forked from cseagle/blc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfuncdata_op.cc
1279 lines (1142 loc) · 42.7 KB
/
funcdata_op.cc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "funcdata.hh"
#include "flow.hh"
// Funcdata members pertaining directly to ops
/// \param op is the given PcodeOp
/// \param opc is the op-code to set
void Funcdata::opSetOpcode(PcodeOp *op,OpCode opc)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
obank.changeOpcode(op, glb->inst[opc] );
}
/// \param op is the given CPUI_RETURN op
/// \param flag is one of \e halt, \e badinstruction, \e unimplemented, \e noreturn, or \e missing.
void Funcdata::opMarkHalt(PcodeOp *op,uint4 flag)
{
if (op->code() != CPUI_RETURN)
throw LowlevelError("Only RETURN pcode ops can be marked as halt");
flag &= (PcodeOp::halt|PcodeOp::badinstruction|
PcodeOp::unimplemented|PcodeOp::noreturn|
PcodeOp::missing);
if (flag == 0)
throw LowlevelError("Bad halt flag");
op->setFlag(flag);
}
/// The output Varnode becomes \e free but is not immediately deleted.
/// \param op is the given PcodeOp
void Funcdata::opUnsetOutput(PcodeOp *op)
{
Varnode *vn;
vn = op->getOut();
if (vn == (Varnode *)0) return; // Nothing to do
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
op->setOutput((Varnode *)0); // This must come before make_free
vbank.makeFree(vn);
vn->clearCover();
}
/// \param op is the specific PcodeOp
/// \param vn is the output Varnode to set
void Funcdata::opSetOutput(PcodeOp *op,Varnode *vn)
{
if (vn == op->getOut()) return; // Already set to this vn
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
if (op->getOut() != (Varnode *)0) {
opUnsetOutput(op);
}
if (vn->getDef() != (PcodeOp *)0) // If this varnode is already an output
opUnsetOutput(vn->getDef());
vn = vbank.setDef(vn,op);
setVarnodeProperties(vn);
op->setOutput(vn);
}
/// The input Varnode is unlinked from the op.
/// \param op is the given PcodeOp
/// \param slot is the input slot to clear
void Funcdata::opUnsetInput(PcodeOp *op,int4 slot)
{
Varnode *vn = op->getIn(slot);
vn->eraseDescend(op);
op->clearInput(slot); // Must be called AFTER descend_erase
}
/// \param op is the given PcodeOp
/// \param vn is the operand Varnode to set
/// \param slot is the input slot where the Varnode is placed
void Funcdata::opSetInput(PcodeOp *op,Varnode *vn,int4 slot)
{
if (vn == op->getIn(slot)) return; // Already set to this vn
if (vn->isConstant()) { // Constants should have only one descendant
if (!vn->hasNoDescend())
if (!vn->isSpacebase()) { // Unless they are a spacebase
Varnode *cvn = newConstant(vn->getSize(),vn->getOffset());
cvn->copySymbol(vn);
vn = cvn;
}
}
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
if (op->getIn(slot) != (Varnode *)0)
opUnsetInput(op,slot);
vn->addDescend(op); // Add this op to list of vn's descendants
op->setInput(vn,slot); // op must be up to date AFTER calling descend_add
}
/// This is convenience method that is more efficient than call opSetInput() twice.
/// \param op is the given PcodeOp
/// \param slot1 is the first input slot being switched
/// \param slot2 is the second input slot
void Funcdata::opSwapInput(PcodeOp *op,int4 slot1,int4 slot2)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
Varnode *tmp = op->getIn(slot1);
op->setInput(op->getIn(slot2),slot1);
op->setInput(tmp,slot2);
}
/// \brief Insert the given PcodeOp at specific point in a basic block
///
/// The PcodeOp is removed from the \e dead list and is inserted \e immediately before
/// the specified iterator.
/// \param op is the given PcodeOp
/// \param bl is the basic block being inserted into
/// \param iter indicates exactly where the op is inserted
void Funcdata::opInsert(PcodeOp *op,BlockBasic *bl,list<PcodeOp *>::iterator iter)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
obank.markAlive(op);
bl->insert(iter,op);
}
/// The op is taken out of its basic block and put into the dead list. If the removal
/// is permanent the input and output Varnodes should be unset.
/// \param op is the given PcodeOp
void Funcdata::opUninsert(PcodeOp *op)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
obank.markDead(op);
op->getParent()->removeOp(op);
}
/// The op is extricated from all its Varnode connections to the functions data-flow and
/// removed from its basic block. This will \e not change block connections. The PcodeOp
/// objects remains in the \e dead list.
/// \param op is the given PcodeOp
void Funcdata::opUnlink(PcodeOp *op)
{
int4 i;
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
// Unlink input and output varnodes
opUnsetOutput(op);
for(i=0;i<op->numInput();++i)
opUnsetInput(op,i);
if (op->getParent() != (BlockBasic *)0) // Remove us from basic block
opUninsert(op);
}
/// All input and output Varnodes to the op are destroyed (their object resources freed),
/// and the op is permanently moved to the \e dead list.
/// To call this routine, make sure that either:
/// - The op has no output
/// - The op's output has no descendants
/// - or all descendants of output are also going to be destroyed
///
/// \param op is the given PcodeOp
void Funcdata::opDestroy(PcodeOp *op)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
if (op->getOut() != (Varnode *)0)
destroyVarnode(op->getOut());
for(int4 i=0;i<op->numInput();++i) {
Varnode *vn = op->getIn(i);
if (vn != (Varnode *)0)
opUnsetInput(op,i);
}
if (op->getParent() != (BlockBasic *)0) {
obank.markDead(op);
op->getParent()->removeOp(op);
}
}
/// This is a specialized routine for deleting an op during flow generation that has
/// been replaced by something else. The op is expected to be \e dead with none of its inputs
/// or outputs linked to anything else. Both the PcodeOp and all the input/output Varnodes are destroyed.
/// \param op is the given PcodeOp
void Funcdata::opDestroyRaw(PcodeOp *op)
{
for(int4 i=0;i<op->numInput();++i)
destroyVarnode(op->getIn(i));
if (op->getOut() != (Varnode *)0)
destroyVarnode(op->getOut());
obank.destroy(op);
}
/// All previously existing input Varnodes are unset. The input slots for the
/// op are resized and then filled in from the specified array.
/// \param op is the given PcodeOp to set
/// \param vvec is the specified array of new input Varnodes
void Funcdata::opSetAllInput(PcodeOp *op,const vector<Varnode *> &vvec)
{
int4 i;
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
for(i=0;i<op->numInput();++i)
if (op->getIn(i) != (Varnode *)0)
opUnsetInput(op,i);
op->setNumInputs( vvec.size() );
for(i=0;i<op->numInput();++i)
opSetInput(op,vvec[i],i);
}
/// The Varnode in the specified slot is unlinked from the op and the slot itself
/// is removed. The slot index for any remaining input Varnodes coming after the
/// specified slot is decreased by one.
/// \param op is the given PcodeOp
/// \param slot is the index of the specified slot to remove
void Funcdata::opRemoveInput(PcodeOp *op,int4 slot)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
opUnsetInput(op,slot);
op->removeInput(slot);
}
/// The given Varnode is set into the given operand slot. Any existing input Varnodes
/// with slot indices equal to or greater than the specified slot are pushed into the
/// next slot.
/// \param op is the given PcodeOp
/// \param vn is the given Varnode to insert
/// \param slot is the input index to insert at
void Funcdata::opInsertInput(PcodeOp *op,Varnode *vn,int4 slot)
{
#ifdef OPACTION_DEBUG
if (opactdbg_active)
debugModCheck(op);
#endif
op->insertInput(slot);
opSetInput(op,vn,slot);
}
/// \param inputs is the number of operands the new op will have
/// \param pc is the Address associated with the new op
/// \return the new PcodeOp
PcodeOp *Funcdata::newOp(int4 inputs,const Address &pc)
{
return obank.create(inputs,pc);
}
/// This method is typically used for cloning.
/// \param inputs is the number of operands the new op will have
/// \param sq is the sequence number (Address and sub-index) of the new op
/// \return the new PcodeOp
PcodeOp *Funcdata::newOp(int4 inputs,const SeqNum &sq)
{
return obank.create(inputs,sq);
}
/// The given PcodeOp is inserted \e immediately before the \e follow op except:
/// - MULTIEQUALS in a basic block all occur first
/// - INDIRECTs occur immediately before their op
/// - a branch op must be the very last op in a basic block
///
/// \param op is the given PcodeOp to insert
/// \param follow is the op to insert before
void Funcdata::opInsertBefore(PcodeOp *op,PcodeOp *follow)
{
list<PcodeOp *>::iterator iter = follow->getBasicIter();
BlockBasic *parent = follow->getParent();
if (op->code() != CPUI_INDIRECT) {
// There should not be an INDIRECT immediately preceding op
PcodeOp *previousop;
while(iter != parent->beginOp()) {
--iter;
previousop = *iter;
if (previousop->code() != CPUI_INDIRECT) {
++iter;
break;
}
}
}
opInsert(op,parent,iter);
}
/// The given PcodeOp is inserted \e immediately after the \e prev op except:
/// - MULTIEQUALS in a basic block all occur first
/// - INDIRECTs occur immediately before their op
/// - a branch op must be the very last op in a basic block
///
/// \param op is the given PcodeOp to insert
/// \param prev is the op to insert after
void Funcdata::opInsertAfter(PcodeOp *op,PcodeOp *prev)
{
if (prev->isMarker()) {
if (prev->code() == CPUI_INDIRECT) {
Varnode *invn = prev->getIn(1);
if (invn->getSpace()->getType()==IPTR_IOP)
prev = PcodeOp::getOpFromConst(invn->getAddr()); // Store or call
}
}
list<PcodeOp *>::iterator iter = prev->getBasicIter();
BlockBasic *parent = prev->getParent();
iter++;
if (op->code() != CPUI_MULTIEQUAL) {
// There should not be a MULTIEQUAL immediately after op
PcodeOp *nextop;
while(iter != parent->endOp()) {
nextop = *iter;
++iter;
if (nextop->code() != CPUI_MULTIEQUAL) {
--iter;
break;
}
}
}
opInsert(op,prev->getParent(),iter);
}
/// The given PcodeOp is inserted as the \e first op in the basic block except:
/// - MULTIEQUALS in a basic block all occur first
/// - INDIRECTs occur immediately before their op
/// - a branch op must be the very last op in a basic block
///
/// \param op is the given PcodeOp to insert
/// \param bl is the basic block to insert into
void Funcdata::opInsertBegin(PcodeOp *op,BlockBasic *bl)
{
list<PcodeOp *>::iterator iter = bl->beginOp();
if (op->code()!=CPUI_MULTIEQUAL) {
while(iter != bl->endOp()) {
if ((*iter)->code() != CPUI_MULTIEQUAL)
break;
++iter;
}
}
opInsert(op,bl,iter);
}
/// The given PcodeOp is inserted as the \e last op in the basic block except:
/// - MULTIEQUALS in a basic block all occur first
/// - INDIRECTs occur immediately before their op
/// - a branch op must be the very last op in a basic block
///
/// \param op is the given PcodeOp to insert
/// \param bl is the basic block to insert into
void Funcdata::opInsertEnd(PcodeOp *op,BlockBasic *bl)
{
list<PcodeOp *>::iterator iter = bl->endOp();
if (iter != bl->beginOp()) {
--iter;
if (!(*iter)->isFlowBreak())
++iter;
}
opInsert(op,bl,iter);
}
/// \brief Create an INT_ADD PcodeOp calculating an offset to the \e spacebase register.
///
/// The \e spacebase register is looked up for the given address space, or an optional previously
/// existing register Varnode can be provided. An insertion point op must be provided,
/// and newly generated ops can come either before or after this insertion point.
/// \param spc is the given address space
/// \param off is the offset to calculate relative to the \e spacebase register
/// \param op is the insertion point PcodeOp
/// \param stackptr is the \e spacebase register Varnode (if available)
/// \param insertafter is \b true if new ops are inserted \e after the insertion point
/// \return the \e unique space Varnode holding the calculated offset
Varnode *Funcdata::createStackRef(AddrSpace *spc,uintb off,PcodeOp *op,Varnode *stackptr,bool insertafter)
{
PcodeOp *addop;
Varnode *addout;
int4 addrsize;
// Calculate CURRENT stackpointer as base for relative offset
if (stackptr == (Varnode *)0) // If we are not reusing an old reference to the stack pointer
stackptr = newSpacebasePtr(spc); // create a new reference
addrsize = stackptr->getSize();
addop = newOp(2,op->getAddr());
opSetOpcode(addop,CPUI_INT_ADD);
addout = newUniqueOut(addrsize,addop);
opSetInput(addop,stackptr,0);
off = AddrSpace::byteToAddress(off,spc->getWordSize());
opSetInput(addop,newConstant(addrsize,off),1);
if (insertafter)
opInsertAfter(addop,op);
else
opInsertBefore(addop,op);
AddrSpace *containerid = spc->getContain();
SegmentOp *segdef = glb->userops.getSegmentOp(containerid->getIndex());
if (segdef != (SegmentOp *)0) {
PcodeOp *segop = newOp(3,op->getAddr());
opSetOpcode(segop,CPUI_SEGMENTOP);
Varnode *segout = newUniqueOut(containerid->getAddrSize(),segop);
opSetInput(segop,newVarnodeSpace(containerid),0);
opSetInput(segop,newConstant(segdef->getBaseSize(),0),1);
opSetInput(segop,addout,2);
opInsertAfter(segop,addop); // Make sure -segop- comes after -addop- regardless if before/after -op-
addout = segout;
}
return addout;
}
/// \brief Create a STORE expression at an offset relative to a \e spacebase register for a given address space
///
/// The \e spacebase register is looked up for the given address space. An insertion point
/// op must be provided, and newly generated ops can come either before or after this insertion point.
/// The Varnode value being stored must still be set on the returned PcodeOp.
/// \param spc is the given address space
/// \param off is the offset to calculate relative to the \e spacebase register
/// \param op is the insertion point PcodeOp
/// \param insertafter is \b true if new ops are inserted \e after the insertion point
/// \return the STORE PcodeOp
PcodeOp *Funcdata::opStackStore(AddrSpace *spc,uintb off,PcodeOp *op,bool insertafter)
{ // Create pcode sequence that stores a value at an offset relative to a spacebase
// -off- is the offset, -size- is the size of the value
// The sequence is inserted before/after -op- based on whether -insertafter- is false/true
// Return the store op
Varnode *addout;
PcodeOp *storeop;
// Calculate CURRENT stackpointer as base for relative offset
addout = createStackRef(spc,off,op,(Varnode *)0,insertafter);
storeop = newOp(3,op->getAddr());
opSetOpcode(storeop,CPUI_STORE);
opSetInput(storeop,newVarnodeSpace(spc->getContain()),0);
opSetInput(storeop,addout,1);
opInsertAfter(storeop,addout->getDef()); // STORE comes after stack building op, regardless of -insertafter-
return storeop;
}
/// \brief Create a LOAD expression at an offset relative to a \e spacebase register for a given address space
///
/// The \e spacebase register is looked up for the given address space, or an optional previously
/// existing register Varnode can be provided. An insertion point op must be provided,
/// and newly generated ops can come either before or after this insertion point.
/// \param spc is the given address space
/// \param off is the offset to calculate relative to the \e spacebase register
/// \param sz is the size of the desire LOAD in bytes
/// \param op is the insertion point PcodeOp
/// \param stackref is the \e spacebase register Varnode (if available)
/// \param insertafter is \b true if new ops are inserted \e after the insertion point
/// \return the \e unique space Varnode holding the result of the LOAD
Varnode *Funcdata::opStackLoad(AddrSpace *spc,uintb off,uint4 sz,PcodeOp *op,Varnode *stackref,bool insertafter)
{
Varnode *addout = createStackRef(spc,off,op,stackref,insertafter);
PcodeOp *loadop = newOp(2,op->getAddr());
opSetOpcode(loadop,CPUI_LOAD);
opSetInput(loadop,newVarnodeSpace(spc->getContain()),0);
opSetInput(loadop,addout,1);
Varnode *res = newUniqueOut(sz,loadop);
opInsertAfter(loadop,addout->getDef()); // LOAD comes after stack building op, regardless of -insertafter-
return res;
}
/// Make a clone of the given PcodeOp, copying control-flow properties as well. The data-type
/// is \e not cloned.
/// \param op is the PcodeOp to clone
/// \param seq is the (possibly custom) sequence number to associate with the clone
/// \return the cloned PcodeOp
PcodeOp *Funcdata::cloneOp(const PcodeOp *op,const SeqNum &seq)
{
PcodeOp *newop = newOp(op->numInput(),seq);
opSetOpcode(newop,op->code());
uint4 flags = op->flags & (PcodeOp::startmark | PcodeOp::startbasic);
newop->setFlag(flags);
if (op->getOut() != (Varnode *)0)
opSetOutput(newop,cloneVarnode(op->getOut()));
for(int4 i=0;i<op->numInput();++i)
opSetInput(newop,cloneVarnode(op->getIn(i)),i);
return newop;
}
/// Return the CPUI_RETURN op with the most specialized data-type, which is not
/// dead and is not a special halt. If HighVariables are not available, just
/// return the first CPUI_RETURN op.
/// \return the representative CPUI_RETURN op or NULL
PcodeOp *Funcdata::canonicalReturnOp(void) const
{
bool hasnohigh = !isHighOn();
PcodeOp *res = (PcodeOp *)0;
Datatype *bestdt = (Datatype *)0;
list<PcodeOp *>::const_iterator iter,iterend;
iterend = endOp(CPUI_RETURN);
for(iter=beginOp(CPUI_RETURN);iter!=iterend;++iter) {
PcodeOp *retop = *iter;
if (retop->isDead()) continue;
if (retop->getHaltType()!=0) continue;
if (retop->numInput() > 1) {
if (hasnohigh) return retop;
Varnode *vn = retop->getIn(1);
Datatype *ct = vn->getHigh()->getType();
if (bestdt == (Datatype *)0) {
res = retop;
bestdt = ct;
}
else if (ct->typeOrder(*bestdt) < 0) {
res = retop;
bestdt = ct;
}
}
}
return res;
}
/// \brief Create new PcodeOp with 2 or 3 given operands
///
/// The new op will have a \e unique space output Varnode and will be inserted before
/// the given \e follow op.
/// \param follow is the \e follow up to insert the new PcodeOp before
/// \param opc is the op-code of the new PcodeOp
/// \param in1 is the first operand
/// \param in2 is the second operand
/// \param in3 is the optional third param
/// \return the new PcodeOp
PcodeOp *Funcdata::newOpBefore(PcodeOp *follow,OpCode opc,Varnode *in1,Varnode *in2,Varnode *in3)
{
PcodeOp *newop;
int4 size;
size = (in3 == (Varnode *)0) ? 2 : 3;
newop = newOp(size,follow->getAddr());
opSetOpcode(newop,opc);
newUniqueOut(in1->getSize(),newop);
opSetInput(newop,in1,0);
opSetInput(newop,in2,1);
if (size==3)
opSetInput(newop,in3,2);
opInsertBefore(newop,follow);
return newop;
}
/// \brief Create a new CPUI_INDIRECT around a PcodeOp with an indirect effect
///
/// Typically this is used to annotate data-flow, for the given storage range, passing
/// through a CALL or STORE. An output Varnode is automatically created.
/// \param indeffect is the PcodeOp with the indirect effect
/// \param addr is the starting address of the storage range to protect
/// \param size is the number of bytes in the storage range
/// \param extraFlags are extra boolean properties to put on the INDIRECT
/// \return the new CPUI_INDIRECT op
PcodeOp *Funcdata::newIndirectOp(PcodeOp *indeffect,const Address &addr,int4 size,uint4 extraFlags)
{
Varnode *newin;
PcodeOp *newop;
newin = newVarnode(size,addr);
newop = newOp(2,indeffect->getAddr());
newop->flags |= extraFlags;
newVarnodeOut(size,addr,newop);
opSetOpcode(newop,CPUI_INDIRECT);
opSetInput(newop,newin,0);
opSetInput(newop,newVarnodeIop(indeffect),1);
opInsertBefore(newop,indeffect);
return newop;
}
/// \brief Turn given PcodeOp into a CPUI_INDIRECT that \e indirectly \e creates a Varnode
///
/// An \e indirectly \e created Varnode effectively has no data-flow before the INDIRECT op
/// that defines it, and the value contained by the Varnode is not explicitly calculable.
/// \param op is the given PcodeOp to convert to a CPUI_INDIRECT
/// \param indeffect is the p-code causing the indirect effect
/// \param outvn is the (preexisting) Varnode that will be marked as \e created by the INDIRECT
/// \param possibleout is \b true if the output should be treated as a \e directwrite.
void Funcdata::setIndirectCreation(PcodeOp *op,PcodeOp *indeffect,Varnode *outvn,bool possibleout)
{
Varnode *newin;
newin = newConstant(outvn->getSize(),0);
op->flags |= PcodeOp::indirect_creation;
opSetOutput(op,outvn);
if (!possibleout)
newin->flags |= Varnode::indirect_creation;
outvn->flags |= Varnode::indirect_creation;
opSetOpcode(op,CPUI_INDIRECT);
opSetInput(op,newin,0);
opSetInput(op,newVarnodeIop(indeffect),1);
opInsertBefore(op,indeffect);
}
/// \brief Build a CPUI_INDIRECT op that \e indirectly \e creates a Varnode
///
/// An \e indirectly \e created Varnode effectively has no data-flow before the INDIRECT op
/// that defines it, and the value contained by the Varnode is not explicitly calculable.
/// The new Varnode is allocated with a given storage range.
/// \param indeffect is the p-code causing the indirect effect
/// \param addr is the starting address of the given storage range
/// \param size is the number of bytes in the storage range
/// \param possibleout is \b true if the output should be treated as a \e directwrite.
/// \return the new CPUI_INDIRECT op
PcodeOp *Funcdata::newIndirectCreation(PcodeOp *indeffect,const Address &addr,int4 size,bool possibleout)
{
Varnode *newout,*newin;
PcodeOp *newop;
newin = newConstant(size,0);
newop = newOp(2,indeffect->getAddr());
newop->flags |= PcodeOp::indirect_creation;
newout = newVarnodeOut(size,addr,newop);
if (!possibleout)
newin->flags |= Varnode::indirect_creation;
newout->flags |= Varnode::indirect_creation;
opSetOpcode(newop,CPUI_INDIRECT);
opSetInput(newop,newin,0);
opSetInput(newop,newVarnodeIop(indeffect),1);
opInsertBefore(newop,indeffect);
return newop;
}
/// Data-flow through the given CPUI_INDIRECT op is truncated causing the output Varnode
/// to be \e indirectly \e created.
/// An \e indirectly \e created Varnode effectively has no data-flow before the INDIRECT op
/// that defines it, and the value contained by the Varnode is not explicitly calculable.
/// \param indop is the given CPUI_INDIRECT op
void Funcdata::truncateIndirect(PcodeOp *indop)
{
Varnode *outvn = indop->getOut();
Varnode *newin = newConstant(outvn->getSize(),0);
indop->flags |= PcodeOp::indirect_creation;
newin->flags |= Varnode::indirect_creation;
outvn->flags |= Varnode::indirect_creation;
opSetInput(indop,newin,0);
}
/// \brief Generate raw p-code for the function
///
/// Follow flow from the entry point generating PcodeOps for each instruction encountered.
/// The caller can provide a bounding range that constrains where control can flow to
/// and can also provide a maximum number of instructions that will be followed.
/// \param baddr is the beginning of the constraining range
/// \param eaddr is the end of the constraining range
/// \param insn_max is the maximum number of instructions to follow
void Funcdata::followFlow(const Address &baddr,const Address &eaddr,uint4 insn_max)
{
if (!obank.empty()) {
if ((flags & blocks_generated)==0)
throw LowlevelError("Function loaded for inlining");
return; // Already translated
}
uint4 fl = 0;
fl |= glb->flowoptions; // Global flow options
FlowInfo flow(*this,obank,bblocks,qlst);
flow.setRange(baddr,eaddr);
flow.setFlags(fl);
if (insn_max != 0)
flow.setMaximumInstructions(insn_max);
flow.generateOps();
size = flow.getSize();
// Cannot keep track of function sizes in general because of non-contiguous functions
// glb->symboltab->update_size(name,size);
flow.generateBlocks();
flags |= blocks_generated;
switchOverJumpTables(flow);
if (flow.hasUnimplemented())
flags |= unimplemented_present;
if (flow.hasBadData())
flags |= baddata_present;
}
/// \brief Generate a clone with truncated control-flow given a partial function
///
/// Existing p-code is cloned from another function whose flow has not been completely
/// followed. Artificial halt operators are inserted wherever flow is incomplete and
/// basic blocks are generated.
/// \param fd is the partial function to clone
/// \param flow is partial function's flow information
void Funcdata::truncatedFlow(const Funcdata *fd,const FlowInfo *flow)
{
if (!obank.empty())
throw LowlevelError("Trying to do truncated flow on pre-existing pcode");
list<PcodeOp *>::const_iterator oiter; // Clone the raw pcode
for(oiter=fd->obank.beginDead();oiter!=fd->obank.endDead();++oiter)
cloneOp(*oiter,(*oiter)->getSeqNum());
obank.setUniqId(fd->obank.getUniqId());
// Clone callspecs
for(int4 i=0;i<fd->qlst.size();++i) {
FuncCallSpecs *oldspec = fd->qlst[i];
PcodeOp *newop = findOp(oldspec->getOp()->getSeqNum());
FuncCallSpecs *newspec = oldspec->clone(newop);
Varnode *invn0 = newop->getIn(0);
if (invn0->getSpace()->getType() == IPTR_FSPEC) { // Replace embedded pointer to callspec
Varnode *newvn0 = newVarnodeCallSpecs(newspec);
opSetInput(newop,newvn0,0);
deleteVarnode(invn0);
}
qlst.push_back(newspec);
}
vector<JumpTable *>::const_iterator jiter; // Clone the jumptables
for(jiter=fd->jumpvec.begin();jiter!=fd->jumpvec.end();++jiter) {
PcodeOp *indop = (*jiter)->getIndirectOp();
if (indop == (PcodeOp *)0) // If indirect op has not been linked, this is probably a jumptable override
continue; // that has not been reached by the flow yet, so we ignore/truncate it
PcodeOp *newop = findOp(indop->getSeqNum());
if (newop == (PcodeOp *)0)
throw LowlevelError("Could not trace jumptable across partial clone");
JumpTable *jtclone = new JumpTable(*jiter);
jtclone->setIndirectOp(newop);
jumpvec.push_back(jtclone);
}
FlowInfo partialflow(*this,obank,bblocks,qlst,flow); // Clone the flow
if (partialflow.hasInject())
partialflow.injectPcode();
// Clear error reporting flags
// Keep possible unreachable flag
partialflow.clearFlags(~((uint4)FlowInfo::possible_unreachable));
partialflow.generateBlocks(); // Generate basic blocks for partial flow
flags |= blocks_generated;
}
/// \brief In-line the p-code from another function into \b this function
///
/// Raw PcodeOps for the in-line function are generated and then cloned into
/// \b this function. Depending on the control-flow complexity of the in-line
/// function, the PcodeOps are injected as if they are all part of the call site
/// address (EZModel), or the PcodeOps preserve their address and extra branch
/// instructions are inserted to integrate control-flow of the in-line into
/// the calling function.
/// \param inlinefd is the function to in-line
/// \param flow is the flow object being injected
/// \param callop is the site of the injection
/// \return \b true if the injection was successful
bool Funcdata::inlineFlow(Funcdata *inlinefd,FlowInfo &flow,PcodeOp *callop)
{
inlinefd->getArch()->clearAnalysis(inlinefd);
FlowInfo inlineflow(*inlinefd,inlinefd->obank,inlinefd->bblocks,inlinefd->qlst);
inlinefd->obank.setUniqId( obank.getUniqId() );
// Generate the pcode ops to be inlined
Address baddr(baseaddr.getSpace(),0);
Address eaddr(baseaddr.getSpace(),~((uintb)0));
inlineflow.setRange(baddr,eaddr);
inlineflow.setFlags(FlowInfo::error_outofbounds|FlowInfo::error_unimplemented|
FlowInfo::error_reinterpreted|FlowInfo::flow_forinline);
inlineflow.forwardRecursion(flow);
inlineflow.generateOps();
if (inlineflow.checkEZModel()) {
// With an EZ clone there are no jumptables to clone
list<PcodeOp *>::const_iterator oiter = obank.endDead();
--oiter; // There is at least one op
flow.inlineEZClone(inlineflow,callop->getAddr());
++oiter;
if (oiter != obank.endDead()) { // If there was at least one PcodeOp cloned
PcodeOp *firstop = *oiter;
oiter = obank.endDead();
--oiter;
PcodeOp *lastop = *oiter;
obank.moveSequenceDead(firstop,lastop,callop); // Move cloned sequence to right after callop
if (callop->isBlockStart())
firstop->setFlag(PcodeOp::startbasic); // First op of inline inherits callop's startbasic flag
else
firstop->clearFlag(PcodeOp::startbasic);
}
opDestroyRaw(callop);
}
else {
Address retaddr;
if (!flow.testHardInlineRestrictions(inlinefd,callop,retaddr))
return false;
vector<JumpTable *>::const_iterator jiter; // Clone any jumptables from inline piece
for(jiter=inlinefd->jumpvec.begin();jiter!=inlinefd->jumpvec.end();++jiter) {
JumpTable *jtclone = new JumpTable(*jiter);
jumpvec.push_back(jtclone);
}
flow.inlineClone(inlineflow,retaddr);
// Convert CALL op to a jump
while(callop->numInput()>1)
opRemoveInput(callop,callop->numInput()-1);
opSetOpcode(callop,CPUI_BRANCH);
Varnode *inlineaddr = newCodeRef( inlinefd->getAddress() );
opSetInput(callop,inlineaddr,0);
}
obank.setUniqId( inlinefd->obank.getUniqId() );
return true;
}
/// \brief Find the primary branch operation for an instruction
///
/// For machine instructions that branch, this finds the \e primary PcodeOp that performs
/// the branch. The instruction is provided as a list of p-code ops, and the caller can
/// specify whether they expect to see a \e branch, \e call, or \e return operation.
/// \param iter is the start of the operations for the instruction
/// \param enditer is the end of the operations for the instruction
/// \param findbranch is \b true if the caller expects to see a BRANCH, CBRANCH, or BRANCHIND
/// \param findcall is \b true if the caller expects to see CALL or CALLIND
/// \param findreturn is \b true if the caller expects to see RETURN
/// \return the first branching PcodeOp that matches the criteria or NULL
PcodeOp *Funcdata::findPrimaryBranch(PcodeOpTree::const_iterator iter,PcodeOpTree::const_iterator enditer,
bool findbranch,bool findcall,bool findreturn)
{
while(iter != enditer) {
PcodeOp *op = (*iter).second;
switch(op->code()) {
case CPUI_BRANCH:
case CPUI_CBRANCH:
if (findbranch) {
if (!op->getIn(0)->isConstant()) // Make sure this is not an internal branch
return op;
}
break;
case CPUI_BRANCHIND:
if (findbranch)
return op;
break;
case CPUI_CALL:
case CPUI_CALLIND:
if (findcall)
return op;
break;
case CPUI_RETURN:
if (findreturn)
return op;
break;
default:
break;
}
++iter;
}
return (PcodeOp *)0;
}
/// \brief Override the control-flow p-code for a particular instruction
///
/// P-code in \b this function is modified to change the control-flow of
/// the instruction at the given address, based on the Override type.
/// \param addr is the given address of the instruction to modify
/// \param type is the Override type
void Funcdata::overrideFlow(const Address &addr,uint4 type)
{
PcodeOpTree::const_iterator iter = beginOp(addr);
PcodeOpTree::const_iterator enditer = endOp(addr);
PcodeOp *op = (PcodeOp *)0;
if (type == Override::BRANCH)
op = findPrimaryBranch(iter,enditer,false,true,true);
else if (type == Override::CALL)
op = findPrimaryBranch(iter,enditer,true,false,true);
else if (type == Override::CALL_RETURN)
op = findPrimaryBranch(iter,enditer,true,false,true);
else if (type == Override::RETURN)
op = findPrimaryBranch(iter,enditer,true,true,false);
if ((op == (PcodeOp *)0)||(!op->isDead()))
throw LowlevelError("Could not apply flowoverride");
OpCode opc = op->code();
if (type == Override::BRANCH) {
if (opc == CPUI_CALL)
opSetOpcode(op,CPUI_BRANCH);
else if (opc == CPUI_CALLIND)
opSetOpcode(op,CPUI_BRANCHIND);
else if (opc == CPUI_RETURN)
opSetOpcode(op,CPUI_BRANCHIND);
}
else if ((type == Override::CALL)||(type == Override::CALL_RETURN)) {
if (opc == CPUI_BRANCH)
opSetOpcode(op,CPUI_CALL);
else if (opc == CPUI_BRANCHIND)
opSetOpcode(op,CPUI_CALLIND);
else if (opc == CPUI_CBRANCH)
throw LowlevelError("Do not currently support CBRANCH overrides");
else if (opc == CPUI_RETURN)
opSetOpcode(op,CPUI_CALLIND);
if (type == Override::CALL_RETURN) { // Insert a new return op after call
PcodeOp *newReturn = newOp(1,addr);
opSetOpcode(newReturn,CPUI_RETURN);
opSetInput(newReturn,newConstant(1,0),0);
opDeadInsertAfter(newReturn,op);
}
}
else if (type == Override::RETURN) {
if ((opc == CPUI_BRANCH)||(opc == CPUI_CBRANCH)||(opc == CPUI_CALL))
throw LowlevelError("Do not currently support complex overrides");
else if (opc == CPUI_BRANCHIND)
opSetOpcode(op,CPUI_RETURN);
else if (opc == CPUI_CALLIND)
opSetOpcode(op,CPUI_RETURN);
}
}
/// Do in-place replacement of
/// - `c <= x` with `c-1 < x` OR
/// - `x <= c` with `x < c+1`
///
/// \param data is the function being analyzed
/// \param op is comparison PcodeOp
/// \return true if a valid replacement was performed
bool Funcdata::replaceLessequal(Funcdata &data,PcodeOp *op)
{
Varnode *vn;
int4 i;
intb val,diff;
if ((vn=op->getIn(0))->isConstant()) {
diff = -1;
i = 0;
}
else if ((vn=op->getIn(1))->isConstant()) {
diff = 1;
i = 1;
}
else
return false;
val = vn->getOffset(); // Treat this as signed value
sign_extend(val,8*vn->getSize()-1);