* Add a new helper to convert a `long double` to an 80-bit RzIL float
* New function: `rz_il_op_new_float_from_f80`
* New opbuilder: `F80`
* Add test for `rz_il_op_new_float_from_f80`
* Also add a float format check in `rz_il_sort_pure_eq`
* Add a few `includes` so that some types are visible
* Fix reachable endless loop.
If rz_il_evaluate_effect() fails to execute it returns false and expects
that the execution is terminated.
Because res was never checked for false, repeat kept going endlessly
in such a case.
* Add unit test for endless loop in case of malformed effect.
* switch from RzList to RzPvector
* Removed the commented line of code
* Removed tab to support clang format
* Added space after foreach statement to support clang format
* Fix memleak in rz_il_handler_empty()
* Fix memleak in compare_op()
* Fix memleak in assign_reg()
* Fix memleak in rz_asm_op_fini()
* Fix memleak in rz_core_analysis_bytes()
* Fix memleak in add_sub_op()
* Fix memleak in bitwise_op()
* Fix memleak in shift_and_rotate()
* Fbasic dev build test
* Add fbasic structure and enums
* Add fbasic op new
* Add fbasic op dup
* Add fbasic op free
* Add partial theory of float
* Add fbasic handlers to pure table default
* Add fbasic stringfy
* Add temporary float functions
* Add rz-float value and evaluation
* Add float json dump functions, todo add mode info in il_opdmp_* functions and compelete il_resolve_pure
* Complete fbasic il in il_export
* Fix detected error in compilation
* Add doxygen for il/definition/float
* Pack float_round function
* Add new version of rounding
* Add cast and convert, todo add 'float_get_sign' and 'float_get_no_bias_exp'
* Add comments and fix new version rounding
* Add util float functions
* Implement theory fbasic : cast, convert and round
* Remove bv_one warning
* Move basic functions into rz_util from definition/float
* Add two basic test cmp and extra format test
* Add test to fsucc, fpred and fneg
* Add round significant test case 1 and fix bug to pass it
* Test round significant and bug fixes
* Add 6 types test cases to round_and_pack function
* Finish round significant and round_pack test with bug fixes and signature changes
* Leave fround as unimplement now
* Pass all test to cast and convert
* Add SPDX header
* Add SPDX header
* Add round to integral float with test and bug fixes
* Add more tests to cast_sint and bug fixes
* Fix mem leak in cast_sfloat
* Replace the deprecated rounding method, fix bugs and pass tests
* Resolve some reviewed issues
* Fix most memleak and bug found
* Remove deprecated round_bv
* Remove unused functions to eliminate warnings
* Fix typo in comments
* Uncommented implmented operations
* Add test cases and bug fixes for fbasic theory in rzil
* Fix ret type of new_bitv_from_* from Bool to BitVector
* Add new float op from f32 and f64
Duplicated code for pkg-config and cmake configuration is avoided by
letting every rizin module register itself in a global dictionary
called "modules" which is then iterated in one place to perform any
shared logic, inspired by how qemu handles multiple targets in its meson
build system.
This is an almost pure refactor, so the resulting .pc/.cmake files
should be identical with the following exceptions:
- rz_reg.pc does not have plugindir anymore as rz_reg has no plugins.
- Some other modules have their dependencies in .pc files altered to be
consistent with cmake.
* Print a warning if config for VM was NULL.
* Add warning if register is not added to VM due to overlap.
* Update PPC register profile.
* Add vector and float registers. As well as some control and system registers.
* Enable to write values 4bit registers.
* PPC: Uplift most common instructions.
* Print warning if reserved SPR instruction is encountered.
* Update PC/LR addresses and add ca32 writes.
* Write cache needs to get flushed so load and store tests don't share the same memory.
* Add missing T/F branch mnemonics.
* Add Move to/from CR/CR0-7
* Fix TA address calculation for branch instructions.
* Add branch tests for branch mnemonics.
* Add XNOP
* NOP cache touch instructions.
* Add undocumented ATTN instruction to the not_implemented group.
* Add isel instruction.
* Implement CRCLR, CRSET, CROR.
* Add CNTLZ instructions.
* Add mcrf instructions.
* Add inacive test for cmpb.
* Add Load bytes reverse instructions.
* Add test and add address alignment to dcbz.
* Add eqv test
* Correct DIV and MUL operations
* Add div tests.
* Add tests and correct MT/MFXER
* Remove register ca32, ov32
* Remove explici setting of cr register because QEMU does not do it. Otherwise we get a mismatch in the trace
* Simplify carry set for add and sub. Sub instructions are exclusivly defined with addition. Hence no sub case needed.
* Unify BD and fix branch instructions. Fix: Check the single bit not the cr reg
* Document Conditional branches and replace NOPs with EMPTY
* Add mulli instruction to double word instructions.
* Fix ca set for shift instructions:
* ca value had to be determined before the shift happened. The wrong ca value was calculated if the src and target reg were the same.
* Replace NOP wit EMPTY.
* Use MSB isntead of SLT.
* Brought fixup of ADD and SUB instructions: The add and sub instructions had several issues which let to incorrect execution.
* The carry was incorrectly if three add operations happened (only the last add were checked, not both).
* The carry was incorrectly set if the src and target register matched.
* Same applies for the CR bit.
* It was too complex. Several local variables were introduced for this.
* Set result in local var, since it would change if src and target reg are the same.
* Remove MTMSR and MFMSR since it is too complex and untestable currently.
* Use unsigned int for shift. Otherwise the 0x1c shift produces a runtime error since 0xf is int as default.
* Fix mtxer: Only write flag bits.
* Let NOT_IMPLEMENTED macro return NULL.
* Mark st[wd]cx and l[wd]cx as not implemented.
* Increase dcache_line_size to 128 bytes.
* Fix cntlz for ppc32. m was set incorrectly, since it is 0 not 32 for 32bit cpus.
* Fix isel: Use op.crx reg instead of imm.
* Unify helper function names: Prependnig `ppc_` mark as IPI
* Add more "Move to SPR" cases.
* MULLI opeartes only on double word on 64bit CPUs.
* Most registers are now assigned the control register type and no longer show up in the ar command.
* Fix xor if dest and src registers match by saving result in local var.
* Fix BE/LE issue for Load BRX instructions.
* Fix shifts: Use only lower 6bits of n.
* User Pure local variables for ROT macros.
* Fix rldimi instructions.
* n was not inverted.
* more than 6 bits of n could be used
* Add 32bit emulateme tests.
* Add 64bit emulateme tests.
* Determine lg(v) in inline function.
* Calculate CR bit in C not in the VM.
* Check if `~mask = 0` and skip mask calculation if yes.
* Check for `sh == 0` and skip rotations where possible.
* Remove `la` instruction. `la` is a mnemonic for `addi`.
* Remove SPR instructions which are not supported by QEMU or not traced yet. For most set/read SPR instructions QEMU segfaults.
In case of SPR 1 (xer), 8 (lr) and 9 (ctr) the assembler resolves them to their mnemonics (mtxer, mtlr etc.). This means the code here is never reached.
To test the get_xer code MFXER was added again. The rz-tracetests will fail for this instructions (due to missing ca32, ov32). But this case is covert in an issue.
* Removed nullability where not needed
* Made events take RzILVal instead of force-converting to RzILBitVector
for variables
* Added more fine-grained tests for events from specific ops
RzAnalysisILVM wraps around the low-level RzILVM and enables emulation
of real code from disassembly, rather than raw IL.
Analysis plugins now don't actively initialize the vm anymore, but
return a fully declarative description RzAnalysisILConfig of how to set
up the vm and optionally its initial state.
This also enables multiple IL vms to exist at the same time as plugins
can not mess with the global vm anymore. See the added integration test
for an example.
This adds RzIL lifting for all legal 6502 ops, except the special bcd
modes of adc and sbc for now. The lifting of every one of these ops is
covered by an asm test, making sure all IL is valid. Some manual
execution tests are available too, including one that runs a simple
real-world xor-"decryption" loop.
The lifting has not been tested against traces yet, so minor mistakes in
the semantics are currently expected.
Because there is currently no reason to have non-ctrl effects after a ctrl
effect (because then we have already jumped somewhere else), we reject this
kind of code altogether.
This leaves future semantics of such code open without breaking any
existing IL, in case it will be needed at some point.
Previously, after a (jmp x) with opsize y, the jump target would
actually be x + y because the addition happened after the evaluation.
Now we actually jump to the target specified by the op.
Before:
store(key:var(v:ptr), value:add(x:load(key:var(v:ptr), mem:0),
y:int(value:1, length:8)), mem:0)
After:
(store 0 (var ptr) (+ (load 0 (var ptr)) (bv 8 0x1)))
S-Expressions like this are more concise and will be trivial to parse,
in case we want a parser for this later. It is also very similar to what
BAP uses, so it will be easier to compare.
This adds the IL validator, which performs static type-checking of both
pure and effect ops among other checks. In particular, assuming the
validator is correctly implemented, if it considers an op to be valid
under some context, evaluating the op in the vm will never yield a
runtime error, that is, an error where the vm itself errors, not an
expected error state of the code being executed. In our case, this
includes for example:
* Any kind of type error: Conditions not being bool, bitvector sizes not
matching, ...
* Variables not being available when they are accessed Using local
* variables with multiple different types in a single effect etc.
Any code that we lift must obey these rules. Thus, any analysis can rely
on it. The plan for this is to use the validator primarily in testing,
development of lifters and for IL code coming from the outside. If our
lifting code is covered well enough by tests using the validator, we can
omit the validation at runtime.
The only ops that do not have well-defined validation yet are blk and
goto since their semantics, in particular regarding label handling are
still a bit vague. This also removes the concat and unk ops since they
are unimplemented and not needed.
There are now three kinds of vars: global, local and local pure. Global
and local pure are exactly like in BAP, local ones are defined by their
initial set op and have the scope of a single lifted instruction.
The set op now handles both global and local vars, let is now pure and
binds only inside its body. Vars have static types, global and local are
always mutable, local pure naturally immutable.
The var op specifies the kind of variable to take from, and the
individual variable sets are separate. This corresponds to BAP's
behavior where the kind of variable is part of the identifier.
Variable content storage has also been rewritten and RzILBag removed.
Plugins do not create register-based variables themselves anymore, but
they are derived from the register profile. However not all registers
may be bound and not all variables may be actual registers. The concrete
relations between an RzILVM and registers is described by an
RzILRegBinding object. It is simply a list of register names and
variables are created of the same names. When stepping with aezs, the
registers are synchronized automatically. From now on, aezv is primarily
useful for debugging, but interacting with emulation from the user side
should be done with ar.
rzil should be either rz_il when prefixed for Rizin API, or just il
whenever it's used in some local identifier/name.
In addition, the unclear notion of "vm_layer" has been removed. The VM
source files are split into management and evaluation instead.
