1 #ifndef ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
2 #define ROSE_BinaryAnalysis_Partitioner2_ModulesX86_H
3 #include <featureTests.h>
4 #ifdef ROSE_ENABLE_BINARY_ANALYSIS
5 #include <Rose/BinaryAnalysis/Partitioner2/BasicTypes.h>
7 #include <Rose/BinaryAnalysis/Partitioner2/Modules.h>
10 namespace BinaryAnalysis {
11 namespace Partitioner2 {
14 namespace ModulesX86 {
37 virtual std::vector<FunctionPtr>
functions()
const override;
52 virtual std::vector<FunctionPtr>
functions()
const override {
return std::vector<FunctionPtr>(1, function_); }
67 virtual std::vector<FunctionPtr>
functions()
const override;
77 virtual std::vector<FunctionPtr>
functions()
const override {
return std::vector<FunctionPtr>(1, function_); }
87 virtual std::vector<FunctionPtr>
functions()
const override {
return std::vector<FunctionPtr>(1, function_); }
100 virtual bool operator()(
bool chain,
const Args&)
override;
109 enum EntryType { ABSOLUTE, RELATIVE };
113 EntryType entryType_;
114 size_t entrySizeBytes_;
118 : entryType_(ABSOLUTE), entrySizeBytes_(4) {}
120 virtual bool operator()(
bool chain,
const Args&)
override;
171 SwitchSuccessors::EntryType tableEntryType,
size_t tableEntrySizeBytes,
173 size_t nSkippable = 0);
bool matchLeaCxMemBpConst(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "LEA ECX, [EBP + constant]" or variant.
virtual bool match(const PartitionerConstPtr &, rose_addr_t anchor) override
Attempt to match an instruction pattern.
bool matchMovDiDi(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "MOV EDI, EDI" or variant.
Match RET followed by PUSH with intervening no-op padding.
bool matchPushBp(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "PUSH EBP" or variant.
Basic block callback to detect "switch" statements.
static Ptr instance()
Allocating constructor.
Base class for adjusting basic blocks during discovery.
Base class for matching function prologues.
bool matchJmpMem(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "JMP [address]" or variant.
Base class for machine instructions.
Sawyer::Optional< rose_addr_t > findTableBase(SgAsmExpression *)
Try to match a base+offset expression.
virtual bool operator()(bool chain, const Args &) override
Callback method.
virtual bool match(const PartitionerConstPtr &, rose_addr_t anchor) override
Attempt to match an instruction pattern.
bool matchPushSi(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "PUSH SI" or variant.
bool matchMovBpSp(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "MOV EBP, ESP" or variant.
Main namespace for the ROSE library.
Basic block callback to detect function returns.
bool matchEnterAnyZero(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "ENTER x, 0".
virtual bool match(const PartitionerConstPtr &, rose_addr_t anchor) override
Attempt to match an instruction pattern.
virtual std::vector< FunctionPtr > functions() const override
Returns the function(s) for the previous successful match.
Matches an x86 MOV EDI,EDI; PUSH ESI function prologe.
static Ptr instance()
Allocating constructor.
virtual bool operator()(bool chain, const Args &) override
Callback method.
static Ptr instance()
Allocating constructor.
std::vector< rose_addr_t > scanCodeAddressTable(const PartitionerConstPtr &, AddressInterval &tableLimits, const AddressInterval &targetLimits, SwitchSuccessors::EntryType tableEntryType, size_t tableEntrySizeBytes, Sawyer::Optional< rose_addr_t > probableStartVa=Sawyer::Nothing(), size_t nSkippable=0)
Reads a table of code addresses.
static Ptr instance()
Allocating constructor.
virtual bool match(const PartitionerConstPtr &, rose_addr_t anchor) override
Attempt to match an instruction pattern.
Matches an x86 function prologue.
Represents one Intel x86 machine instruction.
static Ptr instance()
Allocating constructor.
Base class for expressions.
Sawyer::Optional< rose_addr_t > matchJmpConst(const PartitionerConstPtr &, SgAsmX86Instruction *)
Matches "JMP constant".
virtual std::vector< FunctionPtr > functions() const override
Returns the function(s) for the previous successful match.
virtual std::vector< FunctionPtr > functions() const override
Returns the function(s) for the previous successful match.
virtual std::vector< FunctionPtr > functions() const override
Returns the function(s) for the previous successful match.
static Ptr instance()
Allocating constructor.
virtual std::vector< FunctionPtr > functions() const override
Returns the function(s) for the previous successful match.
static Ptr instance()
Allocating constructor.
BasicBlockCallbackPtr Ptr
Shared-ownership pointer to a BasicBlockCallback.
Matches an x86 "ENTER xxx, 0" prologue.
virtual bool match(const PartitionerConstPtr &, rose_addr_t anchor) override
Attempt to match an instruction pattern.
Matches an x86 function prologue with hot patch.
FunctionPrologueMatcherPtr Ptr
Shared-ownership pointer to a FunctionPrologueMatcher.