src/disassembler/llvm/LLVMDisassembler.cxx

   1 #include "disassembler/Instruction.hxx"
   2 #include "disassembler/llvm/LLVMDisassembler.hxx"
   3 #include "core/InformationManager.hxx"
   4 #include "core/Function.hxx"
   5 #include "core/BasicBlock.hxx"
   6 #include "core/Exception.hxx"
   7 #include <boost/algorithm/string.hpp>
   8
   9 #include <stack>
  10 #include <algorithm>
  11 #include <cassert>
  12
  13 using namespace llvm;
  14 using namespace llvm::object;
  15 using std::error_code;
  16
  17 namespace {
  18         class COFFT {
  19
  20         };
  21
  22         class MACHOT {
  23
  24         };
  25 }
  26
  27 /*
  28  *
  29  */
  30 Disassembler * createLLVMDisassembler(const std::string& filename, InformationManager* manager) {
  31         log4cxx::LoggerPtr logger(log4cxx::Logger::getLogger("disassembler.LLVMDisassembler"));
  32         if (filename == "")
  33                 return NULL;
  34
  35         auto retval = createBinary(filename);
  36         if (error_code ec = retval.getError()) {
  37                 LOG4CXX_ERROR(logger, ec.message());
  38                 return NULL;
  39         }
  40 #if defined(LLVM_35)
  41         Binary * op = retval.get();
  42 #elif defined(LLVM_36)
  43         OwningBinary<Binary> ob;
  44         ob  = std::move(retval.get());
  45         Binary* op = ob.getBinary();
  46         auto foo = ob.takeBinary();
  47         foo.first.release();
  48         foo.second.release();
  49 #endif
  50
  51         try {
  52                 // ELFType<endian, maxalign, 64bit>
  53                 if (ELF32LEObjectFile * object = dyn_cast<ELF32LEObjectFile>(op)) {
  54                         return new LLVMDisassembler<ELFType<support::little, 2, false>>(filename, manager, object);
  55                 }
  56                 if (ELF64LEObjectFile * object = dyn_cast<ELF64LEObjectFile>(op)) {
  57                         return new LLVMDisassembler<ELFType<support::little, 2, true>>(filename, manager, object);
  58                 }
  59                 if (ELF32BEObjectFile * object = dyn_cast<ELF32BEObjectFile>(op)) {
  60                         return new LLVMDisassembler<ELFType<support::big, 2, false>>(filename, manager, object);
  61                 }
  62                 if (ELF64BEObjectFile * object = dyn_cast<ELF64BEObjectFile>(op)) {
  63                         return new LLVMDisassembler<ELFType<support::big, 2, true>>(filename, manager, object);
  64                 }
  65                 if (COFFObjectFile * object = dyn_cast<COFFObjectFile>(op)) {
  66                         return new LLVMDisassembler<COFFT>(filename, manager, object);
  67                 }
  68                 if (MachOObjectFile * object = dyn_cast<MachOObjectFile>(op)) {
  69                         return new LLVMDisassembler<MACHOT>(filename, manager, object);
  70                 }
  71         } catch (BinaryNotSupported& e) {
  72                 return NULL;
  73         }
  74         return NULL;
  75 }
  76
  77 /*
  78  * TODO: fallback code falls die Datei kein ELF/PE/COFF/MacO/.. binary
  79  * ist sondern z.B. einfach nur Instruktionen oder ein Bootsektor oder
  80  * foo
  81  */
  82 template <typename ELFT>
  83 LLVMDisassembler<ELFT>::LLVMDisassembler(const std::string& filename,
  84                                          InformationManager* manager,
  85                                          ObjectFile* file)
  86         : Disassembler()
  87         , logger(log4cxx::Logger::getLogger("disassembler.LLVMDisassembler"))
  88         , triple("unknown-unknown-unknown")
  89         , manager(manager)
  90 {
  91         LOG4CXX_DEBUG(logger, "Handling file " << filename);
  92
  93         if (!file) {
  94                 auto result = createBinary(filename);
  95
  96                 error_code ec;
  97                 if ((ec = result.getError())) {
  98                         LOG4CXX_ERROR(logger, "Failed to load Binary" << ec.message());
  99                         binary = NULL;
 100                         return;
 101                 }
 102
 103 #if defined(LLVM_35)
 104                 binary.reset(result.get());
 105 #elif defined(LLVM_36)
 106                 OwningBinary<Binary> ob;
 107                 ob  = std::move(result.get());
 108                 Binary* op = ob.getBinary();
 109
 110                 binary.reset(op);
 111 #endif
 112
 113                 o = dyn_cast<ObjectFile>(binary.get());
 114         } else {
 115                 o = file;
 116                 binary.reset(file);
 117         }
 118
 119         triple.setArch(Triple::ArchType(o->getArch()));
 120         std::string tripleName(triple.getTriple());
 121
 122         LOG4CXX_INFO(logger, "Architecture " << tripleName);
 123
 124
 125         std::string es;
 126         target = TargetRegistry::lookupTarget("", triple, es);
 127         if (!target) {
 128                 LOG4CXX_ERROR(logger, es);
 129                 BinaryNotSupported e;
 130                 throw e;
 131         }
 132
 133         LOG4CXX_INFO(logger, "Target " << target->getName());
 134
 135         MRI.reset(target->createMCRegInfo(tripleName));
 136         if (!MRI) {
 137                 LOG4CXX_ERROR(logger, "no register info for target " << tripleName);
 138                 BinaryNotSupported e;
 139                 throw e;
 140         }
 141
 142         // Set up disassembler.
 143         AsmInfo.reset(target->createMCAsmInfo(*MRI, tripleName));
 144         if (!AsmInfo) {
 145                 LOG4CXX_ERROR(logger, "no assembly info for target " << tripleName);
 146                 BinaryNotSupported e;
 147                 throw e;
 148         }
 149
 150         STI.reset(target->createMCSubtargetInfo(tripleName, "", ""));
 151         if (!STI) {
 152                 LOG4CXX_ERROR(logger, "no subtarget info for target " << tripleName);
 153                 BinaryNotSupported e;
 154                 throw e;
 155         }
 156
 157         MII.reset(target->createMCInstrInfo());
 158         if (!MII) {
 159                 LOG4CXX_ERROR(logger, "no instruction info for target " << tripleName);
 160                                 BinaryNotSupported e;
 161                 throw e;
 162         }
 163
 164         MOFI.reset(new MCObjectFileInfo);
 165         MCContext Ctx(AsmInfo.get(), MRI.get(), MOFI.get());
 166
 167         DisAsm.reset(target->createMCDisassembler(*STI, Ctx));
 168         if (!DisAsm) {
 169                 LOG4CXX_ERROR(logger, "no disassembler for target " << tripleName);
 170                 BinaryNotSupported e;
 171                 throw e;
 172         }
 173         RelInfo.reset(
 174                 target->createMCRelocationInfo(tripleName, Ctx));
 175         if (RelInfo) {
 176                 // Symzer.reset(
 177                 //      MCObjectSymbolizer::createObjectSymbolizer(Ctx, std::move(RelInfo), o));
 178                 // if (Symzer)
 179                 //      DisAsm->setSymbolizer(std::move(Symzer));
 180         }
 181         RelInfo.release();
 182         Symzer.release();
 183
 184         MIA.reset(target->createMCInstrAnalysis(MII.get()));
 185         if (!MIA) {
 186                 LOG4CXX_ERROR(logger, "no instruction analysis for target " << tripleName);
 187                 BinaryNotSupported e;
 188                 throw e;
 189         }
 190
 191         int AsmPrinterVariant = AsmInfo->getAssemblerDialect();
 192         IP.reset(target->createMCInstPrinter(AsmPrinterVariant, *AsmInfo, *MII, *MRI, *STI));
 193         if (!IP) {
 194                 LOG4CXX_ERROR(logger, "no instruction printer for target " << tripleName);
 195                 BinaryNotSupported e;
 196                 throw e;
 197         }
 198
 199         IP->setPrintImmHex(llvm::HexStyle::C);
 200         IP->setPrintImmHex(true);
 201
 202 //      std::unique_ptr<MCObjectDisassembler> OD(
 203 //              new MCObjectDisassembler(*o, *DisAsm, *MIA));
 204         //Mod.reset(OD->buildModule(false));
 205
 206         readSections();
 207 }
 208
 209 template <typename ELFT>
 210 void LLVMDisassembler<ELFT>::start() {
 211         readSymbols();
 212         disassemble();
 213         readDynamicSymbols();
 214 }
 215
 216 template <typename ELFT>
 217 LLVMDisassembler<ELFT>::~LLVMDisassembler() {}
 218
 219 template <typename ELFT>
 220 Function* LLVMDisassembler<ELFT>::disassembleFunctionAt(uint64_t address, const std::string& name) {
 221         Function * function;
 222         SectionRef text_section = getTextSection();
 223         uint64_t base_address, size;
 224 #if defined(LLVM_35)
 225         text_section.getAddress(base_address);
 226         text_section.getSize(size);
 227 #elif defined(LLVM_36)
 228         base_address = text_section.getAddress();
 229         size = text_section.getSize();
 230 #endif
 231         if (address < base_address ||
 232             address >= base_address + size) {
 233                 return NULL;
 234         }
 235
 236         if (NULL == (function = manager->getFunction(address))) {
 237
 238                 if (name == "") {
 239                         std::stringstream s;
 240                         s << "<Unnamed 0x" << std::hex << address << ">";
 241                         function = manager->newFunction(address);
 242                         function->setName(s.str());
 243                 } else {
 244                         function = manager->newFunction(address);
 245                         function->setName(name);
 246                 }
 247                 disassembleFunction(function);
 248         }
 249
 250         return function;
 251 }
 252
 253 template <typename ELFT>
 254 void LLVMDisassembler<ELFT>::disassembleFunction(Function* function) {
 255         std::vector<uint64_t> called_functions;
 256         std::stack<BasicBlock*> remaining_blocks;
 257         /* TODO:
 258          * Do all blocks get added properly? We should take care to remove
 259          * the other ones at the end of the function!
 260          */
 261         std::map<uint64_t, BasicBlock*> new_blocks;
 262         SectionRef text_section = getTextSection();
 263         StringRef bytes;
 264         uint64_t base_address, size;
 265         text_section.getContents(bytes);
 266 #if defined(LLVM_35)
 267         StringRefMemoryObject ref(bytes);
 268         text_section.getAddress(base_address);
 269         text_section.getSize(size);
 270 #elif defined(LLVM_36)
 271         ArrayRef<uint8_t> bytearray(reinterpret_cast<const uint8_t *>(bytes.data()),
 272                            bytes.size());
 273         base_address = text_section.getAddress();
 274         size = text_section.getSize();
 275 #else
 276 #error LLVM != 3.5 | 3.6 not supported
 277 #endif
 278
 279         LOG4CXX_DEBUG(logger, "Handling function " << function->getName());
 280
 281         if(function->getStartAddress() < base_address || function->getStartAddress() > base_address + size) {
 282                 LOG4CXX_INFO(logger, "Trying to disassemble function " << function->getName() << " but start address " << std::hex << function->getStartAddress() << " is located outside the text segment");
 283                 return;
 284         }
 285
 286         BasicBlock * block = manager->newBasicBlock(function->getStartAddress());
 287         remaining_blocks.push(block);
 288         new_blocks.insert(std::make_pair(block->getStartAddress(), block));
 289         function->addBasicBlock(block);
 290
 291         LOG4CXX_DEBUG(logger, "Text section at " << std::hex << base_address << " with size " << size);
 292
 293         while (remaining_blocks.size()) {
 294                 BasicBlock * current_block = remaining_blocks.top();
 295                 remaining_blocks.pop();
 296
 297                 LOG4CXX_DEBUG(logger, "Handling Block starting at " << std::hex
 298                               << current_block->getStartAddress());
 299
 300                 uint64_t inst_size;
 301                 uint64_t current_address = current_block->getStartAddress() - base_address;
 302                 while(true) {
 303                         MCInst inst;
 304                         std::string buf;
 305                         llvm::raw_string_ostream s(buf);
 306
 307                         if(llvm::MCDisassembler::Success ==
 308 #if defined(LLVM_35)
 309                            DisAsm->getInstruction(inst, inst_size, ref, current_address, nulls(), nulls())) {
 310 #elif defined(LLVM_36)
 311                                 DisAsm->getInstruction(inst, inst_size,
 312                                                        bytearray.slice(current_address),
 313                                                        base_address + current_address,
 314                                                        nulls(), nulls())) {
 315 #endif
 316                                 uint64_t jmptarget;
 317
 318                                 if (MIA->evaluateBranch(inst, current_address, inst_size, jmptarget)) {
 319                                         jmptarget += base_address;
 320                                         if (!MIA->isIndirectBranch(inst)) {
 321                                                 if (MIA->isCall(inst)) {
 322                                                         if (NULL == manager->getFunction(jmptarget))
 323                                                                 called_functions.push_back(jmptarget);
 324                                                 } else {
 325                                                         current_block->setNextBlock(0, jmptarget);
 326                                                         if (new_blocks.find(jmptarget) == new_blocks.end()) {
 327                                                                 BasicBlock * block = manager->newBasicBlock(jmptarget);
 328                                                                 assert(block);
 329                                                                 new_blocks.insert(std::make_pair(block->getStartAddress(), block));
 330                                                                 function->addBasicBlock(block);
 331                                                                 remaining_blocks.push(block);
 332                                                         } else {
 333                                                                 LOG4CXX_DEBUG(logger, "Reusing Block starting at " << std::hex
 334                                                                               << current_block->getStartAddress());
 335                                                                 function->addBasicBlock(new_blocks.find(jmptarget)->second);
 336                                                         }
 337                                                         if (MIA->isConditionalBranch(inst)) {
 338                                                                 jmptarget = base_address + current_address + inst_size;
 339                                                                 current_block->setNextBlock(1, jmptarget);
 340                                                                 if (new_blocks.find(jmptarget) == new_blocks.end()) {
 341                                                                         BasicBlock * block = manager->newBasicBlock(jmptarget);
 342                                                                         assert(block);
 343                                                                         new_blocks.insert(std::make_pair(block->getStartAddress(), block));
 344                                                                         function->addBasicBlock(block);
 345                                                                         remaining_blocks.push(block);
 346                                                                 } else {
 347                                                                         LOG4CXX_DEBUG(logger, "Reusing Block starting at " << std::hex
 348                                                                                       << current_block->getStartAddress());
 349                                                                         function->addBasicBlock(new_blocks.find(jmptarget)->second);
 350                                                                 }
 351                                                         }
 352                                                 }
 353                                         }
 354                                 }
 355                         } else {
 356                                 inst_size = 0;
 357                         }
 358
 359
 360                         if (inst_size == 0 || MIA->isTerminator(inst) || MIA->isBranch(inst)) {
 361                                 current_block->setEndAddress(current_address + base_address + inst_size);
 362                                 LOG4CXX_DEBUG(logger, "Finished Block at " << std::hex <<
 363                                               current_block->getEndAddress());
 364                                 break;
 365                         }
 366                         current_address += inst_size;
 367                 }
 368         }
 369         splitBlocks(function);
 370         LOG4CXX_DEBUG(logger, "Finished function " << function->getName());
 371         manager->finishFunction(function);
 372         for (uint64_t address : called_functions)
 373                 disassembleFunctionAt(address);
 374 }
 375
 376 template <typename ELFT>
 377 void LLVMDisassembler<ELFT>::disassemble() {
 378         SectionRef text_section = getTextSection();
 379         std::vector<Function*> remaining_functions;
 380
 381         // Assume all function symbols actually start a real function
 382         for (auto x = symbols.begin(); x != symbols.end(); ++x) {
 383                 uint64_t result;
 384                 bool contains;
 385                 SymbolRef::Type symbol_type;
 386
 387 #if defined(LLVM_35)
 388                 if (text_section.containsSymbol(x->second, contains) || !contains)
 389 #elif defined(LLVM_36)
 390                 if (!text_section.containsSymbol(x->second))
 391 #endif
 392                         continue;
 393
 394                 if (x->second.getType(symbol_type)
 395                     || SymbolRef::ST_Function != symbol_type)
 396                         continue;
 397
 398                 if (!x->second.getAddress(result)) {
 399                         Function * fun = manager->newFunction(result);
 400                         if (fun) {
 401                                 fun->setName(x->first);
 402                                 remaining_functions.push_back(fun);
 403                                 LOG4CXX_DEBUG(logger, "Disasembling " << x->first);
 404                         } else {
 405                                 LOG4CXX_DEBUG(logger, "Function at " << std::hex << result
 406                                               << " already disassembled as " << manager->getFunction(result)->getName());
 407                         }
 408                 }
 409         }
 410
 411         for (Function* function : remaining_functions) {
 412                 disassembleFunction(function);
 413                 manager->finishFunction(function);
 414         }
 415
 416         if (binary->isELF()) {
 417                 uint64_t _entryAddress = entryAddress();
 418                 LOG4CXX_DEBUG(logger, "Adding entryAddress at: " << std::hex << _entryAddress);
 419                 std::stringstream s;
 420                 s << "<_start 0x" << std::hex << _entryAddress << ">";
 421
 422                 disassembleFunctionAt(_entryAddress, s.str());
 423         }
 424
 425         if (!manager->hasFunctions()) {
 426                 uint64_t text_entry;
 427 #if defined(LLVM_35)
 428                 text_section.getAddress(text_entry);
 429 #elif defined(LLVM_36)
 430                 text_entry = text_section.getAddress();
 431 #endif
 432                 LOG4CXX_INFO(logger, "No Symbols found, starting at the beginning of the text segment");
 433                 disassembleFunctionAt(text_entry);
 434         }
 435 }
 436
 437 template <>
 438 uint64_t LLVMDisassembler<COFFT>::entryAddress() {
 439         const auto coffobject = dyn_cast<COFFObjectFile>(o);
 440         const struct pe32_header* pe32_header;
 441         const struct pe32plus_header* pe32plus_header;
 442
 443         coffobject->getPE32PlusHeader(pe32plus_header);
 444
 445         if (pe32plus_header) {
 446                 return pe32plus_header->AddressOfEntryPoint;
 447         } else {
 448                 coffobject->getPE32Header(pe32_header);
 449                 return pe32_header->AddressOfEntryPoint;
 450         }
 451 }
 452
 453 template<>
 454 uint64_t LLVMDisassembler<MACHOT>::entryAddress() {
 455         // TODO
 456         return 0;
 457 }
 458
 459 template <typename ELFT>
 460 uint64_t LLVMDisassembler<ELFT>::entryAddress() {
 461         const auto elffile = dyn_cast<ELFObjectFile<ELFT>>(o)->getELFFile();
 462         const auto * header = elffile->getHeader();
 463
 464         return header->e_entry;
 465 }
 466
 467 template <typename ELFT>
 468 void LLVMDisassembler<ELFT>::splitBlocks(Function* function) {
 469         SectionRef text_section = getTextSection();
 470         StringRef bytes;
 471         text_section.getContents(bytes);
 472 #if defined(LLVM_35)
 473         StringRefMemoryObject ref(bytes);
 474 #elif defined(LLVM_36)
 475         ArrayRef<uint8_t> bytearray(reinterpret_cast<const uint8_t *>(bytes.data()),
 476                            bytes.size());
 477 #endif
 478
 479
 480         LOG4CXX_DEBUG(logger, "Splitting Blocks in Function " << function->getName());
 481         // Split blocks where jumps are going inside the block
 482         for (auto it = function->blocks().begin();
 483              it != function->blocks().end();
 484              ++it) {
 485                 BasicBlock * current_block = it->second;
 486                 if (current_block->getEndAddress() == 0) {
 487                         LOG4CXX_ERROR(logger, "UNFINISHED BLOCK " << std::hex << current_block->getStartAddress());
 488                         break;
 489                 }
 490                 uint64_t inst_size;
 491                 uint64_t base_address;
 492 #if defined(LLVM_35)
 493                 text_section.getAddress(base_address);
 494 #elif defined(LLVM_36)
 495                 base_address = text_section.getAddress();
 496 #endif
 497                 uint64_t current_address = current_block->getStartAddress() - base_address;
 498                 while(current_block->getEndAddress() - base_address > current_address) {
 499                         MCInst inst;
 500                         std::string buf;
 501                         llvm::raw_string_ostream s(buf);
 502
 503                         if(llvm::MCDisassembler::Success ==
 504 #if defined(LLVM_35)
 505                            DisAsm->getInstruction(inst, inst_size, ref, current_address, nulls(), nulls())) {
 506 #elif defined(LLVM_36)
 507                                 DisAsm->getInstruction(inst, inst_size,
 508                                                        bytearray.slice(current_address),
 509                                                        base_address + current_address,
 510                                                        nulls(), nulls())) {
 511 #endif
 512
 513                                 // See if some other block starts here
 514                                 BasicBlock* other = manager->getBasicBlock(current_address
 515                                                                            + inst_size
 516                                                                            + base_address);
 517
 518                                 // Special case, other block starts here but we are at the end anyway
 519                                 if (other != NULL) {
 520                                         uint64_t endaddress = current_address + inst_size + base_address;
 521                                         if (endaddress != current_block->getEndAddress()) {
 522                                                 LOG4CXX_DEBUG(logger, "Shortening block starting at "
 523                                                               << std::hex
 524                                                               << current_block->getStartAddress()
 525                                                               << " now ending at "
 526                                                               << other->getStartAddress());
 527                                                 function->addBasicBlock(other);
 528                                                 current_block->setEndAddress(endaddress);
 529                                                 current_block->setNextBlock(0, other->getStartAddress());
 530                                                 current_block->setNextBlock(1, 0);
 531                                         }
 532                                 }
 533                         } else {
 534                                 inst_size = 1;
 535                         }
 536                         current_address += inst_size;
 537                 }
 538         }
 539 }
 540
 541 template<>
 542 void LLVMDisassembler<COFFT>::readDynamicSymbols() {
 543         //TODO
 544 }
 545
 546 template<>
 547 void LLVMDisassembler<MACHOT>::readDynamicSymbols() {
 548         //TODO
 549 }
 550
 551 template <typename ELFT>
 552 void LLVMDisassembler<ELFT>::readDynamicSymbols() {
 553         const auto elffile = dyn_cast<ELFObjectFile<ELFT>>(o)->getELFFile();
 554         for (auto it = elffile->begin_dynamic_symbols(),
 555                      end = elffile->end_dynamic_symbols();
 556              it != end;
 557              ++it) {
 558                 if (it->getType() == 2) { // Function
 559                         bool is_default;
 560                         // TODO: Error handling
 561                         std::string symbolname = *(elffile->getSymbolName(it));
 562                         std::string symbolversion = *(elffile->getSymbolVersion(nullptr, &*it, is_default));
 563                         // TODO: actually get the symbol address from relocations
 564                         Function* f = manager->newDynamicFunction(0);
 565                         f->setName(symbolname + (is_default? "@@" : "@") + symbolversion);
 566                         manager->finishFunction(f);
 567
 568                         LOG4CXX_DEBUG(logger, "Adding dynamic Symbol " << symbolname << (is_default? "@@" : "@") << symbolversion);
 569                 }
 570         }
 571 }
 572
 573 template <typename ELFT>
 574 void LLVMDisassembler<ELFT>::readSymbols() {
 575         error_code ec;
 576         symbol_iterator si(o->symbol_begin()), se(o->symbol_end());
 577         for (; si != se; ++si) {
 578                 StringRef name;
 579                 uint64_t address;
 580                 si->getAddress(address);
 581                 if ((ec = si->getName(name))) {
 582                         LOG4CXX_ERROR(logger, ec.message());
 583                         break;
 584                 }
 585                 LOG4CXX_DEBUG(logger, "Added symbol " << name.str() << " at address " << std::hex << address);
 586                 symbols.insert(make_pair(name.str(), *si));
 587         }
 588 }
 589
 590 template <typename ELFT>
 591 void LLVMDisassembler<ELFT>::readSections() {
 592         error_code ec;
 593         section_iterator i(o->section_begin()), e(o->section_end());
 594         for (; i != e; ++i) {
 595                 StringRef name;
 596                 if ((ec = i->getName(name))) {
 597                         LOG4CXX_ERROR(logger, ec.message());
 598                         break;
 599                 }
 600                 LOG4CXX_DEBUG(logger, "Added section " << name.str());
 601                 sections.insert(make_pair(name.str(), *i));
 602         }
 603
 604 }
 605
 606 // template <typename ELFT>
 607 // void LLVMDisassembler<ELFT>::forEachFunction(std::function<void (uint64_t, Function*)> callback) {
 608 //      // std::for_each(functions.begin(), functions.end(),
 609 //      //               [&](std::pair<uint64_t, Function*> x) {
 610 //      //                    callback(x.first, x.second);
 611 //      //               });
 612 // }
 613
 614 template <typename ELFT>
 615 std::vector<Instruction> LLVMDisassembler<ELFT>::getInstructions(const BasicBlock *block) {
 616         std::vector<Instruction> result;
 617         SectionRef text_section = getTextSection();
 618         uint64_t base_address;
 619 #if defined(LLVM_35)
 620         text_section.getAddress(base_address);
 621 #elif defined(LLVM_36)
 622         base_address = text_section.getAddress();
 623 #endif
 624
 625         uint64_t current_address = block->getStartAddress() - base_address;
 626         uint64_t end_position = block->getEndAddress() - base_address;
 627
 628         StringRef bytes;
 629         text_section.getContents(bytes);
 630 #if defined(LLVM_35)
 631         StringRefMemoryObject ref(bytes);
 632 #elif defined(LLVM_36)
 633         ArrayRef<uint8_t> bytearray(reinterpret_cast<const uint8_t *>(bytes.data()),
 634                            bytes.size());
 635 #endif
 636
 637
 638         while (current_address < end_position) {
 639                 uint64_t inst_size;
 640                 MCInst inst;
 641                 std::string buf;
 642                 llvm::raw_string_ostream s(buf);
 643
 644                 if(llvm::MCDisassembler::Success ==
 645 #if defined(LLVM_35)
 646                            DisAsm->getInstruction(inst, inst_size, ref, current_address, nulls(), nulls())) {
 647 #elif defined(LLVM_36)
 648                                 DisAsm->getInstruction(inst, inst_size,
 649                                                        bytearray.slice(current_address),
 650                                                        base_address + current_address,
 651                                                        nulls(), nulls())) {
 652 #endif
 653
 654                         uint8_t bytes[inst_size+2];
 655 #if defined(LLVM_35)
 656                         ref.readBytes(current_address, inst_size, bytes);
 657 #elif defined(LLVM_36)
 658                         size_t bytesindex(0);
 659                         for (uint8_t byte : bytearray.slice(current_address, inst_size)) {
 660                                 bytes[bytesindex++] = byte;
 661                         }
 662 #endif
 663
 664                         uint64_t jmptarget;
 665                         std::string ref("");
 666                         IP->printInst(&inst, s, "");
 667                         if (MIA->evaluateBranch(inst, current_address, inst_size, jmptarget)) {
 668                                 std::stringstream stream;
 669                                 if (MIA->isCall(inst))
 670                                         stream << "function:";
 671                                 else
 672                                         stream << "block:";
 673
 674                                 stream << std::hex << (base_address + jmptarget);
 675                                 ref = stream.str();
 676                         }
 677                         result.push_back(Instruction(current_address + base_address, boost::algorithm::trim_copy(s.str()),
 678                                                      std::vector<uint8_t>(bytes, bytes+inst_size), ref));
 679                 } else {
 680                         LOG4CXX_WARN(logger, "Invalid byte at" << std::hex << current_address + base_address);
 681                         uint8_t bytes[1];
 682 #if defined(LLVM_35)
 683                         ref.readBytes(current_address, 1, bytes);
 684 #elif defined(LLVM_36)
 685                         bytes[0] = bytearray[current_address];
 686 #endif
 687                         result.push_back(Instruction(current_address + base_address, "Invalid Instruction",
 688                                                      std::vector<uint8_t>(bytes, bytes+1), ""));
 689                         inst_size = 1;
 690                 }
 691
 692                 current_address += inst_size;
 693         }
 694         return result;
 695 }
 696
 697 template <typename ELFT>
 698 SectionRef LLVMDisassembler<ELFT>::getTextSection() {
 699         return sections[".text"];
 700 }
 701
 702 template <>
 703 SectionRef LLVMDisassembler<MACHOT>::getTextSection() {
 704         return sections["__text"];
 705 }