Commit Graph

39 Commits

Author SHA1 Message Date
Peter Goodman b0f7790f43 Sparc support (#709)
* Adds sparc support; formats files

* Update the readme and walkthrough

* Minor tweaks to readme/walkthrough

* Update ci.yml
2020-11-05 12:59:20 -05:00
Peter Goodman 31f267bd5f Cmake refactor (#693)
* Update to latest remill APIs and way of using CMake.

* Minor fixes

* Bug fixes for AArch64

* Tweaks

* Adds some nifty functionality useful for debugging some aarch64 bugs

* Fixes a subtle bug

* Bug fixes

* Make the test suite use explicit args

* Bug fix in xrefs

* Disable tests for now
2020-09-22 23:22:56 -04:00
Peter Goodman c002b8505c Formats the code with clang-format and my additional stylistic mojojojo (#682) 2020-08-05 16:14:01 -04:00
Peter Goodman 2d55d02cc3 API improvements. Must be used with the api_improvements branches of Remill and Anvill (#666)
* API improvements. Must be used with the api_improvements branch of both Remill and McSema

fixes for x86 and running the lifted code with klee

* Update dockerfile to clone anvill

* update remill commit id

* Add python3 to dockerfile

* update python3

* disable abi script

* Updated cmake to find anvill

* Update main.cpp

* update find_package for anvill

* WIP:updated prebuild cfg

* update prebuild cfg files

* enable abi build for testsuite

* Fix memory leak

* install missing package for testcases

* frontend: Reflect cfg file changes in dyninst frontend.

* frontend: Update local files copyrights to reflect overall change to agplv3.

* fix failing testcases

* update test cfgs

* Fix test failure with local state pointer

* set the flag to use local state_ptr in default mode

Co-authored-by: kumarak <iit.akshay@gmail.com>
Co-authored-by: Lukas Korencik <xkorenc1@fi.muni.cz>
2020-07-23 02:14:56 -04:00
Aiethel 8ecfe165ef Various improvements (#628)
* bc: Inline calls to semantic functions and wrappers manually.

* bc: Inline calls to semantics and wrappers only if some flags are set.

* Refactor code that is responsible for abi libs loading.

* Wrap global pointers in RAII.

* Update .remill_commit_id

Co-authored-by: Peter Goodman <peter.goodman@gmail.com>
2020-02-10 13:20:05 -05:00
Peter Goodman 5278102cad Various useful fixes (#624) 2020-01-10 16:05:37 -05:00
Peter Goodman 3ba9d58594 Bump remill version, adapt to minor change of API in InstructionLifter. 2018-09-19 19:07:05 -04:00
kumarak 1f3045f7da Resolve the references of stack variable referred using stack pointers (#431)
* Resolve the references of stack variable when referred using stack pointer;

* review changes

* Update Instruction.cpp
2018-07-06 13:41:33 -04:00
Peter Goodman bda3af4c56 Dead store elim (#428)
* Update to use remill's dead store elimination, and be compatible with the indirection-removal done by Arch::PrepareModule.

* Fixes

* Update .remill_commit_id

* Update .remill_commit_id

* Update .remill_commit_id

* Update .remill_commit_id

* Update .remill_commit_id

* Update .remill_commit_id
2018-06-28 21:05:31 -04:00
kumarak a3483e4bf1 C++ exception handling support (#391)
* Initial changes to parse the eh_frame and exception table

* linearly scan the function to find missing blocks

* Update protobuf format for lp; need to tag instructions or basic blocks to associate it with the lp

* tag instructions with lp; removed debug logs

* updated comments and protobuf; use utility functions for pointer size;

* travis build failure; make lp_ea optional field

* Collect the exception handling bb chunks; Create a passthrough for the lifted landingpad;

* Generate the passthrough IR and attach the landing pad with function invoke

* Generate the eh_frame/exception table and add personality function with one raising the exception.

* catch/cleanup wrapper for the exception handling; Disable CFG simplification pass temporarily for invoke inst;

* invoke wrapper to fix stack and base pointers

* recover type indices of the exception type

* fix exception table offset

* Add the function definition for setting the rsp/rpb correctly after eh return;

* Changes for abi_library support in exception handling

* Remove unwind attribute from ext_* functions to generate eh table

* Support the lifting of multiple exception types thrown;

* Fix the multiple declaration of personality function in lifted bitcode;

* Add --recover_exception flag to lift the exception table

* Update the list of external functions with c++ ABI's; Fix basic block split issue for exception chunks;

* Weak linkage for external function causing the garbage value for out_of_range destructor. Temporarily disabled;

* cleanup redundant changes and resolve conflicts

* Update --std-defs list with the c++ exception ABIs

* Fix merge fail

* exception test binaries for integration test; Move to clang++ for recompiling the bitcode.

* Fix the exception handling support for llvm 3.5

* Disable the optimization passes for the function having landingpad;

* Temporary changes to add ABI libraries for exception tests.

* Remove the noreturn attribute to fix the problem with -03 optimization

* review comment changes

* Change wrapper function name across invoke;

* review changes

* Updated comments text

* Remove duplicate clauses from the list; Add arguments for personalityfn and fix review comments.

* Update the flag name to --exception_personalityfn;

* Update the flag name to --exception_personality_func;

* Follow the variable naming convention;

* Update comments

* travis build fix for unused variable

* Create the map of type indices from original binary. Runtime routine to fix the RDX with correct type index;

* Add _Unwind_Resume to --abi_libraries functions list;

* Update comments & code restructure

* Exception handling changes and utility functions for 32 bit;

* DWORD for 32-bit system
2018-04-12 14:05:45 -04:00
Peter Goodman c5ceac27e8 Use 80-column lines (#352) 2017-12-11 14:32:19 -05:00
kumarak 45c34bcc76 Issue 306 indirect stack access (#336)
* Generate list of functions which are unsafe and might refer the stack variables indirectly;

* Collect the references to stack variable in the unsafe functions. Override the LiftRegisterOperand function and replace the base pointer instances with the frame value.

* Lift the stack variables as one frame object in variadic functions.

* remove debug logs and updated comments

* review changes and move check for the frame pointer register;

* Fix incorrect check for the frame pointer register;

* Check for x86 arch

* replace strcmp with the comparison operator
2017-11-27 12:46:57 -05:00
Peter Goodman e621164a7c Fixues issue #321. (#331)
* Fixues issue #321.

* This is an attempt to fix the issue Akshay observed, though not by restoring the original code. In a windows binary I am looking at, I have the jump table entries as 4-byte displacements, added to an 8-byte offset.

* This includes some pretty substantial changes. Some are related to jump tables, then things diverged into better handling of .idata sections in PE files, and specifically external calls and devirtualizing them in the lifted bitcode.
2017-11-19 23:51:57 -05:00
Peter Goodman a68f40142a Issue 323 unimplemented avx instructions (#328)
* Updates mcsema to understand that the InstructionLifter returns a LiftStatus now, instead of a bool. This allows us to partially resolve Issue #323. Next up is instruction support.

* Add missing function to runtime.
2017-11-16 21:40:02 -05:00
kumarak 11149d25e1 [WIP] Lift the stack variables using Mcsema2 (#303)
* collect the references of stack variables

* Initial changes to lift stack variables

* Set the stack variable name

* remove the entryBlock for allocating the stack variables

* addressed review comments

* Handling index and scale associated with stack variable; Build will fail because of the required changes in remill;

* Utility to load the register addresses; remove the dependency on remill changes

* Disable function parameters lifting;

* Fixed review comments

* IDA changes to lift the stack variables for apache ATD's. Issue with lifting some variables from status_handler;

* Change CFG proto names to match with other classes

* Remove debug logs

* Change stack allocation variables and general cleanup; Update the blacklist functions for which the stack shuffling does not work;

* Fixed code alignment

* fix tab indentation with spaces
2017-11-14 15:20:31 -05:00
Peter Goodman c6e2df979d Fix of a fix 2017-10-10 21:36:16 -04:00
Peter Goodman 974f2bc86b Error reporting fix 2017-10-10 21:35:08 -04:00
Peter Goodman 14db6f229a Minor API updates 2017-09-25 17:11:16 -04:00
Peter Goodman 7498b2d1ae Initial support for TLS. Some stuff is still not working, also it
is not thoroughly tested.
2017-08-24 22:52:36 -04:00
Peter Goodman 497d4dbe04 Pretty substantial changes. I removed --partition_segments. Now all idautils.Entries that are in the data sections are treated as segment split points. This is all to handle Apache, which exports its symbols to its shared libs (apr and apr-util). 2017-08-23 00:10:49 -04:00
Peter Goodman 89c42a3e42 Support for jump offset tables in the bitcode. Different handling of ELF GOT pointers. It might still be a bit wonky for stdin/stdout.. not sure. 2017-08-22 13:05:20 -04:00
Peter Goodman df1678412b Adds support for --legacy_mode, where drivers are added for the entrypoint and the callbacks 2017-08-18 15:09:25 -04:00
Peter Goodman a7609d1110 Made mcsema-disass recognize .idata section as containing externals. Provided preliminary implementation of __remill_sync_hyper_call in Runtime.cpp. Added a check to detect jump tables embedded in code so as to make mcsema-disass not think they are actual instructions. This came up with Notepad++. Added initial support that will eventually lead to be able to lift and run c++ code. McSema can now inject two functions, __mcsema_constructor and __mcsema_destructor into the bitcode. The constructor is added to the llvm.global_ctors array. This is there to handle relocations that can't actually be handled statically, e.g. having a global variable contain the value of stderr, which is an external. There's two new corresponding command-line options as well. --libc_constructor lets you tell mcsema that a specific function should be called before main executes. For example, for an ELF binary you would pass __libc_csu_init. In the case of C++, this should do some of the work of bringing up the C++ runtime support needed if the lifted program contains and globals that are constructed pre-main. Still to do is to handle jump tables that go backwards. This shows up in Notepad++, where we see: neg ecx; jmp ds:last_table_entry[ecx];. 2017-07-22 21:06:49 -04:00
Peter Goodman 9dfedeef52 Updates to make code work by passing remill::Instruction by reference. 2017-06-14 21:32:23 -04:00
Peter Goodman 933abea11d Added support for @page and @pageoff memory relocations. 2017-05-27 23:20:31 -04:00
Peter Goodman c1bd1668f4 Minor fixes here and there. May not yet build! 2017-05-25 11:00:02 -04:00
Peter Goodman 8452475933 Big improvements to get_cfg.py, especially for SQLite. Still, SQLite doesn't lift correctly. Also, ls using -la segfaults, although -lax does work. 2017-05-06 18:04:17 -04:00
Peter Goodman b5ef96fabe Lifting and recompiling /bin/ls now works. Yay 2017-05-02 18:28:46 -04:00
Peter Goodman 939f408d69 Lifting and recompiling a simple hello world program is working. This uses a new runtime that does more direct register conversion between lifted and native. Updated the .gdbinit debugging script to work using the remill State structure. 2017-05-01 22:51:41 -04:00
Peter Goodman 5e508962f8 Fixes for lifting. Simple lifted binaries can now be recompiled when using the alessandro/refactor/llvmmultiversion-cmake branch of remill as a base. 2017-04-29 22:06:24 -04:00
Peter Goodman 886ee0873f Use GlobalAlias instead of GlobalVariable for segment and variables. Seems to produce the right type of xref info in resulting object files. There's still a bunch of masking of ptrtoint'd vals that I need to find the source of and remove. 2017-04-28 20:11:21 -04:00
Peter Goodman 3ca5995e83 Working toward bringing up the mcsema runtime. Need to add --entrypoint support to get_cfg.py, so that something like main can be specified as the key entrypoint. Right now it's pulling in things like init, start, etc. 2017-04-25 11:45:32 -04:00
Peter Goodman fd20ddf914 Changes to make things compile again. 2017-04-22 16:56:58 -04:00
Peter Goodman df97ad72e9 Fixes for LLVM compatibility 2017-04-21 13:41:06 -04:00
Peter Goodman c6595839b3 Minor fixes 2017-04-18 17:37:50 -04:00
Peter Goodman 23ef38c7c0 Things are moving steadily forward. Redid all cfg proto stuff, and am bringing the get_cfg.py script back up to producing all relevant info. 2017-04-05 23:20:41 -04:00
Peter Goodman 30e3c86e48 Improved jump table handling and started implementing jump table (via switch inst) support on the C++ side of things. Removed some optimization passes; it seems as though the instruction combining pass of llvm injected lots of undefs into the code, which resulted in all the things optimizing themselves away. 2017-03-31 23:37:16 -04:00
Peter Goodman 16158757bb Major improvements to jump table recognition in get_cfg.py 2017-03-29 21:20:42 -04:00
Peter Goodman dcaaa8683b Makign great progress on various forms of reference resolution. 2017-03-29 00:10:22 -04:00