mirror of
https://github.com/NationalSecurityAgency/ghidra.git
synced 2025-10-04 18:29:37 +02:00
Merge remote-tracking branch 'origin/caheckman_pushvalue' into
caheckman_loadguard
This commit is contained in:
caheckman
commit
e1507d05ec
13 changed files with 2496 additions and 461 deletions
|
|
@ -696,6 +696,34 @@ int4 mostsigbit_set(uintb val)
|
|||
return res;
|
||||
}
|
||||
|
||||
/// Count the number of more significant zero bits before the most significant
|
||||
/// one bit in the representation of the given value;
|
||||
/// \param val is the given value
|
||||
/// \return the number of zero bits
|
||||
int4 count_leading_zeros(uintb val)
|
||||
|
||||
{
|
||||
if (val == 0)
|
||||
return 8*sizeof(uintb);
|
||||
uintb mask = ~((uintb)0);
|
||||
int4 maskSize = 4*sizeof(uintb);
|
||||
mask &= (mask << maskSize);
|
||||
int4 bit = 0;
|
||||
|
||||
do {
|
||||
if ((mask & val)==0) {
|
||||
bit += maskSize;
|
||||
maskSize >>= 1;
|
||||
mask |= (mask >> maskSize);
|
||||
}
|
||||
else {
|
||||
maskSize >>= 1;
|
||||
mask &= (mask << maskSize);
|
||||
}
|
||||
} while(maskSize != 0);
|
||||
return bit;
|
||||
}
|
||||
|
||||
/// Return smallest number of form 2^n-1, bigger or equal to the given value
|
||||
/// \param val is the given value
|
||||
/// \return the mask
|
||||
|
|
|
|||
|
|
@ -482,7 +482,7 @@ inline uintb pcode_left(uintb val,int4 sa) {
|
|||
return val << sa;
|
||||
}
|
||||
|
||||
extern bool signbit_negative(uintb val,int4 size); ///< Return true if the sign-big is set
|
||||
extern bool signbit_negative(uintb val,int4 size); ///< Return true if the sign-bit is set
|
||||
extern uintb calc_mask(int4 size); ///< Calculate a mask for a given byte size
|
||||
extern uintb uintb_negate(uintb in,int4 size); ///< Negate the \e sized value
|
||||
extern uintb sign_extend(uintb in,int4 sizein,int4 sizeout); ///< Sign-extend a value between two byte sizes
|
||||
|
|
@ -493,7 +493,8 @@ extern void byte_swap(intb &val,int4 size); ///< Swap bytes in the given value
|
|||
|
||||
extern uintb byte_swap(uintb val,int4 size); ///< Return the given value with bytes swapped
|
||||
extern int4 leastsigbit_set(uintb val); ///< Return index of least significant bit set in given value
|
||||
extern int4 mostsigbit_set(uintb val); ///< Return index of most significant bit set in given val
|
||||
extern int4 mostsigbit_set(uintb val); ///< Return index of most significant bit set in given value
|
||||
extern int4 count_leading_zeros(uintb val); ///< Return the number of leading zero bits in the given value
|
||||
|
||||
extern uintb coveringmask(uintb val); ///< Return a mask that \e covers the given value
|
||||
extern int4 bit_transitions(uintb val,int4 sz); ///< Calculate the number of bit transitions in the sized value
|
||||
|
|
|
|||
|
|
@ -369,6 +369,31 @@ bool FlowBlock::dominates(const FlowBlock *subBlock) const
|
|||
return false;
|
||||
}
|
||||
|
||||
/// \brief Check if the condition from the given block holds for \b this block
|
||||
///
|
||||
/// We assume the given block has 2 out-edges and that \b this block is immediately reached by
|
||||
/// one of these two edges. Some condition holds when traversing the out-edge to \b this, and the complement
|
||||
/// of the condition holds for traversing the other out-edge. We verify that the condition holds for
|
||||
/// this entire block. More specifically, we check that that there is no path to \b this through the
|
||||
/// sibling edge, where the complement of the condition holds (unless we loop back through the conditional block).
|
||||
/// \param cond is the conditional block with 2 out-edges
|
||||
/// \return \b true if the condition holds for this block
|
||||
bool FlowBlock::restrictedByConditional(const FlowBlock *cond) const
|
||||
|
||||
{
|
||||
if (sizeIn() == 1) return true; // Its impossible for any path to come through sibling to this
|
||||
if (getImmedDom() != cond) return false; // This is not dominated by conditional block at all
|
||||
for(int4 i=0;i<sizeIn();++i) {
|
||||
const FlowBlock *inBlock = getIn(i);
|
||||
if (inBlock == cond) continue; // The unique edge from cond to this
|
||||
while(inBlock != this) {
|
||||
if (inBlock == cond) return false; // Must have come through sibling
|
||||
inBlock = inBlock->getImmedDom();
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/// \return \b true if \b this is the top of a loop
|
||||
bool FlowBlock::hasLoopIn(void) const
|
||||
|
||||
|
|
|
|||
|
|
@ -215,6 +215,7 @@ public:
|
|||
FlowBlock *getFrontLeaf(void); ///< Get the first leaf FlowBlock
|
||||
int4 calcDepth(const FlowBlock *leaf) const; ///< Get the depth of the given component FlowBlock
|
||||
bool dominates(const FlowBlock *subBlock) const; ///< Does \b this block dominate the given block
|
||||
bool restrictedByConditional(const FlowBlock *cond) const;
|
||||
int4 sizeOut(void) const { return outofthis.size(); } ///< Get the number of out edges
|
||||
int4 sizeIn(void) const { return intothis.size(); } ///< Get the number of in edges
|
||||
bool hasLoopIn(void) const; ///< Is there a looping edge coming into \b this block
|
||||
|
|
|
|||
|
|
@ -3246,7 +3246,7 @@ int4 ActionConditionalConst::apply(Funcdata &data)
|
|||
if (flipEdge)
|
||||
constEdge = 1 - constEdge;
|
||||
FlowBlock *constBlock = bl->getOut(constEdge);
|
||||
if (constBlock->sizeIn() != 1) continue; // Must only be one path to constant block directly through CBRANCH
|
||||
if (!constBlock->restrictedByConditional(bl)) continue; // Make sure condition holds
|
||||
propagateConstant(varVn,constVn,constBlock,data);
|
||||
}
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -129,6 +129,7 @@ void IfaceDecompCapability::registerCommands(IfaceStatus *status)
|
|||
status->registerCom(new IfcVolatile(),"volatile");
|
||||
status->registerCom(new IfcPreferSplit(),"prefersplit");
|
||||
status->registerCom(new IfcStructureBlocks(),"structure","blocks");
|
||||
status->registerCom(new IfcAnalyzeRange(), "analyze","range");
|
||||
#ifdef CPUI_RULECOMPILE
|
||||
status->registerCom(new IfcParseRule(),"parse","rule");
|
||||
status->registerCom(new IfcExperimentalRules(),"experimental","rules");
|
||||
|
|
@ -2474,6 +2475,56 @@ void IfcCountPcode::execute(istream &s)
|
|||
*status->optr << "Count - pcode = " << dec << count << endl;
|
||||
}
|
||||
|
||||
void IfcAnalyzeRange::execute(istream &s)
|
||||
|
||||
{
|
||||
if (dcp->conf == (Architecture *)0)
|
||||
throw IfaceExecutionError("Image not loaded");
|
||||
if (dcp->fd == (Funcdata *)0)
|
||||
throw IfaceExecutionError("No function selected");
|
||||
|
||||
bool useFullWidener;
|
||||
string token;
|
||||
s >> ws >> token;
|
||||
if (token == "full")
|
||||
useFullWidener = true;
|
||||
else if (token == "partial") {
|
||||
useFullWidener = false;
|
||||
}
|
||||
else
|
||||
throw IfaceParseError("Must specify \"full\" or \"partial\" widening");
|
||||
Varnode *vn = iface_read_varnode(dcp,s);
|
||||
vector<Varnode *> sinks;
|
||||
vector<PcodeOp *> reads;
|
||||
sinks.push_back(vn);
|
||||
for(list<PcodeOp *>::const_iterator iter=vn->beginDescend();iter!=vn->endDescend();++iter) {
|
||||
PcodeOp *op = *iter;
|
||||
if (op->code() == CPUI_LOAD || op->code() == CPUI_STORE)
|
||||
reads.push_back(op);
|
||||
}
|
||||
Varnode *stackReg = dcp->fd->findSpacebaseInput(dcp->conf->getStackSpace());
|
||||
ValueSetSolver vsSolver;
|
||||
vsSolver.establishValueSets(sinks, reads, stackReg, false);
|
||||
if (useFullWidener) {
|
||||
WidenerFull widener;
|
||||
vsSolver.solve(10000,widener);
|
||||
}
|
||||
else {
|
||||
WidenerNone widener;
|
||||
vsSolver.solve(10000,widener);
|
||||
}
|
||||
list<ValueSet>::const_iterator iter;
|
||||
for(iter=vsSolver.beginValueSets();iter!=vsSolver.endValueSets();++iter) {
|
||||
(*iter).printRaw(*status->optr);
|
||||
*status->optr << endl;
|
||||
}
|
||||
map<SeqNum,ValueSetRead>::const_iterator riter;
|
||||
for(riter=vsSolver.beginValueSetReads();riter!=vsSolver.endValueSetReads();++riter) {
|
||||
(*riter).second.printRaw(*status->optr);
|
||||
*status->optr << endl;
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef OPACTION_DEBUG
|
||||
|
||||
void IfcDebugAction::execute(istream &s)
|
||||
|
|
|
|||
|
|
@ -541,6 +541,11 @@ public:
|
|||
virtual void execute(istream &s);
|
||||
};
|
||||
|
||||
class IfcAnalyzeRange : public IfaceDecompCommand {
|
||||
public:
|
||||
virtual void execute(istream &s);
|
||||
};
|
||||
|
||||
#ifdef CPUI_RULECOMPILE
|
||||
class IfcParseRule : public IfaceDecompCommand {
|
||||
public:
|
||||
|
|
|
|||
|
|
@ -231,11 +231,19 @@ void EmulateFunction::collectLoadPoints(vector<LoadTable> &res) const
|
|||
}
|
||||
}
|
||||
|
||||
/// The starting value for the range and the step is preserved. The
|
||||
/// ending value is set so there are exactly the given number of elements
|
||||
/// in the range.
|
||||
/// \param nm is the given number
|
||||
void JumpValuesRange::truncate(int4 nm)
|
||||
|
||||
{
|
||||
// FIXME: This doesn't work if there is a stride
|
||||
range = CircleRange(range.getMin(),range.getMin() + (nm-1),range.getMask());
|
||||
int4 rangeSize = 8*sizeof(uintb) - count_leading_zeros(range.getMask());
|
||||
rangeSize >>= 3;
|
||||
uintb left = range.getMin();
|
||||
int4 step = range.getStep();
|
||||
uintb right = (left + step * nm) & range.getMask();
|
||||
range.setRange(left, right, rangeSize, step);
|
||||
}
|
||||
|
||||
uintb JumpValuesRange::getSize(void) const
|
||||
|
|
@ -403,18 +411,21 @@ bool JumpBasic::ispoint(Varnode *vn)
|
|||
return true;
|
||||
}
|
||||
|
||||
void JumpBasic::setStride(Varnode *vn,CircleRange &rng)
|
||||
/// If the some of the least significant bits of the given Varnode are known to
|
||||
/// be zero, translate this into a stride for the jumptable range.
|
||||
/// \param vn is the given Varnode
|
||||
/// \return the calculated stride = 1,2,4,...
|
||||
int4 JumpBasic::getStride(Varnode *vn)
|
||||
|
||||
{
|
||||
uintb mask = vn->getNZMask();
|
||||
int4 stride = 0;
|
||||
int4 stride = 1;
|
||||
while((mask&1)==0) {
|
||||
mask >>= 1;
|
||||
stride += 1;
|
||||
stride <<= 1;
|
||||
}
|
||||
if (stride==0) return;
|
||||
if (stride > 6) return;
|
||||
rng.setStride(stride);
|
||||
if (stride > 32) return 1;
|
||||
return stride;
|
||||
}
|
||||
|
||||
uintb JumpBasic::backup2Switch(Funcdata *fd,uintb output,Varnode *outvn,Varnode *invn)
|
||||
|
|
@ -915,23 +926,25 @@ void JumpBasic::calcRange(Varnode *vn,CircleRange &rng) const
|
|||
// by using the precalculated guard ranges.
|
||||
|
||||
// Get an initial range, based on the size/type of -vn-
|
||||
int4 stride = 1;
|
||||
if (vn->isConstant())
|
||||
rng = CircleRange(vn->getOffset(),vn->getSize());
|
||||
else if (vn->isWritten() && vn->getDef()->isBoolOutput())
|
||||
rng = CircleRange(0,1,1); // Only 0 or 1 possible
|
||||
rng = CircleRange(0,2,1,1); // Only 0 or 1 possible
|
||||
else { // Should we go ahead and use nzmask in all cases?
|
||||
uintb mask = calc_mask(vn->getSize());
|
||||
uintb maxValue = 0; // Every possible value
|
||||
if (vn->isWritten()) {
|
||||
PcodeOp *andop = vn->getDef();
|
||||
if (andop->code() == CPUI_INT_AND) {
|
||||
Varnode *constvn = andop->getIn(1);
|
||||
if (constvn->isConstant()) {
|
||||
mask = coveringmask( constvn->getOffset() );
|
||||
maxValue = coveringmask( constvn->getOffset() );
|
||||
maxValue = (maxValue + 1) & calc_mask(vn->getSize());
|
||||
}
|
||||
}
|
||||
}
|
||||
rng = CircleRange(0,mask,mask);
|
||||
setStride(vn,rng);
|
||||
stride = getStride(vn);
|
||||
rng = CircleRange(0,maxValue,vn->getSize(),stride);
|
||||
}
|
||||
|
||||
// Intersect any guard ranges which apply to -vn-
|
||||
|
|
@ -950,7 +963,7 @@ void JumpBasic::calcRange(Varnode *vn,CircleRange &rng) const
|
|||
// in which case the guard might not check for it. If the
|
||||
// size is too big, we try only positive values
|
||||
if (rng.getSize() > 0x10000) {
|
||||
CircleRange positive(0,rng.getMask()>>1,rng.getMask());
|
||||
CircleRange positive(0,(rng.getMask()>>1)+1,vn->getSize(),stride);
|
||||
positive.intersect(rng);
|
||||
if (!positive.isEmpty())
|
||||
rng = positive;
|
||||
|
|
|
|||
|
|
@ -145,7 +145,7 @@ public:
|
|||
void setRange(const CircleRange &rng) { range = rng; }
|
||||
void setStartVn(Varnode *vn) { normqvn = vn; }
|
||||
void setStartOp(PcodeOp *op) { startop = op; }
|
||||
virtual void truncate(int4 nm);
|
||||
virtual void truncate(int4 nm); ///< Truncate the number of values to the given number
|
||||
virtual uintb getSize(void) const;
|
||||
virtual bool contains(uintb val) const;
|
||||
virtual bool initializeForReading(void) const;
|
||||
|
|
@ -233,7 +233,7 @@ protected:
|
|||
Varnode *switchvn; // The unnormalized switch varnode
|
||||
static bool isprune(Varnode *vn);
|
||||
static bool ispoint(Varnode *vn);
|
||||
static void setStride(Varnode *vn,CircleRange &rng);
|
||||
static int4 getStride(Varnode *vn); ///< Get the step/stride associated with the Varnode
|
||||
static uintb backup2Switch(Funcdata *fd,uintb output,Varnode *outvn,Varnode *invn);
|
||||
void findDeterminingVarnodes(PcodeOp *op,int4 slot);
|
||||
void analyzeGuards(BlockBasic *bl,int4 pathout);
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -51,35 +51,269 @@ class CircleRange {
|
|||
uintb mask; ///< Bit mask defining the size (modulus) and stop of the range
|
||||
bool isempty; ///< \b true if set is empty
|
||||
int4 step; ///< Explicit step size
|
||||
int4 shift; ///< Number of bits in step. Equal to log2(step)
|
||||
static const char arrange[]; ///< Map from raw overlaps to normalized overlap code
|
||||
void calcStepShift(void); ///< Calculate explicit \b step and \b skip from \b mask
|
||||
void normalize(void); ///< Normalize the representation of full sets
|
||||
void complement(void); ///< Set \b this to the complement of itself
|
||||
void convertToBoolean(void); ///< Convert \b this to boolean.
|
||||
static bool newStride(uintb newmask,uintb &myleft,uintb &myright); ///< Recalculate range based on new size and stride
|
||||
bool convertToBoolean(void); ///< Convert \b this to boolean.
|
||||
static bool newStride(uintb mask,int4 step,int4 oldStep,uint4 rem,uintb &myleft,uintb &myright);
|
||||
static bool newDomain(uintb newMask,int4 newStep,uintb &myleft,uintb &myright);
|
||||
static char encodeRangeOverlaps(uintb op1left,uintb op1right,uintb op2left,uintb op2right); ///< Calculate overlap code
|
||||
public:
|
||||
CircleRange(void) { isempty=true; } ///< Construct an empty range
|
||||
CircleRange(uintb mn,uintb mx,uintb m); ///< Construct given specific boundaries.
|
||||
CircleRange(uintb lft,uintb rgt,int4 size,int4 stp); ///< Construct given specific boundaries.
|
||||
CircleRange(bool val); ///< Construct a boolean range
|
||||
CircleRange(uintb val,int4 size); ///< Construct range with single value
|
||||
void setRange(uintb lft,uintb rgt,int4 size,int4 step); ///< Set directly to a specific range
|
||||
void setRange(uintb val,int4 size); ///< Set range with a single value
|
||||
void setFull(int4 size); ///< Set a completely full range
|
||||
bool isEmpty(void) const { return isempty; } ///< Return \b true if \b this range is empty
|
||||
bool isFull(void) const { return ((!isempty) && (step == 1) && (left == right)); } ///< Return \b true if \b this contains all possible values
|
||||
bool isSingle(void) const { return (!isempty) && (right == ((left + step)& mask)); } ///< Return \b true if \b this contains single value
|
||||
uintb getMin(void) const { return left; } ///< Get the left boundary of the range
|
||||
uintb getMax(void) const { return (right-step)&mask; } ///< Get the right-most integer contained in the range
|
||||
uintb getEnd(void) const { return right; } ///< Get the right boundary of the range
|
||||
uintb getMask(void) const { return mask; } ///< Get the mask
|
||||
uintb getSize(void) const; ///< Get the size of this range
|
||||
int4 getStep(void) const { return step; } ///< Get the step for \b this range
|
||||
int4 getMaxInfo(void) const; ///< Get maximum information content of range
|
||||
bool operator==(const CircleRange &op2) const; ///< Equals operator
|
||||
bool getNext(uintb &val) const { val = (val+step)&mask; return (val!=right); } ///< Advance an integer within the range
|
||||
bool contains(const CircleRange &op2) const; ///< Check containment of another range in \b this.
|
||||
bool contains(uintb val) const; ///< Check containment of a specific integer.
|
||||
int4 intersect(const CircleRange &op2); ///< Intersect \b this with another range
|
||||
bool setNZMask(uintb nzmask,int4 size); ///< Set the range based on a putative mask.
|
||||
int4 circleUnion(const CircleRange &op2); ///< Union two ranges.
|
||||
void setStride(int4 newshift); ///< Set a new stride on \b this range.
|
||||
bool minimalContainer(const CircleRange &op2,int4 maxStep); ///< Construct minimal range that contains both \b this and another range
|
||||
int4 invert(void); ///< Convert to complementary range
|
||||
void setStride(int4 newStep,uintb rem); ///< Set a new step on \b this range.
|
||||
bool pullBackUnary(OpCode opc,int4 inSize,int4 outSize); ///< Pull-back \b this through the given unary operator
|
||||
bool pullBackBinary(OpCode opc,uintb val,int4 slot,int4 inSize,int4 outSize); ///< Pull-back \b this thru binary operator
|
||||
Varnode *pullBack(PcodeOp *op,Varnode **constMarkup,bool usenzmask); ///< Pull-back \b this range through given PcodeOp.
|
||||
bool pushForwardUnary(OpCode opc,const CircleRange &in1,int4 inSize,int4 outSize); ///< Push-forward thru given unary operator
|
||||
bool pushForwardBinary(OpCode opc,const CircleRange &in1,const CircleRange &in2,int4 inSize,int4 outSize,int4 maxStep);
|
||||
bool pushForwardTrinary(OpCode opc,const CircleRange &in1,const CircleRange &in2,const CircleRange &in3,
|
||||
int4 inSize,int4 outSize,int4 maxStep);
|
||||
void widen(const CircleRange &op2,bool leftIsStable); ///< Widen the unstable bound to match containing range
|
||||
int4 translate2Op(OpCode &opc,uintb &c,int4 &cslot) const; ///< Translate range to a comparison op
|
||||
void printRaw(ostream &s) const; ///< Write a text representation of \b this to stream
|
||||
};
|
||||
|
||||
class Partition; // Forward declaration
|
||||
class Widener; // Forward declaration
|
||||
|
||||
/// \brief A range of values attached to a Varnode within a data-flow subsystem
|
||||
///
|
||||
/// This class acts as both the set of values for the Varnode and as a node in a
|
||||
/// sub-graph overlaying the full data-flow of the function containing the Varnode.
|
||||
/// The values are stored in the CircleRange field and can be interpreted either as
|
||||
/// absolute values (if \b typeCode is 0) or as values relative to a stack pointer
|
||||
/// or some other register (if \b typeCode is non-zero).
|
||||
class ValueSet {
|
||||
public:
|
||||
static const int4 MAX_STEP; ///< Maximum step inferred for a value set
|
||||
/// \brief An external that can be applied to a ValueSet
|
||||
///
|
||||
/// An Equation is attached to a particular ValueSet and its underlying Varnode
|
||||
/// providing additional restriction on the ValueSet of an input parameter of the
|
||||
/// operation producing the Varnode.
|
||||
class Equation {
|
||||
friend class ValueSet;
|
||||
int4 slot; ///< The input parameter slot to which the constraint is attached
|
||||
int4 typeCode; ///< The constraint characteristic 0=absolute 1=relative to a spacebase register
|
||||
CircleRange range; ///< The range constraint
|
||||
public:
|
||||
Equation(int4 s,int4 tc,const CircleRange &rng) { slot=s; typeCode = tc; range = rng; } ///< Constructor
|
||||
};
|
||||
private:
|
||||
friend class ValueSetSolver;
|
||||
int4 typeCode; ///< 0=pure constant 1=stack relative
|
||||
int4 numParams; ///< Number of input parameters to defining operation
|
||||
int4 count; ///< Depth first numbering / widening count
|
||||
OpCode opCode; ///< Op-code defining Varnode
|
||||
bool leftIsStable; ///< Set to \b true if left boundary of range didn't change (last iteration)
|
||||
bool rightIsStable; ///< Set to \b true if right boundary of range didn't change (last iteration)
|
||||
Varnode *vn; ///< Varnode whose set this represents
|
||||
CircleRange range; ///< Range of values or offsets in this set
|
||||
vector<Equation> equations; ///< Any equations associated with this value set
|
||||
Partition *partHead; ///< If Varnode is a component head, pointer to corresponding Partition
|
||||
ValueSet *next; ///< Next ValueSet to iterate
|
||||
bool doesEquationApply(int4 num,int4 slot) const; ///< Does the indicated equation apply for the given input slot
|
||||
void setFull(void) { range.setFull(vn->getSize()); typeCode = 0; } ///< Mark value set as possibly containing any value
|
||||
void setVarnode(Varnode *v,int4 tCode); ///< Attach \b this to given Varnode and set initial values
|
||||
void addEquation(int4 slot,int4 type,const CircleRange &constraint); ///< Insert an equation restricting \b this value set
|
||||
void addLandmark(int4 type,const CircleRange &constraint) { addEquation(numParams,type,constraint); } ///< Add a widening landmark
|
||||
bool computeTypeCode(void); ///< Figure out if \b this value set is absolute or relative
|
||||
bool iterate(Widener &widener); ///< Regenerate \b this value set from operator inputs
|
||||
public:
|
||||
int4 getCount(void) const { return count; } ///< Get the current iteration count
|
||||
const CircleRange *getLandMark(void) const; ///< Get any \e landmark range
|
||||
int4 getTypeCode(void) const { return typeCode; } ///< Return '0' for normal constant, '1' for spacebase relative
|
||||
Varnode *getVarnode(void) const { return vn; } ///< Get the Varnode attached to \b this ValueSet
|
||||
const CircleRange &getRange(void) const { return range; } ///< Get the actual range of values
|
||||
bool isLeftStable(void) const { return leftIsStable; }
|
||||
bool isRightStable(void) const { return rightIsStable; }
|
||||
void printRaw(ostream &s) const; ///< Write a text description of \b to the given stream
|
||||
};
|
||||
|
||||
/// \brief A range of nodes (within the weak topological ordering) that are iterated together
|
||||
class Partition {
|
||||
friend class ValueSetSolver;
|
||||
ValueSet *startNode; ///< Starting node of component
|
||||
ValueSet *stopNode; ///< Ending node of component
|
||||
bool isDirty; ///< Set to \b true if a node in \b this component has changed this iteration
|
||||
public:
|
||||
Partition(void) {
|
||||
startNode = (ValueSet *)0; stopNode = (ValueSet *)0; isDirty = false;
|
||||
} ///< Construct empty partition
|
||||
};
|
||||
|
||||
/// \brief A special form of ValueSet associated with the \e read \e point of a Varnode
|
||||
///
|
||||
/// When a Varnode is read, it may have a more restricted range at the point of the read
|
||||
/// compared to the full scope. This class officially stores the value set at the point
|
||||
/// of the read (specified by PcodeOp and slot). It is computed as a final step after
|
||||
/// the main iteration has completed.
|
||||
class ValueSetRead {
|
||||
friend class ValueSetSolver;
|
||||
int4 typeCode; ///< 0=pure constant 1=stack relative
|
||||
int4 slot; ///< The slot being read
|
||||
PcodeOp *op; ///< The PcodeOp at the point of the value set read
|
||||
CircleRange range; ///< Range of values or offsets in this set
|
||||
CircleRange equationConstraint; ///< Constraint associated with the equation
|
||||
int4 equationTypeCode; ///< Type code of the associated equation
|
||||
bool leftIsStable; ///< Set to \b true if left boundary of range didn't change (last iteration)
|
||||
bool rightIsStable; ///< Set to \b true if right boundary of range didn't change (last iteration)
|
||||
void setPcodeOp(PcodeOp *o,int4 slt); ///< Establish \e read this value set corresponds to
|
||||
void addEquation(int4 slt,int4 type,const CircleRange &constraint); ///< Insert an equation restricting \b this value set
|
||||
public:
|
||||
int4 getTypeCode(void) const { return typeCode; } ///< Return '0' for normal constant, '1' for spacebase relative
|
||||
const CircleRange &getRange(void) const { return range; } ///< Get the actual range of values
|
||||
bool isLeftStable(void) const { return leftIsStable; }
|
||||
bool isRightStable(void) const { return rightIsStable; }
|
||||
void compute(void); ///< Compute \b this value set
|
||||
void printRaw(ostream &s) const; ///< Write a text description of \b to the given stream
|
||||
};
|
||||
|
||||
class Widener {
|
||||
public:
|
||||
virtual ~Widener(void) {} ///< Destructor
|
||||
|
||||
/// \brief Upon entering a fresh partition, determine how the given ValueSet count should be reset
|
||||
///
|
||||
/// \param valueSet is the given value set
|
||||
/// \return the value of the iteration counter to reset to
|
||||
virtual int4 determineIterationReset(const ValueSet &valueSet)=0;
|
||||
|
||||
/// \brief Check if the given value set has been frozen for the remainder of the iteration process
|
||||
///
|
||||
/// \param valueSet is the given value set
|
||||
/// \return \b true if the valueSet will no longer change
|
||||
virtual bool checkFreeze(const ValueSet &valueSet)=0;
|
||||
|
||||
/// \brief For an iteration that isn't stabilizing attempt to widen the given ValueSet
|
||||
///
|
||||
/// Change the given range based on its previous iteration so that it stabilizes more
|
||||
/// rapidly on future iterations.
|
||||
/// \param valueSet is the given value set
|
||||
/// \param range is the previous form of the given range (and storage for the widening result)
|
||||
/// \param newRange is the current iteration of the given range
|
||||
/// \return \b true if widening succeeded
|
||||
virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange)=0;
|
||||
};
|
||||
|
||||
/// \brief Class for doing normal widening
|
||||
///
|
||||
/// Widening is attempted at a specific iteration. If a landmark is available, it is used
|
||||
/// to do a controlled widening, holding the stable range boundary constant. Otherwise a
|
||||
/// full range is produced. At a later iteration, a full range is produced automatically.
|
||||
class WidenerFull : public Widener {
|
||||
int4 widenIteration; ///< The iteration at which widening is attempted
|
||||
int4 fullIteration; ///< The iteration at which a full range is produced
|
||||
public:
|
||||
WidenerFull(void) { widenIteration = 2; fullIteration = 5; } ///< Constructor with default iterations
|
||||
WidenerFull(int4 wide,int4 full) { widenIteration = wide; fullIteration = full; } ///< Constructor specifying iterations
|
||||
virtual int4 determineIterationReset(const ValueSet &valueSet);
|
||||
virtual bool checkFreeze(const ValueSet &valueSet);
|
||||
virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange);
|
||||
};
|
||||
|
||||
class WidenerNone : public Widener {
|
||||
int4 freezeIteration; ///< The iteration at which all change ceases
|
||||
public:
|
||||
WidenerNone(void) { freezeIteration = 3; }
|
||||
virtual int4 determineIterationReset(const ValueSet &valueSet);
|
||||
virtual bool checkFreeze(const ValueSet &valueSet);
|
||||
virtual bool doWidening(const ValueSet &valueSet,CircleRange &range,const CircleRange &newRange);
|
||||
};
|
||||
|
||||
/// \brief Class the determines a ValueSet for each Varnode in a data-flow system
|
||||
///
|
||||
/// This class uses \e value \e set \e analysis to calculate (an overestimation of)
|
||||
/// the range of values that can reach each Varnode. The system is formed by providing
|
||||
/// a set of Varnodes for which the range is desired (the sinks) via establishValueSets().
|
||||
/// This creates a system of Varnodes (within the single function) that can flow to the sinks.
|
||||
/// Running the method solve() does the analysis, and the caller can examine the results
|
||||
/// by examining the ValueSet attached to any of the Varnodes in the system (via Varnode::getValueSet()).
|
||||
class ValueSetSolver {
|
||||
/// \brief An iterator over out-bound edges for a single ValueSet node in a data-flow system
|
||||
///
|
||||
/// This is a helper class for walking a collection of ValueSets as a graph.
|
||||
/// Mostly the graph mirrors the data-flow of the Varnodes underlying the ValueSets, but
|
||||
/// there is support for a simulated root node. This class acts as an iterator over the outgoing
|
||||
/// edges of a particular ValueSet in the graph.
|
||||
class ValueSetEdge {
|
||||
const vector<ValueSet *> *rootEdges; ///< The list of nodes attached to the simulated root node (or NULL)
|
||||
int4 rootPos; ///< The iterator position for the simulated root node
|
||||
Varnode *vn; ///< The Varnode attached to a normal ValueSet node (or NULL)
|
||||
list<PcodeOp *>::const_iterator iter; ///< The iterator position for a normal ValueSet node
|
||||
public:
|
||||
ValueSetEdge(ValueSet *node,const vector<ValueSet *> &roots);
|
||||
ValueSet *getNext(void);
|
||||
};
|
||||
|
||||
list<ValueSet> valueNodes; ///< Storage for all the current value sets
|
||||
map<SeqNum,ValueSetRead> readNodes; ///< Additional, after iteration, add-on value sets
|
||||
Partition orderPartition; ///< Value sets in iteration order
|
||||
list<Partition> recordStorage; ///< Storage for the Partitions establishing components
|
||||
vector<ValueSet *> rootNodes; ///< Values treated as inputs
|
||||
vector<ValueSet *> nodeStack; ///< Stack used to generate the topological ordering
|
||||
int4 depthFirstIndex; ///< (Global) depth first numbering for topological ordering
|
||||
int4 numIterations; ///< Count of individual ValueSet iterations
|
||||
int4 maxIterations; ///< Maximum number of iterations before forcing termination
|
||||
void newValueSet(Varnode *vn,int4 tCode); ///< Allocate storage for a new ValueSet
|
||||
static void partitionPrepend(ValueSet *vertex,Partition &part); ///< Prepend a vertex to a partition
|
||||
static void partitionPrepend(const Partition &head,Partition &part); ///< Prepend full Partition to given Partition
|
||||
void partitionSurround(Partition &part); ///< Create a full partition component
|
||||
void component(ValueSet *vertex,Partition &part); ///< Generate a partition component given its head
|
||||
int4 visit(ValueSet *vertex,Partition &part); ///< Recursively walk the data-flow graph finding partitions
|
||||
void establishTopologicalOrder(void); ///< Find the optimal order for iterating through the ValueSets
|
||||
void applyConstraints(Varnode *vn,int4 type,const CircleRange &range,PcodeOp *cbranch);
|
||||
void constraintsFromPath(int4 type,CircleRange &lift,Varnode *startVn,Varnode *endVn,PcodeOp *cbranch);
|
||||
void constraintsFromCBranch(PcodeOp *cbranch); ///< Generate constraints arising from the given branch
|
||||
void generateConstraints(const vector<Varnode *> &worklist,const vector<PcodeOp *> &reads); ///< Generate constraints given a system of Varnodes
|
||||
bool checkRelativeConstant(Varnode *vn,int4 &typeCode,uintb &value) const; ///< Check if the given Varnode is a \e relative constant
|
||||
void generateRelativeConstraint(PcodeOp *compOp,PcodeOp *cbranch); ///< Try to find a \e relative constraint
|
||||
public:
|
||||
void establishValueSets(const vector<Varnode *> &sinks,const vector<PcodeOp *> &reads,Varnode *stackReg,bool indirectAsCopy);
|
||||
int4 getNumIterations(void) const { return numIterations; } ///< Get the current number of iterations
|
||||
void solve(int4 max,Widener &widener); ///< Iterate the ValueSet system until it stabilizes
|
||||
list<ValueSet>::const_iterator beginValueSets(void) const { return valueNodes.begin(); } ///< Start of all ValueSets in the system
|
||||
list<ValueSet>::const_iterator endValueSets(void) const { return valueNodes.end(); } ///< End of all ValueSets in the system
|
||||
map<SeqNum,ValueSetRead>::const_iterator beginValueSetReads(void) const { return readNodes.begin(); } ///< Start of ValueSetReads
|
||||
map<SeqNum,ValueSetRead>::const_iterator endValueSetReads(void) const { return readNodes.end(); } ///< End of ValueSetReads
|
||||
const ValueSetRead &getValueSetRead(const SeqNum &seq) { return (*readNodes.find(seq)).second; } ///< Get ValueSetRead by SeqNum
|
||||
};
|
||||
|
||||
/// \param op2 is the range to compare \b this to
|
||||
/// \return \b true if the two ranges are equal
|
||||
inline bool CircleRange::operator==(const CircleRange &op2) const
|
||||
|
||||
{
|
||||
if (isempty != op2.isempty) return false;
|
||||
if (isempty) return true;
|
||||
return (left == op2.left) && (right == op2.right) && (mask == op2.mask) && (step == op2.step);
|
||||
}
|
||||
|
||||
/// If two ranges are labeled [l , r) and [op2.l, op2.r), the
|
||||
/// overlap of the ranges can be characterized by listing the four boundary
|
||||
/// values in order, as the circle is traversed in a clock-wise direction. This characterization can be
|
||||
|
|
@ -111,4 +345,43 @@ inline char CircleRange::encodeRangeOverlaps(uintb op1left, uintb op1right, uint
|
|||
return arrange[val];
|
||||
}
|
||||
|
||||
/// Perform basic checks that the selected Equation exists and applies
|
||||
/// to the indicated input slot.
|
||||
/// \param num is the index selecting an Equation
|
||||
/// \param slot is the indicated slot
|
||||
/// \return \b true if the Equation exists and applies
|
||||
inline bool ValueSet::doesEquationApply(int4 num,int4 slot) const
|
||||
|
||||
{
|
||||
if (num < equations.size()) {
|
||||
if (equations[num].slot == slot) {
|
||||
if (equations[num].typeCode == typeCode)
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/// \param vertex is the node that will be prepended
|
||||
/// \param part is the Partition being modified
|
||||
inline void ValueSetSolver::partitionPrepend(ValueSet *vertex,Partition &part)
|
||||
|
||||
{
|
||||
vertex->next = part.startNode; // Attach new vertex to beginning of list
|
||||
part.startNode = vertex; // Change the first value set to be the new vertex
|
||||
if (part.stopNode == (ValueSet *)0)
|
||||
part.stopNode = vertex;
|
||||
}
|
||||
|
||||
/// \param head is the partition to be prepended
|
||||
/// \param part is the given partition being modified (prepended to)
|
||||
inline void ValueSetSolver::partitionPrepend(const Partition &head,Partition &part)
|
||||
|
||||
{
|
||||
head.stopNode->next = part.startNode;
|
||||
part.startNode = head.startNode;
|
||||
if (part.stopNode == (ValueSet *)0)
|
||||
part.stopNode = head.stopNode;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -308,10 +308,10 @@ uintb AddrSpace::read(const string &s,int4 &size) const
|
|||
offset = addressToByte(offset,wordsize);
|
||||
enddata = (const char *) tmpdata;
|
||||
if (enddata - s.c_str() == s.size()) { // If no size or offset override
|
||||
size = getAddrSize(); // Return "natural" size
|
||||
size = manage->getDefaultSize(); // Return "natural" size
|
||||
return offset;
|
||||
}
|
||||
size = getAddrSize();
|
||||
size = manage->getDefaultSize();
|
||||
}
|
||||
if (append != string::npos) {
|
||||
enddata = s.c_str()+append;
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ class VarnodeBank;
|
|||
class Merge;
|
||||
class Funcdata;
|
||||
class SymbolEntry;
|
||||
class ValueSet;
|
||||
|
||||
/// \brief Compare two Varnode pointers by location then definition
|
||||
struct VarnodeCompareLocDef {
|
||||
|
|
@ -134,7 +135,10 @@ private:
|
|||
VarnodeDefSet::iterator defiter; ///< Iterator into VarnodeBank sorted by definition
|
||||
list<PcodeOp *> descend; ///< List of every op using this varnode as input
|
||||
mutable Cover *cover; ///< Addresses covered by the def->use of this Varnode
|
||||
mutable Datatype *temptype; ///< For type propagate algorithm
|
||||
mutable union {
|
||||
Datatype *dataType; ///< For type propagate algorithm
|
||||
ValueSet *valueSet;
|
||||
} temp;
|
||||
uintb consumed; ///< What parts of this varnode are used
|
||||
uintb nzm; ///< Which bits do we know are zero
|
||||
friend class VarnodeBank;
|
||||
|
|
@ -167,8 +171,10 @@ public:
|
|||
SymbolEntry *getSymbolEntry(void) const { return mapentry; } ///< Get symbol and scope information associated with this Varnode
|
||||
uint4 getFlags(void) const { return flags; } ///< Get all the boolean attributes
|
||||
Datatype *getType(void) const { return type; } ///< Get the Datatype associated with this Varnode
|
||||
void setTempType(Datatype *t) const { temptype = t; } ///< Set the temporary Datatype
|
||||
Datatype *getTempType(void) const { return temptype; } ///< Get the temporary Datatype (used during type propagation)
|
||||
void setTempType(Datatype *t) const { temp.dataType = t; } ///< Set the temporary Datatype
|
||||
Datatype *getTempType(void) const { return temp.dataType; } ///< Get the temporary Datatype (used during type propagation)
|
||||
void setValueSet(ValueSet *v) const { temp.valueSet = v; } ///< Set the temporary ValueSet record
|
||||
ValueSet *getValueSet(void) const { return temp.valueSet; } ///< Get the temporary ValueSet record
|
||||
uint4 getCreateIndex(void) const { return create_index; } ///< Get the creation index
|
||||
Cover *getCover(void) const { updateCover(); return cover; } ///< Get Varnode coverage information
|
||||
list<PcodeOp *>::const_iterator beginDescend(void) const { return descend.begin(); } ///< Get iterator to list of syntax tree descendants (reads)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue