def _analyze(self):
if not self.block.statements:
return
last_stmt = self.block.statements[-1]
if not type(last_stmt) is Stmt.Call:
self.result_block = self.block
return
cc = None
prototype = None
args = None
stack_arg_locs: List[SimStackArg] = []
stackarg_sp_diff = 0
target = self._get_call_target(last_stmt)
if target is not None and target in self.kb.functions:
# function-specific logic when the calling target is known
func = self.kb.functions[target]
if func.prototype is None:
func.find_declaration()
cc = func.calling_convention
prototype = func.prototype
args = []
arg_locs = None
if cc is None:
l.warning('%s has an unknown calling convention.', repr(func))
else:
stackarg_sp_diff = func.calling_convention.STACKARG_SP_DIFF
if prototype is not None:
# Make arguments
arg_locs = cc.arg_locs(prototype)
if prototype.variadic:
# determine the number of variadic arguments
variadic_args = self._determine_variadic_arguments(
func, cc, last_stmt)
if variadic_args:
callsite_ty = copy.copy(prototype)
callsite_ty.args = list(callsite_ty.args)
for i in range(variadic_args):
callsite_ty.args.append(SimTypeInt().with_arch(
self.project.arch))
arg_locs = cc.arg_locs(callsite_ty)
if arg_locs is not None:
for arg_loc in arg_locs:
if type(arg_loc) is SimRegArg:
size = arg_loc.size
offset = arg_loc.check_offset(cc.arch)
_, the_arg = self._resolve_register_argument(
last_stmt, arg_loc)
if the_arg is not None:
args.append(the_arg)
else:
# Reaching definitions are not available. Create a register expression instead.
args.append(
Expr.Register(self._atom_idx(),
None,
offset,
size * 8,
reg_name=arg_loc.reg_name))
elif type(arg_loc) is SimStackArg:
stack_arg_locs.append(arg_loc)
_, the_arg = self._resolve_stack_argument(
last_stmt, arg_loc)
if the_arg is not None:
args.append(the_arg)
else:
args.append(None)
else:
raise NotImplementedError('Not implemented yet.')
# Remove the old call statement
new_stmts = self.block.statements[:-1]
# remove the statement that stores the return address
if self.project.arch.call_pushes_ret:
# check if the last statement is storing the return address onto the top of the stack
if len(new_stmts) >= 1:
the_stmt = new_stmts[-1]
if isinstance(the_stmt, Stmt.Store) and isinstance(
the_stmt.data, Expr.Const):
if isinstance(the_stmt.addr, Expr.StackBaseOffset) and \
the_stmt.data.value == self.block.addr + self.block.original_size:
# yes it is!
new_stmts = new_stmts[:-1]
else:
# if there is an lr register...
lr_offset = None
if archinfo.arch_arm.is_arm_arch(
self.project.arch) or self.project.arch.name in {
'PPC32', 'PPC64'
}:
lr_offset = self.project.arch.registers['lr'][0]
elif self.project.arch.name in {'MIPS32', 'MIPS64'}:
lr_offset = self.project.arch.registers['ra'][0]
if lr_offset is not None:
# remove the assignment to the lr register
if len(new_stmts) >= 1:
the_stmt = new_stmts[-1]
if (isinstance(the_stmt, Stmt.Assignment)
and isinstance(the_stmt.dst, Expr.Register)
and the_stmt.dst.reg_offset == lr_offset):
# found it
new_stmts = new_stmts[:-1]
# calculate stack offsets for arguments that are put on the stack. these offsets will be consumed by
# simplification steps in the future, which may decide to remove statements that stores arguments on the stack.
if stack_arg_locs:
sp_offset = self._stack_pointer_tracker.offset_before(
last_stmt.ins_addr, self.project.arch.sp_offset)
if sp_offset is None:
l.warning(
"Failed to calculate the stack pointer offset at pc %#x. You may find redundant Store "
"statements.", last_stmt.ins_addr)
self.stack_arg_offsets = None
else:
self.stack_arg_offsets = set(
(last_stmt.ins_addr,
sp_offset + arg.stack_offset - stackarg_sp_diff)
for arg in stack_arg_locs)
ret_expr = last_stmt.ret_expr
# if ret_expr is None, it means in previous steps (such as during AIL simplification) we have deemed the return
# value of this call statement as useless and is removed.
new_stmts.append(
Stmt.Call(
last_stmt,
last_stmt.target,
calling_convention=cc,
prototype=prototype,
args=args,
ret_expr=ret_expr,
**last_stmt.tags,
))
new_block = self.block.copy()
new_block.statements = new_stmts
self.result_block = new_block
def _ail_handle_Jump(self, stmt):
target = self._expr(stmt.target)
return Stmt.Jump(stmt.idx, target, **stmt.tags)
def _analyze(self):
if not self.block.statements:
return
last_stmt = self.block.statements[-1]
if not type(last_stmt) is Stmt.Call:
self.result_block = self.block
return
target = self._get_call_target(last_stmt)
if target is None:
return
if target not in self.kb.functions:
return
func = self.kb.functions[target]
if func.prototype is None:
func.find_declaration()
args = [ ]
arg_locs = None
if func.calling_convention is None:
l.warning('%s has an unknown calling convention.', repr(func))
else:
if func.prototype is not None:
# Make arguments
arg_locs = func.calling_convention.arg_locs()
else:
if func.calling_convention.args is not None:
arg_locs = func.calling_convention.arg_locs()
if arg_locs is not None:
for arg_loc in arg_locs:
if type(arg_loc) is SimRegArg:
size = arg_loc.size
offset = arg_loc._fix_offset(None, size, arch=self.project.arch)
the_arg = self._resolve_register_argument(last_stmt, arg_loc)
if the_arg is not None:
args.append(the_arg)
else:
# Reaching definitions are not available. Create a register expression instead.
args.append(Expr.Register(None, None, offset, size * 8, reg_name=arg_loc.reg_name))
elif type(arg_loc) is SimStackArg:
the_arg = self._resolve_stack_argument(last_stmt, arg_loc)
if the_arg is not None:
args.append(the_arg)
else:
args.append(None)
else:
raise NotImplementedError('Not implemented yet.')
new_stmts = self.block.statements[:-1]
if self.project.arch.call_pushes_ret:
# check if the last statement is storing the return address onto the top of the stack
if len(new_stmts) >= 1:
the_stmt = new_stmts[-1]
if isinstance(the_stmt, Stmt.Store) and isinstance(the_stmt.data, Expr.Const):
if isinstance(the_stmt.variable, SimStackVariable) and \
the_stmt.data.value == self.block.addr + self.block.original_size:
# yes it is!
new_stmts = new_stmts[:-1]
ret_expr = last_stmt.ret_expr
if ret_expr is None:
ret_expr = None
if func.prototype is not None:
if func.prototype.returnty is not None and not isinstance(func.prototype.returnty, SimTypeBottom):
# it has a return value
if func.calling_convention is not None:
ret_expr_size = func.prototype.returnty._with_arch(self.project.arch).size
reg_offset = func.calling_convention.RETURN_VAL._fix_offset(
None,
ret_expr_size,
arch=self.project.arch,
)
ret_expr = Expr.Register(None, None, reg_offset, ret_expr_size * 8)
new_stmts.append(Stmt.Call(last_stmt, last_stmt.target,
calling_convention=func.calling_convention,
prototype=func.prototype,
args=args,
ret_expr=ret_expr,
**last_stmt.tags,
))
new_block = self.block.copy()
new_block.statements = new_stmts
self.result_block = new_block
