From 7f08117cfeb48a8f48d08e14cb498ee028efcef2 Mon Sep 17 00:00:00 2001
From: Zichuan Li <34680029+river-li@users.noreply.github.com>
Date: Thu, 15 Aug 2024 11:53:05 -0400
Subject: Move EFI Resolver to API

Support all existing features in EFI Resolver,
1. Doesn't support running on existing BNDBs (though we tried to support
this in python plugins, it doesn't work well)
2. Perform analysis on MLIL rather than HLIL, previous pattern matching
on HLIL constains many false negatives
---
 platform/efi/efi_resolver/include/Resolver.h | 76 ++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 platform/efi/efi_resolver/include/Resolver.h

(limited to 'platform/efi/efi_resolver/include/Resolver.h')

diff --git a/platform/efi/efi_resolver/include/Resolver.h b/platform/efi/efi_resolver/include/Resolver.h
new file mode 100644
index 00000000..7bbd3b99
--- /dev/null
+++ b/platform/efi/efi_resolver/include/Resolver.h
@@ -0,0 +1,76 @@
+#pragma once
+
+#include <fstream>
+#include <thread>
+
+#include "GuidRenderer.h"
+#include "ModuleType.h"
+#include "TypePropagation.h"
+#include "binaryninjaapi.h"
+#include "highlevelilinstruction.h"
+#include "lowlevelilinstruction.h"
+#include "mediumlevelilinstruction.h"
+
+using namespace BinaryNinja;
+using namespace std;
+
+typedef array<uint8_t, 16> EFI_GUID;
+
+class Resolver {
+protected:
+    Ref<BinaryView> m_view;
+    Ref<BackgroundTask> m_task;
+    size_t m_width;
+    map<EFI_GUID, pair<string, string>> m_protocol;
+    map<EFI_GUID, string> m_user_guids;
+
+    vector<pair<uint64_t, string>> m_service_usages;
+    vector<pair<uint64_t, string>> m_protocol_usages;
+    vector<pair<uint64_t, EFI_GUID>> m_guid_usages;
+    vector<pair<uint64_t, string>> m_variable_usages;
+
+    bool parseUserGuidIfExists(const string& filePath);
+    bool parseProtocolMapping(const string& filePath);
+
+    /*!
+    For backward compatibility, if a user saved a bndb with older version Binary Ninja
+    this function will try to retrieve types from Platform Types if it doesn't find one
+    in BinaryView
+    */
+    Ref<Type> GetTypeFromViewAndPlatform(string type_name);
+    void initProtocolMapping();
+
+public:
+    bool setModuleEntry(EFIModuleType fileType);
+    bool resolveGuidInterface(Ref<Function> func, uint64_t addr, int guid_pos, int interface_pos);
+    Resolver(Ref<BinaryView> view, Ref<BackgroundTask> task);
+
+    pair<string, string> lookupGuid(EFI_GUID guidBytes);
+    pair<string, string> defineAndLookupGuid(uint64_t addr);
+
+    string nonConflictingName(const string& basename);
+    static string nonConflictingLocalName(Ref<Function> func, const string& basename);
+
+    /*!
+    Define the structure used at the callsite with type `typeName`, propagate it to the data section. If it's a structure type, define it fields
+    according to the `followFields` parameter. The input `addr` should be a call instruction
+    \param func the function that contains the callsite (it's parent function)
+    \param addr address of the callsite
+    \param typeName the type that need to define
+    \param paramIdx the parameter index that want to define
+    \param followFields whether to define the structure's fields if they are pointers
+    \return False if failed
+
+    \b Example:
+    \code{.cpp}
+    refs = bv->GetCodeReferencesForType(QualifiedName("EFI_GET_VARIABLE"));
+    for (auto ref : refs)
+    {
+        // ... some checking, need to make sure is a call instruction
+        bool ok = defineTypeAtCallsite(ref.func, ref.addr, "EFI_GUID", 2, false);
+    }
+    \endcode
+    */
+    bool defineTypeAtCallsite(Ref<Function> func, uint64_t addr, string typeName, int paramIdx, bool followFields = false);
+    vector<HighLevelILInstruction> HighLevelILExprsAt(Ref<Function> func, Ref<Architecture> arch, uint64_t addr);
+};
\ No newline at end of file
-- 
cgit v1.3.1