Dead code removal. Eliminate dead p-code ops. More...

#include <coreaction.hh>

Inheritance diagram for ghidra::ActionDeadCode:

Public Member Functions
	ActionDeadCode (const string &g)
	Constructor.

virtual Action *	clone (const ActionGroupList &grouplist) const
	Clone the Action. More...

virtual int4	apply (Funcdata &data)
	Make a single attempt to apply this Action. More...

Public Member Functions inherited from ghidra::Action
	Action (uint4 f, const string &nm, const string &g)
	Base constructor for an Action. More...

virtual	~Action (void)
	Destructor.

virtual void	printStatistics (ostream &s) const
	Dump statistics to stream. More...

int4	perform (Funcdata &data)
	Perform this action (if necessary) More...

bool	setBreakPoint (uint4 tp, const string &specify)
	Set a breakpoint on this action. More...

virtual void	clearBreakPoints (void)
	Clear all breakpoints set on this Action.

bool	setWarning (bool val, const string &specify)
	Set a warning on this action. More...

bool	disableRule (const string &specify)
	Disable a specific Rule within this. More...

bool	enableRule (const string &specify)
	Enable a specific Rule within this. More...

const string &	getName (void) const
	Get the Action's name.

const string &	getGroup (void) const
	Get the Action's group.

uint4	getStatus (void) const
	Get the current status of this Action.

uint4	getNumTests (void)
	Get the number of times apply() was invoked.

uint4	getNumApply (void)

virtual void	reset (Funcdata &data)
	Reset the Action for a new function. More...

virtual void	resetStats (void)
	Reset all the counts to zero. More...

virtual int4	print (ostream &s, int4 num, int4 depth) const
	Print a description of this Action to stream. More...

virtual void	printState (ostream &s) const
	Print status to stream. More...

virtual Action *	getSubAction (const string &specify)
	Retrieve a specific sub-action by name. More...

virtual Rule *	getSubRule (const string &specify)
	Retrieve a specific sub-rule by name. More...

Static Private Member Functions
static void	pushConsumed (uintb val, Varnode vn, vector< Varnode > &worklist)

static void	propagateConsumed (vector< Varnode *> &worklist)
	Propagate the consumed value for one Varnode. More...

static bool	neverConsumed (Varnode *vn, Funcdata &data)
	Deal with unconsumed Varnodes. More...

static void	markConsumedParameters (FuncCallSpecs fc, vector< Varnode > &worklist)
	Determine how the given sub-function parameters are consumed. More...

static uintb	gatherConsumedReturn (Funcdata &data)
	Determine how the return values for the given function are consumed. More...

static bool	isEventualConstant (Varnode *vn, int4 addCount, int4 loadCount)
	Determine if the given Varnode may eventually collapse to a constant. More...

static bool	lastChanceLoad (Funcdata &data, vector< Varnode *> &worklist)
	Check if there are any unconsumed LOADs that may be from volatile addresses. More...

Additional Inherited Members
Public Types inherited from ghidra::Action
enum	ruleflags { rule_repeatapply = 4, rule_onceperfunc = 8, rule_oneactperfunc = 16, rule_debug = 32, rule_warnings_on = 64, rule_warnings_given = 128 }
	Boolean behavior properties governing this particular Action. More...

enum	statusflags { status_start =1, status_breakstarthit =2, status_repeat =4, status_mid =8, status_end =16, status_actionbreak =32 }
	Boolean properties describing the status of an action. More...

enum	breakflags { break_start = 1, tmpbreak_start = 2, break_action = 4, tmpbreak_action = 8 }
	Break points associated with an Action. More...

Protected Member Functions inherited from ghidra::Action
void	issueWarning (Architecture *glb)
	Warn that this Action has applied. More...

bool	checkStartBreak (void)
	Check start breakpoint. More...

bool	checkActionBreak (void)
	Check action breakpoint. More...

void	turnOnWarnings (void)
	Enable warnings for this Action.

void	turnOffWarnings (void)
	Disable warnings for this Action.

Protected Attributes inherited from ghidra::Action
int4	lcount
	Changes not including last call to apply()

int4	count
	Number of changes made by this action so far.

uint4	status
	Current status.

uint4	breakpoint
	Breakpoint properties.

uint4	flags
	Behavior properties.

uint4	count_tests
	Number of times apply() has been called.

uint4	count_apply
	Number of times apply() made changes.

string	name
	Name of the action.

string	basegroup
	Base group this action belongs to.

Detailed Description

Dead code removal. Eliminate dead p-code ops.

This is a very fine grained algorithm, it detects usage of individual bits within the Varnode, not just use of the Varnode itself. Each Varnode has a consumed word, which indicates if a bit in the Varnode is being used, and it has two flags layed out as follows:

Varnode::lisconsume = varnode is in the working list
Varnode::vacconsume = vacuously used bit there is a path from the varnode through assignment op outputs down to a varnode that is used

The algorithm works by back propagating the consumed value up from the output of the op to its inputs, starting with a set of seed Varnodes which are marked as completely used (function inputs, branch conditions, ...) For each propagation the particular op being passed through can transform the "bit usage" vector of the output to obtain the input.

Member Function Documentation

◆ apply()

int4 ghidra::ActionDeadCode::apply ( Funcdata & data )

virtual

Make a single attempt to apply this Action.

This is the main entry point for applying changes to a function that are specific to this Action. The method can inspect whatever it wants to decide if the Action does or does not apply. Changes are indicated by incrementing the count field.

Parameters

data	is the function to inspect/modify

Returns: 0 for a complete application, -1 for a partial completion (due to breakpoint)

Implements ghidra::Action.

References ghidra::Funcdata::beginLoc(), ghidra::Funcdata::beginOpAlive(), ghidra::Varnode::clearAddrForce(), ghidra::Varnode::clearConsumeList(), ghidra::Varnode::clearConsumeVacuous(), ghidra::Funcdata::clearDeadOps(), ghidra::Funcdata::clearDeadVarnodes(), ghidra::PcodeOp::clearIndirectSource(), ghidra::PcodeOp::code(), ghidra::CPUI_BRANCHIND, ghidra::CPUI_RETURN, ghidra::Funcdata::deadRemovalAllowed(), ghidra::AddrSpace::doesDeadcode(), ghidra::Funcdata::endLoc(), ghidra::Funcdata::endOpAlive(), ghidra::Funcdata::findJumpTable(), ghidra::Funcdata::getArch(), ghidra::Funcdata::getCallSpecs(), ghidra::Varnode::getConsume(), ghidra::Varnode::getDef(), ghidra::PcodeOp::getIn(), ghidra::PcodeOp::getOut(), ghidra::AddrSpaceManager::getSpace(), ghidra::JumpTable::getSwitchVarConsume(), ghidra::PcodeOp::holdOutput(), ghidra::Varnode::isAddrForce(), ghidra::PcodeOp::isAssignment(), ghidra::Varnode::isAutoLive(), ghidra::PcodeOp::isCall(), ghidra::PcodeOp::isCallWithoutSpec(), ghidra::Varnode::isConsumeVacuous(), ghidra::Varnode::isDirectWrite(), ghidra::Varnode::isWritten(), ghidra::Funcdata::numCalls(), ghidra::PcodeOp::numInput(), ghidra::AddrSpaceManager::numSpaces(), ghidra::Funcdata::opDestroy(), ghidra::Funcdata::opUnsetOutput(), ghidra::Funcdata::seenDeadcode(), and ghidra::Varnode::setConsume().

◆ clone()

virtual Action* ghidra::ActionDeadCode::clone ( const ActionGroupList & grouplist ) const

inlinevirtual

Clone the Action.

If this Action is a member of one of the groups in the grouplist, this returns a clone of the Action, otherwise NULL is returned.

Parameters

grouplist is the list of groups being cloned

Returns: the cloned Action or NULL

Implements ghidra::Action.

References ghidra::ActionStart::apply(), ghidra::ActionGroupList::contains(), and ghidra::Action::getGroup().

◆ gatherConsumedReturn()

uintb ghidra::ActionDeadCode::gatherConsumedReturn ( Funcdata & data )

staticprivate

Determine how the return values for the given function are consumed.

Examine each CPUI_RETURN to see how the Varnode input is consumed. If the function's prototype is locked, assume the Varnode is entirely consumed. If there are no CPUI_RETURN ops, return 0

Parameters

data	is the given function

Returns: the bit mask of what is consumed

References ghidra::Funcdata::beginOp(), ghidra::calc_mask(), ghidra::CPUI_RETURN, ghidra::Funcdata::endOp(), ghidra::Funcdata::getActiveOutput(), ghidra::Funcdata::getFuncProto(), ghidra::PcodeOp::getIn(), ghidra::Varnode::getNZMask(), ghidra::FuncProto::getReturnBytesConsumed(), ghidra::PcodeOp::isDead(), ghidra::FuncProto::isOutputLocked(), ghidra::minimalmask(), and ghidra::PcodeOp::numInput().

◆ isEventualConstant()

bool ghidra::ActionDeadCode::isEventualConstant	(	Varnode *	vn,
		int4	addCount,
		int4	loadCount
	)

staticprivate

Determine if the given Varnode may eventually collapse to a constant.

Recursively check if the Varnode is either:

Copied from a constant
The result of adding constants
Loaded from a pointer that is a constant

Parameters

vn	is the given Varnode
addCount	is the number of CPUI_INT_ADD operations seen so far
loadCount	is the number of CPUI_LOAD operations seen so far

Returns: true if the Varnode (might) collapse to a constant

References ghidra::PcodeOp::code(), ghidra::CPUI_COPY, ghidra::CPUI_INT_ADD, ghidra::CPUI_INT_LEFT, ghidra::CPUI_INT_MULT, ghidra::CPUI_INT_RIGHT, ghidra::CPUI_INT_SEXT, ghidra::CPUI_INT_SRIGHT, ghidra::CPUI_INT_ZEXT, ghidra::CPUI_LOAD, ghidra::Varnode::getDef(), ghidra::PcodeOp::getIn(), ghidra::Varnode::isConstant(), and ghidra::Varnode::isWritten().

◆ lastChanceLoad()

bool ghidra::ActionDeadCode::lastChanceLoad	(	Funcdata &	data,
		vector< Varnode *> &	worklist
	)

staticprivate

Check if there are any unconsumed LOADs that may be from volatile addresses.

It may be too early to remove certain LOAD operations even though their result isn't consumed because it may be of a volatile address with side effects. If a LOAD meets this criteria, it is added to the worklist and true is returned.

Parameters

data	is the function being analyzed
worklist	is the container of consumed Varnodes to further process

Returns: true if there was at least one LOAD added to the worklist

References ghidra::Funcdata::beginOp(), ghidra::CPUI_LOAD, ghidra::Funcdata::endOp(), ghidra::Funcdata::getHeritagePass(), ghidra::PcodeOp::getIn(), ghidra::PcodeOp::getOut(), ghidra::Varnode::isConsumeVacuous(), ghidra::PcodeOp::isDead(), ghidra::Funcdata::isJumptableRecoveryOn(), and ghidra::Varnode::setAutoLiveHold().

◆ markConsumedParameters()

void ghidra::ActionDeadCode::markConsumedParameters	(	FuncCallSpecs *	fc,
		vector< Varnode *> &	worklist
	)

staticprivate

Determine how the given sub-function parameters are consumed.

Set the consume property for each input Varnode of a CPUI_CALL or CPUI_CALLIND. If the prototype is locked, assume parameters are entirely consumed.

Parameters

fc	is the call specification for the given sub-function
worklist	will hold input Varnodes that can propagate their consume property

References ghidra::calc_mask(), ghidra::PcodeOp::getIn(), ghidra::FuncCallSpecs::getInputBytesConsumed(), ghidra::Varnode::getNZMask(), ghidra::FuncCallSpecs::getOp(), ghidra::Varnode::isAutoLive(), ghidra::FuncCallSpecs::isInputActive(), ghidra::FuncProto::isInputLocked(), ghidra::minimalmask(), and ghidra::PcodeOp::numInput().

◆ neverConsumed()

bool ghidra::ActionDeadCode::neverConsumed	(	Varnode *	vn,
		Funcdata &	data
	)

staticprivate

Deal with unconsumed Varnodes.

For a Varnode, none of whose bits are consumed, eliminate the PcodeOp defining it and replace Varnode inputs to ops that officially read it with zero constants.

Parameters

vn	is the Varnode
data	is the function being analyzed

Returns: true if the Varnode was eliminated

References ghidra::Varnode::beginDescend(), ghidra::Varnode::endDescend(), ghidra::Varnode::getDef(), ghidra::Varnode::getSize(), ghidra::PcodeOp::getSlot(), ghidra::PcodeOp::isCall(), ghidra::Funcdata::newConstant(), ghidra::Funcdata::opDestroy(), ghidra::Funcdata::opSetInput(), and ghidra::Funcdata::opUnsetOutput().

◆ propagateConsumed()

void ghidra::ActionDeadCode::propagateConsumed ( vector< Varnode *> & worklist )

staticprivate

Propagate the consumed value for one Varnode.

The Varnode at the top of the stack is popped off, and its current consumed value is propagated backward to the inputs of the op that produced it.

Parameters

worklist is the current stack of dirty Varnodes

References ghidra::calc_mask(), ghidra::Varnode::characterizeOverlap(), ghidra::Varnode::clearConsumeList(), ghidra::PcodeOp::code(), ghidra::CPUI_CALL, ghidra::CPUI_CALLIND, ghidra::CPUI_COPY, ghidra::CPUI_EXTRACT, ghidra::CPUI_INDIRECT, ghidra::CPUI_INSERT, ghidra::CPUI_INT_ADD, ghidra::CPUI_INT_AND, ghidra::CPUI_INT_EQUAL, ghidra::CPUI_INT_LEFT, ghidra::CPUI_INT_LESS, ghidra::CPUI_INT_LESSEQUAL, ghidra::CPUI_INT_MULT, ghidra::CPUI_INT_NEGATE, ghidra::CPUI_INT_NOTEQUAL, ghidra::CPUI_INT_OR, ghidra::CPUI_INT_RIGHT, ghidra::CPUI_INT_SEXT, ghidra::CPUI_INT_SUB, ghidra::CPUI_INT_XOR, ghidra::CPUI_INT_ZEXT, ghidra::CPUI_LZCOUNT, ghidra::CPUI_MULTIEQUAL, ghidra::CPUI_PIECE, ghidra::CPUI_POPCOUNT, ghidra::CPUI_SUBPIECE, ghidra::Varnode::getAddr(), ghidra::Varnode::getConsume(), ghidra::Varnode::getDef(), ghidra::PcodeOp::getIn(), ghidra::Varnode::getNZMask(), ghidra::Varnode::getOffset(), ghidra::PcodeOp::getOpFromConst(), ghidra::PcodeOp::getOut(), ghidra::Varnode::getSize(), ghidra::Varnode::getSpace(), ghidra::AddrSpace::getType(), ghidra::IPTR_IOP, ghidra::Varnode::isConstant(), ghidra::PcodeOp::isDead(), ghidra::PcodeOp::numInput(), and ghidra::PcodeOp::setIndirectSource().

◆ pushConsumed()

void ghidra::ActionDeadCode::pushConsumed	(	uintb	val,
		Varnode *	vn,
		vector< Varnode *> &	worklist
	)

inlinestaticprivate

Given a new consume value to push to a Varnode, determine if this changes the Varnodes consume value and whether to push the Varnode onto the work-list.

Parameters

val	is the new consume value
vn	is the Varnode to push to
worklist	is the current work-list

References ghidra::calc_mask(), ghidra::Varnode::getConsume(), ghidra::Varnode::getSize(), ghidra::Varnode::isConsumeList(), ghidra::Varnode::isConsumeVacuous(), ghidra::Varnode::isWritten(), ghidra::Varnode::setConsume(), ghidra::Varnode::setConsumeList(), and ghidra::Varnode::setConsumeVacuous().

The documentation for this class was generated from the following files:

coreaction.hh
coreaction.cc

Public Member Functions

Static Private Member Functions

Additional Inherited Members

Detailed Description

Member Function Documentation

◆ apply()

◆ clone()

◆ gatherConsumedReturn()

◆ isEventualConstant()

◆ lastChanceLoad()

◆ markConsumedParameters()

◆ neverConsumed()

◆ propagateConsumed()

◆ pushConsumed()