trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/third_party/ghidra-decompiler/specs/x86/x86-64-compat32.pspec
trvon c08081a016
 feat: vendor x86-64 + 32-bit SLEIGH; precise SSA def-use; write-loop FP guard 
Unlocks the x86 family end-to-end and makes the write-loop detector precise
enough for statically-linked binaries.

x86 SLEIGH:
- Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default);
  add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32.
- ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the
  raw path, and bound decompiler flow at the function end (0xC3 tail fill) so
  variable-length x86 does not run away into zero padding.

Precise SSA def-use (benefits all arches):
- ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter
  records real def-use. summarizePointerWrites now resolves the store-address
  base via def-use instead of a last-write heuristic — essential on x86 where
  arg registers are reused as scratch (RAX) and sub-registers are written (SIL).
- paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9).

Precision (the key fix at scale):
- A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed:
  if the loop index is `<`-compared against a pure parameter input, the function
  is size-bounded and not flagged. baby_bof's decode_base64 bounds on
  strlen(input) (a computed value, not a param) so it still fires. This cut a
  statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs)
  to 1 — the real decode_base64 → 264-byte overflow.

Perf + reach:
- Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the
  few callers of a write-loop callee that need the injected prototype).
- Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS,
  default 120s) so large static binaries actually analyze (the 3s per-command
  watchdog left them with an empty function list).

Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64
(index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static
FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-01 10:34:28 -04:00

160 lines
7 KiB
XML
Raw Permalink Blame History

<?xml version="1.0" encoding="UTF-8"?>
<processor_spec>
<properties>
<property key="useOperandReferenceAnalyzerSwitchTables" value="true"/>
<property key="assemblyRating:x86:LE:64:compat32" value="GOLD"/>
<property key="useropLibs" value="x86"/>
</properties>
<programcounter register="RIP"/>
<context_data>
<context_set space="ram">
<set name="addrsize" val="1"/>
<set name="opsize" val="1"/>
<set name="rexprefix" val="0"/>
<set name="longMode" val="0"/>
</context_set>
<tracked_set space="ram">
<set name="DF" val="0"/>
</tracked_set>
</context_data>
<register_data>
<register name="DR0" group="DEBUG"/>
<register name="DR1" group="DEBUG"/>
<register name="DR2" group="DEBUG"/>
<register name="DR3" group="DEBUG"/>
<register name="DR4" group="DEBUG"/>
<register name="DR5" group="DEBUG"/>
<register name="DR6" group="DEBUG"/>
<register name="DR7" group="DEBUG"/>
<register name="DR8" group="DEBUG"/>
<register name="DR9" group="DEBUG"/>
<register name="DR10" group="DEBUG"/>
<register name="DR11" group="DEBUG"/>
<register name="DR12" group="DEBUG"/>
<register name="DR13" group="DEBUG"/>
<register name="DR14" group="DEBUG"/>
<register name="DR15" group="DEBUG"/>
<register name="CR0" group="CONTROL"/>
<register name="CR1" group="CONTROL"/>
<register name="CR2" group="CONTROL"/>
<register name="CR3" group="CONTROL"/>
<register name="CR4" group="CONTROL"/>
<register name="CR5" group="CONTROL"/>
<register name="CR6" group="CONTROL"/>
<register name="CR7" group="CONTROL"/>
<register name="CR8" group="CONTROL"/>
<register name="CR9" group="CONTROL"/>
<register name="CR10" group="CONTROL"/>
<register name="CR11" group="CONTROL"/>
<register name="CR12" group="CONTROL"/>
<register name="CR13" group="CONTROL"/>
<register name="CR14" group="CONTROL"/>
<register name="CR15" group="CONTROL"/>
<register name="C0" group="Cx"/>
<register name="C1" group="Cx"/>
<register name="C2" group="Cx"/>
<register name="C3" group="Cx"/>
<register name="ST0" group="ST"/>
<register name="ST1" group="ST"/>
<register name="ST2" group="ST"/>
<register name="ST3" group="ST"/>
<register name="ST4" group="ST"/>
<register name="ST5" group="ST"/>
<register name="ST6" group="ST"/>
<register name="ST7" group="ST"/>
<register name="FPUControlWord" group="FPU"/>
<register name="FPUStatusWord" group="FPU"/>
<register name="FPUTagWord" group="FPU"/>
<register name="FPUDataPointer" group="FPU"/>
<register name="FPUInstructionPointer" group="FPU"/>
<register name="FPULastInstructionOpcode" group="FPU"/>
<register name="MM0" group="MMX"/>
<register name="MM1" group="MMX"/>
<register name="MM2" group="MMX"/>
<register name="MM3" group="MMX"/>
<register name="MM4" group="MMX"/>
<register name="MM5" group="MMX"/>
<register name="MM6" group="MMX"/>
<register name="MM7" group="MMX"/>
<register name="YMM0" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM1" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM2" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM3" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM4" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM5" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM6" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM7" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM8" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM9" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM10" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM11" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM12" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM13" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM14" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM15" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="XMM0" vector_lane_sizes="1,2,4,8"/>
<register name="XMM1" vector_lane_sizes="1,2,4,8"/>
<register name="XMM2" vector_lane_sizes="1,2,4,8"/>
<register name="XMM3" vector_lane_sizes="1,2,4,8"/>
<register name="XMM4" vector_lane_sizes="1,2,4,8"/>
<register name="XMM5" vector_lane_sizes="1,2,4,8"/>
<register name="XMM6" vector_lane_sizes="1,2,4,8"/>
<register name="XMM7" vector_lane_sizes="1,2,4,8"/>
<register name="XMM8" vector_lane_sizes="1,2,4,8"/>
<register name="XMM9" vector_lane_sizes="1,2,4,8"/>
<register name="XMM10" vector_lane_sizes="1,2,4,8"/>
<register name="XMM11" vector_lane_sizes="1,2,4,8"/>
<register name="XMM12" vector_lane_sizes="1,2,4,8"/>
<register name="XMM13" vector_lane_sizes="1,2,4,8"/>
<register name="XMM14" vector_lane_sizes="1,2,4,8"/>
<register name="XMM15" vector_lane_sizes="1,2,4,8"/>
<register name="CF" group="FLAGS"/>
<register name="F1" group="FLAGS"/>
<register name="PF" group="FLAGS"/>
<register name="F3" group="FLAGS"/>
<register name="AF" group="FLAGS"/>
<register name="F5" group="FLAGS"/>
<register name="ZF" group="FLAGS"/>
<register name="SF" group="FLAGS"/>
<register name="TF" group="FLAGS"/>
<register name="IF" group="FLAGS"/>
<register name="DF" group="FLAGS"/>
<register name="OF" group="FLAGS"/>
<register name="IOPL" group="FLAGS"/>
<register name="NT" group="FLAGS"/>
<register name="F15" group="FLAGS"/>
<register name="RF" group="FLAGS"/>
<register name="VM" group="FLAGS"/>
<register name="AC" group="FLAGS"/>
<register name="VIF" group="FLAGS"/>
<register name="VIP" group="FLAGS"/>
<register name="ID" group="FLAGS"/>
<register name="rflags" group="FLAGS"/>
<register name="eflags" group="FLAGS"/>
<register name="flags" group="FLAGS"/>
<register name="bit64" hidden="true"/>
<register name="segover" hidden="true"/>
<register name="repneprefx" hidden="true"/>
<register name="repprefx" hidden="true"/>
<register name="rexWprefix" hidden="true"/>
<register name="rexRprefix" hidden="true"/>
<register name="rexXprefix" hidden="true"/>
<register name="rexBprefix" hidden="true"/>
<register name="xmmTmp1" hidden="true"/>
<register name="xmmTmp1_Qa" hidden="true"/>
<register name="xmmTmp1_Da" hidden="true"/>
<register name="xmmTmp1_Db" hidden="true"/>
<register name="xmmTmp1_Qb" hidden="true"/>
<register name="xmmTmp1_Dc" hidden="true"/>
<register name="xmmTmp1_Dd" hidden="true"/>
<register name="xmmTmp2" hidden="true"/>
<register name="xmmTmp2_Qa" hidden="true"/>
<register name="xmmTmp2_Da" hidden="true"/>
<register name="xmmTmp2_Db" hidden="true"/>
<register name="xmmTmp2_Qb" hidden="true"/>
<register name="xmmTmp2_Dc" hidden="true"/>
<register name="xmmTmp2_Dd" hidden="true"/>
<register name="rexprefix" hidden="true"/>
</register_data>
</processor_spec>
Reference in a new issue View git blame Copy permalink