Function *buildUpdateKeyFunc(Module *m){  std::vector<Type*> params;  params.push_back(Type::getInt8Ty(m->getContext()));         params.push_back(Type::getInt32Ty(m->getContext()));  params.push_back(Type::getInt32Ty(m->getContext())->getPointerTo());  params.push_back(Type::getInt32Ty(m->getContext())->getPointerTo());  params.push_back(Type::getInt32Ty(m->getContext()));  FunctionType *funcType=FunctionType::get(Type::getVoidTy(m->getContext()),params,false);  Function *func=Function::Create(funcType,GlobalValue::PrivateLinkage,Twine("ollvm"),m);  BasicBlock *entry=BasicBlock::Create(m->getContext(),"entry",func);  BasicBlock *cond=BasicBlock::Create(m->getContext(),"cond",func);  BasicBlock *update=BasicBlock::Create(m->getContext(),"update",func);  BasicBlock *end=BasicBlock::Create(m->getContext(),"end",func);  Function::arg_iterator iter=func->arg_begin();  Value *flag=iter;  Value *len=++iter;  Value *posArray=++iter;  Value *keyArray=++iter;  Value *num=++iter;  IRBuilder<> irb(entry);  Value *i=irb.CreateAlloca(irb.getInt32Ty());  irb.CreateStore(irb.getInt32(0),i);  irb.CreateCondBr(irb.CreateICmpEQ(flag,irb.getInt8(0)),cond,end);   irb.SetInsertPoint(cond);  irb.CreateCondBr(irb.CreateICmpSLT(irb.CreateLoad(i),len),update,end);   irb.SetInsertPoint(update);   Value *pos=irb.CreateLoad(irb.CreateGEP(posArray,irb.CreateLoad(i)));  Value *key=irb.CreateGEP(keyArray,pos);  irb.CreateStore(irb.CreateXor(irb.CreateLoad(key),num),key);  irb.CreateStore(irb.CreateAdd(irb.CreateLoad(i),irb.getInt32(1)),i);  irb.CreateBr(cond);   irb.SetInsertPoint(end);  irb.CreateRetVoid();  return func;}

IRBuilder<> irb(&*oldEntry->getFirstInsertionPt());                                // generate context info key for each blockValue *visitedArray=irb.CreateAlloca(irb.getInt8Ty(),irb.getInt32(origBB.size()));Value *keyArray=irb.CreateAlloca(irb.getInt32Ty(),irb.getInt32(origBB.size()));irb.CreateMemSet(visitedArray,irb.getInt8(0),origBB.size(),(MaybeAlign)0);irb.CreateMemSet(keyArray,irb.getInt8(0),origBB.size()*4,(MaybeAlign)0);int idx=0;std::vector<unsigned int> key_list;DominatorTree tree(*f);std::map<BasicBlock*,unsigned int> key_map;std::map<BasicBlock*,unsigned int> index_map;for(std::vector<BasicBlock *>::iterator b=origBB.begin();b!=origBB.end();b++){  BasicBlock *block=*b;  unsigned int num=getUniqueNumber(&key_list);  key_list.push_back(num);  key_map[block]=0;}for(std::vector<BasicBlock *>::iterator b=origBB.begin();b!=origBB.end();b++,idx++){  BasicBlock *block=*b;  std::vector<Constant*> doms;  int i=0;  for(std::vector<BasicBlock *>::iterator bb=origBB.begin();bb!=origBB.end();bb++,i++)  {      BasicBlock *block0=*bb;      if(block0!=block && tree.dominates(block,block0))      {          doms.push_back(irb.getInt32(i));          key_map[block0]^=key_list[idx];      }   }  irb.SetInsertPoint(block->getTerminator());  Value *ptr=irb.CreateGEP(irb.getInt8Ty(),visitedArray,irb.getInt32(idx));  Value *visited=irb.CreateLoad(ptr);  if(doms.size()!=0)  {      ArrayType *arrayType=ArrayType::get(irb.getInt32Ty(),doms.size());      Constant *doms_array=ConstantArray::get(arrayType,ArrayRef<Constant*>(doms));      GlobalVariable *dom_variable=new GlobalVariable(*(f->getParent()),arrayType,false,GlobalValue::LinkageTypes::PrivateLinkage,doms_array,"doms");      irb.CreateCall(FunctionCallee(updateFunc),{visited,irb.getInt32(doms.size()),irb.CreateGEP(dom_variable,{irb.getInt32(0),irb.getInt32(0)}),keyArray,irb.getInt32(key_list[idx])});  }   irb.CreateStore(irb.getInt8(1),ptr);  index_map[block]=idx;}

irb.SetInsertPoint(block);irb.CreateStore(irb.CreateXor(irb.CreateLoad(irb.CreateGEP(keyArray,irb.getInt32(index_map[succ]))),ConstantInt::get(sw->getCondition()->getType(),fixNum)),switchVar);BranchInst::Create(loopEnd,block);

# 往期推荐

1.CVE-2022-21882提权漏洞学习笔记

2.wibu证书 - 初探

3.win10 1909逆向之APIC中断和实验

4.EMET下EAF机制分析以及模拟实现

5.sql注入学习分享

6.V8 Array.prototype.concat函数出现过的issues和他们的POC们