diff options
| -rw-r--r-- | miasm2/jitter/codegen.py | 16 | ||||
| -rw-r--r-- | miasm2/jitter/llvmconvert.py | 46 | ||||
| -rw-r--r-- | test/jitter/jit_options.py | 31 |
3 files changed, 59 insertions, 34 deletions
diff --git a/miasm2/jitter/codegen.py b/miasm2/jitter/codegen.py index fff707e5..2503e104 100644 --- a/miasm2/jitter/codegen.py +++ b/miasm2/jitter/codegen.py @@ -324,10 +324,20 @@ class CGen(object): return out def gen_goto_code(self, attrib, instr_offsets, dst): + if isinstance(dst, asm_label) and dst.offset is None: + # Generate goto for local labels + return ['goto %s;' % dst.name] + offset = None + if isinstance(dst, asm_label) and dst.offset is not None: + offset = dst.offset + elif isinstance(dst, (int, long)): + offset = dst out = [] - if isinstance(dst, asm_label): - out.append('goto %s;' % dst.name) - elif dst in instr_offsets: + if (offset is not None and + offset > attrib.instr.offset and + offset in instr_offsets): + # Only generate goto for next instructions. + # (consecutive instructions) lbl = self.ir_arch.symbol_pool.getby_offset_create(dst) out += self.gen_post_code(attrib) out += self.gen_post_instr_checks(attrib, dst) diff --git a/miasm2/jitter/llvmconvert.py b/miasm2/jitter/llvmconvert.py index 32d4764c..bc04689c 100644 --- a/miasm2/jitter/llvmconvert.py +++ b/miasm2/jitter/llvmconvert.py @@ -1050,15 +1050,18 @@ class LLVMFunction(): evaluated = self.add_ir(to_eval) return case2dst, evaluated - def gen_jump2dst(self, attrib, dst): + def gen_jump2dst(self, attrib, instr_offsets, dst): """Generate the code for a jump to @dst with final check for error Several cases have to be considered: - jump to an offset out of the current ASM BBL (JMP 0x11223344) - jump to an offset inside the current ASM BBL (Go to next instruction) + - jump to an offset back in the current ASM BBL (For max_exec jit + option on self loops) - jump to a generated IR label, which must be jitted in this same - function (REP MOVSB) - - jump to a computed offset (CALL @32[0x11223344]) + function (REP MOVSB) + - jump to a computed offset (CALL @32[0x11223344]) + """ PC = self.llvm_context.PC # We are no longer in the main stream, deactivate cache @@ -1070,18 +1073,27 @@ class LLVMFunction(): if m2_asmbloc.expr_is_label(dst): bbl = self.get_basic_bloc_by_label(dst) + offset = dst.name.offset if bbl is not None: # "local" jump, inside this function - if dst.name.offset is not None: + if offset is None: # Avoid checks on generated label + self.builder.branch(bbl) + return + + if (offset in instr_offsets and + offset > attrib.instr.offset): + # forward local jump (ie. next instruction) self.gen_post_code(attrib) - self.gen_post_instr_checks(attrib, dst.name.offset) - self.builder.branch(bbl) - return - else: - # "extern" jump on a defined offset, return to the caller - offset = dst.name.offset - dst = self.add_ir(m2_expr.ExprInt(offset, PC.size)) + self.gen_post_instr_checks(attrib, offset) + self.builder.branch(bbl) + return + + # reaching this point means a backward local jump, promote it to + # extern + + # "extern" jump on a defined offset, return to the caller + dst = self.add_ir(m2_expr.ExprInt(offset, PC.size)) # "extern" jump with a computed value, return to the caller assert isinstance(dst, (llvm_ir.Instruction, llvm_ir.Value)) @@ -1097,12 +1109,13 @@ class LLVMFunction(): self.set_ret(dst) - def gen_irblock(self, attrib, instr, irblock): + def gen_irblock(self, attrib, instr, instr_offsets, irblock): """ Generate the code for an @irblock @instr: the current instruction to translate @irblock: an irbloc instance @attrib: an Attributs instance + @instr_offsets: offset of all asmblock's instructions """ case2dst = None @@ -1158,7 +1171,7 @@ class LLVMFunction(): assert case2dst is not None if len(case2dst) == 1: # Avoid switch in this common case - self.gen_jump2dst(attrib, case2dst.values()[0]) + self.gen_jump2dst(attrib, instr_offsets, case2dst.values()[0]) else: current_bbl = self.builder.basic_block @@ -1170,7 +1183,7 @@ class LLVMFunction(): bbl = self.append_basic_block(name) case2bbl[case] = bbl self.builder.position_at_start(bbl) - self.gen_jump2dst(attrib, dst) + self.gen_jump2dst(attrib, instr_offsets, dst) # Jump on the correct output self.builder.position_at_end(current_bbl) @@ -1279,6 +1292,7 @@ class LLVMFunction(): # TODO: merge duplicate code with CGen codegen = self.llvm_context.cgen_class(self.llvm_context.ir_arch) irblocks_list = codegen.block2assignblks(asmblock) + instr_offsets = [line.offset for line in asmblock.lines] # Prepare for delayslot if self.llvm_context.has_delayslot: @@ -1288,11 +1302,13 @@ class LLVMFunction(): default_value=eltype(0)) self.local_vars_pointers[element.name] = ptr lbl = codegen.get_block_post_label(asmblock) + instr_offsets.append(lbl.offset) self.append_basic_block(lbl) # Add content builder.position_at_end(entry_bbl) + for instr, irblocks in zip(asmblock.lines, irblocks_list): attrib = codegen.get_attributes(instr, irblocks, self.log_mn, self.log_regs) @@ -1312,7 +1328,7 @@ class LLVMFunction(): if index == 0: self.gen_pre_code(attrib) - self.gen_irblock(attrib, instr, irblock) + self.gen_irblock(attrib, instr, instr_offsets, irblock) # Gen finalize (see codegen::CGen) is unrecheable, except with delayslot self.gen_finalize(asmblock, codegen) diff --git a/test/jitter/jit_options.py b/test/jitter/jit_options.py index cc955c64..4fe936d5 100644 --- a/test/jitter/jit_options.py +++ b/test/jitter/jit_options.py @@ -5,18 +5,18 @@ from miasm2.analysis.machine import Machine from pdb import pm # Shellcode - # main: -# MOV EAX, 0x1 +# MOV EAX, 0x10 +# MOV EBX, 0x1 # loop_main: -# CMP EAX, 0x10 -# JZ loop_end -# loop_inc: -# INC EAX -# JMP loop_main +# SUB EAX, 0x1 +# CMOVZ ECX, EBX +# JNZ loop_main # loop_end: # RET -data = "b80100000083f810740340ebf8c3".decode("hex") + + +data = "b810000000bb0100000083e8010f44cb75f8c3".decode("hex") run_addr = 0x40000000 def code_sentinelle(jitter): @@ -47,10 +47,10 @@ myjit.init_run(run_addr) myjit.continue_run() assert myjit.run is False -assert myjit.cpu.EAX == 0x10 +assert myjit.cpu.EAX == 0x0 ## Let's specify a max_exec_per_call -## 5: main, loop_main, loop_inc, loop_main, loop_inc +## 5: main/loop_main, loop_main myjit.jit.options["max_exec_per_call"] = 5 first_call = True @@ -71,8 +71,8 @@ myjit.exec_cb = cb myjit.continue_run() assert myjit.run is True -# Use a '<=' because it's a 'max_...' -assert myjit.cpu.EAX <= 3 +# Use a '>=' because it's a 'max_...' +assert myjit.cpu.EAX >= 0xA # Test 'jit_maxline' print "[+] Run instr one by one" @@ -91,7 +91,6 @@ myjit.exec_cb = cb myjit.continue_run() assert myjit.run is False -assert myjit.cpu.EAX == 0x10 -## dry(1) + main(1) + (loop_main(2) + loop_inc(2))*(0x10 - 1) + loop_main(2) + -## loop_end(1) = 65 -assert counter == 65 +assert myjit.cpu.EAX == 0x00 +## main(2) + (loop_main(3))*(0x10) + loop_end(1) + 0x1337beef (1) +assert counter == 52 |