portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rizin/librz/core/analysis_tp.c
Khairul Azhar Kasmiran 4897885c5c
Uniquify function flag realnames (#6601)
2026-07-05 22:33:25 +08:00

1019 lines
34 KiB
C
Raw Blame History

// SPDX-FileCopyrightText: 2016-2020 oddcoder <ahmedsoliman@oddcoder.com>
// SPDX-FileCopyrightText: 2016-2020 sivaramaaa <sivaramaaa@gmail.com>
// SPDX-License-Identifier: LGPL-3.0-only
/* type matching - type propagation */
#include <rz_analysis.h>
#include <rz_util.h>
#include <rz_util/ht_uu.h>
#include <rz_core.h>
#define LOOP_MAX 10
// from canalysis.c (core_private.h isn't included: it clashes with the local bb_cmpaddr)
RZ_IPI void rz_core_add_string_ref(RzCore *core, ut64 xref_from, ut64 xref_to);
static bool analysis_emul_init(RzCore *core, RzConfigHold *hc, RzDebugTrace **dt, RzAnalysisEsilTrace **et, RzAnalysisILTrace **rt) {
RzReg *rreg = rz_analysis_get_reg(core->analysis);
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
if (!esil) {
return false;
}
*dt = core->dbg->trace;
*et = esil->trace;
core->dbg->trace = rz_debug_trace_new();
esil->trace = rz_analysis_esil_trace_new(esil);
rz_config_hold_var(hc, "esil.romem", "dbg.trace",
"esil.nonull", "dbg.follow", NULL);
rz_config_set(core->config, "esil.romem", "true");
rz_config_set(core->config, "dbg.trace", "true");
rz_config_set(core->config, "esil.nonull", "true");
rz_config_set_i(core->config, "dbg.follow", false);
const char *bp = rz_reg_get_name(rreg, RZ_REG_NAME_BP);
const char *sp = rz_reg_get_name(rreg, RZ_REG_NAME_SP);
if ((bp && !rz_reg_getv(rreg, bp)) && (sp && !rz_reg_getv(rreg, sp))) {
RZ_LOG_ERROR("core: stack isn't initialized.\n");
RZ_LOG_ERROR("core: try running aei and aeim commands before aft for default stack initialization\n");
return false;
}
return (core->dbg->trace && esil->trace);
}
static void analysis_emul_restore(RzCore *core, RzConfigHold *hc, RzDebugTrace *dt, RzAnalysisEsilTrace *et, RzAnalysisILTrace *rt) {
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
rz_config_hold_restore(hc);
rz_config_hold_free(hc);
rz_debug_trace_free(core->dbg->trace);
rz_analysis_esil_trace_free(esil->trace);
esil->trace = et;
core->dbg->trace = dt;
}
static bool type_pos_hit(RzAnalysis *analysis, RzILTraceInstruction *instr_trace, bool in_stack, int size, const char *place) {
if (in_stack) {
RzReg *rreg = rz_analysis_get_reg(analysis);
const char *sp_name = rz_reg_get_name(rreg, RZ_REG_NAME_SP);
ut64 sp = rz_reg_getv(rreg, sp_name);
ut64 write_addr = 0LL;
if (instr_trace && (instr_trace->stats & RZ_IL_TRACE_INS_HAS_MEM_W)) {
// TODO : This assumes an op will only write to memory once
// : which may be wrong in some archs. this is only a temporary solution
RzILTraceMemOp *mem = rz_pvector_at(instr_trace->write_mem_ops, 0);
write_addr = mem->addr;
} else {
// no reg write
write_addr = 0LL;
}
return (write_addr == sp + size);
}
return rz_analysis_il_reg_trace_contains(instr_trace, place, true);
}
static void var_rename(RzAnalysis *analysis, RzAnalysisVar *v, const char *name, ut64 addr) {
if (!name || !v) {
return;
}
if (!*name || !strcmp(name, "...")) {
return;
}
bool is_default = (rz_str_startswith(v->name, VARPREFIX) || rz_str_startswith(v->name, ARGPREFIX));
if (*name == '*') {
rz_warn_if_reached();
name++;
}
// longer name tends to be meaningful like "src" instead of "s1"
if (!is_default && (strlen(v->name) > strlen(name))) {
return;
}
RzAnalysisFunction *fcn = rz_analysis_get_fcn_in(analysis, addr, 0);
if (!fcn) {
return;
}
rz_analysis_var_rename(v, name, false);
}
static void var_type_set_sign(RzAnalysis *analysis, RzAnalysisVar *var, bool sign) {
rz_return_if_fail(analysis && var);
RzTypeDB *typedb = rz_analysis_get_type_db(analysis);
// Check if it's integral number first
if (rz_type_is_integral(typedb, var->type)) {
rz_type_integral_set_sign(typedb, &var->type, sign);
}
}
static bool var_type_simple_to_complex(const RzTypeDB *typedb, RzType *a, RzType *b) {
// `*int*` types to anything else of the typeclass
if (rz_type_is_integral(typedb, a) && !rz_type_is_char_ptr_nested(a) && !rz_type_is_integral(typedb, b)) {
return true;
}
// `*int*` types to pointers or arrays
if (rz_type_is_integral(typedb, a) && !rz_type_is_char_ptr_nested(a) && b->kind != RZ_TYPE_KIND_IDENTIFIER) {
return true;
}
return false;
}
// TODO: Handle also non-atomic types here
static void var_type_set(RzAnalysis *analysis, RzAnalysisVar *var, RZ_BORROW RzType *type, bool ref, bool resolve_overlaps) {
rz_return_if_fail(analysis && var && type);
RzTypeDB *typedb = rz_analysis_get_type_db(analysis);
// removing this return makes 64bit vars become 32bit
if (rz_type_is_default(typedb, type) || rz_type_atomic_is_void(typedb, type)) {
// default or void (not void* !) type
return;
}
if (!rz_type_is_default(typedb, var->type) && !rz_type_is_void_ptr(var->type) && !var_type_simple_to_complex(typedb, var->type, type)) {
// return since type is already propagated
// except for "void *", since "void *" => "char *" is possible
// except for simple types to the more complex types
return;
}
// Since the type could be used by something else we should clone it
RzType *cloned = rz_type_clone(type);
if (!cloned) {
RZ_LOG_ERROR("core: cannot clone the type for the variable \"%s.%s\"\n", var->fcn->name, var->name);
return;
}
// Make a pointer of the existing type
if (ref) {
// By default we create non-const pointers
RzType *ptrtype = rz_type_pointer_of_type(typedb, cloned, false);
if (!ptrtype) {
RZ_LOG_ERROR("core: cannot convert the type for the variable \"%s.%s\" into pointer\n", var->fcn->name, var->name);
return;
}
rz_analysis_var_set_type(var, ptrtype, resolve_overlaps);
return;
}
rz_analysis_var_set_type(var, cloned, resolve_overlaps);
}
static void var_type_set_resolve_overlaps(RzAnalysis *analysis, RzAnalysisVar *var, RZ_BORROW RzType *type, bool ref) {
var_type_set(analysis, var, type, ref, true);
}
static void vars_resolve_overlaps(RzPVector /*<RzAnalysisVar *>*/ *vars) {
for (size_t i = 0; i < rz_pvector_len(vars); i++) {
RzAnalysisVar *var = rz_pvector_at(vars, i);
rz_analysis_var_resolve_overlaps(var);
}
}
static void var_type_set_str(RzAnalysis *analysis, RzAnalysisVar *var, const char *type, bool ref) {
rz_return_if_fail(analysis && var && type);
char *error_msg = NULL;
RzTypeDB *typedb = rz_analysis_get_type_db(analysis);
RzType *realtype = rz_type_parse_string_single(typedb->parser, type, &error_msg);
if (!realtype && error_msg) {
RZ_LOG_ERROR("core: fail to parse type \"%s\":\n%s\n", type, error_msg);
free(error_msg);
return;
}
var_type_set_resolve_overlaps(analysis, var, realtype, ref);
// Since we clone the type here, free it
rz_type_free(realtype);
}
static void get_src_regname(RzCore *core, ut64 addr, char *regname, int size) {
RzAnalysis *analysis = core->analysis;
RzReg *rreg = rz_analysis_get_reg(analysis);
int bits = rz_analysis_get_bits(analysis);
RzAnalysisOp *op = rz_core_analysis_op(core, addr, RZ_ANALYSIS_OP_MASK_VAL | RZ_ANALYSIS_OP_MASK_ESIL);
if (!op || rz_strbuf_is_empty(&op->esil)) {
rz_analysis_op_free(op);
return;
}
char *op_esil = rz_str_dup(rz_strbuf_get(&op->esil));
char *tmp = strchr(op_esil, ',');
if (tmp) {
*tmp = '\0';
}
memset(regname, 0, size);
RzRegItem *ri = rz_reg_get(rreg, op_esil, -1);
if (ri) {
if ((bits == 64) && (ri->size == 32)) {
const char *reg = rz_reg_32_to_64(rreg, op_esil);
if (reg) {
free(op_esil);
op_esil = rz_str_dup(reg);
}
}
strncpy(regname, op_esil, size - 1);
}
free(op_esil);
rz_analysis_op_free(op);
}
static ut64 get_addr(RzAnalysis *analysis, const char *regname, int idx) {
if (!regname || !*regname) {
return UT64_MAX;
}
RzAnalysisEsil *esil = rz_analysis_get_esil(analysis);
RzAnalysisEsilTrace *etrace = esil->trace;
RzILTraceInstruction *instruction_trace = rz_analysis_esil_get_instruction_trace(etrace, idx);
RzILTraceRegOp *reg_op = rz_analysis_il_get_reg_op_trace(instruction_trace, regname, false);
if (!reg_op) {
return UT64_MAX;
}
return reg_op->value;
}
static RzList /*<char *>*/ *parse_format(RzCore *core, char *fmt) {
if (!fmt || !*fmt) {
return NULL;
}
RzList *ret = rz_list_new();
if (!ret) {
return NULL;
}
Sdb *s = rz_analysis_get_sdb_formats(core->analysis);
const char *spec = rz_config_get(core->config, "analysis.types.spec");
char arr[10] = { 0 };
char tmpbuf[0x300]; // caller has the size limit of 0x200
char *ptr = strchr(fmt, '%');
fmt[strlen(fmt) - 1] = '\0';
while (ptr) {
ptr++;
// strip [width] specifier
while (IS_DIGIT(*ptr)) {
ptr++;
}
rz_str_ncpy(arr, ptr, sizeof(arr) - 1);
char *tmp = arr;
while (tmp && (IS_LOWER(*tmp) || IS_UPPER(*tmp))) {
tmp++;
}
*tmp = '\0';
const char *query = rz_strf(tmpbuf, "spec.%s.%s", spec, arr);
char *type = (char *)sdb_const_get(s, query);
if (type) {
rz_list_append(ret, type);
}
ptr = strchr(ptr, '%');
}
return ret;
}
static void retype_callee_arg(RzAnalysis *analysis, const char *callee_name, bool in_stack, const char *place, int size, RZ_BORROW RzType *type) {
RzAnalysisFunction *fcn = rz_analysis_get_function_byname(analysis, callee_name);
if (!fcn) {
return;
}
if (in_stack) {
RzAnalysisVar *var = rz_analysis_function_get_stack_var_at(fcn, size - fcn->bp_off + 8);
if (!var) {
return;
}
var_type_set_resolve_overlaps(analysis, var, type, false);
} else {
RzAnalysisVar *rvar = rz_analysis_function_get_reg_var_at(fcn, place);
if (!rvar) {
return;
}
var_type_set_resolve_overlaps(analysis, rvar, type, false);
RzAnalysisVar *lvar = rz_analysis_var_get_dst_var(rvar);
if (lvar) {
var_type_set_resolve_overlaps(analysis, lvar, type, false);
}
}
}
RzAnalysisOp *op_cache_get(HtUP *cache, RzCore *core, ut64 addr) {
RzAnalysisOp *op = ht_up_find(cache, addr, NULL);
if (op) {
return op;
}
op = rz_core_analysis_op(core, addr, RZ_ANALYSIS_OP_MASK_BASIC | RZ_ANALYSIS_OP_MASK_VAL);
if (!ht_up_insert(cache, addr, op)) {
rz_analysis_op_free(op);
return NULL;
}
return op;
}
RzCallable *function_type_derive(RzAnalysis *analysis, RZ_NONNULL const char *fcn_name, bool *owned) {
rz_return_val_if_fail(fcn_name && owned, NULL);
// Because in the case of `rz_type_func_get()` we get the borrowed
// pointer to the RzCallable and in the case of `rz_analysis_function_derive_type()`
// we get the owned pointer, we should free the pointer in the one case but not another.
*owned = false;
RzTypeDB *typedb = rz_analysis_get_type_db(analysis);
RzCallable *callable = rz_type_func_get(typedb, fcn_name);
if (!callable) {
RzAnalysisFunction *fcn = rz_analysis_get_function_byname(analysis, fcn_name);
if (!fcn) {
return NULL;
}
callable = rz_analysis_function_derive_type(analysis, fcn);
if (!callable) {
return NULL;
}
*owned = true;
}
return callable;
}
bool function_argument_type_derive(RZ_NULLABLE const RzCallable *callable, int arg_num, RzType **type, char **name) {
rz_return_val_if_fail(type && name, false);
if (!callable) {
return false;
}
if (arg_num >= rz_pvector_len(callable->args)) {
return false;
}
RzCallableArg *arg = rz_pvector_at(callable->args, arg_num);
if (!arg) {
return false;
}
*type = rz_type_clone(arg->type);
*name = rz_str_dup(arg->name);
return true;
}
#define DEFAULT_MAX 3
#define REGNAME_SIZE 10
#define MAX_INSTR 5
/**
* type match at a call instruction inside another function
*
* \param fcn_name name of the callee
* \param addr addr of the call instruction
* \param baddr addr of the caller function
* \param cc cc of the callee
* \param prev_idx index in the esil trace
* \param userfnc whether the callee is a user function (affects propagation direction)
* \param caddr addr of the callee
*/
static void type_match(RzCore *core, char *fcn_name, ut64 addr, ut64 baddr, const char *cc,
int prev_idx, bool userfnc, ut64 caddr, HtUP *op_cache) {
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
RzTypeDB *typedb = rz_analysis_get_type_db(core->analysis);
RzAnalysisEsilTrace *etrace = esil->trace;
RzAnalysis *analysis = core->analysis;
RzList *types = NULL;
char tmpbuf[1024];
int idx = rz_pvector_len(etrace->instructions) - 1;
bool verbose = rz_config_get_i(core->config, "analysis.types.verbose");
bool stack_rev = false, in_stack = false, format = false;
if (!fcn_name || !cc) {
return;
}
int i, j, pos = 0, size = 0, max = rz_type_func_args_count(typedb, fcn_name);
const char *place = rz_analysis_cc_arg(analysis, cc, ST32_MAX);
rz_cons_break_push(NULL, NULL);
if (place && !strcmp(place, "stack_rev")) {
stack_rev = true;
}
place = rz_analysis_cc_arg(analysis, cc, 0);
if (place && rz_str_startswith("stack", place)) {
in_stack = true;
}
if (verbose && !strncmp(fcn_name, "sym.imp.", 8)) {
RZ_LOG_ERROR("core: %s missing function definition\n", fcn_name + 8);
}
if (!max || max == -1) {
if (!in_stack) {
max = rz_analysis_cc_max_arg(analysis, cc);
} else {
max = DEFAULT_MAX;
}
}
// Because in the case of `rz_type_func_get()` we get the borrowed
// pointer to the RzCallable and in the case of `rz_analysis_function_derive_type()`
// we get the owned pointer, we should free the pointer in the one case but not another.
bool owned = false;
RzCallable *callable = function_type_derive(analysis, fcn_name, &owned);
// We don't check if the callable is NULL because we not always need it, for example
// in case of the `format` set it's unnecessary for the type derivation.
for (i = 0; i < max; i++) {
int arg_num = stack_rev ? (max - 1 - i) : i;
RzType *type = NULL;
char *name = NULL;
if (format) {
if (rz_list_empty(types)) {
break;
}
const char *typestr = rz_list_get_n(types, pos++);
if (typestr) {
type = rz_type_parse_string_single(typedb->parser, typestr, NULL);
}
} else {
if (!function_argument_type_derive(callable, arg_num, &type, &name)) {
continue;
}
}
if (!type && !userfnc) {
free(name);
continue;
}
if (!in_stack) {
// XXX: param arg_num must be fixed to support floating point register
place = rz_analysis_cc_arg(analysis, cc, arg_num);
if (place && rz_str_startswith("stack", place)) {
in_stack = true;
}
}
char regname[REGNAME_SIZE] = { 0 };
ut64 xaddr = UT64_MAX;
bool memref = false;
bool cmt_set = false;
bool res = false;
// Backtrace instruction from source sink to prev source sink
for (j = idx; j >= prev_idx; j--) {
RzILTraceInstruction *instr_trace = rz_analysis_esil_get_instruction_trace(etrace, j);
ut64 instr_addr = instr_trace->addr;
if (instr_addr < baddr) {
break;
}
RzAnalysisOp *op = op_cache_get(op_cache, core, instr_addr);
if (!op) {
break;
}
RzAnalysisOp *next_op = op_cache_get(op_cache, core, instr_addr + op->size);
if (!next_op || (j != idx && (next_op->type == RZ_ANALYSIS_OP_TYPE_CALL || next_op->type == RZ_ANALYSIS_OP_TYPE_JMP))) {
break;
}
RzAnalysisVar *var = rz_analysis_get_used_function_var(analysis, op->addr);
// FIXME : It seems also assume only read memory once ?
if (op->type == RZ_ANALYSIS_OP_TYPE_MOV && (instr_trace->stats & RZ_IL_TRACE_INS_HAS_MEM_R)) {
memref = !(!memref && var && var->storage.type == RZ_ANALYSIS_VAR_STORAGE_STACK);
}
// Match type from function param to instr
if (type_pos_hit(analysis, instr_trace, in_stack, size, place)) {
if (!cmt_set && type && name) {
char *typestr = rz_type_as_string(typedb, type);
const char *maybe_space = type->kind == RZ_TYPE_KIND_POINTER ? "" : " ";
rz_meta_set_string(analysis, RZ_META_TYPE_VARTYPE, instr_addr,
rz_strf(tmpbuf, "%s%s%s", typestr, maybe_space, name));
cmt_set = true;
if ((op->ptr && op->ptr != UT64_MAX) && !strcmp(name, "format")) {
RzFlagItem *f = rz_flag_get_by_spaces(core->flags, op->ptr, RZ_FLAGS_FS_STRINGS, NULL);
if (!f) {
// A format argument (e.g. scanf's "%s") is a string even when
// shorter than the detection threshold; create the reference so
// it is shown as a string and parsed for variadic typing below.
size_t saved_min = core->bin->str_search_cfg.min_length;
core->bin->str_search_cfg.min_length = 1;
rz_core_add_string_ref(core, op->addr, op->ptr);
core->bin->str_search_cfg.min_length = saved_min;
f = rz_flag_get_by_spaces(core->flags, op->ptr, RZ_FLAGS_FS_STRINGS, NULL);
}
if (f) {
char formatstr[0x200];
int read = rz_io_nread_at(core->io, f->offset, (ut8 *)formatstr, RZ_MIN(sizeof(formatstr) - 1, f->size));
if (read > 0) {
formatstr[read] = '\0';
if ((types = parse_format(core, formatstr))) {
max += rz_list_length(types);
}
format = true;
}
}
}
free(typestr);
}
if (var) {
if (!userfnc) {
// not a userfunction, propagate the callee's arg types into our function's vars
var_type_set_resolve_overlaps(analysis, var, type, memref);
var_rename(analysis, var, name, addr);
} else {
// callee is a userfunction, propagate our variable's type into the callee's args
retype_callee_arg(analysis, fcn_name, in_stack, place, size, var->type);
}
res = true;
} else {
get_src_regname(core, instr_addr, regname, sizeof(regname));
xaddr = get_addr(analysis, regname, j);
}
}
// Type propagate by following source reg
if (!res && *regname && rz_analysis_il_get_reg_op_trace(instr_trace, regname, true)) {
if (var) {
if (!userfnc) {
// not a userfunction, propagate the callee's arg types into our function's vars
var_type_set_resolve_overlaps(analysis, var, type, memref);
var_rename(analysis, var, name, addr);
} else {
// callee is a userfunction, propagate our variable's type into the callee's args
retype_callee_arg(analysis, fcn_name, in_stack, place, size, var->type);
}
res = true;
} else {
switch (op->type) {
case RZ_ANALYSIS_OP_TYPE_MOV:
case RZ_ANALYSIS_OP_TYPE_PUSH:
get_src_regname(core, instr_addr, regname, sizeof(regname));
break;
case RZ_ANALYSIS_OP_TYPE_LEA:
case RZ_ANALYSIS_OP_TYPE_LOAD:
case RZ_ANALYSIS_OP_TYPE_STORE:
res = true;
break;
}
}
} else if (var && res && xaddr && (xaddr != UT64_MAX)) { // Type progation using value
char tmp[REGNAME_SIZE] = { 0 };
get_src_regname(core, instr_addr, tmp, sizeof(tmp));
ut64 ptr = get_addr(analysis, tmp, j);
if (ptr == xaddr) {
if (type) {
var_type_set_resolve_overlaps(analysis, var, type, memref);
} else {
var_type_set_str(analysis, var, "int", memref);
}
}
}
}
int bits = rz_analysis_get_bits(analysis);
size += bits / 8;
rz_type_free(type);
free(name);
}
if (owned) {
rz_type_callable_free(callable);
}
rz_list_free(types);
rz_cons_break_pop();
}
static int bb_cmpaddr(const void *_a, const void *_b, void *user) {
const RzAnalysisBlock *a = _a, *b = _b;
return a->addr > b->addr ? 1 : (a->addr < b->addr ? -1 : 0);
}
void handle_stack_canary(RzCore *core, RzAnalysisOp *aop, int cur_idx) {
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
RzILTraceInstruction *prev_trace = rz_analysis_esil_get_instruction_trace(
esil->trace,
cur_idx - 1);
ut64 mov_addr;
if (prev_trace) {
mov_addr = prev_trace->addr;
} else {
return;
}
RzAnalysisOp *mop = rz_core_analysis_op(core, mov_addr, RZ_ANALYSIS_OP_MASK_VAL | RZ_ANALYSIS_OP_MASK_BASIC);
if (mop) {
RzAnalysisVar *mopvar = rz_analysis_get_used_function_var(core->analysis, mop->addr);
ut32 type = mop->type & RZ_ANALYSIS_OP_TYPE_MASK;
if (type == RZ_ANALYSIS_OP_TYPE_MOV) {
var_rename(core->analysis, mopvar, "canary", aop->addr);
}
}
rz_analysis_op_free(mop);
}
struct ReturnTypeAnalysisCtx {
bool resolved;
RzType *ret_type;
char *ret_reg;
};
static inline bool return_type_analysis_context_unresolved(struct ReturnTypeAnalysisCtx *ctx) {
return !ctx->resolved && ctx->ret_type && ctx->ret_reg;
}
// Progate return type passed using pointer
static void propagate_return_type_pointer(RzCore *core, RzAnalysisOp *aop, RzPVector /*<RzAnalysisVar *>*/ *used_vars, ut64 addr, struct ReturnTypeAnalysisCtx *ctx) {
// int *ret; *ret = strlen(s);
// TODO: memref check , dest and next src match
char nsrc[REGNAME_SIZE] = { 0 };
void **uvit;
get_src_regname(core, addr, nsrc, sizeof(nsrc));
if (ctx->ret_reg && *nsrc && strstr(ctx->ret_reg, nsrc) && aop->direction == RZ_ANALYSIS_OP_DIR_READ) {
if (used_vars && !rz_pvector_empty(used_vars)) {
rz_pvector_foreach (used_vars, uvit) {
RzAnalysisVar *var = *uvit;
var_type_set(core->analysis, var, ctx->ret_type, true, false);
}
vars_resolve_overlaps(used_vars);
}
}
}
// Forward propagation of function return type
static void propagate_return_type(RzCore *core, RzAnalysisOp *aop, RzAnalysisOp *next_op, RzILTraceInstruction *trace, struct ReturnTypeAnalysisCtx *ctx, RzPVector /*<RzAnalysisVar *>*/ *used_vars) {
char src[REGNAME_SIZE] = { 0 };
void **uvit;
// TODO : handle multiple registers case, this is a temporary solution
RzILTraceRegOp *single_write_reg = NULL;
if (trace && (trace->stats & RZ_IL_TRACE_INS_HAS_REG_W)) {
single_write_reg = rz_pvector_at(trace->write_reg_ops, 0);
}
get_src_regname(core, aop->addr, src, sizeof(src));
ut32 type = aop->type & RZ_ANALYSIS_OP_TYPE_MASK;
if (ctx->ret_reg && *src && strstr(ctx->ret_reg, src)) {
if (used_vars && !rz_pvector_empty(used_vars) && aop->direction == RZ_ANALYSIS_OP_DIR_WRITE) {
rz_pvector_foreach (used_vars, uvit) {
RzAnalysisVar *var = *uvit;
var_type_set(core->analysis, var, ctx->ret_type, false, false);
}
vars_resolve_overlaps(used_vars);
ctx->resolved = true;
} else if (type == RZ_ANALYSIS_OP_TYPE_MOV) {
RZ_FREE(ctx->ret_reg);
if (single_write_reg && single_write_reg->reg_name) {
ctx->ret_reg = rz_str_dup(single_write_reg->reg_name);
}
}
} else if (single_write_reg) {
if (ctx->ret_reg &&
(single_write_reg->reg_name && strstr(ctx->ret_reg, single_write_reg->reg_name))) {
ctx->resolved = true;
} else if (type == RZ_ANALYSIS_OP_TYPE_MOV &&
(next_op && next_op->type == RZ_ANALYSIS_OP_TYPE_MOV)) {
// Progate return type passed using pointer
propagate_return_type_pointer(core, aop, used_vars, next_op->addr, ctx);
}
}
}
struct TypeAnalysisCtx {
struct ReturnTypeAnalysisCtx *retctx;
int cur_idx;
const char *prev_dest;
bool str_flag;
};
void propagate_types_among_used_variables(RzCore *core, HtUP *op_cache, RzAnalysisFunction *fcn, RzAnalysisBlock *bb, RzAnalysisOp *aop, struct TypeAnalysisCtx *ctx) {
RzPVector *used_vars = rz_analysis_function_get_vars_used_at(fcn, aop->addr);
bool chk_constraint = rz_config_get_b(core->config, "analysis.types.constraint");
RzAnalysisOp *next_op = op_cache_get(op_cache, core, aop->addr + aop->size);
RzTypeDB *typedb = rz_analysis_get_type_db(core->analysis);
void **uvit;
RzType *prev_type = NULL;
int prev_idx = 0;
bool prev_var = false;
char *fcn_name = NULL;
bool userfnc = false;
bool prop = false;
ut32 type = aop->type & RZ_ANALYSIS_OP_TYPE_MASK;
RzAnalysis *analysis = core->analysis;
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
RzAnalysisEsilTrace *etrace = esil->trace;
RzILTraceInstruction *cur_instr_trace = rz_analysis_esil_get_instruction_trace(etrace, ctx->cur_idx);
if (aop->type == RZ_ANALYSIS_OP_TYPE_CALL || aop->type & RZ_ANALYSIS_OP_TYPE_UCALL) {
char *full_name = NULL;
ut64 callee_addr;
if (aop->type == RZ_ANALYSIS_OP_TYPE_CALL) {
RzAnalysisFunction *fcn_call = rz_analysis_get_fcn_in(core->analysis, aop->jump, -1);
if (fcn_call) {
full_name = fcn_call->name;
callee_addr = fcn_call->addr;
}
} else if (aop->ptr != UT64_MAX) {
RzFlagItem *flag = rz_flag_get_by_spaces(core->flags, aop->ptr, RZ_FLAGS_FS_IMPORTS, NULL);
if (flag && flag->realname) {
char *reloc_prefix = (char *)rz_str_rstr(flag->realname, "reloc.");
full_name = reloc_prefix ? reloc_prefix + 6 : flag->realname;
callee_addr = aop->ptr;
}
}
// TODO: Apart from checking the types database, we should also derive the information
// from the RzAnalysisFunction if nothing was found in the RzTypeDB
if (full_name) {
if (rz_type_func_exist(typedb, full_name)) {
fcn_name = rz_str_dup(full_name);
} else {
fcn_name = rz_analysis_function_name_guess(typedb, full_name);
}
if (!fcn_name) {
fcn_name = rz_str_dup(full_name);
userfnc = true;
}
const char *Cc = rz_analysis_cc_func(core->analysis, fcn_name);
if (Cc && rz_analysis_cc_exist(core->analysis, Cc)) {
char *cc = rz_str_dup(Cc);
type_match(core, fcn_name, aop->addr, bb->addr, cc, prev_idx, userfnc, callee_addr, op_cache);
prev_idx = ctx->cur_idx;
ctx->retctx->ret_type = rz_type_func_ret(typedb, fcn_name);
RZ_FREE(ctx->retctx->ret_reg);
const char *rr = rz_analysis_cc_ret(core->analysis, cc);
if (rr) {
ctx->retctx->ret_reg = rz_str_dup(rr);
}
ctx->retctx->resolved = false;
free(cc);
}
if (!strcmp(fcn_name, "__stack_chk_fail")) {
handle_stack_canary(core, aop, ctx->cur_idx);
}
free(fcn_name);
}
} else if (return_type_analysis_context_unresolved(ctx->retctx)) {
// Forward propagation of function return type
propagate_return_type(core, aop, next_op, cur_instr_trace, ctx->retctx, used_vars);
}
// Type propagation using instruction access pattern
if (used_vars && !rz_pvector_empty(used_vars)) {
rz_pvector_foreach (used_vars, uvit) {
RzAnalysisVar *var = *uvit;
bool sign = false;
if ((type == RZ_ANALYSIS_OP_TYPE_CMP) && next_op) {
if (next_op->sign) {
sign = true;
} else {
// cmp [local_ch], rax ; jb
// set to "unsigned"
var_type_set_sign(core->analysis, var, false);
}
}
// cmp [local_ch], rax ; jge
if (sign || aop->sign) {
// set to "signed"
var_type_set_sign(core->analysis, var, true);
}
// lea rax , str.hello ; mov [local_ch], rax;
// mov rdx , [local_4h] ; mov [local_8h], rdx;
if (ctx->prev_dest && (type == RZ_ANALYSIS_OP_TYPE_MOV || type == RZ_ANALYSIS_OP_TYPE_STORE)) {
char reg[REGNAME_SIZE] = { 0 };
get_src_regname(core, aop->addr, reg, sizeof(reg));
bool match = strstr(ctx->prev_dest, reg) != NULL;
if (ctx->str_flag && match) {
var_type_set_str(core->analysis, var, "const char *", false);
}
if (prop && match && prev_var && prev_type) {
// Here we clone the type
var_type_set(core->analysis, var, prev_type, false, false);
}
}
if (chk_constraint && var && (type == RZ_ANALYSIS_OP_TYPE_CMP && aop->disp != UT64_MAX) && next_op && next_op->type == RZ_ANALYSIS_OP_TYPE_CJMP) {
bool jmp = false;
RzAnalysisOp *jmp_op = { 0 };
ut64 jmp_addr = next_op->jump;
RzAnalysisBlock *jmpbb = rz_analysis_fcn_bbget_in(core->analysis, fcn, jmp_addr);
if (!jmpbb) {
continue;
}
// Check exit status of jmp branch
int i;
for (i = 0; i < MAX_INSTR; i++) {
jmp_op = rz_core_analysis_op(core, jmp_addr, RZ_ANALYSIS_OP_MASK_BASIC);
if (!jmp_op) {
break;
}
if ((jmp_op->type == RZ_ANALYSIS_OP_TYPE_RET && rz_analysis_block_contains(jmpbb, jmp_addr)) || jmp_op->type == RZ_ANALYSIS_OP_TYPE_CJMP) {
jmp = true;
rz_analysis_op_free(jmp_op);
break;
}
jmp_addr += jmp_op->size;
rz_analysis_op_free(jmp_op);
}
RzTypeConstraint constr = {
.cond = jmp ? rz_type_cond_invert(next_op->cond) : next_op->cond,
.val = aop->val
};
// Only keep constraints that carry useful information: a known
// immediate value (UT64_MAX means the compared value was not a
// resolvable immediate) and a condition that the rest of the
// type engine knows how to represent. Besides the interval
// bounds (<, <=, >, >=) this includes the equality and
// inequality conditions produced by je/jne-style branches.
// This avoids recording degenerate constraints such as
// "> 0xffffffffffffffff".
bool useful_cond = constr.cond == RZ_TYPE_COND_LE || constr.cond == RZ_TYPE_COND_LT ||
constr.cond == RZ_TYPE_COND_GE || constr.cond == RZ_TYPE_COND_GT ||
constr.cond == RZ_TYPE_COND_EQ || constr.cond == RZ_TYPE_COND_NE;
if (constr.val != UT64_MAX && useful_cond) {
// Avoid recording the same constraint more than once (the
// emulation may revisit the same comparison).
bool dup = false;
RzTypeConstraint *existing;
rz_vector_foreach (&var->constraints, existing) {
if (existing->cond == constr.cond && existing->val == constr.val) {
dup = true;
break;
}
}
if (!dup) {
rz_analysis_var_add_constraint(var, &constr);
}
}
}
}
vars_resolve_overlaps(used_vars);
}
prev_var = (used_vars && !rz_pvector_empty(used_vars) && aop->direction == RZ_ANALYSIS_OP_DIR_READ);
ctx->str_flag = false;
prop = false;
ctx->prev_dest = NULL;
switch (type) {
case RZ_ANALYSIS_OP_TYPE_MOV:
case RZ_ANALYSIS_OP_TYPE_LEA:
case RZ_ANALYSIS_OP_TYPE_LOAD:
if (aop->ptr && aop->refptr && aop->ptr != UT64_MAX) {
if (type == RZ_ANALYSIS_OP_TYPE_LOAD) {
ut8 buf[256] = { 0 };
rz_io_read_at_mapped(core->io, aop->ptr, buf, sizeof(buf) - 1);
ut64 ptr = rz_read_ble(buf, core->print->big_endian, aop->refptr * 8);
if (ptr && ptr != UT64_MAX) {
RzFlagItem *f = rz_flag_get_by_spaces(core->flags, ptr, RZ_FLAGS_FS_STRINGS, NULL);
if (f) {
ctx->str_flag = true;
}
}
} else if (rz_flag_exist_at(core->flags, "str", 3, aop->ptr)) {
ctx->str_flag = true;
}
}
// Assert : reg write only once here
RzILTraceRegOp *w_reg = NULL;
if (cur_instr_trace) {
if (cur_instr_trace->stats & RZ_IL_TRACE_INS_HAS_REG_W) {
w_reg = rz_pvector_at(cur_instr_trace->write_reg_ops, 0);
if (w_reg) {
RzStrConstPool *cpool = rz_analysis_get_const_pool(analysis);
ctx->prev_dest = rz_str_constpool_get(cpool, w_reg->reg_name);
}
}
}
if (used_vars && !rz_pvector_empty(used_vars)) {
rz_pvector_foreach (used_vars, uvit) {
RzAnalysisVar *var = *uvit;
// mov dword [local_4h], str.hello;
if (ctx->str_flag) {
var_type_set_str(core->analysis, var, "const char *", false);
}
prev_type = var->type;
prop = true;
}
}
}
}
#define OP_CACHE_LIMIT 8192
RZ_API void rz_core_analysis_type_match(RzCore *core, RzAnalysisFunction *fcn, HtUU *loop_table) {
rz_return_if_fail(core && core->analysis && fcn);
RzAnalysisEsil *esil = rz_analysis_get_esil(core->analysis);
if (!esil) {
RZ_LOG_ERROR("core: please run aeim first.\n");
return;
}
RzAnalysis *analysis = core->analysis;
RzReg *reg = rz_analysis_get_reg(core->analysis);
const int mininstrsz = rz_analysis_archinfo(analysis, RZ_ANALYSIS_ARCHINFO_MIN_OP_SIZE);
const int minopcode = RZ_MAX(1, mininstrsz);
RzConfigHold *hc = rz_config_hold_new(core->config);
if (!hc) {
return;
}
RzDebugTrace *dt = NULL;
RzAnalysisEsilTrace *et = NULL;
RzAnalysisILTrace *rt = NULL;
if (!analysis_emul_init(core, hc, &dt, &et, &rt) || !fcn) {
analysis_emul_restore(core, hc, dt, et, rt);
return;
}
// Reserve bigger ht to avoid rehashing
RzDebugTrace *dtrace = core->dbg->trace;
HtSPOptions opt = dtrace->ht->opt;
ht_sp_free(dtrace->ht);
dtrace->ht = ht_sp_new_opt_size(&opt, fcn->ninstr);
// Create a new context to store the return type propagation state
struct ReturnTypeAnalysisCtx retctx = {
.resolved = false,
.ret_type = NULL,
.ret_reg = NULL,
};
struct TypeAnalysisCtx ctx = {
.retctx = &retctx,
.cur_idx = 0,
.prev_dest = NULL,
.str_flag = false
};
HtUP *op_cache = NULL;
const char *pc = rz_reg_get_name(reg, RZ_REG_NAME_PC);
if (!pc) {
goto out_function;
}
RzRegItem *r = rz_reg_get(reg, pc, -1);
if (!r) {
goto out_function;
}
rz_cons_break_push(NULL, NULL);
rz_pvector_sort(fcn->bbs, bb_cmpaddr, NULL);
// TODO: The algorithm can be more accurate if blocks are followed by their jmp/fail, not just by address
RzAnalysisBlock *bb;
void **vit;
rz_pvector_foreach (fcn->bbs, vit) {
bb = (RzAnalysisBlock *)*vit;
ut64 addr = bb->addr;
rz_reg_set_value(reg, r, addr);
ht_up_free(op_cache);
op_cache = ht_up_new(NULL, (HtUPFreeValue)rz_analysis_op_free);
if (!op_cache) {
break;
}
while (1) {
if (rz_cons_is_breaked()) {
goto out_function;
}
ut64 pcval = rz_reg_getv(reg, pc);
if ((addr >= bb->addr + bb->size) || (addr < bb->addr) || pcval != addr) {
break;
}
RzAnalysisOp *aop = op_cache_get(op_cache, core, addr);
if (!aop) {
break;
}
if (aop->type == RZ_ANALYSIS_OP_TYPE_ILL) {
addr += minopcode;
continue;
}
// CHECK_ME : why we hold a loop_count here ?
// : can we remove it ?
// when set null, do not track loop count
if (loop_table) {
ut64 loop_count = ht_uu_find(loop_table, addr, NULL);
if (loop_count > LOOP_MAX || aop->type == RZ_ANALYSIS_OP_TYPE_RET) {
break;
}
loop_count += 1;
ht_uu_update(loop_table, addr, loop_count);
}
if (rz_analysis_op_nonlinear(aop->type)) { // skip the instr
rz_reg_set_value(reg, r, addr + aop->size);
} else {
rz_core_esil_step(core, UT64_MAX, NULL, NULL, false);
}
RzPVector *ins_traces = esil->trace->instructions;
ctx.cur_idx = rz_pvector_len(ins_traces) - 1;
RzList *fcns = rz_analysis_get_functions_in(analysis, aop->addr);
if (!fcns) {
break;
}
RzListIter *it;
RzAnalysisFunction *fcn;
rz_list_foreach (fcns, it, fcn) {
propagate_types_among_used_variables(core, op_cache, fcn, bb, aop, &ctx);
}
addr += aop->size;
rz_list_free(fcns);
// Recreate op_cache if it grows too large to avoid
// excessive memory usage.
if (ht_up_size(op_cache) > OP_CACHE_LIMIT) {
ht_up_free(op_cache);
op_cache = ht_up_new(NULL, (HtUPFreeValue)rz_analysis_op_free);
if (!op_cache) {
break;
}
}
}
}
// Type propagation for register based args
rz_pvector_foreach (&fcn->vars, vit) {
RzAnalysisVar *rvar = *vit;
if (rvar->storage.type == RZ_ANALYSIS_VAR_STORAGE_REG) {
RzAnalysisVar *lvar = rz_analysis_var_get_dst_var(rvar);
// Note that every `var_type_set_resolve_overlaps()` call could remove some variables
// due to the overlaps resolution
if (lvar) {
// Propagate local var type = to => register-based var
var_type_set(analysis, rvar, lvar->type, false, false);
// Propagate local var type <= from = register-based var
var_type_set(analysis, lvar, rvar->type, false, false);
}
}
}
vars_resolve_overlaps(&fcn->vars);
out_function:
free(retctx.ret_reg);
ht_up_free(op_cache);
rz_cons_break_pop();
analysis_emul_restore(core, hc, dt, et, rt);
}
Reference in a new issue View git blame Copy permalink