angr / angr/vex

Spechelper for FP compares

Aberta
#50 1 comentário 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
C
Estrelas
116
Forks
51
Merge médio
16h 20min
PRs com merge (30d)
2

Descrição

I am trying to get a symbolic expression from an ARM64 code performing floating point compares.
The function takes single `float` argument in reg `s0` which I have initialized as `FPS('x', FLOAT)`.

For the ARM64 insns:

```
00000000000000ec :
ec: 08 20 20 1e fcmp s0, #0.0
f0: c5 00 00 54 b.pl 0x108
```

The IRSB is:

```
IRSB {
t0:Ity_F32 t1:Ity_F32 t2:Ity_I32 t3:Ity_I64 t4:Ity_I64 t5:Ity_I64 t6:Ity_I64 t7:Ity_I64 t8:Ity_I64 t9:Ity_I64 t10:Ity_I64 t11:Ity_I64 t12:Ity_I64 t13:Ity_I64 t14:Ity_I64 t15:Ity_I64 t16:Ity_I64 t17:Ity_I64 t18:Ity_I64 t19:Ity_I64 t20:Ity_I64 t21:Ity_I64 t22:Ity_I64 t23:Ity_I1 t24:Ity_I64 t25:Ity_I64 t26:Ity_I64 t27:Ity_I64 t28:Ity_I64 t29:Ity_I64 t30:Ity_I64

00 | ------ IMark(0x4000ec, 4, 0) ------
01 | t0 = GET:F32(s0)
02 | t2 = CmpF32(t0,0.000000)
03 | t10 = 32Uto64(t2)
04 | t12 = And64(t10,0x0000000000000001)
05 | t14 = Shr64(t10,0x05)
06 | t13 = And64(t14,0x0000000000000003)
07 | t11 = Or64(t13,t12)
08 | t19 = Xor64(t11,0x0000000000000001)
09 | t18 = Shl64(t19,0x3e)
10 | t17 = Sub64(t18,0x0000000000000001)
11 | t16 = Shr64(t17,0x3d)
12 | t15 = Add64(t16,0x0000000000000001)
13 | t22 = Shr64(t11,0x01)
14 | t21 = And64(t11,t22)
15 | t20 = And64(t21,0x0000000000000001)
16 | t6 = Sub64(t15,t20)
17 | t8 = Shl64(t6,0x1c)
18 | PUT(cc_op) = 0x0000000000000000
19 | PUT(cc_dep1) = t8
20 | PUT(cc_dep2) = 0x0000000000000000
21 | PUT(cc_ndep) = 0x0000000000000000
22 | PUT(pc) = 0x00000000004000f0
23 | ------ IMark(0x4000f0, 4, 0) ------
24 | t29 = arm64g_calculate_condition(0x0000000000000050,t8,0x0000000000000000,0x0000000000000000):Ity_I64
25 | t23 = 64to1(t29)
26 | if (t23) { PUT(pc) = 0x400108; Ijk_Boring }
NEXT: PUT(pc) = 0x00000000004000f4; Ijk_Boring
}
```

This code essentially converts the value generated by `CmpF32` to `NZCV` bits (ref `mk_convert_IRCmpF64Result_to_NZCV` in `guest_arm64_toIR.c`)
When `s0` is a symbolic variable, this whole computation stays as is in the constraint added to this IRSB's state. I am looking for a way to simplify this constraint. In other cases, there is a specialization helper which converts some instances of `arm64g_calculate_condition` to `Cmp*`.

Is there a way where something similar can be done for floating-point compares too like the one above? I understand this is not just a simple replacement of the `arm64g_calculate_condition` function but one needs to look back to find the `CmpF32`.

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.