ROSE  0.9.11.30
ModulesX86.h
1 #ifndef ROSE_Partitioner2_ModulesX86_H
2 #define ROSE_Partitioner2_ModulesX86_H
3 
4 #include <Partitioner2/Modules.h>
5 #include <Partitioner2/Thunk.h>
6 
7 namespace Rose {
8 namespace BinaryAnalysis {
9 namespace Partitioner2 {
10 
12 namespace ModulesX86 {
13 
26 protected:
27  Function::Ptr function_;
28 public:
29  static Ptr instance() { return Ptr(new MatchStandardPrologue); }
30  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
31  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
32 };
33 
43 public:
44  static Ptr instance() { return Ptr(new MatchHotPatchPrologue); }
45  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
46  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
47 };
48 
51 protected:
52  Function::Ptr function_;
53 public:
54  static Ptr instance() { return Ptr(new MatchAbbreviatedPrologue); }
55  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
56  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
57 };
58 
61 protected:
62  Function::Ptr function_;
63 public:
64  static Ptr instance() { return Ptr(new MatchEnterPrologue); }
65  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
66  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
67 };
68 
71 protected:
72  Function::Ptr function_;
73 public:
74  static Ptr instance() { return Ptr(new MatchRetPadPush); }
75  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
76  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
77 };
78 
86 public:
87  static Ptr instance() { return Ptr(new FunctionReturnDetector); }
88  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
89 };
90 
96 public:
97  static Ptr instance() { return Ptr(new SwitchSuccessors); }
98  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
99 };
100 
103 
107 Sawyer::Optional<rose_addr_t> matchJmpConst(const Partitioner&, SgAsmX86Instruction*);
108 
110 bool matchLeaCxMemBpConst(const Partitioner&, SgAsmX86Instruction*);
111 
113 bool matchJmpMem(const Partitioner&, SgAsmX86Instruction*);
114 
116 bool matchMovBpSp(const Partitioner&, SgAsmX86Instruction*);
117 
119 bool matchMovDiDi(const Partitioner&, SgAsmX86Instruction*);
120 
122 bool matchPushBp(const Partitioner&, SgAsmX86Instruction*);
123 
125 bool matchPushSi(const Partitioner&, SgAsmX86Instruction*);
126 
134 std::vector<rose_addr_t> scanCodeAddressTable(const Partitioner&, AddressInterval &tableLimits /*in,out*/,
135  const AddressInterval &targetLimits, size_t tableEntrySize);
136 
147 Sawyer::Optional<rose_addr_t> findTableBase(SgAsmExpression*);
148 
149 
150 } // namespace
151 } // namespace
152 } // namespace
153 } // namespace
154 
155 #endif
Match RET followed by PUSH with intervening no-op padding.
Definition: ModulesX86.h:70
Basic block callback to detect "switch" statements.
Definition: ModulesX86.h:95
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:75
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:45
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:39
Base class for matching function prologues.
Definition: Modules.h:108
Sawyer::Optional< rose_addr_t > findTableBase(SgAsmExpression *)
Try to match a base+offset expression.
bool matchMovDiDi(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EDI, EDI" or variant.
STL namespace.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchPushBp(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH EBP" or variant.
Main namespace for the ROSE library.
Basic block callback to detect function returns.
Definition: ModulesX86.h:85
Reference-counting smart pointer.
Definition: SharedPointer.h:67
bool matchLeaCxMemBpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "LEA ECX, [EBP + constant]" or variant.
Name space for the entire library.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
Matches an x86 MOV EDI,EDI; PUSH ESI function prologe.
Definition: ModulesX86.h:50
Sawyer::Optional< rose_addr_t > matchJmpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP constant".
std::vector< rose_addr_t > scanCodeAddressTable(const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, size_t tableEntrySize)
Reads a table of code addresses.
bool matchPushSi(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH SI" or variant.
Represents one Intel x86 machine instruction.
Base class for expressions.
bool matchMovBpSp(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EBP, ESP" or variant.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:30
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchEnterAnyZero(const Partitioner &, SgAsmX86Instruction *)
Matches "ENTER x, 0".
Sawyer::SharedPointer< FunctionPrologueMatcher > Ptr
Shared-ownership pointer to a FunctionPrologueMatcher.
Definition: Modules.h:111
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:65
Sawyer::SharedPointer< BasicBlockCallback > Ptr
Shared-ownership pointer to a BasicBlockCallback.
Definition: Modules.h:42
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:293
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:55
bool matchJmpMem(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP [address]" or variant.
Matches an x86 function prologue with hot patch.
Definition: ModulesX86.h:42