* cmake: Set c++ standard to c++17.
* dyninst: Properly set is_referenced_by_data if bb is target of data reference.
* dyninst: Always set some value to is_reference_by_data field.
Co-authored-by: Peter Goodman <peter@trailofbits.com>
* Python 3 support for mcsema-disass.
* Conditional Python3 installation libraries
* Add conditional check for Python2 also
* Update CMakeLists.txt
Make the install options for py2/3 always available.
* Fix CI tool name
* Update flow.py
Co-authored-by: Eric Kilmer <eric.d.kilmer@gmail.com>
* Update to latest remill APIs and way of using CMake.
* Minor fixes
* Bug fixes for AArch64
* Tweaks
* Adds some nifty functionality useful for debugging some aarch64 bugs
* Fixes a subtle bug
* Bug fixes
* Make the test suite use explicit args
* Bug fix in xrefs
* Disable tests for now
* API improvements. Must be used with the api_improvements branch of both Remill and McSema
fixes for x86 and running the lifted code with klee
* Update dockerfile to clone anvill
* update remill commit id
* Add python3 to dockerfile
* update python3
* disable abi script
* Updated cmake to find anvill
* Update main.cpp
* update find_package for anvill
* WIP:updated prebuild cfg
* update prebuild cfg files
* enable abi build for testsuite
* Fix memory leak
* install missing package for testcases
* frontend: Reflect cfg file changes in dyninst frontend.
* frontend: Update local files copyrights to reflect overall change to agplv3.
* fix failing testcases
* update test cfgs
* Fix test failure with local state pointer
* set the flag to use local state_ptr in default mode
Co-authored-by: kumarak <iit.akshay@gmail.com>
Co-authored-by: Lukas Korencik <xkorenc1@fi.muni.cz>
The key look-up assumes proper string conversion to "cdecl" which appears to not be the case on the latest Binary Ninja development build, thus: `KeyError: <calling convention: aarch64 cdecl>` occurs. By coercing to a string, this issue is fixed.
* bc: Inline calls to semantic functions and wrappers manually.
* bc: Inline calls to semantics and wrappers only if some flags are set.
* Refactor code that is responsible for abi libs loading.
* Wrap global pointers in RAII.
* Update .remill_commit_id
Co-authored-by: Peter Goodman <peter.goodman@gmail.com>
* lift: Filter function from abi_libs based on other flags
* lift: C++11 compatibility
* lift: Change severity of logs when IR prototype of ext function is not used.
* Docs: Update links with the new organization name
* CI/Travis: Update remotes with the new organization name
* mcsema-disass: Update links with the new organization name
* Dockerfile: Update remotes with the new organization name
* Change required Dyninst version
* Function blocks are explicitly checked for successors if they end with jump
* Whitespace
* Fix compile warning about signedness
* Fix compile warning about signedness
* Remove redundant recursion check for outgoing edge from bb
* Adds Section default initialization
* Whitespaces
* Early return
* Displacement is considered only if operand cannot be statically calculated
* ControlFlowOperand at the end is not needed, it is included in succs of bb
* Soften OffsetTable::Match from FATAL to WARNING if targets are empty
* Rework resolution of outgoing edges of bb
* Use ParseAPI::Function::contains instead of manual search
* Remove log message that was too verbose
* Soften heuristic to calculate offset tables as it was too strict
* Fix typo in comment
* Offset tables are now brute-forced if there are no candidates
* Improve algorithm to recognize MemoryDisplacements
* Better error message if bb succ are not determined correctly
* Before refactor & change of code style
* Rename files to match the rest of McSema
* Remove ArgParser, add glog and gflags
* Remove old files
* Rename some flags to match ida frontend
* Small test improvements
* Abolish ExternalFunc, which is reborn as POD
* Big code style sweep
* Renaming of variables
* Add CHECKs in main
* Main can be foung in stripped binaries
* WIP: Jump has lea-like hanlding, xrefs are search according to ParseAPI instead of SymtabAPI
* WIP: Stripped binaries are now trying to name init, fini
* WIP segment xref
* WIP xrefs are found in data, rodata, needs bss + cleanup
* SymbolMap is now container for all possible targets of xrefs
* Xrefs in rodata, data should be resolved correctly
* Bss self xrefs
* WIP Smarter tryEval
* Cleanup with DataXrefs
* No more of .got.plt stubs
* WIP: Try to locate missing functions via xref
* WIP More passes are now run to parse new functions
* WIP Safe point
* WIP: Displacement
* WIP aligment when searching for xrefs is taken into account
* Addresses stored in all data section are now inspected as potential entries of functions
* Need to search for code refs and parse in .*_array as well
* Messy as hell but everything seems to work
* WIP search for main now works in pie code (lea 0x...(%rip),...)
* Forgot to parse newly found functions from _start
* Bunch of hotfixes, preparing for cleaning
* Small code style chnages, bunch of comments to not get lost after weekend
* Externals variables now have imaginary addr
* MagicSection is now separate class, ExternalFunctions write themselves
* WIP relocations are now working, needs cleanup
* Remove throw, preparing to clean up xref handling
* Update README
* Base of DisassContext structure
* Starting to remove things from CFGWriter
* SectionManager is now global
* Managers are now global, to make CFGWriter smaller
* Cleanup
* Segment variables and magic section are now from context
* External and global variables are part of context
* init/fini now renamed based on information from symtab.isStripped()
* External_funcs are now in context
* Fixing tryParse bug
TryParse of segment ended too soon as end was calculated horribly
wrong and I am amazed it actually worked
* Data sections now use only tryParse to get xrefs and vars
* Refactor mistake
* Correctly parsing xrefs on the end of segment
Off by one error fix
* Code style, replacing cerr with glog
* DisassContext now holds all metadata
Removed skip_functions
CFG now contains entry for each function, only meaningful ones have
implementation
gDisassContext now holds everything needed to resolve xrefs
* Code style, forgot to include file last commit
* WIP code_xrefs resolve mechanism cleanup
* Merge CrossXrefs
CFGWriter::CrossXref abolished in favor of implementation in Util.
* Fix bug, with external not being recognizes in Context
* Lifting .so is broken and I have no idea how to do it
* Immediate values, partial variables
Rework code around immediate values, it is finally not just blindly
adding xrefs from everything
Sometimes two variables can occupy the same space (if one is suffix of
other). There is no real way to resolve it, so if there is something
targeting .data, .rodata, .bss it is just added as xref.
* Simplify resolve of instructions
* Remove found_xref from CFGWriter
* Cleaner lookup of regions
* Clean main a bit
* Code style changes
* Better variable names
* File structure
* README todo & shell changes
* Another round of code style
* Syntax error
* Renaming to init/fini only in stripped binaries
* One less writeDataXref wrapper
* Displacement now tries to resolve itself correctly
* Removed another now useless wrapper function
* Basic skeleton for recognising jump tables
* Offset tables
Offset tables are now recognized based on simple heuristic.
Offset tables that are immediately followed look like single one,
when resolving references this is taken into account.
Minor code style improvements
* Skeleton for local variables
* Resolve compiler warnings
* Parameters from debug info are also treated as local vars
* Decouple section parsing out of CFGWriter
* Update README
* Edges to catch blocks are ignored
* cmake now uses cxx-common protobuf instead of system-wide
* SectionManager does not abort when section is found
* Compiler warnings fix
* Remove constexpr, simplify FishForXref using set of overloads
* Edges are now properly checked to exclude some types.
* README update required cpp standart and Dyninst version
* Copyright header
* Typo, pretty_dump is now hidden behind flag
* SectionParser is now properly implemented
* First entry of Offset table can target itself
* Reworked data parsing
Last instruction in the block gets xref if it's a branching.
Utilities around external symbols recovery.
* Multiple improvements
* Removed recovery of variables from data sections as it was not working
properly
* pie_mode is now required for position independent binaries
* part of ubuntu 18.04 coreutils/gnutils can be lifted
* externals are now extracted from .plt stubs if linkage() does
not provide information
* Only link dyninst libs that are needed
* Remove some of log messages
* Unresolved cross_xrefs into text are now properly removed if they are from a switch
* Replace std::experimental::optional with slightly worse own implementation
* Fixed uninitialized variable usage
* Remove ExternalFunctionManager as global object
* Remove incorrectly implemented functions from SectionManager
* Codestyle changes
* TryEval now uses Maybe instead of bool as return type
* Changing last code xref is now cleaner with sanity check
* CrossXref now requires non-pointer type in template
* GetLastXref can return DataReference as well as CodeRef
* Missing reference
* Changed DisassContext into local member of CFGWriter
* SectionManager::IsCode instead manual search for text section
* Add consts into SectionManager where appropriate
* Change SectionManager to be local under CFGWriter
* Build flag is now cmake, not env
* Lift script should work with dyninst
* Cleaner local README
* Top level README
* Update README.md
* Set proper RPATH when install
* README fixes
* Remove tests. They will be added in separate branch
* Typo
* Revert changes in README
* Remove test section from README
* Attempt to resolve Issue #521
* minor fix
* minor fix
* minor fix
* Simplifications and comments
* If it's a copy of shared data, then don't treat it as an xref
* Error log if there is segment variable with the same name as external var
* Added flag and checks if the variable needs initialization if already defined;
* fix noreturn for the functions throwing exceptions;
* review changes
* Update get_cfg.py
* Update get_cfg.py
* Fix the recovery of exception action table chain
* Update the prebuild cfg for testsuite
* Fix entrypoint function not getting recovered in ida7
* Change the order of idc.GetFunctionName and idc.GetTrueName while looking for function name
* Handle large sized externals as byte arrays
* Externals <= 128 bits are treated as an integer
* Externals > 128 bits are treated as a byte array aligned the same as the
original variable
* Output recovered external variable size in mcsema-disass debug info
* InlineAsm fails due to function type mismatch
* disable ada failing testcases;
* semi-naive approach to recover the global variables without debuginfo
* Recover the globals and generate the global proto file
* Traverse the mlil instruction and collects memory addresses read/written
* Collect the function arguments and resolve its possible values ahead of time
* Add function handler and Instruction handler; refactor the changes
* Guard amd64 specific function calls in ABI_libc
* Put a compile-time guard around amd64 specific function definitions
* extend the instructions handling
* variable recovery handle the external and internal function return values;
* remove the check for blacklist addresses
* Initial attempt at variable recovery tests. Still needs work
* Updating globals tests
* Fix up recover and test script
* added a README, easier to read output from comparisons
* Add state variable for function entry
* State initialization and update it with the function call
* Adding binary-only variable recovery tests
* C++ exception test to var recovery
* Fix argument register lookup
* mask the symbols recovered from .init/.fini sections
* impoved inter-function analysis; fix the size of variables due to wrong operand size
* fixed operand size; get segment end to fix the size of last variable
* Compare function set for memory access
* split the list to addr ref and memory refs for the variables
* Update alias set generation
* switch to llil for analysis
* More broadly applies lazy xref initialization to all initializations where the xref size is less than teh value size of the xref itself (pointer size, usually). Moves initialization of lazy xrefs into a new function, __mcsema_early_init, which guards itself against multiple executions. Makes sure that __mcsema_constructor calls __mcsema_early_init first. Finally, makes sure that all native-to-lifted entrypoints call __mcsema_early_init as well, as we have observed cases where the lifted binary contains weak implementations of c++ standard library functions, and these functions are called by native libraries initialized before the call to __mcsema_constructor, thereby resulting in re-entrancy issues.
* Update Function.cpp
* Make sure the __mcsema_early_init guard is in the module.
* Make sure the __mcsema_early_init guard is in the module.
* Fixes for __gmon_start__ and stuff.
* Minor fix
* Adds some symbols
* Minor fix for ida7
* Try to resolve things like calls through PLT thunks via xref entry lookups when a flow cross-reference is missing.
* mcsema_disass: Add support for IDAPython 7.1
* Code review changes
* Fix elf thunk identification for IDA 7.0
* check if the ref addr falls into LOAD segment
* Resolved merge conflict
* Check the LOAD segment before resolving xrefs
* Changes idc.GetMnem to idc. print_insn_mnem
* Move CFG recovery scripts to ida7
* Handle addresses which are in the middle of struct and unable to make xrefs
* Update with the master
* ida import
* handle references of external vtable
* Fix string recovery for apache binary
* IDA 6.x not detecting the typeinfo symbol refs and considering it as string
dependabot[bot]