mirror of
https://gitlab.com/BinaryHardening/cfgrip
synced 2026-07-26 12:41:08 +00:00
x86byte
6c2dca78ab
- Extended prolog patterns: MSVC x64 callee-saves, sub rsp >= 0x20, enter - Tail-call detection: jmp to prolog candidates seeds new functions - endbr64/endbr32 CET skipping at function starts - PE .pdata exception table parsing for precise start/end boundaries - Data-section function pointer scanning (vtables, callbacks) - PLT stub detection with is_thunk tag - end_address and is_thunk fields in Function struct and JSON output - getDataRanges() and getRuntimeFunctions() in Binary interface - README docs for all new features + research paper reference
41 lines
1.3 KiB
C++
41 lines
1.3 KiB
C++
#pragma once
|
|
#include "types.hpp"
|
|
#include "loader/binary.hpp"
|
|
#include "disasm/engine.hpp"
|
|
#include <map>
|
|
#include <set>
|
|
#include <vector>
|
|
|
|
class CFGBuilder
|
|
{
|
|
public:
|
|
CFGBuilder(Binary* binary, Disassembler* disasm, bool subsOnly = false);
|
|
CFG build();
|
|
static void clean(CFG& cfg);
|
|
|
|
private:
|
|
void buildGotMap();
|
|
Function buildFunction(addr_t start, const string& name);
|
|
BasicBlock disassembleBlock(addr_t start, addr_t& next);
|
|
set<addr_t> findPrologs();
|
|
void scanDataPointers();
|
|
addr_t skipEndbr64(addr_t addr);
|
|
bool isPLTStub(const Function& func) const;
|
|
void markVisited(addr_t addr);
|
|
bool isVisited(addr_t addr);
|
|
|
|
addr_t resolveGOT(const Instruction& inst);
|
|
addr_t resolveJumpTable(const vector<Instruction>& block, const Instruction& inst);
|
|
addr_t traceReg(const string& reg, const vector<Instruction>& block, size_t idx);
|
|
void recordIndirect(const Instruction& inst, addr_t target, bool ok, const string& name, const string& lib);
|
|
|
|
Binary* m_bin;
|
|
Disassembler* m_dis;
|
|
bool m_subs_only;
|
|
set<addr_t> m_funcs;
|
|
set<addr_t> m_blocks;
|
|
set<addr_t> m_prologs;
|
|
map<addr_t, pair<string, string>> m_got;
|
|
vector<IndirectTarget> m_targets;
|
|
};
|