Package ghidra.program.util
Class VarnodeContext
java.lang.Object
ghidra.program.util.VarnodeContext
- All Implemented Interfaces:
ProcessorContext
,ProcessorContextView
-
Field Summary
FieldsModifier and TypeFieldDescriptionprotected AddressFactory
protected HashMap
<Varnode, AddressSet> final Address
final int
final Varnode
protected Address
protected Instruction
boolean
protected boolean
protected boolean
protected Varnode[]
protected int
protected Program
protected ProgramContext
protected Varnode[]
protected Register
protected Varnode
final Address
protected VarnodeTranslator
-
Constructor Summary
ConstructorsConstructorDescriptionVarnodeContext
(Program program, ProgramContext programContext, ProgramContext spaceProgramContext, boolean trackStartEndState) -
Method Summary
Modifier and TypeMethodDescriptionadd
(Varnode val1, Varnode val2, ContextEvaluator evaluator) Add two varnodes together to get a new value This could create a new space and return a varnode pointed into that spaceand
(Varnode val1, Varnode val2, ContextEvaluator evaluator) void
void
clearRegister
(Register reg) Clears the register within this context.void
copy
(Varnode out, Varnode in, boolean mustClearAll, ContextEvaluator evaluator) Copy the varnode with as little manipulation as possible.createConstantVarnode
(long value, int size) createVarnode
(long value, int spaceID, int size) createVarnode
(BigInteger bigVal, BigInteger spaceVal, int size) extendValue
(Varnode out, Varnode[] in, boolean signExtend, ContextEvaluator evaluator) Extend a constant value if it can be extended.void
End flow and save any necessary end flow state for the current instruction at addressvoid
Start flow at an address, recording any initial state for the current instructionvoid
flowToAddress
(Address fromAddr, Address toAddr) Records flow from/to basic blocks, or non-fallthru flowint
getAddressSpace
(String name, int bitSize) getConstant
(Varnode vnode, ContextEvaluator evaluator) getCurrentInstruction
(Address addr) boolean
getDebug()
getEndRegisterVarnodeValue
(Register reg, Address fromAddr, Address toAddr, boolean signed) Get the value (value, space, size) of a register at the end of the last execution flow taken for the instruction at toAddr.Varnode[]
getKilledVarnodes
(Function targetFunc) Address[]
getKnownFlowToAddresses
(Address toAddr) getLastSetLocation
(Register reg, BigInteger bval) return the location that this register was last set This is a transient thing, so it should only be used as a particular flow is being processed...getLastSetLocation
(Varnode rvar, BigInteger bval) return the location that this varnode was last set This is a transient thing, so it should only be used as a particular flow is being processed...protected Varnode
getMemoryValue
(Varnode varnode, boolean signed) Search the value state stack for the first occurrence of the set valueprotected Varnode
getMemoryValue
(HashMap<Address, Varnode> valStore, Varnode varnode, boolean signed) protected Varnode
getMemoryValue
(List<HashMap<Address, Varnode>> valStore, int backupDepth, Varnode varnode, boolean signed) getRegister
(Varnode vnode) Return a register given a varnodegetRegister
(String name) Get a Register given the name of a registerReturns all the Registers for the processor as an unmodifiable listgetRegisterValue
(Register register) Get the RegisterValue for the given register.getRegisterValue
(Register reg, Address toAddr) Get the current value of the register at the address.getRegisterValue
(Register reg, Address fromAddr, Address toAddr) Get the value of a register that was set coming from an address to an another address.getRegisterVarnode
(Register register) getRegisterVarnodeValue
(Register register) getRegisterVarnodeValue
(Register reg, Address fromAddr, Address toAddr, boolean signed) Get the value (value, space, size) of a register at the start of the last execution flow taken for the instruction at toAddr.Varnode[]
getReturnVarnode
(Function targetFunc) Get the contents of a processor register as a BigInteger objectgetValue
(Varnode varnode, boolean signed, ContextEvaluator evaluator) getValue
(Varnode varnode, ContextEvaluator evaluator) getVarnode
(int spaceID, long offset, int size) getVarnode
(Varnode space, Varnode offset, int size, ContextEvaluator evaluator) boolean
Returns true if a value is defined for the given register.boolean
hasValueOverRange
(Register reg, BigInteger bval, AddressSet set) boolean
Check if this is a bad address, or offset from a bad addressboolean
isConstant
(Varnode varnode) Check if this is a constant, or a suspect constantboolean
isExternalSpace
(int spaceID) Check if the space ID is an external space.protected boolean
isReadOnly
(Address addr) Check if the symbol at the address is read_only.boolean
isRegister
(Varnode varnode) Check if the varnode is associated with a register.boolean
isStackSpaceName
(String spaceName) Check if spaceName is associated with the stackboolean
isStackSymbolicSpace
(Varnode varnode) Check if varnode is in the stack spaceboolean
isSuspectConstant
(Varnode varnode) Check if the constant is a suspect constant It shouldn't be trusted in certain cases.boolean
Check if the varnode is associated with a Symbolic locationboolean
isSymbolicSpace
(int spaceID) Check if the space ID is a symbolic space.boolean
isSymbolicSpace
(AddressSpace space) Check if the space name is a symbolic space.left
(Varnode val1, Varnode val2, ContextEvaluator evaluator) or
(Varnode val1, Varnode val2, ContextEvaluator evaluator) void
restore a previously saved memory stateprotected String
void
propogateResults
(boolean clearContext) Propogate any results that are in the value cache.void
propogateValue
(Register reg, Varnode node, Varnode val, Address address) void
Save the current memory stateprotected void
putMemoryValue
(Varnode out, Varnode value) Put the value for the varnode on the top of the memory state stackprotected void
void
boolean
void
setCurrentInstruction
(Instruction instr) void
setDebug
(boolean debugOn) void
void
setRegisterValue
(RegisterValue value) Sets the specified register value within this context.void
setValue
(Register register, BigInteger value) Sets the value for a Register.Varnode[]
splitToBytes
(Varnode v, int len) subtract
(Varnode val1, Varnode val2, ContextEvaluator evaluator) Subtract two varnodes to get a new value This could create a new space and return a varnode pointed into that space
-
Field Details
-
memTraces
-
regTraces
-
uniqueTraces
-
lastSetSaves
-
memoryVals
-
regVals
-
uniqueVals
-
tempUniqueVals
-
keepTempUniqueValues
protected boolean keepTempUniqueValues -
clearVals
-
lastSet
-
allLastSet
-
program
-
trans
-
retVarnodes
-
killedVarnodes
-
stackVarnode
-
stackReg
-
BAD_ADDRESS
-
BAD_VARNODE
-
SUSPECT_ZERO_ADDRESS
-
BAD_SPACE_ID_VALUE
public final int BAD_SPACE_ID_VALUE -
hitDest
protected boolean hitDest -
pointerBitSize
protected int pointerBitSize -
addrFactory
-
programContext
-
currentAddress
-
currentInstruction
-
debug
public boolean debug
-
-
Constructor Details
-
VarnodeContext
public VarnodeContext(Program program, ProgramContext programContext, ProgramContext spaceProgramContext, boolean trackStartEndState)
-
-
Method Details
-
setDebug
public void setDebug(boolean debugOn) -
getDebug
public boolean getDebug() -
setCurrentInstruction
-
getCurrentInstruction
-
getBaseContextRegister
- Specified by:
getBaseContextRegister
in interfaceProcessorContextView
- Returns:
- the base processor context register or null if one has not been defined
-
getKnownFlowToAddresses
-
flowToAddress
Records flow from/to basic blocks, or non-fallthru flow -
flowStart
Start flow at an address, recording any initial state for the current instruction -
flowEnd
End flow and save any necessary end flow state for the current instruction at address -
getReturnVarnode
- Parameters:
targetFunc
- function to get a returning varnode for NOTE: this only gets one, unless there is custom storage on the called function there may be bonded ones in the default convention!- Returns:
- varnode that represents where functions place their return value
-
getKilledVarnodes
- Parameters:
targetFunc
- function to get killed varnodes for NOTE: this removes the return varnodes so they aren't duplicated- Returns:
- varnode that represents where functions place their return value
-
getStackVarnode
- Returns:
- Varnode that represents the stack register
-
getStackRegister
- Returns:
- Register that represents the stack register
-
getValue
-
getValue
-
getMemoryValue
Search the value state stack for the first occurrence of the set value- Parameters:
varnode
- varnode to search for a valuesigned
- true if retrieving a signed value- Returns:
- first value found on stack, null otherwise
-
getMemoryValue
-
getMemoryValue
-
putMemoryValue
Put the value for the varnode on the top of the memory state stack- Parameters:
out
- varnode for the valuevalue
- value to store for the varnode
-
putMemoryValue
-
isReadOnly
Check if the symbol at the address is read_only.- Parameters:
addr
- - address of the symbol- Returns:
- true if the block is read_only, and there are no write references.
-
createVarnode
-
createConstantVarnode
-
splitToBytes
-
createBadVarnode
-
createVarnode
-
putValue
-
readExecutableCode
public boolean readExecutableCode() -
setReadExecutableCode
public void setReadExecutableCode() -
clearReadExecutableCode
public void clearReadExecutableCode() -
propogateResults
public void propogateResults(boolean clearContext) Propogate any results that are in the value cache.- Parameters:
clearContext
- true if the cache should be cleared. The propogation could be for flow purposes, and the processing of the instruction is finished, so it's effects should be kept.
-
propogateValue
-
getLastSetLocation
return the location that this register was last set This is a transient thing, so it should only be used as a particular flow is being processed...- Parameters:
reg
- register to find last set locationbval
- value to look for to differentiate set locations, null if don't care- Returns:
- address that the register was set.
-
getLastSetLocation
return the location that this varnode was last set This is a transient thing, so it should only be used as a particular flow is being processed...- Parameters:
rvar
- the register varnodebval
- this parameter is unused.- Returns:
- address that the register was set.
-
getVarnode
-
getConstant
-
getVarnode
-
getRegisterVarnodeValue
public Varnode getRegisterVarnodeValue(Register reg, Address fromAddr, Address toAddr, boolean signed) Get the value (value, space, size) of a register at the start of the last execution flow taken for the instruction at toAddr.- Parameters:
reg
- register to retrieve the start valuefromAddr
- flow from address (not used currently, future use to retrieve multiple flows)toAddr
- address of instruction to retrieve the register flow statesigned
- true if value is signed, will sext the top bit based on value size- Returns:
- instruction start state value for register, or null if no known state
-
getEndRegisterVarnodeValue
public Varnode getEndRegisterVarnodeValue(Register reg, Address fromAddr, Address toAddr, boolean signed) Get the value (value, space, size) of a register at the end of the last execution flow taken for the instruction at toAddr. Note: This can only be called if trackStartEndState flag is true.- Parameters:
reg
- register to retrieve the end valuefromAddr
- flow from address (not used currently, future use to retrieve multiple flows)toAddr
- address of instruction to retrieve the register flow statesigned
- is the value signed or unsigned, will sext the top bit based on value size- Returns:
- instruction end state value for register, or null if no known state
- Throws:
javax.help.UnsupportedOperationException
- trackStartEndState == false at construction
-
print
-
getRegisterValue
Get the current value of the register at the address. Note: If trackStartEndState flag is false, then this will return the current value.- Parameters:
reg
- value of register to gettoAddr
- value of register at a location- Returns:
- value of register or null
-
getRegisterValue
Get the value of a register that was set coming from an address to an another address. Note: If trackStartEndState flag is false, then this will return the current value.- Parameters:
reg
- value of register to getfromAddr
- location the value came fromtoAddr
- location to get the value of the register coming from fromAddr- Returns:
- value of register or null
-
getRegisterValueAddressRanges
-
hasValueOverRange
-
copy
Copy the varnode with as little manipulation as possible. Try to keep whatever partial state there is intact if a real value isn't required.- Parameters:
out
- varnode to put it inin
- varnode to copy from.mustClearAll
- true if must clear if value is not uniqueevaluator
- user provided evaluator if needed
-
add
Add two varnodes together to get a new value This could create a new space and return a varnode pointed into that space- Parameters:
val1
- first valueval2
- second value- Returns:
- varnode that could be a constant, or an offset into a space, or null
-
and
-
or
-
left
-
getAddressSpace
-
subtract
Subtract two varnodes to get a new value This could create a new space and return a varnode pointed into that space- Parameters:
val1
- first valueval2
- second value- Returns:
- varnode that could be a constant, or an offset into a space
-
extendValue
public Varnode extendValue(Varnode out, Varnode[] in, boolean signExtend, ContextEvaluator evaluator) Extend a constant value if it can be extended.- Parameters:
out
- varnode to extend into (for size)in
- varnode value to extend the size- Returns:
- new sign extended varnode
-
clearRegister
Description copied from interface:ProcessorContext
Clears the register within this context.- Specified by:
clearRegister
in interfaceProcessorContext
- Parameters:
reg
- register to be cleared.
-
getRegister
Description copied from interface:ProcessorContextView
Get a Register given the name of a register- Specified by:
getRegister
in interfaceProcessorContextView
- Parameters:
name
- the name of the register.- Returns:
- The register with the given name.
-
getRegisterValue
Description copied from interface:ProcessorContextView
Get the RegisterValue for the given register.- Specified by:
getRegisterValue
in interfaceProcessorContextView
- Parameters:
register
- register to get the value for- Returns:
- RegisterValue object containing the value of the register if a value exists, otherwise null.
-
getRegisterVarnodeValue
-
getRegisterVarnode
-
getRegister
Return a register given a varnode -
getRegisters
Description copied from interface:ProcessorContextView
Returns all the Registers for the processor as an unmodifiable list- Specified by:
getRegisters
in interfaceProcessorContextView
- Returns:
- all the Registers for the processor
-
getValue
Description copied from interface:ProcessorContextView
Get the contents of a processor register as a BigInteger object- Specified by:
getValue
in interfaceProcessorContextView
- Parameters:
register
- register to get the value for- Returns:
- a BigInteger object containing the value of the register if a value exists, otherwise null.
-
hasValue
Description copied from interface:ProcessorContextView
Returns true if a value is defined for the given register.- Specified by:
hasValue
in interfaceProcessorContextView
- Parameters:
register
- the register to check for a value.- Returns:
- true if the given register has a value.
-
setRegisterValue
Description copied from interface:ProcessorContext
Sets the specified register value within this context.- Specified by:
setRegisterValue
in interfaceProcessorContext
- Parameters:
value
- register value
-
setValue
Description copied from interface:ProcessorContext
Sets the value for a Register.- Specified by:
setValue
in interfaceProcessorContext
- Parameters:
register
- the register to have its value setvalue
- the value for the register (null is not permitted).
-
isSymbol
Check if the varnode is associated with a Symbolic location- Parameters:
varnode
- to check- Returns:
- true if the varnode is a symbolic location
-
isRegister
Check if the varnode is associated with a register.- Parameters:
varnode
- to check- Returns:
- true if the varnode is associated with a register
-
isConstant
Check if this is a constant, or a suspect constant- Parameters:
varnode
- to check- Returns:
- true if should be treated as a constant for most purposes
-
isBadAddress
Check if this is a bad address, or offset from a bad address- Parameters:
v
- to check- Returns:
- true if should be treated as a constant for most purposes
-
isSuspectConstant
Check if the constant is a suspect constant It shouldn't be trusted in certain cases. Suspect constants act like constants, but are in a Suspicious address space instead of the constant space.- Parameters:
varnode
- varnode to check- Returns:
- true if varnode is a suspect constant
-
isStackSymbolicSpace
Check if varnode is in the stack space- Parameters:
varnode
- varnode to check- Returns:
- true if this varnode is stored in the symbolic stack space
-
isStackSpaceName
Check if spaceName is associated with the stack- Parameters:
spaceName
- of address space to check- Returns:
- true if spaceName is associated with the stack space
-
isSymbolicSpace
Check if the space name is a symbolic space. A symbolic space is a space named after a register/unknown value and an offset into that symbolic space. Symbolic spaces come from the OffsetAddressFactory- Parameters:
space
- the address space- Returns:
- true if is a symbolic space
-
isSymbolicSpace
public boolean isSymbolicSpace(int spaceID) Check if the space ID is a symbolic space. A symbolic space is a space named after a register/unknown value and an offset into that symbolic space. Symbolic spaces come from the OffsetAddressFactory- Parameters:
spaceID
- the ID of the space- Returns:
- true if is a symbolic space
-
isExternalSpace
public boolean isExternalSpace(int spaceID) Check if the space ID is an external space. External spaces are single locations that have no size normally associated with a location in another program.- Parameters:
spaceID
- the ID of the space- Returns:
- true if is a symbolic space
-
pushMemState
public void pushMemState()Save the current memory state -
popMemState
public void popMemState()restore a previously saved memory state
-