B2R2


RegularFunction Type

Regular function is a function that has its own body in the target binary. Therefore, regular functions have their own IR-level CFG.

Constructors

Constructor Description

RegularFunction(histMgr, hdl, entry)

Full Usage: RegularFunction(histMgr, hdl, entry)

Parameters:
Returns: RegularFunction

Create a new RegularFunction.

histMgr : HistoryManager
hdl : BinHandle
entry : Addr
Returns: RegularFunction

Instance members

Instance member Description

this.AccumulateXRefs(xrefs)

Full Usage: this.AccumulateXRefs(xrefs)

Parameters:
Returns: Map<Addr, Set<Addr>>

Accumulate cross references only if there is a change in the call edges.

xrefs : Map<Addr, Set<Addr>>
Returns: Map<Addr, Set<Addr>>

this.AddEdge(callSite, callee, ftAddr)

Full Usage: this.AddEdge(callSite, callee, ftAddr)

Parameters:

Add/replace a ret edge to this function.

callSite : Addr
callee : Addr
ftAddr : Addr

this.AddEdge(callerBlk, callSite)

Full Usage: this.AddEdge(callerBlk, callSite)

Parameters:

Add/replace an indirect call edge to this function.

callerBlk : ProgramPoint
callSite : Addr

this.AddEdge(callerBlk, callSite, callee, isTailCall)

Full Usage: this.AddEdge(callerBlk, callSite, callee, isTailCall)

Parameters:

Add/replace a direct call edge to this function.

callerBlk : ProgramPoint
callSite : Addr
callee : Addr
isTailCall : bool

this.AddEdge(srcPp, dstPp, edge)

Full Usage: this.AddEdge(srcPp, dstPp, edge)

Parameters:

Add/replace a regular edge to this function.

srcPp : ProgramPoint
dstPp : ProgramPoint
edge : CFGEdgeKind

this.AddSysCallSite(callSiteAddr)

Full Usage: this.AddSysCallSite(callSiteAddr)

Parameters:
    callSiteAddr : Addr

Add a syscall callsite.

callSiteAddr : Addr

this.AddVertex(instrs, leader)

Full Usage: this.AddVertex(instrs, leader)

Parameters:
Returns: Vertex<IRBasicBlock>

Add a parsed regular basic block (given as an array of instructions along with its leader address) to this function.

instrs : InstructionInfo[]
leader : ProgramPoint
Returns: Vertex<IRBasicBlock>

this.AddVertex(blk)

Full Usage: this.AddVertex(blk)

Parameters:
Returns: Vertex<IRBasicBlock>

Add a vertex of a parsed regular basic block to this function.

blk : IRBasicBlock
Returns: Vertex<IRBasicBlock>

this.AmountUnwinding

Full Usage: this.AmountUnwinding

This field indicates the amount of stack unwinding happening at the return of this function. This value is 0 if caller cleans the stack (e.g., cdecl). That is, this value is only meaning for calling conventions where callee cleans up the stack, such as stdcall.

this.CallEdges

Full Usage: this.CallEdges

Returns: (Addr * CalleeKind)[]

A sequence of call edges (call site address, callee). That is, a CallEdge represents a function call edge from the caller bbl to its callee(s).

Returns: (Addr * CalleeKind)[]

this.CallTargets(callSiteAddr)

Full Usage: this.CallTargets(callSiteAddr)

Parameters:
    callSiteAddr : Addr

Returns: Set<Addr>

Returns the set of call target addresses. This function returns the correct set regardless of their callee types; for indirect calls, it returns a set of resolved target addresses, and for direct calls, it returns a singleton target address set.

callSiteAddr : Addr
Returns: Set<Addr>

this.ClearCallEdges()

Full Usage: this.ClearCallEdges()

Remove call edge information from this function.

this.CountRegularVertices

Full Usage: this.CountRegularVertices

Returns: int

Return the current number of regular vertices in this function's IRCFG.

Returns: int

this.FindJumpTableAddr(indJumpAddr)

Full Usage: this.FindJumpTableAddr(indJumpAddr)

Parameters:
    indJumpAddr : Addr

Returns: Addr

Retrieve the jump table address of a given indirect jump address.

indJumpAddr : Addr
Returns: Addr

this.FindVertex(pp)

Full Usage: this.FindVertex(pp)

Parameters:
Returns: Vertex<IRBasicBlock>

Find an IRCFG vertex at the given program point.

pp : ProgramPoint
Returns: Vertex<IRBasicBlock>

this.FoldRegularVertices(fn) (acc)

Full Usage: this.FoldRegularVertices(fn) (acc)

Parameters:
Returns: 'a

Fold each regular vertex in this function.

fn : 'a -> KeyValuePair<ProgramPoint, Vertex<IRBasicBlock>> -> 'a
acc : 'a
Returns: 'a

this.GapAddresses

Full Usage: this.GapAddresses

Returns: Map<Addr, Addr>

Return the sorted gaps' ranges. Each range is a mapping from a start address to an end address (exclusive).

Returns: Map<Addr, Addr>

this.GetPCThunkInfo

Full Usage: this.GetPCThunkInfo

This field is to remember a register ID that holds a PC value. When this function is deemed as a special thunk (e.g., *_get_pc_thunk), the register will hold a PC value after this function returns.

this.GetSSACFG(hdl)

Full Usage: this.GetSSACFG(hdl)

Parameters:
Returns: DiGraph<SSABasicBlock, CFGEdgeKind> * Vertex<SSABasicBlock>

Retrieve the SSA CFG of this function.

hdl : BinHandle
Returns: DiGraph<SSABasicBlock, CFGEdgeKind> * Vertex<SSABasicBlock>

this.HasVertex(v)

Full Usage: this.HasVertex(v)

Parameters:
Returns: bool

Check if the given vertex exists in this function.

v : ProgramPoint
Returns: bool

this.IRCFG

Full Usage: this.IRCFG

IR-level CFG of this function.

this.IndirectJumps

Full Usage: this.IndirectJumps

Returns: SortedList<Addr, IndirectJumpKind>

Return a Dictionary that maps an indirect jump address to its jump kinds.

Returns: SortedList<Addr, IndirectJumpKind>

this.IsAddressCovered(addr)

Full Usage: this.IsAddressCovered(addr)

Parameters:
Returns: bool

Check if the function regards the given address as a valid instruction address.

addr : Addr
Returns: bool

this.IsUnresolvedIndirectCall(callSiteAddr)

Full Usage: this.IsUnresolvedIndirectCall(callSiteAddr)

Parameters:
    callSiteAddr : Addr

Returns: bool

Is the given indirect call unresolved?

callSiteAddr : Addr
Returns: bool

this.IterRegularVertexPps(fn)

Full Usage: this.IterRegularVertexPps(fn)

Parameters:

Iterate each regular vertex's program points.

fn : ProgramPoint -> unit

this.JumpTableAddrs

Full Usage: this.JumpTableAddrs

Returns: Addr list

Retrieve the currently known jump table addresses.

Returns: Addr list

this.MarkIndJumpAsAnalyzed(indJumpAddr) (tAddr)

Full Usage: this.MarkIndJumpAsAnalyzed(indJumpAddr) (tAddr)

Parameters:

Mark the given indirect jump as analyzed; we know the table address of it.

indJumpAddr : Addr
tAddr : Addr

this.MarkIndJumpAsUnknown(indJumpAddr)

Full Usage: this.MarkIndJumpAsUnknown(indJumpAddr)

Parameters:
    indJumpAddr : Addr

Mark the given indirect jump as unknown.

indJumpAddr : Addr

this.MaxAddr

Full Usage: this.MaxAddr

The maximum address of this function's range.

this.MergeVerticesWithInlinedAsmChunk(insAddrs, srcPp, dstPp, chunk)

Full Usage: this.MergeVerticesWithInlinedAsmChunk(insAddrs, srcPp, dstPp, chunk)

Parameters:

Merge two vertices connected with an inlined assembly chunk, where there is a control-flow to the middle of an instruction.

insAddrs : Addr list
srcPp : ProgramPoint
dstPp : ProgramPoint
chunk : Instruction

this.MinAddr

Full Usage: this.MinAddr

The minimum address of this function's range.

this.RegisterNewIndJump(indJumpAddr)

Full Usage: this.RegisterNewIndJump(indJumpAddr)

Parameters:
    indJumpAddr : Addr

Register a new indirect jump as YetAnalyzed.

indJumpAddr : Addr

this.RemoveEdge(src, dst, _kind)

Full Usage: this.RemoveEdge(src, dst, _kind)

Parameters:

Remove the given edge.

src : Vertex<IRBasicBlock>
dst : Vertex<IRBasicBlock>
_kind : 'a

this.RemoveEdge(src, dst)

Full Usage: this.RemoveEdge(src, dst)

Parameters:

Remove the given edge.

src : Vertex<IRBasicBlock>
dst : Vertex<IRBasicBlock>

this.RemoveFakeVertex(fakeEdgeKey)

Full Usage: this.RemoveFakeVertex(fakeEdgeKey)

Parameters:

Remove the fake block from this function.

fakeEdgeKey : Addr * Addr

this.RemoveSysCallSite(callSiteAddr)

Full Usage: this.RemoveSysCallSite(callSiteAddr)

Parameters:
    callSiteAddr : Addr

Remove the syscall callsite.

callSiteAddr : Addr

this.RemoveVertex(pp)

Full Usage: this.RemoveVertex(pp)

Parameters:

Remove the regular basic block at the given program point from this function.

pp : ProgramPoint

this.SetBoundary(minAddr) (maxAddr)

Full Usage: this.SetBoundary(minAddr) (maxAddr)

Parameters:

Set the boundary of this function; set both MinAddr and MaxAddr.

minAddr : Addr
maxAddr : Addr

this.SplitBBL(bblPoint, splitPoint)

Full Usage: this.SplitBBL(bblPoint, splitPoint)

Parameters:
Returns: Vertex<IRBasicBlock>

Split the BBL at bblPoint into two at the splitPoint. This function returns the second block located at the splitPoint.

bblPoint : ProgramPoint
splitPoint : ProgramPoint
Returns: Vertex<IRBasicBlock>

this.SplitFunction(hdl, newEntry)

Full Usage: this.SplitFunction(hdl, newEntry)

Parameters:
Returns: Set<Vertex<IRBasicBlock>> * RegularFunction

Split this function into two separate functions, one is this one, the original function, and the other is a function starting from newEntry.

hdl : BinHandle
newEntry : Addr
Returns: Set<Vertex<IRBasicBlock>> * RegularFunction

this.SyscallSites

Full Usage: this.SyscallSites

Returns: SortedSet<Addr>

A set of bbl entry points which have syscall at the end of each.

Returns: SortedSet<Addr>

this.TryFindVertex(pp)

Full Usage: this.TryFindVertex(pp)

Parameters:
Returns: Vertex<IRBasicBlock> option

Try to find an IRCFG vertex at the given program point.

pp : ProgramPoint
Returns: Vertex<IRBasicBlock> option

this.UnresolvedIndirectCallEdges

Full Usage: this.UnresolvedIndirectCallEdges

Returns: Addr[]

Return only a sequence of unresolved indirect call edge info: a tuple of (call site addr, fall-through addr).

Returns: Addr[]

this.UpdateCallEdgeInfo(callSiteAddr, callee)

Full Usage: this.UpdateCallEdgeInfo(callSiteAddr, callee)

Parameters:

Update the call edge info.

callSiteAddr : Addr
callee : CalleeKind

this.YetAnalyzedIndirectJumpAddrs

Full Usage: this.YetAnalyzedIndirectJumpAddrs

Returns: Addr list

Return an array of yet-analyzed indirect jump addresses.

Returns: Addr list

Static members

Static member Description

RegularFunction.AddEdgeByType(fn) (src) (dst) (e)

Full Usage: RegularFunction.AddEdgeByType(fn) (src) (dst) (e)

Parameters:
fn : RegularFunction
src : Vertex<IRBasicBlock>
dst : Vertex<IRBasicBlock>
e : CFGEdgeKind