ROSE  0.11.22.0
ModulesElf.h
1 #ifndef ROSE_Partitioner2_ModulesElf_H
2 #define ROSE_Partitioner2_ModulesElf_H
3 
4 #include <featureTests.h>
5 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
6 
7 #include <Partitioner2/BasicTypes.h>
8 #include <Partitioner2/Function.h>
9 #include <Partitioner2/Modules.h>
10 
11 #include <boost/filesystem.hpp>
12 
13 namespace Rose {
14 namespace BinaryAnalysis {
15 namespace Partitioner2 {
16 
18 namespace ModulesElf {
19 
26 std::vector<Function::Ptr> findErrorHandlingFunctions(SgAsmElfFileHeader*);
27 std::vector<Function::Ptr> findErrorHandlingFunctions(SgAsmInterpretation*);
28 size_t findErrorHandlingFunctions(SgAsmElfFileHeader*, std::vector<Function::Ptr>&);
34 std::vector<Function::Ptr> findPltFunctions(Partitioner&, SgAsmElfFileHeader*);
35 std::vector<Function::Ptr> findPltFunctions(Partitioner&, SgAsmInterpretation*);
36 size_t findPltFunctions(Partitioner&, SgAsmElfFileHeader*, std::vector<Function::Ptr>&);
40 struct PltInfo {
41  SgAsmGenericSection *section;
42  size_t firstOffset;
43  size_t entrySize;
45  PltInfo()
46  : section(NULL), firstOffset(0), entrySize(0) {}
47 };
48 
51 
55 std::vector<SgAsmElfSection*> findSectionsByName(SgAsmInterpretation*, const std::string&);
56 
61 bool isImport(const Partitioner&, const Function::Ptr&);
62 
67 bool isLinkedImport(const Partitioner&, const Function::Ptr&);
68 
72 bool isUnlinkedImport(const Partitioner&, const Function::Ptr&);
73 
78 bool isObjectFile(const boost::filesystem::path&);
79 
84 bool isStaticArchive(const boost::filesystem::path&);
85 
87 namespace FixUndefinedSymbols {
89 enum Boolean {
90  NO,
91  YES
92 };
93 } // namespace
94 
99 bool tryLink(const std::string &command, const boost::filesystem::path &outputName,
100  std::vector<boost::filesystem::path> inputNames, Sawyer::Message::Stream &errors,
102 
108 std::vector<boost::filesystem::path>
109 extractStaticArchive(const boost::filesystem::path &directory, const boost::filesystem::path &archive);
110 
114  // These data members are generally optional, and filled in as they're matched.
115  rose_addr_t gotVa_; // address of global offset table
116  rose_addr_t gotEntryVa_; // address through which an indirect branch branches
117  size_t gotEntryNBytes_; // size of the global offset table entry in bytes
118  rose_addr_t gotEntry_; // address read from the GOT if the address is mapped (or zero)
119  size_t nBytesMatched_; // number of bytes matched for PLT entry
120  rose_addr_t functionNumber_; // function number argument for the dynamic linker (usually a push)
121 
122 public:
123  explicit PltEntryMatcher(rose_addr_t gotVa)
124  : gotVa_(gotVa), gotEntryVa_(0), gotEntryNBytes_(0), gotEntry_(0), nBytesMatched_(0) {}
125  static Ptr instance(rose_addr_t gotVa) {
126  return Ptr(new PltEntryMatcher(gotVa));
127  }
128  virtual bool match(const Partitioner&, rose_addr_t anchor);
129 
131  rose_addr_t gotVa() const { return gotVa_; }
132 
134  size_t nBytesMatched() const { return nBytesMatched_; }
135 
137  rose_addr_t gotEntryVa() const { return gotEntryVa_; }
138 
140  size_t gotEntryNBytes() const { return gotEntryNBytes_; }
141 
143  rose_addr_t gotEntry() const { return gotEntry_; }
144 
145  // [Robb Matzke 2018-04-06]: deprecated: use gotEntryVa
146  rose_addr_t memAddress() const { return gotEntryVa_; }
147 
148 private:
149  SgAsmInstruction* matchNop(const Partitioner&, rose_addr_t va);
150  SgAsmInstruction* matchPush(const Partitioner&, rose_addr_t var, rose_addr_t &n /*out*/);
151  SgAsmInstruction* matchDirectJump(const Partitioner&, rose_addr_t va);
152  SgAsmInstruction* matchIndirectJump(const Partitioner&, rose_addr_t va,
153  rose_addr_t &indirectVa /*out*/, size_t &indirectNBytes /*out*/);
154  SgAsmInstruction* matchIndirectJumpEbx(const Partitioner&, rose_addr_t va,
155  rose_addr_t &offsetFromEbx /*out*/, size_t &indirectNBytes /*out*/);
156  SgAsmInstruction* matchAarch64Adrp(const Partitioner&, rose_addr_t va, rose_addr_t &value /*out*/);
157  SgAsmInstruction* matchAarch64Ldr(const Partitioner&, rose_addr_t va, rose_addr_t &indirectVa /*in,out*/,
158  rose_addr_t &indirectNBytes /*out*/);
159  SgAsmInstruction* matchAarch64Add(const Partitioner&, rose_addr_t va);
160  SgAsmInstruction* matchAarch64Br(const Partitioner&, rose_addr_t va);
161 };
162 
164 void buildMayReturnLists(Partitioner&);
165 
166 } // namespace
167 } // namespace
168 } // namespace
169 } // namespace
170 
171 #endif
172 #endif
std::vector< SgAsmElfSection * > findSectionsByName(SgAsmInterpretation *, const std::string &)
Get a list of all ELF sections by name.
Contiguous region of a file.
bool tryLink(const std::string &command, const boost::filesystem::path &outputName, std::vector< boost::filesystem::path > inputNames, Sawyer::Message::Stream &errors, FixUndefinedSymbols::Boolean fixUndefinedSymbols=FixUndefinedSymbols::YES)
Try to run a link command.
rose_addr_t gotEntry() const
Value stored in the GOT entry.
Definition: ModulesElf.h:143
bool isObjectFile(const boost::filesystem::path &)
True if named file is an ELF object file.
Represents the file header of an ELF binary container.
bool isStaticArchive(const boost::filesystem::path &)
True if named file is a static library archive.
Base class for machine instructions.
rose_addr_t gotEntryVa() const
Address of the corresponding GOT entry.
Definition: ModulesElf.h:137
std::vector< boost::filesystem::path > extractStaticArchive(const boost::filesystem::path &directory, const boost::filesystem::path &archive)
Extract object files from a static archive.
Information about the procedure lookup table.
Definition: ModulesElf.h:40
void buildMayReturnLists(Partitioner &)
Build may-return white and black lists.
size_t entrySize
Size of each entry in bytes.
Definition: ModulesElf.h:43
Main namespace for the ROSE library.
Base class for matching an instruction pattern.
Definition: Modules.h:82
std::vector< Function::Ptr > findErrorHandlingFunctions(SgAsmElfFileHeader *)
Reads ELF .eh_frames to find function entry addresses.
virtual bool match(const Partitioner &, rose_addr_t anchor)
Attempt to match an instruction pattern.
bool isLinkedImport(const Partitioner &, const Function::Ptr &)
True if function is a linked import.
bool isImport(const Partitioner &, const Function::Ptr &)
True if the function is an import.
rose_addr_t gotVa() const
Address of global offset table.
Definition: ModulesElf.h:131
std::vector< Function::Ptr > findPltFunctions(Partitioner &, SgAsmElfFileHeader *)
Reads ELF PLT sections and returns a list of functions.
size_t nBytesMatched() const
Size of the PLT entry in bytes.
Definition: ModulesElf.h:134
Sawyer::SharedPointer< InstructionMatcher > Ptr
Shared-ownership pointer to an InstructionMatcher.
Definition: Modules.h:85
Converts text to messages.
Definition: Message.h:1396
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:322
Represents an interpretation of a binary container.
PltInfo findPlt(const Partitioner &, SgAsmGenericSection *, SgAsmElfFileHeader *)
Find information about the PLT.
size_t gotEntryNBytes() const
Size of the GOT entry in bytes.
Definition: ModulesElf.h:140
bool isUnlinkedImport(const Partitioner &, const Function::Ptr &)
True if function is a non-linked import.