#include <rz_analysis.h>
#include <rz_parse.h>
#include <rz_util.h>
#include <rz_list.h>

Classes
struct	fcn_tree_iter_t

struct	leaddr_pair

struct	BlockTakeoverCtx

struct	BlockRecurseCtx

Macros
#define	READ_AHEAD 1

#define	SDB_KEY_BB "bb.0x%" PFMT64x ".0x%" PFMT64x

#define	JMPTBL_LEA_SEARCH_SZ 64

#define	BB_ALIGN 0x10

#define	MAX_SCAN_SIZE 0x7ffffff

#define	MAX_FLG_NAME_SIZE 64

#define	MAX_FCN_SIZE (1024 * 256)

#define	DB a->sdb_fcns

#define	EXISTS(x, ...) snprintf(key, sizeof(key) - 1, x, ##__VA_ARGS__), sdb_exists(DB, key)

#define	SETKEY(x, ...) snprintf(key, sizeof(key) - 1, x, ##__VA_ARGS__);

#define	gotoBeach(x)

Typedefs
typedef struct fcn_tree_iter_t	FcnTreeIter

Functions
RZ_API const char *	rz_analysis_fcntype_tostring (int type)

static int	read_ahead (RzAnalysis analysis, ut64 addr, ut8 buf, int len)

RZ_API void	rz_analysis_fcn_invalidate_read_ahead_cache (void)

RZ_API int	rz_analysis_function_resize (RzAnalysisFunction *fcn, int newsize)

static RzAnalysisBlock *	fcn_append_basic_block (RzAnalysis analysis, RzAnalysisFunction fcn, ut64 addr)

static bool	isInvalidMemory (RzAnalysis analysis, const ut8 buf, int len)

static bool	isSymbolNextInstruction (RzAnalysis analysis, RzAnalysisOp op)

static bool	is_delta_pointer_table (RzAnalysis analysis, ut64 addr, ut64 lea_ptr, ut64 jmptbl_addr, ut64 casetbl_addr, RzAnalysisOp jmp_aop)

static ut64	try_get_cmpval_from_parents (RzAnalysis analysis, RzAnalysisFunction fcn, RzAnalysisBlock my_bb, const char cmp_reg)

static bool	regs_exist (RzAnalysisValue src, RzAnalysisValue dst)

static int	skip_hp (RzAnalysis analysis, RzAnalysisFunction fcn, RzAnalysisOp op, RzAnalysisBlock bb, ut64 addr, char tmp_buf, int oplen, int un_idx, int idx)

static bool	purity_checked (HtUP ht, RzAnalysisFunction fcn)

static void	check_purity (HtUP ht, RzAnalysisFunction fcn)

static void	free_leaddr_pair (void *pair)

static RzAnalysisBlock *	bbget (RzAnalysis *analysis, ut64 addr, bool jumpmid)

static bool	fcn_takeover_block_recursive_followthrough_cb (RzAnalysisBlock block, void user)

static void	fcn_takeover_block_recursive (RzAnalysisFunction fcn, RzAnalysisBlock start_block)

static const char *	retpoline_reg (RzAnalysis *analysis, ut64 addr)

static void	analyze_retpoline (RzAnalysis analysis, RzAnalysisOp op)

static bool	op_is_set_bp (RzAnalysisOp op, const char bp_reg, const char *sp_reg)

static bool	does_arch_destroys_dst (const char *arch)

static int	analyze_function_locally (RzAnalysis analysis, RzAnalysisFunction fcn, ut64 address)

static void	set_bb_branches (RZ_OUT RzAnalysisBlock *bb, const ut64 jump, const ut64 fail)

static RzAnalysisBBEndCause	run_basic_block_analysis (RzAnalysisTaskItem item, RzVector tasks)
	Analyses the given task item `item` for branches. More...

RZ_API bool	rz_analysis_task_item_new (RZ_NONNULL RzAnalysis analysis, RZ_NONNULL RzVector tasks, RZ_NONNULL RzAnalysisFunction fcn, RZ_NULLABLE RzAnalysisBlock block, ut64 address)
	Adds a new task item to the `tasks` parameter. More...

RZ_API int	rz_analysis_run_tasks (RZ_NONNULL RzVector *tasks)
	Runs analysis on the task items. More...

RZ_API bool	rz_analysis_check_fcn (RzAnalysis analysis, ut8 buf, ut16 bufsz, ut64 addr, ut64 low, ut64 high)

RZ_API void	rz_analysis_trim_jmprefs (RzAnalysis analysis, RzAnalysisFunction fcn)

RZ_API void	rz_analysis_del_jmprefs (RzAnalysis analysis, RzAnalysisFunction fcn)

RZ_API int	rz_analysis_fcn (RzAnalysis analysis, RzAnalysisFunction fcn, ut64 addr, ut64 len, int reftype)

RZ_API int	rz_analysis_fcn_del_locs (RzAnalysis *analysis, ut64 addr)

RZ_API int	rz_analysis_fcn_del (RzAnalysis *a, ut64 addr)

RZ_DEPRECATE RZ_API RzAnalysisFunction *	rz_analysis_get_fcn_in (RzAnalysis *analysis, ut64 addr, int type)

RZ_DEPRECATE RZ_API RzAnalysisFunction *	rz_analysis_get_fcn_in_bounds (RzAnalysis *analysis, ut64 addr, int type)

RZ_API RzAnalysisFunction *	rz_analysis_get_function_byname (RzAnalysis a, const char name)

RZ_API bool	rz_analysis_fcn_add_bb (RzAnalysis a, RzAnalysisFunction fcn, ut64 addr, ut64 size, ut64 jump, ut64 fail, RZ_BORROW RzAnalysisDiff *diff)

RZ_API int	rz_analysis_function_loops (RzAnalysisFunction *fcn)

RZ_API int	rz_analysis_function_complexity (RzAnalysisFunction *fcn)

RZ_API int	rz_analysis_function_get_arg_count (RzAnalysis analysis, RzAnalysisFunction f)
	Gets the RzCallable's arg count for the given function. More...

RZ_API char *	rz_analysis_function_get_json (RzAnalysisFunction *function)

RZ_API RZ_OWN char *	rz_analysis_function_get_signature (RZ_NONNULL RzAnalysisFunction *function)

RZ_API bool	rz_analysis_function_set_type (RzAnalysis a, RZ_NONNULL RzAnalysisFunction f, RZ_NONNULL RzCallable *callable)
	Sets the RzCallable type for the given function. More...

RZ_API bool	rz_analysis_function_set_type_str (RzAnalysis a, RZ_NONNULL RzAnalysisFunction f, RZ_NONNULL const char *sig)
	Parses the function type and sets it for the given function. More...

RZ_API RzAnalysisFunction *	rz_analysis_fcn_next (RzAnalysis *analysis, ut64 addr)

RZ_API int	rz_analysis_fcn_count (RzAnalysis *analysis, ut64 from, ut64 to)

RZ_API RzAnalysisBlock *	rz_analysis_fcn_bbget_in (const RzAnalysis analysis, RzAnalysisFunction fcn, ut64 addr)

RZ_API RzAnalysisBlock *	rz_analysis_fcn_bbget_at (RzAnalysis analysis, RzAnalysisFunction fcn, ut64 addr)

RZ_API ut32	rz_analysis_function_cost (RzAnalysisFunction *fcn)

RZ_API int	rz_analysis_function_count_edges (const RzAnalysisFunction fcn, RZ_NULLABLE int ebbs)

RZ_API bool	rz_analysis_function_purity (RzAnalysisFunction *fcn)

static bool	can_affect_bp (RzAnalysis analysis, RzAnalysisOp op)

static void	__analysis_fcn_check_bp_use (RzAnalysis analysis, RzAnalysisFunction fcn)

RZ_API void	rz_analysis_function_check_bp_use (RzAnalysisFunction *fcn)

static bool	mark_as_visited (RzAnalysisBlock bb, void user)

static bool	analize_addr_cb (ut64 addr, void *user)

static bool	analize_descendents (RzAnalysisBlock bb, void user)

static void	free_ht_up (HtUPKv *kv)

static void	update_varz_analysisysis (RzAnalysisFunction *fcn, int align, ut64 from, ut64 to)

static void	clear_bb_vars (RzAnalysisFunction fcn, RzAnalysisBlock bb, ut64 from, ut64 to)

static void	update_analysis (RzAnalysis analysis, RzList fcns, HtUP *reachable)

static void	calc_reachable_and_remove_block (RzList fcns, RzAnalysisFunction fcn, RzAnalysisBlock bb, HtUP reachable)

RZ_API void	rz_analysis_update_analysis_range (RzAnalysis *analysis, ut64 addr, int size)

RZ_API void	rz_analysis_function_update_analysis (RzAnalysisFunction *fcn)

RZ_API size_t	rz_analysis_function_arg_count (RzAnalysis a, RzAnalysisFunction fcn)
	Returns the argument count of a function. More...

RZ_API RZ_OWN RzPVector *	rz_analysis_function_args (RzAnalysis a, RzAnalysisFunction fcn)
	Returns vector of all function arguments. More...

static int	typecmp (const void a, const void b)

RZ_API RZ_OWN RzList *	rz_analysis_types_from_fcn (RzAnalysis analysis, RzAnalysisFunction fcn)

RZ_API RZ_OWN RzCallable *	rz_analysis_function_clone_type (RzAnalysis analysis, const RzAnalysisFunction f)
	Clones the RzCallable type for the given function. More...

RZ_API RZ_OWN RzCallable *	rz_analysis_function_create_type (RzAnalysis analysis, RzAnalysisFunction f)
	Creates the RzCallable type for the given function. More...

RZ_API void	rz_analysis_function_derive_return_type (RzAnalysisFunction f, RzCallable *callable)
	Sets the RzCallable return type for the given function. More...

RZ_API bool	rz_analysis_function_derive_args (RzAnalysis analysis, RzAnalysisFunction f, RzCallable **callable)
	Sets the RzCallable args for the given function. More...

RZ_API RZ_OWN RzCallable *	rz_analysis_function_derive_type (RzAnalysis analysis, RzAnalysisFunction f)
	Derives the RzCallable type for the given function. More...

Variables
static ut64	cache_addr = UT64_MAX

Macro Definition Documentation

◆ BB_ALIGN

#define BB_ALIGN 0x10

Definition at line 15 of file fcn.c.

◆ DB

#define DB a->sdb_fcns

Definition at line 25 of file fcn.c.

◆ EXISTS

#define EXISTS	(	x,
		...
	)	snprintf(key, sizeof(key) - 1, x, ##__VA_ARGS__), sdb_exists(DB, key)

Definition at line 26 of file fcn.c.

◆ gotoBeach

#define gotoBeach ( x )

Value:

ret = x; \

goto beach;

x

int x

Definition: mipsasm.c:20

Definition at line 139 of file fcn.c.

◆ JMPTBL_LEA_SEARCH_SZ

#define JMPTBL_LEA_SEARCH_SZ 64

Definition at line 14 of file fcn.c.

◆ MAX_FCN_SIZE

#define MAX_FCN_SIZE (1024 * 256)

Definition at line 23 of file fcn.c.

◆ MAX_FLG_NAME_SIZE

#define MAX_FLG_NAME_SIZE 64

Definition at line 19 of file fcn.c.

◆ MAX_SCAN_SIZE

#define MAX_SCAN_SIZE 0x7ffffff

Definition at line 16 of file fcn.c.

◆ READ_AHEAD

#define READ_AHEAD 1

Definition at line 11 of file fcn.c.

◆ SDB_KEY_BB

#define SDB_KEY_BB "bb.0x%" PFMT64x ".0x%" PFMT64x

Definition at line 12 of file fcn.c.

◆ SETKEY

#define SETKEY	(	x,
		...
	)	snprintf(key, sizeof(key) - 1, x, ##__VA_ARGS__);

Definition at line 27 of file fcn.c.

Typedef Documentation

◆ FcnTreeIter

typedef struct fcn_tree_iter_t FcnTreeIter

Function Documentation

◆ __analysis_fcn_check_bp_use()

static void __analysis_fcn_check_bp_use	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn
	)

static

Definition at line 2165 of file fcn.c.

                                                                                        {
     RzListIter *iter;
     RzAnalysisBlock *bb;
     char str_to_find[40] = "\"type\":\"reg\",\"value\":\"";
     char *pos;
     strncat(str_to_find, analysis->reg->name[RZ_REG_NAME_BP], 39);
     if (!fcn) {
         return;
     }
     rz_list_foreach (fcn->bbs, iter, bb) {
         RzAnalysisOp op;
         ut64 at, end = bb->addr + bb->size;
         ut8 *buf = malloc(bb->size);
         if (!buf) {
             continue;
         }
         (void)analysis->iob.read_at(analysis->iob.io, bb->addr, (ut8 *)buf, bb->size);
         int idx = 0;
         for (at = bb->addr; at < end;) {
             rz_analysis_op(analysis, &op, at, buf + idx, bb->size - idx, RZ_ANALYSIS_OP_MASK_VAL | RZ_ANALYSIS_OP_MASK_OPEX);
             if (op.size < 1) {
                 op.size = 1;
             }
             switch (op.type) {
             case RZ_ANALYSIS_OP_TYPE_MOV:
             case RZ_ANALYSIS_OP_TYPE_LEA:
                 if (can_affect_bp(analysis, &op) && op.src[0] && op.src[0]->reg && op.src[0]->reg->name && strcmp(op.src[0]->reg->name, analysis->reg->name[RZ_REG_NAME_SP])) {
                     fcn->bp_frame = false;
                     rz_analysis_op_fini(&op);
                     free(buf);
                     return;
                 }
                 break;
             case RZ_ANALYSIS_OP_TYPE_ADD:
             case RZ_ANALYSIS_OP_TYPE_AND:
             case RZ_ANALYSIS_OP_TYPE_CMOV:
             case RZ_ANALYSIS_OP_TYPE_NOT:
             case RZ_ANALYSIS_OP_TYPE_OR:
             case RZ_ANALYSIS_OP_TYPE_ROL:
             case RZ_ANALYSIS_OP_TYPE_ROR:
             case RZ_ANALYSIS_OP_TYPE_SAL:
             case RZ_ANALYSIS_OP_TYPE_SAR:
             case RZ_ANALYSIS_OP_TYPE_SHR:
             case RZ_ANALYSIS_OP_TYPE_SUB:
             case RZ_ANALYSIS_OP_TYPE_XOR:
             case RZ_ANALYSIS_OP_TYPE_SHL:
                 // op.dst is not filled for these operations, so for now, check for bp as dst looks like this; in the future it may be just replaced with call to can_affect_bp
                 pos = op.opex.ptr ? strstr(op.opex.ptr, str_to_find) : NULL;
                 if (pos && pos - op.opex.ptr < 60) {
                     fcn->bp_frame = false;
                     rz_analysis_op_fini(&op);
                     free(buf);
                     return;
                 }
                 break;
             case RZ_ANALYSIS_OP_TYPE_XCHG:
                 if (op.opex.ptr && strstr(op.opex.ptr, str_to_find)) {
                     fcn->bp_frame = false;
                     rz_analysis_op_fini(&op);
                     free(buf);
                     return;
                 }
                 break;
             case RZ_ANALYSIS_OP_TYPE_POP:
                 break;
             default:
                 break;
             }
             idx += op.size;
             at += op.size;
             rz_analysis_op_fini(&op);
         }
         free(buf);
     }
 }

Referenced by rz_analysis_function_check_bp_use().

◆ analize_addr_cb()

static bool analize_addr_cb	(	ut64	addr,
		void *	user
	)

static

Definition at line 2257 of file fcn.c.

                                                    {
     BlockRecurseCtx *ctx = user;
     RzAnalysis *analysis = ctx->fcn->analysis;
     RzAnalysisBlock *existing_bb = rz_analysis_get_block_at(analysis, addr);
     if (!existing_bb || !rz_list_contains(ctx->fcn->bbs, existing_bb)) {
         int old_len = rz_list_length(ctx->fcn->bbs);
         analyze_function_locally(ctx->fcn->analysis, ctx->fcn, addr);
         if (old_len != rz_list_length(ctx->fcn->bbs)) {
             rz_analysis_block_recurse(rz_analysis_get_block_at(analysis, addr), mark_as_visited, user);
         }
     }
     ht_up_insert(ctx->visited, addr, NULL);
     return true;
 }

References addr, analyze_function_locally(), mark_as_visited(), NULL, rz_analysis_block_recurse(), rz_analysis_get_block_at(), rz_list_contains(), and rz_list_length().

Referenced by analize_descendents().

◆ analize_descendents()

static bool analize_descendents	(	RzAnalysisBlock *	bb,
		void *	user
	)

static

Definition at line 2272 of file fcn.c.

                                                                  {
     return rz_analysis_block_successor_addrs_foreach(bb, analize_addr_cb, user);
 }

References analize_addr_cb(), and rz_analysis_block_successor_addrs_foreach().

Referenced by update_analysis().

◆ analyze_function_locally()

static int analyze_function_locally	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		ut64	address
	)

static

Definition at line 529 of file fcn.c.

                                                                                                  {
     rz_return_val_if_fail(analysis && fcn, RZ_ANALYSIS_RET_ERROR);
     RzVector tasks;
     rz_vector_init(&tasks, sizeof(RzAnalysisTaskItem), NULL, NULL);
     RzAnalysisTaskItem item = { fcn, NULL, fcn->stack, address };
     rz_vector_push(&tasks, &item);
     int saved_stack = fcn->stack; // TODO: DO NOT use fcn->stack to keep track of stack during analysis
     int ret = rz_analysis_run_tasks(&tasks);
     rz_vector_fini(&tasks);
     fcn->stack = saved_stack;
     return ret;
 }

References NULL, RZ_ANALYSIS_RET_ERROR, rz_analysis_run_tasks(), rz_return_val_if_fail, rz_vector_fini(), rz_vector_init(), rz_vector_push(), and rz_analysis_function_t::stack.

Referenced by analize_addr_cb(), run_basic_block_analysis(), and update_analysis().

◆ analyze_retpoline()

static void analyze_retpoline	(	RzAnalysis *	analysis,
		RzAnalysisOp *	op
	)

static

Definition at line 506 of file fcn.c.

                                                                       {
     if (analysis->opt.retpoline) {
         const char *rr = retpoline_reg(analysis, op->jump);
         if (rr) {
             op->type = RZ_ANALYSIS_OP_TYPE_RJMP;
             op->reg = rr;
         }
     }
 }

References rz_analysis_t::opt, rz_analysis_options_t::retpoline, retpoline_reg(), and RZ_ANALYSIS_OP_TYPE_RJMP.

Referenced by run_basic_block_analysis().

◆ bbget()

static RzAnalysisBlock* bbget	(	RzAnalysis *	analysis,
		ut64	addr,
		bool	jumpmid
	)

static

Definition at line 359 of file fcn.c.

                                                                              {
     RzList *intersecting = rz_analysis_get_blocks_in(analysis, addr);
     RzListIter *iter;
     RzAnalysisBlock *bb;
  
     RzAnalysisBlock *ret = NULL;
     rz_list_foreach (intersecting, iter, bb) {
         ut64 eaddr = bb->addr + bb->size;
         if (((bb->addr >= eaddr && addr == bb->addr) ||
                 rz_analysis_block_contains(bb, addr)) &&
             (!jumpmid || rz_analysis_block_op_starts_at(bb, addr))) {
             if (analysis->opt.delay) {
                 ut8 *buf = malloc(bb->size);
                 if (analysis->iob.read_at(analysis->iob.io, bb->addr, buf, bb->size)) {
                     const int last_instr_idx = bb->ninstr - 1;
                     bool in_delay_slot = false;
                     for (int i = last_instr_idx; i >= 0; i--) {
                         const ut64 off = rz_analysis_block_get_op_offset(bb, i);
                         const ut64 at = bb->addr + off;
                         if (addr <= at || off >= bb->size) {
                             continue;
                         }
                         RzAnalysisOp op;
                         int size = rz_analysis_op(analysis, &op, at, buf + off, bb->size - off, RZ_ANALYSIS_OP_MASK_BASIC);
                         if (size > 0 && op.delay) {
                             if (op.delay >= last_instr_idx - i) {
                                 in_delay_slot = true;
                             }
                             rz_analysis_op_fini(&op);
                             break;
                         }
                         rz_analysis_op_fini(&op);
                     }
                     if (in_delay_slot) {
                         free(buf);
                         continue;
                     }
                 }
                 free(buf);
             }
             ret = bb;
             break;
         }
     }
     rz_list_free(intersecting);
     return ret;
 }

References addr, rz_analysis_bb_t::addr, rz_analysis_options_t::delay, free(), i, rz_io_bind_t::io, rz_analysis_t::iob, malloc(), rz_analysis_bb_t::ninstr, NULL, off, op, rz_analysis_t::opt, rz_io_bind_t::read_at, rz_analysis_block_get_op_offset(), rz_analysis_block_op_starts_at(), rz_analysis_get_blocks_in(), rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_BASIC, rz_list_free(), rz_analysis_bb_t::size, and ut64().

Referenced by run_basic_block_analysis().

◆ calc_reachable_and_remove_block()

static void calc_reachable_and_remove_block	(	RzList *	fcns,
		RzAnalysisFunction *	fcn,
		RzAnalysisBlock *	bb,
		HtUP *	reachable
	)

static

Definition at line 2381 of file fcn.c.

                                                                                                                          {
     clear_bb_vars(fcn, bb, bb->addr, bb->addr + bb->size);
     if (!rz_list_contains(fcns, fcn)) {
         rz_list_append(fcns, fcn);
  
         // Calculate reachable blocks from the start of function
         HtUP *ht = ht_up_new0();
         BlockRecurseCtx ctx = { fcn, ht };
         rz_analysis_block_recurse(rz_analysis_get_block_at(fcn->analysis, fcn->addr), mark_as_visited, &ctx);
         ht_up_insert(reachable, fcn->addr, ht);
     }
     fcn->ninstr -= bb->ninstr;
     rz_analysis_function_remove_block(fcn, bb);
 }

References rz_analysis_function_t::addr, rz_analysis_bb_t::addr, rz_analysis_function_t::analysis, clear_bb_vars(), mark_as_visited(), rz_analysis_function_t::ninstr, rz_analysis_bb_t::ninstr, rz_analysis_block_recurse(), rz_analysis_function_remove_block(), rz_analysis_get_block_at(), rz_list_append(), rz_list_contains(), and rz_analysis_bb_t::size.

Referenced by rz_analysis_function_update_analysis(), and rz_analysis_update_analysis_range().

◆ can_affect_bp()

static bool can_affect_bp	(	RzAnalysis *	analysis,
		RzAnalysisOp *	op
	)

static

Definition at line 2147 of file fcn.c.

                                                                   {
     RzAnalysisValue *dst = op->dst;
     RzAnalysisValue *src = op->src[0];
     const char *opdreg = (dst && dst->reg) ? dst->reg->name : NULL;
     const char *opsreg = (src && src->reg) ? src->reg->name : NULL;
     const char *bp_name = analysis->reg->name[RZ_REG_NAME_BP];
     bool is_bp_dst = opdreg && !dst->memref && !strcmp(opdreg, bp_name);
     bool is_bp_src = opsreg && !src->memref && !strcmp(opsreg, bp_name);
     if (op->type == RZ_ANALYSIS_OP_TYPE_XCHG) {
         return is_bp_src || is_bp_dst;
     }
     return is_bp_dst;
 }

References dst, rz_reg_t::name, NULL, rz_analysis_t::reg, RZ_ANALYSIS_OP_TYPE_XCHG, RZ_REG_NAME_BP, and src.

Referenced by __analysis_fcn_check_bp_use().

◆ check_purity()

static void check_purity	(	HtUP *	ht,
		RzAnalysisFunction *	fcn
	)

static

Definition at line 319 of file fcn.c.

                                                             {
     RzListIter *iter;
     RzList *xrefs = rz_analysis_function_get_xrefs_from(fcn);
     RzAnalysisXRef *xref;
     ht_up_insert(ht, fcn->addr, NULL);
     fcn->is_pure = true;
     rz_list_foreach (xrefs, iter, xref) {
         if (xref->type == RZ_ANALYSIS_XREF_TYPE_CALL || xref->type == RZ_ANALYSIS_XREF_TYPE_CODE) {
             RzAnalysisFunction *called_fcn = rz_analysis_get_fcn_in(fcn->analysis, xref->to, 0);
             if (!called_fcn) {
                 continue;
             }
             if (!purity_checked(ht, called_fcn)) {
                 check_purity(ht, called_fcn);
             }
             if (!called_fcn->is_pure) {
                 fcn->is_pure = false;
                 break;
             }
         }
         if (xref->type == RZ_ANALYSIS_XREF_TYPE_DATA) {
             fcn->is_pure = false;
             break;
         }
     }
     rz_list_free(xrefs);
 }

References rz_analysis_function_t::addr, rz_analysis_function_t::analysis, rz_analysis_function_t::is_pure, NULL, purity_checked(), rz_analysis_function_get_xrefs_from(), rz_analysis_get_fcn_in(), RZ_ANALYSIS_XREF_TYPE_CALL, RZ_ANALYSIS_XREF_TYPE_CODE, RZ_ANALYSIS_XREF_TYPE_DATA, rz_list_free(), rz_analysis_ref_t::to, and rz_analysis_ref_t::type.

Referenced by rz_analysis_function_purity().

◆ clear_bb_vars()

static void clear_bb_vars	(	RzAnalysisFunction *	fcn,
		RzAnalysisBlock *	bb,
		ut64	from,
		ut64	to
	)

static

Definition at line 2312 of file fcn.c.

                                                                                             {
     int i;
     if (rz_pvector_empty(&fcn->vars)) {
         return;
     }
     for (i = 0; i < bb->ninstr; i++) {
         const ut64 addr = rz_analysis_block_get_op_addr(bb, i);
         if (addr < from) {
             continue;
         }
         if (addr >= to || addr == UT64_MAX) {
             break;
         }
         RzPVector *vars = rz_analysis_function_get_vars_used_at(fcn, addr);
         if (vars) {
             RzPVector *vars_clone = (RzPVector *)rz_vector_clone((RzVector *)vars);
             void **v;
             rz_pvector_foreach (vars_clone, v) {
                 rz_analysis_var_remove_access_at((RzAnalysisVar *)*v, addr);
             }
             rz_pvector_clear(vars_clone);
         }
     }
 }

References addr, from, i, rz_analysis_bb_t::ninstr, rz_analysis_block_get_op_addr(), rz_analysis_function_get_vars_used_at(), rz_analysis_var_remove_access_at(), rz_pvector_clear(), rz_pvector_empty(), rz_pvector_foreach, rz_vector_clone(), to, ut64(), UT64_MAX, v, and rz_analysis_function_t::vars.

Referenced by calc_reachable_and_remove_block(), and rz_analysis_update_analysis_range().

◆ does_arch_destroys_dst()

static bool does_arch_destroys_dst ( const char * arch )

inlinestatic

Definition at line 525 of file fcn.c.

                                                             {
     return arch && (!strncmp(arch, "arm", 3) || !strcmp(arch, "riscv") || !strcmp(arch, "ppc"));
 }

References arch.

Referenced by run_basic_block_analysis().

◆ fcn_append_basic_block()

static RzAnalysisBlock* fcn_append_basic_block	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		ut64	addr
	)

static

Definition at line 128 of file fcn.c.

                                                                                                          {
     RzAnalysisBlock *bb = rz_analysis_create_block(analysis, addr, 0);
     if (!bb) {
         return NULL;
     }
     rz_analysis_function_add_block(fcn, bb);
     bb->stackptr = fcn->stack;
     bb->parent_stackptr = fcn->stack;
     return bb;
 }

References addr, NULL, rz_analysis_bb_t::parent_stackptr, rz_analysis_create_block(), rz_analysis_function_add_block(), rz_analysis_function_t::stack, and rz_analysis_bb_t::stackptr.

Referenced by run_basic_block_analysis().

◆ fcn_takeover_block_recursive()

static void fcn_takeover_block_recursive	(	RzAnalysisFunction *	fcn,
		RzAnalysisBlock *	start_block
	)

static

Definition at line 474 of file fcn.c.

                                                                                                 {
     BlockTakeoverCtx ctx = { fcn, start_block->parent_stackptr - fcn->stack };
     rz_analysis_block_recurse_followthrough(start_block, fcn_takeover_block_recursive_followthrough_cb, &ctx);
 }

References fcn_takeover_block_recursive_followthrough_cb(), rz_analysis_bb_t::parent_stackptr, rz_analysis_block_recurse_followthrough(), and rz_analysis_function_t::stack.

Referenced by run_basic_block_analysis().

◆ fcn_takeover_block_recursive_followthrough_cb()

static bool fcn_takeover_block_recursive_followthrough_cb	(	RzAnalysisBlock *	block,
		void *	user
	)

static

Definition at line 412 of file fcn.c.

                                                                                               {
     BlockTakeoverCtx *ctx = user;
     RzAnalysisFunction *our_fcn = ctx->fcn;
     rz_analysis_block_ref(block);
     while (!rz_list_empty(block->fcns)) {
         RzAnalysisFunction *other_fcn = rz_list_first(block->fcns);
         if (other_fcn->addr == block->addr) {
             return false;
         }
         // Steal vars from this block
         size_t i;
         for (i = 0; i < block->ninstr; i++) {
             const ut64 addr = rz_analysis_block_get_op_addr(block, i);
             RzPVector *vars_used = rz_analysis_function_get_vars_used_at(other_fcn, addr);
             if (!vars_used) {
                 continue;
             }
             // vars_used will get modified if rz_analysis_var_remove_access_at gets called
             RzPVector *cloned_vars_used = (RzPVector *)rz_vector_clone((RzVector *)vars_used);
             void **it;
             rz_pvector_foreach (cloned_vars_used, it) {
                 RzAnalysisVar *other_var = *it;
                 int actual_delta = 0;
                 switch (other_var->kind) {
                 case RZ_ANALYSIS_VAR_KIND_SPV:
                     actual_delta = other_var->delta + ctx->stack_diff;
                     break;
                 case RZ_ANALYSIS_VAR_KIND_BPV:
                     actual_delta = other_var->delta + (other_fcn->bp_off - our_fcn->bp_off);
                     break;
                 case RZ_ANALYSIS_VAR_KIND_REG:
                     actual_delta = other_var->delta;
                     break;
                 }
                 RzAnalysisVar *our_var = rz_analysis_function_get_var(our_fcn, other_var->kind, actual_delta);
                 if (!our_var) {
                     our_var = rz_analysis_function_set_var(our_fcn, actual_delta, other_var->kind, other_var->type, 0, other_var->isarg, other_var->name);
                 }
                 if (our_var) {
                     RzAnalysisVarAccess *acc = rz_analysis_var_get_access_at(other_var, addr);
                     rz_analysis_var_set_access(our_var, acc->reg, addr, acc->type, acc->stackptr);
                 }
                 rz_analysis_var_remove_access_at(other_var, addr);
                 if (rz_vector_empty(&other_var->accesses)) {
                     rz_analysis_function_delete_var(other_fcn, other_var);
                 }
             }
             rz_pvector_free(cloned_vars_used);
         }
  
         // TODO: remove block->ninstr from other_fcn considering delay slots
         rz_analysis_function_remove_block(other_fcn, block);
     }
     block->stackptr -= ctx->stack_diff;
     block->parent_stackptr -= ctx->stack_diff;
     rz_analysis_function_add_block(our_fcn, block);
     // TODO: add block->ninstr from our_fcn considering delay slots
     rz_analysis_block_unref(block);
     return true;
 }

References rz_analysis_var_t::accesses, addr, rz_analysis_function_t::addr, rz_analysis_bb_t::addr, rz_analysis_function_t::bp_off, rz_analysis_var_t::delta, rz_analysis_bb_t::fcns, i, rz_analysis_var_t::isarg, rz_analysis_var_t::kind, rz_analysis_var_t::name, rz_analysis_bb_t::ninstr, rz_analysis_bb_t::parent_stackptr, rz_analysis_var_access_t::reg, rz_analysis_block_get_op_addr(), rz_analysis_block_ref(), rz_analysis_block_unref(), rz_analysis_function_add_block(), rz_analysis_function_delete_var(), rz_analysis_function_get_var(), rz_analysis_function_get_vars_used_at(), rz_analysis_function_remove_block(), rz_analysis_function_set_var(), rz_analysis_var_get_access_at(), RZ_ANALYSIS_VAR_KIND_BPV, RZ_ANALYSIS_VAR_KIND_REG, RZ_ANALYSIS_VAR_KIND_SPV, rz_analysis_var_remove_access_at(), rz_analysis_var_set_access(), rz_list_first(), rz_pvector_foreach, rz_pvector_free(), rz_vector_clone(), rz_vector_empty(), rz_analysis_var_access_t::stackptr, rz_analysis_bb_t::stackptr, rz_analysis_var_access_t::type, rz_analysis_var_t::type, and ut64().

Referenced by fcn_takeover_block_recursive().

◆ free_ht_up()

static void free_ht_up ( HtUPKv * kv )

static

Definition at line 2276 of file fcn.c.

                                    {
     ht_up_free((HtUP *)kv->value);
 }

Referenced by rz_analysis_function_update_analysis(), and rz_analysis_update_analysis_range().

◆ free_leaddr_pair()

static void free_leaddr_pair ( void * pair )

static

Definition at line 353 of file fcn.c.

                                          {
     leaddr_pair *_pair = pair;
     free(_pair->reg);
     free(_pair);
 }

References free(), and leaddr_pair::reg.

Referenced by run_basic_block_analysis().

◆ is_delta_pointer_table()

static bool is_delta_pointer_table	(	RzAnalysis *	analysis,
		ut64	addr,
		ut64	lea_ptr,
		ut64 *	jmptbl_addr,
		ut64 *	casetbl_addr,
		RzAnalysisOp *	jmp_aop
	)

static

Definition at line 166 of file fcn.c.

                                                                                                                                                 {
     int i;
     ut64 dst;
     st32 jmptbl[64] = { 0 };
     /* check if current instruction is followed by an ujmp */
     ut8 buf[JMPTBL_LEA_SEARCH_SZ];
     RzAnalysisOp *aop = jmp_aop;
     RzAnalysisOp omov_aop = { 0 };
     RzAnalysisOp mov_aop = { 0 };
     RzAnalysisOp add_aop = { 0 };
     RzRegItem *reg_src = NULL, *o_reg_dst = NULL;
     RzAnalysisValue cur_scr, cur_dst = { 0 };
     read_ahead(analysis, addr, (ut8 *)buf, sizeof(buf));
     bool isValid = false;
     for (i = 0; i + 8 < JMPTBL_LEA_SEARCH_SZ; i++) {
         ut64 at = addr + i;
         int left = JMPTBL_LEA_SEARCH_SZ - i;
         int len = rz_analysis_op(analysis, aop, at, buf + i, left, RZ_ANALYSIS_OP_MASK_BASIC | RZ_ANALYSIS_OP_MASK_HINT | RZ_ANALYSIS_OP_MASK_VAL);
         if (len < 1) {
             len = 1;
         }
         if (aop->type == RZ_ANALYSIS_OP_TYPE_UJMP || aop->type == RZ_ANALYSIS_OP_TYPE_RJMP) {
             isValid = true;
             break;
         } else if (aop->type == RZ_ANALYSIS_OP_TYPE_JMP || aop->type == RZ_ANALYSIS_OP_TYPE_CJMP) {
             break;
         }
         if (aop->type == RZ_ANALYSIS_OP_TYPE_MOV) {
             omov_aop = mov_aop;
             mov_aop = *aop;
             o_reg_dst = cur_dst.reg;
             if (mov_aop.dst) {
                 cur_dst = *mov_aop.dst;
             }
             if (mov_aop.src[0]) {
                 cur_scr = *mov_aop.src[0];
                 reg_src = cur_scr.regdelta;
             }
         }
         if (aop->type == RZ_ANALYSIS_OP_TYPE_ADD) {
             add_aop = *aop;
         }
         rz_analysis_op_fini(aop);
         i += len - 1;
     }
     if (!isValid) {
         return false;
     }
  
     // check if we have a msvc 19xx style jump table using rva table entries
     // lea reg1, [base_addr]
     // mov reg2, dword [reg1 + tbl_off*4 + tbl_loc_off]
     // add reg2, reg1
     // jmp reg2
     if (mov_aop.type && add_aop.type && mov_aop.addr < add_aop.addr && add_aop.addr < jmp_aop->addr && mov_aop.disp && mov_aop.disp != UT64_MAX) {
         // disp in this case should be tbl_loc_off
         *jmptbl_addr += mov_aop.disp;
         if (o_reg_dst && reg_src && o_reg_dst->offset == reg_src->offset && omov_aop.disp != UT64_MAX) {
             // Special case for indirection
             // lea reg1, [base_addr]
             // movzx reg2, byte [reg1 + tbl_off + casetbl_loc_off]
             // mov reg3, dword [reg1 + reg2*4 + tbl_loc_off]
             // add reg3, reg1
             // jmp reg3
             *casetbl_addr += omov_aop.disp;
         }
     }
 #if 0
     // required for the last jmptbl.. but seems to work without it and breaks other tests
     if (mov_aop.type && mov_aop.ptr) {
         *jmptbl_addr += mov_aop.ptr;
         // absjmptbl
         lea_ptr = mov_aop.ptr;
     }
 #endif
     /* check if jump table contains valid deltas */
     read_ahead(analysis, *jmptbl_addr, (ut8 *)&jmptbl, 64);
     for (i = 0; i < 3; i++) {
         dst = lea_ptr + (st32)rz_read_le32(jmptbl);
         if (!analysis->iob.is_valid_offset(analysis->iob.io, dst, 0)) {
             RZ_LOG_VERBOSE("Jump table target is not valid: 0x%" PFMT64x "\n", dst);
             return false;
         }
         if (!UT64_ADD_OVFCHK(jmp_aop->addr, analysis->opt.jmptbl_maxoffset) &&
             dst > jmp_aop->addr + analysis->opt.jmptbl_maxoffset) {
             RZ_LOG_VERBOSE("Jump table target is too far away: 0x%" PFMT64x "\n", dst);
             return false;
         }
         if (analysis->opt.jmpabove && !UT64_SUB_OVFCHK(jmp_aop->addr, analysis->opt.jmptbl_maxoffset) &&
             dst < jmp_aop->addr - analysis->opt.jmptbl_maxoffset) {
             RZ_LOG_VERBOSE("Jump table target is too far away: 0x%" PFMT64x "\n", dst);
             return false;
         }
     }
     return true;
 }

References addr, rz_analysis_op_t::addr, rz_analysis_op_t::disp, rz_analysis_op_t::dst, dst, i, rz_io_bind_t::io, rz_analysis_t::iob, rz_io_bind_t::is_valid_offset, isValid(), rz_analysis_options_t::jmpabove, JMPTBL_LEA_SEARCH_SZ, rz_analysis_options_t::jmptbl_maxoffset, len, NULL, rz_reg_item_t::offset, rz_analysis_t::opt, PFMT64x, rz_analysis_op_t::ptr, read_ahead(), rz_analysis_value_t::reg, rz_analysis_value_t::regdelta, rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_MASK_HINT, RZ_ANALYSIS_OP_MASK_VAL, RZ_ANALYSIS_OP_TYPE_ADD, RZ_ANALYSIS_OP_TYPE_CJMP, RZ_ANALYSIS_OP_TYPE_JMP, RZ_ANALYSIS_OP_TYPE_MOV, RZ_ANALYSIS_OP_TYPE_RJMP, RZ_ANALYSIS_OP_TYPE_UJMP, RZ_LOG_VERBOSE, rz_read_le32(), rz_analysis_op_t::src, st32, rz_analysis_op_t::type, ut64(), UT64_ADD_OVFCHK, UT64_MAX, and UT64_SUB_OVFCHK.

Referenced by run_basic_block_analysis().

◆ isInvalidMemory()

static bool isInvalidMemory	(	RzAnalysis *	analysis,
		const ut8 *	buf,
		int	len
	)

static

Definition at line 143 of file fcn.c.

                                                                            {
     if (analysis->opt.nonull > 0) {
         int i;
         const int count = RZ_MIN(len, analysis->opt.nonull);
         for (i = 0; i < count; i++) {
             if (buf[i]) {
                 break;
             }
         }
         if (i == count) {
             return true;
         }
     }
     return !memcmp(buf, "\xff\xff\xff\xff", RZ_MIN(len, 4));
 }

References count, i, len, rz_analysis_options_t::nonull, rz_analysis_t::opt, and RZ_MIN.

Referenced by run_basic_block_analysis().

◆ isSymbolNextInstruction()

static bool isSymbolNextInstruction	(	RzAnalysis *	analysis,
		RzAnalysisOp *	op
	)

static

Definition at line 159 of file fcn.c.

                                                                             {
     rz_return_val_if_fail(analysis && op && analysis->flb.get_at, false);
  
     RzFlagItem *fi = analysis->flb.get_at(analysis->flb.f, op->addr + op->size, false);
     return (fi && fi->name && (strstr(fi->name, "imp.") || strstr(fi->name, "sym.") || strstr(fi->name, "entry") || strstr(fi->name, "main")));
 }

References rz_flag_bind_t::f, rz_analysis_t::flb, rz_flag_bind_t::get_at, rz_flag_item_t::name, and rz_return_val_if_fail.

Referenced by run_basic_block_analysis().

◆ mark_as_visited()

static bool mark_as_visited	(	RzAnalysisBlock *	bb,
		void *	user
	)

static

Definition at line 2251 of file fcn.c.

                                                              {
     BlockRecurseCtx *ctx = user;
     ht_up_insert(ctx->visited, bb->addr, NULL);
     return true;
 }

References rz_analysis_bb_t::addr, and NULL.

Referenced by analize_addr_cb(), and calc_reachable_and_remove_block().

◆ op_is_set_bp()

static bool op_is_set_bp	(	RzAnalysisOp *	op,
		const char *	bp_reg,
		const char *	sp_reg
	)

inlinestatic

Definition at line 516 of file fcn.c.

                                                                                           {
     bool has_dst_reg = op->dst && op->dst->reg && op->dst->reg->name;
     bool has_src_reg = op->src[0] && op->src[0]->reg && op->src[0]->reg->name;
     if (has_dst_reg && has_src_reg) {
         return !strcmp(bp_reg, op->dst->reg->name) && !strcmp(sp_reg, op->src[0]->reg->name);
     }
     return false;
 }

Referenced by run_basic_block_analysis().

◆ purity_checked()

static bool purity_checked	(	HtUP *	ht,
		RzAnalysisFunction *	fcn
	)

static

Definition at line 306 of file fcn.c.

                                                               {
     bool checked;
     ht_up_find(ht, fcn->addr, &checked);
     return checked;
 }

References rz_analysis_function_t::addr.

Referenced by check_purity().

◆ read_ahead()

static int read_ahead	(	RzAnalysis *	analysis,
		ut64	addr,
		ut8 *	buf,
		int	len
	)

static

Definition at line 52 of file fcn.c.

                                                                           {
     static ut8 cache[1024];
     const int cache_len = sizeof(cache);
  
     if (len < 1) {
         return 0;
     }
     if (len > cache_len) {
         int a = analysis->iob.read_at(analysis->iob.io, addr, buf, len); // double read
         memcpy(cache, buf, cache_len);
         cache_addr = addr;
         return a;
     }
  
     ut64 addr_end = UT64_ADD_OVFCHK(addr, len) ? UT64_MAX : addr + len;
     ut64 cache_addr_end = UT64_ADD_OVFCHK(cache_addr, cache_len) ? UT64_MAX : cache_addr + cache_len;
     bool isCached = ((addr != UT64_MAX) && (addr >= cache_addr) && (addr_end < cache_addr_end));
     if (isCached) {
         memcpy(buf, cache + (addr - cache_addr), len);
     } else {
         analysis->iob.read_at(analysis->iob.io, addr, cache, sizeof(cache));
         memcpy(buf, cache, len);
         cache_addr = addr;
     }
     return len;
 }

References a, addr, cache_addr, rz_io_bind_t::io, rz_analysis_t::iob, len, memcpy(), rz_io_bind_t::read_at, ut64(), UT64_ADD_OVFCHK, and UT64_MAX.

Referenced by is_delta_pointer_table(), and run_basic_block_analysis().

◆ regs_exist()

static bool regs_exist	(	RzAnalysisValue *	src,
		RzAnalysisValue *	dst
	)

static

Definition at line 282 of file fcn.c.

                                                                    {
     rz_return_val_if_fail(src && dst, false);
     return src->reg && dst->reg && src->reg->name && dst->reg->name;
 }

References dst, rz_return_val_if_fail, and src.

Referenced by run_basic_block_analysis().

◆ retpoline_reg()

static const char* retpoline_reg	(	RzAnalysis *	analysis,
		ut64	addr
	)

static

Definition at line 479 of file fcn.c.

                                                                   {
     RzFlagItem *flag = analysis->flag_get(analysis->flb.f, addr);
     if (flag) {
         const char *token = "x86_indirect_thunk_";
         const char *thunk = strstr(flag->name, token);
         if (thunk) {
             return thunk + strlen(token);
         }
     }
 #if 0
 // TODO: implement following code analysis check for stripped binaries:
 // 1) op(addr).type == CALL
 // 2) call_dest = op(addr).addr
 // 3) op(call_dest).type == STORE
 // 4) op(call_dest + op(call_dest).size).type == RET
 [0x00000a65]> pid 6
 0x00000a65  sym.__x86_indirect_thunk_rax:
 0x00000a65  .------- e807000000  call 0xa71
 0x00000a6a  |              f390  pause
 0x00000a6c  |            0faee8  lfence
 0x00000a6f  |              ebf9  jmp 0xa6a
 0x00000a71  `---->     48890424  mov qword [rsp], rax
 0x00000a75                   c3  ret
 #endif
     return NULL;
 }

References addr, c3, call(), rz_flag_bind_t::f, rz_analysis_t::flag_get, rz_analysis_t::flb, jmp, mov(), rz_flag_item_t::name, NULL, pid, and rax.

Referenced by analyze_retpoline().

◆ run_basic_block_analysis()

static RzAnalysisBBEndCause run_basic_block_analysis	(	RzAnalysisTaskItem *	item,
		RzVector *	tasks
	)

static

Analyses the given task item item for branches.

Analysis starts for all instructions from item->start_address. If a branch is encountered a new task item is added to the list tasks. If an end of a basic function block is encountered (e.g. an invalid instruction), the cause for it is returned.

Parameters

item	The task item with the parent function and start address to start analysing from.
tasks	The task list to append the new task items to.

Returns: RzAnalysisBBEndCause Cause a basic block ended.

Definition at line 559 of file fcn.c.

                                                                                                 {
     rz_return_val_if_fail(item && tasks, RZ_ANALYSIS_RET_ERROR);
     RzAnalysis *analysis = item->fcn->analysis;
     RzAnalysisFunction *fcn = item->fcn;
     fcn->stack = item->stack;
     ut64 addr = item->start_address;
     ut64 len = analysis->opt.bb_max_size;
     const int continue_after_jump = analysis->opt.afterjmp;
     const int addrbytes = analysis->iob.io ? analysis->iob.io->addrbytes : 1;
     char *last_reg_mov_lea_name = NULL;
     char *movbasereg = NULL;
     RzAnalysisBlock *bb = item->block;
     RzAnalysisBlock *bbg = NULL;
     RzAnalysisBBEndCause ret = RZ_ANALYSIS_RET_END, skip_ret = 0;
     bool overlapped = false;
     RzAnalysisOp op = { 0 };
     int oplen, idx = 0;
     int lea_cnt = 0;
     static ut64 cmpval = UT64_MAX; // inherited across functions, otherwise it breaks :?
     bool varset = false;
     struct {
         int cnt;
         int idx;
         int after;
         int pending;
         int adjust;
         int un_idx; // delay.un_idx
     } delay = {
         0
     };
     char tmp_buf[MAX_FLG_NAME_SIZE + 5] = "skip";
     bool arch_destroys_dst = does_arch_destroys_dst(analysis->cur->arch);
     bool is_arm = false, is_x86 = false, is_amd64 = false, is_dalvik = false, is_hexagon = false;
     if (analysis->cur->arch) {
         is_arm = !strncmp(analysis->cur->arch, "arm", 3);
         is_x86 = !strncmp(analysis->cur->arch, "x86", 3);
         is_dalvik = !strncmp(analysis->cur->arch, "dalvik", 6);
         is_hexagon = !strncmp(analysis->cur->arch, "hexagon", 7);
     }
     is_amd64 = is_x86 ? fcn->cc && !strcmp(fcn->cc, "amd64") : false;
     bool can_jmpmid = analysis->opt.jmpmid && (is_dalvik || is_x86);
  
     RzRegItem *variadic_reg = NULL;
     if (is_amd64) {
         variadic_reg = rz_reg_get(analysis->reg, "rax", RZ_REG_TYPE_GPR);
     }
     bool has_variadic_reg = !!variadic_reg;
  
     if (rz_cons_is_breaked()) {
         rz_analysis_task_item_new(analysis, tasks, fcn, bb, addr);
         return RZ_ANALYSIS_RET_END;
     }
     if (analysis->sleep) {
         rz_sys_usleep(analysis->sleep);
     }
  
     // check if address is readable
     if (!analysis->iob.is_valid_offset(analysis->iob.io, addr, 0)) {
         if (addr != UT64_MAX && !analysis->iob.io->va) {
             RZ_LOG_DEBUG("Invalid address 0x%" PFMT64x ". Try with io.va=true\n", addr);
         }
         return RZ_ANALYSIS_RET_ERROR; // MUST BE TOO DEEP
     }
  
     RzAnalysisFunction *fcn_at_addr = rz_analysis_get_function_at(analysis, addr);
     if (fcn_at_addr && fcn_at_addr != fcn) {
         return RZ_ANALYSIS_RET_ERROR; // MUST BE NOT FOUND
     }
  
     if (!bb) {
         RzAnalysisBlock *existing_bb = bbget(analysis, addr, can_jmpmid);
         if (existing_bb) {
             bool existing_in_fcn = rz_list_contains(existing_bb->fcns, fcn);
             existing_bb = rz_analysis_block_split(existing_bb, addr);
             if (!existing_in_fcn && existing_bb) {
                 if (existing_bb->addr == fcn->addr) {
                     // our function starts directly there, so we steal what is ours!
                     fcn_takeover_block_recursive(fcn, existing_bb);
                 }
             }
             if (existing_bb) {
                 rz_analysis_block_unref(existing_bb);
             }
             if (analysis->opt.recont) {
                 return RZ_ANALYSIS_RET_END;
             }
             RZ_LOG_DEBUG("%s fails at 0x%" PFMT64x ".\n", __FUNCTION__, addr);
             return RZ_ANALYSIS_RET_ERROR; // MUST BE NOT DUP
         }
  
         item->block = bb = fcn_append_basic_block(analysis, fcn, addr);
         // we checked before whether there is a bb at addr, so the create should have succeeded
         rz_return_val_if_fail(bb, RZ_ANALYSIS_RET_ERROR);
     }
  
     if (!analysis->leaddrs) {
         analysis->leaddrs = rz_list_newf(free_leaddr_pair);
         if (!analysis->leaddrs) {
             RZ_LOG_ERROR("Cannot allocate list of pairs<reg, addr> values.\n");
             gotoBeach(RZ_ANALYSIS_RET_ERROR);
         }
     }
     static ut64 lea_jmptbl_ip = UT64_MAX;
     ut64 last_reg_mov_lea_val = UT64_MAX;
     bool last_is_reg_mov_lea = false;
     bool last_is_push = false;
     bool last_is_mov_lr_pc = false;
     ut64 last_push_addr = UT64_MAX;
     if (analysis->limit && addr + idx < analysis->limit->from) {
         gotoBeach(RZ_ANALYSIS_RET_END);
     }
     RzAnalysisFunction *tmp_fcn = rz_analysis_get_fcn_in(analysis, addr, 0);
     if (tmp_fcn) {
         // Checks if var is already analyzed at given addr
         RzList *list = rz_analysis_var_all_list(analysis, tmp_fcn);
         if (!rz_list_empty(list)) {
             varset = true;
         }
         rz_list_free(list);
     }
     ut64 movdisp = UT64_MAX; // used by jmptbl when coded as "mov reg, [reg * scale + disp]"
     ut64 movscale = 0;
     ut8 buf[32]; // 32 bytes is enough to hold any instruction.
     int maxlen = len * addrbytes;
     if (is_dalvik) {
         bool skipAnalysis = false;
         if (!strncmp(fcn->name, "sym.", 4)) {
             if (!strncmp(fcn->name + 4, "imp.", 4)) {
                 skipAnalysis = true;
             } else if (strstr(fcn->name, "field")) {
                 skipAnalysis = true;
             }
         }
         if (skipAnalysis) {
             gotoBeach(RZ_ANALYSIS_RET_END);
         }
     }
     if ((maxlen - (addrbytes * idx)) > MAX_SCAN_SIZE) {
         RZ_LOG_DEBUG("Skipping large memory region during basic block analysis.\n");
         maxlen = 0;
     }
  
     while (addrbytes * idx < maxlen) {
         ut32 at_delta;
         ut64 at;
         if (!last_is_reg_mov_lea) {
             free(last_reg_mov_lea_name);
             last_reg_mov_lea_name = NULL;
         }
         if (analysis->limit && analysis->limit->to <= addr + idx) {
             break;
         }
     repeat:
         at_delta = addrbytes * idx;
         at = addr + at_delta;
         if (rz_cons_is_breaked()) {
             rz_analysis_task_item_new(analysis, tasks, fcn, bb, at);
             break;
         }
         ut64 bytes_read = RZ_MIN(len - at_delta, sizeof(buf));
         ret = read_ahead(analysis, at, buf, bytes_read);
  
         if (ret < 0) {
             RZ_LOG_ERROR("Failed to read ahead\n");
             break;
         }
         if (isInvalidMemory(analysis, buf, bytes_read)) {
             RZ_LOG_DEBUG("FFFF opcode at 0x%08" PFMT64x "\n", at);
             gotoBeach(RZ_ANALYSIS_RET_ERROR)
         }
         rz_analysis_op_fini(&op);
         if ((oplen = rz_analysis_op(analysis, &op, at, buf, bytes_read, RZ_ANALYSIS_OP_MASK_ESIL | RZ_ANALYSIS_OP_MASK_VAL | RZ_ANALYSIS_OP_MASK_HINT)) < 1) {
             RZ_LOG_DEBUG("Invalid instruction at 0x%" PFMT64x " with %d bits\n", at, analysis->bits);
             // gotoBeach (RZ_ANALYSIS_RET_ERROR);
             // RET_END causes infinite loops somehow
             gotoBeach(RZ_ANALYSIS_RET_END);
         }
  
         const char *bp_reg = analysis->reg->name[RZ_REG_NAME_BP];
         const char *sp_reg = analysis->reg->name[RZ_REG_NAME_SP];
         bool has_stack_regs = bp_reg && sp_reg;
  
         if (analysis->opt.nopskip && fcn->addr == at) {
             RzFlagItem *fi = analysis->flb.get_at(analysis->flb.f, addr, false);
             if (!fi || strncmp(fi->name, "sym.", 4)) {
                 if ((addr + delay.un_idx - oplen) == fcn->addr) {
                     if (rz_analysis_block_relocate(bb, bb->addr + oplen, bb->size - oplen)) {
                         fcn->addr += oplen;
                         idx = delay.un_idx;
                         goto repeat;
                     }
                 }
             }
             switch (op.type & RZ_ANALYSIS_OP_TYPE_MASK) {
             case RZ_ANALYSIS_OP_TYPE_TRAP:
             case RZ_ANALYSIS_OP_TYPE_ILL:
             case RZ_ANALYSIS_OP_TYPE_NOP:
                 if (rz_analysis_block_relocate(bb, at + op.size, bb->size)) {
                     addr = at + op.size;
                     fcn->addr = addr;
                     goto repeat;
                 }
             }
         }
  
         if (op.hint.new_bits) {
             rz_analysis_hint_set_bits(analysis, op.jump, op.hint.new_bits);
         }
         if (idx > 0 && !overlapped) {
             bbg = bbget(analysis, at, can_jmpmid);
             if (bbg && bbg != bb) {
                 bb->jump = at;
                 if (can_jmpmid) {
                     // This happens when we purposefully walked over another block and overlapped it
                     // and now we hit an offset where the instructions match again.
                     // So we need to split the overwalked block.
                     RzAnalysisBlock *split = rz_analysis_block_split(bbg, at);
                     rz_analysis_block_unref(split);
                 }
                 overlapped = true;
                 RZ_LOG_DEBUG("Overlapped at 0x%08" PFMT64x "\n", at);
             }
         }
         if (!overlapped) {
             ut64 newbbsize = bb->size + oplen;
             if (newbbsize > MAX_FCN_SIZE) {
                 gotoBeach(RZ_ANALYSIS_RET_ERROR);
             }
             rz_analysis_block_set_op_offset(bb, bb->ninstr++, at - bb->addr);
             rz_analysis_block_set_size(bb, newbbsize);
             fcn->ninstr++;
         }
         if (analysis->opt.trycatch) {
             const char *name = analysis->coreb.getName(analysis->coreb.core, at);
             if (name) {
                 if (rz_str_startswith(name, "try.") && rz_str_endswith(name, ".from")) {
                     char *handle = strdup(name);
                     // handle = rz_str_replace (handle, ".from", ".to", 0);
                     ut64 from_addr = analysis->coreb.numGet(analysis->coreb.core, handle);
                     handle = rz_str_replace(handle, ".from", ".catch", 0);
                     ut64 handle_addr = analysis->coreb.numGet(analysis->coreb.core, handle);
                     handle = rz_str_replace(handle, ".catch", ".filter", 0);
                     ut64 filter_addr = analysis->coreb.numGet(analysis->coreb.core, handle);
                     if (filter_addr) {
                         rz_analysis_xrefs_set(analysis, op.addr, filter_addr, RZ_ANALYSIS_XREF_TYPE_CALL);
                     }
                     bb->jump = at + oplen;
                     if (from_addr != bb->addr) {
                         bb->fail = handle_addr;
                         ret = analyze_function_locally(analysis, fcn, handle_addr);
                         if (bb->size == 0) {
                             rz_analysis_function_remove_block(fcn, bb);
                         }
                         rz_analysis_block_update_hash(bb);
                         rz_analysis_block_unref(bb);
                         bb = fcn_append_basic_block(analysis, fcn, bb->jump);
                         if (!bb) {
                             gotoBeach(RZ_ANALYSIS_RET_ERROR);
                         }
                     }
                 }
             }
         }
         idx += oplen;
         delay.un_idx = idx;
         if (analysis->opt.delay && op.delay > 0 && !delay.pending) {
             // Handle first pass through a branch delay jump:
             // Come back and handle the current instruction later.
             // Save the location of it in `delay.idx`
             // note, we have still increased size of basic block
             // (and function)
             RZ_LOG_DEBUG("Enter branch delay at 0x%08" PFMT64x ". bb->sz=%" PFMT64u "\n", at - oplen, bb->size);
             delay.idx = idx - oplen;
             delay.cnt = op.delay;
             delay.pending = 1; // we need this in case the actual idx is zero...
             delay.adjust = !overlapped; // adjustment is required later to avoid double count
             continue;
         }
  
         if (delay.cnt > 0) {
             // if we had passed a branch delay instruction, keep
             // track of how many still to process.
             delay.cnt--;
             if (!delay.cnt) {
                 RZ_LOG_DEBUG("Last branch delayed opcode at 0x%08" PFMT64x ". bb->sz=%" PFMT64u "\n", addr + idx - oplen, bb->size);
                 delay.after = idx;
                 idx = delay.idx;
                 // At this point, we are still looking at the
                 // last instruction in the branch delay group.
                 // Next time, we will again be looking
                 // at the original instruction that entered
                 // the branch delay.
             }
         } else if (op.delay > 0 && delay.pending) {
             RZ_LOG_DEBUG("Revisit branch delay jump at 0x%08" PFMT64x ". bb->sz=%" PFMT64u "\n", addr + idx - oplen, bb->size);
             // This is the second pass of the branch delaying opcode
             // But we also already counted this instruction in the
             // size of the current basic block, so we need to fix that
             if (delay.adjust) {
                 rz_analysis_block_set_size(bb, (ut64)addrbytes * (ut64)delay.after);
                 fcn->ninstr--;
                 RZ_LOG_DEBUG("Correct for branch delay @ 0x%08" PFMT64x " bb.addr=0x%08" PFMT64x " corrected.bb=%" PFMT64u " f.uncorr=%" PFMT64u "\n",
                     addr + idx - oplen, bb->addr, bb->size, rz_analysis_function_linear_size(fcn));
             }
             // Next time, we go to the opcode after the delay count
             // Take care not to use this below, use delay.un_idx instead ...
             idx = delay.after;
             delay.pending = delay.after = delay.idx = delay.adjust = 0;
         }
         // Note: if we got two branch delay instructions in a row due to an
         // compiler bug or junk or something it wont get treated as a delay
         if (analysis->opt.vars && !varset) {
             rz_analysis_extract_vars(analysis, fcn, &op);
         }
         if (has_stack_regs && arch_destroys_dst) {
             if (op_is_set_bp(&op, bp_reg, sp_reg) && op.src[1]) {
                 switch (op.type & RZ_ANALYSIS_OP_TYPE_MASK) {
                 case RZ_ANALYSIS_OP_TYPE_ADD:
                     fcn->bp_off = fcn->stack - op.src[1]->imm;
                     break;
                 case RZ_ANALYSIS_OP_TYPE_SUB:
                     fcn->bp_off = fcn->stack + op.src[1]->imm;
                     break;
                 }
             }
         }
         switch (op.stackop) {
         case RZ_ANALYSIS_STACK_INC:
             if (RZ_ABS(op.stackptr) < 8096) {
                 fcn->stack += op.stackptr;
                 if (fcn->stack > fcn->maxstack) {
                     fcn->maxstack = fcn->stack;
                 }
             }
             bb->stackptr += op.stackptr;
             break;
         case RZ_ANALYSIS_STACK_RESET:
             bb->stackptr = 0;
             break;
         default:
             break;
         }
         if (op.ptr && op.ptr != UT64_MAX && op.ptr != UT32_MAX) {
             // swapped parameters
             rz_analysis_xrefs_set(analysis, op.addr, op.ptr, RZ_ANALYSIS_XREF_TYPE_DATA);
         }
         analyze_retpoline(analysis, &op);
  
         switch (op.type & RZ_ANALYSIS_OP_TYPE_MASK) {
         case RZ_ANALYSIS_OP_TYPE_CMOV:
         case RZ_ANALYSIS_OP_TYPE_MOV:
             last_is_reg_mov_lea = false;
             if (is_arm) { // mov lr, pc
                 const char *esil = rz_strbuf_get(&op.esil);
                 if (!rz_str_cmp(esil, "pc,lr,=", -1)) {
                     last_is_mov_lr_pc = true;
                 }
             }
             if (has_stack_regs && op_is_set_bp(&op, bp_reg, sp_reg)) {
                 fcn->bp_off = fcn->stack;
             }
             // Is this a mov of immediate value into a register?
             if (op.dst && op.dst->reg && op.dst->reg->name && op.val > 0 && op.val != UT64_MAX) {
                 free(last_reg_mov_lea_name);
                 if ((last_reg_mov_lea_name = strdup(op.dst->reg->name))) {
                     last_reg_mov_lea_val = op.val;
                     last_is_reg_mov_lea = true;
                 }
             }
             // skip mov reg, reg
             if (analysis->opt.jmptbl && op.scale && op.ireg) {
                 movdisp = op.disp;
                 movscale = op.scale;
                 if (op.src[0] && op.src[0]->reg) {
                     free(movbasereg);
                     movbasereg = strdup(op.src[0]->reg->name);
                 } else {
                     RZ_FREE(movbasereg);
                 }
             }
             if (analysis->opt.hpskip && regs_exist(op.src[0], op.dst) && !strcmp(op.src[0]->reg->name, op.dst->reg->name)) {
                 skip_ret = skip_hp(analysis, fcn, &op, bb, addr, tmp_buf, oplen, delay.un_idx, &idx);
                 if (skip_ret == 1) {
                     goto repeat;
                 }
                 if (skip_ret == 2) {
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_LEA:
             last_is_reg_mov_lea = false;
             // if first byte in op.ptr is 0xff, then set leaddr assuming its a jumptable
             if (op.ptr != UT64_MAX) {
                 leaddr_pair *pair = RZ_NEW(leaddr_pair);
                 if (!pair) {
                     RZ_LOG_ERROR("Cannot allocate pair<reg, addr> structure\n");
                     gotoBeach(RZ_ANALYSIS_RET_ERROR);
                 }
                 pair->op_addr = op.addr;
                 pair->leaddr = op.ptr; // XXX movdisp is dupped but seems to be trashed sometimes(?), better track leaddr separately
                 pair->reg = op.reg
                     ? strdup(op.reg)
                     : op.dst && op.dst->reg
                     ? strdup(op.dst->reg->name)
                     : NULL;
                 lea_cnt++;
                 rz_list_append(analysis->leaddrs, pair);
             }
             if (has_stack_regs && op_is_set_bp(&op, bp_reg, sp_reg)) {
                 fcn->bp_off = fcn->stack - op.src[0]->delta;
             }
             if (op.dst && op.dst->reg && op.dst->reg->name && op.ptr > 0 && op.ptr != UT64_MAX) {
                 free(last_reg_mov_lea_name);
                 if ((last_reg_mov_lea_name = strdup(op.dst->reg->name))) {
                     last_reg_mov_lea_val = op.ptr;
                     last_is_reg_mov_lea = true;
                 }
             }
             // skip lea reg,[reg]
             if (analysis->opt.hpskip && regs_exist(op.src[0], op.dst) && !strcmp(op.src[0]->reg->name, op.dst->reg->name)) {
                 skip_ret = skip_hp(analysis, fcn, &op, bb, at, tmp_buf, oplen, delay.un_idx, &idx);
                 if (skip_ret == 1) {
                     goto repeat;
                 }
                 if (skip_ret == 2) {
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             if (analysis->opt.jmptbl) {
                 RzAnalysisOp jmp_aop = { 0 };
                 ut64 jmptbl_addr = op.ptr;
                 ut64 casetbl_addr = op.ptr;
                 if (is_delta_pointer_table(analysis, op.addr, op.ptr, &jmptbl_addr, &casetbl_addr, &jmp_aop)) {
                     // we require both checks here since rz_analysis_get_jmptbl_info uses
                     // BB info of the final jmptbl jump, which is no present with
                     // is_delta_pointer_table just scanning ahead
                     // rz_analysis_get_delta_jmptbl_info doesn't work at times where the
                     // lea comes after the cmp/default case cjmp, which can be
                     // handled with rz_analysis_get_jmptbl_info
                     RzAnalysisJmpTableParams params = {
                         .jmp_address = jmp_aop.addr,
                         .jmptbl_loc = jmptbl_addr,
                         .casetbl_loc = casetbl_addr,
                         .entry_size = 4,
                         .jmptbl_off = op.ptr,
                         .tasks = tasks
                     };
                     if (rz_analysis_get_jmptbl_info(analysis, fcn, bb, jmp_aop.addr, &params) || rz_analysis_get_delta_jmptbl_info(analysis, fcn, jmp_aop.addr, op.addr, &params)) {
                         ret = casetbl_addr == op.ptr
                             ? rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params)
                             : rz_analysis_walkthrough_casetbl(analysis, fcn, bb, &params);
                         if (ret) {
                             lea_jmptbl_ip = jmp_aop.addr;
                         }
                     }
                 }
                 rz_analysis_op_fini(&jmp_aop);
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_LOAD:
             if (analysis->opt.loads) {
                 if (analysis->iob.is_valid_offset(analysis->iob.io, op.ptr, 0)) {
                     rz_meta_set(analysis, RZ_META_TYPE_DATA, op.ptr, 4, "");
                 }
             }
             break;
             // Case of valid but unused "add [rax], al"
         case RZ_ANALYSIS_OP_TYPE_ADD:
             if (analysis->opt.ijmp) {
                 if ((op.size + 4 <= bytes_read) && !memcmp(buf + op.size, "\x00\x00\x00\x00", 4)) {
                     rz_analysis_block_set_size(bb, bb->size - oplen);
                     op.type = RZ_ANALYSIS_OP_TYPE_RET;
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_ILL:
             gotoBeach(RZ_ANALYSIS_RET_END);
         case RZ_ANALYSIS_OP_TYPE_TRAP:
             if (analysis->opt.aftertrap) {
                 continue;
             }
             gotoBeach(RZ_ANALYSIS_RET_END);
         case RZ_ANALYSIS_OP_TYPE_NOP:
             // do nothing, because the nopskip goes before this switch
             break;
         case RZ_ANALYSIS_OP_TYPE_JMP:
             if (op.jump == UT64_MAX) {
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             {
                 RzFlagItem *fi = analysis->flb.get_at(analysis->flb.f, op.jump, false);
                 if (fi && strstr(fi->name, "imp.")) {
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             if (rz_cons_is_breaked()) {
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             if (analysis->opt.jmpref) {
                 (void)rz_analysis_xrefs_set(analysis, op.addr, op.jump, RZ_ANALYSIS_XREF_TYPE_CODE);
             }
             if (!analysis->opt.jmpabove && (op.jump < fcn->addr)) {
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             if (rz_analysis_noreturn_at(analysis, op.jump)) {
                 if (continue_after_jump && is_hexagon) {
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                     if (!overlapped) {
                         set_bb_branches(bb, op.jump, op.addr + op.size);
                     }
                     gotoBeach(RZ_ANALYSIS_RET_BRANCH);
                 }
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             {
                 bool must_eob = true;
                 RzIOMap *map = analysis->iob.map_get(analysis->iob.io, addr);
                 if (map) {
                     must_eob = (op.jump < map->itv.addr || op.jump >= map->itv.addr + map->itv.size);
                 }
                 if (must_eob) {
                     if (continue_after_jump && is_hexagon) {
                         rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                         rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                         if (!overlapped) {
                             set_bb_branches(bb, op.jump, op.addr + op.size);
                         }
                         gotoBeach(RZ_ANALYSIS_RET_BRANCH);
                     }
                     op.jump = UT64_MAX;
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             if (!overlapped) {
                 set_bb_branches(bb, op.jump, UT64_MAX);
             }
             rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
             if (continue_after_jump && (is_hexagon || (is_dalvik && op.cond == RZ_TYPE_COND_EXCEPTION))) {
                 rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                 gotoBeach(RZ_ANALYSIS_RET_BRANCH);
             }
             int tc = analysis->opt.tailcall;
             if (tc) {
                 int diff = op.jump - op.addr;
                 if (tc < 0) {
                     ut8 buf[32];
                     (void)analysis->iob.read_at(analysis->iob.io, op.jump, (ut8 *)buf, sizeof(buf));
                     if (rz_analysis_is_prelude(analysis, buf, sizeof(buf))) {
                         rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                     }
                 } else if (RZ_ABS(diff) > tc) {
                     (void)rz_analysis_xrefs_set(analysis, op.addr, op.jump, RZ_ANALYSIS_XREF_TYPE_CALL);
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             goto beach;
             break;
         case RZ_ANALYSIS_OP_TYPE_SUB:
             if (op.val != UT64_MAX && op.val > 0 && op.val < analysis->opt.jmptbl_maxcount) {
                 // if register is not stack
                 cmpval = op.val;
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_CMP: {
             ut64 val = is_x86 ? op.val : op.ptr;
             if (val) {
                 if (val < analysis->opt.jmptbl_maxcount) {
                     cmpval = val;
                 }
                 bb->cmpval = val;
                 bb->cmpreg = op.reg;
                 rz_analysis_cond_free(bb->cond);
                 bb->cond = rz_analysis_cond_new_from_op(&op);
             }
         } break;
         case RZ_ANALYSIS_OP_TYPE_CJMP:
         case RZ_ANALYSIS_OP_TYPE_MCJMP:
         case RZ_ANALYSIS_OP_TYPE_RCJMP:
         case RZ_ANALYSIS_OP_TYPE_UCJMP:
             if (op.prefix & RZ_ANALYSIS_OP_PREFIX_HWLOOP_END) {
                 if (op.jump != 0) {
                     rz_analysis_xrefs_set(analysis, op.addr, op.jump, RZ_ANALYSIS_XREF_TYPE_CODE);
                 }
                 if (op.fail != 0) {
                     rz_analysis_xrefs_set(analysis, op.addr, op.fail, RZ_ANALYSIS_XREF_TYPE_CODE);
                 }
                 if (continue_after_jump) {
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                 }
                 if (!overlapped) {
                     // If it is an endloop01 instruction the jump to the inner loop is not added yet.
                     set_bb_branches(bb, op.jump, op.addr + op.size);
                 }
                 gotoBeach(RZ_ANALYSIS_RET_BRANCH);
             }
             if (analysis->opt.cjmpref) {
                 rz_analysis_xrefs_set(analysis, op.addr, op.jump, RZ_ANALYSIS_XREF_TYPE_CODE);
                 if (is_hexagon) {
                     rz_analysis_xrefs_set(analysis, op.addr, op.fail, RZ_ANALYSIS_XREF_TYPE_CODE);
                 }
             }
             if (!overlapped) {
                 set_bb_branches(bb, op.jump, op.fail);
             }
             if (bb->cond) {
                 bb->cond->type = op.cond;
             }
             if (analysis->opt.jmptbl) {
                 if (op.ptr != UT64_MAX) {
                     if (cmpval != UT64_MAX && op.fail != UT64_MAX && (op.reg || op.ireg)) {
                         RzAnalysisJmpTableParams params = {
                             .jmp_address = op.addr,
                             .case_shift = 0,
                             .jmptbl_loc = op.ptr,
                             .casetbl_loc = UT64_MAX,
                             .entry_size = analysis->bits >> 3,
                             .table_count = cmpval + 1,
                             .jmptbl_off = op.ptr,
                             .default_case = op.fail,
                             .tasks = tasks
                         };
                         if (op.ireg) {
                             rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                         } else { // op.reg
                             rz_analysis_walkthrough_arm_jmptbl_style(analysis, fcn, bb, &params);
                         }
                         // check if op.jump and op.fail contain jump table location
                         // clear jump address, because it's jump table location
                         if (op.jump == op.ptr) {
                             op.jump = UT64_MAX;
                         } else if (op.fail == op.ptr) {
                             op.fail = UT64_MAX;
                         }
                         cmpval = UT64_MAX;
                     }
                 }
             }
             rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.fail);
             rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
             if (continue_after_jump && is_hexagon) {
                 if (op.type == RZ_ANALYSIS_OP_TYPE_RCJMP) {
                     break;
                 }
                 rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                 gotoBeach(RZ_ANALYSIS_RET_BRANCH);
             }
             if (!continue_after_jump) {
                 if (op.jump < fcn->addr) {
                     if (!overlapped) {
                         bb->jump = op.jump;
                         bb->fail = UT64_MAX;
                     }
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
  
             // XXX breaks mips analysis too !op.delay
             // this will be all x86, arm (at least)
             // without which the analysis is really slow,
             // presumably because each opcode would get revisited
             // (and already covered by a bb) many times
             if (!is_dalvik) {
                 goto beach;
             }
             // For some reason, branch delayed code (MIPS) needs to continue
             break;
         case RZ_ANALYSIS_OP_TYPE_UCALL:
         case RZ_ANALYSIS_OP_TYPE_RCALL:
         case RZ_ANALYSIS_OP_TYPE_ICALL:
         case RZ_ANALYSIS_OP_TYPE_IRCALL:
             /* call [dst] */
             // XXX: this is TYPE_MCALL or indirect-call
             (void)rz_analysis_xrefs_set(analysis, op.addr, op.ptr, RZ_ANALYSIS_XREF_TYPE_CALL);
  
             if (rz_analysis_noreturn_at(analysis, op.ptr)) {
                 RzAnalysisFunction *f = rz_analysis_get_function_at(analysis, op.ptr);
                 if (f) {
                     f->is_noreturn = true;
                 }
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_CCALL:
         case RZ_ANALYSIS_OP_TYPE_CALL:
             /* call dst */
             (void)rz_analysis_xrefs_set(analysis, op.addr, op.jump, RZ_ANALYSIS_XREF_TYPE_CALL);
  
             if (rz_analysis_noreturn_at(analysis, op.jump)) {
                 RzAnalysisFunction *f = rz_analysis_get_function_at(analysis, op.jump);
                 if (f) {
                     f->is_noreturn = true;
                 }
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_UJMP:
         case RZ_ANALYSIS_OP_TYPE_RJMP:
             if (is_hexagon) {
                 if (op.analysis_vals[0].plugin_specific == 31) {
                     // jumpr Rs instruction which uses R31.
                     // This is a return, but not typed as such.
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 } else {
                     // Ignore
                     break;
                 }
             }
             if (is_arm && last_is_mov_lr_pc) {
                 break;
             }
             /* fall through */
         case RZ_ANALYSIS_OP_TYPE_MJMP:
         case RZ_ANALYSIS_OP_TYPE_IJMP:
         case RZ_ANALYSIS_OP_TYPE_IRJMP:
             // if the next instruction is a symbol
             if (analysis->opt.ijmp && isSymbolNextInstruction(analysis, &op)) {
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             // switch statement
             if (analysis->opt.jmptbl && lea_jmptbl_ip != op.addr) {
                 RzAnalysisJmpTableParams params = {
                     .jmp_address = op.addr,
                     .entry_size = analysis->bits >> 3,
                     .jmptbl_loc = op.ptr,
                     .jmptbl_off = op.ptr,
                     .tasks = tasks
                 };
                 // op.ireg since rip relative addressing produces way too many false positives otherwise
                 // op.ireg is 0 for rip relative, "rax", etc otherwise
                 if (op.ptr != UT64_MAX && op.ireg) { // direct jump
                     if (rz_analysis_get_jmptbl_info(analysis, fcn, bb, op.addr, &params)) {
                         bool case_table = false;
                         RzAnalysisOp prev_op;
                         analysis->iob.read_at(analysis->iob.io, op.addr - op.size, buf, sizeof(buf));
                         if (rz_analysis_op(analysis, &prev_op, op.addr - op.size, buf, sizeof(buf), RZ_ANALYSIS_OP_MASK_VAL) > 0) {
                             bool prev_op_has_dst_name = prev_op.dst && prev_op.dst->reg && prev_op.dst->reg->name;
                             bool op_has_src_name = op.src[0] && op.src[0]->reg && op.src[0]->reg->name;
                             bool same_reg = (op.ireg && prev_op_has_dst_name && !strcmp(op.ireg, prev_op.dst->reg->name)) || (op_has_src_name && prev_op_has_dst_name && !strcmp(op.src[0]->reg->name, prev_op.dst->reg->name));
                             if (prev_op.type == RZ_ANALYSIS_OP_TYPE_MOV && prev_op.disp && prev_op.disp != UT64_MAX && same_reg) {
                                 //  movzx reg, byte [reg + case_table]
                                 //  jmp dword [reg*4 + jump_table]
                                 params.casetbl_loc = prev_op.disp;
                                 if (rz_analysis_walkthrough_casetbl(analysis, fcn, bb, &params)) {
                                     ret = case_table = true;
                                 }
                             }
                         }
                         rz_analysis_op_fini(&prev_op);
                         if (!case_table) {
                             ret = rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                         }
                     }
                 } else if (op.ptr != UT64_MAX && op.reg) { // direct jump
                     if (rz_analysis_get_jmptbl_info(analysis, fcn, bb, op.addr, &params)) {
                         ret = rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                     }
                 } else if (movdisp != UT64_MAX) {
                     ut64 lea_op_off = UT64_MAX;
                     RzListIter *iter;
                     leaddr_pair *pair;
                     params.jmptbl_off = 0;
                     if (movbasereg) {
                         // find nearest candidate leaddr before op.addr
                         rz_list_foreach_prev(analysis->leaddrs, iter, pair) {
                             if (pair->op_addr >= op.addr) {
                                 continue;
                             }
                             if ((lea_op_off == UT64_MAX || lea_op_off > op.addr - pair->op_addr) && pair->reg && !strcmp(movbasereg, pair->reg)) {
                                 lea_op_off = op.addr - pair->op_addr;
                                 params.jmptbl_off = pair->leaddr;
                             }
                         }
                     }
                     if (!rz_analysis_get_jmptbl_info(analysis, fcn, bb, op.addr, &params)) {
                         params.table_count = cmpval + 1;
                         params.default_case = -1;
                     }
                     params.jmptbl_loc = params.jmptbl_off + movdisp;
                     params.entry_size = movscale;
                     ret = rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                     cmpval = UT64_MAX;
                 } else if (is_arm) {
                     params.jmptbl_loc = op.addr + op.size;
                     params.jmptbl_off = op.addr + 4;
                     params.default_case = UT64_MAX;
                     if (op.ptrsize == 1) { // TBB
                         ut64 pred_cmpval = try_get_cmpval_from_parents(analysis, fcn, bb, op.ireg);
                         params.table_count = 0;
                         if (pred_cmpval != UT64_MAX) {
                             params.table_count += pred_cmpval;
                         } else {
                             params.table_count += cmpval;
                         }
                         params.entry_size = 1;
                         ret = rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                         // skip inlined jumptable
                         idx += params.table_count;
                     } else if (op.ptrsize == 2) { // LDRH on thumb/arm
                         ut64 pred_cmpval = try_get_cmpval_from_parents(analysis, fcn, bb, op.ireg);
                         params.table_count = 1;
                         if (pred_cmpval != UT64_MAX) {
                             params.table_count += pred_cmpval;
                         } else {
                             params.table_count += cmpval;
                         }
                         params.entry_size = 2;
                         ret = rz_analysis_walkthrough_jmptbl(analysis, fcn, bb, &params);
                         // skip inlined jumptable
                         idx += (params.table_count * 2);
                     }
                 }
             }
             if (lea_jmptbl_ip == op.addr) {
                 lea_jmptbl_ip = UT64_MAX;
             }
             if (analysis->opt.ijmp) {
                 if (continue_after_jump) {
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.fail);
                     rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                     if (overlapped) {
                         goto analopfinish;
                     }
                 }
                 if (rz_analysis_noreturn_at(analysis, op.jump) || op.eob) {
                     goto analopfinish;
                 }
             } else {
             analopfinish:
                 if (op.type == RZ_ANALYSIS_OP_TYPE_RJMP) {
                     gotoBeach(RZ_ANALYSIS_RET_NOP);
                 } else {
                     gotoBeach(RZ_ANALYSIS_RET_END);
                 }
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_PUSH:
             last_is_push = true;
             last_push_addr = op.val;
             if (analysis->iob.is_valid_offset(analysis->iob.io, last_push_addr, 1)) {
                 (void)rz_analysis_xrefs_set(analysis, op.addr, last_push_addr, RZ_ANALYSIS_XREF_TYPE_DATA);
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_UPUSH:
             if ((op.type & RZ_ANALYSIS_OP_TYPE_REG) && last_is_reg_mov_lea && op.src[0] && op.src[0]->reg && op.src[0]->reg->name && !strcmp(op.src[0]->reg->name, last_reg_mov_lea_name)) {
                 last_is_push = true;
                 last_push_addr = last_reg_mov_lea_val;
                 if (analysis->iob.is_valid_offset(analysis->iob.io, last_push_addr, 1)) {
                     (void)rz_analysis_xrefs_set(analysis, op.addr, last_push_addr, RZ_ANALYSIS_XREF_TYPE_DATA);
                 }
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_RET:
             if (op.family == RZ_ANALYSIS_OP_FAMILY_PRIV) {
                 fcn->type = RZ_ANALYSIS_FCN_TYPE_INT;
             }
             if (last_is_push && analysis->opt.pushret) {
                 op.type = RZ_ANALYSIS_OP_TYPE_JMP;
                 op.jump = last_push_addr;
                 bb->jump = op.jump;
                 rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.jump);
                 goto beach;
             }
             if (!op.cond) {
                 RZ_LOG_DEBUG("RET 0x%08" PFMT64x ". overlap=%s %" PFMT64u " %" PFMT64u "\n",
                     addr + delay.un_idx - oplen, rz_str_bool(overlapped),
                     bb->size, rz_analysis_function_linear_size(fcn));
                 gotoBeach(RZ_ANALYSIS_RET_END);
             }
             break;
         case RZ_ANALYSIS_OP_TYPE_CRET:
             if (continue_after_jump && is_hexagon) {
                 rz_analysis_task_item_new(analysis, tasks, fcn, NULL, op.addr + op.size);
                 set_bb_branches(bb, op.addr + op.size, UT64_MAX);
                 gotoBeach(RZ_ANALYSIS_RET_COND);
             }
         }
         if (op.type != RZ_ANALYSIS_OP_TYPE_MOV && op.type != RZ_ANALYSIS_OP_TYPE_CMOV && op.type != RZ_ANALYSIS_OP_TYPE_LEA) {
             last_is_reg_mov_lea = false;
         }
         if (op.type != RZ_ANALYSIS_OP_TYPE_PUSH && op.type != RZ_ANALYSIS_OP_TYPE_RPUSH) {
             last_is_push = false;
         }
         if (is_arm && op.type != RZ_ANALYSIS_OP_TYPE_MOV) {
             last_is_mov_lr_pc = false;
         }
         if (has_variadic_reg && !fcn->is_variadic) {
             variadic_reg = rz_reg_get(analysis->reg, "rax", RZ_REG_TYPE_GPR);
             bool dst_is_variadic = op.dst && op.dst->reg && variadic_reg && op.dst->reg->offset == variadic_reg->offset;
             bool op_is_cmp = (op.type == RZ_ANALYSIS_OP_TYPE_CMP) || op.type == RZ_ANALYSIS_OP_TYPE_ACMP;
             if (dst_is_variadic && !op_is_cmp) {
                 has_variadic_reg = false;
             } else if (op_is_cmp) {
                 if (op.src[0] && op.src[0]->reg && (op.dst->reg == op.src[0]->reg) && dst_is_variadic) {
                     fcn->is_variadic = true;
                 }
             }
         }
     }
 beach:
     rz_analysis_op_fini(&op);
     RZ_FREE(last_reg_mov_lea_name);
     if (bb) {
         if (bb->size) {
             rz_analysis_block_update_hash(bb);
         } else {
             rz_analysis_function_remove_block(fcn, bb);
         }
         rz_analysis_block_unref(bb);
     }
     free(movbasereg);
     return ret;
 }

Referenced by rz_analysis_run_tasks().

◆ rz_analysis_check_fcn()

RZ_API bool rz_analysis_check_fcn	(	RzAnalysis *	analysis,
		ut8 *	buf,
		ut16	bufsz,
		ut64	addr,
		ut64	low,
		ut64	high
	)

Definition at line 1538 of file fcn.c.

                                                                                                               {
     RzAnalysisOp op = {
         0
     };
     int i, oplen, opcnt = 0, pushcnt = 0, movcnt = 0, brcnt = 0;
     if (rz_analysis_is_prelude(analysis, buf, bufsz)) {
         return true;
     }
     for (i = 0; i < bufsz && opcnt < 10; i += oplen, opcnt++) {
         rz_analysis_op_fini(&op);
         if ((oplen = rz_analysis_op(analysis, &op, addr + i, buf + i, bufsz - i, RZ_ANALYSIS_OP_MASK_BASIC | RZ_ANALYSIS_OP_MASK_HINT)) < 1) {
             return false;
         }
         switch (op.type) {
         case RZ_ANALYSIS_OP_TYPE_PUSH:
         case RZ_ANALYSIS_OP_TYPE_UPUSH:
         case RZ_ANALYSIS_OP_TYPE_RPUSH:
             pushcnt++;
             break;
         case RZ_ANALYSIS_OP_TYPE_MOV:
         case RZ_ANALYSIS_OP_TYPE_CMOV:
             movcnt++;
             break;
         case RZ_ANALYSIS_OP_TYPE_JMP:
         case RZ_ANALYSIS_OP_TYPE_CJMP:
         case RZ_ANALYSIS_OP_TYPE_CALL:
             if (op.jump < low || op.jump >= high) {
                 return false;
             }
             brcnt++;
             break;
         case RZ_ANALYSIS_OP_TYPE_UNK:
             return false;
         default:
             break;
         }
     }
     return (pushcnt + movcnt + brcnt > 5);
 }

References addr, i, rz_analysis_is_prelude(), rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_BASIC, RZ_ANALYSIS_OP_MASK_HINT, RZ_ANALYSIS_OP_TYPE_CALL, RZ_ANALYSIS_OP_TYPE_CJMP, RZ_ANALYSIS_OP_TYPE_CMOV, RZ_ANALYSIS_OP_TYPE_JMP, RZ_ANALYSIS_OP_TYPE_MOV, RZ_ANALYSIS_OP_TYPE_PUSH, RZ_ANALYSIS_OP_TYPE_RPUSH, RZ_ANALYSIS_OP_TYPE_UNK, and RZ_ANALYSIS_OP_TYPE_UPUSH.

Referenced by rz_analysis_try_get_fcn().

◆ rz_analysis_del_jmprefs()

RZ_API void rz_analysis_del_jmprefs	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn
	)

Definition at line 1592 of file fcn.c.

                                                                                    {
     RzAnalysisXRef *xref;
     RzList *xrefs = rz_analysis_function_get_xrefs_from(fcn);
     RzListIter *iter;
  
     rz_list_foreach (xrefs, iter, xref) {
         if (xref->type == RZ_ANALYSIS_XREF_TYPE_CODE) {
             rz_analysis_xrefs_deln(analysis, xref->from, xref->to, xref->type);
         }
     }
     rz_list_free(xrefs);
 }

References rz_analysis_ref_t::from, rz_analysis_function_get_xrefs_from(), RZ_ANALYSIS_XREF_TYPE_CODE, rz_analysis_xrefs_deln(), rz_list_free(), rz_analysis_ref_t::to, and rz_analysis_ref_t::type.

Referenced by rz_analysis_function_del_all_handler().

◆ rz_analysis_fcn()

RZ_API int rz_analysis_fcn	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		ut64	addr,
		ut64	len,
		int	reftype
	)

Definition at line 1606 of file fcn.c.

                                                                                                             {
     RzPVector *metas = rz_meta_get_all_in(analysis, addr, RZ_META_TYPE_ANY);
     void **it;
     rz_pvector_foreach (metas, it) {
         RzAnalysisMetaItem *meta = ((RzIntervalNode *)*it)->data;
         switch (meta->type) {
         case RZ_META_TYPE_DATA:
         case RZ_META_TYPE_STRING:
         case RZ_META_TYPE_FORMAT:
             rz_pvector_free(metas);
             return 0;
         default:
             break;
         }
     }
     rz_pvector_free(metas);
     if (analysis->opt.norevisit) {
         if (!analysis->visited) {
             analysis->visited = set_u_new();
         }
         if (set_u_contains(analysis->visited, addr)) {
             RZ_LOG_DEBUG("rz_analysis_fcn: analysis.norevisit at 0x%08" PFMT64x " %c\n", addr, reftype);
             return RZ_ANALYSIS_RET_END;
         }
         set_u_add(analysis->visited, addr);
     } else {
         if (analysis->visited) {
             set_u_free(analysis->visited);
             analysis->visited = NULL;
         }
     }
     /* defines fcn. or loc. prefix */
     fcn->type = (reftype == RZ_ANALYSIS_XREF_TYPE_CODE) ? RZ_ANALYSIS_FCN_TYPE_LOC : RZ_ANALYSIS_FCN_TYPE_FCN;
     if (fcn->addr == UT64_MAX) {
         fcn->addr = addr;
     }
     fcn->maxstack = 0;
     if (fcn->cc && !strcmp(fcn->cc, "ms")) {
         // Probably should put this on the cc sdb
         const int shadow_store = 0x28; // First 4 args + retaddr
         fcn->stack = fcn->maxstack = fcn->reg_save_area = shadow_store;
     }
     RzVector tasks;
     rz_vector_init(&tasks, sizeof(RzAnalysisTaskItem), NULL, NULL);
     rz_analysis_task_item_new(analysis, &tasks, fcn, NULL, addr);
     int ret = rz_analysis_run_tasks(&tasks);
     rz_vector_fini(&tasks);
     return ret;
 }

References addr, rz_analysis_function_t::addr, rz_analysis_function_t::cc, rz_analysis_function_t::maxstack, metas, rz_analysis_options_t::norevisit, NULL, rz_analysis_t::opt, PFMT64x, rz_analysis_function_t::reg_save_area, RZ_ANALYSIS_FCN_TYPE_FCN, RZ_ANALYSIS_FCN_TYPE_LOC, RZ_ANALYSIS_RET_END, rz_analysis_run_tasks(), rz_analysis_task_item_new(), RZ_ANALYSIS_XREF_TYPE_CODE, RZ_LOG_DEBUG, rz_meta_get_all_in(), RZ_META_TYPE_ANY, RZ_META_TYPE_DATA, RZ_META_TYPE_FORMAT, RZ_META_TYPE_STRING, rz_pvector_foreach, rz_pvector_free(), rz_vector_fini(), rz_vector_init(), set_u_add(), set_u_contains(), set_u_free(), set_u_new(), rz_analysis_function_t::stack, rz_analysis_function_t::type, rz_analysis_meta_item_t::type, UT64_MAX, and rz_analysis_t::visited.

Referenced by __core_analysis_fcn().

◆ rz_analysis_fcn_add_bb()

RZ_API bool rz_analysis_fcn_add_bb	(	RzAnalysis *	a,
		RzAnalysisFunction *	fcn,
		ut64	addr,
		ut64	size,
		ut64	jump,
		ut64	fail,
		RZ_BORROW RzAnalysisDiff *	diff
	)

Definition at line 1739 of file fcn.c.

                                                                                                                                                        {
     if (size == 0) {
         RZ_LOG_ERROR("Empty basic block at 0x%08" PFMT64x " (not allowed).\n", addr);
         rz_warn_if_reached();
         return false;
     }
     if (size > a->opt.bb_max_size) {
         RZ_LOG_ERROR("Cannot allocate such big bb of %" PFMT64d " bytes at 0x%08" PFMT64x "\n", (st64)size, addr);
         rz_warn_if_reached();
         return false;
     }
  
     RzAnalysisBlock *block = rz_analysis_get_block_at(a, addr);
     if (block) {
         rz_analysis_delete_block(block);
         block = NULL;
     }
  
     block = rz_analysis_create_block(a, addr, size);
     if (!block) {
         return false;
     }
  
     rz_analysis_block_analyze_ops(block);
     rz_analysis_function_add_block(fcn, block);
  
     block->jump = jump;
     block->fail = fail;
     if (diff) {
         if (!block->diff) {
             block->diff = rz_analysis_diff_new();
         }
         if (block->diff) {
             block->diff->type = diff->type;
             block->diff->addr = diff->addr;
             if (diff->name) {
                 RZ_FREE(block->diff->name);
                 block->diff->name = strdup(diff->name);
             }
         }
     }
     rz_analysis_block_unref(block);
     return true;
 }

References a, addr, rz_analysis_diff_t::addr, rz_analysis_bb_t::diff, rz_analysis_bb_t::fail, fail, rz_analysis_bb_t::jump, jump(), rz_analysis_diff_t::name, NULL, PFMT64d, PFMT64x, rz_analysis_block_analyze_ops(), rz_analysis_block_unref(), rz_analysis_create_block(), rz_analysis_delete_block(), rz_analysis_diff_new(), rz_analysis_function_add_block(), rz_analysis_get_block_at(), RZ_FREE, RZ_LOG_ERROR, rz_warn_if_reached, st64, strdup(), and rz_analysis_diff_t::type.

Referenced by rz_analysis_function_blocks_add_handler().

◆ rz_analysis_fcn_bbget_at()

RZ_API RzAnalysisBlock* rz_analysis_fcn_bbget_at	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		ut64	addr
	)

Definition at line 2063 of file fcn.c.

                                                                                                            {
     rz_return_val_if_fail(fcn && addr != UT64_MAX, NULL);
     RzAnalysisBlock *b = rz_analysis_get_block_at(analysis, addr);
     if (b) {
         return b;
     }
     RzListIter *iter;
     RzAnalysisBlock *bb;
     rz_list_foreach (fcn->bbs, iter, bb) {
         if (addr == bb->addr) {
             return bb;
         }
     }
     return NULL;
 }

References addr, rz_analysis_bb_t::addr, b, rz_analysis_function_t::bbs, NULL, rz_analysis_get_block_at(), rz_return_val_if_fail, and UT64_MAX.

Referenced by ds_print_bbline().

◆ rz_analysis_fcn_bbget_in()

RZ_API RzAnalysisBlock* rz_analysis_fcn_bbget_in	(	const RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		ut64	addr
	)

Definition at line 2042 of file fcn.c.

                                                                                                                  {
     rz_return_val_if_fail(analysis && fcn, NULL);
     if (addr == UT64_MAX) {
         return NULL;
     }
     bool can_jmpmid = false;
     if (analysis->cur->arch) {
         bool is_x86 = !strncmp(analysis->cur->arch, "x86", 3);
         bool is_dalvik = !strncmp(analysis->cur->arch, "dalvik", 6);
         can_jmpmid = analysis->opt.jmpmid && (is_dalvik || is_x86);
     }
     RzListIter *iter;
     RzAnalysisBlock *bb;
     rz_list_foreach (fcn->bbs, iter, bb) {
         if (addr >= bb->addr && addr < (bb->addr + bb->size) && (!can_jmpmid || rz_analysis_block_op_starts_at(bb, addr))) {
             return bb;
         }
     }
     return NULL;
 }

References addr, rz_analysis_bb_t::addr, rz_analysis_plugin_t::arch, rz_analysis_function_t::bbs, rz_analysis_t::cur, rz_analysis_options_t::jmpmid, NULL, rz_analysis_t::opt, rz_analysis_block_op_starts_at(), rz_return_val_if_fail, rz_analysis_bb_t::size, and UT64_MAX.

Referenced by handleMidBB(), propagate_types_among_used_variables(), and rz_core_print_disasm().

◆ rz_analysis_fcn_count()

RZ_API int rz_analysis_fcn_count	(	RzAnalysis *	analysis,
		ut64	from,
		ut64	to
	)

Definition at line 2028 of file fcn.c.

                                                                            {
     int n = 0;
     RzAnalysisFunction *fcni;
     RzListIter *iter;
     rz_list_foreach (analysis->fcns, iter, fcni) {
         if (fcni->addr >= from && fcni->addr < to) {
             n++;
         }
     }
     return n;
 }

References rz_analysis_function_t::addr, rz_analysis_t::fcns, from, n, and to.

◆ rz_analysis_fcn_del()

RZ_API int rz_analysis_fcn_del	(	RzAnalysis *	a,
		ut64	addr
	)

Definition at line 1675 of file fcn.c.

                                                          {
     RzAnalysisFunction *fcn;
     RzListIter *iter, *iter_tmp;
     rz_list_foreach_safe (a->fcns, iter, iter_tmp, fcn) {
         RZ_LOG_DEBUG("removing function at %" PFMT64x " %" PFMT64x "\n", fcn->addr, addr);
         if (fcn->addr == addr) {
             rz_analysis_function_delete(fcn);
         }
     }
     return true;
 }

References a, addr, rz_analysis_function_t::addr, PFMT64x, rz_analysis_function_delete(), and RZ_LOG_DEBUG.

Referenced by rz_analysis_fcn_del_locs(), rz_analysis_function_del_handler(), rz_core_analysis_undefine(), and rz_core_visual_analysis().

◆ rz_analysis_fcn_del_locs()

RZ_API int rz_analysis_fcn_del_locs	(	RzAnalysis *	analysis,
		ut64	addr
	)

Definition at line 1657 of file fcn.c.

                                                                      {
     RzListIter *iter, *iter2;
     RzAnalysisFunction *fcn, *f = rz_analysis_get_fcn_in(analysis, addr, RZ_ANALYSIS_FCN_TYPE_ROOT);
     if (!f) {
         return false;
     }
     rz_list_foreach_safe (analysis->fcns, iter, iter2, fcn) {
         if (fcn->type != RZ_ANALYSIS_FCN_TYPE_LOC) {
             continue;
         }
         if (rz_analysis_function_contains(fcn, addr)) {
             rz_analysis_function_delete(fcn);
         }
     }
     rz_analysis_fcn_del(analysis, addr);
     return true;
 }

References addr, f, rz_analysis_t::fcns, rz_analysis_fcn_del(), RZ_ANALYSIS_FCN_TYPE_LOC, RZ_ANALYSIS_FCN_TYPE_ROOT, rz_analysis_function_contains(), rz_analysis_function_delete(), rz_analysis_get_fcn_in(), and rz_analysis_function_t::type.

Referenced by rz_analysis_function_del_handler(), rz_core_analysis_undefine(), and rz_core_visual_analysis().

◆ rz_analysis_fcn_invalidate_read_ahead_cache()

RZ_API void rz_analysis_fcn_invalidate_read_ahead_cache ( void )

Definition at line 84 of file fcn.c.

                                                               {
 #if READ_AHEAD
     cache_addr = UT64_MAX;
 #endif
 }

References cache_addr, and UT64_MAX.

Referenced by __core_analysis_fcn(), and update_analysis().

◆ rz_analysis_fcn_next()

RZ_API RzAnalysisFunction* rz_analysis_fcn_next	(	RzAnalysis *	analysis,
		ut64	addr
	)

Definition at line 2015 of file fcn.c.

                                                                                  {
     RzAnalysisFunction *fcni;
     RzListIter *iter;
     RzAnalysisFunction *closer = NULL;
     rz_list_foreach (analysis->fcns, iter, fcni) {
         // if (fcni->addr == addr)
         if (fcni->addr > addr && (!closer || fcni->addr < closer->addr)) {
             closer = fcni;
         }
     }
     return closer;
 }

References addr, rz_analysis_function_t::addr, rz_analysis_t::fcns, and NULL.

◆ rz_analysis_fcntype_tostring()

RZ_API const char* rz_analysis_fcntype_tostring ( int type )

Definition at line 35 of file fcn.c.

                                                           {
     switch (type) {
     case RZ_ANALYSIS_FCN_TYPE_NULL: return "null";
     case RZ_ANALYSIS_FCN_TYPE_FCN: return "fcn";
     case RZ_ANALYSIS_FCN_TYPE_LOC: return "loc";
     case RZ_ANALYSIS_FCN_TYPE_SYM: return "sym";
     case RZ_ANALYSIS_FCN_TYPE_IMP: return "imp";
     case RZ_ANALYSIS_FCN_TYPE_INT: return "int"; // interrupt
     case RZ_ANALYSIS_FCN_TYPE_ROOT: return "root";
     }
     return "unk";
 }

References RZ_ANALYSIS_FCN_TYPE_FCN, RZ_ANALYSIS_FCN_TYPE_IMP, RZ_ANALYSIS_FCN_TYPE_INT, RZ_ANALYSIS_FCN_TYPE_LOC, RZ_ANALYSIS_FCN_TYPE_NULL, RZ_ANALYSIS_FCN_TYPE_ROOT, RZ_ANALYSIS_FCN_TYPE_SYM, and type.

Referenced by __core_analysis_fcn(), core_analysis_graph_nodes(), draw_graph_nodes(), fcn_print_info(), function_print_to_json(), and function_rename().

◆ rz_analysis_function_arg_count()

RZ_API size_t rz_analysis_function_arg_count	(	RzAnalysis *	a,
		RzAnalysisFunction *	fcn
	)

Returns the argument count of a function.

Parameters

a	RzAnalysis instance
f	Function

Definition at line 2460 of file fcn.c.

                                                                                      {
     if (!a || !fcn) {
         return 0;
     }
     void **it;
     size_t count = 0;
     rz_pvector_foreach (&fcn->vars, it) {
         RzAnalysisVar *var = *it;
         if (var->isarg) {
             count++;
         }
     }
     return count;
 }

References a, count, rz_analysis_var_t::isarg, rz_pvector_foreach, and rz_analysis_function_t::vars.

◆ rz_analysis_function_args()

RZ_API RZ_OWN RzPVector* rz_analysis_function_args	(	RzAnalysis *	a,
		RzAnalysisFunction *	fcn
	)

Returns vector of all function arguments.

Parameters

a	RzAnalysis instance
f	Function

Definition at line 2481 of file fcn.c.

                                                                                              {
     if (!a || !fcn) {
         return NULL;
     }
     RzPVector *tmp = rz_pvector_new(NULL);
     if (!tmp) {
         return NULL;
     }
     RzAnalysisVar *var;
     void **it;
     int rarg_idx = 0;
     // Resort the pvector to order "reg_arg - stack_arg"
     rz_pvector_foreach (&fcn->vars, it) {
         var = *it;
         if (var->kind == RZ_ANALYSIS_VAR_KIND_REG) {
             rz_pvector_insert(tmp, rarg_idx++, var);
         } else {
             rz_pvector_push(tmp, var);
         }
     }
  
     RzPVector *args = rz_pvector_new(NULL);
     if (!args) {
         rz_pvector_free(tmp);
         return NULL;
     }
     rz_pvector_foreach (tmp, it) {
         var = *it;
         if (var->isarg) {
             int argnum;
             if (var->kind == RZ_ANALYSIS_VAR_KIND_REG) {
                 argnum = rz_analysis_var_get_argnum(var);
                 if (argnum < 0) {
                     RZ_LOG_INFO("%s : arg \"%s\" has wrong position: %d\n", fcn->name, var->name, argnum);
                     continue;
                 }
             } else {
                 argnum = fcn->argnum;
             }
             // pvector api is a bit ugly here, essentially we make a (possibly sparse) array
             // where each var is assigned at its argnum
             if (argnum >= rz_pvector_len(args)) {
                 if (!rz_pvector_reserve(args, argnum + 1)) {
                     goto cleanup;
                 }
                 while (argnum >= rz_pvector_len(args)) {
                     rz_pvector_push(args, NULL);
                 }
             }
             rz_pvector_set(args, argnum, var);
             fcn->argnum++;
         }
     }
 cleanup:
     rz_pvector_free(tmp);
     return args;
 }

References a, rz_analysis_function_t::argnum, args, cleanup(), rz_analysis_var_t::isarg, rz_analysis_var_t::kind, rz_analysis_function_t::name, rz_analysis_var_t::name, NULL, rz_analysis_var_get_argnum(), RZ_ANALYSIS_VAR_KIND_REG, RZ_LOG_INFO, rz_pvector_foreach, rz_pvector_free(), rz_pvector_insert(), rz_pvector_len(), rz_pvector_new(), rz_pvector_push(), rz_pvector_reserve(), rz_pvector_set(), autogen_x86imm::tmp, and rz_analysis_function_t::vars.

Referenced by rz_analysis_function_derive_args().

◆ rz_analysis_function_check_bp_use()

RZ_API void rz_analysis_function_check_bp_use ( RzAnalysisFunction * fcn )

Definition at line 2241 of file fcn.c.

                                                                        {
     rz_return_if_fail(fcn);
     __analysis_fcn_check_bp_use(fcn->analysis, fcn);
 }

References __analysis_fcn_check_bp_use(), rz_analysis_function_t::analysis, and rz_return_if_fail.

Referenced by __core_analysis_fcn().

◆ rz_analysis_function_clone_type()

RZ_API RZ_OWN RzCallable* rz_analysis_function_clone_type	(	RzAnalysis *	analysis,
		const RzAnalysisFunction *	f
	)

Clones the RzCallable type for the given function.

Searches the types database for the given function and returns a clone of the RzCallable type.

Parameters

analysis	RzAnalysis instance
f	Function to update

Definition at line 2568 of file fcn.c.

                                                                                                              {
     rz_return_val_if_fail(analysis && f, NULL);
     // Check first if there is a match with some pre-existing RzCallable type in the database
     char *shortname = rz_analysis_function_name_guess(analysis->typedb, f->name);
     if (!shortname) {
         shortname = strdup(f->name);
     }
     // At this point the `callable` pointer is *borrowed*
     RzCallable *callable = rz_type_func_get(analysis->typedb, shortname);
     free(shortname);
     if (callable) {
         // TODO: Decide what to do if there is a mismatch between type
         // stored in the RzTypeDB database and the actual type of the
         // RzAnalysisFunction
         return rz_type_callable_clone(callable);
     }
     return NULL;
 }

References f, free(), NULL, rz_analysis_function_name_guess(), rz_return_val_if_fail, rz_type_callable_clone(), rz_type_func_get(), strdup(), and rz_analysis_t::typedb.

Referenced by rz_analysis_function_derive_type().

◆ rz_analysis_function_complexity()

RZ_API int rz_analysis_function_complexity ( RzAnalysisFunction * fcn )

Definition at line 1799 of file fcn.c.

                                                                     {
     /*
     CC = E - N + 2P
     E = the number of edges of the graph.
     N = the number of nodes of the graph.
     P = the number of connected components (exit nodes).
  */
     RzAnalysis *analysis = fcn->analysis;
     int E = 0, N = 0, P = 0;
     RzListIter *iter;
     RzAnalysisBlock *bb;
  
     rz_list_foreach (fcn->bbs, iter, bb) {
         N++; // nodes
         if (!analysis && bb->jump == UT64_MAX && bb->fail != UT64_MAX) {
             RZ_LOG_DEBUG("invalid bb jump/fail pair at 0x%08" PFMT64x " (fcn 0x%08" PFMT64x "\n", bb->addr, fcn->addr);
         }
         if (bb->jump == UT64_MAX && bb->fail == UT64_MAX) {
             P++; // exit nodes
         } else {
             E++; // edges
             if (bb->fail != UT64_MAX) {
                 E++;
             }
         }
         if (bb->switch_op && bb->switch_op->cases) {
             E += rz_list_length(bb->switch_op->cases);
         }
     }
  
     int result = E - N + (2 * P);
     if (result < 1 && !analysis) {
         RZ_LOG_DEBUG("CC = E(%d) - N(%d) + (2 * P(%d)) < 1 at 0x%08" PFMT64x "\n", E, N, P, fcn->addr);
     }
     return result;
 }

References rz_analysis_function_t::addr, rz_analysis_bb_t::addr, rz_analysis_function_t::analysis, rz_analysis_function_t::bbs, rz_analysis_switch_obj_t::cases, E, rz_analysis_bb_t::fail, rz_analysis_bb_t::jump, N, P, PFMT64x, rz_list_length(), RZ_LOG_DEBUG, rz_analysis_bb_t::switch_op, and UT64_MAX.

Referenced by fcn_print_info(), function_list_print_to_table(), and function_print_to_json().

◆ rz_analysis_function_cost()

RZ_API ut32 rz_analysis_function_cost ( RzAnalysisFunction * fcn )

Definition at line 2080 of file fcn.c.

                                                                {
     RzListIter *iter;
     RzAnalysisBlock *bb;
     ut32 totalCycles = 0;
     if (!fcn) {
         return 0;
     }
     RzAnalysis *analysis = fcn->analysis;
     rz_list_foreach (fcn->bbs, iter, bb) {
         RzAnalysisOp op;
         ut64 at, end = bb->addr + bb->size;
         ut8 *buf = malloc(bb->size);
         if (!buf) {
             continue;
         }
         (void)analysis->iob.read_at(analysis->iob.io, bb->addr, (ut8 *)buf, bb->size);
         int idx = 0;
         for (at = bb->addr; at < end;) {
             memset(&op, 0, sizeof(op));
             (void)rz_analysis_op(analysis, &op, at, buf + idx, bb->size - idx, RZ_ANALYSIS_OP_MASK_BASIC);
             if (op.size < 1) {
                 op.size = 1;
             }
             idx += op.size;
             at += op.size;
             totalCycles += op.cycles;
             rz_analysis_op_fini(&op);
         }
         free(buf);
     }
     return totalCycles;
 }

References rz_analysis_bb_t::addr, rz_analysis_function_t::analysis, rz_analysis_function_t::bbs, test_evm::end, free(), setup::idx, rz_io_bind_t::io, rz_analysis_t::iob, malloc(), memset(), op, rz_io_bind_t::read_at, rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_BASIC, rz_analysis_bb_t::size, and ut64().

Referenced by fcn_print_info(), function_list_print_to_table(), and function_print_to_json().

◆ rz_analysis_function_count_edges()

RZ_API int rz_analysis_function_count_edges	(	const RzAnalysisFunction *	fcn,
		RZ_NULLABLE int *	ebbs
	)

Definition at line 2113 of file fcn.c.

                                                                                                   {
     rz_return_val_if_fail(fcn, 0);
     RzListIter *iter;
     RzAnalysisBlock *bb;
     int edges = 0;
     if (ebbs) {
         *ebbs = 0;
     }
     rz_list_foreach (fcn->bbs, iter, bb) {
         if (ebbs && bb->jump == UT64_MAX && bb->fail == UT64_MAX) {
             *ebbs = *ebbs + 1;
         } else {
             if (bb->jump != UT64_MAX) {
                 edges++;
             }
             if (bb->fail != UT64_MAX) {
                 edges++;
             }
         }
     }
     return edges;
 }

References rz_analysis_function_t::bbs, rz_analysis_bb_t::fail, rz_analysis_bb_t::jump, rz_return_val_if_fail, and UT64_MAX.

Referenced by fcn_print_info(), function_list_print_to_table(), and function_print_to_json().

◆ rz_analysis_function_create_type()

RZ_API RZ_OWN RzCallable* rz_analysis_function_create_type	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	f
	)

Creates the RzCallable type for the given function.

Creates the RzCallable type for the given function by searching in the types database and returning it.

Parameters

analysis	RzAnalysis instance
f	Function to update

Definition at line 2596 of file fcn.c.

                                                                                                         {
     // TODO: Figure out if we should use shortname or a fullname here
     RzCallable *callable = rz_type_func_new(analysis->typedb, f->name, NULL);
     if (!callable) {
         return NULL;
     }
     return callable;
 }

References f, NULL, rz_type_func_new(), and rz_analysis_t::typedb.

Referenced by rz_analysis_function_derive_type().

◆ rz_analysis_function_derive_args()

RZ_API bool rz_analysis_function_derive_args	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	f,
		RzCallable **	callable
	)

Sets the RzCallable args for the given function.

Gets the given function's arguments (names and types) and if it has none it simply returns. Otherwise, it creates RzCallableArgs and adds them to RzCallable.

Parameters

analysis	RzAnalysis instance
f	Function to update
callable	A function type

Definition at line 2632 of file fcn.c.

                                                                                                                  {
     RzPVector *args = rz_analysis_function_args(analysis, f);
     if (!args || rz_pvector_empty(args)) {
         rz_pvector_free(args);
         return true;
     }
     void **it;
     rz_pvector_foreach (args, it) {
         RzAnalysisVar *var = *it;
         if (!var) {
             // TODO: maybe create a stub void arg here?
             continue;
         }
         RzType *cloned_type = rz_type_clone(var->type);
         if (!cloned_type) {
             rz_pvector_free(args);
             rz_type_callable_free(*callable);
             RZ_LOG_ERROR("Cannot parse function's argument type\n");
             return false;
         }
         RzCallableArg *arg = rz_type_callable_arg_new(analysis->typedb, var->name, cloned_type);
         if (!arg) {
             rz_pvector_free(args);
             rz_type_callable_free(*callable);
             RZ_LOG_ERROR("Cannot create callable argument\n");
             return false;
         }
         rz_type_callable_arg_add(*callable, arg);
     }
     rz_pvector_free(args);
     return true;
 }

References args, f, rz_analysis_var_t::name, rz_analysis_function_args(), RZ_LOG_ERROR, rz_pvector_empty(), rz_pvector_foreach, rz_pvector_free(), rz_type_callable_arg_add(), rz_type_callable_arg_new(), rz_type_callable_free(), rz_type_clone(), rz_analysis_var_t::type, and rz_analysis_t::typedb.

Referenced by rz_analysis_function_derive_type().

◆ rz_analysis_function_derive_return_type()

RZ_API void rz_analysis_function_derive_return_type	(	RzAnalysisFunction *	f,
		RzCallable **	callable
	)

Sets the RzCallable return type for the given function.

Checks if the given function's return type exists and adds it to RzCallable by cloning it.

Parameters

analysis	RzAnalysis instance
f	Function to update
callable	A function type

Definition at line 2615 of file fcn.c.

                                                                                                   {
     if (f->ret_type) {
         (*callable)->ret = rz_type_clone(f->ret_type);
     }
 }

References f, and rz_type_clone().

Referenced by rz_analysis_function_derive_type().

◆ rz_analysis_function_derive_type()

RZ_API RZ_OWN RzCallable* rz_analysis_function_derive_type	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	f
	)

Derives the RzCallable type for the given function.

Checks if the type is defined already for this function, if yes - it returns pointer to the one stored in the types database. If not - it creates a new RzCallable instance based on the function name, its arguments' names and types.

Parameters

analysis	RzAnalysis instance
f	Function to update

Definition at line 2676 of file fcn.c.

                                                                                                         {
     RzCallable *callable = rz_analysis_function_clone_type(analysis, f);
     if (!callable) {
         // If there is no match - create a new one.
         callable = rz_analysis_function_create_type(analysis, f);
         if (!callable) {
             return NULL;
         }
         // Derive retvar and args from that function
         rz_analysis_function_derive_return_type(f, &callable);
         if (!rz_analysis_function_derive_args(analysis, f, &callable)) {
             return NULL;
         }
     }
     return callable;
 }

References f, NULL, rz_analysis_function_clone_type(), rz_analysis_function_create_type(), rz_analysis_function_derive_args(), and rz_analysis_function_derive_return_type().

Referenced by function_type_derive(), rz_analysis_function_get_arg_count(), and rz_analysis_function_get_signature().

◆ rz_analysis_function_get_arg_count()

RZ_API int rz_analysis_function_get_arg_count	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	f
	)

Gets the RzCallable's arg count for the given function.

Derives the RzCallable type for the given function, saves it if it exists, and returns its arguments count.

Parameters

analysis	RzAnalysis instance
f	Function to update

Definition at line 1845 of file fcn.c.

                                                                                            {
     RzCallable *callable = rz_analysis_function_derive_type(analysis, f);
     if (!callable) {
         return -1;
     }
     rz_type_func_save(analysis->typedb, callable);
     return rz_pvector_len(callable->args);
 }

References rz_callable_at::args, f, rz_analysis_function_derive_type(), rz_pvector_len(), rz_type_func_save(), and rz_analysis_t::typedb.

Referenced by rz_analysis_function_get_json().

◆ rz_analysis_function_get_json()

RZ_API char* rz_analysis_function_get_json ( RzAnalysisFunction * function )

Definition at line 1855 of file fcn.c.

                                                                          {
     RzAnalysis *a = function->analysis;
     PJ *pj = pj_new();
     char *ret_type_str = NULL;
     RzType *ret_type = rz_type_func_ret(a->typedb, function->name);
     if (ret_type) {
         ret_type_str = rz_type_as_string(a->typedb, ret_type);
     }
     int argc = rz_analysis_function_get_arg_count(a, function);
  
     pj_o(pj);
     pj_ks(pj, "name", function->name);
     const bool no_return = rz_analysis_noreturn_at_addr(a, function->addr);
     pj_kb(pj, "noreturn", no_return);
     pj_ks(pj, "ret", ret_type_str ? ret_type_str : "void");
     if (function->cc) {
         pj_ks(pj, "cc", function->cc);
     }
     pj_k(pj, "args");
     pj_a(pj);
     for (int i = 0; i < argc; i++) {
         pj_o(pj);
         const char *arg_name = rz_type_func_args_name(a->typedb, function->name, i);
         RzType *arg_type = rz_type_func_args_type(a->typedb, function->name, i);
         char *arg_type_str = rz_type_as_string(a->typedb, arg_type);
         pj_ks(pj, "name", arg_name);
         pj_ks(pj, "type", arg_type_str);
         const char *cc_arg = rz_reg_get_name(a->reg, rz_reg_get_name_idx(sdb_fmt("A%d", i)));
         if (cc_arg) {
             pj_ks(pj, "cc", cc_arg);
         }
         pj_end(pj);
         free(arg_type_str);
     }
     pj_end(pj);
     pj_end(pj);
     free(ret_type_str);
     return pj_drain(pj);
 }

References a, free(), i, NULL, pj_a(), pj_drain(), pj_end(), pj_k(), pj_kb(), pj_ks(), pj_new(), pj_o(), rz_analysis_function_get_arg_count(), rz_analysis_noreturn_at_addr(), rz_reg_get_name(), rz_reg_get_name_idx(), rz_type_as_string(), rz_type_func_args_name(), rz_type_func_args_type(), rz_type_func_ret(), and sdb_fmt().

Referenced by rz_analysis_function_signature_handler().

◆ rz_analysis_function_get_signature()

RZ_API RZ_OWN char* rz_analysis_function_get_signature ( RZ_NONNULL RzAnalysisFunction * function )

Definition at line 1895 of file fcn.c.

                                                                                                 {
     rz_return_val_if_fail(function, NULL);
     RzAnalysis *a = function->analysis;
  
     RzCallable *callable = rz_analysis_function_derive_type(a, function);
     if (!callable) {
         return NULL;
     }
     char *signature = rz_type_callable_as_string(a->typedb, callable);
     rz_type_callable_free(callable);
     char *result = rz_str_newf("%s;", signature);
     free(signature);
     return result;
 }

References a, free(), NULL, rz_analysis_function_derive_type(), rz_return_val_if_fail, rz_str_newf(), rz_type_callable_as_string(), rz_type_callable_free(), and signature().

Referenced by ds_show_functions(), rz_analysis_function_signature_handler(), and rz_core_analysis_function_signature_editor().

◆ rz_analysis_function_loops()

RZ_API int rz_analysis_function_loops ( RzAnalysisFunction * fcn )

Definition at line 1784 of file fcn.c.

                                                                {
     RzListIter *iter;
     RzAnalysisBlock *bb;
     ut32 loops = 0;
     rz_list_foreach (fcn->bbs, iter, bb) {
         if (bb->jump != UT64_MAX && bb->jump < bb->addr) {
             loops++;
         }
         if (bb->fail != UT64_MAX && bb->fail < bb->addr) {
             loops++;
         }
     }
     return loops;
 }

References rz_analysis_bb_t::addr, rz_analysis_function_t::bbs, rz_analysis_bb_t::fail, rz_analysis_bb_t::jump, and UT64_MAX.

Referenced by fcn_print_info(), function_list_print_to_table(), and function_print_to_json().

◆ rz_analysis_function_purity()

RZ_API bool rz_analysis_function_purity ( RzAnalysisFunction * fcn )

Definition at line 2136 of file fcn.c.

                                                                  {
     if (fcn->has_changed) {
         HtUP *ht = ht_up_new(NULL, NULL, NULL);
         if (ht) {
             check_purity(ht, fcn);
             ht_up_free(ht);
         }
     }
     return fcn->is_pure;
 }

References check_purity(), rz_analysis_function_t::has_changed, rz_analysis_function_t::is_pure, and NULL.

Referenced by fcn_print_info(), and function_print_to_json().

◆ rz_analysis_function_resize()

RZ_API int rz_analysis_function_resize	(	RzAnalysisFunction *	fcn,
		int	newsize
	)

Definition at line 90 of file fcn.c.

                                                                              {
     RzAnalysis *analysis = fcn->analysis;
     RzAnalysisBlock *bb;
     RzListIter *iter, *iter2;
  
     rz_return_val_if_fail(fcn, false);
  
     if (newsize < 1) {
         return false;
     }
  
     // XXX this is something we should probably do for all the archs
     bool is_arm = analysis->cur->arch && !strncmp(analysis->cur->arch, "arm", 3);
     if (is_arm) {
         return true;
     }
  
     ut64 eof = fcn->addr + newsize;
     rz_list_foreach_safe (fcn->bbs, iter, iter2, bb) {
         if (bb->addr >= eof) {
             rz_analysis_function_remove_block(fcn, bb);
             continue;
         }
         if (bb->addr + bb->size >= eof) {
             rz_analysis_block_set_size(bb, eof - bb->addr);
             rz_analysis_block_update_hash(bb);
         }
         if (bb->jump != UT64_MAX && bb->jump >= eof) {
             bb->jump = UT64_MAX;
         }
         if (bb->fail != UT64_MAX && bb->fail >= eof) {
             bb->fail = UT64_MAX;
         }
     }
     return true;
 }

References rz_analysis_function_t::addr, rz_analysis_bb_t::addr, rz_analysis_function_t::analysis, rz_analysis_plugin_t::arch, rz_analysis_function_t::bbs, rz_analysis_t::cur, rz_analysis_bb_t::fail, is_arm(), rz_analysis_bb_t::jump, rz_analysis_block_set_size(), rz_analysis_block_update_hash(), rz_analysis_function_remove_block(), rz_return_val_if_fail, rz_analysis_bb_t::size, ut64(), and UT64_MAX.

Referenced by module_match_buffer(), rz_core_analysis_fcn(), rz_core_analysis_function_add(), rz_core_analysis_function_until(), and rz_core_visual_define().

◆ rz_analysis_function_set_type()

RZ_API bool rz_analysis_function_set_type	(	RzAnalysis *	a,
		RZ_NONNULL RzAnalysisFunction *	f,
		RZ_NONNULL RzCallable *	callable
	)

Sets the RzCallable type for the given function.

Checks if the type is defined already for this function, if yes - it removes the existing one and sets the one defined by the RzCallable. If there is a mismatch between existing arguments - it overwrites their types and names, removes arguments if necessary.

Parameters

a	RzAnalysis instance
f	Function to update
callable	A function type

Definition at line 1922 of file fcn.c.

                                                                                                                             {
     rz_return_val_if_fail(a && f && callable, false);
     // At first, we check if the arguments match, and rename/retype them
     void **it;
     size_t index = 0;
     if (rz_pvector_empty(callable->args)) {
         rz_analysis_function_delete_all_vars(f);
     }
     size_t args_count = rz_pvector_len(callable->args);
     RzPVector *cloned_vars = (RzPVector *)rz_vector_clone((RzVector *)&f->vars);
     rz_pvector_foreach (cloned_vars, it) {
         RzAnalysisVar *var = *it;
         if (!var->isarg) {
             continue;
         }
         if (index < args_count) {
             RzCallableArg *arg = *rz_pvector_index_ptr(callable->args, index);
             if (arg) {
                 free(var->name);
                 if (arg->name) {
                     var->name = strdup(arg->name);
                 }
                 rz_type_free(var->type);
                 var->type = rz_type_clone(arg->type);
             }
             index++;
         } else {
             // There is no match for this argument in the RzCallable type,
             // thus we remove it from the function
             rz_analysis_function_delete_var(f, var);
         }
     }
     // For f->vars is already empty, add args into it
     for (; index < args_count; index++) {
         RzCallableArg *arg = *rz_pvector_index_ptr(callable->args, index);
         if (arg && arg->type) {
             size_t size = rz_type_db_get_bitsize(a->typedb, arg->type);
             // For user defined args, we set its delta and kind to its index and stack var by default
             rz_analysis_function_set_var(f, index, RZ_ANALYSIS_VAR_KIND_BPV, arg->type, size, true, arg->name);
         }
     }
  
     if (callable->noret) {
         f->is_noreturn = true;
     } else {
         f->ret_type = callable->ret;
     }
     rz_pvector_free(cloned_vars);
     return true;
 }

References a, f, free(), rz_analysis_var_t::isarg, arg::name, rz_analysis_var_t::name, rz_analysis_function_delete_all_vars(), rz_analysis_function_delete_var(), rz_analysis_function_set_var(), RZ_ANALYSIS_VAR_KIND_BPV, rz_pvector_empty(), rz_pvector_foreach, rz_pvector_free(), rz_pvector_index_ptr(), rz_pvector_len(), rz_return_val_if_fail, rz_type_clone(), rz_type_db_get_bitsize(), rz_type_free(), rz_vector_clone(), strdup(), and rz_analysis_var_t::type.

Referenced by rz_analysis_function_set_type_str().

◆ rz_analysis_function_set_type_str()

RZ_API bool rz_analysis_function_set_type_str	(	RzAnalysis *	a,
		RZ_NONNULL RzAnalysisFunction *	f,
		RZ_NONNULL const char *	sig
	)

Parses the function type and sets it for the given function.

Checks if the type is defined already for this function, if yes - it removes the existing one and parses the one defined in the signature. The function type should be valid C syntax supplied with name, like int *func(char arg0, const int *arg1, float foo[]);

Parameters

a	RzAnalysis instance
f	Function to update
sig	A function type ("signature" or "prototype")

Definition at line 1985 of file fcn.c.

                                                                                                                            {
     rz_return_val_if_fail(a && f && sig, false);
     char *error_msg = NULL;
     // At first we should check if the type is already presented in the types database
     // and remove it if exists
     if (rz_type_func_exist(a->typedb, f->name)) {
         rz_type_func_delete(a->typedb, f->name);
     }
     // Then we create a new one by parsing the string
     RzType *result = rz_type_parse_string_declaration_single(a->typedb->parser, sig, &error_msg);
     if (!result) {
         if (error_msg) {
             RZ_LOG_ERROR("%s", error_msg);
             free(error_msg);
         }
         RZ_LOG_ERROR("Cannot parse callable type\n");
         return false;
     }
     // Parsed result should be RzCallable
     if (result->kind != RZ_TYPE_KIND_CALLABLE) {
         RZ_LOG_ERROR("Parsed function signature should be RzCallable\n");
         return false;
     }
     if (!result->callable) {
         RZ_LOG_ERROR("Parsed function signature should not be NULL\n");
         return false;
     }
     return rz_analysis_function_set_type(a, f, result->callable);
 }

References a, rz_type_t::callable, f, free(), rz_type_t::kind, NULL, rz_analysis_function_set_type(), RZ_LOG_ERROR, rz_return_val_if_fail, rz_type_func_delete(), rz_type_func_exist(), RZ_TYPE_KIND_CALLABLE, and rz_type_parse_string_declaration_single().

Referenced by rz_core_analysis_function_set_signature().

◆ rz_analysis_function_update_analysis()

RZ_API void rz_analysis_function_update_analysis ( RzAnalysisFunction * fcn )

Definition at line 2435 of file fcn.c.

                                                                           {
     rz_return_if_fail(fcn);
     RzListIter *it, *it2, *tmp, *tmp2;
     RzAnalysisBlock *bb;
     RzAnalysisFunction *f;
     RzList *fcns = rz_list_new();
     HtUP *reachable = ht_up_new(NULL, free_ht_up, NULL);
     rz_list_foreach_safe (fcn->bbs, it, tmp, bb) {
         if (rz_analysis_block_was_modified(bb)) {
             rz_list_foreach_safe (bb->fcns, it2, tmp2, f) {
                 calc_reachable_and_remove_block(fcns, f, bb, reachable);
             }
         }
     }
     update_analysis(fcn->analysis, fcns, reachable);
     ht_up_free(reachable);
     rz_list_free(fcns);
 }

References rz_analysis_function_t::analysis, rz_analysis_function_t::bbs, calc_reachable_and_remove_block(), f, rz_analysis_bb_t::fcns, free_ht_up(), NULL, rz_analysis_block_was_modified(), rz_list_free(), rz_list_new(), rz_return_if_fail, autogen_x86imm::tmp, and update_analysis().

Referenced by check_function_modified().

◆ rz_analysis_get_fcn_in()

RZ_DEPRECATE RZ_API RzAnalysisFunction* rz_analysis_get_fcn_in	(	RzAnalysis *	analysis,
		ut64	addr,
		int	type
	)

Definition at line 1687 of file fcn.c.

                                                                                                           {
     RzList *list = rz_analysis_get_functions_in(analysis, addr);
     RzAnalysisFunction *ret = NULL;
     if (list && !rz_list_empty(list)) {
         if (type == RZ_ANALYSIS_FCN_TYPE_ROOT) {
             RzAnalysisFunction *fcn;
             RzListIter *iter;
             rz_list_foreach (list, iter, fcn) {
                 if (fcn->addr == addr) {
                     ret = fcn;
                     break;
                 }
             }
         } else {
             ret = rz_list_first(list);
         }
     }
     rz_list_free(list);
     return ret;
 }

References addr, rz_analysis_function_t::addr, list(), NULL, RZ_ANALYSIS_FCN_TYPE_ROOT, rz_analysis_get_functions_in(), rz_list_first(), rz_list_free(), and type.

◆ rz_analysis_get_fcn_in_bounds()

RZ_DEPRECATE RZ_API RzAnalysisFunction* rz_analysis_get_fcn_in_bounds	(	RzAnalysis *	analysis,
		ut64	addr,
		int	type
	)

Definition at line 1708 of file fcn.c.

                                                                                                                  {
     RzAnalysisFunction *fcn, *ret = NULL;
     RzListIter *iter;
     if (type == RZ_ANALYSIS_FCN_TYPE_ROOT) {
         rz_list_foreach (analysis->fcns, iter, fcn) {
             if (addr == fcn->addr) {
                 return fcn;
             }
         }
         return NULL;
     }
     rz_list_foreach (analysis->fcns, iter, fcn) {
         if (!type || (fcn && fcn->type & type)) {
             if (rz_analysis_function_contains(fcn, addr)) {
                 return fcn;
             }
         }
     }
     return ret;
 }

References addr, rz_analysis_function_t::addr, rz_analysis_t::fcns, NULL, RZ_ANALYSIS_FCN_TYPE_ROOT, rz_analysis_function_contains(), type, and rz_analysis_function_t::type.

Referenced by rz_core_search_value_in_range(), and xrefs_graph().

◆ rz_analysis_get_function_byname()

RZ_API RzAnalysisFunction* rz_analysis_get_function_byname	(	RzAnalysis *	a,
		const char *	name
	)

Definition at line 1729 of file fcn.c.

                                                                                             {
     bool found = false;
     RzAnalysisFunction *f = ht_pp_find(a->ht_name_fun, name, &found);
     if (f && found) {
         return f;
     }
     return NULL;
 }

References a, f, found, and NULL.

Referenced by function_type_derive(), num_callback(), retype_callee_arg(), rz_core_analysis_function_signature(), and rz_seek_function_handler().

◆ rz_analysis_run_tasks()

RZ_API int rz_analysis_run_tasks ( RZ_NONNULL RzVector * tasks )

Runs analysis on the task items.

Runs control-flow and variable usage analysis on each of the task items until tasks vector becomes empty. Items are removed from the tasks vector as they are processed. Items are added to the tasks vector as new basic blocks are found to be analyzed.

Parameters

tasks Pointer to RzVector of RzAnalysisTaskItem to be performed analysis on.

Definition at line 1509 of file fcn.c.

                                                                {
     rz_return_val_if_fail(tasks, RZ_ANALYSIS_RET_ERROR);
     int ret = RZ_ANALYSIS_RET_ERROR;
     while (!rz_vector_empty(tasks)) {
         RzAnalysisTaskItem item;
         rz_vector_pop(tasks, &item);
         int r = run_basic_block_analysis(&item, tasks);
         switch (r) {
         case RZ_ANALYSIS_RET_BRANCH:
         case RZ_ANALYSIS_RET_COND:
             continue;
         case RZ_ANALYSIS_RET_NOP:
         case RZ_ANALYSIS_RET_ERROR:
             if (ret != RZ_ANALYSIS_RET_END) {
                 ret = r;
             }
             break;
         case RZ_ANALYSIS_RET_END:
         default:
             ret = r;
             break;
         }
         if (rz_cons_is_breaked()) {
             break;
         }
     }
     return ret;
 }

References r, run_basic_block_analysis(), RZ_ANALYSIS_RET_BRANCH, RZ_ANALYSIS_RET_COND, RZ_ANALYSIS_RET_END, RZ_ANALYSIS_RET_ERROR, RZ_ANALYSIS_RET_NOP, rz_cons_is_breaked(), rz_return_val_if_fail, rz_vector_empty(), and rz_vector_pop().

Referenced by analyze_function_locally(), and rz_analysis_fcn().

◆ rz_analysis_task_item_new()

RZ_API bool rz_analysis_task_item_new	(	RZ_NONNULL RzAnalysis *	analysis,
		RZ_NONNULL RzVector *	tasks,
		RZ_NONNULL RzAnalysisFunction *	fcn,
		RZ_NULLABLE RzAnalysisBlock *	block,
		ut64	address
	)

Adds a new task item to the tasks parameter.

Used to create a new item to the tasks parameter that can be worked on later by the rz_analysis_run_tasks function.

Parameters

analysis	Pointer to RzAnalysis instance.
tasks	Pointer to RzVector to add a new RzAnalysisTaskItem to.
fcn	Pointer to RzAnalysisFunction in which analysis will be performed on.
block	Pointer to RzAnalysisBlock in which analysis will be performed on. If null, analysis will take care of block creation.
address	Address where analysis will start from

Definition at line 1488 of file fcn.c.

                                                                                                                                                                                            {
     rz_return_val_if_fail(analysis && tasks && fcn, false);
     RzAnalysisTaskItem item = { fcn, block, fcn->stack, address };
     RzAnalysisTaskItem *it;
     rz_vector_foreach(tasks, it) {
         if (item.start_address == it->start_address) {
             return true;
         }
     }
     return rz_vector_push(tasks, &item);
 }

References rz_return_val_if_fail, rz_vector_foreach, rz_vector_push(), rz_analysis_task_item::stack, and rz_analysis_task_item::start_address.

Referenced by run_basic_block_analysis(), rz_analysis_fcn(), rz_analysis_walkthrough_arm_jmptbl_style(), rz_analysis_walkthrough_casetbl(), and rz_analysis_walkthrough_jmptbl().

◆ rz_analysis_trim_jmprefs()

RZ_API void rz_analysis_trim_jmprefs	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn
	)

Definition at line 1578 of file fcn.c.

                                                                                     {
     RzAnalysisXRef *xref;
     RzList *xrefs = rz_analysis_function_get_xrefs_from(fcn);
     RzListIter *iter;
     const bool is_x86 = analysis->cur->arch && !strcmp(analysis->cur->arch, "x86"); // HACK
  
     rz_list_foreach (xrefs, iter, xref) {
         if (xref->type == RZ_ANALYSIS_XREF_TYPE_CODE && rz_analysis_function_contains(fcn, xref->to) && (!is_x86 || !rz_analysis_function_contains(fcn, xref->from))) {
             rz_analysis_xrefs_deln(analysis, xref->from, xref->to, xref->type);
         }
     }
     rz_list_free(xrefs);
 }

References rz_analysis_plugin_t::arch, rz_analysis_t::cur, rz_analysis_ref_t::from, rz_analysis_function_contains(), rz_analysis_function_get_xrefs_from(), RZ_ANALYSIS_XREF_TYPE_CODE, rz_analysis_xrefs_deln(), rz_list_free(), rz_analysis_ref_t::to, and rz_analysis_ref_t::type.

Referenced by module_match_buffer().

◆ rz_analysis_types_from_fcn()

RZ_API RZ_OWN RzList* rz_analysis_types_from_fcn	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn
	)

Definition at line 2545 of file fcn.c.

                                                                                                   {
     RzListIter *iter;
     RzAnalysisVar *var;
     RzList *list = rz_analysis_var_all_list(analysis, fcn);
     RzList *type_used = rz_list_new();
     rz_list_foreach (list, iter, var) {
         rz_list_append(type_used, var->type);
     }
     RzList *uniq = rz_list_uniq(type_used, typecmp);
     rz_list_free(type_used);
     rz_list_free(list);
     return uniq;
 }

References list(), rz_analysis_var_all_list(), rz_list_append(), rz_list_free(), rz_list_new(), rz_list_uniq(), rz_analysis_var_t::type, and typecmp().

Referenced by types_xrefs(), types_xrefs_all(), types_xrefs_function(), types_xrefs_graph(), and types_xrefs_summary().

◆ rz_analysis_update_analysis_range()

RZ_API void rz_analysis_update_analysis_range	(	RzAnalysis *	analysis,
		ut64	addr,
		int	size
	)

Definition at line 2396 of file fcn.c.

                                                                                          {
     rz_return_if_fail(analysis);
     RzListIter *it, *it2, *tmp;
     RzAnalysisBlock *bb;
     RzAnalysisFunction *fcn;
     RzList *blocks = rz_analysis_get_blocks_intersect(analysis, addr, size);
     if (rz_list_empty(blocks)) {
         rz_list_free(blocks);
         return;
     }
     RzList *fcns = rz_list_new();
     HtUP *reachable = ht_up_new(NULL, free_ht_up, NULL);
     const int align = rz_analysis_archinfo(analysis, RZ_ANALYSIS_ARCHINFO_ALIGN);
     const ut64 end_write = addr + size;
  
     rz_list_foreach (blocks, it, bb) {
         if (!rz_analysis_block_was_modified(bb)) {
             continue;
         }
         rz_list_foreach_safe (bb->fcns, it2, tmp, fcn) {
             if (align > 1) {
                 if ((end_write < rz_analysis_block_get_op_addr(bb, bb->ninstr - 1)) && (!bb->switch_op || end_write < bb->switch_op->addr)) {
                     // Special case when instructions are aligned and we don't
                     // need to worry about a write messing with the jump instructions
                     clear_bb_vars(fcn, bb, addr > bb->addr ? addr : bb->addr, end_write);
                     update_varz_analysisysis(fcn, align, addr > bb->addr ? addr : bb->addr, end_write);
                     rz_analysis_function_delete_unused_vars(fcn);
                     continue;
                 }
             }
             calc_reachable_and_remove_block(fcns, fcn, bb, reachable);
         }
     }
     rz_list_free(blocks); // This will call rz_analysis_block_unref to actually remove blocks from RzAnalysis
     update_analysis(analysis, fcns, reachable);
     ht_up_free(reachable);
     rz_list_free(fcns);
 }

References addr, rz_analysis_switch_obj_t::addr, rz_analysis_bb_t::addr, blocks, calc_reachable_and_remove_block(), clear_bb_vars(), rz_analysis_bb_t::fcns, free_ht_up(), rz_analysis_bb_t::ninstr, NULL, rz_analysis_archinfo(), RZ_ANALYSIS_ARCHINFO_ALIGN, rz_analysis_block_get_op_addr(), rz_analysis_block_was_modified(), rz_analysis_function_delete_unused_vars(), rz_analysis_get_blocks_intersect(), rz_list_free(), rz_list_new(), rz_return_if_fail, rz_analysis_bb_t::switch_op, autogen_x86imm::tmp, update_analysis(), update_varz_analysisysis(), and ut64().

Referenced by ev_iowrite_cb().

◆ set_bb_branches()

static void set_bb_branches	(	RZ_OUT RzAnalysisBlock *	bb,
		const ut64	jump,
		const ut64	fail
	)

inlinestatic

Definition at line 542 of file fcn.c.

                                                                                                  {
     bb->jump = jump;
     bb->fail = fail;
 }

References fail, and jump().

Referenced by run_basic_block_analysis().

◆ skip_hp()

static int skip_hp	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		RzAnalysisOp *	op,
		RzAnalysisBlock *	bb,
		ut64	addr,
		char *	tmp_buf,
		int	oplen,
		int	un_idx,
		int *	idx
	)

static

Definition at line 288 of file fcn.c.

                                                     {
     // this step is required in order to prevent infinite recursion in some cases
     if ((addr + un_idx - oplen) == fcn->addr) {
         // use addr instead of op->addr to mark repeat
         if (!analysis->flb.exist_at(analysis->flb.f, "skip", 4, addr)) {
             snprintf(tmp_buf + 5, MAX_FLG_NAME_SIZE - 6, "%" PFMT64u, addr);
             analysis->flb.set(analysis->flb.f, tmp_buf, addr, oplen);
             fcn->addr += oplen;
             rz_analysis_block_relocate(bb, bb->addr + oplen, bb->size - oplen);
             *idx = un_idx;
             return 1;
         }
         return 2;
     }
     return 0;
 }

References addr, rz_analysis_function_t::addr, rz_analysis_bb_t::addr, rz_flag_bind_t::exist_at, rz_flag_bind_t::f, rz_analysis_t::flb, setup::idx, MAX_FLG_NAME_SIZE, PFMT64u, rz_analysis_block_relocate(), rz_flag_bind_t::set, rz_analysis_bb_t::size, and snprintf.

Referenced by run_basic_block_analysis().

◆ try_get_cmpval_from_parents()

static ut64 try_get_cmpval_from_parents	(	RzAnalysis *	analysis,
		RzAnalysisFunction *	fcn,
		RzAnalysisBlock *	my_bb,
		const char *	cmp_reg
	)

static

Definition at line 263 of file fcn.c.

                                                                                                                                     {
     rz_return_val_if_fail(fcn && fcn->bbs && cmp_reg, UT64_MAX);
     RzListIter *iter;
     RzAnalysisBlock *tmp_bb;
     rz_list_foreach (fcn->bbs, iter, tmp_bb) {
         if (tmp_bb->jump == my_bb->addr || tmp_bb->fail == my_bb->addr) {
             if (tmp_bb->cmpreg == cmp_reg) {
                 if (tmp_bb->cond) {
                     if (tmp_bb->cond->type == RZ_TYPE_COND_HI || tmp_bb->cond->type == RZ_TYPE_COND_GT) {
                         return tmp_bb->cmpval + 1;
                     }
                 }
                 return tmp_bb->cmpval;
             }
         }
     }
     return UT64_MAX;
 }

References rz_analysis_bb_t::addr, rz_analysis_function_t::bbs, rz_analysis_bb_t::cmpreg, rz_analysis_bb_t::cmpval, rz_analysis_bb_t::cond, rz_analysis_bb_t::fail, rz_analysis_bb_t::jump, rz_return_val_if_fail, RZ_TYPE_COND_GT, RZ_TYPE_COND_HI, rz_analysis_cond_t::type, and UT64_MAX.

Referenced by run_basic_block_analysis().

◆ typecmp()

static int typecmp	(	const void *	a,
		const void *	b
	)

static

Definition at line 2539 of file fcn.c.

                                                  {
     const RzType *t1 = a;
     const RzType *t2 = b;
     return !rz_types_equal(t1, t2);
 }

References a, b, rz_types_equal(), and benchmark::t1.

Referenced by rz_analysis_types_from_fcn().

◆ update_analysis()

static void update_analysis	(	RzAnalysis *	analysis,
		RzList *	fcns,
		HtUP *	reachable
	)

static

Definition at line 2337 of file fcn.c.

                                                                                  {
     RzListIter *it, *it2, *tmp;
     RzAnalysisFunction *fcn;
     bool old_jmpmid = analysis->opt.jmpmid;
     analysis->opt.jmpmid = true;
     rz_analysis_fcn_invalidate_read_ahead_cache();
     rz_list_foreach (fcns, it, fcn) {
         // Recurse through blocks of function, mark reachable,
         // analyze edges that don't have a block
         RzAnalysisBlock *bb = rz_analysis_get_block_at(analysis, fcn->addr);
         if (!bb) {
             analyze_function_locally(analysis, fcn, fcn->addr);
             bb = rz_analysis_get_block_at(analysis, fcn->addr);
             if (!bb) {
                 continue;
             }
         }
         HtUP *ht = ht_up_new0();
         ht_up_insert(ht, bb->addr, NULL);
         BlockRecurseCtx ctx = { fcn, ht };
         rz_analysis_block_recurse(bb, analize_descendents, &ctx);
  
         // Remove non-reachable blocks
         rz_list_foreach_safe (fcn->bbs, it2, tmp, bb) {
             if (ht_up_find_kv(ht, bb->addr, NULL)) {
                 continue;
             }
             HtUP *o_visited = ht_up_find(reachable, fcn->addr, NULL);
             if (!ht_up_find_kv(o_visited, bb->addr, NULL)) {
                 // Avoid removing blocks that were already not reachable
                 continue;
             }
             fcn->ninstr -= bb->ninstr;
             rz_analysis_function_remove_block(fcn, bb);
         }
  
         RzList *bbs = rz_list_clone(fcn->bbs);
         rz_analysis_block_automerge(bbs);
         rz_analysis_function_delete_unused_vars(fcn);
         rz_list_free(bbs);
     }
     analysis->opt.jmpmid = old_jmpmid;
 }

References rz_analysis_function_t::addr, rz_analysis_bb_t::addr, analize_descendents(), analyze_function_locally(), rz_analysis_function_t::bbs, rz_analysis_options_t::jmpmid, rz_analysis_function_t::ninstr, rz_analysis_bb_t::ninstr, NULL, rz_analysis_t::opt, rz_analysis_block_automerge(), rz_analysis_block_recurse(), rz_analysis_fcn_invalidate_read_ahead_cache(), rz_analysis_function_delete_unused_vars(), rz_analysis_function_remove_block(), rz_analysis_get_block_at(), rz_list_clone(), rz_list_free(), and autogen_x86imm::tmp.

Referenced by rz_analysis_function_update_analysis(), and rz_analysis_update_analysis_range().

◆ update_varz_analysisysis()

static void update_varz_analysisysis	(	RzAnalysisFunction *	fcn,
		int	align,
		ut64	from,
		ut64	to
	)

static

Definition at line 2280 of file fcn.c.

                                                                                              {
     RzAnalysis *analysis = fcn->analysis;
     ut64 cur_addr;
     int opsz;
     from = align ? from - (from % align) : from;
     to = align ? RZ_ROUND(to, align) : to;
     if (UT64_SUB_OVFCHK(to, from)) {
         return;
     }
     ut64 len = to - from;
     ut8 *buf = malloc(len);
     if (!buf) {
         return;
     }
     if (analysis->iob.read_at(analysis->iob.io, from, buf, len) < len) {
         return;
     }
     for (cur_addr = from; cur_addr < to; cur_addr += opsz, len -= opsz) {
         RzAnalysisOp op;
         int ret = rz_analysis_op(analysis->coreb.core, &op, cur_addr, buf, len, RZ_ANALYSIS_OP_MASK_ESIL | RZ_ANALYSIS_OP_MASK_VAL);
         if (ret < 1 || op.size < 1) {
             rz_analysis_op_fini(&op);
             break;
         }
         opsz = op.size;
         rz_analysis_extract_vars(analysis, fcn, &op);
         rz_analysis_op_fini(&op);
     }
     free(buf);
 }

References rz_analysis_function_t::analysis, rz_core_bind_t::core, rz_analysis_t::coreb, free(), from, rz_io_bind_t::io, rz_analysis_t::iob, len, malloc(), op, rz_io_bind_t::read_at, rz_analysis_extract_vars(), rz_analysis_op(), rz_analysis_op_fini(), RZ_ANALYSIS_OP_MASK_ESIL, RZ_ANALYSIS_OP_MASK_VAL, RZ_ROUND, to, ut64(), and UT64_SUB_OVFCHK.

Referenced by rz_analysis_update_analysis_range().

Variable Documentation

◆ cache_addr

ut64 cache_addr = UT64_MAX

static

Definition at line 49 of file fcn.c.

Referenced by read_ahead(), and rz_analysis_fcn_invalidate_read_ahead_cache().

Classes

Macros

Typedefs

Functions

Variables

Macro Definition Documentation

◆ BB_ALIGN

◆ DB

◆ EXISTS

◆ gotoBeach

◆ JMPTBL_LEA_SEARCH_SZ

◆ MAX_FCN_SIZE

◆ MAX_FLG_NAME_SIZE

◆ MAX_SCAN_SIZE

◆ READ_AHEAD

◆ SDB_KEY_BB

◆ SETKEY

Typedef Documentation

◆ FcnTreeIter

Function Documentation

◆ __analysis_fcn_check_bp_use()

◆ analize_addr_cb()

◆ analize_descendents()

◆ analyze_function_locally()

◆ analyze_retpoline()

◆ bbget()

◆ calc_reachable_and_remove_block()

◆ can_affect_bp()

◆ check_purity()

◆ clear_bb_vars()

◆ does_arch_destroys_dst()

◆ fcn_append_basic_block()

◆ fcn_takeover_block_recursive()

◆ fcn_takeover_block_recursive_followthrough_cb()

◆ free_ht_up()

◆ free_leaddr_pair()

◆ is_delta_pointer_table()

◆ isInvalidMemory()

◆ isSymbolNextInstruction()

◆ mark_as_visited()

◆ op_is_set_bp()

◆ purity_checked()

◆ read_ahead()

◆ regs_exist()

◆ retpoline_reg()

◆ run_basic_block_analysis()

◆ rz_analysis_check_fcn()

◆ rz_analysis_del_jmprefs()

◆ rz_analysis_fcn()

◆ rz_analysis_fcn_add_bb()

◆ rz_analysis_fcn_bbget_at()

◆ rz_analysis_fcn_bbget_in()

◆ rz_analysis_fcn_count()

◆ rz_analysis_fcn_del()

◆ rz_analysis_fcn_del_locs()

◆ rz_analysis_fcn_invalidate_read_ahead_cache()

◆ rz_analysis_fcn_next()

◆ rz_analysis_fcntype_tostring()

◆ rz_analysis_function_arg_count()

◆ rz_analysis_function_args()

◆ rz_analysis_function_check_bp_use()

◆ rz_analysis_function_clone_type()

◆ rz_analysis_function_complexity()

◆ rz_analysis_function_cost()

◆ rz_analysis_function_count_edges()

◆ rz_analysis_function_create_type()

◆ rz_analysis_function_derive_args()

◆ rz_analysis_function_derive_return_type()

◆ rz_analysis_function_derive_type()

◆ rz_analysis_function_get_arg_count()

◆ rz_analysis_function_get_json()

◆ rz_analysis_function_get_signature()

◆ rz_analysis_function_loops()

◆ rz_analysis_function_purity()

◆ rz_analysis_function_resize()

◆ rz_analysis_function_set_type()

◆ rz_analysis_function_set_type_str()

◆ rz_analysis_function_update_analysis()

◆ rz_analysis_get_fcn_in()

◆ rz_analysis_get_fcn_in_bounds()