stephenfewer

# Hold the write lock and disable auto analysis until
# we complete our synchronized operation.
cm.synchronize_analyze do
    # Create a new segment
    segment = cm.add_segment(
        "test", # name
        cm.last_segment.last_rva + 4096, # rva
        4096, # initialized length
        1024, # uninitialized length
        true, # readable

stephenfewer

#
# Run via the command line with the following command (Note: All paths must be absolute and plugin_commandline paths must be double slashed):
#
# "c:\Program Files\Relyze\relyze.exe" /run /plugin "{1BD45FB7-9907-4683-B2C4-B6AB8E15D510}" /log "C:\Testing\log.txt" /plugin_commandline "/infile=C:\\Testing\\Samples\\foo.exe /outdot=C:\\Testing\\Samples\\foo.dot"
#
require 'relyze/core'

class Plugin < Relyze::Plugin::Analysis

    def initialize

stephenfewer

# To use this plugin:
#   * Copy this plugin file to your Relyze Plugins folder (e.g. C:\Users\<username>\Documents\Relyze\Plugins\)
#   * Either restart Relyze.exe or right click in the Plugins view and select 'Reload all Plugins'
#   * Open the file you want to analyze and tick this plugin in the loader options 

require 'relyze/core'

class Plugin < Relyze::Plugin::Analysis

    def initialize

stephenfewer

processed_names    = ::Set.new
processed_comments = ::Set.new
# cm will be the current model (A Relyze::ExecutableFileModel object), we 
# hold the models read lock while we process the results...
cm.synchronize_read do
	# First we pull out the existing differential analysis results that
	# are being displayed in the GUI. We could however create the diff
	# results programmatically by calling the models diff() method.
	dr = @relyze.tab_current_diff
	if( dr.nil? )

stephenfewer

require 'relyze/core'

class Plugin < Relyze::Plugin::Analysis

    def initialize
        super( {
            :guid        => '{75A2197C-4A3C-4B29-A526-5DCE6BE63EFD}',
            :name        => 'Test Plugin Entrypoints',
            :description => 'Test the various entrypoint',
            :authors     => [ 'Relyze Software Limited' ],

stephenfewer

# Simple example to color an instruction based on its EFLAGS access.
 
def run
	result = cm.synchronize_write do
		# Pull out the RVA of the function the user has selected in the GUI
		func_rva = @relyze.tab_current_function_rva( cm ) || (break 'No function selected')
		# Pull out the corresponding function object
		func = cm.function( func_rva ) || (break 'Function not found')
		# Iterate over every block in the function
		func.blocks do | block |

stephenfewer

# Simple example to color every instruction in a function that writes to memory.

def run
	result = cm.synchronize_write do
		# Pull out the RVA of the function the user has selected in the GUI
		func_rva = @relyze.tab_current_function_rva( cm ) || (break 'No function selected')
		# Pull out the corresponding function object
		func = cm.function( func_rva ) || (break 'Function not found')
		# Iterate over every block in the function
		func.blocks do | block |