Skip to content

Custom use cases

Jump to bottom
projectbtle edited this page Jan 1, 2021 · 2 revisions

If you want to configure argXtract to test for API calls that have not been provided in this repo, then you will need to:

  1. Create a vendor-specific folder.
  2. Create a chipset-analyser.py file.
  3. Provide mechanisms for argXtract to identify the API calls within disassembled code. This process is simple if the API calls are translated to svc instructions and less simple if they are normal function calls.
  4. Specify the argument structures within argument defintion files.

If you're interested only in extending the range of API calls for an existing vendor, then you can skip steps 1 and 2. The example below assumes creating a new use case from scratch.

Illustrative example

To better illustrate how to configure argXtract for custom use cases, we will use an artificial example. We will assume we are interested in an API call that we name ExampleAPICall, from a vendor ExampleVendor.

1. Create a vendor-specific folder

The first step is to create a folder: <root>/argxtract/resources/vendor/ExampleVendor/.

Create a subfolder named args, i.e., <root>/argxtract/resources/vendor/ExampleVendor/args/.

If ExampleAPICall is a normal function call, then also create a subfolder named fpfs within the vendor folder: <root>/argxtract/resources/vendor/ExampleVendor/fpfs/. If ExampleAPICall gets translated to a supervisor call (i.e., svc instruction), then this can be skipped. We will describe both possibilities.

2. Create a chipset-analyser.py file

Copy the chipset_analyser.py file from <root>/argxtract/resources/vendor/stm to <root>/argxtract/resources/vendor/ExampleVendor/. If you want to perform vendor/chipset-specific tests, you can modify the relevant parts within the file. Otherwise, leave it as it is for now.

3. Provide mechanisms for argXtract to identify the API calls within disassembled code.

If ExampleAPICall gets translated to a supervisor call (i.e., svc instruction), then go to SVC mode.

If ExampleAPICall is a normal function call, then go to Function mode

4. Specify the argument structures within argument defintion files

See Argument definitions

argxtract_small

Clone this wiki locally