\u7279\u522b\u8bf4\u660e：\u672c\u5e16\u4e0d\u63d0\u4f9b\u4e00\u952e\u8131\u58f3\u6216\u8fc7\u68c0\u6d4b\u4ee3\u7801，\u4ec5\u516c\u5f00\u6211\u5728\u8fd8\u539f VMP \u865a\u62df\u673a\u6267\u884c\u6846\u67b6\u65f6\u7684\u5bc4\u5b58\u5668\u951a\u5b9a\u65b9\u6cd5\u8bba\u548c IR \u63d0\u5347\u8fc7\u7a0b\u4e2d\u7684\u5361\u70b9\u3002\u6211\u77e5\u9053\u5b83\u4e0d\u5b8c\u6574，\u4f46\u5e02\u9762\u4e0a\u516c\u5f00\u8d44\u6599\u91cc，\u5927\u591a\u6570\u8fd8\u662f\u5728\u8bb2 handler \u548c\u5b57\u8282\u7801，\u624b\u52a8\u5206\u6790<\/p>\n
\u4f9d\u65e7\u662f VMP \u65b9\u9762\u7684\u5185\u5bb9\u4f46 VMP \u4e5f\u786e\u5b9e\u662f\u4e00\u4e2a\u96be\u70b9，\u5404\u79cd\u5404\u6837\u7684\u65e0\u9650\u53d8\u4f53，\u5404\u79cd\u5404\u6837\u7684\u601d\u8def，\u8fd8\u662f\u5148\u6765\u56de\u987e\u4e00\u4e0b<\/p>\n
Unpacking Virtualization Obfuscators（WOOT 2009）\u7684\u516d\u6b65\u6cd5\u5219<\/p>\n
\u7136\u540e\u770b\u6211\u4eec\u505a\u4e86\u4ec0\u4e48\u65b9\u9762\u7684\u7b80\u5316\u548c\u4f18\u5316<\/p>\n
\u9996\u5148\u76f4\u63a5\u6765\u4e00\u904d\u6d41\u7a0b<\/p>\n
so: 0x2e01b8(ollvm\u6df7\u6dc6\u5916\u58f3)
\n -> 0x2E2B34(\u95f4\u63a5\u8c03\u7528\u5916\u58f3)
\n -> 0x2E2BE8(\u58f3\u8c03\u7528\u70b9)
\n -> 0x2d3780(\u521d\u59cb\u5316\u5b57\u8282\u7801\u4e0e\u8c03\u7528VM；\u5185\u90e8\u5148\u8c03 sub_2E5C68 \u521d\u59cb\u5316VM\u4e0a\u4e0b\u6587\u3001sub_2E5D28 \u5199ctx\u5b57\u6bb5)
\n -> 0x2E5C2C(VM\u4f1a\u88ab\u5d4c\u5957\u8c03\u7528，\u5165\u53e3\u88ab\u5c01\u88c5\u6210\u72ec\u7acb\u51fd\u6570；\u7528 off_3E1E30[*(ByteCode+88)] \u9009\u5065\u58ee\u68c0\u6d4b\u5305\u88c5)
\n -> 0x2e66d0(VM\u5065\u58ee\u68c0\u6d4b：\u6808\/\u6307\u9488\u8fb9\u754c\u6821\u9a8c；\u540c\u7c7b\u5305\u88c5\u8fd8\u6709 0x2e67a8\u30010x2e68b8)
\n -> 0x2E7FE8(vmOneHandler，VM\u6267\u884c)<\/p>\n
\u8fd9\u5c31\u662f\u4ece\u5916\u5c42\u6df7\u6dc6\u4e00\u6b65\u4e00\u6b65\u8fdb\u5230 VM \u7684\u6d41\u7a0b\u4e86，\u6765\u770b\u7b2c\u4e00\u4e2a handler \u7684\u6c47\u7f16\u903b\u8f91，\u6211\u4e5f\u662f\u5c0f\u5c0f\u505a\u4e86\u4e00\u4e9b\u8bed\u4e49\u5316，\u8fd9\u4e2a\u8fd8\u597d\u8ffd\u4e00\u4e9b，\u5982\u679c\u662f OLLVM \u592a\u957f\u5c31\u53c2\u8003\u516d\u795e\u7684\u5904\u7406\u65b9\u5f0f\u5427，\u6211\u662f\u7b80\u5355\u5c0f\u770b\u4e86\u4e00\u4e0b<\/p>\n
.text:00000000002E7FE8 SUB SP, SP, #0x70
\nSTP X29, X30, [SP,#0x10+var_s0]
\nSTP X28, X27, [SP,#0x10+var_s10]
\nSTP X26, X25, [SP,#0x10+var_s20]
\nSTP X24, X23, [SP,#0x10+var_s30]
\nSTP X22, X21, [SP,#0x10+var_s40]
\nSTP X20, X19, [SP,#0x10+var_s50]
\nADD X29, SP, #0x10
\nLDR X9, [X0] ; \u4ece X0(ByteCode**) \u53d6\u5b9e\u9645\u5b57\u8282\u7801\u6307\u9488
\nMOV X23, X1 ; \u5b9a\u4f4d\u5230VM CTX\u7684\u57fa\u5740，\u4e3a\u540e\u7eed\u505a\u51c6\u5907
\nMOV W8, #0x6064
\nADRL X25, handlerTables ; \u4ece\u8fd9\u91cc\u5c31\u53ef\u4ee5\u5b9a\u6570\u636e\u6d41\u8f6c\u548chandler\u8df3\u8f6c\u8fb9\u754c\u4e86
\nMOV X19, X1 ; VM\u4e0a\u4e0b\u6587，\u8fd9\u4e2a\u4e0d\u77e5\u9053\u662f\u505a\u4ec0\u4e48\u7684
\nLDRH W10, [X9]
\nMOV X20, X0 ; \u4ee5\u540e\u7684\u5b57\u8282\u7801\u6765\u6e90，\u951a\u70b9\u5bc4\u5b58\u5668\u4e4b\u4e00
\nSTR WZR, [X23,#0xC]! ; \u6307\u9488\u52a0\u6cd5，\u521d\u59cb\u5316 IP = 0
\nADD X24, X23, X8 ; X24 = ctx+0x6070 = \u6574\u6570\u865a\u62df\u5bc4\u5b58\u5668\u6587\u4ef6\u57fa\u5740(32\u00d78B)
\nMOV W8, #0x6164
\nLDR X10, [X25,X10,LSL#3]
\nADD X26, X23, X8 ; X26 = ctx+0x6170 = 32\u4f4d\u6d6e\u70b9\u5bc4\u5b58\u5668\u6587\u4ef6\u57fa\u5740([x26,idx,lsl #2])
\nMOV W8, #0x61E4
\nADD X27, X23, X8 ; X27 = ctx+0x61F0 = 64\u4f4d\u6d6e\u70b9\u5bc4\u5b58\u5668\u6587\u4ef6\u57fa\u5740([x27,idx,lsl #3])
\nMOV X8, X9
\nSTP X26, X27, [SP,#0x10+var_10]
\n.text:00000000002E804C BR X10<\/p>\n
\u90a3\u4e48\u4e5f\u5c31\u5dee\u4e0d\u591a\u7406\u89e3\u4e86\u951a\u70b9\u4f4d\u7f6e\u4e86<\/p>\n
IDA + trace \u4ea4\u53c9\u9a8c\u8bc1<\/p>\n
sub_2E5C68(0x2e5c68，\u7531 0x2d3780 \u8c03\u7528，\u521d\u59cb\u5316 VM \u4e0a\u4e0b\u6587)：<\/p>\n
MOV X8, #0x803; MOVK 0xC0C,<<16; MOVK 0x706,<<32; MOVK 0x200,<<48 ; X8 = 0x020007060C0C0803 \u9b54\u6570
\nSTR X8, [X0] ; ctx+0x0 = \u9b54\u6570
\nSTRH W9, [X0,#8] ; ctx+0x8 = 0x200
\nSTR WZR, [X0,#0xC] ; ctx+0xC = 0（IP）
\nSTR XZR, [X19,#0x10] ; ctx+0x10 = 0
\nSTRB W10, [X19,#0x20] ; ctx+0x20 = 1
\nMOV W8, #0x6070
\nADD X0, X0, X8 ; X0 = ctx+0x6070
\nBL .memset ; memset(ctx+0x6070, 0, 0x381) \u2190 \u6e05\u96f6\u6574\u4e2a\u5bc4\u5b58\u5668\u533a
\nMOV W9, #0x6030
\nADD X20, X19, X9 ; X20 = ctx+0x6030
\nSTR X20, [X19,#0x6078] ; ctx+0x6078 = ctx+0x6030 \u2190 \u5bc4\u5b58\u5668\u69fd1\u9884\u7f6e（= [x24+8]）<\/p>\n
trace \u91cc VM \u5165\u53e3\u524d [x24+8] = 0x7853c84200 = ctx+0x6030，\u4e0e\u4e0a\u5b8c\u5168\u543b\u5408\u3002<\/p>\n
\u5168 trace \u5171 34.3 \u4e07\u6b21 [x24, idx, lsl\/uxtw #3] \u7d22\u5f15\u8bbf\u95ee，\u7d22\u5f15\u503c\u4e25\u683c\u843d\u5728 [0, 31] \u2192 32 \u4e2a 8 \u5b57\u8282\u69fd = 0x100，\u6070\u597d\u586b\u6ee1 0x6070 \u2192 0x6170<\/p>\n
\u6240\u6709 handler \u4e00\u81f4：a1=x8（\u5f53\u524d VM \u6307\u4ee4），\u64cd\u4f5c\u6570\u5728 [x8+8]\/[x8+9]\/[x8+0xA]，\u8bbf\u95ee\u865a\u62df\u5bc4\u5b58\u5668\u4e00\u5f8b *(x24 + 8*idx)\u3002\u5b9e\u6d4b\u793a\u4f8b：<\/p>\n
| 0x2eae28<\/td>\n | CMP\/BEQ：if(reg[a]==reg[b]) offset=0; IP += offset+1<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2eb03c<\/td>\n | SHL：reg[dst] = reg[src] << (shift+32)<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2e92bc<\/td>\n | OR：reg[dst] = reg[a] | reg[b]<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2e96b8<\/td>\n | LDRB：reg[dst] = *(u8*)(reg[base] + i16)<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2e8e40<\/td>\n | STR：*(reg[base] + i16) = reg[val]<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2e95cc<\/td>\n | LDR32\u219232 \u4f4d\u6d6e\u70b9\u6587\u4ef6：*(u32*)(x26 + 4*idx) = *(u32*)(reg[base]+i16)<\/td>\n<\/tr>\n | ||||||||||||||||||||||||||||||||
| 0x2e9e90<\/td>\n | 64 \u4f4d\u6d6e\u70b9 \u2192STR：*(u64*)(reg[base]+i16) = *(u64*)(x27 + 8*idx)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n4. VM \u4e0a\u4e0b\u6587\u5e03\u5c40（ctx \u7531 0x2d3780 \u5728\u6808\u4e0a\u5206\u914d，sp \u4f20\u5165）<\/h5>\n
|
\u6765\u770b\u4e00\u4e2a\u5b9e\u9645\u7684 handler \u5427，\u4ece trace \u91cc\u9762\u62ff\u4e00\u6761\u7b80\u5355\u7684，handler \u8868\u7684\u6570\u91cf\u662f\u771f\u4e0d\u5c11\u7684，\u57fa\u7840 handler \u662f\u4ece 0x3E1E58 \u5230 0x3E3708 \u4e00\u5171\u662f 1580 \u4e2a，\u8c03\u7528\u5230\u4e86 335 \u4e2a(\u65e5\u5fd7\u91cf 340 \u4e07)，\u7136\u540e\u8fd8\u6709 VMP \u4e13\u5c5e\u7684 CF \u7cfb\u5217\u51fd\u6570\u8c03\u7528，\u4e5f\u662f\u8981\u5355\u72ec\u5904\u7406\u7684，\u8fd8\u6709 VMP \u7684\u6808\u64cd\u4f5c\u6216\u8005\u5bc4\u5b58\u5668\u5f52\u4e00\u5316\u64cd\u4f5c，\u8fd9\u91cc\u5c31\u53ef\u4ee5\u76f4\u63a5\u91c7\u7528\u7f16\u8bd1\u5668\u524d\u4eba\u6240\u8bf4\u7684\u591a\u8d9f(Pass)\u4e86，\u6700\u8457\u540d\u7684\u5c31\u662f LLVM Pass \u4e86，\u76f8\u4fe1\u5404\u4f4d\u5927\u4f6c\u6709\u7814\u7a76\u8fc7 OLLVM \u7684\u4e5f\u770b\u8fc7\u8fd9\u4e1c\u897f<\/p>\n
.text:00000000002E87E8 LDR W9, [X23] ; \u8bfb VM \u7684 IP \u5bc4\u5b58\u5668
\n.text:00000000002E87EC MOV W12, #0x30 ; W12 = 0x30（VM \u6307\u4ee4\u5927\u5c0f）
\n.text:00000000002E87F0 LDR X11, [X20] ; \u4ece X20 \u8bfb\u53d6\u5f53\u524d\u5b57\u8282\u7801\u57fa\u5740
\n.text:00000000002E87F4 LDRB W10, [X8,#8] ; \u8bfb\u5b57\u8282\u7801\u504f\u79fb +8 \u7684 1 \u5b57\u8282\u64cd\u4f5c\u6570（\u5bc4\u5b58\u5668\u7d22\u5f15：\u6e90）
\n.text:00000000002E87F8 ADD W9, W9, #1 ; IP++
\n.text:00000000002E87FC LDRB W13, [X8,#9] ; \u8bfb\u5b57\u8282\u7801\u504f\u79fb +9 \u7684 1 \u5b57\u8282\u64cd\u4f5c\u6570（\u5bc4\u5b58\u5668\u7d22\u5f15：\u76ee\u6807）
\n.text:00000000002E8800 LDRSH X14, [X8,#0xA] ; \u8bfb\u5b57\u8282\u7801\u504f\u79fb +0xA \u7684 16 \u4f4d\u6709\u7b26\u53f7\u504f\u79fb\u91cf
\n.text:00000000002E8804 NOP
\n.text:00000000002E8808 SMADDL X8, W9, W12, X11 ; X8 = \u5b57\u8282\u7801\u57fa\u5740 + IP * 0x30（\u4e0b\u4e00\u6761 VM \u6307\u4ee4\u5730\u5740）
\n.text:00000000002E880C LDR X10, [X24,X10,LSL#3] ; \u53d6\u6e90\u5bc4\u5b58\u5668\u503c：regs[src]
\n.text:00000000002E8810 STR W9, [X23] ; \u66f4\u65b0 VM \u7684 IP \u5bc4\u5b58\u5668
\n.text:00000000002E8814 LDRH W11, [X8] ; \u8bfb\u4e0b\u4e00\u6761 VM \u6307\u4ee4\u7684 opcode
\n.text:00000000002E8818 ADD X10, X10, X14 ; \u6e90\u5bc4\u5b58\u5668\u503c（\u901a\u5e38\u662f\u6307\u9488）+= \u504f\u79fb\u91cf
\n.text:00000000002E881C STR X10, [X24,X13,LSL#3] ; regs[dst] = \u65b0\u503c
\n.text:00000000002E8820 LDR X11, [X25,X11,LSL#3] ; \u7528\u4e0b\u4e00\u6761 opcode \u67e5 handler \u8868
\n.text:00000000002E8824 BR X11 ; \u8df3\u8f6c\u5230\u4e0b\u4e00\u4e2a handler<\/p>\n
\u9996\u5148\u6211\u4eec\u786e\u5b9a\u4e00\u4e0b\u6211\u4eec\u8981\u6ce8\u610f\u7684：IP\u3001(src1\u3001src2\u3001dest)\u4e09\u4e2a\u5bc4\u5b58\u5668，\u8fd8\u6709\u4e00\u4e2a\u68d8\u624b\u7684\u4e1c\u897fx8\u5bc4\u5b58\u5668，\u8fd9\u4e1c\u897f\u6539\u540e\u7ed9\u4e0b\u4e00\u6761\u4f7f\u7528\u7684，\u8fd9\u65f6\u5019\u5c31\u9700\u8981\u4e00\u4e2a\u6807\u8bb0\u4f4d\u7f6e，\u6211\u6597\u80c6\u731c\u6d4b\u4e00\u4e0bnop\u5c31\u662f\u7ed9x8\u7684\u53d8\u5316\u51c6\u5907\u7684，\u968f\u540e\u5c31\u7ed9\u6211\u6253\u6b7b\u4e86，\u8fd9\u73a9\u610f\u662f\u771f\u6ca1\u5565\u89c4\u5f8b\u554a，\u6211\u4e5f\u662f\u771f\u6ca1\u62db\u4e86<\/p>\n
\u8fd9\u65f6\u5019\u5c31\u9700\u8981\u51b7\u9759\u4e0b\u6765\u4e86，\u4ece\u7b80\u5355\u7684\u5f00\u59cb\u60f3：<\/p>\n
\u8fd9\u4e09\u6761\u4e3b\u8981\u7684\u7ebf\u5c31\u8fed\u4ee3\u51fa\u6765\u4e86，\u7b2c\u4e00\u4e2a\u8d1f\u8d23\u6211\u4eec\u5207\u5272 handler \u7684\u8fb9\u754c，\u7b2c\u4e8c\u53ef\u4ee5\u770b\u6267\u884c\u7684\u5bf9\u4e0d\u5bf9，\u7b2c\u4e09\u4e2a\u5c31\u662f handler \u903b\u8f91\u65b9\u9762\u7684\u4e86<\/p>\n
The "iframe" tag is not supported by your browser.<\/p>\n
The "iframe" tag is not supported by your browser.<\/p>\n
The "iframe" tag is not supported by your browser.<\/p>\n
\u5728\u5177\u4f53\u770b\u4e4b\u524d，\u6211\u4eec\u6765\u627e\u4e00\u4e0b\u63a7\u5236 VM \u8fd4\u56de\u7684\u51fd\u6570，\u627e\u5230\u4ee5\u540e\u5c31\u53ef\u4ee5\u77e5\u9053 VMP \u7684\u5d4c\u5957\u6df1\u5ea6\u4e86，\u5165\u53e3 0x2e6774（sub_2E66D0 \u91cc bl vmOneHandler）\u548c\u8fd4\u56de 0x2ebc54 \u80fd\u7cbe\u786e\u5bf9\u4e0a\u4e4b\u540e，\u8c03\u7528\u6df1\u5ea6\u5c31\u6709\u620f\u4e86\u3002\u8fd9\u91cc\u8bb0\u4e00\u4e0b\u600e\u4e48\u627e\u5230\u7684\u8fd9\u4e2a RET，\u7b97\u662f log + IDA \u5bf9\u62cd\u7684\u4e00\u4e2a\u6807\u51c6\u6253\u6cd5\u3002<\/p>\n
VM \u91cc\u6240\u6709 handler \u90fd\u662f br \u5c3e\u8df3（threaded interpreter），\u552f\u4e00\u4e00\u6b21\u771f\u6b63\u7684 ret \u5c31\u662f\u8fd4\u56de\u3002\u800c\u6bcf\u4e2a wrapper \u90fd\u662f bl vmOneHandler \u8fdb VM，bl \u4f1a\u5199 LR，\u6240\u4ee5：<\/p>\n
\u5728 code.log \u91cc\u641c ret \u6307\u4ee4，\u4e14\u6267\u884c\u524d LR = bl \u8bbe\u4e0b\u7684\u8fd4\u56de\u5730\u5740，\u547d\u4e2d\u7684\u5c31\u662f VMP \u7684 RET\u3002<\/p>\n
\u5168 trace 61 \u6b21 VM \u6267\u884c（bl \u5728 0x2e6774，LR=0x794da10778），\u5168\u90e8\u547d\u4e2d\u540c\u4e00\u4e2a ret \u2014\u2014 \u6a21\u5757\u504f\u79fb 0x2ebc54，\u8fd4\u56de\u70b9 0x2e6778，\u7cbe\u786e\u5f39\u56de wrapper\u3002<\/p>\n
2d22f 0x794da15c40 0x2ebc40 "str w8, [x23]" ; \u8fd4\u56de\u503c \u2192 ctx+0xC
\n2d230 0x794da15c44 0x2ebc44 "ldp x24, x23, [sp, #0x40]"
\n2d231 0x794da15c48 0x2ebc48 "ldp x28, x27, [sp, #0x20]"
\n2d232 0x794da15c4c 0x2ebc4c "ldp x29, x30, [sp, #0x10]" ; \u6062\u590d LR=0x794da10778
\n2d233 0x794da15c50 0x2ebc50 "add sp, sp, #0x70" ; \u62c6 vmOneHandler \u7684\u5e27
\n2d234 0x794da15c54 0x2ebc54 "ret"
\n2d235 0x794da10778 0x2e6778 "ldr x8, [x19, #0x10]" ; \u56de\u5230 wrapper<\/p>\n
\u5b83\u5c31\u662f\u4e2a\u666e\u901a handler，\u4e0d\u662f\u7279\u6b8a\u8def\u5f84，opcode 0xbd \u5206\u6d3e\u8fc7\u6765\u7684：<\/p>\n
.text:00000000002EBC2C LDRB W8, [X8,#8] ; \u64cd\u4f5c\u6570 = \u8fd4\u56de\u54ea\u4e2a\u5bc4\u5b58\u5668\u69fd（\u672c\u6b21 trace \u662f 3）
\n.text:00000000002EBC30 LDP X20, X19, [SP,#0x60] ; \u2510
\n.text:00000000002EBC34 LDR X8, [X24,X8,LSL#3] ; \u2502 \u4ece\u5bc4\u5b58\u5668\u6587\u4ef6\u53d6\u8fd4\u56de\u503c（64 \u4f4d）
\n.text:00000000002EBC38 LDP X22, X21, [SP,#0x50] ; \u2502
\n.text:00000000002EBC3C LDP X26, X25, [SP,#0x30] ; \u2502 \u62c6\u5e27
\n.text:00000000002EBC40 STR W8, [X23] ; \u2502 \u5b58\u4f4e 32 \u4f4d \u2192 ctx+0xC（\u8fd4\u56de\u503c）
\n.text:00000000002EBC44 LDP X24, X23, [SP,#0x40] ; \u2502
\n.text:00000000002EBC48 LDP X28, X27, [SP,#0x20] ; \u2502
\n.text:00000000002EBC4C LDP X29, X30, [SP,#0x10] ; \u2502 \u6062\u590d LR
\n.text:00000000002EBC50 ADD SP, SP, #0x70 ; \u2518 \u5e27 = vmOneHandler \u5f00\u51fa\u6765\u7684\u90a3 0x70
\n.text:00000000002EBC54 RET X30<\/p>\n
\u94fe\u5c3e\u7684\u666e\u901a handler（0x2e8e7c）\u8bfb\u5230\u4e0b\u4e00\u6761 opcode 0xbd \u2192 handlerTables[0xbd] = 0x2ebc2c \u2192 br x11 \u63a5\u8fdb\u8fd4\u56de handler，\u8ddf\u5176\u5b83\u5206\u6d3e\u4e00\u6a21\u4e00\u6837\u3002<\/p>\n
\u5176\u5b9e\u5230\u8fd9\u5757\u4ee5\u540e\u6211\u90fd\u60f3\u76f4\u63a5\u5199\u6c47\u7f16\u8fd8\u539f\u4e86，\u6211\u4e5f\u611f\u89c9\u53ef\u4ee5\u50cf\u4e00\u4e2a\u529e\u6cd5\u5c1d\u8bd5\u6c47\u7f16\u53bb\u505a\u8fd9\u5757\u5185\u5bb9(？\u81ea\u5df1\u5199\u4e00\u4e2a\u5e93)，\u56e0\u4e3a\u5230 IR \u5c42\u9762\u4ee5\u540e\u5c31\u771f\u5f88\u96be\u76f4\u63a5\u5bf9\u5e94 trace \u4e86，\u8fd9\u5757\u5c31\u5f88\u86cb\u75bc<\/p>\n
\u6587\u672c\u89e3\u6790\u4e4b\u7c7b\u7684\u5c31\u4e0d\u63d0\u4e86，\u6211\u4eec\u76f4\u63a5\u5b9a x25 \u5bc4\u5b58\u5668，\u7136\u540e\u770b x25 \u53d6\u503c\u540e\u7684\u5185\u5bb9\u6709\u6ca1\u6709\u88ab br \u8df3\u8f6c\u6216\u8005 br \u8df3\u8f6c\u5bc4\u5b58\u5668\u7684\u503c\u662f\u4e0d\u662f\u88ab x25 \u8d4b\u7684，\u5177\u4f53\u64cd\u4f5c\u53ef\u4ee5\u770b\u770b\u4ee3\u7801，\u6211\u5199\u7684\u4e5f\u662f\u975e\u5e38\u975e\u5e38\u7b80\u5355\u4e86<\/p>\n
\u5728 handler \u5207\u5272\u7684\u57fa\u7840\u4e0a，\u76f4\u63a5\u627e x23 \u5bc4\u5b58\u5668，\u770b\u5b83\u53d6\u7684\u5730\u65b9\u548c\u5b58\u7684\u5730\u65b9，\u4ee3\u5165 trace \u770b\u770b\u52a0\u4e86\u591a\u5c11\u6216\u8005 P-code \u753b\u56fe\u627e\u64cd\u4f5c\u4f4d\u7f6e<\/p>\n
\u8fd9\u4e5f\u662f\u6700\u96be\u7684\u70b9\u4e5f\u662f\u5168\u7bc7\u7684\u7cbe\u534e\u6240\u5728，\u8fd9\u5757\u5c31\u5148\u4e0a\u5e1d\u89c6\u89d2\u4e00\u4e0b，\u5148\u5c1d\u8bd5\u89e3\u51b3\u96be\u70b9<\/p>\n
\u6839\u636e ARM64 \u7684\u6307\u4ee4\u96c6\u5730\u5740\u957f\u5ea6\u4e00\u81f4，\u4ece bl\u3001blr \u7b49\u7b49\u8c03\u7528\u6307\u4ee4\u7684\u5730\u5740\u5230\u52a0 4 \u7684\u5730\u5740，\u88ab\u8c03\u7528\u7684\u5185\u5bb9\u5199\u4e00\u4e2a\u5217\u8868\u5185，handler \u903b\u8f91\u5199\u5728\u4e00\u4e2a\u5217\u8868\u5185，\u8fd9\u65f6\u5019\u6211\u5728\u60f3\u8981\u662f VM \u8c03\u7528 VM \u600e\u4e48\u529e？\u96be\u4e0d\u6210\u771f\u5199\u90a3\u4e48\u591a？
\n\u597d\u50cf\u53c8\u4e0d\u9700\u8981，\u5bf9 CALL \u7c7b\u76f4\u63a5\u6839\u636e trace \u63d0\u53d6\u76f8\u5173\u4fe1\u606f，\u8c03\u7528\u70b9\u5199\u63cf\u8ff0\u800c\u975e\u5168\u90e8\u5185\u5bb9<\/p>\n
CALL@{Addr|Arg} \/\/ \u540c\u65f6\u53c8\u53ef\u4ee5\u6807\u8bb0\u51fa\u6765\u6765\u6e90，LIBC\u3001Call Function\u3001VM reg\/stack<\/p>\n
\u4f46\u662f\u6298\u7684\u6781\u9650\u5462？VM \u8c03\u7528\u81ea\u5df1\u3001\u5c01\u88c5\u7684\u903b\u8f91\u51fd\u6570\u3001libc \u7b49\u7b49\u7cfb\u7edf\u51fd\u6570\u8fd9\u4e9b\u600e\u4e48\u5904\u7406？\u6709\u4e00\u4e2a\u601d\u8def，\u4f46\u662f\u4e0d\u662f\u5f88\u9760\u8c31\u76f4\u63a5\u6df1\u5ea6\u4f18\u5148，\u5904\u7406\u6700\u6df1\u5c42\u6b21\u7684 handler，\u7136\u540e\u9010\u6b65\u56de\u6eaf，\u4f46\u662f\u597d\u50cf\u53c8\u4e0d\u592a\u9700\u8981\u60f3\u8fd9\u79cd\u95ee\u9898，\u6211\u6700\u524d\u9762\u90fd\u5df2\u7ecf\u5207\u51fa\u6765 handler \u5206\u5757\u4e86，\u6211\u5904\u7406\u7684\u53ea\u6709 handler \u8fd9\u79cd\u9897\u7c92\u5ea6\u7684\u4e1c\u897f，\u611f\u89c9\u8fd8\u9700\u8981\u4e00\u6b21\u6298\u53e0，\u7136\u540e\u6839\u636e vmp \u7684\u951a\u70b9\u5bc4\u5b58\u5668\u8fdb\u884c\u6570\u636e\u6d41\u8ffd\u8e2a，\u8fd9\u65f6\u5019\u5c31\u5dee\u4e0d\u591a\u53ef\u4ee5\u7406\u89e3\u5230\u4ec0\u4e48\u51fd\u6570\u662f\u64cd\u4f5c vm \u76f8\u5173(\u6808\u3001\u5bc4\u5b58\u5668)，\u4ec0\u4e48\u662f\u539f\u751f\u51fd\u6570，\u7136\u540e\u5f00\u59cb\u6298\u53e0<\/p>\n
\u7b2c\u4e00\u6b21\u6298\u53e0\u62c6\u51fa\u6765 handler \u7684\u64cd\u4f5c，\u7b2c\u4e8c\u6b21\u6298\u53e0\u62c6\u51fa\u6765 VM \u5728\u6267\u884c\u539f\u751f\u903b\u8f91\u524d\u505a\u4e86\u4ec0\u4e48\u4e1c\u897f，\u600e\u4e48\u51c6\u5907\u53c2\u6570\u548c\u8fd4\u56de\u503c\u7684
\n\u7b2c\u4e8c\u6b21\u6298\u53e0\u8fd9\u5757\u8fd8\u662f\u56fe\u7b97\u6cd5，\u770b\u770b\u90fd\u51c6\u5907\u4e86\u4ec0\u4e48\u951a\u70b9\u5bc4\u5b58\u5668\u6216\u8005\u662f\u5bf9\u4e0a\u4e0b\u6587\u600e\u4e48\u64cd\u4f5c\u7684，\u7136\u540e\u600e\u4e48\u4f20\u9012\u7ed9\u539f\u751f\u51fd\u6570\u7684，\u539f\u751f\u51fd\u6570\u7684\u8fd8\u539f\u4e0d\u5728\u6211\u4eec\u8003\u8651\u65b9\u6cd5\u5185，\u8fd9\u5757\u53ef\u4ee5\u8003\u8651\u76f4\u63a5\u8f93\u51fa\u539f\u59cb\u65e5\u5fd7\u4ea4\u7ed9\u6a21\u578b\u770b<\/p>\n
\u53c2\u6570\u65b9\u9762\u4e5f\u8981\u5bf9\u9f50，\u4ec0\u4e48\u53c2\u6570\u4ea4\u7ed9\u8c01\u4e86，\u5982\u679c\u4e0d\u5199\u660e\u767d\u6a21\u578b\u5c31\u8ddf\u50bb\u5b50\u4e00\u6837，\u778e\u5bf9\u7167\u4e86<\/p>\n
(\u4e0a\u5e1d\u89c6\u89d2：\u8fd9\u5757\u6211\u540e\u9762\u76f4\u63a5\u9009\u62e9\u4e86\u9012\u5f52\u51fd\u6570\u8c03\u7528\u6808\u4e86，\u4e0d\u8fc7\u662f\u53ea\u770b blr \u548c bl \u4e24\u4e2a\u5185\u5bb9，\u770b\u770b blr \u7b2c\u4e8c\u6b21\u8d70\u7684\u90fd\u662f\u8c01，\u662f\u4e0d\u662f x8 \u8fd9\u4e2a\u6807\u8bb0，\u5982\u679c\u4e0d\u662f\u7684\u8bdd\u8d70\u7684\u662f\u8c01，\u56e0\u4e3a\u6211\u4eec\u5df2\u7ecf\u6709\u4e86\u5168\u90e8\u7684\u8c03\u7528\u6808\u4e86，\u904d\u5386\u4e00\u4e0b\u4e5f\u4e0d\u96be)<\/p>\n
\u73b0\u5728\u53c8\u8ff7\u8d77\u6765\u4e86，\u8fd9\u662f\u771f\u6709\u70b9\u61f5\u903c\u4e86，\u5361\u4e86\u4e24\u4e2a\u70b9<\/p>\n
\u5916\u5c42\u50cf\u662f\u4e00\u4e2a\u5c0f\u8df3\u677f\u5c42，bl \u5230\u4e00\u4e2a\u51fd\u6570\u5185，\u4f46\u662f\u90a3\u4e2a\u51fd\u6570\u9664\u4e86\u5f00\u6808\u4e4b\u5916\u4ec0\u4e48\u90fd\u6ca1\u505a<\/p>\n
.text:00000000002F3624 sub_2F3624 ; DATA XREF: .data.rel.ro:00000000003E2B10\u2193o
\n.text:00000000002F3624 ADD X0, X8, #8
\n.text:00000000002F3628 MOV X1, X19
\n.text:00000000002F362C BL sub_3090E0
\n.text:00000000002F3630 LDR W8, [X19,#0xC]
\n.text:00000000002F3634 MOV W10, #0x30 ; '0'
\n.text:00000000002F3638 LDR X9, [X20]
\n.text:00000000002F363C NOP
\n.text:00000000002F3640 SMADDL X8, W8, W10, X9
\n.text:00000000002F3644 LDRH W9, [X8]
\n.text:00000000002F3648 LDR X9, [X25,X9,LSL#3]
\n.text:00000000002F364C BR X9<\/p>\n
.text:00000000003090E0 ; __int64 __fastcall sub_3090E0(_QWORD *, __int64)
\n.text:00000000003090E0 sub_3090E0 ; CODE XREF: sub_2F3624+8\u2191p
\n.text:00000000003090E0
\n.text:00000000003090E0 var_50 = -0x50
\n.text:00000000003090E0 var_4C = -0x4C
\n.text:00000000003090E0 var_48 = -0x48
\n.text:00000000003090E0 var_3C = -0x3C
\n.text:00000000003090E0 var_38 = -0x38
\n.text:00000000003090E0 var_30 = -0x30
\n.text:00000000003090E0 var_28 = -0x28
\n.text:00000000003090E0 var_20 = -0x20
\n.text:00000000003090E0 var_18 = -0x18
\n.text:00000000003090E0 var_10 = -0x10
\n.text:00000000003090E0 var_8 = -8
\n.text:00000000003090E0
\n.text:00000000003090E0 SUB SP, SP, #0x50
\n.text:00000000003090E4 LDR X14, [X0,#8]
\n.text:00000000003090E8 MOV W11, #0x6064
\n.text:00000000003090EC LDR W12, [X1,#0xC]!
\n.text:00000000003090F0 ADD X15, X1, X11
\n.text:00000000003090F4 MOV W8, #0xE8C7
\n.text:00000000003090F8 LDRB W16, [X14,#1]
\n.text:00000000003090FC MOV W9, #0xD2B8
\n.text:0000000000309100 MOVK W8, #0xDB0F,LSL#16
\n.text:0000000000309104 MOVK W9, #0xBEBF,LSL#16
\n.text:0000000000309108 STR X15, [SP,#0x50+var_38]
\n.text:000000000030910C ADD X11, SP, #0x50+var_4C
\n.text:0000000000309110 ADD X15, X15, X16,LSL#3
\n.text:0000000000309114 STR W12, [SP,#0x50+var_3C]
\n.text:0000000000309118 LDP X17, X16, [SP,#0x50+var_20]
\n.text:000000000030911C MOV X12, SP
\n.text:0000000000309120 ADD X14, X14, #2
\n.text:0000000000309124 MOV W10, #0xCDDA
\n.text:0000000000309128 MOV W13, #0xC16F
\n.text:000000000030912C MOVK W10, #0xA2F1,LSL#16
\n.text:0000000000309130 STR X1, [SP,#0x50+var_48]
\n.text:0000000000309134 MOVK W13, #0x1C95,LSL#16
\n.text:0000000000309138 STP X11, X12, [SP,#0x50+var_10]
\n.text:000000000030913C STP W9, W8, [SP,#0x50+var_50]
\n.text:0000000000309140 STP X15, X14, [SP,#0x50+var_30]
\n.text:0000000000309144 LDR W1, [X11]
\n.text:0000000000309148 CMP W1, W8
\n.text:000000000030914C B.EQ loc_3091C0
\n.text:0000000000309150
\n.text:0000000000309150 loc_309150 ; CODE XREF: sub_3090E0+B4\u2193j
\n.text:0000000000309150 ; sub_3090E0+DC\u2193j
\n.text:0000000000309150 LDR W8, [SP,#0x50+var_3C]
\n.text:0000000000309154 STP X17, X16, [SP,#0x50+var_20]
\n.text:0000000000309158 LDRB W9, [X16]
\n.text:000000000030915C MOV W0, #1
\n.text:0000000000309160 LDR X12, [SP,#0x50+var_48]
\n.text:0000000000309164 ADD W8, W8, #3
\n.text:0000000000309168 LDR X10, [SP,#0x50+var_38]
\n.text:000000000030916C LDRSH X11, [X17,#2]
\n.text:0000000000309170 STR X11, [X10,X9,LSL#3]
\n.text:0000000000309174 STR W8, [X12]
\n.text:0000000000309178 ADD SP, SP, #0x50 ; 'P'
\n.text:000000000030917C RET
\n.text:0000000000309180 ; —————————————————————————
\n.text:0000000000309180
\n.text:0000000000309180 loc_309180 ; CODE XREF: sub_3090E0+EC\u2193j
\n.text:0000000000309180 STR W10, [X12]
\n.text:0000000000309184 STR W8, [X11]
\n.text:0000000000309188 MOV W1, W8
\n.text:000000000030918C CMP W8, W8
\n.text:0000000000309190 B.EQ loc_3091C0
\n.text:0000000000309194 B loc_309150
\n.text:0000000000309198 ; —————————————————————————
\n.text:0000000000309198
\n.text:0000000000309198 loc_309198 ; CODE XREF: sub_3090E0+E8\u2193j
\n.text:0000000000309198 LDRH W16, [X14]
\n.text:000000000030919C LDR X17, [X0]
\n.text:00000000003091A0 LSL W16, W16, #0x10
\n.text:00000000003091A4 SXTW X1, W16
\n.text:00000000003091A8 ADD X16, X17, #1
\n.text:00000000003091AC STR X1, [X15]
\n.text:00000000003091B0 STR W13, [X11]
\n.text:00000000003091B4 MOV W1, W13
\n.text:00000000003091B8 CMP W13, W8
\n.text:00000000003091BC B.NE loc_309150
\n.text:00000000003091C0
\n.text:00000000003091C0 loc_3091C0 ; CODE XREF: sub_3090E0+6C\u2191j
\n.text:00000000003091C0 ; sub_3090E0+B0\u2191j
\n.text:00000000003091C0 LDR W1, [X12]
\n.text:00000000003091C4 CMP W1, W9
\n.text:00000000003091C8 B.NE loc_309198
\n.text:00000000003091CC B loc_309180<\/p>\n
.text:00000000002F113C sub_2F113C ; DATA XREF: .data.rel.ro:00000000003E28F8\u2193o
\n.text:00000000002F113C ADD X0, X8, #8
\n.text:00000000002F1140 MOV X1, X19
\n.text:00000000002F1144 BL sub_3083B0
\n.text:00000000002F1148 LDR W8, [X19,#0xC]
\n.text:00000000002F114C MOV W10, #0x30 ; '0'
\n.text:00000000002F1150 LDR X9, [X20]
\n.text:00000000002F1154 NOP
\n.text:00000000002F1158 SMADDL X8, W8, W10, X9
\n.text:00000000002F115C LDRH W9, [X8]
\n.text:00000000002F1160 LDR X9, [X25,X9,LSL#3]
\n.text:00000000002F1164 BR X9<\/p>\n
.text:00000000003083B0 ; __int64 __fastcall sub_3083B0(unsigned __int8 **, __int64)
\n.text:00000000003083B0 sub_3083B0 ; CODE XREF: sub_2F113C+8\u2191p
\n.text:00000000003083B0
\n.text:00000000003083B0 var_50 = -0x50
\n.text:00000000003083B0 var_4C = -0x4C
\n.text:00000000003083B0 var_48 = -0x48
\n.text:00000000003083B0 var_3C = -0x3C
\n.text:00000000003083B0 var_38 = -0x38
\n.text:00000000003083B0 var_2C = -0x2C
\n.text:00000000003083B0 var_28 = -0x28
\n.text:00000000003083B0 var_20 = -0x20
\n.text:00000000003083B0 var_11 = -0x11
\n.text:00000000003083B0 var_10 = -0x10
\n.text:00000000003083B0 var_8 = -8
\n.text:00000000003083B0
\n.text:00000000003083B0 SUB SP, SP, #0x50
\n.text:00000000003083B4 LDR X11, [X0,#8]
\n.text:00000000003083B8 MOV W8, #0xB2EB
\n.text:00000000003083BC MOV W10, #0xE126
\n.text:00000000003083C0 MOV W12, #0x6064
\n.text:00000000003083C4 MOVK W8, #0xCE33,LSL#16
\n.text:00000000003083C8 ADD X9, SP, #0x50+var_4C
\n.text:00000000003083CC LDR W2, [X1,#0xC]!
\n.text:00000000003083D0 MOVK W10, #0xCC48,LSL#16
\n.text:00000000003083D4 ADD X12, X1, X12
\n.text:00000000003083D8 LDRB W13, [X11]
\n.text:00000000003083DC MOV X16, SP
\n.text:00000000003083E0 LDR X17, [SP,#0x50+var_20]
\n.text:00000000003083E4 MOV W14, #0x90CD
\n.text:00000000003083E8 LDRB W3, [SP,#0x50+var_11]
\n.text:00000000003083EC MOV W15, #0x3DD1
\n.text:00000000003083F0 STR X1, [SP,#0x50+var_48]
\n.text:00000000003083F4 MOVK W14, #0xA950,LSL#16
\n.text:00000000003083F8 STR W2, [SP,#0x50+var_3C]
\n.text:00000000003083FC MOVK W15, #0x82BD,LSL#16
\n.text:0000000000308400 STR X11, [SP,#0x50+var_38]
\n.text:0000000000308404 ADD W2, W2, #2
\n.text:0000000000308408 STR X12, [SP,#0x50+var_28]
\n.text:000000000030840C STRB W13, [SP,#0x50+var_2C]
\n.text:0000000000308410 STP W8, W10, [SP,#0x50+var_50]
\n.text:0000000000308414 STP X9, X16, [SP,#0x50+var_10]
\n.text:0000000000308418 LDR W4, [X9]
\n.text:000000000030841C CMP W4, W10
\n.text:0000000000308420 B.EQ loc_3084B4
\n.text:0000000000308424
\n.text:0000000000308424 loc_308424 ; CODE XREF: sub_3083B0+BC\u2193j
\n.text:0000000000308424 ; sub_3083B0+100\u2193j
\n.text:0000000000308424 LDRSH W8, [X17,#2]
\n.text:0000000000308428 ANDS W10, W3, #1
\n.text:000000000030842C LDR W9, [SP,#0x50+var_3C]
\n.text:0000000000308430 MOV W0, #1
\n.text:0000000000308434 STR X17, [SP,#0x50+var_20]
\n.text:0000000000308438 CSEL W8, W8, WZR, NE
\n.text:000000000030843C STRB W10, [SP,#0x50+var_11]
\n.text:0000000000308440 ADD W8, W9, W8
\n.text:0000000000308444 LDR X9, [SP,#0x50+var_48]
\n.text:0000000000308448 ADD W8, W8, #3
\n.text:000000000030844C STR W8, [X9]
\n.text:0000000000308450 ADD SP, SP, #0x50 ; 'P'
\n.text:0000000000308454 RET
\n.text:0000000000308458 ; —————————————————————————
\n.text:0000000000308458
\n.text:0000000000308458 loc_308458 ; CODE XREF: sub_3083B0+110\u2193j
\n.text:0000000000308458 STR W14, [X16]
\n.text:000000000030845C STR W10, [X9]
\n.text:0000000000308460 MOV W4, W10
\n.text:0000000000308464 CMP W10, W10
\n.text:0000000000308468 B.EQ loc_3084B4
\n.text:000000000030846C B loc_308424
\n.text:0000000000308470 ; —————————————————————————
\n.text:0000000000308470
\n.text:0000000000308470 loc_308470 ; CODE XREF: sub_3083B0+10C\u2193j
\n.text:0000000000308470 LDR X4, [X12,X13,LSL#3]
\n.text:0000000000308474 STR W2, [X1]
\n.text:0000000000308478 LDRH W3, [X11,#2]
\n.text:000000000030847C LDR X17, [X0]
\n.text:0000000000308480 LDRB W5, [X11,#1]
\n.text:0000000000308484 AND X3, X4, X3
\n.text:0000000000308488 LDRB W6, [X17]
\n.text:000000000030848C LDRB W4, [X17,#1]
\n.text:0000000000308490 STR X3, [X12,X5,LSL#3]
\n.text:0000000000308494 LDR X3, [X12,X6,LSL#3]
\n.text:0000000000308498 LDR X4, [X12,X4,LSL#3]
\n.text:000000000030849C STR W15, [X9]
\n.text:00000000003084A0 CMP X3, X4
\n.text:00000000003084A4 CSET W3, EQ
\n.text:00000000003084A8 MOV W4, W15
\n.text:00000000003084AC CMP W15, W10
\n.text:00000000003084B0 B.NE loc_308424
\n.text:00000000003084B4
\n.text:00000000003084B4 loc_3084B4 ; CODE XREF: sub_3083B0+70\u2191j
\n.text:00000000003084B4 ; sub_3083B0+B8\u2191j
\n.text:00000000003084B4 LDR W4, [X16]
\n.text:00000000003084B8 CMP W4, W8
\n.text:00000000003084BC B.NE loc_308470
\n.text:00000000003084C0 B loc_308458
\n.text:00000000003084C0 ; End of function sub_3083B0
\n.text:00000000003084C0
\n.text:00000000003084C4<\/p>\n
\u8fd9\u79cd\u8fd9\u79cd\u60c5\u51b5\u5f88\u591a，\u4f46\u662f\u518d\u4ed4\u7ec6\u89c2\u770b\u4e00\u4e0b，\u5c31\u80fd\u53d1\u73b0\u8fd9\u73a9\u610f\u4e24\u4e2a\u53c2\u6570，\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u5b57\u8282\u7801，\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f VM CTX，\u6211\u4eec\u5c31\u53ef\u4ee5\u5229\u7528\u8fd9\u4e00\u70b9\u8fdb\u884c\u601d\u8003，\u56e0\u4e3a\u8fd9\u79cd\u7279\u5f81\u4e5f\u975e\u5e38\u975e\u5e38\u5c11，\u8fd9\u5757\u4e5f\u53ef\u4ee5\u4f5c\u4e3a\u4e00\u4e2a\u7279\u5f81\u8fdb\u884c\u5339\u914d<\/p>\n
\u63a5\u4e0b\u6765\u770b CALL \u7c7b\u8c03\u7528\u7684 handler，\u8fd9\u4e5f\u633a\u62bd\u8c61\u7684<\/p>\n
.text:0000000000358E14 ; __int64 __fastcall sub_358E14(_QWORD **, unsigned __int8 *, unsigned int)
\n.text:0000000000358E14 sub_358E14 ; CODE XREF: sub_2E87B4+C\u2191p
\n.text:0000000000358E14 ; sub_2EDA70+80\u2191p …
\n.text:0000000000358E14
\n.text:0000000000358E14 var_18 = -0x18
\n.text:0000000000358E14 var_10 = -0x10
\n.text:0000000000358E14 var_8 = -8
\n.text:0000000000358E14 var_s0 = 0
\n.text:0000000000358E14 var_s8 = 8
\n.text:0000000000358E14
\n.text:0000000000358E14 SUB SP, SP, #0x30
\n.text:0000000000358E18 STP X29, X30, [SP,#0x20+var_s0]
\n.text:0000000000358E1C ADD X29, SP, #0x20
\n.text:0000000000358E20 LDRB W10, [X1]
\n.text:0000000000358E24 ADRL X9, off_3E41D8
\n.text:0000000000358E2C LDRSW X11, [X1,#0xC]
\n.text:0000000000358E30 ADD X8, SP, #0x20+var_18
\n.text:0000000000358E34 ADD X10, X1, X10,LSL#3
\n.text:0000000000358E38 STR X11, [X10,#0x6070]
\n.text:0000000000358E3C LDR X10, [X0]
\n.text:0000000000358E40 ADD X0, SP, #0x20+var_10
\n.text:0000000000358E44 LDR X10, [X10]
\n.text:0000000000358E48 LDR X10, [X10,W2,UXTW#3]
\n.text:0000000000358E4C STP X1, X8, [SP,#0x20+var_18]
\n.text:0000000000358E50 LDR X11, [X10,#0x58]
\n.text:0000000000358E54 STR X10, [SP,#0x20+var_8]
\n.text:0000000000358E58 LDR X9, [X9,X11,LSL#3]
\n.text:0000000000358E5C BLR X9
\n.text:0000000000358E60 LDP X29, X30, [SP,#0x20+var_s0]
\n.text:0000000000358E64 ADD SP, SP, #0x30 ; '0'
\n.text:0000000000358E68 RET<\/p>\n
.text:00000000002E6694 ; __int64 __fastcall sub_2E6694(unsigned __int8 ***)
\n.text:00000000002E6694 sub_2E6694 ; DATA XREF: .data.rel.ro:off_3E1E30\u2193o
\n.text:00000000002E6694 ; .data.rel.ro:off_3E41D8\u2193o
\n.text:00000000002E6694
\n.text:00000000002E6694 var_20 = -0x20
\n.text:00000000002E6694 var_18 = -0x18
\n.text:00000000002E6694 var_10 = -0x10
\n.text:00000000002E6694
\n.text:00000000002E6694 STP X29, X30, [SP,#var_20]!
\n.text:00000000002E6698 STR X19, [SP,#0x20+var_10]
\n.text:00000000002E669C MOV X29, SP
\n.text:00000000002E66A0 LDP X8, X9, [X0]
\n.text:00000000002E66A4 LDR X19, [X8]
\n.text:00000000002E66A8 LDR X8, [X9]
\n.text:00000000002E66AC MOV X0, X19
\n.text:00000000002E66B0 BLR X8
\n.text:00000000002E66B4 LDRB W8, [X19]
\n.text:00000000002E66B8 ADD X8, X19, X8,LSL#3
\n.text:00000000002E66BC LDR X8, [X8,#0x6070]
\n.text:00000000002E66C0 STR W8, [X19,#0xC]
\n.text:00000000002E66C4 LDR X19, [SP,#0x20+var_10]
\n.text:00000000002E66C8 LDP X29, X30, [SP+0x20+var_20],#0x20
\n.text:00000000002E66CC RET<\/p>\n
.text:00000000002D1D5C
\n.text:00000000002D1D5C ; __int64 __fastcall sub_2D1D5C(__int64)
\n.text:00000000002D1D5C sub_2D1D5C ; DATA XREF: sub_2D2844+1D8\u2193o
\n.text:00000000002D1D5C
\n.text:00000000002D1D5C var_10 = -0x10
\n.text:00000000002D1D5C
\n.text:00000000002D1D5C STR X30, [SP,#var_10]!
\n.text:00000000002D1D60 MOV W1, #8
\n.text:00000000002D1D64 BL sub_2E5D1C ; vm_read_int_reg
\n.text:00000000002D1D68 BL sub_2C8AE8
\n.text:00000000002D1D6C LDR X30, [SP+0x10+var_10],#0x10
\n.text:00000000002D1D70 RET<\/p>\n
\u4e00\u6b65\u4e00\u6b65\u7684\u8c03\u7528\u8fdb\u6765\u7684\u60c5\u51b5，\u8fd9\u5757\u6700\u96be\u7684\u4e5f\u662f x8 \u7684\u5904\u7406，\u4e07\u4e00\u5b83\u4e0d\u8d70 x8 \u5462？\u8fd9\u5757\u4e0d\u70b8\u4e86？(\u54c8\u54c8\u54c8\u54c8\u54c8，\u4e0a\u5e1d\u89c6\u89d2\u6765\u4e86，\u8fd9\u786e\u5b9e\u5168\u8d70 x8 \u95f4\u63a5\u8c03\u7528)\u6211\u60f3\u7684\u662f\u52a0\u4e00\u4e2a if \u6216\u8005 try，\u770b\u770b\u4e0d\u8d70\u7684\u60c5\u51b5，\u8fd9\u79cd\u601d\u8def\u7684\u597d\u5904\u5c31\u662f\u53ef\u4ee5\u770b\u89c1\u8d70\u6216\u8005\u4e0d\u8d70\u90fd\u7ecf\u5386\u4e86\u4ec0\u4e48\u53ef\u4ee5\u4e8c\u5206\u5b9a\u4f4d，OK \u63a5\u4e0b\u6765\u5c31\u53ef\u4ee5\u786e\u5b9a\u5199\u6cd5\u4e86<\/p>\n
\u6211\u6253\u7b97\u7528 Python \u7684match … case …\u5199，\u9996\u5148\u5c31\u662f\u7279\u5f81\u7684\u5339\u914d，\u5176\u6b21\u662f\u5bf9\u95f4\u63a5\u8c03\u7528\u7684\u5339\u914d(\u4e0a\u5e1d\u89c6\u89d2：\u540e\u9762\u7528\u7684\u9012\u5f52\u6700\u6df1\u6808\u8c03\u7528\u8fdb\u884c\u4e8c\u5206\u6392\u67e5\u4e86，\u6ca1\u6709\u8f6f\u4ef6\u6d41\u6c34\u7ebf)
\n\u5176\u5b9e\u8fd8\u53ef\u4ee5\u5916\u5c42 if \u8bed\u53e5\u6765\u5224\u65ad\u662f\u4e0d\u662f\u590d\u5408\u8bed\u53e5，\u7136\u540e\u5728\u95f4\u63a5\u5339\u914d\u65f6\u5019\u7528 match \u770b\u6709\u6ca1\u6709\u8d70 x8 \u95f4\u63a5\u8c03\u7528<\/p>\n
\u8fd9\u70b9\u5c31\u4e5f\u9700\u8981\u4e00\u4e2a\u51fd\u6570\u6765\u8fdb\u884c\u64cd\u4f5c，\u6211\u4eec\u6765\u770b\u4e00\u4e2a\u5b9e\u4f8b<\/p>\n
.text:00000000002D1D08 sub_2D1D08 ; DATA XREF: sub_2D2844+1A0\u2193o
\n.text:00000000002D1D08
\n.text:00000000002D1D08 var_20 = -0x20
\n.text:00000000002D1D08 var_10 = -0x10
\n.text:00000000002D1D08 var_8 = -8
\n.text:00000000002D1D08
\n.text:00000000002D1D08 STR X30, [SP,#var_20]!
\n.text:00000000002D1D0C STP X20, X19, [SP,#0x20+var_10]
\n.text:00000000002D1D10 MOV W1, #8
\n.text:00000000002D1D14 MOV X19, X0
\n.text:00000000002D1D18 BL vm_read_int_reg
\n.text:00000000002D1D1C MOV X20, X0
\n.text:00000000002D1D20 MOV X0, X19
\n.text:00000000002D1D24 MOV W1, #9
\n.text:00000000002D1D28 BL vm_read_int_reg
\n.text:00000000002D1D2C MOV X1, X0
\n.text:00000000002D1D30 MOV X0, X20
\n.text:00000000002D1D34 BL sub_2D8890
\n.text:00000000002D1D38 LDP X20, X19, [SP,#0x20+var_10]
\n.text:00000000002D1D3C LDR X30, [SP+0x20+var_20],#0x20
\n.text:00000000002D1D40 RET<\/p>\n
.text:00000000002E5D1C ; __int64 __fastcall vm_read_int_reg(__int64, int)
\n.text:00000000002E5D1C vm_read_int_reg ; CODE XREF: sub_2D1A58+C\u2191p
\n.text:00000000002E5D1C ; sub_2D1A84+C\u2191p …
\n.text:00000000002E5D1C ADD X8, X0, W1,SXTW#3
\n.text:00000000002E5D20 LDR X0, [X8,#0x6070]
\n.text:00000000002E5D24 RET<\/p>\n
.text:00000000002E5D28 ; __int64 __fastcall vm_write_int_reg(__int64 result, int, __int64)
\n.text:00000000002E5D28 vm_write_int_reg ; CODE XREF: sub_2D1A58+20\u2191p
\n.text:00000000002E5D28 ; sub_2D1A84+20\u2191p …
\n.text:00000000002E5D28 ADD X8, X0, W1,SXTW#3
\n.text:00000000002E5D2C STR X2, [X8,#0x6070]
\n.text:00000000002E5D30 RET<\/p>\n
\u6211\u4eec\u53ef\u4ee5\u770b\u89c1\u5b83\u76f4\u63a5\u901a\u8fc7\u7d22\u5f15\u8bbf\u95ee\u865a\u62df\u673a\u7684\u6574\u6570\u5bc4\u5b58\u5668\u6587\u4ef6，\u73b0\u5728\u51fd\u6570\u540d\u4e5f\u4e0d\u662f\u5f88\u597d，\u4f46\u662f\u5148\u8fd9\u6837\u5427
\n\u8fd9\u5757\u5427\u5176\u5b9e\u4e5f\u53ef\u4ee5\u7ee7\u7eed\u505a\u6298\u53e0\u7136\u540e\u770b\u5168\u90e8\u7684\u4e1c\u897f，\u6bcf\u4e2a\u5230\u8fd9\u7684\u5c31\u8f93\u51fa\u5b83\u8fd9\u4e2a\u51fd\u6570\u53c8\u8c03\u7528\u4e86\u4ec0\u4e48\u51fd\u6570，\u505a\u7279\u5f81\u5339\u914d，\u8fd9\u8fd8\u662f\u5f97\u76ca\u4e8e VMP \u7684\u7cbe\u786e\u6784\u9020，\u8981\u4e0d\u7136\u662f\u771f\u6ca1\u529e\u6cd5\u4e00\u76f4\u5bf9\u7279\u5f81\u8fdb\u884c\u603b\u7ed3，\u5c31\u7b97\u662f Windows \u4e0a\u7684 VMP \u672c\u5c0a\u4e5f\u662f\u5de8\u5927\u7684\u7279\u5f81\u5426\u5219\u4e5f\u4e0d\u4f1a\u88ab\u6574\u7406\u51fa\u6765\u90a3\u4e48\u591a\u8fd8\u539f\u8d44\u6599\u4e86
\n(\u4e0a\u5e1d\u89c6\u89d2：\u5bf9\u4e8e\u8fd9\u5757\u5176\u5b9e\u53ef\u80fd\u771f\u7684\u53ea\u6709\u666e\u901a\u7684\u6574\u6570\u5bc4\u5b58\u5668\u6709，\u6d6e\u70b9\u6570\u5bc4\u5b58\u5668\u6211\u662f\u5b8c\u5b8c\u5168\u5168\u6ca1\u627e\u5230\u76f8\u5173\u7684\u5185\u5bb9，\u8fd9\u4e3b\u8981\u548c VM \u6784\u9020\u6709\u5173\u4e86)<\/p>\n
\u6628\u5929\u7ed9\u4e00\u4e2a CTF \u51fa\u9898\u53bb\u4e86，\u867d\u7136\u53ea\u6709\u4e00\u9053\u5b89\u5353\u9898\u76ee，\u4eca\u5929\u7ee7\u7eed\u601d\u8003\u63a5\u4e0b\u6765\u7684\u5904\u7406
\n\u9996\u5148\u662f\u6539\u4e86\u4e00\u4e0b\u5bf9\u4e8e\u8c03\u7528\u6808\u7684\u4e1c\u897f，\u6362\u6210\u9012\u5f52\u5f62\u5f0f\u4e86，\u8fd9\u6837\u4e5f\u53ef\u4ee5\u66f4\u597d\u7684\u67e5\u627e\u548c\u62fc\u63a5\u6570\u636e，\u611f\u89c9\u9a6c\u4e0a\u8981\u5f00\u59cb\u5199\u56fe\u7b97\u6cd5\u4e86，\u597d\u96be\u554a，\u4e0d\u8fc7\u8f66\u5230\u5c71\u524d\u5fc5\u6709\u8def，\u8239\u5230\u6865\u5934\u81ea\u7136\u76f4，\u4e0d\u7528\u62c5\u5fc3\u8fd9\u4e00\u5757，\u601d\u8003\u4e00\u4e0b\u524d\u77bb\u6027\u95ee\u9898\u5427，\u8bf4\u96be\u4e5f\u96be\u8bf4\u4e0d\u96be\u4e5f\u4e0d\u96be，\u53ef\u80fd\u662f\u6211\u754f\u96be\u5fc3\u7406\u5427<\/p>\n
\u57fa\u672c handler \u56fe\u7b97\u6cd5<\/p>\n<\/li>\n
bl \u8c03\u7528\u7684\u590d\u5408 handler \u56fe\u7b97\u6cd5<\/p>\n<\/li>\n
\u8c03\u7528\u5176\u4ed6\u51fd\u6570\u7684 handler \u56fe\u7b97\u6cd5<\/p>\n<\/li>\n
VM CTX \u7684\u76f8\u5173\u7684\u51fd\u6570\u64cd\u4f5c，\u8fd9\u4e5f\u662f\u56fe\u7b97\u6cd5\u6240\u9700\u8981\u5b9e\u73b0\u7684\u5185\u5bb9，\u4e0d\u8fc7\u8fd9\u5757\u80af\u5b9a\u4e0d\u4f1a\u975e\u5e38\u591a\u7684，\u5b9e\u5728\u4e0d\u884c\u5c31\u518d tm \u7684\u627e\u89c4\u5f8b\u53bb<\/p>\n<\/li>\n
\u903b\u8f91\u51fd\u6570\u7684\u5904\u7406<\/p>\n
wc \u4e86，\u5c31\u5728\u521a\u521a\u6a21\u578b\u7ed9\u4e86\u6211\u4e00\u4e2a\u9876\u7ea7\u601d\u8def<\/p>\n<\/li>\n
\u5f71\u5b50\u8f68\u9053<\/p>\n
\u7531\u4e8e\u6211\u4eec\u9009\u62e9 P-code(\u5b9e\u9645\u662f\u4efb\u610f\u7684，\u53ea\u9700\u8981\u4fdd\u8bc1 IR \u7684\u4e0d\u53d8\u6027，\u4e0d\u80fd\u8ba9\u6c47\u7f16\u6bcf\u6b21\u63d0\u5347\u51fa\u6765\u6709\u968f\u673a\u6027) \u8fdb\u884c IR \u7684\u63d0\u5347，\u6240\u4ee5\u8fd9\u65f6\u5019\u5c31\u53ef\u4ee5\u8003\u8651\u63d0\u5347\u4e24\u4ee3\u51fa\u6765<\/p>\n
\u4e0d\u8fc7\u554a，\u8fd8\u662f\u6709\u4e00\u4e9b\u96be\u70b9\u7684，\u6709 IR\u3001\u5b9e\u73b0\u3001\u4ee3\u5165\u7b49\u7b49\u65b9\u9762\u7684，\u6211\u5148\u8bf4\u6211\u60f3\u5230\u7684\u56f0\u96be<\/p>\n
\u89e3\u6cd5\u6765\u4e86，\u4e5f\u662f\u5403\u4e0a IR \u7684\u7ea2\u5229\u4e86，\u6211\u7528 P-code \u7684
\n\u9996\u5148\u6c47\u7f16\u4f1a\u63d0\u5347\u51fa\u6765，\u8fd9\u6837\u5c31\u6709\u4e86\u6a21\u677f\u4e86，\u8fd9\u65f6\u5019\u6211\u4eec\u4f1a\u6709varnode，\u8fd9\u73a9\u610f\u4e0d\u77e5\u9053\u662f\u5565\u5c31\u53bb\u770b P-code \u7684\u4f7f\u7528\u57fa\u7840\u4e2d\u7684\u57fa\u7840\u4e86，\u7136\u540e\u6211\u4eec\u62ff\u8fd9\u4e2a\u6a21\u677f\u8fdb\u884c\u5bc4\u5b58\u5668\u7684\u904d\u5386\u4e0e\u4ee3\u6362，\u628a\u5b9e\u9645 trace \u8bb0\u5f55\u503c\u4ee3\u5165\u6a21\u677f\u5f97\u5230\u7b2c\u4e8c\u4ee3\u4ea7\u7269，\u4e5f\u5c31\u662f\u6709\u4e86\u5177\u4f53\u503c，\u8fd9\u65f6\u5019\u6211\u4eec\u5c31\u89e3\u51b3\u4e86\u6240\u9047\u89c1\u7684\u5927\u96be\u9898，\u63a5\u4e0b\u6765\u6211\u62ff\u4e00\u6761\u6c47\u7f16\u8fdb\u884c\u6f14\u793a<\/p>\n
idx \u504f\u79fb \u6c47\u7f16 \u5bc4\u5b58\u5668\u8bfb \u5bc4\u5b58\u5668\u5199
\n17052c 0x285eb0 "madd x10, x12, x11, x10" {X12:0x0, X11:0xdec, X10:0x794d9af5c8} {X10:0x794d9af5c8}<\/p>\n
\u7b2c\u4e00\u4ee3（SLEIGH \u63d0\u5347）：
\nx10 = (x12 * x11) + x10<\/p>\n
\u7b2c\u4e8c\u4ee3（\u5f71\u5b50\u6298\u53e0，\u628a\u4e09\u4e2a\u6e90 varnode \u6362\u6210 trace \u503c）：
\nx10 = (0x0 * 0xdec) + 0x794d9af5c8<\/p>\n
\u5728 varnode \u5c42\u6298\u53e0，\u628a varnode \u7684 space \u6362\u6389<\/p>\n
\u8fd9\u91cc\u6211\u5f15\u5165\u8fdb\u6765\u90a3\u4e2a\u5f71\u5b50\u8f68\u9053\u7684\u601d\u8def\u5427，\u8ba9\u6a21\u578b\u6574\u7406\u7684<\/p>\n
\u4e24\u4ee3 IR，\u540c\u6e90\u540c varnode：<\/p>\n
\u5173\u952e\u8ba4\u77e5：\u503c\u6765\u81ea trace（\u52a8\u6001\u6267\u884c），\u4e0d\u662f\u7b2c\u4e00\u4ee3\u81ea\u5df1\u7b97\u51fa\u6765\u7684\u3002\u7b2c\u4e00\u4ee3\u4e0d\u6267\u884c\u4e0d\u4ea7\u503c，\u53ea\u56de\u7b54"\u8fd9\u6bb5\u6307\u4ee4\u957f\u5565\u6837"；trace \u56de\u7b54"\u8fd9\u6b21\u8dd1\u8d77\u6765\u503c\u662f\u5565"\u3002\u4e24\u4ee3\u662f\u540c\u4e00\u6279\u6307\u4ee4\u7684\u4e24\u4e2a\u89c6\u56fe，\u522b\u6df7\u6210\u4e00\u4e2a\u4e1c\u897f\u3002<\/p>\n
\u5bf9\u9f50（\u5f71\u5b50\u8eab\u4efd）：\u4e24\u4ee3\u4ece\u540c\u4e00\u6279\u5b57\u8282\u3001\u540c\u4e00\u5957 SLEIGH \u63d0\u5347，unique varnode \u5bf9\u540c\u4e00\u6761\u6307\u4ee4\u5206\u914d\u662f\u786e\u5b9a\u6027\u7684，\u6240\u4ee5\u5171\u4eab\u540c\u4e00\u5957 varnode \u547d\u540d\u7a7a\u95f4\u3002\u5f71\u5b50\u8eab\u4efd\u9760\u8fd9\u4e2a，\u4e0d\u9760"\u4e24\u4ee3\u6c47\u7f16\u90fd\u5408\u6cd5"\u3002PC \u951a\u70b9\u7528 RVA（trace \u7b2c\u4e09\u5217），\u4e0d\u80fd\u7528\u7edd\u5bf9\u5730\u5740（ASLR \u6f02\u79fb）\u3002<\/p>\n
\u6298\u53e0\u7684\u672c\u8d28：varnode = (space, offset, size)，\u6298\u53e0 = \u628a varnode \u4ece register space \u8e22\u5230 const space\u3002\u5206\u4e24\u6b65：<\/p>\n
unique \u751f\u547d\u5468\u671f\u53ea\u5728\u5355\u6761\u6307\u4ee4\u5185，trace \u4e0d\u8bb0\u5b83，\u53ea\u80fd\u9760"\u8f93\u5165\u5bc4\u5b58\u5668\u6298\u6210\u5e38\u91cf\u540e\u5316\u7b80"\u6d88\u6389\u3002\u987a\u5e8f：\u5148\u6298\u8f93\u5165，\u518d\u5316\u7b80\u3002
\n\u6298\u53e0\u8fb9\u754c（trace \u7ed9\u4e86\u5565\u624d\u80fd\u6298\u5565）：<\/p>\n
varnode \u7ea2\u5229：SLEIGH \u767d\u9001\u5bc4\u5b58\u5668\u91cd\u547d\u540d + \u503c\u7f16\u53f7\u3002\u6c47\u7f16\u91cc x10 \u590d\u7528\u3001\u5185\u5b58\u522b\u540d\u3001\u6761\u4ef6\u7801\u8fd9\u4e9b\u6700\u810f\u7684\u9690\u5f0f\u6570\u636e\u6d41，\u63d0\u5347\u65f6\u5168\u663e\u5f0f\u5316，\u6bcf\u4e2a\u503c\u4e00\u4e2a varnode，\u8de8\u6307\u4ee4 def-use \u73b0\u6210\u3002\u8fd9\u6761 def-use = DFG \u9aa8\u67b6，\u76f4\u63a5\u63a5"DFG + \u53cd\u5411\u6c61\u70b9"\u90a3\u5957\u3002\u6240\u4ee5 P-code \u4e0d\u662f"\u4efb\u610f\u7684"\u2014\u2014\u6362\u4e2a\u6ca1 varnode \/ \u663e\u5f0f def-use \u7684 IR，\u8fd9\u5c42\u5f97\u81ea\u5df1\u91cd\u5199\u3002<\/p>\n
\u4e24\u4e2a\u5751：<\/p>\n
\u96be\u70b9\u7b54\u6848：<\/p>\n
\u8fd9\u5757\u5b9e\u73b0\u76f4\u63a5\u770b\u6211\u4ee3\u7801\u597d\u4e86，\u7136\u540e\u9047\u89c1\u4e00\u4e2a\u5c0f\u5c4c\u6bdb\u7684\u5730\u65b9，\u53d1\u73b0\u6211\u6ca1\u5bc4\u5b58\u5668\u5168\u90e8\u7684\u6620\u5c04\u554a，\u7136\u540e\u81ea\u5df1\u95ee\u6a21\u578b\u7136\u540e\u7ed9\u81ea\u5df1\u6c14\u534a\u6b7b，\u6700\u540e\u8fd8\u662f\u7ffb\u4ee3\u7801，\u7136\u540e\u627e\u5230 ctx \u51fd\u6570\u53ef\u4ee5\u83b7\u53d6\u5168\u90e8\u5bc4\u5b58\u5668\u7684\u504f\u79fb，\u6700\u7ec8\u5b9e\u73b0\u5982\u4e0b，\u7528\u7684\u65f6\u5019\u76f4\u63a5 Python \u8bed\u6cd5\u62ff\u5c31\u884c\u4e86<\/p>\n
_ctx = pypcode.Context(ARCH)
\nAllRegisters = {
\nv.offset: (name, v.size) for v, name in self._ctx.getAllRegisters().items()
\n}<\/p>\n
\u7ed9\u5404\u4f4d\u770b\u4e00\u6bb5\u5427，\u907f\u514d\u4e0d\u77e5\u9053\u53d1\u751f\u4e86\u4ec0\u4e48，\u8fd9\u4e2a\u662f\u6211\u66ff\u6362\u51fa\u6765\u7684\u4e1c\u897f，\u7136\u540e\u5c31\u662f\u51c6\u5907\u62ff\u8fd9\u4e2a\u8fdb\u884c\u8fd8\u539f\u7684，\u5206\u53f7\u540e\u9762\u662f\u5730\u5740\u3001\u6c47\u7f16，\u8fd8\u539f\u671f\u95f4\u6ca1\u5206\u53f7\u884c\u5185\u5bb9<\/p>\n
; 0x2e87e8 ldr w9, [x23]
\nunique[c700:8] = COPY 0x7853c7e1dc:8
\nunique[48f00:4] = LOAD ram(unique[c700:8])
\nx9:8 = INT_ZEXT unique[48f00:4]
\n; 0x2e87ec mov w12, #0x30
\nx12:8 = COPY 0x30:8
\n; 0x2e87f0 ldr x11, [x20]
\nunique[c800:8] = COPY 0x7aaf5ce868:8
\nx11:8 = LOAD ram(unique[c800:8])
\n; 0x2e87f4 ldrb w10, [x8, #0x8]
\nunique[bc00:8] = INT_ADD 0x7c4f75c1d0:8, 0x8:8
\nunique[4a100:1] = LOAD ram(unique[bc00:8])
\nx10:8 = INT_ZEXT unique[4a100:1]
\n; 0x2e87f8 add w9, w9, #0x1
\nunique[22d00:4] = COPY 0x1:4
\ntmpCY:1 = INT_CARRY 0x0:4, unique[22d00:4]
\ntmpOV:1 = INT_SCARRY 0x0:4, unique[22d00:4]
\nunique[22f00:4] = INT_ADD 0x0:4, unique[22d00:4]
\ntmpNG:1 = INT_SLESS unique[22f00:4], 0x0:4
\ntmpZR:1 = INT_EQUAL unique[22f00:4], 0x0:4
\nx9:8 = INT_ZEXT unique[22f00:4]
\n; 0x2e87fc ldrb w13, [x8, #0x9]
\nunique[bc00:8] = INT_ADD 0x7c4f75c1d0:8, 0x9:8
\nunique[4a100:1] = LOAD ram(unique[bc00:8])
\nx13:8 = INT_ZEXT unique[4a100:1]
\n; 0x2e8800 ldrsh x14, [x8, #0xa]
\nunique[be00:8] = INT_ADD 0x7c4f75c1d0:8, 0xa:8
\nunique[4c100:2] = LOAD ram(unique[be00:8])
\nx14:8 = INT_SEXT unique[4c100:2]
\n; 0x2e8808 smaddl x8, w9, w12, x11
\nunique[6db00:8] = INT_SEXT 0x1:4
\nunique[6dd00:8] = INT_SEXT 0x30:4
\nunique[6df00:8] = INT_MULT unique[6db00:8], unique[6dd00:8]
\nx8:8 = INT_ADD 0x7c4f75c1d0:8, unique[6df00:8]
\n; 0x2e880c ldr x10, [x24, x10, lsl #3]
\nunique[ae00:8] = COPY 0x1:8
\nunique[da00:8] = COPY unique[ae00:8]
\nunique[da00:8] = INT_LEFT unique[da00:8], 0x3:8
\nunique[e300:8] = INT_ADD 0x7853c84240:8, unique[da00:8]
\nx10:8 = LOAD ram(unique[e300:8])
\n; 0x2e8810 str w9, [x23]
\nunique[c700:8] = COPY 0x7853c7e1dc:8
\nSTORE ram(unique[c700:8]), 0x1:4
\n; 0x2e8814 ldrh w11, [x8]
\nunique[c600:8] = COPY 0x7c4f75c200:8
\nunique[4a500:2] = LOAD ram(unique[c600:8])
\nx11:8 = INT_ZEXT unique[4a500:2]
\n; 0x2e8818 add x10, x10, x14
\nunique[23f00:8] = COPY 0xfffffffffffffb60:8
\ntmpCY:1 = INT_CARRY 0x7853c84200:8, unique[23f00:8]
\ntmpOV:1 = INT_SCARRY 0x7853c84200:8, unique[23f00:8]
\nunique[24100:8] = INT_ADD 0x7853c84200:8, unique[23f00:8]
\ntmpNG:1 = INT_SLESS unique[24100:8], 0x0:8
\ntmpZR:1 = INT_EQUAL unique[24100:8], 0x0:8
\nx10:8 = COPY unique[24100:8]
\n; 0x2e881c str x10, [x24, x13, lsl #3]
\nunique[74600:8] = COPY 0x7853c83d60:8
\nunique[ae00:8] = COPY 0x1:8
\nunique[da00:8] = COPY unique[ae00:8]
\nunique[da00:8] = INT_LEFT unique[da00:8], 0x3:8
\nunique[e300:8] = INT_ADD 0x7853c84240:8, unique[da00:8]
\nSTORE ram(unique[e300:8]), unique[74600:8]
\n; 0x2e8820 ldr x11, [x25, x11, lsl #3]
\nunique[ae00:8] = COPY 0x8d:8
\nunique[da00:8] = COPY unique[ae00:8]
\nunique[da00:8] = INT_LEFT unique[da00:8], 0x3:8
\nunique[e300:8] = INT_ADD 0x794db0be58:8, unique[da00:8]
\nx11:8 = LOAD ram(unique[e300:8])
\n; 0x2e8824 br x11
\npc:8 = COPY 0x794da14cd4:8
\nBRANCHIND pc:8<\/p>\n
\u8fd9\u65f6\u5019\u6211\u4eec\u6709\u4e86\u503c，\u4f46\u662f\u5427，\u8fd8\u5f97\u60f3\u4e00\u4e0b\u600e\u4e48\u53bb\u505a\u5206\u6790\u6211\u7684\u601d\u8def\u662f\u76f4\u63a5\u5199\u4e09\u4e2a\u51fd\u6570\u8fdb\u884c，\u56e0\u4e3a\u4e0a\u8ff0\u4e09\u6761\u7ebf，\u4f46\u662f\u5176\u4e2d x25 \u7684\u5bc4\u5b58\u5668\u8df3\u8f6c\u53c8\u73b0\u7684\u4e0d\u90a3\u4e48\u91cd\u8981，\u6240\u4ee5\u4e3b\u7ebf\u5c31\u662f\u5148\u5b9a\u628a\u8fd9\u4e9b\u5bc4\u5b58\u5668\u660e\u786e\u51fa\u6765<\/p>\n
\u71c3\u5c3d\u4e86，\u8111\u5b50\u7ed9\u6211\u770b\u9ebb\u4e86\u554a，\u4e0d\u8fc7\u8fd8\u662f\u51b7\u9759\u4e00\u4e0b\u770b\u770b\u6765\u6e90\u518d\u8bf4，\u8fd9\u53ef\u89c1\u53e6\u4e00\u7bc7\u6587\u7ae0\u4e86，P-code IR \u89e3\u6790\u4e0e\u4f7f\u7528\u7bc7\u7ae0<\/p>\n
\u601d\u8def\u7406\u6e05\u4e86\u5c31\u8be5\u52a8\u624b\u3002\u4e09\u6761\u7ebf\u91cc\u6211\u5148\u5543 x23 \u2014\u2014 \u5b83\u4e00\u6761\u5c31\u80fd\u5b9a\u4e0b\u8fd9\u6761 VM \u6307\u4ee4\u7684\u63a7\u5236\u6d41\u6548\u679c（\u987a\u5e8f\u8fd8\u662f\u8df3\u8f6c），\u540e\u9762\u51e0\u6761\u7ebf\u90fd\u5f97\u843d\u5728\u5b83\u4e0a\u9762\u3002<\/p>\n
\u4e00\u5f00\u59cb\u60f3\u5f97\u633a\u7b80\u5355：handler \u91cc ldr wN, [x23] \u548c str wN, [x23] \u5c31\u90a3\u4e24\u6761，\u8bfb trace \u7684\u8bfb\u5217\u5199\u5217，\u53d6\u51fa\u6765\u7684\u503c\u3001\u5b58\u56de\u53bb\u7684\u503c\u4e0d\u5c31\u90fd\u6709\u4e86？\u6c47\u7f16\u5c42\u786e\u5b9e\u80fd\u505a\u3002<\/p>\n
\u4f46\u662f\u4e0d\u5bf9 \u2014\u2014 \u6211\u90fd\u628a IR \u63d0\u5347\u5230 P-code \u4e86，\u518d\u56de\u5934\u53bb\u62a0\u6c47\u7f16\u5b57\u7b26\u4e32，\u90a3\u8fd9\u4e00\u4ee3\u63d0\u5347\u662f\u767d\u5e72\u7684\u3002<\/p>\n
\u771f\u4e0a P-code \u624d\u53d1\u73b0\u95ee\u9898：<\/p>\n
; 0x2e87e8 ldr w9, [x23]
\nunique[c700:8] = COPY 0x7853c7e1dc:8 ; \u2190 x23 \u5728\u8fd9，\u4f46\u5b83\u53ea\u662f\u628a\u5730\u5740\u642c\u8fdb\u4e34\u65f6
\nunique[48f00:4] = LOAD ram(unique[c700:8]) ; \u2190 \u771f\u6b63\u8bfb IP \u7684\u662f\u8fd9\u6761，\u5730\u5740\u662f unique
\nx9:8 = INT_ZEXT unique[48f00:4]<\/p>\n
x23 \u5728 P-code \u4e0a\u4e0d\u662f\u300c\u88ab\u8bfb\u7684\u5bc4\u5b58\u5668\u300d，\u662f\u300c\u88ab COPY \u51fa\u53bb\u7684\u4e00\u4e2a\u5730\u5740\u5e38\u91cf\u300d\u3002<\/p>\n
\u6240\u4ee5\u6309 space == "register" \u53bb\u626b inputs，\u6536\u4e0a\u6765\u4e00\u5806 COPY，\u5565\u4e5f\u8bf4\u660e\u4e0d\u4e86\u3002\u5199\u4fa7\u540c\u7406：<\/p>\n
; 0x2e8810 str w9, [x23]
\nunique[c700:8] = COPY 0x7853c7e1dc:8
\nSTORE ram(unique[c700:8]), 0x1:4<\/p>\n
\u300c\u5b58\u56de\u53bb\u7684\u503c\u300d\u786e\u5b9e\u5728 STORE \u7b2c 3 \u4e2a\u64cd\u4f5c\u6570\u4e0a，\u4f46\u300c\u54ea\u4e2a STORE \u624d\u662f\u5b58 IP \u7684\u300d\u5f97\u5148\u987a\u7740 varnode \u628a\u5b83\u627e\u51fa\u6765\u3002<\/p>\n
\u5148\u8bb0\u4e00\u4e2a\u5751：\u951a\u70b9\u5bc4\u5b58\u5668\u4e00\u5f8b\u6309 offset \u8ba4，\u4e0d\u6309\u540d\u5b57\u3002\u540c\u4e00\u4e2a offset \u4e0a w23\/x23 \u662f\u4e24\u4e2a\u89c6\u56fe（size 4 \u548c 8），\u6309\u540d\u5b57\u8ba4\u4f1a\u6f0f\u3002x23 = 0x40B8\u3002<\/p>\n
\u7136\u540e\u626b\u4e00\u8d9f shadow（SSA \u5e8f，def \u5148\u4e8e use，\u5355\u8d9f\u591f\u7528），\u7ed9\u6bcf\u4e2a varnode \u8bb0\u4e00\u4e2a\u300c\u4f60\u7684\u503c\u662f\u4ece\u54ea\u6761\u7ebf\u6d3e\u751f\u6765\u7684\u300d：<\/p>\n
| \u666e\u901a op<\/td>\n | \u8f93\u51fa\u7ee7\u627f\u6240\u6709\u8f93\u5165\u7684\u8272（\u5e76\u96c6）<\/td>\n<\/tr>\n | ||||||
| \u8f93\u5165\u5168\u65e0\u8272<\/td>\n | \u8f93\u51fa\u65ad\u94fe\u3001\u6e05\u8272（\u5bc4\u5b58\u5668\u88ab\u91cd\u65b0\u8d4b\u503c\u4e86）<\/td>\n<\/tr>\n | ||||||
| LOAD<\/td>\n | \u5730\u5740\u6709\u8272 \u2260 \u8bfb\u51fa\u6765\u7684\u503c\u6709\u8272 \u2014\u2014 \u5730\u5740\u7684\u8272\u8fc7 DEREF \u6362\u6210\u300c\u503c\u300d\u8272（ip \u2192 ipval）\u843d\u5230\u8f93\u51fa<\/td>\n<\/tr>\n | ||||||
| STORE<\/td>\n | \u4e0d\u4ea7\u503c，\u4f46\u5730\u5740\/\u503c\u4e24\u8def\u7684\u8272\u626b\u5230\u65f6\u5c31\u8bb0\u4e0b\u6765<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \u6700\u540e\u90a3\u6761\u5f97\u5f3a\u8c03\u4e00\u4e0b：unique \u7684 offset \u4f1a\u88ab\u540e\u9762\u7684\u6307\u4ee4\u590d\u7528，\u626b\u5b8c\u518d\u56de\u5934\u770b\u90a3\u4e00\u683c\u65e9\u5c31\u88ab\u8986\u76d6\u4e86，\u5206\u7c7b\u5fc5\u987b\u5728\u626b\u7684\u8fc7\u7a0b\u4e2d\u505a\u3002<\/p>\n \u8fd9\u4e2a\u51fd\u6570\u4e0d\u662f\u53ea\u4e3a x23 \u5199\u7684 \u2014\u2014 x24（\u865a\u62df\u5bc4\u5b58\u5668\u6587\u4ef6）\u3001x25（handler \u8868）\u5c31\u662f\u540c\u4e00\u4e2a\u51fd\u6570\u6362\u4e2a\u79cd\u5b50，DEREF \u8868\u91cc\u4f4d\u7f6e\u90fd\u7559\u597d\u4e86\u3002<\/p>\n pre \/ post \u600e\u4e48\u53d6<\/h4>\n\u4e24\u4e2a\u70b9\u90fd\u5728 shadow \u4e0a\u53d6：<\/p>\n
|