JonathanSalwan / Triton

Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
https://triton-library.github.io
Apache License 2.0
3.39k stars 524 forks source link

getParentRegisters() returns some sub-registers #1335

Closed jordan9001 closed 2 days ago

jordan9001 commented 2 weeks ago

The getParentRegisters() function for x86_64 returns some duplicate registers, specifically isSSM, isAVX256 isAVX512 are all included. I am happy to submit a pull request, but I was would like your feedback first. It makes sense to me that the only parent registers listed on x86 should be the YMM registers, none of the isSSM registers. On x86_64 it should just be the zmm registers. Do you agree?

Essentially, I would like to add this test to the tests:

class TestRegisterParents(unittest.TestCase):
    """Test register Parent Register List"""

    def setUp(self):
        """Define the arch list"""
        self.archctx = []
        self.archcxt.append(TritonContext(ARCH.X86))
        self.archcxt.append(TritonContext(ARCH.X86_64))
        self.archcxt.append(TritonContext(ARCH.ARM32))
        self.archcxt.append(TritonContext(ARCH.AARCH64))

    def test_reg_parents(self):
        for ctx in self.archctx:
            for pr in ctx.getParentRegisters():
                self.assertEqual(pr, ctx.getParentRegister(pr))

I would probably also add and use a isAVX512Parent function, because the isAVX512 function returns some xmm and ymm identifiers as well.

jordan9001 commented 2 weeks ago

It looks like AARCH64's getParentRegisters() lists the d# registers but not the q# registers. So, if it makes sense I could replace those as well.

JonathanSalwan commented 2 weeks ago

Thx for this report. Indeed, it would make more sense. Sounds good to me :)

jordan9001 commented 2 weeks ago

@JonathanSalwan Is there a specific reason some flag registers are their own parent? Or is it okay if I have ZF's parent be EFLAGS and EFER_TCE's parent be EFER?