├── COPYING
├── README
├── izsharmctsa.py
├── izsharmstackanalysis.py
├── izshbasicblock.py
└── izshcalltree.py
/COPYING:
--------------------------------------------------------------------------------
1 | GNU GENERAL PUBLIC LICENSE
2 | Version 3, 29 June 2007
3 |
4 | Copyright (C) 2007 Free Software Foundation, Inc.
5 | Everyone is permitted to copy and distribute verbatim copies
6 | of this license document, but changing it is not allowed.
7 |
8 | Preamble
9 |
10 | The GNU General Public License is a free, copyleft license for
11 | software and other kinds of works.
12 |
13 | The licenses for most software and other practical works are designed
14 | to take away your freedom to share and change the works. By contrast,
15 | the GNU General Public License is intended to guarantee your freedom to
16 | share and change all versions of a program--to make sure it remains free
17 | software for all its users. We, the Free Software Foundation, use the
18 | GNU General Public License for most of our software; it applies also to
19 | any other work released this way by its authors. You can apply it to
20 | your programs, too.
21 |
22 | When we speak of free software, we are referring to freedom, not
23 | price. Our General Public Licenses are designed to make sure that you
24 | have the freedom to distribute copies of free software (and charge for
25 | them if you wish), that you receive source code or can get it if you
26 | want it, that you can change the software or use pieces of it in new
27 | free programs, and that you know you can do these things.
28 |
29 | To protect your rights, we need to prevent others from denying you
30 | these rights or asking you to surrender the rights. Therefore, you have
31 | certain responsibilities if you distribute copies of the software, or if
32 | you modify it: responsibilities to respect the freedom of others.
33 |
34 | For example, if you distribute copies of such a program, whether
35 | gratis or for a fee, you must pass on to the recipients the same
36 | freedoms that you received. You must make sure that they, too, receive
37 | or can get the source code. And you must show them these terms so they
38 | know their rights.
39 |
40 | Developers that use the GNU GPL protect your rights with two steps:
41 | (1) assert copyright on the software, and (2) offer you this License
42 | giving you legal permission to copy, distribute and/or modify it.
43 |
44 | For the developers' and authors' protection, the GPL clearly explains
45 | that there is no warranty for this free software. For both users' and
46 | authors' sake, the GPL requires that modified versions be marked as
47 | changed, so that their problems will not be attributed erroneously to
48 | authors of previous versions.
49 |
50 | Some devices are designed to deny users access to install or run
51 | modified versions of the software inside them, although the manufacturer
52 | can do so. This is fundamentally incompatible with the aim of
53 | protecting users' freedom to change the software. The systematic
54 | pattern of such abuse occurs in the area of products for individuals to
55 | use, which is precisely where it is most unacceptable. Therefore, we
56 | have designed this version of the GPL to prohibit the practice for those
57 | products. If such problems arise substantially in other domains, we
58 | stand ready to extend this provision to those domains in future versions
59 | of the GPL, as needed to protect the freedom of users.
60 |
61 | Finally, every program is threatened constantly by software patents.
62 | States should not allow patents to restrict development and use of
63 | software on general-purpose computers, but in those that do, we wish to
64 | avoid the special danger that patents applied to a free program could
65 | make it effectively proprietary. To prevent this, the GPL assures that
66 | patents cannot be used to render the program non-free.
67 |
68 | The precise terms and conditions for copying, distribution and
69 | modification follow.
70 |
71 | TERMS AND CONDITIONS
72 |
73 | 0. Definitions.
74 |
75 | "This License" refers to version 3 of the GNU General Public License.
76 |
77 | "Copyright" also means copyright-like laws that apply to other kinds of
78 | works, such as semiconductor masks.
79 |
80 | "The Program" refers to any copyrightable work licensed under this
81 | License. Each licensee is addressed as "you". "Licensees" and
82 | "recipients" may be individuals or organizations.
83 |
84 | To "modify" a work means to copy from or adapt all or part of the work
85 | in a fashion requiring copyright permission, other than the making of an
86 | exact copy. The resulting work is called a "modified version" of the
87 | earlier work or a work "based on" the earlier work.
88 |
89 | A "covered work" means either the unmodified Program or a work based
90 | on the Program.
91 |
92 | To "propagate" a work means to do anything with it that, without
93 | permission, would make you directly or secondarily liable for
94 | infringement under applicable copyright law, except executing it on a
95 | computer or modifying a private copy. Propagation includes copying,
96 | distribution (with or without modification), making available to the
97 | public, and in some countries other activities as well.
98 |
99 | To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies. Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 |
103 | An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License. If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 |
112 | 1. Source Code.
113 |
114 | The "source code" for a work means the preferred form of the work
115 | for making modifications to it. "Object code" means any non-source
116 | form of a work.
117 |
118 | A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 |
123 | The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form. A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 |
134 | The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities. However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work. For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 |
147 | The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 |
151 | The Corresponding Source for a work in source code form is that
152 | same work.
153 |
154 | 2. Basic Permissions.
155 |
156 | All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met. This License explicitly affirms your unlimited
159 | permission to run the unmodified Program. The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work. This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 |
164 | You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force. You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright. Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 |
175 | Conveying under any other circumstances is permitted solely under
176 | the conditions stated below. Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 |
179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 |
181 | No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 |
187 | When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 |
195 | 4. Conveying Verbatim Copies.
196 |
197 | You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 |
205 | You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 |
208 | 5. Conveying Modified Source Versions.
209 |
210 | You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 |
214 | a) The work must carry prominent notices stating that you modified
215 | it, and giving a relevant date.
216 |
217 | b) The work must carry prominent notices stating that it is
218 | released under this License and any conditions added under section
219 | 7. This requirement modifies the requirement in section 4 to
220 | "keep intact all notices".
221 |
222 | c) You must license the entire work, as a whole, under this
223 | License to anyone who comes into possession of a copy. This
224 | License will therefore apply, along with any applicable section 7
225 | additional terms, to the whole of the work, and all its parts,
226 | regardless of how they are packaged. This License gives no
227 | permission to license the work in any other way, but it does not
228 | invalidate such permission if you have separately received it.
229 |
230 | d) If the work has interactive user interfaces, each must display
231 | Appropriate Legal Notices; however, if the Program has interactive
232 | interfaces that do not display Appropriate Legal Notices, your
233 | work need not make them do so.
234 |
235 | A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit. Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 |
245 | 6. Conveying Non-Source Forms.
246 |
247 | You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 |
252 | a) Convey the object code in, or embodied in, a physical product
253 | (including a physical distribution medium), accompanied by the
254 | Corresponding Source fixed on a durable physical medium
255 | customarily used for software interchange.
256 |
257 | b) Convey the object code in, or embodied in, a physical product
258 | (including a physical distribution medium), accompanied by a
259 | written offer, valid for at least three years and valid for as
260 | long as you offer spare parts or customer support for that product
261 | model, to give anyone who possesses the object code either (1) a
262 | copy of the Corresponding Source for all the software in the
263 | product that is covered by this License, on a durable physical
264 | medium customarily used for software interchange, for a price no
265 | more than your reasonable cost of physically performing this
266 | conveying of source, or (2) access to copy the
267 | Corresponding Source from a network server at no charge.
268 |
269 | c) Convey individual copies of the object code with a copy of the
270 | written offer to provide the Corresponding Source. This
271 | alternative is allowed only occasionally and noncommercially, and
272 | only if you received the object code with such an offer, in accord
273 | with subsection 6b.
274 |
275 | d) Convey the object code by offering access from a designated
276 | place (gratis or for a charge), and offer equivalent access to the
277 | Corresponding Source in the same way through the same place at no
278 | further charge. You need not require recipients to copy the
279 | Corresponding Source along with the object code. If the place to
280 | copy the object code is a network server, the Corresponding Source
281 | may be on a different server (operated by you or a third party)
282 | that supports equivalent copying facilities, provided you maintain
283 | clear directions next to the object code saying where to find the
284 | Corresponding Source. Regardless of what server hosts the
285 | Corresponding Source, you remain obligated to ensure that it is
286 | available for as long as needed to satisfy these requirements.
287 |
288 | e) Convey the object code using peer-to-peer transmission, provided
289 | you inform other peers where the object code and Corresponding
290 | Source of the work are being offered to the general public at no
291 | charge under subsection 6d.
292 |
293 | A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 |
297 | A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling. In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage. For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product. A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 |
310 | "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source. The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 |
318 | If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information. But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 |
329 | The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed. Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 |
337 | Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 |
343 | 7. Additional Terms.
344 |
345 | "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law. If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 |
354 | When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it. (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.) You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 |
361 | Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 |
365 | a) Disclaiming warranty or limiting liability differently from the
366 | terms of sections 15 and 16 of this License; or
367 |
368 | b) Requiring preservation of specified reasonable legal notices or
369 | author attributions in that material or in the Appropriate Legal
370 | Notices displayed by works containing it; or
371 |
372 | c) Prohibiting misrepresentation of the origin of that material, or
373 | requiring that modified versions of such material be marked in
374 | reasonable ways as different from the original version; or
375 |
376 | d) Limiting the use for publicity purposes of names of licensors or
377 | authors of the material; or
378 |
379 | e) Declining to grant rights under trademark law for use of some
380 | trade names, trademarks, or service marks; or
381 |
382 | f) Requiring indemnification of licensors and authors of that
383 | material by anyone who conveys the material (or modified versions of
384 | it) with contractual assumptions of liability to the recipient, for
385 | any liability that these contractual assumptions directly impose on
386 | those licensors and authors.
387 |
388 | All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10. If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term. If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 |
398 | If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 |
403 | Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 |
407 | 8. Termination.
408 |
409 | You may not propagate or modify a covered work except as expressly
410 | provided under this License. Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 |
415 | However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 |
422 | Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 |
429 | Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License. If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 |
435 | 9. Acceptance Not Required for Having Copies.
436 |
437 | You are not required to accept this License in order to receive or
438 | run a copy of the Program. Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance. However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work. These actions infringe copyright if you do
443 | not accept this License. Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 |
446 | 10. Automatic Licensing of Downstream Recipients.
447 |
448 | Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License. You are not responsible
451 | for enforcing compliance by third parties with this License.
452 |
453 | An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations. If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 |
463 | You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License. For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 |
471 | 11. Patents.
472 |
473 | A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based. The
475 | work thus licensed is called the contributor's "contributor version".
476 |
477 | A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version. For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 |
487 | Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 |
492 | In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement). To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 |
499 | If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients. "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 |
513 | If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 |
521 | A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License. You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 |
536 | Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 |
540 | 12. No Surrender of Others' Freedom.
541 |
542 | If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License. If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all. For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 |
552 | 13. Use with the GNU Affero General Public License.
553 |
554 | Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work. The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 |
563 | 14. Revised Versions of this License.
564 |
565 | The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time. Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 |
570 | Each version is given a distinguishing version number. If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation. If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 |
579 | If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 |
584 | Later license versions may give you additional or different
585 | permissions. However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 |
589 | 15. Disclaimer of Warranty.
590 |
591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 |
600 | 16. Limitation of Liability.
601 |
602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 |
612 | 17. Interpretation of Sections 15 and 16.
613 |
614 | If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 |
621 | END OF TERMS AND CONDITIONS
622 |
623 | How to Apply These Terms to Your New Programs
624 |
625 | If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 |
629 | To do so, attach the following notices to the program. It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 |
634 |
635 | Copyright (C)
636 |
637 | This program is free software: you can redistribute it and/or modify
638 | it under the terms of the GNU General Public License as published by
639 | the Free Software Foundation, either version 3 of the License, or
640 | (at your option) any later version.
641 |
642 | This program is distributed in the hope that it will be useful,
643 | but WITHOUT ANY WARRANTY; without even the implied warranty of
644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
645 | GNU General Public License for more details.
646 |
647 | You should have received a copy of the GNU General Public License
648 | along with this program. If not, see .
649 |
650 | Also add information on how to contact you by electronic and paper mail.
651 |
652 | If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 |
655 | Copyright (C)
656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 | This is free software, and you are welcome to redistribute it
658 | under certain conditions; type `show c' for details.
659 |
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License. Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 |
664 | You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | .
668 |
669 | The GNU General Public License does not permit incorporating your program
670 | into proprietary programs. If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library. If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License. But first, please read
674 | .
675 |
--------------------------------------------------------------------------------
/README:
--------------------------------------------------------------------------------
1 | IDA Python Scripts
2 | Copyright (c) 2009 iZsh - izsh at iphone-dev.com
3 |
4 | =====================
5 | License Information
6 | =====================
7 | This program is free software: you can redistribute it and/or modify
8 | it under the terms of the GNU General Public License as published by
9 | the Free Software Foundation, either version 3 of the License, or
10 | (at your option) any later version.
11 |
12 | This program is distributed in the hope that it will be useful,
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 | GNU General Public License for more details.
16 |
17 | You should have received a copy of the GNU General Public License
18 | along with this program. If not, see .
19 |
20 | =========
21 | Scripts
22 | =========
23 |
24 | * izsharmctsa.py: Call Tree and Stack Analyzer script.
25 |
26 | =========
27 | Modules
28 | =========
29 |
30 | * izshcalltree.py: call tree building (xref analysis)
31 | * izshbasicblock.py: basic block flow building
32 | * izsharmstackanalysis.py: stack analysis for ARM Processors
33 |
--------------------------------------------------------------------------------
/izsharmctsa.py:
--------------------------------------------------------------------------------
1 | # Call Tree and Stack Analyzer IDA Python Script for ARM Processors
2 | # Copyright (c) 2009 iZsh - izsh at iphone-dev.com
3 | #
4 | # This program is free software: you can redistribute it and/or modify
5 | # it under the terms of the GNU General Public License as published by
6 | # the Free Software Foundation, either version 3 of the License, or
7 | # (at your option) any later version.
8 | #
9 | # This program is distributed in the hope that it will be useful,
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 | # GNU General Public License for more details.
13 | #
14 | # You should have received a copy of the GNU General Public License
15 | # along with this program. If not, see .
16 | #
17 | # =============
18 | # Description
19 | # =============
20 | #
21 | # Starting from a given function, it builds all the possible paths reaching
22 | # it, and for each of these paths, it analyzes the stack content.
23 | #
24 | # =======
25 | # Usage
26 | # =======
27 | # Place the cursor _at the beginning_ of the function you want to start the
28 | # analysis from, and execute this script (with Alt+9 by default).
29 | #
30 | # You have to make sure all the functions which would need to be analyzed have
31 | # to be actual IDA function (including the entry point function which
32 | # usually set the initial stack pointer value).
33 | #
34 | # You can also edit this script and change the main call from
35 | # AnalyzeCallTreeStack(ea)
36 | # to
37 | # AnalyzeCallTreeStack(ea, AskAddr = True)
38 | #
39 | # if you'd like the script to explicitly ask you for the initial stack pointer
40 | # value.
41 | #
42 | # ==================
43 | # General Comments
44 | # ==================
45 | #
46 | # This is a script written for IDA Python to analyze a call tree as well as
47 | # trying to extract the stack state of each function with a pure static
48 | # analysis. This works only with ARM processors and although it has severe
49 | # limitations it seems to work quite ok on both the 3G and 3GS iPhone bootrom :)
50 | # This is mainly useful assisting exploit writing of buffer overflows.
51 | #
52 | # This is my first Python _and_ IDA Python code, thus, if you feel I missed
53 | # some nice Python features which would make the code more elegant or who knows
54 | # what, feel free to drop me an email. Feel also free to drop me an email for
55 | # any suggestions or insights to improve my ninja-skillz ;)
56 | #
57 | # The call tree and basic block module should be generic enough to be usable
58 | # in other projects/scripts (or epic fail, which wouldn't be that much
59 | # surprising either :P ). The ARM stack analysis module is quite specific
60 | # considering it's doing very sparse island parsing...
61 | #
62 |
63 | from idc import *
64 | from izsharmstackanalysis import *
65 |
66 | ####################################################
67 | #
68 | # Main
69 | #
70 | ####################################################
71 |
72 | ea = ScreenEA()
73 | print "Call Tree and Stack Analyzer IDA Python Script for ARM Processors"
74 | print "Copyright (c) 2009 iZsh - izsh at iphone-dev.com"
75 | print "=" * 80
76 | print "Analyze starts from 0x%x\n" % ea
77 | print "=" * 80
78 | AnalyzeCallTreeStack(ea)
79 |
--------------------------------------------------------------------------------
/izsharmstackanalysis.py:
--------------------------------------------------------------------------------
1 | # Stack Analysis IDA Python Module for ARM Processors
2 | # Copyright (c) 2009 iZsh - izsh at iphone-dev.com
3 | #
4 | # This program is free software: you can redistribute it and/or modify
5 | # it under the terms of the GNU General Public License as published by
6 | # the Free Software Foundation, either version 3 of the License, or
7 | # (at your option) any later version.
8 | #
9 | # This program is distributed in the hope that it will be useful,
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 | # GNU General Public License for more details.
13 | #
14 | # You should have received a copy of the GNU General Public License
15 | # along with this program. If not, see .
16 | #
17 |
18 | from idaapi import *
19 | from idc import *
20 | from idautils import *
21 |
22 | from izshcalltree import *
23 | from izshbasicblock import *
24 |
25 | ####################################################
26 | #
27 | # ARM Stack Analysis
28 | #
29 | ####################################################
30 | # A few const and dicts...
31 | ARM_REG_R0 = 0
32 | ARM_REG_R1 = 1
33 | ARM_REG_R2 = 2
34 | ARM_REG_R3 = 3
35 | ARM_REG_R4 = 4
36 | ARM_REG_R5 = 5
37 | ARM_REG_R6 = 6
38 | ARM_REG_R7 = 7
39 | ARM_REG_R8 = 8
40 | ARM_REG_R9 = 9
41 | ARM_REG_R10 = 10
42 | ARM_REG_R11 = 11
43 | ARM_REG_R12 = 12
44 | ARM_REG_SP = 13
45 | ARM_REG_LR = 14
46 | ARM_REG_PC = 15
47 |
48 | Reg2StrDict = dict([
49 | [ARM_REG_R0, "R0"],
50 | [ARM_REG_R1, "R1"],
51 | [ARM_REG_R2, "R2"],
52 | [ARM_REG_R3, "R3"],
53 | [ARM_REG_R4, "R4"],
54 | [ARM_REG_R5, "R5"],
55 | [ARM_REG_R6, "R6"],
56 | [ARM_REG_R7, "R7"],
57 | [ARM_REG_R8, "R8"],
58 | [ARM_REG_R9, "R9"],
59 | [ARM_REG_R10, "R10"],
60 | [ARM_REG_R11, "R11"],
61 | [ARM_REG_R12, "R12"],
62 | [ARM_REG_SP, "SP"],
63 | [ARM_REG_LR, "LR"],
64 | [ARM_REG_PC, "PC"]])
65 |
66 | Str2RegDict = dict([
67 | ["R0", ARM_REG_R0],
68 | ["R1", ARM_REG_R1],
69 | ["R2", ARM_REG_R2],
70 | ["R3", ARM_REG_R3],
71 | ["R4", ARM_REG_R4],
72 | ["R5", ARM_REG_R5],
73 | ["R6", ARM_REG_R6],
74 | ["R7", ARM_REG_R7],
75 | ["R8", ARM_REG_R8],
76 | ["R9", ARM_REG_R9],
77 | ["R10", ARM_REG_R10],
78 | ["R11", ARM_REG_R11],
79 | ["R12", ARM_REG_R12],
80 | ["SP", ARM_REG_SP],
81 | ["LR", ARM_REG_LR],
82 | ["PC", ARM_REG_PC]])
83 |
84 | # ===========================================================================
85 | # Function: Bitfield2Reglist()
86 | # ===========================================================================
87 | # Description/Comment:
88 | # Convert a register list represented as a bitfield to a normal list of
89 | # register const
90 | #
91 | # Return: the list of the registers
92 | # For example: Bitfield2Reglist(0xD) returns [ 1, 2, 3 ]
93 | # ===========================================================================
94 | def Bitfield2Reglist(Value):
95 | reg_list = []
96 | for reg in Reg2StrDict.keys():
97 | if Value & (1 << reg):
98 | reg_list.append(reg)
99 | return reg_list
100 |
101 | # ===========================================================================
102 | # Function: Reg2Str()
103 | # ===========================================================================
104 | # Description/Comment:
105 | # Convert a register const value to its string representation
106 | # ===========================================================================
107 | def Reg2Str(Value):
108 | if Value in Reg2StrDict:
109 | return Reg2StrDict[Value]
110 | return None
111 |
112 | # ===========================================================================
113 | # Function: Reglist2Str()
114 | # ===========================================================================
115 | # Description/Comment:
116 | # Convert a register list to its string representation
117 | # ===========================================================================
118 | def Reglist2Str(Reglist):
119 | return "{" + ", ".join(map(Reg2Str, Reglist)) + "}"
120 |
121 | # In the following functions, the Stack argument is used to keep track
122 | # of the stack. Each item in it has the following content:
123 | # (SP offset, Description string, EA)
124 | # wherein:
125 | # - "SP Offset" is the displacement offset of the SP needed to store the value
126 | # - "Description String" is a string to describe what the memory is used for
127 | # - "EA" is the address of the instruction where the stack modification occured
128 | #
129 | # Also these functions are only called if SP is involved somehow (being the
130 | # target register, or push/pop instructions)
131 |
132 | # ===========================================================================
133 | # Function: AnalyzePUSH()
134 | # ===========================================================================
135 | # EA: The address of the instruction
136 | # Stack: the simulated stack
137 | # MinEA: Minimum EA we can backtrack to
138 | # MaxEA: Maximum EA we can forwardtrack to
139 | # Debug: Enable the debug mode
140 | #
141 | # Description/Comment:
142 | # Analyze the PUSH instruction and populate the Stack argument accordingly
143 | #
144 | # Since PUSH R8 (any > R7) doesn't exist in ARM we would need to keep track
145 | # of the register contents to properly analyze the stack state.
146 | # For instance, in the following example:
147 | #
148 | # PUSH {R4-R7,LR}
149 | # MOV R6, R11
150 | # MOV R5, R10
151 | # MOV R4, R8
152 | # PUSH {R4-R6}
153 | #
154 | # the second push really just PUSHes {R8,R10,R11}, not really {R4-R6}.
155 | # There are two ways we go could after this:
156 | # - Either we could simulate the MOV throughout the normal analysis, but
157 | # that would give a false-sense of generecity, whereas we really just
158 | # do island parsing which is bound to eventually fail at some point.
159 | # - Or, we could just try to backtrack to the nearest instructions modifying
160 | # the registers involved and apply a naive heuristic : only taking
161 | # into account MOV Rx, Ry with y > 7.
162 | #
163 | # In the case, the second approach is taken, assuming that, when failing,
164 | # we'll probably have more important issues to solve anyway.
165 | #
166 | # ===========================================================================
167 | def AnalyzePUSH(EA, Stack, MinEA, MaxEA, Debug = False):
168 | # Local functions to backtrack the real register as explained above
169 | # WARNING: this function will invalidate the current decoded instruction
170 | def BacktrackReg(Reg, MinEA):
171 | for head in reversed(Heads(MinEA, EA)):
172 | inslen = ua_ana0(head)
173 | if inslen == 0:
174 | continue
175 | insn = get_current_instruction()
176 | if not insn:
177 | continue
178 | op = get_instruction_operand(insn, 0)
179 | if not op:
180 | continue
181 | if op.type != o_reg or op.reg != Reg:
182 | continue
183 | # if we reach this point it means we identified a
184 | # MOV OurRegisterOfInterest, ...
185 | op = get_instruction_operand(insn, 1)
186 | # Then we apply our naive heuristic:
187 | # only accept MOV Regx, Regy with Regy > R7
188 | if not op or op.type != o_reg or op.reg <= 7:
189 | continue
190 | # Yeah we found something interesting ^^
191 | return op.reg
192 | return Reg
193 | def BacktrackReglist(Reglist, MinEA):
194 | return map(lambda reg: BacktrackReg(reg, MinEA), Reglist)
195 |
196 | inslen = ua_ana0(EA)
197 | if inslen == 0:
198 | return None
199 | insn = get_current_instruction()
200 | if not insn:
201 | return None
202 | op = get_instruction_operand(insn, 0)
203 | if not op:
204 | return None
205 | if op.type == o_reg:
206 | real_reg = BacktrackReg(op.reg, MinEA)
207 | # Warning: the current decoded instruction has been invalidated
208 | if Debug: print " 0x%x: PUSH %s" % (EA, Reg2StrDict[real_reg])
209 | Stack.append((-4, Reg2Str(real_reg), EA))
210 | elif op.type == o_idpspec1:
211 | reg_list = BacktrackReglist(Bitfield2Reglist(op.specval), MinEA)
212 | # Warning: the current decoded instruction has been invalidated
213 | if Debug: print " 0x%x: PUSH %s" % (EA, Reglist2Str(reg_list))
214 | for reg in reversed(reg_list):
215 | Stack.append((-4, Reg2Str(reg), EA))
216 | return None
217 |
218 | # ===========================================================================
219 | # Function: AnalyzePOP()
220 | # ===========================================================================
221 | # EA: The address of the instruction
222 | # Stack: the simulated stack
223 | # MinEA: Minimum EA we can backtrack to
224 | # MaxEA: Maximum EA we can forwardtrack to
225 | # Debug: Enable the debug mode
226 | #
227 | # Description/Comment:
228 | # Analyze the POP instruction and depopulate the Stack argument accordingly
229 | # ===========================================================================
230 | def AnalyzePOP(EA, Stack, MinEA, MaxEA, Debug = False):
231 | inslen = idaapi.ua_ana0(EA)
232 | if inslen == 0:
233 | return None
234 | insn = get_current_instruction()
235 | if not insn:
236 | return None
237 | op = get_instruction_operand(insn, 0)
238 | if not op:
239 | return None
240 | if op.type == o_reg:
241 | if Debug: print " 0x%x: POP %s" % (EA, Reg2StrDict[op.reg])
242 | info = Stack.pop()
243 | # Sanity check, verify we are indeed poping a register
244 | assert(info[0] == -4)
245 | elif op.type == o_idpspec1:
246 | reg_list = Bitfield2Reglist(op.specval)
247 | if Debug: print " 0x%x: POP %s" % (EA, Reglist2Str(reg_list))
248 | for reg in reg_list:
249 | info = Stack.pop()
250 | # Sanity check, verify we are indeed poping a register
251 | assert(info[0] == -4)
252 | return None
253 |
254 | # ===========================================================================
255 | # Function: AnalyzeMOV()
256 | # ===========================================================================
257 | # EA: The address of the instruction
258 | # Stack: the simulated stack
259 | # MinEA: Minimum EA we can backtrack to
260 | # MaxEA: Maximum EA we can forwardtrack to
261 | # Debug: Enable the debug mode
262 | #
263 | # Description/Comment:
264 | # Analyze the MOV instruction
265 | # *Not Currently Implemented*
266 | # ===========================================================================
267 | def AnalyzeMOV(EA, Stack, MinEA, MaxEA, Debug = False):
268 | return None
269 |
270 | # ===========================================================================
271 | # Function: AnalyzeLDR()
272 | # ===========================================================================
273 | # EA: The address of the instruction
274 | # Stack: the simulated stack
275 | # MinEA: Minimum EA we can backtrack to
276 | # MaxEA: Maximum EA we can forwardtrack to
277 | # Debug: Enable the debug mode
278 | #
279 | # Description/Comment:
280 | # Analyze the LDR instruction
281 | #
282 | # Currently only support
283 | # LDR SP, =Value
284 | # ===========================================================================
285 | def AnalyzeLDR(EA, Stack, MinEA, MaxEA, Debug = False):
286 | inslen = idaapi.ua_ana0(EA)
287 | if inslen == 0:
288 | return None
289 | insn = get_current_instruction()
290 | if not insn:
291 | return None
292 | op = get_instruction_operand(insn, 1)
293 | if not op:
294 | return None
295 | if op.type == o_reg:
296 | op = get_instruction_operand(insn, 2)
297 | if not op:
298 | return None
299 | if op.type == o_mem:
300 | value = get_32bit(op.addr)
301 | if Debug: print " 0x%x: LDR SP, =0x%x" % (EA, value)
302 | return value
303 | return None
304 |
305 | # ===========================================================================
306 | # Function: AnalyzeADD()
307 | # ===========================================================================
308 | # EA: The address of the instruction
309 | # Stack: the simulated stack
310 | # MinEA: Minimum EA we can backtrack to
311 | # MaxEA: Maximum EA we can forwardtrack to
312 | # Debug: Enable the debug mode
313 | #
314 | # Description/Comment:
315 | # Analyze the ADD instruction
316 | #
317 | # Only support:
318 | # ADD SP, SP, immediate
319 | # ADD SP, immediate
320 | # ===========================================================================
321 | def AnalyzeADD(EA, Stack, MinEA, MaxEA, Debug = False):
322 | inslen = idaapi.ua_ana0(EA)
323 | if inslen == 0:
324 | return None
325 | insn = get_current_instruction()
326 | if not insn:
327 | return None
328 | op = get_instruction_operand(insn, 1)
329 | if not op:
330 | return None
331 | if op.type == o_reg:
332 | op = get_instruction_operand(insn, 2)
333 | if not op:
334 | return None
335 | if op.type == o_imm:
336 | if Debug: print " 0x%x: ADD SP, SP, #0x%x" % (EA, op.value)
337 | info = Stack.pop()
338 | # Sanity check, verify we are indeed poping the same size
339 | assert(info[0] == -op.value)
340 | return None
341 |
342 | # ===========================================================================
343 | # Function: AnalyzeSUB()
344 | # ===========================================================================
345 | # EA: The address of the instruction
346 | # Stack: the simulated stack
347 | # MinEA: Minimum EA we can backtrack to
348 | # MaxEA: Maximum EA we can forwardtrack to
349 | # Debug: Enable the debug mode
350 | #
351 | # Description/Comment:
352 | # Analyze the SUB instruction
353 | #
354 | # Only support:
355 | # SUB SP, SP, immediate
356 | # SUB SP, immediate
357 | # ===========================================================================
358 | def AnalyzeSUB(EA, Stack, MinEA, MaxEA, Debug = False):
359 | inslen = idaapi.ua_ana0(EA)
360 | if inslen == 0:
361 | return None
362 | insn = get_current_instruction()
363 | if not insn:
364 | return None
365 | op = get_instruction_operand(insn, 1)
366 | if not op:
367 | return None
368 | if op.type == o_reg:
369 | op = get_instruction_operand(insn, 2)
370 | if not op:
371 | return None
372 | if op.type == o_imm:
373 | if Debug: print " 0x%x: SUB SP, SP, #0x%x" % (EA, op.value)
374 | Stack.append((-op.value, "<0x%x byte of local vars>" % op.value, EA))
375 | return None
376 |
377 | # ===========================================================================
378 | # Function: AnalyzeBBStack()
379 | # ===========================================================================
380 | # BBNode: the basic block to analyze
381 | # EndEA: the last instruction EA we'd like to analyze up to
382 | # by default it analyzes the whole block
383 | # Debug: debug mode
384 | #
385 | # Description/Comment:
386 | # Analyze the stack of a basic block
387 | # Return guessed SP base address and the stack
388 | # ===========================================================================
389 | def AnalyzeBBStack(BBNode, EndEA = MaxEA(), Debug = False):
390 | # Stack specific mnem
391 | stackops = dict([
392 | ["PUSH", AnalyzePUSH],
393 | ["POP", AnalyzePOP]])
394 | # General usage mnem
395 | genops = dict([
396 | ["MOV", AnalyzeMOV],
397 | ["MOVS", AnalyzeMOV],
398 | ["LDR", AnalyzeLDR],
399 | ["ADD", AnalyzeADD],
400 | ["ADDS", AnalyzeADD],
401 | ["SUB", AnalyzeSUB],
402 | ["SUBS", AnalyzeSUB]])
403 | # The stack holder
404 | stack = []
405 | sp_base = None
406 | # let's go through the instructions
407 | if EndEA > BBNode.EndEA:
408 | EndEA = BBNode.EndEA
409 | for head in Heads(BBNode.StartEA, NextHead(EndEA, MaxEA())):
410 | if isCode(GetFlags(head)):
411 | # We'll try to identify instructions which can modify the stack
412 | # We could just look at the spd value, but we would miss LDR
413 | # or MOV instruction (for instance).
414 | # Since we'll need to decode the operands anyway, it's probably better
415 | # not to use the spd value at all
416 | mnem = GetMnem(head)
417 | op0_type = GetOpType(head, 0)
418 | op0_value = GetOperandValue(head, 0)
419 | if Debug:
420 | print "0x%x: mnem = %s type = %d and value = %d" % (head, mnem, op0_type, op0_value)
421 | if mnem in stackops:
422 | sp_base = stackops[mnem](head, stack, BBNode.StartEA, EndEA, Debug)
423 | if op0_type == o_reg and op0_value == ARM_REG_SP and mnem in genops:
424 | sp_base = genops[mnem](head, stack, BBNode.StartEA, EndEA, Debug)
425 | # And finally return the stack
426 | return sp_base, stack
427 |
428 | # ===========================================================================
429 | # Function: AnalyzeFunctionStack()
430 | # ===========================================================================
431 | # EA: the address of the function
432 | # NextCallEA: the address where the next call is being made
433 | # Debug: debug mode
434 | #
435 | # Description/Comment:
436 | # Analyze the stack of a function
437 | # We could put some heuristic like stopping as soon as the stack offset
438 | # matches the one when calling the next subfunction... Especially since most
439 | # of the time reading just the first BB is enough. But, what the hell...
440 | #
441 | # The function also returns the guessed SP base address
442 | # This is a very limited feature insofar as it only analyzes LDR instructions
443 | # while even hoping the code doesn't interlace LDR SP,(...) and push/pop
444 | # but load it once for all at the beginning.
445 | #
446 | # Return the the guessed SP base address and the stack
447 | # ===========================================================================
448 | def AnalyzeFunctionStack(EA, NextCallEA, Debug = False):
449 | bb = BuildBasicBlockGraph(EA)
450 | bb_last = bb.FindNode(NextCallEA)
451 | path = bb_last.FindPathToRoot()
452 | stack = []
453 | sp_base = None
454 | for block in path:
455 | if block == bb_last:
456 | sp_addr, new_stack = AnalyzeBBStack(block, NextCallEA, Debug = Debug)
457 | else:
458 | sp_addr, new_stack = AnalyzeBBStack(block, Debug = Debug)
459 | if sp_addr:
460 | sp_base = sp_addr
461 | stack.extend(new_stack)
462 | return sp_base, stack
463 |
464 | # ===========================================================================
465 | # Function: AnalyzeFunctionsStack()
466 | # ===========================================================================
467 | # Functions: list of the functions
468 | # SPBase = The SP base address
469 | # Debug: debug mode
470 | #
471 | # Description/Comment:
472 | # Analyze the stack all the functions in a given path
473 | # If SPBase is provided it will be used, otherwise the code will try to
474 | # retrieve it from the analysis.
475 | # ===========================================================================
476 | def AnalyzeFunctionsStack(Functions, SPBase = None, Debug = False):
477 | sp_addr = SPBase
478 | for f in Functions:
479 | assert(f[3] == get_spd(get_func(f[0]), f[2]))
480 | sp_base, stack = AnalyzeFunctionStack(f[0], f[2], Debug = Debug)
481 | if sp_base and not SPBase:
482 | sp_addr = sp_base
483 | if not sp_addr:
484 | print "WARNING: the SP base pointer could not be inferred for the path."
485 | print " The SP addresses will therefore be invalid."
486 | print "-" * 80
487 | sp_addr = 0x0
488 | print "fun %s calling next @0x%x with stack offset %xh : SP = 0x%x" % (f[1], f[2], f[3], sp_addr)
489 | local_addr = sp_addr
490 | for s in stack:
491 | local_addr += s[0]
492 | print " " + hex(local_addr) + " - " + s[1]
493 | sp_addr += f[3]
494 |
495 | # ===========================================================================
496 | # Function: AnalyzeCallTreeStack()
497 | # ===========================================================================
498 | # EA: the address of the function
499 | # Debug: debug mode
500 | #
501 | # Description/Comment:
502 | # Build a call tree and analyze the stack for it
503 | # ===========================================================================
504 | def AnalyzeCallTreeStack(EA, AskSPAddr = False, Debug = False):
505 | addr_asked = None
506 | if AskSPAddr:
507 | addr_asked = AskAddr(0xFFFFFF, ("Please enter the SP Base address if you want to.\n"
508 | "If no value is given, the script will try to retrieve it automagically.\n\n"))
509 | sp_base = None
510 | if addr_asked != 0xFFFFFF:
511 | sp_base = addr_asked
512 | print "Building Call Tree"
513 | min_spd_ea = get_min_spd_ea(get_func(EA))
514 | if min_spd_ea == BADADDR:
515 | min_spd_ea = get_func(EA).startEA
516 | t = BuildCallTree(EA, NextCallEA = min_spd_ea, Debug = Debug)
517 | print("Done.\n")
518 | t.Dump()
519 | allpaths = t.FindAllPaths()
520 | for p in allpaths:
521 | print "\n" * 2
522 | print "=" * 80
523 | print "New Path"
524 | print "=" * 80
525 | AnalyzeFunctionsStack(p, SPBase = sp_base, Debug = Debug)
526 |
--------------------------------------------------------------------------------
/izshbasicblock.py:
--------------------------------------------------------------------------------
1 | # Basic Block IDA Python Module
2 | # Copyright (c) 2009 iZsh - izsh at iphone-dev.com
3 | #
4 | # This program is free software: you can redistribute it and/or modify
5 | # it under the terms of the GNU General Public License as published by
6 | # the Free Software Foundation, either version 3 of the License, or
7 | # (at your option) any later version.
8 | #
9 | # This program is distributed in the hope that it will be useful,
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 | # GNU General Public License for more details.
13 | #
14 | # You should have received a copy of the GNU General Public License
15 | # along with this program. If not, see .
16 | #
17 |
18 | from idaapi import *
19 | from idc import *
20 | from idautils import *
21 |
22 | ####################################################
23 | #
24 | # Basic Block Graph
25 | #
26 | ####################################################
27 | class BasicBlockNode:
28 | # ==========================================================================
29 | # Method: __init__()
30 | # ==========================================================================
31 | # Ident: unique integer to easily identify the node for pretty printing
32 | # (StartEA, EndEA): couple representing the starting EA and the ending EA
33 | # of the basic block. Those addresses represent resp.
34 | # the first and the last valid instruction of the basic
35 | # block.
36 | # ==========================================================================
37 | def __init__(self, Ident, (StartEA, EndEA)):
38 | self.StartEA = StartEA
39 | self.EndEA = EndEA
40 | self.Ident = Ident
41 | self.NextNodes = set()
42 | self.PrevNodes = set()
43 |
44 | # ==========================================================================
45 | # Method: IsStart()
46 | # ==========================================================================
47 | # Description/Comment:
48 | # Test whether or not the node is a start node (i.e. it starts at the
49 | # beginning of the function)
50 | # ==========================================================================
51 | def IsStart(self):
52 | return get_func(self.StartEA).startEA == self.StartEA
53 |
54 | # ==========================================================================
55 | # Method: IsEnd()
56 | # ==========================================================================
57 | # Description/Comment:
58 | # Test whether or not the node is a end node (i.e. no next nodes)
59 | def IsEnd(self):
60 | return len(self.NextNodes) == 0
61 |
62 | # ==========================================================================
63 | # Method: FindNode()
64 | # ==========================================================================
65 | # EA: Address of the instruction belonging to the basic block
66 | # you're looking for
67 | # Return: The found node
68 | #
69 | # Description/Comment:
70 | # Find the node in the basic block graph whose EA address belongs to.
71 | # The search algorithm starts with the current nodes and thereafter
72 | # explores the "next nodes".
73 | # ==========================================================================
74 | def FindNode(self, EA):
75 | def FindNode_(self, EA, Visited):
76 | if self in Visited:
77 | return None
78 | Visited.add(self)
79 | if self.StartEA <= EA <= self.EndEA:
80 | return self
81 | for x in self.NextNodes:
82 | n = FindNode_(x, EA, Visited)
83 | if n:
84 | return n
85 | return None
86 | return FindNode_(self, EA, set())
87 |
88 | # ==========================================================================
89 | # Method: FindPathToRoot()
90 | # ==========================================================================
91 | # Return: list of nodes, starting from the root
92 | #
93 | # Description/Comment:
94 | # Starting from the current node, return any valid path to the "root"
95 | # (i.e. a "start node")
96 | # ==========================================================================
97 | def FindPathToRoot(self):
98 | def FindPathToRoot_(self, Visited):
99 | if self in Visited:
100 | return None
101 | Visited.add(self)
102 | if self.IsStart():
103 | return [self]
104 | for x in self.PrevNodes:
105 | l = FindPathToRoot_(x, Visited)
106 | if l:
107 | l.append(self)
108 | return l
109 | return None
110 | return FindPathToRoot_(self, set())
111 |
112 | # ==========================================================================
113 | # Method: FindEnd()
114 | # ==========================================================================
115 | # Return: the first found node
116 | #
117 | # Description/Comment:
118 | # Find any "end node", exploring the current node and thereafter the
119 | # "next nodes"
120 | # ==========================================================================
121 | def FindEnd(self):
122 | def FindEnd_(self, Visited):
123 | if self in Visited:
124 | return None
125 | Visited.add(self)
126 | if self.IsEnd():
127 | return self
128 | for x in self.NextNodes:
129 | n = FindEnd_(x, Visited)
130 | if n:
131 | return n
132 | return None
133 | return FindEnd_(self, set())
134 |
135 | # ==========================================================================
136 | # Method: PrintNode()
137 | # ==========================================================================
138 | # Description/Comment:
139 | # Pretty Print the node
140 | # ==========================================================================
141 | def PrintNode(self):
142 | print "Node %d = (StartEA:0x%x, EndEA:0x%x)" % (self.Ident, self.StartEA, self.EndEA)
143 | print " Previous Nodes:"
144 | for x in sorted(self.PrevNodes, cmp = lambda x,y: cmp(x.Ident, y.Ident)):
145 | print " Node %d" % x.Ident
146 | print " Next Nodes:"
147 | for x in sorted(self.NextNodes, cmp = lambda x,y: cmp(x.Ident, y.Ident)):
148 | print " Node %d" % x.Ident
149 |
150 | # ==========================================================================
151 | # Method: Dump()
152 | # ==========================================================================
153 | # Description/Comment:
154 | # Pretty print the whole graph
155 | # ==========================================================================
156 | def Dump(self):
157 | def Dump_(self, Visited):
158 | if self in Visited:
159 | return
160 | Visited.add(self)
161 | self.PrintNode()
162 | for n in self.NextNodes:
163 | Dump_(n, Visited)
164 | Dump_(self, set())
165 |
166 | # ============================================================================
167 | # Function: BuildBasicBlockInfo()
168 | # ============================================================================
169 | # Description/Comment:
170 | # Build the basic blocks information
171 | # it returns two lists as a couple:
172 | # - the BB EAs as (StartEA, EndEA) couple
173 | # - the flow edges as (EA1, EA2)
174 | # For example:
175 | # [ [(StartEA1, EndEA1), (StartEA2, EndEA2)], [(EndEA1, StartEA2)] ]
176 | #
177 | # We could build a graph directly, but it could be convenient for ppl
178 | # who just need some basic information (such as the number
179 | # of BB, the number of edges and so on...)
180 | #
181 | # This function is mostly from openrce.org at
182 | # http://www.openrce.org/articles/full_view/11
183 | # (the cyclomatic complexity example), having its return value reworked
184 | # ============================================================================
185 | def BuildBasicBlockInfo(EA):
186 |
187 | f_start = get_func(EA).startEA
188 | f_end = FindFuncEnd(f_start)
189 |
190 | edges = set()
191 | boundaries = set((f_start,))
192 |
193 | # For each defined element in the function.
194 | for head in Heads(f_start, f_end):
195 |
196 | # If the element is an instruction
197 | if isCode(GetFlags(head)):
198 |
199 | # Get the references made from the current instruction
200 | # and keep only the ones local to the function.
201 | refs = CodeRefsFrom(head, 0)
202 | refs = set(filter(lambda x: x>=f_start and x<=f_end, refs))
203 |
204 | if refs:
205 | # If the flow continues also to the next (address-wise)
206 | # instruction, we add a reference to it.
207 | # For instance, a conditional jump will not branch
208 | # if the condition is not met, so we save that
209 | # reference as well.
210 | next_head = NextHead(head, f_end)
211 | if isFlow(GetFlags(next_head)):
212 | refs.add(next_head)
213 |
214 | # Update the boundaries found so far.
215 | boundaries.update(refs)
216 |
217 | # For each of the references found, and edge is
218 | # created.
219 | for r in refs:
220 | # If the flow could also come from the address
221 | # previous to the destination of the branching
222 | # an edge is created.
223 | if isFlow(GetFlags(r)):
224 | edges.add((PrevHead(r, f_start), r))
225 | edges.add((head, r))
226 |
227 | # Let's build the list of (startEA, startEA) couples
228 | # for each basic block
229 | sorted_boundaries = sorted(boundaries, reverse = True)
230 | end_addr = PrevHead(f_end, f_start)
231 | bb_addr = []
232 | for begin_addr in sorted_boundaries:
233 | bb_addr.append((begin_addr, end_addr))
234 | # search the next end_addr which could be
235 | # farther than just the previous head
236 | # if data are interlaced in the code
237 | # WARNING: it assumes it won't epicly fail ;)
238 | end_addr = PrevHead(begin_addr, f_start)
239 | while not isCode(GetFlags(end_addr)):
240 | end_addr = PrevHead(end_addr, f_start)
241 | # And finally return the result
242 | bb_addr.reverse()
243 | return bb_addr, sorted(edges)
244 |
245 | # ============================================================================
246 | # Function: BuildBasicBlockGraph()
247 | # ============================================================================
248 | # Return: the first node of the graph
249 | #
250 | # Description/Comment:
251 | # Build a graph of the basic blocks
252 | # ============================================================================
253 | def BuildBasicBlockGraph(EA):
254 | # local function helper
255 | def find_node(EA, Nodes):
256 | for n in Nodes:
257 | if n.StartEA <= EA <= n.EndEA:
258 | return n
259 | return None
260 |
261 | boundaries, edges = BuildBasicBlockInfo(EA)
262 | # build the nodes
263 | nodes = set()
264 | first_node = BasicBlockNode(len(nodes), boundaries.pop(0))
265 | nodes.add(first_node)
266 | for x in boundaries:
267 | nodes.add(BasicBlockNode(len(nodes), x))
268 | # build the edges
269 | # ~n^2 algorithm...
270 | # Hopefully there aren't too many nodes and edges ;)
271 | # no premature optimizations kthx
272 | for (src_ea, dest_ea) in edges:
273 | src_node = find_node(src_ea, nodes)
274 | dest_node = find_node(dest_ea, nodes)
275 | src_node.NextNodes.add(dest_node)
276 | dest_node.PrevNodes.add(src_node)
277 |
278 | return first_node
279 |
--------------------------------------------------------------------------------
/izshcalltree.py:
--------------------------------------------------------------------------------
1 | # Call Tree IDA Python Module
2 | # Copyright (c) 2009 iZsh - izsh at iphone-dev.com
3 | #
4 | # This program is free software: you can redistribute it and/or modify
5 | # it under the terms of the GNU General Public License as published by
6 | # the Free Software Foundation, either version 3 of the License, or
7 | # (at your option) any later version.
8 | #
9 | # This program is distributed in the hope that it will be useful,
10 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 | # GNU General Public License for more details.
13 | #
14 | # You should have received a copy of the GNU General Public License
15 | # along with this program. If not, see .
16 | #
17 |
18 | from idaapi import *
19 | from idc import *
20 | from idautils import *
21 |
22 | ####################################################
23 | #
24 | # Call Tree
25 | #
26 | ####################################################
27 | class CallTreeNode:
28 | # ===========================================================================
29 | # Method: __init__()
30 | # ===========================================================================
31 | # Name: Name of the function
32 | # EA: Starting address of the function
33 | # NextCallEA: Address where the subcall is being made
34 | # Parent: the parent node in the tree
35 | # ===========================================================================
36 | def __init__(self, Name, EA, NextCallEA, Parent = None):
37 | self.Children = []
38 | self.Parent = Parent
39 | self.Name = Name
40 | self.EA = EA
41 | self.NextCallEA = NextCallEA
42 | # We retrieve the SP delta at the next call address
43 | self.NextCallSPD = 0
44 | if NextCallEA:
45 | self.NextCallSPD = get_spd(get_func(NextCallEA), NextCallEA)
46 |
47 | # ===========================================================================
48 | # Method: Exists()
49 | # ===========================================================================
50 | # Name: The name of the function
51 | # NextCallEA: address where the subcall is being made
52 | # Return a boolean
53 | #
54 | # Description/Comment:
55 | # Checking the NextCallSPD will enable us to analyze the
56 | # function call again in cases wherein the stack state
57 | # is not the same for multiple calls of the same
58 | # function.
59 | # ===========================================================================
60 | def Exists(self, Name, NextCallEA):
61 | NextCallSPD = 0
62 | if NextCallEA:
63 | NextCallSPD = get_spd(get_func(NextCallEA), NextCallEA)
64 | if self.Name == Name and self.NextCallSPD == NextCallSPD:
65 | return True
66 | for c in self.Children:
67 | if c.Exists(Name, NextCallEA):
68 | return True
69 | return False
70 |
71 | # ===========================================================================
72 | # Method: FindAllPaths()
73 | # ===========================================================================
74 | # Return: List of list of (EA, Name, NextCallEA, NextCallSPD)
75 | #
76 | # Description/Comment:
77 | # Return the list of all the possible paths _up_ to this node (including it)
78 | # for each node (EA, Name, NextCallEA, NextCallSPD) is collected
79 | # ===========================================================================
80 | def FindAllPaths(self):
81 | info = (self.EA, self.Name, self.NextCallEA, self.NextCallSPD)
82 | if len(self.Children) == 0:
83 | return [[info]]
84 | paths = []
85 | for n in self.Children:
86 | subpaths = n.FindAllPaths()
87 | map(lambda p: p.append(info), subpaths)
88 | paths.extend(subpaths)
89 | return paths
90 |
91 | # ===========================================================================
92 | # Method: Dump()
93 | # ===========================================================================
94 | # Description/Comment:
95 | # Pretty print the tree - or ugly print... it depends on the point of view ;)
96 | # ===========================================================================
97 | def Dump(self, Space = 0, Threshold = 42):
98 | if Space > Threshold:
99 | return
100 | print (" " * Space + self.Name + " @" + hex(self.EA)
101 | + " (%xh @0x%x)" % (self.NextCallSPD, self.NextCallEA))
102 | for c in self.Children:
103 | c.Dump(Space + 1)
104 |
105 | # ===========================================================================
106 | # Function: BuildCallTree()
107 | # ===========================================================================
108 | # EA: address of the function
109 | # NextCallEA: address where the subfunction is being called
110 | # P = Parent node
111 | # Debug = Enable debug messages
112 | #
113 | # Description/Comment:
114 | # Build the call tree starting with the function at EA
115 | # ===========================================================================
116 | def BuildCallTree(EA, NextCallEA = BADADDR, P = None, Debug = False):
117 | name = GetFunctionName(EA)
118 | if not name:
119 | name = "loc_%x" % EA
120 | if P and P.Exists(name, NextCallEA):
121 | return None
122 | # Build the node
123 | node = CallTreeNode(name, EA, NextCallEA, Parent = P)
124 | # Iterate through the xref
125 | for xref in CodeRefsTo(EA, 1):
126 | try:
127 | # Retrieve the EA of the calling function
128 | xref_f = get_func(xref).startEA
129 | if Debug:
130 | print ("[fun %s @0x%x] fun %s @0x%x: calling %s @0x%x"
131 | % (name, EA, GetFunctionName(xref_f), xref_f, name, xref))
132 | # Build the subtree recursively
133 | subtree = BuildCallTree(xref_f, xref, P = node, Debug = Debug)
134 | if subtree:
135 | node.Children.append(subtree)
136 | if Debug:
137 | print "[fun %s @0x%x] Adding the following subtree:" % (name, EA)
138 | subtree.Dump()
139 | print "[fun %s @0x%x] The new node looks like this:" % (name, EA)
140 | node.Dump()
141 | except:
142 | if Debug:
143 | print "[fun %s @0x%x] [!] Problem getting func of %x" % (name, EA, xref)
144 | # Finally returns the result
145 | return node
146 |
--------------------------------------------------------------------------------