1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
|
#include <stdint.h>
#include <sys/mman.h>
#include "debug.h"
#include "x64emu.h"
#include "emu/x64run_private.h"
#include "custommem.h"
#define OPCODE_READ (1<<0)
#define OPCODE_WRITE (1<<1)
#define OPCODE_STACK (1<<2)
#define MODREG ((nextop&0xC0)==0xC0)
int decode_avx(uint8_t* addr, int idx, vex_t vex)
{
return 0;
}
int decode_0f(uint8_t* addr, int idx, rex_t rex)
{
uint8_t nextop;
switch(addr[idx++]) {
case 0x00:
return OPCODE_READ;
case 0x01:
return OPCODE_WRITE;
case 0x10:
case 0x12:
case 0x14:
case 0x15:
case 0x16:
case 0x28:
case 0x2A:
case 0x2C:
case 0x2D:
case 0x2E:
case 0x2F:
case 0x50 ... 0x6B:
case 0x6E:
case 0x6F:
case 0x70:
case 0x74:
case 0x75:
case 0x76:
case 0xA3:
case 0xAF:
case 0xB6:
case 0xB7:
case 0xBC:
case 0xBD:
case 0xBE:
case 0xBF:
case 0xC2:
case 0xC4 ... 0xC6:
case 0xD1 ... 0xD5:
case 0xD7 ... 0xE5:
case 0xE8 ... 0xEF:
case 0xF1 ... 0xFE:
nextop = addr[idx++];
return (MODREG)?0:OPCODE_READ;
case 0x11:
case 0x13:
case 0x17:
case 0x29:
case 0x2B:
case 0x7E:
case 0x7F:
case 0x90 ... 0x9F:
case 0xAE:
case 0xC3:
case 0xE7:
nextop = addr[idx++];
return (MODREG)?0:OPCODE_WRITE;
case 0x71:
case 0x72:
case 0x73:
case 0xA4:
case 0xA5:
case 0xAB:
case 0xAC:
case 0xAD:
case 0xB0:
case 0xB1:
case 0xB3:
case 0xBA:
case 0xBB:
case 0xC0:
case 0xC1:
case 0xC7:
return (MODREG)?0:(OPCODE_READ|OPCODE_WRITE);
case 0xA0:
case 0xA8:
return OPCODE_WRITE|OPCODE_STACK;
case 0xA1:
case 0xA9:
return OPCODE_READ|OPCODE_STACK;
case 0x38: //todo
return 0;
case 0x3A: //todo
return 0;
}
return 0;
}
int decode_660f(uint8_t* addr, int idx, rex_t rex)
{
return 0;
}
int decode_f20f(uint8_t* addr, int idx, rex_t rex)
{
return 0;
}
int decode_f30f(uint8_t* addr, int idx, rex_t rex)
{
return 0;
}
int decode_opcode(uintptr_t rip, int is32bits)
{
if(!(getProtection(rip)&PROT_READ))
return 0;
// check if opcode is one that write to memory... pretty crude for now.
uint8_t* addr = (uint8_t*)rip;
int idx = 0;
rex_t rex = {0};
int is66 = 0, is67 = 0, rep = 0;
int lock = 0;
vex_t vex = {0};
uint8_t nextop;
if(is32bits) {
rex.is32bits = 1;
while(addr[idx]==0x66 || addr[idx]==0xF2 || addr[idx]==0xF3 || (addr[idx]==0x2E)|| (addr[idx]==0x3E) || (addr[idx]==0x26)|| (addr[idx]==0x36) || (addr[idx]==0xf0) || (addr[idx]==0x64)|| (addr[idx]==0x65)) {
switch(addr[idx++]) {
case 0x66: is66=1; break;
case 0xF0: lock=1; break;
case 0xF2: rep=1; break;
case 0xF3: rep=2; break;
}
}
} else {
while((addr[idx]>=0x40 && addr[idx]<0x4f) || (addr[idx]==0x66 || addr[idx]==0xF2 || addr[idx]==0xF3 || (addr[idx]==0x3E) || (addr[idx]==0x26) || (addr[idx]==0xf0)) || (addr[idx]==0x64)|| (addr[idx]==0x65)) {
switch(addr[idx++]) {
case 0x66: is66=1; break;
case 0xF0: lock=1; break;
case 0xF2: rep=1; break;
case 0xF3: rep=2; break;
case 0x40 ... 0x4f: rex.rex = addr[idx-1]; break;
}
}
}
if((addr[idx]==0xC4 || addr[idx]==0xC5) && (!is32bits || ((addr[idx+1]&0xc0)!=0xc0))) {
uint8_t tmp8u;
switch(addr[idx++]) {
case 0xC4:
vex.rex = rex;
tmp8u = nextop;
vex.m = tmp8u&0b00011111;
vex.rex.b = (tmp8u&0b00100000)?0:1;
vex.rex.x = (tmp8u&0b01000000)?0:1;
vex.rex.r = (tmp8u&0b10000000)?0:1;
tmp8u = addr[idx++];
vex.p = tmp8u&0b00000011;
vex.l = (tmp8u>>2)&1;
vex.v = ((~tmp8u)>>3)&0b1111;
vex.rex.w = (tmp8u>>7)&1;
break;
case 0xC5:
vex.rex = rex;
tmp8u = nextop;
vex.p = tmp8u&0b00000011;
vex.l = (tmp8u>>2)&1;
vex.v = ((~tmp8u)>>3)&0b1111;
vex.rex.r = (tmp8u&0b10000000)?0:1;
vex.rex.b = 0;
vex.rex.x = 0;
vex.rex.w = 0;
vex.m = VEX_M_0F;
break;
}
return decode_avx(addr, idx, vex);
}
switch(addr[idx++]) {
case 0x00:
case 0x01:
case 0x08:
case 0x09:
case 0x10:
case 0x11:
case 0x18:
case 0x19:
case 0x20:
case 0x21:
case 0x28:
case 0x29:
case 0x30:
case 0x31:
case 0x86:
case 0x87:
case 0x88:
case 0x89:
case 0x8C:
case 0xC0:
case 0xC1:
case 0xC6:
case 0xC7:
case 0xD0:
case 0xD1:
case 0xD2:
case 0xD3:
nextop = addr[idx++];
return (MODREG)?0:(OPCODE_WRITE|OPCODE_READ);
case 0x02:
case 0x03:
case 0x0a:
case 0x0b:
case 0x12:
case 0x13:
case 0x1a:
case 0x1b:
case 0x22:
case 0x23:
case 0x2a:
case 0x2b:
case 0x32:
case 0x33:
case 0x38:
case 0x39:
case 0x3a:
case 0x3b:
case 0x63:
case 0x69:
case 0x6B:
case 0x84:
case 0x85:
case 0x8A:
case 0x8B:
case 0x8E:
nextop = addr[idx++];
return (MODREG)?0:(OPCODE_READ);
case 0x06:
case 0x0E:
case 0x16:
case 0x1E:
case 0x60:
return is32bits?(OPCODE_WRITE|OPCODE_STACK):0;
case 0x07:
case 0x17:
case 0x1F:
case 0x61:
return is32bits?(OPCODE_READ|OPCODE_STACK):0;
case 0x50 ... 0x57:
case 0x68:
case 0x6A:
case 0x9C:
case 0xC8:
case 0xE8:
return OPCODE_WRITE|OPCODE_STACK;
case 0x58 ... 0x5F:
case 0x9D:
case 0xC2:
case 0xC3:
case 0xC9:
case 0xCA:
case 0xCB:
case 0xCF:
return OPCODE_READ|OPCODE_STACK;
case 0x80 ... 0x83:
nextop = addr[idx++];
return (MODREG)?0:(((((nextop>>3)&7)!=7)?OPCODE_WRITE:0)|OPCODE_READ);
case 0x8F:
nextop = addr[idx++];
return ((MODREG)?0:(OPCODE_WRITE))|OPCODE_READ|OPCODE_STACK;
case 0xA0:
case 0xA1:
case 0xA6:
case 0xA7:
case 0xAC:
case 0xAD:
case 0xAE:
case 0xAF:
case 0xD7:
return OPCODE_READ;
case 0xA2:
case 0xA3:
case 0xA4:
case 0xA5:
case 0xAA:
case 0xAB:
return OPCODE_WRITE;
case 0xF6:
case 0xF7:
nextop = addr[idx++];
if(MODREG) return 0;
switch((nextop>>3)&7) {
case 2:
case 3:
return OPCODE_WRITE;
default:
return OPCODE_READ;
}
case 0xFE:
case 0xFF:
nextop = addr[idx++];
if(MODREG) return 0;
switch((nextop>>3)&7) {
case 0:
case 1:
return OPCODE_WRITE;
case 2:
case 3:
case 6:
return OPCODE_READ|OPCODE_WRITE|OPCODE_STACK;
default:
return OPCODE_READ;
}
case 0x0F:
if(is66) return decode_660f(addr, idx, rex);
if(rep==1) return decode_f20f(addr, idx, rex);
if(rep==2) return decode_f30f(addr, idx, rex);
return decode_0f(addr, idx, rex);
case 0xD8 ... 0xDF:
nextop = addr[idx++];
if(nextop<0xC0) {
switch(addr[idx-2]) {
case 0xD8:
case 0xDA:
case 0xDC:
case 0xDE:
return OPCODE_READ;
case 0xD9:
switch((nextop>>3)&7) {
case 0:
case 4:
case 5:
return OPCODE_READ;
case 2:
case 3:
case 6:
case 7:
return OPCODE_WRITE;
}
return 0;
case 0xDB:
switch((nextop>>3)&7) {
case 0:
case 1:
case 2:
case 3:
case 7:
return OPCODE_WRITE;
case 5:
return OPCODE_READ;
}
return 0;
case 0xDF:
switch((nextop>>3)&7) {
case 0:
case 4:
case 5:
return OPCODE_READ;
case 1:
case 2:
case 3:
case 6:
case 7:
return OPCODE_WRITE;
}
}
}
return 0;
}
return 0;
}
int write_opcode(uintptr_t rip, uintptr_t native_ip, int is32bits)
{
// TODO, on ARM64, RiSCV and LoongArch, it would be easier to analyse the opcode at the native IP instead, as opcode that write to memory are more limited in quantity
return (decode_opcode(rip, is32bits)&OPCODE_WRITE)?1:0;
}
|