ROSE  0.11.21.0
ModulesX86.h
1 #ifndef ROSE_Partitioner2_ModulesX86_H
2 #define ROSE_Partitioner2_ModulesX86_H
3 
4 #include <featureTests.h>
5 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
6 
7 #include <Partitioner2/Modules.h>
8 #include <Partitioner2/Thunk.h>
9 
10 namespace Rose {
11 namespace BinaryAnalysis {
12 namespace Partitioner2 {
13 
15 namespace ModulesX86 {
16 
29 protected:
30  Function::Ptr function_;
31 public:
32  static Ptr instance() { return Ptr(new MatchStandardPrologue); }
33  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
34  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
35 };
36 
46 public:
47  static Ptr instance() { return Ptr(new MatchHotPatchPrologue); }
48  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
49  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
50 };
51 
54 protected:
55  Function::Ptr function_;
56 public:
57  static Ptr instance() { return Ptr(new MatchAbbreviatedPrologue); }
58  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
59  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
60 };
61 
64 protected:
65  Function::Ptr function_;
66 public:
67  static Ptr instance() { return Ptr(new MatchEnterPrologue); }
68  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
69  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
70 };
71 
74 protected:
75  Function::Ptr function_;
76 public:
77  static Ptr instance() { return Ptr(new MatchRetPadPush); }
78  virtual std::vector<Function::Ptr> functions() const ROSE_OVERRIDE { return std::vector<Function::Ptr>(1, function_); }
79  virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE;
80 };
81 
89 public:
90  static Ptr instance() { return Ptr(new FunctionReturnDetector); }
91  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
92 };
93 
99 public:
100  enum EntryType { ABSOLUTE, RELATIVE };
101 
102 private:
103  Sawyer::Optional<rose_addr_t> tableVa_; // possible address for jump table
104  EntryType entryType_; // type of table entries
105  size_t entrySizeBytes_; // size of each table entry
106 
107 public:
109  : entryType_(ABSOLUTE), entrySizeBytes_(4) {}
110  static Ptr instance() { return Ptr(new SwitchSuccessors); }
111  virtual bool operator()(bool chain, const Args&) ROSE_OVERRIDE;
112 private:
113  bool matchPattern1(SgAsmExpression *jmpArg);
114  bool matchPattern2(const BasicBlockPtr&, SgAsmInstruction *jmp);
115  bool matchPattern3(const Partitioner&, const BasicBlockPtr&, SgAsmInstruction *jmp);
116  bool matchPatterns(const Partitioner&, const BasicBlockPtr&);
117 };
118 
120 bool matchEnterAnyZero(const Partitioner&, SgAsmX86Instruction*);
121 
125 Sawyer::Optional<rose_addr_t> matchJmpConst(const Partitioner&, SgAsmX86Instruction*);
126 
128 bool matchLeaCxMemBpConst(const Partitioner&, SgAsmX86Instruction*);
129 
131 bool matchJmpMem(const Partitioner&, SgAsmX86Instruction*);
132 
134 bool matchMovBpSp(const Partitioner&, SgAsmX86Instruction*);
135 
137 bool matchMovDiDi(const Partitioner&, SgAsmX86Instruction*);
138 
140 bool matchPushBp(const Partitioner&, SgAsmX86Instruction*);
141 
143 bool matchPushSi(const Partitioner&, SgAsmX86Instruction*);
144 
160 std::vector<rose_addr_t> scanCodeAddressTable(const Partitioner&, AddressInterval &tableLimits /*in,out*/,
161  const AddressInterval &targetLimits,
162  SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes,
163  Sawyer::Optional<rose_addr_t> probableStartVa = Sawyer::Nothing(),
164  size_t nSkippable = 0);
165 
176 Sawyer::Optional<rose_addr_t> findTableBase(SgAsmExpression*);
177 
178 
179 } // namespace
180 } // namespace
181 } // namespace
182 } // namespace
183 
184 #endif
185 #endif
Match RET followed by PUSH with intervening no-op padding.
Definition: ModulesX86.h:73
Basic block callback to detect "switch" statements.
Definition: ModulesX86.h:98
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:78
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:48
Base class for adjusting basic blocks during discovery.
Definition: Modules.h:43
Base class for matching function prologues.
Definition: Modules.h:112
Base class for machine instructions.
Sawyer::Optional< rose_addr_t > findTableBase(SgAsmExpression *)
Try to match a base+offset expression.
bool matchMovDiDi(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EDI, EDI" or variant.
STL namespace.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchPushBp(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH EBP" or variant.
Main namespace for the ROSE library.
Basic block callback to detect function returns.
Definition: ModulesX86.h:88
std::vector< rose_addr_t > scanCodeAddressTable(const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes, Sawyer::Optional< rose_addr_t > probableStartVa=Sawyer::Nothing(), size_t nSkippable=0)
Reads a table of code addresses.
bool matchLeaCxMemBpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "LEA ECX, [EBP + constant]" or variant.
Name space for the entire library.
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual bool operator()(bool chain, const Args &) ROSE_OVERRIDE
Callback method.
Matches an x86 MOV EDI,EDI; PUSH ESI function prologe.
Definition: ModulesX86.h:53
Sawyer::Optional< rose_addr_t > matchJmpConst(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP constant".
bool matchPushSi(const Partitioner &, SgAsmX86Instruction *)
Matches "PUSH SI" or variant.
Represents one Intel x86 machine instruction.
Base class for expressions.
bool matchMovBpSp(const Partitioner &, SgAsmX86Instruction *)
Matches "MOV EBP, ESP" or variant.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:33
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
bool matchEnterAnyZero(const Partitioner &, SgAsmX86Instruction *)
Matches "ENTER x, 0".
Sawyer::SharedPointer< FunctionPrologueMatcher > Ptr
Shared-ownership pointer to a FunctionPrologueMatcher.
Definition: Modules.h:115
virtual bool match(const Partitioner &partitioner, rose_addr_t anchor) ROSE_OVERRIDE
Attempt to match an instruction pattern.
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:68
Sawyer::SharedPointer< BasicBlockCallback > Ptr
Shared-ownership pointer to a BasicBlockCallback.
Definition: Modules.h:46
Partitions instructions into basic blocks and functions.
Definition: Partitioner.h:322
virtual std::vector< Function::Ptr > functions() const ROSE_OVERRIDE
Returns the function(s) for the previous successful match.
Definition: ModulesX86.h:58
bool matchJmpMem(const Partitioner &, SgAsmX86Instruction *)
Matches "JMP [address]" or variant.
Matches an x86 function prologue with hot patch.
Definition: ModulesX86.h:45