libTriton version 1.0 build 1599
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Modules Pages
aarch64Semantics.cpp
Go to the documentation of this file.
1
2/*
3** Copyright (C) - Triton
4**
5** This program is under the terms of the Apache License 2.0.
6*/
7
10#include <triton/astContext.hpp>
11#include <triton/cpuSize.hpp>
12#include <triton/exceptions.hpp>
13
14
15
206namespace triton {
207 namespace arch {
208 namespace arm {
209 namespace aarch64 {
210
214 const triton::ast::SharedAstContext& astCtxt) : astCtxt(astCtxt) {
215
216 this->architecture = architecture;
217 this->exception = triton::arch::NO_FAULT;
218 this->symbolicEngine = symbolicEngine;
219 this->taintEngine = taintEngine;
220
221 if (architecture == nullptr)
222 throw triton::exceptions::Semantics("AArch64Semantics::AArch64Semantics(): The architecture API must be defined.");
223
224 if (this->symbolicEngine == nullptr)
225 throw triton::exceptions::Semantics("AArch64Semantics::AArch64Semantics(): The symbolic engine API must be defined.");
226
227 if (this->taintEngine == nullptr)
228 throw triton::exceptions::Semantics("AArch64Semantics::AArch64Semantics(): The taint engines API must be defined.");
229 }
230
231
233 this->exception = triton::arch::NO_FAULT;
234 switch (inst.getType()) {
235 case ID_INS_ADC: this->adc_s(inst); break;
236 case ID_INS_ADD: this->add_s(inst); break;
237 case ID_INS_ADR: this->adr_s(inst); break;
238 case ID_INS_ADRP: this->adrp_s(inst); break;
239 case ID_INS_AND: this->and_s(inst); break;
240 case ID_INS_ASR: this->asr_s(inst); break;
241 case ID_INS_B: this->b_s(inst); break;
242 case ID_INS_BFI: this->bfi_s(inst); break;
243 case ID_INS_BFXIL: this->bfxil_s(inst); break;
244 case ID_INS_BIC: this->bic_s(inst); break;
245 case ID_INS_BL: this->bl_s(inst); break;
246 case ID_INS_BLR: this->blr_s(inst); break;
247 case ID_INS_BR: this->br_s(inst); break;
248 case ID_INS_BRK: this->brk_s(inst); break;
249 case ID_INS_CBNZ: this->cbnz_s(inst); break;
250 case ID_INS_CBZ: this->cbz_s(inst); break;
251 case ID_INS_CCMP: this->ccmp_s(inst); break;
252 case ID_INS_CINC: this->cinc_s(inst); break;
253 case ID_INS_CLZ: this->clz_s(inst); break;
254 case ID_INS_CMN: this->cmn_s(inst); break;
255 case ID_INS_CMP: this->cmp_s(inst); break;
256 case ID_INS_CNEG: this->cneg_s(inst); break;
257 case ID_INS_CSEL: this->csel_s(inst); break;
258 case ID_INS_CSET: this->cset_s(inst); break;
259 case ID_INS_CSETM: this->csetm_s(inst); break;
260 case ID_INS_CSINC: this->csinc_s(inst); break;
261 case ID_INS_CSINV: this->csinv_s(inst); break;
262 case ID_INS_CSNEG: this->csneg_s(inst); break;
263 case ID_INS_EON: this->eon_s(inst); break;
264 case ID_INS_EOR: this->eor_s(inst); break;
265 case ID_INS_EXTR: this->extr_s(inst); break;
266 case ID_INS_FMOV: this->fmov_s(inst); break;
267 case ID_INS_LD3: this->ld3_s(inst); break;
268 case ID_INS_LD3R: this->ld3r_s(inst); break;
269 case ID_INS_LD4: this->ld4_s(inst); break;
270 case ID_INS_LD4R: this->ld4r_s(inst); break;
271 case ID_INS_LDAR: this->ldar_s(inst); break;
272 case ID_INS_LDARB: this->ldarb_s(inst); break;
273 case ID_INS_LDARH: this->ldarh_s(inst); break;
274 case ID_INS_LDAXR: this->ldaxr_s(inst); break;
275 case ID_INS_LDAXRB: this->ldaxrb_s(inst); break;
276 case ID_INS_LDAXRH: this->ldaxrh_s(inst); break;
277 case ID_INS_LDNP: this->ldnp_s(inst); break;
278 case ID_INS_LDP: this->ldp_s(inst); break;
279 case ID_INS_LDPSW: this->ldpsw_s(inst); break;
280 case ID_INS_LDR: this->ldr_s(inst); break;
281 case ID_INS_LDRB: this->ldrb_s(inst); break;
282 case ID_INS_LDRH: this->ldrh_s(inst); break;
283 case ID_INS_LDRSB: this->ldrsb_s(inst); break;
284 case ID_INS_LDRSH: this->ldrsh_s(inst); break;
285 case ID_INS_LDRSW: this->ldrsw_s(inst); break;
286 case ID_INS_LDTR: this->ldtr_s(inst); break;
287 case ID_INS_LDTRB: this->ldtrb_s(inst); break;
288 case ID_INS_LDTRH: this->ldtrh_s(inst); break;
289 case ID_INS_LDTRSB: this->ldtrsb_s(inst); break;
290 case ID_INS_LDTRSH: this->ldtrsh_s(inst); break;
291 case ID_INS_LDTRSW: this->ldtrsw_s(inst); break;
292 case ID_INS_LDUR: this->ldur_s(inst); break;
293 case ID_INS_LDURB: this->ldurb_s(inst); break;
294 case ID_INS_LDURH: this->ldurh_s(inst); break;
295 case ID_INS_LDURSB: this->ldursb_s(inst); break;
296 case ID_INS_LDURSH: this->ldursh_s(inst); break;
297 case ID_INS_LDURSW: this->ldursw_s(inst); break;
298 case ID_INS_LDXP: this->ldxp_s(inst); break;
299 case ID_INS_LDXR: this->ldxr_s(inst); break;
300 case ID_INS_LDXRB: this->ldxrb_s(inst); break;
301 case ID_INS_LDXRH: this->ldxrh_s(inst); break;
302 case ID_INS_LSL: this->lsl_s(inst); break;
303 case ID_INS_LSR: this->lsr_s(inst); break;
304 case ID_INS_MADD: this->madd_s(inst); break;
305 case ID_INS_MNEG: this->mneg_s(inst); break;
306 case ID_INS_MOV: this->mov_s(inst); break;
307 case ID_INS_MOVI: this->movi_s(inst); break;
308 case ID_INS_MOVK: this->movk_s(inst); break;
309 case ID_INS_MOVN: this->movn_s(inst); break;
310 case ID_INS_MOVZ: this->movz_s(inst); break;
311 case ID_INS_MRS: this->mrs_s(inst); break;
312 case ID_INS_MSR: this->msr_s(inst); break;
313 case ID_INS_MSUB: this->msub_s(inst); break;
314 case ID_INS_MUL: this->mul_s(inst); break;
315 case ID_INS_MVN: this->mvn_s(inst); break;
316 case ID_INS_NEG: this->neg_s(inst); break;
317 case ID_INS_NOP: this->nop_s(inst); break;
318 case ID_INS_ORN: this->orn_s(inst); break;
319 case ID_INS_ORR: this->orr_s(inst); break;
320 case ID_INS_RBIT: this->rbit_s(inst); break;
321 case ID_INS_RET: this->ret_s(inst); break;
322 case ID_INS_REV16: this->rev16_s(inst); break;
323 case ID_INS_REV32: this->rev32_s(inst); break;
324 case ID_INS_REV64: this->rev_s(inst); break;
325 case ID_INS_REV: this->rev_s(inst); break;
326 case ID_INS_ROR: this->ror_s(inst); break;
327 case ID_INS_SBC: this->sbc_s(inst); break;
328 case ID_INS_SBFX: this->sbfx_s(inst); break;
329 case ID_INS_SDIV: this->sdiv_s(inst); break;
330 case ID_INS_SMADDL: this->smaddl_s(inst); break;
331 case ID_INS_SMSUBL: this->smsubl_s(inst); break;
332 case ID_INS_SMULH: this->smulh_s(inst); break;
333 case ID_INS_SMULL: this->smull_s(inst); break;
334 case ID_INS_STLR: this->stlr_s(inst); break;
335 case ID_INS_STLRB: this->stlrb_s(inst); break;
336 case ID_INS_STLRH: this->stlrh_s(inst); break;
337 case ID_INS_STLXR: this->stlxr_s(inst); break;
338 case ID_INS_STLXRB: this->stlxrb_s(inst); break;
339 case ID_INS_STLXRH: this->stlxrh_s(inst); break;
340 case ID_INS_STNP: this->stnp_s(inst); break;
341 case ID_INS_STP: this->stp_s(inst); break;
342 case ID_INS_STR: this->str_s(inst); break;
343 case ID_INS_STRB: this->strb_s(inst); break;
344 case ID_INS_STRH: this->strh_s(inst); break;
345 case ID_INS_STTR: this->sttr_s(inst); break;
346 case ID_INS_STTRB: this->sttrb_s(inst); break;
347 case ID_INS_STTRH: this->sttrh_s(inst); break;
348 case ID_INS_STUR: this->stur_s(inst); break;
349 case ID_INS_STURB: this->sturb_s(inst); break;
350 case ID_INS_STURH: this->sturh_s(inst); break;
351 case ID_INS_STXP: this->stxp_s(inst); break;
352 case ID_INS_STXR: this->stxr_s(inst); break;
353 case ID_INS_STXRB: this->stxrb_s(inst); break;
354 case ID_INS_STXRH: this->stxrh_s(inst); break;
355 case ID_INS_SUB: this->sub_s(inst); break;
356 case ID_INS_SVC: this->svc_s(inst); break;
357 case ID_INS_SXTB: this->sxtb_s(inst); break;
358 case ID_INS_SXTH: this->sxth_s(inst); break;
359 case ID_INS_SXTW: this->sxtw_s(inst); break;
360 case ID_INS_TBNZ: this->tbnz_s(inst); break;
361 case ID_INS_TBZ: this->tbz_s(inst); break;
362 case ID_INS_TST: this->tst_s(inst); break;
363 case ID_INS_UBFIZ: this->ubfiz_s(inst); break;
364 case ID_INS_UBFX: this->ubfx_s(inst); break;
365 case ID_INS_UDIV: this->udiv_s(inst); break;
366 case ID_INS_UMADDL: this->umaddl_s(inst); break;
367 case ID_INS_UMOV: this->umov_s(inst); break;
368 case ID_INS_UMNEGL: this->umnegl_s(inst); break;
369 case ID_INS_UMSUBL: this->umsubl_s(inst); break;
370 case ID_INS_UMULH: this->umulh_s(inst); break;
371 case ID_INS_UMULL: this->umull_s(inst); break;
372 case ID_INS_UXTB: this->uxtb_s(inst); break;
373 case ID_INS_UXTH: this->uxth_s(inst); break;
374 default:
375 this->exception = triton::arch::FAULT_UD;
376 break;
377 }
378 return this->exception;
379 }
380
381
382 void AArch64Semantics::controlFlow_s(triton::arch::Instruction& inst) {
383 auto pc = triton::arch::OperandWrapper(this->architecture->getParentRegister(ID_REG_AARCH64_PC));
384
385 /* Create the semantics */
386 auto node = this->astCtxt->bv(inst.getNextAddress(), pc.getBitSize());
387
388 /* Create symbolic expression */
389 auto expr = this->symbolicEngine->createSymbolicRegisterExpression(inst, node, this->architecture->getParentRegister(ID_REG_AARCH64_PC), "Program Counter");
390
391 /* Spread taint */
392 expr->isTainted = this->taintEngine->setTaintRegister(this->architecture->getParentRegister(ID_REG_AARCH64_PC), triton::engines::taint::UNTAINTED);
393 }
394
395
396 triton::ast::SharedAbstractNode AArch64Semantics::getCodeConditionAst(triton::arch::Instruction& inst,
399
400 switch (inst.getCodeCondition()) {
401 // Always. Any flags. This suffix is normally omitted.
403 return thenNode;
404 }
405
406 // Equal. Z set.
408 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
409 auto node = this->astCtxt->ite(
410 this->astCtxt->equal(z, this->astCtxt->bvtrue()),
411 thenNode,
412 elseNode);
413 return node;
414 }
415
416 // Signed >=. N and V the same.
418 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
419 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
420 auto node = this->astCtxt->ite(
421 this->astCtxt->equal(n, v),
422 thenNode,
423 elseNode);
424 return node;
425 }
426
427 // Signed >. Z clear, N and V the same.
429 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
430 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
431 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
432 auto node = this->astCtxt->ite(
433 this->astCtxt->land(
434 this->astCtxt->equal(z, this->astCtxt->bvfalse()),
435 this->astCtxt->equal(n, v)
436 ),
437 thenNode,
438 elseNode);
439 return node;
440 }
441
442 // Higher (unsigned >). C set and Z clear.
444 auto c = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C)));
445 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
446 auto node = this->astCtxt->ite(
447 this->astCtxt->land(
448 this->astCtxt->equal(c, this->astCtxt->bvtrue()),
449 this->astCtxt->equal(z, this->astCtxt->bvfalse())
450 ),
451 thenNode,
452 elseNode);
453 return node;
454 }
455
456 // Higher or same (unsigned >=). C set.
458 auto c = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C)));
459 auto node = this->astCtxt->ite(
460 this->astCtxt->equal(c, this->astCtxt->bvtrue()),
461 thenNode,
462 elseNode);
463 return node;
464 }
465
466 // Signed <=. Z set or N and V differ.
468 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
469 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
470 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
471 auto node = this->astCtxt->ite(
472 this->astCtxt->lor(
473 this->astCtxt->equal(z, this->astCtxt->bvtrue()),
474 this->astCtxt->lnot(this->astCtxt->equal(n, v))
475 ),
476 thenNode,
477 elseNode);
478 return node;
479 }
480
481 // Lower (unsigned <). C clear.
483 auto c = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C)));
484 auto node = this->astCtxt->ite(
485 this->astCtxt->equal(c, this->astCtxt->bvfalse()),
486 thenNode,
487 elseNode);
488 return node;
489 }
490
491 // Lower or same (unsigned <=). C clear or Z set.
493 auto c = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C)));
494 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
495 auto node = this->astCtxt->ite(
496 this->astCtxt->lor(
497 this->astCtxt->equal(c, this->astCtxt->bvfalse()),
498 this->astCtxt->equal(z, this->astCtxt->bvtrue())
499 ),
500 thenNode,
501 elseNode);
502 return node;
503 }
504
505 // Signed <. N and V differ.
507 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
508 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
509 auto node = this->astCtxt->ite(
510 this->astCtxt->lnot(this->astCtxt->equal(n, v)),
511 thenNode,
512 elseNode);
513 return node;
514 }
515
516 // Negative. N set.
518 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
519 auto node = this->astCtxt->ite(
520 this->astCtxt->equal(n, this->astCtxt->bvtrue()),
521 thenNode,
522 elseNode);
523 return node;
524 }
525
526 // Not equal. Z clear.
528 auto z = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z)));
529 auto node = this->astCtxt->ite(
530 this->astCtxt->equal(z, this->astCtxt->bvfalse()),
531 thenNode,
532 elseNode);
533 return node;
534 }
535
536 // Positive or zero. N clear.
538 auto n = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N)));
539 auto node = this->astCtxt->ite(
540 this->astCtxt->equal(n, this->astCtxt->bvfalse()),
541 thenNode,
542 elseNode);
543 return node;
544 }
545
546 // No overflow. V clear.
548 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
549 auto node = this->astCtxt->ite(
550 this->astCtxt->equal(v, this->astCtxt->bvfalse()),
551 thenNode,
552 elseNode);
553 return node;
554 }
555
556 // Overflow. V set.
558 auto v = this->symbolicEngine->getOperandAst(inst, triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V)));
559 auto node = this->astCtxt->ite(
560 this->astCtxt->equal(v, this->astCtxt->bvtrue()),
561 thenNode,
562 elseNode);
563 return node;
564 }
565
566 default:
567 /* The instruction don't use condition, so just return the 'then' node */
568 return thenNode;
569 }
570 }
571
572
573 bool AArch64Semantics::getCodeConditionTainteSate(const triton::arch::Instruction& inst) {
574 switch (inst.getCodeCondition()) {
575 // Always. Any flags. This suffix is normally omitted.
577 return false;
578 }
579
580 // Equal. Z set.
581 // Not equal. Z clear.
584 auto z = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z));
585 return this->taintEngine->isTainted(z);
586 }
587
588 // Signed >=. N and V the same.
589 // Signed <. N and V differ.
592 auto n = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N));
593 auto v = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V));
594 return this->taintEngine->isTainted(n) | this->taintEngine->isTainted(v);
595 }
596
597 // Signed >. Z clear, N and V the same.
598 // Signed <=. Z set, N and V differ.
601 auto z = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z));
602 auto n = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N));
603 auto v = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V));
604 return this->taintEngine->isTainted(z) | this->taintEngine->isTainted(n) | this->taintEngine->isTainted(v);
605 }
606
607 // Higher (unsigned >). C set and Z clear.
608 // Lower or same (unsigned <=). C clear or Z set.
611 auto c = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C));
612 auto z = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_Z));
613 return this->taintEngine->isTainted(c) | this->taintEngine->isTainted(z);
614 }
615
616 // Higher or same (unsigned >=). C set.
617 // Lower (unsigned <). C clear.
620 auto c = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C));
621 return this->taintEngine->isTainted(c);
622 }
623
624 // Negative. N set.
625 // Positive or zero. N clear.
628 auto n = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_N));
629 return this->taintEngine->isTainted(n);
630 }
631
632 // No overflow. V clear.
633 // Overflow. V set.
636 auto v = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_V));
637 return this->taintEngine->isTainted(v);
638 }
639
640 default:
641 return false;
642 }
643 }
644
645
646 void AArch64Semantics::clearFlag_s(triton::arch::Instruction& inst, const triton::arch::Register& flag, std::string comment) {
647 /* Create the semantics */
648 auto node = this->astCtxt->bv(0, 1);
649
650 /* Create symbolic expression */
651 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, flag, comment);
652
653 /* Spread taint */
654 expr->isTainted = this->taintEngine->setTaintRegister(flag, triton::engines::taint::UNTAINTED);
655 }
656
657
658 void AArch64Semantics::setFlag_s(triton::arch::Instruction& inst, const triton::arch::Register& flag, std::string comment) {
659 /* Create the semantics */
660 auto node = this->astCtxt->bv(1, 1);
661
662 /* Create symbolic expression */
663 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, flag, comment);
664
665 /* Spread taint */
666 expr->isTainted = this->taintEngine->setTaintRegister(flag, triton::engines::taint::UNTAINTED);
667 }
668
669
670 void AArch64Semantics::nf_s(triton::arch::Instruction& inst,
673
674 auto nf = this->architecture->getRegister(ID_REG_AARCH64_N);
675 auto high = dst.getHigh();
676
677 /*
678 * Create the semantic.
679 * nf = MSB(result)
680 */
681 auto node = this->astCtxt->extract(high, high, this->astCtxt->reference(parent));
682
683 /* Create the symbolic expression */
684 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, nf, "Negative flag");
685
686 /* Spread the taint from the parent to the child */
687 expr->isTainted = this->taintEngine->setTaintRegister(nf, parent->isTainted);
688 }
689
690
691 void AArch64Semantics::nfCcmp_s(triton::arch::Instruction& inst,
695
696 auto nf = this->architecture->getRegister(ID_REG_AARCH64_N);
697 auto high = dst.getHigh();
698
699 /*
700 * Create the semantic.
701 * nf = MSB(result) if cond == true else NF(nzcv)
702 */
703 auto node1 = this->astCtxt->extract(high, high, this->astCtxt->reference(parent));
704 auto node2 = this->astCtxt->extract(3, 3, nzcv);
705 auto node3 = this->getCodeConditionAst(inst, node1, node2);
706
707 /* Create the symbolic expression */
708 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node3, nf, "Negative flag");
709
710 /* Spread the taint from the parent to the child */
711 expr->isTainted = this->taintEngine->setTaintRegister(nf, parent->isTainted);
712 }
713
714
715 void AArch64Semantics::zf_s(triton::arch::Instruction& inst,
718
719 auto zf = this->architecture->getRegister(ID_REG_AARCH64_Z);
720 auto bvSize = dst.getBitSize();
721 auto low = dst.getLow();
722 auto high = dst.getHigh();
723
724 /*
725 * Create the semantic.
726 * zf = 0 == result
727 */
728 auto node = this->astCtxt->ite(
729 this->astCtxt->equal(
730 this->astCtxt->extract(high, low, this->astCtxt->reference(parent)),
731 this->astCtxt->bv(0, bvSize)
732 ),
733 this->astCtxt->bv(1, 1),
734 this->astCtxt->bv(0, 1)
735 );
736
737 /* Create the symbolic expression */
738 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, zf, "Zero flag");
739
740 /* Spread the taint from the parent to the child */
741 expr->isTainted = this->taintEngine->setTaintRegister(zf, parent->isTainted);
742 }
743
744
745 void AArch64Semantics::zfCcmp_s(triton::arch::Instruction& inst,
749
750 auto zf = this->architecture->getRegister(ID_REG_AARCH64_Z);
751 auto bvSize = dst.getBitSize();
752 auto low = dst.getLow();
753 auto high = dst.getHigh();
754
755 /*
756 * Create the semantic.
757 * zf = 0 == result if cond == true else ZF(nzcv)
758 */
759 auto node1 = this->astCtxt->ite(
760 this->astCtxt->equal(
761 this->astCtxt->extract(high, low, this->astCtxt->reference(parent)),
762 this->astCtxt->bv(0, bvSize)
763 ),
764 this->astCtxt->bv(1, 1),
765 this->astCtxt->bv(0, 1)
766 );
767 auto node2 = this->astCtxt->extract(2, 2, nzcv);
768 auto node3 = this->getCodeConditionAst(inst, node1, node2);
769
770 /* Create the symbolic expression */
771 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node3, zf, "Zero flag");
772
773 /* Spread the taint from the parent to the child */
774 expr->isTainted = this->taintEngine->setTaintRegister(zf, parent->isTainted);
775 }
776
777
778 void AArch64Semantics::cfAdd_s(triton::arch::Instruction& inst,
783
784 auto cf = this->architecture->getRegister(ID_REG_AARCH64_C);
785 auto bvSize = dst.getBitSize();
786 auto low = dst.getLow();
787 auto high = dst.getHigh();
788
789 /*
790 * Create the semantic.
791 * cf = MSB((op1 & op2) ^ ((op1 ^ op2 ^ result) & (op1 ^ op2)));
792 */
793 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
794 this->astCtxt->bvxor(
795 this->astCtxt->bvand(op1, op2),
796 this->astCtxt->bvand(
797 this->astCtxt->bvxor(
798 this->astCtxt->bvxor(op1, op2),
799 this->astCtxt->extract(high, low, this->astCtxt->reference(parent))
800 ),
801 this->astCtxt->bvxor(op1, op2))
802 )
803 );
804
805 /* Create the symbolic expression */
806 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, cf, "Carry flag");
807
808 /* Spread the taint from the parent to the child */
809 expr->isTainted = this->taintEngine->setTaintRegister(cf, parent->isTainted);
810 }
811
812
813 void AArch64Semantics::cfSub_s(triton::arch::Instruction& inst,
818
819 auto cf = this->architecture->getRegister(ID_REG_AARCH64_C);
820 auto bvSize = dst.getBitSize();
821 auto low = dst.getLow();
822 auto high = dst.getHigh();
823
824 /*
825 * Create the semantic.
826 * cf = (MSB(((op1 ^ op2 ^ result) ^ ((op1 ^ result) & (op1 ^ op2))))) ^ 1
827 */
828 auto node = this->astCtxt->bvxor(
829 this->astCtxt->extract(bvSize-1, bvSize-1,
830 this->astCtxt->bvxor(
831 this->astCtxt->bvxor(op1, this->astCtxt->bvxor(op2, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))),
832 this->astCtxt->bvand(
833 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent))),
834 this->astCtxt->bvxor(op1, op2)
835 )
836 )
837 ),
838 this->astCtxt->bvtrue()
839 );
840
841 /* Create the symbolic expression */
842 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, cf, "Carry flag");
843
844 /* Spread the taint from the parent to the child */
845 expr->isTainted = this->taintEngine->setTaintRegister(cf, parent->isTainted);
846 }
847
848
849 void AArch64Semantics::cfCcmp_s(triton::arch::Instruction& inst,
855
856 auto cf = this->architecture->getRegister(ID_REG_AARCH64_C);
857 auto bvSize = dst.getBitSize();
858 auto low = dst.getLow();
859 auto high = dst.getHigh();
860
861 /*
862 * Create the semantic.
863 * if cond == true:
864 * cf = (MSB(((op1 ^ op2 ^ result) ^ ((op1 ^ result) & (op1 ^ op2))))) ^ 1
865 * else
866 * cf = CF(nzcv)
867 */
868 auto node1 = this->astCtxt->bvxor(
869 this->astCtxt->extract(bvSize-1, bvSize-1,
870 this->astCtxt->bvxor(
871 this->astCtxt->bvxor(op1, this->astCtxt->bvxor(op2, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))),
872 this->astCtxt->bvand(
873 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent))),
874 this->astCtxt->bvxor(op1, op2)
875 )
876 )
877 ),
878 this->astCtxt->bvtrue()
879 );
880 auto node2 = this->astCtxt->extract(1, 1, nzcv);
881 auto node3 = this->getCodeConditionAst(inst, node1, node2);
882
883 /* Create the symbolic expression */
884 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node3, cf, "Carry flag");
885
886 /* Spread the taint from the parent to the child */
887 expr->isTainted = this->taintEngine->setTaintRegister(cf, parent->isTainted);
888 }
889
890
891 void AArch64Semantics::vfAdd_s(triton::arch::Instruction& inst,
896
897 auto vf = this->architecture->getRegister(ID_REG_AARCH64_V);
898 auto bvSize = dst.getBitSize();
899 auto low = dst.getLow();
900 auto high = dst.getHigh();
901
902 /*
903 * Create the semantic.
904 * vf = MSB((op1 ^ ~op2) & (op1 ^ result))
905 */
906 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
907 this->astCtxt->bvand(
908 this->astCtxt->bvxor(op1, this->astCtxt->bvnot(op2)),
909 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
910 )
911 );
912
913 /* Create the symbolic expression */
914 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, vf, "Overflow flag");
915
916 /* Spread the taint from the parent to the child */
917 expr->isTainted = this->taintEngine->setTaintRegister(vf, parent->isTainted);
918 }
919
920
921 void AArch64Semantics::vfSub_s(triton::arch::Instruction& inst,
926
927 auto vf = this->architecture->getRegister(ID_REG_AARCH64_V);
928 auto bvSize = dst.getBitSize();
929 auto low = dst.getLow();
930 auto high = dst.getHigh();
931
932 /*
933 * Create the semantic.
934 * vf = MSB((op1 ^ op2) & (op1 ^ result))
935 */
936 auto node = this->astCtxt->extract(bvSize-1, bvSize-1,
937 this->astCtxt->bvand(
938 this->astCtxt->bvxor(op1, op2),
939 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
940 )
941 );
942
943 /* Create the symbolic expression */
944 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, vf, "Overflow flag");
945
946 /* Spread the taint from the parent to the child */
947 expr->isTainted = this->taintEngine->setTaintRegister(vf, parent->isTainted);
948 }
949
950
951 void AArch64Semantics::vfCcmp_s(triton::arch::Instruction& inst,
957
958 auto vf = this->architecture->getRegister(ID_REG_AARCH64_V);
959 auto bvSize = dst.getBitSize();
960 auto low = dst.getLow();
961 auto high = dst.getHigh();
962
963 /*
964 * Create the semantic.
965 * if cond == true:
966 * vf = MSB((op1 ^ op2) & (op1 ^ result))
967 * else:
968 * vf = VF(nzcv)
969 */
970 auto node1 = this->astCtxt->extract(bvSize-1, bvSize-1,
971 this->astCtxt->bvand(
972 this->astCtxt->bvxor(op1, op2),
973 this->astCtxt->bvxor(op1, this->astCtxt->extract(high, low, this->astCtxt->reference(parent)))
974 )
975 );
976 auto node2 = this->astCtxt->extract(0, 0, nzcv);
977 auto node3 = this->getCodeConditionAst(inst, node1, node2);
978
979 /* Create the symbolic expression */
980 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node3, vf, "Overflow flag");
981
982 /* Spread the taint from the parent to the child */
983 expr->isTainted = this->taintEngine->setTaintRegister(vf, parent->isTainted);
984 }
985
986
987 void AArch64Semantics::adc_s(triton::arch::Instruction& inst) {
988 auto& dst = inst.operands[0];
989 auto& src1 = inst.operands[1];
990 auto& src2 = inst.operands[2];
991 auto cf = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C));
992
993 /* Create symbolic operands */
994 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
995 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
996 auto op3 = this->symbolicEngine->getOperandAst(inst, cf);
997
998 /* Create the semantics */
999 auto node = this->astCtxt->bvadd(this->astCtxt->bvadd(op1, op2), this->astCtxt->zx(dst.getBitSize()-1, op3));
1000
1001 /* Create symbolic expression */
1002 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ADC(S) operation");
1003
1004 /* Spread taint */
1005 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(cf));
1006
1007 /* Update symbolic flags */
1008 if (inst.isUpdateFlag() == true) {
1009 this->cfAdd_s(inst, expr, dst, op1, op2);
1010 this->nf_s(inst, expr, dst);
1011 this->vfAdd_s(inst, expr, dst, op1, op2);
1012 this->zf_s(inst, expr, dst);
1013 }
1014
1015 /* Update the symbolic control flow */
1016 this->controlFlow_s(inst);
1017 }
1018
1019
1020 void AArch64Semantics::add_s(triton::arch::Instruction& inst) {
1021 auto& dst = inst.operands[0];
1022 auto& src1 = inst.operands[1];
1023 auto& src2 = inst.operands[2];
1024
1025 /* Create symbolic operands */
1026 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1027 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1028
1029 /* Create the semantics */
1030 auto node = this->astCtxt->bvadd(op1, op2);
1031
1032 /* Create symbolic expression */
1033 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ADD(S) operation");
1034
1035 /* Spread taint */
1036 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1037
1038 /* Update symbolic flags */
1039 if (inst.isUpdateFlag() == true) {
1040 this->cfAdd_s(inst, expr, dst, op1, op2);
1041 this->nf_s(inst, expr, dst);
1042 this->vfAdd_s(inst, expr, dst, op1, op2);
1043 this->zf_s(inst, expr, dst);
1044 }
1045
1046 /* Update the symbolic control flow */
1047 this->controlFlow_s(inst);
1048 }
1049
1050
1051 void AArch64Semantics::adr_s(triton::arch::Instruction& inst) {
1052 auto& dst = inst.operands[0];
1053 auto& src = inst.operands[1];
1054 auto pc = triton::arch::OperandWrapper(this->architecture->getParentRegister(ID_REG_AARCH64_PC));
1055
1056 /*
1057 * Note: Capstone already encodes the result into the source operand. We don't have
1058 * to compute the add operation but do we lose the symbolic?
1059 */
1060 /* Create symbolic semantics */
1061 auto node = this->symbolicEngine->getOperandAst(inst, src);
1062
1063 /* Create symbolic expression */
1064 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ADR operation");
1065
1066 /* Spread taint */
1067 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src) | this->taintEngine->isTainted(pc));
1068
1069 /* Update the symbolic control flow */
1070 this->controlFlow_s(inst);
1071 }
1072
1073
1074 void AArch64Semantics::adrp_s(triton::arch::Instruction& inst) {
1075 auto& dst = inst.operands[0];
1076 auto& src = inst.operands[1];
1077 auto pc = triton::arch::OperandWrapper(this->architecture->getParentRegister(ID_REG_AARCH64_PC));
1078
1079 /*
1080 * Note: Capstone already encodes the result into the source operand. We don't have
1081 * to compute the add operation but do we lose the symbolic?
1082 */
1083 /* Create symbolic semantics */
1084 auto node = this->symbolicEngine->getOperandAst(inst, src);
1085
1086 /* Create symbolic expression */
1087 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ADRP operation");
1088
1089 /* Spread taint */
1090 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src) | this->taintEngine->isTainted(pc));
1091
1092 /* Update the symbolic control flow */
1093 this->controlFlow_s(inst);
1094 }
1095
1096
1097 void AArch64Semantics::and_s(triton::arch::Instruction& inst) {
1098 auto& dst = inst.operands[0];
1099 auto& src1 = inst.operands[1];
1100 auto& src2 = inst.operands[2];
1101
1102 /* Create symbolic operands */
1103 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1104 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1105
1106 /* Create the semantics */
1107 auto node = this->astCtxt->bvand(op1, op2);
1108
1109 /* Special case for vector registers */
1111 node = this->astCtxt->extract(63, 0, node);
1112 }
1113
1114 /* Create symbolic expression */
1115 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "AND(S) operation");
1116
1117 /* Spread taint */
1118 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1119
1120 /* Update symbolic flags */
1121 if (inst.isUpdateFlag() == true) {
1122 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_C), "Clears carry flag");
1123 this->nf_s(inst, expr, dst);
1124 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_V), "Clears overflow flag");
1125 this->zf_s(inst, expr, dst);
1126 }
1127
1128 /* Update the symbolic control flow */
1129 this->controlFlow_s(inst);
1130 }
1131
1132
1133 void AArch64Semantics::asr_s(triton::arch::Instruction& inst) {
1134 auto& dst = inst.operands[0];
1135 auto& src1 = inst.operands[1];
1136 auto& src2 = inst.operands[2];
1137 auto size = src2.getBitSize();
1138
1139 /* Create symbolic operands */
1140 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1141 auto op2 = this->astCtxt->bvand(
1142 this->symbolicEngine->getOperandAst(inst, src2),
1143 this->astCtxt->bv(size - 1, size)
1144 );
1145
1146 /* Create the semantics */
1147 auto node = this->astCtxt->bvashr(op1, op2);
1148
1149 /* Create symbolic expression */
1150 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ASR operation");
1151
1152 /* Spread taint */
1153 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1154
1155 /* Update the symbolic control flow */
1156 this->controlFlow_s(inst);
1157 }
1158
1159
1160 void AArch64Semantics::b_s(triton::arch::Instruction& inst) {
1161 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1162 auto& src = inst.operands[0];
1163
1164 /* Create symbolic operands */
1165 auto op1 = this->symbolicEngine->getOperandAst(inst, src);
1166 auto op2 = this->astCtxt->bv(inst.getNextAddress(), dst.getBitSize());
1167
1168 /* Create the semantics */
1169 auto node = this->getCodeConditionAst(inst, op1, op2);
1170
1171 /* Create symbolic expression */
1172 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "B operation - Program Counter");
1173
1174 /* Spread taint */
1175 expr->isTainted = this->taintEngine->setTaint(dst, this->getCodeConditionTainteSate(inst));
1176
1177 /* Set condition flag */
1178 if (node->getType() == triton::ast::ITE_NODE) {
1179 if (!(node->getChildren()[0]->evaluate().is_zero())) {
1180 inst.setConditionTaken(true);
1181 }
1182 }
1183
1184 /* Create the path constraint */
1185 this->symbolicEngine->pushPathConstraint(inst, expr);
1186 }
1187
1188
1189 void AArch64Semantics::bfi_s(triton::arch::Instruction& inst) {
1190 auto& dst = inst.operands[0]; // Reg
1191 auto& src1 = inst.operands[1]; // Reg
1192 auto& src2 = inst.operands[2]; // Imm (Lsb)
1193 auto& src3 = inst.operands[3]; // Imm (Width)
1194 auto lsb = static_cast<uint32>(src2.getImmediate().getValue());
1195 auto width = static_cast<uint32>(src3.getImmediate().getValue());
1196
1197 if (lsb + width > dst.getBitSize())
1198 throw triton::exceptions::Semantics("AArch64Semantics::bfi_s(): Invalid lsb and width.");
1199
1200 /* Create symbolic operands */
1201 auto op = this->symbolicEngine->getOperandAst(inst, src1);
1202 auto opDst = this->symbolicEngine->getOperandAst(inst, dst);
1203
1204 /* Create the semantics */
1205 std::vector<triton::ast::SharedAbstractNode> chunks;
1206 chunks.reserve(3);
1207
1208 if (lsb + width < dst.getBitSize()) {
1209 chunks.push_back(this->astCtxt->extract(dst.getBitSize() - 1, lsb + width, /* src */ opDst));
1210 }
1211 chunks.push_back(this->astCtxt->extract(width - 1, 0, /* src */ op));
1212 chunks.push_back(this->astCtxt->extract(lsb - 1, 0, /* dst */ opDst));
1213
1214 auto node = this->astCtxt->concat(chunks);
1215
1216 /* Create symbolic expression */
1217 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "BFI operation");
1218
1219 /* Spread taint */
1220 expr->isTainted = this->taintEngine->taintUnion(dst, src1);
1221
1222 /* Update the symbolic control flow */
1223 this->controlFlow_s(inst);
1224 }
1225
1226
1227 void AArch64Semantics::bfxil_s(triton::arch::Instruction& inst) {
1228 auto& dst = inst.operands[0]; // Reg
1229 auto& src1 = inst.operands[1]; // Reg
1230 auto& src2 = inst.operands[2]; // Imm (Lsb)
1231 auto& src3 = inst.operands[3]; // Imm (Width)
1232 auto lsb = static_cast<uint32>(src2.getImmediate().getValue());
1233 auto width = static_cast<uint32>(src3.getImmediate().getValue());
1234
1235 if (lsb + width > dst.getBitSize())
1236 throw triton::exceptions::Semantics("AArch64Semantics::bfxil_s(): Invalid lsb and width.");
1237
1238 /* Create symbolic operands */
1239 auto opSrc = this->symbolicEngine->getOperandAst(inst, src1);
1240 auto opDst = this->symbolicEngine->getOperandAst(inst, dst);
1241
1242 auto node = this->astCtxt->concat(
1243 this->astCtxt->extract(dst.getBitSize() - 1, width, opDst),
1244 this->astCtxt->extract(lsb + width - 1, lsb, opSrc)
1245 );
1246
1247 /* Create symbolic expression */
1248 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "BFXIL operation");
1249
1250 /* Spread taint */
1251 expr->isTainted = this->taintEngine->taintUnion(dst, src1);
1252
1253 /* Update the symbolic control flow */
1254 this->controlFlow_s(inst);
1255 }
1256
1257
1258 void AArch64Semantics::bic_s(triton::arch::Instruction& inst) {
1259 auto& dst = inst.operands[0]; // Reg
1260 auto& src1 = inst.operands[1]; // Reg
1261 auto& src2 = inst.operands[2]; // Reg + [Shift]
1262
1263 /* Create symbolic operands */
1264 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1265 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1266
1267 /* Create the semantics */
1268 auto node = this->astCtxt->bvand(op1, this->astCtxt->bvnot(op2));
1269
1270 /* Create symbolic expression */
1271 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "BIC(S) operation");
1272
1273 /* Spread taint */
1274 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1275
1276 /* Update symbolic flags */
1277 if (inst.isUpdateFlag() == true) {
1278 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_C), "Clears carry flag");
1279 this->nf_s(inst, expr, src1);
1280 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_V), "Clears overflow flag");
1281 this->zf_s(inst, expr, src1);
1282 }
1283
1284 /* Update the symbolic control flow */
1285 this->controlFlow_s(inst);
1286 }
1287
1288
1289
1290 void AArch64Semantics::bl_s(triton::arch::Instruction& inst) {
1291 auto dst1 = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_X30));
1292 auto dst2 = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1293 auto& src = inst.operands[0];
1294
1295 /* Create the semantics */
1296 auto node1 = this->astCtxt->bv(inst.getNextAddress(), dst1.getBitSize());
1297 auto node2 = this->symbolicEngine->getOperandAst(inst, src);
1298
1299 /* Create symbolic expression */
1300 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "BL operation - Link Register");
1301 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "BL operation - Program Counter");
1302
1303 /* Spread taint */
1304 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
1305 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
1306
1307 /* Set condition flag */
1308 inst.setConditionTaken(true);
1309
1310 /* Create the path constraint */
1311 this->symbolicEngine->pushPathConstraint(inst, expr2);
1312 }
1313
1314
1315 void AArch64Semantics::blr_s(triton::arch::Instruction& inst) {
1316 auto dst1 = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_X30));
1317 auto dst2 = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1318 auto& src = inst.operands[0];
1319
1320 /* Create the semantics */
1321 auto node1 = this->astCtxt->bv(inst.getNextAddress(), dst1.getBitSize());
1322 auto node2 = this->symbolicEngine->getOperandAst(inst, src);
1323
1324 /* Create symbolic expression */
1325 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "BLR operation - Link Register");
1326 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "BLR operation - Program Counter");
1327
1328 /* Spread taint */
1329 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
1330 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
1331
1332 /* Set condition flag */
1333 inst.setConditionTaken(true);
1334
1335 /* Create the path constraint */
1336 this->symbolicEngine->pushPathConstraint(inst, expr2);
1337 }
1338
1339
1340 void AArch64Semantics::br_s(triton::arch::Instruction& inst) {
1341 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1342 auto& src = inst.operands[0];
1343
1344 /* Create the semantics */
1345 auto node = this->symbolicEngine->getOperandAst(inst, src);
1346
1347 /* Create symbolic expression */
1348 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "BR operation - Program Counter");
1349
1350 /* Spread taint */
1351 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
1352
1353 /* Set condition flag */
1354 inst.setConditionTaken(true);
1355
1356 /* Create the path constraint */
1357 this->symbolicEngine->pushPathConstraint(inst, expr);
1358 }
1359
1360
1361 void AArch64Semantics::brk_s(triton::arch::Instruction& inst) {
1362 /* Set the exception */
1363 this->exception = triton::arch::FAULT_BP;
1364
1365 /* Update the symbolic control flow */
1366 this->controlFlow_s(inst);
1367 }
1368
1369
1370 void AArch64Semantics::cbnz_s(triton::arch::Instruction& inst) {
1371 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1372 auto& src1 = inst.operands[0];
1373 auto& src2 = inst.operands[1];
1374
1375 /* Create symbolic operands */
1376 auto op1 = this->astCtxt->zx(dst.getBitSize() - src1.getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
1377 auto op2 = this->astCtxt->zx(dst.getBitSize() - src2.getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
1378
1379 /* Create the semantics */
1380 auto node = this->astCtxt->ite(
1381 this->astCtxt->lnot(this->astCtxt->equal(op1, this->astCtxt->bv(0, op1->getBitvectorSize()))),
1382 op2,
1383 this->astCtxt->bv(inst.getNextAddress(), dst.getBitSize())
1384 );
1385
1386 /* Create symbolic expression */
1387 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CBNZ operation - Program Counter");
1388
1389 /* Spread taint */
1390 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1391
1392 /* Set condition flag */
1393 if (op1->evaluate() != 0)
1394 inst.setConditionTaken(true);
1395
1396 /* Create the path constraint */
1397 this->symbolicEngine->pushPathConstraint(inst, expr);
1398 }
1399
1400
1401 void AArch64Semantics::cbz_s(triton::arch::Instruction& inst) {
1402 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
1403 auto& src1 = inst.operands[0];
1404 auto& src2 = inst.operands[1];
1405
1406 /* Create symbolic operands */
1407 auto op1 = this->astCtxt->zx(dst.getBitSize() - src1.getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
1408 auto op2 = this->astCtxt->zx(dst.getBitSize() - src2.getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
1409
1410 /* Create the semantics */
1411 auto node = this->astCtxt->ite(
1412 this->astCtxt->equal(op1, this->astCtxt->bv(0, op1->getBitvectorSize())),
1413 op2,
1414 this->astCtxt->bv(inst.getNextAddress(), dst.getBitSize())
1415 );
1416
1417 /* Create symbolic expression */
1418 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CBZ operation - Program Counter");
1419
1420 /* Spread taint */
1421 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1422
1423 /* Set condition flag */
1424 if (op1->evaluate() == 0)
1425 inst.setConditionTaken(true);
1426
1427 /* Create the path constraint */
1428 this->symbolicEngine->pushPathConstraint(inst, expr);
1429 }
1430
1431
1432 void AArch64Semantics::ccmp_s(triton::arch::Instruction& inst) {
1433 auto& src1 = inst.operands[0];
1434 auto& src2 = inst.operands[1];
1435 auto& src3 = inst.operands[2];
1436
1437 /* Create symbolic operands */
1438 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1439 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1440 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
1441
1442 /* Create the semantics */
1443 auto node = this->astCtxt->bvsub(op1, op2);
1444
1445 /* Create symbolic expression */
1446 auto expr = this->symbolicEngine->createSymbolicVolatileExpression(inst, node, "CCMP temporary operation");
1447
1448 /* Spread taint */
1449 expr->isTainted = this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2);
1450
1451 /* Update symbolic flags */
1452 this->cfCcmp_s(inst, expr, src1, op1, op2, op3);
1453 this->nfCcmp_s(inst, expr, src1, op3);
1454 this->vfCcmp_s(inst, expr, src1, op1, op2, op3);
1455 this->zfCcmp_s(inst, expr, src1, op3);
1456
1457 /* Update the symbolic control flow */
1458 this->controlFlow_s(inst);
1459 }
1460
1461
1462 void AArch64Semantics::cinc_s(triton::arch::Instruction& inst) {
1463 auto& dst = inst.operands[0];
1464 auto& src = inst.operands[1];
1465
1466 /* Create symbolic operands */
1467 auto op1 = this->symbolicEngine->getOperandAst(inst, src);
1468 auto op2 = this->astCtxt->bvadd(op1, this->astCtxt->bv(1, src.getBitSize()));
1469
1470 /* Create the semantics */
1471 auto node = this->getCodeConditionAst(inst, op2, op1);
1472
1473 /* Create symbolic expression */
1474 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CINC operation");
1475
1476 /* Spread taint */
1477 expr->isTainted = this->taintEngine->setTaint(dst, this->getCodeConditionTainteSate(inst));
1478
1479 /* Update the symbolic control flow */
1480 this->controlFlow_s(inst);
1481 }
1482
1483
1484 void AArch64Semantics::clz_s(triton::arch::Instruction& inst) {
1485 auto& dst = inst.operands[0];
1486 auto& src = inst.operands[1];
1487 auto bvSize = dst.getBitSize();
1488
1489 /* Create symbolic operands */
1490 auto op = this->symbolicEngine->getOperandAst(inst, src);
1491
1492 /* Create the semantics */
1493 triton::ast::SharedAbstractNode node = nullptr;
1494 switch (src.getSize()) {
1496 node = this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(31, 31, op), this->astCtxt->bvtrue()), this->astCtxt->bv(0, bvSize),
1497 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(30, 30, op), this->astCtxt->bvtrue()), this->astCtxt->bv(1, bvSize),
1498 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(29, 29, op), this->astCtxt->bvtrue()), this->astCtxt->bv(2, bvSize),
1499 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(28, 28, op), this->astCtxt->bvtrue()), this->astCtxt->bv(3, bvSize),
1500 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(27, 27, op), this->astCtxt->bvtrue()), this->astCtxt->bv(4, bvSize),
1501 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(26, 26, op), this->astCtxt->bvtrue()), this->astCtxt->bv(5, bvSize),
1502 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(25, 25, op), this->astCtxt->bvtrue()), this->astCtxt->bv(6, bvSize),
1503 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(24, 24, op), this->astCtxt->bvtrue()), this->astCtxt->bv(7, bvSize),
1504 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(23, 23, op), this->astCtxt->bvtrue()), this->astCtxt->bv(8, bvSize),
1505 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(22, 22, op), this->astCtxt->bvtrue()), this->astCtxt->bv(9, bvSize),
1506 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(21, 21, op), this->astCtxt->bvtrue()), this->astCtxt->bv(10, bvSize),
1507 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(20, 20, op), this->astCtxt->bvtrue()), this->astCtxt->bv(11, bvSize),
1508 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(19, 19, op), this->astCtxt->bvtrue()), this->astCtxt->bv(12, bvSize),
1509 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(18, 18, op), this->astCtxt->bvtrue()), this->astCtxt->bv(13, bvSize),
1510 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(17, 17, op), this->astCtxt->bvtrue()), this->astCtxt->bv(14, bvSize),
1511 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(16, 16, op), this->astCtxt->bvtrue()), this->astCtxt->bv(15, bvSize),
1512 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(15, 15, op), this->astCtxt->bvtrue()), this->astCtxt->bv(16, bvSize),
1513 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(14, 14, op), this->astCtxt->bvtrue()), this->astCtxt->bv(17, bvSize),
1514 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(13, 13, op), this->astCtxt->bvtrue()), this->astCtxt->bv(18, bvSize),
1515 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(12, 12, op), this->astCtxt->bvtrue()), this->astCtxt->bv(19, bvSize),
1516 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(11, 11, op), this->astCtxt->bvtrue()), this->astCtxt->bv(20, bvSize),
1517 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(10, 10, op), this->astCtxt->bvtrue()), this->astCtxt->bv(21, bvSize),
1518 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(9, 9, op), this->astCtxt->bvtrue()), this->astCtxt->bv(22, bvSize),
1519 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(8, 8, op), this->astCtxt->bvtrue()), this->astCtxt->bv(23, bvSize),
1520 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(7, 7, op), this->astCtxt->bvtrue()), this->astCtxt->bv(24, bvSize),
1521 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(6, 6, op), this->astCtxt->bvtrue()), this->astCtxt->bv(25, bvSize),
1522 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(5, 5, op), this->astCtxt->bvtrue()), this->astCtxt->bv(26, bvSize),
1523 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(4, 4, op), this->astCtxt->bvtrue()), this->astCtxt->bv(27, bvSize),
1524 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(3, 3, op), this->astCtxt->bvtrue()), this->astCtxt->bv(28, bvSize),
1525 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(2, 2, op), this->astCtxt->bvtrue()), this->astCtxt->bv(29, bvSize),
1526 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(1, 1, op), this->astCtxt->bvtrue()), this->astCtxt->bv(30, bvSize),
1527 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(0, 0, op), this->astCtxt->bvtrue()), this->astCtxt->bv(31, bvSize),
1528 this->astCtxt->bv(32, bvSize)
1529 ))))))))))))))))))))))))))))))));
1530 break;
1531
1533 node = this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(63, 63, op), this->astCtxt->bvtrue()), this->astCtxt->bv(0, bvSize),
1534 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(62, 62, op), this->astCtxt->bvtrue()), this->astCtxt->bv(1, bvSize),
1535 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(61, 61, op), this->astCtxt->bvtrue()), this->astCtxt->bv(2, bvSize),
1536 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(60, 60, op), this->astCtxt->bvtrue()), this->astCtxt->bv(3, bvSize),
1537 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(59, 59, op), this->astCtxt->bvtrue()), this->astCtxt->bv(4, bvSize),
1538 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(58, 58, op), this->astCtxt->bvtrue()), this->astCtxt->bv(5, bvSize),
1539 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(57, 57, op), this->astCtxt->bvtrue()), this->astCtxt->bv(6, bvSize),
1540 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(56, 56, op), this->astCtxt->bvtrue()), this->astCtxt->bv(7, bvSize),
1541 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(55, 55, op), this->astCtxt->bvtrue()), this->astCtxt->bv(8, bvSize),
1542 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(54, 54, op), this->astCtxt->bvtrue()), this->astCtxt->bv(9, bvSize),
1543 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(53, 53, op), this->astCtxt->bvtrue()), this->astCtxt->bv(10, bvSize),
1544 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(52, 52, op), this->astCtxt->bvtrue()), this->astCtxt->bv(11, bvSize),
1545 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(51, 51, op), this->astCtxt->bvtrue()), this->astCtxt->bv(12, bvSize),
1546 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(50, 50, op), this->astCtxt->bvtrue()), this->astCtxt->bv(13, bvSize),
1547 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(49, 49, op), this->astCtxt->bvtrue()), this->astCtxt->bv(14, bvSize),
1548 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(48, 48, op), this->astCtxt->bvtrue()), this->astCtxt->bv(15, bvSize),
1549 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(47, 47, op), this->astCtxt->bvtrue()), this->astCtxt->bv(16, bvSize),
1550 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(46, 46, op), this->astCtxt->bvtrue()), this->astCtxt->bv(17, bvSize),
1551 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(45, 45, op), this->astCtxt->bvtrue()), this->astCtxt->bv(18, bvSize),
1552 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(44, 44, op), this->astCtxt->bvtrue()), this->astCtxt->bv(19, bvSize),
1553 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(43, 43, op), this->astCtxt->bvtrue()), this->astCtxt->bv(20, bvSize),
1554 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(42, 42, op), this->astCtxt->bvtrue()), this->astCtxt->bv(21, bvSize),
1555 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(41, 41, op), this->astCtxt->bvtrue()), this->astCtxt->bv(22, bvSize),
1556 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(40, 40, op), this->astCtxt->bvtrue()), this->astCtxt->bv(23, bvSize),
1557 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(39, 39, op), this->astCtxt->bvtrue()), this->astCtxt->bv(24, bvSize),
1558 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(38, 38, op), this->astCtxt->bvtrue()), this->astCtxt->bv(25, bvSize),
1559 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(37, 37, op), this->astCtxt->bvtrue()), this->astCtxt->bv(26, bvSize),
1560 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(36, 36, op), this->astCtxt->bvtrue()), this->astCtxt->bv(27, bvSize),
1561 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(35, 35, op), this->astCtxt->bvtrue()), this->astCtxt->bv(28, bvSize),
1562 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(34, 34, op), this->astCtxt->bvtrue()), this->astCtxt->bv(29, bvSize),
1563 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(33, 33, op), this->astCtxt->bvtrue()), this->astCtxt->bv(30, bvSize),
1564 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(32, 32, op), this->astCtxt->bvtrue()), this->astCtxt->bv(31, bvSize),
1565 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(31, 31, op), this->astCtxt->bvtrue()), this->astCtxt->bv(32, bvSize),
1566 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(30, 30, op), this->astCtxt->bvtrue()), this->astCtxt->bv(33, bvSize),
1567 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(29, 29, op), this->astCtxt->bvtrue()), this->astCtxt->bv(34, bvSize),
1568 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(28, 28, op), this->astCtxt->bvtrue()), this->astCtxt->bv(35, bvSize),
1569 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(27, 27, op), this->astCtxt->bvtrue()), this->astCtxt->bv(36, bvSize),
1570 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(26, 26, op), this->astCtxt->bvtrue()), this->astCtxt->bv(37, bvSize),
1571 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(25, 25, op), this->astCtxt->bvtrue()), this->astCtxt->bv(38, bvSize),
1572 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(24, 24, op), this->astCtxt->bvtrue()), this->astCtxt->bv(39, bvSize),
1573 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(23, 23, op), this->astCtxt->bvtrue()), this->astCtxt->bv(40, bvSize),
1574 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(22, 22, op), this->astCtxt->bvtrue()), this->astCtxt->bv(41, bvSize),
1575 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(21, 21, op), this->astCtxt->bvtrue()), this->astCtxt->bv(42, bvSize),
1576 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(20, 20, op), this->astCtxt->bvtrue()), this->astCtxt->bv(43, bvSize),
1577 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(19, 19, op), this->astCtxt->bvtrue()), this->astCtxt->bv(44, bvSize),
1578 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(18, 18, op), this->astCtxt->bvtrue()), this->astCtxt->bv(45, bvSize),
1579 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(17, 17, op), this->astCtxt->bvtrue()), this->astCtxt->bv(46, bvSize),
1580 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(16, 16, op), this->astCtxt->bvtrue()), this->astCtxt->bv(47, bvSize),
1581 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(15, 15, op), this->astCtxt->bvtrue()), this->astCtxt->bv(48, bvSize),
1582 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(14, 14, op), this->astCtxt->bvtrue()), this->astCtxt->bv(49, bvSize),
1583 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(13, 13, op), this->astCtxt->bvtrue()), this->astCtxt->bv(50, bvSize),
1584 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(12, 12, op), this->astCtxt->bvtrue()), this->astCtxt->bv(51, bvSize),
1585 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(11, 11, op), this->astCtxt->bvtrue()), this->astCtxt->bv(52, bvSize),
1586 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(10, 10, op), this->astCtxt->bvtrue()), this->astCtxt->bv(53, bvSize),
1587 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(9, 9, op), this->astCtxt->bvtrue()), this->astCtxt->bv(54, bvSize),
1588 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(8, 8, op), this->astCtxt->bvtrue()), this->astCtxt->bv(55, bvSize),
1589 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(7, 7, op), this->astCtxt->bvtrue()), this->astCtxt->bv(56, bvSize),
1590 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(6, 6, op), this->astCtxt->bvtrue()), this->astCtxt->bv(57, bvSize),
1591 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(5, 5, op), this->astCtxt->bvtrue()), this->astCtxt->bv(58, bvSize),
1592 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(4, 4, op), this->astCtxt->bvtrue()), this->astCtxt->bv(59, bvSize),
1593 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(3, 3, op), this->astCtxt->bvtrue()), this->astCtxt->bv(60, bvSize),
1594 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(2, 2, op), this->astCtxt->bvtrue()), this->astCtxt->bv(61, bvSize),
1595 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(1, 1, op), this->astCtxt->bvtrue()), this->astCtxt->bv(62, bvSize),
1596 this->astCtxt->ite(this->astCtxt->equal(this->astCtxt->extract(0, 0, op), this->astCtxt->bvtrue()), this->astCtxt->bv(63, bvSize),
1597 this->astCtxt->bv(64, bvSize)
1598 ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))));
1599 break;
1600
1601 default:
1602 throw triton::exceptions::Semantics("AArch64Semantics::clz_s(): Invalid operand size.");
1603 }
1604
1605 /* Create symbolic expression */
1606 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CLZ operation");
1607
1608 /* Spread taint */
1609 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
1610
1611 /* Update the symbolic control flow */
1612 this->controlFlow_s(inst);
1613 }
1614
1615
1616 void AArch64Semantics::cmn_s(triton::arch::Instruction& inst) {
1617 auto& src1 = inst.operands[0];
1618 auto& src2 = inst.operands[1];
1619
1620 /* Create symbolic operands */
1621 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1622 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1623
1624 /* Create the semantics */
1625 auto node = this->astCtxt->bvadd(op1, op2);
1626
1627 /* Create symbolic expression */
1628 auto expr = this->symbolicEngine->createSymbolicVolatileExpression(inst, node, "CMN operation");
1629
1630 /* Spread taint */
1631 expr->isTainted = this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2);
1632
1633 /* Update symbolic flags */
1634 this->cfAdd_s(inst, expr, src1, op1, op2);
1635 this->nf_s(inst, expr, src1);
1636 this->vfAdd_s(inst, expr, src1, op1, op2);
1637 this->zf_s(inst, expr, src1);
1638
1639 /* Update the symbolic control flow */
1640 this->controlFlow_s(inst);
1641 }
1642
1643
1644 void AArch64Semantics::cmp_s(triton::arch::Instruction& inst) {
1645 auto& src1 = inst.operands[0];
1646 auto& src2 = inst.operands[1];
1647
1648 /* Create symbolic operands */
1649 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1650 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1651
1652 /* Create the semantics */
1653 auto node = this->astCtxt->bvsub(op1, op2);
1654
1655 /* Create symbolic expression */
1656 auto expr = this->symbolicEngine->createSymbolicVolatileExpression(inst, node, "CMP operation");
1657
1658 /* Spread taint */
1659 expr->isTainted = this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2);
1660
1661 /* Update symbolic flags */
1662 this->cfSub_s(inst, expr, src1, op1, op2);
1663 this->nf_s(inst, expr, src1);
1664 this->vfSub_s(inst, expr, src1, op1, op2);
1665 this->zf_s(inst, expr, src1);
1666
1667 /* Update the symbolic control flow */
1668 this->controlFlow_s(inst);
1669 }
1670
1671
1672 void AArch64Semantics::cneg_s(triton::arch::Instruction& inst) {
1673 auto& dst = inst.operands[0];
1674 auto& src = inst.operands[1];
1675
1676 /* Create symbolic operands */
1677 auto op1 = this->astCtxt->bvneg(this->symbolicEngine->getOperandAst(inst, src));
1678 auto op2 = this->symbolicEngine->getOperandAst(inst, src);
1679
1680 /* Create the semantics */
1681 auto node = this->getCodeConditionAst(inst, op1, op2);
1682
1683 /* Create symbolic expression */
1684 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CNEG operation");
1685
1686 /* Spread taint */
1687 expr->isTainted = this->taintEngine->taintUnion(dst, src);
1688
1689 /* Update the symbolic control flow */
1690 this->controlFlow_s(inst);
1691 }
1692
1693
1694 void AArch64Semantics::csel_s(triton::arch::Instruction& inst) {
1695 auto& dst = inst.operands[0];
1696 auto& src1 = inst.operands[1];
1697 auto& src2 = inst.operands[2];
1698
1699 /* Create symbolic operands */
1700 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1701 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1702
1703 /* Create the semantics */
1704 auto node = this->getCodeConditionAst(inst, op1, op2);
1705
1706 /* Create symbolic expression */
1707 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSEL operation");
1708
1709 /* Spread taint */
1710 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1711
1712 /* Update the symbolic control flow */
1713 this->controlFlow_s(inst);
1714 }
1715
1716
1717 void AArch64Semantics::cset_s(triton::arch::Instruction& inst) {
1718 auto& dst = inst.operands[0];
1719
1720 /* Create symbolic operands */
1721 auto op1 = this->astCtxt->bv(1, dst.getBitSize());
1722 auto op2 = this->astCtxt->bv(0, dst.getBitSize());
1723
1724 /* Create the semantics */
1725 auto node = this->getCodeConditionAst(inst, op1, op2);
1726
1727 /* Create symbolic expression */
1728 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSET operation");
1729
1730 /* Spread taint */
1731 expr->isTainted = this->taintEngine->setTaint(dst, this->getCodeConditionTainteSate(inst));
1732
1733 /* Update the symbolic control flow */
1734 this->controlFlow_s(inst);
1735 }
1736
1737
1738 void AArch64Semantics::csetm_s(triton::arch::Instruction& inst) {
1739 auto& dst = inst.operands[0];
1740
1741 /* Create symbolic operands */
1742 triton::uint512 temp = 1;
1743 auto op1 = this->astCtxt->bv((temp << dst.getBitSize()) - 1, dst.getBitSize());
1744 auto op2 = this->astCtxt->bv(0, dst.getBitSize());
1745
1746 /* Create the semantics */
1747 auto node = this->getCodeConditionAst(inst, op1, op2);
1748
1749 /* Create symbolic expression */
1750 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSETM operation");
1751
1752 /* Spread taint */
1753 expr->isTainted = this->taintEngine->setTaint(dst, this->getCodeConditionTainteSate(inst));
1754
1755 /* Update the symbolic control flow */
1756 this->controlFlow_s(inst);
1757 }
1758
1759
1760 void AArch64Semantics::csinc_s(triton::arch::Instruction& inst) {
1761 auto& dst = inst.operands[0];
1762 auto& src1 = inst.operands[1];
1763 auto& src2 = inst.operands[2];
1764
1765 /* Create symbolic operands */
1766 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1767 auto op2 = this->astCtxt->bvadd(
1768 this->symbolicEngine->getOperandAst(inst, src2),
1769 this->astCtxt->bv(1, src2.getBitSize())
1770 );
1771
1772 /* Create the semantics */
1773 auto node = this->getCodeConditionAst(inst, op1, op2);
1774
1775 /* Create symbolic expression */
1776 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSINC operation");
1777
1778 /* Spread taint */
1779 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1780
1781 /* Update the symbolic control flow */
1782 this->controlFlow_s(inst);
1783 }
1784
1785
1786 void AArch64Semantics::csneg_s(triton::arch::Instruction& inst) {
1787 auto& dst = inst.operands[0];
1788 auto& src1 = inst.operands[1];
1789 auto& src2 = inst.operands[2];
1790
1791 /* Create symbolic operands */
1792 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1793 auto op2 = this->astCtxt->bvneg(this->symbolicEngine->getOperandAst(inst, src2));
1794
1795 /* Create the semantics */
1796 auto node = this->getCodeConditionAst(inst, op1, op2);
1797
1798 /* Create symbolic expression */
1799 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSNEG operation");
1800
1801 /* Spread taint */
1802 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1803
1804 /* Update the symbolic control flow */
1805 this->controlFlow_s(inst);
1806 }
1807
1808 void AArch64Semantics::csinv_s(triton::arch::Instruction& inst) {
1809 auto& dst = inst.operands[0];
1810 auto& src1 = inst.operands[1];
1811 auto& src2 = inst.operands[2];
1812
1813 /* Create symbolic operands */
1814 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1815 auto op2 = this->astCtxt->bvnot(this->symbolicEngine->getOperandAst(inst, src2));
1816
1817 /* Create the semantics */
1818 auto node = this->getCodeConditionAst(inst, op1, op2);
1819
1820 /* Create symbolic expression */
1821 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "CSINV operation");
1822
1823 /* Spread taint */
1824 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1825
1826 /* Update the symbolic control flow */
1827 this->controlFlow_s(inst);
1828 }
1829
1830
1831
1832 void AArch64Semantics::eon_s(triton::arch::Instruction& inst) {
1833 auto& dst = inst.operands[0];
1834 auto& src1 = inst.operands[1];
1835 auto& src2 = inst.operands[2];
1836
1837 /* Create symbolic operands */
1838 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1839 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1840
1841 /* Create the semantics */
1842 auto node = this->astCtxt->bvxnor(op1, op2);
1843
1844 /* Create symbolic expression */
1845 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "EON operation");
1846
1847 /* Spread taint */
1848 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1849
1850 /* Update the symbolic control flow */
1851 this->controlFlow_s(inst);
1852 }
1853
1854
1855 void AArch64Semantics::eor_s(triton::arch::Instruction& inst) {
1856 auto& dst = inst.operands[0];
1857 auto& src1 = inst.operands[1];
1858 auto& src2 = inst.operands[2];
1859
1860 /* Create symbolic operands */
1861 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1862 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1863
1864 /* Create the semantics */
1865 auto node = this->astCtxt->bvxor(op1, op2);
1866
1867 /* Special case for vector registers */
1869 node = this->astCtxt->extract(63, 0, node);
1870 }
1871
1872 /* Create symbolic expression */
1873 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "EOR operation");
1874
1875 /* Spread taint */
1876 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
1877
1878 /* Update the symbolic control flow */
1879 this->controlFlow_s(inst);
1880 }
1881
1882
1883 void AArch64Semantics::extr_s(triton::arch::Instruction& inst) {
1884 auto& dst = inst.operands[0];
1885 auto& src1 = inst.operands[1];
1886 auto& src2 = inst.operands[2];
1887 auto& src3 = inst.operands[3];
1888 auto lsb = static_cast<uint32>(src3.getImmediate().getValue());
1889
1890 /* Create symbolic operands */
1891 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
1892 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
1893
1894 /* Create the semantics */
1895 auto node = this->astCtxt->extract(lsb + dst.getBitSize() - 1, lsb, this->astCtxt->concat(op1, op2));
1896
1897 /* Create symbolic expression */
1898 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "EXTR operation");
1899
1900 /* Spread taint */
1901 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
1902
1903 /* Update the symbolic control flow */
1904 this->controlFlow_s(inst);
1905 }
1906
1907 void AArch64Semantics::fmov_s(triton::arch::Instruction& inst) {
1908 auto& dst = inst.operands[0];
1909 auto& src = inst.operands[1];
1910
1911 /* Create the semantics */
1912 auto node = this->symbolicEngine->getOperandAst(inst, src);
1913
1914 /* Create symbolic expression */
1915 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "FMOV operation");
1916
1917 /* Spread taint */
1918 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
1919
1920 /* Update the symbolic control flow */
1921 this->controlFlow_s(inst);
1922 }
1923
1924 void AArch64Semantics::ld3_s(triton::arch::Instruction& inst) {
1925 std::list<triton::ast::SharedAbstractNode> vec0;
1926 std::list<triton::ast::SharedAbstractNode> vec1;
1927 std::list<triton::ast::SharedAbstractNode> vec2;
1928
1929 triton::arch::OperandWrapper& vt0 = inst.operands[0]; /* vas register */
1930 triton::arch::OperandWrapper& vt1 = inst.operands[1]; /* vas register */
1931 triton::arch::OperandWrapper& vt2 = inst.operands[2]; /* vas register */
1932 triton::arch::OperandWrapper& src = inst.operands[3]; /* memory */
1933
1934 bool vt0_t = false; /* taint state of vt0 */
1935 bool vt1_t = false; /* taint state of vt1 */
1936 bool vt2_t = false; /* taint state of vt2 */
1937
1938 /*
1939 * Is the post-index immediate offset, encoded in Q:
1940 * 0 #24
1941 * 1 #48
1942 */
1943 triton::uint32 postIndex = 0;
1944
1945 auto mem = src.getConstMemory();
1946 auto vas_e = vt0.getConstRegister().getVASType();
1947
1948 switch (vas_e) {
1949 /* LD3 multiple structure */
1951 for (triton::uint32 i = 0; i != 16; i++) {
1952 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::byte);
1953 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 1, triton::size::byte);
1954 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 2, triton::size::byte);
1955
1956 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
1957 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
1958 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
1959
1960 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
1961 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
1962 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
1963 }
1964 postIndex = 48;
1965 break;
1966 }
1967
1968 /* LD3 multiple structure */
1970 for (triton::uint32 i = 0; i != 8; i++) {
1971 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::byte);
1972 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 1, triton::size::byte);
1973 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 2, triton::size::byte);
1974
1975 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
1976 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
1977 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
1978
1979 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
1980 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
1981 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
1982 }
1983 postIndex = 24;
1984 break;
1985 }
1986
1987 /* LD3 multiple structure */
1989 for (triton::uint32 i = 0; i != 16; i += 2) {
1990 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::word);
1991 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 2, triton::size::word);
1992 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 4, triton::size::word);
1993
1994 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
1995 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
1996 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
1997
1998 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
1999 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2000 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2001 }
2002 postIndex = 48;
2003 break;
2004 }
2005
2006 /* LD3 multiple structure */
2008 for (triton::uint32 i = 0; i != 8; i += 2) {
2009 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::word);
2010 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 2, triton::size::word);
2011 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 4, triton::size::word);
2012
2013 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2014 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2015 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2016
2017 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2018 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2019 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2020 }
2021 postIndex = 24;
2022 break;
2023 }
2024
2025 /* LD3 multiple structure */
2027 for (triton::uint32 i = 0; i != 16; i += 4) {
2028 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::dword);
2029 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 4, triton::size::dword);
2030 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 8, triton::size::dword);
2031
2032 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2033 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2034 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2035
2036 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2037 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2038 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2039 }
2040 postIndex = 48;
2041 break;
2042 }
2043
2044 /* LD3 multiple structure */
2046 for (triton::uint32 i = 0; i != 8; i += 4) {
2047 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::dword);
2048 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 4, triton::size::dword);
2049 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 8, triton::size::dword);
2050
2051 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2052 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2053 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2054
2055 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2056 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2057 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2058 }
2059 postIndex = 24;
2060 break;
2061 }
2062
2063 /* LD3 multiple structure */
2065 for (triton::uint32 i = 0; i != 16; i += 8) {
2066 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 0, triton::size::qword);
2067 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 8, triton::size::qword);
2068 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 3) + 16, triton::size::qword);
2069
2070 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2071 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2072 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2073
2074 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2075 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2076 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2077 }
2078 postIndex = 48;
2079 break;
2080 }
2081
2082 default:
2083 throw triton::exceptions::Semantics("AArch64Semantics::ld3_s(): Invalid VAS encoding.");
2084 }
2085
2086 /* Create the semantics of the LD3 */
2087 auto node0 = this->astCtxt->concat(vec0);
2088 auto node1 = this->astCtxt->concat(vec1);
2089 auto node2 = this->astCtxt->concat(vec2);
2090
2091 /* Create symbolic expression */
2092 auto expr0 = this->symbolicEngine->createSymbolicExpression(inst, node0, vt0, "LD3 operation - LOAD access");
2093 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, vt1, "LD3 operation - LOAD access");
2094 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, vt2, "LD3 operation - LOAD access");
2095
2096 /* Spread taint */
2097 expr0->isTainted = vt0_t;
2098 expr1->isTainted = vt1_t;
2099 expr2->isTainted = vt2_t;
2100
2101 /*
2102 * Register offset (Rm != 11111)
2103 * LD3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm>
2104 */
2105 if (inst.operands.size() == 5 && inst.operands[4].getType() == triton::arch::OP_REG) {
2106 auto base = mem.getBaseRegister();
2107 auto offset = inst.operands[4].getRegister();
2108
2109 /* Create symbolic operands of the post computation */
2110 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2111 auto offsetNode = this->symbolicEngine->getOperandAst(inst, offset);
2112
2113 /* Create the semantics of the base register */
2114 auto node3 = this->astCtxt->bvadd(baseNode, offsetNode);
2115
2116 /* Create symbolic expression */
2117 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LD3 operation - Post Index");
2118
2119 /* Spread taint */
2120 expr3->isTainted = this->taintEngine->isTainted(base) | this->taintEngine->isTainted(offset);
2121 }
2122
2123 /*
2124 * Register offset (Rm == 11111)
2125 * LD3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm>
2126 */
2127 else if (inst.operands.size() == 4 && inst.isWriteBack()) {
2128 /* Create symbolic operands of the post computation */
2129 auto base = mem.getBaseRegister();
2130 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2131
2132 /* Create the semantics of the base register */
2133 auto node3 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2134
2135 /* Create symbolic expression */
2136 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LD3 operation - Post Index");
2137
2138 /* Spread taint */
2139 expr3->isTainted = this->taintEngine->isTainted(base);
2140 }
2141
2142 /* Update the symbolic control flow */
2143 this->controlFlow_s(inst);
2144 }
2145
2146
2147 void AArch64Semantics::ld3r_s(triton::arch::Instruction& inst) {
2148 std::list<triton::ast::SharedAbstractNode> vec0;
2149 std::list<triton::ast::SharedAbstractNode> vec1;
2150 std::list<triton::ast::SharedAbstractNode> vec2;
2151
2152 triton::arch::OperandWrapper& vt0 = inst.operands[0]; /* vas register */
2153 triton::arch::OperandWrapper& vt1 = inst.operands[1]; /* vas register */
2154 triton::arch::OperandWrapper& vt2 = inst.operands[2]; /* vas register */
2155 triton::arch::OperandWrapper& src = inst.operands[3]; /* memory */
2156
2157 bool vt0_t = false; /* taint state of vt0 */
2158 bool vt1_t = false; /* taint state of vt1 */
2159 bool vt2_t = false; /* taint state of vt2 */
2160
2161 /*
2162 * Is the post-index immediate offset, encoded in size:
2163 * 00 #3
2164 * 01 #6
2165 * 10 #12
2166 * 11 #24
2167 */
2168 triton::uint32 postIndex = 0;
2169
2170 auto mem = src.getConstMemory();
2171 auto vas_e = vt0.getConstRegister().getVASType();
2172
2173 switch (vas_e) {
2175 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::byte);
2176 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 1, triton::size::byte);
2177 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::byte);
2178
2179 for (triton::uint32 i = 0; i != 16; i++) {
2180 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2181 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2182 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2183
2184 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2185 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2186 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2187 }
2188
2189 postIndex = 3;
2190 break;
2191 }
2192
2194 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::byte);
2195 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 1, triton::size::byte);
2196 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::byte);
2197
2198 for (triton::uint32 i = 0; i != 8; i++) {
2199 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2200 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2201 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2202
2203 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2204 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2205 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2206 }
2207
2208 postIndex = 3;
2209 break;
2210 }
2211
2213 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::word);
2214 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::word);
2215 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::word);
2216
2217 for (triton::uint32 i = 0; i != 16; i += 2) {
2218 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2219 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2220 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2221
2222 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2223 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2224 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2225 }
2226
2227 postIndex = 6;
2228 break;
2229 }
2230
2232 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::word);
2233 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::word);
2234 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::word);
2235
2236 for (triton::uint32 i = 0; i != 8; i += 2) {
2237 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2238 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2239 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2240
2241 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2242 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2243 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2244 }
2245
2246 postIndex = 6;
2247 break;
2248 }
2249
2251 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::dword);
2252 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::dword);
2253 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::dword);
2254
2255 for (triton::uint32 i = 0; i != 16; i += 4) {
2256 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2257 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2258 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2259
2260 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2261 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2262 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2263 }
2264
2265 postIndex = 12;
2266 break;
2267 }
2268
2270 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::dword);
2271 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::dword);
2272 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::dword);
2273
2274 for (triton::uint32 i = 0; i != 8; i += 4) {
2275 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2276 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2277 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2278
2279 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2280 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2281 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2282 }
2283
2284 postIndex = 12;
2285 break;
2286 }
2287
2289 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::qword);
2290 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::qword);
2291 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 16, triton::size::qword);
2292
2293 for (triton::uint32 i = 0; i != 16; i += 8) {
2294 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2295 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2296 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2297
2298 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2299 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2300 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2301 }
2302
2303 postIndex = 24;
2304 break;
2305 }
2306
2308 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::qword);
2309 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::qword);
2310 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 16, triton::size::qword);
2311
2312 for (triton::uint32 i = 0; i != 8; i += 8) {
2313 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2314 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2315 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2316
2317 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2318 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2319 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2320 }
2321
2322 postIndex = 24;
2323 break;
2324 }
2325
2326 default:
2327 throw triton::exceptions::Semantics("AArch64Semantics::ld3r_s(): Invalid VAS encoding.");
2328 }
2329
2330 /* Create the semantics of the LD3R */
2331 auto node0 = this->astCtxt->concat(vec0);
2332 auto node1 = this->astCtxt->concat(vec1);
2333 auto node2 = this->astCtxt->concat(vec2);
2334
2335 /* Create symbolic expression */
2336 auto expr0 = this->symbolicEngine->createSymbolicExpression(inst, node0, vt0, "LD3R operation - LOAD access");
2337 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, vt1, "LD3R operation - LOAD access");
2338 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, vt2, "LD3R operation - LOAD access");
2339
2340 /* Spread taint */
2341 expr0->isTainted = vt0_t;
2342 expr1->isTainted = vt1_t;
2343 expr2->isTainted = vt2_t;
2344
2345 /*
2346 * Register offset (Rm != 11111)
2347 * LD3R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm>
2348 */
2349 if (inst.operands.size() == 5 && inst.operands[4].getType() == triton::arch::OP_REG) {
2350 auto base = mem.getBaseRegister();
2351 auto offset = inst.operands[4].getRegister();
2352
2353 /* Create symbolic operands of the post computation */
2354 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2355 auto offsetNode = this->symbolicEngine->getOperandAst(inst, offset);
2356
2357 /* Create the semantics of the base register */
2358 auto node3 = this->astCtxt->bvadd(baseNode, offsetNode);
2359
2360 /* Create symbolic expression */
2361 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LD3R operation - Post Index");
2362
2363 /* Spread taint */
2364 expr3->isTainted = this->taintEngine->isTainted(base) | this->taintEngine->isTainted(offset);
2365 }
2366
2367 /*
2368 * Register offset (Rm == 11111)
2369 * LD3R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm>
2370 */
2371 else if (inst.operands.size() == 4 && inst.isWriteBack()) {
2372 /* Create symbolic operands of the post computation */
2373 auto base = mem.getBaseRegister();
2374 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2375
2376 /* Create the semantics of the base register */
2377 auto node3 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2378
2379 /* Create symbolic expression */
2380 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LD3R operation - Post Index");
2381
2382 /* Spread taint */
2383 expr3->isTainted = this->taintEngine->isTainted(base);
2384 }
2385
2386 /* Update the symbolic control flow */
2387 this->controlFlow_s(inst);
2388 }
2389
2390
2391 void AArch64Semantics::ld4_s(triton::arch::Instruction& inst) {
2392 std::list<triton::ast::SharedAbstractNode> vec0;
2393 std::list<triton::ast::SharedAbstractNode> vec1;
2394 std::list<triton::ast::SharedAbstractNode> vec2;
2395 std::list<triton::ast::SharedAbstractNode> vec3;
2396
2397 triton::arch::OperandWrapper& vt0 = inst.operands[0]; /* vas register */
2398 triton::arch::OperandWrapper& vt1 = inst.operands[1]; /* vas register */
2399 triton::arch::OperandWrapper& vt2 = inst.operands[2]; /* vas register */
2400 triton::arch::OperandWrapper& vt3 = inst.operands[3]; /* vas register */
2401 triton::arch::OperandWrapper& src = inst.operands[4]; /* memory */
2402
2403 bool vt0_t = false; /* taint state of vt0 */
2404 bool vt1_t = false; /* taint state of vt1 */
2405 bool vt2_t = false; /* taint state of vt2 */
2406 bool vt3_t = false; /* taint state of vt3 */
2407
2408 /*
2409 * Is the post-index immediate offset, encoded in Q:
2410 * 0 #32
2411 * 1 #64
2412 */
2413 triton::uint32 postIndex = 0;
2414
2415 auto mem = src.getConstMemory();
2416 auto vas_e = vt0.getConstRegister().getVASType();
2417
2418 switch (vas_e) {
2419 /* LD4 multiple structure */
2421 for (triton::uint32 i = 0; i != 16; i++) {
2422 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::byte);
2423 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 1, triton::size::byte);
2424 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 2, triton::size::byte);
2425 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 3, triton::size::byte);
2426
2427 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2428 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2429 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2430 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2431
2432 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2433 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2434 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2435 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2436 }
2437 postIndex = 64;
2438 break;
2439 }
2440
2441 /* LD4 multiple structure */
2443 for (triton::uint32 i = 0; i != 8; i++) {
2444 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::byte);
2445 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 1, triton::size::byte);
2446 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 2, triton::size::byte);
2447 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 3, triton::size::byte);
2448
2449 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2450 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2451 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2452 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2453
2454 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2455 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2456 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2457 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2458 }
2459 postIndex = 32;
2460 break;
2461 }
2462
2463 /* LD4 multiple structure */
2465 for (triton::uint32 i = 0; i != 16; i += 2) {
2466 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::word);
2467 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 2, triton::size::word);
2468 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 4, triton::size::word);
2469 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 6, triton::size::word);
2470
2471 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2472 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2473 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2474 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2475
2476 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2477 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2478 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2479 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2480 }
2481 postIndex = 64;
2482 break;
2483 }
2484
2485 /* LD4 multiple structure */
2487 for (triton::uint32 i = 0; i != 8; i += 2) {
2488 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::word);
2489 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 2, triton::size::word);
2490 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 4, triton::size::word);
2491 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 6, triton::size::word);
2492
2493 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2494 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2495 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2496 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2497
2498 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2499 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2500 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2501 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2502 }
2503 postIndex = 32;
2504 break;
2505 }
2506
2507 /* LD4 multiple structure */
2509 for (triton::uint32 i = 0; i != 16; i += 4) {
2510 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::dword);
2511 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 4, triton::size::dword);
2512 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 8, triton::size::dword);
2513 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 12, triton::size::dword);
2514
2515 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2516 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2517 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2518 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2519
2520 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2521 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2522 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2523 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2524 }
2525 postIndex = 64;
2526 break;
2527 }
2528
2529 /* LD4 multiple structure */
2531 for (triton::uint32 i = 0; i != 8; i += 4) {
2532 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::dword);
2533 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 4, triton::size::dword);
2534 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 8, triton::size::dword);
2535 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 12, triton::size::dword);
2536
2537 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2538 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2539 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2540 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2541
2542 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2543 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2544 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2545 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2546 }
2547 postIndex = 32;
2548 break;
2549 }
2550
2551 /* LD4 multiple structure */
2553 for (triton::uint32 i = 0; i != 16; i += 8) {
2554 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 0, triton::size::qword);
2555 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 8, triton::size::qword);
2556 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 16, triton::size::qword);
2557 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + (i * 4) + 24, triton::size::qword);
2558
2559 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2560 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2561 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2562 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2563
2564 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2565 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2566 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2567 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2568 }
2569 postIndex = 64;
2570 break;
2571 }
2572
2573 default:
2574 throw triton::exceptions::Semantics("AArch64Semantics::ld4_s(): Invalid VAS encoding.");
2575 }
2576
2577 /* Create the semantics of the LD3 */
2578 auto node0 = this->astCtxt->concat(vec0);
2579 auto node1 = this->astCtxt->concat(vec1);
2580 auto node2 = this->astCtxt->concat(vec2);
2581 auto node3 = this->astCtxt->concat(vec3);
2582
2583 /* Create symbolic expression */
2584 auto expr0 = this->symbolicEngine->createSymbolicExpression(inst, node0, vt0, "LD4 operation - LOAD access");
2585 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, vt1, "LD4 operation - LOAD access");
2586 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, vt2, "LD4 operation - LOAD access");
2587 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, vt3, "LD4 operation - LOAD access");
2588
2589 /* Spread taint */
2590 expr0->isTainted = vt0_t;
2591 expr1->isTainted = vt1_t;
2592 expr2->isTainted = vt2_t;
2593 expr3->isTainted = vt3_t;
2594
2595 /*
2596 * Register offset (Rm != 11111)
2597 * LD4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm>
2598 */
2599 if (inst.operands.size() == 6 && inst.operands[5].getType() == triton::arch::OP_REG) {
2600 auto base = mem.getBaseRegister();
2601 auto offset = inst.operands[5].getRegister();
2602
2603 /* Create symbolic operands of the post computation */
2604 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2605 auto offsetNode = this->symbolicEngine->getOperandAst(inst, offset);
2606
2607 /* Create the semantics of the base register */
2608 auto node4 = this->astCtxt->bvadd(baseNode, offsetNode);
2609
2610 /* Create symbolic expression */
2611 auto expr4 = this->symbolicEngine->createSymbolicExpression(inst, node4, base, "LD4 operation - Post Index");
2612
2613 /* Spread taint */
2614 expr4->isTainted = this->taintEngine->isTainted(base) | this->taintEngine->isTainted(offset);
2615 }
2616
2617 /*
2618 * Register offset (Rm == 11111)
2619 * LD4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm>
2620 */
2621 else if (inst.operands.size() == 5 && inst.isWriteBack()) {
2622 /* Create symbolic operands of the post computation */
2623 auto base = mem.getBaseRegister();
2624 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2625
2626 /* Create the semantics of the base register */
2627 auto node4 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2628
2629 /* Create symbolic expression */
2630 auto expr4 = this->symbolicEngine->createSymbolicExpression(inst, node4, base, "LD4 operation - Post Index");
2631
2632 /* Spread taint */
2633 expr4->isTainted = this->taintEngine->isTainted(base);
2634 }
2635
2636 /* Update the symbolic control flow */
2637 this->controlFlow_s(inst);
2638 }
2639
2640
2641 void AArch64Semantics::ld4r_s(triton::arch::Instruction& inst) {
2642 std::list<triton::ast::SharedAbstractNode> vec0;
2643 std::list<triton::ast::SharedAbstractNode> vec1;
2644 std::list<triton::ast::SharedAbstractNode> vec2;
2645 std::list<triton::ast::SharedAbstractNode> vec3;
2646
2647 triton::arch::OperandWrapper& vt0 = inst.operands[0]; /* vas register */
2648 triton::arch::OperandWrapper& vt1 = inst.operands[1]; /* vas register */
2649 triton::arch::OperandWrapper& vt2 = inst.operands[2]; /* vas register */
2650 triton::arch::OperandWrapper& vt3 = inst.operands[3]; /* vas register */
2651 triton::arch::OperandWrapper& src = inst.operands[4]; /* memory */
2652
2653 bool vt0_t = false; /* taint state of vt0 */
2654 bool vt1_t = false; /* taint state of vt1 */
2655 bool vt2_t = false; /* taint state of vt2 */
2656 bool vt3_t = false; /* taint state of vt3 */
2657
2658 /*
2659 * Is the post-index immediate offset, encoded in size:
2660 * 00 #4
2661 * 01 #8
2662 * 10 #16
2663 * 11 #32
2664 */
2665 triton::uint32 postIndex = 0;
2666
2667 auto mem = src.getConstMemory();
2668 auto vas_e = vt0.getConstRegister().getVASType();
2669
2670 switch (vas_e) {
2672 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::byte);
2673 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 1, triton::size::byte);
2674 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::byte);
2675 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 3, triton::size::byte);
2676
2677 for (triton::uint32 i = 0; i != 16; i++) {
2678 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2679 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2680 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2681 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2682
2683 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2684 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2685 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2686 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2687 }
2688
2689 postIndex = 4;
2690 break;
2691 }
2692
2694 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::byte);
2695 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 1, triton::size::byte);
2696 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::byte);
2697 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 3, triton::size::byte);
2698
2699 for (triton::uint32 i = 0; i != 8; i++) {
2700 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2701 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2702 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2703 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2704
2705 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2706 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2707 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2708 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2709 }
2710
2711 postIndex = 4;
2712 break;
2713 }
2714
2716 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::word);
2717 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::word);
2718 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::word);
2719 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 6, triton::size::word);
2720
2721 for (triton::uint32 i = 0; i != 16; i += 2) {
2722 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2723 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2724 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2725 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2726
2727 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2728 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2729 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2730 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2731 }
2732
2733 postIndex = 8;
2734 break;
2735 }
2736
2738 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::word);
2739 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 2, triton::size::word);
2740 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::word);
2741 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 6, triton::size::word);
2742
2743 for (triton::uint32 i = 0; i != 8; i += 2) {
2744 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2745 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2746 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2747 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2748
2749 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2750 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2751 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2752 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2753 }
2754
2755 postIndex = 8;
2756 break;
2757 }
2758
2760 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::dword);
2761 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::dword);
2762 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::dword);
2763 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 12, triton::size::dword);
2764
2765 for (triton::uint32 i = 0; i != 16; i += 4) {
2766 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2767 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2768 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2769 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2770
2771 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2772 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2773 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2774 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2775 }
2776
2777 postIndex = 16;
2778 break;
2779 }
2780
2782 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::dword);
2783 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 4, triton::size::dword);
2784 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::dword);
2785 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 12, triton::size::dword);
2786
2787 for (triton::uint32 i = 0; i != 8; i += 4) {
2788 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2789 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2790 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2791 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2792
2793 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2794 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2795 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2796 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2797 }
2798
2799 postIndex = 16;
2800 break;
2801 }
2802
2804 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::qword);
2805 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::qword);
2806 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 16, triton::size::qword);
2807 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 24, triton::size::qword);
2808
2809 for (triton::uint32 i = 0; i != 16; i += 8) {
2810 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2811 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2812 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2813 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2814
2815 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2816 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2817 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2818 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2819 }
2820
2821 postIndex = 32;
2822 break;
2823 }
2824
2826 auto vt0_m = triton::arch::MemoryAccess(mem.getAddress() + 0, triton::size::qword);
2827 auto vt1_m = triton::arch::MemoryAccess(mem.getAddress() + 8, triton::size::qword);
2828 auto vt2_m = triton::arch::MemoryAccess(mem.getAddress() + 16, triton::size::qword);
2829 auto vt3_m = triton::arch::MemoryAccess(mem.getAddress() + 24, triton::size::qword);
2830
2831 for (triton::uint32 i = 0; i != 8; i += 8) {
2832 vec0.push_front(this->symbolicEngine->getMemoryAst(inst, vt0_m));
2833 vec1.push_front(this->symbolicEngine->getMemoryAst(inst, vt1_m));
2834 vec2.push_front(this->symbolicEngine->getMemoryAst(inst, vt2_m));
2835 vec3.push_front(this->symbolicEngine->getMemoryAst(inst, vt3_m));
2836
2837 vt0_t |= this->taintEngine->isMemoryTainted(vt0_m);
2838 vt1_t |= this->taintEngine->isMemoryTainted(vt1_m);
2839 vt2_t |= this->taintEngine->isMemoryTainted(vt2_m);
2840 vt3_t |= this->taintEngine->isMemoryTainted(vt3_m);
2841 }
2842
2843 postIndex = 32;
2844 break;
2845 }
2846
2847 default:
2848 throw triton::exceptions::Semantics("AArch64Semantics::ld4r_s(): Invalid VAS encoding.");
2849 }
2850
2851 /* Create the semantics of the LD3R */
2852 auto node0 = this->astCtxt->concat(vec0);
2853 auto node1 = this->astCtxt->concat(vec1);
2854 auto node2 = this->astCtxt->concat(vec2);
2855 auto node3 = this->astCtxt->concat(vec3);
2856
2857 /* Create symbolic expression */
2858 auto expr0 = this->symbolicEngine->createSymbolicExpression(inst, node0, vt0, "LD4R operation - LOAD access");
2859 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, vt1, "LD4R operation - LOAD access");
2860 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, vt2, "LD4R operation - LOAD access");
2861 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, vt3, "LD4R operation - LOAD access");
2862
2863 /* Spread taint */
2864 expr0->isTainted = vt0_t;
2865 expr1->isTainted = vt1_t;
2866 expr2->isTainted = vt2_t;
2867 expr3->isTainted = vt3_t;
2868
2869 /*
2870 * Register offset (Rm != 11111)
2871 * LD4R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm>
2872 */
2873 if (inst.operands.size() == 6 && inst.operands[5].getType() == triton::arch::OP_REG) {
2874 auto base = mem.getBaseRegister();
2875 auto offset = inst.operands[5].getRegister();
2876
2877 /* Create symbolic operands of the post computation */
2878 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2879 auto offsetNode = this->symbolicEngine->getOperandAst(inst, offset);
2880
2881 /* Create the semantics of the base register */
2882 auto node4 = this->astCtxt->bvadd(baseNode, offsetNode);
2883
2884 /* Create symbolic expression */
2885 auto expr4 = this->symbolicEngine->createSymbolicExpression(inst, node4, base, "LD4R operation - Post Index");
2886
2887 /* Spread taint */
2888 expr4->isTainted = this->taintEngine->isTainted(base) | this->taintEngine->isTainted(offset);
2889 }
2890
2891 /*
2892 * Register offset (Rm == 11111)
2893 * LD4R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm>
2894 */
2895 else if (inst.operands.size() == 5 && inst.isWriteBack()) {
2896 /* Create symbolic operands of the post computation */
2897 auto base = mem.getBaseRegister();
2898 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
2899
2900 /* Create the semantics of the base register */
2901 auto node4 = this->astCtxt->bvadd(baseNode, this->astCtxt->bv(postIndex, base.getBitSize()));
2902
2903 /* Create symbolic expression */
2904 auto expr4 = this->symbolicEngine->createSymbolicExpression(inst, node4, base, "LD4R operation - Post Index");
2905
2906 /* Spread taint */
2907 expr4->isTainted = this->taintEngine->isTainted(base);
2908 }
2909
2910 /* Update the symbolic control flow */
2911 this->controlFlow_s(inst);
2912 }
2913
2914
2915 void AArch64Semantics::ldar_s(triton::arch::Instruction& inst) {
2918
2919 /* Create the semantics of the LOAD */
2920 auto node = this->symbolicEngine->getOperandAst(inst, src);
2921
2922 /* Create symbolic expression */
2923 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDAR operation - LOAD access");
2924
2925 /* Spread taint */
2926 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
2927
2928 /* Update the symbolic control flow */
2929 this->controlFlow_s(inst);
2930 }
2931
2932
2933 void AArch64Semantics::ldarb_s(triton::arch::Instruction& inst) {
2936
2937 /* Create the semantics of the LOAD */
2938 auto node = this->symbolicEngine->getOperandAst(inst, src);
2939
2940 /* Create symbolic expression */
2941 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDARB operation - LOAD access");
2942
2943 /* Spread taint */
2944 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
2945
2946 /* Update the symbolic control flow */
2947 this->controlFlow_s(inst);
2948 }
2949
2950
2951 void AArch64Semantics::ldarh_s(triton::arch::Instruction& inst) {
2954
2955 /* Create the semantics of the LOAD */
2956 auto node = this->symbolicEngine->getOperandAst(inst, src);
2957
2958 /* Create symbolic expression */
2959 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDARH operation - LOAD access");
2960
2961 /* Spread taint */
2962 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
2963
2964 /* Update the symbolic control flow */
2965 this->controlFlow_s(inst);
2966 }
2967
2968
2969 void AArch64Semantics::ldaxr_s(triton::arch::Instruction& inst) {
2972
2973 /* Create the semantics of the LOAD */
2974 auto node = this->symbolicEngine->getOperandAst(inst, src);
2975
2976 /* Create symbolic expression */
2977 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDAXR operation - LOAD access");
2978
2979 /* Spread taint */
2980 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
2981
2982 /* Update exclusive memory access tag */
2983 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
2984
2985 /* Update the symbolic control flow */
2986 this->controlFlow_s(inst);
2987 }
2988
2989
2990 void AArch64Semantics::ldaxrb_s(triton::arch::Instruction& inst) {
2993
2994 /* Create the semantics of the LOAD */
2995 auto node = this->symbolicEngine->getOperandAst(inst, src);
2996
2997 /* Create symbolic expression */
2998 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDAXRB operation - LOAD access");
2999
3000 /* Spread taint */
3001 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3002
3003 /* Update exclusive memory access tag */
3004 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3005
3006 /* Update the symbolic control flow */
3007 this->controlFlow_s(inst);
3008 }
3009
3010
3011 void AArch64Semantics::ldaxrh_s(triton::arch::Instruction& inst) {
3014
3015 /* Create the semantics of the LOAD */
3016 auto node = this->symbolicEngine->getOperandAst(inst, src);
3017
3018 /* Create symbolic expression */
3019 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDAXRH operation - LOAD access");
3020
3021 /* Spread taint */
3022 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3023
3024 /* Update exclusive memory access tag */
3025 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3026
3027 /* Update the symbolic control flow */
3028 this->controlFlow_s(inst);
3029 }
3030
3031
3032 void AArch64Semantics::ldnp_s(triton::arch::Instruction& inst) {
3033 triton::arch::OperandWrapper& dst1 = inst.operands[0];
3034 triton::arch::OperandWrapper& dst2 = inst.operands[1];
3036
3037 /* Special behavior: Define that the size of the memory access is dst1.size + dst2.size */
3038 src.getMemory().setBits((dst1.getBitSize() + dst2.getBitSize()) - 1, 0);
3039
3040 /* Create symbolic operands */
3041 auto op = this->symbolicEngine->getOperandAst(inst, src);
3042
3043 /* Create the semantics */
3044 auto node1 = this->astCtxt->extract((dst1.getBitSize() - 1), 0, op);
3045 auto node2 = this->astCtxt->extract((dst1.getBitSize() + dst2.getBitSize()) - 1, dst1.getBitSize(), op);
3046
3047 /* Create symbolic expression */
3048 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "LDNP operation - LOAD access");
3049 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "LDNP operation - LOAD access");
3050
3051 /* Spread taint */
3052 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
3053 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
3054
3055 /* Update the symbolic control flow */
3056 this->controlFlow_s(inst);
3057 }
3058
3059
3060 void AArch64Semantics::ldp_s(triton::arch::Instruction& inst) {
3061 triton::arch::OperandWrapper& dst1 = inst.operands[0];
3062 triton::arch::OperandWrapper& dst2 = inst.operands[1];
3064
3065 /* Special behavior: Define that the size of the memory access is dst1.size + dst2.size */
3066 src.getMemory().setBits((dst1.getBitSize() + dst2.getBitSize()) - 1, 0);
3067
3068 /* Create symbolic operands */
3069 auto op = this->symbolicEngine->getOperandAst(inst, src);
3070
3071 /* Create the semantics */
3072 auto node1 = this->astCtxt->extract((dst1.getBitSize() - 1), 0, op);
3073 auto node2 = this->astCtxt->extract((dst1.getBitSize() + dst2.getBitSize()) - 1, dst1.getBitSize(), op);
3074
3075 /* Create symbolic expression */
3076 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "LDP operation - LOAD access");
3077 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "LDP operation - LOAD access");
3078
3079 /* Spread taint */
3080 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
3081 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
3082
3083 /* Optional behavior. Post computation of the base register */
3084 /* LDP <Xt1>, <Xt2>, [<Xn|SP>], #<imm> */
3085 if (inst.operands.size() == 4) {
3086 triton::arch::Immediate& imm = inst.operands[3].getImmediate();
3088
3089 /* Create symbolic operands of the post computation */
3090 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3091 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3092
3093 /* Create the semantics of the base register */
3094 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3095
3096 /* Create symbolic expression */
3097 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDP operation - Base register computation");
3098
3099 /* Spread taint */
3100 expr2->isTainted = this->taintEngine->isTainted(base);
3101 }
3102
3103 /* LDP <Xt1>, <Xt2>, [<Xn|SP>, #<imm>]! */
3104 else if (inst.operands.size() == 3 && inst.isWriteBack() == true) {
3106
3107 /* Create the semantics of the base register */
3108 auto node3 = src.getMemory().getLeaAst();
3109
3110 /* Create symbolic expression */
3111 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDP operation - Base register computation");
3112
3113 /* Spread taint */
3114 expr3->isTainted = this->taintEngine->isTainted(base);
3115 }
3116
3117 /* Update the symbolic control flow */
3118 this->controlFlow_s(inst);
3119 }
3120
3121
3122 void AArch64Semantics::ldpsw_s(triton::arch::Instruction& inst) {
3123 triton::arch::OperandWrapper& dst1 = inst.operands[0];
3124 triton::arch::OperandWrapper& dst2 = inst.operands[1];
3126
3127 /* Create symbolic operands */
3128 auto op = this->symbolicEngine->getOperandAst(inst, src);
3129
3130 /* Create the semantics */
3131 auto node1 = this->astCtxt->sx(32, this->astCtxt->extract(31, 0, op));
3132 auto node2 = this->astCtxt->sx(32, this->astCtxt->extract(63, 32, op));
3133
3134 /* Create symbolic expression */
3135 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "LDPSW operation - LOAD access");
3136 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "LDPSW operation - LOAD access");
3137
3138 /* Spread taint */
3139 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
3140 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
3141
3142 /* Optional behavior. Post computation of the base register */
3143 /* LDPSW <Xt1>, <Xt2>, [<Xn|SP>], #<imm> */
3144 if (inst.operands.size() == 4) {
3145 triton::arch::Immediate& imm = inst.operands[3].getImmediate();
3147
3148 /* Create symbolic operands of the post computation */
3149 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3150 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3151
3152 /* Create the semantics of the base register */
3153 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3154
3155 /* Create symbolic expression */
3156 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDPSW operation - Base register computation");
3157
3158 /* Spread taint */
3159 expr2->isTainted = this->taintEngine->isTainted(base);
3160 }
3161
3162 /* LDPSW <Xt1>, <Xt2>, [<Xn|SP>, #<imm>]! */
3163 else if (inst.operands.size() == 3 && inst.isWriteBack() == true) {
3165
3166 /* Create the semantics of the base register */
3167 auto node3 = src.getMemory().getLeaAst();
3168
3169 /* Create symbolic expression */
3170 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDPSW operation - Base register computation");
3171
3172 /* Spread taint */
3173 expr3->isTainted = this->taintEngine->isTainted(base);
3174 }
3175
3176 /* Update the symbolic control flow */
3177 this->controlFlow_s(inst);
3178 }
3179
3180
3181 void AArch64Semantics::ldr_s(triton::arch::Instruction& inst) {
3184
3185 /* LDR (literal) */
3186 if (inst.operands.size() == 2 && src.getType() == triton::arch::OP_IMM) {
3188 }
3189
3190 /* Create the semantics of the LOAD */
3191 auto node1 = this->symbolicEngine->getOperandAst(inst, src);
3192
3193 /* Create symbolic expression */
3194 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDR operation - LOAD access");
3195
3196 /* Spread taint */
3197 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3198
3199 /* Optional behavior. Post computation of the base register */
3200 /* LDR <Xt>, [<Xn|SP>], #<simm> */
3201 if (inst.operands.size() == 3) {
3202 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3204
3205 /* Create symbolic operands of the post computation */
3206 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3207 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3208
3209 /* Create the semantics of the base register */
3210 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3211
3212 /* Create symbolic expression */
3213 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDR operation - Base register computation");
3214
3215 /* Spread taint */
3216 expr2->isTainted = this->taintEngine->isTainted(base);
3217 }
3218 /* LDR <Xt>, [<Xn|SP>, #<simm>]! */
3219 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3221
3222 /* Create the semantics of the base register */
3223 auto node3 = src.getMemory().getLeaAst();
3224
3225 /* Create symbolic expression */
3226 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDR operation - Base register computation");
3227
3228 /* Spread taint */
3229 expr3->isTainted = this->taintEngine->isTainted(base);
3230 }
3231
3232 /* Update the symbolic control flow */
3233 this->controlFlow_s(inst);
3234 }
3235
3236
3237 void AArch64Semantics::ldrb_s(triton::arch::Instruction& inst) {
3240
3241 /* Create the semantics of the LOAD */
3242 auto node1 = this->symbolicEngine->getOperandAst(inst, src);
3243
3244 /* Create symbolic expression */
3245 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDRB operation - LOAD access");
3246
3247 /* Spread taint */
3248 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3249
3250 /* Optional behavior. Post computation of the base register */
3251 /* LDRB <Xt>, [<Xn|SP>], #<simm> */
3252 if (inst.operands.size() == 3) {
3253 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3255
3256 /* Create symbolic operands of the post computation */
3257 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3258 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3259
3260 /* Create the semantics of the base register */
3261 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3262
3263 /* Create symbolic expression */
3264 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDRB operation - Base register computation");
3265
3266 /* Spread taint */
3267 expr2->isTainted = this->taintEngine->isTainted(base);
3268 }
3269
3270 /* LDRB <Xt>, [<Xn|SP>, #<simm>]! */
3271 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3273
3274 /* Create the semantics of the base register */
3275 auto node3 = src.getMemory().getLeaAst();
3276
3277 /* Create symbolic expression */
3278 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDRB operation - Base register computation");
3279
3280 /* Spread taint */
3281 expr3->isTainted = this->taintEngine->isTainted(base);
3282 }
3283
3284 /* Update the symbolic control flow */
3285 this->controlFlow_s(inst);
3286 }
3287
3288
3289 void AArch64Semantics::ldrh_s(triton::arch::Instruction& inst) {
3292
3293 /* Create the semantics of the LOAD */
3294 auto node1 = this->symbolicEngine->getOperandAst(inst, src);
3295
3296 /* Create symbolic expression */
3297 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDRH operation - LOAD access");
3298
3299 /* Spread taint */
3300 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3301
3302 /* Optional behavior. Post computation of the base register */
3303 /* LDRH <Xt>, [<Xn|SP>], #<simm> */
3304 if (inst.operands.size() == 3) {
3305 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3307
3308 /* Create symbolic operands of the post computation */
3309 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3310 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3311
3312 /* Create the semantics of the base register */
3313 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3314
3315 /* Create symbolic expression */
3316 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDRH operation - Base register computation");
3317
3318 /* Spread taint */
3319 expr2->isTainted = this->taintEngine->isTainted(base);
3320 }
3321
3322 /* LDRH <Xt>, [<Xn|SP>, #<simm>]! */
3323 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3325
3326 /* Create the semantics of the base register */
3327 auto node3 = src.getMemory().getLeaAst();
3328
3329 /* Create symbolic expression */
3330 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDRH operation - Base register computation");
3331
3332 /* Spread taint */
3333 expr3->isTainted = this->taintEngine->isTainted(base);
3334 }
3335
3336 /* Update the symbolic control flow */
3337 this->controlFlow_s(inst);
3338 }
3339
3340
3341 void AArch64Semantics::ldrsb_s(triton::arch::Instruction& inst) {
3344
3345 /* Create symbolic operands */
3346 auto op = this->symbolicEngine->getOperandAst(inst, src);
3347
3348 /* Create the semantics of the LOAD */
3349 auto node1 = this->astCtxt->sx(dst.getBitSize() - 8, this->astCtxt->extract(7, 0, op));
3350
3351 /* Create symbolic expression */
3352 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDRSB operation - LOAD access");
3353
3354 /* Spread taint */
3355 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3356
3357 /* Optional behavior. Post computation of the base register */
3358 /* LDRSB <Xt>, [<Xn|SP>], #<simm> */
3359 if (inst.operands.size() == 3) {
3360 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3362
3363 /* Create symbolic operands of the post computation */
3364 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3365 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3366
3367 /* Create the semantics of the base register */
3368 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3369
3370 /* Create symbolic expression */
3371 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDRSB operation - Base register computation");
3372
3373 /* Spread taint */
3374 expr2->isTainted = this->taintEngine->isTainted(base);
3375 }
3376
3377 /* LDRSB <Xt>, [<Xn|SP>, #<simm>]! */
3378 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3380
3381 /* Create the semantics of the base register */
3382 auto node3 = src.getMemory().getLeaAst();
3383
3384 /* Create symbolic expression */
3385 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDRSB operation - Base register computation");
3386
3387 /* Spread taint */
3388 expr3->isTainted = this->taintEngine->isTainted(base);
3389 }
3390
3391 /* Update the symbolic control flow */
3392 this->controlFlow_s(inst);
3393 }
3394
3395
3396 void AArch64Semantics::ldrsh_s(triton::arch::Instruction& inst) {
3399
3400 /* Create symbolic operands */
3401 auto op = this->symbolicEngine->getOperandAst(inst, src);
3402
3403 /* Create the semantics of the LOAD */
3404 auto node1 = this->astCtxt->sx(dst.getBitSize() - 16, this->astCtxt->extract(15, 0, op));
3405
3406 /* Create symbolic expression */
3407 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDRSH operation - LOAD access");
3408
3409 /* Spread taint */
3410 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3411
3412 /* Optional behavior. Post computation of the base register */
3413 /* LDRSH <Xt>, [<Xn|SP>], #<simm> */
3414 if (inst.operands.size() == 3) {
3415 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3417
3418 /* Create symbolic operands of the post computation */
3419 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3420 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3421
3422 /* Create the semantics of the base register */
3423 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3424
3425 /* Create symbolic expression */
3426 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDRSH operation - Base register computation");
3427
3428 /* Spread taint */
3429 expr2->isTainted = this->taintEngine->isTainted(base);
3430 }
3431
3432 /* LDRSH <Xt>, [<Xn|SP>, #<simm>]! */
3433 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3435
3436 /* Create the semantics of the base register */
3437 auto node3 = src.getMemory().getLeaAst();
3438
3439 /* Create symbolic expression */
3440 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDRSH operation - Base register computation");
3441
3442 /* Spread taint */
3443 expr3->isTainted = this->taintEngine->isTainted(base);
3444 }
3445
3446 /* Update the symbolic control flow */
3447 this->controlFlow_s(inst);
3448 }
3449
3450
3451 void AArch64Semantics::ldrsw_s(triton::arch::Instruction& inst) {
3454
3455 /* LDRSW (literal) */
3456 if (inst.operands.size() == 2 && src.getType() == triton::arch::OP_IMM) {
3458 }
3459
3460 /* Create symbolic operands */
3461 auto op = this->symbolicEngine->getOperandAst(inst, src);
3462
3463 /* Create the semantics of the LOAD */
3464 auto node1 = this->astCtxt->sx(dst.getBitSize() - 32, this->astCtxt->extract(31, 0, op));
3465
3466 /* Create symbolic expression */
3467 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "LDRSW operation - LOAD access");
3468
3469 /* Spread taint */
3470 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
3471
3472 /* Optional behavior. Post computation of the base register */
3473 /* LDRSW <Xt>, [<Xn|SP>], #<simm> */
3474 if (inst.operands.size() == 3) {
3475 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
3477
3478 /* Create symbolic operands of the post computation */
3479 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
3480 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
3481
3482 /* Create the semantics of the base register */
3483 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
3484
3485 /* Create symbolic expression */
3486 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "LDRSW operation - Base register computation");
3487
3488 /* Spread taint */
3489 expr2->isTainted = this->taintEngine->isTainted(base);
3490 }
3491
3492 /* LDRSW <Xt>, [<Xn|SP>, #<simm>]! */
3493 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
3495
3496 /* Create the semantics of the base register */
3497 auto node3 = src.getMemory().getLeaAst();
3498
3499 /* Create symbolic expression */
3500 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "LDRSW operation - Base register computation");
3501
3502 /* Spread taint */
3503 expr3->isTainted = this->taintEngine->isTainted(base);
3504 }
3505
3506 /* Update the symbolic control flow */
3507 this->controlFlow_s(inst);
3508 }
3509
3510
3511 void AArch64Semantics::ldtr_s(triton::arch::Instruction& inst) {
3514
3515 /* Create the semantics of the LOAD */
3516 auto node = this->symbolicEngine->getOperandAst(inst, src);
3517
3518 /* Create symbolic expression */
3519 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTR operation");
3520
3521 /* Spread taint */
3522 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3523
3524 /* Update the symbolic control flow */
3525 this->controlFlow_s(inst);
3526 }
3527
3528
3529 void AArch64Semantics::ldtrb_s(triton::arch::Instruction& inst) {
3532
3533 /* Create symbolic operands */
3534 auto op = this->symbolicEngine->getOperandAst(inst, src);
3535
3536 /* Create the semantics */
3537 auto node = this->astCtxt->zx(dst.getBitSize() - 8, op);
3538
3539 /* Create symbolic expression */
3540 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTRB operation");
3541
3542 /* Spread taint */
3543 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3544
3545 /* Update the symbolic control flow */
3546 this->controlFlow_s(inst);
3547 }
3548
3549
3550 void AArch64Semantics::ldtrh_s(triton::arch::Instruction& inst) {
3553
3554 /* Create symbolic operands */
3555 auto op = this->symbolicEngine->getOperandAst(inst, src);
3556
3557 /* Create the semantics */
3558 auto node = this->astCtxt->zx(dst.getBitSize() - 16, op);
3559
3560 /* Create symbolic expression */
3561 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTRH operation");
3562
3563 /* Spread taint */
3564 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3565
3566 /* Update the symbolic control flow */
3567 this->controlFlow_s(inst);
3568 }
3569
3570
3571 void AArch64Semantics::ldtrsb_s(triton::arch::Instruction& inst) {
3574
3575 /* Create symbolic operands */
3576 auto op = this->symbolicEngine->getOperandAst(inst, src);
3577
3578 /* Create the semantics */
3579 auto node = this->astCtxt->sx(dst.getBitSize() - 8, op);
3580
3581 /* Create symbolic expression */
3582 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTRSB operation");
3583
3584 /* Spread taint */
3585 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3586
3587 /* Update the symbolic control flow */
3588 this->controlFlow_s(inst);
3589 }
3590
3591
3592 void AArch64Semantics::ldtrsh_s(triton::arch::Instruction& inst) {
3595
3596 /* Create symbolic operands */
3597 auto op = this->symbolicEngine->getOperandAst(inst, src);
3598
3599 /* Create the semantics */
3600 auto node = this->astCtxt->sx(dst.getBitSize() - 16, op);
3601
3602 /* Create symbolic expression */
3603 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTRSH operation");
3604
3605 /* Spread taint */
3606 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3607
3608 /* Update the symbolic control flow */
3609 this->controlFlow_s(inst);
3610 }
3611
3612
3613 void AArch64Semantics::ldtrsw_s(triton::arch::Instruction& inst) {
3616
3617 /* Create symbolic operands */
3618 auto op = this->symbolicEngine->getOperandAst(inst, src);
3619
3620 /* Create the semantics */
3621 auto node = this->astCtxt->sx(dst.getBitSize() - 32, op);
3622
3623 /* Create symbolic expression */
3624 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDTRSW operation");
3625
3626 /* Spread taint */
3627 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3628
3629 /* Update the symbolic control flow */
3630 this->controlFlow_s(inst);
3631 }
3632
3633
3634 void AArch64Semantics::ldur_s(triton::arch::Instruction& inst) {
3637
3638 /* Create the semantics of the LOAD */
3639 auto node = this->symbolicEngine->getOperandAst(inst, src);
3640
3641 /* Create symbolic expression */
3642 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDUR operation");
3643
3644 /* Spread taint */
3645 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3646
3647 /* Update the symbolic control flow */
3648 this->controlFlow_s(inst);
3649 }
3650
3651
3652 void AArch64Semantics::ldurb_s(triton::arch::Instruction& inst) {
3655
3656 /* Create symbolic operands */
3657 auto op = this->symbolicEngine->getOperandAst(inst, src);
3658
3659 /* Create the semantics */
3660 auto node = this->astCtxt->zx(dst.getBitSize() - 8, op);
3661
3662 /* Create symbolic expression */
3663 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDURB operation");
3664
3665 /* Spread taint */
3666 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3667
3668 /* Update the symbolic control flow */
3669 this->controlFlow_s(inst);
3670 }
3671
3672
3673 void AArch64Semantics::ldurh_s(triton::arch::Instruction& inst) {
3676
3677 /* Create symbolic operands */
3678 auto op = this->symbolicEngine->getOperandAst(inst, src);
3679
3680 /* Create the semantics */
3681 auto node = this->astCtxt->zx(dst.getBitSize() - 16, op);
3682
3683 /* Create symbolic expression */
3684 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDURH operation");
3685
3686 /* Spread taint */
3687 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3688
3689 /* Update the symbolic control flow */
3690 this->controlFlow_s(inst);
3691 }
3692
3693
3694 void AArch64Semantics::ldursb_s(triton::arch::Instruction& inst) {
3697
3698 /* Create symbolic operands */
3699 auto op = this->symbolicEngine->getOperandAst(inst, src);
3700
3701 /* Create the semantics */
3702 auto node = this->astCtxt->sx(dst.getBitSize() - 8, op);
3703
3704 /* Create symbolic expression */
3705 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDURSB operation");
3706
3707 /* Spread taint */
3708 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3709
3710 /* Update the symbolic control flow */
3711 this->controlFlow_s(inst);
3712 }
3713
3714
3715 void AArch64Semantics::ldursh_s(triton::arch::Instruction& inst) {
3718
3719 /* Create symbolic operands */
3720 auto op = this->symbolicEngine->getOperandAst(inst, src);
3721
3722 /* Create the semantics */
3723 auto node = this->astCtxt->sx(dst.getBitSize() - 16, op);
3724
3725 /* Create symbolic expression */
3726 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDURSH operation");
3727
3728 /* Spread taint */
3729 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3730
3731 /* Update the symbolic control flow */
3732 this->controlFlow_s(inst);
3733 }
3734
3735
3736 void AArch64Semantics::ldursw_s(triton::arch::Instruction& inst) {
3739
3740 /* Create symbolic operands */
3741 auto op = this->symbolicEngine->getOperandAst(inst, src);
3742
3743 /* Create the semantics */
3744 auto node = this->astCtxt->sx(dst.getBitSize() - 32, op);
3745
3746 /* Create symbolic expression */
3747 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDURSW operation");
3748
3749 /* Spread taint */
3750 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3751
3752 /* Update the symbolic control flow */
3753 this->controlFlow_s(inst);
3754 }
3755
3756
3757 void AArch64Semantics::ldxp_s(triton::arch::Instruction& inst) {
3758 triton::arch::OperandWrapper& dst1 = inst.operands[0];
3759 triton::arch::OperandWrapper& dst2 = inst.operands[1];
3761
3762 /* Special behavior: Define that the size of the memory access is dst1.size + dst2.size */
3763 src.getMemory().setBits((dst1.getBitSize() + dst2.getBitSize()) - 1, 0);
3764
3765 /* Create symbolic operands */
3766 auto op = this->symbolicEngine->getOperandAst(inst, src);
3767
3768 /* Create the semantics */
3769 auto node1 = this->astCtxt->extract((dst1.getBitSize() - 1), 0, op);
3770 auto node2 = this->astCtxt->extract((dst1.getBitSize() + dst2.getBitSize()) - 1, dst1.getBitSize(), op);
3771
3772 /* Create symbolic expression */
3773 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "LDXP operation - LOAD access");
3774 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "LDXP operation - LOAD access");
3775
3776 /* Spread taint */
3777 expr1->isTainted = this->taintEngine->taintAssignment(dst1, src);
3778 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
3779
3780 /* Update exclusive memory access tag */
3781 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3782
3783 /* Update the symbolic control flow */
3784 this->controlFlow_s(inst);
3785 }
3786
3787
3788 void AArch64Semantics::ldxr_s(triton::arch::Instruction& inst) {
3791
3792 /* Create the semantics of the LOAD */
3793 auto node = this->symbolicEngine->getOperandAst(inst, src);
3794
3795 /* Create symbolic expression */
3796 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDXR operation");
3797
3798 /* Spread taint */
3799 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3800
3801 /* Update exclusive memory access tag */
3802 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3803
3804 /* Update the symbolic control flow */
3805 this->controlFlow_s(inst);
3806 }
3807
3808
3809 void AArch64Semantics::ldxrb_s(triton::arch::Instruction& inst) {
3812
3813 /* Create symbolic operands */
3814 auto op = this->symbolicEngine->getOperandAst(inst, src);
3815
3816 /* Create the semantics */
3817 auto node = this->astCtxt->zx(dst.getBitSize() - 8, op);
3818
3819 /* Create symbolic expression */
3820 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDXRB operation");
3821
3822 /* Spread taint */
3823 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3824
3825 /* Update exclusive memory access tag */
3826 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3827
3828 /* Update the symbolic control flow */
3829 this->controlFlow_s(inst);
3830 }
3831
3832
3833 void AArch64Semantics::ldxrh_s(triton::arch::Instruction& inst) {
3836
3837 /* Create symbolic operands */
3838 auto op = this->symbolicEngine->getOperandAst(inst, src);
3839
3840 /* Create the semantics */
3841 auto node = this->astCtxt->zx(dst.getBitSize() - 16, op);
3842
3843 /* Create symbolic expression */
3844 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LDXRH operation");
3845
3846 /* Spread taint */
3847 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3848
3849 /* Update exclusive memory access tag */
3850 this->architecture->setMemoryExclusiveTag(src.getConstMemory(), true);
3851
3852 /* Update the symbolic control flow */
3853 this->controlFlow_s(inst);
3854 }
3855
3856
3857 void AArch64Semantics::lsl_s(triton::arch::Instruction& inst) {
3858 auto& dst = inst.operands[0];
3859 auto& src1 = inst.operands[1];
3860 auto& src2 = inst.operands[2];
3861 auto size = src2.getBitSize();
3862
3863 /* Create symbolic operands */
3864 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
3865 auto op2 = this->astCtxt->bvand(
3866 this->symbolicEngine->getOperandAst(inst, src2),
3867 this->astCtxt->bv(size - 1, size)
3868 );
3869
3870 /* Create the semantics */
3871 auto node = this->astCtxt->bvshl(op1, op2);
3872
3873 /* Create symbolic expression */
3874 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LSL operation");
3875
3876 /* Spread taint */
3877 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
3878
3879 /* Update the symbolic control flow */
3880 this->controlFlow_s(inst);
3881 }
3882
3883
3884 void AArch64Semantics::lsr_s(triton::arch::Instruction& inst) {
3885 auto& dst = inst.operands[0];
3886 auto& src1 = inst.operands[1];
3887 auto& src2 = inst.operands[2];
3888 auto size = src2.getBitSize();
3889
3890 /* Create symbolic operands */
3891 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
3892 auto op2 = this->astCtxt->bvand(
3893 this->symbolicEngine->getOperandAst(inst, src2),
3894 this->astCtxt->bv(size - 1, size)
3895 );
3896
3897 /* Create the semantics */
3898 auto node = this->astCtxt->bvlshr(op1, op2);
3899
3900 /* Create symbolic expression */
3901 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "LSR operation");
3902
3903 /* Spread taint */
3904 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
3905
3906 /* Update the symbolic control flow */
3907 this->controlFlow_s(inst);
3908 }
3909
3910
3911 void AArch64Semantics::madd_s(triton::arch::Instruction& inst) {
3912 auto& dst = inst.operands[0];
3913 auto& src1 = inst.operands[1];
3914 auto& src2 = inst.operands[2];
3915 auto& src3 = inst.operands[3];
3916
3917 /* Create symbolic operands */
3918 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
3919 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
3920 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
3921
3922 /* Create the semantics */
3923 auto node = this->astCtxt->bvadd(op3, this->astCtxt->bvmul(op1, op2));
3924
3925 /* Create symbolic expression */
3926 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MADD operation");
3927
3928 /* Spread taint */
3929 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
3930
3931 /* Update the symbolic control flow */
3932 this->controlFlow_s(inst);
3933 }
3934
3935
3936 void AArch64Semantics::mneg_s(triton::arch::Instruction& inst) {
3937 auto& dst = inst.operands[0];
3938 auto& src1 = inst.operands[1];
3939 auto& src2 = inst.operands[2];
3940
3941 /* Create symbolic operands */
3942 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
3943 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
3944
3945 /* Create the semantics */
3946 auto node = this->astCtxt->bvneg(this->astCtxt->bvmul(op1, op2));
3947
3948 /* Create symbolic expression */
3949 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MNEG operation");
3950
3951 /* Spread taint */
3952 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
3953
3954 /* Update the symbolic control flow */
3955 this->controlFlow_s(inst);
3956 }
3957
3958
3959 void AArch64Semantics::mov_s(triton::arch::Instruction& inst) {
3960 auto& dst = inst.operands[0];
3961 auto& src = inst.operands[1];
3962
3963 /* Create the semantics */
3964 auto node = this->symbolicEngine->getOperandAst(inst, src);
3965
3966 /* Create symbolic expression */
3967 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MOV operation");
3968
3969 /* Spread taint */
3970 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
3971
3972 /* Update the symbolic control flow */
3973 this->controlFlow_s(inst);
3974 }
3975
3976
3977 void AArch64Semantics::movi_s(triton::arch::Instruction& inst) {
3978 std::list<triton::ast::SharedAbstractNode> vec;
3979
3980 triton::arch::OperandWrapper& dst = inst.operands[0]; /* vas register */
3981 triton::arch::OperandWrapper& src = inst.operands[1]; /* imm */
3982
3983 /* Create symbolic operands */
3984 auto imm = this->symbolicEngine->getOperandAst(inst, src);
3985 auto vas_e = dst.getConstRegister().getVASType();
3986
3987 switch (vas_e) {
3989 for (triton::uint32 i = 0; i != 16; i++) {
3990 vec.push_front(this->astCtxt->extract(7, 0, imm));
3991 }
3992 break;
3993 }
3994
3996 for (triton::uint32 i = 0; i != 8; i++) {
3997 vec.push_front(this->astCtxt->extract(7, 0, imm));
3998 }
3999 break;
4000 }
4001
4003 for (triton::uint32 i = 0; i != 16; i += 2) {
4004 vec.push_front(this->astCtxt->extract(15, 0, imm));
4005 }
4006 break;
4007 }
4008
4010 for (triton::uint32 i = 0; i != 8; i += 2) {
4011 vec.push_front(this->astCtxt->extract(15, 0, imm));
4012 }
4013 break;
4014 }
4015
4017 for (triton::uint32 i = 0; i != 16; i += 4) {
4018 vec.push_front(this->astCtxt->extract(31, 0, imm));
4019 }
4020 break;
4021 }
4022
4024 for (triton::uint32 i = 0; i != 8; i += 4) {
4025 vec.push_front(this->astCtxt->extract(31, 0, imm));
4026 }
4027 break;
4028 }
4029
4031 for (triton::uint32 i = 0; i != 16; i += 8) {
4032 vec.push_front(this->astCtxt->extract(63, 0, imm));
4033 }
4034 break;
4035 }
4036
4038 for (triton::uint32 i = 0; i != 8; i += 8) {
4039 vec.push_front(this->astCtxt->extract(63, 0, imm));
4040 }
4041 break;
4042 }
4043
4044 default:
4045 throw triton::exceptions::Semantics("AArch64Semantics::movi_s(): Invalid VAS encoding.");
4046 }
4047
4048 /* Create the semantics */
4049 auto node = this->astCtxt->concat(vec);
4050
4051 /* Create symbolic expression */
4052 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MOVI operation");
4053
4054 /* Spread taint */
4055 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4056
4057 /* Update the symbolic control flow */
4058 this->controlFlow_s(inst);
4059 }
4060
4061
4062 void AArch64Semantics::movk_s(triton::arch::Instruction& inst) {
4063 auto& dst = inst.operands[0];
4064 auto& src = inst.operands[1];
4065 auto pos = src.getImmediate().getShiftImmediate(); // 0 by default.
4066
4067 /* Create symbolic operands */
4068 auto op1 = this->symbolicEngine->getOperandAst(inst, dst);
4069 auto op2 = this->symbolicEngine->getOperandAst(inst, src);
4070
4071 /* Create the semantics */
4072 std::vector<triton::ast::SharedAbstractNode> bits;
4073 bits.reserve(10);
4074
4075 switch (pos) {
4076 case 0:
4077 // [------------------------------------------------xxxxxxxxxxxxxxxx]
4078 bits.push_back(this->astCtxt->extract(dst.getHigh(), 16, op1));
4079 bits.push_back(this->astCtxt->extract(15, 0, op2));
4080 break;
4081
4082 case 16:
4083 // [--------------------------------xxxxxxxxxxxxxxxx----------------]
4084 if (dst.getBitSize() == 64) {
4085 /*
4086 * The case where the instruction is: MOVK <Xd>, #<imm>{, LSL #<shift>}.
4087 * Otherwise if the instruction is: MOVK <Wd>, #<imm>{, LSL #<shift>}, just
4088 * skip this extract.
4089 */
4090 bits.push_back(this->astCtxt->extract(dst.getHigh(), 32, op1));
4091 }
4092 bits.push_back(this->astCtxt->extract(31, 16, op2));
4093 bits.push_back(this->astCtxt->extract(15, 0, op1));
4094 break;
4095
4096 case 32:
4097 // [----------------xxxxxxxxxxxxxxxx--------------------------------]
4098 bits.push_back(this->astCtxt->extract(dst.getHigh(), 48, op1));
4099 bits.push_back(this->astCtxt->extract(47, 32, op2));
4100 bits.push_back(this->astCtxt->extract(31, 0, op1));
4101 break;
4102
4103 case 48:
4104 // [xxxxxxxxxxxxxxxx------------------------------------------------]
4105 bits.push_back(this->astCtxt->extract(63, 48, op2));
4106 bits.push_back(this->astCtxt->extract(47, 0, op1));
4107 break;
4108
4109 default:
4110 throw triton::exceptions::Semantics("AArch64Semantics::movk_s(): Invalid pos (hw field) encoding.");
4111 }
4112
4113 auto node = this->astCtxt->concat(bits);
4114
4115 /* Create symbolic expression */
4116 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MOVK operation");
4117
4118 /* Spread taint */
4119 expr->isTainted = this->taintEngine->taintUnion(dst, src);
4120
4121 /* Update the symbolic control flow */
4122 this->controlFlow_s(inst);
4123 }
4124
4125
4126 void AArch64Semantics::movn_s(triton::arch::Instruction& inst) {
4127 auto& dst = inst.operands[0];
4128 auto& src = inst.operands[1];
4129
4130 /* Create symbolic operands */
4131 auto op = this->symbolicEngine->getOperandAst(inst, src);
4132
4133 /* Create the semantics */
4134 auto node = this->astCtxt->bvnot(op);
4135
4136 /* Create symbolic expression */
4137 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MOVN operation");
4138
4139 /* Spread taint */
4140 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4141
4142 /* Update the symbolic control flow */
4143 this->controlFlow_s(inst);
4144 }
4145
4146
4147 void AArch64Semantics::movz_s(triton::arch::Instruction& inst) {
4148 auto& dst = inst.operands[0];
4149 auto& src = inst.operands[1];
4150
4151 /* Create the semantics */
4152 auto node = this->symbolicEngine->getOperandAst(inst, src);
4153
4154 /* Create symbolic expression */
4155 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MOVZ operation");
4156
4157 /* Spread taint */
4158 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4159
4160 /* Update the symbolic control flow */
4161 this->controlFlow_s(inst);
4162 }
4163
4164
4165 void AArch64Semantics::mrs_s(triton::arch::Instruction& inst) {
4166 auto& dst = inst.operands[0];
4167 auto& src = inst.operands[1];
4168
4169 /* Create the semantics */
4170 auto node = this->symbolicEngine->getOperandAst(inst, src);
4171
4172 /* Create symbolic expression */
4173 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MRS operation");
4174
4175 /* Spread taint */
4176 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4177
4178 /* Update the symbolic control flow */
4179 this->controlFlow_s(inst);
4180 }
4181
4182
4183 void AArch64Semantics::msr_s(triton::arch::Instruction& inst) {
4184 auto& dst = inst.operands[0];
4185 auto& src = inst.operands[1];
4186
4187 /* Create the semantics */
4188 auto node = this->symbolicEngine->getOperandAst(inst, src);
4189
4190 /* Create symbolic expression */
4191 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MSR operation");
4192
4193 /* Spread taint */
4194 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4195
4196 /* Update the symbolic control flow */
4197 this->controlFlow_s(inst);
4198 }
4199
4200
4201 void AArch64Semantics::msub_s(triton::arch::Instruction& inst) {
4202 auto& dst = inst.operands[0];
4203 auto& src1 = inst.operands[1];
4204 auto& src2 = inst.operands[2];
4205 auto& src3 = inst.operands[3];
4206
4207 /* Create symbolic operands */
4208 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4209 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4210 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
4211
4212 /* Create the semantics */
4213 auto node = this->astCtxt->bvsub(op3, this->astCtxt->bvmul(op1, op2));
4214
4215 /* Create symbolic expression */
4216 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MSUB operation");
4217
4218 /* Spread taint */
4219 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4220
4221 /* Update the symbolic control flow */
4222 this->controlFlow_s(inst);
4223 }
4224
4225
4226 void AArch64Semantics::mul_s(triton::arch::Instruction& inst) {
4227 auto& dst = inst.operands[0];
4228 auto& src1 = inst.operands[1];
4229 auto& src2 = inst.operands[2];
4230
4231 /* Create symbolic operands */
4232 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4233 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4234
4235 /* Create the semantics */
4236 auto node = this->astCtxt->bvmul(op1, op2);
4237
4238 /* Create symbolic expression */
4239 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MUL operation");
4240
4241 /* Spread taint */
4242 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4243
4244 /* Update the symbolic control flow */
4245 this->controlFlow_s(inst);
4246 }
4247
4248
4249 void AArch64Semantics::mvn_s(triton::arch::Instruction& inst) {
4250 auto& dst = inst.operands[0];
4251 auto& src = inst.operands[1];
4252
4253 /* Create symbolic operands */
4254 auto op = this->symbolicEngine->getOperandAst(inst, src);
4255
4256 /* Create the semantics */
4257 auto node = this->astCtxt->bvnot(op);
4258
4259 /* Create symbolic expression */
4260 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MVN operation");
4261
4262 /* Spread taint */
4263 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4264
4265 /* Update the symbolic control flow */
4266 this->controlFlow_s(inst);
4267 }
4268
4269
4270 void AArch64Semantics::neg_s(triton::arch::Instruction& inst) {
4271 auto& dst = inst.operands[0];
4272 auto& src = inst.operands[1];
4273
4274 /* Create symbolic operands */
4275 auto op = this->symbolicEngine->getOperandAst(inst, src);
4276
4277 /* Create the semantics */
4278 auto node = this->astCtxt->bvneg(op);
4279
4280 /* Create symbolic expression */
4281 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "MEG operation");
4282
4283 /* Spread taint */
4284 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4285
4286 /* Update the symbolic control flow */
4287 this->controlFlow_s(inst);
4288 }
4289
4290
4291 void AArch64Semantics::nop_s(triton::arch::Instruction& inst) {
4292 /* Update the symbolic control flow */
4293 this->controlFlow_s(inst);
4294 }
4295
4296
4297 void AArch64Semantics::orn_s(triton::arch::Instruction& inst) {
4298 auto& dst = inst.operands[0];
4299 auto& src1 = inst.operands[1];
4300 auto& src2 = inst.operands[2];
4301
4302 /* Create symbolic operands */
4303 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4304 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4305
4306 /* Create the semantics */
4307 auto node = this->astCtxt->bvor(op1, this->astCtxt->bvnot(op2));
4308
4309 /* Create symbolic expression */
4310 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ORN operation");
4311
4312 /* Spread taint */
4313 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4314
4315 /* Update the symbolic control flow */
4316 this->controlFlow_s(inst);
4317 }
4318
4319
4320 void AArch64Semantics::orr_s(triton::arch::Instruction& inst) {
4321 auto& dst = inst.operands[0];
4322 auto& src1 = inst.operands[1];
4323 auto& src2 = inst.operands[2];
4324
4325 /* Create symbolic operands */
4326 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4327 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4328
4329 /* Create the semantics */
4330 auto node = this->astCtxt->bvor(op1, op2);
4331
4332 /* Special case for vector registers */
4334 node = this->astCtxt->extract(63, 0, node);
4335 }
4336
4337 /* Create symbolic expression */
4338 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ORR operation");
4339
4340 /* Spread taint */
4341 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4342
4343 /* Update the symbolic control flow */
4344 this->controlFlow_s(inst);
4345 }
4346
4347
4348 void AArch64Semantics::rbit_s(triton::arch::Instruction& inst) {
4349 auto& dst = inst.operands[0];
4350 auto& src = inst.operands[1];
4351
4352 /* Create symbolic operands */
4353 auto op = this->symbolicEngine->getOperandAst(inst, src);
4354
4355 /* Create the semantics */
4356 std::vector<triton::ast::SharedAbstractNode> bits;
4357 bits.reserve(src.getBitSize());
4358
4359 for (triton::uint32 index = 0; index < src.getBitSize(); index++) {
4360 bits.push_back(this->astCtxt->extract(index, index, op));
4361 }
4362
4363 auto node = this->astCtxt->concat(bits);
4364
4365 /* Create symbolic expression */
4366 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "RBIT operation");
4367
4368 /* Spread taint */
4369 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4370
4371 /* Update the symbolic control flow */
4372 this->controlFlow_s(inst);
4373 }
4374
4375
4376 void AArch64Semantics::ret_s(triton::arch::Instruction& inst) {
4377 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
4378 auto src = ((inst.operands.size() == 1) ? inst.operands[0] : triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_X30)));
4379
4380 /* Create the semantics */
4381 auto node = this->symbolicEngine->getOperandAst(inst, src);
4382
4383 /* Create symbolic expression */
4384 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "RET operation - Program Counter");
4385
4386 /* Spread taint */
4387 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4388 }
4389
4390
4391 void AArch64Semantics::rev_s(triton::arch::Instruction& inst) {
4392 auto& dst = inst.operands[0];
4393 auto& src = inst.operands[1];
4394
4395 /* Create symbolic operands */
4396 auto op = this->symbolicEngine->getOperandAst(inst, src);
4397
4398 /* Create the semantics */
4399 std::list<triton::ast::SharedAbstractNode> bits;
4400
4401 switch(src.getSize()) {
4403 bits.push_front(this->astCtxt->extract(63, 56, op));
4404 bits.push_front(this->astCtxt->extract(55, 48, op));
4405 bits.push_front(this->astCtxt->extract(47, 40, op));
4406 bits.push_front(this->astCtxt->extract(39, 32, op));
4408 bits.push_front(this->astCtxt->extract(31, 24, op));
4409 bits.push_front(this->astCtxt->extract(23, 16, op));
4410 bits.push_front(this->astCtxt->extract(15, 8, op));
4411 bits.push_front(this->astCtxt->extract(7, 0, op));
4412 break;
4413
4414 default:
4415 throw triton::exceptions::Semantics("AArch64Semantics::rev_s(): Invalid operand size.");
4416 }
4417
4418 auto node = this->astCtxt->concat(bits);
4419
4420 /* Create symbolic expression */
4421 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "REV operation");
4422
4423 /* Spread taint */
4424 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4425
4426 /* Update the symbolic control flow */
4427 this->controlFlow_s(inst);
4428 }
4429
4430
4431 void AArch64Semantics::rev16_s(triton::arch::Instruction& inst) {
4432 auto& dst = inst.operands[0];
4433 auto& src = inst.operands[1];
4434
4435 /* Create symbolic operands */
4436 auto op = this->symbolicEngine->getOperandAst(inst, src);
4437
4438 /* Create the semantics */
4439 std::vector<triton::ast::SharedAbstractNode> bits;
4440 bits.reserve(8);
4441
4442 switch(src.getSize()) {
4444 bits.push_back(this->astCtxt->extract(55, 48, op));
4445 bits.push_back(this->astCtxt->extract(63, 56, op));
4446 bits.push_back(this->astCtxt->extract(39, 32, op));
4447 bits.push_back(this->astCtxt->extract(47, 40, op));
4449 bits.push_back(this->astCtxt->extract(23, 16, op));
4450 bits.push_back(this->astCtxt->extract(31, 24, op));
4451 bits.push_back(this->astCtxt->extract(7, 0, op));
4452 bits.push_back(this->astCtxt->extract(15, 8, op));
4453 break;
4454
4455 default:
4456 throw triton::exceptions::Semantics("AArch64Semantics::rev16_s(): Invalid operand size.");
4457 }
4458
4459 auto node = this->astCtxt->concat(bits);
4460
4461 /* Create symbolic expression */
4462 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "REV16 operation");
4463
4464 /* Spread taint */
4465 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4466
4467 /* Update the symbolic control flow */
4468 this->controlFlow_s(inst);
4469 }
4470
4471
4472 void AArch64Semantics::rev32_s(triton::arch::Instruction& inst) {
4473 auto& dst = inst.operands[0];
4474 auto& src = inst.operands[1];
4475
4476 /* Create symbolic operands */
4477 auto op = this->symbolicEngine->getOperandAst(inst, src);
4478
4479 /* Create the semantics */
4480 std::vector<triton::ast::SharedAbstractNode> bits;
4481 bits.reserve(8);
4482
4483 bits.push_back(this->astCtxt->extract(39, 32, op));
4484 bits.push_back(this->astCtxt->extract(47, 40, op));
4485 bits.push_back(this->astCtxt->extract(55, 48, op));
4486 bits.push_back(this->astCtxt->extract(63, 56, op));
4487 bits.push_back(this->astCtxt->extract(7, 0, op));
4488 bits.push_back(this->astCtxt->extract(15, 8, op));
4489 bits.push_back(this->astCtxt->extract(23, 16, op));
4490 bits.push_back(this->astCtxt->extract(31, 24, op));
4491
4492 auto node = this->astCtxt->concat(bits);
4493
4494 /* Create symbolic expression */
4495 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "REV32 operation");
4496
4497 /* Spread taint */
4498 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4499
4500 /* Update the symbolic control flow */
4501 this->controlFlow_s(inst);
4502 }
4503
4504
4505 void AArch64Semantics::ror_s(triton::arch::Instruction& inst) {
4506 auto& dst = inst.operands[0];
4507 auto& src1 = inst.operands[1];
4508 auto& src2 = inst.operands[2];
4509
4510 /* Create symbolic operands */
4511 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4512 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4513
4514 /* Create the semantics */
4515 auto node = this->astCtxt->bvror(op1, op2);
4516
4517 /* Create symbolic expression */
4518 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "ROR operation");
4519
4520 /* Spread taint */
4521 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4522
4523 /* Update the symbolic control flow */
4524 this->controlFlow_s(inst);
4525 }
4526
4527
4528 void AArch64Semantics::sbc_s(triton::arch::Instruction& inst) {
4529 auto& dst = inst.operands[0];
4530 auto& src1 = inst.operands[1];
4531 auto& src2 = inst.operands[2];
4532 auto cf = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_C));
4533
4534 /* Create symbolic operands */
4535 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4536 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4537 auto op3 = this->symbolicEngine->getOperandAst(inst, cf);
4538
4539 /* Create the semantics */
4540 auto node = this->astCtxt->bvadd(this->astCtxt->bvadd(op1, this->astCtxt->bvnot(op2)), this->astCtxt->zx(dst.getBitSize()-1, op3));
4541
4542 /* Create symbolic expression */
4543 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SBC(S) operation");
4544
4545 /* Spread taint */
4546 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(cf));
4547
4548 /* Update symbolic flags */
4549 if (inst.isUpdateFlag() == true) {
4550 this->cfSub_s(inst, expr, src1, op1, op2);
4551 this->nf_s(inst, expr, src1);
4552 this->vfSub_s(inst, expr, src1, op1, op2);
4553 this->zf_s(inst, expr, src1);
4554 }
4555
4556 /* Update the symbolic control flow */
4557 this->controlFlow_s(inst);
4558 }
4559
4560
4561 void AArch64Semantics::sbfx_s(triton::arch::Instruction& inst) {
4562 auto& dst = inst.operands[0];
4563 auto& src1 = inst.operands[1];
4564 auto& src2 = inst.operands[2];
4565 auto& src3 = inst.operands[3];
4566 auto lsb = static_cast<uint32>(src2.getImmediate().getValue());
4567 auto width = static_cast<uint32>(src3.getImmediate().getValue());
4568
4569 if (lsb + width > dst.getBitSize())
4570 throw triton::exceptions::Semantics("AArch64Semantics::sbfx_s(): Invalid lsb and width.");
4571
4572 /* Create symbolic operands */
4573 auto op = this->symbolicEngine->getOperandAst(inst, src1);
4574
4575 /* Create the semantics */
4576 auto node = this->astCtxt->sx(dst.getBitSize() - width, this->astCtxt->extract(lsb+width-1, lsb, op));
4577
4578 /* Create symbolic expression */
4579 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SBFX operation");
4580
4581 /* Spread taint */
4582 expr->isTainted = this->taintEngine->taintAssignment(dst, src1);
4583
4584 /* Update the symbolic control flow */
4585 this->controlFlow_s(inst);
4586 }
4587
4588
4589 void AArch64Semantics::sdiv_s(triton::arch::Instruction& inst) {
4590 auto& dst = inst.operands[0];
4591 auto& src1 = inst.operands[1];
4592 auto& src2 = inst.operands[2];
4593
4594 /* Create symbolic operands */
4595 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4596 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4597
4598 /* Create the semantics */
4599 auto node = this->astCtxt->ite(
4600 this->astCtxt->equal(op2, this->astCtxt->bv(0, op2->getBitvectorSize())),
4601 this->astCtxt->bv(0, dst.getBitSize()),
4602 this->astCtxt->bvsdiv(op1, op2)
4603 );
4604
4605 /* Create symbolic expression */
4606 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SDIV operation");
4607
4608 /* Spread taint */
4609 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4610
4611 /* Update the symbolic control flow */
4612 this->controlFlow_s(inst);
4613 }
4614
4615
4616 void AArch64Semantics::smaddl_s(triton::arch::Instruction& inst) {
4617 auto& dst = inst.operands[0];
4618 auto& src1 = inst.operands[1];
4619 auto& src2 = inst.operands[2];
4620 auto& src3 = inst.operands[3];
4621
4622 /* Create symbolic operands */
4623 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4624 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4625 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
4626
4627 /* Create the semantics */
4628 auto node = this->astCtxt->bvadd(
4629 op3,
4630 this->astCtxt->bvmul(
4631 this->astCtxt->sx(triton::bitsize::dword, op1),
4632 this->astCtxt->sx(triton::bitsize::dword, op2)
4633 )
4634 );
4635
4636 /* Create symbolic expression */
4637 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SMADDL operation");
4638
4639 /* Spread taint */
4640 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4641
4642 /* Update the symbolic control flow */
4643 this->controlFlow_s(inst);
4644 }
4645
4646
4647 void AArch64Semantics::smsubl_s(triton::arch::Instruction& inst) {
4648 auto& dst = inst.operands[0];
4649 auto& src1 = inst.operands[1];
4650 auto& src2 = inst.operands[2];
4651 auto& src3 = inst.operands[3];
4652
4653 /* Create symbolic operands */
4654 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4655 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4656 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
4657
4658 /* Create the semantics */
4659 auto node = this->astCtxt->bvsub(
4660 op3,
4661 this->astCtxt->bvmul(
4662 this->astCtxt->sx(triton::bitsize::dword, op1),
4663 this->astCtxt->sx(triton::bitsize::dword, op2)
4664 )
4665 );
4666
4667 /* Create symbolic expression */
4668 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SMSUBL operation");
4669
4670 /* Spread taint */
4671 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
4672
4673 /* Update the symbolic control flow */
4674 this->controlFlow_s(inst);
4675 }
4676
4677
4678 void AArch64Semantics::smulh_s(triton::arch::Instruction& inst) {
4679 auto& dst = inst.operands[0];
4680 auto& src1 = inst.operands[1];
4681 auto& src2 = inst.operands[2];
4682
4683 /* Create symbolic operands */
4684 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4685 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4686
4687 /* Create the semantics */
4688 auto node = this->astCtxt->extract(
4691 this->astCtxt->bvmul(
4692 this->astCtxt->sx(triton::bitsize::qword, op1),
4693 this->astCtxt->sx(triton::bitsize::qword, op2)
4694 )
4695 );
4696
4697 /* Create symbolic expression */
4698 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SMULH operation");
4699
4700 /* Spread taint */
4701 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4702
4703 /* Update the symbolic control flow */
4704 this->controlFlow_s(inst);
4705 }
4706
4707
4708 void AArch64Semantics::smull_s(triton::arch::Instruction& inst) {
4709 auto& dst = inst.operands[0];
4710 auto& src1 = inst.operands[1];
4711 auto& src2 = inst.operands[2];
4712
4713 /* Create symbolic operands */
4714 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4715 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4716
4717 /* Create the semantics */
4718 auto node = this->astCtxt->bvmul(
4719 this->astCtxt->sx(triton::bitsize::dword, op1),
4720 this->astCtxt->sx(triton::bitsize::dword, op2)
4721 );
4722
4723 /* Create symbolic expression */
4724 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SMULL operation");
4725
4726 /* Spread taint */
4727 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4728
4729 /* Update the symbolic control flow */
4730 this->controlFlow_s(inst);
4731 }
4732
4733
4734 void AArch64Semantics::stlr_s(triton::arch::Instruction& inst) {
4737
4738 /* Create the semantics of the STORE */
4739 auto node = this->symbolicEngine->getOperandAst(inst, src);
4740
4741 /* Create symbolic expression */
4742 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STLR operation - STORE access");
4743
4744 /* Spread taint */
4745 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4746
4747 /* Update the symbolic control flow */
4748 this->controlFlow_s(inst);
4749 }
4750
4751
4752 void AArch64Semantics::stlrb_s(triton::arch::Instruction& inst) {
4755
4756 /* Create symbolic operands */
4757 auto op = this->symbolicEngine->getOperandAst(inst, src);
4758
4759 /* Create the semantics */
4760 auto node = this->astCtxt->extract(7, 0, op);
4761
4762 /* Create symbolic expression */
4763 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STLRB operation - STORE access");
4764
4765 /* Spread taint */
4766 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4767
4768 /* Update the symbolic control flow */
4769 this->controlFlow_s(inst);
4770 }
4771
4772
4773 void AArch64Semantics::stlrh_s(triton::arch::Instruction& inst) {
4776
4777 /* Create symbolic operands */
4778 auto op = this->symbolicEngine->getOperandAst(inst, src);
4779
4780 /* Create the semantics */
4781 auto node = this->astCtxt->extract(15, 0, op);
4782
4783 /* Create symbolic expression */
4784 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STLRH operation - STORE access");
4785
4786 /* Spread taint */
4787 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
4788
4789 /* Update the symbolic control flow */
4790 this->controlFlow_s(inst);
4791 }
4792
4793
4794 void AArch64Semantics::stlxr_s(triton::arch::Instruction& inst) {
4795 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
4797 triton::arch::OperandWrapper& dst2 = inst.operands[2];
4798
4799 /* Is memory exclusive */
4800 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
4801
4802 /* Create the semantics */
4803 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4804 auto node2 = this->symbolicEngine->getOperandAst(inst, src);
4805
4806 /* Create symbolic expression */
4807 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STLXR operation - write status");
4808
4809 /* Spread taint */
4810 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
4811
4812 /* Exclusive operation */
4813 if (exclusive) {
4814 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STLXR operation - STORE access");
4815 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
4816 }
4817
4818 /* Update exclusive memory access tag */
4819 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
4820
4821 /* Update the symbolic control flow */
4822 this->controlFlow_s(inst);
4823 }
4824
4825
4826 void AArch64Semantics::stlxrb_s(triton::arch::Instruction& inst) {
4827 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
4829 triton::arch::OperandWrapper& dst2 = inst.operands[2];
4830
4831 /* Is memory exclusive */
4832 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
4833
4834 /* Create symbolic operands */
4835 auto op = this->symbolicEngine->getOperandAst(inst, src);
4836
4837 /* Create the semantics */
4838 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4839 auto node2 = this->astCtxt->extract(7, 0, op);
4840
4841 /* Create symbolic expression */
4842 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STLXRB operation - write status");
4843
4844 /* Spread taint */
4845 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
4846
4847 /* Exclusive operation */
4848 if (exclusive) {
4849 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STLXRB operation - STORE access");
4850 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
4851 }
4852
4853 /* Update exclusive memory access tag */
4854 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
4855
4856 /* Update the symbolic control flow */
4857 this->controlFlow_s(inst);
4858 }
4859
4860
4861 void AArch64Semantics::stlxrh_s(triton::arch::Instruction& inst) {
4862 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
4864 triton::arch::OperandWrapper& dst2 = inst.operands[2];
4865
4866 /* Is memory exclusive */
4867 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
4868
4869 /* Create symbolic operands */
4870 auto op = this->symbolicEngine->getOperandAst(inst, src);
4871
4872 /* Create the semantics */
4873 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
4874 auto node2 = this->astCtxt->extract(15, 0, op);
4875
4876 /* Create symbolic expression */
4877 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STLXRH operation - write status");
4878
4879 /* Spread taint */
4880 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
4881
4882 /* Exclusive operation */
4883 if (exclusive) {
4884 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STLXRH operation - STORE access");
4885 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
4886 }
4887
4888 /* Update exclusive memory access tag */
4889 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
4890
4891 /* Update the symbolic control flow */
4892 this->controlFlow_s(inst);
4893 }
4894
4895
4896 void AArch64Semantics::stnp_s(triton::arch::Instruction& inst) {
4897 triton::arch::OperandWrapper& src1 = inst.operands[0];
4898 triton::arch::OperandWrapper& src2 = inst.operands[1];
4900
4901 /* Create symbolic operands */
4902 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4903 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4904
4905 /* Create the semantics */
4906 auto node = this->astCtxt->concat(op2, op1);
4907
4908 /* Special behavior: Define that the size of the memory access is src1.size + src2.size */
4909 dst.getMemory().setBits(node->getBitvectorSize()-1, 0);
4910
4911 /* Create symbolic expression */
4912 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STNP operation - STORE access");
4913
4914 /* Spread taint */
4915 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4916
4917 /* Update the symbolic control flow */
4918 this->controlFlow_s(inst);
4919 }
4920
4921
4922 void AArch64Semantics::stp_s(triton::arch::Instruction& inst) {
4923 triton::arch::OperandWrapper& src1 = inst.operands[0];
4924 triton::arch::OperandWrapper& src2 = inst.operands[1];
4926
4927 /* Create symbolic operands */
4928 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
4929 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
4930
4931 /* Create the semantics */
4932 auto node = this->astCtxt->concat(op2, op1);
4933
4934 /* Special behavior: Define that the size of the memory access is src1.size + src2.size */
4935 dst.getMemory().setBits(node->getBitvectorSize()-1, 0);
4936
4937 /* Create symbolic expression */
4938 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STP operation - STORE access");
4939
4940 /* Spread taint */
4941 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
4942
4943 /* Optional behavior. Post computation of the base register */
4944 /* STP <Xt1>, <Xt2>, [<Xn|SP>], #<imm> */
4945 if (inst.operands.size() == 4) {
4946 triton::arch::Immediate& imm = inst.operands[3].getImmediate();
4948
4949 /* Create symbolic operands of the post computation */
4950 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
4951 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
4952
4953 /* Create the semantics of the base register */
4954 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
4955
4956 /* Create symbolic expression */
4957 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "STP operation - Base register computation");
4958
4959 /* Spread taint */
4960 expr2->isTainted = this->taintEngine->isTainted(base);
4961 }
4962
4963 /* STP <Xt1>, <Xt2>, [<Xn|SP>, #<imm>]! */
4964 else if (inst.operands.size() == 3 && inst.isWriteBack() == true) {
4966
4967 /* Create the semantics of the base register */
4968 auto node3 = dst.getMemory().getLeaAst();
4969
4970 /* Create symbolic expression */
4971 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "STP operation - Base register computation");
4972
4973 /* Spread taint */
4974 expr3->isTainted = this->taintEngine->isTainted(base);
4975 }
4976
4977 /* Update the symbolic control flow */
4978 this->controlFlow_s(inst);
4979 }
4980
4981
4982 void AArch64Semantics::str_s(triton::arch::Instruction& inst) {
4985
4986 /* Create the semantics of the STORE */
4987 auto node1 = this->symbolicEngine->getOperandAst(inst, src);
4988
4989 /* Create symbolic expression */
4990 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "STR operation - STORE access");
4991
4992 /* Spread taint */
4993 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
4994
4995 /* Optional behavior. Post computation of the base register */
4996 /* STR <Xt>, [<Xn|SP>], #<simm> */
4997 if (inst.operands.size() == 3) {
4998 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
5000
5001 /* Create symbolic operands of the post computation */
5002 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
5003 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
5004
5005 /* Create the semantics of the base register */
5006 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
5007
5008 /* Create symbolic expression */
5009 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "STR operation - Base register computation");
5010
5011 /* Spread taint */
5012 expr2->isTainted = this->taintEngine->isTainted(base);
5013 }
5014
5015 /* STR <Xt>, [<Xn|SP>, #<simm>]! */
5016 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
5018
5019 /* Create the semantics of the base register */
5020 auto node3 = dst.getMemory().getLeaAst();
5021
5022 /* Create symbolic expression */
5023 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "STR operation - Base register computation");
5024
5025 /* Spread taint */
5026 expr3->isTainted = this->taintEngine->isTainted(base);
5027 }
5028
5029 /* Update the symbolic control flow */
5030 this->controlFlow_s(inst);
5031 }
5032
5033
5034 void AArch64Semantics::strb_s(triton::arch::Instruction& inst) {
5037
5038 /* Create symbolic operands */
5039 auto op = this->symbolicEngine->getOperandAst(inst, src);
5040
5041 /* Create the semantics */
5042 auto node1 = this->astCtxt->extract(7, 0, op);
5043
5044 /* Create symbolic expression */
5045 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "STRB operation - STORE access");
5046
5047 /* Spread taint */
5048 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
5049
5050 /* Optional behavior. Post computation of the base register */
5051 /* STRB <Wt>, [<Xn|SP>], #<simm> */
5052 if (inst.operands.size() == 3) {
5053 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
5055
5056 /* Create symbolic operands of the post computation */
5057 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
5058 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
5059
5060 /* Create the semantics of the base register */
5061 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
5062
5063 /* Create symbolic expression */
5064 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "STRB operation - Base register computation");
5065
5066 /* Spread taint */
5067 expr2->isTainted = this->taintEngine->isTainted(base);
5068 }
5069
5070 /* STRB <Wt>, [<Xn|SP>, #<simm>]! */
5071 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
5073
5074 /* Create the semantics of the base register */
5075 auto node3 = dst.getMemory().getLeaAst();
5076
5077 /* Create symbolic expression */
5078 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "STRB operation - Base register computation");
5079
5080 /* Spread taint */
5081 expr3->isTainted = this->taintEngine->isTainted(base);
5082 }
5083
5084 /* Update the symbolic control flow */
5085 this->controlFlow_s(inst);
5086 }
5087
5088
5089 void AArch64Semantics::strh_s(triton::arch::Instruction& inst) {
5092
5093 /* Create symbolic operands */
5094 auto op = this->symbolicEngine->getOperandAst(inst, src);
5095
5096 /* Create the semantics */
5097 auto node1 = this->astCtxt->extract(15, 0, op);
5098
5099 /* Create symbolic expression */
5100 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst, "STRH operation - STORE access");
5101
5102 /* Spread taint */
5103 expr1->isTainted = this->taintEngine->taintAssignment(dst, src);
5104
5105 /* Optional behavior. Post computation of the base register */
5106 /* STRH <Wt>, [<Xn|SP>], #<simm> */
5107 if (inst.operands.size() == 3) {
5108 triton::arch::Immediate& imm = inst.operands[2].getImmediate();
5110
5111 /* Create symbolic operands of the post computation */
5112 auto baseNode = this->symbolicEngine->getOperandAst(inst, base);
5113 auto immNode = this->symbolicEngine->getOperandAst(inst, imm);
5114
5115 /* Create the semantics of the base register */
5116 auto node2 = this->astCtxt->bvadd(baseNode, this->astCtxt->sx(base.getBitSize() - imm.getBitSize(), immNode));
5117
5118 /* Create symbolic expression */
5119 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, base, "STRH operation - Base register computation");
5120
5121 /* Spread taint */
5122 expr2->isTainted = this->taintEngine->isTainted(base);
5123 }
5124
5125 /* STRH <Wt>, [<Xn|SP>, #<simm>]! */
5126 else if (inst.operands.size() == 2 && inst.isWriteBack() == true) {
5128
5129 /* Create the semantics of the base register */
5130 auto node3 = dst.getMemory().getLeaAst();
5131
5132 /* Create symbolic expression */
5133 auto expr3 = this->symbolicEngine->createSymbolicExpression(inst, node3, base, "STRH operation - Base register computation");
5134
5135 /* Spread taint */
5136 expr3->isTainted = this->taintEngine->isTainted(base);
5137 }
5138
5139 /* Update the symbolic control flow */
5140 this->controlFlow_s(inst);
5141 }
5142
5143
5144 void AArch64Semantics::sttr_s(triton::arch::Instruction& inst) {
5147
5148 /* Create the semantics of the STORE */
5149 auto node = this->symbolicEngine->getOperandAst(inst, src);
5150
5151 /* Create symbolic expression */
5152 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STTR operation");
5153
5154 /* Spread taint */
5155 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5156
5157 /* Update the symbolic control flow */
5158 this->controlFlow_s(inst);
5159 }
5160
5161
5162 void AArch64Semantics::sttrb_s(triton::arch::Instruction& inst) {
5165
5166 /* Create symbolic operands */
5167 auto op = this->symbolicEngine->getOperandAst(inst, src);
5168
5169 /* Create the semantics */
5170 auto node = this->astCtxt->extract(7, 0, op);
5171
5172 /* Create symbolic expression */
5173 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STTRB operation");
5174
5175 /* Spread taint */
5176 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5177
5178 /* Update the symbolic control flow */
5179 this->controlFlow_s(inst);
5180 }
5181
5182
5183 void AArch64Semantics::sttrh_s(triton::arch::Instruction& inst) {
5186
5187 /* Create symbolic operands */
5188 auto op = this->symbolicEngine->getOperandAst(inst, src);
5189
5190 /* Create the semantics */
5191 auto node = this->astCtxt->extract(15, 0, op);
5192
5193 /* Create symbolic expression */
5194 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STTRH operation");
5195
5196 /* Spread taint */
5197 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5198
5199 /* Update the symbolic control flow */
5200 this->controlFlow_s(inst);
5201 }
5202
5203
5204 void AArch64Semantics::stur_s(triton::arch::Instruction& inst) {
5207
5208 /* Create the semantics of the STORE */
5209 auto node = this->symbolicEngine->getOperandAst(inst, src);
5210
5211 /* Create symbolic expression */
5212 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STUR operation");
5213
5214 /* Spread taint */
5215 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5216
5217 /* Update the symbolic control flow */
5218 this->controlFlow_s(inst);
5219 }
5220
5221
5222 void AArch64Semantics::sturb_s(triton::arch::Instruction& inst) {
5225
5226 /* Create symbolic operands */
5227 auto op = this->symbolicEngine->getOperandAst(inst, src);
5228
5229 /* Create the semantics */
5230 auto node = this->astCtxt->extract(7, 0, op);
5231
5232 /* Create symbolic expression */
5233 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STURB operation");
5234
5235 /* Spread taint */
5236 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5237
5238 /* Update the symbolic control flow */
5239 this->controlFlow_s(inst);
5240 }
5241
5242
5243 void AArch64Semantics::sturh_s(triton::arch::Instruction& inst) {
5246
5247 /* Create symbolic operands */
5248 auto op = this->symbolicEngine->getOperandAst(inst, src);
5249
5250 /* Create the semantics */
5251 auto node = this->astCtxt->extract(15, 0, op);
5252
5253 /* Create symbolic expression */
5254 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "STURH operation");
5255
5256 /* Spread taint */
5257 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5258
5259 /* Update the symbolic control flow */
5260 this->controlFlow_s(inst);
5261 }
5262
5263
5264 void AArch64Semantics::stxp_s(triton::arch::Instruction& inst) {
5265 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
5266 triton::arch::OperandWrapper& src1 = inst.operands[1];
5267 triton::arch::OperandWrapper& src2 = inst.operands[2];
5268 triton::arch::OperandWrapper& dst2 = inst.operands[3];
5269
5270 /* Special behavior: Define that the size of the memory access is src1.size + src2.size */
5271 dst2.getMemory().setBits((src1.getBitSize() + src2.getBitSize()) - 1, 0);
5272
5273 /* Is memory exclusive */
5274 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
5275
5276 /* Create symbolic operands */
5277 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5278 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5279
5280 /* Create the semantics */
5281 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5282 auto node2 = this->astCtxt->concat(op2, op1);
5283
5284 /* Create symbolic expression */
5285 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STXP operation - write status");
5286
5287 /* Spread taint */
5288 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
5289
5290 /* Exclusive operation */
5291 if (exclusive) {
5292 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STXP operation - STORE access");
5293 expr2->isTainted = this->taintEngine->setTaint(dst2, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5294 }
5295
5296 /* Update exclusive memory access tag */
5297 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
5298
5299 /* Update the symbolic control flow */
5300 this->controlFlow_s(inst);
5301 }
5302
5303
5304 void AArch64Semantics::stxr_s(triton::arch::Instruction& inst) {
5305 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
5307 triton::arch::OperandWrapper& dst2 = inst.operands[2];
5308
5309 /* Is memory exclusive */
5310 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
5311
5312 /* Create the semantics */
5313 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5314 auto node2 = this->symbolicEngine->getOperandAst(inst, src);
5315
5316 /* Create symbolic expression */
5317 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STXR operation - write status");
5318
5319 /* Spread taint */
5320 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
5321
5322 /* Exclusive operation */
5323 if (exclusive) {
5324 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STXR operation - STORE access");
5325 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
5326 }
5327
5328 /* Update exclusive memory access tag */
5329 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
5330
5331 /* Update the symbolic control flow */
5332 this->controlFlow_s(inst);
5333 }
5334
5335
5336 void AArch64Semantics::stxrb_s(triton::arch::Instruction& inst) {
5337 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
5339 triton::arch::OperandWrapper& dst2 = inst.operands[2];
5340
5341 /* Is memory exclusive */
5342 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
5343
5344 /* Create symbolic operands */
5345 auto op = this->symbolicEngine->getOperandAst(inst, src);
5346
5347 /* Create the semantics */
5348 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5349 auto node2 = this->astCtxt->extract(7, 0, op);
5350
5351 /* Create symbolic expression */
5352 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STXRB operation - write status");
5353
5354 /* Spread taint */
5355 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
5356
5357 /* Exclusive operation */
5358 if (exclusive) {
5359 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STXRB operation - STORE access");
5360 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
5361 }
5362
5363 /* Update exclusive memory access tag */
5364 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
5365
5366 /* Update the symbolic control flow */
5367 this->controlFlow_s(inst);
5368 }
5369
5370
5371 void AArch64Semantics::stxrh_s(triton::arch::Instruction& inst) {
5372 triton::arch::OperandWrapper& dst1 = inst.operands[0]; /* status */
5374 triton::arch::OperandWrapper& dst2 = inst.operands[2];
5375
5376 /* Is memory exclusive */
5377 bool exclusive = this->architecture->isMemoryExclusive(dst2.getConstMemory());
5378
5379 /* Create symbolic operands */
5380 auto op = this->symbolicEngine->getOperandAst(inst, src);
5381
5382 /* Create the semantics */
5383 auto node1 = this->astCtxt->bv(exclusive ? 0 : 1, dst1.getBitSize());
5384 auto node2 = this->astCtxt->extract(15, 0, op);
5385
5386 /* Create symbolic expression */
5387 auto expr1 = this->symbolicEngine->createSymbolicExpression(inst, node1, dst1, "STXRH operation - write status");
5388
5389 /* Spread taint */
5390 expr1->isTainted = this->taintEngine->setTaint(dst1, false);
5391
5392 /* Exclusive operation */
5393 if (exclusive) {
5394 auto expr2 = this->symbolicEngine->createSymbolicExpression(inst, node2, dst2, "STXRH operation - STORE access");
5395 expr2->isTainted = this->taintEngine->taintAssignment(dst2, src);
5396 }
5397
5398 /* Update exclusive memory access tag */
5399 this->architecture->setMemoryExclusiveTag(dst2.getConstMemory(), false);
5400
5401 /* Update the symbolic control flow */
5402 this->controlFlow_s(inst);
5403 }
5404
5405
5406 void AArch64Semantics::sub_s(triton::arch::Instruction& inst) {
5407 auto& dst = inst.operands[0];
5408 auto& src1 = inst.operands[1];
5409 auto& src2 = inst.operands[2];
5410
5411 /* Create symbolic operands */
5412 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5413 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5414
5415 /* Create the semantics */
5416 auto node = this->astCtxt->bvsub(op1, op2);
5417
5418 /* Create symbolic expression */
5419 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SUB(S) operation");
5420
5421 /* Spread taint */
5422 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5423
5424 /* Update symbolic flags */
5425 if (inst.isUpdateFlag() == true) {
5426 this->cfSub_s(inst, expr, dst, op1, op2);
5427 this->nf_s(inst, expr, dst);
5428 this->vfSub_s(inst, expr, dst, op1, op2);
5429 this->zf_s(inst, expr, dst);
5430 }
5431
5432 /* Update the symbolic control flow */
5433 this->controlFlow_s(inst);
5434 }
5435
5436
5437 void AArch64Semantics::svc_s(triton::arch::Instruction& inst) {
5438 auto& src = inst.operands[0];
5439
5440 /* Link the immediate to the instruction */
5441 this->symbolicEngine->getOperandAst(inst, src);
5442
5443 /* Update the symbolic control flow */
5444 this->controlFlow_s(inst);
5445 }
5446
5447
5448 void AArch64Semantics::sxtb_s(triton::arch::Instruction& inst) {
5449 auto& dst = inst.operands[0];
5450 auto& src = inst.operands[1];
5451
5452 /* Create symbolic operands */
5453 auto op = this->symbolicEngine->getOperandAst(inst, src);
5454
5455 /* Create the semantics */
5456 auto node = this->astCtxt->sx(dst.getBitSize() - 8, this->astCtxt->extract(7, 0, op));
5457
5458 /* Create symbolic expression */
5459 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SXTB operation");
5460
5461 /* Spread taint */
5462 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5463
5464 /* Update the symbolic control flow */
5465 this->controlFlow_s(inst);
5466 }
5467
5468
5469 void AArch64Semantics::sxth_s(triton::arch::Instruction& inst) {
5470 auto& dst = inst.operands[0];
5471 auto& src = inst.operands[1];
5472
5473 /* Create symbolic operands */
5474 auto op = this->symbolicEngine->getOperandAst(inst, src);
5475
5476 /* Create the semantics */
5477 auto node = this->astCtxt->sx(dst.getBitSize() - 16, this->astCtxt->extract(15, 0, op));
5478
5479 /* Create symbolic expression */
5480 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SXTH operation");
5481
5482 /* Spread taint */
5483 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5484
5485 /* Update the symbolic control flow */
5486 this->controlFlow_s(inst);
5487 }
5488
5489
5490 void AArch64Semantics::sxtw_s(triton::arch::Instruction& inst) {
5491 auto& dst = inst.operands[0];
5492 auto& src = inst.operands[1];
5493
5494 /* Create symbolic operands */
5495 auto op = this->symbolicEngine->getOperandAst(inst, src);
5496
5497 /* Create the semantics */
5498 auto node = this->astCtxt->sx(dst.getBitSize() - 32, this->astCtxt->extract(31, 0, op));
5499
5500 /* Create symbolic expression */
5501 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "SXTW operation");
5502
5503 /* Spread taint */
5504 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5505
5506 /* Update the symbolic control flow */
5507 this->controlFlow_s(inst);
5508 }
5509
5510
5511 void AArch64Semantics::tbnz_s(triton::arch::Instruction& inst) {
5512 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
5513 auto& src1 = inst.operands[0];
5514 auto& src2 = inst.operands[1];
5515 auto& src3 = inst.operands[2];
5516
5517 /* Create symbolic operands */
5518 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5519 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5520 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
5521
5522 /* Create the semantics */
5523 auto node = this->astCtxt->ite(
5524 this->astCtxt->equal(
5525 this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2)),
5526 this->astCtxt->bvtrue()
5527 ),
5528 this->astCtxt->zx(dst.getBitSize() - op3->getBitvectorSize(), op3),
5529 this->astCtxt->bv(inst.getNextAddress(), dst.getBitSize())
5530 );
5531
5532 /* Create symbolic expression */
5533 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "TBNZ operation - Program Counter");
5534
5535 /* Spread taint */
5536 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5537
5538 /* Set condition flag */
5539 if (this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2))->evaluate() != 0)
5540 inst.setConditionTaken(true);
5541
5542 /* Create the path constraint */
5543 this->symbolicEngine->pushPathConstraint(inst, expr);
5544 }
5545
5546
5547 void AArch64Semantics::tbz_s(triton::arch::Instruction& inst) {
5548 auto dst = triton::arch::OperandWrapper(this->architecture->getRegister(ID_REG_AARCH64_PC));
5549 auto& src1 = inst.operands[0];
5550 auto& src2 = inst.operands[1];
5551 auto& src3 = inst.operands[2];
5552
5553 /* Create symbolic operands */
5554 auto op1 = this->astCtxt->zx(dst.getBitSize() - src1.getBitSize(), this->symbolicEngine->getOperandAst(inst, src1));
5555 auto op2 = this->astCtxt->zx(dst.getBitSize() - src2.getBitSize(), this->symbolicEngine->getOperandAst(inst, src2));
5556 auto op3 = this->astCtxt->zx(dst.getBitSize() - src3.getBitSize(), this->symbolicEngine->getOperandAst(inst, src3));
5557
5558 /* Create the semantics */
5559 auto node = this->astCtxt->ite(
5560 this->astCtxt->equal(
5561 this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2)),
5562 this->astCtxt->bvfalse()
5563 ),
5564 this->astCtxt->zx(dst.getBitSize() - op3->getBitvectorSize(), op3),
5565 this->astCtxt->bv(inst.getNextAddress(), dst.getBitSize())
5566 );
5567
5568 /* Create symbolic expression */
5569 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "TBZ operation - Program Counter");
5570
5571 /* Spread taint */
5572 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5573
5574 /* Set condition flag */
5575 if (this->astCtxt->extract(0, 0, this->astCtxt->bvlshr(op1, op2))->evaluate() == 0)
5576 inst.setConditionTaken(true);
5577
5578 /* Create the path constraint */
5579 this->symbolicEngine->pushPathConstraint(inst, expr);
5580 }
5581
5582
5583 void AArch64Semantics::tst_s(triton::arch::Instruction& inst) {
5584 auto& src1 = inst.operands[0];
5585 auto& src2 = inst.operands[1];
5586
5587 /* Create symbolic operands */
5588 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5589 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5590
5591 /* Create the semantics */
5592 auto node = this->astCtxt->bvand(op1, op2);
5593
5594 /* Create symbolic expression */
5595 auto expr = this->symbolicEngine->createSymbolicVolatileExpression(inst, node, "TST operation");
5596
5597 /* Spread taint */
5598 expr->isTainted = this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2);
5599
5600 /* Update symbolic flags */
5601 if (inst.isUpdateFlag() == true) {
5602 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_C), "Clears carry flag");
5603 this->nf_s(inst, expr, src1);
5604 this->clearFlag_s(inst, this->architecture->getRegister(ID_REG_AARCH64_V), "Clears overflow flag");
5605 this->zf_s(inst, expr, src1);
5606 }
5607
5608 /* Update the symbolic control flow */
5609 this->controlFlow_s(inst);
5610 }
5611
5612
5613 void AArch64Semantics::ubfiz_s(triton::arch::Instruction& inst) {
5614 auto& dst = inst.operands[0];
5615 auto& src1 = inst.operands[1];
5616 auto& src2 = inst.operands[2];
5617 auto& src3 = inst.operands[3];
5618 auto lsb = static_cast<uint32>(src2.getImmediate().getValue());
5619 auto width = static_cast<uint32>(src3.getImmediate().getValue());
5620
5621 if (lsb + width > dst.getBitSize())
5622 throw triton::exceptions::Semantics("AArch64Semantics::ubfiz_s(): Invalid lsb and width.");
5623
5624 /* Create symbolic operands */
5625 auto op = this->symbolicEngine->getOperandAst(inst, src1);
5626
5627 /* Create the semantics */
5628 std::vector<triton::ast::SharedAbstractNode> bits;
5629 bits.reserve(3);
5630
5631 if (lsb + width < dst.getBitSize()) {
5632 bits.push_back(this->astCtxt->bv(0, dst.getBitSize() - (lsb + width)));
5633 }
5634
5635 bits.push_back(this->astCtxt->extract(width - 1, 0, op));
5636
5637 if (lsb) {
5638 bits.push_back(this->astCtxt->bv(0, lsb));
5639 }
5640
5641 auto node = this->astCtxt->concat(bits);
5642
5643 /* Create symbolic expression */
5644 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UBFIZ operation");
5645
5646 /* Spread taint */
5647 expr->isTainted = this->taintEngine->taintAssignment(dst, src1);
5648
5649 /* Update the symbolic control flow */
5650 this->controlFlow_s(inst);
5651 }
5652
5653
5654 void AArch64Semantics::ubfx_s(triton::arch::Instruction& inst) {
5655 auto& dst = inst.operands[0];
5656 auto& src1 = inst.operands[1];
5657 auto& src2 = inst.operands[2];
5658 auto& src3 = inst.operands[3];
5659 auto lsb = static_cast<uint32>(src2.getImmediate().getValue());
5660 auto width = static_cast<uint32>(src3.getImmediate().getValue());
5661
5662 if (lsb + width > dst.getBitSize())
5663 throw triton::exceptions::Semantics("AArch64Semantics::ubfx_s(): Invalid lsb and width.");
5664
5665 /* Create symbolic operands */
5666 auto op = this->symbolicEngine->getOperandAst(inst, src1);
5667
5668 /* Create the semantics */
5669 auto node = this->astCtxt->zx(dst.getBitSize() - width, this->astCtxt->extract(lsb+width-1, lsb, op));
5670
5671 /* Create symbolic expression */
5672 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UBFX operation");
5673
5674 /* Spread taint */
5675 expr->isTainted = this->taintEngine->taintAssignment(dst, src1);
5676
5677 /* Update the symbolic control flow */
5678 this->controlFlow_s(inst);
5679 }
5680
5681
5682 void AArch64Semantics::udiv_s(triton::arch::Instruction& inst) {
5683 auto& dst = inst.operands[0];
5684 auto& src1 = inst.operands[1];
5685 auto& src2 = inst.operands[2];
5686
5687 /* Create symbolic operands */
5688 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5689 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5690
5691 /* Create the semantics */
5692 auto node = this->astCtxt->ite(
5693 this->astCtxt->equal(op2, this->astCtxt->bv(0, op2->getBitvectorSize())),
5694 this->astCtxt->bv(0, dst.getBitSize()),
5695 this->astCtxt->bvudiv(op1, op2)
5696 );
5697
5698 /* Create symbolic expression */
5699 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UDIV operation");
5700
5701 /* Spread taint */
5702 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5703
5704 /* Update the symbolic control flow */
5705 this->controlFlow_s(inst);
5706 }
5707
5708
5709 void AArch64Semantics::umaddl_s(triton::arch::Instruction& inst) {
5710 auto& dst = inst.operands[0];
5711 auto& src1 = inst.operands[1];
5712 auto& src2 = inst.operands[2];
5713 auto& src3 = inst.operands[3];
5714
5715 /* Create symbolic operands */
5716 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5717 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5718 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
5719
5720 /* Create the semantics */
5721 auto node = this->astCtxt->bvadd(
5722 op3,
5723 this->astCtxt->bvmul(
5724 this->astCtxt->zx(triton::bitsize::dword, op1),
5725 this->astCtxt->zx(triton::bitsize::dword, op2)
5726 )
5727 );
5728
5729 /* Create symbolic expression */
5730 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UMADDL operation");
5731
5732 /* Spread taint */
5733 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
5734
5735 /* Update the symbolic control flow */
5736 this->controlFlow_s(inst);
5737 }
5738
5739 void AArch64Semantics::umov_s(triton::arch::Instruction& inst) {
5740 auto& dst = inst.operands[0]; // GPR register
5741 auto& src = inst.operands[1]; // vector register
5742
5743 /* Create the semantics */
5744 auto vas_size = src.getConstRegister().getVASSize() * triton::bitsize::byte;
5745
5746 auto node =
5747 this->astCtxt->zx(
5748 dst.getBitSize() - vas_size,
5749 this->symbolicEngine->getOperandAst(src)
5750 );
5751
5752 /* Create symbolic expression */
5753 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst);
5754
5755 /* Spread taint */
5756 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5757
5758 this->controlFlow_s(inst);
5759 }
5760
5761 void AArch64Semantics::umnegl_s(triton::arch::Instruction& inst) {
5762 auto& dst = inst.operands[0];
5763 auto& src1 = inst.operands[1];
5764 auto& src2 = inst.operands[2];
5765
5766 /* Create symbolic operands */
5767 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5768 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5769
5770 /* Create the semantics */
5771 auto node = this->astCtxt->bvneg(
5772 this->astCtxt->bvmul(
5773 this->astCtxt->zx(triton::bitsize::dword, op1),
5774 this->astCtxt->zx(triton::bitsize::dword, op2)
5775 )
5776 );
5777
5778 /* Create symbolic expression */
5779 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UMNEGL operation");
5780
5781 /* Spread taint */
5782 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5783
5784 /* Update the symbolic control flow */
5785 this->controlFlow_s(inst);
5786 }
5787
5788
5789 void AArch64Semantics::umsubl_s(triton::arch::Instruction& inst) {
5790 auto& dst = inst.operands[0];
5791 auto& src1 = inst.operands[1];
5792 auto& src2 = inst.operands[2];
5793 auto& src3 = inst.operands[3];
5794
5795 /* Create symbolic operands */
5796 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5797 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5798 auto op3 = this->symbolicEngine->getOperandAst(inst, src3);
5799
5800 /* Create the semantics */
5801 auto node = this->astCtxt->bvsub(
5802 op3,
5803 this->astCtxt->bvmul(
5804 this->astCtxt->zx(triton::bitsize::dword, op1),
5805 this->astCtxt->zx(triton::bitsize::dword, op2)
5806 )
5807 );
5808
5809 /* Create symbolic expression */
5810 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UMSUBL operation");
5811
5812 /* Spread taint */
5813 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2) | this->taintEngine->isTainted(src3));
5814
5815 /* Update the symbolic control flow */
5816 this->controlFlow_s(inst);
5817 }
5818
5819
5820 void AArch64Semantics::umulh_s(triton::arch::Instruction& inst) {
5821 auto& dst = inst.operands[0];
5822 auto& src1 = inst.operands[1];
5823 auto& src2 = inst.operands[2];
5824
5825 /* Create symbolic operands */
5826 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5827 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5828
5829 /* Create the semantics */
5830 auto node = this->astCtxt->extract(
5833 this->astCtxt->bvmul(
5834 this->astCtxt->zx(triton::bitsize::qword, op1),
5835 this->astCtxt->zx(triton::bitsize::qword, op2)
5836 )
5837 );
5838
5839 /* Create symbolic expression */
5840 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UMULH operation");
5841
5842 /* Spread taint */
5843 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5844
5845 /* Update the symbolic control flow */
5846 this->controlFlow_s(inst);
5847 }
5848
5849
5850 void AArch64Semantics::umull_s(triton::arch::Instruction& inst) {
5851 auto& dst = inst.operands[0];
5852 auto& src1 = inst.operands[1];
5853 auto& src2 = inst.operands[2];
5854
5855 /* Create symbolic operands */
5856 auto op1 = this->symbolicEngine->getOperandAst(inst, src1);
5857 auto op2 = this->symbolicEngine->getOperandAst(inst, src2);
5858
5859 /* Create the semantics */
5860 auto node = this->astCtxt->bvmul(
5861 this->astCtxt->zx(triton::bitsize::dword, op1),
5862 this->astCtxt->zx(triton::bitsize::dword, op2)
5863 );
5864
5865 /* Create symbolic expression */
5866 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UMULL operation");
5867
5868 /* Spread taint */
5869 expr->isTainted = this->taintEngine->setTaint(dst, this->taintEngine->isTainted(src1) | this->taintEngine->isTainted(src2));
5870
5871 /* Update the symbolic control flow */
5872 this->controlFlow_s(inst);
5873 }
5874
5875
5876 void AArch64Semantics::uxtb_s(triton::arch::Instruction& inst) {
5877 auto& dst = inst.operands[0];
5878 auto& src = inst.operands[1];
5879
5880 /* Create symbolic operands */
5881 auto op = this->symbolicEngine->getOperandAst(inst, src);
5882
5883 /* Create the semantics */
5884 auto node = this->astCtxt->zx(dst.getBitSize() - 8, this->astCtxt->extract(7, 0, op));
5885
5886 /* Create symbolic expression */
5887 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UXTB operation");
5888
5889 /* Spread taint */
5890 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5891
5892 /* Update the symbolic control flow */
5893 this->controlFlow_s(inst);
5894 }
5895
5896
5897 void AArch64Semantics::uxth_s(triton::arch::Instruction& inst) {
5898 auto& dst = inst.operands[0];
5899 auto& src = inst.operands[1];
5900
5901 /* Create symbolic operands */
5902 auto op = this->symbolicEngine->getOperandAst(inst, src);
5903
5904 /* Create the semantics */
5905 auto node = this->astCtxt->zx(dst.getBitSize() - 16, this->astCtxt->extract(15, 0, op));
5906
5907 /* Create symbolic expression */
5908 auto expr = this->symbolicEngine->createSymbolicExpression(inst, node, dst, "UXTH operation");
5909
5910 /* Spread taint */
5911 expr->isTainted = this->taintEngine->taintAssignment(dst, src);
5912
5913 /* Update the symbolic control flow */
5914 this->controlFlow_s(inst);
5915 }
5916
5917 }; /* aarch64 namespace */
5918 }; /* arm namespace */
5919 }; /* arch namespace */
5920}; /* triton namespace */
The abstract architecture class.
TRITON_EXPORT const triton::arch::Register & getRegister(triton::arch::register_e id) const
Returns register from id.
TRITON_EXPORT bool isMemoryExclusive(const triton::arch::MemoryAccess &mem) const
Returns true if the memory access is tagged as exclusive. Only valid for Arm32 and AArch64.
TRITON_EXPORT void setMemoryExclusiveTag(const triton::arch::MemoryAccess &mem, bool tag)
Sets exclusive memory access tag. Only valid for Arm32 and AArch64.
TRITON_EXPORT const triton::arch::Register & getParentRegister(triton::arch::register_e id) const
Returns parent register from id.
TRITON_EXPORT void setBits(triton::uint32 high, triton::uint32 low)
Sets the bits (high, low) position.
This class is used to represent an immediate.
Definition immediate.hpp:37
TRITON_EXPORT triton::uint32 getBitSize(void) const
Returns the size (in bits) of the immediate vector.
TRITON_EXPORT triton::uint64 getValue(void) const
Returns the value of the operand.
Definition immediate.cpp:75
This class is used to represent an instruction.
TRITON_EXPORT bool isWriteBack(void) const
Returns true if the instruction performs a write back. Mainly used for AArch64 instructions like LDR.
TRITON_EXPORT void setConditionTaken(bool flag)
Sets flag to define if the condition is taken or not.
TRITON_EXPORT triton::uint32 getType(void) const
Returns the type of the instruction.
std::vector< triton::arch::OperandWrapper > operands
A list of operands.
TRITON_EXPORT bool isUpdateFlag(void) const
Returns true if the instruction updates flags. Mainly used for AArch64 instructions like ADDS.
TRITON_EXPORT triton::arch::arm::condition_e getCodeCondition(void) const
Returns the code codition of the instruction (mainly for AArch64).
TRITON_EXPORT triton::uint64 getNextAddress(void) const
Returns the next address of the instruction.
This class is used to represent a memory access.
TRITON_EXPORT triton::ast::SharedAbstractNode getLeaAst(void) const
Returns the AST of the memory access (LEA).
TRITON_EXPORT triton::arch::Register & getBaseRegister(void)
LEA - Returns the base register operand.
This class is used as operand wrapper.
TRITON_EXPORT triton::uint32 getLow(void) const
Returns the lower bit position of the abstract operand.
TRITON_EXPORT triton::arch::operand_e getType(void) const
Returns the abstract type of the operand.
TRITON_EXPORT triton::uint32 getSize(void) const
Returns the abstract size (in bytes) of the operand.
TRITON_EXPORT const triton::arch::MemoryAccess & getConstMemory(void) const
Returns the memory operand as const.
TRITON_EXPORT triton::arch::MemoryAccess & getMemory(void)
Returns the memory operand.
TRITON_EXPORT const triton::arch::Register & getConstRegister(void) const
Returns the register operand.
TRITON_EXPORT triton::uint32 getHigh(void) const
Returns the highest bit position of the abstract operand.
TRITON_EXPORT const triton::arch::Immediate & getConstImmediate(void) const
Returns the immediate operand.
TRITON_EXPORT triton::uint32 getBitSize(void) const
Returns the abstract size (in bits) of the operand.
TRITON_EXPORT triton::arch::Immediate & getImmediate(void)
Returns the immediate operand.
This class is used when an instruction has a register operand.
Definition register.hpp:44
TRITON_EXPORT triton::uint32 getBitSize(void) const
Returns the size (in bits) of the register.
Definition register.cpp:63
TRITON_EXPORT triton::uint32 getShiftImmediate(void) const
Returns the value of the shift immediate.
TRITON_EXPORT triton::arch::arm::vas_e getVASType(void) const
Returns the vector arrangement specifier.
TRITON_EXPORT triton::uint32 getVASSize(void) const
Returns the vector arrangement specifier size (64 or 128 bits).
TRITON_EXPORT triton::arch::exception_e buildSemantics(triton::arch::Instruction &inst)
Builds the semantics of the instruction. Returns triton::arch::NO_FAULT if succeed.
TRITON_EXPORT AArch64Semantics(triton::arch::Architecture *architecture, triton::engines::symbolic::SymbolicEngine *symbolicEngine, triton::engines::taint::TaintEngine *taintEngine, const triton::ast::SharedAstContext &astCtxt)
Constructor.
TRITON_EXPORT void pushPathConstraint(const triton::arch::Instruction &inst, const triton::engines::symbolic::SharedSymbolicExpression &expr)
Pushs constraints of a branch instruction to the path predicate.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicRegisterExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::Register &reg, const std::string &comment="")
Returns the new symbolic register expression expression and links this expression to the instruction.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicVolatileExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const std::string &comment="")
Returns the new symbolic volatile expression expression and links this expression to the instruction.
TRITON_EXPORT triton::ast::SharedAbstractNode getMemoryAst(const triton::arch::MemoryAccess &mem)
Returns the AST corresponding to the memory.
TRITON_EXPORT const SharedSymbolicExpression & createSymbolicExpression(triton::arch::Instruction &inst, const triton::ast::SharedAbstractNode &node, const triton::arch::OperandWrapper &dst, const std::string &comment="")
Returns the new symbolic expression and links this expression to the instruction.
TRITON_EXPORT triton::ast::SharedAbstractNode getOperandAst(const triton::arch::OperandWrapper &op)
Returns the AST corresponding to the operand.
TRITON_EXPORT bool setTaint(const triton::arch::OperandWrapper &op, bool flag)
Sets the flag (taint or untaint) to an abstract operand (Register or Memory).
TRITON_EXPORT bool isTainted(const triton::arch::OperandWrapper &op) const
Abstract taint verification. Returns true if the operand is tainted.
TRITON_EXPORT bool isMemoryTainted(triton::uint64 addr, triton::uint32 size=1) const
Returns true if the addr is tainted.
TRITON_EXPORT bool taintUnion(const triton::arch::OperandWrapper &op1, const triton::arch::OperandWrapper &op2)
Abstract union tainting.
TRITON_EXPORT bool setTaintRegister(const triton::arch::Register &reg, bool flag)
Sets the flag (taint or untaint) to a register.
TRITON_EXPORT bool taintAssignment(const triton::arch::OperandWrapper &op1, const triton::arch::OperandWrapper &op2)
Abstract assignment tainting.
The exception class used by all semantics.
vas_e
Vector arrangement specifier.
@ ID_VAS_4S
4 lanes, each containing a 32-bit element.
@ ID_VAS_2D
2 lanes, each containing a 64-bit element.
@ ID_VAS_1D
1 lane containing a 64-bit element.
@ ID_VAS_16B
16 lanes, each containing an 8-bit element.
@ ID_VAS_8B
8 lanes, each containing an 8-bit element.
@ ID_VAS_8H
8 lanes, each containing a 16-bit element.
@ ID_VAS_4H
4 lanes, each containing a 16-bit element.
@ ID_VAS_2S
2 lanes, each containing a 32-bit element.
@ ID_CONDITION_HS
Higher or same (unsigned >=). C set.
@ ID_CONDITION_PL
Positive or zero. N clear.
@ ID_CONDITION_VC
No overflow. V clear.
@ ID_CONDITION_LE
Signed <=. Z set, N and V differ.
@ ID_CONDITION_VS
Overflow. V set.
@ ID_CONDITION_MI
Negative. N set.
@ ID_CONDITION_GE
Signed >=. N and V the same.
@ ID_CONDITION_GT
Signed >. Z clear, N and V the same.
@ ID_CONDITION_HI
Higher (unsigned >). C set and Z clear.
@ ID_CONDITION_NE
Not equal. Z clear.
@ ID_CONDITION_AL
Always. Any flags. This suffix is normally omitted.
@ ID_CONDITION_LO
Lower (unsigned <). C clear.
@ ID_CONDITION_LT
Signed <. N and V differ.
@ ID_CONDITION_LS
Lower or same (unsigned <=). C clear or Z set.
@ ID_CONDITION_EQ
Equal. Z set.
std::shared_ptr< triton::ast::AbstractNode > SharedAbstractNode
Shared Abstract Node.
Definition ast.hpp:59
std::shared_ptr< triton::ast::AstContext > SharedAstContext
Shared AST context.
Definition ast.hpp:65
constexpr triton::uint32 byte
byte size in bit
Definition cpuSize.hpp:60
constexpr triton::uint32 dword
dword size in bit
Definition cpuSize.hpp:64
constexpr triton::uint32 qword
qword size in bit
Definition cpuSize.hpp:66
constexpr triton::uint32 dqword
dqword size in bit
Definition cpuSize.hpp:70
constexpr triton::uint32 dword
dword size in byte
Definition cpuSize.hpp:34
constexpr triton::uint32 word
word size in byte
Definition cpuSize.hpp:32
constexpr triton::uint32 byte
byte size in byte
Definition cpuSize.hpp:30
constexpr triton::uint32 qword
qword size in byte
Definition cpuSize.hpp:36
std::shared_ptr< triton::engines::symbolic::SymbolicExpression > SharedSymbolicExpression
Shared Symbolic Expression.
Definition ast.hpp:40
const bool UNTAINTED
Defines an untainted item.
std::uint32_t uint32
unisgned 32-bits
The Triton namespace.