New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature AsmCFG #309

Merged
merged 11 commits into from Jan 26, 2016

Conversation

Projects
None yet
3 participants
@commial
Member

commial commented Jan 25, 2016

Introduce AsmCFG, a class standing for an ASM Control Flow Graph (CFG). This class aims to replace the old representation of ASM blocks as a list of asm_bloc instance.

Indeed, the representation as a DiGraph seems to be closer to what one can expect as an output of a disassembler. In addition, algorithm applied on blocks list, such as block splitting, bad destination retrieving, block graphing and sanity checking for assembler are working on a graph (but were using block.btos to build a kind of intermediate graph construction, ending in more complex code snippets). As these algorithms were built to work on a disassembler outputs and are strongly connected to it, they have been rewritten as AsmCFG method.

In order to be much easier to use, edges are binded on blocks constraints, ie. adding or deleting an edge will impact implicated .btos. The reverse operation (re-synchronization between .btos) and edges can be done thanks to a rebuild_edges helper.

A regression test for miasm2.core.asmbloc has also been added (it should be enough commented to illustrates some uses and associated APIs).
As an example, with the new API:

# Get a AsmCFG instance from a function
blocks = mdis.dis_multibloc(addr).
# Output it for visualization
open("cfg.dot", "w").write(blocks.dot())
# Find reachable blocks from the graph root(s)
for head in blocks.heads():
    for asm_block in blocks.reachable_sons(head):
        ...
# Get a specific assembly block from its label (lazy built)
a_block = blocks.label2block(my_label)
# Remove a block and its associated edges, updating its predecessors .bto
blocks.delete(a_block)

To prevent hours of debugging, a few DeprecationWarning with hints have been added on old APIs.

As they are related, this PR also introduces DiGraphSimplifier, which aims to be the counterpart of ExpressionSimplifier for DiGraph.
One can register graph simplification, which will be applied on a graph (actually, on a copy of this graph) until a fixed point has been reached.
The exposed API is close to the one of ExpressionSimplfier, ie using enable_passes(list of simplifications) to enable simplification passes, then applying the simplifier thanks to simp.apply(graph) or simp(graph) to get back a new, simplified, graph.

Its use is illustrated in miasm2.core.asmbloc: bbl_simplifier which ship a block merging pass (former bloc_merge). This implementation gets rid of some piece of code (see 3882129 for more details), and seems, in my opinion, easier to understand.

@commial commial force-pushed the commial:feature-basicblocks branch from e553f35 to cd73364 Jan 25, 2016

@@ -142,15 +142,13 @@
# Generate dotty graph
all_blocs = []
all_blocs = BasicBlocks()

This comment has been minimized.

@mrphrazer

mrphrazer Jan 26, 2016

Contributor

I don't know if this is intended, but I noticed that you switch to "blocks", in general. In some parts of this PR you leave it as "bloc". Especially in the code above and below, down to asmbloc.py.

This comment has been minimized.

@commial

commial Jan 26, 2016

Member

Actually, "bloc" is the French word for "block". This is an error which is repeated all along Miasm, even in main structure (asm_bloc) or module name (miasm2.core.asmbloc).
Instead of breaking a lot of APIs, I prefer correct them inside function when I modify code around it. But we may correct it once and for all, a day.

So, following this reasoning, I will fix this one 😄

This comment has been minimized.

@commial

commial Jan 26, 2016

Member

After a quick review, there are too many lines to change regarding this correction, lines which are not correlated with the logic of the concerned commit.
Then, I prefer to make a separate commit for all of them, and, a separate PR for the same reasons.

Thanks for your review!

@commial commial force-pushed the commial:feature-basicblocks branch from cd73364 to d6222c4 Jan 26, 2016

@commial commial changed the title from Feature basicblocks to Feature AsmCFG Jan 26, 2016

serpilliere added a commit that referenced this pull request Jan 26, 2016

@serpilliere serpilliere merged commit c1bc567 into cea-sec:master Jan 26, 2016

2 checks passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details
pylint Note: +0.01
Details

@commial commial deleted the commial:feature-basicblocks branch Jan 27, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment