binary/pe/symbolization
PE-specific rules and relations for symbolization
- reg_has_base_image(EA:address, Reg:register)
Uses:
arch.memory_access,arch.move_reg_reg,arch.reg_reg_arithmetic_operation,base_address,binary_format,instruction,pc_relative_operand,reg_def_use.defRecursive:
cmp_defines,first_block_in_byte_interval,overlapping_instruction,split_load_for_symbolization,relocation_adjustment,call_tls_get_addr,simple_data_access_pattern,reg_def_use.def_used,base_relative_operand,split_load_total_points,block,litpool_confidence,reg_has_got,value_reg_limit,stack_def_use.live_var_used,split_load_point,split_load_operand,flags_and_jump_pair,wis_schedule_iter,unresolved_interval,code_in_block,compare_and_jump_indirect_op_valid,__agg_subclause3,inferred_main_in_reg,reg_used_for,is_padding,resolved_reaches,compare_and_jump_indirect,__agg_subclause2,padding_block_candidate,reg_reg_arithmetic_operation_defs,def_used_for_address,impossible_block,plt_block,arm_jump_table_block_instruction,composite_data_access,possible_target_from,jump_table_candidate_refined,base_relative_operation,split_load,__agg_single3,reg_has_base_image,no_value_reg_limit,relative_address_start,wis_schedule,plt_entry,reg_def_use.used_in_block,adjusts_stack_in_block,possible_target,initialized_data_segment,reg_def_use.live_var_at_block_end,cmp_reg_to_reg,indefinite_litpool_ref,negative_block_heuristic,contains_implausible_instr_seq,indexed_pc_relative_load,next_block_in_byte_interval,code_in_block_candidate,symbolic_expr_from_relocation,unlikely_have_symbolic_immediate,incomplete_block,arm_jump_table_data_block_limit,inferred_main_dispatch,arch.simple_data_load,data_block_limit,block_total_points,invalid_jump_table_candidate,stack_def_use.live_var_def,reg_def_use.live_var_def,arm_jump_table_block_start,block_overlap,stack_base_reg_move,may_fallthrough,__agg_single2,block_heuristic,__agg_subclause9,block_implies_block,segment_target_range,stack_def_use.live_var_at_prior_used,cinf_ldr_add_pc,no_return_call_propagated,unresolved_block_overlap,jump_table_max,common_tail,unresolved_interval_order,tls_get_addr,block_points_proportional,likely_fallthrough,block_boundaries,jump_table_element_access,block_points,invalid,jump_table_target,reg_def_use.used,arm_jump_table_candidate,reg_def_use.live_var_at_prior_used,no_return_call,arm_jump_table_skip_first_entry,stack_def_use.defined_in_block,split_load_conflict,arm_jump_table_candidate_start,stack_def_use.live_var_at_block_end,reg_def_use.last_def_in_block,arm_jump_table_cmp_limit,data_in_code,candidate_block_is_not_padding,inter_procedural_edge,known_block,instruction_memory_access_size,overlap_with_litpool,block_limit,function_inference.function_entry_initial,init_symbol_minus_symbol_candidate_arm,const_value_reg_used,self_contained_segment,stack_def_use.last_def_in_block,must_fallthrough,straight_line_last_def,padding_block_limit,jump_table_candidate,no_return_call_refined,block_candidate_dependency_edge,split_load_candidate,stack_def_use.block_last_def,last_value_reg_limit,relative_address,no_return_block,litpool_ref,symbol_minus_symbol_litpool_access_pattern,block_last_instruction,gp_relative_operand,data_in_code_propagate,block_candidate_boundaries,basic_target,compare_and_jump_immediate,wis_memo,__agg_subclause6,nop_in_padding_candidate,reg_def_use.defined_in_block,__agg_single6,relocation_adjustment_total,candidate_block_is_padding,wis_prior,reg_def_use.live_var_used,__agg_subclause7,wis_has_prior,compare_and_jump_register,block_instruction_next,arm_jump_table_data_block,value_reg,contains_plausible_instr_seq,relative_jump_table_entry_candidate,adrp_used,stack_def_use.def_used,got_relative_operand,__agg_subclause10,value_reg_edge,arch.reg_relative_load,reg_def_use.flow_def,hi_load_prop,jump_table_start,branch_to_calculated_pc_rel_addr,tls_desc_call,discarded_block,stack_def_use.live_var_used_in_block,data_segment,value_reg_unsupported,block_next,discarded_split_load,indexed_pc_relative_load_relative,litpool_symbolic_operand,data_block_candidate,reg_def_use.return_block_end,code_in_block_candidate_refined,after_end,jump_table_signed,reg_def_use.block_last_def,base_relative_jump,unresolved_interval_best_block,straight_line_def_used,unresolved_block,data_access,correlated_live_reg,jump_table_prelude,litpool_boundaries,init_ldr_add_pc,arch.extend_load,stack_def_use.used_in_block,stack_def_use.ref_in_block,reg_def_use.ref_in_block,reg_def_use.return_val_used
- possible_rva_operand(EA:address, Index:operand_index, Dest:address)
Uses:
base_address,instruction_get_op,loaded_section,op_indirectUsed by:
base_relative_operand
- base_relative_operand(EA:address, Index:operand_index, Dest:address)
Uses:
arch.reg_reg_arithmetic_operation,instruction,instruction_get_op,op_indirect,possible_rva_operandUsed by:
base_relative_symbolic_operand,symbol_minus_symbolRecursive:
cmp_defines,first_block_in_byte_interval,overlapping_instruction,split_load_for_symbolization,relocation_adjustment,call_tls_get_addr,simple_data_access_pattern,reg_def_use.def_used,base_relative_operand,split_load_total_points,block,litpool_confidence,reg_has_got,value_reg_limit,stack_def_use.live_var_used,split_load_point,split_load_operand,flags_and_jump_pair,wis_schedule_iter,unresolved_interval,code_in_block,compare_and_jump_indirect_op_valid,__agg_subclause3,inferred_main_in_reg,reg_used_for,is_padding,resolved_reaches,compare_and_jump_indirect,__agg_subclause2,padding_block_candidate,reg_reg_arithmetic_operation_defs,def_used_for_address,impossible_block,plt_block,arm_jump_table_block_instruction,composite_data_access,possible_target_from,jump_table_candidate_refined,base_relative_operation,split_load,__agg_single3,reg_has_base_image,no_value_reg_limit,relative_address_start,wis_schedule,plt_entry,reg_def_use.used_in_block,adjusts_stack_in_block,possible_target,initialized_data_segment,reg_def_use.live_var_at_block_end,cmp_reg_to_reg,indefinite_litpool_ref,negative_block_heuristic,contains_implausible_instr_seq,indexed_pc_relative_load,next_block_in_byte_interval,code_in_block_candidate,symbolic_expr_from_relocation,unlikely_have_symbolic_immediate,incomplete_block,arm_jump_table_data_block_limit,inferred_main_dispatch,arch.simple_data_load,data_block_limit,block_total_points,invalid_jump_table_candidate,stack_def_use.live_var_def,reg_def_use.live_var_def,arm_jump_table_block_start,block_overlap,stack_base_reg_move,may_fallthrough,__agg_single2,block_heuristic,__agg_subclause9,block_implies_block,segment_target_range,stack_def_use.live_var_at_prior_used,cinf_ldr_add_pc,no_return_call_propagated,unresolved_block_overlap,jump_table_max,common_tail,unresolved_interval_order,tls_get_addr,block_points_proportional,likely_fallthrough,block_boundaries,jump_table_element_access,block_points,invalid,jump_table_target,reg_def_use.used,arm_jump_table_candidate,reg_def_use.live_var_at_prior_used,no_return_call,arm_jump_table_skip_first_entry,stack_def_use.defined_in_block,split_load_conflict,arm_jump_table_candidate_start,stack_def_use.live_var_at_block_end,reg_def_use.last_def_in_block,arm_jump_table_cmp_limit,data_in_code,candidate_block_is_not_padding,inter_procedural_edge,known_block,instruction_memory_access_size,overlap_with_litpool,block_limit,function_inference.function_entry_initial,init_symbol_minus_symbol_candidate_arm,const_value_reg_used,self_contained_segment,stack_def_use.last_def_in_block,must_fallthrough,straight_line_last_def,padding_block_limit,jump_table_candidate,no_return_call_refined,block_candidate_dependency_edge,split_load_candidate,stack_def_use.block_last_def,last_value_reg_limit,relative_address,no_return_block,litpool_ref,symbol_minus_symbol_litpool_access_pattern,block_last_instruction,gp_relative_operand,data_in_code_propagate,block_candidate_boundaries,basic_target,compare_and_jump_immediate,wis_memo,__agg_subclause6,nop_in_padding_candidate,reg_def_use.defined_in_block,__agg_single6,relocation_adjustment_total,candidate_block_is_padding,wis_prior,reg_def_use.live_var_used,__agg_subclause7,wis_has_prior,compare_and_jump_register,block_instruction_next,arm_jump_table_data_block,value_reg,contains_plausible_instr_seq,relative_jump_table_entry_candidate,adrp_used,stack_def_use.def_used,got_relative_operand,__agg_subclause10,value_reg_edge,arch.reg_relative_load,reg_def_use.flow_def,hi_load_prop,jump_table_start,branch_to_calculated_pc_rel_addr,tls_desc_call,discarded_block,stack_def_use.live_var_used_in_block,data_segment,value_reg_unsupported,block_next,discarded_split_load,indexed_pc_relative_load_relative,litpool_symbolic_operand,data_block_candidate,reg_def_use.return_block_end,code_in_block_candidate_refined,after_end,jump_table_signed,reg_def_use.block_last_def,base_relative_jump,unresolved_interval_best_block,straight_line_def_used,unresolved_block,data_access,correlated_live_reg,jump_table_prelude,litpool_boundaries,init_ldr_add_pc,arch.extend_load,stack_def_use.used_in_block,stack_def_use.ref_in_block,reg_def_use.ref_in_block,reg_def_use.return_val_used
- base_relative_symbolic_operand(EA:address, Index:operand_index, Dest:address)
Uses:
+disconnected0,base_relative_operand,instruction_displacement_offset,instruction_get_op,op_indirect,pc_relative_operandUsed by:
moved_label_classRecursive:
symbolic_expr_symbol_minus_symbol,symbolic_expr,+disconnected3,data_object_conflict,labeled_data_candidate,code_pointer_in_data,+disconnected2,labeled_ea,code_in_refined_block,moved_label,block_needs_merging,best_symexpr_symbol,discarded_jump_table_entry,best_func_symbol,data_limit,moved_displacement_candidate,symbol_minus_symbol,refined_block,+disconnected1,moved_data_label,next_address_in_data,symbolic_expr_attribute,relative_jump_table_entry,inferred_main_function,symbol_minus_symbol_candidate,next_data_limit,main_function,symbolic_data,symbolic_operand_point,resolved_transfer,code_in_split_block,base_relative_symbolic_operand,address_array_aux,data_access_limit,symbol_minus_symbol_from_relocation,string_candidate_refined,split_block,+disconnected6,data_object_total_points,string_candidate,data_object,address_array,discarded_data_object,block_needs_splitting_at,inferred_special_symbol,symbol_score,after_address_in_data,symbolic_operand_attribute,data_object_point,moved_pc_relative_candidate,symbolic_operand,function_inference.function_entry,jump_table,data_limit_after_access,boundary_sym_expr,data_object_candidate,label_conflict,got_reference,moved_label_candidate,preferred_data_access
- base_relative_operation(EA_relop:address, EA:address)
Recursive:
cmp_defines,first_block_in_byte_interval,overlapping_instruction,split_load_for_symbolization,relocation_adjustment,call_tls_get_addr,simple_data_access_pattern,reg_def_use.def_used,base_relative_operand,split_load_total_points,block,litpool_confidence,reg_has_got,value_reg_limit,stack_def_use.live_var_used,split_load_point,split_load_operand,flags_and_jump_pair,wis_schedule_iter,unresolved_interval,code_in_block,compare_and_jump_indirect_op_valid,__agg_subclause3,inferred_main_in_reg,reg_used_for,is_padding,resolved_reaches,compare_and_jump_indirect,__agg_subclause2,padding_block_candidate,reg_reg_arithmetic_operation_defs,def_used_for_address,impossible_block,plt_block,arm_jump_table_block_instruction,composite_data_access,possible_target_from,jump_table_candidate_refined,base_relative_operation,split_load,__agg_single3,reg_has_base_image,no_value_reg_limit,relative_address_start,wis_schedule,plt_entry,reg_def_use.used_in_block,adjusts_stack_in_block,possible_target,initialized_data_segment,reg_def_use.live_var_at_block_end,cmp_reg_to_reg,indefinite_litpool_ref,negative_block_heuristic,contains_implausible_instr_seq,indexed_pc_relative_load,next_block_in_byte_interval,code_in_block_candidate,symbolic_expr_from_relocation,unlikely_have_symbolic_immediate,incomplete_block,arm_jump_table_data_block_limit,inferred_main_dispatch,arch.simple_data_load,data_block_limit,block_total_points,invalid_jump_table_candidate,stack_def_use.live_var_def,reg_def_use.live_var_def,arm_jump_table_block_start,block_overlap,stack_base_reg_move,may_fallthrough,__agg_single2,block_heuristic,__agg_subclause9,block_implies_block,segment_target_range,stack_def_use.live_var_at_prior_used,cinf_ldr_add_pc,no_return_call_propagated,unresolved_block_overlap,jump_table_max,common_tail,unresolved_interval_order,tls_get_addr,block_points_proportional,likely_fallthrough,block_boundaries,jump_table_element_access,block_points,invalid,jump_table_target,reg_def_use.used,arm_jump_table_candidate,reg_def_use.live_var_at_prior_used,no_return_call,arm_jump_table_skip_first_entry,stack_def_use.defined_in_block,split_load_conflict,arm_jump_table_candidate_start,stack_def_use.live_var_at_block_end,reg_def_use.last_def_in_block,arm_jump_table_cmp_limit,data_in_code,candidate_block_is_not_padding,inter_procedural_edge,known_block,instruction_memory_access_size,overlap_with_litpool,block_limit,function_inference.function_entry_initial,init_symbol_minus_symbol_candidate_arm,const_value_reg_used,self_contained_segment,stack_def_use.last_def_in_block,must_fallthrough,straight_line_last_def,padding_block_limit,jump_table_candidate,no_return_call_refined,block_candidate_dependency_edge,split_load_candidate,stack_def_use.block_last_def,last_value_reg_limit,relative_address,no_return_block,litpool_ref,symbol_minus_symbol_litpool_access_pattern,block_last_instruction,gp_relative_operand,data_in_code_propagate,block_candidate_boundaries,basic_target,compare_and_jump_immediate,wis_memo,__agg_subclause6,nop_in_padding_candidate,reg_def_use.defined_in_block,__agg_single6,relocation_adjustment_total,candidate_block_is_padding,wis_prior,reg_def_use.live_var_used,__agg_subclause7,wis_has_prior,compare_and_jump_register,block_instruction_next,arm_jump_table_data_block,value_reg,contains_plausible_instr_seq,relative_jump_table_entry_candidate,adrp_used,stack_def_use.def_used,got_relative_operand,__agg_subclause10,value_reg_edge,arch.reg_relative_load,reg_def_use.flow_def,hi_load_prop,jump_table_start,branch_to_calculated_pc_rel_addr,tls_desc_call,discarded_block,stack_def_use.live_var_used_in_block,data_segment,value_reg_unsupported,block_next,discarded_split_load,indexed_pc_relative_load_relative,litpool_symbolic_operand,data_block_candidate,reg_def_use.return_block_end,code_in_block_candidate_refined,after_end,jump_table_signed,reg_def_use.block_last_def,base_relative_jump,unresolved_interval_best_block,straight_line_def_used,unresolved_block,data_access,correlated_live_reg,jump_table_prelude,litpool_boundaries,init_ldr_add_pc,arch.extend_load,stack_def_use.used_in_block,stack_def_use.ref_in_block,reg_def_use.ref_in_block,reg_def_use.return_val_used
- base_relative_jump(EA_relop:address, EA:address)
Uses:
reg_jumpRecursive:
cmp_defines,first_block_in_byte_interval,overlapping_instruction,split_load_for_symbolization,relocation_adjustment,call_tls_get_addr,simple_data_access_pattern,reg_def_use.def_used,base_relative_operand,split_load_total_points,block,litpool_confidence,reg_has_got,value_reg_limit,stack_def_use.live_var_used,split_load_point,split_load_operand,flags_and_jump_pair,wis_schedule_iter,unresolved_interval,code_in_block,compare_and_jump_indirect_op_valid,__agg_subclause3,inferred_main_in_reg,reg_used_for,is_padding,resolved_reaches,compare_and_jump_indirect,__agg_subclause2,padding_block_candidate,reg_reg_arithmetic_operation_defs,def_used_for_address,impossible_block,plt_block,arm_jump_table_block_instruction,composite_data_access,possible_target_from,jump_table_candidate_refined,base_relative_operation,split_load,__agg_single3,reg_has_base_image,no_value_reg_limit,relative_address_start,wis_schedule,plt_entry,reg_def_use.used_in_block,adjusts_stack_in_block,possible_target,initialized_data_segment,reg_def_use.live_var_at_block_end,cmp_reg_to_reg,indefinite_litpool_ref,negative_block_heuristic,contains_implausible_instr_seq,indexed_pc_relative_load,next_block_in_byte_interval,code_in_block_candidate,symbolic_expr_from_relocation,unlikely_have_symbolic_immediate,incomplete_block,arm_jump_table_data_block_limit,inferred_main_dispatch,arch.simple_data_load,data_block_limit,block_total_points,invalid_jump_table_candidate,stack_def_use.live_var_def,reg_def_use.live_var_def,arm_jump_table_block_start,block_overlap,stack_base_reg_move,may_fallthrough,__agg_single2,block_heuristic,__agg_subclause9,block_implies_block,segment_target_range,stack_def_use.live_var_at_prior_used,cinf_ldr_add_pc,no_return_call_propagated,unresolved_block_overlap,jump_table_max,common_tail,unresolved_interval_order,tls_get_addr,block_points_proportional,likely_fallthrough,block_boundaries,jump_table_element_access,block_points,invalid,jump_table_target,reg_def_use.used,arm_jump_table_candidate,reg_def_use.live_var_at_prior_used,no_return_call,arm_jump_table_skip_first_entry,stack_def_use.defined_in_block,split_load_conflict,arm_jump_table_candidate_start,stack_def_use.live_var_at_block_end,reg_def_use.last_def_in_block,arm_jump_table_cmp_limit,data_in_code,candidate_block_is_not_padding,inter_procedural_edge,known_block,instruction_memory_access_size,overlap_with_litpool,block_limit,function_inference.function_entry_initial,init_symbol_minus_symbol_candidate_arm,const_value_reg_used,self_contained_segment,stack_def_use.last_def_in_block,must_fallthrough,straight_line_last_def,padding_block_limit,jump_table_candidate,no_return_call_refined,block_candidate_dependency_edge,split_load_candidate,stack_def_use.block_last_def,last_value_reg_limit,relative_address,no_return_block,litpool_ref,symbol_minus_symbol_litpool_access_pattern,block_last_instruction,gp_relative_operand,data_in_code_propagate,block_candidate_boundaries,basic_target,compare_and_jump_immediate,wis_memo,__agg_subclause6,nop_in_padding_candidate,reg_def_use.defined_in_block,__agg_single6,relocation_adjustment_total,candidate_block_is_padding,wis_prior,reg_def_use.live_var_used,__agg_subclause7,wis_has_prior,compare_and_jump_register,block_instruction_next,arm_jump_table_data_block,value_reg,contains_plausible_instr_seq,relative_jump_table_entry_candidate,adrp_used,stack_def_use.def_used,got_relative_operand,__agg_subclause10,value_reg_edge,arch.reg_relative_load,reg_def_use.flow_def,hi_load_prop,jump_table_start,branch_to_calculated_pc_rel_addr,tls_desc_call,discarded_block,stack_def_use.live_var_used_in_block,data_segment,value_reg_unsupported,block_next,discarded_split_load,indexed_pc_relative_load_relative,litpool_symbolic_operand,data_block_candidate,reg_def_use.return_block_end,code_in_block_candidate_refined,after_end,jump_table_signed,reg_def_use.block_last_def,base_relative_jump,unresolved_interval_best_block,straight_line_def_used,unresolved_block,data_access,correlated_live_reg,jump_table_prelude,litpool_boundaries,init_ldr_add_pc,arch.extend_load,stack_def_use.used_in_block,stack_def_use.ref_in_block,reg_def_use.ref_in_block,reg_def_use.return_val_used
- dos_header_symbolic_operand(EA:address, Dest:unsigned)
WARNING: Predicate not present in compiled Datalog program (Dead Code)