Classes | Functions
Rose::BinaryAnalysis::Partitioner2::ModulesX86 Namespace Reference


Disassembly and partitioning utilities for Intel x86 and amd64.


class  FunctionReturnDetector
 Basic block callback to detect function returns. More...
class  MatchAbbreviatedPrologue
 Matches an x86 MOV EDI,EDI; PUSH ESI function prologe. More...
class  MatchEnterPrologue
 Matches an x86 "ENTER xxx, 0" prologue. More...
class  MatchHotPatchPrologue
 Matches an x86 function prologue with hot patch. More...
class  MatchRetPadPush
 Match RET followed by PUSH with intervening no-op padding. More...
class  MatchStandardPrologue
 Matches an x86 function prologue. More...
class  SwitchSuccessors
 Basic block callback to detect "switch" statements. More...


bool matchEnterAnyZero (const Partitioner &, SgAsmX86Instruction *)
 Matches "ENTER x, 0".
Sawyer::Optional< rose_addr_t > matchJmpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP constant". More...
bool matchLeaCxMemBpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "LEA ECX, [EBP + constant]" or variant. More...
bool matchJmpMem (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP [address]" or variant. More...
bool matchMovBpSp (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EBP, ESP" or variant. More...
bool matchMovDiDi (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EDI, EDI" or variant. More...
bool matchPushBp (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH EBP" or variant. More...
bool matchPushSi (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH SI" or variant. More...
std::vector< rose_addr_t > scanCodeAddressTable (const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes, Sawyer::Optional< rose_addr_t > probableStartVa=Sawyer::Nothing(), size_t nSkippable=0)
 Reads a table of code addresses. More...
Sawyer::Optional< rose_addr_t > findTableBase (SgAsmExpression *)
 Try to match a base+offset expression. More...

Function Documentation

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpConst ( const Partitioner ,

Matches "JMP constant".

Returns the constant if matched, nothing otherwise.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchLeaCxMemBpConst ( const Partitioner ,

Matches "LEA ECX, [EBP + constant]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpMem ( const Partitioner ,

Matches "JMP [address]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovBpSp ( const Partitioner ,

Matches "MOV EBP, ESP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovDiDi ( const Partitioner ,

Matches "MOV EDI, EDI" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushBp ( const Partitioner ,

Matches "PUSH EBP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushSi ( const Partitioner ,

Matches "PUSH SI" or variant.

std::vector<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::scanCodeAddressTable ( const Partitioner ,
AddressInterval tableLimits,
const AddressInterval targetLimits,
SwitchSuccessors::EntryType  tableEntryType,
size_t  tableEntrySizeBytes,
Sawyer::Optional< rose_addr_t >  probableStartVa = Sawyer::Nothing(),
size_t  nSkippable = 0 

Reads a table of code addresses.

Reads a table of code addresses from within the tableLimits memory range starting at either the specified probableStartVa or the beginning of the tableLimits. If nSkippable is positive, up to that many invalid entries can be skipped before actual valid entries are found. If no entries are skipped and the probableStartVa is larger than the minimum tableLimits then we also look backward from the probableStartVa to consume as many valid table entries as possible within the tableLimits. An entry is valid if it exists in read-only memory and its value (the target address) falls within targetLimits.

If valid table entries are found, and the table is some arbitrarily small number of entries, then it can be followed by zero or more single-byte indexes into the table entries.

Upon return, the tableLimits is adjusted to be the addresses where valid table entries were found unioned with the addresses of the optional post-table indexes. The return value is the valid table entries in the order they occur in the table.

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::findTableBase ( SgAsmExpression )

Try to match a base+offset expression.

Matches expressions like:

  • base + register
  • base + register * size
  • [ base + register ]
  • [ base + register * size ]

Returns the numeric value of base or nothing if the expression is not a recognized form.