216 this->architecture = architecture;
218 this->symbolicEngine = symbolicEngine;
219 this->taintEngine = taintEngine;
221 if (architecture ==
nullptr)
224 if (this->symbolicEngine ==
nullptr)
227 if (this->taintEngine ==
nullptr)
241 case ID_INS_B: this->b_s(inst);
break;
378 return this->exception;
386 auto node = this->astCtxt->bv(inst.
getNextAddress(), pc.getBitSize());
409 auto node = this->astCtxt->ite(
410 this->astCtxt->equal(z, this->astCtxt->bvtrue()),
420 auto node = this->astCtxt->ite(
421 this->astCtxt->equal(n, v),
432 auto node = this->astCtxt->ite(
434 this->astCtxt->equal(z, this->astCtxt->bvfalse()),
435 this->astCtxt->equal(n, v)
446 auto node = this->astCtxt->ite(
448 this->astCtxt->equal(c, this->astCtxt->bvtrue()),
449 this->astCtxt->equal(z, this->astCtxt->bvfalse())
459 auto node = this->astCtxt->ite(
460 this->astCtxt->equal(c, this->astCtxt->bvtrue()),
471 auto node = this->astCtxt->ite(
473 this->astCtxt->equal(z, this->astCtxt->bvtrue()),
474 this->astCtxt->lnot(this->astCtxt->equal(n, v))
484 auto node = this->astCtxt->ite(
485 this->astCtxt->equal(c, this->astCtxt->bvfalse()),
495 auto node = this->astCtxt->ite(
497 this->astCtxt->equal(c, this->astCtxt->bvfalse()),
498 this->astCtxt->equal(z, this->astCtxt->bvtrue())
509 auto node = this->astCtxt->ite(
510 this->astCtxt->lnot(this->astCtxt->equal(n, v)),
519 auto node = this->astCtxt->ite(
520 this->astCtxt->equal(n, this->astCtxt->bvtrue()),
529 auto node = this->astCtxt->ite(
530 this->astCtxt->equal(z, this->astCtxt->bvfalse()),
539 auto node = this->astCtxt->ite(
540 this->astCtxt->equal(n, this->astCtxt->bvfalse()),
549 auto node = this->astCtxt->ite(
550 this->astCtxt->equal(v, this->astCtxt->bvfalse()),
559 auto node = this->astCtxt->ite(
560 this->astCtxt->equal(v, this->astCtxt->bvtrue()),
648 auto node = this->astCtxt->bv(0, 1);
660 auto node = this->astCtxt->bv(1, 1);
674 auto nf = this->architecture->
getRegister(ID_REG_AARCH64_N);
681 auto node = this->astCtxt->extract(high, high, this->astCtxt->reference(parent));
687 expr->isTainted = this->taintEngine->
setTaintRegister(nf, parent->isTainted);
696 auto nf = this->architecture->
getRegister(ID_REG_AARCH64_N);
703 auto node1 = this->astCtxt->extract(high, high, this->astCtxt->reference(parent));
704 auto node2 = this->astCtxt->extract(3, 3, nzcv);
705 auto node3 = this->getCodeConditionAst(inst, node1, node2);
711 expr->isTainted = this->taintEngine->
setTaintRegister(nf, parent->isTainted);
719 auto zf = this->architecture->
getRegister(ID_REG_AARCH64_Z);
728 auto node = this->astCtxt->ite(
729 this->astCtxt->equal(
730 this->astCtxt->extract(high, low, this->astCtxt->reference(parent)),
731 this->astCtxt->bv(0, bvSize)
733 this->astCtxt->bv(1, 1),
734 this->astCtxt->bv(0, 1)
741 expr->isTainted = this->taintEngine->
setTaintRegister(zf, parent->isTainted);
750 auto zf = this->architecture->
getRegister(ID_REG_AARCH64_Z);
759 auto node1 = this->astCtxt->ite(
760 this->astCtxt->equal(
761 this->astCtxt->extract(high, low, this->astCtxt->reference(parent)),
762 this->astCtxt->bv(0, bvSize)
764 this->astCtxt->bv(1, 1),
765 this->astCtxt->bv(0, 1)
767 auto node2 = this->astCtxt->extract(2, 2, nzcv);
768 auto node3 = this->getCodeConditionAst(inst, node1, node2);
774 expr->isTainted = this->taintEngine->
setTaintRegister(zf, parent->isTainted);
784 auto cf = this->architecture->
getRegister(ID_REG_AARCH64_C);
793 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
794 this->astCtxt->bvxor(
795 this->astCtxt->bvand(op1, op2),
796 this->astCtxt->bvand(
797 this->astCtxt->bvxor(
798 this->astCtxt->bvxor(op1, op2),
799 this->astCtxt->extract(high, low, this->astCtxt->reference(parent))
801 this->astCtxt->bvxor(op1, op2))
809 expr->isTainted = this->taintEngine->
setTaintRegister(cf, parent->isTainted);
819 auto cf = this->architecture->
getRegister(ID_REG_AARCH64_C);
828 auto node = this->astCtxt->bvxor(
829 this->astCtxt->extract(bvSize-1, bvSize-1,
830 this->astCtxt->bvxor(
831 this->astCtxt->bvxor(op1, this->astCtxt->bvxor(op2, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))),
832 this->astCtxt->bvand(
833 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent))),
834 this->astCtxt->bvxor(op1, op2)
838 this->astCtxt->bvtrue()
845 expr->isTainted = this->taintEngine->
setTaintRegister(cf, parent->isTainted);
856 auto cf = this->architecture->
getRegister(ID_REG_AARCH64_C);
868 auto node1 = this->astCtxt->bvxor(
869 this->astCtxt->extract(bvSize-1, bvSize-1,
870 this->astCtxt->bvxor(
871 this->astCtxt->bvxor(op1, this->astCtxt->bvxor(op2, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))),
872 this->astCtxt->bvand(
873 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent))),
874 this->astCtxt->bvxor(op1, op2)
878 this->astCtxt->bvtrue()
880 auto node2 = this->astCtxt->extract(1, 1, nzcv);
881 auto node3 = this->getCodeConditionAst(inst, node1, node2);
887 expr->isTainted = this->taintEngine->
setTaintRegister(cf, parent->isTainted);
897 auto vf = this->architecture->
getRegister(ID_REG_AARCH64_V);
906 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
907 this->astCtxt->bvand(
908 this->astCtxt->bvxor(op1, this->astCtxt->bvnot(op2)),
909 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
917 expr->isTainted = this->taintEngine->
setTaintRegister(vf, parent->isTainted);
927 auto vf = this->architecture->
getRegister(ID_REG_AARCH64_V);
936 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
937 this->astCtxt->bvand(
938 this->astCtxt->bvxor(op1, op2),
939 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
947 expr->isTainted = this->taintEngine->
setTaintRegister(vf, parent->isTainted);
958 auto vf = this->architecture->
getRegister(ID_REG_AARCH64_V);
970 auto node1 = this->astCtxt->extract(bvSize-1, bvSize-1,
971 this->astCtxt->bvand(
972 this->astCtxt->bvxor(op1, op2),
973 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
976 auto node2 = this->astCtxt->extract(0, 0, nzcv);
977 auto node3 = this->getCodeConditionAst(inst, node1, node2);
983 expr->isTainted = this->taintEngine->
setTaintRegister(vf, parent->isTainted);
999 auto node = this->astCtxt->bvadd(this->astCtxt->bvadd(op1, op2), this->astCtxt->zx(dst.
getBitSize()-1, op3));
1005 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(cf));
1009 this->cfAdd_s(inst, expr, dst, op1, op2);
1010 this->nf_s(inst, expr, dst);
1011 this->vfAdd_s(inst, expr, dst, op1, op2);
1012 this->zf_s(inst, expr, dst);
1016 this->controlFlow_s(inst);
1030 auto node = this->astCtxt->bvadd(op1, op2);
1036 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1040 this->cfAdd_s(inst, expr, dst, op1, op2);
1041 this->nf_s(inst, expr, dst);
1042 this->vfAdd_s(inst, expr, dst, op1, op2);
1043 this->zf_s(inst, expr, dst);
1047 this->controlFlow_s(inst);
1067 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src) | this->taintEngine->isTainted(pc));
1070 this->controlFlow_s(inst);
1090 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src) | this->taintEngine->isTainted(pc));
1093 this->controlFlow_s(inst);
1107 auto node = this->astCtxt->bvand(op1, op2);
1111 node = this->astCtxt->extract(63, 0, node);
1118 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1122 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_C),
"Clears carry flag");
1123 this->nf_s(inst, expr, dst);
1124 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_V),
"Clears overflow flag");
1125 this->zf_s(inst, expr, dst);
1129 this->controlFlow_s(inst);
1137 auto size = src2.getBitSize();
1141 auto op2 = this->astCtxt->bvand(
1143 this->astCtxt->bv(size - 1, size)
1147 auto node = this->astCtxt->bvashr(op1, op2);
1153 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1156 this->controlFlow_s(inst);
1169 auto node = this->getCodeConditionAst(inst, op1, op2);
1175 expr->isTainted = this->taintEngine->
setTaint(dst, this->getCodeConditionTainteSate(inst));
1179 if (!(node->getChildren()[0]->evaluate().is_zero())) {
1194 auto lsb =
static_cast<uint32>(src2.getImmediate().getValue());
1195 auto width =
static_cast<uint32>(src3.getImmediate().getValue());
1202 auto opDst = this->symbolicEngine->
getOperandAst(inst, dst);
1205 std::vector<triton::ast::SharedAbstractNode> chunks;
1209 chunks.push_back(this->astCtxt->extract(dst.
getBitSize() - 1, lsb + width, opDst));
1211 chunks.push_back(this->astCtxt->extract(width - 1, 0, op));
1212 chunks.push_back(this->astCtxt->extract(lsb - 1, 0, opDst));
1214 auto node = this->astCtxt->concat(chunks);
1220 expr->isTainted = this->taintEngine->
taintUnion(dst, src1);
1223 this->controlFlow_s(inst);
1232 auto lsb =
static_cast<uint32>(src2.getImmediate().getValue());
1233 auto width =
static_cast<uint32>(src3.getImmediate().getValue());
1239 auto opSrc = this->symbolicEngine->
getOperandAst(inst, src1);
1240 auto opDst = this->symbolicEngine->
getOperandAst(inst, dst);
1242 auto node = this->astCtxt->concat(
1243 this->astCtxt->extract(dst.
getBitSize() - 1, width, opDst),
1244 this->astCtxt->extract(lsb + width - 1, lsb, opSrc)
1251 expr->isTainted = this->taintEngine->
taintUnion(dst, src1);
1254 this->controlFlow_s(inst);
1268 auto node = this->astCtxt->bvand(op1, this->astCtxt->bvnot(op2));
1274 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1278 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_C),
"Clears carry flag");
1279 this->nf_s(inst, expr, src1);
1280 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_V),
"Clears overflow flag");
1281 this->zf_s(inst, expr, src1);
1285 this->controlFlow_s(inst);
1296 auto node1 = this->astCtxt->bv(inst.
getNextAddress(), dst1.getBitSize());
1297 auto node2 = this->symbolicEngine->
getOperandAst(inst, src);
1321 auto node1 = this->astCtxt->bv(inst.
getNextAddress(), dst1.getBitSize());
1322 auto node2 = this->symbolicEngine->
getOperandAst(inst, src);
1366 this->controlFlow_s(inst);
1376 auto op1 = this->astCtxt->zx(dst.
getBitSize() - src1.getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
1377 auto op2 = this->astCtxt->zx(dst.
getBitSize() - src2.getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
1380 auto node = this->astCtxt->ite(
1381 this->astCtxt->lnot(this->astCtxt->equal(op1, this->astCtxt->bv(0, op1->getBitvectorSize()))),
1390 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1393 if (op1->evaluate() != 0)
1407 auto op1 = this->astCtxt->zx(dst.
getBitSize() - src1.getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
1408 auto op2 = this->astCtxt->zx(dst.
getBitSize() - src2.getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
1411 auto node = this->astCtxt->ite(
1412 this->astCtxt->equal(op1, this->astCtxt->bv(0, op1->getBitvectorSize())),
1421 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1424 if (op1->evaluate() == 0)
1443 auto node = this->astCtxt->bvsub(op1, op2);
1449 expr->isTainted = this->taintEngine->
isTainted(src1) | this->taintEngine->
isTainted(src2);
1452 this->cfCcmp_s(inst, expr, src1, op1, op2, op3);
1453 this->nfCcmp_s(inst, expr, src1, op3);
1454 this->vfCcmp_s(inst, expr, src1, op1, op2, op3);
1455 this->zfCcmp_s(inst, expr, src1, op3);
1458 this->controlFlow_s(inst);
1468 auto op2 = this->astCtxt->bvadd(op1, this->astCtxt->bv(1, src.getBitSize()));
1471 auto node = this->getCodeConditionAst(inst, op2, op1);
1477 expr->isTainted = this->taintEngine->
setTaint(dst, this->getCodeConditionTainteSate(inst));
1480 this->controlFlow_s(inst);
1494 switch (src.getSize()) {
1496 node = this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(31, 31, op), this->astCtxt->bvtrue()), this->astCtxt->bv(0, bvSize),
1497 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(30, 30, op), this->astCtxt->bvtrue()), this->astCtxt->bv(1, bvSize),
1498 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(29, 29, op), this->astCtxt->bvtrue()), this->astCtxt->bv(2, bvSize),
1499 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(28, 28, op), this->astCtxt->bvtrue()), this->astCtxt->bv(3, bvSize),
1500 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(27, 27, op), this->astCtxt->bvtrue()), this->astCtxt->bv(4, bvSize),
1501 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(26, 26, op), this->astCtxt->bvtrue()), this->astCtxt->bv(5, bvSize),
1502 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(25, 25, op), this->astCtxt->bvtrue()), this->astCtxt->bv(6, bvSize),
1503 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(24, 24, op), this->astCtxt->bvtrue()), this->astCtxt->bv(7, bvSize),
1504 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(23, 23, op), this->astCtxt->bvtrue()), this->astCtxt->bv(8, bvSize),
1505 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(22, 22, op), this->astCtxt->bvtrue()), this->astCtxt->bv(9, bvSize),
1506 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(21, 21, op), this->astCtxt->bvtrue()), this->astCtxt->bv(10, bvSize),
1507 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(20, 20, op), this->astCtxt->bvtrue()), this->astCtxt->bv(11, bvSize),
1508 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(19, 19, op), this->astCtxt->bvtrue()), this->astCtxt->bv(12, bvSize),
1509 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(18, 18, op), this->astCtxt->bvtrue()), this->astCtxt->bv(13, bvSize),
1510 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(17, 17, op), this->astCtxt->bvtrue()), this->astCtxt->bv(14, bvSize),
1511 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(16, 16, op), this->astCtxt->bvtrue()), this->astCtxt->bv(15, bvSize),
1512 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(15, 15, op), this->astCtxt->bvtrue()), this->astCtxt->bv(16, bvSize),
1513 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(14, 14, op), this->astCtxt->bvtrue()), this->astCtxt->bv(17, bvSize),
1514 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(13, 13, op), this->astCtxt->bvtrue()), this->astCtxt->bv(18, bvSize),
1515 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(12, 12, op), this->astCtxt->bvtrue()), this->astCtxt->bv(19, bvSize),
1516 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(11, 11, op), this->astCtxt->bvtrue()), this->astCtxt->bv(20, bvSize),
1517 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(10, 10, op), this->astCtxt->bvtrue()), this->astCtxt->bv(21, bvSize),
1518 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(9, 9, op), this->astCtxt->bvtrue()), this->astCtxt->bv(22, bvSize),
1519 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(8, 8, op), this->astCtxt->bvtrue()), this->astCtxt->bv(23, bvSize),
1520 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(7, 7, op), this->astCtxt->bvtrue()), this->astCtxt->bv(24, bvSize),
1521 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(6, 6, op), this->astCtxt->bvtrue()), this->astCtxt->bv(25, bvSize),
1522 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(5, 5, op), this->astCtxt->bvtrue()), this->astCtxt->bv(26, bvSize),
1523 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(4, 4, op), this->astCtxt->bvtrue()), this->astCtxt->bv(27, bvSize),
1524 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(3, 3, op), this->astCtxt->bvtrue()), this->astCtxt->bv(28, bvSize),
1525 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(2, 2, op), this->astCtxt->bvtrue()), this->astCtxt->bv(29, bvSize),
1526 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(1, 1, op), this->astCtxt->bvtrue()), this->astCtxt->bv(30, bvSize),
1527 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(0, 0, op), this->astCtxt->bvtrue()), this->astCtxt->bv(31, bvSize),
1528 this->astCtxt->bv(32, bvSize)
1529 ))))))))))))))))))))))))))))))));
1533 node = this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(63, 63, op), this->astCtxt->bvtrue()), this->astCtxt->bv(0, bvSize),
1534 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(62, 62, op), this->astCtxt->bvtrue()), this->astCtxt->bv(1, bvSize),
1535 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(61, 61, op), this->astCtxt->bvtrue()), this->astCtxt->bv(2, bvSize),
1536 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(60, 60, op), this->astCtxt->bvtrue()), this->astCtxt->bv(3, bvSize),
1537 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(59, 59, op), this->astCtxt->bvtrue()), this->astCtxt->bv(4, bvSize),
1538 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(58, 58, op), this->astCtxt->bvtrue()), this->astCtxt->bv(5, bvSize),
1539 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(57, 57, op), this->astCtxt->bvtrue()), this->astCtxt->bv(6, bvSize),
1540 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(56, 56, op), this->astCtxt->bvtrue()), this->astCtxt->bv(7, bvSize),
1541 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(55, 55, op), this->astCtxt->bvtrue()), this->astCtxt->bv(8, bvSize),
1542 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(54, 54, op), this->astCtxt->bvtrue()), this->astCtxt->bv(9, bvSize),
1543 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(53, 53, op), this->astCtxt->bvtrue()), this->astCtxt->bv(10, bvSize),
1544 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(52, 52, op), this->astCtxt->bvtrue()), this->astCtxt->bv(11, bvSize),
1545 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(51, 51, op), this->astCtxt->bvtrue()), this->astCtxt->bv(12, bvSize),
1546 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(50, 50, op), this->astCtxt->bvtrue()), this->astCtxt->bv(13, bvSize),
1547 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(49, 49, op), this->astCtxt->bvtrue()), this->astCtxt->bv(14, bvSize),
1548 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(48, 48, op), this->astCtxt->bvtrue()), this->astCtxt->bv(15, bvSize),
1549 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(47, 47, op), this->astCtxt->bvtrue()), this->astCtxt->bv(16, bvSize),
1550 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(46, 46, op), this->astCtxt->bvtrue()), this->astCtxt->bv(17, bvSize),
1551 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(45, 45, op), this->astCtxt->bvtrue()), this->astCtxt->bv(18, bvSize),
1552 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(44, 44, op), this->astCtxt->bvtrue()), this->astCtxt->bv(19, bvSize),
1553 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(43, 43, op), this->astCtxt->bvtrue()), this->astCtxt->bv(20, bvSize),
1554 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(42, 42, op), this->astCtxt->bvtrue()), this->astCtxt->bv(21, bvSize),
1555 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(41, 41, op), this->astCtxt->bvtrue()), this->astCtxt->bv(22, bvSize),
1556 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(40, 40, op), this->astCtxt->bvtrue()), this->astCtxt->bv(23, bvSize),
1557 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(39, 39, op), this->astCtxt->bvtrue()), this->astCtxt->bv(24, bvSize),
1558 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(38, 38, op), this->astCtxt->bvtrue()), this->astCtxt->bv(25, bvSize),
1559 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(37, 37, op), this->astCtxt->bvtrue()), this->astCtxt->bv(26, bvSize),
1560 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(36, 36, op), this->astCtxt->bvtrue()), this->astCtxt->bv(27, bvSize),
1561 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(35, 35, op), this->astCtxt->bvtrue()), this->astCtxt->bv(28, bvSize),
1562 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(34, 34, op), this->astCtxt->bvtrue()), this->astCtxt->bv(29, bvSize),
1563 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(33, 33, op), this->astCtxt->bvtrue()), this->astCtxt->bv(30, bvSize),
1564 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(32, 32, op), this->astCtxt->bvtrue()), this->astCtxt->bv(31, bvSize),
1565 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(31, 31, op), this->astCtxt->bvtrue()), this->astCtxt->bv(32, bvSize),
1566 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(30, 30, op), this->astCtxt->bvtrue()), this->astCtxt->bv(33, bvSize),
1567 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(29, 29, op), this->astCtxt->bvtrue()), this->astCtxt->bv(34, bvSize),
1568 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(28, 28, op), this->astCtxt->bvtrue()), this->astCtxt->bv(35, bvSize),
1569 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(27, 27, op), this->astCtxt->bvtrue()), this->astCtxt->bv(36, bvSize),
1570 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(26, 26, op), this->astCtxt->bvtrue()), this->astCtxt->bv(37, bvSize),
1571 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(25, 25, op), this->astCtxt->bvtrue()), this->astCtxt->bv(38, bvSize),
1572 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(24, 24, op), this->astCtxt->bvtrue()), this->astCtxt->bv(39, bvSize),
1573 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(23, 23, op), this->astCtxt->bvtrue()), this->astCtxt->bv(40, bvSize),
1574 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(22, 22, op), this->astCtxt->bvtrue()), this->astCtxt->bv(41, bvSize),
1575 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(21, 21, op), this->astCtxt->bvtrue()), this->astCtxt->bv(42, bvSize),
1576 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(20, 20, op), this->astCtxt->bvtrue()), this->astCtxt->bv(43, bvSize),
1577 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(19, 19, op), this->astCtxt->bvtrue()), this->astCtxt->bv(44, bvSize),
1578 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(18, 18, op), this->astCtxt->bvtrue()), this->astCtxt->bv(45, bvSize),
1579 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(17, 17, op), this->astCtxt->bvtrue()), this->astCtxt->bv(46, bvSize),
1580 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(16, 16, op), this->astCtxt->bvtrue()), this->astCtxt->bv(47, bvSize),
1581 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(15, 15, op), this->astCtxt->bvtrue()), this->astCtxt->bv(48, bvSize),
1582 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(14, 14, op), this->astCtxt->bvtrue()), this->astCtxt->bv(49, bvSize),
1583 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(13, 13, op), this->astCtxt->bvtrue()), this->astCtxt->bv(50, bvSize),
1584 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(12, 12, op), this->astCtxt->bvtrue()), this->astCtxt->bv(51, bvSize),
1585 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(11, 11, op), this->astCtxt->bvtrue()), this->astCtxt->bv(52, bvSize),
1586 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(10, 10, op), this->astCtxt->bvtrue()), this->astCtxt->bv(53, bvSize),
1587 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(9, 9, op), this->astCtxt->bvtrue()), this->astCtxt->bv(54, bvSize),
1588 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(8, 8, op), this->astCtxt->bvtrue()), this->astCtxt->bv(55, bvSize),
1589 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(7, 7, op), this->astCtxt->bvtrue()), this->astCtxt->bv(56, bvSize),
1590 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(6, 6, op), this->astCtxt->bvtrue()), this->astCtxt->bv(57, bvSize),
1591 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(5, 5, op), this->astCtxt->bvtrue()), this->astCtxt->bv(58, bvSize),
1592 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(4, 4, op), this->astCtxt->bvtrue()), this->astCtxt->bv(59, bvSize),
1593 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(3, 3, op), this->astCtxt->bvtrue()), this->astCtxt->bv(60, bvSize),
1594 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(2, 2, op), this->astCtxt->bvtrue()), this->astCtxt->bv(61, bvSize),
1595 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(1, 1, op), this->astCtxt->bvtrue()), this->astCtxt->bv(62, bvSize),
1596 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(0, 0, op), this->astCtxt->bvtrue()), this->astCtxt->bv(63, bvSize),
1597 this->astCtxt->bv(64, bvSize)
1598 ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))));
1612 this->controlFlow_s(inst);
1625 auto node = this->astCtxt->bvadd(op1, op2);
1631 expr->isTainted = this->taintEngine->
isTainted(src1) | this->taintEngine->
isTainted(src2);
1634 this->cfAdd_s(inst, expr, src1, op1, op2);
1635 this->nf_s(inst, expr, src1);
1636 this->vfAdd_s(inst, expr, src1, op1, op2);
1637 this->zf_s(inst, expr, src1);
1640 this->controlFlow_s(inst);
1653 auto node = this->astCtxt->bvsub(op1, op2);
1659 expr->isTainted = this->taintEngine->
isTainted(src1) | this->taintEngine->
isTainted(src2);
1662 this->cfSub_s(inst, expr, src1, op1, op2);
1663 this->nf_s(inst, expr, src1);
1664 this->vfSub_s(inst, expr, src1, op1, op2);
1665 this->zf_s(inst, expr, src1);
1668 this->controlFlow_s(inst);
1677 auto op1 = this->astCtxt->bvneg(this->symbolicEngine->
getOperandAst(inst, src));
1681 auto node = this->getCodeConditionAst(inst, op1, op2);
1687 expr->isTainted = this->taintEngine->
taintUnion(dst, src);
1690 this->controlFlow_s(inst);
1704 auto node = this->getCodeConditionAst(inst, op1, op2);
1710 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1713 this->controlFlow_s(inst);
1721 auto op1 = this->astCtxt->bv(1, dst.
getBitSize());
1722 auto op2 = this->astCtxt->bv(0, dst.
getBitSize());
1725 auto node = this->getCodeConditionAst(inst, op1, op2);
1731 expr->isTainted = this->taintEngine->
setTaint(dst, this->getCodeConditionTainteSate(inst));
1734 this->controlFlow_s(inst);
1744 auto op2 = this->astCtxt->bv(0, dst.
getBitSize());
1747 auto node = this->getCodeConditionAst(inst, op1, op2);
1753 expr->isTainted = this->taintEngine->
setTaint(dst, this->getCodeConditionTainteSate(inst));
1756 this->controlFlow_s(inst);
1767 auto op2 = this->astCtxt->bvadd(
1769 this->astCtxt->bv(1, src2.getBitSize())
1773 auto node = this->getCodeConditionAst(inst, op1, op2);
1779 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1782 this->controlFlow_s(inst);
1793 auto op2 = this->astCtxt->bvneg(this->symbolicEngine->
getOperandAst(inst, src2));
1796 auto node = this->getCodeConditionAst(inst, op1, op2);
1802 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1805 this->controlFlow_s(inst);
1815 auto op2 = this->astCtxt->bvnot(this->symbolicEngine->
getOperandAst(inst, src2));
1818 auto node = this->getCodeConditionAst(inst, op1, op2);
1824 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1827 this->controlFlow_s(inst);
1842 auto node = this->astCtxt->bvxnor(op1, op2);
1848 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1851 this->controlFlow_s(inst);
1865 auto node = this->astCtxt->bvxor(op1, op2);
1869 node = this->astCtxt->extract(63, 0, node);
1876 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
1879 this->controlFlow_s(inst);
1888 auto lsb =
static_cast<uint32>(src3.getImmediate().getValue());
1895 auto node = this->astCtxt->extract(lsb + dst.
getBitSize() - 1, lsb, this->astCtxt->concat(op1, op2));
1904 this->controlFlow_s(inst);
1921 this->controlFlow_s(inst);
1925 std::list<triton::ast::SharedAbstractNode> vec0;
1926 std::list<triton::ast::SharedAbstractNode> vec1;
1927 std::list<triton::ast::SharedAbstractNode> vec2;
1956 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
1957 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
1958 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
1975 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
1976 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
1977 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
1994 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
1995 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
1996 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2013 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2014 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2015 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2032 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2033 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2034 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2051 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2052 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2053 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2070 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2071 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2072 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2087 auto node0 = this->astCtxt->concat(vec0);
2088 auto node1 = this->astCtxt->concat(vec1);
2089 auto node2 = this->astCtxt->concat(vec2);
2097 expr0->isTainted = vt0_t;
2098 expr1->isTainted = vt1_t;
2099 expr2->isTainted = vt2_t;
2106 auto base = mem.getBaseRegister();
2107 auto offset = inst.
operands[4].getRegister();
2110 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2111 auto offsetNode = this->symbolicEngine->
getOperandAst(inst, offset);
2114 auto node3 = this->astCtxt->bvadd(baseNode, offsetNode);
2120 expr3->isTainted = this->taintEngine->
isTainted(base) | this->taintEngine->
isTainted(offset);
2129 auto base = mem.getBaseRegister();
2130 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2133 auto node3 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2139 expr3->isTainted = this->taintEngine->
isTainted(base);
2143 this->controlFlow_s(inst);
2148 std::list<triton::ast::SharedAbstractNode> vec0;
2149 std::list<triton::ast::SharedAbstractNode> vec1;
2150 std::list<triton::ast::SharedAbstractNode> vec2;
2180 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2181 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2182 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2199 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2200 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2201 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2218 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2219 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2220 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2237 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2238 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2239 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2256 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2257 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2258 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2275 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2276 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2277 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2294 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2295 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2296 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2313 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2314 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2315 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2331 auto node0 = this->astCtxt->concat(vec0);
2332 auto node1 = this->astCtxt->concat(vec1);
2333 auto node2 = this->astCtxt->concat(vec2);
2341 expr0->isTainted = vt0_t;
2342 expr1->isTainted = vt1_t;
2343 expr2->isTainted = vt2_t;
2350 auto base = mem.getBaseRegister();
2351 auto offset = inst.
operands[4].getRegister();
2354 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2355 auto offsetNode = this->symbolicEngine->
getOperandAst(inst, offset);
2358 auto node3 = this->astCtxt->bvadd(baseNode, offsetNode);
2364 expr3->isTainted = this->taintEngine->
isTainted(base) | this->taintEngine->
isTainted(offset);
2373 auto base = mem.getBaseRegister();
2374 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2377 auto node3 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2383 expr3->isTainted = this->taintEngine->
isTainted(base);
2387 this->controlFlow_s(inst);
2392 std::list<triton::ast::SharedAbstractNode> vec0;
2393 std::list<triton::ast::SharedAbstractNode> vec1;
2394 std::list<triton::ast::SharedAbstractNode> vec2;
2395 std::list<triton::ast::SharedAbstractNode> vec3;
2427 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2428 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2429 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2430 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2449 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2450 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2451 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2452 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2471 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2472 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2473 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2474 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2493 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2494 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2495 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2496 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2515 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2516 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2517 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2518 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2537 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2538 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2539 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2540 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2559 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2560 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2561 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2562 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2578 auto node0 = this->astCtxt->concat(vec0);
2579 auto node1 = this->astCtxt->concat(vec1);
2580 auto node2 = this->astCtxt->concat(vec2);
2581 auto node3 = this->astCtxt->concat(vec3);
2590 expr0->isTainted = vt0_t;
2591 expr1->isTainted = vt1_t;
2592 expr2->isTainted = vt2_t;
2593 expr3->isTainted = vt3_t;
2600 auto base = mem.getBaseRegister();
2601 auto offset = inst.
operands[5].getRegister();
2604 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2605 auto offsetNode = this->symbolicEngine->
getOperandAst(inst, offset);
2608 auto node4 = this->astCtxt->bvadd(baseNode, offsetNode);
2614 expr4->isTainted = this->taintEngine->
isTainted(base) | this->taintEngine->
isTainted(offset);
2623 auto base = mem.getBaseRegister();
2624 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2627 auto node4 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2633 expr4->isTainted = this->taintEngine->
isTainted(base);
2637 this->controlFlow_s(inst);
2642 std::list<triton::ast::SharedAbstractNode> vec0;
2643 std::list<triton::ast::SharedAbstractNode> vec1;
2644 std::list<triton::ast::SharedAbstractNode> vec2;
2645 std::list<triton::ast::SharedAbstractNode> vec3;
2678 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2679 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2680 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2681 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2700 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2701 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2702 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2703 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2722 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2723 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2724 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2725 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2744 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2745 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2746 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2747 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2766 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2767 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2768 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2769 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2788 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2789 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2790 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2791 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2810 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2811 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2812 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2813 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2832 vec0.push_front(this->symbolicEngine->
getMemoryAst(inst, vt0_m));
2833 vec1.push_front(this->symbolicEngine->
getMemoryAst(inst, vt1_m));
2834 vec2.push_front(this->symbolicEngine->
getMemoryAst(inst, vt2_m));
2835 vec3.push_front(this->symbolicEngine->
getMemoryAst(inst, vt3_m));
2852 auto node0 = this->astCtxt->concat(vec0);
2853 auto node1 = this->astCtxt->concat(vec1);
2854 auto node2 = this->astCtxt->concat(vec2);
2855 auto node3 = this->astCtxt->concat(vec3);
2864 expr0->isTainted = vt0_t;
2865 expr1->isTainted = vt1_t;
2866 expr2->isTainted = vt2_t;
2867 expr3->isTainted = vt3_t;
2874 auto base = mem.getBaseRegister();
2875 auto offset = inst.
operands[5].getRegister();
2878 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2879 auto offsetNode = this->symbolicEngine->
getOperandAst(inst, offset);
2882 auto node4 = this->astCtxt->bvadd(baseNode, offsetNode);
2888 expr4->isTainted = this->taintEngine->
isTainted(base) | this->taintEngine->
isTainted(offset);
2897 auto base = mem.getBaseRegister();
2898 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
2901 auto node4 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2907 expr4->isTainted = this->taintEngine->
isTainted(base);
2911 this->controlFlow_s(inst);
2929 this->controlFlow_s(inst);
2947 this->controlFlow_s(inst);
2965 this->controlFlow_s(inst);
2986 this->controlFlow_s(inst);
3007 this->controlFlow_s(inst);
3028 this->controlFlow_s(inst);
3044 auto node1 = this->astCtxt->extract((dst1.
getBitSize() - 1), 0, op);
3056 this->controlFlow_s(inst);
3072 auto node1 = this->astCtxt->extract((dst1.
getBitSize() - 1), 0, op);
3090 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3091 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3094 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3097 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDP operation - Base register computation");
3100 expr2->isTainted = this->taintEngine->
isTainted(base);
3111 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDP operation - Base register computation");
3114 expr3->isTainted = this->taintEngine->
isTainted(base);
3118 this->controlFlow_s(inst);
3131 auto node1 = this->astCtxt->sx(32, this->astCtxt->extract(31, 0, op));
3132 auto node2 = this->astCtxt->sx(32, this->astCtxt->extract(63, 32, op));
3149 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3150 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3153 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3156 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDPSW operation - Base register computation");
3159 expr2->isTainted = this->taintEngine->
isTainted(base);
3170 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDPSW operation - Base register computation");
3173 expr3->isTainted = this->taintEngine->
isTainted(base);
3177 this->controlFlow_s(inst);
3191 auto node1 = this->symbolicEngine->
getOperandAst(inst, src);
3206 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3207 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3210 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3213 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDR operation - Base register computation");
3216 expr2->isTainted = this->taintEngine->
isTainted(base);
3226 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDR operation - Base register computation");
3229 expr3->isTainted = this->taintEngine->
isTainted(base);
3233 this->controlFlow_s(inst);
3242 auto node1 = this->symbolicEngine->
getOperandAst(inst, src);
3257 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3258 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3261 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3264 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDRB operation - Base register computation");
3267 expr2->isTainted = this->taintEngine->
isTainted(base);
3278 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDRB operation - Base register computation");
3281 expr3->isTainted = this->taintEngine->
isTainted(base);
3285 this->controlFlow_s(inst);
3294 auto node1 = this->symbolicEngine->
getOperandAst(inst, src);
3309 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3310 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3313 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3316 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDRH operation - Base register computation");
3319 expr2->isTainted = this->taintEngine->
isTainted(base);
3330 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDRH operation - Base register computation");
3333 expr3->isTainted = this->taintEngine->
isTainted(base);
3337 this->controlFlow_s(inst);
3349 auto node1 = this->astCtxt->sx(dst.
getBitSize() - 8, this->astCtxt->extract(7, 0, op));
3364 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3365 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3368 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3371 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDRSB operation - Base register computation");
3374 expr2->isTainted = this->taintEngine->
isTainted(base);
3385 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDRSB operation - Base register computation");
3388 expr3->isTainted = this->taintEngine->
isTainted(base);
3392 this->controlFlow_s(inst);
3404 auto node1 = this->astCtxt->sx(dst.
getBitSize() - 16, this->astCtxt->extract(15, 0, op));
3419 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3420 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3423 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3426 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDRSH operation - Base register computation");
3429 expr2->isTainted = this->taintEngine->
isTainted(base);
3440 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDRSH operation - Base register computation");
3443 expr3->isTainted = this->taintEngine->
isTainted(base);
3447 this->controlFlow_s(inst);
3464 auto node1 = this->astCtxt->sx(dst.
getBitSize() - 32, this->astCtxt->extract(31, 0, op));
3479 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
3480 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
3483 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
3486 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"LDRSW operation - Base register computation");
3489 expr2->isTainted = this->taintEngine->
isTainted(base);
3500 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"LDRSW operation - Base register computation");
3503 expr3->isTainted = this->taintEngine->
isTainted(base);
3507 this->controlFlow_s(inst);
3525 this->controlFlow_s(inst);
3537 auto node = this->astCtxt->zx(dst.
getBitSize() - 8, op);
3546 this->controlFlow_s(inst);
3558 auto node = this->astCtxt->zx(dst.
getBitSize() - 16, op);
3567 this->controlFlow_s(inst);
3579 auto node = this->astCtxt->sx(dst.
getBitSize() - 8, op);
3588 this->controlFlow_s(inst);
3600 auto node = this->astCtxt->sx(dst.
getBitSize() - 16, op);
3609 this->controlFlow_s(inst);
3621 auto node = this->astCtxt->sx(dst.
getBitSize() - 32, op);
3630 this->controlFlow_s(inst);
3648 this->controlFlow_s(inst);
3660 auto node = this->astCtxt->zx(dst.
getBitSize() - 8, op);
3669 this->controlFlow_s(inst);
3681 auto node = this->astCtxt->zx(dst.
getBitSize() - 16, op);
3690 this->controlFlow_s(inst);
3702 auto node = this->astCtxt->sx(dst.
getBitSize() - 8, op);
3711 this->controlFlow_s(inst);
3723 auto node = this->astCtxt->sx(dst.
getBitSize() - 16, op);
3732 this->controlFlow_s(inst);
3744 auto node = this->astCtxt->sx(dst.
getBitSize() - 32, op);
3753 this->controlFlow_s(inst);
3769 auto node1 = this->astCtxt->extract((dst1.
getBitSize() - 1), 0, op);
3784 this->controlFlow_s(inst);
3805 this->controlFlow_s(inst);
3817 auto node = this->astCtxt->zx(dst.
getBitSize() - 8, op);
3829 this->controlFlow_s(inst);
3841 auto node = this->astCtxt->zx(dst.
getBitSize() - 16, op);
3853 this->controlFlow_s(inst);
3861 auto size = src2.getBitSize();
3865 auto op2 = this->astCtxt->bvand(
3867 this->astCtxt->bv(size - 1, size)
3871 auto node = this->astCtxt->bvshl(op1, op2);
3877 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
3880 this->controlFlow_s(inst);
3888 auto size = src2.getBitSize();
3892 auto op2 = this->astCtxt->bvand(
3894 this->astCtxt->bv(size - 1, size)
3898 auto node = this->astCtxt->bvlshr(op1, op2);
3904 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
3907 this->controlFlow_s(inst);
3923 auto node = this->astCtxt->bvadd(op3, this->astCtxt->bvmul(op1, op2));
3929 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
3932 this->controlFlow_s(inst);
3946 auto node = this->astCtxt->bvneg(this->astCtxt->bvmul(op1, op2));
3952 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
3955 this->controlFlow_s(inst);
3973 this->controlFlow_s(inst);
3978 std::list<triton::ast::SharedAbstractNode> vec;
3990 vec.push_front(this->astCtxt->extract(7, 0, imm));
3997 vec.push_front(this->astCtxt->extract(7, 0, imm));
4004 vec.push_front(this->astCtxt->extract(15, 0, imm));
4011 vec.push_front(this->astCtxt->extract(15, 0, imm));
4018 vec.push_front(this->astCtxt->extract(31, 0, imm));
4025 vec.push_front(this->astCtxt->extract(31, 0, imm));
4032 vec.push_front(this->astCtxt->extract(63, 0, imm));
4039 vec.push_front(this->astCtxt->extract(63, 0, imm));
4049 auto node = this->astCtxt->concat(vec);
4058 this->controlFlow_s(inst);
4072 std::vector<triton::ast::SharedAbstractNode> bits;
4078 bits.push_back(this->astCtxt->extract(dst.
getHigh(), 16, op1));
4079 bits.push_back(this->astCtxt->extract(15, 0, op2));
4090 bits.push_back(this->astCtxt->extract(dst.
getHigh(), 32, op1));
4092 bits.push_back(this->astCtxt->extract(31, 16, op2));
4093 bits.push_back(this->astCtxt->extract(15, 0, op1));
4098 bits.push_back(this->astCtxt->extract(dst.
getHigh(), 48, op1));
4099 bits.push_back(this->astCtxt->extract(47, 32, op2));
4100 bits.push_back(this->astCtxt->extract(31, 0, op1));
4105 bits.push_back(this->astCtxt->extract(63, 48, op2));
4106 bits.push_back(this->astCtxt->extract(47, 0, op1));
4113 auto node = this->astCtxt->concat(bits);
4119 expr->isTainted = this->taintEngine->
taintUnion(dst, src);
4122 this->controlFlow_s(inst);
4134 auto node = this->astCtxt->bvnot(op);
4143 this->controlFlow_s(inst);
4161 this->controlFlow_s(inst);
4179 this->controlFlow_s(inst);
4197 this->controlFlow_s(inst);
4213 auto node = this->astCtxt->bvsub(op3, this->astCtxt->bvmul(op1, op2));
4219 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4222 this->controlFlow_s(inst);
4236 auto node = this->astCtxt->bvmul(op1, op2);
4242 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4245 this->controlFlow_s(inst);
4257 auto node = this->astCtxt->bvnot(op);
4266 this->controlFlow_s(inst);
4278 auto node = this->astCtxt->bvneg(op);
4287 this->controlFlow_s(inst);
4293 this->controlFlow_s(inst);
4307 auto node = this->astCtxt->bvor(op1, this->astCtxt->bvnot(op2));
4313 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4316 this->controlFlow_s(inst);
4330 auto node = this->astCtxt->bvor(op1, op2);
4334 node = this->astCtxt->extract(63, 0, node);
4341 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4344 this->controlFlow_s(inst);
4356 std::vector<triton::ast::SharedAbstractNode> bits;
4360 bits.push_back(this->astCtxt->extract(index, index, op));
4363 auto node = this->astCtxt->concat(bits);
4372 this->controlFlow_s(inst);
4378 auto src = ((inst.
operands.size() == 1) ? inst.
operands[0] :
triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_X30)));
4399 std::list<triton::ast::SharedAbstractNode> bits;
4403 bits.push_front(this->astCtxt->extract(63, 56, op));
4404 bits.push_front(this->astCtxt->extract(55, 48, op));
4405 bits.push_front(this->astCtxt->extract(47, 40, op));
4406 bits.push_front(this->astCtxt->extract(39, 32, op));
4408 bits.push_front(this->astCtxt->extract(31, 24, op));
4409 bits.push_front(this->astCtxt->extract(23, 16, op));
4410 bits.push_front(this->astCtxt->extract(15, 8, op));
4411 bits.push_front(this->astCtxt->extract(7, 0, op));
4418 auto node = this->astCtxt->concat(bits);
4427 this->controlFlow_s(inst);
4439 std::vector<triton::ast::SharedAbstractNode> bits;
4444 bits.push_back(this->astCtxt->extract(55, 48, op));
4445 bits.push_back(this->astCtxt->extract(63, 56, op));
4446 bits.push_back(this->astCtxt->extract(39, 32, op));
4447 bits.push_back(this->astCtxt->extract(47, 40, op));
4449 bits.push_back(this->astCtxt->extract(23, 16, op));
4450 bits.push_back(this->astCtxt->extract(31, 24, op));
4451 bits.push_back(this->astCtxt->extract(7, 0, op));
4452 bits.push_back(this->astCtxt->extract(15, 8, op));
4459 auto node = this->astCtxt->concat(bits);
4468 this->controlFlow_s(inst);
4480 std::vector<triton::ast::SharedAbstractNode> bits;
4483 bits.push_back(this->astCtxt->extract(39, 32, op));
4484 bits.push_back(this->astCtxt->extract(47, 40, op));
4485 bits.push_back(this->astCtxt->extract(55, 48, op));
4486 bits.push_back(this->astCtxt->extract(63, 56, op));
4487 bits.push_back(this->astCtxt->extract(7, 0, op));
4488 bits.push_back(this->astCtxt->extract(15, 8, op));
4489 bits.push_back(this->astCtxt->extract(23, 16, op));
4490 bits.push_back(this->astCtxt->extract(31, 24, op));
4492 auto node = this->astCtxt->concat(bits);
4501 this->controlFlow_s(inst);
4515 auto node = this->astCtxt->bvror(op1, op2);
4521 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4524 this->controlFlow_s(inst);
4540 auto node = this->astCtxt->bvadd(this->astCtxt->bvadd(op1, this->astCtxt->bvnot(op2)), this->astCtxt->zx(dst.
getBitSize()-1, op3));
4546 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(cf));
4550 this->cfSub_s(inst, expr, src1, op1, op2);
4551 this->nf_s(inst, expr, src1);
4552 this->vfSub_s(inst, expr, src1, op1, op2);
4553 this->zf_s(inst, expr, src1);
4557 this->controlFlow_s(inst);
4566 auto lsb =
static_cast<uint32>(src2.getImmediate().getValue());
4567 auto width =
static_cast<uint32>(src3.getImmediate().getValue());
4576 auto node = this->astCtxt->sx(dst.
getBitSize() - width, this->astCtxt->extract(lsb+width-1, lsb, op));
4585 this->controlFlow_s(inst);
4599 auto node = this->astCtxt->ite(
4600 this->astCtxt->equal(op2, this->astCtxt->bv(0, op2->getBitvectorSize())),
4602 this->astCtxt->bvsdiv(op1, op2)
4609 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4612 this->controlFlow_s(inst);
4628 auto node = this->astCtxt->bvadd(
4630 this->astCtxt->bvmul(
4640 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4643 this->controlFlow_s(inst);
4659 auto node = this->astCtxt->bvsub(
4661 this->astCtxt->bvmul(
4671 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4674 this->controlFlow_s(inst);
4688 auto node = this->astCtxt->extract(
4691 this->astCtxt->bvmul(
4701 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4704 this->controlFlow_s(inst);
4718 auto node = this->astCtxt->bvmul(
4727 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4730 this->controlFlow_s(inst);
4748 this->controlFlow_s(inst);
4760 auto node = this->astCtxt->extract(7, 0, op);
4769 this->controlFlow_s(inst);
4781 auto node = this->astCtxt->extract(15, 0, op);
4790 this->controlFlow_s(inst);
4803 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4804 auto node2 = this->symbolicEngine->
getOperandAst(inst, src);
4810 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
4822 this->controlFlow_s(inst);
4838 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4839 auto node2 = this->astCtxt->extract(7, 0, op);
4845 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
4857 this->controlFlow_s(inst);
4873 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4874 auto node2 = this->astCtxt->extract(15, 0, op);
4880 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
4892 this->controlFlow_s(inst);
4906 auto node = this->astCtxt->concat(op2, op1);
4915 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4918 this->controlFlow_s(inst);
4932 auto node = this->astCtxt->concat(op2, op1);
4941 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
4950 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
4951 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
4954 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
4957 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"STP operation - Base register computation");
4960 expr2->isTainted = this->taintEngine->
isTainted(base);
4971 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"STP operation - Base register computation");
4974 expr3->isTainted = this->taintEngine->
isTainted(base);
4978 this->controlFlow_s(inst);
4987 auto node1 = this->symbolicEngine->
getOperandAst(inst, src);
5002 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
5003 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
5006 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
5009 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"STR operation - Base register computation");
5012 expr2->isTainted = this->taintEngine->
isTainted(base);
5023 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"STR operation - Base register computation");
5026 expr3->isTainted = this->taintEngine->
isTainted(base);
5030 this->controlFlow_s(inst);
5042 auto node1 = this->astCtxt->extract(7, 0, op);
5057 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
5058 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
5061 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
5064 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"STRB operation - Base register computation");
5067 expr2->isTainted = this->taintEngine->
isTainted(base);
5078 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"STRB operation - Base register computation");
5081 expr3->isTainted = this->taintEngine->
isTainted(base);
5085 this->controlFlow_s(inst);
5097 auto node1 = this->astCtxt->extract(15, 0, op);
5112 auto baseNode = this->symbolicEngine->
getOperandAst(inst, base);
5113 auto immNode = this->symbolicEngine->
getOperandAst(inst, imm);
5116 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.
getBitSize() - imm.
getBitSize(), immNode));
5119 auto expr2 = this->symbolicEngine->
createSymbolicExpression(inst, node2, base,
"STRH operation - Base register computation");
5122 expr2->isTainted = this->taintEngine->
isTainted(base);
5133 auto expr3 = this->symbolicEngine->
createSymbolicExpression(inst, node3, base,
"STRH operation - Base register computation");
5136 expr3->isTainted = this->taintEngine->
isTainted(base);
5140 this->controlFlow_s(inst);
5158 this->controlFlow_s(inst);
5170 auto node = this->astCtxt->extract(7, 0, op);
5179 this->controlFlow_s(inst);
5191 auto node = this->astCtxt->extract(15, 0, op);
5200 this->controlFlow_s(inst);
5218 this->controlFlow_s(inst);
5230 auto node = this->astCtxt->extract(7, 0, op);
5239 this->controlFlow_s(inst);
5251 auto node = this->astCtxt->extract(15, 0, op);
5260 this->controlFlow_s(inst);
5281 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5282 auto node2 = this->astCtxt->concat(op2, op1);
5288 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
5293 expr2->isTainted = this->taintEngine->
setTaint(dst2, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5300 this->controlFlow_s(inst);
5313 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5314 auto node2 = this->symbolicEngine->
getOperandAst(inst, src);
5320 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
5332 this->controlFlow_s(inst);
5348 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5349 auto node2 = this->astCtxt->extract(7, 0, op);
5355 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
5367 this->controlFlow_s(inst);
5383 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5384 auto node2 = this->astCtxt->extract(15, 0, op);
5390 expr1->isTainted = this->taintEngine->
setTaint(dst1,
false);
5402 this->controlFlow_s(inst);
5416 auto node = this->astCtxt->bvsub(op1, op2);
5422 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5426 this->cfSub_s(inst, expr, dst, op1, op2);
5427 this->nf_s(inst, expr, dst);
5428 this->vfSub_s(inst, expr, dst, op1, op2);
5429 this->zf_s(inst, expr, dst);
5433 this->controlFlow_s(inst);
5444 this->controlFlow_s(inst);
5456 auto node = this->astCtxt->sx(dst.
getBitSize() - 8, this->astCtxt->extract(7, 0, op));
5465 this->controlFlow_s(inst);
5477 auto node = this->astCtxt->sx(dst.
getBitSize() - 16, this->astCtxt->extract(15, 0, op));
5486 this->controlFlow_s(inst);
5498 auto node = this->astCtxt->sx(dst.
getBitSize() - 32, this->astCtxt->extract(31, 0, op));
5507 this->controlFlow_s(inst);
5523 auto node = this->astCtxt->ite(
5524 this->astCtxt->equal(
5525 this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2)),
5526 this->astCtxt->bvtrue()
5528 this->astCtxt->zx(dst.
getBitSize() - op3->getBitvectorSize(), op3),
5536 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5539 if (this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2))->evaluate() != 0)
5554 auto op1 = this->astCtxt->zx(dst.
getBitSize() - src1.
getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
5555 auto op2 = this->astCtxt->zx(dst.
getBitSize() - src2.
getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
5556 auto op3 = this->astCtxt->zx(dst.
getBitSize() - src3.getBitSize(), this->symbolicEngine->getOperandAst(inst, src3));
5559 auto node = this->astCtxt->ite(
5560 this->astCtxt->equal(
5561 this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2)),
5562 this->astCtxt->bvfalse()
5564 this->astCtxt->zx(dst.
getBitSize() - op3->getBitvectorSize(), op3),
5572 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5575 if (this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2))->evaluate() == 0)
5592 auto node = this->astCtxt->bvand(op1, op2);
5598 expr->isTainted = this->taintEngine->
isTainted(src1) | this->taintEngine->
isTainted(src2);
5602 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_C),
"Clears carry flag");
5603 this->nf_s(inst, expr, src1);
5604 this->clearFlag_s(inst, this->architecture->
getRegister(ID_REG_AARCH64_V),
"Clears overflow flag");
5605 this->zf_s(inst, expr, src1);
5609 this->controlFlow_s(inst);
5619 auto width =
static_cast<uint32>(src3.getImmediate().getValue());
5628 std::vector<triton::ast::SharedAbstractNode> bits;
5632 bits.push_back(this->astCtxt->bv(0, dst.
getBitSize() - (lsb + width)));
5635 bits.push_back(this->astCtxt->extract(width - 1, 0, op));
5638 bits.push_back(this->astCtxt->bv(0, lsb));
5641 auto node = this->astCtxt->concat(bits);
5650 this->controlFlow_s(inst);
5660 auto width =
static_cast<uint32>(src3.getImmediate().getValue());
5669 auto node = this->astCtxt->zx(dst.
getBitSize() - width, this->astCtxt->extract(lsb+width-1, lsb, op));
5678 this->controlFlow_s(inst);
5692 auto node = this->astCtxt->ite(
5693 this->astCtxt->equal(op2, this->astCtxt->bv(0, op2->getBitvectorSize())),
5695 this->astCtxt->bvudiv(op1, op2)
5702 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5705 this->controlFlow_s(inst);
5721 auto node = this->astCtxt->bvadd(
5723 this->astCtxt->bvmul(
5733 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
5736 this->controlFlow_s(inst);
5749 this->symbolicEngine->getOperandAst(src)
5758 this->controlFlow_s(inst);
5771 auto node = this->astCtxt->bvneg(
5772 this->astCtxt->bvmul(
5782 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5785 this->controlFlow_s(inst);
5801 auto node = this->astCtxt->bvsub(
5803 this->astCtxt->bvmul(
5813 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
5816 this->controlFlow_s(inst);
5830 auto node = this->astCtxt->extract(
5833 this->astCtxt->bvmul(
5843 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5846 this->controlFlow_s(inst);
5860 auto node = this->astCtxt->bvmul(
5869 expr->isTainted = this->taintEngine->
setTaint(dst, this->taintEngine->
isTainted(src1) | this->taintEngine->isTainted(src2));
5872 this->controlFlow_s(inst);
5884 auto node = this->astCtxt->zx(dst.
getBitSize() - 8, this->astCtxt->extract(7, 0, op));
5893 this->controlFlow_s(inst);
5905 auto node = this->astCtxt->zx(dst.
getBitSize() - 16, this->astCtxt->extract(15, 0, op));
5914 this->controlFlow_s(inst);
The abstract architecture class.
TRITON_EXPORT const triton::arch::Register & getRegister(triton::arch::register_e id) const
Returns register from id.
TRITON_EXPORT bool isMemoryExclusive(const triton::arch::MemoryAccess &mem) const
Returns true if the memory access is tagged as exclusive. Only valid for Arm32 and AArch64.
TRITON_EXPORT void setMemoryExclusiveTag(const triton::arch::MemoryAccess &mem, bool tag)
Sets exclusive memory access tag. Only valid for Arm32 and AArch64.
TRITON_EXPORT const triton::arch::Register & getParentRegister(triton::arch::register_e id) const
Returns parent register from id.
TRITON_EXPORT void setBits(triton::uint32 high, triton::uint32 low)
Sets the bits (high, low) position.
This class is used to represent an instruction.
TRITON_EXPORT bool isWriteBack(void) const
Returns true if the instruction performs a write back. Mainly used for AArch64 instructions like LDR.
TRITON_EXPORT void setConditionTaken(bool flag)
Sets flag to define if the condition is taken or not.
TRITON_EXPORT triton::uint32 getType(void) const
Returns the type of the instruction.
std::vector< triton::arch::OperandWrapper > operands
A list of operands.
TRITON_EXPORT bool isUpdateFlag(void) const
Returns true if the instruction updates flags. Mainly used for AArch64 instructions like ADDS.
TRITON_EXPORT triton::arch::arm::condition_e getCodeCondition(void) const
Returns the code codition of the instruction (mainly for AArch64).
TRITON_EXPORT triton::uint64 getNextAddress(void) const
Returns the next address of the instruction.
This class is used to represent a memory access.
TRITON_EXPORT triton::ast::SharedAbstractNode getLeaAst(void) const
Returns the AST of the memory access (LEA).
TRITON_EXPORT triton::arch::Register & getBaseRegister(void)
LEA - Returns the base register operand.
This class is used as operand wrapper.
TRITON_EXPORT triton::uint32 getLow(void) const
Returns the lower bit position of the abstract operand.
TRITON_EXPORT triton::arch::operand_e getType(void) const
Returns the abstract type of the operand.
TRITON_EXPORT triton::uint32 getSize(void) const
Returns the abstract size (in bytes) of the operand.
TRITON_EXPORT const triton::arch::MemoryAccess & getConstMemory(void) const
Returns the memory operand as const.
TRITON_EXPORT triton::arch::MemoryAccess & getMemory(void)
Returns the memory operand.
TRITON_EXPORT const triton::arch::Register & getConstRegister(void) const
Returns the register operand.
TRITON_EXPORT triton::uint32 getHigh(void) const
Returns the highest bit position of the abstract operand.
TRITON_EXPORT const triton::arch::Immediate & getConstImmediate(void) const
Returns the immediate operand.
TRITON_EXPORT triton::uint32 getBitSize(void) const
Returns the abstract size (in bits) of the operand.
TRITON_EXPORT triton::arch::Immediate & getImmediate(void)
Returns the immediate operand.
This class is used when an instruction has a register operand.
TRITON_EXPORT triton::uint32 getBitSize(void) const
Returns the size (in bits) of the register.
TRITON_EXPORT triton::uint32 getShiftImmediate(void) const
Returns the value of the shift immediate.
TRITON_EXPORT triton::arch::arm::vas_e getVASType(void) const
Returns the vector arrangement specifier.
TRITON_EXPORT triton::uint32 getVASSize(void) const
Returns the vector arrangement specifier size (64 or 128 bits).
TRITON_EXPORT triton::arch::exception_e buildSemantics(triton::arch::Instruction &inst)
Builds the semantics of the instruction. Returns triton::arch::NO_FAULT if succeed.
TRITON_EXPORT AArch64Semantics(triton::arch::Architecture *architecture, triton::engines::symbolic::SymbolicEngine *symbolicEngine, triton::engines::taint::TaintEngine *taintEngine, const triton::ast::SharedAstContext &astCtxt)
Constructor.
TRITON_EXPORT void pushPathConstraint(const triton::arch::Instruction &inst, const triton::engines::symbolic::SharedSymbolicExpression &expr)
Pushs constraints of a branch instruction to the path predicate.
The symbolic engine class.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicRegisterExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::Register ®, const std::string &comment="")
Returns the new symbolic register expression expression and links this expression to the instruction.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicVolatileExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const std::string &comment="")
Returns the new symbolic volatile expression expression and links this expression to the instruction.
TRITON_EXPORT triton::ast::SharedAbstractNode getMemoryAst(const triton::arch::MemoryAccess &mem)
Returns the AST corresponding to the memory.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::OperandWrapper &dst, const std::string &comment="")
Returns the new symbolic expression and links this expression to the instruction.
TRITON_EXPORT triton::ast::SharedAbstractNode getOperandAst(const triton::arch::OperandWrapper &op)
Returns the AST corresponding to the operand.
TRITON_EXPORT bool setTaint(const triton::arch::OperandWrapper &op, bool flag)
Sets the flag (taint or untaint) to an abstract operand (Register or Memory).
TRITON_EXPORT bool isTainted(const triton::arch::OperandWrapper &op) const
Abstract taint verification. Returns true if the operand is tainted.
TRITON_EXPORT bool isMemoryTainted(triton::uint64 addr, triton::uint32 size=1) const
Returns true if the addr is tainted.
TRITON_EXPORT bool taintUnion(const triton::arch::OperandWrapper &op1, const triton::arch::OperandWrapper &op2)
Abstract union tainting.
TRITON_EXPORT bool setTaintRegister(const triton::arch::Register ®, bool flag)
Sets the flag (taint or untaint) to a register.
TRITON_EXPORT bool taintAssignment(const triton::arch::OperandWrapper &op1, const triton::arch::OperandWrapper &op2)
Abstract assignment tainting.
The exception class used by all semantics.
vas_e
Vector arrangement specifier.
@ ID_VAS_4S
4 lanes, each containing a 32-bit element.
@ ID_VAS_2D
2 lanes, each containing a 64-bit element.
@ ID_VAS_1D
1 lane containing a 64-bit element.
@ ID_VAS_16B
16 lanes, each containing an 8-bit element.
@ ID_VAS_8B
8 lanes, each containing an 8-bit element.
@ ID_VAS_8H
8 lanes, each containing a 16-bit element.
@ ID_VAS_4H
4 lanes, each containing a 16-bit element.
@ ID_VAS_2S
2 lanes, each containing a 32-bit element.
@ ID_CONDITION_HS
Higher or same (unsigned >=). C set.
@ ID_CONDITION_PL
Positive or zero. N clear.
@ ID_CONDITION_VC
No overflow. V clear.
@ ID_CONDITION_LE
Signed <=. Z set, N and V differ.
@ ID_CONDITION_VS
Overflow. V set.
@ ID_CONDITION_MI
Negative. N set.
@ ID_CONDITION_GE
Signed >=. N and V the same.
@ ID_CONDITION_GT
Signed >. Z clear, N and V the same.
@ ID_CONDITION_HI
Higher (unsigned >). C set and Z clear.
@ ID_CONDITION_NE
Not equal. Z clear.
@ ID_CONDITION_AL
Always. Any flags. This suffix is normally omitted.
@ ID_CONDITION_LO
Lower (unsigned <). C clear.
@ ID_CONDITION_LT
Signed <. N and V differ.
@ ID_CONDITION_LS
Lower or same (unsigned <=). C clear or Z set.
@ ID_CONDITION_EQ
Equal. Z set.
std::shared_ptr< triton::ast::AbstractNode > SharedAbstractNode
Shared Abstract Node.
std::shared_ptr< triton::ast::AstContext > SharedAstContext
Shared AST context.
constexpr triton::uint32 byte
byte size in bit
constexpr triton::uint32 dword
dword size in bit
constexpr triton::uint32 qword
qword size in bit
constexpr triton::uint32 dqword
dqword size in bit
constexpr triton::uint32 dword
dword size in byte
constexpr triton::uint32 word
word size in byte
constexpr triton::uint32 byte
byte size in byte
constexpr triton::uint32 qword
qword size in byte
std::shared_ptr< triton::engines::symbolic::SymbolicExpression > SharedSymbolicExpression
Shared Symbolic Expression.
const bool UNTAINTED
Defines an untainted item.
std::uint32_t uint32
unisgned 32-bits