Search in sources :

Example 1 with Undefined

use of com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined in project binnavi by google.

the class LdmTransformer method transform.

public static ValueTrackerElement transform(final ReilInstruction instruction, final ValueTrackerElement incomingState) {
    final ReilOperand memoryAddressOperand = instruction.getFirstOperand();
    final ReilOperand outputOperand = instruction.getThirdOperand();
    final Register outputRegister = new Register(outputOperand.getValue());
    final IValueElement memoryAddress = getOperandValue(memoryAddressOperand, incomingState);
    if ((memoryAddress == null) || (memoryAddress instanceof Undefined)) {
        final IValueElement memoryAddressValue = getAtomicType(memoryAddressOperand);
        final Dereference dereference = new Dereference(memoryAddressValue);
        return incomingState.update(instruction, outputRegister, dereference);
    } else {
        final IValueElement previousState2 = incomingState.getState(new MemoryCell(memoryAddress));
        if (previousState2 == null) {
            return incomingState.update(instruction, outputRegister, new Dereference(memoryAddress));
        } else {
            return incomingState.update(instruction, outputRegister, previousState2);
        }
    }
}
Also used : Undefined(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined) IValueElement(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IValueElement) Register(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Register) ReilOperand(com.google.security.zynamics.reil.ReilOperand) Dereference(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Dereference) MemoryCell(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.MemoryCell)

Example 2 with Undefined

use of com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined in project binnavi by google.

the class StateCombiner method combine.

private static ValueTrackerElement combine(final ValueTrackerElement state1, final ValueTrackerElement state2) {
    final Map<IAloc, IValueElement> values1 = state1.getStates();
    final Map<IAloc, IValueElement> values2 = state2.getStates();
    final Map<IAloc, IValueElement> combinedState = new HashMap<IAloc, IValueElement>();
    final Set<ReilInstruction> combinedInfluences = state1.getInfluences();
    combinedInfluences.addAll(state2.getInfluences());
    final Map<String, Set<IAddress>> combinedWritten = new HashMap<String, Set<IAddress>>();
    combinedWritten.putAll(state1.getLastWritten());
    for (final Map.Entry<String, Set<IAddress>> lastWritten : state2.getLastWritten().entrySet()) {
        if (combinedWritten.containsKey(lastWritten.getKey())) {
            combinedWritten.get(lastWritten.getKey()).addAll(lastWritten.getValue());
        } else {
            combinedWritten.put(lastWritten.getKey(), new HashSet<IAddress>(lastWritten.getValue()));
        }
    }
    for (final Map.Entry<IAloc, IValueElement> entry : values1.entrySet()) {
        final IAloc aloc = entry.getKey();
        if (values2.containsKey(aloc)) {
            final IValueElement lhs = entry.getValue();
            final IValueElement rhs = values2.get(aloc);
            combinedState.put(aloc, combine(lhs, rhs));
        } else {
            combinedState.put(aloc, new Undefined());
        }
    }
    for (final Map.Entry<IAloc, IValueElement> entry : values2.entrySet()) {
        final IAloc aloc = entry.getKey();
        if (!values1.containsKey(aloc)) {
            combinedState.put(aloc, new Undefined());
        }
    }
    if ((combinedState.size() < state1.getStates().size()) || (combinedState.size() < state2.getStates().size())) {
        throw new IllegalStateException();
    }
    return new ValueTrackerElement(combinedInfluences, combinedState, combinedWritten);
}
Also used : Undefined(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined) ReilInstruction(com.google.security.zynamics.reil.ReilInstruction) Set(java.util.Set) HashSet(java.util.HashSet) HashMap(java.util.HashMap) ValueTrackerElement(com.google.security.zynamics.reil.algorithms.mono.valuetracking.ValueTrackerElement) IAloc(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IAloc) IAddress(com.google.security.zynamics.zylib.disassembly.IAddress) IValueElement(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IValueElement) HashMap(java.util.HashMap) Map(java.util.Map)

Example 3 with Undefined

use of com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined in project binnavi by google.

the class StmTransformer method transform.

public static ValueTrackerElement transform(final ReilInstruction instruction, final ValueTrackerElement state) {
    // STM x, , y
    final ReilOperand inputOperand = instruction.getFirstOperand();
    final ReilOperand addressOperand = instruction.getThirdOperand();
    final OperandType inputOperandType = inputOperand.getType();
    if (inputOperandType == OperandType.INTEGER_LITERAL) {
        final IValueElement previousAddressState = state.getState(addressOperand.getValue());
        final IValueElement outputValue = getValue(inputOperand, previousAddressState);
        if ((previousAddressState == null) || (previousAddressState instanceof Undefined)) {
            final IValueElement newThirdState = getAtomicType(addressOperand);
            return state.update(instruction, new MemoryCell(newThirdState), outputValue);
        } else {
            final IValueElement previousState2b = state.getState(new MemoryCell(previousAddressState));
            if ((previousState2b == null) || (previousState2b instanceof Undefined)) {
                return state.update(instruction, new MemoryCell(previousAddressState), outputValue);
            } else {
                return state.update(instruction, new MemoryCell(previousState2b), outputValue);
            }
        }
    } else if (inputOperandType == OperandType.REGISTER) {
        final IValueElement newThirdState = getAtomicType(addressOperand);
        final IValueElement previousStateInput = state.getState(inputOperand.getValue());
        final IValueElement previousState2 = getOperandValue(addressOperand, state);
        if ((previousStateInput == null) && (previousState2 == null)) {
            return state.update(instruction, new MemoryCell(newThirdState), getAtomicType(inputOperand));
        } else if ((previousStateInput == null) && (previousState2 != null)) {
            final IValueElement previousState2b = state.getState(new MemoryCell(previousState2));
            if (previousState2b == null) {
                return state.update(instruction, new MemoryCell(previousState2), getAtomicType(inputOperand));
            } else {
                return state.update(instruction, new MemoryCell(previousState2b), getAtomicType(inputOperand));
            }
        } else if ((previousStateInput != null) && (previousState2 == null)) {
            return state.update(instruction, new MemoryCell(newThirdState), previousStateInput);
        } else if (previousState2 instanceof Undefined) {
            return state.update(instruction, new MemoryCell(newThirdState), new Undefined());
        } else {
            final IValueElement previousState2b = state.getState(new MemoryCell(previousState2));
            if ((previousState2b == null) || (previousState2b instanceof Undefined)) {
                return state.update(instruction, new MemoryCell(previousState2), previousStateInput);
            } else {
                return state.update(instruction, new MemoryCell(previousState2b), previousStateInput);
            }
        }
    }
    throw new IllegalStateException("Not yet implemented");
}
Also used : Undefined(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined) IValueElement(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IValueElement) OperandType(com.google.security.zynamics.reil.OperandType) ReilOperand(com.google.security.zynamics.reil.ReilOperand) MemoryCell(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.MemoryCell)

Example 4 with Undefined

use of com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined in project binnavi by google.

the class AndSimplifier method simplifyAnd.

public static ValueTrackerElement simplifyAnd(final ReilInstruction instruction, final ReilOperand firstOperand, final ReilOperand secondOperand, final BitwiseAnd previousAnd, final ValueTrackerElement state, final IElementGenerator generator) {
    final ReilOperand thirdOperand = instruction.getThirdOperand();
    final Register targetRegister = new Register(thirdOperand.getValue());
    if (isTruncateMask(previousAnd.getLhs(), firstOperand.getSize())) {
        // (0xFFFFFFFF & X) + Y => (X + Y) & 0xFFFFFFFF
        // final Addition newAddition = new Addition(previousAnd.getRhs(), new Literal(new
        // BigInteger(secondOperand.getValue())));
        final IValueElement newAddition = generator.generate(previousAnd.getRhs(), new Literal(new BigInteger(secondOperand.getValue())));
        final BitwiseAnd newBitwiseAnd = new BitwiseAnd(new Literal(newAddition.evaluate()), previousAnd.getLhs());
        return state.update(instruction, targetRegister, newBitwiseAnd);
    } else if (isTruncateMask(previousAnd.getRhs(), firstOperand.getSize())) {
        // (X & 0xFFFFFFFF) + Y => (X + Y) & 0xFFFFFFFF
        final IValueElement previousLhs = previousAnd.getLhs();
        if (previousLhs instanceof Undefined) {
            return state.update(instruction, targetRegister, new Undefined());
        } else {
            // final Addition newAddition = new Addition(previousLhs, new Literal(new
            // BigInteger(secondOperand.getValue())));
            final IValueElement newAddition = generator.generate(previousLhs, new Literal(new BigInteger(secondOperand.getValue())));
            final BitwiseAnd newBitwiseAnd = new BitwiseAnd(newAddition.getSimplified(), previousAnd.getRhs());
            return state.update(instruction, targetRegister, newBitwiseAnd);
        }
    } else {
        final IValueElement previousState = state.getState(firstOperand.getValue());
        // final IValueElement addition = new Addition(previousState, new Literal(new
        // BigInteger(secondOperand.getValue())));
        final IValueElement addition = generator.generate(previousState, new Literal(new BigInteger(secondOperand.getValue())));
        return state.update(instruction, targetRegister, addition);
    }
}
Also used : Undefined(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined) IValueElement(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IValueElement) Register(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Register) Literal(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Literal) BitwiseAnd(com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.BitwiseAnd) ReilOperand(com.google.security.zynamics.reil.ReilOperand) BigInteger(java.math.BigInteger)

Aggregations

IValueElement (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IValueElement)4 Undefined (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Undefined)4 ReilOperand (com.google.security.zynamics.reil.ReilOperand)3 MemoryCell (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.MemoryCell)2 Register (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Register)2 OperandType (com.google.security.zynamics.reil.OperandType)1 ReilInstruction (com.google.security.zynamics.reil.ReilInstruction)1 ValueTrackerElement (com.google.security.zynamics.reil.algorithms.mono.valuetracking.ValueTrackerElement)1 BitwiseAnd (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.BitwiseAnd)1 Dereference (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Dereference)1 IAloc (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.IAloc)1 Literal (com.google.security.zynamics.reil.algorithms.mono.valuetracking.elements.Literal)1 IAddress (com.google.security.zynamics.zylib.disassembly.IAddress)1 BigInteger (java.math.BigInteger)1 HashMap (java.util.HashMap)1 HashSet (java.util.HashSet)1 Map (java.util.Map)1 Set (java.util.Set)1