lifting-bits-remill

mirror of https://github.com/lifting-bits/remill synced 2026-06-21 13:56:07 +00:00

T

Peter Goodman ecb1f39266 Added Interrupt structure to State structure for x86. It's not an ideal way of configuring interrupts, but it currently seems like the only way to handle conditional interrupts, e.g. via BOUND or INTO. I might need something similar for SYSCALL vs. SYSENTER. Split the build script out into a build script and a build system. Made it so that the IDA script splits interrupts off into their own blocks. This is so that we can restart interrupts by jumping back to the blocks associated with the address of the instruction. Moving the tools stuff out into its own repo as it complicates things to have it in the source.

2016-01-27 14:25:52 -05:00

blob

OMG I really screwed things up temporarily but don't ask.

2016-01-15 12:12:49 -05:00

mcsema

Added Interrupt structure to State structure for x86. It's not an ideal way of configuring interrupts, but it currently seems like the only way to handle conditional interrupts, e.g. via BOUND or INTO. I might need something similar for SYSCALL vs. SYSENTER. Split the build script out into a build script and a build system. Made it so that the IDA script splits interrupts off into their own blocks. This is so that we can restart interrupts by jumping back to the blocks associated with the address of the instruction. Moving the tools stuff out into its own repo as it complicates things to have it in the source.

2016-01-27 14:25:52 -05:00

scripts

2016-01-27 14:25:52 -05:00

tests/X86

Added intrinsic for conditional branch. This will be helpful for symbolic execution for knowing when a conditional branch is from the lifted program vs. from the semantics of things. Modified IMUL testcase to ignore SF. Updated the README to correctly document the updated command-line flags. Updated ida_get_cfg.py to split syscalls into their own basic blocks so that it's easier to consume CGC snapshot files.

2016-01-25 13:13:56 -05:00

__init__.py

Minor fix to protobuf version. Added gtest.

2015-12-02 23:51:10 -05:00

.gitignore

2016-01-27 14:25:52 -05:00

.travis.yml

OMG I really screwed things up temporarily but don't ask.

2016-01-15 12:12:49 -05:00

README.md

2016-01-25 13:13:56 -05:00

README.md

mcsema2

Setup

Linux-specific

sudo apt-get install libunwind8 libunwind8-dev
sudo pip install futures

Generic

./scripts/bootstrap.sh

Example

First, extract the control-flow graph information from your binary.

./scripts/ida_get_cfg.sh /path/to/binary

This script will tell you where it puts the CFG. For example, it might output something like /tmp/tmp.E3RWcczulG.cfg.

Lets assume that /path/to/binary is a 32-bit ELF file. Now you can do the following:

./build/cfg_to_bc --arch_in=x86 --arch_out=x86 --os_in=linux --os_out=linux --bc_in=./generated/sem_x86.bc --bc_out=/tmp/out.bc --cfg=/tmp/tmp.E3RWcczulG.cfg

For 64-bit x86 programs, specificy --arch_in=amd64. If you intend to run a 32-bit binary as a 64-bit program then specify --arch_in=x86 --arch_out=amd64. Similar switching can be done for the OS.

Note: This arch/OS switching only affects the ABI used by the bitcode. The translator itself has no other concept of arch/OS types. It is up to the next tool in the pipeline to implement the desired behavior.

Great! Now you have a massive bitcode file. Enjoy!

Miscellaneous

To recompile the code, run ./scripts/build.py. Ideally, you should install the concurrent.futures package to make the build faster, though it is not required.

To recompile the semantics, e.g. if you add an instruction, then run ./scripts/compile_semantics.sh. If you want to test your new semantics, then also recompile the code using the above command.]

Languages

C++ 70.7%

Assembly 26%

CMake 1.1%

C 1%

Python 0.7%

Other 0.3%