Examples with RegisterSetLatticeElement com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement used on opensource projects

Example 1 with RegisterSetLatticeElement

use of com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement in project binnavi by google.

the class RegisterSetLatticeTest method combine.

@Test
public void combine() {
    final RegisterSetLattice lattice = new RegisterSetLattice();
    final RegisterSetLatticeElement element = lattice.combine(Lists.newArrayList(m_fullRegisterSetLatticeElement, m_emptyRegisterSetLatticeElement));
    Assert.assertTrue(element.getTaintedRegisters().containsAll(m_fullRegisterSetLatticeElement.getTaintedRegisters()));
    Assert.assertTrue(element.getUntaintedRegisters().containsAll(m_fullRegisterSetLatticeElement.getUntaintedRegisters()));
    Assert.assertTrue(element.getReadRegisters().containsAll(m_fullRegisterSetLatticeElement.getReadRegisters()));
    Assert.assertTrue(element.getUpdatedRegisters().containsAll(m_fullRegisterSetLatticeElement.getUpdatedRegisters()));
}

Example 2 with RegisterSetLatticeElement

use of com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement in project binnavi by google.

the class RegisterSetLatticeTest method setUp.

@Before
public void setUp() {
    m_emptyRegisterSetLatticeElement = new RegisterSetLatticeElement();
    m_fullSet = Sets.newHashSet("eax", "ebx", "ecx", "edx", "esi");
    m_fullRegisterSetLatticeElement = new RegisterSetLatticeElement(m_fullSet, m_fullSet, new HashSet<String>(), m_fullSet, m_fullSet);
}

Example 3 with RegisterSetLatticeElement

use of com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement in project binnavi by google.

the class CTracking method track.

/**
 * Performs a register forward tracking operation.
 *
 * @param view The view where the operation happens.
 * @param startInstruction The start instruction.
 * @param trackedRegister The register to track.
 * @param options Register tracking options.
 *
 * @return The result of the register tracking operation.
 *
 * @throws InternalTranslationException Thrown if the graph from the code could not be translated
 *         to REIL.
 */
public static CTrackingResult track(final INaviView view, final INaviInstruction startInstruction, final String trackedRegister, final RegisterTrackingOptions options) throws InternalTranslationException {
    Preconditions.checkNotNull(view, "IE01660: View argument can not be null");
    Preconditions.checkNotNull(startInstruction, "IE01661: Start instruction argument can not be null");
    Preconditions.checkNotNull(trackedRegister, "IE01662: Register argument can not be null");
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(view.getContent().getReilCode(), startInstruction, trackedRegister, options);
    final Map<IAddress, INaviInstruction> instructionMap = CRegisterTrackingHelper.getInstructionMap(view);
    final List<CInstructionResult> instructionResultList = new ArrayList<CInstructionResult>();
    final Map<IAddress, RegisterSetLatticeElement> perInstructionElement = result.generateAddressToStateMapping(startInstruction, options.trackIncoming());
    for (final Map.Entry<IAddress, RegisterSetLatticeElement> addressToStateMapEntry : perInstructionElement.entrySet()) {
        final RegisterSetLatticeElement element = addressToStateMapEntry.getValue();
        if (!element.getReadRegisters().isEmpty() || !element.getNewlyTaintedRegisters().isEmpty() || !element.getUntaintedRegisters().isEmpty() || !element.getUpdatedRegisters().isEmpty()) {
            final CAddress concreteAddress = new CAddress(addressToStateMapEntry.getKey().toLong() >> 8);
            instructionResultList.add(new CInstructionResult(instructionMap.get(concreteAddress), addressToStateMapEntry.getValue()));
        }
    }
    return new CTrackingResult(startInstruction, trackedRegister, instructionResultList);
}

Example 4 with RegisterSetLatticeElement

use of com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement in project binnavi by google.

the class ReilTranslatorTest method testInlinedFunctionGeneration.

@Test
public void testInlinedFunctionGeneration() throws InternalTranslationException {
    final MockBlockContainer container = new MockBlockContainer();
    final MockCodeContainer block1 = new MockCodeContainer();
    block1.m_instructions.add(createMov(0x1000, "eax", "1"));
    final MockCodeContainer block2 = new MockCodeContainer();
    block2.m_instructions.add(createMov(0x1200, "ebx", "eax"));
    final MockCodeContainer block3 = new MockCodeContainer();
    block3.m_instructions.add(createMov(0x1001, "ecx", "ebx"));
    container.m_blocks.add(block1);
    container.m_blocks.add(block2);
    container.m_blocks.add(block3);
    container.m_edges.add(new MockCodeEdge<MockCodeContainer>(block1, block2, EdgeType.ENTER_INLINED_FUNCTION));
    container.m_edges.add(new MockCodeEdge<MockCodeContainer>(block2, block3, EdgeType.LEAVE_INLINED_FUNCTION));
    final ReilFunction function = m_translator.translate(new StandardEnvironment(), container);
    System.out.println(function.getGraph().getNodes());
    System.out.println(function.getGraph().getEdges());
    assertEquals(3, function.getGraph().getNodes().size());
    assertEquals(2, function.getGraph().getEdges().size());
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(function, Iterables.getFirst(block1.getInstructions(), null), "eax", new RegisterTrackingOptions(true, new HashSet<String>(), true, AnalysisDirection.DOWN));
    System.out.println(result);
}

Example 5 with RegisterSetLatticeElement

use of com.google.security.zynamics.reil.algorithms.mono2.registertracking.RegisterSetLatticeElement in project binnavi by google.

the class ReilTranslatorTest method testInlinedFunctionGeneration2.

@Test
public void testInlinedFunctionGeneration2() throws InternalTranslationException {
    final MockBlockContainer container = new MockBlockContainer();
    final MockCodeContainer block1 = new MockCodeContainer();
    block1.m_instructions.add(createPush(0x1000, "eax"));
    block1.m_instructions.add(createMov(0x1001, "edx", "3"));
    block1.m_instructions.add(createCall(0x1002));
    final MockCodeContainer block2 = new MockCodeContainer();
    block2.m_instructions.add(createPush(0x2500, "ebx"));
    final MockCodeContainer block3 = new MockCodeContainer();
    block3.m_instructions.add(createPush(0x1003, "ecx"));
    container.m_blocks.add(block1);
    container.m_blocks.add(block2);
    container.m_blocks.add(block3);
    final MockCodeEdge<MockCodeContainer> edge1 = new MockCodeEdge<MockCodeContainer>(block1, block2, EdgeType.ENTER_INLINED_FUNCTION);
    final MockCodeEdge<MockCodeContainer> edge2 = new MockCodeEdge<MockCodeContainer>(block2, block3, EdgeType.LEAVE_INLINED_FUNCTION);
    block1.m_outgoingEdges.add(edge1);
    container.m_edges.add(edge1);
    container.m_edges.add(edge2);
    final ReilFunction function = m_translator.translate(new StandardEnvironment(), container);
    System.out.println(function.getGraph().getEdges());
    assertEquals(3, function.getGraph().getNodes().size());
    assertEquals(2, function.getGraph().getEdges().size());
    final MonoReilSolverResult<RegisterSetLatticeElement> result = RegisterTracker.track(function, Iterables.get(block1.getInstructions(), 0), "esp", new RegisterTrackingOptions(true, new HashSet<String>(), true, AnalysisDirection.DOWN));
    System.out.println(result);
}