bool isNopInsn(Instruction::Ptr insn)
{
// TODO: add LEA no-ops
if(insn->getOperation().getID() == e_nop)
return true;
if(insn->getOperation().getID() == e_lea)
{
std::set<Expression::Ptr> memReadAddr;
insn->getMemoryReadOperands(memReadAddr);
std::set<RegisterAST::Ptr> writtenRegs;
insn->getWriteSet(writtenRegs);
if(memReadAddr.size() == 1 && writtenRegs.size() == 1)
{
if(**(memReadAddr.begin()) == **(writtenRegs.begin()))
{
return true;
}
}
// Check for zero displacement
nopVisitor visitor;
// We need to get the src operand
insn->getOperand(1).getValue()->apply(&visitor);
if (visitor.isNop) return true;
}
return false;
}
void SpringboardBuilder::generateBranch(Address from, Address to, codeGen &gen) {
gen.invalidate();
gen.allocate(16);
gen.setAddrSpace(addrSpace_);
gen.setAddr(from);
insnCodeGen::generateBranch(gen, from, to);
springboard_cerr << "Generated springboard branch " << hex << from << "->" << to << dec << endl;
#if 0
#include "InstructionDecoder.h"
using namespace Dyninst::InstructionAPI;
Address base = 0;
InstructionDecoder deco(gen.start_ptr(),gen.size(),Arch_aarch64);
Instruction::Ptr insn = deco.decode();
while(base<gen.used()+5) {
std::stringstream rawInsn;
unsigned idx = insn->size();
while(idx--) rawInsn << hex << setfill('0') << setw(2) << (unsigned int) insn->rawByte(idx);
cerr << "\t" << hex << base << ": " << rawInsn.str() << " "
<< insn->format(base) << dec << endl;
base += insn->size();
insn = deco.decode();
}
#endif
}
bool
PatchBlock::containsDynamicCall() {
const ParseAPI::Block::edgelist & out_edges = block_->targets();
ParseAPI::Block::edgelist::const_iterator eit = out_edges.begin();
for( ; eit != out_edges.end(); ++eit) {
if ( ParseAPI::CALL == (*eit)->type() ) {
// see if it's a static call to a bad address
if ((*eit)->sinkEdge()) {
using namespace InstructionAPI;
Instruction::Ptr insn = getInsn(last());
if (insn->readsMemory()) { // memory indirect
return true;
} else { // check for register indirect
set<InstructionAST::Ptr> regs;
Expression::Ptr tExpr = insn->getControlFlowTarget();
if (tExpr)
tExpr->getUses(regs);
for (set<InstructionAST::Ptr>::iterator rit = regs.begin();
rit != regs.end(); rit++)
{
if (RegisterAST::makePC(obj()->co()->cs()->getArch()).getID() !=
boost::dynamic_pointer_cast<RegisterAST>(*rit)->getID())
{
return true;
}
}
}
}
}
}
return false;
}
bool IA_IAPI::cleansStack() const
{
Instruction::Ptr ci = curInsn();
if (ci->getCategory() != c_ReturnInsn) return false;
std::vector<Operand> ops;
ci->getOperands(ops);
return (ops.size() > 1);
}
void LivenessAnalyzer::summarizeBlockLivenessInfo(Function* func, Block *block, bitArray &allRegsDefined)
{
if (blockLiveInfo.find(block) != blockLiveInfo.end()){
return;
}
livenessData &data = blockLiveInfo[block];
data.use = data.def = data.in = abi->getBitArray();
using namespace Dyninst::InstructionAPI;
Address current = block->start();
InstructionDecoder decoder(
reinterpret_cast<const unsigned char*>(getPtrToInstruction(block, block->start())),
block->size(),
block->obj()->cs()->getArch());
Instruction::Ptr curInsn = decoder.decode();
while(curInsn) {
ReadWriteInfo curInsnRW;
liveness_printf("%s[%d] After instruction %s at address 0x%lx:\n",
FILE__, __LINE__, curInsn->format().c_str(), current);
if(!cachedLivenessInfo.getLivenessInfo(current, func, curInsnRW))
{
curInsnRW = calcRWSets(curInsn, block, current);
cachedLivenessInfo.insertInstructionInfo(current, curInsnRW, func);
}
data.use |= (curInsnRW.read & ~data.def);
// And if written, then was defined
data.def |= curInsnRW.written;
liveness_printf("%s[%d] After instruction at address 0x%lx:\n",
FILE__, __LINE__, current);
liveness_cerr << " " << regs1 << endl;
liveness_cerr << " " << regs2 << endl;
liveness_cerr << " " << regs3 << endl;
liveness_cerr << "Read " << curInsnRW.read << endl;
liveness_cerr << "Written " << curInsnRW.written << endl;
liveness_cerr << "Used " << data.use << endl;
liveness_cerr << "Defined " << data.def << endl;
current += curInsn->size();
curInsn = decoder.decode();
}
liveness_printf("%s[%d] Liveness summary for block:\n", FILE__, __LINE__);
liveness_cerr << " " << regs1 << endl;
liveness_cerr << " " << regs2 << endl;
liveness_cerr << " " << regs3 << endl;
liveness_cerr << "Used " << data.in << endl;
liveness_cerr << "Def " << data.def << endl;
liveness_cerr << "Use " << data.use << endl;
liveness_printf("%s[%d] --------------------\n---------------------\n", FILE__, __LINE__);
allRegsDefined |= data.def;
return;
}
bool IA_x86Details::computeTableBounds(Instruction::Ptr maxSwitchInsn,
Instruction::Ptr branchInsn,
Instruction::Ptr tableInsn,
bool foundJCCAlongTaken,
unsigned& tableSize,
unsigned& tableStride)
{
assert(maxSwitchInsn && branchInsn);
Result compareBound = maxSwitchInsn->getOperand(1).getValue()->eval();
if(!compareBound.defined) return false;
tableSize = compareBound.convert<unsigned>();
// Sanity check the bounds; 32k tables would be an oddity, and larger is almost certainly
// a misparse
static const unsigned int maxTableSize = 32768;
if(tableSize > maxTableSize)
{
parsing_printf("\tmaxSwitch of %d above %d, BAILING OUT\n", tableSize, maxTableSize);
return false;
}
if(foundJCCAlongTaken)
{
if(branchInsn->getOperation().getID() == e_jbe ||
branchInsn->getOperation().getID() == e_jle)
{
tableSize++;
}
}
else
{
if(branchInsn->getOperation().getID() == e_jnbe ||
branchInsn->getOperation().getID() == e_jnle)
{
tableSize++;
}
}
parsing_printf("\tmaxSwitch set to %d\n", tableSize);
tableStride = currentBlock->_isrc->getAddressWidth();
std::set<Expression::Ptr> tableInsnReadAddr;
tableInsn->getMemoryReadOperands(tableInsnReadAddr);
if(tableStride == 8)
{
static Immediate::Ptr four(new Immediate(Result(u8, 4)));
static BinaryFunction::funcT::Ptr multiplier(new BinaryFunction::multResult());
static Expression::Ptr dummy(new DummyExpr());
static BinaryFunction::Ptr scaleCheck(new BinaryFunction(four, dummy, u64, multiplier));
for(std::set<Expression::Ptr>::const_iterator curExpr = tableInsnReadAddr.begin();
curExpr != tableInsnReadAddr.end();
++curExpr)
{
if((*curExpr)->isUsed(scaleCheck))
{
tableSize = tableSize >> 1;
parsing_printf("\tmaxSwitch revised to %d\n",tableSize);
}
}
}
test_results_t mov_size_details_Mutator::executeTest()
{
const unsigned char buffer[] =
{
0x66, 0x8c, 0xe8
};
unsigned int size = 3;
unsigned int expectedInsns = 2;
InstructionDecoder d(buffer, size, Dyninst::Arch_x86);
std::deque<Instruction::Ptr> decodedInsns;
Instruction::Ptr i;
do
{
i = d.decode();
decodedInsns.push_back(i);
}
while(i && i->isValid());
if(decodedInsns.size() != expectedInsns)
{
logerror("FAILED: Expected %d instructions, decoded %d\n", expectedInsns, decodedInsns.size());
for(std::deque<Instruction::Ptr>::iterator curInsn = decodedInsns.begin();
curInsn != decodedInsns.end();
++curInsn)
{
logerror("\t%s\n", (*curInsn)->format().c_str());
}
return FAILED;
}
if(decodedInsns.back() && decodedInsns.back()->isValid())
{
logerror("FAILED: Expected instructions to end with an invalid instruction, but they didn't");
return FAILED;
}
Architecture curArch = Arch_x86;
Instruction::Ptr mov = decodedInsns.front();
Expression::Ptr lhs, rhs;
lhs = mov->getOperand(0).getValue();
rhs = mov->getOperand(1).getValue();
if(lhs->size() != 2)
{
logerror("LHS expected 16-bit, actual %d-bit (%s)\n", lhs->size() * 8, lhs->format().c_str());
return FAILED;
}
if(rhs->size() != 2)
{
logerror("RHS expected 16-bit, actual %d-bit (%s)\n", rhs->size() * 8, rhs->format().c_str());
return FAILED;
}
return PASSED;
}
bool IA_x86Details::isTableInsn(Instruction::Ptr i)
{
Expression::Ptr jumpExpr = currentBlock->curInsn()->getControlFlowTarget();
parsing_printf("jumpExpr for table insn is %s\n", jumpExpr->format().c_str());
if(i->getOperation().getID() == e_mov && i->readsMemory() && i->isWritten(jumpExpr))
{
return true;
}
if(i->getOperation().getID() == e_lea && i->isWritten(jumpExpr))
{
return true;
}
return false;
}
bool IA_IAPI::isFrameSetupInsn(Instruction::Ptr i) const
{
if(i->getOperation().getID() == e_mov)
{
if(i->readsMemory() || i->writesMemory())
{
parsing_printf("%s[%d]: discarding insn %s as stack frame preamble, not a reg-reg move\n",
FILE__, __LINE__, i->format().c_str());
//return false;
}
if(i->isRead(stackPtr[_isrc->getArch()]) &&
i->isWritten(framePtr[_isrc->getArch()]))
{
if((unsigned) i->getOperand(0).getValue()->size() == _isrc->getAddressWidth())
{
return true;
}
else
{
parsing_printf("%s[%d]: discarding insn %s as stack frame preamble, size mismatch for %d-byte addr width\n",
FILE__, __LINE__, i->format().c_str(), _isrc->getAddressWidth());
}
}
}
return false;
}
void parse_block::getInsns(Insns &insns, Address base) {
using namespace InstructionAPI;
Offset off = firstInsnOffset();
const unsigned char *ptr = (const unsigned char *)getPtrToInstruction(off);
if (ptr == NULL) return;
InstructionDecoder d(ptr, getSize(),obj()->cs()->getArch());
while (off < endOffset()) {
Instruction::Ptr insn = d.decode();
insns[off + base] = insn;
off += insn->size();
}
}
void instrumentBasicBlock(BPatch_function * function, BPatch_basicBlock *block)
{
Instruction::Ptr iptr;
void *addr;
unsigned char bytes[MAX_RAW_INSN_SIZE];
size_t nbytes, i;
// iterate backwards (PatchAPI restriction)
PatchBlock::Insns insns;
PatchAPI::convert(block)->getInsns(insns);
PatchBlock::Insns::reverse_iterator j;
for (j = insns.rbegin(); j != insns.rend(); j++) {
// get instruction bytes
addr = (void*)((*j).first);
iptr = (*j).second;
nbytes = iptr->size();
assert(nbytes <= MAX_RAW_INSN_SIZE);
for (i=0; i<nbytes; i++) {
bytes[i] = iptr->rawByte(i);
}
bytes[nbytes] = '\0';
// apply filter
mainDecoder->decode((uint64_t)addr,iptr);
if (mainDecoder->isCall()&&mainDecoder->isCall_indirect())
{
instrumentCallIns(addr, bytes, nbytes,
PatchAPI::convert(function), PatchAPI::convert(block),mainDecoder->isCall_indirect());
}
else if (mainDecoder->isIndirectJmp())
{
instrumentIndirectJmpIns(addr, bytes, nbytes,
PatchAPI::convert(function), PatchAPI::convert(block));
}
else if (mainDecoder->needDepie())
{
instrumentInstruction(addr, bytes, nbytes,
PatchAPI::convert(function), PatchAPI::convert(block));
}
}
}
static bool IsConditionalJump(Instruction::Ptr insn) {
entryID id = insn->getOperation().getID();
if (id == e_jz || id == e_jnz ||
id == e_jb || id == e_jnb ||
id == e_jbe || id == e_jnbe ||
id == e_jb_jnaej_j || id == e_jnb_jae_j ||
id == e_jle || id == e_jl ||
id == e_jnl || id == e_jnle) return true;
return false;
}
/* This does a linear scan to find out which registers are used in the function,
it then stores these registers so the scan only needs to be done once.
It returns true or false based on whether the function is a leaf function,
since if it is not the function could call out to another function that
clobbers more registers so more analysis would be needed */
void parse_func::calcUsedRegs()
{
if (usedRegisters != NULL)
return;
else
{
usedRegisters = new parse_func_registers();
using namespace Dyninst::InstructionAPI;
std::set<RegisterAST::Ptr> writtenRegs;
Function::blocklist & bl = blocks();
Function::blocklist::iterator curBlock = bl.begin();
for( ; curBlock != bl.end(); ++curBlock)
{
InstructionDecoder d(getPtrToInstruction((*curBlock)->start()),
(*curBlock)->size(),
isrc()->getArch());
Instruction::Ptr i;
while(i = d.decode())
{
i->getWriteSet(writtenRegs);
}
}
for(std::set<RegisterAST::Ptr>::const_iterator curReg = writtenRegs.begin();
curReg != writtenRegs.end();
++curReg)
{
MachRegister r = (*curReg)->getID();
if((r & ppc32::GPR) && (r <= ppc32::r13))
{
usedRegisters->generalPurposeRegisters.insert(r & 0xFFFF);
}
else if(((r & ppc32::FPR) && (r <= ppc32::fpr13)) ||
((r & ppc32::FSR) && (r <= ppc32::fsr13)))
{
usedRegisters->floatingPointRegisters.insert(r & 0xFFFF);
}
}
}
return;
}
bool IA_IAPI::isThunk() const {
// Before we go a-wandering, check the target
bool valid; Address addr;
boost::tie(valid, addr) = getCFT();
if (!valid ||
!_isrc->isValidAddress(addr)) {
parsing_printf("... Call to 0x%lx is invalid (outside code or data)\n",
addr);
return false;
}
const unsigned char *target =
(const unsigned char *)_isrc->getPtrToInstruction(addr);
InstructionDecoder targetChecker(target,
2*InstructionDecoder::maxInstructionLength, _isrc->getArch());
Instruction::Ptr thunkFirst = targetChecker.decode();
Instruction::Ptr thunkSecond = targetChecker.decode();
if(thunkFirst && thunkSecond &&
(thunkFirst->getOperation().getID() == e_mov) &&
(thunkSecond->getCategory() == c_ReturnInsn))
{
if(thunkFirst->isRead(stackPtr[_isrc->getArch()]))
{
// it is not enough that the stack pointer is read; it must
// be a zero-offset read from the stack pointer
ThunkVisitor tv;
Operand op = thunkFirst->getOperand(1);
op.getValue()->apply(&tv);
return tv.offset() == 0;
}
}
return false;
}
void IndirectControlFlowAnalyzer::FindAllThunks() {
// Enumuerate every block to find thunk
for (auto bit = reachable.begin(); bit != reachable.end(); ++bit) {
// We intentional treat a getting PC call as a special case that does not
// end a basic block. So, we need to check every instruction to find all thunks
ParseAPI::Block *b = *bit;
const unsigned char* buf =
(const unsigned char*)(b->obj()->cs()->getPtrToInstruction(b->start()));
if( buf == NULL ) {
parsing_printf("%s[%d]: failed to get pointer to instruction by offset\n",FILE__, __LINE__);
return;
}
parsing_printf("Looking for thunk in block [%lx,%lx).", b->start(), b->end());
InstructionDecoder dec(buf, b->end() - b->start(), b->obj()->cs()->getArch());
InsnAdapter::IA_IAPI block(dec, b->start(), b->obj() , b->region(), b->obj()->cs(), b);
while (block.getAddr() < b->end()) {
if (block.getInstruction()->getCategory() == c_CallInsn && block.isThunk()) {
bool valid;
Address addr;
boost::tie(valid, addr) = block.getCFT();
const unsigned char *target = (const unsigned char *) b->obj()->cs()->getPtrToInstruction(addr);
InstructionDecoder targetChecker(target, InstructionDecoder::maxInstructionLength, b->obj()->cs()->getArch());
Instruction::Ptr thunkFirst = targetChecker.decode();
set<RegisterAST::Ptr> thunkTargetRegs;
thunkFirst->getWriteSet(thunkTargetRegs);
for (auto curReg = thunkTargetRegs.begin(); curReg != thunkTargetRegs.end(); ++curReg) {
ThunkInfo t;
t.reg = (*curReg)->getID();
t.value = block.getAddr() + block.getInstruction()->size();
t.value += ThunkAdjustment(t.value, t.reg, b);
t.block = b;
thunks.insert(make_pair(block.getAddr(), t));
parsing_printf("\tfind thunk at %lx, storing value %lx to %s\n", block.getAddr(), t.value , t.reg.name().c_str());
}
}
block.advance();
}
}
}
static Address ThunkAdjustment(Address afterThunk, MachRegister reg, ParseAPI::Block *b) {
// After the call to thunk, there is usually
// an add insturction like ADD ebx, OFFSET to adjust
// the value coming out of thunk.
const unsigned char* buf = (const unsigned char*) (b->obj()->cs()->getPtrToInstruction(afterThunk));
InstructionDecoder dec(buf, b->end() - b->start(), b->obj()->cs()->getArch());
Instruction::Ptr nextInsn = dec.decode();
// It has to be an add
if (nextInsn->getOperation().getID() != e_add) return 0;
vector<Operand> operands;
nextInsn->getOperands(operands);
RegisterAST::Ptr regAST = boost::dynamic_pointer_cast<RegisterAST>(operands[0].getValue());
// The first operand should be a register
if (regAST == 0) return 0;
if (regAST->getID() != reg) return 0;
Result res = operands[1].getValue()->eval();
// A not defined result means that
// the second operand is not an immediate
if (!res.defined) return 0;
return res.convert<Address>();
}
std::pair<bool, Address> parse_block::callTarget() {
using namespace InstructionAPI;
Offset off = lastInsnOffset();
const unsigned char *ptr = (const unsigned char *)getPtrToInstruction(off);
if (ptr == NULL) return std::make_pair(false, 0);
InstructionDecoder d(ptr, endOffset() - lastInsnOffset(), obj()->cs()->getArch());
Instruction::Ptr insn = d.decode();
// Bind PC to that insn
// We should build a free function to do this...
Expression::Ptr cft = insn->getControlFlowTarget();
if (cft) {
Expression::Ptr pc(new RegisterAST(MachRegister::getPC(obj()->cs()->getArch())));
cft->bind(pc.get(), Result(u64, lastInsnAddr()));
Result res = cft->eval();
if (!res.defined) return std::make_pair(false, 0);
return std::make_pair(true, res.convert<Address>());
}
return std::make_pair(false, 0);
}
/* returns true if the call leads to:
* -an invalid instruction (or immediately branches/calls to an invalid insn)
* -a block not ending in a return instruction that pops the return address
* off of the stack
*/
bool IA_IAPI::isFakeCall() const
{
assert(_obj->defensiveMode());
if (isDynamicCall()) {
return false;
}
// get func entry
bool tampers = false;
bool valid; Address entry;
boost::tie(valid, entry) = getCFT();
if (!valid) return false;
if (! _cr->contains(entry) ) {
return false;
}
if ( ! _isrc->isCode(entry) ) {
mal_printf("WARNING: found function call at %lx "
"to invalid address %lx %s[%d]\n", current,
entry, FILE__,__LINE__);
return false;
}
// get instruction at func entry
const unsigned char* bufPtr =
(const unsigned char *)(_cr->getPtrToInstruction(entry));
Offset entryOff = entry - _cr->offset();
InstructionDecoder newdec( bufPtr,
_cr->length() - entryOff,
_cr->getArch() );
IA_IAPI *ah = new IA_IAPI(newdec, entry, _obj, _cr, _isrc, _curBlk);
Instruction::Ptr insn = ah->curInsn();
// follow ctrl transfers until you get a block containing non-ctrl
// transfer instructions, or hit a return instruction
while (insn->getCategory() == c_CallInsn ||
insn->getCategory() == c_BranchInsn)
{
boost::tie(valid, entry) = ah->getCFT();
if ( !valid || ! _cr->contains(entry) || ! _isrc->isCode(entry) ) {
mal_printf("WARNING: found call to function at %lx that "
"leaves to %lx, out of the code region %s[%d]\n",
current, entry, FILE__,__LINE__);
return false;
}
bufPtr = (const unsigned char *)(_cr->getPtrToInstruction(entry));
entryOff = entry - _cr->offset();
delete(ah);
newdec = InstructionDecoder(bufPtr,
_cr->length() - entryOff,
_cr->getArch());
ah = new IA_IAPI(newdec, entry, _obj, _cr, _isrc, _curBlk);
insn = ah->curInsn();
}
// calculate instruction stack deltas for the block, leaving the iterator
// at the last ins'n if it's a control transfer, or after calculating the
// last instruction's delta if we run off the end of initialized memory
int stackDelta = 0;
int addrWidth = _isrc->getAddressWidth();
static Expression::Ptr theStackPtr
(new RegisterAST(MachRegister::getStackPointer(_isrc->getArch())));
Address curAddr = entry;
while(true) {
// exit condition 1
if (insn->getCategory() == c_CallInsn ||
insn->getCategory() == c_ReturnInsn ||
insn->getCategory() == c_BranchInsn)
{
break;
}
// calculate instruction delta
if(insn->isWritten(theStackPtr)) {
entryID what = insn->getOperation().getID();
int sign = 1;
switch(what)
{
case e_push:
sign = -1;
//FALLTHROUGH
case e_pop: {
int size = insn->getOperand(0).getValue()->size();
stackDelta += sign * size;
break;
}
case e_pusha:
case e_pushad:
sign = -1;
//FALLTHROUGH
case e_popa:
case e_popad:
if (1 == sign) {
mal_printf("popad ins'n at %lx in func at %lx changes sp "
"by %d. %s[%d]\n", ah->getAddr(),
entry, 8 * sign * addrWidth, FILE__, __LINE__);
}
stackDelta += sign * 8 * addrWidth;
break;
case e_pushf:
case e_pushfd:
sign = -1;
//FALLTHROUGH
case e_popf:
case e_popfd:
stackDelta += sign * 4;
if (1 == sign) {
mal_printf("popf ins'n at %lx in func at %lx changes sp "
"by %d. %s[%d]\n", ah->getAddr(), entry,
sign * 4, FILE__, __LINE__);
}
break;
case e_enter:
//mal_printf("Saw enter instruction at %lx in isFakeCall, "
// "quitting early, assuming not fake "
// "%s[%d]\n",curAddr, FILE__,__LINE__);
// unhandled case, but not essential for correct analysis
delete ah;
return false;
break;
case e_leave:
mal_printf("WARNING: saw leave instruction "
"at %lx that is not handled by isFakeCall %s[%d]\n",
curAddr, FILE__,__LINE__);
// unhandled, not essential for correct analysis, would
// be a red flag if there wasn't an enter ins'n first and
// we didn't end in a return instruction
break;
case e_and:
// Rounding off the stack pointer.
mal_printf("WARNING: saw and instruction at %lx that is not handled by isFakeCall %s[%d]\n",
curAddr, FILE__, __LINE__);
delete ah;
return false;
break;
case e_sub:
sign = -1;
//FALLTHROUGH
case e_add: {
Operand arg = insn->getOperand(1);
Result delta = arg.getValue()->eval();
if(delta.defined) {
int delta_int = sign;
switch (delta.type) {
case u8:
case s8:
delta_int *= (int)delta.convert<char>();
break;
case u16:
case s16:
delta_int *= (int)delta.convert<short>();
break;
case u32:
case s32:
delta_int *= delta.convert<int>();
break;
default:
assert(0 && "got add/sub operand of unusual size");
break;
}
stackDelta += delta_int;
} else if (sign == -1) {
delete ah;
return false;
} else {
mal_printf("ERROR: in isFakeCall, add ins'n "
"at %lx (in first block of function at "
"%lx) modifies the sp but failed to evaluate "
"its arguments %s[%d]\n",
ah->getAddr(), entry, FILE__, __LINE__);
delete ah;
return true;
}
break;
}
default: {
fprintf(stderr,"WARNING: in isFakeCall non-push/pop "
"ins'n at %lx (in first block of function at "
"%lx) modifies the sp by an unknown amount. "
"%s[%d]\n", ah->getAddr(), entry,
FILE__, __LINE__);
break;
} // end default block
} // end switch
}
if (stackDelta > 0) {
tampers=true;
}
// exit condition 2
ah->advance();
Instruction::Ptr next = ah->curInsn();
if (NULL == next) {
break;
}
curAddr += insn->size();
insn = next;
}
// not a fake call if it ends w/ a return instruction
if (insn->getCategory() == c_ReturnInsn) {
delete ah;
return false;
}
// if the stack delta is positive or the return address has been replaced
// with an absolute value, it's a fake call, since in both cases
// the return address is gone and we cannot return to the caller
if ( 0 < stackDelta || tampers ) {
delete ah;
return true;
}
delete ah;
return false;
}
void TextRewriter::organizeNewText() {
/**
*
*/
unsigned int textSize = 0;
textSize = textRegion->getRegionSize();
oldText = (unsigned char*) textRegion->getPtrToRawData();
newText = (unsigned char*) calloc (1, sizeof(unsigned char) * textSize);
memcpy(newText, oldText, textSize);
//InstructionDecoder decoder(oldText, textSize, Arch_x86_64);
InstructionDecoder decoder(oldText, textSize, Arch_x86);
Instruction::Ptr i = decoder.decode();
long unsigned int currentTextOffset = 0;
while (i != NULL) {
//vector<Operand> operands;
//i->getOperands(operands);
//if (operands.size() > 0) {
// Expression::Ptr exp = operands[0].getValue();
// Result res = exp->eval();
// Immediate::makeImmediate(Result(u64, 2^32));
// fprintf(stderr, "results: %s\n", res.format().c_str());
//}
unsigned char* dotTextRaw = (unsigned char*) i->ptr();
//fprintf(stderr, "%i bytes > %s -- ", i->size(), i->format().c_str());
//for (int x = 0; x < i->size(); x++) {
// fprintf(stderr, " %x ", dotTextRaw[x]);
//}
//fprintf(stderr, "\n");
if (i->readsMemory()) {
if (/*dotTextRaw[0] == 0xa1 && */i->size() == 5 || i->size() == 6) {
unsigned int* dataOperand = i->size() == 5 ? (unsigned int*)(dotTextRaw + 1)
: (unsigned int*)(dotTextRaw + 2);
// Interpret as int to reverse bytes in memory automatically
fprintf(stderr, "Data operand: %p\n", (void*) ((unsigned int)*dataOperand));
unsigned int data = *dataOperand;
unsigned char* tmp = (unsigned char*) dataOperand;
if (dataRegion->isOffsetInRegion((*relocs)[data])
|| bssRegion->isOffsetInRegion((*relocs)[data])) {
// Hacky, depends on teh 32-bit instructions
int tmp = i->size() == 5 ? 1 : 2;
*((unsigned int*)(newText + currentTextOffset + tmp)) = (*relocs)[data];
}
}
}
//if (dotTextRaw[0] == 0xa1 && i->size() == 9) {
// fprintf(stdout, "%i bytes > %s\n", i->size(), i->format().c_str());
// unsigned int* dataOperand = (unsigned int*)(dotTextRaw + 1);
// if (dataOperand[0] > 134518284) {
// ((unsigned int*)(((unsigned char*) dotTextRawMuta) + currentTextOffset + 1))[0] = 134518520;
// }
//}
currentTextOffset += i->size();
i = decoder.decode();
}
// Assign the data region to point at the new buffer
if (!textRegion->setPtrToRawData((void*) newText, textRegion->getRegionSize())) {
fprintf(stderr, "Failed to set pointer to raw text!\n");
exit(EXIT_FAILURE);
}
}
func_instance *mapped_object::findGlobalConstructorFunc(const std::string &ctorHandler) {
using namespace Dyninst::InstructionAPI;
const pdvector<func_instance *> *funcs = findFuncVectorByMangled(ctorHandler);
if( funcs != NULL ) {
return funcs->at(0);
}
/* If the symbol isn't found, try looking for it in a call instruction in
* the .init section
*
* On Linux, the instruction sequence is:
* ...
* some instructions
* ...
* call call_gmon_start
* call frame_dummy
* call ctor_handler
*
* On FreeBSD, the instruction sequence is:
* ...
* some instructions
* ...
* call frame_dummy
* call ctor_handler
*/
Symtab *linkedFile = parse_img()->getObject();
Region *initRegion = NULL;
if( !linkedFile->findRegion(initRegion, ".init") ) {
vector<Dyninst::SymtabAPI::Function *> symFuncs;
if( linkedFile->findFunctionsByName(symFuncs, "_init") ) {
initRegion = symFuncs[0]->getRegion();
}else{
logLine("failed to locate .init Region or _init function\n");
return NULL;
}
}
if( initRegion == NULL ) {
logLine("failed to locate .init Region or _init function\n");
return NULL;
}
// Search for last of a fixed number of calls
#if defined(os_freebsd)
const unsigned CTOR_NUM_CALLS = 2;
#else
const unsigned CTOR_NUM_CALLS = 3;
#endif
Address ctorAddress = 0;
unsigned bytesSeen = 0;
unsigned numCalls = 0;
const unsigned char *p = reinterpret_cast<const unsigned char *>(initRegion->getPtrToRawData());
InstructionDecoder decoder(p, initRegion->getDiskSize(),
parse_img()->codeObject()->cs()->getArch());
Instruction::Ptr curInsn = decoder.decode();
while(numCalls < CTOR_NUM_CALLS && curInsn && curInsn->isValid() &&
bytesSeen < initRegion->getDiskSize())
{
InsnCategory category = curInsn->getCategory();
if( category == c_CallInsn ) {
numCalls++;
}
if( numCalls < CTOR_NUM_CALLS ) {
bytesSeen += curInsn->size();
curInsn = decoder.decode();
}
}
if( numCalls != CTOR_NUM_CALLS ) {
logLine("heuristic for finding global constructor function failed\n");
return NULL;
}
Address callAddress = initRegion->getMemOffset() + bytesSeen;
RegisterAST thePC = RegisterAST(
Dyninst::MachRegister::getPC(parse_img()->codeObject()->cs()->getArch()));
Expression::Ptr callTarget = curInsn->getControlFlowTarget();
if( !callTarget.get() ) {
logLine("failed to find global constructor function\n");
return NULL;
}
callTarget->bind(&thePC, Result(s64, callAddress));
Result actualTarget = callTarget->eval();
if( actualTarget.defined ) {
ctorAddress = actualTarget.convert<Address>();
}else{
logLine("failed to find global constructor function\n");
return NULL;
}
if( !ctorAddress || !parse_img()->codeObject()->cs()->isValidAddress(ctorAddress) ) {
logLine("invalid address for global constructor function\n");
return NULL;
}
func_instance *ret;
if( (ret = findFuncByEntry(ctorAddress)) == NULL ) {
logLine("unable to create representation for global constructor function\n");
return NULL;
}
inst_printf("%s[%d]: set global constructor address to 0x%lx\n", FILE__, __LINE__,
ctorAddress);
return ret;
}
boost::tuple<Instruction::Ptr,
Instruction::Ptr,
bool> IA_x86Details::findMaxSwitchInsn(Block *start)
{
std::set<Block *> visited;
std::vector<Block *> WL;
Block *curBlk;
int depth = 0;
bool foundMaxSwitch = false;
bool foundCondBranch = false;
WL.push_back(start);
Instruction::Ptr compareInsn, condBranchInsn;
bool compareOnTakenBranch = false;
for(unsigned j=0;j < WL.size(); j++)
{
curBlk = WL[j];
visited.insert(curBlk);
foundMaxSwitch = false;
foundCondBranch = false;
const unsigned char* buf =
(const unsigned char*)(currentBlock->_isrc->getPtrToInstruction(curBlk->start()));
if( buf == NULL ) {
parsing_printf("%s[%d]: failed to get pointer to instruction by offset\n",
FILE__, __LINE__);
return boost::make_tuple(Instruction::Ptr(), Instruction::Ptr(), false);
}
InstructionDecoder dec(buf, curBlk->size(), currentBlock->_isrc->getArch());
Instruction::Ptr i;
Address curAdr = curBlk->start();
while((i = dec.decode()))
{
if(i->getCategory() == c_CompareInsn)
// check for cmp
{
parsing_printf("\tFound jmp table cmp instruction %s at 0x%lx\n",
i->format().c_str(), curAdr);
compareInsn = i;
foundMaxSwitch = true;
}
if(i->getCategory() == c_BranchInsn &&
i->allowsFallThrough())
{
parsing_printf("\tFound jmp table cond br instruction %s at 0x%lx\n",
i->format().c_str(), curAdr);
condBranchInsn = i;
foundCondBranch = true;
Block::edgelist::const_iterator tit = curBlk->targets().begin();
bool taken_hit = false;
bool fallthrough_hit = false;
for ( ; tit != curBlk->targets().end(); ++tit) {
ParseAPI::Edge *t = *tit;
if (t->type() == COND_TAKEN &&
(visited.find(t->trg()) != visited.end()))
{
taken_hit = true;
}
if ((t->type() == COND_NOT_TAKEN ||
t->type() == FALLTHROUGH) &&
(visited.find(t->trg()) != visited.end()))
{
fallthrough_hit = true;
}
}
parsing_printf("\tfindMaxSwitchInsn: taken_hit: %d, fallthrough_hit: %d\n", taken_hit, fallthrough_hit);
compareOnTakenBranch = taken_hit && !fallthrough_hit;
break;
}
curAdr += i->size();
}
if(foundMaxSwitch && foundCondBranch)
break; // done
// look further back
Block::edgelist::const_iterator sit = curBlk->sources().begin();
depth++;
// We've seen depth 2 in libc et al
if(depth > 2) return boost::make_tuple(Instruction::Ptr(), Instruction::Ptr(), false);
for( ; sit != curBlk->sources().end(); ++sit)
{
ParseAPI::Edge * s = *sit;
// ignore return edges
if(s->type() == RET)
continue;
if(s->type() == CALL)
return boost::make_tuple(Instruction::Ptr(), Instruction::Ptr(), false);
Block * src = s->src();
if( (visited.find( src ) == visited.end())) {
WL.push_back(src);
}
}
}
WL.clear();
parsing_printf("\tfindMaxSwitchInsn: table on taken branch: %d, returning: %d\n", compareOnTakenBranch, foundMaxSwitch &&
foundCondBranch);
return boost::make_tuple(compareInsn, condBranchInsn, compareOnTakenBranch);
}
bool IA_x86Details::handleCall(IA_IAPI& block)
{
parsing_printf("\tchecking call at 0x%lx for thunk\n", block.getAddr());
if(!block.isRealCall())
{
parsing_printf("\tthunk found at 0x%lx, checking for add\n", block.getAddr());
block.advance();
thunkInsn.addrFromInsn = block.getAddr();
Instruction::Ptr addInsn = block.getInstruction();
if(addInsn)
parsing_printf("\tinsn after thunk: %s\n", addInsn->format().c_str());
else
parsing_printf("\tNO INSN after thunk at 0x%lx\n", thunkInsn.addrFromInsn);
if(addInsn)
{
std::set<RegisterAST::Ptr> boundRegs;
if(addInsn->getOperation().getID() == e_pop)
{
addInsn->getWriteSet(boundRegs);
block.advance();
addInsn = block.getInstruction();
}
if(addInsn && ((addInsn->getOperation().getID() == e_add) ||
(addInsn->getOperation().getID() == e_lea)))
{
Expression::Ptr op0 = addInsn->getOperand(0).getValue();
Expression::Ptr op1 = addInsn->getOperand(1).getValue();
for(std::set<RegisterAST::Ptr>::const_iterator curReg = boundRegs.begin();
curReg != boundRegs.end();
++curReg)
{
op0->bind(curReg->get(), Result(u64, 0));
op1->bind(curReg->get(), Result(u64, 0));
}
Result imm = addInsn->getOperand(1).getValue()->eval();
Result imm2 = addInsn->getOperand(0).getValue()->eval();
if(imm.defined)
{
Address thunkDiff = imm.convert<Address>();
parsing_printf("\tsetting thunkInsn.addrFromInsn to 0x%lx (0x%lx + 0x%lx)\n",
thunkInsn.addrFromInsn+thunkDiff, thunkInsn.addrFromInsn, thunkDiff);
thunkInsn.addrOfInsn = block.getPrevAddr();
thunkInsn.addrFromInsn = thunkInsn.addrFromInsn + thunkDiff;
return true;
}
else if(imm2.defined)
{
Address thunkDiff = imm2.convert<Address>();
parsing_printf("\tsetting thunkInsn.addrFromInsn to 0x%lx (0x%lx + 0x%lx)\n",
thunkInsn.addrFromInsn+thunkDiff, thunkInsn.addrFromInsn, thunkDiff);
thunkInsn.addrOfInsn = block.getPrevAddr();
thunkInsn.addrFromInsn = thunkInsn.addrFromInsn + thunkDiff;
return true;
}
else
{
parsing_printf("\tadd insn %s found following thunk at 0x%lx, couldn't bind operands!\n",
addInsn->format().c_str(), thunkInsn.addrFromInsn);
}
}
}
thunkInsn.addrFromInsn = 0;
}
thunkInsn.addrFromInsn = 0;
thunkInsn.addrOfInsn = 0;
thunkInsn.insn.reset();
return false;
}
func_instance *mapped_object::findGlobalDestructorFunc(const std::string &dtorHandler) {
using namespace Dyninst::InstructionAPI;
const pdvector<func_instance *> *funcs = findFuncVectorByMangled(dtorHandler);
if( funcs != NULL ) {
return funcs->at(0);
}
/*
* If the symbol isn't found, try looking for it in a call in the
* .fini section. It is the last call in .fini.
*
* The pattern is:
*
* _fini:
*
* ... some code ...
*
* call dtor_handler
*
* ... prologue ...
*/
Symtab *linkedFile = parse_img()->getObject();
Region *finiRegion = NULL;
if( !linkedFile->findRegion(finiRegion, ".fini") ) {
vector<Dyninst::SymtabAPI::Function *> symFuncs;
if( linkedFile->findFunctionsByName(symFuncs, "_fini") ) {
finiRegion = symFuncs[0]->getRegion();
}else{
logLine("failed to locate .fini Region or _fini function\n");
return NULL;
}
}
if( finiRegion == NULL ) {
logLine("failed to locate .fini Region or _fini function\n");
return NULL;
}
// Search for last call in the function
Address dtorAddress = 0;
unsigned bytesSeen = 0;
const unsigned char *p = reinterpret_cast<const unsigned char *>(finiRegion->getPtrToRawData());
InstructionDecoder decoder(p, finiRegion->getDiskSize(),
parse_img()->codeObject()->cs()->getArch());
Instruction::Ptr lastCall;
Instruction::Ptr curInsn = decoder.decode();
while(curInsn && curInsn->isValid() &&
bytesSeen < finiRegion->getDiskSize())
{
InsnCategory category = curInsn->getCategory();
if( category == c_CallInsn ) {
lastCall = curInsn;
break;
}
bytesSeen += curInsn->size();
curInsn = decoder.decode();
}
if( !lastCall.get() || !lastCall->isValid() ) {
logLine("heuristic for finding global destructor function failed\n");
return NULL;
}
Address callAddress = finiRegion->getMemOffset() + bytesSeen;
RegisterAST thePC = RegisterAST(
Dyninst::MachRegister::getPC(parse_img()->codeObject()->cs()->getArch()));
Expression::Ptr callTarget = lastCall->getControlFlowTarget();
if( !callTarget.get() ) {
logLine("failed to find global destructor function\n");
return NULL;
}
callTarget->bind(&thePC, Result(s64, callAddress));
Result actualTarget = callTarget->eval();
if( actualTarget.defined ) {
dtorAddress = actualTarget.convert<Address>();
}else{
logLine("failed to find global destructor function\n");
return NULL;
}
if( !dtorAddress || !parse_img()->codeObject()->cs()->isValidAddress(dtorAddress) ) {
logLine("invalid address for global destructor function\n");
return NULL;
}
// A targ stub should have been created at the address
func_instance *ret = NULL;
if( (ret = findFuncByEntry(dtorAddress)) == NULL ) {
logLine("unable to find global destructor function\n");
return NULL;
}
inst_printf("%s[%d]: set global destructor address to 0x%lx\n", FILE__, __LINE__,
dtorAddress);
return ret;
}
void AssignmentConverter::convert(const Instruction::Ptr I,
const Address &addr,
ParseAPI::Function *func,
ParseAPI::Block *block,
std::vector<Assignment::Ptr> &assignments) {
assignments.clear();
if (cache(func, addr, assignments)) return;
// Decompose the instruction into a set of abstract assignments.
// We don't have the Definition class concept yet, so we'll do the
// hard work here.
// Two phases:
// 1) Special-cased for IA32 multiple definition instructions,
// based on the opcode of the instruction
// 2) Generic handling for things like flags and the PC.
// Non-PC handling section
switch(I->getOperation().getID()) {
case e_push: {
// SP = SP - 4
// *SP = <register>
std::vector<Operand> operands;
I->getOperands(operands);
// According to the InstructionAPI, the first operand will be the argument, the second will be ESP.
assert(operands.size() == 2);
// The argument can be any of the following:
// 1) a register (push eax);
// 2) an immediate value (push $deadbeef)
// 3) a memory location.
std::vector<AbsRegion> oper0;
aConverter.convertAll(operands[0].getValue(),
addr,
func,
block,
oper0);
handlePushEquivalent(I, addr, func, block, oper0, assignments);
break;
}
case e_call: {
// This can be seen as a push of the PC...
std::vector<AbsRegion> pcRegion;
pcRegion.push_back(Absloc::makePC(func->isrc()->getArch()));
Absloc sp = Absloc::makeSP(func->isrc()->getArch());
handlePushEquivalent(I, addr, func, block, pcRegion, assignments);
// Now for the PC definition
// Assume full intra-dependence of non-flag and non-pc registers.
std::vector<AbsRegion> used;
std::vector<AbsRegion> defined;
aConverter.convertAll(I,
addr,
func,
block,
used,
defined);
Assignment::Ptr a = Assignment::Ptr(new Assignment(I, addr, func, block, pcRegion[0]));
if (!used.empty()) {
for(std::vector<AbsRegion>::const_iterator u = used.begin();
u != used.end();
++u)
{
if(!(u->contains(pcRegion[0])) &&
!(u->contains(sp)))
{
a->addInput(*u);
}
}
}
else {
a->addInputs(pcRegion);
}
assignments.push_back(a);
break;
}
case e_pop: {
// <reg> = *SP
// SP = SP + 4/8
// Amusingly... this doesn't have an intra-instruction dependence. It should to enforce
// the order that <reg> = *SP happens before SP = SP - 4, but since the input to both
// uses of SP in this case are the, well, input values... no "sideways" edges.
// However, we still special-case it so that SP doesn't depend on the incoming stack value...
// Also, we use the same logic for return, defining it as
// PC = *SP
// SP = SP + 4/8
// As with push, eSP shows up as operand 1.
std::vector<Operand> operands;
I->getOperands(operands);
// According to the InstructionAPI, the first operand will be the explicit register, the second will be ESP.
assert(operands.size() == 2);
std::vector<AbsRegion> oper0;
aConverter.convertAll(operands[0].getValue(),
addr,
func,
block,
oper0);
handlePopEquivalent(I, addr, func, block, oper0, assignments);
break;
}
case e_leave: {
// a leave is equivalent to:
// mov ebp, esp
// pop ebp
// From a definition POV, we have the following:
// SP = BP
// BP = *SP
// BP STACK[newSP]
// | |
// v v
// SP -> BP
// This is going to give the stack analysis fits... for now, I think it just reverts the
// stack depth to 0.
// TODO FIXME update stack analysis to make this really work.
AbsRegion sp(Absloc::makeSP(func->isrc()->getArch()));
AbsRegion fp(Absloc::makeFP(func->isrc()->getArch()));
// Should be "we assign SP using FP"
Assignment::Ptr spA = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
sp));
spA->addInput(fp);
// And now we want "FP = (stack slot -2*wordsize)"
/*
AbsRegion stackTop(Absloc(0,
0,
func));
*/
// Actually, I think this is ebp = pop esp === ebp = pop ebp
Assignment::Ptr fpA = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
fp));
//fpA->addInput(aConverter.stack(addr + I->size(), func, false));
fpA->addInput(aConverter.frame(addr, func, block, false));
assignments.push_back(spA);
assignments.push_back(fpA);
break;
}
case e_ret_near:
case e_ret_far: {
// PC = *SP
// SP = SP + 4/8
// Like pop, except it's all implicit.
AbsRegion pc = AbsRegion(Absloc::makePC(func->isrc()->getArch()));
Assignment::Ptr pcA = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
pc));
pcA->addInput(aConverter.stack(addr, func, block, false));
AbsRegion sp = AbsRegion(Absloc::makeSP(func->isrc()->getArch()));
Assignment::Ptr spA = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
sp));
spA->addInput(sp);
assignments.push_back(pcA);
assignments.push_back(spA);
break;
}
case e_xchg: {
// xchg defines two abslocs, and uses them as appropriate...
std::vector<Operand> operands;
I->getOperands(operands);
// According to the InstructionAPI, the first operand will be the argument, the second will be ESP.
assert(operands.size() == 2);
// We use the first to define the second, and vice versa
std::vector<AbsRegion> oper0;
aConverter.convertAll(operands[0].getValue(),
addr,
func,
block,
oper0);
std::vector<AbsRegion> oper1;
aConverter.convertAll(operands[1].getValue(),
addr,
func,
block,
oper1);
// Okay. We may have a memory reference in here, which will
// cause either oper0 or oper1 to have multiple entries (the
// remainder will be registers). So. Use everything from oper1
// to define oper0[0], and vice versa.
Assignment::Ptr a = Assignment::Ptr(new Assignment(I, addr, func, block, oper0[0]));
a->addInputs(oper1);
Assignment::Ptr b = Assignment::Ptr(new Assignment(I, addr, func, block, oper1[0]));
b->addInputs(oper0);
assignments.push_back(a);
assignments.push_back(b);
break;
}
case power_op_stwu: {
std::vector<Operand> operands;
I->getOperands(operands);
// stwu <a>, <b>, <c>
// <a> = R1
// <b> = -16(R1)
// <c> = R1
// From this, R1 <= R1 - 16; -16(R1) <= R1
// So a <= b (without a deref)
// deref(b) <= c
std::set<Expression::Ptr> writes;
I->getMemoryWriteOperands(writes);
assert(writes.size() == 1);
Expression::Ptr tmp = *(writes.begin());
AbsRegion effAddr = aConverter.convert(tmp,
addr,
func,
block);
std::vector<AbsRegion> regions;
aConverter.convertAll(operands[0].getValue(), addr, func, block, regions);
AbsRegion RS = regions[0];
regions.clear();
aConverter.convertAll(operands[2].getValue(), addr, func, block, regions);
AbsRegion RA = regions[0];
Assignment::Ptr mem = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
effAddr));
mem->addInput(RS);
Assignment::Ptr ra = Assignment::Ptr(new Assignment(I,
addr,
func,
block,
RA));
ra->addInput(RS);
assignments.push_back(mem);
assignments.push_back(ra);
break;
}
default:
// Assume full intra-dependence of non-flag and non-pc registers.
std::vector<AbsRegion> used;
std::vector<AbsRegion> defined;
aConverter.convertAll(I,
addr,
func,
block,
used,
defined);
for (std::vector<AbsRegion>::const_iterator i = defined.begin();
i != defined.end(); ++i) {
Assignment::Ptr a = Assignment::Ptr(new Assignment(I, addr, func, block, *i));
a->addInputs(used);
assignments.push_back(a);
}
break;
}
// Now for flags...
// According to Matt, the easiest way to represent dependencies for flags on
// IA-32/AMD-64 is to have them depend on the inputs to the instruction and
// not the outputs of the instruction; therefore, there's no intra-instruction
// dependence.
// PC-handling section
// Most instructions use the PC to set the PC. This includes calls, relative branches,
// and the like. So we're basically looking for indirect branches or absolute branches.
// (are there absolutes on IA-32?).
// Also, conditional branches and the flag registers they use.
if (cacheEnabled_) {
cache_[func][addr] = assignments;
}
}
bool IA_IAPI::isTailCall(Function * context, EdgeTypeEnum type, unsigned int, const set<Address>& knownTargets) const
{
// Collapse down to "branch" or "fallthrough"
switch(type) {
case COND_TAKEN:
case DIRECT:
case INDIRECT:
type = DIRECT;
break;
case CALL:
case RET:
case COND_NOT_TAKEN:
case FALLTHROUGH:
case CALL_FT:
default:
return false;
}
parsing_printf("Checking for Tail Call \n");
context->obj()->cs()->incrementCounter(PARSE_TAILCALL_COUNT);
if (tailCalls.find(type) != tailCalls.end()) {
parsing_printf("\tReturning cached tail call check result: %d\n", tailCalls[type]);
if (tailCalls[type]) {
context->obj()->cs()->incrementCounter(PARSE_TAILCALL_FAIL);
return true;
}
return false;
}
bool valid; Address addr;
boost::tie(valid, addr) = getCFT();
Function* callee = _obj->findFuncByEntry(_cr, addr);
Block* target = _obj->findBlockByEntry(_cr, addr);
// check if addr is in a block if it is not entry.
if (target == NULL) {
std::set<Block*> blocks;
_obj->findCurrentBlocks(_cr, addr, blocks);
if (blocks.size() == 1) {
target = *blocks.begin();
} else if (blocks.size() == 0) {
// This case can happen when the jump target is a function entry,
// but we have not parsed the function yet,
// or when this is an indirect jump
target = NULL;
} else {
// If this case happens, it means the jump goes into overlapping instruction streams,
// it is not likely to be a tail call.
parsing_printf("\tjumps into overlapping instruction streams\n");
for (auto bit = blocks.begin(); bit != blocks.end(); ++bit) {
parsing_printf("\t block [%lx,%lx)\n", (*bit)->start(), (*bit)->end());
}
parsing_printf("\tjump to 0x%lx, NOT TAIL CALL\n", addr);
tailCalls[type] = false;
return false;
}
}
if(curInsn()->getCategory() == c_BranchInsn &&
valid &&
callee &&
callee != context &&
target &&
!context->contains(target)
)
{
parsing_printf("\tjump to 0x%lx, TAIL CALL\n", addr);
tailCalls[type] = true;
return true;
}
if (curInsn()->getCategory() == c_BranchInsn &&
valid &&
!callee) {
if (target) {
parsing_printf("\tjump to 0x%lx is known block, but not func entry, NOT TAIL CALL\n", addr);
tailCalls[type] = false;
return false;
} else if (knownTargets.find(addr) != knownTargets.end()) {
parsing_printf("\tjump to 0x%lx is known target in this function, NOT TAIL CALL\n", addr);
tailCalls[type] = false;
return false;
}
}
if(allInsns.size() < 2) {
if(context->addr() == _curBlk->start() && curInsn()->getCategory() == c_BranchInsn)
{
parsing_printf("\tjump as only insn in entry block, TAIL CALL\n");
tailCalls[type] = true;
return true;
}
else
{
parsing_printf("\ttoo few insns to detect tail call\n");
context->obj()->cs()->incrementCounter(PARSE_TAILCALL_FAIL);
tailCalls[type] = false;
return false;
}
}
if ((curInsn()->getCategory() == c_BranchInsn))
{
//std::map<Address, Instruction::Ptr>::const_iterator prevIter =
//allInsns.find(current);
// Updated: there may be zero or more nops between leave->jmp
allInsns_t::const_iterator prevIter = curInsnIter;
--prevIter;
Instruction::Ptr prevInsn = prevIter->second;
while ( isNopInsn(prevInsn) && (prevIter != allInsns.begin()) ) {
--prevIter;
prevInsn = prevIter->second;
}
prevInsn = prevIter->second;
if(prevInsn->getOperation().getID() == e_leave)
{
parsing_printf("\tprev insn was leave, TAIL CALL\n");
tailCalls[type] = true;
return true;
}
else if(prevInsn->getOperation().getID() == e_pop)
{
if(prevInsn->isWritten(framePtr[_isrc->getArch()]))
{
parsing_printf("\tprev insn was %s, TAIL CALL\n", prevInsn->format().c_str());
tailCalls[type] = true;
return true;
}
}
else if(prevInsn->getOperation().getID() == e_add)
{
if(prevInsn->isWritten(stackPtr[_isrc->getArch()]))
{
bool call_fallthrough = false;
if (_curBlk->start() == prevIter->first) {
for (auto eit = _curBlk->sources().begin(); eit != _curBlk->sources().end(); ++eit) {
if ((*eit)->type() == CALL_FT) {
call_fallthrough = true;
break;
}
}
}
if (call_fallthrough) {
parsing_printf("\tprev insn was %s, but it is the next instruction of a function call, not a tail call %x %x\n", prevInsn->format().c_str());
} else {
parsing_printf("\tprev insn was %s, TAIL CALL\n", prevInsn->format().c_str());
tailCalls[type] = true;
return true;
}
} else
parsing_printf("\tprev insn was %s, not tail call\n", prevInsn->format().c_str());
}
}
tailCalls[type] = false;
context->obj()->cs()->incrementCounter(PARSE_TAILCALL_FAIL);
return false;
}
ReadWriteInfo LivenessAnalyzer::calcRWSets(Instruction::Ptr curInsn, Block* blk, Address a)
{
liveness_cerr << "calcRWSets for " << curInsn->format() << " @ " << hex << a << dec << endl;
ReadWriteInfo ret;
ret.read = abi->getBitArray();
ret.written = abi->getBitArray();
ret.insnSize = curInsn->size();
std::set<RegisterAST::Ptr> cur_read, cur_written;
curInsn->getReadSet(cur_read);
curInsn->getWriteSet(cur_written);
liveness_printf("Read registers: \n");
for (std::set<RegisterAST::Ptr>::const_iterator i = cur_read.begin();
i != cur_read.end(); i++)
{
MachRegister cur = (*i)->getID();
if (cur.getArchitecture() == Arch_ppc64)
cur = MachRegister((cur.val() & ~Arch_ppc64) | Arch_ppc32);
liveness_printf("\t%s \n", cur.name().c_str());
MachRegister base = cur.getBaseRegister();
if (cur == x86::flags || cur == x86_64::flags){
if (width == 4){
ret.read[getIndex(x86::of)] = true;
ret.read[getIndex(x86::cf)] = true;
ret.read[getIndex(x86::pf)] = true;
ret.read[getIndex(x86::af)] = true;
ret.read[getIndex(x86::zf)] = true;
ret.read[getIndex(x86::sf)] = true;
ret.read[getIndex(x86::df)] = true;
ret.read[getIndex(x86::tf)] = true;
ret.read[getIndex(x86::nt_)] = true;
}
else {
ret.read[getIndex(x86_64::of)] = true;
ret.read[getIndex(x86_64::cf)] = true;
ret.read[getIndex(x86_64::pf)] = true;
ret.read[getIndex(x86_64::af)] = true;
ret.read[getIndex(x86_64::zf)] = true;
ret.read[getIndex(x86_64::sf)] = true;
ret.read[getIndex(x86_64::df)] = true;
ret.read[getIndex(x86_64::tf)] = true;
ret.read[getIndex(x86_64::nt_)] = true;
}
}
else{
base = changeIfMMX(base);
ret.read[getIndex(base)] = true;
}
}
liveness_printf("Write Registers: \n");
for (std::set<RegisterAST::Ptr>::const_iterator i = cur_written.begin();
i != cur_written.end(); i++) {
MachRegister cur = (*i)->getID();
if (cur.getArchitecture() == Arch_ppc64)
cur = MachRegister((cur.val() & ~Arch_ppc64) | Arch_ppc32);
liveness_printf("\t%s \n", cur.name().c_str());
MachRegister base = cur.getBaseRegister();
if (cur == x86::flags || cur == x86_64::flags){
if (width == 4){
ret.written[getIndex(x86::of)] = true;
ret.written[getIndex(x86::cf)] = true;
ret.written[getIndex(x86::pf)] = true;
ret.written[getIndex(x86::af)] = true;
ret.written[getIndex(x86::zf)] = true;
ret.written[getIndex(x86::sf)] = true;
ret.written[getIndex(x86::df)] = true;
ret.written[getIndex(x86::tf)] = true;
ret.written[getIndex(x86::nt_)] = true;
}
else {
ret.written[getIndex(x86_64::of)] = true;
ret.written[getIndex(x86_64::cf)] = true;
ret.written[getIndex(x86_64::pf)] = true;
ret.written[getIndex(x86_64::af)] = true;
ret.written[getIndex(x86_64::zf)] = true;
ret.written[getIndex(x86_64::sf)] = true;
ret.written[getIndex(x86_64::df)] = true;
ret.written[getIndex(x86_64::tf)] = true;
ret.written[getIndex(x86_64::nt_)] = true;
}
}
else{
base = changeIfMMX(base);
ret.written[getIndex(base)] = true;
if ((cur != base && cur.size() < 4) || isMMX(base)) ret.read[getIndex(base)] = true;
}
}
InsnCategory category = curInsn->getCategory();
switch(category)
{
case c_CallInsn:
// Call instructions not at the end of a block are thunks, which are not ABI-compliant.
// So make conservative assumptions about what they may read (ABI) but don't assume they write anything.
ret.read |= (abi->getCallReadRegisters());
if(blk->lastInsnAddr() == a)
{
ret.written |= (abi->getCallWrittenRegisters());
}
break;
case c_ReturnInsn:
ret.read |= (abi->getReturnReadRegisters());
// Nothing written implicitly by a return
break;
case c_BranchInsn:
if(!curInsn->allowsFallThrough() && isExitBlock(blk))
{
//Tail call, union of call and return
ret.read |= ((abi->getCallReadRegisters()) |
(abi->getReturnReadRegisters()));
ret.written |= (abi->getCallWrittenRegisters());
}
break;
default:
{
bool isInterrupt = false;
bool isSyscall = false;
if ((curInsn->getOperation().getID() == e_int) ||
(curInsn->getOperation().getID() == e_int3)) {
isInterrupt = true;
}
static RegisterAST::Ptr gs(new RegisterAST(x86::gs));
if (((curInsn->getOperation().getID() == e_call) &&
/*(curInsn()->getOperation().isRead(gs))) ||*/
(curInsn->getOperand(0).format(curInsn->getArch()) == "16")) ||
(curInsn->getOperation().getID() == e_syscall) ||
(curInsn->getOperation().getID() == e_int) ||
(curInsn->getOperation().getID() == power_op_sc)) {
isSyscall = true;
}
if (curInsn->getOperation().getID() == power_op_svcs) {
isSyscall = true;
}
if (isInterrupt || isSyscall) {
ret.read |= (abi->getSyscallReadRegisters());
ret.written |= (abi->getSyscallWrittenRegisters());
}
}
break;
}
return ret;
}
test_results_t test_instruction_farcall_Mutator::executeTest()
{
const unsigned char buffer[] =
{
0x9A, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0xFF, 0xFE // CALL 0504030201, with FF/FE as fenceposts
};
unsigned int size = 7;
unsigned int expectedInsns = 2;
#if defined(arch_x86_64_test)
Architecture curArch = Arch_x86_64;
#elif defined(arch_x86_test)
Architecture curArch = Arch_x86;
#else
Architecture curArch = Arch_none;
#endif
InstructionDecoder d(buffer, size, curArch);
std::vector<Instruction::Ptr> decodedInsns;
Instruction::Ptr i;
do
{
i = d.decode();
decodedInsns.push_back(i);
}
while(i && i->isValid());
#if defined(arch_x86_64_test)
if(decodedInsns.empty() || !decodedInsns[0] || !decodedInsns[0]->isValid() || decodedInsns[0]->isLegalInsn())
{
logerror("FAILED: %s\n", decodedInsns.empty() ? "no instructions decoded" : "first instruction was valid");
return FAILED;
}
else
{
logerror("PASSED: far call invalid on AMD64\n");
return PASSED;
}
#else
if(decodedInsns.size() != expectedInsns) // six valid, one invalid
{
logerror("FAILED: Expected %d instructions, decoded %d\n", expectedInsns, decodedInsns.size());
for(std::vector<Instruction::Ptr>::iterator curInsn = decodedInsns.begin();
curInsn != decodedInsns.end();
++curInsn)
{
logerror("\t%s\t", (*curInsn)->format().c_str());
for(unsigned j = 0; j < (*curInsn)->size(); ++j)
{
logerror("%x ", (*curInsn)->rawByte(j));
}
logerror("\n");
}
return FAILED;
}
if(decodedInsns.back() && decodedInsns.back()->isValid())
{
logerror("FAILED: Expected instructions to end with an invalid instruction, but they didn't");
return FAILED;
}
return PASSED;
#endif
}
bool Injector::inject(std::string libname) {
int_process *proc = proc_->llproc();
pthrd_printf("Injecting %s into process %d\n", libname.c_str(), proc->getPid());
if (!checkIfExists(libname)) {
perr_printf("Library %s doesn't exist\n", libname.c_str());
proc->setLastError(err_nofile, "File doesn't exist\n");
return false;
}
Codegen codegen(proc_, libname);
if (!codegen.generate()) {
perr_printf("Could not generate code\n");
proc->setLastError(err_internal, "Error in code generation");
return false;
}
int_iRPC::ptr irpc = int_iRPC::ptr(new int_iRPC(codegen.buffer().start_ptr(),
codegen.buffer().size(),
false,
true,
codegen.buffer().startAddr()));
// Don't try to execute a library name...
irpc->setStartOffset(codegen.startOffset());
#if defined(DEBUG_DISASSEMBLE)
cerr << "Setting starting offset to " << hex << codegen.startOffset() << endl;
cerr << "And starting address is " << codegen.buffer().startAddr() << dec << endl;
unsigned char *ptr = codegen.buffer().start_ptr();
ptr += codegen.startOffset();
Offset size = codegen.buffer().size() - codegen.startOffset();
InstructionDecoder d(ptr, size, proc_->getArchitecture());
Offset off = 0;
while (off < size) {
Instruction::Ptr insn = d.decode();
cerr << hex << off + codegen.startOffset() + codegen.buffer().startAddr() << " : " << insn->format() << endl;
off += insn->size();
}
off = 0;
while (off < size) {
cerr << hex << off + codegen.startOffset() + codegen.buffer().startAddr() << ": " << (int) ptr[off] << dec << endl;
off++;
}
#endif
//Post, but doesn't start running yet.
bool result = rpcMgr()->postRPCToProc(proc, irpc);
if (!result) {
pthrd_printf("Error posting RPC to process %d\n", proc->getPid());
return false;
}
//Set the internal state so that this iRPC runs.
int_thread *thr = irpc->thread();
thr->getInternalState().desyncState(int_thread::running);
irpc->setRestoreInternal(true);
//Run the IRPC and wait for completion.
proc->throwNopEvent();
result = int_process::waitAndHandleEvents(false);
if (!result) {
perr_printf("Error waiting for and handling events\n");
return false;
}
//TODO: Any mechanism for error checks?
return true;
}
void
dyninst_analyze_address_taken(BPatch_addressSpace *handle, DICFG *cfg)
{
/* XXX: this is the most naive address-taken analysis that can be used by the
* lbr_analysis_pass. More sophisticated ones can be (and are) plugged in in the pass.
* This naive solution is provided only for comparison with more sophisticated ones.
*
* This analysis looks for instruction operands that correspond to known function addresses,
* and then marks these functions as having their address taken. In particular, we
* do /not/ look for function pointers stored in (static) memory, or for function
* pointers that are computed at runtime.
*/
SymtabCodeSource *sts;
CodeObject *co;
std::vector<BPatch_object*> objs;
handle->getImage()->getObjects(objs);
assert(objs.size() > 0);
const char *bin = objs[0]->pathName().c_str();
// Create a new binary object
sts = new SymtabCodeSource((char*)bin);
co = new CodeObject(sts);
// Parse the binary
co->parse();
BPatch_image *image = handle->getImage();
std::vector<BPatch_module *> *mods = image->getModules();
std::vector<BPatch_module *>::iterator mods_iter;
for (mods_iter = mods->begin(); mods_iter != mods->end(); mods_iter++) {
std::vector<BPatch_function *> *funcs = (*mods_iter)->getProcedures(false);
std::vector<BPatch_function *>::iterator funcs_iter = funcs->begin();
for(; funcs_iter != funcs->end(); funcs_iter++) {
co->parse((Address)(*funcs_iter)->getBaseAddr(), true);
BPatch_flowGraph *fg = (*funcs_iter)->getCFG();
std::set<BPatch_basicBlock*> blocks;
fg->getAllBasicBlocks(blocks);
std::set<BPatch_basicBlock*>::iterator block_iter;
for (block_iter = blocks.begin(); block_iter != blocks.end(); ++block_iter) {
BPatch_basicBlock *block = (*block_iter);
std::vector<Instruction::Ptr> insns;
block->getInstructions(insns);
std::vector<Instruction::Ptr>::iterator insn_iter;
for (insn_iter = insns.begin(); insn_iter != insns.end(); ++insn_iter) {
Instruction::Ptr ins = *insn_iter;
std::vector<Operand> ops;
ins->getOperands(ops);
std::vector<Operand>::iterator op_iter;
for (op_iter = ops.begin(); op_iter != ops.end(); ++op_iter) {
Expression::Ptr expr = (*op_iter).getValue();
struct OperandAnalyzer : public Dyninst::InstructionAPI::Visitor {
virtual void visit(BinaryFunction* op) {};
virtual void visit(Dereference* op) {}
virtual void visit(Immediate* op) {
address_t addr;
ArmsFunction *func;
switch(op->eval().type) {
case s32:
addr = op->eval().val.s32val;
break;
case u32:
addr = op->eval().val.u32val;
break;
case s64:
addr = op->eval().val.s64val;
break;
case u64:
addr = op->eval().val.u64val;
break;
default:
return;
}
func = cfg_->find_function(addr);
if(func) {
printf("Instruction [%s] references function 0x%jx\n", ins_->format().c_str(), addr);
func->set_addr_taken();
}
}
virtual void visit(RegisterAST* op) {}
OperandAnalyzer(DICFG *cfg, Instruction::Ptr ins) {
cfg_ = cfg;
ins_ = ins;
};
DICFG *cfg_;
Instruction::Ptr ins_;
};
OperandAnalyzer oa(cfg, ins);
expr->apply(&oa);
}
}
}
}
}
}
