meaningfulFunctions = new HashSet<>();
70 | for (var func : Global.currentProgram.getListing().getFunctions(true)) {
71 | if (isMeaningfulFunction(func)) {
72 | meaningfulFunctions.add(func);
73 | }
74 | }
75 | return meaningfulFunctions;
76 | }
77 |
78 |
79 | /**
80 | * This is a stupid function, but we have to do this.
81 | * Because ghidra's `getCallingFunctions()` and `getCalledFunctions()` may not work correctly.
82 | * For Example:
83 | * If function B is not called by function A, but function B's ptr is used in function A, then ghidra will
84 | * consider function A as a caller of function B when using `getCallingFunctions()` methods. And consider
85 | * function B as a callee of function A when using `getCalledFunctions()` methods.
86 | *
87 | * So some function can be seen as a root node, but failed to pass the check of `getCallingFunctions().isEmpty()`.
88 | * We need to check and complete these root nodes.
89 | *
90 | * @return if the function has no direct caller in the whole program
91 | */
92 | public static boolean confirmNoDirectCaller(Function func) {
93 | boolean noCaller = true;
94 |
95 | for (var caller : func.getCallingFunctions(TaskMonitor.DUMMY)) {
96 | var callerInsts = Global.currentProgram.getListing().getInstructions(caller.getBody(), true);
97 | for (var inst : callerInsts) {
98 | if (inst.getMnemonicString().equals("CALL")) {
99 | var instFlows = inst.getFlows();
100 | if (instFlows.length >= 1) {
101 | for (var flow : instFlows) {
102 | Function calledFunc = Global.currentProgram.getFunctionManager().getFunctionAt(flow);
103 | if (calledFunc != null && calledFunc.equals(func)) {
104 | noCaller = false;
105 | return noCaller;
106 | }
107 | }
108 | }
109 | }
110 | }
111 | }
112 |
113 | return noCaller;
114 | }
115 |
116 |
117 | public static Address getAddress(long offset) {
118 | return Global.currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(offset);
119 | }
120 |
121 | public static Function getFunction(long offset) {
122 | return Global.currentProgram.getFunctionManager().getFunctionAt(getAddress(offset));
123 | }
124 | }
125 |
--------------------------------------------------------------------------------
/src/main/java/typeforge/utils/Global.java:
--------------------------------------------------------------------------------
1 | package typeforge.utils;
2 |
3 | import ghidra.app.script.GhidraScript;
4 | import ghidra.program.model.listing.Program;
5 | import ghidra.program.flatapi.FlatProgramAPI;
6 | /**
7 | * The global state of the current analysis.
8 | */
9 | public class Global {
10 | public static Program currentProgram;
11 | public static FlatProgramAPI flatAPI;
12 | public static GhidraScript ghidraScript;
13 | public static String outputDirectory;
14 | public static long startAddress;
15 |
16 | public static long typeAnalysisBeginTime;
17 | public static long typeAnalysisEndTime;
18 | public static long retypingBeginTime;
19 | public static long retypingEndTime;
20 | public static long prepareAnalysisBeginTime;
21 | public static long prepareAnalysisEndTime;
22 | }
23 |
--------------------------------------------------------------------------------
/src/main/java/typeforge/utils/GraphHelper.java:
--------------------------------------------------------------------------------
1 | package typeforge.utils;
2 |
3 | import typeforge.base.node.DataTypeNode;
4 | import typeforge.base.node.NodeBase;
5 | import typeforge.base.graph.SDGraph;
6 | import ghidra.program.model.data.DataType;
7 |
8 | import java.io.BufferedWriter;
9 | import java.io.IOException;
10 | import java.nio.file.Files;
11 | import java.nio.file.Paths;
12 | import java.util.Set;
13 |
14 | public class GraphHelper {
15 | /**
16 | * Dump the SDGraph to a dot file
17 | */
18 | public static void dumpSDGraph(SDGraph sdg, String filename) {
19 | StringBuilder dotBuilder = new StringBuilder();
20 |
21 | Set> allNodes = sdg.getAllNodes();
22 | Set allEdges = sdg.getAllEdges();
23 |
24 | dotBuilder.append("digraph SDGraph {\n");
25 |
26 | // traverse all nodes
27 | for (var node : allNodes) {
28 | if (node instanceof DataTypeNode dtn) {
29 | String nodeID = "node" + dtn.id;
30 | String nodeLabel = dtn.value.getName();
31 | dotBuilder.append(
32 | String.format(
33 | "%s [label=\"%s\"];\n",
34 | nodeID,
35 | nodeLabel
36 | )
37 | );
38 | }
39 | }
40 |
41 | // traverse all edges
42 | for (var edge : allEdges) {
43 | String srcNodeID = "node" + edge.srcNode.id;
44 | String dstNodeID = "node" + edge.dstNode.id;
45 | String edgeType = edge.edgeType.toString();
46 | String edgeLabel = String.format("Offset %s: %s", Integer.toHexString(edge.offset), edgeType);
47 | dotBuilder.append(
48 | String.format(
49 | "%s -> %s [label=\"%s\"];\n",
50 | srcNodeID,
51 | dstNodeID,
52 | edgeLabel
53 | )
54 | );
55 | }
56 |
57 | dotBuilder.append("}\n");
58 |
59 | try (BufferedWriter writer = Files.newBufferedWriter(Paths.get(filename))) {
60 | writer.write(dotBuilder.toString());
61 | } catch (IOException e) {
62 | Logging.error("GraphHelper", "Failed to write to file: " + filename);
63 | }
64 | }
65 | }
66 |
--------------------------------------------------------------------------------
/src/main/java/typeforge/utils/HighSymbolHelper.java:
--------------------------------------------------------------------------------
1 | package typeforge.utils;
2 |
3 | import ghidra.program.model.address.Address;
4 | import ghidra.program.model.pcode.HighSymbol;
5 |
6 | public class HighSymbolHelper {
7 |
8 | public static Address getGlobalHighSymbolAddr(HighSymbol globalSym) {
9 | assert globalSym.isGlobal();
10 | return globalSym.getStorage().getMinAddress();
11 | }
12 | }
13 |
--------------------------------------------------------------------------------
/src/main/java/typeforge/utils/Logging.java:
--------------------------------------------------------------------------------
1 | package typeforge.utils;
2 |
3 | import java.io.IOException;
4 | import java.io.InputStream;
5 |
6 | import org.apache.logging.log4j.LogManager;
7 | import org.apache.logging.log4j.Logger;
8 | import org.apache.logging.log4j.core.LoggerContext;
9 | import org.apache.logging.log4j.core.config.Configuration;
10 | import org.apache.logging.log4j.core.config.ConfigurationSource;
11 | import org.apache.logging.log4j.core.config.xml.XmlConfiguration;
12 |
13 | /**
14 | * Logging class.
15 | */
16 | public class Logging {
17 |
18 | private static final String DEFAULT_LOGGER_NAME = "TypeForge";
19 | private static final String DEFAULT_CONFIG_FILE_PATH = "/log4j2_default.xml";
20 | private static Logger defaultLogger;
21 |
22 | /**
23 | * Initialize the logging module.
24 | * @return true if init success, false otherwise.
25 | */
26 | public static boolean init() {
27 | InputStream in = Logging.class.getResourceAsStream(DEFAULT_CONFIG_FILE_PATH);
28 | try {
29 | assert in != null;
30 | Configuration configuration = new XmlConfiguration(new LoggerContext(DEFAULT_LOGGER_NAME),
31 | new ConfigurationSource(in));
32 | LoggerContext context = (LoggerContext) LogManager.getContext(true);
33 | context.stop();
34 | context.start(configuration);
35 | defaultLogger = context.getLogger(DEFAULT_LOGGER_NAME);
36 | } catch (IOException e) {
37 | System.out.println("Cannot locate logging config file :" + in);
38 | return false;
39 | }
40 | return true;
41 | }
42 |
43 | /**
44 | * Generate an error log.
45 | * @param msg the log message.
46 | */
47 | public static void error(String prefix, String msg) {
48 | defaultLogger.error("[{}] - {}", prefix, msg);
49 | }
50 |
51 | /**
52 | * Generate a warning log.
53 | * @param msg the log message.
54 | */
55 | public static void warn(String prefix, String msg) {
56 | defaultLogger.warn("[{}] - {}", prefix, msg);
57 | }
58 |
59 | /**
60 | * Generate a info log.
61 | * @param msg the log message.
62 | */
63 | public static void info(String prefix, String msg) {
64 | defaultLogger.info("[{}] - {}", prefix, msg);
65 | }
66 |
67 | /**
68 | * Generate a debug log
69 | * @param msg the debug log.
70 | */
71 | public static void debug(String prefix, String msg) {
72 | defaultLogger.debug("[{}] - {}", prefix, msg);
73 | }
74 |
75 | /**
76 | * Generate a trace log
77 | * @param msg the trace log.
78 | */
79 | public static void trace(String prefix, String msg) {
80 | defaultLogger.trace("[{}] - {}", prefix, msg);
81 | }
82 | }
--------------------------------------------------------------------------------
/src/main/java/typeforge/utils/TCHelper.java:
--------------------------------------------------------------------------------
1 | package typeforge.utils;
2 |
3 | import ghidra.program.model.data.DataType;
4 | import typeforge.base.dataflow.constraint.Skeleton;
5 |
6 | import java.util.*;
7 |
8 | public class TCHelper {
9 | public static class Interval {
10 | final long start;
11 | final long end;
12 |
13 | Interval(long start, long end) {
14 | this.start = start;
15 | this.end = end;
16 | }
17 |
18 | public boolean inInterval(long offset) {
19 | return offset > start && offset < end;
20 | }
21 |
22 | @Override
23 | public boolean equals(Object obj) {
24 | if (obj instanceof Interval) {
25 | return this.start == ((Interval) obj).start && this.end == ((Interval) obj).end;
26 | }
27 | return false;
28 | }
29 |
30 | @Override
31 | public int hashCode() {
32 | return Objects.hash(start, end);
33 | }
34 | }
35 |
36 | /**
37 | * If a field's start in other field's interval, then return true
38 | * If two fields have same start, but one field's end is larger than other field's start, then return true
39 | * @return if overlap occurs
40 | */
41 | public static boolean checkFieldOverlapStrict(Skeleton a, Skeleton b) {
42 | var aIntervals = buildIntervals(a);
43 | var bIntervals = buildIntervals(b);
44 | for (var aI: aIntervals) {
45 | for (var bI: bIntervals) {
46 | if (aI.inInterval(bI.start) || bI.inInterval(aI.start)) {
47 | return true;
48 | }
49 |
50 | if (aI.start == bI.start) {
51 | var aNI = getNextLargerInterval(aI, aIntervals);
52 | if (aNI != null && bI.end > aNI.start) {
53 | return true;
54 | }
55 |
56 | var bNI = getNextLargerInterval(bI, bIntervals);
57 | if (bNI != null && aI.end > bNI.start) {
58 | return true;
59 | }
60 | }
61 | }
62 | }
63 | return false;
64 | }
65 |
66 | // TODO: not very expected ... since (0,4) maybe (0,2) + (2,4), and this is still overlap
67 | public static boolean checkFieldOverlapRelax(Skeleton a, Skeleton b) {
68 | var aIntervals = buildIntervalWithMostAccessed(a);
69 | var bIntervals = buildIntervalWithMostAccessed(b);
70 | for (var aI: aIntervals) {
71 | for (var bI: bIntervals) {
72 | if (aI.inInterval(bI.start) || bI.inInterval(aI.start)) {
73 | return true;
74 | }
75 |
76 | if (aI.start == bI.start) {
77 | var aNI = getNextLargerInterval(aI, aIntervals);
78 | if (aNI != null && bI.end > aNI.start) {
79 | return true;
80 | }
81 |
82 | var bNI = getNextLargerInterval(bI, bIntervals);
83 | if (bNI != null && aI.end > bNI.start) {
84 | return true;
85 | }
86 | }
87 | }
88 | }
89 | return false;
90 | }
91 |
92 |
93 | // public static boolean checkFieldSizeInConsistent(TypeConstraint a, TypeConstraint b) {
94 | // if (a == b) {
95 | // return false;
96 | // }
97 | // Set thisIntervals = new HashSet<>();
98 | // for (var offset : a.fieldAccess.keySet()) {
99 | // long endOffset = calcFieldEndOffset(a, offset);
100 | // thisIntervals.add(new Interval(offset, endOffset));
101 | // }
102 | //
103 | // Set otherIntervals = new HashSet<>();
104 | // for (var offset : b.fieldAccess.keySet()) {
105 | // long endOffset = calcFieldEndOffset(b, offset);
106 | // otherIntervals.add(new Interval(offset, endOffset));
107 | // }
108 | //
109 | // Set commonIntervals = new HashSet<>(thisIntervals);
110 | // commonIntervals.retainAll(otherIntervals);
111 | //
112 | // thisIntervals.removeAll(commonIntervals);
113 | // otherIntervals.removeAll(commonIntervals);
114 | //
115 | // if (thisIntervals.isEmpty() || otherIntervals.isEmpty()) {
116 | // return false;
117 | // }
118 | //
119 | // List mergedIntervals = new ArrayList<>(thisIntervals);
120 | // mergedIntervals.addAll(otherIntervals);
121 | // mergedIntervals.sort(Comparator.comparingLong(interval -> interval.start));
122 | // for (int i = 0; i < mergedIntervals.size() - 1; i++) {
123 | // Interval current = mergedIntervals.get(i);
124 | // Interval next = mergedIntervals.get(i + 1);
125 | // if (current.end > next.start) {
126 | // return true;
127 | // }
128 | // }
129 | // return false;
130 | // }
131 |
132 | public static ArrayList buildIntervals(Skeleton a) {
133 | ArrayList intervals = new ArrayList<>();
134 | for (var offset : a.fieldAccess.keySet()) {
135 | for (var endOffset : calcFieldEndOffset(a, offset)) {
136 | intervals.add(new Interval(offset, endOffset));
137 | }
138 | }
139 | return intervals;
140 | }
141 |
142 | public static ArrayList buildIntervalWithMostAccessed(Skeleton a) {
143 | ArrayList intervals = new ArrayList<>();
144 |
145 | for (var offset : a.fieldAccess.keySet()) {
146 | var aps = a.fieldAccess.get(offset);
147 | if (aps == null || aps.getApSet().isEmpty()) {
148 | continue;
149 | }
150 |
151 | var typeFreq = aps.getTypeFreq();
152 | DataType mostAccessedType = null;
153 | int maxAccess = 0;
154 |
155 | for (var entry : typeFreq.entrySet()) {
156 | if (entry.getValue() > maxAccess) {
157 | maxAccess = entry.getValue();
158 | mostAccessedType = entry.getKey();
159 | }
160 | }
161 |
162 | if (mostAccessedType != null) {
163 | long endOffset = offset + mostAccessedType.getLength();
164 | intervals.add(new Interval(offset, endOffset));
165 | }
166 | }
167 |
168 | return intervals;
169 | }
170 |
171 | public static Interval getNextLargerInterval(Interval cur, List intervals) {
172 | for (var interval: intervals) {
173 | if (interval.start >= cur.end) {
174 | return interval;
175 | }
176 | }
177 | return null;
178 | }
179 |
180 |
181 | public static Set calcFieldEndOffset(Skeleton a, Long offset) {
182 | Set ends = new TreeSet<>();
183 | var fields = a.fieldAccess.get(offset);
184 | if (fields == null) {
185 | return ends;
186 | }
187 |
188 | for (var ap : fields.getApSet()) {
189 | if (ap.dataType != null) {
190 | ends.add(offset + ap.dataType.getLength());
191 | }
192 | }
193 | return ends;
194 | }
195 | }
196 |
--------------------------------------------------------------------------------
/src/main/resources/log4j2_default.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 | >
10 |
11 |
12 |
13 |
14 |
15 |
16 |
--------------------------------------------------------------------------------
/src/test/java/README.test.txt:
--------------------------------------------------------------------------------
1 | The "test" directory is intended to hold unit test cases. The package structure within
2 | this folder should correspond to that found in the "src" folder.
3 |
--------------------------------------------------------------------------------
/src/test/java/typeforge/base/dataflow/NMAETest.java:
--------------------------------------------------------------------------------
1 | package typeforge.base.dataflow;
2 |
3 | import static org.mockito.Mockito.*;
4 |
5 | import typeforge.utils.Logging;
6 | import ghidra.program.model.listing.Function;
7 | import ghidra.program.model.pcode.HighFunction;
8 | import ghidra.program.model.pcode.HighSymbol;
9 | import org.junit.jupiter.api.BeforeEach;
10 | import org.junit.jupiter.api.Test;
11 | import org.junit.jupiter.api.extension.ExtendWith;
12 | import org.mockito.Mock;
13 | import org.mockito.junit.jupiter.MockitoExtension;
14 |
15 | @ExtendWith(MockitoExtension.class)
16 | public class NMAETest {
17 | @Mock
18 | private HighSymbol mockHighSymbol1;
19 | @Mock
20 | private HighSymbol mockHighSymbol2;
21 | @Mock
22 | private HighSymbol mockHighSymbol3;
23 | @Mock
24 | private HighFunction mockHighFunc;
25 | @Mock
26 | private Function mockFunc;
27 |
28 | @BeforeEach
29 | public void setUp() {
30 | if(!Logging.init()) {
31 | return;
32 | }
33 | when(mockHighSymbol1.getName()).thenReturn("mock_1");
34 | when(mockHighSymbol2.getName()).thenReturn("mock_2");
35 | when(mockHighSymbol3.getName()).thenReturn("mock_3");
36 | when(mockHighSymbol1.getHighFunction()).thenReturn(mockHighFunc);
37 | when(mockHighSymbol2.getHighFunction()).thenReturn(mockHighFunc);
38 | when(mockHighSymbol3.getHighFunction()).thenReturn(mockHighFunc);
39 | when(mockHighFunc.getFunction()).thenReturn(mockFunc);
40 | when(mockFunc.getName()).thenReturn("mock_func");
41 | }
42 |
43 | @Test
44 | public void test() {
45 | // var expr1 = new SymbolExpr.Builder()
46 | // .rootSymbol(mockHighSymbol1)
47 | // .build();
48 | //
49 | // var expr2 = new SymbolExpr.Builder()
50 | // .rootSymbol(mockHighSymbol2)
51 | // .build();
52 | //
53 | // var expr3 = new SymbolExpr.Builder()
54 | // .rootSymbol(mockHighSymbol3)
55 | // .build();
56 | //
57 | //
58 | // assertEquals(expr1.getRepresentation(), "mock_1");
59 | // assertEquals(expr2.getRepresentation(), "mock_2");
60 | // assertEquals(expr3.getRepresentation(), "mock_3");
61 | //
62 | // var expr4 = new SymbolExpr.Builder().constant(0x8).build();
63 | // var expr5 = new SymbolExpr.Builder().constant(0x10).build();
64 | // var expr6 = new SymbolExpr.Builder().constant(0x18).build();
65 | //
66 | // assertEquals(expr4.getRepresentation(), "0x8");
67 | // assertEquals(expr5.getRepresentation(), "0x10");
68 | // assertEquals(expr6.getRepresentation(), "0x18");
69 |
70 | // var expr7 = expr1.add(expr4);
71 | // var expr8 = expr2.add(expr5);
72 | // var expr9 = expr3.add(expr6);
73 | // assertEquals(expr7.getRepresentation(), "mock_1 + 0x8");
74 | // assertEquals(expr8.getRepresentation(), "mock_2 + 0x10");
75 | // assertEquals(expr9.getRepresentation(), "mock_3 + 0x18");
76 | //
77 | // var expr10 = expr7.dereference();
78 | // var expr11 = expr8.dereference();
79 | // var expr12 = expr9.dereference();
80 | // var expr13 = expr1.dereference();
81 | // var expr14 = expr12.dereference();
82 | // assertEquals(expr10.getRepresentation(), "*(mock_1 + 0x8)");
83 | // assertEquals(expr11.getRepresentation(), "*(mock_2 + 0x10)");
84 | // assertEquals(expr12.getRepresentation(), "*(mock_3 + 0x18)");
85 | // assertEquals(expr13.getRepresentation(), "*(mock_1)");
86 | // assertEquals(expr14.getRepresentation(), "*(*(mock_3 + 0x18))");
87 | //
88 | // var expr15 = expr12.add(expr4);
89 | // var expr16 = expr14.add(expr6);
90 | // var expr17 = expr16.add(expr6);
91 | // assertEquals(expr15.getRepresentation(), "*(mock_3 + 0x18) + 0x8");
92 | // assertEquals(expr16.getRepresentation(), "*(*(mock_3 + 0x18)) + 0x18");
93 | // assertEquals(expr17.getRepresentation(), "*(*(mock_3 + 0x18)) + 0x30");
94 | //
95 | // var expr18 = expr17.add(expr3);
96 | // assertEquals(expr18.getRepresentation(), "*(*(mock_3 + 0x18)) + mock_3 + 0x30");
97 | }
98 | }
--------------------------------------------------------------------------------
/src/test/java/typeforge/base/dataflow/types/LayoutTest.java:
--------------------------------------------------------------------------------
1 | package typeforge.base.dataflow.types;
2 |
3 | import org.junit.jupiter.api.Test;
4 | import typeforge.base.dataflow.Layout;
5 |
6 | import java.util.ArrayList;
7 | import java.util.HashSet;
8 | import java.util.Set;
9 |
10 | public class LayoutTest {
11 | @Test
12 | public void test() {
13 | Set sizes1 = new HashSet<>();
14 | sizes1.add(1);
15 | sizes1.add(2);
16 | sizes1.add(3);
17 |
18 | Set sizes2 = new HashSet<>();
19 | sizes2.add(3);
20 | sizes2.add(2);
21 | sizes2.add(1);
22 |
23 | Set sizes3 = new HashSet<>();
24 | sizes3.add(0x10);
25 |
26 | var interval1 = new Layout.Interval(10L, sizes1);
27 | var interval2 = new Layout.Interval(10L, sizes2);
28 | var interval3 = new Layout.Interval(0, sizes3);
29 |
30 | assert sizes1.equals(sizes2);
31 | assert interval1.equals(interval2);
32 | assert interval1.hashCode() == interval2.hashCode();
33 | assert !interval1.equals(interval3);
34 |
35 | var intervals = new ArrayList();
36 | intervals.add(interval1);
37 | intervals.add(interval3);
38 | var layout1 = new Layout(intervals);
39 |
40 | intervals = new ArrayList();
41 | intervals.add(interval3);
42 | intervals.add(interval1);
43 | var layout2 = new Layout(intervals);
44 |
45 | intervals = new ArrayList();
46 | intervals.add(interval1);
47 | intervals.add(interval3);
48 | var layout3 = new Layout(intervals);
49 |
50 | assert !layout1.equals(layout2);
51 | assert layout1.equals(layout3);
52 | assert layout1.hashCode() == layout3.hashCode();
53 | }
54 | }
55 |
--------------------------------------------------------------------------------
16 |