Skip to content

Add a WildcardAssembler Plugin. #6118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Empty file.
29 changes: 29 additions & 0 deletions Ghidra/Features/WildcardAssembler/build.gradle
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
apply from: "$rootProject.projectDir/gradle/distributableGhidraModule.gradle"
apply from: "$rootProject.projectDir/gradle/javaProject.gradle"
apply from: "$rootProject.projectDir/gradle/helpProject.gradle"
apply from: "$rootProject.projectDir/gradle/jacocoProject.gradle"
apply from: "$rootProject.projectDir/gradle/javaTestProject.gradle"
apply plugin: 'eclipse'
eclipse.project.name = 'Features WildcardAssembler'

dependencies {

api project(':Base')

testImplementation project(path: ':SoftwareModeling', configuration: 'testArtifacts')
}
6 changes: 6 additions & 0 deletions Ghidra/Features/WildcardAssembler/certification.manifest
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
##VERSION: 2.0
##MODULE IP: FAMFAMFAM Icons - CC 2.5
##MODULE IP: Oxygen Icons - LGPL 3.0
Module.manifest||GHIDRA||||END|
src/main/help/help/TOC_Source.xml||GHIDRA||reviewed||END|
src/main/help/help/topics/WildcardAssemblerPlugin/Wildcard_Assembler.html||GHIDRA||||END|
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's unclear to me if I need to add something else to this file to make the documentation work properly.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you would need to add some entries to make this work. I'd say look at any project except Features Base as an example. Before you go too far, though:

  • Usually everything in Help is meant to describe things in the GUI. I suppose, in anticipation of a GUI, it might make sense to include this.
  • For API-only features, I'd recommend instead including example GhidraScripts. You can often borrow code from your unit tests, and this gives you an opportunity to demonstrate one or two use cases in prototypical fashion. I think a basic instruction pattern search could be demoed? Keep it as simple as possible, and remember what seems simple to you, the developers, may not be simple others. Even skilled users seeing this for the first time will appreciate simple examples to start.
  • It's true, there are parts of our Help that describe the internals of Ghidra, e.g., some of the decompiler and Sleigh documentation. If this is the approach you intend to take, please indicate in the text (html) that the feature is currently only available as an API for plugins and scripts to use. If you add example scripts, you can refer to them in the help. (Scripts are things the user can definitely see from the GUI.)

If you continue down the "Help" road, the way to validate your help is:

  1. Run the help builder:
    gradle buildHelp
  2. Refresh all projects in Eclipse so that it copies the resources over into the build.
  3. Run Ghidra from Eclipse, hit F1 to open help, and search for your topic.
  4. Verify your HTML displays correctly in Ghidra's help viewer. (Sadly, Swing is stuck in HTML 3, CSS 2 times.)

I might recommend formatting your help as well. Beware that Tidy (which our formatter uses) may mangle your nested list, though, so commit first, then:

gradle WildcardAssembler:tidyHelp

Because it's Gradle, you can do the build and the tidy in the same command. Don't omit the WildcardAssembler: part, though. Doing just gradle buildHelp tidyHelp will mangle all the other projects' help. Tidying is a newer practice that not all modules follow.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I'll do some combo of the above and we can edit from there :-)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added two example scripts and tweaked the documentation. I've verified that the documentation looks as expected in the generated help (Help > Contents).

I certainly could be missing something, but the gradle WildcardAssembler:tidyHelp gradle command gives me:

Cannot locate tasks that match 'WildcardAssembler:tidyHelp' as task 'tidyHelp' not found in project ':WildcardAssembler'.

Furthermore, I'm not able to find any references to 'tidyHelp' in the repo unless GitHub search is letting me down! Thanks for your ongoing help!

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tidyHelp task is simply a call to an HTML beautification library. It appears as though it is not in the repo, but instead inside of a build file that we use internally. It is not necessary for you to run this task.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That makes sense; thanks for letting me know I'm not completely crazy! 😄

Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
<?xml version='1.0' encoding='ISO-8859-1' ?>
<!--

This is an XML file intended to be parsed by the Ghidra help system. It is loosely based
upon the JavaHelp table of contents document format. The Ghidra help system uses a
TOC_Source.xml file to allow a module with help to define how its contents appear in the
Ghidra help viewer's table of contents. The main document (in the Base module)
defines a basic structure for the
Ghidra table of contents system. Other TOC_Source.xml files may use this structure to insert
their files directly into this structure (and optionally define a substructure).


In this document, a tag can be either a <tocdef> or a <tocref>. The former is a definition
of an XML item that may have a link and may contain other <tocdef> and <tocref> children.
<tocdef> items may be referred to in other documents by using a <tocref> tag with the
appropriate id attribute value. Using these two tags allows any module to define a place
in the table of contents system (<tocdef>), which also provides a place for
other TOC_Source.xml files to insert content (<tocref>).

During the help build time, all TOC_Source.xml files will be parsed and validated to ensure
that all <tocref> tags point to valid <tocdef> tags. From these files will be generated
<module name>_TOC.xml files, which are table of contents files written in the format
desired by the JavaHelp system. Additionally, the genated files will be merged together
as they are loaded by the JavaHelp system. In the end, when displaying help in the Ghidra
help GUI, there will be on table of contents that has been created from the definitions in
all of the modules' TOC_Source.xml files.


Tags and Attributes

<tocdef>
-id - the name of the definition (this must be unique across all TOC_Source.xml files)
-text - the display text of the node, as seen in the help GUI
-target** - the file to display when the node is clicked in the GUI
-sortgroup - this is a string that defines where a given node should appear under a given
parent. The string values will be sorted by the JavaHelp system using
a javax.text.RulesBasedCollator. If this attribute is not specified, then
the text of attribute will be used.

<tocref>
-id - The id of the <tocdef> that this reference points to

**The URL for the target is relative and should start with 'help/topics'. This text is
used by the Ghidra help system to provide a universal starting point for all links so that
they can be resolved at runtime, across modules.


-->


<tocroot>


</tocroot>
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<HTML>
<HEAD>
<META http-equiv="Content-Language" content="en-us">
<META http-equiv="Content-Type" content="text/html; charset=windows-1252">

<TITLE>Wildcard Assembler Plugin</TITLE>
<LINK rel="stylesheet" type="text/css" href="help/shared/DefaultStyle.css">
</HEAD>

<BODY>
<H1><A name="Wildcard_Assembler_Plugin"></A>Wildcard Assembler Plugin</H1>

<BLOCKQUOTE>
<P>The <I>Wildcard Assembler</I> extends Ghidra's assembler to enable
assembling instructions with specific tokens replaced with wildcards.</P>

<p>This assembler will return metadata for each wildcard in an assembled
instruction. This metadata includes details of which specific bits of an
assembled instruction are used to derive the value of the wildcarded token
and the expression used to derive the value.</p>

<H2>Wildcard Syntax</H2>

<P>Wildcards in instructions are specified by replacing the
to-be-wildcarded token with a wildcard name surrounded by backticks (e.g.
<CODE>`Q1`</CODE> where Q1 is an arbitrary wildcard name) and passing the
entire instruction to the Wildcard Assembler.</P>

<P>By default the Wildcard Assembler will return metadata about all
possible values that a wildcarded token could take and all the encodings
of all these values. This behavior can be limited by filtering the
wildcard by appending specific syntax after the wildcard name:</P>

<UL>
<LI><B>Numeric Filter:</B>
<UL>
<LI>Appending <CODE>[..]</CODE> will constrain the wildcarded token
to only numeric values (and not registers or other strings).</LI>
<LI>Appending <CODE>[0x0..0x100]</CODE> (where 0x0 and 0x100 are
arbitrary hexadecimal values with the smaller number first) will
constrain the wildcarded token to only numeric values between the
two given values. This can be used to ensure that the returned
encodings can hold values of a desired size. Multiple non-contiguous
ranges can be specified by separating them with commas (e.g.
<CODE>[0x0..0x5,0x1000-0x4000]</CODE>)</LI>
</UL>
</LI>
<LI><B>Regex Filter:</B>
<UL>
<LI>Appending <CODE>/ABCD</CODE> where ABCD is an arbitrary
regular expression will constrain the wildcarded token to only be
string tokens matching the given regular expression. This is most
likely used for filtering register names; for example appending
<CODE>/(sp)|(lr)</CODE> to a wildcard in a register position in
ARM assembly will limit the wildcard results to only encodings
using the <CODE>sp</CODE> or <CODE>lr</CODE> registers in that
position.</LI>
</UL>
</LI>
</UL>

<P>Normally, a wildcard will only match a single token. To allow a single
wildcard to match multiple related tokens: precede the wildcard name with a
<CODE>!</CODE> character. For example, in a x86:LE:32:default binary:</P>
<BLOCKQUOTE>
<DL>
<DT>Assembles (no wildcard):</DT>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably remove the "Assembles" and parentheses for these. Just, e.g.:

No wildcard:

For the examples that doesn't work:

Single token (does not assemble):

<DD><CODE>MOVSD.REP ES:EDI,ESI</CODE></DD>

<DT>Assembles (single token):</DT>
<DD><CODE>MOVSD.REP `Q1`:EDI,ESI</CODE></DD>

<DT>Assembles (single token):</DT>
<DD><CODE>MOVSD.REP ES:`Q2`,ESI</CODE></DD>

<DT>Does <I>NOT</I> assemble (single token):</DT>
<DD><CODE>MOVSD.REP `Q3`,ESI</CODE></DD>

<DT>Assembles (multi-token):</DT>
<DD><CODE>MOVSD.REP `!Q4`,ESI</CODE></DD>
</DL>
</BLOCKQUOTE>

<P class="providedbyplugin">Provided by: <I>Wildcard Assembler Plugin</I></P>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A Plugin is an actual configurable object in the Ghidra GUI. Because this is API only, I'd just say "Wildcard Assembler Module"


</BLOCKQUOTE>
</BODY>
</HTML>
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ghidra.asm.wild;

import java.util.List;

import ghidra.app.plugin.assembler.sleigh.sem.AssemblyConstructorSemantic;
import ghidra.app.plugin.assembler.sleigh.sem.AssemblyPatternBlock;
import ghidra.app.plugin.processors.sleigh.expression.PatternExpression;

public record WildOperandInfo(String wildcard, List<AssemblyConstructorSemantic> path,
AssemblyPatternBlock location, PatternExpression expression, Object choice) {

public WildOperandInfo shift(int amt) {
return new WildOperandInfo(wildcard, path, location.shift(amt), expression, choice);
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ghidra.asm.wild;

import ghidra.app.plugin.assembler.AssemblySelector;
import ghidra.app.plugin.assembler.sleigh.AbstractSleighAssembler;
import ghidra.app.plugin.assembler.sleigh.parse.AssemblyParser;
import ghidra.app.plugin.assembler.sleigh.sem.*;
import ghidra.app.plugin.assembler.sleigh.tree.AssemblyParseBranch;
import ghidra.app.plugin.processors.sleigh.SleighLanguage;
import ghidra.asm.wild.sem.WildAssemblyResolvedPatterns;
import ghidra.asm.wild.sem.WildAssemblyTreeResolver;
import ghidra.program.model.address.Address;
import ghidra.program.model.listing.Program;

public class WildSleighAssembler extends AbstractSleighAssembler<WildAssemblyResolvedPatterns> {

protected WildSleighAssembler(
AbstractAssemblyResolutionFactory<WildAssemblyResolvedPatterns, ?> factory,
AssemblySelector selector, SleighLanguage lang, AssemblyParser parser,
AssemblyDefaultContext defaultContext, AssemblyContextGraph ctxGraph) {
super(factory, selector, lang, parser, defaultContext, ctxGraph);
}

protected WildSleighAssembler(
AbstractAssemblyResolutionFactory<WildAssemblyResolvedPatterns, ?> factory,
AssemblySelector selector, Program program, AssemblyParser parser,
AssemblyDefaultContext defaultContext, AssemblyContextGraph ctxGraph) {
super(factory, selector, program, parser, defaultContext, ctxGraph);
}

@Override
protected WildAssemblyTreeResolver newResolver(Address at, AssemblyParseBranch tree,
AssemblyPatternBlock ctx) {
return new WildAssemblyTreeResolver(factory, lang, at, tree, ctx, ctxGraph);
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,128 @@
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ghidra.asm.wild;

import java.util.*;

import ghidra.app.plugin.assembler.AssemblySelector;
import ghidra.app.plugin.assembler.sleigh.AbstractSleighAssemblerBuilder;
import ghidra.app.plugin.assembler.sleigh.grammars.AssemblyGrammar;
import ghidra.app.plugin.assembler.sleigh.grammars.AssemblySentential;
import ghidra.app.plugin.assembler.sleigh.sem.AbstractAssemblyResolutionFactory;
import ghidra.app.plugin.assembler.sleigh.sem.AssemblyResolvedBackfill;
import ghidra.app.plugin.assembler.sleigh.symbol.*;
import ghidra.app.plugin.processors.sleigh.Constructor;
import ghidra.app.plugin.processors.sleigh.SleighLanguage;
import ghidra.app.plugin.processors.sleigh.pattern.DisjointPattern;
import ghidra.asm.wild.grammars.WildAssemblyProduction;
import ghidra.asm.wild.sem.WildAssemblyResolutionFactory;
import ghidra.asm.wild.sem.WildAssemblyResolvedPatterns;
import ghidra.asm.wild.symbol.*;
import ghidra.program.model.listing.Program;

public class WildSleighAssemblerBuilder
extends AbstractSleighAssemblerBuilder<WildAssemblyResolvedPatterns, WildSleighAssembler> {

protected final Map<AssemblySymbol, AssemblyNonTerminal> wildNTs = new HashMap<>();

public WildSleighAssemblerBuilder(SleighLanguage lang) {
super(lang);
}

@Override
protected AbstractAssemblyResolutionFactory< //
WildAssemblyResolvedPatterns, AssemblyResolvedBackfill> newResolutionFactory() {
return new WildAssemblyResolutionFactory();
}

protected WildAssemblyTerminal generateWildTerminal(AssemblySymbol t) {
if (t instanceof AssemblyNonTerminal nt) {
if ("instruction".equals(nt.getName())) {
// Never allow full instruction to be wildcarded
return null;
}
return new WildAssemblySubtableTerminal(nt.getName());
}
if (t instanceof AssemblyFixedNumericTerminal term) {
return new WildAssemblyFixedNumericTerminal(term.getVal());
}
if (t instanceof AssemblyNumericMapTerminal term) {
return new WildAssemblyNumericMapTerminal(term.getName(), term.getMap());
}
if (t instanceof AssemblyNumericTerminal term) {
return new WildAssemblyNumericTerminal(term.getName(), term.getBitSize(),
term.getSpace());
}
if (t instanceof AssemblyStringMapTerminal term) {
return new WildAssemblyStringMapTerminal(term.getName(), term.getMap());
}
if (t instanceof AssemblyStringTerminal term && term.getDefiningSymbol() != null) {
return new WildAssemblyStringTerminal(term.getString());
}
/**
* Exclude string terminals. These should be purely syntactic elements. Use of them as fixed
* literals, e.g., 1 or RAX, is an error on the spec's part.
*/
return null;
}

protected AssemblyNonTerminal createWildNonTerminal(AssemblySymbol s) {
WildAssemblyTerminal wt = generateWildTerminal(s);
if (wt == null) {
return null;
}
WildAssemblyNonTerminal nt =
new WildAssemblyNonTerminal("w`" + s.getName(), s.takesOperandIndex());
grammar.addProduction(new WildAssemblyProduction(nt, new AssemblySentential<>(s)));
grammar.addProduction(new WildAssemblyProduction(nt, new AssemblySentential<>(wt)));
return nt;
}

protected AssemblyNonTerminal getOrCreateWildNonTerminal(AssemblySymbol s) {
return wildNTs.computeIfAbsent(s, this::createWildNonTerminal);
}

protected AssemblySymbol maybeReplaceSymbol(AssemblySymbol s) {
AssemblyNonTerminal nt = getOrCreateWildNonTerminal(s);
if (nt == null) {
return s;
}
return nt;
}

@Override
protected void addProduction(AssemblyGrammar subgrammar, AssemblyNonTerminal lhs,
AssemblySentential<AssemblyNonTerminal> rhs, DisjointPattern pattern, Constructor cons,
List<Integer> indices) {
// Don't call super. We want to replace the original production
AssemblySentential<AssemblyNonTerminal> wildRhs = new AssemblySentential<>();
for (AssemblySymbol sym : rhs.getSymbols()) {
wildRhs.addSymbol(maybeReplaceSymbol(sym));
}
subgrammar.addProduction(lhs, wildRhs, pattern, cons, indices);
}

@Override
protected WildSleighAssembler newAssembler(AssemblySelector selector) {
return new WildSleighAssembler(factory, selector, lang, parser, defaultContext, ctxGraph);
}

@Override
protected WildSleighAssembler newAssembler(AssemblySelector selector, Program program) {
return new WildSleighAssembler(factory, selector, program, parser, defaultContext,
ctxGraph);
}
}
Loading