Tag function_call targeting external symbols

This commit uses SET, information about canonical values and labels to
detect if an indirect function call is targeting an external symbol.

The strings used for the name of external symbols are uniqued global
variables. This commit also uses this approach for the disassembly of
original instructions, which used to be metadata.
This commit is contained in:
Alessandro Di Federico
2018-11-14 13:53:31 +01:00
parent abb47bb964
commit e21eed118c
13 changed files with 422 additions and 105 deletions
@@ -31,12 +31,12 @@ bool FunctionCallIdentification::runOnFunction(llvm::Function &F) {
Module *M = F.getParent();
LLVMContext &C = M->getContext();
PointerType *Int8PtrTy = Type::getInt8PtrTy(C);
auto *Int8NullPtr = ConstantPointerNull::get(Int8PtrTy);
auto *PCTy = IntegerType::get(C, GCBI.pcRegSize() * 8);
auto *PCPtrTy = cast<PointerType>(GCBI.pcReg()->getType());
std::initializer_list<Type *> FunctionArgsTy = { Int8PtrTy,
Int8PtrTy,
PCTy,
PCPtrTy };
std::initializer_list<Type *> FunctionArgsTy = {
Int8PtrTy, Int8PtrTy, PCTy, PCPtrTy, Int8PtrTy
};
using FT = FunctionType;
auto *Ty = FT::get(Type::getVoidTy(C), FunctionArgsTy, false);
Constant *FunctionCallC = M->getOrInsertFunction("function_call", Ty);
@@ -58,7 +58,7 @@ bool FunctionCallIdentification::runOnFunction(llvm::Function &F) {
// Consider the basic block only if it's terminator is an actual jump and it
// hasn't been already marked as a function call
TerminatorInst *Terminator = BB.getTerminator();
if (!GCBI.isJump(Terminator) || isCall(Terminator))
if (BB.empty() or not GCBI.isJump(Terminator) or isCall(Terminator))
continue;
// To be a function call we need to find:
@@ -191,7 +191,7 @@ bool FunctionCallIdentification::runOnFunction(llvm::Function &F) {
Value *Callee = nullptr;
if (SuccessorsCount == 0) {
Callee = ConstantPointerNull::get(Int8PtrTy);
Callee = Int8NullPtr;
} else if (SuccessorsCount == 1) {
Callee = BlockAddress::get(Terminator->getSuccessor(0));
} else {
@@ -209,14 +209,15 @@ bool FunctionCallIdentification::runOnFunction(llvm::Function &F) {
revng_assert(Found);
// It's an indirect call
Callee = ConstantPointerNull::get(Int8PtrTy);
Callee = Int8NullPtr;
}
const std::initializer_list<Value *> Args{ Callee,
BlockAddress::get(ReturnBB),
ConstantInt::get(PCTy,
ReturnPC),
LinkRegister };
LinkRegister,
Int8NullPtr };
FallthroughAddresses.insert(ReturnPC);