SSA form for non-function pcode regions #5137
Unanswered
RolfRolles
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Apart from decompiling the machine code that results from ordinary compilation of procedural languages, SSA form has many applications in binary program analysis. For example, all code passed to an SMT solver must be in SSA form. Sometimes the regions to place in SSA form are straight-line, as in arbitrary branch-free snippets, ROP gadgets, or execution traces obtained from dynamic instrumentation. Other times, these regions are not straight-line, such as a "chop" or an arbitrary CFG in an obfuscated context. None of these situations obey typical function abstractions, such as having arguments, prototypes, stack frames, return values, et cetera.
Although the Java side of Ghidra has functionality that is useful for implementing SSA conversion (such as computing dominance), it appears that the SSA conversion code takes place in C++, more specifically
heritage.cc
. TheHeritage
class constructor requires aFuncdata
object, which exhibits all of the trappings typical of program analysis code written with a procedural abstraction in mind. (Also, theVarnode
concept seems to have complicated SSA translation compared to intermediate representations with an explicit variable abstraction.)Suppose that: I'm writing Java code; I want SSA conversion of a straight-line sequence or an arbitrary graph region not obeying procedural abstractions. What should I do?
Beta Was this translation helpful? Give feedback.
All reactions