/* Add a path constraint */
void PathManager::addPathConstraint(const triton::arch::Instruction& inst, triton::engines::symbolic::SymbolicExpression* expr) {
triton::engines::symbolic::PathConstraint pco;
triton::ast::AbstractNode* pc = nullptr;
triton::uint64 srcAddr = 0;
triton::uint64 dstAddr = 0;
triton::uint32 size = 0;
pc = expr->getAst();
if (pc == nullptr)
throw triton::exceptions::PathManager("PathManager::addPathConstraint(): The PC node cannot be null.");
/* If PC_TRACKING_SYMBOLIC is enabled, Triton will track path constraints only if they are symbolized. */
if (triton::api.isSymbolicOptimizationEnabled(triton::engines::symbolic::PC_TRACKING_SYMBOLIC) && !pc->isSymbolized())
return;
/* If ONLY_ON_TAINTED is enabled and the expression untainted, Triton will skip the storing process. */
if (triton::api.isSymbolicOptimizationEnabled(triton::engines::symbolic::ONLY_ON_TAINTED) && !expr->isTainted)
return;
/* Basic block taken */
srcAddr = inst.getAddress();
dstAddr = pc->evaluate().convert_to<triton::uint64>();
size = pc->getBitvectorSize();
if (size == 0)
throw triton::exceptions::PathManager("PathManager::addPathConstraint(): The PC node size cannot be zero.");
if (pc->getKind() == triton::ast::ZX_NODE)
pc = pc->getChilds()[1];
/* Multiple branches */
if (pc->getKind() == triton::ast::ITE_NODE) {
triton::uint64 bb1 = pc->getChilds()[1]->evaluate().convert_to<triton::uint64>();
triton::uint64 bb2 = pc->getChilds()[2]->evaluate().convert_to<triton::uint64>();
triton::ast::AbstractNode* bb1pc = (bb1 == dstAddr) ? triton::ast::equal(pc, triton::ast::bv(dstAddr, size)) :
triton::ast::lnot(triton::ast::equal(pc, triton::ast::bv(dstAddr, size)));
triton::ast::AbstractNode* bb2pc = (bb2 == dstAddr) ? triton::ast::equal(pc, triton::ast::bv(dstAddr, size)) :
triton::ast::lnot(triton::ast::equal(pc, triton::ast::bv(dstAddr, size)));
pco.addBranchConstraint(bb1 == dstAddr, srcAddr, bb1, bb1pc);
pco.addBranchConstraint(bb2 == dstAddr, srcAddr, bb2, bb2pc);
this->pathConstraints.push_back(pco);
}
/* Direct branch */
else {
pco.addBranchConstraint(true, srcAddr, dstAddr, triton::ast::equal(pc, triton::ast::bv(dstAddr, size)));
this->pathConstraints.push_back(pco);
}
}
void x86Cpu::disassembly(triton::arch::Instruction &inst) {
csh handle;
cs_insn* insn;
size_t count;
/* Check if the opcodes and opcodes' size are defined */
if (inst.getOpcodes() == nullptr || inst.getOpcodesSize() == 0)
throw std::runtime_error("x86Cpu::disassembly(): Opcodes and opcodesSize must be definied.");
/* Open capstone */
if (cs_open(CS_ARCH_X86, CS_MODE_32, &handle) != CS_ERR_OK)
throw std::runtime_error("x86Cpu::disassembly(): Cannot open capstone.");
/* Init capstone's options */
cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
cs_option(handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_INTEL);
/* Let's disass and build our operands */
count = cs_disasm(handle, inst.getOpcodes(), inst.getOpcodesSize(), inst.getAddress(), 0, &insn);
if (count > 0) {
cs_detail* detail = insn->detail;
for (triton::uint32 j = 0; j < count; j++) {
/* Init the disassembly */
std::stringstream str;
str << insn[j].mnemonic << " " << insn[j].op_str;
inst.setDisassembly(str.str());
/* Init the instruction's type */
inst.setType(capstoneInstToTritonInst(insn[j].id));
/* Init operands */
for (triton::uint32 n = 0; n < detail->x86.op_count; n++) {
cs_x86_op *op = &(detail->x86.operands[n]);
switch(op->type) {
case X86_OP_IMM:
inst.operands.push_back(triton::arch::OperandWrapper(triton::arch::ImmediateOperand(op->imm, op->size)));
break;
case X86_OP_MEM: {
triton::arch::MemoryOperand mem = inst.popMemoryAccess();
/* Set the size if the memory is not valid */
if (!mem.isValid())
mem.setPair(std::make_pair(((op->size * BYTE_SIZE_BIT) - 1), 0));
/* LEA if exists */
triton::arch::RegisterOperand base(triton::arch::x86::capstoneRegToTritonReg(op->mem.base));
triton::arch::RegisterOperand index(triton::arch::x86::capstoneRegToTritonReg(op->mem.index));
triton::arch::ImmediateOperand disp(op->mem.disp, op->size);
triton::arch::ImmediateOperand scale(op->mem.scale, op->size);
mem.setBaseReg(base);
mem.setIndexReg(index);
mem.setDisplacement(disp);
mem.setScale(scale);
inst.operands.push_back(triton::arch::OperandWrapper(mem));
break;
}
case X86_OP_REG:
inst.operands.push_back(triton::arch::OperandWrapper(inst.getRegisterState(triton::arch::x86::capstoneRegToTritonReg(op->reg))));
break;
default:
break;
}
}
}
/* Set branch */
if (detail->groups_count > 0) {
for (triton::uint32 n = 0; n < detail->groups_count; n++) {
if (detail->groups[n] == X86_GRP_JUMP)
inst.setBranch(true);
if (detail->groups[n] == X86_GRP_JUMP || detail->groups[n] == X86_GRP_CALL || detail->groups[n] == X86_GRP_RET)
inst.setControlFlow(true);
}
}
cs_free(insn, count);
}
else
throw std::runtime_error("x86Cpu::disassembly(): Failed to disassemble the given code.");
cs_close(&handle);
return;
}