CIL: Support strings.

Author: MathiasVP

binary/ql/lib/semmle/code/binary/ast/internal/CilInstructions.qll

@@ -275,9 +275,7 @@ abstract class CilCall extends CilInstruction {
 
   final predicate hasReturnValue() { il_call_has_return_value(this) }
 
-  string getExternalName() {
-    il_call_target_unresolved(this, result)
-  }
+  string getExternalName() { il_call_target_unresolved(this, result) }
 }
 
 class CilIl_jmp extends @il_il_jmp, CilCall { }
@@ -487,7 +485,9 @@ class CilCpobj extends @il_cpobj, CilInstruction { }
 
 class CilLdobj extends @il_ldobj, CilInstruction { }
 
-class CilLdstr extends @il_ldstr, CilInstruction { }
+class CilLdstr extends @il_ldstr, CilInstruction {
+  string getValue() { il_operand_string(this, result) }
+}
 
 class CilNewobj extends @il_newobj, CilInstruction { }
 

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/Instruction.qll

@@ -100,7 +100,13 @@ class ConstInstruction extends Instruction {
 
   int getValue() { result = te.getConstantValue(tag) }
 
-  override string getImmediateValue() { result = this.getValue().toString() }
+  string getStringValue() { result = te.getStringConstant(tag) }
+
+  override string getImmediateValue() {
+    result = this.getValue().toString()
+    or
+    result = this.getStringValue()
+  }
 }
 
 class CJumpInstruction extends Instruction {

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/TempVariableTag.qll

@@ -30,7 +30,8 @@ newtype TTempVariableTag =
   CilBoolBranchRefVarTag() or
   CilUnconditionalBranchRefVarTag() or
   CallReturnValueTag() or
-  CilCallTargetVarTag()
+  CilCallTargetVarTag() or
+  CilLoadStringVarTag()
 
 class TempVariableTag extends TTempVariableTag {
   string toString() {
@@ -129,5 +130,8 @@ class TempVariableTag extends TTempVariableTag {
     or
     this = CilCallTargetVarTag() and
     result = "call_target"
+    or
+    this = CilLoadStringVarTag() and
+    result = "ldstr"
   }
 }

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/TranslatedElement.qll

@@ -90,7 +90,8 @@ newtype TTranslatedElement =
     shouldTranslateCilInstr(cbr)
   } or
   TTranslatedCilRet(Raw::CilIl_ret ret) { shouldTranslateCilInstr(ret) } or
-  TTranslatedCilCall(Raw::CilCall call) { shouldTranslateCilInstr(call) }
+  TTranslatedCilCall(Raw::CilCall call) { shouldTranslateCilInstr(call) } or
+  TTranslatedCilLoadString(Raw::CilLdstr ldstr) { shouldTranslateCilInstr(ldstr) }
 
 TranslatedElement getTranslatedElement(Raw::Element raw) {
   result.getRawElement() = raw and
@@ -126,6 +127,8 @@ abstract class TranslatedElement extends TTranslatedElement {
 
   int getConstantValue(InstructionTag tag) { none() }
 
+  string getStringConstant(InstructionTag tag) { none() }
+
   string getExternalName(InstructionTag tag) { none() }
 
   Instruction getReferencedInstruction(InstructionTag tag) { none() }

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/TranslatedInstruction.qll

@@ -2283,3 +2283,48 @@ class TranslatedCilCall extends TranslatedCilInstruction, TTranslatedCilCall {
             .getStackElement(i + instr.getNumberOfArguments())
   }
 }
+
+class TranslatedCilLoadString extends TranslatedCilInstruction, TTranslatedCilLoadString {
+  override Raw::CilLdstr instr;
+
+  TranslatedCilLoadString() { this = TTranslatedCilLoadString(instr) }
+
+  final override predicate hasInstruction(
+    Opcode opcode, InstructionTag tag, Option<Variable>::Option v
+  ) {
+    opcode instanceof Opcode::Const and
+    tag = SingleTag() and
+    v.asSome() = this.getVariable(CilLoadStringVarTag())
+  }
+
+  override predicate hasTempVariable(TempVariableTag tag) { tag = CilLoadStringVarTag() }
+
+  override predicate producesResult() { any() }
+
+  override Variable getVariableOperand(InstructionTag tag, OperandTag operandTag) { none() }
+
+  override string getStringConstant(InstructionTag tag) {
+    tag = SingleTag() and
+    result = instr.getValue()
+  }
+
+  override Instruction getChildSuccessor(TranslatedElement child, SuccessorType succType) { none() }
+
+  override Instruction getSuccessor(InstructionTag tag, SuccessorType succType) {
+    tag = SingleTag() and
+    succType instanceof DirectSuccessor and
+    result = getTranslatedInstruction(instr.getASuccessor()).getEntry()
+  }
+
+  override Instruction getEntry() { result = this.getInstruction(SingleTag()) }
+
+  override Variable getResultVariable() { result = this.getVariable(CilLoadStringVarTag()) }
+
+  final override Variable getStackElement(int i) {
+    i = 0 and
+    result = this.getInstruction(SingleTag()).getResultVariable()
+    or
+    i > 0 and
+    result = getTranslatedCilInstruction(instr.getABackwardPredecessor()).getStackElement(i - 1)
+  }
+}

binary/ql/lib/semmle/code/binary/ast/ir/internal/InstructionSig.qll

@@ -236,6 +236,8 @@ signature module InstructionSig {
 
   class ConstInstruction extends Instruction {
     int getValue();
+
+    string getStringValue();
   }
 
   class ControlFlowNode {

binary/ql/lib/semmle/code/binary/ast/ir/internal/TransformInstruction/TransformInstruction.qll

@@ -691,6 +691,13 @@ module Transform<InstructionSig Input> {
         )
       }
 
+      string getStringValue() {
+        exists(Input::ConstInstruction const |
+          this = TOldInstruction(const) and
+          result = const.getStringValue()
+        )
+      }
+
       override string getImmediateValue() { result = this.getValue().toString() }
     }