ROSE  0.11.87.0
ModulesX86.h
1 #ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
2 #define ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
3 #include <featureTests.h>
4 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
5 
6 #include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
7 #include <Rose/BinaryAnalysis/Partitioner2/Thunk.h>
8 
9 namespace Rose {
10 namespace BinaryAnalysis {
11 namespace Partitioner2 {
12 
14 namespace ModulesX86 {
15 
28 protected:
29  Function::Ptr function_;
30 public:
31  static Ptr instance() { return Ptr(new MatchStandardPrologue); }
32  virtual std::vector<Function::Ptr> functions() const override { return std::vector<Function::Ptr>(1, function_); }
33  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override;
34 };
35 
45 public:
46  static Ptr instance() { return Ptr(new MatchHotPatchPrologue); }
47  virtual std::vector<Function::Ptr> functions() const override { return std::vector<Function::Ptr>(1, function_); }
48  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override;
49 };
50 
53 protected:
54  Function::Ptr function_;
55 public:
56  static Ptr instance() { return Ptr(new MatchAbbreviatedPrologue); }
57  virtual std::vector<Function::Ptr> functions() const override { return std::vector<Function::Ptr>(1, function_); }
58  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override;
59 };
60 
63 protected:
64  Function::Ptr function_;
65 public:
66  static Ptr instance() { return Ptr(new MatchEnterPrologue); }
67  virtual std::vector<Function::Ptr> functions() const override { return std::vector<Function::Ptr>(1, function_); }
68  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override;
69 };
70 
73 protected:
74  Function::Ptr function_;
75 public:
76  static Ptr instance() { return Ptr(new MatchRetPadPush); }
77  virtual std::vector<Function::Ptr> functions() const override { return std::vector<Function::Ptr>(1, function_); }
78  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override;
79 };
80 
88 public:
89  static Ptr instance() { return Ptr(new FunctionReturnDetector); }
90  virtual bool operator()(bool chain, const Args&) override;
91 };
92 
98 public:
99  enum EntryType { ABSOLUTE, RELATIVE };
100 
101 private:
102  Sawyer::Optional<rose_addr_t> tableVa_; // possible address for jump table
103  EntryType entryType_; // type of table entries
104  size_t entrySizeBytes_; // size of each table entry
105 
106 public:
108  : entryType_(ABSOLUTE), entrySizeBytes_(4) {}
109  static Ptr instance() { return Ptr(new SwitchSuccessors); }
110  virtual bool operator()(bool chain, const Args&) override;
111 private:
112  bool matchPattern1(SgAsmExpression *jmpArg);
113  bool matchPattern2(const BasicBlockPtr&, SgAsmInstruction *jmp);
114  bool matchPattern3(const Partitioner&, const BasicBlockPtr&, SgAsmInstruction *jmp);
115  bool matchPatterns(const Partitioner&, const BasicBlockPtr&);
116 };
117 
120 
125 
128 
131 
134 
137 
140 
143 
159 std::vector<rose_addr_t> scanCodeAddressTable(const Partitioner&, AddressInterval &tableLimits /*in,out*/,
160  const AddressInterval &targetLimits,
161  SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes,
163  size_t nSkippable = 0);
164 
176 
177 
178 } // namespace
179 } // namespace
180 } // namespace
181 } // namespace
182 
183 #endif
184 #endif
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override
Attempt to match an instruction pattern.
Match RET followed by PUSH with intervening no-op padding.
Definition: ModulesX86.h:72
Basic block callback to detect "switch" statements.
Definition: ModulesX86.h:97
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override
Attempt to match an instruction pattern.
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:42
Base class for matching function prologues.
Definition: Modules.h:111
virtual std::vector< Function::Ptr > functions() const override
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:32
Base class for machine instructions.
virtual std::vector< Function::Ptr > functions() const override
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:47
Sawyer::Optional< rose_addr_t > findTableBase(SgAsmExpression *)
Try to match a base+offset expression.
bool matchMovDiDi(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EDI, EDI" or variant.
virtual std::vector< Function::Ptr > functions() const override
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:67
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override
Attempt to match an instruction pattern.
virtual bool operator()(bool chain, const Args &) override
Callback method.
bool matchPushBp(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH EBP" or variant.
Main namespace for the ROSE library.
Basic block callback to detect function returns.
Definition: ModulesX86.h:87
std::vector< rose_addr_t > scanCodeAddressTable(const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes, Sawyer::Optional< rose_addr_t > probableStartVa=Sawyer::Nothing(), size_t nSkippable=0)
Reads a table of code addresses.
bool matchLeaCxMemBpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "LEA ECX, [EBP + constant]" or variant.
Matches an x86 MOV EDI,EDI; PUSH ESI function prologe.
Definition: ModulesX86.h:52
virtual bool operator()(bool chain, const Args &) override
Callback method.
Sawyer::Optional< rose_addr_t > matchJmpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP constant".
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override
Attempt to match an instruction pattern.
virtual std::vector< Function::Ptr > functions() const override
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:77
bool matchPushSi(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH SI" or variant.
Represents one Intel x86 machine instruction.
Base class for expressions.
bool matchMovBpSp(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EBP, ESP" or variant.
bool matchEnterAnyZero(const Partitioner &, SgAsmX86Instruction *)
Matches "ENTER x, 0".
Sawyer::SharedPointer< FunctionPrologueMatcher > Ptr
Shared-ownership pointer to a FunctionPrologueMatcher.
Definition: Modules.h:114
Sawyer::SharedPointer< BasicBlockCallback > Ptr
Shared-ownership pointer to a BasicBlockCallback.
Definition: Modules.h:45
Represents no value.
Definition: Optional.h:32
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:289
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) override
Attempt to match an instruction pattern.
bool matchJmpMem(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP [address]" or variant.
Matches an x86 function prologue with hot patch.
Definition: ModulesX86.h:44
virtual std::vector< Function::Ptr > functions() const override
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:57