5152d0c9f7
Foundation for replacing fold's dead/abstract binary encoder with a real
SSA P-Code frontend. Verified root-cause gap: serializeBinaryIR() emits only
data-discovery nodes (sections/strings/imports/exports); the control-flow
BinaryExprKind values (BasicBlock/CallSite/...) are never constructed, so the
Z3-BB encoder's encodable filter is always empty and encodeBinaryBBs never
runs — hence 0 binary Z3 findings. The P-Code pipeline supersedes that path.
Phase 0 — docs/internal/ghidra-pcode-integration-research.md: P-Code opcode
core, the decompiler C++ embedding API (LoadImage/SleighArchitecture/Funcdata),
the CORE+DECCORE+SLEIGH source sets, no-bison finding, and pypcode as build
reference.
Phase 1 — vendored Ghidra decompiler at pinned commit (Ghidra_12.1_build,
7e89d94e34...) under third_party/ghidra-decompiler/ (cpp + AArch64 specs +
Apache-2.0 LICENSE + VENDOR.md + .gitignore for build artifacts). Validated by
hand on this clang-21/macOS toolchain:
- full SSA engine (CORE+DECCORE+SLEIGH, 80 files incl. heritage/funcdata/
action) compiles clean, -std=c++11 -O2, NO BFD, NO bison (generated
parsers are committed upstream; ruleparse isn't in the lib set);
- sleigh compiler builds; AArch64 .slaspec -> .sla compiles;
- tools/pcode_dump.cpp (custom LoadImage, no BFD) lifts the real arm64
sym._div_by_zero_direct to correct P-Code: `mov w9,#0 -> COPY(const 0)`,
`sdiv -> INT_SDIV(w8,w9)` — divisor zero-ness explicit in the data flow,
so the Phase-3 encoder proves div-by-zero trivially, multi-arch.
Not yet meson-wired (next step) and no fold-side IR/encoder yet (Phase 2-3);
this commit is the validated vendor + smoke tool.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
95 lines
4.7 KiB
C++
95 lines
4.7 KiB
C++
/* ###
|
|
* IP: GHIDRA
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
/// \file override.hh
|
|
/// \brief A system for sending override commands to the decompiler
|
|
|
|
#ifndef __OVERRIDE_HH__
|
|
#define __OVERRIDE_HH__
|
|
|
|
#include "database.hh"
|
|
|
|
namespace ghidra {
|
|
|
|
class FuncCallSpecs; // Forward declaration
|
|
|
|
extern ElementId ELEM_DEADCODEDELAY; ///< Marshaling element \<deadcodedelay>
|
|
extern ElementId ELEM_FLOW; ///< Marshaling element \<flow>
|
|
extern ElementId ELEM_FORCEGOTO; ///< Marshaling element \<forcegoto>
|
|
extern ElementId ELEM_INDIRECTOVERRIDE; ///< Marshaling element \<indirectoverride>
|
|
extern ElementId ELEM_MULTISTAGEJUMP; ///< Marshaling element \<multistagejump>
|
|
extern ElementId ELEM_OVERRIDE; ///< Marshaling element \<override>
|
|
extern ElementId ELEM_PROTOOVERRIDE; ///< Marshaling element \<protooverride>
|
|
|
|
/// \brief A container of commands that override the decompiler's default behavior for a single function
|
|
///
|
|
/// Information about a particular function that can be overridden includes:
|
|
/// - sub-functions: How they are called and where they call to
|
|
/// - jumptables: Mark indirect jumps that need multistage analysis
|
|
/// - deadcode: Details about how dead code is eliminated
|
|
/// - data-flow: Override the interpretation of specific branch instructions
|
|
///
|
|
/// Commands exist independently of the main data-flow, control-flow, and symbol structures
|
|
/// and survive decompilation restart. A few analyses, mid transformation, insert a new command
|
|
/// to fix a problem that was discovered too late and then force a restart via Funcdata::setRestartPending()
|
|
///
|
|
/// The class accept new commands via the insert* methods. The decompiler applies them by
|
|
/// calling the apply* or get* methods.
|
|
class Override {
|
|
public:
|
|
/// \brief Enumeration of possible branch overrides
|
|
enum {
|
|
NONE = 0, ///< No override
|
|
BRANCH = 1, ///< Replace primary CALL or RETURN with suitable BRANCH operation
|
|
CALL = 2, ///< Replace primary BRANCH or RETURN with suitable CALL operation
|
|
CALL_RETURN = 3, ///< Replace primary BRANCH or RETURN with suitable CALL/RETURN operation
|
|
RETURN = 4 ///< Replace primary BRANCH or CALL with a suitable RETURN operation
|
|
};
|
|
private:
|
|
map<Address,Address> forcegoto; ///< Force goto on jump at \b targetpc to \b destpc
|
|
vector<int4> deadcodedelay; ///< Delay count indexed by address space
|
|
map<Address,Address> indirectover; ///< Override indirect at \b call-point into direct to \b addr
|
|
map<Address,FuncProto *> protoover; ///< Override prototype at \b call-point
|
|
vector<Address> multistagejump; ///< Addresses of indirect jumps that need multistage recovery
|
|
map<Address,uint4> flowoverride; ///< Override the CALL <-> BRANCH
|
|
void clear(void); ///< Clear the entire set of overrides
|
|
static string generateDeadcodeDelayMessage(int4 index,Architecture *glb);
|
|
public:
|
|
~Override(void) { clear(); } ///< Destructor
|
|
void insertForceGoto(const Address &targetpc,const Address &destpc);
|
|
void insertDeadcodeDelay(AddrSpace *spc,int4 delay);
|
|
bool hasDeadcodeDelay(AddrSpace *spc) const;
|
|
void insertIndirectOverride(const Address &callpoint,const Address &directcall);
|
|
void insertProtoOverride(const Address &callpoint,FuncProto *p);
|
|
void insertMultistageJump(const Address &addr);
|
|
void insertFlowOverride(const Address &addr,uint4 type);
|
|
|
|
void applyPrototype(Funcdata &data,FuncCallSpecs &fspecs) const;
|
|
void applyIndirect(Funcdata &data,FuncCallSpecs &fspecs) const;
|
|
bool queryMultistageJumptable(const Address &addr) const;
|
|
void applyDeadCodeDelay(Funcdata &data) const;
|
|
void applyForceGoto(Funcdata &data) const;
|
|
bool hasFlowOverride(void) const { return (!flowoverride.empty()); } ///< Are there any flow overrides
|
|
uint4 getFlowOverride(const Address &addr) const;
|
|
void printRaw(ostream &s,Architecture *glb) const;
|
|
void generateOverrideMessages(vector<string> &messagelist,Architecture *glb) const;
|
|
void encode(Encoder &encoder,Architecture *glb) const;
|
|
void decode(Decoder &decoder,Architecture *glb);
|
|
static string typeToString(uint4 tp); ///< Convert a flow override type to a string
|
|
static uint4 stringToType(const string &nm); ///< Convert a string to a flow override type
|
|
};
|
|
|
|
} // End namespace ghidra
|
|
#endif
|