public void TrfPropagateStackValuesToSuccessor() { m.Label("Start"); Identifier ecx = m.Register(1); trf = CreateTrashedRegisterFinder(prog); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); trf.StackSymbolicValues[-4] = ecx; trf.StackSymbolicValues[-8] = ecx; trf.StackSymbolicValues[-12] = ecx; trf.StackSymbolicValues[-16] = m.Word32(0x1234); trf.StackSymbolicValues[-20] = m.Word32(0x5678); trf.StackSymbolicValues[-24] = m.Word32(0x9ABC); var succ = new Block(m.Procedure, "succ"); var sf = CreateBlockFlow(succ, m.Frame); flow[succ] = sf; sf.SymbolicIn.StackState[-8] = ecx; sf.SymbolicIn.StackState[-12] = Constant.Word32(1231); sf.SymbolicIn.StackState[-20] = Constant.Word32(0x5678); sf.SymbolicIn.StackState[-24] = Constant.Word32(0xCCCC); trf.PropagateToSuccessorBlock(succ); Assert.AreEqual("ecx", sf.SymbolicIn.StackState[-4].ToString(), "Didn't have a value before"); Assert.AreEqual("ecx", sf.SymbolicIn.StackState[-8].ToString(), "Same value as before"); Assert.AreEqual("<invalid>", sf.SymbolicIn.StackState[-12].ToString()); Assert.AreEqual("0x00001234", sf.SymbolicIn.StackState[-16].ToString()); Assert.AreEqual("0x00005678", sf.SymbolicIn.StackState[-20].ToString()); Assert.AreEqual("<invalid>", sf.SymbolicIn.StackState[-24].ToString()); }
public void TrfPropagateToProcedureSummary() { Procedure proc = new Procedure("proc", prog.Architecture.CreateFrame()); prog.CallGraph.AddProcedure(proc); Identifier eax = proc.Frame.EnsureRegister(Registers.eax); Identifier ebx = proc.Frame.EnsureRegister(Registers.ebx); Identifier ecx = proc.Frame.EnsureRegister(Registers.ecx); Identifier esi = proc.Frame.EnsureRegister(Registers.esi); flow[proc] = new ProcedureFlow(proc, prog.Architecture); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(proc.ExitBlock, proc.Frame); trf.StartProcessingBlock(proc.ExitBlock); trf.RegisterSymbolicValues[(RegisterStorage)eax.Storage] = eax; // preserved trf.RegisterSymbolicValues[(RegisterStorage)ebx.Storage] = ecx; // trashed trf.RegisterSymbolicValues[(RegisterStorage)esi.Storage] = Constant.Invalid; // trashed trf.PropagateToProcedureSummary(proc); ProcedureFlow pf = flow[proc]; Assert.AreEqual(" ebx esi", pf.EmitRegisters(prog.Architecture, "", pf.TrashedRegisters)); Assert.AreEqual(" eax", pf.EmitRegisters(prog.Architecture, "", pf.PreservedRegisters)); }
public void TrashFlag() { var scz = m.Frame.EnsureFlagGroup(0x7, arch.GrfToString(0x7), PrimitiveType.Byte); var stm = m.Assign(scz, m.Int32(3)); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Assert.AreEqual(0x7, trf.TrashedFlags); }
public void TrashCompoundRegister() { Identifier ax = m.Frame.EnsureRegister(Registers.ax); var stm = m.Assign(ax, 1); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Assert.AreEqual("(ax:0x0001)", DumpValues()); }
public void TrashRegister() { var r1 = m.Register(1); var stm = m.Assign(r1, m.Int32(0)); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Debug.WriteLine(trf.RegisterSymbolicValues[(RegisterStorage)r1.Storage].ToString()); Assert.IsTrue(trf.IsTrashed(r1.Storage), "r1 should have been marked as trashed."); }
public void TrfCopy() { Identifier r1 = m.Register(1); Identifier r2 = m.Register(2); var ass = m.Assign(r2, r1); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); ass.Accept(trf); Assert.AreEqual(r1, trf.RegisterSymbolicValues[(RegisterStorage)r2.Storage], "r2 should now be equal to r1"); }
public void TrfCallInstruction() { var callee = new Procedure("Callee", prog.Architecture.CreateFrame()); var stm = m.Call(callee, 4); var pf = new ProcedureFlow(callee, prog.Architecture); pf.TrashedRegisters[Registers.ebx.Number] = true; flow[callee] = pf; trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Instruction.Accept(trf); Assert.AreEqual("(ebx:<invalid>)", DumpValues()); }
public void TrfPropagateFlagsToProcedureSummary() { var proc = new Procedure("proc", prog.Architecture.CreateFrame()); prog.CallGraph.AddProcedure(proc); var flags = prog.Architecture.GetFlagGroup("SZ"); var sz = m.Frame.EnsureFlagGroup(flags.FlagGroupBits, flags.Name, flags.DataType); var stm = m.Assign(sz, m.Int32(3)); flow[proc] = new ProcedureFlow(proc, prog.Architecture); trf = CreateTrashedRegisterFinder(prog); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); trf.PropagateToProcedureSummary(proc); Assert.AreEqual(" SZ", flow[proc].EmitFlagGroup(prog.Architecture, "", flow[proc].grfTrashed)); }
public void TrfCopyBack() { var esp = m.Frame.EnsureRegister(Registers.esp); var r2 = m.Register(2); var stm1 = m.Store(m.ISub(esp, 0x10), r2); var stm2 = m.Assign(r2, m.Int32(0)); var stm3 = m.Assign(r2, m.Mem32(m.ISub(esp, 0x10))); trf = CreateTrashedRegisterFinder(); var flow = CreateBlockFlow(m.Block, m.Frame); flow.SymbolicIn.SetValue((Identifier)esp, (Expression)this.m.Frame.FramePointer); trf.StartProcessingBlock(m.Block); stm1.Instruction.Accept(trf); stm2.Accept(trf); stm3.Accept(trf); Assert.AreEqual(r2, trf.RegisterSymbolicValues[(RegisterStorage)r2.Storage]); }
public void TrfPropagateToSuccessorBlocks() { Procedure proc = new Procedure("test", prog.Architecture.CreateFrame()); var frame = proc.Frame; Identifier ecx = m.Register(1); Identifier edx = m.Register(2); Identifier ebx = m.Register(3); Block b = proc.AddBlock("b"); Block t = proc.AddBlock("t"); Block e = proc.AddBlock("e"); proc.ControlGraph.AddEdge(b, e); proc.ControlGraph.AddEdge(b, t); flow[t] = new BlockFlow(t, null, new SymbolicEvaluationContext(prog.Architecture, frame)); flow[e] = new BlockFlow(e, null, new SymbolicEvaluationContext(prog.Architecture, frame)); trf = CreateTrashedRegisterFinder(prog); CreateBlockFlow(b, frame); trf.StartProcessingBlock(b); trf.RegisterSymbolicValues[(RegisterStorage)ecx.Storage] = Constant.Invalid; trf.RegisterSymbolicValues[(RegisterStorage)edx.Storage] = ebx; flow[e].SymbolicIn.RegisterState[(RegisterStorage)ecx.Storage] = edx; flow[e].SymbolicIn.RegisterState[(RegisterStorage)edx.Storage] = ebx; flow[t].SymbolicIn.RegisterState[(RegisterStorage)ecx.Storage] = Constant.Invalid; flow[t].SymbolicIn.RegisterState[(RegisterStorage)edx.Storage] = edx; trf.PropagateToSuccessorBlock(e); trf.PropagateToSuccessorBlock(t); Assert.AreEqual(2, proc.ControlGraph.Successors(b).Count); Assert.AreEqual("<invalid>", flow[e].SymbolicIn.RegisterState[(RegisterStorage)ecx.Storage].ToString(), "trash & r2 => trash"); Assert.AreEqual("ebx", flow[e].SymbolicIn.RegisterState[(RegisterStorage)edx.Storage].ToString(), "ebx & ebx => ebx"); Assert.AreEqual("<invalid>", flow[e].SymbolicIn.RegisterState[(RegisterStorage)ecx.Storage].ToString(), "trash & r2 => trash"); Assert.AreEqual("ebx", flow[e].SymbolicIn.RegisterState[(RegisterStorage)edx.Storage].ToString(), "ebx & ebx => ebx"); Assert.AreEqual("<invalid>", flow[t].SymbolicIn.RegisterState[(RegisterStorage)ecx.Storage].ToString(), "trash & trash => trash"); Assert.AreEqual("<invalid>", flow[t].SymbolicIn.RegisterState[(RegisterStorage)edx.Storage].ToString(), "r3 & r2 => trash"); }
public void TrfPropagateStackValuesToSuccessor() { m.Label("Start"); Identifier ecx = m.Register(1); trf = CreateTrashedRegisterFinder(program); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); trf.StackSymbolicValues[-4] = ecx; trf.StackSymbolicValues[-8] = ecx; trf.StackSymbolicValues[-12] = ecx; trf.StackSymbolicValues[-16] = m.Word32(0x1234); trf.StackSymbolicValues[-20] = m.Word32(0x5678); trf.StackSymbolicValues[-24] = m.Word32(0x9ABC); var succ = new Block(m.Procedure, "succ"); var sf = CreateBlockFlow(succ, m.Frame); flow[succ] = sf; sf.SymbolicIn.StackState[-8] = ecx; sf.SymbolicIn.StackState[-12] = Constant.Word32(1231); sf.SymbolicIn.StackState[-20] = Constant.Word32(0x5678); sf.SymbolicIn.StackState[-24] = Constant.Word32(0xCCCC); trf.PropagateToSuccessorBlock(succ); Assert.AreEqual("ecx", sf.SymbolicIn.StackState[-4].ToString(), "Didn't have a value before"); Assert.AreEqual("ecx", sf.SymbolicIn.StackState[-8].ToString(), "Same value as before"); Assert.AreEqual("<invalid>", sf.SymbolicIn.StackState[-12].ToString()); Assert.AreEqual("0x00001234", sf.SymbolicIn.StackState[-16].ToString()); Assert.AreEqual("0x00005678", sf.SymbolicIn.StackState[-20].ToString()); Assert.AreEqual("<invalid>", sf.SymbolicIn.StackState[-24].ToString()); }
public void TrfPropagateToSuccessorBlocks() { Procedure proc = new Procedure("test", program.Architecture.CreateFrame()); var frame = proc.Frame; Identifier ecx = m.Register(1); Identifier edx = m.Register(2); Identifier ebx = m.Register(3); Block b = proc.AddBlock("b"); Block t = proc.AddBlock("t"); Block e = proc.AddBlock("e"); proc.ControlGraph.AddEdge(b, e); proc.ControlGraph.AddEdge(b, t); flow[t] = new BlockFlow(t, null, new SymbolicEvaluationContext(program.Architecture, frame)); flow[e] = new BlockFlow(e, null, new SymbolicEvaluationContext(program.Architecture, frame)); trf = CreateTrashedRegisterFinder(program); CreateBlockFlow(b, frame); trf.StartProcessingBlock(b); trf.RegisterSymbolicValues[(RegisterStorage) ecx.Storage] = Constant.Invalid; trf.RegisterSymbolicValues[(RegisterStorage) edx.Storage] = ebx; flow[e].SymbolicIn.RegisterState[(RegisterStorage) ecx.Storage] = edx; flow[e].SymbolicIn.RegisterState[(RegisterStorage) edx.Storage] = ebx; flow[t].SymbolicIn.RegisterState[(RegisterStorage) ecx.Storage] = Constant.Invalid; flow[t].SymbolicIn.RegisterState[(RegisterStorage) edx.Storage] = edx; trf.PropagateToSuccessorBlock(e); trf.PropagateToSuccessorBlock(t); Assert.AreEqual(2, proc.ControlGraph.Successors(b).Count); Assert.AreEqual("<invalid>", flow[e].SymbolicIn.RegisterState[(RegisterStorage) ecx.Storage].ToString(), "trash & r2 => trash"); Assert.AreEqual("ebx", flow[e].SymbolicIn.RegisterState[(RegisterStorage) edx.Storage].ToString(), "ebx & ebx => ebx"); Assert.AreEqual("<invalid>", flow[e].SymbolicIn.RegisterState[(RegisterStorage) ecx.Storage].ToString(), "trash & r2 => trash"); Assert.AreEqual("ebx", flow[e].SymbolicIn.RegisterState[(RegisterStorage) edx.Storage].ToString(), "ebx & ebx => ebx"); Assert.AreEqual("<invalid>", flow[t].SymbolicIn.RegisterState[(RegisterStorage) ecx.Storage].ToString(), "trash & trash => trash"); Assert.AreEqual("<invalid>", flow[t].SymbolicIn.RegisterState[(RegisterStorage) edx.Storage].ToString(), "r3 & r2 => trash"); }
public void TrfCallInstruction() { var callee = new Procedure("Callee", program.Architecture.CreateFrame()); var stm = m.Call(callee, 4); var pf = new ProcedureFlow(callee, program.Architecture); pf.TrashedRegisters.Add(Registers.ebx); flow[callee] = pf; trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Instruction.Accept(trf); Assert.AreEqual("(ebx:<invalid>)", DumpValues()); }
public void TrfCopyBack() { var esp = m.Frame.EnsureRegister(Registers.esp); var r2 = m.Register(2); var stm1 = m.Store(m.ISub(esp, 0x10), r2); var stm2 = m.Assign(r2, m.Int32(0)); var stm3 = m.Assign(r2, m.LoadDw(m.ISub(esp, 0x10))); trf = CreateTrashedRegisterFinder(); var flow = CreateBlockFlow(m.Block, m.Frame); flow.SymbolicIn.SetValue(esp, m.Frame.FramePointer); trf.StartProcessingBlock(m.Block); stm1.Instruction.Accept(trf); stm2.Accept(trf); stm3.Accept(trf); Assert.AreEqual(r2, trf.RegisterSymbolicValues[(RegisterStorage) r2.Storage]); }
public void TrfCopy() { Identifier r1 = m.Register(1); Identifier r2 = m.Register(2); var ass = m.Assign(r2, r1); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); ass.Accept(trf); Assert.AreEqual(r1, trf.RegisterSymbolicValues[(RegisterStorage) r2.Storage], "r2 should now be equal to r1"); }
public void TrashCompoundRegister() { Identifier ax = m.Frame.EnsureRegister(Registers.ax); var stm = m.Assign(ax, 1); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Assert.AreEqual("(ax:0x0001)", DumpValues()); }
public void TrashFlag() { var flags = arch.GetFlagGroup(0x7).FlagRegister; var scz = m.Frame.EnsureFlagGroup(flags, 0x7, arch.GrfToString(0x7), PrimitiveType.Byte); var stm = m.Assign(scz, m.Int32(3)); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Assert.AreEqual(0x7, trf.TrashedFlags); }
public void TrfPropagateToProcedureSummary() { Procedure proc = new Procedure("proc", program.Architecture.CreateFrame()); program.CallGraph.AddProcedure(proc); Identifier eax = proc.Frame.EnsureRegister(Registers.eax); Identifier ebx = proc.Frame.EnsureRegister(Registers.ebx); Identifier ecx = proc.Frame.EnsureRegister(Registers.ecx); Identifier esi = proc.Frame.EnsureRegister(Registers.esi); flow[proc] = new ProcedureFlow(proc, program.Architecture); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(proc.ExitBlock, proc.Frame); trf.StartProcessingBlock(proc.ExitBlock); trf.RegisterSymbolicValues[(RegisterStorage) eax.Storage] = eax; // preserved trf.RegisterSymbolicValues[(RegisterStorage) ebx.Storage] = ecx; // trashed trf.RegisterSymbolicValues[(RegisterStorage) esi.Storage] = Constant.Invalid; // trashed trf.PropagateToProcedureSummary(proc); ProcedureFlow pf = flow[proc]; Assert.AreEqual(" ebx esi", pf.EmitRegisters(program.Architecture, "", pf.TrashedRegisters)); Assert.AreEqual(" eax", pf.EmitRegisters(program.Architecture, "", pf.PreservedRegisters)); }
public void TrfPropagateFlagsToProcedureSummary() { var proc = new Procedure("proc", program.Architecture.CreateFrame()); program.CallGraph.AddProcedure(proc); var flags = program.Architecture.GetFlagGroup("SZ"); var sz = m.Frame.EnsureFlagGroup(flags.FlagRegister, flags.FlagGroupBits, flags.Name, flags.DataType); var stm = m.Assign(sz, m.Int32(3)); flow[proc] = new ProcedureFlow(proc, program.Architecture); trf = CreateTrashedRegisterFinder(program); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); trf.PropagateToProcedureSummary(proc); Assert.AreEqual(" SZ", flow[proc].EmitFlagGroup(program.Architecture, "", flow[proc].grfTrashed)); }
public void TrashRegister() { var r1 = m.Register(1); var stm = m.Assign(r1, m.Int32(0)); trf = CreateTrashedRegisterFinder(); CreateBlockFlow(m.Block, m.Frame); trf.StartProcessingBlock(m.Block); stm.Accept(trf); Debug.WriteLine(trf.RegisterSymbolicValues[(RegisterStorage) r1.Storage].ToString()); Assert.IsTrue(trf.IsTrashed(r1.Storage), "r1 should have been marked as trashed."); }