trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/third_party/ghidra-decompiler/specs/x86/bmi2.sinc
trvon c08081a016
 feat: vendor x86-64 + 32-bit SLEIGH; precise SSA def-use; write-loop FP guard 
Unlocks the x86 family end-to-end and makes the write-loop detector precise
enough for statically-linked binaries.

x86 SLEIGH:
- Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default);
  add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32.
- ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the
  raw path, and bound decompiler flow at the function end (0xC3 tail fill) so
  variable-length x86 does not run away into zero padding.

Precise SSA def-use (benefits all arches):
- ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter
  records real def-use. summarizePointerWrites now resolves the store-address
  base via def-use instead of a last-write heuristic — essential on x86 where
  arg registers are reused as scratch (RAX) and sub-registers are written (SIL).
- paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9).

Precision (the key fix at scale):
- A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed:
  if the loop index is `<`-compared against a pure parameter input, the function
  is size-bounded and not flagged. baby_bof's decode_base64 bounds on
  strlen(input) (a computed value, not a param) so it still fires. This cut a
  statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs)
  to 1 — the real decode_base64 → 264-byte overflow.

Perf + reach:
- Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the
  few callers of a write-loop callee that need the injected prototype).
- Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS,
  default 120s) so large static binaries actually analyze (the 3s per-command
  watchdog left them with an empty function list).

Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64
(index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static
FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-01 10:34:28 -04:00

209 lines
5.5 KiB
Text
Raw Permalink Blame History

####
#### BMI2 instructions
####
:BZHI Reg32, rm32, vexVVVV_r32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_NONE) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf5; Reg32 ... & check_Reg32_dest ... & rm32
{
indexTmp:1 = vexVVVV_r32:1;
# saturate index amount to 32; operand size or higher does not clear any bits
shift:1 = (indexTmp <= 32) * (32 - indexTmp);
# clear the upper bits
Reg32 = (rm32 << shift) >> shift;
build check_Reg32_dest;
ZF = (Reg32 == 0);
SF = (Reg32 s< 0);
CF = indexTmp > 31;
OF = 0;
# AF and PF are undefined
}
@ifdef IA64
:BZHI Reg64, rm64, vexVVVV_r64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_NONE) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf5; Reg64 ... & rm64
{
indexTmp:1 = vexVVVV_r64:1;
# saturate index amount to 64; operand size or higher does not clear any bits
shift:1 = (indexTmp <= 64) * (64 - indexTmp);
# clear the upper bits
Reg64 = (rm64 << shift) >> shift;
ZF = (Reg64 == 0);
SF = (Reg64 s< 0);
CF = indexTmp > 63;
OF = 0;
# AF and PF are undefined
}
@endif
:MULX Reg32, vexVVVV_r32, rm32 is $(VEX_NDD) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf6; Reg32 ... & check_Reg32_dest ... & check_vexVVVV_r32_dest ... & rm32
{
temp:8 = zext(EDX) * zext(rm32);
vexVVVV_r32 = temp:4;
build check_vexVVVV_r32_dest;
Reg32 = temp(4);
build check_Reg32_dest;
}
@ifdef IA64
:MULX Reg64, vexVVVV_r64, rm64 is $(LONGMODE_ON) & $(VEX_NDD) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf6; Reg64 ... & rm64
{
temp:16 = zext(RDX) * zext(rm64);
vexVVVV_r64 = temp:8;
Reg64 = temp(8);
}
@endif
:PDEP Reg32, vexVVVV_r32, rm32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf5; Reg32 ... & check_Reg32_dest ... & rm32
{
sourceTmp:4 = vexVVVV_r32;
indexTmp:4 = 1;
resultTmp:4 = 0;
<loop>
maskBit:4 = rm32 & indexTmp;
if (maskBit == 0) goto <nextMaskBit>;
resultTmp = resultTmp | (maskBit * (sourceTmp & 1));
sourceTmp = sourceTmp >> 1;
<nextMaskBit>
indexTmp = indexTmp << 1;
if (indexTmp != 0) goto <loop>;
Reg32 = resultTmp;
build check_Reg32_dest;
}
@ifdef IA64
:PDEP Reg64, vexVVVV_r64, rm64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf5; Reg64 ... & rm64
{
sourceTmp:8 = vexVVVV_r64;
indexTmp:8 = 1;
resultTmp:8 = 0;
<loop>
maskBit:8 = rm64 & indexTmp;
if (maskBit == 0) goto <nextMaskBit>;
resultTmp = resultTmp | (maskBit * (sourceTmp & 1));
sourceTmp = sourceTmp >> 1;
<nextMaskBit>
indexTmp = indexTmp << 1;
if (indexTmp != 0) goto <loop>;
Reg64 = resultTmp;
}
@endif
:PEXT Reg32, vexVVVV_r32, rm32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F3) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf5; Reg32 ... & check_Reg32_dest ... & rm32
{
indexTmp:4 = 0x80000000;
resultTmp:4 = 0;
<loop>
maskBit:4 = rm32 & indexTmp;
if (maskBit == 0) goto <nextMaskBit>;
resultTmp = (resultTmp << 1) | zext((maskBit & vexVVVV_r32) != 0);
<nextMaskBit>
indexTmp = indexTmp >> 1;
if (indexTmp != 0) goto <loop>;
build check_Reg32_dest;
Reg32 = resultTmp;
}
@ifdef IA64
:PEXT Reg64, vexVVVV_r64, rm64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F3) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf5; Reg64 ... & rm64
{
indexTmp:8 = 0x8000000000000000;
resultTmp:8 = 0;
<loop>
maskBit:8 = rm64 & indexTmp;
if (maskBit == 0) goto <nextMaskBit>;
resultTmp = (resultTmp << 1) | zext((maskBit & vexVVVV_r64) != 0);
<nextMaskBit>
indexTmp = indexTmp >> 1;
if (indexTmp != 0) goto <loop>;
Reg64 = resultTmp;
}
@endif
:RORX Reg32, rm32, imm8 is $(VEX_NONE) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F3A) & $(VEX_W0); byte=0xf0; Reg32 ... & check_Reg32_dest ... & rm32; imm8
{
shiftTmp:1 = (imm8:1 & 0x1F);
Reg32 = (rm32 >> shiftTmp) | ( rm32 << (32 - shiftTmp));
build check_Reg32_dest;
}
@ifdef IA64
:RORX Reg64, rm64, imm8 is $(LONGMODE_ON) & $(VEX_NONE) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F3A) & $(VEX_W1); byte=0xf0; Reg64 ... & rm64; imm8
{
shiftTmp:1 = (imm8:1 & 0x3F);
Reg64 = (rm64 >> shiftTmp) | ( rm64 << (64 - shiftTmp));
}
@endif
:SARX Reg32, rm32, vexVVVV_r32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F3) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf7; Reg32 ... & check_Reg32_dest ... & rm32
{
Reg32 = rm32 s>> (vexVVVV_r32 & 0x0000001F);
build check_Reg32_dest;
}
@ifdef IA64
:SARX Reg64, rm64, vexVVVV_r64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F3) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf7; Reg64 ... & rm64
{
Reg64 = rm64 s>> (vexVVVV_r64 & 0x000000000000003F);
}
@endif
:SHLX Reg32, rm32, vexVVVV_r32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf7; Reg32 ... & check_Reg32_dest ... & rm32
{
Reg32 = rm32 << (vexVVVV_r32 & 0x0000001F);
build check_Reg32_dest;
}
@ifdef IA64
:SHLX Reg64, rm64, vexVVVV_r64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf7; Reg64 ... & rm64
{
Reg64 = rm64 << (vexVVVV_r64 & 0x000000000000003F);
}
@endif
:SHRX Reg32, rm32, vexVVVV_r32 is $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_r32; byte=0xf7; Reg32 ... & check_Reg32_dest ... & rm32
{
Reg32 = rm32 >> (vexVVVV_r32 & 0x0000001F);
build check_Reg32_dest;
}
@ifdef IA64
:SHRX Reg64, rm64, vexVVVV_r64 is $(LONGMODE_ON) & $(VEX_NDS) & $(VEX_LZ) & $(VEX_PRE_F2) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_r64; byte=0xf7; Reg64 ... & rm64
{
Reg64 = rm64 >> (vexVVVV_r64 & 0x000000000000003F);
}
@endif
Reference in a new issue View git blame Copy permalink