\n\t * Here we handle indirect taint for indirect writes\n\t */\n\t@Override\n\tpublic TaintVec modBeforeStore(PcodeOp op, AddressSpace space, TaintVec inOffset,\n\t\t\tTaintVec inValue) {\n\t\treturn inValue.tagIndirectWrite(inOffset).withOp(op);\n\t}\n\n\t@Override\n\tpublic TaintVec modBeforeStore(int sizeinOffset, AddressSpace space, TaintVec inOffset,\n\t\t\tint sizeinValue, TaintVec inValue) {\n\t\tthrow new RuntimeException(\"Not supported\");\n\t}\n\n\t/**\n\t * {@inheritDoc}\n\t * \n\t *
\n\t * Here we handle indirect taint for indirect reads\n\t */\n\t@Override\n\tpublic TaintVec modAfterLoad(PcodeOp op, AddressSpace space, TaintVec inOffset,\n\t\t\tTaintVec inValue) {\n\t\treturn inValue.tagIndirectRead(inOffset).withOp(op);\n\t}\n\n\t@Override\n\tpublic TaintVec modAfterLoad(int sizeinOffset, AddressSpace space, TaintVec inOffset,\n\t\t\tint sizeinValue, TaintVec inValue) {\n\t\tthrow new RuntimeException(\"Not supported\");","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/TaintAnalysis/src/main/java/ghidra/pcode/emu/taint/TaintPcodeArithmetic.java#L172-L208","documentation":"TaintPcodeArithmetic is an auxiliary taint-tracking arithmetic layered on top of concrete bytes. The PcodeArithmetic interface has two forms of modBeforeStore: a PcodeOp-based default method and a size-based abstract one. TaintPcodeArithmetic implements only the PcodeOp form (which is what the framework calls) and throws RuntimeException on the size-based form because taint tracking needs the full op context - offset sizes alone aren't enough to tag an indirect write. The source comment notes an AssertionError would also be fitting.","triggerScenarios":"Directly calling taintArithmetic.modBeforeStore(int sizeinOffset, AddressSpace, TaintVec inOffset, int sizeinValue, TaintVec inValue). The default framework path routes through the PcodeOp overload, so this is normally unreachable unless user code or a non-standard executor invokes the size-based API.","commonSituations":"User pcode-emulation scripts calling the size-based API directly; an executor wiring TaintPcodeArithmetic as a standalone arithmetic that bypasses the op overload; a newer framework version that calls the size-based method.","solutions":["Call the PcodeOp-based modBeforeStore overload instead, which is fully implemented for taint.","Ensure the executor uses the op-based path (the default), so the size-based method is never hit.","If you must support the size form, subclass and override it with a real taint implementation."],"exampleFix":"// before\narithmetic.modBeforeStore(offSize, space, inOffset, valSize, inValue); // throws\n// after\narithmetic.modBeforeStore(pcodeOp, space, inOffset, inValue);","handlingStrategy":"validation","validationCode":"// Prefer the op-based overload; only call it when you have a PcodeOp:\nif (op != None) {\n arithmetic.modBeforeStore(op, space, inOffset, inValue);\n} else {\n throw new IllegalStateException(\"taint modBeforeStore requires a PcodeOp\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always call the PcodeOp-based modBeforeStore for taint.","Run taint via the standard executor so the size-based method is never reached."],"tags":["pcode","emulation","taint","api"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}