c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
257 lines
4.9 KiB
Text
257 lines
4.9 KiB
Text
define pcodeop encls_ecreate;
|
|
define pcodeop encls_eadd;
|
|
define pcodeop encls_einit;
|
|
define pcodeop encls_einit_ZF;
|
|
define pcodeop encls_eremove;
|
|
define pcodeop encls_eremove_ZF;
|
|
define pcodeop encls_edbgrd;
|
|
define pcodeop encls_edbgrd_RBX;
|
|
define pcodeop encls_edbgwr;
|
|
define pcodeop encls_eextend;
|
|
define pcodeop encls_eldb;
|
|
define pcodeop encls_eldb_ZF;
|
|
define pcodeop encls_eldu;
|
|
define pcodeop encls_eldu_ZF;
|
|
define pcodeop encls_eblock;
|
|
define pcodeop encls_eblock_ZF;
|
|
define pcodeop encls_epa;
|
|
define pcodeop encls_ewb;
|
|
define pcodeop encls_ewb_ZF;
|
|
define pcodeop encls_ewb_CF;
|
|
define pcodeop encls_etrack;
|
|
define pcodeop encls_etrack_ZF;
|
|
define pcodeop encls_eaug;
|
|
define pcodeop encls_emodpr;
|
|
define pcodeop encls_emodpr_ZF;
|
|
define pcodeop encls_emodt;
|
|
define pcodeop encls_emodt_ZF;
|
|
define pcodeop encls_unknown;
|
|
|
|
:ENCLS is vexMode=0 & byte=0x0f; byte=0x01; byte=0xcf {
|
|
|
|
if ( EAX != 0x0 ) goto <leaf_1>;
|
|
encls_ecreate( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_1>
|
|
if ( EAX != 0x1 ) goto <leaf_2>;
|
|
encls_eadd( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_2>
|
|
if ( EAX != 0x2 ) goto <leaf_3>;
|
|
RAX = encls_einit( RBX, RCX, RDX );
|
|
ZF = encls_einit_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_3>
|
|
if ( EAX != 0x3 ) goto <leaf_4>;
|
|
RAX = encls_eremove( RCX );
|
|
ZF = encls_eremove_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_4>
|
|
if ( EAX != 0x4 ) goto <leaf_5>;
|
|
RAX = encls_edbgrd( RCX );
|
|
RBX = encls_edbgrd_RBX( RCX );
|
|
goto <done>;
|
|
|
|
<leaf_5>
|
|
if ( EAX != 0x5 ) goto <leaf_6>;
|
|
RAX = encls_edbgwr( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_6>
|
|
if ( EAX != 0x6 ) goto <leaf_7>;
|
|
encls_eextend( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_7>
|
|
if ( EAX != 0x7 ) goto <leaf_8>;
|
|
RAX = encls_eldb( RBX, RCX, RDX );
|
|
ZF = encls_eldb_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_8>
|
|
if ( EAX != 0x8 ) goto <leaf_9>;
|
|
RAX = encls_eldu( RBX, RCX, RDX );
|
|
ZF = encls_eldu_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_9>
|
|
if ( EAX != 0x9 ) goto <leaf_A>;
|
|
RAX = encls_eblock( RCX );
|
|
ZF = encls_eblock_ZF( RCX );
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_A>
|
|
if ( EAX != 0xA ) goto <leaf_B>;
|
|
encls_epa( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_B>
|
|
if ( EAX != 0xB ) goto <leaf_C>;
|
|
RAX = encls_ewb( RBX, RCX, RDX );
|
|
ZF = encls_ewb_ZF( RBX, RCX, RDX );
|
|
CF = encls_ewb_CF( RBX, RCX, RDX );
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_C>
|
|
if ( EAX != 0xC ) goto <leaf_D>;
|
|
RAX = encls_etrack( RCX );
|
|
ZF = encls_etrack_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_D>
|
|
if ( EAX != 0xD ) goto <leaf_E>;
|
|
encls_eaug( RBX, RCX, RDX );
|
|
goto <done>;
|
|
|
|
<leaf_E>
|
|
if ( EAX != 0xE ) goto <leaf_F>;
|
|
RAX = encls_emodpr( RBX, RCX );
|
|
ZF = encls_emodpr_ZF( RCX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_F>
|
|
if ( EAX != 0xF ) goto <unknown>;
|
|
RAX = encls_emodt( RBX, RCX );
|
|
ZF = encls_emodt_ZF( RCX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<unknown>
|
|
encls_unknown();
|
|
|
|
<done>
|
|
}
|
|
|
|
|
|
define pcodeop enclu_ereport;
|
|
define pcodeop enclu_egetkey;
|
|
define pcodeop enclu_egetkey_ZF;
|
|
define pcodeop enclu_eenter_EAX;
|
|
define pcodeop enclu_eenter_RCX;
|
|
define pcodeop enclu_eenter_TF;
|
|
define pcodeop enclu_eresume;
|
|
define pcodeop enclu_eexit;
|
|
define pcodeop enclu_eexit_TF;
|
|
define pcodeop enclu_eaccept;
|
|
define pcodeop enclu_eaccept_ZF;
|
|
define pcodeop enclu_emodpe;
|
|
define pcodeop enclu_eacceptcopy;
|
|
define pcodeop enclu_eacceptcopy_ZF;
|
|
define pcodeop enclu_unknown;
|
|
|
|
:ENCLU is vexMode=0 & byte=0x0f; byte=0x01; byte=0xd7 {
|
|
|
|
if ( EAX != 0x0 ) goto <leaf_1>;
|
|
enclu_ereport( RBX, RCX, RDX );
|
|
goto <done>;
|
|
|
|
<leaf_1>
|
|
if ( EAX != 0x1 ) goto <leaf_2>;
|
|
RAX = enclu_egetkey( RBX, RCX );
|
|
ZF = enclu_egetkey_ZF( RBX, RCX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_2>
|
|
if ( EAX != 0x2 ) goto <leaf_3>;
|
|
tempBX:8 = RBX;
|
|
tempCX:8 = RCX;
|
|
|
|
EAX = enclu_eenter_EAX( tempBX, tempCX );
|
|
RCX = enclu_eenter_RCX( tempBX, tempCX );
|
|
TF = enclu_eenter_TF( tempBX, tempCX );
|
|
goto <done>;
|
|
|
|
<leaf_3>
|
|
if ( EAX != 0x3 ) goto <leaf_4>;
|
|
TF = enclu_eresume( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_4>
|
|
if ( EAX != 0x4 ) goto <leaf_5>;
|
|
RCX = enclu_eexit( RBX );
|
|
TF = enclu_eexit_TF( RBX );
|
|
goto <done>;
|
|
|
|
<leaf_5>
|
|
if ( EAX != 0x5 ) goto <leaf_6>;
|
|
RAX = enclu_eaccept( RBX, RCX );
|
|
ZF = enclu_eaccept_ZF( RBX, RCX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<leaf_6>
|
|
if ( EAX != 0x6 ) goto <leaf_7>;
|
|
enclu_emodpe( RBX, RCX );
|
|
goto <done>;
|
|
|
|
<leaf_7>
|
|
if ( EAX != 0x7 ) goto <unknown>;
|
|
RAX = enclu_eacceptcopy( RBX, RCX, RDX );
|
|
ZF = enclu_eacceptcopy_ZF( RBX, RCX, RDX );
|
|
CF = 0;
|
|
PF = 0;
|
|
AF = 0;
|
|
OF = 0;
|
|
SF = 0;
|
|
goto <done>;
|
|
|
|
<unknown>
|
|
enclu_unknown();
|
|
|
|
<done>
|
|
}
|