mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-19 16:40:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-2504,GP-2494 Arm switch patterns moved into pattern matching, adding additional pattern, fixed issues in function start patterns and validcode precondition. Added after='ptr'.

Browse Source
This commit is contained in:
emteere
2022-10-03 22:02:19 -04:00
parent 183a487363
commit b9496de7f5
21 changed files with 784 additions and 449 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Ghidra/Processors/ARM/data/languages/ARM.cspec
View File

@@ -120,6 +120,7 @@
<callfixup name="switch8_r3">
<target name="switch8_r3"/>
<target name="__ARM_common_switch8"/>
<pcode>
<body><![CDATA[
tmpptr = lr - 1;

8
Ghidra/Processors/ARM/data/languages/ARM.opinion
View File

@@ -11,8 +11,8 @@
<constraint loader="Portable Executable (PE)">
<constraint compilerSpecID="windows">
<constraint primary="448" processor="ARM" endian="little" size="32" variant="v8" />
<constraint primary="450" processor="ARM" endian="little" size="32" variant="v8T" /> <!-- THUMB -->
<constraint primary="452" processor="ARM" endian="little" size="32" variant="v8T" /> <!-- THUMB -->
<constraint primary="450" processor="ARM" endian="little" size="32" variant="v8" /> <!-- ARM and Thumb, spec says only Thumb -->
<constraint primary="452" processor="ARM" endian="little" size="32" variant="v8" />
</constraint>
<constraint compilerSpecID="default">
<constraint primary="2560" processor="ARM" endian="big" size="32" variant="v8" />
@@ -20,8 +20,8 @@
</constraint>
<constraint loader="Debug Symbols (DBG)" compilerSpecID="windows">
<constraint primary="448" processor="ARM" endian="little" size="32" variant="v8" />
<constraint primary="450" processor="ARM" endian="little" size="32" variant="v8T" /> <!-- THUMB -->
<constraint primary="452" processor="ARM" endian="little" size="32" variant="v8T" /> <!-- THUMB -->
<constraint primary="450" processor="ARM" endian="little" size="32" variant="v8" /> <!-- ARM and Thumb, spec says only Thumb -->
<constraint primary="452" processor="ARM" endian="little" size="32" variant="v8" />
</constraint>
<constraint loader="Executable and Linking Format (ELF)" compilerSpecID="default">

110
Ghidra/Processors/ARM/data/patterns/ARM_BE_patterns.xml
View File

@@ -13,7 +13,7 @@
<data>0xb0 000..... 0xbd ....0000 </data> <!-- add, pop -->
<data> 0x00bf </data> <!-- nop -->
<data> 0x8000f3af </data> <!-- nop.w -->
<data> 0xe8bd 1....... ........ </data> <!-- pop { rlist, pc } -->
<data> 0xe8bd 101..... ........ </data> <!-- pop { rlist, pc !lr !sp } -->
<data> 0xf746 </data> <!-- mov pc,lr -->
<data> 0xf8 0x5d 0xfb 0....... </data> <!-- ldr.w pc,[sp],#0x.. -->
</prepatterns>
@@ -31,20 +31,22 @@
<data> 0x46 0x.. 0xb5 ....0000 </data> <!-- push, mov -->
<data> 01.01...0x.. 0xb5 ....0000 </data> <!-- push, ldr -->
<data> 0x68 0x.. 0xb5 ....0000 </data> <!-- push, ldr -->
<data> 0xe92d 010..... ........ </data> <!-- push { rlist, lr } -->
<data> 0xe92d 0100.... ........ </data> <!-- push { rlist, lr !sp !pc !r12 } -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart/>
<funcstart validcode="3"/>
</postpatterns>
</patternpairs>
<patternpairs totalbits="32" postbits="16"> <!-- 32 bit ARM -->
<prepatterns>
<data>0xe12fff1. </data> <!-- bx r? -->
<data>0xe12fff1e 0x46c0 </data> <!-- bx lr , filler -->
<data>0xe12fff1e 0xe1a00000 </data> <!-- bx lr , filler -->
<data>0xe12fff1e 0x00000000 </data> <!-- bx lr , filler -->
<data>0xea...... </data> <!-- b xxxx probably a shared call return, careful with this, must be a really strong func start after -->
<data>0xe8 10.11101 10.0.... 0x.. </data> <!-- ldmia sp!,{pc,...} -->
<data>0xe8 10.11101 10.0.... 0x.. 0xe1a00000 </data> <!-- ldmia sp!,{pc,...}; filler -->
<data>0xe8 10.11101 10.0.... 0x.. 0x00000000 </data> <!-- ldmia sp!,{pc,...}; filler -->
<data>0xe4 0x9d 0xf0 0x08 </data> <!-- ldr pc,[sp],#0x8 -->
<data>0xe1 0xa0 0xf0 0x0e </data> <!-- mov pc,lr -->
<data>0xe320f000 0xe1a00000 </data> <!-- nop, cpy r0,r0 -->
@@ -52,76 +54,91 @@
</prepatterns>
<postpatterns>
<data> 0xe24dd... 11101001 00101101 .1...... ....0000 </data> <!-- sub sp,sp ; stmdb sp!,{r4+,lr} -->
<data> 11101001 00101101 .1...... ....0000 0xe24dd... </data> <!-- stmdb sp!,{r4+,lr}; sub sp,sp -->
<data> 11101001 00101101 .1...... ....0000 0x........ 0xe24dd... </data> <!-- stmdb sp!,{r4+,lr}; <instr>; sub sp,sp -->
<data> 11101001 00101101 .1...... ....0000 0xe1a0 010.0000 0000000. </data> <!-- stmdb sp!,{r4+,lr}; mov r4,r0 -->
<data> 11101001 00101101 .1...... ....0000 </data> <!-- stmdb sp!,{r4+,lr}; if the prepattern is strong -->
<data> 0xe24dd... 11101001 00101101 0100.... ........ </data> <!-- sub sp,sp ; stmdb sp!,{r3+,lr !sp !pc !r12} -->
<data> 11101001 00101101 0100.... ........ 0xe24dd... </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; sub sp,sp -->
<data> 11101001 00101101 0100.... ........ 0x........ 0xe24dd... </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; <instr>; sub sp,sp -->
<data> 11101001 00101101 0100.... ........ 0xe1a0 010.0000 0000000. </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; mov r4,r0 -->
<data> 11101001 00101101 0100.... ........ </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; if the prepattern is strong -->
<data> 0xe24dd... 11100101 00101101 1110.... ........ </data> <!-- sub sp,sp; str lr,[sp,#...]; -->
<data> 11101001 00101101 .0...... ........ 11100101 00101101 11100000 ......00 </data> <!-- stmdb sp!,{xxx !lr}; str lr,[sp,#...]; -->
<data> 11101001 00101101 0000.... ........ 11100101 00101101 11100000 ......00 </data> <!-- stmdb sp!,{r0+, !lr !sp !pc !r12}; str lr,[sp,#...]; -->
<data> 11100101 00101101 1110.... ........ 0xe24dd... </data> <!-- str lr,[sp,#...]; sub sp,sp; -->
<data> 11100101 00101101 1110.... ........ 0x........ 0xe24dd... </data> <!-- str lr,[sp,#...]; <instr>; sub sp,sp; -->
<data> 0xe5 0x2d 0xe0 0x08 </data> <!-- str lr,[sp,#-0x8] -->
<data> 0xe1a0c00d 0xe92d.... </data> <!-- cpy ip,sp; stmdb sp!,{} -->
<align mark="0" bits="3"/>
<data> 0xe1a0c00d 0xe92d.... </data> <!-- cpy ip,sp; stmdb sp!,{} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart/>
<funcstart validcode="3"/>
</postpatterns>
</patternpairs>
<pattern> <!-- 32 bit ARM -->
<data> 0xe24dd... 11101001 00101101 .1...... ....0000 </data> <!-- sub sp,sp ; stmdb sp!,{r4+,lr} -->
<align mark="0" bits="3"/>
<data> 0xe24dd... 11101001 00101101 0100.... ........ </data> <!-- sub sp,sp ; stmdb sp!,{r0+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary /> <!-- it is at least code -->
<funcstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 11101001 00101101 .1...... ....0000 </data> <!-- stmdb sp!,{r4+,lr}; -->
<align mark="0" bits="3"/>
<data> 0xe5 1001.... 0....... ........ 11101001 00101101 0100.... ....0000 </data> <!-- ldr .., xxx ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="data" isvalid="true"/> <!-- must be something defined right before this, and good code -->
<codeboundary /> <!-- it is at least code -->
<possiblefuncstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 11101001 00101101 .1...... ....0000 </data> <!-- stmdb sp!,{r4+,lr}; <valid code> -->
<align mark="0" bits="3"/>
<data> 0xe....... 11101001 00101101 0100.... ....0000 </data> <!-- Any instruction ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="defined" isvalid="40"/> <!-- must be something defined right before this, && must be at least 40 valid instructions after it -->
<funcstart after="ptr" validcode="10" contiguous="true" /> <!-- must be a data ptr (non r/w) to this and validcode -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 0xe....... 0xe....... 11101001 00101101 0100.... ....0000 </data> <!-- Any 2 instructions ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="ptr" validcode="10" contiguous="true" /> <!-- must be a data ptr (non r/w) to this and validcode -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 11101001 00101101 0100.... ........ </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; <valid code> -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this, && must be at least 40 valid instructions after it -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 0xe24dd... 11100101 00101101 1110.... ........ </data> <!-- sub sp,sp; str lr,[sp,#...]; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data>11100101 00101101 1110.... ........ 0xe24dd... </data> <!-- str lr,[sp,#...]; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="data" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 11101001 00101101 .1...... ....0000 0x........ 0xe24dd... </data> <!-- stmdb sp!,{r4+,lr}; <instr>; sub sp,sp -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="data" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data>11100101 00101101 1110.... ........ 0x........ 0xe24dd... </data> <!-- str lr,[sp,#...]; <instr>; sub sp,sp; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="data" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data>0xe1a0c00d 0xe92d.... </data> <!-- cpy ip,sp; stmdb sp!,{} -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary /> <!-- can't say it is a function yet, have seen instructions before -->
</pattern>
@@ -130,21 +147,21 @@
<data> 0xb5 ....0000 0xb0 100..... </data> <!-- push, sub-->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0xe92d 010..... ........ </data> <!-- push { rlist, lr } -->
<data> 0xe92d 0100.... ........ </data> <!-- push { rlist, lr !sp !pc !r12 } -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this, && at least n valid instructions -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0xb5 ....0000 0x1c 00...... </data> <!-- push, mov -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
@@ -158,28 +175,28 @@
<data> 0xb5 ....0000 01.01... 0x.. </data> <!-- push, ldr -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0xb5 ....0000 0x68 0x.. </data> <!-- push, ldr -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0xb5 ....0000 01.01... 0x.. 0xb0 10...... </data> <!-- push, ldr, sub -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="defined" /> <!-- must be something defined right before this -->
<funcstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0xb5 1...0000 0xaf.. </data> <!-- pop pushr7 addr7sp -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<!-- Loosened patterns, but MUST come after a function -->
@@ -194,8 +211,27 @@
<data> 0xb5 .......0 </data> <!-- push-->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="function"/>
<funcstart after="function" validcode="4" contiguous="true" />
</postpatterns>
</patternpairs>
<pattern> <!-- 32 bit ARM - thunk -->
<data> 0xe2 0x8f 1100.... ........
0xe2 0x8c 1100.... ........
0xe5 0xbc 0xf. 0x.. </data> <!-- adr r12, #; add r12,r12,#; ldr pc, [r21, #] -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="defined" thunk="true"/> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- Thumb - thunk -->
<data> 0xb4 0x03
0x48 0x01
0x90 0x01
0xbd 0x01 </data> <!-- push {r0,r1} ; ldr r0,[dest] ; str r0, [sp, stack[-4]] ; pop {r0,pc} -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart validcode="function" thunk="true" /> <!-- must be something defined right before this -->
</pattern>
</patternlist>

222
Ghidra/Processors/ARM/data/patterns/ARM_LE_patterns.xml
View File

@@ -10,10 +10,11 @@
<data>0x7047 </data> <!-- bxlr -->
<data>0x7047 0x0000 </data> <!-- bxlr, filler -->
<data>0x7047 0xc046 </data> <!-- bxlr, filler -->
<data>0x7047 0x00bf </data> <!-- bxlr, filler -->
<data>000..... 0xb0 ....0000 0xbd </data> <!-- add, pop -->
<data> 0x00bf </data> <!-- nop -->
<data> 0xaff30080 </data> <!-- nop.w -->
<data> 0xbde8 ........ 1....... </data> <!-- pop { rlist, pc } -->
<data> 0xbde8 ........ 1000.... </data> <!-- pop.w { rlist, pc !lr, !sp !r12 } -->
<data> 0x46f7 </data> <!-- mov pc,lr -->
<data> 0x5d 0xf8 0....... 0xfb </data> <!-- ldr.w pc,[sp],#0x.. -->
</prepatterns>
@@ -31,7 +32,7 @@
<!-- could match 0xc0 0x46, which is filler <data> 0x.. 0x46 ....0000 0xb5 </data> --> <!-- push, mov -->
<data> 0x.. 01.01... ....0000 0xb5 </data> <!-- push, ldr -->
<data> 0x.. 0x68 ....0000 0xb5 </data> <!-- push, ldr -->
<data> 0x2de9 ........ 010..... </data> <!-- push { rlist, lr } -->
<data> 0x2de9 ........ 0100.... </data> <!-- push { rlist, lr !sp !pc !r12 } -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart/>
@@ -41,10 +42,12 @@
<patternpairs totalbits="32" postbits="16"> <!-- 32 bit ARM -->
<prepatterns>
<data>0x1.ff2fe1 </data> <!-- bx r? -->
<data>0x1eff2fe1 0xc046 </data> <!-- bx lr , filler -->
<data>0x1eff2fe1 0x00000000 </data> <!-- bx lr , filler -->
<data>0x1eff2fe1 0x0000a0e1 </data> <!-- bx lr , filler -->
<data>0x......ea </data> <!-- b xxxx probably a shared call return, careful with this, must be a really strong func start after -->
<data>0x.. 10.0.... 10.11101 0xe8 </data> <!-- ldmia sp!,{pc,...} -->
<data>0x.. 10.0.... 10.11101 0xe8 0x00000000 </data> <!-- ldmia sp!,{pc,...}; filler -->
<data>0x.. 10.0.... 10.11101 0xe8 0x0000a0e1 </data> <!-- ldmia sp!,{pc,...}; filler -->
<data>0x08 0xf0 0x9d 0xe4 </data> <!-- ldr pc,[sp],#0x8 -->
<data>0x0e 0xf0 0xa0 0xe1 </data> <!-- mov pc,lr -->
<data>0x00f020e3 0x0000a0e1 </data> <!-- nop, cpy r0,r0 -->
@@ -52,50 +55,75 @@
</prepatterns>
<postpatterns>
<data> 0x..d.4de2 ....0000 .1...... 00101101 11101001 </data> <!-- sub sp,sp ; stmdb sp!,{r4+,lr} -->
<data> ....0000 .1...... 00101101 11101001 0x..d.4de2 </data> <!-- stmdb sp!,{r4+,lr}; sub sp,sp -->
<data> ....0000 .1...... 00101101 11101001 0x........ 0x..d.4de2 </data> <!-- stmdb sp!,{r4+,lr}; <instr>; sub sp,sp -->
<data> ....0000 .1...... 00101101 11101001 0000000. 010.0000 0xa0e1 </data> <!-- stmdb sp!,{r4+,lr}; mov r4,r0 -->
<data> ....0000 .1...... 00101101 11101001 </data> <!-- stmdb sp!,{r4+,lr}; if the prepattern is strong -->
<data> 0x..d.4de2 ........ .10..... 00101101 11101001 </data> <!-- sub sp,sp ; stmdb sp!,{r0+, lr !sp !pc !r12} -->
<data> ........ 0100.... 00101101 11101001 0x..d.4de2 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; sub sp,sp -->
<data> ........ 0100.... 00101101 11101001 0x........ 0x..d.4de2 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; <instr>; sub sp,sp -->
<data> ........ 0100.... 00101101 11101001 0000000. 010.0000 0xa0e1 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; mov r4,r0 -->
<data> ........ 0100.... 00101101 11101001 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; if the prepattern is strong -->
<data> 0x..d.4de2 ........ 1110.... 00101101 11100101 </data> <!-- sub sp,sp; str lr,[sp,#...]; -->
<data> ........ .0...... 00101101 11101001 ......00 11100000 00101101 11100101 </data> <!-- stmdb sp!,{xxx !lr}; str lr,[sp,#...]; -->
<data> ........ 0000.... 00101101 11101001 ......00 11100000 00101101 11100101 </data> <!-- stmdb sp!,{r0+, !lr !sp !pc !r12}; str lr,[sp,#...]; -->
<data> ........ 1110.... 00101101 11100101 0x..d.4de2 </data> <!-- str lr,[sp,#...]; sub sp,sp; -->
<data> ........ 1110.... 00101101 11100101 0x........ 0x..d.4de2 </data> <!-- str lr,[sp,#...]; <instr>; sub sp,sp; -->
<data>0x08 0xe0 0x2d 0xe5 </data> <!-- str lr,[sp,#-0x8] -->
<data>0x0dc0a0e1 0x....2de9 </data> <!-- cpy ip,sp; stmdb sp!,{} -->
<data> ........ .1...... 00101101 11101001 </data> <!-- stmdb sp!,{xxx lr}; -->
<align mark="0" bits="3"/>
<data> ........ 0100.... 00101101 11101001 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<possiblefuncstart/>
</postpatterns>
</patternpairs>
<pattern> <!-- 32 bit ARM -->
<data> 0x..d.4de2 ....0000 .1...... 00101101 11101001 </data> <!-- sub sp,sp ; stmdb sp!,{r4+,lr} -->
<align mark="0" bits="3"/>
<data> 0x..d.4de2 ........ 0100.... 00101101 11101001 </data> <!-- sub sp,sp ; stmdb sp!,{r0+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary /> <!-- it is at least code -->
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<!-- must be something defined right before this, at least 10 contiguous instructions after it, check up to 20 instructions -->
<possiblefuncstart after="defined" validcode="10" validcodemax="20" contiguous="true" />
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> ........ 0....... 1001.... 0xe5 0000.... 0100.... 00101101 11101001 </data> <!-- ldr .., xxx ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary /> <!-- it is at least code -->
<!-- must be something defined right before this, at least 10 contiguous instructions after it -->
<possiblefuncstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 0x......e. 0000.... 0100.... 00101101 11101001 </data> <!-- Any instruction ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="ptr" validcode="10" contiguous="true"/> <!-- must be a data ptr (non r/w) to this and validcode -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 0x......e. 0x......e. 0000.... 0100.... 00101101 11101001 </data> <!-- Any 2 instructions ; stmdb sp!,{r4+, lr !sp !pc !r12} -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="ptr" validcode="10" contiguous="true"/> <!-- must be a data ptr (non r/w) to this and validcode -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<!-- NOTE: pattern also match Thumb 'b' instruction followed by a 'push' instruction (where push is start uf Thumb function) -->
<data> ....0000 .1...... 00101101 11101001 </data> <!-- stmdb sp!,{r4+,lr}; -->
<align mark="0" bits="3"/>
<data> ........ 0100.... 00101101 11101001 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<possiblefuncstart after="data" isvalid="true"/> <!-- must be something defined right before this, and good code -->
<possiblefuncstart after="defined" validcode="10" contiguous="true" /> <!-- must be something defined right before this, and good code -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> ........ .1...... 00101101 11101001 </data> <!-- stmdb sp!,{r4+,lr}; <valid code> -->
<align mark="0" bits="3"/>
<data> ........ 0100.... 00101101 11101001 </data> <!-- stmdb sp!,{r0+, lr !sp !pc !r12}; <valid code> -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart after="defined" isvalid="40"/> <!-- must be something defined right before this, && must be at least 40 valid instructions after it -->
<!-- must be something defined right before this, at least 10 contiguous instructions after it, check up to (2*validcode) instructions -->
<funcstart after="defined" validcode="10" contiguous="true" />
</pattern>
<pattern> <!-- 32 bit ARM -->
<data> 0x..d.4de2 ........ 1110.... 00101101 11100101 </data> <!-- sub sp,sp; str lr,[sp,#...]; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary />
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
@@ -103,7 +131,7 @@
<pattern> <!-- 32 bit ARM -->
<data>........ 1110.... 00101101 11100101 0x..d.4de2 </data> <!-- str lr,[sp,#...]; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary />
<possiblefuncstart after="data" /> <!-- must be data defined right before this -->
@@ -111,7 +139,7 @@
<pattern> <!-- 32 bit ARM -->
<data> ....0000 .1...... 00101101 11101001 0x........ 0x..d.4de2 </data> <!-- stmdb sp!,{r4+,lr}; <instr>; sub sp,sp -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary />
<possiblefuncstart after="data" /> <!-- must be data defined right before this -->
@@ -119,14 +147,14 @@
<pattern> <!-- 32 bit ARM -->
<data>........ 1110.... 00101101 11100101 0x........ 0x..d.4de2 </data> <!-- str lr,[sp,#...]; <instr>; sub sp,sp; -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<possiblefuncstart after="data" /> <!-- must be data defined right before this -->
</pattern>
<pattern> <!-- 32 bit ARM -->
<data>0x0dc0a0e1 0x....2de9 </data> <!-- cpy ip,sp; stmdb sp!,{} -->
<align mark="0" bits="3"/>
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<codeboundary /> <!-- can't say it is a function yet, have seen instructions before -->
</pattern>
@@ -135,56 +163,56 @@
<data> ....0000 0xb5 1....... 0xb0 </data> <!-- push, sub-->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 0x2de9 ........ 010..... </data> <!-- push { rlist, lr } -->
<data> 0x2de9 ........ 010..... </data> <!-- push { rlist, lr !pc !sp } -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> ....0000 0xb5 00...... 0x1c </data> <!-- push, mov -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> ....0000 0xb5 0x.. 0x46 </data> <!-- push, mov -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> ....0000 0xb5 0x.. 01.01... </data> <!-- push, ldr -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> ....0000 0xb5 0x.. 0x68 </data> <!-- push, ldr -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> ....0000 0xb5 0x.. 01.01... 10...... 0xb0 </data> <!-- push, ldr, sub -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- 16 bit Thumb -->
<data> 1...0000 0xb5 0x..af </data> <!-- pop pushr7 addr7sp -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
<possiblefuncstart after="defined" validcode="4" contiguous="true" /> <!-- must be something defined right before this -->
</pattern>
<!-- Loosened patterns, but MUST come after a function -->
@@ -200,123 +228,27 @@
<data> .......0 0xb5 </data> <!-- push-->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart after="function"/>
<funcstart after="function" validcode="4" contiguous="true"/>
</postpatterns>
</patternpairs>
<!-- Special functions with side-effects -->
<!-- -->
<pattern> <!-- Thumb Switch32_r0 -->
<data> 0x03b4 0x7146 0x0231 0x8908 0x8000 0x8900 0x0858 0x4018 0x8646 0x03bc 0xf746 </data>
<!-- push { r1 r0 }
mov r1,lr
add r1,#0x2
lsr r1,r1,#0x2
lsl r0,r0,#0x2
lsl r1,r1,#0x2
ldr r0,[r1,r0]
add r0,r0,r1
mov lr,r0
pop { r0 r1 }
mov pc,lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_si"/>
</pattern>
<pattern> <!-- Thumb Switch8_r0 -->
<data> 0x02b4 0x7146 0x4908 0x4900 0x095c 0x4900 0x8e44 0x02bc 0x7047 </data>
<!-- push { r1 }
mov r1,lr
lsr r1,r1,#0x1
lsl r1,r1,#0x1
ldrb r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_uqi"/>
</pattern>
<pattern> <!-- Thumb SwitchS8_r0 -->
<data> 0x02b4 0x7146 0x4908 0x4900 0x0956 0x4900 0x8e44 0x02bc 0x7047 </data>
<!-- push { r1 }
mov r1,lr
lsr r1,r1,#0x1
lsl r1,r1,#0x1
ldrsb r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_sqi"/>
</pattern>
<pattern> <!-- Thumb Switch_S16_r0 -->
<data> 0x03b4 0x7146 0x4908 0x4000 0x4900 0x095e 0x4900 0x8e44 0x03bc 0x7047 </data>
<!-- push { r1 r0 }
mov r1,lr
lsr r1,r1,#0x1
lsl r0,r0,#0x1
ldrsh r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_shi"/>
</pattern>
<pattern> <!-- Thumb Switch_16_r0 -->
<data> 0x03b4 0x7146 0x4908 0x4000 0x4900 0x095a 0x4900 0x8e44 0x03bc 0x7047 </data>
<!-- push { r1 r0 }
mov r1,lr
lsr r1,r1,#0x1
lsl r0,r0,#0x1
ldrh r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_uhi"/>
</pattern>
<pattern> <!-- ARM Switch8_r3 -->
<data> 0x01c05ee5 0x0c0053e1 0x0330de37 0x0c30de27 0x83 11.00000 0x8ee0 000111.0 0xff2fe1 </data>
<!-- ldrb ip,[lr,#-0x1]
cmp r3,ip
ldrbcc r3,[lr,r3]
ldrbcs r3,[lr,ip]
add ip,lr,r3, lsl #0x1 | add lr,lr,r3, lsl #0x1
bx ip | bx lr
-->
<align mark="0" bits="3"/>
<pattern> <!-- 32 bit ARM - thunk -->
<data> ........ 1100.... 0x8f 0xe2
........ 1100.... 0x8c 0xe2
0x.. 0xf. 0xbc 0xe5 </data> <!-- adr r12, #; add r12,r12,#; ldr pc, [r21, #] -->
<align mark="0" bits="2"/>
<setcontext name="TMode" value="0"/>
<funcstart label="switch8_r3"/>
<funcstart after="defined" thunk="true" /> <!-- must be something defined right before this -->
</pattern>
<pattern> <!-- ARM Switch8_r3 -->
<data> 0x01c05ee5 0x0c0053e1 0x0c30de27 0x0330de37 0x83 11.00000 0x8ee0 000111.0 0xff2fe1 </data>
<!-- ldrb ip,[lr,#-0x1]
cmp r3,ip
ldrbcs r3,[lr,ip]
ldrbcc r3,[lr,r3]
add ip,lr,r3, lsl #0x1 | add lr,lr,r3, lsl #0x1
bx ip | bx lr
-->
<align mark="0" bits="3"/>
<setcontext name="TMode" value="0"/>
<funcstart label="switch8_r3"/>
<pattern> <!-- Thumb - thunk -->
<data> 0x03 0xb4
0x01 0x48
0x01 0x90
0x01 0xbd </data> <!-- push {r0,r1} ; ldr r0,[dest] ; str r0, [sp, stack[-4]] ; pop {r0,pc} -->
<align mark="0" bits="1"/>
<setcontext name="TMode" value="1"/>
<funcstart validcode="function" thunk="true" /> <!-- must be something defined right before this -->
</pattern>
</patternlist>

137
Ghidra/Processors/ARM/data/patterns/ARM_switch_patterns.xml Normal file
View File

@@ -0,0 +1,137 @@
<patternlist>
<!-- Special functions with side-effects -->
<!-- -->
<pattern> <!-- Thumb Switch32_r0 -->
<data> 0x03b4 0x7146 0x0231 0x8908 0x8000 0x8900 0x0858 0x4018 0x8646 0x03bc 0xf746 </data>
<!-- push { r1 r0 }
mov r1,lr
add r1,#0x2
lsr r1,r1,#0x2
lsl r0,r0,#0x2
lsl r1,r1,#0x2
ldr r0,[r1,r0]
add r0,r0,r1
mov lr,r0
pop { r0 r1 }
mov pc,lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_si"/>
</pattern>
<pattern> <!-- Thumb Switch8_r0 -->
<data> 0x02b4 0x7146 0x4908 0x4900 0x095c 0x4900 0x8e44 0x02bc 0x7047 </data>
<!-- push { r1 }
mov r1,lr
lsr r1,r1,#0x1
lsl r1,r1,#0x1
ldrb r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_uqi"/>
</pattern>
<pattern> <!-- Thumb SwitchS8_r0 -->
<data> 0x02b4 0x7146 0x4908 0x4900 0x0956 0x4900 0x8e44 0x02bc 0x7047 </data>
<!-- push { r1 }
mov r1,lr
lsr r1,r1,#0x1
lsl r1,r1,#0x1
ldrsb r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_sqi"/>
</pattern>
<pattern> <!-- Thumb Switch_S16_r0 -->
<data> 0x03b4 0x7146 0x4908 0x4000 0x4900 0x095e 0x4900 0x8e44 0x03bc 0x7047 </data>
<!-- push { r1 r0 }
mov r1,lr
lsr r1,r1,#0x1
lsl r0,r0,#0x1
ldrsh r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_shi"/>
</pattern>
<pattern> <!-- Thumb Switch_16_r0 -->
<data> 0x03b4 0x7146 0x4908 0x4000 0x4900 0x095a 0x4900 0x8e44 0x03bc 0x7047 </data>
<!-- push { r1 r0 }
mov r1,lr
lsr r1,r1,#0x1
lsl r0,r0,#0x1
ldrh r1,[r1,r0]
lsl r1,r1,#0x1
add lr,r1
pop { r1 }
bx lr
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__gnu_thumb1_case_uhi"/>
</pattern>
<pattern> <!-- ARM Switch8_r3 -->
<data> 0x01c05ee5 0x0c0053e1 0x0330de37 0x0c30de27 0x83 11.00000 0x8ee0 000111.0 0xff2fe1 </data>
<!-- ldrb ip,[lr,#-0x1]
cmp r3,ip
ldrbcc r3,[lr,r3]
ldrbcs r3,[lr,ip]
add ip,lr,r3, lsl #0x1 | add lr,lr,r3, lsl #0x1
bx ip | bx lr
-->
<align mark="0" bits="3"/>
<setcontext name="TMode" value="0"/>
<funcstart label="switch8_r3"/>
</pattern>
<pattern> <!-- ARM Switch8_r3 -->
<data> 0x01c05ee5 0x0c0053e1 0x0c30de27 0x0330de37 0x83 11.00000 0x8ee0 000111.0 0xff2fe1 </data>
<!-- ldrb ip,[lr,#-0x1]
cmp r3,ip
ldrbcs r3,[lr,ip]
ldrbcc r3,[lr,r3]
add ip,lr,r3, lsl #0x1 | add lr,lr,r3, lsl #0x1
bx ip | bx lr
-->
<align mark="0" bits="3"/>
<setcontext name="TMode" value="0"/>
<funcstart label="switch8_r3"/>
</pattern>
<pattern> <!-- Thumb common switch8 - same effect as switch8_r3 -->
<data> 0x30b4 0x7446 0x641e 0x2578 0x641c 0xab42 0x00d2 0x1d46 0x635d 0x5b00 0xe318 0x30bc 0x1847</data>
<!-- push {r4,r5}
mov r4,lr
subs r4,r4,#0x1
ldrb r,[r4,#0x0]
adds r4,r4,#0x1
cmp r3,r5
bcs <lab>
mov r5,r3
lab:
ldrb r3,[r4,r5]
lsls r3,r3,#0x1
adds r3,r4,r3
pop {r4,r5}
bx r3
-->
<setcontext name="TMode" value="1"/>
<funcstart label="__ARM_common_switch8"/>
</pattern>
</patternlist>

3
Ghidra/Processors/ARM/data/patterns/patternconstraints.xml
View File

@@ -9,5 +9,6 @@
<language id="ARM:LEBE:32:*">
<patternfile>ARM_LE_patterns.xml</patternfile>
</language>
</language>
</patternconstraints>

5
Ghidra/Processors/ARM/data/patterns/prepatternconstraints.xml Normal file
View File

@@ -0,0 +1,5 @@
<patternconstraints>
<language id="ARM:*:32:*">
<patternfile>ARM_switch_patterns.xml</patternfile>
</language>
</patternconstraints>