Ghidra Decompiler Analysis Engine
Public Member Functions | Protected Attributes | List of all members
JumpModel Class Referenceabstract

A jump-table execution model. More...

#include <jumptable.hh>

Inheritance diagram for JumpModel:
Inheritance graph
[legend]
Collaboration diagram for JumpModel:
Collaboration graph
[legend]

Public Member Functions

virtual bool isOverride (void) const =0
 Return true if this model was manually overridden.
 
virtual int4 getTableSize (void) const =0
 Return the number of entries in the address table.
 
virtual bool recoverModel (Funcdata *fd, PcodeOp *indop, uint4 matchsize, uint4 maxtablesize)=0
 Attempt to recover details of the model, given a specific BRANCHIND. More...
 
virtual void buildAddresses (Funcdata *fd, PcodeOp *indop, vector< Address > &addresstable, vector< LoadTable > *loadpoints) const =0
 Construct the explicit list of target addresses (the Address Table) from this model. More...
 
virtual void findUnnormalized (uint4 maxaddsub, uint4 maxleftright, uint4 maxext)=0
 Recover the unnormalized switch variable. More...
 
virtual void buildLabels (Funcdata *fd, vector< Address > &addresstable, vector< uintb > &label, const JumpModel *orig) const =0
 Recover case labels associated with the Address table. More...
 
virtual VarnodefoldInNormalization (Funcdata *fd, PcodeOp *indop)=0
 Do normalization of the given switch specific to this model. More...
 
virtual bool foldInGuards (Funcdata *fd, JumpTable *jump)=0
 Eliminate any guard code involved in computing the switch destination. More...
 
virtual bool sanityCheck (Funcdata *fd, PcodeOp *indop, vector< Address > &addresstable)=0
 Perform a sanity check on recovered addresses. More...
 
virtual JumpModelclone (JumpTable *jt) const =0
 Clone this model.
 

Protected Attributes

JumpTablejumptable
 The jump-table that is building this model.
 

Detailed Description

A jump-table execution model.

This class holds details of the model and recovers these details in various stages. The model concepts include:

Member Function Documentation

◆ buildAddresses()

virtual void JumpModel::buildAddresses ( Funcdata fd,
PcodeOp indop,
vector< Address > &  addresstable,
vector< LoadTable > *  loadpoints 
) const
pure virtual

Construct the explicit list of target addresses (the Address Table) from this model.

The addresses produced all come from the BRANCHIND and may not be deduped. Alternate guard destinations are not yet included.

Parameters
fdis the function containing the switch
indopis the root BRANCHIND of the switch
addresstablewill hold the list of Addresses
loadpointsif non-null will hold LOAD table information used by the model

Implemented in JumpAssisted, JumpBasicOverride, JumpBasic, and JumpModelTrivial.

◆ buildLabels()

virtual void JumpModel::buildLabels ( Funcdata fd,
vector< Address > &  addresstable,
vector< uintb > &  label,
const JumpModel orig 
) const
pure virtual

Recover case labels associated with the Address table.

The unnormalized switch variable must already be recovered. Values that the normalized switch value can hold or walked back to obtain the value that the unnormalized switch variable would hold. Labels are returned in the order provided by normalized switch variable iterator JumpValues.

Parameters
fdis the function containing the switch
addresstableis the address table (used to label code blocks with bad or missing labels)
labelwill hold recovered labels in JumpValues order
origis the JumpModel to use for the JumpValues iterator

Implemented in JumpAssisted, JumpBasicOverride, JumpBasic, and JumpModelTrivial.

◆ findUnnormalized()

virtual void JumpModel::findUnnormalized ( uint4  maxaddsub,
uint4  maxleftright,
uint4  maxext 
)
pure virtual

Recover the unnormalized switch variable.

The normalized switch variable must already be recovered. The amount of normalization between the two switch variables can be restricted.

Parameters
maxaddsubis a restriction on arithmetic operations
maxleftrightis a restriction on shift operations
maxextis a restriction on extension operations

Implemented in JumpAssisted, JumpBasic2, JumpBasic, and JumpModelTrivial.

◆ foldInGuards()

virtual bool JumpModel::foldInGuards ( Funcdata fd,
JumpTable jump 
)
pure virtual

Eliminate any guard code involved in computing the switch destination.

We now think of the BRANCHIND as encompassing any guard function.

Parameters
fdis the function containing the switch
jumpis the JumpTable owning this model.

Implemented in JumpAssisted, JumpBasicOverride, JumpBasic, and JumpModelTrivial.

◆ foldInNormalization()

virtual Varnode* JumpModel::foldInNormalization ( Funcdata fd,
PcodeOp indop 
)
pure virtual

Do normalization of the given switch specific to this model.

The PcodeOp machinery is removed so it looks like the CPUI_BRANCHIND simply takes the switch variable as an input Varnode and automatically interprets its values to reach the correct destination.

Parameters
fdis the function containing the switch
indopis the given switch as a CPUI_BRANCHIND
Returns
the Varnode holding the final unnormalized switch variable

Implemented in JumpAssisted, JumpBasic, and JumpModelTrivial.

◆ recoverModel()

virtual bool JumpModel::recoverModel ( Funcdata fd,
PcodeOp indop,
uint4  matchsize,
uint4  maxtablesize 
)
pure virtual

Attempt to recover details of the model, given a specific BRANCHIND.

This generally recovers the normalized switch variable and any guards.

Parameters
fdis the function containing the switch
indopis the given BRANCHIND
matchsizeis the expected number of address table entries to recover, or 0 for no expectation
maxtablesizeis maximum number of address table entries to allow in the model
Returns
true if details of the model were successfully recovered

Implemented in JumpAssisted, JumpBasicOverride, JumpBasic2, JumpBasic, and JumpModelTrivial.

◆ sanityCheck()

virtual bool JumpModel::sanityCheck ( Funcdata fd,
PcodeOp indop,
vector< Address > &  addresstable 
)
pure virtual

Perform a sanity check on recovered addresses.

Individual addresses are checked against the function or its program to determine if they are reasonable. This method can optionally remove addresses from the table. If it does so, the underlying model is changed to reflect the removal.

Parameters
fdis the function containing the switch
indopis the root BRANCHIND of the switch
addresstableis the list of recovered Addresses, which may be modified
Returns
true if there are (at least some) reasonable addresses in the table

Implemented in JumpAssisted, JumpBasicOverride, JumpBasic, and JumpModelTrivial.


The documentation for this class was generated from the following file: