symbols

This module select the symbols to be used in symbolic expressions and declares the predicates needed to infer new symbols.

inferred_symbol(EA:address, SymbolName:symbol, Scope:symbol, Visibility:symbol, Type:symbol, Pos:symbol_position)

A new symbol ‘SymbolName’ at address ‘EA’ should be created.

• Uses: binary_format, tls_segment

• Used by: pointer_to_external_symbol, symbol_at_end

• Recursive: code_in_refined_block, symbol_minus_symbol_candidate, jump_table, moved_label_candidate, discarded_jump_table_entry, moved_label, data_limit, next_data_limit, +disconnected6, block_needs_splitting_at, relative_jump_table_entry, data_object, best_func_symbol, symbolic_expr_attribute, symbol_score, after_address_in_data, string_candidate_refined, inferred_main_function, split_block, next_address_in_data, data_object_conflict, code_pointer_in_data, symbolic_data, address_array, symbol_minus_symbol_from_relocation, symbolic_expr, code_in_split_block, preferred_data_access, inferred_special_symbol, +disconnected2, function_inference.function_entry, +disconnected1, refined_block, data_object_point, got_reference, data_limit_after_access, discarded_data_object, block_needs_merging, labeled_data_candidate, moved_pc_relative_candidate, best_symexpr_symbol, boundary_sym_expr, address_array_aux, string_candidate, symbolic_operand_point, symbolic_operand_attribute, moved_displacement_candidate, data_access_limit, symbol_minus_symbol, labeled_ea, main_function, +disconnected4, resolved_transfer, inferred_symbol_mips, data_object_total_points, symbolic_operand, symbolic_expr_symbol_minus_symbol, inferred_symbol, moved_data_label, subsequent_string_candidate, data_object_candidate, label_conflict, value_reg_address_before

inferred_special_symbol(EA:address, SymbolName:symbol, Scope:symbol, Visibility:symbol, Type:symbol, Pos:symbol_position)

A special symbol ‘SymbolName’ at address ‘EA’ has been inferred. Special inferred symbols have higher priority than regular inferred symbols.

• Uses: address_in_data, base_address, binary_format, binary_type, bss_section, entry_point, function_symbol, got_reference_pointer, instruction, loaded_section, op_immediate, pc_relative_operand, relocation, start_function, symbol

• Used by: abi_intrinsic

• Recursive: code_in_refined_block, symbol_minus_symbol_candidate, jump_table, moved_label_candidate, discarded_jump_table_entry, moved_label, data_limit, next_data_limit, +disconnected6, block_needs_splitting_at, relative_jump_table_entry, data_object, best_func_symbol, symbolic_expr_attribute, symbol_score, after_address_in_data, string_candidate_refined, inferred_main_function, split_block, next_address_in_data, data_object_conflict, code_pointer_in_data, symbolic_data, address_array, symbol_minus_symbol_from_relocation, symbolic_expr, code_in_split_block, preferred_data_access, inferred_special_symbol, +disconnected2, function_inference.function_entry, +disconnected1, refined_block, data_object_point, got_reference, data_limit_after_access, discarded_data_object, block_needs_merging, labeled_data_candidate, moved_pc_relative_candidate, best_symexpr_symbol, boundary_sym_expr, address_array_aux, string_candidate, symbolic_operand_point, symbolic_operand_attribute, moved_displacement_candidate, data_access_limit, symbol_minus_symbol, labeled_ea, main_function, +disconnected4, resolved_transfer, inferred_symbol_mips, data_object_total_points, symbolic_operand, symbolic_expr_symbol_minus_symbol, inferred_symbol, moved_data_label, subsequent_string_candidate, data_object_candidate, label_conflict, value_reg_address_before

best_symexpr_symbol(EA:address, SymbolName:symbol, Pos:symbol_position)

Best symbol at address ‘EA’ to be used for symbolic expressions. There can be two variants: If ‘Pos’ is “Beg”, the symbol points to the beginning of a block. If ‘Pos’ is “End”, the symbol points at the end of a block.

• Uses: symbol

• Used by: cfi_directive

• Recursive: code_in_refined_block, symbol_minus_symbol_candidate, jump_table, moved_label_candidate, discarded_jump_table_entry, moved_label, data_limit, next_data_limit, +disconnected6, block_needs_splitting_at, relative_jump_table_entry, data_object, best_func_symbol, symbolic_expr_attribute, symbol_score, after_address_in_data, string_candidate_refined, inferred_main_function, split_block, next_address_in_data, data_object_conflict, code_pointer_in_data, symbolic_data, address_array, symbol_minus_symbol_from_relocation, symbolic_expr, code_in_split_block, preferred_data_access, inferred_special_symbol, +disconnected2, function_inference.function_entry, +disconnected1, refined_block, data_object_point, got_reference, data_limit_after_access, discarded_data_object, block_needs_merging, labeled_data_candidate, moved_pc_relative_candidate, best_symexpr_symbol, boundary_sym_expr, address_array_aux, string_candidate, symbolic_operand_point, symbolic_operand_attribute, moved_displacement_candidate, data_access_limit, symbol_minus_symbol, labeled_ea, main_function, +disconnected4, resolved_transfer, inferred_symbol_mips, data_object_total_points, symbolic_operand, symbolic_expr_symbol_minus_symbol, inferred_symbol, moved_data_label, subsequent_string_candidate, data_object_candidate, label_conflict, value_reg_address_before

best_func_symbol(EA:address, SymbolName:symbol)

Best function symbol at address ‘EA’.

• Uses: binary_format

• Used by: function_inference.function_entry_name

• Recursive: code_in_refined_block, symbol_minus_symbol_candidate, jump_table, moved_label_candidate, discarded_jump_table_entry, moved_label, data_limit, next_data_limit, +disconnected6, block_needs_splitting_at, relative_jump_table_entry, data_object, best_func_symbol, symbolic_expr_attribute, symbol_score, after_address_in_data, string_candidate_refined, inferred_main_function, split_block, next_address_in_data, data_object_conflict, code_pointer_in_data, symbolic_data, address_array, symbol_minus_symbol_from_relocation, symbolic_expr, code_in_split_block, preferred_data_access, inferred_special_symbol, +disconnected2, function_inference.function_entry, +disconnected1, refined_block, data_object_point, got_reference, data_limit_after_access, discarded_data_object, block_needs_merging, labeled_data_candidate, moved_pc_relative_candidate, best_symexpr_symbol, boundary_sym_expr, address_array_aux, string_candidate, symbolic_operand_point, symbolic_operand_attribute, moved_displacement_candidate, data_access_limit, symbol_minus_symbol, labeled_ea, main_function, +disconnected4, resolved_transfer, inferred_symbol_mips, data_object_total_points, symbolic_operand, symbolic_expr_symbol_minus_symbol, inferred_symbol, moved_data_label, subsequent_string_candidate, data_object_candidate, label_conflict, value_reg_address_before

symbol_score(EA:address, SymbolName:symbol, Type:symbol, Pos:symbol_position, Score:unsigned)

This predicate is computed to decide which is the best symbol for symbolic expressions or the best function symbol at each address. Each symbol receives a score based on its properties.

• Uses: ambiguous_symbol, avoid_symbols, defined_symbol, relocation, symbol_at_section_end, symbol_scope_score, symbol_type_score, symbol_visibility_score

• Recursive: code_in_refined_block, symbol_minus_symbol_candidate, jump_table, moved_label_candidate, discarded_jump_table_entry, moved_label, data_limit, next_data_limit, +disconnected6, block_needs_splitting_at, relative_jump_table_entry, data_object, best_func_symbol, symbolic_expr_attribute, symbol_score, after_address_in_data, string_candidate_refined, inferred_main_function, split_block, next_address_in_data, data_object_conflict, code_pointer_in_data, symbolic_data, address_array, symbol_minus_symbol_from_relocation, symbolic_expr, code_in_split_block, preferred_data_access, inferred_special_symbol, +disconnected2, function_inference.function_entry, +disconnected1, refined_block, data_object_point, got_reference, data_limit_after_access, discarded_data_object, block_needs_merging, labeled_data_candidate, moved_pc_relative_candidate, best_symexpr_symbol, boundary_sym_expr, address_array_aux, string_candidate, symbolic_operand_point, symbolic_operand_attribute, moved_displacement_candidate, data_access_limit, symbol_minus_symbol, labeled_ea, main_function, +disconnected4, resolved_transfer, inferred_symbol_mips, data_object_total_points, symbolic_operand, symbolic_expr_symbol_minus_symbol, inferred_symbol, moved_data_label, subsequent_string_candidate, data_object_candidate, label_conflict, value_reg_address_before

symbol_type_score(Type:symbol, Scope:unsigned)

Auxiliary predicate to define symbol_score. Prefer symbols with type different than NOTYPE.

• Uses: symbol

• Used by: symbol_score

symbol_scope_score(Scope:symbol, Score:unsigned)

Auxiliary predicate to define symbol_score

• Uses: symbol

• Used by: symbol_score

symbol_visibility_score(Visibility:symbol, Score:unsigned)

Auxiliary predicate to define symbol_score. Prefer symbols that are not HIDDEN.

• Uses: symbol

• Used by: ifunc_symbol_score, symbol_score

avoid_symbols(SymbolName:symbol)

This predicate records a set of symbols that should not be used in symbolic expressions. These symbols are skipped by the pprinter. TODO: maybe the pprinter could stop skipping these symbols and we could remove them from here.

• Uses: arm_sym, binary_format, data_sym, elf_avoid_symbols, thumb_sym

• Used by: symbol_score

elf_avoid_symbols(SymbolName:symbol)

This predicate records the set of symbols that should not be used in symbolic expressions for ELF binaries

• Used by: avoid_symbols

symbol_at_section_end(EA:address, SymbolName:symbol)

An existing symbol is pointing to the end of a section rather than the beginning of the next section.

• Uses: section, symbol

• Used by: symbol_score

symbol_at_end(EA:address, SymbolName:symbol)

The symbol at address ‘EA’ with name ‘SymbolName’ should point at the end of a block.

• Uses: inferred_symbol, section, symbol

symbol_before_section_beg(EA:address, SymbolName:symbol, NewEA:address)

The symbol at address ‘EA’ with name ‘SymbolName’ is pointing outside its own section and should be moved to ‘NewEA’.

• Uses: section, symbol