serpilliere
commented
5 years ago Hi @mrphrazer !
Yep here is the exaplaination:
- first of all,
dead_simpknows which reg is to keep by using the 'abi' in their_archobject usingget_out_regs, which is call on each leaf block of their_cfg - when you do SSA transformation, the last
RAXis (for example) translated inRAX.12 - So when you do
dead_simp_ssa, theget_out_regsdoes not recognizeRAX.12as a register to keep - it's deleted
- so the
phiancestor are deleted - the test and conditional jump branches are useless, so removed.
- we obtain the given graph.
In full.py here is the steps which are done:
- first, we have to be sure that the registers of
get_out_regsare assigned in the leaves blocks.this is done with:# Add dummy dependency to uncover out regs assignment for loc in ircfg_a.leaves(): irblock = ircfg_a.blocks.get(loc) if irblock is None: continue regs = {} for reg in ir_arch_a.get_out_regs(irblock): regs[reg] = reg assignblks = list(irblock) new_assiblk = AssignBlock(regs, assignblks[-1].instr) assignblks.append(new_assiblk) new_irblock = IRBlock(irblock.loc_key, assignblks) ircfg_a.blocks[loc] = new_irblock
Now we are sure that we have at the leaves blocks, something like:
...
RAX = RAX
RSP = RSPNow, when we will translate in SSA, this gives something as:
...
RAX.12 = RAX.11
RSP.20 = RSP.19Now, we have to use a modified ir_arch_a class, as we have to recognize new registers in get_out_regs. This is done in full.py as:
class IRAOutRegs(ira):
def get_out_regs(self, block):
regs_todo = super(self.__class__, self).get_out_regs(block)
out = {}
for assignblk in block:
for dst in assignblk:
reg = self.ssa_var.get(dst, None)
if reg is None:
continue
if reg in regs_todo:
out[reg] = dst
return set(viewvalues(out))Here, we keep classical registers, plus ssa registers linked to original registers found in the original get_out_regs
So dead_simp_ssa will be ok!
So your come becomes:
from miasm.analysis.machine import Machine
from miasm.analysis.simplifier import IRCFGSimplifierSSA
from miasm.ir.ir import AssignBlock, IRBlock
from pdb import pm
def write_graph(output_file, ira_cfg):
open(output_file, "wb").write(ira_cfg.dot())
code = "554889e5897dfc8975f88b55fc8b45f801d03d390500007507B801000000EB05B8000000005dc3".decode("hex")
architecture = "x86_64"
m = Machine(architecture)
mdis = m.dis_engine(code)
ira_orig = m.ira(mdis.loc_db)
class IRAOutRegs(m.ira):
def get_out_regs(self, block):
regs_todo = super(self.__class__, self).get_out_regs(block)
out = {}
for assignblk in block:
for dst in assignblk:
reg = self.ssa_var.get(dst, None)
if reg is None:
continue
if reg in regs_todo:
out[reg] = dst
return set(out.values())
ira = IRAOutRegs(mdis.loc_db)
asm_cfg = mdis.dis_multiblock(0)
ira_cfg = ira.new_ircfg_from_asmcfg(asm_cfg)
# Add dummy dependency to uncover out regs assignment
for loc in ira_cfg.leaves():
irblock = ira_cfg.blocks.get(loc)
if irblock is None:
continue
regs = {}
for reg in ira_orig.get_out_regs(irblock):
regs[reg] = reg
assignblks = list(irblock)
new_assiblk = AssignBlock(regs, assignblks[-1].instr)
assignblks.append(new_assiblk)
new_irblock = IRBlock(irblock.loc_key, assignblks)
ira_cfg.blocks[loc] = new_irblock
head = mdis.loc_db.get_offset_location(0)
write_graph("before_simp.dot", ira_cfg)
simplifier = IRCFGSimplifierSSA(ira)
simplifier.simplify(ira_cfg, head)
write_graph("after_dead_code.dot", ira_cfg)
which gives:
Ok. after reading my own explanations, I think I must include all those mechanism by default somewhere.
Maybe in the simplifier ?
Does it answer to your questions @mrphrazer ?
mrphrazer
su-vikas
commial
dwuid
Hi!
In
IRCFGSimplifierSSA, the propagations seem to work fine. However, the results ofdo_dead_simp_ssaseem strange to me.Given the following code, the remaining graph in
after_dead_code.dotis a small basic block.Do you have any idea what's going on?