c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
245 lines
7.3 KiB
XML
245 lines
7.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<!-- see: -->
|
|
<!-- https://docs.microsoft.com/en-us/cpp/build/x64-software-conventions#register-usage -->
|
|
<!-- https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention -->
|
|
<!-- https://docs.microsoft.com/en-us/cpp/c-runtime-library/direction-flag -->
|
|
<!-- https://docs.microsoft.com/en-us/cpp/cpp/vectorcall -->
|
|
|
|
<compiler_spec>
|
|
|
|
<data_organization>
|
|
<absolute_max_alignment value="0" />
|
|
<machine_alignment value="2" />
|
|
<default_alignment value="1" />
|
|
<default_pointer_alignment value="8" />
|
|
<pointer_size value="8" />
|
|
<wchar_size value="2" />
|
|
<short_size value="2" />
|
|
<integer_size value="4" />
|
|
<long_size value="4" />
|
|
<long_long_size value="8" />
|
|
<float_size value="4" />
|
|
<double_size value="8" />
|
|
<long_double_size value="8" />
|
|
<size_alignment_map>
|
|
<entry size="1" alignment="1" />
|
|
<entry size="2" alignment="2" />
|
|
<entry size="4" alignment="4" />
|
|
<entry size="8" alignment="8" />
|
|
</size_alignment_map>
|
|
<bitfield_packing>
|
|
<use_MS_convention value="true"/>
|
|
</bitfield_packing>
|
|
</data_organization>
|
|
|
|
<global>
|
|
<range space="ram"/>
|
|
<register name="MXCSR"/>
|
|
</global>
|
|
<stackpointer register="RSP" space="ram"/>
|
|
<returnaddress>
|
|
<varnode space="stack" offset="0" size="8"/>
|
|
</returnaddress>
|
|
<default_proto>
|
|
<prototype name="__fastcall" extrapop="8" stackshift="8">
|
|
<input pointermax="8">
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RCX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM1_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM2_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R8"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM3_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R9"/>
|
|
</pentry>
|
|
</group>
|
|
<pentry minsize="1" maxsize="500" align="8">
|
|
<addr offset="40" space="stack"/>
|
|
</pentry>
|
|
<!-- only structs of size 8,16,32,64 bits can be packed to register -->
|
|
<rule>
|
|
<datatype name="struct" sizes="3,5,6,7"/>
|
|
<convert_to_ptr/>
|
|
</rule>
|
|
</input>
|
|
<output>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
<!-- only structs of size 8,16,32,64 bits can be returned via register -->
|
|
<rule>
|
|
<datatype name="struct" sizes="3,5,6,7"/>
|
|
<hidden_return/>
|
|
</rule>
|
|
</output>
|
|
<unaffected>
|
|
<varnode space="ram" offset="0" size="8"/>
|
|
<register name="RBX"/>
|
|
<register name="RBP"/>
|
|
<register name="RDI"/>
|
|
<register name="RSI"/>
|
|
<register name="RSP"/>
|
|
<register name="R12"/>
|
|
<register name="R13"/>
|
|
<register name="R14"/>
|
|
<register name="R15"/>
|
|
<register name="DF"/>
|
|
<register name="GS_OFFSET"/>
|
|
<register name="XMM6"/>
|
|
<register name="XMM7"/>
|
|
<register name="XMM8"/>
|
|
<register name="XMM9"/>
|
|
<register name="XMM10"/>
|
|
<register name="XMM11"/>
|
|
<register name="XMM12"/>
|
|
<register name="XMM13"/>
|
|
<register name="XMM14"/>
|
|
<register name="XMM15"/>
|
|
</unaffected>
|
|
<killedbycall>
|
|
<register name="RAX"/>
|
|
<register name="XMM0"/>
|
|
</killedbycall>
|
|
<localrange>
|
|
<range space="stack" first="0xfffffffffff0bdc1" last="0xffffffffffffffff"/>
|
|
<range space="stack" first="8" last="39"/>
|
|
</localrange>
|
|
</prototype>
|
|
</default_proto>
|
|
<prototype name="__thiscall" extrapop="8" stackshift="8">
|
|
<input pointermax="8" thisbeforeretpointer="true">
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RCX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM1_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RDX"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM2_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R8"/>
|
|
</pentry>
|
|
</group>
|
|
<group>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM3_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="R9"/>
|
|
</pentry>
|
|
</group>
|
|
<pentry minsize="1" maxsize="500" align="8">
|
|
<addr offset="40" space="stack"/>
|
|
</pentry>
|
|
</input>
|
|
<output>
|
|
<pentry minsize="4" maxsize="8" metatype="float">
|
|
<register name="XMM0_Qa"/>
|
|
</pentry>
|
|
<pentry minsize="1" maxsize="8">
|
|
<register name="RAX"/>
|
|
</pentry>
|
|
</output>
|
|
<unaffected>
|
|
<varnode space="ram" offset="0" size="8"/>
|
|
<register name="RBX"/>
|
|
<register name="RBP"/>
|
|
<register name="RDI"/>
|
|
<register name="RSI"/>
|
|
<register name="RSP"/>
|
|
<register name="R12"/>
|
|
<register name="R13"/>
|
|
<register name="R14"/>
|
|
<register name="R15"/>
|
|
<register name="DF"/>
|
|
<register name="GS_OFFSET"/>
|
|
<register name="XMM6"/>
|
|
<register name="XMM7"/>
|
|
<register name="XMM8"/>
|
|
<register name="XMM9"/>
|
|
<register name="XMM10"/>
|
|
<register name="XMM11"/>
|
|
<register name="XMM12"/>
|
|
<register name="XMM13"/>
|
|
<register name="XMM14"/>
|
|
<register name="XMM15"/>
|
|
</unaffected>
|
|
<killedbycall>
|
|
<register name="RAX"/>
|
|
<register name="XMM0"/>
|
|
</killedbycall>
|
|
<localrange>
|
|
<range space="stack" first="0xfffffffffff0bdc1" last="0xffffffffffffffff"/>
|
|
<range space="stack" first="8" last="39"/>
|
|
</localrange>
|
|
</prototype>
|
|
<modelalias name="__cdecl" parent="__fastcall"/>
|
|
<modelalias name="__stdcall" parent="__fastcall"/>
|
|
<callfixup name="alloca_probe">
|
|
<target name="_alloca_probe"/>
|
|
<target name="_alloca_probe2"/>
|
|
<target name="__chkstk"/>
|
|
<target name="__chkstk2"/>
|
|
<target name="___chkstk_ms"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
RSP = RSP + 8;
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
<callfixup name="guard_dispatch_icall">
|
|
<target name="_guard_dispatch_icall"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
call [RAX];
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
|
|
<callfixup name="security_check_cookie">
|
|
<target name="__security_check_cookie"/>
|
|
<pcode>
|
|
<body><![CDATA[
|
|
tmpzero:4 = 0;
|
|
]]></body>
|
|
</pcode>
|
|
</callfixup>
|
|
</compiler_spec>
|