Ghidra Decompiler Analysis Engine
Public Member Functions | Public Attributes | List of all members
IfaceDecompData Class Reference

Common data shared by decompiler commands. More...

#include <ifacedecomp.hh>

Inheritance diagram for IfaceDecompData:
Inheritance graph
[legend]
Collaboration diagram for IfaceDecompData:
Collaboration graph
[legend]

Public Member Functions

void storePrototypePieces (Funcdata *fd_in, PrototypePieces pp_in)
 
PrototypePieces findPrototypePieces (Funcdata *fd_in)
 
 IfaceDecompData (void)
 Constructor.
 
void allocateCallGraph (void)
 Allocate the call-graph object.
 
void abortFunction (ostream &s)
 Clear references to current function. More...
 
void clearArchitecture (void)
 Free all resources for the current architecture/program.
 
void followFlow (ostream &s, int4 size)
 Generate raw p-code for the current function. More...
 
VarnodereadVarnode (istream &s)
 Read a varnode from the given stream. More...
 

Public Attributes

Funcdatafd
 Current function active in the console.
 
Architectureconf
 Current architecture/program active in the console.
 
CallGraphcgraph
 Call-graph information for the program.
 
map< Funcdata *, PrototypePiecesprototypePieces
 

Detailed Description

Common data shared by decompiler commands.

Member Function Documentation

◆ abortFunction()

void IfaceDecompData::abortFunction ( ostream &  s)

Clear references to current function.

This is called if a command throws a low-level error. It clears any analysis on the function, sets the current function to null, and issues a warning.

Parameters
sis the stream to write the warning to

◆ followFlow()

void IfaceDecompData::followFlow ( ostream &  s,
int4  size 
)

Generate raw p-code for the current function.

Follow flow from the entry point of the function and generate the raw p-code ops for all instructions, up to return instructions. If a size in bytes is provided, it bounds the memory region where flow can be followed. Otherwise, a zero size allows unbounded flow tracing.

Parameters
sis a output stream for reporting function details or errors
size(if non-zero) is the maximum number of bytes to disassemble

◆ readVarnode()

Varnode * IfaceDecompData::readVarnode ( istream &  s)

Read a varnode from the given stream.

The Varnode is selected from the current function. It is specified as a storage location with info about its defining p-code in parantheses.

  • EAX(r0x10000:0x65)
  • ECX(i)
  • r0x10001000:4(:0x96)
  • u0x00001100:1(:0x102)
  • #0x1(0x10205:0x27)

The storage address space is given as the short-cut character followed by the address offset. For register spaces, the name of the register can be given instead of the offset. After the offset, a size can be specified with a ':' followed by the size in bytes. If size is not provided and there is no register name, a default word size is assigned based on the address space.

The defining p-code op is specified either as:

  • An address and sequence number: EAX(r0x10000:0x65)
  • Just a sequence number: EAX(:0x65) or
  • An "i" token for inputs: EAX(i)

For a constant Varnode, the storage offset is the actual value of the constant, and the p-code address and sequence number must both be present and specify the p-code op that reads the constant.

Parameters
sis the given input stream
Returns
the Varnode object

The documentation for this class was generated from the following files: