Rizin
unix-like reverse engineering framework and cli tools
|
Go to the source code of this file.
Classes | |
struct | ReturnTypeAnalysisCtx |
struct | TypeAnalysisCtx |
Macros | |
#define | LOOP_MAX 10 |
#define | DEFAULT_MAX 3 |
#define | REGNAME_SIZE 10 |
#define | MAX_INSTR 5 |
#define DEFAULT_MAX 3 |
Definition at line 330 of file analysis_tp.c.
#define LOOP_MAX 10 |
Definition at line 10 of file analysis_tp.c.
#define MAX_INSTR 5 |
Definition at line 332 of file analysis_tp.c.
#define REGNAME_SIZE 10 |
Definition at line 331 of file analysis_tp.c.
|
static |
Definition at line 12 of file analysis_tp.c.
References rz_core_t::analysis, rz_core_t::config, rz_core_t::dbg, eprintf, rz_analysis_t::esil, NULL, rz_analysis_t::reg, rz_analysis_esil_trace_new(), rz_config_hold_i(), rz_config_set(), rz_config_set_i(), rz_debug_trace_new(), rz_reg_get_name(), rz_reg_getv(), RZ_REG_NAME_BP, RZ_REG_NAME_SP, sp, rz_analysis_esil_t::trace, and rz_debug_t::trace.
Referenced by rz_core_analysis_type_match().
|
static |
Definition at line 38 of file analysis_tp.c.
References rz_core_t::analysis, rz_core_t::dbg, rz_analysis_t::esil, rz_analysis_esil_trace_free(), rz_config_hold_free(), rz_config_hold_restore(), rz_debug_trace_free(), rz_analysis_esil_t::trace, and rz_debug_t::trace.
Referenced by rz_core_analysis_type_match().
Definition at line 530 of file analysis_tp.c.
Referenced by rz_core_analysis_type_match(), rz_core_link_stroff(), and rz_core_print_function_disasm_json().
void free_op_cache_kv | ( | HtUPKv * | kv | ) |
Definition at line 535 of file analysis_tp.c.
References rz_analysis_op_free().
Referenced by rz_core_analysis_type_match().
bool function_argument_type_derive | ( | RZ_NULLABLE const RzCallable * | callable, |
int | arg_num, | ||
RzType ** | type, | ||
char ** | name | ||
) |
Definition at line 313 of file analysis_tp.c.
References arg::name, rz_pvector_index_ptr(), rz_pvector_len(), rz_return_val_if_fail, rz_type_clone(), strdup(), and type.
Referenced by type_match().
RzCallable* function_type_derive | ( | RzAnalysis * | analysis, |
RZ_NONNULL const char * | fcn_name, | ||
bool * | owned | ||
) |
Definition at line 292 of file analysis_tp.c.
References NULL, rz_analysis_function_derive_type(), rz_analysis_get_function_byname(), rz_return_val_if_fail, rz_type_func_get(), and rz_analysis_t::typedb.
Referenced by type_match().
|
static |
Definition at line 200 of file analysis_tp.c.
References rz_analysis_t::esil, setup::idx, regname(), rz_analysis_esil_get_instruction_trace(), rz_analysis_il_get_reg_op_trace(), rz_analysis_esil_t::trace, and UT64_MAX.
Referenced by type_match().
Definition at line 172 of file analysis_tp.c.
References addr, rz_core_t::analysis, rz_analysis_t::bits, free(), memset(), reg, rz_analysis_t::reg, regname(), rz_analysis_op_free(), RZ_ANALYSIS_OP_MASK_ESIL, RZ_ANALYSIS_OP_MASK_VAL, rz_core_analysis_op(), rz_reg_32_to_64(), rz_reg_get(), rz_strbuf_get(), rz_strbuf_is_empty(), rz_reg_item_t::size, strdup(), and autogen_x86imm::tmp.
Referenced by propagate_return_type(), propagate_return_type_pointer(), propagate_types_among_used_variables(), and type_match().
void handle_stack_canary | ( | RzCore * | core, |
RzAnalysisOp * | aop, | ||
int | cur_idx | ||
) |
Definition at line 539 of file analysis_tp.c.
References rz_analysis_op_t::addr, rz_core_t::analysis, rz_analysis_t::esil, rz_analysis_esil_get_instruction_trace(), rz_analysis_get_used_function_var(), rz_analysis_op_free(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_MASK_VAL, RZ_ANALYSIS_OP_TYPE_MASK, RZ_ANALYSIS_OP_TYPE_MOV, rz_core_analysis_op(), rz_analysis_esil_t::trace, type, rz_analysis_op_t::type, ut64(), and var_rename().
Referenced by propagate_types_among_used_variables().
RzAnalysisOp* op_cache_get | ( | HtUP * | cache, |
RzCore * | core, | ||
ut64 | addr | ||
) |
Definition at line 279 of file analysis_tp.c.
References addr, NULL, op, rz_analysis_op_free(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_MASK_VAL, and rz_core_analysis_op().
Referenced by propagate_types_among_used_variables(), rz_core_analysis_type_match(), and type_match().
Definition at line 216 of file analysis_tp.c.
References rz_core_t::analysis, syscall_preprocessing::arr, rz_core_t::config, IS_DIGIT, IS_LOWER, IS_UPPER, NULL, rz_config_get(), rz_list_append(), rz_list_new(), rz_str_ncpy(), s, sdb_const_get(), sdb_fmt(), rz_analysis_t::sdb_fmts, autogen_x86imm::tmp, and type.
Referenced by type_match().
|
static |
Definition at line 591 of file analysis_tp.c.
References rz_analysis_op_t::addr, rz_core_t::analysis, rz_analysis_op_t::direction, get_src_regname(), NULL, propagate_return_type_pointer(), REGNAME_SIZE, RZ_ANALYSIS_OP_DIR_WRITE, RZ_ANALYSIS_OP_TYPE_MASK, RZ_ANALYSIS_OP_TYPE_MOV, RZ_FREE, rz_pvector_at(), rz_pvector_empty(), rz_pvector_foreach, src, strdup(), type, rz_analysis_op_t::type, var_type_set(), and vars_resolve_overlaps().
Referenced by propagate_types_among_used_variables().
|
static |
Definition at line 573 of file analysis_tp.c.
References addr, rz_core_t::analysis, rz_analysis_op_t::direction, get_src_regname(), REGNAME_SIZE, RZ_ANALYSIS_OP_DIR_READ, rz_pvector_empty(), rz_pvector_foreach, var_type_set(), and vars_resolve_overlaps().
Referenced by propagate_return_type().
void propagate_types_among_used_variables | ( | RzCore * | core, |
HtUP * | op_cache, | ||
RzAnalysisFunction * | fcn, | ||
RzAnalysisBlock * | bb, | ||
RzAnalysisOp * | aop, | ||
struct TypeAnalysisCtx * | ctx | ||
) |
Definition at line 636 of file analysis_tp.c.
References rz_analysis_function_t::addr, rz_analysis_op_t::addr, rz_analysis_bb_t::addr, rz_core_t::analysis, rz_print_t::big_endian, rz_analysis_op_t::cond, rz_type_constraint_t::cond, rz_core_t::config, rz_analysis_t::constpool, rz_analysis_op_t::direction, rz_analysis_op_t::disp, rz_analysis_t::esil, f, rz_core_t::flags, free(), get_src_regname(), handle_stack_canary(), i, rz_core_t::io, jmp, rz_analysis_op_t::jump, MAX_INSTR, rz_analysis_function_t::name, NULL, op_cache_get(), rz_core_t::print, propagate_return_type(), rz_analysis_op_t::ptr, rz_flag_item_t::realname, rz_analysis_op_t::refptr, reg, REGNAME_SIZE, return_type_analysis_context_unresolved(), rz_analysis_cc_exist(), rz_analysis_cc_func(), rz_analysis_cc_ret(), rz_analysis_esil_get_instruction_trace(), rz_analysis_fcn_bbget_in(), rz_analysis_function_get_vars_used_at(), rz_analysis_function_name_guess(), rz_analysis_get_fcn_in(), RZ_ANALYSIS_OP_DIR_READ, rz_analysis_op_free(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_TYPE_CALL, RZ_ANALYSIS_OP_TYPE_CJMP, RZ_ANALYSIS_OP_TYPE_CMP, RZ_ANALYSIS_OP_TYPE_LEA, RZ_ANALYSIS_OP_TYPE_LOAD, RZ_ANALYSIS_OP_TYPE_MASK, RZ_ANALYSIS_OP_TYPE_MOV, RZ_ANALYSIS_OP_TYPE_RET, RZ_ANALYSIS_OP_TYPE_STORE, RZ_ANALYSIS_OP_TYPE_UCALL, rz_analysis_var_add_constraint(), rz_config_get_b(), rz_core_analysis_op(), rz_flag_exist_at(), rz_flag_get_by_spaces(), RZ_FLAGS_FS_IMPORTS, RZ_FLAGS_FS_STRINGS, RZ_FREE, rz_io_read_at(), rz_pvector_at(), rz_pvector_empty(), rz_pvector_foreach, rz_read_ble(), rz_str_constpool_get(), rz_type_cond_invert(), rz_type_func_exist(), rz_type_func_ret(), rz_analysis_op_t::sign, rz_analysis_op_t::size, strdup(), rz_analysis_esil_t::trace, type, rz_analysis_var_t::type, rz_analysis_op_t::type, type_match(), rz_analysis_t::typedb, ut64(), UT64_MAX, rz_analysis_op_t::val, var_type_set(), var_type_set_sign(), var_type_set_str(), and vars_resolve_overlaps().
Referenced by rz_core_analysis_type_match().
|
inlinestatic |
Definition at line 568 of file analysis_tp.c.
Referenced by propagate_types_among_used_variables().
|
static |
Definition at line 251 of file analysis_tp.c.
References rz_analysis_function_t::bp_off, rz_reg_item_t::index, rz_analysis_t::reg, rz_analysis_function_get_var(), rz_analysis_get_function_byname(), rz_analysis_var_get_dst_var(), RZ_ANALYSIS_VAR_KIND_BPV, RZ_ANALYSIS_VAR_KIND_REG, rz_reg_get(), type, and var_type_set_resolve_overlaps().
Referenced by type_match().
RZ_API void rz_core_analysis_type_match | ( | RzCore * | core, |
RzAnalysisFunction * | fcn, | ||
HtUU * | loop_table | ||
) |
Definition at line 816 of file analysis_tp.c.
References addr, rz_analysis_op_t::addr, rz_analysis_bb_t::addr, rz_core_t::analysis, analysis_emul_init(), analysis_emul_restore(), bb_cmpaddr(), rz_analysis_function_t::bbs, rz_core_t::config, rz_core_t::dbg, rz_analysis_var_t::delta, eprintf, rz_analysis_t::esil, free(), free_op_cache_kv(), rz_debug_trace_t::ht, i, rz_analysis_esil_trace_t::instructions, rz_analysis_var_t::kind, LOOP_MAX, rz_analysis_function_t::ninstr, NULL, op_cache_get(), pc, propagate_types_among_used_variables(), r, reg, rz_analysis_t::reg, ReturnTypeAnalysisCtx::resolved, ReturnTypeAnalysisCtx::ret_reg, TypeAnalysisCtx::retctx, rz_analysis_archinfo(), RZ_ANALYSIS_ARCHINFO_MIN_OP_SIZE, rz_analysis_get_functions_in(), rz_analysis_op_nonlinear(), RZ_ANALYSIS_OP_TYPE_ILL, RZ_ANALYSIS_OP_TYPE_RET, rz_analysis_var_get_dst_var(), RZ_ANALYSIS_VAR_KIND_REG, rz_config_hold_new(), rz_cons_break_pop(), rz_cons_break_push(), rz_cons_is_breaked(), rz_core_esil_step(), rz_list_free(), rz_list_sort(), RZ_MAX, rz_pvector_foreach, rz_pvector_len(), rz_reg_get(), rz_reg_get_name(), rz_reg_getv(), rz_reg_index_get(), RZ_REG_NAME_PC, rz_reg_set_value(), rz_return_if_fail, rz_analysis_op_t::size, rz_analysis_bb_t::size, rz_analysis_esil_t::trace, rz_debug_t::trace, rz_analysis_var_t::type, rz_analysis_op_t::type, ut64(), UT64_MAX, var_type_set(), rz_analysis_function_t::vars, and vars_resolve_overlaps().
Referenced by rz_analysis_function_type_matching_handler(), and rz_core_analysis_types_propagation().
|
static |
type match at a call instruction inside another function
fcn_name | name of the callee |
addr | addr of the call instruction |
baddr | addr of the caller function |
cc | cc of the callee |
prev_idx | index in the esil trace |
userfnc | whether the callee is a user function (affects propagation direction) |
caddr | addr of the callee |
Definition at line 345 of file analysis_tp.c.
References addr, rz_core_t::analysis, baddr(), rz_analysis_t::bits, rz_core_t::config, DEFAULT_MAX, eprintf, rz_analysis_t::esil, f, rz_core_t::flags, free(), function_argument_type_derive(), function_type_derive(), get_addr(), get_src_regname(), i, setup::idx, rz_analysis_esil_trace_t::instructions, rz_core_t::io, rz_analysis_var_t::kind, max, NULL, op_cache_get(), parse_format(), rz_type_db_t::parser, pos, read(), regname(), REGNAME_SIZE, retype_callee_arg(), rz_analysis_cc_arg(), rz_analysis_cc_max_arg(), rz_analysis_esil_get_instruction_trace(), rz_analysis_get_used_function_var(), rz_analysis_il_get_reg_op_trace(), RZ_ANALYSIS_OP_TYPE_CALL, RZ_ANALYSIS_OP_TYPE_JMP, RZ_ANALYSIS_OP_TYPE_LEA, RZ_ANALYSIS_OP_TYPE_LOAD, RZ_ANALYSIS_OP_TYPE_MOV, RZ_ANALYSIS_OP_TYPE_PUSH, RZ_ANALYSIS_OP_TYPE_STORE, RZ_ANALYSIS_VAR_KIND_REG, rz_config_get_i(), rz_cons_break_pop(), rz_cons_break_push(), rz_flag_get_by_spaces(), RZ_FLAGS_FS_STRINGS, rz_io_nread_at(), rz_list_free(), rz_list_get_n(), rz_list_length(), rz_meta_set_string(), RZ_META_TYPE_VARTYPE, RZ_MIN, rz_pvector_len(), rz_str_new(), rz_str_startswith(), rz_type_as_string(), rz_type_callable_free(), rz_type_free(), rz_type_func_args_count(), RZ_TYPE_KIND_POINTER, rz_type_parse_string_single(), sdb_fmt(), ST32_MAX, autogen_x86imm::tmp, rz_analysis_esil_t::trace, type, rz_analysis_var_t::type, rz_analysis_op_t::type, type_pos_hit(), rz_analysis_t::typedb, types, ut64(), UT64_MAX, var_rename(), var_type_set_resolve_overlaps(), var_type_set_str(), and verbose.
Referenced by propagate_types_among_used_variables().
|
static |
Definition at line 47 of file analysis_tp.c.
References mem, rz_analysis_t::reg, rz_analysis_il_reg_trace_contains(), rz_pvector_at(), rz_reg_get_name(), rz_reg_getv(), RZ_REG_NAME_SP, sp, and ut64().
Referenced by type_match().
|
static |
Definition at line 68 of file analysis_tp.c.
References addr, ARGPREFIX, rz_analysis_get_fcn_in(), rz_analysis_var_rename(), rz_str_startswith(), rz_warn_if_reached, v, and VARPREFIX.
Referenced by handle_stack_canary(), and type_match().
|
static |
Definition at line 112 of file analysis_tp.c.
References eprintf, rz_analysis_var_t::fcn, rz_analysis_function_t::name, rz_analysis_var_t::name, rz_analysis_var_set_type(), rz_return_if_fail, rz_type_atomic_is_void(), rz_type_clone(), rz_type_is_default(), rz_type_is_void_ptr(), rz_type_pointer_of_type(), type, rz_analysis_var_t::type, rz_analysis_t::typedb, and var_type_simple_to_complex().
Referenced by propagate_return_type(), propagate_return_type_pointer(), propagate_types_among_used_variables(), rz_core_analysis_type_match(), and var_type_set_resolve_overlaps().
|
static |
Definition at line 147 of file analysis_tp.c.
References type, and var_type_set().
Referenced by retype_callee_arg(), type_match(), and var_type_set_str().
|
static |
Definition at line 91 of file analysis_tp.c.
References rz_return_if_fail, rz_type_integral_set_sign(), rz_type_is_integral(), rz_analysis_var_t::type, and rz_analysis_t::typedb.
Referenced by propagate_types_among_used_variables().
|
static |
Definition at line 158 of file analysis_tp.c.
References eprintf, free(), NULL, rz_type_db_t::parser, rz_return_if_fail, rz_type_free(), rz_type_parse_string_single(), type, rz_analysis_t::typedb, and var_type_set_resolve_overlaps().
Referenced by propagate_types_among_used_variables(), and type_match().
Definition at line 99 of file analysis_tp.c.
References a, b, rz_type_is_char_ptr_nested(), rz_type_is_integral(), and RZ_TYPE_KIND_IDENTIFIER.
Referenced by var_type_set().
|
static |
Definition at line 151 of file analysis_tp.c.
References i, rz_analysis_var_resolve_overlaps(), rz_pvector_at(), and rz_pvector_len().
Referenced by propagate_return_type(), propagate_return_type_pointer(), propagate_types_among_used_variables(), and rz_core_analysis_type_match().