static int g_skip_func;
static int g_allow_regfunc;
static int g_allow_user_icall;
+static int g_nowarn_reguse;
static int g_quiet_pp;
static int g_header_mode;
// note: this skips over calls and rm'd stuff assuming they're handled
// so it's intended to use at one of final passes
+// exception: doesn't skip OPF_RSAVE stuff
static int scan_for_pop(int i, int opcnt, int magic, int reg,
- int depth, int seen_noreturn, int flags_set)
+ int depth, int seen_noreturn, int save_level, int flags_set)
{
struct parsed_op *po;
int relevant;
po->cc_scratch = magic;
if (po->flags & OPF_TAIL) {
- if (po->op == OP_CALL) {
- if (po->pp != NULL && po->pp->is_noreturn)
- seen_noreturn = 1;
- else
+ if (po->op == OP_CALL && po->pp != NULL && po->pp->is_noreturn) {
+ // msvc sometimes generates stack cleanup code after
+ // noreturn, set a flag and continue
+ seen_noreturn = 1;
+
+ // ... but stop if there is another path to next insn -
+ // if msvc skipped something stack tracking may mess up
+ if (i + 1 < opcnt && g_labels[i + 1] != NULL)
goto out;
}
else
goto out;
}
- if (po->flags & (OPF_RMD|OPF_DONE|OPF_FARG))
+ if (po->flags & OPF_FARG)
continue;
+ if (po->flags & (OPF_RMD|OPF_DONE)) {
+ if (!(po->flags & OPF_RSAVE))
+ continue;
+ // reprocess, there might be another push in some "parallel"
+ // path that took a pop what we should also take
+ }
if ((po->flags & OPF_JMP) && po->op != OP_CALL) {
if (po->btj != NULL) {
for (j = 0; j < po->btj->count; j++) {
check_i(po, po->btj->d[j].bt_i);
ret |= scan_for_pop(po->btj->d[j].bt_i, opcnt, magic, reg,
- depth, seen_noreturn, flags_set);
+ depth, seen_noreturn, save_level, flags_set);
if (ret < 0)
return ret; // dead end
}
check_i(po, po->bt_i);
if (po->flags & OPF_CJMP) {
ret |= scan_for_pop(po->bt_i, opcnt, magic, reg,
- depth, seen_noreturn, flags_set);
+ depth, seen_noreturn, save_level, flags_set);
if (ret < 0)
return ret; // dead end
}
}
else if (po->op == OP_POP) {
if (relevant && depth == 0) {
+ if (flags_set == 0 && save_level > 0) {
+ ret = scan_for_pop(i + 1, opcnt, magic, reg,
+ depth, seen_noreturn, save_level - 1, flags_set);
+ if (ret != 1)
+ // no pop for other levels, current one must be false
+ return -1;
+ }
po->flags |= flags_set;
return 1;
}
}
static void scan_for_call_type(int i, const struct parsed_opr *opr,
- int magic, const struct parsed_proto **pp_found, int *pp_i,
- int *multi)
+ int magic, int is_call_op, const struct parsed_proto **pp_found,
+ int *pp_i, int *multi)
{
const struct parsed_proto *pp = NULL;
struct parsed_op *po;
lr = &g_label_refs[i];
for (; lr != NULL; lr = lr->next) {
check_i(&ops[i], lr->i);
- scan_for_call_type(lr->i, opr, magic, pp_found, pp_i, multi);
+ scan_for_call_type(lr->i, opr, magic, is_call_op,
+ pp_found, pp_i, multi);
}
if (i > 0 && LAST_OP(i - 1))
return;
if (i == g_func_pp->argc)
return;
pp = g_func_pp->arg[i].pp;
- if (pp == NULL)
- ferr(po, "icall: arg%d (%s) is not a fptr?\n",
- i + 1, g_func_pp->arg[i].reg);
+ if (pp == NULL) {
+ if (is_call_op)
+ ferr(po, "icall: arg%d (%s) is not a fptr?\n",
+ i + 1, g_func_pp->arg[i].reg);
+ return;
+ }
check_func_pp(po, pp, "icall reg-arg");
}
else
- pp = try_recover_pp(po, opr, 1, NULL);
+ pp = try_recover_pp(po, opr, is_call_op, NULL);
if (*pp_found != NULL && pp != NULL && *pp_found != pp) {
- if (!IS((*pp_found)->ret_type.name, pp->ret_type.name)
- || (*pp_found)->is_stdcall != pp->is_stdcall
- //|| (*pp_found)->is_fptr != pp->is_fptr
- || (*pp_found)->argc != pp->argc
- || (*pp_found)->argc_reg != pp->argc_reg
- || (*pp_found)->argc_stack != pp->argc_stack)
- {
+ if (pp_cmp_func(*pp_found, pp)) {
+ if (pp_i != NULL && *pp_i != -1)
+ fnote(&ops[*pp_i], "(other ref)\n");
ferr(po, "icall: parsed_proto mismatch\n");
}
- *multi = 1;
+ if (multi != NULL)
+ *multi = 1;
}
if (pp != NULL) {
*pp_found = pp;
- *pp_i = po - ops;
+ if (pp_i != NULL)
+ *pp_i = po - ops;
}
}
}
// unlike pushes after sub esp,
- // IDA treats pushed like this as part of var area
+ // IDA treats pushes like this as part of var area
*fsz += seq_len * 4;
}
for (; i < opcnt; i++) {
if (i > 0 && g_labels[i] != NULL)
break;
- if (ops[i].op == OP_PUSH || (ops[i].flags & (OPF_JMP|OPF_TAIL)))
+ if (ops[i].flags & (OPF_JMP|OPF_TAIL))
+ break;
+ if (ops[i].flags & OPF_DONE)
+ continue;
+ if (ops[i].op == OP_PUSH)
break;
if (ops[i].op == OP_SUB && ops[i].operand[0].reg == xSP
&& ops[i].operand[1].type == OPT_CONST)
ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS;
i = j + 1;
*esp_sub = 1;
+ break;
}
- break;
}
}
for (; j >= 0; j--) {
if (ops[j].op != OP_MOV)
break;
- if (ops[j].operand[0].type != OPT_REGMEM)
- break;
- if (strstr(ops[j].operand[0].name, "arg_") == NULL)
- break;
+ if (ops[j].operand[0].type == OPT_REGMEM
+ && strstr(ops[j].operand[0].name, "arg_") != NULL)
+ continue;
+ if (ops[j].operand[0].type == OPT_REG)
+ continue; // assume arg-reg mov
+ break;
}
}
}
}
+static int resolve_origin_reg(int i, int reg, int magic, int *op_i,
+ int *is_caller)
+{
+ struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, reg);
+
+ *op_i = -1;
+ if (is_caller != NULL)
+ *is_caller = 0;
+ return resolve_origin(i, &opr, magic, op_i, is_caller);
+}
+
// find an instruction that previously referenced opr
// if multiple results are found - fail
// *op_i must be set to -1 by the caller
}
static const struct parsed_proto *resolve_deref(int i, int magic,
- struct parsed_opr *opr, int level)
+ const struct parsed_opr *opr, int level)
{
- struct parsed_opr opr_s = OPR_INIT(OPT_REG, OPLM_DWORD, 0);
const struct parsed_proto *pp = NULL;
int from_caller = 0;
char s_reg[4];
if (reg < 0)
return NULL;
- opr_s.reg = reg;
- ret = resolve_origin(i, &opr_s, i + magic, &j, NULL);
+ ret = resolve_origin_reg(i, reg, i + magic, &j, NULL);
if (ret != 1)
return NULL;
ops[j].operand[1].name);
if (reg < 0)
return NULL;
- opr_s.reg = reg;
- ret = resolve_origin(j, &opr_s, j + magic, &k, NULL);
+ ret = resolve_origin_reg(j, reg, j + magic, &k, NULL);
if (ret != 1)
return NULL;
j = k;
return proto_lookup_struct(g_fhdr, pp->type.name, offset);
}
-static const struct parsed_proto *resolve_icall(int i, int opcnt,
+static const struct parsed_proto *resolve_func_ptr(int i, int opcnt,
+ int is_call_op, const struct parsed_opr *opr,
int *pp_i, int *multi_src)
{
const struct parsed_proto *pp = NULL;
int search_advice = 0;
- *multi_src = 0;
- *pp_i = -1;
+ if (multi_src != NULL)
+ *multi_src = 0;
+ if (pp_i != NULL)
+ *pp_i = -1;
- switch (ops[i].operand[0].type) {
+ switch (opr->type) {
case OPT_REGMEM:
// try to resolve struct member calls
- pp = resolve_deref(i, i + opcnt * 19, &ops[i].operand[0], 0);
+ pp = resolve_deref(i, i + opcnt * 19, opr, 0);
if (pp != NULL)
break;
// fallthrough
case OPT_LABEL:
case OPT_OFFSET:
- pp = try_recover_pp(&ops[i], &ops[i].operand[0],
- 1, &search_advice);
+ pp = try_recover_pp(&ops[i], opr, is_call_op, &search_advice);
if (!search_advice)
break;
// fallthrough
default:
- scan_for_call_type(i, &ops[i].operand[0], i + opcnt * 9, &pp,
- pp_i, multi_src);
+ scan_for_call_type(i, opr, i + opcnt * 9, is_call_op,
+ &pp, pp_i, multi_src);
break;
}
if (pp == NULL)
{
// indirect call
- pp_c = resolve_icall(i, opcnt, &call_i, &multipath);
+ pp_c = resolve_func_ptr(i, opcnt, 1, &ops[i].operand[0],
+ &call_i, &multipath);
if (pp_c != NULL) {
if (!pp_c->is_func && !pp_c->is_fptr)
ferr(po, "call to non-func: %s\n", pp_c->name);
return pp;
}
+static void check_fptr_args(int i, int opcnt, struct parsed_proto *pp)
+{
+ struct parsed_opr s_opr = OPR_INIT(OPT_REG, OPLM_DWORD, 0);
+ const struct parsed_proto *pp_arg, *pp_cmp;
+ const struct parsed_op *po_a;
+ const char *s_reg;
+ int pp_cmp_i;
+ int arg, reg;
+
+ for (arg = 0; arg < pp->argc; arg++) {
+ pp_cmp = NULL;
+ pp_cmp_i = -1;
+
+ pp_arg = pp->arg[arg].pp;
+ if (pp_arg == NULL || !pp_arg->is_func)
+ continue;
+
+ s_reg = pp->arg[arg].reg;
+ if (s_reg != NULL) {
+ reg = char_array_i(regs_r32, ARRAY_SIZE(regs_r32), s_reg);
+ ferr_assert(&ops[i], reg >= 0);
+ s_opr.reg = reg;
+ scan_for_call_type(i, &s_opr, i + arg + opcnt * 28, 0,
+ &pp_cmp, &pp_cmp_i, NULL);
+ }
+ else {
+ po_a = pp->arg[arg].datap;
+ if (po_a != NULL && po_a->op == OP_PUSH)
+ pp_cmp = resolve_func_ptr(po_a - ops, opcnt, 0,
+ &po_a->operand[0], &pp_cmp_i, NULL);
+ if (pp_cmp_i < 0)
+ pp_cmp_i = po_a - ops;
+ }
+
+ if (pp_cmp != NULL && !pp_compatible_func(pp_arg, pp_cmp)) {
+ if (pp_cmp_i >= 0)
+ fnote(&ops[pp_cmp_i], "(referenced here)\n");
+ ferr(&ops[i], "incompatible fptr arg %d\n", arg + 1);
+ }
+ }
+}
+
static void mark_float_arg(struct parsed_op *po,
struct parsed_proto *pp, int arg, int *regmask_ffca)
{
return 0;
}
-static int collect_call_args_early(int i, struct parsed_proto *pp,
- int *regmask, int *regmask_ffca)
+static int collect_call_args_early(int i, int opcnt,
+ struct parsed_proto *pp, int *regmask, int *regmask_ffca)
{
struct parsed_op *po;
int arg, ret;
}
}
+ if (!g_header_mode)
+ check_fptr_args(i, opcnt, pp);
+
return 0;
}
return arg;
}
-static int collect_call_args(struct parsed_op *po, int i,
+static int collect_call_args(struct parsed_op *po, int i, int opcnt,
struct parsed_proto *pp, int *regmask, int magic)
{
// arg group is for cases when pushes for
if (ret < 0)
return ret;
+ if (pp->is_unresolved) {
+ pp->argc += ret;
+ pp->argc_stack += ret;
+ for (a = 0; a < pp->argc; a++)
+ if (pp->arg[a].type.name == NULL)
+ pp->arg[a].type.name = strdup("int");
+ }
+
if (arg_grp != 0) {
// propagate arg_grp
for (a = 0; a < pp->argc; a++) {
}
}
- if (pp->is_unresolved) {
- pp->argc += ret;
- pp->argc_stack += ret;
- for (a = 0; a < pp->argc; a++)
- if (pp->arg[a].type.name == NULL)
- pp->arg[a].type.name = strdup("int");
- }
+ if (!g_header_mode)
+ check_fptr_args(i, opcnt, pp);
return ret;
}
&& !g_func_pp->is_userstack
&& po->operand[0].type == OPT_REG)
{
+ int save_level = 0;
+
reg = po->operand[0].reg;
ferr_assert(po, reg >= 0);
if (regmask_now & (1 << reg)) {
already_saved = regmask_save_now & (1 << reg);
flags_set = OPF_RSAVE | OPF_DONE;
+ save_level++;
}
- ret = scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, 0, 0);
+ ret = scan_for_pop(i + 1, opcnt, i + opcnt * 3,
+ reg, 0, 0, save_level, 0);
if (ret == 1) {
scan_for_pop(i + 1, opcnt, i + opcnt * 4,
- reg, 0, 0, flags_set);
+ reg, 0, 0, save_level, flags_set);
}
else {
ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg, 0);
if (pp != NULL) {
if (!(po->flags & OPF_ATAIL)) {
// since we know the args, try to collect them
- ret = collect_call_args_early(i, pp, ®mask, ®mask_ffca);
+ ret = collect_call_args_early(i, opcnt, pp,
+ ®mask, ®mask_ffca);
if (ret != 0)
pp = NULL;
}
if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) {
// since we know the args, collect them
- collect_call_args(po, i, pp, ®mask, i + opcnt * 2);
+ collect_call_args(po, i, opcnt, pp, ®mask, i + opcnt * 2);
}
// for unresolved, collect after other passes
}
if (pp->is_unresolved) {
int regmask_stack = 0;
- collect_call_args(po, i, pp, ®mask, i + opcnt * 2);
+ collect_call_args(po, i, opcnt, pp, ®mask, i + opcnt * 2);
// this is pretty rough guess:
// see ecx and edx were pushed (and not their saved versions)
regmask_stack |= 1 << tmp_op->operand[0].reg;
}
- if (!((regmask_stack & (1 << xCX))
- && (regmask_stack & (1 << xDX))))
+ // quick dumb check for potential reg-args
+ for (j = i - 1; j >= 0 && ops[j].op == OP_MOV; j--)
+ if (ops[j].operand[0].type == OPT_REG)
+ regmask_stack &= ~(1 << ops[j].operand[0].reg);
+
+ if ((regmask_stack & (mxCX|mxDX)) != (mxCX|mxDX)
+ && ((regmask | regmask_arg) & (mxCX|mxDX)))
{
if (pp->argc_stack != 0
- || ((regmask | regmask_arg) & ((1 << xCX)|(1 << xDX))))
+ || ((regmask | regmask_arg) & (mxCX|mxDX)))
{
pp_insert_reg_arg(pp, "ecx");
pp->is_fastcall = 1;
regmask |= 1 << xCX;
}
if (pp->argc_stack != 0
- || ((regmask | regmask_arg) & (1 << xDX)))
+ || ((regmask | regmask_arg) & mxDX))
{
pp_insert_reg_arg(pp, "edx");
regmask_init |= 1 << xDX;
pp->is_stdcall = 1;
}
if (!(po->flags & OPF_TAIL)
- && !(g_sct_func_attr & SCTFA_NOWARN))
+ && !(g_sct_func_attr & SCTFA_NOWARN) && !g_nowarn_reguse)
{
// treat al write as overwrite to avoid many false positives
if (IS(pp->ret_type.name, "void") || pp->ret_type.is_float) {
default:
break;
}
+ }
+
+ // pass8: final adjustments
+ for (i = 0; i < opcnt; i++)
+ {
+ po = &ops[i];
+ if (po->flags & (OPF_RMD|OPF_DONE))
+ continue;
- // this might need it's own pass...
if (po->op != OP_FST && po->p_argnum > 0)
save_arg_vars[po->p_arggrp] |= 1 << (po->p_argnum - 1);
unsigned int dep_resolved:1;
unsigned int is_stdcall:1;
unsigned int eax_pass:1; // returns without touching eax
+ unsigned int ptr_taken:1; // pointer taken of this func
struct func_proto_dep *dep_func;
int dep_func_cnt;
const struct parsed_proto *pp; // seed pp, if any
unsigned int ret_dep:1; // return from this is caller's return
unsigned int has_ret:1; // found from eax use after return
unsigned int has_ret64:1;
+ unsigned int ptr_taken:1; // pointer taken, not a call
};
static struct func_prototype *hg_fp;
return NULL;
}
-static void hg_fp_add_dep(struct func_prototype *fp, const char *name)
+static void hg_fp_add_dep(struct func_prototype *fp, const char *name,
+ unsigned int ptr_taken)
{
+ struct func_proto_dep * dep;
+
// is it a dupe?
- if (hg_fp_find_dep(fp, name))
+ dep = hg_fp_find_dep(fp, name);
+ if (dep != NULL && dep->ptr_taken == ptr_taken)
return;
if ((fp->dep_func_cnt & 0xff) == 0) {
sizeof(fp->dep_func[0]) * 0x100);
}
fp->dep_func[fp->dep_func_cnt].name = strdup(name);
+ fp->dep_func[fp->dep_func_cnt].ptr_taken = ptr_taken;
fp->dep_func_cnt++;
}
if (po->flags & OPF_DONE)
continue;
- ret = scan_for_pop(i + 1, opcnt, i + opcnt * 2, reg, 0, 0, 0);
+ ret = scan_for_pop(i + 1, opcnt, i + opcnt * 2,
+ reg, 0, 0, 0, 0);
if (ret == 1) {
regmask_save |= 1 << reg;
po->flags |= OPF_RMD;
- scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, 0, OPF_RMD);
+ scan_for_pop(i + 1, opcnt, i + opcnt * 3,
+ reg, 0, 0, 0, OPF_RMD);
continue;
}
}
ret = 1;
}
else {
- struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xAX);
j = -1;
from_caller = 0;
- ret = resolve_origin(i, &opr, i + opcnt * 4, &j, &from_caller);
+ ret = resolve_origin_reg(i, xAX, i + opcnt * 4, &j, &from_caller);
}
if (ret != 1 && from_caller) {
struct func_prototype *fp;
struct func_proto_dep *dep;
struct parsed_op *po;
+ const char *tmpname;
int regmask_dummy = 0;
int regmask_dep;
int regmask_use;
// pass3:
// - remove dead labels
// - collect calls
+ // - collect function ptr refs
for (i = 0; i < opcnt; i++)
{
if (g_labels[i] != NULL && g_label_refs[i].i == -1) {
if (po->op == OP_CALL) {
if (po->operand[0].type == OPT_LABEL)
- hg_fp_add_dep(fp, opr_name(po, 0));
+ hg_fp_add_dep(fp, opr_name(po, 0), 0);
else if (po->pp != NULL)
- hg_fp_add_dep(fp, po->pp->name);
+ hg_fp_add_dep(fp, po->pp->name, 0);
+ }
+ else if (po->op == OP_MOV && po->operand[1].type == OPT_OFFSET) {
+ tmpname = opr_name(po, 1);
+ if (IS_START(tmpname, "p_") || IS_START(tmpname, "sub_"))
+ hg_fp_add_dep(fp, tmpname, 1);
+ }
+ else if (po->op == OP_PUSH && po->operand[0].type == OPT_OFFSET) {
+ tmpname = opr_name(po, 0);
+ if (IS_START(tmpname, "p_") || IS_START(tmpname, "sub_"))
+ hg_fp_add_dep(fp, tmpname, 1);
}
}
if (pp != NULL) {
if (!(po->flags & OPF_ATAIL))
// since we know the args, try to collect them
- if (collect_call_args_early(i, pp, NULL, NULL) != 0)
+ if (collect_call_args_early(i, opcnt, pp, NULL, NULL) != 0)
pp = NULL;
}
if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) {
// since we know the args, collect them
- ret = collect_call_args(po, i, pp, ®mask_dummy,
+ ret = collect_call_args(po, i, opcnt, pp, ®mask_dummy,
i + opcnt * 1);
}
if (!(po->flags & OPF_TAIL)
dep->proto = bsearch(&fp_s, hg_fp, hg_fp_cnt,
sizeof(hg_fp[0]), hg_fp_cmp_name);
if (dep->proto != NULL) {
+ if (dep->ptr_taken) {
+ dep->proto->ptr_taken = 1;
+ continue;
+ }
+
if (!dep->proto->dep_resolved)
hg_fp_resolve_deps(dep->proto);
strcpy(fp_s.name, hg_refs[i]);
fp = bsearch(&fp_s, hg_fp, hg_fp_cnt,
sizeof(hg_fp[0]), hg_fp_cmp_name);
- if (fp == NULL)
- continue;
-
- if (fp->argc_stack != 0 && (fp->regmask_dep & (mxCX | mxDX)))
- fp->regmask_dep |= mxCX | mxDX;
+ if (fp != NULL)
+ fp->ptr_taken = 1;
}
}
regmask_dep = fp->regmask_dep;
argc_normal = fp->argc_stack;
+ if (fp->ptr_taken && regmask_dep
+ && (regmask_dep & ~(mxCX|mxDX)) == 0)
+ {
+ if ((regmask_dep & mxDX) || fp->argc_stack > 0)
+ regmask_dep |= mxCX | mxDX;
+ }
fprintf(fout, "%-5s",
fp->pp ? fp->pp->ret_type.name :
g_allow_regfunc = 1;
else if (IS(argv[arg], "-uc"))
g_allow_user_icall = 1;
+ else if (IS(argv[arg], "-wu"))
+ g_nowarn_reguse = 1;
else if (IS(argv[arg], "-m"))
multi_seg = 1;
else if (IS(argv[arg], "-hdr"))
}
if (argc < arg + 3) {
- printf("usage:\n%s [-v] [-rf] [-m] <.c> <.asm> <hdr.h> [rlist]*\n"
+ printf("usage:\n%s [options] <.c> <.asm> <hdr.h> [rlist]*\n"
"%s -hdr <out.h> <.asm> <seed.h> [rlist]*\n"
"options:\n"
" -hdr - header generation mode\n"
" -rf - allow unannotated indirect calls\n"
" -uc - allow ind. calls/refs to __usercall\n"
" -m - allow multiple .text sections\n"
+ " -wu - don't warn about bad reg use\n"
"[rlist] is a file with function names to skip,"
" one per line\n",
argv[0], argv[0]);
continue;
goto parse_words; // lame
}
- if (IS_START(p, "; sctproto:")) {
- sctproto = strdup(p + 11);
- }
else if (IS_START(p, "; sctend")) {
end = 1;
if (!pending_endp)
break;
}
+ else if (g_skip_func)
+ /* ignore remaining attrs */;
+ else if (IS_START(p, "; sctproto:")) {
+ sctproto = strdup(p + 11);
+ }
else if (IS_START(p, "; sctskip_start")) {
- if (in_func && !g_skip_func) {
+ if (in_func) {
if (!skip_code) {
ops[pi].op = OPP_ABORT;
ops[pi].asmln = asmln;
notaz.gp2x.de / ia32rtools.git / blobdiff