Improve Segmentation Semantics for x86
See original GitHub issueDescribe the bug LowIR for instructions accessing segmented memory is “probably” incorrect, e.g.
2e 8b 02 mov eax, cs:[edx]
To Reproduce
- Run this piece of code
open B2R2
open B2R2.FrontEnd
[<EntryPoint>]
let main argv =
let isa = ISA.OfString "x86"
let bytes = [| 0x2euy; 0x8buy; 0x02uy; |]
let handler = BinHandler.Init (isa, bytes)
let ins = BinHandler.ParseInstr handler 0UL
ins
|> fun i -> i.Translate handler.TranslationContext
|> printfn "%A"
0
- See output
[|ISMark (0UL,3u);
Put
(Var (32,8,"EAX",IntelRegisterSet<1, 0, 0, 0>),
Load
(Little,32,
BinOp
(ADD,32,Var (32,1793,"CSBase",IntelRegisterSet<8000000, 0, 0, 0>),
Var (32,11,"EDX",IntelRegisterSet<8, 0, 0, 0>),
{HasLoad = false;
VarInfo = IntelRegisterSet<8000008, 0, 0, 0>;
TempVarInfo = set [];},None),
{HasLoad = true;
VarInfo = IntelRegisterSet<8000008, 0, 0, 0>;
TempVarInfo = set [];},None)); IEMark 3UL|]
Expected behavior
In the Intel’s segmented memory model, the semantics of cs:[edx]
is not simply as loading [cs + edx]
.
Environment:
- OS: [e.g. iOS]
- .NET Core version: [e.g. 2.1.502]
- B2R2 version [e.g. 0.1.0]
Additional context I’m reading the paper but it does not discuss about how the memory is modelled.
Issue Analytics
- State:
- Created 5 years ago
- Comments:5 (4 by maintainers)
Top Results From Across the Web
Image Segmentation: Tips and Tricks from 39 Kaggle ...
Clustering of 3d segmentation with the 0.5 threshold; Identify if there is a substantial ... Apply pseudo labeling to test data in order...
Read more >A 2021 guide to Semantic Segmentation
Low-Latency Video Semantic Segmentation This paper improves on top of the above discussion by adaptively selecting the frames to compute the ...
Read more >Semantic Segmentation - The Definitive Guide for 2021
In this article, we'll take a deep dive into the world of semantic segmentation. Some of the items that will be covered include:...
Read more >Segment size in x86 real mode
The segment limit in real mode is 64K, even on a 386 or later CPU where you can use 32-bit address-size via prefixes....
Read more >x86 memory segmentation
x86 memory segmentation refers to the implementation of memory segmentation in the Intel x86 computer instruction set architecture.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I mean you can implement your own analyzer using a memory model that handles the CSBase variable correctly. For documentation, you should take a look at the file
LowUIR.fs
. There are extensive comments for each expression and statement of our IR. For example, https://github.com/B2R2-org/B2R2/blob/master/src/BinIR/LowUIR.fs#L48This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.