Patchestry

https://lifting-bits.github.io/patchestry/
Admin
Patchestry is an MLIR-based binary lifting and patching framework that decompiles machine code to...
Tokens:20,120
Snippets:194
Trust Score:9.7
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Start Ghidra GUI

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Starts the Ghidra GUI. Run this after ensuring Patchestry is available via PATH.

```shell
~/ghidra/ghidraRun
```

--------------------------------

### Install Xcode command line tools on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Install Xcode command line tools on macOS, a prerequisite for the build.

```bash
xcode-select --install

```

--------------------------------

### Run example firmware end-to-end flow

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Validates the documented example firmware patching flow and produces a report. Writes per-case artifacts plus builds/example-firmware-e2e/summary.md and summary.tsv. Intended for focused inspection and reporting.

```shell
scripts/test-example-firmwares.sh --build-type Debug
```

--------------------------------

### Install Ghidra locally

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Downloads and installs Ghidra 11.1.1 locally for script debugging. Extracts the archive and moves it to ~/ghidra. Prefer working in the headless container for normal builds.

```shell
wget -c https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.1_build/ghidra_11.1.1_PUBLIC_20240614.zip -O ghidra.zip
unzip ghidra.zip
mv ghidra_11.1.1_PUBLIC ~/ghidra
```

--------------------------------

### Start Patchestry and Ghidra GUI

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra?q=

Commands to ensure Patchestry is available via PATH and to start the Ghidra GUI. These are prerequisites for running the Patchestry scripts in the GUI.

```shell
patchestry
```

```shell
~/ghidra/ghidraRun
```

--------------------------------

### Install Java JDK for local Ghidra

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Downloads and installs Java JDK (x64) for local Ghidra use. Redirects the tar output, moves it to ~/jdk, and appends the PATH export to ~/.bashrc. Only needed for Ghidra script debugging, not for most builds.

```shell
wget -c https://download.oracle.com/java/22/latest/jdk-22_linux-x64_bin.tar.gz -O jdk.tar.gz
tar xvf jdk.tar.gz
mv jdk-22.0.1 ~/jdk
echo "export PATH=\$PATH:~/jdk/bin" >> ~/.bashrc
```

--------------------------------

### Install macOS dependencies with Homebrew

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Install required dependencies via Homebrew on macOS, including Docker tooling, CMake, LIT, and musl-cross for cross-compiling tests.

```bash
# basics
brew install colima docker docker-buildx docker-credential-helper cmake lit
# to run tests, we need to cross-compile for x86-64/Linux and aarch64/Linux
brew install FiloSottile/musl-cross/musl-cross

```

--------------------------------

### Apple Silicon: Fresh checkout to validated build

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

The complete validated build process for Apple Silicon macOS: configures with the default preset, builds the debug patchestry target, builds the standalone intrinsics library in Release mode, builds the headless Ghidra Docker image, and runs the whole lit test tree. Requires the patched ClangIR LLVM install prefix.

```shell
git submodule update --init --recursive

export LLVM_INSTALL_PREFIX=<path_to_llvm_install>
export CC="${LLVM_INSTALL_PREFIX}/bin/clang"
export CXX="${LLVM_INSTALL_PREFIX}/bin/clang++"
export CMAKE_PREFIX_PATH="${LLVM_INSTALL_PREFIX}/lib/cmake/llvm;${LLVM_INSTALL_PREFIX}/lib/cmake/mlir;${LLVM_INSTALL_PREFIX}/lib/cmake/clang"

cmake --fresh --preset default \
  -DLLVM_EXTERNAL_LIT=$(which lit)

cmake --build --preset debug -j

cmake -S lib/patchestry/intrinsics -B lib/patchestry/intrinsics/build_standalone \
  -DCMAKE_BUILD_TYPE=Release
cmake --build lib/patchestry/intrinsics/build_standalone -j

bash ./scripts/ghidra/build-headless-docker.sh

lit ./builds/default/test -D BUILD_TYPE=Debug -v
```

--------------------------------

### Check Patchestry availability

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Ensures Patchestry is available via PATH before starting the Ghidra GUI.

```shell
patchestry
```

--------------------------------

### Configure Docker BuildX with Colima on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure Docker BuildX to work with Colima on macOS, using the vz backend for Apple Silicon. The linux/amd64 emulation path is slower and not the routine workflow.

```bash
mkdir -p ~/.docker/cli-plugins
ln -s $(which docker-buildx) ~/.docker/cli-plugins/docker-buildx
colima start --vm-type vz
docker buildx version
docker ps

```

--------------------------------

### Initialize vendored sources with git submodule update

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Initialize and update all submodules from a fresh checkout before the first-time build, as required by the documentation.

```bash
git submodule update --init --recursive

```

--------------------------------

### List all functions with headless decompilation script

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Lists all functions in the binary using the --list-functions flag. The output is saved as JSON to the specified output file.

```shell
sh ./decompile-headless.sh --input <binary> --list-functions --output <output-file>
```

--------------------------------

### pc.instruction

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Instruction operation.

```APIDOC
## pc.instruction

### Description
Represents an instruction.

### Syntax
```
operation ::= `pc.instruction` attr-dict `:` $semantics
```

### Attributes
- **inst_mnemonic** (StringAttr) - string attribute
```

--------------------------------

### pc.const

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Constant operation.

```APIDOC
## pc.const

### Description
Creates a constant value.

### Syntax
```
operation ::= `pc.const` attr-dict `:` type($result)
```

### Attributes
- **value** (TypedAttr) - TypedAttr instance

### Results
- **result** (any type)

### Traits
- ConstantLike

### Interfaces
- InferTypeOpInterface
```

--------------------------------

### Decompilation Pipeline

Source: https://lifting-bits.github.io/patchestry?q=

Shows Patchestry decompilation stages: binary to Ghidra to P-Code JSON, then to Clang AST, C output, and lowering through CIR to MLIR, instrumentation, LLVM IR, and machine code.

```text
Binary --> Ghidra --> P-Code (JSON) --> Clang AST --> C Output
                                           |
                                      CIR (MLIR) --> Instrumentation --> LLVM IR --> Machine Code
```

--------------------------------

### pc.return

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode RETURN operation.

```APIDOC
## `pc.return`

### Description
Pcode RETURN operation. Returns a varnode value.

### Syntax
```
operation ::= `pc.return` $varnode attr-dict `:` type(operands)
```

### Operands
- `varnode` (signless integer) - Required - Value to return.
```

--------------------------------

### pc.store

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode STORE operation.

```APIDOC
## `pc.store`

### Description
Pcode STORE operation. Stores data to memory at the given address space and address.

### Syntax
```
operation ::= `pc.store` $addr_space `,` $addr `,` $data attr-dict `:` type(operands)
```

### Operands
- `addr_space` (signless integer) - Required - Address space identifier.
- `addr` (signless integer) - Required - Address to store to.
- `data` (signless integer) - Required - Data to store.
```

--------------------------------

### pc.return Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.return operation, which returns a varnode.

```text
operation ::= `pc.return` $varnode attr-dict `:` type(operands)
```

--------------------------------

### pc.load

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode LOAD operation.

```APIDOC
## `pc.load`

### Description
Pcode LOAD operation. Loads a value from memory at the given address space and address.

### Syntax
```
operation ::= `pc.load` $addr_space `,` $addr attr-dict `:` functional-type(operands, results)
```

### Operands
- `addr_space` (signless integer) - Required - Address space identifier.
- `addr` (signless integer) - Required - Address to load from.

### Results
- `result` (signless integer) - Loaded value.
```

--------------------------------

### pc.int_and

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer bitwise AND operation.

```APIDOC
## pc.int_and

### Description
Performs integer bitwise AND.

### Syntax
```
operation ::= `pc.int_and` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.load Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.load operation, which loads from memory.

```text
operation ::= `pc.load` $addr_space `,` $addr attr-dict `:` functional-type(operands, results)
```

--------------------------------

### Configure and build Patchestry with patched ClangIR on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure and build Patchestry on macOS host-native using the patched ClangIR toolchain. CC and CXX must point to that toolchain, not AppleClang or stock Homebrew LLVM. Uses Colima as the Docker backend for Docker-backed workflows.

```bash
export LLVM_INSTALL_PREFIX=<path_to_llvm_install>
export CC="${LLVM_INSTALL_PREFIX}/bin/clang"
export CXX="${LLVM_INSTALL_PREFIX}/bin/clang++"
export CMAKE_PREFIX_PATH="${LLVM_INSTALL_PREFIX}/lib/cmake/llvm;${LLVM_INSTALL_PREFIX}/lib/cmake/mlir;${LLVM_INSTALL_PREFIX}/lib/cmake/clang"

cmake \
   --fresh --preset default \
   -DLLVM_EXTERNAL_LIT=$(which lit)

cmake --build --preset debug -j

```

--------------------------------

### Configuration File YAML

Source: https://lifting-bits.github.io/patchestry?q=

Top-level configuration that specifies the target binary, architecture, libraries, and dispatch entries for patches and contracts.

```yaml
apiVersion: patchestry.io/v1
metadata:
  name: "usb-security-deployment"
target:
  binary: "firmware.bin"
  arch: "ARM:LE:32"

libraries:
  - "patches/usb_security_patches.yaml"
  - "contracts/usb_security_contracts.yaml"

patches:
  - name: "usb_security_precheck"
    # ... match + action ...

contracts:
  - name: "usb_security_static"
    # ... match + action ...

```

--------------------------------

### pc.store Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.store operation, which stores data to memory.

```text
operation ::= `pc.store` $addr_space `,` $addr `,` $data attr-dict `:` type(operands)
```

--------------------------------

### pc.var

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for variable references.

```APIDOC
## `pc.var`

### Description
Represents a variable reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.var` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### pc.func

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Function operation.

```APIDOC
## pc.func

### Description
Represents a function.

### Syntax
```
operation ::= `pc.func` $sym_name attr-dict `:` $blocks
```

### Attributes
- **sym_name** (StringAttr) - string attribute

### Traits
- IsolatedFromAbove
- NoTerminator
- SymbolTable

### Interfaces
- Symbol
```

--------------------------------

### Log into Docker Hub

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Log into Docker Hub. This may not be needed on macOS and is not needed on Linux.

```bash
docker login -u <username>

```

--------------------------------

### Run headless decompilation script

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra?q=

Commands to run the headless decompilation script. The first extracts pcode for a specific function using the --function flag; the second lists all functions using the --list-functions flag. Both save output as JSON to the specified output file.

```shell
sh ./decompile-headless.sh --input <binary> --function <function-name> --output <output-file>
```

```shell
sh ./decompile-headless.sh --input <binary> --list-functions --output <output-file>
```

--------------------------------

### pc.int_add

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer addition operation.

```APIDOC
## pc.int_add

### Description
Performs integer addition.

### Syntax
```
operation ::= `pc.int_add` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_add operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_add operation, which performs integer addition. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_add` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### Run cached patch/contract matrix

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Validates the broader patch/contract matrix from cached generated fixtures. Reuses firmware artifacts in firmwares/output/ and fixture caches in builds/test-fixtures/ when present. Use --rebuild-firmware, --rebuild-ghidra, --rebuild-fixtures, or --clean to refresh caches explicitly. Writes builds/patch-matrix/summary.md and summary.tsv.

```shell
scripts/test-patch-matrix.sh --build-type Debug
```

--------------------------------

### pc.mem

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for memory references.

```APIDOC
## `pc.mem`

### Description
Represents a memory reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.mem` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### Configure ClangIR build with CMake for Patchestry

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure a build of the patched ClangIR toolchain (branch patchir-llvmorg-22.1.4) with CMake. The targets list intentionally includes host, AArch64, ARM, and X86. This must use the trail-of-forks/llvm-project fork; stock Homebrew LLVM is not supported.

```cmake
cmake -G Ninja ../../llvm \
    -DCMAKE_INSTALL_PREFIX="/path/to/installdir" \
    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
    -DLLVM_ENABLE_PROJECTS="clang;mlir;clang-tools-extra" \
    -DLLVM_ENABLE_ASSERTIONS=ON \
    -DCLANG_ENABLE_CIR=ON \
    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
    -DLLVM_ENABLE_RTTI=ON \
    -DLLVM_INSTALL_UTILS=ON \
    -DLLVM_TARGETS_TO_BUILD="host;AArch64;ARM;X86"

```

--------------------------------

### pc.copy

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Copy operation on a signless integer.

```APIDOC
## pc.copy

### Description
Copies a signless integer value.

### Syntax
```
operation ::= `pc.copy` $op attr-dict `:` functional-type(operands, results)
```

### Operands
- **op** (signless integer)

### Results
- **result** (signless integer)

### Traits
- SameOperandsAndResultType

### Interfaces
- InferTypeOpInterface
```

--------------------------------

### Contract library YAML for CVE-2021-22156

Source: https://lifting-bits.github.io/patchestry?q=

Contract library defining a static precondition for calloc bounds, with min/max as string-encoded integers.

```yaml
# contracts/cve_2021_22156_library.yaml
contracts:
  - name: calloc_bounds_contract
    severity: high
    preconditions:
      - id: "num_elements_bounded"
        description: "calloc count must not overflow a 32-bit size_t"
        pred:
          kind: range
          target: arg0
          # min/max are string-encoded integer literals parsed with
          # std::stoll — C macros and expressions like
          # "SIZE_MAX/sizeof(long)" are not supported. Compute the
          # bound in the spec author's environment and inline the
          # integer.
          range:
            min: "0"
            max: "1073741823"   # (2^32 - 1) / 4, i.e. SIZE_MAX/sizeof(long)
                                # on a 32-bit target with 4-byte long

```

--------------------------------

### pc.cbranch

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode CBRANCH operation.

```APIDOC
## pc.cbranch

### Description
Pcode CBRANCH operation.

### Syntax
```
operation ::= `pc.cbranch` $addr `,` $cond attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
- **cond** (signless integer)
```

--------------------------------

### pc.int_sborrow

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer signed borrow operation.

```APIDOC
## pc.int_sborrow

### Description
Performs signed borrow operation.

### Syntax
```
operation ::= `pc.int_sborrow` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_and operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_and operation, which performs integer bitwise AND. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_and` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.int_sless

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for signed less-than comparison.

```APIDOC
## `pc.int_sless`

### Description
Performs a signed less-than comparison on two signless integer operands and produces a signless integer result.

### Syntax
```
operation ::= `pc.int_sless` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- `lhs` (signless integer) - Required - First operand.
- `rhs` (signless integer) - Required - Second operand.

### Results
- `result` (signless integer) - Result of the comparison.
```

--------------------------------

### pc.int_equal operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_equal operation, which compares two integers for equality. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_equal` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### Decompilation pipeline diagram

Source: https://lifting-bits.github.io/patchestry

Pipeline diagram showing the stages from binary to C output and the alternative path through CIR/MLIR for instrumentation and recompilation.

```text
Binary --> Ghidra --> P-Code (JSON) --> Clang AST --> C Output
                                           |
                                      CIR (MLIR) --> Instrumentation --> LLVM IR --> Machine Code

```

--------------------------------

### Run headless decompilation for a specific function

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Runs the headless decompilation script to extract pcode for a specific function. Use the --function flag to specify the function name; otherwise, all functions are decompiled by default.

```shell
sh ./decompile-headless.sh --input <binary> --function <function-name> --output <output-file>
```

--------------------------------

### Contract dispatch deployment YAML

Source: https://lifting-bits.github.io/patchestry?q=

Deployment spec that dispatches the contract at the calloc match site.

```yaml
# deployment.yaml (contract dispatch)
libraries:
  - "contracts/cve_2021_22156_library.yaml"

contracts:
  - name: "cve_2021_22156_contract_at_calloc"
    id: "CVE-2021-22156-CONTRACT"
    match:
      name: "calloc"
      context: ["process_command"]
    action:
      mode: "apply_before"
      contract: "calloc_bounds_contract"

```

--------------------------------

### pc.mem Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.mem operation, which defines a memory access.

```text
operation ::= `pc.mem` attr-dict `:` type($result)
```

--------------------------------

### pc.block operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.block operation, which represents a basic block in the pcode dialect. It takes a symbol name and a list of instructions, and has the NoTerminator trait.

```ebnf
operation ::= `pc.block` $sym_name attr-dict `:` $instructions

```

--------------------------------

### pc.instruction operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.instruction operation, which represents an instruction. It has an inst_mnemonic attribute.

```ebnf
operation ::= `pc.instruction` attr-dict `:` $semantics

```

--------------------------------

### pc.var Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.var operation, which defines a variable.

```text
operation ::= `pc.var` attr-dict `:` type($result)
```

--------------------------------

### pc.int_equal

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer equality comparison operation.

```APIDOC
## pc.int_equal

### Description
Checks if two integers are equal.

### Syntax
```
operation ::= `pc.int_equal` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_sborrow operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_sborrow operation, which computes the signed borrow of two integers. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_sborrow` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.popcount Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.popcount operation, which counts the number of set bits.

```text
operation ::= `pc.popcount` $op attr-dict `:` functional-type(operands, results)
```

--------------------------------

### pc.branch

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode BRANCH operation.

```APIDOC
## pc.branch

### Description
Pcode BRANCH operation.

### Syntax
```
operation ::= `pc.branch` $addr attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
```

--------------------------------

### pc.reg

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for register references.

```APIDOC
## `pc.reg`

### Description
Represents a register reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.reg` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### pc.branch operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.branch operation, which represents a pcode BRANCH operation. It takes an address operand.

```ebnf
operation ::= `pc.branch` $addr attr-dict `:` type(operands)

```

--------------------------------

### pc.call

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode CALL operation.

```APIDOC
## pc.call

### Description
Pcode CALL operation.

### Syntax
```
operation ::= `pc.call` $addr attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
```

--------------------------------

### Patch Specification YAML

Source: https://lifting-bits.github.io/patchestry?q=

Defines a patch library file with metadata and a patch entry that references a C source file and specifies parameters.

```yaml
apiVersion: patchestry.io/v1
metadata:
  name: usb-security-patches
  version: "1.0.0"

patches:
  - name: usb_endpoint_write_validation
    id: "USB-PATCH-001"
    description: "Validate USB endpoint write operations"
    category: usb_security
    severity: high
    code_file: "patches/patch_usbd_ep_write_packet.c"
    function_name: "patch::before::usbd_ep_write_packet"
    parameters:
      - name: usb_device
        type: "usb_device_t*"
      - name: buffer
        type: "const void*"

```

--------------------------------

### Patch Dispatch YAML

Source: https://lifting-bits.github.io/patchestry?q=

Shows a patch entry with a match block for locating the target function and an action block for applying the patch before the matched operation.

```yaml
patches:
  - name: "usb_security_precheck"
    id: "USB-PATCH-001"
    description: "Pre-validation security check"
    match:
      name: "usbd_ep_write_packet"
      kind: "function"
      context: ["bl_usb__send_message"]
    action:
      mode: "apply_before"
      patch: "usb_security_precheck"
      optimization: ["inline-patches"]
      arguments:
        - name: "operand_0"
          source: "operand"
          index: 0

```

--------------------------------

### Deployment YAML for CVE-2021-22156 patch

Source: https://lifting-bits.github.io/patchestry?q=

Deployment spec that dispatches the patch before every calloc in process_command.

```yaml
# deployment.yaml — apply before every calloc in process_command
libraries:
  - "patches/cve_2021_22156_library.yaml"

patches:
  - name: "cve_2021_22156_precheck"
    id: "CVE-2021-22156-ACTION"
    match:
      name: "calloc"
      kind: "function"
      context: ["process_command"]
    action:
      mode: "apply_before"
      patch: "calloc_overflow_check"
      arguments:
        - name: "num_elements"
          source: "operand"
          index: 0

```

--------------------------------

### pc.int_sub Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.int_sub operation, which subtracts two signless integers.

```text
operation ::= `pc.int_sub` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```
Tokens:
Raw