Move much of the logic of `rp_manager_produce_targets` to a method
inside `PipelineManager`, add additional checks for the existence of the
targets that are requested to be produced.
HexDumpPipe dumps content of binary file in the similar way as hexdump
tool with addition of PTML markup for instructions addresses.
Continuous parts of binary code are wrapped with <span
data-location-definition=""></span> where data-location-definition
attribute contains Entry/BasicBlock/Instruction addresses in generic
form. <span> tags can be nested if byte(s) belong to many instructions
in code.
At the end of the line every <span> is closed and opened on the next
line again if it still applies to the next byte.
MetaAddress are converted to IntervalMetaAddress (which implements own,
optional-less operator-) and stored in boost::icl::intruval_map. This
map is used to get addresses of instructions to which each byte belongs.
getJumpTargetBlock takes llvm::BasicBlock * as argument, but doesn't
need to modify it, so const it adds const to it and other functions that
are used by getJumpTargetBlock: findJumpTarget, isTranslated, getType,
isJumpTarget.
This commit fixes a TypeShrinking bug and extends it to better handle
more instructions. Specifically, we now handle shift left, select, phi
and bitwise operations.
This commit introduces a change in AdvancedValueInfoMFI which forces to
consider constraints valid on 32-bit values to be valid on their
untruncated 64-bit counterparts.
While being unsound, this is important to easily devirtualize indirect
branches on 64-bit architectures where often constraints are expressed
on 32-bit switch values.
Before this commit, we were blinding adding the `nomerge` attribute to
function calls. Now we copy attributes over, so we preserve all the
attributes.
In this way the only place where we add the `nomerge` attribute becomes
Isolate.
The goal of this update is to propagate prototypes of functions called
in wrappers to this wrappers.
When some function hasn't it's own prototype, but the only thing it does
is calling another function, DetectABI pass sets callee prototype as
caller prototype also.
This behaviour is limited to callers that:
1. have only one basic block
2. end with call
3. don't write arguments of callee
4. don't modify stack pointer
5. don't write to memory.
Not every case can benefit from extra liniency, so they were manually
reviewed on a case by case basis.
Additionally, this drops a couple of "this should be a non-strict
specialization" commits, because of a bug with clang
(see the GenericGraph concepts rework commit for more details) as
to avoid confusion (we wouldn't want anyone trying to solve these
"todo"s) until the clang struct type deduction is fixed. Especially
considering that there are currently no cases where these softer
versions would be beneficial (we never inherit from templates in
question).
`ValueMaterializer` is a rewrite of what was called `AdvancedValueInfo`
which follows the same principles.
The main benefits over the old version is:
* We materialize the data-flow graph and the CFG of the relevant part of
root. This makes debugging significantly easier.
* We drop the old MonotoneFramework infrastructure in favor of
getMaximalFixedPoint.
* We significantly reduce the amount of queries we make to
AdvancedValueInfo.
Sometimes code performs an indirect jump without changing the value of
the PC. In most cases this is due to non-code or some other faulty
situation, but it is in principle possible that an instruction performs
an indirect branch to its own address.
This commit ensures that this situation does not end up in an hard
failure.
Alessandro Di Federico