MLIL
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
>>> inst = current_mlil[22]
>>> inst
<mlil: [rax_1 + 8].q(rdi_1)>
>>> inst.operation
<MediumLevelILOperation.MLIL_CALL: 51>
>>> inst.params
[<mlil: rdi_1>]
>>> inst.dest
<mlil: [rax_1 + 8].q>
>>> inst.dest.value
<undetermined>
>>> inst.dest.operation
<MediumLevelILOperation.MLIL_LOAD: 4>
>>> inst.params[0]
<mlil: rdi_1>
>>> type(inst.params[0])
<class 'binaryninja.mediumlevelil.MediumLevelILVar'>
>>> para1 = inst.params[0]
>>> para1.operands
[<var void* rdi_1>]
>>> para1.operands[0]
<var void* rdi_1>
>>> type(para1.operands[0])
<class 'binaryninja.variable.Variable'>
>>> para1.operands[0].function
<func: x86_64@0x1ad6b>
>>> para1.operands[0].function.mlil
<mlil func: x86_64@0x1ad6b>
>>> ml = para1.operands[0].function.mlil
>>> ml.get_var_uses(para1.operands[0])
[<mlil: if (rdi_1 == 0) then 19 @ 0x1ada4 else 21 @ 0x1ad9d>, <mlil: rax_1 = [rdi_1 + 0x10].q>, <mlil: [rax_1 + 8].q(rdi_1)>]
>>> ml.get_var_definitions(para1.operands[0])
[<mlil: rdi_1 = [r12 + (rbp << 3)].q>]
>>> ml.get_var_definitions(para1.operands[0])[0]
<mlil: rdi_1 = [r12 + (rbp << 3)].q>
>>> hex(ml.get_var_definitions(para1.operands[0])[0].address)
'0x1ad94'
|
TODO
根据官方文档的说法，从assembly到low-level il做了常量传播、tail-call等分析，
从low-level il到medium-level il做了VSA、类型推断、函数参数解析等，
这些分析怎么实现的？
