Add MLIL instruction for dealing with direct access to GOT/IAT entries

6 files changed, 22 insertions, 1 deletions

diff --git a/binaryninjaapi.h b/binaryninjaapi.h
index f5f51908..1b02e2f1 100644
--- a/binaryninjaapi.h
+++ b/binaryninjaapi.h
@@ -2727,6 +2727,7 @@ namespace BinaryNinja
 			const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId ImportedAddress(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Add(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId AddWithCarry(size_t size, ExprId left, ExprId right, ExprId carry,
 			const ILSourceLocation& loc = ILSourceLocation());
diff --git a/binaryninjacore.h b/binaryninjacore.h
index 6ba7fda4..44858e6f 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -224,7 +224,8 @@ extern "C"
 		DataSymbolToken = 65,
 		LocalVariableToken = 66,
 		ImportToken = 67,
-		AddressDisplayToken = 68
+		AddressDisplayToken = 68,
+		IndirectImportToken = 69
 	};
 
 	enum BNInstructionTextTokenContext
@@ -651,6 +652,7 @@ extern "C"
 		ConstantPointerValue,
 		StackFrameOffset,
 		ReturnAddressValue,
+		ImportedAddressValue,
 
 		// The following are only valid in BNPossibleValueSet
 		SignedRangeValue,
@@ -746,6 +748,7 @@ extern "C"
 		MLIL_ADDRESS_OF_FIELD,
 		MLIL_CONST,
 		MLIL_CONST_PTR,
+		MLIL_IMPORT,
 		MLIL_ADD,
 		MLIL_ADC,
 		MLIL_SUB,
diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp
index 73f2e59b..ec6aa1c6 100644
--- a/mediumlevelilinstruction.cpp
+++ b/mediumlevelilinstruction.cpp
@@ -149,6 +149,7 @@ unordered_map<BNMediumLevelILOperation, vector<MediumLevelILOperandUsage>>
 		{MLIL_MEM_PHI, {DestMemoryVersionMediumLevelOperandUsage, SourceMemoryVersionsMediumLevelOperandUsage}},
 		{MLIL_CONST, {ConstantMediumLevelOperandUsage}},
 		{MLIL_CONST_PTR, {ConstantMediumLevelOperandUsage}},
+		{MLIL_IMPORT, {ConstantMediumLevelOperandUsage}},
 		{MLIL_ADD, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}},
 		{MLIL_SUB, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}},
 		{MLIL_AND, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}},
@@ -1552,6 +1553,8 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 		return dest->Const(size, GetConstant<MLIL_CONST>(), *this);
 	case MLIL_CONST_PTR:
 		return dest->ConstPointer(size, GetConstant<MLIL_CONST_PTR>(), *this);
+	case MLIL_IMPORT:
+		return dest->ImportedAddress(size, GetConstant<MLIL_IMPORT>(), *this);
 	case MLIL_BP:
 		return dest->Breakpoint(*this);
 	case MLIL_TRAP:
@@ -2086,6 +2089,12 @@ ExprId MediumLevelILFunction::ConstPointer(size_t size, uint64_t val, const ILSo
 }
 
 
+ExprId MediumLevelILFunction::ImportedAddress(size_t size, uint64_t val, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(MLIL_IMPORT, loc, size, val);
+}
+
+
 ExprId MediumLevelILFunction::Add(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_ADD, loc, size, left, right);
diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h
index 066259eb..9a76cb6c 100644
--- a/mediumlevelilinstruction.h
+++ b/mediumlevelilinstruction.h
@@ -934,6 +934,7 @@ namespace BinaryNinja
 
 	template <> struct MediumLevelILInstructionAccessor<MLIL_CONST>: public MediumLevelILConstantInstruction {};
 	template <> struct MediumLevelILInstructionAccessor<MLIL_CONST_PTR>: public MediumLevelILConstantInstruction {};
+	template <> struct MediumLevelILInstructionAccessor<MLIL_IMPORT>: public MediumLevelILConstantInstruction {};
 
 	template <> struct MediumLevelILInstructionAccessor<MLIL_ADD>: public MediumLevelILTwoOperandInstruction {};
 	template <> struct MediumLevelILInstructionAccessor<MLIL_SUB>: public MediumLevelILTwoOperandInstruction {};
diff --git a/python/function.py b/python/function.py
index 553b156f..4af95738 100644
--- a/python/function.py
+++ b/python/function.py
@@ -67,6 +67,8 @@ class RegisterValue(object):
 				self.is_constant = True
 			elif value.state == RegisterValueType.StackFrameOffset:
 				self.offset = value.value
+			elif value.state == RegisterValueType.ImportedAddressValue:
+				self.value = value.value
 		self.confidence = confidence
 
 	def __repr__(self):
@@ -80,6 +82,8 @@ class RegisterValue(object):
 			return "<stack frame offset %#x>" % self.offset
 		if self.type == RegisterValueType.ReturnAddressValue:
 			return "<return address>"
+		if self.type == RegisterValueType.ImportedAddressValue:
+			return "<imported address from entry %#x>" % self.value
 		return "<undetermined>"
 
 	def _to_api_object(self):
@@ -95,6 +99,8 @@ class RegisterValue(object):
 			result.value = self.value
 		elif self.type == RegisterValueType.StackFrameOffset:
 			result.value = self.offset
+		elif self.type == RegisterValueType.ImportedAddressValue:
+			result.value = self.value
 		return result
 
 
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
index 3e7a6997..07759a47 100644
--- a/python/mediumlevelil.py
+++ b/python/mediumlevelil.py
@@ -89,6 +89,7 @@ class MediumLevelILInstruction(object):
 		MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [("src", "var"), ("offset", "int")],
 		MediumLevelILOperation.MLIL_CONST: [("constant", "int")],
 		MediumLevelILOperation.MLIL_CONST_PTR: [("constant", "int")],
+		MediumLevelILOperation.MLIL_IMPORT: [("constant", "int")],
 		MediumLevelILOperation.MLIL_ADD: [("left", "expr"), ("right", "expr")],
 		MediumLevelILOperation.MLIL_ADC: [("left", "expr"), ("right", "expr"), ("carry", "expr")],
 		MediumLevelILOperation.MLIL_SUB: [("left", "expr"), ("right", "expr")],