@@ -361,6 +361,47 @@ def trampoline_payload_sideeffect_ast(
361361 return astree .mk_branch (cond , tr_stmt , estmt , "0x0" )
362362 return tr_stmt
363363
364+ def trampoline_payload_compound_ast (
365+ self , astree : "ASTInterface" ) -> AST .ASTStmt :
366+ """
367+ compound condition: fallthrough / exit function (return):
368+ B <condition 1>
369+ B <condition 2>
370+ B <return 0> (fallthrough)
371+ B set function return value
372+ <return 1>
373+ ===> if (condition1 || condition2):
374+ return (new return value)
375+ fallthrough
376+
377+ Note: recognition of return value not yet implemented.
378+ """
379+
380+ bl3 = self .trampoline ["payload-2" ]
381+ bl3instrs = sorted (bl3 .instructions .items ())
382+ if not len (bl3instrs ) == 2 :
383+ return self .trampoline_payload_loop_ast (astree )
384+ instr31 = bl3instrs [0 ][1 ]
385+ if not instr31 .mnemonic_stem == "MOV" :
386+ return self .trampoline_payload_loop_ast (astree )
387+ instr32 = bl3instrs [1 ][1 ]
388+ if not instr32 .mnemonic_stem == "BX" :
389+ return self .trampoline_payload_loop_ast (astree )
390+
391+ cond1 = self .trampoline_ast_condition ("payload-0" , astree )
392+ cond2 = self .trampoline_ast_condition ("payload-1" , astree )
393+ if cond1 is not None and cond2 is not None :
394+ cond = astree .mk_binary_op ("lor" , cond1 , cond2 )
395+ rstmt = astree .mk_return_stmt (None )
396+ estmt = astree .mk_instr_sequence ([])
397+ brstmt = astree .mk_branch (cond , rstmt , estmt , "0x0" )
398+ return brstmt
399+ else :
400+ chklogger .logger .error (
401+ "Not all conditions resolved in compound trampoline condition: "
402+ "cond1: %s; cond2: %s" , str (cond1 ), str (cond2 ))
403+ return self .trampoline_payload_loop_ast (astree )
404+
364405 def trampoline_payload_loop_ast (
365406 self , astree : "ASTInterface" ) -> AST .ASTStmt :
366407 """Assumes a return via conditional POP."""
@@ -404,7 +445,7 @@ def trampoline_ast(self, astree: "ASTInterface") -> AST.ASTStmt:
404445 stmts .append (self .trampoline_setup_ast (astree ))
405446 if "payload-0" in self .trampoline or "payload" in self .trampoline :
406447 if len (self .trampoline_payload_roles ) == 4 :
407- stmts .append (self .trampoline_payload_loop_ast (astree ))
448+ stmts .append (self .trampoline_payload_compound_ast (astree ))
408449 elif len (self .trampoline_payload_roles ) == 3 :
409450 stmts .append (self .trampoline_payload_sideeffect_ast (astree ))
410451 elif len (self .trampoline_payload_roles ) == 1 :
0 commit comments