falconre / falcon

Binary Analysis Framework in Rust
Apache License 2.0
549 stars 47 forks source link

0.5 IL Changes #71

Closed endeav0r closed 3 years ago

endeav0r commented 4 years ago

This issue exists as a place to discuss IL changes for Falcon 0.5.

Other Ideas:

Delay Slots

We can create an operation, il::Operation::Delay(usize, Box<Operation>), but allowing for operations with arbitrary delays makes the implementation of analyses and control-flow recovery more difficult. We would need to create some sort of, "Executor," which could be used by analyses, which kept track of operations in delay slots/pipelines.

Parallel Execution

I am less sure how to incorporate this. Currently, il::Instruction corresponds nicely to a single instruction. In some architectures, however, multiple instructions can be executed simultaneously. We can either lift these addresses to an il::Instruction, and at the il::Instruction level mark whether the instruction is parallel or not, or we can create an il::Operation::Parallel(Vec<il::Operation>). I'm again worried about creating an il::Operation::Parallel(Vec<il::Operation>), because it may make implementing analyses more challenging. We would need to integrate this into an, "Executor," of sorts which managed all of this for us.

Placeholder

Often times we Nop out instructions we aren't concerned with. Specific to this conversation is the NOPing of branch instructions. People would like to retain this information in an optional fashion.

There are a couple ways to do this.

  1. We create a Placeholder Operation, which is another operation people need to consider while doing analyses.
  2. We create a placeholder: Option<il::Operation> field for Nops. This becomes a, "Bonus add-on," modification that should not affect anything as is.
  3. We allow the attachment of serialized data different components of the il, beginning with Program, Function, Block, Instruction, and Operation. We can go with either json or I am going to recommend, bincode. Json is nice because it allows the entire IL to still be easily serializable. Bincode is nice because anything that is Rust can be encoded with bincode (json only allows things which can be converted to strings as map indices).