Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
C
cwe_checker
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
cwe_checker
Commits
d701731b
Commit
d701731b
authored
Sep 30, 2020
by
Enkelmann
Committed by
Enkelmann
Nov 03, 2020
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
cargo fmt
parent
5343432e
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
37 additions
and
49 deletions
+37
-49
mod.rs
cwe_checker_rs/src/analysis/pointer_inference/mod.rs
+1
-1
expression.rs
cwe_checker_rs/src/intermediate_representation/expression.rs
+6
-12
mod.rs
cwe_checker_rs/src/intermediate_representation/mod.rs
+1
-1
term.rs
cwe_checker_rs/src/intermediate_representation/term.rs
+19
-31
variable.rs
cwe_checker_rs/src/intermediate_representation/variable.rs
+1
-1
mod.rs
cwe_checker_rs/src/term/mod.rs
+9
-3
No files found.
cwe_checker_rs/src/analysis/pointer_inference/mod.rs
View file @
d701731b
...
@@ -14,13 +14,13 @@
...
@@ -14,13 +14,13 @@
use
super
::
interprocedural_fixpoint
::{
Computation
,
NodeValue
};
use
super
::
interprocedural_fixpoint
::{
Computation
,
NodeValue
};
use
crate
::
abstract_domain
::{
BitvectorDomain
,
DataDomain
};
use
crate
::
abstract_domain
::{
BitvectorDomain
,
DataDomain
};
use
crate
::
analysis
::
graph
::{
Graph
,
Node
};
use
crate
::
analysis
::
graph
::{
Graph
,
Node
};
use
crate
::
prelude
::
*
;
use
crate
::
term
::
*
;
use
crate
::
term
::
*
;
use
crate
::
utils
::
log
::
*
;
use
crate
::
utils
::
log
::
*
;
use
petgraph
::
graph
::
NodeIndex
;
use
petgraph
::
graph
::
NodeIndex
;
use
petgraph
::
visit
::
IntoNodeReferences
;
use
petgraph
::
visit
::
IntoNodeReferences
;
use
petgraph
::
Direction
;
use
petgraph
::
Direction
;
use
std
::
collections
::
HashMap
;
use
std
::
collections
::
HashMap
;
use
crate
::
prelude
::
*
;
mod
context
;
mod
context
;
mod
object
;
mod
object
;
...
...
cwe_checker_rs/src/intermediate_representation/expression.rs
View file @
d701731b
...
@@ -4,17 +4,17 @@ use crate::prelude::*;
...
@@ -4,17 +4,17 @@ use crate::prelude::*;
/// An expression is a calculation rule
/// An expression is a calculation rule
/// on how to compute a certain value given some variables (register values) as input.
/// on how to compute a certain value given some variables (register values) as input.
///
///
/// The basic building blocks of expressions are the same as for Ghidra P-Code.
/// The basic building blocks of expressions are the same as for Ghidra P-Code.
/// However, expressions can be nested, unlike original P-Code.
/// However, expressions can be nested, unlike original P-Code.
///
///
/// Computing the value of an expression is a side-effect-free operation.
/// Computing the value of an expression is a side-effect-free operation.
///
///
/// Expressions are typed in the sense that each expression has a `ByteSize`
/// Expressions are typed in the sense that each expression has a `ByteSize`
/// indicating the size of the result when evaluating the expression.
/// indicating the size of the result when evaluating the expression.
/// Some expressions impose restrictions on the sizes of their inputs
/// Some expressions impose restrictions on the sizes of their inputs
/// for the expression to be well-typed.
/// for the expression to be well-typed.
///
///
/// All operations are defined the same as the corresponding P-Code operation.
/// All operations are defined the same as the corresponding P-Code operation.
/// Further information about specific operations can be obtained by looking up the P-Code mnemonics in the
/// Further information about specific operations can be obtained by looking up the P-Code mnemonics in the
/// [P-Code Reference Manual](https://ghidra.re/courses/languages/html/pcoderef.html).
/// [P-Code Reference Manual](https://ghidra.re/courses/languages/html/pcoderef.html).
...
@@ -33,10 +33,7 @@ pub enum Expression {
...
@@ -33,10 +33,7 @@ pub enum Expression {
rhs
:
Box
<
Expression
>
,
rhs
:
Box
<
Expression
>
,
},
},
/// A unary operation
/// A unary operation
UnOp
{
UnOp
{
op
:
UnOpType
,
arg
:
Box
<
Expression
>
},
op
:
UnOpType
,
arg
:
Box
<
Expression
>
,
},
/// A cast operation for type cast between integer and floating point types of different byte lengths.
/// A cast operation for type cast between integer and floating point types of different byte lengths.
Cast
{
Cast
{
op
:
CastOpType
,
op
:
CastOpType
,
...
@@ -46,10 +43,7 @@ pub enum Expression {
...
@@ -46,10 +43,7 @@ pub enum Expression {
/// An unknown value but with known size.
/// An unknown value but with known size.
/// This may be generated for e.g. unsupported assembly instructions.
/// This may be generated for e.g. unsupported assembly instructions.
/// Note that computation of an unknown value is still required to be side-effect-free!
/// Note that computation of an unknown value is still required to be side-effect-free!
Unknown
{
Unknown
{
description
:
String
,
size
:
ByteSize
},
description
:
String
,
size
:
ByteSize
,
},
/// Extracting a sub-bitvector from the argument expression.
/// Extracting a sub-bitvector from the argument expression.
Subpiece
{
Subpiece
{
low_byte
:
ByteSize
,
low_byte
:
ByteSize
,
...
...
cwe_checker_rs/src/intermediate_representation/mod.rs
View file @
d701731b
...
@@ -19,7 +19,7 @@ mod term;
...
@@ -19,7 +19,7 @@ mod term;
pub
use
term
::
*
;
pub
use
term
::
*
;
/// An unsigned number of bytes.
/// An unsigned number of bytes.
///
///
/// Used to represent sizes of values in registers or in memory.
/// Used to represent sizes of values in registers or in memory.
/// Can also be used for other byte-valued numbers, like offsets,
/// Can also be used for other byte-valued numbers, like offsets,
/// as long as the number is guaranteed to be non-negative.
/// as long as the number is guaranteed to be non-negative.
...
...
cwe_checker_rs/src/intermediate_representation/term.rs
View file @
d701731b
...
@@ -50,15 +50,12 @@ pub struct Term<T> {
...
@@ -50,15 +50,12 @@ pub struct Term<T> {
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
pub
enum
Def
{
pub
enum
Def
{
/// A memory load into the register given by `var`.
/// A memory load into the register given by `var`.
///
///
/// The size of `var` also determines the number of bytes read from memory.
/// The size of `var` also determines the number of bytes read from memory.
/// The size of `address` is required to match the pointer size of the corresponding CPU architecture.
/// The size of `address` is required to match the pointer size of the corresponding CPU architecture.
Load
{
Load
{
var
:
Variable
,
address
:
Expression
},
var
:
Variable
,
address
:
Expression
,
},
/// A memory store operation.
/// A memory store operation.
///
///
/// The size of `value` determines the number of bytes written.
/// The size of `value` determines the number of bytes written.
/// The size of `address` is required to match the pointer size of the corresponding CPU architecture.
/// The size of `address` is required to match the pointer size of the corresponding CPU architecture.
Store
{
Store
{
...
@@ -66,18 +63,15 @@ pub enum Def {
...
@@ -66,18 +63,15 @@ pub enum Def {
value
:
Expression
,
value
:
Expression
,
},
},
/// A register assignment, assigning the result of the expression `value` to the register `var`.
/// A register assignment, assigning the result of the expression `value` to the register `var`.
Assign
{
Assign
{
var
:
Variable
,
value
:
Expression
},
var
:
Variable
,
value
:
Expression
,
},
}
}
/// A `Jmp` instruction affects the control flow of a program, i.e. it may change the instruction pointer.
/// A `Jmp` instruction affects the control flow of a program, i.e. it may change the instruction pointer.
/// With the exception of `CallOther`, it has no other side effects.
/// With the exception of `CallOther`, it has no other side effects.
///
///
/// `Jmp` instructions carry some semantic information with it, like whether a jump is intra- or interprocedural.
/// `Jmp` instructions carry some semantic information with it, like whether a jump is intra- or interprocedural.
/// Note that this semantic information may not always be correct.
/// Note that this semantic information may not always be correct.
///
///
/// The targets (and return targets) of jumps are, if known, either basic blocks (`Blk`) or subroutines (`Sub`)
/// The targets (and return targets) of jumps are, if known, either basic blocks (`Blk`) or subroutines (`Sub`)
/// depending of the type of the jump.
/// depending of the type of the jump.
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
...
@@ -87,21 +81,15 @@ pub enum Jmp {
...
@@ -87,21 +81,15 @@ pub enum Jmp {
/// An indirect intraprocedural jump to the address that the given expression evaluates to.
/// An indirect intraprocedural jump to the address that the given expression evaluates to.
BranchInd
(
Expression
),
BranchInd
(
Expression
),
/// A direct intraprocedural jump that is only taken if the condition evaluates to true (i.e. not zero).
/// A direct intraprocedural jump that is only taken if the condition evaluates to true (i.e. not zero).
CBranch
{
CBranch
{
target
:
Tid
,
condition
:
Expression
},
target
:
Tid
,
condition
:
Expression
,
},
/// A direct interprocedural jump representing a subroutine call.
/// A direct interprocedural jump representing a subroutine call.
///
///
/// Note that this is syntactically equivalent to a `Jmp::Branch`.
/// Note that this is syntactically equivalent to a `Jmp::Branch`.
/// If the `return_` is `None`, then the called function does not return to its caller.
/// If the `return_` is `None`, then the called function does not return to its caller.
Call
{
Call
{
target
:
Tid
,
return_
:
Option
<
Tid
>
},
target
:
Tid
,
return_
:
Option
<
Tid
>
,
},
/// An indirect interprocedural jump to the address the `target` expression evaluates to
/// An indirect interprocedural jump to the address the `target` expression evaluates to
/// and representing a subroutine call.
/// and representing a subroutine call.
///
///
/// Note that this is syntactically equivalent to a `Jmp::BranchInd`.
/// Note that this is syntactically equivalent to a `Jmp::BranchInd`.
/// If the `return_` is `None`, then the called function is believed to not return to its caller.
/// If the `return_` is `None`, then the called function is believed to not return to its caller.
CallInd
{
CallInd
{
...
@@ -109,17 +97,17 @@ pub enum Jmp {
...
@@ -109,17 +97,17 @@ pub enum Jmp {
return_
:
Option
<
Tid
>
,
return_
:
Option
<
Tid
>
,
},
},
/// A indirect interprocedural jump indicating a return from a subroutine.
/// A indirect interprocedural jump indicating a return from a subroutine.
///
///
/// Note that this is syntactically equivalent to a `Jmp::BranchInd`.
/// Note that this is syntactically equivalent to a `Jmp::BranchInd`.
Return
(
Expression
),
Return
(
Expression
),
/// This instruction is used for all side effects that are not representable by other instructions
/// This instruction is used for all side effects that are not representable by other instructions
/// or not supported by the disassembler.
/// or not supported by the disassembler.
///
///
/// E.g. syscalls and other interrupts are mapped to `CallOther`.
/// E.g. syscalls and other interrupts are mapped to `CallOther`.
/// Assembly instructions that the disassembler does not support are also mapped to `CallOther`.
/// Assembly instructions that the disassembler does not support are also mapped to `CallOther`.
/// One can use the `description` field to match for and handle known side effects (e.g. syscalls).
/// One can use the `description` field to match for and handle known side effects (e.g. syscalls).
///
///
/// The `return_` field indicates the `Blk` term identifier
/// The `return_` field indicates the `Blk` term identifier
/// where the disassembler assumes that execution will continue after handling of the side effect.
/// where the disassembler assumes that execution will continue after handling of the side effect.
CallOther
{
CallOther
{
description
:
String
,
description
:
String
,
...
@@ -128,10 +116,10 @@ pub enum Jmp {
...
@@ -128,10 +116,10 @@ pub enum Jmp {
}
}
/// A basic block is a sequence of `Def` instructions followed by up to two `Jmp` instructions.
/// A basic block is a sequence of `Def` instructions followed by up to two `Jmp` instructions.
///
///
/// The `Def` instructions represent side-effectful operations that are executed in order when the block is entered.
/// The `Def` instructions represent side-effectful operations that are executed in order when the block is entered.
/// `Def` instructions do not affect the control flow of a program.
/// `Def` instructions do not affect the control flow of a program.
///
///
/// The `Jmp` instructions represent control flow affecting operations.
/// The `Jmp` instructions represent control flow affecting operations.
/// There can only be zero, one or two `Jmp`s:
/// There can only be zero, one or two `Jmp`s:
/// - Zero `Jmp`s indicate that the next execution to be executed could not be discerned.
/// - Zero `Jmp`s indicate that the next execution to be executed could not be discerned.
...
@@ -139,7 +127,7 @@ pub enum Jmp {
...
@@ -139,7 +127,7 @@ pub enum Jmp {
/// - If there is exactly one `Jmp`, it is required to be an unconditional jump.
/// - If there is exactly one `Jmp`, it is required to be an unconditional jump.
/// - For two jumps, the first one has to be a conditional jump,
/// - For two jumps, the first one has to be a conditional jump,
/// where the second unconditional jump is only taken if the condition of the first jump evaluates to false.
/// where the second unconditional jump is only taken if the condition of the first jump evaluates to false.
///
///
/// Basic blocks are *single entry, single exit*, i.e. a basic block is only entered at the beginning
/// Basic blocks are *single entry, single exit*, i.e. a basic block is only entered at the beginning
/// and is only exited by the jump instructions at the end of the block.
/// and is only exited by the jump instructions at the end of the block.
/// If a new control flow edge is discovered that would jump to the middle of a basic block,
/// If a new control flow edge is discovered that would jump to the middle of a basic block,
...
@@ -151,7 +139,7 @@ pub struct Blk {
...
@@ -151,7 +139,7 @@ pub struct Blk {
}
}
/// A `Sub` or subroutine represents a function with a given name and a list of basic blocks belonging to it.
/// A `Sub` or subroutine represents a function with a given name and a list of basic blocks belonging to it.
///
///
/// Subroutines are *single-entry*,
/// Subroutines are *single-entry*,
/// i.e. calling a subroutine will execute the first block in the list of basic blocks.
/// i.e. calling a subroutine will execute the first block in the list of basic blocks.
/// A subroutine may have multiple exits, which are identified by `Jmp::Return` instructions.
/// A subroutine may have multiple exits, which are identified by `Jmp::Return` instructions.
...
@@ -206,7 +194,7 @@ pub struct Program {
...
@@ -206,7 +194,7 @@ pub struct Program {
}
}
/// The `Project` struct is the main data structure representing a binary.
/// The `Project` struct is the main data structure representing a binary.
///
///
/// It contains information about the disassembled binary
/// It contains information about the disassembled binary
/// and about the execution environment of the binary.
/// and about the execution environment of the binary.
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
#[derive(Serialize,
Deserialize,
Debug,
PartialEq,
Eq,
Hash,
Clone)]
...
...
cwe_checker_rs/src/intermediate_representation/variable.rs
View file @
d701731b
...
@@ -2,7 +2,7 @@ use super::ByteSize;
...
@@ -2,7 +2,7 @@ use super::ByteSize;
use
crate
::
prelude
::
*
;
use
crate
::
prelude
::
*
;
/// A variable represents a register with a known size and name.
/// A variable represents a register with a known size and name.
///
///
/// Variables can be temporary (or virtual).
/// Variables can be temporary (or virtual).
/// In this case they do not represent actual physical registers
/// In this case they do not represent actual physical registers
/// and are only used to store intermediate results necessary for representing more complex assembly instructions.
/// and are only used to store intermediate results necessary for representing more complex assembly instructions.
...
...
cwe_checker_rs/src/term/mod.rs
View file @
d701731b
...
@@ -7,8 +7,8 @@ use crate::intermediate_representation::Jmp as IrJmp;
...
@@ -7,8 +7,8 @@ use crate::intermediate_representation::Jmp as IrJmp;
use
crate
::
intermediate_representation
::
Program
as
IrProgram
;
use
crate
::
intermediate_representation
::
Program
as
IrProgram
;
use
crate
::
intermediate_representation
::
Project
as
IrProject
;
use
crate
::
intermediate_representation
::
Project
as
IrProject
;
use
crate
::
intermediate_representation
::
Sub
as
IrSub
;
use
crate
::
intermediate_representation
::
Sub
as
IrSub
;
use
serde
::{
Deserialize
,
Serialize
};
use
crate
::
intermediate_representation
::{
Term
,
Tid
};
use
crate
::
intermediate_representation
::{
Term
,
Tid
};
use
serde
::{
Deserialize
,
Serialize
};
pub
mod
symbol
;
pub
mod
symbol
;
use
symbol
::
ExternSymbol
;
use
symbol
::
ExternSymbol
;
...
@@ -207,7 +207,10 @@ impl From<Blk> for IrBlk {
...
@@ -207,7 +207,10 @@ impl From<Blk> for IrBlk {
}
else
{
}
else
{
for
(
counter
,
ir_def
)
in
ir_defs
.into_iter
()
.enumerate
()
{
for
(
counter
,
ir_def
)
in
ir_defs
.into_iter
()
.enumerate
()
{
ir_def_terms
.push
(
Term
{
ir_def_terms
.push
(
Term
{
tid
:
def_term
.tid
.clone
()
.with_id_suffix
(
&
format!
(
"_{}"
,
counter
)),
tid
:
def_term
.tid
.clone
()
.with_id_suffix
(
&
format!
(
"_{}"
,
counter
)),
term
:
ir_def
,
term
:
ir_def
,
});
});
}
}
...
@@ -224,7 +227,10 @@ impl From<Blk> for IrBlk {
...
@@ -224,7 +227,10 @@ impl From<Blk> for IrBlk {
}
}
for
(
counter
,
ir_def
)
in
ir_defs
.into_iter
()
.enumerate
()
{
for
(
counter
,
ir_def
)
in
ir_defs
.into_iter
()
.enumerate
()
{
ir_def_terms
.push
(
Term
{
ir_def_terms
.push
(
Term
{
tid
:
jmp_term
.tid
.clone
()
.with_id_suffix
(
&
format!
(
"_{}"
,
counter
)),
tid
:
jmp_term
.tid
.clone
()
.with_id_suffix
(
&
format!
(
"_{}"
,
counter
)),
term
:
ir_def
,
term
:
ir_def
,
});
});
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment