Remove handler-specific hacks

Author: mrexodia

devirt.py

@@ -161,12 +161,6 @@ def initial_state(self, *, symbolic_rcx: bool = True, rcx_value: int = 0) -> Tra
         return TraceState(regs, mem)
 
     def trace_handler(self, addr: int, state: TraceState) -> list[TraceOutcome]:
-        if addr == 0x14001606A:
-            return self._trace_binaryshield_push_reg64(state)
-        if addr == 0x140016126:
-            return self._trace_binaryshield_pop_reg32(state)
-        if addr == 0x14001676B:
-            return self._trace_binaryshield_jcc(state)
         with create_context() as context:
             types = context.types
             with context.create_module(f"trace_{addr:x}") as module:
@@ -255,137 +249,6 @@ def reg_ptr(reg_name: str) -> Value:
 
                 return self._read_outcomes(resolver, sem, result_ty, ram, state)
 
-    def _trace_binaryshield_push_reg64(self, state: TraceState) -> list[TraceOutcome]:
-        r13 = state.regs.get("r13")
-        r14 = state.regs.get("r14")
-        r15 = state.regs.get("r15")
-        rsp = state.regs.get("rsp")
-        if (
-            r13 is None
-            or r14 is None
-            or r15 is None
-            or rsp is None
-            or not r13.is_concrete
-            or not r14.is_concrete
-            or not r15.is_concrete
-            or not rsp.is_concrete
-        ):
-            return [TraceOutcome("unresolved", None, state)]
-
-        reg_index = self.container.get_data(r13.value or 0, 1)[0]
-        source_addr = (rsp.value or 0) + reg_index * 8
-        value_bytes = [state.mem.get(source_addr + i, AbsValue.concrete(8, 0)) for i in range(8)]
-        new_r15 = (r15.value or 0) - 8
-        post_mem = dict(state.mem)
-        for i, byte in enumerate(value_bytes):
-            post_mem[new_r15 + i] = byte
-
-        next_ptr = (r13.value or 0) + 1
-        target, post_r13 = self._dispatch_from_bytecode(next_ptr, r14.value or 0)
-        post_regs = dict(state.regs)
-        post_regs["rax"] = AbsValue.concrete(64, target)
-        post_regs["r13"] = AbsValue.concrete(64, post_r13)
-        post_regs["r15"] = AbsValue.concrete(64, new_r15)
-        return [TraceOutcome("jmp", target, TraceState(post_regs, post_mem))]
-
-    def _trace_binaryshield_pop_reg32(self, state: TraceState) -> list[TraceOutcome]:
-        r13 = state.regs.get("r13")
-        r14 = state.regs.get("r14")
-        r15 = state.regs.get("r15")
-        rsp = state.regs.get("rsp")
-        if (
-            r13 is None
-            or r14 is None
-            or r15 is None
-            or rsp is None
-            or not r13.is_concrete
-            or not r14.is_concrete
-            or not r15.is_concrete
-            or not rsp.is_concrete
-        ):
-            return [TraceOutcome("unresolved", None, state)]
-
-        reg_index = self.container.get_data(r13.value or 0, 1)[0]
-        dest_addr = (rsp.value or 0) + reg_index * 8
-        value_bytes = [state.mem.get((r15.value or 0) + i, AbsValue.concrete(8, 0)) for i in range(4)]
-        post_mem = dict(state.mem)
-        for i, byte in enumerate(value_bytes):
-            post_mem[dest_addr + i] = byte
-
-        next_ptr = (r13.value or 0) + 1
-        target, post_r13 = self._dispatch_from_bytecode(next_ptr, r14.value or 0)
-        post_regs = dict(state.regs)
-        post_regs["rax"] = AbsValue.concrete(64, target)
-        post_regs["r13"] = AbsValue.concrete(64, post_r13)
-        post_regs["r15"] = AbsValue.concrete(64, (r15.value or 0) + 4)
-        loaded = self._bytes_to_concrete(value_bytes)
-        post_regs["rbx"] = (
-            AbsValue.concrete(64, loaded)
-            if loaded is not None
-            else self.namer.new("rbx_pop32", 64)
-        )
-        return [TraceOutcome("jmp", target, TraceState(post_regs, post_mem))]
-
-    def _bytes_to_concrete(self, values: list[AbsValue]) -> int | None:
-        result = 0
-        for i, value in enumerate(values):
-            if not value.is_concrete:
-                return None
-            result |= (value.value or 0) << (8 * i)
-        return result
-
-    def _dispatch_from_bytecode(self, ptr: int, image_base: int) -> tuple[int, int]:
-        target_rva = int.from_bytes(self.container.get_data(ptr, 4), "little")
-        return image_base + target_rva, ptr + 4
-
-    def _trace_binaryshield_jcc(self, state: TraceState) -> list[TraceOutcome]:
-        r13 = state.regs.get("r13")
-        r14 = state.regs.get("r14")
-        r15 = state.regs.get("r15")
-        if (
-            r13 is None
-            or r14 is None
-            or r15 is None
-            or not r13.is_concrete
-            or not r14.is_concrete
-            or not r15.is_concrete
-        ):
-            return [TraceOutcome("unresolved", None, state)]
-
-        branch_rva = int.from_bytes(self.container.get_data(r13.value or 0, 4), "little")
-        fallthrough_ptr = (r13.value or 0) + 4
-        branch_ptr = (r14.value or 0) + branch_rva
-
-        flags_value = self._read_tracked_int(state.mem, r15.value or 0, 64)
-        if flags_value is None:
-            selected = [branch_ptr, fallthrough_ptr]
-        else:
-            zf = (flags_value >> 6) & 1
-            selected = [branch_ptr if zf == 0 else fallthrough_ptr]
-
-        outcomes: list[TraceOutcome] = []
-        for selected_ptr in selected:
-            target, post_r13 = self._dispatch_from_bytecode(selected_ptr, r14.value or 0)
-            post_regs = dict(state.regs)
-            post_regs["rax"] = AbsValue.concrete(64, target)
-            post_regs["r13"] = AbsValue.concrete(64, post_r13)
-            post_regs["r15"] = AbsValue.concrete(64, (r15.value or 0) + 8)
-            post_regs["cf"] = AbsValue.concrete(8, 0)
-            post_regs["zf"] = AbsValue.concrete(8, 0)
-            post_regs["sf"] = AbsValue.concrete(8, 0)
-            post_regs["of"] = AbsValue.concrete(8, 0)
-            outcomes.append(TraceOutcome("jmp", target, TraceState(post_regs, dict(state.mem))))
-        return outcomes
-
-    def _read_tracked_int(self, mem: dict[int, AbsValue], addr: int, width: int) -> int | None:
-        value = 0
-        for i in range(width // 8):
-            byte = mem.get(addr + i, AbsValue.concrete(8, 0))
-            if not byte.is_concrete:
-                return None
-            value |= (byte.value or 0) << (8 * i)
-        return value
-
     def _materialize_abs_value(self, types, abs_value: AbsValue, param: Value | None) -> Value:
         ty = types.int_n(abs_value.width)
         if abs_value.is_concrete: