void RolIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, writeSize);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 = smt2lib::decimal(imm);
/* Final expr */
expr = smt2lib::bvrol(op2, op1);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, writeSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfRol(inst, se, ap, op2);
EflagsBuilder::ofRol(inst, se, ap, writeSize, op2);
}
void XaddIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se1, *se2;
smt2lib::smtAstAbstractNode *expr1, *expr2, *op1, *op2;
uint64 mem1 = this->operands[0].getValue();
uint64 reg2 = this->operands[1].getValue();
uint32 memSize1 = this->operands[0].getSize();
uint32 regSize2 = this->operands[1].getSize();
uint64 tmpMem1Taint = ap.isMemTainted(mem1);
uint64 tmpReg2Taint = ap.isRegTainted(reg2);
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem1, memSize1);
op2 = ap.buildSymbolicRegOperand(reg2, regSize2);
// Final expr
expr1 = op2;
expr2 = smt2lib::bvadd(op1, op2);
/* Create the symbolic expression */
se1 = ap.createMemSE(inst, expr1, mem1, memSize1);
se2 = ap.createRegSE(inst, expr2, reg2, regSize2);
/* Apply the taint */
ap.setTaintMem(se1, mem1, tmpReg2Taint);
ap.setTaintReg(se2, reg2, tmpMem1Taint);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::af(inst, se2, ap, memSize1, op1, op2);
EflagsBuilder::cfAdd(inst, se2, ap, memSize1, op1);
EflagsBuilder::ofAdd(inst, se2, ap, memSize1, op1, op2);
EflagsBuilder::pf(inst, se2, ap, memSize1);
EflagsBuilder::sf(inst, se2, ap, memSize1);
EflagsBuilder::zf(inst, se2, ap, memSize1);
}
void RolIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 = smt2lib::decimal(ap.getRegisterValue(ID_TMP_RCX) & 0xff); /* 0xff -> There is only CL available */
// Final expr
expr = smt2lib::bvrol(op2, op1);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfRol(inst, se, ap, op2);
EflagsBuilder::ofRol(inst, se, ap, memSize, op2);
}
void RorIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, writeSize);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 << imm;
/* Final expr */
expr << smt2lib::bvror(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, writeSize);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::cfRor(inst, se, ap, writeSize, op2);
EflagsBuilder::ofRor(inst, se, ap, writeSize, op2);
}
void ShrIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint32_t writeSize = this->operands[0].getSize();
uint64_t mem = this->operands[0].getValue();
uint64_t imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, writeSize);
op2 << smt2lib::bv(imm, writeSize * REG_SIZE);
/* Final expr */
expr << smt2lib::bvlshr(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::cfShr(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::ofShr(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::pfShl(inst, se, ap, writeSize, op2) /* Same that shl */;
EflagsBuilder::sfShl(inst, se, ap, writeSize, op2) /* Same that shl */;
EflagsBuilder::zfShl(inst, se, ap, writeSize, op2) /* Same that shl */;
}
void AddIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 reg = this->operands[1].getValue();
uint32 regSize = this->operands[1].getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, writeSize);
op2 = ap.buildSymbolicRegOperand(reg, regSize);
// Final expr
expr = smt2lib::bvadd(op1, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemReg(se, mem, reg, writeSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::af(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::cfAdd(inst, se, ap, op1);
EflagsBuilder::ofAdd(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::pf(inst, se, ap, writeSize);
EflagsBuilder::sf(inst, se, ap, writeSize);
EflagsBuilder::zf(inst, se, ap, writeSize);
}
void XaddIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se1, *se2;
std::stringstream expr1, expr2, op1, op2;
uint64_t mem1 = this->operands[0].getValue();
uint64_t reg2 = this->operands[1].getValue();
uint32_t memSize1 = this->operands[0].getSize();
uint32_t regSize2 = this->operands[1].getSize();
uint64_t tmpMem1Taint = ap.isMemTainted(mem1);
uint64_t tmpReg2Taint = ap.isRegTainted(reg2);
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem1, memSize1);
op2 << ap.buildSymbolicRegOperand(reg2, regSize2);
// Final expr
expr1 << op2.str();
expr2 << smt2lib::bvadd(op1.str(), op2.str());
/* Create the symbolic element */
se1 = ap.createMemSE(inst, expr1, mem1, memSize1);
se2 = ap.createRegSE(inst, expr2, reg2, regSize2);
/* Apply the taint */
ap.setTaintMem(se1, mem1, tmpReg2Taint);
ap.setTaintReg(se2, reg2, tmpMem1Taint);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::af(inst, se2, ap, memSize1, op1, op2);
EflagsBuilder::cfAdd(inst, se2, ap, op1);
EflagsBuilder::ofAdd(inst, se2, ap, memSize1, op1, op2);
EflagsBuilder::pf(inst, se2, ap);
EflagsBuilder::sf(inst, se2, ap, memSize1);
EflagsBuilder::zf(inst, se2, ap, memSize1);
}
void OrIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
auto mem = this->operands[0].getMem();
auto memSize = this->operands[0].getMem().getSize();
auto reg = this->operands[1].getReg();
auto regSize = this->operands[1].getReg().getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
op2 = ap.buildSymbolicRegOperand(reg, regSize);
/* Final expr */
expr = smt2lib::bvor(op1, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemReg(se, mem, reg, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::clearFlag(inst, ap, ID_TMP_CF, "Clears carry flag");
EflagsBuilder::clearFlag(inst, ap, ID_TMP_OF, "Clears overflow flag");
EflagsBuilder::pf(inst, se, ap, memSize);
EflagsBuilder::sf(inst, se, ap, memSize);
EflagsBuilder::zf(inst, se, ap, memSize);
}
void SbbIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2, *op3;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem().getAddress();
auto reg = this->operands[1].getReg().getTritonRegId();
auto regSize = this->operands[1].getReg().getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
op2 = ap.buildSymbolicRegOperand(reg, regSize);
op3 = ap.buildSymbolicFlagOperand(ID_CF, regSize);
/* Final expr */
expr = smt2lib::bvsub(op1, smt2lib::bvadd(op2, op3));
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemReg(se, mem, reg, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::af(inst, se, ap, memSize, op1, op2);
EflagsBuilder::cfSub(inst, se, ap, memSize, op1, op2);
EflagsBuilder::ofSub(inst, se, ap, memSize, op1, op2);
EflagsBuilder::pf(inst, se, ap, memSize);
EflagsBuilder::sf(inst, se, ap, memSize);
EflagsBuilder::zf(inst, se, ap, memSize);
}
void AndIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint32_t writeSize = this->operands[0].getSize();
uint64_t mem = this->operands[0].getValue();
uint64_t imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, writeSize);
op2 << smt2lib::bv(imm, writeSize * REG_SIZE);
/* Final expr */
expr << smt2lib::bvand(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemImm(se, mem, writeSize);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::clearFlag(inst, ap, ID_CF, "Clears carry flag");
EflagsBuilder::clearFlag(inst, ap, ID_OF, "Clears overflow flag");
EflagsBuilder::pf(inst, se, ap);
EflagsBuilder::sf(inst, se, ap, writeSize);
EflagsBuilder::zf(inst, se, ap, writeSize);
}
void XorIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, writeSize);
op2 = smt2lib::bv(imm, writeSize * REG_SIZE);
/* Final expr */
expr = smt2lib::bvxor(op1, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemImm(se, mem, writeSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::clearFlag(inst, ap, ID_CF, "Clears carry flag");
EflagsBuilder::clearFlag(inst, ap, ID_OF, "Clears overflow flag");
EflagsBuilder::pf(inst, se, ap, writeSize);
EflagsBuilder::sf(inst, se, ap, writeSize);
EflagsBuilder::zf(inst, se, ap, writeSize);
}
void SetleIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *sf, *of, *zf;
uint64 mem = this->operands[0].getValue();
uint64 memSize = this->operands[0].getSize();
/* Create the flag SMT semantic */
sf = ap.buildSymbolicFlagOperand(ID_SF);
of = ap.buildSymbolicFlagOperand(ID_OF);
zf = ap.buildSymbolicFlagOperand(ID_ZF);
/* Finale expr */
expr = smt2lib::ite(
smt2lib::equal(
smt2lib::bvor(smt2lib::bvxor(sf, of), zf),
smt2lib::bvtrue()),
smt2lib::bv(1, BYTE_SIZE_BIT),
smt2lib::bv(0, BYTE_SIZE_BIT));
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint via the concretization */
if (((ap.getFlagValue(ID_SF) ^ ap.getFlagValue(ID_OF)) | ap.getFlagValue(ID_ZF)) == 1) {
if (ap.isRegTainted(ID_SF) == TAINTED)
ap.assignmentSpreadTaintMemReg(se, mem, ID_SF, memSize);
else if (ap.isRegTainted(ID_OF) == TAINTED)
ap.assignmentSpreadTaintMemReg(se, mem, ID_OF, memSize);
else
ap.assignmentSpreadTaintMemReg(se, mem, ID_ZF, memSize);
}
}
void SbbIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2, op3;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 imm = this->operands[1].getValue();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, writeSize);
op2 << smt2lib::bv(imm, writeSize * REG_SIZE);
op3 << ap.buildSymbolicFlagOperand(ID_CF, writeSize);
/* Final expr */
expr << smt2lib::bvsub(op1.str(), smt2lib::bvadd(op2.str(), op3.str()));
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemImm(se, mem, writeSize);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::af(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::cfSub(inst, se, ap, op1, op2);
EflagsBuilder::ofSub(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::pf(inst, se, ap);
EflagsBuilder::sf(inst, se, ap, writeSize);
EflagsBuilder::zf(inst, se, ap, writeSize);
}
void SetzIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, mem1e, zf;
uint64_t mem = this->operands[0].getValue();
uint64_t memSize = this->operands[0].getSize();
/* Create the SMT semantic */
zf << ap.buildSymbolicFlagOperand(ID_ZF);
mem1e << ap.buildSymbolicMemOperand(mem, memSize);
/* Finale expr */
expr << smt2lib::ite(
smt2lib::equal(
zf.str(),
smt2lib::bvtrue()),
smt2lib::bv(1, 8),
smt2lib::bv(0, 8));
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint via the concretization */
if (ap.getFlagValue(ID_ZF) == 1)
ap.assignmentSpreadTaintMemReg(se, mem, ID_ZF, memSize);
}
void IncIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint64 mem = this->operands[0].getValue();
uint32 memSize = this->operands[0].getSize();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, memSize);
op2 << smt2lib::bv(1, memSize * REG_SIZE);
/* Finale expr */
expr << smt2lib::bvadd(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::af(inst, se, ap, memSize, op1, op2);
EflagsBuilder::ofAdd(inst, se, ap, memSize, op1, op2);
EflagsBuilder::pf(inst, se, ap);
EflagsBuilder::sf(inst, se, ap, memSize);
EflagsBuilder::zf(inst, se, ap, memSize);
}
void SetlIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, mem1e, sf, of;
uint64_t mem = this->operands[0].getValue();
uint64_t memSize = this->operands[0].getSize();
/* Create the flag SMT semantic */
sf << ap.buildSymbolicFlagOperand(ID_SF);
of << ap.buildSymbolicFlagOperand(ID_OF);
mem1e << ap.buildSymbolicMemOperand(mem, memSize);
/* Finale expr */
expr << smt2lib::ite(
smt2lib::equal(
smt2lib::bvxor(sf.str(), of.str()),
smt2lib::bvtrue()),
smt2lib::bv(1, BYTE_SIZE_BIT),
smt2lib::bv(0, BYTE_SIZE_BIT));
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint via the concretization */
if (ap.getFlagValue(ID_SF) ^ ap.getFlagValue(ID_OF)) {
if (ap.isRegTainted(ID_SF) == TAINTED)
ap.assignmentSpreadTaintMemReg(se, mem, ID_SF, memSize);
else
ap.assignmentSpreadTaintMemReg(se, mem, ID_OF, memSize);
}
}
void NegIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1;
auto mem = this->operands[0].getMem();
auto memSize = this->operands[0].getMem().getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
/* Finale expr */
expr = smt2lib::bvneg(op1);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::afNeg(inst, se, ap, memSize, op1);
EflagsBuilder::cfNeg(inst, se, ap, memSize, op1);
EflagsBuilder::ofNeg(inst, se, ap, memSize, op1);
EflagsBuilder::pf(inst, se, ap, memSize);
EflagsBuilder::sf(inst, se, ap, memSize);
EflagsBuilder::zf(inst, se, ap, memSize);
}
void ShlIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem();
auto imm = this->operands[1].getImm().getValue();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
op2 = smt2lib::bv(imm, memSize * REG_SIZE);
/* Final expr */
expr = smt2lib::bvshl(op1, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfShl(inst, se, ap, memSize, op1, op2);
EflagsBuilder::ofShl(inst, se, ap, memSize, op1, op2);
EflagsBuilder::pfShl(inst, se, ap, memSize, op2);
EflagsBuilder::sfShl(inst, se, ap, memSize, op2);
EflagsBuilder::zfShl(inst, se, ap, memSize, op2);
}
void SetnbeIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *cf, *zf;
auto mem = this->operands[0].getMem();
auto memSize = this->operands[0].getMem().getSize();
/* Create the SMT semantic */
cf = ap.buildSymbolicFlagOperand(ID_TMP_CF);
zf = ap.buildSymbolicFlagOperand(ID_TMP_ZF);
/* Finale expr */
expr = smt2lib::ite(
smt2lib::equal(
smt2lib::bvand(
smt2lib::bvnot(cf),
smt2lib::bvnot(zf)
),
smt2lib::bvtrue()),
smt2lib::bv(1, BYTE_SIZE_BIT),
smt2lib::bv(0, BYTE_SIZE_BIT));
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint via the concretization */
if (ap.getFlagValue(ID_TMP_CF) == 0 && ap.getFlagValue(ID_TMP_ZF) == 0) {
if (ap.isRegTainted(ID_TMP_CF) == TAINTED)
ap.assignmentSpreadTaintMemReg(se, mem, ID_TMP_CF, memSize);
else
ap.assignmentSpreadTaintMemReg(se, mem, ID_TMP_ZF, memSize);
}
}
void AddIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint32_t writeSize = this->operands[0].getSize();
uint64_t mem = this->operands[0].getValue();
uint64_t reg = this->operands[1].getValue();
uint32_t regSize = this->operands[1].getSize();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, writeSize);
op2 << ap.buildSymbolicRegOperand(reg, regSize);
// Final expr
expr << smt2lib::bvadd(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.aluSpreadTaintMemReg(se, mem, reg, writeSize);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::af(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::cfAdd(inst, se, ap, op1);
EflagsBuilder::ofAdd(inst, se, ap, writeSize, op1, op2);
EflagsBuilder::pf(inst, se, ap);
EflagsBuilder::sf(inst, se, ap, writeSize);
EflagsBuilder::zf(inst, se, ap, writeSize);
}
void SetsIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *sf;
auto mem = this->operands[0].getMem().getAddress();
auto memSize = this->operands[0].getMem().getSize();
/* Create the SMT semantic */
sf = ap.buildSymbolicFlagOperand(ID_SF);
/* Finale expr */
expr = smt2lib::ite(
smt2lib::equal(
sf,
smt2lib::bvtrue()),
smt2lib::bv(1, BYTE_SIZE_BIT),
smt2lib::bv(0, BYTE_SIZE_BIT));
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint via the concretization */
if (ap.getFlagValue(ID_SF) == 1)
ap.assignmentSpreadTaintMemReg(se, mem, ID_SF, memSize);
}
void CallIRBuilder::imm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr1, expr2;
uint64_t imm = this->operands[0].getValue();
uint64_t memDst = this->operands[1].getValue(); // The dst memory write
uint32_t writeSize = this->operands[1].getSize();
/* Create the SMT semantic side effect */
alignStack(inst, ap, writeSize);
/* Create the SMT semantic */
/* *RSP = Next_RIP */
expr1 << smt2lib::bv(this->nextAddress, writeSize * REG_SIZE);
/* Create the symbolic element */
se = ap.createMemSE(inst, expr1, memDst, writeSize, "Saved RIP");
/* Apply the taint */
ap.assignmentSpreadTaintMemImm(se, memDst, writeSize);
/* Create the SMT semantic */
/* RIP = imm */
expr2 << smt2lib::bv(imm, writeSize * REG_SIZE);
/* Create the symbolic element */
se = ap.createRegSE(inst, expr2, ID_RIP, REG_SIZE, "RIP");
/* Apply the taint */
ap.assignmentSpreadTaintRegImm(se, ID_RIP);
}
void MovIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr;
uint32_t writeSize = this->operands[0].getSize();
uint64_t mem = this->operands[0].getValue();
uint64_t imm = this->operands[1].getValue();
/* Create the SMT semantic */
expr << smt2lib::bv(imm, writeSize * REG_SIZE);
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemImm(se, mem, writeSize);
}
void MovIRBuilder::memImm(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem();
auto imm = this->operands[1].getImm().getValue();
/* Create the SMT semantic */
expr = smt2lib::bv(imm, memSize * REG_SIZE);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemImm(se, mem, memSize);
}
void MovIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr;
uint32_t writeSize = this->operands[0].getSize();
uint64_t mem = this->operands[0].getValue();
uint64_t reg = this->operands[1].getValue();
uint64_t regSize = this->operands[1].getSize();
/* Create the SMT semantic */
expr << ap.buildSymbolicRegOperand(reg, regSize);
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemReg(se, mem, reg, writeSize);
}
void MovdqaIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem();
auto reg = this->operands[1].getReg();
auto regSize = this->operands[1].getReg().getSize();
/* Create the SMT semantic */
expr = ap.buildSymbolicRegOperand(reg, regSize);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemReg(se, mem, reg, memSize);
}
void NotIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1;
auto mem = this->operands[0].getMem().getAddress();
auto memSize = this->operands[0].getMem().getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
/* Finale expr */
expr = smt2lib::bvnot(op1);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
}
void NotIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1;
uint64_t mem = this->operands[0].getValue();
uint32_t memSize = this->operands[0].getSize();
/* Create the SMT semantic */
op1 << ap.buildSymbolicMemOperand(mem, memSize);
/* Finale expr */
expr << smt2lib::bvnot(op1.str());
/* Create the symbolic element */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem);
}
void MovhpdIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op2;
uint32 writeSize = this->operands[0].getSize();
uint64 mem = this->operands[0].getValue();
uint64 reg = this->operands[1].getValue();
uint64 regSize = this->operands[1].getSize();
/* Create the SMT semantic */
op2 = ap.buildSymbolicRegOperand(reg, regSize);
expr = smt2lib::extract(127, 64, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, writeSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemReg(se, mem, reg, writeSize);
}
void MovlpdIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op2;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem().getAddress();
auto reg = this->operands[1].getReg().getTritonRegId();
auto regSize = this->operands[1].getReg().getSize();
/* Create the SMT semantic */
op2 = ap.buildSymbolicRegOperand(reg, regSize);
/* Destination = Source[0..63] */
expr = smt2lib::extract(63, 0, op2);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.assignmentSpreadTaintMemReg(se, mem, reg, memSize);
}
