public List<Address> Build(Address addrTable, Address addrFrom, ProcessorState state) { bw = new Backwalker(this, null, null); if (bw == null) return null; List<BackwalkOperation> operations = bw.BackWalk(null); if (operations == null) return PostError("Unable to determine limit", addrFrom, addrTable); return BuildAux(bw, addrFrom, state); }
public List<Address> BuildAux(Backwalker bw, Address addrFrom, ProcessorState state) { int limit = 0; int[] permutation = null; foreach (BackwalkOperation op in bw.Operations) { BackwalkError err = op as BackwalkError; if (err != null) { return PostError(err.ErrorMessage, addrFrom, bw.VectorAddress); } var deref = op as BackwalkDereference; if (deref != null) { permutation = BuildMapping(deref, limit); } limit = op.Apply(limit); } if (limit == 0) return PostError("Unable to determine limit", addrFrom, bw.VectorAddress); return BuildTable(bw.VectorAddress, limit, permutation, bw.Stride, state); }
private void RunTest(IntelArchitecture arch, RtlTransfer rtlTransfer, string outputFile) { using (var fut = new FileUnitTester(outputFile)) { m.Procedure.Write(false, fut.TextWriter); fut.TextWriter.Flush(); var ibw = new Backwalker(host, rtlTransfer, expSimp); var bwoList = ibw.BackWalk(m.CurrentBlock); Assert.IsNotNull(bwoList); foreach (BackwalkOperation bwo in bwoList) { fut.TextWriter.WriteLine(bwo); } fut.TextWriter.WriteLine("Index register: {0}", ibw.Index); fut.AssertFilesEqual(); } }
public void BwUnresolveableIndirect() { var eax = m.Frame.CreateTemporary("eax", PrimitiveType.Word32); var esi = m.Frame.CreateTemporary("esi", PrimitiveType.Word32); var Z = m.Frame.EnsureFlagGroup(1, "Z", PrimitiveType.Bool); var xfer = new RtlCall(eax, 4, RtlClass.Transfer); m.Assign(eax, m.LoadDw(esi)); m.Assign(Z, m.Cond(m.And(eax, eax))); m.BranchIf(m.Test(ConditionCode.EQ, Z), "null_ptr"); m.Label("do_call"); var bw = new Backwalker(host, xfer, expSimp); Assert.IsTrue(bw.CanBackwalk()); Assert.AreEqual("eax", bw.Index.Name); bw.BackWalk(m.Block); Assert.AreEqual("None", bw.Index.Name); }
public void BwTempRegister() { var v1 = m.Frame.CreateTemporary(PrimitiveType.Word32); var edi = m.Frame.CreateTemporary(PrimitiveType.Word32); var esi = m.Frame.EnsureRegister(Registers.esi); var xfer = new RtlCall(m.LoadDw(m.IAdd(esi, 40)), 4, RtlClass.Transfer); m.Assign(v1, m.LoadDw(edi)); m.Assign(esi, v1); var bw = new Backwalker(host, xfer, expSimp); bool result; result = bw.BackwalkInstruction(m.Block.Statements[1].Instruction); result = bw.BackwalkInstruction(m.Block.Statements[0].Instruction); Assert.IsTrue(result); Assert.AreEqual("None", bw.Index.ToString()); }
public void BwIndexInMemoryAddress() { // samples of switch statement emitted // by the Microsoft VC compiler var ebp = m.Frame.EnsureRegister(Registers.ebp); var eax = m.Frame.EnsureRegister(Registers.eax); var edx = m.Frame.EnsureRegister(Registers.edx); var dl = m.Frame.EnsureRegister(Registers.dl); var SCZO = m.Frame.EnsureFlagGroup((uint)(FlagM.SF | FlagM.CF | FlagM.ZF | FlagM.OF), "SCZO", PrimitiveType.Byte); // cmp [ebp-66],1D m.Assign(SCZO, m.Cond(m.ISub(m.LoadDw(m.ISub(ebp, 0xC4)), 0x1D))); var block0 = m.CurrentBlock; m.BranchIf(new TestCondition(ConditionCode.UGT, SCZO), "default"); // mov edx,[ebp-66] // movzx eax,byte ptr [edx + 0x10000] // jmp [eax + 0x12000] m.Assign(edx, m.LoadDw(m.ISub(ebp, 0xC4))); m.Assign(eax, m.Cast(PrimitiveType.Word32, m.LoadB(m.IAdd(edx, 0x10000)))); var block1 = m.CurrentBlock; var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd( eax, 0x12000)), RtlClass.Transfer), expSimp); var ret = bw.BackwalkInstructions(Registers.eax, block1); Assert.AreEqual("None", bw.Index.ToString()); Assert.AreEqual("Mem0[ebp - 0x000000C4:word32]", bw.IndexExpression.ToString()); Assert.IsTrue(ret); ret = bw.BackwalkInstructions(null, block0); }
public void BwDetectIndexRegister() { var edx = m.Frame.EnsureRegister(Registers.edx); var xfer = new RtlGoto(m.LoadDw(m.IAdd(m.Word32(0x10001234), m.IMul(edx, 4))), RtlClass.Transfer); var bw = new Backwalker(host, xfer, expSimp); Assert.AreSame(Registers.edx, bw.Index); }
public void BwInc() { var state = arch.CreateProcessorState(); var di = new Identifier("di", Registers.di.DataType, Registers.di); Backwalker bw = new Backwalker(host, new RtlGoto(new MemoryAccess(di, di.DataType), RtlClass.Transfer), new ExpressionSimplifier(state)); var instrs = new StatementList(new Block(null, "foo")); instrs.Add(0, new Assignment(di, new BinaryExpression(Operator.IAdd, di.DataType, di, Constant.Word16(1)))); var r = bw.BackwalkInstructions(Registers.di, instrs); Assert.AreSame(Registers.di, bw.Index); Assert.AreEqual("+ 1", bw.Operations[0].ToString()); }
public void BwXorHiwordOfIndex() { var bx = m.Frame.EnsureRegister(Registers.bx); var bl = m.Frame.EnsureRegister(Registers.bl); var bh = m.Frame.EnsureRegister(Registers.bh); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(bx, 0x1000)), RtlClass.Transfer), expSimp); Assert.IsTrue(bw.BackwalkInstruction( m.Assign(bh, m.Xor(bh, bh)))); Assert.AreSame(Registers.bl, bw.Index); Assert.AreEqual("& 255", bw.Operations[0].ToString()); }
public void BwLoadIndexed() { var eax = m.Frame.EnsureRegister(Registers.eax); var edx = m.Frame.EnsureRegister(Registers.edx); var al = m.Frame.EnsureRegister(Registers.al); var SCZO = m.Frame.EnsureFlagGroup((uint)(FlagM.SF | FlagM.ZF | FlagM.CF | FlagM.OF), "SCZO", PrimitiveType.Byte); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x1000)), RtlClass.Transfer), expSimp); Assert.IsTrue(bw.BackwalkInstruction( m.Assign(al, m.LoadB(m.IAdd(edx, 0x1004))))); Assert.AreSame(Registers.edx, bw.Index); }
public void BwMaskWithHoles() { var eax = m.Frame.EnsureRegister(Registers.eax); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x10000)), RtlClass.Transfer), expSimp); Assert.IsFalse(bw.BackwalkInstruction(m.Assign(eax, m.And(eax, 0x0A)))); Assert.IsNull(bw.Index); Assert.AreEqual(0, bw.Operations.Count); }
public void BwComparison() { var eax = m.Frame.EnsureRegister(Registers.eax); var SCZO = m.Frame.EnsureFlagGroup((uint)(FlagM.SF | FlagM.ZF | FlagM.CF | FlagM.OF), "SCZO", PrimitiveType.Byte); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x1000)), RtlClass.Transfer), expSimp); bw.UsedFlagIdentifier = m.Frame.EnsureFlagGroup((uint)FlagM.CF, "C", PrimitiveType.Byte); Assert.IsFalse(bw.BackwalkInstruction( m.Assign(SCZO, new ConditionOf(m.ISub(eax, 3)))), "Encountering this comparison should terminate the backwalk"); Assert.AreSame(Registers.eax, bw.Index); Assert.AreEqual("cmp 3", bw.Operations[0].ToString()); }
public void BwJmp() { var eax = m.Frame.EnsureRegister(Registers.eax); var SCZO = m.Frame.EnsureFlagGroup((uint)(FlagM.SF|FlagM.ZF|FlagM.CF|FlagM.OF), "SCZO", PrimitiveType.Byte); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x1000)), RtlClass.Transfer), expSimp); Assert.IsTrue( bw.BackwalkInstruction( m.BranchIf( new TestCondition(ConditionCode.UGT, SCZO), "Nizze").Instruction)); Assert.AreEqual("branch UGT", bw.Operations[0].ToString()); Assert.AreEqual("SCZO", bw.UsedFlagIdentifier.ToString()); }
public void BwAndMask() { var eax = m.Frame.EnsureRegister(Registers.eax); var bw = new Backwalker(host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x10000)), RtlClass.Transfer), expSimp); Assert.IsFalse(bw.BackwalkInstruction(m.Assign(eax, m.And(eax, 0x7)))); Assert.AreSame(Registers.eax, bw.Index); Assert.AreEqual(0x10000ul, bw.VectorAddress.ToLinear()); Assert.AreEqual("cmp 8", bw.Operations[0].ToString()); }
public void BwAdd() { var eax = m.Frame.EnsureRegister(Registers.eax); var bw = new Backwalker( host, new RtlGoto(m.LoadDw(m.IAdd(eax, 0x10000)), RtlClass.Transfer), expSimp); Assert.IsTrue(bw.BackwalkInstruction(m.Assign(eax, m.IAdd(eax, eax)))); Assert.AreSame(Registers.eax, bw.Index); Assert.AreEqual("* 2", bw.Operations[0].ToString()); Assert.AreEqual(2, bw.Stride); }