Skip to main content

drutil_expand_rep_string

Function drutil_expand_rep_string 

Source
pub unsafe extern "C" fn drutil_expand_rep_string(
    drcontext: *mut c_void,
    bb: *mut instrlist_t,
) -> bool_
Expand description

Expands single-instruction string loops (those using the \p rep or \p repne prefixes) into regular loops to simplify memory usage analysis. This is accomplished by arranging for each single-instruction string loop to occupy a basic block by itself (by truncating the prior block before the loop, and truncating instructions after the loop) and then exanding it into a multi-instruction loop.

Clients applying this expansion are encouraged to use emulation-aware instrumentation via drmgr_orig_app_instr_for_fetch() and drmgr_orig_app_instr_for_operands() in order to observe the original string loop opcode with the expanded memory operands.

WARNING: The added multi-instruction loop contains several control-transfer instructions and is not straight-line code, which can complicate subsequent analysis routines.

WARNING: The added instructions have translations that are in the middle of the original string loop instruction. This is to prevent passes that match exact addresses from having multiple hits and doing something like inserting 6 clean calls.

WARNING: The added instructions include a jecxz instruction which will not be transformed into a 32-bit-reach instruction: thus, excessive added instrumentation may result in a reachability problem.

The client must use the \p drmgr Extension to order its instrumentation in order to use this function. This function must be called from the application-to-application (“app2app”) stage (see drmgr_register_bb_app2app_event()).

This transformation is deterministic, so the caller can return DR_EMIT_DEFAULT from its event.

\return whether successful.