Prototype for an RzIL based analysis chain#5505

Draft

Rot127 wants to merge 326 commits into

devfrom

abstr-intr-prototype

This pull request is big! We're only showing the most recent 250 commits

Commits on Jul 17, 2026

Leaks

Rot127
authored and
thestr4ng3r
committed
Fix SEQ

Rot127
authored and
thestr4ng3r
committed
Add warnings

Rot127
authored and
thestr4ng3r
committed
Signal interpreter that the lifting failed.

Rot127
authored and
thestr4ng3r
committed
Set entry point in PC

Rot127
authored and
thestr4ng3r
committed
Remove state cleanup for now. Currently one exists anyways

Rot127
authored and
thestr4ng3r
committed
Fix argument order

Rot127
authored and
thestr4ng3r
committed
Init bitvector for globals.

Rot127
authored and
thestr4ng3r
committed
Add assert

Rot127
authored and
thestr4ng3r
committed
Fix truthy check function

Rot127
authored and
thestr4ng3r
committed
Fix BRANCH

Rot127
authored and
thestr4ng3r
committed
Read with rz_io_read_at_mapped() because it can read over map boundaries.

Rot127
authored and
thestr4ng3r
committed
Enhance logs

Rot127
authored and
thestr4ng3r
committed
Map not lifted instructions to NOP

Rot127
authored and
thestr4ng3r
committed
Spelling

Rot127
authored and
thestr4ng3r
committed
Fix NOP

Rot127
authored and
thestr4ng3r
committed
Fix arguemnt order

Rot127
authored and
thestr4ng3r
committed
Fix termination condition in interpreter

Rot127
authored and
thestr4ng3r
committed
Remove state cache for simplicity

Rot127
authored and
thestr4ng3r
committed
Fix NOP

Rot127
authored and
thestr4ng3r
committed
Fix leaks in NOP

Rot127
authored and
thestr4ng3r
committed
Read IO loads into stack buffer not heap ones.

Rot127
authored and
thestr4ng3r
committed
Fix return values and show more errors.

Rot127
authored and
thestr4ng3r
committed
Make all globals concrete by default to reach more states.

Rot127
authored and
thestr4ng3r
committed
Improve hash function a little.

Rot127
authored and
thestr4ng3r
committed
Report xrefs of LOAD/STORE/JMP.

Rot127
authored and
thestr4ng3r
committed
Move different roles the inquiry function plays into threads.

Rot127
authored and
thestr4ng3r
committed
Add xrefs to RzAnalysis

Rot127
authored and
thestr4ng3r
committed
Make analysis abortable with ctrl+c and don't allocate xrefs shared over queue

Rot127
authored and
thestr4ng3r
committed
Logs and docs

Rot127
authored and
thestr4ng3r
committed
Set PC on new effect selection

Rot127
authored and
thestr4ng3r
committed
Fix storing of memory.

Rot127
authored and
thestr4ng3r
committed
Abort on failed memory read.

Rot127
authored and
thestr4ng3r
committed
Log failed reads in more detail.

Rot127
authored and
thestr4ng3r
committed
Fix incorrect handling of PC increment of effects without jumps.

Rot127
authored and
thestr4ng3r
committed
Always assume the read succeeded.

Rot127
authored and
thestr4ng3r
committed
Terminate interpreter if it couldn't find successors.

Rot127
authored and
thestr4ng3r
committed
Warn if PC is set to an abstract value

Rot127
authored and
thestr4ng3r
committed
Print packet address of instruction with too few ops.

Rot127
authored and
thestr4ng3r
committed
Move and log set pc actions

Rot127
authored and
thestr4ng3r
committed
Fix MSB/LSB/IS_ZERO

Rot127
authored and
thestr4ng3r
committed
Init PC as concrete values

Rot127
authored and
thestr4ng3r
committed
Implement MUL

Rot127
authored and
thestr4ng3r
committed
Hexagon: Allow to set instruction packet size in RzAnalysisOp

Rot127
authored and
thestr4ng3r
committed
Refactor to make IL basic block a vector of instruction packets.

Rot127
authored and
thestr4ng3r
committed
Use printf for debug printing to make it usable with grep

Rot127
authored and
thestr4ng3r
committed
Keep the IL config in the state

Rot127
authored and
thestr4ng3r
committed
Fix detection of basic block boundaries

Rot127
authored and
thestr4ng3r
committed
Check if set PC is concrete

Rot127
authored and
thestr4ng3r
committed
Use RZ_LOG_DEBUG instead of printf

Rot127
authored and
thestr4ng3r
committed
Add xref test

Rot127
authored and
thestr4ng3r
committed
Use latest queue modernizations.

Rot127
authored and
thestr4ng3r
committed
Update test with return xrefs from functions.

Rot127
authored and
thestr4ng3r
committed
Use rz_io_nread_at() to allow reading at map boundaries without failure.

Rot127
authored and
thestr4ng3r
committed
Rename rzil_analysis -> inquiry

Rot127
authored and
thestr4ng3r
committed
Add work-around for Hexagon, so 'next packet' jumps are not reported as xrefs.

Rot127
authored and
thestr4ng3r
committed
Revert to only blocking variant of queue_pop

Rot127
authored and
thestr4ng3r
committed
Fix another edge case of Hexagon IL lifting.

Rot127
authored and
thestr4ng3r
committed
Several fixes for interpretation.

Rot127
authored and
thestr4ng3r
committed
Terminate interpretation at obviously wrong address.

Rot127
authored and
thestr4ng3r
committed
Add a il memory load function which reads into a given output bit vector.

Rot127
authored and
thestr4ng3r
committed
Refactor to use RzILMem for IO and RzAnalysisILVM for setup.

Rot127
authored and
thestr4ng3r
committed
Init state with default values.

Rot127
authored and
thestr4ng3r
committed
Implement DIV and MOD

Rot127
authored and
thestr4ng3r
committed
Fix Sparc BB generation

Rot127
authored and
thestr4ng3r
committed
Map not concrete shift results to bottom.

Rot127
authored and
thestr4ng3r
committed
Add callback to print current state.

Rot127
authored and
thestr4ng3r
committed
Add test for Sparc indirect call discovery.

Rot127
authored and
thestr4ng3r
committed
Fix build for less smart CI build chains.

Rot127
authored and
thestr4ng3r
committed
Move entry-points init to command handler

Rot127
authored and
thestr4ng3r
committed
Move io.cache toggle to before iset for loop preparation.

Rot127
authored and
thestr4ng3r
committed
Add two more reference types.

Rot127
authored and
thestr4ng3r
committed
Start implementing BB tracking.

Rot127
authored and
thestr4ng3r
committed
Move all the queue init code into a static function.

Rot127
authored and
thestr4ng3r
committed
Second part implementing BB and coverage tracking.

Rot127
authored and
thestr4ng3r
committed
Continue interpretation after an invalid basic block

Rot127
authored and
thestr4ng3r
committed
Scan sections for next targets.

Rot127
authored and
thestr4ng3r
committed
Change order of arguments after rebase

Rot127
authored and
thestr4ng3r
committed
Fix queue open

Rot127
authored and
thestr4ng3r
committed
Bug fixes

Rot127
authored and
thestr4ng3r
committed
More bugs fixes

Rot127
authored and
thestr4ng3r
committed
Move 'choose successor' logic into own function.

Rot127
authored and
thestr4ng3r
committed
RzBinSymbol: Add role attribute to the layout.

Rot127
authored and
thestr4ng3r
committed
Allow to declare address intervals which should never be executed.

Rot127
authored and
thestr4ng3r
committed
Actualy Cache IL ops

Rot127
authored and
thestr4ng3r
committed
Move ownership of sent queue objects to RzInquiry.

Rot127
authored and
thestr4ng3r
committed
Track invocation of BBs and quit if they were executed more than 3 times.

Rot127
authored and
thestr4ng3r
committed
Print some status update.

Rot127
authored and
thestr4ng3r
committed
Add NULL check to not fail with -n flag

Rot127
authored and
thestr4ng3r
committed
Basic start for new yield types for function detection

Rot127
authored and
thestr4ng3r
committed
Fix test

Rot127
authored and
thestr4ng3r
committed
CLean up code

Rot127
authored and
thestr4ng3r
committed
Report yields: PC store and possible return points.

Rot127
authored and
thestr4ng3r
committed
Move yield handling into own function.

Rot127
authored and
thestr4ng3r
committed
Move the whole plugin setupt into rz_inquiry_new() and free()

Rot127
authored and
thestr4ng3r
committed
Rewrite the whole call candidate detection.

Rot127
authored and
thestr4ng3r
committed
Some clean ups

Rot127
authored and
thestr4ng3r
committed
Add basic block CFG as wrapper around RzGraph.

Rot127
authored and
thestr4ng3r
committed
Unfinished function detection algorithm.

Rot127
authored and
thestr4ng3r
committed
Finish function detection.

Rot127
authored and
thestr4ng3r
committed
Perform function detection in aaaaIp

Rot127
authored and
thestr4ng3r
committed
Renames, sharing settting og bb_cfg edge and more

Rot127
authored and
thestr4ng3r
committed
Fix incorrect bb edges

Rot127
authored and
thestr4ng3r
committed
Enable formatted inquiry function printing.

Rot127
authored and
thestr4ng3r
committed
Fix bb assignment to functions

Rot127
authored and
thestr4ng3r
committed
Fix adding of basic blocks following calls

Rot127
authored and
thestr4ng3r
committed
Move function detection into own function

Rot127
authored and
thestr4ng3r
committed
Remove the whole tail call logic for simplicity.

Rot127
authored and
thestr4ng3r
committed
Move il_bb lifting into own function.

Rot127
authored and
thestr4ng3r
committed
Add entry point always as cfep

Rot127
authored and
thestr4ng3r
committed
Add edges to analysis basic blocks

Rot127
authored and
thestr4ng3r
committed
Fix iq_fcn name

Rot127
authored and
thestr4ng3r
committed
Extend initial set of addresses to interpret.

Rot127
authored and
thestr4ng3r
committed
Add edges between calls and their (guessed) return point.

Rot127
authored and
thestr4ng3r
committed
Don't add duplicate edges to the bb cfg.

Rot127
authored and
thestr4ng3r
committed
Log more warnings

Rot127
authored and
thestr4ng3r
committed
Fix possible endless loop if interpreter fails early.

Rot127
authored and
thestr4ng3r
committed
Don't overwrite existing symbol names.

Rot127
authored and
thestr4ng3r
committed
Rename call targets -> branch targets

Rot127
authored and
thestr4ng3r
committed
Fix function naming of existing symbols

Rot127
authored and
thestr4ng3r
committed
Update tests with latest results.

Rot127
authored and
thestr4ng3r
committed
Add ARM test

Rot127
authored and
thestr4ng3r
committed
Add broken test for Mips.

Rot127
authored and
thestr4ng3r
committed
Add overview of basic function detection algo

Rot127
authored and
thestr4ng3r
committed
Also add op.fail to branch targets

Rot127
authored and
thestr4ng3r
committed
clang-format

Rot127
authored and
thestr4ng3r
committed
Add statically known to the bb_cfg

Rot127
authored and
thestr4ng3r
committed
Some code clean up and separation

Rot127
authored and
thestr4ng3r
committed
Remove duplicate basic blocks and ensure each of them has exactly one entry point.

Rot127
authored and
thestr4ng3r
committed
Demode super common logged errors

Rot127
authored and
thestr4ng3r
committed
Don't add call return points to branch target list.

Rot127
authored and
thestr4ng3r
committed
Fix tests with latest changes

Rot127
authored and
thestr4ng3r
committed
Update docs and logs

Rot127
authored and
thestr4ng3r
committed
Speed up post processing of bb cfg

Rot127
authored and
thestr4ng3r
committed
Fix random exits due to unset signal flag.

Rot127
authored and
thestr4ng3r
committed
Fix call candidate detection by resetting candidate info each bb

Rot127
authored and
thestr4ng3r
committed
Fix wrong logic error

Rot127
authored and
thestr4ng3r
committed
Speed up the whole bb_cfg complementation somewhat.

Rot127
authored and
thestr4ng3r
committed
Add now also the addresses after calls to the branch target list.

Rot127
authored and
thestr4ng3r
committed
Add non-exectuable maps to ignore list.

Rot127
authored and
thestr4ng3r
committed
Fix jumps to unmapped symbols

Rot127
authored and
thestr4ng3r
committed
Add test case to cover latest function detection fixes.

Rot127
authored and
thestr4ng3r
committed
Fix user send siganls

Rot127
authored and
thestr4ng3r
committed
Better logging.

Rot127
authored and
thestr4ng3r
committed
Add all function symbol addresses to the branch targets.

Rot127
authored and
thestr4ng3r
committed
Fix bug of too many function detections.

Rot127
authored and
thestr4ng3r
committed
Get rid of wrong assumptions that branch targets must be aligned.

Rot127
authored and
thestr4ng3r
committed
Remove unnecessary logging

Rot127
authored and
thestr4ng3r
committed
Move validation of IL ops code into function and deactivate it.

Rot127
authored and
thestr4ng3r
committed
Don't add jumps to invalid addresses to functions.

Rot127
authored and
thestr4ng3r
committed
Move warnings where they occur.

Rot127
authored and
thestr4ng3r
committed
Don't hard fail on errors in the function detection.

Rot127
authored and
thestr4ng3r
committed
Fix leaks

Rot127
authored and
thestr4ng3r
committed
Push the same object over the queue to prepare for multi-threaded interpretation.

Rot127
authored and
thestr4ng3r
committed
Fix invalid addition of size

Rot127
authored and
thestr4ng3r
committed
Move the queue initialization into the rz_interpreter_set_new()

Rot127
authored and
thestr4ng3r
committed
Reduce number of arguments passed.

Rot127
authored and
thestr4ng3r
committed
Revert "Push the same object over the queue to prepare for multi-threaded interpretation."

Rot127
authored and
thestr4ng3r
committed
Add incomplete refactor to ring buffers.

Rot127
authored and
thestr4ng3r
committed
Move initialization code into own function.

Rot127
authored and
thestr4ng3r
committed
Refactor to single running interpreter, instead of spawning mutliple threads.

Rot127
authored and
thestr4ng3r
committed
Rename state to astate (for abstract).

Rot127
authored and
thestr4ng3r
committed
Add state flag for the interpreter skeleton.

Rot127
authored and
thestr4ng3r
committed
Unfinished refactor to properly defined states of the interpreter.

Rot127
authored and
thestr4ng3r
committed
Finish refactor to run-state based interpreters.

Rot127
authored and
thestr4ng3r
committed
Reset abstract state instead of freeing and allocating it.

Rot127
authored and
thestr4ng3r
committed
Added wrong file.

Rot127
authored and
thestr4ng3r
committed
Add unsafe function to check for state.

Rot127
authored and
thestr4ng3r
committed
Convert yield_rbufs to an array to safe HT lookup time.

Rot127
authored and
thestr4ng3r
committed
Limit number of checks on rz_cons_breaked.

Rot127
authored and
thestr4ng3r
committed
Fix rebase issues

Rot127
authored and
thestr4ng3r
committed
Improve performance by casting before setting.

Rot127
authored and
thestr4ng3r
committed
Speed up rz_bv_set_from functions.

Rot127
authored and
thestr4ng3r
committed
Add multiple threads

Rot127
authored and
thestr4ng3r
committed
Remove one hash table lookup.

Rot127
authored and
thestr4ng3r
committed
Refactor to new graph.

Rot127
authored and
thestr4ng3r
committed
Remove outdated comments

Rot127
authored and
thestr4ng3r
committed
Don't add nodes of length 1 if an edge points to it.

Rot127
authored and
thestr4ng3r
committed
Fix incorrect types

Rot127
authored and
thestr4ng3r
committed
Rename getter for neighboring nodes for clarity

Rot127
authored and
thestr4ng3r
committed
Add missing negation from refactor

Rot127
authored and
thestr4ng3r
committed
Use list based graph.

Rot127
authored and
thestr4ng3r
committed
Start refactor to CFGs with edge types.

Rot127
authored and
thestr4ng3r
committed
Refactor Inquiry graph stuff (sorry forgot what exactly, I only rebase this)

Rot127
authored and
thestr4ng3r
committed
For each requested branch, add control flow edges.

Rot127
authored and
thestr4ng3r
committed
Fix conversion of RzInquiry to RzAnalysis xrefs

Rot127
authored and
thestr4ng3r
committed
Add API to get dotgraph of cfg.

Rot127
authored and
thestr4ng3r
committed
Let the Interpreter fill out the whole branch object for request. Not just the address.

Rot127
authored and
thestr4ng3r
committed
IL Cache implementation.

Rot127
authored and
thestr4ng3r
committed
Fix NULL derefence

Rot127
authored and
thestr4ng3r
committed
Fix filter of xrefs to check for permissions.

Rot127
authored and
thestr4ng3r
committed
Rename

Rot127
authored and
thestr4ng3r
committed
Stop cache early

Rot127
authored and
thestr4ng3r
committed
Speedup reduce function

Rot127
authored and
thestr4ng3r
committed
Clean up reduce function for bb cfgs.

Rot127
authored and
thestr4ng3r
committed
Rename BB to block, since they are no BBs.

Rot127
authored and
thestr4ng3r
committed
Add prefixes to log messages.

Rot127
authored and
thestr4ng3r
committed
Rename Basic Block CFG -> Block CFG, Interpreter -> Interp, add -f command option.

Rot127
authored and
thestr4ng3r
committed
Add missing NULL check

Rot127
authored and
thestr4ng3r
committed
Reduce log level for common error cases.

Rot127
authored and
thestr4ng3r
committed
Fix tests

Rot127
authored and
thestr4ng3r
committed
Remvoe unused file

Rot127
authored and
thestr4ng3r
committed
Add new headers to install

Rot127
authored and
thestr4ng3r
committed
Rename branch_targets -> control flow targets

Rot127
authored and
thestr4ng3r
committed
Disassemble instructions for each BB added to RzAnalysis

Rot127
authored and
thestr4ng3r
committed
Reduce BV_STACK_MAX_SIZE to avoid stack overflows
thestr4ng3r
committed
Fix some nomenclature
thestr4ng3r
committed
Fix underflow

Rot127
authored and
thestr4ng3r
committed
Fix comparison of ut64 (compared ptrs.

Rot127
authored and
thestr4ng3r
committed
Remove duplicate fini() call

Rot127
authored and
thestr4ng3r
committed
Fix NULL check

Rot127
authored and
thestr4ng3r
committed
Update change_cf flag if instruction si unlifted.

Rot127
authored and
thestr4ng3r
committed
Fix leaks

Rot127
authored and
thestr4ng3r
committed
Fix tests

Rot127
authored and
thestr4ng3r
committed
Reformat
thestr4ng3r
committed
Add clone and join operations
thestr4ng3r
committed
Abstract interpretation with fixpoint iteration
thestr4ng3r
committed
Add comments for block entry/exit
thestr4ng3r
committed
Fix handling calls
thestr4ng3r
committed
Unify all interpreter abbrevs to interp
thestr4ng3r
committed
Simplify IL cache requests
thestr4ng3r
committed
Adapt to RzAnalysisILContext
thestr4ng3r
committed
Remove io writes from interpreter
thestr4ng3r
committed
Split RzInterpSet into RzInterpInstance and RzInterpRunContext
thestr4ng3r
committed
Remove now unused RzInterpPlugin members
thestr4ng3r
committed
Merge some files and prepare for finer value abstraction
thestr4ng3r
committed
Remove some features before reafactoring
thestr4ng3r
committed
Move plugin data out of plugin
thestr4ng3r
committed
Move effect evaluation out of plugin and leave pure
thestr4ng3r
committed
Make interp plugin only handle actual abstract value evaluation
thestr4ng3r
committed
Minor interp loop refactor
thestr4ng3r
committed
Adjust to RzIL refinements
thestr4ng3r
committed
Move non-state out of abstract state and other minor changes
thestr4ng3r
committed
Introduce RzInterpBlock
thestr4ng3r
committed
Reorder interpreter.c
thestr4ng3r
committed
Store blocks in rbtree
thestr4ng3r
committed
Apply interpreter blocks to analysis
thestr4ng3r
committed
Merge consecutive blocks if possible
thestr4ng3r
committed
Begin testing of cfg results
thestr4ng3r
committed
Split blocks
thestr4ng3r
committed
Simplify interp_block_with_op_at_cmp
thestr4ng3r
committed
Reset data after calls and test
thestr4ng3r
committed
Add xrefs to result
thestr4ng3r
committed
Fix xrefs from addr
thestr4ng3r
committed
Fix runaway block mutations
thestr4ng3r
committed
Add result dimensions and move comments out
thestr4ng3r
committed
wip commands
thestr4ng3r
committed
Isolate interpreter driver and restructure commands
thestr4ng3r
committed
Remove now-unused code from interpreter
thestr4ng3r
committed
Begin moving ipc to driver
thestr4ng3r
committed

Uh oh!

Uh oh!

Commits

Commits on Jul 17, 2026