### Start Ghidra GUI

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Starts the Ghidra GUI. Run this after ensuring Patchestry is available via PATH.

```shell
~/ghidra/ghidraRun
```

--------------------------------

### Install Xcode command line tools on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Install Xcode command line tools on macOS, a prerequisite for the build.

```bash
xcode-select --install

```

--------------------------------

### Run example firmware end-to-end flow

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Validates the documented example firmware patching flow and produces a report. Writes per-case artifacts plus builds/example-firmware-e2e/summary.md and summary.tsv. Intended for focused inspection and reporting.

```shell
scripts/test-example-firmwares.sh --build-type Debug
```

--------------------------------

### Install Ghidra locally

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Downloads and installs Ghidra 11.1.1 locally for script debugging. Extracts the archive and moves it to ~/ghidra. Prefer working in the headless container for normal builds.

```shell
wget -c https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.1_build/ghidra_11.1.1_PUBLIC_20240614.zip -O ghidra.zip
unzip ghidra.zip
mv ghidra_11.1.1_PUBLIC ~/ghidra
```

--------------------------------

### Start Patchestry and Ghidra GUI

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra?q=

Commands to ensure Patchestry is available via PATH and to start the Ghidra GUI. These are prerequisites for running the Patchestry scripts in the GUI.

```shell
patchestry
```

```shell
~/ghidra/ghidraRun
```

--------------------------------

### Install Java JDK for local Ghidra

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Downloads and installs Java JDK (x64) for local Ghidra use. Redirects the tar output, moves it to ~/jdk, and appends the PATH export to ~/.bashrc. Only needed for Ghidra script debugging, not for most builds.

```shell
wget -c https://download.oracle.com/java/22/latest/jdk-22_linux-x64_bin.tar.gz -O jdk.tar.gz
tar xvf jdk.tar.gz
mv jdk-22.0.1 ~/jdk
echo "export PATH=\$PATH:~/jdk/bin" >> ~/.bashrc
```

--------------------------------

### Install macOS dependencies with Homebrew

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Install required dependencies via Homebrew on macOS, including Docker tooling, CMake, LIT, and musl-cross for cross-compiling tests.

```bash
# basics
brew install colima docker docker-buildx docker-credential-helper cmake lit
# to run tests, we need to cross-compile for x86-64/Linux and aarch64/Linux
brew install FiloSottile/musl-cross/musl-cross

```

--------------------------------

### Apple Silicon: Fresh checkout to validated build

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

The complete validated build process for Apple Silicon macOS: configures with the default preset, builds the debug patchestry target, builds the standalone intrinsics library in Release mode, builds the headless Ghidra Docker image, and runs the whole lit test tree. Requires the patched ClangIR LLVM install prefix.

```shell
git submodule update --init --recursive

export LLVM_INSTALL_PREFIX=<path_to_llvm_install>
export CC="${LLVM_INSTALL_PREFIX}/bin/clang"
export CXX="${LLVM_INSTALL_PREFIX}/bin/clang++"
export CMAKE_PREFIX_PATH="${LLVM_INSTALL_PREFIX}/lib/cmake/llvm;${LLVM_INSTALL_PREFIX}/lib/cmake/mlir;${LLVM_INSTALL_PREFIX}/lib/cmake/clang"

cmake --fresh --preset default \
  -DLLVM_EXTERNAL_LIT=$(which lit)

cmake --build --preset debug -j

cmake -S lib/patchestry/intrinsics -B lib/patchestry/intrinsics/build_standalone \
  -DCMAKE_BUILD_TYPE=Release
cmake --build lib/patchestry/intrinsics/build_standalone -j

bash ./scripts/ghidra/build-headless-docker.sh

lit ./builds/default/test -D BUILD_TYPE=Debug -v
```

--------------------------------

### Check Patchestry availability

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Ensures Patchestry is available via PATH before starting the Ghidra GUI.

```shell
patchestry
```

--------------------------------

### Configure Docker BuildX with Colima on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure Docker BuildX to work with Colima on macOS, using the vz backend for Apple Silicon. The linux/amd64 emulation path is slower and not the routine workflow.

```bash
mkdir -p ~/.docker/cli-plugins
ln -s $(which docker-buildx) ~/.docker/cli-plugins/docker-buildx
colima start --vm-type vz
docker buildx version
docker ps

```

--------------------------------

### Initialize vendored sources with git submodule update

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Initialize and update all submodules from a fresh checkout before the first-time build, as required by the documentation.

```bash
git submodule update --init --recursive

```

--------------------------------

### List all functions with headless decompilation script

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Lists all functions in the binary using the --list-functions flag. The output is saved as JSON to the specified output file.

```shell
sh ./decompile-headless.sh --input <binary> --list-functions --output <output-file>
```

--------------------------------

### pc.instruction

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Instruction operation.

```APIDOC
## pc.instruction

### Description
Represents an instruction.

### Syntax
```
operation ::= `pc.instruction` attr-dict `:` $semantics
```

### Attributes
- **inst_mnemonic** (StringAttr) - string attribute
```

--------------------------------

### pc.const

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Constant operation.

```APIDOC
## pc.const

### Description
Creates a constant value.

### Syntax
```
operation ::= `pc.const` attr-dict `:` type($result)
```

### Attributes
- **value** (TypedAttr) - TypedAttr instance

### Results
- **result** (any type)

### Traits
- ConstantLike

### Interfaces
- InferTypeOpInterface
```

--------------------------------

### Decompilation Pipeline

Source: https://lifting-bits.github.io/patchestry?q=

Shows Patchestry decompilation stages: binary to Ghidra to P-Code JSON, then to Clang AST, C output, and lowering through CIR to MLIR, instrumentation, LLVM IR, and machine code.

```text
Binary --> Ghidra --> P-Code (JSON) --> Clang AST --> C Output
                                           |
                                      CIR (MLIR) --> Instrumentation --> LLVM IR --> Machine Code
```

--------------------------------

### pc.return

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode RETURN operation.

```APIDOC
## `pc.return`

### Description
Pcode RETURN operation. Returns a varnode value.

### Syntax
```
operation ::= `pc.return` $varnode attr-dict `:` type(operands)
```

### Operands
- `varnode` (signless integer) - Required - Value to return.
```

--------------------------------

### pc.store

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode STORE operation.

```APIDOC
## `pc.store`

### Description
Pcode STORE operation. Stores data to memory at the given address space and address.

### Syntax
```
operation ::= `pc.store` $addr_space `,` $addr `,` $data attr-dict `:` type(operands)
```

### Operands
- `addr_space` (signless integer) - Required - Address space identifier.
- `addr` (signless integer) - Required - Address to store to.
- `data` (signless integer) - Required - Data to store.
```

--------------------------------

### pc.return Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.return operation, which returns a varnode.

```text
operation ::= `pc.return` $varnode attr-dict `:` type(operands)
```

--------------------------------

### pc.load

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode LOAD operation.

```APIDOC
## `pc.load`

### Description
Pcode LOAD operation. Loads a value from memory at the given address space and address.

### Syntax
```
operation ::= `pc.load` $addr_space `,` $addr attr-dict `:` functional-type(operands, results)
```

### Operands
- `addr_space` (signless integer) - Required - Address space identifier.
- `addr` (signless integer) - Required - Address to load from.

### Results
- `result` (signless integer) - Loaded value.
```

--------------------------------

### pc.int_and

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer bitwise AND operation.

```APIDOC
## pc.int_and

### Description
Performs integer bitwise AND.

### Syntax
```
operation ::= `pc.int_and` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.load Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.load operation, which loads from memory.

```text
operation ::= `pc.load` $addr_space `,` $addr attr-dict `:` functional-type(operands, results)
```

--------------------------------

### Configure and build Patchestry with patched ClangIR on macOS

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure and build Patchestry on macOS host-native using the patched ClangIR toolchain. CC and CXX must point to that toolchain, not AppleClang or stock Homebrew LLVM. Uses Colima as the Docker backend for Docker-backed workflows.

```bash
export LLVM_INSTALL_PREFIX=<path_to_llvm_install>
export CC="${LLVM_INSTALL_PREFIX}/bin/clang"
export CXX="${LLVM_INSTALL_PREFIX}/bin/clang++"
export CMAKE_PREFIX_PATH="${LLVM_INSTALL_PREFIX}/lib/cmake/llvm;${LLVM_INSTALL_PREFIX}/lib/cmake/mlir;${LLVM_INSTALL_PREFIX}/lib/cmake/clang"

cmake \
   --fresh --preset default \
   -DLLVM_EXTERNAL_LIT=$(which lit)

cmake --build --preset debug -j

```

--------------------------------

### Configuration File YAML

Source: https://lifting-bits.github.io/patchestry?q=

Top-level configuration that specifies the target binary, architecture, libraries, and dispatch entries for patches and contracts.

```yaml
apiVersion: patchestry.io/v1
metadata:
  name: "usb-security-deployment"
target:
  binary: "firmware.bin"
  arch: "ARM:LE:32"

libraries:
  - "patches/usb_security_patches.yaml"
  - "contracts/usb_security_contracts.yaml"

patches:
  - name: "usb_security_precheck"
    # ... match + action ...

contracts:
  - name: "usb_security_static"
    # ... match + action ...

```

--------------------------------

### pc.store Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.store operation, which stores data to memory.

```text
operation ::= `pc.store` $addr_space `,` $addr `,` $data attr-dict `:` type(operands)
```

--------------------------------

### pc.var

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for variable references.

```APIDOC
## `pc.var`

### Description
Represents a variable reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.var` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### pc.func

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Function operation.

```APIDOC
## pc.func

### Description
Represents a function.

### Syntax
```
operation ::= `pc.func` $sym_name attr-dict `:` $blocks
```

### Attributes
- **sym_name** (StringAttr) - string attribute

### Traits
- IsolatedFromAbove
- NoTerminator
- SymbolTable

### Interfaces
- Symbol
```

--------------------------------

### Log into Docker Hub

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Log into Docker Hub. This may not be needed on macOS and is not needed on Linux.

```bash
docker login -u <username>

```

--------------------------------

### Run headless decompilation script

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra?q=

Commands to run the headless decompilation script. The first extracts pcode for a specific function using the --function flag; the second lists all functions using the --list-functions flag. Both save output as JSON to the specified output file.

```shell
sh ./decompile-headless.sh --input <binary> --function <function-name> --output <output-file>
```

```shell
sh ./decompile-headless.sh --input <binary> --list-functions --output <output-file>
```

--------------------------------

### pc.int_add

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer addition operation.

```APIDOC
## pc.int_add

### Description
Performs integer addition.

### Syntax
```
operation ::= `pc.int_add` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_add operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_add operation, which performs integer addition. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_add` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### Run cached patch/contract matrix

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Validates the broader patch/contract matrix from cached generated fixtures. Reuses firmware artifacts in firmwares/output/ and fixture caches in builds/test-fixtures/ when present. Use --rebuild-firmware, --rebuild-ghidra, --rebuild-fixtures, or --clean to refresh caches explicitly. Writes builds/patch-matrix/summary.md and summary.tsv.

```shell
scripts/test-patch-matrix.sh --build-type Debug
```

--------------------------------

### pc.mem

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for memory references.

```APIDOC
## `pc.mem`

### Description
Represents a memory reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.mem` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### Configure ClangIR build with CMake for Patchestry

Source: https://lifting-bits.github.io/patchestry/GettingStarted/build

Configure a build of the patched ClangIR toolchain (branch patchir-llvmorg-22.1.4) with CMake. The targets list intentionally includes host, AArch64, ARM, and X86. This must use the trail-of-forks/llvm-project fork; stock Homebrew LLVM is not supported.

```cmake
cmake -G Ninja ../../llvm \
    -DCMAKE_INSTALL_PREFIX="/path/to/installdir" \
    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
    -DLLVM_ENABLE_PROJECTS="clang;mlir;clang-tools-extra" \
    -DLLVM_ENABLE_ASSERTIONS=ON \
    -DCLANG_ENABLE_CIR=ON \
    -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
    -DLLVM_ENABLE_RTTI=ON \
    -DLLVM_INSTALL_UTILS=ON \
    -DLLVM_TARGETS_TO_BUILD="host;AArch64;ARM;X86"

```

--------------------------------

### pc.copy

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Copy operation on a signless integer.

```APIDOC
## pc.copy

### Description
Copies a signless integer value.

### Syntax
```
operation ::= `pc.copy` $op attr-dict `:` functional-type(operands, results)
```

### Operands
- **op** (signless integer)

### Results
- **result** (signless integer)

### Traits
- SameOperandsAndResultType

### Interfaces
- InferTypeOpInterface
```

--------------------------------

### Contract library YAML for CVE-2021-22156

Source: https://lifting-bits.github.io/patchestry?q=

Contract library defining a static precondition for calloc bounds, with min/max as string-encoded integers.

```yaml
# contracts/cve_2021_22156_library.yaml
contracts:
  - name: calloc_bounds_contract
    severity: high
    preconditions:
      - id: "num_elements_bounded"
        description: "calloc count must not overflow a 32-bit size_t"
        pred:
          kind: range
          target: arg0
          # min/max are string-encoded integer literals parsed with
          # std::stoll — C macros and expressions like
          # "SIZE_MAX/sizeof(long)" are not supported. Compute the
          # bound in the spec author's environment and inline the
          # integer.
          range:
            min: "0"
            max: "1073741823"   # (2^32 - 1) / 4, i.e. SIZE_MAX/sizeof(long)
                                # on a 32-bit target with 4-byte long

```

--------------------------------

### pc.cbranch

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode CBRANCH operation.

```APIDOC
## pc.cbranch

### Description
Pcode CBRANCH operation.

### Syntax
```
operation ::= `pc.cbranch` $addr `,` $cond attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
- **cond** (signless integer)
```

--------------------------------

### pc.int_sborrow

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer signed borrow operation.

```APIDOC
## pc.int_sborrow

### Description
Performs signed borrow operation.

### Syntax
```
operation ::= `pc.int_sborrow` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_and operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_and operation, which performs integer bitwise AND. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_and` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.int_sless

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for signed less-than comparison.

```APIDOC
## `pc.int_sless`

### Description
Performs a signed less-than comparison on two signless integer operands and produces a signless integer result.

### Syntax
```
operation ::= `pc.int_sless` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- `lhs` (signless integer) - Required - First operand.
- `rhs` (signless integer) - Required - Second operand.

### Results
- `result` (signless integer) - Result of the comparison.
```

--------------------------------

### pc.int_equal operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_equal operation, which compares two integers for equality. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_equal` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### Decompilation pipeline diagram

Source: https://lifting-bits.github.io/patchestry

Pipeline diagram showing the stages from binary to C output and the alternative path through CIR/MLIR for instrumentation and recompilation.

```text
Binary --> Ghidra --> P-Code (JSON) --> Clang AST --> C Output
                                           |
                                      CIR (MLIR) --> Instrumentation --> LLVM IR --> Machine Code

```

--------------------------------

### Run headless decompilation for a specific function

Source: https://lifting-bits.github.io/patchestry/GettingStarted/ghidra

Runs the headless decompilation script to extract pcode for a specific function. Use the --function flag to specify the function name; otherwise, all functions are decompiled by default.

```shell
sh ./decompile-headless.sh --input <binary> --function <function-name> --output <output-file>
```

--------------------------------

### Contract dispatch deployment YAML

Source: https://lifting-bits.github.io/patchestry?q=

Deployment spec that dispatches the contract at the calloc match site.

```yaml
# deployment.yaml (contract dispatch)
libraries:
  - "contracts/cve_2021_22156_library.yaml"

contracts:
  - name: "cve_2021_22156_contract_at_calloc"
    id: "CVE-2021-22156-CONTRACT"
    match:
      name: "calloc"
      context: ["process_command"]
    action:
      mode: "apply_before"
      contract: "calloc_bounds_contract"

```

--------------------------------

### pc.mem Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.mem operation, which defines a memory access.

```text
operation ::= `pc.mem` attr-dict `:` type($result)
```

--------------------------------

### pc.block operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.block operation, which represents a basic block in the pcode dialect. It takes a symbol name and a list of instructions, and has the NoTerminator trait.

```ebnf
operation ::= `pc.block` $sym_name attr-dict `:` $instructions

```

--------------------------------

### pc.instruction operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.instruction operation, which represents an instruction. It has an inst_mnemonic attribute.

```ebnf
operation ::= `pc.instruction` attr-dict `:` $semantics

```

--------------------------------

### pc.var Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.var operation, which defines a variable.

```text
operation ::= `pc.var` attr-dict `:` type($result)
```

--------------------------------

### pc.int_equal

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer equality comparison operation.

```APIDOC
## pc.int_equal

### Description
Checks if two integers are equal.

### Syntax
```
operation ::= `pc.int_equal` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.int_sborrow operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_sborrow operation, which computes the signed borrow of two integers. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_sborrow` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.popcount Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.popcount operation, which counts the number of set bits.

```text
operation ::= `pc.popcount` $op attr-dict `:` functional-type(operands, results)
```

--------------------------------

### pc.branch

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode BRANCH operation.

```APIDOC
## pc.branch

### Description
Pcode BRANCH operation.

### Syntax
```
operation ::= `pc.branch` $addr attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
```

--------------------------------

### pc.reg

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for register references.

```APIDOC
## `pc.reg`

### Description
Represents a register reference with address space, address, and size attributes.

### Syntax
```
operation ::= `pc.reg` attr-dict `:` type($result)
```

### Attributes
- `addr_space` (::mlir::StringAttr) - Required - String attribute.
- `addr` (::mlir::IntegerAttr) - Required - 64-bit signless integer attribute.
- `size` (::mlir::IntegerAttr) - Required - 8-bit signless integer attribute.

### Results
- `result` (any type) - Result value.
```

--------------------------------

### pc.branch operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.branch operation, which represents a pcode BRANCH operation. It takes an address operand.

```ebnf
operation ::= `pc.branch` $addr attr-dict `:` type(operands)

```

--------------------------------

### pc.call

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Pcode CALL operation.

```APIDOC
## pc.call

### Description
Pcode CALL operation.

### Syntax
```
operation ::= `pc.call` $addr attr-dict `:` type(operands)
```

### Operands
- **addr** (signless integer)
```

--------------------------------

### Patch Specification YAML

Source: https://lifting-bits.github.io/patchestry?q=

Defines a patch library file with metadata and a patch entry that references a C source file and specifies parameters.

```yaml
apiVersion: patchestry.io/v1
metadata:
  name: usb-security-patches
  version: "1.0.0"

patches:
  - name: usb_endpoint_write_validation
    id: "USB-PATCH-001"
    description: "Validate USB endpoint write operations"
    category: usb_security
    severity: high
    code_file: "patches/patch_usbd_ep_write_packet.c"
    function_name: "patch::before::usbd_ep_write_packet"
    parameters:
      - name: usb_device
        type: "usb_device_t*"
      - name: buffer
        type: "const void*"

```

--------------------------------

### Patch Dispatch YAML

Source: https://lifting-bits.github.io/patchestry?q=

Shows a patch entry with a match block for locating the target function and an action block for applying the patch before the matched operation.

```yaml
patches:
  - name: "usb_security_precheck"
    id: "USB-PATCH-001"
    description: "Pre-validation security check"
    match:
      name: "usbd_ep_write_packet"
      kind: "function"
      context: ["bl_usb__send_message"]
    action:
      mode: "apply_before"
      patch: "usb_security_precheck"
      optimization: ["inline-patches"]
      arguments:
        - name: "operand_0"
          source: "operand"
          index: 0

```

--------------------------------

### Deployment YAML for CVE-2021-22156 patch

Source: https://lifting-bits.github.io/patchestry?q=

Deployment spec that dispatches the patch before every calloc in process_command.

```yaml
# deployment.yaml — apply before every calloc in process_command
libraries:
  - "patches/cve_2021_22156_library.yaml"

patches:
  - name: "cve_2021_22156_precheck"
    id: "CVE-2021-22156-ACTION"
    match:
      name: "calloc"
      kind: "function"
      context: ["process_command"]
    action:
      mode: "apply_before"
      patch: "calloc_overflow_check"
      arguments:
        - name: "num_elements"
          source: "operand"
          index: 0

```

--------------------------------

### pc.int_sub Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.int_sub operation, which subtracts two signless integers.

```text
operation ::= `pc.int_sub` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

--------------------------------

### pc.reg Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.reg operation, which accesses a register.

```text
operation ::= `pc.reg` attr-dict `:` type($result)
```

--------------------------------

### pc.copy operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.copy operation, which copies a value. It has the SameOperandsAndResultType trait and InferTypeOpInterface.

```ebnf
operation ::= `pc.copy` $op attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.func operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.func operation, which represents a function. It has the IsolatedFromAbove, NoTerminator, and SymbolTable traits, and implements the Symbol interface.

```ebnf
operation ::= `pc.func` $sym_name attr-dict `:` $blocks

```

--------------------------------

### pc.int_less operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.int_less operation, which compares two integers for less-than. It takes two signless integer operands and returns a signless integer.

```ebnf
operation ::= `pc.int_less` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)

```

--------------------------------

### pc.call operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.call operation, which represents a pcode CALL operation. It takes an address operand.

```ebnf
operation ::= `pc.call` $addr attr-dict `:` type(operands)

```

--------------------------------

### pc.cbranch operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.cbranch operation, which represents a pcode CBRANCH operation. It takes an address and a condition operand.

```ebnf
operation ::= `pc.cbranch` $addr `,` $cond attr-dict `:` type(operands)

```

--------------------------------

### pc.block

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Represents a basic block in the pc dialect.

```APIDOC
## pc.block

### Description
Represents a basic block in the pc dialect.

### Syntax
```
operation ::= `pc.block` $sym_name attr-dict `:` $instructions
```

### Attributes
- **sym_name** (StringAttr) - string attribute

### Traits
- NoTerminator
```

--------------------------------

### pc.popcount

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for population count.

```APIDOC
## `pc.popcount`

### Description
Counts the number of set bits in the input operand and produces a signless integer result.

### Syntax
```
operation ::= `pc.popcount` $op attr-dict `:` functional-type(operands, results)
```

### Operands
- `op` (signless integer) - Required - Input operand.

### Results
- `result` (signless integer) - Popcount result.
```

--------------------------------

### pc.int_sless Syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Syntax for the pc.int_sless operation, which compares two signless integers.

```text
operation ::= `pc.int_sless` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

--------------------------------

### pc.bool_negate

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Boolean negation operation on a signless integer.

```APIDOC
## pc.bool_negate

### Description
Performs boolean negation on a signless integer value.

### Syntax
```
operation ::= `pc.bool_negate` $op attr-dict `:` functional-type(operands, results)
```

### Operands
- **op** (signless integer)

### Results
- **result** (signless integer)

### Traits
- SameOperandsAndResultType

### Interfaces
- InferTypeOpInterface
```

--------------------------------

### Define a static contract with a nonnull precondition

Source: https://lifting-bits.github.io/patchestry?q=

Declares a static-only contract that attaches a nonnull precondition to the matched op as an MLIR attribute. It emits no runtime code and is consumed by downstream verifiers such as KLEE or SeaHorn.

```yaml
contracts:
  - name: "nonnull_pointer"
    severity: critical
    preconditions:
      - id: "pre-001"
        description: "Pointer argument must not be null"
        pred:
          kind: nonnull
          target: arg0

```

--------------------------------

### pc.int_less

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Integer less-than comparison operation.

```APIDOC
## pc.int_less

### Description
Checks if lhs is less than rhs.

### Syntax
```
operation ::= `pc.int_less` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- **lhs** (signless integer)
- **rhs** (signless integer)

### Results
- **result** (signless integer)
```

--------------------------------

### pc.const operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.const operation, which represents a constant value. It has the ConstantLike trait and InferTypeOpInterface.

```ebnf
operation ::= `pc.const` attr-dict `:` type($result)

```

--------------------------------

### pc.int_sub

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode

Pcode operation for integer subtraction.

```APIDOC
## `pc.int_sub`

### Description
Performs integer subtraction on two signless integer operands and produces a signless integer result.

### Syntax
```
operation ::= `pc.int_sub` $lhs `,` $rhs attr-dict `:` functional-type(operands, results)
```

### Operands
- `lhs` (signless integer) - Required - First operand.
- `rhs` (signless integer) - Required - Second operand.

### Results
- `result` (signless integer) - Result of the subtraction.
```

--------------------------------

### Patched calloc() code for CVE-2021-22156

Source: https://lifting-bits.github.io/patchestry?q=

Desired result after applying the patch, adding an integer overflow check before the calloc() call.

```c
size_t num_elements = get_num_elements();

/* Patch start */
if (num_elements > SIZE_MAX/sizeof(long)) {
    /* Handle error condition */
}
/* Patch end */

long *buffer = (long *)calloc(num_elements, sizeof(long));
if (buffer == NULL) {
    /* Handle error condition */
    return;
}

```

--------------------------------

### pc.bool_negate operation syntax

Source: https://lifting-bits.github.io/patchestry/Dialects/Pcode?q=

Defines the syntax for the pc.bool_negate operation, which negates a boolean value. It has the SameOperandsAndResultType trait and InferTypeOpInterface.

```ebnf
operation ::= `pc.bool_negate` $op attr-dict `:` functional-type(operands, results)

```

--------------------------------

### Patch library YAML for CVE-2021-22156

Source: https://lifting-bits.github.io/patchestry?q=

YAML patch library defining the C patch function for the calloc overflow check.

```yaml
# patches/cve_2021_22156_library.yaml
patches:
  - name: calloc_overflow_check
    id: "CVE-2021-22156"
    description: "Integer overflow check before calloc"
    severity: high
    code_file: "patches/cve_2021_22156_patch.c"
    function_name: "patch_calloc_overflow"
    parameters:
      - name: num_elements
        type: "size_t"

```

--------------------------------

### Vulnerable calloc() code for CVE-2021-22156

Source: https://lifting-bits.github.io/patchestry?q=

Vulnerable code for CVE-2021-22156 where calloc() may allocate a zeroed buffer of insufficient size due to integer overflow.

```c
size_t num_elements = get_num_elements();
long *buffer = (long *)calloc(num_elements, sizeof(long));
if (buffer == NULL) {
    /* Handle error condition */
}

```

--------------------------------

### C patch function patch_calloc_overflow

Source: https://lifting-bits.github.io/patchestry?q=

C function implementing the patch for the integer overflow check, stored in patches/cve_2021_22156_patch.c.

```c
// patches/cve_2021_22156_patch.c
void patch_calloc_overflow(size_t num_elements) {
    if (num_elements > SIZE_MAX/sizeof(long)) {
        /* Handle error condition */
    }
}

```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.