This commit slightly improves VariableManager's API and, most
importantly, undef-initializes all TCG variables in order to avoid
creation of complex PHIs.
In large binaries PHI nodes show up. As a consequence, calls to `newpc`
are no longer the first instruction.
This commit uses the `getFirstNonPHI` method to fix this issue.
FunctionTags goal is to solve the long-standing problem of identifying
what type of function are we dealing with. Is it a lifted function? An
helper?
Now we have a sane way to determine this using Metadata and a proper
API.
This commit further reduces the time spent in AVI by considering all the
function calls as indirect. In fact, we currently don't handle indirect
jumps whose target is affected by computation happening before a
function call.
This commit greatly improves the performance by ensuring that, when
computing the set of nodes we want to consider for AVI, we do not
traverse the dispatcher.
Doing so, means including *a lot* of irrelevant nodes and wasting a lot
of computation, since the CFG usually is not influenced by stuff
happening before an indirect jump.
In at least a situation the speedup is in the order of 20x, however this
depends on the size of the binary, since traversing the dispatcher means
including all the binary in the computations (as opposed to just the set
of blocks involved in the dataflow to compute a certain expression).
QEMU helpers are compiled with -O0. This led the functions in the QEMU
helper module to have the `optnone` attribute, preventing any
optimization.
This has now been fixed on the QEMU side with the following flags:
clang -Xclang -disable-O0-optnone
We used to stop the harvesting process when the harvesting process was
no longer able to identify new jump targets, even if new CFG edges have
been identified.
This approach prevented to discover additional parts of the CFG thanks
to the increased accuracy gained by a more accurate CFG. This effect is
particularly visible when we have jump tables that can be reached only
through other jump tables.
This enables us to handle situations where the comparison against the
switch value is performed on the lower 32 bits, but the address
computations uses the full 64 bits.
cmp edi,0x23
ja ...
movsxd rdx,DWORD PTR [rcx+rdi*4]
Note that this does not solve all these situations yet.
This commit also introduces a reference output for the new
switch-jump-table-32-bit-comparison test case.
AVI used to work on a cloned root that was initializing the pc to the
program entry point. Under certain conditions, this led to DCE almost
all of the code.
Generated code now either jumps to `anypc` or `unexpectedpc`. The latter
one is to be considered a safety measure and will be populated with an
unreachable instruction on the decompilation pipeline.
This commit extracts a plain `struct` from the `MetaAddress` class. This
enables us to use `MetaAddress` from C and therefore, runtime.
The definition of such `struct`, `PlainMetaAddress`, is in
`PlainMetaAddress.h`, which is included by `early-linked.c`.
A function to print the content of a `PlainMetaAddress` has also been
introduced.
Also, anticipating the linkage of `early-linked.c` triggered a
superflous assertion in `CPUStateAccessAnalysis`. This commit removes
it.
* Introduce GCBI::buildDispatcher
* Introduce GCBI::getJumpTarget{,Block} and GCBI::getBlocksGeneratedByPC
to easily map `BasicBlock *` to jump targets and viceversa.
* PCH::buildDispatcher now returns a list of the newly created basic
blocks.
* Other minor changes
Alessandro Di Federico