Commit Graph

39 Commits

Author SHA1 Message Date
Peter Goodman b0f7790f43 Sparc support (#709)
* Adds sparc support; formats files

* Update the readme and walkthrough

* Minor tweaks to readme/walkthrough

* Update ci.yml
2020-11-05 12:59:20 -05:00
Peter Goodman 31f267bd5f Cmake refactor (#693)
* Update to latest remill APIs and way of using CMake.

* Minor fixes

* Bug fixes for AArch64

* Tweaks

* Adds some nifty functionality useful for debugging some aarch64 bugs

* Fixes a subtle bug

* Bug fixes

* Make the test suite use explicit args

* Bug fix in xrefs

* Disable tests for now
2020-09-22 23:22:56 -04:00
Peter Goodman c002b8505c Formats the code with clang-format and my additional stylistic mojojojo (#682) 2020-08-05 16:14:01 -04:00
Peter Goodman 2d55d02cc3 API improvements. Must be used with the api_improvements branches of Remill and Anvill (#666)
* API improvements. Must be used with the api_improvements branch of both Remill and McSema

fixes for x86 and running the lifted code with klee

* Update dockerfile to clone anvill

* update remill commit id

* Add python3 to dockerfile

* update python3

* disable abi script

* Updated cmake to find anvill

* Update main.cpp

* update find_package for anvill

* WIP:updated prebuild cfg

* update prebuild cfg files

* enable abi build for testsuite

* Fix memory leak

* install missing package for testcases

* frontend: Reflect cfg file changes in dyninst frontend.

* frontend: Update local files copyrights to reflect overall change to agplv3.

* fix failing testcases

* update test cfgs

* Fix test failure with local state pointer

* set the flag to use local state_ptr in default mode

Co-authored-by: kumarak <iit.akshay@gmail.com>
Co-authored-by: Lukas Korencik <xkorenc1@fi.muni.cz>
2020-07-23 02:14:56 -04:00
Aiethel 8ecfe165ef Various improvements (#628)
* bc: Inline calls to semantic functions and wrappers manually.

* bc: Inline calls to semantics and wrappers only if some flags are set.

* Refactor code that is responsible for abi libs loading.

* Wrap global pointers in RAII.

* Update .remill_commit_id

Co-authored-by: Peter Goodman <peter.goodman@gmail.com>
2020-02-10 13:20:05 -05:00
Peter Goodman 782bd1dcfa Update for new remill APIs (#595)
* Update for new remill APIs

* Update remill commit id

* Cleanups

* resolved one issue
2019-10-27 17:48:43 -04:00
Aiethel bc0e132a65 Various fixes (#572)
* Correct constness when appending to global ctors

* Remove obsolete commit.

* Return type for native -> lifted is now pointer type size.

* Main returns i32
2019-06-01 21:02:45 -04:00
kumarak 472675ba9c Check for the xref variable before calling lazy init (#560)
* Add check for the xref variable before lazy initialization

* Fix space
2019-05-06 14:10:22 -04:00
Peter Goodman 7d2dfe6e94 Attempt to resolve Issue #521 (#522)
* Attempt to resolve Issue #521

* minor fix

* minor fix

* minor fix

* Simplifications and comments

* If it's a copy of shared data, then don't treat it as an xref

* Error log if there is segment variable with the same name as external var

* Added flag and checks if the variable needs initialization if already defined;

* fix noreturn for the functions throwing exceptions;

* review changes

* Update get_cfg.py

* Update get_cfg.py

* Fix the recovery of exception action table chain

* Update the prebuild cfg for testsuite

* Fix entrypoint function not getting recovered in ida7

* Change the order of idc.GetFunctionName and idc.GetTrueName while looking for function name
2019-03-02 20:59:08 -05:00
Peter Goodman 69cb35cc16 Call early init lazy xrefs (#466)
* More broadly applies lazy xref initialization to all initializations where the xref size is less than teh value size of the xref itself (pointer size, usually). Moves initialization of lazy xrefs into a new function, __mcsema_early_init, which guards itself against multiple executions. Makes sure that __mcsema_constructor calls __mcsema_early_init first. Finally, makes sure that all native-to-lifted entrypoints call __mcsema_early_init as well, as we have observed cases where the lifted binary contains weak implementations of c++ standard library functions, and these functions are called by native libraries initialized before the call to __mcsema_constructor, thereby resulting in re-entrancy issues.

* Update Function.cpp

* Make sure the __mcsema_early_init guard is in the module.

* Make sure the __mcsema_early_init guard is in the module.

* Fixes for __gmon_start__ and stuff.

* Minor fix

* Adds some symbols

* Minor fix for ida7

* Try to resolve things like calls through PLT thunks via xref entry lookups when a flow cross-reference is missing.
2018-09-23 15:25:14 -07:00
Aiethel 1f786559f9 Deduce libc ctor/dtor based on functions in cfg (#453) 2018-08-31 11:05:10 -04:00
kumarak 22934d3d85 [WIP]Issue 414 incorrect references of variables (#427)
* Recover the class typeinfo references

* Use generic reference collector

* get the reference of missing symbol from typeinfo class

* Lazy initialization to avoid pointer trucation

* disable aggressive looking for string refs in rodata section

* Revert changes to lookup for the strings

* check if ea references other symbol before making it to string

* Split the segement at the runtime external variable boundary

* Lazy initialization of the variables causing problem with pointer truncation

* remove rtti parsing; The typeinfo's symbols are getting recovered as external variable;

* remove rtti.py; not getting used

* review changes
2018-08-15 12:15:19 -04:00
Peter Goodman e621164a7c Fixues issue #321. (#331)
* Fixues issue #321.

* This is an attempt to fix the issue Akshay observed, though not by restoring the original code. In a windows binary I am looking at, I have the jump table entries as 4-byte displacements, added to an 8-byte offset.

* This includes some pretty substantial changes. Some are related to jump tables, then things diverged into better handling of .idata sections in PE files, and specifically external calls and devirtualizing them in the lifted bitcode.
2017-11-19 23:51:57 -05:00
Peter Goodman d77167d8c8 Working on Issue #281 to update the documentation. 2017-10-16 15:40:02 -04:00
Peter Goodman 71c7e939df LLVM 5.0 compatibility. 2017-09-19 15:13:24 -04:00
Peter Goodman d0ae6e941c Minor fix to the reg state printer. Moved the TLS base pointer code into Arch/ABI, as it's more arch/os-specific. 2017-08-26 12:56:38 -04:00
Peter Goodman 7498b2d1ae Initial support for TLS. Some stuff is still not working, also it
is not thoroughly tested.
2017-08-24 22:52:36 -04:00
Peter Goodman 497d4dbe04 Pretty substantial changes. I removed --partition_segments. Now all idautils.Entries that are in the data sections are treated as segment split points. This is all to handle Apache, which exports its symbols to its shared libs (apr and apr-util). 2017-08-23 00:10:49 -04:00
Peter Goodman 89c42a3e42 Support for jump offset tables in the bitcode. Different handling of ELF GOT pointers. It might still be a bit wonky for stdin/stdout.. not sure. 2017-08-22 13:05:20 -04:00
Peter Goodman 04e675ac48 Remove tail calls, fast calling convention, and fixup get_cfg.py to better support segmenting existing segments using global variables 2017-08-18 22:41:49 -04:00
Peter Goodman df1678412b Adds support for --legacy_mode, where drivers are added for the entrypoint and the callbacks 2017-08-18 15:09:25 -04:00
Peter Goodman bc84b2f56c Improvements to handling lifting of statically linked ELFs that also have thunks in them. Bug fixes. 2017-08-14 23:29:54 -04:00
Peter Goodman c2bda2eaa4 Adds command-line option that forces partitioning of segment variables into distinct regions, even if the segments are contiguous 2017-08-08 15:57:50 -04:00
Peter Goodman a3f5f65aed Minor improvements to handling of code with c++ exceptions. The exceptions should now be throwable, but not catchable/handle-able. Also fixed a related issue that crept up when there is an lazy xref in the gcc except table section to rtti stuff. 2017-08-08 15:07:24 -04:00
Peter Goodman a7609d1110 Made mcsema-disass recognize .idata section as containing externals. Provided preliminary implementation of __remill_sync_hyper_call in Runtime.cpp. Added a check to detect jump tables embedded in code so as to make mcsema-disass not think they are actual instructions. This came up with Notepad++. Added initial support that will eventually lead to be able to lift and run c++ code. McSema can now inject two functions, __mcsema_constructor and __mcsema_destructor into the bitcode. The constructor is added to the llvm.global_ctors array. This is there to handle relocations that can't actually be handled statically, e.g. having a global variable contain the value of stderr, which is an external. There's two new corresponding command-line options as well. --libc_constructor lets you tell mcsema that a specific function should be called before main executes. For example, for an ELF binary you would pass __libc_csu_init. In the case of C++, this should do some of the work of bringing up the C++ runtime support needed if the lifted program contains and globals that are constructed pre-main. Still to do is to handle jump tables that go backwards. This shows up in Notepad++, where we see: neg ecx; jmp ds:last_table_entry[ecx];. 2017-07-22 21:06:49 -04:00
Peter Goodman 1707c0c3cf Fixes some segfaults related to trying to print out the names of segments, but if the segment isn't recovered, e.g. it's an external segment, then we won't have the name for it. Also, produced an error message when it tries to fill in an external address itno a data section. 2017-07-10 16:31:22 -04:00
Peter Goodman 8452475933 Big improvements to get_cfg.py, especially for SQLite. Still, SQLite doesn't lift correctly. Also, ls using -la segfaults, although -lax does work. 2017-05-06 18:04:17 -04:00
Peter Goodman b5ef96fabe Lifting and recompiling /bin/ls now works. Yay 2017-05-02 18:28:46 -04:00
Peter Goodman 939f408d69 Lifting and recompiling a simple hello world program is working. This uses a new runtime that does more direct register conversion between lifted and native. Updated the .gdbinit debugging script to work using the remill State structure. 2017-05-01 22:51:41 -04:00
Peter Goodman 886ee0873f Use GlobalAlias instead of GlobalVariable for segment and variables. Seems to produce the right type of xref info in resulting object files. There's still a bunch of masking of ptrtoint'd vals that I need to find the source of and remove. 2017-04-28 20:11:21 -04:00
Peter Goodman 0c8f2ec21f Minor updates. Trying to diagnose an issue where llvm optimizes a ton of stuff into unreachable insts. 2017-04-27 21:04:00 -04:00
Peter Goodman 3ca5995e83 Working toward bringing up the mcsema runtime. Need to add --entrypoint support to get_cfg.py, so that something like main can be specified as the key entrypoint. Right now it's pulling in things like init, start, etc. 2017-04-25 11:45:32 -04:00
Peter Goodman 6d6d02ba7e Made it so that contiguous segments are placed within the same struct on the llvm side, just in case there's a reference to the beginning of one segment that is logically a reference just beyond the end of another one. Added some weak externs related to the end of some segments (used by brk I think) to the linux defs file. Improved some error reporting. 2017-04-23 12:52:48 -04:00
Peter Goodman df97ad72e9 Fixes for LLVM compatibility 2017-04-21 13:41:06 -04:00
Peter Goodman c6595839b3 Minor fixes 2017-04-18 17:37:50 -04:00
Peter Goodman 93b4aa56b4 WIP. Modified license to apache 2.0 to follow remill, also most code is new anyway. 2017-04-15 16:27:35 -04:00
Peter Goodman ce5bce402d More big improvements to get_cfg.py, with corresponding improvements on the lifting side of things. 2017-04-10 14:49:10 -04:00
Peter Goodman dfdc6b9648 More progress, especially on the get_cfg.py front. 2017-04-07 21:15:46 -04:00
Peter Goodman 23ef38c7c0 Things are moving steadily forward. Redid all cfg proto stuff, and am bringing the get_cfg.py script back up to producing all relevant info. 2017-04-05 23:20:41 -04:00