ROSE  0.11.87.0
ModulesElf.h
1 #ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesElf_H
2 #define ROSE_BinaryAnalysis_Partitioner2_ModulesElf_H
3 #include <featureTests.h>
4 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
5 
6 #include <Rose/BinaryAnalysis/Partitioner2/BasicTypes.h>
7 #include <Rose/BinaryAnalysis/Partitioner2/Function.h>
8 #include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
9 
10 #include <boost/filesystem.hpp>
11 
12 namespace Rose {
13 namespace BinaryAnalysis {
14 namespace Partitioner2 {
15 
17 namespace ModulesElf {
18 
25 std::vector<Function::Ptr> findErrorHandlingFunctions(SgAsmElfFileHeader*);
26 std::vector<Function::Ptr> findErrorHandlingFunctions(SgAsmInterpretation*);
27 size_t findErrorHandlingFunctions(SgAsmElfFileHeader*, std::vector<Function::Ptr>&);
33 std::vector<Function::Ptr> findPltFunctions(Partitioner&, SgAsmElfFileHeader*);
34 std::vector<Function::Ptr> findPltFunctions(Partitioner&, SgAsmInterpretation*);
35 size_t findPltFunctions(Partitioner&, SgAsmElfFileHeader*, std::vector<Function::Ptr>&);
39 struct PltInfo {
40  SgAsmGenericSection *section;
41  size_t firstOffset;
42  size_t entrySize;
44  PltInfo()
45  : section(NULL), firstOffset(0), entrySize(0) {}
46 };
47 
50 
54 std::vector<SgAsmElfSection*> findSectionsByName(SgAsmInterpretation*, const std::string&);
55 
60 bool isImport(const Partitioner&, const Function::Ptr&);
61 
66 bool isLinkedImport(const Partitioner&, const Function::Ptr&);
67 
71 bool isUnlinkedImport(const Partitioner&, const Function::Ptr&);
72 
77 bool isObjectFile(const boost::filesystem::path&);
78 
83 bool isStaticArchive(const boost::filesystem::path&);
84 
86 namespace FixUndefinedSymbols {
88 enum Boolean {
89  NO,
90  YES
91 };
92 } // namespace
93 
98 bool tryLink(const std::string &command, const boost::filesystem::path &outputName,
99  std::vector<boost::filesystem::path> inputNames, Sawyer::Message::Stream &errors,
101 
107 std::vector<boost::filesystem::path>
108 extractStaticArchive(const boost::filesystem::path &directory, const boost::filesystem::path &archive);
109 
113  // These data members are generally optional, and filled in as they're matched.
114  rose_addr_t gotVa_ = 0; // address of global offset table
115  rose_addr_t gotEntryVa_ = 0; // address through which an indirect branch branches
116  size_t gotEntryNBytes_ = 0; // size of the global offset table entry in bytes
117  rose_addr_t gotEntry_ = 0; // address read from the GOT if the address is mapped (or zero)
118  size_t nBytesMatched_ = 0; // number of bytes matched for PLT entry
119  rose_addr_t functionNumber_ = 0; // function number argument for the dynamic linker (usually a push)
120  rose_addr_t pltEntryAlignment_ = 1; // must PLT entries be aligned, and by how much?
121 
122 public:
123  explicit PltEntryMatcher(rose_addr_t gotVa)
124  : gotVa_(gotVa) {}
125  static Ptr instance(rose_addr_t gotVa) {
126  return Ptr(new PltEntryMatcher(gotVa));
127  }
128  virtual bool match(const Partitioner&, rose_addr_t anchor);
129 
131  rose_addr_t gotVa() const { return gotVa_; }
132 
134  size_t nBytesMatched() const { return nBytesMatched_; }
135 
137  rose_addr_t pltEntryAlignment() const { return pltEntryAlignment_; }
138 
140  rose_addr_t gotEntryVa() const { return gotEntryVa_; }
141 
143  size_t gotEntryNBytes() const { return gotEntryNBytes_; }
144 
146  rose_addr_t gotEntry() const { return gotEntry_; }
147 
148  // [Robb Matzke 2018-04-06]: deprecated: use gotEntryVa
149  rose_addr_t memAddress() const { return gotEntryVa_; }
150 
151 private:
152  SgAsmInstruction* matchNop(const Partitioner&, rose_addr_t va);
153  SgAsmInstruction* matchPush(const Partitioner&, rose_addr_t var, rose_addr_t &n /*out*/);
154  SgAsmInstruction* matchDirectJump(const Partitioner&, rose_addr_t va);
155  SgAsmInstruction* matchIndirectJump(const Partitioner&, rose_addr_t va,
156  rose_addr_t &indirectVa /*out*/, size_t &indirectNBytes /*out*/);
157  SgAsmInstruction* matchIndirectJumpEbx(const Partitioner&, rose_addr_t va,
158  rose_addr_t &offsetFromEbx /*out*/, size_t &indirectNBytes /*out*/);
159  SgAsmInstruction* matchAarch64Adrp(const Partitioner&, rose_addr_t va, rose_addr_t &value /*out*/);
160  SgAsmInstruction* matchAarch64Ldr(const Partitioner&, rose_addr_t va, rose_addr_t &indirectVa /*in,out*/,
161  rose_addr_t &indirectNBytes /*out*/);
162  SgAsmInstruction* matchAarch64Add(const Partitioner&, rose_addr_t va);
163  SgAsmInstruction* matchAarch64Br(const Partitioner&, rose_addr_t va);
164  SgAsmInstruction* matchAarch32CopyPcToIp(const Partitioner&, rose_addr_t va, uint32_t &result);
165  SgAsmInstruction* matchAarch32AddConstToIp(const Partitioner&, rose_addr_t va, uint32_t &addend);
166  SgAsmInstruction* matchAarch32IndirectBranch(const Partitioner&, rose_addr_t va, uint32_t &addend);
167 };
168 
170 void buildMayReturnLists(Partitioner&);
171 
172 } // namespace
173 } // namespace
174 } // namespace
175 } // namespace
176 
177 #endif
178 #endif
std::vector< SgAsmElfSection * > findSectionsByName(SgAsmInterpretation *, const std::string &)
Get a list of all ELF sections by name.
Contiguous region of a file.
bool tryLink(const std::string &command, const boost::filesystem::path &outputName, std::vector< boost::filesystem::path > inputNames, Sawyer::Message::Stream &errors, FixUndefinedSymbols::Boolean fixUndefinedSymbols=FixUndefinedSymbols::YES)
Try to run a link command.
rose_addr_t gotEntry() const
Value stored in the GOT entry.
Definition: ModulesElf.h:146
bool isObjectFile(const boost::filesystem::path &)
True if named file is an ELF object file.
Represents the file header of an ELF binary container.
bool isStaticArchive(const boost::filesystem::path &)
True if named file is a static library archive.
Base class for machine instructions.
rose_addr_t gotEntryVa() const
Address of the corresponding GOT entry.
Definition: ModulesElf.h:140
std::vector< boost::filesystem::path > extractStaticArchive(const boost::filesystem::path &directory, const boost::filesystem::path &archive)
Extract object files from a static archive.
Information about the procedure lookup table.
Definition: ModulesElf.h:39
void buildMayReturnLists(Partitioner &)
Build may-return white and black lists.
size_t entrySize
Size of each entry in bytes.
Definition: ModulesElf.h:42
Main namespace for the ROSE library.
Base class for matching an instruction pattern.
Definition: Modules.h:81
std::vector< Function::Ptr > findErrorHandlingFunctions(SgAsmElfFileHeader *)
Reads ELF .eh_frames to find function entry addresses.
virtual bool match(const Partitioner &, rose_addr_t anchor)
Attempt to match an instruction pattern.
rose_addr_t pltEntryAlignment() const
Alignment of PLT entries w.r.t.
Definition: ModulesElf.h:137
bool isLinkedImport(const Partitioner &, const Function::Ptr &)
True if function is a linked import.
bool isImport(const Partitioner &, const Function::Ptr &)
True if the function is an import.
rose_addr_t gotVa() const
Address of global offset table.
Definition: ModulesElf.h:131
std::vector< Function::Ptr > findPltFunctions(Partitioner &, SgAsmElfFileHeader *)
Reads ELF PLT sections and returns a list of functions.
size_t nBytesMatched() const
Size of the PLT entry in bytes.
Definition: ModulesElf.h:134
Sawyer::SharedPointer< InstructionMatcher > Ptr
Shared-ownership pointer to an InstructionMatcher.
Definition: Modules.h:84
Converts text to messages.
Definition: Message.h:1396
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:289
Represents an interpretation of a binary container.
PltInfo findPlt(const Partitioner &, SgAsmGenericSection *, SgAsmElfFileHeader *)
Find information about the PLT.
size_t gotEntryNBytes() const
Size of the GOT entry in bytes.
Definition: ModulesElf.h:143
bool isUnlinkedImport(const Partitioner &, const Function::Ptr &)
True if function is a non-linked import.