c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
2.2 KiB
Text
53 lines
2.2 KiB
Text
<dwarf>
|
|
<register_mappings>
|
|
<register_mapping dwarf="0" ghidra="EAX"/>
|
|
<register_mapping dwarf="1" ghidra="ECX"/>
|
|
<register_mapping dwarf="2" ghidra="EDX"/>
|
|
<register_mapping dwarf="3" ghidra="EBX"/>
|
|
<register_mapping dwarf="4" ghidra="ESP" stackpointer="true"/>
|
|
<register_mapping dwarf="5" ghidra="EBP"/>
|
|
<register_mapping dwarf="6" ghidra="ESI"/>
|
|
<register_mapping dwarf="7" ghidra="EDI"/>
|
|
<register_mapping dwarf="8" ghidra="EIP"/>
|
|
<register_mapping dwarf="9" ghidra="eflags"/>
|
|
<!-- <register_mapping dwarf="10" ghidra="TRAPNO"/> **not implemented** -->
|
|
<register_mapping dwarf="11" ghidra="ST0" auto_count="8"/> <!-- ST0..ST7 -->
|
|
|
|
<register_mapping dwarf="21" ghidra="XMM0" auto_count="8"/> <!-- XMM0..XMM7 -->
|
|
<register_mapping dwarf="29" ghidra="MM0" auto_count="8"/> <!-- MM0..MM7 -->
|
|
|
|
<!-- <register_mapping dwarf="37" ghidra="FCW"/> **not implemented** -->
|
|
<!-- <register_mapping dwarf="38" ghidra="FSW"/> **not implemented** -->
|
|
<register_mapping dwarf="39" ghidra="MXCSR"/>
|
|
|
|
<register_mapping dwarf="40" ghidra="ES"/>
|
|
<register_mapping dwarf="41" ghidra="CS"/>
|
|
<register_mapping dwarf="42" ghidra="SS"/>
|
|
<register_mapping dwarf="43" ghidra="DS"/>
|
|
<register_mapping dwarf="44" ghidra="FS"/>
|
|
<register_mapping dwarf="45" ghidra="GS"/>
|
|
|
|
<register_mapping dwarf="48" ghidra="TR"/>
|
|
<register_mapping dwarf="49" ghidra="LDTR"/>
|
|
</register_mappings>
|
|
|
|
<!--
|
|
call_frame_cfa and stack_frame allow specifying static values for DWARF expressions that
|
|
calculate stack locations of params or variables, typically used in a func's
|
|
DW_AT_frame_base attribute (later referenced via a DW_OP_fbreg instruction),
|
|
or in param/variable DW_AT_location attributes.
|
|
Using these values is controlled by dwarf import options, but not settable by the user currently.
|
|
-->
|
|
|
|
<!--
|
|
call_frame_cfa specifies the static offset of the func's CFA, which
|
|
technically should be looked up in the func's CIE structs.
|
|
-->
|
|
<call_frame_cfa value="4"/>
|
|
|
|
<!--
|
|
stack_frame allows dwarf expressions that reference EBP to be converted to a ghidra stack
|
|
location without evaluating the actual EBP value via symbolic propagation.
|
|
-->
|
|
<stack_frame register="EBP" offset="-4" />
|
|
</dwarf>
|