Container for data structures associated with a single function. More...

#include <funcdata.hh>

Public Member Functions
	Funcdata (const string &nm, Scope conf, const Address &addr, FunctionSymbol sym, int4 sz=0)
	Constructor. More...

	~Funcdata (void)
	Destructor.

void	setJumptableRecovery (bool val)
	Toggle whether this is being used for jump-table recovery. More...

void	setDoublePrecisRecovery (bool val)
	Toggle whether double precision analysis is used. More...

void	clear (void)
	Clear out old disassembly.

void	warning (const string &txt, const Address &ad) const
	Add a warning comment in the function body. More...

void	warningHeader (const string &txt) const
	Add a warning comment as part of the function header. More...

void	startProcessing (void)
	Start processing for this function. More...

void	stopProcessing (void)
	Mark that processing has completed for this function.

bool	startTypeRecovery (void)
	Mark that data-type analysis has started.

void	followFlow (const Address &baddr, const Address &eadddr)
	Generate raw p-code for the function. More...

void	truncatedFlow (const Funcdata fd, const FlowInfo flow)
	Generate a clone with truncated control-flow given a partial function. More...

bool	inlineFlow (Funcdata inlinefd, FlowInfo &flow, PcodeOp callop)
	In-line the p-code from another function into this function. More...

void	overrideFlow (const Address &addr, uint4 type)
	Override the control-flow p-code for a particular instruction. More...

void	doLiveInject (InjectPayload payload, const Address &addr, BlockBasic bl, list< PcodeOp * >::iterator pos)
	Inject p-code from a payload into this live function. More...

void	printRaw (ostream &s) const
	Print raw p-code op descriptions to a stream. More...

void	printVarnodeTree (ostream &s) const
	Print a description of all Varnodes to a stream. More...

void	printBlockTree (ostream &s) const
	Print a description of control-flow structuring to a stream. More...

void	printLocalRange (ostream &s) const
	Print description of memory ranges associated with local scopes. More...

void	saveXml (ostream &s, uint8 id, bool savetree) const
	Emit an XML description of this function to stream. More...

uint8	restoreXml (const Element *el)
	Restore the state of this function from an XML description. More...

void	saveXmlJumpTable (ostream &s) const
	Emit an XML description of jump-tables to stream. More...

void	restoreXmlJumpTable (const Element *el)
	Restore jump-tables from an XML description. More...

void	saveXmlTree (ostream &s) const
	Save an XML description of the p-code tree to stream. More...

void	saveXmlHigh (ostream &s) const
	Save an XML description of all HighVariables to stream. More...

void	setRestartPending (bool val)
	Toggle whether analysis needs to be restarted for this function. More...

bool	hasRestartPending (void) const
	Does this function need to restart its analysis. More...

bool	hasUnimplemented (void) const
	Does this function have instructions marked as unimplemented. More...

void	spacebase (void)
	Mark registers that map to a virtual address space. More...

Varnode *	newSpacebasePtr (AddrSpace *id)
	Construct a new spacebase register for a given address space. More...

Varnode *	findSpacebaseInput (AddrSpace *id) const

void	spacebaseConstant (PcodeOp op, int4 slot, SymbolEntry entry, const Address &rampoint, uintb origval, int4 origsize)
	Convert a constant pointer into a ram CPUI_PTRSUB. More...

int4	numHeritagePasses (AddrSpace *spc)
	Get the number of heritage passes performed for the given address space. More...

void	seenDeadcode (AddrSpace *spc)
	Mark that dead Varnodes have been seen in a specific address space. More...

void	setDeadCodeDelay (AddrSpace *spc, int4 delay)
	Set a delay before removing dead code for a specific address space. More...

bool	deadRemovalAllowed (AddrSpace *spc) const
	Check if dead code removal is allowed for a specific address space. More...

bool	deadRemovalAllowedSeen (AddrSpace *spc)
	Check if dead Varnodes have been removed for a specific address space. More...

bool	isHeritaged (Varnode *vn)
	Check if a specific Varnode has been linked in fully to the syntax tree (SSA) More...

FuncCallSpecs *	getCallSpecs (const PcodeOp *op) const
	Get the call specification associated with a CALL op.

int4	fillinExtrapop (void)
	Recover and return the extrapop for this function. More...

Varnode *	newVarnodeOut (int4 s, const Address &m, PcodeOp *op)
	Create a new output Varnode. More...

Varnode *	newUniqueOut (int4 s, PcodeOp *op)
	Create a new temporary output Varnode. More...

Varnode *	newVarnode (int4 s, const Address &m, Datatype ct=(Datatype ) 0)
	Create a new unattached Varnode object. More...

Varnode *	newConstant (int4 s, uintb constant_val)
	Create a new constant Varnode. More...

Varnode *	newVarnode (int4 s, AddrSpace *base, uintb off)
	Create a new Varnode given an address space and offset. More...

Varnode *	newVarnodeIop (PcodeOp *op)
	Create a PcodeOp annotation Varnode. More...

Varnode *	newVarnodeSpace (AddrSpace *spc)
	Create a constant Varnode referring to an address space. More...

Varnode *	newVarnodeCallSpecs (FuncCallSpecs *fc)
	Create a call specification annotation Varnode. More...

Varnode *	newUnique (int4 s, Datatype ct=(Datatype ) 0)
	Create a new temporary Varnode. More...

Varnode *	newCodeRef (const Address &m)
	Create a code address annotation Varnode. More...

Varnode *	setInputVarnode (Varnode *vn)
	Mark a Varnode as an input to the function. More...

void	adjustInputVarnodes (const Address &addr, int4 size)
	Adjust input Varnodes contained in the given range. More...

Address	findDisjointCover (Varnode *vn, int4 &sz)
	Find range covering given Varnode and any intersecting Varnodes. More...

Varnode *	findCoveredInput (int4 s, const Address &loc) const
	Find the first input Varnode covered by the given range. More...

Varnode *	findCoveringInput (int4 s, const Address &loc) const
	Find the input Varnode that contains the given range. More...

Varnode *	findVarnodeInput (int4 s, const Address &loc) const
	Find the input Varnode with the given size and storage address. More...

Varnode *	findVarnodeWritten (int4 s, const Address &loc, const Address &pc, uintm uniq=~((uintm) 0)) const
	Find a defined Varnode via its storage address and its definition address. More...

VarnodeLocSet::const_iterator	beginLoc (void) const
	Start of all Varnodes sorted by storage.

VarnodeLocSet::const_iterator	endLoc (void) const
	End of all Varnodes sorted by storage.

VarnodeLocSet::const_iterator	beginLoc (AddrSpace *spaceid) const
	Start of Varnodes stored in a given address space.

VarnodeLocSet::const_iterator	endLoc (AddrSpace *spaceid) const
	End of Varnodes stored in a given address space.

VarnodeLocSet::const_iterator	beginLoc (const Address &addr) const
	Start of Varnodes at a storage address.

VarnodeLocSet::const_iterator	endLoc (const Address &addr) const
	End of Varnodes at a storage address.

VarnodeLocSet::const_iterator	beginLoc (int4 s, const Address &addr) const
	Start of Varnodes with given storage.

VarnodeLocSet::const_iterator	endLoc (int4 s, const Address &addr) const
	End of Varnodes with given storage.

VarnodeLocSet::const_iterator	beginLoc (int4 s, const Address &addr, uint4 fl) const
	Start of Varnodes matching storage and properties.

VarnodeLocSet::const_iterator	endLoc (int4 s, const Address &addr, uint4 fl) const
	End of Varnodes matching storage and properties.

VarnodeLocSet::const_iterator	beginLoc (int4 s, const Address &addr, const Address &pc, uintm uniq=~((uintm) 0)) const
	Start of Varnodes matching storage and definition address.

VarnodeLocSet::const_iterator	endLoc (int4 s, const Address &addr, const Address &pc, uintm uniq=~((uintm) 0)) const
	End of Varnodes matching storage and definition address.

VarnodeDefSet::const_iterator	beginDef (void) const
	Start of all Varnodes sorted by definition address.

VarnodeDefSet::const_iterator	endDef (void) const
	End of all Varnodes sorted by definition address.

VarnodeDefSet::const_iterator	beginDef (uint4 fl) const
	Start of Varnodes with a given definition property.

VarnodeDefSet::const_iterator	endDef (uint4 fl) const
	End of Varnodes with a given definition property.

VarnodeDefSet::const_iterator	beginDef (uint4 fl, const Address &addr) const
	Start of (input or free) Varnodes at a given storage address.

VarnodeDefSet::const_iterator	endDef (uint4 fl, const Address &addr) const
	End of (input or free) Varnodes at a given storage address.

void	checkForLanedRegister (int4 size, const Address &addr)
	Check for a potential laned register. More...

HighVariable *	findHigh (const string &name) const
	Find a high-level variable by name. More...

void	mapGlobals (void)
	Make sure there is a Symbol entry for all global Varnodes. More...

bool	checkCallDoubleUse (const PcodeOp opmatch, const PcodeOp op, const Varnode *vn, const ParamTrial &trial) const
	Test for legitimate double use of a parameter trial. More...

bool	onlyOpUse (const Varnode invn, const PcodeOp opmatch, const ParamTrial &trial) const
	Test if the given Varnode seems to only be used by a CALL. More...

bool	ancestorOpUse (int4 maxlevel, const Varnode invn, const PcodeOp op, ParamTrial &trial) const
	Test if the given trial Varnode is likely only used for parameter passing. More...

bool	syncVarnodesWithSymbols (const ScopeLocal *lm, bool typesyes)
	Update Varnode properties based on (new) Symbol information. More...

void	transferVarnodeProperties (Varnode vn, Varnode newVn, int4 lsbOffset)
	Copy properties from an existing Varnode to a new Varnode. More...

bool	fillinReadOnly (Varnode *vn)
	Replace the given Varnode with its (constant) value in the load image. More...

bool	replaceVolatile (Varnode *vn)
	Replace accesses of the given Varnode with volatile operations. More...

void	markIndirectOnly (void)
	Mark illegal input Varnodes used only in INDIRECTs. More...

void	totalReplace (Varnode vn, Varnode newvn)
	Replace all read references to the first Varnode with a second Varnode. More...

void	totalReplaceConstant (Varnode *vn, uintb val)
	Replace every read reference of the given Varnode with a constant value. More...

void	initActiveOutput (void)

void	clearActiveOutput (void)
	Clear any analysis of the function's return prototype.

void	setHighLevel (void)
	Turn on HighVariable objects for all Varnodes.

void	clearDeadVarnodes (void)
	Delete any dead Varnodes. More...

void	calcNZMask (void)
	Calculate non-zero masks for all Varnodes. More...

void	clearSymbolLinks (HighVariable *high)
	Clear Symbols attached to Varnodes in the given HighVariable. More...

void	remapVarnode (Varnode vn, Symbol sym, const Address &usepoint)
	Remap a Symbol to a given Varnode using a static mapping. More...

void	remapDynamicVarnode (Varnode vn, Symbol sym, const Address &usepoint, uint8 hash)
	Remap a Symbol to a given Varnode using a new dynamic mapping. More...

Symbol *	linkSymbol (Varnode *vn)
	Find or create Symbol associated with given Varnode. More...

Symbol *	linkSymbolReference (Varnode *vn)
	Discover and attach Symbol to a constant reference. More...

Varnode *	findLinkedVarnode (SymbolEntry *entry) const
	Find a Varnode matching the given Symbol mapping. More...

void	findLinkedVarnodes (SymbolEntry entry, vector< Varnode > &res) const
	Find Varnodes that map to the given SymbolEntry. More...

void	buildDynamicSymbol (Varnode *vn)
	Build a dynamic Symbol associated with the given Varnode. More...

bool	attemptDynamicMapping (SymbolEntry *entry, DynamicHash &dhash)
	Map properties of a dynamic symbol to a Varnode. More...

bool	attemptDynamicMappingLate (SymbolEntry *entry, DynamicHash &dhash)
	Map the name of a dynamic symbol to a Varnode. More...

PcodeOp *	newOp (int4 inputs, const Address &pc)

PcodeOp *	newOp (int4 inputs, const SeqNum &sq)
	Allocate a new PcodeOp with Address. More...

PcodeOp *	newOpBefore (PcodeOp follow, OpCode opc, Varnode in1, Varnode in2, Varnode in3=(Varnode *) 0)
	Allocate a new PcodeOp with sequence number. More...

PcodeOp *	cloneOp (const PcodeOp *op, const SeqNum &seq)

PcodeOp *	getFirstReturnOp (void) const
	Clone a PcodeOp into this function. More...

PcodeOp *	newIndirectOp (PcodeOp *indeffect, const Address &addr, int4 size, uint4 extraFlags)
	Find a representative CPUI_RETURN op for this function. More...

PcodeOp *	newIndirectCreation (PcodeOp *indeffect, const Address &addr, int4 size, bool possibleout)
	Build a CPUI_INDIRECT op that indirectly creates a Varnode. More...

void	markIndirectCreation (PcodeOp *indop, bool possibleOutput)
	Convert CPUI_INDIRECT into an indirect creation. More...

void	opInsertBefore (PcodeOp op, PcodeOp follow)
	Insert given PcodeOp before a specific op. More...

void	opInsertAfter (PcodeOp op, PcodeOp prev)
	Insert given PcodeOp after a specific op. More...

void	opInsertBegin (PcodeOp op, BlockBasic bl)
	Insert given PcodeOp at the beginning of a basic block. More...

void	opInsertEnd (PcodeOp op, BlockBasic bl)
	Insert given PcodeOp at the end of a basic block. More...

void	opDeadInsertAfter (PcodeOp op, PcodeOp prev)
	Moved given PcodeOp to specified point in the dead list.

void	opSetOpcode (PcodeOp *op, OpCode opc)
	Set the op-code for a specific PcodeOp. More...

void	opMarkHalt (PcodeOp *op, uint4 flag)
	Mark given CPUI_RETURN op as a special halt. More...

void	opSetOutput (PcodeOp op, Varnode vn)
	Set a specific output Varnode for the given PcodeOp. More...

void	opUnsetOutput (PcodeOp *op)
	Remove output Varnode from the given PcodeOp. More...

void	opSetInput (PcodeOp op, Varnode vn, int4 slot)
	Set a specific input operand for the given PcodeOp. More...

void	opSwapInput (PcodeOp *op, int4 slot1, int4 slot2)
	Swap two input operands in the given PcodeOp. More...

void	opUnsetInput (PcodeOp *op, int4 slot)
	Clear an input operand slot for the given PcodeOp. More...

void	opInsert (PcodeOp op, BlockBasic bl, list< PcodeOp * >::iterator iter)
	Insert the given PcodeOp at specific point in a basic block. More...

void	opUninsert (PcodeOp *op)
	Remove the given PcodeOp from its basic block. More...

void	opUnlink (PcodeOp *op)
	Unset inputs/output and remove given PcodeOP from its basic block. More...

void	opDestroy (PcodeOp *op)
	Remove given PcodeOp and destroy its Varnode operands. More...

void	opDestroyRaw (PcodeOp *op)
	Remove the given raw PcodeOp. More...

void	opSetAllInput (PcodeOp op, const vector< Varnode > &vvec)
	Set all input Varnodes for the given PcodeOp simultaneously. More...

void	opRemoveInput (PcodeOp *op, int4 slot)
	Remove a specific input slot for the given PcodeOp. More...

void	opInsertInput (PcodeOp op, Varnode vn, int4 slot)
	Insert a new Varnode into the operand list for the given PcodeOp. More...

Varnode *	createStackRef (AddrSpace spc, uintb off, PcodeOp op, Varnode *stackptr, bool insertafter)
	Create an INT_ADD PcodeOp calculating an offset to the spacebase register. More...

Varnode *	opStackLoad (AddrSpace spc, uintb off, uint4 sz, PcodeOp op, Varnode *stackptr, bool insertafter)
	Create a LOAD expression at an offset relative to a spacebase register for a given address space. More...

PcodeOp *	opStackStore (AddrSpace spc, uintb off, PcodeOp op, bool insertafter)
	Create a STORE expression at an offset relative to a spacebase register for a given address space. More...

void	opUndoPtradd (PcodeOp *op, bool finalize)
	Convert a CPUI_PTRADD back into a CPUI_INT_ADD. More...

list< PcodeOp * >::const_iterator	beginOp (OpCode opc) const
	Start of PcodeOp objects with the given op-code.

list< PcodeOp * >::const_iterator	endOp (OpCode opc) const
	End of PcodeOp objects with the given op-code.

list< PcodeOp * >::const_iterator	beginOpAlive (void) const
	Start of PcodeOp objects in the alive list.

list< PcodeOp * >::const_iterator	endOpAlive (void) const
	End of PcodeOp objects in the alive list.

list< PcodeOp * >::const_iterator	beginOpDead (void) const
	Start of PcodeOp objects in the dead list.

list< PcodeOp * >::const_iterator	endOpDead (void) const
	End of PcodeOp objects in the dead list.

PcodeOpTree::const_iterator	beginOpAll (void) const
	Start of all (alive) PcodeOp objects sorted by sequence number.

PcodeOpTree::const_iterator	endOpAll (void) const
	End of all (alive) PcodeOp objects sorted by sequence number.

PcodeOpTree::const_iterator	beginOp (const Address &addr) const
	Start of all (alive) PcodeOp objects attached to a specific Address.

PcodeOpTree::const_iterator	endOp (const Address &addr) const
	End of all (alive) PcodeOp objects attached to a specific Address.

bool	moveRespectingCover (PcodeOp op, PcodeOp lastOp)
	Move given op past lastOp respecting covers if possible. More...

JumpTable *	linkJumpTable (PcodeOp *op)
	Link jump-table with a given BRANCHIND. More...

JumpTable *	findJumpTable (const PcodeOp *op) const
	Find a jump-table associated with a given BRANCHIND. More...

JumpTable *	installJumpTable (const Address &addr)
	Install a new jump-table for the given Address. More...

JumpTable *	recoverJumpTable (PcodeOp op, FlowInfo flow, int4 &failuremode)
	Recover destinations for a BRANCHIND by analyzing nearby data and control-flow. More...

void	removeJumpTable (JumpTable *jt)
	Remove/delete the given jump-table. More...

void	setBasicBlockRange (BlockBasic *bb, const Address &beg, const Address &end)
	Set the initial ownership range for the given basic block. More...

void	removeDoNothingBlock (BlockBasic *bb)
	Remove a basic block from control-flow that performs no operations. More...

bool	removeUnreachableBlocks (bool issuewarning, bool checkexistence)
	Remove any unreachable basic blocks. More...

void	pushBranch (BlockBasic bb, int4 slot, BlockBasic bbnew)
	Move a control-flow edge from one block to another. More...

void	removeBranch (BlockBasic *bb, int4 num)
	Remove the indicated branch from a basic block. More...

BlockBasic *	nodeJoinCreateBlock (BlockBasic block1, BlockBasic block2, BlockBasic exita, BlockBasic exitb, bool fora_block1ishigh, bool forb_block1ishigh, const Address &addr)
	Create a new basic block for holding a merged CBRANCH. More...

void	nodeSplit (BlockBasic *b, int4 inedge)
	Split control-flow into a basic block, duplicating its p-code into a new block. More...

bool	forceGoto (const Address &pcop, const Address &pcdest)
	Force a specific control-flow edge to be marked as unstructured. More...

void	removeFromFlowSplit (BlockBasic *bl, bool swap)
	Remove a basic block splitting its control-flow into two distinct paths. More...

void	switchEdge (FlowBlock inblock, BlockBasic outbefore, FlowBlock *outafter)
	Switch an outgoing edge from the given source block to flow into another block. More...

void	spliceBlockBasic (BlockBasic *bl)
	Merge the given basic block with the block it flows into. More...

void	installSwitchDefaults (void)
	Make sure default switch cases are properly labeled.

bool	replaceLessequal (PcodeOp *op)
	Replace INT_LESSEQUAL and INT_SLESSEQUAL expressions. More...

bool	distributeIntMultAdd (PcodeOp *op)
	Distribute constant coefficient to additive input. More...

bool	collapseIntMultMult (Varnode *vn)
	Collapse constant coefficients for two chained CPUI_INT_MULT. More...

Static Public Member Functions
static bool	compareCallspecs (const FuncCallSpecs a, const FuncCallSpecs b)
	Compare call specification objects by call site address. More...

Detailed Description

Container for data structures associated with a single function.

This class holds the primary data structures for decompiling a function. In particular it holds control-flow, data-flow, and prototype information, plus class instances to help with constructing SSA form, structure control-flow, recover jump-tables, recover parameters, and merge Varnodes. In most cases it acts as the main API for querying and accessing these structures.

Some important groups of public methods include:

PcodeOp manipulation (mostly starting with 'op')
PcodeOp search and traversal ('beginOp*' and 'endOp*')
Varnode creation ('new*' methods)
Varnode search and traversal ('beginLoc' 'endLoc' 'beginDef' and 'endDef')
Basic block access and block structuring
Access to subfunction prototypes
Access to jump-tables (within the body of the function)

Constructor & Destructor Documentation

◆ Funcdata()

Funcdata::Funcdata	(	const string &	nm,
		Scope *	scope,
		const Address &	addr,
		FunctionSymbol *	sym,
		int4	sz = `0`
	)

Constructor.

Parameters

nm	is the (base) name of the function
scope	is Symbol scope associated with the function
addr	is the entry address for the function
sym	is the symbol representing the function
sz	is the number of bytes (of code) in the function body

Member Function Documentation

◆ adjustInputVarnodes()

void Funcdata::adjustInputVarnodes	(	const Address &	addr,
		int4	size
	)

Adjust input Varnodes contained in the given range.

After this call, a single input Varnode will exist that fills the given range. Any previous input Varnodes contained in this range are redefined using a SUBPIECE op off of the new single input. If an overlapping Varnode isn't fully contained an exception is thrown.

Parameters

addr	is the starting address of the range
size	is the number of bytes in the range

◆ ancestorOpUse()

bool Funcdata::ancestorOpUse	(	int4	maxlevel,
		const Varnode *	invn,
		const PcodeOp *	op,
		ParamTrial &	trial
	)		const

Test if the given trial Varnode is likely only used for parameter passing.

Flow is followed from the Varnode itself and from ancestors the Varnode was copied from to see if it hits anything other than the given CALL or RETURN operation.

Parameters

maxlevel	is the maximum number of times to recurse through ancestor copies
invn	is the given trial Varnode to test
op	is the given CALL or RETURN
trial	is the associated parameter trial object

Returns: true if the Varnode is only used for the CALL/RETURN

◆ attemptDynamicMapping()

bool Funcdata::attemptDynamicMapping	(	SymbolEntry *	entry,
		DynamicHash &	dhash
	)

Map properties of a dynamic symbol to a Varnode.

Given a dynamic mapping, try to find the mapped Varnode, then adjust (type and flags) to reflect this mapping.

Parameters

entry	is the (dynamic) Symbol entry
dhash	is the dynamic mapping information

Returns: true if a Varnode was adjusted

◆ attemptDynamicMappingLate()

bool Funcdata::attemptDynamicMappingLate	(	SymbolEntry *	entry,
		DynamicHash &	dhash
	)

Map the name of a dynamic symbol to a Varnode.

Given a dynamic mapping, try to find the mapped Varnode, then attach the Symbol to the Varnode. The name of the Symbol is used, but the data-type and possibly other properties are not put on the Varnode.

Parameters

entry	is the (dynamic) Symbol entry
dhash	is the dynamic mapping information

Returns: true if a Varnode was adjusted

◆ buildDynamicSymbol()

void Funcdata::buildDynamicSymbol ( Varnode * vn )

Build a dynamic Symbol associated with the given Varnode.

If a Symbol is already attached, no change is made. Otherwise a special dynamic Symbol is created that is associated with the Varnode via a hash of its local data-flow (rather than its storage address).

Parameters

vn	is the given Varnode

◆ calcNZMask()

void Funcdata::calcNZMask ( void )

Calculate non-zero masks for all Varnodes.

All Varnodes are initialized assuming that all its bits are possibly non-zero. This method looks for situations where a p-code produces a value that is known to have some bits that are guaranteed to be zero. It updates the state of the output Varnode then tries to push the information forward through the data-flow until additional changes are apparent.

◆ checkCallDoubleUse()

bool Funcdata::checkCallDoubleUse	(	const PcodeOp *	opmatch,
		const PcodeOp *	op,
		const Varnode *	vn,
		const ParamTrial &	trial
	)		const

Test for legitimate double use of a parameter trial.

The given trial is a putative input to first CALL, but can also trace its data-flow into a second CALL. Return false if this leads us to conclude that the trial is not a likely parameter.

Parameters

opmatch	is the first CALL linked to the trial
op	is the second CALL
vn	is the Varnode parameter for the second CALL
trial	is the given parameter trial

Returns: true for a legitimate double use

◆ checkForLanedRegister()

void Funcdata::checkForLanedRegister	(	int4	size,
		const Address &	addr
	)

Check for a potential laned register.

Check if the given storage range is a potential laned register. If so, record the storage with the matching laned register record.

Parameters

size	is the size of the storage range in bytes
addr	is the starting address of the storage range

◆ clearDeadVarnodes()

void Funcdata::clearDeadVarnodes ( void )

Delete any dead Varnodes.

Free any Varnodes not attached to anything. This is only performed at fixed times so that editing operations can detach (and then reattach) Varnodes without losing them.

◆ clearSymbolLinks()

void Funcdata::clearSymbolLinks ( HighVariable * high )

Clear Symbols attached to Varnodes in the given HighVariable.

For each instance Varnode, remove any SymbolEntry reference and associated properties.

Parameters

high	is the given HighVariable to clear

◆ cloneOp()

PcodeOp * Funcdata::cloneOp	(	const PcodeOp *	op,
		const SeqNum &	seq
	)

Make a clone of the given PcodeOp, copying control-flow properties as well. The data-type is not cloned.

Parameters

op	is the PcodeOp to clone
seq	is the (possibly custom) sequence number to associate with the clone

Returns: the cloned PcodeOp

◆ collapseIntMultMult()

bool Funcdata::collapseIntMultMult ( Varnode * vn )

Collapse constant coefficients for two chained CPUI_INT_MULT.

If:

The given Varnode is defined by a CPUI_INT_MULT.
The second input to the INT_MULT is a constant.
The first input is defined by another CPUI_INT_MULT,
This multiply is also by a constant.

The constants are combined and true is returned. Otherwise no change is made and false is returned.

Parameters

vn	is the given Varnode

Returns: true if a change was made

◆ compareCallspecs()

bool Funcdata::compareCallspecs	(	const FuncCallSpecs *	a,
		const FuncCallSpecs *	b
	)

static

Compare call specification objects by call site address.

Parameters

a	is the first call specification to compare
b	is the second call specification

Returns: true if the first call specification should come before the second

◆ createStackRef()

Varnode * Funcdata::createStackRef	(	AddrSpace *	spc,
		uintb	off,
		PcodeOp *	op,
		Varnode *	stackptr,
		bool	insertafter
	)

Create an INT_ADD PcodeOp calculating an offset to the spacebase register.

The spacebase register is looked up for the given address space, or an optional previously existing register Varnode can be provided. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point.

Parameters

spc	is the given address space
off	is the offset to calculate relative to the spacebase register
op	is the insertion point PcodeOp
stackptr	is the spacebase register Varnode (if available)
insertafter	is true if new ops are inserted after the insertion point

Returns: the unique space Varnode holding the calculated offset

◆ deadRemovalAllowed()

bool Funcdata::deadRemovalAllowed ( AddrSpace * spc ) const

inline

Check if dead code removal is allowed for a specific address space.

Parameters

spc	is the specific address space

Returns: true if dead code removal is allowed

◆ deadRemovalAllowedSeen()

bool Funcdata::deadRemovalAllowedSeen ( AddrSpace * spc )

inline

Check if dead Varnodes have been removed for a specific address space.

Parameters

spc	is the specific address space

Returns: true if dead code removal has happened in the space

◆ distributeIntMultAdd()

bool Funcdata::distributeIntMultAdd ( PcodeOp * op )

Distribute constant coefficient to additive input.

If a term has a multiplicative coefficient, but the underlying term is still additive, in some situations we may need to distribute the coefficient before simplifying further. The given PcodeOp is a INT_MULT where the second input is a constant. We also know the first input is formed with INT_ADD. Distribute the coefficient to the INT_ADD inputs.

Parameters

op	is the given PcodeOp

Returns: true if the action was performed

◆ doLiveInject()

void Funcdata::doLiveInject	(	InjectPayload *	payload,
		const Address &	addr,
		BlockBasic *	bl,
		list< PcodeOp * >::iterator	iter
	)

Inject p-code from a payload into this live function.

Raw PcodeOps are generated from the payload within a given basic block at a specific position in this function.

Parameters

payload	is the injection payload
addr	is the address at the point of injection
bl	is the given basic block holding the new ops
iter	indicates the point of insertion

◆ fillinExtrapop()

int4 Funcdata::fillinExtrapop ( void )

Recover and return the extrapop for this function.

If extrapop is unknown, recover it from what we know about this function and set the value permanently for this Funcdata object. If there is no function body it may be impossible to know the value, in which case this returns the reserved value indicating extrapop is unknown.

Returns: the recovered value

◆ fillinReadOnly()

bool Funcdata::fillinReadOnly ( Varnode * vn )

Replace the given Varnode with its (constant) value in the load image.

Treat the given Varnode as read-only, look up its value in LoadImage and replace read references with the value as a constant Varnode.

Parameters

vn	is the given Varnode

Returns: true if any change was made

◆ findCoveredInput()

Varnode* Funcdata::findCoveredInput	(	int4	s,
		const Address &	loc
	)		const

inline

Find the first input Varnode covered by the given range.

Parameters

s	is the size of the range in bytes
loc	is the starting address of the range

Returns: the matching Varnode or NULL

◆ findCoveringInput()

Varnode* Funcdata::findCoveringInput	(	int4	s,
		const Address &	loc
	)		const

inline

Find the input Varnode that contains the given range.

Parameters

s	is the size of the range in bytes
loc	is the starting address of the range

Returns: the matching Varnode or NULL

◆ findDisjointCover()

Address Funcdata::findDisjointCover	(	Varnode *	vn,
		int4 &	sz
	)

Find range covering given Varnode and any intersecting Varnodes.

Find the minimal Address range covering the given Varnode that doesn't split other Varnodes

Parameters

vn	is the given Varnode
sz	is used to pass back the size of the resulting range

Returns: the starting address of the resulting range

◆ findHigh()

HighVariable * Funcdata::findHigh ( const string & name ) const

Find a high-level variable by name.

Look up the Symbol visible in this function's Scope and return the HighVariable associated with it. If the Symbol doesn't exist or there is no Varnode holding at least part of the value of the Symbol, NULL is returned.

Parameters

name	is the name to search for

Returns: the matching HighVariable or NULL

◆ findJumpTable()

JumpTable * Funcdata::findJumpTable ( const PcodeOp * op ) const

Find a jump-table associated with a given BRANCHIND.

Look up the jump-table object with the matching PcodeOp address

Parameters

op	is the given BRANCHIND PcodeOp

Returns: the matching jump-table object or NULL

◆ findLinkedVarnode()

Varnode * Funcdata::findLinkedVarnode ( SymbolEntry * entry ) const

Find a Varnode matching the given Symbol mapping.

Return the (first) Varnode that matches the given SymbolEntry

Parameters

entry is the given SymbolEntry

Returns: a matching Varnode or null

◆ findLinkedVarnodes()

void Funcdata::findLinkedVarnodes	(	SymbolEntry *	entry,
		vector< Varnode * > &	res
	)		const

Find Varnodes that map to the given SymbolEntry.

Look for Varnodes that are (should be) mapped to the given SymbolEntry and add them to the end of the result list.

Parameters

entry	is the given SymbolEntry to match
res	is the container holding the result list of matching Varnodes

◆ findSpacebaseInput()

Varnode * Funcdata::findSpacebaseInput ( AddrSpace * id ) const

Given an address space, like stack, that is known to have a base register pointing to it, try to locate the unique Varnode that holds the input value of this register.

Parameters

id	is the stack like address space

Returns: the input stack-pointer Varnode (or NULL if it doesn't exist)

◆ findVarnodeInput()

Varnode* Funcdata::findVarnodeInput	(	int4	s,
		const Address &	loc
	)		const

inline

Find the input Varnode with the given size and storage address.

Parameters

s	is the size in bytes
loc	is the storage address

Returns: the matching Varnode or NULL

◆ findVarnodeWritten()

Varnode* Funcdata::findVarnodeWritten	(	int4	s,
		const Address &	loc,
		const Address &	pc,
		uintm	uniq = `~((uintm)0)`
	)		const

inline

Find a defined Varnode via its storage address and its definition address.

Parameters

s	is the size in bytes
loc	is the storage address
pc	is the address where the Varnode is defined
uniq	is an (optional) sequence number to match

Returns: the matching Varnode or NULL

◆ followFlow()

void Funcdata::followFlow	(	const Address &	baddr,
		const Address &	eaddr
	)

Generate raw p-code for the function.

Follow flow from the entry point generating PcodeOps for each instruction encountered. The caller can provide a bounding range that constrains where control can flow to.

Parameters

baddr	is the beginning of the constraining range
eaddr	is the end of the constraining range

◆ forceGoto()

bool Funcdata::forceGoto	(	const Address &	pcop,
		const Address &	pcdest
	)

Force a specific control-flow edge to be marked as unstructured.

The edge is specified by a source and destination Address (of the branch). The resulting control-flow structure will have a goto statement modeling the edge.

Parameters

pcop	is the source Address
pcdest	is the destination Address

Returns: true if a control-flow edge was successfully labeled

◆ getFirstReturnOp()

PcodeOp * Funcdata::getFirstReturnOp ( void ) const

Clone a PcodeOp into this function.

Return the first CPUI_RETURN operation that is not dead or an artificial halt

Returns: a representative CPUI_RETURN op or NULL if there are none

◆ hasRestartPending()

bool Funcdata::hasRestartPending ( void ) const

inline

Does this function need to restart its analysis.

Returns: true if analysis should be restarted

◆ hasUnimplemented()

bool Funcdata::hasUnimplemented ( void ) const

inline

Does this function have instructions marked as unimplemented.

Returns: true if the function's body contains at least one unimplemented instruction

◆ initActiveOutput()

void Funcdata::initActiveOutput ( void )

Initialize return prototype recovery analysis

◆ inlineFlow()

bool Funcdata::inlineFlow	(	Funcdata *	inlinefd,
		FlowInfo &	flow,
		PcodeOp *	callop
	)

In-line the p-code from another function into this function.

Raw PcodeOps for the in-line function are generated and then cloned into this function. Depending on the control-flow complexity of the in-line function, the PcodeOps are injected as if they are all part of the call site address (EZModel), or the PcodeOps preserve their address and extra branch instructions are inserted to integrate control-flow of the in-line into the calling function.

Parameters

inlinefd	is the function to in-line
flow	is the flow object being injected
callop	is the site of the injection

Returns: true if the injection was successful

◆ installJumpTable()

JumpTable * Funcdata::installJumpTable ( const Address & addr )

Install a new jump-table for the given Address.

The given address must have a BRANCHIND op attached to it. This is suitable for installing an override and must be called before flow has been traced.

Parameters

addr	is the given Address

Returns: the new jump-table object

◆ isHeritaged()

bool Funcdata::isHeritaged ( Varnode * vn )

inline

Check if a specific Varnode has been linked in fully to the syntax tree (SSA)

Parameters

vn	is the specific Varnode

Returns: true if the Varnode is fully linked

◆ linkJumpTable()

JumpTable * Funcdata::linkJumpTable ( PcodeOp * op )

Link jump-table with a given BRANCHIND.

Look up the jump-table object with the matching PcodeOp address, then attach the given PcodeOp to it.

Parameters

op	is the given BRANCHIND PcodeOp

Returns: the matching jump-table object or NULL

◆ linkSymbol()

Symbol * Funcdata::linkSymbol ( Varnode * vn )

Find or create Symbol associated with given Varnode.

The Symbol is really attached to the Varnode's HighVariable (which must exist). The only reason a Symbol doesn't get set is if, the HighVariable is global and there is no pre-existing Symbol. (see mapGlobals())

Parameters

vn	is the given Varnode

Returns: the associated Symbol or NULL

◆ linkSymbolReference()

Symbol * Funcdata::linkSymbolReference ( Varnode * vn )

Discover and attach Symbol to a constant reference.

A reference to a symbol (i.e. &varname) is typically stored as a PTRSUB operation, where the first input Varnode is a spacebase Varnode indicating whether the symbol is on the stack or at a global RAM location. The second input Varnode is a constant encoding the address of the symbol. This method takes this constant Varnode, recovers the symbol it is referring to, and stores on the HighVariable object attached to the Varnode.

Parameters

vn	is the constant Varnode (second input) to a PTRSUB operation

Returns: the symbol being referred to or null

◆ mapGlobals()

void Funcdata::mapGlobals ( void )

Make sure there is a Symbol entry for all global Varnodes.

Search for addrtied Varnodes whose storage falls in the global Scope, then build a new global Symbol if one didn't exist before.

◆ markIndirectCreation()

void Funcdata::markIndirectCreation	(	PcodeOp *	indop,
		bool	possibleOutput
	)

Convert CPUI_INDIRECT into an indirect creation.

Data-flow through the given CPUI_INDIRECT op is marked so that the output Varnode is considered indirectly created. An indirectly created Varnode effectively has no data-flow before the INDIRECT op that defines it, and the value contained by the Varnode is not explicitly calculable.

Parameters

indop	is the given CPUI_INDIRECT op
possibleOutput	is true if INDIRECT should be marked as a possible call output

◆ markIndirectOnly()

void Funcdata::markIndirectOnly ( void )

Mark illegal input Varnodes used only in INDIRECTs.

The illegal inputs are additionally marked as indirectonly and isIndirectOnly() returns true.

◆ moveRespectingCover()

bool Funcdata::moveRespectingCover	(	PcodeOp *	op,
		PcodeOp *	lastOp
	)

Move given op past lastOp respecting covers if possible.

This routine should be called only after Varnode merging and explicit/implicit attributes have been calculated. Determine if the given op can be moved (only within its basic block) to after lastOp. The output of any PcodeOp moved across must not be involved, directly or indirectly, with any variable in the expression rooted at the given op. If the move is possible, perform the move.

Parameters

op	is the given PcodeOp
lastOp	is the PcodeOp to move past

Returns: true if the move is possible

◆ newCodeRef()

Varnode * Funcdata::newCodeRef ( const Address & m )

Create a code address annotation Varnode.

A reference to a specific Address is encoded in a Varnode. The Varnode is an annotation in the sense that it will hold no value in the data-flow, it will will only hold a reference to an address. This is used specifically by the branch p-code operations to hold destination addresses.

Parameters

m	is the Address to encode

Returns: the newly allocated annotation Varnode

◆ newConstant()

Varnode * Funcdata::newConstant	(	int4	s,
		uintb	constant_val
	)

Create a new constant Varnode.

A Varnode is allocated which represents the indicated constant value. Its storage address is in the constant address space.

Parameters

s	is the size of the Varnode in bytes
constant_val	is the indicated constant value

Returns: the new Varnode object

◆ newIndirectCreation()

PcodeOp * Funcdata::newIndirectCreation	(	PcodeOp *	indeffect,
		const Address &	addr,
		int4	size,
		bool	possibleout
	)

Build a CPUI_INDIRECT op that indirectly creates a Varnode.

An indirectly created Varnode effectively has no data-flow before the INDIRECT op that defines it, and the value contained by the Varnode is not explicitly calculable. The new Varnode is allocated with a given storage range.

Parameters

indeffect	is the p-code causing the indirect effect
addr	is the starting address of the given storage range
size	is the number of bytes in the storage range
possibleout	is true if the output should be treated as a directwrite.

Returns: the new CPUI_INDIRECT op

◆ newIndirectOp()

PcodeOp * Funcdata::newIndirectOp	(	PcodeOp *	indeffect,
		const Address &	addr,
		int4	size,
		uint4	extraFlags
	)

Find a representative CPUI_RETURN op for this function.

Create a new CPUI_INDIRECT around a PcodeOp with an indirect effect.

Typically this is used to annotate data-flow, for the given storage range, passing through a CALL or STORE. An output Varnode is automatically created.

Parameters

indeffect	is the PcodeOp with the indirect effect
addr	is the starting address of the storage range to protect
size	is the number of bytes in the storage range
extraFlags	are extra boolean properties to put on the INDIRECT

Returns: the new CPUI_INDIRECT op

◆ newOp() [1/2]

PcodeOp * Funcdata::newOp	(	int4	inputs,
		const Address &	pc
	)

Parameters

inputs	is the number of operands the new op will have
pc	is the Address associated with the new op

Returns: the new PcodeOp

◆ newOp() [2/2]

PcodeOp * Funcdata::newOp	(	int4	inputs,
		const SeqNum &	sq
	)

Allocate a new PcodeOp with Address.

This method is typically used for cloning.

Parameters

inputs	is the number of operands the new op will have
sq	is the sequence number (Address and sub-index) of the new op

Returns: the new PcodeOp

◆ newOpBefore()

PcodeOp * Funcdata::newOpBefore	(	PcodeOp *	follow,
		OpCode	opc,
		Varnode *	in1,
		Varnode *	in2,
		Varnode *	in3 = `(Varnode *)0`
	)

Allocate a new PcodeOp with sequence number.

Create new PcodeOp with 2 or 3 given operands.

The new op will have a unique space output Varnode and will be inserted before the given follow op.

Parameters

follow	is the follow up to insert the new PcodeOp before
opc	is the op-code of the new PcodeOp
in1	is the first operand
in2	is the second operand
in3	is the optional third param

Returns: the new PcodeOp

◆ newSpacebasePtr()

Varnode * Funcdata::newSpacebasePtr ( AddrSpace * id )

Construct a new spacebase register for a given address space.

Given an address space, like stack, that is known to have a base register pointing to it, construct a Varnode representing that register.

Parameters

id	is the stack like address space

Returns: a newly allocated stack-pointer Varnode

◆ newUnique()

Varnode * Funcdata::newUnique	(	int4	s,
		Datatype *	ct = `(Datatype *)0`
	)

Create a new temporary Varnode.

A new temporary register storage location is allocated from the unique address space

Parameters

s	is the size of the Varnode in bytes
ct	is an optional data-type to associated with the Varnode

Returns: the newly allocated temporary Varnode

◆ newUniqueOut()

Varnode * Funcdata::newUniqueOut	(	int4	s,
		PcodeOp *	op
	)

Create a new temporary output Varnode.

Allocate a new register from the unique address space and create a new Varnode object representing it as an output to the given PcodeOp

Parameters

s	is the size of the new Varnode in bytes
op	is the given PcodeOp whose output is created

Returns: the new temporary register Varnode

◆ newVarnode() [1/2]

Varnode * Funcdata::newVarnode	(	int4	s,
		AddrSpace *	base,
		uintb	off
	)

Create a new Varnode given an address space and offset.

Parameters

s	is the size of the Varnode in bytes
base	is the address space of the Varnode
off	is the offset into the address space of the Varnode

Returns: the newly allocated Varnode

◆ newVarnode() [2/2]

Varnode * Funcdata::newVarnode	(	int4	s,
		const Address &	m,
		Datatype *	ct = `(Datatype *)0`
	)

Create a new unattached Varnode object.

Parameters

s	is the size of the new Varnode in bytes
m	is the storage Address of the Varnode
ct	is a data-type to associate with the Varnode

Returns: the newly allocated Varnode object

◆ newVarnodeCallSpecs()

Varnode * Funcdata::newVarnodeCallSpecs ( FuncCallSpecs * fc )

Create a call specification annotation Varnode.

A call specification (FuncCallSpecs) is encoded into an annotation Varnode. The Varnode is used specifically as an input to CPUI_CALL ops to speed up access to their associated call specification.

Parameters

fc	is the call specification to encode

Returns: the newly allocated annotation Varnode

◆ newVarnodeIop()

Varnode * Funcdata::newVarnodeIop ( PcodeOp * op )

Create a PcodeOp annotation Varnode.

Create a special annotation Varnode that holds a pointer reference to a specific PcodeOp. This is used specifically to let a CPUI_INDIRECT op refer to the PcodeOp it is holding an indirect effect for.

Parameters

op	is the PcodeOp to encode in the annotation

Returns: the newly allocated annotation Varnode

◆ newVarnodeOut()

Varnode * Funcdata::newVarnodeOut	(	int4	s,
		const Address &	m,
		PcodeOp *	op
	)

Create a new output Varnode.

Create a new Varnode which is already defined as output of a given PcodeOp. This if more efficient as it avoids the initial insertion of the free form of the Varnode into the tree, and queryProperties only needs to be called once.

Parameters

s	is the size of the new Varnode in bytes
m	is the storage Address of the Varnode
op	is the given PcodeOp whose output is created

Returns: the new Varnode object

◆ newVarnodeSpace()

Varnode * Funcdata::newVarnodeSpace ( AddrSpace * spc )

Create a constant Varnode referring to an address space.

A reference to a particular address space is encoded as a constant Varnode. These are used for LOAD and STORE p-code ops in particular.

Parameters

spc	is the address space to encode

Returns: the newly allocated constant Varnode

◆ nodeJoinCreateBlock()

BlockBasic * Funcdata::nodeJoinCreateBlock	(	BlockBasic *	block1,
		BlockBasic *	block2,
		BlockBasic *	exita,
		BlockBasic *	exitb,
		bool	fora_block1ishigh,
		bool	forb_block1ishigh,
		const Address &	addr
	)

Create a new basic block for holding a merged CBRANCH.

This is used by ConditionalJoin to do the low-level control-flow manipulation to merge identical conditional branches. Given basic blocks containing the two CBRANCH ops to merge, the new block gets one of the two out edges from each block, and the remaining out edges are changed to point into the new block.

Parameters

block1	is the basic block containing the first CBRANCH to merge
block2	is the basic block containing the second CBRANCH
exita	is the first common exit block for the CBRANCHs
exitb	is the second common exit block
fora_block1ishigh	designates which edge is moved for exita
forb_block1ishigh	designates which edge is moved for exitb
addr	is the Address associated with (1 of the) CBRANCH ops

Returns: the new basic block

◆ nodeSplit()

void Funcdata::nodeSplit	(	BlockBasic *	b,
		int4	inedge
	)

Split control-flow into a basic block, duplicating its p-code into a new block.

P-code is duplicated into another block, and control-flow is modified so that the new block takes over flow from one input edge to the original block.

Parameters

b	is the basic block to be duplicated and split
inedge	is the index of the input edge to move to the duplicate block

◆ numHeritagePasses()

int4 Funcdata::numHeritagePasses ( AddrSpace * spc )

inline

Get the number of heritage passes performed for the given address space.

Parameters

spc	is the address space

Returns: the number of passes performed

◆ onlyOpUse()

bool Funcdata::onlyOpUse	(	const Varnode *	invn,
		const PcodeOp *	opmatch,
		const ParamTrial &	trial
	)		const

Test if the given Varnode seems to only be used by a CALL.

Part of testing whether a Varnode makes sense as parameter passing storage is looking for different explicit uses.

Parameters

invn	is the given Varnode
opmatch	is the putative CALL op using the Varnode for parameter passing
trial	is the parameter trial object associated with the Varnode

Returns: true if the Varnode seems only to be used as parameter to opmatch

◆ opDestroy()

void Funcdata::opDestroy ( PcodeOp * op )

Remove given PcodeOp and destroy its Varnode operands.

All input and output Varnodes to the op are destroyed (their object resources freed), and the op is permanently moved to the dead list. To call this routine, make sure that either:

The op has no output
The op's output has no descendants
or all descendants of output are also going to be destroyed

Parameters

op	is the given PcodeOp

◆ opDestroyRaw()

void Funcdata::opDestroyRaw ( PcodeOp * op )

Remove the given raw PcodeOp.

This is a specialized routine for deleting an op during flow generation that has been replaced by something else. The op is expected to be dead with none of its inputs or outputs linked to anything else. Both the PcodeOp and all the input/output Varnodes are destroyed.

Parameters

op	is the given PcodeOp

◆ opInsert()

void Funcdata::opInsert	(	PcodeOp *	op,
		BlockBasic *	bl,
		list< PcodeOp * >::iterator	iter
	)

Insert the given PcodeOp at specific point in a basic block.

The PcodeOp is removed from the dead list and is inserted immediately before the specified iterator.

Parameters

op	is the given PcodeOp
bl	is the basic block being inserted into
iter	indicates exactly where the op is inserted

◆ opInsertAfter()

void Funcdata::opInsertAfter	(	PcodeOp *	op,
		PcodeOp *	prev
	)

Insert given PcodeOp after a specific op.

The given PcodeOp is inserted immediately after the prev op except:

MULTIEQUALS in a basic block all occur first
INDIRECTs occur immediately before their op
a branch op must be the very last op in a basic block

Parameters

op	is the given PcodeOp to insert
prev	is the op to insert after

◆ opInsertBefore()

void Funcdata::opInsertBefore	(	PcodeOp *	op,
		PcodeOp *	follow
	)

Insert given PcodeOp before a specific op.

The given PcodeOp is inserted immediately before the follow op except:

MULTIEQUALS in a basic block all occur first
INDIRECTs occur immediately before their op
a branch op must be the very last op in a basic block

Parameters

op	is the given PcodeOp to insert
follow	is the op to insert before

◆ opInsertBegin()

void Funcdata::opInsertBegin	(	PcodeOp *	op,
		BlockBasic *	bl
	)

Insert given PcodeOp at the beginning of a basic block.

The given PcodeOp is inserted as the first op in the basic block except:

MULTIEQUALS in a basic block all occur first
INDIRECTs occur immediately before their op
a branch op must be the very last op in a basic block

Parameters

op	is the given PcodeOp to insert
bl	is the basic block to insert into

◆ opInsertEnd()

void Funcdata::opInsertEnd	(	PcodeOp *	op,
		BlockBasic *	bl
	)

Insert given PcodeOp at the end of a basic block.

The given PcodeOp is inserted as the last op in the basic block except:

MULTIEQUALS in a basic block all occur first
INDIRECTs occur immediately before their op
a branch op must be the very last op in a basic block

Parameters

op	is the given PcodeOp to insert
bl	is the basic block to insert into

◆ opInsertInput()

void Funcdata::opInsertInput	(	PcodeOp *	op,
		Varnode *	vn,
		int4	slot
	)

Insert a new Varnode into the operand list for the given PcodeOp.

The given Varnode is set into the given operand slot. Any existing input Varnodes with slot indices equal to or greater than the specified slot are pushed into the next slot.

Parameters

op	is the given PcodeOp
vn	is the given Varnode to insert
slot	is the input index to insert at

◆ opMarkHalt()

void Funcdata::opMarkHalt	(	PcodeOp *	op,
		uint4	flag
	)

Mark given CPUI_RETURN op as a special halt.

Parameters

op	is the given CPUI_RETURN op
flag	is one of halt, badinstruction, unimplemented, noreturn, or missing.

◆ opRemoveInput()

void Funcdata::opRemoveInput	(	PcodeOp *	op,
		int4	slot
	)

Remove a specific input slot for the given PcodeOp.

The Varnode in the specified slot is unlinked from the op and the slot itself is removed. The slot index for any remaining input Varnodes coming after the specified slot is decreased by one.

Parameters

op	is the given PcodeOp
slot	is the index of the specified slot to remove

◆ opSetAllInput()

void Funcdata::opSetAllInput	(	PcodeOp *	op,
		const vector< Varnode * > &	vvec
	)

Set all input Varnodes for the given PcodeOp simultaneously.

All previously existing input Varnodes are unset. The input slots for the op are resized and then filled in from the specified array.

Parameters

op	is the given PcodeOp to set
vvec	is the specified array of new input Varnodes

◆ opSetInput()

void Funcdata::opSetInput	(	PcodeOp *	op,
		Varnode *	vn,
		int4	slot
	)

Set a specific input operand for the given PcodeOp.

Parameters

op	is the given PcodeOp
vn	is the operand Varnode to set
slot	is the input slot where the Varnode is placed

◆ opSetOpcode()

void Funcdata::opSetOpcode	(	PcodeOp *	op,
		OpCode	opc
	)

Set the op-code for a specific PcodeOp.

Parameters

op	is the given PcodeOp
opc	is the op-code to set

◆ opSetOutput()

void Funcdata::opSetOutput	(	PcodeOp *	op,
		Varnode *	vn
	)

Set a specific output Varnode for the given PcodeOp.

Parameters

op	is the specific PcodeOp
vn	is the output Varnode to set

◆ opStackLoad()

Varnode * Funcdata::opStackLoad	(	AddrSpace *	spc,
		uintb	off,
		uint4	sz,
		PcodeOp *	op,
		Varnode *	stackref,
		bool	insertafter
	)

Create a LOAD expression at an offset relative to a spacebase register for a given address space.

The spacebase register is looked up for the given address space, or an optional previously existing register Varnode can be provided. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point.

Parameters

spc	is the given address space
off	is the offset to calculate relative to the spacebase register
sz	is the size of the desire LOAD in bytes
op	is the insertion point PcodeOp
stackref	is the spacebase register Varnode (if available)
insertafter	is true if new ops are inserted after the insertion point

Returns: the unique space Varnode holding the result of the LOAD

◆ opStackStore()

PcodeOp * Funcdata::opStackStore	(	AddrSpace *	spc,
		uintb	off,
		PcodeOp *	op,
		bool	insertafter
	)

Create a STORE expression at an offset relative to a spacebase register for a given address space.

The spacebase register is looked up for the given address space. An insertion point op must be provided, and newly generated ops can come either before or after this insertion point. The Varnode value being stored must still be set on the returned PcodeOp.

Parameters

spc	is the given address space
off	is the offset to calculate relative to the spacebase register
op	is the insertion point PcodeOp
insertafter	is true if new ops are inserted after the insertion point

Returns: the STORE PcodeOp

◆ opSwapInput()

void Funcdata::opSwapInput	(	PcodeOp *	op,
		int4	slot1,
		int4	slot2
	)

Swap two input operands in the given PcodeOp.

This is convenience method that is more efficient than call opSetInput() twice.

Parameters

op	is the given PcodeOp
slot1	is the first input slot being switched
slot2	is the second input slot

◆ opUndoPtradd()

void Funcdata::opUndoPtradd	(	PcodeOp *	op,
		bool	finalize
	)

Convert a CPUI_PTRADD back into a CPUI_INT_ADD.

Convert the given CPUI_PTRADD into the equivalent CPUI_INT_ADD. This may involve inserting a CPUI_INT_MULT PcodeOp. If finalization is requested and a new PcodeOp is needed, the output Varnode is marked as implicit and has its data-type set

Parameters

op	is the given PTRADD
finalize	is true if finalization is needed for any new PcodeOp

◆ opUninsert()

void Funcdata::opUninsert ( PcodeOp * op )

Remove the given PcodeOp from its basic block.

The op is taken out of its basic block and put into the dead list. If the removal is permanent the input and output Varnodes should be unset.

Parameters

op	is the given PcodeOp

◆ opUnlink()

void Funcdata::opUnlink ( PcodeOp * op )

Unset inputs/output and remove given PcodeOP from its basic block.

The op is extricated from all its Varnode connections to the functions data-flow and removed from its basic block. This will not change block connections. The PcodeOp objects remains in the dead list.

Parameters

op	is the given PcodeOp

◆ opUnsetInput()

void Funcdata::opUnsetInput	(	PcodeOp *	op,
		int4	slot
	)

Clear an input operand slot for the given PcodeOp.

The input Varnode is unlinked from the op.

Parameters

op	is the given PcodeOp
slot	is the input slot to clear

◆ opUnsetOutput()

void Funcdata::opUnsetOutput ( PcodeOp * op )

Remove output Varnode from the given PcodeOp.

The output Varnode becomes free but is not immediately deleted.

Parameters

op	is the given PcodeOp

◆ overrideFlow()

void Funcdata::overrideFlow	(	const Address &	addr,
		uint4	type
	)

Override the control-flow p-code for a particular instruction.

P-code in this function is modified to change the control-flow of the instruction at the given address, based on the Override type.

Parameters

addr	is the given address of the instruction to modify
type	is the Override type

◆ printBlockTree()

void Funcdata::printBlockTree ( ostream & s ) const

Print a description of control-flow structuring to a stream.

A description of each block in the current structure hierarchy is printed to stream. This is suitable for a console mode or debug view of the state of control-flow structuring at any point during analysis.

Parameters

s	is the output stream

◆ printLocalRange()

void Funcdata::printLocalRange ( ostream & s ) const

Print description of memory ranges associated with local scopes.

Each scope has a set of memory ranges associated with it, encompassing storage locations of variables that are assumed to be in the scope. Each range for each local scope is printed.

Parameters

s	is the output stream

◆ printRaw()

void Funcdata::printRaw ( ostream & s ) const

Print raw p-code op descriptions to a stream.

A representation of all PcodeOps in the function body are printed to the stream. Depending on the state of analysis, PcodeOps are grouped into their basic blocks, and within a block, ops are displayed sequentially. Basic labeling of branch destinations is also printed. This is suitable for a console mode or debug view of the state of the function at any given point in its analysis.

Parameters

s	is the output stream

◆ printVarnodeTree()

void Funcdata::printVarnodeTree ( ostream & s ) const

Print a description of all Varnodes to a stream.

A description of each Varnode currently involved in the data-flow of this function is printed to the output stream. This is suitable as part of a console mode or debug view of the function at any point during its analysis

Parameters

s	is the output stream

◆ pushBranch()

void Funcdata::pushBranch	(	BlockBasic *	bb,
		int4	slot,
		BlockBasic *	bbnew
	)

Move a control-flow edge from one block to another.

This is intended for eliminating switch guard artifacts. The edge must be for a conditional jump and must be moved to a block hosting multiple out edges for a BRANCHIND.

Parameters

bb	is the basic block out of which the edge to move flows
slot	is the index of the (out) edge
bbnew	is the basic block where the edge should get moved to

◆ recoverJumpTable()

JumpTable * Funcdata::recoverJumpTable	(	PcodeOp *	op,
		FlowInfo *	flow,
		int4 &	failuremode
	)

Recover destinations for a BRANCHIND by analyzing nearby data and control-flow.

This is the high-level entry point for jump-table/switch recovery. In short, a copy of the current state of data-flow is made, simplification transformations are applied to the copy, and the resulting data-flow tree is examined to enumerate possible values of the input Varnode to the given BRANCHIND PcodeOp. This information is stored in a JumpTable object.

Parameters

op	is the given BRANCHIND PcodeOp
flow	is current flow information for this function
failuremode	will hold the final success/failure code (0=success)

Returns: the recovered JumpTable or NULL if there was no success

◆ remapDynamicVarnode()

void Funcdata::remapDynamicVarnode	(	Varnode *	vn,
		Symbol *	sym,
		const Address &	usepoint,
		uint8	hash
	)

Remap a Symbol to a given Varnode using a new dynamic mapping.

Any previous links between the Symbol, the Varnode, and the associate HighVariable are removed. Then a new dynamic link is created.

Parameters

vn	is the given Varnode
sym	is the Symbol the Varnode maps to
usepoint	is the code Address where the Varnode is defined
hash	is the hash for the new dynamic mapping

◆ remapVarnode()

void Funcdata::remapVarnode	(	Varnode *	vn,
		Symbol *	sym,
		const Address &	usepoint
	)

Remap a Symbol to a given Varnode using a static mapping.

Any previous links between the Symbol, the Varnode, and the associate HighVariable are removed. Then a new link is created.

Parameters

vn	is the given Varnode
sym	is the Symbol the Varnode maps to
usepoint	is the desired usepoint for the mapping

◆ removeBranch()

void Funcdata::removeBranch	(	BlockBasic *	bb,
		int4	num
	)

Remove the indicated branch from a basic block.

The edge is removed from control-flow and affected MULTIEQUAL ops are adjusted.

Parameters

bb	is the basic block
num	is the index of the out edge to remove

◆ removeDoNothingBlock()

void Funcdata::removeDoNothingBlock ( BlockBasic * bb )

Remove a basic block from control-flow that performs no operations.

The block must contain only marker operations (MULTIEQUAL) and possibly a single unconditional branch operation. The block and its PcodeOps are completely removed from the current control-flow and data-flow. This forces a reset of the control-flow structuring hierarchy.

Parameters

bb	is the given basic block

◆ removeFromFlowSplit()

void Funcdata::removeFromFlowSplit	(	BlockBasic *	bl,
		bool	swap
	)

Remove a basic block splitting its control-flow into two distinct paths.

This is used by ConditionalExecution to eliminate unnecessary control-flow joins. The given block must have 2 inputs and 2 outputs, (and no operations). The block is removed, and control-flow is adjusted so that In(0) flows to Out(0) and In(1) flows to Out(1), or vice versa.

Parameters

bl	is the given basic block
swap	is true to force In(0)->Out(1) and In(1)->Out(0)

◆ removeJumpTable()

void Funcdata::removeJumpTable ( JumpTable * jt )

Remove/delete the given jump-table.

The JumpTable object is freed, and the associated BRANCHIND is no longer marked as a switch point.

Parameters

jt	is the given JumpTable object

◆ removeUnreachableBlocks()

bool Funcdata::removeUnreachableBlocks	(	bool	issuewarning,
		bool	checkexistence
	)

Remove any unreachable basic blocks.

A quick check for unreachable blocks can optionally be made, otherwise the cached state is checked via hasUnreachableBlocks(), which is turned on during analysis by calling the structureReset() method.

Parameters

issuewarning	is true if warning comments are desired
checkexistence	is true to force an active search for unreachable blocks

Returns: true if unreachable blocks were actually found and removed

◆ replaceLessequal()

bool Funcdata::replaceLessequal ( PcodeOp * op )

Replace INT_LESSEQUAL and INT_SLESSEQUAL expressions.

Do in-place replacement of

c <= x with c-1 < x OR
x <= c with x < c+1

Parameters

op	is comparison PcodeOp

Returns: true if a valid replacement was performed

◆ replaceVolatile()

bool Funcdata::replaceVolatile ( Varnode * vn )

Replace accesses of the given Varnode with volatile operations.

The Varnode is assumed not fully linked. The read or write action is modeled by inserting a special user op that represents the action. The given Varnode is replaced by a temporary Varnode within the data-flow, and the original address becomes a parameter to the user op.

Parameters

vn	is the given Varnode to model as volatile

Returns: true if a change was made

◆ restoreXml()

uint8 Funcdata::restoreXml ( const Element * el )

Restore the state of this function from an XML description.

From an XML <function> tag, recover the name, address, prototype, symbol, jump-table, and override information for this function.

Parameters

el	is the root <function> tag

Returns: the symbol id associated with the function

◆ restoreXmlJumpTable()

void Funcdata::restoreXmlJumpTable ( const Element * el )

Restore jump-tables from an XML description.

This parses a <jumptablelist> tag and builds a JumpTable object for each <jumptable> sub-tag.

Parameters

el	is the root <jumptablelist> tag

◆ saveXml()

void Funcdata::saveXml	(	ostream &	s,
		uint8	id,
		bool	savetree
	)		const

Emit an XML description of this function to stream.

An XML description of this function is written to the stream, including name, address, prototype, symbol, jump-table, and override information. If indicated by the caller, a description of the entire PcodeOp and Varnode tree is also emitted.

Parameters

s	is the output stream
id	is the unique id associated with the function symbol
savetree	is true if the p-code tree should be emitted

◆ saveXmlHigh()

void Funcdata::saveXmlHigh ( ostream & s ) const

Save an XML description of all HighVariables to stream.

This produces a single <highlist> tag, with a <high> sub-tag for each high-level variable (HighVariable) currently associated with this function.

Parameters

s	is the output stream

◆ saveXmlJumpTable()

void Funcdata::saveXmlJumpTable ( ostream & s ) const

Emit an XML description of jump-tables to stream.

A <jumptablelist> tag is written with <jumptable> sub-tags describing each jump-table associated with the control-flow of this function.

Parameters

s	is the output stream

◆ saveXmlTree()

void Funcdata::saveXmlTree ( ostream & s ) const

Save an XML description of the p-code tree to stream.

A single <ast> tag is produced with children describing Varnodes, PcodeOps, and basic blocks making up this function's current syntax tree.

Parameters

s	is the output stream

◆ seenDeadcode()

void Funcdata::seenDeadcode ( AddrSpace * spc )

inline

Mark that dead Varnodes have been seen in a specific address space.

Parameters

spc	is the address space to mark

◆ setBasicBlockRange()

void Funcdata::setBasicBlockRange	(	BlockBasic *	bb,
		const Address &	beg,
		const Address &	end
	)

inline

Set the initial ownership range for the given basic block.

Parameters

bb	is the given basic block
beg	is the beginning Address of the owned code range
end	is the ending Address of the owned code range

◆ setDeadCodeDelay()

void Funcdata::setDeadCodeDelay	(	AddrSpace *	spc,
		int4	delay
	)

inline

Set a delay before removing dead code for a specific address space.

Parameters

spc	is the specific address space
delay	is the number of passes to delay

◆ setDoublePrecisRecovery()

void Funcdata::setDoublePrecisRecovery ( bool val )

inline

Toggle whether double precision analysis is used.

Parameters

val	is true if double precision analysis is enabled

◆ setInputVarnode()

Varnode * Funcdata::setInputVarnode ( Varnode * vn )

Mark a Varnode as an input to the function.

An input Varnode has a special designation within SSA form as not being defined by a p-code operation and is a formal input to the data-flow of the function. It is not necessarily a formal function parameter.

The given Varnode to be marked is also returned unless there is an input Varnode that already exists which overlaps the given Varnode. If the Varnodes have the same size and storage address, the preexisting input Varnode is returned instead. Otherwise an exception is thrown.

Parameters

vn	is the given Varnode to mark as an input

Returns: the marked Varnode

◆ setJumptableRecovery()

void Funcdata::setJumptableRecovery ( bool val )

inline

Toggle whether this is being used for jump-table recovery.

Parameters

val	is true to indicate a jump-table is being recovered

◆ setRestartPending()

void Funcdata::setRestartPending ( bool val )

inline

Toggle whether analysis needs to be restarted for this function.

Parameters

val	is true if a reset is required

◆ spacebase()

void Funcdata::spacebase ( void )

Mark registers that map to a virtual address space.

This routine searches for an marks Varnode objects, like stack-pointer registers, that are used as a base address for a virtual address space. Each Varnode gets a special data-type and is marked so that Varnode::isSpacebase() returns true.

◆ spacebaseConstant()

void Funcdata::spacebaseConstant	(	PcodeOp *	op,
		int4	slot,
		SymbolEntry *	entry,
		const Address &	rampoint,
		uintb	origval,
		int4	origsize
	)

Convert a constant pointer into a ram CPUI_PTRSUB.

A constant known to be a pointer into an address space like ram is converted into a Varnode defined by CPUI_PTRSUB, which triggers a Symbol lookup at points during analysis. The constant must point to a known Symbol.

The PTRSUB takes the constant 0 as its first input, which is marked as a spacebase to indicate this situation. The second input to PTRSUB becomes the offset to the Symbol within the address space. An additional INT_SUB may be inserted to get from the start of the Symbol to the address indicated by the original constant pointer.

Parameters

op	is the PcodeOp referencing the constant pointer
slot	is the input slot of the constant pointer
entry	is the Symbol being pointed (in)to
rampoint	is the constant pointer interpreted as an Address
origval	is the constant
origsize	is the size of the constant

◆ spliceBlockBasic()

void Funcdata::spliceBlockBasic ( BlockBasic * bl )

Merge the given basic block with the block it flows into.

The given block must have a single output block, which will be removed. The given block has the p-code from the output block concatenated to its own, and it inherits the output block's out edges.

Parameters

bl	is the given basic block

◆ startProcessing()

void Funcdata::startProcessing ( void )

Start processing for this function.

This routine does basic set-up for analyzing the function. In particular, it generates the raw p-code, builds basic blocks, and generates the call specification objects.

◆ switchEdge()

void Funcdata::switchEdge	(	FlowBlock *	inblock,
		BlockBasic *	outbefore,
		FlowBlock *	outafter
	)

Switch an outgoing edge from the given source block to flow into another block.

This does not adjust MULTIEQUAL data-flow.

Parameters

inblock	is the given source block
outbefore	is the other side of the desired edge
outafter	is the new destination block desired

◆ syncVarnodesWithSymbols()

bool Funcdata::syncVarnodesWithSymbols	(	const ScopeLocal *	lm,
		bool	typesyes
	)

Update Varnode properties based on (new) Symbol information.

Boolean properties addrtied, addrforce, and nolocalalias for Varnodes are updated based on new Symbol information they map to. The caller can elect to update data-type information as well, where Varnodes and their associated HighVariables have their data-type finalized based symbols.

Parameters

lm	is the Symbol scope within which to search for mapped Varnodes
typesyes	is true if the caller wants to update data-types

Returns: true if any Varnode was updated

◆ totalReplace()

void Funcdata::totalReplace	(	Varnode *	vn,
		Varnode *	newvn
	)

Replace all read references to the first Varnode with a second Varnode.

Parameters

vn	is the first Varnode (being replaced)
newvn	is the second Varnode (the replacement)

◆ totalReplaceConstant()

void Funcdata::totalReplaceConstant	(	Varnode *	vn,
		uintb	val
	)

Replace every read reference of the given Varnode with a constant value.

A new constant Varnode is created for each read site. If there are any marker ops (MULTIEQUAL) a single COPY op is inserted and the marker input is set to be the output of the COPY.

Parameters

vn	is the given Varnode
val	is the constant value to replace it with

◆ transferVarnodeProperties()

void Funcdata::transferVarnodeProperties	(	Varnode *	vn,
		Varnode *	newVn,
		int4	lsbOffset
	)

Copy properties from an existing Varnode to a new Varnode.

The new Varnode is assumed to overlap the storage of the existing Varnode. Properties like boolean flags and consume bits are copied as appropriate.

Parameters

vn	is the existing Varnode
newVn	is the new Varnode that has its properties set
lsbOffset	is the significance offset of the new Varnode within the exising

◆ truncatedFlow()

void Funcdata::truncatedFlow	(	const Funcdata *	fd,
		const FlowInfo *	flow
	)

Generate a clone with truncated control-flow given a partial function.

Existing p-code is cloned from another function whose flow has not been completely followed. Artificial halt operators are inserted wherever flow is incomplete and basic blocks are generated.

Parameters

fd	is the partial function to clone
flow	is partial function's flow information

◆ warning()

void Funcdata::warning	(	const string &	txt,
		const Address &	ad
	)		const

Add a warning comment in the function body.

The comment is added to the global database, indexed via its placement address and the entry address of the function. The emitter will attempt to place the comment before the source expression that maps most closely to the address.

Parameters

txt	is the string body of the comment
ad	is the placement address

◆ warningHeader()

void Funcdata::warningHeader ( const string & txt ) const

Add a warning comment as part of the function header.

The warning will be emitted as part of the block comment printed right before the prototype. The comment is stored in the global comment database, indexed via the function's entry address.

Parameters

txt	is the string body of the comment

The documentation for this class was generated from the following files:

funcdata.hh
funcdata.cc
funcdata_block.cc
funcdata_op.cc
funcdata_varnode.cc

Public Member Functions

Static Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ Funcdata()

Member Function Documentation

◆ adjustInputVarnodes()

◆ ancestorOpUse()

◆ attemptDynamicMapping()

◆ attemptDynamicMappingLate()

◆ buildDynamicSymbol()

◆ calcNZMask()

◆ checkCallDoubleUse()

◆ checkForLanedRegister()

◆ clearDeadVarnodes()

◆ clearSymbolLinks()

◆ cloneOp()

◆ collapseIntMultMult()

◆ compareCallspecs()

◆ createStackRef()

◆ deadRemovalAllowed()

◆ deadRemovalAllowedSeen()

◆ distributeIntMultAdd()

◆ doLiveInject()

◆ fillinExtrapop()

◆ fillinReadOnly()

◆ findCoveredInput()

◆ findCoveringInput()

◆ findDisjointCover()

◆ findHigh()

◆ findJumpTable()

◆ findLinkedVarnode()

◆ findLinkedVarnodes()

◆ findSpacebaseInput()

◆ findVarnodeInput()

◆ findVarnodeWritten()

◆ followFlow()

◆ forceGoto()

◆ getFirstReturnOp()

◆ hasRestartPending()

◆ hasUnimplemented()

◆ initActiveOutput()

◆ inlineFlow()

◆ installJumpTable()

◆ isHeritaged()

◆ linkJumpTable()

◆ linkSymbol()

◆ linkSymbolReference()

◆ mapGlobals()

◆ markIndirectCreation()

◆ markIndirectOnly()

◆ moveRespectingCover()

◆ newCodeRef()

◆ newConstant()

◆ newIndirectCreation()

◆ newIndirectOp()

◆ newOp() [1/2]

◆ newOp() [2/2]

◆ newOpBefore()

◆ newSpacebasePtr()

◆ newUnique()

◆ newUniqueOut()

◆ newVarnode() [1/2]

◆ newVarnode() [2/2]

◆ newVarnodeCallSpecs()

◆ newVarnodeIop()

◆ newVarnodeOut()

◆ newVarnodeSpace()

◆ nodeJoinCreateBlock()

◆ nodeSplit()

◆ numHeritagePasses()

◆ onlyOpUse()

◆ opDestroy()

◆ opDestroyRaw()

◆ opInsert()

◆ opInsertAfter()

◆ opInsertBefore()

◆ opInsertBegin()

◆ opInsertEnd()

◆ opInsertInput()