static PyObject *Triton_getRegs(PyObject *self, PyObject *noargs)
{
PyObject *regs = xPyDict_New();
/* Build all Registers */
for (uint64 regId = ID_RAX; regId < ID_RFLAGS; regId++){
PyObject *reg = xPyDict_New();
if (regId >= ID_XMM0 && regId <= ID_XMM15)
PyDict_SetItemString(reg, "concreteValue", uint128ToPyLongObject(ap.getSSERegisterValue(regId)));
else
PyDict_SetItemString(reg, "concreteValue", Py_BuildValue("k", ap.getRegisterValue(regId)));
PyDict_SetItemString(reg, "symbolicExpr", Py_BuildValue("k", ap.getRegSymbolicID(regId)));
PyDict_SetItem(regs, Py_BuildValue("k", regId), reg);
}
/* Build all Flags */
for (uint64 flagId = ID_AF; flagId <= ID_ZF; flagId++){
PyObject *flag = xPyDict_New();
PyDict_SetItemString(flag, "concreteValue", Py_BuildValue("k", ap.getFlagValue(flagId)));
PyDict_SetItemString(flag, "symbolicExpr", Py_BuildValue("k", ap.getRegSymbolicID(flagId)));
PyDict_SetItem(regs, Py_BuildValue("k", flagId), flag);
}
return regs;
}
void RolIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
uint64 reg1 = this->operands[0].getValue();
uint32 regSize1 = this->operands[0].getSize();
/* Create the SMT semantic */
op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 = smt2lib::decimal(ap.getRegisterValue(ID_RCX) & 0xff); /* 0xff -> There is only CL available */
// Final expr
expr = smt2lib::bvrol(op2, op1);
/* Create the symbolic expression */
se = ap.createRegSE(inst, expr, reg1, regSize1);
/* Apply the taint */
ap.aluSpreadTaintRegReg(se, reg1, reg1);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfRol(inst, se, ap, op2);
EflagsBuilder::ofRol(inst, se, ap, regSize1, op2);
}
void RorIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicElement *se;
std::stringstream expr, op1, op2;
uint64 reg1 = this->operands[0].getValue();
uint32 regSize1 = this->operands[0].getSize();
/* Create the SMT semantic */
op1 << ap.buildSymbolicRegOperand(reg1, regSize1);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 << (ap.getRegisterValue(ID_RCX) & 0xff); /* 0xff -> There is only CL available */
// Final expr
expr << smt2lib::bvror(op1.str(), op2.str());
/* Create the symbolic element */
se = ap.createRegSE(inst, expr, reg1, regSize1);
/* Apply the taint */
ap.aluSpreadTaintRegReg(se, reg1, reg1);
/* Add the symbolic flags element to the current inst */
EflagsBuilder::cfRor(inst, se, ap, regSize1, op2);
EflagsBuilder::ofRor(inst, se, ap, regSize1, op2);
}
void RorIRBuilder::memReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se;
smt2lib::smtAstAbstractNode *expr, *op1, *op2;
auto memSize = this->operands[0].getMem().getSize();
auto mem = this->operands[0].getMem();
/* Create the SMT semantic */
op1 = ap.buildSymbolicMemOperand(mem, memSize);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 = smt2lib::decimal(ap.getRegisterValue(ID_TMP_RCX) & 0xff); /* 0xff -> There is only CL available */
// Final expr
expr = smt2lib::bvror(op2, op1);
/* Create the symbolic expression */
se = ap.createMemSE(inst, expr, mem, memSize);
/* Apply the taint */
ap.aluSpreadTaintMemMem(se, mem, mem, memSize);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfRor(inst, se, ap, memSize, op2);
EflagsBuilder::ofRor(inst, se, ap, memSize, op2);
}
static PyObject *Triton_getRegValue(PyObject *self, PyObject *reg)
{
uint64 tritonReg;
if (!PyLong_Check(reg) && !PyInt_Check(reg))
return PyErr_Format(PyExc_TypeError, "getRegValue(): expected a register id (IDREF.REG) as argument");
if (!ap.getCurrentCtxH())
return PyErr_Format(PyExc_TypeError, "getRegValue(): Can't call getRegValue() right now. You must run the program before.");
tritonReg = PyLong_AsLong(reg);
if (tritonReg >= ID_XMM0 && tritonReg <= ID_XMM15){
uint128 value = ap.getSSERegisterValue(tritonReg);
return uint128ToPyLongObject(value);
}
return Py_BuildValue("k", ap.getRegisterValue(tritonReg));
}
void RcrIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
SymbolicExpression *se1, *se2;
smt2lib::smtAstAbstractNode *expr, *op1, *op2, *cf, *res;
uint64 reg1 = this->operands[0].getValue();
uint32 regSize1 = this->operands[0].getSize();
/* Create the SMT semantic */
cf = ap.buildSymbolicFlagOperand(ID_CF);
op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
/*
* Note that SMT2-LIB doesn't support expression as rotate's value.
* The op2 must be the concretization's value.
*/
op2 = smt2lib::decimal(ap.getRegisterValue(ID_RCX) & 0xff); /* 0xff -> There is only CL available */
/* Rcl expression */
expr = smt2lib::bvror(
op2,
smt2lib::concat(cf, op1)
);
/* Temporary extended expression */
se1 = ap.createSE(inst, expr, "Temporary Extended Expression");
/* Apply the taint */
ap.assignmentSpreadTaintExprReg(se1, reg1);
/* Result expression */
res = smt2lib::extract((regSize1 * REG_SIZE) - 1, 0, expr);
/* Create the symbolic expression */
se2 = ap.createRegSE(inst, res, reg1, regSize1);
/* Apply the taint */
ap.aluSpreadTaintRegReg(se2, reg1, reg1);
/* Add the symbolic flags expression to the current inst */
EflagsBuilder::cfRcl(inst, se1, ap, regSize1, op2); /* Same as RCL */
EflagsBuilder::ofRor(inst, se2, ap, regSize1, op2); /* Same as ROR */
}
