Former-commit-id: 11233d09a4b9dc78d87047aae3fe8d3c3f627d81

Former-commit-id: 09ccce22d96b31a9154c1e203d5d57578d3ae560

PrecedenceBoundaryInference.cpp, no canaries for these inferences, reveted to no validation for precedence inference.



Former-commit-id: 3af84450e6f2a0e18ad42aeff5a1874847815029

Assert false if the info annot file cannot be opened (likely will have to change this in a subsequent commit).

Memset inferences have been shown to be unsafe, they are no longer attempted without validation. 




Former-commit-id: 10c2e70fe2b3d7cf62e10875dea59d89a57d706e

Former-commit-id: d84504f6ffadd893173b0ac949ca313eca3db17d

In pntransformdriver, if the current inference is at the lowest level in the hierarchy, then do not perform validation. 



Former-commit-id: 0093d1b0b62fe7fd280f8adb7e421817aa07b0c9

PrecedenceBoundaryInference based on p1 did not add an out args region as necessary. Now if precedence bounds sees the supplied inference out args is 0, it assumes the first object is an out args region to be conservative. 




Former-commit-id: 1b2aae1354c7be53640671f80ccbf7c5bf463413

PrecedenceBoundaryInference now takes boundaries from a boundary generator, converts them to esp bounds, then produces a "transitive closure" on these ranges. That is, if any ranges intersect, containing all intersections is what is used for the boundary inference. 



Former-commit-id: 01be564a8ca11cfffad6e0d3ac3c7ea420c81acd

Changed padding to be a random amount of padding plus size equal to the aligned size of the allocated stack. 




Former-commit-id: d7bcc9ee2bb11c3d2403c0092d57871a2c587294

Former-commit-id: 71561a35be85fe06e69a2db936bc489c0c89c9ee

Former-commit-id: 5470ec1108ed69859b3c6946c903a6168bb72070

Former-commit-id: 01bf47f746ff62dc6f205dbc2f666b9d7e595f63

Former-commit-id: 650334febdb52ac1e6c19631fee708d403373283

Former-commit-id: 038c58f5cbb2f0169499f1e284458e775cd37777

Added changes to allow padding between dynamic sized arrays, not between the rest of the variables though (i.e., the transform is essentilaly part PN and part P1).



Former-commit-id: 4c381883db0bd2af024695fe3faf21d33e4bd62e

OffsetInference.cpp, the dynamic stack output log code now checks to see if the file is opened before writing. 



Former-commit-id: 6532b6068e371f715db830b842ecc094606ea058

OffsetInference.cpp, keeping with the last change to output a dynamic_stack.log, I do a check for null pointers before attempting to print the address of the isntruction. I don't think this can happen, but I don't want to break TNE. 



Former-commit-id: 9a9c34bbdbb9ad5032c5354257fed5be1a6d0122

in OffsetInference.cpp if a dynamic stack frame is detected, a log file, dynamic_stack.log, is created, which lists the functions, addresses, and instructions indicating a dynamic stack frame. 
 


Former-commit-id: f0f7bbb8811ad443f4c161e54579e096718998d3

Former-commit-id: 6af4305c051a895d0592bc846c1ea854a14ce8dd

Former-commit-id: a4a1b32f4b04e86e53700ead09a9386aeade1e90

Former-commit-id: d4208d5094be4b3f1e2a45824ec8ffde220c51e7

Former-commit-id: ff180fca33e6aa8e0ecac85321d981505ff919da

Due to some stupidity, OffsetInference.cpp had lost a previously made change to avoid adding too much padding to recursive functions. This functionality has been restored. 



Former-commit-id: 9f5c6c1bcf11023e0dfdd8b5657ff70102440256

Former-commit-id: b9f71b4b78e2fb6b19728ded1362ac8b560cd9ea

OffsetInference bug fix, do not transform functions that deallocate the stack by a different ammount used for allocation. 




Former-commit-id: c0504aadadd7e74eb9c06fdca9c47457c8022be7

Former-commit-id: 906c54f7eedbdc064e2952c7c104d6882a5d9679

Former-commit-id: c4445a288886ebc2688044674f99f1a4cc37c1e6

Former-commit-id: bb765f926368f4b012cf948963bf71b4c60cb275

Former-commit-id: 6cc2dab081970ecae2a09957bca5ca6bd65ae470

Former-commit-id: 84ee9b717624a7151823ac305a0f8c0fb6b26f36

OffsetInference looks for recursive functions, if found a flag is set, and when padding is added to that function, the padding is significantly reduced. 



Former-commit-id: 419b7de27c53f344816aa47bd388ded566cf4af8

Former-commit-id: 35eb6397edb4d9c1d523cdb1c1e01a9fce90259f

Former-commit-id: c81610a6ba6408a995adc3eec7814ef097fb72c4

If a function is not believed to have a dynamic stack frame, canary checks are performed prior to any function call. 



Former-commit-id: 20be9054ca856ffa82e9189618cab59aae23ebb7

PNRegularExpressions.cpp: modified the regex_ret expression to only match lines that contain ret only.

OffsetInference.cpp: When inferring layouts, the number of ret instructions is counted. If 0 and no deallocation site is found, the function is considered transformable. 




Former-commit-id: 716e7a209e985fb0c3758300755efb95442fb760

The primary change in this commit is the support of dynamic arrays and alloca functions as well as adding a few more prologue checks. 

Added General_Utility.*, as of this commit, this utility "class" contains a str2int and str2uint function. 

Changed makefile to reflect addition of General_Utility.*.

Modified PNRegularExpressions.cpp, changed stack_dealloc_implicit. Added the pattern

lea esp, [ebp-<const>]

as a valid stack deallocation. 

OffsetInference.cpp now checks the amount by which esp is subtracted in 

sub esp, <val>

instructions. If the value is determined to be non-integral, it is assumed the function is using alloca or dynamic arrays, and the function is considered non PNsafe (only p1 is attempted). 

Given the addition to PNRegularExpressions.cpp, in OffsetInference.cpp, stack_dealloc_implicit checks are now done first. 

PNTransformDriver.cpp also does a check to see if sub esp, <val> contains an integral value, and does not transform instructions that do not. 

OffsetInference.cpp now does a stack deallocation check for add esp, 0x00000000, and does not filter a function based on 0 not matching the size of the stack frame. 




Former-commit-id: 9c9f3494d7bd13bf237ef9fc4925b1a72e95b3c2

If a scaled memory access is found that uses ebp as an index
e.g., [ecx+ebp*1+0x21]
The funciton is considered not PN safe, and only p1 is attempted if p1
has been determined to be safe. 

This check is done in OffsetInference.cpp. In PNTransformDriver.cpp, if this
pattern is encountered during transformation, it is assumed that p1 is being 
used and the offset is used to find the appropriate displacment by which
to modify the original instruction. 

In the future a dynamic solution would be more appropriate, and then PN
could be attempted. The issue with PN is the offset discovered in instructions
like these does not necessarily point to the variable the instruction will
reference at runtime. A runtime check is needed to see what memory is accessed. 




Former-commit-id: c5a33834377949a5cfef357004bdd29c6bc079c9

Also added comments for canary checks and canary setup which will now appear in the produced aspri and bspri code. 



Former-commit-id: 0122593dda5b095c13036e55802204742ea09f0d

In a previous commit, PN was altered to not place canaries in a function if an AND esp, <const> instruction was found. That was altered, but the functionality in in PNTransformDriver.cpp still replaced AND esp with a nop. In this commit that code is commented out, i.e., AND esp instructions are untouched. 



Former-commit-id: 5f5e66cde79953142797e0c2b91313f9a4388d7c

fixed bug with overflow instrumentation. we were not handling the case when the overflowing instruction didn't refer to a register


Former-commit-id: 277b75e67b9b11fba246c86f19944c3ed8644357