ROSE  0.9.10.230
Classes | Functions
Rose::BinaryAnalysis::Partitioner2::ModulesX86 Namespace Reference

Description

Disassembly and partitioning utilities for Intel x86 and amd64.

Classes

class  FunctionReturnDetector
 Basic block callback to detect function returns. More...
 
class  MatchAbbreviatedPrologue
 Matches an x86 MOV EDI,EDI; PUSH ESI function prologe. More...
 
class  MatchEnterPrologue
 Matches an x86 "ENTER xxx, 0" prologue. More...
 
class  MatchHotPatchPrologue
 Matches an x86 function prologue with hot patch. More...
 
class  MatchRetPadPush
 Match RET followed by PUSH with intervening no-op padding. More...
 
class  MatchStandardPrologue
 Matches an x86 function prologue. More...
 
class  SwitchSuccessors
 Basic block callback to detect "switch" statements. More...
 

Functions

bool matchEnterAnyZero (const Partitioner &, SgAsmX86Instruction *)
 Matches "ENTER x, 0".
 
Sawyer::Optional< rose_addr_t > matchJmpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP constant". More...
 
bool matchLeaCxMemBpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "LEA ECX, [EBP + constant]" or variant. More...
 
bool matchJmpMem (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP [address]" or variant. More...
 
bool matchMovBpSp (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EBP, ESP" or variant. More...
 
bool matchMovDiDi (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EDI, EDI" or variant. More...
 
bool matchPushBp (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH EBP" or variant. More...
 
bool matchPushSi (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH SI" or variant. More...
 
std::vector< rose_addr_t > scanCodeAddressTable (const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, size_t tableEntrySize)
 Reads a table of code addresses. More...
 
Sawyer::Optional< rose_addr_t > findTableBase (SgAsmExpression *)
 Try to match a base+offset expression. More...
 

Function Documentation

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpConst ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "JMP constant".

Returns the constant if matched, nothing otherwise.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchLeaCxMemBpConst ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "LEA ECX, [EBP + constant]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpMem ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "JMP [address]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovBpSp ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "MOV EBP, ESP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovDiDi ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "MOV EDI, EDI" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushBp ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "PUSH EBP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushSi ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "PUSH SI" or variant.

std::vector<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::scanCodeAddressTable ( const Partitioner ,
AddressInterval tableLimits,
const AddressInterval targetLimits,
size_t  tableEntrySize 
)

Reads a table of code addresses.

Reads a table that starts at the lower limit of tableLimits and does not extend past the upper limit. Each entry in the table is an instruction address of tableEntrySize bytes and the entry must exist in read-only memory. The address stored in the entry must be within the targetLimits interval and must be an address that is mapped with execute permission. As many entries as possible are read into the return vector. Upon return, the tableLimits is adjusted to indicate the actual location of the table.

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::findTableBase ( SgAsmExpression )

Try to match a base+offset expression.

Matches expressions like:

  • base + register
  • base + register * size
  • [ base + register ]
  • [ base + register * size ]

Returns the numeric value of base or nothing if the expression is not a recognized form.