{"action":"created","issue":{"url":"https://api.github.com/repos/cea-sec/miasm/issues/115","labels_url":"https://api.github.com/repos/cea-sec/miasm/issues/115/labels{/name}","comments_url":"https://api.github.com/repos/cea-sec/miasm/issues/115/comments","events_url":"https://api.github.com/repos/cea-sec/miasm/issues/115/events","html_url":"https://github.com/cea-sec/miasm/issues/115","id":62509211,"number":115,"title":"Question about the IR internals","user":{"login":"pmontagnier","id":1623671,"avatar_url":"https://avatars.githubusercontent.com/u/1623671?v=3","gravatar_id":"","url":"https://api.github.com/users/pmontagnier","html_url":"https://github.com/pmontagnier","followers_url":"https://api.github.com/users/pmontagnier/followers","following_url":"https://api.github.com/users/pmontagnier/following{/other_user}","gists_url":"https://api.github.com/users/pmontagnier/gists{/gist_id}","starred_url":"https://api.github.com/users/pmontagnier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmontagnier/subscriptions","organizations_url":"https://api.github.com/users/pmontagnier/orgs","repos_url":"https://api.github.com/users/pmontagnier/repos","events_url":"https://api.github.com/users/pmontagnier/events{/privacy}","received_events_url":"https://api.github.com/users/pmontagnier/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cea-sec/miasm/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-17T20:25:00Z","updated_at":"2015-03-18T09:12:30Z","closed_at":null,"body":"Hello,\r\nI have a question about how the IR translates assembly to miasm expressions, and I couldn't find any help elsewhere, so I'm asking the question here.\r\n\r\nLet's suppose I'm working on 32 bits x86 architecture, and I'm trying to translate the following assembly to miasm expressions:\r\n\r\n```\r\nMOV SI, DI\r\n```\r\n\r\nThese two registers are 16 bits wide.\r\n\r\nAfter the translation to IR, I was expecting something like:\r\n\r\n```\r\nSI = DI_init\r\n```\r\n\r\nBut instead, the IR seems to work only on 32 bit registers, and I will get a mix of ExprCompose, ExprSlice, like:\r\n\r\n```\r\nESI = {EDI_init[0:16],0,16, ESI_init[16:32],16,32}\r\n```\r\n\r\nMoreover, if I do a symbolic execution of the assembly block, with all x86 registers provided as input symbols, the SI register seems to be untouched after the translation, eventhough the instruction clearly should have changed it:\r\n\r\n```\r\nSI = SI_init   (Expected \"SI = DI_init\")\r\n```\r\n\r\nThis \"issue\" appears with the register DX in [this miasm example](https://github.com/cea-sec/miasm/blob/master/example/expression/asm_to_ir.py).\r\n\r\nIs there a reason why miasm works like that ? Can I somehow translate the result with ExprCompose and ExprSlice to something like the result I expected with 16 bits expressions ?"},"comment":{"url":"https://api.github.com/repos/cea-sec/miasm/issues/comments/82835083","html_url":"https://github.com/cea-sec/miasm/issues/115#issuecomment-82835083","issue_url":"https://api.github.com/repos/cea-sec/miasm/issues/115","id":82835083,"user":{"login":"commial","id":4194483,"avatar_url":"https://avatars.githubusercontent.com/u/4194483?v=3","gravatar_id":"","url":"https://api.github.com/users/commial","html_url":"https://github.com/commial","followers_url":"https://api.github.com/users/commial/followers","following_url":"https://api.github.com/users/commial/following{/other_user}","gists_url":"https://api.github.com/users/commial/gists{/gist_id}","starred_url":"https://api.github.com/users/commial/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/commial/subscriptions","organizations_url":"https://api.github.com/users/commial/orgs","repos_url":"https://api.github.com/users/commial/repos","events_url":"https://api.github.com/users/commial/events{/privacy}","received_events_url":"https://api.github.com/users/commial/received_events","type":"User","site_admin":false},"created_at":"2015-03-18T09:12:30Z","updated_at":"2015-03-18T09:12:30Z","body":"You could use the `replace_regs*` dictionnaries which are defined in `miasm2/arch/XX/arch.py`, and which translated `DI` to `EDI[0:16]`.\r\n\r\nSo, regarding your PoC, you can apply this patch:\r\n```Python\r\n--- temp.py\t2015-03-18 10:07:30.501092867 +0100\r\n+++ poc.py\t2015-03-18 10:04:33.905086578 +0100\r\n@@ -18,6 +18,16 @@\r\n from miasm2.expression.expression import *\r\n from miasm2.expression.simplifications import expr_simp\r\n \r\n+from miasm2.arch.x86.arch import replace_regs32\r\n+def get_value(output_symbols, element):\r\n+    # Get the equivalent form, here in 32 bits\r\n+    real_reg = replace_regs32.get(element, element)\r\n+\r\n+    # Get the concolic value\r\n+    value = output_symbols.eval_expr(real_reg)\r\n+\r\n+    # Simplify it\r\n+    return expr_simp(value)\r\n \r\n def main():\r\n     offset_name = \"gadget\"\r\n@@ -47,10 +57,10 @@\r\n     block = ir.get_bloc(0)\r\n     cur_addr = output_symbols.emulbloc(block)\r\n \r\n-    print \"DI = \" + str(output_symbols.symbols[ExprId('DI', 16)])\r\n-    print \"EDI = \" + str(output_symbols.symbols[ExprId('EDI', 32)])\r\n-    print \"SI = \" + str(output_symbols.symbols[ExprId('SI', 16)])\r\n-    print \"ESI = \" + str(output_symbols.symbols[ExprId('ESI', 32)])\r\n+    print \"DI = \" + str(get_value(output_symbols, ExprId('DI', 16)))\r\n+    print \"EDI = \" + str(get_value(output_symbols, ExprId('EDI', 32)))\r\n+    print \"SI = \" + str(get_value(output_symbols, ExprId('SI', 16)))\r\n+    print \"ESI = \" + str(get_value(output_symbols, ExprId('ESI', 32)))\r\n \r\n if __name__ == '__main__':\r\n     main()\r\n```\r\n\r\nResult:\r\n```Python\r\nDI = EDI_init[0:16]\r\nEDI = EDI_init\r\nSI = EDI_init[0:16]\r\nESI = {EDI_init[0:16],0,16, ESI_init[16:32],16,32}\r\n```\r\n\r\nHope it will help you!"}}