ROSE  0.9.10.103
Classes | Functions
Rose::BinaryAnalysis::Partitioner2::ModulesX86 Namespace Reference

Description

Disassembly and partitioning utilities for Intel x86 and amd64.

Classes

class  FunctionReturnDetector
 Basic block callback to detect function returns. More...
 
class  MatchAbbreviatedPrologue
 Matches an x86 MOV EDI,EDI; PUSH ESI function prologe. More...
 
class  MatchEnterPrologue
 Matches an x86 "ENTER xxx, 0" prologue. More...
 
class  MatchHotPatchPrologue
 Matches an x86 function prologue with hot patch. More...
 
class  MatchRetPadPush
 Match RET followed by PUSH with intervening no-op padding. More...
 
class  MatchStandardPrologue
 Matches an x86 function prologue. More...
 
class  MatchThunk
 Match thunk. More...
 
class  SwitchSuccessors
 Basic block callback to detect "switch" statements. More...
 

Functions

bool matchEnterAnyZero (const Partitioner &, SgAsmX86Instruction *)
 Matches "ENTER x, 0".
 
Sawyer::Optional< rose_addr_t > matchJmpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP constant". More...
 
bool matchLeaCxMemBpConst (const Partitioner &, SgAsmX86Instruction *)
 Matches "LEA ECX, [EBP + constant]" or variant. More...
 
bool matchJmpMem (const Partitioner &, SgAsmX86Instruction *)
 Matches "JMP [address]" or variant. More...
 
bool matchMovBpSp (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EBP, ESP" or variant. More...
 
bool matchMovDiDi (const Partitioner &, SgAsmX86Instruction *)
 Matches "MOV EDI, EDI" or variant. More...
 
bool matchPushBp (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH EBP" or variant. More...
 
bool matchPushSi (const Partitioner &, SgAsmX86Instruction *)
 Matches "PUSH SI" or variant. More...
 
size_t isThunk (const std::vector< SgAsmInstruction * > &insns)
 Returns number of leading instructions that form a valid thunk. More...
 
void splitThunkFunctions (Partitioner &)
 Split thunks off from start of functions. More...
 
std::vector< rose_addr_t > scanCodeAddressTable (const Partitioner &, AddressInterval &tableLimits, const AddressInterval &targetLimits, size_t tableEntrySize)
 Reads a table of code addresses. More...
 
Sawyer::Optional< rose_addr_t > findTableBase (SgAsmExpression *)
 Try to match a base+offset expression. More...
 
size_t isJmpMemThunk (const Partitioner &, const std::vector< SgAsmInstruction * > &)
 Determines whether an instruction sequence begins with a thunk. More...
 
size_t isLeaJmpThunk (const Partitioner &, const std::vector< SgAsmInstruction * > &)
 Determines whether an instruction sequence begins with a thunk. More...
 
size_t isMovJmpThunk (const Partitioner &, const std::vector< SgAsmInstruction * > &)
 Determines whether an instruction sequence begins with a thunk. More...
 
size_t isJmpImmThunk (const Partitioner &, const std::vector< SgAsmInstruction * > &)
 Determines whether an instruction sequence begins with a thunk. More...
 
size_t isThunk (const Partitioner &, const std::vector< SgAsmInstruction * > &)
 Determines whether an instruction sequence begins with a thunk. More...
 

Function Documentation

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isJmpMemThunk ( const Partitioner ,
const std::vector< SgAsmInstruction * > &   
)

Determines whether an instruction sequence begins with a thunk.

There are a number of these functions:

The isThunk function tries to match any of the above patterns. The return value is the number of instructions that were matched.

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isLeaJmpThunk ( const Partitioner ,
const std::vector< SgAsmInstruction * > &   
)

Determines whether an instruction sequence begins with a thunk.

There are a number of these functions:

The isThunk function tries to match any of the above patterns. The return value is the number of instructions that were matched.

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isMovJmpThunk ( const Partitioner ,
const std::vector< SgAsmInstruction * > &   
)

Determines whether an instruction sequence begins with a thunk.

There are a number of these functions:

The isThunk function tries to match any of the above patterns. The return value is the number of instructions that were matched.

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isJmpImmThunk ( const Partitioner ,
const std::vector< SgAsmInstruction * > &   
)

Determines whether an instruction sequence begins with a thunk.

There are a number of these functions:

The isThunk function tries to match any of the above patterns. The return value is the number of instructions that were matched.

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isThunk ( const Partitioner ,
const std::vector< SgAsmInstruction * > &   
)

Determines whether an instruction sequence begins with a thunk.

There are a number of these functions:

The isThunk function tries to match any of the above patterns. The return value is the number of instructions that were matched.

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpConst ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "JMP constant".

Returns the constant if matched, nothing otherwise.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchLeaCxMemBpConst ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "LEA ECX, [EBP + constant]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchJmpMem ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "JMP [address]" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovBpSp ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "MOV EBP, ESP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchMovDiDi ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "MOV EDI, EDI" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushBp ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "PUSH EBP" or variant.

bool Rose::BinaryAnalysis::Partitioner2::ModulesX86::matchPushSi ( const Partitioner ,
SgAsmX86Instruction  
)

Matches "PUSH SI" or variant.

size_t Rose::BinaryAnalysis::Partitioner2::ModulesX86::isThunk ( const std::vector< SgAsmInstruction * > &  insns)

Returns number of leading instructions that form a valid thunk.

void Rose::BinaryAnalysis::Partitioner2::ModulesX86::splitThunkFunctions ( Partitioner )

Split thunks off from start of functions.

Splits as many thunks as possible off the front of all functions currently attached to the partitioner's CFG.

std::vector<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::scanCodeAddressTable ( const Partitioner ,
AddressInterval tableLimits,
const AddressInterval targetLimits,
size_t  tableEntrySize 
)

Reads a table of code addresses.

Reads a table that starts at the lower limit of tableLimits and does not extend past the upper limit. Each entry in the table is an instruction address of tableEntrySize bytes and the entry must exist in read-only memory. The address stored in the entry must be within the targetLimits interval and must be an address that is mapped with execute permission. As many entries as possible are read into the return vector. Upon return, the tableLimits is adjusted to indicate the actual location of the table.

Sawyer::Optional<rose_addr_t> Rose::BinaryAnalysis::Partitioner2::ModulesX86::findTableBase ( SgAsmExpression )

Try to match a base+offset expression.

Matches expressions like:

  • base + register
  • base + register * size
  • [ base + register ]
  • [ base + register * size ]

Returns the numeric value of base or nothing if the expression is not a recognized form.