Function CFGCodeAnalysis

src/e9tool/e9cfg.cpp:108–248

* Code analysis pass: find all probable code targets. */

 * Code analysis pass: find all probable code targets.
 */
static void CFGCodeAnalysis(const ELF *elf, bool pic, const Instr *Is,
    size_t size, std::set<intptr_t> &tables, Targets &targets)
{
    // STEP (1): Calculate a rough-cut of the targets:
    intptr_t next = INTPTR_MIN;
    for (size_t i = 0; i < size; i++)
    {
        InstrInfo I0, *I = &I0;
        getInstrInfo(elf, Is + i, I);
        if (next != I->address)
        {
            // [HEURISTIC] This is the first instruction after a "gap" in the
            // executable code.  Thus, something probably jumps here, so is
            // considered a jump target.
            DEBUG(targets, I->address, "Entry : %p", (void *)I->address);
            addTarget(I->address, TARGET_ENTRY, targets);
        }
        next = I->address + I->size;

        intptr_t target = INTPTR_MIN;
        bool call = false;
        switch (I->mnemonic)
        {
            case MNEMONIC_MOV: case MNEMONIC_PUSH:
                if (pic || I->op[0].type != OPTYPE_IMM)
                    continue;

                // [HEURISTIC] This instruction may be moving a jump target
                // into another location for later use.  Thus, we consider the
                // immediate value to be a target if it happens to point to a
                // valid instruction.
                //
                // [HEURISTIC] The target is assumed to be a function.
                target = (intptr_t)I->op[0].imm;
                if (findInstr(Is, size, target) >= 0)
                {
                    DEBUG(targets, target, "Load  : %p", (void *)target);
                    addTarget(target, TARGET_INDIRECT | TARGET_FUNCTION,
                        targets);
                }
                continue;

            case MNEMONIC_LEA:
                if (I->op[0].type != OPTYPE_MEM ||
                        I->op[0].mem.base != REGISTER_RIP)
                    continue;

                // [HEURISTIC] Similar to the "mov" case but for PIC.
                target = (intptr_t)I->address + (intptr_t)I->size +
                    (intptr_t)I->op[0].mem.disp;
                if (findInstr(Is, size, target) >= 0)
                {
                    DEBUG(targets, target, "Load  : %p", (void *)target);
                    addTarget(target, TARGET_INDIRECT | TARGET_FUNCTION,
                        targets);
                }
                else
                {