/** Add edges to graph from functions that call system calls to system calls. * * The first 1000 vertexes (0 to 999) in the graph is reserved for system calls, which is many more than the actual system * calls in linux. */ void add_syscall_edges(DirectedGraph* G, std::vector<SgAsmFunction*>& all_functions) { // Detect all system calls and add an edge from the function to the function to the system call for (unsigned int caller_id = 0; caller_id < all_functions.size(); ++caller_id) { SgAsmFunction *func = all_functions[caller_id]; std::vector<SgAsmInstruction*> insns = SageInterface::querySubTree<SgAsmInstruction>(func); for (std::vector<SgAsmInstruction*>::iterator inst_it = insns.begin(); inst_it != insns.end(); ++inst_it) { SgAsmX86Instruction *insn = isSgAsmX86Instruction(*inst_it); if (insn == NULL) continue; SgAsmBlock *block = SageInterface::getEnclosingNode<SgAsmBlock>(insn); // On linux system calls are always interrups and all interrupts are system calls if (insn && block && insn->get_kind()==x86_int) { const SgAsmExpressionPtrList &opand_list = insn->get_operandList()->get_operands(); SgAsmExpression *expr = opand_list.size()==1 ? opand_list[0] : NULL; //semantically execute the basic block to find out which sytem call was called if (expr && expr->variantT()==V_SgAsmIntegerValueExpression && 0x80==isSgAsmIntegerValueExpression(expr)->get_value()) { const SgAsmStatementPtrList &stmts = block->get_statementList(); size_t int_n; for (int_n=0; int_n<stmts.size(); int_n++) { if (isSgAsmInstruction(stmts[int_n])==insn) break; } typedef PartialSymbolicSemantics::Policy<PartialSymbolicSemantics::State, PartialSymbolicSemantics::ValueType> Policy; typedef X86InstructionSemantics<Policy, PartialSymbolicSemantics::ValueType> Semantics; Policy policy; Semantics semantics(policy); try { semantics.processBlock(stmts, 0, int_n); if (policy.readRegister<32>("eax").is_known()) { int nr = policy.readRegister<32>("eax").known_value(); boost::add_edge(caller_id, nr, *G); } } catch (const Semantics::Exception&) { } catch (const Policy::Exception&) { } } } } } }
/* Helper function for unparseArmExpression(SgAsmExpression*) * * If this function is called for an EXPR node that cannot appear at the top of an ARM instruction operand tree then the node * might create two strings: the primary expression return value and an additional string returned through the SUFFIX * argument. What to do with the additional string depends on layers higher up in the call stack. * * The sign will be prepended to the result if EXPR is a value expression of some sort. */ static std::string unparseArmExpression(SgAsmExpression* expr, const AsmUnparser::LabelMap *labels, ArmSignForExpressionUnparsing sign, std::string *suffix=NULL) { std::string result, extra; if (!isSgAsmValueExpression(expr)) { result += unparseArmSign(sign); } switch (expr->variantT()) { case V_SgAsmBinaryMultiply: ROSE_ASSERT (isSgAsmByteValueExpression(isSgAsmBinaryExpression(expr)->get_rhs())); result = unparseArmExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, arm_sign_none) + "*" + StringUtility::numberToString(isSgAsmByteValueExpression(isSgAsmBinaryExpression(expr)->get_rhs())); break; case V_SgAsmBinaryLsl: result = unparseArmExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, arm_sign_none) + ", lsl " + unparseArmExpression(isSgAsmBinaryExpression(expr)->get_rhs(), labels, arm_sign_none); break; case V_SgAsmBinaryLsr: result = unparseArmExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, arm_sign_none) + ", lsr " + unparseArmExpression(isSgAsmBinaryExpression(expr)->get_rhs(), labels, arm_sign_none); break; case V_SgAsmBinaryAsr: result = unparseArmExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, arm_sign_none) + ", asr " + unparseArmExpression(isSgAsmBinaryExpression(expr)->get_rhs(), labels, arm_sign_none); break; case V_SgAsmBinaryRor: result = unparseArmExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, arm_sign_none) + ", ror " + unparseArmExpression(isSgAsmBinaryExpression(expr)->get_rhs(), labels, arm_sign_none); break; case V_SgAsmUnaryRrx: result = unparseArmExpression(isSgAsmUnaryExpression(expr)->get_operand(), labels, arm_sign_none) + ", rrx"; break; case V_SgAsmUnaryArmSpecialRegisterList: result += unparseArmExpression(isSgAsmUnaryExpression(expr)->get_operand(), labels, arm_sign_none) + "^"; break; case V_SgAsmExprListExp: { SgAsmExprListExp* el = isSgAsmExprListExp(expr); const std::vector<SgAsmExpression*>& exprs = el->get_expressions(); result += "{"; for (size_t i = 0; i < exprs.size(); ++i) { if (i != 0) result += ", "; result += unparseArmExpression(exprs[i], labels, arm_sign_none); } result += "}"; break; } case V_SgAsmBinaryAdd: { /* This node cannot appear at the top of an ARM instruction operand tree */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_plus); break; } case V_SgAsmBinarySubtract: { /* This node cannot appear at the top of an ARM instruction operand tree */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_minus); break; } case V_SgAsmBinaryAddPreupdate: { /* This node cannot appear at the top of an ARM instruction operand tree */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_plus); extra = "!"; break; } case V_SgAsmBinarySubtractPreupdate: { /* This node cannot appear at the top of an ARM instruction operand tree */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_minus); extra = "!"; break; } case V_SgAsmBinaryAddPostupdate: { /* Two styles of syntax depending on whether this is at top-level or inside a memory reference expression. */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); if (suffix) { result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none); extra = ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_plus); } else { /* Used by LDM* and STM* instructions outside memory reference expressions. RHS is unused. */ result = unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + "!"; } break; } case V_SgAsmBinarySubtractPostupdate: { /* Two styles of syntax depending on whether this is at top-level or inside a memory reference expression. */ SgAsmBinaryExpression *e = isSgAsmBinaryExpression(expr); if (suffix) { result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none); extra = ", " + unparseArmExpression(e->get_rhs(), labels, arm_sign_minus); } else { /* Used by LDM* and STM* instructions outside memory reference expressions. RHS is unused. */ result += unparseArmExpression(e->get_lhs(), labels, arm_sign_none) + "!"; } break; } case V_SgAsmMemoryReferenceExpression: { SgAsmMemoryReferenceExpression* mr = isSgAsmMemoryReferenceExpression(expr); SgAsmExpression* addr = mr->get_address(); switch (addr->variantT()) { case V_SgAsmRegisterReferenceExpression: case V_SgAsmBinaryAdd: case V_SgAsmBinarySubtract: case V_SgAsmBinaryAddPreupdate: case V_SgAsmBinarySubtractPreupdate: case V_SgAsmBinaryAddPostupdate: case V_SgAsmBinarySubtractPostupdate: break; default: ROSE_ASSERT (!"Bad addressing mode"); } std::string suffix; result += "[" + unparseArmExpression(addr, labels, arm_sign_none, &suffix) + "]"; result += suffix; break; } case V_SgAsmArmRegisterReferenceExpression: result += unparseArmRegister(isSgAsmArmRegisterReferenceExpression(expr)); break; case V_SgAsmByteValueExpression: case V_SgAsmWordValueExpression: case V_SgAsmDoubleWordValueExpression: { SgAsmValueExpression *ve = isSgAsmValueExpression(expr); assert(ve!=NULL); uint64_t v = SageInterface::getAsmConstant(ve); result += "#" + unparseArmSign(sign) + StringUtility::numberToString(v); if (labels && v!=0) { AsmUnparser::LabelMap::const_iterator li=labels->find(v); if (li!=labels->end()) result += "<" + li->second + ">"; } break; } default: { std::cerr << "Unhandled expression kind " << expr->class_name() << std::endl; ROSE_ASSERT (false); } } /* The extra data should be passed back up the call stack so it can be inserted into the ultimate return string. We can't * insert it here because the string can't be generated strictly left-to-right. If "suffix" is the null pointer then the * caller isn't expecting a suffix and we'll have to just do our best -- the result will not be valid ARM assembly. */ if (extra.size()>0 && !suffix) result = "\"" + result + "\" and \"" + extra + "\""; if (suffix) *suffix = extra; if (expr->get_replacement() != "") { result += " <" + expr->get_replacement() + ">"; } return result; }
/* Helper for unparsePowerpcExpression(SgAsmExpression*) */ static std::string unparsePowerpcExpression(SgAsmExpression* expr, const AsmUnparser::LabelMap *labels, const RegisterDictionary *registers, bool useHex) { std::string result = ""; if (expr == NULL) return "BOGUS:NULL"; switch (expr->variantT()) { case V_SgAsmBinaryAdd: result = unparsePowerpcExpression(isSgAsmBinaryExpression(expr)->get_lhs(), labels, registers, false) + " + " + unparsePowerpcExpression(isSgAsmBinaryExpression(expr)->get_rhs(), labels, registers, false); break; case V_SgAsmMemoryReferenceExpression: { SgAsmMemoryReferenceExpression* mr = isSgAsmMemoryReferenceExpression(expr); SgAsmExpression* addr = mr->get_address(); switch (addr->variantT()) { case V_SgAsmBinaryAdd: { SgAsmBinaryAdd* a = isSgAsmBinaryAdd(addr); std::string lhs = unparsePowerpcExpression(a->get_lhs(), labels, registers, false); if (isSgAsmValueExpression(a->get_rhs())) { // Sign-extend from 16 bits SgAsmValueExpression *ve = isSgAsmValueExpression(a->get_rhs()); ASSERT_not_null(ve); result = boost::lexical_cast<std::string>( (int64_t)IntegerOps::signExtend<16, 64>(SageInterface::getAsmConstant(ve))); result += "(" + lhs + ")"; } else { result = lhs + ", " + unparsePowerpcExpression(a->get_rhs(), labels, registers, false); } break; } default: result = "(" + unparsePowerpcExpression(addr, labels, registers, false) + ")"; break; } break; } case V_SgAsmDirectRegisterExpression: { SgAsmInstruction *insn = SageInterface::getEnclosingNode<SgAsmInstruction>(expr); SgAsmDirectRegisterExpression* rr = isSgAsmDirectRegisterExpression(expr); result = unparsePowerpcRegister(insn, rr->get_descriptor(), registers); break; } case V_SgAsmIntegerValueExpression: { uint64_t v = isSgAsmIntegerValueExpression(expr)->get_absoluteValue(); if (useHex) { result = StringUtility::intToHex(v); } else { result = StringUtility::numberToString(v); } if (expr->get_comment().empty() && labels) { AsmUnparser::LabelMap::const_iterator li = labels->find(v); if (li!=labels->end()) result = StringUtility::appendAsmComment(result, li->second); } break; } default: { ASSERT_not_reachable("invalid PowerPC expression: " + expr->class_name()); } } result = StringUtility::appendAsmComment(result, expr->get_replacement()); result = StringUtility::appendAsmComment(result, expr->get_comment()); return result; }