Package ghidra.program.util

Class ContextEvaluatorAdapter

java.lang.Object
ghidra.program.util.ContextEvaluatorAdapter
All Implemented Interfaces:
ContextEvaluator
public class ContextEvaluatorAdapter extends Object implements ContextEvaluator
Default behavior implementation of ContextEvaluator passed to SymbolicPropogator Override methods to inspect context.

  • Constructor Details

    • ContextEvaluatorAdapter

      public ContextEvaluatorAdapter()

  • Method Details

    • evaluateContextBefore

      public boolean evaluateContextBefore(VarnodeContext context, Instruction instr)
      Description copied from interface: ContextEvaluator
      Evaluate the current instruction given the context before the instruction is evaluated
      Specified by:
      evaluateContextBefore in interface ContextEvaluator
      Parameters:
      context - describes current state of registers
      instr - instruction whose context has not yet been applied
      Returns:
      true if evaluation should stop

    • evaluateContext

      public boolean evaluateContext(VarnodeContext context, Instruction instr)
      Description copied from interface: ContextEvaluator
      Evaluate the current instruction given the final context for the instruction
      Specified by:
      evaluateContext in interface ContextEvaluator
      Parameters:
      context - describes current state of registers
      instr - instruction whose context has been applied
      Returns:
      true if evaluation should stop, false to continue evaluation

    • evaluateConstant

      public Address evaluateConstant(VarnodeContext context, Instruction instr, int pcodeop, Address constant, int size, DataType dataType, RefType refType)
      Description copied from interface: ContextEvaluator
      Evaluate a potential constant to be used as an address or an interesting constant that should have a reference created for it. Computed values that are not know to be used as an address will be passed to this function. For example a value passed to a function, or a stored constant value.
      Specified by:
      evaluateConstant in interface ContextEvaluator
      Parameters:
      context - current program context
      instr - instruction on which this reference was detected
      pcodeop - the PcodeOp operation that is causing this potential constant
      constant - constant value (in constant.getOffset() )
      size - size of constant value in bytes
      dataType - dataType associated with the reference if known
      refType - reference type (flow, data/read/write)
      Returns:
      the original address unchanged if it should be a reference null if the constant reference should not be created a new address if the value should be a different address or address space Using something like instr.getProgram().getAddressFactory().getDefaultAddressSpace();

    • evaluateReference

      public boolean evaluateReference(VarnodeContext context, Instruction instr, int pcodeop, Address address, int size, DataType dataType, RefType refType)
      Description copied from interface: ContextEvaluator
      Evaluate the reference that has been found on this instruction. Computed values that are used as an address will be passed to this function. For example a value passed to a function, or a stored constant value.
      Specified by:
      evaluateReference in interface ContextEvaluator
      Parameters:
      context - current program context
      instr - instruction on which this reference was detected
      pcodeop - the PcodeOp operation that is causing this reference
      address - address being referenced
      size - size of the item being referenced (only non-zero if load or store of data)
      dataType - dataType associated with the reference if known
      refType - reference type (flow, data/read/write)
      Returns:
      false if the reference should be ignored (or has been taken care of by this routine)

    • evaluateDestination

      public boolean evaluateDestination(VarnodeContext context, Instruction instruction)
      Description copied from interface: ContextEvaluator
      Evaluate the instruction for an unknown destination
      Specified by:
      evaluateDestination in interface ContextEvaluator
      Parameters:
      context - current register context
      instruction - instruction that has an unknown destination
      Returns:
      true if the evaluation should stop, false to continue evaluation

    • evaluateReturn

      public boolean evaluateReturn(Varnode retVN, VarnodeContext context, Instruction instruction)
      Description copied from interface: ContextEvaluator
      Evaluate the the target of a return
      Specified by:
      evaluateReturn in interface ContextEvaluator
      Parameters:
      retVN - varnode that is the target of a RETURN pcodeop
      context - current register context
      instruction - instruction that has an unknown destination
      Returns:
      true if the evaluation should stop, false to continue evaluation

    • unknownValue

      public Long unknownValue(VarnodeContext context, Instruction instruction, Varnode node)
      Description copied from interface: ContextEvaluator
      Called when a value is needed for a register that is unknown
      Specified by:
      unknownValue in interface ContextEvaluator
      Parameters:
      context - current register context
      instruction - instruction that has an unknown destination
      node - varnode for the register being accessed to obtain a value
      Returns:
      null if the varnode should not have an assumed value. a long value if the varnode such as a Global Register should have an assumed constant

    • followFalseConditionalBranches

      public boolean followFalseConditionalBranches()
      Description copied from interface: ContextEvaluator
      Follow all branches, even if the condition evaluates to false, indicating it shouldn't be followed.
      Specified by:
      followFalseConditionalBranches in interface ContextEvaluator
      Returns:
      true if false evaluated conditional branches should be followed.

    • evaluateSymbolicReference

      public boolean evaluateSymbolicReference(VarnodeContext context, Instruction instr, Address address)
      Description copied from interface: ContextEvaluator
      Evaluate the reference that has been found on this instruction that points into an unknown space that has been designated as tracked.
      Specified by:
      evaluateSymbolicReference in interface ContextEvaluator
      Parameters:
      context - current program context
      instr - instruction on which this reference was detected
      address - address being referenced
      Returns:
      false if the reference should be ignored (or has been taken care of by this routine) true to allow the reference to be created

    • allowAccess

      public boolean allowAccess(VarnodeContext context, Address addr)
      Description copied from interface: ContextEvaluator
      Evaluate the address and check if the access to the value in the memory location to be read The address is read-only and is not close to this address.
      Specified by:
      allowAccess in interface ContextEvaluator
      Parameters:
      context - current program context
      addr - Address of memory where location is attempting to be read
      Returns:
      true if the access should be allowed