예제 #1
0
 /// <summary>
 /// Analyzes code starting from the given location. That location
 /// should be the entry point of a procedure, or otherwise the
 /// analysis may not work correctly.
 /// </summary>
 /// <param name="entryPoint">Specifies the location to start analysis.
 /// This location is relative to the beginning of the image.</param>
 /// <param name="entryType">Type of entry, should usually be JMP or
 /// CALL.</param>
 public virtual void Analyze(Address entryPoint, XRefType entryType)
 {
     GenerateBasicBlocks(entryPoint, entryType);
     GenerateControlFlowGraph();
     GenerateProcedures();
     AddBasicBlocksToProcedures();
 }
예제 #2
0
 public SourceAwareRelativeOperand(RelativeOperand opr, Address source)
     : base(opr.Offset)
 {
     this.source = source;
 }
예제 #3
0
        /// <summary>
        /// Analyzes code starting from the given location, and create basic
        /// blocks iteratively.
        /// </summary>
        public void GenerateBasicBlocks(Address entryPoint, XRefType entryType)
        {
            Address address = entryPoint;

            // Maintain a queue of basic block entry points to analyze. At
            // the beginning, only the user-specified entry point is in the
            // queue. As we encounter b/c/j instructions during the course
            // of analysis, we push the target addresses to the queue of
            // entry points to be analyzed later.
            PriorityQueue<XRef> xrefQueue =
                new PriorityQueue<XRef>(XRef.CompareByPriority);

            // Maintain a list of all procedure calls (with known target)
            // encountered during the analysis. After we finish analyzing
            // all the basic blocks, we update the list of procedures.
            // List<XRef> xrefCalls = new List<XRef>();

            // Create a a dummy xref entry using the user-supplied starting
            // address.
            xrefQueue.Enqueue(new XRef(
                type: entryType,
                source: Address.Invalid,
                target: entryPoint
            ));

            // Analyze each cross reference in order of their priority.
            // In particular, if the xref is an indexed jump, we delay its
            // processing until we have processed all other types of xrefs.
            // This reduces the chance that we process past the end of a
            // jump table.
            while (!xrefQueue.IsEmpty)
            {
                XRef entry = xrefQueue.Dequeue();

                // Handle jump table entry, whose Target == Invalid.
                if (entry.Type == XRefType.NearIndexedJump)
                {
                    System.Diagnostics.Debug.Assert(entry.Target == Address.Invalid);

                    // Fill the Target field to make it a static xref.
                    entry = ProcessJumpTableEntry(entry, xrefQueue);
                    if (entry == null) // end of jump table
                        continue;
                }

                // Skip other dynamic xrefs.
                if (entry.Target == Address.Invalid)
                {
                    CrossReferences.Add(entry);
                    continue;
                }

                // Process the basic block starting at the target address.
                BasicBlock block = AnalyzeBasicBlock(entry, xrefQueue);
                if (block != null)
                {
                    //int count = block.Length;
                    //int baseOffset = PointerToOffset(entry.Target);
                    //proc.CodeRange.AddInterval(baseOffset, baseOffset + count);
                    //proc.ByteRange.AddInterval(baseOffset, baseOffset + count);
                    //for (int j = 0; j < count; j++)
                    //{
                    //    image[baseOffset + j].Procedure = proc;
                    //}
            #if false
                    proc.AddBasicBlock(block);
            #endif
                }
                CrossReferences.Add(entry);
            }
        }
예제 #4
0
        /// <summary>
        /// Decodes an instruction at the given offset, applying associated
        /// fix-up information if present.
        /// </summary>
        /// <returns>The decoded instruction.</returns>
        /// <remarks>
        /// When overridden, the method must guarantee that the instruction
        /// is contained in the image, and not into another segment.
        /// </remarks>
        /// <exception cref="ArgumentOutOfRangeException">If offset refers to
        /// a location outside of the image.</exception>
        protected virtual Instruction DecodeInstruction(Address address)
        {
            if (!image.IsAddressValid(address))
                throw new ArgumentOutOfRangeException("address");

            Instruction instruction ;
            try
            {
                instruction = X86Codec.Decoder.Decode(
                    image.GetBytes(address), CpuMode.RealAddressMode);
            }
            catch (Exception ex)
            {
                AddError(address, ErrorCode.InvalidInstruction, "Bad instruction: {0}", ex.Message);
                return null;
            }

            MakeRelativeOperandSourceAware(instruction, address);

            return instruction;
        }
예제 #5
0
        /// <summary>
        /// Creates an instruction starting at the given address. If the
        /// decoded instruction covers bytes that are already analyzed,
        /// returns null.
        /// </summary>
        /// <param name="image"></param>
        /// <param name="address"></param>
        /// <returns></returns>
        protected virtual Instruction CreateInstruction(Address address, XRef entry)
        {
            Instruction instruction = DecodeInstruction(address);
            if (instruction == null)
                return null;

            // Check that the bytes covered by the decoded instruction are
            // unanalyzed.
            if (!image.CheckByteType(address, address + instruction.EncodedLength, ByteType.Unknown))
            {
                AddError(address, ErrorCode.OverlappingInstruction,
                    "Ran into the middle of code when processing block {0} referred from {1}",
                    entry.Target, entry.Source);
                return null;
            }

            // Create a code piece for this instruction.
            image.UpdateByteType(address, address + instruction.EncodedLength, ByteType.Code);
            image.Instructions.Add(address, instruction);

            // Return the decoded instruction.
            return instruction;
        }
예제 #6
0
        /// <summary>
        /// Creates a procedure with the given entry point.
        /// </summary>
        /// <returns></returns>
        protected virtual Procedure CreateProcedure(Address entryPoint)
        {
            // If there is already a procedure defined at the given entry
            // point, return that procedure.
            Procedure proc = Procedures.Find(entryPoint);
            if (proc != null)
                return proc;

            // Create a procedure at the entry point. The entry point must be
            // be the first byte of a basic block, or otherwise some flow
            // analysis error must have occurred. On the other hand, note
            // that multiple procedures may share one or more basic blocks
            // as part of their implementation.
            proc = new Procedure(entryPoint);
            AddBasicBlocksToProcedure(proc);
            //proc.Name = "TBD";

            // To determine the call type of the procedure, examine the
            // features of the basic blocks.
            CodeFeatures features = proc.Features;
            #if false
            foreach (BasicBlock block in proc.BasicBlocks)
            {
                features |= block.Features;
            }
            #endif

            CodeFeatures callFeatures = features & (
                CodeFeatures.HasRETN | CodeFeatures.HasRETF | CodeFeatures.HasIRET);
            switch (callFeatures)
            {
                case CodeFeatures.HasRETN:
                    proc.ReturnType |= ReturnType.Near;
                    break;
                case CodeFeatures.HasRETF:
                    proc.ReturnType |= ReturnType.Far;
                    break;
                case CodeFeatures.HasIRET:
                    proc.ReturnType |= ReturnType.Interrupt;
                    break;
                case CodeFeatures.None:
                    AddError(entryPoint, ErrorCode.InconsistentCall,
                        "Procedure at entry point {0} does not contain a RET/RETF/IRET instruction.",
                        entryPoint);
                    break;
                default:
                    AddError(entryPoint, ErrorCode.InconsistentCall,
                        "Procedure at entry point {0} contains inconsistent return instructions: {1}.",
                        entryPoint, callFeatures);
                    break;
            }
            return proc;
        }
예제 #7
0
        protected virtual XRef CreateFlowXRef(
            XRefType xrefType, Address source, Instruction instruction)
        {
            switch (xrefType)
            {
                case XRefType.ConditionalJump:
                case XRefType.FarJump:
                case XRefType.NearJump:
                case XRefType.FarCall:
                case XRefType.NearCall:
                    return CreateBranchJumpCallXRef(xrefType, source, instruction);

                case XRefType.NearIndexedJump:
                    throw new NotImplementedException();

                default:
                    return null;
            }
        }
예제 #8
0
 protected virtual XRef CreateFallThroughXRef(Address source, Address target)
 {
     XRef xref = new XRef(
         type: XRefType.FallThrough,
         source: source,
         target: target
         );
     return xref;
 }
예제 #9
0
        protected virtual XRef CreateBranchJumpCallXRef(
            XRefType type, Address source, Instruction instruction)
        {
            Address target = ResolveFlowInstructionTarget(instruction.Operands[0]);

            if (target == Address.Invalid)
            {
                AddError(source, ErrorCode.DynamicTarget,
                    "Cannot determine the target of {0} instruction.", instruction.Operation);
            }
            return new XRef(
                type: type,
                source: source,
                target: target
            );
        }
예제 #10
0
 protected void AddError(
     Address location, ErrorCode errorCode,
     string format, params object[] args)
 {
     Errors.Add(new Error(location, errorCode, string.Format(format, args)));
 }
예제 #11
0
 /// <summary>
 /// Replaces any RelativeOperand with SourceAwareRelativeOperand.
 /// </summary>
 /// <param name="instruction"></param>
 // TODO: make SourceAwareRelativeOperand.Target a dummy
 // SymbolicTarget, so that we can handle them consistently.
 protected static void MakeRelativeOperandSourceAware(
     Instruction instruction, Address instructionStart)
 {
     for (int i = 0; i < instruction.Operands.Length; i++)
     {
         if (instruction.Operands[i] is RelativeOperand &&
             instruction.Operands[i].Tag == null)
         {
             instruction.Operands[i] = new SourceAwareRelativeOperand(
                 (RelativeOperand)instruction.Operands[i],
                 instructionStart + instruction.EncodedLength);
         }
     }
 }