IR module

Maat's binary code Intermediate Representation.

Contents

This module contains the implementation of the IR used to lift binary code in Maat.

❱   Classes

class maat::ir::CPUContext
class maat::ir::TmpContext
class maat::ir::CPU
class maat::ir::Param
Base class for parameters to be used in IR instructions.
class maat::ir::Inst
Maat IR instructions.
An IR instruction is made of an operation followed by one or several parameters.
class maat::ir::AsmInst
A native instruction lifted into a sequence of IR/PCODE instructions.
class maat::ir::IRMap
class maat::Lifter
The lifter is responsible for translating binary assembly code into Maat's IR.
class maat::ir::ProcessedInst::Param
A processed parameter, it can hold either an abstract value, a concrete value, or no value at all.
class maat::ir::ProcessedInst

❱   Enums

enum class Op: uint8_t { COPY, LOAD, STORE, BRANCH, CBRANCH, BRANCHIND, CALL, CALLIND, CALLOTHER, RETURN, INT_EQUAL, INT_NOTEQUAL, INT_SLESS, INT_SLESSEQUAL, INT_LESS, INT_LESSEQUAL, INT_ZEXT, INT_SEXT, INT_ADD, INT_SUB, INT_CARRY, INT_SCARRY, INT_SBORROW, INT_2COMP, INT_NEGATE, INT_XOR, INT_AND, INT_OR, INT_LEFT, INT_RIGHT, INT_SRIGHT, INT_MULT, INT_DIV, INT_SDIV, INT_REM, INT_SREM, BOOL_NEGATE, BOOL_XOR, BOOL_AND, BOOL_OR, FLOAT_EQUAL, FLOAT_NOTEQUAL, FLOAT_LESS, FLOAT_LESSEQUAL, FLOAT_NAN, FLOAT_ADD, FLOAT_DIV, FLOAT_MULT, FLOAT_SUB, FLOAT_NEG, FLOAT_ABS, FLOAT_SQRT, FLOAT_INT2FLOAT, FLOAT_FLOAT2FLOAT, FLOAT_TRUNC, FLOAT_CEIL, FLOAT_FLOOR, FLOAT_ROUND, MULTIEQUAL, INDIRECT, PIECE, SUBPIECE, CAST, PTRADD, PTRSUB, SEGMENTOP, CPOOLREF, NEW, INSERT, EXTRACT, POPCOUNT, NONE }

❱   Typedefs

using reg_t = uint16_t
using tmp_t = uint16_t
using addr_t = uint64_t
using code_t = uint8_t*
using param_t = Param

❱   Functions

auto is_assignment_op(const ir::Op& op) -> bool
auto is_memory_op(const ir::Op& op) -> bool
auto is_branch_op(const ir::Op& op) -> bool
auto operator<<(std::ostream& os, const ir::Op& op) -> std::ostream&
auto Cst(cst_t val, size_t size) -> Param
auto Addr(addr_t addr, size_t size) -> Param
auto Cst(cst_t val, size_t hb, size_t lb) -> Param
auto Reg(reg_t reg, size_t size) -> Param
auto Reg(reg_t reg, size_t hb, size_t lb) -> Param
auto Tmp(tmp_t tmp, size_t size) -> Param
auto Tmp(tmp_t tmp, size_t hb, size_t lb) -> Param
auto get_ir_map(int mem_engine_uid) -> IRMap&
Get IRMap corresponding to MemEngine identified by mem_engine_uid
auto operator=(const Value& val) -> Param&
Not performant.
void set_value_by_ref(const Value& val)
Performant, 'val' reference needs to stay valid!!

❱   Variables

Value auxilliary
Optional auxilliary value, used to store the original address expression when processing a parameter that is a memory address (the original parameter 'expr' gets replaced by the loaded expression.
Value res
Result of the operation to be assigned to destination operand (if applicable)
Param out
Value of output variable.
Param in0
Value of first input parameter.
Param in1
Value of second input parameter.
Param in2
Value of third input parameter.

❱   Enum documentation

enum class Op: uint8_t

Maat's IR is basically Ghidra's PCODE

❱   Typedef documentation

typedef uint16_t reg_t

Represents a CPU register in Maat's IR

typedef uint16_t tmp_t

Represents a temporary register in Maat's IR

typedef uint64_t addr_t

Represents a memory address in Maat's IR

typedef uint8_t* code_t

A raw pointer to binary executable code

typedef Param param_t

Parameter of an processed instruction

❱   Function documentation

bool is_assignment_op(const ir::Op& op)

Return True if the operation assigns a value to a variable

bool is_memory_op(const ir::Op& op)

Return True if the operation loads of stores memory

bool is_branch_op(const ir::Op& op)

Return True if the operation is a control flow branch

std::ostream& operator<<(std::ostream& os, const ir::Op& op)

Print IR operation to a stream

Param Cst(cst_t val, size_t size)

Build a constant parameter of value 'val' of size 'size' bits

Param Addr(addr_t addr, size_t size)

Build an address parameter for address 'addr' and accessing 'size' bits

Param Cst(cst_t val, size_t hb, size_t lb)

Build a constant parameter of value 'val[hb:lb]' (extract bits lb to hb included from the constant) of size 'hb-lb+1' bits

Param Reg(reg_t reg, size_t size)

Build a parameter for register 'reg' of size 'size' bits

Param Reg(reg_t reg, size_t hb, size_t lb)

Build a parameter for value 'reg[hb:lb]' (extract bits lb to hb included from the register) of size 'hb-lb+1' bits

Param Tmp(tmp_t tmp, size_t size)

Build a parameter for register 'tmp' of size 'size' bits

Param Tmp(tmp_t tmp, size_t hb, size_t lb)

Build a parameter for value 'tmp[hb:lb]' (extract bits lb to hb included from the tmp register) of size 'hb-lb+1' bits