mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-25 17:00:36 -09:00
Code Issues Packages Projects Releases Wiki Activity

GP-4474 Add pattern to automatically set callfixup on blrl PIC related

Browse Source 
routine
This commit is contained in:
emteere
2024-03-29 15:39:41 -04:00
parent d920e39e7f
commit d934e7aace
9 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_be.cspec
View File

@@ -116,6 +116,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_e500_be.cspec
View File

@@ -72,6 +72,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_e500_le.cspec
View File

@@ -71,6 +71,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_e500mc_be.cspec
View File

@@ -70,6 +70,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_e500mc_le.cspec
View File

@@ -70,6 +70,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_32_le.cspec
View File

@@ -116,6 +116,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

1
Ghidra/Processors/PowerPC/data/languages/ppc_64_32.cspec
View File

@@ -119,6 +119,7 @@
</default_proto>
<callfixup name="get_pc_thunk_lr">
<target name="__get_pc_thunk_lr"/>
<pcode>
<body><![CDATA[
LR = inst_dest + 4;

5
Ghidra/Processors/PowerPC/data/patterns/PPC_BE_patterns.xml
View File

@@ -31,4 +31,9 @@
<possiblefuncstart after="defined" /> <!-- must be something defined right before this -->
</pattern>
<pattern>
<data> 0x4e 0x80 0x00 0x21</data> <!-- blrl -->
<possiblefuncstart validcode="function" label="__get_pc_thunk_lr" /> <!-- must be a function here -->
</pattern>
</patternlist>

52
Ghidra/Test/IntegrationTest/src/test.slow/java/ghidra/app/cmd/function/CreateFunctionThunkTest.java
View File

@@ -29,6 +29,7 @@ import ghidra.program.model.address.AddressSet;
import ghidra.program.model.data.DWordDataType;
import ghidra.program.model.data.DataType;
import ghidra.program.model.listing.*;
import ghidra.program.model.symbol.Reference;
import ghidra.program.model.symbol.SourceType;
import ghidra.test.AbstractGhidraHeadedIntegrationTest;
import ghidra.test.TestEnv;
@@ -208,4 +209,55 @@ public class CreateFunctionThunkTest extends AbstractGhidraHeadedIntegrationTest
assertEquals(true, isThunk.isThunk());
assertEquals("thunker", isThunk.getName());
}
/**
* Tests that the Function start analyzer will create a thunk given the thunk tag on a matching function
* Tests that constant propagation creates a reference using the callfixup value in LR
*
*/
@Test
public void testPPCblrlThunk() throws Exception {
builder = new ProgramBuilder("thunk", ProgramBuilder._PPC_32);
/**
* bl __get_pc_thunk_lr
* mfspr r30,LR
* lbz r3,0x0(r30)
* blr
*/
builder.setBytes("0x00002000", "42 80 00 31 7f c8 02 a6 88 1e 00 00 4e 80 00 20");
builder.disassemble("0x00002000", 27, true);
/**
* blrl
* lbz r12,0x0(r10)
* blr
*/
builder.setBytes("0x0002030", "4e 80 00 21 89 8a 00 00 4e 80 00 20");
builder.disassemble("0x0002030", 27, true);
builder.createFunction("0x0002000");
builder.createFunction("0x0002030");
program = builder.getProgram();
analyze();
Instruction instruction = program.getListing().getInstructionAt(builder.addr(0x2008));
assertNotNull(instruction);
Reference[] referencesFrom = instruction.getReferencesFrom();
// Thunk will set a value in LR that is not normal from the assumed return of a function
// used to calculate a constant reference
// TODO: There is a left-over BAD reference. Need to clean references on re-analysis
assertEquals(0x2034L, referencesFrom[1].getToAddress().getOffset());
Function thunker = program.getFunctionManager().getFunctionAt(builder.addr(0x0002030));
assertEquals("__get_pc_thunk_lr", thunker.getName());
assertEquals("get_pc_thunk_lr", thunker.getCallFixup());
}
}