c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
110 lines
5 KiB
Meson
110 lines
5 KiB
Meson
# Vendored Ghidra decompiler (Apache-2.0, pinned — see VENDOR.md).
|
|
# Builds libghidra_decompiler.a (full SSA decompiler), the SLEIGH spec compiler,
|
|
# the per-arch .sla, and the pcode_dump smoke tool. Third-party code: warnings
|
|
# suppressed and pinned to C++11 (the std it is validated against), independent
|
|
# of fold's own warning/std flags.
|
|
|
|
cpp_dir = 'cpp'
|
|
# Use the z library without injecting SDK include dirs. On macOS Meson's zlib
|
|
# dependency reports the SDK's usr/include as a normal -I path, which can appear
|
|
# before libc++'s resource headers and break <cstdio>/<cstdlib> lookup. The
|
|
# headers are available through the compiler's default sysroot, so the link-only
|
|
# dependency is sufficient for the vendored decompiler sources.
|
|
zlib_dep = cpp.find_library('z', required: true)
|
|
|
|
# Object sets mirror the upstream cpp/Makefile (CORE / DECCORE / SLEIGH).
|
|
ghidra_core = [
|
|
'xml', 'marshal', 'space', 'float', 'address', 'pcoderaw', 'translate',
|
|
'opcodes', 'globalcontext',
|
|
]
|
|
ghidra_deccore = [
|
|
'capability', 'architecture', 'options', 'graph', 'cover', 'block', 'cast',
|
|
'typeop', 'database', 'cpool', 'comment', 'stringmanage', 'modelrules',
|
|
'fspec', 'action', 'loadimage', 'grammar', 'varnode', 'op', 'type',
|
|
'variable', 'varmap', 'jumptable', 'emulate', 'emulateutil', 'flow',
|
|
'userop', 'expression', 'multiprecision', 'funcdata', 'funcdata_block',
|
|
'funcdata_op', 'funcdata_varnode', 'unionresolve', 'pcodeinject', 'heritage',
|
|
'prefersplit', 'rangeutil', 'ruleaction', 'subflow', 'blockaction', 'merge',
|
|
'double', 'transform', 'constseq', 'bitfield', 'coreaction', 'condexe',
|
|
'override', 'dynamic', 'crc32', 'prettyprint', 'printlanguage', 'printc',
|
|
'printjava', 'memstate', 'opbehavior', 'paramid', 'signature',
|
|
]
|
|
ghidra_sleigh = [
|
|
'sleigh', 'pcodeparse', 'pcodecompile', 'sleighbase', 'slghsymbol',
|
|
'slghpatexpress', 'slghpattern', 'semantics', 'context', 'slaformat',
|
|
'compression', 'filemanage',
|
|
]
|
|
# Architecture / loader infrastructure (the EXTRA set, minus the BFD loader,
|
|
# the GUI bridge, the SLEIGH compiler, the CLI console, and tests). Provides
|
|
# SleighArchitecture + the spec-loading machinery the lifter embeds.
|
|
ghidra_arch = [
|
|
'sleigh_arch', 'inject_sleigh', 'loadimage_xml', 'xml_arch', 'raw_arch',
|
|
]
|
|
|
|
ghidra_inc = include_directories(cpp_dir)
|
|
ghidra_args = ['-w'] # vendored: do not police upstream warnings
|
|
ghidra_opts = ['cpp_std=c++11', 'werror=false', 'optimization=2']
|
|
|
|
lib_srcs = []
|
|
foreach n : ghidra_core + ghidra_deccore + ghidra_sleigh + ghidra_arch
|
|
lib_srcs += files(cpp_dir / (n + '.cc'))
|
|
endforeach
|
|
|
|
ghidra_decompiler = static_library(
|
|
'ghidra_decompiler', lib_srcs,
|
|
cpp_args: ghidra_args, override_options: ghidra_opts,
|
|
include_directories: ghidra_inc, dependencies: [zlib_dep], install: false,
|
|
)
|
|
# link_whole: Ghidra registers print-language / architecture / loader
|
|
# capabilities via global constructors; a plain static-lib link drops those
|
|
# objects (nothing references them directly) and the decompiler then fails with
|
|
# "No print languages registered". Whole-archive keeps every static initializer.
|
|
ghidra_decompiler_dep = declare_dependency(
|
|
link_whole: ghidra_decompiler, include_directories: ghidra_inc,
|
|
dependencies: [zlib_dep],
|
|
)
|
|
|
|
# SLEIGH spec compiler: CORE + SLEIGH runtime + the compiler-only TUs.
|
|
sleigh_srcs = []
|
|
foreach n : ghidra_core + ghidra_sleigh + ['slgh_compile', 'slghparse', 'slghscan']
|
|
sleigh_srcs += files(cpp_dir / (n + '.cc'))
|
|
endforeach
|
|
ghidra_sleigh_exe = executable(
|
|
'ghidra_sleigh', sleigh_srcs,
|
|
cpp_args: ghidra_args, override_options: ghidra_opts,
|
|
include_directories: ghidra_inc, dependencies: [zlib_dep], install: false,
|
|
)
|
|
|
|
# Compile target-arch .sla into the build dir (single-file form keeps the
|
|
# source tree clean). Add arches here as their specs are vendored.
|
|
ghidra_sla = []
|
|
foreach spec : ['AARCH64/AARCH64', 'AARCH64/AARCH64_AppleSilicon', 'AARCH64/AARCH64BE',
|
|
'x86/x86-64', 'x86/x86']
|
|
base = spec.split('/')[1]
|
|
ghidra_sla += custom_target(base + '.sla',
|
|
input: files('specs' / (spec + '.slaspec')),
|
|
output: base + '.sla',
|
|
command: [ghidra_sleigh_exe, '@INPUT@', '@OUTPUT@'],
|
|
build_by_default: true,
|
|
)
|
|
endforeach
|
|
|
|
# Phase-1 smoke tool: lift a raw buffer to P-Code (no fold deps, no BFD).
|
|
pcode_dump_exe = executable(
|
|
'pcode_dump', files('../../tools/pcode_dump.cpp'),
|
|
cpp_args: ghidra_args, override_options: ghidra_opts,
|
|
dependencies: [ghidra_decompiler_dep], install: false,
|
|
)
|
|
|
|
# Phase-2 lifter glue + smoke driver. The glue (ghidra_lifter.cpp) includes the
|
|
# Ghidra headers but is compiled at fold's C++ std (it returns std::optional /
|
|
# fold::ir::pcode), linking the c++11-built ghidra lib. Warnings suppressed for
|
|
# the Ghidra-header-heavy TU.
|
|
fold_include = include_directories('../../include')
|
|
ghidra_lifter_exe = executable(
|
|
'pcode_lift',
|
|
files('../../tools/pcode_lift.cpp', '../../src/binary/ghidra_lifter.cpp'),
|
|
cpp_args: ['-w'], override_options: ['werror=false'],
|
|
include_directories: [fold_include, ghidra_inc],
|
|
dependencies: [ghidra_decompiler_dep], install: false,
|
|
)
|