matcher

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 10, 2026 License: BSD-3-Clause Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ReferencePaddingProjection = 256
	BaseReferenceProjection    = 257
)
View Source 
const (
	SeedSelectionTotalVisitLengthQuota = 1 << 18
	BackwardsExtendLimit               = 1 << 16
)
View Source 
const (
	MinEquivalenceSimilarity = 12.0
	MinLabelAffinity         = 64.0
)
View Source 
const MinProgramSize = 16

Variables

View Source 
var MismatchFatal = math.Inf(-1)

Functions

func DetectElementFromDisassembler 

func DetectElementFromDisassembler(image []byte) (types.Element, bool)

func ExtendEquivalenceBackward 

func ExtendEquivalenceBackward(
	oldIdx *ImageIndex,
	newIdx *ImageIndex,
	affinities []TargetsAffinity,
	candidate types.EquivalenceCandidate,
	minSimilarity float64,
) types.EquivalenceCandidate

func ExtendEquivalenceForward 

func ExtendEquivalenceForward(
	oldIdx *ImageIndex,
	newIdx *ImageIndex,
	affinities []TargetsAffinity,
	candidate types.EquivalenceCandidate,
	minSimilarity float64,
) types.EquivalenceCandidate

func GetEquivalenceSimilarity 

func GetEquivalenceSimilarity(
	oldIdx *ImageIndex,
	newIdx *ImageIndex,
	affinities []TargetsAffinity,
	eq types.Equivalence,
) float64

func GetTokenSimilarity 

func GetTokenSimilarity(
	oldIdx *ImageIndex,
	newIdx *ImageIndex,
	affinities []TargetsAffinity,
	src, dst types.Offset,
) float64

func MakeDisassemblerOfType 

func MakeDisassemblerOfType(image []byte, exeType types.ExecutableType) disasm.Disassembler

func MakeDisassemblerWithoutFallback 

func MakeDisassemblerWithoutFallback(image []byte) disasm.Disassembler

func PruneEquivalencesAndSortBySource 

func PruneEquivalencesAndSortBySource(equivalences *[]types.Equivalence)

func VisitEquivalenceSeed 

func VisitEquivalenceSeed(
	oldIdx *ImageIndex,
	newIdx *ImageIndex,
	affinities []TargetsAffinity,
	src, dst types.Offset,
	minSimilarity float64,
) types.EquivalenceCandidate

Types

type Association 

type Association struct {
	Other    uint32
	Affinity float64
}

type BinaryDataHistogram 

type BinaryDataHistogram struct {
	// contains filtered or unexported fields
}

func NewBinaryDataHistogram 

func NewBinaryDataHistogram() *BinaryDataHistogram

func (*BinaryDataHistogram) Compute 

func (h *BinaryDataHistogram) Compute(region []byte) bool

func (*BinaryDataHistogram) Distance 

func (h *BinaryDataHistogram) Distance(other *BinaryDataHistogram) float64

func (*BinaryDataHistogram) IsValid 

func (h *BinaryDataHistogram) IsValid() bool

type ElementDetector 

type ElementDetector func(image []byte) (types.Element, bool)

type ElementFinder 

type ElementFinder struct {
	// contains filtered or unexported fields
}

func NewElementFinder 

func NewElementFinder(image []byte, detector ElementDetector) *ElementFinder

func (*ElementFinder) GetNext 

func (f *ElementFinder) GetNext() (types.Element, bool)

type EncodedView 

type EncodedView struct {
	// contains filtered or unexported fields
}

func NewEncodedView 

func NewEncodedView(imageIndex *ImageIndex) *EncodedView

func (*EncodedView) BuildProjectionCache 

func (ev *EncodedView) BuildProjectionCache()

BuildProjectionCache precomputes per-reference projections so ProjectionAt becomes O(1). Must be called after all SetLabels calls, since projections depend on labels. Costs one pass over references rather than over the image.

func (*EncodedView) Cardinality 

func (ev *EncodedView) Cardinality() int

func (*EncodedView) ImageIndex 

func (ev *EncodedView) ImageIndex() *ImageIndex

func (*EncodedView) Projection 

func (ev *EncodedView) Projection(location types.Offset) uint32

func (*EncodedView) ProjectionAt 

func (ev *EncodedView) ProjectionAt(location types.Offset) uint32

ProjectionAt returns the same value as Projection, but in O(1) using the cache built by BuildProjectionCache.

func (*EncodedView) QueryAt 

func (ev *EncodedView) QueryAt(i int) uint32

QueryAt lets *EncodedView act as a lazy query string for suffix array lookup, so the "new" side never needs a materialized projection array.

func (*EncodedView) SetLabels 

func (ev *EncodedView) SetLabels(pool types.PoolTag, labels []uint32, bound int)

func (*EncodedView) Size 

func (ev *EncodedView) Size() int

func (*EncodedView) SuffixSource 

func (ev *EncodedView) SuffixSource() *sais.ProjectionSource

type EquivalenceMap 

type EquivalenceMap struct {
	// contains filtered or unexported fields
}

func CreateEquivalenceMap 

func CreateEquivalenceMap(oldIdx, newIdx *ImageIndex, numIterations int) *EquivalenceMap

func NewEquivalenceMap 

func NewEquivalenceMap() *EquivalenceMap

func (*EquivalenceMap) Build 

func (m *EquivalenceMap) Build(
	oldSA []uint32,
	oldView *EncodedView,
	newView *EncodedView,
	affinities []TargetsAffinity,
	minSimilarity float64,
)

func (*EquivalenceMap) BuildWithEncodedViews 

func (m *EquivalenceMap) BuildWithEncodedViews(
	oldSA []uint32,
	oldView *EncodedView,
	newView *EncodedView,
	affinities []TargetsAffinity,
	minSimilarity float64,
)

func (*EquivalenceMap) BuildWithProjections 

func (m *EquivalenceMap) BuildWithProjections(
	oldSA []uint32,
	oldProj []uint32,
	oldView *EncodedView,
	newView *EncodedView,
	affinities []TargetsAffinity,
	minSimilarity float64,
)

func (*EquivalenceMap) BuildWithSource 

func (m *EquivalenceMap) BuildWithSource(
	oldSA []uint32,
	oldSource sais.Uint32Source,
	oldView *EncodedView,
	newView *EncodedView,
	affinities []TargetsAffinity,
	minSimilarity float64,
)

func (*EquivalenceMap) Candidates 

func (m *EquivalenceMap) Candidates() []types.EquivalenceCandidate

type HeuristicEnsembleMatcher 

type HeuristicEnsembleMatcher struct {
	// contains filtered or unexported fields
}

func NewHeuristicEnsembleMatcher 

func NewHeuristicEnsembleMatcher() *HeuristicEnsembleMatcher

func (*HeuristicEnsembleMatcher) Matches 

func (m *HeuristicEnsembleMatcher) Matches() []types.ElementMatch

func (*HeuristicEnsembleMatcher) NumIdentical 

func (m *HeuristicEnsembleMatcher) NumIdentical() int

func (*HeuristicEnsembleMatcher) RunMatch 

func (m *HeuristicEnsembleMatcher) RunMatch(oldImage, newImage []byte) bool

type ImageIndex 

type ImageIndex struct {
	// contains filtered or unexported fields
}

func NewImageIndex 

func NewImageIndex(image []byte) *ImageIndex

func (*ImageIndex) GetRawValue 

func (idx *ImageIndex) GetRawValue(location types.Offset) byte

func (*ImageIndex) Initialize 

func (idx *ImageIndex) Initialize(d disasm.Disassembler) bool

func (*ImageIndex) IsReference 

func (idx *ImageIndex) IsReference(location types.Offset) bool

func (*ImageIndex) IsToken 

func (idx *ImageIndex) IsToken(location types.Offset) bool

func (*ImageIndex) LookupType 

func (idx *ImageIndex) LookupType(location types.Offset) types.TypeTag

func (*ImageIndex) Pool 

func (idx *ImageIndex) Pool(poolTag types.PoolTag) *TargetPool

func (*ImageIndex) PoolCount 

func (idx *ImageIndex) PoolCount() int

func (*ImageIndex) RefCount 

func (idx *ImageIndex) RefCount() int

RefCount returns the total number of references across all types.

func (*ImageIndex) RefRank 

func (idx *ImageIndex) RefRank(loc int) int

RefRank returns the number of reference starts strictly before loc. Valid only when refStart is populated.

func (*ImageIndex) ReferenceSets 

func (idx *ImageIndex) ReferenceSets() map[types.TypeTag]*ReferenceSet

func (*ImageIndex) Refs 

func (idx *ImageIndex) Refs(typeTag types.TypeTag) *ReferenceSet

func (*ImageIndex) Size 

func (idx *ImageIndex) Size() int

func (*ImageIndex) TargetPools 

func (idx *ImageIndex) TargetPools() map[types.PoolTag]*TargetPool

func (*ImageIndex) TypeCount 

func (idx *ImageIndex) TypeCount() int

type ImposedEnsembleMatcher 

type ImposedEnsembleMatcher struct {
	// contains filtered or unexported fields
}

func NewImposedEnsembleMatcher 

func NewImposedEnsembleMatcher(imposedMatches string) *ImposedEnsembleMatcher

func (*ImposedEnsembleMatcher) Matches 

func (m *ImposedEnsembleMatcher) Matches() []types.ElementMatch

func (*ImposedEnsembleMatcher) NumIdentical 

func (m *ImposedEnsembleMatcher) NumIdentical() int

func (*ImposedEnsembleMatcher) RunMatch 

func (m *ImposedEnsembleMatcher) RunMatch(oldImage, newImage []byte) bool

type OffsetMapper 

type OffsetMapper struct {
	// contains filtered or unexported fields
}

func NewOffsetMapper 

func NewOffsetMapper(equivalences []types.Equivalence, oldImageSize, newImageSize types.Offset) *OffsetMapper

func NewOffsetMapperFromOwnedEquivalences 

func NewOffsetMapperFromOwnedEquivalences(equivalences []types.Equivalence, oldImageSize, newImageSize types.Offset) *OffsetMapper

NewOffsetMapperFromOwnedEquivalences takes ownership of equivalences.

func (*OffsetMapper) Equivalences 

func (m *OffsetMapper) Equivalences() []types.Equivalence

func (*OffsetMapper) ExtendedForwardProject 

func (m *OffsetMapper) ExtendedForwardProject(offset types.Offset) types.Offset

func (*OffsetMapper) ForwardProjectAll 

func (m *OffsetMapper) ForwardProjectAll(offsets []types.Offset) []types.Offset

ForwardProjectAll projects each offset in sorted slice offsets from old image space to new image space, dropping any offset not covered by an equivalence. Unlike ExtendedForwardProject, this never falls back to the nearest equivalence: offsets in gaps are discarded, matching OffsetMapper::ForwardProjectAll in the C++ implementation.

type OutlierDetector 

type OutlierDetector struct {
	// contains filtered or unexported fields
}

func NewOutlierDetector 

func NewOutlierDetector() *OutlierDetector

func (*OutlierDetector) Add 

func (d *OutlierDetector) Add(sample float64)

func (*OutlierDetector) DecideOutlier 

func (d *OutlierDetector) DecideOutlier(sample float64) int

func (*OutlierDetector) Prepare 

func (d *OutlierDetector) Prepare()

type PoolInfo 

type PoolInfo struct {
	// contains filtered or unexported fields
}

type ReferenceSet 

type ReferenceSet struct {
	// contains filtered or unexported fields
}

func NewReferenceSet 

func NewReferenceSet(traits types.ReferenceTypeTraits, targetPool *TargetPool) *ReferenceSet

func (*ReferenceSet) At 

func (rs *ReferenceSet) At(offset types.Offset) types.Reference

func (*ReferenceSet) InitReferences 

func (rs *ReferenceSet) InitReferences(refs []types.Reference)

func (*ReferenceSet) InitReferencesFromReader 

func (rs *ReferenceSet) InitReferencesFromReader(reader types.ReferenceReader, capacityHint int)

InitReferencesFromReader drains reader into rs.references directly. Going through InitReferences would allocate a second full array and copy into it; the slice built here is not shared with any caller, so it can be adopted as is. For a large binary this avoids a copy of every reference.

func (*ReferenceSet) PoolTag 

func (rs *ReferenceSet) PoolTag() types.PoolTag

func (*ReferenceSet) References 

func (rs *ReferenceSet) References() []types.Reference

func (*ReferenceSet) Size 

func (rs *ReferenceSet) Size() int

func (*ReferenceSet) TargetPool 

func (rs *ReferenceSet) TargetPool() *TargetPool

func (*ReferenceSet) Traits 

func (rs *ReferenceSet) Traits() types.ReferenceTypeTraits

func (*ReferenceSet) TypeTag 

func (rs *ReferenceSet) TypeTag() types.TypeTag

func (*ReferenceSet) Width 

func (rs *ReferenceSet) Width() types.Offset

type TargetPool 

type TargetPool struct {
	// contains filtered or unexported fields
}

func NewTargetPool 

func NewTargetPool() *TargetPool

func NewTargetPoolFromOwnedTargets 

func NewTargetPoolFromOwnedTargets(targets []types.Offset) *TargetPool

NewTargetPoolFromOwnedTargets takes ownership of targets. Callers must not retain or mutate the slice after passing it here.

func NewTargetPoolWithTargets 

func NewTargetPoolWithTargets(targets []types.Offset) *TargetPool

func (*TargetPool) AddType 

func (tp *TargetPool) AddType(t types.TypeTag)

func (*TargetPool) FilterAndProject 

func (tp *TargetPool) FilterAndProject(mapper OffsetMapper)

FilterAndProject projects targets from old image space to new image space using mapper, dropping targets not covered by any equivalence. Unlike InsertTargets, this only sorts (no dedup), matching TargetPool:: FilterAndProject in the C++ implementation.

func (*TargetPool) InsertReferences 

func (tp *TargetPool) InsertReferences(refs []types.Reference)

func (*TargetPool) InsertTargets 

func (tp *TargetPool) InsertTargets(targets []types.Offset)

func (*TargetPool) KeyForNearestOffset 

func (tp *TargetPool) KeyForNearestOffset(offset types.Offset) uint32

func (*TargetPool) KeyForOffset 

func (tp *TargetPool) KeyForOffset(offset types.Offset) uint32

func (*TargetPool) KeyIsValid 

func (tp *TargetPool) KeyIsValid(key uint32) bool

func (*TargetPool) OffsetForKey 

func (tp *TargetPool) OffsetForKey(key uint32) types.Offset

func (*TargetPool) Size 

func (tp *TargetPool) Size() int

func (*TargetPool) Targets 

func (tp *TargetPool) Targets() []types.Offset

func (*TargetPool) Types 

func (tp *TargetPool) Types() []types.TypeTag

type TargetsAffinity 

type TargetsAffinity struct {
	// contains filtered or unexported fields
}

func NewTargetsAffinity 

func NewTargetsAffinity() *TargetsAffinity

func (*TargetsAffinity) AffinityBetween 

func (ta *TargetsAffinity) AffinityBetween(oldKey, newKey uint32) float64

func (*TargetsAffinity) AssignLabels 

func (ta *TargetsAffinity) AssignLabels(
	minAffinity float64,
	oldLabels *[]uint32,
	newLabels *[]uint32,
) uint32

func (*TargetsAffinity) InferFromSimilarities 

func (ta *TargetsAffinity) InferFromSimilarities(
	eqMap *EquivalenceMap,
	oldTargets []types.Offset,
	newTargets []types.Offset,
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.