arch/arch

This module provides a generic implementation of arch component. This allows declaring all relations of the interface, and defining default rules for some of them.

arch(Name:symbol)

The name of the active architecture

WARNING: Predicate not present in compiled Datalog program (Dead Code)

float_operation(Operation:symbol)

Define a set of floating point operations

WARNING: Predicate not present in compiled Datalog program (Dead Code)

interrupt_operation(Operation:symbol)

jump_operation(Operation:symbol)

An operation that may be a jump, depending on context. Use arch.jump(EA) for a defintive list of jumps.

move_operation(Operation:symbol)

Define all variants of the move operation.

load_operation(Operation:symbol)

load_word_operation(Operation:symbol)

WARNING: Predicate not present in compiled Datalog program (Dead Code)

store_operation(Operation:symbol)

conditional_operation(Operation:symbol, CC:condition_code)

conditional(EA:address, CC:condition_code)

multiplication_operation(Operation:symbol)

This can include any multiplication operations, including shift-left operation.

shift_rotate_operation(Operation:symbol)

This can include shift and rotation (right/left, arithmetic/logical) operations.

arithmetic_operation(Operation:symbol)

This can include any kinds of arithmetic operations including arithmetic shifts and multiplications.

WARNING: Predicate not present in compiled Datalog program (Dead Code)

logic_operation(Operation:symbol)

This can include logical operations including bitwise operations.

call_operation(Operation:symbol)

syscall_operation(Operation:symbol)

return_operation(Operation:symbol)

halt_operation(Operation:symbol)

cmp_operation(Operation:symbol)

May include operations that:

  • compare two values and implicitly set flags, e.g, Intel “CMP”

  • compare two values in a manner other than subtraction, e.g, Intel “TEST”

  • make a comparison and branch, e.g., mips32 “BEQZ”

cmp_zero_operation(Operation:symbol)

Comparison operations where a value is implicitly compared to zero.

Comparison may occur within an instruction that is also a branch operation, e.g., “BEQZ” on MIPS.

jump_operation_op_index(Operation:symbol, operand_index:operand_index)

call_operation_op_index(Operation:symbol, operand_index:operand_index)

move_reg_reg(EA:address, Dst:register, Src:register)

Moves from a register to a register; a move does not transform the value (except by sign extension).

Dst and Src may be untracked registers.

move_reg_imm(EA:address, Dst:register, Imm:number, ImmIndex:operand_index)

Moves an immediate value to a register.

Dst may be an untracked register.

move(EA:address)

WARNING: Predicate not present in compiled Datalog program (Dead Code)

is_nop(EA:address)

return(EA:address)

Returns

jump(EA:address)

call(EA:address, DestOperandIndex:operand_index)

memory_access_aggregated(AccessType:symbol, EA:address, BaseReg:reg_nullable, IndexReg:reg_nullable, Mult:number, Offset:number, AccessSize:unsigned)

Represents a load or store of a given instruction at EA.

This rule can represent complex vector loads, the semantics of which memory_access cannot accommodate. E.g., vld2.32, etc., in arm neon

AccesSize: The size of the entire consecutive memory that the given

instruction at EA accesses.

memory_access(AccessType:symbol, EA:address, SrcOp:operand_index, DstOp:operand_index, DirectReg:register, BaseReg:reg_nullable, IndexReg:reg_nullable, Mult:number, Offset:number)

Represents a load or store of a register.

The address of the accessed memory is of the form:

BaseReg + IndexReg * Mult + Offset

Complex memory accesses may be represented with multiple members of this relation at the same address. For example, the arm64 instruction:

0x1000: ldp x7, x8, [x0, #10]

generates two arch.memory_access members:

memory_access(“LOAD”,0x1000,2,3,”X7”,”X0”,”NONE”,0,10) memory_access(“LOAD”,0x1000,2,1,”X8”,”X0”,”NONE”,0,18)

AccessType is either “LOAD” or “STORE” DirectReg, BaseReg, and IndexReg may be untracked registers or unstandardized names.

load(EA:address, SrcOp:operand_index, DstOp:operand_index, DstReg:register, BaseReg:reg_nullable, IndexReg:reg_nullable, Mult:number, Offset:number)

Represents a load from memory to a register.

See arch.memory_access().

WARNING: Predicate not present in compiled Datalog program (Dead Code)

store(EA:address, SrcOp:operand_index, DstOp:operand_index, SrcReg:register, BaseReg:reg_nullable, IndexReg:reg_nullable, Mult:number, Offset:number)

Represents a store from a register to memory.

See arch.memory_access().

WARNING: Predicate not present in compiled Datalog program (Dead Code)

store_immediate(EA:address, SrcOp:operand_index, DstOp:operand_index, Immediate:number, BaseReg:reg_nullable, IndexReg:reg_nullable, Mult:number, Offset:number)

Represents the store of an immediate to memory. The address of the written memory is: BaseReg + IndexReg * Mult + Offset. The immediate stored to memory is Immediate.

This is not instantiatied for all architectures but it is defined here to maintain a uniform interface. E.g. It is possible in x86 but not in ARM.

delay_slot(BranchEA:address, EA:address)

data_access_size(Operation:symbol, DestReg:register, Size:unsigned)

These operations are either special like LEA (does not read memory) or are not decoded correctly from capstone

  • Operation: Operation name

  • DestReg: The destination register of the operation

  • Size: Data-access size in bytes

reg_arithmetic_operation(EA:address, Dst:register, Src:register, Mult:number, Offset:number)

Arithmetic operation on one source register of the form Dst = Src * Mult + Offset

reg_reg_arithmetic_operation(EA:address, Dst:register, Src1:register, Src2:register, Mult:number, Offset:number)

Arithmetic operation on two source registers of the form Dst = Src1 + Src2 * Mult + Offset

Note: Src1 and Src2 may be the same register.

reg_reg_bitwise_binary_op(EA:address, Dst:register, Src1:register, Src2:register, Op:symbol)

Bitwise operation on two source of the form Dst = Src1 op Src2

op—– ASR: Arithmetic Shift Right LSR: Logical Shift Right LSL: Logical Shift Left AND: Bitwise AND OR: Bitwise OR XOR: Bitwise Exclusive OR

Note: The second source is either a register or an immediate.

reg_imm_bitwise_binary_op(EA:address, Dst:register, Src:register, Imm:number, Op:symbol)

extend_reg(EA:address, Reg:register, Signed:unsigned, SrcBits:unsigned)

A value in a register is zero/sign-extended.

The initial value to be extended is SrcBits wide.

A value of 0 for Signed indicates the value is zero-extended, while 1 indicates that it is sign-extended.

If the register is used for other operations in the instruction, it is assumed the sign extension occurs first.

extend_load(EA:address, Signed:unsigned, SrcBits:unsigned)

A value loaded from memory is zero/sign-extended.

register_access_override(EA:address, Register:register, Access:access_mode, Enable:unsigned)

Override the register access mode reported by Capstone

The Enable field indicates if the (EA,Register,Access) tuple should be a logical addition to register_access (Enable = 1) or ignored if it is in register_access (Enable = 0).

op_access_override(EA:address, Index:operand_index, Access:access_mode, Enable:unsigned)

Override the operand access mode reported by Capstone.

The Enable field indicates if the (EA,Register,Access) tuple should be a logical addition to instruction_op_access (Enable = 1) or ignored if it is in instruction_op_access (Enable = 0).

reg_relative_load(LoadEA:address, Reg:register, Offset:number, Size:unsigned)

Data is loaded from a register-relative address.

simple_data_load(EA:address, Data:address, Size:unsigned)

A single instruction reads data with a predetermined size and location

reg_map_rule(RegIn:input_reg, Reg:register)

Defines explicit register mappings.

function_non_maintained_reg(Reg:register)

This specifies the registers whose value is not kept through a function call according to the architecture’s calling convention.

WARNING: Predicate not present in compiled Datalog program (Dead Code)

pc_reg(Reg:register)

The PC register, if architecturally accessible.

WARNING: Predicate not present in compiled Datalog program (Dead Code)

frame_pointer(Reg:register)

Register that may hold the stack frame pointer.

The frame pointer is often also a general_purpose_reg.

stack_pointer(Reg:register)

Register that may hold the stack pointer.

return_reg(Reg:register)

Registers that hold the return value of a function.

general_purpose_reg(Reg:register)

Registers that may be used for general purpose calculations.

zero_reg(Reg:register)

A register with a constant value of zero.

integer_reg_param(Reg:register, Index:unsigned)

Registers used for passing function arguments by calling convention: e.g., {r0-r3} for ARM32, {rcx,rdx,r8,r9} for Microsoft x64, etc.

float_reg(Reg:register, Size:unsigned)

Floating-point registers

condition_flags_reg(Reg:register)

The register that holds condition flags.

pc_relative_addr(EA:address, Reg:register, Target:address)

A pc-relative address ‘Target’ is loaded into ‘Reg’ at address ‘EA’.

instruction_at(EA:address, Instruction:address)

Maps instruction identifier address to the instruction’s real memory address.

While this is a simple one-to-one mapping on most architectures, Thumb instructions on ARM are offset by 1 byte. This relation makes it easier to write portable rules.

Maps all instructions in the instruction input relation, regardless of invalid(), etc.

alignment_required(EA:address, AlignInBits:unsigned)

Instruction at EA requires alignment on the referenced memory.

register_size_bytes(Reg:input_reg, Size:unsigned)

The size of a register, in bytes.

loop_prefix(Prefix:symbol)

pointer_size(N:unsigned)

WARNING: Predicate not present in compiled Datalog program (Dead Code)