using X86Disassembler.Analysers.DecompilerTypes; using X86Disassembler.X86; using X86Disassembler.X86.Operands; namespace X86Disassembler.Analysers; /// /// Analyzes control flow structures in disassembled code /// public class ControlFlowAnalyzer { /// /// The analyzer context /// private readonly AnalyzerContext _context; /// /// Creates a new control flow analyzer /// /// The analyzer context public ControlFlowAnalyzer(AnalyzerContext context) { _context = context; } /// /// Analyzes the control flow of a function to identify high-level structures /// /// The function to analyze public void AnalyzeControlFlow(Function function) { // First, identify if-else structures IdentifyIfElseStructures(function); // Then, identify switch statements IdentifySwitchStatements(function); } /// /// Identifies if-else structures in the control flow graph /// /// The function to analyze private void IdentifyIfElseStructures(Function function) { // Now analyze each block for conditional jumps foreach (var block in function.AsmFunction.Blocks) { // Get the last instruction in the block var lastInstruction = block.Instructions.LastOrDefault(); if (lastInstruction == null) continue; // Check if the last instruction is a conditional jump if (lastInstruction.Type.IsConditionalJump()) { // Get the jump target address ulong targetAddress = GetJumpTargetAddress(lastInstruction); // Find the target block InstructionBlock? targetBlock = null; foreach (var b in function.AsmFunction.Blocks) { if (b.Address == targetAddress) { targetBlock = b; break; } } if (targetBlock == null) { continue; } // Find the fall-through block (should be in the successors) InstructionBlock? fallThroughBlock = null; foreach (var successor in block.Successors) { if (successor != targetBlock) { fallThroughBlock = successor; break; } } if (fallThroughBlock == null) { continue; } // Create an if-else structure var ifElseStructure = new IfElseStructure { ConditionBlock = block, ThenBlock = targetBlock, ElseBlock = fallThroughBlock }; // Store the if-else structure in the analysis context function.AsmFunction.Context.StoreAnalysisData(block.Address, "IfElseStructure", ifElseStructure); } } // Second pass: identify nested if-else structures foreach (var block in function.AsmFunction.Blocks) { var ifElseStructure = _context.GetAnalysisData(block.Address, "IfElseStructure"); if (ifElseStructure != null) { // Check if the 'then' block contains another if-else structure var nestedThenIf = _context.GetAnalysisData(ifElseStructure.ThenBlock.Address, "IfElseStructure"); if (nestedThenIf != null) { ifElseStructure.NestedThenStructure = nestedThenIf; } // Check if the 'else' block contains another if-else structure if (ifElseStructure.ElseBlock != null) { var nestedElseIf = _context.GetAnalysisData(ifElseStructure.ElseBlock.Address, "IfElseStructure"); if (nestedElseIf != null) { ifElseStructure.NestedElseStructure = nestedElseIf; } } } } } /// /// Identifies switch statements in the control flow graph /// /// The function to analyze private void IdentifySwitchStatements(Function function) { // For each block in the function foreach (var block in function.AsmFunction.Blocks) { // Look for patterns that indicate a switch statement // Common patterns include: // 1. A series of compare and jump instructions // 2. An indirect jump through a jump table // For now, we'll focus on the first pattern (series of compares) if (IsPotentialSwitchHeader(block)) { // This is a potential switch statement var switchStructure = new SwitchStructure { HeaderBlock = block, Cases = [] }; // Find the cases by analyzing the successors foreach (var successor in block.Successors) { // Each successor is a potential case switchStructure.Cases.Add(new SwitchCase { CaseBlock = successor, Value = 0 // We'd need more analysis to determine the actual value }); } // Store the switch structure in the context _context.StoreAnalysisData(block.Address, "SwitchStructure", switchStructure); } } } /// /// Gets the target address of a jump instruction /// /// The jump instruction /// The target address of the jump private ulong GetJumpTargetAddress(Instruction instruction) { // Add debug output to see the instruction and its operands // For conditional jumps, the target address is the first operand if (instruction.StructuredOperands.Count > 0) { var operand = instruction.StructuredOperands[0]; if (operand is ImmediateOperand immOp) { return (ulong)immOp.Value; } else if (operand is RelativeOffsetOperand relOp) { // For relative jumps, the target address is directly available in the operand // We need to convert from file offset to RVA by adding 0x1000 (the section offset) // This matches how the blocks are converted in BlockDisassembler.cs ulong rvaTargetAddress = relOp.TargetAddress + 0x1000; return rvaTargetAddress; } } // If we can't determine the target, return 0 return 0; } /// /// Checks if the given block is a potential switch statement header /// /// The block to check /// True if the block is a potential switch header, false otherwise private bool IsPotentialSwitchHeader(InstructionBlock block) { // A switch header typically has multiple successors if (block.Successors.Count <= 2) { return false; } // Look for patterns that indicate a switch statement // For now, we'll just check if the block ends with an indirect jump if (block.Instructions.Count > 0) { var lastInstruction = block.Instructions[^1]; if (lastInstruction.Type == InstructionType.Jmp && lastInstruction.StructuredOperands.Count > 0 && !(lastInstruction.StructuredOperands[0] is ImmediateOperand)) { return true; } } return false; } /// /// Represents an if-else structure in the control flow graph /// public class IfElseStructure { /// /// The block containing the condition /// public InstructionBlock ConditionBlock { get; set; } = null!; /// /// The block representing the 'then' branch (taken when condition is true) /// public InstructionBlock ThenBlock { get; set; } = null!; /// /// The block representing the 'else' branch (taken when condition is false) /// public InstructionBlock? ElseBlock { get; set; } /// /// The block where both branches merge back together (if applicable) /// public InstructionBlock? MergeBlock { get; set; } /// /// Whether this is a complete if-else structure with a merge point /// public bool IsComplete { get; set; } /// /// Nested if-else structure in the 'then' branch (if any) /// public IfElseStructure? NestedThenStructure { get; set; } /// /// Nested if-else structure in the 'else' branch (if any) /// public IfElseStructure? NestedElseStructure { get; set; } } /// /// Represents a switch statement in the control flow graph /// public class SwitchStructure { /// /// The block containing the switch header /// public InstructionBlock HeaderBlock { get; set; } = null!; /// /// The cases of the switch statement /// public List Cases { get; set; } = []; } /// /// Represents a case in a switch statement /// public class SwitchCase { /// /// The value of the case /// public int Value { get; set; } /// /// The block containing the case code /// public InstructionBlock CaseBlock { get; set; } = null!; } }