Ejemplo n.º 1
0
        public void SrtSimpleLoop()
        {
            Procedure proc = BuildSimpleLoop();

            var dom = proc.CreateBlockDominatorGraph();
            SsaTransform ssa = new SsaTransform(new ProgramDataFlow(), proc, dom);
            proc.Write(false, Console.Out);
            LinearInductionVariableFinder lif = new LinearInductionVariableFinder(proc, ssa.SsaState.Identifiers, dom);
            lif.Find();

            Assert.AreEqual(1, lif.InductionVariables.Count, "Should have found one induction variable");
            Assert.AreEqual(1, lif.Contexts.Count);
            LinearInductionVariableContext ctx = lif.Contexts[lif.InductionVariables[0]];

            StrengthReduction str = new StrengthReduction(ssa.SsaState,lif.InductionVariables[0], ctx);
            str.ClassifyUses();
            Assert.AreEqual(1, str.IncrementedUses.Count);
            str.ModifyUses();
            Assert.AreEqual("(0x00003000 0x00000004 0x00007000)", lif.InductionVariables[0].ToString());
            using (FileUnitTester fut = new FileUnitTester("Analysis/SrtSimpleLoop.txt"))
            {
                proc.Write(false, fut.TextWriter);
                fut.AssertFilesEqual();
            }
        }
Ejemplo n.º 2
0
 public void Create1()
 {
     Prepare(new WhileLtIncMock().Procedure);
     var doms = proc.CreateBlockDominatorGraph();
     LinearInductionVariableFinder liv = new LinearInductionVariableFinder(proc, ssaIds, doms);
     Assert.IsNull(liv.Context.PhiIdentifier);
     Assert.IsNull(liv.Context.PhiStatement);
     Assert.Fail(); /*
     liv.Context.PhiStatement = ssaIds[5].DefStatement;
     liv.Context.PhiIdentifier = (Identifier) ((PhiAssignment) liv.Context.PhiStatement.Instruction).Dst;
     liv.Context.TestStatement = proc.ControlGraph.Blocks[2].Statements[1];
     liv.Context.DeltaStatement = ssaIds[8].DefStatement;
     liv.Context.InitialValue = Constant.Word32(0);
     liv.Context.DeltaValue = Constant.Word32(1);
     liv.Context.TestValue = Constant.Word32(10);
     LinearInductionVariable iv = liv.CreateInductionVariable();
     Assert.AreEqual("X", iv.ToString()); */
 }
        public void Create1()
        {
            Prepare(new WhileLtIncMock().Procedure);
            var doms = proc.CreateBlockDominatorGraph();
            LinearInductionVariableFinder liv = new LinearInductionVariableFinder(proc, ssaIds, doms);

            Assert.IsNull(liv.Context.PhiIdentifier);
            Assert.IsNull(liv.Context.PhiStatement);
            Assert.Fail(); /*
                            * liv.Context.PhiStatement = ssaIds[5].DefStatement;
                            * liv.Context.PhiIdentifier = (Identifier) ((PhiAssignment) liv.Context.PhiStatement.Instruction).Dst;
                            * liv.Context.TestStatement = proc.ControlGraph.Blocks[2].Statements[1];
                            * liv.Context.DeltaStatement = ssaIds[8].DefStatement;
                            * liv.Context.InitialValue = Constant.Word32(0);
                            * liv.Context.DeltaValue = Constant.Word32(1);
                            * liv.Context.TestValue = Constant.Word32(10);
                            * LinearInductionVariable iv = liv.CreateInductionVariable();
                            * Assert.AreEqual("X", iv.ToString()); */
        }
Ejemplo n.º 4
0
        public void Liv_CreateDecTest()
        {
            Prepare(m =>
            {
                Identifier id = m.Local32("id");
                m.Assign(id, Constant.Word32(10));
                m.Label("loop");
                m.Assign(id, m.ISub(id, 1));
                m.BranchIf(m.Ge(id, 0), "loop");
                m.MStore(m.Word32(0x4232), id);
                m.Return(id);
            });
            var liv = new LinearInductionVariableFinder(proc, ssaIds, doms);

            liv.Find();
            var iv = liv.InductionVariables[0];

            Assert.AreEqual("(0x00000009 -1 0xFFFFFFFF signed)", iv.ToString());
        }
Ejemplo n.º 5
0
        public void Liv_PreTestedUge()
        {
            Prepare(m =>
            {
                Identifier i = m.Local32("i");
                m.Label("test");
                m.BranchIf(m.Uge(i, 10), "done");
                m.MStore(m.Word32(0x4204), i);
                m.Assign(i, m.IAdd(i, 1));
                m.Goto("test");
                m.Label("done");
                m.MStore(m.Word32(0x4200), i);
                m.Return();
            });
            var liv = new LinearInductionVariableFinder(proc, ssaIds, doms);

            liv.Find();
            Assert.AreEqual("(? 0x00000001 0x0000000A)", liv.InductionVariables[0].ToString());
        }
Ejemplo n.º 6
0
        public void Liv_CreateBareMinimum()
        {
            ssaIds = new SsaIdentifierCollection();
            Identifier id0 = new Identifier("foo", PrimitiveType.Word32, new TemporaryStorage("foo", 1, PrimitiveType.Word32));
            Identifier id1 = new Identifier("bar", PrimitiveType.Word32, new TemporaryStorage("bar", 1, PrimitiveType.Word32));
            Identifier phi = new Identifier("i_3", PrimitiveType.Word32, null);

            ssaIds.Add(id0, new SsaIdentifier(id0, id0, null, null, false));
            ssaIds.Add(id1, new SsaIdentifier(id1, id1, null, null, false));
            ssaIds.Add(phi, new SsaIdentifier(phi, phi, null, null, false));
            LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, ssaIds, null);

            liv.Context.PhiStatement  = new Statement(0, null, null);
            liv.Context.PhiIdentifier = phi;
            liv.Context.DeltaValue    = Constant.Word32(1);
            LinearInductionVariable iv = liv.CreateInductionVariable();

            Assert.AreEqual("(? 0x00000001 ?)", iv.ToString());
        }
Ejemplo n.º 7
0
        public void Liv_CreateIncInitialValue()
        {
            var pb = new ProcedureBuilder();

            ssa = new SsaState(pb.Procedure);
            LinearInductionVariableFinder liv = new LinearInductionVariableFinder(ssa, null);

            liv.Context.InitialValue  = Constant.Word32(0);
            liv.Context.PhiStatement  = new Statement(0, null, null);
            liv.Context.PhiIdentifier = new Identifier("foo_0", PrimitiveType.Word32, null);
            ssa.Identifiers.Add(liv.Context.PhiIdentifier, new SsaIdentifier(liv.Context.PhiIdentifier, liv.Context.PhiIdentifier, liv.Context.PhiStatement, null, false));
            liv.Context.DeltaValue     = Constant.Word32(1);
            liv.Context.DeltaStatement = new Statement(0, new Assignment(new Identifier("foo_1", PrimitiveType.Word32, null),
                                                                         new BinaryExpression(Operator.IAdd, PrimitiveType.Word32, liv.Context.PhiIdentifier, liv.Context.DeltaValue)), null);
            ssa.Identifiers[liv.Context.PhiIdentifier].Uses.Add(liv.Context.DeltaStatement);

            LinearInductionVariable iv = liv.CreateInductionVariable();

            Assert.AreEqual("(1<32> 1<32> ?)", iv.ToString());
        }
Ejemplo n.º 8
0
        public void Liv_CreateBareMinimum()
        {
            var pb = new ProcedureBuilder();

            ssa = new SsaState(pb.Procedure);
            Identifier id0 = new Identifier("foo", PrimitiveType.Word32, new TemporaryStorage("foo", 1, PrimitiveType.Word32));
            Identifier id1 = new Identifier("bar", PrimitiveType.Word32, new TemporaryStorage("bar", 1, PrimitiveType.Word32));
            Identifier phi = new Identifier("i_3", PrimitiveType.Word32, null);

            ssa.Identifiers.Add(id0, new SsaIdentifier(id0, id0, null, null, false));
            ssa.Identifiers.Add(id1, new SsaIdentifier(id1, id1, null, null, false));
            ssa.Identifiers.Add(phi, new SsaIdentifier(phi, phi, null, null, false));
            var liv = new LinearInductionVariableFinder(ssa, null);

            liv.Context.PhiStatement  = new Statement(0, null, null);
            liv.Context.PhiIdentifier = phi;
            liv.Context.DeltaValue    = Constant.Word32(1);
            LinearInductionVariable iv = liv.CreateInductionVariable();

            Assert.AreEqual("(? 1<32> ?)", iv.ToString());
        }
Ejemplo n.º 9
0
        public void CreateNoincInitialValue()
        {
            ProcedureBuilder m = new ProcedureBuilder();

            ssa = new SsaState(m.Procedure);
            SsaId(new Identifier("id0", PrimitiveType.Word32, new TemporaryStorage("id0", 0, PrimitiveType.Word32)), null, null, false);
            SsaId(new Identifier("id1", PrimitiveType.Word32, new TemporaryStorage("id1", 1, PrimitiveType.Word32)), null, null, false);
            LinearInductionVariableFinder liv = new LinearInductionVariableFinder(ssa, null);

            liv.Context.InitialValue = Constant.Word32(0);
            Identifier id2 = m.Local32("id_2");

            SsaId(id2, new Statement(0, null, null), null, false);
            Assert.AreEqual(3, ssa.Identifiers.Count);

            Identifier id3 = m.Local32("id_3");
            Identifier id4 = m.Local32("id_4");

            liv.Context.PhiStatement  = m.Phi(id3, (id2, "block2"), (id4, "block4"));
            liv.Context.PhiIdentifier = id3;
            SsaId(id3, liv.Context.PhiStatement, ((PhiAssignment)liv.Context.PhiStatement.Instruction).Src, false);
            Assert.AreEqual(4, ssa.Identifiers.Count);

            Statement use = new Statement(0, null, null);

            ssa.Identifiers[id3].Uses.Add(use);

            liv.Context.DeltaValue = m.Word32(1);
            m.Assign(id4, m.IAdd(id3, liv.Context.DeltaValue));
            liv.Context.DeltaStatement = m.Block.Statements.Last;
            ssa.Identifiers[id3].Uses.Add(liv.Context.DeltaStatement);

            LinearInductionVariable iv = liv.CreateInductionVariable();

            Assert.AreEqual("(0<32> 1<32> ?)", iv.ToString());
        }
		public void Liv_CreateIncInitialValue()
		{
			ssaIds = new SsaIdentifierCollection();
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, ssaIds, null);
			liv.Context.InitialValue = Constant.Word32(0);
			liv.Context.PhiStatement = new Statement(0, null, null);
			liv.Context.PhiIdentifier = new Identifier("foo_0", PrimitiveType.Word32, null);
            ssaIds.Add(liv.Context.PhiIdentifier, new SsaIdentifier(liv.Context.PhiIdentifier, liv.Context.PhiIdentifier, liv.Context.PhiStatement, null, false));
			liv.Context.DeltaValue = Constant.Word32(1);
			liv.Context.DeltaStatement = new Statement(0, new Assignment(new Identifier("foo_1", PrimitiveType.Word32, null), 
				new BinaryExpression(Operator.IAdd, PrimitiveType.Word32, liv.Context.PhiIdentifier, liv.Context.DeltaValue)), null);
			ssaIds[liv.Context.PhiIdentifier].Uses.Add(liv.Context.DeltaStatement);

			LinearInductionVariable iv = liv.CreateInductionVariable();
			Assert.AreEqual("(0x00000001 0x00000001 ?)", iv.ToString());
		}
		public void Liv_FindLinearIncrement()
		{
            List<SsaIdentifier> a = BuildScc();
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, null, dom);
			Constant c = liv.FindLinearIncrement(a);
			Assert.AreEqual(4, c.ToInt32());
            Assert.AreEqual("a_2 = a_1 + 0x00000004", liv.Context.DeltaStatement.ToString());
		}
		public void Liv_FindPhi()
		{
			List<SsaIdentifier> a = BuildScc();
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, null, dom);
			PhiFunction p = liv.FindPhiFunction(a);
			Assert.IsNotNull(p, "Didn't find phi function!");
		}
		public void Liv_FindInitialValue()
		{
			List<SsaIdentifier> a = BuildScc();
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, ssaIds, dom);
			PhiFunction phi = liv.FindPhiFunction(a);
			Constant c = liv.FindInitialValue(phi);
            Assert.AreEqual(0, c.ToInt32());
            Assert.AreEqual("a_0 = 0x00000000", liv.Context.InitialStatement.ToString());
		}
Ejemplo n.º 14
0
        public void Liv_CreateNo()
        {
            var liv = new LinearInductionVariableFinder(null, null);

            Assert.IsNull(liv.CreateInductionVariable());
        }
		private void RunTest(Procedure proc, string outputFile)
		{
			Prepare(proc);
			var liv = new LinearInductionVariableFinder(proc, ssaIds, doms);
			liv.Find();
			using (FileUnitTester fut = new FileUnitTester(outputFile))
			{
				proc.Write(false, fut.TextWriter);
				fut.TextWriter.WriteLine();
				foreach (LinearInductionVariable iv in liv.InductionVariables)
				{
					fut.TextWriter.WriteLine(iv);
				}
				fut.AssertFilesEqual();
			}
		}
		public void Liv_FindFinalValue()
		{
			Prepare(new ByteArrayLoopMock().Procedure);
			var liv = new LinearInductionVariableFinder(proc, ssaIds, null);
			var a = new List<SsaIdentifier>();
			a.Add(ssaIds.Where(s => s.Identifier.Name == "i_1").Single());
			a.Add(ssaIds.Where(s => s.Identifier.Name == "i_4").Single());
			Constant c = liv.FindFinalValue(a);
			Assert.AreEqual(10, c.ToInt32());
            Assert.AreEqual("branch i_1 < 0x0000000A body", liv.Context.TestStatement.ToString());
		}
		public void Liv_CreateDecTest()
		{
            Prepare(delegate(ProcedureBuilder m)
            {
                Identifier id = m.Local32("id");
                m.Assign(id, Constant.Word32(10));
                m.Label("loop");
                m.Assign(id, m.ISub(id, 1));
                m.BranchIf(m.Ge(id, 0), "loop");
                m.Store(m.Word32(0x4232), id);
                m.Return(id);
            });
            proc.Dump(true);
            var liv = new LinearInductionVariableFinder(proc, ssaIds, doms);
            liv.Find();
			var iv = liv.InductionVariables[0];
			Assert.AreEqual("(0x00000009 -1 0xFFFFFFFF signed)", iv.ToString());
		}
 public void Liv_PreTestedUge()
 {
     Prepare(delegate(ProcedureBuilder m)
     {
         Identifier i = m.Local32("i");
         m.Label("test");
         m.BranchIf(m.Uge(i, 10), "done");
         m.Store(m.Word32(0x4204), i);
         m.Assign(i, m.IAdd(i, 1));
         m.Goto("test");
         m.Label("done");
         m.Store(m.Word32(0x4200), i);
         m.Return();
     });
     var liv = new LinearInductionVariableFinder(proc, ssaIds, doms);
     liv.Find();
     Assert.AreEqual("(? 0x00000001 0x0000000A)", liv.InductionVariables[0].ToString());
 }
		public void Liv_CreateNo()
		{
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, null, null);
			Assert.IsNull(liv.CreateInductionVariable());
		}
Ejemplo n.º 20
0
        private void UntangleProcedureScc(IList<Procedure> procs)
        {
            if (procs.Count == 1)
            {
                var proc = procs[0];
                Aliases alias = new Aliases(proc, program.Architecture, flow);
                alias.Transform();

                // Transform the procedure to SSA state. When encountering 'call' instructions,
                // they can be to functions already visited. If so, they have a "ProcedureFlow"
                // associated with them. If they have not been visited, or are computed destinations
                // (e.g. vtables) they will have no "ProcedureFlow" associated with them yet, in
                // which case the the SSA treats the call as a "hell node".
                var doms = proc.CreateBlockDominatorGraph();
                var sst = new SsaTransform(flow, proc, doms);
                var ssa = sst.SsaState;

                // Propagate condition codes and registers. At the end, the hope is that
                // all statements like (x86) mem[esp_42+4] will have been converted to
                // mem[fp - 30]. We also hope that procedure constants kept in registers
                // are propagated to the corresponding call sites.
                var cce = new ConditionCodeEliminator(ssa.Identifiers, program.Platform);
                cce.Transform();
                var vp = new ValuePropagator(program.Architecture, ssa.Identifiers, proc);
                vp.Transform();

                // Now compute SSA for the stack-based variables as well. That is:
                // mem[fp - 30] becomes wLoc30, while
                // mem[fp + 30] becomes wArg30.
                // This allows us to compute the dataflow of this procedure.
                sst.RenameFrameAccesses = true;
                sst.AddUseInstructions = true;
                sst.Transform();

                // Propagate those newly discovered identifiers.
                vp.Transform();

                // At this point, the computation of _actual_ ProcedureFlow should be possible.
                var tid = new TrashedRegisterFinder2(program.Architecture, flow, proc, ssa.Identifiers, this.eventListener);
                tid.Compute();
                DeadCode.Eliminate(proc, ssa);

                // Build expressions. A definition with a single use can be subsumed
                // into the using expression.

                var coa = new Coalescer(proc, ssa);
                coa.Transform();
                DeadCode.Eliminate(proc, ssa);

                var liv = new LinearInductionVariableFinder(
                    proc,
                    ssa.Identifiers,
                    new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock));
                liv.Find();

                foreach (var de in liv.Contexts)
                {
                    var str = new StrengthReduction(ssa, de.Key, de.Value);
                    str.ClassifyUses();
                    str.ModifyUses();
                }

                //var opt = new OutParameterTransformer(proc, ssa.Identifiers);
                //opt.Transform();
                DeadCode.Eliminate(proc, ssa);

                // Definitions with multiple uses and variables joined by PHI functions become webs.
                var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables);
                web.Transform();
                ssa.ConvertBack(false);
            }
            else
            {
                throw new NotImplementedException();
            }
        }
		public void Liv_CreateBareMinimum()
		{
			ssaIds = new SsaIdentifierCollection();
            Identifier id0 = new Identifier("foo", PrimitiveType.Word32, new TemporaryStorage("foo", 1, PrimitiveType.Word32));
            Identifier id1 = new Identifier("bar", PrimitiveType.Word32, new TemporaryStorage("bar", 1, PrimitiveType.Word32));
            Identifier phi = new Identifier("i_3", PrimitiveType.Word32, null);
			ssaIds.Add(id0, new SsaIdentifier(id0, id0, null, null, false));
			ssaIds.Add(id1, new SsaIdentifier(id1, id1, null, null, false));
            ssaIds.Add(phi, new SsaIdentifier(phi, phi, null, null, false));
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, ssaIds, null);
			liv.Context.PhiStatement = new Statement(0, null, null);
            liv.Context.PhiIdentifier = phi;
			liv.Context.DeltaValue = Constant.Word32(1);
			LinearInductionVariable iv = liv.CreateInductionVariable();
			Assert.AreEqual("(? 0x00000001 ?)", iv.ToString());
		}
Ejemplo n.º 22
0
        /// <summary>
        /// Processes procedures individually, building complex expression trees out
        /// of the simple, close-to-the-machine code generated by the disassembly.
        /// </summary>
        /// <param name="rl"></param>
        public void BuildExpressionTrees()
        {
            int i = 0;
            foreach (Procedure proc in program.Procedures.Values)
            {
                eventListener.ShowProgress("Building complex expressions.", i, program.Procedures.Values.Count);
                ++i;

                try
                {
                    var larw = new LongAddRewriter(proc, program.Architecture);
                    larw.Transform();

                    Aliases alias = new Aliases(proc, program.Architecture, flow);
                    alias.Transform();

                    var doms = new DominatorGraph<Block>(proc.ControlGraph, proc.EntryBlock);
                    var sst = new SsaTransform(flow, proc, doms);
                    var ssa = sst.SsaState;

                    var cce = new ConditionCodeEliminator(ssa.Identifiers, program.Platform);
                    cce.Transform();
                    DeadCode.Eliminate(proc, ssa);

                    var vp = new ValuePropagator(program.Architecture, ssa.Identifiers, proc);
                    vp.Transform();
                    DeadCode.Eliminate(proc, ssa);

                    // Build expressions. A definition with a single use can be subsumed
                    // into the using expression.

                    var coa = new Coalescer(proc, ssa);
                    coa.Transform();
                    DeadCode.Eliminate(proc, ssa);

                    var liv = new LinearInductionVariableFinder(
                        proc,
                        ssa.Identifiers,
                        new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock));
                    liv.Find();

                    foreach (KeyValuePair<LinearInductionVariable, LinearInductionVariableContext> de in liv.Contexts)
                    {
                        var str = new StrengthReduction(ssa, de.Key, de.Value);
                        str.ClassifyUses();
                        str.ModifyUses();
                    }
                    var opt = new OutParameterTransformer(proc, ssa.Identifiers);
                    opt.Transform();
                    DeadCode.Eliminate(proc, ssa);

                    // Definitions with multiple uses and variables joined by PHI functions become webs.
                    var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables);
                    web.Transform();
                    ssa.ConvertBack(false);
                }
                catch (Exception ex)
                {
                    eventListener.Error(new NullCodeLocation(proc.Name), ex, "An error occurred during data flow analysis.");
                }
            }
        }
		public void CreateNoincInitialValue()
		{
			ProcedureBuilder m = new ProcedureBuilder();
			ssaIds = new SsaIdentifierCollection();
			SsaId(new Identifier("id0", PrimitiveType.Word32, new TemporaryStorage("id0", 0, PrimitiveType.Word32)), null, null, false);
			SsaId(new Identifier("id1", PrimitiveType.Word32, new TemporaryStorage("id1", 1, PrimitiveType.Word32)), null, null, false);
			LinearInductionVariableFinder liv = new LinearInductionVariableFinder(null, ssaIds, null);

			liv.Context.InitialValue = Constant.Word32(0);
			Identifier id2 = m.Local32("id_2");
			SsaId(id2, new Statement(0, null, null), null, false);
			Assert.AreEqual(3, ssaIds.Count);

			Identifier id3 = m.Local32("id_3");
			Identifier id4 = m.Local32("id_4");
			liv.Context.PhiStatement = m.Phi(id3, id2, id4);
			liv.Context.PhiIdentifier = id3;
			SsaId(id3, liv.Context.PhiStatement, ((PhiAssignment)liv.Context.PhiStatement.Instruction).Src, false);
			Assert.AreEqual(4, ssaIds.Count);

			Statement use = new Statement(0, null, null);
			ssaIds[id3].Uses.Add(use);

			liv.Context.DeltaValue = m.Int32(1);
            m.Assign(id4, m.IAdd(id3, liv.Context.DeltaValue));
            liv.Context.DeltaStatement = m.Block.Statements.Last;
			ssaIds[id3].Uses.Add(liv.Context.DeltaStatement);

			LinearInductionVariable iv = liv.CreateInductionVariable();
			Assert.AreEqual("(0x00000000 0x00000001 ?)", iv.ToString());

		}