5152d0c9f7
Foundation for replacing fold's dead/abstract binary encoder with a real
SSA P-Code frontend. Verified root-cause gap: serializeBinaryIR() emits only
data-discovery nodes (sections/strings/imports/exports); the control-flow
BinaryExprKind values (BasicBlock/CallSite/...) are never constructed, so the
Z3-BB encoder's encodable filter is always empty and encodeBinaryBBs never
runs — hence 0 binary Z3 findings. The P-Code pipeline supersedes that path.
Phase 0 — docs/internal/ghidra-pcode-integration-research.md: P-Code opcode
core, the decompiler C++ embedding API (LoadImage/SleighArchitecture/Funcdata),
the CORE+DECCORE+SLEIGH source sets, no-bison finding, and pypcode as build
reference.
Phase 1 — vendored Ghidra decompiler at pinned commit (Ghidra_12.1_build,
7e89d94e34...) under third_party/ghidra-decompiler/ (cpp + AArch64 specs +
Apache-2.0 LICENSE + VENDOR.md + .gitignore for build artifacts). Validated by
hand on this clang-21/macOS toolchain:
- full SSA engine (CORE+DECCORE+SLEIGH, 80 files incl. heritage/funcdata/
action) compiles clean, -std=c++11 -O2, NO BFD, NO bison (generated
parsers are committed upstream; ruleparse isn't in the lib set);
- sleigh compiler builds; AArch64 .slaspec -> .sla compiles;
- tools/pcode_dump.cpp (custom LoadImage, no BFD) lifts the real arm64
sym._div_by_zero_direct to correct P-Code: `mov w9,#0 -> COPY(const 0)`,
`sdiv -> INT_SDIV(w8,w9)` — divisor zero-ness explicit in the data flow,
so the Phase-3 encoder proves div-by-zero trivially, multi-arch.
Not yet meson-wired (next step) and no fold-side IR/encoder yet (Phase 2-3);
this commit is the validated vendor + smoke tool.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
78 lines
3.6 KiB
C++
Executable file
78 lines
3.6 KiB
C++
Executable file
/* ###
|
|
* IP: GHIDRA
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
/// \file signature_ghidra.hh
|
|
/// \brief Feature/Signature generation commands that can be issued to the decompiler by the Ghidra client
|
|
#ifndef __GHIDRA_SIGNATURES_HH__
|
|
#define __GHIDRA_SIGNATURES_HH__
|
|
|
|
#include "ghidra_process.hh"
|
|
|
|
namespace ghidra {
|
|
|
|
/// \brief Signature command capability
|
|
///
|
|
/// This class is instantiated as a singleton and registers commands that the Ghidra client can issue
|
|
/// for generating feature vectors extracted from decompiled functions.
|
|
class GhidraSignatureCapability : public GhidraCapability {
|
|
static GhidraSignatureCapability ghidraSignatureCapability; ///< Singleton instance
|
|
GhidraSignatureCapability(void) { name = "signature"; } ///< Construct the singleton instance
|
|
GhidraSignatureCapability(const GhidraSignatureCapability &op2); ///< Not implemented
|
|
GhidraSignatureCapability &operator=(const GhidraSignatureCapability &op2); ///< Not implemented
|
|
public:
|
|
virtual void initialize(void);
|
|
};
|
|
|
|
/// \brief Command to generate a feature vector from a function's data-flow and control-flow graphs
|
|
///
|
|
/// The command expects to receive the entry point address of a function. The function is
|
|
/// decompiled using the "normalize" simplification style. Then features are extracted from the
|
|
/// resulting data-flow and control-flow graphs of the decompiled function. The features are
|
|
/// returned to the Ghidra client. The command can be instantiated in two forms. One form returns
|
|
/// a stream-lined encoding of the feature vector for more efficient transfers during normal operation.
|
|
/// The other form returns more descriptive meta-data with the features and is suitable for debugging
|
|
/// or exploring the feature generation process.
|
|
class SignaturesAt : public GhidraCommand {
|
|
bool debug; ///< True if the command should return verbose feature encodings
|
|
Address addr; ///< The entry point of the function to generate features for
|
|
virtual void loadParameters(void);
|
|
public:
|
|
SignaturesAt(bool dbg) { debug = dbg; } ///< Constructor specifying response format
|
|
virtual void rawAction(void);
|
|
};
|
|
|
|
/// \brief Command to retrieve current decompiler settings being used for feature/signature generation
|
|
///
|
|
/// The command returns an opaque integer indicating the state of boolean properties affecting
|
|
/// feature generation. The reserved value of 0 indicates that no settings have been provided to the
|
|
/// decompiler process.
|
|
class GetSignatureSettings : public GhidraCommand {
|
|
public:
|
|
virtual void rawAction(void);
|
|
};
|
|
|
|
/// \brief Command to provide the global settings used by the decompiler process during feature/signature generation
|
|
///
|
|
/// The command expects to receive an opaque integer value encoding the state of boolean properties affecting
|
|
/// feature generation. The command returns 't' indicating a valid setting was received or 'f' for an invalid setting.
|
|
class SetSignatureSettings : public GhidraCommand {
|
|
uint4 settings; ///< Opaque settings value being requested
|
|
virtual void loadParameters(void);
|
|
public:
|
|
virtual void rawAction(void);
|
|
};
|
|
|
|
} // End namespace ghidra
|
|
#endif
|