private void RunTest(string sExp, Action<ProcedureBuilder> builder) { var pb = new ProcedureBuilder(this.pb.Program.Architecture); builder(pb); var proc = pb.Procedure; var dg = new DominatorGraph<Block>(proc.ControlGraph, proc.EntryBlock); // Perform the initial transformation var ssa = new SsaTransform(programFlow, proc, dg); // Propagate values and simplify the results. // We hope the the sequence // esp = fp - 4 // mov [esp-4],eax // will become // esp_2 = fp - 4 // mov [fp - 8],eax var vp = new ValuePropagator(ssa.SsaState.Identifiers, proc); vp.Transform(); ssa.RenameFrameAccesses = true; ssa.AddUseInstructions = true; ssa.Transform(); var writer = new StringWriter(); proc.Write(false, writer); var sActual = writer.ToString(); if (sActual != sExp) Debug.Print(sActual); Assert.AreEqual(sExp, sActual); }
private Procedure RunTest(string sExp, IProcessorArchitecture arch, Func<Procedure> mkProc) { var proc = mkProc(); progBuilder.ResolveUnresolved(); var ssa = new SsaTransform(pf, proc, proc.CreateBlockDominatorGraph()); var vp = new ValuePropagator(arch, ssa.SsaState.Identifiers, proc); vp.Transform(); ssa.RenameFrameAccesses = true; ssa.AddUseInstructions = true; ssa.Transform(); vp.Transform(); var trf = new TrashedRegisterFinder2( arch, pf, proc, ssa.SsaState.Identifiers, NullDecompilerEventListener.Instance); var flow = trf.Compute(); var sw = new StringWriter(); sw.Write("Preserved: "); sw.WriteLine(string.Join(",", flow.Preserved.OrderBy(p => p.ToString()))); sw.Write("Trashed: "); sw.WriteLine(string.Join(",", flow.Trashed.OrderBy(p => p.ToString()))); if (flow.Constants.Count > 0) { sw.Write("Constants: "); sw.WriteLine(string.Join( ",", flow.Constants .OrderBy(kv => kv.Key.ToString()) .Select(kv => string.Format( "{0}:{1}", kv.Key, kv.Value)))); } var sActual = sw.ToString(); if (sActual != sExp) { proc.Dump(true); Debug.WriteLine(sActual); Assert.AreEqual(sExp, sActual); } pf.ProcedureFlows2.Add(proc, flow); return proc; }
private void UntangleProcedureScc(IList <Procedure> procs) { if (procs.Count == 1) { var proc = procs[0]; Aliases alias = new Aliases(proc, program.Architecture, flow); alias.Transform(); // Transform the procedure to SSA state. When encountering 'call' instructions, // they can be to functions already visited. If so, they have a "ProcedureFlow" // associated with them. If they have not been visited, or are computed destinations // (e.g. vtables) they will have no "ProcedureFlow" associated with them yet, in // which case the the SSA treats the call as a "hell node". var doms = proc.CreateBlockDominatorGraph(); var sst = new SsaTransform(flow, proc, importResolver, doms); var ssa = sst.SsaState; // Propagate condition codes and registers. At the end, the hope is that // all statements like (x86) mem[esp_42+4] will have been converted to // mem[fp - 30]. We also hope that procedure constants kept in registers // are propagated to the corresponding call sites. var cce = new ConditionCodeEliminator(ssa.Identifiers, program.Platform); cce.Transform(); var vp = new ValuePropagator(program.Architecture, ssa.Identifiers, proc); vp.Transform(); // Now compute SSA for the stack-based variables as well. That is: // mem[fp - 30] becomes wLoc30, while // mem[fp + 30] becomes wArg30. // This allows us to compute the dataflow of this procedure. sst.RenameFrameAccesses = true; sst.AddUseInstructions = true; sst.Transform(); // Propagate those newly discovered identifiers. vp.Transform(); // At this point, the computation of _actual_ ProcedureFlow should be possible. var tid = new TrashedRegisterFinder2(program.Architecture, flow, proc, ssa.Identifiers, this.eventListener); tid.Compute(); DeadCode.Eliminate(proc, ssa); // Build expressions. A definition with a single use can be subsumed // into the using expression. var coa = new Coalescer(proc, ssa); coa.Transform(); DeadCode.Eliminate(proc, ssa); var liv = new LinearInductionVariableFinder( proc, ssa.Identifiers, new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock)); liv.Find(); foreach (var de in liv.Contexts) { var str = new StrengthReduction(ssa, de.Key, de.Value); str.ClassifyUses(); str.ModifyUses(); } //var opt = new OutParameterTransformer(proc, ssa.Identifiers); //opt.Transform(); DeadCode.Eliminate(proc, ssa); // Definitions with multiple uses and variables joined by PHI functions become webs. var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables); web.Transform(); ssa.ConvertBack(false); } else { throw new NotImplementedException(); } }
private void UntangleProcedureScc(IList<Procedure> procs) { if (procs.Count == 1) { var proc = procs[0]; Aliases alias = new Aliases(proc, program.Architecture, flow); alias.Transform(); // Transform the procedure to SSA state. When encountering 'call' instructions, // they can be to functions already visited. If so, they have a "ProcedureFlow" // associated with them. If they have not been visited, or are computed destinations // (e.g. vtables) they will have no "ProcedureFlow" associated with them yet, in // which case the the SSA treats the call as a "hell node". var doms = proc.CreateBlockDominatorGraph(); var sst = new SsaTransform(flow, proc, doms); var ssa = sst.SsaState; // Propagate condition codes and registers. At the end, the hope is that // all statements like (x86) mem[esp_42+4] will have been converted to // mem[fp - 30]. We also hope that procedure constants kept in registers // are propagated to the corresponding call sites. var cce = new ConditionCodeEliminator(ssa.Identifiers, program.Platform); cce.Transform(); var vp = new ValuePropagator(program.Architecture, ssa.Identifiers, proc); vp.Transform(); // Now compute SSA for the stack-based variables as well. That is: // mem[fp - 30] becomes wLoc30, while // mem[fp + 30] becomes wArg30. // This allows us to compute the dataflow of this procedure. sst.RenameFrameAccesses = true; sst.AddUseInstructions = true; sst.Transform(); // Propagate those newly discovered identifiers. vp.Transform(); // At this point, the computation of _actual_ ProcedureFlow should be possible. var tid = new TrashedRegisterFinder2(program.Architecture, flow, proc, ssa.Identifiers, this.eventListener); tid.Compute(); DeadCode.Eliminate(proc, ssa); // Build expressions. A definition with a single use can be subsumed // into the using expression. var coa = new Coalescer(proc, ssa); coa.Transform(); DeadCode.Eliminate(proc, ssa); var liv = new LinearInductionVariableFinder( proc, ssa.Identifiers, new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock)); liv.Find(); foreach (var de in liv.Contexts) { var str = new StrengthReduction(ssa, de.Key, de.Value); str.ClassifyUses(); str.ModifyUses(); } //var opt = new OutParameterTransformer(proc, ssa.Identifiers); //opt.Transform(); DeadCode.Eliminate(proc, ssa); // Definitions with multiple uses and variables joined by PHI functions become webs. var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables); web.Transform(); ssa.ConvertBack(false); } else { throw new NotImplementedException(); } }
/// <summary> /// Converts all registers and stack accesses to SSA variables. /// </summary> /// <param name="proc"></param> /// <returns>The SsaTransform for the procedure.</returns> public SsaTransform ConvertToSsa(Procedure proc) { if (program.NeedsSsaTransform) { // Transform the procedure to SSA state. When encountering 'call' // instructions, they can be to functions already visited. If so, // they have a "ProcedureFlow" associated with them. If they have // not been visited, or are computed destinations (e.g. vtables) // they will have no "ProcedureFlow" associated with them yet, in // which case the the SSA treats the call as a "hell node". var sst = new SsaTransform(program, proc, sccProcs, dynamicLinker, this.ProgramDataFlow); var ssa = sst.Transform(); DumpWatchedProcedure("After SSA", ssa.Procedure); // Merge unaligned memory accesses. var fuser = new UnalignedMemoryAccessFuser(ssa); fuser.Transform(); // After value propagation expressions like (x86) // mem[esp_42+4] will have been converted to mem[fp - 30]. // We also hope that procedure constants // kept in registers are propagated to the corresponding call // sites. var vp = new ValuePropagator(program.SegmentMap, ssa, program.CallGraph, dynamicLinker, eventListener); vp.Transform(); DumpWatchedProcedure("After first VP", ssa.Procedure); // Fuse additions and subtractions that are linked by the carry flag. var larw = new LongAddRewriter(ssa); larw.Transform(); // Propagate condition codes and registers. var cce = new ConditionCodeEliminator(ssa, program.Platform); cce.Transform(); vp.Transform(); DumpWatchedProcedure("After CCE", ssa.Procedure); // Now compute SSA for the stack-based variables as well. That is: // mem[fp - 30] becomes wLoc30, while // mem[fp + 30] becomes wArg30. // This allows us to compute the dataflow of this procedure. sst.RenameFrameAccesses = true; sst.Transform(); DumpWatchedProcedure("After SSA frame accesses", ssa.Procedure); var icrw = new IndirectCallRewriter(program, ssa, eventListener); while (!eventListener.IsCanceled() && icrw.Rewrite()) { vp.Transform(); sst.RenameFrameAccesses = true; sst.Transform(); } var fpuGuesser = new FpuStackReturnGuesser(ssa); fpuGuesser.Rewrite(); // By placing use statements in the exit block, we will collect // reaching definitions in the use statements. sst.AddUsesToExitBlock(); sst.RemoveDeadSsaIdentifiers(); // Backpropagate stack pointer from procedure return. var spBackpropagator = new StackPointerBackpropagator(ssa); spBackpropagator.BackpropagateStackPointer(); DumpWatchedProcedure("After SP BP", ssa.Procedure); // Propagate those newly created stack-based identifiers. vp.Transform(); DumpWatchedProcedure("After VP2", ssa.Procedure); return(sst); } else { // We are assuming phi functions are already generated. var sst = new SsaTransform(program, proc, sccProcs, dynamicLinker, this.ProgramDataFlow); return(sst); } }
/// <summary> /// Processes procedures individually, building complex expression trees out /// of the simple, close-to-the-machine code generated by the disassembly. /// </summary> /// <param name="rl"></param> public void BuildExpressionTrees() { int i = 0; foreach (Procedure proc in program.Procedures.Values) { if (eventListener.IsCanceled()) { break; } eventListener.ShowProgress("Building complex expressions.", i, program.Procedures.Values.Count); ++i; try { var larw = new LongAddRewriter(proc, program.Architecture); larw.Transform(); Aliases alias = new Aliases(proc, program.Architecture, flow); alias.Transform(); var doms = new DominatorGraph <Block>(proc.ControlGraph, proc.EntryBlock); var sst = new SsaTransform(flow, proc, importResolver, doms, new HashSet <RegisterStorage>()); var ssa = sst.SsaState; var vp = new ValuePropagator(program.Architecture, ssa, eventListener); sst.RenameFrameAccesses = true; var icrw = new IndirectCallRewriter(program, ssa, eventListener); while (!eventListener.IsCanceled() && icrw.Rewrite()) { vp.Transform(); sst.Transform(); } var cce = new ConditionCodeEliminator(ssa, program.Platform); cce.Transform(); //var cd = new ConstDivisionImplementedByMultiplication(ssa); //cd.Transform(); DeadCode.Eliminate(proc, ssa); vp.Transform(); DeadCode.Eliminate(proc, ssa); // Build expressions. A definition with a single use can be subsumed // into the using expression. var coa = new Coalescer(proc, ssa); coa.Transform(); DeadCode.Eliminate(proc, ssa); vp.Transform(); var liv = new LinearInductionVariableFinder( proc, ssa.Identifiers, new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock)); liv.Find(); foreach (KeyValuePair <LinearInductionVariable, LinearInductionVariableContext> de in liv.Contexts) { var str = new StrengthReduction(ssa, de.Key, de.Value); str.ClassifyUses(); str.ModifyUses(); } var opt = new OutParameterTransformer(proc, ssa.Identifiers); opt.Transform(); DeadCode.Eliminate(proc, ssa); // Definitions with multiple uses and variables joined by PHI functions become webs. var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables); web.Transform(); ssa.ConvertBack(false); } catch (StatementCorrelatedException stex) { eventListener.Error( eventListener.CreateStatementNavigator(program, stex.Statement), stex, "An error occurred during data flow analysis."); } catch (Exception ex) { eventListener.Error( new NullCodeLocation(proc.Name), ex, "An error occurred during data flow analysis."); } } }
/// <summary> /// Processes procedures individually, building complex expression trees out /// of the simple, close-to-the-machine code generated by the disassembly. /// </summary> /// <param name="rl"></param> public void BuildExpressionTrees() { int i = 0; foreach (Procedure proc in program.Procedures.Values) { if (eventListener.IsCanceled()) break; eventListener.ShowProgress("Building complex expressions.", i, program.Procedures.Values.Count); ++i; try { var larw = new LongAddRewriter(proc, program.Architecture); larw.Transform(); Aliases alias = new Aliases(proc, program.Architecture, flow); alias.Transform(); var doms = new DominatorGraph<Block>(proc.ControlGraph, proc.EntryBlock); var sst = new SsaTransform(flow, proc, importResolver, doms, new HashSet<RegisterStorage>()); var ssa = sst.SsaState; var vp = new ValuePropagator(program.Architecture, ssa); sst.RenameFrameAccesses = true; var icrw = new IndirectCallRewriter(program, ssa, eventListener); while (!eventListener.IsCanceled() && icrw.Rewrite()) { vp.Transform(); sst.Transform(); } var cce = new ConditionCodeEliminator(ssa, program.Platform); cce.Transform(); //var cd = new ConstDivisionImplementedByMultiplication(ssa); //cd.Transform(); DeadCode.Eliminate(proc, ssa); vp.Transform(); DeadCode.Eliminate(proc, ssa); // Build expressions. A definition with a single use can be subsumed // into the using expression. var coa = new Coalescer(proc, ssa); coa.Transform(); DeadCode.Eliminate(proc, ssa); vp.Transform(); var liv = new LinearInductionVariableFinder( proc, ssa.Identifiers, new BlockDominatorGraph(proc.ControlGraph, proc.EntryBlock)); liv.Find(); foreach (KeyValuePair<LinearInductionVariable, LinearInductionVariableContext> de in liv.Contexts) { var str = new StrengthReduction(ssa, de.Key, de.Value); str.ClassifyUses(); str.ModifyUses(); } var opt = new OutParameterTransformer(proc, ssa.Identifiers); opt.Transform(); DeadCode.Eliminate(proc, ssa); // Definitions with multiple uses and variables joined by PHI functions become webs. var web = new WebBuilder(proc, ssa.Identifiers, program.InductionVariables); web.Transform(); ssa.ConvertBack(false); } catch (StatementCorrelatedException stex) { eventListener.Error( eventListener.CreateStatementNavigator(program, stex.Statement), stex, "An error occurred during data flow analysis."); } catch (Exception ex) { eventListener.Error( new NullCodeLocation(proc.Name), ex, "An error occurred during data flow analysis."); } } }
private void RunTest(string sExp, Action<ProcedureBuilder> builder) { var pb = new ProcedureBuilder(this.pb.Program.Architecture); builder(pb); var proc = pb.Procedure; var dg = new DominatorGraph<Block>(proc.ControlGraph, proc.EntryBlock); var project = new Project { Programs = { this.pb.Program } }; var importResolver = new ImportResolver( project, this.pb.Program, new FakeDecompilerEventListener()); var arch = new FakeArchitecture(); var platform = new FakePlatform(null, arch); // Register r1 is assumed to always be implicit when calling // another procedure. var implicitRegs = new HashSet<RegisterStorage> { arch.GetRegister(1) }; Debug.Print("GetRegister(1) {0}", arch.GetRegister(1)); this.pb.Program.Platform = platform; this.pb.Program.Platform = new FakePlatform(null, new FakeArchitecture()); this.pb.Program.SegmentMap = new SegmentMap( Address.Ptr32(0x0000), new ImageSegment( ".text", Address.Ptr32(0), 0x40000, AccessMode.ReadWriteExecute)); // Perform the initial transformation var ssa = new SsaTransform(programFlow, proc, importResolver, dg, implicitRegs); // Propagate values and simplify the results. // We hope the the sequence // esp = fp - 4 // mov [esp-4],eax // will become // esp_2 = fp - 4 // mov [fp - 8],eax var vp = new ValuePropagator(this.pb.Program.Architecture, ssa.SsaState); vp.Transform(); ssa.RenameFrameAccesses = true; ssa.AddUseInstructions = true; ssa.Transform(); var writer = new StringWriter(); proc.Write(false, writer); var sActual = writer.ToString(); if (sActual != sExp) Debug.Print(sActual); Assert.AreEqual(sExp, sActual); }