- Author
- Andreas Pehnack
- Copyright
- 2011-2012 Andreas Pehnack
Here you find all classes and methods available in Synalyze It! scripting elements
How to start
To access the objects you need you start with the global currentMapper
object of type StructureMapper.
Common task: access parsed value and set endianness
The following code placed in a script element after a number value can access this value and set the dynamic endianness parameter accordingly. All number or offset elements having set their endianness to dynamic will use this setting.
-- get collection with results so far
-- get latest added result
-- access the parsed value
-- get the value parsed
num = value:getUnsignedNumber()
if (num == 0x4949) then
else
end
-- write a message to the log window
logSrc:
logMessage(_VERSION, 111, synalysis.SEVERITY_INFO, "my message")
Common task: map structure
Depending on conditions you choose you can map different structures either at the current parsing position or at any position inside the file being processed.
-- get currently processed grammar. This may change if another grammar is referenced
-- get the structure we want to apply
-- map structure at current parsing position and add number of parsed bytes to enclosing structure
-- map structure at position \c 6 with maximum size \c 5
Manually add results
Using scripts you can add results for the results tree - structures and their elements. If the script element should be considered failed, return true
.
size = 2
-- get results collection
-- get currenly processed grammar
-- get byte view on currently processed file
-- get current offset
-- get the structure we want to add to results
-- get currently processed element (the scripting element)
element = currentMapper:getCurrentStructureElement()
-- add structure start to results with offset \c offset
-- read little endian unsigned integer (4 bytes)
-- create a value object and set as string
value = synalysis.Value()
-- add element with value to results
results:addStructureElement(element, size, 0, value)
-- add structure end to results with 4 unused (padding) bytes
-- delete added results
-- results:
cut(startResult)
-- write a log message
logSrc:
logMessage("ABC", 111, synalysis.SEVERITY_INFO, "Message from Script")
return false
Modify one byte in reference file
Scripts can modify reference files. These changes can be reverted like the manual ones.
-- get byte array currently processed
-- insert byte 33 (0x21) at position 2 (3rd byte)
-- replace byte at position 1 (2nd byte) with 15 (0x0F)