Demonstrate function bb analysis from API

zznop · zznop · commit a1b49cf88087 · 2025-04-18T15:45:01.000-04:00
diff --git a/architecture.cpp b/architecture.cpp
@@ -307,6 +307,15 @@ bool Architecture::GetInstructionLowLevelILCallback(
 }
 
 
+bool Architecture::AnalyzeBasicBlocksCallback(void *ctxt, BNFunction* function,
+	bool incrementalUpdate, BNFunctionAnalysisSkipOverride analysisSkipOverride)
+{
+	CallbackRef<Architecture> arch(ctxt);
+	Ref<Function> func(new Function(BNNewFunctionReference(function)));
+	return arch->AnalyzeBasicBlocks(*func, incrementalUpdate, analysisSkipOverride);
+}
+
+
 char* Architecture::GetRegisterNameCallback(void* ctxt, uint32_t reg)
 {
 	CallbackRef<Architecture> arch(ctxt);
@@ -797,6 +806,7 @@ void Architecture::Register(Architecture* arch)
 	callbacks.getInstructionText = GetInstructionTextCallback;
 	callbacks.freeInstructionText = FreeInstructionTextCallback;
 	callbacks.getInstructionLowLevelIL = GetInstructionLowLevelILCallback;
+	callbacks.analyzeBasicBlocks = AnalyzeBasicBlocksCallback;
 	callbacks.getRegisterName = GetRegisterNameCallback;
 	callbacks.getFlagName = GetFlagNameCallback;
 	callbacks.getFlagWriteTypeName = GetFlagWriteTypeNameCallback;
@@ -925,6 +935,56 @@ bool Architecture::GetInstructionLowLevelIL(const uint8_t*, uint64_t, size_t&, L
 }
 
 
+bool Architecture::AnalyzeBasicBlocks(Function& function, bool incrementalUpdate, BNFunctionAnalysisSkipOverride analysisSkipOverride)
+{
+	auto data = function.GetView();
+	queue<ArchAndAddr> blocksToProcess;
+	set<ArchAndAddr> seenBlocks;
+
+	// TODO - we might just want to create a generic analysis settings object that includes all of these
+	//bool tailCallTranslation = function.GetSettingsCache()->Get<bool>("core.function.translateTailCalls");
+	bool tailCallTranslation = true;
+	//bool disallowBranchToString = owner->IsDisallowBranchToStringEnabled();
+	bool disallowBranchToString = true;
+
+	/*
+	auto targetExceedsByteLimit = [](const BNStringReference& strRef) {
+			size_t byteLimit = 8;
+			if (strRef.type == Utf16String) byteLimit *= 2;
+			else if (strRef.type == Utf32String) byteLimit *= 4;
+			return (strRef.length >= byteLimit);
+	};*/
+
+	auto funcPlatform = function.GetPlatform();
+	auto start = function.GetStart();
+	blocksToProcess.emplace(funcPlatform->GetArchitecture(), start);
+	seenBlocks.emplace(funcPlatform->GetArchitecture(), start);
+	while (blocksToProcess.size() != 0)
+	{
+		if (data->AnalysisIsAborted())
+			return true;
+
+		// Get the next block to process
+		ArchAndAddr location = blocksToProcess.front();
+		ArchAndAddr instructionGroupStart = location;
+		blocksToProcess.pop();
+
+		// Create a new basic block
+		Ref<BasicBlock> block = function.CreateBasicBlock(location.arch, location.address);
+
+		// TODO actually compute the size of the block from the instruction info
+		block->SetEnd(location.address + 1);
+
+		// Commit the basic block to the function basic block list
+		function.AddBasicBlock(block);
+	}
+
+	// Finalize the function basic block list
+	function.FinalizeBasicBlocks();
+	return true;
+}
+
+
 string Architecture::GetRegisterName(uint32_t reg)
 {
 	return fmt::format("r{}", reg);
@@ -1485,6 +1545,13 @@ bool CoreArchitecture::GetInstructionLowLevelIL(const uint8_t* data, uint64_t ad
 }
 
 
+bool CoreArchitecture::AnalyzeBasicBlocks(Function& function, bool incrementalUpdate,
+	BNFunctionAnalysisSkipOverride analysisSkipOverride)
+{
+	return BNArchitectureAnalyzeBasicBlocks(m_object, function.GetObject(), incrementalUpdate, analysisSkipOverride);
+}
+
+
 string CoreArchitecture::GetRegisterName(uint32_t reg)
 {
 	char* name = BNGetArchitectureRegisterName(m_object, reg);
diff --git a/basicblock.cpp b/basicblock.cpp
@@ -317,6 +317,12 @@ uint64_t BasicBlock::GetStart() const
 }
 
 
+void BasicBlock::SetEnd(uint64_t end)
+{
+	BNSetBasicBlockEnd(m_object, end);
+}
+
+
 uint64_t BasicBlock::GetEnd() const
 {
 	return BNGetBasicBlockEnd(m_object);
diff --git a/binaryninjaapi.h b/binaryninjaapi.h
@@ -5275,6 +5275,13 @@ namespace BinaryNinja {
 		*/
 		void AbortAnalysis();
 
+
+		/*! Check whether analysis is currently running
+
+		    \return true if analysis is aborted, false otherwise
+		*/
+		bool AnalysisIsAborted() const;
+
 		/*! Define a DataVariable at a given address with a set type
 
 		    \param addr virtual address to define the DataVariable at
@@ -8045,6 +8052,8 @@ namespace BinaryNinja {
 		static void FreeInstructionTextCallback(BNInstructionTextToken* tokens, size_t count);
 		static bool GetInstructionLowLevelILCallback(
 		    void* ctxt, const uint8_t* data, uint64_t addr, size_t* len, BNLowLevelILFunction* il);
+		static bool AnalyzeBasicBlocksCallback(void *ctxt, BNFunction* function, bool incrementalUpdate,
+			BNFunctionAnalysisSkipOverride analysisSkipOverride);
 		static char* GetRegisterNameCallback(void* ctxt, uint32_t reg);
 		static char* GetFlagNameCallback(void* ctxt, uint32_t flag);
 		static char* GetFlagWriteTypeNameCallback(void* ctxt, uint32_t flags);
@@ -8215,6 +8224,9 @@ namespace BinaryNinja {
 		*/
 		virtual bool GetInstructionLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il);
 
+		virtual bool AnalyzeBasicBlocks(Function& function, bool incrementalUpdate,
+			BNFunctionAnalysisSkipOverride analysisSkipOverride);
+
 		/*! Gets a register name from a register index.
 
 			\param reg Register index
@@ -8493,7 +8505,6 @@ namespace BinaryNinja {
 		    \return Whether the conversion was successful
 		*/
 		virtual bool SkipAndReturnValue(uint8_t* data, uint64_t addr, size_t len, uint64_t value);
-
 		void RegisterFunctionRecognizer(FunctionRecognizer* recog);
 		void RegisterRelocationHandler(const std::string& viewName, RelocationHandler* handler);
 		Ref<RelocationHandler> GetRelocationHandler(const std::string& viewName);
@@ -8609,6 +8620,8 @@ namespace BinaryNinja {
 		    const uint8_t* data, uint64_t addr, size_t& len, std::vector<InstructionTextToken>& result) override;
 		virtual bool GetInstructionLowLevelIL(
 		    const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il) override;
+		virtual bool AnalyzeBasicBlocks(Function& function, bool incrementalUpdate,
+			BNFunctionAnalysisSkipOverride analysisSkipOverride) override;
 		virtual std::string GetRegisterName(uint32_t reg) override;
 		virtual std::string GetFlagName(uint32_t flag) override;
 		virtual std::string GetFlagWriteTypeName(uint32_t flags) override;
@@ -10443,6 +10456,13 @@ namespace BinaryNinja {
 		*/
 		uint64_t GetStart() const;
 
+
+		/*! Set the end of a basic block
+
+			\param end Ending address of the basic block
+		*/
+		void SetEnd(uint64_t end);
+
 		/*! Ending address of the basic block
 
 			\return Ending address of the basic block
@@ -10870,6 +10890,24 @@ namespace BinaryNinja {
 		*/
 		std::vector<Ref<BasicBlock>> GetBasicBlocks() const;
 
+		/*! Create a new basic block for this function
+
+			\param arch Architecture for the basic block
+			\param addr Address of the basic block
+			\return The new BasicBlock
+		*/
+		Ref<BasicBlock> CreateBasicBlock(Architecture* arch, uint64_t addr);
+
+		/*! Add a basic block to the function analysis basic block list
+
+			\param block The BasicBlock to add
+		*/
+		void AddBasicBlock(Ref<BasicBlock> block);
+
+		/*! Finalize basic block list for this function
+		*/
+		void FinalizeBasicBlocks();
+
 		/*! Get the basic block an address is located in
 
 			\param arch Architecture for the basic block
diff --git a/binaryninjacore.h b/binaryninjacore.h
@@ -1842,6 +1842,13 @@ extern "C"
 		uint8_t confidence;
 	} BNTypeWithConfidence;
 
+	typedef enum BNFunctionAnalysisSkipOverride
+	{
+		DefaultFunctionAnalysisSkip,
+		NeverSkipFunctionAnalysis,
+		AlwaysSkipFunctionAnalysis
+	} BNFunctionAnalysisSkipOverride;
+
 	typedef struct BNCustomArchitecture
 	{
 		void* context;
@@ -1860,6 +1867,8 @@ extern "C"
 		void (*freeInstructionText)(BNInstructionTextToken* tokens, size_t count);
 		bool (*getInstructionLowLevelIL)(
 		    void* ctxt, const uint8_t* data, uint64_t addr, size_t* len, BNLowLevelILFunction* il);
+		bool (*analyzeBasicBlocks)(void* ctxt, BNFunction* function, 
+			bool incrementalUpdate, BNFunctionAnalysisSkipOverride analysisSkipOverride);
 		char* (*getRegisterName)(void* ctxt, uint32_t reg);
 		char* (*getFlagName)(void* ctxt, uint32_t flag);
 		char* (*getFlagWriteTypeName)(void* ctxt, uint32_t flags);
@@ -3128,13 +3137,6 @@ extern "C"
 		uint8_t confidence;
 	} BNRegisterStackAdjustment;
 
-	typedef enum BNFunctionAnalysisSkipOverride
-	{
-		DefaultFunctionAnalysisSkip,
-		NeverSkipFunctionAnalysis,
-		AlwaysSkipFunctionAnalysis
-	} BNFunctionAnalysisSkipOverride;
-
 	typedef enum BNReportType
 	{
 		PlainTextReportType,
@@ -4460,6 +4462,8 @@ extern "C"
 	BINARYNINJACOREAPI bool BNGetInstructionLowLevelIL(
 	    BNArchitecture* arch, const uint8_t* data, uint64_t addr, size_t* len, BNLowLevelILFunction* il);
 	BINARYNINJACOREAPI void BNFreeInstructionText(BNInstructionTextToken* tokens, size_t count);
+	BINARYNINJACOREAPI bool BNArchitectureAnalyzeBasicBlocks(BNArchitecture* arch, BNFunction* function, 
+		bool incrementalUpdate, BNFunctionAnalysisSkipOverride analysisSkipOverride);
 	BINARYNINJACOREAPI void BNFreeInstructionTextLines(BNInstructionTextLine* lines, size_t count);
 	BINARYNINJACOREAPI char* BNGetArchitectureRegisterName(BNArchitecture* arch, uint32_t reg);
 	BINARYNINJACOREAPI char* BNGetArchitectureFlagName(BNArchitecture* arch, uint32_t flag);
@@ -4575,6 +4579,7 @@ extern "C"
 	BINARYNINJACOREAPI void BNUpdateAnalysisAndWait(BNBinaryView* view);
 	BINARYNINJACOREAPI void BNUpdateAnalysis(BNBinaryView* view);
 	BINARYNINJACOREAPI void BNAbortAnalysis(BNBinaryView* view);
+	BINARYNINJACOREAPI bool BNAnalysisIsAborted(BNBinaryView* view);
 	BINARYNINJACOREAPI bool BNIsFunctionUpdateNeeded(BNFunction* func);
 	BINARYNINJACOREAPI void BNRequestAdvancedFunctionAnalysisData(BNFunction* func);
 	BINARYNINJACOREAPI void BNReleaseAdvancedFunctionAnalysisData(BNFunction* func);
@@ -4638,6 +4643,9 @@ extern "C"
 	BINARYNINJACOREAPI void BNFreeBasicBlock(BNBasicBlock* block);
 	BINARYNINJACOREAPI BNBasicBlock** BNGetFunctionBasicBlockList(BNFunction* func, size_t* count);
 	BINARYNINJACOREAPI void BNFreeBasicBlockList(BNBasicBlock** blocks, size_t count);
+	BINARYNINJACOREAPI BNBasicBlock* BNCreateFunctionBasicBlock(BNFunction* func, BNArchitecture* arch, uint64_t addr);
+	BINARYNINJACOREAPI void BNAddFunctionBasicBlock(BNFunction* func, BNBasicBlock* block);
+	BINARYNINJACOREAPI void BNFinalizeFunctionBasicBlocks(BNFunction* func);
 	BINARYNINJACOREAPI BNBasicBlock* BNGetFunctionBasicBlockAtAddress(
 	    BNFunction* func, BNArchitecture* arch, uint64_t addr);
 	BINARYNINJACOREAPI BNBasicBlock* BNGetRecentBasicBlockForAddress(BNBinaryView* view, uint64_t addr);
@@ -4775,6 +4783,7 @@ extern "C"
 	BINARYNINJACOREAPI BNArchitecture* BNGetBasicBlockArchitecture(BNBasicBlock* block);
 	BINARYNINJACOREAPI BNBasicBlock* BNGetBasicBlockSource(BNBasicBlock* block);
 	BINARYNINJACOREAPI uint64_t BNGetBasicBlockStart(BNBasicBlock* block);
+	BINARYNINJACOREAPI void BNSetBasicBlockEnd(BNBasicBlock* block, uint64_t end);
 	BINARYNINJACOREAPI uint64_t BNGetBasicBlockEnd(BNBasicBlock* block);
 	BINARYNINJACOREAPI uint64_t BNGetBasicBlockLength(BNBasicBlock* block);
 	BINARYNINJACOREAPI BNBasicBlockEdge* BNGetBasicBlockOutgoingEdges(BNBasicBlock* block, size_t* count);
diff --git a/binaryview.cpp b/binaryview.cpp
@@ -2174,6 +2174,12 @@ void BinaryView::AbortAnalysis()
 }
 
 
+bool BinaryView::AnalysisIsAborted() const
+{
+	return BNAnalysisIsAborted(m_object);
+}
+
+
 void BinaryView::DefineDataVariable(uint64_t addr, const Confidence<Ref<Type>>& type)
 {
 	BNTypeWithConfidence tc;
diff --git a/function.cpp b/function.cpp
@@ -319,6 +319,27 @@ vector<Ref<BasicBlock>> Function::GetBasicBlocks() const
 }
 
 
+Ref<BasicBlock> Function::CreateBasicBlock(Architecture* arch, uint64_t addr)
+{
+	BNBasicBlock* block = BNCreateFunctionBasicBlock(m_object, arch->GetObject(), addr);
+	if (!block)
+		return nullptr;
+	return new BasicBlock(block);
+}
+
+
+void Function::AddBasicBlock(Ref<BasicBlock> block)
+{
+	BNAddFunctionBasicBlock(m_object, block->GetObject());
+}
+
+
+void Function::FinalizeBasicBlocks()
+{
+	BNFinalizeFunctionBasicBlocks(m_object);
+}
+
+
 Ref<BasicBlock> Function::GetBasicBlockAtAddress(Architecture* arch, uint64_t addr) const
 {
 	BNBasicBlock* block = BNGetFunctionBasicBlockAtAddress(m_object, arch->GetObject(), addr);
diff --git a/rust/src/architecture.rs b/rust/src/architecture.rs
@@ -31,6 +31,7 @@ use crate::{
     string::*,
     types::{NameAndType, Type},
     Endianness,
+    function::Function,
 };
 use std::ops::Deref;
 use std::{
@@ -463,6 +464,15 @@ pub trait Architecture: 'static + Sized + AsRef<CoreArchitecture> {
         il: &mut MutableLiftedILFunction<Self>,
     ) -> Option<(usize, bool)>;
 
+    fn analyze_basic_blocks(
+        &self,
+        _function: &mut Function,
+        _incremental_update: bool,
+        _analysis_skip_override: BNFunctionAnalysisSkipOverride,
+    ) -> bool {
+        false
+    }
+
     /// Fallback flag value calculation path. This method is invoked when the core is unable to
     /// recover flag use semantics, and resorts to emitting instructions that explicitly set each
     /// observed flag to the value of an expression returned by this function.
@@ -1525,6 +1535,24 @@ impl Architecture for CoreArchitecture {
         }
     }
 
+    fn analyze_basic_blocks(
+        &self,
+        function: &mut Function,
+        incremental_update: bool,
+        analysis_skip_override: BNFunctionAnalysisSkipOverride,
+    ) -> bool {
+        let success: bool = unsafe {
+            BNArchitectureAnalyzeBasicBlocks(
+                self.handle,
+                function.handle,
+                incremental_update,
+                analysis_skip_override,
+            )
+        };
+
+        return success;
+    }
+
     fn flag_write_llil<'a>(
         &self,
         _flag: Self::Flag,
@@ -2234,6 +2262,20 @@ where
         }
     }
 
+    extern "C" fn cb_analyze_basic_blocks<A>(
+        ctxt: *mut c_void,
+        function: *mut BNFunction,
+        incremental_update: bool,
+        analysis_skip_override: BNFunctionAnalysisSkipOverride,
+    ) -> bool
+    where
+        A: 'static + Architecture<Handle = CustomArchitectureHandle<A>> + Send + Sync,
+    {
+        let custom_arch = unsafe { &*(ctxt as *mut A) };
+        let mut function = unsafe { Function::from_raw(function) };
+        return custom_arch.analyze_basic_blocks(&mut function, incremental_update, analysis_skip_override);
+    }
+
     extern "C" fn cb_reg_name<A>(ctxt: *mut c_void, reg: u32) -> *mut c_char
     where
         A: 'static + Architecture<Handle = CustomArchitectureHandle<A>> + Send + Sync,
@@ -3158,6 +3200,7 @@ where
         getInstructionText: Some(cb_get_instruction_text::<A>),
         freeInstructionText: Some(cb_free_instruction_text),
         getInstructionLowLevelIL: Some(cb_instruction_llil::<A>),
+        analyzeBasicBlocks: Some(cb_analyze_basic_blocks::<A>),
 
         getRegisterName: Some(cb_reg_name::<A>),
         getFlagName: Some(cb_flag_name::<A>),

Original file line number	Diff line number	Diff line change
`@@ -317,6 +317,12 @@ uint64_t BasicBlock::GetStart() const`
`317`	`317`	`}`
`318`	`318`
`319`	`319`
	`320`	`+void BasicBlock::SetEnd(uint64_t end)`
	`321`	`+{`
	`322`	`+ BNSetBasicBlockEnd(m_object, end);`
	`323`	`+}`
	`324`	`+`
	`325`	`+`
`320`	`326`	`uint64_t BasicBlock::GetEnd() const`
`321`	`327`	`{`
`322`	`328`	`return BNGetBasicBlockEnd(m_object);`
Original file line number	Diff line number	Diff line change
`@@ -2174,6 +2174,12 @@ void BinaryView::AbortAnalysis()`
`2174`	`2174`	`}`
`2175`	`2175`
`2176`	`2176`
	`2177`	`+bool BinaryView::AnalysisIsAborted() const`
	`2178`	`+{`
	`2179`	`+ return BNAnalysisIsAborted(m_object);`
	`2180`	`+}`
	`2181`	`+`
	`2182`	`+`
`2177`	`2183`	`void BinaryView::DefineDataVariable(uint64_t addr, const Confidence<Ref<Type>>& type)`
`2178`	`2184`	`{`
`2179`	`2185`	`BNTypeWithConfidence tc;`