public void Find_Matching_Frames_Complex()
{
var frameAccess = new FrameAccess();
var builder = new ContextFactoryBuilder();
builder.WithFrame(new FrameEntity
{
PosHi = 0,
PosLo = 0,
ThreadId = 1,
Rax = ((ulong)1).ToHexString()
}).WithFrame(new FrameEntity
{
PosHi = 0,
PosLo = 0,
ThreadId = 2,
Rax = ((ulong)2).ToHexString()
}).WithFrame(new FrameEntity
{
PosHi = 1,
PosLo = 0,
ThreadId = 2,
Rax = ((ulong)2).ToHexString()
}).WithFrame(new FrameEntity
{
PosHi = 1,
PosLo = 1,
ThreadId = 2,
Rax = ((ulong)1).ToHexString(),
Rbx = ((ulong)2).ToHexString()
});
frameAccess.ContextFactory = builder.Build();
var rax = new RegisterEqualsCriterion(Register.Rax, ((ulong)1).ToHexString());
var rbx = new RegisterEqualsCriterion(Register.Rbx, ((ulong)2).ToHexString());
var and = new AndCriterion(new[] { rax, rbx });
var or = new OrCriterion(new[] { rax, rbx });
var not = new NotCriterion(rax);
var all = new OrCriterion(new ICriterion[] { not, rax });
var none = new AndCriterion(new ICriterion[] { not, rax });
var andAll = new AndCriterion(new ICriterion[] { and, all });
var andResults = frameAccess.Search("", and);
var orResults = frameAccess.Search("", or);
var notResults = frameAccess.Search("", not);
var allResults = frameAccess.Search("", all);
var noneResults = frameAccess.Search("", none);
var andAllResults = frameAccess.Search("", andAll);
andResults.Single().RegisterSet.Rax.Should().Be(1);
andResults.Single().RegisterSet.Rbx.Should().Be(2);
orResults.Should().HaveCount(2);
notResults.Should().HaveCount(2);
allResults.Should().HaveCount(4);
noneResults.Should().HaveCount(0);
andAllResults.Should().HaveCount(1);
}
public void Create_The_Correct_Expression_Tree_For_And()
{
var visitor = new FrameCriterionVisitor();
var criteria1 = new RegisterEqualsCriterion(Register.Rax, ((ulong)0).ToHexString());
var criteria2 = new RegisterEqualsCriterion(Register.Rbx, ((ulong)1).ToHexString());
var and = new AndCriterion(new[] { criteria1, criteria2 });
var f = visitor.Visit(and);
var frame = new FrameEntity
{
Rax = ((ulong)0).ToHexString(),
Rbx = ((ulong)1).ToHexString()
};
var frame2 = new FrameEntity
{
Rax = ((ulong)1).ToHexString(),
Rbx = ((ulong)1).ToHexString()
};
var method = ((FramePredicateExpression)f).Compile();
new[] { frame, frame2 }.Single(x => method(x)).Should().Be(frame);
}
public void Create_The_Correct_Expression_Tree_For_Or()
{
var visitor = new FrameCriterionVisitor();
var criteria1 = new RegisterEqualsCriterion(Register.Rax, ((ulong)0).ToHexString());
var criteria2 = new RegisterEqualsCriterion(Register.Rbx, ((ulong)1).ToHexString());
var and = new OrCriterion(new[] { criteria1, criteria2 });
var f = visitor.Visit(and);
var builder = new ContextFactoryBuilder();
var frame = new FrameEntity
{
Rax = ((ulong)0).ToHexString(),
Rbx = ((ulong)1).ToHexString()
};
var frame2 = new FrameEntity
{
Rax = ((ulong)1).ToHexString(),
Rbx = ((ulong)1).ToHexString()
};
builder.WithFrame(frame).WithFrame(frame2);
var method = ((FramePredicateExpression)f).Compile();
new[] { frame, frame2 }.Where(x => method(x)).SequenceEqual(new[] { frame, frame2 }).Should().BeTrue();
}
/// <summary>
/// Visits the specified register equals criterion.
/// </summary>
/// <param name="registerEqualsCriterion">The register equals criterion.</param>
/// <returns>FramePredicateExpression.</returns>
/// <exception cref="IndexOutOfRangeException">Unknown register</exception>
public object Visit(RegisterEqualsCriterion registerEqualsCriterion)
{
var bytes = registerEqualsCriterion.HexString;
if (registerEqualsCriterion.Register == Register.Rax)
{
FramePredicateExpression exp = entity =>
entity.Rax == null && bytes == null || entity.Rax != null && entity.Rax == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rcx)
{
FramePredicateExpression exp = entity =>
entity.Rcx == null && bytes == null || entity.Rcx != null && entity.Rcx == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rdx)
{
FramePredicateExpression exp = entity =>
entity.Rdx == null && bytes == null || entity.Rdx != null && entity.Rdx == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rbx)
{
FramePredicateExpression exp = entity =>
entity.Rbx == null && bytes == null || entity.Rbx != null && entity.Rbx == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rsp)
{
FramePredicateExpression exp = entity =>
entity.Rsp == null && bytes == null || entity.Rsp != null && entity.Rsp == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rbp)
{
FramePredicateExpression exp = entity =>
entity.Rbp == null && bytes == null || entity.Rbp != null && entity.Rbp == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rsi)
{
FramePredicateExpression exp = entity =>
entity.Rsi == null && bytes == null || entity.Rsi != null && entity.Rsi == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rdi)
{
FramePredicateExpression exp = entity =>
entity.Rdi == null && bytes == null || entity.Rdi != null && entity.Rdi == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R8)
{
FramePredicateExpression exp = entity =>
entity.R8 == null && bytes == null || entity.R8 != null && entity.R8 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R9)
{
FramePredicateExpression exp = entity =>
entity.R9 == null && bytes == null || entity.R9 != null && entity.R9 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R10)
{
FramePredicateExpression exp = entity =>
entity.R10 == null && bytes == null || entity.R10 != null && entity.R10 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R11)
{
FramePredicateExpression exp = entity =>
entity.R11 == null && bytes == null || entity.R11 != null && entity.R11 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R12)
{
FramePredicateExpression exp = entity =>
entity.R12 == null && bytes == null || entity.R12 != null && entity.R12 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R13)
{
FramePredicateExpression exp = entity =>
entity.R13 == null && bytes == null || entity.R13 != null && entity.R13 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R14)
{
FramePredicateExpression exp = entity =>
entity.R14 == null && bytes == null || entity.R14 != null && entity.R14 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.R15)
{
FramePredicateExpression exp = entity =>
entity.R15 == null && bytes == null || entity.R15 != null && entity.R15 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Rip)
{
FramePredicateExpression exp = entity =>
entity.Rip == null && bytes == null || entity.Rip != null && entity.Rip == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Efl)
{
FramePredicateExpression exp = entity =>
entity.Efl == null && bytes == null || entity.Efl != null && entity.Efl == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Cs)
{
FramePredicateExpression exp = entity =>
entity.Cs == null && bytes == null || entity.Cs != null && entity.Cs == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ds)
{
FramePredicateExpression exp = entity =>
entity.Ds == null && bytes == null || entity.Ds != null && entity.Ds == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Es)
{
FramePredicateExpression exp = entity =>
entity.Es == null && bytes == null || entity.Es != null && entity.Es == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fs)
{
FramePredicateExpression exp = entity =>
entity.Fs == null && bytes == null || entity.Fs != null && entity.Fs == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Gs)
{
FramePredicateExpression exp = entity =>
entity.Gs == null && bytes == null || entity.Gs != null && entity.Gs == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ss)
{
FramePredicateExpression exp = entity =>
entity.Ss == null && bytes == null || entity.Ss != null && entity.Ss == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr0)
{
FramePredicateExpression exp = entity =>
entity.Dr0 == null && bytes == null || entity.Dr0 != null && entity.Dr0 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr1)
{
FramePredicateExpression exp = entity =>
entity.Dr1 == null && bytes == null || entity.Dr1 != null && entity.Dr1 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr2)
{
FramePredicateExpression exp = entity =>
entity.Dr2 == null && bytes == null || entity.Dr2 != null && entity.Dr2 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr3)
{
FramePredicateExpression exp = entity =>
entity.Dr3 == null && bytes == null || entity.Dr3 != null && entity.Dr3 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr6)
{
FramePredicateExpression exp = entity =>
entity.Dr6 == null && bytes == null || entity.Dr6 != null && entity.Dr6 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Dr7)
{
FramePredicateExpression exp = entity =>
entity.Dr7 == null && bytes == null || entity.Dr7 != null && entity.Dr7 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpcw)
{
FramePredicateExpression exp = entity =>
entity.Fpcw == null && bytes == null || entity.Fpcw != null && entity.Fpcw == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpsw)
{
FramePredicateExpression exp = entity =>
entity.Fpsw == null && bytes == null || entity.Fpsw != null && entity.Fpsw == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fptw)
{
FramePredicateExpression exp = entity =>
entity.Fptw == null && bytes == null || entity.Fptw != null && entity.Fptw == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St0)
{
FramePredicateExpression exp = entity =>
entity.St0 == null && bytes == null || entity.St0 != null && entity.St0 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St1)
{
FramePredicateExpression exp = entity =>
entity.St1 == null && bytes == null || entity.St1 != null && entity.St1 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St2)
{
FramePredicateExpression exp = entity =>
entity.St2 == null && bytes == null || entity.St2 != null && entity.St2 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St3)
{
FramePredicateExpression exp = entity =>
entity.St3 == null && bytes == null || entity.St3 != null && entity.St3 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St4)
{
FramePredicateExpression exp = entity =>
entity.St4 == null && bytes == null || entity.St4 != null && entity.St4 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St5)
{
FramePredicateExpression exp = entity =>
entity.St5 == null && bytes == null || entity.St5 != null && entity.St5 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St6)
{
FramePredicateExpression exp = entity =>
entity.St6 == null && bytes == null || entity.St6 != null && entity.St6 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.St7)
{
FramePredicateExpression exp = entity =>
entity.St7 == null && bytes == null || entity.St7 != null && entity.St7 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm0)
{
FramePredicateExpression exp = entity =>
entity.Mm0 == null && bytes == null || entity.Mm0 != null && entity.Mm0 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm1)
{
FramePredicateExpression exp = entity =>
entity.Mm1 == null && bytes == null || entity.Mm1 != null && entity.Mm1 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm2)
{
FramePredicateExpression exp = entity =>
entity.Mm2 == null && bytes == null || entity.Mm2 != null && entity.Mm2 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm3)
{
FramePredicateExpression exp = entity =>
entity.Mm3 == null && bytes == null || entity.Mm3 != null && entity.Mm3 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm4)
{
FramePredicateExpression exp = entity =>
entity.Mm4 == null && bytes == null || entity.Mm4 != null && entity.Mm4 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm5)
{
FramePredicateExpression exp = entity =>
entity.Mm5 == null && bytes == null || entity.Mm5 != null && entity.Mm5 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm6)
{
FramePredicateExpression exp = entity =>
entity.Mm6 == null && bytes == null || entity.Mm6 != null && entity.Mm6 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mm7)
{
FramePredicateExpression exp = entity =>
entity.Mm7 == null && bytes == null || entity.Mm7 != null && entity.Mm7 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Mxcsr)
{
FramePredicateExpression exp = entity =>
entity.Mxcsr == null && bytes == null || entity.Mxcsr != null && entity.Mxcsr == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm0)
{
FramePredicateExpression exp = entity =>
entity.Ymm0 == null && bytes == null || entity.Ymm0 != null && entity.Ymm0 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm1)
{
FramePredicateExpression exp = entity =>
entity.Ymm1 == null && bytes == null || entity.Ymm1 != null && entity.Ymm1 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm2)
{
FramePredicateExpression exp = entity =>
entity.Ymm2 == null && bytes == null || entity.Ymm2 != null && entity.Ymm2 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm3)
{
FramePredicateExpression exp = entity =>
entity.Ymm3 == null && bytes == null || entity.Ymm3 != null && entity.Ymm3 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm4)
{
FramePredicateExpression exp = entity =>
entity.Ymm4 == null && bytes == null || entity.Ymm4 != null && entity.Ymm4 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm5)
{
FramePredicateExpression exp = entity =>
entity.Ymm5 == null && bytes == null || entity.Ymm5 != null && entity.Ymm5 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm6)
{
FramePredicateExpression exp = entity =>
entity.Ymm6 == null && bytes == null || entity.Ymm6 != null && entity.Ymm6 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm7)
{
FramePredicateExpression exp = entity =>
entity.Ymm7 == null && bytes == null || entity.Ymm7 != null && entity.Ymm7 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm8)
{
FramePredicateExpression exp = entity =>
entity.Ymm8 == null && bytes == null || entity.Ymm8 != null && entity.Ymm8 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm9)
{
FramePredicateExpression exp = entity =>
entity.Ymm9 == null && bytes == null || entity.Ymm9 != null && entity.Ymm9 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm10)
{
FramePredicateExpression exp = entity =>
entity.Ymm10 == null && bytes == null || entity.Ymm10 != null && entity.Ymm10 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm11)
{
FramePredicateExpression exp = entity =>
entity.Ymm11 == null && bytes == null || entity.Ymm11 != null && entity.Ymm11 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm12)
{
FramePredicateExpression exp = entity =>
entity.Ymm12 == null && bytes == null || entity.Ymm12 != null && entity.Ymm12 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm13)
{
FramePredicateExpression exp = entity =>
entity.Ymm13 == null && bytes == null || entity.Ymm13 != null && entity.Ymm13 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm14)
{
FramePredicateExpression exp = entity =>
entity.Ymm14 == null && bytes == null || entity.Ymm14 != null && entity.Ymm14 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Ymm15)
{
FramePredicateExpression exp = entity =>
entity.Ymm15 == null && bytes == null || entity.Ymm15 != null && entity.Ymm15 == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Exfrom)
{
FramePredicateExpression exp = entity =>
entity.Exfrom == null && bytes == null || entity.Exfrom != null && entity.Exfrom == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Exto)
{
FramePredicateExpression exp = entity =>
entity.Exto == null && bytes == null || entity.Exto != null && entity.Exto == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Brfrom)
{
FramePredicateExpression exp = entity =>
entity.Brfrom == null && bytes == null || entity.Brfrom != null && entity.Brfrom == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Brto)
{
FramePredicateExpression exp = entity =>
entity.Brto == null && bytes == null || entity.Brto != null && entity.Brto == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fopcode)
{
FramePredicateExpression exp = entity =>
entity.Fopcode == null && bytes == null || entity.Fopcode != null && entity.Fopcode == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpip)
{
FramePredicateExpression exp = entity =>
entity.Fpip == null && bytes == null || entity.Fpip != null && entity.Fpip == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpipsel)
{
FramePredicateExpression exp = entity =>
entity.Fpipsel == null && bytes == null || entity.Fpipsel != null && entity.Fpipsel == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpdp)
{
FramePredicateExpression exp = entity =>
entity.Fpdp == null && bytes == null || entity.Fpdp != null && entity.Fpdp == bytes;
return(exp);
}
if (registerEqualsCriterion.Register == Register.Fpdpsel)
{
FramePredicateExpression exp = entity =>
entity.Fpdpsel == null && bytes == null || entity.Fpdpsel != null && entity.Fpdpsel == bytes;
return(exp);
}
throw new ArgumentOutOfRangeException(nameof(registerEqualsCriterion), $"Register provided was ${registerEqualsCriterion.Register.Name}, but that is not allowed");
}