1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
import json
from binaryninja import Workflow, Activity, AnalysisContext, ReportCollection, \
FlowGraphReport, show_report_collection, DisassemblySettings, DisassemblyOption
from binaryninja.lowlevelil import *
"""
This workflow copies every instruction in an IL function to a new IL function and then
verifies that they are exactly the same.
"""
def assert_llil_eq(old_insn: LowLevelILInstruction, new_insn: LowLevelILInstruction):
"""
Make sure that these two instructions are the same (probably correct). Asserts otherwise.
Note: This ignores when instructions reference other instructions by index directly
as that IL indices are not guaranteed to be consistent. So things like goto/if/jump_to
will check that the target of the branch is the same, but allow the target to have
a different instruction index.
"""
err_msg = (hex(old_insn.address), old_insn, new_insn)
assert old_insn.operation == new_insn.operation, err_msg
assert old_insn.attributes == new_insn.attributes, err_msg
assert old_insn.size == new_insn.size, err_msg
assert old_insn.raw_flags == new_insn.raw_flags, err_msg
assert old_insn.source_location == new_insn.source_location, err_msg
assert len(old_insn.operands) == len(new_insn.operands), err_msg
# Can't compare operands directly since IL expression indices might change when
# copying an instruction to another function
for i, (old_op, new_op) in enumerate(zip(old_insn.detailed_operands, new_insn.detailed_operands)):
err_msg = (hex(old_insn.address), f'op {i}', old_insn, new_insn, old_op, new_op)
assert old_op[0] == new_op[0], err_msg # op name
assert old_op[2] == new_op[2], err_msg # op type
op_type = old_op[2]
if op_type == 'LowLevelILInstruction':
assert_llil_eq(old_op[1], new_op[1])
elif op_type == 'InstructionIndex' or \
(old_insn.operation == LowLevelILOperation.LLIL_GOTO and old_op[0] == 'dest') or \
(old_insn.operation == LowLevelILOperation.LLIL_IF and old_op[0] == 'true') or \
(old_insn.operation == LowLevelILOperation.LLIL_IF and old_op[0] == 'false'):
# These aren't consistent if the old function has instructions outside BBs
# (they are not copied), so just make sure the target instruction looks the same
assert old_insn.function[old_op[1]].operation == new_insn.function[new_op[1]].operation
elif op_type in [
'List[LowLevelILInstruction]',
'List[\'LowLevelILInstruction\']' # compat (ew)
]:
for old_sub, new_sub in zip(old_op[1], new_op[1]):
assert_llil_eq(old_sub, new_sub)
elif old_insn.operation == LowLevelILOperation.LLIL_JUMP_TO and old_op[0] == 'targets':
for old_target, new_target in zip(sorted(old_op[1].items()), sorted(new_op[1].items())):
assert old_target[0] == new_target[0], err_msg
# Same as with instruction index
assert_llil_eq(old_insn.function[old_target[1]], new_insn.function[new_target[1]])
else:
# TODO: Any other types of ops need special behavior?
assert old_op[1] == new_op[1], err_msg
def lil_action(context: AnalysisContext):
def translate_instr(
new_func: LowLevelILFunction,
old_block: LowLevelILBasicBlock,
old_instr: LowLevelILInstruction,
):
# no-op copy
return old_instr.copy_to(
new_func,
lambda sub_instr: translate_instr(new_func, old_block, sub_instr)
)
old_lil = context.lifted_il
if old_lil is None:
return
new_lil = old_lil.translate(translate_instr)
new_lil.finalize()
if context.function.check_for_debug_report("copy_expr_test_lil"):
# debug the test :)
report = ReportCollection()
settings = DisassemblySettings()
settings.set_option(DisassemblyOption.ShowAddress, True)
report.append(FlowGraphReport("old graph", old_lil.create_graph_immediate(settings)))
report.append(FlowGraphReport("new graph", new_lil.create_graph_immediate(settings)))
show_report_collection("copy expr test", report)
# Check all BBs have all the same instructions
# Technically, this misses any instructions outside a BB, but those are not
# picked up by analysis anyway, and therefore don't matter.
assert len(old_lil.basic_blocks) == len(new_lil.basic_blocks)
for old_bb, new_bb in zip(old_lil.basic_blocks, new_lil.basic_blocks):
assert len(old_bb) == len(new_bb)
for old_insn, new_insn in zip(old_bb, new_bb):
assert_llil_eq(old_insn, new_insn)
def llil_action(context: AnalysisContext):
def translate_instr(
new_func: LowLevelILFunction,
old_block: LowLevelILBasicBlock,
old_instr: LowLevelILInstruction,
):
# no-op copy
return old_instr.copy_to(
new_func,
lambda sub_instr: translate_instr(new_func, old_block, sub_instr)
)
old_llil = context.llil
if old_llil is None:
return
new_llil = old_llil.translate(translate_instr)
new_llil.finalize()
new_llil.generate_ssa_form()
if context.function.check_for_debug_report("copy_expr_test_llil"):
# debug the test :)
report = ReportCollection()
settings = DisassemblySettings()
settings.set_option(DisassemblyOption.ShowAddress, True)
report.append(FlowGraphReport("old graph", old_llil.create_graph_immediate(settings)))
report.append(FlowGraphReport("new graph", new_llil.create_graph_immediate(settings)))
show_report_collection("copy expr test", report)
# Check all BBs have all the same instructions
# Technically, this misses any instructions outside a BB, but those are not
# picked up by analysis anyway, and therefore don't matter.
assert len(old_llil.basic_blocks) == len(new_llil.basic_blocks)
for old_bb, new_bb in zip(old_llil.basic_blocks, new_llil.basic_blocks):
assert len(old_bb) == len(new_bb)
for old_insn, new_insn in zip(old_bb, new_bb):
assert_llil_eq(old_insn, new_insn)
wf = Workflow("core.function.metaAnalysis").clone("TestCopyExpr")
# Define the custom activity configuration
wf.register_activity(Activity(
configuration=json.dumps({
"name": "extension.test_copy_expr.lil_action",
"title": "Lifted IL copy_expr Test",
"description": "Makes sure copy_expr works on Lifted IL functions."
}),
action=lil_action
))
wf.register_activity(Activity(
configuration=json.dumps({
"name": "extension.test_copy_expr.llil_action",
"title": "Low Level IL copy_expr Test",
"description": "Makes sure copy_expr works on Low Level IL functions."
}),
action=llil_action
))
wf.insert("core.function.analyzeAndExpandFlags", ["extension.test_copy_expr.lil_action"])
wf.insert("core.function.generateMediumLevelIL", ["extension.test_copy_expr.llil_action"])
# TODO: MLIL and higher
wf.register()
|
