Binary: Load instructions's operand now have a LoadOperand type.

Author: MathiasVP

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/Instruction.qll

@@ -144,7 +144,7 @@ class CopyInstruction extends Instruction {
 class LoadInstruction extends Instruction {
   override Opcode::Load opcode;
 
-  UnaryOperand getOperand() { result = this.getAnOperand() }
+  LoadAddressOperand getOperand() { result = this.getAnOperand() }
 }
 
 class StoreInstruction extends Instruction {

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/Operand.qll

@@ -57,6 +57,10 @@ class UnaryOperand extends Operand {
   override UnaryTag operandTag;
 }
 
+class LoadAddressOperand extends Operand {
+  override LoadAddressTag operandTag;
+}
+
 class ConditionOperand extends Operand {
   override CondTag operandTag;
 }

binary/ql/lib/semmle/code/binary/ast/ir/internal/Instruction0/TranslatedOperand.qll

@@ -440,7 +440,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd2Tag()).getResultVariable()
   }
 
@@ -469,7 +469,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd1Tag()).getResultVariable()
   }
 
@@ -498,7 +498,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd2Tag()).getResultVariable()
   }
 
@@ -517,7 +517,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd1Tag()).getResultVariable()
   }
 
@@ -536,15 +536,15 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd1Tag()).getResultVariable()
   }
 
   // Compute base
   Variable case6(InstructionTag tag, OperandTag operandTag) {
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getX86RegisterVariable(op.getBaseRegister().getTarget())
     // If we are in case6 and we do not need to load the result will be the base register
   }
@@ -574,7 +574,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd1Tag()).getResultVariable()
   }
 
@@ -593,7 +593,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandMulTag()).getResultVariable()
   }
 
@@ -612,15 +612,15 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
     // Load from [x]
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandAdd1Tag()).getResultVariable()
   }
 
   // Compute index
   Variable case10(InstructionTag tag, OperandTag operandTag) {
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getX86RegisterVariable(op.getIndexRegister().getTarget())
     // If we are in case10 and we do not need to load the result will be the index register
   }
@@ -629,7 +629,7 @@ class TranslatedX86MemoryOperand extends TranslatedX86Operand, TTranslatedX86Mem
   Variable case11(InstructionTag tag, OperandTag operandTag) {
     this.isLoaded() and
     tag = MemoryOperandLoadTag() and
-    operandTag = UnaryTag() and
+    operandTag = LoadAddressTag() and
     result = this.getInstruction(MemoryOperandConstDisplacementTag()).getResultVariable()
     // If we are in case11 and we do not need to load the result will be the displacement constant
   }

binary/ql/lib/semmle/code/binary/ast/ir/internal/InstructionSig.qll

@@ -36,6 +36,8 @@ signature module InstructionSig {
 
   class UnaryOperand extends Operand;
 
+  class LoadAddressOperand extends Operand;
+
   class ConditionOperand extends Operand;
 
   class ConditionJumpTargetOperand extends Operand;
@@ -183,7 +185,7 @@ signature module InstructionSig {
   }
 
   class LoadInstruction extends Instruction {
-    UnaryOperand getOperand();
+    LoadAddressOperand getOperand();
   }
 
   class StoreInstruction extends Instruction {

binary/ql/lib/semmle/code/binary/ast/ir/internal/Tags.qll

@@ -28,6 +28,7 @@ newtype TOperandTag =
   RightTag() or
   UnaryTag() or
   StoreValueTag() or
+  LoadAddressTag() or
   StoreAddressTag() or
   CallTargetTag() or
   CondTag() or
@@ -45,6 +46,9 @@ class OperandTag extends TOperandTag {
     this = UnaryTag() and
     result = 0
     or
+    this = LoadAddressTag() and
+    result = 0
+    or
     this = StoreValueTag() and
     result = 1
     or
@@ -87,6 +91,9 @@ class OperandTag extends TOperandTag {
     this = UnaryTag() and
     result = "Unary"
     or
+    this = LoadAddressTag() and
+    result = "LoadAddr"
+    or
     this = StoreValueTag() and
     result = "StoreValue"
     or

binary/ql/lib/semmle/code/binary/ast/ir/internal/TransformInstruction/TransformInstruction.qll

@@ -596,7 +596,7 @@ module Transform<InstructionSig Input> {
     class LoadInstruction extends Instruction {
       LoadInstruction() { this.getOpcode() instanceof Opcode::Load }
 
-      UnaryOperand getOperand() { result = this.getAnOperand() }
+      LoadAddressOperand getOperand() { result = this.getAnOperand() }
     }
 
     class StoreInstruction extends Instruction {
@@ -843,6 +843,10 @@ module Transform<InstructionSig Input> {
       StoreAddressOperand() { this.getOperandTag() instanceof StoreAddressTag }
     }
 
+    class LoadAddressOperand extends Operand {
+      LoadAddressOperand() { this.getOperandTag() instanceof LoadAddressTag }
+    }
+
     class UnaryOperand extends Operand {
       UnaryOperand() { this.getOperandTag() instanceof UnaryTag }
     }