Search for concatenations with unlikely things to inform return/parameter consumption calculation. More...

Inheritance diagram for ghidra::RulePiecePathology:

Public Member Functions
	RulePiecePathology (const string &g)
	Constructor.

virtual Rule *	clone (const ActionGroupList &grouplist) const
	Clone the Rule. More...

virtual void	getOpList (vector< uint4 > &oplist) const
	List of op codes this rule operates on. More...

virtual int4	applyOp (PcodeOp *op, Funcdata &data)
	Attempt to apply this Rule. More...

Public Member Functions inherited from ghidra::Rule
	Rule (const string &g, uint4 fl, const string &nm)
	Construct given group, properties name. More...

virtual	~Rule (void)
	Destructor.

const string &	getName (void) const
	Return the name of this Rule.

const string &	getGroup (void) const
	Return the group this Rule belongs to.

uint4	getNumTests (void)
	Get number of attempted applications.

uint4	getNumApply (void)
	Get number of successful applications.

void	setBreak (uint4 tp)
	Set a breakpoint on this Rule.

void	clearBreak (uint4 tp)
	Clear a breakpoint on this Rule.

void	clearBreakPoints (void)
	Clear all breakpoints on this Rule.

void	turnOnWarnings (void)
	Enable warnings for this Rule.

void	turnOffWarnings (void)
	Disable warnings for this Rule.

bool	isDisabled (void) const
	Return true if this Rule is disabled.

void	setDisable (void)
	Disable this Rule (within its pool)

void	clearDisable (void)
	Enable this Rule (within its pool)

bool	checkActionBreak (void)
	Check if an action breakpoint is turned on. More...

uint4	getBreakPoint (void) const
	Return breakpoint toggles.

virtual void	reset (Funcdata &data)
	Reset this Rule. More...

virtual void	resetStats (void)
	Reset Rule statistics. More...

virtual void	printStatistics (ostream &s) const
	Print statistics for this Rule. More...

Static Private Member Functions
static bool	isPathology (Varnode *vn, Funcdata &data)
	Return true if concatenating with a SUBPIECE of the given Varnode is unusual. More...

static int4	tracePathologyForward (PcodeOp *op, Funcdata &data)
	Given a known pathological concatenation, trace it forward to CALLs and RETURNs. More...

Additional Inherited Members
Public Types inherited from ghidra::Rule
enum	typeflags { type_disable = 1, rule_debug = 2, warnings_on = 4, warnings_given = 8 }
	Properties associated with a Rule. More...

Detailed Description

Search for concatenations with unlikely things to inform return/parameter consumption calculation.

For that can read/write part of a general purpose register, a small return value can get concatenated with unrelated data when the function writes directly to part of the return register. This searches for a characteristic pathology:

retreg = CALL();
...
retreg = CONCAT(SUBPIECE(retreg,#4),smallval);

Member Function Documentation

◆ applyOp()

int4 ghidra::RulePiecePathology::applyOp	(	PcodeOp *	op,
		Funcdata &	data
	)

virtual

Attempt to apply this Rule.

This method contains the main logic for applying the Rule. It must use a given PcodeOp as the point at which the Rule applies. If it does apply, changes are made directly to the function and 1 (non-zero) is returned, otherwise 0 is returned.

Parameters

op	is the given PcodeOp where the Rule may apply
data	is the function to which to apply

Reimplemented from ghidra::Rule.

References ghidra::PcodeOp::binary, ghidra::PcodeOp::code(), ghidra::CPUI_INDIRECT, ghidra::CPUI_SUBPIECE, ghidra::Varnode::getAddr(), ghidra::Funcdata::getCallSpecs(), ghidra::Varnode::getDef(), ghidra::PcodeOp::getEvalType(), ghidra::PcodeOp::getIn(), ghidra::Varnode::getOffset(), ghidra::Varnode::getSize(), ghidra::Address::getSpace(), ghidra::AddrSpace::isBigEndian(), ghidra::PcodeOp::isCall(), ghidra::PcodeOp::isIndirectCreation(), ghidra::FuncProto::isOutputLocked(), ghidra::Varnode::isWritten(), and ghidra::PcodeOp::unary.

◆ clone()

virtual Rule* ghidra::RulePiecePathology::clone ( const ActionGroupList & grouplist ) const

inlinevirtual

Clone the Rule.

If this Rule is a member of one of the groups in the grouplist, this returns a clone of the Rule, otherwise NULL is returned.

Parameters

grouplist is the list of groups being cloned

Returns: the cloned Rule or NULL

Implements ghidra::Rule.

References ghidra::ActionGroupList::contains().

◆ getOpList()

void ghidra::RulePiecePathology::getOpList ( vector< uint4 > & oplist ) const

virtual

List of op codes this rule operates on.

Populate the given array with all possible OpCodes this Rule might apply to. By default, this method returns all possible OpCodes

Parameters

oplist is the array to populate

Reimplemented from ghidra::Rule.

References ghidra::CPUI_PIECE.

◆ isPathology()

bool ghidra::RulePiecePathology::isPathology	(	Varnode *	vn,
		Funcdata &	data
	)

staticprivate

Return true if concatenating with a SUBPIECE of the given Varnode is unusual.

Parameters

vn	is the given Varnode
data	is the function containing the Varnode

Returns: true if the configuration is a pathology

References ghidra::PcodeOp::code(), ghidra::CPUI_CALL, ghidra::CPUI_CALLIND, ghidra::CPUI_COPY, ghidra::CPUI_INDIRECT, ghidra::CPUI_MULTIEQUAL, ghidra::Varnode::getAddr(), ghidra::Funcdata::getCallSpecs(), ghidra::Varnode::getDef(), ghidra::PcodeOp::getIn(), ghidra::PcodeOp::getOpFromConst(), ghidra::Varnode::getSpace(), ghidra::AddrSpace::getType(), ghidra::IPTR_IOP, ghidra::PcodeOp::isCall(), ghidra::Varnode::isInput(), ghidra::PcodeOp::isMark(), ghidra::FuncCallSpecs::isOutputActive(), ghidra::Varnode::isPersist(), and ghidra::PcodeOp::setMark().

◆ tracePathologyForward()

int4 ghidra::RulePiecePathology::tracePathologyForward	(	PcodeOp *	op,
		Funcdata &	data
	)

staticprivate

Given a known pathological concatenation, trace it forward to CALLs and RETURNs.

If the pathology reaches a CALL or RETURN, it is noted, through the FuncProto or FuncCallSpecs object, that the parameter or return value is only partially consumed. The subvariable flow rules can then decide whether or not to truncate this part of the data-flow.

Parameters

op	is CPUI_PIECE op that is the pathological concatenation
data	is the function containing the data-flow

Returns: a non-zero value if new bytes are labeled as unconsumed

References ghidra::Varnode::beginDescend(), ghidra::PcodeOp::code(), ghidra::CPUI_CALL, ghidra::CPUI_CALLIND, ghidra::CPUI_COPY, ghidra::CPUI_INDIRECT, ghidra::CPUI_MULTIEQUAL, ghidra::CPUI_RETURN, ghidra::Varnode::endDescend(), ghidra::Funcdata::getCallSpecs(), ghidra::Funcdata::getFuncProto(), ghidra::PcodeOp::getIn(), ghidra::PcodeOp::getOut(), ghidra::Varnode::getSize(), ghidra::FuncCallSpecs::isInputActive(), ghidra::FuncProto::isInputLocked(), ghidra::PcodeOp::isMark(), ghidra::FuncProto::isOutputLocked(), ghidra::PcodeOp::numInput(), ghidra::FuncCallSpecs::setInputBytesConsumed(), ghidra::PcodeOp::setMark(), and ghidra::FuncProto::setReturnBytesConsumed().

The documentation for this class was generated from the following files:

ruleaction.hh
ruleaction.cc

Public Member Functions

Static Private Member Functions

Additional Inherited Members

Detailed Description

Member Function Documentation

◆ applyOp()

◆ clone()

◆ getOpList()

◆ isPathology()

◆ tracePathologyForward()