Skip to content

Commit 08995e6

Browse files
committed
ASTI: add support for trampoline compound condition
1 parent 573a97d commit 08995e6

File tree

2 files changed

+43
-2
lines changed

2 files changed

+43
-2
lines changed

chb/app/CHVersion.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
chbversion: str = "0.3.0-20250417"
1+
chbversion: str = "0.3.0-20250420"

chb/astinterface/ASTInterfaceBasicBlock.py

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,47 @@ def trampoline_payload_sideeffect_ast(
361361
return astree.mk_branch(cond, tr_stmt, estmt, "0x0")
362362
return tr_stmt
363363

364+
def trampoline_payload_compound_ast(
365+
self, astree: "ASTInterface") -> AST.ASTStmt:
366+
"""
367+
compound condition: fallthrough / exit function (return):
368+
B <condition 1>
369+
B <condition 2>
370+
B <return 0> (fallthrough)
371+
B set function return value
372+
<return 1>
373+
===> if (condition1 || condition2):
374+
return (new return value)
375+
fallthrough
376+
377+
Note: recognition of return value not yet implemented.
378+
"""
379+
380+
bl3 = self.trampoline["payload-2"]
381+
bl3instrs = sorted(bl3.instructions.items())
382+
if not len(bl3instrs) == 2:
383+
return self.trampoline_payload_loop_ast(astree)
384+
instr31 = bl3instrs[0][1]
385+
if not instr31.mnemonic_stem == "MOV":
386+
return self.trampoline_payload_loop_ast(astree)
387+
instr32 = bl3instrs[1][1]
388+
if not instr32.mnemonic_stem == "BX":
389+
return self.trampoline_payload_loop_ast(astree)
390+
391+
cond1 = self.trampoline_ast_condition("payload-0", astree)
392+
cond2 = self.trampoline_ast_condition("payload-1", astree)
393+
if cond1 is not None and cond2 is not None:
394+
cond = astree.mk_binary_op("lor", cond1, cond2)
395+
rstmt = astree.mk_return_stmt(None)
396+
estmt = astree.mk_instr_sequence([])
397+
brstmt = astree.mk_branch(cond, rstmt, estmt, "0x0")
398+
return brstmt
399+
else:
400+
chklogger.logger.error(
401+
"Not all conditions resolved in compound trampoline condition: "
402+
"cond1: %s; cond2: %s", str(cond1), str(cond2))
403+
return self.trampoline_payload_loop_ast(astree)
404+
364405
def trampoline_payload_loop_ast(
365406
self, astree: "ASTInterface") -> AST.ASTStmt:
366407
"""Assumes a return via conditional POP."""
@@ -404,7 +445,7 @@ def trampoline_ast(self, astree: "ASTInterface") -> AST.ASTStmt:
404445
stmts.append(self.trampoline_setup_ast(astree))
405446
if "payload-0" in self.trampoline or "payload" in self.trampoline:
406447
if len(self.trampoline_payload_roles) == 4:
407-
stmts.append(self.trampoline_payload_loop_ast(astree))
448+
stmts.append(self.trampoline_payload_compound_ast(astree))
408449
elif len(self.trampoline_payload_roles) == 3:
409450
stmts.append(self.trampoline_payload_sideeffect_ast(astree))
410451
elif len(self.trampoline_payload_roles) == 1:

0 commit comments

Comments
 (0)