binary/pe/symbolization
PE-specific rules and relations for symbolization
- reg_has_base_image(EA:address, Reg:register)
Uses:
arch.memory_access,arch.move_reg_reg,arch.reg_reg_arithmetic_operation,base_address,binary_format,instruction,pc_relative_operand,reg_def_use.defRecursive:
unresolved_block,litpool_ref,negative_block_heuristic,reg_def_use.used,contains_implausible_instr_seq,padding_block_candidate,block_instruction_next,arm_jump_table_candidate_start,block_candidate_boundaries,impossible_block,arch.reg_relative_load,wis_schedule,reg_has_base_image,split_load_conflict,possible_target_from,wis_has_prior,straight_line_def_used,__agg_subclause6,init_symbol_minus_symbol_candidate_arm,base_relative_operation,straight_line_last_def,unresolved_interval_order,stack_def_use.live_var_used,unresolved_block_overlap,reg_def_use.ambiguous_block_last_def,correlated_live_reg,litpool_symbolic_operand,data_in_code_propagate,split_load_point,relative_address,__agg_subclause3,cmp_reg_to_reg,plt_block,compare_and_jump_indirect_op_valid,data_block_candidate,reg_def_use.live_var_at_prior_used,no_return_call,split_load_operand,common_tail,no_return_call_refined,value_reg_unsupported,cinf_ldr_add_pc,stack_def_use.last_def_in_block,next_start,block_points_proportional,tls_desc_call,code_in_block,reg_def_use.live_var_used,data_in_code,split_load_for_symbolization,incomplete_block,base_relative_jump,unlikely_have_symbolic_immediate,base_relative_operand,arm_jump_table_candidate,jump_table_candidate_refined,split_load_total_points,next_block_in_byte_interval,discarded_block,reg_def_use.return_val_used,adrp_used,indefinite_litpool_ref,reg_def_use.live_var_def,relative_address_start,reg_def_use.ref_in_block,block_points,arch.extend_load,block_boundaries,data_access,candidate_block_is_padding,instruction_memory_access_size,function_inference.function_entry_initial,indexed_pc_relative_load,wis_schedule_iter,init_ldr_add_pc,call_tls_get_addr,unresolved_interval,data_block_limit,segment_target_range,const_value_reg_used,__agg_single2,compare_and_jump_register,is_padding,jump_table_start,relocation_adjustment_total,stack_def_use.live_var_def,cmp_defines,after_end,reg_has_got,overlap_with_litpool,no_return_call_propagated,invalid,invalid_jump_table_candidate,data_segment,inter_procedural_edge,block_last_instruction,must_fallthrough,padding_block_limit,block_limit,wis_prior,block_overlap,symbol_minus_symbol_litpool_access_pattern,arm_jump_table_block_start,no_return_block,initialized_data_segment,branch_to_calculated_pc_rel_addr,litpool_boundaries,jump_table_target,arm_jump_table_cmp_limit,stack_def_use.block_last_def,no_value_reg_limit,block_heuristic,reg_used_for,possible_target,reg_def_use.live_var_at_block_end,hi_load_prop,indexed_pc_relative_load_relative,relocation_adjustment,arm_jump_table_data_block,composite_data_access,code_in_block_candidate_refined,tls_get_addr,value_reg_edge,value_reg,__agg_subclause7,known_block,resolved_reaches,block,block_next,gp_relative_operand,jump_table_signed,symbolic_expr_from_relocation,reg_def_use.block_last_def,__agg_subclause2,likely_fallthrough,last_value_reg_limit,reg_def_use.flow_def,split_load_candidate,jump_table_max,__agg_single3,jump_table_candidate,compare_and_jump_indirect,block_implies_block,reg_def_use.def_used,reg_reg_arithmetic_operation_defs,next_type,self_contained_segment,arch.simple_data_load,block_total_points,def_used_for_address,relative_jump_table_entry_candidate,may_fallthrough,basic_target,candidate_block_is_not_padding,reg_def_use.last_def_in_block,wis_memo,block_candidate_dependency_edge,stack_def_use.used_in_block,stack_base_reg_move,inferred_main_dispatch,reg_def_use.defined_in_block,stack_def_use.def_used,code_in_block_candidate,overlapping_instruction,arm_jump_table_block_instruction,first_block_in_byte_interval,jump_table_prelude,arm_jump_table_skip_first_entry,contains_plausible_instr_seq,stack_def_use.ref_in_block,transition_block_limit,inferred_main_in_reg,reg_def_use.ambiguous_last_def_in_block,next_end,stack_def_use.live_var_at_block_end,discarded_split_load,simple_data_access_pattern,start_function,got_relative_operand,value_reg_limit,adjusts_stack_in_block,split_load,arm_jump_table_data_block_limit,flags_and_jump_pair,stack_def_use.live_var_used_in_block,litpool_confidence,reg_def_use.used_in_block,jump_table_element_access,__agg_single6,stack_def_use.defined_in_block,stack_def_use.live_var_at_prior_used,plt_entry,reg_def_use.return_block_end,nop_in_padding_candidate,compare_and_jump_immediate
- possible_rva_operand(EA:address, Index:operand_index, Dest:address)
Uses:
base_address,instruction_get_op,loaded_section,op_indirectUsed by:
base_relative_operand
- base_relative_operand(EA:address, Index:operand_index, Dest:address)
Uses:
arch.reg_reg_arithmetic_operation,instruction,instruction_get_op,op_indirect,possible_rva_operandUsed by:
base_relative_symbolic_operand,symbol_minus_symbolRecursive:
unresolved_block,litpool_ref,negative_block_heuristic,reg_def_use.used,contains_implausible_instr_seq,padding_block_candidate,block_instruction_next,arm_jump_table_candidate_start,block_candidate_boundaries,impossible_block,arch.reg_relative_load,wis_schedule,reg_has_base_image,split_load_conflict,possible_target_from,wis_has_prior,straight_line_def_used,__agg_subclause6,init_symbol_minus_symbol_candidate_arm,base_relative_operation,straight_line_last_def,unresolved_interval_order,stack_def_use.live_var_used,unresolved_block_overlap,reg_def_use.ambiguous_block_last_def,correlated_live_reg,litpool_symbolic_operand,data_in_code_propagate,split_load_point,relative_address,__agg_subclause3,cmp_reg_to_reg,plt_block,compare_and_jump_indirect_op_valid,data_block_candidate,reg_def_use.live_var_at_prior_used,no_return_call,split_load_operand,common_tail,no_return_call_refined,value_reg_unsupported,cinf_ldr_add_pc,stack_def_use.last_def_in_block,next_start,block_points_proportional,tls_desc_call,code_in_block,reg_def_use.live_var_used,data_in_code,split_load_for_symbolization,incomplete_block,base_relative_jump,unlikely_have_symbolic_immediate,base_relative_operand,arm_jump_table_candidate,jump_table_candidate_refined,split_load_total_points,next_block_in_byte_interval,discarded_block,reg_def_use.return_val_used,adrp_used,indefinite_litpool_ref,reg_def_use.live_var_def,relative_address_start,reg_def_use.ref_in_block,block_points,arch.extend_load,block_boundaries,data_access,candidate_block_is_padding,instruction_memory_access_size,function_inference.function_entry_initial,indexed_pc_relative_load,wis_schedule_iter,init_ldr_add_pc,call_tls_get_addr,unresolved_interval,data_block_limit,segment_target_range,const_value_reg_used,__agg_single2,compare_and_jump_register,is_padding,jump_table_start,relocation_adjustment_total,stack_def_use.live_var_def,cmp_defines,after_end,reg_has_got,overlap_with_litpool,no_return_call_propagated,invalid,invalid_jump_table_candidate,data_segment,inter_procedural_edge,block_last_instruction,must_fallthrough,padding_block_limit,block_limit,wis_prior,block_overlap,symbol_minus_symbol_litpool_access_pattern,arm_jump_table_block_start,no_return_block,initialized_data_segment,branch_to_calculated_pc_rel_addr,litpool_boundaries,jump_table_target,arm_jump_table_cmp_limit,stack_def_use.block_last_def,no_value_reg_limit,block_heuristic,reg_used_for,possible_target,reg_def_use.live_var_at_block_end,hi_load_prop,indexed_pc_relative_load_relative,relocation_adjustment,arm_jump_table_data_block,composite_data_access,code_in_block_candidate_refined,tls_get_addr,value_reg_edge,value_reg,__agg_subclause7,known_block,resolved_reaches,block,block_next,gp_relative_operand,jump_table_signed,symbolic_expr_from_relocation,reg_def_use.block_last_def,__agg_subclause2,likely_fallthrough,last_value_reg_limit,reg_def_use.flow_def,split_load_candidate,jump_table_max,__agg_single3,jump_table_candidate,compare_and_jump_indirect,block_implies_block,reg_def_use.def_used,reg_reg_arithmetic_operation_defs,next_type,self_contained_segment,arch.simple_data_load,block_total_points,def_used_for_address,relative_jump_table_entry_candidate,may_fallthrough,basic_target,candidate_block_is_not_padding,reg_def_use.last_def_in_block,wis_memo,block_candidate_dependency_edge,stack_def_use.used_in_block,stack_base_reg_move,inferred_main_dispatch,reg_def_use.defined_in_block,stack_def_use.def_used,code_in_block_candidate,overlapping_instruction,arm_jump_table_block_instruction,first_block_in_byte_interval,jump_table_prelude,arm_jump_table_skip_first_entry,contains_plausible_instr_seq,stack_def_use.ref_in_block,transition_block_limit,inferred_main_in_reg,reg_def_use.ambiguous_last_def_in_block,next_end,stack_def_use.live_var_at_block_end,discarded_split_load,simple_data_access_pattern,start_function,got_relative_operand,value_reg_limit,adjusts_stack_in_block,split_load,arm_jump_table_data_block_limit,flags_and_jump_pair,stack_def_use.live_var_used_in_block,litpool_confidence,reg_def_use.used_in_block,jump_table_element_access,__agg_single6,stack_def_use.defined_in_block,stack_def_use.live_var_at_prior_used,plt_entry,reg_def_use.return_block_end,nop_in_padding_candidate,compare_and_jump_immediate
- base_relative_symbolic_operand(EA:address, Index:operand_index, Dest:address)
Uses:
+disconnected0,base_relative_operand,instruction_displacement_offset,instruction_get_op,op_indirect,pc_relative_operandUsed by:
moved_label_classRecursive:
resolved_transfer,+disconnected6,data_limit_after_access,jump_table,symbol_score,discarded_data_object,symbolic_expr_attribute,split_block,labeled_data_candidate,data_limit,code_in_split_block,symbolic_operand,best_func_symbol,code_in_refined_block,after_address_in_data,refined_block,inferred_special_symbol,got_reference,data_object,address_array_aux,symbolic_operand_attribute,+disconnected3,preferred_data_access,string_candidate,moved_displacement_candidate,+disconnected2,address_array,discarded_jump_table_entry,data_object_point,moved_label,moved_data_label,symbol_minus_symbol_candidate,function_inference.function_entry,data_object_conflict,relative_jump_table_entry,base_relative_symbolic_operand,data_object_candidate,string_candidate_refined,value_reg_address_before,moved_label_candidate,+disconnected1,block_needs_merging,data_access_limit,symbolic_data,boundary_sym_expr,symbolic_operand_point,symbolic_expr,moved_pc_relative_candidate,block_needs_splitting_at,labeled_ea,label_conflict,data_object_total_points,next_address_in_data,code_pointer_in_data,inferred_main_function,symbolic_expr_symbol_minus_symbol,main_function,symbol_minus_symbol_from_relocation,symbol_minus_symbol,next_data_limit,best_symexpr_symbol
- base_relative_operation(EA_relop:address, EA:address)
Recursive:
unresolved_block,litpool_ref,negative_block_heuristic,reg_def_use.used,contains_implausible_instr_seq,padding_block_candidate,block_instruction_next,arm_jump_table_candidate_start,block_candidate_boundaries,impossible_block,arch.reg_relative_load,wis_schedule,reg_has_base_image,split_load_conflict,possible_target_from,wis_has_prior,straight_line_def_used,__agg_subclause6,init_symbol_minus_symbol_candidate_arm,base_relative_operation,straight_line_last_def,unresolved_interval_order,stack_def_use.live_var_used,unresolved_block_overlap,reg_def_use.ambiguous_block_last_def,correlated_live_reg,litpool_symbolic_operand,data_in_code_propagate,split_load_point,relative_address,__agg_subclause3,cmp_reg_to_reg,plt_block,compare_and_jump_indirect_op_valid,data_block_candidate,reg_def_use.live_var_at_prior_used,no_return_call,split_load_operand,common_tail,no_return_call_refined,value_reg_unsupported,cinf_ldr_add_pc,stack_def_use.last_def_in_block,next_start,block_points_proportional,tls_desc_call,code_in_block,reg_def_use.live_var_used,data_in_code,split_load_for_symbolization,incomplete_block,base_relative_jump,unlikely_have_symbolic_immediate,base_relative_operand,arm_jump_table_candidate,jump_table_candidate_refined,split_load_total_points,next_block_in_byte_interval,discarded_block,reg_def_use.return_val_used,adrp_used,indefinite_litpool_ref,reg_def_use.live_var_def,relative_address_start,reg_def_use.ref_in_block,block_points,arch.extend_load,block_boundaries,data_access,candidate_block_is_padding,instruction_memory_access_size,function_inference.function_entry_initial,indexed_pc_relative_load,wis_schedule_iter,init_ldr_add_pc,call_tls_get_addr,unresolved_interval,data_block_limit,segment_target_range,const_value_reg_used,__agg_single2,compare_and_jump_register,is_padding,jump_table_start,relocation_adjustment_total,stack_def_use.live_var_def,cmp_defines,after_end,reg_has_got,overlap_with_litpool,no_return_call_propagated,invalid,invalid_jump_table_candidate,data_segment,inter_procedural_edge,block_last_instruction,must_fallthrough,padding_block_limit,block_limit,wis_prior,block_overlap,symbol_minus_symbol_litpool_access_pattern,arm_jump_table_block_start,no_return_block,initialized_data_segment,branch_to_calculated_pc_rel_addr,litpool_boundaries,jump_table_target,arm_jump_table_cmp_limit,stack_def_use.block_last_def,no_value_reg_limit,block_heuristic,reg_used_for,possible_target,reg_def_use.live_var_at_block_end,hi_load_prop,indexed_pc_relative_load_relative,relocation_adjustment,arm_jump_table_data_block,composite_data_access,code_in_block_candidate_refined,tls_get_addr,value_reg_edge,value_reg,__agg_subclause7,known_block,resolved_reaches,block,block_next,gp_relative_operand,jump_table_signed,symbolic_expr_from_relocation,reg_def_use.block_last_def,__agg_subclause2,likely_fallthrough,last_value_reg_limit,reg_def_use.flow_def,split_load_candidate,jump_table_max,__agg_single3,jump_table_candidate,compare_and_jump_indirect,block_implies_block,reg_def_use.def_used,reg_reg_arithmetic_operation_defs,next_type,self_contained_segment,arch.simple_data_load,block_total_points,def_used_for_address,relative_jump_table_entry_candidate,may_fallthrough,basic_target,candidate_block_is_not_padding,reg_def_use.last_def_in_block,wis_memo,block_candidate_dependency_edge,stack_def_use.used_in_block,stack_base_reg_move,inferred_main_dispatch,reg_def_use.defined_in_block,stack_def_use.def_used,code_in_block_candidate,overlapping_instruction,arm_jump_table_block_instruction,first_block_in_byte_interval,jump_table_prelude,arm_jump_table_skip_first_entry,contains_plausible_instr_seq,stack_def_use.ref_in_block,transition_block_limit,inferred_main_in_reg,reg_def_use.ambiguous_last_def_in_block,next_end,stack_def_use.live_var_at_block_end,discarded_split_load,simple_data_access_pattern,start_function,got_relative_operand,value_reg_limit,adjusts_stack_in_block,split_load,arm_jump_table_data_block_limit,flags_and_jump_pair,stack_def_use.live_var_used_in_block,litpool_confidence,reg_def_use.used_in_block,jump_table_element_access,__agg_single6,stack_def_use.defined_in_block,stack_def_use.live_var_at_prior_used,plt_entry,reg_def_use.return_block_end,nop_in_padding_candidate,compare_and_jump_immediate
- base_relative_jump(EA_relop:address, EA:address)
Uses:
reg_jumpRecursive:
unresolved_block,litpool_ref,negative_block_heuristic,reg_def_use.used,contains_implausible_instr_seq,padding_block_candidate,block_instruction_next,arm_jump_table_candidate_start,block_candidate_boundaries,impossible_block,arch.reg_relative_load,wis_schedule,reg_has_base_image,split_load_conflict,possible_target_from,wis_has_prior,straight_line_def_used,__agg_subclause6,init_symbol_minus_symbol_candidate_arm,base_relative_operation,straight_line_last_def,unresolved_interval_order,stack_def_use.live_var_used,unresolved_block_overlap,reg_def_use.ambiguous_block_last_def,correlated_live_reg,litpool_symbolic_operand,data_in_code_propagate,split_load_point,relative_address,__agg_subclause3,cmp_reg_to_reg,plt_block,compare_and_jump_indirect_op_valid,data_block_candidate,reg_def_use.live_var_at_prior_used,no_return_call,split_load_operand,common_tail,no_return_call_refined,value_reg_unsupported,cinf_ldr_add_pc,stack_def_use.last_def_in_block,next_start,block_points_proportional,tls_desc_call,code_in_block,reg_def_use.live_var_used,data_in_code,split_load_for_symbolization,incomplete_block,base_relative_jump,unlikely_have_symbolic_immediate,base_relative_operand,arm_jump_table_candidate,jump_table_candidate_refined,split_load_total_points,next_block_in_byte_interval,discarded_block,reg_def_use.return_val_used,adrp_used,indefinite_litpool_ref,reg_def_use.live_var_def,relative_address_start,reg_def_use.ref_in_block,block_points,arch.extend_load,block_boundaries,data_access,candidate_block_is_padding,instruction_memory_access_size,function_inference.function_entry_initial,indexed_pc_relative_load,wis_schedule_iter,init_ldr_add_pc,call_tls_get_addr,unresolved_interval,data_block_limit,segment_target_range,const_value_reg_used,__agg_single2,compare_and_jump_register,is_padding,jump_table_start,relocation_adjustment_total,stack_def_use.live_var_def,cmp_defines,after_end,reg_has_got,overlap_with_litpool,no_return_call_propagated,invalid,invalid_jump_table_candidate,data_segment,inter_procedural_edge,block_last_instruction,must_fallthrough,padding_block_limit,block_limit,wis_prior,block_overlap,symbol_minus_symbol_litpool_access_pattern,arm_jump_table_block_start,no_return_block,initialized_data_segment,branch_to_calculated_pc_rel_addr,litpool_boundaries,jump_table_target,arm_jump_table_cmp_limit,stack_def_use.block_last_def,no_value_reg_limit,block_heuristic,reg_used_for,possible_target,reg_def_use.live_var_at_block_end,hi_load_prop,indexed_pc_relative_load_relative,relocation_adjustment,arm_jump_table_data_block,composite_data_access,code_in_block_candidate_refined,tls_get_addr,value_reg_edge,value_reg,__agg_subclause7,known_block,resolved_reaches,block,block_next,gp_relative_operand,jump_table_signed,symbolic_expr_from_relocation,reg_def_use.block_last_def,__agg_subclause2,likely_fallthrough,last_value_reg_limit,reg_def_use.flow_def,split_load_candidate,jump_table_max,__agg_single3,jump_table_candidate,compare_and_jump_indirect,block_implies_block,reg_def_use.def_used,reg_reg_arithmetic_operation_defs,next_type,self_contained_segment,arch.simple_data_load,block_total_points,def_used_for_address,relative_jump_table_entry_candidate,may_fallthrough,basic_target,candidate_block_is_not_padding,reg_def_use.last_def_in_block,wis_memo,block_candidate_dependency_edge,stack_def_use.used_in_block,stack_base_reg_move,inferred_main_dispatch,reg_def_use.defined_in_block,stack_def_use.def_used,code_in_block_candidate,overlapping_instruction,arm_jump_table_block_instruction,first_block_in_byte_interval,jump_table_prelude,arm_jump_table_skip_first_entry,contains_plausible_instr_seq,stack_def_use.ref_in_block,transition_block_limit,inferred_main_in_reg,reg_def_use.ambiguous_last_def_in_block,next_end,stack_def_use.live_var_at_block_end,discarded_split_load,simple_data_access_pattern,start_function,got_relative_operand,value_reg_limit,adjusts_stack_in_block,split_load,arm_jump_table_data_block_limit,flags_and_jump_pair,stack_def_use.live_var_used_in_block,litpool_confidence,reg_def_use.used_in_block,jump_table_element_access,__agg_single6,stack_def_use.defined_in_block,stack_def_use.live_var_at_prior_used,plt_entry,reg_def_use.return_block_end,nop_in_padding_candidate,compare_and_jump_immediate
- dos_header_symbolic_operand(EA:address, Dest:unsigned)
WARNING: Predicate not present in compiled Datalog program (Dead Code)