pcode relevance

[Ruturaj4]

Hello,

I am using pcodes ("high pcodes") for my analysis. My main objective was to keep my analysis machine independent.

My analysis is based on a list of pcodes I recover from the decompiler. For e.g.

['(register, 0x28, 8) INT_SEXT (unique, 0x0, 4)', '(register, 0xa8, 4) INT_ADD (register, 0x38, 4) , (const, 0x0, 4)', '(unique, 0x0, 4) CAST (register, 0xa8, 4)', '(register, 0x28, 8) INT_LEFT (register, 0x28, 8) , (const, 0x0, 4)']

Currently, I am using complete pcode i.e. with (address_space, address, size) triplet for some classification analysis. I want to strip some of the information to reduce the analysis burden, but I don't want to lose important information from the pcodes.

I considered removing all the addresses - second field in the triplet and keep the rest. But, I thought this may remove some important information. Then, I thought about stripping some and keeping some. For e.g. I can strip actual code space addresses that show up in the pcodes, additionally I may not need to distinguish between registers. The problem with that is, even though I checked the documentation, I really don't know what some symbols signify for e.g. "unique".

What is the best way to approach this?

[astrelsky]

See ghidra/docs/languages/html/sleigh.html#sleigh_address_spaces. The last paragraph explains the unique and const address spaces.

[Ruturaj4]

Thanks @astrelsky. That is very useful. I somehow missed that part. Could you give me an advise on what to remove from the pcode, or how to clean the pcode? I want to use pcodes for a pattern detection algorithm and would like to remove unnecessary data such as addresses. I believe I can safely remove "addresses" from everything except registers (as that can be use to distinguish between different registers) and const (as that may contain some important constants, but may also contain addresses).

[astrelsky]

For transparency, this is definitely not my area of expertise.

If you want to keep your analysis machine independent I would recommend not stripping anything. However, for something like pattern detection I would try it on just the ops themselves and see how that goes, ie [INT_SEXT, INT_ADD, CAST, INT_LEFT].

Note that the generation of pcode for instructions is highly dependent on how the sleigh spec was implemented and who wrote it. Since you're using high pcode a majority of that should be simplified away by the decompiler but you should still keep an eye out for it.

That is probably the extend that I can help with this.

[Ruturaj4]

@astrelsky Thanks, your feedback is nonetheless very helpful.