Architecture-agnostic and ABI-independent data-flow analyses that
traverse the recovered functions in order to detect arguments and
return values registers.
An architecture-agnostic analysis that attempts to detect
boundaries of functions, recover the control-flow graph as
well as function prototypes (arguments and return values)
of the original program. The analysis identifies whether
the function jumps to its return address (namely, it is a
regular function), it tracks the evolution of the stack
by determining its height (in order to say if the stack is
left in a correct position upon stackframe destruction),
and it identifies callee-saved registers.
A pass which segregates direct stack accesses from all other
memory accesses through appropriate alias information metadata.
By doing so, we provide a way to say that stack accesses reasonably
do not interfere with any other memory access. This pass also tries
to canonicalize `inttoptr` + `add` instructions into `getelementptr`s
so as to avoid the use of `inttoptr`, which would otherwise inhibit
compiler optimizations.
This commit introduces the type system of the model along with several
various other improvements to the model and its users.
* Introduce the type system.
* Introduce possibility to tag certain fields in the model as to be
optional during YAML serialization.
* All the `Name` fields have been replaced in favor of `CustomName` plus
a `name` method that will use `CustomName` if available, or an
automatically generated name otherwise.
* Make TupleTreeReferences behavior more robust: now you either need to
have a valid pointer to `Root` and a `Path` or be default constructed
(`nullptr` for `Root` and an empty `Path`). Any other configuration is
invalid.
* The type system introduces `RawFunctionType`: this superseds the
previous way in which we were specifying arguments and return
values. Users of such information have been updated accordingly.
The previous design returned a model::Binary &, which did not allow
users writing the model to properly initialize cross references between
different parts of the model.
When we compare StackAnalysis test results, the order in which things
appear in the JSON is relevant. However, the output was
non-deterministic due to a `std::map` using a pointer as key.
This commit improves the situation by sorting the elements by name
before dumping them in JSON.
This commit drops support for running StackAnalysis without ABI
analysis. This has been broken for quite some time and a source of slow
downs in (badly) crafted optimization pipelines.
We used to mark call to noreturn functions as killers, but this is not
correct.
Note that this is a temporary solution, we need to explicitly handle
such situations.
Generated code now either jumps to `anypc` or `unexpectedpc`. The latter
one is to be considered a safety measure and will be populated with an
unreachable instruction on the decompilation pipeline.
Changes include:
- `getFunctionCall` has been moved in IRHelpers.h
- `getFallthrough` and `getFunctionCallCallee`
have been simplified and added in IRHelpers.h (their old versions
have been removed respectively from FCI.h and revng.h)
- `FCI::getCall` and `FCI::isCall` have been removed
due to redundancy with `getFunctionCall`.
After combining two AS objects, removing an ASOContent in the cleanup
phase may lead to a mismatch in the CSVs promoted to function argument,
with some registers actually being used. In most cases, this results in
promoting only one or few alive registers as function argument.
We used to accidentaly call `resetCacheMustHit` on the just popped
element of the set, resulting in an out-of-bounds access within the
container.
This bug has been spotted thanks to AddressSanitizer.
We used to detect callee-saved registers only by checking if their final
value was identical to the initial one. However, the need for a more
precise heuristic emerged: we now also check if at least on of the stack
slots contains that same value.
This commit fixes a subtle bug that was preventing us from correctly
considering the effects of function calls during ABI analysis.
Specifically, when merging information from the call site to the caller,
in case the caller did not provide any information about a certain
slots, we used the `DefaultMap::Default` field, which is the correct
thing to do, except for the fact that, in two methods, the `Default`
field was being updated to early.
This basically had the effect of not considering arguments of function
calls as used, e.g., in URAOF.
Under certain conditions, we ended up having code in the ABI IR which
was not reachable. This was due to the fact that a certain instruction
was initially detected as an indirect call, triggering inclusion in the
function of the fallthrough code, and then as a return, which has no
successors within the function.
This commit simply prunes the ABI IR in the finalization method.
Antonio Frighetto