ROSE  0.9.10.103
ModulesX86.h
1 #ifndef ROSE_Partitioner2_ModulesX86_H
2 #define ROSE_Partitioner2_ModulesX86_H
3 
4 #include <Partitioner2/Modules.h>
5 
6 namespace Rose {
7 namespace BinaryAnalysis {
8 namespace Partitioner2 {
9 
11 namespace ModulesX86 {
12 
25 protected:
26  Function::Ptr function_;
27 public:
28  static Ptr instance() { return Ptr(new MatchStandardPrologue); }
29  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
30  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
31 };
32 
42 public:
43  static Ptr instance() { return Ptr(new MatchHotPatchPrologue); }
44  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
45  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
46 };
47 
50 protected:
51  Function::Ptr function_;
52 public:
53  static Ptr instance() { return Ptr(new MatchAbbreviatedPrologue); }
54  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
55  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
56 };
57 
60 protected:
61  Function::Ptr function_;
62 public:
63  static Ptr instance() { return Ptr(new MatchEnterPrologue); }
64  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
65  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
66 };
67 
73 protected:
74  std::vector<Function::Ptr> functions_;
75 public:
76  static Ptr instance() { return Ptr(new MatchThunk); }
77  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return functions_; }
78  virtual bool match(const Partitioner&, rose_addr_t anchor) ROSE_OVERRIDE;
79 };
80 
83 protected:
84  Function::Ptr function_;
85 public:
86  static Ptr instance() { return Ptr(new MatchRetPadPush); }
87  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
88  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
89 };
90 
98 public:
99  static Ptr instance() { return Ptr(new FunctionReturnDetector); }
100  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
101 };
102 
108 public:
109  static Ptr instance() { return Ptr(new SwitchSuccessors); }
110  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
111 };
112 
124 size_t isJmpMemThunk(const Partitioner&, const std::vector<SgAsmInstruction*>&);
125 size_t isLeaJmpThunk(const Partitioner&, const std::vector<SgAsmInstruction*>&);
126 size_t isMovJmpThunk(const Partitioner&, const std::vector<SgAsmInstruction*>&);
127 size_t isJmpImmThunk(const Partitioner&, const std::vector<SgAsmInstruction*>&);
128 size_t isThunk(const Partitioner&, const std::vector<SgAsmInstruction*>&);
132 bool matchEnterAnyZero(const Partitioner&, SgAsmX86Instruction*);
133 
137 Sawyer::Optional<rose_addr_t> matchJmpConst(const Partitioner&, SgAsmX86Instruction*);
138 
140 bool matchLeaCxMemBpConst(const Partitioner&, SgAsmX86Instruction*);
141 
143 bool matchJmpMem(const Partitioner&, SgAsmX86Instruction*);
144 
146 bool matchMovBpSp(const Partitioner&, SgAsmX86Instruction*);
147 
149 bool matchMovDiDi(const Partitioner&, SgAsmX86Instruction*);
150 
152 bool matchPushBp(const Partitioner&, SgAsmX86Instruction*);
153 
155 bool matchPushSi(const Partitioner&, SgAsmX86Instruction*);
156 
158 size_t isThunk(const std::vector<SgAsmInstruction*> &insns);
159 
163 void splitThunkFunctions(Partitioner&);
164 
172 std::vector<rose_addr_t> scanCodeAddressTable(const Partitioner&, AddressInterval &tableLimits /*in,out*/,
173  const AddressInterval &targetLimits, size_t tableEntrySize);
174 
185 Sawyer::Optional<rose_addr_t> findTableBase(SgAsmExpression*);
186 
187 
188 } // namespace
189 } // namespace
190 } // namespace
191 } // namespace
192 
193 #endif
Match RET followed by PUSH with intervening no-op padding.
Definition: ModulesX86.h:82
Basic block callback to detect "switch" statements.
Definition: ModulesX86.h:107
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:87
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:44
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:38
size_t isJmpImmThunk(const Partitioner &, const std::vector< SgAsmInstruction * > &)
Determines whether an instruction sequence begins with a thunk.
Base class for matching function prologues.
Definition: Modules.h:107
Base class for machine instructions.
Sawyer::Optional< rose_addr_t > findTableBase(SgAsmExpression *)
Try to match a base+offset expression.
bool matchMovDiDi(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EDI, EDI" or variant.
size_t isThunk(const Partitioner &, const std::vector< SgAsmInstruction * > &)
Determines whether an instruction sequence begins with a thunk.
STL namespace.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchPushBp(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH EBP" or variant.
Main namespace for the ROSE library.
Basic block callback to detect function returns.
Definition: ModulesX86.h:97
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:77
bool matchLeaCxMemBpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "LEA ECX, [EBP + constant]" or variant.
Name space for the entire library.
Definition: Access.h:13
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
Matches an x86 MOV EDI,EDI; PUSH ESI function prologe.
Definition: ModulesX86.h:49
Sawyer::Optional< rose_addr_t > matchJmpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP constant".
static Ptr instance()
Allocating constructor.
Definition: ModulesX86.h:76
std::vector< rose_addr_t > scanCodeAddressTable(const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, size_t tableEntrySize)
Reads a table of code addresses.
bool matchPushSi(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH SI" or variant.
size_t isJmpMemThunk(const Partitioner &, const std::vector< SgAsmInstruction * > &)
Determines whether an instruction sequence begins with a thunk.
Represents one Intel x86 machine instruction.
virtual bool match(const Partitioner &, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
Base class for expressions.
size_t isMovJmpThunk(const Partitioner &, const std::vector< SgAsmInstruction * > &)
Determines whether an instruction sequence begins with a thunk.
bool matchMovBpSp(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EBP, ESP" or variant.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:29
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchEnterAnyZero(const Partitioner &, SgAsmX86Instruction *)
Matches "ENTER x, 0".
Sawyer::SharedPointer< FunctionPrologueMatcher > Ptr
Shared-ownership pointer to a FunctionPrologueMatcher.
Definition: Modules.h:110
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:64
Sawyer::SharedPointer< BasicBlockCallback > Ptr
Shared-ownership pointer to a BasicBlockCallback.
Definition: Modules.h:41
void splitThunkFunctions(Partitioner &)
Split thunks off from start of functions.
size_t isLeaJmpThunk(const Partitioner &, const std::vector< SgAsmInstruction * > &)
Determines whether an instruction sequence begins with a thunk.
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:293
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:54
bool matchJmpMem(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP [address]" or variant.
Matches an x86 function prologue with hot patch.
Definition: ModulesX86.h:41