angr/pyvex

Confused tmp index in Dirty stmt

xrivendell7 opened this issue · 1 comments

When I test lifter from x86 to vex , I found this

~/P/R/G/src ❯❯❯ bpython                                                                                                                                                               
>>> import pyvex
>>> import archinfo
>>> import codecs
>>> arch = archinfo.ArchX86()
>>> data = codecs.decode("db7d88",'hex')
>>> pp = pyvex.IRSB(data, 0x8048000,arch)
>>> pp.pp()
IRSB {
   t0:Ity_I32 t1:Ity_I32 t2:Ity_I32 t3:Ity_I64 t4:Ity_F64 t5:Ity_F64 t6:Ity_F64 t7:Ity_I32 t8:Ity_I1 t9:Ity_I8 t10:Ity_I32 t11:Ity_I32 t12:Ity_I32 t13:Ity_I32 t14:Ity_I32

   00 | ------ IMark(0x8048000, 3, 0) ------a
   01 | t2 = GET:I32(ebp)
   02 | t1 = Add32(t2,0xffffff88)
   03 | t5 = nan
   04 | t7 = GET:I32(ftop)
   05 | t6 = GetI(72:F64x8)[t7,0]
   06 | t9 = GetI(136:I8x8)[t7,0]
   07 | t8 = CmpNE8(t9,0x00)
   08 | t4 = ITE(t8,t6,t5)
   09 | t3 = ReinterpF64asI64(t4)
   10 | t4294967295 = DIRTY 1 TODO(effects) ::: x86g_dirtyhelper_storeF80le(t1,t3)
   11 | PutI(136:I8x8)[t7,0] = 0x00
   12 | t12 = Add32(t7,0x00000001)
   13 | PUT(ftop) = t12
   NEXT: PUT(eip) = 0x08048003; Ijk_Boring
}

It's the fstp [ebp+var_78] in x86 which had side effect.
Howerver the index of tmp in Dirty statements is 4294967295 which maybe 0xffffffff = -1 i guess and it doesn't apperar in tyenvs.
Maybe I don’t know enough about Dirty, look forward for answering...

vex uses tmp val -1 in dirty statements to indicate that the function is a void function, that it has no return value.