5152d0c9f7
Foundation for replacing fold's dead/abstract binary encoder with a real
SSA P-Code frontend. Verified root-cause gap: serializeBinaryIR() emits only
data-discovery nodes (sections/strings/imports/exports); the control-flow
BinaryExprKind values (BasicBlock/CallSite/...) are never constructed, so the
Z3-BB encoder's encodable filter is always empty and encodeBinaryBBs never
runs — hence 0 binary Z3 findings. The P-Code pipeline supersedes that path.
Phase 0 — docs/internal/ghidra-pcode-integration-research.md: P-Code opcode
core, the decompiler C++ embedding API (LoadImage/SleighArchitecture/Funcdata),
the CORE+DECCORE+SLEIGH source sets, no-bison finding, and pypcode as build
reference.
Phase 1 — vendored Ghidra decompiler at pinned commit (Ghidra_12.1_build,
7e89d94e34...) under third_party/ghidra-decompiler/ (cpp + AArch64 specs +
Apache-2.0 LICENSE + VENDOR.md + .gitignore for build artifacts). Validated by
hand on this clang-21/macOS toolchain:
- full SSA engine (CORE+DECCORE+SLEIGH, 80 files incl. heritage/funcdata/
action) compiles clean, -std=c++11 -O2, NO BFD, NO bison (generated
parsers are committed upstream; ruleparse isn't in the lib set);
- sleigh compiler builds; AArch64 .slaspec -> .sla compiles;
- tools/pcode_dump.cpp (custom LoadImage, no BFD) lifts the real arm64
sym._div_by_zero_direct to correct P-Code: `mov w9,#0 -> COPY(const 0)`,
`sdiv -> INT_SDIV(w8,w9)` — divisor zero-ness explicit in the data flow,
so the Phase-3 encoder proves div-by-zero trivially, multi-arch.
Not yet meson-wired (next step) and no fold-side IR/encoder yet (Phase 2-3);
this commit is the validated vendor + smoke tool.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
97 lines
4.2 KiB
C++
97 lines
4.2 KiB
C++
/* ###
|
|
* IP: GHIDRA
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
/// \file inject_ghidra.hh
|
|
/// \brief P-code injection classes using a Ghidra client as the back-end for generating p-code
|
|
|
|
#ifndef __INJECT_GHIDRA_HH__
|
|
#define __INJECT_GHIDRA_HH__
|
|
|
|
#include "pcodeinject.hh"
|
|
#include "ghidra_arch.hh"
|
|
|
|
namespace ghidra {
|
|
|
|
/// \brief An injection context that can be serialized and sent to the Ghidra client
|
|
///
|
|
/// This adds the capability to wrap up the context data in \<context> XML tag
|
|
/// that can then be forwarded to the Ghidra client.
|
|
class InjectContextGhidra : public InjectContext {
|
|
public:
|
|
virtual void encode(Encoder &encoder) const;
|
|
};
|
|
|
|
/// \brief An injection payload that uses a Ghidra client to generate the p-code ops
|
|
///
|
|
/// This acts as a placeholder for the actual details of the payload.
|
|
/// When the inject() method is invoked, the context is wrapped as XML and
|
|
/// sent to the Ghidra client, which returns the actual p-code to inject.
|
|
class InjectPayloadGhidra : public InjectPayload {
|
|
string source; ///< Source description to associate with the payload
|
|
public:
|
|
InjectPayloadGhidra(const string &src,const string &nm,int4 tp) : InjectPayload(nm,tp) { source = src; } ///< Constructor
|
|
virtual void inject(InjectContext &context,PcodeEmit &emit) const;
|
|
virtual void decode(Decoder &decoder);
|
|
virtual void printTemplate(ostream &s) const;
|
|
virtual string getSource(void) const { return source; }
|
|
};
|
|
|
|
/// \brief A call-fixup injection that uses a Ghidra client to generate the p-code ops
|
|
class InjectCallfixupGhidra : public InjectPayloadGhidra {
|
|
public:
|
|
InjectCallfixupGhidra(const string &src,const string &nm); ///< Constructor
|
|
virtual void decode(Decoder &decoder);
|
|
};
|
|
|
|
/// \brief A callother-fixup injection that uses a Ghidra client to generate the p-code ops
|
|
class InjectCallotherGhidra : public InjectPayloadGhidra {
|
|
public:
|
|
InjectCallotherGhidra(const string &src,const string &nm); ///< Constructor
|
|
virtual void decode(Decoder &decoder);
|
|
};
|
|
|
|
/// \brief A \e p-code \e script that uses a Ghidra client to generate the p-code ops
|
|
///
|
|
/// The \<body> section of any p-code script encountered in .cspec or .pspec files
|
|
/// is ignored. Instead the emulator is initialized by fetching compiled p-code
|
|
/// from the Ghidra client.
|
|
class ExecutablePcodeGhidra : public ExecutablePcode {
|
|
public:
|
|
ExecutablePcodeGhidra(Architecture *g,const string &src,const string &nm); ///< Constructor
|
|
virtual void inject(InjectContext &context,PcodeEmit &emit) const;
|
|
virtual void decode(Decoder &decoder);
|
|
virtual void printTemplate(ostream &s) const;
|
|
};
|
|
|
|
/// \brief A p-code injection library that uses a Ghidra client to generate/compile the injection p-code
|
|
///
|
|
/// The InjectPayload objects produced by this library are just placeholders (see InjectPayloadGhidra).
|
|
/// At the time of injection, final p-code is generated by the Ghidra client.
|
|
class PcodeInjectLibraryGhidra : public PcodeInjectLibrary {
|
|
InjectContextGhidra contextCache; ///< A context object that wraps data in XML for the Ghidra client
|
|
vector<OpBehavior *> inst; ///< Collected behaviors for the ExecutablePcode payloads
|
|
virtual int4 allocateInject(const string &sourceName,const string &name,int4 type);
|
|
virtual void registerInject(int4 injectid);
|
|
public:
|
|
PcodeInjectLibraryGhidra(ArchitectureGhidra *ghi); ///< Constructor
|
|
virtual int4 manualCallFixup(const string &name,const string &snippet);
|
|
virtual int4 manualCallOtherFixup(const string &name,const string &outname,const vector<string> &inname,
|
|
const string &snippet);
|
|
virtual InjectContext &getCachedContext(void) { return contextCache; }
|
|
virtual const vector<OpBehavior *> &getBehaviors(void);
|
|
};
|
|
|
|
} // End namespace ghidra
|
|
#endif
|