当前位置: 首页>>代码示例>>C++>>正文

C++ AnalysisProcessor::buildSymbolicRegOperand方法代码示例

本文整理汇总了C++中AnalysisProcessor::buildSymbolicRegOperand方法的典型用法代码示例。如果您正苦于以下问题：C++ AnalysisProcessor::buildSymbolicRegOperand方法的具体用法？C++ AnalysisProcessor::buildSymbolicRegOperand怎么用？C++ AnalysisProcessor::buildSymbolicRegOperand使用的例子？那么, 这里精选的方法代码示例或许可以为您提供帮助。您也可以进一步了解该方法所在类AnalysisProcessor的用法示例。


在下文中一共展示了AnalysisProcessor::buildSymbolicRegOperand方法的12个代码示例，这些例子默认根据受欢迎程度排序。您可以为喜欢或者感觉有用的代码点赞，您的评价将有助于系统推荐出更棒的C++代码示例。

示例1: regMem

void XorpsIRBuilder::regMem(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicElement   *se;
  std::stringstream expr, op1, op2;
  uint32            readSize = this->operands[1].getSize();
  uint64            mem      = this->operands[1].getValue();
  uint64            reg      = this->operands[0].getValue();
  uint32            regSize  = this->operands[1].getSize();

  /* Create the SMT semantic */
  op1 << ap.buildSymbolicRegOperand(reg, regSize);
  op2 << ap.buildSymbolicMemOperand(mem, readSize);

  // Final expr
  expr << smt2lib::bvxor(op1.str(), op2.str());

  /* Create the symbolic element */
  se = ap.createRegSE(inst, expr, reg, regSize);

  /* Apply the taint */
  ap.aluSpreadTaintRegMem(se, reg, mem, readSize);
}
开发者ID:AmesianX，项目名称:Triton-windows，代码行数:21，代码来源:XorpsIRBuilder.cpp

示例2: regReg

void AndnpdIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicElement   *se;
  std::stringstream expr, op1, op2;
  uint64_t          reg1     = this->operands[0].getValue();
  uint64_t          reg2     = this->operands[1].getValue();
  uint32_t          regSize1 = this->operands[0].getSize();
  uint32_t          regSize2 = this->operands[1].getSize();

  /* Create the SMT semantic */
  op1 << ap.buildSymbolicRegOperand(reg1, regSize1);
  op2 << ap.buildSymbolicRegOperand(reg2, regSize2);

  // Final expr
  expr << smt2lib::bvand(smt2lib::bvnot(op1.str()), op2.str());

  /* Create the symbolic element */
  se = ap.createRegSE(inst, expr, reg1, regSize1);

  /* Apply the taint */
  ap.aluSpreadTaintRegReg(se, reg1, reg2);
}
开发者ID:ISkandaLTR，项目名称:Triton，代码行数:21，代码来源:AndnpdIRBuilder.cpp

示例3: regMem

void XorpsIRBuilder::regMem(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2;
  auto memSize = this->operands[1].getMem().getSize();
  auto mem = this->operands[1].getMem();
  auto reg = this->operands[0].getReg();
  auto regSize = this->operands[1].getReg().getSize();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(reg, regSize);
  op2 = ap.buildSymbolicMemOperand(mem, memSize);

  // Final expr
  expr = smt2lib::bvxor(op1, op2);

  /* Create the symbolic expression */
  se = ap.createRegSE(inst, expr, reg, regSize);

  /* Apply the taint */
  ap.aluSpreadTaintRegMem(se, reg, mem, memSize);
}
开发者ID:v0re，项目名称:Triton，代码行数:21，代码来源:XorpsIRBuilder.cpp

示例4: regReg

void OrpsIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2;
  auto reg1 = this->operands[0].getReg().getTritonRegId();
  auto reg2 = this->operands[1].getReg().getTritonRegId();
  auto regSize1 = this->operands[0].getReg().getSize();
  auto regSize2 = this->operands[1].getReg().getSize();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
  op2 = ap.buildSymbolicRegOperand(reg2, regSize2);

  /* Final expr */
  expr = smt2lib::bvor(op1, op2);

  /* Create the symbolic expression */
  se = ap.createRegSE(inst, expr, reg1, regSize1);

  /* Apply the taint */
  ap.aluSpreadTaintRegReg(se, reg1, reg2);
}
开发者ID:nnamon，项目名称:Triton，代码行数:21，代码来源:OrpsIRBuilder.cpp

示例5: regReg

void RcrIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se1, *se2;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2, *cf, *res;
  uint64 reg1     = this->operands[0].getValue();
  uint32 regSize1 = this->operands[0].getSize();

  /* Create the SMT semantic */
  cf = ap.buildSymbolicFlagOperand(ID_CF);
  op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
  /*
   * Note that SMT2-LIB doesn't support expression as rotate's value.
   * The op2 must be the concretization's value.
   */
  op2 = smt2lib::decimal(ap.getRegisterValue(ID_RCX) & 0xff); /* 0xff -> There is only CL available */

  /* Rcl expression */
  expr = smt2lib::bvror(
            op2,
            smt2lib::concat(cf, op1)
          );

  /* Temporary extended expression */
  se1 = ap.createSE(inst, expr, "Temporary Extended Expression");

  /* Apply the taint */
  ap.assignmentSpreadTaintExprReg(se1, reg1);

  /* Result expression */
  res = smt2lib::extract((regSize1 * REG_SIZE) - 1, 0, expr);

  /* Create the symbolic expression */
  se2 = ap.createRegSE(inst, res, reg1, regSize1);

  /* Apply the taint */
  ap.aluSpreadTaintRegReg(se2, reg1, reg1);

  /* Add the symbolic flags expression to the current inst */
  EflagsBuilder::cfRcl(inst, se1, ap, regSize1, op2); /* Same as RCL */
  EflagsBuilder::ofRor(inst, se2, ap, regSize1, op2); /* Same as ROR */
}
开发者ID:Jinmo，项目名称:Triton，代码行数:40，代码来源:RcrIRBuilder.cpp

示例6: regMem

void MovlpdIRBuilder::regMem(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2;
  auto memSize = this->operands[1].getMem().getSize();
  auto mem = this->operands[1].getMem().getAddress();
  auto reg = this->operands[0].getReg().getTritonRegId();
  auto regSize = this->operands[0].getReg().getSize();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(reg, regSize);
  op2 = ap.buildSymbolicMemOperand(mem, memSize);

  expr = smt2lib::concat(
            smt2lib::extract(127, 64, op1), /* Destination[64..127] unchanged */
            smt2lib::extract(63, 0, op2)    /* Destination[0..63] = Source */
          );

  /* Create the symbolic expression */
  se = ap.createRegSE(inst, expr, reg, regSize);

  /* Apply the taint */
  ap.assignmentSpreadTaintRegMem(se, reg, mem, memSize);
}
开发者ID:nnamon，项目名称:Triton，代码行数:23，代码来源:MovlpdIRBuilder.cpp

示例7: regMem

void MovhpdIRBuilder::regMem(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicElement   *se;
  std::stringstream expr, op1, op2;
  uint32            readSize = this->operands[1].getSize();
  uint64            mem      = this->operands[1].getValue();
  uint64            reg      = this->operands[0].getValue();
  uint64            regSize  = this->operands[0].getSize();

  /* Create the SMT semantic */
  op1 << ap.buildSymbolicRegOperand(reg, regSize);
  op2 << ap.buildSymbolicMemOperand(mem, readSize);

  expr << smt2lib::concat(
            smt2lib::extract(63, 0, op2.str()), /* Destination[64..127] = Source */
            smt2lib::extract(63, 0, op1.str())  /* Destination[0..63] unchanged */
          );

  /* Create the symbolic element */
  se = ap.createRegSE(inst, expr, reg, regSize);

  /* Apply the taint */
  ap.assignmentSpreadTaintRegMem(se, reg, mem, readSize);
}
开发者ID:bowlofstew，项目名称:Triton，代码行数:23，代码来源:MovhpdIRBuilder.cpp

示例8: regReg

void MovhlpsIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2;
  auto reg1 = this->operands[0].getReg();
  auto regSize1 = this->operands[0].getReg().getSize();
  auto reg2 = this->operands[1].getReg();
  auto regSize2 = this->operands[1].getReg().getSize();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
  op2 = ap.buildSymbolicRegOperand(reg2, regSize2);

  /* Destination[0..63] = Source[64..127] */
  expr = smt2lib::concat(
            smt2lib::extract(127, 64, op1), /* Destination[64..127] unchanged */
            smt2lib::extract(127, 64, op2)  /* Destination[0..63] = Source[64..127]; */
          );

  /* Create the symbolic expression */
  se = ap.createRegSE(inst, expr, reg1, regSize1);

  /* Apply the taint */
  ap.assignmentSpreadTaintRegReg(se, reg1, reg2);
}
开发者ID:v0re，项目名称:Triton，代码行数:24，代码来源:MovhlpsIRBuilder.cpp

示例9: regReg

void ImulIRBuilder::regReg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2, *op3;
  uint64 imm = 0;
  auto reg1 = this->operands[0].getReg();
  auto regSize1 = this->operands[0].getReg().getSize();
  auto reg2 = this->operands[1].getReg();
  auto regSize2 = this->operands[1].getReg().getSize();

  if (this->operands[2].getType() == IRBuilderOperand::IMM)
    imm = this->operands[2].getImm().getValue();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(reg1, regSize1);
  op2 = ap.buildSymbolicRegOperand(reg2, regSize2);
  op3 = smt2lib::bv(imm, regSize2 * REG_SIZE);

  /* Case 1 */
  if (this->operands[0].isReadOnly()) {

    /* Expr */
    expr = smt2lib::bvmul(
             smt2lib::sx(regSize2 * REG_SIZE, op2),
             smt2lib::sx(regSize1 * REG_SIZE, op1)
           );

    switch (regSize1) {

      case BYTE_SIZE:
        /* RAX */
        se = ap.createRegSE(inst, smt2lib::extract(WORD_SIZE_BIT - 1, 0, expr), ID_TMP_RAX, WORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg2);
        break;

      case WORD_SIZE:
        /* RDX */
        se = ap.createRegSE(inst, smt2lib::extract(DWORD_SIZE_BIT - 1, WORD_SIZE_BIT, expr), ID_TMP_RDX, WORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg2);
        /* RAX */
        se = ap.createRegSE(inst, smt2lib::extract(WORD_SIZE_BIT - 1, 0, expr), ID_TMP_RAX, WORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg2);
        break;

      case DWORD_SIZE:
        /* RDX */
        se = ap.createRegSE(inst, smt2lib::extract(QWORD_SIZE_BIT - 1, DWORD_SIZE_BIT, expr), ID_TMP_RDX, DWORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg2);
        /* RAX */
        se = ap.createRegSE(inst, smt2lib::extract(DWORD_SIZE_BIT - 1, 0, expr), ID_TMP_RAX, DWORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg2);
        break;

      case QWORD_SIZE:
        /* RDX */
        se = ap.createRegSE(inst, smt2lib::extract(DQWORD_SIZE_BIT - 1, QWORD_SIZE_BIT, expr), ID_TMP_RDX, QWORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg2);
        /* RAX */
        se = ap.createRegSE(inst, smt2lib::extract(QWORD_SIZE_BIT - 1, 0, expr), ID_TMP_RAX, QWORD_SIZE);
        ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg2);
        break;

      default:
        throw std::runtime_error("ImulIRBuilder::reg - Invalid operand size");
    }

  }

  /* Case 2 */
  else if (this->operands[0].isReadAndWrite()) {
    /* Expr */
    expr = smt2lib::bvmul(
             smt2lib::sx(regSize1 * REG_SIZE, op1),
             smt2lib::sx(regSize2 * REG_SIZE, op2)
           );

    /* Create the symbolic expression */
    se = ap.createRegSE(inst, smt2lib::extract((regSize1 * REG_SIZE) - 1, 0, expr), reg1, regSize1);

    /* Apply the taint */
    ap.aluSpreadTaintRegReg(se, reg1, reg2);
  }

  /* Case 3 */
  else if (this->operands[0].isWriteOnly()) {
    /* Expr */
    expr = smt2lib::bvmul(
             smt2lib::sx(regSize2 * REG_SIZE, op2),
             smt2lib::sx(regSize2 * REG_SIZE, op3)
           );

    /* Create the symbolic expression */
    se = ap.createRegSE(inst, smt2lib::extract((regSize1 * REG_SIZE) - 1, 0, expr), reg1, regSize1);

    /* Apply the taint */
    ap.aluSpreadTaintRegReg(se, reg1, reg2);
  }

  else {
    throw std::runtime_error("ImulIRBuilder::regReg - Invalid operand");
  }
//.........这里部分代码省略.........
开发者ID:453483289，项目名称:Triton，代码行数:101，代码来源:ImulIRBuilder.cpp

示例10: mem

void IdivIRBuilder::mem(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicElement   *se;
  std::stringstream expr, result, dividend, divisor, mod;
  uint64            mem       = this->operands[0].getValue();
  uint32            memSize   = this->operands[0].getSize();

  /* Create the SMT semantic */
  divisor << ap.buildSymbolicMemOperand(mem, memSize);

  switch (memSize) {

    case BYTE_SIZE:
      /* AX */
      dividend << ap.buildSymbolicRegOperand(ID_RAX, WORD_SIZE);
      /* res = AX / Source */
      result << smt2lib::bvsdiv(dividend.str(), smt2lib::sx(divisor.str(), BYTE_SIZE_BIT));
      /* mod = AX % Source */
      mod << smt2lib::bvsrem(dividend.str(), smt2lib::sx(divisor.str(), BYTE_SIZE_BIT));
      /* AH = mod */
      /* AL = res */
      expr << smt2lib::concat(
                smt2lib::extract(7, 0, mod.str()),   /* AH = mod */
                smt2lib::extract(7, 0, result.str()) /* AL = res */
              );
      /* Create the symbolic element */
      se = ap.createRegSE(inst, expr, ID_RAX, WORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegMem(se, ID_RAX, mem, memSize);
      break;

    case WORD_SIZE:
      /* DX:AX */
      dividend << smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, WORD_SIZE), ap.buildSymbolicRegOperand(ID_RAX, WORD_SIZE));
      /* res = DX:AX / Source */
      result << smt2lib::extract(15, 0, smt2lib::bvsdiv(dividend.str(), smt2lib::sx(divisor.str(), WORD_SIZE_BIT)));
      /* mod = DX:AX % Source */
      mod << smt2lib::extract(15, 0, smt2lib::bvsrem(dividend.str(), smt2lib::sx(divisor.str(), WORD_SIZE_BIT)));
      /* Create the symbolic element for AX */
      se = ap.createRegSE(inst, result, ID_RAX, WORD_SIZE);
      /* Apply the taint for AX */
      ap.aluSpreadTaintRegMem(se, ID_RAX, mem, memSize);
      /* Create the symbolic element for DX */
      se = ap.createRegSE(inst, mod, ID_RDX, WORD_SIZE);
      /* Apply the taint for DX */
      ap.aluSpreadTaintRegMem(se, ID_RDX, mem, memSize);
      break;

    case DWORD_SIZE:
      /* EDX:EAX */
      dividend << smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, DWORD_SIZE), ap.buildSymbolicRegOperand(ID_RAX, DWORD_SIZE));
      /* res = EDX:EAX / Source */
      result << smt2lib::extract(31, 0, smt2lib::bvsdiv(dividend.str(), smt2lib::sx(divisor.str(), DWORD_SIZE_BIT)));
      /* mod = EDX:EAX % Source */
      mod << smt2lib::extract(31, 0, smt2lib::bvsrem(dividend.str(), smt2lib::sx(divisor.str(), DWORD_SIZE_BIT)));
      /* Create the symbolic element for EAX */
      se = ap.createRegSE(inst, result, ID_RAX, DWORD_SIZE);
      /* Apply the taint for EAX */
      ap.aluSpreadTaintRegMem(se, ID_RAX, mem, memSize);
      /* Create the symbolic element for EDX */
      se = ap.createRegSE(inst, mod, ID_RDX, DWORD_SIZE);
      /* Apply the taint for EDX */
      ap.aluSpreadTaintRegMem(se, ID_RDX, mem, memSize);
      break;

    case QWORD_SIZE:
      /* RDX:RAX */
      dividend << smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, QWORD_SIZE), ap.buildSymbolicRegOperand(ID_RDX, QWORD_SIZE));
      /* res = RDX:RAX / Source */
      result << smt2lib::extract(63, 0, smt2lib::bvsdiv(dividend.str(), smt2lib::sx(divisor.str(), QWORD_SIZE_BIT)));
      /* mod = RDX:RAX % Source */
      mod << smt2lib::extract(63, 0, smt2lib::bvsrem(dividend.str(), smt2lib::sx(divisor.str(), QWORD_SIZE_BIT)));
      /* Create the symbolic element for RAX */
      se = ap.createRegSE(inst, result, ID_RAX, QWORD_SIZE);
      /* Apply the taint for RAX */
      ap.aluSpreadTaintRegMem(se, ID_RAX, mem, memSize);
      /* Create the symbolic element for RDX */
      se = ap.createRegSE(inst, mod, ID_RDX, QWORD_SIZE);
      /* Apply the taint for RDX */
      ap.aluSpreadTaintRegMem(se, ID_RDX, mem, memSize);
      break;
  }
}
开发者ID:AmesianX，项目名称:Triton-windows，代码行数:82，代码来源:IdivIRBuilder.cpp

示例11: reg

void DivIRBuilder::reg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *result, *dividend, *divisor, *mod;
  auto reg = this->operands[0].getReg().getTritonRegId();
  auto regSize = this->operands[0].getReg().getSize();

  /* Create the SMT semantic */
  divisor = ap.buildSymbolicRegOperand(reg, regSize);

  switch (regSize) {

    case BYTE_SIZE:
      /* AX */
      dividend = ap.buildSymbolicRegOperand(ID_RAX, WORD_SIZE);
      /* res = AX / Source */
      result = smt2lib::bvudiv(dividend, smt2lib::zx(BYTE_SIZE_BIT, divisor));
      /* mod = AX % Source */
      mod = smt2lib::bvurem(dividend, smt2lib::zx(BYTE_SIZE_BIT, divisor));
      /* AH = mod */
      /* AL = res */
      expr = smt2lib::concat(
                smt2lib::extract(7, 0, mod),   /* AH = mod */
                smt2lib::extract(7, 0, result) /* AL = res */
              );
      /* Create the symbolic expression */
      se = ap.createRegSE(inst, expr, ID_RAX, WORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_RAX, reg);
      break;

    case WORD_SIZE:
      /* DX:AX */
      dividend = smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, WORD_SIZE), ap.buildSymbolicRegOperand(ID_RAX, WORD_SIZE));
      /* res = DX:AX / Source */
      result = smt2lib::extract(15, 0, smt2lib::bvudiv(dividend, smt2lib::zx(WORD_SIZE_BIT, divisor)));
      /* mod = DX:AX % Source */
      mod = smt2lib::extract(15, 0, smt2lib::bvurem(dividend, smt2lib::zx(WORD_SIZE_BIT, divisor)));
      /* Create the symbolic expression for AX */
      se = ap.createRegSE(inst, result, ID_RAX, WORD_SIZE);
      /* Apply the taint for AX */
      ap.aluSpreadTaintRegReg(se, ID_RAX, reg);
      /* Create the symbolic expression for DX */
      se = ap.createRegSE(inst, mod, ID_RDX, WORD_SIZE);
      /* Apply the taint for DX */
      ap.aluSpreadTaintRegReg(se, ID_RDX, reg);
      break;

    case DWORD_SIZE:
      /* EDX:EAX */
      dividend = smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, DWORD_SIZE), ap.buildSymbolicRegOperand(ID_RAX, DWORD_SIZE));
      /* res = EDX:EAX / Source */
      result = smt2lib::extract(31, 0, smt2lib::bvudiv(dividend, smt2lib::zx(DWORD_SIZE_BIT, divisor)));
      /* mod = EDX:EAX % Source */
      mod = smt2lib::extract(31, 0, smt2lib::bvurem(dividend, smt2lib::zx(DWORD_SIZE_BIT, divisor)));
      /* Create the symbolic expression for EAX */
      se = ap.createRegSE(inst, result, ID_RAX, DWORD_SIZE);
      /* Apply the taint for EAX */
      ap.aluSpreadTaintRegReg(se, ID_RAX, reg);
      /* Create the symbolic expression for EDX */
      se = ap.createRegSE(inst, mod, ID_RDX, DWORD_SIZE);
      /* Apply the taint for EDX */
      ap.aluSpreadTaintRegReg(se, ID_RDX, reg);
      break;

    case QWORD_SIZE:
      /* RDX:RAX */
      dividend = smt2lib::concat(ap.buildSymbolicRegOperand(ID_RDX, QWORD_SIZE), ap.buildSymbolicRegOperand(ID_RAX, QWORD_SIZE));
      /* res = RDX:RAX / Source */
      result = smt2lib::extract(63, 0, smt2lib::bvudiv(dividend, smt2lib::zx(QWORD_SIZE_BIT, divisor)));
      /* mod = RDX:RAX % Source */
      mod = smt2lib::extract(63, 0, smt2lib::bvurem(dividend, smt2lib::zx(QWORD_SIZE_BIT, divisor)));
      /* Create the symbolic expression for RAX */
      se = ap.createRegSE(inst, result, ID_RAX, QWORD_SIZE);
      /* Apply the taint for RAX */
      ap.aluSpreadTaintRegReg(se, ID_RAX, reg);
      /* Create the symbolic expression for RDX */
      se = ap.createRegSE(inst, mod, ID_RDX, QWORD_SIZE);
      /* Apply the taint for RDX */
      ap.aluSpreadTaintRegReg(se, ID_RDX, reg);
      break;
  }
}
开发者ID:nnamon，项目名称:Triton，代码行数:82，代码来源:DivIRBuilder.cpp

示例12: reg

void MulIRBuilder::reg(AnalysisProcessor &ap, Inst &inst) const {
  SymbolicExpression *se;
  smt2lib::smtAstAbstractNode *expr, *op1, *op2, *rax, *rdx;
  auto reg = this->operands[0].getReg();
  auto regSize = this->operands[0].getReg().getSize();

  /* Create the SMT semantic */
  op1 = ap.buildSymbolicRegOperand(ID_TMP_RAX, regSize);
  op2 = ap.buildSymbolicRegOperand(reg, regSize);

  switch (regSize) {

    /* AX = AL * r/m8 */
    case BYTE_SIZE:
      /* Final expr */
      expr = smt2lib::bvmul(
                smt2lib::zx(BYTE_SIZE_BIT, op1),
                smt2lib::zx(BYTE_SIZE_BIT, op2)
              );
      /* Create the symbolic expression */
      se = ap.createRegSE(inst, expr, ID_TMP_RAX, WORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg);
      /* Add the symbolic flags expression to the current inst */
      rax = smt2lib::extract((WORD_SIZE_BIT - 1), BYTE_SIZE_BIT, expr);
      EflagsBuilder::cfMul(inst, se, ap, regSize, rax);
      EflagsBuilder::ofMul(inst, se, ap, regSize, rax);
      break;

    /* DX:AX = AX * r/m16 */
    case WORD_SIZE:
      /* Final expr */
      expr = smt2lib::bvmul(
                smt2lib::zx(WORD_SIZE_BIT, op1),
                smt2lib::zx(WORD_SIZE_BIT, op2)
              );
      rax = smt2lib::extract((WORD_SIZE_BIT - 1), 0, expr);
      rdx = smt2lib::extract((DWORD_SIZE_BIT - 1), WORD_SIZE_BIT, expr);
      /* Create the symbolic expression for AX */
      se = ap.createRegSE(inst, rax, ID_TMP_RAX, WORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg);
      /* Create the symbolic expression for DX */
      se = ap.createRegSE(inst, rdx, ID_TMP_RDX, WORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg);
      /* Add the symbolic flags expression to the current inst */
      EflagsBuilder::cfMul(inst, se, ap, regSize, rdx);
      EflagsBuilder::ofMul(inst, se, ap, regSize, rdx);
      break;

    /* EDX:EAX = EAX * r/m32 */
    case DWORD_SIZE:
      /* Final expr */
      expr = smt2lib::bvmul(
                smt2lib::zx(DWORD_SIZE_BIT, op1),
                smt2lib::zx(DWORD_SIZE_BIT, op2)
              );
      rax = smt2lib::extract((DWORD_SIZE_BIT - 1), 0, expr);
      rdx = smt2lib::extract((QWORD_SIZE_BIT - 1), DWORD_SIZE_BIT, expr);
      /* Create the symbolic expression for EAX */
      se = ap.createRegSE(inst, rax, ID_TMP_RAX, DWORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg);
      /* Create the symbolic expression for EDX */
      se = ap.createRegSE(inst, rdx, ID_TMP_RDX, DWORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg);
      /* Add the symbolic flags expression to the current inst */
      EflagsBuilder::cfMul(inst, se, ap, regSize, rdx);
      EflagsBuilder::ofMul(inst, se, ap, regSize, rdx);
      break;

    /* RDX:RAX = RAX * r/m64 */
    case QWORD_SIZE:
      /* Final expr */
      expr = smt2lib::bvmul(
                smt2lib::zx(QWORD_SIZE_BIT, op1),
                smt2lib::zx(QWORD_SIZE_BIT, op2)
              );
      rax = smt2lib::extract((QWORD_SIZE_BIT - 1), 0, expr);
      rdx = smt2lib::extract((DQWORD_SIZE_BIT - 1), QWORD_SIZE_BIT, expr);
      /* Create the symbolic expression for RAX */
      se = ap.createRegSE(inst, rax, ID_TMP_RAX, QWORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RAX, reg);
      /* Create the symbolic expression for RDX */
      se = ap.createRegSE(inst, rdx, ID_TMP_RDX, QWORD_SIZE);
      /* Apply the taint */
      ap.aluSpreadTaintRegReg(se, ID_TMP_RDX, reg);
      /* Add the symbolic flags expression to the current inst */
      EflagsBuilder::cfMul(inst, se, ap, regSize, rdx);
      EflagsBuilder::ofMul(inst, se, ap, regSize, rdx);
      break;

  }

}
开发者ID:453483289，项目名称:Triton，代码行数:98，代码来源:MulIRBuilder.cpp


注：本文中的AnalysisProcessor::buildSymbolicRegOperand方法示例由纯净天空整理自Github/MSDocs等开源代码及文档管理平台，相关代码片段筛选自各路编程大神贡献的开源项目，源码版权归原作者所有，传播和使用请参考对应项目的License；未经允许，请勿转载。