280c23b4b4
Changes to how vectors in memory are read. Cleaned up a bunch of the vector related operator code. Added some extra test cases for memory accesses. I plan to add more.
2016-04-01 18:24:37 -04:00
b5247b0fb0
Test cases for LEA, CPUID, and ENTER.
2016-03-22 13:16:23 -04:00
d74cbedfef
Added implementation and tests for MOVLPS. This turned out to require a new DownCast construct because the default implemented behaviour for assigning a small value/vector to a big vector is to zero out the high part of the vector.
2016-03-15 17:40:54 -04:00
414766d692
Change how temp file is created. Bump to clang+llvm 3.8.
2016-03-10 23:07:22 -05:00
e2ef455ddf
Minor fix to the register analysis that treats conditional writes as reads (I assumed there was a read operand in there), as it's an implicit data dependency and otherwise introduces undef values.
2016-03-08 20:13:06 -05:00
2bf82421f7
Fiddling with interrupt state. Need a vector value, and also needed extra State structure padding. Added -lowerswitch to optimize_bitcode.sh
2016-02-18 17:36:45 -05:00
94e5a9afe1
A few days of changes. First, some fixes in the dead flag/register analysis. It was slightly buggy. The trick was to split the live/dead tracking into two related bitsets that are updated in the same way. The first bitset, the register kill mask is used to mask the union of incoming live registers. This bitset is initially all set, then we update with revives/kills. As a mask, this ensures that certain things are killed. Then there's the revive set, which is initially unset then updated with revives/kills. This is ORed in, in order to ensure that specific flags are revived. This is more like the gen and kill sets in a typical data flow analysis.
...
The next big change was the introduction of seemingly useless volatile variables into the State structure between aithmetic flag bytes and general purpose registers. I observed that a lot of times LLVM would merge adjacent kills of flags into either a memset intrinsic or into a wider store. This is basically write combining, and these extra volatile fields ensure that writes to adjacent flags are independent. Ancedotally, this also helps dead store elimination.
The next change was to the optimizer plugin. Originally this did two things: first, remove calls to __mcsema_defer_inlining, and mark the callers of this function as having to always be inlined. This was to help dead flag elimination as a form of dead store elimination, because removing a pure callinst is fairly trivial. The next thing the optimizer did was replace all __mcsema_undefined_X intrinsics with Undef values. This was generally good but it didn't always do what I wanted. The resulting undef stores would sometimes be eliminated, and other times be replaced with 0-value stores. The latter is suboptimal. The new addition goes through all functions and removes stores of undef values.
2016-02-10 14:16:36 -05:00
2fec611914
Bumping XED version.
2016-02-08 14:54:13 -05:00
ee87b84d5e
Made is to that the memory intrinsics always read/write byval as opposed to byref for vectors.
2016-02-03 13:32:57 -05:00
09d71cada2
Improved flags analysis. Move the undefined optimization out into the plugin. Still have an issue where dead-store elimination is not happening :-(
2016-02-03 12:24:34 -05:00
5742f219e7
Minor fix.
2016-02-02 23:07:10 -05:00
24cc36e9e0
Tried to clean up a bit of code. Maybe didn't success so much. Added the beginnings of a data-flow analysis pass. It very aggressively marks condition codes as dead. Next step is to augment it to handle registers.
2016-02-02 22:46:23 -05:00
c98dfd7b51
Minor tweaks
2016-01-28 12:40:46 -05:00
5fe8738bf6
More ida testing
2016-01-28 11:48:22 -05:00
5d1488c0d5
Added install script
2016-01-28 11:11:27 -05:00
ecb1f39266
Added Interrupt structure to State structure for x86. It's not an ideal way of configuring interrupts, but it currently seems like the only way to handle conditional interrupts, e.g. via BOUND or INTO. I might need something similar for SYSCALL vs. SYSENTER. Split the build script out into a build script and a build system. Made it so that the IDA script splits interrupts off into their own blocks. This is so that we can restart interrupts by jumping back to the blocks associated with the address of the instruction. Moving the tools stuff out into its own repo as it complicates things to have it in the source.
2016-01-27 14:25:52 -05:00
09bf511d1a
Switch back to 3.7.1 for mac because there is no 3.8.0 llvm pre-release for mac.
2016-01-25 21:56:30 -05:00
1aa12026a8
Adding the beginning of a CGC replayer tool.
2016-01-25 21:25:05 -05:00
b0843d4abd
Added intrinsic for conditional branch. This will be helpful for symbolic execution for knowing when a conditional branch is from the lifted program vs. from the semantics of things. Modified IMUL testcase to ignore SF. Updated the README to correctly document the updated command-line flags. Updated ida_get_cfg.py to split syscalls into their own basic blocks so that it's easier to consume CGC snapshot files.
2016-01-25 13:13:56 -05:00
497e44e198
Moved some files around, added implementation for SHRD.
2016-01-24 12:18:19 -05:00
96e809f84e
Added test cases for BTC and BTR
2016-01-20 13:53:57 -05:00
5cc7e92d06
Testcases should work on Mac now.
2016-01-20 13:06:05 -05:00
88ff579cb3
Added testcases for BTS. Cleaned up a bit of code. Made it so that --bc_in is now required, so that the initial value must always be a semantics file. Added source/target OS. Target OS (--os_out) and target arch (--arch_out) compile to decide what DataLayout / target triple to use. Removing uses of flags strings in favor of enumeration constants. Not exactly happy with the current interfaces to Arch, but it works for now so oh well.
2016-01-19 19:36:20 -05:00
80adf5e085
Compiling is working on Linux.
2016-01-17 20:47:23 -05:00
1688d1edfe
Build script and test cases working on Linux.
2016-01-16 23:45:41 -05:00
a57cc64822
OMG I really screwed things up temporarily but don't ask.
2016-01-15 12:12:49 -05:00
15d7b60c05
Made the lifter ignore NOPs. Fixed handling of passing vector registers by value; I used the wrong XED API function to determine the register class of a particular register. Modified the implementation of LEA to use the A accessor, which is the canonical way of finding the address of a memory operand. Fixed a minor bug in the IDA script by disabling an assertion.
2016-01-13 11:49:48 -05:00
ac95d5c649
Added scripts/check.sh to run the clang static analyzer on the code (I think). Added an untested implementation of SHR.
2015-12-28 18:39:58 -05:00
f79835b370
Added some more test cases. Added the ability to omit certain flags from being checked during test cases. Fixed the overflow flag for signed multiplications.
2015-12-23 21:48:40 -05:00
9b3be033a2
Made it so that the test cases exercise the instruction with the flags zeroed and with the flags set.
2015-12-20 17:47:16 -05:00
5b955b358d
Implemented inline deferral optimization. Enabled the optimization on the test case builds. Modified cmake to explicitly include LLVM; hopefully that works on macs.
2015-12-17 19:11:02 -05:00
110fb1ec7c
Minor fix to testing script.
2015-12-13 17:04:20 -05:00
33e02e1024
Fixed x86 tests cases run under amd64. Issue was a difference in how llvm treats x86_f80 type in i386 and amd64. Made it so that test cases are run by a script that also tries to detect avx.
2015-12-13 16:51:34 -05:00
40dffc5c54
Massive changes to start supporting test cases.
2015-12-11 23:41:04 -05:00
c6ba5aed98
Refactored arch naming, bitcode loading/storing. Changed --arch to --source_arch and --target_arch, though the latter isn't yet used. Changes Test.S to subtract the TestInfo structure address from the other code addresses to try to guarantee that the result can fit into a .long (I think). Fixed semantics where one if the DEC isels was incorrectly named as using INC. Changed to symbol/function name resolution works. Instead of always checking for FLAGS_os==mac, I now use the DataLayout::getGlobalPrefix. Hopefully this will be more generic.
2015-12-05 23:50:01 -05:00
cf7dfa0869
Working on making a testing setup>
2015-12-04 17:32:00 -05:00
323d7211c7
Minor fix to protobuf version. Added gtest.
2015-12-02 23:51:10 -05:00
b3e05a628b
Adding error propagation when building semantics files.
2015-11-29 15:37:33 -05:00
33dc7a8ad7
This should do it
2015-11-29 15:23:32 -05:00
27427475ff
This might make it fail faster
2015-11-29 15:14:52 -05:00
2e2abadf14
Trying to correct travis CI issue.
2015-11-29 14:50:18 -05:00
4dccee9bfe
Removing things from the needed llvm libraries.
2015-11-29 13:21:39 -05:00
4eae13154f
New bootstrap script
2015-11-29 13:18:47 -05:00
c2f04b5329
os x support for ida_get_cfg....with a dirty hack :-x
2015-11-29 13:08:07 -05:00
42e6d1e258
Saving work adding OS X support.
...
I think the llvm+clang download has rtti off but this project requires
it to be on. We might need to build llvm and clang each time. :(
2015-11-29 13:07:17 -05:00
5af1a09b25
Working on factoring the bootstrap code
2015-11-29 10:41:06 -05:00
c559dfd15d
os x support for ida_get_cfg....with a dirty hack :-x
2015-11-28 21:19:18 -05:00
4c8f433750
Saving work adding OS X support.
...
I think the llvm+clang download has rtti off but this project requires
it to be on. We might need to build llvm and clang each time. :(
2015-11-28 20:40:43 -05:00
a918cfa675
Moving files around
2015-11-28 20:40:27 -05:00
8263147956
Saving work adding OS X support.
...
I think the llvm+clang download has rtti off but this project requires
it to be on. We might need to build llvm and clang each time. :(
2015-11-28 20:26:37 -05:00
Peter Goodman