data_access_analysis

The data access analysis computes:

-‘data_access_patterns’ which represent that the address ‘Address’ is

accessed with size ‘Size’ and multiplier ‘Multiplier’ from an instruction in ‘FromWhere’.

-‘preferred_data_access’ the address is most likely accessed from the data access

pattern located at ea_data_access.

data_access_patterns are computed by checking memory accesses and with the help of the value analysis.

data_access_patterns give us very sparse information, but if an address ‘ea’ is accessed with a multiplier, it is likely that ‘ea’+multiplier, ‘ea’+2*multiplier, etc are also accessed the same way. Unfortunately, we do not know until when. Therefore, we propagate these accesses using the multiplier until we reach some other access.

instruction_memory_access_size(EA:address, Op_index:operand_index, Size:unsigned)

• Uses: arch.data_access_size, instruction, instruction_get_dest_op, instruction_get_op, op_indirect, op_regdirect

• Used by: arch.alignment_required

• Recursive: unresolved_block, litpool_ref, negative_block_heuristic, reg_def_use.used, contains_implausible_instr_seq, padding_block_candidate, block_instruction_next, arm_jump_table_candidate_start, block_candidate_boundaries, impossible_block, arch.reg_relative_load, wis_schedule, reg_has_base_image, split_load_conflict, possible_target_from, wis_has_prior, straight_line_def_used, __agg_subclause6, init_symbol_minus_symbol_candidate_arm, base_relative_operation, straight_line_last_def, unresolved_interval_order, stack_def_use.live_var_used, unresolved_block_overlap, reg_def_use.ambiguous_block_last_def, correlated_live_reg, litpool_symbolic_operand, data_in_code_propagate, split_load_point, relative_address, __agg_subclause3, cmp_reg_to_reg, plt_block, compare_and_jump_indirect_op_valid, data_block_candidate, reg_def_use.live_var_at_prior_used, no_return_call, split_load_operand, common_tail, no_return_call_refined, value_reg_unsupported, cinf_ldr_add_pc, stack_def_use.last_def_in_block, next_start, block_points_proportional, tls_desc_call, code_in_block, reg_def_use.live_var_used, data_in_code, split_load_for_symbolization, incomplete_block, base_relative_jump, unlikely_have_symbolic_immediate, base_relative_operand, arm_jump_table_candidate, jump_table_candidate_refined, split_load_total_points, next_block_in_byte_interval, discarded_block, reg_def_use.return_val_used, adrp_used, indefinite_litpool_ref, reg_def_use.live_var_def, relative_address_start, reg_def_use.ref_in_block, block_points, arch.extend_load, block_boundaries, data_access, candidate_block_is_padding, instruction_memory_access_size, function_inference.function_entry_initial, indexed_pc_relative_load, wis_schedule_iter, init_ldr_add_pc, call_tls_get_addr, unresolved_interval, data_block_limit, segment_target_range, const_value_reg_used, __agg_single2, compare_and_jump_register, is_padding, jump_table_start, relocation_adjustment_total, stack_def_use.live_var_def, cmp_defines, after_end, reg_has_got, overlap_with_litpool, no_return_call_propagated, invalid, invalid_jump_table_candidate, data_segment, inter_procedural_edge, block_last_instruction, must_fallthrough, padding_block_limit, block_limit, wis_prior, block_overlap, symbol_minus_symbol_litpool_access_pattern, arm_jump_table_block_start, no_return_block, initialized_data_segment, branch_to_calculated_pc_rel_addr, litpool_boundaries, jump_table_target, arm_jump_table_cmp_limit, stack_def_use.block_last_def, no_value_reg_limit, block_heuristic, reg_used_for, possible_target, reg_def_use.live_var_at_block_end, hi_load_prop, indexed_pc_relative_load_relative, relocation_adjustment, arm_jump_table_data_block, composite_data_access, code_in_block_candidate_refined, tls_get_addr, value_reg_edge, value_reg, __agg_subclause7, known_block, resolved_reaches, block, block_next, gp_relative_operand, jump_table_signed, symbolic_expr_from_relocation, reg_def_use.block_last_def, __agg_subclause2, likely_fallthrough, last_value_reg_limit, reg_def_use.flow_def, split_load_candidate, jump_table_max, __agg_single3, jump_table_candidate, compare_and_jump_indirect, block_implies_block, reg_def_use.def_used, reg_reg_arithmetic_operation_defs, next_type, self_contained_segment, arch.simple_data_load, block_total_points, def_used_for_address, relative_jump_table_entry_candidate, may_fallthrough, basic_target, candidate_block_is_not_padding, reg_def_use.last_def_in_block, wis_memo, block_candidate_dependency_edge, stack_def_use.used_in_block, stack_base_reg_move, inferred_main_dispatch, reg_def_use.defined_in_block, stack_def_use.def_used, code_in_block_candidate, overlapping_instruction, arm_jump_table_block_instruction, first_block_in_byte_interval, jump_table_prelude, arm_jump_table_skip_first_entry, contains_plausible_instr_seq, stack_def_use.ref_in_block, transition_block_limit, inferred_main_in_reg, reg_def_use.ambiguous_last_def_in_block, next_end, stack_def_use.live_var_at_block_end, discarded_split_load, simple_data_access_pattern, start_function, got_relative_operand, value_reg_limit, adjusts_stack_in_block, split_load, arm_jump_table_data_block_limit, flags_and_jump_pair, stack_def_use.live_var_used_in_block, litpool_confidence, reg_def_use.used_in_block, jump_table_element_access, __agg_single6, stack_def_use.defined_in_block, stack_def_use.live_var_at_prior_used, plt_entry, reg_def_use.return_block_end, nop_in_padding_candidate, compare_and_jump_immediate

data_access(EA:address, Op_index:operand_index, RegSegment:reg_nullable, RegBase:reg_nullable, RegIndex:reg_nullable, Mult:number, Offset:number, Size:unsigned)

• Uses: instruction_get_op, op_indirect_mapped

• Used by: addr_outside_section_used_for_memory_access, data_access_pattern_candidate, dest_enlarged_data_section, jump_table, moved_displacement_candidate, moved_label_class, value_reg_at_operand, value_reg_at_operand_loop

• Recursive: unresolved_block, litpool_ref, negative_block_heuristic, reg_def_use.used, contains_implausible_instr_seq, padding_block_candidate, block_instruction_next, arm_jump_table_candidate_start, block_candidate_boundaries, impossible_block, arch.reg_relative_load, wis_schedule, reg_has_base_image, split_load_conflict, possible_target_from, wis_has_prior, straight_line_def_used, __agg_subclause6, init_symbol_minus_symbol_candidate_arm, base_relative_operation, straight_line_last_def, unresolved_interval_order, stack_def_use.live_var_used, unresolved_block_overlap, reg_def_use.ambiguous_block_last_def, correlated_live_reg, litpool_symbolic_operand, data_in_code_propagate, split_load_point, relative_address, __agg_subclause3, cmp_reg_to_reg, plt_block, compare_and_jump_indirect_op_valid, data_block_candidate, reg_def_use.live_var_at_prior_used, no_return_call, split_load_operand, common_tail, no_return_call_refined, value_reg_unsupported, cinf_ldr_add_pc, stack_def_use.last_def_in_block, next_start, block_points_proportional, tls_desc_call, code_in_block, reg_def_use.live_var_used, data_in_code, split_load_for_symbolization, incomplete_block, base_relative_jump, unlikely_have_symbolic_immediate, base_relative_operand, arm_jump_table_candidate, jump_table_candidate_refined, split_load_total_points, next_block_in_byte_interval, discarded_block, reg_def_use.return_val_used, adrp_used, indefinite_litpool_ref, reg_def_use.live_var_def, relative_address_start, reg_def_use.ref_in_block, block_points, arch.extend_load, block_boundaries, data_access, candidate_block_is_padding, instruction_memory_access_size, function_inference.function_entry_initial, indexed_pc_relative_load, wis_schedule_iter, init_ldr_add_pc, call_tls_get_addr, unresolved_interval, data_block_limit, segment_target_range, const_value_reg_used, __agg_single2, compare_and_jump_register, is_padding, jump_table_start, relocation_adjustment_total, stack_def_use.live_var_def, cmp_defines, after_end, reg_has_got, overlap_with_litpool, no_return_call_propagated, invalid, invalid_jump_table_candidate, data_segment, inter_procedural_edge, block_last_instruction, must_fallthrough, padding_block_limit, block_limit, wis_prior, block_overlap, symbol_minus_symbol_litpool_access_pattern, arm_jump_table_block_start, no_return_block, initialized_data_segment, branch_to_calculated_pc_rel_addr, litpool_boundaries, jump_table_target, arm_jump_table_cmp_limit, stack_def_use.block_last_def, no_value_reg_limit, block_heuristic, reg_used_for, possible_target, reg_def_use.live_var_at_block_end, hi_load_prop, indexed_pc_relative_load_relative, relocation_adjustment, arm_jump_table_data_block, composite_data_access, code_in_block_candidate_refined, tls_get_addr, value_reg_edge, value_reg, __agg_subclause7, known_block, resolved_reaches, block, block_next, gp_relative_operand, jump_table_signed, symbolic_expr_from_relocation, reg_def_use.block_last_def, __agg_subclause2, likely_fallthrough, last_value_reg_limit, reg_def_use.flow_def, split_load_candidate, jump_table_max, __agg_single3, jump_table_candidate, compare_and_jump_indirect, block_implies_block, reg_def_use.def_used, reg_reg_arithmetic_operation_defs, next_type, self_contained_segment, arch.simple_data_load, block_total_points, def_used_for_address, relative_jump_table_entry_candidate, may_fallthrough, basic_target, candidate_block_is_not_padding, reg_def_use.last_def_in_block, wis_memo, block_candidate_dependency_edge, stack_def_use.used_in_block, stack_base_reg_move, inferred_main_dispatch, reg_def_use.defined_in_block, stack_def_use.def_used, code_in_block_candidate, overlapping_instruction, arm_jump_table_block_instruction, first_block_in_byte_interval, jump_table_prelude, arm_jump_table_skip_first_entry, contains_plausible_instr_seq, stack_def_use.ref_in_block, transition_block_limit, inferred_main_in_reg, reg_def_use.ambiguous_last_def_in_block, next_end, stack_def_use.live_var_at_block_end, discarded_split_load, simple_data_access_pattern, start_function, got_relative_operand, value_reg_limit, adjusts_stack_in_block, split_load, arm_jump_table_data_block_limit, flags_and_jump_pair, stack_def_use.live_var_used_in_block, litpool_confidence, reg_def_use.used_in_block, jump_table_element_access, __agg_single6, stack_def_use.defined_in_block, stack_def_use.live_var_at_prior_used, plt_entry, reg_def_use.return_block_end, nop_in_padding_candidate, compare_and_jump_immediate

value_reg_at_operand(EA:address, Op_index:operand_index, Reg:reg_nullable, EA_from:address, Mult:number, Offset:number, Type:symbol)

• Uses: best_value_reg, data_access, reg_def_use.def_used, value_reg_at_operand_loop

• Used by: addr_outside_section_used_for_memory_access, data_access_pattern_candidate, moved_displacement_candidate, moved_label_class

value_reg_at_operand_loop(EA:address, Op_index:operand_index, Reg:reg_nullable, EA_from:address, Mult:number, Offset:number, Type:symbol)

• Uses: best_value_reg, data_access, reg_def_use.def_used

• Used by: dest_enlarged_data_section, value_reg_at_operand

data_access_pattern(Address:address, Size:unsigned, Multiplier:number, FromWhere:address)

The address ‘Address’ is accessed from an instruction at address ‘FromWhere’. The access has size ‘Size’ and uses a multiplier ‘Multiplier’.

• Uses: dap_max_mult, data_access_pattern_candidate_refined

• Used by: data_access_pattern_non_zero, data_limit_after_access, jump_table, next_data_access, next_dyssynchronous_data_access, preferred_data_access, synchronous_access, synchronous_access_barrier_after_access

data_access_pattern_candidate(Address:address, Size:unsigned, Multiplier:number, FromWhere:address)

Auxiliary predicate that computes initial approximation of data_access_pattern

• Uses: data_access, data_segment, simple_data_access_pattern, value_reg_at_operand

• Used by: addr_outside_section_used_for_memory_access, data_access_pattern_candidate_refined, moved_displacement_candidate, moved_label_class

simple_data_access_pattern(Address:address, Op_index:unsigned, Size:unsigned, FromWhere:address)

The address Address is accessed from instruction at address FromWhere. The access is done from operand Op_index and has size Size. simple_data_access_pattern is a subset of data_access_pattern_candidate that can be computed without using the value register analysis.

• Uses: instruction_has_relocation, pc_relative_operand

• Used by: data_access_pattern_candidate

• Recursive: unresolved_block, litpool_ref, negative_block_heuristic, reg_def_use.used, contains_implausible_instr_seq, padding_block_candidate, block_instruction_next, arm_jump_table_candidate_start, block_candidate_boundaries, impossible_block, arch.reg_relative_load, wis_schedule, reg_has_base_image, split_load_conflict, possible_target_from, wis_has_prior, straight_line_def_used, __agg_subclause6, init_symbol_minus_symbol_candidate_arm, base_relative_operation, straight_line_last_def, unresolved_interval_order, stack_def_use.live_var_used, unresolved_block_overlap, reg_def_use.ambiguous_block_last_def, correlated_live_reg, litpool_symbolic_operand, data_in_code_propagate, split_load_point, relative_address, __agg_subclause3, cmp_reg_to_reg, plt_block, compare_and_jump_indirect_op_valid, data_block_candidate, reg_def_use.live_var_at_prior_used, no_return_call, split_load_operand, common_tail, no_return_call_refined, value_reg_unsupported, cinf_ldr_add_pc, stack_def_use.last_def_in_block, next_start, block_points_proportional, tls_desc_call, code_in_block, reg_def_use.live_var_used, data_in_code, split_load_for_symbolization, incomplete_block, base_relative_jump, unlikely_have_symbolic_immediate, base_relative_operand, arm_jump_table_candidate, jump_table_candidate_refined, split_load_total_points, next_block_in_byte_interval, discarded_block, reg_def_use.return_val_used, adrp_used, indefinite_litpool_ref, reg_def_use.live_var_def, relative_address_start, reg_def_use.ref_in_block, block_points, arch.extend_load, block_boundaries, data_access, candidate_block_is_padding, instruction_memory_access_size, function_inference.function_entry_initial, indexed_pc_relative_load, wis_schedule_iter, init_ldr_add_pc, call_tls_get_addr, unresolved_interval, data_block_limit, segment_target_range, const_value_reg_used, __agg_single2, compare_and_jump_register, is_padding, jump_table_start, relocation_adjustment_total, stack_def_use.live_var_def, cmp_defines, after_end, reg_has_got, overlap_with_litpool, no_return_call_propagated, invalid, invalid_jump_table_candidate, data_segment, inter_procedural_edge, block_last_instruction, must_fallthrough, padding_block_limit, block_limit, wis_prior, block_overlap, symbol_minus_symbol_litpool_access_pattern, arm_jump_table_block_start, no_return_block, initialized_data_segment, branch_to_calculated_pc_rel_addr, litpool_boundaries, jump_table_target, arm_jump_table_cmp_limit, stack_def_use.block_last_def, no_value_reg_limit, block_heuristic, reg_used_for, possible_target, reg_def_use.live_var_at_block_end, hi_load_prop, indexed_pc_relative_load_relative, relocation_adjustment, arm_jump_table_data_block, composite_data_access, code_in_block_candidate_refined, tls_get_addr, value_reg_edge, value_reg, __agg_subclause7, known_block, resolved_reaches, block, block_next, gp_relative_operand, jump_table_signed, symbolic_expr_from_relocation, reg_def_use.block_last_def, __agg_subclause2, likely_fallthrough, last_value_reg_limit, reg_def_use.flow_def, split_load_candidate, jump_table_max, __agg_single3, jump_table_candidate, compare_and_jump_indirect, block_implies_block, reg_def_use.def_used, reg_reg_arithmetic_operation_defs, next_type, self_contained_segment, arch.simple_data_load, block_total_points, def_used_for_address, relative_jump_table_entry_candidate, may_fallthrough, basic_target, candidate_block_is_not_padding, reg_def_use.last_def_in_block, wis_memo, block_candidate_dependency_edge, stack_def_use.used_in_block, stack_base_reg_move, inferred_main_dispatch, reg_def_use.defined_in_block, stack_def_use.def_used, code_in_block_candidate, overlapping_instruction, arm_jump_table_block_instruction, first_block_in_byte_interval, jump_table_prelude, arm_jump_table_skip_first_entry, contains_plausible_instr_seq, stack_def_use.ref_in_block, transition_block_limit, inferred_main_in_reg, reg_def_use.ambiguous_last_def_in_block, next_end, stack_def_use.live_var_at_block_end, discarded_split_load, simple_data_access_pattern, start_function, got_relative_operand, value_reg_limit, adjusts_stack_in_block, split_load, arm_jump_table_data_block_limit, flags_and_jump_pair, stack_def_use.live_var_used_in_block, litpool_confidence, reg_def_use.used_in_block, jump_table_element_access, __agg_single6, stack_def_use.defined_in_block, stack_def_use.live_var_at_prior_used, plt_entry, reg_def_use.return_block_end, nop_in_padding_candidate, compare_and_jump_immediate

preferred_data_access(EA:address, Size:unsigned, AccessEA:address)

The address at ‘EA’ is probably accessed with size ‘Size’ using the same pattern as the data access in ‘AccessEA’. Preferred data accesses are computed by propagating data accesses based on their multiplier.

• Uses: data_access_pattern, data_access_pattern_non_zero, next_dyssynchronous_data_access

• Recursive: resolved_transfer, +disconnected6, data_limit_after_access, jump_table, symbol_score, discarded_data_object, symbolic_expr_attribute, split_block, labeled_data_candidate, data_limit, code_in_split_block, symbolic_operand, best_func_symbol, code_in_refined_block, after_address_in_data, refined_block, inferred_special_symbol, got_reference, data_object, address_array_aux, symbolic_operand_attribute, +disconnected3, preferred_data_access, string_candidate, moved_displacement_candidate, +disconnected2, address_array, discarded_jump_table_entry, data_object_point, moved_label, moved_data_label, symbol_minus_symbol_candidate, function_inference.function_entry, data_object_conflict, relative_jump_table_entry, base_relative_symbolic_operand, data_object_candidate, string_candidate_refined, value_reg_address_before, moved_label_candidate, +disconnected1, block_needs_merging, data_access_limit, symbolic_data, boundary_sym_expr, symbolic_operand_point, symbolic_expr, moved_pc_relative_candidate, block_needs_splitting_at, labeled_ea, label_conflict, data_object_total_points, next_address_in_data, code_pointer_in_data, inferred_main_function, symbolic_expr_symbol_minus_symbol, main_function, symbol_minus_symbol_from_relocation, symbol_minus_symbol, next_data_limit, best_symexpr_symbol

data_access_pattern_candidate_refined(Address:address, Size:unsigned, Multiplier:number, FromWhere:address)

Filter out some invalid DAP candidates before performing expensive aggregation

• Uses: address_in_data, data_access_pattern_candidate, indirect_call, indirect_jump, instruction, pe_import_entry, relocation

• Used by: dap_location, dap_max_mult, data_access_pattern, resolved_transfer, resolved_transfer_to_symbol

dap_location(Address:address, Size:unsigned)

Unique DAP Address,Size pairs at which the max must be evaluated.

Prevents evaluating the max for each non-unique copy of the pair.

• Uses: data_access_pattern_candidate_refined

• Used by: dap_max_mult

dap_max_mult(Address:address, Size:unsigned, Max:number)

The largest multiplier for each Address,Size combination among the data access pattern candidates

• Uses: dap_location, data_access_pattern_candidate_refined

• Used by: data_access_pattern

data_access_limit(EA:address)

Data limits are the candidates for labeled data and the boundaries of data segments.

• Uses: data_access_pattern_non_zero, data_segment, repeated_byte

• Recursive: resolved_transfer, +disconnected6, data_limit_after_access, jump_table, symbol_score, discarded_data_object, symbolic_expr_attribute, split_block, labeled_data_candidate, data_limit, code_in_split_block, symbolic_operand, best_func_symbol, code_in_refined_block, after_address_in_data, refined_block, inferred_special_symbol, got_reference, data_object, address_array_aux, symbolic_operand_attribute, +disconnected3, preferred_data_access, string_candidate, moved_displacement_candidate, +disconnected2, address_array, discarded_jump_table_entry, data_object_point, moved_label, moved_data_label, symbol_minus_symbol_candidate, function_inference.function_entry, data_object_conflict, relative_jump_table_entry, base_relative_symbolic_operand, data_object_candidate, string_candidate_refined, value_reg_address_before, moved_label_candidate, +disconnected1, block_needs_merging, data_access_limit, symbolic_data, boundary_sym_expr, symbolic_operand_point, symbolic_expr, moved_pc_relative_candidate, block_needs_splitting_at, labeled_ea, label_conflict, data_object_total_points, next_address_in_data, code_pointer_in_data, inferred_main_function, symbolic_expr_symbol_minus_symbol, main_function, symbol_minus_symbol_from_relocation, symbol_minus_symbol, next_data_limit, best_symexpr_symbol

data_limit(EA:address)

Labeled data boundaries

• Uses: data_segment

• Recursive: resolved_transfer, +disconnected6, data_limit_after_access, jump_table, symbol_score, discarded_data_object, symbolic_expr_attribute, split_block, labeled_data_candidate, data_limit, code_in_split_block, symbolic_operand, best_func_symbol, code_in_refined_block, after_address_in_data, refined_block, inferred_special_symbol, got_reference, data_object, address_array_aux, symbolic_operand_attribute, +disconnected3, preferred_data_access, string_candidate, moved_displacement_candidate, +disconnected2, address_array, discarded_jump_table_entry, data_object_point, moved_label, moved_data_label, symbol_minus_symbol_candidate, function_inference.function_entry, data_object_conflict, relative_jump_table_entry, base_relative_symbolic_operand, data_object_candidate, string_candidate_refined, value_reg_address_before, moved_label_candidate, +disconnected1, block_needs_merging, data_access_limit, symbolic_data, boundary_sym_expr, symbolic_operand_point, symbolic_expr, moved_pc_relative_candidate, block_needs_splitting_at, labeled_ea, label_conflict, data_object_total_points, next_address_in_data, code_pointer_in_data, inferred_main_function, symbolic_expr_symbol_minus_symbol, main_function, symbol_minus_symbol_from_relocation, symbol_minus_symbol, next_data_limit, best_symexpr_symbol

next_data_limit(EA:address, Next:address)

The next data limit after ‘EA’ is at ‘Next’.

• Uses: data_segment

• Recursive: resolved_transfer, +disconnected6, data_limit_after_access, jump_table, symbol_score, discarded_data_object, symbolic_expr_attribute, split_block, labeled_data_candidate, data_limit, code_in_split_block, symbolic_operand, best_func_symbol, code_in_refined_block, after_address_in_data, refined_block, inferred_special_symbol, got_reference, data_object, address_array_aux, symbolic_operand_attribute, +disconnected3, preferred_data_access, string_candidate, moved_displacement_candidate, +disconnected2, address_array, discarded_jump_table_entry, data_object_point, moved_label, moved_data_label, symbol_minus_symbol_candidate, function_inference.function_entry, data_object_conflict, relative_jump_table_entry, base_relative_symbolic_operand, data_object_candidate, string_candidate_refined, value_reg_address_before, moved_label_candidate, +disconnected1, block_needs_merging, data_access_limit, symbolic_data, boundary_sym_expr, symbolic_operand_point, symbolic_expr, moved_pc_relative_candidate, block_needs_splitting_at, labeled_ea, label_conflict, data_object_total_points, next_address_in_data, code_pointer_in_data, inferred_main_function, symbolic_expr_symbol_minus_symbol, main_function, symbol_minus_symbol_from_relocation, symbol_minus_symbol, next_data_limit, best_symexpr_symbol

data_limit_after_access(Access:address, DataLimit:address)

The first data limit after the data access at address ‘Access’ is at address ‘DataLimit’.

• Uses: data_access_pattern, data_segment

• Recursive: resolved_transfer, +disconnected6, data_limit_after_access, jump_table, symbol_score, discarded_data_object, symbolic_expr_attribute, split_block, labeled_data_candidate, data_limit, code_in_split_block, symbolic_operand, best_func_symbol, code_in_refined_block, after_address_in_data, refined_block, inferred_special_symbol, got_reference, data_object, address_array_aux, symbolic_operand_attribute, +disconnected3, preferred_data_access, string_candidate, moved_displacement_candidate, +disconnected2, address_array, discarded_jump_table_entry, data_object_point, moved_label, moved_data_label, symbol_minus_symbol_candidate, function_inference.function_entry, data_object_conflict, relative_jump_table_entry, base_relative_symbolic_operand, data_object_candidate, string_candidate_refined, value_reg_address_before, moved_label_candidate, +disconnected1, block_needs_merging, data_access_limit, symbolic_data, boundary_sym_expr, symbolic_operand_point, symbolic_expr, moved_pc_relative_candidate, block_needs_splitting_at, labeled_ea, label_conflict, data_object_total_points, next_address_in_data, code_pointer_in_data, inferred_main_function, symbolic_expr_symbol_minus_symbol, main_function, symbol_minus_symbol_from_relocation, symbol_minus_symbol, next_data_limit, best_symexpr_symbol

next_data_access(EA:address, Next:address)

The next data access after the one at ‘EA’ is at ‘Next’.

• Uses: data_access_pattern, data_segment

• Used by: next_dyssynchronous_data_access, synchronous_access

data_access_pattern_non_zero(Address:address, Size:unsigned, Multiplier:unsigned, FromWhere:address)

• Uses: data_access_pattern

• Used by: data_access_limit, preferred_data_access, synchronous_access

synchronous_access_barrier(EA:address)

Barriers are the candidates for limiting synchronous access pairing.

• Uses: data_segment, symbol

• Used by: synchronous_access_barrier_after_access

synchronous_access_barrier_after_access(EA:address, Barrier:address)

The first synchronous_access barrier after the data access to ‘EA’ is at address ‘Barrier’.

• Uses: data_access_pattern, synchronous_access_barrier

• Used by: synchronous_access

synchronous_access(RefAccess:address, LastEA:address)

Two data accesses are synchronous if: 1. The second access has multiplier 0 and it originates from the same address

as the first.

2. Or, They have the same multiplier and the space between them

means they do not collide with each other even if they are propagated.

synchronous_access denotes that the access at RefAccess is synchronous with all the accesses from RefAccess to LastEA. For example, if we have the consecutive accesses: A, B, C, D. synchronous_access(A,D) means that A is synchronous with B, C and D.

Note that if synchronous_access(A,D) is generated, so will synchronous_access(A,B) and synchronous_access(A,C) since the computation is incremental. We could use subsumption to remove those intermediate results but that would require reworking first_synchronous_access as well.

• Uses: data_access_pattern, data_access_pattern_non_zero, next_data_access, synchronous_access_barrier_after_access

• Used by: first_synchronous_access, next_dyssynchronous_data_access

• Recursive: synchronous_access

first_synchronous_access(Ref:address, Access:address)

The first synchronous data access of ‘Access’ is located at address ‘Ref’.

• Uses: synchronous_access

• Used by: moved_label_candidate, moved_label_class

next_dyssynchronous_data_access(EA:address, Next:address)

The next data access after ‘EA’ that is not synchronous with ‘EA’ is located at address ‘Next’.

• Uses: data_access_pattern, next_data_access, synchronous_access

• Used by: preferred_data_access