Quokka

ProgramBackendQuokka

class qbindiff.loader.backend.quokka.ProgramBackendQuokka(export_path: str, exec_path: str)[source]

Bases: AbstractProgramBackend

Backend loader of a Program using Quokka

property callgraph: DiGraph

The callgraph of the program

property capabilities: ProgramCapability

Returns the supported capabilities

property exec_path: str

Returns the executable path

property fun_names: dict[str, int]

Returns a dictionary with function name as key and the function address as value

property functions: Iterator[FunctionBackendQuokka]

Returns an iterator over backend function objects

get_structure(name: str) Structure[source]

Returns structure identified by the name

property name: str

The name of the program.

property structures: list[Structure]

Returns the list of structures defined in program

property structures_by_name: dict[str, Structure]

Returns the dictionary {name: structure}

FunctionBackendQuokka

class qbindiff.loader.backend.quokka.FunctionBackendQuokka(program: ReferenceType[ProgramBackendQuokka], qb_func: Function)[source]

Bases: AbstractFunctionBackend

Backend loader of a Function using Quokka

property addr: int

The address of the function

property basic_blocks: Iterator[BasicBlockBackendQuokka]

Returns an iterator over backend basic blocks objects

Returns:

Iterator over the Quokka Basic Blocks

property children: set[int]

Set of function children in the call graph

property graph: DiGraph

The Control Flow Graph of the function

is_import() bool[source]

True if the function is imported

Returns:

whether the fonction is imported

property name: str

The name of the function

property parents: set[int]

Set of function parents in the call graph

property type: FunctionType

The type of the function (as defined by IDA)

unload_blocks() None

Unload basic blocks from memory

BasicBlockBackendQuokka

class qbindiff.loader.backend.quokka.BasicBlockBackendQuokka(program: ReferenceType[ProgramBackendQuokka], qb_block: Block)[source]

Bases: AbstractBasicBlockBackend

Backend loader of a BasicBlock using Quokka

property addr: int

The address of the basic block

property bytes: bytes

Returns the bytes representation of the basic block

property instructions: Iterator[InstructionBackendQuokka]

Returns an iterator over backend instruction objects

Returns:

iterator over Quokka instructions

InstructionBackendQuokka

class qbindiff.loader.backend.quokka.InstructionBackendQuokka(program: ReferenceType[ProgramBackendQuokka], qb_instruction: Instruction)[source]

Bases: AbstractInstructionBackend

Backend loader of a Instruction using Quokka

MAX_ID = 3000

Max instruction ID. All the instruction IDs will be in the range [0, MAX_ID]

property addr: int

The address of the instruction

property bytes: bytes

Returns the bytes representation of the instruction

property comment: str

Comment associated with the instruction

property groups: list[InstructionGroup]

Returns a list of groups of this instruction.

property id: int

Returns the capstone instruction ID as a non negative int. The ID is in the range [0, MAX_ID]. The id is MAX_ID if there is no capstone instruction available.

property mnemonic: str

Returns the instruction mnemonic as a string

property operands: Iterator[OperandBackendQuokka]

Returns an iterator over backend operand objects

Returns:

list of Quokka operands

property pcode_ops: list[PcodeOp]

List of PcodeOp associated with the instruction. Provided with the PCODE capability

property program: ProgramBackendQuokka

Wrapper on weak reference on ProgramBackendQuokka

property references: dict[ReferenceType, list[Data | Structure | StructureMember]]

Returns all the references towards the instruction

Returns:

dictionary with reference type as key and the corresponding references list as values

OperandBackendQuokka

class qbindiff.loader.backend.quokka.OperandBackendQuokka(program: ReferenceType[ProgramBackendQuokka], cs_instruction: CsInsn, cs_operand: Any, cs_operand_position: int)[source]

Bases: AbstractOperandBackend

Backend loader of an Operand using Quokka

is_immediate() bool[source]

Returns whether the operand is an immediate value (not considering addresses)

property program: ProgramBackendQuokka

Wrapper on weak reference on ProgramBackendQuokka

property type: OperandType

Returns the capstone operand type

property value: int | None

Returns the immediate value (not addresses).