mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-2504,GP-2494 Arm switch patterns moved into pattern matching, adding additional pattern, fixed issues in function start patterns and validcode precondition. Added after='ptr'.

Browse Source
This commit is contained in:
emteere
2022-10-03 22:02:19 -04:00
parent 183a487363
commit b9496de7f5
21 changed files with 784 additions and 449 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Ghidra/Processors/x86/data/patterns/prepatternconstraints.xml Normal file
View File

@@ -0,0 +1,12 @@
<patternconstraints>
<language id="x86:LE:32:default">
<compiler id="windows">
<patternfile>x86win_prepatterns.xml</patternfile>
</compiler>
<compiler id="borlandcpp">
<patternfile>x86win_prepatterns.xml</patternfile>
</compiler>
</language>
</patternconstraints>

98
Ghidra/Processors/x86/data/patterns/x86-64gcc_patterns.xml
View File

@@ -11,11 +11,8 @@
<data>0xeb..90</data> <!-- JMP small , NOP -->
<data>0x5d 0xc3</data> <!-- POP RBP, RET -->
<data>0x5b 0xc3</data> <!-- POP RBX, RET -->
<data>0x415f 0xc3</data> <!-- POP R15, RET -->
<data>0x415c 0xc3</data> <!-- POP R12, RET -->
<data>0x41 010111.. 0xc3</data> <!-- POP R12-15, RET -->
<data>0x31c0 0xc3</data> <!-- XOR(EAX,EAX), RET -->
<data>0x415d 0xc3</data> <!-- POP R13, RET -->
<data>0x415e 0xc3</data> <!-- POP R14, RET -->
<data>0x4883c4 ....1000 0xc3</data> <!-- ADD RSP, C; RET -->
<data>0x666690</data> <!-- three-byte NOP -->
<data>0x0f1f00</data> <!-- three-byte NOP -->
@@ -36,37 +33,114 @@
<data>0x534889fb</data> <!-- PUSH RBX; MOV(RBX,RDI) (shared objects) -->
<data>0x554889fd</data> <!-- PUSH (RBP); MOV(RBP, RDI) (kernel objects) -->
<data>0x534889fb</data> <!-- PUSH RBX; MOV(RBX,RDI)-->
<data>0x53 0x48 0x83 0xec 0....000 </data> <!-- PUSH RBX; SUB RSP, C -->
<data>0x53 0x48 0x81 0xec .....000 00...... 0x00 </data> <!-- PUSH RBX; SUB RSP, C -->
<!-- three-instruction sequences -->
<data>0x55 0x48 0x89 0xe5 0x48 0x83 0xec 0...0000</data> <!-- PUSH RBP; MOV RBP, RSP; SUB RSP, C -->
<data>0x55 0x48 0x89 0xe5 0x48 100000.1 0xec .....000</data> <!-- PUSH RBP; MOV RBP, RSP; SUB RSP, C -->
<data>0x554889e553</data> <!-- PUSH RBP; MOV RBP, RSP; PUSH RBX -->
<data>0x554889fd53</data> <!-- PUSH RBP; MOV RBP, RDI; PUSH RBX -->
<data>0x554889e548897df8</data> <!-- PUSH RBP; MOV RBP, RSP; MOV [RBP -0x8], RDI -->
<data>0x53 0x48 0x89 0xfb 0xe8 ........ ........ 0xff 0xff</data> <!-- PUSH RBX; MOV RBX,RDI; CALL -->
<data>0x4154 0x55 0100100. 0x89 11......</data> <!-- PUSH R12; PUSH RBP; MOV(R12/3/4/5/xX,RxX); -->
<data>0x4154 0x55 0x53 0100100. 0x89 11......</data> <!-- PUSH R12; PUSH RBP; PUSH RBX; MOV(R12/3/4/5/xX,RxX); -->
<!-- save registers start sequences -->
<data>0x415741564155</data> <!-- PUSH R15; PUSH R14; PUSH R13-->
<data>0x41544989fc55</data> <!-- PUSH R12; MOV(R12,RDI); PUSH(RBP)-->
<data>0x41564155</data> <!-- PUSH R14; PUSH R13-->
<data>0x41554154</data> <!-- PUSH R13; PUSH R12-->
<data>0x41 010101.. 0100100. 0x89 11...... 0x55</data> <!-- PUSH R12/3/4/5; MOV(R12/3/4/5/xX,RxX); PUSH(RBP)-->
<data>0x41 010101.. 0x41 010101.. 0100100. 0x89 11...... </data> <!-- PUSH R12/3/4/5; PUSH R12/3/4/5; MOV(R12/3/4/5/xX,RxX); -->
<funcstart/>
</postpatterns>
</patternpairs>
<pattern>
<data>0x5589e5</data> <!-- PUSH RBP; MOV(EBP, ESP) (shared objects) -->
<funcstart after="data" /> <!-- must be something defined right before this, or no memory -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x55 0x53 0100100. 0x89 11......</data> <!-- PUSH RBP; PUSH RBX; MOV(R12/3/4/5/xX,RxX); -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x4154 0x55 0100100. 0x89 11......</data> <!-- PUSH R12; PUSH RBP; MOV(R12/3/4/5/xX,RxX); -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x4154 0x55 0x53 0100100. 0x89 11......</data> <!-- PUSH R12; PUSH RBP; PUSH RBX; MOV(R12/3/4/5/xX,RxX); -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x53 0x48 0x83 0xec 0....000 </data> <!-- PUSH RBX; SUB RSP, C -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x48 0x83 0xec .....000 </data> <!-- SUB RSP, C -->
<funcstart after="defined" validcode="10" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x48 0x81 0xec .....000 00...... 0x00 </data> <!-- SUB RSP, big C -->
<funcstart after="defined" validcode="10" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x55 0x53 0x48 0x83 100000.1 0xec .....000 </data> <!-- PUSH RBP; PUSH RBX; SUB RSP, big/C -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x554889e5</data> <!-- PUSH RBP; MOV(RBP, RSP) (shared objects) -->
<funcstart after="data" /> <!-- must be something defined right before this, or no memory -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x55 0x48 0x89 0xe5 0x48 0x83 0xec 0...0000</data> <!-- PUSH RBP; MOV RBP, RSP; SUB RSP, C --> <!-- PUSH RBP; MOV(RBP, RSP) (shared objects) -->
<funcstart after="data" /> <!-- must be something defined right before this, or no memory -->
<data>0x55 0x48 0x89 0xe5 0x48 100000.1 0xec .....000</data> <!-- PUSH RBP; MOV RBP, RSP; SUB RSP, big/C --> <!-- PUSH RBP; MOV(RBP, RSP) (shared objects) -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x554889e553</data> <!-- PUSH RBP; MOV RBP, RSP; PUSH RBX --> <!-- PUSH RBP; MOV(RBP, RSP) (shared objects) -->
<funcstart after="data" /> <!-- must be something defined right before this, or no memory -->
<funcstart after="defined" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x4157 0x4156 0x4155</data> <!-- PUSH R15; PUSH R14; PUSH R13-->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x4157 0x4156</data> <!-- PUSH R15; PUSH R14-->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x4156 0x4155</data> <!-- PUSH R14; PUSH R13-->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x41554154</data> <!-- PUSH R13; PUSH R12-->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x41 010101.. 0100100. 0x89 11...... 0x55</data> <!-- PUSH R12/3/4/5; MOV(R12/3/4/5/xX,RxX); PUSH(RBP)-->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x41 010101.. 0x41 010101.. 0100100. 0x89 11...... </data> <!-- PUSH R12/3/4/5; PUSH R12/3/4/5; MOV(R12/3/4/5/xX,RxX); -->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
<pattern>
<data>0x41 010101.. 0x41 010101.. 0100100. 0x89 11...... </data> <!-- PUSH R12/3/4/5; PUSH R12/3/4/5; MOV(R12/3/4/5/xX,RxX); -->
<funcstart after="defined" validcode="5" /> <!-- must be something defined right before this, or no memory, at least 5 FT instructions -->
</pattern>
</patternlist>

34
Ghidra/Processors/x86/data/patterns/x86gcc_patterns.xml
View File

@@ -30,7 +30,41 @@
<possiblefuncstart/>
</pattern>
<pattern>
<data> 0x83 0xec 0.....00 100010.1 01...100 ..100100 0.....00 </data> <!-- SUB ESP, C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x81 0xec ......00 0000.... 0x00 0x00 100010.1 01...100 ..100100 0.....00 </data> <!-- SUB ESP, big C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x5. 0x83 0xec 0.....00 100010.1 01...100 ..100100 0.....00 </data> <!-- PUSH reg, SUB ESP, C, MOV [ESP + value], reg OR MOV reg, [ESP + value] -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x5. 0x81 0xec ......00 0000.... 0x00 0x00 </data> <!-- PUSH reg, SUB ESP, big C, -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x5. 0x5. 100000.1 0xec ......00 </data> <!-- PUSH reg; push reg; SUB ESP, C/big C -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x5. 0x5. 0x5. 100000.1 0xec ......00 </data> <!-- PUSH reg; PUSH reg; PUSH reg; push reg; SUB ESP, C/big C -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data> 0x5. 0x5. 0x5. 0x5. 100000.1 0xec ......00 </data> <!-- PUSH reg; PUSH reg; push reg; SUB ESP, C/big C -->
<funcstart after="defined" validcode="6" /> <!-- must be something defined right before this, or no memory -->
</pattern>
<pattern>
<data>0x8b 0x04 0x24 0xc3 </data> <!-- MOV EAX,[ESP] / RET -->
<funcstart label="__i686.get_pc_thunk.ax" validcode="function"/>

36
Ghidra/Processors/x86/data/patterns/x86win_patterns.xml
View File

@@ -103,41 +103,7 @@
<data> 0x518d4c24082bc883e10703c11bc90bc159e9........ </data> <!-- alloca_probe_8 -->
<funcstart label="__alloca_probe_8"/>
</pattern>
<pattern>
<data>
0x8bff
0x55
0x8bec
0x83ec20
0x8b4508
0x56
0x57
0x6a08
0x59
0xbe........
0x8d7de0
0xf3a5
0x8945f8
0x8b450c
0x5f
0x8945fc
0x5e
0x85c0
0x740c
0xf60008
0x7407
0xc745f4........
0x8d45f4
0x50
0xff75f0
0xff75e4
0xff75e0
0xff15........
0xc9
0xc20800 </data> <!-- __CxxThrowException@8 -->
<funcstart label="__CxxThrowException@8" noreturn="true"/>
</pattern>
<pattern>
<data>

38
Ghidra/Processors/x86/data/patterns/x86win_prepatterns.xml Normal file
View File

@@ -0,0 +1,38 @@
<patternlist>
<pattern>
<data>
0x8bff
0x55
0x8bec
0x83ec20
0x8b4508
0x56
0x57
0x6a08
0x59
0xbe........
0x8d7de0
0xf3a5
0x8945f8
0x8b450c
0x5f
0x8945fc
0x5e
0x85c0
0x740c
0xf60008
0x7407
0xc745f4........
0x8d45f4
0x50
0xff75f0
0xff75e4
0xff75e0
0xff15........
0xc9
0xc20800 </data> <!-- __CxxThrowException@8 -->
<funcstart label="__CxxThrowException@8" noreturn="true"/>
</pattern>
</patternlist>