Package ghidra.util.state.analysis

Class MySwitchAnalyzer

java.lang.Object

ghidra.util.state.analysis.MySwitchAnalyzer

All Implemented Interfaces:

FunctionAnalyzer

public class MySwitchAnalyzer
extends Object
implements FunctionAnalyzer

Constructor Summary

Constructors

Constructor	Description
MySwitchAnalyzer(Program program)

Method Summary

Modifier and Type	Method	Description
static ResultsState	analyze(Program program, Address functionEntry, TaskMonitor monitor)
void	dataReference(PcodeOp op, int instrOpIndex, Varnode storageVarnode, RefType refType, TaskMonitor monitor)	Callback indicating that an absolute memory reference was encountered
void	indirectDataReference(PcodeOp op, int instrOpIndex, Varnode offsetVarnode, int size, int storageSpaceID, RefType refType, TaskMonitor monitor)	Callback indicating that an indirect/computed memory reference was encountered using an indirect/computed offset
boolean	resolvedFlow(PcodeOp op, int instrOpIndex, Address destAddr, ContextState currentState, ResultsState results, TaskMonitor monitor)	Callback indicating that a call/branch destination was identified.
boolean	resolvedFlow(PcodeOp op, Object opIndex, Address destAddr, ContextState currentState, ResultsState results, TaskMonitor monitor)
void	stackReference(PcodeOp op, int instrOpIndex, int stackOffset, int size, int storageSpaceID, RefType refType, TaskMonitor monitor)	Callback indicating that an absolute stack reference was encountered.
void	stackReference(PcodeOp op, int instrOpIndex, VarnodeOperation computedStackOffset, int size, int storageSpaceID, RefType refType, TaskMonitor monitor)	Callback indicating that a computed stack reference was encountered.
List<Address>	unresolvedIndirectFlow(PcodeOp op, int instrOpIndex, Varnode destination, ContextState currentState, ResultsState results, TaskMonitor monitor)	Callback indicating that a computed call/branch destination was not resolved.
List<Address>	unresolvedIndirectFlow(PcodeOp op, Object opIndex, Varnode destination, ContextState currentState, ResultsState results, TaskMonitor monitor)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

MySwitchAnalyzer

public MySwitchAnalyzer(Program program)

Method Details

analyze

public static ResultsState analyze(Program program,
 Address functionEntry,
 TaskMonitor monitor)
                            throws CancelledException

Throws:

CancelledException

resolvedFlow

public boolean resolvedFlow(PcodeOp op,
 Object opIndex,
 Address destAddr,
 ContextState currentState,
 ResultsState results,
 TaskMonitor monitor)

unresolvedIndirectFlow

public List<Address> unresolvedIndirectFlow(PcodeOp op,
 Object opIndex,
 Varnode destination,
 ContextState currentState,
 ResultsState results,
 TaskMonitor monitor)

dataReference

public void dataReference(PcodeOp op,
 int instrOpIndex,
 Varnode storageVarnode,
 RefType refType,
 TaskMonitor monitor)
                   throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that an absolute memory reference was encountered

Specified by:

dataReference in interface FunctionAnalyzer

Parameters:

op - pcode operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

storageVarnode - absolute storage Varnode

refType - read/write/data reference type

monitor - task monitor

Throws:

CancelledException - if callback canceled by monitor

indirectDataReference

public void indirectDataReference(PcodeOp op,
 int instrOpIndex,
 Varnode offsetVarnode,
 int size,
 int storageSpaceID,
 RefType refType,
 TaskMonitor monitor)
                           throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that an indirect/computed memory reference was encountered using an indirect/computed offset

Specified by:

indirectDataReference in interface FunctionAnalyzer

Parameters:

op - pcode operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

offsetVarnode - indirect/computed offset

size - access size or -1 if not applicable

storageSpaceID - storage space ID

refType - read/write/data reference type

monitor - task monitor

Throws:

CancelledException - if callback canceled by monitor

resolvedFlow

public boolean resolvedFlow(PcodeOp op,
 int instrOpIndex,
 Address destAddr,
 ContextState currentState,
 ResultsState results,
 TaskMonitor monitor)
                     throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that a call/branch destination was identified. Analyzer should create reference if appropriate Keep in mind that there could be other unidentified destinations.

Specified by:

resolvedFlow in interface FunctionAnalyzer

Parameters:

op - branch or call flow operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

destAddr - destination address

currentState - current state at the branch/call

results - contains previous states leading upto the currentState

monitor - task monitor

Returns:

true if destination should be disassembled if not already

Throws:

CancelledException - if callback canceled by monitor

stackReference

public void stackReference(PcodeOp op,
 int instrOpIndex,
 int stackOffset,
 int size,
 int storageSpaceID,
 RefType refType,
 TaskMonitor monitor)
                    throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that an absolute stack reference was encountered. A non-load/store operation will have a -1 for both storageSpaceId and size.

Specified by:

stackReference in interface FunctionAnalyzer

Parameters:

op - pcode operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

stackOffset - stack offset

size - access size or -1 if not applicable

storageSpaceID - storage space ID or -1 if not applicable

refType - read/write/data reference type

monitor - task monitor

Throws:

CancelledException - if callback canceled by monitor

stackReference

public void stackReference(PcodeOp op,
 int instrOpIndex,
 VarnodeOperation computedStackOffset,
 int size,
 int storageSpaceID,
 RefType refType,
 TaskMonitor monitor)
                    throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that a computed stack reference was encountered. A non-load/store operation will have a -1 for both storageSpaceId and size.

Specified by:

stackReference in interface FunctionAnalyzer

Parameters:

op - pcode operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

computedStackOffset - stack offset computation (i.e., VarnodeOperation w/ stack pointer)

size - access size or -1 if not applicable

storageSpaceID - storage space ID or -1 if not applicable

refType - read/write/data reference type

monitor - task monitor

Throws:

CancelledException - if callback canceled by monitor

unresolvedIndirectFlow

public List<Address> unresolvedIndirectFlow(PcodeOp op,
 int instrOpIndex,
 Varnode destination,
 ContextState currentState,
 ResultsState results,
 TaskMonitor monitor)
                                     throws CancelledException

Description copied from interface: FunctionAnalyzer

Callback indicating that a computed call/branch destination was not resolved.

Specified by:

unresolvedIndirectFlow in interface FunctionAnalyzer

Parameters:

op - indirect branch or call flow operation

instrOpIndex - opIndex associated with reference or -1 if it could not be determined

destination - destination identified as a Varnode (may be an expression represented by a VarnodeOperation

currentState - current state at the branch/call

results - contains previous states leading upto the currentState

monitor - task monitor

Returns:

list of resolved destinations which should be used or null. List of destination addresses will trigger disassembly where necessary.

Throws:

CancelledException - if callback cancelled by monitor