trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/third_party/ghidra-decompiler/specs/x86/pclmulqdq.sinc
trvon c08081a016
 feat: vendor x86-64 + 32-bit SLEIGH; precise SSA def-use; write-loop FP guard 
Unlocks the x86 family end-to-end and makes the write-loop detector precise
enough for statically-linked binaries.

x86 SLEIGH:
- Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default);
  add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32.
- ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the
  raw path, and bound decompiler flow at the function end (0xC3 tail fill) so
  variable-length x86 does not run away into zero padding.

Precise SSA def-use (benefits all arches):
- ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter
  records real def-use. summarizePointerWrites now resolves the store-address
  base via def-use instead of a last-write heuristic — essential on x86 where
  arg registers are reused as scratch (RAX) and sub-registers are written (SIL).
- paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9).

Precision (the key fix at scale):
- A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed:
  if the loop index is `<`-compared against a pure parameter input, the function
  is size-bounded and not flagged. baby_bof's decode_base64 bounds on
  strlen(input) (a computed value, not a param) so it still fires. This cut a
  statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs)
  to 1 — the real decode_base64 → 264-byte overflow.

Perf + reach:
- Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the
  few callers of a write-loop callee that need the injected prototype).
- Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS,
  default 120s) so large static binaries actually analyze (the 3s per-command
  watchdog left them with an empty function list).

Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64
(index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static
FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-01 10:34:28 -04:00

173 lines
4.9 KiB
Text
Raw Permalink Blame History

# Due to limitations on variable length matching that preclude opcode matching afterwards, all memory addressing forms of PCLMULQDQ are decoded to PCLMULQDQ, not the macro names.
# Display is non-standard, but semantics, and de-compilation should be correct.
macro pclmul(src1, src2, dest) {
local i:4 = 0:4;
local temp:16 = 0;
<start>
if (i > 63:4) goto <end>;
if ((src1 & (1 << i)) == 0) goto <skip>;
temp = temp ^ (src2 << i);
<skip>
i = i+1;
goto <start>;
<end>
dest = temp;
}
:PCLMULLQLQDQ XmmReg1, XmmReg2 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; xmmmod=3 & XmmReg1 & XmmReg2; byte=0x00
{
local src1:16 = zext(XmmReg1[0,64]);
local src2:16 = zext(XmmReg2[0,64]);
pclmul(src1,src2,XmmReg1);
}
:PCLMULHQLQDQ XmmReg1, XmmReg2 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; xmmmod=3 & XmmReg1 & XmmReg2; byte=0x01
{
local src1:16 = zext(XmmReg1[64,64]);
local src2:16 = zext(XmmReg2[0,64]);
pclmul(src1,src2,XmmReg1);
}
:PCLMULLQHQDQ XmmReg1, XmmReg2 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; xmmmod=3 & XmmReg1 & XmmReg2; byte=0x10
{
local src1:16 = zext(XmmReg1[0,64]);
local src2:16 = zext(XmmReg2[64,64]);
pclmul(src1,src2,XmmReg1);
}
:PCLMULHQHQDQ XmmReg1, XmmReg2 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; xmmmod=3 & XmmReg1 & XmmReg2; byte=0x11
{
local src1:16 = zext(XmmReg1[64,64]);
local src2:16 = zext(XmmReg2[64,64]);
pclmul(src1,src2,XmmReg1);
}
:PCLMULQDQ XmmReg1, XmmReg2, imm8 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; xmmmod=3 & XmmReg1 & XmmReg2; imm8 & imm8_4 & imm8_0
{
if (imm8_0:1) goto <src1_b>;
src1:16 = zext(XmmReg1[0,64]);
goto <done1>;
<src1_b>
src1 = zext(XmmReg1[64,64]);
<done1>
if (imm8_4:1) goto <src2_b>;
src2:16 = zext(XmmReg2[0,64]);
goto <done2>;
<src2_b>
src2 = zext(XmmReg2[64,64]);
<done2>
pclmul(src1,src2,XmmReg1);
}
:PCLMULQDQ XmmReg, m128, imm8 is vexMode=0 & $(PRE_66) & byte=0x0f; byte=0x3a; byte=0x44; XmmReg ... & m128; imm8 & imm8_4 & imm8_0
{
if (imm8_0:1) goto <src1_b>;
src1:16 = zext(XmmReg[0,64]);
goto <done1>;
<src1_b>
src1 = zext(XmmReg[64,64]);
<done1>
local m:16 = m128;
if (imm8_4:1) goto <src2_b>;
src2:16 = zext(m[0,64]);
goto <done2>;
<src2_b>
src2 = zext(m[64,64]);
<done2>
pclmul(src1,src2,XmmReg);
}
:VPCLMULLQLQDQ XmmReg1, vexVVVV_XmmReg, XmmReg2 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; xmmmod=3 & (XmmReg1 & YmmReg1) & XmmReg2; byte=0x00
{
local src1:16 = zext(vexVVVV_XmmReg[0,64]);
local src2:16 = zext(XmmReg2[0,64]);
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
:VPCLMULHQLQDQ XmmReg1, vexVVVV_XmmReg, XmmReg2 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; xmmmod=3 & (XmmReg1 & YmmReg1) & XmmReg2; byte=0x01
{
local src1:16 = zext(vexVVVV_XmmReg[64,64]);
local src2:16 = zext(XmmReg2[0,64]);
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
:VPCLMULLQHQDQ XmmReg1, vexVVVV_XmmReg, XmmReg2 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; xmmmod=3 & (XmmReg1 & YmmReg1) & XmmReg2; byte=0x10
{
local src1:16 = zext(vexVVVV_XmmReg[0,64]);
local src2:16 = zext(XmmReg2[64,64]);
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
:VPCLMULHQHQDQ XmmReg1, vexVVVV_XmmReg, XmmReg2 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; xmmmod=3 & (XmmReg1 & YmmReg1) & XmmReg2; byte=0x11
{
local src1:16 = zext(vexVVVV_XmmReg[64,64]);
local src2:16 = zext(XmmReg2[64,64]);
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
:VPCLMULQDQ XmmReg1, vexVVVV_XmmReg, XmmReg2, imm8 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; xmmmod=3 & (XmmReg1 & YmmReg1) & XmmReg2; imm8 & imm8_4 & imm8_0
{
if (imm8_0:1) goto <src1_b>;
src1:16 = zext(vexVVVV_XmmReg[0,64]);
goto <done1>;
<src1_b>
src1 = zext(vexVVVV_XmmReg[64,64]);
<done1>
if (imm8_4:1) goto <src2_b>;
src2:16 = zext(XmmReg2[0,64]);
goto <done2>;
<src2_b>
src2 = zext(XmmReg2[64,64]);
<done2>
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
:VPCLMULQDQ XmmReg1, vexVVVV_XmmReg, m128, imm8 is $(VEX_NDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_WIG) & vexVVVV_XmmReg; byte=0x44; (XmmReg1 & YmmReg1) ... & m128; imm8 & imm8_4 & imm8_0
{
if (imm8_0:1) goto <src1_b>;
src1:16 = zext(vexVVVV_XmmReg[0,64]);
goto <done1>;
<src1_b>
src1 = zext(vexVVVV_XmmReg[64,64]);
<done1>
local m:16 = m128;
if (imm8_4:1) goto <src2_b>;
src2:16 = zext(m[0,64]);
goto <done2>;
<src2_b>
src2 = zext(m[64,64]);
<done2>
pclmul(src1,src2,XmmReg1);
YmmReg1 = zext(XmmReg1);
}
Reference in a new issue View git blame Copy permalink