Add code-structure analysis: call graph, jump tables, basic blocks, constant xref

mirror of https://dev.lirent.ru/Vatrog/vm-introspection-engine.git synced 2026-06-18 02:06:36 +03:00

Wave 1 of the code-analysis layer, built on the x86-64 decoder:

- vmie_win32_callgraph walks each .pdata function with the decoder and emits an
  edge for every direct call/jmp whose target lands in the module - the
  intra-module call graph. Indirect edges are left to the IAT and jump tables.
- gva_jumptable recovers a switch's case targets from an indirect jump's table:
  consecutive pointer entries that land in an executable region.
- cfg_blocks splits one function view into basic blocks (a generic handler:
  leaders from intra-function branch targets, cut after jmp/jcc/ret).
- gva_imm_xref finds the instructions whose immediate operand equals a constant
  - the dual of code-xref for magic values, error codes, syscall numbers.

The decoder now also reports imm_off/imm_len so a caller can read or match the
immediate operand. The generic primitives live in the new codeanalysis.h
(jump tables, basic blocks) and scan.h (constant xref); the .pdata-bound call
graph stays on the win32 surface and reuses the existing function/section/decode
primitives - no second PE or instruction parser.

This commit is contained in:

Gregory Lirent

2026-06-16 19:52:25 +03:00

parent c4419964aa

commit 79e82ffc6a

9 changed files with 505 additions and 1 deletions

									
										CMakeLists.txt
									
		+1
		
												View File
												
				@@ -21,6 +21,7 @@ add_library(vmie STATIC

				        src/handlers/sigscan.c

				        src/handlers/sigset.c

				        src/handlers/codescan.c

				        src/handlers/codeanalysis.c

				        src/handlers/siggen.c

				        src/handlers/x86dec.c

				        src/handlers/pmap.c