|
| 1 | +#include "lifter_arm.h" |
| 2 | +#include <capstone/arm.h> |
| 3 | +#include <fmt/format.h> |
| 4 | +#include <algorithm> |
| 5 | +#include <cstring> |
| 6 | + |
| 7 | +namespace hype { |
| 8 | + |
| 9 | +Varnode LifterARM::reg_vn(int reg_id) { |
| 10 | + if (reg_id == ARM_REG_INVALID) return vn_const(0); |
| 11 | + |
| 12 | + int sz = 4; |
| 13 | + const char* name = "unk"; |
| 14 | + |
| 15 | + if (reg_id >= ARM_REG_R0 && reg_id <= ARM_REG_R12) { |
| 16 | + static thread_local char buf[8]; |
| 17 | + std::snprintf(buf, sizeof(buf), "r%d", reg_id - ARM_REG_R0); |
| 18 | + name = buf; |
| 19 | + } else if (reg_id == ARM_REG_SP) { name = "sp"; } |
| 20 | + else if (reg_id == ARM_REG_LR) { name = "lr"; } |
| 21 | + else if (reg_id == ARM_REG_PC) { name = "pc"; } |
| 22 | + |
| 23 | + return vn_reg(reg_id, name, sz); |
| 24 | +} |
| 25 | + |
| 26 | +Varnode LifterARM::operand_read(const Insn& insn, int idx, PcodeBlock& out) { |
| 27 | + if (idx >= insn.op_count) return vn_const(0); |
| 28 | + auto& op = insn.ops[idx]; |
| 29 | + switch (op.type) { |
| 30 | + case OpType::Reg: |
| 31 | + return reg_vn(op.reg); |
| 32 | + case OpType::Imm: |
| 33 | + return vn_const(op.val); |
| 34 | + case OpType::Mem: { |
| 35 | + Varnode addr = vn_const(0); |
| 36 | + bool has = false; |
| 37 | + if (op.mem.base) { |
| 38 | + addr = reg_vn(op.mem.base); |
| 39 | + has = true; |
| 40 | + } |
| 41 | + if (op.mem.index) { |
| 42 | + Varnode idx_vn = reg_vn(op.mem.index); |
| 43 | + if (has) { |
| 44 | + Varnode t = alloc_temp(); |
| 45 | + emit(out, PcodeOp::ADD, t, {addr, idx_vn}); |
| 46 | + addr = t; |
| 47 | + } else { addr = idx_vn; } |
| 48 | + has = true; |
| 49 | + } |
| 50 | + if (op.mem.disp != 0) { |
| 51 | + Varnode d = vn_const(static_cast<u64>(op.mem.disp)); |
| 52 | + if (has) { |
| 53 | + Varnode t = alloc_temp(); |
| 54 | + emit(out, PcodeOp::ADD, t, {addr, d}); |
| 55 | + addr = t; |
| 56 | + } else { addr = d; } |
| 57 | + } |
| 58 | + Varnode res = alloc_temp(4); |
| 59 | + emit(out, PcodeOp::LOAD, res, {addr}); |
| 60 | + return res; |
| 61 | + } |
| 62 | + default: return vn_const(0); |
| 63 | + } |
| 64 | +} |
| 65 | + |
| 66 | +void LifterARM::operand_write(const Insn& insn, int idx, Varnode val, PcodeBlock& out) { |
| 67 | + if (idx >= insn.op_count) return; |
| 68 | + auto& op = insn.ops[idx]; |
| 69 | + if (op.type == OpType::Reg) { |
| 70 | + emit(out, PcodeOp::COPY, reg_vn(op.reg), {val}); |
| 71 | + } else if (op.type == OpType::Mem) { |
| 72 | + Varnode addr = vn_const(0); |
| 73 | + bool has = false; |
| 74 | + if (op.mem.base) { |
| 75 | + addr = reg_vn(op.mem.base); |
| 76 | + has = true; |
| 77 | + } |
| 78 | + if (op.mem.index) { |
| 79 | + Varnode idx_vn = reg_vn(op.mem.index); |
| 80 | + if (has) { |
| 81 | + Varnode t = alloc_temp(); |
| 82 | + emit(out, PcodeOp::ADD, t, {addr, idx_vn}); |
| 83 | + addr = t; |
| 84 | + } else { addr = idx_vn; } |
| 85 | + has = true; |
| 86 | + } |
| 87 | + if (op.mem.disp != 0) { |
| 88 | + Varnode d = vn_const(static_cast<u64>(op.mem.disp)); |
| 89 | + if (has) { |
| 90 | + Varnode t = alloc_temp(); |
| 91 | + emit(out, PcodeOp::ADD, t, {addr, d}); |
| 92 | + addr = t; |
| 93 | + } else { addr = d; } |
| 94 | + } |
| 95 | + emit(out, PcodeOp::STORE, {}, {addr, val}); |
| 96 | + } |
| 97 | +} |
| 98 | + |
| 99 | +Varnode LifterARM::alloc_temp(int sz) { return vn_temp(next_temp_++, sz); } |
| 100 | + |
| 101 | +void LifterARM::emit(PcodeBlock& b, PcodeOp op, Varnode out, std::vector<Varnode> in, va_t a) { |
| 102 | + PcodeInsn p; |
| 103 | + p.op = op; |
| 104 | + p.output = out; |
| 105 | + p.inputs = std::move(in); |
| 106 | + p.addr = a ? a : cur_addr_; |
| 107 | + p.seq = cur_seq_++; |
| 108 | + b.ops.push_back(std::move(p)); |
| 109 | +} |
| 110 | + |
| 111 | +void LifterARM::lift_insn(const Insn& insn, PcodeBlock& blk, const AnalysisDB& db) { |
| 112 | + cur_addr_ = insn.addr; |
| 113 | + cur_seq_ = 0; |
| 114 | + |
| 115 | + std::string_view mn(insn.mnemonic); |
| 116 | + |
| 117 | + if (mn == "mov" || mn == "movw" || mn == "movt") { |
| 118 | + Varnode src = operand_read(insn, 1, blk); |
| 119 | + operand_write(insn, 0, src, blk); |
| 120 | + } else if (mn == "add" || mn == "adds") { |
| 121 | + Varnode lhs = operand_read(insn, 1, blk); |
| 122 | + Varnode rhs = operand_read(insn, 2, blk); |
| 123 | + if (insn.op_count == 2) { |
| 124 | + lhs = operand_read(insn, 0, blk); |
| 125 | + rhs = operand_read(insn, 1, blk); |
| 126 | + } |
| 127 | + Varnode res = alloc_temp(lhs.size); |
| 128 | + emit(blk, PcodeOp::ADD, res, {lhs, rhs}); |
| 129 | + operand_write(insn, 0, res, blk); |
| 130 | + } else if (mn == "sub" || mn == "subs") { |
| 131 | + Varnode lhs = operand_read(insn, 1, blk); |
| 132 | + Varnode rhs = operand_read(insn, 2, blk); |
| 133 | + if (insn.op_count == 2) { |
| 134 | + lhs = operand_read(insn, 0, blk); |
| 135 | + rhs = operand_read(insn, 1, blk); |
| 136 | + } |
| 137 | + Varnode res = alloc_temp(lhs.size); |
| 138 | + emit(blk, PcodeOp::SUB, res, {lhs, rhs}); |
| 139 | + operand_write(insn, 0, res, blk); |
| 140 | + } else if (mn == "ldr" || mn == "ldrb" || mn == "ldrh") { |
| 141 | + Varnode res = operand_read(insn, 1, blk); |
| 142 | + operand_write(insn, 0, res, blk); |
| 143 | + } else if (mn == "str" || mn == "strb" || mn == "strh") { |
| 144 | + Varnode val = operand_read(insn, 0, blk); |
| 145 | + operand_write(insn, 1, val, blk); |
| 146 | + } else if (mn == "b" || mn == "bl" || mn == "bx" || mn == "blx") { |
| 147 | + va_t target = insn.branch_target(); |
| 148 | + if (mn == "bl" || mn == "blx") { |
| 149 | + Varnode fn_addr = vn_const(target); |
| 150 | + if (target) { |
| 151 | + auto it = db.names.find(target); |
| 152 | + if (it != db.names.end()) fn_addr.name = it->second; |
| 153 | + } |
| 154 | + emit(blk, PcodeOp::CALL, reg_vn(ARM_REG_R0), {fn_addr}); |
| 155 | + } else if (mn == "bx" && insn.ops[0].type == OpType::Reg && insn.ops[0].reg == ARM_REG_LR) { |
| 156 | + blk.has_return = true; |
| 157 | + emit(blk, PcodeOp::RETURN, {}, {reg_vn(ARM_REG_R0)}); |
| 158 | + } else { |
| 159 | + emit(blk, PcodeOp::BRANCH, {}, {vn_const(target)}); |
| 160 | + } |
| 161 | + } else { |
| 162 | + emit(blk, PcodeOp::NOP, alloc_temp(), {}); |
| 163 | + } |
| 164 | +} |
| 165 | + |
| 166 | +void LifterARM::lift_block(const BasicBlock& bb, const AnalysisDB& db, PcodeBlock& out) { |
| 167 | + out.addr = bb.start; |
| 168 | + for (auto& insn : bb.insns) |
| 169 | + lift_insn(insn, out, db); |
| 170 | +} |
| 171 | + |
| 172 | +PcodeFunc LifterARM::lift(const Function& func, const AnalysisDB& db) { |
| 173 | + next_temp_ = 256; |
| 174 | + PcodeFunc pf; |
| 175 | + pf.entry = func.entry; |
| 176 | + pf.name = func.name.empty() ? fmt::format("sub_{:X}", func.entry) : func.name; |
| 177 | + |
| 178 | + std::vector<va_t> order; |
| 179 | + for (auto& [addr, _] : func.blocks) order.push_back(addr); |
| 180 | + std::sort(order.begin(), order.end()); |
| 181 | + |
| 182 | + for (int i = 0; i < (int)order.size(); ++i) addr_to_block_[order[i]] = i; |
| 183 | + |
| 184 | + for (int i = 0; i < (int)order.size(); ++i) { |
| 185 | + auto it = func.blocks.find(order[i]); |
| 186 | + if (it == func.blocks.end()) continue; |
| 187 | + PcodeBlock blk; |
| 188 | + blk.id = i; |
| 189 | + lift_block(it->second, db, blk); |
| 190 | + for (va_t s : it->second.succs) { |
| 191 | + auto sit = addr_to_block_.find(s); |
| 192 | + if (sit != addr_to_block_.end()) blk.succs.push_back(sit->second); |
| 193 | + } |
| 194 | + pf.blocks.push_back(std::move(blk)); |
| 195 | + } |
| 196 | + |
| 197 | + for (int i = 0; i < (int)pf.blocks.size(); ++i) { |
| 198 | + for (int s : pf.blocks[i].succs) |
| 199 | + if (s >= 0 && s < (int)pf.blocks.size()) |
| 200 | + pf.blocks[s].preds.push_back(i); |
| 201 | + } |
| 202 | + |
| 203 | + pf.next_temp = next_temp_; |
| 204 | + pf.params = { reg_vn(ARM_REG_R0), reg_vn(ARM_REG_R1), reg_vn(ARM_REG_R2), reg_vn(ARM_REG_R3) }; |
| 205 | + addr_to_block_.clear(); |
| 206 | + return pf; |
| 207 | +} |
| 208 | + |
| 209 | +} |
0 commit comments