deardaniel/secdata-raw huggingface dataset:
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "Gadget.h"
#include "iostream"
#include "ostream"
#include "stdio.h"

Gadget::Gadget(char *gname)
{
	this->name = gname;
	this->deployed = false;
	this->type = 0;
	this->workingOn = NULL;
}

char *Gadget::getName()
{
	return name;
}

bool Gadget::isDeployed()
{
	return deployed;
}

int Gadget::getType()
{
	return type;
}

void Gadget::use(Person *person)
{
	if (deployed) {
		return;
	}

	deployed = true;
	workingOn = person;
}

void Gadget::print() {
	char *depstr = (deployed == false ? "is not" : "is");
	char *who = (deployed == false ? "anyone" : workingOn->name);
	printf("%s %s deployed on %s\n", name, depstr, who);
}


Gadget::~Gadget(void)
{
}
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
// WinHelloCPP.cpp : Defines the entry point for the application.
//

#include "Wallace.h"
#include "Gadget.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

Person *personList = NULL;

static char *wallace = "Wallace";

void addPeople(Person **list) {
	addPerson(list, "Lord Victor Quartermaine");
	addPerson(list, "Lady Tottington");
	addPerson(list, "Were Rabbit");
	addPerson(list, "Rabbit");
	addPerson(list, "Gromit");
	addPerson(list, "Wallace");
	addPerson(list, "Sheep");
}

void initializePeople(Person *people) {
	int index = 0;

	do {
		people->likesCheese = ((index % 3) == 0);
		people->id = index++;
		people = people->next;
	} while (people != NULL);
}

void addPerson (Person **list, char *name) {
	Person *person = new(Person);
	strncpy_s(person->name, name, sizeof(person->name));

	person->next = *list;
	*list = person;
}

Gadget* deployGadget() {
	Gadget *gadget = new Gadget("Infrared Garden Gnome");

	Person *pp = personList;
	while (pp != NULL) {
		if (strcmp(pp->name, wallace)==0 || pp->likesCheese) {
			gadget->use(pp);
		}
		pp = pp->next;
	}

	return gadget;
}

int main(int argc, char **argv) {
	addPeople(&personList);
 	initializePeople(personList);
	Gadget *gadget = deployGadget();
	gadget->print();
}
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "Gadget.h"
#include "iostream"
#include "ostream"
#include "stdio.h"

Gadget::Gadget(char *gname)
{
	this->name = gname;
	this->deployed = false;
	this->broken = false;
	this->type = 0;
	this->workingOn = NULL;
}

char *Gadget::getName()
{
	return name;
}

bool Gadget::isDeployed()
{
	return deployed;
}

bool Gadget::isBroken()
{
	return broken;
}

int Gadget::getType()
{
	return type;
}

void Gadget::setBroken(bool state) {
	broken = state;
	if (broken) {
		deployed = false;
		workingOn = 0;
	}
}

void Gadget::use(Person *person)
{
	if (deployed || broken) {
		return;
	}

	deployed = true;
	workingOn = person;
}

void Gadget::print() {
	char *depstr = (deployed == false ? "is not" : "is");
	char *who = (deployed == false ? "anyone" : workingOn->name);
	printf("%s %s deployed on %s\n", name, depstr, who);
}


Gadget::~Gadget(void)
{
}
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
// WinHelloCPP.cpp : Defines the entry point for the application.
//

#include "Wallace.h"
#include "Gadget.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

Person *personList = NULL;

void addPeople(Person **list) {
	addPerson(list, "Lord Victor Quartermaine");
	addPerson(list, "Lady Tottington");
	addPerson(list, "Were Rabbit");
	addPerson(list, "Rabbit");
	addPerson(list, "Gromit");
	addPerson(list, "Wallace");
}

void initializePeople(Person *people) {
	int index = 0;

	do {
		people->likesCheese = (rand() * 2) < 1;
		people->id = index++;
		people = people->next;
	} while (people != NULL);
}

void addPerson (Person **list, char *name) {
	Person *person = new(Person);
	strncpy_s(person->name, name, sizeof(person->name));

	person->next = *list;
	*list = person;
}

Gadget* deployGadget() {
	Gadget *gadget = new Gadget("Infrared Garden Gnome");

	Person *pp = personList;
	while (pp != NULL) {
		if (strcmp(pp->name, "Wallace")==0) { 
			gadget->use(pp);
		}
		pp = pp->next;
	}

	return gadget;
}

int main(int argc, char **argv) {
	addPeople(&personList);
 	initializePeople(personList);
	Gadget *gadget = deployGadget();
	gadget->print();
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <pwd.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/prctl.h>

int main(int argc, char *argv[], char *envp[]) {
	if (argc != 2) {
		fprintf(stderr, "Usage: %s COMMAND\n\
\n\
    COMMAND A shell command to execute as in /bin/sh -c COMMAND. This must be\n\
            a single argument. To run a command with multiple arguments,\n\
            enclose the full command in quotations.\n\
\n\
Execute the given COMMAND allowing any other process to attach to it. This is\n\
done using prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY), so that on Linux systems\n\
with Yama ptrace_scope=1, gdb, strace, lldb, etc., can attach to it.\n\
", argv[0]);
	}
	char* shell = getpwuid(geteuid())->pw_shell;
	prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY);
	execl(shell, shell, "-c", argv[1], (char *) NULL);
}
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifdef __x86_64

#include <malloc.h>
#include <string.h>

#else

// Library routine not linked in for cross-build

void * malloc(int size) {
	// missing implementation
	return (void *)0;
}

void free(void *ptr) {
	// missing implementation
}

int strlen(char *s) {
	int len = 0;
	while (*s++ != 0) {
		++len;
	}
	return len;
}

#endif

const char data[] = {
0xec,
0xc3,
0xd8,
0xd9,
0xde,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0xf9,
0xcf,
0xc9,
0xc5,
0xc4,
0xce,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0xfe,
0xc2,
0xc3,
0xd8,
0xce,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0x00
};

char * deobfuscate(char *src, int len) {
        char *buf = (char *)malloc(len + 1);
        char *ptr = buf;
        for (int i = 0; i < len; i++) {
            *ptr++ = *src++ ^ 0xAA;
        }
        *ptr = 0;
        return buf;
}

void use_string(char * str, int index) {
//	fprintf(stderr, "String[%d]: %s\n", index, str);
}

int main (int argc, char **argv) {
    char *ptr = (char *)data;
    int index = 0;
    while (*ptr != 0) {
        int len = strlen(ptr);
        char *str = deobfuscate(ptr, len);
	use_string(str, index++);
        free(str);
	ptr += len + 1;
    }
    return 0;
}

#ifndef __x86_64


int _start() {
	char *argv[] = { "deobExample" };
	return main(1, argv);
}

#endif
/* ###
 * IP: GHIDRA
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
int length(char *s) {
	int len = 0;
	while (*s++ != 0) {
		++len;
	}
	return len;
}

const char data[] = {
0xec,
0xc3,
0xd8,
0xd9,
0xde,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0xf9,
0xcf,
0xc9,
0xc5,
0xc4,
0xce,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0xfe,
0xc2,
0xc3,
0xd8,
0xce,
0x8a,
0xcf,
0xc4,
0xde,
0xd8,
0xd3,
0x00,
0x00
};

char buffer[64];

char * deobfuscate(char *src, char *dst, int len) {
        char *ptr = dst;
        for (int i = 0; i < len; i++) {
            *ptr++ = *src++ ^ 0xAA;
        }
        *ptr = 0;
        return dst;
}

void use_string(char * str, int index) {
//	fprintf(stderr, "String[%d]: %s\n", index, str);
}

int main (int argc, char **argv) {
    char *ptr = (char *)data;
    int index = 0;
    while (*ptr != 0) {
        int len = length(ptr);
        char *str = deobfuscate(ptr, buffer, len);
	use_string(str, index++);
	ptr += len + 1;
    }
    return 0;
}

#ifndef __x86_64


int _start() {
	char *argv[] = { "deobExample" };
	return main(1, argv);
}

#endif
See the example emulation scripts contained within Ghidra/Features/Base/ghidra_scripts.

Sample scripts deobExampleX86 and deobHookExampleX86 may be built under Linux.

	cc -std=c99 -Wimplicit-function-declaration -o deobExampleX86 deobExample.c 
	cc -std=c99 -Wimplicit-function-declaration -o deobHookExampleX86 deobHookExample.c 
	
Once these examples have been compiled they may be imported into a Ghidra project and the
corresponding Ghidra Scripts (EmuX86DeobfuscateExampleScript and EmuX86GccDeobfuscateHookExampleScript) 
used to demonstrate the use of the PcodeEmulator class.
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "StdAfx.h"
#include "Gadget.h"
#include "iostream"
#include "ostream"

Gadget::Gadget(char *gname)
{
	this->name = gname;
	this->deployed = false;
	this->type = 0;
	this->workingOn = NULL;
}

char *Gadget::getName()
{
	return name;
}

bool Gadget::isDeployed()
{
	return deployed;
}

int Gadget::getType()
{
	return type;
}

void Gadget::use(Person *person)
{
	if (deployed) {
		return;
	}

	deployed = true;
	workingOn = person;
}


Gadget::~Gadget(void)
{
}
/* ###
 * IP: GHIDRA
 * REVIEWED: YES
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *      http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
// stdafx.cpp : source file that includes just the standard includes
// WinHelloCPP.pch will be the pre-compiled header
// stdafx.obj will contain the pre-compiled type information

#include "stdafx.h"

// TODO: reference any additional headers you need in STDAFX.H
// and not in this file
# From Matching Functions to Matching Executables

In this section, we discuss the Executable Results table.
Each row of this table corresponds to one executable in the database.
The information in one row is an aggregation of all of the function-level matches into that row's executable.
Here is an example Executable Results table from the previous query (yours may look different depending on the compiler used to create the example files):

![executable results](images/exe_results.png)

If you select a single row in the table and right-click on it, you will see the following actions:

- **Load Executable** 
  Opens a read-only copy of the program in the Code Browser.
- **Filter on this Executable** 
  Applies a filter which restricts the matches shown in the Function Matches table to matches which occur in the given executable.

## Exercise

1. Sort the Executable results by descending **Function Count**. 
   An entry in this column shows the number of queried functions which have at least one match in the row's executable (if ``foo`` has 2 or more matches into a given executable, it still only contributes 1 to the function count).
   What position is ``demangler_gnu_v2_41`` in your table?
1. An entry in the **Confidence** column shows the sum of the confidence scores of all matches into the corresponding executable.
   If ``foo`` has more than one match into a given executable, only the one with the highest (function-level) confidence contributes to the (executable-level) confidence score.
   Sort the Executable results by descending confidence and observe that ``demangler_gnu_v2_41`` is now further down the list. 
   <details><summary>What could explain this?</summary> If there are many function matches but the sum of all the confidences is relatively low, it is likely that many of the matches involve small functions with common BSim signatures.</details> 
1. In the Executable match table, right click on ``demangler_gnu_v2_41`` and apply the filter action.
Sort the filtered function matches by descending confidence.
Starting at the top, examine some of the matches and convince yourself that the given explanation is correct.
    - **Note**: You can remove the filter using the **Filter Results** icon ![Filter Results](images/exec.png) in the toolbar.
     We'll discuss this further in [BSim Filters](BSimTutorial_Filters.md)
1. Determine the highest confidence match in ``demangler_gnu_v2_41`` and query all functions in ``postgres`` again, this time with a Confidence bound slightly higher than this confidence value.  Verify that ``demangler_gnu_v2_41`` is not in the list of executable matches.

From this exercise, we see that unrelated functions can be duplicates of each other, either because they are small or because they perform a common generic action.
Keep in mind that such functions can "pollute" the results of a blanket query.
In the next section, we demonstrate a technique to restrict queries to functions which are more likely to have meaningful matches.

Next Section: [Overview Queries](BSimTutorial_Overview_Queries.md)
# Starting Ghidra and Enabling the BSim Plugin:

To begin the tutorial, perform the following steps:

1. Launch Ghidra.
1. Create a new non-shared project for this tutorial.
1. Launch the Code Browser.

To enable BSim, perform the following steps:

1. **File -> Configure** from the Code Browser.
1. Click on the ``Configure`` link of the ``BSim`` entry.
1. In the resulting dialog, ensure that the checkbox for ``BSimSearchPlugin`` is checked.

![configure dialog](images/configure.png)
 
 Next Section: [Creating and Populating a BSim Database from the GUI](BSimTutorial_Creating_Database_From_GUI.md)
# Ghidra Analysis from the Command Line 

For the remaining exercises, we need to populate our BSim database with a number of binaries. 
We'd like a consistent set of binaries for the tutorial, but we don't want to clutter the Ghidra distribution with dozens of additional executables.
Fortunately, the BSim plugin includes a script for building the PostgreSQL backend, and that build process creates hundreds of object files.
So we can just build PostgreSQL and harvest the object files we need.

**Note**: For the tutorial, we continue to use the H2 BSim backend. 
We do not run any PostgreSQL code, we simply analyze some files produced when building PostgreSQL.

Note that these files must be built on a machine running Linux or macOS.
Windows users can build these files in a Linux virtual machine.

To build the files, execute the following commands in a shell: [^1] 

[^1]: You may need to install additional packages and/or change some build options in order for PostgreSQL to build successfully. The error messages are generally informative.  See the comments in ``make-postgres.sh``.

```bash
cd <ghidra_install_dir>/Ghidra/Features/BSim
export CFLAGS="-O2 -g"
./support/make-postgres.sh
mkdir ~/postgres_object_files
cd build
find . -name p*o -size +100000c -size -700000c -exec cp {} ~/postgres_object_files/ \;
cd os/linux_x86_64/postgresql/bin
strip -s postgres
```

To continue on Windows, transfer the ``~/postgres_object_files`` directory and the stripped ``postgres`` executable to your Windows machine.

## Importing and Analyzing the Exercise Files

Now that we have the executables, we can analyze them with the headless analyzer[^2].
The headless analyzer is distinct from BSim, but using it is the only feasible way to analyze substantial numbers of binaries.

[^2]: The headless analyzer has its own documentation: ``<ghidra_install_dir>/support/analyzeHeadlessREADME.html``.

To analyze the files in Linux, execute the following commands in a shell.

```bash
cd <ghidra_install_dir>/support
./analyzeHeadless <ghidra_project_dir> postgres_object_files -import ~/postgres_object_files/*
```
(On windows, use ``analyzeHeadless.bat`` and adjust paths accordingly.)

This will create a local Ghidra project called ``postgres_object_files`` in the directory ``<ghidra_project_dir>``. 


Next Section: [BSim from the Command Line](BSimTutorial_BSim_Command_Line.md)
# BSim Tutorial

BSim is a Ghidra plugin for finding structurally similar functions in (potentially large) collections of binaries.
It is based on Ghidra's decompiler and can find matches across compilers, architectures, and/or small changes to source code.

This tutorial demonstrates how create a small BSim database and walks through some typical use cases.

**Detailed information about BSim can be found in the "BSim" entry of the Ghidra Help**.

1. [Introduction to BSim](BSimTutorial_Intro.md)
1. [Starting Ghidra and Enabling BSim](BSimTutorial_Enabling.md)
1. [Creating and Populating a BSim Database from the GUI](BSimTutorial_Creating_Database_From_GUI.md)
1. [Basic BSim Queries](BSimTutorial_Basic_Queries.md)
1. [Ghidra from the Command Line](BSimTutorial_Ghidra_Command_Line.md)
1. [BSim from the Command Line](BSimTutorial_BSim_Command_Line.md)
1. [Evaluating Matches](BSimTutorial_Evaluating_Matches.md)
1. [From Matching Functions to Matching Executables](BSimTutorial_Exe_Results.md)
1. [Overview Queries](BSimTutorial_Overview_Queries.md)
1. [BSim Filters](BSimTutorial_Filters.md)
1. [Scripting and Visualization](BSimTutorial_Scripting.md)

Next Section: [Introduction to BSim](BSimTutorial_Intro.md)
# BSim Filters

There are a number of filters that can be applied to BSim queries, involving names, architectures, compilers, ingest dates, user-defined executable categories, and other attributes.

Filters be can applied *server-side* or *client-side*.
Server-side filters affect the query results sent to Ghidra from a BSim server and can be applied using the **Filters** drop-down in the BSim Search dialog.
Client-side filters apply to the BSim Search results table and can be added and removed at will using the **Filter Results** icon ![Filter Results](images/exec.png).
However, to "undo" a server-side filter, you have to issue another BSim query without the filter.



## Exercise: Filters

1. Select all functions in ``postgres`` and bring up the BSim Search dialog.
1. Apply an **Executable name does not equal** filter with ``demangler_gnu_v2_41`` as the name to exclude.
1. Perform the query and verify ``demangler_gnu_v2_41`` is not in the list of executables with matches.
1. Using the **Search Info** icon ![Search Info](images/information.png) in the BSim Search Results toolbar, you can see the server-side filters applied to the query.
Verify that this information is correct.
1. Using the **Filter Results** icon ![Filter Results](images/exec.png), you can apply client-side filters to the query results. Experiment with applying and removing some client-side filters.

Next Section: [Scripting and Visualization](BSimTutorial_Scripting.md)
# Scripting and Visualization

Finally, we briefly mention a few other topics related to BSim.

## Scripting BSim

There are a number of example scripts in the ``BSim`` script category, which demonstrate how to interact with BSim programmatically.

![script manager](images/script_manager.png)

## Visualizing Features

Finally, if you'd like to see the particular BSim features in a function, you can use the BSim Feature Visualizer.
This plugin allows you to highlight regions of the decompiled code corresponding to a particular feature and to display a graph representing the feature.

To use this plugin, first enable the ``BSimFeatureVisualizerPlugin`` via **File -> Configure** from the Code Browser.
You can then bring it up via **BSim -> BSim Feature Visualizer**.

![feature visualizer](images/feature_visualizer.png)

This is the end of the tutorial.

[Return to the Beginning](README.md)