Skip to content
Snippets Groups Projects
  1. Aug 12, 2017
    • Alessandro Di Federico's avatar
      Replace `getNext` with `nextNonMarker` · 47104c0f
      Alessandro Di Federico authored
      Most of the times, when we need to get the next instruction, we actually
      want to skip over "marker" function calls (e.g., calls to `newpc` and
      `function_call`). `nextNonMarker` does exactly this.
      
      `FunctionCallIdentification::isCall` and `JumpTargetManager::setCFGForm`
      have also been extended to correctly handle such situations.
      47104c0f
  2. Aug 01, 2017
  3. Apr 21, 2017
    • Alessandro Di Federico's avatar
      Fix GCC 6.3.0 warnings · 24c1df35
      Alessandro Di Federico authored
      This commit fixes some warnings given by GCC 6.3.0.
      
      * Some `assert(false)` are not recognized as `noreturn`ing. They have
        been replaced with `llvm_unreachable`.
      * Added `-Wno-ignored-attributes`: attributes are not part the function
        name mangling, and therefore they might create some problems when they
        are involved in template arguments. We don't care.
      * Specializations of `readPointer` functions in `binaryfile.h` are now
        `inline`, so they don't appear as "unused" functions.
      24c1df35
  4. Mar 02, 2017
    • Alessandro Di Federico's avatar
      When splitting a basic block, retranslate · 04a4591f
      Alessandro Di Federico authored
      This commit should fix some bugs due to the fact that when we're
      splitting a basic block we don't retranslate the basic block at the
      split point but preserve the existing code. This lead to problems, in
      particular in x86-64 where certain QEMU local variables were not
      available. This change should fix it.
      
      Basically, every time we split a basic block in
      `JumpTargetManager::registerJT` we note down that the new basic block
      must be purged, and in `JumpTargetManager::harvest` we perform the
      purge. `harvest` has been chosen since it's a particularly quiet moment,
      i.e., there should be no pending references/iterator to code we have to
      delete.
      04a4591f
  5. Jan 23, 2017
    • Alessandro Di Federico's avatar
      Function detection: drop normalized address space · c3fbcf31
      Alessandro Di Federico authored
      We used to have a normalized address space formed only functions,
      skipping all the holes. This was employed to identify "skipping
      jumps". However, this method was ineffective, and we changed the
      definition of skipping jump as a jump skipping over CFEPs that are
      highly likely to be actual functions.
      
      This commit removes the leftovers of the normalized address space
      computation, which was also the cause of a bug in function detection.
      c3fbcf31
  6. Jan 11, 2017
  7. Dec 08, 2016
    • Alessandro Di Federico's avatar
      Introduce the GCBI and FCI passes · 5c619ab0
      Alessandro Di Federico authored
      This commit introduces two new passes:
      
      * `GeneratedCodeBasicInfo`: recovers from the IR some basic information
        like the size of delay slots in the input architecture, the name of
        the program counter and so on. It can also identify the type of a
        basic block (e.g., dispatcher, jump target...).  *
      * `FunctionCallIdentification`: identifies function calls and injects a
        marker before the associated terminator instruction.
      
      The idea of these two passes is to try to progressively move information
      we used to keep in `JumpTargetManager` into the IR, so that it is more
      easily accessible and passes do not need a reference to `JTM`.
      
      In particular by having markers for function calls available during jump
      target discovery we don't have to have duplicated and suboptimal
      implementation of `isCall`.
      
      This commit also introduce some additional helper functions and an
      helper class to quickly.
      5c619ab0
  8. Dec 03, 2016
    • Alessandro Di Federico's avatar
      Rework the `noreturn` detection · d3d73159
      Alessandro Di Federico authored
      This commit improves the `NoreturnAnalysis` by inflating the set of
      killer basic blocks using the set of basic blocks post-dominated by the
      set of killer basic blocks. To do so, we temporarily replace the
      successor of all the killer basic blocks with a single basic block (the
      "sink") and then computed the set of basic blocks it post-dominates.
      
      To improve the precision of our analysis we work on the CFG in
      `NoFunctionCallsCFG` form, so we don't "infect" functions called by kill
      basic blocks. However, since we work in this CFG form, we need to
      manually collect the list of basic blocks calling a killer function and
      compute the set of basic blocks they post-dominate.
      d3d73159
    • Alessandro Di Federico's avatar
      Introduce the `NoFunctionCallsCFG` CFG form · 09e25267
      Alessandro Di Federico authored
      `NoFunctionCallsCFG` is a form of the CFG where all the function call
      edges are replaced with jumps to the return address. This is beneficial
      in certain analysis to pretend we're working on a function-level.
      
      To implement such a form of CFG we now emit right before the terminator
      of each caller basic block a call to the "function_call" function
      passing as the first parameter the callee basic block and as the second
      one the return basic block. Using this function calls, switching to
      `NoFunctionCallsCFG` and back becomes straightforward.
      09e25267
    • Alessandro Di Federico's avatar
    • Alessandro Di Federico's avatar
      Keep the CFG simple: do not jump to the dispatcher · c069700b
      Alessandro Di Federico authored
      Every time we don't know where an indirect jump can go, we used to emit
      a jump to the dispatcher, however this complicates our analyses, in
      particular the computed dominator tree provides less useful information
      than it could.
      
      This commit transforms all the jumps to the dispatcher into jumps to a
      "anypc" basic block which during analysis just contains an unreachable
      instruction, but during finalization this instruction is replaced with a
      jump to the dispatcher. A similar (temporary) situation is for the
      "unexpectepc" case.
      
      This commit also makes the `visit(Sucessors|Predecessors)` functions
      more idiomatic by employing a trait for black lists.
      c069700b
    • Alessandro Di Federico's avatar
      Associate each BB with the functions it belongs to · 786c809e
      Alessandro Di Federico authored
      Create a MDNode for each identified function and associate to the
      terminator instruction of each basic block a list containing a reference
      to the MDNodes identifying the functions it belongs to.
      786c809e
  9. Sep 20, 2016
  10. Sep 17, 2016
    • Alessandro Di Federico's avatar
      Introduce `NoreturnAnalysis` · cc87ad60
      Alessandro Di Federico authored
      This commit introduces the `noreturn` analysis, whose aim is to detect
      all the basic blocks the are doomed to lead to a `noreturn` syscall such
      as `execve` or `exit`.
      
      * Implement `NoreturnAnalysis`.
      * Include and initialize in the `Architecture` data structure all the
        necessary information to detect `noreturn` syscalls. Specifically, the
        name of the QEMU helper for syscalls, the name of the register holding
        the syscall number and the syscall numbers representing `noreturn`
        syscalls.
      * `ReachingDefinitionsPass`: make reaching definitions available both in
        reaching definitions mode and reached loads mode. This part needs
        further cleanup. We also might be willing to implement this with a
        `Boost.Bimap`.
      * Use `SET` to collect information useful for the
        `NoreturnAnalysis`. Also restructure how the `OperationsStack` works
        to be more streamlined and keep track of multiple information about
        the instruction currently being tracked.
      cc87ad60
    • Alessandro Di Federico's avatar
      Introduce `FunctionBoundariesDetectionPass` · 37de0a00
      Alessandro Di Federico authored
      `FunctionBoundariesDetectionPass` implements our function detection
      system.
      37de0a00
Loading