Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP][TA] Analyze out-of-BT func with tainted parameters #47

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

[WIP][TA] Analyze out-of-BT func with tainted parameters #47

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1268452
[Target] Helpers for param forwarding registers
Apr 5, 2023
7ea35b2
[TaintDFG] Upgrade TaintDFG infrastructure
Apr 5, 2023
987712b
[TA] Detect tainted parameters
Apr 5, 2023
fe3565a
[TA] Introduce forward Taint Analysis
Apr 5, 2023
2bd22b9
[TA] Analysis of already decompiled functions
Apr 5, 2023
10a9db9
New tests for tainted params analysis
Apr 5, 2023
231fed5
Addressing comments 1
Apr 18, 2023
4eda5c0
[TA] Support parameters on the stack
Apr 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 29 additions & 5 deletions llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@
#include "llvm/CodeGen/MachineBasicBlock.h"
#include "llvm/CodeGen/MachineFunction.h"
#include "llvm/CodeGen/MachineInstr.h"
#include "llvm/CodeGen/TargetInstrInfo.h"
#include "llvm/MC/MCRegisterInfo.h"
#include "llvm/Support/Debug.h"
#include "llvm/Support/Host.h"

Expand All @@ -39,7 +41,8 @@ class CATargetInfo {
std::unordered_map<unsigned, RegAliasTuple> RegMap;

// Save PC value for each instruction.
std::unordered_map<const MachineInstr*, std::pair<uint64_t,uint64_t>> InstAddrs;
std::unordered_map<const MachineInstr *, std::pair<uint64_t, uint64_t>>
InstAddrs;

// Singleton class for the CATargetInfo instance.
template <typename T> class Singleton {
Expand All @@ -53,34 +56,47 @@ class CATargetInfo {

public:
CATargetInfo() {}
virtual ~CATargetInfo() { RegMap.clear(); InstAddrs.clear(); }
virtual ~CATargetInfo() {
RegMap.clear();
InstAddrs.clear();
}

// Get register index in the RegMap.
virtual Optional<unsigned> getID(std::string RegName) const = 0;

// Get register unsigned (MCRegister) from the RegMap.
virtual Optional<unsigned> getRegister(std::string RegName,
const MachineInstr *MI) const = 0;

virtual unsigned getRegSize(std::string RegName) const = 0;

// Get RegAliasTuple from the RegMap with selected Id.
RegAliasTuple &getRegMap(unsigned Id) const {
return const_cast<RegAliasTuple &>(RegMap.at(Id));
}

// Get RegAliasTuple from the RegMap with selected Id.
std::unordered_map<unsigned, RegAliasTuple> getWholeRegMap() const {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better return a reference to map instead of copying the entire map; no?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Definitely, I missed this, thanks!

return RegMap;
}

// Get InstAddr from the InstAddrs map for the MI.
Optional<uint64_t> getInstAddr(const MachineInstr* MI) {
Optional<uint64_t> getInstAddr(const MachineInstr *MI) {
if (InstAddrs.count(MI) == 0)
return None;
return InstAddrs[MI].first;
}

// Get InstAddr from the InstAddrs map for the MI.
Optional<uint64_t> getInstSize(const MachineInstr* MI) {
Optional<uint64_t> getInstSize(const MachineInstr *MI) {
if (InstAddrs.count(MI) == 0)
return None;
return InstAddrs[MI].second;
}

// Set InstAddr in the InstAddrs map for the MI.
void setInstAddr(const MachineInstr* MI, uint64_t InstAddr, uint64_t InstSize = 0) {
void setInstAddr(const MachineInstr *MI, uint64_t InstAddr,
uint64_t InstSize = 0) {
InstAddrs[MI] = {InstAddr, InstSize};
}

Expand All @@ -99,6 +115,9 @@ class CATargetInfo {
// Return true if the register is Base Pointer Register.
virtual bool isBPRegister(std::string RegName) const = 0;

// Return true if the register can be used to forward parameters.
virtual bool isParamFwdRegister(std::string RegName) const = 0;

// Set target Triple of the CATargetInfo instance.
static void initializeCATargetInfo(Triple *Triple) {
if (!TT)
Expand All @@ -118,6 +137,9 @@ class X86CATargetInfo : public CATargetInfo {

Optional<unsigned> getID(std::string RegName) const override;

Optional<unsigned> getRegister(std::string RegName,
const MachineInstr *MI) const override;

unsigned getRegSize(std::string RegName) const override;

bool isRetValRegister(std::string RegName) const override;
Expand All @@ -130,6 +152,8 @@ class X86CATargetInfo : public CATargetInfo {

bool isBPRegister(std::string RegName) const override;

bool isParamFwdRegister(std::string RegName) const override;

// Define static instance getter for each target.
static X86CATargetInfo *instance() {
return CATargetInfo::Singleton<X86CATargetInfo>::get();
Expand Down
36 changes: 36 additions & 0 deletions llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,3 +159,39 @@ bool X86CATargetInfo::isBPRegister(std::string RegName) const {
return true;
return false;
}

bool X86CATargetInfo::isParamFwdRegister(std::string RegName) const {
if (RegName == "rdi" || RegName == "edi" || RegName == "di" ||
RegName == "dil")
return true;
if (RegName == "rsi" || RegName == "esi" || RegName == "si" ||
RegName == "sil")
return true;
if (RegName == "rdx" || RegName == "edx" || RegName == "dx" ||
RegName == "dl")
return true;
if (RegName == "rcx" || RegName == "ecx" || RegName == "cx" ||
RegName == "cl")
return true;
if (RegName == "r8" || RegName == "r8d" || RegName == "r8w" ||
RegName == "r8b")
return true;
if (RegName == "r9" || RegName == "r9d" || RegName == "r9w" ||
RegName == "r9b")
return true;
return false;
}

Optional<unsigned> X86CATargetInfo::getRegister(std::string RegName,
const MachineInstr *MI) const {
auto TRI = MI->getMF()->getSubtarget().getRegisterInfo();
if (!TRI)
return None;
unsigned N = 1000;
for (unsigned I = 0; I < N; ++I) {
std::string CurName = TRI->getRegAsmName(I).lower();
if (CurName == RegName)
return I;
}
return None;
}