rz_il_events.h File Reference

list of types of events that can happen on the VM More...

#include <rz_il/definitions/definitions.h>

Go to the source code of this file.

Classes
struct	rz_il_vm_event_mem_read_t
struct	rz_il_vm_event_var_read_t
struct	rz_il_vm_event_pc_write_t
struct	rz_il_vm_event_mem_write_t
struct	rz_il_vm_event_var_write_t
struct	rz_il_vm_event_t

Typedefs
typedef enum rz_il_event_id_t	RzILEventId
typedef struct rz_il_vm_event_mem_read_t	RzILEventMemRead
typedef struct rz_il_vm_event_var_read_t	RzILEventVarRead
typedef struct rz_il_vm_event_pc_write_t	RzILEventPCWrite
typedef struct rz_il_vm_event_mem_write_t	RzILEventMemWrite
typedef struct rz_il_vm_event_var_write_t	RzILEventVarWrite
typedef struct rz_il_vm_event_t	RzILEvent

Enumerations
enum	rz_il_event_id_t {   RZ_IL_EVENT_EXCEPTION = 0 , RZ_IL_EVENT_PC_WRITE , RZ_IL_EVENT_MEM_READ , RZ_IL_EVENT_VAR_READ ,   RZ_IL_EVENT_MEM_WRITE , RZ_IL_EVENT_VAR_WRITE }

Functions
RZ_API RZ_OWN RzILEvent *	rz_il_event_exception_new (RZ_NONNULL const char *exception)
RZ_API RZ_OWN RzILEvent *	rz_il_event_pc_write_new (RZ_NONNULL const RzBitVector *old_pc, RZ_NONNULL const RzBitVector *new_pc)
RZ_API RZ_OWN RzILEvent *	rz_il_event_mem_read_new (RZ_NONNULL const RzBitVector *addr, RZ_NULLABLE const RzBitVector *value)
RZ_API RZ_OWN RzILEvent *	rz_il_event_var_read_new (RZ_NONNULL const char *name, RZ_NULLABLE const RzILVal *value)
RZ_API RZ_OWN RzILEvent *	rz_il_event_mem_write_new (RZ_NONNULL const RzBitVector *addr, RZ_NONNULL const RzBitVector *old_v, RZ_NONNULL const RzBitVector *new_v)
RZ_API RZ_OWN RzILEvent *	rz_il_event_var_write_new (RZ_NONNULL const char *name, RZ_NULLABLE const RzILVal *old_v, RZ_NONNULL const RzILVal *new_v)
RZ_API void	rz_il_event_free (RZ_NULLABLE RzILEvent *evt)
RZ_API void	rz_il_event_stringify (RZ_NONNULL const RzILEvent *evt, RZ_NONNULL RzStrBuf *sb)
RZ_API void	rz_il_event_json (RZ_NONNULL RzILEvent *evt, RZ_NONNULL PJ *pj)

Detailed Description

list of types of events that can happen on the VM

Definition in file rz_il_events.h.

Typedef Documentation

RzILEvent

typedef struct rz_il_vm_event_t RzILEvent

RzILEventId

typedef enum rz_il_event_id_t RzILEventId

RzILEventMemRead

typedef struct rz_il_vm_event_mem_read_t RzILEventMemRead

RzILEventMemWrite

typedef struct rz_il_vm_event_mem_write_t RzILEventMemWrite

RzILEventPCWrite

typedef struct rz_il_vm_event_pc_write_t RzILEventPCWrite

RzILEventVarRead

typedef struct rz_il_vm_event_var_read_t RzILEventVarRead

RzILEventVarWrite

typedef struct rz_il_vm_event_var_write_t RzILEventVarWrite

Enumeration Type Documentation

rz_il_event_id_t

enum rz_il_event_id_t

Enumerator
RZ_IL_EVENT_EXCEPTION
RZ_IL_EVENT_PC_WRITE
RZ_IL_EVENT_MEM_READ
RZ_IL_EVENT_VAR_READ
RZ_IL_EVENT_MEM_WRITE
RZ_IL_EVENT_VAR_WRITE

Definition at line 19 of file rz_il_events.h.

                              {
    RZ_IL_EVENT_EXCEPTION = 0,
    RZ_IL_EVENT_PC_WRITE,
    RZ_IL_EVENT_MEM_READ,
    RZ_IL_EVENT_VAR_READ,
    RZ_IL_EVENT_MEM_WRITE,
    RZ_IL_EVENT_VAR_WRITE,
} RzILEventId;

Function Documentation

rz_il_event_exception_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_exception_new

(

RZ_NONNULL const char *

exception

)

Creates an RzILEvent of type RZ_IL_EVENT_EXCEPTION

Parameters

exception,const

char, pointer to the exception message

Definition at line 52 of file il_events.c.

                                                                                     {
    rz_return_val_if_fail(exception, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        RZ_LOG_ERROR("RzIL: cannot allocate exception RzILEvent");
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_EXCEPTION;
    evt->data.exception = strdup(exception);
    if (!evt->data.exception) {
        rz_il_event_free(evt);
        RZ_LOG_ERROR("RzIL: cannot allocate exception string");
        return NULL;
    }
    return evt;
}

References rz_il_vm_event_t::data, exception, rz_il_vm_event_t::exception, NULL, RZ_IL_EVENT_EXCEPTION, rz_il_event_free(), RZ_LOG_ERROR, RZ_NEW, rz_return_val_if_fail, strdup(), and rz_il_vm_event_t::type.

Referenced by rz_il_handler_div().

rz_il_event_free()

RZ_API void rz_il_event_free

(

RZ_NULLABLE RzILEvent *

evt

)

Frees an RzILEvent struct

Parameters

evt,RzILEvent,pointer

to the RzILEvent to free

Definition at line 11 of file il_events.c.

                                                         {
    if (!evt) {
        return;
    }
    switch (evt->type) {
    case RZ_IL_EVENT_EXCEPTION:
        free(evt->data.exception);
        break;
    case RZ_IL_EVENT_PC_WRITE:
        rz_bv_free(evt->data.pc_write.old_pc);
        rz_bv_free(evt->data.pc_write.new_pc);
        break;
    case RZ_IL_EVENT_MEM_READ:
        rz_bv_free(evt->data.mem_read.address);
        rz_bv_free(evt->data.mem_read.value);
        break;
    case RZ_IL_EVENT_VAR_READ:
        free(evt->data.var_read.variable);
        rz_il_value_free(evt->data.var_read.value);
        break;
    case RZ_IL_EVENT_MEM_WRITE:
        rz_bv_free(evt->data.mem_write.address);
        rz_bv_free(evt->data.mem_write.old_value);
        rz_bv_free(evt->data.mem_write.new_value);
        break;
    case RZ_IL_EVENT_VAR_WRITE:
        free(evt->data.var_write.variable);
        rz_il_value_free(evt->data.var_write.old_value);
        rz_il_value_free(evt->data.var_write.new_value);
        break;
    default:
        rz_warn_if_reached();
        break;
    }
    free(evt);
}

References free(), rz_bv_free(), RZ_IL_EVENT_EXCEPTION, RZ_IL_EVENT_MEM_READ, RZ_IL_EVENT_MEM_WRITE, RZ_IL_EVENT_PC_WRITE, RZ_IL_EVENT_VAR_READ, RZ_IL_EVENT_VAR_WRITE, rz_il_value_free(), and rz_warn_if_reached.

Referenced by rz_il_event_exception_new(), rz_il_event_mem_read_new(), rz_il_event_mem_write_new(), rz_il_event_pc_write_new(), rz_il_event_var_read_new(), rz_il_event_var_write_new(), rz_il_vm_event_add(), and rz_il_vm_init().

rz_il_event_json()

RZ_API void rz_il_event_json	(	RZ_NONNULL RzILEvent *	evt,
		RZ_NONNULL PJ *	pj
	)

Definition at line 797 of file il_export.c.

                                                                           {
    rz_return_if_fail(evt && pj);
    char *tmp0 = NULL, *tmp1 = NULL, *tmp2 = NULL;
 
    switch (evt->type) {
    case RZ_IL_EVENT_EXCEPTION:
        pj_o(pj);
        pj_ks(pj, "type", "exception");
        pj_ks(pj, "exception", evt->data.exception);
        pj_end(pj);
        break;
    case RZ_IL_EVENT_PC_WRITE:
        tmp0 = rz_bv_as_hex_string(evt->data.pc_write.old_pc, false);
        tmp1 = rz_bv_as_hex_string(evt->data.pc_write.new_pc, false);
        pj_o(pj);
        pj_ks(pj, "type", "pc_write");
        pj_ks(pj, "old", tmp0);
        pj_ks(pj, "new", tmp1);
        pj_end(pj);
        break;
    case RZ_IL_EVENT_MEM_READ:
        tmp0 = rz_bv_as_hex_string(evt->data.mem_read.address, false);
        tmp1 = rz_bv_as_hex_string(evt->data.mem_read.value, false);
        pj_o(pj);
        pj_ks(pj, "type", "mem_read");
        pj_ks(pj, "address", tmp0);
        pj_ks(pj, "value", tmp1);
        pj_end(pj);
        break;
    case RZ_IL_EVENT_VAR_READ:
        tmp1 = rz_il_value_stringify(evt->data.var_read.value);
        pj_o(pj);
        pj_ks(pj, "type", "var_read");
        pj_ks(pj, "name", evt->data.var_read.variable);
        pj_ks(pj, "value", tmp1 ? tmp1 : "uninitialized variable");
        pj_end(pj);
        break;
    case RZ_IL_EVENT_MEM_WRITE:
        tmp0 = rz_bv_as_hex_string(evt->data.mem_write.address, false);
        tmp1 = evt->data.mem_write.old_value ? rz_bv_as_hex_string(evt->data.mem_write.old_value, false) : NULL;
        tmp2 = rz_bv_as_hex_string(evt->data.mem_write.new_value, false);
        pj_o(pj);
        pj_ks(pj, "type", "mem_write");
        pj_ks(pj, "address", tmp0);
        pj_ks(pj, "old", tmp1 ? tmp1 : "uninitialized memory");
        pj_ks(pj, "new", tmp2);
        pj_end(pj);
        break;
    case RZ_IL_EVENT_VAR_WRITE:
        tmp1 = rz_il_value_stringify(evt->data.var_write.old_value);
        tmp2 = rz_il_value_stringify(evt->data.var_write.new_value);
        pj_o(pj);
        pj_ks(pj, "type", "var_write");
        pj_ks(pj, "name", evt->data.var_write.variable);
        pj_ks(pj, "old", tmp1 ? tmp1 : "uninitialized variable");
        pj_ks(pj, "new", tmp2);
        pj_end(pj);
        break;
    default:
        rz_warn_if_reached();
        pj_o(pj);
        pj_ks(pj, "type", "unknown");
        pj_end(pj);
        break;
    }
 
    free(tmp0);
    free(tmp1);
    free(tmp2);
}

References free(), NULL, pj_end(), pj_ks(), pj_o(), rz_bv_as_hex_string(), RZ_IL_EVENT_EXCEPTION, RZ_IL_EVENT_MEM_READ, RZ_IL_EVENT_MEM_WRITE, RZ_IL_EVENT_PC_WRITE, RZ_IL_EVENT_VAR_READ, RZ_IL_EVENT_VAR_WRITE, rz_il_value_stringify(), rz_return_if_fail, and rz_warn_if_reached.

Referenced by rz_core_analysis_il_step_with_events().

rz_il_event_mem_read_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_mem_read_new	(	RZ_NONNULL const RzBitVector *	address,
		RZ_NULLABLE const RzBitVector *	value
	)

Creates an RzILEvent of type RZ_IL_EVENT_MEM_READ

Parameters

addr,RzBitVector,address	of the memory where the read op has occurred
value,RzBitVector,value	read from the variable

Definition at line 100 of file il_events.c.

                                                                                                                               {
    rz_return_val_if_fail(address && value, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_MEM_READ;
    evt->data.mem_read.address = rz_bv_dup(address);
    evt->data.mem_read.value = rz_bv_dup(value);
    if (!evt->data.mem_read.address || !evt->data.mem_read.value) {
        rz_il_event_free(evt);
        return NULL;
    }
 
    return evt;
}

References rz_il_vm_event_mem_read_t::address, rz_il_vm_event_t::data, rz_il_vm_event_t::mem_read, NULL, rz_bv_dup(), rz_il_event_free(), RZ_IL_EVENT_MEM_READ, RZ_NEW, rz_return_val_if_fail, rz_il_vm_event_t::type, value, and rz_il_vm_event_mem_read_t::value.

Referenced by rz_il_vm_mem_load(), and rz_il_vm_mem_loadw().

rz_il_event_mem_write_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_mem_write_new	(	RZ_NONNULL const RzBitVector *	addr,
		RZ_NONNULL const RzBitVector *	old_v,
		RZ_NONNULL const RzBitVector *	new_v
	)

Creates an RzILEvent of type RZ_IL_EVENT_MEM_WRITE

Parameters

addr,RzBitVector,address	of the memory that has changed
old_v,RzBitVector,old	value before the change
new_v,RzBitVector,new	value after the change

Definition at line 125 of file il_events.c.

                                                                                                                                                                 {
    rz_return_val_if_fail(addr && old_v && new_v, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_MEM_WRITE;
    evt->data.mem_write.address = rz_bv_dup(addr);
    evt->data.mem_write.old_value = rz_bv_dup(old_v);
    evt->data.mem_write.new_value = rz_bv_dup(new_v);
    if (!evt->data.mem_write.address ||
        !evt->data.mem_write.old_value ||
        !evt->data.mem_write.new_value) {
        rz_il_event_free(evt);
        return NULL;
    }
 
    return evt;
}

References addr, rz_il_vm_event_mem_write_t::address, rz_il_vm_event_t::data, rz_il_vm_event_t::mem_write, rz_il_vm_event_mem_write_t::new_value, NULL, rz_il_vm_event_mem_write_t::old_value, rz_bv_dup(), rz_il_event_free(), RZ_IL_EVENT_MEM_WRITE, RZ_NEW, rz_return_val_if_fail, and rz_il_vm_event_t::type.

Referenced by rz_il_vm_mem_store(), and rz_il_vm_mem_storew().

rz_il_event_pc_write_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_pc_write_new	(	RZ_NONNULL const RzBitVector *	old_pc,
		RZ_NONNULL const RzBitVector *	new_pc
	)

Creates an RzILEvent of type RZ_IL_EVENT_PC_WRITE

Parameters

old_pc,RzBitVector,old	program counter value before the change
new_pc,RzBitVector,new	program counter value after the change

Definition at line 76 of file il_events.c.

                                                                                                                              {
    rz_return_val_if_fail(old_pc && new_pc, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_PC_WRITE;
    evt->data.pc_write.old_pc = rz_bv_dup(old_pc);
    evt->data.pc_write.new_pc = rz_bv_dup(new_pc);
    if (!evt->data.pc_write.old_pc || !evt->data.pc_write.new_pc) {
        rz_il_event_free(evt);
        return NULL;
    }
 
    return evt;
}

References rz_il_vm_event_t::data, rz_il_vm_event_pc_write_t::new_pc, NULL, rz_il_vm_event_pc_write_t::old_pc, rz_il_vm_event_t::pc_write, rz_bv_dup(), rz_il_event_free(), RZ_IL_EVENT_PC_WRITE, RZ_NEW, rz_return_val_if_fail, and rz_il_vm_event_t::type.

Referenced by perform_jump(), and rz_il_vm_step().

rz_il_event_stringify()

RZ_API void rz_il_event_stringify	(	RZ_NONNULL const RzILEvent *	evt,
		RZ_NONNULL RzStrBuf *	sb
	)

Create a readable string representation of evt

Definition at line 753 of file il_export.c.

                                                                                            {
    rz_return_if_fail(evt && sb);
    char *tmp0 = NULL, *tmp1 = NULL, *tmp2 = NULL;
 
    switch (evt->type) {
    case RZ_IL_EVENT_EXCEPTION:
        rz_strbuf_appendf(sb, "exception(%s)", evt->data.exception);
        break;
    case RZ_IL_EVENT_PC_WRITE:
        tmp0 = rz_bv_as_hex_string(evt->data.pc_write.old_pc, false);
        tmp1 = rz_bv_as_hex_string(evt->data.pc_write.new_pc, false);
        rz_strbuf_appendf(sb, "pc_write(old: %s, new: %s)", tmp0, tmp1);
        break;
    case RZ_IL_EVENT_MEM_READ:
        tmp0 = rz_bv_as_hex_string(evt->data.mem_read.address, false);
        tmp1 = evt->data.mem_read.value ? rz_bv_as_hex_string(evt->data.mem_read.value, false) : NULL;
        rz_strbuf_appendf(sb, "mem_read(addr: %s, value: %s)", tmp0, tmp1 ? tmp1 : "uninitialized memory");
        break;
    case RZ_IL_EVENT_VAR_READ:
        tmp1 = rz_il_value_stringify(evt->data.var_read.value);
        rz_strbuf_appendf(sb, "var_read(name: %s, value: %s)", evt->data.var_write.variable, tmp1 ? tmp1 : "uninitialized variable");
        break;
    case RZ_IL_EVENT_MEM_WRITE:
        tmp0 = rz_bv_as_hex_string(evt->data.mem_write.address, false);
        tmp1 = evt->data.mem_write.old_value ? rz_bv_as_hex_string(evt->data.mem_write.old_value, false) : NULL;
        tmp2 = rz_bv_as_hex_string(evt->data.mem_write.new_value, false);
        rz_strbuf_appendf(sb, "mem_write(addr: %s, old: %s, new: %s)", tmp0, tmp1 ? tmp1 : "uninitialized memory", tmp2);
        break;
    case RZ_IL_EVENT_VAR_WRITE:
        tmp1 = rz_il_value_stringify(evt->data.var_write.old_value);
        tmp2 = rz_il_value_stringify(evt->data.var_write.new_value);
        rz_strbuf_appendf(sb, "var_write(name: %s, old: %s, new: %s)", evt->data.var_write.variable, tmp1 ? tmp1 : "uninitialized variable", tmp2);
        break;
    default:
        rz_warn_if_reached();
        rz_strbuf_append(sb, "unknown(?)");
        break;
    }
 
    free(tmp0);
    free(tmp1);
    free(tmp2);
}

References free(), NULL, rz_bv_as_hex_string(), RZ_IL_EVENT_EXCEPTION, RZ_IL_EVENT_MEM_READ, RZ_IL_EVENT_MEM_WRITE, RZ_IL_EVENT_PC_WRITE, RZ_IL_EVENT_VAR_READ, RZ_IL_EVENT_VAR_WRITE, rz_il_value_stringify(), rz_return_if_fail, rz_strbuf_append(), rz_strbuf_appendf(), rz_warn_if_reached, and sb.

Referenced by rz_core_analysis_il_step_with_events().

rz_il_event_var_read_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_var_read_new	(	RZ_NONNULL const char *	name,
		RZ_NULLABLE const RzILVal *	value
	)

Creates an RzILEvent of type RZ_IL_EVENT_VAR_READ

Parameters

name	register name that has changed
value	value read from the variable

Definition at line 152 of file il_events.c.

                                                                                                                 {
    rz_return_val_if_fail(name && value, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_VAR_READ;
    evt->data.var_read.variable = strdup(name);
    evt->data.var_read.value = rz_il_value_dup(value);
    if (!evt->data.var_read.variable || !evt->data.var_read.value) {
        rz_il_event_free(evt);
        return NULL;
    }
 
    return evt;
}

References rz_il_vm_event_t::data, NULL, rz_il_event_free(), RZ_IL_EVENT_VAR_READ, rz_il_value_dup(), RZ_NEW, rz_return_val_if_fail, strdup(), rz_il_vm_event_t::type, value, rz_il_vm_event_var_read_t::value, rz_il_vm_event_t::var_read, and rz_il_vm_event_var_read_t::variable.

Referenced by rz_il_handler_var().

rz_il_event_var_write_new()

RZ_API RZ_OWN RzILEvent* rz_il_event_var_write_new	(	RZ_NONNULL const char *	name,
		RZ_NULLABLE const RzILVal *	old_v,
		RZ_NONNULL const RzILVal *	new_v
	)

Creates an RzILEvent of type RZ_IL_EVENT_VAR_WRITE

Parameters

name	register name that has changed
old_v	old value before the change
new_v	new value after the change

Definition at line 177 of file il_events.c.

                                                                                                                                                   {
    rz_return_val_if_fail(name && old_v && new_v, NULL);
 
    RzILEvent *evt = RZ_NEW(RzILEvent);
    if (!evt) {
        return NULL;
    }
 
    evt->type = RZ_IL_EVENT_VAR_WRITE;
    evt->data.var_write.variable = strdup(name);
    evt->data.var_write.old_value = rz_il_value_dup(old_v);
    evt->data.var_write.new_value = rz_il_value_dup(new_v);
    if (!evt->data.var_write.variable ||
        !evt->data.var_write.old_value ||
        !evt->data.var_write.new_value) {
        rz_il_event_free(evt);
        return NULL;
    }
 
    return evt;
}

References rz_il_vm_event_t::data, rz_il_vm_event_var_write_t::new_value, NULL, rz_il_vm_event_var_write_t::old_value, rz_il_event_free(), RZ_IL_EVENT_VAR_WRITE, rz_il_value_dup(), RZ_NEW, rz_return_val_if_fail, strdup(), rz_il_vm_event_t::type, rz_il_vm_event_t::var_write, and rz_il_vm_event_var_write_t::variable.

Referenced by il_event_new_write_from_var().