Add outputs and parameters for call and return, handle aliasing

4 files changed, 88 insertions, 21 deletions

diff --git a/binaryninjaapi.h b/binaryninjaapi.h
index e3ba4968..f63deee1 100644
--- a/binaryninjaapi.h
+++ b/binaryninjaapi.h
@@ -2201,20 +2201,25 @@ namespace BinaryNinja
 		size_t GetInstructionStart(Architecture* arch, uint64_t addr);
 
 		ExprId AddExpr(BNMediumLevelILOperation operation, size_t size,
-			ExprId a = 0, ExprId b = 0, ExprId c = 0, ExprId d = 0, ExprId e = 0);
+			ExprId a = 0, ExprId b = 0, ExprId c = 0, ExprId d = 0, ExprId e = 0, ExprId f = 0);
 		ExprId AddInstruction(ExprId expr);
 
 		ExprId SetVar(size_t size, const BNILVariable& var, ExprId src);
 		ExprId SetVarField(size_t size, const BNILVariable& var, int64_t offset, ExprId src);
 		ExprId SetVarSplit(size_t size, const BNILVariable& high, const BNILVariable& low, ExprId src);
 		ExprId SetVarSSA(size_t size, const BNILVariable& var, size_t index, ExprId src);
-		ExprId SetVarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex, ExprId src);
+		ExprId SetVarFieldSSA(size_t size, const BNILVariable& var, size_t varIndex, int64_t offset, ExprId src);
 		ExprId SetVarSplitSSA(size_t size, const BNILVariable& high, size_t highIndex,
 			const BNILVariable& low, size_t lowIndex, ExprId src);
+		ExprId SetVarAliased(size_t size, const BNILVariable& var, size_t destIndex, size_t srcIndex, ExprId src);
+		ExprId SetVarFieldAliased(size_t size, const BNILVariable& var, size_t destIndex, size_t srcIndex,
+			int64_t offset, ExprId src);
 		ExprId Var(size_t size, const BNILVariable& var);
 		ExprId VarField(size_t size, const BNILVariable& var, int64_t offset);
 		ExprId VarSSA(size_t size, const BNILVariable& var, size_t index);
 		ExprId VarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex);
+		ExprId VarAliased(size_t size, const BNILVariable& var, size_t memIndex);
+		ExprId VarFieldAliased(size_t size, const BNILVariable& var, int64_t offset, size_t memIndex);
 		ExprId AddressOf(size_t size, const BNILVariable& var);
 		ExprId AddressOfField(size_t size, const BNILVariable& var, int64_t offset);
 
diff --git a/binaryninjacore.h b/binaryninjacore.h
index d35f806c..fe8382f9 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -684,8 +684,11 @@ extern "C"
 		MLIL_ZX,
 		MLIL_JUMP,
 		MLIL_JUMP_TO,
-		MLIL_CALL,
-		MLIL_RET,
+		MLIL_CALL, // Not valid in SSA form (see MLIL_CALL_SSA)
+		MLIL_CALL_UNTYPED, // Not valid in SSA form (see MLIL_CALL_UNTYPED_SSA)
+		MLIL_CALL_OUTPUT, // Only valid within MLIL_CALL or MLIL_SYSCALL family instructions
+		MLIL_CALL_PARAM, // Only valid within MLIL_CALL or MLIL_SYSCALL family instructions
+		MLIL_RET, // Not valid in SSA form (see MLIL_RET_SSA)
 		MLIL_NORET,
 		MLIL_IF,
 		MLIL_GOTO,
@@ -701,7 +704,8 @@ extern "C"
 		MLIL_CMP_UGT,
 		MLIL_TEST_BIT,
 		MLIL_BOOL_TO_INT,
-		MLIL_SYSCALL,
+		MLIL_SYSCALL, // Not valid in SSA form (see MLIL_SYSCALL_SSA)
+		MLIL_SYSCALL_UNTYPED, // Not valid in SSA form (see MLIL_SYSCALL_UNTYPED_SSA)
 		MLIL_BP,
 		MLIL_TRAP,
 		MLIL_UNDEF,
@@ -713,12 +717,19 @@ extern "C"
 		MLIL_SET_VAR_SSA_FIELD,
 		MLIL_SET_VAR_SPLIT_SSA,
 		MLIL_VAR_SPLIT_DEST_SSA,
+		MLIL_SET_VAR_ALIASED,
+		MLIL_SET_VAR_ALIASED_FIELD,
 		MLIL_VAR_SSA,
 		MLIL_VAR_SSA_FIELD,
+		MLIL_VAR_ALIASED,
+		MLIL_VAR_ALIASED_FIELD,
 		MLIL_CALL_SSA,
+		MLIL_CALL_UNTYPED_SSA,
 		MLIL_SYSCALL_SSA,
-		MLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
-		MLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		MLIL_SYSCALL_UNTYPED_SSA,
+		MLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA, LLIL_SYSCALL_SSA family instructions
+		MLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA family instructions
+		MLIL_RET_SSA,
 		MLIL_LOAD_SSA,
 		MLIL_STORE_SSA,
 		MLIL_VAR_PHI,
@@ -729,7 +740,7 @@ extern "C"
 	{
 		BNMediumLevelILOperation operation;
 		size_t size;
-		uint64_t operands[5];
+		uint64_t operands[6];
 		uint64_t address;
 	};
 
@@ -2169,7 +2180,7 @@ extern "C"
 	BINARYNINJACOREAPI size_t BNMediumLevelILGetInstructionStart(BNMediumLevelILFunction* func,
 		BNArchitecture* arch, uint64_t addr);
 	BINARYNINJACOREAPI size_t BNMediumLevelILAddExpr(BNMediumLevelILFunction* func, BNMediumLevelILOperation operation,
-		size_t size, uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e);
+		size_t size, uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e, uint64_t f);
 	BINARYNINJACOREAPI size_t BNMediumLevelILAddInstruction(BNMediumLevelILFunction* func, size_t expr);
 	BINARYNINJACOREAPI size_t BNMediumLevelILGoto(BNMediumLevelILFunction* func, BNMediumLevelILLabel* label);
 	BINARYNINJACOREAPI size_t BNMediumLevelILIf(BNMediumLevelILFunction* func, uint64_t op,
diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp
index 8c97db61..f1f0bdd2 100644
--- a/mediumlevelil.cpp
+++ b/mediumlevelil.cpp
@@ -61,9 +61,9 @@ size_t MediumLevelILFunction::GetInstructionStart(Architecture* arch, uint64_t a
 
 
 ExprId MediumLevelILFunction::AddExpr(BNMediumLevelILOperation operation, size_t size,
-	ExprId a, ExprId b, ExprId c, ExprId d, ExprId e)
+	ExprId a, ExprId b, ExprId c, ExprId d, ExprId e, ExprId f)
 {
-	return BNMediumLevelILAddExpr(m_object, operation, size, a, b, c, d, e);
+	return BNMediumLevelILAddExpr(m_object, operation, size, a, b, c, d, e, f);
 }
 
 
@@ -100,11 +100,11 @@ ExprId MediumLevelILFunction::SetVarSSA(size_t size, const BNILVariable& var, si
 }
 
 
-ExprId MediumLevelILFunction::SetVarFieldSSA(size_t size, const BNILVariable& var, int64_t offset,
-	size_t varIndex, ExprId src)
+ExprId MediumLevelILFunction::SetVarFieldSSA(size_t size, const BNILVariable& var, size_t varIndex,
+	int64_t offset, ExprId src)
 {
 	return AddExpr(MLIL_SET_VAR_SSA_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier,
-		offset, varIndex, src);
+		varIndex, offset, src);
 }
 
 
@@ -119,6 +119,22 @@ ExprId MediumLevelILFunction::SetVarSplitSSA(size_t size, const BNILVariable& hi
 }
 
 
+ExprId MediumLevelILFunction::SetVarAliased(size_t size, const BNILVariable& var, size_t destIndex,
+	size_t srcIndex, ExprId src)
+{
+	return AddExpr(MLIL_SET_VAR_ALIASED, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier,
+		destIndex, srcIndex, src);
+}
+
+
+ExprId MediumLevelILFunction::SetVarFieldAliased(size_t size, const BNILVariable& var, size_t destIndex,
+	size_t srcIndex, int64_t offset, ExprId src)
+{
+	return AddExpr(MLIL_SET_VAR_ALIASED_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier,
+		destIndex, srcIndex, offset, src);
+}
+
+
 ExprId MediumLevelILFunction::Var(size_t size, const BNILVariable& var)
 {
 	return AddExpr(MLIL_VAR, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier);
@@ -145,6 +161,19 @@ ExprId MediumLevelILFunction::VarFieldSSA(size_t size, const BNILVariable& var,
 }
 
 
+ExprId MediumLevelILFunction::VarAliased(size_t size, const BNILVariable& var, size_t memIndex)
+{
+	return AddExpr(MLIL_VAR_ALIASED, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, memIndex);
+}
+
+
+ExprId MediumLevelILFunction::VarFieldAliased(size_t size, const BNILVariable& var, int64_t offset, size_t memIndex)
+{
+	return AddExpr(MLIL_VAR_ALIASED_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier,
+		offset, memIndex);
+}
+
+
 ExprId MediumLevelILFunction::AddressOf(size_t size, const BNILVariable& var)
 {
 	return AddExpr(MLIL_ADDRESS_OF, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier);
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
index 839c45ce..fa6371f8 100644
--- a/python/mediumlevelil.py
+++ b/python/mediumlevelil.py
@@ -84,8 +84,11 @@ class MediumLevelILInstruction(object):
 		MediumLevelILOperation.MLIL_ZX: [("src", "expr")],
 		MediumLevelILOperation.MLIL_JUMP: [("dest", "expr")],
 		MediumLevelILOperation.MLIL_JUMP_TO: [("dest", "expr"), ("targets", "int_list")],
-		MediumLevelILOperation.MLIL_CALL: [("dest", "expr")],
-		MediumLevelILOperation.MLIL_RET: [],
+		MediumLevelILOperation.MLIL_CALL: [("output", "var_list"), ("dest", "expr"), ("params", "var_list")],
+		MediumLevelILOperation.MLIL_CALL_UNTYPED: [("output", "expr"), ("dest", "expr"), ("params", "expr"), ("stack", "expr")],
+		MediumLevelILOperation.MLIL_CALL_OUTPUT: [("dest", "var_list")],
+		MediumLevelILOperation.MLIL_CALL_PARAM: [("src", "var_list")],
+		MediumLevelILOperation.MLIL_RET: [("src", "var_list")],
 		MediumLevelILOperation.MLIL_NORET: [],
 		MediumLevelILOperation.MLIL_IF: [("condition", "expr"), ("true", "int"), ("false", "int")],
 		MediumLevelILOperation.MLIL_GOTO: [("dest", "int")],
@@ -101,7 +104,8 @@ class MediumLevelILInstruction(object):
 		MediumLevelILOperation.MLIL_CMP_UGT: [("left", "expr"), ("right", "expr")],
 		MediumLevelILOperation.MLIL_TEST_BIT: [("left", "expr"), ("right", "expr")],
 		MediumLevelILOperation.MLIL_BOOL_TO_INT: [("src", "expr")],
-		MediumLevelILOperation.MLIL_SYSCALL: [],
+		MediumLevelILOperation.MLIL_SYSCALL: [("output", "var_list"), ("params", "var_list")],
+		MediumLevelILOperation.MLIL_SYSCALL_UNTYPED: [("output", "expr"), ("params", "expr"), ("stack", "expr")],
 		MediumLevelILOperation.MLIL_BP: [],
 		MediumLevelILOperation.MLIL_TRAP: [("vector", "int")],
 		MediumLevelILOperation.MLIL_UNDEF: [],
@@ -110,11 +114,17 @@ class MediumLevelILInstruction(object):
 		MediumLevelILOperation.MLIL_SET_VAR_SSA: [("dest", "var"), ("index", "int"), ("src", "expr")],
 		MediumLevelILOperation.MLIL_SET_VAR_SSA_FIELD: [("dest", "var"), ("index", "int"), ("offset", "int"), ("src", "expr")],
 		MediumLevelILOperation.MLIL_SET_VAR_SPLIT_SSA: [("high", "expr"), ("low", "expr"), ("src", "expr")],
+		MediumLevelILOperation.MLIL_SET_VAR_ALIASED: [("dest", "var"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "exor")],
+		MediumLevelILOperation.MLIL_SET_VAR_ALIASED_FIELD: [("dest", "var"), ("dest_memory", "int"), ("src_memory", "int"), ("offset", "int"), ("src", "exor")],
 		MediumLevelILOperation.MLIL_VAR_SPLIT_DEST_SSA: [("dest", "var"), ("index", "int")],
 		MediumLevelILOperation.MLIL_VAR_SSA: [("src", "var"), ("index", "int")],
 		MediumLevelILOperation.MLIL_VAR_SSA_FIELD: [("src", "var"), ("index", "int"), ("offset", "int")],
+		MediumLevelILOperation.MLIL_VAR_ALIASED: [("src", "var"), ("src_memory", "int")],
+		MediumLevelILOperation.MLIL_VAR_ALIASED_FIELD: [("src", "var"), ("src_memory", "int"), ("offset", "int")],
 		MediumLevelILOperation.MLIL_CALL_SSA: [("output", "expr"), ("dest", "expr"), ("param", "expr")],
+		MediumLevelILOperation.MLIL_CALL_UNTYPED_SSA: [("output", "expr"), ("dest", "expr"), ("param", "expr"), ("stack", "expr")],
 		MediumLevelILOperation.MLIL_SYSCALL_SSA: [("output", "expr"), ("param", "expr")],
+		MediumLevelILOperation.MLIL_SYSCALL_UNTYPED_SSA: [("output", "expr"), ("param", "expr"), ("stack", "expr")],
 		MediumLevelILOperation.MLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "var_ssa_list")],
 		MediumLevelILOperation.MLIL_CALL_PARAM_SSA: [("src_memory", "int"), ("src", "var_ssa_list")],
 		MediumLevelILOperation.MLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")],
@@ -134,8 +144,8 @@ class MediumLevelILInstruction(object):
 		operands = MediumLevelILInstruction.ILOperations[instr.operation]
 		self.operands = []
 		i = 0
-		while i < len(operands):
-			name, operand_type = operands[i]
+		for operand in operands:
+			name, operand_type = operand
 			if operand_type == "int":
 				value = instr.operands[i]
 			elif operand_type == "expr":
@@ -150,8 +160,19 @@ class MediumLevelILInstruction(object):
 				count = ctypes.c_ulonglong()
 				operand_list = core.BNMediumLevelILGetOperandList(func.handle, self.expr_index, i, count)
 				value = []
-				for i in xrange(count.value):
-					value.append(operand_list[i])
+				for j in xrange(count.value):
+					value.append(operand_list[j])
+				core.BNMediumLevelILFreeOperandList(operand_list)
+			elif operand_type == "var_list":
+				count = ctypes.c_ulonglong()
+				operand_list = core.BNMediumLevelILGetOperandList(func.handle, self.expr_index, i, count)
+				i += 1
+				value = []
+				for j in xrange(count.value / 2):
+					var_type = ILVariableSourceType(operand_list[j * 2] >> 32)
+					index = operand_list[j * 2] & 0xffffffff
+					identifier = operand_list[(j * 2) + 1]
+					value.append(function.ILVariable(self.function, var_type, index, identifier))
 				core.BNMediumLevelILFreeOperandList(operand_list)
 			elif operand_type == "var_ssa_list":
 				count = ctypes.c_ulonglong()
@@ -167,6 +188,7 @@ class MediumLevelILInstruction(object):
 				core.BNMediumLevelILFreeOperandList(operand_list)
 			self.operands.append(value)
 			self.__dict__[name] = value
+			i += 1
 
 	def __str__(self):
 		tokens = self.tokens