cisco-open / llvm-crash-analyzer

llvm crash analysis
Apache License 2.0
40 stars 17 forks source link

[CRE] Update PC register value for each instruction #41

Closed niktesic closed 1 year ago

niktesic commented 1 year ago

Concrete Reverse Execution is focused on keeping track of registers, that are explicitly modified by an instruction. However, the Program Counter register is not updated and its value is stuck at the crash-start value for the current frame.

This patch adds support for updating PC register value for each instruction, in two steps:

  1. During decompilation, we save PC value for each decompiled Machine Instruction We maintain mapping between MI and its PC address, since TII for x86 doesn't support MI size getter. In x86, instructions with the same Opcode could have different sizes.
  2. During Taint Analysis, we update CRE data for PC register to make it available for the CMA calculation

It is important to have actual values of PC register at each program point, so we can calculate Concrete Memory Addresses for PC relative addressing mode. This will be supported in the next PR. PC relative addresses are extensively used to access global variables via Global Offset Table in PIC code.