ModulesX86.h

#ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
#define ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
#include <featureTests.h>
#ifdef ROSE_ENABLE_BINARY_ANALYSIS
#include <Rose/BinaryAnalysis/Partitioner2/BasicTypes.h>
 
#include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
 
namespace Rose {
namespace BinaryAnalysis {
namespace Partitioner2 {
 
namespace ModulesX86 {
 
class MatchStandardPrologue: public FunctionPrologueMatcher {
protected:
    FunctionPtr function_;
protected:
    MatchStandardPrologue();
public:
    ~MatchStandardPrologue();
 
public:
    static Ptr instance();                              
    virtual std::vector<FunctionPtr> functions() const override;
    virtual bool match(const PartitionerConstPtr&, rose_addr_t anchor) override;
};
 
class MatchHotPatchPrologue: public MatchStandardPrologue {
public:
    static Ptr instance() { return Ptr(new MatchHotPatchPrologue); } 
    virtual std::vector<FunctionPtr> functions() const override { return std::vector<FunctionPtr>(1, function_); }
    virtual bool match(const PartitionerConstPtr&, rose_addr_t anchor) override;
};
 
class MatchAbbreviatedPrologue: public FunctionPrologueMatcher {
protected:
    FunctionPtr function_;
protected:
    MatchAbbreviatedPrologue();
public:
    ~MatchAbbreviatedPrologue();
 
public:
    static Ptr instance();                              
    virtual std::vector<FunctionPtr> functions() const override;
    virtual bool match(const PartitionerConstPtr&, rose_addr_t anchor) override;
};
 
class MatchEnterPrologue: public FunctionPrologueMatcher {
protected:
    FunctionPtr function_;
public:
    static Ptr instance() { return Ptr(new MatchEnterPrologue); } 
    virtual std::vector<FunctionPtr> functions() const override { return std::vector<FunctionPtr>(1, function_); }
    virtual bool match(const PartitionerConstPtr&, rose_addr_t anchor) override;
};
 
class MatchRetPadPush: public FunctionPrologueMatcher {
protected:
    FunctionPtr function_;
public:
    static Ptr instance() { return Ptr(new MatchRetPadPush); } 
    virtual std::vector<FunctionPtr> functions() const override { return std::vector<FunctionPtr>(1, function_); }
    virtual bool match(const PartitionerConstPtr&, rose_addr_t anchor) override;
};
 
class FunctionReturnDetector: public BasicBlockCallback {
public:
    static Ptr instance() { return Ptr(new FunctionReturnDetector); } 
    virtual bool operator()(bool chain, const Args&) override;
};
 
class SwitchSuccessors: public BasicBlockCallback {
public:
    enum EntryType { ABSOLUTE, RELATIVE };
 
private:
    Sawyer::Optional<rose_addr_t> tableVa_;             // possible address for jump table
    EntryType entryType_;                               // type of table entries
    size_t entrySizeBytes_;                             // size of each table entry
 
public:
    SwitchSuccessors()
        : entryType_(ABSOLUTE), entrySizeBytes_(4) {}
    static Ptr instance() { return Ptr(new SwitchSuccessors); } 
    virtual bool operator()(bool chain, const Args&) override;
private:
    bool matchPattern1(SgAsmExpression *jmpArg);
    bool matchPattern2(const BasicBlockPtr&, SgAsmInstruction *jmp);
    bool matchPattern3(const PartitionerConstPtr&, const BasicBlockPtr&, SgAsmInstruction *jmp);
    bool matchPatterns(const PartitionerConstPtr&, const BasicBlockPtr&);
};
 
bool matchEnterAnyZero(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
Sawyer::Optional<rose_addr_t> matchJmpConst(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchLeaCxMemBpConst(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchJmpMem(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchMovBpSp(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchMovDiDi(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchPushBp(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
bool matchPushSi(const PartitionerConstPtr&, SgAsmX86Instruction*);
 
std::vector<rose_addr_t> scanCodeAddressTable(const PartitionerConstPtr&, AddressInterval &tableLimits /*in,out*/,
                                              const AddressInterval &targetLimits,
                                              SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes,
                                              Sawyer::Optional<rose_addr_t> probableStartVa = Sawyer::Nothing(),
                                              size_t nSkippable = 0);
 
Sawyer::Optional<rose_addr_t> findTableBase(SgAsmExpression*);
 
 
} // namespace
} // namespace
} // namespace
} // namespace
 
#endif
#endif