Skip to content

Commit

Permalink
feat: Allow negative token values in Hash Lookup
Browse files Browse the repository at this point in the history
Although this isn't officially in the documentation, I've found that the
`value` property of an `InstructionTextToken` of type `IntegerToken`
already always gives the unsigned interpretation of its value,
regardless of how the user is currently displaying it.

Therefore, this should already do what we want in #13, which is to,
when performing a hash lookup or hunt, interpret the 4 bytes backing a
negative `int32_t` value as a `uint32_t`, and to intepret the 8 bytes
backing a negative `int64_t` value as a `uint64_t`.

We can simply remove the warnings. Add some debug logging here as well,
so that we can get some feedback from the logs if there is an issue.

Closes #13.
  • Loading branch information
cxiao committed Jan 29, 2023
1 parent 1810484 commit c4114de
Showing 1 changed file with 2 additions and 8 deletions.
10 changes: 2 additions & 8 deletions actions.py
Original file line number Diff line number Diff line change
Expand Up @@ -309,10 +309,7 @@ def hash_lookup(context: UIActionContext) -> None:
if context.token.token:
token = context.token.token
if token.type == InstructionTextTokenType.IntegerToken:
if token.text.startswith("-"):
# Handle negatives later
logger.log_warn("Plugin does not currently handle negative values.")
return
logger.log_debug(f"Integer token found: {token.value:#x}")
hash_value = token.value

HashLookupTask(
Expand Down Expand Up @@ -761,10 +758,7 @@ def hunt_algorithm(context: UIActionContext) -> None:
if context.token.token:
token = context.token.token
if token.type == InstructionTextTokenType.IntegerToken:
if token.text.startswith("-"):
# Handle negatives later
logger.log_warn("Plugin does not currently handle negative values.")
return
logger.log_debug(f"Integer token found: {token.value:#x}")
hash_value = token.value
HuntAlgorithmTask(bv, hashdb_api_url, hash_value).start()
else:
Expand Down

0 comments on commit c4114de

Please sign in to comment.