diff --git a/irdb-libs/ir_builders/fill_in_cfg.cpp b/irdb-libs/ir_builders/fill_in_cfg.cpp index 85ce8cf0efda608519158b4c4e1e42f67b89354b..c07f45e704fdc056fe56f65b83d62ba783642d25 100644 --- a/irdb-libs/ir_builders/fill_in_cfg.cpp +++ b/irdb-libs/ir_builders/fill_in_cfg.cpp @@ -664,6 +664,19 @@ int PopulateCFG::parseArgs(const vector<string> step_args) return 0; } +void PopulateCFG::rename_start(FileIR_t *firp) +{ + for(auto f : firp->getFunctions()) + { + const auto entry_point_insn = f->getEntryPoint(); + if(!entry_point_insn) continue; + + const auto entry_point_vo = entry_point_insn->getAddress()->getVirtualOffset(); + if(entry_point_vo==elfiop->get_entry()) + f->setName("_start"); + } +} + int PopulateCFG::executeStep(IRDBObjects_t *const irdb_objects) { try @@ -688,6 +701,7 @@ int PopulateCFG::executeStep(IRDBObjects_t *const irdb_objects) elfiop.reset(new exeio()); elfiop->load(string("readeh_tmp_file.exe")); + rename_start(firp); fill_in_cfg(firp); fill_in_scoops(firp); detect_scoops_in_code(firp); diff --git a/irdb-libs/ir_builders/fill_in_cfg.hpp b/irdb-libs/ir_builders/fill_in_cfg.hpp index 93c36e48becad489a64b6fce26734a46b9335e77..b0cd24358041fe2d769723f32cf7511ceea89257 100644 --- a/irdb-libs/ir_builders/fill_in_cfg.hpp +++ b/irdb-libs/ir_builders/fill_in_cfg.hpp @@ -48,6 +48,8 @@ class PopulateCFG : public IRDB_SDK::TransformStep_t void fill_in_scoops(IRDB_SDK::FileIR_t *); void detect_scoops_in_code(IRDB_SDK::FileIR_t *firp); void fill_in_landing_pads(IRDB_SDK::FileIR_t *); + void rename_start(IRDB_SDK::FileIR_t *firp); + // helpers void populate_instruction_map diff --git a/irdb-libs/ir_builders/fix_calls.cpp b/irdb-libs/ir_builders/fix_calls.cpp index d245e2b950324ec035172ba109af3b8a0576cd20..d9a041009ba7469d5acdd436fa401e47e3982e7a 100644 --- a/irdb-libs/ir_builders/fix_calls.cpp +++ b/irdb-libs/ir_builders/fix_calls.cpp @@ -1048,6 +1048,7 @@ int executeStep(IRDBObjects_t *const irdb_objects) // do eh_frame reading as required. if(do_eh_frame) read_ehframe(firp, elfiop); + setFrameSizes(firp); fix_all_calls(firp,fix_all); fix_other_pcrel(firp); @@ -1099,11 +1100,50 @@ bool possible_target(uintptr_t p, uintptr_t at, ibt_provenance_t prov) } -std::string getStepName(void) const override +string getStepName(void) const override { return std::string("fix_calls"); } +void setFrameSizes(FileIR_t* firp) +{ + for(auto func : firp->getFunctions()) + { + if(func->getEntryPoint()==nullptr) continue; + + const auto is_found_it=cfg_optimizer.find(func); + const auto is_found=(is_found_it!=end(cfg_optimizer)); + + if(!is_found) + /* build a cfg for this function */ + cfg_optimizer[func]=shared_ptr<ControlFlowGraph_t>(move(ControlFlowGraph_t::factory(func))); + + const auto cfg=cfg_optimizer[func].get(); + const auto entry_block=cfg->getEntry(); + auto pushes=0; + for(auto insn : entry_block->getInstructions()) + { + const auto di=DecodedInstruction_t::factory(insn); + const auto mnemonic=di->getMnemonic(); + if(mnemonic=="push") + pushes++; + if(mnemonic=="sub") + { + const auto hasop0 = di->hasOperand(0); + const auto op0_sp = hasop0 && (di->getOperand(0)->getString()=="rsp" || di->getOperand(0)->getString()=="esp"); + const auto hasop1 = di->hasOperand(1); + const auto op1_const = hasop1 && di->getOperand(1)->isConstant(); + if(op0_sp && op1_const) + { + func->setStackFrameSize(di->getOperand(1)->getConstant()); + } + break; + } + + } + } +} + }; // end class FixCalls_t shared_ptr<TransformStep_t> curInvocation; diff --git a/irdb-libs/rida/rida.cpp b/irdb-libs/rida/rida.cpp index 91833dfb11270b5bd8f1a98f657d3fb5223054bf..49d64907a8bc9751d4cf7d17e5b22c59a45e8866 100644 --- a/irdb-libs/rida/rida.cpp +++ b/irdb-libs/rida/rida.cpp @@ -76,15 +76,15 @@ class CreateFunctions_t const auto cs_mode= machine_type==mtAarch64 ? CS_MODE_LITTLE_ENDIAN : - file_class==ELF64 ? CS_MODE_64 : - file_class==ELF32 ? CS_MODE_32 : - throw std::runtime_error("Cannot handle ELF class"); + file_class==ELF64 ? CS_MODE_64 : + file_class==ELF32 ? CS_MODE_32 : + throw std::runtime_error("Cannot handle ELF class"); const auto my_cs_arch = - machine_type == mtX86_64 ? CS_ARCH_X86 : - machine_type == mtI386 ? CS_ARCH_X86 : + machine_type == mtX86_64 ? CS_ARCH_X86 : + machine_type == mtI386 ? CS_ARCH_X86 : machine_type == mtAarch64 ? CS_ARCH_ARM64 : - throw std::runtime_error("Cannot handle architecture"); + throw std::runtime_error("Cannot handle architecture"); if (cs_open(my_cs_arch, cs_mode , &cshandle) != CS_ERR_OK) { @@ -146,21 +146,30 @@ class CreateFunctions_t auto unnamedFunctions=0U; auto functions=0U; + const auto entryPointAddress=exeio.get_entry(); + // set default names for(const auto &func: sccs) { assert(func.begin() != func.end()); const auto first_range=*(func.begin()); const auto startAddr=first_range.first; - std::stringstream ss; - ss << "sub_" << hex << startAddr; - const auto name = ss.str(); functions++; - if(funcNames[func]=="") // destructive test OK, next line sets if empty. + if(entryPointAddress == startAddr) { - unnamedFunctions++; + // override the elf entry point to be called _start + funcNames[func]="_start"; + namedFunctions++; + } + else if(funcNames[func]=="") // destructive test OK, next line sets if empty. + { + std::stringstream ss; + ss << "sub_" << hex << startAddr; + const auto name = ss.str(); + funcNames[func]=name; + unnamedFunctions++; } else { diff --git a/set_env_vars b/set_env_vars index 878a42bdcabd33b7f5548b4e132ac9b7999c74c8..68a60c71a293a274bd7f7d1771068e75fda124af 100644 --- a/set_env_vars +++ b/set_env_vars @@ -8,7 +8,12 @@ export ZIPR_HOME=$PEASOUP_HOME/zipr export ZIPR_SDK=$PEASOUP_HOME/zipr-sdk export IRDB_SDK=$PEASOUP_HOME/irdb-sdk export ZEST_RUNTIME=$PEASOUP_HOME/zest_runtime -export PSPATH=$PEASOUP_HOME/irdb-libs/plugins_install + + +# don't override pspath +if [[ -z $PSPATH ]]; then + export PSPATH=$PEASOUP_HOME/irdb-libs/plugins_install +fi if [ -f manifest.txt ]; then if [ -f $PS_INSTALL ]; then