dlldiag/subcommands/graph.py
def printSummary(graph, extendedDetails):
		'''
		Prints a summary of the supplied call hierarchy graph
		'''
		
		# Iterate over each module
		for vertex in graph:
			
			# Ignore the "NULL" vertex that is used to represent failed LoadLibrary() calls
			if vertex == 'NULL':
				continue
			
			# Print the module name
			print('{}:'.format(colored(vertex, color='cyan', attrs=['bold'])))
			
			# Gather the list of pretty-printed function calls so we can filter out duplicates
			printed = []
			
			# If we are displaying extended details then print the details of the module's calls that are not LoadLibrary() calls
			if extendedDetails == True:
				
				# Keep track of the cookie values used by AddDllDirectory() and RemoveDllDirectory()
				cookies = {}
				
				# Iterate over the non-LoadLibrary calls
				calls = nx.get_node_attributes(graph, 'non_loadlibrary_calls')[vertex]
				for call in calls:
					
					# Determine which function we are dealing with, since we pretty print them with different formats
					if call['function'] == 'SetDefaultDllDirectories':
						printed.append('    {} [{}] -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							GraphHelpers.formatFlags(call['arguments'][0]),
							GraphHelpers.formatReturnValue(call)
						))
					
					elif call['function'] in ['SetDllDirectoryA', 'SetDllDirectoryW']:
						printed.append('    {} "{}" -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							GraphHelpers.formatReturnValue(call)
						))
						
					elif call['function'] == 'AddDllDirectory':
						
						# Add the returned cookie to our list
						cookies[call['result']] = call['arguments'][0]
						
						printed.append('    {} "{}" -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							GraphHelpers.formatReturnValue(call)
						))
					
					elif call['function'] == 'RemoveDllDirectory':
						
						# Retrieve the passed cookie from our list
						cookie = cookies.get(call['arguments'][0], '<UNKNOWN>')
						
						printed.append('    {} {} ("{}") -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							cookie,
							GraphHelpers.formatReturnValue(call)
						))
			
			# Iterate over the edges for the module's LoadLibrary() and LdrLoadDll() calls
			neighbours = graph[vertex]
			if len(neighbours) == 0:
				printed.append('    This module did not load any libraries.')
			else:
				for _, edges in neighbours.items():
					for _, edge in edges.items():
						
						# Determine if we are annotating the call with any special information
						details = edge['details']
						annotations = []
						if extendedDetails == True:
							if details['function'] == 'LdrLoadDll' and details['module'].upper() in ['C:\WINDOWS\SYSTEM32\DXGI.DLL', 'C:\WINDOWS\SYSTEM32\D3D12CORE.DLL'] and 'DriverStore' in details['result']:
								annotations.append('DirectX UMD')
						
						# Determine if we are printing the search flags for the call
						flags = ''
						if extendedDetails == True and (details['function'].startswith('LoadLibraryEx') or details['function'] == 'LdrLoadDll'):
							flags = ' [{}]'.format(GraphHelpers.formatFlags(
								details['arguments'][1] if details['function'] == 'LdrLoadDll' else details['arguments'][2]
							))
						
						# Print the call details with pretty formatting
						printed.append('    {}{} "{}"{} -> {}'.format(
							(GraphHelpers.formatAnnotations(annotations) + ' ') if len(annotations) > 0 else '',
							GraphHelpers.formatFunctionName(details),
							details['arguments'][0],
							flags,
							GraphHelpers.formatReturnValue(details, successCondition = lambda e: e['result'] != 'NULL')
						))
			
			# Print all unique output lines, preserving their ordering
			print('\n'.join(list(OrderedDict.fromkeys(printed))))
			
			# Print a blank line after each module's call list
			print()

		Prints a summary of the supplied call hierarchy graph
		
Prints a summary of the supplied call hierarchy graph
Prints a summary of the supplied call hierarchy graph
def printSummary(graph, extendedDetails):
		for vertex in graph:
			if vertex == 'NULL':
				continue
			print('{}:'.format(colored(vertex, color='cyan', attrs=['bold'])))
			printed = []
			if extendedDetails == True:
				cookies = {}
				calls = nx.get_node_attributes(graph, 'non_loadlibrary_calls')[vertex]
				for call in calls:
					if call['function'] == 'SetDefaultDllDirectories':
						printed.append('    {} [{}] -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							GraphHelpers.formatFlags(call['arguments'][0]),
							GraphHelpers.formatReturnValue(call)
						))
					elif call['function'] in ['SetDllDirectoryA', 'SetDllDirectoryW']:
						printed.append('    {} "{}" -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							GraphHelpers.formatReturnValue(call)
						))
					elif call['function'] == 'AddDllDirectory':
						cookies[call['result']] = call['arguments'][0]
						printed.append('    {} "{}" -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							GraphHelpers.formatReturnValue(call)
						))
					elif call['function'] == 'RemoveDllDirectory':
						cookie = cookies.get(call['arguments'][0], '<UNKNOWN>')
						printed.append('    {} {} ("{}") -> {}'.format(
							GraphHelpers.formatFunctionName(call),
							call['arguments'][0],
							cookie,
							GraphHelpers.formatReturnValue(call)
						))
			neighbours = graph[vertex]
			if len(neighbours) == 0:
				printed.append('    This module did not load any libraries.')
			else:
				for _, edges in neighbours.items():
					for _, edge in edges.items():
						details = edge['details']
						annotations = []
						if extendedDetails == True:
							if details['function'] == 'LdrLoadDll' and details['module'].upper() in ['C:\WINDOWS\SYSTEM32\DXGI.DLL', 'C:\WINDOWS\SYSTEM32\D3D12CORE.DLL'] and 'DriverStore' in details['result']:
								annotations.append('DirectX UMD')
						flags = ''
						if extendedDetails == True and (details['function'].startswith('LoadLibraryEx') or details['function'] == 'LdrLoadDll'):
							flags = ' [{}]'.format(GraphHelpers.formatFlags(
								details['arguments'][1] if details['function'] == 'LdrLoadDll' else details['arguments'][2]
							))
						printed.append('    {}{} "{}"{} -> {}'.format(
							(GraphHelpers.formatAnnotations(annotations) + ' ') if len(annotations) > 0 else '',
							GraphHelpers.formatFunctionName(details),
							details['arguments'][0],
							flags,
							GraphHelpers.formatReturnValue(details, successCondition = lambda e: e['result'] != 'NULL')
						))
			print('\n'.join(list(OrderedDict.fromkeys(printed))))
			print()
def printSummary ( graph , extendedDetails ) : for vertex in graph : if vertex == 'NULL' : continue print ( '{}:' . format ( colored ( vertex , color = 'cyan' , attrs = [ 'bold' ] ) ) ) printed = [ ] if extendedDetails == True : cookies = { } calls = nx . get_node_attributes ( graph , 'non_loadlibrary_calls' ) [ vertex ] for call in calls : if call [ 'function' ] == 'SetDefaultDllDirectories' : printed . append ( '    {} [{}] -> {}' . format ( GraphHelpers . formatFunctionName ( call ) , GraphHelpers . formatFlags ( call [ 'arguments' ] [ 0 ] ) , GraphHelpers . formatReturnValue ( call ) ) ) elif call [ 'function' ] in [ 'SetDllDirectoryA' , 'SetDllDirectoryW' ] : printed . append ( '    {} "{}" -> {}' . format ( GraphHelpers . formatFunctionName ( call ) , call [ 'arguments' ] [ 0 ] , GraphHelpers . formatReturnValue ( call ) ) ) elif call [ 'function' ] == 'AddDllDirectory' : cookies [ call [ 'result' ] ] = call [ 'arguments' ] [ 0 ] printed . append ( '    {} "{}" -> {}' . format ( GraphHelpers . formatFunctionName ( call ) , call [ 'arguments' ] [ 0 ] , GraphHelpers . formatReturnValue ( call ) ) ) elif call [ 'function' ] == 'RemoveDllDirectory' : cookie = cookies . get ( call [ 'arguments' ] [ 0 ] , '<UNKNOWN>' ) printed . append ( '    {} {} ("{}") -> {}' . format ( GraphHelpers . formatFunctionName ( call ) , call [ 'arguments' ] [ 0 ] , cookie , GraphHelpers . formatReturnValue ( call ) ) ) neighbours = graph [ vertex ] if len ( neighbours ) == 0 : printed . append ( '    This module did not load any libraries.' ) else : for _ , edges in neighbours . items ( ) : for _ , edge in edges . items ( ) : details = edge [ 'details' ] annotations = [ ] if extendedDetails == True : if details [ 'function' ] == 'LdrLoadDll' and details [ 'module' ] . upper ( ) in [ 'C:\WINDOWS\SYSTEM32\DXGI.DLL' , 'C:\WINDOWS\SYSTEM32\D3D12CORE.DLL' ] and 'DriverStore' in details [ 'result' ] : annotations . append ( 'DirectX UMD' ) flags = '' if extendedDetails == True and ( details [ 'function' ] . startswith ( 'LoadLibraryEx' ) or details [ 'function' ] == 'LdrLoadDll' ) : flags = ' [{}]' . format ( GraphHelpers . formatFlags ( details [ 'arguments' ] [ 1 ] if details [ 'function' ] == 'LdrLoadDll' else details [ 'arguments' ] [ 2 ] ) ) printed . append ( '    {}{} "{}"{} -> {}' . format ( ( GraphHelpers . formatAnnotations ( annotations ) + ' ' ) if len ( annotations ) > 0 else '' , GraphHelpers . formatFunctionName ( details ) , details [ 'arguments' ] [ 0 ] , flags , GraphHelpers . formatReturnValue ( details , successCondition = lambda e : e [ 'result' ] != 'NULL' ) ) ) print ( '\n' . join ( list ( OrderedDict . fromkeys ( printed ) ) ) ) print ( )
Prints a summary of the supplied call hierarchy graph
Prints a summary of the supplied call hierarchy graph
'''
		Prints a summary of the supplied call hierarchy graph
		''' # Iterate over each module # Ignore the "NULL" vertex that is used to represent failed LoadLibrary() calls # Print the module name # Gather the list of pretty-printed function calls so we can filter out duplicates # If we are displaying extended details then print the details of the module's calls that are not LoadLibrary() calls # Keep track of the cookie values used by AddDllDirectory() and RemoveDllDirectory() # Iterate over the non-LoadLibrary calls # Determine which function we are dealing with, since we pretty print them with different formats # Add the returned cookie to our list # Retrieve the passed cookie from our list # Iterate over the edges for the module's LoadLibrary() and LdrLoadDll() calls # Determine if we are annotating the call with any special information # Determine if we are printing the search flags for the call # Print the call details with pretty formatting # Print all unique output lines, preserving their ordering # Print a blank line after each module's call list
graph
extendedDetails