From 1c6f11277096534479c958b6d9fc5265d318ca2a Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 18 Sep 2017 23:25:08 -0400 Subject: Add basic floating point instructions --- binaryninjaapi.h | 61 +++++++-- binaryninjacore.h | 42 ++++++ lowlevelilinstruction.cpp | 244 ++++++++++++++++++++++++++------- lowlevelilinstruction.h | 61 +++++---- mediumlevelilinstruction.cpp | 250 ++++++++++++++++++++++++++-------- mediumlevelilinstruction.h | 59 ++++---- python/lowlevelil.py | 313 +++++++++++++++++++++++++++++++++++++++---- python/mediumlevelil.py | 27 +++- 8 files changed, 861 insertions(+), 196 deletions(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 9d4a7257..7d686142 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2453,6 +2453,9 @@ namespace BinaryNinja ExprId RegisterSSA(size_t size, const SSARegister& reg, const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterSSAPartial(size_t size, const SSARegister& fullReg, uint32_t partialReg, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterSplit(size_t size, uint32_t high, uint32_t low, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterSplitSSA(size_t size, const SSARegister& high, const SSARegister& low, + const ILSourceLocation& loc = ILSourceLocation()); ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId Flag(uint32_t flag, const ILSourceLocation& loc = ILSourceLocation()); @@ -2497,19 +2500,19 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId DivUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); - ExprId DivDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags = 0, + ExprId DivDoublePrecUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId DivSigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); - ExprId DivDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags = 0, + ExprId DivDoublePrecSigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId ModUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); - ExprId ModDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags = 0, + ExprId ModDoublePrecUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId ModSigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); - ExprId ModDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags = 0, + ExprId ModDoublePrecSigned(size_t size, ExprId a, ExprId b, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId Neg(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId Not(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); @@ -2567,6 +2570,27 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId MemoryPhi(size_t dest, const std::vector& sources, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatAdd(size_t size, ExprId a, ExprId b, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatSub(size_t size, ExprId a, ExprId b, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatMult(size_t size, ExprId a, ExprId b, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatDiv(size_t size, ExprId a, ExprId b, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatSqrt(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatNeg(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatAbs(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatToInt(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId IntToFloat(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatConvert(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareNotEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareLessThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareLessEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareGreaterEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareGreaterThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId Goto(BNLowLevelILLabel& label, const ILSourceLocation& loc = ILSourceLocation()); ExprId If(ExprId operand, BNLowLevelILLabel& t, BNLowLevelILLabel& f, @@ -2725,6 +2749,8 @@ namespace BinaryNinja ExprId Var(size_t size, const Variable& src, const ILSourceLocation& loc = ILSourceLocation()); ExprId VarField(size_t size, const Variable& src, uint64_t offset, const ILSourceLocation& loc = ILSourceLocation()); + ExprId VarSplit(size_t size, const Variable& high, const Variable& low, + const ILSourceLocation& loc = ILSourceLocation()); ExprId VarSSA(size_t size, const SSAVariable& src, const ILSourceLocation& loc = ILSourceLocation()); ExprId VarSSAField(size_t size, const SSAVariable& src, uint64_t offset, const ILSourceLocation& loc = ILSourceLocation()); @@ -2732,6 +2758,8 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId VarAliasedField(size_t size, const Variable& src, size_t memVersion, uint64_t offset, const ILSourceLocation& loc = ILSourceLocation()); + ExprId VarSplitSSA(size_t size, const SSAVariable& high, const SSAVariable& low, + const ILSourceLocation& loc = ILSourceLocation()); ExprId AddressOf(const Variable& var, const ILSourceLocation& loc = ILSourceLocation()); ExprId AddressOfField(const Variable& var, uint64_t offset, const ILSourceLocation& loc = ILSourceLocation()); @@ -2770,17 +2798,17 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId DivUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); - ExprId DivDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId right, + ExprId DivDoublePrecSigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); - ExprId DivDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId right, + ExprId DivDoublePrecUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); ExprId ModSigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); ExprId ModUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); - ExprId ModDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId right, + ExprId ModDoublePrecSigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); - ExprId ModDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId right, + ExprId ModDoublePrecUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); ExprId Neg(size_t size, ExprId src, const ILSourceLocation& loc = ILSourceLocation()); ExprId Not(size_t size, ExprId src, const ILSourceLocation& loc = ILSourceLocation()); @@ -2845,6 +2873,23 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId MemoryPhi(size_t destMemVersion, const std::vector& sourceMemVersions, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatAdd(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatSub(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatMult(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatDiv(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatSqrt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatNeg(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatAbs(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatToInt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId IntToFloat(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatConvert(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareNotEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareLessThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareLessEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareGreaterEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareGreaterThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId Goto(BNMediumLevelILLabel& label, const ILSourceLocation& loc = ILSourceLocation()); ExprId If(ExprId operand, BNMediumLevelILLabel& t, BNMediumLevelILLabel& f, diff --git a/binaryninjacore.h b/binaryninjacore.h index 1bb4c726..9bbea512 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -286,6 +286,7 @@ extern "C" LLIL_PUSH, // Not valid in SSA form (expanded) LLIL_POP, // Not valid in SSA form (expanded) LLIL_REG, // Not valid in SSA form (see LLIL_REG_SSA) + LLIL_REG_SPLIT, // Not valid in SSA form (see LLIL_REG_SPLIT_SSA) LLIL_CONST, LLIL_CONST_PTR, LLIL_FLAG, // Not valid in SSA form (see LLIL_FLAG_SSA) @@ -349,6 +350,25 @@ extern "C" LLIL_UNIMPL, LLIL_UNIMPL_MEM, + // Floating point + LLIL_FADD, + LLIL_FSUB, + LLIL_FMUL, + LLIL_FDIV, + LLIL_FSQRT, + LLIL_FNEG, + LLIL_FABS, + LLIL_FLOAT_TO_INT, + LLIL_INT_TO_FLOAT, + LLIL_FLOAT_CONV, + LLIL_FCMP_E, + LLIL_FCMP_NE, + LLIL_FCMP_LT, + LLIL_FCMP_LE, + LLIL_FCMP_GE, + LLIL_FCMP_GT, + LLIL_FCMP_UO, + // The following instructions are only used in SSA form LLIL_SET_REG_SSA, LLIL_SET_REG_SSA_PARTIAL, @@ -356,6 +376,7 @@ extern "C" LLIL_REG_SPLIT_DEST_SSA, // Only valid within an LLIL_SET_REG_SPLIT_SSA instruction LLIL_REG_SSA, LLIL_REG_SSA_PARTIAL, + LLIL_REG_SPLIT_SSA, LLIL_SET_FLAG_SSA, LLIL_FLAG_SSA, LLIL_FLAG_BIT_SSA, @@ -745,6 +766,7 @@ extern "C" MLIL_STORE_STRUCT, // Not valid in SSA form (see MLIL_STORE_STRUCT_SSA) MLIL_VAR, // Not valid in SSA form (see MLIL_VAR_SSA) MLIL_VAR_FIELD, // Not valid in SSA form (see MLIL_VAR_SSA_FIELD) + MLIL_VAR_SPLIT, // Not valid in SSA form (see MLIL_VAR_SSA) MLIL_ADDRESS_OF, MLIL_ADDRESS_OF_FIELD, MLIL_CONST, @@ -811,6 +833,25 @@ extern "C" MLIL_UNIMPL, MLIL_UNIMPL_MEM, + // Floating point + MLIL_FADD, + MLIL_FSUB, + MLIL_FMUL, + MLIL_FDIV, + MLIL_FSQRT, + MLIL_FNEG, + MLIL_FABS, + MLIL_FLOAT_TO_INT, + MLIL_INT_TO_FLOAT, + MLIL_FLOAT_CONV, + MLIL_FCMP_E, + MLIL_FCMP_NE, + MLIL_FCMP_LT, + MLIL_FCMP_LE, + MLIL_FCMP_GE, + MLIL_FCMP_GT, + MLIL_FCMP_UO, + // The following instructions are only used in SSA form MLIL_SET_VAR_SSA, MLIL_SET_VAR_SSA_FIELD, @@ -821,6 +862,7 @@ extern "C" MLIL_VAR_SSA_FIELD, MLIL_VAR_ALIASED, MLIL_VAR_ALIASED_FIELD, + MLIL_VAR_SPLIT_SSA, MLIL_CALL_SSA, MLIL_CALL_UNTYPED_SSA, MLIL_SYSCALL_SSA, diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index d85e4f17..501b7b72 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -51,8 +51,6 @@ unordered_map {LeftExprLowLevelOperandUsage, ExprLowLevelOperand}, {RightExprLowLevelOperandUsage, ExprLowLevelOperand}, {CarryExprLowLevelOperandUsage, ExprLowLevelOperand}, - {HighExprLowLevelOperandUsage, ExprLowLevelOperand}, - {LowExprLowLevelOperandUsage, ExprLowLevelOperand}, {ConditionExprLowLevelOperandUsage, ExprLowLevelOperand}, {HighRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, {HighSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, @@ -105,6 +103,8 @@ unordered_map> {LLIL_REG, {SourceRegisterLowLevelOperandUsage}}, {LLIL_REG_SSA, {SourceSSARegisterLowLevelOperandUsage}}, {LLIL_REG_SSA_PARTIAL, {SourceSSARegisterLowLevelOperandUsage, PartialRegisterLowLevelOperandUsage}}, + {LLIL_REG_SPLIT, {HighRegisterLowLevelOperandUsage, LowRegisterLowLevelOperandUsage}}, + {LLIL_REG_SPLIT_SSA, {HighSSARegisterLowLevelOperandUsage, LowSSARegisterLowLevelOperandUsage}}, {LLIL_FLAG, {SourceFlagLowLevelOperandUsage}}, {LLIL_FLAG_BIT, {SourceFlagLowLevelOperandUsage, BitIndexLowLevelOperandUsage}}, {LLIL_FLAG_SSA, {SourceSSAFlagLowLevelOperandUsage}}, @@ -163,10 +163,10 @@ unordered_map> {LLIL_SBB, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage, CarryExprLowLevelOperandUsage}}, {LLIL_RLC, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage, CarryExprLowLevelOperandUsage}}, {LLIL_RRC, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage, CarryExprLowLevelOperandUsage}}, - {LLIL_DIVU_DP, {HighExprLowLevelOperandUsage, LowExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, - {LLIL_DIVS_DP, {HighExprLowLevelOperandUsage, LowExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, - {LLIL_MODU_DP, {HighExprLowLevelOperandUsage, LowExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, - {LLIL_MODS_DP, {HighExprLowLevelOperandUsage, LowExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_DIVU_DP, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_DIVS_DP, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_MODU_DP, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_MODS_DP, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_PUSH, {SourceExprLowLevelOperandUsage}}, {LLIL_NEG, {SourceExprLowLevelOperandUsage}}, {LLIL_NOT, {SourceExprLowLevelOperandUsage}}, @@ -174,7 +174,24 @@ unordered_map> {LLIL_ZX, {SourceExprLowLevelOperandUsage}}, {LLIL_LOW_PART, {SourceExprLowLevelOperandUsage}}, {LLIL_BOOL_TO_INT, {SourceExprLowLevelOperandUsage}}, - {LLIL_UNIMPL_MEM, {SourceExprLowLevelOperandUsage}} + {LLIL_UNIMPL_MEM, {SourceExprLowLevelOperandUsage}}, + {LLIL_FADD, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FSUB, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FMUL, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FDIV, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FSQRT, {SourceExprLowLevelOperandUsage}}, + {LLIL_FNEG, {SourceExprLowLevelOperandUsage}}, + {LLIL_FABS, {SourceExprLowLevelOperandUsage}}, + {LLIL_FLOAT_TO_INT, {SourceExprLowLevelOperandUsage}}, + {LLIL_INT_TO_FLOAT, {SourceExprLowLevelOperandUsage}}, + {LLIL_FLOAT_CONV, {SourceExprLowLevelOperandUsage}}, + {LLIL_FCMP_E, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_NE, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_LT, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_LE, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_GE, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_GT, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, + {LLIL_FCMP_UO, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}} }; @@ -1179,6 +1196,12 @@ void LowLevelILInstruction::VisitExprs(const std::functionRegisterSSAPartial(size, GetSourceSSARegister(), GetPartialRegister(), *this); + case LLIL_REG_SPLIT: + return dest->RegisterSplit(size, GetHighRegister(), + GetLowRegister(), *this); + case LLIL_REG_SPLIT_SSA: + return dest->RegisterSplitSSA(size, GetHighSSARegister(), + GetLowSSARegister(), *this); case LLIL_FLAG: return dest->Flag(GetSourceFlag(), *this); case LLIL_FLAG_SSA: @@ -1371,6 +1407,12 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_LOW_PART: case LLIL_BOOL_TO_INT: case LLIL_UNIMPL_MEM: + case LLIL_FSQRT: + case LLIL_FNEG: + case LLIL_FABS: + case LLIL_FLOAT_TO_INT: + case LLIL_INT_TO_FLOAT: + case LLIL_FLOAT_CONV: return dest->AddExprWithLocation(operation, *this, size, flags, subExprHandler(AsOneOperand().GetSourceExpr())); case LLIL_ADD: @@ -1390,6 +1432,10 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_DIVS: case LLIL_MODU: case LLIL_MODS: + case LLIL_DIVU_DP: + case LLIL_DIVS_DP: + case LLIL_MODU_DP: + case LLIL_MODS_DP: case LLIL_CMP_E: case LLIL_CMP_NE: case LLIL_CMP_SLT: @@ -1402,6 +1448,17 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_CMP_UGT: case LLIL_TEST_BIT: case LLIL_ADD_OVERFLOW: + case LLIL_FADD: + case LLIL_FSUB: + case LLIL_FMUL: + case LLIL_FDIV: + case LLIL_FCMP_E: + case LLIL_FCMP_NE: + case LLIL_FCMP_LT: + case LLIL_FCMP_LE: + case LLIL_FCMP_GE: + case LLIL_FCMP_GT: + case LLIL_FCMP_UO: return dest->AddExprWithLocation(operation, *this, size, flags, subExprHandler(AsTwoOperand().GetLeftExpr()), subExprHandler(AsTwoOperand().GetRightExpr())); case LLIL_ADC: @@ -1412,14 +1469,6 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, subExprHandler(AsTwoOperandWithCarry().GetLeftExpr()), subExprHandler(AsTwoOperandWithCarry().GetRightExpr()), subExprHandler(AsTwoOperandWithCarry().GetCarryExpr())); - case LLIL_DIVU_DP: - case LLIL_DIVS_DP: - case LLIL_MODU_DP: - case LLIL_MODS_DP: - return dest->AddExprWithLocation(operation, *this, size, flags, - subExprHandler(AsDoublePrecision().GetHighExpr()), - subExprHandler(AsDoublePrecision().GetLowExpr()), - subExprHandler(AsDoublePrecision().GetRightExpr())); default: throw LowLevelILInstructionAccessException(); } @@ -1574,24 +1623,6 @@ LowLevelILInstruction LowLevelILInstruction::GetCarryExpr() const } -LowLevelILInstruction LowLevelILInstruction::GetHighExpr() const -{ - size_t operandIndex; - if (GetOperandIndexForUsage(HighExprLowLevelOperandUsage, operandIndex)) - return GetRawOperandAsExpr(operandIndex); - throw LowLevelILInstructionAccessException(); -} - - -LowLevelILInstruction LowLevelILInstruction::GetLowExpr() const -{ - size_t operandIndex; - if (GetOperandIndexForUsage(LowExprLowLevelOperandUsage, operandIndex)) - return GetRawOperandAsExpr(operandIndex); - throw LowLevelILInstructionAccessException(); -} - - LowLevelILInstruction LowLevelILInstruction::GetConditionExpr() const { size_t operandIndex; @@ -1899,6 +1930,19 @@ ExprId LowLevelILFunction::RegisterSSAPartial(size_t size, const SSARegister& fu } +ExprId LowLevelILFunction::RegisterSplit(size_t size, uint32_t high, uint32_t low, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_SPLIT, loc, size, 0, high, low); +} + + +ExprId LowLevelILFunction::RegisterSplitSSA(size_t size, const SSARegister& high, const SSARegister& low, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_SPLIT_SSA, loc, size, 0, high.reg, high.version, low.reg, low.version); +} + + ExprId LowLevelILFunction::Const(size_t size, uint64_t val, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_CONST, loc, size, 0, val); @@ -2054,10 +2098,10 @@ ExprId LowLevelILFunction::DivUnsigned(size_t size, ExprId a, ExprId b, uint32_t } -ExprId LowLevelILFunction::DivDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags, +ExprId LowLevelILFunction::DivDoublePrecUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_DIVU_DP, loc, size, flags, high, low, div); + return AddExprWithLocation(LLIL_DIVU_DP, loc, size, flags, a, b); } @@ -2067,10 +2111,10 @@ ExprId LowLevelILFunction::DivSigned(size_t size, ExprId a, ExprId b, uint32_t f } -ExprId LowLevelILFunction::DivDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags, +ExprId LowLevelILFunction::DivDoublePrecSigned(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_DIVS_DP, loc, size, flags, high, low, div); + return AddExprWithLocation(LLIL_DIVS_DP, loc, size, flags, a, b); } @@ -2081,10 +2125,10 @@ ExprId LowLevelILFunction::ModUnsigned(size_t size, ExprId a, ExprId b, uint32_t } -ExprId LowLevelILFunction::ModDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags, +ExprId LowLevelILFunction::ModDoublePrecUnsigned(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_MODU_DP, loc, size, flags, high, low, div); + return AddExprWithLocation(LLIL_MODU_DP, loc, size, flags, a, b); } @@ -2094,10 +2138,10 @@ ExprId LowLevelILFunction::ModSigned(size_t size, ExprId a, ExprId b, uint32_t f } -ExprId LowLevelILFunction::ModDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId div, uint32_t flags, +ExprId LowLevelILFunction::ModDoublePrecSigned(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_MODS_DP, loc, size, flags, high, low, div); + return AddExprWithLocation(LLIL_MODS_DP, loc, size, flags, a, b); } @@ -2326,3 +2370,105 @@ ExprId LowLevelILFunction::MemoryPhi(size_t dest, const vector& sources, { return AddExprWithLocation(LLIL_MEM_PHI, loc, 0, 0, dest, sources.size(), AddIndexList(sources)); } + + +ExprId LowLevelILFunction::FloatAdd(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FADD, loc, size, flags, a, b); +} + + +ExprId LowLevelILFunction::FloatSub(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FSUB, loc, size, flags, a, b); +} + + +ExprId LowLevelILFunction::FloatMult(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FMUL, loc, size, flags, a, b); +} + + +ExprId LowLevelILFunction::FloatDiv(size_t size, ExprId a, ExprId b, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FDIV, loc, size, flags, a, b); +} + + +ExprId LowLevelILFunction::FloatSqrt(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FSQRT, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatNeg(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FNEG, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatAbs(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FABS, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatToInt(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FLOAT_TO_INT, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::IntToFloat(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_INT_TO_FLOAT, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatConvert(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FLOAT_CONV, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_E, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareNotEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_NE, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareLessThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_LT, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareLessEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_LE, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareGreaterEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_GE, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareGreaterThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_GT, loc, size, 0, a, b); +} + + +ExprId LowLevelILFunction::FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_UO, loc, size, 0, a, b); +} diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index b2849d44..8c8fe55f 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -49,7 +49,6 @@ namespace BinaryNinja struct LowLevelILOneOperandInstruction; struct LowLevelILTwoOperandInstruction; struct LowLevelILTwoOperandWithCarryInstruction; - struct LowLevelILDoublePrecisionInstruction; struct LowLevelILLabel; struct MediumLevelILInstruction; class LowLevelILOperand; @@ -118,8 +117,6 @@ namespace BinaryNinja LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage, CarryExprLowLevelOperandUsage, - HighExprLowLevelOperandUsage, - LowExprLowLevelOperandUsage, ConditionExprLowLevelOperandUsage, HighRegisterLowLevelOperandUsage, HighSSARegisterLowLevelOperandUsage, @@ -428,10 +425,6 @@ namespace BinaryNinja { return *(LowLevelILTwoOperandWithCarryInstruction*)this; } - LowLevelILDoublePrecisionInstruction& AsDoublePrecision() - { - return *(LowLevelILDoublePrecisionInstruction*)this; - } template const LowLevelILInstructionAccessor& As() const @@ -456,10 +449,6 @@ namespace BinaryNinja { return *(const LowLevelILTwoOperandWithCarryInstruction*)this; } - const LowLevelILDoublePrecisionInstruction& AsDoublePrecision() const - { - return *(const LowLevelILDoublePrecisionInstruction*)this; - } }; struct LowLevelILInstruction: public LowLevelILInstructionBase @@ -491,8 +480,6 @@ namespace BinaryNinja template LowLevelILInstruction GetLeftExpr() const { return As().GetLeftExpr(); } template LowLevelILInstruction GetRightExpr() const { return As().GetRightExpr(); } template LowLevelILInstruction GetCarryExpr() const { return As().GetCarryExpr(); } - template LowLevelILInstruction GetHighExpr() const { return As().GetHighExpr(); } - template LowLevelILInstruction GetLowExpr() const { return As().GetLowExpr(); } template LowLevelILInstruction GetConditionExpr() const { return As().GetConditionExpr(); } template uint32_t GetHighRegister() const { return As().GetHighRegister(); } template SSARegister GetHighSSARegister() const { return As().GetHighSSARegister(); } @@ -544,8 +531,6 @@ namespace BinaryNinja LowLevelILInstruction GetLeftExpr() const; LowLevelILInstruction GetRightExpr() const; LowLevelILInstruction GetCarryExpr() const; - LowLevelILInstruction GetHighExpr() const; - LowLevelILInstruction GetLowExpr() const; LowLevelILInstruction GetConditionExpr() const; uint32_t GetHighRegister() const; SSARegister GetHighSSARegister() const; @@ -651,13 +636,6 @@ namespace BinaryNinja LowLevelILInstruction GetCarryExpr() const { return GetRawOperandAsExpr(2); } }; - struct LowLevelILDoublePrecisionInstruction: public LowLevelILInstructionBase - { - LowLevelILInstruction GetHighExpr() const { return GetRawOperandAsExpr(0); } - LowLevelILInstruction GetLowExpr() const { return GetRawOperandAsExpr(1); } - LowLevelILInstruction GetRightExpr() const { return GetRawOperandAsExpr(2); } - }; - // Implementations of each instruction to fetch the correct operand value for the valid operands, these // are derived from LowLevelILInstructionBase so that invalid operand accessor functions will generate // a compiler error. @@ -764,6 +742,19 @@ namespace BinaryNinja void SetSourceSSAVersion(size_t version) { UpdateRawOperand(1, version); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetHighRegister() const { return GetRawOperandAsRegister(0); } + uint32_t GetLowRegister() const { return GetRawOperandAsRegister(1); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegister GetHighSSARegister() const { return GetRawOperandAsSSARegister(0); } + SSARegister GetLowSSARegister() const { return GetRawOperandAsSSARegister(2); } + void SetHighSSAVersion(size_t version) { UpdateRawOperand(1, version); } + void SetLowSSAVersion(size_t version) { UpdateRawOperand(3, version); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(0); } @@ -880,6 +871,10 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; @@ -892,17 +887,23 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandWithCarryInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandWithCarryInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandWithCarryInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandWithCarryInstruction {}; - template <> struct LowLevelILInstructionAccessor: public LowLevelILDoublePrecisionInstruction {}; - template <> struct LowLevelILInstructionAccessor: public LowLevelILDoublePrecisionInstruction {}; - template <> struct LowLevelILInstructionAccessor: public LowLevelILDoublePrecisionInstruction {}; - template <> struct LowLevelILInstructionAccessor: public LowLevelILDoublePrecisionInstruction {}; - template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; @@ -911,4 +912,10 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; } diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index ec6aa1c6..b0e607b2 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -45,8 +45,6 @@ unordered_map {LeftExprMediumLevelOperandUsage, ExprMediumLevelOperand}, {RightExprMediumLevelOperandUsage, ExprMediumLevelOperand}, {CarryExprMediumLevelOperandUsage, ExprMediumLevelOperand}, - {HighExprMediumLevelOperandUsage, ExprMediumLevelOperand}, - {LowExprMediumLevelOperandUsage, ExprMediumLevelOperand}, {StackExprMediumLevelOperandUsage, ExprMediumLevelOperand}, {ConditionExprMediumLevelOperandUsage, ExprMediumLevelOperand}, {HighVariableMediumLevelOperandUsage, VariableMediumLevelOperand}, @@ -112,10 +110,12 @@ unordered_map> SourceExprMediumLevelOperandUsage}}, {MLIL_VAR, {SourceVariableMediumLevelOperandUsage}}, {MLIL_VAR_FIELD, {SourceVariableMediumLevelOperandUsage, OffsetMediumLevelOperandUsage}}, + {MLIL_VAR_SPLIT, {HighVariableMediumLevelOperandUsage, LowVariableMediumLevelOperandUsage}}, {MLIL_VAR_SSA, {SourceSSAVariableMediumLevelOperandUsage}}, {MLIL_VAR_SSA_FIELD, {SourceSSAVariableMediumLevelOperandUsage, OffsetMediumLevelOperandUsage}}, {MLIL_VAR_ALIASED, {SourceSSAVariableMediumLevelOperandUsage}}, {MLIL_VAR_ALIASED_FIELD, {SourceSSAVariableMediumLevelOperandUsage, OffsetMediumLevelOperandUsage}}, + {MLIL_VAR_SPLIT_SSA, {HighSSAVariableMediumLevelOperandUsage, LowSSAVariableMediumLevelOperandUsage}}, {MLIL_ADDRESS_OF, {SourceVariableMediumLevelOperandUsage}}, {MLIL_ADDRESS_OF_FIELD, {SourceVariableMediumLevelOperandUsage, OffsetMediumLevelOperandUsage}}, {MLIL_JUMP, {DestExprMediumLevelOperandUsage}}, @@ -187,21 +187,34 @@ unordered_map> CarryExprMediumLevelOperandUsage}}, {MLIL_RRC, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage, CarryExprMediumLevelOperandUsage}}, - {MLIL_DIVU_DP, {HighExprMediumLevelOperandUsage, LowExprMediumLevelOperandUsage, - RightExprMediumLevelOperandUsage}}, - {MLIL_DIVS_DP, {HighExprMediumLevelOperandUsage, LowExprMediumLevelOperandUsage, - RightExprMediumLevelOperandUsage}}, - {MLIL_MODU_DP, {HighExprMediumLevelOperandUsage, LowExprMediumLevelOperandUsage, - RightExprMediumLevelOperandUsage}}, - {MLIL_MODS_DP, {HighExprMediumLevelOperandUsage, LowExprMediumLevelOperandUsage, - RightExprMediumLevelOperandUsage}}, + {MLIL_DIVU_DP, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_DIVS_DP, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_MODU_DP, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_MODS_DP, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_NEG, {SourceExprMediumLevelOperandUsage}}, {MLIL_NOT, {SourceExprMediumLevelOperandUsage}}, {MLIL_SX, {SourceExprMediumLevelOperandUsage}}, {MLIL_ZX, {SourceExprMediumLevelOperandUsage}}, {MLIL_LOW_PART, {SourceExprMediumLevelOperandUsage}}, {MLIL_BOOL_TO_INT, {SourceExprMediumLevelOperandUsage}}, - {MLIL_UNIMPL_MEM, {SourceExprMediumLevelOperandUsage}} + {MLIL_UNIMPL_MEM, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FADD, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FSUB, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FMUL, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FDIV, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FSQRT, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FNEG, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FABS, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FLOAT_TO_INT, {SourceExprMediumLevelOperandUsage}}, + {MLIL_INT_TO_FLOAT, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FLOAT_CONV, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FCMP_E, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_NE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_LT, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_LE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_GE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_GT, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_UO, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}} }; @@ -1266,6 +1279,12 @@ void MediumLevelILInstruction::VisitExprs(const std::functionVarField(size, GetSourceVariable(), GetOffset(), *this); + case MLIL_VAR_SPLIT: + return dest->VarSplit(size, GetHighVariable(), + GetLowVariable(), *this); case MLIL_VAR_SSA: return dest->VarSSA(size, GetSourceSSAVariable(), *this); case MLIL_VAR_SSA_FIELD: @@ -1392,6 +1421,9 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, return dest->VarAliasedField(size, GetSourceSSAVariable().var, GetSourceSSAVariable().version, GetOffset(), *this); + case MLIL_VAR_SPLIT_SSA: + return dest->VarSplitSSA(size, GetHighSSAVariable(), + GetLowSSAVariable(), *this); case MLIL_ADDRESS_OF: return dest->AddressOf(GetSourceVariable(), *this); case MLIL_ADDRESS_OF_FIELD: @@ -1477,6 +1509,12 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, case MLIL_BOOL_TO_INT: case MLIL_JUMP: case MLIL_UNIMPL_MEM: + case MLIL_FSQRT: + case MLIL_FNEG: + case MLIL_FABS: + case MLIL_FLOAT_TO_INT: + case MLIL_INT_TO_FLOAT: + case MLIL_FLOAT_CONV: return dest->AddExprWithLocation(operation, *this, size, subExprHandler(AsOneOperand().GetSourceExpr())); case MLIL_ADD: @@ -1496,6 +1534,10 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, case MLIL_DIVS: case MLIL_MODU: case MLIL_MODS: + case MLIL_DIVU_DP: + case MLIL_DIVS_DP: + case MLIL_MODU_DP: + case MLIL_MODS_DP: case MLIL_CMP_E: case MLIL_CMP_NE: case MLIL_CMP_SLT: @@ -1508,6 +1550,17 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, case MLIL_CMP_UGT: case MLIL_TEST_BIT: case MLIL_ADD_OVERFLOW: + case MLIL_FADD: + case MLIL_FSUB: + case MLIL_FMUL: + case MLIL_FDIV: + case MLIL_FCMP_E: + case MLIL_FCMP_NE: + case MLIL_FCMP_LT: + case MLIL_FCMP_LE: + case MLIL_FCMP_GE: + case MLIL_FCMP_GT: + case MLIL_FCMP_UO: return dest->AddExprWithLocation(operation, *this, size, subExprHandler(AsTwoOperand().GetLeftExpr()), subExprHandler(AsTwoOperand().GetRightExpr())); case MLIL_ADC: @@ -1518,14 +1571,6 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, subExprHandler(AsTwoOperandWithCarry().GetLeftExpr()), subExprHandler(AsTwoOperandWithCarry().GetRightExpr()), subExprHandler(AsTwoOperandWithCarry().GetCarryExpr())); - case MLIL_DIVU_DP: - case MLIL_DIVS_DP: - case MLIL_MODU_DP: - case MLIL_MODS_DP: - return dest->AddExprWithLocation(operation, *this, size, - subExprHandler(AsDoublePrecision().GetHighExpr()), - subExprHandler(AsDoublePrecision().GetLowExpr()), - subExprHandler(AsDoublePrecision().GetRightExpr())); case MLIL_JUMP_TO: for (auto target : GetTargetList()) { @@ -1665,24 +1710,6 @@ MediumLevelILInstruction MediumLevelILInstruction::GetCarryExpr() const } -MediumLevelILInstruction MediumLevelILInstruction::GetHighExpr() const -{ - size_t operandIndex; - if (GetOperandIndexForUsage(HighExprMediumLevelOperandUsage, operandIndex)) - return GetRawOperandAsExpr(operandIndex); - throw MediumLevelILInstructionAccessException(); -} - - -MediumLevelILInstruction MediumLevelILInstruction::GetLowExpr() const -{ - size_t operandIndex; - if (GetOperandIndexForUsage(LowExprMediumLevelOperandUsage, operandIndex)) - return GetRawOperandAsExpr(operandIndex); - throw MediumLevelILInstructionAccessException(); -} - - MediumLevelILInstruction MediumLevelILInstruction::GetStackExpr() const { size_t operandIndex; @@ -2036,6 +2063,13 @@ ExprId MediumLevelILFunction::VarField(size_t size, const Variable& src, uint64_ } +ExprId MediumLevelILFunction::VarSplit(size_t size, const Variable& high, const Variable& low, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_VAR_SPLIT, loc, size, high.ToIdentifier(), low.ToIdentifier()); +} + + ExprId MediumLevelILFunction::VarSSA(size_t size, const SSAVariable& src, const ILSourceLocation& loc) { @@ -2064,6 +2098,14 @@ ExprId MediumLevelILFunction::VarAliasedField(size_t size, const Variable& src, } +ExprId MediumLevelILFunction::VarSplitSSA(size_t size, const SSAVariable& high, const SSAVariable& low, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_VAR_SPLIT_SSA, loc, size, high.var.ToIdentifier(), high.version, + low.var.ToIdentifier(), low.version); +} + + ExprId MediumLevelILFunction::AddressOf(const Variable& var, const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_ADDRESS_OF, loc, 0, var.ToIdentifier()); @@ -2223,17 +2265,17 @@ ExprId MediumLevelILFunction::DivUnsigned(size_t size, ExprId left, ExprId right } -ExprId MediumLevelILFunction::DivDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId right, +ExprId MediumLevelILFunction::DivDoublePrecSigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc) { - return AddExprWithLocation(MLIL_DIVS_DP, loc, size, high, low, right); + return AddExprWithLocation(MLIL_DIVS_DP, loc, size, left, right); } -ExprId MediumLevelILFunction::DivDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId right, +ExprId MediumLevelILFunction::DivDoublePrecUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc) { - return AddExprWithLocation(MLIL_DIVU_DP, loc, size, high, low, right); + return AddExprWithLocation(MLIL_DIVU_DP, loc, size, left, right); } @@ -2251,17 +2293,17 @@ ExprId MediumLevelILFunction::ModUnsigned(size_t size, ExprId left, ExprId right } -ExprId MediumLevelILFunction::ModDoublePrecSigned(size_t size, ExprId high, ExprId low, ExprId right, +ExprId MediumLevelILFunction::ModDoublePrecSigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc) { - return AddExprWithLocation(MLIL_MODS_DP, loc, size, high, low, right); + return AddExprWithLocation(MLIL_MODS_DP, loc, size, left, right); } -ExprId MediumLevelILFunction::ModDoublePrecUnsigned(size_t size, ExprId high, ExprId low, ExprId right, +ExprId MediumLevelILFunction::ModDoublePrecUnsigned(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc) { - return AddExprWithLocation(MLIL_MODU_DP, loc, size, high, low, right); + return AddExprWithLocation(MLIL_MODU_DP, loc, size, left, right); } @@ -2533,3 +2575,105 @@ ExprId MediumLevelILFunction::MemoryPhi(size_t destMemVersion, const vector const MediumLevelILInstructionAccessor& As() const @@ -456,10 +450,6 @@ namespace BinaryNinja { return *(const MediumLevelILTwoOperandWithCarryInstruction*)this; } - const MediumLevelILDoublePrecisionInstruction& AsDoublePrecision() const - { - return *(const MediumLevelILDoublePrecisionInstruction*)this; - } }; struct MediumLevelILInstruction: public MediumLevelILInstructionBase @@ -485,8 +475,6 @@ namespace BinaryNinja template MediumLevelILInstruction GetLeftExpr() const { return As().GetLeftExpr(); } template MediumLevelILInstruction GetRightExpr() const { return As().GetRightExpr(); } template MediumLevelILInstruction GetCarryExpr() const { return As().GetCarryExpr(); } - template MediumLevelILInstruction GetHighExpr() const { return As().GetHighExpr(); } - template MediumLevelILInstruction GetLowExpr() const { return As().GetLowExpr(); } template MediumLevelILInstruction GetStackExpr() const { return As().GetStackExpr(); } template MediumLevelILInstruction GetConditionExpr() const { return As().GetConditionExpr(); } template Variable GetHighVariable() const { return As().GetHighVariable(); } @@ -537,8 +525,6 @@ namespace BinaryNinja MediumLevelILInstruction GetLeftExpr() const; MediumLevelILInstruction GetRightExpr() const; MediumLevelILInstruction GetCarryExpr() const; - MediumLevelILInstruction GetHighExpr() const; - MediumLevelILInstruction GetLowExpr() const; MediumLevelILInstruction GetStackExpr() const; MediumLevelILInstruction GetConditionExpr() const; Variable GetHighVariable() const; @@ -644,13 +630,6 @@ namespace BinaryNinja MediumLevelILInstruction GetCarryExpr() const { return GetRawOperandAsExpr(2); } }; - struct MediumLevelILDoublePrecisionInstruction: public MediumLevelILInstructionBase - { - MediumLevelILInstruction GetHighExpr() const { return GetRawOperandAsExpr(0); } - MediumLevelILInstruction GetLowExpr() const { return GetRawOperandAsExpr(1); } - MediumLevelILInstruction GetRightExpr() const { return GetRawOperandAsExpr(2); } - }; - // Implementations of each instruction to fetch the correct operand value for the valid operands, these // are derived from MediumLevelILInstructionBase so that invalid operand accessor functions will generate // a compiler error. @@ -773,6 +752,11 @@ namespace BinaryNinja Variable GetSourceVariable() const { return GetRawOperandAsVariable(0); } uint64_t GetOffset() const { return GetRawOperandAsInteger(1); } }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + Variable GetHighVariable() const { return GetRawOperandAsVariable(0); } + Variable GetLowVariable() const { return GetRawOperandAsVariable(1); } + }; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase { @@ -796,6 +780,13 @@ namespace BinaryNinja uint64_t GetOffset() const { return GetRawOperandAsInteger(2); } void SetSourceMemoryVersion(size_t version) { UpdateRawOperand(1, version); } }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + SSAVariable GetHighSSAVariable() const { return GetRawOperandAsSSAVariable(0); } + SSAVariable GetLowSSAVariable() const { return GetRawOperandAsSSAVariable(2); } + void SetHighSSAVersion(size_t version) { UpdateRawOperand(1, version); } + void SetLowSSAVersion(size_t version) { UpdateRawOperand(3, version); } + }; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase { @@ -953,6 +944,10 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; @@ -965,17 +960,23 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandWithCarryInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandWithCarryInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandWithCarryInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandWithCarryInstruction {}; - template <> struct MediumLevelILInstructionAccessor: public MediumLevelILDoublePrecisionInstruction {}; - template <> struct MediumLevelILInstructionAccessor: public MediumLevelILDoublePrecisionInstruction {}; - template <> struct MediumLevelILInstructionAccessor: public MediumLevelILDoublePrecisionInstruction {}; - template <> struct MediumLevelILInstructionAccessor: public MediumLevelILDoublePrecisionInstruction {}; - template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; @@ -983,4 +984,10 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; } diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 75a3f1ad..a3b1fcb6 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -124,6 +124,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_PUSH: [("src", "expr")], LowLevelILOperation.LLIL_POP: [], LowLevelILOperation.LLIL_REG: [("src", "reg")], + LowLevelILOperation.LLIL_REG_SPLIT: [("hi", "reg", "lo", "reg")], LowLevelILOperation.LLIL_CONST: [("constant", "int")], LowLevelILOperation.LLIL_CONST_PTR: [("constant", "int")], LowLevelILOperation.LLIL_FLAG: [("src", "flag")], @@ -146,13 +147,13 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_MULU_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_MULS_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_DIVU: [("left", "expr"), ("right", "expr")], - LowLevelILOperation.LLIL_DIVU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_DIVU_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_DIVS: [("left", "expr"), ("right", "expr")], - LowLevelILOperation.LLIL_DIVS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_DIVS_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_MODU: [("left", "expr"), ("right", "expr")], - LowLevelILOperation.LLIL_MODU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_MODU_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_MODS: [("left", "expr"), ("right", "expr")], - LowLevelILOperation.LLIL_MODS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_MODS_DP: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_NEG: [("src", "expr")], LowLevelILOperation.LLIL_NOT: [("src", "expr")], LowLevelILOperation.LLIL_SX: [("src", "expr")], @@ -186,12 +187,30 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_UNDEF: [], LowLevelILOperation.LLIL_UNIMPL: [], LowLevelILOperation.LLIL_UNIMPL_MEM: [("src", "expr")], + LowLevelILOperation.LLIL_FADD: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FSUB: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FMUL: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FDIV: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FSQRT: [("src", "expr")], + LowLevelILOperation.LLIL_FNEG: [("src", "expr")], + LowLevelILOperation.LLIL_FABS: [("src", "expr")], + LowLevelILOperation.LLIL_FLOAT_TO_INT: [("src", "expr")], + LowLevelILOperation.LLIL_INT_TO_FLOAT: [("src", "expr")], + LowLevelILOperation.LLIL_FLOAT_CONV: [("src", "expr")], + LowLevelILOperation.LLIL_FCMP_E: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_NE: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_LT: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_LE: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_GE: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_GT: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_UO: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_SET_REG_SSA: [("dest", "reg_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [("full_reg", "reg_ssa"), ("dest", "reg"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: [("hi", "expr"), ("lo", "expr"), ("src", "expr")], LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: [("dest", "reg_ssa")], LowLevelILOperation.LLIL_REG_SSA: [("src", "reg_ssa")], LowLevelILOperation.LLIL_REG_SSA_PARTIAL: [("full_reg", "reg_ssa"), ("src", "reg")], + LowLevelILOperation.LLIL_REG_SPLIT_SSA: [("hi", "reg_ssa"), ("lo", "reg_ssa")], LowLevelILOperation.LLIL_SET_FLAG_SSA: [("dest", "flag_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_FLAG_SSA: [("src", "flag_ssa")], LowLevelILOperation.LLIL_FLAG_BIT_SSA: [("src", "flag_ssa"), ("bit", "int")], @@ -768,7 +787,7 @@ class LowLevelILFunction(object): def reg(self, size, reg): """ - ``reg`` returns a register of size ``size`` with name ``name`` + ``reg`` returns a register of size ``size`` with name ``reg`` :param int size: the size of the register in bytes :param str reg: the name of the register @@ -778,6 +797,20 @@ class LowLevelILFunction(object): reg = self.arch.get_reg_index(reg) return self.expr(LowLevelILOperation.LLIL_REG, reg, size=size) + def reg_split(self, size, hi, lo): + """ + ``reg_split`` combines registers of size ``size`` with names ``hi`` and ``lo`` + + :param int size: the size of the register in bytes + :param str hi: register holding high part of value + :param str lo: register holding low part of value + :return: The expression ``hi:lo`` + :rtype: LowLevelILExpr + """ + hi = self.arch.get_reg_index(hi) + lo = self.arch.get_reg_index(lo) + return self.expr(LowLevelILOperation.LLIL_REG_SPLIT, hi, lo, size=size) + def const(self, size, value): """ ``const`` returns an expression for the constant integer ``value`` with size ``size`` @@ -1078,21 +1111,20 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_DIVS, a.index, b.index, size=size, flags=flags) - def div_double_prec_signed(self, size, hi, lo, b, flags=None): + def div_double_prec_signed(self, size, a, b, flags=None): """ - ``div_double_prec_signed`` signed double precision divide using expression ``hi`` and expression ``lo`` as a + ``div_double_prec_signed`` signed double precision divide using expression ``a`` as a single double precision register by expression ``b`` potentially setting flags ``flags`` and returning an expression of ``size`` bytes. :param int size: the size of the result in bytes - :param LowLevelILExpr hi: high LHS expression - :param LowLevelILExpr lo: low LHS expression + :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``divs.dp.{}(hi:lo, b)`` + :return: The expression ``divs.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_DIVS_DP, hi.index, lo.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_DIVS_DP, a.index, b.index, size=size, flags=flags) def div_unsigned(self, size, a, b, flags=None): """ @@ -1108,21 +1140,20 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_DIVS, a.index, b.index, size=size, flags=flags) - def div_double_prec_unsigned(self, size, hi, lo, b, flags=None): + def div_double_prec_unsigned(self, size, a, b, flags=None): """ - ``div_double_prec_unsigned`` unsigned double precision divide using expression ``hi`` and expression ``lo`` as + ``div_double_prec_unsigned`` unsigned double precision divide using expression ``a`` as a single double precision register by expression ``b`` potentially setting flags ``flags`` and returning an expression of ``size`` bytes. :param int size: the size of the result in bytes - :param LowLevelILExpr hi: high LHS expression - :param LowLevelILExpr lo: low LHS expression + :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``divs.dp.{}(hi:lo, b)`` + :return: The expression ``divs.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_DIVS_DP, hi.index, lo.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_DIVS_DP, a.index, b.index, size=size, flags=flags) def mod_signed(self, size, a, b, flags=None): """ @@ -1138,21 +1169,20 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_MODS, a.index, b.index, size=size, flags=flags) - def mod_double_prec_signed(self, size, hi, lo, b, flags=None): + def mod_double_prec_signed(self, size, a, b, flags=None): """ - ``mod_double_prec_signed`` signed double precision modulus using expression ``hi`` and expression ``lo`` as a single + ``mod_double_prec_signed`` signed double precision modulus using expression ``a`` as a single double precision register by expression ``b`` potentially setting flags ``flags`` and returning an expression of ``size`` bytes. :param int size: the size of the result in bytes - :param LowLevelILExpr hi: high LHS expression - :param LowLevelILExpr lo: low LHS expression + :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``mods.dp.{}(hi:lo, b)`` + :return: The expression ``mods.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_MODS_DP, hi.index, lo.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_MODS_DP, a.index, b.index, size=size, flags=flags) def mod_unsigned(self, size, a, b, flags=None): """ @@ -1168,21 +1198,20 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_MODS, a.index, b.index, size=size, flags=flags) - def mod_double_prec_unsigned(self, size, hi, lo, b, flags=None): + def mod_double_prec_unsigned(self, size, a, b, flags=None): """ - ``mod_double_prec_unsigned`` unsigned double precision modulus using expression ``hi`` and expression ``lo`` as + ``mod_double_prec_unsigned`` unsigned double precision modulus using expression ``a`` as a single double precision register by expression ``b`` potentially setting flags ``flags`` and returning an expression of ``size`` bytes. :param int size: the size of the result in bytes - :param LowLevelILExpr hi: high LHS expression - :param LowLevelILExpr lo: low LHS expression + :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``modu.dp.{}(hi:lo, b)`` + :return: The expression ``modu.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_MODS_DP, hi.index, lo.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_MODS_DP, a.index, b.index, size=size, flags=flags) def neg_expr(self, size, value, flags=None): """ @@ -1501,6 +1530,232 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_UNIMPL_MEM, addr.index, size = size) + def float_add(self, size, a, b, flags=None): + """ + ``float_add`` adds floating point expression ``a`` to expression ``b`` potentially setting flags ``flags`` + and returning an expression of ``size`` bytes. + + :param int size: the size of the result in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``fadd.{}(a, b)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FADD, a.index, b.index, size=size, flags=flags) + + def float_sub(self, size, a, b, flags=None): + """ + ``float_sub`` subtracts floating point expression ``b`` from expression ``a`` potentially setting flags ``flags`` + and returning an expression of ``size`` bytes. + + :param int size: the size of the result in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``fsub.{}(a, b)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FSUB, a.index, b.index, size=size, flags=flags) + + def float_mult(self, size, a, b, flags=None): + """ + ``float_mult`` multiplies floating point expression ``a`` by expression ``b`` potentially setting flags ``flags`` + and returning an expression of ``size`` bytes. + + :param int size: the size of the result in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``fmul.{}(a, b)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FMUL, a.index, b.index, size=size, flags=flags) + + def float_div(self, size, a, b, flags=None): + """ + ``float_div`` divides floating point expression ``a`` by expression ``b`` potentially setting flags ``flags`` + and returning an expression of ``size`` bytes. + + :param int size: the size of the result in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``fdiv.{}(a, b)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FDIV, a.index, b.index, size=size, flags=flags) + + def float_sqrt(self, size, value, flags=None): + """ + ``float_sqrt`` returns square root of floating point expression ``value`` of size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``sqrt.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FSQRT, value.index, size=size, flags=flags) + + def float_neg(self, size, value, flags=None): + """ + ``float_neg`` returns sign negation of floating point expression ``value`` of size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``fneg.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FNEG, value.index, size=size, flags=flags) + + def float_abs(self, size, value, flags=None): + """ + ``float_abs`` returns absolute value of floating point expression ``value`` of size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``fabs.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FABS, value.index, size=size, flags=flags) + + def float_to_int(self, size, value, flags=None): + """ + ``float_to_int`` returns integer value of floating point expression ``value`` of size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``int.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOAT_TO_INT, value.index, size=size, flags=flags) + + def int_to_float(self, size, value, flags=None): + """ + ``int_to_float`` returns floating point value of integer expression ``value`` of size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``float.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_INT_TO_FLOAT, value.index, size=size, flags=flags) + + def float_convert(self, size, value, flags=None): + """ + ``int_to_float`` converts floating point value of expression ``value`` to size ``size`` potentially setting flags + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``fconvert.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOAT_CONV, value.index, size=size, flags=flags) + + def float_compare_equal(self, size, a, b): + """ + ``float_compare_equal`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is equal to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f== b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_E, a.index, b.index) + + def float_compare_not_equal(self, size, a, b): + """ + ``float_compare_not_equal`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is not equal to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f!= b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_NE, a.index, b.index) + + def float_compare_less_than(self, size, a, b): + """ + ``float_compare_less_than`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is less than to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f< b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_LT, a.index, b.index) + + def float_compare_less_equal(self, size, a, b): + """ + ``float_compare_less_equal`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is less than or equal to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f<= b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_LE, a.index, b.index) + + def float_compare_greater_equal(self, size, a, b): + """ + ``float_compare_greater_equal`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is greater than or equal to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f>= b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_GE, a.index, b.index) + + def float_compare_greater_than(self, size, a, b): + """ + ``float_compare_greater_than`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is greater than or equal to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``a f> b`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_GT, a.index, b.index) + + def float_compare_unordered(self, size, a, b): + """ + ``float_compare_unordered`` returns floating point comparison expression of size ``size`` checking if + expression ``a`` is unordered relative to expression ``b`` + + :param int size: the size of the operands in bytes + :param LowLevelILExpr a: LHS expression + :param LowLevelILExpr b: RHS expression + :param str flags: flags to set + :return: The expression ``is_unordered(a, b)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FCMP_UO, a.index, b.index) + def goto(self, label): """ ``goto`` returns a goto expression which jumps to the provided LowLevelILLabel. diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 07759a47..05b558d2 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -85,6 +85,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_STORE_STRUCT: [("dest", "expr"), ("offset", "int"), ("src", "expr")], MediumLevelILOperation.MLIL_VAR: [("src", "var")], MediumLevelILOperation.MLIL_VAR_FIELD: [("src", "var"), ("offset", "int")], + MediumLevelILOperation.MLIL_VAR_SPLIT: [("high", "var"), ("low", "var")], MediumLevelILOperation.MLIL_ADDRESS_OF: [("src", "var")], MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [("src", "var"), ("offset", "int")], MediumLevelILOperation.MLIL_CONST: [("constant", "int")], @@ -108,13 +109,13 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_MULU_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_MULS_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_DIVU: [("left", "expr"), ("right", "expr")], - MediumLevelILOperation.MLIL_DIVU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVU_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_DIVS: [("left", "expr"), ("right", "expr")], - MediumLevelILOperation.MLIL_DIVS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVS_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_MODU: [("left", "expr"), ("right", "expr")], - MediumLevelILOperation.MLIL_MODU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODU_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_MODS: [("left", "expr"), ("right", "expr")], - MediumLevelILOperation.MLIL_MODS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODS_DP: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_NEG: [("src", "expr")], MediumLevelILOperation.MLIL_NOT: [("src", "expr")], MediumLevelILOperation.MLIL_SX: [("src", "expr")], @@ -150,6 +151,23 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_UNDEF: [], MediumLevelILOperation.MLIL_UNIMPL: [], MediumLevelILOperation.MLIL_UNIMPL_MEM: [("src", "expr")], + MediumLevelILOperation.MLIL_FADD: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FSUB: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FMUL: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FDIV: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FSQRT: [("src", "expr")], + MediumLevelILOperation.MLIL_FNEG: [("src", "expr")], + MediumLevelILOperation.MLIL_FABS: [("src", "expr")], + MediumLevelILOperation.MLIL_FLOAT_TO_INT: [("src", "expr")], + MediumLevelILOperation.MLIL_INT_TO_FLOAT: [("src", "expr")], + MediumLevelILOperation.MLIL_FLOAT_CONV: [("src", "expr")], + MediumLevelILOperation.MLIL_FCMP_E: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_NE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_LT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_LE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_GE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_GT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_UO: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA: [("dest", "var_ssa"), ("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA_FIELD: [("prev", "var_ssa_dest_and_src"), ("offset", "int"), ("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SPLIT_SSA: [("high", "var_ssa"), ("low", "var_ssa"), ("src", "expr")], @@ -159,6 +177,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_VAR_SSA_FIELD: [("src", "var_ssa"), ("offset", "int")], MediumLevelILOperation.MLIL_VAR_ALIASED: [("src", "var_ssa")], MediumLevelILOperation.MLIL_VAR_ALIASED_FIELD: [("src", "var_ssa"), ("offset", "int")], + MediumLevelILOperation.MLIL_VAR_SPLIT_SSA: [("high", "var_ssa"), ("low", "var_ssa")], MediumLevelILOperation.MLIL_CALL_SSA: [("output", "expr"), ("dest", "expr"), ("params", "expr_list"), ("src_memory", "int")], MediumLevelILOperation.MLIL_CALL_UNTYPED_SSA: [("output", "expr"), ("dest", "expr"), ("params", "expr"), ("stack", "expr")], MediumLevelILOperation.MLIL_SYSCALL_SSA: [("output", "expr"), ("params", "expr_list"), ("src_memory", "int")], -- cgit v1.3.1 From 95a7be141a07a20b8465981b01116fcafb6b5f41 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 3 Oct 2017 23:07:48 -0400 Subject: Adding support for register stacks in IL (for x87) --- architecture.cpp | 90 ++++++++++ binaryninjaapi.h | 38 +++++ binaryninjacore.h | 28 +++ callingconvention.cpp | 12 +- lowlevelil.cpp | 14 ++ lowlevelilinstruction.cpp | 394 ++++++++++++++++++++++++++++++++++++++++++- lowlevelilinstruction.h | 149 ++++++++++++++++ mediumlevelilinstruction.cpp | 33 ++++ mediumlevelilinstruction.h | 1 + python/architecture.py | 101 +++++++++++ python/callingconvention.py | 4 + python/function.py | 59 ++++++- python/lowlevelil.py | 165 +++++++++++++++++- python/mediumlevelil.py | 9 + 14 files changed, 1092 insertions(+), 5 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index eb588394..56af3f80 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -359,6 +359,34 @@ uint32_t* Architecture::GetGlobalRegistersCallback(void* ctxt, size_t* count) } +char* Architecture::GetRegisterStackNameCallback(void* ctxt, uint32_t regStack) +{ + Architecture* arch = (Architecture*)ctxt; + string result = arch->GetRegisterStackName(regStack); + return BNAllocString(result.c_str()); +} + + +uint32_t* Architecture::GetAllRegisterStacksCallback(void* ctxt, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector regs = arch->GetAllRegisterStacks(); + *count = regs.size(); + + uint32_t* result = new uint32_t[regs.size()]; + for (size_t i = 0; i < regs.size(); i++) + result[i] = regs[i]; + return result; +} + + +void Architecture::GetRegisterStackInfoCallback(void* ctxt, uint32_t regStack, BNRegisterStackInfo* result) +{ + Architecture* arch = (Architecture*)ctxt; + *result = arch->GetRegisterStackInfo(regStack); +} + + bool Architecture::AssembleCallback(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors) { Architecture* arch = (Architecture*)ctxt; @@ -467,6 +495,9 @@ void Architecture::Register(Architecture* arch) callbacks.getStackPointerRegister = GetStackPointerRegisterCallback; callbacks.getLinkRegister = GetLinkRegisterCallback; callbacks.getGlobalRegisters = GetGlobalRegistersCallback; + callbacks.getRegisterStackName = GetRegisterStackNameCallback; + callbacks.getAllRegisterStacks = GetAllRegisterStacksCallback; + callbacks.getRegisterStackInfo = GetRegisterStackInfoCallback; callbacks.assemble = AssembleCallback; callbacks.isNeverBranchPatchAvailable = IsNeverBranchPatchAvailableCallback; callbacks.isAlwaysBranchPatchAvailable = IsAlwaysBranchPatchAvailableCallback; @@ -682,6 +713,36 @@ bool Architecture::IsGlobalRegister(uint32_t reg) } +string Architecture::GetRegisterStackName(uint32_t regStack) +{ + char regStr[32]; + sprintf(regStr, "reg_stack_%" PRIu32, regStack); + return regStr; +} + + +vector Architecture::GetAllRegisterStacks() +{ + return vector(); +} + + +BNRegisterStackInfo Architecture::GetRegisterStackInfo(uint32_t) +{ + BNRegisterStackInfo result; + result.firstStorageReg = BN_INVALID_REGISTER; + result.count = 0; + result.stackTopReg = BN_INVALID_REGISTER; + return result; +} + + +uint32_t Architecture::GetRegisterStackForRegister(uint32_t reg) +{ + return BNGetArchitectureRegisterStackForRegister(m_object, reg); +} + + vector Architecture::GetModifiedRegistersOnWrite(uint32_t reg) { size_t count; @@ -1116,6 +1177,35 @@ vector CoreArchitecture::GetGlobalRegisters() } +string CoreArchitecture::GetRegisterStackName(uint32_t regStack) +{ + char* name = BNGetArchitectureRegisterStackName(m_object, regStack); + string result = name; + BNFreeString(name); + return result; +} + + +vector CoreArchitecture::GetAllRegisterStacks() +{ + size_t count; + uint32_t* regs = BNGetAllArchitectureRegisterStacks(m_object, &count); + + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(regs[i]); + + BNFreeRegisterList(regs); + return result; +} + + +BNRegisterStackInfo CoreArchitecture::GetRegisterStackInfo(uint32_t regStack) +{ + return BNGetArchitectureRegisterStackInfo(m_object, regStack); +} + + bool CoreArchitecture::Assemble(const string& code, uint64_t addr, DataBuffer& result, string& errors) { char* errorStr = nullptr; diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 7d686142..5c122966 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1610,6 +1610,10 @@ namespace BinaryNinja static uint32_t GetLinkRegisterCallback(void* ctxt); static uint32_t* GetGlobalRegistersCallback(void* ctxt, size_t* count); + static char* GetRegisterStackNameCallback(void* ctxt, uint32_t regStack); + static uint32_t* GetAllRegisterStacksCallback(void* ctxt, size_t* count); + static void GetRegisterStackInfoCallback(void* ctxt, uint32_t regStack, BNRegisterStackInfo* result); + static bool AssembleCallback(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); static bool IsNeverBranchPatchAvailableCallback(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); static bool IsAlwaysBranchPatchAvailableCallback(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); @@ -1676,6 +1680,11 @@ namespace BinaryNinja std::vector GetModifiedRegistersOnWrite(uint32_t reg); uint32_t GetRegisterByName(const std::string& name); + virtual std::string GetRegisterStackName(uint32_t regStack); + virtual std::vector GetAllRegisterStacks(); + virtual BNRegisterStackInfo GetRegisterStackInfo(uint32_t regStack); + uint32_t GetRegisterStackForRegister(uint32_t reg); + virtual bool Assemble(const std::string& code, uint64_t addr, DataBuffer& result, std::string& errors); /*! IsNeverBranchPatchAvailable returns true if the instruction at addr can be patched to never branch. @@ -1800,6 +1809,10 @@ namespace BinaryNinja virtual uint32_t GetLinkRegister() override; virtual std::vector GetGlobalRegisters() override; + virtual std::string GetRegisterStackName(uint32_t regStack) override; + virtual std::vector GetAllRegisterStacks() override; + virtual BNRegisterStackInfo GetRegisterStackInfo(uint32_t regStack) override; + virtual bool Assemble(const std::string& code, uint64_t addr, DataBuffer& result, std::string& errors) override; virtual bool IsNeverBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; @@ -2394,6 +2407,7 @@ namespace BinaryNinja struct LowLevelILInstruction; struct SSARegister; + struct SSARegisterStack; struct SSAFlag; class LowLevelILFunction: public CoreRefCountObject& sources, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackPhi(const SSARegisterStack& dest, const std::vector& sources, + const ILSourceLocation& loc = ILSourceLocation()); ExprId FlagPhi(const SSAFlag& dest, const std::vector& sources, const ILSourceLocation& loc = ILSourceLocation()); ExprId MemoryPhi(size_t dest, const std::vector& sources, @@ -2602,6 +2636,7 @@ namespace BinaryNinja ExprId AddOperandList(const std::vector operands); ExprId AddIndexList(const std::vector operands); ExprId AddSSARegisterList(const std::vector& regs); + ExprId AddSSARegisterStackList(const std::vector& regStacks); ExprId AddSSAFlagList(const std::vector& flags); ExprId GetExprForRegisterOrConstant(const BNRegisterOrConstant& operand, size_t size); @@ -2765,6 +2800,9 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatConstRaw(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatConstSingle(float val, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatConstDouble(double val, const ILSourceLocation& loc = ILSourceLocation()); ExprId ImportedAddress(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId Add(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation()); ExprId AddWithCarry(size_t size, ExprId left, ExprId right, ExprId carry, diff --git a/binaryninjacore.h b/binaryninjacore.h index 9bbea512..f50c28c8 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -281,14 +281,19 @@ extern "C" LLIL_SET_REG, // Not valid in SSA form (see LLIL_SET_REG_SSA) LLIL_SET_REG_SPLIT, // Not valid in SSA form (see LLIL_SET_REG_SPLIT_SSA) LLIL_SET_FLAG, // Not valid in SSA form (see LLIL_SET_FLAG_SSA) + LLIL_SET_REG_STACK_REL, // Not valid in SSA form (see LLIL_SET_REG_STACK_REL_SSA) + LLIL_REG_STACK_PUSH, // Not valid in SSA form (expanded) LLIL_LOAD, // Not valid in SSA form (see LLIL_LOAD_SSA) LLIL_STORE, // Not valid in SSA form (see LLIL_STORE_SSA) LLIL_PUSH, // Not valid in SSA form (expanded) LLIL_POP, // Not valid in SSA form (expanded) LLIL_REG, // Not valid in SSA form (see LLIL_REG_SSA) LLIL_REG_SPLIT, // Not valid in SSA form (see LLIL_REG_SPLIT_SSA) + LLIL_REG_STACK_REL, // Not valid in SSA form (see LLIL_REG_STACK_REL_SSA) + LLIL_REG_STACK_POP, // Not valid in SSA form (expanded) LLIL_CONST, LLIL_CONST_PTR, + LLIL_FLOAT_CONST, LLIL_FLAG, // Not valid in SSA form (see LLIL_FLAG_SSA) LLIL_FLAG_BIT, // Not valid in SSA form (see LLIL_FLAG_BIT_SSA) LLIL_ADD, @@ -373,10 +378,15 @@ extern "C" LLIL_SET_REG_SSA, LLIL_SET_REG_SSA_PARTIAL, LLIL_SET_REG_SPLIT_SSA, + LLIL_SET_REG_STACK_REL_SSA, + LLIL_SET_REG_STACK_ABS_SSA, LLIL_REG_SPLIT_DEST_SSA, // Only valid within an LLIL_SET_REG_SPLIT_SSA instruction + LLIL_REG_STACK_DEST_SSA, // Only valid within LLIL_SET_REG_STACK_REL_SSA or LLIL_SET_REG_STACK_ABS_SSA LLIL_REG_SSA, LLIL_REG_SSA_PARTIAL, LLIL_REG_SPLIT_SSA, + LLIL_REG_STACK_REL_SSA, + LLIL_REG_STACK_ABS_SSA, LLIL_SET_FLAG_SSA, LLIL_FLAG_SSA, LLIL_FLAG_BIT_SSA, @@ -388,6 +398,7 @@ extern "C" LLIL_LOAD_SSA, LLIL_STORE_SSA, LLIL_REG_PHI, + LLIL_REG_STACK_PHI, LLIL_FLAG_PHI, LLIL_MEM_PHI }; @@ -666,6 +677,13 @@ extern "C" BNImplicitRegisterExtend extend; }; + struct BNRegisterStackInfo + { + uint32_t firstStorageReg; + uint32_t count; + uint32_t stackTopReg; + }; + enum BNRegisterValueType { UndeterminedValue, @@ -771,6 +789,7 @@ extern "C" MLIL_ADDRESS_OF_FIELD, MLIL_CONST, MLIL_CONST_PTR, + MLIL_FLOAT_CONST, MLIL_IMPORT, MLIL_ADD, MLIL_ADC, @@ -1071,6 +1090,10 @@ extern "C" uint32_t (*getLinkRegister)(void* ctxt); uint32_t* (*getGlobalRegisters)(void* ctxt, size_t* count); + char* (*getRegisterStackName)(void* ctxt, uint32_t regStack); + uint32_t* (*getAllRegisterStacks)(void* ctxt, size_t* count); + void (*getRegisterStackInfo)(void* ctxt, uint32_t regStack, BNRegisterStackInfo* result); + bool (*assemble)(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); bool (*isNeverBranchPatchAvailable)(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); @@ -2022,6 +2045,11 @@ extern "C" BINARYNINJACOREAPI bool BNIsArchitectureGlobalRegister(BNArchitecture* arch, uint32_t reg); BINARYNINJACOREAPI uint32_t BNGetArchitectureRegisterByName(BNArchitecture* arch, const char* name); + BINARYNINJACOREAPI char* BNGetArchitectureRegisterStackName(BNArchitecture* arch, uint32_t regStack); + BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureRegisterStacks(BNArchitecture* arch, size_t* count); + BINARYNINJACOREAPI BNRegisterStackInfo BNGetArchitectureRegisterStackInfo(BNArchitecture* arch, uint32_t regStack); + BINARYNINJACOREAPI uint32_t BNGetArchitectureRegisterStackForRegister(BNArchitecture* arch, uint32_t reg); + BINARYNINJACOREAPI bool BNAssemble(BNArchitecture* arch, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); BINARYNINJACOREAPI bool BNIsArchitectureNeverBranchPatchAvailable(BNArchitecture* arch, const uint8_t* data, diff --git a/callingconvention.cpp b/callingconvention.cpp index 945ba25f..b29d51e2 100644 --- a/callingconvention.cpp +++ b/callingconvention.cpp @@ -264,8 +264,16 @@ vector CallingConvention::GetImplicitlyDefinedRegisters() } -RegisterValue CallingConvention::GetIncomingRegisterValue(uint32_t, Function*) -{ +RegisterValue CallingConvention::GetIncomingRegisterValue(uint32_t reg, Function*) +{ + uint32_t regStack = GetArchitecture()->GetRegisterStackForRegister(reg); + if ((regStack != BN_INVALID_REGISTER) && (reg == GetArchitecture()->GetRegisterStackInfo(regStack).stackTopReg)) + { + RegisterValue value; + value.state = ConstantValue; + value.value = 0; + return value; + } return RegisterValue(); } diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 690f0b41..c72d4b68 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -230,6 +230,20 @@ ExprId LowLevelILFunction::AddSSARegisterList(const vector& regs) } +ExprId LowLevelILFunction::AddSSARegisterStackList(const vector& regStacks) +{ + uint64_t* operandList = new uint64_t[regStacks.size() * 2]; + for (size_t i = 0; i < regStacks.size(); i++) + { + operandList[i * 2] = regStacks[i].regStack; + operandList[(i * 2) + 1] = regStacks[i].version; + } + ExprId result = (ExprId)BNLowLevelILAddOperandList(m_object, operandList, regStacks.size() * 2); + delete[] operandList; + return result; +} + + ExprId LowLevelILFunction::AddSSAFlagList(const vector& flags) { uint64_t* operandList = new uint64_t[flags.size() * 2]; diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 501b7b72..4130dd2a 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -37,17 +37,23 @@ unordered_map LowLevelILInstructionBase::operandTypeForUsage = { {SourceExprLowLevelOperandUsage, ExprLowLevelOperand}, {SourceRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, + {SourceRegisterStackLowLevelOperandUsage, RegisterStackLowLevelOperand}, {SourceFlagLowLevelOperandUsage, FlagLowLevelOperand}, {SourceSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, + {SourceSSARegisterStackLowLevelOperandUsage, SSARegisterStackLowLevelOperand}, {SourceSSAFlagLowLevelOperandUsage, SSAFlagLowLevelOperand}, {DestExprLowLevelOperandUsage, ExprLowLevelOperand}, {DestRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, + {DestRegisterStackLowLevelOperandUsage, RegisterStackLowLevelOperand}, {DestFlagLowLevelOperandUsage, FlagLowLevelOperand}, {DestSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, + {DestSSARegisterStackLowLevelOperandUsage, SSARegisterStackLowLevelOperand}, {DestSSAFlagLowLevelOperandUsage, SSAFlagLowLevelOperand}, {PartialRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, + {PartialSSARegisterStackSourceLowLevelOperandUsage, SSARegisterStackLowLevelOperand}, {StackSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, {StackMemoryVersionLowLevelOperandUsage, IndexLowLevelOperand}, + {TopSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, {LeftExprLowLevelOperandUsage, ExprLowLevelOperand}, {RightExprLowLevelOperandUsage, ExprLowLevelOperand}, {CarryExprLowLevelOperandUsage, ExprLowLevelOperand}, @@ -70,6 +76,7 @@ unordered_map {OutputMemoryVersionLowLevelOperandUsage, IndexLowLevelOperand}, {ParameterSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, {SourceSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, + {SourceSSARegisterStacksLowLevelOperandUsage, SSARegisterStackListLowLevelOperand}, {SourceSSAFlagsLowLevelOperandUsage, SSAFlagListLowLevelOperand}, {SourceMemoryVersionsLowLevelOperandUsage, IndexListLowLevelOperand}, {TargetListLowLevelOperandUsage, IndexListLowLevelOperand} @@ -93,6 +100,15 @@ unordered_map> SourceExprLowLevelOperandUsage}}, {LLIL_SET_REG_SPLIT_SSA, {HighSSARegisterLowLevelOperandUsage, LowSSARegisterLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, + {LLIL_SET_REG_STACK_REL, {DestRegisterStackLowLevelOperandUsage, DestExprLowLevelOperandUsage, + SourceExprLowLevelOperandUsage}}, + {LLIL_REG_STACK_PUSH, {DestRegisterStackLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, + {LLIL_SET_REG_STACK_REL_SSA, {DestSSARegisterStackLowLevelOperandUsage, + PartialSSARegisterStackSourceLowLevelOperandUsage, DestExprLowLevelOperandUsage, + TopSSARegisterLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, + {LLIL_SET_REG_STACK_ABS_SSA, {DestSSARegisterStackLowLevelOperandUsage, + PartialSSARegisterStackSourceLowLevelOperandUsage, DestRegisterLowLevelOperandUsage, + SourceExprLowLevelOperandUsage}}, {LLIL_SET_FLAG, {DestFlagLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, {LLIL_SET_FLAG_SSA, {DestSSAFlagLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, {LLIL_LOAD, {SourceExprLowLevelOperandUsage}}, @@ -105,6 +121,11 @@ unordered_map> {LLIL_REG_SSA_PARTIAL, {SourceSSARegisterLowLevelOperandUsage, PartialRegisterLowLevelOperandUsage}}, {LLIL_REG_SPLIT, {HighRegisterLowLevelOperandUsage, LowRegisterLowLevelOperandUsage}}, {LLIL_REG_SPLIT_SSA, {HighSSARegisterLowLevelOperandUsage, LowSSARegisterLowLevelOperandUsage}}, + {LLIL_REG_STACK_REL, {SourceRegisterStackLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, + {LLIL_REG_STACK_POP, {SourceRegisterStackLowLevelOperandUsage}}, + {LLIL_REG_STACK_REL_SSA, {SourceSSARegisterStackLowLevelOperandUsage, TopSSARegisterLowLevelOperandUsage, + SourceExprLowLevelOperandUsage}}, + {LLIL_REG_STACK_ABS_SSA, {SourceSSARegisterStackLowLevelOperandUsage, SourceRegisterLowLevelOperandUsage}}, {LLIL_FLAG, {SourceFlagLowLevelOperandUsage}}, {LLIL_FLAG_BIT, {SourceFlagLowLevelOperandUsage, BitIndexLowLevelOperandUsage}}, {LLIL_FLAG_SSA, {SourceSSAFlagLowLevelOperandUsage}}, @@ -126,10 +147,12 @@ unordered_map> StackSSARegisterLowLevelOperandUsage, StackMemoryVersionLowLevelOperandUsage, ParameterSSARegistersLowLevelOperandUsage}}, {LLIL_REG_PHI, {DestSSARegisterLowLevelOperandUsage, SourceSSARegistersLowLevelOperandUsage}}, + {LLIL_REG_STACK_PHI, {DestSSARegisterStackLowLevelOperandUsage, SourceSSARegisterStacksLowLevelOperandUsage}}, {LLIL_FLAG_PHI, {DestSSAFlagLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage}}, {LLIL_MEM_PHI, {DestMemoryVersionLowLevelOperandUsage, SourceMemoryVersionsLowLevelOperandUsage}}, {LLIL_CONST, {ConstantLowLevelOperandUsage}}, {LLIL_CONST_PTR, {ConstantLowLevelOperandUsage}}, + {LLIL_FLOAT_CONST, {ConstantLowLevelOperandUsage}}, {LLIL_ADD, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_SUB, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_AND, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, @@ -211,6 +234,8 @@ static unordered_map() const } +const SSARegisterStack LowLevelILSSARegisterStackList::ListIterator::operator*() +{ + LowLevelILIntegerList::const_iterator cur = pos; + uint32_t regStack = (uint32_t)*cur; + ++cur; + size_t version = (size_t)*cur; + return SSARegisterStack(regStack, version); +} + + +LowLevelILSSARegisterStackList::LowLevelILSSARegisterStackList(LowLevelILFunction* func, + const BNLowLevelILInstruction& instr, size_t count): m_list(func, instr, count & (~1)) +{ +} + + +LowLevelILSSARegisterStackList::const_iterator LowLevelILSSARegisterStackList::begin() const +{ + const_iterator result; + result.pos = m_list.begin(); + return result; +} + + +LowLevelILSSARegisterStackList::const_iterator LowLevelILSSARegisterStackList::end() const +{ + const_iterator result; + result.pos = m_list.end(); + return result; +} + + +size_t LowLevelILSSARegisterStackList::size() const +{ + return m_list.size() / 2; +} + + +const SSARegisterStack LowLevelILSSARegisterStackList::operator[](size_t i) const +{ + if (i >= size()) + throw LowLevelILInstructionAccessException(); + auto iter = begin(); + for (size_t j = 0; j < i; j++) + ++iter; + return *iter; +} + + +LowLevelILSSARegisterStackList::operator vector() const +{ + vector result; + for (auto& i : *this) + result.push_back(i); + return result; +} + + const SSAFlag LowLevelILSSAFlagList::ListIterator::operator*() { LowLevelILIntegerList::const_iterator cur = pos; @@ -666,6 +801,14 @@ uint32_t LowLevelILOperand::GetRegister() const } +uint32_t LowLevelILOperand::GetRegisterStack() const +{ + if (m_type != RegisterStackLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegister(m_operandIndex); +} + + uint32_t LowLevelILOperand::GetFlag() const { if (m_type != FlagLowLevelOperand) @@ -687,12 +830,24 @@ SSARegister LowLevelILOperand::GetSSARegister() const if (m_type != SSARegisterLowLevelOperand) throw LowLevelILInstructionAccessException(); if ((m_usage == HighSSARegisterLowLevelOperandUsage) || (m_usage == LowSSARegisterLowLevelOperandUsage) || - (m_usage == StackSSARegisterLowLevelOperandUsage)) + (m_usage == StackSSARegisterLowLevelOperandUsage) || (m_usage == TopSSARegisterLowLevelOperandUsage)) return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsSSARegister(0); return m_instr.GetRawOperandAsSSARegister(m_operandIndex); } +SSARegisterStack LowLevelILOperand::GetSSARegisterStack() const +{ + if (m_type != SSARegisterStackLowLevelOperand) + throw LowLevelILInstructionAccessException(); + if (m_usage == DestSSARegisterStackLowLevelOperandUsage) + return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsSSARegisterStack(0); + if (m_usage == PartialSSARegisterStackSourceLowLevelOperandUsage) + return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsPartialSSARegisterStackSource(0); + return m_instr.GetRawOperandAsSSARegisterStack(m_operandIndex); +} + + SSAFlag LowLevelILOperand::GetSSAFlag() const { if (m_type != SSAFlagLowLevelOperand) @@ -721,6 +876,14 @@ LowLevelILSSARegisterList LowLevelILOperand::GetSSARegisterList() const } +LowLevelILSSARegisterStackList LowLevelILOperand::GetSSARegisterStackList() const +{ + if (m_type != SSARegisterStackListLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsSSARegisterStackList(m_operandIndex); +} + + LowLevelILSSAFlagList LowLevelILOperand::GetSSAFlagList() const { if (m_type != SSAFlagListLowLevelOperand) @@ -886,6 +1049,18 @@ SSARegister LowLevelILInstructionBase::GetRawOperandAsSSARegister(size_t operand } +SSARegisterStack LowLevelILInstructionBase::GetRawOperandAsSSARegisterStack(size_t operand) const +{ + return SSARegisterStack((uint32_t)operands[operand], (size_t)operands[operand + 1]); +} + + +SSARegisterStack LowLevelILInstructionBase::GetRawOperandAsPartialSSARegisterStackSource(size_t operand) const +{ + return SSARegisterStack((uint32_t)operands[operand], (size_t)operands[operand + 2]); +} + + SSAFlag LowLevelILInstructionBase::GetRawOperandAsSSAFlag(size_t operand) const { return SSAFlag((uint32_t)operands[operand], (size_t)operands[operand + 1]); @@ -904,6 +1079,12 @@ LowLevelILSSARegisterList LowLevelILInstructionBase::GetRawOperandAsSSARegisterL } +LowLevelILSSARegisterStackList LowLevelILInstructionBase::GetRawOperandAsSSARegisterStackList(size_t operand) const +{ + return LowLevelILSSARegisterStackList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); +} + + LowLevelILSSAFlagList LowLevelILInstructionBase::GetRawOperandAsSSAFlagList(size_t operand) const { return LowLevelILSSAFlagList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); @@ -1147,12 +1328,32 @@ void LowLevelILInstruction::VisitExprs(const std::function().VisitExprs(func); break; + case LLIL_SET_REG_STACK_REL: + GetDestExpr().VisitExprs(func); + GetSourceExpr().VisitExprs(func); + break; + case LLIL_REG_STACK_PUSH: + GetSourceExpr().VisitExprs(func); + break; + case LLIL_SET_REG_STACK_REL_SSA: + GetDestExpr().VisitExprs(func); + GetSourceExpr().VisitExprs(func); + break; + case LLIL_SET_REG_STACK_ABS_SSA: + GetSourceExpr().VisitExprs(func); + break; case LLIL_SET_FLAG: GetSourceExpr().VisitExprs(func); break; case LLIL_SET_FLAG_SSA: GetSourceExpr().VisitExprs(func); break; + case LLIL_REG_STACK_REL: + GetSourceExpr().VisitExprs(func); + break; + case LLIL_REG_STACK_REL_SSA: + GetSourceExpr().VisitExprs(func); + break; case LLIL_LOAD: GetSourceExpr().VisitExprs(func); break; @@ -1300,6 +1501,25 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, return dest->SetRegisterSplitSSA(size, GetHighSSARegister(), GetLowSSARegister(), subExprHandler(GetSourceExpr()), *this); + case LLIL_SET_REG_STACK_REL: + return dest->SetRegisterStackTopRelative(size, GetDestRegisterStack(), + subExprHandler(GetDestExpr()), + subExprHandler(GetSourceExpr()), flags, *this); + case LLIL_REG_STACK_PUSH: + return dest->RegisterStackPush(size, GetDestRegisterStack(), + subExprHandler(GetSourceExpr()), flags, *this); + case LLIL_SET_REG_STACK_REL_SSA: + return dest->SetRegisterStackTopRelativeSSA(size, GetDestSSARegisterStack().regStack, + GetDestSSARegisterStack().version, + GetSourceSSARegisterStack().version, + subExprHandler(GetDestExpr()), GetTopSSARegister(), + subExprHandler(GetSourceExpr()), *this); + case LLIL_SET_REG_STACK_ABS_SSA: + return dest->SetRegisterStackAbsoluteSSA(size, GetDestSSARegisterStack().regStack, + GetDestSSARegisterStack().version, + GetSourceSSARegisterStack().version, + GetDestRegister(), + subExprHandler(GetSourceExpr()), *this); case LLIL_SET_FLAG: return dest->SetFlag(GetDestFlag(), subExprHandler(GetSourceExpr()), *this); case LLIL_SET_FLAG_SSA: @@ -1330,6 +1550,18 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_REG_SPLIT_SSA: return dest->RegisterSplitSSA(size, GetHighSSARegister(), GetLowSSARegister(), *this); + case LLIL_REG_STACK_REL: + return dest->RegisterStackTopRelative(size, GetSourceRegisterStack(), + subExprHandler(GetSourceExpr()), *this); + case LLIL_REG_STACK_POP: + return dest->RegisterStackPop(size, GetSourceRegisterStack(), *this); + case LLIL_REG_STACK_REL_SSA: + return dest->RegisterStackTopRelativeSSA(size, GetSourceSSARegisterStack(), + subExprHandler(GetSourceExpr()), + GetTopSSARegister(), *this); + case LLIL_REG_STACK_ABS_SSA: + return dest->RegisterStackAbsoluteSSA(size, GetSourceSSARegisterStack(), + GetSourceRegister(), *this); case LLIL_FLAG: return dest->Flag(GetSourceFlag(), *this); case LLIL_FLAG_SSA: @@ -1384,6 +1616,9 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, GetDestMemoryVersion(), GetSourceMemoryVersion(), *this); case LLIL_REG_PHI: return dest->RegisterPhi(GetDestSSARegister(), GetSourceSSARegisters(), *this); + case LLIL_REG_STACK_PHI: + return dest->RegisterStackPhi(GetDestSSARegisterStack(), + GetSourceSSARegisterStacks(), *this); case LLIL_FLAG_PHI: return dest->FlagPhi(GetDestSSAFlag(), GetSourceSSAFlags(), *this); case LLIL_MEM_PHI: @@ -1392,6 +1627,8 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, return dest->Const(size, GetConstant(), *this); case LLIL_CONST_PTR: return dest->ConstPointer(size, GetConstant(), *this); + case LLIL_FLOAT_CONST: + return dest->FloatConstRaw(size, GetConstant(), *this); case LLIL_POP: case LLIL_NORET: case LLIL_SYSCALL: @@ -1506,6 +1743,15 @@ uint32_t LowLevelILInstruction::GetSourceRegister() const } +uint32_t LowLevelILInstruction::GetSourceRegisterStack() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(SourceRegisterStackLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegister(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + uint32_t LowLevelILInstruction::GetSourceFlag() const { size_t operandIndex; @@ -1524,6 +1770,17 @@ SSARegister LowLevelILInstruction::GetSourceSSARegister() const } +SSARegisterStack LowLevelILInstruction::GetSourceSSARegisterStack() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(PartialSSARegisterStackSourceLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsExpr(operandIndex).GetRawOperandAsPartialSSARegisterStackSource(0); + if (GetOperandIndexForUsage(SourceSSARegisterStackLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsSSARegisterStack(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + SSAFlag LowLevelILInstruction::GetSourceSSAFlag() const { size_t operandIndex; @@ -1551,6 +1808,15 @@ uint32_t LowLevelILInstruction::GetDestRegister() const } +uint32_t LowLevelILInstruction::GetDestRegisterStack() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(DestRegisterStackLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegister(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + uint32_t LowLevelILInstruction::GetDestFlag() const { size_t operandIndex; @@ -1569,6 +1835,15 @@ SSARegister LowLevelILInstruction::GetDestSSARegister() const } +SSARegisterStack LowLevelILInstruction::GetDestSSARegisterStack() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(DestSSARegisterStackLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsExpr(operandIndex).GetRawOperandAsSSARegisterStack(0); + throw LowLevelILInstructionAccessException(); +} + + SSAFlag LowLevelILInstruction::GetDestSSAFlag() const { size_t operandIndex; @@ -1596,6 +1871,15 @@ SSARegister LowLevelILInstruction::GetStackSSARegister() const } +SSARegister LowLevelILInstruction::GetTopSSARegister() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(TopSSARegisterLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsExpr(operandIndex).GetRawOperandAsSSARegister(0); + throw LowLevelILInstructionAccessException(); +} + + LowLevelILInstruction LowLevelILInstruction::GetLeftExpr() const { size_t operandIndex; @@ -1789,6 +2073,15 @@ LowLevelILSSARegisterList LowLevelILInstruction::GetSourceSSARegisters() const } +LowLevelILSSARegisterStackList LowLevelILInstruction::GetSourceSSARegisterStacks() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(SourceSSARegisterStacksLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsSSARegisterStackList(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + LowLevelILSSAFlagList LowLevelILInstruction::GetSourceSSAFlags() const { size_t operandIndex; @@ -1859,6 +2152,39 @@ ExprId LowLevelILFunction::SetRegisterSplitSSA(size_t size, const SSARegister& h } +ExprId LowLevelILFunction::SetRegisterStackTopRelative(size_t size, uint32_t regStack, ExprId entry, + ExprId val, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_SET_REG_STACK_REL, loc, size, flags, regStack, entry, val); +} + + +ExprId LowLevelILFunction::RegisterStackPush(size_t size, uint32_t regStack, ExprId val, + uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_PUSH, loc, size, flags, regStack, val); +} + + +ExprId LowLevelILFunction::SetRegisterStackTopRelativeSSA(size_t size, uint32_t regStack, + size_t destVersion, size_t srcVersion, ExprId entry, const SSARegister& top, + ExprId val, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_SET_REG_STACK_REL_SSA, loc, size, 0, + AddExprWithLocation(LLIL_REG_STACK_DEST_SSA, loc, size, 0, regStack, destVersion, srcVersion), + entry, AddExprWithLocation(LLIL_REG_SSA, loc, 0, 0, top.reg, top.version), val); +} + + +ExprId LowLevelILFunction::SetRegisterStackAbsoluteSSA(size_t size, uint32_t regStack, + size_t destVersion, size_t srcVersion, uint32_t reg, ExprId val, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_SET_REG_STACK_REL_SSA, loc, size, 0, + AddExprWithLocation(LLIL_REG_STACK_DEST_SSA, loc, size, 0, regStack, destVersion, srcVersion), + reg, val); +} + + ExprId LowLevelILFunction::SetFlag(uint32_t flag, ExprId val, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_SET_FLAG, loc, 0, 0, flag, val); @@ -1943,6 +2269,34 @@ ExprId LowLevelILFunction::RegisterSplitSSA(size_t size, const SSARegister& high } +ExprId LowLevelILFunction::RegisterStackTopRelative(size_t size, uint32_t regStack, ExprId entry, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_REL, loc, size, 0, regStack, entry); +} + + +ExprId LowLevelILFunction::RegisterStackPop(size_t size, uint32_t regStack, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_POP, loc, size, 0, regStack); +} + + +ExprId LowLevelILFunction::RegisterStackTopRelativeSSA(size_t size, const SSARegisterStack& regStack, ExprId entry, + const SSARegister& top, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_REL_SSA, loc, size, 0, regStack.regStack, regStack.version, entry, + AddExprWithLocation(LLIL_REG_SSA, loc, 0, 0, top.reg, top.version)); +} + + +ExprId LowLevelILFunction::RegisterStackAbsoluteSSA(size_t size, const SSARegisterStack& regStack, uint32_t reg, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_ABS_SSA, loc, size, 0, regStack.regStack, regStack.version, reg); +} + + ExprId LowLevelILFunction::Const(size_t size, uint64_t val, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_CONST, loc, size, 0, val); @@ -1955,6 +2309,36 @@ ExprId LowLevelILFunction::ConstPointer(size_t size, uint64_t val, const ILSourc } +ExprId LowLevelILFunction::FloatConstRaw(size_t size, uint64_t val, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FLOAT_CONST, loc, size, 0, val); +} + + +ExprId LowLevelILFunction::FloatConstSingle(float val, const ILSourceLocation& loc) +{ + union + { + float f; + uint32_t i; + } bits; + bits.f = val; + return AddExprWithLocation(LLIL_FLOAT_CONST, loc, 4, 0, bits.i); +} + + +ExprId LowLevelILFunction::FloatConstDouble(double val, const ILSourceLocation& loc) +{ + union + { + double f; + uint64_t i; + } bits; + bits.f = val; + return AddExprWithLocation(LLIL_FLOAT_CONST, loc, 8, 0, bits.i); +} + + ExprId LowLevelILFunction::Flag(uint32_t flag, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_FLAG, loc, 0, 0, flag); @@ -2358,6 +2742,14 @@ ExprId LowLevelILFunction::RegisterPhi(const SSARegister& dest, const vector& sources, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_PHI, loc, 0, 0, dest.regStack, dest.version, + sources.size() * 2, AddSSARegisterStackList(sources)); +} + + ExprId LowLevelILFunction::FlagPhi(const SSAFlag& dest, const vector& sources, const ILSourceLocation& loc) { diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index 8c8fe55f..4e02632e 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -69,6 +69,21 @@ namespace BinaryNinja bool operator<(const SSARegister& v) const; }; + struct SSARegisterStack + { + uint32_t regStack; + size_t version; + + SSARegisterStack(); + SSARegisterStack(uint32_t r, size_t i); + SSARegisterStack(const SSARegisterStack& v); + + SSARegisterStack& operator=(const SSARegisterStack& v); + bool operator==(const SSARegisterStack& v) const; + bool operator!=(const SSARegisterStack& v) const; + bool operator<(const SSARegisterStack& v) const; + }; + struct SSAFlag { uint32_t flag; @@ -90,12 +105,15 @@ namespace BinaryNinja IndexLowLevelOperand, ExprLowLevelOperand, RegisterLowLevelOperand, + RegisterStackLowLevelOperand, FlagLowLevelOperand, FlagConditionLowLevelOperand, SSARegisterLowLevelOperand, + SSARegisterStackLowLevelOperand, SSAFlagLowLevelOperand, IndexListLowLevelOperand, SSARegisterListLowLevelOperand, + SSARegisterStackListLowLevelOperand, SSAFlagListLowLevelOperand }; @@ -103,17 +121,23 @@ namespace BinaryNinja { SourceExprLowLevelOperandUsage, SourceRegisterLowLevelOperandUsage, + SourceRegisterStackLowLevelOperandUsage, SourceFlagLowLevelOperandUsage, SourceSSARegisterLowLevelOperandUsage, + SourceSSARegisterStackLowLevelOperandUsage, SourceSSAFlagLowLevelOperandUsage, DestExprLowLevelOperandUsage, DestRegisterLowLevelOperandUsage, + DestRegisterStackLowLevelOperandUsage, DestFlagLowLevelOperandUsage, DestSSARegisterLowLevelOperandUsage, + DestSSARegisterStackLowLevelOperandUsage, DestSSAFlagLowLevelOperandUsage, PartialRegisterLowLevelOperandUsage, + PartialSSARegisterStackSourceLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage, StackMemoryVersionLowLevelOperandUsage, + TopSSARegisterLowLevelOperandUsage, LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage, CarryExprLowLevelOperandUsage, @@ -136,6 +160,7 @@ namespace BinaryNinja OutputMemoryVersionLowLevelOperandUsage, ParameterSSARegistersLowLevelOperandUsage, SourceSSARegistersLowLevelOperandUsage, + SourceSSARegisterStacksLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage, SourceMemoryVersionsLowLevelOperandUsage, TargetListLowLevelOperandUsage @@ -162,6 +187,24 @@ namespace std } }; +#ifdef BINARYNINJACORE_LIBRARY + template<> struct hash +#else + template<> struct hash +#endif + { +#ifdef BINARYNINJACORE_LIBRARY + typedef BinaryNinjaCore::SSARegisterStack argument_type; +#else + typedef BinaryNinja::SSARegisterStack argument_type; +#endif + typedef uint64_t result_type; + result_type operator()(argument_type const& value) const + { + return ((result_type)value.regStack) ^ ((result_type)value.version << 32); + } + }; + #ifdef BINARYNINJACORE_LIBRARY template<> struct hash #else @@ -312,6 +355,33 @@ namespace BinaryNinja operator std::vector() const; }; + class LowLevelILSSARegisterStackList + { + struct ListIterator + { + LowLevelILIntegerList::const_iterator pos; + bool operator==(const ListIterator& a) const { return pos == a.pos; } + bool operator!=(const ListIterator& a) const { return pos != a.pos; } + bool operator<(const ListIterator& a) const { return pos < a.pos; } + ListIterator& operator++() { ++pos; ++pos; return *this; } + const SSARegisterStack operator*(); + }; + + LowLevelILIntegerList m_list; + + public: + typedef ListIterator const_iterator; + + LowLevelILSSARegisterStackList(LowLevelILFunction* func, const BNLowLevelILInstruction& instr, size_t count); + + const_iterator begin() const; + const_iterator end() const; + size_t size() const; + const SSARegisterStack operator[](size_t i) const; + + operator std::vector() const; + }; + class LowLevelILSSAFlagList { struct ListIterator @@ -362,9 +432,12 @@ namespace BinaryNinja BNLowLevelILFlagCondition GetRawOperandAsFlagCondition(size_t operand) const; LowLevelILInstruction GetRawOperandAsExpr(size_t operand) const; SSARegister GetRawOperandAsSSARegister(size_t operand) const; + SSARegisterStack GetRawOperandAsSSARegisterStack(size_t operand) const; + SSARegisterStack GetRawOperandAsPartialSSARegisterStackSource(size_t operand) const; SSAFlag GetRawOperandAsSSAFlag(size_t operand) const; LowLevelILIndexList GetRawOperandAsIndexList(size_t operand) const; LowLevelILSSARegisterList GetRawOperandAsSSARegisterList(size_t operand) const; + LowLevelILSSARegisterStackList GetRawOperandAsSSARegisterStackList(size_t operand) const; LowLevelILSSAFlagList GetRawOperandAsSSAFlagList(size_t operand) const; void UpdateRawOperand(size_t operandIndex, ExprId value); @@ -467,16 +540,21 @@ namespace BinaryNinja // Templated accessors for instruction operands, use these for efficient access to a known instruction template LowLevelILInstruction GetSourceExpr() const { return As().GetSourceExpr(); } template uint32_t GetSourceRegister() const { return As().GetSourceRegister(); } + template uint32_t GetSourceRegisterStack() const { return As().GetSourceRegisterStack(); } template uint32_t GetSourceFlag() const { return As().GetSourceFlag(); } template SSARegister GetSourceSSARegister() const { return As().GetSourceSSARegister(); } + template SSARegisterStack GetSourceSSARegisterStack() const { return As().GetSourceSSARegisterStack(); } template SSAFlag GetSourceSSAFlag() const { return As().GetSourceSSAFlag(); } template LowLevelILInstruction GetDestExpr() const { return As().GetDestExpr(); } template uint32_t GetDestRegister() const { return As().GetDestRegister(); } + template uint32_t GetDestRegisterStack() const { return As().GetDestRegisterStack(); } template uint32_t GetDestFlag() const { return As().GetDestFlag(); } template SSARegister GetDestSSARegister() const { return As().GetDestSSARegister(); } + template SSARegisterStack GetDestSSARegisterStack() const { return As().GetDestSSARegisterStack(); } template SSAFlag GetDestSSAFlag() const { return As().GetDestSSAFlag(); } template uint32_t GetPartialRegister() const { return As().GetPartialRegister(); } template SSARegister GetStackSSARegister() const { return As().GetStackSSARegister(); } + template SSARegister GetTopSSARegister() const { return As().GetTopSSARegister(); } template LowLevelILInstruction GetLeftExpr() const { return As().GetLeftExpr(); } template LowLevelILInstruction GetRightExpr() const { return As().GetRightExpr(); } template LowLevelILInstruction GetCarryExpr() const { return As().GetCarryExpr(); } @@ -498,6 +576,7 @@ namespace BinaryNinja template LowLevelILSSARegisterList GetOutputSSARegisters() const { return As().GetOutputSSARegisters(); } template LowLevelILSSARegisterList GetParameterSSARegisters() const { return As().GetParameterSSARegisters(); } template LowLevelILSSARegisterList GetSourceSSARegisters() const { return As().GetSourceSSARegisters(); } + template LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const { return As().GetSourceSSARegisterStacks(); } template LowLevelILSSAFlagList GetSourceSSAFlags() const { return As().GetSourceSSAFlags(); } template LowLevelILIndexList GetSourceMemoryVersions() const { return As().GetSourceMemoryVersions(); } template LowLevelILIndexList GetTargetList() const { return As().GetTargetList(); } @@ -507,6 +586,7 @@ namespace BinaryNinja template void SetHighSSAVersion(size_t version) { As().SetHighSSAVersion(version); } template void SetLowSSAVersion(size_t version) { As().SetLowSSAVersion(version); } template void SetStackSSAVersion(size_t version) { As().SetStackSSAVersion(version); } + template void SetTopSSAVersion(size_t version) { As().SetTopSSAVersion(version); } template void SetDestMemoryVersion(size_t version) { As().SetDestMemoryVersion(version); } template void SetSourceMemoryVersion(size_t version) { As().SetSourceMemoryVersion(version); } template void SetOutputSSARegisters(const std::vector& regs) { As().SetOutputSSARegisters(regs); } @@ -518,16 +598,21 @@ namespace BinaryNinja // on type mismatch. These are slower than the templated versions above. LowLevelILInstruction GetSourceExpr() const; uint32_t GetSourceRegister() const; + uint32_t GetSourceRegisterStack() const; uint32_t GetSourceFlag() const; SSARegister GetSourceSSARegister() const; + SSARegisterStack GetSourceSSARegisterStack() const; SSAFlag GetSourceSSAFlag() const; LowLevelILInstruction GetDestExpr() const; uint32_t GetDestRegister() const; + uint32_t GetDestRegisterStack() const; uint32_t GetDestFlag() const; SSARegister GetDestSSARegister() const; + SSARegisterStack GetDestSSARegisterStack() const; SSAFlag GetDestSSAFlag() const; uint32_t GetPartialRegister() const; SSARegister GetStackSSARegister() const; + SSARegister GetTopSSARegister() const; LowLevelILInstruction GetLeftExpr() const; LowLevelILInstruction GetRightExpr() const; LowLevelILInstruction GetCarryExpr() const; @@ -549,6 +634,7 @@ namespace BinaryNinja LowLevelILSSARegisterList GetOutputSSARegisters() const; LowLevelILSSARegisterList GetParameterSSARegisters() const; LowLevelILSSARegisterList GetSourceSSARegisters() const; + LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const; LowLevelILSSAFlagList GetSourceSSAFlags() const; LowLevelILIndexList GetSourceMemoryVersions() const; LowLevelILIndexList GetTargetList() const; @@ -572,12 +658,15 @@ namespace BinaryNinja size_t GetIndex() const; LowLevelILInstruction GetExpr() const; uint32_t GetRegister() const; + uint32_t GetRegisterStack() const; uint32_t GetFlag() const; BNLowLevelILFlagCondition GetFlagCondition() const; SSARegister GetSSARegister() const; + SSARegisterStack GetSSARegisterStack() const; SSAFlag GetSSAFlag() const; LowLevelILIndexList GetIndexList() const; LowLevelILSSARegisterList GetSSARegisterList() const; + LowLevelILSSARegisterStackList GetSSARegisterStackList() const; LowLevelILSSAFlagList GetSSAFlagList() const; }; @@ -671,6 +760,37 @@ namespace BinaryNinja void SetHighSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(1, version); } void SetLowSSAVersion(size_t version) { GetRawOperandAsExpr(1).UpdateRawOperand(1, version); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetDestRegisterStack() const { return GetRawOperandAsRegister(0); } + LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(2); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetDestRegisterStack() const { return GetRawOperandAsRegister(0); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(1); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetDestSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsSSARegisterStack(0); } + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsPartialSSARegisterStackSource(0); } + LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); } + SSARegister GetTopSSARegister() const { return GetRawOperandAsExpr(2).GetRawOperandAsSSARegister(0); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(3); } + void SetDestSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(1, version); } + void SetSourceSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(2, version); } + void SetTopSSAVersion(size_t version) { GetRawOperandAsExpr(2).UpdateRawOperand(1, version); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetDestSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsSSARegisterStack(0); } + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsPartialSSARegisterStackSource(0); } + uint32_t GetDestRegister() const { return GetRawOperandAsRegister(1); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(2); } + void SetDestSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(1, version); } + void SetSourceSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(2, version); } + }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { uint32_t GetDestFlag() const { return GetRawOperandAsRegister(0); } @@ -721,6 +841,29 @@ namespace BinaryNinja uint32_t GetPartialRegister() const { return GetRawOperandAsRegister(2); } void SetSourceSSAVersion(size_t version) { UpdateRawOperand(1, version); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetSourceRegisterStack() const { return GetRawOperandAsRegister(0); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(1); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetSourceRegisterStack() const { return GetRawOperandAsRegister(0); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsSSARegisterStack(0); } + LowLevelILInstruction GetSourceExpr() const { return GetRawOperandAsExpr(2); } + SSARegister GetTopSSARegister() const { return GetRawOperandAsExpr(3).GetRawOperandAsSSARegister(0); } + void SetSourceSSAVersion(size_t version) { UpdateRawOperand(1, version); } + void SetTopSSAVersion(size_t version) { GetRawOperandAsExpr(3).UpdateRawOperand(1, version); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsSSARegisterStack(0); } + uint32_t GetSourceRegister() const { return GetRawOperandAsRegister(2); } + void SetSourceSSAVersion(size_t version) { UpdateRawOperand(1, version); } + }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { uint32_t GetSourceFlag() const { return GetRawOperandAsRegister(0); } @@ -832,6 +975,11 @@ namespace BinaryNinja SSARegister GetDestSSARegister() const { return GetRawOperandAsSSARegister(0); } LowLevelILSSARegisterList GetSourceSSARegisters() const { return GetRawOperandAsSSARegisterList(2); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetDestSSARegisterStack() const { return GetRawOperandAsSSARegisterStack(0); } + LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const { return GetRawOperandAsSSARegisterStackList(2); } + }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { SSAFlag GetDestSSAFlag() const { return GetRawOperandAsSSAFlag(0); } @@ -853,6 +1001,7 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILConstantInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILConstantInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILConstantInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index b0e607b2..c3b4014f 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -149,6 +149,7 @@ unordered_map> {MLIL_MEM_PHI, {DestMemoryVersionMediumLevelOperandUsage, SourceMemoryVersionsMediumLevelOperandUsage}}, {MLIL_CONST, {ConstantMediumLevelOperandUsage}}, {MLIL_CONST_PTR, {ConstantMediumLevelOperandUsage}}, + {MLIL_FLOAT_CONST, {ConstantMediumLevelOperandUsage}}, {MLIL_IMPORT, {ConstantMediumLevelOperandUsage}}, {MLIL_ADD, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_SUB, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, @@ -1598,6 +1599,8 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, return dest->Const(size, GetConstant(), *this); case MLIL_CONST_PTR: return dest->ConstPointer(size, GetConstant(), *this); + case MLIL_FLOAT_CONST: + return dest->FloatConstRaw(size, GetConstant(), *this); case MLIL_IMPORT: return dest->ImportedAddress(size, GetConstant(), *this); case MLIL_BP: @@ -2131,6 +2134,36 @@ ExprId MediumLevelILFunction::ConstPointer(size_t size, uint64_t val, const ILSo } +ExprId MediumLevelILFunction::FloatConstRaw(size_t size, uint64_t val, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FLOAT_CONST, loc, size, val); +} + + +ExprId MediumLevelILFunction::FloatConstSingle(float val, const ILSourceLocation& loc) +{ + union + { + float f; + uint32_t i; + } bits; + bits.f = val; + return AddExprWithLocation(MLIL_FLOAT_CONST, loc, 4, bits.i); +} + + +ExprId MediumLevelILFunction::FloatConstDouble(double val, const ILSourceLocation& loc) +{ + union + { + double f; + uint64_t i; + } bits; + bits.f = val; + return AddExprWithLocation(MLIL_FLOAT_CONST, loc, 8, bits.i); +} + + ExprId MediumLevelILFunction::ImportedAddress(size_t size, uint64_t val, const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_IMPORT, loc, size, val); diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h index aa4600df..85630843 100644 --- a/mediumlevelilinstruction.h +++ b/mediumlevelilinstruction.h @@ -925,6 +925,7 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILConstantInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILConstantInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILConstantInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILConstantInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; diff --git a/python/architecture.py b/python/architecture.py index 72403fec..289b0abd 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -122,6 +122,7 @@ class Architecture(object): flag_roles = {} flags_required_for_flag_condition = {} flags_written_by_flag_write_type = {} + reg_stacks = {} __metaclass__ = _ArchitectureMetaClass next_address = 0 @@ -216,6 +217,19 @@ class Architecture(object): for i in xrange(0, count.value): self.global_regs.append(core.BNGetArchitectureRegisterName(self.handle, regs[i])) core.BNFreeRegisterList(regs) + + count = ctypes.c_ulonglong() + regs = core.BNGetAllArchitectureRegisterStacks(self.handle, count) + self.__dict__["reg_stacks"] = {} + for i in xrange(0, count.value): + name = core.BNGetArchitectureRegisterStackName(self.handle, regs[i]) + info = core.BNGetArchitectureRegisterStackInfo(self.handle, regs[i]) + storage = [] + for j in xrange(0, info.count): + storage.append(core.BNGetArchitectureRegisterName(self.handle, info.firstStorageReg + j)) + top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) + self.reg_stacks[name] = function.RegisterStackInfo(storage, top) + core.BNFreeRegisterList(regs) else: startup._init_plugins() @@ -259,6 +273,9 @@ class Architecture(object): self._get_stack_pointer_register) self._cb.getLinkRegister = self._cb.getLinkRegister.__class__(self._get_link_register) self._cb.getGlobalRegisters = self._cb.getGlobalRegisters.__class__(self._get_global_registers) + self._cb.getRegisterStackName = self._cb.getRegisterStackName.__class__(self._get_register_stack_name) + self._cb.getAllRegisterStacks = self._cb.getAllRegisterStacks.__class__(self._get_all_register_stacks) + self._cb.getRegisterStackInfo = self._cb.getRegisterStackInfo.__class__(self._get_register_stack_info) self._cb.assemble = self._cb.assemble.__class__(self._assemble) self._cb.isNeverBranchPatchAvailable = self._cb.isNeverBranchPatchAvailable.__class__( self._is_never_branch_patch_available) @@ -280,6 +297,25 @@ class Architecture(object): self._regs_by_index = {} self.__dict__["regs"] = self.__class__.regs reg_index = 0 + + # Registers used for storage in register stacks must be sequential, so allocate these in order first + self._all_reg_stacks = {} + self._reg_stacks_by_index = {} + self.__dict__["reg_stacks"] = self.__class__.reg_stacks + reg_stack_index = 0 + for reg_stack in self.reg_stacks: + info = self.reg_stacks[reg_stack] + for reg in info.storage_regs: + self._all_regs[reg] = reg_index + self._regs_by_index[reg_index] = reg + self.regs[reg].index = reg_index + reg_index += 1 + if reg_stack not in self._all_reg_stacks: + self._all_reg_stacks[reg_stack] = reg_stack_index + self._reg_stacks_by_index[reg_stack_index] = reg_stack + self.reg_stacks[reg_stack].index = reg_stack_index + reg_stack_index += 1 + for reg in self.regs: info = self.regs[reg] if reg not in self._all_regs: @@ -744,6 +780,47 @@ class Architecture(object): count[0] = 0 return None + def _get_register_stack_name(self, ctxt, reg_stack): + try: + if reg_stack in self._reg_stacks_by_index: + return core.BNAllocString(self._reg_stacks_by_index[reg_stack]) + return core.BNAllocString("") + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + return core.BNAllocString("") + + def _get_all_register_stacks(self, ctxt, count): + try: + regs = self._reg_stacks_by_index.keys() + count[0] = len(regs) + reg_buf = (ctypes.c_uint * len(regs))() + for i in xrange(0, len(regs)): + reg_buf[i] = regs[i] + result = ctypes.cast(reg_buf, ctypes.c_void_p) + self._pending_reg_lists[result.value] = (result, reg_buf) + return result.value + except KeyError: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _get_register_stack_info(self, ctxt, reg_stack, result): + try: + if reg_stack not in self._reg_stacks_by_index: + result[0].firstStorageReg = 0 + result[0].count = 0 + result[0].stackTopReg = 0 + return + info = self.__class__.regs[self._reg_stacks_by_index[reg_stack]] + result[0].firstStorageReg = self._all_regs[info.storage_regs[0]] + result[0].count = len(info.storage_regs) + result[0].stackTopReg = self._all_regs[info.stack_top_reg] + except KeyError: + log.log_error(traceback.format_exc()) + result[0].firstStorageReg = 0 + result[0].count = 0 + result[0].stackTopReg = 0 + def _assemble(self, ctxt, code, addr, result, errors): try: data, error_str = self.perform_assemble(code, addr) @@ -1251,6 +1328,23 @@ class Architecture(object): """ return core.BNGetArchitectureRegisterName(self.handle, reg) + def get_reg_stack_name(self, reg_stack): + """ + ``get_reg_stack_name`` gets a register stack name from a register stack number. + + :param int reg_stack: register stack number + :return: the corresponding register string + :rtype: str + """ + return core.BNGetArchitectureRegisterStackName(self.handle, reg_stack) + + def get_reg_stack_for_reg(self, reg): + reg = self.get_reg_index(reg) + result = core.BNGetArchitectureRegisterStackForRegister(self.handle, reg) + if result == 0xffffffff: + return None + return self.get_reg_stack_name(result) + def get_flag_name(self, flag): """ ``get_flag_name`` gets a flag name from a flag number. @@ -1268,6 +1362,13 @@ class Architecture(object): return reg.index return reg + def get_reg_stack_index(self, reg_stack): + if isinstance(reg_stack, str): + return self.reg_stacks[reg_stack].index + elif isinstance(reg_stack, lowlevelil.ILRegisterStack): + return reg_stack.index + return reg_stack + def get_flag_index(self, flag): if isinstance(flag, str): return self._flags[flag] diff --git a/python/callingconvention.py b/python/callingconvention.py index e72475c9..18662fc5 100644 --- a/python/callingconvention.py +++ b/python/callingconvention.py @@ -308,6 +308,10 @@ class CallingConvention(object): return self.name def perform_get_incoming_reg_value(self, reg, func): + reg_stack = self.arch.get_reg_stack_for_reg(reg) + if reg_stack is not None: + if reg == self.arch.reg_stacks[reg_stack].stack_top_reg: + return function.RegisterValue.constant(0) return function.RegisterValue() def perform_get_incoming_flag_value(self, reg, func): diff --git a/python/function.py b/python/function.py index 5daa7b2a..eb8796f1 100644 --- a/python/function.py +++ b/python/function.py @@ -51,11 +51,11 @@ class LookupTableEntry(object): class RegisterValue(object): def __init__(self, arch = None, value = None, confidence = types.max_confidence): + self.is_constant = False if value is None: self.type = RegisterValueType.UndeterminedValue else: self.type = RegisterValueType(value.state) - self.is_constant = False if value.state == RegisterValueType.EntryValue: self.arch = arch if arch is not None: @@ -103,6 +103,54 @@ class RegisterValue(object): result.value = self.value return result + @classmethod + def undetermined(self): + return RegisterValue() + + @classmethod + def entry_value(self, arch, reg): + result = RegisterValue() + result.type = RegisterValueType.EntryValue + result.arch = arch + result.reg = reg + return result + + @classmethod + def constant(self, value): + result = RegisterValue() + result.type = RegisterValueType.ConstantValue + result.value = value + result.is_constant = True + return result + + @classmethod + def constant_ptr(self, value): + result = RegisterValue() + result.type = RegisterValueType.ConstantPointerValue + result.value = value + result.is_constant = True + return result + + @classmethod + def stack_frame_offset(self, offset): + result = RegisterValue() + result.type = RegisterValueType.StackFrameOffset + result.offset = offset + return result + + @classmethod + def imported_address(self, value): + result = RegisterValue() + result.type = RegisterValueType.ImportedAddressValue + result.value = value + return result + + @classmethod + def return_address(self): + result = RegisterValue() + result.type = RegisterValueType.ReturnAddressValue + return result + class ValueRange(object): def __init__(self, start, end, step): @@ -1678,6 +1726,15 @@ class RegisterInfo(object): return "" % (self.size, self.offset, self.full_width_reg, extend) +class RegisterStackInfo(object): + def __init__(self, storage_regs, stack_top_reg): + self.storage_regs = storage_regs + self.stack_top_reg = stack_top_reg + + def __repr__(self): + return "" % (len(self.storage_regs), self.stack_top_reg) + + class InstructionBranch(object): def __init__(self, branch_type, target = 0, arch = None): self.type = branch_type diff --git a/python/lowlevelil.py b/python/lowlevelil.py index a3b1fcb6..f5a39b7e 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -26,6 +26,7 @@ from .enums import LowLevelILOperation, LowLevelILFlagCondition, InstructionText import function import basicblock import mediumlevelil +import struct class LowLevelILLabel(object): @@ -61,6 +62,26 @@ class ILRegister(object): return self.info == other.info +class ILRegisterStack(object): + def __init__(self, arch, reg_stack): + self.arch = arch + self.index = reg_stack + self.name = self.arch.get_reg_stack_name(self.index) + + @property + def info(self): + return self.arch.reg_stacks[self.name] + + def __str__(self): + return self.name + + def __repr__(self): + return self.name + + def __eq__(self, other): + return self.info == other.info + + class ILFlag(object): def __init__(self, arch, flag): self.arch = arch @@ -87,6 +108,15 @@ class SSARegister(object): return "" % (repr(self.reg), self.version) +class SSARegisterStack(object): + def __init__(self, reg_stack, version): + self.reg_stack = reg_stack + self.version = version + + def __repr__(self): + return "" % (repr(self.reg_stack), self.version) + + class SSAFlag(object): def __init__(self, flag, version): self.flag = flag @@ -118,15 +148,20 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_NOP: [], LowLevelILOperation.LLIL_SET_REG: [("dest", "reg"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SPLIT: [("hi", "reg"), ("lo", "reg"), ("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_STACK_REL: [("stack", "reg_stack"), ("dest", "expr"), ("src", "expr")], + LowLevelILOperation.LLIL_REG_STACK_PUSH: [("stack", "reg_stack"), ("src", "expr")], LowLevelILOperation.LLIL_SET_FLAG: [("dest", "flag"), ("src", "expr")], LowLevelILOperation.LLIL_LOAD: [("src", "expr")], LowLevelILOperation.LLIL_STORE: [("dest", "expr"), ("src", "expr")], LowLevelILOperation.LLIL_PUSH: [("src", "expr")], LowLevelILOperation.LLIL_POP: [], LowLevelILOperation.LLIL_REG: [("src", "reg")], - LowLevelILOperation.LLIL_REG_SPLIT: [("hi", "reg", "lo", "reg")], + LowLevelILOperation.LLIL_REG_SPLIT: [("hi", "reg"), ("lo", "reg")], + LowLevelILOperation.LLIL_REG_STACK_REL: [("stack", "reg_stack"), ("src", "expr")], + LowLevelILOperation.LLIL_REG_STACK_POP: [("stack", "reg_stack")], LowLevelILOperation.LLIL_CONST: [("constant", "int")], LowLevelILOperation.LLIL_CONST_PTR: [("constant", "int")], + LowLevelILOperation.LLIL_FLOAT_CONST: [("constant", "float")], LowLevelILOperation.LLIL_FLAG: [("src", "flag")], LowLevelILOperation.LLIL_FLAG_BIT: [("src", "flag"), ("bit", "int")], LowLevelILOperation.LLIL_ADD: [("left", "expr"), ("right", "expr")], @@ -207,10 +242,15 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_SET_REG_SSA: [("dest", "reg_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [("full_reg", "reg_ssa"), ("dest", "reg"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: [("hi", "expr"), ("lo", "expr"), ("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_STACK_REL_SSA: [("stack", "expr"), ("dest", "expr"), ("top", "expr"), ("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_STACK_ABS_SSA: [("stack", "expr"), ("dest", "reg"), ("src", "expr")], LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: [("dest", "reg_ssa")], + LowLevelILOperation.LLIL_REG_STACK_DEST_SSA: [("src", "reg_stack_ssa_dest_and_src")], LowLevelILOperation.LLIL_REG_SSA: [("src", "reg_ssa")], LowLevelILOperation.LLIL_REG_SSA_PARTIAL: [("full_reg", "reg_ssa"), ("src", "reg")], LowLevelILOperation.LLIL_REG_SPLIT_SSA: [("hi", "reg_ssa"), ("lo", "reg_ssa")], + LowLevelILOperation.LLIL_REG_STACK_REL_SSA: [("stack", "reg_stack_ssa"), ("src", "expr"), ("top", "expr")], + LowLevelILOperation.LLIL_REG_STACK_ABS_SSA: [("stack", "reg_stack_ssa"), ("src", "reg")], LowLevelILOperation.LLIL_SET_FLAG_SSA: [("dest", "flag_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_FLAG_SSA: [("src", "flag_ssa")], LowLevelILOperation.LLIL_FLAG_BIT_SSA: [("src", "flag_ssa"), ("bit", "int")], @@ -222,6 +262,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], LowLevelILOperation.LLIL_REG_PHI: [("dest", "reg_ssa"), ("src", "reg_ssa_list")], + LowLevelILOperation.LLIL_REG_STACK_PHI: [("dest", "reg_stack_ssa"), ("src", "reg_stack_ssa_list")], LowLevelILOperation.LLIL_FLAG_PHI: [("dest", "flag_ssa"), ("src", "flag_ssa_list")], LowLevelILOperation.LLIL_MEM_PHI: [("dest_memory", "int"), ("src_memory", "int_list")] } @@ -248,14 +289,35 @@ class LowLevelILInstruction(object): name, operand_type = operand if operand_type == "int": value = instr.operands[i] + elif operand_type == "float": + if instr.size == 4: + value = struct.unpack("f", struct.pack("I", instr.operands[i] & 0xffffffff))[0] + elif instr.size == 8: + value = struct.unpack("d", struct.pack("Q", instr.operands[i]))[0] + else: + value = instr.operands[i] elif operand_type == "expr": value = LowLevelILInstruction(func, instr.operands[i]) elif operand_type == "reg": value = ILRegister(func.arch, instr.operands[i]) + elif operand_type == "reg_stack": + value = ILRegisterStack(func.arch, instr.operands[i]) elif operand_type == "reg_ssa": reg = ILRegister(func.arch, instr.operands[i]) i += 1 value = SSARegister(reg, instr.operands[i]) + elif operand_type == "reg_stack_ssa": + reg_stack = ILRegisterStack(func.arch, instr.operands[i]) + i += 1 + value = SSARegisterStack(reg_stack, instr.operands[i]) + elif operand_type == "reg_stack_ssa_dest_and_src": + reg_stack = ILRegisterStack(func.arch, instr.operands[i]) + i += 1 + value = SSARegisterStack(reg_stack, instr.operands[i]) + i += 1 + self.operands.append(value) + self.dest = value + value = SSARegisterStack(reg_stack, instr.operands[i]) elif operand_type == "flag": value = ILFlag(func.arch, instr.operands[i]) elif operand_type == "flag_ssa": @@ -282,6 +344,16 @@ class LowLevelILInstruction(object): reg_version = operand_list[(i * 2) + 1] value.append(SSARegister(ILRegister(func.arch, reg), reg_version)) core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "reg_stack_ssa_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = [] + for i in xrange(count.value / 2): + reg_stack = operand_list[i * 2] + reg_version = operand_list[(i * 2) + 1] + value.append(SSARegisterStack(ILRegisterStack(func.arch, reg_stack), reg_version)) + core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "flag_ssa_list": count = ctypes.c_ulonglong() operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) @@ -729,6 +801,38 @@ class LowLevelILFunction(object): lo = self.arch.get_reg_index(lo) return self.expr(LowLevelILOperation.LLIL_SET_REG_SPLIT, hi, lo, value.index, size = size, flags = flags) + def set_reg_stack_top_relative(self, size, reg_stack, entry, value, flags = 0): + """ + ``set_reg_stack_top_relative`` sets the top-relative entry ``entry`` of size ``size`` in register + stack ``reg_stack`` to the expression ``value`` + + :param int size: size of the register parameter in bytes + :param str reg_stack: the register stack name + :param LowLevelILExpr entry: an expression for which stack entry to set + :param LowLevelILExpr value: an expression to set the entry to + :param str flags: which flags are set by this operation + :return: The expression ``reg_stack[entry] = value`` + :rtype: LowLevelILExpr + """ + reg_stack = self.arch.get_reg_stack_index(reg_stack) + return self.expr(LowLevelILOperation.LLIL_SET_REG_STACK_REL, reg_stack, entry.index, value.index, + size = size, flags = flags) + + def reg_stack_push(self, size, reg_stack, value, flags = 0): + """ + ``reg_stack_push`` pushes the expression ``value`` of size ``size`` onto the top of the register + stack ``reg_stack`` + + :param int size: size of the register parameter in bytes + :param str reg_stack: the register stack name + :param LowLevelILExpr value: an expression to push + :param str flags: which flags are set by this operation + :return: The expression ``reg_stack.push(value)`` + :rtype: LowLevelILExpr + """ + reg_stack = self.arch.get_reg_stack_index(reg_stack) + return self.expr(LowLevelILOperation.LLIL_REG_STACK_PUSH, reg_stack, value.index, size = size, flags = flags) + def set_flag(self, flag, value): """ ``set_flag`` sets the flag ``flag`` to the LowLevelILExpr ``value`` @@ -811,6 +915,33 @@ class LowLevelILFunction(object): lo = self.arch.get_reg_index(lo) return self.expr(LowLevelILOperation.LLIL_REG_SPLIT, hi, lo, size=size) + def reg_stack_top_relative(self, size, reg_stack, entry): + """ + ``reg_stack_top_relative`` returns a register stack entry of size ``size`` at top-relative + location ``entry`` in register stack with name ``reg_stack`` + + :param int size: the size of the register in bytes + :param str reg_stack: the name of the register stack + :param LowLevelILExpr entry: an expression for which stack entry to fetch + :return: The expression ``reg_stack[entry]`` + :rtype: LowLevelILExpr + """ + reg_stack = self.arch.get_reg_stack_index(reg_stack) + return self.expr(LowLevelILOperation.LLIL_REG_STACK_REL, reg_stack, entry.index, size=size) + + def reg_stack_pop(self, size, reg_stack): + """ + ``reg_stack_pop`` returns the top entry of size ``size`` in register stack with name ``reg_stack``, and + removes the entry from the stack + + :param int size: the size of the register in bytes + :param str reg_stack: the name of the register stack + :return: The expression ``reg_stack.pop`` + :rtype: LowLevelILExpr + """ + reg_stack = self.arch.get_reg_stack_index(reg_stack) + return self.expr(LowLevelILOperation.LLIL_REG_STACK_POP, reg_stack, size=size) + def const(self, size, value): """ ``const`` returns an expression for the constant integer ``value`` with size ``size`` @@ -833,6 +964,38 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_CONST_PTR, value, size=size) + def float_const_raw(self, size, value): + """ + ``float_const_raw`` returns an expression for the constant raw binary floating point + value ``value`` with size ``size`` + + :param int size: the size of the constant in bytes + :param int value: integer value for the raw binary representation of the constant + :return: A constant expression of given value and size + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOAT_CONST, value, size=size) + + def float_const_single(self, value): + """ + ``float_const_single`` returns an expression for the single precision floating point value ``value`` + + :param float value: float value for the constant + :return: A constant expression of given value and size + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOAT_CONST, struct.unpack("I", struct.pack("f", value))[0], size=4) + + def float_const_double(self, value): + """ + ``float_const_double`` returns an expression for the double precision floating point value ``value`` + + :param float value: float value for the constant + :return: A constant expression of given value and size + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOAT_CONST, struct.unpack("Q", struct.pack("d", value))[0], size=8) + def flag(self, reg): """ ``flag`` returns a flag expression for the given flag name. diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 05b558d2..144c7e0b 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -27,6 +27,7 @@ import function import basicblock import lowlevelil import types +import struct class SSAVariable(object): @@ -90,6 +91,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [("src", "var"), ("offset", "int")], MediumLevelILOperation.MLIL_CONST: [("constant", "int")], MediumLevelILOperation.MLIL_CONST_PTR: [("constant", "int")], + MediumLevelILOperation.MLIL_FLOAT_CONST: [("constant", "float")], MediumLevelILOperation.MLIL_IMPORT: [("constant", "int")], MediumLevelILOperation.MLIL_ADD: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_ADC: [("left", "expr"), ("right", "expr"), ("carry", "expr")], @@ -211,6 +213,13 @@ class MediumLevelILInstruction(object): name, operand_type = operand if operand_type == "int": value = instr.operands[i] + elif operand_type == "float": + if instr.size == 4: + value = struct.unpack("f", struct.pack("I", instr.operands[i] & 0xffffffff))[0] + elif instr.size == 8: + value = struct.unpack("d", struct.pack("Q", instr.operands[i]))[0] + else: + value = instr.operands[i] elif operand_type == "expr": value = MediumLevelILInstruction(func, instr.operands[i]) elif operand_type == "var": -- cgit v1.3.1 From d5db0ddb807265b295bb6b4ff07613776945c92b Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 23 Oct 2017 21:45:37 -0400 Subject: Top relative register stack access as a normal register --- architecture.cpp | 4 +++- binaryninjacore.h | 4 ++-- lowlevelilinstruction.cpp | 2 +- python/architecture.py | 28 +++++++++++++++++++++++----- python/function.py | 3 ++- 5 files changed, 31 insertions(+), 10 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 56af3f80..169a8c0c 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -731,7 +731,9 @@ BNRegisterStackInfo Architecture::GetRegisterStackInfo(uint32_t) { BNRegisterStackInfo result; result.firstStorageReg = BN_INVALID_REGISTER; - result.count = 0; + result.topRelativeCount = BN_INVALID_REGISTER; + result.storageCount = 0; + result.topRelativeCount = 0; result.stackTopReg = BN_INVALID_REGISTER; return result; } diff --git a/binaryninjacore.h b/binaryninjacore.h index f50c28c8..c32d42e3 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -679,8 +679,8 @@ extern "C" struct BNRegisterStackInfo { - uint32_t firstStorageReg; - uint32_t count; + uint32_t firstStorageReg, firstTopRelativeReg; + uint32_t storageCount, topRelativeCount; uint32_t stackTopReg; }; diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 4130dd2a..91af36b1 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -2179,7 +2179,7 @@ ExprId LowLevelILFunction::SetRegisterStackTopRelativeSSA(size_t size, uint32_t ExprId LowLevelILFunction::SetRegisterStackAbsoluteSSA(size_t size, uint32_t regStack, size_t destVersion, size_t srcVersion, uint32_t reg, ExprId val, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_SET_REG_STACK_REL_SSA, loc, size, 0, + return AddExprWithLocation(LLIL_SET_REG_STACK_ABS_SSA, loc, size, 0, AddExprWithLocation(LLIL_REG_STACK_DEST_SSA, loc, size, 0, regStack, destVersion, srcVersion), reg, val); } diff --git a/python/architecture.py b/python/architecture.py index 289b0abd..04179e7f 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -225,10 +225,13 @@ class Architecture(object): name = core.BNGetArchitectureRegisterStackName(self.handle, regs[i]) info = core.BNGetArchitectureRegisterStackInfo(self.handle, regs[i]) storage = [] - for j in xrange(0, info.count): + for j in xrange(0, info.storageCount): storage.append(core.BNGetArchitectureRegisterName(self.handle, info.firstStorageReg + j)) + top_rel = [] + for j in xrange(0, info.topRelativeCount): + top_rel.append(core.BNGetArchitectureRegisterName(self.handle, info.firstTopRelativeReg + j)) top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) - self.reg_stacks[name] = function.RegisterStackInfo(storage, top) + self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top) core.BNFreeRegisterList(regs) else: startup._init_plugins() @@ -310,6 +313,11 @@ class Architecture(object): self._regs_by_index[reg_index] = reg self.regs[reg].index = reg_index reg_index += 1 + for reg in info.top_relative_regs: + self._all_regs[reg] = reg_index + self._regs_by_index[reg_index] = reg + self.regs[reg].index = reg_index + reg_index += 1 if reg_stack not in self._all_reg_stacks: self._all_reg_stacks[reg_stack] = reg_stack_index self._reg_stacks_by_index[reg_stack_index] = reg_stack @@ -808,17 +816,27 @@ class Architecture(object): try: if reg_stack not in self._reg_stacks_by_index: result[0].firstStorageReg = 0 - result[0].count = 0 + result[0].firstTopRelativeReg = 0 + result[0].storageCount = 0 + result[0].topRelativeCount = 0 result[0].stackTopReg = 0 return info = self.__class__.regs[self._reg_stacks_by_index[reg_stack]] result[0].firstStorageReg = self._all_regs[info.storage_regs[0]] - result[0].count = len(info.storage_regs) + result[0].storageCount = len(info.storage_regs) + if len(info.top_relative_regs) > 0: + result[0].firstTopRelativeReg = self._all_regs[info.top_relative_regs[0]] + result[0].topRelativeCount = len(info.top_relative_regs) + else: + result[0].firstTopRelativeReg = 0 + result[0].topRelativeCount = 0 result[0].stackTopReg = self._all_regs[info.stack_top_reg] except KeyError: log.log_error(traceback.format_exc()) result[0].firstStorageReg = 0 - result[0].count = 0 + result[0].firstTopRelativeReg = 0 + result[0].storageCount = 0 + result[0].topRelativeCount = 0 result[0].stackTopReg = 0 def _assemble(self, ctxt, code, addr, result, errors): diff --git a/python/function.py b/python/function.py index eb8796f1..ba00147e 100644 --- a/python/function.py +++ b/python/function.py @@ -1727,8 +1727,9 @@ class RegisterInfo(object): class RegisterStackInfo(object): - def __init__(self, storage_regs, stack_top_reg): + def __init__(self, storage_regs, top_relative_regs, stack_top_reg): self.storage_regs = storage_regs + self.top_relative_regs = top_relative_regs self.stack_top_reg = stack_top_reg def __repr__(self): -- cgit v1.3.1 From c24b1bd108ee2885d7164cecd15f75aa1715a8df Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 27 Nov 2017 17:15:03 -0500 Subject: Register stack adjustments in calling conventions --- binaryninjaapi.h | 21 +++++- binaryninjacore.h | 29 +++++++- callingconvention.cpp | 44 ++++++++++++ function.cpp | 48 ++++++++++++- lowlevelilinstruction.cpp | 172 ++++++++++++++++++++++++++++++++++++++------ lowlevelilinstruction.h | 57 ++++++++++++--- python/architecture.py | 2 +- python/callingconvention.py | 85 ++++++++++++++++++++++ python/function.py | 67 ++++++++++++++--- python/lowlevelil.py | 24 ++++++- python/types.py | 15 ++++ 11 files changed, 512 insertions(+), 52 deletions(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 5c122966..af067ae9 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2208,6 +2208,7 @@ namespace BinaryNinja Confidence> GetParameterVariables() const; Confidence HasVariableArguments() const; Confidence GetStackAdjustment() const; + std::map> GetRegisterStackAdjustments() const; Confidence> GetClobberedRegisters() const; void SetAutoType(Type* type); @@ -2217,6 +2218,7 @@ namespace BinaryNinja void SetAutoHasVariableArguments(const Confidence& varArgs); void SetAutoCanReturn(const Confidence& returns); void SetAutoStackAdjustment(const Confidence& stackAdjust); + void SetAutoRegisterStackAdjustments(const std::map>& regStackAdjust); void SetAutoClobberedRegisters(const Confidence>& clobbered); void SetUserType(Type* type); @@ -2226,6 +2228,7 @@ namespace BinaryNinja void SetHasVariableArguments(const Confidence& varArgs); void SetCanReturn(const Confidence& returns); void SetStackAdjustment(const Confidence& stackAdjust); + void SetRegisterStackAdjustments(const std::map>& regStackAdjust); void SetClobberedRegisters(const Confidence>& clobbered); void ApplyImportedTypes(Symbol* sym); @@ -2558,11 +2561,12 @@ namespace BinaryNinja ExprId JumpTo(ExprId dest, const std::vector& targets, const ILSourceLocation& loc = ILSourceLocation()); ExprId Call(ExprId dest, const ILSourceLocation& loc = ILSourceLocation()); - ExprId CallStackAdjust(ExprId dest, size_t adjust, const ILSourceLocation& loc = ILSourceLocation()); - ExprId CallSSA(const std::vector& output, ExprId dest, const std::vector& params, + ExprId CallStackAdjust(ExprId dest, size_t adjust, const std::map& regStackAdjust, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId CallSSA(const std::vector& output, ExprId dest, const std::vector& params, const SSARegister& stack, size_t newMemoryVer, size_t prevMemoryVer, const ILSourceLocation& loc = ILSourceLocation()); - ExprId SystemCallSSA(const std::vector& output, const std::vector& params, + ExprId SystemCallSSA(const std::vector& output, const std::vector& params, const SSARegister& stack, size_t newMemoryVer, size_t prevMemoryVer, const ILSourceLocation& loc = ILSourceLocation()); ExprId Return(size_t dest, const ILSourceLocation& loc = ILSourceLocation()); @@ -3184,6 +3188,11 @@ namespace BinaryNinja static void GetIncomingRegisterValueCallback(void* ctxt, uint32_t reg, BNFunction* func, BNRegisterValue* result); static void GetIncomingFlagValueCallback(void* ctxt, uint32_t reg, BNFunction* func, BNRegisterValue* result); + static void GetIncomingVariableForParameterVariableCallback(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result); + static void GetParameterVariableForIncomingVariableCallback(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result); + public: Ref GetArchitecture() const; std::string GetName() const; @@ -3204,6 +3213,9 @@ namespace BinaryNinja virtual std::vector GetImplicitlyDefinedRegisters(); virtual RegisterValue GetIncomingRegisterValue(uint32_t reg, Function* func); virtual RegisterValue GetIncomingFlagValue(uint32_t flag, Function* func); + + virtual Variable GetIncomingVariableForParameterVariable(const Variable& var, Function* func); + virtual Variable GetParameterVariableForIncomingVariable(const Variable& var, Function* func); }; class CoreCallingConvention: public CallingConvention @@ -3227,6 +3239,9 @@ namespace BinaryNinja virtual std::vector GetImplicitlyDefinedRegisters() override; virtual RegisterValue GetIncomingRegisterValue(uint32_t reg, Function* func) override; virtual RegisterValue GetIncomingFlagValue(uint32_t flag, Function* func) override; + + virtual Variable GetIncomingVariableForParameterVariable(const Variable& var, Function* func) override; + virtual Variable GetParameterVariableForIncomingVariable(const Variable& var, Function* func) override; }; /*! diff --git a/binaryninjacore.h b/binaryninjacore.h index c32d42e3..278299bc 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -1341,6 +1341,11 @@ extern "C" uint32_t* (*getImplicitlyDefinedRegisters)(void* ctxt, size_t* count); void (*getIncomingRegisterValue)(void* ctxt, uint32_t reg, BNFunction* func, BNRegisterValue* result); void (*getIncomingFlagValue)(void* ctxt, uint32_t flag, BNFunction* func, BNRegisterValue* result); + + void (*getIncomingVariableForParameterVariable)(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result); + void (*getParameterVariableForIncomingVariable)(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result); }; struct BNVariableNameAndType @@ -1658,6 +1663,13 @@ extern "C" ArrayDataType }; + struct BNRegisterStackAdjustment + { + uint32_t regStack; + int32_t adjustment; + uint8_t confidence; + }; + BINARYNINJACOREAPI char* BNAllocString(const char* contents); BINARYNINJACOREAPI void BNFreeString(char* str); BINARYNINJACOREAPI char** BNAllocStringList(const char** contents, size_t size); @@ -2173,6 +2185,8 @@ extern "C" BINARYNINJACOREAPI void BNFreeParameterVariables(BNParameterVariablesWithConfidence* vars); BINARYNINJACOREAPI BNBoolWithConfidence BNFunctionHasVariableArguments(BNFunction* func); BINARYNINJACOREAPI BNSizeWithConfidence BNGetFunctionStackAdjustment(BNFunction* func); + BINARYNINJACOREAPI BNRegisterStackAdjustment* BNGetFunctionRegisterStackAdjustments(BNFunction* func, size_t* count); + BINARYNINJACOREAPI void BNFreeRegisterStackAdjustments(BNRegisterStackAdjustment* adjustments); BINARYNINJACOREAPI BNRegisterSetWithConfidence BNGetFunctionClobberedRegisters(BNFunction* func); BINARYNINJACOREAPI void BNFreeClobberedRegisters(BNRegisterSetWithConfidence* regs); @@ -2182,6 +2196,8 @@ extern "C" BINARYNINJACOREAPI void BNSetAutoFunctionHasVariableArguments(BNFunction* func, BNBoolWithConfidence* varArgs); BINARYNINJACOREAPI void BNSetAutoFunctionCanReturn(BNFunction* func, BNBoolWithConfidence* returns); BINARYNINJACOREAPI void BNSetAutoFunctionStackAdjustment(BNFunction* func, BNSizeWithConfidence* stackAdjust); + BINARYNINJACOREAPI void BNSetAutoFunctionRegisterStackAdjustments(BNFunction* func, + BNRegisterStackAdjustment* adjustments, size_t count); BINARYNINJACOREAPI void BNSetAutoFunctionClobberedRegisters(BNFunction* func, BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNSetUserFunctionReturnType(BNFunction* func, BNTypeWithConfidence* type); @@ -2190,6 +2206,8 @@ extern "C" BINARYNINJACOREAPI void BNSetUserFunctionHasVariableArguments(BNFunction* func, BNBoolWithConfidence* varArgs); BINARYNINJACOREAPI void BNSetUserFunctionCanReturn(BNFunction* func, BNBoolWithConfidence* returns); BINARYNINJACOREAPI void BNSetUserFunctionStackAdjustment(BNFunction* func, BNSizeWithConfidence* stackAdjust); + BINARYNINJACOREAPI void BNSetUserFunctionRegisterStackAdjustments(BNFunction* func, + BNRegisterStackAdjustment* adjustments, size_t count); BINARYNINJACOREAPI void BNSetUserFunctionClobberedRegisters(BNFunction* func, BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNApplyImportedTypes(BNFunction* func, BNSymbol* sym); @@ -2241,7 +2259,7 @@ extern "C" BINARYNINJACOREAPI void BNFreeStringReferenceList(BNStringReference* strings); BINARYNINJACOREAPI BNVariableNameAndType* BNGetStackLayout(BNFunction* func, size_t* count); - BINARYNINJACOREAPI void BNFreeVariableList(BNVariableNameAndType* vars, size_t count); + BINARYNINJACOREAPI void BNFreeVariableNameAndTypeList(BNVariableNameAndType* vars, size_t count); BINARYNINJACOREAPI void BNCreateAutoStackVariable(BNFunction* func, int64_t offset, BNTypeWithConfidence* type, const char* name); BINARYNINJACOREAPI void BNCreateUserStackVariable(BNFunction* func, int64_t offset, @@ -2917,6 +2935,15 @@ extern "C" BINARYNINJACOREAPI BNRegisterValue BNGetIncomingRegisterValue(BNCallingConvention* cc, uint32_t reg, BNFunction* func); BINARYNINJACOREAPI BNRegisterValue BNGetIncomingFlagValue(BNCallingConvention* cc, uint32_t reg, BNFunction* func); + BINARYNINJACOREAPI BNVariable BNGetIncomingVariableForParameterVariable(BNCallingConvention* cc, + const BNVariable* var, BNFunction* func); + BINARYNINJACOREAPI BNVariable BNGetParameterVariableForIncomingVariable(BNCallingConvention* cc, + const BNVariable* var, BNFunction* func); + BINARYNINJACOREAPI BNVariable BNGetDefaultIncomingVariableForParameterVariable(BNCallingConvention* cc, + const BNVariable* var); + BINARYNINJACOREAPI BNVariable BNGetDefaultParameterVariableForIncomingVariable(BNCallingConvention* cc, + const BNVariable* var); + BINARYNINJACOREAPI BNCallingConvention* BNGetArchitectureDefaultCallingConvention(BNArchitecture* arch); BINARYNINJACOREAPI BNCallingConvention* BNGetArchitectureCdeclCallingConvention(BNArchitecture* arch); BINARYNINJACOREAPI BNCallingConvention* BNGetArchitectureStdcallCallingConvention(BNArchitecture* arch); diff --git a/callingconvention.cpp b/callingconvention.cpp index b29d51e2..2eb57567 100644 --- a/callingconvention.cpp +++ b/callingconvention.cpp @@ -49,6 +49,8 @@ CallingConvention::CallingConvention(Architecture* arch, const string& name) cc.getImplicitlyDefinedRegisters = GetImplicitlyDefinedRegistersCallback; cc.getIncomingRegisterValue = GetIncomingRegisterValueCallback; cc.getIncomingFlagValue = GetIncomingFlagValueCallback; + cc.getIncomingVariableForParameterVariable = GetIncomingVariableForParameterVariableCallback; + cc.getParameterVariableForIncomingVariable = GetParameterVariableForIncomingVariableCallback; AddRefForRegistration(); m_object = BNCreateCallingConvention(arch->GetObject(), name.c_str(), &cc); @@ -189,6 +191,24 @@ void CallingConvention::GetIncomingFlagValueCallback(void* ctxt, uint32_t reg, B } +void CallingConvention::GetIncomingVariableForParameterVariableCallback(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result) +{ + CallingConvention* cc = (CallingConvention*)ctxt; + *result = cc->GetIncomingVariableForParameterVariable(*var, + func ? new Function(BNNewFunctionReference(func)) : nullptr); +} + + +void CallingConvention::GetParameterVariableForIncomingVariableCallback(void* ctxt, const BNVariable* var, + BNFunction* func, BNVariable* result) +{ + CallingConvention* cc = (CallingConvention*)ctxt; + *result = cc->GetParameterVariableForIncomingVariable(*var, + func ? new Function(BNNewFunctionReference(func)) : nullptr); +} + + Ref CallingConvention::GetArchitecture() const { return new CoreArchitecture(BNGetCallingConventionArchitecture(m_object)); @@ -284,6 +304,18 @@ RegisterValue CallingConvention::GetIncomingFlagValue(uint32_t, Function*) } +Variable CallingConvention::GetIncomingVariableForParameterVariable(const Variable& var, Function*) +{ + return BNGetDefaultIncomingVariableForParameterVariable(m_object, &var); +} + + +Variable CallingConvention::GetParameterVariableForIncomingVariable(const Variable& var, Function*) +{ + return BNGetDefaultParameterVariableForIncomingVariable(m_object, &var); +} + + CoreCallingConvention::CoreCallingConvention(BNCallingConvention* cc): CallingConvention(cc) { } @@ -385,3 +417,15 @@ RegisterValue CoreCallingConvention::GetIncomingFlagValue(uint32_t flag, Functio { return RegisterValue::FromAPIObject(BNGetIncomingFlagValue(m_object, flag, func ? func->GetObject() : nullptr)); } + + +Variable CoreCallingConvention::GetIncomingVariableForParameterVariable(const Variable& var, Function* func) +{ + return BNGetIncomingVariableForParameterVariable(m_object, &var, func ? func->GetObject() : nullptr); +} + + +Variable CoreCallingConvention::GetParameterVariableForIncomingVariable(const Variable& var, Function* func) +{ + return BNGetParameterVariableForIncomingVariable(m_object, &var, func ? func->GetObject() : nullptr); +} diff --git a/function.cpp b/function.cpp index 2d8db04c..879c7156 100644 --- a/function.cpp +++ b/function.cpp @@ -530,6 +530,18 @@ Confidence Function::GetStackAdjustment() const } +map> Function::GetRegisterStackAdjustments() const +{ + size_t count; + BNRegisterStackAdjustment* regStackAdjust = BNGetFunctionRegisterStackAdjustments(m_object, &count); + map> result; + for (size_t i = 0; i < count; i++) + result[regStackAdjust[i].regStack] = Confidence(regStackAdjust[i].adjustment, regStackAdjust[i].confidence); + BNFreeRegisterStackAdjustments(regStackAdjust); + return result; +} + + Confidence> Function::GetClobberedRegisters() const { BNRegisterSetWithConfidence regs = BNGetFunctionClobberedRegisters(m_object); @@ -611,6 +623,22 @@ void Function::SetAutoStackAdjustment(const Confidence& stackAdjust) } +void Function::SetAutoRegisterStackAdjustments(const map>& regStackAdjust) +{ + BNRegisterStackAdjustment* adjust = new BNRegisterStackAdjustment[regStackAdjust.size()]; + size_t i = 0; + for (auto& j : regStackAdjust) + { + adjust[i].regStack = j.first; + adjust[i].adjustment = j.second.GetValue(); + adjust[i].confidence = j.second.GetConfidence(); + i++; + } + BNSetAutoFunctionRegisterStackAdjustments(m_object, adjust, regStackAdjust.size()); + delete[] adjust; +} + + void Function::SetAutoClobberedRegisters(const Confidence>& clobbered) { BNRegisterSetWithConfidence regs; @@ -694,6 +722,22 @@ void Function::SetStackAdjustment(const Confidence& stackAdjust) } +void Function::SetRegisterStackAdjustments(const map>& regStackAdjust) +{ + BNRegisterStackAdjustment* adjust = new BNRegisterStackAdjustment[regStackAdjust.size()]; + size_t i = 0; + for (auto& j : regStackAdjust) + { + adjust[i].regStack = j.first; + adjust[i].adjustment = j.second.GetValue(); + adjust[i].confidence = j.second.GetConfidence(); + i++; + } + BNSetUserFunctionRegisterStackAdjustments(m_object, adjust, regStackAdjust.size()); + delete[] adjust; +} + + void Function::SetClobberedRegisters(const Confidence>& clobbered) { BNRegisterSetWithConfidence regs; @@ -743,7 +787,7 @@ map> Function::GetStackLayout() result[vars[i].var.storage].push_back(var); } - BNFreeVariableList(vars, count); + BNFreeVariableNameAndTypeList(vars, count); return result; } @@ -811,7 +855,7 @@ map Function::GetVariables() result[vars[i].var] = var; } - BNFreeVariableList(vars, count); + BNFreeVariableNameAndTypeList(vars, count); return result; } diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 91af36b1..8259426a 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -74,12 +74,13 @@ unordered_map {FlagConditionLowLevelOperandUsage, FlagConditionLowLevelOperand}, {OutputSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, {OutputMemoryVersionLowLevelOperandUsage, IndexLowLevelOperand}, - {ParameterSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, + {ParameterExprsLowLevelOperandUsage, ExprListLowLevelOperand}, {SourceSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, {SourceSSARegisterStacksLowLevelOperandUsage, SSARegisterStackListLowLevelOperand}, {SourceSSAFlagsLowLevelOperandUsage, SSAFlagListLowLevelOperand}, {SourceMemoryVersionsLowLevelOperandUsage, IndexListLowLevelOperand}, - {TargetListLowLevelOperandUsage, IndexListLowLevelOperand} + {TargetListLowLevelOperandUsage, IndexListLowLevelOperand}, + {RegisterStackAdjustmentsLowLevelOperandUsage, RegisterStackAdjustmentsLowLevelOperand} }; @@ -133,7 +134,8 @@ unordered_map> {LLIL_JUMP, {DestExprLowLevelOperandUsage}}, {LLIL_JUMP_TO, {DestExprLowLevelOperandUsage, TargetListLowLevelOperandUsage}}, {LLIL_CALL, {DestExprLowLevelOperandUsage}}, - {LLIL_CALL_STACK_ADJUST, {DestExprLowLevelOperandUsage, StackAdjustmentLowLevelOperandUsage}}, + {LLIL_CALL_STACK_ADJUST, {DestExprLowLevelOperandUsage, StackAdjustmentLowLevelOperandUsage, + RegisterStackAdjustmentsLowLevelOperandUsage}}, {LLIL_RET, {DestExprLowLevelOperandUsage}}, {LLIL_IF, {ConditionExprLowLevelOperandUsage, TrueTargetLowLevelOperandUsage, FalseTargetLowLevelOperandUsage}}, @@ -142,10 +144,10 @@ unordered_map> {LLIL_TRAP, {VectorLowLevelOperandUsage}}, {LLIL_CALL_SSA, {OutputSSARegistersLowLevelOperandUsage, OutputMemoryVersionLowLevelOperandUsage, DestExprLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage, - StackMemoryVersionLowLevelOperandUsage, ParameterSSARegistersLowLevelOperandUsage}}, + StackMemoryVersionLowLevelOperandUsage, ParameterExprsLowLevelOperandUsage}}, {LLIL_SYSCALL_SSA, {OutputSSARegistersLowLevelOperandUsage, OutputMemoryVersionLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage, StackMemoryVersionLowLevelOperandUsage, - ParameterSSARegistersLowLevelOperandUsage}}, + ParameterExprsLowLevelOperandUsage}}, {LLIL_REG_PHI, {DestSSARegisterLowLevelOperandUsage, SourceSSARegistersLowLevelOperandUsage}}, {LLIL_REG_STACK_PHI, {DestSSARegisterStackLowLevelOperandUsage, SourceSSARegisterStacksLowLevelOperandUsage}}, {LLIL_FLAG_PHI, {DestSSAFlagLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage}}, @@ -239,7 +241,7 @@ static unordered_map() const } +const LowLevelILInstruction LowLevelILInstructionList::ListIterator::operator*() +{ + return LowLevelILInstruction(pos.GetFunction(), pos.GetFunction()->GetRawExpr((size_t)*pos), + (size_t)*pos, instructionIndex); +} + + +LowLevelILInstructionList::LowLevelILInstructionList(LowLevelILFunction* func, + const BNLowLevelILInstruction& instr, size_t count, size_t instrIndex): + m_list(func, instr, count), m_instructionIndex(instrIndex) +{ +} + + +LowLevelILInstructionList::const_iterator LowLevelILInstructionList::begin() const +{ + const_iterator result; + result.pos = m_list.begin(); + result.instructionIndex = m_instructionIndex; + return result; +} + + +LowLevelILInstructionList::const_iterator LowLevelILInstructionList::end() const +{ + const_iterator result; + result.pos = m_list.end(); + result.instructionIndex = m_instructionIndex; + return result; +} + + +size_t LowLevelILInstructionList::size() const +{ + return m_list.size(); +} + + +const LowLevelILInstruction LowLevelILInstructionList::operator[](size_t i) const +{ + if (i >= size()) + throw LowLevelILInstructionAccessException(); + auto iter = begin(); + for (size_t j = 0; j < i; j++) + ++iter; + return *iter; +} + + +LowLevelILInstructionList::operator vector() const +{ + vector result; + for (auto i : *this) + result.push_back(i); + return result; +} + + const SSARegister LowLevelILSSARegisterList::ListIterator::operator*() { LowLevelILIntegerList::const_iterator cur = pos; @@ -864,14 +925,20 @@ LowLevelILIndexList LowLevelILOperand::GetIndexList() const } +LowLevelILInstructionList LowLevelILOperand::GetExprList() const +{ + if (m_type != ExprListLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsExprList(0); +} + + LowLevelILSSARegisterList LowLevelILOperand::GetSSARegisterList() const { if (m_type != SSARegisterListLowLevelOperand) throw LowLevelILInstructionAccessException(); if (m_usage == OutputSSARegistersLowLevelOperandUsage) return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsSSARegisterList(1); - if (m_usage == ParameterSSARegistersLowLevelOperandUsage) - return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsSSARegisterList(0); return m_instr.GetRawOperandAsSSARegisterList(m_operandIndex); } @@ -892,6 +959,14 @@ LowLevelILSSAFlagList LowLevelILOperand::GetSSAFlagList() const } +map LowLevelILOperand::GetRegisterStackAdjustments() const +{ + if (m_type != RegisterStackAdjustmentsLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegisterStackAdjustments(m_operandIndex); +} + + const LowLevelILOperand LowLevelILOperandList::ListIterator::operator*() { LowLevelILOperandUsage usage = *pos; @@ -1073,6 +1148,13 @@ LowLevelILIndexList LowLevelILInstructionBase::GetRawOperandAsIndexList(size_t o } +LowLevelILInstructionList LowLevelILInstructionBase::GetRawOperandAsExprList(size_t operand) const +{ + return LowLevelILInstructionList(function, function->GetRawExpr(operands[operand + 1]), operands[operand], + instructionIndex); +} + + LowLevelILSSARegisterList LowLevelILInstructionBase::GetRawOperandAsSSARegisterList(size_t operand) const { return LowLevelILSSARegisterList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); @@ -1091,6 +1173,24 @@ LowLevelILSSAFlagList LowLevelILInstructionBase::GetRawOperandAsSSAFlagList(size } +map LowLevelILInstructionBase::GetRawOperandAsRegisterStackAdjustments(size_t operand) const +{ + LowLevelILIntegerList list(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); + map result; + for (auto i = list.begin(); i != list.end(); ) + { + uint32_t regStack = (uint32_t)*i; + ++i; + if (i == list.end()) + break; + int32_t adjust = (int32_t)*i; + ++i; + result[regStack] = adjust; + } + return result; +} + + void LowLevelILInstructionBase::UpdateRawOperand(size_t operandIndex, ExprId value) { operands[operandIndex] = value; @@ -1385,6 +1485,12 @@ void LowLevelILInstruction::VisitExprs(const std::function().VisitExprs(func); + for (auto& i : GetParameterExprs()) + i.VisitExprs(func); + break; + case LLIL_SYSCALL_SSA: + for (auto& i : GetParameterExprs()) + i.VisitExprs(func); break; case LLIL_RET: GetDestExpr().VisitExprs(func); @@ -1478,6 +1584,7 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, const std::function& subExprHandler) const { vector labelList; + vector params; BNLowLevelILLabel* labelA; BNLowLevelILLabel* labelB; switch (operation) @@ -1576,7 +1683,7 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, return dest->Call(subExprHandler(GetDestExpr()), *this); case LLIL_CALL_STACK_ADJUST: return dest->CallStackAdjust(subExprHandler(GetDestExpr()), - GetStackAdjustment(), *this); + GetStackAdjustment(), GetRegisterStackAdjustments(), *this); case LLIL_RET: return dest->Return(subExprHandler(GetDestExpr()), *this); case LLIL_JUMP_TO: @@ -1607,13 +1714,17 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_TRAP: return dest->Trap(GetVector(), *this); case LLIL_CALL_SSA: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); return dest->CallSSA(GetOutputSSARegisters(), subExprHandler(GetDestExpr()), - GetParameterSSARegisters(), GetStackSSARegister(), - GetDestMemoryVersion(), GetSourceMemoryVersion(), *this); + params, GetStackSSARegister(), GetDestMemoryVersion(), + GetSourceMemoryVersion(), *this); case LLIL_SYSCALL_SSA: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); return dest->SystemCallSSA(GetOutputSSARegisters(), - GetParameterSSARegisters(), GetStackSSARegister(), - GetDestMemoryVersion(), GetSourceMemoryVersion(), *this); + params, GetStackSSARegister(), GetDestMemoryVersion(), + GetSourceMemoryVersion(), *this); case LLIL_REG_PHI: return dest->RegisterPhi(GetDestSSARegister(), GetSourceSSARegisters(), *this); case LLIL_REG_STACK_PHI: @@ -2055,11 +2166,11 @@ LowLevelILSSARegisterList LowLevelILInstruction::GetOutputSSARegisters() const } -LowLevelILSSARegisterList LowLevelILInstruction::GetParameterSSARegisters() const +LowLevelILInstructionList LowLevelILInstruction::GetParameterExprs() const { size_t operandIndex; - if (GetOperandIndexForUsage(ParameterSSARegistersLowLevelOperandUsage, operandIndex)) - return GetRawOperandAsExpr(operandIndex).GetRawOperandAsSSARegisterList(0); + if (GetOperandIndexForUsage(ParameterExprsLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsExpr(operandIndex).GetRawOperandAsExprList(0); throw LowLevelILInstructionAccessException(); } @@ -2109,6 +2220,15 @@ LowLevelILIndexList LowLevelILInstruction::GetTargetList() const } +map LowLevelILInstruction::GetRegisterStackAdjustments() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(RegisterStackAdjustmentsLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegisterStackAdjustments(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + ExprId LowLevelILFunction::Nop(const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_NOP, loc, 0, 0); @@ -2578,13 +2698,21 @@ ExprId LowLevelILFunction::Call(ExprId dest, const ILSourceLocation& loc) } -ExprId LowLevelILFunction::CallStackAdjust(ExprId dest, size_t adjust, const ILSourceLocation& loc) +ExprId LowLevelILFunction::CallStackAdjust(ExprId dest, size_t adjust, + const std::map& regStackAdjust, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_CALL_STACK_ADJUST, loc, 0, 0, dest, adjust); + vector list; + for (auto& i : regStackAdjust) + { + list.push_back(i.first); + list.push_back(i.second); + } + return AddExprWithLocation(LLIL_CALL_STACK_ADJUST, loc, 0, 0, dest, adjust, list.size(), + AddIndexList(list)); } -ExprId LowLevelILFunction::CallSSA(const vector& output, ExprId dest, const vector& params, +ExprId LowLevelILFunction::CallSSA(const vector& output, ExprId dest, const vector& params, const SSARegister& stack, size_t newMemoryVer, size_t prevMemoryVer, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_CALL_SSA, loc, 0, 0, @@ -2592,11 +2720,11 @@ ExprId LowLevelILFunction::CallSSA(const vector& output, ExprId des output.size() * 2, AddSSARegisterList(output)), dest, AddExprWithLocation(LLIL_CALL_STACK_SSA, loc, 0, 0, stack.reg, stack.version, prevMemoryVer), AddExprWithLocation(LLIL_CALL_PARAM_SSA, loc, 0, 0, - params.size() * 2, AddSSARegisterList(params))); + params.size(), AddOperandList(params))); } -ExprId LowLevelILFunction::SystemCallSSA(const vector& output, const vector& params, +ExprId LowLevelILFunction::SystemCallSSA(const vector& output, const vector& params, const SSARegister& stack, size_t newMemoryVer, size_t prevMemoryVer, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_SYSCALL_SSA, loc, 0, 0, @@ -2604,7 +2732,7 @@ ExprId LowLevelILFunction::SystemCallSSA(const vector& output, cons output.size() * 2, AddSSARegisterList(output)), AddExprWithLocation(LLIL_CALL_STACK_SSA, loc, 0, 0, stack.reg, stack.version, prevMemoryVer), AddExprWithLocation(LLIL_CALL_PARAM_SSA, loc, 0, 0, - params.size() * 2, AddSSARegisterList(params))); + params.size(), AddOperandList(params))); } diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index 4e02632e..cfc7e2d7 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -112,9 +112,11 @@ namespace BinaryNinja SSARegisterStackLowLevelOperand, SSAFlagLowLevelOperand, IndexListLowLevelOperand, + ExprListLowLevelOperand, SSARegisterListLowLevelOperand, SSARegisterStackListLowLevelOperand, - SSAFlagListLowLevelOperand + SSAFlagListLowLevelOperand, + RegisterStackAdjustmentsLowLevelOperand }; enum LowLevelILOperandUsage @@ -158,12 +160,13 @@ namespace BinaryNinja FlagConditionLowLevelOperandUsage, OutputSSARegistersLowLevelOperandUsage, OutputMemoryVersionLowLevelOperandUsage, - ParameterSSARegistersLowLevelOperandUsage, + ParameterExprsLowLevelOperandUsage, SourceSSARegistersLowLevelOperandUsage, SourceSSARegisterStacksLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage, SourceMemoryVersionsLowLevelOperandUsage, - TargetListLowLevelOperandUsage + TargetListLowLevelOperandUsage, + RegisterStackAdjustmentsLowLevelOperandUsage }; } @@ -328,6 +331,36 @@ namespace BinaryNinja operator std::vector() const; }; + class LowLevelILInstructionList + { + struct ListIterator + { + LowLevelILIntegerList::const_iterator pos; + size_t instructionIndex; + bool operator==(const ListIterator& a) const { return pos == a.pos; } + bool operator!=(const ListIterator& a) const { return pos != a.pos; } + bool operator<(const ListIterator& a) const { return pos < a.pos; } + ListIterator& operator++() { ++pos; return *this; } + const LowLevelILInstruction operator*(); + }; + + LowLevelILIntegerList m_list; + size_t m_instructionIndex; + + public: + typedef ListIterator const_iterator; + + LowLevelILInstructionList(LowLevelILFunction* func, const BNLowLevelILInstruction& instr, + size_t count, size_t instrIndex); + + const_iterator begin() const; + const_iterator end() const; + size_t size() const; + const LowLevelILInstruction operator[](size_t i) const; + + operator std::vector() const; + }; + class LowLevelILSSARegisterList { struct ListIterator @@ -436,9 +469,11 @@ namespace BinaryNinja SSARegisterStack GetRawOperandAsPartialSSARegisterStackSource(size_t operand) const; SSAFlag GetRawOperandAsSSAFlag(size_t operand) const; LowLevelILIndexList GetRawOperandAsIndexList(size_t operand) const; + LowLevelILInstructionList GetRawOperandAsExprList(size_t operand) const; LowLevelILSSARegisterList GetRawOperandAsSSARegisterList(size_t operand) const; LowLevelILSSARegisterStackList GetRawOperandAsSSARegisterStackList(size_t operand) const; LowLevelILSSAFlagList GetRawOperandAsSSAFlagList(size_t operand) const; + std::map GetRawOperandAsRegisterStackAdjustments(size_t operand) const; void UpdateRawOperand(size_t operandIndex, ExprId value); void UpdateRawOperandAsSSARegisterList(size_t operandIndex, const std::vector& regs); @@ -574,12 +609,13 @@ namespace BinaryNinja template size_t GetDestMemoryVersion() const { return As().GetDestMemoryVersion(); } template BNLowLevelILFlagCondition GetFlagCondition() const { return As().GetFlagCondition(); } template LowLevelILSSARegisterList GetOutputSSARegisters() const { return As().GetOutputSSARegisters(); } - template LowLevelILSSARegisterList GetParameterSSARegisters() const { return As().GetParameterSSARegisters(); } + template LowLevelILInstructionList GetParameterExprs() const { return As().GetParameterExprs(); } template LowLevelILSSARegisterList GetSourceSSARegisters() const { return As().GetSourceSSARegisters(); } template LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const { return As().GetSourceSSARegisterStacks(); } template LowLevelILSSAFlagList GetSourceSSAFlags() const { return As().GetSourceSSAFlags(); } template LowLevelILIndexList GetSourceMemoryVersions() const { return As().GetSourceMemoryVersions(); } template LowLevelILIndexList GetTargetList() const { return As().GetTargetList(); } + template std::map GetRegisterStackAdjustments() const { return As().GetRegisterStackAdjustments(); } template void SetDestSSAVersion(size_t version) { As().SetDestSSAVersion(version); } template void SetSourceSSAVersion(size_t version) { As().SetSourceSSAVersion(version); } @@ -590,7 +626,6 @@ namespace BinaryNinja template void SetDestMemoryVersion(size_t version) { As().SetDestMemoryVersion(version); } template void SetSourceMemoryVersion(size_t version) { As().SetSourceMemoryVersion(version); } template void SetOutputSSARegisters(const std::vector& regs) { As().SetOutputSSARegisters(regs); } - template void SetParameterSSARegisters(const std::vector& regs) { As().SetParameterSSARegisters(regs); } bool GetOperandIndexForUsage(LowLevelILOperandUsage usage, size_t& operandIndex) const; @@ -632,12 +667,13 @@ namespace BinaryNinja size_t GetDestMemoryVersion() const; BNLowLevelILFlagCondition GetFlagCondition() const; LowLevelILSSARegisterList GetOutputSSARegisters() const; - LowLevelILSSARegisterList GetParameterSSARegisters() const; + LowLevelILInstructionList GetParameterExprs() const; LowLevelILSSARegisterList GetSourceSSARegisters() const; LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const; LowLevelILSSAFlagList GetSourceSSAFlags() const; LowLevelILIndexList GetSourceMemoryVersions() const; LowLevelILIndexList GetTargetList() const; + std::map GetRegisterStackAdjustments() const; }; class LowLevelILOperand @@ -665,9 +701,11 @@ namespace BinaryNinja SSARegisterStack GetSSARegisterStack() const; SSAFlag GetSSAFlag() const; LowLevelILIndexList GetIndexList() const; + LowLevelILInstructionList GetExprList() const; LowLevelILSSARegisterList GetSSARegisterList() const; LowLevelILSSARegisterStackList GetSSARegisterStackList() const; LowLevelILSSAFlagList GetSSAFlagList() const; + std::map GetRegisterStackAdjustments() const; }; class LowLevelILOperandList @@ -915,6 +953,7 @@ namespace BinaryNinja { LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(0); } size_t GetStackAdjustment() const { return (size_t)GetRawOperandAsInteger(1); } + std::map GetRegisterStackAdjustments() const { return GetRawOperandAsRegisterStackAdjustments(2); } }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { @@ -949,12 +988,11 @@ namespace BinaryNinja LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); } SSARegister GetStackSSARegister() const { return GetRawOperandAsExpr(2).GetRawOperandAsSSARegister(0); } size_t GetSourceMemoryVersion() const { return GetRawOperandAsExpr(2).GetRawOperandAsIndex(2); } - LowLevelILSSARegisterList GetParameterSSARegisters() const { return GetRawOperandAsExpr(3).GetRawOperandAsSSARegisterList(0); } + LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExpr(3).GetRawOperandAsExprList(0); } void SetDestMemoryVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(0, version); } void SetSourceMemoryVersion(size_t version) { GetRawOperandAsExpr(2).UpdateRawOperand(2, version); } void SetStackSSAVersion(size_t version) { GetRawOperandAsExpr(2).UpdateRawOperand(1, version); } void SetOutputSSARegisters(const std::vector& regs) { GetRawOperandAsExpr(0).UpdateRawOperandAsSSARegisterList(1, regs); } - void SetParameterSSARegisters(const std::vector& regs) { GetRawOperandAsExpr(3).UpdateRawOperandAsSSARegisterList(0, regs); } }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { @@ -962,12 +1000,11 @@ namespace BinaryNinja size_t GetDestMemoryVersion() const { return GetRawOperandAsExpr(0).GetRawOperandAsIndex(0); } SSARegister GetStackSSARegister() const { return GetRawOperandAsExpr(1).GetRawOperandAsSSARegister(0); } size_t GetSourceMemoryVersion() const { return GetRawOperandAsExpr(1).GetRawOperandAsIndex(2); } - LowLevelILSSARegisterList GetParameterSSARegisters() const { return GetRawOperandAsExpr(2).GetRawOperandAsSSARegisterList(0); } + LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExpr(2).GetRawOperandAsExprList(0); } void SetDestMemoryVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(0, version); } void SetSourceMemoryVersion(size_t version) { GetRawOperandAsExpr(1).UpdateRawOperand(2, version); } void SetStackSSAVersion(size_t version) { GetRawOperandAsExpr(1).UpdateRawOperand(1, version); } void SetOutputSSARegisters(const std::vector& regs) { GetRawOperandAsExpr(0).UpdateRawOperandAsSSARegisterList(1, regs); } - void SetParameterSSARegisters(const std::vector& regs) { GetRawOperandAsExpr(2).UpdateRawOperandAsSSARegisterList(0, regs); } }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase diff --git a/python/architecture.py b/python/architecture.py index 04179e7f..c4179b00 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -231,7 +231,7 @@ class Architecture(object): for j in xrange(0, info.topRelativeCount): top_rel.append(core.BNGetArchitectureRegisterName(self.handle, info.firstTopRelativeReg + j)) top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) - self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top) + self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top, regs[i]) core.BNFreeRegisterList(regs) else: startup._init_plugins() diff --git a/python/callingconvention.py b/python/callingconvention.py index 18662fc5..5aad3317 100644 --- a/python/callingconvention.py +++ b/python/callingconvention.py @@ -28,6 +28,7 @@ import log import types import function import binaryview +from enums import VariableSourceType class CallingConvention(object): @@ -68,6 +69,8 @@ class CallingConvention(object): self._cb.getImplicitlyDefinedRegisters = self._cb.getImplicitlyDefinedRegisters.__class__(self._get_implicitly_defined_regs) self._cb.getIncomingRegisterValue = self._cb.getIncomingRegisterValue.__class__(self._get_incoming_reg_value) self._cb.getIncomingFlagValue = self._cb.getIncomingFlagValue.__class__(self._get_incoming_flag_value) + self._cb.getIncomingVariableForParameterVariable = self._cb.getIncomingVariableForParameterVariable.__class__(self._get_incoming_var_for_parameter_var) + self._cb.getParameterVariableForIncomingVariable = self._cb.getParameterVariableForIncomingVariable.__class__(self._get_parameter_var_for_incoming_var) self.handle = core.BNCreateCallingConvention(arch.handle, name, self._cb) self.__class__._registered_calling_conventions.append(self) else: @@ -301,6 +304,42 @@ class CallingConvention(object): result[0].state = api_obj.state result[0].value = api_obj.value + def _get_incoming_var_for_parameter_var(self, ctxt, in_var, func, result): + try: + if func is None: + func_obj = None + else: + func_obj = function.Function(binaryview.BinaryView(handle = core.BNGetFunctionData(func)), + core.BNNewFunctionReference(func)) + in_var_obj = function.Variable(func_obj, in_var[0].type, in_var[0].index, in_var[0].storage) + out_var = self.perform_get_incoming_var_for_parameter_var(in_var_obj, func_obj) + result[0].type = out_var.source_type + result[0].index = out_var.index + result[0].storage = out_var.storage + except: + log.log_error(traceback.format_exc()) + result[0].type = in_var[0].type + result[0].index = in_var[0].index + result[0].storage = in_var[0].storage + + def _get_parameter_var_for_incoming_var(self, ctxt, in_var, func, result): + try: + if func is None: + func_obj = None + else: + func_obj = function.Function(binaryview.BinaryView(handle = core.BNGetFunctionData(func)), + core.BNNewFunctionReference(func)) + in_var_obj = function.Variable(func_obj, in_var[0].type, in_var[0].index, in_var[0].storage) + out_var = self.perform_get_parameter_var_for_incoming_var(in_var_obj, func_obj) + result[0].type = out_var.source_type + result[0].index = out_var.index + result[0].storage = out_var.storage + except: + log.log_error(traceback.format_exc()) + result[0].type = in_var[0].type + result[0].index = in_var[0].index + result[0].storage = in_var[0].storage + def __repr__(self): return "" % (self.arch.name, self.name) @@ -317,6 +356,25 @@ class CallingConvention(object): def perform_get_incoming_flag_value(self, reg, func): return function.RegisterValue() + def perform_get_incoming_var_for_parameter_var(self, in_var, func): + in_buf = core.BNVariable() + in_buf.type = in_var.source_type + in_buf.index = in_var.index + in_buf.storage = in_var.storage + out_var = core.BNGetDefaultIncomingVariableForParameterVariable(self.handle, in_buf) + name = None + if (func is not None) and (out_var.type == VariableSourceType.RegisterVariableSourceType): + name = func.arch.get_reg_name(out_var.storage) + return function.Variable(func, out_var.type, out_var.index, out_var.storage, name) + + def perform_get_parameter_var_for_incoming_var(self, in_var, func): + in_buf = core.BNVariable() + in_buf.type = in_var.source_type + in_buf.index = in_var.index + in_buf.storage = in_var.storage + out_var = core.BNGetDefaultParameterVariableForIncomingVariable(self.handle, in_buf) + return function.Variable(func, out_var.type, out_var.index, out_var.storage) + def with_confidence(self, confidence): return CallingConvention(self.arch, handle = core.BNNewCallingConventionReference(self.handle), confidence = confidence) @@ -334,3 +392,30 @@ class CallingConvention(object): if func is not None: func_handle = func.handle return function.RegisterValue(self.arch, core.BNGetIncomingFlagValue(self.handle, reg_num, func_handle)) + + def get_incoming_var_for_parameter_var(self, in_var, func): + in_buf = core.BNVariable() + in_buf.type = in_var.source_type + in_buf.index = in_var.index + in_buf.storage = in_var.storage + if func is None: + func_obj = None + else: + func_obj = func.handle + out_var = core.BNGetIncomingVariableForParameterVariable(self.handle, in_buf, func_obj) + name = None + if (func is not None) and (out_var.type == VariableSourceType.RegisterVariableSourceType): + name = func.arch.get_reg_name(out_var.storage) + return function.Variable(func, out_var.type, out_var.index, out_var.storage, name) + + def get_parameter_var_for_incoming_var(self, in_var, func): + in_buf = core.BNVariable() + in_buf.type = in_var.source_type + in_buf.index = in_var.index + in_buf.storage = in_var.storage + if func is None: + func_obj = None + else: + func_obj = func.handle + out_var = core.BNGetParameterVariableForIncomingVariable(self.handle, in_buf, func_obj) + return function.Variable(func, out_var.type, out_var.index, out_var.storage) diff --git a/python/function.py b/python/function.py index ba00147e..eabf86b3 100644 --- a/python/function.py +++ b/python/function.py @@ -263,14 +263,15 @@ class Variable(object): var.storage = storage self.identifier = core.BNToVariableIdentifier(var) - if name is None: - name = core.BNGetVariableName(func.handle, var) - if var_type is None: - var_type_conf = core.BNGetVariableType(func.handle, var) - if var_type_conf.type: - var_type = types.Type(var_type_conf.type, platform = func.platform, confidence = var_type_conf.confidence) - else: - var_type = None + if func is not None: + if name is None: + name = core.BNGetVariableName(func.handle, var) + if var_type is None: + var_type_conf = core.BNGetVariableType(func.handle, var) + if var_type_conf.type: + var_type = types.Type(var_type_conf.type, platform = func.platform, confidence = var_type_conf.confidence) + else: + var_type = None self.name = name self.type = var_type @@ -519,7 +520,7 @@ class Function(object): result.append(Variable(self, v[i].var.type, v[i].var.index, v[i].var.storage, v[i].name, types.Type(handle = core.BNNewTypeReference(v[i].type), platform = self.platform, confidence = v[i].typeConfidence))) result.sort(key = lambda x: x.identifier) - core.BNFreeVariableList(v, count.value) + core.BNFreeVariableNameAndTypeList(v, count.value) return result @property @@ -532,7 +533,7 @@ class Function(object): result.append(Variable(self, v[i].var.type, v[i].var.index, v[i].var.storage, v[i].name, types.Type(handle = core.BNNewTypeReference(v[i].type), platform = self.platform, confidence = v[i].typeConfidence))) result.sort(key = lambda x: x.identifier) - core.BNFreeVariableList(v, count.value) + core.BNFreeVariableNameAndTypeList(v, count.value) return result @property @@ -674,6 +675,35 @@ class Function(object): sc.confidence = types.max_confidence core.BNSetUserFunctionStackAdjustment(self.handle, sc) + @property + def reg_stack_adjustments(self): + """Number of entries removed from each register stack after return""" + count = ctypes.c_ulonglong() + adjust = core.BNGetFunctionRegisterStackAdjustments(self.handle, count) + result = {} + for i in xrange(0, count.value): + name = self.arch.get_reg_stack_name(adjust[i].regStack) + value = types.RegisterStackAdjustmentWithConfidence(adjust[i].adjustment, + confidence = adjust[i].confidence) + result[name] = value + core.BNFreeRegisterStackAdjustments(adjust) + return result + + @reg_stack_adjustments.setter + def reg_stack_adjustments(self, value): + adjust = (core.BNRegisterStackAdjustment * len(value))() + i = 0 + for reg_stack in value.keys(): + adjust[i].regStack = self.arch.get_reg_stack_index(reg_stack) + if isinstance(value[reg_stack], types.RegisterStackAdjustmentWithConfidence): + adjust[i].adjustment = value[reg_stack].value + adjust[i].confidence = value[reg_stack].confidence + else: + adjust[i].adjustment = value[reg_stack] + adjust[i].confidence = types.max_confidence + i += 1 + core.BNSetUserFunctionRegisterStackAdjustments(self.handle, adjust, len(value)) + @property def clobbered_regs(self): """Registers that are modified by this function""" @@ -1099,6 +1129,20 @@ class Function(object): sc.confidence = types.max_confidence core.BNSetAutoFunctionStackAdjustment(self.handle, sc) + def set_auto_reg_stack_adjustments(self, value): + adjust = (core.BNRegisterStackAdjustment * len(value))() + i = 0 + for reg_stack in value.keys(): + adjust[i].regStack = self.arch.get_reg_stack_index(reg_stack) + if isinstance(value[reg_stack], types.RegisterStackAdjustmentWithConfidence): + adjust[i].adjustment = value[reg_stack].value + adjust[i].confidence = value[reg_stack].confidence + else: + adjust[i].adjustment = value[reg_stack] + adjust[i].confidence = types.max_confidence + i += 1 + core.BNSetAutoFunctionRegisterStackAdjustments(self.handle, adjust, len(value)) + def set_auto_clobbered_regs(self, value): regs = core.BNRegisterSetWithConfidence() regs.regs = (ctypes.c_uint * len(value))() @@ -1727,10 +1771,11 @@ class RegisterInfo(object): class RegisterStackInfo(object): - def __init__(self, storage_regs, top_relative_regs, stack_top_reg): + def __init__(self, storage_regs, top_relative_regs, stack_top_reg, index=None): self.storage_regs = storage_regs self.top_relative_regs = top_relative_regs self.stack_top_reg = stack_top_reg + self.index = index def __repr__(self): return "" % (len(self.storage_regs), self.stack_top_reg) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index f5a39b7e..3810e742 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -197,7 +197,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_JUMP: [("dest", "expr")], LowLevelILOperation.LLIL_JUMP_TO: [("dest", "expr"), ("targets", "int_list")], LowLevelILOperation.LLIL_CALL: [("dest", "expr")], - LowLevelILOperation.LLIL_CALL_STACK_ADJUST: [("dest", "expr"), ("stack_adjustment", "int")], + LowLevelILOperation.LLIL_CALL_STACK_ADJUST: [("dest", "expr"), ("stack_adjustment", "int"), ("reg_stack_adjustments", "reg_stack_adjust")], LowLevelILOperation.LLIL_RET: [("dest", "expr")], LowLevelILOperation.LLIL_NORET: [], LowLevelILOperation.LLIL_IF: [("condition", "expr"), ("true", "int"), ("false", "int")], @@ -258,7 +258,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_SYSCALL_SSA: [("output", "expr"), ("stack", "expr"), ("param", "expr")], LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "reg_ssa_list")], LowLevelILOperation.LLIL_CALL_STACK_SSA: [("src", "reg_ssa"), ("src_memory", "int")], - LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("src", "reg_ssa_list")], + LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("src", "expr_list")], LowLevelILOperation.LLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], LowLevelILOperation.LLIL_REG_PHI: [("dest", "reg_ssa"), ("src", "reg_ssa_list")], @@ -334,6 +334,14 @@ class LowLevelILInstruction(object): for i in xrange(count.value): value.append(operand_list[i]) core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "expr_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = [] + for i in xrange(count.value): + value.append(LowLevelILInstruction(func, operand_list[i])) + core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "reg_ssa_list": count = ctypes.c_ulonglong() operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) @@ -364,6 +372,18 @@ class LowLevelILInstruction(object): flag_version = operand_list[(i * 2) + 1] value.append(SSAFlag(ILFlag(func.arch, flag), flag_version)) core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "reg_stack_adjust": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = {} + for i in xrange(count.value / 2): + reg_stack = operand_list[i * 2] + adjust = operand_list[(i * 2) + 1] + if adjust & 0x80000000: + adjust |= ~0x80000000 + value[func.arch.get_reg_stack_name(reg_stack)] = adjust + core.BNLowLevelILFreeOperandList(operand_list) self.operands.append(value) self.__dict__[name] = value i += 1 diff --git a/python/types.py b/python/types.py index 2557db2c..d44cc736 100644 --- a/python/types.py +++ b/python/types.py @@ -680,6 +680,21 @@ class SizeWithConfidence(object): return self.value +class RegisterStackAdjustmentWithConfidence(object): + def __init__(self, value, confidence = max_confidence): + self.value = value + self.confidence = confidence + + def __str__(self): + return str(self.value) + + def __repr__(self): + return repr(self.value) + + def __int__(self): + return self.value + + class RegisterSet(object): def __init__(self, reg_list, confidence = max_confidence): self.regs = reg_list -- cgit v1.3.1 From 06b97009b2a09dc7816f6ace2d6a4bff66cb3f26 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 26 Dec 2017 17:10:07 -0500 Subject: Adding return value registers to function type --- binaryninjaapi.h | 3 +++ binaryninjacore.h | 5 ++++- function.cpp | 40 +++++++++++++++++++++++++++++++++++++++- python/function.py | 38 +++++++++++++++++++++++++++++++++++++- 4 files changed, 83 insertions(+), 3 deletions(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index af067ae9..d4624ca5 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2204,6 +2204,7 @@ namespace BinaryNinja Ref GetType() const; Confidence> GetReturnType() const; + Confidence> GetReturnRegisters() const; Confidence> GetCallingConvention() const; Confidence> GetParameterVariables() const; Confidence HasVariableArguments() const; @@ -2213,6 +2214,7 @@ namespace BinaryNinja void SetAutoType(Type* type); void SetAutoReturnType(const Confidence>& type); + void SetAutoReturnRegisters(const Confidence>& returnRegs); void SetAutoCallingConvention(const Confidence>& convention); void SetAutoParameterVariables(const Confidence>& vars); void SetAutoHasVariableArguments(const Confidence& varArgs); @@ -2223,6 +2225,7 @@ namespace BinaryNinja void SetUserType(Type* type); void SetReturnType(const Confidence>& type); + void SetReturnRegisters(const Confidence>& returnRegs); void SetCallingConvention(const Confidence>& convention); void SetParameterVariables(const Confidence>& vars); void SetHasVariableArguments(const Confidence& varArgs); diff --git a/binaryninjacore.h b/binaryninjacore.h index 278299bc..7f107c60 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2180,6 +2180,7 @@ extern "C" BINARYNINJACOREAPI BNType* BNGetFunctionType(BNFunction* func); BINARYNINJACOREAPI BNTypeWithConfidence BNGetFunctionReturnType(BNFunction* func); + BINARYNINJACOREAPI BNRegisterSetWithConfidence BNGetFunctionReturnRegisters(BNFunction* func); BINARYNINJACOREAPI BNCallingConventionWithConfidence BNGetFunctionCallingConvention(BNFunction* func); BINARYNINJACOREAPI BNParameterVariablesWithConfidence BNGetFunctionParameterVariables(BNFunction* func); BINARYNINJACOREAPI void BNFreeParameterVariables(BNParameterVariablesWithConfidence* vars); @@ -2188,9 +2189,10 @@ extern "C" BINARYNINJACOREAPI BNRegisterStackAdjustment* BNGetFunctionRegisterStackAdjustments(BNFunction* func, size_t* count); BINARYNINJACOREAPI void BNFreeRegisterStackAdjustments(BNRegisterStackAdjustment* adjustments); BINARYNINJACOREAPI BNRegisterSetWithConfidence BNGetFunctionClobberedRegisters(BNFunction* func); - BINARYNINJACOREAPI void BNFreeClobberedRegisters(BNRegisterSetWithConfidence* regs); + BINARYNINJACOREAPI void BNFreeRegisterSet(BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNSetAutoFunctionReturnType(BNFunction* func, BNTypeWithConfidence* type); + BINARYNINJACOREAPI void BNSetAutoFunctionReturnRegisters(BNFunction* func, BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNSetAutoFunctionCallingConvention(BNFunction* func, BNCallingConventionWithConfidence* convention); BINARYNINJACOREAPI void BNSetAutoFunctionParameterVariables(BNFunction* func, BNParameterVariablesWithConfidence* vars); BINARYNINJACOREAPI void BNSetAutoFunctionHasVariableArguments(BNFunction* func, BNBoolWithConfidence* varArgs); @@ -2201,6 +2203,7 @@ extern "C" BINARYNINJACOREAPI void BNSetAutoFunctionClobberedRegisters(BNFunction* func, BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNSetUserFunctionReturnType(BNFunction* func, BNTypeWithConfidence* type); + BINARYNINJACOREAPI void BNSetUserFunctionReturnRegisters(BNFunction* func, BNRegisterSetWithConfidence* regs); BINARYNINJACOREAPI void BNSetUserFunctionCallingConvention(BNFunction* func, BNCallingConventionWithConfidence* convention); BINARYNINJACOREAPI void BNSetUserFunctionParameterVariables(BNFunction* func, BNParameterVariablesWithConfidence* vars); BINARYNINJACOREAPI void BNSetUserFunctionHasVariableArguments(BNFunction* func, BNBoolWithConfidence* varArgs); diff --git a/function.cpp b/function.cpp index 879c7156..ba2b419e 100644 --- a/function.cpp +++ b/function.cpp @@ -490,6 +490,18 @@ Confidence> Function::GetReturnType() const } +Confidence> Function::GetReturnRegisters() const +{ + BNRegisterSetWithConfidence regs = BNGetFunctionReturnRegisters(m_object); + vector regList; + for (size_t i = 0; i < regs.count; i++) + regList.push_back(regs.regs[i]); + Confidence> result(regList, regs.confidence); + BNFreeRegisterSet(®s); + return result; +} + + Confidence> Function::GetCallingConvention() const { BNCallingConventionWithConfidence cc = BNGetFunctionCallingConvention(m_object); @@ -549,7 +561,7 @@ Confidence> Function::GetClobberedRegisters() const for (size_t i = 0; i < regs.count; i++) regSet.insert(regs.regs[i]); Confidence> result(regSet, regs.confidence); - BNFreeClobberedRegisters(®s); + BNFreeRegisterSet(®s); return result; } @@ -569,6 +581,19 @@ void Function::SetAutoReturnType(const Confidence>& type) } +void Function::SetAutoReturnRegisters(const Confidence>& returnRegs) +{ + BNRegisterSetWithConfidence regs; + regs.regs = new uint32_t[returnRegs.GetValue().size()]; + regs.count = returnRegs.GetValue().size(); + for (size_t i = 0; i < regs.count; i++) + regs.regs[i] = returnRegs.GetValue()[i]; + regs.confidence = returnRegs.GetConfidence(); + BNSetAutoFunctionReturnRegisters(m_object, ®s); + delete[] regs.regs; +} + + void Function::SetAutoCallingConvention(const Confidence>& convention) { BNCallingConventionWithConfidence cc; @@ -668,6 +693,19 @@ void Function::SetReturnType(const Confidence>& type) } +void Function::SetReturnRegisters(const Confidence>& returnRegs) +{ + BNRegisterSetWithConfidence regs; + regs.regs = new uint32_t[returnRegs.GetValue().size()]; + regs.count = returnRegs.GetValue().size(); + for (size_t i = 0; i < regs.count; i++) + regs.regs[i] = returnRegs.GetValue()[i]; + regs.confidence = returnRegs.GetConfidence(); + BNSetUserFunctionReturnRegisters(m_object, ®s); + delete[] regs.regs; +} + + void Function::SetCallingConvention(const Confidence>& convention) { BNCallingConventionWithConfidence cc; diff --git a/python/function.py b/python/function.py index eabf86b3..db4ca0f5 100644 --- a/python/function.py +++ b/python/function.py @@ -592,6 +592,30 @@ class Function(object): type_conf.confidence = value.confidence core.BNSetUserFunctionReturnType(self.handle, type_conf) + @property + def return_regs(self): + """Registers that are used for the return value""" + result = core.BNGetFunctionReturnRegisters(self.handle) + reg_set = [] + for i in xrange(0, result.count): + reg_set.append(self.arch.get_reg_name(result.regs[i])) + regs = types.RegisterSet(reg_set, confidence = result.confidence) + core.BNFreeRegisterSet(result) + return regs + + @return_regs.setter + def return_regs(self, value): + regs = core.BNRegisterSetWithConfidence() + regs.regs = (ctypes.c_uint * len(value))() + regs.count = len(value) + for i in xrange(0, len(value)): + regs.regs[i] = self.arch.get_reg_index(value[i]) + if hasattr(value, 'confidence'): + regs.confidence = value.confidence + else: + regs.confidence = types.max_confidence + core.BNSetUserFunctionReturnRegisters(self.handle, regs) + @property def calling_convention(self): """Calling convention used by the function""" @@ -712,7 +736,7 @@ class Function(object): for i in xrange(0, result.count): reg_set.append(self.arch.get_reg_name(result.regs[i])) regs = types.RegisterSet(reg_set, confidence = result.confidence) - core.BNFreeClobberedRegisters(result) + core.BNFreeRegisterSet(result) return regs @clobbered_regs.setter @@ -1072,6 +1096,18 @@ class Function(object): type_conf.confidence = value.confidence core.BNSetAutoFunctionReturnType(self.handle, type_conf) + def set_auto_return_regs(self, value): + regs = core.BNRegisterSetWithConfidence() + regs.regs = (ctypes.c_uint * len(value))() + regs.count = len(value) + for i in xrange(0, len(value)): + regs.regs[i] = self.arch.get_reg_index(value[i]) + if hasattr(value, 'confidence'): + regs.confidence = value.confidence + else: + regs.confidence = types.max_confidence + core.BNSetAutoFunctionReturnRegisters(self.handle, regs) + def set_auto_calling_convention(self, value): conv_conf = core.BNCallingConventionWithConfidence() if value is None: -- cgit v1.3.1 From d8b25d611e29ade2aca70fc2a06ec8f93ae778f1 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 2 Jan 2018 15:03:39 -0500 Subject: Fix incorrect handling of syscall IL --- lowlevelilinstruction.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 8259426a..6b67ef72 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -1489,7 +1489,7 @@ void LowLevelILInstruction::VisitExprs(const std::function()) + for (auto& i : GetParameterExprs()) i.VisitExprs(func); break; case LLIL_RET: -- cgit v1.3.1 From 0cc77206c79257d49013c3a3ed1bf889c85b10d1 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Sun, 14 Jan 2018 03:42:04 -0500 Subject: Container Memory Reservations. --- architecture.cpp | 11 +++++++++++ backgroundtask.cpp | 1 + basicblock.cpp | 4 ++++ binaryview.cpp | 20 ++++++++++++++++++++ binaryviewtype.cpp | 2 ++ function.cpp | 11 +++++++++-- functiongraph.cpp | 2 ++ functiongraphblock.cpp | 3 +++ lowlevelil.cpp | 8 ++++---- lowlevelilinstruction.cpp | 7 ++++--- mediumlevelil.cpp | 9 +++++---- mediumlevelilinstruction.cpp | 6 +++--- metadata.cpp | 1 + platform.cpp | 6 ++++++ plugin.cpp | 1 + settings.cpp | 1 + transform.cpp | 2 ++ type.cpp | 12 ++++++------ update.cpp | 2 ++ 19 files changed, 87 insertions(+), 22 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 821f4c7b..7b74e43b 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -507,6 +507,7 @@ vector> Architecture::GetList() archs = BNGetArchitectureList(&count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreArchitecture(archs[i])); @@ -703,6 +704,7 @@ vector Architecture::GetModifiedRegistersOnWrite(uint32_t reg) uint32_t* regs = BNGetModifiedArchitectureRegistersOnWrite(m_object, reg, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); @@ -814,6 +816,7 @@ vector> Architecture::GetCallingConventions() BNCallingConvention** list = BNGetArchitectureCallingConventions(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreCallingConvention(BNNewCallingConventionReference(list[i]))); @@ -957,6 +960,7 @@ bool CoreArchitecture::GetInstructionText(const uint8_t* data, uint64_t addr, si if (!BNGetInstructionText(m_object, data, addr, &len, &tokens, &count)) return false; + result.reserve(count); for (size_t i = 0; i < count; i++) { result.emplace_back(tokens[i].type, tokens[i].context, tokens[i].text, tokens[i].address, @@ -1007,6 +1011,7 @@ vector CoreArchitecture::GetFullWidthRegisters() uint32_t* regs = BNGetFullWidthArchitectureRegisters(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); @@ -1021,6 +1026,7 @@ vector CoreArchitecture::GetAllRegisters() uint32_t* regs = BNGetAllArchitectureRegisters(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); @@ -1035,6 +1041,7 @@ vector CoreArchitecture::GetAllFlags() uint32_t* regs = BNGetAllArchitectureFlags(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); @@ -1049,6 +1056,7 @@ vector CoreArchitecture::GetAllFlagWriteTypes() uint32_t* regs = BNGetAllArchitectureFlagWriteTypes(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); @@ -1069,6 +1077,7 @@ vector CoreArchitecture::GetFlagsRequiredForFlagCondition(BNLowLevelIL uint32_t* flags = BNGetArchitectureFlagsRequiredForFlagCondition(m_object, cond, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(flags[i]); @@ -1083,6 +1092,7 @@ vector CoreArchitecture::GetFlagsWrittenByFlagWriteType(uint32_t write uint32_t* flags = BNGetArchitectureFlagsWrittenByFlagWriteType(m_object, writeType, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(flags[i]); @@ -1129,6 +1139,7 @@ vector CoreArchitecture::GetGlobalRegisters() uint32_t* regs = BNGetArchitectureGlobalRegisters(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(regs[i]); diff --git a/backgroundtask.cpp b/backgroundtask.cpp index aebf980c..b2d4a738 100644 --- a/backgroundtask.cpp +++ b/backgroundtask.cpp @@ -67,6 +67,7 @@ vector> BackgroundTask::GetRunningTasks() BNBackgroundTask** tasks = BNGetRunningBackgroundTasks(&count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BackgroundTask(BNNewBackgroundTaskReference(tasks[i]))); diff --git a/basicblock.cpp b/basicblock.cpp index 89ace134..d42a1038 100644 --- a/basicblock.cpp +++ b/basicblock.cpp @@ -120,6 +120,7 @@ vector BasicBlock::GetOutgoingEdges() const BNBasicBlockEdge* array = BNGetBasicBlockOutgoingEdges(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { BasicBlockEdge edge; @@ -140,6 +141,7 @@ vector BasicBlock::GetIncomingEdges() const BNBasicBlockEdge* array = BNGetBasicBlockIncomingEdges(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { BasicBlockEdge edge; @@ -269,10 +271,12 @@ vector BasicBlock::GetDisassemblyText(DisassemblySettings* BNDisassemblyTextLine* lines = BNGetBasicBlockDisassemblyText(m_object, settings->GetObject(), &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { DisassemblyTextLine line; line.addr = lines[i].addr; + line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { InstructionTextToken token; diff --git a/binaryview.cpp b/binaryview.cpp index 00cd294f..0ee428e1 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -670,6 +670,7 @@ vector BinaryView::GetModification(uint64_t offset, size_t len = BNGetModificationArray(m_object, offset, mod, len); vector result; + result.reserve(len); for (size_t i = 0; i < len; i++) result.push_back(mod[i]); @@ -988,6 +989,7 @@ vector> BinaryView::GetAnalysisFunctionList() BNFunction** list = BNGetAnalysisFunctionList(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Function(BNNewFunctionReference(list[i]))); @@ -1026,6 +1028,7 @@ vector> BinaryView::GetAnalysisFunctionsForAddress(uint64_t addr) BNFunction** list = BNGetAnalysisFunctionsForAddress(m_object, addr, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Function(BNNewFunctionReference(list[i]))); @@ -1058,6 +1061,7 @@ vector> BinaryView::GetBasicBlocksForAddress(uint64_t addr) BNBasicBlock** blocks = BNGetBasicBlocksForAddress(m_object, addr, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); @@ -1072,6 +1076,7 @@ vector> BinaryView::GetBasicBlocksStartingAtAddress(uint64_t add BNBasicBlock** blocks = BNGetBasicBlocksStartingAtAddress(m_object, addr, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); @@ -1086,6 +1091,7 @@ vector BinaryView::GetCodeReferences(uint64_t addr) BNReferenceSource* refs = BNGetCodeReferences(m_object, addr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { ReferenceSource src; @@ -1106,6 +1112,7 @@ vector BinaryView::GetCodeReferences(uint64_t addr, uint64_t le BNReferenceSource* refs = BNGetCodeReferencesInRange(m_object, addr, len, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { ReferenceSource src; @@ -1144,6 +1151,7 @@ vector> BinaryView::GetSymbolsByName(const string& name) BNSymbol** syms = BNGetSymbolsByName(m_object, name.c_str(), &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Symbol(BNNewSymbolReference(syms[i]))); @@ -1158,6 +1166,7 @@ vector> BinaryView::GetSymbols() BNSymbol** syms = BNGetSymbols(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Symbol(BNNewSymbolReference(syms[i]))); @@ -1172,6 +1181,7 @@ vector> BinaryView::GetSymbols(uint64_t start, uint64_t len) BNSymbol** syms = BNGetSymbolsInRange(m_object, start, len, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Symbol(BNNewSymbolReference(syms[i]))); @@ -1186,6 +1196,7 @@ vector> BinaryView::GetSymbolsOfType(BNSymbolType type) BNSymbol** syms = BNGetSymbolsOfType(m_object, type, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Symbol(BNNewSymbolReference(syms[i]))); @@ -1200,6 +1211,7 @@ vector> BinaryView::GetSymbolsOfType(BNSymbolType type, uint64_t sta BNSymbol** syms = BNGetSymbolsOfTypeInRange(m_object, type, start, len, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Symbol(BNNewSymbolReference(syms[i]))); @@ -1412,6 +1424,7 @@ vector BinaryView::GetPreviousLinearDisassemblyLines(Line settings ? settings->GetObject() : nullptr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { LinearDisassemblyLine line; @@ -1420,6 +1433,7 @@ vector BinaryView::GetPreviousLinearDisassemblyLines(Line line.block = lines[i].block ? new BasicBlock(BNNewBasicBlockReference(lines[i].block)) : nullptr; line.lineOffset = lines[i].lineOffset; line.contents.addr = lines[i].contents.addr; + line.contents.tokens.reserve(lines[i].contents.count); for (size_t j = 0; j < lines[i].contents.count; j++) { InstructionTextToken token; @@ -1458,6 +1472,7 @@ vector BinaryView::GetNextLinearDisassemblyLines(LinearDi settings ? settings->GetObject() : nullptr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { LinearDisassemblyLine line; @@ -1466,6 +1481,7 @@ vector BinaryView::GetNextLinearDisassemblyLines(LinearDi line.block = lines[i].block ? new BasicBlock(BNNewBasicBlockReference(lines[i].block)) : nullptr; line.lineOffset = lines[i].lineOffset; line.contents.addr = lines[i].contents.addr; + line.contents.tokens.reserve(lines[i].contents.count); for (size_t j = 0; j < lines[i].contents.count; j++) { InstructionTextToken token; @@ -1704,6 +1720,7 @@ vector BinaryView::GetSegments() BNSegment* segments = BNGetSegments(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { Segment segment; @@ -1777,6 +1794,7 @@ vector
BinaryView::GetSections() BNSection* sections = BNGetSections(m_object, &count); vector
result; + result.reserve(count); for (size_t i = 0; i < count; i++) { Section section; @@ -1804,6 +1822,7 @@ vector
BinaryView::GetSectionsAt(uint64_t addr) BNSection* sections = BNGetSectionsAt(m_object, addr, &count); vector
result; + result.reserve(count); for (size_t i = 0; i < count; i++) { Section section; @@ -1855,6 +1874,7 @@ vector BinaryView::GetUniqueSectionNames(const vector& names) char** outgoingNames = BNGetUniqueSectionNames(m_object, incomingNames, names.size()); vector result; + result.reserve(names.size()); for (size_t i = 0; i < names.size(); i++) result.push_back(outgoingNames[i]); diff --git a/binaryviewtype.cpp b/binaryviewtype.cpp index e23838f6..e8ef4f53 100644 --- a/binaryviewtype.cpp +++ b/binaryviewtype.cpp @@ -83,6 +83,7 @@ vector> BinaryViewType::GetViewTypes() types = BNGetBinaryViewTypes(&count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreBinaryViewType(types[i])); @@ -98,6 +99,7 @@ vector> BinaryViewType::GetViewTypesForData(BinaryView* data types = BNGetBinaryViewTypesForData(data->GetObject(), &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreBinaryViewType(types[i])); diff --git a/function.cpp b/function.cpp index 1226e399..cb4377b2 100644 --- a/function.cpp +++ b/function.cpp @@ -174,6 +174,7 @@ vector> Function::GetBasicBlocks() const BNBasicBlock** blocks = BNGetFunctionBasicBlockList(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); @@ -379,6 +380,7 @@ vector Function::GetStackVariablesReferencedByInstructio BNStackVariableReference* refs = BNGetStackVariablesReferencedByInstruction(m_object, arch->GetObject(), addr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { StackVariableReference ref; @@ -502,10 +504,9 @@ Confidence> Function::GetParameterVariables() const { BNParameterVariablesWithConfidence vars = BNGetFunctionParameterVariables(m_object); vector varList; + varList.reserve(vars.count); for (size_t i = 0; i < vars.count; i++) - { varList.emplace_back(vars.vars[i].type, vars.vars[i].index, vars.vars[i].storage); - } Confidence> result(varList, vars.confidence); BNFreeParameterVariables(&vars); return result; @@ -897,6 +898,7 @@ vector Function::GetIndirectBranches() BNIndirectBranchInfo* branches = BNGetIndirectBranches(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { IndirectBranchInfo b; @@ -919,6 +921,7 @@ vector Function::GetIndirectBranchesAt(Architecture* arch, u BNIndirectBranchInfo* branches = BNGetIndirectBranchesAt(m_object, arch->GetObject(), addr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { IndirectBranchInfo b; @@ -941,9 +944,11 @@ vector> Function::GetBlockAnnotations(Architecture* BNInstructionTextLine* lines = BNGetFunctionBlockAnnotations(m_object, arch->GetObject(), addr, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) { vector line; + line.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { InstructionTextToken token; @@ -1155,10 +1160,12 @@ vector Function::GetTypeTokens(DisassemblySettings* setting settings ? settings->GetObject() : nullptr, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { DisassemblyTextLine line; line.addr = lines[i].addr; + line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { InstructionTextToken token; diff --git a/functiongraph.cpp b/functiongraph.cpp index 7e5ec079..77754913 100644 --- a/functiongraph.cpp +++ b/functiongraph.cpp @@ -110,6 +110,7 @@ vector> FunctionGraph::GetBlocks() BNFunctionGraphBlock** blocks = BNGetFunctionGraphBlocks(m_graph, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) { auto block = m_cachedBlocks.find(blocks[i]); @@ -148,6 +149,7 @@ vector> FunctionGraph::GetBlocksInRegion(int left, int t BNFunctionGraphBlock** blocks = BNGetFunctionGraphBlocksInRegion(m_graph, left, top, right, bottom, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) { auto block = m_cachedBlocks.find(blocks[i]); diff --git a/functiongraphblock.cpp b/functiongraphblock.cpp index 20b2515b..06a35eee 100644 --- a/functiongraphblock.cpp +++ b/functiongraphblock.cpp @@ -89,10 +89,12 @@ const vector& FunctionGraphBlock::GetLines() BNDisassemblyTextLine* lines = BNGetFunctionGraphBlockLines(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { DisassemblyTextLine line; line.addr = lines[i].addr; + line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { InstructionTextToken token; @@ -125,6 +127,7 @@ const vector& FunctionGraphBlock::GetOutgoingEdges() BNFunctionGraphEdge* edges = BNGetFunctionGraphBlockOutgoingEdges(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { FunctionGraphEdge edge; diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 6c59b704..5e985a8e 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -176,6 +176,7 @@ vector LowLevelILFunction::GetOperandList(ExprId expr, size_t listOper size_t count; uint64_t* operands = BNLowLevelILGetOperandList(m_object, expr, listOperand, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(operands[i]); BNLowLevelILFreeOperandList(operands); @@ -390,11 +391,10 @@ bool LowLevelILFunction::GetExprText(Architecture* arch, ExprId expr, vector> LowLevelILFunction::GetBasicBlocks() const BNBasicBlock** blocks = BNGetLowLevelILBasicBlockList(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index d85e4f17..53b1e390 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -178,15 +178,16 @@ unordered_map> }; -static unordered_map> - GetOperandIndexForOperandUsages() +static unordered_map> GetOperandIndexForOperandUsages() { unordered_map> result; + result.reserve(LowLevelILInstructionBase::operationOperandUsage.size()); for (auto& operation : LowLevelILInstructionBase::operationOperandUsage) { result[operation.first] = unordered_map(); size_t operand = 0; + result[operation.first].reserve(operation.second.size()); for (auto usage : operation.second) { result[operation.first][usage] = operand; @@ -377,7 +378,7 @@ uint64_t LowLevelILIntegerList::ListIterator::operator*() LowLevelILIntegerList::LowLevelILIntegerList(LowLevelILFunction* func, - const BNLowLevelILInstruction& instr, size_t count) +const BNLowLevelILInstruction& instr, size_t count) { m_start.function = func; #ifdef BINARYNINJACORE_LIBRARY diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp index 2cd5a233..0a28bd49 100644 --- a/mediumlevelil.cpp +++ b/mediumlevelil.cpp @@ -157,6 +157,7 @@ vector MediumLevelILFunction::GetOperandList(ExprId expr, size_t listO size_t count; uint64_t* operands = BNMediumLevelILGetOperandList(m_object, expr, listOperand, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(operands[i]); BNMediumLevelILFreeOperandList(operands); @@ -338,11 +339,10 @@ bool MediumLevelILFunction::GetExprText(Architecture* arch, ExprId expr, vector< return false; tokens.clear(); + tokens.reserve(count); for (size_t i = 0; i < count; i++) - { tokens.emplace_back(list[i].type, list[i].context, list[i].text, list[i].address, list[i].value, list[i].size, list[i].operand, list[i].confidence); - } BNFreeInstructionText(list, count); return true; @@ -359,11 +359,10 @@ bool MediumLevelILFunction::GetInstructionText(Function* func, Architecture* arc return false; tokens.clear(); + tokens.reserve(count); for (size_t i = 0; i < count; i++) - { tokens.emplace_back(list[i].type, list[i].context, list[i].text, list[i].address, list[i].value, list[i].size, list[i].operand, list[i].confidence); - } BNFreeInstructionText(list, count); return true; @@ -396,6 +395,7 @@ vector> MediumLevelILFunction::GetBasicBlocks() const BNBasicBlock** blocks = BNGetMediumLevelILBasicBlockList(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); @@ -680,6 +680,7 @@ unordered_map MediumLevelILFunction::GetAllBranchD BNILBranchInstructionAndDependence* deps = BNGetAllMediumLevelILBranchDependence(m_object, instr, &count); unordered_map result; + result.reserve(count); for (size_t i = 0; i < count; i++) result[deps[i].branch] = deps[i].dependence; diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index ec6aa1c6..bb4d205a 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -205,14 +205,14 @@ unordered_map> }; -static unordered_map> - GetOperandIndexForOperandUsages() +static unordered_map> GetOperandIndexForOperandUsages() { unordered_map> result; + result.reserve(MediumLevelILInstructionBase::operationOperandUsage.size()); for (auto& operation : MediumLevelILInstructionBase::operationOperandUsage) { result[operation.first] = unordered_map(); - + result[operation.first].reserve(operation.second.size()); size_t operand = 0; for (auto usage : operation.second) { diff --git a/metadata.cpp b/metadata.cpp index f9c48b04..c111233f 100644 --- a/metadata.cpp +++ b/metadata.cpp @@ -144,6 +144,7 @@ vector> Metadata::GetArray() size_t size = 0; BNMetadata** data = BNMetadataGetArray(m_object, &size); vector> result; + result.reserve(size); for (size_t i = 0; i < size; i++) result.push_back(new Metadata(data[i])); return result; diff --git a/platform.cpp b/platform.cpp index a9ab888f..724901fe 100644 --- a/platform.cpp +++ b/platform.cpp @@ -72,6 +72,7 @@ vector> Platform::GetList() BNPlatform** list = BNGetPlatformList(&count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Platform(BNNewPlatformReference(list[i]))); @@ -86,6 +87,7 @@ vector> Platform::GetList(Architecture* arch) BNPlatform** list = BNGetPlatformListByArchitecture(arch->GetObject(), &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Platform(BNNewPlatformReference(list[i]))); @@ -100,6 +102,7 @@ vector> Platform::GetList(const string& os) BNPlatform** list = BNGetPlatformListByOS(os.c_str(), &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Platform(BNNewPlatformReference(list[i]))); @@ -114,6 +117,7 @@ vector> Platform::GetList(const string& os, Architecture* arch) BNPlatform** list = BNGetPlatformListByOSAndArchitecture(os.c_str(), arch->GetObject(), &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new Platform(BNNewPlatformReference(list[i]))); @@ -128,6 +132,7 @@ vector Platform::GetOSList() char** list = BNGetPlatformOSList(&count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(list[i]); @@ -178,6 +183,7 @@ vector> Platform::GetCallingConventions() const BNCallingConvention** list = BNGetPlatformCallingConventions(m_object, &count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreCallingConvention(BNNewCallingConventionReference(list[i]))); diff --git a/plugin.cpp b/plugin.cpp index 2378fdab..972ce28b 100644 --- a/plugin.cpp +++ b/plugin.cpp @@ -211,6 +211,7 @@ vector PluginCommand::GetList() vector result; size_t count; BNPluginCommand* commands = BNGetAllPluginCommands(&count); + result.reserve(count); for (size_t i = 0; i < count; i++) result.emplace_back(commands[i]); BNFreePluginCommandList(commands); diff --git a/settings.cpp b/settings.cpp index 6b9c4e3a..b5899e38 100644 --- a/settings.cpp +++ b/settings.cpp @@ -51,6 +51,7 @@ std::vector Setting::GetStringList(const std::string& pluginName, char** outBuffer = (char**)BNSettingGetStringList(pluginName.c_str(), name.c_str(), (const char**)buffer, &size); vector result; + result.reserve(size); for (size_t i = 0; i < size; i++) result.emplace_back(outBuffer[i]); diff --git a/transform.cpp b/transform.cpp index 29a665d0..0a6fdfe6 100644 --- a/transform.cpp +++ b/transform.cpp @@ -157,6 +157,7 @@ vector> Transform::GetTransformTypes() BNTransform** list = BNGetTransformTypeList(&count); vector> result; + result.reserve(count); for (size_t i = 0; i < count; i++) result.push_back(new CoreTransform(list[i])); @@ -229,6 +230,7 @@ vector CoreTransform::GetParameters() const BNTransformParameterInfo* list = BNGetTransformParameterList(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { TransformParameter param; diff --git a/type.cpp b/type.cpp index c158f53e..08b64713 100644 --- a/type.cpp +++ b/type.cpp @@ -355,6 +355,7 @@ vector Type::GetParameters() const BNFunctionParameter* types = BNGetTypeParameters(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { FunctionParameter param; @@ -474,11 +475,10 @@ vector Type::GetTokens(Platform* platform, uint8_t baseCon platform ? platform->GetObject() : nullptr, baseConfidence, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) - { result.emplace_back(tokens[i].type, tokens[i].context, tokens[i].text, tokens[i].address, tokens[i].value, tokens[i].size, tokens[i].operand, tokens[i].confidence); - } BNFreeTokenList(tokens, count); return result; @@ -492,11 +492,10 @@ vector Type::GetTokensBeforeName(Platform* platform, uint8 platform ? platform->GetObject() : nullptr, baseConfidence, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) - { result.emplace_back(tokens[i].type, tokens[i].context, tokens[i].text, tokens[i].address, tokens[i].value, tokens[i].size, tokens[i].operand, tokens[i].confidence); - } BNFreeTokenList(tokens, count); return result; @@ -510,11 +509,10 @@ vector Type::GetTokensAfterName(Platform* platform, uint8_ platform ? platform->GetObject() : nullptr, baseConfidence, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) - { result.emplace_back(tokens[i].type, tokens[i].context, tokens[i].text, tokens[i].address, tokens[i].value, tokens[i].size, tokens[i].operand, tokens[i].confidence); - } BNFreeTokenList(tokens, count); return result; @@ -882,6 +880,7 @@ vector Structure::GetMembers() const BNStructureMember* members = BNGetStructureMembers(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { StructureMember member; @@ -1001,6 +1000,7 @@ vector Enumeration::GetMembers() const BNEnumerationMember* members = BNGetEnumerationMembers(m_object, &count); vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { EnumerationMember member; diff --git a/update.cpp b/update.cpp index 0ec69892..ecdf4162 100644 --- a/update.cpp +++ b/update.cpp @@ -53,6 +53,7 @@ vector UpdateChannel::GetList() } vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { UpdateChannel channel; @@ -149,6 +150,7 @@ vector UpdateVersion::GetChannelVersions(const string& channel) } vector result; + result.reserve(count); for (size_t i = 0; i < count; i++) { UpdateVersion version; -- cgit v1.3.1 From c351ac9c5c25b8d422648d97f96bebc263999cb6 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Sun, 14 Jan 2018 16:38:14 -0500 Subject: Add InstructionTextToken Constructor --- binaryninjaapi.h | 1 + 1 file changed, 1 insertion(+) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 31bd2316..d357e5bc 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -968,6 +968,7 @@ namespace BinaryNinja uint64_t address; InstructionTextToken(); + InstructionTextToken(uint8_t confidence, BNInstructionTextTokenType t, const std::string& txt); InstructionTextToken(BNInstructionTextTokenType type, const std::string& text, uint64_t value = 0, size_t size = 0, size_t operand = BN_INVALID_OPERAND, uint8_t confidence = BN_FULL_CONFIDENCE); InstructionTextToken(BNInstructionTextTokenType type, BNInstructionTextTokenContext context, -- cgit v1.3.1 From 5c6b13a5576ccbf9c64ba51079d1a3625661cb50 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Mon, 15 Jan 2018 18:29:11 -0500 Subject: Fix 'demangled' typo. --- python/types.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/types.py b/python/types.py index 49f1fdeb..27b4828f 100644 --- a/python/types.py +++ b/python/types.py @@ -634,7 +634,7 @@ class Type(object): return core.BNGenerateAutoDemangledTypeId(name) @classmethod - def get_auto_demanged_type_id_source(self): + def get_auto_demangled_type_id_source(self): return core.BNGetAutoDemangledTypeIdSource() def with_confidence(self, confidence): -- cgit v1.3.1 From cd8903be01bee8f38833bbabca2b7ae31880abb7 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Mon, 15 Jan 2018 18:30:08 -0500 Subject: Add platform check and access correct autodefined field. --- python/binaryview.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/python/binaryview.py b/python/binaryview.py index 6eb59db1..fae98c14 100644 --- a/python/binaryview.py +++ b/python/binaryview.py @@ -2095,6 +2095,8 @@ class BinaryView(object): """ if plat is None: plat = self.platform + if plat is None: + return None func = core.BNGetAnalysisFunction(self.handle, plat.handle, addr) if func is None: return None @@ -3398,7 +3400,7 @@ class BinaryView(object): return None result = Section(section.name, section.type, section.start, section.length, section.linkedSection, section.infoSection, section.infoData, section.align, section.entrySize, section.semantics, - section_list.autoDefined) + section.autoDefined) core.BNFreeSection(section) return result -- cgit v1.3.1 From 6430776b3de5ee6eb922a9356080ad07d5a92856 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 16 Jan 2018 16:25:30 -0500 Subject: Add classes and groups for semantic flags resolution --- architecture.cpp | 267 ++++++++++++++++++++++++++++-- binaryninjaapi.h | 48 +++++- binaryninjacore.h | 50 +++++- lowlevelilinstruction.cpp | 59 ++++++- lowlevelilinstruction.h | 16 ++ mediumlevelilinstruction.cpp | 8 + python/architecture.py | 382 +++++++++++++++++++++++++++++++++++++++---- python/lowlevelil.py | 58 ++++++- python/mediumlevelil.py | 1 + 9 files changed, 832 insertions(+), 57 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 3ca41741..571794c6 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -224,6 +224,22 @@ char* Architecture::GetFlagWriteTypeNameCallback(void* ctxt, uint32_t flags) } +char* Architecture::GetSemanticFlagClassNameCallback(void* ctxt, uint32_t semClass) +{ + Architecture* arch = (Architecture*)ctxt; + string result = arch->GetSemanticFlagClassName(semClass); + return BNAllocString(result.c_str()); +} + + +char* Architecture::GetSemanticFlagGroupNameCallback(void* ctxt, uint32_t semGroup) +{ + Architecture* arch = (Architecture*)ctxt; + string result = arch->GetSemanticFlagGroupName(semGroup); + return BNAllocString(result.c_str()); +} + + uint32_t* Architecture::GetFullWidthRegistersCallback(void* ctxt, size_t* count) { Architecture* arch = (Architecture*)ctxt; @@ -276,6 +292,32 @@ uint32_t* Architecture::GetAllFlagWriteTypesCallback(void* ctxt, size_t* count) } +uint32_t* Architecture::GetAllSemanticFlagClassesCallback(void* ctxt, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector regs = arch->GetAllSemanticFlagClasses(); + *count = regs.size(); + + uint32_t* result = new uint32_t[regs.size()]; + for (size_t i = 0; i < regs.size(); i++) + result[i] = regs[i]; + return result; +} + + +uint32_t* Architecture::GetAllSemanticFlagGroupsCallback(void* ctxt, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector regs = arch->GetAllSemanticFlagGroups(); + *count = regs.size(); + + uint32_t* result = new uint32_t[regs.size()]; + for (size_t i = 0; i < regs.size(); i++) + result[i] = regs[i]; + return result; +} + + BNFlagRole Architecture::GetFlagRoleCallback(void* ctxt, uint32_t flag) { Architecture* arch = (Architecture*)ctxt; @@ -283,10 +325,24 @@ BNFlagRole Architecture::GetFlagRoleCallback(void* ctxt, uint32_t flag) } -uint32_t* Architecture::GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNLowLevelILFlagCondition cond, size_t* count) +uint32_t* Architecture::GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNLowLevelILFlagCondition cond, + uint32_t semClass, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector flags = arch->GetFlagsRequiredForFlagCondition(cond, semClass); + *count = flags.size(); + + uint32_t* result = new uint32_t[flags.size()]; + for (size_t i = 0; i < flags.size(); i++) + result[i] = flags[i]; + return result; +} + + +uint32_t* Architecture::GetFlagsRequiredForSemanticFlagGroupCallback(void* ctxt, uint32_t semGroup, size_t* count) { Architecture* arch = (Architecture*)ctxt; - vector flags = arch->GetFlagsRequiredForFlagCondition(cond); + vector flags = arch->GetFlagsRequiredForSemanticFlagGroup(semGroup); *count = flags.size(); uint32_t* result = new uint32_t[flags.size()]; @@ -296,6 +352,31 @@ uint32_t* Architecture::GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNL } +BNFlagConditionForSemanticClass* Architecture::GetFlagConditionsForSemanticFlagGroupCallback(void* ctxt, + uint32_t semGroup, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + map conditions = arch->GetFlagConditionsForSemanticFlagGroup(semGroup); + *count = conditions.size(); + + BNFlagConditionForSemanticClass* result = new BNFlagConditionForSemanticClass[conditions.size()]; + size_t i = 0; + for (auto& j : conditions) + { + result[i].semanticClass = j.first; + result[i].condition = j.second; + i++; + } + return result; +} + + +void Architecture::FreeFlagConditionsForSemanticFlagGroupCallback(void*, BNFlagConditionForSemanticClass* conditions) +{ + delete[] conditions; +} + + uint32_t* Architecture::GetFlagsWrittenByFlagWriteTypeCallback(void* ctxt, uint32_t writeType, size_t* count) { Architecture* arch = (Architecture*)ctxt; @@ -309,6 +390,13 @@ uint32_t* Architecture::GetFlagsWrittenByFlagWriteTypeCallback(void* ctxt, uint3 } +uint32_t Architecture::GetSemanticClassForFlagWriteTypeCallback(void* ctxt, uint32_t writeType) +{ + Architecture* arch = (Architecture*)ctxt; + return arch->GetSemanticClassForFlagWriteType(writeType); +} + + size_t Architecture::GetFlagWriteLowLevelILCallback(void* ctxt, BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, BNLowLevelILFunction* il) { @@ -318,12 +406,20 @@ size_t Architecture::GetFlagWriteLowLevelILCallback(void* ctxt, BNLowLevelILOper } -size_t Architecture::GetFlagConditionLowLevelILCallback(void* ctxt, BNLowLevelILFlagCondition cond, +size_t Architecture::GetFlagConditionLowLevelILCallback(void* ctxt, BNLowLevelILFlagCondition cond, uint32_t semClass, BNLowLevelILFunction* il) { Architecture* arch = (Architecture*)ctxt; LowLevelILFunction func(il); - return arch->GetFlagConditionLowLevelIL(cond, func); + return arch->GetFlagConditionLowLevelIL(cond, semClass, func); +} + + +size_t Architecture::GetSemanticFlagGroupLowLevelILCallback(void* ctxt, uint32_t semGroup, BNLowLevelILFunction* il) +{ + Architecture* arch = (Architecture*)ctxt; + LowLevelILFunction func(il); + return arch->GetSemanticFlagGroupLowLevelIL(semGroup, func); } @@ -490,15 +586,24 @@ void Architecture::Register(Architecture* arch) callbacks.getRegisterName = GetRegisterNameCallback; callbacks.getFlagName = GetFlagNameCallback; callbacks.getFlagWriteTypeName = GetFlagWriteTypeNameCallback; + callbacks.getSemanticFlagClassName = GetSemanticFlagClassNameCallback; + callbacks.getSemanticFlagGroupName = GetSemanticFlagGroupNameCallback; callbacks.getFullWidthRegisters = GetFullWidthRegistersCallback; callbacks.getAllRegisters = GetAllRegistersCallback; callbacks.getAllFlags = GetAllFlagsCallback; callbacks.getAllFlagWriteTypes = GetAllFlagWriteTypesCallback; + callbacks.getAllSemanticFlagClasses = GetAllSemanticFlagClassesCallback; + callbacks.getAllSemanticFlagGroups = GetAllSemanticFlagGroupsCallback; callbacks.getFlagRole = GetFlagRoleCallback; callbacks.getFlagsRequiredForFlagCondition = GetFlagsRequiredForFlagConditionCallback; + callbacks.getFlagsRequiredForSemanticFlagGroup = GetFlagsRequiredForSemanticFlagGroupCallback; + callbacks.getFlagConditionsForSemanticFlagGroup = GetFlagConditionsForSemanticFlagGroupCallback; + callbacks.freeFlagConditionsForSemanticFlagGroup = FreeFlagConditionsForSemanticFlagGroupCallback; callbacks.getFlagsWrittenByFlagWriteType = GetFlagsWrittenByFlagWriteTypeCallback; + callbacks.getSemanticClassForFlagWriteType = GetSemanticClassForFlagWriteTypeCallback; callbacks.getFlagWriteLowLevelIL = GetFlagWriteLowLevelILCallback; callbacks.getFlagConditionLowLevelIL = GetFlagConditionLowLevelILCallback; + callbacks.getSemanticFlagGroupLowLevelIL = GetSemanticFlagGroupLowLevelILCallback; callbacks.freeRegisterList = FreeRegisterListCallback; callbacks.getRegisterInfo = GetRegisterInfoCallback; callbacks.getStackPointerRegister = GetStackPointerRegisterCallback; @@ -621,6 +726,24 @@ string Architecture::GetFlagWriteTypeName(uint32_t flags) } +string Architecture::GetSemanticFlagClassName(uint32_t semClass) +{ + if (semClass == 0) + return ""; + char flagStr[32]; + sprintf(flagStr, "semantic%" PRIu32, semClass); + return flagStr; +} + + +string Architecture::GetSemanticFlagGroupName(uint32_t semGroup) +{ + char flagStr[32]; + sprintf(flagStr, "group%" PRIu32, semGroup); + return flagStr; +} + + vector Architecture::GetFullWidthRegisters() { return vector(); @@ -645,24 +768,54 @@ vector Architecture::GetAllFlagWriteTypes() } +vector Architecture::GetAllSemanticFlagClasses() +{ + return vector(); +} + + +vector Architecture::GetAllSemanticFlagGroups() +{ + return vector(); +} + + BNFlagRole Architecture::GetFlagRole(uint32_t) { return SpecialFlagRole; } -vector Architecture::GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition) +vector Architecture::GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition, uint32_t) { return vector(); } +vector Architecture::GetFlagsRequiredForSemanticFlagGroup(uint32_t) +{ + return vector(); +} + + +map Architecture::GetFlagConditionsForSemanticFlagGroup(uint32_t) +{ + return map(); +} + + vector Architecture::GetFlagsWrittenByFlagWriteType(uint32_t) { return vector(); } +uint32_t Architecture::GetSemanticClassForFlagWriteType(uint32_t) +{ + return 0; +} + + size_t Architecture::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount,LowLevelILFunction& il) { @@ -681,7 +834,7 @@ size_t Architecture::GetDefaultFlagWriteLowLevelIL(BNLowLevelILOperation op, siz } -ExprId Architecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il) +ExprId Architecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, uint32_t, LowLevelILFunction& il) { return BNGetDefaultArchitectureFlagConditionLowLevelIL(m_object, cond, il.GetObject()); } @@ -693,6 +846,12 @@ ExprId Architecture::GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition } +ExprId Architecture::GetSemanticFlagGroupLowLevelIL(uint32_t, LowLevelILFunction& il) +{ + return il.Unimplemented(); +} + + BNRegisterInfo Architecture::GetRegisterInfo(uint32_t) { BNRegisterInfo result; @@ -1064,6 +1223,24 @@ string CoreArchitecture::GetFlagWriteTypeName(uint32_t flags) } +string CoreArchitecture::GetSemanticFlagClassName(uint32_t semClass) +{ + char* name = BNGetArchitectureSemanticFlagClassName(m_object, semClass); + string result = name; + BNFreeString(name); + return result; +} + + +string CoreArchitecture::GetSemanticFlagGroupName(uint32_t semGroup) +{ + char* name = BNGetArchitectureSemanticFlagGroupName(m_object, semGroup); + string result = name; + BNFreeString(name); + return result; +} + + vector CoreArchitecture::GetFullWidthRegisters() { size_t count; @@ -1120,16 +1297,58 @@ vector CoreArchitecture::GetAllFlagWriteTypes() } +vector CoreArchitecture::GetAllSemanticFlagClasses() +{ + size_t count; + uint32_t* regs = BNGetAllArchitectureSemanticFlagClasses(m_object, &count); + + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(regs[i]); + + BNFreeRegisterList(regs); + return result; +} + + +vector CoreArchitecture::GetAllSemanticFlagGroups() +{ + size_t count; + uint32_t* regs = BNGetAllArchitectureSemanticFlagGroups(m_object, &count); + + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(regs[i]); + + BNFreeRegisterList(regs); + return result; +} + + BNFlagRole CoreArchitecture::GetFlagRole(uint32_t flag) { return BNGetArchitectureFlagRole(m_object, flag); } -vector CoreArchitecture::GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond) +vector CoreArchitecture::GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, uint32_t semClass) +{ + size_t count; + uint32_t* flags = BNGetArchitectureFlagsRequiredForFlagCondition(m_object, cond, semClass, &count); + + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(flags[i]); + + BNFreeRegisterList(flags); + return result; +} + + +vector CoreArchitecture::GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup) { size_t count; - uint32_t* flags = BNGetArchitectureFlagsRequiredForFlagCondition(m_object, cond, &count); + uint32_t* flags = BNGetArchitectureFlagsRequiredForSemanticFlagGroup(m_object, semGroup, &count); vector result; for (size_t i = 0; i < count; i++) @@ -1140,6 +1359,21 @@ vector CoreArchitecture::GetFlagsRequiredForFlagCondition(BNLowLevelIL } +map CoreArchitecture::GetFlagConditionsForSemanticFlagGroup(uint32_t semGroup) +{ + size_t count; + BNFlagConditionForSemanticClass* conditions = BNGetArchitectureFlagConditionsForSemanticFlagGroup(m_object, + semGroup, &count); + + map result; + for (size_t i = 0; i < count; i++) + result[conditions[i].semanticClass] = conditions[i].condition; + + BNFreeFlagConditionsForSemanticFlagGroup(conditions); + return result; +} + + vector CoreArchitecture::GetFlagsWrittenByFlagWriteType(uint32_t writeType) { size_t count; @@ -1154,6 +1388,12 @@ vector CoreArchitecture::GetFlagsWrittenByFlagWriteType(uint32_t write } +uint32_t CoreArchitecture::GetSemanticClassForFlagWriteType(uint32_t writeType) +{ + return BNGetArchitectureSemanticClassForFlagWriteType(m_object, writeType); +} + + size_t CoreArchitecture::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il) { @@ -1162,9 +1402,16 @@ size_t CoreArchitecture::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t } -ExprId CoreArchitecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il) +ExprId CoreArchitecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) +{ + return (ExprId)BNGetArchitectureFlagConditionLowLevelIL(m_object, cond, semClass, il.GetObject()); +} + + +ExprId CoreArchitecture::GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il) { - return (ExprId)BNGetArchitectureFlagConditionLowLevelIL(m_object, cond, il.GetObject()); + return (ExprId)BNGetArchitectureSemanticFlagGroupLowLevelIL(m_object, semGroup, il.GetObject()); } diff --git a/binaryninjaapi.h b/binaryninjaapi.h index b90f72a2..cbd51d05 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1601,17 +1601,28 @@ namespace BinaryNinja static char* GetRegisterNameCallback(void* ctxt, uint32_t reg); static char* GetFlagNameCallback(void* ctxt, uint32_t flag); static char* GetFlagWriteTypeNameCallback(void* ctxt, uint32_t flags); + static char* GetSemanticFlagClassNameCallback(void* ctxt, uint32_t semClass); + static char* GetSemanticFlagGroupNameCallback(void* ctxt, uint32_t semGroup); static uint32_t* GetFullWidthRegistersCallback(void* ctxt, size_t* count); static uint32_t* GetAllRegistersCallback(void* ctxt, size_t* count); static uint32_t* GetAllFlagsCallback(void* ctxt, size_t* count); static uint32_t* GetAllFlagWriteTypesCallback(void* ctxt, size_t* count); + static uint32_t* GetAllSemanticFlagClassesCallback(void* ctxt, size_t* count); + static uint32_t* GetAllSemanticFlagGroupsCallback(void* ctxt, size_t* count); static BNFlagRole GetFlagRoleCallback(void* ctxt, uint32_t flag); - static uint32_t* GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNLowLevelILFlagCondition cond, size_t* count); + static uint32_t* GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNLowLevelILFlagCondition cond, + uint32_t semClass, size_t* count); + static uint32_t* GetFlagsRequiredForSemanticFlagGroupCallback(void* ctxt, uint32_t semGroup, size_t* count); + static BNFlagConditionForSemanticClass* GetFlagConditionsForSemanticFlagGroupCallback(void* ctxt, + uint32_t semGroup, size_t* count); + static void FreeFlagConditionsForSemanticFlagGroupCallback(void* ctxt, BNFlagConditionForSemanticClass* conditions); static uint32_t* GetFlagsWrittenByFlagWriteTypeCallback(void* ctxt, uint32_t writeType, size_t* count); + static uint32_t GetSemanticClassForFlagWriteTypeCallback(void* ctxt, uint32_t writeType); static size_t GetFlagWriteLowLevelILCallback(void* ctxt, BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, BNLowLevelILFunction* il); static size_t GetFlagConditionLowLevelILCallback(void* ctxt, BNLowLevelILFlagCondition cond, - BNLowLevelILFunction* il); + uint32_t semClass, BNLowLevelILFunction* il); + static size_t GetSemanticFlagGroupLowLevelILCallback(void* ctxt, uint32_t semGroup, BNLowLevelILFunction* il); static void FreeRegisterListCallback(void* ctxt, uint32_t* regs); static void GetRegisterInfoCallback(void* ctxt, uint32_t reg, BNRegisterInfo* result); static uint32_t GetStackPointerRegisterCallback(void* ctxt); @@ -1668,19 +1679,28 @@ namespace BinaryNinja virtual std::string GetRegisterName(uint32_t reg); virtual std::string GetFlagName(uint32_t flag); virtual std::string GetFlagWriteTypeName(uint32_t flags); + virtual std::string GetSemanticFlagClassName(uint32_t semClass); + virtual std::string GetSemanticFlagGroupName(uint32_t semGroup); virtual std::vector GetFullWidthRegisters(); virtual std::vector GetAllRegisters(); virtual std::vector GetAllFlags(); virtual std::vector GetAllFlagWriteTypes(); + virtual std::vector GetAllSemanticFlagClasses(); + virtual std::vector GetAllSemanticFlagGroups(); virtual BNFlagRole GetFlagRole(uint32_t flag); - virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond); + virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, + uint32_t semClass = 0); + virtual std::vector GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup); + virtual std::map GetFlagConditionsForSemanticFlagGroup(uint32_t semGroup); virtual std::vector GetFlagsWrittenByFlagWriteType(uint32_t writeType); + virtual uint32_t GetSemanticClassForFlagWriteType(uint32_t writeType); virtual ExprId GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il); ExprId GetDefaultFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, BNFlagRole role, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il); - virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il); + virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, uint32_t semClass, LowLevelILFunction& il); ExprId GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il); + virtual ExprId GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il); virtual BNRegisterInfo GetRegisterInfo(uint32_t reg); virtual uint32_t GetStackPointerRegister(); virtual uint32_t GetLinkRegister(); @@ -1804,16 +1824,26 @@ namespace BinaryNinja virtual std::string GetRegisterName(uint32_t reg) override; virtual std::string GetFlagName(uint32_t flag) override; virtual std::string GetFlagWriteTypeName(uint32_t flags) override; + virtual std::string GetSemanticFlagClassName(uint32_t semClass) override; + virtual std::string GetSemanticFlagGroupName(uint32_t semGroup) override; virtual std::vector GetFullWidthRegisters() override; virtual std::vector GetAllRegisters() override; virtual std::vector GetAllFlags() override; virtual std::vector GetAllFlagWriteTypes() override; + virtual std::vector GetAllSemanticFlagClasses() override; + virtual std::vector GetAllSemanticFlagGroups() override; virtual BNFlagRole GetFlagRole(uint32_t flag) override; - virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond) override; + virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, + uint32_t semClass = 0) override; + virtual std::vector GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup) override; + virtual std::map GetFlagConditionsForSemanticFlagGroup(uint32_t semGroup) override; virtual std::vector GetFlagsWrittenByFlagWriteType(uint32_t writeType) override; + virtual uint32_t GetSemanticClassForFlagWriteType(uint32_t writeType) override; virtual ExprId GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il) override; - virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il) override; + virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) override; + virtual ExprId GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il) override; virtual BNRegisterInfo GetRegisterInfo(uint32_t reg) override; virtual uint32_t GetStackPointerRegister() override; virtual uint32_t GetLinkRegister() override; @@ -2584,7 +2614,9 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId Return(size_t dest, const ILSourceLocation& loc = ILSourceLocation()); ExprId NoReturn(const ILSourceLocation& loc = ILSourceLocation()); - ExprId FlagCondition(BNLowLevelILFlagCondition cond, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FlagCondition(BNLowLevelILFlagCondition cond, uint32_t semClass = 0, + const ILSourceLocation& loc = ILSourceLocation()); + ExprId FlagGroup(uint32_t semGroup, const ILSourceLocation& loc = ILSourceLocation()); ExprId CompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId CompareNotEqual(size_t size, ExprId a, ExprId b, @@ -2641,6 +2673,7 @@ namespace BinaryNinja ExprId FloatCompareLessEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareGreaterEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareGreaterThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareOrdered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId Goto(BNLowLevelILLabel& label, const ILSourceLocation& loc = ILSourceLocation()); @@ -2944,6 +2977,7 @@ namespace BinaryNinja ExprId FloatCompareLessEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareGreaterEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareGreaterThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatCompareOrdered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId Goto(BNMediumLevelILLabel& label, const ILSourceLocation& loc = ILSourceLocation()); diff --git a/binaryninjacore.h b/binaryninjacore.h index baca94be..388d3643 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -335,6 +335,7 @@ extern "C" LLIL_IF, LLIL_GOTO, LLIL_FLAG_COND, // Valid only in Lifted IL + LLIL_FLAG_GROUP, // Valid only in Lifted IL LLIL_CMP_E, LLIL_CMP_NE, LLIL_CMP_SLT, @@ -372,6 +373,7 @@ extern "C" LLIL_FCMP_LE, LLIL_FCMP_GE, LLIL_FCMP_GT, + LLIL_FCMP_O, LLIL_FCMP_UO, // The following instructions are only used in SSA form @@ -418,7 +420,15 @@ extern "C" LLFC_NEG, LLFC_POS, LLFC_O, - LLFC_NO + LLFC_NO, + LLFC_FE, + LLFC_FNE, + LLFC_FLT, + LLFC_FLE, + LLFC_FGE, + LLFC_FGT, + LLFC_FO, + LLFC_FUO }; enum BNFlagRole @@ -869,6 +879,7 @@ extern "C" MLIL_FCMP_LE, MLIL_FCMP_GE, MLIL_FCMP_GT, + MLIL_FCMP_O, MLIL_FCMP_UO, // The following instructions are only used in SSA form @@ -1058,6 +1069,12 @@ extern "C" size_t count; }; + struct BNFlagConditionForSemanticClass + { + uint32_t semanticClass; + BNLowLevelILFlagCondition condition; + }; + struct BNCustomArchitecture { void* context; @@ -1077,16 +1094,27 @@ extern "C" char* (*getRegisterName)(void* ctxt, uint32_t reg); char* (*getFlagName)(void* ctxt, uint32_t flag); char* (*getFlagWriteTypeName)(void* ctxt, uint32_t flags); + char* (*getSemanticFlagClassName)(void* ctxt, uint32_t semClass); + char* (*getSemanticFlagGroupName)(void* ctxt, uint32_t semGroup); uint32_t* (*getFullWidthRegisters)(void* ctxt, size_t* count); uint32_t* (*getAllRegisters)(void* ctxt, size_t* count); uint32_t* (*getAllFlags)(void* ctxt, size_t* count); uint32_t* (*getAllFlagWriteTypes)(void* ctxt, size_t* count); + uint32_t* (*getAllSemanticFlagClasses)(void* ctxt, size_t* count); + uint32_t* (*getAllSemanticFlagGroups)(void* ctxt, size_t* count); BNFlagRole (*getFlagRole)(void* ctxt, uint32_t flag); - uint32_t* (*getFlagsRequiredForFlagCondition)(void* ctxt, BNLowLevelILFlagCondition cond, size_t* count); + uint32_t* (*getFlagsRequiredForFlagCondition)(void* ctxt, BNLowLevelILFlagCondition cond, + uint32_t semClass, size_t* count); + uint32_t* (*getFlagsRequiredForSemanticFlagGroup)(void* ctxt, uint32_t semGroup, size_t* count); + BNFlagConditionForSemanticClass* (*getFlagConditionsForSemanticFlagGroup)(void* ctxt, uint32_t semGroup, size_t* count); + void (*freeFlagConditionsForSemanticFlagGroup)(void* ctxt, BNFlagConditionForSemanticClass* conditions); uint32_t* (*getFlagsWrittenByFlagWriteType)(void* ctxt, uint32_t writeType, size_t* count); + uint32_t (*getSemanticClassForFlagWriteType)(void* ctxt, uint32_t writeType); size_t (*getFlagWriteLowLevelIL)(void* ctxt, BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, BNLowLevelILFunction* il); - size_t (*getFlagConditionLowLevelIL)(void* ctxt, BNLowLevelILFlagCondition cond, BNLowLevelILFunction* il); + size_t (*getFlagConditionLowLevelIL)(void* ctxt, BNLowLevelILFlagCondition cond, + uint32_t semClass, BNLowLevelILFunction* il); + size_t (*getSemanticFlagGroupLowLevelIL)(void* ctxt, uint32_t semGroup, BNLowLevelILFunction* il); void (*freeRegisterList)(void* ctxt, uint32_t* regs); void (*getRegisterInfo)(void* ctxt, uint32_t reg, BNRegisterInfo* result); uint32_t (*getStackPointerRegister)(void* ctxt); @@ -2042,24 +2070,36 @@ extern "C" BINARYNINJACOREAPI char* BNGetArchitectureRegisterName(BNArchitecture* arch, uint32_t reg); BINARYNINJACOREAPI char* BNGetArchitectureFlagName(BNArchitecture* arch, uint32_t flag); BINARYNINJACOREAPI char* BNGetArchitectureFlagWriteTypeName(BNArchitecture* arch, uint32_t flags); + BINARYNINJACOREAPI char* BNGetArchitectureSemanticFlagClassName(BNArchitecture* arch, uint32_t semClass); + BINARYNINJACOREAPI char* BNGetArchitectureSemanticFlagGroupName(BNArchitecture* arch, uint32_t semGroup); BINARYNINJACOREAPI uint32_t* BNGetFullWidthArchitectureRegisters(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureRegisters(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureFlags(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureFlagWriteTypes(BNArchitecture* arch, size_t* count); + BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureSemanticFlagClasses(BNArchitecture* arch, size_t* count); + BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureSemanticFlagGroups(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI BNFlagRole BNGetArchitectureFlagRole(BNArchitecture* arch, uint32_t flag); BINARYNINJACOREAPI uint32_t* BNGetArchitectureFlagsRequiredForFlagCondition(BNArchitecture* arch, BNLowLevelILFlagCondition cond, - size_t* count); + uint32_t semClass, size_t* count); + BINARYNINJACOREAPI uint32_t* BNGetArchitectureFlagsRequiredForSemanticFlagGroup(BNArchitecture* arch, + uint32_t semGroup, size_t* count); + BINARYNINJACOREAPI BNFlagConditionForSemanticClass* BNGetArchitectureFlagConditionsForSemanticFlagGroup(BNArchitecture* arch, + uint32_t semGroup, size_t* count); + BINARYNINJACOREAPI void BNFreeFlagConditionsForSemanticFlagGroup(BNFlagConditionForSemanticClass* conditions); BINARYNINJACOREAPI uint32_t* BNGetArchitectureFlagsWrittenByFlagWriteType(BNArchitecture* arch, uint32_t writeType, size_t* count); + BINARYNINJACOREAPI uint32_t BNGetArchitectureSemanticClassForFlagWriteType(BNArchitecture* arch, uint32_t writeType); BINARYNINJACOREAPI size_t BNGetArchitectureFlagWriteLowLevelIL(BNArchitecture* arch, BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, BNLowLevelILFunction* il); BINARYNINJACOREAPI size_t BNGetDefaultArchitectureFlagWriteLowLevelIL(BNArchitecture* arch, BNLowLevelILOperation op, size_t size, BNFlagRole role, BNRegisterOrConstant* operands, size_t operandCount, BNLowLevelILFunction* il); BINARYNINJACOREAPI size_t BNGetArchitectureFlagConditionLowLevelIL(BNArchitecture* arch, BNLowLevelILFlagCondition cond, - BNLowLevelILFunction* il); + uint32_t semClass, BNLowLevelILFunction* il); BINARYNINJACOREAPI size_t BNGetDefaultArchitectureFlagConditionLowLevelIL(BNArchitecture* arch, BNLowLevelILFlagCondition cond, BNLowLevelILFunction* il); + BINARYNINJACOREAPI size_t BNGetArchitectureSemanticFlagGroupLowLevelIL(BNArchitecture* arch, + uint32_t semGroup, BNLowLevelILFunction* il); BINARYNINJACOREAPI uint32_t* BNGetModifiedArchitectureRegistersOnWrite(BNArchitecture* arch, uint32_t reg, size_t* count); BINARYNINJACOREAPI void BNFreeRegisterList(uint32_t* regs); BINARYNINJACOREAPI BNRegisterInfo BNGetArchitectureRegisterInfo(BNArchitecture* arch, uint32_t reg); diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 6b67ef72..4b1acff3 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -49,6 +49,8 @@ unordered_map {DestSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, {DestSSARegisterStackLowLevelOperandUsage, SSARegisterStackLowLevelOperand}, {DestSSAFlagLowLevelOperandUsage, SSAFlagLowLevelOperand}, + {SemanticFlagClassLowLevelOperandUsage, SemanticFlagClassLowLevelOperand}, + {SemanticFlagGroupLowLevelOperandUsage, SemanticFlagGroupLowLevelOperand}, {PartialRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, {PartialSSARegisterStackSourceLowLevelOperandUsage, SSARegisterStackLowLevelOperand}, {StackSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, @@ -140,7 +142,8 @@ unordered_map> {LLIL_IF, {ConditionExprLowLevelOperandUsage, TrueTargetLowLevelOperandUsage, FalseTargetLowLevelOperandUsage}}, {LLIL_GOTO, {TargetLowLevelOperandUsage}}, - {LLIL_FLAG_COND, {FlagConditionLowLevelOperandUsage}}, + {LLIL_FLAG_COND, {FlagConditionLowLevelOperandUsage, SemanticFlagClassLowLevelOperandUsage}}, + {LLIL_FLAG_GROUP, {SemanticFlagGroupLowLevelOperandUsage}}, {LLIL_TRAP, {VectorLowLevelOperandUsage}}, {LLIL_CALL_SSA, {OutputSSARegistersLowLevelOperandUsage, OutputMemoryVersionLowLevelOperandUsage, DestExprLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage, @@ -886,6 +889,22 @@ BNLowLevelILFlagCondition LowLevelILOperand::GetFlagCondition() const } +uint32_t LowLevelILOperand::GetSemanticFlagClass() const +{ + if (m_type != SemanticFlagClassLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegister(m_operandIndex); +} + + +uint32_t LowLevelILOperand::GetSemanticFlagGroup() const +{ + if (m_type != SemanticFlagGroupLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegister(m_operandIndex); +} + + SSARegister LowLevelILOperand::GetSSARegister() const { if (m_type != SSARegisterLowLevelOperand) @@ -1710,7 +1729,9 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, return dest->Undefined(*this); return dest->If(subExprHandler(GetConditionExpr()), *labelA, *labelB, *this); case LLIL_FLAG_COND: - return dest->FlagCondition(GetFlagCondition(), *this); + return dest->FlagCondition(GetFlagCondition(), GetSemanticFlagClass(), *this); + case LLIL_FLAG_GROUP: + return dest->FlagGroup(GetSemanticFlagGroup(), *this); case LLIL_TRAP: return dest->Trap(GetVector(), *this); case LLIL_CALL_SSA: @@ -1964,6 +1985,24 @@ SSAFlag LowLevelILInstruction::GetDestSSAFlag() const } +uint32_t LowLevelILInstruction::GetSemanticFlagClass() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(SemanticFlagClassLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegister(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + +uint32_t LowLevelILInstruction::GetSemanticFlagGroup() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(SemanticFlagGroupLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegister(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + uint32_t LowLevelILInstruction::GetPartialRegister() const { size_t operandIndex; @@ -2748,9 +2787,15 @@ ExprId LowLevelILFunction::NoReturn(const ILSourceLocation& loc) } -ExprId LowLevelILFunction::FlagCondition(BNLowLevelILFlagCondition cond, const ILSourceLocation& loc) +ExprId LowLevelILFunction::FlagCondition(BNLowLevelILFlagCondition cond, uint32_t semClass, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_FLAG_COND, loc, 0, 0, (ExprId)cond); + return AddExprWithLocation(LLIL_FLAG_COND, loc, 0, 0, (ExprId)cond, semClass); +} + + +ExprId LowLevelILFunction::FlagGroup(uint32_t semGroup, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FLAG_GROUP, loc, 0, 0, semGroup); } @@ -2988,6 +3033,12 @@ ExprId LowLevelILFunction::FloatCompareGreaterThan(size_t size, ExprId a, ExprId } +ExprId LowLevelILFunction::FloatCompareOrdered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FCMP_O, loc, size, 0, a, b); +} + + ExprId LowLevelILFunction::FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_FCMP_UO, loc, size, 0, a, b); diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index a0a867af..bb5041a6 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -108,6 +108,8 @@ namespace BinaryNinja RegisterStackLowLevelOperand, FlagLowLevelOperand, FlagConditionLowLevelOperand, + SemanticFlagClassLowLevelOperand, + SemanticFlagGroupLowLevelOperand, SSARegisterLowLevelOperand, SSARegisterStackLowLevelOperand, SSAFlagLowLevelOperand, @@ -135,6 +137,8 @@ namespace BinaryNinja DestSSARegisterLowLevelOperandUsage, DestSSARegisterStackLowLevelOperandUsage, DestSSAFlagLowLevelOperandUsage, + SemanticFlagClassLowLevelOperandUsage, + SemanticFlagGroupLowLevelOperandUsage, PartialRegisterLowLevelOperandUsage, PartialSSARegisterStackSourceLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage, @@ -587,6 +591,8 @@ namespace BinaryNinja template SSARegister GetDestSSARegister() const { return As().GetDestSSARegister(); } template SSARegisterStack GetDestSSARegisterStack() const { return As().GetDestSSARegisterStack(); } template SSAFlag GetDestSSAFlag() const { return As().GetDestSSAFlag(); } + template uint32_t GetSemanticFlagClass() const { return As().GetSemanticFlagClass(); } + template uint32_t GetSemanticFlagGroup() const { return As().GetSemanticFlagGroup(); } template uint32_t GetPartialRegister() const { return As().GetPartialRegister(); } template SSARegister GetStackSSARegister() const { return As().GetStackSSARegister(); } template SSARegister GetTopSSARegister() const { return As().GetTopSSARegister(); } @@ -645,6 +651,8 @@ namespace BinaryNinja SSARegister GetDestSSARegister() const; SSARegisterStack GetDestSSARegisterStack() const; SSAFlag GetDestSSAFlag() const; + uint32_t GetSemanticFlagClass() const; + uint32_t GetSemanticFlagGroup() const; uint32_t GetPartialRegister() const; SSARegister GetStackSSARegister() const; SSARegister GetTopSSARegister() const; @@ -696,6 +704,8 @@ namespace BinaryNinja uint32_t GetRegister() const; uint32_t GetRegisterStack() const; uint32_t GetFlag() const; + uint32_t GetSemanticFlagClass() const; + uint32_t GetSemanticFlagGroup() const; BNLowLevelILFlagCondition GetFlagCondition() const; SSARegister GetSSARegister() const; SSARegisterStack GetSSARegisterStack() const; @@ -974,6 +984,11 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { BNLowLevelILFlagCondition GetFlagCondition() const { return GetRawOperandAsFlagCondition(0); } + uint32_t GetSemanticFlagClass() const { return GetRawOperandAsRegister(1); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetSemanticFlagGroup() const { return GetRawOperandAsRegister(0); } }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase @@ -1083,6 +1098,7 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILTwoOperandWithCarryInstruction {}; diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index c3b4014f..e911c298 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -1331,6 +1331,7 @@ void MediumLevelILInstruction::VisitExprs(const std::functionAddExprWithLocation(operation, *this, size, subExprHandler(AsTwoOperand().GetLeftExpr()), subExprHandler(AsTwoOperand().GetRightExpr())); @@ -2706,6 +2708,12 @@ ExprId MediumLevelILFunction::FloatCompareGreaterThan(size_t size, ExprId a, Exp } +ExprId MediumLevelILFunction::FloatCompareOrdered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FCMP_O, loc, size, a, b); +} + + ExprId MediumLevelILFunction::FloatCompareUnordered(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_FCMP_UO, loc, size, a, b); diff --git a/python/architecture.py b/python/architecture.py index 08049d46..d2ab586e 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -33,7 +33,6 @@ import callingconvention import platform import log import databuffer -import types class _ArchitectureMetaClass(type): @@ -120,9 +119,14 @@ class Architecture(object): global_regs = [] flags = [] flag_write_types = [] + semantic_flag_classes = [] + semantic_flag_groups = [] flag_roles = {} flags_required_for_flag_condition = {} + flags_required_for_semantic_flag_group = {} + flag_conditions_for_semantic_flag_group = {} flags_written_by_flag_write_type = {} + semantic_class_for_flag_write_type = {} reg_stacks = {} __metaclass__ = _ArchitectureMetaClass next_address = 0 @@ -166,16 +170,40 @@ class Architecture(object): core.BNFreeRegisterList(flags) count = ctypes.c_ulonglong() - types = core.BNGetAllArchitectureFlagWriteTypes(self.handle, count) + write_types = core.BNGetAllArchitectureFlagWriteTypes(self.handle, count) self._flag_write_types = {} self._flag_write_types_by_index = {} self.__dict__["flag_write_types"] = [] for i in xrange(0, count.value): - name = core.BNGetArchitectureFlagWriteTypeName(self.handle, types[i]) - self._flag_write_types[name] = types[i] - self._flag_write_types_by_index[types[i]] = name + name = core.BNGetArchitectureFlagWriteTypeName(self.handle, write_types[i]) + self._flag_write_types[name] = write_types[i] + self._flag_write_types_by_index[write_types[i]] = name self.flag_write_types.append(name) - core.BNFreeRegisterList(types) + core.BNFreeRegisterList(write_types) + + count = ctypes.c_ulonglong() + sem_classes = core.BNGetAllArchitectureSemanticFlagClasses(self.handle, count) + self._semantic_flag_classes = {} + self._semantic_flag_classes_by_index = {} + self.__dict__["semantic_flag_classes"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureSemanticFlagClassName(self.handle, sem_classes[i]) + self._semantic_flag_classes[name] = sem_classes[i] + self._semantic_flag_classes_by_index[sem_classes[i]] = name + self.semantic_flag_classes.append(name) + core.BNFreeRegisterList(sem_classes) + + count = ctypes.c_ulonglong() + sem_groups = core.BNGetAllArchitectureSemanticFlagGroups(self.handle, count) + self._semantic_flag_groups = {} + self._semantic_flag_groups_by_index = {} + self.__dict__["semantic_flag_groups"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureSemanticFlagGroupName(self.handle, sem_groups[i]) + self._semantic_flag_groups[name] = sem_groups[i] + self._semantic_flag_groups_by_index[sem_groups[i]] = name + self.semantic_flag_groups.append(name) + core.BNFreeRegisterList(sem_groups) self._flag_roles = {} self.__dict__["flag_roles"] = {} @@ -184,19 +212,48 @@ class Architecture(object): self.__dict__["flag_roles"][flag] = role self._flag_roles[self._flags[flag]] = role - self._flags_required_for_flag_condition = {} self.__dict__["flags_required_for_flag_condition"] = {} for cond in LowLevelILFlagCondition: count = ctypes.c_ulonglong() - flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, count) + flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, 0, count) + flag_names = [] + for i in xrange(0, count.value): + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + self.__dict__["flags_required_for_flag_condition"][cond] = flag_names + + self._flags_required_by_semantic_flag_group = {} + self.__dict__["flags_required_for_semantic_flag_group"] = {} + for group in self.semantic_flag_groups: + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsRequiredForSemanticFlagGroup(self.handle, + self._semantic_flag_groups[group], count) flag_indexes = [] flag_names = [] for i in xrange(0, count.value): flag_indexes.append(flags[i]) flag_names.append(self._flags_by_index[flags[i]]) core.BNFreeRegisterList(flags) - self._flags_required_for_flag_condition[cond] = flag_indexes - self.__dict__["flags_required_for_flag_condition"][cond] = flag_names + self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flag_indexes + self.__dict__["flags_required_for_semantic_flag_group"][cond] = flag_names + + self._flag_conditions_for_semantic_flag_group = {} + self.__dict__["flag_conditions_for_semantic_flag_group"] = {} + for group in self.semantic_flag_groups: + count = ctypes.c_ulonglong() + conditions = core.BNGetArchitectureFlagConditionsForSemanticFlagGroup(self.handle, + self._semantic_flag_groups[group], count) + class_index_cond = {} + class_cond = {} + for i in xrange(0, count.value): + class_index_cond[conditions[i].semanticClass] = conditions[i].condition + if conditions[i].semanticClass == 0: + class_cond[None] = conditions[i].condition + elif conditions[i].semanticClass in self._semantic_flag_classes_by_index: + class_cond[self._semantic_flag_classes_by_index[conditions[i].semanticClass]] = conditions[i].condition + core.BNFreeFlagConditionsForSemanticFlagGroup(conditions) + self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_index_cond + self.__dict__["flag_conditions_for_semantic_flag_group"][group] = class_cond self._flags_written_by_flag_write_type = {} self.__dict__["flags_written_by_flag_write_type"] = {} @@ -213,6 +270,18 @@ class Architecture(object): self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flag_indexes self.__dict__["flags_written_by_flag_write_type"][write_type] = flag_names + self._semantic_class_for_flag_write_type = {} + self.__dict__["semantic_class_for_flag_write_type"] = {} + for write_type in self.flag_write_types: + sem_class = core.BNGetArchitectureSemanticClassForFlagWriteType(self.handle, + self._flag_write_types[write_type]) + if sem_class == 0: + sem_class_name = None + else: + sem_class_name = self._semantic_flag_classes_by_index[sem_class] + self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class + self.__dict__["semantic_class_for_flag_write_type"][write_type] = sem_class_name + count = ctypes.c_ulonglong() regs = core.BNGetArchitectureGlobalRegisters(self.handle, count) self.__dict__["global_regs"] = [] @@ -260,19 +329,33 @@ class Architecture(object): self._cb.getRegisterName = self._cb.getRegisterName.__class__(self._get_register_name) self._cb.getFlagName = self._cb.getFlagName.__class__(self._get_flag_name) self._cb.getFlagWriteTypeName = self._cb.getFlagWriteTypeName.__class__(self._get_flag_write_type_name) + self._cb.getFlagSemanticClassName = self._cb.getFlagSemanticClassName.__class__(self._get_semantic_flag_class_name) + self._cb.getFlagSemanticGroupName = self._cb.getFlagSemanticGroupName.__class__(self._get_semantic_flag_group_name) self._cb.getFullWidthRegisters = self._cb.getFullWidthRegisters.__class__(self._get_full_width_registers) self._cb.getAllRegisters = self._cb.getAllRegisters.__class__(self._get_all_registers) self._cb.getAllFlags = self._cb.getAllRegisters.__class__(self._get_all_flags) self._cb.getAllFlagWriteTypes = self._cb.getAllRegisters.__class__(self._get_all_flag_write_types) + self._cb.getAllFlagSemanticClasses = self._cb.getAllFlagSemanticClasses.__class__(self._get_all_semantic_flag_classes) + self._cb.getAllFlagSemanticGroups = self._cb.getAllFlagSemanticGroups.__class__(self._get_all_semantic_flag_groups) self._cb.getFlagRole = self._cb.getFlagRole.__class__(self._get_flag_role) self._cb.getFlagsRequiredForFlagCondition = self._cb.getFlagsRequiredForFlagCondition.__class__( self._get_flags_required_for_flag_condition) + self._cb.getFlagsRequiredForSemanticFlagGroup = self._cb.getFlagsRequiredForSemanticFlagGroup.__class__( + self._get_flags_required_for_semantic_flag_group) + self._cb.getFlagConditionsForSemanticFlagGroup = self._cb.getFlagConditionsForSemanticFlagGroup.__class__( + self._get_flag_conditions_for_semantic_flag_group) + self._cb.freeFlagConditionsForSemanticFlagGroup = self._cb.freeFlagConditionsForSemanticFlagGroup.__class__( + self._free_flag_conditions_for_semantic_flag_group) self._cb.getFlagsWrittenByFlagWriteType = self._cb.getFlagsWrittenByFlagWriteType.__class__( self._get_flags_written_by_flag_write_type) + self._cb.getSemanticClassForFlagWriteType = self._cb.getSemanticClassForFlagWriteType.__class__( + self._get_semantic_class_for_flag_write_type) self._cb.getFlagWriteLowLevelIL = self._cb.getFlagWriteLowLevelIL.__class__( self._get_flag_write_low_level_il) self._cb.getFlagConditionLowLevelIL = self._cb.getFlagConditionLowLevelIL.__class__( self._get_flag_condition_low_level_il) + self._cb.getSemanticFlagGroupLowLevelIL = self._cb.getSemanticFlagGroupLowLevelIL.__class__( + self._get_semantic_flag_group_low_level_il) self._cb.freeRegisterList = self._cb.freeRegisterList.__class__(self._free_register_list) self._cb.getRegisterInfo = self._cb.getRegisterInfo.__class__(self._get_register_info) self._cb.getStackPointerRegister = self._cb.getStackPointerRegister.__class__( @@ -362,6 +445,26 @@ class Architecture(object): self._flag_write_types_by_index[write_type_index] = write_type write_type_index += 1 + self._semantic_flag_classes = {} + self._semantic_flag_classes_by_index = {} + self.__dict__["semantic_flag_classes"] = self.__class__.semantic_flag_classes + semantic_class_index = 1 + for sem_class in self.__class__.semantic_flag_classes: + if sem_class not in self._semantic_flag_classes: + self._semantic_flag_classes[sem_class] = semantic_class_index + self._semantic_flag_classes_by_index[semantic_class_index] = sem_class + semantic_class_index += 1 + + self._semantic_flag_groups = {} + self._semantic_flag_groups_by_index = {} + self.__dict__["semantic_flag_groups"] = self.__class__.semantic_flag_groups + semantic_group_index = 0 + for sem_group in self.__class__.semantic_flag_groups: + if sem_group not in self._semantic_flag_groups: + self._semantic_flag_groups[sem_group] = semantic_group_index + self._semantic_flag_groups_by_index[semantic_group_index] = sem_group + semantic_group_index += 1 + self._flag_roles = {} self.__dict__["flag_roles"] = self.__class__.flag_roles for flag in self.__class__.flag_roles: @@ -370,13 +473,26 @@ class Architecture(object): role = FlagRole[role] self._flag_roles[self._flags[flag]] = role - self._flags_required_for_flag_condition = {} self.__dict__["flags_required_for_flag_condition"] = self.__class__.flags_required_for_flag_condition - for cond in self.__class__.flags_required_for_flag_condition: + + self._flags_required_by_semantic_flag_group = {} + self.__dict__["flags_required_for_semantic_flag_group"] = self.__class__.flags_required_for_semantic_flag_group + for group in self.__class__.flags_required_for_semantic_flag_group: flags = [] - for flag in self.__class__.flags_required_for_flag_condition[cond]: + for flag in self.__class__.flags_required_for_semantic_flag_group[group]: flags.append(self._flags[flag]) - self._flags_required_for_flag_condition[cond] = flags + self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flags + + self._flag_conditions_for_semantic_flag_group = {} + self.__dict__["flag_conditions_for_semantic_flag_group"] = self.__class__.flag_conditions_for_semantic_flag_group + for group in self.__class__.flag_conditions_for_semantic_flag_group: + class_cond = {} + for sem_class in self.__class__.flag_conditions_for_semantic_flag_group[group]: + if sem_class is None: + class_cond[0] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] + else: + class_cond[self._semantic_flag_classes[sem_class]] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] + self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_cond self._flags_written_by_flag_write_type = {} self.__dict__["flags_written_by_flag_write_type"] = self.__class__.flags_written_by_flag_write_type @@ -386,10 +502,21 @@ class Architecture(object): flags.append(self._flags[flag]) self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flags + self._semantic_class_for_flag_write_type = {} + self.__dict__["semantic_class_for_flag_write_type"] = self.__class__.semantic_class_for_flag_write_type + for write_type in self.__class__.semantic_class_for_flag_write_type: + sem_class = self.__class__.semantic_class_for_flag_write_type[write_type] + if sem_class in self._semantic_flag_classes: + sem_class_index = self._semantic_flag_classes[sem_class] + else: + sem_class_index = 0 + self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class_index + self.__dict__["global_regs"] = self.__class__.global_regs self._pending_reg_lists = {} self._pending_token_lists = {} + self._pending_condition_lists = {} def __eq__(self, value): if not isinstance(value, Architecture): @@ -605,6 +732,24 @@ class Architecture(object): log.log_error(traceback.format_exc()) return core.BNAllocString("") + def _get_semantic_flag_class_name(self, ctxt, sem_class): + try: + if sem_class in self._semantic_flag_class_by_index: + return core.BNAllocString(self._semantic_flag_class_by_index[sem_class]) + return core.BNAllocString("") + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + return core.BNAllocString("") + + def _get_semantic_flag_group_name(self, ctxt, sem_group): + try: + if sem_group in self._semantic_flag_group_by_index: + return core.BNAllocString(self._semantic_flag_group_by_index[sem_group]) + return core.BNAllocString("") + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + return core.BNAllocString("") + def _get_full_width_registers(self, ctxt, count): try: regs = self._full_width_regs.values() @@ -652,11 +797,11 @@ class Architecture(object): def _get_all_flag_write_types(self, ctxt, count): try: - types = self._flag_write_types_by_index.keys() - count[0] = len(types) - type_buf = (ctypes.c_uint * len(types))() - for i in xrange(0, len(types)): - type_buf[i] = types[i] + write_types = self._flag_write_types_by_index.keys() + count[0] = len(write_types) + type_buf = (ctypes.c_uint * len(write_types))() + for i in xrange(0, len(write_types)): + type_buf[i] = write_types[i] result = ctypes.cast(type_buf, ctypes.c_void_p) self._pending_reg_lists[result.value] = (result, type_buf) return result.value @@ -665,6 +810,36 @@ class Architecture(object): count[0] = 0 return None + def _get_all_semantic_flag_classes(self, ctxt, count): + try: + sem_classes = self._semantic_flag_classes_by_index.keys() + count[0] = len(sem_classes) + class_buf = (ctypes.c_uint * len(sem_classes))() + for i in xrange(0, len(sem_classes)): + class_buf[i] = sem_classes[i] + result = ctypes.cast(class_buf, ctypes.c_void_p) + self._pending_reg_lists[result.value] = (result, class_buf) + return result.value + except KeyError: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _get_all_semantic_flag_groups(self, ctxt, count): + try: + sem_groups = self._semantic_flag_groups_by_index.keys() + count[0] = len(sem_groups) + group_buf = (ctypes.c_uint * len(sem_groups))() + for i in xrange(0, len(sem_groups)): + group_buf[i] = sem_groups[i] + result = ctypes.cast(group_buf, ctypes.c_void_p) + self._pending_reg_lists[result.value] = (result, group_buf) + return result.value + except KeyError: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + def _get_flag_role(self, ctxt, flag): try: if flag in self._flag_roles: @@ -674,12 +849,16 @@ class Architecture(object): log.log_error(traceback.format_exc()) return None - def _get_flags_required_for_flag_condition(self, ctxt, cond, count): + def _get_flags_required_for_flag_condition(self, ctxt, cond, sem_class, count): try: - if cond in self._flags_required_for_flag_condition: - flags = self._flags_required_for_flag_condition[cond] + if sem_class in self._semantic_flag_classes_by_index: + sem_class = self._semantic_flag_classes_by_index[sem_class] else: - flags = [] + sem_class = 0 + flag_names = self.perform_get_flags_required_for_flag_condition(cond, sem_class) + flags = [] + for name in flag_names: + flags.append(self._flags[name]) count[0] = len(flags) flag_buf = (ctypes.c_uint * len(flags))() for i in xrange(0, len(flags)): @@ -692,6 +871,59 @@ class Architecture(object): count[0] = 0 return None + def perform_get_flags_required_for_flag_condition(self, cond, sem_class): + if cond in self.flags_required_for_flag_condition: + return self.flags_required_for_flag_condition[cond] + return [] + + def _get_flags_required_for_semantic_flag_group(self, ctxt, sem_group, count): + try: + if sem_group in self._flags_required_by_semantic_flag_group: + flags = self._flags_required_by_semantic_flag_group[sem_group] + else: + flags = [] + count[0] = len(flags) + flag_buf = (ctypes.c_uint * len(flags))() + for i in xrange(0, len(flags)): + flag_buf[i] = flags[i] + result = ctypes.cast(flag_buf, ctypes.c_void_p) + self._pending_reg_lists[result.value] = (result, flag_buf) + return result.value + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _get_flag_conditions_for_semantic_flag_group(self, ctxt, sem_group, count): + try: + if sem_group in self._flag_conditions_by_semantic_flag_group: + class_cond = self._flag_conditions_by_semantic_flag_group[sem_group] + else: + class_cond = {} + count[0] = len(class_cond) + cond_buf = (core.BNFlagConditionForSemanticClass * len(class_cond))() + i = 0 + for class_index in class_cond.keys(): + cond_buf[i].semanticClass = class_index + cond_buf[i].condition = class_cond[class_index] + i += 1 + result = ctypes.cast(cond_buf, ctypes.c_void_p) + self._pending_conditions[result.value] = (result, cond_buf) + return result.value + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _free_flag_conditions_for_semantic_flag_group(self, ctxt, conditions): + try: + buf = ctypes.cast(conditions, ctypes.c_void_p) + if buf.value not in self._pending_conditions: + raise ValueError("freeing condition list that wasn't allocated") + del self._pending_conditions[buf.value] + except (ValueError, KeyError): + log.log_error(traceback.format_exc()) + def _get_flags_written_by_flag_write_type(self, ctxt, write_type, count): try: if write_type in self._flags_written_by_flag_write_type: @@ -710,6 +942,16 @@ class Architecture(object): count[0] = 0 return None + def _get_semantic_class_for_flag_write_type(self, ctxt, write_type): + try: + if write_type in self._semantic_class_for_flag_write_type: + return self._semantic_class_for_flag_write_type[write_type] + else: + return 0 + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + return 0 + def _get_flag_write_low_level_il(self, ctxt, op, size, write_type, flag, operands, operand_count, il): try: write_type_name = None @@ -730,9 +972,25 @@ class Architecture(object): log.log_error(traceback.format_exc()) return False - def _get_flag_condition_low_level_il(self, ctxt, cond, il): + def _get_flag_condition_low_level_il(self, ctxt, cond, sem_class, il): try: - return self.perform_get_flag_condition_low_level_il(cond, + if sem_class in self._semantic_flag_classes_by_index: + sem_class_name = self._semantic_flag_classes_by_index[sem_class] + else: + sem_class_name = None + return self.perform_get_flag_condition_low_level_il(cond, sem_class_name, + lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))).index + except OSError: + log.log_error(traceback.format_exc()) + return 0 + + def _get_semantic_flag_group_low_level_il(self, ctxt, sem_group, il): + try: + if sem_group in self._semantic_flag_groups_by_index: + sem_group_name = self._semantic_flag_groups_by_index[sem_group] + else: + sem_group_name = None + return self.perform_get_semantic_flag_group_low_level_il(sem_group_name, lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))).index except OSError: log.log_error(traceback.format_exc()) @@ -1054,17 +1312,30 @@ class Architecture(object): return self.get_default_flag_write_low_level_il(op, size, self._flag_roles[flag], operands, il) @abc.abstractmethod - def perform_get_flag_condition_low_level_il(self, cond, il): + def perform_get_flag_condition_low_level_il(self, cond, sem_class, il): """ .. note:: Architecture subclasses should implement this method. .. warning:: This method should never be called directly. - :param LowLevelILFlagCondition cond: - :param LowLevelILFunction il: + :param LowLevelILFlagCondition cond: Flag condition to be computed + :param str sem_class: Semantic class to be used (None for default semantics) + :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to :rtype: LowLevelILExpr """ return self.get_default_flag_condition_low_level_il(cond, il) + @abc.abstractmethod + def perform_get_semantic_flag_group_low_level_il(self, sem_group, il): + """ + .. note:: Architecture subclasses should implement this method. + .. warning:: This method should never be called directly. + + :param str sem_group: Semantic group to be computed + :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to + :rtype: LowLevelILExpr + """ + return il.unimplemented() + @abc.abstractmethod def perform_assemble(self, code, addr): """ @@ -1407,6 +1678,22 @@ class Architecture(object): return flag.index return flag + def get_semantic_flag_class_index(self, sem_class): + if sem_class is None: + return 0 + elif isinstance(sem_class, str): + return self._semantic_flag_classes[sem_class] + elif isinstance(sem_class, lowlevelil.ILSemanticFlagClass): + return sem_class.index + return sem_class + + def get_semantic_flag_group_index(self, sem_group): + if isinstance(sem_group, str): + return self._semantic_flag_groups[sem_group] + elif isinstance(sem_group, lowlevelil.ILSemanticFlagGroup): + return sem_group.index + return sem_group + def get_flag_write_type_name(self, write_type): """ ``get_flag_write_type_name`` gets the flag write type name for the given flag. @@ -1437,6 +1724,26 @@ class Architecture(object): """ return self._flag_write_types[write_type] + def get_semantic_flag_class_by_name(self, sem_class): + """ + ``get_semantic_flag_class_by_name`` gets the semantic flag class index by name. + + :param int sem_class: semantic flag class + :return: semantic flag class index + :rtype: str + """ + return self._semantic_flag_classes[sem_class] + + def get_semantic_flag_group_by_name(self, sem_group): + """ + ``get_semantic_flag_group_by_name`` gets the semantic flag group index by name. + + :param int sem_group: semantic flag group + :return: semantic flag group index + :rtype: str + """ + return self._semantic_flag_groups[sem_group] + def get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): """ :param LowLevelILOperation op: @@ -1502,6 +1809,25 @@ class Architecture(object): """ return lowlevelil.LowLevelILExpr(core.BNGetDefaultArchitectureFlagConditionLowLevelIL(self.handle, cond, il.handle)) + def get_semantic_flag_group_low_level_il(self, sem_group, il): + """ + :param str sem_group: + :param LowLevelILFunction il: + :rtype: LowLevelILExpr + """ + group_index = self.get_semantic_flag_group_index(sem_group) + return lowlevelil.LowLevelILExpr(core.BNGetArchitectureSemanticFlagGroupLowLevelIL(self.handle, group_index, il.handle)) + + def get_flags_required_for_flag_condition(self, cond, sem_class = None): + sem_class = self.get_semantic_flag_class_index(sem_class) + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, sem_class, count) + flag_names = [] + for i in xrange(0, count.value): + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + return flag_names + def get_modified_regs_on_write(self, reg): """ ``get_modified_regs_on_write`` returns a list of register names that are modified when ``reg`` is written. diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 42c34ee0..a2d77c9f 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -99,6 +99,38 @@ class ILFlag(object): return self.name +class ILSemanticFlagClass(object): + def __init__(self, arch, sem_class): + self.arch = arch + self.index = sem_class + self.name = self.arch.get_semantic_flag_class_name(self.index) + + def __str__(self): + return self.name + + def __repr__(self): + return self.name + + def __eq__(self, other): + return self.index == other.index + + +class ILSemanticFlagGroup(object): + def __init__(self, arch, sem_group): + self.arch = arch + self.index = sem_group + self.name = self.arch.get_semantic_flag_group_name(self.index) + + def __str__(self): + return self.name + + def __repr__(self): + return self.name + + def __eq__(self, other): + return self.index == other.index + + class SSARegister(object): def __init__(self, reg, version): self.reg = reg @@ -202,7 +234,8 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_NORET: [], LowLevelILOperation.LLIL_IF: [("condition", "expr"), ("true", "int"), ("false", "int")], LowLevelILOperation.LLIL_GOTO: [("dest", "int")], - LowLevelILOperation.LLIL_FLAG_COND: [("condition", "cond")], + LowLevelILOperation.LLIL_FLAG_COND: [("condition", "cond", "semantic_class", "sem_class")], + LowLevelILOperation.LLIL_FLAG_GROUP: [("semantic_group", "sem_group")], LowLevelILOperation.LLIL_CMP_E: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_CMP_NE: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_CMP_SLT: [("left", "expr"), ("right", "expr")], @@ -238,6 +271,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_FCMP_LE: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_FCMP_GE: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_FCMP_GT: [("left", "expr"), ("right", "expr")], + LowLevelILOperation.LLIL_FCMP_O: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_FCMP_UO: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_SET_REG_SSA: [("dest", "reg_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [("full_reg", "reg_ssa"), ("dest", "reg"), ("src", "expr")], @@ -324,6 +358,10 @@ class LowLevelILInstruction(object): flag = ILFlag(func.arch, instr.operands[i]) i += 1 value = SSAFlag(flag, instr.operands[i]) + elif operand_type == "sem_class": + value = ILSemanticFlagClass(func.arch, instr.operands[i]) + elif operand_type == "sem_group": + value = ILSemanticFlagGroup(func.arch, instr.operands[i]) elif operand_type == "cond": value = LowLevelILFlagCondition(instr.operands[i]) elif operand_type == "int_list": @@ -1507,11 +1545,12 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_NORET) - def flag_condition(self, cond): + def flag_condition(self, cond, sem_class = None): """ ``flag_condition`` returns a flag_condition expression for the given LowLevelILFlagCondition :param LowLevelILFlagCondition cond: Flag condition expression to retrieve + :param str sem_class: Optional semantic flag class :return: A flag_condition expression :rtype: LowLevelILExpr """ @@ -1519,7 +1558,19 @@ class LowLevelILFunction(object): cond = LowLevelILFlagCondition[cond] elif isinstance(cond, LowLevelILFlagCondition): cond = cond.value - return self.expr(LowLevelILOperation.LLIL_FLAG_COND, cond) + class_index = self.arch.get_semantic_flag_class_index(sem_class) + return self.expr(LowLevelILOperation.LLIL_FLAG_COND, cond, class_index) + + def flag_group(self, sem_group): + """ + ``flag_group`` returns a flag_group expression for the given semantic flag group + + :param str sem_group: Semantic flag group to access + :return: A flag_group expression + :rtype: LowLevelILExpr + """ + group = self.arch.get_semantic_flag_group_index(sem_group) + return self.expr(LowLevelILOperation.LLIL_FLAG_GROUP, group) def compare_equal(self, size, a, b): """ @@ -2174,6 +2225,7 @@ class LowLevelILBasicBlock(basicblock.BasicBlock): def __hash__(self): return hash((self.start, self.end, self.il_function)) + def LLIL_TEMP(n): return n | 0x80000000 diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 85feba0a..8594ea36 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -169,6 +169,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_FCMP_LE: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_FCMP_GE: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_FCMP_GT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_FCMP_O: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_FCMP_UO: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA: [("dest", "var_ssa"), ("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA_FIELD: [("prev", "var_ssa_dest_and_src"), ("offset", "int"), ("src", "expr")], -- cgit v1.3.1 From bbf3e6901902fb4193eb8194d09675590cd7ba1c Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 16 Jan 2018 19:01:29 -0500 Subject: update open source documentation with qt 5.10 build information --- docs/about/open-source.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/about/open-source.md b/docs/about/open-source.md index 9f385633..a25fb24e 100644 --- a/docs/about/open-source.md +++ b/docs/about/open-source.md @@ -42,12 +42,12 @@ The previous tools are used in the generation of our documentation, but are not ## Building Qt -Binary Ninja uses [Qt 5.6] under an LGPLv3 license which requires that we host the original sources used to build Qt for our application along with instructions on how that source may be re-built and can replace the version of Qt shipped with Binary Ninja. +Binary Ninja uses [Qt 5.10] under an LGPLv3 license which requires that we host the original sources used to build Qt for our application along with instructions on how that source may be re-built and can replace the version of Qt shipped with Binary Ninja. Please note that we offer no support for running Binary Ninja with modified Qt libraries. 1. Follow the installation requirements on the [Building Qt 5 from Git] page. -2. Download the Qt 5.6.0 [tarball] from binary.ninja. (Note this is an unmodified 5.6 identical to that available from Qt's source control, but must be hosted locally according to the [Qt 5.6] terms.) +2. Download the Qt 5.10.0 [tarball] from binary.ninja. (Note this is an unmodified 5.10 identical to that available from Qt's source control, but must be hosted locally according to the [Qt 5.10] terms.) 3. Next, build QT using the aforementioned instructions. 4. On OS X, you will need to disable the code-signing signature since it would otherwise prevent changes to binaries or shared libraries. We recommend a tool such as [unsign]. 5. Finally, replace the built libraries: @@ -56,7 +56,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l - On Linux, replace the `libQt5Core.so.5`, `libQt5DBus.so.5`, `libQt5Gui.so.5`, `libQt5Network.so.5`, `libQt5Widgets.so.5`, `libQt5XcbQpa.so.5` files wherever Binary Ninja was extracted [Building Qt 5 from Git]: https://wiki.qt.io/Building-Qt-5-from-Git -[Qt 5.6]: https://www.qt.io/qt-licensing-terms/ +[Qt 5.10]: https://www.qt.io/qt-licensing-terms/ [capstone]: https://github.com/aquynh/capstone [capstone license]: https://github.com/aquynh/capstone/blob/master/LICENSE.TXT [breathe license]: https://github.com/michaeljones/breathe/blob/master/LICENSE @@ -97,7 +97,7 @@ Please note that we offer no support for running Binary Ninja with modified Qt l [sphinx]: http://www.sphinx-doc.org/en/stable/index.html [sqlite license]: https://www.sqlite.org/copyright.html [sqlite]: https://www.sqlite.org/index.html -[tarball]: https://binary.ninja/qt5.6.0.tar.xz +[tarball]: https://binary.ninja/qt5.10.0.tar.xz [tomcrypt license]: https://github.com/libtom/libtomcrypt/blob/develop/LICENSE [tomcrypt]: https://github.com/libtom/libtomcrypt [unsign]: https://github.com/steakknife/unsign -- cgit v1.3.1 From 6580ae315ea60d630625f7f8592ebddfc95bf563 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 16 Jan 2018 19:01:51 -0500 Subject: fix slack badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index bfa453d0..74788a28 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![slack](https://binaryninja-slack-hwwdinrdce.now.sh/badge.svg)](https://binaryninja-slack-hwwdinrdce.now.sh/) +[![slack](https://slackin-sbhuzyheck.now.sh/badge.svg)](https://binaryninja-slack-hwwdinrdce.now.sh/) # Binary Ninja API -- cgit v1.3.1 From 1228e32e300d62f5d76438e4500965d76edeca69 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 18 Jan 2018 20:15:04 -0500 Subject: Allow flag roles to be dependent on semantic class --- architecture.cpp | 23 ++++++++++++----------- binaryninjaapi.h | 11 ++++++----- binaryninjacore.h | 10 ++++++---- lowlevelilinstruction.cpp | 7 ++++--- python/architecture.py | 42 ++++++++++++++++++++++++++++++++---------- 5 files changed, 60 insertions(+), 33 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 571794c6..78a67105 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -318,10 +318,10 @@ uint32_t* Architecture::GetAllSemanticFlagGroupsCallback(void* ctxt, size_t* cou } -BNFlagRole Architecture::GetFlagRoleCallback(void* ctxt, uint32_t flag) +BNFlagRole Architecture::GetFlagRoleCallback(void* ctxt, uint32_t flag, uint32_t semClass) { Architecture* arch = (Architecture*)ctxt; - return arch->GetFlagRole(flag); + return arch->GetFlagRole(flag, semClass); } @@ -780,7 +780,7 @@ vector Architecture::GetAllSemanticFlagGroups() } -BNFlagRole Architecture::GetFlagRole(uint32_t) +BNFlagRole Architecture::GetFlagRole(uint32_t, uint32_t) { return SpecialFlagRole; } @@ -819,8 +819,7 @@ uint32_t Architecture::GetSemanticClassForFlagWriteType(uint32_t) size_t Architecture::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount,LowLevelILFunction& il) { - (void)flagWriteType; - BNFlagRole role = GetFlagRole(flag); + BNFlagRole role = GetFlagRole(flag, GetSemanticClassForFlagWriteType(flagWriteType)); return BNGetDefaultArchitectureFlagWriteLowLevelIL(m_object, op, size, role, operands, operandCount, il.GetObject()); } @@ -834,15 +833,17 @@ size_t Architecture::GetDefaultFlagWriteLowLevelIL(BNLowLevelILOperation op, siz } -ExprId Architecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, uint32_t, LowLevelILFunction& il) +ExprId Architecture::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) { - return BNGetDefaultArchitectureFlagConditionLowLevelIL(m_object, cond, il.GetObject()); + return BNGetDefaultArchitectureFlagConditionLowLevelIL(m_object, cond, semClass, il.GetObject()); } -ExprId Architecture::GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il) +ExprId Architecture::GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) { - return BNGetDefaultArchitectureFlagConditionLowLevelIL(m_object, cond, il.GetObject()); + return BNGetDefaultArchitectureFlagConditionLowLevelIL(m_object, cond, semClass, il.GetObject()); } @@ -1325,9 +1326,9 @@ vector CoreArchitecture::GetAllSemanticFlagGroups() } -BNFlagRole CoreArchitecture::GetFlagRole(uint32_t flag) +BNFlagRole CoreArchitecture::GetFlagRole(uint32_t flag, uint32_t semClass) { - return BNGetArchitectureFlagRole(m_object, flag); + return BNGetArchitectureFlagRole(m_object, flag, semClass); } diff --git a/binaryninjaapi.h b/binaryninjaapi.h index cbd51d05..b74fa971 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1609,7 +1609,7 @@ namespace BinaryNinja static uint32_t* GetAllFlagWriteTypesCallback(void* ctxt, size_t* count); static uint32_t* GetAllSemanticFlagClassesCallback(void* ctxt, size_t* count); static uint32_t* GetAllSemanticFlagGroupsCallback(void* ctxt, size_t* count); - static BNFlagRole GetFlagRoleCallback(void* ctxt, uint32_t flag); + static BNFlagRole GetFlagRoleCallback(void* ctxt, uint32_t flag, uint32_t semClass); static uint32_t* GetFlagsRequiredForFlagConditionCallback(void* ctxt, BNLowLevelILFlagCondition cond, uint32_t semClass, size_t* count); static uint32_t* GetFlagsRequiredForSemanticFlagGroupCallback(void* ctxt, uint32_t semGroup, size_t* count); @@ -1687,7 +1687,7 @@ namespace BinaryNinja virtual std::vector GetAllFlagWriteTypes(); virtual std::vector GetAllSemanticFlagClasses(); virtual std::vector GetAllSemanticFlagGroups(); - virtual BNFlagRole GetFlagRole(uint32_t flag); + virtual BNFlagRole GetFlagRole(uint32_t flag, uint32_t semClass = 0); virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, uint32_t semClass = 0); virtual std::vector GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup); @@ -1699,7 +1699,7 @@ namespace BinaryNinja ExprId GetDefaultFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, BNFlagRole role, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il); virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, uint32_t semClass, LowLevelILFunction& il); - ExprId GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, LowLevelILFunction& il); + ExprId GetDefaultFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, uint32_t semClass, LowLevelILFunction& il); virtual ExprId GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il); virtual BNRegisterInfo GetRegisterInfo(uint32_t reg); virtual uint32_t GetStackPointerRegister(); @@ -1832,7 +1832,7 @@ namespace BinaryNinja virtual std::vector GetAllFlagWriteTypes() override; virtual std::vector GetAllSemanticFlagClasses() override; virtual std::vector GetAllSemanticFlagGroups() override; - virtual BNFlagRole GetFlagRole(uint32_t flag) override; + virtual BNFlagRole GetFlagRole(uint32_t flag, uint32_t semClass = 0) override; virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, uint32_t semClass = 0) override; virtual std::vector GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup) override; @@ -2526,7 +2526,8 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackTopRelative(size_t size, uint32_t regStack, ExprId entry, const ILSourceLocation& loc = ILSourceLocation()); - ExprId RegisterStackPop(size_t size, uint32_t regStack, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackPop(size_t size, uint32_t regStack, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackTopRelativeSSA(size_t size, const SSARegisterStack& regStack, ExprId entry, const SSARegister& top, const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackAbsoluteSSA(size_t size, const SSARegisterStack& regStack, uint32_t reg, diff --git a/binaryninjacore.h b/binaryninjacore.h index 388d3643..bc58092d 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -441,7 +441,9 @@ extern "C" OverflowFlagRole = 5, HalfCarryFlagRole = 6, EvenParityFlagRole = 7, - OddParityFlagRole = 8 + OddParityFlagRole = 8, + OrderedFlagRole = 9, + UnorderedFlagRole = 10 }; enum BNFunctionGraphType @@ -1102,7 +1104,7 @@ extern "C" uint32_t* (*getAllFlagWriteTypes)(void* ctxt, size_t* count); uint32_t* (*getAllSemanticFlagClasses)(void* ctxt, size_t* count); uint32_t* (*getAllSemanticFlagGroups)(void* ctxt, size_t* count); - BNFlagRole (*getFlagRole)(void* ctxt, uint32_t flag); + BNFlagRole (*getFlagRole)(void* ctxt, uint32_t flag, uint32_t semClass); uint32_t* (*getFlagsRequiredForFlagCondition)(void* ctxt, BNLowLevelILFlagCondition cond, uint32_t semClass, size_t* count); uint32_t* (*getFlagsRequiredForSemanticFlagGroup)(void* ctxt, uint32_t semGroup, size_t* count); @@ -2078,7 +2080,7 @@ extern "C" BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureFlagWriteTypes(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureSemanticFlagClasses(BNArchitecture* arch, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureSemanticFlagGroups(BNArchitecture* arch, size_t* count); - BINARYNINJACOREAPI BNFlagRole BNGetArchitectureFlagRole(BNArchitecture* arch, uint32_t flag); + BINARYNINJACOREAPI BNFlagRole BNGetArchitectureFlagRole(BNArchitecture* arch, uint32_t flag, uint32_t semClass); BINARYNINJACOREAPI uint32_t* BNGetArchitectureFlagsRequiredForFlagCondition(BNArchitecture* arch, BNLowLevelILFlagCondition cond, uint32_t semClass, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetArchitectureFlagsRequiredForSemanticFlagGroup(BNArchitecture* arch, @@ -2097,7 +2099,7 @@ extern "C" BINARYNINJACOREAPI size_t BNGetArchitectureFlagConditionLowLevelIL(BNArchitecture* arch, BNLowLevelILFlagCondition cond, uint32_t semClass, BNLowLevelILFunction* il); BINARYNINJACOREAPI size_t BNGetDefaultArchitectureFlagConditionLowLevelIL(BNArchitecture* arch, BNLowLevelILFlagCondition cond, - BNLowLevelILFunction* il); + uint32_t semClass, BNLowLevelILFunction* il); BINARYNINJACOREAPI size_t BNGetArchitectureSemanticFlagGroupLowLevelIL(BNArchitecture* arch, uint32_t semGroup, BNLowLevelILFunction* il); BINARYNINJACOREAPI uint32_t* BNGetModifiedArchitectureRegistersOnWrite(BNArchitecture* arch, uint32_t reg, size_t* count); diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 4b1acff3..9909e8ee 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -1680,7 +1680,7 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, return dest->RegisterStackTopRelative(size, GetSourceRegisterStack(), subExprHandler(GetSourceExpr()), *this); case LLIL_REG_STACK_POP: - return dest->RegisterStackPop(size, GetSourceRegisterStack(), *this); + return dest->RegisterStackPop(size, GetSourceRegisterStack(), flags, *this); case LLIL_REG_STACK_REL_SSA: return dest->RegisterStackTopRelativeSSA(size, GetSourceSSARegisterStack(), subExprHandler(GetSourceExpr()), @@ -1827,6 +1827,7 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_FCMP_LE: case LLIL_FCMP_GE: case LLIL_FCMP_GT: + case LLIL_FCMP_O: case LLIL_FCMP_UO: return dest->AddExprWithLocation(operation, *this, size, flags, subExprHandler(AsTwoOperand().GetLeftExpr()), subExprHandler(AsTwoOperand().GetRightExpr())); @@ -2435,9 +2436,9 @@ ExprId LowLevelILFunction::RegisterStackTopRelative(size_t size, uint32_t regSta } -ExprId LowLevelILFunction::RegisterStackPop(size_t size, uint32_t regStack, const ILSourceLocation& loc) +ExprId LowLevelILFunction::RegisterStackPop(size_t size, uint32_t regStack, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_REG_STACK_POP, loc, size, 0, regStack); + return AddExprWithLocation(LLIL_REG_STACK_POP, loc, size, flags, regStack); } diff --git a/python/architecture.py b/python/architecture.py index d2ab586e..2b422962 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -208,7 +208,7 @@ class Architecture(object): self._flag_roles = {} self.__dict__["flag_roles"] = {} for flag in self.__dict__["flags"]: - role = FlagRole(core.BNGetArchitectureFlagRole(self.handle, self._flags[flag])) + role = FlagRole(core.BNGetArchitectureFlagRole(self.handle, self._flags[flag], 0)) self.__dict__["flag_roles"][flag] = role self._flag_roles[self._flags[flag]] = role @@ -840,21 +840,28 @@ class Architecture(object): count[0] = 0 return None - def _get_flag_role(self, ctxt, flag): + def _get_flag_role(self, ctxt, flag, sem_class): try: - if flag in self._flag_roles: - return self._flag_roles[flag] - return FlagRole.SpecialFlagRole + if sem_class in self._semantic_flag_classes_by_index: + sem_class = self._semantic_flag_classes_by_index[sem_class] + else: + sem_class = None + return self.perform_get_flag_role(flag, sem_class) except KeyError: log.log_error(traceback.format_exc()) - return None + return FlagRole.SpecialFlagRole + + def perform_get_flag_role(self, flag, sem_class): + if flag in self._flag_roles: + return self._flag_roles[flag] + return FlagRole.SpecialFlagRole def _get_flags_required_for_flag_condition(self, ctxt, cond, sem_class, count): try: if sem_class in self._semantic_flag_classes_by_index: sem_class = self._semantic_flag_classes_by_index[sem_class] else: - sem_class = 0 + sem_class = None flag_names = self.perform_get_flags_required_for_flag_condition(cond, sem_class) flags = [] for name in flag_names: @@ -1322,7 +1329,7 @@ class Architecture(object): :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to :rtype: LowLevelILExpr """ - return self.get_default_flag_condition_low_level_il(cond, il) + return self.get_default_flag_condition_low_level_il(cond, sem_class, il) @abc.abstractmethod def perform_get_semantic_flag_group_low_level_il(self, sem_group, il): @@ -1744,6 +1751,19 @@ class Architecture(object): """ return self._semantic_flag_groups[sem_group] + def get_flag_role(self, flag, sem_class = None): + """ + ``get_flag_role`` gets the role of a given flag. + + :param int flag: flag + :param int sem_class: optional semantic flag class + :return: flag role + :rtype: FlagRole + """ + flag = self.get_flag_index(flag) + sem_class = self.get_semantic_flag_class_index(sem_class) + return FlagRole(core.BNGetArchitectureFlagRole(self.handle, flag, sem_class)) + def get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): """ :param LowLevelILOperation op: @@ -1801,13 +1821,15 @@ class Architecture(object): """ return lowlevelil.LowLevelILExpr(core.BNGetArchitectureFlagConditionLowLevelIL(self.handle, cond, il.handle)) - def get_default_flag_condition_low_level_il(self, cond, il): + def get_default_flag_condition_low_level_il(self, cond, sem_class, il): """ :param LowLevelILFlagCondition cond: :param LowLevelILFunction il: + :param str sem_class: :rtype: LowLevelILExpr """ - return lowlevelil.LowLevelILExpr(core.BNGetDefaultArchitectureFlagConditionLowLevelIL(self.handle, cond, il.handle)) + class_index = self.get_semantic_flag_class_index(sem_class) + return lowlevelil.LowLevelILExpr(core.BNGetDefaultArchitectureFlagConditionLowLevelIL(self.handle, cond, class_index, il.handle)) def get_semantic_flag_group_low_level_il(self, sem_group, il): """ -- cgit v1.3.1 From 80a5b6d9bca0b0ef4d2a7d33b632d558d6d9b0f0 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Mon, 22 Jan 2018 23:57:00 -0500 Subject: Add Access to Background Analysis Task. --- binaryninjaapi.h | 2 ++ binaryninjacore.h | 1 + binaryview.cpp | 10 ++++++++++ 3 files changed, 13 insertions(+) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index d357e5bc..d1b6f5f5 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -486,6 +486,7 @@ namespace BinaryNinja }; class Architecture; + class BackgroundTask; class Platform; class Type; class DataBuffer; @@ -1266,6 +1267,7 @@ namespace BinaryNinja Ref AddAnalysisCompletionEvent(const std::function& callback); BNAnalysisProgress GetAnalysisProgress(); + Ref GetBackgroundAnalysisTask(); uint64_t GetNextFunctionStartAfterAddress(uint64_t addr); uint64_t GetNextBasicBlockStartAfterAddress(uint64_t addr); diff --git a/binaryninjacore.h b/binaryninjacore.h index 245e6353..e9ef7c7a 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2232,6 +2232,7 @@ extern "C" BINARYNINJACOREAPI void BNCancelAnalysisCompletionEvent(BNAnalysisCompletionEvent* event); BINARYNINJACOREAPI BNAnalysisProgress BNGetAnalysisProgress(BNBinaryView* view); + BINARYNINJACOREAPI BNBackgroundTask* BNGetBackgroundAnalysisTask(BNBinaryView* view); BINARYNINJACOREAPI uint64_t BNGetNextFunctionStartAfterAddress(BNBinaryView* view, uint64_t addr); BINARYNINJACOREAPI uint64_t BNGetNextBasicBlockStartAfterAddress(BNBinaryView* view, uint64_t addr); diff --git a/binaryview.cpp b/binaryview.cpp index 0ee428e1..96fd161d 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -1351,6 +1351,16 @@ BNAnalysisProgress BinaryView::GetAnalysisProgress() } +Ref BinaryView::GetBackgroundAnalysisTask() +{ + BNBackgroundTask* task = BNGetBackgroundAnalysisTask(m_object); + if (!task) + return nullptr; + + return new BackgroundTask(BNNewBackgroundTaskReference(task)); +} + + uint64_t BinaryView::GetNextFunctionStartAfterAddress(uint64_t addr) { return BNGetNextFunctionStartAfterAddress(m_object, addr); -- cgit v1.3.1 From a5328d944c9ba71e67ad2607d0a7f943f91645c2 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Thu, 25 Jan 2018 10:30:43 -0500 Subject: fixes #912 --- python/types.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/python/types.py b/python/types.py index 27b4828f..feb256d0 100644 --- a/python/types.py +++ b/python/types.py @@ -471,6 +471,7 @@ class Type(object): :param int width: width of the integer in bytes :param bool sign: optional variable representing signedness + :param string altname: alternate name for type """ if sign is None: sign = BoolWithConfidence(True, confidence = 0) @@ -484,8 +485,14 @@ class Type(object): return Type(core.BNCreateIntegerType(width, sign_conf, altname)) @classmethod - def float(self, width): - return Type(core.BNCreateFloatType(width)) + def float(self, width, altname=""): + """ + ``float`` class method for creating an floating point Types. + + :param int width: width of the floating point number in bytes + :param string altname: alternate name for type + """ + return Type(core.BNCreateFloatType(width, altname)) @classmethod def structure_type(self, structure_type): -- cgit v1.3.1 From c352fec480dde5321a0c52850be1bb8a3df9bbd3 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Sat, 27 Jan 2018 11:12:47 -0500 Subject: fix blocks to function in documentation and another small typo --- docs/getting-started.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/getting-started.md b/docs/getting-started.md index 88945f7b..e34121c1 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -210,15 +210,15 @@ By default the interactive python prompt has a number of convenient helper funct - `bv` / `current_view` / : the current [BinaryView](https://api.binary.ninja/binaryninja.BinaryView.html) - `current_function`: the current [Function](https://api.binary.ninja/binaryninja.Function.html) - `current_basic_block`: the current [BasicBlock](https://api.binary.ninja/binaryninja.BasicBlock.html) -- `current_llil`: the current [LowLevelILBasicBlock](https://api.binary.ninja/binaryninja.lowlevelil.LowLevelILBasicBlock.html) -- `current_mlil`: the current [MediumLevelILBasicBlock](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILBasicBlock.html) +- `current_llil`: the current [LowLevelILFunction](https://api.binary.ninja/binaryninja.lowlevelil.LowLevelILFunction.html) +- `current_mlil`: the current [MediumLevelILFunction](https://api.binary.ninja/binaryninja.mediumlevelil.MediumLevelILFunction.html) - `current_selection`: a tuple of the start and end addresses of the current selection - `write_at_cursor(data)`: function that writes data to the start of the current selection - `get_selected_data()`: function that returns the data in the current selection Note !!! Tip "Note" - The current script console only supports Python at the moment, but it's fully extensible for other programming languages for advanced users who with to implement their own bindings. + The current script console only supports Python at the moment, but it's fully extensible for other programming languages for advanced users who wish to implement their own bindings. ## Using Plugins -- cgit v1.3.1 From 2f3873928078e8c21911ffeb5476781b31886514 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 31 Jan 2018 20:24:16 -0500 Subject: Adding CPU intrinsics support --- architecture.cpp | 159 +++++++++++++++++++ binaryninjaapi.h | 39 +++++ binaryninjacore.h | 40 ++++- lowlevelil.cpp | 25 +++ lowlevelilinstruction.cpp | 355 ++++++++++++++++++++++++++++++++++++++++++- lowlevelilinstruction.h | 129 ++++++++++++++++ mediumlevelilinstruction.cpp | 71 ++++++++- mediumlevelilinstruction.h | 20 +++ python/architecture.py | 154 +++++++++++++++++++ python/function.py | 23 ++- python/lowlevelil.py | 109 ++++++++++--- python/mediumlevelil.py | 4 + 12 files changed, 1095 insertions(+), 33 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 78a67105..223af13d 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -491,6 +491,79 @@ void Architecture::GetRegisterStackInfoCallback(void* ctxt, uint32_t regStack, B } +char* Architecture::GetIntrinsicNameCallback(void* ctxt, uint32_t intrinsic) +{ + Architecture* arch = (Architecture*)ctxt; + string result = arch->GetIntrinsicName(intrinsic); + return BNAllocString(result.c_str()); +} + + +uint32_t* Architecture::GetAllIntrinsicsCallback(void* ctxt, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector regs = arch->GetAllIntrinsics(); + *count = regs.size(); + + uint32_t* result = new uint32_t[regs.size()]; + for (size_t i = 0; i < regs.size(); i++) + result[i] = regs[i]; + return result; +} + + +BNNameAndType* Architecture::GetIntrinsicInputsCallback(void* ctxt, uint32_t intrinsic, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector inputs = arch->GetIntrinsicInputs(intrinsic); + *count = inputs.size(); + + BNNameAndType* result = new BNNameAndType[inputs.size()]; + for (size_t i = 0; i < inputs.size(); i++) + { + result[i].name = BNAllocString(inputs[i].name.c_str()); + result[i].type = BNNewTypeReference(inputs[i].type.GetValue()->GetObject()); + result[i].typeConfidence = inputs[i].type.GetConfidence(); + } + return result; +} + + +void Architecture::FreeNameAndTypeListCallback(void*, BNNameAndType* nt, size_t count) +{ + for (size_t i = 0; i < count; i++) + { + BNFreeString(nt[i].name); + BNFreeType(nt[i].type); + } + delete[] nt; +} + + +BNTypeWithConfidence* Architecture::GetIntrinsicOutputsCallback(void* ctxt, uint32_t intrinsic, size_t* count) +{ + Architecture* arch = (Architecture*)ctxt; + vector>> outputs = arch->GetIntrinsicOutputs(intrinsic); + *count = outputs.size(); + + BNTypeWithConfidence* result = new BNTypeWithConfidence[outputs.size()]; + for (size_t i = 0; i < outputs.size(); i++) + { + result[i].type = BNNewTypeReference(outputs[i].GetValue()->GetObject()); + result[i].confidence = outputs[i].GetConfidence(); + } + return result; +} + + +void Architecture::FreeTypeListCallback(void*, BNTypeWithConfidence* types, size_t count) +{ + for (size_t i = 0; i < count; i++) + BNFreeType(types[i].type); + delete[] types; +} + + bool Architecture::AssembleCallback(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors) { Architecture* arch = (Architecture*)ctxt; @@ -612,6 +685,12 @@ void Architecture::Register(Architecture* arch) callbacks.getRegisterStackName = GetRegisterStackNameCallback; callbacks.getAllRegisterStacks = GetAllRegisterStacksCallback; callbacks.getRegisterStackInfo = GetRegisterStackInfoCallback; + callbacks.getIntrinsicName = GetIntrinsicNameCallback; + callbacks.getAllIntrinsics = GetAllIntrinsicsCallback; + callbacks.getIntrinsicInputs = GetIntrinsicInputsCallback; + callbacks.freeNameAndTypeList = FreeNameAndTypeListCallback; + callbacks.getIntrinsicOutputs = GetIntrinsicOutputsCallback; + callbacks.freeTypeList = FreeTypeListCallback; callbacks.assemble = AssembleCallback; callbacks.isNeverBranchPatchAvailable = IsNeverBranchPatchAvailableCallback; callbacks.isAlwaysBranchPatchAvailable = IsAlwaysBranchPatchAvailableCallback; @@ -920,6 +999,32 @@ uint32_t Architecture::GetRegisterStackForRegister(uint32_t reg) } +string Architecture::GetIntrinsicName(uint32_t intrinsic) +{ + char intrinsicStr[32]; + sprintf(intrinsicStr, "intrinsic_%" PRIu32, intrinsic); + return intrinsicStr; +} + + +vector Architecture::GetAllIntrinsics() +{ + return vector(); +} + + +vector Architecture::GetIntrinsicInputs(uint32_t) +{ + return vector(); +} + + +vector>> Architecture::GetIntrinsicOutputs(uint32_t) +{ + return vector>>(); +} + + vector Architecture::GetModifiedRegistersOnWrite(uint32_t reg) { size_t count; @@ -1477,6 +1582,60 @@ BNRegisterStackInfo CoreArchitecture::GetRegisterStackInfo(uint32_t regStack) } +string CoreArchitecture::GetIntrinsicName(uint32_t intrinsic) +{ + char* name = BNGetArchitectureIntrinsicName(m_object, intrinsic); + string result = name; + BNFreeString(name); + return result; +} + + +vector CoreArchitecture::GetAllIntrinsics() +{ + size_t count; + uint32_t* regs = BNGetAllArchitectureIntrinsics(m_object, &count); + + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(regs[i]); + + BNFreeRegisterList(regs); + return result; +} + + +vector CoreArchitecture::GetIntrinsicInputs(uint32_t intrinsic) +{ + size_t count; + BNNameAndType* inputs = BNGetArchitectureIntrinsicInputs(m_object, intrinsic, &count); + + vector result; + for (size_t i = 0; i < count; i++) + { + result.push_back(NameAndType(inputs[i].name, Confidence>( + new Type(BNNewTypeReference(inputs[i].type)), inputs[i].typeConfidence))); + } + + BNFreeNameAndTypeList(inputs, count); + return result; +} + + +vector>> CoreArchitecture::GetIntrinsicOutputs(uint32_t intrinsic) +{ + size_t count; + BNTypeWithConfidence* outputs = BNGetArchitectureIntrinsicOutputs(m_object, intrinsic, &count); + + vector>> result; + for (size_t i = 0; i < count; i++) + result.push_back(Confidence>(new Type(BNNewTypeReference(outputs[i].type)), outputs[i].confidence)); + + BNFreeOutputTypeList(outputs, count); + return result; +} + + bool CoreArchitecture::Assemble(const string& code, uint64_t addr, DataBuffer& result, string& errors) { char* errorStr = nullptr; diff --git a/binaryninjaapi.h b/binaryninjaapi.h index b74fa971..d1ca9cdb 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1566,6 +1566,16 @@ namespace BinaryNinja void AddBranch(BNBranchType type, uint64_t target = 0, Architecture* arch = nullptr, bool hasDelaySlot = false); }; + struct NameAndType + { + std::string name; + Confidence> type; + + NameAndType() {} + NameAndType(const Confidence>& t): type(t) {} + NameAndType(const std::string& n, const Confidence>& t): name(n), type(t) {} + }; + class LowLevelILFunction; class FunctionRecognizer; class CallingConvention; @@ -1633,6 +1643,13 @@ namespace BinaryNinja static uint32_t* GetAllRegisterStacksCallback(void* ctxt, size_t* count); static void GetRegisterStackInfoCallback(void* ctxt, uint32_t regStack, BNRegisterStackInfo* result); + static char* GetIntrinsicNameCallback(void* ctxt, uint32_t intrinsic); + static uint32_t* GetAllIntrinsicsCallback(void* ctxt, size_t* count); + static BNNameAndType* GetIntrinsicInputsCallback(void* ctxt, uint32_t intrinsic, size_t* count); + static void FreeNameAndTypeListCallback(void* ctxt, BNNameAndType* nt, size_t count); + static BNTypeWithConfidence* GetIntrinsicOutputsCallback(void* ctxt, uint32_t intrinsic, size_t* count); + static void FreeTypeListCallback(void* ctxt, BNTypeWithConfidence* types, size_t count); + static bool AssembleCallback(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); static bool IsNeverBranchPatchAvailableCallback(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); static bool IsAlwaysBranchPatchAvailableCallback(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); @@ -1714,6 +1731,11 @@ namespace BinaryNinja virtual BNRegisterStackInfo GetRegisterStackInfo(uint32_t regStack); uint32_t GetRegisterStackForRegister(uint32_t reg); + virtual std::string GetIntrinsicName(uint32_t intrinsic); + virtual std::vector GetAllIntrinsics(); + virtual std::vector GetIntrinsicInputs(uint32_t intrinsic); + virtual std::vector>> GetIntrinsicOutputs(uint32_t intrinsic); + virtual bool Assemble(const std::string& code, uint64_t addr, DataBuffer& result, std::string& errors); /*! IsNeverBranchPatchAvailable returns true if the instruction at addr can be patched to never branch. @@ -1853,6 +1875,11 @@ namespace BinaryNinja virtual std::vector GetAllRegisterStacks() override; virtual BNRegisterStackInfo GetRegisterStackInfo(uint32_t regStack) override; + virtual std::string GetIntrinsicName(uint32_t intrinsic) override; + virtual std::vector GetAllIntrinsics() override; + virtual std::vector GetIntrinsicInputs(uint32_t intrinsic) override; + virtual std::vector>> GetIntrinsicOutputs(uint32_t intrinsic) override; + virtual bool Assemble(const std::string& code, uint64_t addr, DataBuffer& result, std::string& errors) override; virtual bool IsNeverBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; @@ -2452,9 +2479,11 @@ namespace BinaryNinja }; struct LowLevelILInstruction; + struct RegisterOrFlag; struct SSARegister; struct SSARegisterStack; struct SSAFlag; + struct SSARegisterOrFlag; class LowLevelILFunction: public CoreRefCountObject @@ -2641,6 +2670,10 @@ namespace BinaryNinja ExprId TestBit(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId BoolToInt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); ExprId SystemCall(const ILSourceLocation& loc = ILSourceLocation()); + ExprId Intrinsic(const std::vector& outputs, uint32_t intrinsic, + const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); + ExprId IntrinsicSSA(const std::vector& outputs, uint32_t intrinsic, + const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); ExprId Breakpoint(const ILSourceLocation& loc = ILSourceLocation()); ExprId Trap(uint32_t num, const ILSourceLocation& loc = ILSourceLocation()); ExprId Undefined(const ILSourceLocation& loc = ILSourceLocation()); @@ -2686,9 +2719,11 @@ namespace BinaryNinja ExprId AddLabelList(const std::vector& labels); ExprId AddOperandList(const std::vector operands); ExprId AddIndexList(const std::vector operands); + ExprId AddRegisterOrFlagList(const std::vector& regs); ExprId AddSSARegisterList(const std::vector& regs); ExprId AddSSARegisterStackList(const std::vector& regStacks); ExprId AddSSAFlagList(const std::vector& flags); + ExprId AddSSARegisterOrFlagList(const std::vector& regs); ExprId GetExprForRegisterOrConstant(const BNRegisterOrConstant& operand, size_t size); ExprId GetNegExprForRegisterOrConstant(const BNRegisterOrConstant& operand, size_t size); @@ -2954,6 +2989,10 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId Breakpoint(const ILSourceLocation& loc = ILSourceLocation()); ExprId Trap(int64_t vector, const ILSourceLocation& loc = ILSourceLocation()); + ExprId Intrinsic(const std::vector& outputs, uint32_t intrinsic, + const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); + ExprId IntrinsicSSA(const std::vector& outputs, uint32_t intrinsic, + const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); ExprId Undefined(const ILSourceLocation& loc = ILSourceLocation()); ExprId Unimplemented(const ILSourceLocation& loc = ILSourceLocation()); ExprId UnimplementedMemoryRef(size_t size, ExprId target, diff --git a/binaryninjacore.h b/binaryninjacore.h index bc58092d..a946df31 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -352,6 +352,7 @@ extern "C" LLIL_SYSCALL, LLIL_BP, LLIL_TRAP, + LLIL_INTRINSIC, LLIL_UNDEF, LLIL_UNIMPL, LLIL_UNIMPL_MEM, @@ -394,11 +395,12 @@ extern "C" LLIL_FLAG_BIT_SSA, LLIL_CALL_SSA, LLIL_SYSCALL_SSA, - LLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions + LLIL_CALL_PARAM, // Only valid within the LLIL_CALL_SSA, LLIL_SYSCALL_SSA, LLIL_INTRINSIC, LLIL_INTRINSIC_SSA instructions LLIL_CALL_STACK_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions LLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions LLIL_LOAD_SSA, LLIL_STORE_SSA, + LLIL_INTRINSIC_SSA, LLIL_REG_PHI, LLIL_REG_STACK_PHI, LLIL_FLAG_PHI, @@ -858,6 +860,7 @@ extern "C" MLIL_ADD_OVERFLOW, MLIL_SYSCALL, // Not valid in SSA form (see MLIL_SYSCALL_SSA) MLIL_SYSCALL_UNTYPED, // Not valid in SSA form (see MLIL_SYSCALL_UNTYPED_SSA) + MLIL_INTRINSIC, // Not valid in SSA form (see MLIL_INTRINSIC_SSA) MLIL_BP, MLIL_TRAP, MLIL_UNDEF, @@ -905,6 +908,7 @@ extern "C" MLIL_LOAD_STRUCT_SSA, MLIL_STORE_SSA, MLIL_STORE_STRUCT_SSA, + MLIL_INTRINSIC_SSA, MLIL_VAR_PHI, MLIL_MEM_PHI }; @@ -1077,6 +1081,19 @@ extern "C" BNLowLevelILFlagCondition condition; }; + struct BNNameAndType + { + char* name; + BNType* type; + uint8_t typeConfidence; + }; + + struct BNTypeWithConfidence + { + BNType* type; + uint8_t confidence; + }; + struct BNCustomArchitecture { void* context; @@ -1127,6 +1144,13 @@ extern "C" uint32_t* (*getAllRegisterStacks)(void* ctxt, size_t* count); void (*getRegisterStackInfo)(void* ctxt, uint32_t regStack, BNRegisterStackInfo* result); + char* (*getIntrinsicName)(void* ctxt, uint32_t intrinsic); + uint32_t* (*getAllIntrinsics)(void* ctxt, size_t* count); + BNNameAndType* (*getIntrinsicInputs)(void* ctxt, uint32_t intrinsic, size_t* count); + void (*freeNameAndTypeList)(void* ctxt, BNNameAndType* nt, size_t count); + BNTypeWithConfidence* (*getIntrinsicOutputs)(void* ctxt, uint32_t intrinsic, size_t* count); + void (*freeTypeList)(void* ctxt, BNTypeWithConfidence* types, size_t count); + bool (*assemble)(void* ctxt, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); bool (*isNeverBranchPatchAvailable)(void* ctxt, const uint8_t* data, uint64_t addr, size_t len); @@ -1203,12 +1227,6 @@ extern "C" char* (*serialize)(void* ctxt); }; - struct BNTypeWithConfidence - { - BNType* type; - uint8_t confidence; - }; - struct BNCallingConventionWithConfidence { BNCallingConvention* convention; @@ -2116,6 +2134,14 @@ extern "C" BINARYNINJACOREAPI BNRegisterStackInfo BNGetArchitectureRegisterStackInfo(BNArchitecture* arch, uint32_t regStack); BINARYNINJACOREAPI uint32_t BNGetArchitectureRegisterStackForRegister(BNArchitecture* arch, uint32_t reg); + BINARYNINJACOREAPI char* BNGetArchitectureIntrinsicName(BNArchitecture* arch, uint32_t intrinsic); + BINARYNINJACOREAPI uint32_t* BNGetAllArchitectureIntrinsics(BNArchitecture* arch, size_t* count); + BINARYNINJACOREAPI BNNameAndType* BNGetArchitectureIntrinsicInputs(BNArchitecture* arch, uint32_t intrinsic, size_t* count); + BINARYNINJACOREAPI void BNFreeNameAndTypeList(BNNameAndType* nt, size_t count); + BINARYNINJACOREAPI BNTypeWithConfidence* BNGetArchitectureIntrinsicOutputs(BNArchitecture* arch, uint32_t intrinsic, + size_t* count); + BINARYNINJACOREAPI void BNFreeOutputTypeList(BNTypeWithConfidence* types, size_t count); + BINARYNINJACOREAPI bool BNAssemble(BNArchitecture* arch, const char* code, uint64_t addr, BNDataBuffer* result, char** errors); BINARYNINJACOREAPI bool BNIsArchitectureNeverBranchPatchAvailable(BNArchitecture* arch, const uint8_t* data, diff --git a/lowlevelil.cpp b/lowlevelil.cpp index c72d4b68..0f2b29be 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -216,6 +216,17 @@ ExprId LowLevelILFunction::AddIndexList(const vector operands) } +ExprId LowLevelILFunction::AddRegisterOrFlagList(const vector& regs) +{ + uint64_t* operandList = new uint64_t[regs.size()]; + for (size_t i = 0; i < regs.size(); i++) + operandList[i] = regs[i].ToIdentifier(); + ExprId result = (ExprId)BNLowLevelILAddOperandList(m_object, operandList, regs.size()); + delete[] operandList; + return result; +} + + ExprId LowLevelILFunction::AddSSARegisterList(const vector& regs) { uint64_t* operandList = new uint64_t[regs.size() * 2]; @@ -258,6 +269,20 @@ ExprId LowLevelILFunction::AddSSAFlagList(const vector& flags) } +ExprId LowLevelILFunction::AddSSARegisterOrFlagList(const vector& regs) +{ + uint64_t* operandList = new uint64_t[regs.size() * 2]; + for (size_t i = 0; i < regs.size(); i++) + { + operandList[i * 2] = regs[i].regOrFlag.ToIdentifier(); + operandList[(i * 2) + 1] = regs[i].version; + } + ExprId result = (ExprId)BNLowLevelILAddOperandList(m_object, operandList, regs.size() * 2); + delete[] operandList; + return result; +} + + ExprId LowLevelILFunction::GetExprForRegisterOrConstant(const BNRegisterOrConstant& operand, size_t size) { if (operand.constant) diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 9909e8ee..2c00db68 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -64,6 +64,7 @@ unordered_map {HighSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, {LowRegisterLowLevelOperandUsage, RegisterLowLevelOperand}, {LowSSARegisterLowLevelOperandUsage, SSARegisterLowLevelOperand}, + {IntrinsicLowLevelOperandUsage, IntrinsicLowLevelOperand}, {ConstantLowLevelOperandUsage, IntegerLowLevelOperand}, {VectorLowLevelOperandUsage, IntegerLowLevelOperand}, {StackAdjustmentLowLevelOperandUsage, IntegerLowLevelOperand}, @@ -80,6 +81,8 @@ unordered_map {SourceSSARegistersLowLevelOperandUsage, SSARegisterListLowLevelOperand}, {SourceSSARegisterStacksLowLevelOperandUsage, SSARegisterStackListLowLevelOperand}, {SourceSSAFlagsLowLevelOperandUsage, SSAFlagListLowLevelOperand}, + {OutputRegisterOrFlagListLowLevelOperandUsage, RegisterOrFlagListLowLevelOperand}, + {OutputSSARegisterOrFlagListLowLevelOperandUsage, SSARegisterOrFlagListLowLevelOperand}, {SourceMemoryVersionsLowLevelOperandUsage, IndexListLowLevelOperand}, {TargetListLowLevelOperandUsage, IndexListLowLevelOperand}, {RegisterStackAdjustmentsLowLevelOperandUsage, RegisterStackAdjustmentsLowLevelOperand} @@ -202,6 +205,10 @@ unordered_map> {LLIL_ZX, {SourceExprLowLevelOperandUsage}}, {LLIL_LOW_PART, {SourceExprLowLevelOperandUsage}}, {LLIL_BOOL_TO_INT, {SourceExprLowLevelOperandUsage}}, + {LLIL_INTRINSIC, {OutputRegisterOrFlagListLowLevelOperandUsage, IntrinsicLowLevelOperandUsage, + ParameterExprsLowLevelOperandUsage}}, + {LLIL_INTRINSIC_SSA, {OutputSSARegisterOrFlagListLowLevelOperandUsage, IntrinsicLowLevelOperandUsage, + ParameterExprsLowLevelOperandUsage}}, {LLIL_UNIMPL_MEM, {SourceExprLowLevelOperandUsage}}, {LLIL_FADD, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_FSUB, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, @@ -268,6 +275,8 @@ static unordered_map() const } +const RegisterOrFlag LowLevelILRegisterOrFlagList::ListIterator::operator*() +{ + return RegisterOrFlag::FromIdentifier(*pos); +} + + +LowLevelILRegisterOrFlagList::LowLevelILRegisterOrFlagList(LowLevelILFunction* func, + const BNLowLevelILInstruction& instr, size_t count): m_list(func, instr, count) +{ +} + + +LowLevelILRegisterOrFlagList::const_iterator LowLevelILRegisterOrFlagList::begin() const +{ + const_iterator result; + result.pos = m_list.begin(); + return result; +} + + +LowLevelILRegisterOrFlagList::const_iterator LowLevelILRegisterOrFlagList::end() const +{ + const_iterator result; + result.pos = m_list.end(); + return result; +} + + +size_t LowLevelILRegisterOrFlagList::size() const +{ + return m_list.size(); +} + + +const RegisterOrFlag LowLevelILRegisterOrFlagList::operator[](size_t i) const +{ + if (i >= size()) + throw LowLevelILInstructionAccessException(); + auto iter = begin(); + for (size_t j = 0; j < i; j++) + ++iter; + return *iter; +} + + +LowLevelILRegisterOrFlagList::operator vector() const +{ + vector result; + for (auto& i : *this) + result.push_back(i); + return result; +} + + const SSARegister LowLevelILSSARegisterList::ListIterator::operator*() { LowLevelILIntegerList::const_iterator cur = pos; @@ -818,6 +1004,64 @@ LowLevelILSSAFlagList::operator vector() const } +const SSARegisterOrFlag LowLevelILSSARegisterOrFlagList::ListIterator::operator*() +{ + LowLevelILIntegerList::const_iterator cur = pos; + RegisterOrFlag rf = RegisterOrFlag::FromIdentifier(*cur); + ++cur; + size_t version = (size_t)*cur; + return SSARegisterOrFlag(rf, version); +} + + +LowLevelILSSARegisterOrFlagList::LowLevelILSSARegisterOrFlagList(LowLevelILFunction* func, + const BNLowLevelILInstruction& instr, size_t count): m_list(func, instr, count & (~1)) +{ +} + + +LowLevelILSSARegisterOrFlagList::const_iterator LowLevelILSSARegisterOrFlagList::begin() const +{ + const_iterator result; + result.pos = m_list.begin(); + return result; +} + + +LowLevelILSSARegisterOrFlagList::const_iterator LowLevelILSSARegisterOrFlagList::end() const +{ + const_iterator result; + result.pos = m_list.end(); + return result; +} + + +size_t LowLevelILSSARegisterOrFlagList::size() const +{ + return m_list.size() / 2; +} + + +const SSARegisterOrFlag LowLevelILSSARegisterOrFlagList::operator[](size_t i) const +{ + if (i >= size()) + throw LowLevelILInstructionAccessException(); + auto iter = begin(); + for (size_t j = 0; j < i; j++) + ++iter; + return *iter; +} + + +LowLevelILSSARegisterOrFlagList::operator vector() const +{ + vector result; + for (auto& i : *this) + result.push_back(i); + return result; +} + + LowLevelILOperand::LowLevelILOperand(const LowLevelILInstruction& instr, LowLevelILOperandUsage usage, size_t operandIndex): m_instr(instr), m_usage(usage), m_operandIndex(operandIndex) @@ -905,6 +1149,14 @@ uint32_t LowLevelILOperand::GetSemanticFlagGroup() const } +uint32_t LowLevelILOperand::GetIntrinsic() const +{ + if (m_type != IntrinsicLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegister(m_operandIndex); +} + + SSARegister LowLevelILOperand::GetSSARegister() const { if (m_type != SSARegisterLowLevelOperand) @@ -952,6 +1204,14 @@ LowLevelILInstructionList LowLevelILOperand::GetExprList() const } +LowLevelILRegisterOrFlagList LowLevelILOperand::GetRegisterOrFlagList() const +{ + if (m_type != RegisterOrFlagListLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsRegisterOrFlagList(m_operandIndex); +} + + LowLevelILSSARegisterList LowLevelILOperand::GetSSARegisterList() const { if (m_type != SSARegisterListLowLevelOperand) @@ -978,6 +1238,14 @@ LowLevelILSSAFlagList LowLevelILOperand::GetSSAFlagList() const } +LowLevelILSSARegisterOrFlagList LowLevelILOperand::GetSSARegisterOrFlagList() const +{ + if (m_type != SSARegisterOrFlagListLowLevelOperand) + throw LowLevelILInstructionAccessException(); + return m_instr.GetRawOperandAsSSARegisterOrFlagList(m_operandIndex); +} + + map LowLevelILOperand::GetRegisterStackAdjustments() const { if (m_type != RegisterStackAdjustmentsLowLevelOperand) @@ -1174,6 +1442,12 @@ LowLevelILInstructionList LowLevelILInstructionBase::GetRawOperandAsExprList(siz } +LowLevelILRegisterOrFlagList LowLevelILInstructionBase::GetRawOperandAsRegisterOrFlagList(size_t operand) const +{ + return LowLevelILRegisterOrFlagList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); +} + + LowLevelILSSARegisterList LowLevelILInstructionBase::GetRawOperandAsSSARegisterList(size_t operand) const { return LowLevelILSSARegisterList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); @@ -1192,6 +1466,12 @@ LowLevelILSSAFlagList LowLevelILInstructionBase::GetRawOperandAsSSAFlagList(size } +LowLevelILSSARegisterOrFlagList LowLevelILInstructionBase::GetRawOperandAsSSARegisterOrFlagList(size_t operand) const +{ + return LowLevelILSSARegisterOrFlagList(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); +} + + map LowLevelILInstructionBase::GetRawOperandAsRegisterStackAdjustments(size_t operand) const { LowLevelILIntegerList list(function, function->GetRawExpr(operands[operand + 1]), operands[operand]); @@ -1224,6 +1504,14 @@ void LowLevelILInstructionBase::UpdateRawOperandAsSSARegisterList(size_t operand } +void LowLevelILInstructionBase::UpdateRawOperandAsSSARegisterOrFlagList(size_t operandIndex, + const vector& outputs) +{ + UpdateRawOperand(operandIndex, outputs.size() * 2); + UpdateRawOperand(operandIndex + 1, function->AddSSARegisterOrFlagList(outputs)); +} + + RegisterValue LowLevelILInstructionBase::GetValue() const { return function->GetExprValue(*(const LowLevelILInstruction*)this); @@ -1585,6 +1873,14 @@ void LowLevelILInstruction::VisitExprs(const std::function()) + i.VisitExprs(func); + break; + case LLIL_INTRINSIC_SSA: + for (auto& i : GetParameterExprs()) + i.VisitExprs(func); + break; default: break; } @@ -1839,6 +2135,16 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, subExprHandler(AsTwoOperandWithCarry().GetLeftExpr()), subExprHandler(AsTwoOperandWithCarry().GetRightExpr()), subExprHandler(AsTwoOperandWithCarry().GetCarryExpr())); + case LLIL_INTRINSIC: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); + return dest->Intrinsic(GetOutputRegisterOrFlagList(), GetIntrinsic(), + params, *this); + case LLIL_INTRINSIC_SSA: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); + return dest->IntrinsicSSA(GetOutputSSARegisterOrFlagList(), GetIntrinsic(), + params, *this); default: throw LowLevelILInstructionAccessException(); } @@ -2103,6 +2409,15 @@ SSARegister LowLevelILInstruction::GetLowSSARegister() const } +uint32_t LowLevelILInstruction::GetIntrinsic() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(IntrinsicLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegister(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + int64_t LowLevelILInstruction::GetConstant() const { size_t operandIndex; @@ -2242,6 +2557,24 @@ LowLevelILSSAFlagList LowLevelILInstruction::GetSourceSSAFlags() const } +LowLevelILRegisterOrFlagList LowLevelILInstruction::GetOutputRegisterOrFlagList() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(OutputRegisterOrFlagListLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsRegisterOrFlagList(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + +LowLevelILSSARegisterOrFlagList LowLevelILInstruction::GetOutputSSARegisterOrFlagList() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(OutputSSARegisterOrFlagListLowLevelOperandUsage, operandIndex)) + return GetRawOperandAsSSARegisterOrFlagList(operandIndex); + throw LowLevelILInstructionAccessException(); +} + + LowLevelILIndexList LowLevelILInstruction::GetSourceMemoryVersions() const { size_t operandIndex; @@ -2759,7 +3092,7 @@ ExprId LowLevelILFunction::CallSSA(const vector& output, ExprId des AddExprWithLocation(LLIL_CALL_OUTPUT_SSA, loc, 0, 0, newMemoryVer, output.size() * 2, AddSSARegisterList(output)), dest, AddExprWithLocation(LLIL_CALL_STACK_SSA, loc, 0, 0, stack.reg, stack.version, prevMemoryVer), - AddExprWithLocation(LLIL_CALL_PARAM_SSA, loc, 0, 0, + AddExprWithLocation(LLIL_CALL_PARAM, loc, 0, 0, params.size(), AddOperandList(params))); } @@ -2771,7 +3104,7 @@ ExprId LowLevelILFunction::SystemCallSSA(const vector& output, cons AddExprWithLocation(LLIL_CALL_OUTPUT_SSA, loc, 0, 0, newMemoryVer, output.size() * 2, AddSSARegisterList(output)), AddExprWithLocation(LLIL_CALL_STACK_SSA, loc, 0, 0, stack.reg, stack.version, prevMemoryVer), - AddExprWithLocation(LLIL_CALL_PARAM_SSA, loc, 0, 0, + AddExprWithLocation(LLIL_CALL_PARAM, loc, 0, 0, params.size(), AddOperandList(params))); } @@ -2878,6 +3211,24 @@ ExprId LowLevelILFunction::SystemCall(const ILSourceLocation& loc) } +ExprId LowLevelILFunction::Intrinsic(const vector& outputs, uint32_t intrinsic, + const vector& params, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_INTRINSIC, loc, 0, 0, + outputs.size(), AddRegisterOrFlagList(outputs), intrinsic, + AddExprWithLocation(LLIL_CALL_PARAM, loc, 0, 0, params.size(), AddOperandList(params))); +} + + +ExprId LowLevelILFunction::IntrinsicSSA(const vector& outputs, uint32_t intrinsic, + const vector& params, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_INTRINSIC_SSA, loc, 0, 0, + outputs.size() * 2, AddSSARegisterOrFlagList(outputs), intrinsic, + AddExprWithLocation(LLIL_CALL_PARAM, loc, 0, 0, params.size(), AddOperandList(params))); +} + + ExprId LowLevelILFunction::Breakpoint(const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_BP, loc, 0, 0); diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index bb5041a6..4679f556 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -54,6 +54,31 @@ namespace BinaryNinja class LowLevelILOperand; class LowLevelILOperandList; + struct RegisterOrFlag + { + bool isFlag; + uint32_t index; + + RegisterOrFlag(); + RegisterOrFlag(bool flag, uint32_t i); + + bool IsRegister() const { return !isFlag; } + bool IsFlag() const { return isFlag; } + uint32_t GetRegister() const; + uint32_t GetFlag() const; + + RegisterOrFlag& operator=(const RegisterOrFlag& v); + bool operator==(const RegisterOrFlag& v) const; + bool operator!=(const RegisterOrFlag& v) const; + bool operator<(const RegisterOrFlag& v) const; + + uint64_t ToIdentifier() const; + static RegisterOrFlag FromIdentifier(uint64_t id); + + static RegisterOrFlag Register(uint32_t reg) { return RegisterOrFlag(false, reg); } + static RegisterOrFlag Flag(uint32_t flag) { return RegisterOrFlag(true, flag); } + }; + struct SSARegister { uint32_t reg; @@ -99,6 +124,23 @@ namespace BinaryNinja bool operator<(const SSAFlag& v) const; }; + struct SSARegisterOrFlag + { + RegisterOrFlag regOrFlag; + size_t version; + + SSARegisterOrFlag(); + SSARegisterOrFlag(const RegisterOrFlag& rf, size_t i); + SSARegisterOrFlag(const SSARegister& v); + SSARegisterOrFlag(const SSAFlag& v); + SSARegisterOrFlag(const SSARegisterOrFlag& v); + + SSARegisterOrFlag& operator=(const SSARegisterOrFlag& v); + bool operator==(const SSARegisterOrFlag& v) const; + bool operator!=(const SSARegisterOrFlag& v) const; + bool operator<(const SSARegisterOrFlag& v) const; + }; + enum LowLevelILOperandType { IntegerLowLevelOperand, @@ -108,6 +150,7 @@ namespace BinaryNinja RegisterStackLowLevelOperand, FlagLowLevelOperand, FlagConditionLowLevelOperand, + IntrinsicLowLevelOperand, SemanticFlagClassLowLevelOperand, SemanticFlagGroupLowLevelOperand, SSARegisterLowLevelOperand, @@ -115,9 +158,11 @@ namespace BinaryNinja SSAFlagLowLevelOperand, IndexListLowLevelOperand, ExprListLowLevelOperand, + RegisterOrFlagListLowLevelOperand, SSARegisterListLowLevelOperand, SSARegisterStackListLowLevelOperand, SSAFlagListLowLevelOperand, + SSARegisterOrFlagListLowLevelOperand, RegisterStackAdjustmentsLowLevelOperand }; @@ -152,6 +197,7 @@ namespace BinaryNinja HighSSARegisterLowLevelOperandUsage, LowRegisterLowLevelOperandUsage, LowSSARegisterLowLevelOperandUsage, + IntrinsicLowLevelOperandUsage, ConstantLowLevelOperandUsage, VectorLowLevelOperandUsage, StackAdjustmentLowLevelOperandUsage, @@ -168,6 +214,8 @@ namespace BinaryNinja SourceSSARegistersLowLevelOperandUsage, SourceSSARegisterStacksLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage, + OutputRegisterOrFlagListLowLevelOperandUsage, + OutputSSARegisterOrFlagListLowLevelOperandUsage, SourceMemoryVersionsLowLevelOperandUsage, TargetListLowLevelOperandUsage, RegisterStackAdjustmentsLowLevelOperandUsage @@ -365,6 +413,33 @@ namespace BinaryNinja operator std::vector() const; }; + class LowLevelILRegisterOrFlagList + { + struct ListIterator + { + LowLevelILIntegerList::const_iterator pos; + bool operator==(const ListIterator& a) const { return pos == a.pos; } + bool operator!=(const ListIterator& a) const { return pos != a.pos; } + bool operator<(const ListIterator& a) const { return pos < a.pos; } + ListIterator& operator++() { ++pos; return *this; } + const RegisterOrFlag operator*(); + }; + + LowLevelILIntegerList m_list; + + public: + typedef ListIterator const_iterator; + + LowLevelILRegisterOrFlagList(LowLevelILFunction* func, const BNLowLevelILInstruction& instr, size_t count); + + const_iterator begin() const; + const_iterator end() const; + size_t size() const; + const RegisterOrFlag operator[](size_t i) const; + + operator std::vector() const; + }; + class LowLevelILSSARegisterList { struct ListIterator @@ -446,6 +521,33 @@ namespace BinaryNinja operator std::vector() const; }; + class LowLevelILSSARegisterOrFlagList + { + struct ListIterator + { + LowLevelILIntegerList::const_iterator pos; + bool operator==(const ListIterator& a) const { return pos == a.pos; } + bool operator!=(const ListIterator& a) const { return pos != a.pos; } + bool operator<(const ListIterator& a) const { return pos < a.pos; } + ListIterator& operator++() { ++pos; ++pos; return *this; } + const SSARegisterOrFlag operator*(); + }; + + LowLevelILIntegerList m_list; + + public: + typedef ListIterator const_iterator; + + LowLevelILSSARegisterOrFlagList(LowLevelILFunction* func, const BNLowLevelILInstruction& instr, size_t count); + + const_iterator begin() const; + const_iterator end() const; + size_t size() const; + const SSARegisterOrFlag operator[](size_t i) const; + + operator std::vector() const; + }; + struct LowLevelILInstructionBase: public BNLowLevelILInstruction { #ifdef BINARYNINJACORE_LIBRARY @@ -474,13 +576,16 @@ namespace BinaryNinja SSAFlag GetRawOperandAsSSAFlag(size_t operand) const; LowLevelILIndexList GetRawOperandAsIndexList(size_t operand) const; LowLevelILInstructionList GetRawOperandAsExprList(size_t operand) const; + LowLevelILRegisterOrFlagList GetRawOperandAsRegisterOrFlagList(size_t operand) const; LowLevelILSSARegisterList GetRawOperandAsSSARegisterList(size_t operand) const; LowLevelILSSARegisterStackList GetRawOperandAsSSARegisterStackList(size_t operand) const; LowLevelILSSAFlagList GetRawOperandAsSSAFlagList(size_t operand) const; + LowLevelILSSARegisterOrFlagList GetRawOperandAsSSARegisterOrFlagList(size_t operand) const; std::map GetRawOperandAsRegisterStackAdjustments(size_t operand) const; void UpdateRawOperand(size_t operandIndex, ExprId value); void UpdateRawOperandAsSSARegisterList(size_t operandIndex, const std::vector& regs); + void UpdateRawOperandAsSSARegisterOrFlagList(size_t operandIndex, const std::vector& outputs); RegisterValue GetValue() const; PossibleValueSet GetPossibleValues() const; @@ -604,6 +709,7 @@ namespace BinaryNinja template SSARegister GetHighSSARegister() const { return As().GetHighSSARegister(); } template uint32_t GetLowRegister() const { return As().GetLowRegister(); } template SSARegister GetLowSSARegister() const { return As().GetLowSSARegister(); } + template uint32_t GetIntrinsic() const { return As().GetIntrinsic(); } template int64_t GetConstant() const { return As().GetConstant(); } template int64_t GetVector() const { return As().GetVector(); } template size_t GetStackAdjustment() const { return As().GetStackAdjustment(); } @@ -619,6 +725,8 @@ namespace BinaryNinja template LowLevelILSSARegisterList GetSourceSSARegisters() const { return As().GetSourceSSARegisters(); } template LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const { return As().GetSourceSSARegisterStacks(); } template LowLevelILSSAFlagList GetSourceSSAFlags() const { return As().GetSourceSSAFlags(); } + template LowLevelILRegisterOrFlagList GetOutputRegisterOrFlagList() const { return As().GetOutputRegisterOrFlagList(); } + template LowLevelILSSARegisterOrFlagList GetOutputSSARegisterOrFlagList() const { return As().GetOutputSSARegisterOrFlagList(); } template LowLevelILIndexList GetSourceMemoryVersions() const { return As().GetSourceMemoryVersions(); } template LowLevelILIndexList GetTargetList() const { return As().GetTargetList(); } template std::map GetRegisterStackAdjustments() const { return As().GetRegisterStackAdjustments(); } @@ -632,6 +740,7 @@ namespace BinaryNinja template void SetDestMemoryVersion(size_t version) { As().SetDestMemoryVersion(version); } template void SetSourceMemoryVersion(size_t version) { As().SetSourceMemoryVersion(version); } template void SetOutputSSARegisters(const std::vector& regs) { As().SetOutputSSARegisters(regs); } + template void SetOutputSSARegisterOrFlagList(const std::vector& outputs) { As().SetOutputSSARegisterOrFlagList(outputs); } bool GetOperandIndexForUsage(LowLevelILOperandUsage usage, size_t& operandIndex) const; @@ -664,6 +773,7 @@ namespace BinaryNinja SSARegister GetHighSSARegister() const; uint32_t GetLowRegister() const; SSARegister GetLowSSARegister() const; + uint32_t GetIntrinsic() const; int64_t GetConstant() const; int64_t GetVector() const; size_t GetStackAdjustment() const; @@ -679,6 +789,8 @@ namespace BinaryNinja LowLevelILSSARegisterList GetSourceSSARegisters() const; LowLevelILSSARegisterStackList GetSourceSSARegisterStacks() const; LowLevelILSSAFlagList GetSourceSSAFlags() const; + LowLevelILRegisterOrFlagList GetOutputRegisterOrFlagList() const; + LowLevelILSSARegisterOrFlagList GetOutputSSARegisterOrFlagList() const; LowLevelILIndexList GetSourceMemoryVersions() const; LowLevelILIndexList GetTargetList() const; std::map GetRegisterStackAdjustments() const; @@ -706,6 +818,7 @@ namespace BinaryNinja uint32_t GetFlag() const; uint32_t GetSemanticFlagClass() const; uint32_t GetSemanticFlagGroup() const; + uint32_t GetIntrinsic() const; BNLowLevelILFlagCondition GetFlagCondition() const; SSARegister GetSSARegister() const; SSARegisterStack GetSSARegisterStack() const; @@ -715,6 +828,8 @@ namespace BinaryNinja LowLevelILSSARegisterList GetSSARegisterList() const; LowLevelILSSARegisterStackList GetSSARegisterStackList() const; LowLevelILSSAFlagList GetSSAFlagList() const; + LowLevelILRegisterOrFlagList GetRegisterOrFlagList() const; + LowLevelILSSARegisterOrFlagList GetSSARegisterOrFlagList() const; std::map GetRegisterStackAdjustments() const; }; @@ -1022,6 +1137,20 @@ namespace BinaryNinja void SetOutputSSARegisters(const std::vector& regs) { GetRawOperandAsExpr(0).UpdateRawOperandAsSSARegisterList(1, regs); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + LowLevelILRegisterOrFlagList GetOutputRegisterOrFlagList() const { return GetRawOperandAsRegisterOrFlagList(0); } + uint32_t GetIntrinsic() const { return GetRawOperandAsRegister(2); } + LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExpr(3).GetRawOperandAsExprList(0); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + LowLevelILSSARegisterOrFlagList GetOutputSSARegisterOrFlagList() const { return GetRawOperandAsSSARegisterOrFlagList(0); } + uint32_t GetIntrinsic() const { return GetRawOperandAsRegister(2); } + LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExpr(3).GetRawOperandAsExprList(0); } + void SetOutputSSARegisterOrFlagList(const std::vector& outputs) { UpdateRawOperandAsSSARegisterOrFlagList(0, outputs); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { SSARegister GetDestSSARegister() const { return GetRawOperandAsSSARegister(0); } diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index e911c298..7e1e663f 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -54,6 +54,7 @@ unordered_map {OffsetMediumLevelOperandUsage, IntegerMediumLevelOperand}, {ConstantMediumLevelOperandUsage, IntegerMediumLevelOperand}, {VectorMediumLevelOperandUsage, IntegerMediumLevelOperand}, + {IntrinsicMediumLevelOperandUsage, IntrinsicMediumLevelOperand}, {TargetMediumLevelOperandUsage, IndexMediumLevelOperand}, {TrueTargetMediumLevelOperandUsage, IndexMediumLevelOperand}, {FalseTargetMediumLevelOperandUsage, IndexMediumLevelOperand}, @@ -64,6 +65,7 @@ unordered_map {OutputVariablesMediumLevelOperandUsage, VariableListMediumLevelOperand}, {OutputVariablesSubExprMediumLevelOperandUsage, VariableListMediumLevelOperand}, {OutputSSAVariablesMediumLevelOperandUsage, SSAVariableListMediumLevelOperand}, + {OutputSSAVariablesSubExprMediumLevelOperandUsage, SSAVariableListMediumLevelOperand}, {OutputSSAMemoryVersionMediumLevelOperandUsage, IndexMediumLevelOperand}, {ParameterExprsMediumLevelOperandUsage, ExprListMediumLevelOperand}, {SourceExprsMediumLevelOperandUsage, ExprListMediumLevelOperand}, @@ -127,23 +129,27 @@ unordered_map> {MLIL_SYSCALL, {OutputVariablesMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage}}, {MLIL_SYSCALL_UNTYPED, {OutputVariablesSubExprMediumLevelOperandUsage, ParameterVariablesMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}}, - {MLIL_CALL_SSA, {OutputSSAVariablesMediumLevelOperandUsage, + {MLIL_CALL_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage, DestExprMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage, SourceMemoryVersionMediumLevelOperandUsage}}, - {MLIL_CALL_UNTYPED_SSA, {OutputSSAVariablesMediumLevelOperandUsage, + {MLIL_CALL_UNTYPED_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage, DestExprMediumLevelOperandUsage, ParameterSSAVariablesMediumLevelOperandUsage, ParameterSSAMemoryVersionMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}}, - {MLIL_SYSCALL_SSA, {OutputSSAVariablesMediumLevelOperandUsage, + {MLIL_SYSCALL_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage, SourceMemoryVersionMediumLevelOperandUsage}}, - {MLIL_SYSCALL_UNTYPED_SSA, {OutputSSAVariablesMediumLevelOperandUsage, + {MLIL_SYSCALL_UNTYPED_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage, ParameterSSAVariablesMediumLevelOperandUsage, ParameterSSAMemoryVersionMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}}, {MLIL_RET, {SourceExprsMediumLevelOperandUsage}}, {MLIL_IF, {ConditionExprMediumLevelOperandUsage, TrueTargetMediumLevelOperandUsage, FalseTargetMediumLevelOperandUsage}}, {MLIL_GOTO, {TargetMediumLevelOperandUsage}}, + {MLIL_INTRINSIC, {OutputVariablesMediumLevelOperandUsage, IntrinsicMediumLevelOperandUsage, + ParameterExprsMediumLevelOperandUsage}}, + {MLIL_INTRINSIC_SSA, {OutputSSAVariablesMediumLevelOperandUsage, IntrinsicMediumLevelOperandUsage, + ParameterExprsMediumLevelOperandUsage}}, {MLIL_TRAP, {VectorMediumLevelOperandUsage}}, {MLIL_VAR_PHI, {DestSSAVariableMediumLevelOperandUsage, SourceSSAVariablesMediumLevelOperandUsages}}, {MLIL_MEM_PHI, {DestMemoryVersionMediumLevelOperandUsage, SourceMemoryVersionsMediumLevelOperandUsage}}, @@ -243,7 +249,7 @@ static unordered_map()) + i.VisitExprs(func); + break; + case MLIL_INTRINSIC_SSA: + for (auto& i : GetParameterExprs()) + i.VisitExprs(func); + break; default: break; } @@ -1609,6 +1631,16 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, return dest->Breakpoint(*this); case MLIL_TRAP: return dest->Trap(GetVector(), *this); + case MLIL_INTRINSIC: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); + return dest->Intrinsic(GetOutputVariables(), + GetIntrinsic(), params, *this); + case MLIL_INTRINSIC_SSA: + for (auto& i : GetParameterExprs()) + params.push_back(subExprHandler(i)); + return dest->IntrinsicSSA(GetOutputSSAVariables(), + GetIntrinsic(), params, *this); case MLIL_UNDEF: return dest->Undefined(*this); case MLIL_UNIMPL: @@ -1796,6 +1828,15 @@ int64_t MediumLevelILInstruction::GetVector() const } +uint32_t MediumLevelILInstruction::GetIntrinsic() const +{ + size_t operandIndex; + if (GetOperandIndexForUsage(IntrinsicMediumLevelOperandUsage, operandIndex)) + return (uint32_t)GetRawOperandAsInteger(operandIndex); + throw MediumLevelILInstructionAccessException(); +} + + size_t MediumLevelILInstruction::GetTarget() const { size_t operandIndex; @@ -1878,6 +1919,8 @@ MediumLevelILSSAVariableList MediumLevelILInstruction::GetOutputSSAVariables() c { size_t operandIndex; if (GetOperandIndexForUsage(OutputSSAVariablesMediumLevelOperandUsage, operandIndex)) + return GetRawOperandAsSSAVariableList(operandIndex); + if (GetOperandIndexForUsage(OutputSSAVariablesSubExprMediumLevelOperandUsage, operandIndex)) return GetRawOperandAsExpr(operandIndex).GetRawOperandAsSSAVariableList(1); throw MediumLevelILInstructionAccessException(); } @@ -2577,6 +2620,22 @@ ExprId MediumLevelILFunction::Trap(int64_t vector, const ILSourceLocation& loc) } +ExprId MediumLevelILFunction::Intrinsic(const vector& outputs, uint32_t intrinsic, + const vector& params, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_INTRINSIC, loc, 0, outputs.size(), AddVariableList(outputs), + intrinsic, params.size(), AddOperandList(params)); +} + + +ExprId MediumLevelILFunction::IntrinsicSSA(const vector& outputs, uint32_t intrinsic, + const vector& params, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_INTRINSIC_SSA, loc, 0, outputs.size() * 2, AddSSAVariableList(outputs), + intrinsic, params.size(), AddOperandList(params)); +} + + ExprId MediumLevelILFunction::Undefined(const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_UNDEF, loc, 0); diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h index 8e671aaf..de92764d 100644 --- a/mediumlevelilinstruction.h +++ b/mediumlevelilinstruction.h @@ -70,6 +70,7 @@ namespace BinaryNinja { IntegerMediumLevelOperand, IndexMediumLevelOperand, + IntrinsicMediumLevelOperand, ExprMediumLevelOperand, VariableMediumLevelOperand, SSAVariableMediumLevelOperand, @@ -100,6 +101,7 @@ namespace BinaryNinja OffsetMediumLevelOperandUsage, ConstantMediumLevelOperandUsage, VectorMediumLevelOperandUsage, + IntrinsicMediumLevelOperandUsage, TargetMediumLevelOperandUsage, TrueTargetMediumLevelOperandUsage, FalseTargetMediumLevelOperandUsage, @@ -110,6 +112,7 @@ namespace BinaryNinja OutputVariablesMediumLevelOperandUsage, OutputVariablesSubExprMediumLevelOperandUsage, OutputSSAVariablesMediumLevelOperandUsage, + OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage, SourceExprsMediumLevelOperandUsage, @@ -485,6 +488,7 @@ namespace BinaryNinja template uint64_t GetOffset() const { return As().GetOffset(); } template int64_t GetConstant() const { return As().GetConstant(); } template int64_t GetVector() const { return As().GetVector(); } + template uint32_t GetIntrinsic() const { return As().GetIntrinsic(); } template size_t GetTarget() const { return As().GetTarget(); } template size_t GetTrueTarget() const { return As().GetTrueTarget(); } template size_t GetFalseTarget() const { return As().GetFalseTarget(); } @@ -535,6 +539,7 @@ namespace BinaryNinja uint64_t GetOffset() const; int64_t GetConstant() const; int64_t GetVector() const; + uint32_t GetIntrinsic() const; size_t GetTarget() const; size_t GetTrueTarget() const; size_t GetFalseTarget() const; @@ -567,6 +572,7 @@ namespace BinaryNinja uint64_t GetInteger() const; size_t GetIndex() const; + uint32_t GetIntrinsic() const; MediumLevelILInstruction GetExpr() const; Variable GetVariable() const; SSAVariable GetSSAVariable() const; @@ -902,6 +908,20 @@ namespace BinaryNinja size_t GetTarget() const { return GetRawOperandAsIndex(0); } }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + MediumLevelILVariableList GetOutputVariables() const { return GetRawOperandAsVariableList(0); } + uint32_t GetIntrinsic() const { return (uint32_t)GetRawOperandAsInteger(2); } + MediumLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(3); } + }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + MediumLevelILSSAVariableList GetOutputSSAVariables() const { return GetRawOperandAsSSAVariableList(0); } + uint32_t GetIntrinsic() const { return (uint32_t)GetRawOperandAsInteger(2); } + MediumLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(3); } + void SetOutputSSAVariables(const std::vector& vars) { UpdateRawOperandAsSSAVariableList(0, vars); } + }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase { int64_t GetVector() const { return GetRawOperandAsInteger(0); } diff --git a/python/architecture.py b/python/architecture.py index 2b422962..3ccd2b11 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -33,6 +33,7 @@ import callingconvention import platform import log import databuffer +import types class _ArchitectureMetaClass(type): @@ -128,6 +129,7 @@ class Architecture(object): flags_written_by_flag_write_type = {} semantic_class_for_flag_write_type = {} reg_stacks = {} + intrinsics = {} __metaclass__ = _ArchitectureMetaClass next_address = 0 @@ -304,6 +306,27 @@ class Architecture(object): top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top, regs[i]) core.BNFreeRegisterList(regs) + + count = ctypes.c_ulonglong() + intrinsics = core.BNGetAllArchitectureIntrinsics(self.handle, count) + self.__dict__["intrinsics"] = {} + for i in xrange(0, count.value): + name = core.BNGetArchitectureIntrinsicName(self.handle, intrinsics[i]) + input_count = ctypes.c_ulonglong() + inputs = core.BNGetArchitectureIntrinsicInputs(self.handle, intrinsics[i], input_count) + input_list = [] + for j in xrange(0, input_count.value): + input_name = inputs[j].name + type_obj = types.Type(core.BNNewTypeReference(inputs[j].type), confidence = inputs[j].typeConfidence) + input_list.append(function.IntrinsicInput(type_obj, input_name)) + core.BNFreeNameAndTypeList(inputs, input_count.value) + output_count = ctypes.c_ulonglong() + outputs = core.BNGetArchitectureIntrinsicOutputs(self.handle, intrinsics[i], output_count) + output_list = [] + for j in xrange(0, output_count.value): + output_list.append(types.Type(core.BNNewTypeReference(outputs[j].type), confidence = outputs[j].confidence)) + core.BNFreeOutputTypeList(outputs, output_count.value) + self.intrinsics[name] = function.IntrinsicInfo(input_list, output_list) else: startup._init_plugins() @@ -365,6 +388,12 @@ class Architecture(object): self._cb.getRegisterStackName = self._cb.getRegisterStackName.__class__(self._get_register_stack_name) self._cb.getAllRegisterStacks = self._cb.getAllRegisterStacks.__class__(self._get_all_register_stacks) self._cb.getRegisterStackInfo = self._cb.getRegisterStackInfo.__class__(self._get_register_stack_info) + self._cb.getIntrinsicName = self._cb.getIntrinsicName.__class__(self._get_intrinsic_name) + self._cb.getAllIntrinsics = self._cb.getAllIntrinsics.__class__(self._get_all_intrinsics) + self._cb.getIntrinsicInputs = self._cb.getIntrinsicInputs.__class__(self._get_intrinsic_inputs) + self._cb.freeNameAndTypeList = self._cb.freeNameAndTypeList.__class__(self._free_name_and_type_list) + self._cb.getIntrinsicOutputs = self._cb.getIntrinsicOutputs.__class__(self._get_intrinsic_outputs) + self._cb.freeTypeList = self._cb.freeTypeList.__class__(self._free_type_list) self._cb.assemble = self._cb.assemble.__class__(self._assemble) self._cb.isNeverBranchPatchAvailable = self._cb.isNeverBranchPatchAvailable.__class__( self._is_never_branch_patch_available) @@ -514,9 +543,28 @@ class Architecture(object): self.__dict__["global_regs"] = self.__class__.global_regs + self._intrinsics = {} + self._intrinsics_by_index = {} + self.__dict__["intrinsics"] = self.__class__.intrinsics + intrinsic_index = 0 + for intrinsic in self.__class__.intrinsics.keys(): + if intrinsic not in self._intrinsics: + info = self.__class__.intrinsics[intrinsic] + for i in xrange(0, len(info.inputs)): + if isinstance(info.inputs[i], types.Type): + info.inputs[i] = function.IntrinsicInput(info.inputs[i]) + elif isinstance(info.inputs[i], tuple): + info.inputs[i] = function.IntrinsicInput(info.inputs[i][0], info.inputs[i][1]) + info.index = intrinsic_index + self._intrinsics[intrinsic] = intrinsic_index + self._intrinsics_by_index[intrinsic_index] = (intrinsic, info) + intrinsic_index += 1 + self._pending_reg_lists = {} self._pending_token_lists = {} self._pending_condition_lists = {} + self._pending_name_and_type_lists = {} + self._pending_type_lists = {} def __eq__(self, value): if not isinstance(value, Architecture): @@ -1116,6 +1164,95 @@ class Architecture(object): result[0].topRelativeCount = 0 result[0].stackTopReg = 0 + def _get_intrinsic_name(self, ctxt, intrinsic): + try: + if intrinsic in self._intrinsics_by_index: + return core.BNAllocString(self._intrinsics_by_index[intrinsic][0]) + return core.BNAllocString("") + except (KeyError, OSError): + log.log_error(traceback.format_exc()) + return core.BNAllocString("") + + def _get_all_intrinsics(self, ctxt, count): + try: + regs = self._intrinsics_by_index.keys() + count[0] = len(regs) + reg_buf = (ctypes.c_uint * len(regs))() + for i in xrange(0, len(regs)): + reg_buf[i] = regs[i] + result = ctypes.cast(reg_buf, ctypes.c_void_p) + self._pending_reg_lists[result.value] = (result, reg_buf) + return result.value + except KeyError: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _get_intrinsic_inputs(self, ctxt, intrinsic, count): + try: + if intrinsic in self._intrinsics_by_index: + inputs = self._intrinsics_by_index[intrinsic][1].inputs + count[0] = len(inputs) + input_buf = (core.BNNameAndType * len(inputs))() + for i in xrange(0, len(inputs)): + input_buf[i].name = inputs[i].name + input_buf[i].type = core.BNNewTypeReference(inputs[i].type.handle) + input_buf[i].typeConfidence = inputs[i].type.confidence + result = ctypes.cast(input_buf, ctypes.c_void_p) + self._pending_name_and_type_lists[result.value] = (result, input_buf, len(inputs)) + return result.value + count[0] = 0 + return None + except: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _free_name_and_type_list(self, ctxt, buf_raw): + try: + buf = ctypes.cast(buf_raw, ctypes.c_void_p) + if buf.value not in self._pending_name_and_type_lists: + raise ValueError("freeing name and type list that wasn't allocated") + name_and_types = self._pending_name_and_type_lists[buf.value][1] + count = self._pending_name_and_type_lists[buf.value][2] + for i in xrange(0, count): + core.BNFreeType(name_and_types[i].type) + del self._pending_name_and_type_lists[buf.value] + except (ValueError, KeyError): + log.log_error(traceback.format_exc()) + + def _get_intrinsic_outputs(self, ctxt, intrinsic, count): + try: + if intrinsic in self._intrinsics_by_index: + outputs = self._intrinsics_by_index[intrinsic][1].outputs + count[0] = len(outputs) + output_buf = (core.BNTypeWithConfidence * len(outputs))() + for i in xrange(0, len(outputs)): + output_buf[i].type = core.BNNewTypeReference(outputs[i].handle) + output_buf[i].confidence = outputs[i].confidence + result = ctypes.cast(output_buf, ctypes.c_void_p) + self._pending_type_lists[result.value] = (result, output_buf, len(outputs)) + return result.value + count[0] = 0 + return None + except: + log.log_error(traceback.format_exc()) + count[0] = 0 + return None + + def _free_type_list(self, ctxt, buf_raw): + try: + buf = ctypes.cast(buf_raw, ctypes.c_void_p) + if buf.value not in self._pending_type_lists: + raise ValueError("freeing type list that wasn't allocated") + types = self._pending_type_lists[buf.value][1] + count = self._pending_type_lists[buf.value][2] + for i in xrange(0, count): + core.BNFreeType(types[i].type) + del self._pending_type_lists[buf.value] + except (ValueError, KeyError): + log.log_error(traceback.format_exc()) + def _assemble(self, ctxt, code, addr, result, errors): try: data, error_str = self.perform_assemble(code, addr) @@ -1701,6 +1838,23 @@ class Architecture(object): return sem_group.index return sem_group + def get_intrinsic_name(self, intrinsic): + """ + ``get_intrinsic_name`` gets an intrinsic name from an intrinsic number. + + :param int intrinsic: intrinsic number + :return: the corresponding intrinsic string + :rtype: str + """ + return core.BNGetArchitectureIntrinsicName(self.handle, intrinsic) + + def get_intrinsic_index(self, intrinsic): + if isinstance(intrinsic, str): + return self._intrinsics[intrinsic] + elif isinstance(intrinsic, lowlevelil.ILIntrinsic): + return intrinsic.index + return intrinsic + def get_flag_write_type_name(self, write_type): """ ``get_flag_write_type_name`` gets the flag write type name for the given flag. diff --git a/python/function.py b/python/function.py index 10583b58..7607657f 100644 --- a/python/function.py +++ b/python/function.py @@ -427,7 +427,7 @@ class Function(object): """Function platform (read-only)""" if self._platform: return self._platform - else: + else: plat = core.BNGetFunctionPlatform(self.handle) if plat is None: return None @@ -1878,6 +1878,27 @@ class RegisterStackInfo(object): return "" % (len(self.storage_regs), self.stack_top_reg) +class IntrinsicInput(object): + def __init__(self, type_obj, name=""): + self.name = name + self.type = type_obj + + def __repr__(self): + if len(self.name) == 0: + return "" % str(self.type) + return "" % (str(self.type), self.name) + + +class IntrinsicInfo(object): + def __init__(self, inputs, outputs, index=None): + self.inputs = inputs + self.outputs = outputs + self.index = index + + def __repr__(self): + return " %s>" % (repr(self.inputs), repr(self.outputs)) + + class InstructionBranch(object): def __init__(self, branch_type, target = 0, arch = None): self.type = branch_type diff --git a/python/lowlevelil.py b/python/lowlevelil.py index a2d77c9f..33296ce8 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -131,6 +131,25 @@ class ILSemanticFlagGroup(object): return self.index == other.index +class ILIntrinsic(object): + def __init__(self, arch, intrinsic): + self.arch = arch + self.index = intrinsic + self.name = self.arch.get_intrinsic_name(self.index) + if self.name in self.arch.intrinsics: + self.inputs = self.arch.intrinsics[self.name].inputs + self.outputs = self.arch.intrinsics[self.name].outputs + + def __str__(self): + return self.name + + def __repr__(self): + return self.name + + def __eq__(self, other): + return self.index == other.index + + class SSARegister(object): def __init__(self, reg, version): self.reg = reg @@ -158,6 +177,15 @@ class SSAFlag(object): return "" % (repr(self.flag), self.version) +class SSARegisterOrFlag(object): + def __init__(self, reg_or_flag, version): + self.reg_or_flag = reg_or_flag + self.version = version + + def __repr__(self): + return "" % (repr(self.reg_or_flag), self.version) + + class LowLevelILOperationAndSize(object): def __init__(self, operation, size): self.operation = operation @@ -250,6 +278,8 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_BOOL_TO_INT: [("src", "expr")], LowLevelILOperation.LLIL_ADD_OVERFLOW: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_SYSCALL: [], + LowLevelILOperation.LLIL_INTRINSIC: [("output", "reg_or_flag_list"), ("intrinsic", "intrinsic"), ("param", "expr")], + LowLevelILOperation.LLIL_INTRINSIC_SSA: [("output", "reg_or_flag_ssa_list"), ("intrinsic", "intrinsic"), ("param", "expr")], LowLevelILOperation.LLIL_BP: [], LowLevelILOperation.LLIL_TRAP: [("vector", "int")], LowLevelILOperation.LLIL_UNDEF: [], @@ -292,7 +322,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_SYSCALL_SSA: [("output", "expr"), ("stack", "expr"), ("param", "expr")], LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "reg_ssa_list")], LowLevelILOperation.LLIL_CALL_STACK_SSA: [("src", "reg_ssa"), ("src_memory", "int")], - LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("src", "expr_list")], + LowLevelILOperation.LLIL_CALL_PARAM: [("src", "expr_list")], LowLevelILOperation.LLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], LowLevelILOperation.LLIL_REG_PHI: [("dest", "reg_ssa"), ("src", "reg_ssa_list")], @@ -336,6 +366,8 @@ class LowLevelILInstruction(object): value = ILRegister(func.arch, instr.operands[i]) elif operand_type == "reg_stack": value = ILRegisterStack(func.arch, instr.operands[i]) + elif operand_type == "intrinsic": + value = ILIntrinsic(func.arch, instr.operands[i]) elif operand_type == "reg_ssa": reg = ILRegister(func.arch, instr.operands[i]) i += 1 @@ -369,25 +401,36 @@ class LowLevelILInstruction(object): operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = [] - for i in xrange(count.value): - value.append(operand_list[i]) + for j in xrange(count.value): + value.append(operand_list[j]) core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "expr_list": count = ctypes.c_ulonglong() operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = [] - for i in xrange(count.value): - value.append(LowLevelILInstruction(func, operand_list[i])) + for j in xrange(count.value): + value.append(LowLevelILInstruction(func, operand_list[j])) + core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "reg_or_flag_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = [] + for j in xrange(count.value): + if (operand_list[j] & (1 << 32)) != 0: + value.append(ILFlag(func.arch, operand_list[j] & 0xffffffff)) + else: + value.append(ILRegister(func.arch, operand_list[j] & 0xffffffff)) core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "reg_ssa_list": count = ctypes.c_ulonglong() operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = [] - for i in xrange(count.value / 2): - reg = operand_list[i * 2] - reg_version = operand_list[(i * 2) + 1] + for j in xrange(count.value / 2): + reg = operand_list[j * 2] + reg_version = operand_list[(j * 2) + 1] value.append(SSARegister(ILRegister(func.arch, reg), reg_version)) core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "reg_stack_ssa_list": @@ -395,9 +438,9 @@ class LowLevelILInstruction(object): operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = [] - for i in xrange(count.value / 2): - reg_stack = operand_list[i * 2] - reg_version = operand_list[(i * 2) + 1] + for j in xrange(count.value / 2): + reg_stack = operand_list[j * 2] + reg_version = operand_list[(j * 2) + 1] value.append(SSARegisterStack(ILRegisterStack(func.arch, reg_stack), reg_version)) core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "flag_ssa_list": @@ -405,19 +448,32 @@ class LowLevelILInstruction(object): operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = [] - for i in xrange(count.value / 2): - flag = operand_list[i * 2] - flag_version = operand_list[(i * 2) + 1] + for j in xrange(count.value / 2): + flag = operand_list[j * 2] + flag_version = operand_list[(j * 2) + 1] value.append(SSAFlag(ILFlag(func.arch, flag), flag_version)) core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "reg_or_flag_ssa_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = [] + for j in xrange(count.value / 2): + if (operand_list[j * 2] & (1 << 32)) != 0: + reg_or_flag = ILFlag(func.arch, operand_list[j * 2] & 0xffffffff) + else: + reg_or_flag = ILRegister(func.arch, operand_list[j * 2] & 0xffffffff) + reg_version = operand_list[(j * 2) + 1] + value.append(SSARegisterOrFlag(reg_or_flag, reg_version)) + core.BNLowLevelILFreeOperandList(operand_list) elif operand_type == "reg_stack_adjust": count = ctypes.c_ulonglong() operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) i += 1 value = {} - for i in xrange(count.value / 2): - reg_stack = operand_list[i * 2] - adjust = operand_list[(i * 2) + 1] + for j in xrange(count.value / 2): + reg_stack = operand_list[j * 2] + adjust = operand_list[(j * 2) + 1] if adjust & 0x80000000: adjust |= ~0x80000000 value[func.arch.get_reg_stack_name(reg_stack)] = adjust @@ -1714,6 +1770,25 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_SYSCALL) + def intrinsic(self, outputs, intrinsic, params): + """ + ``intrinsic`` return an intrinsic expression. + + :return: an intrinsic expression. + :rtype: LowLevelILExpr + """ + output_list = [] + for output in outputs: + if isinstance(output, ILFlag): + output_list.append((1 << 32) | output.index) + else: + output_list.append(output.index) + param_list = [] + for param in params: + param_list.append(param.index) + return self.expr(LowLevelILOperation.LLIL_INTRINSIC, len(outputs), self.add_operand_list(output_list), + self.arch.get_intrinsic_index(intrinsic), len(params), self.add_operand_list(param_list)) + def breakpoint(self): """ ``breakpoint`` returns a processor breakpoint expression. diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 8594ea36..3c4ba3fd 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -150,6 +150,8 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_SYSCALL_UNTYPED: [("output", "expr"), ("params", "expr"), ("stack", "expr")], MediumLevelILOperation.MLIL_BP: [], MediumLevelILOperation.MLIL_TRAP: [("vector", "int")], + MediumLevelILOperation.MLIL_INTRINSIC: [("output", "var_list"), ("intrinsic", "intrinsic"), ("params", "expr_list")], + MediumLevelILOperation.MLIL_INTRINSIC_SSA: [("output", "var_ssa_list"), ("intrinsic", "intrinsic"), ("params", "expr_list")], MediumLevelILOperation.MLIL_UNDEF: [], MediumLevelILOperation.MLIL_UNIMPL: [], MediumLevelILOperation.MLIL_UNIMPL_MEM: [("src", "expr")], @@ -223,6 +225,8 @@ class MediumLevelILInstruction(object): value = instr.operands[i] elif operand_type == "expr": value = MediumLevelILInstruction(func, instr.operands[i]) + elif operand_type == "intrinsic": + value = lowlevelil.ILIntrinsic(func.arch, instr.operands[i]) elif operand_type == "var": value = function.Variable.from_identifier(self.function.source_function, instr.operands[i]) elif operand_type == "var_ssa": -- cgit v1.3.1 From fd51307c7fa5baff29860b1e3be09aafca13c2f0 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 31 Jan 2018 21:08:05 -0500 Subject: Allow intrinsics to write flags --- binaryninjaapi.h | 3 ++- lowlevelilinstruction.cpp | 6 +++--- python/lowlevelil.py | 4 ++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index d1ca9cdb..3decc4e9 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2671,7 +2671,8 @@ namespace BinaryNinja ExprId BoolToInt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); ExprId SystemCall(const ILSourceLocation& loc = ILSourceLocation()); ExprId Intrinsic(const std::vector& outputs, uint32_t intrinsic, - const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); + const std::vector& params, uint32_t flags = 0, + const ILSourceLocation& loc = ILSourceLocation()); ExprId IntrinsicSSA(const std::vector& outputs, uint32_t intrinsic, const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); ExprId Breakpoint(const ILSourceLocation& loc = ILSourceLocation()); diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 2c00db68..1a834435 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -2139,7 +2139,7 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, for (auto& i : GetParameterExprs()) params.push_back(subExprHandler(i)); return dest->Intrinsic(GetOutputRegisterOrFlagList(), GetIntrinsic(), - params, *this); + params, flags, *this); case LLIL_INTRINSIC_SSA: for (auto& i : GetParameterExprs()) params.push_back(subExprHandler(i)); @@ -3212,9 +3212,9 @@ ExprId LowLevelILFunction::SystemCall(const ILSourceLocation& loc) ExprId LowLevelILFunction::Intrinsic(const vector& outputs, uint32_t intrinsic, - const vector& params, const ILSourceLocation& loc) + const vector& params, uint32_t flags, const ILSourceLocation& loc) { - return AddExprWithLocation(LLIL_INTRINSIC, loc, 0, 0, + return AddExprWithLocation(LLIL_INTRINSIC, loc, 0, flags, outputs.size(), AddRegisterOrFlagList(outputs), intrinsic, AddExprWithLocation(LLIL_CALL_PARAM, loc, 0, 0, params.size(), AddOperandList(params))); } diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 33296ce8..273d3aeb 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1770,7 +1770,7 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_SYSCALL) - def intrinsic(self, outputs, intrinsic, params): + def intrinsic(self, outputs, intrinsic, params, flags=None): """ ``intrinsic`` return an intrinsic expression. @@ -1787,7 +1787,7 @@ class LowLevelILFunction(object): for param in params: param_list.append(param.index) return self.expr(LowLevelILOperation.LLIL_INTRINSIC, len(outputs), self.add_operand_list(output_list), - self.arch.get_intrinsic_index(intrinsic), len(params), self.add_operand_list(param_list)) + self.arch.get_intrinsic_index(intrinsic), len(params), self.add_operand_list(param_list), flags = flags) def breakpoint(self): """ -- cgit v1.3.1 From 331bfd4e4a648de8aba4fefd8301703a6a3440c9 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Fri, 2 Feb 2018 18:02:57 -0500 Subject: Add rounding instructions --- binaryninjaapi.h | 8 +++++++ binaryninjacore.h | 8 +++++++ lowlevelilinstruction.cpp | 36 ++++++++++++++++++++++++++++++ lowlevelilinstruction.h | 4 ++++ mediumlevelilinstruction.cpp | 36 ++++++++++++++++++++++++++++++ mediumlevelilinstruction.h | 4 ++++ python/lowlevelil.py | 52 ++++++++++++++++++++++++++++++++++++++++++++ python/mediumlevelil.py | 4 ++++ 8 files changed, 152 insertions(+) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 3decc4e9..650299ed 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2702,6 +2702,10 @@ namespace BinaryNinja ExprId FloatToInt(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId IntToFloat(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatConvert(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RoundToInt(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId Floor(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId Ceil(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatTrunc(size_t size, ExprId a, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareNotEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareLessThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); @@ -3012,6 +3016,10 @@ namespace BinaryNinja ExprId FloatToInt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); ExprId IntToFloat(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatConvert(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RoundToInt(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId Floor(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId Ceil(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FloatTrunc(size_t size, ExprId a, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareNotEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatCompareLessThan(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc = ILSourceLocation()); diff --git a/binaryninjacore.h b/binaryninjacore.h index a946df31..945badce 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -368,6 +368,10 @@ extern "C" LLIL_FLOAT_TO_INT, LLIL_INT_TO_FLOAT, LLIL_FLOAT_CONV, + LLIL_ROUND_TO_INT, + LLIL_FLOOR, + LLIL_CEIL, + LLIL_FTRUNC, LLIL_FCMP_E, LLIL_FCMP_NE, LLIL_FCMP_LT, @@ -878,6 +882,10 @@ extern "C" MLIL_FLOAT_TO_INT, MLIL_INT_TO_FLOAT, MLIL_FLOAT_CONV, + MLIL_ROUND_TO_INT, + MLIL_FLOOR, + MLIL_CEIL, + MLIL_FTRUNC, MLIL_FCMP_E, MLIL_FCMP_NE, MLIL_FCMP_LT, diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index 1a834435..c38d742f 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -220,6 +220,10 @@ unordered_map> {LLIL_FLOAT_TO_INT, {SourceExprLowLevelOperandUsage}}, {LLIL_INT_TO_FLOAT, {SourceExprLowLevelOperandUsage}}, {LLIL_FLOAT_CONV, {SourceExprLowLevelOperandUsage}}, + {LLIL_ROUND_TO_INT, {SourceExprLowLevelOperandUsage}}, + {LLIL_FLOOR, {SourceExprLowLevelOperandUsage}}, + {LLIL_CEIL, {SourceExprLowLevelOperandUsage}}, + {LLIL_FTRUNC, {SourceExprLowLevelOperandUsage}}, {LLIL_FCMP_E, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_FCMP_NE, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, {LLIL_FCMP_LT, {LeftExprLowLevelOperandUsage, RightExprLowLevelOperandUsage}}, @@ -1816,6 +1820,10 @@ void LowLevelILInstruction::VisitExprs(const std::functionAddExprWithLocation(operation, *this, size, flags, subExprHandler(AsOneOperand().GetSourceExpr())); case LLIL_ADD: @@ -3349,6 +3361,30 @@ ExprId LowLevelILFunction::FloatConvert(size_t size, ExprId a, uint32_t flags, c } +ExprId LowLevelILFunction::RoundToInt(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_ROUND_TO_INT, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::Floor(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FLOOR, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::Ceil(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_CEIL, loc, size, flags, a); +} + + +ExprId LowLevelILFunction::FloatTrunc(size_t size, ExprId a, uint32_t flags, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_FTRUNC, loc, size, flags, a); +} + + ExprId LowLevelILFunction::FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_FCMP_E, loc, size, 0, a, b); diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index 4679f556..3cd1c8f4 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -1249,4 +1249,8 @@ namespace BinaryNinja template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; + template <> struct LowLevelILInstructionAccessor: public LowLevelILOneOperandInstruction {}; } diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index 7e1e663f..c4800837 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -215,6 +215,10 @@ unordered_map> {MLIL_FLOAT_TO_INT, {SourceExprMediumLevelOperandUsage}}, {MLIL_INT_TO_FLOAT, {SourceExprMediumLevelOperandUsage}}, {MLIL_FLOAT_CONV, {SourceExprMediumLevelOperandUsage}}, + {MLIL_ROUND_TO_INT, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FLOOR, {SourceExprMediumLevelOperandUsage}}, + {MLIL_CEIL, {SourceExprMediumLevelOperandUsage}}, + {MLIL_FTRUNC, {SourceExprMediumLevelOperandUsage}}, {MLIL_FCMP_E, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_FCMP_NE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_FCMP_LT, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, @@ -1300,6 +1304,10 @@ void MediumLevelILInstruction::VisitExprs(const std::functionAddExprWithLocation(operation, *this, size, subExprHandler(AsOneOperand().GetSourceExpr())); case MLIL_ADD: @@ -2731,6 +2743,30 @@ ExprId MediumLevelILFunction::FloatConvert(size_t size, ExprId a, const ILSource } +ExprId MediumLevelILFunction::RoundToInt(size_t size, ExprId a, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_ROUND_TO_INT, loc, size, a); +} + + +ExprId MediumLevelILFunction::Floor(size_t size, ExprId a, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FLOOR, loc, size, a); +} + + +ExprId MediumLevelILFunction::Ceil(size_t size, ExprId a, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_CEIL, loc, size, a); +} + + +ExprId MediumLevelILFunction::FloatTrunc(size_t size, ExprId a, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FTRUNC, loc, size, a); +} + + ExprId MediumLevelILFunction::FloatCompareEqual(size_t size, ExprId a, ExprId b, const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_FCMP_E, loc, size, a, b); diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h index de92764d..cdda87f5 100644 --- a/mediumlevelilinstruction.h +++ b/mediumlevelilinstruction.h @@ -1012,4 +1012,8 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILOneOperandInstruction {}; } diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 273d3aeb..8a132478 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -295,6 +295,10 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_FLOAT_TO_INT: [("src", "expr")], LowLevelILOperation.LLIL_INT_TO_FLOAT: [("src", "expr")], LowLevelILOperation.LLIL_FLOAT_CONV: [("src", "expr")], + LowLevelILOperation.LLIL_ROUND_TO_INT: [("src", "expr")], + LowLevelILOperation.LLIL_FLOOR: [("src", "expr")], + LowLevelILOperation.LLIL_CEIL: [("src", "expr")], + LowLevelILOperation.LLIL_FTRUNC: [("src", "expr")], LowLevelILOperation.LLIL_FCMP_E: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_FCMP_NE: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_FCMP_LT: [("left", "expr"), ("right", "expr")], @@ -1967,6 +1971,54 @@ class LowLevelILFunction(object): """ return self.expr(LowLevelILOperation.LLIL_FLOAT_CONV, value.index, size=size, flags=flags) + def round_to_int(self, size, value, flags=None): + """ + ``round_to_int`` rounds a floating point value to the nearest integer + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``roundint.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_ROUND_TO_INT, value.index, size=size, flags=flags) + + def floor(self, size, value, flags=None): + """ + ``floor`` rounds a floating point value to an integer towards negative infinity + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``roundint.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FLOOR, value.index, size=size, flags=flags) + + def ceil(self, size, value, flags=None): + """ + ``ceil`` rounds a floating point value to an integer towards positive infinity + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``roundint.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_CEIL, value.index, size=size, flags=flags) + + def float_trunc(self, size, value, flags=None): + """ + ``float_trunc`` rounds a floating point value to an integer towards zero + + :param int size: the size of the result in bytes + :param LowLevelILExpr value: the expression to negate + :param str flags: optional, flags to set + :return: The expression ``roundint.{}(value)`` + :rtype: LowLevelILExpr + """ + return self.expr(LowLevelILOperation.LLIL_FTRUNC, value.index, size=size, flags=flags) + def float_compare_equal(self, size, a, b): """ ``float_compare_equal`` returns floating point comparison expression of size ``size`` checking if diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 3c4ba3fd..a842c3c4 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -165,6 +165,10 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_FLOAT_TO_INT: [("src", "expr")], MediumLevelILOperation.MLIL_INT_TO_FLOAT: [("src", "expr")], MediumLevelILOperation.MLIL_FLOAT_CONV: [("src", "expr")], + MediumLevelILOperation.MLIL_ROUND_TO_INT: [("src", "expr")], + MediumLevelILOperation.MLIL_FLOOR: [("src", "expr")], + MediumLevelILOperation.MLIL_CEIL: [("src", "expr")], + MediumLevelILOperation.MLIL_FTRUNC: [("src", "expr")], MediumLevelILOperation.MLIL_FCMP_E: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_FCMP_NE: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_FCMP_LT: [("left", "expr"), ("right", "expr")], -- cgit v1.3.1 From 83c9c2bceeb354dcf53e338e9411c6636f418123 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 7 Feb 2018 17:18:27 -0500 Subject: Add APIs for overriding stack adjustments on calls --- binaryninjaapi.h | 15 +++++++++ binaryninjacore.h | 19 ++++++++++++ function.cpp | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ python/function.py | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 212 insertions(+) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 650299ed..d7535184 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2329,6 +2329,21 @@ namespace BinaryNinja std::vector GetIndirectBranches(); std::vector GetIndirectBranchesAt(Architecture* arch, uint64_t addr); + void SetAutoCallStackAdjustment(Architecture* arch, uint64_t addr, const Confidence& adjust); + void SetAutoCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, + const std::map>& adjust); + void SetAutoCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack, + const Confidence& adjust); + void SetUserCallStackAdjustment(Architecture* arch, uint64_t addr, const Confidence& adjust); + void SetUserCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, + const std::map>& adjust); + void SetUserCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack, + const Confidence& adjust); + + Confidence GetCallStackAdjustment(Architecture* arch, uint64_t addr); + std::map> GetCallRegisterStackAdjustment(Architecture* arch, uint64_t addr); + Confidence GetCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack); + std::vector> GetBlockAnnotations(Architecture* arch, uint64_t addr); BNIntegerDisplayType GetIntegerConstantDisplayType(Architecture* arch, uint64_t instrAddr, uint64_t value, diff --git a/binaryninjacore.h b/binaryninjacore.h index 945badce..a9c38ed6 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2383,6 +2383,25 @@ extern "C" uint64_t addr, size_t* count); BINARYNINJACOREAPI void BNFreeIndirectBranchList(BNIndirectBranchInfo* branches); + BINARYNINJACOREAPI void BNSetAutoCallStackAdjustment(BNFunction* func, BNArchitecture* arch, uint64_t addr, + size_t adjust, uint8_t confidence); + BINARYNINJACOREAPI void BNSetUserCallStackAdjustment(BNFunction* func, BNArchitecture* arch, uint64_t addr, + size_t adjust, uint8_t confidence); + BINARYNINJACOREAPI void BNSetAutoCallRegisterStackAdjustment(BNFunction* func, BNArchitecture* arch, uint64_t addr, + BNRegisterStackAdjustment* adjust, size_t count); + BINARYNINJACOREAPI void BNSetUserCallRegisterStackAdjustment(BNFunction* func, BNArchitecture* arch, uint64_t addr, + BNRegisterStackAdjustment* adjust, size_t count); + BINARYNINJACOREAPI void BNSetAutoCallRegisterStackAdjustmentForRegisterStack(BNFunction* func, + BNArchitecture* arch, uint64_t addr, uint32_t regStack, int32_t adjust, uint8_t confidence); + BINARYNINJACOREAPI void BNSetUserCallRegisterStackAdjustmentForRegisterStack(BNFunction* func, + BNArchitecture* arch, uint64_t addr, uint32_t regStack, int32_t adjust, uint8_t confidence); + + BINARYNINJACOREAPI BNSizeWithConfidence BNGetCallStackAdjustment(BNFunction* func, BNArchitecture* arch, uint64_t addr); + BINARYNINJACOREAPI BNRegisterStackAdjustment* BNGetCallRegisterStackAdjustment(BNFunction* func, + BNArchitecture* arch, uint64_t addr, size_t* count); + BINARYNINJACOREAPI BNRegisterStackAdjustment BNGetCallRegisterStackAdjustmentForRegisterStack(BNFunction* func, + BNArchitecture* arch, uint64_t addr, uint32_t regStack); + BINARYNINJACOREAPI BNInstructionTextLine* BNGetFunctionBlockAnnotations(BNFunction* func, BNArchitecture* arch, uint64_t addr, size_t* count); BINARYNINJACOREAPI void BNFreeInstructionTextLines(BNInstructionTextLine* lines, size_t count); diff --git a/function.cpp b/function.cpp index ba2b419e..cd9be4d5 100644 --- a/function.cpp +++ b/function.cpp @@ -1018,6 +1018,96 @@ vector Function::GetIndirectBranchesAt(Architecture* arch, u } +void Function::SetAutoCallStackAdjustment(Architecture* arch, uint64_t addr, const Confidence& adjust) +{ + BNSetAutoCallStackAdjustment(m_object, arch->GetObject(), addr, adjust.GetValue(), adjust.GetConfidence()); +} + + +void Function::SetAutoCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, + const map>& adjust) +{ + BNRegisterStackAdjustment* values = new BNRegisterStackAdjustment[adjust.size()]; + size_t i = 0; + for (auto& j : adjust) + { + values[i].regStack = j.first; + values[i].adjustment = j.second.GetValue(); + values[i].confidence = j.second.GetConfidence(); + i++; + } + BNSetAutoCallRegisterStackAdjustment(m_object, arch->GetObject(), addr, values, adjust.size()); + delete[] values; +} + + +void Function::SetAutoCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack, + const Confidence& adjust) +{ + BNSetAutoCallRegisterStackAdjustmentForRegisterStack(m_object, arch->GetObject(), addr, regStack, + adjust.GetValue(), adjust.GetConfidence()); +} + + +void Function::SetUserCallStackAdjustment(Architecture* arch, uint64_t addr, const Confidence& adjust) +{ + BNSetUserCallStackAdjustment(m_object, arch->GetObject(), addr, adjust.GetValue(), adjust.GetConfidence()); +} + + +void Function::SetUserCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, + const map>& adjust) +{ + BNRegisterStackAdjustment* values = new BNRegisterStackAdjustment[adjust.size()]; + size_t i = 0; + for (auto& j : adjust) + { + values[i].regStack = j.first; + values[i].adjustment = j.second.GetValue(); + values[i].confidence = j.second.GetConfidence(); + i++; + } + BNSetUserCallRegisterStackAdjustment(m_object, arch->GetObject(), addr, values, adjust.size()); + delete[] values; +} + + +void Function::SetUserCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack, + const Confidence& adjust) +{ + BNSetUserCallRegisterStackAdjustmentForRegisterStack(m_object, arch->GetObject(), addr, regStack, + adjust.GetValue(), adjust.GetConfidence()); +} + + +Confidence Function::GetCallStackAdjustment(Architecture* arch, uint64_t addr) +{ + BNSizeWithConfidence result = BNGetCallStackAdjustment(m_object, arch->GetObject(), addr); + return Confidence(result.value, result.confidence); +} + + +map> Function::GetCallRegisterStackAdjustment(Architecture* arch, uint64_t addr) +{ + size_t count; + BNRegisterStackAdjustment* adjust = BNGetCallRegisterStackAdjustment(m_object, arch->GetObject(), addr, &count); + + map> result; + for (size_t i = 0; i < count; i++) + result[adjust[i].regStack] = Confidence(adjust[i].adjustment, adjust[i].confidence); + BNFreeRegisterStackAdjustments(adjust); + return result; +} + + +Confidence Function::GetCallRegisterStackAdjustment(Architecture* arch, uint64_t addr, uint32_t regStack) +{ + BNRegisterStackAdjustment result = BNGetCallRegisterStackAdjustmentForRegisterStack(m_object, + arch->GetObject(), addr, regStack); + return Confidence(result.adjustment, result.confidence); +} + + vector> Function::GetBlockAnnotations(Architecture* arch, uint64_t addr) { size_t count; diff --git a/python/function.py b/python/function.py index 7607657f..664afcd0 100644 --- a/python/function.py +++ b/python/function.py @@ -1453,6 +1453,94 @@ class Function(object): result = core.BNGetFunctionRegisterValueAtExit(self.handle, self.arch.get_reg_index(reg)) return RegisterValue(self.arch, result.value, confidence = result.confidence) + def set_auto_call_stack_adjustment(self, addr, adjust, arch=None): + if arch is None: + arch = self.arch + if not isinstance(adjust, types.SizeWithConfidence): + adjust = types.SizeWithConfidence(adjust) + core.BNSetAutoCallStackAdjustment(self.handle, arch.handle, addr, adjust.value, adjust.confidence) + + def set_auto_call_reg_stack_adjustment(self, addr, adjust, arch=None): + if arch is None: + arch = self.arch + adjust_buf = (core.BNRegisterStackAdjustment * len(adjust))() + i = 0 + for reg_stack in adjust.keys(): + adjust_buf[i].regStack = arch.get_reg_stack_index(reg_stack) + value = adjust[reg_stack] + if not isinstance(value, types.RegisterStackAdjustmentWithConfidence): + value = types.RegisterStackAdjustmentWithConfidence(value) + adjust_buf[i].adjustment = value.value + adjust_buf[i].confidence = value.confidence + i += 1 + core.BNSetAutoCallRegisterStackAdjustment(self.handle, arch.handle, addr, adjust_buf, len(adjust)) + + def set_auto_call_reg_stack_adjustment_for_reg_stack(self, addr, reg_stack, adjust, arch=None): + if arch is None: + arch = self.arch + reg_stack = arch.get_reg_stack_index(reg_stack) + if not isinstance(adjust, types.RegisterStackAdjustmentWithConfidence): + adjust = types.RegisterStackAdjustmentWithConfidence(adjust) + core.BNSetAutoCallRegisterStackAdjustmentForRegisterStack(self.handle, arch.handle, addr, reg_stack, + adjust.value, adjust.confidence) + + def set_call_stack_adjustment(self, addr, adjust, arch=None): + if arch is None: + arch = self.arch + if not isinstance(adjust, types.SizeWithConfidence): + adjust = types.SizeWithConfidence(adjust) + core.BNSetUserCallStackAdjustment(self.handle, arch.handle, addr, adjust.value, adjust.confidence) + + def set_call_reg_stack_adjustment(self, addr, adjust, arch=None): + if arch is None: + arch = self.arch + adjust_buf = (core.BNRegisterStackAdjustment * len(adjust))() + i = 0 + for reg_stack in adjust.keys(): + adjust_buf[i].regStack = arch.get_reg_stack_index(reg_stack) + value = adjust[reg_stack] + if not isinstance(value, types.RegisterStackAdjustmentWithConfidence): + value = types.RegisterStackAdjustmentWithConfidence(value) + adjust_buf[i].adjustment = value.value + adjust_buf[i].confidence = value.confidence + i += 1 + core.BNSetUserCallRegisterStackAdjustment(self.handle, arch.handle, addr, adjust_buf, len(adjust)) + + def set_call_reg_stack_adjustment_for_reg_stack(self, addr, reg_stack, adjust, arch=None): + if arch is None: + arch = self.arch + reg_stack = arch.get_reg_stack_index(reg_stack) + if not isinstance(adjust, types.RegisterStackAdjustmentWithConfidence): + adjust = types.RegisterStackAdjustmentWithConfidence(adjust) + core.BNSetUserCallRegisterStackAdjustmentForRegisterStack(self.handle, arch.handle, addr, reg_stack, + adjust.value, adjust.confidence) + + def get_call_stack_adjustment(self, addr, arch=None): + if arch is None: + arch = self.arch + result = core.BNGetCallStackAdjustment(self.handle, arch.handle, addr) + return types.SizeWithConfidence(result.value, confidence = result.confidence) + + def get_call_reg_stack_adjustment(self, addr, arch=None): + if arch is None: + arch = self.arch + count = ctypes.c_ulonglong() + adjust = core.BNGetCallRegisterStackAdjustment(self.handle, arch.handle, addr, count) + result = {} + for i in xrange(0, count.value): + result[arch.get_reg_stack_name(adjust[i].regStack)] = types.RegisterStackAdjustmentWithConfidence( + adjust[i].adjustment, confidence = adjust[i].confidence) + core.BNFreeRegisterStackAdjustments(adjust) + return result + + def get_call_reg_stack_adjustment_for_reg_stack(self, addr, reg_stack, arch=None): + if arch is None: + arch = self.arch + reg_stack = arch.get_reg_stack_index(reg_stack) + adjust = core.BNGetCallRegisterStackAdjustmentForRegisterStack(self.handle, arch.handle, addr, reg_stack) + result = types.RegisterStackAdjustmentWithConfidence(adjust.adjustment, confidence = adjust.confidence) + return result + class AdvancedFunctionAnalysisDataRequestor(object): def __init__(self, func = None): -- cgit v1.3.1 From 79b5bdcf42f6abf1c8b2c4bda4c30b41319c4aa5 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Fri, 9 Feb 2018 17:17:53 -0500 Subject: Add instructions for tracking freed register stack slots --- binaryninjaapi.h | 10 ++++++++ binaryninjacore.h | 6 +++++ lowlevelilinstruction.cpp | 59 ++++++++++++++++++++++++++++++++++++++++++++ lowlevelilinstruction.h | 27 ++++++++++++++++++++ mediumlevelilinstruction.cpp | 21 ++++++++++++++++ mediumlevelilinstruction.h | 12 +++++++++ python/lowlevelil.py | 4 +++ python/mediumlevelil.py | 2 ++ 8 files changed, 141 insertions(+) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index d7535184..187740b9 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2572,10 +2572,17 @@ namespace BinaryNinja const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackPop(size_t size, uint32_t regStack, uint32_t flags = 0, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackFreeReg(uint32_t reg, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackFreeTopRelative(uint32_t regStack, ExprId entry, + const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackTopRelativeSSA(size_t size, const SSARegisterStack& regStack, ExprId entry, const SSARegister& top, const ILSourceLocation& loc = ILSourceLocation()); ExprId RegisterStackAbsoluteSSA(size_t size, const SSARegisterStack& regStack, uint32_t reg, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackFreeTopRelativeSSA(uint32_t regStack, size_t destVersion, size_t srcVersion, + ExprId entry, const SSARegister& top, const ILSourceLocation& loc = ILSourceLocation()); + ExprId RegisterStackFreeAbsoluteSSA(uint32_t regStack, size_t destVersion, size_t srcVersion, + uint32_t reg, const ILSourceLocation& loc = ILSourceLocation()); ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); ExprId FloatConstRaw(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation()); @@ -3013,6 +3020,9 @@ namespace BinaryNinja const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); ExprId IntrinsicSSA(const std::vector& outputs, uint32_t intrinsic, const std::vector& params, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FreeVarSlot(const Variable& var, const ILSourceLocation& loc = ILSourceLocation()); + ExprId FreeVarSlotSSA(const Variable& var, size_t newVersion, size_t prevVersion, + const ILSourceLocation& loc = ILSourceLocation()); ExprId Undefined(const ILSourceLocation& loc = ILSourceLocation()); ExprId Unimplemented(const ILSourceLocation& loc = ILSourceLocation()); ExprId UnimplementedMemoryRef(size_t size, ExprId target, diff --git a/binaryninjacore.h b/binaryninjacore.h index a9c38ed6..528df6bd 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -291,6 +291,8 @@ extern "C" LLIL_REG_SPLIT, // Not valid in SSA form (see LLIL_REG_SPLIT_SSA) LLIL_REG_STACK_REL, // Not valid in SSA form (see LLIL_REG_STACK_REL_SSA) LLIL_REG_STACK_POP, // Not valid in SSA form (expanded) + LLIL_REG_STACK_FREE_REG, // Not valid in SSA form (see LLIL_REG_STACK_FREE_REL_SSA, LLIL_REG_STACK_FREE_ABS_SSA) + LLIL_REG_STACK_FREE_REL, // Not valid in SSA from (see LLIL_REG_STACK_FREE_REL_SSA) LLIL_CONST, LLIL_CONST_PTR, LLIL_FLOAT_CONST, @@ -394,6 +396,8 @@ extern "C" LLIL_REG_SPLIT_SSA, LLIL_REG_STACK_REL_SSA, LLIL_REG_STACK_ABS_SSA, + LLIL_REG_STACK_FREE_REL_SSA, + LLIL_REG_STACK_FREE_ABS_SSA, LLIL_SET_FLAG_SSA, LLIL_FLAG_SSA, LLIL_FLAG_BIT_SSA, @@ -865,6 +869,7 @@ extern "C" MLIL_SYSCALL, // Not valid in SSA form (see MLIL_SYSCALL_SSA) MLIL_SYSCALL_UNTYPED, // Not valid in SSA form (see MLIL_SYSCALL_UNTYPED_SSA) MLIL_INTRINSIC, // Not valid in SSA form (see MLIL_INTRINSIC_SSA) + MLIL_FREE_VAR_SLOT, // Not valid in SSA from (see MLIL_FREE_VAR_SLOT_SSA) MLIL_BP, MLIL_TRAP, MLIL_UNDEF, @@ -917,6 +922,7 @@ extern "C" MLIL_STORE_SSA, MLIL_STORE_STRUCT_SSA, MLIL_INTRINSIC_SSA, + MLIL_FREE_VAR_SLOT_SSA, MLIL_VAR_PHI, MLIL_MEM_PHI }; diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp index c38d742f..32425784 100644 --- a/lowlevelilinstruction.cpp +++ b/lowlevelilinstruction.cpp @@ -129,9 +129,16 @@ unordered_map> {LLIL_REG_SPLIT_SSA, {HighSSARegisterLowLevelOperandUsage, LowSSARegisterLowLevelOperandUsage}}, {LLIL_REG_STACK_REL, {SourceRegisterStackLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, {LLIL_REG_STACK_POP, {SourceRegisterStackLowLevelOperandUsage}}, + {LLIL_REG_STACK_FREE_REG, {DestRegisterLowLevelOperandUsage}}, + {LLIL_REG_STACK_FREE_REL, {DestRegisterStackLowLevelOperandUsage, DestExprLowLevelOperandUsage}}, {LLIL_REG_STACK_REL_SSA, {SourceSSARegisterStackLowLevelOperandUsage, TopSSARegisterLowLevelOperandUsage, SourceExprLowLevelOperandUsage}}, {LLIL_REG_STACK_ABS_SSA, {SourceSSARegisterStackLowLevelOperandUsage, SourceRegisterLowLevelOperandUsage}}, + {LLIL_REG_STACK_FREE_REL_SSA, {DestSSARegisterStackLowLevelOperandUsage, + PartialSSARegisterStackSourceLowLevelOperandUsage, DestExprLowLevelOperandUsage, + TopSSARegisterLowLevelOperandUsage}}, + {LLIL_REG_STACK_FREE_ABS_SSA, {DestSSARegisterStackLowLevelOperandUsage, + PartialSSARegisterStackSourceLowLevelOperandUsage, DestRegisterLowLevelOperandUsage}}, {LLIL_FLAG, {SourceFlagLowLevelOperandUsage}}, {LLIL_FLAG_BIT, {SourceFlagLowLevelOperandUsage, BitIndexLowLevelOperandUsage}}, {LLIL_FLAG_SSA, {SourceSSAFlagLowLevelOperandUsage}}, @@ -1762,9 +1769,15 @@ void LowLevelILInstruction::VisitExprs(const std::function().VisitExprs(func); break; + case LLIL_REG_STACK_FREE_REL: + GetDestExpr().VisitExprs(func); + break; case LLIL_REG_STACK_REL_SSA: GetSourceExpr().VisitExprs(func); break; + case LLIL_REG_STACK_FREE_REL_SSA: + GetDestExpr().VisitExprs(func); + break; case LLIL_LOAD: GetSourceExpr().VisitExprs(func); break; @@ -1985,6 +1998,11 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, subExprHandler(GetSourceExpr()), *this); case LLIL_REG_STACK_POP: return dest->RegisterStackPop(size, GetSourceRegisterStack(), flags, *this); + case LLIL_REG_STACK_FREE_REG: + return dest->RegisterStackFreeReg(GetDestRegister(), *this); + case LLIL_REG_STACK_FREE_REL: + return dest->RegisterStackFreeTopRelative(GetDestRegisterStack(), + subExprHandler(GetDestExpr()), *this); case LLIL_REG_STACK_REL_SSA: return dest->RegisterStackTopRelativeSSA(size, GetSourceSSARegisterStack(), subExprHandler(GetSourceExpr()), @@ -1992,6 +2010,17 @@ ExprId LowLevelILInstruction::CopyTo(LowLevelILFunction* dest, case LLIL_REG_STACK_ABS_SSA: return dest->RegisterStackAbsoluteSSA(size, GetSourceSSARegisterStack(), GetSourceRegister(), *this); + case LLIL_REG_STACK_FREE_REL_SSA: + return dest->RegisterStackFreeTopRelativeSSA(GetDestSSARegisterStack().regStack, + GetDestSSARegisterStack().version, + GetSourceSSARegisterStack().version, + subExprHandler(GetDestExpr()), + GetTopSSARegister(), *this); + case LLIL_REG_STACK_FREE_ABS_SSA: + return dest->RegisterStackFreeAbsoluteSSA(GetDestSSARegisterStack().regStack, + GetDestSSARegisterStack().version, + GetSourceSSARegisterStack().version, + GetDestRegister(), *this); case LLIL_FLAG: return dest->Flag(GetSourceFlag(), *this); case LLIL_FLAG_SSA: @@ -2787,6 +2816,18 @@ ExprId LowLevelILFunction::RegisterStackPop(size_t size, uint32_t regStack, uint } +ExprId LowLevelILFunction::RegisterStackFreeReg(uint32_t reg, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_FREE_REG, loc, 0, 0, reg); +} + + +ExprId LowLevelILFunction::RegisterStackFreeTopRelative(uint32_t regStack, ExprId entry, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_FREE_REG, loc, 0, 0, regStack, entry); +} + + ExprId LowLevelILFunction::RegisterStackTopRelativeSSA(size_t size, const SSARegisterStack& regStack, ExprId entry, const SSARegister& top, const ILSourceLocation& loc) { @@ -2802,6 +2843,24 @@ ExprId LowLevelILFunction::RegisterStackAbsoluteSSA(size_t size, const SSARegist } +ExprId LowLevelILFunction::RegisterStackFreeTopRelativeSSA(uint32_t regStack, + size_t destVersion, size_t srcVersion, ExprId entry, const SSARegister& top, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_FREE_REL_SSA, loc, 0, 0, + AddExprWithLocation(LLIL_REG_STACK_DEST_SSA, loc, 0, 0, regStack, destVersion, srcVersion), + entry, AddExprWithLocation(LLIL_REG_SSA, loc, 0, 0, top.reg, top.version)); +} + + +ExprId LowLevelILFunction::RegisterStackFreeAbsoluteSSA(uint32_t regStack, + size_t destVersion, size_t srcVersion, uint32_t reg, const ILSourceLocation& loc) +{ + return AddExprWithLocation(LLIL_REG_STACK_FREE_ABS_SSA, loc, 0, 0, + AddExprWithLocation(LLIL_REG_STACK_DEST_SSA, loc, 0, 0, regStack, destVersion, srcVersion), reg); +} + + ExprId LowLevelILFunction::Const(size_t size, uint64_t val, const ILSourceLocation& loc) { return AddExprWithLocation(LLIL_CONST, loc, size, 0, val); diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h index 3cd1c8f4..675baa3c 100644 --- a/lowlevelilinstruction.h +++ b/lowlevelilinstruction.h @@ -1013,6 +1013,15 @@ namespace BinaryNinja { uint32_t GetSourceRegisterStack() const { return GetRawOperandAsRegister(0); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetDestRegister() const { return GetRawOperandAsRegister(0); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + uint32_t GetDestRegisterStack() const { return GetRawOperandAsRegister(0); } + LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); } + }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsSSARegisterStack(0); } @@ -1027,6 +1036,24 @@ namespace BinaryNinja uint32_t GetSourceRegister() const { return GetRawOperandAsRegister(2); } void SetSourceSSAVersion(size_t version) { UpdateRawOperand(1, version); } }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetDestSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsSSARegisterStack(0); } + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsPartialSSARegisterStackSource(0); } + LowLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); } + SSARegister GetTopSSARegister() const { return GetRawOperandAsExpr(2).GetRawOperandAsSSARegister(0); } + void SetDestSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(1, version); } + void SetSourceSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(2, version); } + void SetTopSSAVersion(size_t version) { GetRawOperandAsExpr(2).UpdateRawOperand(1, version); } + }; + template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase + { + SSARegisterStack GetDestSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsSSARegisterStack(0); } + SSARegisterStack GetSourceSSARegisterStack() const { return GetRawOperandAsExpr(0).GetRawOperandAsPartialSSARegisterStackSource(0); } + uint32_t GetDestRegister() const { return GetRawOperandAsRegister(1); } + void SetDestSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(1, version); } + void SetSourceSSAVersion(size_t version) { GetRawOperandAsExpr(0).UpdateRawOperand(2, version); } + }; template <> struct LowLevelILInstructionAccessor: public LowLevelILInstructionBase { uint32_t GetSourceFlag() const { return GetRawOperandAsRegister(0); } diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index c4800837..39ab4f28 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -150,6 +150,8 @@ unordered_map> ParameterExprsMediumLevelOperandUsage}}, {MLIL_INTRINSIC_SSA, {OutputSSAVariablesMediumLevelOperandUsage, IntrinsicMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage}}, + {MLIL_FREE_VAR_SLOT, {DestVariableMediumLevelOperandUsage}}, + {MLIL_FREE_VAR_SLOT_SSA, {DestSSAVariableMediumLevelOperandUsage, PartialSSAVariableSourceMediumLevelOperandUsage}}, {MLIL_TRAP, {VectorMediumLevelOperandUsage}}, {MLIL_VAR_PHI, {DestSSAVariableMediumLevelOperandUsage, SourceSSAVariablesMediumLevelOperandUsages}}, {MLIL_MEM_PHI, {DestMemoryVersionMediumLevelOperandUsage, SourceMemoryVersionsMediumLevelOperandUsage}}, @@ -1653,6 +1655,12 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest, params.push_back(subExprHandler(i)); return dest->IntrinsicSSA(GetOutputSSAVariables(), GetIntrinsic(), params, *this); + case MLIL_FREE_VAR_SLOT: + return dest->FreeVarSlot(GetDestVariable(), *this); + case MLIL_FREE_VAR_SLOT_SSA: + return dest->FreeVarSlotSSA(GetDestSSAVariable().var, + GetDestSSAVariable().version, + GetSourceSSAVariable().version, *this); case MLIL_UNDEF: return dest->Undefined(*this); case MLIL_UNIMPL: @@ -2648,6 +2656,19 @@ ExprId MediumLevelILFunction::IntrinsicSSA(const vector& outputs, u } +ExprId MediumLevelILFunction::FreeVarSlot(const Variable& var, const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FREE_VAR_SLOT, loc, 0, var.ToIdentifier()); +} + + +ExprId MediumLevelILFunction::FreeVarSlotSSA(const Variable& var, size_t newVersion, size_t prevVersion, + const ILSourceLocation& loc) +{ + return AddExprWithLocation(MLIL_FREE_VAR_SLOT_SSA, loc, 0, var.ToIdentifier(), newVersion, prevVersion); +} + + ExprId MediumLevelILFunction::Undefined(const ILSourceLocation& loc) { return AddExprWithLocation(MLIL_UNDEF, loc, 0); diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h index cdda87f5..a0c4fd9b 100644 --- a/mediumlevelilinstruction.h +++ b/mediumlevelilinstruction.h @@ -922,6 +922,18 @@ namespace BinaryNinja void SetOutputSSAVariables(const std::vector& vars) { UpdateRawOperandAsSSAVariableList(0, vars); } }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + Variable GetDestVariable() const { return GetRawOperandAsVariable(0); } + }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase + { + SSAVariable GetDestSSAVariable() const { return GetRawOperandAsSSAVariable(0); } + SSAVariable GetSourceSSAVariable() const { return GetRawOperandAsPartialSSAVariableSource(0); } + void SetDestSSAVersion(size_t version) { UpdateRawOperand(1, version); } + void SetSourceSSAVersion(size_t version) { UpdateRawOperand(2, version); } + }; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILInstructionBase { int64_t GetVector() const { return GetRawOperandAsInteger(0); } diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 8a132478..e64e20fd 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -219,6 +219,8 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_REG_SPLIT: [("hi", "reg"), ("lo", "reg")], LowLevelILOperation.LLIL_REG_STACK_REL: [("stack", "reg_stack"), ("src", "expr")], LowLevelILOperation.LLIL_REG_STACK_POP: [("stack", "reg_stack")], + LowLevelILOperation.LLIL_REG_STACK_FREE_REG: [("dest", "reg")], + LowLevelILOperation.LLIL_REG_STACK_FREE_REL: [("stack", "reg_stack"), ("dest", "expr")], LowLevelILOperation.LLIL_CONST: [("constant", "int")], LowLevelILOperation.LLIL_CONST_PTR: [("constant", "int")], LowLevelILOperation.LLIL_FLOAT_CONST: [("constant", "float")], @@ -319,6 +321,8 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_REG_SPLIT_SSA: [("hi", "reg_ssa"), ("lo", "reg_ssa")], LowLevelILOperation.LLIL_REG_STACK_REL_SSA: [("stack", "reg_stack_ssa"), ("src", "expr"), ("top", "expr")], LowLevelILOperation.LLIL_REG_STACK_ABS_SSA: [("stack", "reg_stack_ssa"), ("src", "reg")], + LowLevelILOperation.LLIL_REG_STACK_FREE_REL_SSA: [("stack", "expr"), ("dest", "expr"), ("top", "expr")], + LowLevelILOperation.LLIL_REG_STACK_FREE_ABS_SSA: [("stack", "expr"), ("dest", "reg")], LowLevelILOperation.LLIL_SET_FLAG_SSA: [("dest", "flag_ssa"), ("src", "expr")], LowLevelILOperation.LLIL_FLAG_SSA: [("src", "flag_ssa")], LowLevelILOperation.LLIL_FLAG_BIT_SSA: [("src", "flag_ssa"), ("bit", "int")], diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index a842c3c4..caf19e8e 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -152,6 +152,8 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_TRAP: [("vector", "int")], MediumLevelILOperation.MLIL_INTRINSIC: [("output", "var_list"), ("intrinsic", "intrinsic"), ("params", "expr_list")], MediumLevelILOperation.MLIL_INTRINSIC_SSA: [("output", "var_ssa_list"), ("intrinsic", "intrinsic"), ("params", "expr_list")], + MediumLevelILOperation.MLIL_FREE_VAR_SLOT: [("dest", "var")], + MediumLevelILOperation.MLIL_FREE_VAR_SLOT_SSA: [("prev", "var_ssa_dest_and_src")], MediumLevelILOperation.MLIL_UNDEF: [], MediumLevelILOperation.MLIL_UNIMPL: [], MediumLevelILOperation.MLIL_UNIMPL_MEM: [("src", "expr")], -- cgit v1.3.1 From 4c3184d5391f78b30e9be04651b1445157144316 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 13 Feb 2018 17:27:50 -0500 Subject: Add missing instruction --- mediumlevelilinstruction.cpp | 1 + mediumlevelilinstruction.h | 1 + 2 files changed, 2 insertions(+) diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp index 586eb470..fa66f553 100644 --- a/mediumlevelilinstruction.cpp +++ b/mediumlevelilinstruction.cpp @@ -227,6 +227,7 @@ unordered_map> {MLIL_FCMP_LE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_FCMP_GE, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_FCMP_GT, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, + {MLIL_FCMP_O, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}}, {MLIL_FCMP_UO, {LeftExprMediumLevelOperandUsage, RightExprMediumLevelOperandUsage}} }; diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h index a0c4fd9b..e3167585 100644 --- a/mediumlevelilinstruction.h +++ b/mediumlevelilinstruction.h @@ -1004,6 +1004,7 @@ namespace BinaryNinja template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; + template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandInstruction {}; template <> struct MediumLevelILInstructionAccessor: public MediumLevelILTwoOperandWithCarryInstruction {}; -- cgit v1.3.1 From 4c58c514e4acfa5cb95a53c7fa09f115e886c107 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Wed, 14 Feb 2018 16:24:15 -0500 Subject: fix typo in semantic flag core names --- python/architecture.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/python/architecture.py b/python/architecture.py index 3ccd2b11..028fdeaa 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -352,14 +352,14 @@ class Architecture(object): self._cb.getRegisterName = self._cb.getRegisterName.__class__(self._get_register_name) self._cb.getFlagName = self._cb.getFlagName.__class__(self._get_flag_name) self._cb.getFlagWriteTypeName = self._cb.getFlagWriteTypeName.__class__(self._get_flag_write_type_name) - self._cb.getFlagSemanticClassName = self._cb.getFlagSemanticClassName.__class__(self._get_semantic_flag_class_name) - self._cb.getFlagSemanticGroupName = self._cb.getFlagSemanticGroupName.__class__(self._get_semantic_flag_group_name) + self._cb.getSemanticFlagClassName = self._cb.getSemanticFlagClassName.__class__(self._get_semantic_flag_class_name) + self._cb.getSemanticFlagGroupName = self._cb.getSemanticFlagGroupName.__class__(self._get_semantic_flag_group_name) self._cb.getFullWidthRegisters = self._cb.getFullWidthRegisters.__class__(self._get_full_width_registers) self._cb.getAllRegisters = self._cb.getAllRegisters.__class__(self._get_all_registers) self._cb.getAllFlags = self._cb.getAllRegisters.__class__(self._get_all_flags) self._cb.getAllFlagWriteTypes = self._cb.getAllRegisters.__class__(self._get_all_flag_write_types) - self._cb.getAllFlagSemanticClasses = self._cb.getAllFlagSemanticClasses.__class__(self._get_all_semantic_flag_classes) - self._cb.getAllFlagSemanticGroups = self._cb.getAllFlagSemanticGroups.__class__(self._get_all_semantic_flag_groups) + self._cb.getAllSemanticFlagClasses = self._cb.getAllSemanticFlagClasses.__class__(self._get_all_semantic_flag_classes) + self._cb.getAllSemanticFlagGroups = self._cb.getAllSemanticFlagGroups.__class__(self._get_all_semantic_flag_groups) self._cb.getFlagRole = self._cb.getFlagRole.__class__(self._get_flag_role) self._cb.getFlagsRequiredForFlagCondition = self._cb.getFlagsRequiredForFlagCondition.__class__( self._get_flags_required_for_flag_condition) -- cgit v1.3.1 From 2de6ae566e2f7351d548e330addd82cc5c4d670d Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Fri, 16 Feb 2018 10:47:36 -0500 Subject: fix a typo --- python/lowlevelil.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index e64e20fd..d2f02c3d 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -968,7 +968,7 @@ class LowLevelILFunction(object): def load(self, size, addr): """ - ``laod`` Reads ``size`` bytes from the expression ``addr`` + ``load`` Reads ``size`` bytes from the expression ``addr`` :param int size: number of bytes to read :param LowLevelILExpr addr: the expression to read memory from -- cgit v1.3.1 From d785ee1870ecd7ce0f5259d56d80cbf2e3f3c94d Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Fri, 16 Feb 2018 10:47:52 -0500 Subject: another typo --- python/interaction.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/interaction.py b/python/interaction.py index 96cac42d..4f6ed67d 100644 --- a/python/interaction.py +++ b/python/interaction.py @@ -121,7 +121,7 @@ class IntegerField(object): class AddressField(object): """ ``AddressField`` prompts the user for an address. By passing the optional view and current_address parameters - offsets can be used instead of just an address. Th reslut is stored as in int in self.result. + offsets can be used instead of just an address. The result is stored as in int in self.result. Note: This API currenlty functions differently on the command line, as the view and current_address are disregarded. Additionally where as in the ui the result defaults to hexidecimal on the command line 0x must be -- cgit v1.3.1 From 73b3f7fc2ff9dab40f29da2031a0c6c71220d93c Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Fri, 16 Feb 2018 10:48:13 -0500 Subject: implement missing get_semantic_flag_class_name and get_semantic_flag_group_name --- python/architecture.py | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/python/architecture.py b/python/architecture.py index 028fdeaa..51a7cfba 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -1831,6 +1831,21 @@ class Architecture(object): return sem_class.index return sem_class + def get_semantic_flag_class_name(self, class_index): + """ + ``get_semantic_flag_class_name`` gets the name of a semantic flag class from the index. + + :param int _index: class_index + :return: the name of the semantic flag class + :rtype: str + """ + if not isinstance(class_index, int): + raise ValueError("argument 'class_index' must be an intege") + try: + return self._semantic_flag_classes_by_index[class_index] + except KeyError: + raise AttributeError("argument class_index is not a valid class index") + def get_semantic_flag_group_index(self, sem_group): if isinstance(sem_group, str): return self._semantic_flag_groups[sem_group] @@ -1838,6 +1853,21 @@ class Architecture(object): return sem_group.index return sem_group + def get_semantic_flag_group_name(self, group_index): + """ + ``get_semantic_flag_group_name`` gets the name of a semantic flag group from the index. + + :param int group_index: group_index + :return: the name of the semantic flag group + :rtype: str + """ + if not isinstance(group_index, int): + raise ValueError("argument 'group_index' must be an intege") + try: + return self._semantic_flag_groups_by_index[group_index] + except KeyError: + raise AttributeError("argument group_index is not a valid group index") + def get_intrinsic_name(self, intrinsic): """ ``get_intrinsic_name`` gets an intrinsic name from an intrinsic number. -- cgit v1.3.1 From f5d8f94993452815fe68e1da9cb398bf4b7e5917 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Sat, 17 Feb 2018 02:26:45 -0500 Subject: For Python, display set of values in hex format. --- python/function.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/function.py b/python/function.py index 664afcd0..39ace7c6 100644 --- a/python/function.py +++ b/python/function.py @@ -225,9 +225,9 @@ class PossibleValueSet(object): if self.type == RegisterValueType.LookupTableValue: return "" % ', '.join([repr(i) for i in self.table]) if self.type == RegisterValueType.InSetOfValues: - return "" % repr(self.values) + return "" % '[{}]'.format(', '.join(hex(i) for i in self.values)) if self.type == RegisterValueType.NotInSetOfValues: - return "" % repr(self.values) + return "" % '[{}]'.format(', '.join(hex(i) for i in self.values)) if self.type == RegisterValueType.ReturnAddressValue: return "" return "" -- cgit v1.3.1 From e0fae5db1c0d7c8989d4d95459fb051ae433b68c Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 20 Feb 2018 16:16:58 -0500 Subject: unsigned improperly using signed division --- python/lowlevelil.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index d2f02c3d..0eb463d1 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1423,7 +1423,7 @@ class LowLevelILFunction(object): :return: The expression ``divs.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_DIVS, a.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_DIVU, a.index, b.index, size=size, flags=flags) def div_double_prec_unsigned(self, size, a, b, flags=None): """ @@ -1438,7 +1438,7 @@ class LowLevelILFunction(object): :return: The expression ``divs.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_DIVS_DP, a.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_DIVU_DP, a.index, b.index, size=size, flags=flags) def mod_signed(self, size, a, b, flags=None): """ -- cgit v1.3.1 From 211ec230ddfd86785729e05e47dabfcebee42174 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 20 Feb 2018 22:28:24 -0500 Subject: one more signed/unsigned copy paste failure --- python/lowlevelil.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 0eb463d1..0acb0312 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1496,7 +1496,7 @@ class LowLevelILFunction(object): :return: The expression ``modu.dp.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_MODS_DP, a.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_MODU_DP, a.index, b.index, size=size, flags=flags) def neg_expr(self, size, value, flags=None): """ -- cgit v1.3.1 From b724a330ca0a722908459d5ae5f7e77c9df24fa6 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Tue, 20 Feb 2018 22:30:54 -0500 Subject: and the other modulus... --- python/lowlevelil.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 0acb0312..1a9fc21e 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1481,7 +1481,7 @@ class LowLevelILFunction(object): :return: The expression ``modu.{}(a, b)`` :rtype: LowLevelILExpr """ - return self.expr(LowLevelILOperation.LLIL_MODS, a.index, b.index, size=size, flags=flags) + return self.expr(LowLevelILOperation.LLIL_MODU, a.index, b.index, size=size, flags=flags) def mod_double_prec_unsigned(self, size, a, b, flags=None): """ -- cgit v1.3.1 From 7f2897356793a0a68308e6da740610628f5eef2d Mon Sep 17 00:00:00 2001 From: lucasduffey Date: Wed, 21 Feb 2018 11:06:21 -0300 Subject: Fix documentation mult_double_prec_unsigned, div_unsigned, div_double_prec_unsigned, zero_extend --- python/lowlevelil.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 1a9fc21e..bf7d6d46 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1377,7 +1377,7 @@ class LowLevelILFunction(object): :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``muls.dp.{}(a, b)`` + :return: The expression ``mulu.dp.{}(a, b)`` :rtype: LowLevelILExpr """ return self.expr(LowLevelILOperation.LLIL_MULU_DP, a.index, b.index, size=size, flags=flags) @@ -1420,7 +1420,7 @@ class LowLevelILFunction(object): :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``divs.{}(a, b)`` + :return: The expression ``divu.{}(a, b)`` :rtype: LowLevelILExpr """ return self.expr(LowLevelILOperation.LLIL_DIVU, a.index, b.index, size=size, flags=flags) @@ -1435,7 +1435,7 @@ class LowLevelILFunction(object): :param LowLevelILExpr a: LHS expression :param LowLevelILExpr b: RHS expression :param str flags: optional, flags to set - :return: The expression ``divs.dp.{}(a, b)`` + :return: The expression ``divu.dp.{}(a, b)`` :rtype: LowLevelILExpr """ return self.expr(LowLevelILOperation.LLIL_DIVU_DP, a.index, b.index, size=size, flags=flags) @@ -1540,7 +1540,7 @@ class LowLevelILFunction(object): :param int size: the size of the result in bytes :param LowLevelILExpr value: the expression to zero extend - :return: The expression ``sx.(value)`` + :return: The expression ``zx.(value)`` :rtype: LowLevelILExpr """ return self.expr(LowLevelILOperation.LLIL_ZX, value.index, size=size, flags=flags) -- cgit v1.3.1 From ef91ab7f3b648051b72fd06dd05eff3c57fa7f65 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Fri, 23 Feb 2018 14:54:44 -0500 Subject: Add APIs for subclassing or hooking an existing architecture in C/C++ --- architecture.cpp | 378 ++++++++++++++++- binaryninjaapi.h | 89 ++++ binaryninjacore.h | 4 + examples/x86_extension/src/x86_extension.cpp | 585 +-------------------------- 4 files changed, 490 insertions(+), 566 deletions(-) diff --git a/architecture.cpp b/architecture.cpp index 90f8e622..a1aaca2d 100644 --- a/architecture.cpp +++ b/architecture.cpp @@ -640,6 +640,13 @@ bool Architecture::SkipAndReturnValueCallback(void* ctxt, uint8_t* data, uint64_ } +void Architecture::Register(BNCustomArchitecture* callbacks) +{ + AddRefForRegistration(); + BNRegisterArchitecture(m_nameForRegister.c_str(), callbacks); +} + + void Architecture::Register(Architecture* arch) { BNCustomArchitecture callbacks; @@ -701,8 +708,7 @@ void Architecture::Register(Architecture* arch) callbacks.alwaysBranch = AlwaysBranchCallback; callbacks.invertBranch = InvertBranchCallback; callbacks.skipAndReturnValue = SkipAndReturnValueCallback; - arch->AddRefForRegistration(); - BNRegisterArchitecture(arch->m_nameForRegister.c_str(), &callbacks); + arch->Register(&callbacks); } @@ -1228,6 +1234,12 @@ Ref Architecture::GetStandalonePlatform() } +void Architecture::AddArchitectureRedirection(Architecture* from, Architecture* to) +{ + BNAddArchitectureRedirection(m_object, from->GetObject(), to->GetObject()); +} + + CoreArchitecture::CoreArchitecture(BNArchitecture* arch): Architecture(arch) { } @@ -1712,3 +1724,365 @@ bool CoreArchitecture::SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t l { return BNArchitectureSkipAndReturnValue(m_object, data, addr, len, value); } + + +ArchitectureExtension::ArchitectureExtension(const string& name, Architecture* base): Architecture(name), m_base(base) +{ +} + + +void ArchitectureExtension::Register(BNCustomArchitecture* callbacks) +{ + AddRefForRegistration(); + BNRegisterArchitectureExtension(m_nameForRegister.c_str(), m_base->GetObject(), callbacks); +} + + +BNEndianness ArchitectureExtension::GetEndianness() const +{ + return m_base->GetEndianness(); +} + + +size_t ArchitectureExtension::GetAddressSize() const +{ + return m_base->GetAddressSize(); +} + + +size_t ArchitectureExtension::GetDefaultIntegerSize() const +{ + return m_base->GetDefaultIntegerSize(); +} + + +size_t ArchitectureExtension::GetInstructionAlignment() const +{ + return m_base->GetInstructionAlignment(); +} + + +size_t ArchitectureExtension::GetMaxInstructionLength() const +{ + return m_base->GetMaxInstructionLength(); +} + + +size_t ArchitectureExtension::GetOpcodeDisplayLength() const +{ + return m_base->GetOpcodeDisplayLength(); +} + + +Ref ArchitectureExtension::GetAssociatedArchitectureByAddress(uint64_t& addr) +{ + Ref result = m_base->GetAssociatedArchitectureByAddress(addr); + if (result == m_base) + return this; + return result; +} + + +bool ArchitectureExtension::GetInstructionInfo(const uint8_t* data, uint64_t addr, size_t maxLen, InstructionInfo& result) +{ + return m_base->GetInstructionInfo(data, addr, maxLen, result); +} + + +bool ArchitectureExtension::GetInstructionText(const uint8_t* data, uint64_t addr, size_t& len, + vector& result) +{ + return m_base->GetInstructionText(data, addr, len, result); +} + + +bool ArchitectureExtension::GetInstructionLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il) +{ + return m_base->GetInstructionLowLevelIL(data, addr, len, il); +} + + +string ArchitectureExtension::GetRegisterName(uint32_t reg) +{ + return m_base->GetRegisterName(reg); +} + + +string ArchitectureExtension::GetFlagName(uint32_t flag) +{ + return m_base->GetFlagName(flag); +} + + +string ArchitectureExtension::GetFlagWriteTypeName(uint32_t flags) +{ + return m_base->GetFlagWriteTypeName(flags); +} + + +string ArchitectureExtension::GetSemanticFlagClassName(uint32_t semClass) +{ + return m_base->GetSemanticFlagClassName(semClass); +} + + +string ArchitectureExtension::GetSemanticFlagGroupName(uint32_t semGroup) +{ + return m_base->GetSemanticFlagGroupName(semGroup); +} + + +vector ArchitectureExtension::GetFullWidthRegisters() +{ + return m_base->GetFullWidthRegisters(); +} + + +vector ArchitectureExtension::GetAllRegisters() +{ + return m_base->GetAllRegisters(); +} + + +vector ArchitectureExtension::GetAllFlags() +{ + return m_base->GetAllFlags(); +} + + +vector ArchitectureExtension::GetAllFlagWriteTypes() +{ + return m_base->GetAllFlagWriteTypes(); +} + + +vector ArchitectureExtension::GetAllSemanticFlagClasses() +{ + return m_base->GetAllSemanticFlagClasses(); +} + + +vector ArchitectureExtension::GetAllSemanticFlagGroups() +{ + return m_base->GetAllSemanticFlagGroups(); +} + + +BNFlagRole ArchitectureExtension::GetFlagRole(uint32_t flag, uint32_t semClass) +{ + return m_base->GetFlagRole(flag, semClass); +} + + +vector ArchitectureExtension::GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, + uint32_t semClass) +{ + return m_base->GetFlagsRequiredForFlagCondition(cond, semClass); +} + + +vector ArchitectureExtension::GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup) +{ + return m_base->GetFlagsRequiredForSemanticFlagGroup(semGroup); +} + + +map ArchitectureExtension::GetFlagConditionsForSemanticFlagGroup(uint32_t semGroup) +{ + return m_base->GetFlagConditionsForSemanticFlagGroup(semGroup); +} + + +vector ArchitectureExtension::GetFlagsWrittenByFlagWriteType(uint32_t writeType) +{ + return m_base->GetFlagsWrittenByFlagWriteType(writeType); +} + + +uint32_t ArchitectureExtension::GetSemanticClassForFlagWriteType(uint32_t writeType) +{ + return m_base->GetSemanticClassForFlagWriteType(writeType); +} + + +ExprId ArchitectureExtension::GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, + uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il) +{ + return m_base->GetFlagWriteLowLevelIL(op, size, flagWriteType, flag, operands, operandCount, il); +} + + +ExprId ArchitectureExtension::GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) +{ + return m_base->GetFlagConditionLowLevelIL(cond, semClass, il); +} + + +ExprId ArchitectureExtension::GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il) +{ + return m_base->GetSemanticFlagGroupLowLevelIL(semGroup, il); +} + + +BNRegisterInfo ArchitectureExtension::GetRegisterInfo(uint32_t reg) +{ + return m_base->GetRegisterInfo(reg); +} + + +uint32_t ArchitectureExtension::GetStackPointerRegister() +{ + return m_base->GetStackPointerRegister(); +} + + +uint32_t ArchitectureExtension::GetLinkRegister() +{ + return m_base->GetLinkRegister(); +} + + +vector ArchitectureExtension::GetGlobalRegisters() +{ + return m_base->GetGlobalRegisters(); +} + + +string ArchitectureExtension::GetRegisterStackName(uint32_t regStack) +{ + return m_base->GetRegisterStackName(regStack); +} + + +vector ArchitectureExtension::GetAllRegisterStacks() +{ + return m_base->GetAllRegisterStacks(); +} + + +BNRegisterStackInfo ArchitectureExtension::GetRegisterStackInfo(uint32_t regStack) +{ + return m_base->GetRegisterStackInfo(regStack); +} + + +string ArchitectureExtension::GetIntrinsicName(uint32_t intrinsic) +{ + return m_base->GetIntrinsicName(intrinsic); +} + + +vector ArchitectureExtension::GetAllIntrinsics() +{ + return m_base->GetAllIntrinsics(); +} + + +vector ArchitectureExtension::GetIntrinsicInputs(uint32_t intrinsic) +{ + return m_base->GetIntrinsicInputs(intrinsic); +} + + +vector>> ArchitectureExtension::GetIntrinsicOutputs(uint32_t intrinsic) +{ + return m_base->GetIntrinsicOutputs(intrinsic); +} + + +bool ArchitectureExtension::Assemble(const string& code, uint64_t addr, DataBuffer& result, string& errors) +{ + return m_base->Assemble(code, addr, result, errors); +} + + +bool ArchitectureExtension::IsNeverBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->IsNeverBranchPatchAvailable(data, addr, len); +} + + +bool ArchitectureExtension::IsAlwaysBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->IsAlwaysBranchPatchAvailable(data, addr, len); +} + + +bool ArchitectureExtension::IsInvertBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->IsInvertBranchPatchAvailable(data, addr, len); +} + + +bool ArchitectureExtension::IsSkipAndReturnZeroPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->IsSkipAndReturnValuePatchAvailable(data, addr, len); +} + + +bool ArchitectureExtension::IsSkipAndReturnValuePatchAvailable(const uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->IsSkipAndReturnValuePatchAvailable(data, addr, len); +} + + +bool ArchitectureExtension::ConvertToNop(uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->ConvertToNop(data, addr, len); +} + + +bool ArchitectureExtension::AlwaysBranch(uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->AlwaysBranch(data, addr, len); +} + + +bool ArchitectureExtension::InvertBranch(uint8_t* data, uint64_t addr, size_t len) +{ + return m_base->InvertBranch(data, addr, len); +} + + +bool ArchitectureExtension::SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value) +{ + return m_base->SkipAndReturnValue(data, addr, len, value); +} + + +ArchitectureHook::ArchitectureHook(Architecture* base): CoreArchitecture(nullptr), m_base(base) +{ + // Architecture hooks allow existing architecture implementations to be extended without creating + // a new Architecture object for the changes. By deriving from the ArchitectureHook class and passing + // the original Architecture object of the architecture to be extended, any reimplemented functions + // will be called first before the original architecture's implementation. You MUST call the base + // class method to call the original implementation's version of the function, as calling the + // same function on the original Architecture object will call your implementation again. + + // Example of a hook to modify the lifting process: + + // class ArchitectureHookExample: public ArchitectureHook + // { + // public: + // ArchitectureHookExample(Architecture* existingArch) : ArchitectureHook(existingArch) + // { + // } + // + // virtual bool GetInstructionLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, + // LowLevelILFunction& il) override + // { + // // Perform extra lifting here + // // ... + // // For unhandled cases, call the original architecture's implementation + // return ArchitectureHook::GetInstructionLowLevelIL(data, addr, len, il); + // } + // }; +} + + +void ArchitectureHook::Register(BNCustomArchitecture* callbacks) +{ + AddRefForRegistration(); + m_object = BNRegisterArchitectureHook(m_base->GetObject(), callbacks); +} diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 91162af7..89eba009 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1668,6 +1668,8 @@ namespace BinaryNinja static bool InvertBranchCallback(void* ctxt, uint8_t* data, uint64_t addr, size_t len); static bool SkipAndReturnValueCallback(void* ctxt, uint8_t* data, uint64_t addr, size_t len, uint64_t value); + virtual void Register(BNCustomArchitecture* callbacks); + public: Architecture(const std::string& name); @@ -1832,6 +1834,8 @@ namespace BinaryNinja Ref GetStdcallCallingConvention(); Ref GetFastcallCallingConvention(); Ref GetStandalonePlatform(); + + void AddArchitectureRedirection(Architecture* from, Architecture* to); }; class CoreArchitecture: public Architecture @@ -1900,6 +1904,91 @@ namespace BinaryNinja virtual bool SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value) override; }; + class ArchitectureExtension: public Architecture + { + protected: + Ref m_base; + + virtual void Register(BNCustomArchitecture* callbacks) override; + + public: + ArchitectureExtension(const std::string& name, Architecture* base); + + Ref GetBaseArchitecture() const { return m_base; } + + virtual BNEndianness GetEndianness() const override; + virtual size_t GetAddressSize() const override; + virtual size_t GetDefaultIntegerSize() const override; + virtual size_t GetInstructionAlignment() const override; + virtual size_t GetMaxInstructionLength() const override; + virtual size_t GetOpcodeDisplayLength() const override; + virtual Ref GetAssociatedArchitectureByAddress(uint64_t& addr) override; + virtual bool GetInstructionInfo(const uint8_t* data, uint64_t addr, size_t maxLen, InstructionInfo& result) override; + virtual bool GetInstructionText(const uint8_t* data, uint64_t addr, size_t& len, + std::vector& result) override; + virtual bool GetInstructionLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il) override; + virtual std::string GetRegisterName(uint32_t reg) override; + virtual std::string GetFlagName(uint32_t flag) override; + virtual std::string GetFlagWriteTypeName(uint32_t flags) override; + virtual std::string GetSemanticFlagClassName(uint32_t semClass) override; + virtual std::string GetSemanticFlagGroupName(uint32_t semGroup) override; + virtual std::vector GetFullWidthRegisters() override; + virtual std::vector GetAllRegisters() override; + virtual std::vector GetAllFlags() override; + virtual std::vector GetAllFlagWriteTypes() override; + virtual std::vector GetAllSemanticFlagClasses() override; + virtual std::vector GetAllSemanticFlagGroups() override; + virtual BNFlagRole GetFlagRole(uint32_t flag, uint32_t semClass = 0) override; + virtual std::vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond, + uint32_t semClass = 0) override; + virtual std::vector GetFlagsRequiredForSemanticFlagGroup(uint32_t semGroup) override; + virtual std::map GetFlagConditionsForSemanticFlagGroup(uint32_t semGroup) override; + virtual std::vector GetFlagsWrittenByFlagWriteType(uint32_t writeType) override; + virtual uint32_t GetSemanticClassForFlagWriteType(uint32_t writeType) override; + virtual ExprId GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, + uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il) override; + virtual ExprId GetFlagConditionLowLevelIL(BNLowLevelILFlagCondition cond, + uint32_t semClass, LowLevelILFunction& il) override; + virtual ExprId GetSemanticFlagGroupLowLevelIL(uint32_t semGroup, LowLevelILFunction& il) override; + virtual BNRegisterInfo GetRegisterInfo(uint32_t reg) override; + virtual uint32_t GetStackPointerRegister() override; + virtual uint32_t GetLinkRegister() override; + virtual std::vector GetGlobalRegisters() override; + + virtual std::string GetRegisterStackName(uint32_t regStack) override; + virtual std::vector GetAllRegisterStacks() override; + virtual BNRegisterStackInfo GetRegisterStackInfo(uint32_t regStack) override; + + virtual std::string GetIntrinsicName(uint32_t intrinsic) override; + virtual std::vector GetAllIntrinsics() override; + virtual std::vector GetIntrinsicInputs(uint32_t intrinsic) override; + virtual std::vector>> GetIntrinsicOutputs(uint32_t intrinsic) override; + + virtual bool Assemble(const std::string& code, uint64_t addr, DataBuffer& result, std::string& errors) override; + + virtual bool IsNeverBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; + virtual bool IsAlwaysBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; + virtual bool IsInvertBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; + virtual bool IsSkipAndReturnZeroPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; + virtual bool IsSkipAndReturnValuePatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override; + + virtual bool ConvertToNop(uint8_t* data, uint64_t addr, size_t len) override; + virtual bool AlwaysBranch(uint8_t* data, uint64_t addr, size_t len) override; + virtual bool InvertBranch(uint8_t* data, uint64_t addr, size_t len) override; + virtual bool SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value) override; + }; + + class ArchitectureHook: public CoreArchitecture + { + protected: + Ref m_base; + + virtual void Register(BNCustomArchitecture* callbacks) override; + + public: + ArchitectureHook(Architecture* base); + }; + class Structure; class NamedTypeReference; class Enumeration; diff --git a/binaryninjacore.h b/binaryninjacore.h index fa7a818a..5329a1d9 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2085,6 +2085,10 @@ extern "C" BINARYNINJACOREAPI BNArchitecture** BNGetArchitectureList(size_t* count); BINARYNINJACOREAPI void BNFreeArchitectureList(BNArchitecture** archs); BINARYNINJACOREAPI BNArchitecture* BNRegisterArchitecture(const char* name, BNCustomArchitecture* arch); + BINARYNINJACOREAPI BNArchitecture* BNRegisterArchitectureExtension(const char* name, + BNArchitecture* base, BNCustomArchitecture* arch); + BINARYNINJACOREAPI void BNAddArchitectureRedirection(BNArchitecture* arch, BNArchitecture* from, BNArchitecture* to); + BINARYNINJACOREAPI BNArchitecture* BNRegisterArchitectureHook(BNArchitecture* base, BNCustomArchitecture* arch); BINARYNINJACOREAPI char* BNGetArchitectureName(BNArchitecture* arch); BINARYNINJACOREAPI BNEndianness BNGetArchitectureEndianness(BNArchitecture* arch); diff --git a/examples/x86_extension/src/x86_extension.cpp b/examples/x86_extension/src/x86_extension.cpp index a2ba4c9c..87f2c2cb 100644 --- a/examples/x86_extension/src/x86_extension.cpp +++ b/examples/x86_extension/src/x86_extension.cpp @@ -10,572 +10,37 @@ using namespace std; using namespace asmx86; -#define IL_FLAG_C 0 -#define IL_FLAG_P 2 -#define IL_FLAG_A 4 -#define IL_FLAG_Z 6 -#define IL_FLAG_S 7 -#define IL_FLAG_D 10 -#define IL_FLAG_O 11 - -#define IL_FLAGWRITE_ALL 1 -#define IL_FLAGWRITE_NOCARRY 2 -#define IL_FLAGWRITE_CO 3 - -#define REG_FSBASE 0x100 -#define REG_GSBASE 0x101 - -#define TRAP_DIV 0 -#define TRAP_ICEBP 1 -#define TRAP_NMI 2 -#define TRAP_BP 3 -#define TRAP_OVERFLOW 4 -#define TRAP_BOUND 5 -#define TRAP_ILL 6 -#define TRAP_NOT_AVAIL 7 -#define TRAP_DOUBLE 8 -#define TRAP_TSS 10 -#define TRAP_NO_SEG 11 -#define TRAP_STACK 12 -#define TRAP_GPF 13 -#define TRAP_PAGE 14 -#define TRAP_FPU 16 -#define TRAP_ALIGN 17 -#define TRAP_MCE 18 -#define TRAP_SIMD 19 - -static uint8_t GetShiftCountForScale(uint8_t scale) -{ - switch (scale) - { - case 2: - return 1; - case 4: - return 2; - case 8: - return 3; - default: - return 0; - } -} - - -static uint32_t GetStackPointer(size_t addrSize) -{ - switch (addrSize) - { - case 2: - return REG_SP; - case 4: - return REG_ESP; - default: - return REG_RSP; - } -} - - -static uint32_t GetFramePointer(size_t addrSize) -{ - switch (addrSize) - { - case 2: - return REG_BP; - case 4: - return REG_EBP; - default: - return REG_RBP; - } -} - - -static uint32_t GetCountRegister(size_t addrSize) -{ - switch (addrSize) - { - case 2: - return REG_CX; - case 4: - return REG_ECX; - default: - return REG_RCX; - } -} - - -static size_t GetILOperandMemoryAddress(LowLevelILFunction& il, InstructionOperand& operand, size_t i, size_t addrSize) -{ - size_t offset; - if (operand.operand != MEM) - offset = il.Operand(i, il.Undefined()); - else if ((operand.components[0] == NONE) && (operand.components[1] == NONE) && operand.relative) - offset = il.Operand(i, il.ConstPointer(addrSize, operand.immediate)); - else if ((operand.components[0] == NONE) && (operand.components[1] == NONE)) - offset = il.Operand(i, il.Const(addrSize, operand.immediate)); - else if ((operand.components[1] == NONE) && (operand.immediate == 0)) - offset = il.Operand(i, il.Register(addrSize, operand.components[0])); - else if (operand.components[1] == NONE) - { - offset = il.Operand(i, il.Add(addrSize, il.Register(addrSize, operand.components[0]), - il.Const(addrSize, operand.immediate))); - } - else if ((operand.components[0] == NONE) && (operand.scale == 1) && (operand.immediate == 0)) - offset = il.Operand(i, il.Register(addrSize, operand.components[1])); - else if ((operand.components[0] == NONE) && (operand.scale == 1)) - { - offset = il.Operand(i, il.Add(addrSize, il.Register(addrSize, operand.components[1]), - il.Const(addrSize, operand.immediate))); - } - else if ((operand.components[0] == NONE) && (operand.immediate == 0)) - { - offset = il.Operand(i, il.ShiftLeft(addrSize, il.Register(addrSize, operand.components[1]), - il.Const(1, GetShiftCountForScale(operand.scale)))); - } - else if (operand.components[0] == NONE) - { - offset = il.Operand(i, il.Add(addrSize, il.ShiftLeft(addrSize, il.Register(addrSize, operand.components[1]), - il.Const(1, GetShiftCountForScale(operand.scale))), il.Const(addrSize, operand.immediate))); - } - else if ((operand.scale == 1) && (operand.immediate == 0)) - { - offset = il.Operand(i, il.Add(addrSize, il.Register(addrSize, operand.components[0]), - il.Register(addrSize, operand.components[1]))); - } - else if (operand.scale == 1) - { - offset = il.Operand(i, il.Add(addrSize, il.Add(addrSize, il.Register(addrSize, operand.components[0]), - il.Register(addrSize, operand.components[1])), il.Const(addrSize, operand.immediate))); - } - else if (operand.immediate == 0) - { - offset = il.Operand(i, il.Add(addrSize, il.Register(addrSize, operand.components[0]), - il.ShiftLeft(addrSize, il.Register(addrSize, operand.components[1]), - il.Const(1, GetShiftCountForScale(operand.scale))))); - } - else - { - offset = il.Operand(i, il.Add(addrSize, il.Add(addrSize, il.Register(addrSize, operand.components[0]), - il.ShiftLeft(addrSize, il.Register(addrSize, operand.components[1]), - il.Const(1, GetShiftCountForScale(operand.scale)))), il.Const(addrSize, operand.immediate))); - } - - if (operand.segment == SEG_FS) - return il.Operand(i, il.Add(addrSize, il.Register(addrSize, REG_FSBASE), offset)); - if (operand.segment == SEG_GS) - return il.Operand(i, il.Add(addrSize, il.Register(addrSize, REG_GSBASE), offset)); - return offset; -} - - -static size_t ReadILOperand(LowLevelILFunction& il, Instruction& instr, size_t i, size_t addrSize, bool isAddress = false) -{ - InstructionOperand& operand = instr.operands[i]; - switch (operand.operand) - { - case NONE: - return il.Undefined(); - case IMM: - if (isAddress) - return il.Operand(i, il.ConstPointer(operand.size, operand.immediate)); - else - return il.Operand(i, il.Const(operand.size, operand.immediate)); - case MEM: - return il.Operand(i, il.Load(operand.size, GetILOperandMemoryAddress(il, operand, i, addrSize))); - default: - return il.Operand(i, il.Register(operand.size, operand.operand)); - } -} - - -static size_t WriteILOperand(LowLevelILFunction& il, Instruction& instr, size_t i, size_t addrSize, size_t value) -{ - InstructionOperand& operand = instr.operands[i]; - switch (operand.operand) - { - case NONE: - case IMM: - return il.Undefined(); - case MEM: - return il.Operand(i, il.Store(operand.size, GetILOperandMemoryAddress(il, operand, i, addrSize), value)); - default: - return il.Operand(i, il.SetRegister(operand.size, operand.operand, value)); - } -} - - -static size_t DirectJump(Architecture* arch, LowLevelILFunction& il, uint64_t target, size_t addrSize) -{ - BNLowLevelILLabel* label = il.GetLabelForAddress(arch, target); - if (label) - return il.Goto(*label); - else - return il.Jump(il.ConstPointer(addrSize, target)); -} - - -static void ConditionalJump(Architecture* arch, LowLevelILFunction& il, size_t cond, size_t addrSize, uint64_t t, uint64_t f) -{ - BNLowLevelILLabel* trueLabel = il.GetLabelForAddress(arch, t); - BNLowLevelILLabel* falseLabel = il.GetLabelForAddress(arch, f); - - if (trueLabel && falseLabel) - { - il.AddInstruction(il.If(cond, *trueLabel, *falseLabel)); - return; - } - - LowLevelILLabel trueCode, falseCode; - - if (trueLabel) - { - il.AddInstruction(il.If(cond, *trueLabel, falseCode)); - il.MarkLabel(falseCode); - il.AddInstruction(il.Jump(il.ConstPointer(addrSize, f))); - return; - } - - if (falseLabel) - { - il.AddInstruction(il.If(cond, trueCode, *falseLabel)); - il.MarkLabel(trueCode); - il.AddInstruction(il.Jump(il.ConstPointer(addrSize, t))); - return; - } - - il.AddInstruction(il.If(cond, trueCode, falseCode)); - il.MarkLabel(trueCode); - il.AddInstruction(il.Jump(il.ConstPointer(addrSize, t))); - il.MarkLabel(falseCode); - il.AddInstruction(il.Jump(il.ConstPointer(addrSize, f))); -} - - -static void DirFlagIf(size_t addrSize, - LowLevelILFunction& il, - std::function addPreTestIl, - std::function addDirFlagSetIl, - std::function addDirFlagClearIl) -{ - LowLevelILLabel dirFlagSet, dirFlagClear, dirFlagDone; - - addPreTestIl(addrSize, il); - - il.AddInstruction(il.If(il.Flag(IL_FLAG_D), dirFlagSet, dirFlagClear)); - il.MarkLabel(dirFlagSet); - - addDirFlagSetIl(addrSize, il); - - il.AddInstruction(il.Goto(dirFlagDone)); - il.MarkLabel(dirFlagClear); - - addDirFlagClearIl(addrSize, il); - - il.AddInstruction(il.Goto(dirFlagDone)); - il.MarkLabel(dirFlagDone); -} - - -static void Repeat(size_t addrSize, - Instruction& instr, - LowLevelILFunction& il, - std::function addil) -{ - LowLevelILLabel trueLabel, falseLabel, doneLabel; - if (instr.flags & X86_FLAG_ANY_REP) - { - il.AddInstruction(il.Goto(trueLabel)); - il.MarkLabel(trueLabel); - il.AddInstruction(il.If(il.CompareEqual(addrSize, il.Register(addrSize, GetCountRegister(addrSize)), - il.Const(addrSize, 0)), doneLabel, falseLabel)); - il.MarkLabel(falseLabel); - } - - addil(addrSize, il); - - if (instr.flags & X86_FLAG_ANY_REP) - { - il.AddInstruction(il.SetRegister(addrSize, GetCountRegister(addrSize), - il.Sub(addrSize, il.Register(addrSize, GetCountRegister(addrSize)), - il.Const(addrSize, 1)))); - if (instr.flags & X86_FLAG_REPE) - il.AddInstruction(il.If(il.FlagCondition(LLFC_E), trueLabel, doneLabel)); - else if (instr.flags & X86_FLAG_REPNE) - il.AddInstruction(il.If(il.FlagCondition(LLFC_NE), trueLabel, doneLabel)); - else - il.AddInstruction(il.Goto(trueLabel)); - il.MarkLabel(doneLabel); - } -} - - // This is a wrapper for the x86 architecture. Its useful for extending and improving // the existing core x86 architecture. -class x86ArchitectureExtension: public Architecture +class x86ArchitectureExtension: public ArchitectureHook { - Architecture* m_arch; public: - x86ArchitectureExtension() : Architecture("x86_extension") - { - m_arch = new CoreArchitecture(BNGetArchitectureByName("x86")); - } - - virtual size_t GetAddressSize() const override - { - return 4; - } - - virtual BNEndianness GetEndianness() const override + x86ArchitectureExtension(Architecture* x86) : ArchitectureHook(x86) { - return LittleEndian; - } - - virtual size_t GetInstructionAlignment() const override - { - return 1; - } - - virtual bool GetInstructionInfo(const uint8_t* data, uint64_t addr, size_t maxLen, InstructionInfo& result) override - { - return m_arch->GetInstructionInfo(data, addr, maxLen, result); - } - - virtual bool GetInstructionText(const uint8_t* data, uint64_t addr, size_t& len, vector& result) override - { - return m_arch->GetInstructionText(data, addr, len, result); } virtual bool GetInstructionLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il) override { Instruction instr; - if (!asmx86::Disassemble32(data, addr, len, &instr)) + if (asmx86::Disassemble32(data, addr, len, &instr)) { - il.AddInstruction(il.Undefined()); - return false; + switch (instr.operation) + { + case CPUID: + // The default implementation of CPUID doesn't set registers to constant values + // Here we'll emulate a Intel(R) Core(TM) i5-6267U CPU @ 2.90GHz with _eax set to 1 + il.AddInstruction(il.Register(4, REG_EAX)); // Reference the register so we know it is read + il.AddInstruction(il.SetRegister(4, REG_EAX, il.Const(4, 0x000406e3))); + il.AddInstruction(il.SetRegister(4, REG_EBX, il.Const(4, 0x03100800))); + il.AddInstruction(il.SetRegister(4, REG_ECX, il.Const(4, 0x7ffafbbf))); + il.AddInstruction(il.SetRegister(4, REG_EDX, il.Const(4, 0xbfebfbff))); + len = instr.length; + return true; + default: + break; + } } - - size_t addrSize = 4; - switch (instr.operation) - { - case CPUID: - // The default implementation of CPUID doesn't set registers to constant values - // Here we'll emulate a Intel(R) Core(TM) i5-6267U CPU @ 2.90GHz with _eax set to 1 - il.AddInstruction(il.Register(4, REG_EAX)); // Reference the register so we know it is read - il.AddInstruction(il.SetRegister(4, REG_EAX, il.Const(4, 0x000406e3))); - il.AddInstruction(il.SetRegister(4, REG_EBX, il.Const(4, 0x03100800))); - il.AddInstruction(il.SetRegister(4, REG_ECX, il.Const(4, 0x7ffafbbf))); - il.AddInstruction(il.SetRegister(4, REG_EDX, il.Const(4, 0xbfebfbff))); - len = instr.length; - return true; - - case JMP: - if (instr.operands[0].operand == IMM) - il.AddInstruction(DirectJump(this, il, instr.operands[0].immediate, addrSize)); - else - il.AddInstruction(il.Jump(ReadILOperand(il, instr, 0, addrSize, true))); - return false; - - case JO: - ConditionalJump(this, il, il.FlagCondition(LLFC_O), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JNO: - ConditionalJump(this, il, il.FlagCondition(LLFC_NO), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JB: - ConditionalJump(this, il, il.FlagCondition(LLFC_ULT), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JAE: - ConditionalJump(this, il, il.FlagCondition(LLFC_UGE), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JE: - ConditionalJump(this, il, il.FlagCondition(LLFC_E), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JNE: - ConditionalJump(this, il, il.FlagCondition(LLFC_NE), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JBE: - ConditionalJump(this, il, il.FlagCondition(LLFC_ULE), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JA: - ConditionalJump(this, il, il.FlagCondition(LLFC_UGT), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JS: - ConditionalJump(this, il, il.FlagCondition(LLFC_NEG), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JNS: - ConditionalJump(this, il, il.FlagCondition(LLFC_POS), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JPE: - ConditionalJump(this, il, il.Not(0, il.Flag(IL_FLAG_P)), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JPO: - ConditionalJump(this, il, il.Flag(IL_FLAG_P), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JL: - ConditionalJump(this, il, il.FlagCondition(LLFC_SLT), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JGE: - ConditionalJump(this, il, il.FlagCondition(LLFC_SGE), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JLE: - ConditionalJump(this, il, il.FlagCondition(LLFC_SLE), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JG: - ConditionalJump(this, il, il.FlagCondition(LLFC_SGT), addrSize, instr.operands[0].immediate, addr + instr.length); - return false; - - case JCXZ: - ConditionalJump(this, il, il.CompareEqual(2, il.Register(2, REG_CX), il.Const(2, 0)), addrSize, - instr.operands[0].immediate, addr + instr.length); - return false; - - case JECXZ: - ConditionalJump(this, il, il.CompareEqual(4, il.Register(4, REG_ECX), il.Const(4, 0)), addrSize, - instr.operands[0].immediate, addr + instr.length); - return false; - - case JRCXZ: - ConditionalJump(this, il, il.CompareEqual(8, il.Register(8, REG_RCX), il.Const(8, 0)), addrSize, - instr.operands[0].immediate, addr + instr.length); - return false; - - default: - return m_arch->GetInstructionLowLevelIL(data, addr, len, il); - } - } - - virtual size_t GetFlagWriteLowLevelIL(BNLowLevelILOperation op, size_t size, uint32_t flagWriteType, - uint32_t flag, BNRegisterOrConstant* operands, size_t operandCount, LowLevelILFunction& il) override - { - return m_arch->GetFlagWriteLowLevelIL(op,size, flagWriteType, flag, operands, operandCount, il); - } - - virtual string GetRegisterName(uint32_t reg) override - { - return m_arch->GetRegisterName(reg); - } - - virtual string GetFlagName(uint32_t flag) override - { - return m_arch->GetFlagName(flag); - } - - virtual vector GetAllFlags() override - { - return m_arch->GetAllFlags(); - } - - virtual string GetFlagWriteTypeName(uint32_t flags) override - { - return m_arch->GetFlagWriteTypeName(flags); - } - - virtual vector GetAllFlagWriteTypes() override - { - return m_arch->GetAllFlagWriteTypes(); - } - - virtual BNFlagRole GetFlagRole(uint32_t flag) override - { - return m_arch->GetFlagRole(flag); - } - - virtual vector GetFlagsRequiredForFlagCondition(BNLowLevelILFlagCondition cond) override - { - return m_arch->GetFlagsRequiredForFlagCondition(cond); - } - - virtual vector GetFlagsWrittenByFlagWriteType(uint32_t writeType) override - { - return m_arch->GetFlagsWrittenByFlagWriteType(writeType); - } - - virtual bool IsNeverBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->IsNeverBranchPatchAvailable(data, addr, len); - } - - virtual bool IsAlwaysBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->IsAlwaysBranchPatchAvailable(data, addr, len); - } - - virtual bool IsInvertBranchPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->IsInvertBranchPatchAvailable(data, addr, len); - } - - virtual bool IsSkipAndReturnZeroPatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->IsSkipAndReturnZeroPatchAvailable(data, addr, len); - } - - virtual bool IsSkipAndReturnValuePatchAvailable(const uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->IsSkipAndReturnValuePatchAvailable(data, addr, len); - } - - virtual bool ConvertToNop(uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->ConvertToNop(data, addr, len); - } - - virtual bool AlwaysBranch(uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->AlwaysBranch(data, addr, len); - } - - virtual bool InvertBranch(uint8_t* data, uint64_t addr, size_t len) override - { - return m_arch->InvertBranch(data, addr, len); - } - - virtual bool SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value) override - { - return m_arch->SkipAndReturnValue(data, addr, len, value); - } - - virtual vector GetFullWidthRegisters() override - { - return m_arch->GetFullWidthRegisters(); - } - - virtual vector GetGlobalRegisters() override - { - return m_arch->GetGlobalRegisters(); - } - - virtual vector GetAllRegisters() override - { - return m_arch->GetAllRegisters(); - } - - virtual BNRegisterInfo GetRegisterInfo(uint32_t reg) override - { - return m_arch->GetRegisterInfo(reg); - } - - virtual uint32_t GetStackPointerRegister() override - { - return m_arch->GetStackPointerRegister(); - } - - virtual bool Assemble(const string& code, uint64_t addr, DataBuffer& result, string& errors) override - { - return m_arch->Assemble(code, addr, result, errors); + return ArchitectureHook::GetInstructionLowLevelIL(data, addr, len, il); } }; @@ -585,21 +50,13 @@ extern "C" BINARYNINJAPLUGIN void CorePluginDependencies() { // Make sure we load after the original x86 plugin loads - SetCurrentPluginLoadOrder(LatePluginLoadOrder); + AddRequiredPluginDependency("arch_x86"); } BINARYNINJAPLUGIN bool CorePluginInit() { - Architecture* x86ext = new x86ArchitectureExtension(); + Architecture* x86ext = new x86ArchitectureExtension(Architecture::GetByName("x86")); Architecture::Register(x86ext); - - // Register the architectures with the binary format parsers so that they know when to use - // these architectures for disassembling an executable file - BinaryViewType::RegisterArchitecture("ELF", 3, LittleEndian, x86ext); - BinaryViewType::RegisterArchitecture("PE", 0x14c, LittleEndian, x86ext); - BinaryViewType::RegisterArchitecture("Mach-O", 0x00000007, LittleEndian, x86ext); - x86ext->SetBinaryViewTypeConstant("ELF", "R_COPY", 5); - x86ext->SetBinaryViewTypeConstant("ELF", "R_JUMP_SLOT", 7); return true; } } -- cgit v1.3.1 From 1b044bf3988500367391467064696832a0edff41 Mon Sep 17 00:00:00 2001 From: Kareem El-Faramawi Date: Mon, 26 Feb 2018 09:59:06 -0500 Subject: Fix type error for get_semantic_{flag,class}_name (#957) {group,class}_index might be a long, which would throw a ValueError --- python/architecture.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/python/architecture.py b/python/architecture.py index 51a7cfba..2b52ea35 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -1839,8 +1839,8 @@ class Architecture(object): :return: the name of the semantic flag class :rtype: str """ - if not isinstance(class_index, int): - raise ValueError("argument 'class_index' must be an intege") + if not isinstance(class_index, (int, long)): + raise ValueError("argument 'class_index' must be an integer") try: return self._semantic_flag_classes_by_index[class_index] except KeyError: @@ -1861,8 +1861,8 @@ class Architecture(object): :return: the name of the semantic flag group :rtype: str """ - if not isinstance(group_index, int): - raise ValueError("argument 'group_index' must be an intege") + if not isinstance(group_index, (int, long)): + raise ValueError("argument 'group_index' must be an integer") try: return self._semantic_flag_groups_by_index[group_index] except KeyError: -- cgit v1.3.1 From 6926cf203d32d32ef2961d39ac373f88c8957304 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Mon, 26 Feb 2018 17:07:44 -0500 Subject: Advance submodule reference. --- examples/x86_extension/src/asmx86 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/x86_extension/src/asmx86 b/examples/x86_extension/src/asmx86 index 9a1bf01f..217176e2 160000 --- a/examples/x86_extension/src/asmx86 +++ b/examples/x86_extension/src/asmx86 @@ -1 +1 @@ -Subproject commit 9a1bf01f4c456779544a445db45b1496c50ff372 +Subproject commit 217176e2dd84f09214d38b5cc727313f17d6a0d3 -- cgit v1.3.1 From bfce40850be6f6df4138d717798d4d0d35865908 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Mon, 26 Feb 2018 17:08:23 -0500 Subject: Log cleanup. --- log.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/log.cpp b/log.cpp index dd15559f..840ddf52 100644 --- a/log.cpp +++ b/log.cpp @@ -102,6 +102,7 @@ void BinaryNinja::Log(BNLogLevel level, const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(level, fmt, args); + va_end(args); } @@ -110,6 +111,7 @@ void BinaryNinja::LogDebug(const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(DebugLog, fmt, args); + va_end(args); } @@ -118,6 +120,7 @@ void BinaryNinja::LogInfo(const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(InfoLog, fmt, args); + va_end(args); } @@ -126,6 +129,7 @@ void BinaryNinja::LogWarn(const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(WarningLog, fmt, args); + va_end(args); } @@ -134,6 +138,7 @@ void BinaryNinja::LogError(const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(ErrorLog, fmt, args); + va_end(args); } @@ -142,6 +147,7 @@ void BinaryNinja::LogAlert(const char* fmt, ...) va_list args; va_start(args, fmt); PerformLog(AlertLog, fmt, args); + va_end(args); } -- cgit v1.3.1 From 105fb2549bd8fc0e19907fefff1168322dee3bb3 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 26 Feb 2018 22:37:19 -0500 Subject: Architecture plugins no longer need to override the perform_* methods (you can now override get_instruction_info, not perform_get_instruction_info). The perform_* methods are now deprecated but will still function as expected. Added architecture hooks to Python API using this new style. --- python/architecture.py | 1763 +++++++++++++++++++++++++----------------- python/basicblock.py | 2 +- python/binaryview.py | 6 +- python/callingconvention.py | 2 +- python/examples/arch_hook.py | 16 + python/examples/nes.py | 28 +- python/function.py | 8 +- python/platform.py | 2 +- 8 files changed, 1091 insertions(+), 736 deletions(-) create mode 100644 python/examples/arch_hook.py diff --git a/python/architecture.py b/python/architecture.py index 2b52ea35..781edcfd 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -44,7 +44,7 @@ class _ArchitectureMetaClass(type): archs = core.BNGetArchitectureList(count) result = [] for i in xrange(0, count.value): - result.append(Architecture(archs[i])) + result.append(CoreArchitecture(archs[i])) core.BNFreeArchitectureList(archs) return result @@ -54,7 +54,7 @@ class _ArchitectureMetaClass(type): archs = core.BNGetArchitectureList(count) try: for i in xrange(0, count.value): - yield Architecture(archs[i]) + yield CoreArchitecture(archs[i]) finally: core.BNFreeArchitectureList(archs) @@ -63,7 +63,7 @@ class _ArchitectureMetaClass(type): arch = core.BNGetArchitectureByName(name) if arch is None: raise KeyError("'%s' is not a valid architecture" % str(name)) - return Architecture(arch) + return CoreArchitecture(arch) def register(cls): startup._init_plugins() @@ -133,438 +133,253 @@ class Architecture(object): __metaclass__ = _ArchitectureMetaClass next_address = 0 - def __init__(self, handle=None): - if handle is not None: - self.handle = core.handle_of_type(handle, core.BNArchitecture) - self.__dict__["name"] = core.BNGetArchitectureName(self.handle) - self.__dict__["endianness"] = Endianness(core.BNGetArchitectureEndianness(self.handle)) - self.__dict__["address_size"] = core.BNGetArchitectureAddressSize(self.handle) - self.__dict__["default_int_size"] = core.BNGetArchitectureDefaultIntegerSize(self.handle) - self.__dict__["instr_alignment"] = core.BNGetArchitectureInstructionAlignment(self.handle) - self.__dict__["max_instr_length"] = core.BNGetArchitectureMaxInstructionLength(self.handle) - self.__dict__["opcode_display_length"] = core.BNGetArchitectureOpcodeDisplayLength(self.handle) - self.__dict__["stack_pointer"] = core.BNGetArchitectureRegisterName(self.handle, - core.BNGetArchitectureStackPointerRegister(self.handle)) - self.__dict__["link_reg"] = core.BNGetArchitectureRegisterName(self.handle, - core.BNGetArchitectureLinkRegister(self.handle)) - - count = ctypes.c_ulonglong() - regs = core.BNGetAllArchitectureRegisters(self.handle, count) - self.__dict__["regs"] = {} - for i in xrange(0, count.value): - name = core.BNGetArchitectureRegisterName(self.handle, regs[i]) - info = core.BNGetArchitectureRegisterInfo(self.handle, regs[i]) - full_width_reg = core.BNGetArchitectureRegisterName(self.handle, info.fullWidthRegister) - self.regs[name] = function.RegisterInfo(full_width_reg, info.size, info.offset, - ImplicitRegisterExtend(info.extend), regs[i]) - core.BNFreeRegisterList(regs) - - count = ctypes.c_ulonglong() - flags = core.BNGetAllArchitectureFlags(self.handle, count) - self._flags = {} - self._flags_by_index = {} - self.__dict__["flags"] = [] - for i in xrange(0, count.value): - name = core.BNGetArchitectureFlagName(self.handle, flags[i]) - self._flags[name] = flags[i] - self._flags_by_index[flags[i]] = name - self.flags.append(name) - core.BNFreeRegisterList(flags) - - count = ctypes.c_ulonglong() - write_types = core.BNGetAllArchitectureFlagWriteTypes(self.handle, count) - self._flag_write_types = {} - self._flag_write_types_by_index = {} - self.__dict__["flag_write_types"] = [] - for i in xrange(0, count.value): - name = core.BNGetArchitectureFlagWriteTypeName(self.handle, write_types[i]) - self._flag_write_types[name] = write_types[i] - self._flag_write_types_by_index[write_types[i]] = name - self.flag_write_types.append(name) - core.BNFreeRegisterList(write_types) - - count = ctypes.c_ulonglong() - sem_classes = core.BNGetAllArchitectureSemanticFlagClasses(self.handle, count) - self._semantic_flag_classes = {} - self._semantic_flag_classes_by_index = {} - self.__dict__["semantic_flag_classes"] = [] - for i in xrange(0, count.value): - name = core.BNGetArchitectureSemanticFlagClassName(self.handle, sem_classes[i]) - self._semantic_flag_classes[name] = sem_classes[i] - self._semantic_flag_classes_by_index[sem_classes[i]] = name - self.semantic_flag_classes.append(name) - core.BNFreeRegisterList(sem_classes) + def __init__(self): + startup._init_plugins() - count = ctypes.c_ulonglong() - sem_groups = core.BNGetAllArchitectureSemanticFlagGroups(self.handle, count) - self._semantic_flag_groups = {} - self._semantic_flag_groups_by_index = {} - self.__dict__["semantic_flag_groups"] = [] - for i in xrange(0, count.value): - name = core.BNGetArchitectureSemanticFlagGroupName(self.handle, sem_groups[i]) - self._semantic_flag_groups[name] = sem_groups[i] - self._semantic_flag_groups_by_index[sem_groups[i]] = name - self.semantic_flag_groups.append(name) - core.BNFreeRegisterList(sem_groups) - - self._flag_roles = {} - self.__dict__["flag_roles"] = {} - for flag in self.__dict__["flags"]: - role = FlagRole(core.BNGetArchitectureFlagRole(self.handle, self._flags[flag], 0)) - self.__dict__["flag_roles"][flag] = role - self._flag_roles[self._flags[flag]] = role - - self.__dict__["flags_required_for_flag_condition"] = {} - for cond in LowLevelILFlagCondition: - count = ctypes.c_ulonglong() - flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, 0, count) - flag_names = [] - for i in xrange(0, count.value): - flag_names.append(self._flags_by_index[flags[i]]) - core.BNFreeRegisterList(flags) - self.__dict__["flags_required_for_flag_condition"][cond] = flag_names - - self._flags_required_by_semantic_flag_group = {} - self.__dict__["flags_required_for_semantic_flag_group"] = {} - for group in self.semantic_flag_groups: - count = ctypes.c_ulonglong() - flags = core.BNGetArchitectureFlagsRequiredForSemanticFlagGroup(self.handle, - self._semantic_flag_groups[group], count) - flag_indexes = [] - flag_names = [] - for i in xrange(0, count.value): - flag_indexes.append(flags[i]) - flag_names.append(self._flags_by_index[flags[i]]) - core.BNFreeRegisterList(flags) - self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flag_indexes - self.__dict__["flags_required_for_semantic_flag_group"][cond] = flag_names - - self._flag_conditions_for_semantic_flag_group = {} - self.__dict__["flag_conditions_for_semantic_flag_group"] = {} - for group in self.semantic_flag_groups: - count = ctypes.c_ulonglong() - conditions = core.BNGetArchitectureFlagConditionsForSemanticFlagGroup(self.handle, - self._semantic_flag_groups[group], count) - class_index_cond = {} - class_cond = {} - for i in xrange(0, count.value): - class_index_cond[conditions[i].semanticClass] = conditions[i].condition - if conditions[i].semanticClass == 0: - class_cond[None] = conditions[i].condition - elif conditions[i].semanticClass in self._semantic_flag_classes_by_index: - class_cond[self._semantic_flag_classes_by_index[conditions[i].semanticClass]] = conditions[i].condition - core.BNFreeFlagConditionsForSemanticFlagGroup(conditions) - self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_index_cond - self.__dict__["flag_conditions_for_semantic_flag_group"][group] = class_cond - - self._flags_written_by_flag_write_type = {} - self.__dict__["flags_written_by_flag_write_type"] = {} - for write_type in self.flag_write_types: - count = ctypes.c_ulonglong() - flags = core.BNGetArchitectureFlagsWrittenByFlagWriteType(self.handle, - self._flag_write_types[write_type], count) - flag_indexes = [] - flag_names = [] - for i in xrange(0, count.value): - flag_indexes.append(flags[i]) - flag_names.append(self._flags_by_index[flags[i]]) - core.BNFreeRegisterList(flags) - self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flag_indexes - self.__dict__["flags_written_by_flag_write_type"][write_type] = flag_names - - self._semantic_class_for_flag_write_type = {} - self.__dict__["semantic_class_for_flag_write_type"] = {} - for write_type in self.flag_write_types: - sem_class = core.BNGetArchitectureSemanticClassForFlagWriteType(self.handle, - self._flag_write_types[write_type]) - if sem_class == 0: - sem_class_name = None + if self.__class__.opcode_display_length > self.__class__.max_instr_length: + self.__class__.opcode_display_length = self.__class__.max_instr_length + + self._cb = core.BNCustomArchitecture() + self._cb.context = 0 + self._cb.init = self._cb.init.__class__(self._init) + self._cb.getEndianness = self._cb.getEndianness.__class__(self._get_endianness) + self._cb.getAddressSize = self._cb.getAddressSize.__class__(self._get_address_size) + self._cb.getDefaultIntegerSize = self._cb.getDefaultIntegerSize.__class__(self._get_default_integer_size) + self._cb.getInstructionAlignment = self._cb.getInstructionAlignment.__class__(self._get_instruction_alignment) + self._cb.getMaxInstructionLength = self._cb.getMaxInstructionLength.__class__(self._get_max_instruction_length) + self._cb.getOpcodeDisplayLength = self._cb.getOpcodeDisplayLength.__class__(self._get_opcode_display_length) + self._cb.getAssociatedArchitectureByAddress = \ + self._cb.getAssociatedArchitectureByAddress.__class__(self._get_associated_arch_by_address) + self._cb.getInstructionInfo = self._cb.getInstructionInfo.__class__(self._get_instruction_info) + self._cb.getInstructionText = self._cb.getInstructionText.__class__(self._get_instruction_text) + self._cb.freeInstructionText = self._cb.freeInstructionText.__class__(self._free_instruction_text) + self._cb.getInstructionLowLevelIL = self._cb.getInstructionLowLevelIL.__class__( + self._get_instruction_low_level_il) + self._cb.getRegisterName = self._cb.getRegisterName.__class__(self._get_register_name) + self._cb.getFlagName = self._cb.getFlagName.__class__(self._get_flag_name) + self._cb.getFlagWriteTypeName = self._cb.getFlagWriteTypeName.__class__(self._get_flag_write_type_name) + self._cb.getSemanticFlagClassName = self._cb.getSemanticFlagClassName.__class__(self._get_semantic_flag_class_name) + self._cb.getSemanticFlagGroupName = self._cb.getSemanticFlagGroupName.__class__(self._get_semantic_flag_group_name) + self._cb.getFullWidthRegisters = self._cb.getFullWidthRegisters.__class__(self._get_full_width_registers) + self._cb.getAllRegisters = self._cb.getAllRegisters.__class__(self._get_all_registers) + self._cb.getAllFlags = self._cb.getAllRegisters.__class__(self._get_all_flags) + self._cb.getAllFlagWriteTypes = self._cb.getAllRegisters.__class__(self._get_all_flag_write_types) + self._cb.getAllSemanticFlagClasses = self._cb.getAllSemanticFlagClasses.__class__(self._get_all_semantic_flag_classes) + self._cb.getAllSemanticFlagGroups = self._cb.getAllSemanticFlagGroups.__class__(self._get_all_semantic_flag_groups) + self._cb.getFlagRole = self._cb.getFlagRole.__class__(self._get_flag_role) + self._cb.getFlagsRequiredForFlagCondition = self._cb.getFlagsRequiredForFlagCondition.__class__( + self._get_flags_required_for_flag_condition) + self._cb.getFlagsRequiredForSemanticFlagGroup = self._cb.getFlagsRequiredForSemanticFlagGroup.__class__( + self._get_flags_required_for_semantic_flag_group) + self._cb.getFlagConditionsForSemanticFlagGroup = self._cb.getFlagConditionsForSemanticFlagGroup.__class__( + self._get_flag_conditions_for_semantic_flag_group) + self._cb.freeFlagConditionsForSemanticFlagGroup = self._cb.freeFlagConditionsForSemanticFlagGroup.__class__( + self._free_flag_conditions_for_semantic_flag_group) + self._cb.getFlagsWrittenByFlagWriteType = self._cb.getFlagsWrittenByFlagWriteType.__class__( + self._get_flags_written_by_flag_write_type) + self._cb.getSemanticClassForFlagWriteType = self._cb.getSemanticClassForFlagWriteType.__class__( + self._get_semantic_class_for_flag_write_type) + self._cb.getFlagWriteLowLevelIL = self._cb.getFlagWriteLowLevelIL.__class__( + self._get_flag_write_low_level_il) + self._cb.getFlagConditionLowLevelIL = self._cb.getFlagConditionLowLevelIL.__class__( + self._get_flag_condition_low_level_il) + self._cb.getSemanticFlagGroupLowLevelIL = self._cb.getSemanticFlagGroupLowLevelIL.__class__( + self._get_semantic_flag_group_low_level_il) + self._cb.freeRegisterList = self._cb.freeRegisterList.__class__(self._free_register_list) + self._cb.getRegisterInfo = self._cb.getRegisterInfo.__class__(self._get_register_info) + self._cb.getStackPointerRegister = self._cb.getStackPointerRegister.__class__( + self._get_stack_pointer_register) + self._cb.getLinkRegister = self._cb.getLinkRegister.__class__(self._get_link_register) + self._cb.getGlobalRegisters = self._cb.getGlobalRegisters.__class__(self._get_global_registers) + self._cb.getRegisterStackName = self._cb.getRegisterStackName.__class__(self._get_register_stack_name) + self._cb.getAllRegisterStacks = self._cb.getAllRegisterStacks.__class__(self._get_all_register_stacks) + self._cb.getRegisterStackInfo = self._cb.getRegisterStackInfo.__class__(self._get_register_stack_info) + self._cb.getIntrinsicName = self._cb.getIntrinsicName.__class__(self._get_intrinsic_name) + self._cb.getAllIntrinsics = self._cb.getAllIntrinsics.__class__(self._get_all_intrinsics) + self._cb.getIntrinsicInputs = self._cb.getIntrinsicInputs.__class__(self._get_intrinsic_inputs) + self._cb.freeNameAndTypeList = self._cb.freeNameAndTypeList.__class__(self._free_name_and_type_list) + self._cb.getIntrinsicOutputs = self._cb.getIntrinsicOutputs.__class__(self._get_intrinsic_outputs) + self._cb.freeTypeList = self._cb.freeTypeList.__class__(self._free_type_list) + self._cb.assemble = self._cb.assemble.__class__(self._assemble) + self._cb.isNeverBranchPatchAvailable = self._cb.isNeverBranchPatchAvailable.__class__( + self._is_never_branch_patch_available) + self._cb.isAlwaysBranchPatchAvailable = self._cb.isAlwaysBranchPatchAvailable.__class__( + self._is_always_branch_patch_available) + self._cb.isInvertBranchPatchAvailable = self._cb.isInvertBranchPatchAvailable.__class__( + self._is_invert_branch_patch_available) + self._cb.isSkipAndReturnZeroPatchAvailable = self._cb.isSkipAndReturnZeroPatchAvailable.__class__( + self._is_skip_and_return_zero_patch_available) + self._cb.isSkipAndReturnValuePatchAvailable = self._cb.isSkipAndReturnValuePatchAvailable.__class__( + self._is_skip_and_return_value_patch_available) + self._cb.convertToNop = self._cb.convertToNop.__class__(self._convert_to_nop) + self._cb.alwaysBranch = self._cb.alwaysBranch.__class__(self._always_branch) + self._cb.invertBranch = self._cb.invertBranch.__class__(self._invert_branch) + self._cb.skipAndReturnValue = self._cb.skipAndReturnValue.__class__(self._skip_and_return_value) + + self.__dict__["endianness"] = self.__class__.endianness + self.__dict__["address_size"] = self.__class__.address_size + self.__dict__["default_int_size"] = self.__class__.default_int_size + self.__dict__["instr_alignment"] = self.__class__.instr_alignment + self.__dict__["max_instr_length"] = self.__class__.max_instr_length + self.__dict__["opcode_display_length"] = self.__class__.opcode_display_length + self.__dict__["stack_pointer"] = self.__class__.stack_pointer + self.__dict__["link_reg"] = self.__class__.link_reg + + self._all_regs = {} + self._full_width_regs = {} + self._regs_by_index = {} + self.__dict__["regs"] = self.__class__.regs + reg_index = 0 + + # Registers used for storage in register stacks must be sequential, so allocate these in order first + self._all_reg_stacks = {} + self._reg_stacks_by_index = {} + self.__dict__["reg_stacks"] = self.__class__.reg_stacks + reg_stack_index = 0 + for reg_stack in self.reg_stacks: + info = self.reg_stacks[reg_stack] + for reg in info.storage_regs: + self._all_regs[reg] = reg_index + self._regs_by_index[reg_index] = reg + self.regs[reg].index = reg_index + reg_index += 1 + for reg in info.top_relative_regs: + self._all_regs[reg] = reg_index + self._regs_by_index[reg_index] = reg + self.regs[reg].index = reg_index + reg_index += 1 + if reg_stack not in self._all_reg_stacks: + self._all_reg_stacks[reg_stack] = reg_stack_index + self._reg_stacks_by_index[reg_stack_index] = reg_stack + self.reg_stacks[reg_stack].index = reg_stack_index + reg_stack_index += 1 + + for reg in self.regs: + info = self.regs[reg] + if reg not in self._all_regs: + self._all_regs[reg] = reg_index + self._regs_by_index[reg_index] = reg + self.regs[reg].index = reg_index + reg_index += 1 + if info.full_width_reg not in self._all_regs: + self._all_regs[info.full_width_reg] = reg_index + self._regs_by_index[reg_index] = info.full_width_reg + self.regs[info.full_width_reg].index = reg_index + reg_index += 1 + if info.full_width_reg not in self._full_width_regs: + self._full_width_regs[info.full_width_reg] = self._all_regs[info.full_width_reg] + + self._flags = {} + self._flags_by_index = {} + self.__dict__["flags"] = self.__class__.flags + flag_index = 0 + for flag in self.__class__.flags: + if flag not in self._flags: + self._flags[flag] = flag_index + self._flags_by_index[flag_index] = flag + flag_index += 1 + + self._flag_write_types = {} + self._flag_write_types_by_index = {} + self.__dict__["flag_write_types"] = self.__class__.flag_write_types + write_type_index = 0 + for write_type in self.__class__.flag_write_types: + if write_type not in self._flag_write_types: + self._flag_write_types[write_type] = write_type_index + self._flag_write_types_by_index[write_type_index] = write_type + write_type_index += 1 + + self._semantic_flag_classes = {} + self._semantic_flag_classes_by_index = {} + self.__dict__["semantic_flag_classes"] = self.__class__.semantic_flag_classes + semantic_class_index = 1 + for sem_class in self.__class__.semantic_flag_classes: + if sem_class not in self._semantic_flag_classes: + self._semantic_flag_classes[sem_class] = semantic_class_index + self._semantic_flag_classes_by_index[semantic_class_index] = sem_class + semantic_class_index += 1 + + self._semantic_flag_groups = {} + self._semantic_flag_groups_by_index = {} + self.__dict__["semantic_flag_groups"] = self.__class__.semantic_flag_groups + semantic_group_index = 0 + for sem_group in self.__class__.semantic_flag_groups: + if sem_group not in self._semantic_flag_groups: + self._semantic_flag_groups[sem_group] = semantic_group_index + self._semantic_flag_groups_by_index[semantic_group_index] = sem_group + semantic_group_index += 1 + + self._flag_roles = {} + self.__dict__["flag_roles"] = self.__class__.flag_roles + for flag in self.__class__.flag_roles: + role = self.__class__.flag_roles[flag] + if isinstance(role, str): + role = FlagRole[role] + self._flag_roles[self._flags[flag]] = role + + self.__dict__["flags_required_for_flag_condition"] = self.__class__.flags_required_for_flag_condition + + self._flags_required_by_semantic_flag_group = {} + self.__dict__["flags_required_for_semantic_flag_group"] = self.__class__.flags_required_for_semantic_flag_group + for group in self.__class__.flags_required_for_semantic_flag_group: + flags = [] + for flag in self.__class__.flags_required_for_semantic_flag_group[group]: + flags.append(self._flags[flag]) + self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flags + + self._flag_conditions_for_semantic_flag_group = {} + self.__dict__["flag_conditions_for_semantic_flag_group"] = self.__class__.flag_conditions_for_semantic_flag_group + for group in self.__class__.flag_conditions_for_semantic_flag_group: + class_cond = {} + for sem_class in self.__class__.flag_conditions_for_semantic_flag_group[group]: + if sem_class is None: + class_cond[0] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] else: - sem_class_name = self._semantic_flag_classes_by_index[sem_class] - self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class - self.__dict__["semantic_class_for_flag_write_type"][write_type] = sem_class_name - - count = ctypes.c_ulonglong() - regs = core.BNGetArchitectureGlobalRegisters(self.handle, count) - self.__dict__["global_regs"] = [] - for i in xrange(0, count.value): - self.global_regs.append(core.BNGetArchitectureRegisterName(self.handle, regs[i])) - core.BNFreeRegisterList(regs) - - count = ctypes.c_ulonglong() - regs = core.BNGetAllArchitectureRegisterStacks(self.handle, count) - self.__dict__["reg_stacks"] = {} - for i in xrange(0, count.value): - name = core.BNGetArchitectureRegisterStackName(self.handle, regs[i]) - info = core.BNGetArchitectureRegisterStackInfo(self.handle, regs[i]) - storage = [] - for j in xrange(0, info.storageCount): - storage.append(core.BNGetArchitectureRegisterName(self.handle, info.firstStorageReg + j)) - top_rel = [] - for j in xrange(0, info.topRelativeCount): - top_rel.append(core.BNGetArchitectureRegisterName(self.handle, info.firstTopRelativeReg + j)) - top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) - self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top, regs[i]) - core.BNFreeRegisterList(regs) + class_cond[self._semantic_flag_classes[sem_class]] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] + self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_cond - count = ctypes.c_ulonglong() - intrinsics = core.BNGetAllArchitectureIntrinsics(self.handle, count) - self.__dict__["intrinsics"] = {} - for i in xrange(0, count.value): - name = core.BNGetArchitectureIntrinsicName(self.handle, intrinsics[i]) - input_count = ctypes.c_ulonglong() - inputs = core.BNGetArchitectureIntrinsicInputs(self.handle, intrinsics[i], input_count) - input_list = [] - for j in xrange(0, input_count.value): - input_name = inputs[j].name - type_obj = types.Type(core.BNNewTypeReference(inputs[j].type), confidence = inputs[j].typeConfidence) - input_list.append(function.IntrinsicInput(type_obj, input_name)) - core.BNFreeNameAndTypeList(inputs, input_count.value) - output_count = ctypes.c_ulonglong() - outputs = core.BNGetArchitectureIntrinsicOutputs(self.handle, intrinsics[i], output_count) - output_list = [] - for j in xrange(0, output_count.value): - output_list.append(types.Type(core.BNNewTypeReference(outputs[j].type), confidence = outputs[j].confidence)) - core.BNFreeOutputTypeList(outputs, output_count.value) - self.intrinsics[name] = function.IntrinsicInfo(input_list, output_list) - else: - startup._init_plugins() - - if self.__class__.opcode_display_length > self.__class__.max_instr_length: - self.__class__.opcode_display_length = self.__class__.max_instr_length - - self._cb = core.BNCustomArchitecture() - self._cb.context = 0 - self._cb.init = self._cb.init.__class__(self._init) - self._cb.getEndianness = self._cb.getEndianness.__class__(self._get_endianness) - self._cb.getAddressSize = self._cb.getAddressSize.__class__(self._get_address_size) - self._cb.getDefaultIntegerSize = self._cb.getDefaultIntegerSize.__class__(self._get_default_integer_size) - self._cb.getInstructionAlignment = self._cb.getInstructionAlignment.__class__(self._get_instruction_alignment) - self._cb.getMaxInstructionLength = self._cb.getMaxInstructionLength.__class__(self._get_max_instruction_length) - self._cb.getOpcodeDisplayLength = self._cb.getOpcodeDisplayLength.__class__(self._get_opcode_display_length) - self._cb.getAssociatedArchitectureByAddress = \ - self._cb.getAssociatedArchitectureByAddress.__class__(self._get_associated_arch_by_address) - self._cb.getInstructionInfo = self._cb.getInstructionInfo.__class__(self._get_instruction_info) - self._cb.getInstructionText = self._cb.getInstructionText.__class__(self._get_instruction_text) - self._cb.freeInstructionText = self._cb.freeInstructionText.__class__(self._free_instruction_text) - self._cb.getInstructionLowLevelIL = self._cb.getInstructionLowLevelIL.__class__( - self._get_instruction_low_level_il) - self._cb.getRegisterName = self._cb.getRegisterName.__class__(self._get_register_name) - self._cb.getFlagName = self._cb.getFlagName.__class__(self._get_flag_name) - self._cb.getFlagWriteTypeName = self._cb.getFlagWriteTypeName.__class__(self._get_flag_write_type_name) - self._cb.getSemanticFlagClassName = self._cb.getSemanticFlagClassName.__class__(self._get_semantic_flag_class_name) - self._cb.getSemanticFlagGroupName = self._cb.getSemanticFlagGroupName.__class__(self._get_semantic_flag_group_name) - self._cb.getFullWidthRegisters = self._cb.getFullWidthRegisters.__class__(self._get_full_width_registers) - self._cb.getAllRegisters = self._cb.getAllRegisters.__class__(self._get_all_registers) - self._cb.getAllFlags = self._cb.getAllRegisters.__class__(self._get_all_flags) - self._cb.getAllFlagWriteTypes = self._cb.getAllRegisters.__class__(self._get_all_flag_write_types) - self._cb.getAllSemanticFlagClasses = self._cb.getAllSemanticFlagClasses.__class__(self._get_all_semantic_flag_classes) - self._cb.getAllSemanticFlagGroups = self._cb.getAllSemanticFlagGroups.__class__(self._get_all_semantic_flag_groups) - self._cb.getFlagRole = self._cb.getFlagRole.__class__(self._get_flag_role) - self._cb.getFlagsRequiredForFlagCondition = self._cb.getFlagsRequiredForFlagCondition.__class__( - self._get_flags_required_for_flag_condition) - self._cb.getFlagsRequiredForSemanticFlagGroup = self._cb.getFlagsRequiredForSemanticFlagGroup.__class__( - self._get_flags_required_for_semantic_flag_group) - self._cb.getFlagConditionsForSemanticFlagGroup = self._cb.getFlagConditionsForSemanticFlagGroup.__class__( - self._get_flag_conditions_for_semantic_flag_group) - self._cb.freeFlagConditionsForSemanticFlagGroup = self._cb.freeFlagConditionsForSemanticFlagGroup.__class__( - self._free_flag_conditions_for_semantic_flag_group) - self._cb.getFlagsWrittenByFlagWriteType = self._cb.getFlagsWrittenByFlagWriteType.__class__( - self._get_flags_written_by_flag_write_type) - self._cb.getSemanticClassForFlagWriteType = self._cb.getSemanticClassForFlagWriteType.__class__( - self._get_semantic_class_for_flag_write_type) - self._cb.getFlagWriteLowLevelIL = self._cb.getFlagWriteLowLevelIL.__class__( - self._get_flag_write_low_level_il) - self._cb.getFlagConditionLowLevelIL = self._cb.getFlagConditionLowLevelIL.__class__( - self._get_flag_condition_low_level_il) - self._cb.getSemanticFlagGroupLowLevelIL = self._cb.getSemanticFlagGroupLowLevelIL.__class__( - self._get_semantic_flag_group_low_level_il) - self._cb.freeRegisterList = self._cb.freeRegisterList.__class__(self._free_register_list) - self._cb.getRegisterInfo = self._cb.getRegisterInfo.__class__(self._get_register_info) - self._cb.getStackPointerRegister = self._cb.getStackPointerRegister.__class__( - self._get_stack_pointer_register) - self._cb.getLinkRegister = self._cb.getLinkRegister.__class__(self._get_link_register) - self._cb.getGlobalRegisters = self._cb.getGlobalRegisters.__class__(self._get_global_registers) - self._cb.getRegisterStackName = self._cb.getRegisterStackName.__class__(self._get_register_stack_name) - self._cb.getAllRegisterStacks = self._cb.getAllRegisterStacks.__class__(self._get_all_register_stacks) - self._cb.getRegisterStackInfo = self._cb.getRegisterStackInfo.__class__(self._get_register_stack_info) - self._cb.getIntrinsicName = self._cb.getIntrinsicName.__class__(self._get_intrinsic_name) - self._cb.getAllIntrinsics = self._cb.getAllIntrinsics.__class__(self._get_all_intrinsics) - self._cb.getIntrinsicInputs = self._cb.getIntrinsicInputs.__class__(self._get_intrinsic_inputs) - self._cb.freeNameAndTypeList = self._cb.freeNameAndTypeList.__class__(self._free_name_and_type_list) - self._cb.getIntrinsicOutputs = self._cb.getIntrinsicOutputs.__class__(self._get_intrinsic_outputs) - self._cb.freeTypeList = self._cb.freeTypeList.__class__(self._free_type_list) - self._cb.assemble = self._cb.assemble.__class__(self._assemble) - self._cb.isNeverBranchPatchAvailable = self._cb.isNeverBranchPatchAvailable.__class__( - self._is_never_branch_patch_available) - self._cb.isAlwaysBranchPatchAvailable = self._cb.isAlwaysBranchPatchAvailable.__class__( - self._is_always_branch_patch_available) - self._cb.isInvertBranchPatchAvailable = self._cb.isInvertBranchPatchAvailable.__class__( - self._is_invert_branch_patch_available) - self._cb.isSkipAndReturnZeroPatchAvailable = self._cb.isSkipAndReturnZeroPatchAvailable.__class__( - self._is_skip_and_return_zero_patch_available) - self._cb.isSkipAndReturnValuePatchAvailable = self._cb.isSkipAndReturnValuePatchAvailable.__class__( - self._is_skip_and_return_value_patch_available) - self._cb.convertToNop = self._cb.convertToNop.__class__(self._convert_to_nop) - self._cb.alwaysBranch = self._cb.alwaysBranch.__class__(self._always_branch) - self._cb.invertBranch = self._cb.invertBranch.__class__(self._invert_branch) - self._cb.skipAndReturnValue = self._cb.skipAndReturnValue.__class__(self._skip_and_return_value) - - self._all_regs = {} - self._full_width_regs = {} - self._regs_by_index = {} - self.__dict__["regs"] = self.__class__.regs - reg_index = 0 - - # Registers used for storage in register stacks must be sequential, so allocate these in order first - self._all_reg_stacks = {} - self._reg_stacks_by_index = {} - self.__dict__["reg_stacks"] = self.__class__.reg_stacks - reg_stack_index = 0 - for reg_stack in self.reg_stacks: - info = self.reg_stacks[reg_stack] - for reg in info.storage_regs: - self._all_regs[reg] = reg_index - self._regs_by_index[reg_index] = reg - self.regs[reg].index = reg_index - reg_index += 1 - for reg in info.top_relative_regs: - self._all_regs[reg] = reg_index - self._regs_by_index[reg_index] = reg - self.regs[reg].index = reg_index - reg_index += 1 - if reg_stack not in self._all_reg_stacks: - self._all_reg_stacks[reg_stack] = reg_stack_index - self._reg_stacks_by_index[reg_stack_index] = reg_stack - self.reg_stacks[reg_stack].index = reg_stack_index - reg_stack_index += 1 - - for reg in self.regs: - info = self.regs[reg] - if reg not in self._all_regs: - self._all_regs[reg] = reg_index - self._regs_by_index[reg_index] = reg - self.regs[reg].index = reg_index - reg_index += 1 - if info.full_width_reg not in self._all_regs: - self._all_regs[info.full_width_reg] = reg_index - self._regs_by_index[reg_index] = info.full_width_reg - self.regs[info.full_width_reg].index = reg_index - reg_index += 1 - if info.full_width_reg not in self._full_width_regs: - self._full_width_regs[info.full_width_reg] = self._all_regs[info.full_width_reg] - - self._flags = {} - self._flags_by_index = {} - self.__dict__["flags"] = self.__class__.flags - flag_index = 0 - for flag in self.__class__.flags: - if flag not in self._flags: - self._flags[flag] = flag_index - self._flags_by_index[flag_index] = flag - flag_index += 1 - - self._flag_write_types = {} - self._flag_write_types_by_index = {} - self.__dict__["flag_write_types"] = self.__class__.flag_write_types - write_type_index = 0 - for write_type in self.__class__.flag_write_types: - if write_type not in self._flag_write_types: - self._flag_write_types[write_type] = write_type_index - self._flag_write_types_by_index[write_type_index] = write_type - write_type_index += 1 - - self._semantic_flag_classes = {} - self._semantic_flag_classes_by_index = {} - self.__dict__["semantic_flag_classes"] = self.__class__.semantic_flag_classes - semantic_class_index = 1 - for sem_class in self.__class__.semantic_flag_classes: - if sem_class not in self._semantic_flag_classes: - self._semantic_flag_classes[sem_class] = semantic_class_index - self._semantic_flag_classes_by_index[semantic_class_index] = sem_class - semantic_class_index += 1 - - self._semantic_flag_groups = {} - self._semantic_flag_groups_by_index = {} - self.__dict__["semantic_flag_groups"] = self.__class__.semantic_flag_groups - semantic_group_index = 0 - for sem_group in self.__class__.semantic_flag_groups: - if sem_group not in self._semantic_flag_groups: - self._semantic_flag_groups[sem_group] = semantic_group_index - self._semantic_flag_groups_by_index[semantic_group_index] = sem_group - semantic_group_index += 1 - - self._flag_roles = {} - self.__dict__["flag_roles"] = self.__class__.flag_roles - for flag in self.__class__.flag_roles: - role = self.__class__.flag_roles[flag] - if isinstance(role, str): - role = FlagRole[role] - self._flag_roles[self._flags[flag]] = role - - self.__dict__["flags_required_for_flag_condition"] = self.__class__.flags_required_for_flag_condition - - self._flags_required_by_semantic_flag_group = {} - self.__dict__["flags_required_for_semantic_flag_group"] = self.__class__.flags_required_for_semantic_flag_group - for group in self.__class__.flags_required_for_semantic_flag_group: - flags = [] - for flag in self.__class__.flags_required_for_semantic_flag_group[group]: - flags.append(self._flags[flag]) - self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flags - - self._flag_conditions_for_semantic_flag_group = {} - self.__dict__["flag_conditions_for_semantic_flag_group"] = self.__class__.flag_conditions_for_semantic_flag_group - for group in self.__class__.flag_conditions_for_semantic_flag_group: - class_cond = {} - for sem_class in self.__class__.flag_conditions_for_semantic_flag_group[group]: - if sem_class is None: - class_cond[0] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] - else: - class_cond[self._semantic_flag_classes[sem_class]] = self.__class__.flag_conditions_for_semantic_flag_group[group][sem_class] - self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_cond - - self._flags_written_by_flag_write_type = {} - self.__dict__["flags_written_by_flag_write_type"] = self.__class__.flags_written_by_flag_write_type - for write_type in self.__class__.flags_written_by_flag_write_type: - flags = [] - for flag in self.__class__.flags_written_by_flag_write_type[write_type]: - flags.append(self._flags[flag]) - self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flags - - self._semantic_class_for_flag_write_type = {} - self.__dict__["semantic_class_for_flag_write_type"] = self.__class__.semantic_class_for_flag_write_type - for write_type in self.__class__.semantic_class_for_flag_write_type: - sem_class = self.__class__.semantic_class_for_flag_write_type[write_type] - if sem_class in self._semantic_flag_classes: - sem_class_index = self._semantic_flag_classes[sem_class] - else: - sem_class_index = 0 - self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class_index - - self.__dict__["global_regs"] = self.__class__.global_regs - - self._intrinsics = {} - self._intrinsics_by_index = {} - self.__dict__["intrinsics"] = self.__class__.intrinsics - intrinsic_index = 0 - for intrinsic in self.__class__.intrinsics.keys(): - if intrinsic not in self._intrinsics: - info = self.__class__.intrinsics[intrinsic] - for i in xrange(0, len(info.inputs)): - if isinstance(info.inputs[i], types.Type): - info.inputs[i] = function.IntrinsicInput(info.inputs[i]) - elif isinstance(info.inputs[i], tuple): - info.inputs[i] = function.IntrinsicInput(info.inputs[i][0], info.inputs[i][1]) - info.index = intrinsic_index - self._intrinsics[intrinsic] = intrinsic_index - self._intrinsics_by_index[intrinsic_index] = (intrinsic, info) - intrinsic_index += 1 - - self._pending_reg_lists = {} - self._pending_token_lists = {} - self._pending_condition_lists = {} - self._pending_name_and_type_lists = {} - self._pending_type_lists = {} + self._flags_written_by_flag_write_type = {} + self.__dict__["flags_written_by_flag_write_type"] = self.__class__.flags_written_by_flag_write_type + for write_type in self.__class__.flags_written_by_flag_write_type: + flags = [] + for flag in self.__class__.flags_written_by_flag_write_type[write_type]: + flags.append(self._flags[flag]) + self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flags + + self._semantic_class_for_flag_write_type = {} + self.__dict__["semantic_class_for_flag_write_type"] = self.__class__.semantic_class_for_flag_write_type + for write_type in self.__class__.semantic_class_for_flag_write_type: + sem_class = self.__class__.semantic_class_for_flag_write_type[write_type] + if sem_class in self._semantic_flag_classes: + sem_class_index = self._semantic_flag_classes[sem_class] + else: + sem_class_index = 0 + self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class_index + + self.__dict__["global_regs"] = self.__class__.global_regs + + self._intrinsics = {} + self._intrinsics_by_index = {} + self.__dict__["intrinsics"] = self.__class__.intrinsics + intrinsic_index = 0 + for intrinsic in self.__class__.intrinsics.keys(): + if intrinsic not in self._intrinsics: + info = self.__class__.intrinsics[intrinsic] + for i in xrange(0, len(info.inputs)): + if isinstance(info.inputs[i], types.Type): + info.inputs[i] = function.IntrinsicInput(info.inputs[i]) + elif isinstance(info.inputs[i], tuple): + info.inputs[i] = function.IntrinsicInput(info.inputs[i][0], info.inputs[i][1]) + info.index = intrinsic_index + self._intrinsics[intrinsic] = intrinsic_index + self._intrinsics_by_index[intrinsic_index] = (intrinsic, info) + intrinsic_index += 1 + + self._pending_reg_lists = {} + self._pending_token_lists = {} + self._pending_condition_lists = {} + self._pending_name_and_type_lists = {} + self._pending_type_lists = {} def __eq__(self, value): if not isinstance(value, Architecture): @@ -624,49 +439,49 @@ class Architecture(object): def _get_endianness(self, ctxt): try: - return self.__class__.endianness + return self.endianness except: log.log_error(traceback.format_exc()) return Endianness.LittleEndian def _get_address_size(self, ctxt): try: - return self.__class__.address_size + return self.address_size except: log.log_error(traceback.format_exc()) return 8 def _get_default_integer_size(self, ctxt): try: - return self.__class__.default_int_size + return self.default_int_size except: log.log_error(traceback.format_exc()) return 4 def _get_instruction_alignment(self, ctxt): try: - return self.__class__.instr_alignment + return self.instr_alignment except: log.log_error(traceback.format_exc()) return 1 def _get_max_instruction_length(self, ctxt): try: - return self.__class__.max_instr_length + return self.max_instr_length except: log.log_error(traceback.format_exc()) return 16 def _get_opcode_display_length(self, ctxt): try: - return self.__class__.opcode_display_length + return self.opcode_display_length except: log.log_error(traceback.format_exc()) return 8 def _get_associated_arch_by_address(self, ctxt, addr): try: - result, new_addr = self.perform_get_associated_arch_by_address(addr[0]) + result, new_addr = self.get_associated_arch_by_address(addr[0]) addr[0] = new_addr return ctypes.cast(result.handle, ctypes.c_void_p).value except: @@ -677,7 +492,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(max_len) ctypes.memmove(buf, data, max_len) - info = self.perform_get_instruction_info(buf.raw, addr) + info = self.get_instruction_info(buf.raw, addr) if info is None: return False result[0].length = info.length @@ -703,7 +518,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length[0]) ctypes.memmove(buf, data, length[0]) - info = self.perform_get_instruction_text(buf.raw, addr) + info = self.get_instruction_text(buf.raw, addr) if info is None: return False tokens = info[0] @@ -743,7 +558,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length[0]) ctypes.memmove(buf, data, length[0]) - result = self.perform_get_instruction_low_level_il(buf.raw, addr, + result = self.get_instruction_low_level_il(buf.raw, addr, lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))) if result is None: return False @@ -782,8 +597,8 @@ class Architecture(object): def _get_semantic_flag_class_name(self, ctxt, sem_class): try: - if sem_class in self._semantic_flag_class_by_index: - return core.BNAllocString(self._semantic_flag_class_by_index[sem_class]) + if sem_class in self._semantic_flag_classes_by_index: + return core.BNAllocString(self._semantic_flag_classes_by_index[sem_class]) return core.BNAllocString("") except (KeyError, OSError): log.log_error(traceback.format_exc()) @@ -791,8 +606,8 @@ class Architecture(object): def _get_semantic_flag_group_name(self, ctxt, sem_group): try: - if sem_group in self._semantic_flag_group_by_index: - return core.BNAllocString(self._semantic_flag_group_by_index[sem_group]) + if sem_group in self._semantic_flag_groups_by_index: + return core.BNAllocString(self._semantic_flag_groups_by_index[sem_group]) return core.BNAllocString("") except (KeyError, OSError): log.log_error(traceback.format_exc()) @@ -894,23 +709,18 @@ class Architecture(object): sem_class = self._semantic_flag_classes_by_index[sem_class] else: sem_class = None - return self.perform_get_flag_role(flag, sem_class) + return self.get_flag_role(flag, sem_class) except KeyError: log.log_error(traceback.format_exc()) return FlagRole.SpecialFlagRole - def perform_get_flag_role(self, flag, sem_class): - if flag in self._flag_roles: - return self._flag_roles[flag] - return FlagRole.SpecialFlagRole - def _get_flags_required_for_flag_condition(self, ctxt, cond, sem_class, count): try: if sem_class in self._semantic_flag_classes_by_index: sem_class = self._semantic_flag_classes_by_index[sem_class] else: sem_class = None - flag_names = self.perform_get_flags_required_for_flag_condition(cond, sem_class) + flag_names = self.get_flags_required_for_flag_condition(cond, sem_class) flags = [] for name in flag_names: flags.append(self._flags[name]) @@ -926,11 +736,6 @@ class Architecture(object): count[0] = 0 return None - def perform_get_flags_required_for_flag_condition(self, cond, sem_class): - if cond in self.flags_required_for_flag_condition: - return self.flags_required_for_flag_condition[cond] - return [] - def _get_flags_required_for_semantic_flag_group(self, ctxt, sem_group, count): try: if sem_group in self._flags_required_by_semantic_flag_group: @@ -951,8 +756,8 @@ class Architecture(object): def _get_flag_conditions_for_semantic_flag_group(self, ctxt, sem_group, count): try: - if sem_group in self._flag_conditions_by_semantic_flag_group: - class_cond = self._flag_conditions_by_semantic_flag_group[sem_group] + if sem_group in self._flag_conditions_for_semantic_flag_group: + class_cond = self._flag_conditions_for_semantic_flag_group[sem_group] else: class_cond = {} count[0] = len(class_cond) @@ -963,7 +768,7 @@ class Architecture(object): cond_buf[i].condition = class_cond[class_index] i += 1 result = ctypes.cast(cond_buf, ctypes.c_void_p) - self._pending_conditions[result.value] = (result, cond_buf) + self._pending_condition_lists[result.value] = (result, cond_buf) return result.value except (KeyError, OSError): log.log_error(traceback.format_exc()) @@ -973,9 +778,9 @@ class Architecture(object): def _free_flag_conditions_for_semantic_flag_group(self, ctxt, conditions): try: buf = ctypes.cast(conditions, ctypes.c_void_p) - if buf.value not in self._pending_conditions: + if buf.value not in self._pending_condition_lists: raise ValueError("freeing condition list that wasn't allocated") - del self._pending_conditions[buf.value] + del self._pending_condition_lists[buf.value] except (ValueError, KeyError): log.log_error(traceback.format_exc()) @@ -1021,7 +826,7 @@ class Architecture(object): operand_list.append(lowlevelil.ILRegister(self, operands[i].reg)) else: operand_list.append(lowlevelil.ILRegister(self, operands[i].reg)) - return self.perform_get_flag_write_low_level_il(op, size, write_type_name, flag_name, operand_list, + return self.get_flag_write_low_level_il(op, size, write_type_name, flag_name, operand_list, lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))).index except (KeyError, OSError): log.log_error(traceback.format_exc()) @@ -1033,7 +838,7 @@ class Architecture(object): sem_class_name = self._semantic_flag_classes_by_index[sem_class] else: sem_class_name = None - return self.perform_get_flag_condition_low_level_il(cond, sem_class_name, + return self.get_flag_condition_low_level_il(cond, sem_class_name, lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))).index except OSError: log.log_error(traceback.format_exc()) @@ -1045,7 +850,7 @@ class Architecture(object): sem_group_name = self._semantic_flag_groups_by_index[sem_group] else: sem_group_name = None - return self.perform_get_semantic_flag_group_low_level_il(sem_group_name, + return self.get_semantic_flag_group_low_level_il(sem_group_name, lowlevelil.LowLevelILFunction(self, core.BNNewLowLevelILFunctionReference(il))).index except OSError: log.log_error(traceback.format_exc()) @@ -1068,7 +873,7 @@ class Architecture(object): result[0].size = 0 result[0].extend = ImplicitRegisterExtend.NoExtend return - info = self.__class__.regs[self._regs_by_index[reg]] + info = self.regs[self._regs_by_index[reg]] result[0].fullWidthRegister = self._all_regs[info.full_width_reg] result[0].offset = info.offset result[0].size = info.size @@ -1085,26 +890,26 @@ class Architecture(object): def _get_stack_pointer_register(self, ctxt): try: - return self._all_regs[self.__class__.stack_pointer] + return self._all_regs[self.stack_pointer] except KeyError: log.log_error(traceback.format_exc()) return 0 def _get_link_register(self, ctxt): try: - if self.__class__.link_reg is None: + if self.link_reg is None: return 0xffffffff - return self._all_regs[self.__class__.link_reg] + return self._all_regs[self.link_reg] except KeyError: log.log_error(traceback.format_exc()) return 0 def _get_global_registers(self, ctxt, count): try: - count[0] = len(self.__class__.global_regs) - reg_buf = (ctypes.c_uint * len(self.__class__.global_regs))() - for i in xrange(0, len(self.__class__.global_regs)): - reg_buf[i] = self._all_regs[self.__class__.global_regs[i]] + count[0] = len(self.global_regs) + reg_buf = (ctypes.c_uint * len(self.global_regs))() + for i in xrange(0, len(self.global_regs)): + reg_buf[i] = self._all_regs[self.global_regs[i]] result = ctypes.cast(reg_buf, ctypes.c_void_p) self._pending_reg_lists[result.value] = (result, reg_buf) return result.value @@ -1146,7 +951,7 @@ class Architecture(object): result[0].topRelativeCount = 0 result[0].stackTopReg = 0 return - info = self.__class__.regs[self._reg_stacks_by_index[reg_stack]] + info = self.reg_stacks[self._reg_stacks_by_index[reg_stack]] result[0].firstStorageReg = self._all_regs[info.storage_regs[0]] result[0].storageCount = len(info.storage_regs) if len(info.top_relative_regs) > 0: @@ -1208,7 +1013,7 @@ class Architecture(object): count[0] = 0 return None - def _free_name_and_type_list(self, ctxt, buf_raw): + def _free_name_and_type_list(self, ctxt, buf_raw, length): try: buf = ctypes.cast(buf_raw, ctypes.c_void_p) if buf.value not in self._pending_name_and_type_lists: @@ -1240,7 +1045,7 @@ class Architecture(object): count[0] = 0 return None - def _free_type_list(self, ctxt, buf_raw): + def _free_type_list(self, ctxt, buf_raw, length): try: buf = ctypes.cast(buf_raw, ctypes.c_void_p) if buf.value not in self._pending_type_lists: @@ -1255,7 +1060,7 @@ class Architecture(object): def _assemble(self, ctxt, code, addr, result, errors): try: - data, error_str = self.perform_assemble(code, addr) + data, error_str = self.assemble(code, addr) errors[0] = core.BNAllocString(str(error_str)) if data is None: return False @@ -1273,7 +1078,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - return self.perform_is_never_branch_patch_available(buf.raw, addr) + return self.is_never_branch_patch_available(buf.raw, addr) except: log.log_error(traceback.format_exc()) return False @@ -1282,7 +1087,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - return self.perform_is_always_branch_patch_available(buf.raw, addr) + return self.is_always_branch_patch_available(buf.raw, addr) except: log.log_error(traceback.format_exc()) return False @@ -1291,7 +1096,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - return self.perform_is_invert_branch_patch_available(buf.raw, addr) + return self.is_invert_branch_patch_available(buf.raw, addr) except: log.log_error(traceback.format_exc()) return False @@ -1300,7 +1105,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - return self.perform_is_skip_and_return_zero_patch_available(buf.raw, addr) + return self.is_skip_and_return_zero_patch_available(buf.raw, addr) except: log.log_error(traceback.format_exc()) return False @@ -1309,7 +1114,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - return self.perform_is_skip_and_return_value_patch_available(buf.raw, addr) + return self.is_skip_and_return_value_patch_available(buf.raw, addr) except: log.log_error(traceback.format_exc()) return False @@ -1318,7 +1123,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - result = self.perform_convert_to_nop(buf.raw, addr) + result = self.convert_to_nop(buf.raw, addr) if result is None: return False result = str(result) @@ -1334,7 +1139,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - result = self.perform_always_branch(buf.raw, addr) + result = self.always_branch(buf.raw, addr) if result is None: return False result = str(result) @@ -1350,7 +1155,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - result = self.perform_invert_branch(buf.raw, addr) + result = self.invert_branch(buf.raw, addr) if result is None: return False result = str(result) @@ -1366,7 +1171,7 @@ class Architecture(object): try: buf = ctypes.create_string_buffer(length) ctypes.memmove(buf, data, length) - result = self.perform_skip_and_return_value(buf.raw, addr, value) + result = self.skip_and_return_value(buf.raw, addr, value) if result is None: return False result = str(result) @@ -1379,27 +1184,15 @@ class Architecture(object): return False def perform_get_associated_arch_by_address(self, addr): + """ + Deprecated method provided for compatibility. Architecture plugins should override ``get_associated_arch_by_address``. + """ return self, addr @abc.abstractmethod def perform_get_instruction_info(self, data, addr): """ - ``perform_get_instruction_info`` implements a method which interpretes the bytes passed in ``data`` as an - :py:Class:`InstructionInfo` object. The InstructionInfo object should have the length of the current instruction. - If the instruction is a branch instruction the method should add a branch of the proper type: - - ===================== =================================================== - BranchType Description - ===================== =================================================== - UnconditionalBranch Branch will always be taken - FalseBranch False branch condition - TrueBranch True branch condition - CallDestination Branch is a call instruction (Branch with Link) - FunctionReturn Branch returns from a function - SystemCall System call instruction - IndirectBranch Branch destination is a memory address or register - UnresolvedBranch Call instruction that isn't - ===================== =================================================== + Deprecated method provided for compatibility. Architecture plugins should override ``get_instruction_info``. :param str data: bytes to decode :param int addr: virtual address of the byte to be decoded @@ -1411,8 +1204,7 @@ class Architecture(object): @abc.abstractmethod def perform_get_instruction_text(self, data, addr): """ - ``perform_get_instruction_text`` implements a method which interpretes the bytes passed in ``data`` as a - list of :py:class:`InstructionTextToken` objects. + Deprecated method provided for compatibility. Architecture plugins should override ``get_instruction_text``. :param str data: bytes to decode :param int addr: virtual address of the byte to be decoded @@ -1424,10 +1216,7 @@ class Architecture(object): @abc.abstractmethod def perform_get_instruction_low_level_il(self, data, addr, il): """ - ``perform_get_instruction_low_level_il`` implements a method to interpret the bytes passed in ``data`` to - low-level IL instructions. The il instructions must be appended to the :py:class:`LowLevelILFunction`. - - .. note:: Architecture subclasses should implement this method. + Deprecated method provided for compatibility. Architecture plugins should override ``get_instruction_low_level_il``. :param str data: bytes to be interpreted as low-level IL instructions :param int addr: virtual address of start of ``data`` @@ -1439,8 +1228,7 @@ class Architecture(object): @abc.abstractmethod def perform_get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): """ - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``get_flag_write_low_level_il``. :param LowLevelILOperation op: :param int size: @@ -1458,8 +1246,7 @@ class Architecture(object): @abc.abstractmethod def perform_get_flag_condition_low_level_il(self, cond, sem_class, il): """ - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``get_flag_condition_low_level_il``. :param LowLevelILFlagCondition cond: Flag condition to be computed :param str sem_class: Semantic class to be used (None for default semantics) @@ -1471,8 +1258,7 @@ class Architecture(object): @abc.abstractmethod def perform_get_semantic_flag_group_low_level_il(self, sem_group, il): """ - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``get_semantic_flag_group_low_level_il``. :param str sem_group: Semantic group to be computed :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to @@ -1483,14 +1269,7 @@ class Architecture(object): @abc.abstractmethod def perform_assemble(self, code, addr): """ - ``perform_assemble`` implements a method to convert the string of assembly instructions ``code`` loaded at - virtual address ``addr`` to the byte representation of those instructions. This can be done by simply shelling - out to an assembler like yasm or llvm-mc, since this method isn't performance sensitive. - - .. note:: Architecture subclasses should implement this method. - .. note :: It is important that the assembler used accepts a syntax identical to the one emitted by the \ - disassembler. This will prevent confusing the user. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``assemble``. :param str code: string representation of the instructions to be assembled :param int addr: virtual address that the instructions will be loaded at @@ -1502,8 +1281,7 @@ class Architecture(object): @abc.abstractmethod def perform_is_never_branch_patch_available(self, data, addr): """ - ``perform_is_never_branch_patch_available`` implements a check to determine if the instruction represented by - the bytes contained in ``data`` at address addr is a branch instruction that can be made to never branch. + Deprecated method provided for compatibility. Architecture plugins should override ``is_never_branch_patch_available``. .. note:: Architecture subclasses should implement this method. .. warning:: This method should never be called directly. @@ -1518,11 +1296,7 @@ class Architecture(object): @abc.abstractmethod def perform_is_always_branch_patch_available(self, data, addr): """ - ``perform_is_always_branch_patch_available`` implements a check to determine if the instruction represented by - the bytes contained in ``data`` at address addr is a conditional branch that can be made unconditional. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``is_always_branch_patch_available``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1534,11 +1308,7 @@ class Architecture(object): @abc.abstractmethod def perform_is_invert_branch_patch_available(self, data, addr): """ - ``perform_is_invert_branch_patch_available`` implements a check to determine if the instruction represented by - the bytes contained in ``data`` at address addr is a conditional branch which can be inverted. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``is_invert_branch_patch_available``. :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise @@ -1549,13 +1319,7 @@ class Architecture(object): @abc.abstractmethod def perform_is_skip_and_return_zero_patch_available(self, data, addr): """ - ``perform_is_skip_and_return_zero_patch_available`` implements a check to determine if the instruction represented by - the bytes contained in ``data`` at address addr is a *call-like* instruction which can made into instructions - that are equivilent to "return 0". For example if ``data`` was the x86 instruction ``call eax`` which could be - converted into ``xor eax,eax`` thus this function would return True. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``is_skip_and_return_zero_patch_available``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1567,13 +1331,7 @@ class Architecture(object): @abc.abstractmethod def perform_is_skip_and_return_value_patch_available(self, data, addr): """ - ``perform_is_skip_and_return_value_patch_available`` implements a check to determine if the instruction represented by - the bytes contained in ``data`` at address addr is a *call-like* instruction which can made into instructions - that are equivilent to "return 0". For example if ``data`` was the x86 instruction ``call 0xdeadbeef`` which could be - converted into ``mov eax, 42`` thus this function would return True. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``is_skip_and_return_value_patch_available``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1585,10 +1343,7 @@ class Architecture(object): @abc.abstractmethod def perform_convert_to_nop(self, data, addr): """ - ``perform_convert_to_nop`` implements a method which returns a nop sequence of len(data) bytes long. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``convert_to_nop``. :param str data: bytes at virtual address ``addr`` :param int addr: the virtual address of the instruction to be patched @@ -1600,11 +1355,7 @@ class Architecture(object): @abc.abstractmethod def perform_always_branch(self, data, addr): """ - ``perform_always_branch`` implements a method which converts the branch represented by the bytes in ``data`` to - at ``addr`` to an unconditional branch. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``always_branch``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1616,11 +1367,7 @@ class Architecture(object): @abc.abstractmethod def perform_invert_branch(self, data, addr): """ - ``perform_invert_branch`` implements a method which inverts the branch represented by the bytes in ``data`` to - at ``addr``. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``invert_branch``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1632,12 +1379,7 @@ class Architecture(object): @abc.abstractmethod def perform_skip_and_return_value(self, data, addr, value): """ - ``perform_skip_and_return_value`` implements a method which converts a *call-like* instruction represented by - the bytes in ``data`` at ``addr`` to one or more instructions that are equivilent to a function returning a - value. - - .. note:: Architecture subclasses should implement this method. - .. warning:: This method should never be called directly. + Deprecated method provided for compatibility. Architecture plugins should override ``skip_and_return_value``. :param str data: bytes to be checked :param int addr: the virtual address of the instruction to be patched @@ -1647,76 +1389,70 @@ class Architecture(object): """ return None + def perform_get_flag_role(self, flag, sem_class): + """ + Deprecated method provided for compatibility. Architecture plugins should override ``get_flag_role``. + """ + if flag in self._flag_roles: + return self._flag_roles[flag] + return FlagRole.SpecialFlagRole + + def perform_get_flags_required_for_flag_condition(self, cond, sem_class): + """ + Deprecated method provided for compatibility. Architecture plugins should override ``get_flags_required_for_flag_condition``. + """ + if cond in self.flags_required_for_flag_condition: + return self.flags_required_for_flag_condition[cond] + return [] + def get_associated_arch_by_address(self, addr): - new_addr = ctypes.c_ulonglong() - new_addr.value = addr - result = core.BNGetAssociatedArchitectureByAddress(self.handle, new_addr) - return Architecture(handle = result), new_addr.value + return self.perform_get_associated_arch_by_address(addr) def get_instruction_info(self, data, addr): """ ``get_instruction_info`` returns an InstructionInfo object for the instruction at the given virtual address ``addr`` with data ``data``. + .. note:: Architecture subclasses should implement this method. + .. note :: The instruction info object should always set the InstructionInfo.length to the instruction length, \ and the branches of the proper types shoulde be added if the instruction is a branch. + If the instruction is a branch instruction architecture plugins should add a branch of the proper type: + + ===================== =================================================== + BranchType Description + ===================== =================================================== + UnconditionalBranch Branch will always be taken + FalseBranch False branch condition + TrueBranch True branch condition + CallDestination Branch is a call instruction (Branch with Link) + FunctionReturn Branch returns from a function + SystemCall System call instruction + IndirectBranch Branch destination is a memory address or register + UnresolvedBranch Branch destination is an unknown address + ===================== =================================================== + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` :param int addr: virtual address of bytes in ``data`` :return: the InstructionInfo for the current instruction :rtype: InstructionInfo """ - info = core.BNInstructionInfo() - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - if not core.BNGetInstructionInfo(self.handle, buf, addr, len(data), info): - return None - result = function.InstructionInfo() - result.length = info.length - result.arch_transition_by_target_addr = info.archTransitionByTargetAddr - result.branch_delay = info.branchDelay - for i in xrange(0, info.branchCount): - target = info.branchTarget[i] - if info.branchArch[i]: - arch = Architecture(info.branchArch[i]) - else: - arch = None - result.add_branch(BranchType(info.branchType[i]), target, arch) - return result + return self.perform_get_instruction_info(data, addr) def get_instruction_text(self, data, addr): """ ``get_instruction_text`` returns a list of InstructionTextToken objects for the instruction at the given virtual address ``addr`` with data ``data``. + .. note:: Architecture subclasses should implement this method. + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` :param int addr: virtual address of bytes in ``data`` :return: an InstructionTextToken list for the current instruction :rtype: list(InstructionTextToken) """ - data = str(data) - count = ctypes.c_ulonglong() - length = ctypes.c_ulonglong() - length.value = len(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - tokens = ctypes.POINTER(core.BNInstructionTextToken)() - if not core.BNGetInstructionText(self.handle, buf, addr, length, tokens, count): - return None, 0 - result = [] - for i in xrange(0, count.value): - token_type = InstructionTextTokenType(tokens[i].type) - text = tokens[i].text - value = tokens[i].value - size = tokens[i].size - operand = tokens[i].operand - context = tokens[i].context - confidence = tokens[i].confidence - address = tokens[i].address - result.append(function.InstructionTextToken(token_type, text, value, size, operand, context, address, confidence)) - core.BNFreeInstructionText(tokens, count.value) - return result, length.value + return self.perform_get_instruction_text(data, addr) def get_instruction_low_level_il_instruction(self, bv, addr): il = lowlevelil.LowLevelILFunction(self) @@ -1732,19 +1468,15 @@ class Architecture(object): This is used to analyze arbitrary data at an address, if you are working with an existing binary, you likely want to be using ``Function.get_low_level_il_at``. + .. note:: Architecture subclasses should implement this method. + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` :param int addr: virtual address of bytes in ``data`` :param LowLevelILFunction il: The function the current instruction belongs to :return: the length of the current instruction :rtype: int """ - data = str(data) - length = ctypes.c_ulonglong() - length.value = len(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - core.BNGetInstructionLowLevelIL(self.handle, buf, addr, length, il.handle) - return length.value + return self.perform_get_instruction_low_level_il(data, addr, il) def get_low_level_il_from_bytes(self, data, addr): """ @@ -1944,9 +1676,7 @@ class Architecture(object): :return: flag role :rtype: FlagRole """ - flag = self.get_flag_index(flag) - sem_class = self.get_semantic_flag_class_index(sem_class) - return FlagRole(core.BNGetArchitectureFlagRole(self.handle, flag, sem_class)) + return self.perform_get_flag_role(flag, sem_class) def get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): """ @@ -1958,20 +1688,7 @@ class Architecture(object): :param LowLevelILFunction il: :rtype: LowLevelILExpr """ - flag = self.get_flag_index(flag) - operand_list = (core.BNRegisterOrConstant * len(operands))() - for i in xrange(len(operands)): - if isinstance(operands[i], str): - operand_list[i].constant = False - operand_list[i].reg = self.regs[operands[i]].index - elif isinstance(operands[i], lowlevelil.ILRegister): - operand_list[i].constant = False - operand_list[i].reg = operands[i].index - else: - operand_list[i].constant = True - operand_list[i].value = operands[i] - return lowlevelil.LowLevelILExpr(core.BNGetArchitectureFlagWriteLowLevelIL(self.handle, op, size, - self._flag_write_types[write_type], flag, operand_list, len(operand_list), il.handle)) + return self.perform_get_flag_write_low_level_il(op, size, write_type, flag, operands, il) def get_default_flag_write_low_level_il(self, op, size, role, operands, il): """ @@ -1997,13 +1714,14 @@ class Architecture(object): return lowlevelil.LowLevelILExpr(core.BNGetDefaultArchitectureFlagWriteLowLevelIL(self.handle, op, size, role, operand_list, len(operand_list), il.handle)) - def get_flag_condition_low_level_il(self, cond, il): + def get_flag_condition_low_level_il(self, cond, sem_class, il): """ - :param LowLevelILFlagCondition cond: - :param LowLevelILFunction il: + :param LowLevelILFlagCondition cond: Flag condition to be computed + :param str sem_class: Semantic class to be used (None for default semantics) + :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to :rtype: LowLevelILExpr """ - return lowlevelil.LowLevelILExpr(core.BNGetArchitectureFlagConditionLowLevelIL(self.handle, cond, il.handle)) + return self.perform_get_flag_condition_low_level_il(cond, sem_class, il) def get_default_flag_condition_low_level_il(self, cond, sem_class, il): """ @@ -2021,18 +1739,10 @@ class Architecture(object): :param LowLevelILFunction il: :rtype: LowLevelILExpr """ - group_index = self.get_semantic_flag_group_index(sem_group) - return lowlevelil.LowLevelILExpr(core.BNGetArchitectureSemanticFlagGroupLowLevelIL(self.handle, group_index, il.handle)) + return self.perform_get_semantic_flag_group_low_level_il(sem_group, il) def get_flags_required_for_flag_condition(self, cond, sem_class = None): - sem_class = self.get_semantic_flag_class_index(sem_class) - count = ctypes.c_ulonglong() - flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, sem_class, count) - flag_names = [] - for i in xrange(0, count.value): - flag_names.append(self._flags_by_index[flags[i]]) - core.BNFreeRegisterList(flags) - return flag_names + return self.perform_get_flags_required_for_flag_condition(cond, sem_class) def get_modified_regs_on_write(self, reg): """ @@ -2056,6 +1766,14 @@ class Architecture(object): ``assemble`` converts the string of assembly instructions ``code`` loaded at virtual address ``addr`` to the byte representation of those instructions. + .. note:: Architecture subclasses should implement this method. + + Architecture plugins can override this method to provide assembler functionality. This can be done by + simply shelling out to an assembler like yasm or llvm-mc, since this method isn't performance sensitive. + + .. note :: It is important that the assembler used accepts a syntax identical to the one emitted by the \ + disassembler. This will prevent confusing the user. + :param str code: string representation of the instructions to be assembled :param int addr: virtual address that the instructions will be loaded at :return: the bytes for the assembled instructions or error string @@ -2066,16 +1784,14 @@ class Architecture(object): ('\\x0f\\x84\\x04\\x00\\x00\\x00', '') >>> """ - result = databuffer.DataBuffer() - errors = ctypes.c_char_p() - if not core.BNAssemble(self.handle, code, addr, result.handle, errors): - return None, errors.value - return str(result), errors.value + return self.perform_assemble(code, addr) def is_never_branch_patch_available(self, data, addr): """ ``is_never_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be made to **never branch**. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be checked :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise @@ -2088,16 +1804,15 @@ class Architecture(object): False >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - return core.BNIsArchitectureNeverBranchPatchAvailable(self.handle, buf, addr, len(data)) + return self.perform_is_never_branch_patch_available(data, addr) def is_always_branch_patch_available(self, data, addr): """ ``is_always_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be made to **always branch**. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be checked :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise @@ -2110,15 +1825,14 @@ class Architecture(object): False >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - return core.BNIsArchitectureAlwaysBranchPatchAvailable(self.handle, buf, addr, len(data)) + return self.perform_is_always_branch_patch_available(data, addr) def is_invert_branch_patch_available(self, data, addr): """ ``is_always_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be inverted. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be checked :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise @@ -2131,16 +1845,15 @@ class Architecture(object): False >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - return core.BNIsArchitectureInvertBranchPatchAvailable(self.handle, buf, addr, len(data)) + return self.perform_is_invert_branch_patch_available(data, addr) def is_skip_and_return_zero_patch_available(self, data, addr): """ ``is_skip_and_return_zero_patch_available`` determines if the instruction ``data`` at ``addr`` is a *call-like* instruction that can be made into an instruction *returns zero*. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be checked :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise @@ -2155,39 +1868,37 @@ class Architecture(object): False >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - return core.BNIsArchitectureSkipAndReturnZeroPatchAvailable(self.handle, buf, addr, len(data)) + return self.perform_is_skip_and_return_zero_patch_available(data, addr) def is_skip_and_return_value_patch_available(self, data, addr): """ - ``is_skip_and_return_zero_patch_available`` determines if the instruction ``data`` at ``addr`` is a *call-like* + ``is_skip_and_return_value_patch_available`` determines if the instruction ``data`` at ``addr`` is a *call-like* instruction that can be made into an instruction *returns a value*. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be checked :param int addr: the virtual address of the instruction to be patched :return: True if the instruction can be patched, False otherwise :rtype: bool :Example: - >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call 0")[0], 0) + >>> arch.is_skip_and_return_value_patch_available(arch.assemble("call 0")[0], 0) True - >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("jmp eax")[0], 0) + >>> arch.is_skip_and_return_value_patch_available(arch.assemble("jmp eax")[0], 0) False >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - return core.BNIsArchitectureSkipAndReturnValuePatchAvailable(self.handle, buf, addr, len(data)) + return self.perform_is_skip_and_return_value_patch_available(data, addr) def convert_to_nop(self, data, addr): """ ``convert_to_nop`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of nop instructions of the same length as data. - :param str data: bytes for the instruction to be converted + .. note:: Architecture subclasses should implement this method. + + :param str data: bytes for the instruction to be converted :param int addr: the virtual address of the instruction to be patched :return: string containing len(data) worth of no-operation instructions :rtype: str @@ -2197,20 +1908,15 @@ class Architecture(object): '\\x90\\x90' >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - if not core.BNArchitectureConvertToNop(self.handle, buf, addr, len(data)): - return None - result = ctypes.create_string_buffer(len(data)) - ctypes.memmove(result, buf, len(data)) - return result.raw + return self.perform_convert_to_nop(data, addr) def always_branch(self, data, addr): """ ``always_branch`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of bytes of the same length which always branches. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be converted :param int addr: the virtual address of the instruction to be patched :return: string containing len(data) which always branches to the same location as the provided instruction @@ -2224,20 +1930,15 @@ class Architecture(object): (['jmp ', '0x9'], 5L) >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - if not core.BNArchitectureAlwaysBranch(self.handle, buf, addr, len(data)): - return None - result = ctypes.create_string_buffer(len(data)) - ctypes.memmove(result, buf, len(data)) - return result.raw + return self.perform_always_branch(data, addr) def invert_branch(self, data, addr): """ ``invert_branch`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of bytes of the same length which inverts the branch of provided instruction. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be converted :param int addr: the virtual address of the instruction to be patched :return: string containing len(data) which always branches to the same location as the provided instruction @@ -2252,20 +1953,15 @@ class Architecture(object): (['jl ', '0xa'], 6L) >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - if not core.BNArchitectureInvertBranch(self.handle, buf, addr, len(data)): - return None - result = ctypes.create_string_buffer(len(data)) - ctypes.memmove(result, buf, len(data)) - return result.raw + return self.perform_invert_branch(data, addr) def skip_and_return_value(self, data, addr, value): """ ``skip_and_return_value`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of bytes of the same length which doesn't call and instead *return a value*. + .. note:: Architecture subclasses should implement this method. + :param str data: bytes for the instruction to be converted :param int addr: the virtual address of the instruction to be patched :return: string containing len(data) which always branches to the same location as the provided instruction @@ -2276,14 +1972,7 @@ class Architecture(object): (['mov ', 'eax', ', ', '0x0'], 5L) >>> """ - data = str(data) - buf = (ctypes.c_ubyte * len(data))() - ctypes.memmove(buf, data, len(data)) - if not core.BNArchitectureSkipAndReturnValue(self.handle, buf, addr, len(data), value): - return None - result = ctypes.create_string_buffer(len(data)) - ctypes.memmove(result, buf, len(data)) - return result.raw + return self.perform_skip_and_return_value(data, addr, value) def is_view_type_constant_defined(self, type_name, const_name): """ @@ -2348,6 +2037,656 @@ class Architecture(object): core.BNRegisterCallingConvention(self.handle, cc.handle) +class CoreArchitecture(Architecture): + def __init__(self, handle): + super(CoreArchitecture, self).__init__() + + self.handle = core.handle_of_type(handle, core.BNArchitecture) + self.__dict__["name"] = core.BNGetArchitectureName(self.handle) + self.__dict__["endianness"] = Endianness(core.BNGetArchitectureEndianness(self.handle)) + self.__dict__["address_size"] = core.BNGetArchitectureAddressSize(self.handle) + self.__dict__["default_int_size"] = core.BNGetArchitectureDefaultIntegerSize(self.handle) + self.__dict__["instr_alignment"] = core.BNGetArchitectureInstructionAlignment(self.handle) + self.__dict__["max_instr_length"] = core.BNGetArchitectureMaxInstructionLength(self.handle) + self.__dict__["opcode_display_length"] = core.BNGetArchitectureOpcodeDisplayLength(self.handle) + self.__dict__["stack_pointer"] = core.BNGetArchitectureRegisterName(self.handle, + core.BNGetArchitectureStackPointerRegister(self.handle)) + + link_reg = core.BNGetArchitectureLinkRegister(self.handle) + if link_reg == 0xffffffff: + self.__dict__["link_reg"] = None + else: + self.__dict__["link_reg"] = core.BNGetArchitectureRegisterName(self.handle, link_reg) + + count = ctypes.c_ulonglong() + regs = core.BNGetAllArchitectureRegisters(self.handle, count) + self._all_regs = {} + self._regs_by_index = {} + self._full_width_regs = {} + self.__dict__["regs"] = {} + for i in xrange(0, count.value): + name = core.BNGetArchitectureRegisterName(self.handle, regs[i]) + info = core.BNGetArchitectureRegisterInfo(self.handle, regs[i]) + full_width_reg = core.BNGetArchitectureRegisterName(self.handle, info.fullWidthRegister) + self.regs[name] = function.RegisterInfo(full_width_reg, info.size, info.offset, + ImplicitRegisterExtend(info.extend), regs[i]) + self._all_regs[name] = regs[i] + self._regs_by_index[regs[i]] = name + for i in xrange(0, count.value): + info = core.BNGetArchitectureRegisterInfo(self.handle, regs[i]) + full_width_reg = core.BNGetArchitectureRegisterName(self.handle, info.fullWidthRegister) + if full_width_reg not in self._full_width_regs: + self._full_width_regs[full_width_reg] = self._all_regs[full_width_reg] + core.BNFreeRegisterList(regs) + + count = ctypes.c_ulonglong() + flags = core.BNGetAllArchitectureFlags(self.handle, count) + self._flags = {} + self._flags_by_index = {} + self.__dict__["flags"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureFlagName(self.handle, flags[i]) + self._flags[name] = flags[i] + self._flags_by_index[flags[i]] = name + self.flags.append(name) + core.BNFreeRegisterList(flags) + + count = ctypes.c_ulonglong() + write_types = core.BNGetAllArchitectureFlagWriteTypes(self.handle, count) + self._flag_write_types = {} + self._flag_write_types_by_index = {} + self.__dict__["flag_write_types"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureFlagWriteTypeName(self.handle, write_types[i]) + self._flag_write_types[name] = write_types[i] + self._flag_write_types_by_index[write_types[i]] = name + self.flag_write_types.append(name) + core.BNFreeRegisterList(write_types) + + count = ctypes.c_ulonglong() + sem_classes = core.BNGetAllArchitectureSemanticFlagClasses(self.handle, count) + self._semantic_flag_classes = {} + self._semantic_flag_classes_by_index = {} + self.__dict__["semantic_flag_classes"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureSemanticFlagClassName(self.handle, sem_classes[i]) + self._semantic_flag_classes[name] = sem_classes[i] + self._semantic_flag_classes_by_index[sem_classes[i]] = name + self.semantic_flag_classes.append(name) + core.BNFreeRegisterList(sem_classes) + + count = ctypes.c_ulonglong() + sem_groups = core.BNGetAllArchitectureSemanticFlagGroups(self.handle, count) + self._semantic_flag_groups = {} + self._semantic_flag_groups_by_index = {} + self.__dict__["semantic_flag_groups"] = [] + for i in xrange(0, count.value): + name = core.BNGetArchitectureSemanticFlagGroupName(self.handle, sem_groups[i]) + self._semantic_flag_groups[name] = sem_groups[i] + self._semantic_flag_groups_by_index[sem_groups[i]] = name + self.semantic_flag_groups.append(name) + core.BNFreeRegisterList(sem_groups) + + self._flag_roles = {} + self.__dict__["flag_roles"] = {} + for flag in self.__dict__["flags"]: + role = FlagRole(core.BNGetArchitectureFlagRole(self.handle, self._flags[flag], 0)) + self.__dict__["flag_roles"][flag] = role + self._flag_roles[self._flags[flag]] = role + + self.__dict__["flags_required_for_flag_condition"] = {} + for cond in LowLevelILFlagCondition: + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, 0, count) + flag_names = [] + for i in xrange(0, count.value): + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + self.__dict__["flags_required_for_flag_condition"][cond] = flag_names + + self._flags_required_by_semantic_flag_group = {} + self.__dict__["flags_required_for_semantic_flag_group"] = {} + for group in self.semantic_flag_groups: + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsRequiredForSemanticFlagGroup(self.handle, + self._semantic_flag_groups[group], count) + flag_indexes = [] + flag_names = [] + for i in xrange(0, count.value): + flag_indexes.append(flags[i]) + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + self._flags_required_by_semantic_flag_group[self._semantic_flag_groups[group]] = flag_indexes + self.__dict__["flags_required_for_semantic_flag_group"][cond] = flag_names + + self._flag_conditions_for_semantic_flag_group = {} + self.__dict__["flag_conditions_for_semantic_flag_group"] = {} + for group in self.semantic_flag_groups: + count = ctypes.c_ulonglong() + conditions = core.BNGetArchitectureFlagConditionsForSemanticFlagGroup(self.handle, + self._semantic_flag_groups[group], count) + class_index_cond = {} + class_cond = {} + for i in xrange(0, count.value): + class_index_cond[conditions[i].semanticClass] = conditions[i].condition + if conditions[i].semanticClass == 0: + class_cond[None] = conditions[i].condition + elif conditions[i].semanticClass in self._semantic_flag_classes_by_index: + class_cond[self._semantic_flag_classes_by_index[conditions[i].semanticClass]] = conditions[i].condition + core.BNFreeFlagConditionsForSemanticFlagGroup(conditions) + self._flag_conditions_for_semantic_flag_group[self._semantic_flag_groups[group]] = class_index_cond + self.__dict__["flag_conditions_for_semantic_flag_group"][group] = class_cond + + self._flags_written_by_flag_write_type = {} + self.__dict__["flags_written_by_flag_write_type"] = {} + for write_type in self.flag_write_types: + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsWrittenByFlagWriteType(self.handle, + self._flag_write_types[write_type], count) + flag_indexes = [] + flag_names = [] + for i in xrange(0, count.value): + flag_indexes.append(flags[i]) + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + self._flags_written_by_flag_write_type[self._flag_write_types[write_type]] = flag_indexes + self.__dict__["flags_written_by_flag_write_type"][write_type] = flag_names + + self._semantic_class_for_flag_write_type = {} + self.__dict__["semantic_class_for_flag_write_type"] = {} + for write_type in self.flag_write_types: + sem_class = core.BNGetArchitectureSemanticClassForFlagWriteType(self.handle, + self._flag_write_types[write_type]) + if sem_class == 0: + sem_class_name = None + else: + sem_class_name = self._semantic_flag_classes_by_index[sem_class] + self._semantic_class_for_flag_write_type[self._flag_write_types[write_type]] = sem_class + self.__dict__["semantic_class_for_flag_write_type"][write_type] = sem_class_name + + count = ctypes.c_ulonglong() + regs = core.BNGetArchitectureGlobalRegisters(self.handle, count) + self.__dict__["global_regs"] = [] + for i in xrange(0, count.value): + self.global_regs.append(core.BNGetArchitectureRegisterName(self.handle, regs[i])) + core.BNFreeRegisterList(regs) + + count = ctypes.c_ulonglong() + regs = core.BNGetAllArchitectureRegisterStacks(self.handle, count) + self._all_reg_stacks = {} + self._reg_stacks_by_index = {} + self.__dict__["reg_stacks"] = {} + for i in xrange(0, count.value): + name = core.BNGetArchitectureRegisterStackName(self.handle, regs[i]) + info = core.BNGetArchitectureRegisterStackInfo(self.handle, regs[i]) + storage = [] + for j in xrange(0, info.storageCount): + storage.append(core.BNGetArchitectureRegisterName(self.handle, info.firstStorageReg + j)) + top_rel = [] + for j in xrange(0, info.topRelativeCount): + top_rel.append(core.BNGetArchitectureRegisterName(self.handle, info.firstTopRelativeReg + j)) + top = core.BNGetArchitectureRegisterName(self.handle, info.stackTopReg) + self.reg_stacks[name] = function.RegisterStackInfo(storage, top_rel, top, regs[i]) + self._all_reg_stacks[name] = regs[i] + self._reg_stacks_by_index[regs[i]] = name + core.BNFreeRegisterList(regs) + + count = ctypes.c_ulonglong() + intrinsics = core.BNGetAllArchitectureIntrinsics(self.handle, count) + self._intrinsics = {} + self._intrinsics_by_index = {} + self.__dict__["intrinsics"] = {} + for i in xrange(0, count.value): + name = core.BNGetArchitectureIntrinsicName(self.handle, intrinsics[i]) + input_count = ctypes.c_ulonglong() + inputs = core.BNGetArchitectureIntrinsicInputs(self.handle, intrinsics[i], input_count) + input_list = [] + for j in xrange(0, input_count.value): + input_name = inputs[j].name + type_obj = types.Type(core.BNNewTypeReference(inputs[j].type), confidence = inputs[j].typeConfidence) + input_list.append(function.IntrinsicInput(type_obj, input_name)) + core.BNFreeNameAndTypeList(inputs, input_count.value) + output_count = ctypes.c_ulonglong() + outputs = core.BNGetArchitectureIntrinsicOutputs(self.handle, intrinsics[i], output_count) + output_list = [] + for j in xrange(0, output_count.value): + output_list.append(types.Type(core.BNNewTypeReference(outputs[j].type), confidence = outputs[j].confidence)) + core.BNFreeOutputTypeList(outputs, output_count.value) + self.intrinsics[name] = function.IntrinsicInfo(input_list, output_list) + self._intrinsics[name] = intrinsics[i] + self._intrinsics_by_index[intrinsics[i]] = (name, self.intrinsics[name]) + core.BNFreeRegisterList(intrinsics) + + def get_associated_arch_by_address(self, addr): + new_addr = ctypes.c_ulonglong() + new_addr.value = addr + result = core.BNGetAssociatedArchitectureByAddress(self.handle, new_addr) + return CoreArchitecture(handle = result), new_addr.value + + def get_instruction_info(self, data, addr): + """ + ``get_instruction_info`` returns an InstructionInfo object for the instruction at the given virtual address + ``addr`` with data ``data``. + + .. note :: The instruction info object should always set the InstructionInfo.length to the instruction length, \ + and the branches of the proper types shoulde be added if the instruction is a branch. + + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` + :param int addr: virtual address of bytes in ``data`` + :return: the InstructionInfo for the current instruction + :rtype: InstructionInfo + """ + info = core.BNInstructionInfo() + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + if not core.BNGetInstructionInfo(self.handle, buf, addr, len(data), info): + return None + result = function.InstructionInfo() + result.length = info.length + result.arch_transition_by_target_addr = info.archTransitionByTargetAddr + result.branch_delay = info.branchDelay + for i in xrange(0, info.branchCount): + target = info.branchTarget[i] + if info.branchArch[i]: + arch = CoreArchitecture(info.branchArch[i]) + else: + arch = None + result.add_branch(BranchType(info.branchType[i]), target, arch) + return result + + def get_instruction_text(self, data, addr): + """ + ``get_instruction_text`` returns a list of InstructionTextToken objects for the instruction at the given virtual + address ``addr`` with data ``data``. + + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` + :param int addr: virtual address of bytes in ``data`` + :return: an InstructionTextToken list for the current instruction + :rtype: list(InstructionTextToken) + """ + data = str(data) + count = ctypes.c_ulonglong() + length = ctypes.c_ulonglong() + length.value = len(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + tokens = ctypes.POINTER(core.BNInstructionTextToken)() + if not core.BNGetInstructionText(self.handle, buf, addr, length, tokens, count): + return None, 0 + result = [] + for i in xrange(0, count.value): + token_type = InstructionTextTokenType(tokens[i].type) + text = tokens[i].text + value = tokens[i].value + size = tokens[i].size + operand = tokens[i].operand + context = tokens[i].context + confidence = tokens[i].confidence + address = tokens[i].address + result.append(function.InstructionTextToken(token_type, text, value, size, operand, context, address, confidence)) + core.BNFreeInstructionText(tokens, count.value) + return result, length.value + + def get_instruction_low_level_il(self, data, addr, il): + """ + ``get_instruction_low_level_il`` appends LowLevelILExpr objects to ``il`` for the instruction at the given + virtual address ``addr`` with data ``data``. + + This is used to analyze arbitrary data at an address, if you are working with an existing binary, you likely + want to be using ``Function.get_low_level_il_at``. + + :param str data: max_instruction_length bytes from the binary at virtual address ``addr`` + :param int addr: virtual address of bytes in ``data`` + :param LowLevelILFunction il: The function the current instruction belongs to + :return: the length of the current instruction + :rtype: int + """ + data = str(data) + length = ctypes.c_ulonglong() + length.value = len(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + core.BNGetInstructionLowLevelIL(self.handle, buf, addr, length, il.handle) + return length.value + + def get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): + """ + :param LowLevelILOperation op: + :param int size: + :param str write_type: + :param list(str or int) operands: a list of either items that are either string register names or constant \ + integer values + :param LowLevelILFunction il: + :rtype: LowLevelILExpr + """ + flag = self.get_flag_index(flag) + operand_list = (core.BNRegisterOrConstant * len(operands))() + for i in xrange(len(operands)): + if isinstance(operands[i], str): + operand_list[i].constant = False + operand_list[i].reg = self.regs[operands[i]].index + elif isinstance(operands[i], lowlevelil.ILRegister): + operand_list[i].constant = False + operand_list[i].reg = operands[i].index + else: + operand_list[i].constant = True + operand_list[i].value = operands[i] + return lowlevelil.LowLevelILExpr(core.BNGetArchitectureFlagWriteLowLevelIL(self.handle, op, size, + self._flag_write_types[write_type], flag, operand_list, len(operand_list), il.handle)) + + def get_flag_condition_low_level_il(self, cond, sem_class, il): + """ + :param LowLevelILFlagCondition cond: Flag condition to be computed + :param str sem_class: Semantic class to be used (None for default semantics) + :param LowLevelILFunction il: LowLevelILFunction object to append LowLevelILExpr objects to + :rtype: LowLevelILExpr + """ + class_index = self.get_semantic_flag_class_index(sem_class) + return lowlevelil.LowLevelILExpr(core.BNGetArchitectureFlagConditionLowLevelIL(self.handle, cond, + class_index, il.handle)) + + def get_semantic_flag_group_low_level_il(self, sem_group, il): + """ + :param str sem_group: + :param LowLevelILFunction il: + :rtype: LowLevelILExpr + """ + group_index = self.get_semantic_flag_group_index(sem_group) + return lowlevelil.LowLevelILExpr(core.BNGetArchitectureSemanticFlagGroupLowLevelIL(self.handle, group_index, il.handle)) + + def assemble(self, code, addr=0): + """ + ``assemble`` converts the string of assembly instructions ``code`` loaded at virtual address ``addr`` to the + byte representation of those instructions. + + :param str code: string representation of the instructions to be assembled + :param int addr: virtual address that the instructions will be loaded at + :return: the bytes for the assembled instructions or error string + :rtype: (a tuple of instructions and empty string) or (or None and error string) + :Example: + + >>> arch.assemble("je 10") + ('\\x0f\\x84\\x04\\x00\\x00\\x00', '') + >>> + """ + result = databuffer.DataBuffer() + errors = ctypes.c_char_p() + if not core.BNAssemble(self.handle, code, addr, result.handle, errors): + return None, errors.value + return str(result), errors.value + + def is_never_branch_patch_available(self, data, addr): + """ + ``is_never_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be made to **never branch**. + + :param str data: bytes for the instruction to be checked + :param int addr: the virtual address of the instruction to be patched + :return: True if the instruction can be patched, False otherwise + :rtype: bool + :Example: + + >>> arch.is_never_branch_patch_available(arch.assemble("je 10")[0], 0) + True + >>> arch.is_never_branch_patch_available(arch.assemble("nop")[0], 0) + False + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + return core.BNIsArchitectureNeverBranchPatchAvailable(self.handle, buf, addr, len(data)) + + def is_always_branch_patch_available(self, data, addr): + """ + ``is_always_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be made to + **always branch**. + + :param str data: bytes for the instruction to be checked + :param int addr: the virtual address of the instruction to be patched + :return: True if the instruction can be patched, False otherwise + :rtype: bool + :Example: + + >>> arch.is_always_branch_patch_available(arch.assemble("je 10")[0], 0) + True + >>> arch.is_always_branch_patch_available(arch.assemble("nop")[0], 0) + False + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + return core.BNIsArchitectureAlwaysBranchPatchAvailable(self.handle, buf, addr, len(data)) + + def is_invert_branch_patch_available(self, data, addr): + """ + ``is_always_branch_patch_available`` determines if the instruction ``data`` at ``addr`` can be inverted. + + :param str data: bytes for the instruction to be checked + :param int addr: the virtual address of the instruction to be patched + :return: True if the instruction can be patched, False otherwise + :rtype: bool + :Example: + + >>> arch.is_invert_branch_patch_available(arch.assemble("je 10")[0], 0) + True + >>> arch.is_invert_branch_patch_available(arch.assemble("nop")[0], 0) + False + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + return core.BNIsArchitectureInvertBranchPatchAvailable(self.handle, buf, addr, len(data)) + + def is_skip_and_return_zero_patch_available(self, data, addr): + """ + ``is_skip_and_return_zero_patch_available`` determines if the instruction ``data`` at ``addr`` is a *call-like* + instruction that can be made into an instruction *returns zero*. + + :param str data: bytes for the instruction to be checked + :param int addr: the virtual address of the instruction to be patched + :return: True if the instruction can be patched, False otherwise + :rtype: bool + :Example: + + >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call 0")[0], 0) + True + >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("call eax")[0], 0) + True + >>> arch.is_skip_and_return_zero_patch_available(arch.assemble("jmp eax")[0], 0) + False + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + return core.BNIsArchitectureSkipAndReturnZeroPatchAvailable(self.handle, buf, addr, len(data)) + + def is_skip_and_return_value_patch_available(self, data, addr): + """ + ``is_skip_and_return_value_patch_available`` determines if the instruction ``data`` at ``addr`` is a *call-like* + instruction that can be made into an instruction *returns a value*. + + :param str data: bytes for the instruction to be checked + :param int addr: the virtual address of the instruction to be patched + :return: True if the instruction can be patched, False otherwise + :rtype: bool + :Example: + + >>> arch.is_skip_and_return_value_patch_available(arch.assemble("call 0")[0], 0) + True + >>> arch.is_skip_and_return_value_patch_available(arch.assemble("jmp eax")[0], 0) + False + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + return core.BNIsArchitectureSkipAndReturnValuePatchAvailable(self.handle, buf, addr, len(data)) + + def convert_to_nop(self, data, addr): + """ + ``convert_to_nop`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of nop + instructions of the same length as data. + + :param str data: bytes for the instruction to be converted + :param int addr: the virtual address of the instruction to be patched + :return: string containing len(data) worth of no-operation instructions + :rtype: str + :Example: + + >>> arch.convert_to_nop("\\x00\\x00", 0) + '\\x90\\x90' + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + if not core.BNArchitectureConvertToNop(self.handle, buf, addr, len(data)): + return None + result = ctypes.create_string_buffer(len(data)) + ctypes.memmove(result, buf, len(data)) + return result.raw + + def always_branch(self, data, addr): + """ + ``always_branch`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of bytes + of the same length which always branches. + + :param str data: bytes for the instruction to be converted + :param int addr: the virtual address of the instruction to be patched + :return: string containing len(data) which always branches to the same location as the provided instruction + :rtype: str + :Example: + + >>> bytes = arch.always_branch(arch.assemble("je 10")[0], 0) + >>> arch.get_instruction_text(bytes, 0) + (['nop '], 1L) + >>> arch.get_instruction_text(bytes[1:], 0) + (['jmp ', '0x9'], 5L) + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + if not core.BNArchitectureAlwaysBranch(self.handle, buf, addr, len(data)): + return None + result = ctypes.create_string_buffer(len(data)) + ctypes.memmove(result, buf, len(data)) + return result.raw + + def invert_branch(self, data, addr): + """ + ``invert_branch`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of bytes + of the same length which inverts the branch of provided instruction. + + :param str data: bytes for the instruction to be converted + :param int addr: the virtual address of the instruction to be patched + :return: string containing len(data) which always branches to the same location as the provided instruction + :rtype: str + :Example: + + >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("je 10")[0], 0), 0) + (['jne ', '0xa'], 6L) + >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jo 10")[0], 0), 0) + (['jno ', '0xa'], 6L) + >>> arch.get_instruction_text(arch.invert_branch(arch.assemble("jge 10")[0], 0), 0) + (['jl ', '0xa'], 6L) + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + if not core.BNArchitectureInvertBranch(self.handle, buf, addr, len(data)): + return None + result = ctypes.create_string_buffer(len(data)) + ctypes.memmove(result, buf, len(data)) + return result.raw + + def skip_and_return_value(self, data, addr, value): + """ + ``skip_and_return_value`` reads the instruction(s) in ``data`` at virtual address ``addr`` and returns a string of + bytes of the same length which doesn't call and instead *return a value*. + + :param str data: bytes for the instruction to be converted + :param int addr: the virtual address of the instruction to be patched + :return: string containing len(data) which always branches to the same location as the provided instruction + :rtype: str + :Example: + + >>> arch.get_instruction_text(arch.skip_and_return_value(arch.assemble("call 10")[0], 0, 0), 0) + (['mov ', 'eax', ', ', '0x0'], 5L) + >>> + """ + data = str(data) + buf = (ctypes.c_ubyte * len(data))() + ctypes.memmove(buf, data, len(data)) + if not core.BNArchitectureSkipAndReturnValue(self.handle, buf, addr, len(data), value): + return None + result = ctypes.create_string_buffer(len(data)) + ctypes.memmove(result, buf, len(data)) + return result.raw + + def get_flag_role(self, flag, sem_class = None): + """ + ``get_flag_role`` gets the role of a given flag. + + :param int flag: flag + :param int sem_class: optional semantic flag class + :return: flag role + :rtype: FlagRole + """ + flag = self.get_flag_index(flag) + sem_class = self.get_semantic_flag_class_index(sem_class) + return FlagRole(core.BNGetArchitectureFlagRole(self.handle, flag, sem_class)) + + def get_flags_required_for_flag_condition(self, cond, sem_class = None): + sem_class = self.get_semantic_flag_class_index(sem_class) + count = ctypes.c_ulonglong() + flags = core.BNGetArchitectureFlagsRequiredForFlagCondition(self.handle, cond, sem_class, count) + flag_names = [] + for i in xrange(0, count.value): + flag_names.append(self._flags_by_index[flags[i]]) + core.BNFreeRegisterList(flags) + return flag_names + + +class ArchitectureHook(CoreArchitecture): + def __init__(self, base_arch): + self.base_arch = base_arch + super(ArchitectureHook, self).__init__(base_arch.handle) + + # To improve performance of simpler hooks, use null callback for functions that are not being overridden + if self.get_associated_arch_by_address.__code__ == CoreArchitecture.get_associated_arch_by_address.__code__: + self._cb.getAssociatedArchitectureByAddress = self._cb.getAssociatedArchitectureByAddress.__class__() + if self.get_instruction_info.__code__ == CoreArchitecture.get_instruction_info.__code__: + self._cb.getInstructionInfo = self._cb.getInstructionInfo.__class__() + if self.get_instruction_text.__code__ == CoreArchitecture.get_instruction_text.__code__: + self._cb.getInstructionText = self._cb.getInstructionText.__class__() + if self.__class__.stack_pointer is None: + self._cb.getStackPointerRegister = self._cb.getStackPointerRegister.__class__() + if self.__class__.link_reg is None: + self._cb.getLinkRegister = self._cb.getLinkRegister.__class__() + if len(self.__class__.regs) == 0: + self._cb.getRegisterInfo = self._cb.getRegisterInfo.__class__() + self._cb.getRegisterName = self._cb.getRegisterName.__class__() + if len(self.__class__.reg_stacks) == 0: + self._cb.getRegisterStackName = self._cb.getRegisterStackName.__class__() + self._cb.getRegisterStackInfo = self._cb.getRegisterStackInfo.__class__() + if len(self.__class__.intrinsics) == 0: + self._cb.getIntrinsicName = self._cb.getIntrinsicName.__class__() + self._cb.getIntrinsicInputs = self._cb.getIntrinsicInputs.__class__() + self._cb.freeNameAndTypeList = self._cb.freeNameAndTypeList.__class__() + self._cb.getIntrinsicOutputs = self._cb.getIntrinsicOutputs.__class__() + self._cb.freeTypeList = self._cb.freeTypeList.__class__() + + def register(self): + self.__class__._registered_cb = self._cb + self.handle = core.BNRegisterArchitectureHook(self.base_arch.handle, self._cb) + + class ReferenceSource(object): def __init__(self, func, arch, addr): self.function = func diff --git a/python/basicblock.py b/python/basicblock.py index 8e64c1c1..c93d0b2c 100644 --- a/python/basicblock.py +++ b/python/basicblock.py @@ -100,7 +100,7 @@ class BasicBlock(object): arch = core.BNGetBasicBlockArchitecture(self.handle) if arch is None: return None - self._arch = architecture.Architecture(arch) + self._arch = architecture.CoreArchitecture(arch) return self._arch @property diff --git a/python/binaryview.py b/python/binaryview.py index fae98c14..7a6bc875 100644 --- a/python/binaryview.py +++ b/python/binaryview.py @@ -400,7 +400,7 @@ class BinaryViewType(object): arch = core.BNGetArchitectureForViewType(self.handle, ident, endian) if arch is None: return None - return architecture.Architecture(arch) + return architecture.CoreArchitecture(arch) def register_platform(self, ident, arch, plat): core.BNRegisterPlatformForViewType(self.handle, ident, arch.handle, plat.handle) @@ -812,7 +812,7 @@ class BinaryView(object): arch = core.BNGetDefaultArchitecture(self.handle) if arch is None: return None - return architecture.Architecture(handle=arch) + return architecture.CoreArchitecture(handle=arch) @arch.setter def arch(self, value): @@ -2191,7 +2191,7 @@ class BinaryView(object): else: func = None if refs[i].arch: - arch = architecture.Architecture(refs[i].arch) + arch = architecture.CoreArchitecture(refs[i].arch) else: arch = None addr = refs[i].addr diff --git a/python/callingconvention.py b/python/callingconvention.py index 5aad3317..49ef7666 100644 --- a/python/callingconvention.py +++ b/python/callingconvention.py @@ -75,7 +75,7 @@ class CallingConvention(object): self.__class__._registered_calling_conventions.append(self) else: self.handle = handle - self.arch = architecture.Architecture(core.BNGetCallingConventionArchitecture(self.handle)) + self.arch = architecture.CoreArchitecture(core.BNGetCallingConventionArchitecture(self.handle)) self.__dict__["name"] = core.BNGetCallingConventionName(self.handle) self.__dict__["arg_regs_share_index"] = core.BNAreArgumentRegistersSharedIndex(self.handle) self.__dict__["stack_reserved_for_arg_regs"] = core.BNIsStackReservedForArgumentRegisters(self.handle) diff --git a/python/examples/arch_hook.py b/python/examples/arch_hook.py new file mode 100644 index 00000000..452bd2b6 --- /dev/null +++ b/python/examples/arch_hook.py @@ -0,0 +1,16 @@ +from binaryninja.architecture import Architecture, ArchitectureHook + +class X86ReturnHook(ArchitectureHook): + def get_instruction_text(self, data, addr): + # Call the original implementation's method by calling the superclass + result, length = super(X86ReturnHook, self).get_instruction_text(data, addr) + + # Patch the name of the 'retn' instruction to 'ret' + if len(result) > 0 and result[0].text == 'retn': + result[0].text = 'ret' + + return result, length + +# Install the hook by constructing it with the desired architecture to hook, then registering it +X86ReturnHook(Architecture['x86']).register() + diff --git a/python/examples/nes.py b/python/examples/nes.py index 39544c9f..00451abd 100644 --- a/python/examples/nes.py +++ b/python/examples/nes.py @@ -423,7 +423,7 @@ class M6502(Architecture): return instr, operand, length, value - def perform_get_instruction_info(self, data, addr): + def get_instruction_info(self, data, addr): instr, operand, length, value = self.decode_instruction(data, addr) if instr is None: return None @@ -445,7 +445,7 @@ class M6502(Architecture): result.add_branch(BranchType.FalseBranch, addr + 2) return result - def perform_get_instruction_text(self, data, addr): + def get_instruction_text(self, data, addr): instr, operand, length, value = self.decode_instruction(data, addr) if instr is None: return None @@ -455,7 +455,7 @@ class M6502(Architecture): tokens += OperandTokens[operand](value) return tokens, length - def perform_get_instruction_low_level_il(self, data, addr, il): + def get_instruction_low_level_il(self, data, addr, il): instr, operand, length, value = self.decode_instruction(data, addr) if instr is None: return None @@ -470,48 +470,48 @@ class M6502(Architecture): return length - def perform_get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): + def get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il): if flag == 'c': if (op == LowLevelILOperation.LLIL_SUB) or (op == LowLevelILOperation.LLIL_SBB): # Subtraction carry flag is inverted from the commom implementation return il.not_expr(0, self.get_default_flag_write_low_level_il(op, size, FlagRole.CarryFlagRole, operands, il)) # Other operations use a normal carry flag return self.get_default_flag_write_low_level_il(op, size, FlagRole.CarryFlagRole, operands, il) - return Architecture.perform_get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il) + return Architecture.get_flag_write_low_level_il(self, op, size, write_type, flag, operands, il) - def perform_is_never_branch_patch_available(self, data, addr): + def is_never_branch_patch_available(self, data, addr): if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"): return True return False - def perform_is_invert_branch_patch_available(self, data, addr): + def is_invert_branch_patch_available(self, data, addr): if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"): return True return False - def perform_is_always_branch_patch_available(self, data, addr): + def is_always_branch_patch_available(self, data, addr): return False - def perform_is_skip_and_return_zero_patch_available(self, data, addr): + def is_skip_and_return_zero_patch_available(self, data, addr): return (data[0] == "\x20") and (len(data) == 3) - def perform_is_skip_and_return_value_patch_available(self, data, addr): + def is_skip_and_return_value_patch_available(self, data, addr): return (data[0] == "\x20") and (len(data) == 3) - def perform_convert_to_nop(self, data, addr): + def convert_to_nop(self, data, addr): return "\xea" * len(data) - def perform_never_branch(self, data, addr): + def never_branch(self, data, addr): if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"): return "\xea" * len(data) return None - def perform_invert_branch(self, data, addr): + def invert_branch(self, data, addr): if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"): return chr(ord(data[0]) ^ 0x20) + data[1:] return None - def perform_skip_and_return_value(self, data, addr, value): + def skip_and_return_value(self, data, addr, value): if (data[0] != "\x20") or (len(data) != 3): return None return "\xa9" + chr(value & 0xff) + "\xea" diff --git a/python/function.py b/python/function.py index 39ace7c6..f68aa76f 100644 --- a/python/function.py +++ b/python/function.py @@ -419,7 +419,7 @@ class Function(object): arch = core.BNGetFunctionArchitecture(self.handle) if arch is None: return None - self._arch = architecture.Architecture(arch) + self._arch = architecture.CoreArchitecture(arch) return self._arch @property @@ -557,7 +557,7 @@ class Function(object): branches = core.BNGetIndirectBranches(self.handle, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.Architecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result @@ -1115,7 +1115,7 @@ class Function(object): branches = core.BNGetIndirectBranchesAt(self.handle, arch.handle, addr, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.Architecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result @@ -1633,7 +1633,7 @@ class FunctionGraphBlock(object): arch = core.BNGetFunctionGraphBlockArchitecture(self.handle) if arch is None: return None - return architecture.Architecture(arch) + return architecture.CoreArchitecture(arch) @property def start(self): diff --git a/python/platform.py b/python/platform.py index 5e63d836..09670bac 100644 --- a/python/platform.py +++ b/python/platform.py @@ -105,7 +105,7 @@ class Platform(object): else: self.handle = handle self.__dict__["name"] = core.BNGetPlatformName(self.handle) - self.arch = architecture.Architecture(core.BNGetPlatformArchitecture(self.handle)) + self.arch = architecture.CoreArchitecture(core.BNGetPlatformArchitecture(self.handle)) def __del__(self): core.BNFreePlatform(self.handle) -- cgit v1.3.1 From 1855cf3c1d58f3db233ced1817676a50479aeca2 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 27 Feb 2018 19:44:03 -0500 Subject: Fix lifted IL access from Python --- python/lowlevelil.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/python/lowlevelil.py b/python/lowlevelil.py index bf7d6d46..ab6170a5 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -264,7 +264,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_NORET: [], LowLevelILOperation.LLIL_IF: [("condition", "expr"), ("true", "int"), ("false", "int")], LowLevelILOperation.LLIL_GOTO: [("dest", "int")], - LowLevelILOperation.LLIL_FLAG_COND: [("condition", "cond", "semantic_class", "sem_class")], + LowLevelILOperation.LLIL_FLAG_COND: [("condition", "cond"), ("semantic_class", "sem_class")], LowLevelILOperation.LLIL_FLAG_GROUP: [("semantic_group", "sem_group")], LowLevelILOperation.LLIL_CMP_E: [("left", "expr"), ("right", "expr")], LowLevelILOperation.LLIL_CMP_NE: [("left", "expr"), ("right", "expr")], @@ -399,7 +399,10 @@ class LowLevelILInstruction(object): i += 1 value = SSAFlag(flag, instr.operands[i]) elif operand_type == "sem_class": - value = ILSemanticFlagClass(func.arch, instr.operands[i]) + if instr.operands[i] == 0: + value = None + else: + value = ILSemanticFlagClass(func.arch, instr.operands[i]) elif operand_type == "sem_group": value = ILSemanticFlagGroup(func.arch, instr.operands[i]) elif operand_type == "cond": -- cgit v1.3.1 From 0539a9ebe89a64dda7ab5bce3caa7eb8682d98a5 Mon Sep 17 00:00:00 2001 From: Jordan Date: Tue, 6 Mar 2018 16:20:13 -0500 Subject: add backward forward navigation hotkeys to documentation --- docs/getting-started.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/getting-started.md b/docs/getting-started.md index e34121c1..922a7b7f 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -85,6 +85,10 @@ Switching views happens multiple ways. In some instances, it's automatic (clicki - `h` : Switch to hex view - `p` : Create a function - `[ESC]` : Navigate backward + - `[CMD] [` (OS X) : Navigate backward + - `[CMD] ]` (OS X) : Navigate forward + - `[CTRL] [` (Windows/Linux) : Navigate backward + - `[CTRL] ]` (Windows/Linux) : Navigate forward - `[SPACE]` : Toggle between linear view and graph view - `g` : Go To Address dialog - `n` : Name a symbol -- cgit v1.3.1 From 352949f41ea0b66c833f272d2a2a1e5a77a9507c Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 6 Mar 2018 19:33:00 -0500 Subject: Automatically update analysis after commands in interactive Python --- python/scriptingprovider.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/python/scriptingprovider.py b/python/scriptingprovider.py index c92c249a..e7838748 100644 --- a/python/scriptingprovider.py +++ b/python/scriptingprovider.py @@ -540,7 +540,7 @@ class PythonScriptingInstance(ScriptingInstance): self.locals["current_address"] = self.active_addr self.locals["here"] = self.active_addr self.locals["current_selection"] = (self.active_selection_begin, self.active_selection_end) - if self.active_func == None: + if self.active_func is None: self.locals["current_llil"] = None self.locals["current_mlil"] = None else: @@ -556,6 +556,8 @@ class PythonScriptingInstance(ScriptingInstance): elif self.locals["current_address"] != self.active_addr: if not self.active_view.file.navigate(self.active_view.file.view, self.locals["current_address"]): sys.stderr.write("Address 0x%x is not valid for the current view\n" % self.locals["current_address"]) + if self.active_view is not None: + self.active_view.update_analysis() except: traceback.print_exc() finally: -- cgit v1.3.1 From 1c7349fcf125994f2e577361626fe1fb02eac029 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 7 Mar 2018 18:10:55 -0500 Subject: Add APIs for skipping analysis of functions that are too large, and overriding this behavior --- binaryninjaapi.h | 11 +++++++++++ binaryninjacore.h | 17 +++++++++++++++++ binaryview.cpp | 23 +++++++++++++++++++++++ function.cpp | 24 ++++++++++++++++++++++++ functiongraph.cpp | 6 ++++++ python/binaryview.py | 19 +++++++++++++++++++ python/function.py | 34 +++++++++++++++++++++++++++++++++- 7 files changed, 133 insertions(+), 1 deletion(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 89eba009..2d7e2ccf 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -866,6 +866,7 @@ namespace BinaryNinja static void FunctionAddedCallback(void* ctxt, BNBinaryView* data, BNFunction* func); static void FunctionRemovedCallback(void* ctxt, BNBinaryView* data, BNFunction* func); static void FunctionUpdatedCallback(void* ctxt, BNBinaryView* data, BNFunction* func); + static void FunctionUpdateRequestedCallback(void* ctxt, BNBinaryView* data, BNFunction* func); static void DataVariableAddedCallback(void* ctxt, BNBinaryView* data, BNDataVariable* var); static void DataVariableRemovedCallback(void* ctxt, BNBinaryView* data, BNDataVariable* var); static void DataVariableUpdatedCallback(void* ctxt, BNBinaryView* data, BNDataVariable* var); @@ -886,6 +887,7 @@ namespace BinaryNinja virtual void OnAnalysisFunctionAdded(BinaryView* view, Function* func) { (void)view; (void)func; } virtual void OnAnalysisFunctionRemoved(BinaryView* view, Function* func) { (void)view; (void)func; } virtual void OnAnalysisFunctionUpdated(BinaryView* view, Function* func) { (void)view; (void)func; } + virtual void OnAnalysisFunctionUpdateRequested(BinaryView* view, Function* func) { (void)view; (void)func; } virtual void OnDataVariableAdded(BinaryView* view, const DataVariable& var) { (void)view; (void)var; } virtual void OnDataVariableRemoved(BinaryView* view, const DataVariable& var) { (void)view; (void)var; } virtual void OnDataVariableUpdated(BinaryView* view, const DataVariable& var) { (void)view; (void)var; } @@ -1344,6 +1346,9 @@ namespace BinaryNinja std::string GetStringMetadata(const std::string& key); std::vector GetRawMetadata(const std::string& key); uint64_t GetUIntMetadata(const std::string& key); + + uint64_t GetMaxFunctionSizeForAnalysis(); + void SetMaxFunctionSizeForAnalysis(uint64_t size); }; class BinaryData: public BinaryView @@ -2475,6 +2480,11 @@ namespace BinaryNinja Confidence GetGlobalPointerValue() const; Confidence GetRegisterValueAtExit(uint32_t reg) const; + + bool IsFunctionTooLarge(); + bool IsAnalysisSkipped(); + BNFunctionAnalysisSkipOverride GetAnalysisSkipOverride(); + void SetAnalysisSkipOverride(BNFunctionAnalysisSkipOverride skip); }; class AdvancedFunctionAnalysisDataRequestor @@ -2550,6 +2560,7 @@ namespace BinaryNinja void Abort(); std::vector> GetBlocks(); + bool HasBlocks() const; int GetWidth() const; int GetHeight() const; diff --git a/binaryninjacore.h b/binaryninjacore.h index 5329a1d9..a1b78b1c 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -989,6 +989,7 @@ extern "C" void (*functionAdded)(void* ctxt, BNBinaryView* view, BNFunction* func); void (*functionRemoved)(void* ctxt, BNBinaryView* view, BNFunction* func); void (*functionUpdated)(void* ctxt, BNBinaryView* view, BNFunction* func); + void (*functionUpdateRequested)(void* ctxt, BNBinaryView* view, BNFunction* func); void (*dataVariableAdded)(void* ctxt, BNBinaryView* view, BNDataVariable* var); void (*dataVariableRemoved)(void* ctxt, BNBinaryView* view, BNDataVariable* var); void (*dataVariableUpdated)(void* ctxt, BNBinaryView* view, BNDataVariable* var); @@ -1739,6 +1740,13 @@ extern "C" uint8_t confidence; }; + enum BNFunctionAnalysisSkipOverride + { + DefaultFunctionAnalysisSkip, + NeverSkipFunctionAnalysis, + AlwaysSkipFunctionAnalysis + }; + BINARYNINJACOREAPI char* BNAllocString(const char* contents); BINARYNINJACOREAPI void BNFreeString(char* str); BINARYNINJACOREAPI char** BNAllocStringList(const char** contents, size_t size); @@ -2421,6 +2429,14 @@ extern "C" BINARYNINJACOREAPI void BNSetIntegerConstantDisplayType(BNFunction* func, BNArchitecture* arch, uint64_t instrAddr, uint64_t value, size_t operand, BNIntegerDisplayType type); + BINARYNINJACOREAPI bool BNIsFunctionTooLarge(BNFunction* func); + BINARYNINJACOREAPI bool BNIsFunctionAnalysisSkipped(BNFunction* func); + BINARYNINJACOREAPI BNFunctionAnalysisSkipOverride BNGetFunctionAnalysisSkipOverride(BNFunction* func); + BINARYNINJACOREAPI void BNSetFunctionAnalysisSkipOverride(BNFunction* func, BNFunctionAnalysisSkipOverride skip); + + BINARYNINJACOREAPI uint64_t BNGetMaxFunctionSizeForAnalysis(BNBinaryView* view); + BINARYNINJACOREAPI void BNSetMaxFunctionSizeForAnalysis(BNBinaryView* view, uint64_t size); + BINARYNINJACOREAPI BNAnalysisCompletionEvent* BNAddAnalysisCompletionEvent(BNBinaryView* view, void* ctxt, void (*callback)(void* ctxt)); BINARYNINJACOREAPI BNAnalysisCompletionEvent* BNNewAnalysisCompletionEventReference(BNAnalysisCompletionEvent* event); @@ -2536,6 +2552,7 @@ extern "C" BINARYNINJACOREAPI BNFunctionGraphBlock** BNGetFunctionGraphBlocksInRegion( BNFunctionGraph* graph, int left, int top, int right, int bottom, size_t* count); BINARYNINJACOREAPI void BNFreeFunctionGraphBlockList(BNFunctionGraphBlock** blocks, size_t count); + BINARYNINJACOREAPI bool BNFunctionGraphHasBlocks(BNFunctionGraph* graph); BINARYNINJACOREAPI int BNGetFunctionGraphWidth(BNFunctionGraph* graph); BINARYNINJACOREAPI int BNGetFunctionGraphHeight(BNFunctionGraph* graph); diff --git a/binaryview.cpp b/binaryview.cpp index 96fd161d..0dcf6bc3 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -78,6 +78,15 @@ void BinaryDataNotification::FunctionUpdatedCallback(void* ctxt, BNBinaryView* o } +void BinaryDataNotification::FunctionUpdateRequestedCallback(void* ctxt, BNBinaryView* object, BNFunction* func) +{ + BinaryDataNotification* notify = (BinaryDataNotification*)ctxt; + Ref view = new BinaryView(BNNewViewReference(object)); + Ref funcObj = new Function(BNNewFunctionReference(func)); + notify->OnAnalysisFunctionUpdateRequested(view, funcObj); +} + + void BinaryDataNotification::DataVariableAddedCallback(void* ctxt, BNBinaryView* object, BNDataVariable* var) { BinaryDataNotification* notify = (BinaryDataNotification*)ctxt; @@ -148,6 +157,7 @@ BinaryDataNotification::BinaryDataNotification() m_callbacks.functionAdded = FunctionAddedCallback; m_callbacks.functionRemoved = FunctionRemovedCallback; m_callbacks.functionUpdated = FunctionUpdatedCallback; + m_callbacks.functionUpdateRequested = FunctionUpdateRequestedCallback; m_callbacks.dataVariableAdded = DataVariableAddedCallback; m_callbacks.dataVariableRemoved = DataVariableRemovedCallback; m_callbacks.dataVariableUpdated = DataVariableUpdatedCallback; @@ -1949,6 +1959,19 @@ uint64_t BinaryView::GetUIntMetadata(const string& key) return data->GetUnsignedInteger(); } + +uint64_t BinaryView::GetMaxFunctionSizeForAnalysis() +{ + return BNGetMaxFunctionSizeForAnalysis(m_object); +} + + +void BinaryView::SetMaxFunctionSizeForAnalysis(uint64_t size) +{ + BNSetMaxFunctionSizeForAnalysis(m_object, size); +} + + BinaryData::BinaryData(FileMetadata* file): BinaryView(BNCreateBinaryDataView(file->GetObject())) { } diff --git a/function.cpp b/function.cpp index ab5f0ea3..1e91f8f3 100644 --- a/function.cpp +++ b/function.cpp @@ -1359,6 +1359,30 @@ vector Function::GetTypeTokens(DisassemblySettings* setting } +bool Function::IsFunctionTooLarge() +{ + return BNIsFunctionTooLarge(m_object); +} + + +bool Function::IsAnalysisSkipped() +{ + return BNIsFunctionAnalysisSkipped(m_object); +} + + +BNFunctionAnalysisSkipOverride Function::GetAnalysisSkipOverride() +{ + return BNGetFunctionAnalysisSkipOverride(m_object); +} + + +void Function::SetAnalysisSkipOverride(BNFunctionAnalysisSkipOverride skip) +{ + BNSetFunctionAnalysisSkipOverride(m_object, skip); +} + + AdvancedFunctionAnalysisDataRequestor::AdvancedFunctionAnalysisDataRequestor(Function* func): m_func(func) { if (m_func) diff --git a/functiongraph.cpp b/functiongraph.cpp index 77754913..a743254e 100644 --- a/functiongraph.cpp +++ b/functiongraph.cpp @@ -131,6 +131,12 @@ vector> FunctionGraph::GetBlocks() } +bool FunctionGraph::HasBlocks() const +{ + return BNFunctionGraphHasBlocks(m_graph); +} + + int FunctionGraph::GetWidth() const { return BNGetFunctionGraphWidth(m_graph); diff --git a/python/binaryview.py b/python/binaryview.py index 7a6bc875..1c986a94 100644 --- a/python/binaryview.py +++ b/python/binaryview.py @@ -65,6 +65,9 @@ class BinaryDataNotification(object): def function_updated(self, view, func): pass + def function_update_requested(self, view, func): + pass + def data_var_added(self, view, var): pass @@ -180,6 +183,7 @@ class BinaryDataNotificationCallbacks(object): self._cb.functionAdded = self._cb.functionAdded.__class__(self._function_added) self._cb.functionRemoved = self._cb.functionRemoved.__class__(self._function_removed) self._cb.functionUpdated = self._cb.functionUpdated.__class__(self._function_updated) + self._cb.functionUpdateRequested = self._cb.functionUpdateRequested.__class__(self._function_update_requested) self._cb.dataVariableAdded = self._cb.dataVariableAdded.__class__(self._data_var_added) self._cb.dataVariableRemoved = self._cb.dataVariableRemoved.__class__(self._data_var_removed) self._cb.dataVariableUpdated = self._cb.dataVariableUpdated.__class__(self._data_var_updated) @@ -230,6 +234,12 @@ class BinaryDataNotificationCallbacks(object): except: log.log_error(traceback.format_exc()) + def _function_update_requested(self, ctxt, view, func): + try: + self.notify.function_update_requested(self.view, function.Function(self.view, core.BNNewFunctionReference(func))) + except: + log.log_error(traceback.format_exc()) + def _data_var_added(self, ctxt, view, var): try: address = var[0].address @@ -1013,6 +1023,15 @@ class BinaryView(object): result = core.BNGetGlobalPointerValue(self.handle) return function.RegisterValue(self.arch, result.value, confidence = result.confidence) + @property + def max_function_size_for_analysis(self): + """Maximum size of function (sum of basic block sizes in bytes) for auto analysis""" + return core.BNGetMaxFunctionSizeForAnalysis(self.handle) + + @max_function_size_for_analysis.setter + def max_function_size_for_analysis(self, size): + core.BNSetMaxFunctionSizeForAnalysis(self.handle, size) + def __len__(self): return int(core.BNGetViewLength(self.handle)) diff --git a/python/function.py b/python/function.py index f68aa76f..0d796d98 100644 --- a/python/function.py +++ b/python/function.py @@ -26,7 +26,8 @@ import ctypes import _binaryninjacore as core from enums import (FunctionGraphType, BranchType, SymbolType, InstructionTextTokenType, HighlightStandardColor, HighlightColorStyle, RegisterValueType, ImplicitRegisterExtend, - DisassemblyOption, IntegerDisplayType, InstructionTextTokenContext, VariableSourceType) + DisassemblyOption, IntegerDisplayType, InstructionTextTokenContext, VariableSourceType, + FunctionAnalysisSkipOverride) import architecture import platform import highlight @@ -817,6 +818,32 @@ class Function(object): for i in block: yield i + @property + def too_large(self): + """Whether the function is too large to automatically perform analysis (read-only)""" + return core.BNIsFunctionTooLarge(self.handle) + + @property + def analysis_skipped(self): + """Whether automatic analysis was skipped for this function""" + return core.BNIsFunctionAnalysisSkipped(self.handle) + + @analysis_skipped.setter + def analysis_skipped(self, skip): + if skip: + core.BNSetFunctionAnalysisSkipOverride(self.handle, FunctionAnalysisSkipOverride.AlwaysSkipFunctionAnalysis) + else: + core.BNSetFunctionAnalysisSkipOverride(self.handle, FunctionAnalysisSkipOverride.NeverSkipFunctionAnalysis) + + @property + def analysis_skip_override(self): + """Override for skipping of automatic analysis""" + return FunctionAnalysisSkipOverride(core.BNGetFunctionAnalysisSkipOverride(self.handle)) + + @analysis_skip_override.setter + def analysis_skip_override(self, override): + core.BNSetFunctionAnalysisSkipOverride(self.handle, override) + def __iter__(self): count = ctypes.c_ulonglong() blocks = core.BNGetFunctionBasicBlockList(self.handle, count) @@ -1835,6 +1862,11 @@ class FunctionGraph(object): core.BNFreeFunctionGraphBlockList(blocks, count.value) return result + @property + def has_blocks(self): + """Whether the function graph has at least one block (read-only)""" + return core.BNFunctionGraphHasBlocks(self.handle) + @property def width(self): """Function graph width (read-only)""" -- cgit v1.3.1 From 0f1d03f81cd79d501e8642360dc7c521a55cf374 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Thu, 8 Mar 2018 18:20:34 -0500 Subject: Update AnalysisCompletionEvent documentation. --- python/binaryview.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python/binaryview.py b/python/binaryview.py index 1c986a94..3af0ee50 100644 --- a/python/binaryview.py +++ b/python/binaryview.py @@ -108,7 +108,8 @@ class StringReference(object): class AnalysisCompletionEvent(object): """ The ``AnalysisCompletionEvent`` object provides an asynchronous mechanism for receiving - callbacks when analysis is complete. + callbacks when analysis is complete. The callback runs once. A completion event must be added + for each new analysis in order to be notified of each analysis completion. :Example: >>> def on_complete(self): -- cgit v1.3.1 From b8ac51a5ff98a79a205160b53cc74c324335250b Mon Sep 17 00:00:00 2001 From: Jordan Date: Mon, 12 Mar 2018 10:40:17 -0400 Subject: update to latest slack badge --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 74788a28..6575543d 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -[![slack](https://slackin-sbhuzyheck.now.sh/badge.svg)](https://binaryninja-slack-hwwdinrdce.now.sh/) +[![slack](https://slack.binary.ninja/badge.svg)](https://slack.binary.ninja/) # Binary Ninja API -- cgit v1.3.1 From 0700b6ba0b92ff99328f764a5e48192dc6f961c6 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Fri, 16 Mar 2018 20:07:48 -0400 Subject: Fix reference leak in calling conventions --- callingconvention.cpp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/callingconvention.cpp b/callingconvention.cpp index 2eb57567..a56b8f11 100644 --- a/callingconvention.cpp +++ b/callingconvention.cpp @@ -195,8 +195,10 @@ void CallingConvention::GetIncomingVariableForParameterVariableCallback(void* ct BNFunction* func, BNVariable* result) { CallingConvention* cc = (CallingConvention*)ctxt; - *result = cc->GetIncomingVariableForParameterVariable(*var, - func ? new Function(BNNewFunctionReference(func)) : nullptr); + Ref funcObj; + if (func) + funcObj = new Function(BNNewFunctionReference(func)); + *result = cc->GetIncomingVariableForParameterVariable(*var, funcObj); } @@ -204,8 +206,10 @@ void CallingConvention::GetParameterVariableForIncomingVariableCallback(void* ct BNFunction* func, BNVariable* result) { CallingConvention* cc = (CallingConvention*)ctxt; - *result = cc->GetParameterVariableForIncomingVariable(*var, - func ? new Function(BNNewFunctionReference(func)) : nullptr); + Ref funcObj; + if (func) + funcObj = new Function(BNNewFunctionReference(func)); + *result = cc->GetParameterVariableForIncomingVariable(*var, funcObj); } -- cgit v1.3.1 From 8f80afaaffa53ab0a1b0a4abc1a4c27ac45cf7d0 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Sun, 18 Mar 2018 14:47:17 -0400 Subject: Add api for getting total string output size of QualifiedName object --- binaryninjaapi.h | 4 +++- type.cpp | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 2d7e2ccf..d0c19e7a 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -680,8 +680,10 @@ namespace BinaryNinja void erase(std::vector::iterator i); void clear(); void push_back(const std::string& name); + // Returns count of names size_t size() const; - + // Returns size of output string + size_t StringSize() const; std::string GetString() const; BNQualifiedName GetAPIObject() const; diff --git a/type.cpp b/type.cpp index 08b64713..0a91ae92 100644 --- a/type.cpp +++ b/type.cpp @@ -188,6 +188,15 @@ size_t QualifiedName::size() const } +size_t QualifiedName::StringSize() const +{ + size_t size = 0; + for (auto& name : m_name) + size += name.size() + 2; + return size - 2; +} + + string QualifiedName::GetString() const { bool first = true; -- cgit v1.3.1 From 33b2a9d597e38e3c1df94b17ee7617fac8cdf311 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Mon, 19 Mar 2018 00:16:31 -0400 Subject: Add API to get file size --- binaryninjacore.h | 1 + 1 file changed, 1 insertion(+) diff --git a/binaryninjacore.h b/binaryninjacore.h index a1b78b1c..cb4b9eb9 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -3325,6 +3325,7 @@ extern "C" BINARYNINJACOREAPI bool BNPathExists(const char* path); BINARYNINJACOREAPI bool BNIsPathDirectory(const char* path); BINARYNINJACOREAPI bool BNIsPathRegularFile(const char* path); + BINARYNINJACOREAPI bool BNFileSize(const char* path, uint64_t* size); // Settings APIs BINARYNINJACOREAPI bool BNSettingGetBool(const char* settingGroup, const char* name, bool defaultValue); -- cgit v1.3.1 From 5f07bf18df013860c9d9870a4ad0fba78379b0f1 Mon Sep 17 00:00:00 2001 From: Ryan Snyder Date: Tue, 20 Mar 2018 09:53:59 -0400 Subject: Cache all created CoreArchitecture objects --- python/architecture.py | 18 +++++++++++++----- python/basicblock.py | 2 +- python/binaryview.py | 6 +++--- python/callingconvention.py | 2 +- python/function.py | 8 ++++---- python/platform.py | 2 +- 6 files changed, 23 insertions(+), 15 deletions(-) diff --git a/python/architecture.py b/python/architecture.py index 781edcfd..c5f87ec6 100644 --- a/python/architecture.py +++ b/python/architecture.py @@ -44,7 +44,7 @@ class _ArchitectureMetaClass(type): archs = core.BNGetArchitectureList(count) result = [] for i in xrange(0, count.value): - result.append(CoreArchitecture(archs[i])) + result.append(CoreArchitecture._from_cache(archs[i])) core.BNFreeArchitectureList(archs) return result @@ -54,7 +54,7 @@ class _ArchitectureMetaClass(type): archs = core.BNGetArchitectureList(count) try: for i in xrange(0, count.value): - yield CoreArchitecture(archs[i]) + yield CoreArchitecture._from_cache(archs[i]) finally: core.BNFreeArchitectureList(archs) @@ -63,7 +63,7 @@ class _ArchitectureMetaClass(type): arch = core.BNGetArchitectureByName(name) if arch is None: raise KeyError("'%s' is not a valid architecture" % str(name)) - return CoreArchitecture(arch) + return CoreArchitecture._from_cache(arch) def register(cls): startup._init_plugins() @@ -2037,6 +2037,7 @@ class Architecture(object): core.BNRegisterCallingConvention(self.handle, cc.handle) +_architecture_cache = {} class CoreArchitecture(Architecture): def __init__(self, handle): super(CoreArchitecture, self).__init__() @@ -2256,12 +2257,19 @@ class CoreArchitecture(Architecture): self._intrinsics[name] = intrinsics[i] self._intrinsics_by_index[intrinsics[i]] = (name, self.intrinsics[name]) core.BNFreeRegisterList(intrinsics) + global _architecture_cache + _architecture_cache[ctypes.addressof(handle.contents)] = self + + @classmethod + def _from_cache(cls, handle): + global _architecture_cache + return _architecture_cache.get(ctypes.addressof(handle.contents)) or cls(handle) def get_associated_arch_by_address(self, addr): new_addr = ctypes.c_ulonglong() new_addr.value = addr result = core.BNGetAssociatedArchitectureByAddress(self.handle, new_addr) - return CoreArchitecture(handle = result), new_addr.value + return CoreArchitecture._from_cache(handle = result), new_addr.value def get_instruction_info(self, data, addr): """ @@ -2289,7 +2297,7 @@ class CoreArchitecture(Architecture): for i in xrange(0, info.branchCount): target = info.branchTarget[i] if info.branchArch[i]: - arch = CoreArchitecture(info.branchArch[i]) + arch = CoreArchitecture._from_cache(info.branchArch[i]) else: arch = None result.add_branch(BranchType(info.branchType[i]), target, arch) diff --git a/python/basicblock.py b/python/basicblock.py index c93d0b2c..1d932c5e 100644 --- a/python/basicblock.py +++ b/python/basicblock.py @@ -100,7 +100,7 @@ class BasicBlock(object): arch = core.BNGetBasicBlockArchitecture(self.handle) if arch is None: return None - self._arch = architecture.CoreArchitecture(arch) + self._arch = architecture.CoreArchitecture._from_cache(arch) return self._arch @property diff --git a/python/binaryview.py b/python/binaryview.py index 3af0ee50..0cf25e70 100644 --- a/python/binaryview.py +++ b/python/binaryview.py @@ -411,7 +411,7 @@ class BinaryViewType(object): arch = core.BNGetArchitectureForViewType(self.handle, ident, endian) if arch is None: return None - return architecture.CoreArchitecture(arch) + return architecture.CoreArchitecture._from_cache(arch) def register_platform(self, ident, arch, plat): core.BNRegisterPlatformForViewType(self.handle, ident, arch.handle, plat.handle) @@ -823,7 +823,7 @@ class BinaryView(object): arch = core.BNGetDefaultArchitecture(self.handle) if arch is None: return None - return architecture.CoreArchitecture(handle=arch) + return architecture.CoreArchitecture._from_cache(handle=arch) @arch.setter def arch(self, value): @@ -2211,7 +2211,7 @@ class BinaryView(object): else: func = None if refs[i].arch: - arch = architecture.CoreArchitecture(refs[i].arch) + arch = architecture.CoreArchitecture._from_cache(refs[i].arch) else: arch = None addr = refs[i].addr diff --git a/python/callingconvention.py b/python/callingconvention.py index 49ef7666..e3ec7261 100644 --- a/python/callingconvention.py +++ b/python/callingconvention.py @@ -75,7 +75,7 @@ class CallingConvention(object): self.__class__._registered_calling_conventions.append(self) else: self.handle = handle - self.arch = architecture.CoreArchitecture(core.BNGetCallingConventionArchitecture(self.handle)) + self.arch = architecture.CoreArchitecture._from_cache(core.BNGetCallingConventionArchitecture(self.handle)) self.__dict__["name"] = core.BNGetCallingConventionName(self.handle) self.__dict__["arg_regs_share_index"] = core.BNAreArgumentRegistersSharedIndex(self.handle) self.__dict__["stack_reserved_for_arg_regs"] = core.BNIsStackReservedForArgumentRegisters(self.handle) diff --git a/python/function.py b/python/function.py index 0d796d98..8c4b7765 100644 --- a/python/function.py +++ b/python/function.py @@ -420,7 +420,7 @@ class Function(object): arch = core.BNGetFunctionArchitecture(self.handle) if arch is None: return None - self._arch = architecture.CoreArchitecture(arch) + self._arch = architecture.CoreArchitecture._from_cache(arch) return self._arch @property @@ -558,7 +558,7 @@ class Function(object): branches = core.BNGetIndirectBranches(self.handle, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.CoreArchitecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result @@ -1142,7 +1142,7 @@ class Function(object): branches = core.BNGetIndirectBranchesAt(self.handle, arch.handle, addr, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.CoreArchitecture(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result @@ -1660,7 +1660,7 @@ class FunctionGraphBlock(object): arch = core.BNGetFunctionGraphBlockArchitecture(self.handle) if arch is None: return None - return architecture.CoreArchitecture(arch) + return architecture.CoreArchitecture._from_cache(arch) @property def start(self): diff --git a/python/platform.py b/python/platform.py index 09670bac..a79e3b9a 100644 --- a/python/platform.py +++ b/python/platform.py @@ -105,7 +105,7 @@ class Platform(object): else: self.handle = handle self.__dict__["name"] = core.BNGetPlatformName(self.handle) - self.arch = architecture.CoreArchitecture(core.BNGetPlatformArchitecture(self.handle)) + self.arch = architecture.CoreArchitecture._from_cache(core.BNGetPlatformArchitecture(self.handle)) def __del__(self): core.BNFreePlatform(self.handle) -- cgit v1.3.1 From 7df91eab880eea11369072ae4ebc9b6ae2bb2f51 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Tue, 20 Mar 2018 17:03:18 -0400 Subject: Call CreateDatabase on parent view if it exists --- binaryview.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/binaryview.cpp b/binaryview.cpp index 0dcf6bc3..8dcae40f 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -584,6 +584,9 @@ bool BinaryView::IsBackedByDatabase() const bool BinaryView::CreateDatabase(const string& path) { + auto parent = GetParentView(); + if (parent) + return parent->CreateDatabase(path); return m_file->CreateDatabase(path, this); } @@ -591,6 +594,9 @@ bool BinaryView::CreateDatabase(const string& path) bool BinaryView::CreateDatabase(const string& path, const function& progressCallback) { + auto parent = GetParentView(); + if (parent) + return parent->CreateDatabase(path); return m_file->CreateDatabase(path, this, progressCallback); } -- cgit v1.3.1 From 5e56265478e39ec4a1e7bad40c4f8728c5a46214 Mon Sep 17 00:00:00 2001 From: Ryan Snyder Date: Fri, 23 Mar 2018 14:23:09 -0400 Subject: Make indirect branch queries initialize CoreArchitecture objects correctly --- python/function.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/function.py b/python/function.py index 8c4b7765..1cc4dcac 100644 --- a/python/function.py +++ b/python/function.py @@ -558,7 +558,7 @@ class Function(object): branches = core.BNGetIndirectBranches(self.handle, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.CoreArchitecture._from_cache(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result @@ -1142,7 +1142,7 @@ class Function(object): branches = core.BNGetIndirectBranchesAt(self.handle, arch.handle, addr, count) result = [] for i in xrange(0, count.value): - result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.Architecture(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) + result.append(IndirectBranchInfo(architecture.CoreArchitecture._from_cache(branches[i].sourceArch), branches[i].sourceAddr, architecture.CoreArchitecture._from_cache(branches[i].destArch), branches[i].destAddr, branches[i].autoDefined)) core.BNFreeIndirectBranchList(branches) return result -- cgit v1.3.1 From c4e2ab35793daf5d138965eb4d530443f4b54d49 Mon Sep 17 00:00:00 2001 From: Ryan Snyder Date: Wed, 28 Mar 2018 13:18:38 -0400 Subject: Prevent creation of invalid Type wrappers --- type.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/type.cpp b/type.cpp index 0a91ae92..85961a3e 100644 --- a/type.cpp +++ b/type.cpp @@ -582,19 +582,19 @@ Ref Type::NamedType(const QualifiedName& name, Type* type) Ref Type::NamedType(const string& id, const QualifiedName& name, Type* type) { BNQualifiedName nameObj = name.GetAPIObject(); - Type* result = new Type(BNCreateNamedTypeReferenceFromTypeAndId(id.c_str(), &nameObj, - type ? type->GetObject() : nullptr)); + BNType* coreObj = BNCreateNamedTypeReferenceFromTypeAndId(id.c_str(), &nameObj, + type ? type->GetObject() : nullptr); QualifiedName::FreeAPIObject(&nameObj); - return result; + return coreObj ? new Type(coreObj) : nullptr; } Ref Type::NamedType(BinaryView* view, const QualifiedName& name) { BNQualifiedName nameObj = name.GetAPIObject(); - Type* result = new Type(BNCreateNamedTypeReferenceFromType(view->GetObject(), &nameObj)); + BNType* coreObj = BNCreateNamedTypeReferenceFromType(view->GetObject(), &nameObj); QualifiedName::FreeAPIObject(&nameObj); - return result; + return coreObj ? new Type(coreObj) : nullptr; } -- cgit v1.3.1 From f37eb6cc18abf4dbb5b03175e4cb980c3e9a7ae2 Mon Sep 17 00:00:00 2001 From: Ryan Snyder Date: Wed, 28 Mar 2018 13:45:43 -0400 Subject: Fix default flag write generation for some ops --- lowlevelil.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 91db6ab3..79138159 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -314,7 +314,11 @@ ExprId LowLevelILFunction::GetExprForRegisterOrConstantOperation(BNLowLevelILOpe if (operandCount == 0) return AddExpr(op, size, 0); if (operandCount == 1) + { + if (op == LLIL_SET_REG) + return GetExprForRegisterOrConstant(operands[0], size); return AddExpr(op, size, 0, GetExprForRegisterOrConstant(operands[0], size)); + } if (operandCount == 2) { return AddExpr(op, size, 0, GetExprForRegisterOrConstant(operands[0], size), -- cgit v1.3.1 From 928c3e87f6d58006f15a7f33ce9cb9c8dab1c5a5 Mon Sep 17 00:00:00 2001 From: Jordan Wiens Date: Wed, 28 Mar 2018 20:57:33 -0400 Subject: update docs for I hotkey --- docs/getting-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started.md b/docs/getting-started.md index 922a7b7f..0100eed0 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -96,7 +96,7 @@ Switching views happens multiple ways. In some instances, it's automatic (clicki - `e` : Edits an instruction (by modifying the original binary -- currently only enabled for x86, and x64) - `x` : Focuses the cross-reference pane - `;` : Adds a comment - - `i` : Switches between disassembly and low-level il in graph view + - `i` : Cycles between disassembly, low-level il, and medium-level il in graph view - `y` : Change type - `a` : Change the data type to an ASCII string - [1248] : Change type directly to a data variable of the indicated widths -- cgit v1.3.1 From 5055d38ef59c570d21dcb6ce6855961e270f1042 Mon Sep 17 00:00:00 2001 From: Brian Potchik Date: Wed, 28 Mar 2018 21:11:21 -0400 Subject: Add documentation for recent-file-limit. --- docs/getting-started.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/getting-started.md b/docs/getting-started.md index 0100eed0..073ccd33 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -264,6 +264,7 @@ Settings are stored in the _user_ directory in the file `settings.json`. Each to | ui | activeContent | boolean | True | Allow Binary Ninja to connect to the web to check for updates | | ui | colorblind | boolean | True | Choose colors that are visible to those with red/green colorblind | | ui | debug | boolean | False | Enable developer debugging features (Additional views: Lifted IL, and SSA forms) | +| ui | recent-file-limit | integer | 10 | Specify limit for number of recent files | | pdb | local-store-absolute | string | "" | Absolute path specifying where the pdb symbol store exists on this machine, overrides relative path | | pdb | local-store-relative | string | "symbols" | Path *relative* to the binaryninja _user_ directory, sepcifying the pdb symbol store | | pdb | auto-download-pdb | boolean | True | Automatically download pdb files from specified symbol servers | @@ -277,6 +278,7 @@ Below is an example `settings.json` setting various options: "activeContent" : false, "colorblind" : false, "debug" : true + "recent-file-limit" : 10 } "pdb" : { -- cgit v1.3.1 From fa716fe2da53a4f136380b1f60197bd197b2793a Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Mon, 2 Apr 2018 23:30:56 -0400 Subject: Add plugin commands for LLIL and MLIL --- basicblock.cpp | 37 +++++++++ binaryninjaapi.h | 101 ++++++++++++++++++++--- binaryninjacore.h | 69 ++++++++++++---- binaryview.cpp | 2 + function.cpp | 1 + functiongraph.cpp | 36 ++++++++ functiongraphblock.cpp | 1 + plugin.cpp | 218 ++++++++++++++++++++++++++++++++++++++++++++++++ python/basicblock.py | 21 ++++- python/function.py | 71 +++++++++++++--- python/plugin.py | 219 +++++++++++++++++++++++++++++++++++++++++++++++++ 11 files changed, 736 insertions(+), 40 deletions(-) diff --git a/basicblock.cpp b/basicblock.cpp index d42a1038..33f57d40 100644 --- a/basicblock.cpp +++ b/basicblock.cpp @@ -276,6 +276,7 @@ vector BasicBlock::GetDisassemblyText(DisassemblySettings* { DisassemblyTextLine line; line.addr = lines[i].addr; + line.instrIndex = lines[i].instrIndex; line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { @@ -417,3 +418,39 @@ bool BasicBlock::IsBackEdge(BasicBlock* source, BasicBlock* target) } return false; } + + +bool BasicBlock::IsILBlock() const +{ + return BNIsILBasicBlock(m_object); +} + + +bool BasicBlock::IsLowLevelILBlock() const +{ + return BNIsLowLevelILBasicBlock(m_object); +} + + +bool BasicBlock::IsMediumLevelILBlock() const +{ + return BNIsMediumLevelILBasicBlock(m_object); +} + + +Ref BasicBlock::GetLowLevelILFunction() const +{ + BNLowLevelILFunction* func = BNGetBasicBlockLowLevelILFunction(m_object); + if (!func) + return nullptr; + return new LowLevelILFunction(func); +} + + +Ref BasicBlock::GetMediumLevelILFunction() const +{ + BNMediumLevelILFunction* func = BNGetBasicBlockMediumLevelILFunction(m_object); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} diff --git a/binaryninjaapi.h b/binaryninjaapi.h index d0c19e7a..81b5105d 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -986,6 +986,7 @@ namespace BinaryNinja struct DisassemblyTextLine { uint64_t addr; + size_t instrIndex; std::vector tokens; }; @@ -1590,6 +1591,7 @@ namespace BinaryNinja }; class LowLevelILFunction; + class MediumLevelILFunction; class FunctionRecognizer; class CallingConvention; @@ -2254,6 +2256,12 @@ namespace BinaryNinja void SetUserBasicBlockHighlight(uint8_t r, uint8_t g, uint8_t b, uint8_t alpha = 255); static bool IsBackEdge(BasicBlock* source, BasicBlock* target); + + bool IsILBlock() const; + bool IsLowLevelILBlock() const; + bool IsMediumLevelILBlock() const; + Ref GetLowLevelILFunction() const; + Ref GetMediumLevelILFunction() const; }; struct VariableNameAndType @@ -2570,6 +2578,12 @@ namespace BinaryNinja bool IsOptionSet(BNDisassemblyOption option) const; void SetOption(BNDisassemblyOption option, bool state = true); + + bool IsILGraph() const; + bool IsLowLevelILGraph() const; + bool IsMediumLevelILGraph() const; + Ref GetLowLevelILFunction() const; + Ref GetMediumLevelILFunction() const; }; struct LowLevelILLabel: public BNLowLevelILLabel @@ -3312,7 +3326,10 @@ namespace BinaryNinja { Ref view; uint64_t address, length; + size_t instrIndex; Ref function; + Ref lowLevelILFunction; + Ref mediumLevelILFunction; PluginCommandContext(); }; @@ -3345,15 +3362,55 @@ namespace BinaryNinja std::function isValid; }; + struct RegisteredLowLevelILFunctionCommand + { + std::function action; + std::function isValid; + }; + + struct RegisteredLowLevelILInstructionCommand + { + std::function action; + std::function isValid; + }; + + struct RegisteredMediumLevelILFunctionCommand + { + std::function action; + std::function isValid; + }; + + struct RegisteredMediumLevelILInstructionCommand + { + std::function action; + std::function isValid; + }; + static void DefaultPluginCommandActionCallback(void* ctxt, BNBinaryView* view); static void AddressPluginCommandActionCallback(void* ctxt, BNBinaryView* view, uint64_t addr); static void RangePluginCommandActionCallback(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len); static void FunctionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, BNFunction* func); + static void LowLevelILFunctionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func); + static void LowLevelILInstructionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func, size_t instr); + static void MediumLevelILFunctionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func); + static void MediumLevelILInstructionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func, size_t instr); static bool DefaultPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view); static bool AddressPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, uint64_t addr); static bool RangePluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len); static bool FunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, BNFunction* func); + static bool LowLevelILFunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func); + static bool LowLevelILInstructionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func, size_t instr); + static bool MediumLevelILFunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func); + static bool MediumLevelILInstructionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func, size_t instr); public: PluginCommand(const BNPluginCommand& cmd); @@ -3363,25 +3420,45 @@ namespace BinaryNinja PluginCommand& operator=(const PluginCommand& cmd); static void Register(const std::string& name, const std::string& description, - const std::function& action); + const std::function& action); static void Register(const std::string& name, const std::string& description, - const std::function& action, - const std::function& isValid); + const std::function& action, + const std::function& isValid); static void RegisterForAddress(const std::string& name, const std::string& description, - const std::function& action); + const std::function& action); static void RegisterForAddress(const std::string& name, const std::string& description, - const std::function& action, - const std::function& isValid); + const std::function& action, + const std::function& isValid); static void RegisterForRange(const std::string& name, const std::string& description, - const std::function& action); + const std::function& action); static void RegisterForRange(const std::string& name, const std::string& description, - const std::function& action, - const std::function& isValid); + const std::function& action, + const std::function& isValid); static void RegisterForFunction(const std::string& name, const std::string& description, - const std::function& action); + const std::function& action); static void RegisterForFunction(const std::string& name, const std::string& description, - const std::function& action, - const std::function& isValid); + const std::function& action, + const std::function& isValid); + static void RegisterForLowLevelILFunction(const std::string& name, const std::string& description, + const std::function& action); + static void RegisterForLowLevelILFunction(const std::string& name, const std::string& description, + const std::function& action, + const std::function& isValid); + static void RegisterForLowLevelILInstruction(const std::string& name, const std::string& description, + const std::function& action); + static void RegisterForLowLevelILInstruction(const std::string& name, const std::string& description, + const std::function& action, + const std::function& isValid); + static void RegisterForMediumLevelILFunction(const std::string& name, const std::string& description, + const std::function& action); + static void RegisterForMediumLevelILFunction(const std::string& name, const std::string& description, + const std::function& action, + const std::function& isValid); + static void RegisterForMediumLevelILInstruction(const std::string& name, const std::string& description, + const std::function& action); + static void RegisterForMediumLevelILInstruction(const std::string& name, const std::string& description, + const std::function& action, + const std::function& isValid); static std::vector GetList(); static std::vector GetValidList(const PluginCommandContext& ctxt); diff --git a/binaryninjacore.h b/binaryninjacore.h index cb4b9eb9..69c5e61b 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -1205,6 +1205,7 @@ extern "C" struct BNDisassemblyTextLine { uint64_t addr; + size_t instrIndex; BNInstructionTextToken* tokens; size_t count; }; @@ -1365,7 +1366,11 @@ extern "C" DefaultPluginCommand, AddressPluginCommand, RangePluginCommand, - FunctionPluginCommand + FunctionPluginCommand, + LowLevelILFunctionPluginCommand, + LowLevelILInstructionPluginCommand, + MediumLevelILFunctionPluginCommand, + MediumLevelILInstructionPluginCommand }; struct BNPluginCommand @@ -1379,11 +1384,19 @@ extern "C" void (*addressCommand)(void* ctxt, BNBinaryView* view, uint64_t addr); void (*rangeCommand)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len); void (*functionCommand)(void* ctxt, BNBinaryView* view, BNFunction* func); + void (*lowLevelILFunctionCommand)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func); + void (*lowLevelILInstructionCommand)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func, size_t instr); + void (*mediumLevelILFunctionCommand)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func); + void (*mediumLevelILInstructionCommand)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func, size_t instr); bool (*defaultIsValid)(void* ctxt, BNBinaryView* view); bool (*addressIsValid)(void* ctxt, BNBinaryView* view, uint64_t addr); bool (*rangeIsValid)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len); bool (*functionIsValid)(void* ctxt, BNBinaryView* view, BNFunction* func); + bool (*lowLevelILFunctionIsValid)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func); + bool (*lowLevelILInstructionIsValid)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func, size_t instr); + bool (*mediumLevelILFunctionIsValid)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func); + bool (*mediumLevelILInstructionIsValid)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func, size_t instr); }; struct BNCustomCallingConvention @@ -2347,6 +2360,11 @@ extern "C" BINARYNINJACOREAPI BNBasicBlock** BNGetBasicBlockDominanceFrontier(BNBasicBlock* block, size_t* count); BINARYNINJACOREAPI BNBasicBlock** BNGetBasicBlockIteratedDominanceFrontier(BNBasicBlock** blocks, size_t incomingCount, size_t* outputCount); + BINARYNINJACOREAPI bool BNIsILBasicBlock(BNBasicBlock* block); + BINARYNINJACOREAPI bool BNIsLowLevelILBasicBlock(BNBasicBlock* block); + BINARYNINJACOREAPI bool BNIsMediumLevelILBasicBlock(BNBasicBlock* block); + BINARYNINJACOREAPI BNLowLevelILFunction* BNGetBasicBlockLowLevelILFunction(BNBasicBlock* block); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetBasicBlockMediumLevelILFunction(BNBasicBlock* block); BINARYNINJACOREAPI BNDisassemblyTextLine* BNGetBasicBlockDisassemblyText(BNBasicBlock* block, BNDisassemblySettings* settings, size_t* count); @@ -2547,6 +2565,11 @@ extern "C" BINARYNINJACOREAPI void BNSetFunctionGraphCompleteCallback(BNFunctionGraph* graph, void* ctxt, void (*func)(void* ctxt)); BINARYNINJACOREAPI void BNAbortFunctionGraph(BNFunctionGraph* graph); BINARYNINJACOREAPI BNFunctionGraphType BNGetFunctionGraphType(BNFunctionGraph* graph); + BINARYNINJACOREAPI bool BNIsILFunctionGraph(BNFunctionGraph* graph); + BINARYNINJACOREAPI bool BNIsLowLevelILFunctionGraph(BNFunctionGraph* graph); + BINARYNINJACOREAPI bool BNIsMediumLevelILFunctionGraph(BNFunctionGraph* graph); + BINARYNINJACOREAPI BNLowLevelILFunction* BNGetFunctionGraphLowLevelILFunction(BNFunctionGraph* graph); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetFunctionGraphMediumLevelILFunction(BNFunctionGraph* graph); BINARYNINJACOREAPI BNFunctionGraphBlock** BNGetFunctionGraphBlocks(BNFunctionGraph* graph, size_t* count); BINARYNINJACOREAPI BNFunctionGraphBlock** BNGetFunctionGraphBlocksInRegion( @@ -3017,29 +3040,45 @@ extern "C" // Plugin commands BINARYNINJACOREAPI void BNRegisterPluginCommand(const char* name, const char* description, - void (*action)(void* ctxt, BNBinaryView* view), - bool (*isValid)(void* ctxt, BNBinaryView* view), void* context); + void (*action)(void* ctxt, BNBinaryView* view), bool (*isValid)(void* ctxt, BNBinaryView* view), void* context); BINARYNINJACOREAPI void BNRegisterPluginCommandForAddress(const char* name, const char* description, - void (*action)(void* ctxt, BNBinaryView* view, uint64_t addr), - bool (*isValid)(void* ctxt, BNBinaryView* view, uint64_t addr), - void* context); + void (*action)(void* ctxt, BNBinaryView* view, uint64_t addr), + bool (*isValid)(void* ctxt, BNBinaryView* view, uint64_t addr), void* context); BINARYNINJACOREAPI void BNRegisterPluginCommandForRange(const char* name, const char* description, - void (*action)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len), - bool (*isValid)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len), - void* context); + void (*action)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len), + bool (*isValid)(void* ctxt, BNBinaryView* view, uint64_t addr, uint64_t len), void* context); BINARYNINJACOREAPI void BNRegisterPluginCommandForFunction(const char* name, const char* description, - void (*action)(void* ctxt, BNBinaryView* view, BNFunction* func), - bool (*isValid)(void* ctxt, BNBinaryView* view, BNFunction* func), - void* context); + void (*action)(void* ctxt, BNBinaryView* view, BNFunction* func), + bool (*isValid)(void* ctxt, BNBinaryView* view, BNFunction* func), void* context); + BINARYNINJACOREAPI void BNRegisterPluginCommandForLowLevelILFunction(const char* name, const char* description, + void (*action)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func), + bool (*isValid)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func), void* context); + BINARYNINJACOREAPI void BNRegisterPluginCommandForLowLevelILInstruction(const char* name, const char* description, + void (*action)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func, size_t instr), + bool (*isValid)(void* ctxt, BNBinaryView* view, BNLowLevelILFunction* func, size_t instr), void* context); + BINARYNINJACOREAPI void BNRegisterPluginCommandForMediumLevelILFunction(const char* name, const char* description, + void (*action)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func), + bool (*isValid)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func), void* context); + BINARYNINJACOREAPI void BNRegisterPluginCommandForMediumLevelILInstruction(const char* name, const char* description, + void (*action)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func, size_t instr), + bool (*isValid)(void* ctxt, BNBinaryView* view, BNMediumLevelILFunction* func, size_t instr), void* context); BINARYNINJACOREAPI BNPluginCommand* BNGetAllPluginCommands(size_t* count); BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommands(BNBinaryView* view, size_t* count); BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForAddress(BNBinaryView* view, uint64_t addr, - size_t* count); + size_t* count); BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForRange(BNBinaryView* view, uint64_t addr, - uint64_t len, size_t* count); + uint64_t len, size_t* count); BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForFunction(BNBinaryView* view, BNFunction* func, - size_t* count); + size_t* count); + BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForLowLevelILFunction(BNBinaryView* view, + BNLowLevelILFunction* func, size_t* count); + BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForLowLevelILInstruction(BNBinaryView* view, + BNLowLevelILFunction* func, size_t instr, size_t* count); + BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForMediumLevelILFunction(BNBinaryView* view, + BNMediumLevelILFunction* func, size_t* count); + BINARYNINJACOREAPI BNPluginCommand* BNGetValidPluginCommandsForMediumLevelILInstruction(BNBinaryView* view, + BNMediumLevelILFunction* func, size_t instr, size_t* count); BINARYNINJACOREAPI void BNFreePluginCommandList(BNPluginCommand* commands); // Calling conventions diff --git a/binaryview.cpp b/binaryview.cpp index 8dcae40f..0a9a7118 100644 --- a/binaryview.cpp +++ b/binaryview.cpp @@ -1459,6 +1459,7 @@ vector BinaryView::GetPreviousLinearDisassemblyLines(Line line.block = lines[i].block ? new BasicBlock(BNNewBasicBlockReference(lines[i].block)) : nullptr; line.lineOffset = lines[i].lineOffset; line.contents.addr = lines[i].contents.addr; + line.contents.instrIndex = lines[i].contents.instrIndex; line.contents.tokens.reserve(lines[i].contents.count); for (size_t j = 0; j < lines[i].contents.count; j++) { @@ -1507,6 +1508,7 @@ vector BinaryView::GetNextLinearDisassemblyLines(LinearDi line.block = lines[i].block ? new BasicBlock(BNNewBasicBlockReference(lines[i].block)) : nullptr; line.lineOffset = lines[i].lineOffset; line.contents.addr = lines[i].contents.addr; + line.contents.instrIndex = lines[i].contents.instrIndex; line.contents.tokens.reserve(lines[i].contents.count); for (size_t j = 0; j < lines[i].contents.count; j++) { diff --git a/function.cpp b/function.cpp index 1e91f8f3..835ab144 100644 --- a/function.cpp +++ b/function.cpp @@ -1337,6 +1337,7 @@ vector Function::GetTypeTokens(DisassemblySettings* setting { DisassemblyTextLine line; line.addr = lines[i].addr; + line.instrIndex = lines[i].instrIndex; line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { diff --git a/functiongraph.cpp b/functiongraph.cpp index a743254e..9948d70e 100644 --- a/functiongraph.cpp +++ b/functiongraph.cpp @@ -186,3 +186,39 @@ void FunctionGraph::SetOption(BNDisassemblyOption option, bool state) { BNSetFunctionGraphOption(m_graph, option, state); } + + +bool FunctionGraph::IsILGraph() const +{ + return BNIsILFunctionGraph(m_graph); +} + + +bool FunctionGraph::IsLowLevelILGraph() const +{ + return BNIsLowLevelILFunctionGraph(m_graph); +} + + +bool FunctionGraph::IsMediumLevelILGraph() const +{ + return BNIsMediumLevelILFunctionGraph(m_graph); +} + + +Ref FunctionGraph::GetLowLevelILFunction() const +{ + BNLowLevelILFunction* func = BNGetFunctionGraphLowLevelILFunction(m_graph); + if (!func) + return nullptr; + return new LowLevelILFunction(func); +} + + +Ref FunctionGraph::GetMediumLevelILFunction() const +{ + BNMediumLevelILFunction* func = BNGetFunctionGraphMediumLevelILFunction(m_graph); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} diff --git a/functiongraphblock.cpp b/functiongraphblock.cpp index 06a35eee..469fb175 100644 --- a/functiongraphblock.cpp +++ b/functiongraphblock.cpp @@ -94,6 +94,7 @@ const vector& FunctionGraphBlock::GetLines() { DisassemblyTextLine line; line.addr = lines[i].addr; + line.instrIndex = lines[i].instrIndex; line.tokens.reserve(lines[i].count); for (size_t j = 0; j < lines[i].count; j++) { diff --git a/plugin.cpp b/plugin.cpp index 972ce28b..22befd65 100644 --- a/plugin.cpp +++ b/plugin.cpp @@ -19,6 +19,8 @@ // IN THE SOFTWARE. #include "binaryninjaapi.h" +#include "lowlevelilinstruction.h" +#include "mediumlevelilinstruction.h" using namespace BinaryNinja; using namespace std; @@ -27,6 +29,7 @@ using namespace std; PluginCommandContext::PluginCommandContext() { address = length = 0; + instrIndex = BN_INVALID_EXPR; } @@ -97,6 +100,48 @@ void PluginCommand::FunctionPluginCommandActionCallback(void* ctxt, BNBinaryView } +void PluginCommand::LowLevelILFunctionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func) +{ + RegisteredLowLevelILFunctionCommand* cmd = (RegisteredLowLevelILFunctionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new LowLevelILFunction(BNNewLowLevelILFunctionReference(func)); + cmd->action(viewObject, funcObject); +} + + +void PluginCommand::LowLevelILInstructionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func, size_t instr) +{ + RegisteredLowLevelILInstructionCommand* cmd = (RegisteredLowLevelILInstructionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new LowLevelILFunction(BNNewLowLevelILFunctionReference(func)); + LowLevelILInstruction instrObject = funcObject->GetInstruction(instr); + cmd->action(viewObject, instrObject); +} + + +void PluginCommand::MediumLevelILFunctionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func) +{ + RegisteredMediumLevelILFunctionCommand* cmd = (RegisteredMediumLevelILFunctionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new MediumLevelILFunction(BNNewMediumLevelILFunctionReference(func)); + cmd->action(viewObject, funcObject); +} + + +void PluginCommand::MediumLevelILInstructionPluginCommandActionCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func, size_t instr) +{ + RegisteredMediumLevelILInstructionCommand* cmd = (RegisteredMediumLevelILInstructionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new MediumLevelILFunction(BNNewMediumLevelILFunctionReference(func)); + MediumLevelILInstruction instrObject = funcObject->GetInstruction(instr); + cmd->action(viewObject, instrObject); +} + + bool PluginCommand::DefaultPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view) { RegisteredDefaultCommand* cmd = (RegisteredDefaultCommand*)ctxt; @@ -130,6 +175,48 @@ bool PluginCommand::FunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryVie } +bool PluginCommand::LowLevelILFunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func) +{ + RegisteredLowLevelILFunctionCommand* cmd = (RegisteredLowLevelILFunctionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new LowLevelILFunction(BNNewLowLevelILFunctionReference(func)); + return cmd->isValid(viewObject, funcObject); +} + + +bool PluginCommand::LowLevelILInstructionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNLowLevelILFunction* func, size_t instr) +{ + RegisteredLowLevelILInstructionCommand* cmd = (RegisteredLowLevelILInstructionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new LowLevelILFunction(BNNewLowLevelILFunctionReference(func)); + LowLevelILInstruction instrObject = funcObject->GetInstruction(instr); + return cmd->isValid(viewObject, instrObject); +} + + +bool PluginCommand::MediumLevelILFunctionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func) +{ + RegisteredMediumLevelILFunctionCommand* cmd = (RegisteredMediumLevelILFunctionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new MediumLevelILFunction(BNNewMediumLevelILFunctionReference(func)); + return cmd->isValid(viewObject, funcObject); +} + + +bool PluginCommand::MediumLevelILInstructionPluginCommandIsValidCallback(void* ctxt, BNBinaryView* view, + BNMediumLevelILFunction* func, size_t instr) +{ + RegisteredMediumLevelILInstructionCommand* cmd = (RegisteredMediumLevelILInstructionCommand*)ctxt; + Ref viewObject = new BinaryView(BNNewViewReference(view)); + Ref funcObject = new MediumLevelILFunction(BNNewMediumLevelILFunctionReference(func)); + MediumLevelILInstruction instrObject = funcObject->GetInstruction(instr); + return cmd->isValid(viewObject, instrObject); +} + + void PluginCommand::Register(const string& name, const string& description, const function& action) { @@ -206,6 +293,89 @@ void PluginCommand::RegisterForFunction(const string& name, const string& descri } +void PluginCommand::RegisterForLowLevelILFunction(const string& name, const string& description, + const function& action) +{ + RegisterForLowLevelILFunction(name, description, action, [](BinaryView*, LowLevelILFunction*) { return true; }); +} + + +void PluginCommand::RegisterForLowLevelILFunction(const string& name, const string& description, + const function& action, + const function& isValid) +{ + RegisteredLowLevelILFunctionCommand* cmd = new RegisteredLowLevelILFunctionCommand; + cmd->action = action; + cmd->isValid = isValid; + BNRegisterPluginCommandForLowLevelILFunction(name.c_str(), description.c_str(), + LowLevelILFunctionPluginCommandActionCallback, + LowLevelILFunctionPluginCommandIsValidCallback, cmd); +} + + +void PluginCommand::RegisterForLowLevelILInstruction(const string& name, const string& description, + const function& action) +{ + RegisterForLowLevelILInstruction(name, description, action, + [](BinaryView*, const LowLevelILInstruction&) { return true; }); +} + + +void PluginCommand::RegisterForLowLevelILInstruction(const string& name, const string& description, + const function& action, + const function& isValid) +{ + RegisteredLowLevelILInstructionCommand* cmd = new RegisteredLowLevelILInstructionCommand; + cmd->action = action; + cmd->isValid = isValid; + BNRegisterPluginCommandForLowLevelILInstruction(name.c_str(), description.c_str(), + LowLevelILInstructionPluginCommandActionCallback, + LowLevelILInstructionPluginCommandIsValidCallback, cmd); +} + + +void PluginCommand::RegisterForMediumLevelILFunction(const string& name, const string& description, + const function& action) +{ + RegisterForMediumLevelILFunction(name, description, action, + [](BinaryView*, MediumLevelILFunction*) { return true; }); +} + + +void PluginCommand::RegisterForMediumLevelILFunction(const string& name, const string& description, + const function& action, + const function& isValid) +{ + RegisteredMediumLevelILFunctionCommand* cmd = new RegisteredMediumLevelILFunctionCommand; + cmd->action = action; + cmd->isValid = isValid; + BNRegisterPluginCommandForMediumLevelILFunction(name.c_str(), description.c_str(), + MediumLevelILFunctionPluginCommandActionCallback, + MediumLevelILFunctionPluginCommandIsValidCallback, cmd); +} + + +void PluginCommand::RegisterForMediumLevelILInstruction(const string& name, const string& description, + const function& action) +{ + RegisterForMediumLevelILInstruction(name, description, action, + [](BinaryView*, const MediumLevelILInstruction&) { return true; }); +} + + +void PluginCommand::RegisterForMediumLevelILInstruction(const string& name, const string& description, + const function& action, + const function& isValid) +{ + RegisteredMediumLevelILInstructionCommand* cmd = new RegisteredMediumLevelILInstructionCommand; + cmd->action = action; + cmd->isValid = isValid; + BNRegisterPluginCommandForMediumLevelILInstruction(name.c_str(), description.c_str(), + MediumLevelILInstructionPluginCommandActionCallback, + MediumLevelILInstructionPluginCommandIsValidCallback, cmd); +} + + vector PluginCommand::GetList() { vector result; @@ -259,6 +429,38 @@ bool PluginCommand::IsValid(const PluginCommandContext& ctxt) const if (!m_command.functionIsValid) return true; return m_command.functionIsValid(m_command.context, ctxt.view->GetObject(), ctxt.function->GetObject()); + case LowLevelILFunctionPluginCommand: + if (!ctxt.lowLevelILFunction) + return false; + if (!m_command.lowLevelILFunctionIsValid) + return true; + return m_command.lowLevelILFunctionIsValid(m_command.context, ctxt.view->GetObject(), + ctxt.lowLevelILFunction->GetObject()); + case LowLevelILInstructionPluginCommand: + if (!ctxt.lowLevelILFunction) + return false; + if (ctxt.instrIndex == BN_INVALID_EXPR) + return false; + if (!m_command.lowLevelILInstructionIsValid) + return true; + return m_command.lowLevelILInstructionIsValid(m_command.context, ctxt.view->GetObject(), + ctxt.lowLevelILFunction->GetObject(), ctxt.instrIndex); + case MediumLevelILFunctionPluginCommand: + if (!ctxt.mediumLevelILFunction) + return false; + if (!m_command.mediumLevelILFunctionIsValid) + return true; + return m_command.mediumLevelILFunctionIsValid(m_command.context, ctxt.view->GetObject(), + ctxt.mediumLevelILFunction->GetObject()); + case MediumLevelILInstructionPluginCommand: + if (!ctxt.mediumLevelILFunction) + return false; + if (ctxt.instrIndex == BN_INVALID_EXPR) + return false; + if (!m_command.mediumLevelILInstructionIsValid) + return true; + return m_command.mediumLevelILInstructionIsValid(m_command.context, ctxt.view->GetObject(), + ctxt.mediumLevelILFunction->GetObject(), ctxt.instrIndex); default: return false; } @@ -284,6 +486,22 @@ void PluginCommand::Execute(const PluginCommandContext& ctxt) const case FunctionPluginCommand: m_command.functionCommand(m_command.context, ctxt.view->GetObject(), ctxt.function->GetObject()); break; + case LowLevelILFunctionPluginCommand: + m_command.lowLevelILFunctionCommand(m_command.context, ctxt.view->GetObject(), + ctxt.lowLevelILFunction->GetObject()); + break; + case LowLevelILInstructionPluginCommand: + m_command.lowLevelILInstructionCommand(m_command.context, ctxt.view->GetObject(), + ctxt.lowLevelILFunction->GetObject(), ctxt.instrIndex); + break; + case MediumLevelILFunctionPluginCommand: + m_command.mediumLevelILFunctionCommand(m_command.context, ctxt.view->GetObject(), + ctxt.mediumLevelILFunction->GetObject()); + break; + case MediumLevelILInstructionPluginCommand: + m_command.mediumLevelILInstructionCommand(m_command.context, ctxt.view->GetObject(), + ctxt.mediumLevelILFunction->GetObject(), ctxt.instrIndex); + break; default: break; } diff --git a/python/basicblock.py b/python/basicblock.py index 1d932c5e..4dc783c3 100644 --- a/python/basicblock.py +++ b/python/basicblock.py @@ -256,6 +256,21 @@ class BasicBlock(object): def highlight(self, value): self.set_user_highlight(value) + @property + def is_il(self): + """Whether the basic block contains IL""" + return core.BNIsILBasicBlock(self.handle) + + @property + def is_low_level_il(self): + """Whether the basic block contains Low Level IL""" + return core.BNIsLowLevelILBasicBlock(self.handle) + + @property + def is_medium_level_il(self): + """Whether the basic block contains Medium Level IL""" + return core.BNIsMediumLevelILBasicBlock(self.handle) + @classmethod def get_iterated_dominance_frontier(self, blocks): if len(blocks) == 0: @@ -322,6 +337,10 @@ class BasicBlock(object): result = [] for i in xrange(0, count.value): addr = lines[i].addr + if (lines[i].instrIndex != 0xffffffffffffffff) and hasattr(self, 'il_function'): + il_instr = self.il_function[lines[i].instrIndex] + else: + il_instr = None tokens = [] for j in xrange(0, lines[i].count): token_type = InstructionTextTokenType(lines[i].tokens[j].type) @@ -333,7 +352,7 @@ class BasicBlock(object): confidence = lines[i].tokens[j].confidence address = lines[i].tokens[j].address tokens.append(function.InstructionTextToken(token_type, text, value, size, operand, context, address, confidence)) - result.append(function.DisassemblyTextLine(addr, tokens)) + result.append(function.DisassemblyTextLine(addr, tokens, il_instr)) core.BNFreeDisassemblyTextLines(lines, count.value) return result diff --git a/python/function.py b/python/function.py index 1cc4dcac..6db44e6d 100644 --- a/python/function.py +++ b/python/function.py @@ -1598,9 +1598,10 @@ class AdvancedFunctionAnalysisDataRequestor(object): class DisassemblyTextLine(object): - def __init__(self, addr, tokens): + def __init__(self, addr, tokens, il_instr = None): self.address = addr self.tokens = tokens + self.il_instruction = il_instr def __str__(self): result = "" @@ -1625,8 +1626,9 @@ class FunctionGraphEdge(object): class FunctionGraphBlock(object): - def __init__(self, handle): + def __init__(self, handle, graph): self.handle = handle + self.graph = graph def __del__(self): core.BNFreeFunctionGraphBlock(self.handle) @@ -1645,13 +1647,22 @@ class FunctionGraphBlock(object): def basic_block(self): """Basic block associated with this part of the function graph (read-only)""" block = core.BNGetFunctionGraphBasicBlock(self.handle) - func = core.BNGetBasicBlockFunction(block) - if func is None: + func_handle = core.BNGetBasicBlockFunction(block) + if func_handle is None: core.BNFreeBasicBlock(block) - block = None + return None + + view = binaryview.BinaryView(handle = core.BNGetFunctionData(func_handle)) + func = Function(view, func_handle) + + if core.BNIsLowLevelILBasicBlock(block): + block = lowlevelil.LowLevelILBasicBlock(view, block, + lowlevelil.LowLevelILFunction(func.arch, core.BNGetBasicBlockLowLevelILFunction(block), func)) + elif core.BNIsMediumLevelILBasicBlock(block): + block = mediumlevelil.MediumLevelILBasicBlock(view, block, + mediumlevelil.MediumLevelILFunction(func.arch, core.BNGetBasicBlockMediumLevelILFunction(block), func)) else: - block = basicblock.BasicBlock(binaryview.BinaryView(handle = core.BNGetFunctionData(func)), block) - core.BNFreeFunction(func) + block = basicblock.BasicBlock(view, block) return block @property @@ -1697,9 +1708,14 @@ class FunctionGraphBlock(object): """Function graph block list of lines (read-only)""" count = ctypes.c_ulonglong() lines = core.BNGetFunctionGraphBlockLines(self.handle, count) + block = self.basic_block result = [] for i in xrange(0, count.value): addr = lines[i].addr + if (lines[i].instrIndex != 0xffffffffffffffff) and hasattr(block, 'il_function'): + il_instr = block.il_function[lines[i].instrIndex] + else: + il_instr = None tokens = [] for j in xrange(0, lines[i].count): token_type = InstructionTextTokenType(lines[i].tokens[j].type) @@ -1711,7 +1727,7 @@ class FunctionGraphBlock(object): confidence = lines[i].tokens[j].confidence address = lines[i].tokens[j].address tokens.append(InstructionTextToken(token_type, text, value, size, operand, context, address, confidence)) - result.append(DisassemblyTextLine(addr, tokens)) + result.append(DisassemblyTextLine(addr, tokens, il_instr)) core.BNFreeDisassemblyTextLines(lines, count.value) return result @@ -1756,9 +1772,14 @@ class FunctionGraphBlock(object): def __iter__(self): count = ctypes.c_ulonglong() lines = core.BNGetFunctionGraphBlockLines(self.handle, count) + block = self.basic_block try: for i in xrange(0, count.value): addr = lines[i].addr + if (lines[i].instrIndex != 0xffffffffffffffff) and hasattr(block, 'il_function'): + il_instr = block.il_function[lines[i].instrIndex] + else: + il_instr = None tokens = [] for j in xrange(0, lines[i].count): token_type = InstructionTextTokenType(lines[i].tokens[j].type) @@ -1770,7 +1791,7 @@ class FunctionGraphBlock(object): confidence = lines[i].tokens[j].confidence address = lines[i].tokens[j].address tokens.append(InstructionTextToken(token_type, text, value, size, operand, context, address, confidence)) - yield DisassemblyTextLine(addr, tokens) + yield DisassemblyTextLine(addr, tokens, il_instr) finally: core.BNFreeDisassemblyTextLines(lines, count.value) @@ -1858,7 +1879,7 @@ class FunctionGraph(object): blocks = core.BNGetFunctionGraphBlocks(self.handle, count) result = [] for i in xrange(0, count.value): - result.append(FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i]))) + result.append(FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i]), self)) core.BNFreeFunctionGraphBlockList(blocks, count.value) return result @@ -1897,6 +1918,32 @@ class FunctionGraph(object): def settings(self): return DisassemblySettings(core.BNGetFunctionGraphSettings(self.handle)) + @property + def is_il(self): + return core.BNIsILFunctionGraph(self.handle) + + @property + def is_low_level_il(self): + return core.BNIsLowLevelILFunctionGraph(self.handle) + + @property + def is_medium_level_il(self): + return core.BNIsMediumLevelILFunctionGraph(self.handle) + + @property + def il_function(self): + if self.is_low_level_il: + il_func = core.BNGetFunctionGraphLowLevelILFunction(self.handle) + if not il_func: + return None + return lowlevelil.LowLevelILFunction(self.function.arch, il_func, self.function) + if self.is_medium_level_il: + il_func = core.BNGetFunctionGraphMediumLevelILFunction(self.handle) + if not il_func: + return None + return mediumlevelil.MediumLevelILFunction(self.function.arch, il_func, self.function) + return None + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -1911,7 +1958,7 @@ class FunctionGraph(object): blocks = core.BNGetFunctionGraphBlocks(self.handle, count) try: for i in xrange(0, count.value): - yield FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i])) + yield FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i]), self) finally: core.BNFreeFunctionGraphBlockList(blocks, count.value) @@ -1954,7 +2001,7 @@ class FunctionGraph(object): blocks = core.BNGetFunctionGraphBlocksInRegion(self.handle, left, top, right, bottom, count) result = [] for i in xrange(0, count.value): - result.append(FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i]))) + result.append(FunctionGraphBlock(core.BNNewFunctionGraphBlockReference(blocks[i]), self)) core.BNFreeFunctionGraphBlockList(blocks, count.value) return result diff --git a/python/plugin.py b/python/plugin.py index e0054d86..c6cd9fc0 100644 --- a/python/plugin.py +++ b/python/plugin.py @@ -30,6 +30,8 @@ import filemetadata import binaryview import function import log +import lowlevelil +import mediumlevelil class PluginCommandContext(object): @@ -38,6 +40,7 @@ class PluginCommandContext(object): self.address = 0 self.length = 0 self.function = None + self.instruction = None class _PluginCommandMetaClass(type): @@ -117,6 +120,50 @@ class PluginCommand(object): except: log.log_error(traceback.format_exc()) + @classmethod + def _low_level_il_function_action(cls, view, func, action): + try: + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetLowLevelILOwnerFunction(func)) + func_obj = lowlevelil.LowLevelILFunction(owner.arch, core.BNNewLowLevelILFunctionReference(func), owner) + action(view_obj, func_obj) + except: + log.log_error(traceback.format_exc()) + + @classmethod + def _low_level_il_instruction_action(cls, view, func, instr, action): + try: + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetLowLevelILOwnerFunction(func)) + func_obj = lowlevelil.LowLevelILFunction(owner.arch, core.BNNewLowLevelILFunctionReference(func), owner) + action(view_obj, func_obj[instr]) + except: + log.log_error(traceback.format_exc()) + + @classmethod + def _medium_level_il_function_action(cls, view, func, action): + try: + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetMediumLevelILOwnerFunction(func)) + func_obj = mediumlevelil.MediumLevelILFunction(owner.arch, core.BNNewMediumLevelILFunctionReference(func), owner) + action(view_obj, func_obj) + except: + log.log_error(traceback.format_exc()) + + @classmethod + def _medium_level_il_instruction_action(cls, view, func, instr, action): + try: + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetMediumLevelILOwnerFunction(func)) + func_obj = mediumlevelil.MediumLevelILFunction(owner.arch, core.BNNewMediumLevelILFunctionReference(func), owner) + action(view_obj, func_obj[instr]) + except: + log.log_error(traceback.format_exc()) + @classmethod def _default_is_valid(cls, view, is_valid): try: @@ -166,6 +213,62 @@ class PluginCommand(object): log.log_error(traceback.format_exc()) return False + @classmethod + def _low_level_il_function_is_valid(cls, view, func, is_valid): + try: + if is_valid is None: + return True + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetLowLevelILOwnerFunction(func)) + func_obj = lowlevelil.LowLevelILFunction(owner.arch, core.BNNewLowLevelILFunctionReference(func), owner) + return is_valid(view_obj, func_obj) + except: + log.log_error(traceback.format_exc()) + return False + + @classmethod + def _low_level_il_instruction_is_valid(cls, view, func, instr, is_valid): + try: + if is_valid is None: + return True + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetLowLevelILOwnerFunction(func)) + func_obj = lowlevelil.LowLevelILFunction(owner.arch, core.BNNewLowLevelILFunctionReference(func), owner) + return is_valid(view_obj, func_obj[instr]) + except: + log.log_error(traceback.format_exc()) + return False + + @classmethod + def _medium_level_il_function_is_valid(cls, view, func, is_valid): + try: + if is_valid is None: + return True + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetMediumLevelILOwnerFunction(func)) + func_obj = mediumlevelil.MediumLevelILFunction(owner.arch, core.BNNewMediumLevelILFunctionReference(func), owner) + return is_valid(view_obj, func_obj) + except: + log.log_error(traceback.format_exc()) + return False + + @classmethod + def _medium_level_il_instruction_is_valid(cls, view, func, instr, is_valid): + try: + if is_valid is None: + return True + file_metadata = filemetadata.FileMetadata(handle = core.BNGetFileForView(view)) + view_obj = binaryview.BinaryView(file_metadata = file_metadata, handle = core.BNNewViewReference(view)) + owner = function.Function(view_obj, core.BNGetMediumLevelILOwnerFunction(func)) + func_obj = mediumlevelil.MediumLevelILFunction(owner.arch, core.BNNewMediumLevelILFunctionReference(func), owner) + return is_valid(view_obj, func_obj[instr]) + except: + log.log_error(traceback.format_exc()) + return False + @classmethod def register(cls, name, description, action, is_valid = None): """ @@ -242,6 +345,82 @@ class PluginCommand(object): cls._registered_commands.append((action_obj, is_valid_obj)) core.BNRegisterPluginCommandForFunction(name, description, action_obj, is_valid_obj, None) + @classmethod + def register_for_low_level_il_function(cls, name, description, action, is_valid = None): + """ + ``register_for_low_level_il_function`` Register a plugin to be called with a low level IL function argument + + :param str name: name of the plugin + :param str description: description of the plugin + :param action: function to call with the ``BinaryView`` and a ``LowLevelILFunction`` as arguments + :param is_valid: optional argument of a function passed a ``BinaryView`` to determine whether the plugin should be enabled for that view + :rtype: None + + .. warning:: Calling ``register_for_low_level_il_function`` with the same function name will replace the existing function but will leak the memory of the original plugin. + """ + startup._init_plugins() + action_obj = ctypes.CFUNCTYPE(None, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNLowLevelILFunction))(lambda ctxt, view, func: cls._low_level_il_function_action(view, func, action)) + is_valid_obj = ctypes.CFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNLowLevelILFunction))(lambda ctxt, view, func: cls._low_level_il_function_is_valid(view, func, is_valid)) + cls._registered_commands.append((action_obj, is_valid_obj)) + core.BNRegisterPluginCommandForLowLevelILFunction(name, description, action_obj, is_valid_obj, None) + + @classmethod + def register_for_low_level_il_instruction(cls, name, description, action, is_valid = None): + """ + ``register_for_low_level_il_instruction`` Register a plugin to be called with a low level IL instruction argument + + :param str name: name of the plugin + :param str description: description of the plugin + :param action: function to call with the ``BinaryView`` and a ``LowLevelILInstruction`` as arguments + :param is_valid: optional argument of a function passed a ``BinaryView`` to determine whether the plugin should be enabled for that view + :rtype: None + + .. warning:: Calling ``register_for_low_level_il_instruction`` with the same function name will replace the existing function but will leak the memory of the original plugin. + """ + startup._init_plugins() + action_obj = ctypes.CFUNCTYPE(None, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNLowLevelILFunction), ctypes.c_ulonglong)(lambda ctxt, view, func, instr: cls._low_level_il_instruction_action(view, func, instr, action)) + is_valid_obj = ctypes.CFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNLowLevelILFunction), ctypes.c_ulonglong)(lambda ctxt, view, func, instr: cls._low_level_il_instruction_is_valid(view, func, instr, is_valid)) + cls._registered_commands.append((action_obj, is_valid_obj)) + core.BNRegisterPluginCommandForLowLevelILInstruction(name, description, action_obj, is_valid_obj, None) + + @classmethod + def register_for_medium_level_il_function(cls, name, description, action, is_valid = None): + """ + ``register_for_medium_level_il_function`` Register a plugin to be called with a medium level IL function argument + + :param str name: name of the plugin + :param str description: description of the plugin + :param action: function to call with the ``BinaryView`` and a ``MediumLevelILFunction`` as arguments + :param is_valid: optional argument of a function passed a ``BinaryView`` to determine whether the plugin should be enabled for that view + :rtype: None + + .. warning:: Calling ``register_for_medium_level_il_function`` with the same function name will replace the existing function but will leak the memory of the original plugin. + """ + startup._init_plugins() + action_obj = ctypes.CFUNCTYPE(None, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNMediumLevelILFunction))(lambda ctxt, view, func: cls._medium_level_il_function_action(view, func, action)) + is_valid_obj = ctypes.CFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNMediumLevelILFunction))(lambda ctxt, view, func: cls._medium_level_il_function_is_valid(view, func, is_valid)) + cls._registered_commands.append((action_obj, is_valid_obj)) + core.BNRegisterPluginCommandForMediumLevelILFunction(name, description, action_obj, is_valid_obj, None) + + @classmethod + def register_for_medium_level_il_instruction(cls, name, description, action, is_valid = None): + """ + ``register_for_medium_level_il_instruction`` Register a plugin to be called with a medium level IL instruction argument + + :param str name: name of the plugin + :param str description: description of the plugin + :param action: function to call with the ``BinaryView`` and a ``MediumLevelILInstruction`` as arguments + :param is_valid: optional argument of a function passed a ``BinaryView`` to determine whether the plugin should be enabled for that view + :rtype: None + + .. warning:: Calling ``register_for_medium_level_il_instruction`` with the same function name will replace the existing function but will leak the memory of the original plugin. + """ + startup._init_plugins() + action_obj = ctypes.CFUNCTYPE(None, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNMediumLevelILFunction), ctypes.c_ulonglong)(lambda ctxt, view, func, instr: cls._medium_level_il_instruction_action(view, func, instr, action)) + is_valid_obj = ctypes.CFUNCTYPE(ctypes.c_bool, ctypes.c_void_p, ctypes.POINTER(core.BNBinaryView), ctypes.POINTER(core.BNMediumLevelILFunction), ctypes.c_ulonglong)(lambda ctxt, view, func, instr: cls._medium_level_il_instruction_is_valid(view, func, instr, is_valid)) + cls._registered_commands.append((action_obj, is_valid_obj)) + core.BNRegisterPluginCommandForMediumLevelILInstruction(name, description, action_obj, is_valid_obj, None) + @classmethod def get_valid_list(cls, context): """Dict of registered plugins""" @@ -275,6 +454,36 @@ class PluginCommand(object): if not self.command.functionIsValid: return True return self.command.functionIsValid(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.LowLevelILFunctionPluginCommand: + if context.function is None: + return False + if not self.command.lowLevelILFunctionIsValid: + return True + return self.command.lowLevelILFunctionIsValid(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.LowLevelILInstructionPluginCommand: + if context.instruction is None: + return False + if not isinstance(context.instruction, lowlevelil.LowLevelILInstruction): + return False + if not self.command.lowLevelILInstructionIsValid: + return True + return self.command.lowLevelILInstructionIsValid(self.command.context, context.view.handle, + context.instruction.function.handle, context.instruction.instr_index) + elif self.command.type == PluginCommandType.MediumLevelILFunctionPluginCommand: + if context.function is None: + return False + if not self.command.mediumLevelILFunctionIsValid: + return True + return self.command.mediumLevelILFunctionIsValid(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.MediumLevelILInstructionPluginCommand: + if context.instruction is None: + return False + if not isinstance(context.instruction, mediumlevelil.MediumLevelILInstruction): + return False + if not self.command.mediumLevelILInstructionIsValid: + return True + return self.command.mediumLevelILInstructionIsValid(self.command.context, context.view.handle, + context.instruction.function.handle, context.instruction.instr_index) return False def execute(self, context): @@ -288,6 +497,16 @@ class PluginCommand(object): self.command.rangeCommand(self.command.context, context.view.handle, context.address, context.length) elif self.command.type == PluginCommandType.FunctionPluginCommand: self.command.functionCommand(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.LowLevelILFunctionPluginCommand: + self.command.lowLevelILFunctionCommand(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.LowLevelILInstructionPluginCommand: + self.command.lowLevelILInstructionCommand(self.command.context, context.view.handle, + context.instruction.function.handle, context.instruction.instr_index) + elif self.command.type == PluginCommandType.MediumLevelILFunctionPluginCommand: + self.command.mediumLevelILFunctionCommand(self.command.context, context.view.handle, context.function.handle) + elif self.command.type == PluginCommandType.MediumLevelILInstructionPluginCommand: + self.command.mediumLevelILInstructionCommand(self.command.context, context.view.handle, + context.instruction.function.handle, context.instruction.instr_index) def __repr__(self): return "" % self.name -- cgit v1.3.1