arch/arm32_jump_tables

Define a set predicates to detect jump-tables for ARM32

arm_jump_table_block_instruction(EA:address, EA_jump:address)

Instructions in the same block as the jumptable’s jump instruction.

arm_jump_table_block_start(Block:address, EA_jump:address)

The start of the block containing the jumptable’s jump instruction.

Can be used before code_in_block_candidate.

indexed_pc_relative_load(EA:address, DstReg:register, LoadFrom:address, IndexReg:reg_nullable, Size:unsigned)

PC-relative loads using an index register

indexed_pc_relative_load_relative(EA:address, DstReg:register, LoadFrom:address, IndexReg:reg_nullable, Size:unsigned, EA_add:address, Reference:address)

Specialization of indexed_pc_relative_load, where the result in an arithmetic operation indicating a relative jump table.

thumb_jumptable_instruction(Operation:symbol, Size:unsigned)

Thumb jump table instructions “TBB” and “TBH” and their entry sizes.

arm_jump_table_candidate_target(Type:symbol, Thumb:unsigned, EA:address, Reference:address, Size:unsigned, Scale:unsigned, TargetAddr:address)

Compute the target address for the given unsigned relative jump-table entry.

Type: Target type (“rel_unsigned”, “rel_signed”, or “absolute”) EA: An entry of a relative jump-table Thumb: lowest address bit of the jumping instruction Reference: The Base from which offsets are relative Size: The size of the entry Scale: The scale amount is multiplied to the entry value AlignedTargetAddr: The computed target address is aligned

WARNING: Predicate not present in compiled Datalog program (Dead Code)

arm_jump_table_skip_first_entry(EA_jump:address)

Indicates the jump table used be EA_jump is allowed to skip the first entry in the table.

Sometimes the compiler knows the index is non-zero, and puts padding in the starting entry. We have observed a couple of cases where this is necessary:

  • zero padding in a tbb jump table

  • ”bpkt #0” as padding in ARM ldr/add in libRSCpuRef.so

arm_jump_table_cmp_limit(Jmp:address, TableStart:address, Count:number)

The value compared against just before entering the jumptable’s block.

This is typically the number of jumptable entries, so we use it to create one big data block instead of smaller ones. We prefer this if we can identify the comparison, because it’s a definitive limit on the jumptable size.

arm_jump_table_data_block(EA_jmp:address, TableStart:address, Block:address, Size:address)

Generate data block candidates for the jump table entries. We try to generate one big block, but split it at any possible jump target. This allows the block_points rules to decide whether the conflicts are data or code.