Class StaticFlowGraphBuilder<TInstruction>

Namespace

Echo.ControlFlow.Construction

Assembly

Echo.ControlFlow.dll

Provides an implementation of a control flow graph builder that traverses the instructions in a recursive manner, and determines for each instruction the successors by looking at the general flow control of each instruction.

public class StaticFlowGraphBuilder<TInstruction> : FlowGraphBuilder<TInstruction>, IFlowGraphBuilder<TInstruction> where TInstruction : notnull

Type Parameters

TInstruction

The type of instructions to store in the control flow graph.

Inheritance

object

FlowGraphBuilder<TInstruction>

StaticFlowGraphBuilder<TInstruction>

Implements

IFlowGraphBuilder<TInstruction>

Inherited Members

FlowGraphBuilder<TInstruction>.ConstructFlowGraph(long, IEnumerable<long>)

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FlowGraphBuilderExtensions.ConstructFlowGraph<TInstruction>(IFlowGraphBuilder<TInstruction>, long)

FlowGraphBuilderExtensions.ConstructFlowGraph<TInstruction>(IFlowGraphBuilder<TInstruction>, long, IEnumerable<ExceptionHandlerRange>)

Remarks

This flow graph builder does not do any emulation or data flow analysis. Therefore, this flow graph builder can only be reliably used when the instructions to graph do not contain any indirect branching instructions. For example, if we target x86, the instruction jmp 12345678h is possible to process using this graph builder, but jmp eax is not.

Constructors

StaticFlowGraphBuilder(IArchitecture<TInstruction>, IEnumerable<TInstruction>, IStaticSuccessorResolver<TInstruction>)

Creates a new static graph builder using the provided instruction successor resolver.

public StaticFlowGraphBuilder(IArchitecture<TInstruction> architecture, IEnumerable<TInstruction> instructions, IStaticSuccessorResolver<TInstruction> successorResolver)

Parameters

architecture IArchitecture<TInstruction>

The architecture of the instructions.

instructions IEnumerable<TInstruction>

The instructions to traverse.

successorResolver IStaticSuccessorResolver<TInstruction>

The object used to determine the successors of a single instruction.

Exceptions

ArgumentNullException

Occurs when any of the arguments is null.

StaticFlowGraphBuilder(IStaticInstructionProvider<TInstruction>, IStaticSuccessorResolver<TInstruction>)

Creates a new static graph builder using the provided instruction successor resolver.

public StaticFlowGraphBuilder(IStaticInstructionProvider<TInstruction> instructions, IStaticSuccessorResolver<TInstruction> successorResolver)

Parameters

instructions IStaticInstructionProvider<TInstruction>

The instructions to traverse.

successorResolver IStaticSuccessorResolver<TInstruction>

The object used to determine the successors of a single instruction.

Exceptions

ArgumentNullException

Occurs when any of the arguments is null.

Properties

Architecture

Gets the architecture of the instructions to graph.

public override IArchitecture<TInstruction> Architecture { get; }

Property Value

IArchitecture<TInstruction>

Instructions

Gets the instructions to traverse.

public IStaticInstructionProvider<TInstruction> Instructions { get; }

Property Value

IStaticInstructionProvider<TInstruction>

SuccessorResolver

Gets the object used to determine the successors of a single instruction.

public IStaticSuccessorResolver<TInstruction> SuccessorResolver { get; }

Property Value

IStaticSuccessorResolver<TInstruction>

Methods

CollectInstructions(long, IEnumerable<long>)

Traverses the instructions and records block headers and successor information about each traversed instruction.

protected override IInstructionTraversalResult<TInstruction> CollectInstructions(long entrypoint, IEnumerable<long> knownBlockHeaders)

Parameters

entrypoint long

The address of the first instruction to traverse.

knownBlockHeaders IEnumerable<long>

A list of known block headers that should be included in the traversal.

Returns

IInstructionTraversalResult<TInstruction>

An object containing the result of the traversal, including the block headers and successors of each instruction.