mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/patch'

Browse Source
This commit is contained in:
Ryan Kurtz
2023-03-03 15:28:49 -05:00
parent a9baf9f6d8 0c67fa3f35
commit f69241da71
5 changed files with 78 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Ghidra/Processors/AARCH64/certification.manifest
View File

@@ -21,4 +21,6 @@ data/languages/AARCH64sve.sinc||GHIDRA||||END|
data/languages/AppleSilicon.ldefs||GHIDRA||||END|
data/manuals/AARCH64.idx||GHIDRA||||END|
data/patterns/AARCH64_LE_patterns.xml||GHIDRA||||END|
data/patterns/AARCH64_win_patterns.xml||GHIDRA||||END|
data/patterns/patternconstraints.xml||GHIDRA||||END|
data/patterns/prepatternconstraints.xml||GHIDRA||||END|

18
Ghidra/Processors/AARCH64/data/languages/AARCH64_win.cspec
View File

@@ -193,4 +193,22 @@
</prototype>
</default_proto>
<callfixup name="security_push_cookie">
<target name="__security_push_cookie"/>
<pcode>
<body><![CDATA[
sp = sp - 16;
]]></body>
</pcode>
</callfixup>
<callfixup name="security_pop_cookie">
<target name="__security_pop_cookie"/>
<pcode>
<body><![CDATA[
sp = sp + 16;
]]></body>
</pcode>
</callfixup>
</compiler_spec>

50
Ghidra/Processors/AARCH64/data/patterns/AARCH64_win_patterns.xml Normal file
View File

@@ -0,0 +1,50 @@
<patternlist>
<!-- Special functions with side-effects -->
<!-- -->
<pattern> <!-- __security_push_cookie -->
<data> 0xff 0x43 0x00 0xd1
...10001 ........ ........ 1..10000
00110001 ......10 01...... 11111001
0xf1 0x63 0x31 0xcb
0xf1 0x07 0x00 0xf9
0xc0 0x03 0x5f 0xd6 </data>
<!--
sub sp,sp,#0x10
adrp x17,0x........
ldr x17,[x17, #0x...]
sub x17,sp,x17
str x17,[sp, #0x8]
ret
-->
<align mark="0" bits="3"/>
<funcstart label="__security_push_cookie"/>
</pattern>
<pattern> <!-- __security_pop_cookie -->
<data> ...10001 ........ ........ 1..10000
0xf0 0x07 0x40 0xf9
00110001 ......10 01...... 11111001
0xf0 0x63 0x30 0xcb
0x1f 0x02 0x11 0xeb
...00001 ........ ........ 01010100
0xff 0x43 0x00 0x91
0xc0 0x03 0x5f 0xd6
0x1f 0x20 0x03 0xd5 </data>
<!--
adrp x17,0x........
ldr x16,[sp, #0x8]
ldr x17,[x17, #0x...]
sub x16,sp,x16
cmp x16,x17
b.ne LAB_14020e5a4
add sp,sp,#0x10
ret
-->
<align mark="0" bits="3"/>
<funcstart label="__security_pop_cookie"/>
</pattern>
</patternlist>

7
Ghidra/Processors/AARCH64/data/patterns/prepatternconstraints.xml Normal file
View File

@@ -0,0 +1,7 @@
<patternconstraints>
<language id="AARCH64:LE:64:*">
<compiler id="windows">
<patternfile>AARCH64_win_patterns.xml</patternfile>
</compiler>
</language>
</patternconstraints>

2
Ghidra/Processors/ARM/data/languages/ARMTHUMBinstructions.sinc
View File

@@ -883,7 +883,7 @@ thsdec4: thsdec5 is thc0404=0 & thsdec5 { }
thsdec3: r3 is thc0303=1 & r3 & thc0415=0 { * mult_addr=r3; mult_addr = mult_addr - 4; }
thsdec3: r3,thsdec4 is thc0303=1 & thsdec4 & r3 { * mult_addr=r3; mult_addr = mult_addr - 4; }
thsdec3: thsdec4 is thc0303=0 & thsdec4 { }
thsdec2: r2 is thc0202=1 & r2 & thc0415=0 { * mult_addr=r2; mult_addr = mult_addr - 4; }
thsdec2: r2 is thc0202=1 & r2 & thc0315=0 { * mult_addr=r2; mult_addr = mult_addr - 4; }
thsdec2: r2,thsdec3 is thc0202=1 & thsdec3 & r2 { * mult_addr=r2; mult_addr = mult_addr - 4; }
thsdec2: thsdec3 is thc0202=0 & thsdec3 { }
thsdec1: r1 is thc0101=1 & r1 & thc0215=0 { * mult_addr=r1; mult_addr = mult_addr - 4; }