Commit Graph

30 Commits

Author SHA1 Message Date
Peter Goodman b0f7790f43 Sparc support (#709)
* Adds sparc support; formats files

* Update the readme and walkthrough

* Minor tweaks to readme/walkthrough

* Update ci.yml
2020-11-05 12:59:20 -05:00
Peter Goodman 31f267bd5f Cmake refactor (#693)
* Update to latest remill APIs and way of using CMake.

* Minor fixes

* Bug fixes for AArch64

* Tweaks

* Adds some nifty functionality useful for debugging some aarch64 bugs

* Fixes a subtle bug

* Bug fixes

* Make the test suite use explicit args

* Bug fix in xrefs

* Disable tests for now
2020-09-22 23:22:56 -04:00
Peter Goodman c002b8505c Formats the code with clang-format and my additional stylistic mojojojo (#682) 2020-08-05 16:14:01 -04:00
Peter Goodman 2d55d02cc3 API improvements. Must be used with the api_improvements branches of Remill and Anvill (#666)
* API improvements. Must be used with the api_improvements branch of both Remill and McSema

fixes for x86 and running the lifted code with klee

* Update dockerfile to clone anvill

* update remill commit id

* Add python3 to dockerfile

* update python3

* disable abi script

* Updated cmake to find anvill

* Update main.cpp

* update find_package for anvill

* WIP:updated prebuild cfg

* update prebuild cfg files

* enable abi build for testsuite

* Fix memory leak

* install missing package for testcases

* frontend: Reflect cfg file changes in dyninst frontend.

* frontend: Update local files copyrights to reflect overall change to agplv3.

* fix failing testcases

* update test cfgs

* Fix test failure with local state pointer

* set the flag to use local state_ptr in default mode

Co-authored-by: kumarak <iit.akshay@gmail.com>
Co-authored-by: Lukas Korencik <xkorenc1@fi.muni.cz>
2020-07-23 02:14:56 -04:00
Aiethel 8ecfe165ef Various improvements (#628)
* bc: Inline calls to semantic functions and wrappers manually.

* bc: Inline calls to semantics and wrappers only if some flags are set.

* Refactor code that is responsible for abi libs loading.

* Wrap global pointers in RAII.

* Update .remill_commit_id

Co-authored-by: Peter Goodman <peter.goodman@gmail.com>
2020-02-10 13:20:05 -05:00
Peter Goodman 46362c1f69 Function annotations (#619)
* Annotate lifted functions

* Annotate and Tie entrypoints

* Annotate external functions

* Annote _attach_call

* Update comments

* Simplify code that generated VerifyRegState

Co-authored-by: Aiethel <korencikl@gmail.com>
2020-01-08 17:35:35 -05:00
Peter Goodman 7d2dfe6e94 Attempt to resolve Issue #521 (#522)
* Attempt to resolve Issue #521

* minor fix

* minor fix

* minor fix

* Simplifications and comments

* If it's a copy of shared data, then don't treat it as an xref

* Error log if there is segment variable with the same name as external var

* Added flag and checks if the variable needs initialization if already defined;

* fix noreturn for the functions throwing exceptions;

* review changes

* Update get_cfg.py

* Update get_cfg.py

* Fix the recovery of exception action table chain

* Update the prebuild cfg for testsuite

* Fix entrypoint function not getting recovered in ida7

* Change the order of idc.GetFunctionName and idc.GetTrueName while looking for function name
2019-03-02 20:59:08 -05:00
kumarak 1cc571b11f Support for --abi_library flag to call the external functions with explicit arguments. (#387)
* Add initial support for --abi_library flags

* support for abi_library

* Remove the weak linkage for __mcsema_debug_get_reg_state.

* Fix num of agruments for __cxa_allocate_exception

* Remove --library flag and cleanup

* Don't reload/overwrite mcsema::gModule after loading in the protobuf.

* Use PrepareModuleDataLayout to avoid checks for __remill_basic_block function.

* Bump the remill commit id to support --abi_library flag

* Fix travis build failure

* Initialize the test log filename;

* trim newline char from the eof
2018-03-22 11:09:13 -04:00
Peter Goodman 8a9856ada3 Klee maze example (#369)
* In progress. Working on an example of using KLEE on a Maze, but with the maze program being compiled to x86, amd64, and aarch64.

* Making lots of progress on getting lifting and runnning an aarch64 maze program on amd64, but using --explicit_args. The key thing I'm working through right now is a jump offset table, but where the offset is a block pc, rather than a table base. Also adding various bits of code here and there to making runnning with klee more directly doable, and working on a debugging facility to track down when the emulated program counter gets out of sync with the original program.

* Fixed a subtle @PAGE and @PAGEOFF-related reference bug on AArch64. Partially disabled the special jump offset table handling I had in table.py, as it doesn't (yet) handle the shifted table values. However, I still have the code there, so that it can recognize that a basic block address is used as a possible offset, so that I can remove the block address as a reference, which permits a new heuristic on the C++ side to work. On the C++ side, when there's a jump instruction that isn't associated with a cross-reference flow, I try to auto-augment it with addition switch cases, targeting blocks with no predecessors (as present in the CFG). This seems to work reasonably well.

* Improved the scripts and updated the READMEs.

* Minor rephrase

* Minor rephrase
2018-01-13 23:47:55 -05:00
Peter Goodman d77167d8c8 Working on Issue #281 to update the documentation. 2017-10-16 15:40:02 -04:00
Peter Goodman 7498b2d1ae Initial support for TLS. Some stuff is still not working, also it
is not thoroughly tested.
2017-08-24 22:52:36 -04:00
Peter Goodman 8b465717e4 Made the pc annotation configurable, and auto-set when --legacy_mode is enabled 2017-08-23 12:49:01 -04:00
Peter Goodman df1678412b Adds support for --legacy_mode, where drivers are added for the entrypoint and the callbacks 2017-08-18 15:09:25 -04:00
Peter Goodman 18abc11714 Added new --legacy_mode operation that tries to produce bitcode that is more similar to old bitcode. Also updates get_cfg.py to disassemble in such a way that mcsema2 will be able to support global variable recovery as though they were distinct segments 2017-08-16 23:06:53 -04:00
Peter Goodman bc84b2f56c Improvements to handling lifting of statically linked ELFs that also have thunks in them. Bug fixes. 2017-08-14 23:29:54 -04:00
Peter Goodman a7609d1110 Made mcsema-disass recognize .idata section as containing externals. Provided preliminary implementation of __remill_sync_hyper_call in Runtime.cpp. Added a check to detect jump tables embedded in code so as to make mcsema-disass not think they are actual instructions. This came up with Notepad++. Added initial support that will eventually lead to be able to lift and run c++ code. McSema can now inject two functions, __mcsema_constructor and __mcsema_destructor into the bitcode. The constructor is added to the llvm.global_ctors array. This is there to handle relocations that can't actually be handled statically, e.g. having a global variable contain the value of stderr, which is an external. There's two new corresponding command-line options as well. --libc_constructor lets you tell mcsema that a specific function should be called before main executes. For example, for an ELF binary you would pass __libc_csu_init. In the case of C++, this should do some of the work of bringing up the C++ runtime support needed if the lifted program contains and globals that are constructed pre-main. Still to do is to handle jump tables that go backwards. This shows up in Notepad++, where we see: neg ecx; jmp ds:last_table_entry[ecx];. 2017-07-22 21:06:49 -04:00
Peter Goodman 6ced3bd807 Transitioned to using a table-based approach for explicit arguments and return values. 2017-07-14 15:30:18 -04:00
Peter Goodman 5e508962f8 Fixes for lifting. Simple lifted binaries can now be recompiled when using the alessandro/refactor/llvmmultiversion-cmake branch of remill as a base. 2017-04-29 22:06:24 -04:00
Peter Goodman 3ca5995e83 Working toward bringing up the mcsema runtime. Need to add --entrypoint support to get_cfg.py, so that something like main can be specified as the key entrypoint. Right now it's pulling in things like init, start, etc. 2017-04-25 11:45:32 -04:00
Peter Goodman df97ad72e9 Fixes for LLVM compatibility 2017-04-21 13:41:06 -04:00
Peter Goodman 93b4aa56b4 WIP. Modified license to apache 2.0 to follow remill, also most code is new anyway. 2017-04-15 16:27:35 -04:00
Peter Goodman 23ef38c7c0 Things are moving steadily forward. Redid all cfg proto stuff, and am bringing the get_cfg.py script back up to producing all relevant info. 2017-04-05 23:20:41 -04:00
Peter Goodman 30e3c86e48 Improved jump table handling and started implementing jump table (via switch inst) support on the C++ side of things. Removed some optimization passes; it seems as though the instruction combining pass of llvm injected lots of undefs into the code, which resulted in all the things optimizing themselves away. 2017-03-31 23:37:16 -04:00
Peter Goodman dcaaa8683b Makign great progress on various forms of reference resolution. 2017-03-29 00:10:22 -04:00
Peter Goodman 0441f95426 Updated copyright messages. Added namespace mcsema 2017-03-24 19:33:54 -04:00
Peter Goodman a139d435ce Another good logical spot. Have basic lifting working (no mem refs, no jump tables, etc.), and also have optimization of the lifted bitcode working nicely, with removal of ISELs and SEMs. 2017-03-24 18:02:21 -04:00
Peter Goodman f17266f985 Making progress towards initial lifting 2017-03-23 23:23:49 -04:00
Peter Goodman 9ee7bec444 How to debug mcsema (#188)
* Generalizes two debugging features. The first, -add-breakpoints, adds instruction-specific 'breakpoint' function calls before every lifted instruction. The second, -add-reg-tracer, adds in a function that prints out the value of every general purpose register before each instruction execution.

* In-progress doc

* ...

* More of the debugging doc, some more images, a PIN tool to complement the new -add-reg-tracer option to mcsema-lift. Still a ways from being done though.
2017-03-13 22:09:45 -04:00
Peter Goodman 62eba71105 Adding the document, and moved some more files around to make the xre… (#158)
* Adding the document, and moved some more files around to make the xrefs in the doc make sense

* Update readme

* try to make xref link paths work

* minor wording

* minor wording

* Addressed comments
2017-03-08 17:24:16 -05:00
Peter Goodman 661174afba Reorg x86 files (#155)
* Initial move of some of the files

* Rename the semantics files.

* Moves more stuff, adds some files, removes others, fixes include paths.

* Addresses comments
2017-03-08 11:10:07 -05:00