decompiler  1.0.0
Public Member Functions | Static Private Member Functions | Private Attributes | List of all members
ghidra::ActionInferTypes Class Reference

Infer and propagate data-types. More...

#include <coreaction.hh>

Inheritance diagram for ghidra::ActionInferTypes:
ghidra::Action

Public Member Functions

 ActionInferTypes (const string &g)
 Constructor.
 
virtual void reset (Funcdata &data)
 Reset the Action for a new function. More...
 
virtual Actionclone (const ActionGroupList &grouplist) const
 Clone the Action. More...
 
virtual int4 apply (Funcdata &data)
 Make a single attempt to apply this Action. More...
 
- Public Member Functions inherited from ghidra::Action
 Action (uint4 f, const string &nm, const string &g)
 Base constructor for an Action. More...
 
virtual ~Action (void)
 Destructor.
 
virtual void printStatistics (ostream &s) const
 Dump statistics to stream. More...
 
int4 perform (Funcdata &data)
 Perform this action (if necessary) More...
 
bool setBreakPoint (uint4 tp, const string &specify)
 Set a breakpoint on this action. More...
 
virtual void clearBreakPoints (void)
 Clear all breakpoints set on this Action.
 
bool setWarning (bool val, const string &specify)
 Set a warning on this action. More...
 
bool disableRule (const string &specify)
 Disable a specific Rule within this. More...
 
bool enableRule (const string &specify)
 Enable a specific Rule within this. More...
 
const string & getName (void) const
 Get the Action's name.
 
const string & getGroup (void) const
 Get the Action's group.
 
uint4 getStatus (void) const
 Get the current status of this Action.
 
uint4 getNumTests (void)
 Get the number of times apply() was invoked.
 
uint4 getNumApply (void)
 
virtual void resetStats (void)
 Reset all the counts to zero. More...
 
virtual int4 print (ostream &s, int4 num, int4 depth) const
 Print a description of this Action to stream. More...
 
virtual void printState (ostream &s) const
 Print status to stream. More...
 
virtual ActiongetSubAction (const string &specify)
 Retrieve a specific sub-action by name. More...
 
virtual RulegetSubRule (const string &specify)
 Retrieve a specific sub-rule by name. More...
 

Static Private Member Functions

static void buildLocaltypes (Funcdata &data)
 Assign initial data-type based on local info. More...
 
static bool writeBack (Funcdata &data)
 Commit the final propagated data-types to Varnodes. More...
 
static bool propagateTypeEdge (TypeFactory *typegrp, PcodeOp *op, int4 inslot, int4 outslot)
 Attempt to propagate a data-type across a single PcodeOp edge. More...
 
static void propagateOneType (TypeFactory *typegrp, Varnode *vn)
 Propagate a data-type starting from one Varnode across the function. More...
 
static void propagateRef (Funcdata &data, Varnode *vn, const Address &addr)
 Try to propagate a pointer data-type to known aliases. More...
 
static void propagateSpacebaseRef (Funcdata &data, Varnode *spcvn)
 Search for pointers and propagate its data-type to known aliases. More...
 
static PcodeOpcanonicalReturnOp (Funcdata &data)
 
static void propagateAcrossReturns (Funcdata &data)
 Give data-types a chance to propagate between CPUI_RETURN operations. More...
 

Private Attributes

int4 localcount
 Number of passes performed for this function.
 

Additional Inherited Members

- Public Types inherited from ghidra::Action
enum  ruleflags {
  rule_repeatapply = 4, rule_onceperfunc = 8, rule_oneactperfunc = 16, rule_debug = 32,
  rule_warnings_on = 64, rule_warnings_given = 128
}
 Boolean behavior properties governing this particular Action. More...
 
enum  statusflags {
  status_start =1, status_breakstarthit =2, status_repeat =4, status_mid =8,
  status_end =16, status_actionbreak =32
}
 Boolean properties describing the status of an action. More...
 
enum  breakflags { break_start = 1, tmpbreak_start = 2, break_action = 4, tmpbreak_action = 8 }
 Break points associated with an Action. More...
 
- Protected Member Functions inherited from ghidra::Action
void issueWarning (Architecture *glb)
 Warn that this Action has applied. More...
 
bool checkStartBreak (void)
 Check start breakpoint. More...
 
bool checkActionBreak (void)
 Check action breakpoint. More...
 
void turnOnWarnings (void)
 Enable warnings for this Action.
 
void turnOffWarnings (void)
 Disable warnings for this Action.
 
- Protected Attributes inherited from ghidra::Action
int4 lcount
 Changes not including last call to apply()
 
int4 count
 Number of changes made by this action so far.
 
uint4 status
 Current status.
 
uint4 breakpoint
 Breakpoint properties.
 
uint4 flags
 Behavior properties.
 
uint4 count_tests
 Number of times apply() has been called.
 
uint4 count_apply
 Number of times apply() made changes.
 
string name
 Name of the action.
 
string basegroup
 Base group this action belongs to.
 

Detailed Description

Infer and propagate data-types.

Atomic data-types are ordered from most specified to least specified. This is extended rescursively to an ordering on composite data-types via Datatype::typeOrder(). A local data-type is calculated for each Varnode by looking at the data-types expected by the PcodeOps it is directly involved in (as input or output). Every Varnode has 1 chance to propagate its information throughout the graph along COPY,LOAD,STORE,ADD,MULTIEQUAL,and INDIRECT edges. The propagation is done with a depth first search along propagating edges. If the propagated data-type is the same, less than, or if the varnode had been propagated through already, that branch is trimmed. Every edge can theoretically get traversed once, i.e. the search allows the type to propagate through a looping edge, but immediately truncates. This is probably quadratic in the worst case, if each Varnode has a higher type and propagates it to the entire graph. But it is linear in practice, because there are generally only two or three levels of type, so only one or two Varnodes are likely to propagate widely within a component, and the others get truncated immediately. An initial sort on the data-type level of the Varnodes, so that the highest-level types are propagated first, would probably fix the worst-case, but this seems unnecessary. Complications: TYPE_SPACEBASE is a problem because we have to make sure that it doesn't propagate. Also, offsets off of pointers to TYPE_SPACEBASE look up the data-type in the local map. Then ActionRestructure uses data-type information recovered by this algorithm to reconstruct the local map. This causes a feedback loop which allows type information recovered about mapped Varnodes to be propagated to pointer Varnodes which point to the mapped object. Unfortunately under rare circumstances, this feedback-loop does not converge for some reason. Rather than hunt this down, I've put an arbitrary iteration limit on the data-type propagation algorithm, which reports a warning if the limit is reached and then aborts additional propagation so that decompiling can terminate.

Member Function Documentation

◆ apply()

int4 ghidra::ActionInferTypes::apply ( Funcdata data)
virtual

Make a single attempt to apply this Action.

This is the main entry point for applying changes to a function that are specific to this Action. The method can inspect whatever it wants to decide if the Action does or does not apply. Changes are indicated by incrementing the count field.

Parameters
datais the function to inspect/modify
Returns
0 for a complete application, -1 for a partial completion (due to breakpoint)

Implements ghidra::Action.

References ghidra::ScopeLocal::applyTypeRecommendations(), ghidra::Funcdata::beginLoc(), ghidra::Funcdata::endLoc(), ghidra::Funcdata::findSpacebaseInput(), ghidra::Funcdata::getArch(), ghidra::Funcdata::getScopeLocal(), ghidra::ScopeLocal::getSpaceId(), ghidra::Varnode::hasNoDescend(), ghidra::Funcdata::hasTypeRecoveryStarted(), ghidra::Varnode::isAnnotation(), ghidra::Varnode::isWritten(), ghidra::Architecture::types, and ghidra::Funcdata::warningHeader().

◆ buildLocaltypes()

void ghidra::ActionInferTypes::buildLocaltypes ( Funcdata data)
staticprivate

◆ canonicalReturnOp()

PcodeOp * ghidra::ActionInferTypes::canonicalReturnOp ( Funcdata data)
staticprivate

Return the CPUI_RETURN op with the most specialized data-type, which is not dead and is not a special halt.

Parameters
datais the function
Returns
the representative CPUI_RETURN op or NULL

References ghidra::Funcdata::beginOp(), ghidra::CPUI_RETURN, ghidra::Funcdata::endOp(), ghidra::PcodeOp::getHaltType(), ghidra::PcodeOp::getIn(), ghidra::Varnode::getTempType(), ghidra::PcodeOp::isDead(), ghidra::PcodeOp::numInput(), and ghidra::Datatype::typeOrder().

◆ clone()

virtual Action* ghidra::ActionInferTypes::clone ( const ActionGroupList grouplist) const
inlinevirtual

Clone the Action.

If this Action is a member of one of the groups in the grouplist, this returns a clone of the Action, otherwise NULL is returned.

Parameters
grouplistis the list of groups being cloned
Returns
the cloned Action or NULL

Implements ghidra::Action.

References ghidra::ActionStart::apply(), ghidra::ActionGroupList::contains(), and ghidra::Action::getGroup().

◆ propagateAcrossReturns()

void ghidra::ActionInferTypes::propagateAcrossReturns ( Funcdata data)
staticprivate

◆ propagateOneType()

void ghidra::ActionInferTypes::propagateOneType ( TypeFactory typegrp,
Varnode vn 
)
staticprivate

Propagate a data-type starting from one Varnode across the function.

Given a starting Varnode, propagate its Datatype as far as possible through the data-flow graph, transforming the data-type through PcodeOps as necessary. The data-type is push through all possible propagating edges, but each Varnode is visited at most once. Propagation is trimmed along any particular path if the pushed data-type isn't more specific than the current data-type on a Varnode, under the data-type ordering.

Parameters
typegrpis the TypeFactory for constructing transformed data-types
vnis the Varnode holding the root data-type to push

References ghidra::Varnode::clearMark(), ghidra::PcodeOp::getIn(), ghidra::PcodeOp::getOut(), ghidra::PropagationState::inslot, ghidra::PropagationState::op, ghidra::Varnode::setMark(), ghidra::PropagationState::slot, ghidra::PropagationState::step(), ghidra::PropagationState::valid(), and ghidra::PropagationState::vn.

◆ propagateRef()

void ghidra::ActionInferTypes::propagateRef ( Funcdata data,
Varnode vn,
const Address addr 
)
staticprivate

◆ propagateSpacebaseRef()

void ghidra::ActionInferTypes::propagateSpacebaseRef ( Funcdata data,
Varnode spcvn 
)
staticprivate

Search for pointers and propagate its data-type to known aliases.

This routine looks for ADD operations off of a specific spacebase register that produce output Varnodes with a known data-type. The offset of the ADD is calculated into the corresponding address space, and an attempt is made to propagate the Varnodes data-type to other Varnodes in the address space at that offset.

Parameters
datais the function being analyzed
spcvnis the spacebase register

References ghidra::Varnode::beginDescend(), ghidra::PcodeOp::code(), ghidra::CPUI_COPY, ghidra::CPUI_INT_ADD, ghidra::CPUI_PTRADD, ghidra::CPUI_PTRSUB, ghidra::Varnode::endDescend(), ghidra::PcodeOp::getAddr(), ghidra::TypeSpacebase::getAddress(), ghidra::PcodeOp::getIn(), ghidra::Datatype::getMetatype(), ghidra::Varnode::getOffset(), ghidra::PcodeOp::getOut(), ghidra::Varnode::getSize(), ghidra::Varnode::getType(), ghidra::Varnode::isConstant(), ghidra::TYPE_PTR, and ghidra::TYPE_SPACEBASE.

◆ propagateTypeEdge()

bool ghidra::ActionInferTypes::propagateTypeEdge ( TypeFactory typegrp,
PcodeOp op,
int4  inslot,
int4  outslot 
)
staticprivate

Attempt to propagate a data-type across a single PcodeOp edge.

Given an input Varnode and an output Varnode defining a directed edge through a PcodeOp, determine if and how the input data-type propagates to the output. Update the output Varnode's (temporary) data-type. An input to the edge may either an input or output to the PcodeOp. A slot value of -1 indicates the PcodeOp output, a non-negative value indicates a PcodeOp input index.

Parameters
typegrpis the TypeFactory for building a possibly transformed data-type
opis the PcodeOp through which the propagation edge flows
inslotindicates the edge's input Varnode
outslotindicates the edge's output Varnode
Returns
true if the data-type propagates

References ghidra::TypeFactory::getArch(), ghidra::PcodeOp::getIn(), ghidra::Datatype::getMetatype(), ghidra::Varnode::getNZMask(), ghidra::PcodeOp::getOpcode(), ghidra::PcodeOp::getOut(), ghidra::Varnode::getTempType(), ghidra::Varnode::isAnnotation(), ghidra::Varnode::isMark(), ghidra::Varnode::isTypeLock(), ghidra::Datatype::needsResolution(), ghidra::TypeOp::propagateType(), ghidra::Datatype::resolveInFlow(), ghidra::Varnode::setTempType(), ghidra::Varnode::stopsUpPropagation(), ghidra::TYPE_BOOL, and ghidra::Datatype::typeOrder().

◆ reset()

virtual void ghidra::ActionInferTypes::reset ( Funcdata data)
inlinevirtual

Reset the Action for a new function.

Parameters
datais the new function this Action may affect

Reimplemented from ghidra::Action.

◆ writeBack()

bool ghidra::ActionInferTypes::writeBack ( Funcdata data)
staticprivate

Commit the final propagated data-types to Varnodes.

For each Varnode copy the temporary data-type to the permament field, taking into account previous locks.

Parameters
datais the function being analyzed
Returns
true if any Varnode's data-type changed from the last round of propagation

References ghidra::Funcdata::beginLoc(), ghidra::Funcdata::endLoc(), ghidra::Varnode::getTempType(), ghidra::Varnode::hasNoDescend(), ghidra::Varnode::isAnnotation(), ghidra::Varnode::isWritten(), and ghidra::Varnode::updateType().


The documentation for this class was generated from the following files: