Pattern matching against decompiler output (weggli)

[arizvisa]

Taking inspiration from weggli over at https://github.com/weggli-rs/weggli, i wrote the patch (attached at the end of the post) against weggli-rs/weggli@01499e2. It essentially adds support to weggli's python module for returning the spans or bounds from the query results.

After you apply the patch, build weggli, and drop its python module somewhere in your python path, you should be able to use the preliminary decompiler modules over at https://gist.github.com/arizvisa/6a6237205e7cc63e9307dd158078d9fc with minsc. To use those modules, copy base-hexrays.py to base/hexrays.py and procs-hexrays.py to procs/hexrays.py. That'll allow you to access the hexrays module and use its functionality in your scripting.

There's a couple of other things in the hexrays module, that might be useful. The hexrays.repr function is pretty handy in that it recognizes a number of decompiler types and can be used to get a quick representation describing things about that type. Apologies for the scarcity of its documentation.

Anyways, the hexrays.tree namespace contains all the ctree things. In this namespace you can find hexrays.tree.match (aliased as hexrays.match) to query a function using weggli's syntax. For example, to query all calls to WPP_SF_q, you can do something like the following.

import hexrays
some_function = func.by('whatever')
for m in hexrays.match(some_function, 'WPP_SF_q(_);'):
  print('found', hexrays.repr(m))
  cot_call = hexrays.tree.parent(m, opname='call')
  args = cot_call.operands['a']
  print(hex(cot_call.ea), hexrays.repr(cot_call))
  for i, arg in enumerate(args):
    print('\t', i, hexrays.repr(arg))
  continue

The hexrays.tree.parent function (that's being used) takes a citem_t and a function address/body to traverse upwards from whatever was matched.

Output of the previous python looks like:

found WPP_SF_q
1d29c WPP_SF_q(WPP_GLOBAL_Control->AttachedDevice, WPP_GLOBAL_Control->CurrentIrp, 20 * v3)
	 0 WPP_GLOBAL_Control->AttachedDevice
	 1 WPP_GLOBAL_Control->CurrentIrp
	 2 20 * v3
found WPP_GLOBAL_Control
1d312 WPP_SF_q(WPP_GLOBAL_Control->AttachedDevice, WPP_GLOBAL_Control->CurrentIrp, 40 * v4)
	 0 WPP_GLOBAL_Control->AttachedDevice
	 1 WPP_GLOBAL_Control->CurrentIrp
	 2 40 * v4

I'm still experimenting with this, and may consider integrating weggli support into the plugin if the interface feels right. However, there's also a chance that I drop weggli entirely in favor of something custom wrapped around the tree-sitter library. Hence, all opinions about this are welcome.

---

That patch is here (https://gist.github.com/arizvisa/ba180b27fa21a3a65ab12f534be19d27) because I can't figure out how to fucking attach files to the discussion without getting a "We don't support that file type" error message. Apologies in advance for the patch.. I hate rust and hence don't speak it.