c08081a016
Unlocks the x86 family end-to-end and makes the write-loop detector precise enough for statically-linked binaries. x86 SLEIGH: - Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default); add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32. - ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the raw path, and bound decompiler flow at the function end (0xC3 tail fill) so variable-length x86 does not run away into zero padding. Precise SSA def-use (benefits all arches): - ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter records real def-use. summarizePointerWrites now resolves the store-address base via def-use instead of a last-write heuristic — essential on x86 where arg registers are reused as scratch (RAX) and sub-registers are written (SIL). - paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9). Precision (the key fix at scale): - A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed: if the loop index is `<`-compared against a pure parameter input, the function is size-bounded and not flagged. baby_bof's decode_base64 bounds on strlen(input) (a computed value, not a param) so it still fires. This cut a statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs) to 1 — the real decode_base64 → 264-byte overflow. Perf + reach: - Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the few callers of a write-loop callee that need the injected prototype). - Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS, default 120s) so large static binaries actually analyze (the 3s per-command watchdog left them with an empty function list). Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64 (index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
1.9 KiB
Text
53 lines
1.9 KiB
Text
# INFO This file automatically generated by andre on Fri Mar 16 15:13:25 2018
|
|
# INFO Direct edits to this file may be lost in future updates
|
|
# INFO Command line arguments: ['--sinc', '--cpuid-match', 'SHA']
|
|
|
|
# SHA1RNDS4 4-602 PAGE 1722 LINE 89511
|
|
define pcodeop sha1rnds4_sha ;
|
|
:SHA1RNDS4 XmmReg1, XmmReg2_m128, imm8 is vexMode=0 & byte=0x0F; byte=0x3A; byte=0xCC; (XmmReg1 & YmmReg1) ... & XmmReg2_m128; imm8
|
|
{
|
|
XmmReg1 = sha1rnds4_sha( XmmReg1, XmmReg2_m128, imm8:1 );
|
|
}
|
|
|
|
# SHA1NEXTE 4-604 PAGE 1724 LINE 89602
|
|
define pcodeop sha1nexte_sha ;
|
|
:SHA1NEXTE XmmReg1, XmmReg2_m128 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xC8; (XmmReg1 & YmmReg1) ... & XmmReg2_m128
|
|
{
|
|
XmmReg1 = sha1nexte_sha( XmmReg1, XmmReg2_m128 );
|
|
}
|
|
|
|
# SHA1MSG1 4-605 PAGE 1725 LINE 89654
|
|
define pcodeop sha1msg1_sha ;
|
|
:SHA1MSG1 XmmReg1, XmmReg2_m128 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xC9; (XmmReg1 & YmmReg1) ... & XmmReg2_m128
|
|
{
|
|
XmmReg1 = sha1msg1_sha( XmmReg1, XmmReg2_m128 );
|
|
}
|
|
|
|
# SHA1MSG2 4-606 PAGE 1726 LINE 89708
|
|
define pcodeop sha1msg2_sha ;
|
|
:SHA1MSG2 XmmReg1, XmmReg2_m128 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xCA; (XmmReg1 & YmmReg1) ... & XmmReg2_m128
|
|
{
|
|
XmmReg1 = sha1msg2_sha( XmmReg1, XmmReg2_m128 );
|
|
}
|
|
|
|
# SHA256RNDS2 4-607 PAGE 1727 LINE 89765
|
|
define pcodeop sha256rnds2_sha ;
|
|
:SHA256RNDS2 XmmReg1, XmmReg2_m128, XMM0 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xCB; (XmmReg1 & YmmReg1) ... & XmmReg2_m128 & XMM0
|
|
{
|
|
XmmReg1 = sha256rnds2_sha( XmmReg1, XmmReg2_m128, XMM0 );
|
|
}
|
|
|
|
# SHA256MSG1 4-609 PAGE 1729 LINE 89847
|
|
define pcodeop sha256msg1_sha ;
|
|
:SHA256MSG1 XmmReg1, XmmReg2_m128 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xCC; (XmmReg1 & YmmReg1) ... & XmmReg2_m128
|
|
{
|
|
XmmReg1 = sha256msg1_sha( XmmReg1, XmmReg2_m128 );
|
|
}
|
|
|
|
# SHA256MSG2 4-610 PAGE 1730 LINE 89900
|
|
define pcodeop sha256msg2_sha ;
|
|
:SHA256MSG2 XmmReg1, XmmReg2_m128 is vexMode=0 & byte=0x0F; byte=0x38; byte=0xCD; (XmmReg1 & YmmReg1) ... & XmmReg2_m128
|
|
{
|
|
XmmReg1 = sha256msg2_sha( XmmReg1, XmmReg2_m128 );
|
|
}
|
|
|