binary/pe/symbolization
PE-specific rules and relations for symbolization
- reg_has_base_image(EA:address, Reg:register)
Uses:
arch.memory_access,arch.move_reg_reg,arch.reg_reg_arithmetic_operation,base_address,binary_format,instruction,pc_relative_operand,reg_def_use.defRecursive:
const_value_reg_used,function_inference.function_entry_initial,no_return_call_propagated,next_end,may_fallthrough,jump_table_candidate,block_candidate_boundaries,unresolved_interval_order,inferred_main_in_reg,reg_def_use.return_val_used,inter_procedural_edge,compare_and_jump_immediate,block_limit,value_reg_edge,block_next,reg_has_base_image,stack_def_use.block_last_def,possible_target_from,no_return_block,indefinite_litpool_ref,stack_def_use.used_in_block,adjusts_stack_in_block,split_load_total_points,jump_table_candidate_refined,overlap_with_litpool,value_reg_limit,code_in_block_candidate,candidate_block_is_not_padding,likely_fallthrough,arch.reg_relative_load,arm_jump_table_cmp_limit,value_reg_unsupported,nop_in_padding_candidate,arm_jump_table_block_start,__agg_subclause2,transition_block_limit,block_overlap,no_return_call,data_segment,jump_table_element_access,reg_def_use.flow_def,arm_jump_table_skip_first_entry,block_total_points,stack_def_use.defined_in_block,reg_def_use.ambiguous_last_def_in_block,straight_line_def_used,basic_target,symbol_minus_symbol_litpool_access_pattern,value_reg,reg_def_use.live_var_used,compare_and_jump_indirect_op_valid,litpool_ref,padding_block_candidate,self_contained_segment,data_in_code_propagate,unresolved_interval,unlikely_have_symbolic_immediate,symbolic_expr_from_relocation,hi_load_prop,block_points,wis_memo,split_load_for_symbolization,arm_jump_table_data_block_limit,adrp_used,known_block,wis_has_prior,candidate_block_is_padding,no_return_call_refined,data_in_code,reg_def_use.used,is_padding,reg_def_use.ref_in_block,base_relative_operand,def_used_for_address,reg_def_use.live_var_at_prior_used,block_heuristic,relative_address_start,tls_get_addr,__agg_subclause6,instruction_memory_access_size,start_function,arm_jump_table_candidate,first_block_in_byte_interval,stack_base_reg_move,__agg_subclause3,jump_table_target,base_relative_operation,resolved_reaches,next_start,reg_def_use.live_var_def,must_fallthrough,next_type,arm_jump_table_candidate_start,next_block_in_byte_interval,__agg_single3,split_load,indexed_pc_relative_load_relative,block_instruction_next,stack_def_use.live_var_used_in_block,cmp_defines,block,reg_def_use.block_last_def,overlapping_instruction,code_in_block,no_value_reg_limit,jump_table_signed,impossible_block,block_boundaries,wis_prior,composite_data_access,relocation_adjustment_total,discarded_block,stack_def_use.last_def_in_block,indexed_pc_relative_load,__agg_single6,stack_def_use.live_var_at_block_end,after_end,split_load_candidate,incomplete_block,straight_line_last_def,jump_table_max,block_points_proportional,wis_schedule,arm_jump_table_data_block,compare_and_jump_register,block_candidate_dependency_edge,reg_has_got,data_block_candidate,got_relative_operand,contains_plausible_instr_seq,reg_def_use.ambiguous_block_last_def,invalid_jump_table_candidate,possible_target,relative_address,cmp_reg_to_reg,reg_def_use.def_used,cinf_ldr_add_pc,block_implies_block,contains_implausible_instr_seq,split_load_point,call_tls_get_addr,unresolved_block,split_load_operand,inferred_main_dispatch,gp_relative_operand,code_in_block_candidate_refined,reg_reg_arithmetic_operation_defs,litpool_symbolic_operand,data_access,init_symbol_minus_symbol_candidate_arm,plt_block,invalid,litpool_boundaries,segment_target_range,correlated_live_reg,arm_jump_table_block_instruction,simple_data_access_pattern,reg_def_use.live_var_at_block_end,reg_def_use.defined_in_block,block_last_instruction,flags_and_jump_pair,split_load_conflict,data_block_limit,last_value_reg_limit,reg_used_for,initialized_data_segment,__agg_subclause7,stack_def_use.live_var_at_prior_used,jump_table_start,unresolved_block_overlap,arch.extend_load,stack_def_use.def_used,init_ldr_add_pc,litpool_confidence,tls_desc_call,common_tail,stack_def_use.ref_in_block,arch.simple_data_load,reg_def_use.used_in_block,base_relative_jump,branch_to_calculated_pc_rel_addr,stack_def_use.live_var_def,wis_schedule_iter,jump_table_prelude,negative_block_heuristic,relocation_adjustment,compare_and_jump_indirect,reg_def_use.last_def_in_block,relative_jump_table_entry_candidate,discarded_split_load,__agg_single2,padding_block_limit,reg_def_use.return_block_end,plt_entry,stack_def_use.live_var_used
- possible_rva_operand(EA:address, Index:operand_index, Dest:address)
Uses:
base_address,instruction_get_op,loaded_section,op_indirectUsed by:
base_relative_operand
- base_relative_operand(EA:address, Index:operand_index, Dest:address)
Uses:
arch.reg_reg_arithmetic_operation,instruction,instruction_get_op,op_indirect,possible_rva_operandUsed by:
base_relative_symbolic_operand,symbol_minus_symbolRecursive:
const_value_reg_used,function_inference.function_entry_initial,no_return_call_propagated,next_end,may_fallthrough,jump_table_candidate,block_candidate_boundaries,unresolved_interval_order,inferred_main_in_reg,reg_def_use.return_val_used,inter_procedural_edge,compare_and_jump_immediate,block_limit,value_reg_edge,block_next,reg_has_base_image,stack_def_use.block_last_def,possible_target_from,no_return_block,indefinite_litpool_ref,stack_def_use.used_in_block,adjusts_stack_in_block,split_load_total_points,jump_table_candidate_refined,overlap_with_litpool,value_reg_limit,code_in_block_candidate,candidate_block_is_not_padding,likely_fallthrough,arch.reg_relative_load,arm_jump_table_cmp_limit,value_reg_unsupported,nop_in_padding_candidate,arm_jump_table_block_start,__agg_subclause2,transition_block_limit,block_overlap,no_return_call,data_segment,jump_table_element_access,reg_def_use.flow_def,arm_jump_table_skip_first_entry,block_total_points,stack_def_use.defined_in_block,reg_def_use.ambiguous_last_def_in_block,straight_line_def_used,basic_target,symbol_minus_symbol_litpool_access_pattern,value_reg,reg_def_use.live_var_used,compare_and_jump_indirect_op_valid,litpool_ref,padding_block_candidate,self_contained_segment,data_in_code_propagate,unresolved_interval,unlikely_have_symbolic_immediate,symbolic_expr_from_relocation,hi_load_prop,block_points,wis_memo,split_load_for_symbolization,arm_jump_table_data_block_limit,adrp_used,known_block,wis_has_prior,candidate_block_is_padding,no_return_call_refined,data_in_code,reg_def_use.used,is_padding,reg_def_use.ref_in_block,base_relative_operand,def_used_for_address,reg_def_use.live_var_at_prior_used,block_heuristic,relative_address_start,tls_get_addr,__agg_subclause6,instruction_memory_access_size,start_function,arm_jump_table_candidate,first_block_in_byte_interval,stack_base_reg_move,__agg_subclause3,jump_table_target,base_relative_operation,resolved_reaches,next_start,reg_def_use.live_var_def,must_fallthrough,next_type,arm_jump_table_candidate_start,next_block_in_byte_interval,__agg_single3,split_load,indexed_pc_relative_load_relative,block_instruction_next,stack_def_use.live_var_used_in_block,cmp_defines,block,reg_def_use.block_last_def,overlapping_instruction,code_in_block,no_value_reg_limit,jump_table_signed,impossible_block,block_boundaries,wis_prior,composite_data_access,relocation_adjustment_total,discarded_block,stack_def_use.last_def_in_block,indexed_pc_relative_load,__agg_single6,stack_def_use.live_var_at_block_end,after_end,split_load_candidate,incomplete_block,straight_line_last_def,jump_table_max,block_points_proportional,wis_schedule,arm_jump_table_data_block,compare_and_jump_register,block_candidate_dependency_edge,reg_has_got,data_block_candidate,got_relative_operand,contains_plausible_instr_seq,reg_def_use.ambiguous_block_last_def,invalid_jump_table_candidate,possible_target,relative_address,cmp_reg_to_reg,reg_def_use.def_used,cinf_ldr_add_pc,block_implies_block,contains_implausible_instr_seq,split_load_point,call_tls_get_addr,unresolved_block,split_load_operand,inferred_main_dispatch,gp_relative_operand,code_in_block_candidate_refined,reg_reg_arithmetic_operation_defs,litpool_symbolic_operand,data_access,init_symbol_minus_symbol_candidate_arm,plt_block,invalid,litpool_boundaries,segment_target_range,correlated_live_reg,arm_jump_table_block_instruction,simple_data_access_pattern,reg_def_use.live_var_at_block_end,reg_def_use.defined_in_block,block_last_instruction,flags_and_jump_pair,split_load_conflict,data_block_limit,last_value_reg_limit,reg_used_for,initialized_data_segment,__agg_subclause7,stack_def_use.live_var_at_prior_used,jump_table_start,unresolved_block_overlap,arch.extend_load,stack_def_use.def_used,init_ldr_add_pc,litpool_confidence,tls_desc_call,common_tail,stack_def_use.ref_in_block,arch.simple_data_load,reg_def_use.used_in_block,base_relative_jump,branch_to_calculated_pc_rel_addr,stack_def_use.live_var_def,wis_schedule_iter,jump_table_prelude,negative_block_heuristic,relocation_adjustment,compare_and_jump_indirect,reg_def_use.last_def_in_block,relative_jump_table_entry_candidate,discarded_split_load,__agg_single2,padding_block_limit,reg_def_use.return_block_end,plt_entry,stack_def_use.live_var_used
- base_relative_symbolic_operand(EA:address, Index:operand_index, Dest:address)
Uses:
+disconnected0,base_relative_operand,instruction_displacement_offset,instruction_get_op,op_indirect,pc_relative_operandUsed by:
moved_label_classRecursive:
data_object_conflict,labeled_data_candidate,boundary_sym_expr,symbolic_expr_symbol_minus_symbol,data_object,resolved_transfer,function_inference.function_entry,string_candidate,moved_data_label,labeled_ea,value_reg_address_before,code_pointer_in_data,moved_label_candidate,symbolic_operand_point,discarded_jump_table_entry,data_object_total_points,inferred_special_symbol,data_limit,next_data_limit,code_in_refined_block,data_access_limit,symbol_minus_symbol_from_relocation,+disconnected3,moved_displacement_candidate,best_func_symbol,main_function,data_object_point,data_limit_after_access,symbolic_data,string_candidate_refined,preferred_data_access,address_array,symbolic_expr,split_block,refined_block,moved_label,moved_pc_relative_candidate,+disconnected6,code_in_split_block,+disconnected2,after_address_in_data,address_array_aux,next_address_in_data,best_symexpr_symbol,data_object_candidate,symbolic_expr_attribute,+disconnected1,symbolic_operand_attribute,symbolic_operand,got_reference,block_needs_splitting_at,jump_table,label_conflict,symbol_minus_symbol,block_needs_merging,relative_jump_table_entry,base_relative_symbolic_operand,symbol_minus_symbol_candidate,discarded_data_object,symbol_score,inferred_main_function
- base_relative_operation(EA_relop:address, EA:address)
Recursive:
const_value_reg_used,function_inference.function_entry_initial,no_return_call_propagated,next_end,may_fallthrough,jump_table_candidate,block_candidate_boundaries,unresolved_interval_order,inferred_main_in_reg,reg_def_use.return_val_used,inter_procedural_edge,compare_and_jump_immediate,block_limit,value_reg_edge,block_next,reg_has_base_image,stack_def_use.block_last_def,possible_target_from,no_return_block,indefinite_litpool_ref,stack_def_use.used_in_block,adjusts_stack_in_block,split_load_total_points,jump_table_candidate_refined,overlap_with_litpool,value_reg_limit,code_in_block_candidate,candidate_block_is_not_padding,likely_fallthrough,arch.reg_relative_load,arm_jump_table_cmp_limit,value_reg_unsupported,nop_in_padding_candidate,arm_jump_table_block_start,__agg_subclause2,transition_block_limit,block_overlap,no_return_call,data_segment,jump_table_element_access,reg_def_use.flow_def,arm_jump_table_skip_first_entry,block_total_points,stack_def_use.defined_in_block,reg_def_use.ambiguous_last_def_in_block,straight_line_def_used,basic_target,symbol_minus_symbol_litpool_access_pattern,value_reg,reg_def_use.live_var_used,compare_and_jump_indirect_op_valid,litpool_ref,padding_block_candidate,self_contained_segment,data_in_code_propagate,unresolved_interval,unlikely_have_symbolic_immediate,symbolic_expr_from_relocation,hi_load_prop,block_points,wis_memo,split_load_for_symbolization,arm_jump_table_data_block_limit,adrp_used,known_block,wis_has_prior,candidate_block_is_padding,no_return_call_refined,data_in_code,reg_def_use.used,is_padding,reg_def_use.ref_in_block,base_relative_operand,def_used_for_address,reg_def_use.live_var_at_prior_used,block_heuristic,relative_address_start,tls_get_addr,__agg_subclause6,instruction_memory_access_size,start_function,arm_jump_table_candidate,first_block_in_byte_interval,stack_base_reg_move,__agg_subclause3,jump_table_target,base_relative_operation,resolved_reaches,next_start,reg_def_use.live_var_def,must_fallthrough,next_type,arm_jump_table_candidate_start,next_block_in_byte_interval,__agg_single3,split_load,indexed_pc_relative_load_relative,block_instruction_next,stack_def_use.live_var_used_in_block,cmp_defines,block,reg_def_use.block_last_def,overlapping_instruction,code_in_block,no_value_reg_limit,jump_table_signed,impossible_block,block_boundaries,wis_prior,composite_data_access,relocation_adjustment_total,discarded_block,stack_def_use.last_def_in_block,indexed_pc_relative_load,__agg_single6,stack_def_use.live_var_at_block_end,after_end,split_load_candidate,incomplete_block,straight_line_last_def,jump_table_max,block_points_proportional,wis_schedule,arm_jump_table_data_block,compare_and_jump_register,block_candidate_dependency_edge,reg_has_got,data_block_candidate,got_relative_operand,contains_plausible_instr_seq,reg_def_use.ambiguous_block_last_def,invalid_jump_table_candidate,possible_target,relative_address,cmp_reg_to_reg,reg_def_use.def_used,cinf_ldr_add_pc,block_implies_block,contains_implausible_instr_seq,split_load_point,call_tls_get_addr,unresolved_block,split_load_operand,inferred_main_dispatch,gp_relative_operand,code_in_block_candidate_refined,reg_reg_arithmetic_operation_defs,litpool_symbolic_operand,data_access,init_symbol_minus_symbol_candidate_arm,plt_block,invalid,litpool_boundaries,segment_target_range,correlated_live_reg,arm_jump_table_block_instruction,simple_data_access_pattern,reg_def_use.live_var_at_block_end,reg_def_use.defined_in_block,block_last_instruction,flags_and_jump_pair,split_load_conflict,data_block_limit,last_value_reg_limit,reg_used_for,initialized_data_segment,__agg_subclause7,stack_def_use.live_var_at_prior_used,jump_table_start,unresolved_block_overlap,arch.extend_load,stack_def_use.def_used,init_ldr_add_pc,litpool_confidence,tls_desc_call,common_tail,stack_def_use.ref_in_block,arch.simple_data_load,reg_def_use.used_in_block,base_relative_jump,branch_to_calculated_pc_rel_addr,stack_def_use.live_var_def,wis_schedule_iter,jump_table_prelude,negative_block_heuristic,relocation_adjustment,compare_and_jump_indirect,reg_def_use.last_def_in_block,relative_jump_table_entry_candidate,discarded_split_load,__agg_single2,padding_block_limit,reg_def_use.return_block_end,plt_entry,stack_def_use.live_var_used
- base_relative_jump(EA_relop:address, EA:address)
Uses:
reg_jumpRecursive:
const_value_reg_used,function_inference.function_entry_initial,no_return_call_propagated,next_end,may_fallthrough,jump_table_candidate,block_candidate_boundaries,unresolved_interval_order,inferred_main_in_reg,reg_def_use.return_val_used,inter_procedural_edge,compare_and_jump_immediate,block_limit,value_reg_edge,block_next,reg_has_base_image,stack_def_use.block_last_def,possible_target_from,no_return_block,indefinite_litpool_ref,stack_def_use.used_in_block,adjusts_stack_in_block,split_load_total_points,jump_table_candidate_refined,overlap_with_litpool,value_reg_limit,code_in_block_candidate,candidate_block_is_not_padding,likely_fallthrough,arch.reg_relative_load,arm_jump_table_cmp_limit,value_reg_unsupported,nop_in_padding_candidate,arm_jump_table_block_start,__agg_subclause2,transition_block_limit,block_overlap,no_return_call,data_segment,jump_table_element_access,reg_def_use.flow_def,arm_jump_table_skip_first_entry,block_total_points,stack_def_use.defined_in_block,reg_def_use.ambiguous_last_def_in_block,straight_line_def_used,basic_target,symbol_minus_symbol_litpool_access_pattern,value_reg,reg_def_use.live_var_used,compare_and_jump_indirect_op_valid,litpool_ref,padding_block_candidate,self_contained_segment,data_in_code_propagate,unresolved_interval,unlikely_have_symbolic_immediate,symbolic_expr_from_relocation,hi_load_prop,block_points,wis_memo,split_load_for_symbolization,arm_jump_table_data_block_limit,adrp_used,known_block,wis_has_prior,candidate_block_is_padding,no_return_call_refined,data_in_code,reg_def_use.used,is_padding,reg_def_use.ref_in_block,base_relative_operand,def_used_for_address,reg_def_use.live_var_at_prior_used,block_heuristic,relative_address_start,tls_get_addr,__agg_subclause6,instruction_memory_access_size,start_function,arm_jump_table_candidate,first_block_in_byte_interval,stack_base_reg_move,__agg_subclause3,jump_table_target,base_relative_operation,resolved_reaches,next_start,reg_def_use.live_var_def,must_fallthrough,next_type,arm_jump_table_candidate_start,next_block_in_byte_interval,__agg_single3,split_load,indexed_pc_relative_load_relative,block_instruction_next,stack_def_use.live_var_used_in_block,cmp_defines,block,reg_def_use.block_last_def,overlapping_instruction,code_in_block,no_value_reg_limit,jump_table_signed,impossible_block,block_boundaries,wis_prior,composite_data_access,relocation_adjustment_total,discarded_block,stack_def_use.last_def_in_block,indexed_pc_relative_load,__agg_single6,stack_def_use.live_var_at_block_end,after_end,split_load_candidate,incomplete_block,straight_line_last_def,jump_table_max,block_points_proportional,wis_schedule,arm_jump_table_data_block,compare_and_jump_register,block_candidate_dependency_edge,reg_has_got,data_block_candidate,got_relative_operand,contains_plausible_instr_seq,reg_def_use.ambiguous_block_last_def,invalid_jump_table_candidate,possible_target,relative_address,cmp_reg_to_reg,reg_def_use.def_used,cinf_ldr_add_pc,block_implies_block,contains_implausible_instr_seq,split_load_point,call_tls_get_addr,unresolved_block,split_load_operand,inferred_main_dispatch,gp_relative_operand,code_in_block_candidate_refined,reg_reg_arithmetic_operation_defs,litpool_symbolic_operand,data_access,init_symbol_minus_symbol_candidate_arm,plt_block,invalid,litpool_boundaries,segment_target_range,correlated_live_reg,arm_jump_table_block_instruction,simple_data_access_pattern,reg_def_use.live_var_at_block_end,reg_def_use.defined_in_block,block_last_instruction,flags_and_jump_pair,split_load_conflict,data_block_limit,last_value_reg_limit,reg_used_for,initialized_data_segment,__agg_subclause7,stack_def_use.live_var_at_prior_used,jump_table_start,unresolved_block_overlap,arch.extend_load,stack_def_use.def_used,init_ldr_add_pc,litpool_confidence,tls_desc_call,common_tail,stack_def_use.ref_in_block,arch.simple_data_load,reg_def_use.used_in_block,base_relative_jump,branch_to_calculated_pc_rel_addr,stack_def_use.live_var_def,wis_schedule_iter,jump_table_prelude,negative_block_heuristic,relocation_adjustment,compare_and_jump_indirect,reg_def_use.last_def_in_block,relative_jump_table_entry_candidate,discarded_split_load,__agg_single2,padding_block_limit,reg_def_use.return_block_end,plt_entry,stack_def_use.live_var_used
- dos_header_symbolic_operand(EA:address, Dest:unsigned)
WARNING: Predicate not present in compiled Datalog program (Dead Code)