Package ghidra.program.util
Class VarnodeContext
java.lang.Object
ghidra.program.util.VarnodeContext
- All Implemented Interfaces:
ProcessorContext
,ProcessorContextView
-
Field Summary
Modifier and TypeFieldDescriptionprotected AddressFactory
protected HashMap
<Varnode, AddressSet> final Address
final int
protected Address
protected Instruction
boolean
protected boolean
protected boolean
protected Varnode[]
protected static final NotFoundException
protected DisassemblerContextImpl
protected Program
protected ProgramContext
protected Varnode[]
protected DisassemblerContextImpl
protected Register
protected Varnode
final Address
protected VarnodeTranslator
-
Constructor Summary
ConstructorDescriptionVarnodeContext
(Program program, ProgramContext programContext, ProgramContext spaceProgramContext) -
Method Summary
Modifier and TypeMethodDescriptionadd
(Varnode val1, Varnode val2, ContextEvaluator evaluator) Add two varnodes together to get a new value This could create a new space and return a varnode pointed into that spaceand
(Varnode val1, Varnode val2, ContextEvaluator evaluator) void
void
clearRegister
(Register reg) Clears the register within this context.void
copy
(Varnode out, Varnode in, boolean mustClearAll, ContextEvaluator evaluator) Copy the varnode with as little manipulation as possible.void
copyToFutureFlowState
(Address fromAddr, Address toAddr) createConstantVarnode
(long value, int size) createVarnode
(long value, int spaceID, int size) createVarnode
(BigInteger bigVal, BigInteger spaceVal, int size) extendValue
(Varnode out, Varnode[] in, boolean signExtend, ContextEvaluator evaluator) Extend a constant value if it can be extended.void
void
void
flowToAddress
(Address fromAddr, Address toAddr) int
getAddressSpace
(String name) long
getConstant
(Varnode vnode, ContextEvaluator evaluator) getCurrentInstruction
(Address addr) boolean
getDebug()
Varnode[]
getKilledVarnodes
(Function targetFunc) Address[]
getKnownFlowToAddresses
(Address toAddr) getLastSetLocation
(Register reg, BigInteger bval) return the location that this register was last set This is a transient thing, so it should only be used as a particular flow is being processed...getLastSetLocation
(Varnode rvar, BigInteger bval) return the location that this varnode was last set This is a transient thing, so it should only be used as a particular flow is being processed...protected Varnode
getMemoryValue
(Varnode varnode) Search the value state stack for the first occurence of the set valuegetRegister
(Varnode vnode) Return a register given a varnodegetRegister
(String name) Get a Register given the name of a registerReturns all the Registers for the processor as an unmodifiable listgetRegisterValue
(Register register) Get the RegisterValue for the given register.getRegisterValue
(Register reg, Address toAddr) Get the current value of the register at the addressgetRegisterValue
(Register reg, Address fromAddr, Address toAddr) Get the value of a register that was set coming from an address to an another address.getRegisterVarnode
(Register register) getRegisterVarnodeValue
(Register register) getRegisterVarnodeValue
(Register reg, Address fromAddr, Address toAddr, boolean signed) get the value of a register as a varnode (value, space, size)Varnode[]
getReturnVarnode
(Function targetFunc) Get the contents of a processor register as a BigInteger objectgetValue
(Varnode varnode, boolean signed, ContextEvaluator evaluator) getValue
(Varnode varnode, ContextEvaluator evaluator) getVarnode
(int spaceID, long offset, int size) getVarnode
(Varnode space, Varnode offset, int size, ContextEvaluator evaluator) boolean
Returns true if a value is defined for the given register.boolean
hasValueOverRange
(Register reg, BigInteger bval, AddressSet set) boolean
isConstant
(Varnode varnode) Check if this is a constant, or a suspect constantboolean
isExternalSpace
(int spaceID) Check if the space ID is an external space.protected boolean
isReadOnly
(Address addr) Check if the symbol at the address is read_only.boolean
isRegister
(Varnode varnode) Check if the varnode is associated with a register.boolean
isStackSpaceName
(String spaceName) Check if spaceName is associated with the stackboolean
isStackSymbolicSpace
(Varnode varnode) Check if varnode is in the stack spaceboolean
isSuspectConstant
(Varnode val1) Check if the constant is a suspect constant It shouldn't be trusted in certain cases.boolean
Check if the varnode is associated with a Symbolic locationboolean
isSymbolicSpace
(int spaceID) Check if the space ID is a symbolic space.boolean
isSymbolicSpace
(AddressSpace space) Check if the space name is a symbolic space.left
(Varnode val1, Varnode val2, ContextEvaluator evaluator) boolean
mergeToFutureFlowState
(Address fromAddr, Address toAddr) or
(Varnode val1, Varnode val2, ContextEvaluator evaluator) void
restore a previously saved memory stateprotected String
void
propogateResults
(boolean clearContext) Propogate any results that are in the value cache.void
propogateValue
(Register reg, Varnode node, Varnode val, Address address) void
Save the current memory stateprotected void
putMemoryValue
(Varnode out, Varnode value) Put the value for the varnode on the top of the memory state stackvoid
boolean
void
setCurrentInstruction
(Instruction instr) void
setDebug
(boolean debugOn) void
setFutureRegisterValue
(Address address, RegisterValue regVal) void
void
setRegisterValue
(RegisterValue value) Sets the specified register value within this context.void
setValue
(Register register, BigInteger value) Sets the value for a Register.subtract
(Varnode val1, Varnode val2, ContextEvaluator evaluator) Subtract two varnodes to get a new value This could create a new space and return a varnode pointed into that space
-
Field Details
-
offsetContext
-
spaceContext
-
memoryVals
-
tempUniqueVals
-
keepTempUniqueValues
protected boolean keepTempUniqueValues -
clearVals
-
lastSet
-
allLastSet
-
program
-
trans
-
retVarnodes
-
killedVarnodes
-
stackVarnode
-
stackReg
-
notFoundExc
-
BAD_ADDRESS
-
SUSPECT_ZERO_ADDRESS
-
BAD_SPACE_ID_VALUE
public final int BAD_SPACE_ID_VALUE -
hitDest
protected boolean hitDest -
addrFactory
-
programContext
-
currentAddress
-
currentInstruction
-
debug
public boolean debug
-
-
Constructor Details
-
VarnodeContext
public VarnodeContext(Program program, ProgramContext programContext, ProgramContext spaceProgramContext)
-
-
Method Details
-
setDebug
public void setDebug(boolean debugOn) -
getDebug
public boolean getDebug() -
setCurrentInstruction
-
getCurrentInstruction
-
getBaseContextRegister
- Specified by:
getBaseContextRegister
in interfaceProcessorContextView
- Returns:
- the base processor context register or null if one has not been defined
-
flowEnd
-
flowToAddress
-
getKnownFlowToAddresses
-
flowStart
-
copyToFutureFlowState
-
mergeToFutureFlowState
-
setFutureRegisterValue
-
getReturnVarnode
- Parameters:
targetFunc
- function to get a returning varnode for NOTE: this only gets one, unless there is custom storage on the called function there may be bonded ones in the default convention!- Returns:
- varnode that represents where functions place their return value
-
getKilledVarnodes
- Parameters:
targetFunc
- function to get killed varnodes for NOTE: this removes the return varnodes so they aren't duplicated- Returns:
- varnode that represents where functions place their return value
-
getStackVarnode
- Returns:
- Varnode that represents the stack register
-
getStackRegister
- Returns:
- Register that represents the stack register
-
getValue
- Throws:
NotFoundException
-
getValue
public Varnode getValue(Varnode varnode, boolean signed, ContextEvaluator evaluator) throws NotFoundException - Throws:
NotFoundException
-
getMemoryValue
Search the value state stack for the first occurence of the set value- Parameters:
varnode
- varnode to search for a value- Returns:
- first value found on stack, null otherwise
-
putMemoryValue
Put the value for the varnode on the top of the memory state stack- Parameters:
out
- varnode for the valuevalue
- value to store for the varnode
-
isReadOnly
Check if the symbol at the address is read_only.- Parameters:
addr
- - address of the symbol- Returns:
- true if the block is read_only, and there are no write references.
-
createVarnode
-
createConstantVarnode
-
createBadVarnode
-
createVarnode
-
putValue
-
readExecutableCode
public boolean readExecutableCode() -
setReadExecutableCode
public void setReadExecutableCode() -
clearReadExecutableCode
public void clearReadExecutableCode() -
propogateResults
public void propogateResults(boolean clearContext) Propogate any results that are in the value cache.- Parameters:
clearContext
- true if the cache should be cleared. The propogation could be for flow purposes, and the processing of the instruction is finished, so it's effects should be kept.
-
propogateValue
-
getLastSetLocation
return the location that this register was last set This is a transient thing, so it should only be used as a particular flow is being processed...- Parameters:
reg
- register to find last set locationbval
- value to look for to differentiate set locations, null if don't care- Returns:
- address that the register was set.
-
getLastSetLocation
return the location that this varnode was last set This is a transient thing, so it should only be used as a particular flow is being processed...- Parameters:
rvar
- the register varnodebval
- this parameter is unused.- Returns:
- address that the register was set.
-
getVarnode
-
getConstant
- Throws:
NotFoundException
-
getVarnode
public Varnode getVarnode(Varnode space, Varnode offset, int size, ContextEvaluator evaluator) throws NotFoundException - Throws:
NotFoundException
-
getRegisterVarnodeValue
public Varnode getRegisterVarnodeValue(Register reg, Address fromAddr, Address toAddr, boolean signed) get the value of a register as a varnode (value, space, size)- Parameters:
reg
- register to get value forfromAddr
- from addresstoAddr
- to addresssigned
- true if signed- Returns:
- the register value or null
-
print
-
getRegisterValue
Get the current value of the register at the address- Parameters:
reg
- value of register to gettoAddr
- value of register at a location- Returns:
- value of register or null
-
getRegisterValue
Get the value of a register that was set coming from an address to an another address.- Parameters:
reg
- value of register to getfromAddr
- location the value came fromtoAddr
- location to get the value of the register coming from fromAddr- Returns:
- value of register or null
-
getRegisterValueAddressRanges
-
hasValueOverRange
-
copy
public void copy(Varnode out, Varnode in, boolean mustClearAll, ContextEvaluator evaluator) throws NotFoundException Copy the varnode with as little manipulation as possible. Try to keep whatever partial state there is intact if a real value isn't required.- Parameters:
out
- varnode to put it inin
- varnode to copy from.mustClearAll
- true if must clear if value is not uniqueevaluator
- user provided evaluator if needed- Throws:
NotFoundException
- if there is no known value for in
-
add
Add two varnodes together to get a new value This could create a new space and return a varnode pointed into that space- Parameters:
val1
- first valueval2
- second value- Returns:
- varnode that could be a constant, or an offset into a space
- Throws:
NotFoundException
- if any constant is needed not known
-
and
- Throws:
NotFoundException
-
or
- Throws:
NotFoundException
-
left
public Varnode left(Varnode val1, Varnode val2, ContextEvaluator evaluator) throws NotFoundException - Throws:
NotFoundException
-
getAddressSpace
-
subtract
public Varnode subtract(Varnode val1, Varnode val2, ContextEvaluator evaluator) throws NotFoundException Subtract two varnodes to get a new value This could create a new space and return a varnode pointed into that space- Parameters:
val1
- first valueval2
- second value- Returns:
- varnode that could be a constant, or an offset into a space
- Throws:
NotFoundException
- if any constant is needed not known
-
extendValue
public Varnode extendValue(Varnode out, Varnode[] in, boolean signExtend, ContextEvaluator evaluator) throws NotFoundException Extend a constant value if it can be extended.- Parameters:
out
- varnode to extend into (for size)in
- varnode value to extend the size- Returns:
- Throws:
NotFoundException
-
clearRegister
Description copied from interface:ProcessorContext
Clears the register within this context.- Specified by:
clearRegister
in interfaceProcessorContext
- Parameters:
reg
- register to be cleared.
-
getRegister
Description copied from interface:ProcessorContextView
Get a Register given the name of a register- Specified by:
getRegister
in interfaceProcessorContextView
- Parameters:
name
- the name of the register.- Returns:
- The register with the given name.
-
getRegisterValue
Description copied from interface:ProcessorContextView
Get the RegisterValue for the given register.- Specified by:
getRegisterValue
in interfaceProcessorContextView
- Parameters:
register
- register to get the value for- Returns:
- RegisterValue object containing the value of the register if a value exists, otherwise null.
-
getRegisterVarnodeValue
-
getRegisterVarnode
-
getRegister
Return a register given a varnode -
getRegisters
Description copied from interface:ProcessorContextView
Returns all the Registers for the processor as an unmodifiable list- Specified by:
getRegisters
in interfaceProcessorContextView
- Returns:
- all the Registers for the processor
-
getValue
Description copied from interface:ProcessorContextView
Get the contents of a processor register as a BigInteger object- Specified by:
getValue
in interfaceProcessorContextView
- Parameters:
register
- register to get the value for- Returns:
- a BigInteger object containing the value of the register if a value exists, otherwise null.
-
hasValue
Description copied from interface:ProcessorContextView
Returns true if a value is defined for the given register.- Specified by:
hasValue
in interfaceProcessorContextView
- Parameters:
register
- the register to check for a value.- Returns:
- true if the given register has a value.
-
setRegisterValue
Description copied from interface:ProcessorContext
Sets the specified register value within this context.- Specified by:
setRegisterValue
in interfaceProcessorContext
- Parameters:
value
- register value
-
setValue
Description copied from interface:ProcessorContext
Sets the value for a Register.- Specified by:
setValue
in interfaceProcessorContext
- Parameters:
register
- the register to have its value setvalue
- the value for the register (null is not permitted).
-
isSymbol
Check if the varnode is associated with a Symbolic location- Parameters:
varnode
- to check- Returns:
- true if the varnode is a symbolic location
-
isRegister
Check if the varnode is associated with a register.- Parameters:
varnode
- to check- Returns:
- true if the varnode is associated with a register
-
isConstant
Check if this is a constant, or a suspect constant- Parameters:
varnode
- to check- Returns:
- true if should be treated as a constant for most purposes
-
isSuspectConstant
Check if the constant is a suspect constant It shouldn't be trusted in certain cases. Suspect constants act like constants, but are in a Suspicious address space instead of the constant space.- Parameters:
val1
- varnode to check- Returns:
- true if varnode is a suspect constant
-
isStackSymbolicSpace
Check if varnode is in the stack space- Parameters:
varnode
- varnode to check- Returns:
- true if this varnode is stored in the symbolic stack space
-
isStackSpaceName
Check if spaceName is associated with the stack- Parameters:
spaceName
- of address space to check- Returns:
- true if spaceName is associated with the stack space
-
isSymbolicSpace
Check if the space name is a symbolic space. A symbolic space is a space named after a register/unknown value and an offset into that symbolic space. Symbolic spaces come from the OffsetAddressFactory- Parameters:
space
- the address space- Returns:
- true if is a symbolic space
-
isSymbolicSpace
public boolean isSymbolicSpace(int spaceID) Check if the space ID is a symbolic space. A symbolic space is a space named after a register/unknown value and an offset into that symbolic space. Symbolic spaces come from the OffsetAddressFactory- Parameters:
spaceID
- the ID of the space- Returns:
- true if is a symbolic space
-
isExternalSpace
public boolean isExternalSpace(int spaceID) Check if the space ID is an external space. External spaces are single locations that have no size normally associated with a location in another program.- Parameters:
spaceID
- the ID of the space- Returns:
- true if is a symbolic space
-
pushMemState
public void pushMemState()Save the current memory state -
popMemState
public void popMemState()restore a previously saved memory state
-