From c687ea8692ee553476280ee5b621e861b627fa80 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 22 Feb 2017 00:24:14 -0500 Subject: Add SSA form APIs --- python/lowlevelil.py | 54 +++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 49 insertions(+), 5 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/python/lowlevelil.py b/python/lowlevelil.py index c80fcd0d..3ce55793 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -110,7 +110,26 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_TRAP: [("value", "int")], LowLevelILOperation.LLIL_UNDEF: [], LowLevelILOperation.LLIL_UNIMPL: [], - LowLevelILOperation.LLIL_UNIMPL_MEM: [("src", "expr")] + LowLevelILOperation.LLIL_UNIMPL_MEM: [("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_SSA: [("dest", "reg"), ("index", "int"), ("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_SSA_PARTIAL: [("full_reg", "reg"), ("index", "int"), ("dest", "reg"), ("src", "expr")], + LowLevelILOperation.LLIL_SET_REG_SPLIT_SSA: [("hi", "expr"), ("lo", "expr"), ("src", "expr")], + LowLevelILOperation.LLIL_REG_SPLIT_DEST_SSA: [("dest", "reg", "index", "int")], + LowLevelILOperation.LLIL_REG_SSA: [("src", "reg"), ("index", "int")], + LowLevelILOperation.LLIL_REG_SSA_PARTIAL: [("full_reg", "reg"), ("index", "int"), ("src", "reg")], + LowLevelILOperation.LLIL_SET_FLAG_SSA: [("dest", "flag"), ("index", "int"), ("src", "expr")], + LowLevelILOperation.LLIL_FLAG_SSA: [("src", "flag"), ("index", "int")], + LowLevelILOperation.LLIL_FLAG_BIT_SSA: [("src", "flag"), ("index", "int"), ("bit", "int")], + LowLevelILOperation.LLIL_CALL_SSA: [("output", "expr"), ("dest", "expr"), ("stack", "expr"), ("param", "expr")], + LowLevelILOperation.LLIL_SYSCALL_SSA: [("output", "expr"), ("stack", "expr"), ("param", "expr")], + LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "reg_ssa_list")], + LowLevelILOperation.LLIL_CALL_STACK_SSA: [("src", "reg"), ("index", "int"), ("src_memory", "int")], + LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("dest", "reg_ssa_list")], + LowLevelILOperation.LLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], + LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], + LowLevelILOperation.LLIL_REG_PHI: [("dest", "reg"), ("index", "int"), ("src", "reg_ssa_list")], + LowLevelILOperation.LLIL_FLAG_PHI: [("dest", "reg"), ("index", "int"), ("src", "flag_ssa_list")], + LowLevelILOperation.LLIL_MEM_PHI: [("dest_memory", "int"), ("src_memory", "int_list")] } def __init__(self, func, expr_index, instr_index=None): @@ -142,16 +161,41 @@ class LowLevelILInstruction(object): else: value = func.arch.get_reg_name(instr.operands[i]) elif operand_type == "flag": - value = func.arch.get_flag_name(instr.operands[i]) + if (instr.operands[i] & 0x80000000) != 0: + value = instr.operands[i] + else: + value = func.arch.get_flag_name(instr.operands[i]) elif operand_type == "cond": value = LowLevelILFlagCondition(instr.operands[i]) elif operand_type == "int_list": count = ctypes.c_ulonglong() - operands = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) value = [] for i in xrange(count.value): - value.append(operands[i]) - core.BNLowLevelILFreeOperandList(operands) + value.append(operand_list[i]) + core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "reg_ssa_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + value = [] + for i in xrange(count.value / 2): + reg = operand_list[i * 2] + reg_index = operand_list[(i * 2) + 1] + if (reg & 0x80000000) == 0: + reg = func.arch.get_reg_name(reg) + value.append((reg, reg_index)) + core.BNLowLevelILFreeOperandList(operand_list) + elif operand_type == "flag_ssa_list": + count = ctypes.c_ulonglong() + operand_list = core.BNLowLevelILGetOperandList(func.handle, self.expr_index, i, count) + value = [] + for i in xrange(count.value / 2): + flag = operand_list[i * 2] + flag_index = operand_list[(i * 2) + 1] + if (flag & 0x80000000) == 0: + flag = func.arch.get_flag_name(flag) + value.append((flag, flag_index)) + core.BNLowLevelILFreeOperandList(operand_list) self.operands.append(value) self.__dict__[name] = value -- cgit v1.3.1 From dbe5606575f6b59b82eff2f9ab7b41990b57147e Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 23 Feb 2017 18:34:03 -0500 Subject: Instruction starts and SSA form are a property of IL functions --- binaryninjaapi.h | 6 ++++-- binaryninjacore.h | 8 ++++++-- function.cpp | 6 ------ lowlevelil.cpp | 19 +++++++++++++++++-- python/function.py | 5 ----- python/lowlevelil.py | 23 ++++++++++++++++++++++- 6 files changed, 49 insertions(+), 18 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 188471b3..9d81b198 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1887,7 +1887,6 @@ namespace BinaryNinja void SetCommentForAddress(uint64_t addr, const std::string& comment); Ref GetLowLevelIL() const; - Ref GetLowLevelILSSAForm() const; size_t GetLowLevelILForInstruction(Architecture* arch, uint64_t addr); std::vector GetLowLevelILExitsForInstruction(Architecture* arch, uint64_t addr); RegisterValue GetRegisterValueAtInstruction(Architecture* arch, uint64_t addr, uint32_t reg); @@ -2057,7 +2056,8 @@ namespace BinaryNinja LowLevelILFunction(BNLowLevelILFunction* func); uint64_t GetCurrentAddress() const; - void SetCurrentAddress(uint64_t addr); + void SetCurrentAddress(Architecture* arch, uint64_t addr); + size_t GetInstructionStart(Architecture* arch, uint64_t addr); void ClearIndirectBranches(); void SetIndirectBranches(const std::vector& branches); @@ -2158,6 +2158,8 @@ namespace BinaryNinja uint32_t GetTemporaryFlagCount(); std::vector> GetBasicBlocks() const; + + Ref GetSSAForm() const; }; class FunctionRecognizer diff --git a/binaryninjacore.h b/binaryninjacore.h index c1e7d6f9..e95f2bf3 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -1694,7 +1694,6 @@ extern "C" BINARYNINJACOREAPI BNBasicBlock** BNGetBasicBlocksStartingAtAddress(BNBinaryView* view, uint64_t addr, size_t* count); BINARYNINJACOREAPI BNLowLevelILFunction* BNGetFunctionLowLevelIL(BNFunction* func); - BINARYNINJACOREAPI BNLowLevelILFunction* BNGetFunctionLowLevelILSSAForm(BNFunction* func); BINARYNINJACOREAPI size_t BNGetLowLevelILForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr); BINARYNINJACOREAPI size_t* BNGetLowLevelILExitsForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, size_t* count); @@ -1977,7 +1976,10 @@ extern "C" BINARYNINJACOREAPI BNLowLevelILFunction* BNNewLowLevelILFunctionReference(BNLowLevelILFunction* func); BINARYNINJACOREAPI void BNFreeLowLevelILFunction(BNLowLevelILFunction* func); BINARYNINJACOREAPI uint64_t BNLowLevelILGetCurrentAddress(BNLowLevelILFunction* func); - BINARYNINJACOREAPI void BNLowLevelILSetCurrentAddress(BNLowLevelILFunction* func, uint64_t addr); + BINARYNINJACOREAPI void BNLowLevelILSetCurrentAddress(BNLowLevelILFunction* func, + BNArchitecture* arch, uint64_t addr); + BINARYNINJACOREAPI size_t BNLowLevelILGetInstructionStart(BNLowLevelILFunction* func, + BNArchitecture* arch, uint64_t addr); BINARYNINJACOREAPI void BNLowLevelILClearIndirectBranches(BNLowLevelILFunction* func); BINARYNINJACOREAPI void BNLowLevelILSetIndirectBranches(BNLowLevelILFunction* func, BNArchitectureAndAddress* branches, size_t count); @@ -2015,6 +2017,8 @@ extern "C" BINARYNINJACOREAPI BNBasicBlock** BNGetLowLevelILBasicBlockList(BNLowLevelILFunction* func, size_t* count); + BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILSSAForm(BNLowLevelILFunction* func); + // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); BINARYNINJACOREAPI BNType* BNCreateBoolType(void); diff --git a/function.cpp b/function.cpp index d8a5a4a7..b1d008ee 100644 --- a/function.cpp +++ b/function.cpp @@ -147,12 +147,6 @@ Ref Function::GetLowLevelIL() const } -Ref Function::GetLowLevelILSSAForm() const -{ - return new LowLevelILFunction(BNGetFunctionLowLevelILSSAForm(m_object)); -} - - size_t Function::GetLowLevelILForInstruction(Architecture* arch, uint64_t addr) { return BNGetLowLevelILForInstruction(m_object, arch->GetObject(), addr); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index bf3b980e..1a353b51 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -48,9 +48,15 @@ uint64_t LowLevelILFunction::GetCurrentAddress() const } -void LowLevelILFunction::SetCurrentAddress(uint64_t addr) +void LowLevelILFunction::SetCurrentAddress(Architecture* arch, uint64_t addr) { - BNLowLevelILSetCurrentAddress(m_object, addr); + BNLowLevelILSetCurrentAddress(m_object, arch ? arch->GetObject() : nullptr, addr); +} + + +size_t LowLevelILFunction::GetInstructionStart(Architecture* arch, uint64_t addr) +{ + return BNLowLevelILGetInstructionStart(m_object, arch ? arch->GetObject() : nullptr, addr); } @@ -643,3 +649,12 @@ vector> LowLevelILFunction::GetBasicBlocks() const BNFreeBasicBlockList(blocks, count); return result; } + + +Ref LowLevelILFunction::GetSSAForm() const +{ + BNLowLevelILFunction* func = BNGetLowLevelILSSAForm(m_object); + if (!func) + return nullptr; + return new LowLevelILFunction(func); +} diff --git a/python/function.py b/python/function.py index 47099395..86c93bf7 100644 --- a/python/function.py +++ b/python/function.py @@ -292,11 +292,6 @@ class Function(object): """Function low level IL (read-only)""" return lowlevelil.LowLevelILFunction(self.arch, core.BNGetFunctionLowLevelIL(self.handle), self) - @property - def low_level_il_ssa_form(self): - """Function low level IL in SSA form (read-only)""" - return lowlevelil.LowLevelILFunction(self.arch, core.BNGetFunctionLowLevelILSSAForm(self.handle), self) - @property def lifted_il(self): """Function lifted IL (read-only)""" diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 3ce55793..390e4210 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -314,7 +314,12 @@ class LowLevelILFunction(object): @current_address.setter def current_address(self, value): - core.BNLowLevelILSetCurrentAddress(self.handle, value) + core.BNLowLevelILSetCurrentAddress(self.handle, self.arch.handle, value) + + def set_current_address(self, value, arch = None): + if arch is None: + arch = self.arch + core.BNLowLevelILSetCurrentAddress(self.handle, arch.handle, value) @property def temp_reg_count(self): @@ -340,6 +345,14 @@ class LowLevelILFunction(object): core.BNFreeBasicBlockList(blocks, count.value) return result + @property + def ssa_form(self): + """Low level IL in SSA form (read-only)""" + result = core.BNGetLowLevelILSSAForm(self.handle) + if not result: + return None + return LowLevelILFunction(self.arch, result, self.source_function) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -373,6 +386,14 @@ class LowLevelILFunction(object): finally: core.BNFreeBasicBlockList(blocks, count.value) + def get_instruction_start(self, addr, arch = None): + if arch is None: + arch = self.arch + result = core.BNLowLevelILGetInstructionStart(self.handle, arch.handle, addr) + if result >= core.BNGetLowLevelILInstructionCount(self.handle): + return None + return result + def clear_indirect_branches(self): core.BNLowLevelILClearIndirectBranches(self.handle) -- cgit v1.3.1 From ba4bb6dbee0476d5c30d942ae978621af790d518 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 23 Feb 2017 22:56:47 -0500 Subject: Add APIs for definitions and uses of SSA variables --- binaryninjaapi.h | 10 +++++++ binaryninjacore.h | 12 ++++++++ lowlevelil.cpp | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++ python/lowlevelil.py | 59 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 162 insertions(+) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 9d81b198..9bdaf5f5 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2160,6 +2160,16 @@ namespace BinaryNinja std::vector> GetBasicBlocks() const; Ref GetSSAForm() const; + Ref GetNonSSAForm() const; + size_t GetSSAInstructionIndex(size_t instr) const; + size_t GetNonSSAInstructionIndex(size_t instr) const; + + size_t GetSSARegisterDefinition(uint32_t reg, size_t idx) const; + size_t GetSSAFlagDefinition(uint32_t flag, size_t idx) const; + size_t GetSSAMemoryDefinition(size_t idx) const; + std::set GetSSARegisterUses(uint32_t reg, size_t idx) const; + std::set GetSSAFlagUses(uint32_t flag, size_t idx) const; + std::set GetSSAMemoryUses(size_t idx) const; }; class FunctionRecognizer diff --git a/binaryninjacore.h b/binaryninjacore.h index e95f2bf3..f7fb2172 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2018,6 +2018,18 @@ extern "C" BINARYNINJACOREAPI BNBasicBlock** BNGetLowLevelILBasicBlockList(BNLowLevelILFunction* func, size_t* count); BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILSSAForm(BNLowLevelILFunction* func); + BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILNonSSAForm(BNLowLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetLowLevelILSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr); + + BINARYNINJACOREAPI size_t BNGetLowLevelILSSARegisterDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx); + BINARYNINJACOREAPI size_t BNGetLowLevelILSSAFlagDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx); + BINARYNINJACOREAPI size_t BNGetLowLevelILSSAMemoryDefinition(BNLowLevelILFunction* func, size_t idx); + BINARYNINJACOREAPI size_t* BNGetLowLevelILSSARegisterUses(BNLowLevelILFunction* func, uint32_t reg, size_t idx, + size_t* count); + BINARYNINJACOREAPI size_t* BNGetLowLevelILSSAFlagUses(BNLowLevelILFunction* func, uint32_t reg, size_t idx, + size_t* count); + BINARYNINJACOREAPI size_t* BNGetLowLevelILSSAMemoryUses(BNLowLevelILFunction* func, size_t idx, size_t* count); // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 1a353b51..d09db62c 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -658,3 +658,84 @@ Ref LowLevelILFunction::GetSSAForm() const return nullptr; return new LowLevelILFunction(func); } + + +Ref LowLevelILFunction::GetNonSSAForm() const +{ + BNLowLevelILFunction* func = BNGetLowLevelILNonSSAForm(m_object); + if (!func) + return nullptr; + return new LowLevelILFunction(func); +} + + +size_t LowLevelILFunction::GetSSAInstructionIndex(size_t instr) const +{ + return BNGetLowLevelILNonSSAInstructionIndex(m_object, instr); +} + + +size_t LowLevelILFunction::GetNonSSAInstructionIndex(size_t instr) const +{ + return BNGetLowLevelILNonSSAInstructionIndex(m_object, instr); +} + + +size_t LowLevelILFunction::GetSSARegisterDefinition(uint32_t reg, size_t idx) const +{ + return BNGetLowLevelILSSARegisterDefinition(m_object, reg, idx); +} + + +size_t LowLevelILFunction::GetSSAFlagDefinition(uint32_t flag, size_t idx) const +{ + return BNGetLowLevelILSSAFlagDefinition(m_object, flag, idx); +} + + +size_t LowLevelILFunction::GetSSAMemoryDefinition(size_t idx) const +{ + return BNGetLowLevelILSSAMemoryDefinition(m_object, idx); +} + + +set LowLevelILFunction::GetSSARegisterUses(uint32_t reg, size_t idx) const +{ + size_t count; + size_t* instrs = BNGetLowLevelILSSARegisterUses(m_object, reg, idx, &count); + + set result; + for (size_t i = 0; i < count; i++) + result.insert(instrs[i]); + + BNFreeLowLevelILInstructionList(instrs); + return result; +} + + +set LowLevelILFunction::GetSSAFlagUses(uint32_t flag, size_t idx) const +{ + size_t count; + size_t* instrs = BNGetLowLevelILSSAFlagUses(m_object, flag, idx, &count); + + set result; + for (size_t i = 0; i < count; i++) + result.insert(instrs[i]); + + BNFreeLowLevelILInstructionList(instrs); + return result; +} + + +set LowLevelILFunction::GetSSAMemoryUses(size_t idx) const +{ + size_t count; + size_t* instrs = BNGetLowLevelILSSAMemoryUses(m_object, idx, &count); + + set result; + for (size_t i = 0; i < count; i++) + result.insert(instrs[i]); + + BNFreeLowLevelILInstructionList(instrs); + return result; +} diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 390e4210..564fef34 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -353,6 +353,14 @@ class LowLevelILFunction(object): return None return LowLevelILFunction(self.arch, result, self.source_function) + @property + def non_ssa_form(self): + """Low level IL in non-SSA (default) form (read-only)""" + result = core.BNGetLowLevelILNonSSAForm(self.handle) + if not result: + return None + return LowLevelILFunction(self.arch, result, self.source_function) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -1327,6 +1335,57 @@ class LowLevelILFunction(object): return None return LowLevelILLabel(label) + def get_ssa_instruction_index(self, instr): + return core.BNGetLowLevelILSSAInstructionIndex(self.handle, instr) + + def get_non_ssa_instruction_index(self, instr): + return core.BNGetLowLevelILNonSSAInstructionIndex(self.handle, instr) + + def get_ssa_reg_definition(self, reg, index): + result = core.BNGetLowLevelILSSARegisterDefinition(self.handle, reg, index) + if result >= core.BNGetLowLevelILInstructionCount(self.handle): + return None + return result + + def get_ssa_flag_definition(self, flag, index): + result = core.BNGetLowLevelILSSAFlagDefinition(self.handle, flag, index) + if result >= core.BNGetLowLevelILInstructionCount(self.handle): + return None + return result + + def get_ssa_memory_definition(self, index): + result = core.BNGetLowLevelILSSAMemoryDefinition(self.handle, index) + if result >= core.BNGetLowLevelILInstructionCount(self.handle): + return None + return result + + def get_ssa_reg_uses(self, reg, index): + count = ctypes.c_ulonglong() + instrs = core.BNGetLowLevelILSSARegisterUses(self.handle, reg, index, count) + result = [] + for i in xrange(0, count.value): + result.append(instrs[i]) + core.BNFreeLowLevelILInstructionList(instrs) + return result + + def get_ssa_flag_uses(self, flag, index): + count = ctypes.c_ulonglong() + instrs = core.BNGetLowLevelILSSAFlagUses(self.handle, flag, index, count) + result = [] + for i in xrange(0, count.value): + result.append(instrs[i]) + core.BNFreeLowLevelILInstructionList(instrs) + return result + + def get_ssa_memory_uses(self, index): + count = ctypes.c_ulonglong() + instrs = core.BNGetLowLevelILSSAMemoryUses(self.handle, index, count) + result = [] + for i in xrange(0, count.value): + result.append(instrs[i]) + core.BNFreeLowLevelILInstructionList(instrs) + return result + class LowLevelILBasicBlock(basicblock.BasicBlock): def __init__(self, view, handle, owner): -- cgit v1.3.1 From 57a3ea491d2d819ab5415d8d7bdf7e9e505808fc Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Sat, 25 Feb 2017 00:25:36 -0500 Subject: Add APIs to access SSA-based data flow --- binaryninjaapi.h | 6 ++++++ binaryninjacore.h | 7 +++++++ function.cpp | 22 +++++++++++----------- lowlevelil.cpp | 21 +++++++++++++++++++++ python/lowlevelil.py | 22 ++++++++++++++++++++++ 5 files changed, 67 insertions(+), 11 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 9bdaf5f5..9e8ce4c4 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1857,6 +1857,8 @@ namespace BinaryNinja int64_t value; // Offset for OffsetFromEntryValue, StackFrameOffset or RangeValue, value of register for ConstantValue uint64_t rangeStart, rangeEnd, rangeStep; // Range of register, inclusive std::vector table; + + static RegisterValue FromAPIObject(BNRegisterValue& value); }; class FunctionGraph; @@ -2170,6 +2172,10 @@ namespace BinaryNinja std::set GetSSARegisterUses(uint32_t reg, size_t idx) const; std::set GetSSAFlagUses(uint32_t flag, size_t idx) const; std::set GetSSAMemoryUses(size_t idx) const; + + RegisterValue GetSSARegisterValue(uint32_t reg, size_t idx); + RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); + RegisterValue GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size); }; class FunctionRecognizer diff --git a/binaryninjacore.h b/binaryninjacore.h index f7fb2172..bb08c428 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2031,6 +2031,13 @@ extern "C" size_t* count); BINARYNINJACOREAPI size_t* BNGetLowLevelILSSAMemoryUses(BNLowLevelILFunction* func, size_t idx, size_t* count); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSARegisterValue(BNLowLevelILFunction* func, + uint32_t reg, size_t idx); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAFlagValue(BNLowLevelILFunction* func, + uint32_t flag, size_t idx); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAStackContents(BNLowLevelILFunction* func, + size_t memoryIndex, int64_t offset, size_t size); + // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); BINARYNINJACOREAPI BNType* BNCreateBoolType(void); diff --git a/function.cpp b/function.cpp index b1d008ee..fe119c9d 100644 --- a/function.cpp +++ b/function.cpp @@ -166,7 +166,7 @@ vector Function::GetLowLevelILExitsForInstruction(Architecture* arch, ui } -static RegisterValue GetRegisterValueFromAPIObject(BNRegisterValue& value) +RegisterValue RegisterValue::FromAPIObject(BNRegisterValue& value) { RegisterValue result; result.state = value.state; @@ -194,56 +194,56 @@ static RegisterValue GetRegisterValueFromAPIObject(BNRegisterValue& value) RegisterValue Function::GetRegisterValueAtInstruction(Architecture* arch, uint64_t addr, uint32_t reg) { BNRegisterValue value = BNGetRegisterValueAtInstruction(m_object, arch->GetObject(), addr, reg); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetRegisterValueAfterInstruction(Architecture* arch, uint64_t addr, uint32_t reg) { BNRegisterValue value = BNGetRegisterValueAfterInstruction(m_object, arch->GetObject(), addr, reg); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetRegisterValueAtLowLevelILInstruction(size_t i, uint32_t reg) { BNRegisterValue value = BNGetRegisterValueAtLowLevelILInstruction(m_object, i, reg); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetRegisterValueAfterLowLevelILInstruction(size_t i, uint32_t reg) { BNRegisterValue value = BNGetRegisterValueAfterLowLevelILInstruction(m_object, i, reg); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetStackContentsAtInstruction(Architecture* arch, uint64_t addr, int64_t offset, size_t size) { BNRegisterValue value = BNGetStackContentsAtInstruction(m_object, arch->GetObject(), addr, offset, size); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetStackContentsAfterInstruction(Architecture* arch, uint64_t addr, int64_t offset, size_t size) { BNRegisterValue value = BNGetStackContentsAfterInstruction(m_object, arch->GetObject(), addr, offset, size); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetStackContentsAtLowLevelILInstruction(size_t i, int64_t offset, size_t size) { BNRegisterValue value = BNGetStackContentsAtLowLevelILInstruction(m_object, i, offset, size); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } RegisterValue Function::GetStackContentsAfterLowLevelILInstruction(size_t i, int64_t offset, size_t size) { BNRegisterValue value = BNGetStackContentsAfterLowLevelILInstruction(m_object, i, offset, size); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } @@ -251,7 +251,7 @@ RegisterValue Function::GetParameterValueAtInstruction(Architecture* arch, uint6 { BNRegisterValue value = BNGetParameterValueAtInstruction(m_object, arch->GetObject(), addr, functionType ? functionType->GetObject() : nullptr, i); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } @@ -259,7 +259,7 @@ RegisterValue Function::GetParameterValueAtLowLevelILInstruction(size_t instr, T { BNRegisterValue value = BNGetParameterValueAtLowLevelILInstruction(m_object, instr, functionType ? functionType->GetObject() : nullptr, i); - return GetRegisterValueFromAPIObject(value); + return RegisterValue::FromAPIObject(value); } diff --git a/lowlevelil.cpp b/lowlevelil.cpp index d09db62c..999e35ee 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -739,3 +739,24 @@ set LowLevelILFunction::GetSSAMemoryUses(size_t idx) const BNFreeLowLevelILInstructionList(instrs); return result; } + + +RegisterValue LowLevelILFunction::GetSSARegisterValue(uint32_t reg, size_t idx) +{ + BNRegisterValue value = BNGetLowLevelILSSARegisterValue(m_object, reg, idx); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetSSAFlagValue(uint32_t flag, size_t idx) +{ + BNRegisterValue value = BNGetLowLevelILSSAFlagValue(m_object, flag, idx); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size) +{ + BNRegisterValue value = BNGetLowLevelILSSAStackContents(m_object, memoryIndex, offset, size); + return RegisterValue::FromAPIObject(value); +} diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 564fef34..6c664cb4 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1386,6 +1386,28 @@ class LowLevelILFunction(object): core.BNFreeLowLevelILInstructionList(instrs) return result + def get_ssa_reg_value(self, reg, index): + if isinstance(reg, str): + reg = self.arch.regs[reg].index + value = core.BNGetLowLevelILSSARegisterValue(self.handle, reg, index) + result = function.RegisterValue(self.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_ssa_flag_value(self, flag, index): + if isinstance(flag, str): + flag = self.arch.get_flag_by_name(flag) + value = core.BNGetLowLevelILSSAFlagValue(self.handle, flag, index) + result = function.RegisterValue(self.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_ssa_stack_contents(self, memory_index, offset, size): + value = core.BNGetLowLevelILSSAStackContents(self.handle, memory_index, offset, size) + result = function.RegisterValue(self.arch, value) + core.BNFreeRegisterValue(value) + return result + class LowLevelILBasicBlock(basicblock.BasicBlock): def __init__(self, view, handle, owner): -- cgit v1.3.1 From dc0f16fa9bbac0388bb844af8d9f6c3b72ec31e8 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Tue, 28 Feb 2017 20:23:20 -0500 Subject: Map expressions to SSA form and add API to query expression value --- binaryninjaapi.h | 4 ++++ binaryninjacore.h | 4 ++++ lowlevelil.cpp | 21 ++++++++++++++++++++- python/lowlevelil.py | 24 ++++++++++++++++++++++-- 4 files changed, 50 insertions(+), 3 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 9e8ce4c4..58ea890e 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2165,6 +2165,8 @@ namespace BinaryNinja Ref GetNonSSAForm() const; size_t GetSSAInstructionIndex(size_t instr) const; size_t GetNonSSAInstructionIndex(size_t instr) const; + size_t GetSSAExprIndex(size_t instr) const; + size_t GetNonSSAExprIndex(size_t instr) const; size_t GetSSARegisterDefinition(uint32_t reg, size_t idx) const; size_t GetSSAFlagDefinition(uint32_t flag, size_t idx) const; @@ -2176,6 +2178,8 @@ namespace BinaryNinja RegisterValue GetSSARegisterValue(uint32_t reg, size_t idx); RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); RegisterValue GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size); + + RegisterValue GetExprValue(size_t expr); }; class FunctionRecognizer diff --git a/binaryninjacore.h b/binaryninjacore.h index 8536d56e..89302c64 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -2022,6 +2022,8 @@ extern "C" BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILNonSSAForm(BNLowLevelILFunction* func); BINARYNINJACOREAPI size_t BNGetLowLevelILSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr); BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAInstructionIndex(BNLowLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetLowLevelILSSAExprIndex(BNLowLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI size_t BNGetLowLevelILNonSSAExprIndex(BNLowLevelILFunction* func, size_t expr); BINARYNINJACOREAPI size_t BNGetLowLevelILSSARegisterDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx); BINARYNINJACOREAPI size_t BNGetLowLevelILSSAFlagDefinition(BNLowLevelILFunction* func, uint32_t reg, size_t idx); @@ -2039,6 +2041,8 @@ extern "C" BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAStackContents(BNLowLevelILFunction* func, size_t memoryIndex, int64_t offset, size_t size); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); + // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); BINARYNINJACOREAPI BNType* BNCreateBoolType(void); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 999e35ee..fecde9c8 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -671,7 +671,7 @@ Ref LowLevelILFunction::GetNonSSAForm() const size_t LowLevelILFunction::GetSSAInstructionIndex(size_t instr) const { - return BNGetLowLevelILNonSSAInstructionIndex(m_object, instr); + return BNGetLowLevelILSSAInstructionIndex(m_object, instr); } @@ -681,6 +681,18 @@ size_t LowLevelILFunction::GetNonSSAInstructionIndex(size_t instr) const } +size_t LowLevelILFunction::GetSSAExprIndex(size_t expr) const +{ + return BNGetLowLevelILSSAExprIndex(m_object, expr); +} + + +size_t LowLevelILFunction::GetNonSSAExprIndex(size_t expr) const +{ + return BNGetLowLevelILNonSSAExprIndex(m_object, expr); +} + + size_t LowLevelILFunction::GetSSARegisterDefinition(uint32_t reg, size_t idx) const { return BNGetLowLevelILSSARegisterDefinition(m_object, reg, idx); @@ -760,3 +772,10 @@ RegisterValue LowLevelILFunction::GetSSAStackContents(size_t memoryIndex, int64_ BNRegisterValue value = BNGetLowLevelILSSAStackContents(m_object, memoryIndex, offset, size); return RegisterValue::FromAPIObject(value); } + + +RegisterValue LowLevelILFunction::GetExprValue(size_t expr) +{ + BNRegisterValue value = BNGetLowLevelILExprValue(m_object, expr); + return RegisterValue::FromAPIObject(value); +} diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 6c664cb4..6ed179c2 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -53,7 +53,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_PUSH: [("src", "expr")], LowLevelILOperation.LLIL_POP: [], LowLevelILOperation.LLIL_REG: [("src", "reg")], - LowLevelILOperation.LLIL_CONST: [("value", "int")], + LowLevelILOperation.LLIL_CONST: [("constant", "int")], LowLevelILOperation.LLIL_FLAG: [("src", "flag")], LowLevelILOperation.LLIL_FLAG_BIT: [("src", "flag"), ("bit", "int")], LowLevelILOperation.LLIL_ADD: [("left", "expr"), ("right", "expr")], @@ -107,7 +107,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_BOOL_TO_INT: [("src", "expr")], LowLevelILOperation.LLIL_SYSCALL: [], LowLevelILOperation.LLIL_BP: [], - LowLevelILOperation.LLIL_TRAP: [("value", "int")], + LowLevelILOperation.LLIL_TRAP: [("vector", "int")], LowLevelILOperation.LLIL_UNDEF: [], LowLevelILOperation.LLIL_UNIMPL: [], LowLevelILOperation.LLIL_UNIMPL_MEM: [("src", "expr")], @@ -237,6 +237,26 @@ class LowLevelILInstruction(object): core.BNFreeInstructionText(tokens, count.value) return result + @property + def ssa_form(self): + """SSA form of expression (read-only)""" + return LowLevelILInstruction(self.function.ssa_form, + core.BNGetLowLevelILSSAExprIndex(self.function.handle, self.expr_index)) + + @property + def non_ssa_form(self): + """Non-SSA form of expression (read-only)""" + return LowLevelILInstruction(self.function.non_ssa_form, + core.BNGetLowLevelILNonSSAExprIndex(self.function.handle, self.expr_index)) + + @property + def value(self): + """Value of expression using static data flow analysis (read-only)""" + value = core.BNGetLowLevelILExprValue(self.function.handle, self.expr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) -- cgit v1.3.1 From 94b38cee51eff16f1e79945806088c7ae60016d7 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 1 Mar 2017 03:45:51 -0500 Subject: Adding framework for medium level IL --- binaryninjaapi.h | 70 +++++++ binaryninjacore.h | 174 +++++++++++++++- function.cpp | 12 +- lowlevelil.cpp | 6 +- mediumlevelil.cpp | 378 ++++++++++++++++++++++++++++++++++ python/__init__.py | 1 + python/function.py | 20 +- python/lowlevelil.py | 8 +- python/mediumlevelil.py | 525 ++++++++++++++++++++++++++++++++++++++++++++++++ 9 files changed, 1179 insertions(+), 15 deletions(-) create mode 100644 mediumlevelil.cpp create mode 100644 python/mediumlevelil.py (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 58ea890e..1367e7c1 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1862,6 +1862,7 @@ namespace BinaryNinja }; class FunctionGraph; + class MediumLevelILFunction; class Function: public CoreRefCountObject { @@ -1913,6 +1914,8 @@ namespace BinaryNinja std::set GetFlagsReadByLiftedILInstruction(size_t i); std::set GetFlagsWrittenByLiftedILInstruction(size_t i); + Ref GetMediumLevelIL() const; + Ref GetType() const; void SetAutoType(Type* type); void SetUserType(Type* type); @@ -2182,6 +2185,73 @@ namespace BinaryNinja RegisterValue GetExprValue(size_t expr); }; + struct MediumLevelILLabel: public BNMediumLevelILLabel + { + MediumLevelILLabel(); + }; + + class MediumLevelILFunction: public CoreRefCountObject + { + public: + MediumLevelILFunction(Architecture* arch, Function* func = nullptr); + MediumLevelILFunction(BNMediumLevelILFunction* func); + + uint64_t GetCurrentAddress() const; + void SetCurrentAddress(Architecture* arch, uint64_t addr); + size_t GetInstructionStart(Architecture* arch, uint64_t addr); + + ExprId AddExpr(BNMediumLevelILOperation operation, size_t size, + ExprId a = 0, ExprId b = 0, ExprId c = 0, ExprId d = 0, ExprId e = 0); + ExprId AddInstruction(ExprId expr); + + ExprId SetVar(size_t size, const BNILVariable& var, ExprId src); + ExprId SetVarField(size_t size, const BNILVariable& var, int64_t offset, ExprId src); + ExprId SetVarSSA(size_t size, const BNILVariable& var, size_t index, ExprId src); + ExprId SetVarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex, ExprId src); + ExprId Var(size_t size, const BNILVariable& var); + ExprId VarField(size_t size, const BNILVariable& var, int64_t offset); + ExprId VarSSA(size_t size, const BNILVariable& var, size_t index); + ExprId VarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex); + + ExprId Goto(BNMediumLevelILLabel& label); + ExprId If(ExprId operand, BNMediumLevelILLabel& t, BNMediumLevelILLabel& f); + void MarkLabel(BNMediumLevelILLabel& label); + + std::vector GetOperandList(ExprId i, size_t listOperand); + ExprId AddLabelList(const std::vector& labels); + ExprId AddOperandList(const std::vector operands); + + BNILVariable GetVariable(ExprId i, size_t varOperand); + + BNMediumLevelILInstruction operator[](size_t i) const; + size_t GetIndexForInstruction(size_t i) const; + size_t GetInstructionCount() const; + + void Finalize(); + + bool GetExprText(Architecture* arch, ExprId expr, std::vector& tokens); + bool GetInstructionText(Function* func, Architecture* arch, size_t i, + std::vector& tokens); + + std::vector> GetBasicBlocks() const; + + Ref GetSSAForm() const; + Ref GetNonSSAForm() const; + size_t GetSSAInstructionIndex(size_t instr) const; + size_t GetNonSSAInstructionIndex(size_t instr) const; + size_t GetSSAExprIndex(size_t instr) const; + size_t GetNonSSAExprIndex(size_t instr) const; + + size_t GetSSAVarDefinition(const BNILVariable& var, size_t idx) const; + size_t GetSSAMemoryDefinition(size_t idx) const; + std::set GetSSAVarUses(const BNILVariable& var, size_t idx) const; + std::set GetSSAMemoryUses(size_t idx) const; + + RegisterValue GetSSAVarValue(const BNILVariable& var, size_t idx); + RegisterValue GetExprValue(size_t expr); + }; + class FunctionRecognizer { static bool RecognizeLowLevelILCallback(void* ctxt, BNBinaryView* data, BNFunction* func, BNLowLevelILFunction* il); diff --git a/binaryninjacore.h b/binaryninjacore.h index 89302c64..aa9bb49b 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -92,6 +92,7 @@ extern "C" struct BNSymbol; struct BNTemporaryFile; struct BNLowLevelILFunction; + struct BNMediumLevelILFunction; struct BNType; struct BNStructure; struct BNNamedTypeReference; @@ -363,7 +364,9 @@ extern "C" NormalFunctionGraph = 0, LowLevelILFunctionGraph = 1, LiftedILFunctionGraph = 2, - LowLevelILSSAFormFunctionGraph = 3 + LowLevelILSSAFormFunctionGraph = 3, + MediumLevelILFunctionGraph = 4, + MediumLevelILSSAFormFunctionGraph = 5 }; enum BNDisassemblyOption @@ -637,6 +640,115 @@ extern "C" bool autoDiscovered; }; + enum BNMediumLevelILOperation + { + MLIL_NOP, + MLIL_SET_VAR, // Not valid in SSA form (see MLIL_SET_VAR_SSA) + MLIL_SET_VAR_FIELD, // Not valid in SSA form (see MLIL_SET_VAR_FIELD) + MLIL_LOAD, // Not valid in SSA form (see MLIL_LOAD_SSA) + MLIL_STORE, // Not valid in SSA form (see MLIL_STORE_SSA) + MLIL_VAR, // Not valid in SSA form (see MLIL_VAR_SSA) + MLIL_VAR_FIELD, // Not valid in SSA form (see MLIL_VAR_SSA_FIELD) + MLIL_CONST, + MLIL_ADD, + MLIL_ADC, + MLIL_SUB, + MLIL_SBB, + MLIL_AND, + MLIL_OR, + MLIL_XOR, + MLIL_LSL, + MLIL_LSR, + MLIL_ASR, + MLIL_ROL, + MLIL_RLC, + MLIL_ROR, + MLIL_RRC, + MLIL_MUL, + MLIL_MULU_DP, + MLIL_MULS_DP, + MLIL_DIVU, + MLIL_DIVU_DP, + MLIL_DIVS, + MLIL_DIVS_DP, + MLIL_MODU, + MLIL_MODU_DP, + MLIL_MODS, + MLIL_MODS_DP, + MLIL_NEG, + MLIL_NOT, + MLIL_SX, + MLIL_ZX, + MLIL_JUMP, + MLIL_JUMP_TO, + MLIL_CALL, + MLIL_RET, + MLIL_NORET, + MLIL_IF, + MLIL_GOTO, + MLIL_CMP_E, + MLIL_CMP_NE, + MLIL_CMP_SLT, + MLIL_CMP_ULT, + MLIL_CMP_SLE, + MLIL_CMP_ULE, + MLIL_CMP_SGE, + MLIL_CMP_UGE, + MLIL_CMP_SGT, + MLIL_CMP_UGT, + MLIL_TEST_BIT, + MLIL_BOOL_TO_INT, + MLIL_SYSCALL, + MLIL_BP, + MLIL_TRAP, + MLIL_UNDEF, + MLIL_UNIMPL, + MLIL_UNIMPL_MEM, + + // The following instructions are only used in SSA form + MLIL_SET_VAR_SSA, + MLIL_SET_VAR_SSA_FIELD, + MLIL_VAR_SSA, + MLIL_VAR_SSA_FIELD, + MLIL_CALL_SSA, + MLIL_SYSCALL_SSA, + MLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions + MLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions + MLIL_LOAD_SSA, + MLIL_STORE_SSA, + MLIL_VAR_PHI, + MLIL_MEM_PHI + }; + + struct BNMediumLevelILInstruction + { + BNMediumLevelILOperation operation; + size_t size; + uint64_t operands[5]; + uint64_t address; + }; + + struct BNMediumLevelILLabel + { + bool resolved; + size_t ref; + size_t operand; + }; + + enum BNILVariableSourceType + { + RegisterVariableSourceType, + FlagVariableSourceType, + StackVariableSourceType + }; + + struct BNILVariable + { + BNILVariableSourceType type; + uint32_t index; + int64_t identifier; + }; + // Callbacks struct BNLogListener { @@ -1698,7 +1810,8 @@ extern "C" BINARYNINJACOREAPI size_t BNGetLowLevelILForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr); BINARYNINJACOREAPI size_t* BNGetLowLevelILExitsForInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, size_t* count); - BINARYNINJACOREAPI void BNFreeLowLevelILInstructionList(size_t* list); + BINARYNINJACOREAPI void BNFreeILInstructionList(size_t* list); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetFunctionMediumLevelIL(BNFunction* func); BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAtInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, uint32_t reg); BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAfterInstruction(BNFunction* func, BNArchitecture* arch, @@ -2043,6 +2156,63 @@ extern "C" BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); + // Medium-level IL + BINARYNINJACOREAPI BNMediumLevelILFunction* BNCreateMediumLevelILFunction(BNArchitecture* arch, BNFunction* func); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNNewMediumLevelILFunctionReference(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI void BNFreeMediumLevelILFunction(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI uint64_t BNMediumLevelILGetCurrentAddress(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI void BNMediumLevelILSetCurrentAddress(BNMediumLevelILFunction* func, + BNArchitecture* arch, uint64_t addr); + BINARYNINJACOREAPI size_t BNMediumLevelILGetInstructionStart(BNMediumLevelILFunction* func, + BNArchitecture* arch, uint64_t addr); + BINARYNINJACOREAPI size_t BNMediumLevelILAddExpr(BNMediumLevelILFunction* func, BNMediumLevelILOperation operation, + size_t size, uint64_t a, uint64_t b, uint64_t c, uint64_t d, uint64_t e); + BINARYNINJACOREAPI size_t BNMediumLevelILAddInstruction(BNMediumLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI size_t BNMediumLevelILGoto(BNMediumLevelILFunction* func, BNMediumLevelILLabel* label); + BINARYNINJACOREAPI size_t BNMediumLevelILIf(BNMediumLevelILFunction* func, uint64_t op, + BNMediumLevelILLabel* t, BNMediumLevelILLabel* f); + BINARYNINJACOREAPI void BNMediumLevelILInitLabel(BNMediumLevelILLabel* label); + BINARYNINJACOREAPI void BNMediumLevelILMarkLabel(BNMediumLevelILFunction* func, BNMediumLevelILLabel* label); + BINARYNINJACOREAPI void BNFinalizeMediumLevelILFunction(BNMediumLevelILFunction* func); + + BINARYNINJACOREAPI size_t BNMediumLevelILAddLabelList(BNMediumLevelILFunction* func, + BNMediumLevelILLabel** labels, size_t count); + BINARYNINJACOREAPI size_t BNMediumLevelILAddOperandList(BNMediumLevelILFunction* func, + uint64_t* operands, size_t count); + BINARYNINJACOREAPI uint64_t* BNMediumLevelILGetOperandList(BNMediumLevelILFunction* func, size_t expr, + size_t operand, size_t* count); + BINARYNINJACOREAPI void BNMediumLevelILFreeOperandList(uint64_t* operands); + + BINARYNINJACOREAPI BNMediumLevelILInstruction BNGetMediumLevelILByIndex(BNMediumLevelILFunction* func, size_t i); + BINARYNINJACOREAPI size_t BNGetMediumLevelILIndexForInstruction(BNMediumLevelILFunction* func, size_t i); + BINARYNINJACOREAPI size_t BNGetMediumLevelILInstructionCount(BNMediumLevelILFunction* func); + + BINARYNINJACOREAPI bool BNGetMediumLevelILExprText(BNMediumLevelILFunction* func, BNArchitecture* arch, size_t i, + BNInstructionTextToken** tokens, size_t* count); + BINARYNINJACOREAPI bool BNGetMediumLevelILInstructionText(BNMediumLevelILFunction* il, BNFunction* func, + BNArchitecture* arch, size_t i, BNInstructionTextToken** tokens, size_t* count); + + BINARYNINJACOREAPI BNBasicBlock** BNGetMediumLevelILBasicBlockList(BNMediumLevelILFunction* func, size_t* count); + + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILSSAForm(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILNonSSAForm(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAInstructionIndex(BNMediumLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetMediumLevelILNonSSAInstructionIndex(BNMediumLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAExprIndex(BNMediumLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI size_t BNGetMediumLevelILNonSSAExprIndex(BNMediumLevelILFunction* func, size_t expr); + + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAVarDefinition(BNMediumLevelILFunction* func, + const BNILVariable* var, size_t idx); + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAMemoryDefinition(BNMediumLevelILFunction* func, size_t idx); + BINARYNINJACOREAPI size_t* BNGetMediumLevelILSSAVarUses(BNMediumLevelILFunction* func, const BNILVariable* var, + size_t idx, size_t* count); + BINARYNINJACOREAPI size_t* BNGetMediumLevelILSSAMemoryUses(BNMediumLevelILFunction* func, + size_t idx, size_t* count); + + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILSSAVarValue(BNMediumLevelILFunction* func, + const BNILVariable* var, size_t idx); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILExprValue(BNMediumLevelILFunction* func, size_t expr); + // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); BINARYNINJACOREAPI BNType* BNCreateBoolType(void); diff --git a/function.cpp b/function.cpp index fe119c9d..9faf68fa 100644 --- a/function.cpp +++ b/function.cpp @@ -161,7 +161,7 @@ vector Function::GetLowLevelILExitsForInstruction(Architecture* arch, ui vector result; result.insert(result.end(), exits, &exits[count]); - BNFreeLowLevelILInstructionList(exits); + BNFreeILInstructionList(exits); return result; } @@ -343,7 +343,7 @@ set Function::GetLiftedILFlagUsesForDefinition(size_t i, uint32_t flag) set result; result.insert(&instrs[0], &instrs[count]); - BNFreeLowLevelILInstructionList(instrs); + BNFreeILInstructionList(instrs); return result; } @@ -355,7 +355,7 @@ set Function::GetLiftedILFlagDefinitionsForUse(size_t i, uint32_t flag) set result; result.insert(&instrs[0], &instrs[count]); - BNFreeLowLevelILInstructionList(instrs); + BNFreeILInstructionList(instrs); return result; } @@ -384,6 +384,12 @@ set Function::GetFlagsWrittenByLiftedILInstruction(size_t i) } +Ref Function::GetMediumLevelIL() const +{ + return new MediumLevelILFunction(BNGetFunctionMediumLevelIL(m_object)); +} + + Ref Function::GetType() const { return new Type(BNGetFunctionType(m_object)); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index fecde9c8..5a789981 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -720,7 +720,7 @@ set LowLevelILFunction::GetSSARegisterUses(uint32_t reg, size_t idx) con for (size_t i = 0; i < count; i++) result.insert(instrs[i]); - BNFreeLowLevelILInstructionList(instrs); + BNFreeILInstructionList(instrs); return result; } @@ -734,7 +734,7 @@ set LowLevelILFunction::GetSSAFlagUses(uint32_t flag, size_t idx) const for (size_t i = 0; i < count; i++) result.insert(instrs[i]); - BNFreeLowLevelILInstructionList(instrs); + BNFreeILInstructionList(instrs); return result; } @@ -748,7 +748,7 @@ set LowLevelILFunction::GetSSAMemoryUses(size_t idx) const for (size_t i = 0; i < count; i++) result.insert(instrs[i]); - BNFreeLowLevelILInstructionList(instrs); + BNFreeILInstructionList(instrs); return result; } diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp new file mode 100644 index 00000000..f6ad5bfd --- /dev/null +++ b/mediumlevelil.cpp @@ -0,0 +1,378 @@ +// Copyright (c) 2017 Vector 35 LLC +// +// Permission is hereby granted, free of charge, to any person obtaining a copy +// of this software and associated documentation files (the "Software"), to +// deal in the Software without restriction, including without limitation the +// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or +// sell copies of the Software, and to permit persons to whom the Software is +// furnished to do so, subject to the following conditions: +// +// The above copyright notice and this permission notice shall be included in +// all copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS +// IN THE SOFTWARE. + +#include "binaryninjaapi.h" + +using namespace BinaryNinja; +using namespace std; + + +MediumLevelILLabel::MediumLevelILLabel() +{ + BNMediumLevelILInitLabel(this); +} + + +MediumLevelILFunction::MediumLevelILFunction(Architecture* arch, Function* func) +{ + m_object = BNCreateMediumLevelILFunction(arch->GetObject(), func ? func->GetObject() : nullptr); +} + + +MediumLevelILFunction::MediumLevelILFunction(BNMediumLevelILFunction* func) +{ + m_object = func; +} + + +uint64_t MediumLevelILFunction::GetCurrentAddress() const +{ + return BNMediumLevelILGetCurrentAddress(m_object); +} + + +void MediumLevelILFunction::SetCurrentAddress(Architecture* arch, uint64_t addr) +{ + BNMediumLevelILSetCurrentAddress(m_object, arch ? arch->GetObject() : nullptr, addr); +} + + +size_t MediumLevelILFunction::GetInstructionStart(Architecture* arch, uint64_t addr) +{ + return BNMediumLevelILGetInstructionStart(m_object, arch ? arch->GetObject() : nullptr, addr); +} + + +ExprId MediumLevelILFunction::AddExpr(BNMediumLevelILOperation operation, size_t size, + ExprId a, ExprId b, ExprId c, ExprId d, ExprId e) +{ + return BNMediumLevelILAddExpr(m_object, operation, size, a, b, c, d, e); +} + + +ExprId MediumLevelILFunction::AddInstruction(size_t expr) +{ + return BNMediumLevelILAddInstruction(m_object, expr); +} + + +ExprId MediumLevelILFunction::SetVar(size_t size, const BNILVariable& var, ExprId src) +{ + return AddExpr(MLIL_SET_VAR, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, src); +} + + +ExprId MediumLevelILFunction::SetVarField(size_t size, const BNILVariable& var, int64_t offset, ExprId src) +{ + return AddExpr(MLIL_SET_VAR_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, + offset, src); +} + + +ExprId MediumLevelILFunction::SetVarSSA(size_t size, const BNILVariable& var, size_t varIndex, ExprId src) +{ + return AddExpr(MLIL_SET_VAR_SSA, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, + varIndex, src); +} + + +ExprId MediumLevelILFunction::SetVarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, + size_t varIndex, ExprId src) +{ + return AddExpr(MLIL_SET_VAR_SSA_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, + offset, varIndex, src); +} + + +ExprId MediumLevelILFunction::Var(size_t size, const BNILVariable& var) +{ + return AddExpr(MLIL_VAR, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier); +} + + +ExprId MediumLevelILFunction::VarField(size_t size, const BNILVariable& var, int64_t offset) +{ + return AddExpr(MLIL_VAR_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, offset); +} + + +ExprId MediumLevelILFunction::VarSSA(size_t size, const BNILVariable& var, size_t varIndex) +{ + return AddExpr(MLIL_VAR_SSA, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, varIndex); +} + + +ExprId MediumLevelILFunction::VarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, + size_t varIndex) +{ + return AddExpr(MLIL_VAR_SSA_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, + offset, varIndex); +} + + +ExprId MediumLevelILFunction::Goto(BNMediumLevelILLabel& label) +{ + return BNMediumLevelILGoto(m_object, &label); +} + + +ExprId MediumLevelILFunction::If(ExprId operand, BNMediumLevelILLabel& t, BNMediumLevelILLabel& f) +{ + return BNMediumLevelILIf(m_object, operand, &t, &f); +} + + +void MediumLevelILFunction::MarkLabel(BNMediumLevelILLabel& label) +{ + BNMediumLevelILMarkLabel(m_object, &label); +} + + +vector MediumLevelILFunction::GetOperandList(ExprId expr, size_t listOperand) +{ + size_t count; + uint64_t* operands = BNMediumLevelILGetOperandList(m_object, expr, listOperand, &count); + vector result; + for (size_t i = 0; i < count; i++) + result.push_back(operands[i]); + BNMediumLevelILFreeOperandList(operands); + return result; +} + + +ExprId MediumLevelILFunction::AddLabelList(const vector& labels) +{ + BNMediumLevelILLabel** labelList = new BNMediumLevelILLabel*[labels.size()]; + for (size_t i = 0; i < labels.size(); i++) + labelList[i] = labels[i]; + ExprId result = (ExprId)BNMediumLevelILAddLabelList(m_object, labelList, labels.size()); + delete[] labelList; + return result; +} + + +ExprId MediumLevelILFunction::AddOperandList(const vector operands) +{ + uint64_t* operandList = new uint64_t[operands.size()]; + for (size_t i = 0; i < operands.size(); i++) + operandList[i] = operands[i]; + ExprId result = (ExprId)BNMediumLevelILAddOperandList(m_object, operandList, operands.size()); + delete[] operandList; + return result; +} + + +BNILVariable MediumLevelILFunction::GetVariable(ExprId i, size_t varOperand) +{ + BNMediumLevelILInstruction instr = (*this)[i]; + BNILVariable result; + result.type = (BNILVariableSourceType)(instr.operands[varOperand] >> 32); + result.index = (uint32_t)instr.operands[varOperand]; + result.identifier = instr.operands[varOperand + 1]; + return result; +} + + +BNMediumLevelILInstruction MediumLevelILFunction::operator[](size_t i) const +{ + return BNGetMediumLevelILByIndex(m_object, i); +} + + +size_t MediumLevelILFunction::GetIndexForInstruction(size_t i) const +{ + return BNGetMediumLevelILIndexForInstruction(m_object, i); +} + + +size_t MediumLevelILFunction::GetInstructionCount() const +{ + return BNGetMediumLevelILInstructionCount(m_object); +} + + +void MediumLevelILFunction::Finalize() +{ + BNFinalizeMediumLevelILFunction(m_object); +} + + +bool MediumLevelILFunction::GetExprText(Architecture* arch, ExprId expr, vector& tokens) +{ + size_t count; + BNInstructionTextToken* list; + if (!BNGetMediumLevelILExprText(m_object, arch->GetObject(), expr, &list, &count)) + return false; + + tokens.clear(); + for (size_t i = 0; i < count; i++) + { + InstructionTextToken token; + token.type = list[i].type; + token.text = list[i].text; + token.value = list[i].value; + token.size = list[i].size; + token.operand = list[i].operand; + token.context = list[i].context; + token.address = list[i].address; + tokens.push_back(token); + } + + BNFreeInstructionText(list, count); + return true; +} + + +bool MediumLevelILFunction::GetInstructionText(Function* func, Architecture* arch, size_t instr, + vector& tokens) +{ + size_t count; + BNInstructionTextToken* list; + if (!BNGetMediumLevelILInstructionText(m_object, func ? func->GetObject() : nullptr, arch->GetObject(), + instr, &list, &count)) + return false; + + tokens.clear(); + for (size_t i = 0; i < count; i++) + { + InstructionTextToken token; + token.type = list[i].type; + token.text = list[i].text; + token.value = list[i].value; + token.size = list[i].size; + token.operand = list[i].operand; + token.context = list[i].context; + token.address = list[i].address; + tokens.push_back(token); + } + + BNFreeInstructionText(list, count); + return true; +} + + +vector> MediumLevelILFunction::GetBasicBlocks() const +{ + size_t count; + BNBasicBlock** blocks = BNGetMediumLevelILBasicBlockList(m_object, &count); + + vector> result; + for (size_t i = 0; i < count; i++) + result.push_back(new BasicBlock(BNNewBasicBlockReference(blocks[i]))); + + BNFreeBasicBlockList(blocks, count); + return result; +} + + +Ref MediumLevelILFunction::GetSSAForm() const +{ + BNMediumLevelILFunction* func = BNGetMediumLevelILSSAForm(m_object); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} + + +Ref MediumLevelILFunction::GetNonSSAForm() const +{ + BNMediumLevelILFunction* func = BNGetMediumLevelILNonSSAForm(m_object); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} + + +size_t MediumLevelILFunction::GetSSAInstructionIndex(size_t instr) const +{ + return BNGetMediumLevelILSSAInstructionIndex(m_object, instr); +} + + +size_t MediumLevelILFunction::GetNonSSAInstructionIndex(size_t instr) const +{ + return BNGetMediumLevelILNonSSAInstructionIndex(m_object, instr); +} + + +size_t MediumLevelILFunction::GetSSAExprIndex(size_t expr) const +{ + return BNGetMediumLevelILSSAExprIndex(m_object, expr); +} + + +size_t MediumLevelILFunction::GetNonSSAExprIndex(size_t expr) const +{ + return BNGetMediumLevelILNonSSAExprIndex(m_object, expr); +} + + +size_t MediumLevelILFunction::GetSSAVarDefinition(const BNILVariable& var, size_t idx) const +{ + return BNGetMediumLevelILSSAVarDefinition(m_object, &var, idx); +} + + +size_t MediumLevelILFunction::GetSSAMemoryDefinition(size_t idx) const +{ + return BNGetMediumLevelILSSAMemoryDefinition(m_object, idx); +} + + +set MediumLevelILFunction::GetSSAVarUses(const BNILVariable& var, size_t idx) const +{ + size_t count; + size_t* instrs = BNGetMediumLevelILSSAVarUses(m_object, &var, idx, &count); + + set result; + for (size_t i = 0; i < count; i++) + result.insert(instrs[i]); + + BNFreeILInstructionList(instrs); + return result; +} + + +set MediumLevelILFunction::GetSSAMemoryUses(size_t idx) const +{ + size_t count; + size_t* instrs = BNGetMediumLevelILSSAMemoryUses(m_object, idx, &count); + + set result; + for (size_t i = 0; i < count; i++) + result.insert(instrs[i]); + + BNFreeILInstructionList(instrs); + return result; +} + + +RegisterValue MediumLevelILFunction::GetSSAVarValue(const BNILVariable& var, size_t idx) +{ + BNRegisterValue value = BNGetMediumLevelILSSAVarValue(m_object, &var, idx); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetExprValue(size_t expr) +{ + BNRegisterValue value = BNGetMediumLevelILExprValue(m_object, expr); + return RegisterValue::FromAPIObject(value); +} diff --git a/python/__init__.py b/python/__init__.py index b1f5cd08..7502d205 100644 --- a/python/__init__.py +++ b/python/__init__.py @@ -32,6 +32,7 @@ from .basicblock import * from .function import * from .log import * from .lowlevelil import * +from .mediumlevelil import * from .types import * from .functionrecognizer import * from .update import * diff --git a/python/function.py b/python/function.py index 07187080..ed2a537c 100644 --- a/python/function.py +++ b/python/function.py @@ -33,6 +33,7 @@ import associateddatastore import types import basicblock import lowlevelil +import mediumlevelil import binaryview import log @@ -139,6 +140,14 @@ class StackVariableReference(object): return "" % (self.source_operand, self.name) +class ILVariable(object): + def __init__(self, func, var_type, index, identifier): + self.function = func + self.type = var_type + self.index = index + self.identifier = identifier + + class ConstantReference(object): def __init__(self, val, size): self.value = val @@ -299,6 +308,11 @@ class Function(object): """Function lifted IL (read-only)""" return lowlevelil.LowLevelILFunction(self.arch, core.BNGetFunctionLiftedIL(self.handle), self) + @property + def medium_level_il(self): + """Function medium level IL (read-only)""" + return mediumlevelil.MediumLevelILFunction(self.arch, core.BNGetFunctionMediumLevelIL(self.handle), self) + @property def function_type(self): """Function type object""" @@ -398,7 +412,7 @@ class Function(object): result = [] for i in xrange(0, count.value): result.append(exits[i]) - core.BNFreeLowLevelILInstructionList(exits) + core.BNFreeILInstructionList(exits) return result def get_reg_value_at(self, addr, reg, arch=None): @@ -597,7 +611,7 @@ class Function(object): result = [] for i in xrange(0, count.value): result.append(instrs[i]) - core.BNFreeLowLevelILInstructionList(instrs) + core.BNFreeILInstructionList(instrs) return result def get_lifted_il_flag_definitions_for_use(self, i, flag): @@ -608,7 +622,7 @@ class Function(object): result = [] for i in xrange(0, count.value): result.append(instrs[i]) - core.BNFreeLowLevelILInstructionList(instrs) + core.BNFreeILInstructionList(instrs) return result def get_flags_read_by_lifted_il_instruction(self, i): diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 6ed179c2..ed1cedd4 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -124,7 +124,7 @@ class LowLevelILInstruction(object): LowLevelILOperation.LLIL_SYSCALL_SSA: [("output", "expr"), ("stack", "expr"), ("param", "expr")], LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "reg_ssa_list")], LowLevelILOperation.LLIL_CALL_STACK_SSA: [("src", "reg"), ("index", "int"), ("src_memory", "int")], - LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("dest", "reg_ssa_list")], + LowLevelILOperation.LLIL_CALL_PARAM_SSA: [("src", "reg_ssa_list")], LowLevelILOperation.LLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], LowLevelILOperation.LLIL_REG_PHI: [("dest", "reg"), ("index", "int"), ("src", "reg_ssa_list")], @@ -1385,7 +1385,7 @@ class LowLevelILFunction(object): result = [] for i in xrange(0, count.value): result.append(instrs[i]) - core.BNFreeLowLevelILInstructionList(instrs) + core.BNFreeILInstructionList(instrs) return result def get_ssa_flag_uses(self, flag, index): @@ -1394,7 +1394,7 @@ class LowLevelILFunction(object): result = [] for i in xrange(0, count.value): result.append(instrs[i]) - core.BNFreeLowLevelILInstructionList(instrs) + core.BNFreeILInstructionList(instrs) return result def get_ssa_memory_uses(self, index): @@ -1403,7 +1403,7 @@ class LowLevelILFunction(object): result = [] for i in xrange(0, count.value): result.append(instrs[i]) - core.BNFreeLowLevelILInstructionList(instrs) + core.BNFreeILInstructionList(instrs) return result def get_ssa_reg_value(self, reg, index): diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py new file mode 100644 index 00000000..c4c4aa23 --- /dev/null +++ b/python/mediumlevelil.py @@ -0,0 +1,525 @@ +# Copyright (c) 2017 Vector 35 LLC +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to +# deal in the Software without restriction, including without limitation the +# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or +# sell copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS +# IN THE SOFTWARE. + +import ctypes + +# Binary Ninja components +import _binaryninjacore as core +from .enums import MediumLevelILOperation, InstructionTextTokenType, ILVariableSourceType +import function +import basicblock + + +class MediumLevelILLabel(object): + def __init__(self, handle = None): + if handle is None: + self.handle = (core.BNMediumLevelILLabel * 1)() + core.BNMediumLevelILInitLabel(self.handle) + else: + self.handle = handle + + +class MediumLevelILInstruction(object): + """ + ``class MediumLevelILInstruction`` Medium Level Intermediate Language Instructions are infinite length tree-based + instructions. Tree-based instructions use infix notation with the left hand operand being the destination operand. + Infix notation is thus more natural to read than other notations (e.g. x86 ``mov eax, 0`` vs. MLIL ``eax = 0``). + """ + + ILOperations = { + MediumLevelILOperation.MLIL_NOP: [], + MediumLevelILOperation.MLIL_SET_VAR: [("dest", "var"), ("src", "expr")], + MediumLevelILOperation.MLIL_SET_VAR_FIELD: [("dest", "var"), ("offset", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_LOAD: [("src", "expr")], + MediumLevelILOperation.MLIL_STORE: [("dest", "expr"), ("src", "expr")], + MediumLevelILOperation.MLIL_VAR: [("src", "var")], + MediumLevelILOperation.MLIL_VAR_FIELD: [("src", "var"), ("offset", "int")], + MediumLevelILOperation.MLIL_CONST: [("constant", "int")], + MediumLevelILOperation.MLIL_ADD: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_ADC: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_SUB: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_SBB: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_AND: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_OR: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_XOR: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_LSL: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_LSR: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_ASR: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_ROL: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_RLC: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_ROR: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_RRC: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MUL: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MULU_DP: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MULS_DP: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVU: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVS: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_DIVS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODU: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODU_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODS: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_MODS_DP: [("hi", "expr"), ("lo", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_NEG: [("src", "expr")], + MediumLevelILOperation.MLIL_NOT: [("src", "expr")], + MediumLevelILOperation.MLIL_SX: [("src", "expr")], + MediumLevelILOperation.MLIL_ZX: [("src", "expr")], + MediumLevelILOperation.MLIL_JUMP: [("dest", "expr")], + MediumLevelILOperation.MLIL_JUMP_TO: [("dest", "expr"), ("targets", "int_list")], + MediumLevelILOperation.MLIL_CALL: [("dest", "expr")], + MediumLevelILOperation.MLIL_RET: [], + MediumLevelILOperation.MLIL_NORET: [], + MediumLevelILOperation.MLIL_IF: [("condition", "expr"), ("true", "int"), ("false", "int")], + MediumLevelILOperation.MLIL_GOTO: [("dest", "int")], + MediumLevelILOperation.MLIL_CMP_E: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_NE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_SLT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_ULT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_SLE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_ULE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_SGE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_UGE: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_SGT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_CMP_UGT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_TEST_BIT: [("left", "expr"), ("right", "expr")], + MediumLevelILOperation.MLIL_BOOL_TO_INT: [("src", "expr")], + MediumLevelILOperation.MLIL_SYSCALL: [], + MediumLevelILOperation.MLIL_BP: [], + MediumLevelILOperation.MLIL_TRAP: [("vector", "int")], + MediumLevelILOperation.MLIL_UNDEF: [], + MediumLevelILOperation.MLIL_UNIMPL: [], + MediumLevelILOperation.MLIL_UNIMPL_MEM: [("src", "expr")], + MediumLevelILOperation.MLIL_SET_VAR_SSA: [("dest", "var"), ("index", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_SET_VAR_SSA_FIELD: [("dest", "var"), ("index", "int"), ("offset", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_VAR_SSA: [("src", "var"), ("index", "int")], + MediumLevelILOperation.MLIL_VAR_SSA_FIELD: [("src", "var"), ("index", "int"), ("offset", "int")], + MediumLevelILOperation.MLIL_CALL_SSA: [("output", "expr"), ("dest", "expr"), ("param", "expr")], + MediumLevelILOperation.MLIL_SYSCALL_SSA: [("output", "expr"), ("param", "expr")], + MediumLevelILOperation.MLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "var_ssa_list")], + MediumLevelILOperation.MLIL_CALL_PARAM_SSA: [("src", "var_ssa_list")], + MediumLevelILOperation.MLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], + MediumLevelILOperation.MLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_VAR_PHI: [("dest", "var"), ("index", "int"), ("src", "var_ssa_list")], + MediumLevelILOperation.MLIL_MEM_PHI: [("dest_memory", "int"), ("src_memory", "int_list")] + } + + def __init__(self, func, expr_index, instr_index=None): + instr = core.BNGetMediumLevelILByIndex(func.handle, expr_index) + self.function = func + self.expr_index = expr_index + self.instr_index = instr_index + self.operation = MediumLevelILOperation(instr.operation) + self.size = instr.size + self.address = instr.address + operands = MediumLevelILInstruction.ILOperations[instr.operation] + self.operands = [] + i = 0 + while i < len(operands): + name, operand_type = operands[i] + if operand_type == "int": + value = instr.operands[i] + elif operand_type == "expr": + value = MediumLevelILInstruction(func, instr.operands[i]) + elif operand_type == "var": + var_type = ILVariableSourceType(instr.operands[i] >> 32) + index = instr.operands[i] & 0xffffffff + identifier = instr.operands[i + 1] + i += 1 + value = function.ILVariable(self.function, var_type, index, identifier) + elif operand_type == "int_list": + count = ctypes.c_ulonglong() + operand_list = core.BNMediumLevelILGetOperandList(func.handle, self.expr_index, i, count) + value = [] + for i in xrange(count.value): + value.append(operand_list[i]) + core.BNMediumLevelILFreeOperandList(operand_list) + elif operand_type == "var_ssa_list": + count = ctypes.c_ulonglong() + operand_list = core.BNMediumLevelILGetOperandList(func.handle, self.expr_index, i, count) + i += 1 + value = [] + for j in xrange(count.value / 3): + var_type = ILVariableSourceType(operand_list[j * 3] >> 32) + index = operand_list[j * 3] & 0xffffffff + identifier = operand_list[(j * 3) + 1] + var_index = operand_list[(j * 3) + 2] + value.append((function.ILVariable(self.function, var_type, index, identifier), var_index)) + core.BNMediumLevelILFreeOperandList(operand_list) + self.operands.append(value) + self.__dict__[name] = value + + def __str__(self): + tokens = self.tokens + if tokens is None: + return "invalid" + result = "" + for token in tokens: + result += token.text + return result + + def __repr__(self): + return "" % str(self) + + @property + def tokens(self): + """MLIL tokens (read-only)""" + count = ctypes.c_ulonglong() + tokens = ctypes.POINTER(core.BNInstructionTextToken)() + if (self.instr_index is not None) and (self.function.source_function is not None): + if not core.BNGetMediumLevelILInstructionText(self.function.handle, self.function.source_function.handle, + self.function.arch.handle, self.instr_index, tokens, count): + return None + else: + if not core.BNGetMediumLevelILExprText(self.function.handle, self.function.arch.handle, + self.expr_index, tokens, count): + return None + result = [] + for i in xrange(0, count.value): + token_type = InstructionTextTokenType(tokens[i].type) + text = tokens[i].text + value = tokens[i].value + size = tokens[i].size + operand = tokens[i].operand + context = tokens[i].context + address = tokens[i].address + result.append(function.InstructionTextToken(token_type, text, value, size, operand, context, address)) + core.BNFreeInstructionText(tokens, count.value) + return result + + @property + def ssa_form(self): + """SSA form of expression (read-only)""" + return MediumLevelILInstruction(self.function.ssa_form, + core.BNGetMediumLevelILSSAExprIndex(self.function.handle, self.expr_index)) + + @property + def non_ssa_form(self): + """Non-SSA form of expression (read-only)""" + return MediumLevelILInstruction(self.function.non_ssa_form, + core.BNGetMediumLevelILNonSSAExprIndex(self.function.handle, self.expr_index)) + + @property + def value(self): + """Value of expression using static data flow analysis (read-only)""" + value = core.BNGetMediumLevelILExprValue(self.function.handle, self.expr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def __setattr__(self, name, value): + try: + object.__setattr__(self, name, value) + except AttributeError: + raise AttributeError("attribute '%s' is read only" % name) + + +class MediumLevelILExpr(object): + """ + ``class MediumLevelILExpr`` hold the index of IL Expressions. + + .. note:: This class shouldn't be instantiated directly. Rather the helper members of MediumLevelILFunction should be \ + used instead. + """ + def __init__(self, index): + self.index = index + + +class MediumLevelILFunction(object): + """ + ``class MediumLevelILFunction`` contains the list of MediumLevelILExpr objects that make up a function. MediumLevelILExpr + objects can be added to the MediumLevelILFunction by calling ``append`` and passing the result of the various class + methods which return MediumLevelILExpr objects. + """ + def __init__(self, arch, handle = None, source_func = None): + self.arch = arch + self.source_function = source_func + if handle is not None: + self.handle = core.handle_of_type(handle, core.BNMediumLevelILFunction) + else: + func_handle = None + if self.source_function is not None: + func_handle = self.source_function.handle + self.handle = core.BNCreateMediumLevelILFunction(arch.handle, func_handle) + + def __del__(self): + core.BNFreeMediumLevelILFunction(self.handle) + + def __eq__(self, value): + if not isinstance(value, MediumLevelILFunction): + return False + return ctypes.addressof(self.handle.contents) == ctypes.addressof(value.handle.contents) + + def __ne__(self, value): + if not isinstance(value, MediumLevelILFunction): + return True + return ctypes.addressof(self.handle.contents) != ctypes.addressof(value.handle.contents) + + @property + def current_address(self): + """Current IL Address (read/write)""" + return core.BNMediumLevelILGetCurrentAddress(self.handle) + + @current_address.setter + def current_address(self, value): + core.BNMediumLevelILSetCurrentAddress(self.handle, self.arch.handle, value) + + def set_current_address(self, value, arch = None): + if arch is None: + arch = self.arch + core.BNMediumLevelILSetCurrentAddress(self.handle, arch.handle, value) + + @property + def basic_blocks(self): + """list of MediumLevelILBasicBlock objects (read-only)""" + count = ctypes.c_ulonglong() + blocks = core.BNGetMediumLevelILBasicBlockList(self.handle, count) + result = [] + view = None + if self.source_function is not None: + view = self.source_function.view + for i in xrange(0, count.value): + result.append(MediumLevelILBasicBlock(view, core.BNNewBasicBlockReference(blocks[i]), self)) + core.BNFreeBasicBlockList(blocks, count.value) + return result + + @property + def ssa_form(self): + """Medium level IL in SSA form (read-only)""" + result = core.BNGetMediumLevelILSSAForm(self.handle) + if not result: + return None + return MediumLevelILFunction(self.arch, result, self.source_function) + + @property + def non_ssa_form(self): + """Medium level IL in non-SSA (default) form (read-only)""" + result = core.BNGetMediumLevelILNonSSAForm(self.handle) + if not result: + return None + return MediumLevelILFunction(self.arch, result, self.source_function) + + def __setattr__(self, name, value): + try: + object.__setattr__(self, name, value) + except AttributeError: + raise AttributeError("attribute '%s' is read only" % name) + + def __len__(self): + return int(core.BNGetMediumLevelILInstructionCount(self.handle)) + + def __getitem__(self, i): + if isinstance(i, slice) or isinstance(i, tuple): + raise IndexError("expected integer instruction index") + if isinstance(i, MediumLevelILExpr): + return MediumLevelILInstruction(self, i.index) + if (i < 0) or (i >= len(self)): + raise IndexError("index out of range") + return MediumLevelILInstruction(self, core.BNGetMediumLevelILIndexForInstruction(self.handle, i), i) + + def __setitem__(self, i, j): + raise IndexError("instruction modification not implemented") + + def __iter__(self): + count = ctypes.c_ulonglong() + blocks = core.BNGetMediumLevelILBasicBlockList(self.handle, count) + view = None + if self.source_function is not None: + view = self.source_function.view + try: + for i in xrange(0, count.value): + yield MediumLevelILBasicBlock(view, core.BNNewBasicBlockReference(blocks[i]), self) + finally: + core.BNFreeBasicBlockList(blocks, count.value) + + def get_instruction_start(self, addr, arch = None): + if arch is None: + arch = self.arch + result = core.BNMediumLevelILGetInstructionStart(self.handle, arch.handle, addr) + if result >= core.BNGetMediumLevelILInstructionCount(self.handle): + return None + return result + + def expr(self, operation, a = 0, b = 0, c = 0, d = 0, e = 0, size = 0): + if isinstance(operation, str): + operation = MediumLevelILOperation[operation] + elif isinstance(operation, MediumLevelILOperation): + operation = operation.value + return MediumLevelILExpr(core.BNMediumLevelILAddExpr(self.handle, operation, size, a, b, c, d, e)) + + def append(self, expr): + """ + ``append`` adds the MediumLevelILExpr ``expr`` to the current MediumLevelILFunction. + + :param MediumLevelILExpr expr: the MediumLevelILExpr to add to the current MediumLevelILFunction + :return: number of MediumLevelILExpr in the current function + :rtype: int + """ + return core.BNMediumLevelILAddInstruction(self.handle, expr.index) + + def goto(self, label): + """ + ``goto`` returns a goto expression which jumps to the provided MediumLevelILLabel. + + :param MediumLevelILLabel label: Label to jump to + :return: the MediumLevelILExpr that jumps to the provided label + :rtype: MediumLevelILExpr + """ + return MediumLevelILExpr(core.BNMediumLevelILGoto(self.handle, label.handle)) + + def if_expr(self, operand, t, f): + """ + ``if_expr`` returns the ``if`` expression which depending on condition ``operand`` jumps to the MediumLevelILLabel + ``t`` when the condition expression ``operand`` is non-zero and ``f`` when it's zero. + + :param MediumLevelILExpr operand: comparison expression to evaluate. + :param MediumLevelILLabel t: Label for the true branch + :param MediumLevelILLabel f: Label for the false branch + :return: the MediumLevelILExpr for the if expression + :rtype: MediumLevelILExpr + """ + return MediumLevelILExpr(core.BNMediumLevelILIf(self.handle, operand.index, t.handle, f.handle)) + + def mark_label(self, label): + """ + ``mark_label`` assigns a MediumLevelILLabel to the current IL address. + + :param MediumLevelILLabel label: + :rtype: None + """ + core.BNMediumLevelILMarkLabel(self.handle, label.handle) + + def add_label_list(self, labels): + """ + ``add_label_list`` returns a label list expression for the given list of MediumLevelILLabel objects. + + :param list(MediumLevelILLabel) lables: the list of MediumLevelILLabel to get a label list expression from + :return: the label list expression + :rtype: MediumLevelILExpr + """ + label_list = (ctypes.POINTER(core.BNMediumLevelILLabel) * len(labels))() + for i in xrange(len(labels)): + label_list[i] = labels[i].handle + return MediumLevelILExpr(core.BNMediumLevelILAddLabelList(self.handle, label_list, len(labels))) + + def add_operand_list(self, operands): + """ + ``add_operand_list`` returns an operand list expression for the given list of integer operands. + + :param list(int) operands: list of operand numbers + :return: an operand list expression + :rtype: MediumLevelILExpr + """ + operand_list = (ctypes.c_ulonglong * len(operands))() + for i in xrange(len(operands)): + operand_list[i] = operands[i] + return MediumLevelILExpr(core.BNMediumLevelILAddOperandList(self.handle, operand_list, len(operands))) + + def operand(self, n, expr): + """ + ``operand`` sets the operand number of the expression ``expr`` and passes back ``expr`` without modification. + + :param int n: + :param MediumLevelILExpr expr: + :return: returns the expression ``expr`` unmodified + :rtype: MediumLevelILExpr + """ + core.BNMediumLevelILSetExprSourceOperand(self.handle, expr.index, n) + return expr + + def finalize(self): + """ + ``finalize`` ends the function and computes the list of basic blocks. + + :rtype: None + """ + core.BNFinalizeMediumLevelILFunction(self.handle) + + def get_ssa_instruction_index(self, instr): + return core.BNGetMediumLevelILSSAInstructionIndex(self.handle, instr) + + def get_non_ssa_instruction_index(self, instr): + return core.BNGetMediumLevelILNonSSAInstructionIndex(self.handle, instr) + + def get_ssa_var_definition(self, var, index): + var_data = core.BNILVariable() + var_data.type = var.type + var_data.index = var.index + var_data.identifier = var.identifier + result = core.BNGetMediumLevelILSSAVarDefinition(self.handle, var_data, index) + if result >= core.BNGetMediumLevelILInstructionCount(self.handle): + return None + return result + + def get_ssa_memory_definition(self, index): + result = core.BNGetMediumLevelILSSAMemoryDefinition(self.handle, index) + if result >= core.BNGetMediumLevelILInstructionCount(self.handle): + return None + return result + + def get_ssa_var_uses(self, var, index): + count = ctypes.c_ulonglong() + var_data = core.BNILVariable() + var_data.type = var.type + var_data.index = var.index + var_data.identifier = var.identifier + instrs = core.BNGetMediumLevelILSSAVarUses(self.handle, var_data, index, count) + result = [] + for i in xrange(0, count.value): + result.append(instrs[i]) + core.BNFreeILInstructionList(instrs) + return result + + def get_ssa_memory_uses(self, index): + count = ctypes.c_ulonglong() + instrs = core.BNGetMediumLevelILSSAMemoryUses(self.handle, index, count) + result = [] + for i in xrange(0, count.value): + result.append(instrs[i]) + core.BNFreeILInstructionList(instrs) + return result + + def get_ssa_var_value(self, var, index): + var_data = core.BNILVariable() + var_data.type = var.type + var_data.index = var.index + var_data.identifier = var.identifier + value = core.BNGetMediumLevelILSSAVarValue(self.handle, var_data, index) + result = function.RegisterValue(self.arch, value) + core.BNFreeRegisterValue(value) + return result + + +class MediumLevelILBasicBlock(basicblock.BasicBlock): + def __init__(self, view, handle, owner): + super(MediumLevelILBasicBlock, self).__init__(view, handle) + self.il_function = owner + + def __iter__(self): + for idx in xrange(self.start, self.end): + yield self.il_function[idx] + + def __getitem__(self, idx): + size = self.end - self.start + if idx > size or idx < -size: + raise IndexError("list index is out of range") + if idx >= 0: + return self.il_function[idx + self.start] + else: + return self.il_function[self.end + idx] -- cgit v1.3.1 From 7aab4e4a3f8f2daadd1fbd00259da5b01090d84c Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 2 Mar 2017 00:37:46 -0500 Subject: Adding MLIL instructions, moving stack contents data flow to a later stage --- binaryninjaapi.h | 6 +++++- binaryninjacore.h | 7 +++++-- lowlevelil.cpp | 7 ------- mediumlevelil.cpp | 31 +++++++++++++++++++++++++++++++ python/lowlevelil.py | 6 ------ python/mediumlevelil.py | 5 ++++- 6 files changed, 45 insertions(+), 17 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 1367e7c1..e3ba4968 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2180,7 +2180,6 @@ namespace BinaryNinja RegisterValue GetSSARegisterValue(uint32_t reg, size_t idx); RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); - RegisterValue GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size); RegisterValue GetExprValue(size_t expr); }; @@ -2207,12 +2206,17 @@ namespace BinaryNinja ExprId SetVar(size_t size, const BNILVariable& var, ExprId src); ExprId SetVarField(size_t size, const BNILVariable& var, int64_t offset, ExprId src); + ExprId SetVarSplit(size_t size, const BNILVariable& high, const BNILVariable& low, ExprId src); ExprId SetVarSSA(size_t size, const BNILVariable& var, size_t index, ExprId src); ExprId SetVarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex, ExprId src); + ExprId SetVarSplitSSA(size_t size, const BNILVariable& high, size_t highIndex, + const BNILVariable& low, size_t lowIndex, ExprId src); ExprId Var(size_t size, const BNILVariable& var); ExprId VarField(size_t size, const BNILVariable& var, int64_t offset); ExprId VarSSA(size_t size, const BNILVariable& var, size_t index); ExprId VarFieldSSA(size_t size, const BNILVariable& var, int64_t offset, size_t varIndex); + ExprId AddressOf(size_t size, const BNILVariable& var); + ExprId AddressOfField(size_t size, const BNILVariable& var, int64_t offset); ExprId Goto(BNMediumLevelILLabel& label); ExprId If(ExprId operand, BNMediumLevelILLabel& t, BNMediumLevelILLabel& f); diff --git a/binaryninjacore.h b/binaryninjacore.h index aa9bb49b..d35f806c 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -645,10 +645,13 @@ extern "C" MLIL_NOP, MLIL_SET_VAR, // Not valid in SSA form (see MLIL_SET_VAR_SSA) MLIL_SET_VAR_FIELD, // Not valid in SSA form (see MLIL_SET_VAR_FIELD) + MLIL_SET_VAR_SPLIT, // Not valid in SSA form (see MLIL_SET_VAR_SPLIT_SSA) MLIL_LOAD, // Not valid in SSA form (see MLIL_LOAD_SSA) MLIL_STORE, // Not valid in SSA form (see MLIL_STORE_SSA) MLIL_VAR, // Not valid in SSA form (see MLIL_VAR_SSA) MLIL_VAR_FIELD, // Not valid in SSA form (see MLIL_VAR_SSA_FIELD) + MLIL_ADDRESS_OF, + MLIL_ADDRESS_OF_FIELD, MLIL_CONST, MLIL_ADD, MLIL_ADC, @@ -708,6 +711,8 @@ extern "C" // The following instructions are only used in SSA form MLIL_SET_VAR_SSA, MLIL_SET_VAR_SSA_FIELD, + MLIL_SET_VAR_SPLIT_SSA, + MLIL_VAR_SPLIT_DEST_SSA, MLIL_VAR_SSA, MLIL_VAR_SSA_FIELD, MLIL_CALL_SSA, @@ -2151,8 +2156,6 @@ extern "C" uint32_t reg, size_t idx); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAFlagValue(BNLowLevelILFunction* func, uint32_t flag, size_t idx); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILSSAStackContents(BNLowLevelILFunction* func, - size_t memoryIndex, int64_t offset, size_t size); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 5a789981..342effea 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -767,13 +767,6 @@ RegisterValue LowLevelILFunction::GetSSAFlagValue(uint32_t flag, size_t idx) } -RegisterValue LowLevelILFunction::GetSSAStackContents(size_t memoryIndex, int64_t offset, size_t size) -{ - BNRegisterValue value = BNGetLowLevelILSSAStackContents(m_object, memoryIndex, offset, size); - return RegisterValue::FromAPIObject(value); -} - - RegisterValue LowLevelILFunction::GetExprValue(size_t expr) { BNRegisterValue value = BNGetLowLevelILExprValue(m_object, expr); diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp index f6ad5bfd..8c97db61 100644 --- a/mediumlevelil.cpp +++ b/mediumlevelil.cpp @@ -86,6 +86,13 @@ ExprId MediumLevelILFunction::SetVarField(size_t size, const BNILVariable& var, } +ExprId MediumLevelILFunction::SetVarSplit(size_t size, const BNILVariable& high, const BNILVariable& low, ExprId src) +{ + return AddExpr(MLIL_SET_VAR_SPLIT, size, ((uint64_t)high.type << 32) | (uint64_t)high.index, high.identifier, + ((uint64_t)low.type << 32) | (uint64_t)low.index, low.identifier, src); +} + + ExprId MediumLevelILFunction::SetVarSSA(size_t size, const BNILVariable& var, size_t varIndex, ExprId src) { return AddExpr(MLIL_SET_VAR_SSA, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier, @@ -101,6 +108,17 @@ ExprId MediumLevelILFunction::SetVarFieldSSA(size_t size, const BNILVariable& va } +ExprId MediumLevelILFunction::SetVarSplitSSA(size_t size, const BNILVariable& high, size_t highIndex, + const BNILVariable& low, size_t lowIndex, ExprId src) +{ + return AddExpr(MLIL_SET_VAR_SPLIT_SSA, size, + AddExpr(MLIL_VAR_SPLIT_DEST_SSA, size, ((uint64_t)high.type << 32) | (uint64_t)high.index, + high.identifier, highIndex), + AddExpr(MLIL_VAR_SPLIT_DEST_SSA, size, ((uint64_t)low.type << 32) | (uint64_t)low.index, + low.identifier, lowIndex), src); +} + + ExprId MediumLevelILFunction::Var(size_t size, const BNILVariable& var) { return AddExpr(MLIL_VAR, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier); @@ -127,6 +145,19 @@ ExprId MediumLevelILFunction::VarFieldSSA(size_t size, const BNILVariable& var, } +ExprId MediumLevelILFunction::AddressOf(size_t size, const BNILVariable& var) +{ + return AddExpr(MLIL_ADDRESS_OF, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, var.identifier); +} + + +ExprId MediumLevelILFunction::AddressOfField(size_t size, const BNILVariable& var, int64_t offset) +{ + return AddExpr(MLIL_ADDRESS_OF_FIELD, size, ((uint64_t)var.type << 32) | (uint64_t)var.index, + var.identifier, offset); +} + + ExprId MediumLevelILFunction::Goto(BNMediumLevelILLabel& label) { return BNMediumLevelILGoto(m_object, &label); diff --git a/python/lowlevelil.py b/python/lowlevelil.py index ed1cedd4..40cb964c 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -1422,12 +1422,6 @@ class LowLevelILFunction(object): core.BNFreeRegisterValue(value) return result - def get_ssa_stack_contents(self, memory_index, offset, size): - value = core.BNGetLowLevelILSSAStackContents(self.handle, memory_index, offset, size) - result = function.RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) - return result - class LowLevelILBasicBlock(basicblock.BasicBlock): def __init__(self, view, handle, owner): diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index c4c4aa23..839c45ce 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -47,6 +47,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_NOP: [], MediumLevelILOperation.MLIL_SET_VAR: [("dest", "var"), ("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_FIELD: [("dest", "var"), ("offset", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_SET_VAR_SPLIT: [("high", "var"), ("low", "var"), ("src", "expr")], MediumLevelILOperation.MLIL_LOAD: [("src", "expr")], MediumLevelILOperation.MLIL_STORE: [("dest", "expr"), ("src", "expr")], MediumLevelILOperation.MLIL_VAR: [("src", "var")], @@ -108,12 +109,14 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_UNIMPL_MEM: [("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA: [("dest", "var"), ("index", "int"), ("src", "expr")], MediumLevelILOperation.MLIL_SET_VAR_SSA_FIELD: [("dest", "var"), ("index", "int"), ("offset", "int"), ("src", "expr")], + MediumLevelILOperation.MLIL_SET_VAR_SPLIT_SSA: [("high", "expr"), ("low", "expr"), ("src", "expr")], + MediumLevelILOperation.MLIL_VAR_SPLIT_DEST_SSA: [("dest", "var"), ("index", "int")], MediumLevelILOperation.MLIL_VAR_SSA: [("src", "var"), ("index", "int")], MediumLevelILOperation.MLIL_VAR_SSA_FIELD: [("src", "var"), ("index", "int"), ("offset", "int")], MediumLevelILOperation.MLIL_CALL_SSA: [("output", "expr"), ("dest", "expr"), ("param", "expr")], MediumLevelILOperation.MLIL_SYSCALL_SSA: [("output", "expr"), ("param", "expr")], MediumLevelILOperation.MLIL_CALL_OUTPUT_SSA: [("dest_memory", "int"), ("dest", "var_ssa_list")], - MediumLevelILOperation.MLIL_CALL_PARAM_SSA: [("src", "var_ssa_list")], + MediumLevelILOperation.MLIL_CALL_PARAM_SSA: [("src_memory", "int"), ("src", "var_ssa_list")], MediumLevelILOperation.MLIL_LOAD_SSA: [("src", "expr"), ("src_memory", "int")], MediumLevelILOperation.MLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")], MediumLevelILOperation.MLIL_VAR_PHI: [("dest", "var"), ("index", "int"), ("src", "var_ssa_list")], -- cgit v1.3.1 From 29be664b3c91d135b54ed34976357bb7d3413e94 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Fri, 10 Mar 2017 19:21:10 -0500 Subject: Mappings between low level IL and medium level IL --- binaryninjaapi.h | 14 ++++++++++++++ binaryninjacore.h | 26 ++++++++++++++++++++++--- lowlevelil.cpp | 36 ++++++++++++++++++++++++++++++++++ mediumlevelil.cpp | 39 +++++++++++++++++++++++++++++++++++++ python/lowlevelil.py | 45 +++++++++++++++++++++++++++++++++++++++++++ python/mediumlevelil.py | 51 +++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 208 insertions(+), 3 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index f63deee1..ee342851 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -2149,6 +2149,7 @@ namespace BinaryNinja BNLowLevelILInstruction operator[](size_t i) const; size_t GetIndexForInstruction(size_t i) const; size_t GetInstructionCount() const; + size_t GetExprCount() const; void AddLabelForAddress(Architecture* arch, ExprId addr); BNLowLevelILLabel* GetLabelForAddress(Architecture* arch, ExprId addr); @@ -2182,6 +2183,11 @@ namespace BinaryNinja RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); RegisterValue GetExprValue(size_t expr); + + Ref GetMediumLevelIL() const; + Ref GetMappedMediumLevelIL() const; + size_t GetMappedMediumLevelILInstructionIndex(size_t instr) const; + size_t GetMappedMediumLevelILExprIndex(size_t expr) const; }; struct MediumLevelILLabel: public BNMediumLevelILLabel @@ -2236,6 +2242,7 @@ namespace BinaryNinja BNMediumLevelILInstruction operator[](size_t i) const; size_t GetIndexForInstruction(size_t i) const; size_t GetInstructionCount() const; + size_t GetExprCount() const; void Finalize(); @@ -2259,6 +2266,13 @@ namespace BinaryNinja RegisterValue GetSSAVarValue(const BNILVariable& var, size_t idx); RegisterValue GetExprValue(size_t expr); + + size_t GetSSAVarIndexAtInstruction(const BNILVariable& var, size_t instr) const; + size_t GetSSAMemoryIndexAtInstruction(size_t instr) const; + + Ref GetLowLevelIL() const; + size_t GetLowLevelILInstructionIndex(size_t instr) const; + size_t GetLowLevelILExprIndex(size_t expr) const; }; class FunctionRecognizer diff --git a/binaryninjacore.h b/binaryninjacore.h index 1d5e10d8..66d5f010 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -60,6 +60,8 @@ #define BN_INVALID_OPERAND 0xffffffff +#define BN_INVALID_EXPR ((size_t)-1) + #define BN_DEFAULT_MIN_STRING_LENGTH 4 #define BN_MAX_STRING_LENGTH 128 @@ -366,7 +368,9 @@ extern "C" LiftedILFunctionGraph = 2, LowLevelILSSAFormFunctionGraph = 3, MediumLevelILFunctionGraph = 4, - MediumLevelILSSAFormFunctionGraph = 5 + MediumLevelILSSAFormFunctionGraph = 5, + MappedMediumLevelILFunctionGraph = 6, + MappedMediumLevelILSSAFormFunctionGraph = 7 }; enum BNDisassemblyOption @@ -727,8 +731,8 @@ extern "C" MLIL_CALL_UNTYPED_SSA, MLIL_SYSCALL_SSA, MLIL_SYSCALL_UNTYPED_SSA, - MLIL_CALL_PARAM_SSA, // Only valid within the LLIL_CALL_SSA, LLIL_SYSCALL_SSA family instructions - MLIL_CALL_OUTPUT_SSA, // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA family instructions + MLIL_CALL_PARAM_SSA, // Only valid within the MLIL_CALL_SSA, MLIL_SYSCALL_SSA family instructions + MLIL_CALL_OUTPUT_SSA, // Only valid within the MLIL_CALL_SSA or MLIL_SYSCALL_SSA family instructions MLIL_LOAD_SSA, MLIL_STORE_SSA, MLIL_VAR_PHI, @@ -2131,6 +2135,7 @@ extern "C" BINARYNINJACOREAPI BNLowLevelILInstruction BNGetLowLevelILByIndex(BNLowLevelILFunction* func, size_t i); BINARYNINJACOREAPI size_t BNGetLowLevelILIndexForInstruction(BNLowLevelILFunction* func, size_t i); BINARYNINJACOREAPI size_t BNGetLowLevelILInstructionCount(BNLowLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetLowLevelILExprCount(BNLowLevelILFunction* func); BINARYNINJACOREAPI void BNAddLowLevelILLabelForAddress(BNLowLevelILFunction* func, BNArchitecture* arch, uint64_t addr); BINARYNINJACOREAPI BNLowLevelILLabel* BNGetLowLevelILLabelForAddress(BNLowLevelILFunction* func, @@ -2169,6 +2174,11 @@ extern "C" BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILForLowLevelIL(BNLowLevelILFunction* func); + BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMappedMediumLevelIL(BNLowLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetMappedMediumLevelILInstructionIndex(BNLowLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetMappedMediumLevelILExprIndex(BNLowLevelILFunction* func, size_t expr); + // Medium-level IL BINARYNINJACOREAPI BNMediumLevelILFunction* BNCreateMediumLevelILFunction(BNArchitecture* arch, BNFunction* func); BINARYNINJACOREAPI BNMediumLevelILFunction* BNNewMediumLevelILFunctionReference(BNMediumLevelILFunction* func); @@ -2199,6 +2209,7 @@ extern "C" BINARYNINJACOREAPI BNMediumLevelILInstruction BNGetMediumLevelILByIndex(BNMediumLevelILFunction* func, size_t i); BINARYNINJACOREAPI size_t BNGetMediumLevelILIndexForInstruction(BNMediumLevelILFunction* func, size_t i); BINARYNINJACOREAPI size_t BNGetMediumLevelILInstructionCount(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetMediumLevelILExprCount(BNMediumLevelILFunction* func); BINARYNINJACOREAPI bool BNGetMediumLevelILExprText(BNMediumLevelILFunction* func, BNArchitecture* arch, size_t i, BNInstructionTextToken** tokens, size_t* count); @@ -2226,6 +2237,15 @@ extern "C" const BNILVariable* var, size_t idx); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILExprValue(BNMediumLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAVarIndexAtILInstruction(BNMediumLevelILFunction* func, + const BNILVariable* var, size_t instr); + BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAMemoryIndexAtILInstruction(BNMediumLevelILFunction* func, + size_t instr); + + BINARYNINJACOREAPI BNLowLevelILFunction* BNGetLowLevelILForMediumLevelIL(BNMediumLevelILFunction* func); + BINARYNINJACOREAPI size_t BNGetLowLevelILInstructionIndex(BNMediumLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI size_t BNGetLowLevelILExprIndex(BNMediumLevelILFunction* func, size_t expr); + // Types BINARYNINJACOREAPI BNType* BNCreateVoidType(void); BINARYNINJACOREAPI BNType* BNCreateBoolType(void); diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 342effea..bd038b6e 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -553,6 +553,12 @@ size_t LowLevelILFunction::GetInstructionCount() const } +size_t LowLevelILFunction::GetExprCount() const +{ + return BNGetLowLevelILExprCount(m_object); +} + + void LowLevelILFunction::AddLabelForAddress(Architecture* arch, ExprId addr) { BNAddLowLevelILLabelForAddress(m_object, arch->GetObject(), addr); @@ -772,3 +778,33 @@ RegisterValue LowLevelILFunction::GetExprValue(size_t expr) BNRegisterValue value = BNGetLowLevelILExprValue(m_object, expr); return RegisterValue::FromAPIObject(value); } + + +Ref LowLevelILFunction::GetMediumLevelIL() const +{ + BNMediumLevelILFunction* func = BNGetMediumLevelILForLowLevelIL(m_object); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} + + +Ref LowLevelILFunction::GetMappedMediumLevelIL() const +{ + BNMediumLevelILFunction* func = BNGetMappedMediumLevelIL(m_object); + if (!func) + return nullptr; + return new MediumLevelILFunction(func); +} + + +size_t LowLevelILFunction::GetMappedMediumLevelILInstructionIndex(size_t instr) const +{ + return BNGetMappedMediumLevelILInstructionIndex(m_object, instr); +} + + +size_t LowLevelILFunction::GetMappedMediumLevelILExprIndex(size_t expr) const +{ + return BNGetMappedMediumLevelILExprIndex(m_object, expr); +} diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp index f1f0bdd2..04b1cffd 100644 --- a/mediumlevelil.cpp +++ b/mediumlevelil.cpp @@ -268,6 +268,12 @@ size_t MediumLevelILFunction::GetInstructionCount() const } +size_t MediumLevelILFunction::GetExprCount() const +{ + return BNGetMediumLevelILExprCount(m_object); +} + + void MediumLevelILFunction::Finalize() { BNFinalizeMediumLevelILFunction(m_object); @@ -436,3 +442,36 @@ RegisterValue MediumLevelILFunction::GetExprValue(size_t expr) BNRegisterValue value = BNGetMediumLevelILExprValue(m_object, expr); return RegisterValue::FromAPIObject(value); } + + +size_t MediumLevelILFunction::GetSSAVarIndexAtInstruction(const BNILVariable& var, size_t instr) const +{ + return BNGetMediumLevelILSSAVarIndexAtILInstruction(m_object, &var, instr); +} + + +size_t MediumLevelILFunction::GetSSAMemoryIndexAtInstruction(size_t instr) const +{ + return BNGetMediumLevelILSSAMemoryIndexAtILInstruction(m_object, instr); +} + + +Ref MediumLevelILFunction::GetLowLevelIL() const +{ + BNLowLevelILFunction* func = BNGetLowLevelILForMediumLevelIL(m_object); + if (!func) + return nullptr; + return new LowLevelILFunction(func); +} + + +size_t MediumLevelILFunction::GetLowLevelILInstructionIndex(size_t instr) const +{ + return BNGetLowLevelILInstructionIndex(m_object, instr); +} + + +size_t MediumLevelILFunction::GetLowLevelILExprIndex(size_t expr) const +{ + return BNGetLowLevelILExprIndex(m_object, expr); +} diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 40cb964c..462d4ade 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -25,6 +25,7 @@ import _binaryninjacore as core from .enums import LowLevelILOperation, LowLevelILFlagCondition, InstructionTextTokenType import function import basicblock +import mediumlevelil class LowLevelILLabel(object): @@ -249,6 +250,14 @@ class LowLevelILInstruction(object): return LowLevelILInstruction(self.function.non_ssa_form, core.BNGetLowLevelILNonSSAExprIndex(self.function.handle, self.expr_index)) + @property + def mapped_medium_level_il(self): + """Gets the medium level IL expression corresponding to this expression""" + expr = self.function.get_mapped_medium_level_il_expr_index(self.expr_index) + if expr is None: + return None + return mediumlevelil.MediumLevelILInstruction(self.function.mapped_medium_level_il, expr) + @property def value(self): """Value of expression using static data flow analysis (read-only)""" @@ -381,6 +390,24 @@ class LowLevelILFunction(object): return None return LowLevelILFunction(self.arch, result, self.source_function) + @property + def medium_level_il(self): + """Medium level IL for this low level IL.""" + result = core.BNGetMediumLevelILForLowLevelIL(self.handle) + if not result: + return None + return mediumlevelil.MediumLevelILFunction(self.arch, result, self.source_function) + + @property + def mapped_medium_level_il(self): + """Medium level IL with mappings between low level IL and medium level IL. Unused stores are not removed. + Typically, this should only be used to answer queries on assembly or low level IL where the query is + easier to perform on medium level IL.""" + result = core.BNGetMappedMediumLevelIL(self.handle) + if not result: + return None + return mediumlevelil.MediumLevelILFunction(self.arch, result, self.source_function) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -1422,6 +1449,24 @@ class LowLevelILFunction(object): core.BNFreeRegisterValue(value) return result + def get_mapped_medium_level_il_instruction_index(self, instr): + med_il = self.mapped_medium_level_il + if med_il is None: + return None + result = core.BNGetMappedMediumLevelILInstructionIndex(self.handle, instr) + if result >= core.BNGetMediumLevelILInstructionCount(med_il.handle): + return None + return result + + def get_mapped_medium_level_il_expr_index(self, expr): + med_il = self.mapped_medium_level_il + if med_il is None: + return None + result = core.BNGetMappedMediumLevelILExprIndex(self.handle, expr) + if result >= core.BNGetMediumLevelILExprCount(med_il.handle): + return None + return result + class LowLevelILBasicBlock(basicblock.BasicBlock): def __init__(self, view, handle, owner): diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 9f25ee97..00d7215f 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -25,6 +25,7 @@ import _binaryninjacore as core from .enums import MediumLevelILOperation, InstructionTextTokenType, ILVariableSourceType import function import basicblock +import lowlevelil class MediumLevelILLabel(object): @@ -258,6 +259,14 @@ class MediumLevelILInstruction(object): core.BNFreeRegisterValue(value) return result + @property + def low_level_il(self): + """Low level IL form of this expression""" + expr = self.function.get_low_level_il_expr_index(self.expr_index) + if expr is None: + return None + return lowlevelil.LowLevelILInstruction(self.function.low_level_il.ssa_form, expr) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -350,6 +359,14 @@ class MediumLevelILFunction(object): return None return MediumLevelILFunction(self.arch, result, self.source_function) + @property + def low_level_il(self): + """Low level IL for this function""" + result = core.BNGetLowLevelILForMediumLevelIL(self.handle) + if not result: + return None + return lowlevelil.LowLevelILFunction(self.arch, result, self.source_function) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -540,6 +557,40 @@ class MediumLevelILFunction(object): core.BNFreeRegisterValue(value) return result + def get_ssa_var_index_at_instruction(self, var, instr): + var_data = core.BNILVariable() + var_data.type = var.type + var_data.index = var.index + var_data.identifier = var.identifier + return core.BNGetMediumLevelILSSAVarIndexAtILInstruction(self.handle, var_data, instr) + + def get_ssa_memory_index_at_instruction(self, instr): + return core.BNGetMediumLevelILSSAMemoryIndexAtILInstruction(self.handle, instr) + + def get_low_level_il_instruction_index(self, instr): + low_il = self.low_level_il + if low_il is None: + return None + low_il = low_il.ssa_form + if low_il is None: + return None + result = core.BNGetLowLevelILInstructionIndex(self.handle, instr) + if result >= core.BNGetLowLevelILInstructionCount(low_il.handle): + return None + return result + + def get_low_level_il_expr_index(self, expr): + low_il = self.low_level_il + if low_il is None: + return None + low_il = low_il.ssa_form + if low_il is None: + return None + result = core.BNGetLowLevelILExprIndex(self.handle, expr) + if result >= core.BNGetLowLevelILExprCount(low_il.handle): + return None + return result + class MediumLevelILBasicBlock(basicblock.BasicBlock): def __init__(self, view, handle, owner): -- cgit v1.3.1 From cec08b6240f775a831226d9f36ee7f96b369f285 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 16 Mar 2017 03:41:04 -0400 Subject: Adding APIs to query register and stack contents from IL --- binaryninjaapi.h | 34 +++++++++-- binaryninjacore.h | 63 ++++++++++++++++++-- function.cpp | 28 --------- lowlevelil.cpp | 91 +++++++++++++++++++++++++++++ mediumlevelil.cpp | 102 +++++++++++++++++++++++++++++++++ python/function.py | 42 -------------- python/lowlevelil.py | 98 ++++++++++++++++++++++++++++++- python/mediumlevelil.py | 149 ++++++++++++++++++++++++++++++++++++++++-------- 8 files changed, 503 insertions(+), 104 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 3f39c827..131d6a17 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1894,12 +1894,8 @@ namespace BinaryNinja std::vector GetLowLevelILExitsForInstruction(Architecture* arch, uint64_t addr); RegisterValue GetRegisterValueAtInstruction(Architecture* arch, uint64_t addr, uint32_t reg); RegisterValue GetRegisterValueAfterInstruction(Architecture* arch, uint64_t addr, uint32_t reg); - RegisterValue GetRegisterValueAtLowLevelILInstruction(size_t i, uint32_t reg); - RegisterValue GetRegisterValueAfterLowLevelILInstruction(size_t i, uint32_t reg); RegisterValue GetStackContentsAtInstruction(Architecture* arch, uint64_t addr, int64_t offset, size_t size); RegisterValue GetStackContentsAfterInstruction(Architecture* arch, uint64_t addr, int64_t offset, size_t size); - RegisterValue GetStackContentsAtLowLevelILInstruction(size_t i, int64_t offset, size_t size); - RegisterValue GetStackContentsAfterLowLevelILInstruction(size_t i, int64_t offset, size_t size); RegisterValue GetParameterValueAtInstruction(Architecture* arch, uint64_t addr, Type* functionType, size_t i); RegisterValue GetParameterValueAtLowLevelILInstruction(size_t instr, Type* functionType, size_t i); std::vector GetRegistersReadByInstruction(Architecture* arch, uint64_t addr); @@ -2183,6 +2179,20 @@ namespace BinaryNinja RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); RegisterValue GetExprValue(size_t expr); + RegisterValue GetPossibleExprValues(size_t expr); + + RegisterValue GetRegisterValueAtInstruction(uint32_t reg, size_t instr); + RegisterValue GetRegisterValueAfterInstruction(uint32_t reg, size_t instr); + RegisterValue GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); + RegisterValue GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); + RegisterValue GetFlagValueAtInstruction(uint32_t flag, size_t instr); + RegisterValue GetFlagValueAfterInstruction(uint32_t flag, size_t instr); + RegisterValue GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); + RegisterValue GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); + RegisterValue GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); Ref GetMediumLevelIL() const; Ref GetMappedMediumLevelIL() const; @@ -2272,6 +2282,22 @@ namespace BinaryNinja size_t GetSSAVarIndexAtInstruction(const BNILVariable& var, size_t instr) const; size_t GetSSAMemoryIndexAtInstruction(size_t instr) const; + BNILVariable GetVariableForRegisterAtInstruction(uint32_t reg, size_t instr) const; + BNILVariable GetVariableForFlagAtInstruction(uint32_t flag, size_t instr) const; + BNILVariable GetVariableForStackLocationAtInstruction(int64_t offset, size_t instr) const; + + RegisterValue GetRegisterValueAtInstruction(uint32_t reg, size_t instr); + RegisterValue GetRegisterValueAfterInstruction(uint32_t reg, size_t instr); + RegisterValue GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); + RegisterValue GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); + RegisterValue GetFlagValueAtInstruction(uint32_t flag, size_t instr); + RegisterValue GetFlagValueAfterInstruction(uint32_t flag, size_t instr); + RegisterValue GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); + RegisterValue GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); + RegisterValue GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + RegisterValue GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); BNILBranchDependence GetBranchDependenceAtInstruction(size_t curInstr, size_t branchInstr) const; std::map GetAllBranchDependenceAtInstruction(size_t instr) const; diff --git a/binaryninjacore.h b/binaryninjacore.h index 4905a73c..eaba1a51 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -1848,16 +1848,10 @@ extern "C" uint64_t addr, uint32_t reg); BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAfterInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, uint32_t reg); - BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAtLowLevelILInstruction(BNFunction* func, size_t i, uint32_t reg); - BINARYNINJACOREAPI BNRegisterValue BNGetRegisterValueAfterLowLevelILInstruction(BNFunction* func, size_t i, uint32_t reg); BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAtInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, int64_t offset, size_t size); BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAfterInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, int64_t offset, size_t size); - BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAtLowLevelILInstruction(BNFunction* func, size_t i, - int64_t offset, size_t size); - BINARYNINJACOREAPI BNRegisterValue BNGetStackContentsAfterLowLevelILInstruction(BNFunction* func, size_t i, - int64_t offset, size_t size); BINARYNINJACOREAPI BNRegisterValue BNGetParameterValueAtInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, BNType* functionType, size_t i); BINARYNINJACOREAPI BNRegisterValue BNGetParameterValueAtLowLevelILInstruction(BNFunction* func, size_t instr, @@ -2186,6 +2180,32 @@ extern "C" uint32_t flag, size_t idx); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleExprValues(BNLowLevelILFunction* func, size_t expr); + + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAtInstruction(BNLowLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAfterInstruction(BNLowLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleRegisterValuesAtInstruction(BNLowLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleRegisterValuesAfterInstruction(BNLowLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAtInstruction(BNLowLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAfterInstruction(BNLowLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleFlagValuesAtInstruction(BNLowLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleFlagValuesAfterInstruction(BNLowLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAtInstruction(BNLowLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAfterInstruction(BNLowLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleStackContentsAtInstruction(BNLowLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleStackContentsAfterInstruction(BNLowLevelILFunction* func, + int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILForLowLevelIL(BNLowLevelILFunction* func); BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMappedMediumLevelIL(BNLowLevelILFunction* func); @@ -2258,6 +2278,37 @@ extern "C" const BNILVariable* var, size_t instr); BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAMemoryIndexAtILInstruction(BNMediumLevelILFunction* func, size_t instr); + BINARYNINJACOREAPI BNILVariable BNGetMediumLevelILVariableForRegisterAtInstruction(BNMediumLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNILVariable BNGetMediumLevelILVariableForFlagAtInstruction(BNMediumLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNILVariable BNGetMediumLevelILVariableForStackLocationAtInstruction(BNMediumLevelILFunction* func, + int64_t offset, size_t instr); + + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILRegisterValueAtInstruction(BNMediumLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILRegisterValueAfterInstruction(BNMediumLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleRegisterValuesAtInstruction(BNMediumLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(BNMediumLevelILFunction* func, + uint32_t reg, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAtInstruction(BNMediumLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAfterInstruction(BNMediumLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleFlagValuesAtInstruction(BNMediumLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleFlagValuesAfterInstruction(BNMediumLevelILFunction* func, + uint32_t flag, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAtInstruction(BNMediumLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAfterInstruction(BNMediumLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleStackContentsAtInstruction(BNMediumLevelILFunction* func, + int64_t offset, size_t len, size_t instr); + BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleStackContentsAfterInstruction(BNMediumLevelILFunction* func, + int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNILBranchDependence BNGetMediumLevelILBranchDependence(BNMediumLevelILFunction* func, size_t curInstr, size_t branchInstr); diff --git a/function.cpp b/function.cpp index 9faf68fa..aa56f7af 100644 --- a/function.cpp +++ b/function.cpp @@ -205,20 +205,6 @@ RegisterValue Function::GetRegisterValueAfterInstruction(Architecture* arch, uin } -RegisterValue Function::GetRegisterValueAtLowLevelILInstruction(size_t i, uint32_t reg) -{ - BNRegisterValue value = BNGetRegisterValueAtLowLevelILInstruction(m_object, i, reg); - return RegisterValue::FromAPIObject(value); -} - - -RegisterValue Function::GetRegisterValueAfterLowLevelILInstruction(size_t i, uint32_t reg) -{ - BNRegisterValue value = BNGetRegisterValueAfterLowLevelILInstruction(m_object, i, reg); - return RegisterValue::FromAPIObject(value); -} - - RegisterValue Function::GetStackContentsAtInstruction(Architecture* arch, uint64_t addr, int64_t offset, size_t size) { BNRegisterValue value = BNGetStackContentsAtInstruction(m_object, arch->GetObject(), addr, offset, size); @@ -233,20 +219,6 @@ RegisterValue Function::GetStackContentsAfterInstruction(Architecture* arch, uin } -RegisterValue Function::GetStackContentsAtLowLevelILInstruction(size_t i, int64_t offset, size_t size) -{ - BNRegisterValue value = BNGetStackContentsAtLowLevelILInstruction(m_object, i, offset, size); - return RegisterValue::FromAPIObject(value); -} - - -RegisterValue Function::GetStackContentsAfterLowLevelILInstruction(size_t i, int64_t offset, size_t size) -{ - BNRegisterValue value = BNGetStackContentsAfterLowLevelILInstruction(m_object, i, offset, size); - return RegisterValue::FromAPIObject(value); -} - - RegisterValue Function::GetParameterValueAtInstruction(Architecture* arch, uint64_t addr, Type* functionType, size_t i) { BNRegisterValue value = BNGetParameterValueAtInstruction(m_object, arch->GetObject(), addr, diff --git a/lowlevelil.cpp b/lowlevelil.cpp index bd038b6e..54e26498 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -780,6 +780,97 @@ RegisterValue LowLevelILFunction::GetExprValue(size_t expr) } +RegisterValue LowLevelILFunction::GetPossibleExprValues(size_t expr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleExprValues(m_object, expr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetRegisterValueAtInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILRegisterValueAtInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetRegisterValueAfterInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILRegisterValueAfterInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetFlagValueAtInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILFlagValueAtInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetFlagValueAfterInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILFlagValueAfterInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILStackContentsAtInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILStackContentsAfterInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue LowLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetLowLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + Ref LowLevelILFunction::GetMediumLevelIL() const { BNMediumLevelILFunction* func = BNGetMediumLevelILForLowLevelIL(m_object); diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp index 51dd067d..bb629e64 100644 --- a/mediumlevelil.cpp +++ b/mediumlevelil.cpp @@ -476,6 +476,108 @@ size_t MediumLevelILFunction::GetSSAMemoryIndexAtInstruction(size_t instr) const } +BNILVariable MediumLevelILFunction::GetVariableForRegisterAtInstruction(uint32_t reg, size_t instr) const +{ + return BNGetMediumLevelILVariableForRegisterAtInstruction(m_object, reg, instr); +} + + +BNILVariable MediumLevelILFunction::GetVariableForFlagAtInstruction(uint32_t flag, size_t instr) const +{ + return BNGetMediumLevelILVariableForFlagAtInstruction(m_object, flag, instr); +} + + +BNILVariable MediumLevelILFunction::GetVariableForStackLocationAtInstruction(int64_t offset, size_t instr) const +{ + return BNGetMediumLevelILVariableForStackLocationAtInstruction(m_object, offset, instr); +} + + +RegisterValue MediumLevelILFunction::GetRegisterValueAtInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILRegisterValueAtInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetRegisterValueAfterInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILRegisterValueAfterInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetFlagValueAtInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILFlagValueAtInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetFlagValueAfterInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILFlagValueAfterInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILStackContentsAtInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILStackContentsAfterInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + +RegisterValue MediumLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +{ + BNRegisterValue value = BNGetMediumLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); + return RegisterValue::FromAPIObject(value); +} + + BNILBranchDependence MediumLevelILFunction::GetBranchDependenceAtInstruction(size_t curInstr, size_t branchInstr) const { return BNGetMediumLevelILBranchDependence(m_object, curInstr, branchInstr); diff --git a/python/function.py b/python/function.py index ed2a537c..928597a7 100644 --- a/python/function.py +++ b/python/function.py @@ -459,36 +459,6 @@ class Function(object): core.BNFreeRegisterValue(value) return result - def get_reg_value_at_low_level_il_instruction(self, i, reg, arch=None): - """ - ``get_reg_value_at_low_level_il_instruction`` returns the value of the specified register ``reg`` at the il address - i - - :param int i: il address of instruction to query - :param Architecture arch: (optional) Architecture for the given function - :rtype: function.RegisterValue - :Example: - - >>> func.get_reg_value_at_low_level_il_instruction(15, 'rdi') - - """ - if arch is None: - arch = self.arch - if isinstance(reg, str): - reg = self.arch.regs[reg].index - value = core.BNGetRegisterValueAtLowLevelILInstruction(self.handle, i, reg) - result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) - return result - - def get_reg_value_after_low_level_il_instruction(self, i, reg): - if isinstance(reg, str): - reg = self.arch.regs[reg].index - value = core.BNGetRegisterValueAfterLowLevelILInstruction(self.handle, i, reg) - result = RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) - return result - def get_stack_contents_at(self, addr, offset, size, arch=None): """ ``get_stack_contents_at`` returns the RegisterValue for the item on the stack in the current function at the @@ -523,18 +493,6 @@ class Function(object): core.BNFreeRegisterValue(value) return result - def get_stack_contents_at_low_level_il_instruction(self, i, offset, size): - value = core.BNGetStackContentsAtLowLevelILInstruction(self.handle, i, offset, size) - result = RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) - return result - - def get_stack_contents_after_low_level_il_instruction(self, i, offset, size): - value = core.BNGetStackContentsAfterInstruction(self.handle, i, offset, size) - result = RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) - return result - def get_parameter_at(self, addr, func_type, i, arch=None): if arch is None: arch = self.arch diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 462d4ade..74b030d7 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -260,12 +260,108 @@ class LowLevelILInstruction(object): @property def value(self): - """Value of expression using static data flow analysis (read-only)""" + """Value of expression if constant or a known value (read-only)""" value = core.BNGetLowLevelILExprValue(self.function.handle, self.expr_index) result = function.RegisterValue(self.function.arch, value) core.BNFreeRegisterValue(value) return result + @property + def possible_values(self): + """Possible values of expression using path-sensitive static data flow analysis (read-only)""" + value = core.BNGetLowLevelILPossibleExprValues(self.function.handle, self.expr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_reg_value(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetLowLevelILRegisterValueAtInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_reg_value_after(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetLowLevelILRegisterValueAfterInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_reg_values(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetLowLevelILPossibleRegisterValuesAtInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_reg_values_after(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetLowLevelILPossibleRegisterValuesAfterInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_flag_value(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetLowLevelILFlagValueAtInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_flag_value_after(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetLowLevelILFlagValueAfterInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_flag_values(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetLowLevelILPossibleFlagValuesAtInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_flag_values_after(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetLowLevelILPossibleFlagValuesAfterInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_stack_contents(self, offset, size): + value = core.BNGetLowLevelILStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_stack_contents_after(self, offset, size): + value = core.BNGetLowLevelILStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_stack_contents(self, offset, size): + value = core.BNGetLowLevelILPossibleStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_stack_contents_after(self, offset, size): + value = core.BNGetLowLevelILPossibleStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index a63e1b31..6f482221 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -274,7 +274,13 @@ class MediumLevelILInstruction(object): @property def branch_dependence(self): """Set of branching instructions that must take the true or false path to reach this instruction""" - return self.function.get_all_branch_dependence_at_instruction(self.instr_index) + count = ctypes.c_ulonglong() + deps = core.BNGetAllMediumLevelILBranchDependence(self.function.handle, self.instr_index, count) + result = {} + for i in xrange(0, count.value): + result[deps[i].branch] = ILBranchDependence(deps[i].dependence) + core.BNFreeILBranchDependenceList(deps) + return result @property def low_level_il(self): @@ -284,6 +290,11 @@ class MediumLevelILInstruction(object): return None return lowlevelil.LowLevelILInstruction(self.function.low_level_il.ssa_form, expr) + @property + def ssa_memory_index(self): + """Index of active memory contents in SSA form for this instruction""" + return core.BNGetMediumLevelILSSAMemoryIndexAtILInstruction(self.function.handle, self.instr_index) + def get_ssa_var_possible_values(self, var, index): var_data = core.BNILVariable() var_data.type = var.type @@ -294,6 +305,120 @@ class MediumLevelILInstruction(object): core.BNFreeRegisterValue(value) return result + def get_ssa_var_index(self, var): + var_data = core.BNILVariable() + var_data.type = var.type + var_data.index = var.index + var_data.identifier = var.identifier + return core.BNGetMediumLevelILSSAVarIndexAtILInstruction(self.function.handle, var_data, self.instr_index) + + def get_var_for_reg(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + result = core.BNGetMediumLevelILVariableForRegisterAtInstruction(self.function.handle, reg, self.instr_index) + return function.ILVariable(self.function.source_function, result.type, result.index, result.identifier) + + def get_var_for_flag(self, flag): + if isinstance(flag, str): + flag = self.function.arch.regs[flag].index + result = core.BNGetMediumLevelILVariableForFlagAtInstruction(self.function.handle, flag, self.instr_index) + return function.ILVariable(self.function.source_function, result.type, result.index, result.identifier) + + def get_var_for_stack_location(self, offset): + result = core.BNGetMediumLevelILVariableForStackLocationAtInstruction(self.function.handle, offset, self.instr_index) + return function.ILVariable(self.function.source_function, result.type, result.index, result.identifier) + + def get_reg_value(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetMediumLevelILRegisterValueAtInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_reg_value_after(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetMediumLevelILRegisterValueAfterInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_reg_values(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetMediumLevelILPossibleRegisterValuesAtInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_reg_values_after(self, reg): + if isinstance(reg, str): + reg = self.function.arch.regs[reg].index + value = core.BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(self.function.handle, reg, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_flag_value(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetMediumLevelILFlagValueAtInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_flag_value_after(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetMediumLevelILFlagValueAfterInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_flag_values(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetMediumLevelILPossibleFlagValuesAtInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_flag_values_after(self, flag): + if isinstance(flag, str): + flag = self.function.arch.flags[flag].index + value = core.BNGetMediumLevelILPossibleFlagValuesAfterInstruction(self.function.handle, flag, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_stack_contents(self, offset, size): + value = core.BNGetMediumLevelILStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_stack_contents_after(self, offset, size): + value = core.BNGetMediumLevelILStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_stack_contents(self, offset, size): + value = core.BNGetMediumLevelILPossibleStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_possible_stack_contents_after(self, offset, size): + value = core.BNGetMediumLevelILPossibleStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) + result = function.RegisterValue(self.function.arch, value) + core.BNFreeRegisterValue(value) + return result + + def get_branch_dependence(self, branch_instr): + return ILBranchDependence(core.BNGetMediumLevelILBranchDependence(self.function.handle, self.instr_index, branch_instr)) + def __setattr__(self, name, value): try: object.__setattr__(self, name, value) @@ -584,28 +709,6 @@ class MediumLevelILFunction(object): core.BNFreeRegisterValue(value) return result - def get_ssa_var_index_at_instruction(self, var, instr): - var_data = core.BNILVariable() - var_data.type = var.type - var_data.index = var.index - var_data.identifier = var.identifier - return core.BNGetMediumLevelILSSAVarIndexAtILInstruction(self.handle, var_data, instr) - - def get_ssa_memory_index_at_instruction(self, instr): - return core.BNGetMediumLevelILSSAMemoryIndexAtILInstruction(self.handle, instr) - - def get_branch_dependence_at_instruction(self, cur_instr, branch_instr): - return ILBranchDependence(core.BNGetMediumLevelILBranchDependence(self.handle, cur_instr, branch_instr)) - - def get_all_branch_dependence_at_instruction(self, instr): - count = ctypes.c_ulonglong() - deps = core.BNGetAllMediumLevelILBranchDependence(self.handle, instr, count) - result = {} - for i in xrange(0, count.value): - result[deps[i].branch] = ILBranchDependence(deps[i].dependence) - core.BNFreeILBranchDependenceList(deps) - return result - def get_low_level_il_instruction_index(self, instr): low_il = self.low_level_il if low_il is None: -- cgit v1.3.1 From cb244a62fea649d6840b70b8e7fe7953eb3acc5a Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Wed, 22 Mar 2017 22:43:16 -0400 Subject: Adding new value object to hold disjoint sets --- binaryninjaapi.h | 46 +++++++++++++++----------- binaryninjacore.h | 60 +++++++++++++++++++++------------- function.cpp | 27 ++++++++++++---- lowlevelil.cpp | 42 ++++++++++++------------ mediumlevelil.cpp | 48 +++++++++++++-------------- python/function.py | 86 ++++++++++++++++++++++++++++++++++++------------- python/lowlevelil.py | 37 ++++++++------------- python/mediumlevelil.py | 37 ++++++++------------- 8 files changed, 223 insertions(+), 160 deletions(-) (limited to 'python/lowlevelil.py') diff --git a/binaryninjaapi.h b/binaryninjaapi.h index 131d6a17..af0cf5ce 100644 --- a/binaryninjaapi.h +++ b/binaryninjaapi.h @@ -1853,14 +1853,22 @@ namespace BinaryNinja struct RegisterValue { BNRegisterValueType state; - uint32_t reg; // For EntryValue and OffsetFromEntryValue, the original input register - int64_t value; // Offset for OffsetFromEntryValue, StackFrameOffset or RangeValue, value of register for ConstantValue - uint64_t rangeStart, rangeEnd, rangeStep; // Range of register, inclusive - std::vector table; + int64_t value; static RegisterValue FromAPIObject(BNRegisterValue& value); }; + struct PossibleValueSet + { + BNRegisterValueType state; + int64_t value; + std::vector ranges; + std::set valueSet; + std::vector table; + + static PossibleValueSet FromAPIObject(BNPossibleValueSet& value); + }; + class FunctionGraph; class MediumLevelILFunction; @@ -2179,20 +2187,20 @@ namespace BinaryNinja RegisterValue GetSSAFlagValue(uint32_t flag, size_t idx); RegisterValue GetExprValue(size_t expr); - RegisterValue GetPossibleExprValues(size_t expr); + PossibleValueSet GetPossibleExprValues(size_t expr); RegisterValue GetRegisterValueAtInstruction(uint32_t reg, size_t instr); RegisterValue GetRegisterValueAfterInstruction(uint32_t reg, size_t instr); - RegisterValue GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); - RegisterValue GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); + PossibleValueSet GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); + PossibleValueSet GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); RegisterValue GetFlagValueAtInstruction(uint32_t flag, size_t instr); RegisterValue GetFlagValueAfterInstruction(uint32_t flag, size_t instr); - RegisterValue GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); - RegisterValue GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); + PossibleValueSet GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); + PossibleValueSet GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); RegisterValue GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); RegisterValue GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); - RegisterValue GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); - RegisterValue GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); + PossibleValueSet GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + PossibleValueSet GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); Ref GetMediumLevelIL() const; Ref GetMappedMediumLevelIL() const; @@ -2277,8 +2285,8 @@ namespace BinaryNinja RegisterValue GetSSAVarValue(const BNILVariable& var, size_t idx); RegisterValue GetExprValue(size_t expr); - RegisterValue GetPossibleSSAVarValues(const BNILVariable& var, size_t idx, size_t instr); - RegisterValue GetPossibleExprValues(size_t expr); + PossibleValueSet GetPossibleSSAVarValues(const BNILVariable& var, size_t idx, size_t instr); + PossibleValueSet GetPossibleExprValues(size_t expr); size_t GetSSAVarIndexAtInstruction(const BNILVariable& var, size_t instr) const; size_t GetSSAMemoryIndexAtInstruction(size_t instr) const; @@ -2288,16 +2296,16 @@ namespace BinaryNinja RegisterValue GetRegisterValueAtInstruction(uint32_t reg, size_t instr); RegisterValue GetRegisterValueAfterInstruction(uint32_t reg, size_t instr); - RegisterValue GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); - RegisterValue GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); + PossibleValueSet GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr); + PossibleValueSet GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr); RegisterValue GetFlagValueAtInstruction(uint32_t flag, size_t instr); RegisterValue GetFlagValueAfterInstruction(uint32_t flag, size_t instr); - RegisterValue GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); - RegisterValue GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); + PossibleValueSet GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr); + PossibleValueSet GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr); RegisterValue GetStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); RegisterValue GetStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); - RegisterValue GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); - RegisterValue GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); + PossibleValueSet GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr); + PossibleValueSet GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr); BNILBranchDependence GetBranchDependenceAtInstruction(size_t curInstr, size_t branchInstr) const; std::map GetAllBranchDependenceAtInstruction(size_t instr) const; diff --git a/binaryninjacore.h b/binaryninjacore.h index feea147d..c43c9b21 100644 --- a/binaryninjacore.h +++ b/binaryninjacore.h @@ -600,14 +600,18 @@ extern "C" enum BNRegisterValueType { + UndeterminedValue, EntryValue, ConstantValue, StackFrameOffset, - UndeterminedValue, + ReturnAddressValue, + + // The following are only valid in BNPossibleValueSet SignedRangeValue, UnsignedRangeValue, LookupTableValue, - ReturnAddressValue + InSetOfValues, + NotInSetOfValues }; struct BNLookupTableEntry @@ -620,10 +624,22 @@ extern "C" struct BNRegisterValue { BNRegisterValueType state; - uint32_t reg; // For EntryValue and OffsetFromEntryValue, the original input register - int64_t value; // Offset for OffsetFromEntryValue, StackFrameOffset or RangeValue, value of register for ConstantValue - uint64_t rangeStart, rangeEnd, rangeStep; // Range of register, inclusive - BNLookupTableEntry* table; // Number of entries in rangeEnd + int64_t value; + }; + + struct BNValueRange + { + uint64_t start, end, step; + }; + + struct BNPossibleValueSet + { + BNRegisterValueType state; + int64_t value; + BNValueRange* ranges; + int64_t* valueSet; + BNLookupTableEntry* table; + size_t count; }; struct BNRegisterOrConstant @@ -1852,7 +1868,7 @@ extern "C" uint64_t addr, BNType* functionType, size_t i); BINARYNINJACOREAPI BNRegisterValue BNGetParameterValueAtLowLevelILInstruction(BNFunction* func, size_t instr, BNType* functionType, size_t i); - BINARYNINJACOREAPI void BNFreeRegisterValue(BNRegisterValue* value); + BINARYNINJACOREAPI void BNFreePossibleValueSet(BNPossibleValueSet* value); BINARYNINJACOREAPI uint32_t* BNGetRegistersReadByInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, size_t* count); BINARYNINJACOREAPI uint32_t* BNGetRegistersWrittenByInstruction(BNFunction* func, BNArchitecture* arch, uint64_t addr, @@ -2176,31 +2192,31 @@ extern "C" uint32_t flag, size_t idx); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILExprValue(BNLowLevelILFunction* func, size_t expr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleExprValues(BNLowLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleExprValues(BNLowLevelILFunction* func, size_t expr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAtInstruction(BNLowLevelILFunction* func, uint32_t reg, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILRegisterValueAfterInstruction(BNLowLevelILFunction* func, uint32_t reg, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleRegisterValuesAtInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleRegisterValuesAtInstruction(BNLowLevelILFunction* func, uint32_t reg, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleRegisterValuesAfterInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleRegisterValuesAfterInstruction(BNLowLevelILFunction* func, uint32_t reg, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAtInstruction(BNLowLevelILFunction* func, uint32_t flag, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILFlagValueAfterInstruction(BNLowLevelILFunction* func, uint32_t flag, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleFlagValuesAtInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleFlagValuesAtInstruction(BNLowLevelILFunction* func, uint32_t flag, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleFlagValuesAfterInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleFlagValuesAfterInstruction(BNLowLevelILFunction* func, uint32_t flag, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAtInstruction(BNLowLevelILFunction* func, int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILStackContentsAfterInstruction(BNLowLevelILFunction* func, int64_t offset, size_t len, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleStackContentsAtInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleStackContentsAtInstruction(BNLowLevelILFunction* func, int64_t offset, size_t len, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetLowLevelILPossibleStackContentsAfterInstruction(BNLowLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetLowLevelILPossibleStackContentsAfterInstruction(BNLowLevelILFunction* func, int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNMediumLevelILFunction* BNGetMediumLevelILForLowLevelIL(BNLowLevelILFunction* func); @@ -2266,9 +2282,9 @@ extern "C" BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILSSAVarValue(BNMediumLevelILFunction* func, const BNILVariable* var, size_t idx); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILExprValue(BNMediumLevelILFunction* func, size_t expr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleSSAVarValues(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleSSAVarValues(BNMediumLevelILFunction* func, const BNILVariable* var, size_t idx, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleExprValues(BNMediumLevelILFunction* func, size_t expr); + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleExprValues(BNMediumLevelILFunction* func, size_t expr); BINARYNINJACOREAPI size_t BNGetMediumLevelILSSAVarIndexAtILInstruction(BNMediumLevelILFunction* func, const BNILVariable* var, size_t instr); @@ -2285,25 +2301,25 @@ extern "C" uint32_t reg, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILRegisterValueAfterInstruction(BNMediumLevelILFunction* func, uint32_t reg, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleRegisterValuesAtInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleRegisterValuesAtInstruction(BNMediumLevelILFunction* func, uint32_t reg, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(BNMediumLevelILFunction* func, uint32_t reg, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAtInstruction(BNMediumLevelILFunction* func, uint32_t flag, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILFlagValueAfterInstruction(BNMediumLevelILFunction* func, uint32_t flag, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleFlagValuesAtInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleFlagValuesAtInstruction(BNMediumLevelILFunction* func, uint32_t flag, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleFlagValuesAfterInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleFlagValuesAfterInstruction(BNMediumLevelILFunction* func, uint32_t flag, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAtInstruction(BNMediumLevelILFunction* func, int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILStackContentsAfterInstruction(BNMediumLevelILFunction* func, int64_t offset, size_t len, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleStackContentsAtInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleStackContentsAtInstruction(BNMediumLevelILFunction* func, int64_t offset, size_t len, size_t instr); - BINARYNINJACOREAPI BNRegisterValue BNGetMediumLevelILPossibleStackContentsAfterInstruction(BNMediumLevelILFunction* func, + BINARYNINJACOREAPI BNPossibleValueSet BNGetMediumLevelILPossibleStackContentsAfterInstruction(BNMediumLevelILFunction* func, int64_t offset, size_t len, size_t instr); BINARYNINJACOREAPI BNILBranchDependence BNGetMediumLevelILBranchDependence(BNMediumLevelILFunction* func, diff --git a/function.cpp b/function.cpp index aa56f7af..16ad1f1c 100644 --- a/function.cpp +++ b/function.cpp @@ -170,14 +170,19 @@ RegisterValue RegisterValue::FromAPIObject(BNRegisterValue& value) { RegisterValue result; result.state = value.state; - result.reg = value.reg; result.value = value.value; - result.rangeStart = value.rangeStart; - result.rangeEnd = value.rangeEnd; - result.rangeStep = value.rangeStep; + return result; +} + + +PossibleValueSet PossibleValueSet::FromAPIObject(BNPossibleValueSet& value) +{ + PossibleValueSet result; + result.state = value.state; + result.value = value.value; if (value.state == LookupTableValue) { - for (size_t i = 0; i < (size_t)value.rangeEnd; i++) + for (size_t i = 0; i < value.count; i++) { LookupTableEntry entry; entry.fromValues.insert(entry.fromValues.end(), &value.table[i].fromValues[0], @@ -186,7 +191,17 @@ RegisterValue RegisterValue::FromAPIObject(BNRegisterValue& value) result.table.push_back(entry); } } - BNFreeRegisterValue(&value); + else if ((value.state == SignedRangeValue) || (value.state == UnsignedRangeValue)) + { + for (size_t i = 0; i < value.count; i++) + result.ranges.push_back(value.ranges[i]); + } + else if ((value.state == InSetOfValues) || (value.state == NotInSetOfValues)) + { + for (size_t i = 0; i < value.count; i++) + result.valueSet.insert(value.valueSet[i]); + } + BNFreePossibleValueSet(&value); return result; } diff --git a/lowlevelil.cpp b/lowlevelil.cpp index 54e26498..9764445e 100644 --- a/lowlevelil.cpp +++ b/lowlevelil.cpp @@ -780,10 +780,10 @@ RegisterValue LowLevelILFunction::GetExprValue(size_t expr) } -RegisterValue LowLevelILFunction::GetPossibleExprValues(size_t expr) +PossibleValueSet LowLevelILFunction::GetPossibleExprValues(size_t expr) { - BNRegisterValue value = BNGetLowLevelILPossibleExprValues(m_object, expr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleExprValues(m_object, expr); + return PossibleValueSet::FromAPIObject(value); } @@ -801,17 +801,17 @@ RegisterValue LowLevelILFunction::GetRegisterValueAfterInstruction(uint32_t reg, } -RegisterValue LowLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue LowLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); + return PossibleValueSet::FromAPIObject(value); } @@ -829,17 +829,17 @@ RegisterValue LowLevelILFunction::GetFlagValueAfterInstruction(uint32_t flag, si } -RegisterValue LowLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue LowLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); + return PossibleValueSet::FromAPIObject(value); } @@ -857,17 +857,17 @@ RegisterValue LowLevelILFunction::GetStackContentsAfterInstruction(int32_t offse } -RegisterValue LowLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue LowLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +PossibleValueSet LowLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) { - BNRegisterValue value = BNGetLowLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetLowLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); + return PossibleValueSet::FromAPIObject(value); } diff --git a/mediumlevelil.cpp b/mediumlevelil.cpp index bb629e64..b0eb83a1 100644 --- a/mediumlevelil.cpp +++ b/mediumlevelil.cpp @@ -450,17 +450,17 @@ RegisterValue MediumLevelILFunction::GetExprValue(size_t expr) } -RegisterValue MediumLevelILFunction::GetPossibleSSAVarValues(const BNILVariable& var, size_t idx, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleSSAVarValues(const BNILVariable& var, size_t idx, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleSSAVarValues(m_object, &var, idx, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleSSAVarValues(m_object, &var, idx, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue MediumLevelILFunction::GetPossibleExprValues(size_t expr) +PossibleValueSet MediumLevelILFunction::GetPossibleExprValues(size_t expr) { - BNRegisterValue value = BNGetMediumLevelILPossibleExprValues(m_object, expr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleExprValues(m_object, expr); + return PossibleValueSet::FromAPIObject(value); } @@ -508,17 +508,17 @@ RegisterValue MediumLevelILFunction::GetRegisterValueAfterInstruction(uint32_t r } -RegisterValue MediumLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleRegisterValuesAtInstruction(uint32_t reg, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleRegisterValuesAtInstruction(m_object, reg, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue MediumLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleRegisterValuesAfterInstruction(uint32_t reg, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(m_object, reg, instr); + return PossibleValueSet::FromAPIObject(value); } @@ -536,17 +536,17 @@ RegisterValue MediumLevelILFunction::GetFlagValueAfterInstruction(uint32_t flag, } -RegisterValue MediumLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleFlagValuesAtInstruction(uint32_t flag, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleFlagValuesAtInstruction(m_object, flag, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue MediumLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleFlagValuesAfterInstruction(uint32_t flag, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleFlagValuesAfterInstruction(m_object, flag, instr); + return PossibleValueSet::FromAPIObject(value); } @@ -564,17 +564,17 @@ RegisterValue MediumLevelILFunction::GetStackContentsAfterInstruction(int32_t of } -RegisterValue MediumLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleStackContentsAtInstruction(int32_t offset, size_t len, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleStackContentsAtInstruction(m_object, offset, len, instr); + return PossibleValueSet::FromAPIObject(value); } -RegisterValue MediumLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) +PossibleValueSet MediumLevelILFunction::GetPossibleStackContentsAfterInstruction(int32_t offset, size_t len, size_t instr) { - BNRegisterValue value = BNGetMediumLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); - return RegisterValue::FromAPIObject(value); + BNPossibleValueSet value = BNGetMediumLevelILPossibleStackContentsAfterInstruction(m_object, offset, len, instr); + return PossibleValueSet::FromAPIObject(value); } diff --git a/python/function.py b/python/function.py index a507534c..51d61792 100644 --- a/python/function.py +++ b/python/function.py @@ -51,34 +51,78 @@ class RegisterValue(object): def __init__(self, arch, value): self.type = RegisterValueType(value.state) if value.state == RegisterValueType.EntryValue: - self.reg = arch.get_reg_name(value.reg) + self.reg = arch.get_reg_name(value.value) + elif value.state == RegisterValueType.ConstantValue: + self.value = value.value + elif value.state == RegisterValueType.StackFrameOffset: + self.offset = value.value + + def __repr__(self): + if self.type == RegisterValueType.EntryValue: + return "" % self.reg + if self.type == RegisterValueType.ConstantValue: + return "" % self.value + if self.type == RegisterValueType.StackFrameOffset: + return "" % self.offset + if self.type == RegisterValueType.ReturnAddressValue: + return "" + return "" + + +class ValueRange(object): + def __init__(self, start, end, step): + self.start = start + self.end = end + self.step = step + + def __repr__(self): + if self.step == 1: + return "" % (self.start, self.end) + return "" % (self.start, self.end, self.step) + + +class PossibleValueSet(object): + def __init__(self, arch, value): + self.type = RegisterValueType(value.state) + if value.state == RegisterValueType.EntryValue: + self.reg = arch.get_reg_name(value.value) elif value.state == RegisterValueType.ConstantValue: self.value = value.value elif value.state == RegisterValueType.StackFrameOffset: self.offset = value.value elif value.state == RegisterValueType.SignedRangeValue: self.offset = value.value - self.start = value.rangeStart - self.end = value.rangeEnd - self.step = value.rangeStep - if self.start & (1 << 63): - self.start |= ~((1 << 63) - 1) - if self.end & (1 << 63): - self.end |= ~((1 << 63) - 1) + self.ranges = [] + for i in xrange(0, value.count): + start = value.ranges[i].start + end = value.ranges[i].end + step = value.ranges[i].step + if start & (1 << 63): + start |= ~((1 << 63) - 1) + if end & (1 << 63): + end |= ~((1 << 63) - 1) + self.ranges.append(ValueRange(start, end, step)) elif value.state == RegisterValueType.UnsignedRangeValue: self.offset = value.value - self.start = value.rangeStart - self.end = value.rangeEnd - self.step = value.rangeStep + self.ranges = [] + for i in xrange(0, value.count): + start = value.ranges[i].start + end = value.ranges[i].end + step = value.ranges[i].step + self.ranges.append(ValueRange(start, end, step)) elif value.state == RegisterValueType.LookupTableValue: self.table = [] self.mapping = {} - for i in xrange(0, value.rangeEnd): + for i in xrange(0, value.count): from_list = [] for j in xrange(0, value.table[i].fromCount): from_list.append(value.table[i].fromValues[j]) self.mapping[value.table[i].fromValues[j]] = value.table[i].toValue self.table.append(LookupTableEntry(from_list, value.table[i].toValue)) + elif (value.state == RegisterValueType.InSetOfValues) or (value.state == RegisterValueType.NotInSetOfValues): + self.values = set() + for i in xrange(0, value.count): + self.values.add(value.valueSet[i]) def __repr__(self): if self.type == RegisterValueType.EntryValue: @@ -87,12 +131,16 @@ class RegisterValue(object): return "" % self.value if self.type == RegisterValueType.StackFrameOffset: return "" % self.offset - if (self.type == RegisterValueType.SignedRangeValue) or (self.type == RegisterValueType.UnsignedRangeValue): - if self.step == 1: - return "" % (self.start, self.end) - return "" % (self.start, self.end, self.step) + if self.type == RegisterValueType.SignedRangeValue: + return "" % repr(self.ranges) + if self.type == RegisterValueType.UnsignedRangeValue: + return "" % repr(self.ranges) if self.type == RegisterValueType.LookupTableValue: return "" % ', '.join([repr(i) for i in self.table]) + if self.type == RegisterValueType.InSetOfValues: + return "" % repr(self.values) + if self.type == RegisterValueType.NotInSetOfValues: + return "" % repr(self.values) if self.type == RegisterValueType.ReturnAddressValue: return "" return "" @@ -425,7 +473,6 @@ class Function(object): reg = arch.regs[reg].index value = core.BNGetRegisterValueAtInstruction(self.handle, arch.handle, addr, reg) result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) return result def get_reg_value_after(self, addr, reg, arch=None): @@ -447,7 +494,6 @@ class Function(object): reg = arch.regs[reg].index value = core.BNGetRegisterValueAfterInstruction(self.handle, arch.handle, addr, reg) result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) return result def get_stack_contents_at(self, addr, offset, size, arch=None): @@ -473,7 +519,6 @@ class Function(object): arch = self.arch value = core.BNGetStackContentsAtInstruction(self.handle, arch.handle, addr, offset, size) result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) return result def get_stack_contents_after(self, addr, offset, size, arch=None): @@ -481,7 +526,6 @@ class Function(object): arch = self.arch value = core.BNGetStackContentsAfterInstruction(self.handle, arch.handle, addr, offset, size) result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) return result def get_parameter_at(self, addr, func_type, i, arch=None): @@ -491,7 +535,6 @@ class Function(object): func_type = func_type.handle value = core.BNGetParameterValueAtInstruction(self.handle, arch.handle, addr, func_type, i) result = RegisterValue(arch, value) - core.BNFreeRegisterValue(value) return result def get_parameter_at_low_level_il_instruction(self, instr, func_type, i): @@ -499,7 +542,6 @@ class Function(object): func_type = func_type.handle value = core.BNGetParameterValueAtLowLevelILInstruction(self.handle, instr, func_type, i) result = RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) return result def get_regs_read_by(self, addr, arch=None): diff --git a/python/lowlevelil.py b/python/lowlevelil.py index 74b030d7..a737d95e 100644 --- a/python/lowlevelil.py +++ b/python/lowlevelil.py @@ -263,15 +263,14 @@ class LowLevelILInstruction(object): """Value of expression if constant or a known value (read-only)""" value = core.BNGetLowLevelILExprValue(self.function.handle, self.expr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result @property def possible_values(self): """Possible values of expression using path-sensitive static data flow analysis (read-only)""" value = core.BNGetLowLevelILPossibleExprValues(self.function.handle, self.expr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_reg_value(self, reg): @@ -279,7 +278,6 @@ class LowLevelILInstruction(object): reg = self.function.arch.regs[reg].index value = core.BNGetLowLevelILRegisterValueAtInstruction(self.function.handle, reg, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_reg_value_after(self, reg): @@ -287,23 +285,22 @@ class LowLevelILInstruction(object): reg = self.function.arch.regs[reg].index value = core.BNGetLowLevelILRegisterValueAfterInstruction(self.function.handle, reg, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_reg_values(self, reg): if isinstance(reg, str): reg = self.function.arch.regs[reg].index value = core.BNGetLowLevelILPossibleRegisterValuesAtInstruction(self.function.handle, reg, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_reg_values_after(self, reg): if isinstance(reg, str): reg = self.function.arch.regs[reg].index value = core.BNGetLowLevelILPossibleRegisterValuesAfterInstruction(self.function.handle, reg, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_flag_value(self, flag): @@ -311,7 +308,6 @@ class LowLevelILInstruction(object): flag = self.function.arch.flags[flag].index value = core.BNGetLowLevelILFlagValueAtInstruction(self.function.handle, flag, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_flag_value_after(self, flag): @@ -319,47 +315,44 @@ class LowLevelILInstruction(object): flag = self.function.arch.flags[flag].index value = core.BNGetLowLevelILFlagValueAfterInstruction(self.function.handle, flag, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_flag_values(self, flag): if isinstance(flag, str): flag = self.function.arch.flags[flag].index value = core.BNGetLowLevelILPossibleFlagValuesAtInstruction(self.function.handle, flag, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_flag_values_after(self, flag): if isinstance(flag, str): flag = self.function.arch.flags[flag].index value = core.BNGetLowLevelILPossibleFlagValuesAfterInstruction(self.function.handle, flag, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_stack_contents(self, offset, size): value = core.BNGetLowLevelILStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_stack_contents_after(self, offset, size): value = core.BNGetLowLevelILStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_stack_contents(self, offset, size): value = core.BNGetLowLevelILPossibleStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_stack_contents_after(self, offset, size): value = core.BNGetLowLevelILPossibleStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def __setattr__(self, name, value): @@ -1534,7 +1527,6 @@ class LowLevelILFunction(object): reg = self.arch.regs[reg].index value = core.BNGetLowLevelILSSARegisterValue(self.handle, reg, index) result = function.RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) return result def get_ssa_flag_value(self, flag, index): @@ -1542,7 +1534,6 @@ class LowLevelILFunction(object): flag = self.arch.get_flag_by_name(flag) value = core.BNGetLowLevelILSSAFlagValue(self.handle, flag, index) result = function.RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) return result def get_mapped_medium_level_il_instruction_index(self, instr): diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 6f482221..951ad591 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -260,15 +260,14 @@ class MediumLevelILInstruction(object): """Value of expression if constant or a known value (read-only)""" value = core.BNGetMediumLevelILExprValue(self.function.handle, self.expr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result @property def possible_values(self): """Possible values of expression using path-sensitive static data flow analysis (read-only)""" value = core.BNGetMediumLevelILPossibleExprValues(self.function.handle, self.expr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result @property @@ -302,7 +301,6 @@ class MediumLevelILInstruction(object): var_data.identifier = var.identifier value = core.BNGetMediumLevelILPossibleSSAVarValues(self.function.handle, var_data, index, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_ssa_var_index(self, var): @@ -333,7 +331,6 @@ class MediumLevelILInstruction(object): reg = self.function.arch.regs[reg].index value = core.BNGetMediumLevelILRegisterValueAtInstruction(self.function.handle, reg, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_reg_value_after(self, reg): @@ -341,23 +338,22 @@ class MediumLevelILInstruction(object): reg = self.function.arch.regs[reg].index value = core.BNGetMediumLevelILRegisterValueAfterInstruction(self.function.handle, reg, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_reg_values(self, reg): if isinstance(reg, str): reg = self.function.arch.regs[reg].index value = core.BNGetMediumLevelILPossibleRegisterValuesAtInstruction(self.function.handle, reg, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_reg_values_after(self, reg): if isinstance(reg, str): reg = self.function.arch.regs[reg].index value = core.BNGetMediumLevelILPossibleRegisterValuesAfterInstruction(self.function.handle, reg, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_flag_value(self, flag): @@ -365,7 +361,6 @@ class MediumLevelILInstruction(object): flag = self.function.arch.flags[flag].index value = core.BNGetMediumLevelILFlagValueAtInstruction(self.function.handle, flag, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_flag_value_after(self, flag): @@ -373,47 +368,44 @@ class MediumLevelILInstruction(object): flag = self.function.arch.flags[flag].index value = core.BNGetMediumLevelILFlagValueAfterInstruction(self.function.handle, flag, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_flag_values(self, flag): if isinstance(flag, str): flag = self.function.arch.flags[flag].index value = core.BNGetMediumLevelILPossibleFlagValuesAtInstruction(self.function.handle, flag, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_flag_values_after(self, flag): if isinstance(flag, str): flag = self.function.arch.flags[flag].index value = core.BNGetMediumLevelILPossibleFlagValuesAfterInstruction(self.function.handle, flag, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_stack_contents(self, offset, size): value = core.BNGetMediumLevelILStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_stack_contents_after(self, offset, size): value = core.BNGetMediumLevelILStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) return result def get_possible_stack_contents(self, offset, size): value = core.BNGetMediumLevelILPossibleStackContentsAtInstruction(self.function.handle, offset, size, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_possible_stack_contents_after(self, offset, size): value = core.BNGetMediumLevelILPossibleStackContentsAfterInstruction(self.function.handle, offset, size, self.instr_index) - result = function.RegisterValue(self.function.arch, value) - core.BNFreeRegisterValue(value) + result = function.PossibleValueSet(self.function.arch, value) + core.BNFreePossibleValueSet(value) return result def get_branch_dependence(self, branch_instr): @@ -706,7 +698,6 @@ class MediumLevelILFunction(object): var_data.identifier = var.identifier value = core.BNGetMediumLevelILSSAVarValue(self.handle, var_data, index) result = function.RegisterValue(self.arch, value) - core.BNFreeRegisterValue(value) return result def get_low_level_il_instruction_index(self, instr): -- cgit v1.3.1