Author: ero

# Views: 2212

• modules, which holds the information about all the disassemblies in the database, the name of the file, the date it was imported and a comment field

• functions, containing all the functions in the disassembly and specifying their address name and type


• basic_blocks, all the basic blocks in the disassembly and their parent function


• instructions, the instructions making the basic blocks. Contains the data making up the instruction together with its address, mnemonic and parent basic block


• callgraph relates all callers and callees


• control_flow_graph expresses all the links between basic blocks


• operand_strings contains the operand strings as shown by IDA


• expression_tree represents all expressions composing the operands as a tree


• operand_tuples maps addresses to the operands used by the instruction at such location


• expression_substitutions allows to replace any part of the expression tree of an operand with a string, variable names are handled through this table


• operand_expressions relates the operands to the expressions composing them


• address_references contains all references, both to code and data labeled with their type


• sections holds the raw data for the section composing the binary source for the disassembly

• Supports multiple modules in a single database


• Instruction operands are stored as trees, which enables it to support a variety of architectures, efficient storage and advanced querying


• Use of SQL statements to perform advanced analysis and data-mining


• The exporter module from IDA to the SQL schema currently supports METAPC(x86), PPC and ARM exporting (the latter two are still in beta). More will be added in the future.

Some query examples

SELECT * FROM modules

SELECT count(address) FROM functions

SELECT count(address) FROM basic_blocks

SELECT count(DISTINCT(address)) FROM basic_blocks;

SELECT mnemonic, COUNT(mnemonic) as mnem_count FROM instructions GROUP BY mnemonic ORDER BY mnem_count;