ROSE 0.11.145.192
Public Member Functions | Static Public Member Functions | List of all members
Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue Class Reference

Description

Matches an x86 function prologue with hot patch.

A hot-patch prologue is a MOV EDI, EDI instruction followed by a standard prologue. These are generated by Microsoft compilers.

Definition at line 49 of file ModulesX86.h.

#include <Rose/BinaryAnalysis/Partitioner2/ModulesX86.h>

Inheritance diagram for Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue:
Inheritance graph
[legend]
Collaboration diagram for Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue:
Collaboration graph
[legend]

Public Member Functions

virtual std::vector< FunctionPtrfunctions () const override
 Returns the function(s) for the previous successful match.
 
virtual bool match (const PartitionerConstPtr &, rose_addr_t anchor) override
 Attempt to match an instruction pattern.
 
- Public Member Functions inherited from Sawyer::SharedObject
 SharedObject ()
 Default constructor.
 
 SharedObject (const SharedObject &)
 Copy constructor.
 
virtual ~SharedObject ()
 Virtual destructor.
 
SharedObjectoperator= (const SharedObject &)
 Assignment.
 

Static Public Member Functions

static Ptr instance ()
 Allocating constructor.
 
- Static Public Member Functions inherited from Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchStandardPrologue
static Ptr instance ()
 Allocating constructor.
 

Additional Inherited Members

- Public Types inherited from Rose::BinaryAnalysis::Partitioner2::FunctionPrologueMatcher
using Ptr = FunctionPrologueMatcherPtr
 Shared-ownership pointer to a FunctionPrologueMatcher.
 
- Public Types inherited from Rose::BinaryAnalysis::Partitioner2::InstructionMatcher
typedef Sawyer::SharedPointer< InstructionMatcherPtr
 Shared-ownership pointer to an InstructionMatcher.
 
- Protected Attributes inherited from Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchStandardPrologue
FunctionPtr function_
 

Member Function Documentation

◆ instance()

static Ptr Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue::instance ( )
inlinestatic

Allocating constructor.

Definition at line 51 of file ModulesX86.h.

◆ functions()

virtual std::vector< FunctionPtr > Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue::functions ( ) const
inlineoverridevirtual

Returns the function(s) for the previous successful match.

If the previous call to match returned true then this method should return at least one function for the matched function prologue. Although the function returned by this method is often at the same address as the anchor for the match, it need not be. For instance, a matcher could match against some amount of padding followed the instructions for setting up the stack frame, in which case it might choose to return a function that starts at the stack frame setup instructions and includes the padding as static data.

Multiple functions can be created. For instance, if the matcher matches a thunk then two functions will likely be created: the thunk itself, and the function to which it points.

The partitioner will never call Function Declarations without first having called match.

Reimplemented from Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchStandardPrologue.

Definition at line 52 of file ModulesX86.h.

◆ match()

virtual bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchHotPatchPrologue::match ( const PartitionerConstPtr ,
rose_addr_t  anchor 
)
overridevirtual

Attempt to match an instruction pattern.

If the subclass implementation is able to match instructions, bytes, etc. anchored at the anchor address then it should return true, otherwise false. The anchor address will always be valid for the situation (e.g., if the partitioner is trying to match something anchored at an address that is not in the CFG, then the anchor will be such an address; if it is trying to match something that is definitely an instruction then the address will be mapped with execute permission; etc.). This precondition makes writing matchers that match against a single address easier to write, but matchers that match at additional locations must explicitly check those other locations with the same conditions (FIXME[Robb P. Matzke 2014-08-04]: perhaps we should pass those conditions as an argument).

Reimplemented from Rose::BinaryAnalysis::Partitioner2::ModulesX86::MatchStandardPrologue.


The documentation for this class was generated from the following file: