c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
413 lines
12 KiB
XML
413 lines
12 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<compiler_spec>
|
|
<data_organization>
|
|
<machine_alignment value="2" />
|
|
<default_alignment value="1" />
|
|
<default_pointer_alignment value="8" />
|
|
<pointer_size value="8" />
|
|
<wchar_size value="4" />
|
|
<short_size value="2" />
|
|
<integer_size value="4" />
|
|
<long_size value="8" />
|
|
<long_long_size value="8" />
|
|
<float_size value="4" />
|
|
<double_size value="8" />
|
|
<long_double_size value="10" /> <!-- aligned-length=16 -->
|
|
<size_alignment_map>
|
|
<entry size="1" alignment="1" />
|
|
<entry size="2" alignment="2" />
|
|
<entry size="4" alignment="4" />
|
|
<entry size="8" alignment="8" />
|
|
<entry size="16" alignment="16" />
|
|
</size_alignment_map>
|
|
</data_organization>
|
|
|
|
<global>
|
|
<range space="ram"/>
|
|
<register name="MXCSR"/>
|
|
</global>
|
|
<stackpointer register="RSP" space="ram"/>
|
|
<returnaddress>
|
|
<varnode space="stack" offset="0" size="8"/>
|
|
</returnaddress>
|
|
<default_proto>
|
|
<prototype name="__stdcall" extrapop="8" stackshift="8">
|
|
<!-- Derived from "System V Application Binary Interface AMD64 Architecture Processor Supplement" April 2016 -->
|
|
<input>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM1_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM2_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM3_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM4_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM5_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM6_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM7_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDI"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RSI"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RCX"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R8"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R9"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="500" align="8">
|
|
<addr offset="8" space="stack"/>
|
|
</pentry>
|
|
<rule>
|
|
<datatype name="any" maxsize="16"/>
|
|
<join_dual_class/> <!-- Bind from registers if possible-->
|
|
</rule>
|
|
<rule>
|
|
<datatype name="any"/>
|
|
<goto_stack/>
|
|
</rule>
|
|
</input>
|
|
<output>
|
|
<pentry minsize="1" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8" metatype="float">
|
|
<register name="XMM1_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
<rule>
|
|
<datatype name="any" maxsize="16"/>
|
|
<join_dual_class/>
|
|
</rule>
|
|
<rule>
|
|
<datatype name="any"/>
|
|
<hidden_return/>
|
|
</rule>
|
|
</output>
|
|
<killedbycall>
|
|
<register name="RAX"/>
|
|
<register name="RDX"/>
|
|
<register name="XMM0"/>
|
|
</killedbycall>
|
|
<unaffected>
|
|
<register name="RBX"/>
|
|
<register name="RSP"/>
|
|
<register name="RBP"/>
|
|
<register name="R12"/>
|
|
<register name="R13"/>
|
|
<register name="R14"/>
|
|
<register name="R15"/>
|
|
</unaffected>
|
|
</prototype>
|
|
</default_proto>
|
|
<prototype name="MSABI" extrapop="8" stackshift="8">
|
|
<input pointermax="8">
|
|
<!-- Use same grouping setup as x86-64-win.cspec. If the nth general-purpose register is
|
|
consumed, consume the nth floating point register, and vice-versa -->
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RCX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM1_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM2_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R8"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM3_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R9"/>
|
|
</pentry>
|
|
</group>
|
|
<pentry minsize="1" maxsize="500" align="8">
|
|
<addr offset="40" space="stack"/>
|
|
</pentry>
|
|
<!-- only structs of size 8,16,32,64 bits can be packed to register -->
|
|
<rule>
|
|
<datatype name="struct" sizes="3,5,6,7"/>
|
|
<convert_to_ptr/>
|
|
</rule>
|
|
</input>
|
|
<output>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
<!-- only structs of size 8,16,32,64 bits can be returned via register -->
|
|
<rule>
|
|
<datatype name="struct" sizes="3,5,6,7"/>
|
|
<hidden_return/>
|
|
</rule>
|
|
</output>
|
|
<unaffected>
|
|
<varnode space="ram" offset="0" size="8"/>
|
|
<register name="RBX"/>
|
|
<register name="RBP"/>
|
|
<register name="RDI"/>
|
|
<register name="RSI"/>
|
|
<register name="RSP"/>
|
|
<register name="R12"/>
|
|
<register name="R13"/>
|
|
<register name="R14"/>
|
|
<register name="R15"/>
|
|
<register name="DF"/>
|
|
</unaffected>
|
|
<killedbycall>
|
|
<register name="RAX"/>
|
|
<register name="XMM0"/>
|
|
</killedbycall>
|
|
<localrange>
|
|
<range space="stack" first="0xfffffffffff0bdc1" last="0xffffffffffffffff"/>
|
|
<range space="stack" first="8" last="39"/>
|
|
</localrange>
|
|
</prototype>
|
|
<prototype name="syscall" extrapop="8" stackshift="8">
|
|
<input pointermax="8">
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDI"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RSI"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R10"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R8"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R9"/>
|
|
</pentry>
|
|
</input>
|
|
<output killedbycall="true">
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
</output>
|
|
<unaffected>
|
|
<varnode space="ram" offset="0" size="8"/>
|
|
<register name="RBX"/>
|
|
<register name="RDX"/>
|
|
<register name="RBP"/>
|
|
<register name="RDI"/>
|
|
<register name="RSI"/>
|
|
<register name="RSP"/>
|
|
<register name="R8"/>
|
|
<register name="R9"/>
|
|
<register name="R10"/>
|
|
<register name="R12"/>
|
|
<register name="R13"/>
|
|
<register name="R14"/>
|
|
<register name="R15"/>
|
|
<register name="DF"/>
|
|
</unaffected>
|
|
<killedbycall>
|
|
<register name="RCX"/>
|
|
<register name="R11"/>
|
|
</killedbycall>
|
|
</prototype>
|
|
<prototype name="processEntry" extrapop="0" stackshift="0">
|
|
<input pointermax="8">
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="500" align="8">
|
|
<addr offset="0" space="stack"/>
|
|
</pentry>
|
|
</input>
|
|
<output killedbycall="true">
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
</output>
|
|
<unaffected>
|
|
<register name="RSP"/>
|
|
</unaffected>
|
|
<!-- Functions with this prototype don't have a return address. But, if we don't specify one, this prototype will
|
|
use the default, which is to have the return address on the stack. That conflicts with how this prototype actually
|
|
uses the stack, so we set a fake return address at a RBP, which is unspecified at process entry -->
|
|
<returnaddress>
|
|
<register name="RBP"/>
|
|
</returnaddress>
|
|
</prototype>
|
|
|
|
<callfixup name="x86_return_thunk">
|
|
<target name="__x86_return_thunk"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
RIP = *:8 RSP;
|
|
RSP = RSP + 8;
|
|
return [RIP];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="fentry">
|
|
<target name="__fentry__"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
temp:1 = 0;
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="mcount">
|
|
<target name="mcount"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
temp:1 = 0;
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_rbp">
|
|
<target name="__x86_indirect_thunk_rbp"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RBP];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_rax">
|
|
<target name="__x86_indirect_thunk_rax"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RAX];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_rbx">
|
|
<target name="__x86_indirect_thunk_rbx"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RBX];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_rcx">
|
|
<target name="__x86_indirect_thunk_rcx"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RCX];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_rdx">
|
|
<target name="__x86_indirect_thunk_rdx"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RDX];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r8">
|
|
<target name="__x86_indirect_thunk_r8"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R8];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r9">
|
|
<target name="__x86_indirect_thunk_r9"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R9];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r10">
|
|
<target name="__x86_indirect_thunk_r10"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R10];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r11">
|
|
<target name="__x86_indirect_thunk_r11"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R11];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r12">
|
|
<target name="__x86_indirect_thunk_r12"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R12];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r13">
|
|
<target name="__x86_indirect_thunk_r13"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R13];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r14">
|
|
<target name="__x86_indirect_thunk_r14"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R14];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="x86_indirect_thunk_r15">
|
|
<target name="__x86_indirect_thunk_r15"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [R15];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
</compiler_spec>
|