mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/patch'

Browse Source
This commit is contained in:
Ryan Kurtz
2022-07-25 03:06:18 -04:00
parent d64c61014e 61167f93cb
commit 0f2e518957
4 changed files with 24 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/CallDepthChangeInfo.java
View File

@@ -497,6 +497,7 @@ public class CallDepthChangeInfo {
return; return;
} }
// if extrapop is has an unknown purge, check for a purge on return instructions
int purge = (short) program.getCompilerSpec().getDefaultCallingConvention().getExtrapop(); int purge = (short) program.getCompilerSpec().getDefaultCallingConvention().getExtrapop();
final boolean possiblePurge = purge == -1 || purge > 3200 || purge < -3200; final boolean possiblePurge = purge == -1 || purge > 3200 || purge < -3200;
@@ -527,7 +528,9 @@ public class CallDepthChangeInfo {
public boolean evaluateContext(VarnodeContext context, Instruction instr) { public boolean evaluateContext(VarnodeContext context, Instruction instr) {
FlowType ftype = instr.getFlowType(); FlowType ftype = instr.getFlowType();
if (possiblePurge && ftype.isTerminal()) { if (possiblePurge && ftype.isTerminal()) {
if (instr.getMnemonicString().compareToIgnoreCase("ret") == 0) { String mnemonicStr = instr.getMnemonicString().toLowerCase();
if ("ret".equals(mnemonicStr) || "retf".equals(mnemonicStr)) {
// x86 has a scalar operand to purge value from the stack
int tempPurge = 0; int tempPurge = 0;
Scalar scalar = instr.getScalar(0); Scalar scalar = instr.getScalar(0);
if (scalar != null) { if (scalar != null) {

4
Ghidra/Features/Base/src/main/java/ghidra/app/cmd/function/FunctionPurgeAnalysisCmd.java
View File

@@ -279,7 +279,9 @@ public class FunctionPurgeAnalysisCmd extends BackgroundCommand {
FlowType ftype = instr.getFlowType(); FlowType ftype = instr.getFlowType();
if (ftype.isTerminal()) { if (ftype.isTerminal()) {
if (instr.getMnemonicString().compareToIgnoreCase("ret") == 0) { String mnemonicStr = instr.getMnemonicString().toLowerCase();
if ("ret".equals(mnemonicStr) || "retf".equals(mnemonicStr)) {
// x86 has a scalar operand to purge value from the stack
return instr; return instr;
} }
else if (ftype.isCall()) { else if (ftype.isCall()) {

25
Ghidra/Features/Base/src/main/java/ghidra/app/plugin/prototype/analysis/ArmAggressiveInstructionFinderAnalyzer.java
View File

@@ -1,6 +1,5 @@
/* ### /* ###
* IP: GHIDRA * IP: GHIDRA
* REVIEWED: YES
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@@ -215,15 +214,17 @@ public class ArmAggressiveInstructionFinderAnalyzer extends AbstractAnalyzer {
new PseudoDisassemblerContext(curProgram.getProgramContext()); new PseudoDisassemblerContext(curProgram.getProgramContext());
// get the current value from the program context // get the current value from the program context
curValue = curProgram.getProgramContext().getValue(tmodeReg, entry, false); if (tmodeReg != null) {
// if it doesn't have one set, try to get it the last context from the instruction before curValue = curProgram.getProgramContext().getValue(tmodeReg, entry, false);
if (curValue == null) { // if it doesn't have one set, try to get it the last context from the instruction before
Instruction instr = listing.getInstructionBefore(entry); if (curValue == null) {
if (instr != null) { Instruction instr = listing.getInstructionBefore(entry);
curValue = if (instr != null) {
curProgram.getProgramContext().getValue(tmodeReg, instr.getMinAddress(), false); curValue =
if (curValue != null) { curProgram.getProgramContext().getValue(tmodeReg, instr.getMinAddress(), false);
pseudoContext.setValue(tmodeReg, entry, curValue); if (curValue != null) {
pseudoContext.setValue(tmodeReg, entry, curValue);
}
} }
} }
} }
@@ -257,7 +258,9 @@ public class ArmAggressiveInstructionFinderAnalyzer extends AbstractAnalyzer {
addsInfo = true; addsInfo = true;
} }
pseudoContext = new PseudoDisassemblerContext(curProgram.getProgramContext()); pseudoContext = new PseudoDisassemblerContext(curProgram.getProgramContext());
pseudoContext.setValue(tmodeReg, entry, curValue); if (tmodeReg != null) {
pseudoContext.setValue(tmodeReg, entry, curValue);
}
AddressSet body = AddressSet body =
pseudo.followSubFlows(entry, pseudoContext, 1000, new PseudoFlowProcessor() { pseudo.followSubFlows(entry, pseudoContext, 1000, new PseudoFlowProcessor() {
Object lastResults[] = null; Object lastResults[] = null;

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/LibrarySymbolTable.java
View File

@@ -207,7 +207,9 @@ class LibrarySymbolTable {
} }
FlowType ftype = instr.getFlowType(); FlowType ftype = instr.getFlowType();
if (ftype.isTerminal()) { if (ftype.isTerminal()) {
if (instr.getMnemonicString().compareToIgnoreCase("ret") == 0) { String mnemonicStr = instr.getMnemonicString().toLowerCase();
if ("ret".equals(mnemonicStr) || "retf".equals(mnemonicStr)) {
// x86 has a scalar operand to purge value from the stack
tempPurge = 0; tempPurge = 0;
Scalar scalar = instr.getScalar(0); Scalar scalar = instr.getScalar(0);
if (scalar != null) { if (scalar != null) {