c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
84 lines
2.7 KiB
Text
84 lines
2.7 KiB
Text
#
|
|
# Instructions based on Intel Control-flow Enforcement Technology Preview
|
|
#
|
|
# Note: Shadow Stack semantics is not currently implemented correctly in these instructions
|
|
# nor in the instructions affected by CET
|
|
#
|
|
|
|
|
|
define pcodeop ShadowStackPush8B;
|
|
define pcodeop ShadowStackPush4B;
|
|
|
|
define pcodeop ShadowStackLoad8B;
|
|
define pcodeop ShadowStackLoad4B;
|
|
|
|
:INCSSPD r32 is vexMode=0 & $(PRE_F3) & byte=0x0f; byte=0xae; reg_opcode=5 & r32 {
|
|
SSP = SSP + zext(4 * r32:1);
|
|
}
|
|
@ifdef IA64
|
|
:INCSSPQ r64 is $(LONGMODE_ON) & vexMode=0 & $(PRE_F3) & $(REX_W) & byte=0x0f; byte=0xae; reg_opcode=5 & r64 {
|
|
SSP = SSP + zext(8 * r64:1);
|
|
}
|
|
@endif
|
|
|
|
:RDSSPD r32 is vexMode=0 & $(PRE_F3) & byte=0x0f; byte=0x1e; mod=3 & reg_opcode=1 & r32 {
|
|
r32 = SSP:4;
|
|
}
|
|
@ifdef IA64
|
|
:RDSSPQ r64 is $(LONGMODE_ON) & vexMode=0 & $(PRE_F3) & $(REX_W) & byte=0x0f; byte=0x1e; mod=3 & reg_opcode=1 & r64 {
|
|
r64 = SSP;
|
|
}
|
|
@endif
|
|
|
|
:SAVEPREVSSP is vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0x01; byte=0xea {
|
|
tmp:8 = SSP;
|
|
SSP = SSP & ~0x7;
|
|
ShadowStackPush8B(tmp);
|
|
}
|
|
|
|
|
|
:RSTORSSP m64 is vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0x01; ( mod != 0b11 & reg_opcode=5 ) ... & m64 {
|
|
tmp_SSP:8 = m64;
|
|
SSP = tmp_SSP & ~0x01;
|
|
}
|
|
|
|
define pcodeop writeToShadowStack;
|
|
define pcodeop writeToUserShadowStack;
|
|
|
|
|
|
:WRSSD rm32,Reg32 is vexMode=0 & byte=0x0f; byte=0x38; byte=0xf6; rm32 & Reg32 ... {
|
|
writeToShadowStack(rm32, Reg32);
|
|
}
|
|
@ifdef IA64
|
|
:WRSSQ rm64,Reg64 is $(LONGMODE_ON) & vexMode=0 & $(REX_W) & byte=0x0f; byte=0x0f; byte=0x38; byte=0xf6; rm64 & Reg64 ... {
|
|
writeToShadowStack(rm64, Reg64);
|
|
}
|
|
@endif
|
|
|
|
:WRUSSD rm32,Reg32 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x38; byte=0xf5; rm32 & Reg32 ... {
|
|
writeToUserShadowStack(rm32, Reg32);
|
|
}
|
|
@ifdef IA64
|
|
:WRUSSQ rm64,Reg64 is $(LONGMODE_ON) & vexMode=0 & $(PRE_66) & $(REX_W) & byte=0x0f; byte=0x0f; byte=0x38; byte=0xf5; rm64 & Reg64 ... {
|
|
writeToUserShadowStack(rm64, Reg64);
|
|
}
|
|
@endif
|
|
|
|
define pcodeop markShadowStackBusy;
|
|
define pcodeop clearShadowStackBusy;
|
|
|
|
:SETSSBSY is vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0x01; byte=0xe8 {
|
|
SSP = markShadowStackBusy(IA32_PL0_SSP);
|
|
}
|
|
|
|
:CLRSSBSY m64 is vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0xae; reg_opcode=6 ... & m64 {
|
|
clearShadowStackBusy(m64);
|
|
SSP=0;
|
|
}
|
|
|
|
:ENDBR32 is vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0x1e; byte=0xfb {}
|
|
@ifdef IA64
|
|
:ENDBR64 is $(LONGMODE_ON) & vexMode=0 & $(PRE_F3) & (opsize=0 | opsize=1 | opsize=2 | opsize=3) & byte=0x0f; byte=0x1e; byte=0xfa {}
|
|
@endif
|
|
|
|
|