Improve Segmentation Semantics for x86

Describe the bug LowIR for instructions accessing segmented memory is “probably” incorrect, e.g.

2e 8b 02    mov eax, cs:[edx]

To Reproduce

1. Run this piece of code

open B2R2
open B2R2.FrontEnd

[<EntryPoint>]
let main argv =
  let isa = ISA.OfString "x86"
  let bytes = [| 0x2euy; 0x8buy; 0x02uy; |]
  let handler = BinHandler.Init (isa, bytes)
  let ins = BinHandler.ParseInstr handler 0UL
  ins
  |> fun i -> i.Translate handler.TranslationContext
  |> printfn "%A"
  0

1. See output

[|ISMark (0UL,3u);
  Put
    (Var (32,8,"EAX",IntelRegisterSet<1, 0, 0, 0>),
     Load
       (Little,32,
        BinOp
          (ADD,32,Var (32,1793,"CSBase",IntelRegisterSet<8000000, 0, 0, 0>),
           Var (32,11,"EDX",IntelRegisterSet<8, 0, 0, 0>),
           {HasLoad = false;
            VarInfo = IntelRegisterSet<8000008, 0, 0, 0>;
            TempVarInfo = set [];},None),
        {HasLoad = true;
         VarInfo = IntelRegisterSet<8000008, 0, 0, 0>;
         TempVarInfo = set [];},None)); IEMark 3UL|]

Expected behavior In the Intel’s segmented memory model, the semantics of cs:[edx] is not simply as loading [cs + edx].

Environment:

• OS: [e.g. iOS]
• .NET Core version: [e.g. 2.1.502]
• B2R2 version [e.g. 0.1.0]

Additional context I’m reading the paper but it does not discuss about how the memory is modelled.

[sangkilc]

I mean you can implement your own analyzer using a memory model that handles the CSBase variable correctly. For documentation, you should take a look at the file LowUIR.fs. There are extensive comments for each expression and statement of our IR. For example, https://github.com/B2R2-org/B2R2/blob/master/src/BinIR/LowUIR.fs#L48

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.