rizin icon indicating copy to clipboard operation
rizin copied to clipboard

Allow to fine grade branching analysis to fit each architecture.

Open Rot127 opened this issue 3 years ago • 0 comments

Is your feature request related to a problem? Please describe.

The analysis of basic blocks can already adapted to the user needs by settings like analysis.jmp.cref or analysis.jmp.after. Unfortunately the analysis does not obey to all of them (see: https://github.com/rizinorg/rizin/issues/2047). Although this does not seem to be a problem for x86 and arm architectures, it very much does so for the Hexagon architecture (see: https://github.com/rizinorg/rizin/pull/2073/).

Therefore it would be nice if:

  1. Each architecture has its own ARCH_basic_block_analysis function which produces reasonable results without the need to check those settings.
  2. The user could fine grade the branching analysis behavior with even more settings.

Describe the solution you'd like

  1. Add a switch statement for each architecture in run_basic_block_analysis and call its ARCH_basic_block_analysis function.
  2. Add more settings of which some of those could be:
analysis.jmp.after.outofmap     // Continue analysis if jump leaves mapped memory region.
analysis.jmp.after.reg          // Continue analysis after a register jump.
analysis.jmp.after.cond         // Continue analysis after a conditional jump.
analysis.jmp.after.outfcn       // Continue analysis if jump leads out of function.
analysis.prelude.ignore         // Do not interpret function preludes as function beginning (useful for firmware binaries).
analysis.trap.after             // Continue analysis after trap (implemented in #2073)

Describe alternatives you've considered

(1) is already an alternative solution for (2). Especially since (2) adds more to an already huge amount of analysis settings.

Additional context

None

Rot127 avatar Jan 04 '22 12:01 Rot127