 
1 parent 6a8618c commit 32013bf

File tree

3 files changed

+69
-24
lines changed

3 files changed

+69
-24
lines changed

‎romsolverdialog.cpp‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,26 @@
55
#include "gatograderbytes.h"
66
#include "gatograderstring.h"
77
#include "gatograderyara.h"
8+
#include "gatograderyarax.h"
89
#include "gatogradergoodasm.h"
910

1011
#include "maskromtool.h"
1112
#include "gatosolver.h"
1213
#include "gatorom.h"
13-
#include "extern/goodasm/goodasm.h"
1414

1515

1616
RomSolverDialog::RomSolverDialog(QWidget *parent) :
1717
QDialog(parent),
1818
ui(new Ui::RomSolverDialog)
1919
{
2020
ui->setupUi(this);
21+
#if YARAX_FOUND==1
22+
//Nothing to do in the happy case.
23+
#else
24+
//Sad case, we disable the page.
25+
qDebug()<<"YaraX isn't linked into this build. Disabling.";
26+
ui->editYaraX->setEnabled(false);
27+
#endif
2128
}
2229

2330
RomSolverDialog::~RomSolverDialog()
@@ -34,10 +41,6 @@ void RomSolverDialog::setYaraRule(QString rule){
3441
ui->editYara->setPlainText(yararule);
3542
}
3643

37-
void RomSolverDialog::on_editYara_textChanged(){
38-
yararule=ui->editYara->toPlainText();
39-
}
40-
4144
/* Returns a new GatoGrader based upon the GUI settings.
4245
*/
4346
GatoGrader* RomSolverDialog::grader(){
@@ -59,12 +62,22 @@ GatoGrader* RomSolverDialog::grader(){
5962
delete tmpfile;
6063
tmpfile=new QTemporaryFile();
6164
tmpfile->open();
65+
yararule=ui->editYara->toPlainText();
6266
tmpfile->write(yararule.toStdString().data());
6367
tmpfile->flush();
6468
tmpfile->close();
6569
grader=new GatoGraderYara(tmpfile->fileName());
6670
break;
67-
case 4: // GoodASM
71+
case 4: // YaraX
72+
#if YARAX_FOUND==1
73+
yaraxrule=ui->editYaraX->toPlainText();
74+
grader=new GatoGraderYaraX(yaraxrule);
75+
#else
76+
qDebug()<<"YaraX isn't linked into this build.";
77+
#endif
78+
break;
79+
80+
case 5: // GoodASM
6881
grader=new GatoGraderGoodAsm(mrt->gatorom().goodasm());
6982
break;
7083
default:

‎romsolverdialog.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,12 @@ class RomSolverDialog : public QDialog
2121
~RomSolverDialog();
2222
void setMaskRomTool(MaskRomTool *mrt);
2323
void setYaraRule(QString rule);
24-
QString yararule;
24+
QString yararule, yaraxrule;
2525
GatoGrader* grader();
2626
void solve(QString solveset="");
2727

2828
private slots:
2929
void on_butSolve_clicked();
30-
void on_editYara_textChanged();
3130

3231
private:
3332
Ui::RomSolverDialog *ui;

‎romsolverdialog.ui‎

Lines changed: 49 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ p, li { white-space: pre-wrap; }
3333
hr { height: 1px; border-width: 0; }
3434
li.unchecked::marker { content: &quot;\2610&quot;; }
3535
li.checked::marker { content: &quot;\2612&quot;; }
36-
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'Ubuntu Sans'; font-size:11pt; font-weight:400; font-style:normal;&quot;&gt;
37-
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu';&quot;&gt;This solves for optionally masked bytes at absolute addresses. Comma or space delimited, the records are colon separated with an address, a byte, and an optional mask. Use the Byte String solver if you know the bytes, but not their address.&lt;/span&gt;&lt;/p&gt;
38-
&lt;p style=&quot;-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-family:'Ubuntu';&quot;&gt;&lt;br /&gt;&lt;/p&gt;
39-
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu';&quot;&gt;Examples:&lt;br /&gt;GameBoy: 0:31,1:fe,2:ff&lt;br /&gt;MYK82 Clipper Chip: 0:9b,7:ea &lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
36+
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'.AppleSystemUIFont'; font-size:13pt; font-weight:400; font-style:normal;&quot;&gt;
37+
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;This solves for optionally masked bytes at absolute addresses. Comma or space delimited, the records are colon separated with an address, a byte, and an optional mask. Use the Byte String solver if you know the bytes, but not their address.&lt;/span&gt;&lt;/p&gt;
38+
&lt;p style=&quot;-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;&lt;br /&gt;&lt;/p&gt;
39+
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;Examples:&lt;br /&gt;GameBoy: 0:31,1:fe,2:ff&lt;br /&gt;MYK82 Clipper Chip: 0:9b,7:ea &lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
4040
</property>
4141
</widget>
4242
</item>
@@ -66,10 +66,10 @@ p, li { white-space: pre-wrap; }
6666
hr { height: 1px; border-width: 0; }
6767
li.unchecked::marker { content: &quot;\2610&quot;; }
6868
li.checked::marker { content: &quot;\2612&quot;; }
69-
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'Ubuntu Sans'; font-size:11pt; font-weight:400; font-style:normal;&quot;&gt;
70-
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu';&quot;&gt;This searches for a string of bytes within the image, at any offset. The string is comma or space delimited.&lt;/span&gt;&lt;/p&gt;
71-
&lt;p style=&quot;-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-family:'Ubuntu';&quot;&gt;&lt;br /&gt;&lt;/p&gt;
72-
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu';&quot;&gt;In MYK82, we can search for BNE instructions with &amp;quot;00,00,1a&amp;quot; to reveal 22 solutions, one of which is right.&lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
69+
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'.AppleSystemUIFont'; font-size:13pt; font-weight:400; font-style:normal;&quot;&gt;
70+
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;This searches for a string of bytes within the image, at any offset. The string is comma or space delimited.&lt;/span&gt;&lt;/p&gt;
71+
&lt;p style=&quot;-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;&lt;br /&gt;&lt;/p&gt;
72+
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;In MYK82, we can search for BNE instructions with &amp;quot;00,00,1a&amp;quot; to reveal 22 solutions, one of which is right.&lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
7373
</property>
7474
</widget>
7575
</item>
@@ -99,8 +99,8 @@ p, li { white-space: pre-wrap; }
9999
hr { height: 1px; border-width: 0; }
100100
li.unchecked::marker { content: &quot;\2610&quot;; }
101101
li.checked::marker { content: &quot;\2612&quot;; }
102-
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'Ubuntu Sans'; font-size:11pt; font-weight:400; font-style:normal;&quot;&gt;
103-
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu';&quot;&gt;This solves for ASCII strings. Some ROMs are devoid of them, but in others they stand out brilliantly.&lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
102+
&lt;/style&gt;&lt;/head&gt;&lt;body style=&quot; font-family:'.AppleSystemUIFont'; font-size:13pt; font-weight:400; font-style:normal;&quot;&gt;
103+
&lt;p style=&quot; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;&quot;&gt;&lt;span style=&quot; font-family:'Ubuntu'; font-size:11pt;&quot;&gt;This solves for ASCII strings. Some ROMs are devoid of them, but in others they stand out brilliantly.&lt;/span&gt;&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;</string>
104104
</property>
105105
</widget>
106106
</item>
@@ -114,13 +114,46 @@ li.checked::marker { content: &quot;\2612&quot;; }
114114
<item>
115115
<widget class="QPlainTextEdit" name="editYara">
116116
<property name="plainText">
117-
<string>rule ExampleRule
118-
{
119-
strings:
120-
$hex = { 9b 06 00 ea }
117+
<string>// This is a Yara rule. It works by shelling out to the &quot;yara&quot; command
118+
// with temporary files, and it's a lot slower than the modern YaraX
119+
// driver. At some point we'll deprecate it.
121120

122-
condition:
123-
$hex
121+
rule gameboy {
122+
strings:
123+
$nintendo = {CE ED 66 66 CC 0D 00 0B 03 73 00 83 00 0C 00 0D}
124+
125+
condition:
126+
$nintendo
127+
}
128+
</string>
129+
</property>
130+
</widget>
131+
</item>
132+
</layout>
133+
</widget>
134+
<widget class="QWidget" name="tabYaraX">
135+
<attribute name="title">
136+
<string>YaraX</string>
137+
</attribute>
138+
<layout class="QVBoxLayout" name="verticalLayout_7">
139+
<item>
140+
<widget class="QPlainTextEdit" name="editYaraX">
141+
<property name="plainText">
142+
<string>// This is a YaraX rule, parsed by the C++ library. It's a lot faster
143+
// than the Yara driver, but only exists if you installed the YaraX CAPI
144+
// before building MaskRomTool.
145+
146+
147+
// The GameBoy boot ROM contains a bitmap of Nintendo's logo, compared
148+
// against a matching bitmap in every cartridge. Here we check for the
149+
// first row of the logo.
150+
151+
rule gameboy {
152+
strings:
153+
$nintendo = {CE ED 66 66 CC 0D 00 0B 03 73 00 83 00 0C 00 0D}
154+
155+
condition:
156+
$nintendo
124157
}
125158
</string>
126159
</property>

0 commit comments

Comments
 (0)