2934 lines
115 KiB
C++
2934 lines
115 KiB
C++
#include <assert.h>
|
|
#include <stdint.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <inttypes.h>
|
|
|
|
#include <map>
|
|
#include <set>
|
|
#include <vector>
|
|
#include <string>
|
|
|
|
#include <capstone.h>
|
|
|
|
#include "elf.h"
|
|
|
|
#define INSPECT_FUNCTION_POINTERS 0 // set this to 1 when testing a new program, to verify that no false function pointers are found
|
|
|
|
#ifndef TRACE
|
|
#define TRACE 0
|
|
#endif
|
|
|
|
#define LABELS_64_BIT 1
|
|
|
|
#define MAX(a, b) ((a) > (b) ? (a) : (b))
|
|
#define MIN(a, b) ((a) < (b) ? (a) : (b))
|
|
|
|
#define u32be(x) (uint32_t)(((x & 0xff) << 24) + ((x & 0xff00) << 8) + ((x & 0xff0000) >> 8) + ((uint32_t)(x) >> 24))
|
|
#define u16be(x) (uint16_t)(((x & 0xff) << 8) + ((x & 0xff00) >> 8))
|
|
#define read_u32_be(buf) (uint32_t)(((buf)[0] << 24) + ((buf)[1] << 16) + ((buf)[2] << 8) + ((buf)[3]))
|
|
|
|
using namespace std;
|
|
|
|
struct Edge {
|
|
uint32_t i;
|
|
uint8_t function_entry: 1;
|
|
uint8_t function_exit: 1;
|
|
uint8_t extern_function: 1;
|
|
uint8_t function_pointer: 1;
|
|
};
|
|
|
|
struct Insn {
|
|
uint32_t id;
|
|
uint8_t op_count;
|
|
string mnemonic;
|
|
string op_str;
|
|
cs_mips_op operands[8];
|
|
|
|
uint8_t is_jump: 1;
|
|
uint8_t is_global_got_memop: 1;
|
|
uint8_t no_following_successor: 1;
|
|
int linked_insn;
|
|
union {
|
|
uint32_t linked_value;
|
|
float linked_float;
|
|
};
|
|
uint32_t jtbl_addr;
|
|
uint32_t num_cases;
|
|
mips_reg index_reg;
|
|
vector<Edge> successors;
|
|
vector<Edge> predecessors;
|
|
uint64_t b_liveout;
|
|
uint64_t b_livein;
|
|
uint64_t f_livein;
|
|
uint64_t f_liveout;
|
|
};
|
|
|
|
struct Function {
|
|
vector<uint32_t> returns; //points to delay slots
|
|
uint32_t end_addr; //address after end
|
|
uint32_t nargs;
|
|
uint32_t nret;
|
|
bool v0_in;
|
|
bool referenced_by_function_pointer;
|
|
};
|
|
|
|
static bool conservative;
|
|
|
|
static csh handle;
|
|
|
|
static const uint8_t *text_section;
|
|
static uint32_t text_section_len;
|
|
static uint32_t text_vaddr;
|
|
|
|
static const uint8_t *rodata_section;
|
|
static uint32_t rodata_section_len;
|
|
static uint32_t rodata_vaddr;
|
|
|
|
static const uint8_t *data_section;
|
|
static uint32_t data_section_len;
|
|
static uint32_t data_vaddr;
|
|
|
|
static uint32_t bss_section_len;
|
|
static uint32_t bss_vaddr;
|
|
|
|
static vector<Insn> insns;
|
|
static set<uint32_t> label_addresses;
|
|
static vector<uint32_t> got_globals;
|
|
static vector<uint32_t> got_locals;
|
|
static uint32_t gp_value;
|
|
static uint32_t gp_value_adj;
|
|
|
|
static map<uint32_t, string> symbol_names;
|
|
|
|
static vector<pair<uint32_t, uint32_t>> data_function_pointers;
|
|
static set<uint32_t> li_function_pointers;
|
|
static map<uint32_t, Function> functions;
|
|
static uint32_t main_addr;
|
|
static uint32_t mcount_addr;
|
|
static uint32_t procedure_table_start;
|
|
static uint32_t procedure_table_len;
|
|
|
|
#define FLAG_NO_MEM 1
|
|
#define FLAG_VARARG 2
|
|
|
|
static const struct {
|
|
const char *name;
|
|
const char *params;
|
|
int flags;
|
|
} extern_functions[] = {
|
|
{"exit", "vi"}, // override exit from application
|
|
{"abort", "v"},
|
|
{"sbrk", "pi"},
|
|
{"malloc", "pu"},
|
|
{"calloc", "puu"},
|
|
{"realloc", "ppu"},
|
|
{"free", "vp"},
|
|
{"fscanf", "ipp", FLAG_VARARG},
|
|
{"printf", "ip", FLAG_VARARG},
|
|
{"sprintf", "ipp", FLAG_VARARG},
|
|
{"fprintf", "ipp", FLAG_VARARG},
|
|
{"_doprnt", "ippp"},
|
|
{"strlen", "up"},
|
|
{"open", "ipii"},
|
|
{"creat", "ipi"},
|
|
{"access", "ipi"},
|
|
{"rename", "ipp"},
|
|
{"utime", "ipp"},
|
|
{"flock", "iii"},
|
|
{"chmod", "ipu"},
|
|
{"umask", "ii", FLAG_NO_MEM},
|
|
{"ecvt", "pdipp"},
|
|
{"fcvt", "pdipp"},
|
|
{"sqrt", "dd", FLAG_NO_MEM},
|
|
{"sqrtf", "ff", FLAG_NO_MEM},
|
|
{"atoi", "ip"},
|
|
{"atol", "ip"},
|
|
{"atof", "dp"},
|
|
{"strtol", "ippi"},
|
|
{"strtoul", "uppi"},
|
|
{"strtod", "dpp"},
|
|
{"strchr", "ppi"},
|
|
{"strrchr", "ppi"},
|
|
{"strcspn", "upp"},
|
|
{"strpbrk", "ppp"},
|
|
{"fstat", "iip"},
|
|
{"stat", "ipp"},
|
|
{"ftruncate", "iii"},
|
|
{"bcopy", "vppu"},
|
|
{"memcpy", "pppu"},
|
|
{"memccpy", "pppiu"},
|
|
{"read", "iipu"},
|
|
{"write", "iipu"},
|
|
{"fopen", "ppp"},
|
|
{"freopen", "pppp"},
|
|
{"fclose", "ip"},
|
|
{"ftell", "ip"},
|
|
{"rewind", "vp"},
|
|
{"fseek", "ipii"},
|
|
{"lseek", "iiii"},
|
|
{"fflush", "ip"},
|
|
{"dup", "ii"},
|
|
{"dup2", "iii"},
|
|
{"pipe", "ip"},
|
|
{"perror", "vp"},
|
|
{"fdopen", "iip"},
|
|
{"memset", "ppiu"},
|
|
{"bcmp", "ippu"},
|
|
{"memcmp", "ippu"},
|
|
{"getpid", "i", FLAG_NO_MEM},
|
|
{"getpgrp", "i"},
|
|
{"remove", "ip"},
|
|
{"unlink", "ip"},
|
|
{"close", "ii"},
|
|
{"strcmp", "ipp"},
|
|
{"strncmp", "ippu"},
|
|
{"strcpy", "ppp"},
|
|
{"strncpy", "pppu"},
|
|
{"strcat", "ppp"},
|
|
{"strncat", "pppu"},
|
|
{"strtok", "ppp"},
|
|
{"strstr", "ppp"},
|
|
{"strdup", "pp"},
|
|
{"toupper", "ii", FLAG_NO_MEM},
|
|
{"tolower", "ii", FLAG_NO_MEM},
|
|
{"gethostname", "ipu"},
|
|
{"isatty", "ii"},
|
|
{"strftime", "upupp"},
|
|
{"times", "ip"},
|
|
{"clock", "i", FLAG_NO_MEM},
|
|
{"ctime", "pp"},
|
|
{"localtime", "pp"},
|
|
{"setvbuf", "ippiu"},
|
|
{"__semgetc", "ip"},
|
|
{"__semputc", "iip"},
|
|
{"fgetc", "ip"},
|
|
{"fgets", "ipip"},
|
|
{"__filbuf", "ip"},
|
|
{"__flsbuf", "iip"},
|
|
{"ungetc", "iip"},
|
|
{"gets", "pp"},
|
|
{"fread", "upuup"},
|
|
{"fwrite", "upuup"},
|
|
{"fputs", "ipp"},
|
|
{"puts", "ip"},
|
|
{"getcwd", "ppu"},
|
|
{"time", "ip"},
|
|
{"bzero", "vpu"},
|
|
{"fp_class_d", "id", FLAG_NO_MEM},
|
|
{"ldexp", "ddi", FLAG_NO_MEM},
|
|
{"__ll_mul", "lll", FLAG_NO_MEM},
|
|
{"__ll_div", "lll", FLAG_NO_MEM},
|
|
{"__ll_rem", "ljl", FLAG_NO_MEM},
|
|
{"__ll_lshift", "llj", FLAG_NO_MEM},
|
|
{"__ll_rshift", "llj", FLAG_NO_MEM},
|
|
{"__ull_div", "jjj", FLAG_NO_MEM},
|
|
{"__ull_rem", "jjj", FLAG_NO_MEM},
|
|
{"__ull_rshift", "jjj", FLAG_NO_MEM},
|
|
{"__d_to_ull", "jd", FLAG_NO_MEM},
|
|
{"__d_to_ll", "ld", FLAG_NO_MEM},
|
|
{"__f_to_ull", "jf", FLAG_NO_MEM},
|
|
{"__f_to_ll", "lf", FLAG_NO_MEM},
|
|
{"__ull_to_f", "fj", FLAG_NO_MEM},
|
|
{"__ll_to_f", "fl", FLAG_NO_MEM},
|
|
{"__ull_to_d", "dj", FLAG_NO_MEM},
|
|
{"__ll_to_d", "dl", FLAG_NO_MEM},
|
|
{"_exit", "vi"},
|
|
{"_cleanup", "v"},
|
|
{"_rld_new_interface", "pu", FLAG_VARARG},
|
|
{"_exithandle", "v"},
|
|
{"_prctl", "ii", FLAG_VARARG},
|
|
{"_atod", "dpii"},
|
|
{"pathconf", "ipi"},
|
|
{"getenv", "pp"},
|
|
{"gettxt", "ppp"},
|
|
{"setlocale", "pip"},
|
|
{"mmap", "ppuiiii"},
|
|
{"munmap", "ipu"},
|
|
{"mprotect", "ipui"},
|
|
{"sysconf", "ii"},
|
|
{"getpagesize", "i"},
|
|
{"strerror", "pi"},
|
|
{"ioctl", "iiu", FLAG_VARARG},
|
|
{"fcntl", "iii", FLAG_VARARG},
|
|
{"signal", "pit"},
|
|
{"sigset", "pit"},
|
|
{"get_fpc_csr", "i"},
|
|
{"set_fpc_csr", "ii"},
|
|
{"setjmp", "ip"},
|
|
{"longjmp", "vpi"},
|
|
{"tempnam", "ppp"},
|
|
{"tmpnam", "pp"},
|
|
{"mktemp", "pp"},
|
|
{"mkstemp", "ip"},
|
|
{"tmpfile", "p"},
|
|
{"wait", "ip"},
|
|
{"kill", "iii"},
|
|
{"execlp", "ip", FLAG_VARARG},
|
|
{"execv", "ipp"},
|
|
{"execvp", "ipp"},
|
|
{"fork", "i"},
|
|
{"system", "ip"},
|
|
{"tsearch", "pppp"},
|
|
{"tfind", "pppp"},
|
|
{"qsort", "vpuut"},
|
|
{"regcmp", "pp", FLAG_VARARG},
|
|
{"regex", "ppp", FLAG_VARARG},
|
|
{"__assert", "vppi"},
|
|
};
|
|
|
|
static void disassemble(void) {
|
|
csh handle;
|
|
cs_insn *disasm;
|
|
static size_t disasm_size;
|
|
assert(cs_open(CS_ARCH_MIPS, (cs_mode)(CS_MODE_MIPS64 | CS_MODE_BIG_ENDIAN), &handle) == CS_ERR_OK);
|
|
cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
|
|
disasm_size = cs_disasm(handle, text_section, text_section_len, text_vaddr, 0, &disasm);
|
|
for (size_t i = 0; i < disasm_size; i++) {
|
|
insns.push_back(Insn());
|
|
Insn& insn = insns.back();
|
|
insn.id = disasm[i].id;
|
|
insn.mnemonic = disasm[i].mnemonic;
|
|
insn.op_str = disasm[i].op_str;
|
|
if (disasm[i].detail != nullptr && disasm[i].detail->mips.op_count > 0) {
|
|
insn.op_count = disasm[i].detail->mips.op_count;
|
|
memcpy(insn.operands, disasm[i].detail->mips.operands, sizeof(insn.operands));
|
|
}
|
|
insn.is_jump = cs_insn_group(handle, &disasm[i], MIPS_GRP_JUMP) || insn.id == MIPS_INS_JAL || insn.id == MIPS_INS_BAL || insn.id == MIPS_INS_JALR;
|
|
insn.linked_insn = -1;
|
|
}
|
|
cs_free(disasm, disasm_size);
|
|
cs_close(&handle);
|
|
|
|
{
|
|
// Add dummy instruction to avoid out of bounds
|
|
insns.push_back(Insn());
|
|
Insn& insn = insns.back();
|
|
insn.id = MIPS_INS_NOP;
|
|
insn.mnemonic = "nop";
|
|
insn.no_following_successor = true;
|
|
}
|
|
}
|
|
|
|
static void add_function(uint32_t addr) {
|
|
if (addr >= text_vaddr && addr < text_vaddr + text_section_len) {
|
|
functions[addr];
|
|
}
|
|
}
|
|
|
|
static map<uint32_t, Function>::iterator find_function(uint32_t addr) {
|
|
if (functions.size() == 0) {
|
|
return functions.end();
|
|
}
|
|
auto it = functions.upper_bound(addr);
|
|
if (it == functions.begin()) {
|
|
return functions.end();
|
|
}
|
|
--it;
|
|
return it;
|
|
}
|
|
|
|
// try to find a matching LUI for a given register
|
|
static void link_with_lui(int offset, uint32_t reg, int mem_imm)
|
|
{
|
|
#define MAX_LOOKBACK 128
|
|
// don't attempt to compute addresses for zero offset
|
|
// end search after some sane max number of instructions
|
|
int end_search = MAX(0, offset - MAX_LOOKBACK);
|
|
for (int search = offset - 1; search >= end_search; search--) {
|
|
// use an `if` instead of `case` block to allow breaking out of the `for` loop
|
|
if (insns[search].id == MIPS_INS_LUI) {
|
|
uint32_t rd = insns[search].operands[0].reg;
|
|
if (reg == rd) {
|
|
break;
|
|
}
|
|
} else if (insns[search].id == MIPS_INS_LW ||
|
|
insns[search].id == MIPS_INS_LD ||
|
|
insns[search].id == MIPS_INS_ADDIU ||
|
|
//insns[search].id == MIPS_INS_ADDU || used in jump tables for offset
|
|
insns[search].id == MIPS_INS_ADD ||
|
|
insns[search].id == MIPS_INS_SUB ||
|
|
insns[search].id == MIPS_INS_SUBU) {
|
|
uint32_t rd = insns[search].operands[0].reg;
|
|
if (reg == rd) {
|
|
if (insns[search].id == MIPS_INS_LW && insns[search].operands[1].mem.base == MIPS_REG_GP) {
|
|
int mem_imm0 = (int)insns[search].operands[1].mem.disp;
|
|
uint32_t got_entry = (mem_imm0 + gp_value_adj) / sizeof(uint32_t);
|
|
if (got_entry < got_locals.size()) {
|
|
// used for static functions
|
|
char buf[32];
|
|
uint32_t addr = got_locals[got_entry] + mem_imm;
|
|
insns[search].linked_insn = offset;
|
|
insns[search].linked_value = addr;
|
|
insns[offset].linked_insn = search;
|
|
insns[offset].linked_value = addr;
|
|
|
|
//vaddr_references[addr].insert(text_vaddr + offset * 4);
|
|
|
|
insns[search].id = MIPS_INS_LI;
|
|
insns[search].mnemonic = "li";
|
|
sprintf(buf, "$%s, 0x%x", cs_reg_name(handle, rd), addr);
|
|
insns[search].op_str = buf;
|
|
insns[search].operands[1].type = MIPS_OP_IMM;
|
|
insns[search].operands[1].imm = addr;
|
|
|
|
switch (insns[offset].id) {
|
|
case MIPS_INS_ADDIU:
|
|
insns[offset].id = MIPS_INS_MOVE;
|
|
insns[offset].operands[1].type = MIPS_OP_REG;
|
|
insns[offset].mnemonic = "move";
|
|
sprintf(buf, "$%s, $%s", cs_reg_name(handle, insns[offset].operands[0].reg), cs_reg_name(handle, rd));
|
|
insns[offset].op_str = buf;
|
|
if (addr >= text_vaddr && addr < text_vaddr + text_section_len) {
|
|
add_function(addr);
|
|
}
|
|
break;
|
|
case MIPS_INS_LB:
|
|
case MIPS_INS_LBU:
|
|
case MIPS_INS_SB:
|
|
case MIPS_INS_LH:
|
|
case MIPS_INS_LHU:
|
|
case MIPS_INS_SH:
|
|
case MIPS_INS_LW:
|
|
case MIPS_INS_SW:
|
|
case MIPS_INS_LDC1:
|
|
case MIPS_INS_LWC1:
|
|
case MIPS_INS_SWC1:
|
|
insns[offset].operands[1].mem.disp = 0;
|
|
sprintf(buf, "$%s, ($%s)", cs_reg_name(handle, insns[offset].operands[0].reg), cs_reg_name(handle, rd));
|
|
insns[offset].op_str = buf;
|
|
break;
|
|
default:
|
|
assert(0);
|
|
}
|
|
}
|
|
break;
|
|
} else {
|
|
// ignore: reg is pointer, offset is probably struct data member
|
|
break;
|
|
}
|
|
}
|
|
} else if (insns[search].id == MIPS_INS_JR &&
|
|
insns[search].operands[0].reg == MIPS_REG_RA && offset - search >= 2) {
|
|
// stop looking when previous `jr ra` is hit,
|
|
// but ignore if `offset` is branch delay slot for this `jr ra`
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
// for a given `jalr t9`, find the matching t9 load
|
|
static void link_with_jalr(int offset)
|
|
{
|
|
// end search after some sane max number of instructions
|
|
int end_search = MAX(0, offset - MAX_LOOKBACK);
|
|
for (int search = offset - 1; search >= end_search; search--) {
|
|
if (insns[search].operands[0].reg == MIPS_REG_T9) {
|
|
if (insns[search].id == MIPS_INS_LW || insns[search].id == MIPS_INS_LI) {
|
|
if (insns[search].is_global_got_memop || insns[search].id == MIPS_INS_LI) {
|
|
char buf[32];
|
|
sprintf(buf, "0x%x", insns[search].linked_value);
|
|
insns[search].linked_insn = offset;
|
|
insns[offset].linked_insn = search;
|
|
insns[offset].linked_value = insns[search].linked_value;
|
|
//insns[offset].label = insns[search].label;
|
|
//function_entry_points.insert(insns[search].linked_value);
|
|
insns[offset].id = MIPS_INS_JAL;
|
|
insns[offset].mnemonic = "jal";
|
|
insns[offset].op_str = buf;
|
|
insns[offset].operands[0].type = MIPS_OP_IMM;
|
|
insns[offset].operands[0].imm = insns[search].linked_value;
|
|
insns[search].id = MIPS_INS_NOP;
|
|
insns[search].mnemonic = "nop";
|
|
insns[search].op_str = "";
|
|
insns[search].is_global_got_memop = false;
|
|
add_function(insns[search].linked_value);
|
|
}
|
|
break;
|
|
} else if (insns[search].id == MIPS_INS_ADDIU) {
|
|
if (insns[search].linked_insn != -1) {
|
|
//function_entry_points.insert(insns[search].linked_value);
|
|
uint32_t first = insns[search].linked_insn;
|
|
insns[search].linked_insn = offset;
|
|
insns[offset].linked_insn = first;
|
|
insns[offset].linked_value = insns[search].linked_value;
|
|
}
|
|
break;
|
|
} else if (insns[search].id == MIPS_INS_LI) {
|
|
if (insns[search].linked_insn != -1) {
|
|
//function_entry_points.insert(insns[search].linked_value);
|
|
uint32_t first = insns[search].linked_insn;
|
|
insns[search].linked_insn = offset;
|
|
insns[offset].linked_insn = first;
|
|
insns[offset].linked_value = insns[search].linked_value;
|
|
insns[search].id = MIPS_INS_NOP;
|
|
insns[search].mnemonic = "nop";
|
|
insns[search].op_str = "";
|
|
}
|
|
break;
|
|
} else if (insns[search].id == MIPS_INS_LD ||
|
|
insns[search].id == MIPS_INS_ADDU ||
|
|
insns[search].id == MIPS_INS_ADD ||
|
|
insns[search].id == MIPS_INS_SUB ||
|
|
insns[search].id == MIPS_INS_SUBU) {
|
|
break;
|
|
}
|
|
} else if (insns[search].id == MIPS_INS_JR &&
|
|
insns[search].operands[0].reg == MIPS_REG_RA)
|
|
{
|
|
// stop looking when previous `jr ra` is hit
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void pass1(void) {
|
|
for (size_t i = 0; i < insns.size(); i++) {
|
|
Insn& insn = insns[i];
|
|
if (insn.id == MIPS_INS_BAL) {
|
|
insn.id = MIPS_INS_JAL;
|
|
insn.mnemonic = "jal";
|
|
}
|
|
if (insn.is_jump) {
|
|
if (insn.id == MIPS_INS_JAL || insn.id == MIPS_INS_J) {
|
|
uint32_t target = (uint32_t)insn.operands[0].imm;
|
|
label_addresses.insert(target);
|
|
add_function(target);
|
|
} else if (insn.id == MIPS_INS_JR) {
|
|
// sltiu $at, $ty, z
|
|
// sw $reg, offset($sp) (very seldom, one or more, usually in func entry)
|
|
// lw $gp, offset($sp) (if PIC, and very seldom)
|
|
// beqz $at, .L
|
|
// some other instruction (not always)
|
|
// lui $at, %hi(jtbl)
|
|
// sll $tx, $ty, 2
|
|
// addu $at, $at, $tx
|
|
// lw $tx, %lo(jtbl)($at)
|
|
// nop (code compiled with 5.3)
|
|
// addu $tx, $tx, $gp (if PIC)
|
|
// jr $tx
|
|
|
|
// IDO 7.1:
|
|
//lw at,offset(gp)
|
|
//andi t9,t8,0x3f
|
|
//sll t9,t9,0x2
|
|
//addu at,at,t9
|
|
//lw t9,offset(at)
|
|
//addu t9,t9,gp
|
|
//jr t9
|
|
|
|
// IDO 5.3:
|
|
//lw at,offset(gp)
|
|
//andi t3,t2,0x3f
|
|
//sll t3,t3,0x2
|
|
//addu at,at,t3
|
|
//something
|
|
//lw t3,offset(at)
|
|
//something
|
|
//addu t3,t3,gp
|
|
//jr t3
|
|
if (i >= 7 && rodata_section != NULL) {
|
|
bool is_pic = insns[i - 1].id == MIPS_INS_ADDU && insns[i - 1].operands[2].reg == MIPS_REG_GP;
|
|
bool has_nop = insns[i - is_pic - 1].id == MIPS_INS_NOP;
|
|
bool has_extra = insns[i - is_pic - has_nop - 5].id != MIPS_INS_BEQZ;
|
|
int lw = i - is_pic - has_nop - 1;
|
|
if (insns[lw].id != MIPS_INS_LW) {
|
|
--lw;
|
|
}
|
|
if (insns[lw].id == MIPS_INS_LW && insns[lw].linked_insn != -1) {
|
|
int sltiu_index = -1;
|
|
int andi_index = -1;
|
|
uint32_t addu_index = lw - 1;
|
|
uint32_t num_cases;
|
|
bool found = false;
|
|
bool and_variant = false;
|
|
int end = 14;
|
|
if (insns[addu_index].id != MIPS_INS_ADDU) {
|
|
--addu_index;
|
|
}
|
|
mips_reg index_reg = (mips_reg)insns[addu_index - 1].operands[1].reg;
|
|
if (insns[addu_index].id != MIPS_INS_ADDU) {
|
|
goto skip;
|
|
}
|
|
if (insns[addu_index - 1].id != MIPS_INS_SLL) {
|
|
goto skip;
|
|
}
|
|
if (insns[addu_index - 1].operands[0].reg != insn.operands[0].reg) {
|
|
goto skip;
|
|
}
|
|
for (int j = 3; j <= 4; j++) {
|
|
if (insns[lw - j].id == MIPS_INS_ANDI) {
|
|
andi_index = lw - j;
|
|
break;
|
|
}
|
|
}
|
|
if (i == 368393) {
|
|
// In copt
|
|
end = 18;
|
|
}
|
|
for (int j = 5; j <= end; j++) {
|
|
if (insns[lw - has_extra - j].id == MIPS_INS_SLTIU &&
|
|
insns[lw - has_extra - j].operands[0].reg == MIPS_REG_AT)
|
|
{
|
|
sltiu_index = j;
|
|
break;
|
|
}
|
|
if (insns[lw - has_extra - j].id == MIPS_INS_JR) {
|
|
// Prevent going into a previous switch
|
|
break;
|
|
}
|
|
}
|
|
if (sltiu_index != -1) {
|
|
andi_index = -1;
|
|
}
|
|
if (sltiu_index != -1 && insns[lw - has_extra - sltiu_index].id == MIPS_INS_SLTIU) {
|
|
num_cases = insns[lw - has_extra - sltiu_index].operands[2].imm;
|
|
found = true;
|
|
} else if (andi_index != -1) {
|
|
num_cases = insns[andi_index].operands[2].imm + 1;
|
|
found = true;
|
|
and_variant = true;
|
|
} else if (i == 219382) {
|
|
// Special hard case in copt where the initial sltiu is in another basic block
|
|
found = true;
|
|
num_cases = 13;
|
|
} else if (i == 370995) {
|
|
// Special hard case in copt where the initial sltiu is in another basic block
|
|
found = true;
|
|
num_cases = 12;
|
|
}
|
|
if (found) {
|
|
uint32_t jtbl_addr = insns[lw].linked_value;
|
|
if (is_pic) {
|
|
insns[i - 1].id = MIPS_INS_NOP;
|
|
}
|
|
//printf("jump table at %08x, size %u\n", jtbl_addr, num_cases);
|
|
insn.jtbl_addr = jtbl_addr;
|
|
insn.num_cases = num_cases;
|
|
insn.index_reg = index_reg;
|
|
insns[lw].id = MIPS_INS_NOP;
|
|
insns[addu_index].id = MIPS_INS_NOP;
|
|
insns[addu_index - 1].id = MIPS_INS_NOP;
|
|
if (!and_variant) {
|
|
insns[addu_index - 2].id = MIPS_INS_NOP;
|
|
}
|
|
|
|
if (jtbl_addr < rodata_vaddr || jtbl_addr + num_cases * sizeof(uint32_t) > rodata_vaddr + rodata_section_len) {
|
|
fprintf(stderr, "jump table outside rodata\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
for (uint32_t i = 0; i < num_cases; i++) {
|
|
uint32_t target_addr = read_u32_be(rodata_section + (jtbl_addr - rodata_vaddr) + i * sizeof(uint32_t));
|
|
target_addr += gp_value;
|
|
//printf("%08X\n", target_addr);
|
|
label_addresses.insert(target_addr);
|
|
}
|
|
}
|
|
skip:;
|
|
}
|
|
}
|
|
} else {
|
|
for (int j = 0; j < insn.op_count; j++) {
|
|
if (insn.operands[j].type == MIPS_OP_IMM) {
|
|
uint32_t target = (uint32_t)insn.operands[j].imm;
|
|
label_addresses.insert(target);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
switch (insns[i].id) {
|
|
// find floating point LI
|
|
case MIPS_INS_MTC1:
|
|
{
|
|
unsigned int rt = insns[i].operands[0].reg;
|
|
for (int s = i - 1; s >= 0; s--) {
|
|
if (insns[s].id == MIPS_INS_LUI && insns[s].operands[0].reg == rt) {
|
|
float f;
|
|
uint32_t lui_imm = (uint32_t)(insns[s].operands[1].imm << 16);
|
|
memcpy(&f, &lui_imm, sizeof(f));
|
|
insns[s].operands[1].imm <<= 16;
|
|
// link up the LUI with this instruction and the float
|
|
insns[s].linked_insn = i;
|
|
insns[s].linked_float = f;
|
|
// rewrite LUI instruction to be LI
|
|
insns[s].id = MIPS_INS_LI;
|
|
insns[s].mnemonic = "li";
|
|
break;
|
|
} else if (insns[s].id == MIPS_INS_LW ||
|
|
insns[s].id == MIPS_INS_LD ||
|
|
insns[s].id == MIPS_INS_LH ||
|
|
insns[s].id == MIPS_INS_LHU ||
|
|
insns[s].id == MIPS_INS_LB ||
|
|
insns[s].id == MIPS_INS_LBU ||
|
|
insns[s].id == MIPS_INS_ADDIU ||
|
|
insns[s].id == MIPS_INS_ADD ||
|
|
insns[s].id == MIPS_INS_SUB ||
|
|
insns[s].id == MIPS_INS_SUBU) {
|
|
unsigned int rd = insns[s].operands[0].reg;
|
|
if (rt == rd) {
|
|
break;
|
|
}
|
|
} else if (insns[s].id == MIPS_INS_JR &&
|
|
insns[s].operands[0].reg == MIPS_REG_RA) {
|
|
// stop looking when previous `jr ra` is hit
|
|
break;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
case MIPS_INS_SD:
|
|
case MIPS_INS_SW:
|
|
case MIPS_INS_SH:
|
|
case MIPS_INS_SB:
|
|
case MIPS_INS_LB:
|
|
case MIPS_INS_LBU:
|
|
case MIPS_INS_LD:
|
|
case MIPS_INS_LDL:
|
|
case MIPS_INS_LDR:
|
|
case MIPS_INS_LH:
|
|
case MIPS_INS_LHU:
|
|
case MIPS_INS_LW:
|
|
case MIPS_INS_LWU:
|
|
case MIPS_INS_LDC1:
|
|
case MIPS_INS_LWC1:
|
|
case MIPS_INS_LWC2:
|
|
case MIPS_INS_LWC3:
|
|
case MIPS_INS_SWC1:
|
|
case MIPS_INS_SWC2:
|
|
case MIPS_INS_SWC3:
|
|
{
|
|
unsigned int mem_rs = insns[i].operands[1].mem.base;
|
|
int mem_imm = (int)insns[i].operands[1].mem.disp;
|
|
if (mem_rs == MIPS_REG_GP) {
|
|
unsigned int got_entry = (mem_imm + gp_value_adj) / sizeof(unsigned int);
|
|
if (got_entry >= got_locals.size()) {
|
|
got_entry -= got_locals.size();
|
|
if (got_entry < got_globals.size()) {
|
|
assert(insn.id == MIPS_INS_LW);
|
|
//printf("gp 0x%08x %s\n", mem_imm, got_globals[got_entry].name);
|
|
unsigned int dest_vaddr = got_globals[got_entry];
|
|
insns[i].is_global_got_memop = true;
|
|
insns[i].linked_value = dest_vaddr;
|
|
//insns[i].label = got_globals[got_entry].name;
|
|
|
|
//vaddr_references[dest_vaddr].insert(vaddr + i * 4);
|
|
//disasm_add_data_addr(state, dest_vaddr);
|
|
insns[i].id = MIPS_INS_LI;
|
|
insns[i].operands[1].imm = dest_vaddr;
|
|
char buf[32];
|
|
sprintf(buf, "$%s, 0x%x", cs_reg_name(handle, insn.operands[0].reg), dest_vaddr);
|
|
insns[i].op_str = buf;
|
|
}
|
|
}
|
|
} else {
|
|
link_with_lui(i, mem_rs, mem_imm);
|
|
}
|
|
break;
|
|
}
|
|
case MIPS_INS_ADDIU:
|
|
case MIPS_INS_ORI:
|
|
{
|
|
unsigned int rd = insns[i].operands[0].reg;
|
|
unsigned int rs = insns[i].operands[1].reg;
|
|
int64_t imm = insns[i].operands[2].imm;
|
|
if (rs == MIPS_REG_ZERO) { // becomes LI
|
|
char buf[32];
|
|
insns[i].id = MIPS_INS_LI;
|
|
insns[i].operands[1].imm = imm;
|
|
insns[i].mnemonic = "li";
|
|
sprintf(buf, "$%s, %" PRIi64, cs_reg_name(handle, rd), imm);
|
|
insns[i].op_str = buf;
|
|
} else if (/*rd == rs &&*/ rd != MIPS_REG_GP) { // only look for LUI if rd and rs are the same
|
|
link_with_lui(i, rs, (int)imm);
|
|
}
|
|
break;
|
|
}
|
|
case MIPS_INS_JALR:
|
|
{
|
|
unsigned int r = insn.operands[0].reg;
|
|
if (r == MIPS_REG_T9) {
|
|
link_with_jalr(i);
|
|
if (insn.linked_insn != -1) {
|
|
char buf[32];
|
|
sprintf(buf, "0x%x", insn.linked_value);
|
|
insn.id = MIPS_INS_JAL;
|
|
insn.mnemonic = "jal";
|
|
insn.op_str = buf;
|
|
insn.operands[0].type = MIPS_OP_IMM;
|
|
insn.operands[0].imm = insn.linked_value;
|
|
label_addresses.insert(insn.linked_value);
|
|
add_function(insn.linked_value);
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
if (insn.id == MIPS_INS_ADDU && insn.operands[0].reg == MIPS_REG_GP && insn.operands[1].reg == MIPS_REG_GP && insn.operands[2].reg == MIPS_REG_T9 && i >= 2) {
|
|
//state->function_entry_points.insert(vaddr + (i - 2) * 4);
|
|
for (int j = i - 2; j <= i; j++) {
|
|
insns[j].id = MIPS_INS_NOP;
|
|
insns[j].mnemonic = "nop";
|
|
insns[j].op_str = "";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
static uint32_t addr_to_i(uint32_t addr) {
|
|
return (addr - text_vaddr) / 4;
|
|
}
|
|
|
|
static void pass2(void) {
|
|
// Find returns in each function
|
|
for (size_t i = 0; i < insns.size(); i++) {
|
|
uint32_t addr = text_vaddr + i * 4;
|
|
Insn& insn = insns[i];
|
|
if (insn.id == MIPS_INS_JR && insn.operands[0].reg == MIPS_REG_RA) {
|
|
auto it = find_function(addr);
|
|
assert(it != functions.end());
|
|
it->second.returns.push_back(addr + 4);
|
|
}
|
|
if (insn.is_global_got_memop && text_vaddr <= insn.operands[1].imm && insn.operands[1].imm < text_vaddr + text_section_len) {
|
|
uint32_t faddr = insn.operands[1].imm;
|
|
li_function_pointers.insert(faddr);
|
|
functions[faddr].referenced_by_function_pointer = true;
|
|
#if INSPECT_FUNCTION_POINTERS
|
|
fprintf(stderr, "li function pointer: 0x%x at 0x%x\n", faddr, addr);
|
|
#endif
|
|
}
|
|
}
|
|
for (auto it = functions.begin(); it != functions.end(); ++it) {
|
|
if (it->second.returns.size() == 0) {
|
|
uint32_t i = addr_to_i(it->first);
|
|
auto str_it = symbol_names.find(it->first);
|
|
if (str_it != symbol_names.end() && str_it->second == "__start") {
|
|
|
|
} else if (str_it != symbol_names.end() && str_it->second == "xmalloc") {
|
|
// orig 5.3:
|
|
/*
|
|
496bf4: 3c1c0fb9 lui gp,0xfb9
|
|
496bf8: 279c366c addiu gp,gp,13932
|
|
496bfc: 0399e021 addu gp,gp,t9
|
|
496c00: 27bdffd8 addiu sp,sp,-40
|
|
496c04: 8f858de8 lw a1,-29208(gp)
|
|
496c08: 10000006 b 496c24 <alloc_new+0x14>
|
|
496c0c: afbf0020 sw ra,32(sp)
|
|
*/
|
|
|
|
// jal alloc_new
|
|
// lui $a1, malloc_scb
|
|
// jr $ra
|
|
// nop
|
|
uint32_t alloc_new_addr = text_vaddr + (i + 7) * 4;
|
|
insns[i].id = MIPS_INS_JAL;
|
|
insns[i].op_count = 1;
|
|
insns[i].mnemonic = "jal";
|
|
insns[i].op_str = "alloc_new";
|
|
insns[i].operands[0].imm = alloc_new_addr;
|
|
assert(symbol_names.count(alloc_new_addr) && symbol_names[alloc_new_addr] == "alloc_new");
|
|
i++;
|
|
if (insns[i + 5].id == MIPS_INS_LI) {
|
|
// 7.1
|
|
insns[i] = insns[i + 5];
|
|
} else {
|
|
// 5.3
|
|
insns[i] = insns[i + 3];
|
|
}
|
|
i++;
|
|
insns[i].id = MIPS_INS_JR;
|
|
insns[i].op_count = 1;
|
|
insns[i].mnemonic = "jr";
|
|
insns[i].op_str = "$ra";
|
|
insns[i].operands[0].reg = MIPS_REG_RA;
|
|
it->second.returns.push_back(text_vaddr + i * 4 + 4);
|
|
i++;
|
|
for (uint32_t j = 0; j < 4; j++) {
|
|
insns[i].id = MIPS_INS_NOP;
|
|
insns[i].op_count = 0;
|
|
insns[i].mnemonic = "nop";
|
|
i++;
|
|
}
|
|
} else if (str_it != symbol_names.end() && str_it->second == "xfree") {
|
|
// jal alloc_dispose
|
|
// lui $a1, malloc_scb
|
|
// jr $ra
|
|
// nop
|
|
uint32_t alloc_dispose_addr = text_vaddr + (i + 4) * 4;
|
|
if (symbol_names.count(alloc_dispose_addr + 4) && symbol_names[alloc_dispose_addr + 4] == "alloc_dispose") {
|
|
alloc_dispose_addr += 4;
|
|
}
|
|
insns[i].id = MIPS_INS_JAL;
|
|
insns[i].op_count = 1;
|
|
insns[i].mnemonic = "jal";
|
|
insns[i].op_str = "alloc_dispose";
|
|
insns[i].operands[0].imm = alloc_dispose_addr;
|
|
assert(symbol_names.count(alloc_dispose_addr) && symbol_names[alloc_dispose_addr] == "alloc_dispose");
|
|
i++;
|
|
insns[i] = insns[i + 2];
|
|
i++;
|
|
insns[i].id = MIPS_INS_JR;
|
|
insns[i].op_count = 1;
|
|
insns[i].mnemonic = "jr";
|
|
insns[i].op_str = "$ra";
|
|
insns[i].operands[0].reg = MIPS_REG_RA;
|
|
it->second.returns.push_back(text_vaddr + i * 4 + 4);
|
|
i++;
|
|
insns[i].id = MIPS_INS_NOP;
|
|
insns[i].op_count = 0;
|
|
insns[i].mnemonic = "nop";
|
|
} else if (insns[i].id == MIPS_INS_LW && insns[i + 1].id == MIPS_INS_MOVE && insns[i + 2].id == MIPS_INS_JALR) {
|
|
/*
|
|
408f50: 8f998010 lw t9,-32752(gp)
|
|
408f54: 03e07821 move t7,ra
|
|
408f58: 0320f809 jalr t9
|
|
*/
|
|
} else if (it->first > mcount_addr) {
|
|
fprintf(stderr, "no ret: 0x%x\n", it->first);
|
|
abort();
|
|
}
|
|
}
|
|
auto next = it;
|
|
++next;
|
|
if (next == functions.end()) {
|
|
it->second.end_addr = text_vaddr + text_section_len;
|
|
} else {
|
|
it->second.end_addr = next->first;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void add_edge(uint32_t from, uint32_t to, bool function_entry = false, bool function_exit = false, bool extern_function = false, bool function_pointer = false) {
|
|
Edge fe = Edge(), be = Edge();
|
|
fe.i = to;
|
|
be.i = from;
|
|
fe.function_entry = function_entry;
|
|
be.function_entry = function_entry;
|
|
fe.function_exit = function_exit;
|
|
be.function_exit = function_exit;
|
|
fe.extern_function = extern_function;
|
|
be.extern_function = extern_function;
|
|
fe.function_pointer = function_pointer;
|
|
be.function_pointer = function_pointer;
|
|
insns[from].successors.push_back(fe);
|
|
insns[to].predecessors.push_back(be);
|
|
}
|
|
|
|
static void pass3(void) {
|
|
// Build graph
|
|
for (size_t i = 0; i < insns.size(); i++) {
|
|
uint32_t addr = text_vaddr + i * 4;
|
|
Insn& insn = insns[i];
|
|
if (insn.no_following_successor) {
|
|
continue;
|
|
}
|
|
switch (insn.id) {
|
|
case MIPS_INS_BEQ:
|
|
case MIPS_INS_BGEZ:
|
|
case MIPS_INS_BGTZ:
|
|
case MIPS_INS_BLEZ:
|
|
case MIPS_INS_BLTZ:
|
|
case MIPS_INS_BNE:
|
|
case MIPS_INS_BEQZ:
|
|
case MIPS_INS_BNEZ:
|
|
case MIPS_INS_BC1F:
|
|
case MIPS_INS_BC1T:
|
|
add_edge(i, i + 1);
|
|
add_edge(i + 1, addr_to_i((uint32_t)insn.operands[insn.op_count - 1].imm));
|
|
break;
|
|
|
|
case MIPS_INS_BEQL:
|
|
case MIPS_INS_BGEZL:
|
|
case MIPS_INS_BGTZL:
|
|
case MIPS_INS_BLEZL:
|
|
case MIPS_INS_BLTZL:
|
|
case MIPS_INS_BNEL:
|
|
case MIPS_INS_BC1FL:
|
|
case MIPS_INS_BC1TL:
|
|
add_edge(i, i + 1);
|
|
add_edge(i, i + 2);
|
|
add_edge(i + 1, addr_to_i((uint32_t)insn.operands[insn.op_count - 1].imm));
|
|
insns[i + 1].no_following_successor = true; // don't inspect delay slot
|
|
break;
|
|
|
|
case MIPS_INS_B:
|
|
case MIPS_INS_J:
|
|
add_edge(i, i + 1);
|
|
add_edge(i + 1, addr_to_i((uint32_t)insn.operands[0].imm));
|
|
insns[i + 1].no_following_successor = true; // don't inspect delay slot
|
|
break;
|
|
|
|
case MIPS_INS_JR: {
|
|
add_edge(i, i + 1);
|
|
if (insn.jtbl_addr != 0) {
|
|
uint32_t jtbl_pos = insn.jtbl_addr - rodata_vaddr;
|
|
assert(jtbl_pos < rodata_section_len && jtbl_pos + insn.num_cases * 4 <= rodata_section_len);
|
|
for (uint32_t j = 0; j < insn.num_cases; j++) {
|
|
uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + j * 4) + gp_value;
|
|
add_edge(i + 1, addr_to_i(dest_addr));
|
|
}
|
|
} else {
|
|
assert(insn.operands[0].reg == MIPS_REG_RA && "jump to address in register not supported");
|
|
}
|
|
insns[i + 1].no_following_successor = true; // don't inspect delay slot
|
|
break;
|
|
}
|
|
|
|
case MIPS_INS_JAL: {
|
|
add_edge(i, i + 1);
|
|
uint32_t dest = (uint32_t)insn.operands[0].imm;
|
|
if (dest > mcount_addr && dest >= text_vaddr && dest < text_vaddr + text_section_len) {
|
|
add_edge(i + 1, addr_to_i(dest), true);
|
|
auto it = functions.find(dest);
|
|
assert(it != functions.end());
|
|
for (uint32_t ret_instr : it->second.returns) {
|
|
add_edge(addr_to_i(ret_instr), i + 2, false, true);
|
|
}
|
|
} else {
|
|
add_edge(i + 1, i + 2, false, false, true);
|
|
}
|
|
insns[i + 1].no_following_successor = true; // don't inspect delay slot
|
|
break;
|
|
}
|
|
|
|
case MIPS_INS_JALR:
|
|
// function pointer
|
|
add_edge(i, i + 1);
|
|
add_edge(i + 1, i + 2, false, false, false, true);
|
|
insns[i + 1].no_following_successor = true; // don't inspect delay slot
|
|
break;
|
|
|
|
default:
|
|
add_edge(i, i + 1);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
static uint64_t map_reg(int32_t reg) {
|
|
if (reg > MIPS_REG_31) {
|
|
if (reg == MIPS_REG_HI) {
|
|
reg = MIPS_REG_31 + 1;
|
|
} else if (reg == MIPS_REG_LO) {
|
|
reg = MIPS_REG_31 + 2;
|
|
} else {
|
|
return 0;
|
|
}
|
|
}
|
|
return (uint64_t)1 << (reg - MIPS_REG_0 + 1);
|
|
}
|
|
|
|
static uint64_t temporary_regs(void) {
|
|
return
|
|
map_reg(MIPS_REG_T0) |
|
|
map_reg(MIPS_REG_T1) |
|
|
map_reg(MIPS_REG_T2) |
|
|
map_reg(MIPS_REG_T3) |
|
|
map_reg(MIPS_REG_T4) |
|
|
map_reg(MIPS_REG_T5) |
|
|
map_reg(MIPS_REG_T6) |
|
|
map_reg(MIPS_REG_T7) |
|
|
map_reg(MIPS_REG_T8) |
|
|
map_reg(MIPS_REG_T9);
|
|
}
|
|
|
|
typedef enum {
|
|
TYPE_NOP,
|
|
TYPE_1S,
|
|
TYPE_2S,
|
|
TYPE_1D,
|
|
TYPE_1D_1S,
|
|
TYPE_1D_2S,
|
|
TYPE_D_LO_HI_2S,
|
|
TYPE_1S_POS1
|
|
} TYPE;
|
|
static TYPE insn_to_type(Insn& i) {
|
|
switch (i.id) {
|
|
case MIPS_INS_ADD:
|
|
case MIPS_INS_ADDU:
|
|
if (i.mnemonic != "add.s" && i.mnemonic != "add.d") {
|
|
return TYPE_1D_2S;
|
|
} else {
|
|
return TYPE_NOP;
|
|
}
|
|
|
|
case MIPS_INS_ADDI:
|
|
case MIPS_INS_ADDIU:
|
|
case MIPS_INS_ANDI:
|
|
case MIPS_INS_ORI:
|
|
case MIPS_INS_LB:
|
|
case MIPS_INS_LBU:
|
|
case MIPS_INS_LH:
|
|
case MIPS_INS_LHU:
|
|
case MIPS_INS_LW:
|
|
case MIPS_INS_LWL:
|
|
//case MIPS_INS_LWR:
|
|
case MIPS_INS_MOVE:
|
|
case MIPS_INS_NEGU:
|
|
case MIPS_INS_NOT:
|
|
case MIPS_INS_SLL:
|
|
case MIPS_INS_SLTI:
|
|
case MIPS_INS_SLTIU:
|
|
case MIPS_INS_SRA:
|
|
case MIPS_INS_SRL:
|
|
case MIPS_INS_XORI:
|
|
return TYPE_1D_1S;
|
|
|
|
case MIPS_INS_MFHI:
|
|
i.operands[1].reg = MIPS_REG_HI;
|
|
return TYPE_1D_1S;
|
|
|
|
case MIPS_INS_MFLO:
|
|
i.operands[1].reg = MIPS_REG_LO;
|
|
return TYPE_1D_1S;
|
|
|
|
case MIPS_INS_AND:
|
|
case MIPS_INS_OR:
|
|
case MIPS_INS_NOR:
|
|
case MIPS_INS_SLLV:
|
|
case MIPS_INS_SLT:
|
|
case MIPS_INS_SLTU:
|
|
case MIPS_INS_SRAV:
|
|
case MIPS_INS_SRLV:
|
|
case MIPS_INS_SUBU:
|
|
case MIPS_INS_XOR:
|
|
return TYPE_1D_2S;
|
|
|
|
case MIPS_INS_CFC1:
|
|
case MIPS_INS_MFC1:
|
|
case MIPS_INS_LI:
|
|
case MIPS_INS_LUI:
|
|
return TYPE_1D;
|
|
|
|
case MIPS_INS_CTC1:
|
|
case MIPS_INS_BGEZ:
|
|
case MIPS_INS_BGEZL:
|
|
case MIPS_INS_BGTZ:
|
|
case MIPS_INS_BGTZL:
|
|
case MIPS_INS_BLEZ:
|
|
case MIPS_INS_BLEZL:
|
|
case MIPS_INS_BLTZ:
|
|
case MIPS_INS_BLTZL:
|
|
case MIPS_INS_BEQZ:
|
|
case MIPS_INS_BNEZ:
|
|
case MIPS_INS_MTC1:
|
|
return TYPE_1S;
|
|
|
|
case MIPS_INS_BEQ:
|
|
case MIPS_INS_BEQL:
|
|
case MIPS_INS_BNE:
|
|
case MIPS_INS_BNEL:
|
|
case MIPS_INS_SB:
|
|
case MIPS_INS_SH:
|
|
case MIPS_INS_SW:
|
|
case MIPS_INS_SWL:
|
|
//case MIPS_INS_SWR:
|
|
case MIPS_INS_TNE:
|
|
case MIPS_INS_TEQ:
|
|
case MIPS_INS_TGE:
|
|
case MIPS_INS_TGEU:
|
|
case MIPS_INS_TLT:
|
|
return TYPE_2S;
|
|
|
|
case MIPS_INS_DIV:
|
|
if (i.mnemonic != "div.s" && i.mnemonic != "div.d") {
|
|
return TYPE_D_LO_HI_2S;
|
|
} else {
|
|
return TYPE_NOP;
|
|
}
|
|
|
|
case MIPS_INS_DIVU:
|
|
case MIPS_INS_MULT:
|
|
case MIPS_INS_MULTU:
|
|
return TYPE_D_LO_HI_2S;
|
|
|
|
case MIPS_INS_NEG:
|
|
if (i.mnemonic != "neg.s" && i.mnemonic != "neg.d") {
|
|
return TYPE_1D_1S;
|
|
} else {
|
|
return TYPE_NOP;
|
|
}
|
|
|
|
case MIPS_INS_JALR:
|
|
return TYPE_1S;
|
|
|
|
case MIPS_INS_JR:
|
|
if (i.jtbl_addr != 0) {
|
|
i.operands[0].reg = i.index_reg;
|
|
}
|
|
if (i.operands[0].reg == MIPS_REG_RA) {
|
|
return TYPE_NOP;
|
|
}
|
|
return TYPE_1S;
|
|
|
|
case MIPS_INS_LWC1:
|
|
case MIPS_INS_LDC1:
|
|
case MIPS_INS_SWC1:
|
|
case MIPS_INS_SDC1:
|
|
return TYPE_1S_POS1;
|
|
|
|
default:
|
|
return TYPE_NOP;
|
|
}
|
|
}
|
|
|
|
static void pass4(void) {
|
|
vector<uint32_t> q;
|
|
uint64_t livein_func_start = 1U | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) | map_reg(MIPS_REG_SP) | map_reg(MIPS_REG_ZERO);
|
|
|
|
q.push_back(main_addr);
|
|
insns[addr_to_i(main_addr)].f_livein = livein_func_start;
|
|
|
|
for (auto& it : data_function_pointers) {
|
|
q.push_back(it.second);
|
|
insns[addr_to_i(it.second)].f_livein = livein_func_start | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
|
|
}
|
|
for (auto& addr : li_function_pointers) {
|
|
q.push_back(addr);
|
|
insns[addr_to_i(addr)].f_livein = livein_func_start | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
|
|
}
|
|
|
|
while (!q.empty()) {
|
|
uint32_t addr = q.back();
|
|
q.pop_back();
|
|
uint32_t idx = addr_to_i(addr);
|
|
Insn& i = insns[idx];
|
|
uint64_t live = i.f_livein | 1;
|
|
switch (insn_to_type(i)) {
|
|
case TYPE_1D:
|
|
live |= map_reg(i.operands[0].reg);
|
|
break;
|
|
|
|
case TYPE_1D_1S:
|
|
if (live & map_reg(i.operands[1].reg)) {
|
|
live |= map_reg(i.operands[0].reg);
|
|
}
|
|
break;
|
|
|
|
case TYPE_1D_2S:
|
|
if ((live & map_reg(i.operands[1].reg)) && (live & map_reg(i.operands[2].reg))) {
|
|
live |= map_reg(i.operands[0].reg);
|
|
}
|
|
break;
|
|
|
|
case TYPE_D_LO_HI_2S:
|
|
if ((live & map_reg(i.operands[0].reg)) && (live & map_reg(i.operands[1].reg))) {
|
|
live |= map_reg(MIPS_REG_LO);
|
|
live |= map_reg(MIPS_REG_HI);
|
|
}
|
|
break;
|
|
}
|
|
if ((i.f_liveout | live) == i.f_liveout) {
|
|
// No new bits
|
|
continue;
|
|
}
|
|
live |= i.f_liveout;
|
|
i.f_liveout = live;
|
|
|
|
bool function_entry = false;
|
|
for (Edge& e : i.successors) {
|
|
uint64_t new_live = live;
|
|
if (e.function_exit) {
|
|
new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1) | map_reg(MIPS_REG_ZERO);
|
|
} else if (e.function_entry) {
|
|
new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_SP) | map_reg(MIPS_REG_ZERO);
|
|
function_entry = true;
|
|
} else if (e.extern_function) {
|
|
string name;
|
|
bool is_extern_function = false;
|
|
size_t extern_function_id;
|
|
auto it = symbol_names.find(insns[idx - 1].operands[0].imm);
|
|
if (it != symbol_names.end()) {
|
|
name = it->second;
|
|
for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
|
|
if (name == extern_functions[i].name) {
|
|
is_extern_function = true;
|
|
extern_function_id = i;
|
|
break;
|
|
}
|
|
}
|
|
if (!is_extern_function) {
|
|
fprintf(stderr, "missing extern function: %s\n", name.c_str());
|
|
}
|
|
}
|
|
assert(is_extern_function);
|
|
auto& fn = extern_functions[extern_function_id];
|
|
char ret_type = fn.params[0];
|
|
new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
switch (ret_type) {
|
|
case 'i':
|
|
case 'u':
|
|
case 'p':
|
|
new_live |= map_reg(MIPS_REG_V0);
|
|
break;
|
|
case 'f':
|
|
break;
|
|
case 'd':
|
|
break;
|
|
case 'v':
|
|
break;
|
|
case 'l':
|
|
case 'j':
|
|
new_live |= map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
|
|
break;
|
|
}
|
|
} else if (e.function_pointer) {
|
|
new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
new_live |= map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
|
|
}
|
|
if ((insns[e.i].f_livein | new_live) != insns[e.i].f_livein) {
|
|
insns[e.i].f_livein |= new_live;
|
|
q.push_back(text_vaddr + e.i * 4);
|
|
}
|
|
}
|
|
if (function_entry) {
|
|
// add one edge that skips the function call, for callee-saved register liveness propagation
|
|
live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
if ((insns[idx + 1].f_livein | live) != insns[idx + 1].f_livein) {
|
|
insns[idx + 1].f_livein |= live;
|
|
q.push_back(text_vaddr + (idx + 1) * 4);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
static void pass5(void) {
|
|
vector<uint32_t> q;
|
|
|
|
assert(functions.count(main_addr));
|
|
|
|
q = functions[main_addr].returns;
|
|
for (auto addr : q) {
|
|
insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0);
|
|
}
|
|
for (auto& it : data_function_pointers) {
|
|
for (auto addr : functions[it.second].returns) {
|
|
q.push_back(addr);
|
|
insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
|
|
}
|
|
}
|
|
for (auto& func_addr : li_function_pointers) {
|
|
for (auto addr : functions[func_addr].returns) {
|
|
q.push_back(addr);
|
|
insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
|
|
}
|
|
}
|
|
for (size_t i = 0; i < insns.size(); i++) {
|
|
if (insns[i].f_livein != 0) {
|
|
// Instruction is reachable
|
|
q.push_back(text_vaddr + i * 4);
|
|
}
|
|
}
|
|
|
|
while (!q.empty()) {
|
|
uint32_t addr = q.back();
|
|
q.pop_back();
|
|
uint32_t idx = addr_to_i(addr);
|
|
Insn& i = insns[idx];
|
|
uint64_t live = i.b_liveout | 1;
|
|
switch (insn_to_type(i)) {
|
|
case TYPE_1S:
|
|
live |= map_reg(i.operands[0].reg);
|
|
break;
|
|
|
|
case TYPE_1S_POS1:
|
|
live |= map_reg(i.operands[1].reg);
|
|
break;
|
|
|
|
case TYPE_2S:
|
|
live |= map_reg(i.operands[0].reg);
|
|
live |= map_reg(i.operands[1].reg);
|
|
break;
|
|
|
|
case TYPE_1D:
|
|
live &= ~map_reg(i.operands[0].reg);
|
|
break;
|
|
|
|
case TYPE_1D_1S:
|
|
if (live & map_reg(i.operands[0].reg)) {
|
|
live &= ~map_reg(i.operands[0].reg);
|
|
live |= map_reg(i.operands[1].reg);
|
|
}
|
|
break;
|
|
|
|
case TYPE_1D_2S:
|
|
if (live & map_reg(i.operands[0].reg)) {
|
|
live &= ~map_reg(i.operands[0].reg);
|
|
live |= map_reg(i.operands[1].reg);
|
|
live |= map_reg(i.operands[2].reg);
|
|
}
|
|
break;
|
|
|
|
case TYPE_D_LO_HI_2S: {
|
|
bool used = (live & map_reg(MIPS_REG_LO)) || (live & map_reg(MIPS_REG_HI));
|
|
live &= ~map_reg(MIPS_REG_LO);
|
|
live &= ~map_reg(MIPS_REG_HI);
|
|
if (used) {
|
|
live |= map_reg(i.operands[0].reg);
|
|
live |= map_reg(i.operands[1].reg);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
if ((i.b_livein | live) == i.b_livein) {
|
|
// No new bits
|
|
continue;
|
|
}
|
|
live |= i.b_livein;
|
|
i.b_livein = live;
|
|
|
|
bool function_exit = false;
|
|
for (Edge& e : i.predecessors) {
|
|
uint64_t new_live = live;
|
|
if (e.function_exit) {
|
|
new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
|
|
function_exit = true;
|
|
} else if (e.function_entry) {
|
|
new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_SP);
|
|
} else if (e.extern_function) {
|
|
string name;
|
|
bool is_extern_function = false;
|
|
size_t extern_function_id;
|
|
auto it = symbol_names.find(insns[idx - 2].operands[0].imm);
|
|
if (it != symbol_names.end()) {
|
|
name = it->second;
|
|
for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
|
|
if (name == extern_functions[i].name) {
|
|
is_extern_function = true;
|
|
extern_function_id = i;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
assert(is_extern_function);
|
|
auto& fn = extern_functions[extern_function_id];
|
|
uint64_t args = 1U;
|
|
if (fn.flags & FLAG_VARARG) {
|
|
// Assume the worst, that all four registers are used
|
|
for (int j = 0; j < 4; j++) {
|
|
args |= map_reg(MIPS_REG_A0 + j);
|
|
}
|
|
}
|
|
int pos = 0;
|
|
int pos_float = 0;
|
|
bool only_floats_so_far = true;
|
|
for (const char *p = fn.params + 1; *p != '\0'; ++p) {
|
|
switch (*p) {
|
|
case 'i':
|
|
case 'u':
|
|
case 'p':
|
|
case 't':
|
|
only_floats_so_far = false;
|
|
if (pos < 4) {
|
|
args |= map_reg(MIPS_REG_A0 + pos);
|
|
}
|
|
++pos;
|
|
break;
|
|
case 'f':
|
|
if (only_floats_so_far && pos_float < 4) {
|
|
pos_float += 2;
|
|
} else if (pos < 4) {
|
|
args |= map_reg(MIPS_REG_A0 + pos);
|
|
}
|
|
++pos;
|
|
break;
|
|
case 'd':
|
|
if (pos % 1 != 0) {
|
|
++pos;
|
|
}
|
|
if (only_floats_so_far && pos_float < 4) {
|
|
pos_float += 2;
|
|
} else if (pos < 4) {
|
|
args |= map_reg(MIPS_REG_A0 + pos) | map_reg(MIPS_REG_A0 + pos + 1);
|
|
}
|
|
pos += 2;
|
|
break;
|
|
case 'l':
|
|
case 'j':
|
|
if (pos % 1 != 0) {
|
|
++pos;
|
|
}
|
|
only_floats_so_far = false;
|
|
if (pos < 4) {
|
|
args |= map_reg(MIPS_REG_A0 + pos) | map_reg(MIPS_REG_A0 + pos + 1);
|
|
}
|
|
pos += 2;
|
|
break;
|
|
}
|
|
}
|
|
args |= map_reg(MIPS_REG_SP);
|
|
new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
new_live |= args;
|
|
} else if (e.function_pointer) {
|
|
new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
new_live |= map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
|
|
}
|
|
if ((insns[e.i].b_liveout | new_live) != insns[e.i].b_liveout) {
|
|
insns[e.i].b_liveout |= new_live;
|
|
q.push_back(text_vaddr + e.i * 4);
|
|
}
|
|
}
|
|
if (function_exit) {
|
|
// add one edge that skips the function call, for callee-saved register liveness propagation
|
|
live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
|
|
map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
|
|
if ((insns[idx - 1].b_liveout | live) != insns[idx - 1].b_liveout) {
|
|
insns[idx - 1].b_liveout |= live;
|
|
q.push_back(text_vaddr + (idx - 1) * 4);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
static void pass6(void) {
|
|
for (auto& it : functions) {
|
|
uint32_t addr = it.first;
|
|
Function& f = it.second;
|
|
for (uint32_t ret : f.returns) {
|
|
Insn& i = insns[addr_to_i(ret)];
|
|
if (i.f_liveout & i.b_liveout & map_reg(MIPS_REG_V1)) {
|
|
f.nret = 2;
|
|
} else if ((i.f_liveout & i.b_liveout & map_reg(MIPS_REG_V0)) && f.nret == 0) {
|
|
f.nret = 1;
|
|
}
|
|
}
|
|
Insn& insn = insns.at(addr_to_i(addr));
|
|
for (int i = 0; i < 4; i++) {
|
|
if (insn.f_livein & insn.b_livein & map_reg(MIPS_REG_A0 + i)) {
|
|
f.nargs = 1 + i;
|
|
}
|
|
}
|
|
f.v0_in = (insn.f_livein & insn.b_livein & map_reg(MIPS_REG_V0)) != 0 && !f.referenced_by_function_pointer;
|
|
}
|
|
}
|
|
|
|
static void dump(void) {
|
|
for (size_t i = 0; i < insns.size(); i++) {
|
|
Insn& insn = insns[i];
|
|
uint32_t vaddr = text_vaddr + i * 4;
|
|
if (label_addresses.count(vaddr)) {
|
|
if (symbol_names.count(vaddr)) {
|
|
printf("L%08x: //%s\n", vaddr, symbol_names[vaddr].c_str());
|
|
} else {
|
|
printf("L%08x:\n", vaddr);
|
|
}
|
|
}
|
|
printf("\t%s %s\n", insn.mnemonic.c_str(), insn.op_str.c_str());
|
|
}
|
|
}
|
|
|
|
static const char *r(uint32_t reg) {
|
|
return cs_reg_name(handle, reg);
|
|
}
|
|
|
|
static const char *wr(uint32_t reg) {
|
|
static const char *regs[] = {
|
|
"f0.w[0]", "f0.w[1]",
|
|
"f2.w[0]", "f2.w[1]",
|
|
"f4.w[0]", "f4.w[1]",
|
|
"f6.w[0]", "f6.w[1]",
|
|
"f8.w[0]", "f8.w[1]",
|
|
"f10.w[0]", "f10.w[1]",
|
|
"f12.w[0]", "f12.w[1]",
|
|
"f14.w[0]", "f14.w[1]",
|
|
"f16.w[0]", "f16.w[1]",
|
|
"f18.w[0]", "f18.w[1]",
|
|
"f20.w[0]", "f20.w[1]",
|
|
"f22.w[0]", "f22.w[1]",
|
|
"f24.w[0]", "f24.w[1]",
|
|
"f26.w[0]", "f26.w[1]",
|
|
"f28.w[0]", "f28.w[1]",
|
|
"f30.w[0]", "f30.w[1]"
|
|
};
|
|
assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31);
|
|
return regs[reg - MIPS_REG_F0];
|
|
}
|
|
|
|
static const char *fr(uint32_t reg) {
|
|
static const char *regs[] = {
|
|
"f0.f[0]", "f0.f[1]",
|
|
"f2.f[0]", "f2.f[1]",
|
|
"f4.f[0]", "f4.f[1]",
|
|
"f6.f[0]", "f6.f[1]",
|
|
"f8.f[0]", "f8.f[1]",
|
|
"f10.f[0]", "f10.f[1]",
|
|
"f12.f[0]", "f12.f[1]",
|
|
"f14.f[0]", "f14.f[1]",
|
|
"f16.f[0]", "f16.f[1]",
|
|
"f18.f[0]", "f18.f[1]",
|
|
"f20.f[0]", "f20.f[1]",
|
|
"f22.f[0]", "f22.f[1]",
|
|
"f24.f[0]", "f24.f[1]",
|
|
"f26.f[0]", "f26.f[1]",
|
|
"f28.f[0]", "f28.f[1]",
|
|
"f30.f[0]", "f30.f[1]"
|
|
};
|
|
assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31);
|
|
return regs[reg - MIPS_REG_F0];
|
|
}
|
|
|
|
static const char *dr(uint32_t reg) {
|
|
static const char *regs[] = {
|
|
"f0.d",
|
|
"f2.d",
|
|
"f4.d",
|
|
"f6.d",
|
|
"f8.d",
|
|
"f10.d",
|
|
"f12.d",
|
|
"f14.d",
|
|
"f16.d",
|
|
"f18.d",
|
|
"f20.d",
|
|
"f22.d",
|
|
"f24.d",
|
|
"f26.d",
|
|
"f28.d",
|
|
"f30.d"
|
|
};
|
|
assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31 && (reg - MIPS_REG_F0) % 2 == 0);
|
|
return regs[(reg - MIPS_REG_F0) / 2];
|
|
}
|
|
|
|
static void dump_instr(int i);
|
|
|
|
static void dump_cond_branch(int i, const char *lhs, const char *op, const char *rhs) {
|
|
Insn& insn = insns[i];
|
|
const char *cast1 = "";
|
|
const char *cast2 = "";
|
|
if (strcmp(op, "==") && strcmp(op, "!=")) {
|
|
cast1 = "(int)";
|
|
if (strcmp(rhs, "0")) {
|
|
cast2 = "(int)";
|
|
}
|
|
}
|
|
printf("if (%s%s %s %s%s) {", cast1, lhs, op, cast2, rhs);
|
|
dump_instr(i + 1);
|
|
printf("goto L%x;}\n", (uint32_t)insn.operands[insn.op_count - 1].imm);
|
|
}
|
|
|
|
static void dump_cond_branch_likely(int i, const char *lhs, const char *op, const char *rhs) {
|
|
uint32_t target = text_vaddr + (i + 2) * 4;
|
|
dump_cond_branch(i, lhs, op, rhs);
|
|
if (!TRACE) {
|
|
printf("else goto L%x;\n", target);
|
|
} else {
|
|
printf("else {printf(\"pc=0x%08x (ignored)\\n\"); goto L%x;}\n", text_vaddr + (i + 1) * 4, target);
|
|
}
|
|
label_addresses.insert(target);
|
|
}
|
|
|
|
static void dump_instr(int i) {
|
|
const char *symbol_name = NULL;
|
|
if (symbol_names.count(text_vaddr + i * 4) != 0) {
|
|
symbol_name = symbol_names[text_vaddr + i * 4].c_str();
|
|
printf("//%s:\n", symbol_name);
|
|
}
|
|
if (TRACE) {
|
|
printf("++cnt; printf(\"pc=0x%08x%s%s\\n\"); ", text_vaddr + i * 4, symbol_name ? " " : "", symbol_name ? symbol_name : "");
|
|
}
|
|
Insn& insn = insns[i];
|
|
if (!insn.is_jump && !conservative) {
|
|
switch (insn_to_type(insn)) {
|
|
case TYPE_1S:
|
|
if (!(insn.f_livein & map_reg(insn.operands[0].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
}
|
|
break;
|
|
case TYPE_1S_POS1:
|
|
if (!(insn.f_livein & map_reg(insn.operands[1].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
}
|
|
break;
|
|
case TYPE_2S:
|
|
if (!(insn.f_livein & map_reg(insn.operands[0].reg)) || !(insn.f_livein & map_reg(insn.operands[1].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
}
|
|
break;
|
|
case TYPE_1D_2S:
|
|
if (!(insn.f_livein & map_reg(insn.operands[2].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
break;
|
|
}
|
|
// fallthrough
|
|
case TYPE_1D_1S:
|
|
if (!(insn.f_livein & map_reg(insn.operands[1].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
break;
|
|
}
|
|
// fallthrough
|
|
case TYPE_1D:
|
|
if (!(insn.b_liveout & map_reg(insn.operands[0].reg))) {
|
|
printf("// bdead %llx ", (unsigned long long)insn.b_liveout);
|
|
}
|
|
break;
|
|
case TYPE_D_LO_HI_2S:
|
|
if (!(insn.f_livein & map_reg(insn.operands[0].reg)) || !(insn.f_livein & map_reg(insn.operands[1].reg))) {
|
|
printf("// fdead %llx ", (unsigned long long)insn.f_livein);
|
|
break;
|
|
}
|
|
if (!(insn.b_liveout & (map_reg(MIPS_REG_LO) | map_reg(MIPS_REG_HI)))) {
|
|
printf("// bdead %llx ", (unsigned long long)insn.b_liveout);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
switch (insn.id) {
|
|
case MIPS_INS_ADD:
|
|
case MIPS_INS_ADDU:
|
|
if (insn.mnemonic == "add.s") {
|
|
printf("%s = %s + %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
|
|
} else if (insn.mnemonic == "add.d") {
|
|
printf("%s = %s + %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
|
|
} else {
|
|
printf("%s = %s + %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
}
|
|
break;
|
|
case MIPS_INS_ADDI:
|
|
case MIPS_INS_ADDIU:
|
|
printf("%s = %s + 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_AND:
|
|
printf("%s = %s & %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_ANDI:
|
|
printf("%s = %s & 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_BEQ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "==", r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_BEQL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "==", r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_BGEZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), ">=", "0");
|
|
break;
|
|
case MIPS_INS_BGEZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), ">=", "0");
|
|
break;
|
|
case MIPS_INS_BGTZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), ">", "0");
|
|
break;
|
|
case MIPS_INS_BGTZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), ">", "0");
|
|
break;
|
|
case MIPS_INS_BLEZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "<=", "0");
|
|
break;
|
|
case MIPS_INS_BLEZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "<=", "0");
|
|
break;
|
|
case MIPS_INS_BLTZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "<", "0");
|
|
break;
|
|
case MIPS_INS_BLTZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "<", "0");
|
|
break;
|
|
case MIPS_INS_BNE:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "!=", r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_BNEL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "!=", insn.mnemonic == "bnezl" ? "0" : r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_BREAK:
|
|
printf("abort();\n");
|
|
break;
|
|
case MIPS_INS_BEQZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "==", "0");
|
|
break;
|
|
/*case MIPS_INS_BEQZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "==", "0");
|
|
break;*/
|
|
case MIPS_INS_B:
|
|
dump_instr(i + 1);
|
|
printf("goto L%x;\n", (int32_t)insn.operands[0].imm);
|
|
break;
|
|
case MIPS_INS_BC1F:
|
|
case MIPS_INS_BC1T:
|
|
printf("if (%scf) {", insn.id == MIPS_INS_BC1F ? "!" : "");
|
|
dump_instr(i + 1);
|
|
printf("goto L%x;}\n", (int32_t)insn.operands[0].imm);
|
|
break;
|
|
case MIPS_INS_BC1FL:
|
|
case MIPS_INS_BC1TL:
|
|
{
|
|
uint32_t target = text_vaddr + (i + 2) * 4;
|
|
printf("if (%scf) {", insn.id == MIPS_INS_BC1FL ? "!" : "");
|
|
dump_instr(i + 1);
|
|
printf("goto L%x;}\n", (int32_t)insn.operands[0].imm);
|
|
if (!TRACE) {
|
|
printf("else goto L%x;\n", target);
|
|
} else {
|
|
printf("else {printf(\"pc=0x%08x (ignored)\\n\"); goto L%x;}\n", text_vaddr + (i + 1) * 4, target);
|
|
}
|
|
label_addresses.insert(target);
|
|
break;
|
|
}
|
|
case MIPS_INS_BNEZ:
|
|
dump_cond_branch(i, r(insn.operands[0].reg), "!=", "0");
|
|
break;
|
|
/*case MIPS_INS_BNEZL:
|
|
dump_cond_branch_likely(i, r(insn.operands[0].reg), "!=", "0");
|
|
break;*/
|
|
case MIPS_INS_C:
|
|
if (insn.mnemonic == "c.lt.s") {
|
|
printf("cf = %s < %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "c.le.s") {
|
|
printf("cf = %s <= %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "c.eq.s") {
|
|
printf("cf = %s == %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "c.lt.d") {
|
|
printf("cf = %s < %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "c.le.d") {
|
|
printf("cf = %s <= %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "c.eq.d") {
|
|
printf("cf = %s == %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
}
|
|
break;
|
|
case MIPS_INS_CVT:
|
|
if (insn.mnemonic == "cvt.s.w") {
|
|
printf("%s = (int)%s;\n", fr(insn.operands[0].reg), wr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "cvt.d.w") {
|
|
printf("%s = (int)%s;\n", dr(insn.operands[0].reg), wr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "cvt.d.s") {
|
|
printf("%s = %s;\n", dr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "cvt.s.d") {
|
|
printf("%s = %s;\n", fr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "cvt.w.d") {
|
|
printf("%s = cvt_w_d(%s);\n", wr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "cvt.w.s") {
|
|
printf("%s = cvt_w_s(%s);\n", wr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else {
|
|
goto unimplemented;
|
|
}
|
|
break;
|
|
case MIPS_INS_CFC1:
|
|
assert(insn.operands[1].reg == MIPS_REG_31);
|
|
printf("%s = fcsr;\n", r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_CTC1:
|
|
assert(insn.operands[1].reg == MIPS_REG_31);
|
|
printf("fcsr = %s;\n", r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_DIV:
|
|
if (insn.mnemonic == "div.s") {
|
|
assert(insn.op_count == 3);
|
|
printf("%s = %s / %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
|
|
} else if (insn.mnemonic == "div.d") {
|
|
assert(insn.op_count == 3);
|
|
printf("%s = %s / %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
|
|
} else {
|
|
assert(insn.op_count == 2);
|
|
printf("lo = (int)%s / (int)%s; ", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
printf("hi = (int)%s %% (int)%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
}
|
|
break;
|
|
case MIPS_INS_DIVU:
|
|
assert(insn.op_count == 2);
|
|
printf("lo = %s / %s; ", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
printf("hi = %s %% %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_MOV:
|
|
if (insn.mnemonic == "mov.s") {
|
|
printf("%s = %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "mov.d") {
|
|
printf("%s = %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else {
|
|
goto unimplemented;
|
|
}
|
|
break;
|
|
case MIPS_INS_MUL:
|
|
if (insn.mnemonic == "mul.s") {
|
|
printf("%s = %s * %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
|
|
} else if (insn.mnemonic == "mul.d") {
|
|
printf("%s = %s * %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
|
|
} else {
|
|
goto unimplemented;
|
|
}
|
|
break;
|
|
case MIPS_INS_NEG:
|
|
if (insn.mnemonic == "neg.s") {
|
|
printf("%s = -%s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "neg.d") {
|
|
printf("%s = -%s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else {
|
|
printf("%s = -%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
}
|
|
break;
|
|
case MIPS_INS_SUB:
|
|
if (insn.mnemonic == "sub.s") {
|
|
printf("%s = %s - %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
|
|
} else if (insn.mnemonic == "sub.d") {
|
|
printf("%s = %s - %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
|
|
} else {
|
|
goto unimplemented;
|
|
}
|
|
break;
|
|
case MIPS_INS_J:
|
|
dump_instr(i + 1);
|
|
printf("goto L%x;\n", (uint32_t)insn.operands[0].imm);
|
|
break;
|
|
case MIPS_INS_JAL:
|
|
{
|
|
string name;
|
|
bool is_extern_function = false;
|
|
size_t extern_function_id;
|
|
auto it = symbol_names.find(insn.operands[0].imm);
|
|
if (it != symbol_names.end()) {
|
|
name = it->second;
|
|
for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
|
|
if (name == extern_functions[i].name) {
|
|
is_extern_function = true;
|
|
extern_function_id = i;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
dump_instr(i + 1);
|
|
if (is_extern_function) {
|
|
auto& fn = extern_functions[extern_function_id];
|
|
if (fn.flags & FLAG_VARARG) {
|
|
for (int j = 0; j < 4; j++) {
|
|
printf("MEM_U32(sp + %d) = %s;\n", j * 4, r(MIPS_REG_A0 + j));
|
|
}
|
|
}
|
|
char ret_type = fn.params[0];
|
|
if (ret_type != 'v') {
|
|
switch (ret_type) {
|
|
case 'i':
|
|
case 'u':
|
|
case 'p':
|
|
printf("%s = ", r(MIPS_REG_V0));
|
|
break;
|
|
case 'f':
|
|
printf("%s = ", fr(MIPS_REG_F0));
|
|
break;
|
|
case 'd':
|
|
printf("%s = ", dr(MIPS_REG_F0));
|
|
break;
|
|
case 'l':
|
|
case 'j':
|
|
printf("temp64 = ");
|
|
break;
|
|
}
|
|
}
|
|
printf("wrapper_%s(", name.c_str());
|
|
bool first = true;
|
|
if (!(fn.flags & FLAG_NO_MEM)) {
|
|
printf("mem");
|
|
first = false;
|
|
}
|
|
int pos = 0;
|
|
int pos_float = 0;
|
|
bool only_floats_so_far = true;
|
|
bool needs_sp = false;
|
|
for (const char *p = fn.params + 1; *p != '\0'; ++p) {
|
|
if (!first) {
|
|
printf(", ");
|
|
}
|
|
first = false;
|
|
switch (*p) {
|
|
case 't':
|
|
printf("trampoline, ");
|
|
needs_sp = true;
|
|
// fallthrough
|
|
case 'i':
|
|
case 'u':
|
|
case 'p':
|
|
only_floats_so_far = false;
|
|
if (pos < 4) {
|
|
printf("%s", r(MIPS_REG_A0 + pos));
|
|
} else {
|
|
printf("MEM_%c32(sp + %d)", *p == 'i' ? 'S' : 'U', pos * 4);
|
|
}
|
|
++pos;
|
|
break;
|
|
case 'f':
|
|
if (only_floats_so_far && pos_float < 4) {
|
|
printf("%s", fr(MIPS_REG_F12 + pos_float));
|
|
pos_float += 2;
|
|
} else if (pos < 4) {
|
|
printf("BITCAST_U32_TO_F32(%s)", r(MIPS_REG_A0 + pos));
|
|
} else {
|
|
printf("BITCAST_U32_TO_F32(MEM_U32(sp + %d))", pos * 4);
|
|
}
|
|
++pos;
|
|
break;
|
|
case 'd':
|
|
if (pos % 1 != 0) {
|
|
++pos;
|
|
}
|
|
if (only_floats_so_far && pos_float < 4) {
|
|
printf("%s", dr(MIPS_REG_F12 + pos_float));
|
|
pos_float += 2;
|
|
} else if (pos < 4) {
|
|
printf("BITCAST_U64_TO_F64(((uint64_t)%s << 32) | (uint64_t)%s)", r(MIPS_REG_A0 + pos), r(MIPS_REG_A0 + pos + 1));
|
|
} else {
|
|
printf("BITCAST_U64_TO_F64(((uint64_t)MEM_U32(sp + %d) << 32) | (uint64_t)MEM_U32(sp + %d))", pos * 4, (pos + 1) * 4);
|
|
}
|
|
pos += 2;
|
|
break;
|
|
case 'l':
|
|
case 'j':
|
|
if (pos % 1 != 0) {
|
|
++pos;
|
|
}
|
|
only_floats_so_far = false;
|
|
if (*p == 'l') {
|
|
printf("(int64_t)");
|
|
}
|
|
if (pos < 4) {
|
|
printf("(((uint64_t)%s << 32) | (uint64_t)%s)", r(MIPS_REG_A0 + pos), r(MIPS_REG_A0 + pos + 1));
|
|
} else {
|
|
printf("(((uint64_t)MEM_U32(sp + %d) << 32) | (uint64_t)MEM_U32(sp + %d))", pos * 4, (pos + 1) * 4);
|
|
}
|
|
pos += 2;
|
|
break;
|
|
}
|
|
}
|
|
if ((fn.flags & FLAG_VARARG) || needs_sp) {
|
|
printf("%s%s", first ? "" : ", ", r(MIPS_REG_SP));
|
|
}
|
|
printf(");\n");
|
|
if (ret_type == 'l' || ret_type == 'j') {
|
|
printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
|
|
printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
|
|
}
|
|
if (!name.empty()) {
|
|
//printf("printf(\"%s %%x\\n\", %s);\n", name.c_str(), r(MIPS_REG_A0));
|
|
}
|
|
} else {
|
|
Function& f = functions.find((uint32_t)insn.operands[0].imm)->second;
|
|
if (f.nret == 1) {
|
|
printf("v0 = ");
|
|
} else if (f.nret == 2) {
|
|
printf("temp64 = ");
|
|
}
|
|
if (!name.empty()) {
|
|
//printf("printf(\"%s %%x\\n\", %s);\n", name.c_str(), r(MIPS_REG_A0));
|
|
printf("f_%s", name.c_str());
|
|
} else {
|
|
printf("func_%x", (uint32_t)insn.operands[0].imm);
|
|
}
|
|
printf("(mem, sp");
|
|
if (f.v0_in) {
|
|
printf(", %s", r(MIPS_REG_V0));
|
|
}
|
|
for (uint32_t i = 0; i < f.nargs; i++) {
|
|
printf(", %s", r(MIPS_REG_A0 + i));
|
|
}
|
|
printf(");\n");
|
|
if (f.nret == 2) {
|
|
printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
|
|
printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
|
|
}
|
|
}
|
|
printf("goto L%x;\n", text_vaddr + (i + 2) * 4);
|
|
label_addresses.insert(text_vaddr + (i + 2) * 4);
|
|
break;
|
|
}
|
|
case MIPS_INS_JALR:
|
|
printf("fp_dest = %s;\n", r(insn.operands[0].reg));
|
|
dump_instr(i + 1);
|
|
printf("temp64 = trampoline(mem, sp, %s, %s, %s, %s, fp_dest);\n",
|
|
r(MIPS_REG_A0), r(MIPS_REG_A1), r(MIPS_REG_A2), r(MIPS_REG_A3));
|
|
printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
|
|
printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
|
|
printf("goto L%x;\n", text_vaddr + (i + 2) * 4);
|
|
label_addresses.insert(text_vaddr + (i + 2) * 4);
|
|
break;
|
|
case MIPS_INS_JR:
|
|
if (insn.jtbl_addr != 0) {
|
|
uint32_t jtbl_pos = insn.jtbl_addr - rodata_vaddr;
|
|
assert(jtbl_pos < rodata_section_len && jtbl_pos + insn.num_cases * 4 <= rodata_section_len);
|
|
#if 1
|
|
printf(";static void *const Lswitch%x[] = {\n", insn.jtbl_addr);
|
|
for (uint32_t i = 0; i < insn.num_cases; i++) {
|
|
uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + i * 4) + gp_value;
|
|
printf("&&L%x,\n", dest_addr);
|
|
label_addresses.insert(dest_addr);
|
|
}
|
|
printf("};\n");
|
|
printf("dest = Lswitch%x[%s];\n", insn.jtbl_addr, r(insn.index_reg));
|
|
dump_instr(i + 1);
|
|
printf("goto *dest;\n");
|
|
#else
|
|
assert(insns[i + 1].id == MIPS_INS_NOP);
|
|
printf("switch (%s) {\n", r(insn.index_reg));
|
|
for (uint32_t i = 0; i < insn.num_cases; i++) {
|
|
uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + i * 4) + gp_value;
|
|
printf("case %u: goto L%x;\n", i, dest_addr);
|
|
label_addresses.insert(dest_addr);
|
|
}
|
|
printf("}\n");
|
|
#endif
|
|
} else {
|
|
if (insn.operands[0].reg != MIPS_REG_RA) {
|
|
printf("UNSUPPORTED JR %s %s\n", insn.op_str.c_str(), r(insn.operands[0].reg));
|
|
} else {
|
|
dump_instr(i + 1);
|
|
switch (find_function(text_vaddr + i * 4)->second.nret) {
|
|
case 0:
|
|
printf("return;\n");
|
|
break;
|
|
case 1:
|
|
printf("return v0;\n");
|
|
break;
|
|
case 2:
|
|
printf("return ((uint64_t)v0 << 32) | v1;\n");
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
break;
|
|
case MIPS_INS_LB:
|
|
printf("%s = MEM_S8(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LBU:
|
|
printf("%s = MEM_U8(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LH:
|
|
printf("%s = MEM_S16(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LHU:
|
|
printf("%s = MEM_U16(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LUI:
|
|
printf("%s = 0x%x;\n", r(insn.operands[0].reg), ((uint32_t)insn.operands[1].imm) << 16);
|
|
break;
|
|
case MIPS_INS_LW:
|
|
printf("%s = MEM_U32(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LWC1:
|
|
printf("%s = MEM_U32(%s + %d);\n", wr(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LDC1:
|
|
assert((insn.operands[0].reg - MIPS_REG_F0) % 2 == 0);
|
|
printf("%s = MEM_U32(%s + %d);\n", wr(insn.operands[0].reg + 1), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
printf("%s = MEM_U32(%s + %d + 4);\n", wr(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
break;
|
|
case MIPS_INS_LWL:
|
|
{
|
|
const char *reg = r(insn.operands[0].reg);
|
|
printf("%s = %s + %d; ", reg, r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
|
|
printf("%s = (MEM_U8(%s) << 24) | (MEM_U8(%s + 1) << 16) | (MEM_U8(%s + 2) << 8) | MEM_U8(%s + 3);\n", reg, reg, reg, reg, reg);
|
|
break;
|
|
}
|
|
case MIPS_INS_LWR:
|
|
printf("//lwr %s\n", insn.op_str.c_str());
|
|
break;
|
|
case MIPS_INS_LI:
|
|
if (insn.is_global_got_memop && text_vaddr <= insn.operands[1].imm && insn.operands[1].imm < text_vaddr + text_section_len) {
|
|
printf("%s = 0x%x; // function pointer\n", r(insn.operands[0].reg), (uint32_t)insn.operands[1].imm);
|
|
label_addresses.insert((uint32_t)insn.operands[1].imm);
|
|
} else {
|
|
printf("%s = 0x%x;\n", r(insn.operands[0].reg), (uint32_t)insn.operands[1].imm);
|
|
}
|
|
break;
|
|
case MIPS_INS_MFC1:
|
|
printf("%s = %s;\n", r(insn.operands[0].reg), wr(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_MFHI:
|
|
printf("%s = hi;\n", r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_MFLO:
|
|
printf("%s = lo;\n", r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_MOVE:
|
|
printf("%s = %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_MTC1:
|
|
printf("%s = %s;\n", wr(insn.operands[1].reg), r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_MULT:
|
|
printf("lo = %s * %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
printf("hi = (uint32_t)((int64_t)(int)%s * (int64_t)(int)%s >> 32);\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_MULTU:
|
|
printf("lo = %s * %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
printf("hi = (uint32_t)((uint64_t)%s * (uint64_t)%s >> 32);\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_NEGU:
|
|
printf("%s = -%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_NOR:
|
|
printf("%s = ~(%s | %s);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_NOT:
|
|
printf("%s = ~%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
|
|
break;
|
|
case MIPS_INS_OR:
|
|
printf("%s = %s | %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_ORI:
|
|
printf("%s = %s | 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SB:
|
|
printf("MEM_U8(%s + %d) = (uint8_t)%s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_SH:
|
|
printf("MEM_U16(%s + %d) = (uint16_t)%s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_SLL:
|
|
printf("%s = %s << %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SLLV:
|
|
printf("%s = %s << (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SLT:
|
|
printf("%s = (int)%s < (int)%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SLTI:
|
|
printf("%s = (int)%s < (int)0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SLTIU:
|
|
printf("%s = %s < 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SLTU:
|
|
printf("%s = %s < %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SRA:
|
|
printf("%s = (int)%s >> %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SRAV:
|
|
printf("%s = (int)%s >> (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SRL:
|
|
printf("%s = %s >> %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_SRLV:
|
|
printf("%s = %s >> (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SUBU:
|
|
printf("%s = %s - %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_SW:
|
|
printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_SWC1:
|
|
printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_SDC1:
|
|
assert((insn.operands[0].reg - MIPS_REG_F0) % 2 == 0);
|
|
printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg + 1));
|
|
printf("MEM_U32(%s + %d + 4) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg));
|
|
break;
|
|
case MIPS_INS_SWL:
|
|
for (int i = 0; i < 4; i++) {
|
|
printf("MEM_U8(%s + %d + %d) = (uint8_t)(%s >> %d);\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, i, r(insn.operands[0].reg), (3 - i) * 8);
|
|
}
|
|
break;
|
|
case MIPS_INS_SWR:
|
|
printf("//swr %s\n", insn.op_str.c_str());
|
|
break;
|
|
case MIPS_INS_TRUNC:
|
|
if (insn.mnemonic == "trunc.w.s") {
|
|
printf("%s = (int)%s;\n", wr(insn.operands[0].reg), fr(insn.operands[1].reg));
|
|
} else if (insn.mnemonic == "trunc.w.d") {
|
|
printf("%s = (int)%s;\n", wr(insn.operands[0].reg), dr(insn.operands[1].reg));
|
|
} else {
|
|
goto unimplemented;
|
|
}
|
|
break;
|
|
case MIPS_INS_XOR:
|
|
printf("%s = %s ^ %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
|
|
break;
|
|
case MIPS_INS_XORI:
|
|
printf("%s = %s ^ 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_TNE:
|
|
printf("assert(%s == %s && \"tne %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_TEQ:
|
|
printf("assert(%s != %s && \"teq %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_TGE:
|
|
printf("assert((int)%s < (int)%s && \"tge %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_TGEU:
|
|
printf("assert(%s < %s && \"tgeu %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_TLT:
|
|
printf("assert((int)%s >= (int)%s && \"tlt %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
|
|
break;
|
|
case MIPS_INS_NOP:
|
|
printf("//nop;\n");
|
|
break;
|
|
default:
|
|
unimplemented:
|
|
printf("UNIMPLEMENTED %s %s\n", insn.mnemonic.c_str(), insn.op_str.c_str());
|
|
break;
|
|
}
|
|
}
|
|
|
|
static void inspect_data_function_pointers(vector<pair<uint32_t, uint32_t>>& ret, const uint8_t *section, uint32_t section_vaddr, uint32_t len) {
|
|
for (uint32_t i = 0; i < len; i += 4) {
|
|
uint32_t addr = read_u32_be(section + i);
|
|
if (addr == 0x430b00 || addr == 0x433b00) {
|
|
// in as1, not function pointers (normal integers)
|
|
continue;
|
|
}
|
|
if (addr == 0x4a0000) {
|
|
// in copt
|
|
continue;
|
|
}
|
|
if (section_vaddr + i >= procedure_table_start && section_vaddr + i < procedure_table_start + procedure_table_len) {
|
|
// some linking table with a "all" functions, in as1 5.3
|
|
continue;
|
|
}
|
|
if (addr >= text_vaddr && addr < text_vaddr + text_section_len && addr % 4 == 0) {
|
|
#if INSPECT_FUNCTION_POINTERS
|
|
fprintf(stderr, "assuming function pointer 0x%x at 0x%x\n", addr, section_vaddr + i);
|
|
#endif
|
|
ret.push_back(make_pair(section_vaddr + i, addr));
|
|
label_addresses.insert(addr);
|
|
functions[addr].referenced_by_function_pointer = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
static void dump_function_signature(Function& f, uint32_t vaddr) {
|
|
printf("static ");
|
|
switch (f.nret) {
|
|
case 0:
|
|
printf("void ");
|
|
break;
|
|
case 1:
|
|
printf("uint32_t ");
|
|
break;
|
|
case 2:
|
|
printf("uint64_t ");
|
|
break;
|
|
}
|
|
auto name_it = symbol_names.find(vaddr);
|
|
if (name_it != symbol_names.end()) {
|
|
printf("f_%s", name_it->second.c_str());
|
|
} else {
|
|
printf("func_%x", vaddr);
|
|
}
|
|
printf("(uint8_t *mem, uint32_t sp");
|
|
if (f.v0_in) {
|
|
printf(", uint32_t %s", r(MIPS_REG_V0));
|
|
}
|
|
for (uint32_t i = 0; i < f.nargs; i++) {
|
|
printf(", uint32_t %s", r(MIPS_REG_A0 + i));
|
|
}
|
|
printf(")");
|
|
}
|
|
|
|
static void dump_c(void) {
|
|
map<string, uint32_t> symbol_names_inv;
|
|
for (auto& it : symbol_names) {
|
|
symbol_names_inv[it.second] = it.first;
|
|
}
|
|
|
|
uint32_t min_addr = ~0;
|
|
uint32_t max_addr = 0;
|
|
|
|
if (data_section_len > 0) {
|
|
min_addr = MIN(min_addr, data_vaddr);
|
|
max_addr = MAX(max_addr, data_vaddr + data_section_len);
|
|
}
|
|
if (rodata_section_len > 0) {
|
|
min_addr = MIN(min_addr, rodata_vaddr);
|
|
max_addr = MAX(max_addr, rodata_vaddr + rodata_section_len);
|
|
}
|
|
if (bss_section_len) {
|
|
min_addr = MIN(min_addr, bss_vaddr);
|
|
max_addr = MAX(max_addr, bss_vaddr + bss_section_len);
|
|
}
|
|
|
|
min_addr = min_addr & ~0xfff;
|
|
max_addr = (max_addr + 0xfff) & ~0xfff;
|
|
|
|
uint32_t stack_bottom = min_addr;
|
|
min_addr -= 1 * 1024 * 1024; // 1 MB stack
|
|
stack_bottom -= 16; // for main's stack frame
|
|
|
|
printf("#include \"header.h\"\n");
|
|
if (conservative) {
|
|
printf("static uint32_t s0, s1, s2, s3, s4, s5, s6, s7, fp;\n");
|
|
}
|
|
printf("static const uint32_t rodata[] = {\n");
|
|
for (size_t i = 0; i < rodata_section_len; i += 4) {
|
|
printf("0x%x,%s", read_u32_be(rodata_section + i), i % 32 == 28 ? "\n" : "");
|
|
}
|
|
printf("};\n");
|
|
printf("static const uint32_t data[] = {\n");
|
|
for (size_t i = 0; i < data_section_len; i += 4) {
|
|
printf("0x%x,%s", read_u32_be(data_section + i), i % 32 == 28 ? "\n" : "");
|
|
}
|
|
printf("};\n");
|
|
|
|
/*if (!data_function_pointers.empty()) {
|
|
printf("static const struct { uint32_t orig_addr; void *recompiled_addr; } data_function_pointers[] = {\n");
|
|
for (auto item : data_function_pointers) {
|
|
printf("{0x%x, &&L%x},\n", item.first, item.second);
|
|
}
|
|
printf("};\n");
|
|
}*/
|
|
|
|
if (TRACE) {
|
|
printf("static unsigned long long int cnt = 0;\n");
|
|
}
|
|
|
|
for (auto& f_it : functions) {
|
|
if (insns[addr_to_i(f_it.first)].f_livein != 0) {
|
|
// Function is used
|
|
dump_function_signature(f_it.second, f_it.first);
|
|
printf(";\n");
|
|
}
|
|
}
|
|
|
|
if (!data_function_pointers.empty() || !li_function_pointers.empty()) {
|
|
printf("uint64_t trampoline(uint8_t *mem, uint32_t sp, uint32_t a0, uint32_t a1, uint32_t a2, uint32_t a3, uint32_t fp_dest) {\n");
|
|
printf("switch (fp_dest) {\n");
|
|
for (auto& it : functions) {
|
|
Function& f = it.second;
|
|
if (f.referenced_by_function_pointer) {
|
|
printf("case 0x%x: ", it.first);
|
|
if (f.nret == 1) {
|
|
printf("return (uint64_t)");
|
|
} else if (f.nret == 2) {
|
|
printf("return ");
|
|
}
|
|
auto name_it = symbol_names.find(it.first);
|
|
if (name_it != symbol_names.end()) {
|
|
printf("f_%s", name_it->second.c_str());
|
|
} else {
|
|
printf("func_%x", it.first);
|
|
}
|
|
printf("(mem, sp");
|
|
for (int i = 0; i < f.nargs; i++) {
|
|
printf(", a%d", i);
|
|
}
|
|
printf(")");
|
|
if (f.nret == 1) {
|
|
printf(" << 32");
|
|
}
|
|
printf(";");
|
|
if (f.nret == 0) {
|
|
printf(" return 0;");
|
|
}
|
|
printf("\n");
|
|
}
|
|
}
|
|
printf("default: abort();");
|
|
printf("}\n");
|
|
printf("}\n");
|
|
}
|
|
|
|
printf("int run(uint8_t *mem, int argc, char *argv[]) {\n");
|
|
printf("mmap_initial_data_range(mem, 0x%x, 0x%x);\n", min_addr, max_addr);
|
|
|
|
printf("memcpy(mem + 0x%x, rodata, 0x%x);\n", rodata_vaddr, rodata_section_len);
|
|
printf("memcpy(mem + 0x%x, data, 0x%x);\n", data_vaddr, data_section_len);
|
|
|
|
/*if (!data_function_pointers.empty()) {
|
|
if (!LABELS_64_BIT) {
|
|
printf("for (int i = 0; i < %d; i++) MEM_U32(data_function_pointers[i].orig_addr) = (uint32_t)(uintptr_t)data_function_pointers[i].recompiled_addr;\n", (int)data_function_pointers.size());
|
|
} else {
|
|
printf("for (int i = 0; i < %d; i++) MEM_U32(data_function_pointers[i].orig_addr) = (uint32_t)((uintptr_t)data_function_pointers[i].recompiled_addr - (uintptr_t)&&Loffset);\n", (int)data_function_pointers.size());
|
|
}
|
|
}*/
|
|
|
|
printf("MEM_S32(0x%x) = argc;\n", symbol_names_inv.at("__Argc"));
|
|
printf("MEM_S32(0x%x) = argc;\n", stack_bottom);
|
|
printf("uint32_t al = argc * 4; for (int i = 0; i < argc; i++) al += strlen(argv[i]) + 1;\n");
|
|
printf("uint32_t arg_addr = wrapper_malloc(mem, al);\n");
|
|
printf("MEM_U32(0x%x) = arg_addr;\n", symbol_names_inv.at("__Argv"));
|
|
printf("MEM_U32(0x%x) = arg_addr;\n", stack_bottom + 4);
|
|
printf("uint32_t arg_strpos = arg_addr + argc * 4;\n");
|
|
printf("for (int i = 0; i < argc; i++) {MEM_U32(arg_addr + i * 4) = arg_strpos; uint32_t p = 0; do { MEM_S8(arg_strpos) = argv[i][p]; ++arg_strpos; } while (argv[i][p++] != '\\0');}\n");
|
|
|
|
printf("setup_libc_data(mem);\n");
|
|
|
|
//printf("gp = 0x%x;\n", gp_value); // only to recreate the outcome when ugen reads uninitialized stack memory
|
|
|
|
printf("int ret = f_main(mem, 0x%x", stack_bottom);
|
|
Function& main_func = functions[main_addr];
|
|
if (main_func.nargs >= 1) {
|
|
printf(", argc");
|
|
}
|
|
if (main_func.nargs >= 2) {
|
|
printf(", arg_addr");
|
|
}
|
|
printf(");\n");
|
|
if (TRACE) {
|
|
printf("end: fprintf(stderr, \"cnt: %%llu\\n\", cnt);\n");
|
|
}
|
|
printf("return ret;\n");
|
|
printf("}\n");
|
|
|
|
for (auto& f_it : functions) {
|
|
Function& f = f_it.second;
|
|
uint32_t start_addr = f_it.first;
|
|
uint32_t end_addr = f.end_addr;
|
|
|
|
if (insns[addr_to_i(start_addr)].f_livein == 0) {
|
|
// Non-used function, skip
|
|
continue;
|
|
}
|
|
|
|
printf("\n");
|
|
dump_function_signature(f, start_addr);
|
|
printf(" {\n");
|
|
printf("const uint32_t zero = 0;\n");
|
|
if (!conservative) {
|
|
printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
|
|
printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, s0 = 0, s1 = 0, s2 = 0, s3 = 0, s4 = 0, s5 = 0,\n");
|
|
printf("s6 = 0, s7 = 0, t8 = 0, t9 = 0, gp = 0, fp = 0, s8 = 0, ra = 0;\n");
|
|
} else {
|
|
printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
|
|
printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, gp = 0x10000, ra = 0x10000;\n");
|
|
}
|
|
printf("uint32_t lo = 0, hi = 0;\n");
|
|
printf("int cf = 0;\n");
|
|
printf("uint64_t temp64;\n");
|
|
printf("uint32_t fp_dest;\n");
|
|
printf("void *dest;\n");
|
|
if (!f.v0_in) {
|
|
printf("uint32_t v0 = 0;\n");
|
|
}
|
|
for (uint32_t j = f.nargs; j < 4; j++) {
|
|
printf("uint32_t %s = 0;\n", r(MIPS_REG_A0 + j));
|
|
}
|
|
|
|
for (size_t i = addr_to_i(start_addr), end_i = addr_to_i(end_addr); i < end_i; i++) {
|
|
Insn& insn = insns[i];
|
|
uint32_t vaddr = text_vaddr + i * 4;
|
|
if (label_addresses.count(vaddr)) {
|
|
printf("L%x:\n", vaddr);
|
|
}
|
|
dump_instr(i);
|
|
}
|
|
|
|
printf("}\n");
|
|
}
|
|
/*for (size_t i = 0; i < insns.size(); i++) {
|
|
Insn& insn = insns[i];
|
|
uint32_t vaddr = text_vaddr + i * 4;
|
|
auto fn_it = functions.find(vaddr);
|
|
if (fn_it != functions.end()) {
|
|
Function& f = fn_it->second;
|
|
printf("}\n\n");
|
|
switch (f.nret) {
|
|
case 0:
|
|
printf("void ");
|
|
break;
|
|
case 1:
|
|
printf("uint32_t ");
|
|
break;
|
|
case 2:
|
|
printf("uint64_t ");
|
|
break;
|
|
}
|
|
auto name_it = symbol_names.find(vaddr);
|
|
if (name_it != symbol_names.end()) {
|
|
printf("%s", name_it->second.c_str());
|
|
} else {
|
|
printf("func_%x", vaddr);
|
|
}
|
|
printf("(uint8_t *mem, uint32_t sp");
|
|
if (f.v0_in) {
|
|
printf(", uint32_t %s", r(MIPS_REG_V0));
|
|
}
|
|
for (uint32_t i = 0; i < f.nargs; i++) {
|
|
printf(", uint32_t %s", r(MIPS_REG_A0 + i));
|
|
}
|
|
printf(") {\n");
|
|
printf("const uint32_t zero = 0;\n");
|
|
printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
|
|
printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, s0 = 0, s1 = 0, s2 = 0, s3 = 0, s4 = 0, s5 = 0,\n");
|
|
printf("s6 = 0, s7 = 0, t8 = 0, t9 = 0, gp = 0, fp = 0, s8 = 0, ra = 0;\n");
|
|
printf("uint32_t lo = 0, hi = 0;\n");
|
|
printf("int cf = 0;\n");
|
|
if (!f.v0_in) {
|
|
printf("uint32_t v0 = 0;\n");
|
|
}
|
|
for (uint32_t j = f.nargs; j < 4; j++) {
|
|
printf("uint32_t %s = 0;\n", r(MIPS_REG_A0 + j));
|
|
}
|
|
}
|
|
if (label_addresses.count(vaddr)) {
|
|
printf("L%x:\n", vaddr);
|
|
}
|
|
dump_instr(i);
|
|
}*/
|
|
}
|
|
|
|
static void parse_elf(const uint8_t *data, size_t file_len) {
|
|
Elf32_Ehdr *ehdr;
|
|
Elf32_Shdr *shdr, *str_shdr, *sym_shdr = NULL, *dynsym_shdr, *dynamic_shdr, *reginfo_shdr, *got_shdr, *sym_strtab, *sym_dynstr;
|
|
int text_section_index = -1;
|
|
int symtab_section_index = -1;
|
|
int dynsym_section_index = -1;
|
|
int reginfo_section_index = -1;
|
|
int dynamic_section_index = -1;
|
|
int got_section_index = -1;
|
|
int rodata_section_index = -1;
|
|
int data_section_index = -1;
|
|
int bss_section_index = -1;
|
|
uint32_t text_offset = 0;
|
|
uint32_t vaddr_adj = 0;
|
|
|
|
if (file_len < 4 || data[0] != 0x7f || data[1] != 'E' || data[2] != 'L' || data[3] != 'F') {
|
|
fprintf(stderr, "Not an ELF file.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
ehdr = (Elf32_Ehdr *) data;
|
|
if (ehdr->e_ident[EI_DATA] != 2 || u16be(ehdr->e_machine) != 8) {
|
|
fprintf(stderr, "Not big-endian MIPS.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (u16be(ehdr->e_shstrndx) == 0) {
|
|
// (We could look at program headers instead in this case.)
|
|
fprintf(stderr, "Missing section headers; stripped binaries are not yet supported.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
#define SECTION(index) (Elf32_Shdr *)(data + u32be(ehdr->e_shoff) + (index) * u16be(ehdr->e_shentsize))
|
|
#define STR(strtab, offset) (const char *)(data + u32be(strtab->sh_offset) + offset)
|
|
|
|
str_shdr = SECTION(u16be(ehdr->e_shstrndx));
|
|
for (int i = 0; i < u16be(ehdr->e_shnum); i++) {
|
|
shdr = SECTION(i);
|
|
const char *name = STR(str_shdr, u32be(shdr->sh_name));
|
|
if (strcmp(name, ".text") == 0) {
|
|
text_offset = u32be(shdr->sh_offset);
|
|
text_vaddr = u32be(shdr->sh_addr);
|
|
vaddr_adj = text_vaddr - u32be(shdr->sh_addr);
|
|
text_section_len = u32be(shdr->sh_size);
|
|
text_section = data + text_offset;
|
|
text_section_index = i;
|
|
}
|
|
if (u32be(shdr->sh_type) == SHT_SYMTAB) {
|
|
symtab_section_index = i;
|
|
}
|
|
if (u32be(shdr->sh_type) == SHT_DYNSYM) {
|
|
dynsym_section_index = i;
|
|
}
|
|
if (u32be(shdr->sh_type) == SHT_MIPS_REGINFO) {
|
|
reginfo_section_index = i;
|
|
}
|
|
if (u32be(shdr->sh_type) == SHT_DYNAMIC) {
|
|
dynamic_section_index = i;
|
|
}
|
|
if (strcmp(name, ".got") == 0) {
|
|
got_section_index = i;
|
|
}
|
|
if (strcmp(name, ".rodata") == 0) {
|
|
rodata_section_index = i;
|
|
}
|
|
if (strcmp(name, ".data") == 0) {
|
|
data_section_index = i;
|
|
}
|
|
if (strcmp(name, ".bss") == 0) {
|
|
bss_section_index = i;
|
|
}
|
|
}
|
|
|
|
if (text_section_index == -1) {
|
|
fprintf(stderr, "Missing .text section.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (symtab_section_index == -1 && dynsym_section_index == -1) {
|
|
fprintf(stderr, "Missing .symtab or .dynsym section.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
if (dynsym_section_index != -1) {
|
|
if (reginfo_section_index == -1) {
|
|
fprintf(stderr, "Missing .reginfo section.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (dynamic_section_index == -1) {
|
|
fprintf(stderr, "Missing .dynamic section.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
if (got_section_index == -1) {
|
|
fprintf(stderr, "Missing .got section.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
if (rodata_section_index != -1) {
|
|
shdr = SECTION(rodata_section_index);
|
|
uint32_t size = u32be(shdr->sh_size);
|
|
rodata_section = data + u32be(shdr->sh_offset);
|
|
rodata_section_len = size;
|
|
rodata_vaddr = u32be(shdr->sh_addr);
|
|
}
|
|
|
|
if (data_section_index != -1) {
|
|
shdr = SECTION(data_section_index);
|
|
uint32_t size = u32be(shdr->sh_size);
|
|
data_section = data + u32be(shdr->sh_offset);
|
|
data_section_len = size;
|
|
data_vaddr = u32be(shdr->sh_addr);
|
|
}
|
|
|
|
if (bss_section_index != -1) {
|
|
shdr = SECTION(bss_section_index);
|
|
uint32_t size = u32be(shdr->sh_size);
|
|
bss_section_len = size;
|
|
bss_vaddr = u32be(shdr->sh_addr);
|
|
}
|
|
|
|
|
|
// add symbols
|
|
if (symtab_section_index != -1) {
|
|
sym_shdr = SECTION(symtab_section_index);
|
|
sym_strtab = SECTION(u32be(sym_shdr->sh_link));
|
|
assert(0 && ".symtab not supported - use a program with .dynsym instead");
|
|
|
|
assert(u32be(sym_shdr->sh_entsize) == sizeof(Elf32_Sym));
|
|
for (uint32_t i = 0; i < u32be(sym_shdr->sh_size); i += sizeof(Elf32_Sym)) {
|
|
Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(sym_shdr->sh_offset) + i);
|
|
const char *name = STR(sym_strtab, u32be(sym->st_name));
|
|
uint32_t addr = u32be(sym->st_value);
|
|
if (u16be(sym->st_shndx) != text_section_index || name[0] == '.') {
|
|
continue;
|
|
}
|
|
addr += vaddr_adj;
|
|
//disasm_label_add(state, name, addr, u32be(sym->st_size), true);
|
|
}
|
|
}
|
|
|
|
if (dynsym_section_index != -1) {
|
|
dynsym_shdr = SECTION(dynsym_section_index);
|
|
sym_dynstr = SECTION(u32be(dynsym_shdr->sh_link));
|
|
reginfo_shdr = SECTION(reginfo_section_index);
|
|
dynamic_shdr = SECTION(dynamic_section_index);
|
|
got_shdr = SECTION(got_section_index);
|
|
|
|
Elf32_RegInfo *reg_info = (Elf32_RegInfo *)(data + u32be(reginfo_shdr->sh_offset));
|
|
uint32_t gp_base = u32be(reg_info->ri_gp_value); // gp should have this value through the program run
|
|
uint32_t got_start = 0;
|
|
uint32_t local_got_no = 0;
|
|
uint32_t first_got_sym = 0;
|
|
uint32_t dynsym_no = 0; // section size can't be used due to alignment 16 padding
|
|
|
|
assert(u32be(dynamic_shdr->sh_entsize) == sizeof(Elf32_Dyn));
|
|
for (uint32_t i = 0; i < u32be(dynamic_shdr->sh_size); i += sizeof(Elf32_Dyn)) {
|
|
Elf32_Dyn *dyn = (Elf32_Dyn *)(data + u32be(dynamic_shdr->sh_offset) + i);
|
|
if (u32be(dyn->d_tag) == DT_PLTGOT) {
|
|
got_start = u32be(dyn->d_un.d_ptr);
|
|
}
|
|
if (u32be(dyn->d_tag) == DT_MIPS_LOCAL_GOTNO) {
|
|
local_got_no = u32be(dyn->d_un.d_val);
|
|
}
|
|
if (u32be(dyn->d_tag) == DT_MIPS_GOTSYM) {
|
|
first_got_sym = u32be(dyn->d_un.d_val);
|
|
}
|
|
if (u32be(dyn->d_tag) == DT_MIPS_SYMTABNO) {
|
|
dynsym_no = u32be(dyn->d_un.d_val);
|
|
}
|
|
}
|
|
|
|
assert(got_start != 0);
|
|
|
|
// value to add to asm gp offset, for example 32752, if -32752(gp) refers to the first entry in got.
|
|
uint32_t gp_adj = gp_base - got_start;
|
|
assert(gp_adj < 0x10000);
|
|
|
|
assert(u32be(dynsym_shdr->sh_entsize) == sizeof(Elf32_Sym));
|
|
uint32_t global_got_no = dynsym_no - first_got_sym;
|
|
//global_got_entry *global_entries = (global_got_entry *)calloc(global_got_no, sizeof(global_got_entry));
|
|
got_globals.resize(global_got_no);
|
|
|
|
uint32_t common_start = ~0U;
|
|
vector<string> common_order;
|
|
|
|
for (uint32_t i = 0; i < dynsym_no; i++) {
|
|
Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(dynsym_shdr->sh_offset) + i * sizeof(Elf32_Sym));
|
|
const char *name = STR(sym_dynstr, u32be(sym->st_name));
|
|
uint32_t addr = u32be(sym->st_value);
|
|
addr += vaddr_adj;
|
|
uint8_t type = ELF32_ST_TYPE(sym->st_info);
|
|
if (!strcmp(name, "_procedure_table")) {
|
|
procedure_table_start = addr;
|
|
} else if (!strcmp(name, "_procedure_table_size")) {
|
|
procedure_table_len = 40 * u32be(sym->st_value);
|
|
}
|
|
if ((u16be(sym->st_shndx) == SHN_MIPS_TEXT && type == STT_FUNC) ||
|
|
(type == STT_OBJECT && (u16be(sym->st_shndx) == SHN_MIPS_ACOMMON || u16be(sym->st_shndx) == SHN_MIPS_DATA)))
|
|
{
|
|
//disasm_label_add(state, name, addr, u32be(sym->st_size), true);
|
|
if (type == STT_OBJECT) {
|
|
}
|
|
if (u16be(sym->st_shndx) == SHN_MIPS_ACOMMON) {
|
|
if (addr < common_start) {
|
|
common_start = addr;
|
|
}
|
|
common_order.push_back(name);
|
|
}
|
|
if (type == STT_FUNC) {
|
|
add_function(addr);
|
|
if (strcmp(name, "main") == 0) {
|
|
main_addr = addr;
|
|
}
|
|
if (strcmp(name, "_mcount") == 0) {
|
|
mcount_addr = addr;
|
|
}
|
|
symbol_names[addr] = name;
|
|
}
|
|
}
|
|
if (i >= first_got_sym) {
|
|
uint32_t got_value = u32be(*(uint32_t *)(data + u32be(got_shdr->sh_offset) + (local_got_no + (i - first_got_sym)) * sizeof(uint32_t)));
|
|
if (u16be(sym->st_shndx) == SHN_MIPS_TEXT && type == STT_FUNC) {
|
|
//got_globals[i - first_got_sym] = got_value;
|
|
//label_addresses.insert(got_value);
|
|
got_globals[i - first_got_sym] = addr; // to include the 3 instr gp header thing
|
|
label_addresses.insert(addr);
|
|
} else if (type == STT_OBJECT && (u16be(sym->st_shndx) == SHN_UNDEF || u16be(sym->st_shndx) == SHN_COMMON)) {
|
|
// symbol defined externally (for example in libc)
|
|
got_globals[i - first_got_sym] = got_value;
|
|
} else {
|
|
got_globals[i - first_got_sym] = addr;
|
|
}
|
|
symbol_names[got_globals[i - first_got_sym]] = name;
|
|
}
|
|
}
|
|
|
|
uint32_t *local_entries = (uint32_t *)calloc(local_got_no, sizeof(uint32_t));
|
|
got_locals.resize(local_got_no);
|
|
for (uint32_t i = 0; i < local_got_no; i++) {
|
|
uint32_t *entry = (uint32_t *)(data + u32be(got_shdr->sh_offset) + i * sizeof(uint32_t));
|
|
got_locals[i] = u32be(*entry);
|
|
}
|
|
|
|
gp_value = gp_base;
|
|
gp_value_adj = gp_adj;
|
|
//disasm_got_entries_set(state, gp_base, gp_adj, local_entries, local_got_no, global_entries, global_got_no);
|
|
|
|
//out_range.common_start = common_start;
|
|
//out_range.common_order.swap(common_order);
|
|
}
|
|
|
|
// add relocations
|
|
for (int i = 0; i < u16be(ehdr->e_shnum); i++) {
|
|
Elf32_Rel *prevHi = NULL;
|
|
shdr = SECTION(i);
|
|
if (u32be(shdr->sh_type) != SHT_REL || u32be(shdr->sh_info) != (uint32_t) text_section_index)
|
|
continue;
|
|
|
|
if (sym_shdr == NULL) {
|
|
fprintf(stderr, "Relocations without .symtab section\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
assert(u32be(shdr->sh_link) == (uint32_t) symtab_section_index);
|
|
assert(u32be(shdr->sh_entsize) == sizeof(Elf32_Rel));
|
|
for (uint32_t i = 0; i < u32be(shdr->sh_size); i += sizeof(Elf32_Rel)) {
|
|
Elf32_Rel *rel = (Elf32_Rel *)(data + u32be(shdr->sh_offset) + i);
|
|
uint32_t offset = text_offset + u32be(rel->r_offset);
|
|
uint32_t symIndex = ELF32_R_SYM(u32be(rel->r_info));
|
|
uint32_t rtype = ELF32_R_TYPE(u32be(rel->r_info));
|
|
const char *symName = "0";
|
|
if (symIndex != STN_UNDEF) {
|
|
Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(sym_shdr->sh_offset) + symIndex * sizeof(Elf32_Sym));
|
|
symName = STR(sym_strtab, u32be(sym->st_name));
|
|
}
|
|
|
|
if (rtype == R_MIPS_HI16) {
|
|
if (prevHi != NULL) {
|
|
fprintf(stderr, "Consecutive R_MIPS_HI16.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
prevHi = rel;
|
|
continue;
|
|
}
|
|
if (rtype == R_MIPS_LO16) {
|
|
int32_t addend = (int16_t)((data[offset + 2] << 8) + data[offset + 3]);
|
|
if (prevHi != NULL) {
|
|
uint32_t offset2 = text_offset + u32be(prevHi->r_offset);
|
|
addend += (uint32_t)((data[offset2 + 2] << 8) + data[offset2 + 3]) << 16;
|
|
//add_reloc(state, offset2, symName, addend, out_range.vaddr);
|
|
}
|
|
prevHi = NULL;
|
|
//add_reloc(state, offset, symName, addend, out_range.vaddr);
|
|
}
|
|
else if (rtype == R_MIPS_26) {
|
|
int32_t addend = (u32be(*(uint32_t*)(data + offset)) & ((1 << 26) - 1)) << 2;
|
|
if (addend >= (1 << 27)) {
|
|
addend -= 1 << 28;
|
|
}
|
|
//add_reloc(state, offset, symName, addend, out_range.vaddr);
|
|
}
|
|
else {
|
|
fprintf(stderr, "Bad relocation type %d.\n", rtype);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
if (prevHi != NULL) {
|
|
fprintf(stderr, "R_MIPS_HI16 without matching R_MIPS_LO16.\n");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
}
|
|
#undef SECTION
|
|
#undef STR
|
|
|
|
size_t read_file(const char *file_name, uint8_t **data) {
|
|
FILE *in;
|
|
uint8_t *in_buf = NULL;
|
|
long file_size;
|
|
long bytes_read;
|
|
in = fopen(file_name, "rb");
|
|
assert(in != nullptr);
|
|
|
|
// allocate buffer to read from offset to end of file
|
|
fseek(in, 0, SEEK_END);
|
|
file_size = ftell(in);
|
|
assert(file_size != -1L);
|
|
|
|
in_buf = (uint8_t *)malloc(file_size);
|
|
fseek(in, 0, SEEK_SET);
|
|
|
|
// read bytes
|
|
bytes_read = fread(in_buf, 1, file_size, in);
|
|
assert(bytes_read == file_size);
|
|
|
|
fclose(in);
|
|
*data = in_buf;
|
|
return bytes_read;
|
|
}
|
|
|
|
int main(int argc, char *argv[]) {
|
|
const char *filename = argv[1];
|
|
if (strcmp(filename, "--conservative") == 0) {
|
|
conservative = true;
|
|
filename = argv[2];
|
|
}
|
|
|
|
uint8_t *data;
|
|
size_t len = read_file(filename, &data);
|
|
parse_elf(data, len);
|
|
assert(cs_open(CS_ARCH_MIPS, (cs_mode)(CS_MODE_MIPS64 | CS_MODE_BIG_ENDIAN), &handle) == CS_ERR_OK);
|
|
cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
|
|
disassemble();
|
|
inspect_data_function_pointers(data_function_pointers, rodata_section, rodata_vaddr, rodata_section_len);
|
|
inspect_data_function_pointers(data_function_pointers, data_section, data_vaddr, data_section_len);
|
|
pass1();
|
|
pass2();
|
|
pass3();
|
|
pass4();
|
|
pass5();
|
|
pass6();
|
|
//dump();
|
|
dump_c();
|
|
free(data);
|
|
cs_close(&handle);
|
|
}
|
|
|