diff options
128 files changed, 43356 insertions, 0 deletions
diff --git a/example/asm_arm.py b/example/asm_arm.py new file mode 100644 index 00000000..a848f22b --- /dev/null +++ b/example/asm_arm.py @@ -0,0 +1,79 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.arm.arch import mn_arm, base_expr, variable +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from miasm2.core import asmbloc +from elfesteem.strpatchwork import StrPatchwork + +my_mn = mn_arm + +reg_and_id = dict(mn_arm.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(my_mn, "arm", ''' +main: + STMFD SP!, {R4, R5, LR} + MOV R0, mystr & 0xffff + ORR R0, R0, mystr & 0xffff0000 + MOV R1, mystrend & 0xffff + ORR R1, R1, mystrend & 0xffff0000 +xxx: + LDR R2, [PC, key-(xxx+8)] +loop: + LDRB R3, [R0] + EOR R3, R3, R2 + STRB R3, [R0], 1 + CMP R0, R1 + BNE loop + EOR R0, R0, R0 + BNE end + EOR R1, R1, R1 + EOR R2, R2, R2 + EORGE R1, R1, R1 + EORGE R2, R2, R2 + ADDLTS R2, R2, R2 + SUBEQ R2, R2, R2 +end: + LDMFD SP!, {R4, R5, PC} +key: +.long 0x11223344 +mystr: +.string "test string" +mystrend: +.long 0 +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) + +for b in blocs[0]: + print b +# graph sc#### +g = asmbloc.bloc2graph(blocs[0]) +open("graph.txt", "w").write(g) + +s = StrPatchwork() + +print "symbols" +print symbol_pool +# dont erase from start to shell code padading +resolved_b, patches = asmbloc.asm_resolve_final( + my_mn, 'arm', blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + s[offset] = raw + +open('demo_arm.bin', 'wb').write(str(s)) diff --git a/example/asm_arm_sc.py b/example/asm_arm_sc.py new file mode 100644 index 00000000..824145fa --- /dev/null +++ b/example/asm_arm_sc.py @@ -0,0 +1,57 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.arm.arch import mn_arm, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem.strpatchwork import StrPatchwork + +from pdb import pm +from miasm2.core import asmbloc +import struct + +reg_and_id = dict(mn_arm.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + + +st = StrPatchwork() + +blocs, symbol_pool = parse_asm.parse_txt(mn_arm, 'arm', ''' +main: + MOV R1, R0 + MOV R2, 0x100 +loop: + ADD R2, R1, R2 + ADD R1, R1, 1 + CMP R1, 0x10 + BEQ loop + + ADD R0, R1, R2 + BX LR +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), 0) + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_arm, "arm", blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + st[offset] = raw + +open('arm_sc.bin', 'wb').write(str(st)) diff --git a/example/asm_box_x86_32.py b/example/asm_box_x86_32.py new file mode 100644 index 00000000..2fa63c78 --- /dev/null +++ b/example/asm_box_x86_32.py @@ -0,0 +1,66 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE() +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + RET + +title: +.string "Hello!" +msg: +.string "World!" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"), + e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 32, blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + e.virt[offset] = raw + +open('box_x86_32.bin', 'wb').write(str(e)) diff --git a/example/asm_box_x86_32_enc.py b/example/asm_box_x86_32_enc.py new file mode 100644 index 00000000..7f1ef7ec --- /dev/null +++ b/example/asm_box_x86_32_enc.py @@ -0,0 +1,105 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE() +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + CALL cipher_code + CALL msgbox_encrypted_start + CALL cipher_code + RET + +cipher_code: + PUSH EBP + MOV EBP, ESP + + LEA ESI, DWORD PTR [msgbox_encrypted_start] + LEA EDI, DWORD PTR [msgbox_encrypted_stop] + +loop: + XOR BYTE PTR [ESI], 0x42 + INC ESI + CMP ESI, EDI + JBE loop + + MOV ESP, EBP + POP EBP + RET + +msgbox_encrypted_start: + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + RET +.dontsplit +msgbox_encrypted_stop: +.long 0 + +title: +.string "Hello!" +msg: +.string "World!" +''') + + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create( + "MessageBoxA"), e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +print "symbols" +print symbol_pool + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 32, blocs[0], symbol_pool) +print patches + +ad_start = symbol_pool.getby_name_create("msgbox_encrypted_start").offset +ad_stop = symbol_pool.getby_name_create("msgbox_encrypted_stop").offset + +# cipher code +new_patches = dict(patches) +for ad, val in patches.items(): + if ad_start <= ad < ad_stop: + new_patches[ad] = "".join([chr(ord(x) ^ 0x42) for x in val]) + +for offset, raw in new_patches.items(): + e.virt[offset] = raw + +open('box_x86_32_enc.bin', 'wb').write(str(e)) diff --git a/example/asm_box_x86_32_mod.py b/example/asm_box_x86_32_mod.py new file mode 100644 index 00000000..f9f53f58 --- /dev/null +++ b/example/asm_box_x86_32_mod.py @@ -0,0 +1,89 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE() +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + CALL test_automod + CALL test_automod + RET + +test_automod: + PUSH EBP + MOV EBP, ESP + +loop: + MOV EAX, 0 + CMP EAX, 0 + JMP mod_addr +mod_addr: + JNZ end + + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + + ; automodif code + MOV BYTE PTR [mod_addr], 0xEB + JMP loop +end: + MOV BYTE PTR [mod_addr], 0x75 + MOV ESP, EBP + POP EBP + RET + +title: +.string "Hello!" +msg: +.string "World!" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"), + e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 32, blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + e.virt[offset] = raw + +open('box_x86_32_mod.bin', 'wb').write(str(e)) diff --git a/example/asm_box_x86_32_mod_self.py b/example/asm_box_x86_32_mod_self.py new file mode 100644 index 00000000..95898722 --- /dev/null +++ b/example/asm_box_x86_32_mod_self.py @@ -0,0 +1,74 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE() +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + PUSH EBP + MOV EBP, ESP + MOV BYTE PTR [myint], 0x90 +myint: + INT 0x3 + + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + MOV ESP, EBP + POP EBP + RET + +title: +.string "Hello!" +msg: +.string "World!" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"), + e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 32, blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + e.virt[offset] = raw + +open('box_x86_32_mod_self.bin', 'wb').write(str(e)) diff --git a/example/asm_box_x86_32_repmod.py b/example/asm_box_x86_32_repmod.py new file mode 100644 index 00000000..f351fcfa --- /dev/null +++ b/example/asm_box_x86_32_repmod.py @@ -0,0 +1,103 @@ +#! /usr/bin/env python + +# test instruction caching + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE() +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + CALL test_automod + RET + +lbl_good: + NOP + NOP + NOP + NOP + NOP + NOP + NOP + NOP + NOP + +test_automod: + PUSH EBP + MOV EBP, ESP + + LEA EDI, DWORD PTR [lbl_mod] + LEA ESI, DWORD PTR [lbl_good] + + MOV ECX, 0x8 + REPE MOVSB +lbl_mod: + XOR EAX, EAX + MOV DWORD PTR [EAX], 0xDEADC0DE + + NOP + NOP + NOP + + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + + MOV ESP, EBP + POP EBP + RET + +title: +.string "Hello!" +msg: +.string "World!" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"), + e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 32, blocs[0], symbol_pool) +print patches + +for offset, raw in patches.items(): + e.virt[offset] = raw + +open('box_x86_32_repmod.bin', 'wb').write(str(e)) diff --git a/example/asm_box_x86_64.py b/example/asm_box_x86_64.py new file mode 100644 index 00000000..3ae4bcb5 --- /dev/null +++ b/example/asm_box_x86_64.py @@ -0,0 +1,68 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core.bin_stream import bin_stream +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from elfesteem import * +from pdb import pm +from miasm2.core import asmbloc +import struct + +e = pe_init.PE(wsize=64) +s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000) +s_iat = e.SHList.add_section(name="iat", rawsize=0x100) +new_dll = [({"name": "USER32.dll", + "firstthunk": s_iat.addr}, ["MessageBoxA"])] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt64(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=64)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 64, ''' +main: + MOV R9, 0x0 + MOV R8, title + MOV RDX, msg + MOV RCX, 0x0 + MOV RAX, QWORD PTR [ MessageBoxA ] + CALL RAX + RET + +title: +.string "Hello!" +msg: +.string "World!" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr)) +symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"), + e.DirImport.get_funcvirt('MessageBoxA')) +e.Opthdr.AddressOfEntryPoint = s_text.addr + +for b in blocs[0]: + print b + +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, 64, blocs[0], symbol_pool, + max_offset=0xFFFFFFFFFFFFFFFF) +print patches + +for offset, raw in patches.items(): + e.virt[offset] = raw + +open('box_x86_64.bin', 'wb').write(str(e)) diff --git a/example/asm_x86.py b/example/asm_x86.py new file mode 100644 index 00000000..3637f9ed --- /dev/null +++ b/example/asm_x86.py @@ -0,0 +1,47 @@ +#! /usr/bin/env python + +from miasm2.core.cpu import parse_ast +from miasm2.arch.x86.arch import mn_x86, base_expr, variable +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from miasm2.core import asmbloc +from elfesteem.strpatchwork import StrPatchwork + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + PUSH EBP + MOV EBP, ESP + SUB ESP, 0x100 + MOV EAX, 0x1337 + LEA ESI, DWORD PTR [mystr] + MOV ESP, EBP + POP EBP + RET +mystr: +.string "test string" +''') + +# fix shellcode addr +symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) +s = StrPatchwork() +resolved_b, patches = asmbloc.asm_resolve_final( + mn_x86, '32', blocs[0], symbol_pool) +for offset, raw in patches.items(): + s[offset] = raw + +print patches + +open('demo_x86_32.bin', 'wb').write(str(s)) diff --git a/example/box.exe b/example/box.exe new file mode 100755 index 00000000..1c11bcda --- /dev/null +++ b/example/box.exe Binary files differdiff --git a/example/box_upx.exe b/example/box_upx.exe new file mode 100755 index 00000000..d0776ec2 --- /dev/null +++ b/example/box_upx.exe Binary files differdiff --git a/example/disasm_01.py b/example/disasm_01.py new file mode 100644 index 00000000..bc6a2fd6 --- /dev/null +++ b/example/disasm_01.py @@ -0,0 +1,12 @@ +from miasm2.arch.x86.arch import mn_x86 +from miasm2.arch.x86.regs import * + +l = mn_x86.fromstring('MOV EAX, EBX', 32) +print "instruction:", l +print "arg:", l.args[0] +x = mn_x86.asm(l) +print x +l.args[0] = EDX +y = mn_x86.asm(l) +print y +print mn_x86.dis(y[0], 32) diff --git a/example/disasm_02.py b/example/disasm_02.py new file mode 100644 index 00000000..5bfd77de --- /dev/null +++ b/example/disasm_02.py @@ -0,0 +1,13 @@ +from miasm2.arch.x86.disasm import dis_x86_32 +from miasm2.core.asmbloc import bloc2graph + + +s = '\xb8\xef\xbe7\x13\xb9\x04\x00\x00\x00\xc1\xc0\x08\xe2\xfb\xc3' +mdis = dis_x86_32(s) +blocs = mdis.dis_multibloc(0) + +for b in blocs: + print b + +g = bloc2graph(blocs) +open('graph.txt', 'w').write(g) diff --git a/example/disasm_03.py b/example/disasm_03.py new file mode 100644 index 00000000..08b209a1 --- /dev/null +++ b/example/disasm_03.py @@ -0,0 +1,23 @@ +import sys +from elfesteem import pe_init +from miasm2.arch.x86.disasm import dis_x86_32 +from miasm2.core.asmbloc import bloc2graph +from miasm2.core.bin_stream import bin_stream_pe + +if len(sys.argv) != 3: + print 'Example:' + print "%s box_upx.exe 0x410f90" % sys.argv[0] + sys.exit(0) + +fname = sys.argv[1] +ad = int(sys.argv[2], 16) +e = pe_init.PE(open(fname).read()) +bs = bin_stream_pe(e.virt) + +mdis = dis_x86_32(bs) +# inform the engine not to disasm nul instructions +mdis.dont_dis_nulstart_bloc = True +blocs = mdis.dis_multibloc(ad) + +g = bloc2graph(blocs) +open('graph.txt', 'w').write(g) diff --git a/example/expression/manip_expression1.py b/example/expression/manip_expression1.py new file mode 100644 index 00000000..a9ed00e3 --- /dev/null +++ b/example/expression/manip_expression1.py @@ -0,0 +1,31 @@ +from miasm2.expression.expression import * + +print """ +Simple expression manipulation demo +""" + +# define 2 ID +a = ExprId('eax', 32) +b = ExprId('ebx', 32) +print a, b +# eax ebx + +# add those ID +c = ExprOp('+', a, b) +print c +# (eax + ebx) + +# + automaticaly generates ExprOp('+', a, b) +c = a + b +print c +# (eax + ebx) + +# ax is a slice of eax +ax = a[:16] +print ax +# eax[0:16] + +# memory deref +d = ExprMem(c, 32) +print d +# @32[(eax + ebx)] diff --git a/example/expression/manip_expression2.py b/example/expression/manip_expression2.py new file mode 100644 index 00000000..4153f875 --- /dev/null +++ b/example/expression/manip_expression2.py @@ -0,0 +1,26 @@ +from miasm2.arch.x86.arch import mn_x86 +from miasm2.expression.expression import get_rw +from miasm2.arch.x86.ira import ir_a_x86_32 +print """ +Simple expression manipulation demo. +Get read/written registers for a given instruction +""" + +arch = mn_x86 +my_ir = ir_a_x86_32() + +l = arch.fromstring('LODSB', 32) +l.offset, l.l = 0, 15 +my_ir.add_instr(l) + +print '*' * 80 +for lbl, b in my_ir.blocs.items(): + print b + for irs in b.irs: + o_r, o_w = get_rw(irs) + print 'read: ', [str(x) for x in o_r] + print 'written:', [str(x) for x in o_w] + print +my_ir.gen_graph() +g = my_ir.graph() +open('graph_instr.txt', 'w').write(g) diff --git a/example/expression/manip_expression3.py b/example/expression/manip_expression3.py new file mode 100644 index 00000000..27c86096 --- /dev/null +++ b/example/expression/manip_expression3.py @@ -0,0 +1,20 @@ +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp + +print """ +Simple expression simplification demo +""" + + +a = ExprId('eax') +b = ExprId('ebx') + +exprs = [a + b - a, + ExprInt32(0x12) + ExprInt32(0x30) - a, + ExprCompose([(a[:8], 0, 8), + (a[8:16], 8, 16)])] + +for e in exprs: + print '*' * 40 + print 'original expression:', e + print "simplified:", expr_simp(e) diff --git a/example/expression/manip_expression4.py b/example/expression/manip_expression4.py new file mode 100644 index 00000000..f4a55a3c --- /dev/null +++ b/example/expression/manip_expression4.py @@ -0,0 +1,215 @@ +import os +import sys +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from miasm2.arch.x86.ira import ir_a_x86_32 +from miasm2.arch.x86.arch import mn_x86 +from miasm2.core import asmbloc +from miasm2.core.bin_stream import bin_stream_str +from elfesteem import pe_init +from optparse import OptionParser +from pdb import pm +from miasm2.ir.ir import ir +from miasm2.arch.x86.regs import * +from miasm2.arch.x86.disasm import dis_x86_32 + +from miasm2.analysis.data_analysis import intra_bloc_flow_raw, inter_bloc_flow + +from miasm2.core.graph import DiGraph +from miasm2.ir.symbexec import symbexec + +from pprint import pprint as pp + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +print """ +Simple expression use for generating dataflow graph +Exemple: +python manip_expression4.py sc_connect_back.bin 0x2e +""" + + +parser = OptionParser(usage="usage: %prog [options] sc_connect_back.bin") + +(options, args) = parser.parse_args(sys.argv[1:]) +if len(args) != 2: + parser.print_help() + sys.exit(0) + + +def node_x_2_id(n, x): + return hash(str(n) + str(x)) & 0xffffffffffffffff + + +def get_node_name(label, i, n): + # n_name = "%s_%d_%s"%(label.name, i, n) + n_name = (label.name, i, n) + return n_name + + +def get_modified_symbols(sb): + # get modified IDS + ids = sb.symbols.symbols_id.keys() + ids.sort() + out = {} + for i in ids: + if i in sb.arch.regs.regs_init and \ + i in sb.symbols.symbols_id and \ + sb.symbols.symbols_id[i] == sb.arch.regs.regs_init[i]: + continue + # print i, sb.symbols.symbols_id[i] + out[i] = sb.symbols.symbols_id[i] + + # get mem IDS + mems = sb.symbols.symbols_mem.values() + for m, v in mems: + print m, v + out[m] = v + pp([(str(x[0]), str(x[1])) for x in out.items()]) + return out + + +def intra_bloc_flow_symb(my_ir, flow_graph, irbloc): + symbols_init = {} + for i, r in enumerate(all_regs_ids): + symbols_init[r] = all_regs_ids_init[i] + sb = symbexec(mn_x86, symbols_init) + sb.emulbloc(irbloc) + print '*' * 40 + print irbloc + # sb.dump_mem() + # sb.dump_id() + in_nodes = {} + out_nodes = {} + + out = get_modified_symbols(sb) + current_nodes = {} + # gen mem arg to mem node links + for dst, src in out.items(): + for n in [dst, src]: + + all_mems = set() + all_mems.update(get_expr_mem(n)) + + for n in all_mems: + node_n_w = get_node_name(irbloc.label, 0, n) + if not n == src: + continue + o_r = n.arg.get_r(mem_read=False, cst_read=True) + for n_r in o_r: + if n_r in current_nodes: + node_n_r = current_nodes[n_r] + else: + node_n_r = get_node_name(irbloc.label, i, n_r) + if not n_r in in_nodes: + in_nodes[n_r] = node_n_r + flow_graph.add_uniq_edge(node_n_r, node_n_w) + + # gen data flow links + for dst, src in out.items(): + nodes_r = src.get_r(mem_read=False, cst_read=True) + nodes_w = set([dst]) + for n_r in nodes_r: + if n_r in current_nodes: + node_n_r = current_nodes[n_r] + else: + node_n_r = get_node_name(irbloc.label, 0, n_r) + if not n_r in in_nodes: + in_nodes[n_r] = node_n_r + + flow_graph.add_node(node_n_r) + for n_w in nodes_w: + node_n_w = get_node_name(irbloc.label, 1, n_w) + out_nodes[n_w] = node_n_w + + flow_graph.add_node(node_n_w) + flow_graph.add_uniq_edge(node_n_r, node_n_w) + + irbloc.in_nodes = in_nodes + irbloc.out_nodes = out_nodes + + +def node2str(self, n): + label, i, node = n + # print n + out = "%s,%s\\l\\\n%s" % n + return out + + +def gen_bloc_data_flow_graph(my_ir, in_str, ad): # arch, attrib, pool_bin, bloc, symbol_pool): + out_str = "" + + # my_ir = ir_x86_32(symbol_pool) + + for irbloc in my_ir.blocs.values(): + print irbloc + + my_ir.gen_graph() + my_ir.dead_simp() + + irbloc_0 = None + for irbloc in my_ir.blocs.values(): + if irbloc.label.offset == ad: + irbloc_0 = irbloc + break + assert(irbloc_0 is not None) + flow_graph = DiGraph() + flow_graph.node2str = lambda n: node2str(flow_graph, n) + done = set() + todo = set([irbloc_0.label]) + + bloc2w = {} + + for irbloc in my_ir.blocs.values(): + intra_bloc_flow_raw(my_ir, flow_graph, irbloc) + # intra_bloc_flow_symb(my_ir, flow_graph, irbloc) + + for irbloc in my_ir.blocs.values(): + print irbloc + print 'IN', [str(x) for x in irbloc.in_nodes] + print 'OUT', [str(x) for x in irbloc.out_nodes] + + print '*' * 20, 'interbloc', '*' * 20 + inter_bloc_flow(my_ir, flow_graph, irbloc_0.label) + + # sys.path.append('/home/serpilliere/projet/m2_devel/miasm2/core') + # from graph_qt import graph_qt + # graph_qt(flow_graph) + open('data.txt', 'w').write(flow_graph.dot()) + + +data = open(args[0]).read() +ad = int(args[1], 16) + +print 'disasm...' +mdis = dis_x86_32(data) +mdis.follow_call = True +ab = mdis.dis_multibloc(ad) +print 'ok' + + +print 'generating dataflow graph for:' +my_ir = ir_a_x86_32(mdis.symbol_pool) + +blocs = ab +for bloc in blocs: + print bloc + my_ir.add_bloc(bloc) +for irbloc in my_ir.blocs.values(): + print irbloc + if irbloc.label.offset != 0: + continue + + +out_str = gen_bloc_data_flow_graph(my_ir, mdis.bs, ad) + +print '*' * 40 +print """ + View with: +dotty dataflow.txt + or + Generate ps with pdf: +dot -Tps dataflow_xx.txt -o graph.ps +""" diff --git a/example/expression/manip_expression5.py b/example/expression/manip_expression5.py new file mode 100644 index 00000000..ed147c04 --- /dev/null +++ b/example/expression/manip_expression5.py @@ -0,0 +1,73 @@ +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from pdb import pm +import os + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +print """ +Expression simplification demo. +(and regression test) +""" + + +a = ExprId('a') +b = ExprId('b') +c = ExprId('c') +d = ExprId('d') +e = ExprId('e') + +m = ExprMem(a) +s = a[:8] + +i1 = ExprInt(uint32(0x1)) +i2 = ExprInt(uint32(0x2)) +cc = ExprCond(a, b, c) + +o = ExprCompose([(a[:8], 8, 16), + (a[8:16], 0, 8)]) + +o2 = ExprCompose([(a[8:16], 0, 8), + (a[:8], 8, 16)]) + +l = [a[:8], b[:8], c[:8], m[:8], s, i1[:8], i2[:8], o[:8]] +l2 = l[::-1] + + +x = ExprMem(a + b + ExprInt32(0x42)) + + +def replace_expr(e): + # print 'visit', e + dct = {c + ExprInt32(0x42): d, + a + b: c, } + if e in dct: + return dct[e] + return e + + +print x +y = x.visit(replace_expr) +print y +print x.copy() +print y.copy() +print y == y.copy() +print repr(y), repr(y.copy()) + + +z = ExprCompose([(a[5:5 + 8], 0, 8), (b[:16], 8, 24), (x[:8], 24, 32)]) +print z +print z.copy() +print z[:31].copy().visit(replace_expr) + +print 'replace' +print x.replace_expr({c + ExprInt32(0x42): d, + a + b: c, }) +print z.replace_expr({c + ExprInt32(0x42): d, + a + b: c, }) + + +u = z.copy() +print u diff --git a/example/expression/manip_expression6.py b/example/expression/manip_expression6.py new file mode 100644 index 00000000..45a6c8c1 --- /dev/null +++ b/example/expression/manip_expression6.py @@ -0,0 +1,67 @@ +from miasm2.core.cpu import parse_ast, ast_id2expr +from miasm2.arch.x86.arch import mn_x86, base_expr +from miasm2.core import parse_asm +from miasm2.expression.expression import * +from miasm2.core import asmbloc +from miasm2.arch.x86.ira import ir_a_x86_32 +from pdb import pm + + +def my_ast_int2expr(a): + return ExprInt32(a) + +my_var_parser = parse_ast(ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + + +# First, asm code +blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' +main: + MOV EAX, 1 + MOV EBX, 2 + MOV ECX, 2 + MOV DX, 2 + +loop: + INC EBX + CMOVZ EAX, EBX + ADD EAX, ECX + JZ loop + RET +''') + +blocs = blocs[0] + +symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) +for b in blocs: + print b + + +print "symbols:" +print symbol_pool +resolved_b, patches = asmbloc.asm_resolve_final(mn_x86, 32, blocs, symbol_pool) + +# Translate to IR +my_ir = ir_a_x86_32(symbol_pool) +for b in blocs: + print 'add bloc' + print b + my_ir.add_bloc(b) + +# Display IR +for lbl, b in my_ir.blocs.items(): + print b + +# Dead propagation +my_ir.gen_graph() +out = my_ir.graph() +open('graph.txt', 'w').write(out) +print '*' * 80 +my_ir.dead_simp() +out2 = my_ir.graph() +open('graph2.txt', 'w').write(out2) + +# Display new IR +print 'new ir blocs' +for lbl, b in my_ir.blocs.items(): + print b diff --git a/example/expression/manip_expression7.py b/example/expression/manip_expression7.py new file mode 100644 index 00000000..d1cbb73b --- /dev/null +++ b/example/expression/manip_expression7.py @@ -0,0 +1,21 @@ +from miasm2.core.graph import DiGraph +from miasm2.expression.expression import * + +print "Simple Expression grapher demo" + +a = ExprId("A") +b = ExprId("B") +c = ExprId("C") +d = ExprId("D") +m = ExprMem(a + b + c + a) + +e1 = ExprCompose([(a + b - (c * a) / m | b, 0, 32), (a + m, 32, 64)]) +e2 = ExprInt64(15) +e = ExprCond(d, e1, e2)[0:32] + +print "[+] Expression:" +print e + +g = e.graph() +print "[+] Graph:" +print g.dot() diff --git a/example/expression/sc_connect_back.bin b/example/expression/sc_connect_back.bin new file mode 100644 index 00000000..9e9c80a5 --- /dev/null +++ b/example/expression/sc_connect_back.bin Binary files differdiff --git a/example/expression/simple_test.bin b/example/expression/simple_test.bin new file mode 100644 index 00000000..60f4e768 --- /dev/null +++ b/example/expression/simple_test.bin Binary files differdiff --git a/example/expression/simple_test.c b/example/expression/simple_test.c new file mode 100644 index 00000000..8e344f18 --- /dev/null +++ b/example/expression/simple_test.c @@ -0,0 +1,26 @@ +int test(unsigned int argc, char** argv) +{ + unsigned int ret; + if (argc == 0) + ret = 0x1001; + else if (argc < 2) + ret = 0x1002; + else if (argc <= 5) + ret = 0x1003; + else if (argc != 7 && argc*2 == 14) + ret = 0x1004; + else if (argc*2 == 14) + ret = 0x1005; + else if (argc & 0x30) + ret = 0x1006; + else if (argc + 3 == 0x45) + ret = 0x1007; + else + ret = 0x1008; + return ret; +} + +int main(int argc, char** argv) +{ + return test(argc, argv); +} diff --git a/example/expression/solve_condition_stp.py b/example/expression/solve_condition_stp.py new file mode 100644 index 00000000..828629fc --- /dev/null +++ b/example/expression/solve_condition_stp.py @@ -0,0 +1,245 @@ +import os +import sys +from miasm2.arch.x86.arch import * +from miasm2.arch.x86.regs import * +from miasm2.arch.x86.sem import * +from miasm2.core.bin_stream import bin_stream_str +from miasm2.core import asmbloc +from miasm2.expression.expression import get_rw +from miasm2.ir.symbexec import symbexec +from miasm2.expression.simplifications import expr_simp +from miasm2.expression import stp +from collections import defaultdict +from optparse import OptionParser +import subprocess +from miasm2.core import parse_asm +from elfesteem.strpatchwork import StrPatchwork + +from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine + + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + + +mn = mn_x86 + +parser = OptionParser(usage="usage: %prog [options] file") +parser.add_option('-a', "--address", dest="address", metavar="ADDRESS", + help="address to disasemble", default="0") + +(options, args) = parser.parse_args(sys.argv[1:]) +if not args: + parser.print_help() + sys.exit(0) + + +def get_bloc(my_ir, mdis, ad): + if isinstance(ad, asmbloc.asm_label): + l = ad + else: + l = mdis.symbol_pool.getby_offset_create(ad) + if not l in my_ir.blocs: + ad = l.offset + b = mdis.dis_bloc(ad) + my_ir.add_bloc(b) + b = my_ir.get_bloc(l) + if b is None: + raise LookupError('no bloc found at that address: %s' % l) + return b + + +def emul_symb(my_ir, mdis, states_todo, states_done): + while states_todo: + ad, symbols, conds = states_todo.pop() + print '*' * 40, "addr", ad, '*' * 40 + if (ad, symbols, conds) in states_done: + print 'skip', ad + continue + states_done.add((ad, symbols, conds)) + sb = symbexec(mn, {}) + sb.symbols = symbols.copy() + if my_ir.pc in sb.symbols: + del(sb.symbols[my_ir.pc]) + b = get_bloc(my_ir, mdis, ad) + + print 'run bloc' + print b + # print blocs[ad] + ad = sb.emulbloc(b) + print 'final state' + sb.dump_id() + print 'dataflow' + # data_flow_graph_from_expr(sb) + + assert(ad is not None) + print "DST", ad + + if isinstance(ad, ExprCond): + # Create 2 states, each including complementary conditions + p1 = sb.symbols.copy() + p2 = sb.symbols.copy() + c1 = {ad.cond: ExprInt_from(ad.cond, 0)} + c2 = {ad.cond: ExprInt_from(ad.cond, 1)} + print ad.cond + p1[ad.cond] = ExprInt_from(ad.cond, 0) + p2[ad.cond] = ExprInt_from(ad.cond, 1) + ad1 = expr_simp(sb.eval_expr(ad.replace_expr(c1), {})) + ad2 = expr_simp(sb.eval_expr(ad.replace_expr(c2), {})) + if not (isinstance(ad1, ExprInt) or (isinstance(ad1, ExprId) and isinstance(ad1.name, asmbloc.asm_label)) and + isinstance(ad2, ExprInt) or (isinstance(ad2, ExprId) and isinstance(ad2.name, asmbloc.asm_label))): + print str(ad1), str(ad2) + raise ValueError("zarb condition") + conds1 = list(conds) + c1.items() + conds2 = list(conds) + c2.items() + if isinstance(ad1, ExprId): + ad1 = ad1.name + if isinstance(ad2, ExprId): + ad2 = ad2.name + if isinstance(ad1, ExprInt): + ad1 = ad1.arg + if isinstance(ad2, ExprInt): + ad2 = ad2.arg + states_todo.add((ad1, p1, tuple(conds1))) + states_todo.add((ad2, p2, tuple(conds2))) + elif isinstance(ad, ExprInt): + ad = int(ad.arg) + states_todo.add((ad, sb.symbols.copy(), tuple(conds))) + elif isinstance(ad, ExprId) and isinstance(ad.name, asmbloc.asm_label): + if isinstance(ad, ExprId): + ad = ad.name + states_todo.add((ad, sb.symbols.copy(), tuple(conds))) + elif ad == ret_addr: + print 'ret reached' + continue + else: + raise ValueError("zarb eip") + + +if __name__ == '__main__': + + data = open(args[0]).read() + bs = bin_stream_str(data) + + mdis = dis_engine(bs) + + ad = int(options.address, 16) + + symbols_init = {} + for i, r in enumerate(all_regs_ids): + symbols_init[r] = all_regs_ids_init[i] + + # config parser for 32 bit + reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) + + def my_ast_int2expr(a): + return ExprInt32(a) + + def my_ast_id2expr(t): + if t in reg_and_id: + r = reg_and_id[t] + else: + r = ExprId(t, size=32) + return r + my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) + base_expr.setParseAction(my_var_parser) + + argc = ExprId('argc', 32) + argv = ExprId('argv', 32) + ret_addr = ExprId('ret_addr') + reg_and_id[argc.name] = argc + reg_and_id[argv.name] = argv + reg_and_id[ret_addr.name] = ret_addr + + my_symbols = [argc, argv, ret_addr] + my_symbols = dict([(x.name, x) for x in my_symbols]) + my_symbols.update(mn_x86.regs.all_regs_ids_byname) + + sb = symbexec(mn, symbols_init) + + blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, ''' + PUSH argv + PUSH argc + PUSH ret_addr + ''') + + my_ir = ir_x86_32(mdis.symbol_pool) + + b = blocs[0][0] + print b + # add fake address and len to parsed instructions + for i, l in enumerate(b.lines): + l.offset, l.l = i, 1 + my_ir.add_bloc(b) + irb = get_bloc(my_ir, mdis, 0) + sb.emulbloc(irb) + sb.dump_mem() + + # reset my_ir blocs + my_ir.blocs = {} + + states_todo = set() + states_done = set() + states_todo.add((uint32(ad), sb.symbols, ())) + + # emul blocs, propagate states + emul_symb(my_ir, mdis, states_todo, states_done) + + all_info = [] + + print '*' * 40, 'conditions to match', '*' * 40 + for ad, symbols, conds in sorted(states_done): + print '*' * 40, ad, '*' * 40 + reqs = [] + for k, v in conds: + print k, v + reqs.append((k, v)) + all_info.append((ad, reqs)) + + all_cases = set() + + sb = symbexec(mn, symbols_init) + for ad, reqs_cond in all_info: + all_ids = set() + for k, v in reqs_cond: + all_ids.update(get_expr_ids(k)) + + out = [] + + # declare variables + for v in all_ids: + out.append(str(v) + ":" + "BITVECTOR(%d);" % v.size) + + all_csts = [] + for k, v in reqs_cond: + cst = k.strcst() + val = v.arg + assert(val in [0, 1]) + inv = "" + if val == 1: + inv = "NOT " + val = "0" * v.size + all_csts.append("(%s%s=0bin%s)" % (inv, cst, val)) + if not all_csts: + continue + rez = " AND ".join(all_csts) + out.append("QUERY(NOT (%s));" % rez) + end = "\n".join(out) + open('out.txt', 'w').write(end) + try: + cases = subprocess.check_output(["/home/serpilliere/tools/stp/stp", + "-p", + "out.txt"]) + except OSError: + print "ERF, cannot find stp" + break + for c in cases.split('\n'): + if c.startswith('ASSERT'): + all_cases.add((ad, c)) + + print '*' * 40, 'ALL COND', '*' * 40 + all_cases = list(all_cases) + all_cases.sort(key=lambda x: (x[0], x[1])) + for ad, val in all_cases: + print 'address', ad, 'is reachable using argc', val diff --git a/example/extract_pe_ressources.py b/example/extract_pe_ressources.py new file mode 100644 index 00000000..d5c59ae5 --- /dev/null +++ b/example/extract_pe_ressources.py @@ -0,0 +1,42 @@ +import sys +import struct +from elfesteem import * +import os +import sys + +# example for extracting all pe ressources + + +def extract_res(res, name_o="", num=0, lvl=-1): + lvl += 1 + if not res: + return num + for x in res.resentries: + print "\t" * lvl, repr(x) + num += 1 + + if x.name_s: + name = name_o[:] + repr(x.name_s.value[::2]) + else: + name = name_o[:] + + if x.data: + print "\t" * lvl, 'data', len(x.data.s) + open('out/%.3d_%s.bin' % (num, name), 'w').write(str(x.data.s)) + else: + print "\t" * lvl, None + if x.offsettosubdir: + num = extract_res(x.subdir, name, num, lvl + 1) + return num + +try: + os.stat('out') +except: + os.mkdir('out') + +fname = sys.argv[1] +e = pe_init.PE(open(fname, 'rb').read()) +res = e.DirRes.resdesc + + +extract_res(res) diff --git a/example/md5_arm b/example/md5_arm new file mode 100755 index 00000000..148e0611 --- /dev/null +++ b/example/md5_arm Binary files differdiff --git a/example/sandbox_pe_x86_32.py b/example/sandbox_pe_x86_32.py new file mode 100644 index 00000000..0f660668 --- /dev/null +++ b/example/sandbox_pe_x86_32.py @@ -0,0 +1,125 @@ +import sys +import os +from argparse import ArgumentParser +from miasm2.arch.x86.arch import mn_x86 +from miasm2.jitter.jitload import jitter_x86_32, vm_load_pe, preload_pe, libimp +from miasm2.jitter.jitload import bin_stream_vm +from miasm2.jitter.csts import * +from miasm2.jitter.os_dep import win_api_x86_32 +from miasm2.analysis import debugging, gdbserver +import inspect + +# Debug settings # +from pdb import pm + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +# + +# Handle arguments + +parser = ArgumentParser( + description="Sandbox a PE binary with x86 32bits engine") +parser.add_argument("filename", help="PE binary") +parser.add_argument("-r", "--log-regs", + help="Log registers value for each instruction", + action="store_true") +parser.add_argument("-m", "--log-mn", + help="Log desassembly conversion for each instruction", + action="store_true") +parser.add_argument("-n", "--log-newbloc", + help="Log basic blocks processed by the Jitter", + action="store_true") +parser.add_argument("-j", "--jitter", + help="Jitter engine. Possible values are : tcc (default), llvm", + default="tcc") +parser.add_argument("-d", "--debugging", + help="Attach a CLI debugguer to the sandboxed programm", + action="store_true") +parser.add_argument("-g", "--gdbserver", + help="Listen on [port] with a GDB server", + type=int, + default=False) +args = parser.parse_args() + +# User defined methods + + +def msvcrt_memset(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + dst, c, size = args + + myjit.vm.vm_set_mem(dst, chr(c & 0xFF) * size) + myjit.func_ret_cdecl(ret_ad, 0) + + +def msvcrt_memcpy(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + dst, src, size = args + + x = myjit.vm.vm_get_mem(src, size) + myjit.vm.vm_set_mem(dst, x) + myjit.func_ret_cdecl(ret_ad, 0) + +# Breakpoint callbacks + + +def code_sentinelle(jitter): + jitter.run = False + jitter.pc = 0 + print "End Emulation" + return True + +# x86 32 bits engine instanciation +myjit = jitter_x86_32(jit_type=args.jitter) +myjit.init_stack() +libs = libimp() + +# Set libs for win_32 api +win_api_x86_32.winobjs.runtime_dll = libs + +# Load PE and get entry point address +e = vm_load_pe(myjit.vm, args.filename) +preload_pe(myjit.vm, e, libs) + +addr = e.rva2virt(e.Opthdr.AddressOfEntryPoint) + +# Log level (if available with jitter engine) +myjit.jit.log_regs = args.log_regs +myjit.jit.log_mn = args.log_mn +myjit.jit.log_newbloc = args.log_newbloc + +# Set up stack +myjit.vm_push_uint32_t(0x1337beef) + +# Set callbacks +myjit.add_breakpoint(0x1337beef, code_sentinelle) + +myjit.add_lib_handler(libs, globals()) + +# Start Emulation +myjit.init_run(addr) + +# Handle debugging +if any([args.debugging, args.gdbserver]): + dbg = debugging.Debugguer(myjit) + if args.debugging is True: + cmd = debugging.DebugCmd(dbg) + cmd.cmdloop() + else: + gdb = gdbserver.GdbServer_x86_32(dbg, args.gdbserver) + print("Listenning on port %d" % args.gdbserver) + gdb.run() + +else: + print(myjit.continue_run()) + +# Performance tests +# +# import cProfile +# cProfile.run(r'run_bin(myjit, addr)') + +# Test if emulation ended properly +assert(myjit.run is False) diff --git a/example/symbol_exec.py b/example/symbol_exec.py new file mode 100644 index 00000000..6d7457aa --- /dev/null +++ b/example/symbol_exec.py @@ -0,0 +1,31 @@ +# Minimalist Symbol Exec example +from miasm2.core.bin_stream import bin_stream_str +from miasm2.arch.x86.arch import mn_x86 +from miasm2.arch.x86.ira import ir_a_x86_32 +from miasm2.arch.x86.regs import all_regs_ids, all_regs_ids_init +from miasm2.ir.symbexec import symbexec +from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine +import miasm2.expression.expression as m2_expr + +l = mn_x86.fromstring("MOV EAX, EBX", 32) +asm = mn_x86.asm(l)[0] + +bin_stream = bin_stream_str(asm) + +mdis = dis_engine(bin_stream) +disasm = mdis.dis_multibloc(0) + +ir = ir_a_x86_32(mdis.symbol_pool) +for bbl in disasm: ir.add_bloc(bbl) + +symbols_init = {} +for i, r in enumerate(all_regs_ids): + symbols_init[r] = all_regs_ids_init[i] +symb = symbexec(mn_x86, symbols_init) + +block = ir.get_bloc(0) + +cur_addr = symb.emulbloc(block) +assert(symb.symbols[m2_expr.ExprId("EAX")] == symbols_init[m2_expr.ExprId("EBX")]) +print 'modified registers:' +symb.dump_id() diff --git a/example/test_dis.py b/example/test_dis.py new file mode 100644 index 00000000..4400ec14 --- /dev/null +++ b/example/test_dis.py @@ -0,0 +1,266 @@ +import sys +import os +import time + +from miasm2.core.bin_stream import bin_stream_elf, bin_stream_pe, bin_stream_str +from elfesteem import * +from miasm2.core.asmbloc import * +from miasm2.expression.simplifications import expr_simp +from optparse import OptionParser +from miasm2.core.cpu import dum_arg +import cProfile +from miasm2.expression.expression import * +from miasm2.core.interval import interval +from miasm2.core.utils import hexdump + +log = logging.getLogger("dis") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.INFO) + + +# log_asmbloc.setLevel(logging.DEBUG) +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + + +parser = OptionParser(usage="usage: %prog [options] file address") +parser.add_option('-m', "--architecture", dest="machine", metavar="MACHINE", + help="architecture: arm, x86_16, x86_32, x86_64, msp430") +parser.add_option('-f', "--followcall", dest="followcall", action="store_true", + default=False, + help="follow call") + +parser.add_option('-b', "--blocwatchdog", dest="bw", + default=None, + help="address to disasemble") + +parser.add_option('-n', "--funcsnumwatchdog", dest="funcswd", + default=None, + help="max func to disasm") + +parser.add_option( + '-r', "--recurfunctions", dest="recurfunctions", action="store_true", + default=False, + help="disasm found functions") + +parser.add_option('-v', "--verbose", dest="verbose", action="store_true", + default=False, + help="verbose") + +parser.add_option('-g', "--gen_ir", dest="gen_ir", action="store_true", + default=False, + help="gen intermediate representation") + +parser.add_option('-z', "--dis_nulstart_bloc", dest="dis_nulstart_bloc", + action="store_true", default=False, + help="dont_dis_nulstart_bloc") +parser.add_option('-l', "--dontdis_retcall", dest="dontdis_retcall", + action="store_true", default=False, + help="only disasm call dst") + +parser.add_option('-s', "--simplify", dest="simplify", action="store_true", + default=False, + help="for test purpose") + +parser.add_option('-o', "--shiftoffset", dest="shiftoffset", + default="0", + help="shift input str by offset") + +parser.add_option( + '-a', "--trydisasmall", dest="trydisasmall", action="store_true", + default=False, + help="try disasm all binary") + +parser.add_option('-i', "--image", dest="image", action="store_true", + default=False, + help="display image representation of disasm") + +(options, args) = parser.parse_args(sys.argv[1:]) +if not args: + parser.print_help() + sys.exit(0) +fname = args[0] + +if options.verbose: + log_asmbloc.setLevel(logging.DEBUG) + +log.info("import machine...") +mode = None +dis_cb = None + + +if options.machine == "arm": + from miasm2.arch.arm.disasm import dis_arm as dis_engine + from miasm2.arch.arm.arch import mn_arm as mn + from miasm2.arch.arm.ira import ir_a_arm as ira +elif options.machine == "armt": + from miasm2.arch.arm.disasm import dis_armt as dis_engine + from miasm2.arch.arm.arch import mn_armt as mn + from miasm2.arch.arm.ira import ir_a_armt as ira +elif options.machine == "sh4": + from miasm2.arch.sh4.disasm import dis_sha4 as dis_engine + from miasm2.arch.sh4.arch import mn_sh4 as mn + from miasm2.arch.sh4.ira import ir_a_sh4 as ira +elif options.machine == "x86_16": + from miasm2.arch.x86.disasm import dis_x86_16 as dis_engine + from miasm2.arch.x86.arch import mn_x86 as mn + from miasm2.arch.x86.ira import ir_a_x86_16 as ira +elif options.machine == "x86_32": + from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine + from miasm2.arch.x86.arch import mn_x86 as mn + from miasm2.arch.x86.ira import ir_a_x86_32 as ira +elif options.machine == "x86_64": + from miasm2.arch.x86.disasm import dis_x86_64 as dis_engine + from miasm2.arch.x86.arch import mn_x86 as mn + from miasm2.arch.x86.ira import ir_a_x86_64 as ira +elif options.machine == "msp430": + from miasm2.arch.msp430.disasm import dis_msp430 as dis_engine + from miasm2.arch.msp430.arch import mn_msp430 as mn + from miasm2.arch.msp430.ira import ir_a_msp430 as ira +else: + raise ValueError('unknown machine') +log.info('ok') + +if options.bw != None: + options.bw = int(options.bw) +if options.funcswd != None: + options.funcswd = int(options.funcswd) +machine = options.machine + +log.info('load binary') +b = open(fname).read() + +default_addr = 0 +bs = None +if b.startswith('MZ'): + e = pe_init.PE(b) + if e.isPE() and e.NTsig.signature_value == 0x4550: + bs = bin_stream_pe(e.virt) + default_addr = e.rva2virt(e.Opthdr.AddressOfEntryPoint) +elif b.startswith('\x7fELF'): + e = elf_init.ELF(b) + bs = bin_stream_elf(e.virt) + default_addr = e.Ehdr.entry + +if bs is None: + shift = int(options.shiftoffset, 16) + log.warning('fallback to string input (offset=%s)' % hex(shift)) + bs = bin_stream_str(b, shift=shift) + + +log.info('ok') +mdis = dis_engine(bs) +# configure disasm engine +mdis.dontdis_retcall = options.dontdis_retcall +mdis.blocs_wd = options.bw +mdis.dont_dis_nulstart_bloc = not options.dis_nulstart_bloc + +todo = [] +addrs = [int(a, 16) for a in args[1:]] + +if len(addrs) == 0 and default_addr is not None: + addrs.append(default_addr) +for ad in addrs: + todo = [(mdis, None, ad)] + +done = set() +all_funcs = set() +all_funcs_blocs = {} + + +done_interval = interval() +finish = False + +# Main disasm loop +while not finish and todo: + while not finish and todo: + mdis, caller, ad = todo.pop(0) + if ad in done: + continue + done.add(ad) + ab = mdis.dis_multibloc(ad) + + log.info('func ok %.16x (%d)' % (ad, len(all_funcs))) + + all_funcs.add(ad) + all_funcs_blocs[ad] = ab + for b in ab: + for l in b.lines: + done_interval += interval([(l.offset, l.offset + l.l)]) + + if options.funcswd is not None: + options.funcswd -= 1 + if options.recurfunctions: + for b in ab: + i = b.get_subcall_instr() + if not i: + continue + for d in i.getdstflow(mdis.symbol_pool): + if not (isinstance(d, ExprId) and isinstance(d.name, asm_label)): + continue + todo.append((mdis, i, d.name.offset)) + + if options.funcswd is not None and options.funcswd <= 0: + finish = True + + if options.trydisasmall: + for a, b in done_interval.intervals: + if b in done: + continue + log.debug('add func %s' % hex(b)) + todo.append((mdis, None, b)) + + +# Generate dotty graph +all_blocs = [] +for blocs in all_funcs_blocs.values(): + all_blocs += blocs + # for b in blocs: + # print b + +log.info('generate graph file') +g = bloc2graph(all_blocs, True) +open('graph_execflow.txt', 'w').write(g) + +log.info('generate intervals') + +all_lines = [] +total_l = 0 + +print done_interval +if options.image: + log.info('build img') + done_interval.show() + +for i, j in done_interval.intervals: + log.debug((hex(i), "->", hex(j))) + + +all_lines.sort(key=lambda x: x.offset) +open('lines.txt', 'w').write('\n'.join([str(l) for l in all_lines])) +log.info('total lines %s' % total_l) + + +# Bonus, generate IR graph +if options.gen_ir: + log.info("generating IR") + + my_ir = ira(mdis.symbol_pool) + my_ir.blocs = {} + for ad, all_bloc in all_funcs_blocs.items(): + log.info("generating IR... %x" % ad) + for b in all_bloc: + my_ir.add_bloc(b) + + log.info("Gen Graph... %x" % ad) + + my_ir.gen_graph() + + if options.simplify: + my_ir.dead_simp() + + out = my_ir.graph() + open('graph_irflow.txt', 'w').write(out) diff --git a/example/test_ida.py b/example/test_ida.py new file mode 100644 index 00000000..449c630c --- /dev/null +++ b/example/test_ida.py @@ -0,0 +1,409 @@ +import sys + +# Set your path first! +sys.path.append("/home/serpilliere/tools/pyparsing/pyparsing-2.0.1/build/lib.linux-x86_64-2.7") +sys.path.append("/home/serpilliere/projet/m2_devel/build/lib.linux-x86_64-2.7") + +from miasm2.core.bin_stream import bin_stream_str +from miasm2.core.asmbloc import * +from miasm2.expression.simplifications import expr_simp + +from miasm2.analysis.data_analysis import intra_bloc_flow_raw, inter_bloc_flow +from miasm2.analysis.data_analysis import intra_bloc_flow_symbexec + +from idaapi import * +import idautils + + +class bin_stream_ida(bin_stream_str): + # ida should provide Byte function + + def getbytes(self, start, l=1): + o = "" + for ad in xrange(start - self.shift, start - self.shift + l): + o += chr(Byte(ad)) + return o + + def readbs(self, l=1): + if self.offset + l > self.l: + raise IOError + o = self.getbytes(self.offset) + self.offset += l + return p + + def writebs(self, l=1): + raise ValueError('writebs unsupported') + + def __str__(self): + raise NotImplementedError('not fully functional') + out = self.bin[self.offset - self.shift:] + return out + + def setoffset(self, val): + self.offset = val + + def __len__(self): + return 0x7FFFFFFF + + def getlen(self): + return 0x7FFFFFFF - self.offset - self.shift + + +def expr2colorstr(my_ir, e): + # print "XXX", e + if isinstance(e, ExprId): + s = str(e) + if e in my_ir.arch.regs.all_regs_ids: + s = idaapi.COLSTR(s, idaapi.SCOLOR_REG) + elif isinstance(e, ExprInt): + s = str(e) + s = idaapi.COLSTR(s, idaapi.SCOLOR_NUMBER) + elif isinstance(e, ExprMem): + s = '@%d[%s]' % (e.size, expr2colorstr(my_ir, e.arg)) + elif isinstance(e, ExprOp): + out = [] + for a in e.args: + s = expr2colorstr(my_ir, a) + if isinstance(a, ExprOp): + s = "(%s)" % s + out.append(s) + if len(out) == 1: + s = "%s %s" % (e.op, str(out[0])) + else: + s = (" " + e.op + " ").join(out) + elif isinstance(e, ExprAff): + s = "%s = %s" % ( + expr2colorstr(my_ir, e.dst), expr2colorstr(my_ir, e.src)) + elif isinstance(e, ExprCond): + cond = expr2colorstr(my_ir, e.cond) + src1 = expr2colorstr(my_ir, e.src1) + src2 = expr2colorstr(my_ir, e.src2) + s = "(%s?%s:%s)" % (cond, src1, src2) + elif isinstance(e, ExprSlice): + s = "(%s)[%d:%d]" % (expr2colorstr(my_ir, e.arg), e.start, e.stop) + else: + s = str(e) + # print repr(s) + return s + + +def color_irbloc(irbloc): + o = [] + lbl = '%s' % irbloc.label + lbl = idaapi.COLSTR(lbl, idaapi.SCOLOR_INSN) + o.append(lbl) + for i, expr in enumerate(irbloc.irs): + for e in expr: + s = expr2colorstr(my_ir, e) + s = idaapi.COLSTR(s, idaapi.SCOLOR_INSN) + o.append(' %s' % s) + o.append("") + o.pop() + i = len(irbloc.irs) + s = str(' Dst: %s' % irbloc.dst) + s = idaapi.COLSTR(s, idaapi.SCOLOR_RPTCMT) + o.append(s) + + return "\n".join(o) + + +class GraphMiasmIR(GraphViewer): + + def __init__(self, my_ir, title, result): + GraphViewer.__init__(self, title) + print 'init' + self.my_ir = my_ir + self.result = result + self.names = {} + + def OnRefresh(self): + print 'refresh' + self.Clear() + addr_id = {} + for irbloc in self.my_ir.blocs.values(): + id_irbloc = self.AddNode(color_irbloc(irbloc)) + addr_id[irbloc] = id_irbloc + + for irbloc in self.my_ir.blocs.values(): + if not irbloc: + continue + dst = my_ir.dst_trackback(irbloc) + for d in dst: + if not self.my_ir.ExprIsLabel(d): + continue + + d = d.name + if not d in self.my_ir.blocs: + continue + b = self.my_ir.blocs[d] + node1 = addr_id[irbloc] + node2 = addr_id[b] + self.AddEdge(node1, node2) + return True + + def OnGetText(self, node_id): + b = self[node_id] + return str(b) + + def OnSelect(self, node_id): + return True + + def OnClick(self, node_id): + return True + + def OnCommand(self, cmd_id): + if self.cmd_test == cmd_id: + print 'TEST!' + return + print "command:", cmd_id + + def Show(self): + if not GraphViewer.Show(self): + return False + self.cmd_test = self.AddCommand("Test", "F2") + if self.cmd_test == 0: + print "Failed to add popup menu item!" + return True + + +from miasm2.analysis.disasm_cb import guess_funcs, guess_multi_cb + + +processor_name = GetLongPrm(INF_PROCNAME) +dis_engine = None +if processor_name == "metapc": + + # HACK: check 32/64 using INF_START_SP + max_size = GetLongPrm(INF_START_SP) + if max_size == 0x80: # TODO XXX check + from miasm2.arch.x86.disasm import dis_x86_16 as dis_engine + from miasm2.arch.x86.x86.ira import ir_a_x86_16 as ira + elif max_size == 0xFFFFFFFF: + from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine + from miasm2.arch.x86.ira import ir_a_x86_32 as ira + + elif max_size == 0xFFFFFFFFFFFFFFFF: + from miasm2.arch.x86.disasm import dis_x86_64 as dis_engine + from miasm2.arch.x86.ira import ir_a_x86_64 as ira + + else: + raise ValueError('cannot guess 32/64 bit! (%x)' % max_size) +elif processor_name == "ARM": + # TODO ARM/thumb + # hack for thumb: place armt = True in globals :/ + is_armt = globals().get('armt', False) + if is_armt: + from miasm2.arch.arm.disasm import dis_armt as dis_engine + from miasm2.arch.arm.ira import ir_a_armt as ira + else: + from miasm2.arch.arm.disasm import dis_arm as dis_engine + from miasm2.arch.arm.ira import ir_a_arm as ira + + from miasm2.analysis.disasm_cb import arm_guess_subcall, arm_guess_jump_table + guess_funcs.append(arm_guess_subcall) + guess_funcs.append(arm_guess_jump_table) + +elif processor_name == "msp430": + # TODO ARM/thumb + from miasm2.arch.msp430.disasm import dis_msp430 as dis_engine + from miasm2.arch.msp430.ira import ir_a_msp430 as ira + +else: + print repr(processor_name) + raise NotImplementedError('not fully functional') + +print "Arch", dis_engine + +fname = GetInputFile() +print fname + +bs = bin_stream_ida() +mdis = dis_engine(bs) +my_ir = ira(mdis.symbol_pool) + +# populate symbols with ida names +for ad, name in Names(): + # print hex(ad), repr(name) + if name is None: + continue + mdis.symbol_pool.add_label(name, ad) + +print "start disasm" +ad = ScreenEA() +print hex(ad) + +ab = mdis.dis_multibloc(ad) + +print "generating graph" +g = bloc2graph(ab, True) +open('asm_flow.txt', 'w').write(g) + + +print "generating IR... %x" % ad + +for b in ab: + print 'ADD' + print b + my_ir.add_bloc(b) + + +print "IR ok... %x" % ad + +for irb in my_ir.blocs.values(): + for irs in irb.irs: + for i, e in enumerate(irs): + e.dst, e.src = expr_simp(e.dst), expr_simp(e.src) + +my_ir.gen_graph() +out = my_ir.graph() +open('/tmp/graph.txt', 'w').write(out) + + +# my_ir.dead_simp() + +g = GraphMiasmIR(my_ir, "Miasm IR graph", None) + + +def mycb(*test): + print test + raise NotImplementedError('not fully functional') + +g.cmd_a = g.AddCommand("cmd a", "x") +g.cmd_b = g.AddCommand("cmd b", "y") + +g.Show() + + +def node2str(n): + label, i, node = n + print n + # out = "%s,%s\n%s"%n + out = "%s" % node + return out + + +def get_node_name(label, i, n): + # n_name = "%s_%d_%s"%(label.name, i, n) + n_name = (label.name, i, n) + return n_name + + +def get_modified_symbols(sb): + # get modified IDS + ids = sb.symbols.symbols_id.keys() + ids.sort() + out = {} + for i in ids: + if i in sb.arch.regs.regs_init and \ + i in sb.symbols.symbols_id and \ + sb.symbols.symbols_id[i] == sb.arch.regs.regs_init[i]: + continue + # print i, sb.symbols.symbols_id[i] + out[i] = sb.symbols.symbols_id[i] + + # get mem IDS + mems = sb.symbols.symbols_mem.values() + for m, v in mems: + # print m, v + out[m] = v + pp([(str(x[0]), str(x[1])) for x in out.items()]) + return out + + +def gen_bloc_data_flow_graph(my_ir, in_str, ad): # arch, attrib, pool_bin, bloc, symbol_pool): + out_str = "" + + my_ir.gen_graph() + # my_ir.dead_simp() + + irbloc_0 = None + for irbloc in my_ir.blocs.values(): + if irbloc.label.offset == ad: + irbloc_0 = irbloc + break + assert(irbloc_0 is not None) + flow_graph = DiGraph() + done = set() + todo = set([irbloc_0.label]) + + bloc2w = {} + + for irbloc in my_ir.blocs.values(): + # intra_bloc_flow_raw(my_ir, flow_graph, irbloc) + intra_bloc_flow_symbexec(my_ir, flow_graph, irbloc) + # intra_bloc_flow_symb(my_ir, flow_graph, irbloc) + + for irbloc in my_ir.blocs.values(): + print irbloc + print 'IN', [str(x) for x in irbloc.in_nodes] + print 'OUT', [str(x) for x in irbloc.out_nodes] + + print '*' * 20, 'interbloc', '*' * 20 + inter_bloc_flow(my_ir, flow_graph, irbloc_0.label, False) + + print 'Dataflow roots:' + for node in flow_graph.roots(): + lbl, i, n = node + if n in my_ir.arch.regs.all_regs_ids: + print node + + open('data.txt', 'w').write(flow_graph.dot()) + return flow_graph + + +class GraphMiasmIRFlow(GraphViewer): + + def __init__(self, flow_graph, title, result): + GraphViewer.__init__(self, title) + print 'init' + self.flow_graph = flow_graph + self.result = result + self.names = {} + + def OnRefresh(self): + print 'refresh' + self.Clear() + addr_id = {} + for n in self.flow_graph.nodes(): + id_n = self.AddNode(node2str(self.flow_graph, n)) + addr_id[n] = id_n + + for a, b in self.flow_graph.edges(): + node1, node2 = addr_id[a], addr_id[b] + self.AddEdge(node1, node2) + return True + + def OnGetText(self, node_id): + b = self[node_id] + return str(b).lower() + + def OnSelect(self, node_id): + return True + + def OnClick(self, node_id): + return True + + def OnCommand(self, cmd_id): + if self.cmd_test == cmd_id: + print 'TEST!' + return + print "command:", cmd_id + + def Show(self): + if not GraphViewer.Show(self): + return False + self.cmd_test = self.AddCommand("Test", "F2") + if self.cmd_test == 0: + print "Failed to add popup menu item!" + return True + + +#print "gen bloc data flow" +#flow_graph = gen_bloc_data_flow_graph(my_ir, bs, ad) +#def node2str(self, n): +# return "%s, %s\\l%s" % n +#flow_graph.node2str = lambda n: node2str(flow_graph, n) +#open('data_flow.txt', 'w').write(flow_graph.dot()) + +# h = GraphMiasmIRFlow(flow_graph, "Miasm IRFlow graph", None) +# h.Show() diff --git a/example/test_jit_arm.py b/example/test_jit_arm.py new file mode 100644 index 00000000..7ccfd447 --- /dev/null +++ b/example/test_jit_arm.py @@ -0,0 +1,69 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- +from argparse import ArgumentParser +from miasm2.analysis import debugging, gdbserver + +from miasm2.arch.arm.arch import mn_arm +from miasm2.jitter.jitload import * + + +parser = ArgumentParser( + description="""Sandbox an elf binary with arm engine +(ex: test_jit_arm.py example/md5_arm A684)""") +parser.add_argument("-r", "--log-regs", + help="Log registers value for each instruction", + action="store_true") +parser.add_argument("-m", "--log-mn", + help="Log desassembly conversion for each instruction", + action="store_true") +parser.add_argument("-n", "--log-newbloc", + help="Log basic blocks processed by the Jitter", + action="store_true") +parser.add_argument("-j", "--jitter", + help="Jitter engine. Possible values are : tcc (default), llvm", + default="tcc") +parser.add_argument("-d", "--debugging", + help="Attach a CLI debugguer to the sandboxed programm", + action="store_true") +parser.add_argument("binary", + help="binary to run") +parser.add_argument("addr", + help="start exec on addr") + + + +def jit_arm_binary(args): + filepath, entryp = args.binary, int(args.addr, 16) + myjit = jitter_arm() + myjit.init_stack() + + # Log level (if available with jitter engine) + myjit.jit.log_regs = args.log_regs + myjit.jit.log_mn = args.log_mn + myjit.jit.log_newbloc = args.log_newbloc + + elf = vm_load_elf(myjit.vm, filepath) + libs = libimp() + preload_elf(myjit.vm, elf, libs) + myjit.add_lib_handler(libs) + myjit.add_breakpoint(0x1337BEEF, lambda _: exit(0)) + regs = myjit.cpu.vm_get_gpreg() + regs['LR'] = 0x1337BEEF + myjit.cpu.vm_set_gpreg(regs) + myjit.init_run(entryp) + + + + # Handle debugging + if args.debugging is True: + dbg = debugging.Debugguer(myjit) + cmd = debugging.DebugCmd(dbg) + cmd.cmdloop() + + else: + print(myjit.continue_run()) + +if __name__ == '__main__': + from sys import stderr + args = parser.parse_args() + jit_arm_binary(args) diff --git a/example/test_jit_x86_32.py b/example/test_jit_x86_32.py new file mode 100644 index 00000000..b26161bc --- /dev/null +++ b/example/test_jit_x86_32.py @@ -0,0 +1,45 @@ +import sys +import os +from optparse import OptionParser +from miasm2.arch.x86.arch import mn_x86 +from miasm2.jitter.jitload import jitter_x86_32 +from miasm2.jitter.jitload import bin_stream_vm +from miasm2.jitter.csts import * + +from pdb import pm + + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +parser = OptionParser(usage="usage: %prog rawfiley arch address [options]") +(options, args) = parser.parse_args(sys.argv[1:]) + +if len(args) < 1: + parser.print_help() + sys.exit(0) + + +def code_sentinelle(jitter): + jitter.run = False + jitter.pc = 0 + return True + + +myjit = jitter_x86_32() +myjit.init_stack() + +fname = args[0] +data = open(fname).read() +run_addr = 0x40000000 +myjit.vm.vm_add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, data) + +myjit.jit.log_regs = True +myjit.jit.log_mn = True +myjit.vm_push_uint32_t(0x1337beef) + +myjit.add_breakpoint(0x1337beef, code_sentinelle) + +myjit.init_run(run_addr) +myjit.continue_run() diff --git a/example/test_symbexec.py b/example/test_symbexec.py new file mode 100644 index 00000000..1eabe824 --- /dev/null +++ b/example/test_symbexec.py @@ -0,0 +1,141 @@ +import sys +import os +from elfesteem import * +from elfesteem.strpatchwork import StrPatchwork +import inspect +import logging +from pdb import pm +import struct +from optparse import OptionParser +from miasm2.expression.expression import * +from miasm2.core import asmbloc + +from miasm2.arch.x86.arch import mn_x86 +from miasm2.jitter.jitload import load_pe_in_vm, load_elf_in_vm, bin_stream_vm, get_import_address_elf +from miasm2.jitter.jitter import updt_bloc_emul +from miasm2.jitter.vm_mngr import * +from miasm2.jitter.arch import Jit_x86 +from miasm2.jitter.arch import Jit_arm +from miasm2.ir.ir2C import init_arch_C + + +from miasm2.core.bin_stream import bin_stream +# from jitter import * +from miasm2.jitter.os_dep import win_api_x86_32 + +from miasm2.ir.symbexec import symbexec + +from miasm2.ir.ir2C import bloc2IR + +from miasm2.arch.x86.regs import * + + +def whoami(): + return inspect.stack()[1][3] + + +log = logging.getLogger("dis") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.INFO) + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + + +parser = OptionParser(usage="usage: %prog [options] file") +parser.add_option('-a', "--address", dest="address", metavar="ADDRESS", + help="force eop address", default=None) +parser.add_option('-m', "--architecture", dest="machine", metavar="MACHINE", + help="architecture to use for disasm: arm, x86_32, x86_64, ppc, java") +parser.add_option('-s', "--segm", dest="usesegm", action="store_true", + help="use segments fs:", default=False) +parser.add_option('-d', "--hdr", dest="loadhdr", action="store_true", + help="load pe hdr", default=False) +parser.add_option( + '-l', "--loadbasedll", dest="loadbasedll", action="store_true", + help="load base dll", default=False) +parser.add_option('-x', "--dumpall", dest="dumpall", action="store_true", + help="load base dll", default=False) +parser.add_option('-e', "--loadmainpe", dest="loadmainpe", action="store_true", + help="load main pe", default=False) + +parser.add_option('-b', "--dumpblocs", dest="dumpblocs", action="store_true", + help="log disasm blogs", default=False) + +parser.add_option('-r', "--parse_resources", dest="parse_resources", + action="store_true", help="parse pe resources", default=False) + +(options, args) = parser.parse_args(sys.argv[1:]) +if not args: + parser.print_help() + sys.exit(0) + + +log.info("import machine...") +mode = None +if options.machine == "arm": + from miasm2.arch.arm.arch import mn_arm as mn +elif options.machine == "sh4": + from miasm2.arch.sh4_arch import mn_sh4 as mn +elif options.machine == "x86_32": + from miasm2.arch.x86.arch import mn_x86 as mn +elif options.machine == "x86_64": + from miasm2.arch.x86.arch import mn_x86 as mn +else: + raise ValueError('unknown machine') +log.info('ok') +machines = {'arm': (mn, 'arm'), + 'sh4': (mn, None), + 'x86_32': (mn, 32), + 'x86_64': (mn, 64), + } + +mn, attrib = machines[options.machine] + +arch2jit = {'x86': Jit_x86, + 'arm': Jit_arm} + +jitarch = arch2jit[mn.name] + +e, in_str, runtime_dll, segm_to_do, symbol_pool, stack_ad = load_pe_in_vm( + mn, args[0], options) +# e, in_str, runtime_dll, segm_to_do, symbol_pool, stack_ad = +# load_elf_in_vm(mn, args[0], options) +init_arch_C(mn) + +win_api_x86_32.winobjs.runtime_dll = runtime_dll +""" +regs = jitarch.vm_get_gpreg() +regs['RSP'] = stack_ad +jitarch.vm_set_gpreg(regs) +""" + +symbol_pool = asmbloc.asm_symbol_pool() +known_blocs = {} +code_blocs_mem_range = [] + + +ad = 0x951DAF +ad = 0x9518C6 +ad = 0x9519FE +symbols_init = {} +for i, r in enumerate(all_regs_ids): + symbols_init[r] = all_regs_ids_init[i] + + +def se_bloc(ad, arch, attrib, sb): + l = asmbloc.asm_label(ad) + b = asmbloc.asm_bloc(l) + job_done = set() + asmbloc.dis_bloc(arch, in_str, b, ad, job_done, symbol_pool, + attrib=attrib) # , lines_wd = 8) + print b + bloc_ir = bloc2IR(arch, attrib, in_str, b, [], symbol_pool) + sb.emulbloc(arch, bloc_ir) + sb.dump_mem() + +sb = symbexec(mn, symbols_init) +se_bloc(ad, mn, attrib, sb) diff --git a/example/unpack_upx.py b/example/unpack_upx.py new file mode 100644 index 00000000..14eac9ef --- /dev/null +++ b/example/unpack_upx.py @@ -0,0 +1,187 @@ +import sys +import os +import inspect +import logging +import struct +from argparse import ArgumentParser + +from elfesteem import pe +from elfesteem import * +from elfesteem.strpatchwork import StrPatchwork + +from miasm2.core import asmbloc +from miasm2.arch.x86.arch import mn_x86 +from miasm2.arch.x86.disasm import dis_x86_32 +from miasm2.jitter.jitload import jitter_x86_32, vm_load_pe, preload_pe, libimp +from miasm2.jitter.jitload import bin_stream_vm +from miasm2.jitter.csts import * +from miasm2.jitter.os_dep import win_api_x86_32 + +# Debug settings # +from pdb import pm + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +# + +# Handle arguments +parser = ArgumentParser(description="Sandbox a PE binary packed with UPX") +parser.add_argument("filename", help="PE binary") +parser.add_argument("-r", "--log-regs", + help="Log registers value for each instruction", + action="store_true") +parser.add_argument("-m", "--log-mn", + help="Log desassembly conversion for each instruction", + action="store_true") +parser.add_argument("-n", "--log-newbloc", + help="Log basic blocks processed by the Jitter", + action="store_true") +parser.add_argument("-j", "--jitter", + help="Jitter engine. Possible values are : tcc (default), llvm", + default="tcc") +parser.add_argument("-g", "--graph", + help="Export the CFG graph in graph.txt", + action="store_true") +parser.add_argument("-v", "--verbose", + help="Verbose mode", + action="store_true") +args = parser.parse_args() + +# Verbose mode +if args.verbose is True: + logging.basicConfig(level=logging.INFO) +else: + logging.basicConfig(level=logging.WARNING) + +# Init arch +myjit = jitter_x86_32(jit_type=args.jitter) +myjit.init_stack() + +# Log level (if available with jitter engine) +myjit.jit.log_regs = args.log_regs +myjit.jit.log_mn = args.log_mn +myjit.jit.log_newbloc = args.log_newbloc + +# Load pe and get entry point address +e = vm_load_pe(myjit.vm, args.filename) +libs = libimp() +preload_pe(myjit.vm, e, libs) + +if args.verbose is True: + myjit.vm.vm_dump_memory_page_pool() +ep = e.rva2virt(e.Opthdr.AddressOfEntryPoint) + +# Ensure there is one and only one leave (for OEP discovering) +mdis = dis_x86_32(myjit.bs) +mdis.dont_dis_nulstart_bloc = True +ab = mdis.dis_multibloc(ep) + +bb = asmbloc.basicblocs(ab) +leaves = bb.get_bad_dst() +assert(len(leaves) == 1) +l = leaves.pop() +logging.info(l) +end_label = l.label.offset + +logging.info('final label') +logging.info(end_label) + +# Export CFG graph (dot format) +if args.graph is True: + g = asmbloc.bloc2graph(ab) + open("graph.txt", "w").write(g) + +# User defined methods + + +def mygetproc(myjit): + global libs + ret_ad, args = myjit.func_args_stdcall(2) + libbase, fname = args + + dst_ad = myjit.cpu.EBX + logging.info('EBX ' + hex(dst_ad)) + + if fname < 0x10000: + fname = fname + else: + fname = myjit.get_str_ansi(fname) + logging.info(fname) + + ad = libs.lib_get_add_func(libbase, fname, dst_ad) + myjit.func_ret_stdcall(ret_ad, ad) + + +def kernel32_GetProcAddress(myjit): + return mygetproc(myjit) + +# Set libs for win_32 api +win_api_x86_32.winobjs.runtime_dll = libs +if args.verbose is True: + myjit.vm.vm_dump_memory_page_pool() + +# Set up stack +myjit.vm_push_uint32_t(1) # reason code if dll +myjit.vm_push_uint32_t(1) # reason code if dll +myjit.vm_push_uint32_t(0x1337beef) + +# Breakpoint callbacks + + +def update_binary(myjit): + e.Opthdr.AddressOfEntryPoint = e.virt2rva(myjit.pc) + logging.info('updating binary') + for s in e.SHList: + sdata = myjit.vm.vm_get_mem(e.rva2virt(s.addr), s.rawsize) + e.virt[e.rva2virt(s.addr)] = sdata + + +# Set callbacks +myjit.add_breakpoint(end_label, update_binary) +myjit.add_lib_handler(libs, globals()) + +# Run until breakpoint is reached +myjit.init_run(ep) +myjit.continue_run() + + +regs = myjit.cpu.vm_get_gpreg() + + +new_dll = [] + + +# XXXXX + +e.SHList.align_sections(0x1000, 0x1000) +logging.info(repr(e.SHList)) +st = StrPatchwork() +st[0] = e.content + +# get back data from emulator +for s in e.SHList: + ad1 = e.rva2virt(s.addr) + ad2 = ad1 + len(s.data) + st[s.offset] = e.virt(ad1, ad2) +# e.content = str(st) + +e.DirRes = pe.DirRes(e) +e.DirImport.impdesc = None +logging.info(repr(e.DirImport.impdesc)) +new_dll = libs.gen_new_lib(e) +logging.info(new_dll) +e.DirImport.impdesc = [] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport)) +logging.info(repr(e.SHList)) +e.DirImport.set_rva(s_myimp.addr) + +# XXXX TODO +e.NThdr.optentries[pe.DIRECTORY_ENTRY_DELAY_IMPORT].rva = 0 + +e.Opthdr.AddressOfEntryPoint = e.virt2rva(end_label) +bname, fname = os.path.split(args.filename) +fname = os.path.join(bname, fname.replace('.', '_')) +open(fname + '_unupx.bin', 'w').write(str(e)) diff --git a/example/x86_32_sc.bin b/example/x86_32_sc.bin new file mode 100644 index 00000000..c1931ce0 --- /dev/null +++ b/example/x86_32_sc.bin @@ -0,0 +1 @@ +I[€ùt[ÿë[‰Øà \ No newline at end of file diff --git a/miasm2/.hg_archival.txt b/miasm2/.hg_archival.txt new file mode 100644 index 00000000..6d5aba4b --- /dev/null +++ b/miasm2/.hg_archival.txt @@ -0,0 +1,5 @@ +repo: 9bf379ebc5306f0ac03e1736966188d062a2723c +node: edd167467676cc9f096d766373001952f178b725 +branch: default +latesttag: asm/dis ok +latesttagdistance: 228 diff --git a/miasm2/.hgtags b/miasm2/.hgtags new file mode 100644 index 00000000..81b57c03 --- /dev/null +++ b/miasm2/.hgtags @@ -0,0 +1,2 @@ +07f301ad2a5a7457fbb350aa50c8084ee1394274 v0.01 +844c086c637a15263bc4aea10a0b2a8efa280062 asm/dis ok diff --git a/miasm2/__init__.py b/miasm2/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/__init__.py diff --git a/miasm2/analysis/__init__.py b/miasm2/analysis/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/analysis/__init__.py diff --git a/miasm2/analysis/data_analysis.py b/miasm2/analysis/data_analysis.py new file mode 100644 index 00000000..cb953399 --- /dev/null +++ b/miasm2/analysis/data_analysis.py @@ -0,0 +1,326 @@ +from miasm2.expression.expression import * +from miasm2.ir.symbexec import symbexec + + +def get_node_name(label, i, n): + # n_name = "%s_%d_%s"%(label.name, i, n) + n_name = (label, i, n) + return n_name + + +def intra_bloc_flow_raw(my_ir, flow_graph, irb): + """ + Create data flow for an irbloc using raw IR expressions + """ + in_nodes = {} + out_nodes = {} + current_nodes = {} + for i, exprs in enumerate(irb.irs): + list_rw = get_list_rw(exprs) + current_nodes.update(out_nodes) + + # gen mem arg to mem node links + all_mems = set() + for nodes_r, nodes_w in list_rw: + for n in nodes_r.union(nodes_w): + all_mems.update(get_expr_mem(n)) + if not all_mems: + continue + + # print [str(x) for x in all_mems] + for n in all_mems: + node_n_w = get_node_name(irb.label, i, n) + if not n in nodes_r: + continue + o_r = n.arg.get_r(mem_read=False, cst_read=True) + for n_r in o_r: + if n_r in current_nodes: + node_n_r = current_nodes[n_r] + else: + node_n_r = get_node_name(irb.label, i, n_r) + current_nodes[n_r] = node_n_r + in_nodes[n_r] = node_n_r + flow_graph.add_uniq_edge(node_n_r, node_n_w) + + # gen data flow links + for nodes_r, nodes_w in list_rw: + for n_r in nodes_r: + if n_r in current_nodes: + node_n_r = current_nodes[n_r] + else: + node_n_r = get_node_name(irb.label, i, n_r) + current_nodes[n_r] = node_n_r + in_nodes[n_r] = node_n_r + + flow_graph.add_node(node_n_r) + for n_w in nodes_w: + node_n_w = get_node_name(irb.label, i + 1, n_w) + out_nodes[n_w] = node_n_w + # current_nodes[n_w] = node_n_w + + flow_graph.add_node(node_n_w) + flow_graph.add_uniq_edge(node_n_r, node_n_w) + irb.in_nodes = in_nodes + irb.out_nodes = out_nodes + + +def intra_bloc_flow_symbexec(my_ir, flow_graph, irb): + """ + Create data flow for an irbloc using symbolic execution + """ + in_nodes = {} + out_nodes = {} + current_nodes = {} + + symbols_init = {} + for r in my_ir.arch.regs.all_regs_ids: + # symbols_init[r] = my_ir.arch.regs.all_regs_ids_init[i] + x = ExprId(r.name, r.size) + x.is_term = True + symbols_init[r] = x + + sb = symbexec(my_ir.arch, dict(symbols_init)) + sb.emulbloc(irb) + # print "*"*40 + # print irb + # print sb.dump_id() + # print sb.dump_mem() + + for n_w in sb.symbols: + # print n_w + v = sb.symbols[n_w] + if n_w in symbols_init and symbols_init[n_w] == v: + continue + read_values = v.get_r(cst_read=True) + # print n_w, v, [str(x) for x in read_values] + node_n_w = get_node_name(irb.label, len(irb.lines), n_w) + + for n_r in read_values: + if n_r in current_nodes: + node_n_r = current_nodes[n_r] + else: + node_n_r = get_node_name(irb.label, 0, n_r) + current_nodes[n_r] = node_n_r + in_nodes[n_r] = node_n_r + + out_nodes[n_w] = node_n_w + flow_graph.add_uniq_edge(node_n_r, node_n_w) + + irb.in_nodes = in_nodes + irb.out_nodes = out_nodes + + +def inter_bloc_flow_link(my_ir, flow_graph, todo, link_exec_to_data): + lbl, current_nodes, exec_nodes = todo + # print 'TODO' + # print lbl + # print [(str(x[0]), str(x[1])) for x in current_nodes] + current_nodes = dict(current_nodes) + + # link current nodes to bloc in_nodes + if not lbl in my_ir.blocs: + print "cannot find bloc!!", lbl + return set() + irb = my_ir.blocs[lbl] + # pp(('IN', lbl, [(str(x[0]), str(x[1])) for x in current_nodes.items()])) + to_del = set() + for n_r, node_n_r in irb.in_nodes.items(): + if not n_r in current_nodes: + continue + # print 'add link', current_nodes[n_r], node_n_r + flow_graph.add_uniq_edge(current_nodes[n_r], node_n_r) + to_del.add(n_r) + + # if link exec to data, all nodes depends on exec nodes + if link_exec_to_data: + for n_x_r in exec_nodes: + for n_r, node_n_r in irb.in_nodes.items(): + if not n_x_r in current_nodes: + continue + if isinstance(n_r, ExprInt): + continue + flow_graph.add_uniq_edge(current_nodes[n_x_r], node_n_r) + + # update current nodes using bloc out_nodes + for n_w, node_n_w in irb.out_nodes.items(): + current_nodes[n_w] = node_n_w + + # get nodes involved in exec flow + x_nodes = tuple(sorted(list(irb.dst.get_r()))) + + todo = set() + for lbl_dst in my_ir.g.successors(irb.label): + todo.add((lbl_dst, tuple(current_nodes.items()), x_nodes)) + + # pp(('OUT', lbl, [(str(x[0]), str(x[1])) for x in current_nodes.items()])) + + return todo + + +def create_implicit_flow(my_ir, flow_graph): + + # first fix IN/OUT + # If a son read a node which in not in OUT, add it + todo = set(my_ir.blocs.keys()) + while todo: + lbl = todo.pop() + irb = my_ir.blocs[lbl] + for lbl_son in my_ir.g.successors(irb.label): + if not lbl_son in my_ir.blocs: + print "cannot find bloc!!", lbl + continue + irb_son = my_ir.blocs[lbl_son] + for n_r in irb_son.in_nodes: + if n_r in irb.out_nodes: + continue + if not isinstance(n_r, ExprId): + continue + + # print "###", n_r + # print "###", irb + # print "###", 'OUT', [str(x) for x in irb.out_nodes] + # print "###", irb_son + # print "###", 'IN', [str(x) for x in irb_son.in_nodes] + + node_n_w = irb.label, len(irb.lines), n_r + irb.out_nodes[n_r] = node_n_w + if not n_r in irb.in_nodes: + irb.in_nodes[n_r] = irb.label, 0, n_r + node_n_r = irb.in_nodes[n_r] + # print "###", node_n_r + for lbl_p in my_ir.g.predecessors(irb.label): + todo.add(lbl_p) + + flow_graph.add_uniq_edge(node_n_r, node_n_w) + + +def inter_bloc_flow(my_ir, flow_graph, irb_0, link_exec_to_data=True): + + todo = set() + done = set() + todo.add((irb_0, (), ())) + + while todo: + state = todo.pop() + if state in done: + continue + done.add(state) + out = inter_bloc_flow_link(my_ir, flow_graph, state, link_exec_to_data) + todo.update(out) + + +class symb_exec_func: + + """ + This algorithm will do symbolic execution on a function, trying to propagate + states between basic blocs in order to extract inter-blocs dataflow. The + algorithm tries to merge states from blocs with multiple parents. + + There is no real magic here, loops and complex merging will certainly fail. + """ + + def __init__(self, my_ir): + self.todo = set() + self.stateby_ad = {} + self.cpt = {} + self.states_var_done = set() + self.states_done = set() + self.total_done = 0 + self.my_ir = my_ir + + def add_state(self, parent, ad, state): + variables = dict(state.symbols.items()) + + # get bloc dead, and remove from state + b = self.my_ir.get_bloc(ad) + if b is None: + raise ValueError("unknown bloc! %s" % ad) + """ + dead = b.dead[0] + for d in dead: + if d in variables: + del(variables[d]) + """ + variables = variables.items() + + s = parent, ad, tuple(sorted(variables)) + """ + state_var = s[1] + if s in self.states_var_done: + print 'skip state' + return + if not ad in self.stateby_ad: + self.stateby_ad[ad] = set() + self.stateby_ad[ad].add(state_var) + + """ + self.todo.add(s) + + """ + if not ad in self.cpt: + self.cpt[ad] = 0 + """ + """ + def get_next_min(self): + state_by_ad = {} + for state in self.todo: + ad = state[1] + if not ad in state_by_ad: + state_by_ad[ad] = [] + state_by_ad[ad].append(state) + print "XX", [len(x) for x in state_by_ad.values()] + state_by_ad = state_by_ad.items() + state_by_ad.sort(key=lambda x:len(x[1])) + state_by_ad.reverse() + return state_by_ad.pop()[1][0] + """ + + def get_next_state(self): + state = self.todo.pop() + return state + + def do_step(self): + if len(self.todo) == 0: + return None + if self.total_done > 600: + print "symbexec watchdog!" + return None + self.total_done += 1 + print 'CPT', self.total_done + while self.todo: + # if self.total_done>20: + # self.get_next_min() + # state = self.todo.pop() + state = self.get_next_state() + parent, ad, s = state + self.states_done.add(state) + self.states_var_done.add(state) + # if s in self.states_var_done: + # print "state done" + # continue + + sb = symbexec(self.my_ir.arch, dict(s)) + """ + if (not is_dispatcher(ad)) and len(self.stateby_ad[ad]) > 10: + print "DROP", ad + continue + + if (not is_dispatcher(ad)) and len(self.stateby_ad[ad]) > 5: + print ad + big_keys = diff_states(*self.stateby_ad[ad]) + print big_keys + print "MERGE", ad + + if not big_keys: + return parent, sb + #assert(len(big_keys) == 1) + s_out = [] + for k, v in s: + if k not in big_keys : + s_out.append((k, v)) + sb = symbexec(mn, dict(s_out)) + return parent, ad, sb + #diff_states(*self.stateby_ad[ad]) + """ + return parent, ad, sb + return None diff --git a/miasm2/analysis/debugging.py b/miasm2/analysis/debugging.py new file mode 100644 index 00000000..473f20f1 --- /dev/null +++ b/miasm2/analysis/debugging.py @@ -0,0 +1,479 @@ +import cmd +from miasm2.core.utils import hexdump +import miasm2.jitter.csts as csts +from miasm2.jitter.jitload import ExceptionHandle + + +class DebugBreakpoint: + + "Debug Breakpoint parent class" + pass + + +class DebugBreakpointSoft(DebugBreakpoint): + + "Stand for software breakpoint" + + def __init__(self, addr): + self.addr = addr + + def __str__(self): + return "Soft BP @0x%08x" % self.addr + + +class DebugBreakpointMemory(DebugBreakpoint): + + "Stand for memory breakpoint" + + type2str = {csts.BREAKPOINT_READ: "R", + csts.BREAKPOINT_WRITE: "W"} + + def __init__(self, addr, size, access_type): + self.addr = addr + self.access_type = access_type + self.size = size + + def __str__(self): + bp_type = "" + for k, v in self.type2str.items(): + if k & self.access_type != 0: + bp_type += v + return "Memory BP @0x%08x, Size 0x%08x, Type %s" % (self.addr, + self.size, + bp_type) + + @classmethod + def get_access_type(cls, read=False, write=False): + value = 0 + for k, v in cls.type2str.items(): + if v == "R" and read is True: + value += k + if v == "W" and write is True: + value += k + return value + + +class Debugguer(object): + + "Debugguer linked with a Jitter instance" + + def __init__(self, myjit): + "myjit : jitter instance" + self.myjit = myjit + self.bp_list = [] # DebugBreakpointSoft list + self.hw_bp_list = [] # DebugBreakpointHard list + self.mem_watched = [] # Memory areas watched + + def init_run(self, addr): + self.myjit.init_run(addr) + + def add_breakpoint(self, addr): + "Add bp @addr" + bp = DebugBreakpointSoft(addr) + func = lambda x: bp + bp.func = func + self.bp_list.append(bp) + self.myjit.add_breakpoint(addr, func) + + def init_memory_breakpoint(self): + "Set exception handler on EXCEPT_BREAKPOINT_INTERN" + self.myjit.exception_handler + + def add_memory_breakpoint(self, addr, size, read=False, write=False): + "add mem bp @[addr, addr + size], on read/write/both" + access_type = DebugBreakpointMemory.get_access_type(read=read, + write=write) + dbm = DebugBreakpointMemory(addr, size, access_type) + self.hw_bp_list.append(dbm) + self.myjit.vm.vm_add_memory_breakpoint(addr, size, access_type) + + def remove_breakpoint(self, dbs): + "remove the DebugBreakpointSoft instance" + self.bp_list.remove(dbs) + self.myjit.remove_breakpoints_by_callback(dbs.func) + + def remove_breakpoint_by_addr(self, addr): + "remove breakpoints @ addr" + for bp in self.get_breakpoint_by_addr(addr): + self.remove_breakpoint(bp) + + def remove_memory_breakpoint(self, dbm): + "remove the DebugBreakpointMemory instance" + self.hw_bp_list.remove(dbm) + self.myjit.vm.vm_remove_memory_breakpoint(dbm.addr, dbm.access_type) + + def remove_memory_breakpoint_by_addr_access(self, addr, read=False, + write=False): + "remove breakpoints @ addr" + access_type = DebugBreakpointMemory.get_access_type(read=read, + write=write) + for bp in self.hw_bp_list: + if bp.addr == addr and bp.access_type == access_type: + self.remove_memory_breakpoint(bp) + + def get_breakpoint_by_addr(self, addr): + ret = [] + for dbgsoft in self.bp_list: + if dbgsoft.addr == addr: + ret.append(dbgsoft) + return ret + + def get_breakpoints(self): + return self.bp_list + + def active_trace(self, mn=None, regs=None, newbloc=None): + if mn is not None: + self.myjit.jit.log_mn = mn + if regs is not None: + self.myjit.jit.log_regs = regs + if newbloc is not None: + self.myjit.jit.log_newbloc = newbloc + + def handle_exception(self, res): + if res is None: + return + + if isinstance(res, DebugBreakpointSoft): + print "Breakpoint reached @0x%08x" % res.addr + elif isinstance(res, ExceptionHandle): + if res == ExceptionHandle.memoryBreakpoint(): + print "Memory breakpoint reached!" + + # Remove flag + except_flag = self.myjit.vm.vm_get_exception() + self.myjit.vm.vm_set_exception(except_flag ^ res.except_flag) + + else: + raise NotImplementedError("Unknown Except") + else: + raise NotImplementedError("type res") + + def step(self): + "Step in jit" + + self.myjit.jit.set_options(jit_maxline=1) + self.myjit.jit.updt_automod_code(self.myjit.vm, self.myjit.pc, 8) + + res = self.myjit.continue_run(step=True) + self.handle_exception(res) + + self.myjit.jit.set_options(jit_maxline=50) + self.on_step() + + return res + + def run(self): + res = self.myjit.continue_run() + self.handle_exception(res) + return res + + def get_mem(self, addr, size=0xF): + "hexdump @addr, size" + + hexdump(self.myjit.vm.vm_get_mem(addr, size)) + + def get_mem_raw(self, addr, size=0xF): + "hexdump @addr, size" + return self.myjit.vm.vm_get_mem(addr, size) + + def watch_mem(self, addr, size=0xF): + self.mem_watched.append((addr, size)) + + def on_step(self): + for addr, size in self.mem_watched: + print "@0x%08x:" % addr + self.get_mem(addr, size) + + def get_reg_value(self, reg_name): + return getattr(self.myjit.cpu, reg_name) + + def set_reg_value(self, reg_name, value): + + # Handle PC case + if reg_name == self.myjit.my_ir.pc.name: + self.init_run(value) + + setattr(self.myjit.cpu, reg_name, value) + + def get_gpreg_all(self): + "Return general purposes registers" + return self.myjit.cpu.vm_get_gpreg() + + +class DebugCmd(cmd.Cmd, object): + + "CommandLineInterpreter for Debugguer instance" + + color_g = '\033[92m' + color_e = '\033[0m' + color_b = '\033[94m' + color_r = '\033[91m' + + intro = color_g + "=== Miasm2 Debugging shell ===\nIf you need help, " + intro += "type 'help' or '?'" + color_e + prompt = color_b + "$> " + color_e + + def __init__(self, dbg): + "dbg : Debugguer" + self.dbg = dbg + super(DebugCmd, self).__init__() + + # Debug methods + + def print_breakpoints(self): + bp_list = self.dbg.bp_list + if len(bp_list) == 0: + print "No breakpoints." + else: + for i, b in enumerate(bp_list): + print "%d\t0x%08x" % (i, b.addr) + + def print_watchmems(self): + watch_list = self.dbg.mem_watched + if len(watch_list) == 0: + print "No memory watchpoints." + else: + print "Num\tAddress \tSize" + for i, w in enumerate(watch_list): + addr, size = w + print "%d\t0x%08x\t0x%08x" % (i, addr, size) + + def print_registers(self): + regs = self.dbg.get_gpreg_all() + + # Display settings + title1 = "Registers" + title2 = "Values" + max_name_len = max(map(len, regs.keys() + [title1])) + + # Print value table + s = "%s%s | %s" % ( + title1, " " * (max_name_len - len(title1)), title2) + print s + print "-" * len(s) + for name, value in sorted(regs.items(), key=lambda x: x[0]): + print "%s%s | %s" % (name, + " " * (max_name_len - len(name)), + hex(value).replace("L", "")) + + def add_breakpoints(self, bp_addr): + for addr in bp_addr: + if "0x" in addr: + addr = int(addr, 16) + else: + addr = int(addr) + + good = True + for i, dbg_obj in enumerate(self.dbg.bp_list): + if dbg_obj.addr == addr: + good = False + break + if good is False: + print "Breakpoint 0x%08x already set (%d)" % (addr, i) + else: + l = len(self.dbg.bp_list) + self.dbg.add_breakpoint(addr) + print "Breakpoint 0x%08x successfully added ! (%d)" % (addr, l) + + display_mode = {"mn": None, + "regs": None, + "newbloc": None} + + def update_display_mode(self): + self.display_mode = {"mn": self.dbg.myjit.jit.log_mn, + "regs": self.dbg.myjit.jit.log_regs, + "newbloc": self.dbg.myjit.jit.log_newbloc} + + # Command line methods + def print_warning(self, s): + print self.color_r + s + self.color_e + + def onecmd(self, line): + cmd_translate = {"h": "help", + "q": "exit", + "e": "exit", + "!": "exec", + "r": "run", + "i": "info", + "b": "breakpoint", + "s": "step", + "d": "dump"} + + if len(line) >= 2 and \ + line[1] == " " and \ + line[:1] in cmd_translate: + line = cmd_translate[line[:1]] + line[1:] + + if len(line) == 1 and line in cmd_translate: + line = cmd_translate[line] + + r = super(DebugCmd, self).onecmd(line) + return r + + def can_exit(self): + return True + + def do_display(self, arg): + if arg == "": + self.help_display() + return + + args = arg.split(" ") + if args[-1].lower() not in ["on", "off"]: + self.print_warning("/!\ %s not in 'on' / 'off'" % args[-1]) + return + mode = args[-1].lower() == "on" + d = {} + for a in args[:-1]: + d[a] = mode + self.dbg.active_trace(**d) + self.update_display_mode() + + def help_display(self): + print "Enable/Disable tracing." + print "Usage: display <mode1> <mode2> ... on|off" + print "Available modes are:" + for k in self.display_mode: + print "\t%s" % k + print "Use 'info display' to get current values" + + def do_watchmem(self, arg): + if arg == "": + self.help_watchmem() + return + + args = arg.split(" ") + if len(args) >= 2: + if "0x" in args[1]: + size = int(args[1], 16) + else: + size = int(args[1]) + else: + size = 0xF + if "0x" in args[0]: + addr = int(args[0], 16) + else: + addr = int(args[0]) + + self.dbg.watch_mem(addr, size) + + def help_watchmem(self): + print "Add a memory watcher." + print "Usage: watchmem <addr> [size]" + print "Use 'info watchmem' to get current memory watchers" + + def do_info(self, arg): + av_info = ["registers", + "display", + "breakpoints", + "watchmem"] + + if arg == "": + print "'info' must be followed by the name of an info command." + print "List of info subcommands:" + for k in av_info: + print "\t%s" % k + + if arg.startswith("b"): + # Breakpoint + self.print_breakpoints() + + if arg.startswith("d"): + # Display + self.update_display_mode() + for k, v in self.display_mode.items(): + print "%s\t\t%s" % (k, v) + + if arg.startswith("w"): + # Watchmem + self.print_watchmems() + + if arg.startswith("r"): + # Registers + self.print_registers() + + def help_info(self): + print "Generic command for showing things about the program being" + print "debugged. Use 'info' without arguments to get the list of" + print "available subcommands." + + def do_breakpoint(self, arg): + if arg == "": + self.help_breakpoint() + else: + addrs = arg.split(" ") + self.add_breakpoints(addrs) + + def help_breakpoint(self): + print "Add breakpoints to argument addresses." + print "Example:" + print "\tbreakpoint 0x11223344" + print "\tbreakpoint 1122 0xabcd" + + def do_step(self, arg): + if arg == "": + nb = 1 + else: + nb = int(arg) + for _ in xrange(nb): + self.dbg.step() + + def help_step(self): + print "Step program until it reaches a different source line." + print "Argument N means do this N times (or till program stops" + print "for another reason)." + + def do_dump(self, arg): + if arg == "": + self.help_dump() + else: + args = arg.split(" ") + if len(args) >= 2: + if "0x" in args[1]: + size = int(args[1], 16) + else: + size = int(args[1]) + else: + size = 0xF + if "0x" in args[0]: + addr = int(args[0], 16) + else: + addr = int(args[0]) + + self.dbg.get_mem(addr, size) + + def help_dump(self): + print "Dump <addr> [size]. Dump size bytes at addr." + + def do_run(self, arg): + self.dbg.run() + + def help_run(self): + print "Launch or continue the current program" + + def do_exit(self, s): + return True + + def do_exec(self, l): + try: + print eval(l) + except Exception, e: + print "*** Error: %s" % e + + def help_exec(self): + print "Exec a python command." + print "You can also use '!' shortcut." + + def help_exit(self): + print "Exit the interpreter." + print "You can also use the Ctrl-D shortcut." + + def help_help(self): + print "Print help" + + def postloop(self): + print '\nGoodbye !' + super(DebugCmd, self).postloop() + + do_EOF = do_exit + help_EOF = help_exit diff --git a/miasm2/analysis/disasm_cb.py b/miasm2/analysis/disasm_cb.py new file mode 100644 index 00000000..4b4832f8 --- /dev/null +++ b/miasm2/analysis/disasm_cb.py @@ -0,0 +1,137 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from miasm2.core.asmbloc import * +from miasm2.core.utils import * +# from miasm2.core.graph import DiGraph + + +def get_ira(mnemo, attrib): + arch = mnemo.name, attrib + if arch == ("arm", "arm"): + from miasm2.arch.arm.ira import ir_a_arm_base as ira + elif arch == ("x86", 32): + from miasm2.arch.x86.ira import ir_a_x86_32 as ira + elif arch == ("x86", 64): + from miasm2.arch.x86.ira import ir_a_x86_64 as ira + else: + raise ValueError('unknown architecture: %s' % mnemo.name) + return ira + + +def arm_guess_subcall( + mnemo, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + ira = get_ira(mnemo, attrib) + + sp = asm_symbol_pool() + my_ir = ira(sp) + print '###' + print cur_bloc + my_ir.add_bloc(cur_bloc) + + ir_blocs = my_ir.blocs.values() + # flow_graph = DiGraph() + to_add = set() + for irb in ir_blocs: + # print 'X'*40 + # print irb + pc_val = None + lr_val = None + for exprs in irb.irs: + for e in exprs: + if e.dst == my_ir.pc: + pc_val = e.src + if e.dst == mnemo.regs.LR: + lr_val = e.src + if pc_val is None or lr_val is None: + continue + if not isinstance(lr_val, ExprInt): + continue + + l = cur_bloc.lines[-1] + if lr_val.arg != l.offset + l.l: + continue + # print 'IS CALL!' + l = symbol_pool.getby_offset_create(int(lr_val.arg)) + c = asm_constraint_next(l) + + to_add.add(c) + offsets_to_dis.add(int(lr_val.arg)) + + # if to_add: + # print 'R'*70 + for c in to_add: + # print c + cur_bloc.addto(c) + + +def arm_guess_jump_table( + mnemo, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + ira = get_ira(mnemo, attrib) + + jra = ExprId('jra') + jrb = ExprId('jrb') + + sp = asm_symbol_pool() + my_ir = ira(sp) + my_ir.add_bloc(cur_bloc) + + ir_blocs = my_ir.blocs.values() + for irb in ir_blocs: + # print 'X'*40 + # print irb + pc_val = None + # lr_val = None + for exprs in irb.irs: + for e in exprs: + if e.dst == my_ir.pc: + pc_val = e.src + # if e.dst == mnemo.regs.LR: + # lr_val = e.src + if pc_val is None: + continue + if not isinstance(pc_val, ExprMem): + continue + assert(pc_val.size == 32) + print pc_val + ad = pc_val.arg + ad = expr_simp(ad) + print ad + res = MatchExpr(ad, jra + jrb, set([jra, jrb])) + if res is False: + raise NotImplementedError('not fully functional') + print res + if not isinstance(res[jrb], ExprInt): + raise NotImplementedError('not fully functional') + base_ad = int(res[jrb].arg) + print base_ad + addrs = set() + i = -1 + max_table_entry = 10000 + max_diff_addr = 0x100000 # heuristic + while i < max_table_entry: + i += 1 + try: + ad = upck32(pool_bin.getbytes(base_ad + 4 * i, 4)) + except: + break + if abs(ad - base_ad) > max_diff_addr: + break + addrs.add(ad) + print [hex(x) for x in addrs] + + for ad in addrs: + offsets_to_dis.add(ad) + l = symbol_pool.getby_offset_create(ad) + c = asm_constraint_to(l) + cur_bloc.addto(c) + +guess_funcs = [] + + +def guess_multi_cb( + mnemo, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + for f in guess_funcs: + f(mnemo, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool) diff --git a/miasm2/analysis/gdbserver.py b/miasm2/analysis/gdbserver.py new file mode 100644 index 00000000..8d0135e9 --- /dev/null +++ b/miasm2/analysis/gdbserver.py @@ -0,0 +1,425 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import socket +import struct +import time +import logging +from StringIO import StringIO +import miasm2.analysis.debugging as debugging +from miasm2.jitter.jitload import ExceptionHandle + + +class GdbServer(object): + + "Debugguer binding for GDBServer protocol" + + general_registers_order = [] + general_registers_size = {} # RegName : Size in octet + status = "S05" + + def __init__(self, dbg, port=4455): + server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) + server.bind(('localhost', port)) + server.listen(1) + self.server = server + self.dbg = dbg + + # Communication methods + + def compute_checksum(self, data): + return chr(sum(map(ord, data)) % 256).encode("hex") + + def get_messages(self): + all_data = "" + data = self.sock.recv(4096) + all_data += data + while (len(data) == 4096 or data == ""): + if data == "": + # Avoid consuming CPU + time.sleep(0.001) + continue + data = self.sock.recv(4096) + all_data += data + + logging.debug("<- %r" % all_data) + self.recv_queue += self.parse_messages(all_data) + + def parse_messages(self, data): + buf = StringIO(data) + + msgs = [] + + while (buf.tell() < buf.len): + token = buf.read(1) + if token == "+": + continue + if token == "-": + raise NotImplementedError("Resend packet") + if token == "$": + packet_data = "" + c = buf.read(1) + while c != "#": + packet_data += c + c = buf.read(1) + checksum = buf.read(2) + if checksum != self.compute_checksum(packet_data): + raise ValueError("Incorrect checksum") + + msgs.append(packet_data) + + return msgs + + def send_string(self, s): + self.send_queue.append("O" + s.encode("hex")) + + def process_messages(self): + + while self.recv_queue: + msg = self.recv_queue.pop(0) + buf = StringIO(msg) + msg_type = buf.read(1) + + self.send_queue.append("+") + + if msg_type == "q": + if msg.startswith("qSupported"): + self.send_queue.append("PacketSize=3fff") + elif msg.startswith("qC"): + # Current thread + self.send_queue.append("") + elif msg.startswith("qAttached"): + # Not supported + self.send_queue.append("") + elif msg.startswith("qTStatus"): + # Not supported + self.send_queue.append("") + elif msg.startswith("qfThreadInfo"): + # Not supported + self.send_queue.append("") + else: + raise NotImplementedError() + + elif msg_type == "H": + # Set current thread + self.send_queue.append("OK") + + elif msg_type == "?": + # Report why the target halted + self.send_queue.append(self.status) # TRAP signal + + elif msg_type == "g": + # Report all general register values + self.send_queue.append(self.report_general_register_values()) + + elif msg_type == "p": + # Read a specific register + reg_num = int(buf.read(), 16) + self.send_queue.append(self.read_register(reg_num)) + + elif msg_type == "P": + # Set a specific register + reg_num, value = buf.read().split("=") + reg_num = int(reg_num, 16) + value = int(value.decode("hex")[::-1].encode("hex"), 16) + self.set_register(reg_num, value) + self.send_queue.append("OK") + + elif msg_type == "m": + # Read memory + addr, size = map(lambda x: int(x, 16), buf.read().split(",")) + self.send_queue.append(self.read_memory(addr, size)) + + elif msg_type == "k": + # Kill + self.sock.close() + exit(1) + + elif msg_type == "!": + # Extending debugging will be used + self.send_queue.append("OK") + + elif msg_type == "v": + if msg == "vCont?": + # Is vCont supported ? + self.send_queue.append("") + + elif msg_type == "s": + # Step + self.dbg.step() + self.send_queue.append("S05") # TRAP signal + + elif msg_type == "Z": + # Add breakpoint or watchpoint + bp_type = buf.read(1) + if bp_type == "0": + # Exec breakpoint + assert(buf.read(1) == ",") + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + + if size != 1: + raise NotImplementedError("Bigger size") + self.dbg.add_breakpoint(addr) + self.send_queue.append("OK") + + elif bp_type == "1": + # Hardware BP + assert(buf.read(1) == ",") + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + + self.dbg.add_memory_breakpoint(addr, size, + read=True, + write=True) + self.send_queue.append("OK") + + elif bp_type in ["2", "3", "4"]: + # Memory breakpoint + assert(buf.read(1) == ",") + read = bp_type in ["3", "4"] + write = bp_type in ["2", "4"] + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + + self.dbg.add_memory_breakpoint(addr, size, + read=read, + write=write) + self.send_queue.append("OK") + + else: + raise ValueError("Impossible value") + + elif msg_type == "z": + # Remove breakpoint or watchpoint + bp_type = buf.read(1) + if bp_type == "0": + # Exec breakpoint + assert(buf.read(1) == ",") + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + + if size != 1: + raise NotImplementedError("Bigger size") + dbgsoft = self.dbg.get_breakpoint_by_addr(addr) + assert(len(dbgsoft) == 1) + self.dbg.remove_breakpoint(dbgsoft[0]) + self.send_queue.append("OK") + + elif bp_type == "1": + # Hardware BP + assert(buf.read(1) == ",") + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + self.dbg.remove_memory_breakpoint_by_addr_access( + addr, read=True, write=True) + self.send_queue.append("OK") + + elif bp_type in ["2", "3", "4"]: + # Memory breakpoint + assert(buf.read(1) == ",") + read = bp_type in ["3", "4"] + write = bp_type in ["2", "4"] + addr, size = map( + lambda x: int(x, 16), buf.read().split(",")) + + self.dbg.remove_memory_breakpoint_by_addr_access( + addr, read=read, write=write) + self.send_queue.append("OK") + + else: + raise ValueError("Impossible value") + + elif msg_type == "c": + # Continue + self.status = "" + self.send_messages() + ret = self.dbg.run() + if isinstance(ret, debugging.DebugBreakpointSoft): + self.status = "S05" + self.send_queue.append("S05") # TRAP signal + elif isinstance(ret, ExceptionHandle): + if ret == ExceptionHandle.memoryBreakpoint(): + self.status = "S05" + self.send_queue.append("S05") + else: + raise NotImplementedError("Unknown Except") + else: + raise NotImplementedError() + + else: + raise NotImplementedError( + "Not implemented: message type '%s'" % msg_type) + + def send_messages(self): + for msg in self.send_queue: + if msg == "+": + data = "+" + else: + data = "$%s#%s" % (msg, self.compute_checksum(msg)) + logging.debug("-> %r" % data) + self.sock.send(data) + self.send_queue = [] + + def main_loop(self): + self.recv_queue = [] + self.send_queue = [] + + self.send_string("Test\n") + + while (self.sock): + self.get_messages() + self.process_messages() + self.send_messages() + + def run(self): + self.sock, self.address = self.server.accept() + self.main_loop() + + # Debugguer processing methods + def report_general_register_values(self): + s = "" + for i in xrange(len(self.general_registers_order)): + s += self.read_register(i) + return s + + def read_register(self, reg_num): + reg_name = self.general_registers_order[reg_num] + reg_value = self.read_register_by_name(reg_name) + size = self.general_registers_size[reg_name] + + pack_token = "" + if size == 1: + pack_token = "<B" + elif size == 2: + pack_token = "<H" + elif size == 4: + pack_token = "<I" + elif size == 8: + pack_token = "<Q" + else: + raise NotImplementedError("Unknown size") + + return struct.pack(pack_token, reg_value).encode("hex") + + def set_register(self, reg_num, value): + reg_name = self.general_registers_order[reg_num] + self.dbg.set_reg_value(reg_name, value) + + def read_register_by_name(self, reg_name): + return self.dbg.get_reg_value(reg_name) + + def read_memory(self, addr, size): + except_flag_vm = self.dbg.myjit.vm.vm_get_exception() + try: + return self.dbg.get_mem_raw(addr, size).encode("hex") + except RuntimeError: + self.dbg.myjit.vm.vm_set_exception(except_flag_vm) + return "00" * size + + +class GdbServer_x86_32(GdbServer): + + "Extend GdbServer for x86 32bits purposes" + + general_registers_order = ["EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", + "EDI", "EIP", "EFLAGS", "CS", "SS", "DS", "ES", + "FS", "GS"] + + general_registers_size = {"EAX": 4, + "ECX": 4, + "EDX": 4, + "EBX": 4, + "ESP": 4, + "EBP": 4, + "ESI": 4, + "EDI": 4, + "EIP": 4, + "EFLAGS": 2, + "CS": 2, + "SS": 2, + "DS": 2, + "ES": 2, + "FS": 2, + "GS": 2} + + register_ignore = [ + "tf", "i_f", "nt", "rf", "vm", "ac", "vif", "vip", "i_d"] + + def read_register_by_name(self, reg_name): + sup_func = super(GdbServer_x86_32, self).read_register_by_name + if reg_name == "EFLAGS": + val = 0 + eflags_args = [ + "cf", 1, "pf", 0, "af", 0, "zf", "nf", "tf", "i_f", "df", "of"] + eflags_args += ["nt", 0, "rf", "vm", "ac", "vif", "vip", "i_d"] + eflags_args += [0] * 10 + + for i, arg in enumerate(eflags_args): + if isinstance(arg, str): + if arg not in self.register_ignore: + to_add = sup_func(arg) + else: + to_add = 0 + else: + to_add = arg + + val |= (to_add << i) + return val + else: + return sup_func(reg_name) + + +class GdbServer_msp430(GdbServer): + + "Extend GdbServer for msp430 purposes" + + general_registers_order = ["PC", "SP", "SR", "R3", "R4", "R5", "R6", "R7", + "R8", "R9", "R10", "R11", "R12", "R13", "R14", + "R15"] + + general_registers_size = {"PC": 2, + "SP": 2, + "SR": 2, + "R3": 2, + "R2": 2, + "R5": 2, + "R6": 2, + "R7": 2, + "R8": 2, + "R9": 2, + "R10": 2, + "R11": 2, + "R12": 2, + "R13": 2, + "R12": 2, + "R15": 2} + + def read_register_by_name(self, reg_name): + sup_func = super(GdbServer_msp430, self).read_register_by_name + if reg_name == "SR": + o = sup_func('res') + o <<= 1 + o |= sup_func('of') + o <<= 1 + o |= sup_func('scg1') + o <<= 1 + o |= sup_func('scg0') + o <<= 1 + o |= sup_func('osc') + o <<= 1 + o |= sup_func('cpuoff') + o <<= 1 + o |= sup_func('gie') + o <<= 1 + o |= sup_func('nf') + o <<= 1 + o |= sup_func('zf') + o <<= 1 + o |= sup_func('cf') + + return o + else: + return sup_func(reg_name) + diff --git a/miasm2/arch/__init__.py b/miasm2/arch/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/arch/__init__.py diff --git a/miasm2/arch/arm/__init__.py b/miasm2/arch/arm/__init__.py new file mode 100644 index 00000000..bbad893b --- /dev/null +++ b/miasm2/arch/arm/__init__.py @@ -0,0 +1 @@ +__all__ = ["arch", "disasm", "regs", "sem"] diff --git a/miasm2/arch/arm/arch.py b/miasm2/arch/arm/arch.py new file mode 100644 index 00000000..3c219710 --- /dev/null +++ b/miasm2/arch/arm/arch.py @@ -0,0 +1,2168 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import logging +from pyparsing import * +from miasm2.expression.expression import * +from miasm2.core.cpu import * +from collections import defaultdict +from miasm2.core.bin_stream import bin_stream +import regs as regs_module +from regs import * + +# A1 encoding + +log = logging.getLogger("armdis") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.DEBUG) + +# arm regs ############## +reg_dum = ExprId('DumReg') + +gen_reg('PC', globals()) + +# GP +regs_str = ['R%d' % r for r in xrange(0x10)] +regs_str[13] = 'SP' +regs_str[14] = 'LR' +regs_str[15] = 'PC' +regs_expr = [ExprId(x, 32) for x in regs_str] + +gpregs = reg_info(regs_str, regs_expr) + +gpregs_pc = reg_info(regs_str[-1:], regs_expr[-1:]) +gpregs_sp = reg_info(regs_str[13:14], regs_expr[13:14]) + +gpregs_nosppc = reg_info(regs_str[:13] + [str(reg_dum), regs_str[14]], + regs_expr[:13] + [reg_dum, regs_expr[14]]) + + +# psr +sr_flags = "cxsf" +cpsr_regs_str = [] +spsr_regs_str = [] +for i in xrange(0x10): + o = "" + for j in xrange(4): + if i & (1 << j): + o += sr_flags[j] + cpsr_regs_str.append("CPSR_%s" % o) + spsr_regs_str.append("SPSR_%s" % o) + +# psr_regs_str = ['CPSR', 'SPSR'] +# psr_regs_expr = [ExprId(x, 32) for x in psr_regs_str] + +# psr_regs = reg_info(psr_regs_str, psr_regs_expr) + +cpsr_regs_expr = [ExprId(x, 32) for x in cpsr_regs_str] +spsr_regs_expr = [ExprId(x, 32) for x in spsr_regs_str] + +cpsr_regs = reg_info(cpsr_regs_str, cpsr_regs_expr) +spsr_regs = reg_info(spsr_regs_str, spsr_regs_expr) + +# CP +cpregs_str = ['c%d' % r for r in xrange(0x10)] +cpregs_expr = [ExprId(x) for x in cpregs_str] + +cp_regs = reg_info(cpregs_str, cpregs_expr) + +# P +pregs_str = ['p%d' % r for r in xrange(0x10)] +pregs_expr = [ExprId(x) for x in pregs_str] + +p_regs = reg_info(pregs_str, pregs_expr) + + +# parser helper ########### + +def tok_reg_duo(s, l, t): + t = t[0] + i1 = gpregs.expr.index(t[0]) + i2 = gpregs.expr.index(t[1]) + o = [] + for i in xrange(i1, i2 + 1): + o.append(gpregs.expr[i]) + return o + +LPARENTHESIS = Literal("(") +RPARENTHESIS = Literal(")") + +LACC = Suppress(Literal("{")) +RACC = Suppress(Literal("}")) +MINUS = Suppress(Literal("-")) +CIRCUNFLEX = Literal("^") + + +def check_bounds(left_bound, right_bound, value): + if left_bound <= value and value <= right_bound: + return ExprInt32(value) + else: + raise ValueError('shift operator immediate value out of bound') + +int_1_31 = str_int.copy().setParseAction(lambda v: check_bounds(1, 31, v[0])) +int_1_32 = str_int.copy().setParseAction(lambda v: check_bounds(1, 32, v[0])) + + +def reglistparse(s, l, t): + t = t[0] + if t[-1] == "^": + return ExprOp('sbit', ExprOp('reglist', *t[:-1])) + return ExprOp('reglist', *t) + + +allshifts = ['<<', '>>', 'a>>', '>>>', 'rrx'] +allshifts_armt = ['<<', '>>', 'a>>', '>>>', 'rrx'] + +shift2expr_dct = {'LSL': '<<', 'LSR': '>>', 'ASR': 'a>>', + 'ROR': ">>>", 'RRX': "rrx"} + +expr2shift_dct = dict([(x[1], x[0]) for x in shift2expr_dct.items()]) + + +def op_shift2expr(s, l, t): + return shift2expr_dct[t[0]] + +reg_duo = Group(gpregs.parser + MINUS + + gpregs.parser).setParseAction(tok_reg_duo) +reg_or_duo = reg_duo | gpregs.parser +gpreg_list = Group(LACC + delimitedList( + reg_or_duo, delim=',') + RACC + Optional(CIRCUNFLEX)) +gpreg_list.setParseAction(reglistparse) + +LBRACK = Suppress("[") +RBRACK = Suppress("]") +COMMA = Suppress(",") +all_binaryop_1_31_shifts_t = literal_list( + ['LSL', 'ROR']).setParseAction(op_shift2expr) +all_binaryop_1_32_shifts_t = literal_list( + ['LSR', 'ASR']).setParseAction(op_shift2expr) +all_unaryop_shifts_t = literal_list(['RRX']).setParseAction(op_shift2expr) + +allshifts_t_armt = literal_list( + ['LSL', 'LSR', 'ASR', 'ROR', 'RRX']).setParseAction(op_shift2expr) + +gpreg_p = gpregs.parser + +psr_p = cpsr_regs.parser | spsr_regs.parser + + +def shift2expr(t): + if len(t) == 1: + return t[0] + elif len(t) == 2: + return ExprOp(t[1], t[0]) + elif len(t) == 3: + return ExprOp(t[1], t[0], t[2]) + +variable, operand, base_expr = gen_base_expr() + +int_or_expr = base_expr + + +def ast_id2expr(t): + if not t in mn_arm.regs.all_regs_ids_byname: + r = ExprId(t) + else: + r = mn_arm.regs.all_regs_ids_byname[t] + return r + + +def ast_int2expr(a): + return ExprInt32(a) + + +my_var_parser = parse_ast(ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + + +shift_off = (gpregs.parser + Optional( + (all_unaryop_shifts_t) | + (all_binaryop_1_31_shifts_t + (gpregs.parser | int_1_31)) | + (all_binaryop_1_32_shifts_t + (gpregs.parser | int_1_32)) +)).setParseAction(shift2expr) +shift_off |= base_expr + + +def deref2expr_nooff(s, l, t): + t = t[0] + # XXX default + return ExprOp("preinc", t[0], ExprInt32(0)) + + +def deref2expr_pre(s, l, t): + t = t[0] + if len(t) == 1: + return ExprOp("preinc", t[0], ExprInt32(0)) + elif len(t) == 2: + return ExprOp("preinc", t[0], t[1]) + else: + raise NotImplementedError('len(t) > 2') + + +def deref2expr_post(s, l, t): + t = t[0] + return ExprOp("postinc", t[0], t[1]) + + +def deref_wb(s, l, t): + t = t[0] + if t[-1] == '!': + return ExprOp('wback', *t[:-1]) + return t[0] + +# shift_off.setParseAction(deref_off) +deref_nooff = Group( + LBRACK + gpregs.parser + RBRACK).setParseAction(deref2expr_nooff) +deref_pre = Group(LBRACK + gpregs.parser + Optional( + COMMA + shift_off) + RBRACK).setParseAction(deref2expr_pre) +deref_post = Group(LBRACK + gpregs.parser + RBRACK + + COMMA + shift_off).setParseAction(deref2expr_post) +deref = Group((deref_post | deref_pre | deref_nooff) + + Optional('!')).setParseAction(deref_wb) + + +def parsegpreg_wb(s, l, t): + t = t[0] + if t[-1] == '!': + return ExprOp('wback', *t[:-1]) + return t[0] + +gpregs_wb = Group(gpregs.parser + Optional('!')).setParseAction(parsegpreg_wb) + + +# + + +cond_list = ['EQ', 'NE', 'CS', 'CC', 'MI', 'PL', 'VS', 'VC', + 'HI', 'LS', 'GE', 'LT', 'GT', 'LE', ''] # , 'NV'] +cond_dct = dict([(x[1], x[0]) for x in enumerate(cond_list)]) +# default_prio = 0x1337 + +bm_cond = bs_mod_name(l=4, fname='cond', mn_mod=cond_list) # cond_dct) + + +def permut_args(order, args): + l = [] + for i, x in enumerate(order): + l.append((x.__class__, i)) + l = dict(l) + out = [None for x in xrange(len(args))] + for a in args: + out[l[a.__class__]] = a + return out + + +class additional_info: + + def __init__(self): + self.except_on_instr = False + self.lnk = None + self.cond = None + + +class instruction_arm(instruction): + delayslot = 0 + + def __init__(self, *args, **kargs): + super(instruction_arm, self).__init__(*args, **kargs) + + def dstflow(self): + if self.name.startswith('BIC'): + return False + return self.name.startswith('B') + + def dstflow2label(self, symbol_pool): + e = self.args[0] + if not isinstance(e, ExprInt): + return + if self.name == 'BLX': + ad = e.arg + 8 + self.offset + else: + ad = e.arg + 8 + self.offset + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0] = s + + def breakflow(self): + if self.name.startswith('B') and not self.name.startswith('BIC'): + return True + if self.name.startswith("LDM") and PC in self.args[1].args: + return True + + if self.args and PC in self.args[0].get_r(): + return True + return False + + def is_subcall(self): + if self.name == 'BLX': + return True + return self.additional_info.lnk + + def getdstflow(self, symbol_pool): + if self.name in ['CBZ', 'CBNZ']: + return [self.args[1]] + return [self.args[0]] + + def splitflow(self): + if self.additional_info.lnk: + return True + if self.name == 'BX': + return False + return self.breakflow() and self.additional_info.cond != 14 + + def get_symbol_size(self, symbol, symbol_pool): + return 32 + + def fixDstOffset(self): + e = self.args[0] + print 'FIX', e, self.offset, self.l + if self.offset is None: + raise ValueError('symbol not resolved %s' % l) + if not isinstance(e, ExprInt): + log.warning('zarb dst %r' % e) + return + off = e.arg - (self.offset + 4 + self.l) + print hex(off) + if int(off % 4): + raise ValueError('strange offset! %r' % off) + self.args[0] = ExprInt32(off) + print 'final', self.args[0] + + def get_args_expr(self): + args = [a for a in self.args] + return args + + +class instruction_armt(instruction_arm): + + def __init__(self, *args, **kargs): + super(instruction_armt, self).__init__(*args, **kargs) + + def dstflow(self): + if self.name.startswith('BIC'): + return False + if self.name in ["CBZ", "CBNZ"]: + return True + return self.name.startswith('B') + + def dstflow2label(self, symbol_pool): + if self.name in ["CBZ", "CBNZ"]: + e = self.args[1] + else: + e = self.args[0] + if not isinstance(e, ExprInt): + return + if self.name == 'BLX': + ad = e.arg + 4 + (self.offset & 0xfffffffc) + else: + ad = e.arg + 4 + self.offset + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + if self.name in ["CBZ", "CBNZ"]: + self.args[1] = s + else: + self.args[0] = s + + def breakflow(self): + if self.name in ['B', 'BL', 'BLX', + 'BEQ', 'BNE', 'BCS', 'BCC', 'BMI', 'BPL', 'BVS', + 'BVC', 'BHI', 'BLS', 'BGE', 'BLT', 'BGT', 'BLE', + 'CBZ', 'CBNZ']: + return True + if self.name.startswith("LDM") and PC in self.args[1].args: + return True + if self.args and PC in self.args[0].get_r(): + return True + return False + + def splitflow(self): + if self.name in ['BL', 'BLX', + 'BEQ', 'BNE', 'BCS', 'BCC', 'BMI', 'BPL', 'BVS', + 'BVC', 'BHI', 'BLS', 'BGE', 'BLT', 'BGT', 'BLE', + 'CBZ', 'CBNZ']: + return True + return False + + def is_subcall(self): + if self.name in ['BL', 'BLX']: + return True + return False + +mode_arm = 'arm' +mode_armthumb = 'armt' + + +class mn_arm(cls_mn): + delayslot = 0 + name = "arm" + regs = regs_module + bintree = {} + num = 0 + all_mn = [] + all_mn_mode = defaultdict(list) + all_mn_name = defaultdict(list) + all_mn_inst = defaultdict(list) + pc = {mode_arm: PC, mode_armthumb: PC} + sp = {mode_arm: SP, mode_armthumb: SP} + instruction = instruction_arm + max_instruction_len = 4 + + @classmethod + def fromstring(cls, s, mode='arm'): + return super(mn_arm, cls).fromstring(s, mode) + + @classmethod + def dis(cls, bs_o, mode_o='arm', offset=0): + return super(mn_arm, cls).dis(bs_o, mode_o, offset) + + @classmethod + def getpc(cls, attrib): + return PC + + @classmethod + def getsp(cls, attrib): + return SP + + def additional_info(self): + info = additional_info() + info.lnk = False + if hasattr(self, "lnk"): + info.lnk = self.lnk.value != 0 + info.cond = self.cond.value + return info + + @classmethod + def getbits(cls, bs, start, n): + if not n: + return 0 + o = 0 + if n > bs.getlen() * 8: + raise ValueError('not enought bits %r %r' % (n, len(bs.bin) * 8)) + while n: + i = start / 8 + c = cls.getbytes(bs, i) + if not c: + raise IOError + c = ord(c) + r = 8 - start % 8 + c &= (1 << r) - 1 + l = min(r, n) + c >>= (r - l) + o <<= l + o |= c + n -= l + start += l + return o + + @classmethod + def getbytes(cls, bs, offset, l=1): + out = "" + for _ in xrange(l): + n_offset = (offset & ~3) + 3 - offset % 4 + out += bs.getbytes(n_offset, 1) + offset += 1 + return out + + @classmethod + def check_mnemo(cls, fields): + l = sum([x.l for x in fields]) + assert l == 32, "len %r" % l + + @classmethod + def getmn(cls, name): + return name.upper() + + @classmethod + def mod_fields(cls, fields): + l = sum([x.l for x in fields]) + if l == 32: + return fields + return [bm_cond] + fields + + @classmethod + def gen_modes(cls, subcls, name, bases, dct, fields): + dct['mode'] = mode_arm + return [(subcls, name, bases, dct, fields)] + + def value(self, mode): + v = super(mn_arm, self).value(mode) + return [x[::-1] for x in v] + + def fixDstOffset(self): + e = self.args[0].expr + + if self.offset is None: + raise ValueError('symbol not resolved %s' % l) + if not isinstance(e, ExprInt): + # raise ValueError('dst must be int or label') + log.warning('zarb dst %r' % e) + return + # return ExprInt32(e.arg - (self.offset + self.l)) + off = e.arg - (self.offset + 4 + self.l) + if int(off % 4): + raise ValueError('strange offset! %r' % off) + self.args[0].expr = ExprInt32(off / 4) + + def get_symbol_size(self, symbol, symbol_pool, mode): + return 32 + + +class mn_armt(cls_mn): + name = "armt" + regs = regs_module + delayslot = 0 + bintree = {} + num = 0 + all_mn = [] + all_mn_mode = defaultdict(list) + all_mn_name = defaultdict(list) + all_mn_inst = defaultdict(list) + pc = PC + sp = SP + instruction = instruction_armt + max_instruction_len = 8 + + @classmethod + def fromstring(cls, s, mode='armt'): + return super(mn_armt, cls).fromstring(s, mode) + + @classmethod + def dis(cls, bs_o, mode_o='armt', offset=0): + return super(mn_armt, cls).dis(bs_o, mode_o, offset) + + @classmethod + def getpc(cls, attrib): + return PC + + @classmethod + def getsp(cls, attrib): + return SP + + def additional_info(self): + info = additional_info() + info.lnk = False + if hasattr(self, "lnk"): + info.lnk = self.lnk.value != 0 + info.cond = 14 # COND_ALWAYS + return info + + @classmethod + def getbits(cls, bs, start, n): + if not n: + return 0 + o = 0 + if n > bs.getlen() * 8: + raise ValueError('not enought bits %r %r' % (n, len(bs.bin) * 8)) + while n: + i = start / 8 + c = cls.getbytes(bs, i) + if not c: + raise IOError + c = ord(c) + r = 8 - start % 8 + c &= (1 << r) - 1 + l = min(r, n) + c >>= (r - l) + o <<= l + o |= c + n -= l + start += l + return o + + @classmethod + def getbytes(cls, bs, offset, l=1): + out = "" + for _ in xrange(l): + n_offset = (offset & ~1) + 1 - offset % 2 + out += bs.getbytes(n_offset, 1) + offset += 1 + return out + + @classmethod + def check_mnemo(cls, fields): + l = sum([x.l for x in fields]) + assert l in [16, 32], "len %r" % l + + @classmethod + def getmn(cls, name): + return name.upper() + + @classmethod + def mod_fields(cls, fields): + return list(fields) + + @classmethod + def gen_modes(cls, subcls, name, bases, dct, fields): + dct['mode'] = mode_armthumb + return [(subcls, name, bases, dct, fields)] + + def value(self, mode): + v = super(mn_armt, self).value(mode) + out = [] + for x in v: + if len(x) == 2: + out.append(x[::-1]) + elif len(x) == 4: + out.append(x[:2][::-1] + x[2:4][::-1]) + return out + + def get_args_expr(self): + args = [a.expr for a in self.args] + return args + + def get_symbol_size(self, symbol, symbol_pool, mode): + return 32 + + +class arm_reg(reg_noarg, m_arg): + pass + + +class arm_gpreg_noarg(reg_noarg): + reg_info = gpregs + parser = reg_info.parser + + +class arm_gpreg(arm_reg): + reg_info = gpregs + parser = reg_info.parser + + +class arm_reg_wb(arm_reg): + reg_info = gpregs + parser = gpregs_wb + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + return '%s' % e + return "%s!" % e.args[0] + + def decode(self, v): + v = v & self.lmask + e = self.reg_info.expr[v] + if self.parent.wback.value: + e = ExprOp('wback', e) + self.expr = e + return True + + def encode(self): + e = self.expr + self.parent.wback.value = 0 + if isinstance(e, ExprOp) and e.op == 'wback': + self.parent.wback.value = 1 + e = e.args[0] + if isinstance(e, ExprId): + self.value = self.reg_info.expr.index(e) + else: + self.parent.wback.value = 1 + self.value = self.reg_info.expr.index(e.args[0]) + return True + + +class arm_psr(m_arg): + parser = psr_p + + def decode(self, v): + v = v & self.lmask + if self.parent.psr.value == 0: + e = cpsr_regs.expr[v] + else: + e = spsr_regs.expr[v] + self.expr = e + return True + + def encode(self): + e = self.expr + if e in spsr_regs.expr: + self.parent.psr.value = 1 + v = spsr_regs.expr.index(e) + elif e in cpsr_regs.expr: + self.parent.psr.value = 0 + v = cpsr_regs.expr.index(e) + else: + return False + self.value = v + return True + + +class arm_cpreg(arm_reg): + reg_info = cp_regs + parser = reg_info.parser + + +class arm_preg(arm_reg): + reg_info = p_regs + parser = reg_info.parser + + +class arm_imm(imm_noarg, m_arg): + parser = base_expr + + +class arm_offs(arm_imm): + parser = base_expr + + def int2expr(self, v): + if v & ~self.intmask != 0: + return None + return ExprInt_fromsize(self.intsize, v) + + def decodeval(self, v): + return v << 2 + + def encodeval(self, v): + return v >> 2 + + def decode(self, v): + v = v & self.lmask + if (1 << (self.l - 1)) & v: + v |= ~0 ^ self.lmask + v = self.decodeval(v) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if (1 << (self.l - 1)) & v: + v = -((0xffffffff ^ v) + 1) + v = self.encodeval(v) + self.value = (v & 0xffffffff) & self.lmask + return True + + +class arm_imm8_12(m_arg): + parser = deref + + def decode(self, v): + v = v & self.lmask + if self.parent.updown.value: + e = ExprInt32(v << 2) + else: + e = ExprInt32(-v << 2) + if self.parent.ppi.value: + e = ExprOp('preinc', self.parent.rn.expr, e) + else: + e = ExprOp('postinc', self.parent.rn.expr, e) + if self.parent.wback.value == 1: + e = ExprOp('wback', e) + self.expr = e + return True + + def encode(self): + self.parent.updown.value = 1 + e = self.expr + if isinstance(e, ExprOp) and e.op == 'wback': + self.parent.wback.value = 1 + e = e.args[0] + else: + self.parent.wback.value = 0 + if e.op == "postinc": + self.parent.ppi.value = 0 + elif e.op == "preinc": + self.parent.ppi.value = 1 + else: + # XXX default + self.parent.ppi.value = 1 + self.parent.rn.expr = e.args[0] + if len(e.args) == 1: + self.value = 0 + return True + e = e.args[1] + if not isinstance(e, ExprInt): + log.debug('should be int %r' % e) + return False + v = int(e.arg) + if v < 0 or v & (1 << 31): + self.parent.updown.value = 0 + v = -v & 0xFFFFFFFF + if v & 0x3: + log.debug('arg shoulb be 4 aligned') + return False + v >>= 2 + self.value = v + return True + + @staticmethod + def arg2str(e): + wb = False + if isinstance(e, ExprOp) and e.op == 'wback': + wb = True + e = e.args[0] + if isinstance(e, ExprId): + r = e + s = None + else: + if len(e.args) == 1 and isinstance(e.args[0], ExprId): + r, s = e.args[0], None + elif isinstance(e.args[0], ExprId): + r, s = e.args[0], e.args[1] + else: + r, s = e.args[0].args + if isinstance(s, ExprOp) and s.op in expr2shift_dct: + s = ' '.join([str(x) + for x in s.args[0], expr2shift_dct[s.op], s.args[1]]) + if isinstance(e, ExprOp) and e.op == 'preinc': + if s and not (isinstance(s, ExprInt) and s.arg == 0): + o = '[%s, %s]' % (r, s) + else: + o = '[%s]' % (r) + else: + o = '[%s]' % r + if s and not (isinstance(s, ExprInt) and s.arg == 0): + o += ', %s' % s + if wb: + o += "!" + return o + + +class arm_imm_4_12(m_arg): + parser = base_expr + + def decode(self, v): + v = v & self.lmask + imm = (self.parent.imm4.value << 12) | v + self.expr = ExprInt32(imm) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if v > 0xffff: + return False + self.parent.imm4.value = v >> 12 + self.value = v & 0xfff + return True + + +class arm_op2(m_arg): + parser = shift_off + + def str_to_imm_rot_form(self, s, neg=False): + if neg: + s = -s & 0xffffffff + for i in xrange(0, 32, 2): + v = myrol32(s, i) + if 0 <= v < 0x100: + return ((i / 2) << 8) | v + return None + + def decode(self, v): + val = v & self.lmask + if self.parent.immop.value: + rot = val >> 8 + imm = val & 0xff + imm = myror32(imm, rot * 2) + self.expr = ExprInt32(imm) + return True + rm = val & 0xf + shift = val >> 4 + shift_kind = shift & 1 + shift_type = (shift >> 1) & 3 + shift >>= 3 + # print self.parent.immop.value, hex(shift), hex(shift_kind), + # hex(shift_type) + if shift_kind: + # shift kind is reg + if shift & 1: + # log.debug('error in shift1') + return False + rs = shift >> 1 + if rs == 0xf: + # log.debug('error in shift2') + return False + shift_op = regs_expr[rs] + else: + # shift kind is imm + amount = shift + shift_op = ExprInt32(amount) + a = regs_expr[rm] + if shift_op == ExprInt32(0): + if shift_type == 3: + self.expr = ExprOp(allshifts[4], a) + else: + self.expr = a + else: + self.expr = ExprOp(allshifts[shift_type], a, shift_op) + return True + + def encode(self): + e = self.expr + # pure imm + if isinstance(e, ExprInt): + val = self.str_to_imm_rot_form(int(e.arg)) + if val is None: + return False + self.parent.immop.value = 1 + self.value = val + return True + + self.parent.immop.value = 0 + # pure reg + if isinstance(e, ExprId): + rm = gpregs.expr.index(e) + shift_kind = 0 + shift_type = 0 + amount = 0 + self.value = ( + ((((amount << 2) | shift_type) << 1) | shift_kind) << 4) | rm + return True + # rot reg + if not isinstance(e, ExprOp): + log.debug('bad reg rot1 %r', e) + return False + rm = gpregs.expr.index(e.args[0]) + shift_type = allshifts.index(e.op) + if e.op == 'rrx': + shift_kind = 0 + amount = 0 + shift_type = 3 + elif isinstance(e.args[1], ExprInt): + shift_kind = 0 + amount = int(e.args[1].arg) + # LSR/ASR of 32 => 0 + if amount == 32 and e.op in ['>>', 'a>>']: + amount = 0 + else: + shift_kind = 1 + amount = gpregs.expr.index(e.args[1]) << 1 + self.value = ( + ((((amount << 2) | shift_type) << 1) | shift_kind) << 4) | rm + return True + + @staticmethod + def arg2str(e): + if isinstance(e, ExprInt) or isinstance(e, ExprId): + return str(e) + if isinstance(e, ExprOp) and e.op in expr2shift_dct: + if len(e.args) == 1: + return '%s %s' % (e.args[0], expr2shift_dct[e.op]) + elif len(e.args) == 2: + return '%s %s %s' % (e.args[0], expr2shift_dct[e.op], e.args[1]) + return str(e) + +# op2imm + rn + + +class arm_op2imm(arm_imm8_12): + parser = deref + + def str_to_imm_rot_form(self, s, neg=False): + if neg: + s = -s & 0xffffffff + if 0 <= s < (1 << 12): + return s + return None + + def decode(self, v): + val = v & self.lmask + if self.parent.immop.value == 0: + imm = val + if self.parent.updown.value == 0: + imm = -imm + if self.parent.ppi.value: + e = ExprOp('preinc', self.parent.rn.expr, ExprInt32(imm)) + else: + e = ExprOp('postinc', self.parent.rn.expr, ExprInt32(imm)) + if self.parent.wback.value == 1: + e = ExprOp('wback', e) + self.expr = e + return True + rm = val & 0xf + shift = val >> 4 + shift_kind = shift & 1 + shift_type = (shift >> 1) & 3 + shift >>= 3 + # print self.parent.immop.value, hex(shift), hex(shift_kind), + # hex(shift_type) + if shift_kind: + # log.debug('error in disasm xx') + return False + else: + # shift kind is imm + amount = shift + shift_op = ExprInt32(amount) + a = regs_expr[rm] + if shift_op == ExprInt32(0): + pass + else: + a = ExprOp(allshifts[shift_type], a, shift_op) + if self.parent.ppi.value: + e = ExprOp('preinc', self.parent.rn.expr, a) + else: + e = ExprOp('postinc', self.parent.rn.expr, a) + if self.parent.wback.value == 1: + e = ExprOp('wback', e) + self.expr = e + return True + + def encode(self): + self.parent.immop.value = 1 + self.parent.updown.value = 1 + + e = self.expr + if e.op == 'wback': + self.parent.wback.value = 1 + e = e.args[0] + else: + self.parent.wback.value = 0 + if e.op == "postinc": + self.parent.ppi.value = 0 + elif e.op == "preinc": + self.parent.ppi.value = 1 + else: + # XXX default + self.parent.ppi.value = 1 + + # if len(v) <1: + # raise ValueError('cannot parse', s) + self.parent.rn.fromstring(e.args[0]) + if len(e.args) == 1: + self.parent.immop.value = 0 + self.value = 0 + return True + # pure imm + if isinstance(e.args[1], ExprInt): + self.parent.immop.value = 0 + val = self.str_to_imm_rot_form(int(e.args[1].arg)) + if val is None: + val = self.str_to_imm_rot_form(int(e.args[1].arg), True) + if val is None: + log.debug('cannot encode inm') + return False + self.parent.updown.value = 0 + self.value = val + return True + # pure reg + if isinstance(e.args[1], ExprId): + rm = gpregs.expr.index(e.args[1]) + shift_kind = 0 + shift_type = 0 + amount = 0 + self.value = ( + ((((amount << 2) | shift_type) << 1) | shift_kind) << 4) | rm + return True + # rot reg + if not isinstance(e.args[1], ExprOp): + log.debug('bad reg rot2 %r' % e) + return False + e = e.args[1] + rm = gpregs.expr.index(e.args[0]) + shift_type = allshifts.index(e.op) + if isinstance(e.args[1], ExprInt): + shift_kind = 0 + amount = int(e.args[1].arg) + else: + shift_kind = 1 + amount = gpregs.expr.index(e.args[1]) << 1 + self.value = ( + ((((amount << 2) | shift_type) << 1) | shift_kind) << 4) | rm + return True + + +def reglist2str(rlist): + out = [] + i = 0 + while i < len(rlist): + j = i + 1 + while j < len(rlist) and rlist[j] < 13 and rlist[j] == rlist[j - 1] + 1: + j += 1 + j -= 1 + if j < i + 2: + out.append(regs_str[rlist[i]]) + i += 1 + else: + out.append(regs_str[rlist[i]] + '-' + regs_str[rlist[j]]) + i = j + 1 + return "{" + ", ".join(out) + '}' + + +class arm_rlist(m_arg): + parser = gpreg_list + + def encode(self): + self.parent.sbit.value = 0 + e = self.expr + if isinstance(e, ExprOp) and e.op == "sbit": + e = e.args[0] + self.parent.sbit.value = 1 + rlist = [gpregs.expr.index(x) for x in e.args] + v = 0 + for r in rlist: + v |= 1 << r + self.value = v + return True + + def decode(self, v): + v = v & self.lmask + out = [] + for i in xrange(0x10): + if 1 << i & v: + out.append(gpregs.expr[i]) + e = ExprOp('reglist', *out) + if self.parent.sbit.value == 1: + e = ExprOp('sbit', e) + self.expr = e + return True + + @staticmethod + def arg2str(e): + o = [] + sb = False + if isinstance(e, ExprOp) and e.op == "sbit": + sb = True + e = e.args[0] + o = [gpregs.expr.index(x) for x in e.args] + out = reglist2str(o) + if sb: + out += "^" + return out + + +class updown_b_nosp_mn(bs_mod_name): + mn_mod = ['D', 'I'] + + def modname(self, name, f_i): + return name + self.args['mn_mod'][f_i] + + +class ppi_b_nosp_mn(bs_mod_name): + prio = 5 + mn_mod = ['A', 'B'] + + +class updown_b_sp_mn(bs_mod_name): + mn_mod = ['A', 'D'] + + def modname(self, name, f_i): + if name.startswith("STM"): + f_i = [1, 0][f_i] + return name + self.args['mn_mod'][f_i] + + +class ppi_b_sp_mn(bs_mod_name): + mn_mod = ['F', 'E'] + + def modname(self, name, f_i): + if name.startswith("STM"): + f_i = [1, 0][f_i] + return name + self.args['mn_mod'][f_i] + + +class arm_reg_wb_nosp(arm_reg_wb): + + def decode(self, v): + v = v & self.lmask + if v == 13: + return False + e = self.reg_info.expr[v] + if self.parent.wback.value: + e = ExprOp('wback', e) + self.expr = e + return True + + +class arm_offs_blx(arm_imm): + + def decode(self, v): + v = v & self.lmask + v = (v << 2) + (self.parent.lowb.value << 1) + v = sign_ext(v, 26, 32) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = self.expr.arg.arg + if v & 0x80000000: + v &= (1 << 26) - 1 + self.parent.lowb.value = (v >> 1) & 1 + self.value = v >> 2 + return True + + +class bs_lnk(bs_mod_name): + + def modname(self, name, i): + return name[:1] + self.args['mn_mod'][i] + name[1:] + + +accum = bs(l=1) +scc = bs_mod_name(l=1, fname='scc', mn_mod=['', 'S']) +dumscc = bs("1") +rd = bs(l=4, cls=(arm_gpreg,)) +rdl = bs(l=4, cls=(arm_gpreg,)) + +rn = bs(l=4, cls=(arm_gpreg,), fname="rn") +rs = bs(l=4, cls=(arm_gpreg,)) +rm = bs(l=4, cls=(arm_gpreg,)) +op2 = bs(l=12, cls=(arm_op2,)) +lnk = bs_lnk(l=1, fname='lnk', mn_mod=['', 'L']) +offs = bs(l=24, cls=(arm_offs,), fname="offs") + +rn_noarg = bs(l=4, cls=(arm_gpreg_noarg,), fname="rn") + +immop = bs(l=1, fname='immop') +dumr = bs(l=4, default_val="0000", fname="dumr") +# psr = bs(l=1, cls=(arm_psr,), fname="psr") + +psr = bs(l=1, fname="psr") +psr_field = bs(l=4, cls=(arm_psr,)) + +ppi = bs(l=1, fname='ppi') +updown = bs(l=1, fname='updown') +trb = bs_mod_name(l=1, fname='trb', mn_mod=['', 'B']) +wback = bs_mod_name(l=1, fname="wback", mn_mod=['', 'T']) +wback_no_t = bs(l=1, fname="wback") + +op2imm = bs(l=12, cls=(arm_op2imm,)) + +updown_b_nosp = updown_b_nosp_mn(l=1, mn_mod=['D', 'I'], fname='updown') +ppi_b_nosp = ppi_b_nosp_mn(l=1, mn_mod=['A', 'B'], fname='ppi') +updown_b_sp = updown_b_sp_mn(l=1, mn_mod=['A', 'D'], fname='updown') +ppi_b_sp = ppi_b_sp_mn(l=1, mn_mod=['F', 'E'], fname='ppi') + +sbit = bs(l=1, fname="sbit") +rn_sp = bs("1101", cls=(arm_reg_wb,), fname='rnsp') +rn_wb = bs(l=4, cls=(arm_reg_wb_nosp,), fname='rn') +rlist = bs(l=16, cls=(arm_rlist,), fname='rlist') + +swi_i = bs(l=24, cls=(arm_imm,), fname="swi_i") + +opc = bs(l=4, cls=(arm_imm, m_arg), fname='opc') +crn = bs(l=4, cls=(arm_cpreg,), fname='crn') +crd = bs(l=4, cls=(arm_cpreg,), fname='crd') +crm = bs(l=4, cls=(arm_cpreg,), fname='crm') +cpnum = bs(l=4, cls=(arm_preg,), fname='cpnum') +cp = bs(l=3, cls=(arm_imm, m_arg), fname='cp') + +imm8_12 = bs(l=8, cls=(arm_imm8_12, m_arg), fname='imm') +tl = bs_mod_name(l=1, fname="tl", mn_mod=['', 'L']) + +cpopc = bs(l=3, cls=(arm_imm, m_arg), fname='cpopc') +imm20 = bs(l=20, cls=(arm_imm, m_arg)) +imm4 = bs(l=4, cls=(arm_imm, m_arg)) +imm12 = bs(l=12, cls=(arm_imm, m_arg)) +imm16 = bs(l=16, cls=(arm_imm, m_arg)) + +imm4_noarg = bs(l=4, fname="imm4") + +imm_4_12 = bs(l=12, cls=(arm_imm_4_12,)) + +lowb = bs(l=1, fname='lowb') +offs_blx = bs(l=24, cls=(arm_offs_blx,), fname="offs") + +fix_cond = bs("1111", fname="cond") + + +class arm_immed(m_arg): + parser = deref + + def decode(self, v): + if self.parent.immop.value == 1: + imm = ExprInt32((self.parent.immedH.value << 4) | v) + else: + imm = gpregs.expr[v] + if self.parent.updown.value == 0: + imm = -imm + if self.parent.ppi.value: + e = ExprOp('preinc', self.parent.rn.expr, imm) + else: + e = ExprOp('postinc', self.parent.rn.expr, imm) + if self.parent.wback.value == 1: + e = ExprOp('wback', e) + self.expr = e + + return True + + def encode(self): + self.parent.immop.value = 1 + self.parent.updown.value = 1 + e = self.expr + if isinstance(e, ExprOp) and e.op == 'wback': + self.parent.wback.value = 1 + e = e.args[0] + else: + self.parent.wback.value = 0 + if e.op == "postinc": + self.parent.ppi.value = 0 + elif e.op == "preinc": + self.parent.ppi.value = 1 + else: + # XXX default + self.parent.ppi.value = 1 + self.parent.rn.expr = e.args[0] + if len(e.args) == 1: + self.value = 0 + self.parent.immedH.value = 0 + return True + e = e.args[1] + if isinstance(e, ExprInt): + v = int(e.arg) + if v < 0 or v & (1 << 31): + self.parent.updown.value = 0 + v = (-v) & 0xFFFFFFFF + if v > 0xff: + log.debug('cannot encode imm XXX') + return False + self.value = v & 0xF + self.parent.immedH.value = v >> 4 + return True + + self.parent.immop.value = 0 + if isinstance(e, ExprOp) and len(e.args) == 1 and e.op == "-": + self.parent.updown.value = 0 + e = e.args[0] + if e in gpregs.expr: + self.value = gpregs.expr.index(e) + self.parent.immedH.value = 0x0 + return True + else: + raise ValueError('e should be int: %r' % e) + + @staticmethod + def arg2str(e): + return arm_imm8_12.arg2str(e) + +immedH = bs(l=4, fname='immedH') +immedL = bs(l=4, cls=(arm_immed, m_arg), fname='immedL') +hb = bs(l=1) + + +def armop(name, fields, args=None, alias=False): + dct = {"fields": fields} + dct["alias"] = alias + if args is not None: + dct['args'] = args + type(name, (mn_arm,), dct) + + +def armtop(name, fields, args=None, alias=False): + dct = {"fields": fields} + dct["alias"] = alias + if args is not None: + dct['args'] = args + type(name, (mn_armt,), dct) + + +op_list = ['AND', 'EOR', 'SUB', 'RSB', 'ADD', 'ADC', 'SBC', 'RSC', + 'TST', 'TEQ', 'CMP', 'CMN', 'ORR', 'MOV', 'BIC', 'MVN'] +data_mov_name = {'MOV': 13, 'MVN': 15} +data_test_name = {'TST': 8, 'TEQ': 9, 'CMP': 10, 'CMN': 11} + +data_name = {} +for i, n in enumerate(op_list): + if n in data_mov_name.keys() + data_test_name.keys(): + continue + data_name[n] = i +bs_data_name = bs_name(l=4, name=data_name) + +bs_data_mov_name = bs_name(l=4, name=data_mov_name) + +bs_data_test_name = bs_name(l=4, name=data_test_name) + + +transfer_name = {'STR': 0, 'LDR': 1} +bs_transfer_name = bs_name(l=1, name=transfer_name) + +transferh_name = {'STRH': 0, 'LDRH': 1} +bs_transferh_name = bs_name(l=1, name=transferh_name) + + +transfer_ldr_name = {'LDRD': 0, 'LDRSB': 1} +bs_transfer_ldr_name = bs_name(l=1, name=transfer_ldr_name) + +btransfer_name = {'STM': 0, 'LDM': 1} +bs_btransfer_name = bs_name(l=1, name=btransfer_name) + +ctransfer_name = {'STC': 0, 'LDC': 1} +bs_ctransfer_name = bs_name(l=1, name=ctransfer_name) + +mr_name = {'MCR': 0, 'MRC': 1} +bs_mr_name = bs_name(l=1, name=mr_name) + +armop("mul", [bs('000000'), bs('0'), scc, rd, + bs('0000'), rs, bs('1001'), rm], [rd, rm, rs]) +armop("umull", [bs('000010'), + bs('0'), scc, rd, rdl, rs, bs('1001'), rm], [rdl, rd, rm, rs]) +armop("smull", [bs('000011'), bs('0'), scc, rd, + rdl, rs, bs('1001'), rm], [rdl, rd, rm, rs]) +armop("smlal", [bs('000011'), bs('1'), scc, rd, + rdl, rs, bs('1001'), rm], [rdl, rd, rm, rs]) +armop("mla", [bs('000000'), bs('1'), scc, rd, + rn, rs, bs('1001'), rm], [rd, rm, rs, rn]) +armop("mrs", [bs('00010'), psr, bs('00'), + psr_field, rd, bs('000000000000')], [rd, psr]) +armop("msr", [bs('00010'), psr, bs('10'), psr_field, + bs('1111'), bs('0000'), bs('0000'), rm], [psr_field, rm]) +armop("data", [bs('00'), immop, bs_data_name, scc, rn, rd, op2], [rd, rn, op2]) +armop("data_mov", + [bs('00'), immop, bs_data_mov_name, scc, bs('0000'), rd, op2], [rd, op2]) +armop("data_test", [bs('00'), immop, bs_data_test_name, dumscc, rn, dumr, op2]) +armop("b", [bs('101'), lnk, offs]) + +# TODO TEST +armop("und", [bs('011'), imm20, bs('1'), imm4]) +armop("transfer", [bs('01'), immop, ppi, updown, trb, wback_no_t, + bs_transfer_name, rn_noarg, rd, op2imm], [rd, op2imm]) +armop("transferh", [bs('000'), ppi, updown, immop, wback_no_t, + bs_transferh_name, rn_noarg, rd, immedH, bs('1011'), immedL], [rd, immedL]) +armop("ldrd", [bs('000'), ppi, updown, immop, wback_no_t, bs_transfer_ldr_name, + rn_noarg, rd, immedH, bs('1101'), immedL], [rd, immedL]) +armop("ldrsh", [bs('000'), ppi, updown, immop, wback_no_t, bs('1'), rn_noarg, + rd, immedH, bs('1'), bs('1'), bs('1'), bs('1'), immedL], [rd, immedL]) +armop("strd", [bs('000'), ppi, updown, immop, wback_no_t, bs('0'), rn_noarg, + rd, immedH, bs('1'), bs('1'), bs('1'), bs('1'), immedL], [rd, immedL]) +armop("btransfersp", [bs('100'), ppi_b_sp, updown_b_sp, sbit, wback_no_t, + bs_btransfer_name, rn_sp, rlist]) +armop("btransfer", [bs('100'), ppi_b_nosp, updown_b_nosp, sbit, wback_no_t, + bs_btransfer_name, rn_wb, rlist]) +# TODO: TEST +armop("swp", [bs('00010'), trb, bs('00'), rn, rd, bs('0000'), bs('1001'), rm]) +armop("svc", [bs('1111'), swi_i]) +armop("cdp", [bs('1110'), opc, crn, crd, cpnum, cp, bs('0'), crm], + [cpnum, opc, crd, crn, crm, cp]) +armop("cdata", [bs('110'), ppi, updown, tl, wback_no_t, bs_ctransfer_name, + rn_noarg, crd, cpnum, imm8_12], [cpnum, crd, imm8_12]) +armop("mr", [bs('1110'), cpopc, bs_mr_name, crn, rd, cpnum, cp, bs('1'), crm], + [cpnum, cpopc, rd, crn, crm, cp]) +armop("bkpt", [bs('00010010'), imm12, bs('0111'), imm4]) +armop("bx", [bs('000100101111111111110001'), rn]) +armop("mov", [bs('00110000'), imm4_noarg, rd, imm_4_12], [rd, imm_4_12]) +armop("movt", [bs('00110100'), imm4_noarg, rd, imm_4_12], [rd, imm_4_12]) +armop("blx", [bs('00010010'), bs('1111'), + bs('1111'), bs('1111'), bs('0011'), rm], [rm]) +armop("blx", [fix_cond, bs('101'), lowb, offs_blx], [offs_blx]) +armop("clz", [bs('00010110'), bs('1111'), + rd, bs('1111'), bs('0001'), rm], [rd, rm]) +armop("qadd", + [bs('00010000'), rn, rd, bs('0000'), bs('0101'), rm], [rd, rm, rn]) + + +# +# thumnb ####################### +# +# ARM7-TDMI-manual-pt3 +gpregs_l = reg_info(regs_str[:8], regs_expr[:8]) +gpregs_h = reg_info(regs_str[8:], regs_expr[8:]) + +gpregs_sppc = reg_info(regs_str[-1:] + regs_str[13:14], + regs_expr[-1:] + regs_expr[13:14]) + +deref_low = Group(LBRACK + gpregs_l.parser + Optional( + COMMA + shift_off) + RBRACK).setParseAction(deref2expr_pre) +deref_pc = Group(LBRACK + gpregs_pc.parser + Optional( + COMMA + shift_off) + RBRACK).setParseAction(deref2expr_pre) +deref_sp = Group(LBRACK + gpregs_sp.parser + COMMA + + shift_off + RBRACK).setParseAction(deref2expr_pre) + +gpregs_l_wb = Group( + gpregs_l.parser + Optional('!')).setParseAction(parsegpreg_wb) + + +class arm_offreg(m_arg): + parser = deref_pc + + def decodeval(self, v): + return v + + def encodeval(self, v): + return v + + def decode(self, v): + v = v & self.lmask + v = self.decodeval(v) + if v: + self.expr = self.off_reg + ExprInt32(v) + else: + self.expr = self.off_reg + + e = self.expr + if isinstance(e, ExprOp) and e.op == 'wback': + self.parent.wback.value = 1 + e = e.args[0] + return True + + def encode(self): + e = self.expr + if not (isinstance(e, ExprOp) and e.op == "preinc"): + log.debug('cannot encode %r' % e) + return False + if e.args[0] != self.off_reg: + log.debug('cannot encode reg %r' % e.args[0]) + return False + v = int(e.args[1].arg) + v = self.encodeval(v) + self.value = v + return True + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + o = str(e) + elif (len(e.args) == 2 and + isinstance(e.args[1], ExprInt) and e.args[1].arg == 0): + o = "%s" % e.args[0] + else: + o = '%s, %s' % (e.args[0], e.args[1]) + return '[%s]' % o + + +class arm_offpc(arm_offreg): + off_reg = regs_expr[15] + + +class arm_offsp(arm_offreg): + parser = deref_sp + off_reg = regs_expr[13] + + def decodeval(self, v): + return v << 2 + + def encodeval(self, v): + return v >> 2 + + +class arm_offspc(arm_offs): + + def decodeval(self, v): + return v << 1 + + def encodeval(self, v): + return v >> 1 + + +class arm_offspchl(arm_offs): + + def decodeval(self, v): + if self.parent.hl.value == 0: + return v << 12 + else: + return v << 1 + + def encodeval(self, v): + if v > (1 << 12): + self.parent.hl.value = 0 + v >>= 12 + else: + self.parent.hl.value = 1 + v >>= 1 + return v + + +class arm_off8sppc(arm_imm): + + def decodeval(self, v): + return v << 2 + + def encodeval(self, v): + return v >> 2 + + +class arm_off7(arm_imm): + + def decodeval(self, v): + return v << 2 + + def encodeval(self, v): + return v >> 2 + + +class arm_deref(m_arg): + parser = deref_low + + def decode(self, v): + v = v & self.lmask + rbase = regs_expr[v] + e = ExprOp('preinc', rbase, self.parent.off.expr) + self.expr = e + return True + + def encode(self): + e = self.expr + if not (isinstance(e, ExprOp) and e.op == 'preinc'): + log.debug('cannot encode %r' % e) + return False + off = e.args[1] + if isinstance(off, ExprId): + self.parent.off.expr = off + elif isinstance(off, ExprInt): + self.parent.off.expr = off + else: + log.debug('cannot encode off %r' % off) + return False + self.value = gpregs.expr.index(e.args[0]) + if self.value >= 1 << self.l: + log.debug('cannot encode reg %r' % off) + return False + return True + + @staticmethod + def arg2str(e): + if not (isinstance(e, ExprOp) and e.op == 'preinc'): + log.debug('cannot str %r' % e) + raise ValueError() + return '[%s, %s]' % (e.args[0], e.args[1]) + + +class arm_offbw(imm_noarg): + + def decode(self, v): + v = v & self.lmask + if self.parent.trb.value == 0: + v <<= 2 + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if self.parent.trb.value == 0: + if v & 3: + log.debug('off must be aligned %r' % v) + return False + v >>= 2 + self.value = v + return True + + +class arm_offh(imm_noarg): + + def decode(self, v): + v = v & self.lmask + v <<= 1 + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if v & 1: + log.debug('off must be aligned %r' % v) + return False + v >>= 1 + self.value = v + return True + + +class armt_rlist(m_arg): + parser = gpreg_list + + def encode(self): + e = self.expr + rlist = [gpregs_l.expr.index(x) for x in e.args] + v = 0 + for r in rlist: + v |= 1 << r + self.value = v + return True + + def decode(self, v): + v = v & self.lmask + out = [] + for i in xrange(0x10): + if 1 << i & v: + out.append(gpregs.expr[i]) + e = ExprOp('reglist', *out) + self.expr = e + return True + + @staticmethod + def arg2str(e): + o = [] + o = [gpregs.expr.index(x) for x in e.args] + out = reglist2str(o) + return out + + +class armt_rlist_pclr(armt_rlist): + + def encode(self): + e = self.expr + reg_l = list(e.args) + self.parent.pclr.value = 0 + if self.parent.pp.value == 0: + # print 'push' + if regs_expr[14] in reg_l: + reg_l.remove(regs_expr[14]) + self.parent.pclr.value = 1 + else: + # print 'pop', + if regs_expr[15] in reg_l: + reg_l.remove(regs_expr[15]) + self.parent.pclr.value = 1 + rlist = [gpregs.expr.index(x) for x in reg_l] + v = 0 + for r in rlist: + v |= 1 << r + self.value = v + return True + + def decode(self, v): + v = v & self.lmask + out = [] + for i in xrange(0x10): + if 1 << i & v: + out.append(gpregs.expr[i]) + + if self.parent.pclr.value == 1: + if self.parent.pp.value == 0: + out += [regs_expr[14]] + else: + out += [regs_expr[15]] + e = ExprOp('reglist', *out) + self.expr = e + return True + + +class armt_reg_wb(arm_reg_wb): + reg_info = gpregs_l + parser = gpregs_l_wb + + def decode(self, v): + v = v & self.lmask + e = self.reg_info.expr[v] + e = ExprOp('wback', e) + self.expr = e + return True + + def encode(self): + e = self.expr + self.value = self.reg_info.expr.index(e.args[0]) + return True + + +class arm_gpreg_l(arm_reg): + reg_info = gpregs_l + parser = reg_info.parser + + +class arm_gpreg_h(arm_reg): + reg_info = gpregs_h + parser = reg_info.parser + + +class arm_gpreg_l_noarg(arm_gpreg_noarg): + reg_info = gpregs_l + parser = reg_info.parser + + +class arm_sppc(arm_reg): + reg_info = gpregs_sppc + parser = reg_info.parser + + +class arm_sp(arm_reg): + reg_info = gpregs_sp + parser = reg_info.parser + + +off5 = bs(l=5, cls=(arm_imm,), fname="off") +off3 = bs(l=3, cls=(arm_imm,), fname="off") +off8 = bs(l=8, cls=(arm_imm,), fname="off") +off7 = bs(l=7, cls=(arm_off7,), fname="off") + +rdl = bs(l=3, cls=(arm_gpreg_l,), fname="rd") +rnl = bs(l=3, cls=(arm_gpreg_l,), fname="rn") +rsl = bs(l=3, cls=(arm_gpreg_l,), fname="rs") +rml = bs(l=3, cls=(arm_gpreg_l,), fname="rm") +rol = bs(l=3, cls=(arm_gpreg_l,), fname="ro") +rbl = bs(l=3, cls=(arm_gpreg_l,), fname="rb") +rbl_deref = bs(l=3, cls=(arm_deref,), fname="rb") +dumrh = bs(l=3, default_val="000") + +rdh = bs(l=3, cls=(arm_gpreg_h,), fname="rd") +rsh = bs(l=3, cls=(arm_gpreg_h,), fname="rs") + +offpc8 = bs(l=8, cls=(arm_offpc,), fname="offs") +offsp8 = bs(l=8, cls=(arm_offsp,), fname="offs") +rol_noarg = bs(l=3, cls=(arm_gpreg_l_noarg,), fname="off") + +off5bw = bs(l=5, cls=(arm_offbw,), fname="off") +off5h = bs(l=5, cls=(arm_offh,), fname="off") +sppc = bs(l=1, cls=(arm_sppc,)) + + +pclr = bs(l=1, fname='pclr') + + +sp = bs(l=0, cls=(arm_sp,)) + +tswi_i = bs(l=8, cls=(arm_imm,), fname="swi_i") + + +off8s = bs(l=8, cls=(arm_offs,), fname="offs") +trlistpclr = bs(l=8, cls=(armt_rlist_pclr,)) +trlist = bs(l=8, cls=(armt_rlist,)) + +rbl_wb = bs(l=3, cls=(armt_reg_wb,), fname='rb') + +offs8 = bs(l=8, cls=(arm_offspc,), fname="offs") +offs11 = bs(l=11, cls=(arm_offspc,), fname="offs") + +offs11hl = bs(l=11, cls=(arm_offspchl,), fname="offs") +hl = bs(l=1, prio=default_prio + 1, fname='hl') +off8sppc = bs(l=8, cls=(arm_off8sppc,), fname="off") + +imm8_d1 = bs(l=8, default_val="00000001") +imm8 = bs(l=8, cls=(arm_imm,), default_val = "00000001") + + +mshift_name = {'LSLS': 0, 'LSRS': 1, 'ASRS': 2} +bs_mshift_name = bs_name(l=2, name=mshift_name) + + +addsub_name = {'ADDS': 0, 'SUBS': 1} +bs_addsub_name = bs_name(l=1, name=addsub_name) + +mov_cmp_add_sub_name = {'MOVS': 0, 'CMP': 1, 'ADDS': 2, 'SUBS': 3} +bs_mov_cmp_add_sub_name = bs_name(l=2, name=mov_cmp_add_sub_name) + +alu_name = {'ANDS': 0, 'EORS': 1, 'LSLS': 2, 'LSRS': 3, + 'ASRS': 4, 'ADCS': 5, 'SBCS': 6, 'RORS': 7, + 'TST': 8, 'NEGS': 9, 'CMP': 10, 'CMN': 11, + 'ORRS': 12, 'MULS': 13, 'BICS': 14, 'MVNS': 15} +bs_alu_name = bs_name(l=4, name=alu_name) + +hiregop_name = {'ADDS': 0, 'CMP': 1, 'MOV': 2} +bs_hiregop_name = bs_name(l=2, name=hiregop_name) + +ldr_str_name = {'STR': 0, 'LDR': 1} +bs_ldr_str_name = bs_name(l=1, name=ldr_str_name) + +ldrh_strh_name = {'STRH': 0, 'LDRH': 1} +bs_ldrh_strh_name = bs_name(l=1, name=ldrh_strh_name) + +ldstsp_name = {'STR': 0, 'LDR': 1} +bs_ldstsp_name = bs_name(l=1, name=ldstsp_name) + +addsubsp_name = {'ADD': 0, 'SUB': 1} +bs_addsubsp_name = bs_name(l=1, name=addsubsp_name) + +pushpop_name = {'PUSH': 0, 'POP': 1} +bs_pushpop_name = bs_name(l=1, name=pushpop_name, fname='pp') + +tbtransfer_name = {'STMIA': 0, 'LDMIA': 1} +bs_tbtransfer_name = bs_name(l=1, name=tbtransfer_name) + +br_name = {'BEQ': 0, 'BNE': 1, 'BCS': 2, 'BCC': 3, 'BMI': 4, + 'BPL': 5, 'BVS': 6, 'BVC': 7, 'BHI': 8, 'BLS': 9, + 'BGE': 10, 'BLT': 11, 'BGT': 12, 'BLE': 13} +bs_br_name = bs_name(l=4, name=br_name) + + +armtop("mshift", [bs('000'), bs_mshift_name, off5, rsl, rdl], [rdl, rsl, off5]) +armtop("addsubr", + [bs('000110'), bs_addsub_name, rnl, rsl, rdl], [rdl, rsl, rnl]) +armtop("addsubi", + [bs('000111'), bs_addsub_name, off3, rsl, rdl], [rdl, rsl, off3]) +armtop("mcas", [bs('001'), bs_mov_cmp_add_sub_name, rnl, off8]) +armtop("alu", [bs('010000'), bs_alu_name, rsl, rdl], [rdl, rsl]) + # should not be used ?? +armtop("hiregop00", + [bs('010001'), bs_hiregop_name, bs('00'), rsl, rdl], [rdl, rsl]) +armtop("hiregop01", + [bs('010001'), bs_hiregop_name, bs('01'), rsh, rdl], [rdl, rsh]) +armtop("hiregop10", + [bs('010001'), bs_hiregop_name, bs('10'), rsl, rdh], [rdh, rsl]) +armtop("hiregop11", + [bs('010001'), bs_hiregop_name, bs('11'), rsh, rdh], [rdh, rsh]) +armtop("bx", [bs('010001'), bs('11'), bs('00'), rsl, dumrh]) +armtop("bx", [bs('010001'), bs('11'), bs('01'), rsh, dumrh]) +armtop("ldr", [bs('01001'), rdl, offpc8]) +armtop("ldrstr", [bs('0101'), bs_ldr_str_name, + trb, bs('0'), rol_noarg, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("strh", [bs('0101'), bs('00'), bs('1'), + rol_noarg, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldrh", [bs('0101'), bs('10'), bs('1'), + rol_noarg, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldsb", [bs('0101'), bs('01'), bs('1'), + rol_noarg, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldsh", [bs('0101'), bs('11'), bs('1'), + rol_noarg, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldst", [bs('011'), trb, + bs_ldr_str_name, off5bw, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldhsth", + [bs('1000'), bs_ldrh_strh_name, off5h, rbl_deref, rdl], [rdl, rbl_deref]) +armtop("ldstsp", [bs('1001'), bs_ldstsp_name, rdl, offsp8], [rdl, offsp8]) +armtop("add", [bs('1010'), sppc, rdl, off8sppc], [rdl, sppc, off8sppc]) +armtop("addsp", [bs('10110000'), bs_addsubsp_name, sp, off7], [sp, off7]) +armtop("pushpop", + [bs('1011'), bs_pushpop_name, bs('10'), pclr, trlistpclr], [trlistpclr]) +armtop("btransfersp", [bs('1100'), bs_tbtransfer_name, rbl_wb, trlist]) +armtop("br", [bs('1101'), bs_br_name, offs8]) +armtop("blx", [bs("01000111"), bs('10'), rnl, bs('000')]) +armtop("swi", [bs('11011111'), tswi_i]) +armtop("b", [bs('11100'), offs11]) +armtop("und", [bs('1101'), bs('1110'), imm8_d1]) + +# +# thumnb2 ###################### +# + +# ARM Architecture Reference Manual Thumb-2 Supplement + +armt_gpreg_shift_off = Group( + gpregs_nosppc.parser + allshifts_t_armt + base_expr +).setParseAction(shift2expr) +armt_gpreg_shift_off |= gpregs_nosppc.parser + + +class arm_gpreg_nosppc(arm_reg): + reg_info = gpregs_nosppc + + +class armt_gpreg_rm_shift_off(arm_reg): + parser = armt_gpreg_shift_off + + def decode(self, v): + v = v & self.lmask + r = gpregs_nosppc.expr[v] + + i = int(self.parent.imm5_3.value) << 2 + i |= int(self.parent.imm5_2.value) + + if self.parent.stype.value < 3 or i != 0: + shift = allshifts_armt[self.parent.stype.value] + else: + shift = allshifts_armt[4] + self.expr = ExprOp(shift, r, ExprInt32(i)) + return True + + def encode(self): + e = self.expr + if isinstance(e, ExprId): + self.value = gpregs_nosppc.index(e) + self.parent.stype.value = 0 + self.parent.imm5_3.value = 0 + self.parent.imm5_2.value = 0 + return True + shift = e.op + r = gpregs_nosppc.expr.index(e.args[0]) + self.value = r + i = int(e.args[1].arg) + if shift == 'rrx': + if i != 1: + log.debug('rrx shift must be 1') + return False + self.parent.imm5_3.value = 0 + self.parent.imm5_2.value = 0 + self.parent.stype.value = 3 + return True + self.parent.stype.value = allshifts_armt.index(shift) + self.parent.imm5_2.value = i & 3 + self.parent.imm5_3.value = i >> 2 + return True + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + return str(e) + return str(e)[1:-1] + +rn_nosppc = bs(l=4, cls=(arm_gpreg_nosppc,), fname="rn") +rd_nosppc = bs(l=4, cls=(arm_gpreg_nosppc,), fname="rd") +rm_sh = bs(l=4, cls=(armt_gpreg_rm_shift_off,), fname="rm") + + +class armt2_imm12(arm_imm): + + def decode(self, v): + v = v & self.lmask + v |= int(self.parent.imm12_3.value) << 8 + v |= int(self.parent.imm12_1.value) << 11 + + # simple encoding + if 0 <= v < 0x100: + self.expr = ExprInt32(v) + return True + # 00XY00XY form + if v >> 8 == 1: + v &= 0xFF + self.expr = ExprInt32((v << 16) | v) + return True + # XY00XY00 form + if v >> 8 == 2: + v &= 0xFF + self.expr = ExprInt32((v << 24) | (v << 8)) + return True + # XYXYXYXY + if v >> 8 == 3: + v &= 0xFF + self.expr = ExprInt32((v << 24) | (v << 16) | (v << 8) | v) + return True + r = v >> 7 + v = v & 0xFF + self.expr = ExprInt32(myror32(v, r)) + return True + + def encode(self): + v = int(self.expr.arg) + value = None + # simple encoding + if 0 <= v < 0x100: + value = v + elif v & 0xFF00FF00 == 0 and v & 0xFF == (v >> 16) & 0xff: + # 00XY00XY form + value = (1 << 8) | (v & 0xFF) + elif v & 0x00FF00FF == 0 and (v >> 8) & 0xff == (v >> 24) & 0xff: + # XY00XY00 form + value = (2 << 8) | ((v >> 8) & 0xff) + elif (v & 0xFF == + (v >> 8) & 0xFF == + (v >> 16) & 0xFF == + (v >> 24) & 0xFF): + # XYXYXYXY form + value = (3 << 8) | ((v >> 16) & 0xff) + else: + # rol encoding + for i in xrange(32): + o = myrol32(v, i) + if 0 <= o < 0x100 and o & 0x80: + value = (i << 7) | o + break + if value is None: + log.debug('cannot encode imm12') + return False + self.value = value & self.lmask + self.parent.imm12_3.value = (value >> 8) & self.parent.imm12_3.lmask + self.parent.imm12_1.value = (value >> 11) & self.parent.imm12_1.lmask + return True + + +class armt2_imm10l(arm_imm): + + def decode(self, v): + v = v & self.lmask + s = self.parent.sign.value + j1 = self.parent.j1.value + j2 = self.parent.j2.value + imm10h = self.parent.imm10h.value + imm10l = v + + i1, i2 = j1 ^ s ^ 1, j2 ^ s ^ 1 + + v = (s << 24) | (i1 << 23) | ( + i2 << 22) | (imm10h << 12) | (imm10l << 2) + v = sign_ext(v, 25, 32) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = self.expr.arg.arg + s = 0 + if v & 0x80000000: + s = 1 + v = (-v) & 0xffffffff + if v > (1 << 26): + return False + i1, i2, imm10h, imm10l = (v >> 23) & 1, ( + v >> 22) & 1, (v >> 12) & 0x3ff, (v >> 2) & 0x3ff + j1, j2 = i1 ^ s ^ 1, i2 ^ s ^ 1 + self.parent.sign.value = s + self.parent.j1.value = j1 + self.parent.j2.value = j2 + self.parent.imm10h.value = imm10h + self.value = imm10l + return True + + +class armt2_imm11l(arm_imm): + + def decode(self, v): + v = v & self.lmask + s = self.parent.sign.value + j1 = self.parent.j1.value + j2 = self.parent.j2.value + imm10h = self.parent.imm10h.value + imm11l = v + + i1, i2 = j1 ^ s ^ 1, j2 ^ s ^ 1 + + v = (s << 24) | (i1 << 23) | ( + i2 << 22) | (imm10h << 12) | (imm11l << 1) + v = sign_ext(v, 25, 32) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = self.expr.arg.arg + s = 0 + if v & 0x80000000: + s = 1 + v = (-v) & 0xffffffff + if v > (1 << 26): + return False + i1, i2, imm10h, imm11l = (v >> 23) & 1, ( + v >> 22) & 1, (v >> 12) & 0x3ff, (v >> 1) & 0x7ff + j1, j2 = i1 ^ s ^ 1, i2 ^ s ^ 1 + self.parent.sign.value = s + self.parent.j1.value = j1 + self.parent.j2.value = j2 + self.parent.imm10h.value = imm10h + self.value = imm11l + return True + + +imm12_1 = bs(l=1, fname="imm12_1", order=1) +imm12_3 = bs(l=3, fname="imm12_3", order=1) +imm12_8 = bs(l=8, cls=(armt2_imm12,), fname="imm", order=2) + + +imm5_3 = bs(l=3, fname="imm5_3") +imm5_2 = bs(l=2, fname="imm5_2") +imm_stype = bs(l=2, fname="stype") + +imm1 = bs(l=1, fname="imm1") + + +class armt_imm5_1(arm_imm): + + def decode(self, v): + v = sign_ext(((self.parent.imm1.value << 5) | v) << 1, 7, 32) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = self.expr.arg.arg + if v & 0x80000000: + v &= (1 << 7) - 1 + self.parent.imm1.value = (v >> 6) & 1 + self.value = (v >> 1) & 0x1f + return True + +imm5_off = bs(l=5, cls=(armt_imm5_1,), fname="imm5_off") + +tsign = bs(l=1, fname="sign") +tj1 = bs(l=1, fname="j1") +tj2 = bs(l=1, fname="j2") + +timm10H = bs(l=10, fname="imm10h") +timm10L = bs(l=10, cls=(armt2_imm10l,), fname="imm10l") +timm11L = bs(l=11, cls=(armt2_imm11l,), fname="imm11l") + + +armtop("adc", [bs('11110'), imm12_1, bs('0'), bs('1010'), scc, rn_nosppc, + bs('0'), imm12_3, rd_nosppc, imm12_8]) +armtop("adc", [bs('11101'), bs('01'), bs('1010'), scc, rn_nosppc, + bs('0'), imm5_3, rd_nosppc, imm5_2, imm_stype, rm_sh]) +armtop("bl", [bs('11110'), tsign, timm10H, + bs('11'), tj1, bs('1'), tj2, timm11L]) +armtop("blx", [bs('11110'), tsign, timm10H, + bs('11'), tj1, bs('0'), tj2, timm10L, bs('0')]) +armtop("cbz", [bs('101100'), imm1, bs('1'), imm5_off, rnl], [rnl, imm5_off]) +armtop("cbnz", [bs('101110'), imm1, bs('1'), imm5_off, rnl], [rnl, imm5_off]) diff --git a/miasm2/arch/arm/disasm.py b/miasm2/arch/arm/disasm.py new file mode 100644 index 00000000..64e10eec --- /dev/null +++ b/miasm2/arch/arm/disasm.py @@ -0,0 +1,51 @@ +from miasm2.core.asmbloc import asm_constraint, disasmEngine +from arch import mn_arm, mn_armt + + +def cb_arm_fix_call( + mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + """ + for arm: + MOV LR, PC + LDR PC, [R5, 0x14] + * is a subcall * + + """ + if len(cur_bloc.lines) < 2: + return + l1 = cur_bloc.lines[-1] + l2 = cur_bloc.lines[-2] + if l1.name != "LDR": + return + if l2.name != "MOV": + return + # print cur_bloc + # print l1 + if not l1.args[0] in mn.pc.values(): + return + if not l2.args[1] in mn.pc.values(): + return + cur_bloc.add_cst(l1.offset + 4, asm_constraint.c_next, symbol_pool) + offsets_to_dis.add(l1.offset + 4) + +cb_arm_funcs = [cb_arm_fix_call] + + +def cb_arm_disasm(mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + for func in cb_arm_funcs: + func(mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool) + + +class dis_arm(disasmEngine): + attrib = 'arm' + + def __init__(self, bs=None, **kwargs): + super(dis_arm, self).__init__(mn_arm, self.attrib, bs, **kwargs) + self.dis_bloc_callback = cb_arm_disasm + + +class dis_armt(disasmEngine): + attrib = 'armt' + + def __init__(self, bs=None, **kwargs): + super(dis_armt, self).__init__(mn_armt, self.attrib, bs, **kwargs) diff --git a/miasm2/arch/arm/ira.py b/miasm2/arch/arm/ira.py new file mode 100644 index 00000000..7ff2c142 --- /dev/null +++ b/miasm2/arch/arm/ira.py @@ -0,0 +1,112 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * +from miasm2.ir.ir import ir, irbloc +from miasm2.ir.analysis import ira +from miasm2.arch.arm.sem import ir_arm, ir_armt +from miasm2.arch.arm.regs import * +# from miasm2.core.graph import DiGraph + + +class ir_a_arm_base(ir_arm, ira): + + def __init__(self, symbol_pool=None): + ir_arm.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.R0 + + +class ir_a_arm(ir_a_arm_base): + + def __init__(self, symbol_pool=None): + ir_a_arm_base.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.R0 + + # for test XXX TODO + def set_dead_regs(self, b): + b.rw[-1][1].add(self.arch.regs.zf) + b.rw[-1][1].add(self.arch.regs.nf) + b.rw[-1][1].add(self.arch.regs.of) + b.rw[-1][1].add(self.arch.regs.cf) + + def call_effects(self, ad): + irs = [[ExprAff(self.ret_reg, ExprOp('call_func_ret', ad, self.sp)), + ExprAff(self.sp, ExprOp('call_func_stack', ad, self.sp)), + ]] + return irs + + def post_add_bloc(self, bloc, ir_blocs): + ir.post_add_bloc(self, bloc, ir_blocs) + # flow_graph = DiGraph() + for irb in ir_blocs: + # print 'X'*40 + # print irb + pc_val = None + lr_val = None + for exprs in irb.irs: + for e in exprs: + if e.dst == PC: + pc_val = e.src + if e.dst == LR: + lr_val = e.src + if pc_val is None or lr_val is None: + continue + if not isinstance(lr_val, ExprInt): + continue + + l = bloc.lines[-1] + if lr_val.arg != l.offset + l.l: + continue + # print 'IS CALL!' + lbl = bloc.get_next() + new_lbl = self.gen_label() + irs = self.call_effects(pc_val) + nbloc = irbloc(new_lbl, ExprId(lbl, size=self.pc.size), irs) + nbloc.lines = [l] + self.blocs[new_lbl] = nbloc + irb.dst = ExprId(new_lbl, size=self.pc.size) + + """ + if not bloc.lines: + return + l = bloc.lines[-1] + sub_call_dst = None + if not l.is_subcall(): + return + sub_call_dst = l.args[0] + if self.ExprIsLabel(sub_call_dst): + sub_call_dst = sub_call_dst.name + for b in ir_blocs: + l = b.lines[-1] + sub_call_dst_b = None + sub_call_dst_b = l.args[0] + #if self.ExprIsLabel(sub_call_dst_b): + # sub_call_dst_b = sub_call_dst.name + #if str(b.dst) == str(sub_call_dst_b): + # pass + if not l.is_subcall(): + continue + if b.dst != sub_call_dst_b: + continue + sub_call_dst_b = l.args[0] + if self.ExprIsLabel(sub_call_dst_b): + sub_call_dst_b = sub_call_dst.name + lbl = bloc.get_next() + new_lbl = self.gen_label() + irs = self.call_effects(l.args[0]) + nbloc = irbloc(new_lbl, ExprId(lbl, size=self.pc.size), irs) + nbloc.lines = [l] + self.blocs[new_lbl] = nbloc + b.dst = ExprId(new_lbl, size=self.pc.size) + return + """ + + def get_out_regs(self, b): + return set([self.ret_reg, self.sp]) + + +class ir_a_armt(ir_armt, ir_a_arm): + + def __init__(self, symbol_pool): + ir_armt.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.R0 diff --git a/miasm2/arch/arm/regs.py b/miasm2/arch/arm/regs.py new file mode 100644 index 00000000..6ddac2ef --- /dev/null +++ b/miasm2/arch/arm/regs.py @@ -0,0 +1,80 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * + + +# GP + +regs32_str = ["R%d" % i for i in xrange(13)] + ["SP", "LR", "PC"] +regs32_expr = [ExprId(x, 32) for x in regs32_str] + + +R0 = regs32_expr[0] +R1 = regs32_expr[1] +R2 = regs32_expr[2] +R3 = regs32_expr[3] +R4 = regs32_expr[4] +R5 = regs32_expr[5] +R6 = regs32_expr[6] +R7 = regs32_expr[7] +R8 = regs32_expr[8] +R9 = regs32_expr[9] +R10 = regs32_expr[10] +R11 = regs32_expr[11] +R12 = regs32_expr[12] +SP = regs32_expr[13] +LR = regs32_expr[14] +PC = regs32_expr[15] + +R0_init = ExprId("R0_init") +R1_init = ExprId("R1_init") +R2_init = ExprId("R2_init") +R3_init = ExprId("R3_init") +R4_init = ExprId("R4_init") +R5_init = ExprId("R5_init") +R6_init = ExprId("R6_init") +R7_init = ExprId("R7_init") +R8_init = ExprId("R8_init") +R9_init = ExprId("R9_init") +R10_init = ExprId("R10_init") +R11_init = ExprId("R11_init") +R12_init = ExprId("R12_init") +SP_init = ExprId("SP_init") +LR_init = ExprId("LR_init") +PC_init = ExprId("PC_init") + + +reg_zf = 'zf' +reg_nf = 'nf' +reg_of = 'of' +reg_cf = 'cf' + +zf = ExprId(reg_zf, size=1) +nf = ExprId(reg_nf, size=1) +of = ExprId(reg_of, size=1) +cf = ExprId(reg_cf, size=1) + +zf_init = ExprId("zf_init", size=1) +nf_init = ExprId("nf_init", size=1) +of_init = ExprId("of_init", size=1) +cf_init = ExprId("cf_init", size=1) + + +all_regs_ids = [ + R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R11, R12, SP, LR, PC, + zf, nf, of, cf +] + +all_regs_ids_byname = dict([(x.name, x) for x in all_regs_ids]) + +all_regs_ids_init = [R0_init, R1_init, R2_init, R3_init, + R4_init, R5_init, R6_init, R7_init, + R8_init, R9_init, R10_init, R11_init, + R12_init, SP_init, LR_init, PC_init, + zf_init, nf_init, of_init, cf_init + ] + +regs_init = {} +for i, r in enumerate(all_regs_ids): + regs_init[r] = all_regs_ids_init[i] diff --git a/miasm2/arch/arm/sem.py b/miasm2/arch/arm/sem.py new file mode 100644 index 00000000..d40c86eb --- /dev/null +++ b/miasm2/arch/arm/sem.py @@ -0,0 +1,1040 @@ +from miasm2.expression.expression import * +from miasm2.ir.ir import ir, irbloc +from miasm2.arch.arm.arch import mn_arm, mn_armt + +# liris.cnrs.fr/~mmrissa/lib/exe/fetch.php?media=armv7-a-r-manual.pdf + +EXCEPT_PRIV_INSN = (1 << 17) + +# CPSR: N Z C V + +reg_r0 = 'R0' +reg_r1 = 'R1' +reg_r2 = 'R2' +reg_r3 = 'R3' +reg_r4 = 'R4' +reg_r5 = 'R5' +reg_r6 = 'R6' +reg_r7 = 'R7' +reg_r8 = 'R8' +reg_r9 = 'R9' +reg_r10 = 'R10' +reg_r11 = 'R11' +reg_r12 = 'R12' +reg_sp = 'SP' +reg_lr = 'LR' +reg_pc = 'PC' + +reg_zf = 'zf' +reg_nf = 'nf' +reg_of = 'of' +reg_cf = 'cf' + +zf = ExprId(reg_zf, size=1) +nf = ExprId(reg_nf, size=1) +of = ExprId(reg_of, size=1) +cf = ExprId(reg_cf, size=1) + +R0 = ExprId(reg_r0) +R1 = ExprId(reg_r1) +R2 = ExprId(reg_r2) +R3 = ExprId(reg_r3) +R4 = ExprId(reg_r4) +R5 = ExprId(reg_r5) +R6 = ExprId(reg_r6) +R7 = ExprId(reg_r7) +R8 = ExprId(reg_r8) +R9 = ExprId(reg_r9) +R10 = ExprId(reg_r10) +R11 = ExprId(reg_r11) +R12 = ExprId(reg_r12) +SP = ExprId(reg_sp) +LR = ExprId(reg_lr) +PC = ExprId(reg_pc) + + +all_registers = [ + R0, + R1, + R2, + R3, + R4, + R5, + R6, + R7, + R8, + R9, + R10, + R11, + R12, + SP, + LR, + PC, +] + + +def update_flag_zf(a): + return [ExprAff(zf, ExprCond(a, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))] + + +def update_flag_nf(a): + return [ExprAff(nf, a.msb())] + + +def update_flag_pf(a): + return [ExprAff(pf, ExprOp('parity', a))] + + +def update_flag_af(a): + return [ExprAff(af, ExprCond(a & ExprInt_from(a, 0x10), + ExprInt_from(af, 1), ExprInt_from(af, 0)))] + + +def update_flag_zn(a): + e = [] + e += update_flag_zf(a) + e += update_flag_nf(a) + return e + + +def update_flag_logic(a): + e = [] + e += update_flag_zn(a) + e.append(ExprAff(cf, ExprInt1(0))) + return e + + +def update_flag_arith(a): + e = [] + e += update_flag_zn(a) + return e + + +def check_ops_msb(a, b, c): + if not a or not b or not c or a != b or a != c: + raise ValueError('bad ops size %s %s %s' % (a, b, c)) + + +def arith_flag(a, b, c): + a_s, b_s, c_s = a.size, b.size, c.size + check_ops_msb(a_s, b_s, c_s) + a_s, b_s, c_s = a.msb(), b.msb(), c.msb() + return a_s, b_s, c_s + +# checked: ok for adc add because b & c before +cf + + +def update_flag_add_cf(a, b, c): + return ExprAff(cf, + ((((a ^ b) ^ c) ^ ((a ^ c) & (~(a ^ b)))).msb()) ^ ExprInt1(1)) + + +def update_flag_add_of(a, b, c): + return ExprAff(of, (((a ^ c) & (~(a ^ b)))).msb()) + + +# checked: ok for sbb add because b & c before +cf +def update_flag_sub_cf(a, b, c): + return ExprAff(cf, + ((((a ^ b) ^ c) ^ ((a ^ c) & (a ^ b))).msb()) ^ ExprInt1(1)) + + +def update_flag_sub_of(a, b, c): + return ExprAff(of, (((a ^ c) & (a ^ b))).msb()) + +# z = x+y (+cf?) + + +def update_flag_add(x, y, z): + e = [] + e.append(update_flag_add_cf(x, y, z)) + e.append(update_flag_add_of(x, y, z)) + return e + +# z = x-y (+cf?) + + +def update_flag_sub(x, y, z): + e = [] + e.append(update_flag_sub_cf(x, y, z)) + e.append(update_flag_sub_of(x, y, z)) + return e + + +def get_dst(a): + if a == PC: + return PC + return None + +# instruction definition ############## + + +def adc(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b + x + cf.zeroExtend(32) + if instr.name == 'ADCS' and a != PC: + e += update_flag_arith(c) + e += update_flag_add(b, x, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def add(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b + x + if instr.name == 'ADDS' and a != PC: + e += update_flag_arith(c) + e += update_flag_add(b, x, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def l_and(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b & x + if instr.name == 'ANDS' and a != PC: + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def sub(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b - x + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def subs(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b - x + e += update_flag_arith(c) + e += update_flag_sub(b, x, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def eor(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b ^ x + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def eors(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b ^ x + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def rsb(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = x - b + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def rsbs(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = x - b + e += update_flag_arith(c) + e += update_flag_sub(b, x, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def sbc(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = (b + cf.zeroExtend(32)) - (x + ExprInt32(1)) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def sbcs(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = (b + cf.zeroExtend(32)) - (x + ExprInt32(1)) + e += update_flag_arith(c) + e += update_flag_sub(b, x, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def rsc(ir, instr, x, a, b): + e = [] + if x is None: + b, x = a, b + c = (x + cf.zeroExtend(32)) - (b + ExprInt32(1)) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def rscs(ir, instr, x, a, b): + e = [] + if x is None: + b, x = a, b + c = (x + cf.zeroExtend(32)) - (b + ExprInt32(1)) + e.append(ExprAff(a, c)) + e += update_flag_arith(c) + e += update_flag_sub(x, b, c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def tst(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b & x + e += update_flag_logic(c) + return None, e + + +def teq(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b ^ x + e += update_flag_logic(c) + return None, e + + +def l_cmp(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b - x + e += update_flag_arith(c) + e += update_flag_sub(x, b, c) + return None, e + + +def cmn(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b + x + e += update_flag_arith(c) + e += update_flag_add(b, x, c) + return None, e + + +def orr(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b | x + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def orrs(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b | x + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def mov(ir, instr, a, b): + e = [ExprAff(a, b)] + dst = get_dst(a) + return dst, e + + +def movt(ir, instr, a, b): + e = [ExprAff(a, a | b << ExprInt32(16))] + dst = get_dst(a) + return dst, e + + +def movs(ir, instr, a, b): + e = [] + e.append(ExprAff(a, b)) + # XXX TODO check + e += update_flag_logic(b) + dst = get_dst(a) + return dst, e + + +def mvn(ir, instr, a, b): + e = [ExprAff(a, b ^ ExprInt32(-1))] + dst = get_dst(a) + return dst, e + + +def mvns(ir, instr, a, b): + e = [] + c = b ^ ExprInt32(-1) + e.append(ExprAff(a, c)) + # XXX TODO check + e += update_flag_logic(c) + dst = get_dst(a) + return dst, e + + +def bic(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b & (x ^ ExprInt(uint32(-1))) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def bics(ir, instr, a, b, x=None): + e = [] + if x is None: + b, x = a, b + c = b & (x ^ ExprInt(uint32(-1))) + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def mla(ir, instr, x, a, b, c): + e = [] + d = (a * b) + c + e.append(ExprAff(x, d)) + dst = get_dst(x) + return dst, e + + +def mlas(ir, instr, x, a, b, c): + e = [] + d = (a * b) + c + e += update_flag_zn(d) + e.append(ExprAff(x, d)) + dst = get_dst(x) + return dst, e + + +def mul(ir, instr, x, a, b): + e = [] + c = a * b + e.append(ExprAff(x, c)) + dst = get_dst(x) + return dst, e + + +def muls(ir, instr, x, a, b): + e = [] + c = a * b + e += update_flag_zn(c) + e.append(ExprAff(x, c)) + dst = get_dst(x) + return dst, e + + +def b(ir, instr, a): + e = [] + e.append(ExprAff(PC, a)) + return a, e + + +def bl(ir, instr, a): + e = [] + l = ExprInt32(instr.offset + instr.l) + e.append(ExprAff(PC, a)) + e.append(ExprAff(LR, l)) + return a, e + + +def bx(ir, instr, a): + e = [] + e.append(ExprAff(PC, a)) + return a, e + + +def blx(ir, instr, a): + e = [] + l = ExprInt32(instr.offset + instr.l) + e.append(ExprAff(PC, a)) + e.append(ExprAff(LR, l)) + return a, e + + +def st_ld_r(ir, instr, a, b, store=False, size=32, s_ext=False, z_ext=False): + e = [] + wb = False + b = b.copy() + postinc = False + if isinstance(b, ExprOp): + if b.op == "wback": + wb = True + b = b.args[0] + if b.op == "postinc": + postinc = True + if isinstance(b, ExprOp) and b.op in ["postinc", 'preinc']: + # XXX TODO CHECK + base, off = b.args[0], b.args[1] # ExprInt32(size/8) + else: + base, off = b, ExprInt32(0) + # print a, wb, base, off, postinc + if postinc: + ad = base + else: + ad = base + off + + dmem = False + if size in [8, 16]: + if store: + a = a[:size] + m = ExprMem(ad, size=size) + elif s_ext: + m = ExprMem(ad, size=size).signExtend(a.size) + elif z_ext: + m = ExprMem(ad, size=size).zeroExtend(a.size) + else: + raise ValueError('unhandled case') + elif size == 32: + m = ExprMem(ad, size=size) + pass + elif size == 64: + m = ExprMem(ad, size=32) + dmem = True + a2 = ir.arch.regs.all_regs_ids[ir.arch.regs.all_regs_ids.index(a) + 1] + size = 32 + else: + raise ValueError('the size DOES matter') + dst = None + + if store: + e.append(ExprAff(m, a)) + if dmem: + e.append(ExprAff(ExprMem(ad + ExprInt32(4), size=size), a2)) + else: + if a == PC: + dst = PC + e.append(ExprAff(a, m)) + if dmem: + e.append(ExprAff(a2, ExprMem(ad + ExprInt32(4), size=size))) + + # XXX TODO check multiple write cause by wb + if wb or postinc: + e.append(ExprAff(base, base + off)) + return dst, e + + +def ldr(ir, instr, a, b): + return st_ld_r(ir, instr, a, b, store=False) + + +def ldrd(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=False, size=64) + return dst, e + + +def l_str(ir, instr, a, b): + return st_ld_r(ir, instr, a, b, store=True) + + +def l_strd(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=True, size=64) + return dst, e + + +def ldrb(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=False, size=8, z_ext=True) + return dst, e + + +def strb(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=True, size=8) + return dst, e + + +def ldrh(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=False, size=16, z_ext=True) + return dst, e + + +def strh(ir, instr, a, b): + dst, e = st_ld_r(ir, instr, a, b, store=True, size=16, z_ext=True) + return dst, e + + +def ldrsh(ir, instr, a, b): + dst, e = st_ld_r( + ir, instr, a, b, store=False, size=16, s_ext=True, z_ext=False) + return dst, e + + +def st_ld_m(ir, instr, a, b, store=False, postinc=False, updown=False): + e = [] + wb = False + # sb = False + dst = None + if isinstance(a, ExprOp) and a.op == 'wback': + wb = True + a = a.args[0] + if isinstance(b, ExprOp) and b.op == 'sbit': + # sb = True + b = b.args[0] + regs = b.args + base = a + if updown: + step = 4 + else: + step = -4 + regs = regs[::-1] + if postinc: + pass + else: + base += ExprInt32(step) + for i, r in enumerate(regs): + ad = base + ExprInt32(i * step) + if store: + e.append(ExprAff(ExprMem(ad), r)) + else: + e.append(ExprAff(r, ExprMem(ad))) + # XXX TODO check multiple write cause by wb + if wb: + if postinc: + e.append(ExprAff(a, base + ExprInt32(len(regs) * step))) + else: + e.append(ExprAff(a, base + ExprInt32((len(regs) - 1) * step))) + if store: + pass + else: + assert(isinstance(b, ExprOp) and b.op == "reglist") + if PC in b.args: + dst = PC + + return dst, e + + +def ldmia(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=False, postinc=True, updown=True) + + +def ldmib(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=False, postinc=False, updown=True) + + +def ldmda(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=False, postinc=True, updown=False) + + +def ldmdb(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=False, postinc=False, updown=False) + + +def stmia(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=True, postinc=True, updown=True) + + +def stmib(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=True, postinc=False, updown=True) + + +def stmda(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=True, postinc=True, updown=False) + + +def stmdb(ir, instr, a, b): + return st_ld_m(ir, instr, a, b, store=True, postinc=False, updown=False) + + +def svc(ir, instr, a): + # XXX TODO implement + e = [ + ExprAff(ExprId('vmmngr.exception_flags'), ExprInt32(EXCEPT_PRIV_INSN))] + return None, e + + +def und(ir, instr, a, b): + # XXX TODO implement + e = [] + return None, e + + +def lsr(ir, instr, a, b, x): + e = [] + c = b >> x + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def lsrs(ir, instr, a, b, x): + e = [] + c = b >> x + e.append(ExprAff(a, c)) + e += update_flag_logic(c) + dst = get_dst(a) + return dst, e + + +def lsl(ir, instr, a, b, x): + e = [] + c = b << x + e.append(ExprAff(a, c)) + dst = get_dst(a) + return dst, e + + +def lsls(ir, instr, a, b, x): + e = [] + c = b << x + e.append(ExprAff(a, c)) + e += update_flag_logic(c) + dst = get_dst(a) + return dst, e + + +def push(ir, instr, a): + e = [] + regs = list(a.args) + for i in xrange(len(regs)): + c = SP + ExprInt32(-4 * (i + 1)) + e.append(ExprAff(regs[i], ExprMem(c))) + c = SP + ExprInt32(-4 * len(regs)) + e.append(ExprAff(SP, c)) + return None, e + + +def pop(ir, instr, a): + e = [] + regs = list(a.args) + for i in xrange(len(regs)): + c = SP + ExprInt32(4 * i) + e.append(ExprAff(regs[i], ExprMem(c))) + c = SP + ExprInt32(4 * len(regs)) + e.append(ExprAff(SP, c)) + dst = None + if PC in a.get_r(): + dst = PC + return dst, e + + +def cbz(ir, instr, a, b): + e = [] + lbl_next = ExprId(ir.get_next_label(instr), 32) + dst = ExprCond(a, lbl_next, b) + return dst, e + + +def cbnz(ir, instr, a, b): + e = [] + lbl_next = ExprId(ir.get_next_label(instr), 32) + dst = ExprCond(a, b, lbl_next) + return dst, e + + +COND_EQ = 0 +COND_NE = 1 +COND_CS = 2 +COND_CC = 3 +COND_MI = 4 +COND_PL = 5 +COND_VS = 6 +COND_VC = 7 +COND_HI = 8 +COND_LS = 9 +COND_GE = 10 +COND_LT = 11 +COND_GT = 12 +COND_LE = 13 +COND_AL = 14 +COND_NV = 15 + +cond_dct = { + COND_EQ: "EQ", + COND_NE: "NE", + COND_CS: "CS", + COND_CC: "CC", + COND_MI: "MI", + COND_PL: "PL", + COND_VS: "VS", + COND_VC: "VC", + COND_HI: "HI", + COND_LS: "LS", + COND_GE: "GE", + COND_LT: "LT", + COND_GT: "GT", + COND_LE: "LE", + COND_AL: "AL", + # COND_NV: "NV", +} + + +tab_cond = {COND_EQ: zf, + COND_NE: ExprOp('==', zf, ExprInt1(0)), + COND_CS: cf, + COND_CC: ExprOp('==', cf, ExprInt1(0)), + COND_MI: nf, + COND_PL: ExprOp('==', nf, ExprInt1(0)), + COND_VS: of, + COND_VC: ExprOp('==', of, ExprInt1(0)), + COND_HI: cf & ExprOp('==', zf, ExprInt1(0)), + # COND_HI: cf, + # COND_HI: ExprOp('==', + # ExprOp('|', cf, zf), + # ExprInt1(0)), + COND_LS: ExprOp('==', cf, ExprInt1(0)) | zf, + COND_GE: ExprOp('==', nf, of), + COND_LT: nf ^ of, + # COND_GT: ExprOp('|', + # ExprOp('==', zf, ExprInt1(0)) & (nf | of), + # ExprOp('==', nf, ExprInt1(0)) & ExprOp('==', of, ExprInt1(0))), + COND_GT: ExprOp('==', zf, ExprInt1(0)) & ExprOp('==', nf, of), + COND_LE: zf | (nf ^ of), + } + + +def is_pc_written(ir, instr_ir): + all_pc = ir.mn.pc.values() + for ir in instr_ir: + if ir.dst in all_pc: + return True, ir.dst + return False, None + + +def add_condition_expr(ir, instr, cond, instr_ir, dst): + # print "XXX", hex(instr.offset), instr + if cond == COND_AL: + return dst, instr_ir, [] + if not cond in tab_cond: + raise ValueError('unknown condition %r' % cond) + cond = tab_cond[cond] + + lbl_next = ExprId(ir.get_next_label(instr), 32) + lbl_do = ExprId(ir.gen_label(), 32) + + dst_cond = ExprCond(cond, lbl_do, lbl_next) + assert(isinstance(instr_ir, list)) + + if dst is None: + dst = lbl_next + e_do = irbloc(lbl_do.name, dst, [instr_ir]) + return dst_cond, [], [e_do] + +mnemo_func = {} +mnemo_func_cond = {} +mnemo_condm0 = {'add': add, + 'sub': sub, + 'eor': eor, + 'and': l_and, + 'rsb': rsb, + 'adc': adc, + 'sbc': sbc, + 'rsc': rsc, + + 'tst': tst, + 'teq': teq, + 'cmp': l_cmp, + 'cmn': cmn, + 'orr': orr, + 'mov': mov, + 'movt': movt, + 'bic': bic, + 'mvn': mvn, + + 'mul': mul, + 'mla': mla, + 'ldr': ldr, + 'ldrd': ldrd, + 'str': l_str, + 'strd': l_strd, + 'b': b, + 'bl': bl, + 'svc': svc, + 'und': und, + 'bx': bx, + 'ldrh': ldrh, + 'strh': strh, + 'ldrsh': ldrsh, + } + +mnemo_condm1 = {'adds': add, + 'subs': subs, + 'eors': eors, + 'ands': l_and, + 'rsbs': rsbs, + 'adcs': adc, + 'sbcs': sbcs, + 'rscs': rscs, + + 'orrs': orrs, + 'movs': movs, + 'bics': bics, + 'mvns': mvns, + + 'muls': muls, + 'mlas': mlas, + 'blx': blx, + + 'ldrb': ldrb, + 'strb': strb, + + } + +mnemo_condm2 = {'ldmia': ldmia, + 'ldmib': ldmib, + 'ldmda': ldmda, + 'ldmdb': ldmdb, + + 'ldmfa': ldmda, + 'ldmfd': ldmia, + 'ldmea': ldmdb, + 'ldmed': ldmib, # XXX + + + 'stmia': stmia, + 'stmib': stmib, + 'stmda': stmda, + 'stmdb': stmdb, + + 'stmfa': stmib, + 'stmed': stmda, + 'stmfd': stmdb, + 'stmea': stmia, + } + + +mnemo_nocond = {'lsr': lsr, + 'lsrs': lsrs, + 'lsl': lsl, + 'lsls': lsls, + 'push': push, + 'pop': pop, + 'cbz': cbz, + 'cbnz': cbnz, + } +mn_cond_x = [mnemo_condm0, + mnemo_condm1, + mnemo_condm2] + +for index, mn_base in enumerate(mn_cond_x): + for mn, mf in mn_base.items(): + for cond, cn in cond_dct.items(): + if cond == COND_AL: + cn = "" + cn = cn.lower() + if index == 0: + mn_mod = mn + cn + else: + mn_mod = mn[:-index] + cn + mn[-index:] + # print mn_mod + mnemo_func_cond[mn_mod] = cond, mf + +for name, mf in mnemo_nocond.items(): + mnemo_func_cond[name] = COND_AL, mf + + +def split_expr_dst(ir, instr_ir): + out = [] + dst = None + for i in instr_ir: + if i.dst == ir.pc: + out.append(i) + dst = ir.pc # i.src + else: + out.append(i) + return out, dst + + +def get_mnemo_expr(ir, instr, *args): + if not instr.name.lower() in mnemo_func_cond: + raise ValueError('unknown mnemo %s' % instr) + cond, mf = mnemo_func_cond[instr.name.lower()] + dst, instr_ir = mf(ir, instr, *args) + dst, instr, extra_ir = add_condition_expr(ir, instr, cond, instr_ir, dst) + return dst, instr, extra_ir + +get_arm_instr_expr = get_mnemo_expr + + +class arminfo: + mode = "arm" + # offset + + +class ir_arm(ir): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_arm, "arm", symbol_pool) + self.pc = PC + self.sp = SP + + def get_ir(self, instr): + args = instr.args + # ir = get_mnemo_expr(self, self.name.lower(), *args) + if len(args) and isinstance(args[-1], ExprOp): + if args[-1].op == 'rrx': + args[-1] = ExprCompose( + [(args[-1].args[0][1:], 0, 31), (cf, 31, 32)]) + elif (args[-1].op in ['<<', '>>', '<<a', 'a>>', '<<<', '>>>'] and + isinstance(args[-1].args[-1], ExprId)): + args[-1].args = args[-1].args[:-1] + ( + args[-1].args[-1][:8].zeroExtend(32),) + dst, instr_ir, extra_ir = get_mnemo_expr(self, instr, *args) + # if self.name.startswith('B'): + # return instr_ir, extra_ir + for i, x in enumerate(instr_ir): + x = ExprAff(x.dst, x.src.replace_expr( + {self.pc: ExprInt32(instr.offset + 8)})) + instr_ir[i] = x + for b in extra_ir: + for irs in b.irs: + for i, x in enumerate(irs): + x = ExprAff(x.dst, x.src.replace_expr( + {self.pc: ExprInt32(instr.offset + 8)})) + irs[i] = x + # return out_ir, extra_ir + return dst, instr_ir, extra_ir + + +class ir_armt(ir): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_armt, "armt", symbol_pool) + self.pc = PC + self.sp = SP + + def get_ir(self, instr): + return get_mnemo_expr(self, instr, *instr.args) + diff --git a/miasm2/arch/exe64.bin b/miasm2/arch/exe64.bin new file mode 100644 index 00000000..d7b5256b --- /dev/null +++ b/miasm2/arch/exe64.bin Binary files differdiff --git a/miasm2/arch/msp430/__init__.py b/miasm2/arch/msp430/__init__.py new file mode 100644 index 00000000..bbad893b --- /dev/null +++ b/miasm2/arch/msp430/__init__.py @@ -0,0 +1 @@ +__all__ = ["arch", "disasm", "regs", "sem"] diff --git a/miasm2/arch/msp430/arch.py b/miasm2/arch/msp430/arch.py new file mode 100644 index 00000000..74cce9ea --- /dev/null +++ b/miasm2/arch/msp430/arch.py @@ -0,0 +1,601 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import logging +from pyparsing import * +from miasm2.expression.expression import * +from miasm2.core.cpu import * +from collections import defaultdict +from miasm2.core.bin_stream import bin_stream +import regs as regs_module +from regs import * + +log = logging.getLogger("armdis") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.DEBUG) + + +def deref2expr_nooff(s, l, t): + t = t[0] + if len(t) == 1 and isinstance(t[0], ExprId): + return ExprMem(t[0], 16) + elif len(t) == 1 and isinstance(t[0], ExprInt): + return ExprMem(t[0], 16) + raise NotImplementedError('not fully functional') + + +def deref2expr_pinc(s, l, t): + t = t[0] + if len(t) == 1 and isinstance(t[0], ExprId): + return ExprOp('autoinc', t[0]) + raise NotImplementedError('not fully functional') + + +def deref2expr_off(s, l, t): + t = t[0] + if len(t) == 2 and isinstance(t[1], ExprId): + return ExprMem(t[1] + t[0], 16) + raise NotImplementedError('not fully functional') + + +def deref_expr(s, l, t): + t = t[0] + assert(len(t) == 1) + t = t[0] + if isinstance(t, ExprId): + return t + elif isinstance(t, ExprInt): + return t + elif isinstance(t, ExprMem): + return t + elif isinstance(t, ExprOp) and t.op == "autoinc": + return t + raise NotImplementedError('not fully functional') + if t[-1] == '!': + return ExprOp('wback', *t[:-1]) + return t[0] + + +def f_reg2expr(t): + t = t[0] + i = regs16_str.index(t) + r = regs16_expr[i] + return r + +# gpregs.parser.setParseAction(f_reg2expr) + +ARO = Suppress("@") +LPARENT = Suppress("(") +RPARENT = Suppress(")") + +PINC = Suppress("+") + + +def ast_id2expr(t): + if not t in mn_msp430.regs.all_regs_ids_byname: + r = ExprId(t, 16) + else: + r = mn_msp430.regs.all_regs_ids_byname[t] + return r + + +def ast_int2expr(a): + return ExprInt16(a) + + +variable, operand, base_expr = gen_base_expr() + +my_var_parser = parse_ast(ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + + +deref_nooff = Group(ARO + base_expr).setParseAction(deref2expr_nooff) +deref_pinc = Group(ARO + base_expr + PINC).setParseAction(deref2expr_pinc) +deref_off = Group(base_expr + LPARENT + + gpregs.parser + RPARENT).setParseAction(deref2expr_off) + + +sreg_p = Group(deref_pinc | deref_nooff | + deref_off | base_expr).setParseAction(deref_expr) + + +class additional_info: + + def __init__(self): + self.except_on_instr = False + + +class instruction_msp430(instruction): + delayslot = 0 + + def dstflow(self): + if self.name.startswith('j'): + return True + return self.name in ['call'] + + def dstflow2label(self, symbol_pool): + e = self.args[0] + if not isinstance(e, ExprInt): + return + if self.name == "call": + ad = e.arg + else: + ad = e.arg + int(self.offset) + self.l + + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0] = s + + def breakflow(self): + if self.name.startswith('j'): + return True + if self.name.startswith('ret'): + return True + if self.name.startswith('int'): + return True + if self.name.startswith('mov') and self.args[1] == PC: + return True + return self.name in ['call'] + + def splitflow(self): + if self.name.startswith('jmp'): + return False + if self.name.startswith('j'): + return True + return self.name in ['call'] + + def setdstflow(self, a): + return + + def is_subcall(self): + return self.name in ['call'] + + def getdstflow(self, symbol_pool): + return [self.args[0]] + + def get_symbol_size(self, symbol, symbol_pool): + return self.mode + + def fixDstOffset(self): + e = self.args[0] + if self.offset is None: + raise ValueError('symbol not resolved %s' % l) + if not isinstance(e, ExprInt): + # raise ValueError('dst must be int or label') + log.warning('dynamic dst %r' % e) + return + # return ExprInt32(e.arg - (self.offset + self.l)) + self.args[0] = ExprInt_fromsize(self.mode, e.arg) + + def get_info(self, c): + pass + + def __str__(self): + o = super(instruction_msp430, self).__str__() + return o + + def get_args_expr(self): + args = [] + for a in self.args: + # a = a.replace_expr(replace_regs[self.mode]) + args.append(a) + return args + + +mode_msp430 = None + + +class mn_msp430(cls_mn): + name = "msp430" + regs = regs_module + all_mn = [] + bintree = {} + num = 0 + delayslot = 0 + pc = {None: PC} + sp = {None: SP} + all_mn_mode = defaultdict(list) + all_mn_name = defaultdict(list) + all_mn_inst = defaultdict(list) + instruction = instruction_msp430 + max_instruction_len = 8 + + @classmethod + def getpc(cls, attrib): + return PC + + @classmethod + def getsp(cls, attrib): + return SP + + @classmethod + def check_mnemo(cls, fields): + l = sum([x.l for x in fields]) + assert l % 16 == 00, "len %r" % l + + @classmethod + def getbits(cls, bs, start, n): + if not n: + return 0 + o = 0 + if n > bs.getlen() * 8: + raise ValueError('not enought bits %r %r' % (n, len(bs.bin) * 8)) + while n: + i = start / 8 + c = cls.getbytes(bs, i) + if not c: + raise IOError + c = ord(c) + r = 8 - start % 8 + c &= (1 << r) - 1 + l = min(r, n) + c >>= (r - l) + o <<= l + o |= c + n -= l + start += l + return o + + @classmethod + def getbytes(cls, bs, offset, l=1): + out = "" + for _ in xrange(l): + n_offset = (offset & ~1) + 1 - offset % 2 + out += bs.getbytes(n_offset, 1) + offset += 1 + return out + + def decoded2bytes(self, result): + tmp = super(mn_msp430, self).decoded2bytes(result) + out = [] + for x in tmp: + o = "" + while x: + o += x[:2][::-1] + x = x[2:] + out.append(o) + return out + + @classmethod + def gen_modes(cls, subcls, name, bases, dct, fields): + dct['mode'] = None + return [(subcls, name, bases, dct, fields)] + + def additional_info(self): + info = additional_info() + return info + + @classmethod + def getmn(cls, name): + return name.upper() + + def reset_class(self): + super(mn_msp430, self).reset_class() + + def getnextflow(self, symbol_pool): + raise NotImplementedError('not fully functional') + return self.offset + 4 + + +def addop(name, fields, args=None, alias=False): + dct = {"fields": fields} + dct["alias"] = alias + if args is not None: + dct['args'] = args + type(name, (mn_msp430,), dct) + + +class bw_mn(bs_mod_name): + prio = 5 + mn_mod = ['.w', '.b'] + + +class msp430_sreg_arg(reg_noarg, m_arg): + prio = default_prio + 1 + reg_info = gpregs + parser = sreg_p + + def decode(self, v): + size = 16 + if hasattr(self.parent, 'size'): + size = [16, 8][self.parent.size.value] + v = v & self.lmask + e = self.reg_info.expr[v] + if self.parent.a_s.value == 0b00: + if e == R3: + self.expr = ExprInt_fromsize(size, 0) + else: + self.expr = e + elif self.parent.a_s.value == 0b01: + if e == SR: + self.expr = ExprMem(ExprInt16(self.parent.off_s.value), size) + elif e == R3: + self.expr = ExprInt_fromsize(size, 1) + else: + self.expr = ExprMem( + e + ExprInt16(self.parent.off_s.value), size) + elif self.parent.a_s.value == 0b10: + if e == SR: + self.expr = ExprInt_fromsize(size, 4) + elif e == R3: + self.expr = ExprInt_fromsize(size, 2) + else: + self.expr = ExprMem(e, size) + elif self.parent.a_s.value == 0b11: + if e == SR: + self.expr = ExprInt_fromsize(size, 8) + elif e == R3: + if self.parent.size.value == 0: + self.expr = ExprInt_fromsize(size, 0xffff) + else: + self.expr = ExprInt_fromsize(size, 0xff) + elif e == PC: + self.expr = ExprInt_fromsize(size, self.parent.off_s.value) + else: + self.expr = ExprOp('autoinc', e) + else: + raise NotImplementedError( + "unknown value self.parent.a_s.value = " + + "%d" % self.parent.a_s.value) + return True + + def encode(self): + e = self.expr + if e in self.reg_info.expr: + self.parent.a_s.value = 0 + self.value = self.reg_info.expr.index(e) + elif isinstance(e, ExprInt): + v = int(e.arg) + if v == 0xffff and self.parent.size.value == 0: + self.parent.a_s.value = 0b11 + self.value = 3 + elif v == 0xff and self.parent.size.value == 1: + self.parent.a_s.value = 0b11 + self.value = 3 + elif v == 2: + self.parent.a_s.value = 0b10 + self.value = 3 + elif v == 1: + self.parent.a_s.value = 0b01 + self.value = 3 + elif v == 8: + self.parent.a_s.value = 0b11 + self.value = 2 + elif v == 4: + self.parent.a_s.value = 0b10 + self.value = 2 + elif v == 0: + self.parent.a_s.value = 0b00 + self.value = 3 + else: + self.parent.a_s.value = 0b11 + self.value = 0 + self.parent.off_s.value = v + elif isinstance(e, ExprMem): + if isinstance(e.arg, ExprId): + self.parent.a_s.value = 0b10 + self.value = self.reg_info.expr.index(e.arg) + elif isinstance(e.arg, ExprInt): + self.parent.a_s.value = 0b01 + self.value = self.reg_info.expr.index(SR) + self.parent.off_s.value = int(e.arg.arg) + elif isinstance(e.arg, ExprOp): + self.parent.a_s.value = 0b01 + self.value = self.reg_info.expr.index(e.arg.args[0]) + self.parent.off_s.value = int(e.arg.args[1].arg) + else: + raise NotImplementedError( + 'unknown instance e.arg = %s' % type(e.arg)) + elif isinstance(e, ExprOp) and e.op == "autoinc": + self.parent.a_s.value = 0b11 + self.value = self.reg_info.expr.index(e.args[0]) + else: + raise NotImplementedError('unknown instance e = %s' % type(e)) + return True + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + o = str(e) + elif isinstance(e, ExprInt): + o = str(e) + elif isinstance(e, ExprOp) and e.op == "autoinc": + o = "@%s+" % str(e.args[0]) + elif isinstance(e, ExprMem): + if isinstance(e.arg, ExprId): + o = "@%s" % e.arg + elif isinstance(e.arg, ExprInt): + o = "@%s" % e.arg + elif isinstance(e.arg, ExprOp): + o = "%s(%s)" % (e.arg.args[1], e.arg.args[0]) + else: + raise NotImplementedError('unknown instance e = %s' % type(e)) + return o + + +class msp430_dreg_arg(msp430_sreg_arg): + prio = default_prio + 1 + reg_info = gpregs + parser = sreg_p + + def decode(self, v): + if hasattr(self.parent, 'size'): + size = [16, 8][self.parent.size.value] + else: + size = 16 + + v = v & self.lmask + e = self.reg_info.expr[v] + if self.parent.a_d.value == 0: + self.expr = e + elif self.parent.a_d.value == 1: + if e == SR: + x = ExprInt16(self.parent.off_d.value) + else: + x = e + ExprInt16(self.parent.off_d.value) + self.expr = ExprMem(x, size) + else: + raise NotImplementedError( + "unknown value self.parent.a_d.value = " + + "%d" % self.parent.a_d.value) + return True + + def encode(self): + e = self.expr + if e in self.reg_info.expr: + self.parent.a_d.value = 0 + self.value = self.reg_info.expr.index(e) + elif isinstance(e, ExprMem): + if isinstance(e.arg, ExprId): + r, i = e.arg, ExprInt16(0) + elif isinstance(e.arg, ExprOp): + r, i = e.arg.args[0], e.arg.args[1] + elif isinstance(e.arg, ExprInt): + r, i = SR, e.arg + else: + raise NotImplementedError( + 'unknown instance e.arg = %s' % type(e.arg)) + self.parent.a_d.value = 1 + self.value = self.reg_info.expr.index(r) + self.parent.off_d.value = int(i.arg) + else: + raise NotImplementedError('unknown instance e = %s' % type(e)) + return True + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + o = str(e) + elif isinstance(e, ExprMem): + if isinstance(e.arg, ExprId): + o = "0x0(%s)" % e.arg + elif isinstance(e.arg, ExprInt): + o = "@%s" % e.arg + elif isinstance(e.arg, ExprOp): + o = "%s(%s)" % (e.arg.args[1], e.arg.args[0]) + else: + raise NotImplementedError( + 'unknown instance e.arg = %s' % type(e.arg)) + else: + raise NotImplementedError('unknown instance e = %s' % type(e)) + return o + + +class bs_cond_off_s(bs_cond): + + @classmethod + def flen(cls, mode, v): + if v['a_s'] == 0b00: + return None + elif v['a_s'] == 0b01: + if v['sreg'] in [3]: + return None + else: + return 16 + elif v['a_s'] == 0b10: + return None + elif v['a_s'] == 0b11: + """ + if v['sreg'] in [2, 3]: + return None + else: + return 16 + """ + if v['sreg'] in [0]: + return 16 + else: + return None + else: + raise NotImplementedError("unknown value v[a_s] = %d" % v['a_s']) + + def encode(self): + return super(bs_cond, self).encode() + + def decode(self, v): + if self.l == 0: + self.value = None + self.value = v + return True + + +class bs_cond_off_d(bs_cond_off_s): + + @classmethod + def flen(cls, mode, v): + if v['a_d'] == 0: + return None + elif v['a_d'] == 1: + return 16 + else: + raise NotImplementedError("unknown value v[a_d] = %d" % v['a_d']) + + +class msp430_offs(imm_noarg, m_arg): + parser = base_expr + + def int2expr(self, v): + if v & ~self.intmask != 0: + return None + return ExprInt_fromsize(16, v) + + def decodeval(self, v): + return v << 1 + + def encodeval(self, v): + return v >> 1 + + def decode(self, v): + v = v & self.lmask + if (1 << (self.l - 1)) & v: + v |= ~0 ^ self.lmask + v = self.decodeval(v) + self.expr = ExprInt16(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if (1 << (self.l - 1)) & v: + v = -((0xffff ^ v) + 1) + v = self.encodeval(v) + self.value = (v & 0xffff) & self.lmask + return True + + +off_s = bs(l=16, order=-10, cls=(bs_cond_off_s,), fname = "off_s") +off_d = bs(l=16, order=-10, cls=(bs_cond_off_d,), fname = "off_d") + +a_s = bs(l=2, order=-4, fname='a_s') +a_d = bs(l=1, order=-6, fname='a_d') + +a_d2 = bs(l=2, order=-2, fname='a_d') + +sreg = bs(l=4, order=-3, cls=(msp430_sreg_arg,), fname='sreg') +dreg = bs(l=4, order=-5, cls=(msp430_dreg_arg,), fname='dreg') + +bw = bw_mn(l=1, order=-10, mn_mod=['.w', '.b'], fname='size') + +bs_f1 = bs_name( + l=4, name={ + 'mov': 4, 'add': 5, 'addc': 6, 'subc': 7, 'sub': 8, 'cmp': 9, + 'dadd': 10, 'bit': 11, 'bic': 12, 'bis': 13, 'xor': 14, 'and': 15}) +addop("f1", [bs_f1, sreg, a_d, bw, a_s, dreg, off_s, off_d]) + +bs_f2 = bs_name(l=3, name={'rrc': 0, 'rra': 2, + 'push': 4}) +addop("f2_1", [bs('000100'), bs_f2, bw, a_s, sreg, off_s]) + + +bs_f2_nobw = bs_name(l=3, name={'swpb': 1, 'sxt': 3, + 'call': 5}) +addop("f2_2", [bs('000100'), bs_f2_nobw, bs('0'), a_s, sreg, off_s]) + + +offimm = bs(l=10, cls=(msp430_offs,), fname="offs") + +bs_f2_jcc = bs_name(l=3, name={'jnz': 0, 'jz': 1, 'jnc': 2, 'jc': 3, 'jn': 4, + 'jge': 5, 'jl': 6, 'jmp': 7}) +addop("f2_3", [bs('001'), bs_f2_jcc, offimm]) diff --git a/miasm2/arch/msp430/disasm.py b/miasm2/arch/msp430/disasm.py new file mode 100644 index 00000000..f0138bdf --- /dev/null +++ b/miasm2/arch/msp430/disasm.py @@ -0,0 +1,8 @@ +from miasm2.core.asmbloc import disasmEngine +from arch import mn_msp430 + + +class dis_msp430(disasmEngine): + + def __init__(self, bs=None, **kwargs): + super(dis_msp430, self).__init__(mn_msp430, None, bs, **kwargs) diff --git a/miasm2/arch/msp430/ira.py b/miasm2/arch/msp430/ira.py new file mode 100644 index 00000000..8e9a70dd --- /dev/null +++ b/miasm2/arch/msp430/ira.py @@ -0,0 +1,75 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * +from miasm2.ir.ir import ir, irbloc +from miasm2.ir.analysis import ira +from miasm2.arch.msp430.sem import ir_msp430 +from miasm2.arch.msp430.regs import * +# from miasm2.core.graph import DiGraph + + +class ir_a_msp430_base(ir_msp430, ira): + + def __init__(self, symbol_pool=None): + ir_msp430.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.R15 + + +class ir_a_msp430(ir_a_msp430_base): + + def __init__(self, symbol_pool=None): + ir_a_msp430_base.__init__(self, symbol_pool) + + # for test XXX TODO + def set_dead_regs(self, b): + b.rw[-1][1].add(self.arch.regs.zf) + b.rw[-1][1].add(self.arch.regs.nf) + b.rw[-1][1].add(self.arch.regs.of) + b.rw[-1][1].add(self.arch.regs.cf) + + b.rw[-1][1].add(self.arch.regs.res) + b.rw[-1][1].add(self.arch.regs.scg1) + b.rw[-1][1].add(self.arch.regs.scg0) + b.rw[-1][1].add(self.arch.regs.osc) + b.rw[-1][1].add(self.arch.regs.cpuoff) + b.rw[-1][1].add(self.arch.regs.gie) + + def call_effects(self, ad): + irs = [[ExprAff(self.ret_reg, ExprOp('call_func_ret', ad, self.sp)), + ExprAff(self.sp, ExprOp('call_func_stack', ad, self.sp)), + ]] + return irs + + def post_add_bloc(self, bloc, ir_blocs): + ir.post_add_bloc(self, bloc, ir_blocs) + # flow_graph = DiGraph() + + l = bloc.lines[-1] + if not l.is_subcall(): + return + + for irb in ir_blocs: + # print 'X'*40 + # print irb + pc_val = None + for exprs in irb.irs: + for e in exprs: + if e.dst == PC: + pc_val = e.src + if pc_val is None: + continue + + l = bloc.lines[-1] + # print str(l), 'IS CALL!' + lbl = bloc.get_next() + new_lbl = self.gen_label() + irs = self.call_effects(pc_val) + nbloc = irbloc(new_lbl, ExprId(lbl, size=self.pc.size), irs) + nbloc.lines = [l] + self.blocs[new_lbl] = nbloc + irb.dst = ExprId(new_lbl, size=self.pc.size) + + def get_out_regs(self, b): + return set([self.ret_reg, self.sp]) + diff --git a/miasm2/arch/msp430/regs.py b/miasm2/arch/msp430/regs.py new file mode 100644 index 00000000..7a389ae1 --- /dev/null +++ b/miasm2/arch/msp430/regs.py @@ -0,0 +1,105 @@ +from miasm2.expression.expression import * +from miasm2.core.cpu import reg_info + + +# GP + +regs16_str = ["PC", "SP", "SR"] + ["R%d" % i for i in xrange(3, 16)] +regs16_expr = [ExprId(x, 16) for x in regs16_str] + + +gpregs = reg_info(regs16_str, regs16_expr) + +PC = regs16_expr[0] +SP = regs16_expr[1] +SR = regs16_expr[2] +R3 = regs16_expr[3] +R4 = regs16_expr[4] +R5 = regs16_expr[5] +R6 = regs16_expr[6] +R7 = regs16_expr[7] +R8 = regs16_expr[8] +R9 = regs16_expr[9] +R10 = regs16_expr[10] +R11 = regs16_expr[11] +R12 = regs16_expr[12] +R13 = regs16_expr[13] +R14 = regs16_expr[14] +R15 = regs16_expr[15] + +PC_init = ExprId("PC_init", 16) +SP_init = ExprId("SP_init", 16) +SR_init = ExprId("SR_init", 16) +R3_init = ExprId("R3_init", 16) +R4_init = ExprId("R4_init", 16) +R5_init = ExprId("R5_init", 16) +R6_init = ExprId("R6_init", 16) +R7_init = ExprId("R7_init", 16) +R8_init = ExprId("R8_init", 16) +R9_init = ExprId("R9_init", 16) +R10_init = ExprId("R10_init", 16) +R11_init = ExprId("R11_init", 16) +R12_init = ExprId("R12_init", 16) +R13_init = ExprId("R13_init", 16) +R14_init = ExprId("R14_init", 16) +R15_init = ExprId("R15_init", 16) + + +reg_zf = 'zf' +reg_nf = 'nf' +reg_of = 'of' +reg_cf = 'cf' +reg_cpuoff = 'cpuoff' +reg_gie = 'gie' +reg_osc = 'osc' +reg_scg0 = 'scg0' +reg_scg1 = 'scg1' +reg_res = 'res' + +zf = ExprId(reg_zf, size=1) +nf = ExprId(reg_nf, size=1) +of = ExprId(reg_of, size=1) +cf = ExprId(reg_cf, size=1) + +cpuoff = ExprId(reg_cpuoff, size=1) +gie = ExprId(reg_gie, size=1) +osc = ExprId(reg_osc, size=1) +scg0 = ExprId(reg_scg0, size=1) +scg1 = ExprId(reg_scg1, size=1) +res = ExprId(reg_res, size=7) + + +zf_init = ExprId("zf_init", size=1) +nf_init = ExprId("nf_init", size=1) +of_init = ExprId("of_init", size=1) +cf_init = ExprId("cf_init", size=1) + + +cpuoff_init = ExprId("cpuoff_init", size=1) +gie_init = ExprId("gie_init", size=1) +osc_init = ExprId("osc_init", size=1) +scg0_init = ExprId("scg0_init", size=1) +scg1_init = ExprId("scg1_init", size=1) +res_init = ExprId("res_init", size=7) + + +all_regs_ids = [ + PC, SP, SR, R3, R4, R5, R6, R7, R8, R9, R10, R11, R12, R13, R14, R15, + zf, nf, of, cf, + cpuoff, gie, osc, scg0, scg1, res, +] + +all_regs_ids_byname = dict([(x.name, x) for x in all_regs_ids]) + +all_regs_ids_init = [PC_init, SP_init, SR_init, R3_init, + R4_init, R5_init, R6_init, R7_init, + R8_init, R9_init, R10_init, R11_init, + R12_init, R13_init, R14_init, R15_init, + zf_init, nf_init, of_init, cf_init, + cpuoff_init, gie_init, osc_init, + scg0_init, scg1_init, res_init, + ] + +regs_init = {} +for i, r in enumerate(all_regs_ids): + regs_init[r] = all_regs_ids_init[i] diff --git a/miasm2/arch/msp430/sem.py b/miasm2/arch/msp430/sem.py new file mode 100644 index 00000000..6fea2c21 --- /dev/null +++ b/miasm2/arch/msp430/sem.py @@ -0,0 +1,440 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * +from miasm2.arch.msp430.regs import * +from miasm2.arch.msp430.arch import mn_msp430 +from miasm2.ir.ir import ir +from regs import * + + +# Utils +def hex2bcd(val): + "Return val as BCD" + try: + return int("%x" % val, 10) + except ValueError: + raise NotImplementedError("Not defined behaviour") + + +def bcd2hex(val): + "Return the hex value of a BCD" + try: + return int("0x%d" % val, 16) + except ValueError: + raise NotImplementedError("Not defined behaviour") + + +def reset_sr_res(): + return [ExprAff(res, ExprInt_fromsize(7, 0))] + + +def update_flag_zf(a): + return [ExprAff(zf, ExprCond(a, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))] + + +def update_flag_nf(a): + return [ExprAff(nf, a.msb())] + + +def update_flag_pf(a): + return [ExprAff(pf, ExprOp('parity', a & ExprInt_from(a, 0xFF)))] + + +def update_flag_cf_inv_zf(a): + return [ExprAff(cf, ExprCond(a, ExprInt_from(cf, 1), ExprInt_from(cf, 0)))] + + +def update_flag_zn_r(a): + e = [] + e += update_flag_zf(a) + e += update_flag_nf(a) + e += reset_sr_res() + return e + + +def update_flag_sub_cf(a, b, c): + return [ExprAff(cf, + ((((a ^ b) ^ c) ^ ((a ^ c) & (a ^ b))).msb()) ^ ExprInt1(1))] + + +def update_flag_add_cf(a, b, c): + return [ExprAff(cf, (((a ^ b) ^ c) ^ ((a ^ c) & (~(a ^ b)))).msb())] + + +def update_flag_add_of(a, b, c): + return [ExprAff(of, (((a ^ c) & (~(a ^ b)))).msb())] + + +def update_flag_sub_of(a, b, c): + return [ExprAff(of, (((a ^ c) & (a ^ b))).msb())] + + +def mng_autoinc(a, b, size): + e = [] + if not (isinstance(a, ExprOp) and a.op == "autoinc"): + return e, a, b + + a_r = a.args[0] + e.append(ExprAff(a_r, a_r + ExprInt_from(a_r, size / 8))) + a = ExprMem(a_r, size) + if isinstance(b, ExprMem) and a_r in b.arg: + b = ExprMem(b.arg + ExprInt16(size / 8), b.size) + return e, a, b + +# Mnemonics + + +def mov_b(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 8) + if isinstance(b, ExprMem): + b = ExprMem(b.arg, 8) + a = a[:8] + else: + a = a[:8].zeroExtend(16) + e.append(ExprAff(b, a)) + return None, e, [] + + +def mov_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + e.append(ExprAff(b, a)) + if b == ir.pc: + dst = PC + else: + dst = None + return dst, e, [] + + +def and_b(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 8) + c = a[:8] & b[:8] + e.append(ExprAff(b, c.zeroExtend(16))) + e += update_flag_zn_r(c) + e += update_flag_cf_inv_zf(c) + e += [ExprAff(of, ExprInt1(0))] + return None, e, [] + + +def and_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = a & b + e.append(ExprAff(b, c)) + e += update_flag_zn_r(c) + e += update_flag_cf_inv_zf(c) + e += [ExprAff(of, ExprInt1(0))] + return None, e, [] + + +def bic_b(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 8) + c = (a[:8] ^ ExprInt8(0xff)) & b[:8] + c = c.zeroExtend(b.size) + e.append(ExprAff(b, c)) + return None, e, [] + + +def bic_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = (a ^ ExprInt16(0xffff)) & b + e.append(ExprAff(b, c)) + return None, e, [] + + +def bis_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = a | b + e.append(ExprAff(b, c)) + return None, e, [] + + +def bit_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = a & b + e += update_flag_zn_r(c) + e += update_flag_cf_inv_zf(c) + e.append(ExprAff(of, ExprInt1(0))) + return None, e, [] + +""" +def sub_b(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 8) + c = b - a + e.append(ExprAff(b, c)) + e += update_flag_zn_r(c) + e += update_flag_sub_cf(b, a, c) + return None, e, [] +""" + + +def sub_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = b - a + e.append(ExprAff(b, c)) + e += update_flag_zn_r(c) + e += update_flag_sub_cf(b, a, c) + # micrcorruption + # e += update_flag_sub_of(a, b, c) + # e += update_flag_sub_of(b, a, c) + return None, e, [] + + +def add_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = b + a + e.append(ExprAff(b, c)) + e += update_flag_zn_r(c) + e += update_flag_add_cf(a, b, c) + e += update_flag_add_of(a, b, c) + return None, e, [] + + +def dadd_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + # TODO: microcorruption no carryflag + c = ExprOp("bcdadd", b, a) # +zeroExtend(cf, 16)) + + e.append(ExprAff(b, c)) + # e += update_flag_zn_r(c) + + # micrcorruption + e += update_flag_zf(a) + # e += update_flag_nf(a) + e += reset_sr_res() + + e.append(ExprAff(cf, ExprOp("bcdadd_cf", b, a))) # +zeroExtend(cf, 16)))) + + # of : undefined + return None, e, [] + + +def xor_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = b ^ a + e.append(ExprAff(b, c)) + e += update_flag_zn_r(c) + e += update_flag_cf_inv_zf(c) + e.append(ExprAff(of, b.msb() & a.msb())) + return None, e, [] + + +def push_w(ir, instr, a): + e = [] + e.append(ExprAff(ExprMem(SP - ExprInt16(2), 16), a)) + e.append(ExprAff(SP, SP - ExprInt16(2))) + return None, e, [] + + +def call(ir, instr, a): + e, a, dummy = mng_autoinc(a, None, 16) + n = ExprId(ir.get_next_label(instr), 16) + e.append(ExprAff(ExprMem(SP - ExprInt16(2), 16), n)) + e.append(ExprAff(SP, SP - ExprInt16(2))) + e.append(ExprAff(PC, a)) + return PC, e, [] + + +def swpb(ir, instr, a): + e = [] + x, y = a[:8], a[8:16] + e.append(ExprAff(a, ExprCompose([(y, 0, 8), + (x, 8, 16)]))) + return None, e, [] + + +def cmp_w(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 16) + c = b - a + e += update_flag_zn_r(c) + e += update_flag_sub_cf(a, b, c) + e += update_flag_sub_of(a, b, c) + return None, e, [] + + +def cmp_b(ir, instr, a, b): + e, a, b = mng_autoinc(a, b, 8) + c = b[:8] - a[:8] + e += update_flag_zn_r(c) + e += update_flag_sub_cf(a[:8], b[:8], c) + e += update_flag_sub_of(a[:8], b[:8], c) + return None, e, [] + + +def jz(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(zf, a, n))) + return PC, e, [] + + +def jnz(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(zf, n, a))) + return PC, e, [] + + +def jl(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(nf ^ of, a, n))) + return PC, e, [] + + +def jc(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(cf, a, n))) + return PC, e, [] + + +def jnc(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(cf, n, a))) + return PC, e, [] + + +def jge(ir, instr, a): + n = ExprId(ir.get_next_label(instr), 16) + e = [] + e.append(ExprAff(PC, ExprCond(nf ^ of, n, a))) + return PC, e, [] + + +def jmp(ir, instr, a): + e = [] + e.append(ExprAff(PC, a)) + return PC, e, [] + + +def rrc_w(ir, instr, a): + e = [] + c = ExprCompose([(a[1:16], 0, 15), + (cf, 15, 16)]) + e.append(ExprAff(a, c)) + e.append(ExprAff(cf, a[:1])) + # e += update_flag_zn_r(c) + + # micrcorruption + e += update_flag_zf(a) + # e += update_flag_nf(a) + e += reset_sr_res() + + e.append(ExprAff(of, ExprInt1(0))) + return None, e, [] + + +def rra_w(ir, instr, a): + e = [] + c = ExprCompose([(a[1:16], 0, 15), + (a[15:16], 15, 16)]) + e.append(ExprAff(a, c)) + # TODO: error in disasm microcorruption? + # e.append(ExprAff(cf, a[:1])) + # e += update_flag_zn_r(c) + + # micrcorruption + e += update_flag_zf(a) + # e += update_flag_nf(a) + e += reset_sr_res() + + e.append(ExprAff(of, ExprInt1(0))) + return None, e, [] + + +def sxt(ir, instr, a): + e = [] + c = a[:8].signExtend(16) + e.append(ExprAff(a, c)) + + e += update_flag_zn_r(c) + e += update_flag_cf_inv_zf(c) + e.append(ExprAff(of, ExprInt1(0))) + + return None, e, [] + +mnemo_func = { + "mov.b": mov_b, + "mov.w": mov_w, + "and.b": and_b, + "and.w": and_w, + "bic.b": bic_b, + "bic.w": bic_w, + "bis.w": bis_w, + "bit.w": bit_w, + "sub.w": sub_w, + "add.w": add_w, + "push.w": push_w, + "dadd.w": dadd_w, + "xor.w": xor_w, + "call": call, + "swpb": swpb, + "cmp.w": cmp_w, + "cmp.b": cmp_b, + "jz": jz, + "jnz": jnz, + "jl": jl, + "jc": jc, + "jnc": jnc, + "jmp": jmp, + "jge": jge, + "rrc.w": rrc_w, + "rra.w": rra_w, + "sxt": sxt, +} + + +composed_sr = ExprCompose([ + (cf, 0, 1), + (zf, 1, 2), + (nf, 2, 3), + (gie, 3, 4), + (cpuoff, 4, 5), + (osc, 5, 6), + (scg0, 6, 7), + (scg1, 7, 8), + (of, 8, 9), + (res, 9, 16), +]) + + +def ComposeExprAff(dst, src): + e = [] + for x, start, stop in dst.args: + e.append(ExprAff(x, src[start:stop])) + return e + + +class ir_msp430(ir): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_msp430, None, symbol_pool) + self.pc = PC + self.sp = SP + + def mod_pc(self, instr, instr_ir, extra_ir): + pass + + def get_ir(self, instr): + # print instr#, args + args = instr.args + dst, instr_ir, extra_ir = mnemo_func[instr.name](self, instr, *args) + self.mod_sr(instr, instr_ir, extra_ir) + + return dst, instr_ir, extra_ir + + def mod_sr(self, instr, instr_ir, extra_ir): + for i, x in enumerate(instr_ir): + x.src = x.src.replace_expr({SR: composed_sr}) + if x.dst != SR: + continue + xx = ComposeExprAff(composed_sr, x.src) + instr_ir[i:i + 1] = xx + for i, x in enumerate(instr_ir): + x = ExprAff(x.dst, x.src.replace_expr( + {self.pc: ExprInt16(instr.offset + instr.l)})) + instr_ir[i] = x + + if extra_ir: + raise NotImplementedError('not fully functional') diff --git a/miasm2/arch/sh4/__init__.py b/miasm2/arch/sh4/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/arch/sh4/__init__.py diff --git a/miasm2/arch/sh4/arch.py b/miasm2/arch/sh4/arch.py new file mode 100644 index 00000000..c2029000 --- /dev/null +++ b/miasm2/arch/sh4/arch.py @@ -0,0 +1,1404 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import os +from pyparsing import * +from miasm2.core.cpu import * +from miasm2.expression.expression import * +from collections import defaultdict +from regs import * + + +jra = ExprId('jra') +jrb = ExprId('jrb') +jrc = ExprId('jrc') + + +# parser helper ########### +PLUS = Suppress("+") +MULT = Suppress("*") +MINUS = Suppress("-") +AND = Suppress("&") +LBRACK = Suppress("[") +RBRACK = Suppress("]") +DEREF = Suppress("@") +COMMA = Suppress(",") +LPARENT = Suppress("(") +RPARENT = Suppress(")") + + +def parse_deref_pcimm(t): + t = t[0] + return t[0] + t[1] + + +def parse_pcandimmimm(t): + t = t[0] + return (t[0] & t[1]) + t[2] + +def ast_id2expr(a): + return ExprId(a, 32) + +def ast_int2expr(a): + return ExprInt32(a) + + +my_var_parser = parse_ast(ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + +int_or_expr = base_expr + +ref_pc = Group(LPARENT + regi_pc.parser + COMMA + + int_or_expr + RPARENT).setParseAction(parse_deref_pcimm) +ref_pcandimm = Group( + LPARENT + regi_pc.parser + AND + int_or_expr + + COMMA + int_or_expr + RPARENT).setParseAction(parse_pcandimmimm) + + +pcdisp = Group(regi_pc.parser + AND + int_or_expr + + PLUS + int_or_expr).setParseAction(parse_pcandimmimm) + +PTR = Suppress('PTR') + + +def parse_deref_mem(s, l, t): + t = t[0] + e = ExprMem(t[0], 32) + return e + + +def parse_predec(s, l, t): + t = t[0] + e = ExprOp('predec', t[0]) + return e + + +def parse_postinc(s, l, t): + t = t[0] + e = ExprOp('postinc', t[0]) + return e + + +def parse_regdisp(t): + t = t[0] + e = ExprMem(t[0] + t[1]) + return e + + +def parse_regreg(t): + t = t[0] + e = ExprMem(t[0] + t[1]) + return e + + +deref_pc = Group(DEREF + ref_pc).setParseAction(parse_deref_mem) +deref_pcimm = Group(DEREF + ref_pcandimm).setParseAction(parse_deref_mem) + +dgpregs_base = Group(DEREF + gpregs.parser).setParseAction(parse_deref_mem) +dgpregs_predec = Group( + DEREF + MINUS + gpregs.parser).setParseAction(parse_predec) +dgpregs_postinc = Group( + DEREF + gpregs.parser + PLUS).setParseAction(parse_postinc) + +dgpregs = dgpregs_base | dgpregs_predec | dgpregs_postinc + +d_gpreg_gpreg = Group(DEREF + + LPARENT + gpregs.parser + COMMA + gpregs.parser + RPARENT + ).setParseAction(parse_regdisp) +dgpregs_p = dgpregs_predec | dgpregs_postinc + + +dgpregs_ir = Group(DEREF + LPARENT + gpregs.parser + + COMMA + int_or_expr + RPARENT).setParseAction(parse_regdisp) +dgpregs_ir |= d_gpreg_gpreg + +dgbr_imm = Group(DEREF + LPARENT + regi_gbr.parser + + COMMA + int_or_expr + RPARENT).setParseAction(parse_regdisp) + +dgbr_reg = Group(DEREF + LPARENT + regi_gbr.parser + + COMMA + gpregs.parser + RPARENT).setParseAction(parse_regreg) + + +class sh4_reg(reg_noarg, m_arg): + pass + + +class sh4_gpreg(sh4_reg): + reg_info = gpregs + parser = reg_info.parser + + +class sh4_dr(sh4_reg): + reg_info = dregs + parser = reg_info.parser + + +class sh4_bgpreg(sh4_reg): + reg_info = bgpregs + parser = reg_info.parser + + +class sh4_gpreg_noarg(reg_noarg, ): + reg_info = gpregs + parser = reg_info.parser + + +class sh4_freg(sh4_reg): + reg_info = fregs + parser = reg_info.parser + + +class sh4_dgpreg(m_arg): + parser = dgpregs_base + + def fromstring(self, s, parser_result=None): + start, stop = super(sh4_dgpreg, self).fromstring(s, parser_result) + if start is None: + return start, stop + self.expr = ExprMem(self.expr.arg, self.sz) + return start, stop + + def decode(self, v): + r = gpregs.expr[v] + self.expr = ExprMem(r, self.sz) + return True + + def encode(self): + e = self.expr + if not isinstance(e, ExprMem): + return False + if not isinstance(e.arg, ExprId): + return False + v = gpregs.expr.index(e.arg) + self.value = v + return True + + @staticmethod + def arg2str(e): + ad = e.arg + if isinstance(ad, ExprOp): + s = ','.join([str(x).replace('(', '').replace(')', '') + for x in ad.args]) + s = "@(%s)" % s + else: + s = "@%s" % ad + return s + + +class sh4_dgpregpinc(m_arg): + parser = dgpregs_p + + def fromstring(self, s, parser_result=None): + start, stop = super(sh4_dgpregpinc, self).fromstring(s, parser_result) + if not isinstance(self.expr, ExprOp): + return None, None + if self.expr.op != self.op: + return None, None + return start, stop + + def decode(self, v): + r = gpregs.expr[v] + e = ExprOp(self.op, r, ExprInt32(self.sz)) + self.expr = e + return True + + def encode(self): + e = self.expr + res = MatchExpr(e, ExprOp(self.op, jra), [jra]) + if not res: + return False + r = res[jra] + if not r in gpregs.expr: + return False + v = gpregs.expr.index(r) + self.value = v + return True + + @staticmethod + def arg2str(e): + if e.op == "predec": + o = '-%s' % e.args[0] + elif e.op == "postinc": + o = '%s+' % e.args[0] + else: + raise ValueError('unknown e.op: %s' % e.op) + return "@%s" % o + + +class sh4_dgpregpdec(m_arg): + parser = dgpregs_postinc + op = "preinc" + + +class sh4_dgpreg_imm(sh4_dgpreg): + parser = dgpregs_ir + + def decode(self, v): + p = self.parent + r = gpregs.expr[v] + s = self.sz + d = ExprInt32(p.disp.value * s / 8) + e = ExprMem(r + d, s) + self.expr = e + return True + + def encode(self): + e = self.expr + p = self.parent + s = self.sz + if not isinstance(e, ExprMem): + return False + if isinstance(e.arg, ExprId): + v = gpregs.expr.index(e.arg) + p.disp.value = 0 + elif isinstance(e.arg, ExprOp): + res = MatchExpr(e, ExprMem(jra + jrb, self.sz), [jra, jrb]) + if not res: + return False + if not isinstance(res[jra], ExprId): + return False + if not isinstance(res[jrb], ExprInt): + return False + d = int(res[jrb].arg) + p.disp.value = d / (s / 8) + if not res[jra] in gpregs.expr: + return False + v = gpregs.expr.index(res[jra]) + else: + return False + self.value = v + return True + + +class sh4_imm(imm_noarg, m_arg): + parser = base_expr + pass + + +class sh4_simm(sh4_imm): + parser = base_expr + + def decode(self, v): + v = sign_ext(v, self.l, 32) + v = self.decodeval(v) + self.expr = ExprInt32(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if (1 << (self.l - 1)) & v: + v = -((0xffffffff ^ v) + 1) + v = self.encodeval(v) + self.value = (v & 0xffffffff) & self.lmask + return True + + +class sh4_dpc16imm(sh4_dgpreg): + parser = deref_pc + + def decode(self, v): + self.expr = ExprMem(PC + ExprInt32(v * 2 + 4), 16) + return True + + def calcdisp(self, v): + v = (int(v.arg) - 4) / 2 + if not 0 < v <= 0xff: + return None + return v + + def encode(self): + res = MatchExpr(self.expr, ExprMem(PC + jra, 16), [jra]) + if not res: + return False + if not isinstance(res[jra], ExprInt): + return False + v = self.calcdisp(res[jra]) + if v is None: + return False + self.value = v + return True + + +class sh4_dgbrimm8(sh4_dgpreg): + parser = dgbr_imm + + def decode(self, v): + s = self.sz + self.expr = ExprMem(GBR + ExprInt32(v * s / 8), s) + return True + + def encode(self): + e = self.expr + s = self.sz + if e == ExprMem(GBR): + self.value = 0 + return True + res = MatchExpr(self.expr, ExprMem(GBR + jra, s), [jra]) + if not res: + return False + if not isinstance(res[jra], ExprInt): + return False + self.value = int(res[jra].arg) / (s / 8) + return True + + +class sh4_dpc32imm(sh4_dpc16imm): + parser = deref_pcimm + + def decode(self, v): + self.expr = ExprMem( + (PC & ExprInt32(0xfffffffc)) + ExprInt32(v * 4 + 4)) + return True + + def calcdisp(self, v): + v = (int(v.arg) - 4) / 4 + if not 0 < v <= 0xff: + return None + return v + + def encode(self): + res = MatchExpr( + self.expr, ExprMem((PC & ExprInt32(0xFFFFFFFC)) + jra, 32), [jra]) + if not res: + return False + if not isinstance(res[jra], ExprInt): + return False + v = self.calcdisp(res[jra]) + if v is None: + return False + self.value = v + return True + + +class sh4_pc32imm(m_arg): + parser = pcdisp + + def decode(self, v): + self.expr = (PC & ExprInt32(0xfffffffc)) + ExprInt32(v * 4 + 4) + return True + + def encode(self): + res = MatchExpr(self.expr, (PC & ExprInt32(0xfffffffc)) + jra, [jra]) + if not res: + return False + if not isinstance(res[jra], ExprInt): + return False + v = (int(res[jra].arg) - 4) / 4 + if v is None: + return False + self.value = v + return True + + @staticmethod + def arg2str(e): + s = str(e).replace('(', '').replace(')', '') + return "%s" % s + + +class additional_info: + + def __init__(self): + self.except_on_instr = False + + +class instruction_sh4(instruction): + delayslot = 0 + + def __init__(self, *args, **kargs): + super(instruction_arm, self).__init__(*args, **kargs) + + def dstflow(self): + return self.name.startswith('J') + """ + def dstflow2label(self, symbol_pool): + e = self.args[0] + if not isinstance(e, ExprInt): + return + if self.name == 'BLX': + ad = e.arg+8+self.offset + else: + ad = e.arg+8+self.offset + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0] = s + """ + + def breakflow(self): + if self.name.startswith('J'): + return True + return False + + def is_subcall(self): + return self.name == 'JSR' + + def getdstflow(self, symbol_pool): + return [self.args[0]] + + def splitflow(self): + return self.name == 'JSR' + + def get_symbol_size(self, symbol, symbol_pool): + return 32 + + def fixDstOffset(self): + e = self.args[0] + print 'FIX', e, self.offset, self.l + if self.offset is None: + raise ValueError('symbol not resolved %s' % l) + if not isinstance(e, ExprInt): + log.warning('zarb dst %r' % e) + return + off = e.arg - (self.offset + 4 + self.l) + print hex(off) + if int(off % 4): + raise ValueError('strange offset! %r' % off) + self.args[0] = ExprInt32(off) + print 'final', self.args[0] + + def get_args_expr(self): + args = [a for a in self.args] + return args + + +class mn_sh4(cls_mn): + bintree = {} + num = 0 + all_mn = [] + all_mn_mode = defaultdict(list) + all_mn_name = defaultdict(list) + all_mn_inst = defaultdict(list) + pc = PC + # delayslot: + # http://resource.renesas.com/lib/eng/e_learnig/sh4/13/index.html + delayslot = 0 # unit is instruction instruction + + def additional_info(self): + info = additional_info() + return info + + @classmethod + def getbits(cls, bs, start, n): + if not n: + return 0 + o = 0 + if n > bs.getlen() * 8: + raise ValueError('not enought bits %r %r' % (n, len(bs.bin) * 8)) + while n: + i = start / 8 + c = cls.getbytes(bs, i) + if not c: + raise IOError + c = ord(c) + r = 8 - start % 8 + c &= (1 << r) - 1 + l = min(r, n) + c >>= (r - l) + o <<= l + o |= c + n -= l + start += l + return o + + @classmethod + def getbytes(cls, bs, offset, l=1): + out = "" + for _ in xrange(l): + n_offset = (offset & ~1) + 1 - offset % 2 + out += bs.getbytes(n_offset, 1) + offset += 1 + return out + + @classmethod + def check_mnemo(cls, fields): + l = sum([x.l for x in fields]) + assert l == 16, "len %r" % l + + @classmethod + def getmn(cls, name): + return name.upper().replace('_', '.') + + @classmethod + def gen_modes(cls, subcls, name, bases, dct, fields): + dct['mode'] = None + return [(subcls, name, bases, dct, fields)] + + def value(self, mode): + v = super(mn_sh4, self).value(mode) + return [x[::-1] for x in v] + + +class bs_dr0gbr(sh4_dgpreg): + parser = dgbr_reg + + def decode(self, v): + self.expr = ExprMem(GBR + R0, 8) + return True + + def encode(self): + return self.expr == ExprMem(GBR + R0, 8) + + +class bs_dr0gp(sh4_dgpreg): + parser = d_gpreg_gpreg + + def decode(self, v): + self.expr = ExprMem(gpregs.expr[v] + R0, self.sz) + return True + + def encode(self): + res = MatchExpr(self.expr, ExprMem(R0 + jra, self.sz), [jra]) + if not res: + return False + r = res[jra] + if not r in gpregs.expr: + return False + self.value = gpregs.expr.index(r) + return True + + +class bs_dgpreg(sh4_dgpreg): + parser = dgpregs_base + + +rn = bs(l=4, cls=(sh4_gpreg,), fname="rn") +rm = bs(l=4, cls=(sh4_gpreg,), fname="rm") + + +d08_rn = bs(l=4, cls=(sh4_dgpreg,), fname="rn", sz = 8) +d16_rn = bs(l=4, cls=(sh4_dgpreg,), fname="rn", sz = 16) +d32_rn = bs(l=4, cls=(sh4_dgpreg,), fname="rn", sz = 32) +d08_rm = bs(l=4, cls=(sh4_dgpreg,), fname="rm", sz = 8) +d16_rm = bs(l=4, cls=(sh4_dgpreg,), fname="rm", sz = 16) +d32_rm = bs(l=4, cls=(sh4_dgpreg,), fname="rm", sz = 32) + + +brm = bs(l=3, cls=(sh4_bgpreg,), fname="brm") +brn = bs(l=3, cls=(sh4_bgpreg,), fname="brn") + +d08rnimm = bs(l=4, fname="rn", cls=(sh4_dgpreg_imm,), sz = 8) +d16rnimm = bs(l=4, fname="rn", cls=(sh4_dgpreg_imm,), sz = 16) +d32rnimm = bs(l=4, fname="rn", cls=(sh4_dgpreg_imm,), sz = 32) + +d08rmimm = bs(l=4, fname="rm", cls=(sh4_dgpreg_imm,), sz = 8) +d16rmimm = bs(l=4, fname="rm", cls=(sh4_dgpreg_imm,), sz = 16) +d32rmimm = bs(l=4, fname="rm", cls=(sh4_dgpreg_imm,), sz = 32) + +btype = bs(l=4, fname="btype", order=-1) + +s08imm = bs(l=8, cls=(sh4_simm,), fname="imm") +s12imm = bs(l=12, cls=(sh4_simm,), fname="imm") +dpc16imm = bs(l=8, cls=(sh4_dpc16imm,), fname="pcimm", sz=16) +dpc32imm = bs(l=8, cls=(sh4_dpc32imm,), fname="pcimm", sz=32) +dimm4 = bs(l=4, fname='disp', order=-1) +d08gbrimm8 = bs(l=8, cls=(sh4_dgbrimm8,), fname='disp', sz=8) +d16gbrimm8 = bs(l=8, cls=(sh4_dgbrimm8,), fname='disp', sz=16) +d32gbrimm8 = bs(l=8, cls=(sh4_dgbrimm8,), fname='disp', sz=32) + +pc32imm = bs(l=8, cls=(sh4_pc32imm,), fname="pcimm") + +d08rnpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=8, fname="rn") +d08rmpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=8, fname="rm") + +d16rnpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=16, fname="rn") +d16rmpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=16, fname="rm") + +d32rnpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=32, fname="rn") +d32rmpinc = bs(l=4, cls=(sh4_dgpregpinc,), op='postinc', sz=32, fname="rm") + +d08rnpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=8, fname="rn") +d08rmpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=8, fname="rm") + +d16rnpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=16, fname="rn") +d16rmpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=16, fname="rm") + +d32rnpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=32, fname="rn") +d32rmpdec = bs(l=4, cls=(sh4_dgpregpinc,), op='predec', sz=32, fname="rm") + + +u08imm = bs(l=8, cls=(sh4_imm,), fname="imm") +dr0gbr = bs(l=0, cls=(bs_dr0gbr,), sz=8) + +d08gpreg = bs(l=4, cls=(bs_dgpreg,), sz=8) +d32gpreg = bs(l=4, cls=(bs_dgpreg,), sz=32) + +frn = bs(l=4, cls=(sh4_freg,), fname="frn") +frm = bs(l=4, cls=(sh4_freg,), fname="frm") + +bd08r0gp = bs(l=4, cls=(bs_dr0gp,), sz=8) +bd16r0gp = bs(l=4, cls=(bs_dr0gp,), sz=16) +bd32r0gp = bs(l=4, cls=(bs_dr0gp,), sz=32) + +drn = bs(l=3, cls=(sh4_dr,), fname="drn") +drm = bs(l=3, cls=(sh4_dr,), fname="drm") + + +def addop(name, fields, args=None, alias=False): + dct = {"fields": fields} + dct["alias"] = alias + if args is not None: + dct['args'] = args + type(name, (mn_sh4,), dct) + +addop("mov", [bs('1110'), rn, s08imm], [s08imm, rn]) +addop("mov_w", [bs('1001'), rn, dpc16imm], [dpc16imm, rn]) +addop("mov_l", [bs('1101'), rn, dpc32imm], [dpc32imm, rn]) +addop("mov", [bs('0110', fname="opc"), rn, rm, bs('0011')], [rm, rn]) +addop("mov_b", [bs('0010', fname="opc"), d08_rn, rm, bs('0000')], [rm, d08_rn]) +addop("mov_w", [bs('0010', fname="opc"), d16_rn, rm, bs('0001')], [rm, d16_rn]) +addop("mov_l", [bs('0010', fname="opc"), d32_rn, rm, bs('0010')], [rm, d32_rn]) +addop("mov_b", [bs('0110', fname="opc"), rn, d08_rm, bs('0000')], [d08_rm, rn]) +addop("mov_w", [bs('0110', fname="opc"), rn, d16_rm, bs('0001')], [d16_rm, rn]) +addop("mov_l", [bs('0110', fname="opc"), rn, d32_rm, bs('0010')], [d32_rm, rn]) +addop("mov_b", + [bs('0010', fname="opc"), d08rnpdec, rm, bs('0100')], [rm, d08rnpdec]) +addop("mov_w", + [bs('0010', fname="opc"), d16rnpdec, rm, bs('0101')], [rm, d16rnpdec]) +addop("mov_l", + [bs('0010', fname="opc"), d32rnpdec, rm, bs('0110')], [rm, d32rnpdec]) +addop("mov_b", + [bs('0110', fname="opc"), rn, d08rmpinc, bs('0100')], [rm, d08rnpinc]) +addop("mov_w", + [bs('0110', fname="opc"), rn, d16rmpinc, bs('0101')], [d16rmpinc, rn]) +addop("mov_l", + [bs('0110', fname="opc"), rn, d32rmpinc, bs('0110')], [d32rmpinc, rn]) +addop("mov_b", [bs('10000000', fname='opc'), bsr0, d08rnimm, dimm4]) +addop("mov_w", [bs('10000001', fname='opc'), bsr0, d16rnimm, dimm4]) +addop("mov_l", [bs('0001', fname='opc'), d32rnimm, rm, dimm4], [rm, d32rnimm]) +addop("mov_b", [bs('10000100', fname='opc'), d08rmimm, dimm4, bsr0]) +addop("mov_w", [bs('10000101', fname='opc'), d16rmimm, dimm4, bsr0]) +addop("mov_l", [bs('0101', fname='opc'), rn, d32rmimm, dimm4], [d32rmimm, rn]) +addop("mov_b", + [bs('0000', fname='opc'), bd08r0gp, rm, bs('0100')], [rm, bd08r0gp]) +addop("mov_w", + [bs('0000', fname='opc'), bd16r0gp, rm, bs('0101')], [rm, bd16r0gp]) +addop("mov_l", + [bs('0000', fname='opc'), bd32r0gp, rm, bs('0110')], [rm, bd32r0gp]) +addop("mov_b", + [bs('0000', fname='opc'), rn, bd08r0gp, bs('1100')], [bd08r0gp, rn]) +addop("mov_w", + [bs('0000', fname='opc'), rn, bd16r0gp, bs('1101')], [bd16r0gp, rn]) +addop("mov_l", + [bs('0000', fname='opc'), rn, bd32r0gp, bs('1110')], [bd32r0gp, rn]) + +addop("mov_b", [bs('11000000'), bsr0, d08gbrimm8]) +addop("mov_w", [bs('11000001'), bsr0, d16gbrimm8]) +addop("mov_l", [bs('11000010'), bsr0, d32gbrimm8]) + +addop("mov_b", [bs('11000100'), d08gbrimm8, bsr0]) +addop("mov_w", [bs('11000101'), d16gbrimm8, bsr0]) +addop("mov_l", [bs('11000110'), d32gbrimm8, bsr0]) + +addop("mov", [bs('11000111'), pc32imm, bsr0]) + +addop("swapb", [bs('0110'), rn, rm, bs('1000')], [rm, rn]) +addop("swapw", [bs('0110'), rn, rm, bs('1001')], [rm, rn]) +addop("xtrct", [bs('0010'), rn, rm, bs('1101')], [rm, rn]) + + +addop("add", [bs('0011'), rn, rm, bs('1100')], [rm, rn]) +addop("add", [bs('0111'), rn, s08imm], [s08imm, rn]) +addop("addc", [bs('0011'), rn, rm, bs('1110')], [rm, rn]) +addop("addv", [bs('0011'), rn, rm, bs('1111')], [rm, rn]) + + +addop("cmpeq", [bs('10001000'), s08imm, bsr0]) + + +addop("cmpeq", [bs('0011'), rn, rm, bs('0000')], [rm, rn]) +addop("cmphs", [bs('0011'), rn, rm, bs('0010')], [rm, rn]) +addop("cmpge", [bs('0011'), rn, rm, bs('0011')], [rm, rn]) +addop("cmphi", [bs('0011'), rn, rm, bs('0110')], [rm, rn]) +addop("cmpgt", [bs('0011'), rn, rm, bs('0111')], [rm, rn]) + + +addop("cmppz", [bs('0100'), rn, bs('00010001')]) +addop("cmppl", [bs('0100'), rn, bs('00010101')]) +addop("cmpstr", [bs('0010'), rn, rm, bs('1100')], [rm, rn]) + + +addop("div1", [bs('0011'), rn, rm, bs('0100')], [rm, rn]) + +addop("div0s", [bs('0010'), rn, rm, bs('0111')], [rm, rn]) +addop("div0u", [bs('0000000000011001')]) + +addop("dmuls", [bs('0011'), rn, rm, bs('1101')], [rm, rn]) +addop("dmulu", [bs('0011'), rn, rm, bs('0101')], [rm, rn]) + +addop("dt", [bs('0100'), rn, bs('00010000')]) + + +addop("extsb", [bs('0110'), rn, rm, bs('1110')], [rm, rn]) +addop("extsw", [bs('0110'), rn, rm, bs('1111')], [rm, rn]) +addop("extub", [bs('0110'), rn, rm, bs('1100')], [rm, rn]) +addop("extuw", [bs('0110'), rn, rm, bs('1101')], [rm, rn]) + +addop("mac_l", [bs('0000', fname='opc'), d32rnpinc, + d32rmpinc, bs('1111')], [d32rmpinc, d32rnpinc]) +addop("mac_w", [bs('0100', fname='opc'), d16rnpinc, + d16rmpinc, bs('1111')], [d16rmpinc, d16rnpinc]) + +addop("mull", [bs('0000'), rn, rm, bs('0111')], [rm, rn]) +addop("mulsw", [bs('0010'), rn, rm, bs('1111')], [rm, rn]) +addop("muluw", [bs('0010'), rn, rm, bs('1110')], [rm, rn]) + +addop("neg", [bs('0110'), rn, rm, bs('1011')], [rm, rn]) +addop("negc", [bs('0110'), rn, rm, bs('1010')], [rm, rn]) + +addop("sub", [bs('0011'), rn, rm, bs('1000')], [rm, rn]) +addop("subc", [bs('0011'), rn, rm, bs('1010')], [rm, rn]) +addop("subv", [bs('0011'), rn, rm, bs('1011')], [rm, rn]) + +addop("and", [bs('0010'), rn, rm, bs('1001')], [rm, rn]) +addop("and", [bs('11001001'), u08imm, bsr0]) +addop("and_b", [bs('11001101'), u08imm, dr0gbr]) + +addop("not", [bs('0110'), rn, rm, bs('0111')], [rm, rn]) + +addop("or", [bs('0010'), rn, rm, bs('1011')], [rm, rn]) + +addop("or", [bs('11001011'), u08imm, bsr0]) +addop("or_b", [bs('11001111'), u08imm, dr0gbr]) + +addop("tas_b", [bs('0100'), d08gpreg, bs('00011011')]) +addop("tst", [bs('0010'), rn, rm, bs('1000')], [rm, rn]) +addop("tst", [bs('11001000'), u08imm, bsr0]) +addop("tst_b", [bs('11001100'), u08imm, dr0gbr]) + + +addop("xor", [bs('0010'), rn, rm, bs('1010')], [rm, rn]) +addop("xor", [bs('11001010'), u08imm, bsr0]) +addop("xor_b", [bs('11001110'), u08imm, dr0gbr]) + +addop("rotl", [bs('0100'), rn, bs('00000100')]) +addop("rotr", [bs('0100'), rn, bs('00000101')]) +addop("rotcl", [bs('0100'), rn, bs('00100100')]) +addop("rotcr", [bs('0100'), rn, bs('00100101')]) + +addop("shad", [bs('0100'), rn, rm, bs('1100')], [rm, rn]) +addop("shal", [bs('0100'), rn, bs('00100000')]) +addop("shar", [bs('0100'), rn, bs('00100001')]) +addop("shld", [bs('0100'), rn, rm, bs('1101')], [rm, rn]) + +addop("shll", [bs('0100'), rn, bs('00000000')]) +addop("shlr", [bs('0100'), rn, bs('00000001')]) +addop("shll2", [bs('0100'), rn, bs('00001000')]) +addop("shlr2", [bs('0100'), rn, bs('00001001')]) +addop("shll8", [bs('0100'), rn, bs('00011000')]) +addop("shlr8", [bs('0100'), rn, bs('00011001')]) +addop("shll16", [bs('0100'), rn, bs('00101000')]) +addop("shlr16", [bs('0100'), rn, bs('00101001')]) + + +addop("bf", [bs('10001011'), s08imm]) +""" + def splitflow(self): + return True + def breakflow(self): + return True + def dstflow(self): + return True + def dstflow2label(self, symbol_pool): + e = self.args[0].expr + ad = e.arg*2+4+self.offset + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0].expr = s +""" + +addop("bfs", [bs('10001111'), s08imm]) +""" + delayslot = 1 +""" +addop("bt", [bs('10001001'), s08imm]) + +addop("bts", [bs('10001101'), s08imm]) + +addop("bra", [bs('1010'), s12imm]) +""" + delayslot = 1 + def breakflow(self): + return True + def dstflow(self): + return True + def dstflow2label(self, symbol_pool): + e = self.args[0].expr + ad = e.arg*2+4+self.offset + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0].expr = s +""" + +addop("braf", [bs('0000'), rn, bs('00100011')]) +""" + delayslot = 1 + def breakflow(self): + return True + def dstflow(self): + return True +""" +addop("bsr", [bs('1011'), s12imm]) + +addop("bsrf", [bs('0000'), rn, bs('00000011')]) +""" + delayslot = 1 + def breakflow(self): + return True + def is_subcall(self): + return True + def splitflow(self): + return True +""" + +addop("jmp_l", [bs('0100'), d32gpreg, bs('00101011')]) +""" + delayslot = 1 + def breakflow(self): + return True +""" + +addop("jsr_l", [bs('0100'), d32gpreg, bs('00001011')]) +""" + delayslot = 1 + def breakflow(self): + return True + def is_subcall(self): + return True + def splitflow(self): + return True +""" + +addop("rts", [bs('0000000000001011')]) +""" + delayslot = 1 + def breakflow(self): + return True +""" +addop("clrmac", [bs('0000000000101000')]) +addop("clrs", [bs('0000000001001000')]) +addop("clrt", [bs('0000000000001000')]) + + +addop("ldc", [bs('0100'), rm, bssr, bs('00001110')]) +addop("ldc", [bs('0100'), rm, bsgbr, bs('00011110')]) +addop("ldc", [bs('0100'), rm, bsvbr, bs('00101110')]) +addop("ldc", [bs('0100'), rm, bsssr, bs('00111110')]) +addop("ldc", [bs('0100'), rm, bsspc, bs('01001110')]) +addop("ldc", [bs('0100'), rm, bsdbr, bs('11111010')]) +addop("ldc", [bs('0100'), rm, bs('1'), brn, bs('1110')], [rm, brn]) +addop("ldc_l", [bs('0100'), d32rmpinc, bssr, bs('00000111')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bsgbr, bs('00010111')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bsvbr, bs('00100111')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bsssr, bs('00110111')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bsspc, bs('01000111')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bsdbr, bs('11110110')]) +addop("ldc_l", [bs('0100'), d32rmpinc, bs('1'), brn, bs('0111')]) +addop("lds", [bs('0100'), rm, bsmach, bs('00001010')]) +addop("lds", [bs('0100'), rm, bsmacl, bs('00011010')]) +addop("lds", [bs('0100'), rm, bspr, bs('00101010')]) +addop("lds_l", [bs('0100'), d32rmpinc, bsmach, bs('00000110')]) +addop("lds_l", [bs('0100'), d32rmpinc, bsmacl, bs('00010110')]) +addop("lds_l", [bs('0100'), d32rmpinc, bspr, bs('00100110')]) +addop("ldtlb", [bs('0000000000111000')]) + +addop("movca_l", [bs('0000'), bsr0, d32gpreg, bs('11000011')]) +addop("nop", [bs('0000000000001001')]) +addop("ocbi_l", [bs('0000'), d32gpreg, bs('10010011')]) +addop("ocbp_l", [bs('0000'), d32gpreg, bs('10100011')]) +addop("ocbwb_l", [bs('0000'), d32gpreg, bs('10110011')]) +addop("pref_l", [bs('0000'), d32gpreg, bs('10000011')]) + + +addop("rte", [bs('0000000000101011')]) +addop("sets", [bs('0000000001011000')]) +addop("sett", [bs('0000000000011000')]) +addop("sleep", [bs('0000000000011011')]) +addop("stc", [bs('0000'), bssr, rn, bs('00000010')]) +addop("stc", [bs('0000'), bsgbr, rn, bs('00010010')]) +addop("stc", [bs('0000'), bsvbr, rn, bs('00100010')]) +addop("stc", [bs('0000'), bsssr, rn, bs('00110010')]) +addop("stc", [bs('0000'), bsspc, rn, bs('01000010')]) +addop("stc", [bs('0000'), bssgr, rn, bs('00111010')]) +addop("stc", [bs('0000'), bsdbr, rn, bs('11111010')]) +addop("stc", [bs('0000'), rn, bs('1'), brm, bs('0010')], [brm, rn]) + +addop("stc_l", [bs('0100'), bssr, d32rmpdec, bs('00000011')]) +addop("stc_l", [bs('0100'), bsgbr, d32rmpdec, bs('00010011')]) +addop("stc_l", [bs('0100'), bsvbr, d32rmpdec, bs('00100011')]) +addop("stc_l", [bs('0100'), bsssr, d32rmpdec, bs('00110011')]) +addop("stc_l", [bs('0100'), bsspc, d32rmpdec, bs('01000011')]) +addop("stc_l", [bs('0100'), bssgr, d32rmpdec, bs('00110010')]) +addop("stc_l", [bs('0100'), bsdbr, d32rmpdec, bs('11110010')]) +addop("stc_l", + [bs('0100'), d32rnpdec, bs('1'), brm, bs('0011')], [brm, d32rnpdec]) + +# float +addop("sts", [bs('0000'), bsmach, rm, bs('00001010')]) +addop("sts", [bs('0000'), bsmacl, rm, bs('00011010')]) +addop("sts", [bs('0000'), bspr, rm, bs('00101010')]) +addop("sts_l", [bs('0100'), bsmach, d32rmpdec, bs('00000010')]) +addop("sts_l", [bs('0100'), bsmacl, d32rmpdec, bs('00010010')]) +addop("sts_l", + [bs('0100'), d32rnpdec, bspr, bs('00100010')], [bspr, d32rnpdec]) +addop("trapa", [bs('11000011'), u08imm]) + +addop("fldi0", [bs('1111'), frn, bs('10001101')]) +addop("fldi1", [bs('1111'), frn, bs('10011101')]) +addop("fmov", [bs('1111'), frn, frm, bs('1100')], [frm, frn]) +addop("fmov_s", [bs('1111'), frn, d32gpreg, bs('1000')], [d32gpreg, frn]) +addop("fmov_s", [bs('1111'), frn, bd32r0gp, bs('0110')], [bd32r0gp, frn]) +addop("fmov_s", [bs('1111'), frn, d32rmpinc, bs('1001')], [d32rmpinc, frn]) +addop("fmov_s", [bs('1111'), d32gpreg, frm, bs('1010')], [frm, d32gpreg]) +addop("fmov_s", [bs('1111'), d32rnpdec, frm, bs('1011')], [frm, d32rnpdec]) +addop("fmov_s", [bs('1111'), bd32r0gp, frm, bs('0111')], [frm, bd32r0gp]) + +addop("flds", [bs('1111'), frm, bsfpul, bs('00011101')]) +addop("fsts", [bs('1111'), bsfpul, frm, bs('00001101')]) +addop("fabs", [bs('1111'), frn, bs('01011101')]) +addop("fadd", [bs('1111'), frn, frm, bs('0000')], [frm, frn]) +addop("fcmpeq", [bs('1111'), frn, frm, bs('0100')], [frm, frn]) +addop("fcmpgt", [bs('1111'), frn, frm, bs('0101')], [frm, frn]) +addop("fdiv", [bs('1111'), frn, frm, bs('0011')], [frm, frn]) + +addop("float", [bs('1111'), bsfpul, frn, bs('00101101')]) +addop("fmac", [bs('1111'), bsfr0, frn, frm, bs('1110')], [bsfr0, frm, frn]) +addop("fmul", [bs('1111'), frn, frm, bs('0010')], [frm, frn]) +addop("fneg", [bs('1111'), frn, bs('01001101')]) +addop("fsqrt", [bs('1111'), frn, bs('01101101')]) +addop("fsub", [bs('1111'), frn, frm, bs('0001')], [frm, frn]) +addop("ftrc", [bs('1111'), frm, bsfpul, bs('00111101')]) + + +if __name__ == '__main__': + import os + import time + filename = os.environ.get('PYTHONSTARTUP') + if filename and os.path.isfile(filename): + execfile(filename) + + def h2i(s): + return s.replace(' ', '').decode('hex') + + reg_tests_sh4 = [ + # vxworks + ("c80022f2 MOV 0x10, R6", + "10e6"), + ("c8002250 MOV 0xFFFFFFFF, R0", + "ffe0"), + ("c800226a MOV.W @(PC,0xC0), R9", + "5e99"), + ("c8002006 MOV.L @(PC&0xFFFFFFFC,0x10), R15", + "03df"), + ("c800cfc4 MOV R4, R9", + "4369"), + ("C8005004 MOV.B R1, @R2", + "1022"), + ("C8002E04 MOV.W R0, @R8", + '0128'), + ("c800223e MOV.L R1, @R14", + "122E"), + + ("c8002002 MOV.L @R1, R0", + "1260"), + ("c8002E08 MOV.W @R8, R1", + "8161"), + ("c800357c MOV.B @R4, R1", + "4061"), + + ("c8002220 MOV.L R8, @-R15", + "862f"), + ("c8022a66 MOV.B R4, @-R0", + "4420"), + ("c8002310 MOV.L @R15+, R14", + "f66e"), + ("c80038a4 MOV.W @R8+, R5", + "8565"), + ("xxxxxxxx MOV.B R0, @(R8,0x2)", + "8280"), + ("xxxxxxxx MOV.W R0, @(R8,0x4)", + "8281"), + ("c8002274 MOV.L R0, @(R9,0x8)", + "0219"), + ("xxxxxxxx MOV.B @(R8,0x8), R0", + "8884"), + ("xxxxxxxx MOV.W @(R8,0x10), R0", + "8885"), + ("c8002500 MOV.L @(R14,0x4), R5", + "e155"), + ("xxxxxxxx MOV.B R4, @(R0,R8)", + "4408"), + ("xxxxxxxx MOV.W R4, @(R0,R8)", + "4508"), + ("xxxxxxxx MOV.L R4, @(R0,R8)", + "4608"), + ("xxxxxxxx MOV.B @(R0,R4), R8", + "4c08"), + ("xxxxxxxx MOV.W @(R0,R4), R8", + "4d08"), + ("xxxxxxxx MOV.L @(R0,R4), R8", + "4e08"), + ("xxxxxxxx MOV.B R0, @(GBR,0x4)", + "04c0"), + ("xxxxxxxx MOV.W R0, @(GBR,0x8)", + "04c1"), + ("xxxxxxxx MOV.L R0, @(GBR,0x10)", + "04c2"), + ("xxxxxxxx MOV.B @(GBR,0x4), R0", + "04c4"), + ("xxxxxxxx MOV.W @(GBR,0x8), R0", + "04c5"), + ("xxxxxxxx MOV.L @(GBR,0x10), R0", + "04c6"), + #("xxxxxxxx MOV PC&0xFFFFFFFC+0x14, R0", + # "04c7"), + ("xxxxxxxx SWAPB R2, R1", + "2861"), + ("c803f492 SWAPW R4, R9", + "4969"), + ("xxxxxxxx XTRCT R4, R9", + "4d29"), + ("c8002270 ADD R12, R9", + "cc39"), + ("c8002238 ADD 0xFFFFFFFC, R15", + "FC7F"), + ("c80164cc ADDC R0, R1", + "0e31"), + ("xxxxxxxx ADDV R0, R1", + "0f31"), + ("c8002994 CMPEQ 0x20, R0", + "2088"), + ("c80029d2 CMPEQ R2, R1", + "2031"), + ("c8003964 CMPHS R5, R3", + "5233"), + ("c8002df2 CMPGE R0, R1", + "0331"), + ("c80029a4 CMPHI R1, R0", + "1630"), + ("c8002bfe CMPGT R10, R8", + "a738"), + ("c8002bf8 CMPPZ R0", + "1140"), + ("c8006294 CMPPL R2", + "1542"), + ("c8033800 CMPSTR R14, R4", + "ec24"), + ("xxxxxxxx DIV1 R14, R4", + "e434"), + ("c8d960de DIV0S R0, R3", + "0723"), + ("xxxxxxxx DIV0U ", + "1900"), + ("c800dcd8 DMULS R1, R0", + "1d30"), + ("c80164da DMULU R3, R8", + "3538"), + ("c80024e2 DT R10", + "104a"), + ("c800343a EXTSB R1, R1", + "1e61"), + ("c8002bf6 EXTSW R0, R0", + "0f60"), + ("c8002fba EXTUB R0, R0", + "0c60"), + ("c8002398 EXTUW R0, R0", + "0d60"), + ("xxxxxxxx MAC.L @R5+, @R4+", + "5f04"), + ("xxxxxxxx MAC.W @R5+, @R4+", + "5f44"), + ("c8005112 MULL R1, R3", + "1703"), + ("xxxxxxxx MULSW R1, R3", + "1F23"), + ("xxxxxxxx MULUW R1, R3", + "1e23"), + ("c8004856 NEG R1, R8", + "1b68"), + ("c80054fc NEGC R9, R7", + "9a67"), + ("c8004b36 SUB R1, R5", + "1835"), + ("c800a536 SUBC R1, R0", + "1a30"), + ("xxxxxxxx SUBV R1, R0", + "1b30"), + ("c80023ca AND R0, R5", + "0925"), + ("c800257c AND 0x2, R0", + "02c9"), + ("xxxxxxxx AND.B 0x2, @(GBR,R0)", + "02cd"), + ("c80065fe NOT R5, R1", + "5761"), + ("c8002586 OR R10, R1", + "ab21"), + ("c80023aa OR 0x4, R0", + "04cb"), + ("xxxxxxxx OR.B 0x4, @(GBR,R0)", + "04cf"), + ("xxxxxxxx TAS.B @R8", + "1b48"), + ("c8002368 TST R10, R13", + "a82d"), + ("c8003430 TST 0x11, R0", + "11c8"), + ("xxxxxxxx TST.B 0x4, @(GBR,R0)", + "04cc"), + ("c8003978 XOR R1, R6", + "1a26"), + ("c8028270 XOR 0x1, R0", + "01ca"), + ("xxxxxxxx XOR.B 0x4, @(GBR,R0)", + "04cE"), + ("xxxxxxxx ROTL R9", + "0449"), + ("xxxxxxxx ROTR R9", + "0549"), + ("xxxxxxxx ROTCL R9", + "2449"), + ("xxxxxxxx ROTCR R9", + "2549"), + ("xxxxxxxx SHAL R11", + "204b"), + ("xxxxxxxx SHAR R11", + "214b"), + ("c800236c SHLD R6, R10", + "6d4a"), + ("xxxxxxxx SHLL R11", + "004b"), + ("xxxxxxxx SHLR R11", + "014b"), + ("xxxxxxxx SHLL2 R11", + "084b"), + ("xxxxxxxx SHLR2 R11", + "094b"), + ("xxxxxxxx SHLL8 R11", + "184b"), + ("xxxxxxxx SHLR8 R11", + "194b"), + ("xxxxxxxx SHLL16 R11", + "284b"), + ("xxxxxxxx SHLR16 R11", + "294b"), + ("c8002c00 BF 0xFFFFFFF4", + "f48b"), + ("c80023c2 BFS 0xFFFFFFD8", + "d88f"), + ("c8002266 BT 0x5B", + "5b89"), + ("c8002266 BTS 0x5C", + "5c8d"), + ("c8002326 BRA 0xFFFFFFF0", + "f0af"), + ("c8004b4a BRAF R1", + "2301"), + ("c8055da4 BSR 0xFFFFFE48", + "48be"), + ("xxxxxxxx BSRF R1", + "0301"), + ("c80027b4 JMP.L @R1", + "2b41"), + ("c800200c JSR.L @R0", + "0b40"), + ("c800231a RTS ", + "0b00"), + ("xxxxxxxx CLRMAC ", + "2800"), + ("xxxxxxxx CLRS ", + "4800"), + ("xxxxxxxx CLRT ", + "0800"), + ("c8002004 LDC R0, SR", + "0e40"), + ("c800200e LDC R1, GBR", + "1e41"), + ("c8064bd4 LDC R8, VBR", + "2e48"), + ("xxxxxxxx LDC R8, SSR", + "3e48"), + ("xxxxxxxx LDC R8, SPC", + "4e48"), + ("xxxxxxxx LDC R8, DBR", + "fa48"), + ("xxxxxxxx LDC R8, R0_BANK", + "8e48"), + ("xxxxxxxx LDC.L @R8+, SR", + "0748"), + ("xxxxxxxx LDC.L @R8+, GBR", + "1748"), + ("xxxxxxxx LDC.L @R8+, VBR", + "2748"), + ("xxxxxxxx LDC.L @R8+, SSR", + "3748"), + ("xxxxxxxx LDC.L @R8+, SPC", + "4748"), + ("xxxxxxxx LDC.L @R8+, DBR", + "f648"), + ("xxxxxxxx LDC.L @R8+, R2_BANK", + "a748"), + ("xxxxxxxx LDS R8, MACH", + "0a48"), + ("xxxxxxxx LDS R8, MACL", + "1a48"), + ("xxxxxxxx LDS R8, PR", + "2a48"), + ("xxxxxxxx LDS.L @R8+, MACH", + "0648"), + ("xxxxxxxx LDS.L @R8+, MACL", + "1648"), + ("xxxxxxxx LDTLB ", + "3800"), + ("xxxxxxxx MOVCA.L R0, @R8", + "c308"), + ("xxxxxxxx NOP ", + "0900"), + ("xxxxxxxx OCBI.L @R8", + "9308"), + ("xxxxxxxx OCBP.L @R8", + "a308"), + ("xxxxxxxx OCBWB.L @R8", + "b308"), + ("xxxxxxxx PREF.L @R8", + "8308"), + ("xxxxxxxx STS MACH, R8", + "0a08"), + ("xxxxxxxx STS MACL, R8", + "1a08"), + ("xxxxxxxx STS PR, R8", + "2a08"), + ("xxxxxxxx STS.L MACH, @-R8", + "0248"), + ("xxxxxxxx STS.L MACL, @-R8", + "1248"), + ("xxxxxxxx STS.L PR, @-R8", + "2248"), + + + + + + ("c8004b50 STC GBR, R0", + "1200"), + ("c8064516 STC VBR, R1", + "2201"), + ("c8004b54 STC SSR, R1", + "3201"), + ("c801ed6c STC SPC, R0", + "4200"), + ("xxxxxxxx STC SGR, R0", + "3a00"), + ("xxxxxxxx STC DBR, R0", + "fa00"), + ("c8004b56 STC R3_BANK, R1", + "B201"), + ("xxxxxxxx STC.L SR, @-R8", + "0348"), + ("xxxxxxxx STC.L GBR, @-R8", + "1348"), + ("xxxxxxxx STC.L VBR, @-R8", + "2348"), + ("xxxxxxxx STC.L SSR, @-R8", + "3348"), + ("xxxxxxxx STC.L SPC, @-R8", + "4348"), + ("xxxxxxxx STC.L DBR, @-R8", + "f248"), + ("xxxxxxxx STC.L R7_BANK, @-R8", + "f348"), + ("c803b130 TRAPA 0xE0", + "e0c3"), + + ("xxxxxxxx FLDI0 FR8", + "8df8"), + ("xxxxxxxx FLDI1 FR8", + "9df8"), + ("c8019ca8 FMOV FR15, FR5", + "fcf5"), + ("c800affe FMOV.S @R1, FR4", + "18f4"), + ("c80283f6 FMOV.S @(R0,R14), FR5", + "e6f5"), + ("c800aff8 FMOV.S @R1+, FR5", + "19f5"), + ("c80cb692 FMOV.S FR0, @R2", + "0af2"), + ("c80cb694 FMOV.S FR1, @-R2", + "1bf2"), + ("c80283aa FMOV.S FR1, @(R0,R14)", + "17fe"), + ("c800ce16 FLDS FR13, FPUL", + "1dfd"), + ("c800ce08 FSTS FPUL, FR13", + "0dfd"), + ("xxxxxxxx FABS FR8", + "5df8"), + ("c800cf28 FADD FR2, FR6", + "20f6"), + ("c805dacc FCMPEQ FR2, FR6", + "24f6"), + ("c8028406 FCMPGT FR4, FR2", + "45f2"), + ("c8019ca4 FDIV FR2, FR12", + "23fc"), + ("c800ce5e FLOAT FPUL, FR2", + "2df2"), + ("xxxxxxxx FMAC FR0, FR1, FR2", + "1ef2"), + ("c800b006 FMUL FR2, FR4", + "22f4"), + ("c805e412 FNEG FR14", + "4dfe"), + ("xxxxxxxx FSQRT FR14", + "6dfe"), + ("c8030400 FSUB FR4, FR2", + "41f2"), + ("c80303ba FTRC FR2, FPUL", + "3df2"), + + ] + + for s, l in reg_tests_sh4: + print "-" * 80 + s = s[12:] + b = h2i((l)) + print b.encode('hex') + mn = mn_sh4.dis(b, None) + print [str(x) for x in mn.args] + print s + print mn + assert(str(mn) == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + l = mn_sh4.fromstring(s, None) + # print l + assert(str(l) == s) + a = mn_sh4.asm(l, None) + print [x for x in a] + print repr(b) + # print mn.args + assert(b in a) + + # speed test + o = "" + for s, l, in reg_tests_sh4: + s = s[12:] + b = h2i((l)) + o += b + + while len(o) < 1000: + o += o + bs = bin_stream_str(o) + off = 0 + instr_num = 0 + ts = time.time() + while off < bs.getlen(): + mn = mn_sh4.dis(bs, None, off) + # print instr_num, off, mn.l, str(mn) + instr_num += 1 + off += mn.l + print 'instr per sec:', instr_num / (time.time() - ts) + + import cProfile + cProfile.run(r'mn_sh4.dis("\x17\xfe", None)') diff --git a/miasm2/arch/sh4/regs.py b/miasm2/arch/sh4/regs.py new file mode 100644 index 00000000..bfc61b04 --- /dev/null +++ b/miasm2/arch/sh4/regs.py @@ -0,0 +1,80 @@ +from miasm2.expression.expression import * +from miasm2.core.cpu import reg_info, gen_reg + +# GP +gpregs_str = ['R%d' % r for r in xrange(0x10)] +gpregs_expr = [ExprId(x, 32) for x in gpregs_str] +gpregs = reg_info(gpregs_str, gpregs_expr) + +bgpregs_str = ['R%d_BANK' % r for r in xrange(0x8)] +bgpregs_expr = [ExprId(x, 32) for x in bgpregs_str] +bgpregs = reg_info(bgpregs_str, bgpregs_expr) + +fregs_str = ['FR%d' % r for r in xrange(0x10)] +fregs_expr = [ExprId(x, 32) for x in fregs_str] +fregs = reg_info(fregs_str, fregs_expr) + +dregs_str = ['DR%d' % r for r in xrange(0x8)] +dregs_expr = [ExprId(x, 32) for x in dregs_str] +dregs = reg_info(dregs_str, dregs_expr) + + +gen_reg('PC', globals()) +gen_reg('PR', globals()) +gen_reg('R0', globals()) +gen_reg('GBR', globals()) +gen_reg('SR', globals()) +gen_reg('VBR', globals()) +gen_reg('SSR', globals()) +gen_reg('SPC', globals()) +gen_reg('SGR', globals()) +gen_reg('DBR', globals()) +gen_reg('MACH', globals()) +gen_reg('MACL', globals()) +gen_reg('FPUL', globals()) +gen_reg('FR0', globals()) + +R0 = gpregs_expr[0] +R1 = gpregs_expr[1] +R2 = gpregs_expr[2] +R3 = gpregs_expr[3] +R4 = gpregs_expr[4] +R5 = gpregs_expr[5] +R6 = gpregs_expr[6] +R7 = gpregs_expr[7] +R8 = gpregs_expr[8] +R9 = gpregs_expr[9] +R10 = gpregs_expr[10] +R11 = gpregs_expr[11] +R12 = gpregs_expr[12] +R13 = gpregs_expr[13] +R14 = gpregs_expr[14] +R15 = gpregs_expr[15] + + +reg_zf = 'zf' +reg_nf = 'nf' +reg_of = 'of' +reg_cf = 'cf' + +zf = ExprId(reg_zf, size=1) +nf = ExprId(reg_nf, size=1) +of = ExprId(reg_of, size=1) +cf = ExprId(reg_cf, size=1) + + +all_regs_ids = [ + R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R11, R12, R13, R14, R15, + zf, nf, of, cf, + + PC, PR, R0, GBR, SR, VBR, SSR, SPC, + SGR, DBR, MACH, MACL, FPUL, FR0] + +all_regs_ids_byname = dict([(x.name, x) for x in all_regs_ids]) + +all_regs_ids_init = [ExprId("%s_init" % x.name, x.size) for x in all_regs_ids] + +regs_init = {} +for i, r in enumerate(all_regs_ids): + all_regs_ids_init[i].is_term = True + regs_init[r] = all_regs_ids_init[i] diff --git a/miasm2/arch/x86/__init__.py b/miasm2/arch/x86/__init__.py new file mode 100644 index 00000000..bbad893b --- /dev/null +++ b/miasm2/arch/x86/__init__.py @@ -0,0 +1 @@ +__all__ = ["arch", "disasm", "regs", "sem"] diff --git a/miasm2/arch/x86/arch.py b/miasm2/arch/x86/arch.py new file mode 100644 index 00000000..5ccc4a9c --- /dev/null +++ b/miasm2/arch/x86/arch.py @@ -0,0 +1,3839 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import re +from miasm2.expression.expression import * +from pyparsing import * +from miasm2.core.cpu import * +from collections import defaultdict +import regs as regs_module +from regs import * +from miasm2.ir.ir import * + +log = logging.getLogger("x86_arch") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.WARN) + + +f_isad = "AD" +f_s08 = "S08" +f_u08 = "U08" +f_s16 = "S16" +f_u16 = "U16" +f_s32 = "S32" +f_u32 = "U32" +f_s64 = "S64" +f_u64 = "U64" +f_imm = 'IMM' + +f_imm2size = {f_s08: 8, f_s16: 16, f_s32: 32, f_s64: 64, + f_u08: 8, f_u16: 16, f_u32: 32, f_u64: 64} + + +size2gpregs = {8: gpregs08, 16: gpregs16, + 32: gpregs32, 64: gpregs64} + + +replace_regs64 = { + AL: RAX[:8], CL: RCX[:8], DL: RDX[:8], BL: RBX[:8], + AH: RAX[8:16], CH: RCX[8:16], DH: RDX[8:16], BH: RBX[8:16], + SPL: RSP[0:8], BPL: RBP[0:8], SIL: RSI[0:8], DIL: RDI[0:8], + R8B: R8[0:8], R9B: R9[0:8], R10B: R10[0:8], R11B: R11[0:8], + R12B: R12[0:8], R13B: R13[0:8], R14B: R14[0:8], R15B: R15[0:8], + + AX: RAX[:16], CX: RCX[:16], DX: RDX[:16], BX: RBX[:16], + SP: RSP[:16], BP: RBP[:16], SI: RSI[:16], DI: RDI[:16], + R8W: R8[:16], R9W: R9[:16], R10W: R10[:16], R11W: R11[:16], + R12W: R12[:16], R13W: R13[:16], R14W: R14[:16], R15W: R15[:16], + + + EAX: RAX[:32], ECX: RCX[:32], EDX: RDX[:32], EBX: RBX[:32], + ESP: RSP[:32], EBP: RBP[:32], ESI: RSI[:32], EDI: RDI[:32], + R8D: R8[:32], R9D: R9[:32], R10D: R10[:32], R11D: R11[:32], + R12D: R12[:32], R13D: R13[:32], R14D: R14[:32], R15D: R15[:32], + + IP: RIP[:16], EIP: RIP[:32], + +} + +replace_regs32 = { + AL: EAX[:8], CL: ECX[:8], DL: EDX[:8], BL: EBX[:8], + AH: EAX[8:16], CH: ECX[8:16], DH: EDX[8:16], BH: EBX[8:16], + + AX: EAX[:16], CX: ECX[:16], DX: EDX[:16], BX: EBX[:16], + SP: ESP[:16], BP: EBP[:16], SI: ESI[:16], DI: EDI[:16], + + IP: EIP[:16] +} + +replace_regs16 = { + AL: AX[:8], CL: CX[:8], DL: DX[:8], BL: BX[:8], + AH: AX[8:16], CH: CX[8:16], DH: DX[8:16], BH: BX[8:16], + + AX: AX[:16], CX: CX[:16], DX: DX[:16], BX: BX[:16], + SP: SP[:16], BP: BP[:16], SI: SI[:16], DI: DI[:16], +} + +replace_regs = {16: replace_regs16, + 32: replace_regs32, + 64: replace_regs64} + + +# parser helper ########### +PLUS = Suppress("+") +MULT = Suppress("*") + +COLON = Suppress(":") + + +LBRACK = Suppress("[") +RBRACK = Suppress("]") + +dbreg = Group(gpregs16.parser | gpregs32.parser | gpregs64.parser) +gpreg = (gpregs08.parser | gpregs08_64.parser | gpregs16.parser | + gpregs32.parser | gpregs64.parser | gpregs_xmm.parser | + gpregs_mm.parser) + + +def reg2exprid(r): + if not r.name in all_regs_ids_byname: + raise ValueError('unknown reg') + return all_regs_ids_byname[r.name] + + +def parse_deref_reg(s, l, t): + t = t[0][0] + return t[0] + + +def parse_deref_int(s, l, t): + t = t[0] + return t[0] + + +def parse_deref_regint(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + i1 = ExprInt_from(r1, t[1].arg) + return r1 + i1 + + +def parse_deref_regreg(s, l, t): + t = t[0] + return t[0][0] + t[1][0] + + +def parse_deref_regregint(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + r2 = reg2exprid(t[1][0]) + i1 = ExprInt_from(r1, t[2].arg) + return r1 + r2 + i1 + + +def parse_deref_reg_intmreg(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + r2 = reg2exprid(t[1][0]) + i1 = ExprInt_from(r1, t[2].arg) + return r1 + (r2 * i1) + + +def parse_deref_reg_intmreg_int(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + r2 = reg2exprid(t[1][0]) + i1 = ExprInt_from(r1, t[2].arg) + i2 = ExprInt_from(r1, t[3].arg) + return r1 + (r2 * i1) + i2 + + +def parse_deref_intmreg(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + i1 = ExprInt_from(r1, t[1].arg) + return r1 * i1 + + +def parse_deref_intmregint(s, l, t): + t = t[0] + r1 = reg2exprid(t[0][0]) + i1 = ExprInt_from(r1, t[1].arg) + i2 = ExprInt_from(r1, t[1].arg) + return (r1 * i1) + i2 + + +def getreg(s, l, t): + t = t[0] + return t[0] + + +def parse_deref_ptr(s, l, t): + t = t[0] + return ExprMem(ExprOp('segm', t[0], t[1])) + + +variable, operand, base_expr = gen_base_expr() + + +def ast_id2expr(t): + if not t in mn_x86.regs.all_regs_ids_byname: + r = ExprId(t) + else: + r = mn_x86.regs.all_regs_ids_byname[t] + return r + + +def ast_int2expr(a): + return ExprInt64(a) + + +my_var_parser = parse_ast(ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + +int_or_expr = base_expr + +deref_mem_ad = Group(LBRACK + dbreg + RBRACK).setParseAction(parse_deref_reg) +deref_mem_ad |= Group( + LBRACK + int_or_expr + RBRACK).setParseAction(parse_deref_int) +deref_mem_ad |= Group( + LBRACK + dbreg + PLUS + + int_or_expr + RBRACK).setParseAction(parse_deref_regint) +deref_mem_ad |= Group( + LBRACK + dbreg + PLUS + + dbreg + RBRACK).setParseAction(parse_deref_regreg) +deref_mem_ad |= Group( + LBRACK + dbreg + PLUS + dbreg + PLUS + + int_or_expr + RBRACK).setParseAction(parse_deref_regregint) +deref_mem_ad |= Group( + LBRACK + dbreg + PLUS + dbreg + MULT + + int_or_expr + RBRACK).setParseAction(parse_deref_reg_intmreg) +deref_mem_ad |= Group( + LBRACK + dbreg + PLUS + dbreg + MULT + int_or_expr + + PLUS + int_or_expr + RBRACK).setParseAction(parse_deref_reg_intmreg_int) +deref_mem_ad |= Group( + LBRACK + dbreg + MULT + + int_or_expr + RBRACK).setParseAction(parse_deref_intmreg) +deref_mem_ad |= Group( + LBRACK + dbreg + MULT + int_or_expr + + PLUS + int_or_expr + RBRACK).setParseAction(parse_deref_intmregint) + + +deref_ptr = Group(int_or_expr + COLON + + int_or_expr).setParseAction(parse_deref_ptr) + + +PTR = Suppress('PTR') + + +BYTE = Literal('BYTE') +WORD = Literal('WORD') +DWORD = Literal('DWORD') +QWORD = Literal('QWORD') +TBYTE = Literal('TBYTE') + + +def parse_deref_mem(s, l, t): + sz = {'BYTE': 8, 'WORD': 16, 'DWORD': 32, 'QWORD': 64, 'TBYTE': 80} + t = t[0] + if len(t) == 2: + s, ptr = t + return ExprMem(ptr, sz[s[0]]) + elif len(t) == 3: + s, segm, ptr = t + return ExprMem(ExprOp('segm', segm[0], ptr), sz[s[0]]) + else: + raise ValueError('len(t) > 3') + +mem_size = Group(BYTE | DWORD | QWORD | WORD | TBYTE) +deref_mem = Group(mem_size + PTR + Optional(Group(int_or_expr + COLON)) + + deref_mem_ad).setParseAction(parse_deref_mem) + + +rmarg = Group(gpregs08.parser | + gpregs08_64.parser | + gpregs16.parser | + gpregs32.parser | + gpregs64.parser | + gpregs_mm.parser | + gpregs_xmm.parser + ).setParseAction(getreg) + +rmarg |= deref_mem + + +cl_or_imm = Group(r08_ecx.parser).setParseAction(getreg) +cl_or_imm |= int_or_expr + + +class r_al(reg_noarg, m_arg): + reg_info = r08_eax + parser = reg_info.parser + + +class r_ax(reg_noarg, m_arg): + reg_info = r16_eax + parser = reg_info.parser + + +class r_dx(reg_noarg, m_arg): + reg_info = r16_edx + parser = reg_info.parser + + +class r_eax(reg_noarg, m_arg): + reg_info = r32_eax + parser = reg_info.parser + + +class r_rax(reg_noarg, m_arg): + reg_info = r64_eax + parser = reg_info.parser + + +class r_cl(reg_noarg, m_arg): + reg_info = r08_ecx + parser = reg_info.parser + + +invmode = {16: 32, 32: 16} + + +def opmode_prefix(mode): + size, opmode, admode = mode + if size in [16, 32]: + if opmode: + return invmode[size] + else: + return size + elif size == 64: + if opmode: + return 16 + else: + return 32 + raise NotImplementedError('not fully functional') + + +def admode_prefix(mode): + size, opmode, admode = mode + if size in [16, 32]: + if admode: + return invmode[size] + else: + return size + elif size == 64: + return 64 + raise NotImplementedError('not fully functional') + + +def v_opmode_info(size, opmode, rex_w, stk): + if size in [16, 32]: + if opmode: + return invmode[size] + else: + return size + elif size == 64: + if rex_w == 1: + return 64 + elif stk: + if opmode == 1: + return 16 + else: + return 64 + elif opmode == 1: + return 16 + return 32 + + +def v_opmode(p): + stk = hasattr(p, 'stk') + return v_opmode_info(p.mode, p.opmode, p.rex_w.value, stk) + + +def v_admode_info(size, admode): + if size in [16, 32]: + if admode: + return invmode[size] + else: + return size + elif size == 64: + if admode == 1: + return 32 + return 64 + + +def v_admode(p): + return v_admode_info(p.mode, p.admode) + + +def offsize(p): + if p.opmode: + return 16 + else: + return p.mode + + +def get_prefix(s): + g = re.search('(\S+)(\s+)', s) + if not g: + return None, s + prefix, b = g.groups() + return prefix, s[len(prefix) + len(b):] + + +repeat_mn = ["INS", "OUTS", + "MOVSB", "MOVSW", "MOVSD", "MOVSQ", + "SCASB", "SCASW", "SCASD", "SCASQ", + "LODSB", "LODSW", "LODSD", "LODSQ", + "STOSB", "STOSW", "STOSD", "STOSQ", + "CMPSB", "CMPSW", "CMPSD", "CMPSQ", + ] + +segm2enc = {CS: 1, SS: 2, DS: 3, ES: 4, FS: 5, GS: 6} +enc2segm = dict([(x[1], x[0]) for x in segm2enc.items()]) + + +class group: + + def __init__(self): + self.value = None + + +class additional_info: + + def __init__(self): + self.except_on_instr = False + self.g1 = group() + self.g2 = group() + self.vopmode = None + self.stk = False + self.v_opmode = None + self.v_admode = None + self.prefixed = '' + + +class instruction_x86(instruction): + delayslot = 0 + + def __init__(self, *args, **kargs): + super(instruction_x86, self).__init__(*args, **kargs) + self.additional_info.stk = hasattr(self, 'stk') + + def v_opmode(self): + return self.additional_info.v_opmode + + def v_admode(self): + return self.additional_info.v_admode + + def dstflow(self): + if self.name.startswith('J'): + return True + if self.name.startswith('LOOP'): + return True + # repxx yyy generate split flow + # if self.g1.value & 6 and self.name in repeat_mn: + # return True + return self.name in ['CALL'] + + def dstflow2label(self, symbol_pool): + if self.additional_info.g1.value & 6 and self.name in repeat_mn: + return + e = self.args[0] + if isinstance(e, ExprId) and not e.name in all_regs_ids_byname: + l = symbol_pool.getby_name_create(e.name) + s = ExprId(l, e.size) + self.args[0] = s + elif isinstance(e, ExprInt): + ad = e.arg + int(self.offset) + self.l + l = symbol_pool.getby_offset_create(ad) + s = ExprId(l, e.size) + self.args[0] = s + else: + return + + def breakflow(self): + if self.name.startswith('J'): + return True + if self.name.startswith('LOOP'): + return True + if self.name.startswith('RET'): + return True + if self.name.startswith('INT'): + return True + if self.name.startswith('SYS'): + return True + # repxx yyy generate split flow + # if self.g1.value & 6 and self.name in repeat_mn: + # return True + return self.name in ['CALL', 'HLT', 'IRET', 'ICEBP'] + + def splitflow(self): + if self.name.startswith('JMP'): + return False + if self.name.startswith('J'): + return True + if self.name.startswith('LOOP'): + return True + if self.name.startswith('SYS'): + return True + # repxx yyy generate split flow + # if self.g1.value & 6 and self.name in repeat_mn: + # return True + return self.name in ['CALL'] + + def setdstflow(self, a): + return + + def is_subcall(self): + return self.name in ['CALL'] + + def getdstflow(self, symbol_pool): + if self.additional_info.g1.value & 6 and self.name in repeat_mn: + ad = int(self.offset) + l = symbol_pool.getby_offset_create(ad) + # XXX size ??? + s = ExprId(l, self.v_opmode()) + return [s] + return [self.args[0]] + + def get_symbol_size(self, symbol, symbol_pool): + return self.mode + + def fixDstOffset(self): + e = self.args[0] + if self.offset is None: + raise ValueError('symbol not resolved %s' % l) + if not isinstance(e, ExprInt): + # raise ValueError('dst must be int or label') + log.warning('dynamic dst %r' % e) + return + # return ExprInt32(e.arg - (self.offset + self.l)) + self.args[0] = ExprInt_fromsize( + self.mode, e.arg - (self.offset + self.l)) + + def get_info(self, c): + self.additional_info.g1.value = c.g1.value + self.additional_info.g2.value = c.g2.value + self.additional_info.v_opmode = c.v_opmode() + self.additional_info.v_admode = c.v_admode() + self.additional_info.prefix = c.prefix + self.additional_info.prefixed = getattr(c, "prefixed", "") + + def __str__(self): + o = super(instruction_x86, self).__str__() + if self.additional_info.g1.value & 1: + o = "LOCK %s" % o + if self.additional_info.g1.value & 2: + if getattr(self.additional_info.prefixed, 'default', "") != "\xF2": + o = "REPNE %s" % o + if self.additional_info.g1.value & 4: + if getattr(self.additional_info.prefixed, 'default', "") != "\xF3": + o = "REPE %s" % o + return o + + def get_args_expr(self): + args = [] + for a in self.args: + a = a.replace_expr(replace_regs[self.mode]) + args.append(a) + return args + + +class mn_x86(cls_mn): + name = "x86" + prefix_op_size = False + prefix_ad_size = False + regs = regs_module + all_mn = [] + all_mn_mode = defaultdict(list) + all_mn_name = defaultdict(list) + all_mn_inst = defaultdict(list) + bintree = {} + num = 0 + delayslot = 0 + pc = {16: IP, 32: EIP, 64: RIP} + sp = {16: SP, 32: ESP, 64: RSP} + instruction = instruction_x86 + max_instruction_len = 15 + + @classmethod + def getpc(cls, attrib): + return cls.pc[attrib] + + @classmethod + def getsp(cls, attrib): + return cls.sp[attrib] + + def v_opmode(self): + if hasattr(self, 'stk'): + stk = 1 + else: + stk = 0 + return v_opmode_info(self.mode, self.opmode, self.rex_w.value, stk) + + def v_admode(self): + size, opmode, admode = self.mode, self.opmode, self.admode + if size in [16, 32]: + if admode: + return invmode[size] + else: + return size + elif size == 64: + if admode == 1: + return 32 + return 64 + + def additional_info(self): + info = additional_info() + info.g1.value = self.g1.value + info.g2.value = self.g2.value + info.v_opmode = self.v_opmode() + info.prefixed = "" + if hasattr(self, 'prefixed'): + info.prefixed = self.prefixed.default + return info + + @classmethod + def check_mnemo(cls, fields): + pass + + @classmethod + def getmn(cls, name): + return name.upper() + + @classmethod + def mod_fields(cls, fields): + prefix = [d_g1, d_g2, d_rex_p, d_rex_w, d_rex_r, d_rex_x, d_rex_b] + return prefix + fields + + @classmethod + def gen_modes(cls, subcls, name, bases, dct, fields): + dct['mode'] = None + return [(subcls, name, bases, dct, fields)] + + @classmethod + def fromstring(cls, s, mode): + pref = 0 + prefix, new_s = get_prefix(s) + if prefix == "LOCK": + pref |= 1 + s = new_s + elif prefix == "REPNE": + pref |= 2 + s = new_s + elif prefix == "REPE": + pref |= 4 + s = new_s + c = super(mn_x86, cls).fromstring(s, mode) + c.additional_info.g1.value = pref + return c + + @classmethod + def pre_dis(cls, v, mode, offset): + offset_o = offset + pre_dis_info = {'opmode': 0, + 'admode': 0, + 'g1': 0, + 'g2': 0, + 'rex_p': 0, + 'rex_w': 0, + 'rex_r': 0, + 'rex_x': 0, + 'rex_b': 0, + 'prefix': "", + 'prefixed': "", + } + while True: + c = v.getbytes(offset) + if c == '\x66': + # pre_dis_info.opmode = 1 + pre_dis_info['opmode'] = 1 + elif c == '\x67': + pre_dis_info['admode'] = 1 + elif c == '\xf0': + pre_dis_info['g1'] = 1 + elif c == '\xf2': + pre_dis_info['g1'] = 2 + elif c == '\xf3': + pre_dis_info['g1'] = 4 + + elif c == '\x2e': + pre_dis_info['g2'] = 1 + elif c == '\x36': + pre_dis_info['g2'] = 2 + elif c == '\x3e': + pre_dis_info['g2'] = 3 + elif c == '\x26': + pre_dis_info['g2'] = 4 + elif c == '\x64': + pre_dis_info['g2'] = 5 + elif c == '\x65': + pre_dis_info['g2'] = 6 + + elif mode == 64 and c in '@ABCDEFGHIJKLMNO': + x = ord(c) + pre_dis_info['rex_p'] = 1 + pre_dis_info['rex_w'] = (x >> 3) & 1 + pre_dis_info['rex_r'] = (x >> 2) & 1 + pre_dis_info['rex_x'] = (x >> 1) & 1 + pre_dis_info['rex_b'] = (x >> 0) & 1 + offset += 1 + break + else: + c = '' + break + pre_dis_info['prefix'] += c + offset += 1 + # pre_dis_info.b = v[:offset] + return pre_dis_info, v, mode, offset, offset - offset_o + + @classmethod + def get_cls_instance(cls, cc, mode, infos=None): + for opmode in [0, 1]: + for admode in [0, 1]: + # c = cls.all_mn_inst[cc][0] + c = cc() + c.init_class() + + c.reset_class() + c.add_pre_dis_info() + c.dup_info(infos) + + c.mode = mode + c.opmode = opmode + c.admode = admode + + if hasattr(c, "fopmode") and c.fopmode.mode == 64: + c.rex_w.value = 1 + yield c + + def post_dis(self): + if self.g2.value: + for a in self.args: + if not isinstance(a.expr, ExprMem): + continue + m = a.expr + a.expr = ExprMem( + ExprOp('segm', enc2segm[self.g2.value], m.arg), m.size) + if self.name == 'LEA': + if not isinstance(self.args[1].expr, ExprMem): + return None + return self + + def dup_info(self, infos): + if infos is not None: + self.g1.value = infos.g1.value + self.g2.value = infos.g2.value + + def reset_class(self): + super(mn_x86, self).reset_class() + # self.rex_w.value, self.rex_b.value, + # self.rex_x.value = None, None, None + # self.opmode.value, self.admode.value = None, None + if hasattr(self, "opmode"): + del(self.opmode) + if hasattr(self, "admode"): + del(self.admode) + # self.opmode = 0 + # self.admode = 0 + + def add_pre_dis_info(self, pre_dis_info=None): + # print 'add_pre_dis_info', pre_dis_info + + if pre_dis_info is None: + return True + if hasattr(self, "prefixed") and self.prefixed.default == "\x66": + pre_dis_info['opmode'] = 0 + # if self.opmode != 0: + # return False + + # if pre_dis_info['opmode'] != self.opmode: + # return False + # if pre_dis_info['admode'] != self.admode: + # return False + self.opmode = pre_dis_info['opmode'] + self.admode = pre_dis_info['admode'] + + if hasattr(self, 'no_xmm_pref') and\ + pre_dis_info['prefix'] and\ + pre_dis_info['prefix'][-1] in '\x66\xf2\xf3': + return False + if (hasattr(self, "prefixed") and + not pre_dis_info['prefix'].endswith(self.prefixed.default)): + return False + # print self.rex_w.value, pre_dis_info['rex_w'] + # print 'rex', self.rex_w.value, self.rex_b.value, self.rex_x.value + if (self.rex_w.value is not None and + self.rex_w.value != pre_dis_info['rex_w']): + return False + else: + self.rex_w.value = pre_dis_info['rex_w'] + self.rex_r.value = pre_dis_info['rex_r'] + self.rex_b.value = pre_dis_info['rex_b'] + self.rex_x.value = pre_dis_info['rex_x'] + self.rex_p.value = pre_dis_info['rex_p'] + self.g1.value = pre_dis_info['g1'] + self.g2.value = pre_dis_info['g2'] + self.prefix = pre_dis_info['prefix'] + # self.prefixed = pre_dis_info['prefixed'] + + """ + if hasattr(self, "p_"): + self.prefixed = self.p_.default + if self.p_.default == "\x66": + pre_dis_info['opmode'] = 0 + if self.opmode != 0: + return False + #self.pre_dis_info = pre_dis_info + """ + return True + + def post_asm(self, v): + return v + + def encodefields(self, decoded): + v = super(mn_x86, self).encodefields(decoded) + if hasattr(self, 'prefixed'): + v = self.prefixed.default + v + + rex = 0x40 + if self.g1.value is None: + self.g1.value = 0 + if self.g2.value is None: + self.g2.value = 0 + + if self.rex_w.value: + rex |= 0x8 + if self.rex_r.value: + rex |= 0x4 + if self.rex_x.value: + rex |= 0x2 + if self.rex_b.value: + rex |= 0x1 + if rex != 0x40 or self.rex_p.value == 1: + v = chr(rex) + v + if self.g1.value & 1: + v = "\xf0" + v + if self.g1.value & 2: + if hasattr(self, 'no_xmm_pref'): + return None + v = "\xf2" + v + if self.g1.value & 4: + if hasattr(self, 'no_xmm_pref'): + return None + v = "\xf3" + v + if self.g2.value: + v = {1: '\x2e', 2: '\x36', 3: '\x3e', 4: + '\x26', 5: '\x64', 6: '\x65'}[self.g2.value] + v + # mode prefix + if hasattr(self, "admode") and self.admode: + v = "\x67" + v + + if hasattr(self, "opmode") and self.opmode: + if hasattr(self, 'no_xmm_pref'): + return None + v = "\x66" + v + + return v + + def getnextflow(self, symbol_pool): + raise NotImplementedError('not fully functional') + return self.offset + 4 + + def ir_pre_instruction(self): + return [ExprAff(mRIP[self.mode], + ExprInt_from(mRIP[self.mode], self.offset + self.l))] + + @classmethod + def filter_asm_candidates(cls, instr, candidates): + + cand_same_mode = [] + cand_diff_mode = [] + out = [] + for c, v in candidates: + if (hasattr(c, 'no_xmm_pref') and + (c.g1.value & 2 or c.g1.value & 4 or c.opmode)): + continue + if hasattr(c, "fopmode") and v_opmode(c) != c.fopmode.mode: + # print 'DROP', c, v_opmode(c), c.fopmode.mode + continue + if hasattr(c, "fadmode") and v_admode(c) != c.fadmode.mode: + # print 'DROP', c, v_opmode(c), c.fopmode.mode + continue + # relative dstflow must not have opmode set + # (affect IP instead of EIP for instance) + if (instr.dstflow() and + instr.name not in ["JCXZ", "JECXZ", "JRCXZ"] and + len(instr.args) == 1 and + isinstance(instr.args[0], ExprInt) and c.opmode): + continue + + out.append((c, v)) + candidates = out + # return [x[1][0] for x in candidates] + for c, v in candidates: + if v_opmode(c) == instr.mode: + cand_same_mode += v + for c, v in candidates: + if v_opmode(c) != instr.mode: + cand_diff_mode += v + cand_same_mode.sort(key=lambda x: len(x)) + cand_diff_mode.sort(key=lambda x: len(x)) + return cand_same_mode + cand_diff_mode + + +class bs8(bs): + prio = default_prio + + def __init__(self, v, cls=None, fname=None, **kargs): + super(bs8, self).__init__(int2bin(v, 8), 8, + cls=cls, fname=fname, **kargs) + + +class bs_modname_size(bs_divert): + prio = 1 + + def divert(self, i, candidates): + out = [] + for candidate in candidates: + cls, name, bases, dct, fields = candidate + fopmode = opmode_prefix( + (dct['mode'], dct['opmode'], dct['admode'])) + mode = dct['mode'] + size, opmode, admode = dct['mode'], dct['opmode'], dct['admode'] + # no mode64 existance in name means no 64bit version of mnemo + if mode == 64: + if mode in self.args['name']: + nfields = fields[:] + f, i = getfieldindexby_name(nfields, 'rex_w') + # f = bs("1", l=0, fname = 'rex_w') + f = bs("1", l=0, cls=(bs_fbit,), fname="rex_w") + osize = v_opmode_info(size, opmode, 1, 0) + nfields[i] = f + nfields = nfields[:-1] + args = dict(self.args) + ndct = dict(dct) + if osize in self.args['name']: + ndct['name'] = self.args['name'][osize] + out.append((cls, ndct['name'], bases, ndct, nfields)) + + nfields = fields[:] + nfields = nfields[:-1] + f, i = getfieldindexby_name(nfields, 'rex_w') + # f = bs("0", l=0, fname = 'rex_w') + f = bs("0", l=0, cls=(bs_fbit,), fname="rex_w") + osize = v_opmode_info(size, opmode, 0, 0) + nfields[i] = f + args = dict(self.args) + ndct = dict(dct) + if osize in self.args['name']: + ndct['name'] = self.args['name'][osize] + out.append((cls, ndct['name'], bases, ndct, nfields)) + else: + l = opmode_prefix((dct['mode'], dct['opmode'], dct['admode'])) + osize = v_opmode_info(size, opmode, None, 0) + nfields = fields[:-1] + args = dict(self.args) + ndct = dict(dct) + if osize in self.args['name']: + ndct['name'] = self.args['name'][osize] + out.append((cls, ndct['name'], bases, ndct, nfields)) + return out + + +class bs_modname_jecx(bs_divert): + prio = 1 + + def divert(self, i, candidates): + out = [] + for candidate in candidates: + cls, name, bases, dct, fields = candidate + fopmode = opmode_prefix( + (dct['mode'], dct['opmode'], dct['admode'])) + mode = dct['mode'] + size, opmode, admode = dct['mode'], dct['opmode'], dct['admode'] + + nfields = fields[:] + nfields = nfields[:-1] + args = dict(self.args) + ndct = dict(dct) + if mode == 64: + if admode: + ndct['name'] = "JECXZ" + else: + ndct['name'] = "JRCXZ" + elif mode == 32: + if admode: + ndct['name'] = "JCXZ" + else: + ndct['name'] = "JECXZ" + elif mode == 16: + if admode: + ndct['name'] = "JECXZ" + else: + ndct['name'] = "JCXZ" + else: + raise ValueError('unhandled mode') + out.append((cls, ndct['name'], bases, ndct, nfields)) + return out + + +class bs_modname_mode(bs_divert): + prio = 1 + + def divert(self, i, candidates): + out = [] + for candidate in candidates: + cls, name, bases, dct, fields = candidate + fopmode = opmode_prefix( + (dct['mode'], dct['opmode'], dct['admode'])) + size, opmode, admode = dct['mode'], dct['opmode'], dct['admode'] + + mode = dct['mode'] + l = opmode_prefix((dct['mode'], dct['opmode'], dct['admode'])) + osize = v_opmode_info(size, opmode, None, 0) + nfields = fields[:-1] + args = dict(self.args) + ndct = dict(dct) + if mode == 64 or osize == 32: + ndct['name'] = self.args['name'][mode] + else: + ndct['name'] = self.args['name'][16] + out.append((cls, ndct['name'], bases, ndct, nfields)) + return out + + +class x86_imm(imm_noarg): + parser = base_expr + + def decodeval(self, v): + return swap_uint(self.l, v) + + def encodeval(self, v): + return swap_uint(self.l, v) + + +class x86_imm_fix(imm_noarg): + parser = base_expr + + def decodeval(self, v): + return self.ival + + def encodeval(self, v): + if v != self.ival: + return False + return self.ival + + +class x86_08(x86_imm): + intsize = 8 + intmask = (1 << intsize) - 1 + + +class x86_16(x86_imm): + intsize = 16 + intmask = (1 << intsize) - 1 + + +class x86_32(x86_imm): + intsize = 32 + intmask = (1 << intsize) - 1 + + +class x86_64(x86_imm): + intsize = 64 + intmask = (1 << intsize) - 1 + + +class x86_08_ne(x86_imm): + intsize = 8 + intmask = (1 << intsize) - 1 + + def encode(self): + return True + + def decode(self, v): + v = swap_uint(self.l, v) + p = self.parent + admode = p.v_admode() + e = sign_ext(v, self.intsize, admode) + e = ExprInt_fromsize(admode, e) + self.expr = e + return True + + +class x86_16_ne(x86_08_ne): + intsize = 16 + intmask = (1 << intsize) - 1 + + +class x86_32_ne(x86_08_ne): + intsize = 32 + intmask = (1 << intsize) - 1 + + +class x86_64_ne(x86_08_ne): + intsize = 64 + intmask = (1 << intsize) - 1 + + +class x86_s08to16(x86_imm): + in_size = 8 + out_size = 16 + + def myexpr(self, x): + return ExprInt16(x) + + def int2expr(self, v): + return self.myexpr(v) + + def expr2int(self, e): + if not isinstance(e, ExprInt): + return None + v = int(e.arg) + if v & ~((1 << self.l) - 1) != 0: + return None + return v + + def decode(self, v): + v = v & self.lmask + v = self.decodeval(v) + if self.parent.v_opmode() == 64: + self.expr = ExprInt64(sign_ext(v, self.in_size, 64)) + else: + if (1 << (self.l - 1)) & v: + v = sign_ext(v, self.l, self.out_size) + self.expr = self.myexpr(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + opmode = self.parent.v_opmode() + + out_size = self.out_size + if opmode != self.out_size: + if opmode == 32 and self.out_size == 64: + out_size = opmode + if v == sign_ext( + int(v & ((1 << self.in_size) - 1)), self.in_size, out_size): + pass + else: + # print 'cannot encode1', hex(v), + # print hex(sign_ext(int(v&((1<<self.in_size)-1)), + # self.in_size, out_size)) + # test with rex_w + self.parent.rex_w.value = 1 + opmode = self.parent.v_opmode() + out_size = opmode + if (v != sign_ext( + int(v & ((1 << self.in_size) - 1)), + self.in_size, out_size)): + # print 'cannot encode2', hex(v), + # hex(sign_ext(int(v&((1<<self.in_size)-1)), + # self.in_size, out_size)) + return False + else: + pass + else: + pass + if v != sign_ext( + int(v & ((1 << self.in_size) - 1)), self.in_size, out_size): + # print 'cannot encode3', hex(v), + # hex(sign_ext(int(v&((1<<self.in_size)-1)), self.in_size, + # self.out_size)) + return False + v = self.encodeval(v) + self.value = (v & 0xffffffff) & self.lmask + return True + + def decodeval(self, v): + return swap_uint(self.l, v) + + def encodeval(self, v): + return swap_sint(self.l, v) + + +class x86_s08to32(x86_s08to16): + myexpr = lambda self, x: ExprInt32(x) + in_size = 8 + out_size = 32 + + def decode(self, v): + v = v & self.lmask + v = self.decodeval(v) + if self.parent.rex_w.value == 1: + v = ExprInt64(sign_ext(v, self.in_size, 64)) + else: + v = ExprInt32(sign_ext(v, self.in_size, 32)) + + self.expr = v + # print "INT1", self.parent.rex_w.value, self.expr, self.expr.size + return True + + +class x86_s08to64(x86_s08to16): + myexpr = lambda self, x: ExprInt64(x) + in_size = 8 + out_size = 64 + + def decode(self, v): + v = v & self.lmask + v = self.decodeval(v) + if self.parent.rex_w.value == 1: + v = ExprInt64(sign_ext(v, self.in_size, 64)) + else: + v = ExprInt32(sign_ext(v, self.in_size, 32)) + + self.expr = v + # print "INT1X", self.parent.prefix.rex_w, self.expr, self.expr.size + return True + + +class x86_s32to64(x86_s08to32): + myexpr = lambda self, x: ExprInt64(x) + in_size = 32 + out_size = 64 + + +class bs_eax(m_arg): + reg_info = r_eax_all + rindex = 0 + parser = reg_info.parser + + def decode(self, v): + p = self.parent + e = None + if hasattr(p, 'w8') and p.w8.value == 0: + e = regs08_expr[self.rindex] + else: + e = size2gpregs[p.v_opmode()].expr[self.rindex] + self.expr = e + return True + + def encode(self): + self.value = 0 + p = self.parent + e = self.expr + # print "EEEEE", e, p.w8.value + # print 'XXX', p.mode, p.opmode + osize = p.v_opmode() + if hasattr(p, 'w8'): + if p.w8.value is None: + # XXX TODO: priority in w8 erase? + if e.size == 8: + p.w8.value = 0 + else: + p.w8.value = 1 + if hasattr(p, 'w8') and p.w8.value == 0: + return e == regs08_expr[self.rindex] + elif p.mode in [16, 32]: + return e == size2gpregs[osize].expr[self.rindex] + elif p.mode == 64: + if e == size2gpregs[64].expr[self.rindex]: + p.rex_w.value = 1 + return True + elif e == size2gpregs[osize].expr[self.rindex]: + return True + return False + + +class bs_seg(m_arg): + reg_info = r_eax_all + rindex = 0 + parser = reg_info.parser + + def decode(self, v): + self.expr = self.reg_info.expr[0] + return True + + def encode(self): + self.value = 0 + return self.expr == self.reg_info.expr[0] + + +class bs_edx(bs_eax): + reg_info = r_edx_all + rindex = 2 + parser = reg_info.parser + + +class bs_st(bs_eax): + reg_info = r_st_all + rindex = 0 + parser = reg_info.parser + + +class bs_cs(bs_seg): + reg_info = r_cs_all + rindex = 0 + parser = reg_info.parser + + +class bs_ds(bs_seg): + reg_info = r_ds_all + rindex = 0 + parser = reg_info.parser + + +class bs_es(bs_seg): + reg_info = r_es_all + rindex = 0 + parser = reg_info.parser + + +class bs_ss(bs_seg): + reg_info = r_ss_all + rindex = 0 + parser = reg_info.parser + + +class bs_fs(bs_seg): + reg_info = r_fs_all + rindex = 0 + parser = reg_info.parser + + +class bs_gs(bs_seg): + reg_info = r_gs_all + rindex = 0 + parser = reg_info.parser + + +class x86_reg_st(reg_noarg, m_arg): + reg_info = r_st_all + parser = reg_info.parser + + +class bs_sib_scale(bs_divert): + bsname = "sib_scale" + + def divert(self, i, candidates): + out = [] + done = False + for cls, name, bases, dct, fields in candidates: + if (not (admode_prefix( + (dct['mode'], dct['opmode'], dct['admode'])) != 16 and + 'rm' in dct and dct['rm'] == 0b100 and + 'mod' in dct and dct['mod'] != 0b11)): + ndct = dict(dct) + nfields = fields[:] + nfields[i] = None + ndct[self.args['fname']] = None + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + + nfields = fields[:] + args = dict(self.args) + ndct = dict(dct) + f = bs(**args) + nfields[i] = f + ndct[self.args['fname']] = None + out.append((cls, ndct['name'], bases, ndct, nfields)) + return out + + +class bs_sib_index(bs_sib_scale): + pass + + +class bs_sib_base(bs_sib_scale): + pass + + +class bs_disp(bs_divert): + + def divert(self, i, candidates): + out = [] + done = False + for cls, name, bases, dct, fields in candidates: + ndct = dict(dct) + nfields = fields[:] + if (admode_prefix( + (dct['mode'], dct['opmode'], dct['admode'])) == 16): + if 'mod' in dct and dct['mod'] == 0b00 and \ + 'rm' in dct and dct['rm'] == 0b110: + nfields[i] = bs( + l=16, cls=(x86_16_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + elif 'mod' in dct and dct['mod'] == 0b01: + nfields[i] = bs( + l=8, cls=(x86_08_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + elif 'mod' in dct and dct['mod'] == 0b10: + nfields[i] = bs( + l=16, cls=(x86_16_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + else: + if 'mod' in dct and dct['mod'] == 0b00 and \ + 'rm' in dct and dct['rm'] == 0b101: + nfields[i] = bs( + l=32, cls=(x86_32_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + elif 'mod' in dct and dct['mod'] == 0b01: + nfields[i] = bs( + l=8, cls=(x86_08_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + elif 'mod' in dct and dct['mod'] == 0b10: + nfields[i] = bs( + l=32, cls=(x86_32_ne,), fname=self.args['fname']) + ndct[self.args['fname']] = True + out.append((cls, ndct['name'], bases, ndct, nfields)) + continue + + nfields[i] = None + ndct[self.args['fname']] = None + out.append((cls, ndct['name'], bases, ndct, nfields)) + return out + + +def getmodrm(c): + return (c >> 6) & 3, (c >> 3) & 7, c & 7 + + +def setmodrm(mod, re, rm): + return ((mod & 3) << 6) | ((re & 7) << 3) | (rm & 7) + + +def sib(c): + return modrm(c) + +db_afs_64 = [] +sib_64_s08_ebp = [] + + +def gen_modrm_form(): + global db_afs_64, sib_64_s08_ebp + ebp = 5 + + sib_s08_ebp = [{f_isad: True} for i in range(0x100)] + sib_u32_ebp = [{f_isad: True} for i in range(0x100)] + sib_u32 = [{f_isad: True} for i in range(0x100)] + + sib_u64 = [] + for rex_x in xrange(2): + o = [] + for rex_b in xrange(2): + x = [{f_isad: True} for i in range(0x100)] + o.append(x) + sib_u64.append(o) + + sib_u64_ebp = [] + for rex_x in xrange(2): + o = [] + for rex_b in xrange(2): + x = [{f_isad: True} for i in range(0x100)] + o.append(x) + sib_u64_ebp.append(o) + + sib_64_s08_ebp = [] + for rex_x in xrange(2): + o = [] + for rex_b in xrange(2): + x = [{f_isad: True} for i in range(0x100)] + o.append(x) + sib_64_s08_ebp.append(o) + + for sib_rez in [sib_s08_ebp, + sib_u32_ebp, + sib_u32, + sib_64_s08_ebp, + sib_u64_ebp, + sib_u64, + ]: + for index in range(0x100): + ss, i, b = getmodrm(index) + + if b == 0b101: + if sib_rez == sib_s08_ebp: + sib_rez[index][f_imm] = f_s08 + sib_rez[index][ebp] = 1 + elif sib_rez == sib_u32_ebp: + sib_rez[index][f_imm] = f_u32 + sib_rez[index][ebp] = 1 + elif sib_rez == sib_u32: + sib_rez[index][f_imm] = f_u32 + elif sib_rez == sib_u64_ebp: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][f_imm] = f_u32 + sib_rez[rex_x][rex_b][index][ebp + 8 * rex_b] = 1 + elif sib_rez == sib_u64: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][f_imm] = f_u32 + elif sib_rez == sib_64_s08_ebp: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][f_imm] = f_s08 + sib_rez[rex_x][rex_b][index][ebp + 8 * rex_b] = 1 + + else: + if sib_rez == sib_s08_ebp: + sib_rez[index][b] = 1 + sib_rez[index][f_imm] = f_s08 + elif sib_rez == sib_u32_ebp: + sib_rez[index][b] = 1 + sib_rez[index][f_imm] = f_u32 + elif sib_rez == sib_u32: + sib_rez[index][b] = 1 + elif sib_rez == sib_u64_ebp: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][b + 8 * rex_b] = 1 + sib_rez[rex_x][rex_b][index][f_imm] = f_u32 + elif sib_rez == sib_u64: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][b + 8 * rex_b] = 1 + elif sib_rez == sib_64_s08_ebp: + for rex_b in xrange(2): + for rex_x in xrange(2): + sib_rez[rex_x][rex_b][index][f_imm] = f_s08 + sib_rez[rex_x][rex_b][index][b + 8 * rex_b] = 1 + + if i == 0b100 and sib_rez in [sib_s08_ebp, sib_u32_ebp, sib_u32]: + continue + + if sib_rez in [sib_s08_ebp, sib_u32_ebp, sib_u32]: + tmp = i + if not tmp in sib_rez[index]: + sib_rez[index][tmp] = 0 # 1 << ss + sib_rez[index][tmp] += 1 << ss + else: + for rex_b in xrange(2): + for rex_x in xrange(2): + tmp = i + 8 * rex_x + if i == 0b100 and rex_x == 0: + continue + if not tmp in sib_rez[rex_x][rex_b][index]: + sib_rez[rex_x][rex_b][index][tmp] = 0 # 1 << ss + sib_rez[rex_x][rex_b][index][tmp] += 1 << ss + + # 32bit + db_afs_32 = [None for i in range(0x100)] + for i in range(0x100): + index = i + mod, re, rm = getmodrm(i) + + if mod == 0b00: + if rm == 0b100: + db_afs_32[index] = sib_u32 + elif rm == 0b101: + db_afs_32[index] = {f_isad: True, f_imm: f_u32} + else: + db_afs_32[index] = {f_isad: True, rm: 1} + elif mod == 0b01: + if rm == 0b100: + db_afs_32[index] = sib_s08_ebp + continue + tmp = {f_isad: True, rm: 1, f_imm: f_s08} + db_afs_32[index] = tmp + + elif mod == 0b10: + if rm == 0b100: + db_afs_32[index] = sib_u32_ebp + else: + db_afs_32[index] = {f_isad: True, rm: 1, f_imm: f_u32} + elif mod == 0b11: + db_afs_32[index] = {f_isad: False, rm: 1} + + # 64bit + db_afs_64 = [None for i in range(0x400)] + for i in range(0x400): + index = i + rex_x = (index >> 9) & 1 + rex_b = (index >> 8) & 1 + mod, re, rm = getmodrm(i & 0xff) + + if mod == 0b00: + if rm == 0b100: + db_afs_64[i] = sib_u64[rex_x][rex_b] + elif rm == 0b101: + db_afs_64[i] = {f_isad: True, f_imm: f_u32, 16: 1} + else: + db_afs_64[i] = {f_isad: True, rm + 8 * rex_b: 1} + elif mod == 0b01: + if rm == 0b100: + db_afs_64[i] = sib_64_s08_ebp[rex_x][rex_b] + continue + tmp = {f_isad: True, rm + 8 * rex_b: 1, f_imm: f_s08} + db_afs_64[i] = tmp + + elif mod == 0b10: + if rm == 0b100: + db_afs_64[i] = sib_u64_ebp[rex_x][rex_b] + else: + db_afs_64[i] = {f_isad: True, rm + 8 * rex_b: 1, f_imm: f_u32} + elif mod == 0b11: + db_afs_64[i] = {f_isad: False, rm + 8 * rex_b: 1} + + # 16bit + db_afs_16 = [None for i in range(0x100)] + _si = 6 + _di = 7 + _bx = 3 + _bp = 5 + for i in range(0x100): + index = i + mod, re, rm = getmodrm(i) + + if mod == 0b00: + if rm == 0b100: + db_afs_16[index] = {f_isad: True, _si: 1} + elif rm == 0b101: + db_afs_16[index] = {f_isad: True, _di: 1} + elif rm == 0b110: + db_afs_16[index] = { + f_isad: True, f_imm: f_u16} # {f_isad:True,_bp:1} + elif rm == 0b111: + db_afs_16[index] = {f_isad: True, _bx: 1} + else: + db_afs_16[index] = {f_isad: True, + [_si, _di][rm % 2]: 1, + [_bx, _bp][(rm >> 1) % 2]: 1} + elif mod in [0b01, 0b10]: + if mod == 0b01: + my_imm = f_s08 + else: + my_imm = f_u16 + + if rm == 0b100: + db_afs_16[index] = {f_isad: True, _si: 1, f_imm: my_imm} + elif rm == 0b101: + db_afs_16[index] = {f_isad: True, _di: 1, f_imm: my_imm} + elif rm == 0b110: + db_afs_16[index] = {f_isad: True, _bp: 1, f_imm: my_imm} + elif rm == 0b111: + db_afs_16[index] = {f_isad: True, _bx: 1, f_imm: my_imm} + else: + db_afs_16[index] = {f_isad: True, + [_si, _di][rm % 2]: 1, + [_bx, _bp][(rm >> 1) % 2]: 1, + f_imm: my_imm} + + elif mod == 0b11: + db_afs_16[index] = {f_isad: False, rm: 1} + + byte2modrm = {} + byte2modrm[16] = db_afs_16 + byte2modrm[32] = db_afs_32 + byte2modrm[64] = db_afs_64 + + modrm2byte = {16: defaultdict(list), + 32: defaultdict(list), + 64: defaultdict(list), + } + for size, db_afs in byte2modrm.items(): + for i, modrm in enumerate(db_afs): + if not isinstance(modrm, list): + modrm = modrm.items() + modrm.sort() + modrm = tuple(modrm) + modrm2byte[size][modrm].append(i) + continue + for j, modrm_f in enumerate(modrm): + modrm_f = modrm_f.items() + modrm_f.sort() + modrm_f = tuple(modrm_f) + modrm2byte[size][modrm_f].append((i, j)) + + return byte2modrm, modrm2byte + +byte2modrm, modrm2byte = gen_modrm_form() + + +# ret is modr; ret is displacement +def exprfindmod(e, o=None): + if o is None: + o = {} + if isinstance(e, ExprInt): + return e + if isinstance(e, ExprId): + i = size2gpregs[e.size].expr.index(e) + o[i] = 1 + return None + elif isinstance(e, ExprOp): + out = None + if e.op == '+': + for a in e.args: + r = exprfindmod(a, o) + if out and r1: + raise ValueError('multiple displacement!') + out = r + return out + elif e.op == "*": + mul = int(e.args[1].arg) + a = e.args[0] + i = size2gpregs[a.size].expr.index(a) + o[i] = mul + else: + raise ValueError('bad op') + return None + + +def expr2modrm(e, p, w8, sx=0, xmm=0, mm=0): + o = defaultdict(lambda x: 0) + if e.size == 64 and not e in gpregs_mm.expr: + if hasattr(p, 'sd'): + p.sd.value = 1 + # print 'set64pref', str(e) + elif hasattr(p, 'wd'): + pass + elif hasattr(p, 'stk'): + pass + else: + p.rex_w.value = 1 + opmode = p.v_opmode() + if sx == 1: + opmode = 16 + if sx == 2: + opmode = 32 + if e.size == 8 and w8 != 0: + return None, None, False + + if w8 == 0 and e.size != 8: + return None, None, False + + if not isinstance(e, ExprMem): + o[f_isad] = False + if xmm: + if e in gpregs_xmm.expr: + i = gpregs_xmm.expr.index(e) + o[i] = 1 + return [o], None, True + else: + return None, None, False + if mm: + if e in gpregs_mm.expr: + i = gpregs_mm.expr.index(e) + o[i] = 1 + return [o], None, True + else: + return None, None, False + if w8 == 0: + # if (p.v_opmode() == 64 or p.rex_p.value == 1) and e in + # gpregs08_64.expr: + if p.mode == 64 and e in gpregs08_64.expr: + r = gpregs08_64 + p.rex_p.value = 1 + else: + p.rex_p.value = 0 + p.rex_x.value = 0 + r = size2gpregs[8] + if not e in r.expr: + return None, None, False + i = r.expr.index(e) + o[i] = 1 + return [o], None, True + # print "ttt", opmode, e.size + if opmode != e.size: + # print "FFFF" + return None, None, False + if not e in size2gpregs[opmode].expr: + return None, None, False + i = size2gpregs[opmode].expr.index(e) + # print 'aaa', p.mode, i + if i > 7: + if p.mode == 64: + # p.rex_b.value = 1 + # i -=7 + # print "SET REXB" + pass + else: + return None, None, False + o[i] = 1 + return [o], None, True + if e.is_op_segm() and isinstance(e.arg.args[0], ExprInt): + return None, None, False + + if e.is_op_segm(): + segm = e.arg.args[0] + ptr = e.arg.args[1] + else: + segm = None + ptr = e.arg + + o[f_isad] = True + ad_size = ptr.size + admode = p.v_admode() + if ad_size != admode: + return None, None, False + """ + if e.size == 64: + if hasattr(p, 'sd'): + p.sd.value = 1 + else: + p.rex_w.value = 1 + """ + + if w8 == 1 and e.size != opmode: # p.v_opmode(): + if not (hasattr(p, 'sd') or hasattr(p, 'wd')): + return None, None, False + # print 'tttt' + + if hasattr(p, 'wd'): + s = e.size + if s == 16: + p.wd.value = 1 + elif s == 32: + pass + else: + return None, None, False + + if p.mode == 64 and ptr.size == 32: + if p.admode != 1: + return None, None, False + + o = {f_isad: True} + disp = exprfindmod(ptr, o) + out = [] + if disp is None: + # add 0 disp + disp = ExprInt32(0) + if disp is not None: + for s, x in [(f_s08, ExprInt8), (f_s16, ExprInt16), (f_s32, ExprInt32), + (f_u08, ExprInt8), (f_u16, ExprInt16), (f_u32, ExprInt32)]: + # print "1", disp + v = x(int(disp.arg)) + # print "2", v, hex(sign_ext(int(v.arg), v.size, disp.size)) + if int(disp.arg) != sign_ext(int(v.arg), v.size, disp.size): + # print 'nok' + continue + # print 'ok', s, v + x1 = dict(o) + x1[f_imm] = (s, v) + out.append(x1) + else: + out = [o] + return out, segm, True + + +def modrm2expr(m, p, w8, sx=0, xmm=0, mm=0): + o = [] + if not m[f_isad]: + k = [x[0] for x in m.items() if x[1] == 1] + if len(k) != 1: + raise ValueError('strange reg encoding %r' % m) + k = k[0] + if w8 == 0: + opmode = 8 + elif sx == 1: + opmode = 16 + elif sx == 2: + opmode = 32 + else: + opmode = p.v_opmode() + """ + if k > 7: + # XXX HACK TODO + e = size2gpregs[64].expr[k] + else: + e = size2gpregs[opmode].expr[k] + """ + # print 'yyy', opmode, k + if xmm: + e = gpregs_xmm.expr[k] + elif mm: + e = gpregs_mm.expr[k] + elif opmode == 8 and (p.v_opmode() == 64 or p.rex_p.value == 1): + e = gpregs08_64.expr[k] + else: + e = size2gpregs[opmode].expr[k] + return e + # print "enc", m, p.v_admode(), p.prefix.opmode, p.prefix.admode + admode = p.v_admode() + opmode = p.v_opmode() + for k, v in m.items(): + if type(k) in [int, long]: + e = size2gpregs[admode].expr[k] + if v != 1: + e = ExprInt_fromsize(admode, v) * e + o.append(e) + # print [str(x) for x in o] + if f_imm in m: + if p.disp.value is None: + return None + o.append(ExprInt_fromsize(admode, p.disp.expr.arg)) + e = ExprOp('+', *o) + if w8 == 0: + opmode = 8 + elif sx == 1: + opmode = 16 + elif sx == 2: + opmode = 32 + e = ExprMem(e, size=opmode) + # print "mem size", opmode, e + return e + + +class x86_rm_arg(m_arg): + parser = rmarg + + def fromstring(self, s, parser_result=None): + start, stop = super(x86_rm_arg, self).fromstring(s, parser_result) + e = self.expr + p = self.parent + if start is None: + return None, None + s = e.size + return start, stop + + @staticmethod + def arg2str(e): + if isinstance(e, ExprId): + o = str(e) + elif isinstance(e, ExprMem): + sz = {8: 'BYTE', 16: 'WORD', 32: 'DWORD', + 64: 'QWORD', 80: 'TBYTE'}[e.size] + segm = "" + if e.is_op_segm(): + segm = "%s:" % e.arg.args[0] + e = e.arg.args[1] + else: + e = e.arg + if isinstance(e, ExprOp): + # s = str(e.arg)[1:-1] + s = str(e).replace('(', '').replace(')', '') + else: + s = str(e) + o = sz + ' PTR %s[%s]' % (segm, s) + else: + raise ValueError('check this %r' % e) + return "%s" % o + + def get_modrm(self): + p = self.parent + admode = p.v_admode() + + if not admode in [16, 32, 64]: + raise ValueError('strange admode %r', admode) + v = setmodrm(p.mod.value, 0, p.rm.value) + v |= p.rex_b.value << 8 + v |= p.rex_x.value << 9 + if p.mode == 64: + # XXXx to check + admode = 64 + + xx = byte2modrm[admode][v] + if isinstance(xx, list): + if not p.sib_scale: + return False + v = setmodrm(p.sib_scale.value, + p.sib_index.value, + p.sib_base.value) + # print 'SIB', hex(v) + # v |= p.rex_b.value << 8 + # v |= p.rex_x.value << 9 + # if v >= 0x100: + # pass + xx = xx[v] + return xx + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + mm = hasattr(self.parent, "mm") + xmm = hasattr(self.parent, "xmm") + e = modrm2expr(xx, p, 1, xmm=xmm, mm=mm) + if e is None: + return False + self.expr = e + return True + + def gen_cand(self, v_cand, admode): + # print "GEN CAND" + if not admode in modrm2byte: + # XXX TODO: 64bit + raise StopIteration + if not v_cand: + raise StopIteration + + p = self.parent + o_rex_x = p.rex_x.value + o_rex_b = p.rex_b.value + # add candidate without 0 imm + new_v_cand = [] + moddd = False + for v in v_cand: + new_v_cand.append(v) + # print 'CANDI', v, admode + if f_imm in v and int(v[f_imm][1].arg) == 0: + v = dict(v) + del(v[f_imm]) + new_v_cand.append(v) + moddd = True + + v_cand = new_v_cand + + out_c = [] + for v in v_cand: + disp = None + # patch value in modrm + if f_imm in v: + size, disp = v[f_imm] + disp = int(disp.arg) + # disp = swap_uint(f_imm2size[size], int(disp)) + + v[f_imm] = size + vo = v + # print 'vv', v, disp + v = v.items() + v.sort() + v = tuple(v) + # print "II", e, admode + # print 'III', v + # if (8, 1) in v: + # pass + if not v in modrm2byte[admode]: + # print 'cannot find' + continue + # print "FOUND1", v + xx = modrm2byte[admode][v] + # if opmode == 64 and admode == 64: + # pdb.set_trace() + + # print "FOUND2", xx + # default case + for x in xx: + if type(x) == tuple: + modrm, sib = x + else: + modrm = x + sib = None + # print 'mod sib', hex(modrm), sib + # print p.sib_scale + # print p.sib_base + # print p.sib_index + + # 16 bit cannot have sib + if (not sib is None) and admode == 16: + continue + # if ((p.sib_scale and sib is None) or + # (p.sib_scale is None and sib)): + # log.debug('dif sib %r %r'%(p.sib_scale, sib)) + # continue + # print hex(modrm), sib + # p.mod.value, dum, p.rm.value = getmodrm(modrm) + rex = modrm >> 8 # 0# XXX HACK REM temporary REX modrm>>8 + if rex and admode != 64: + continue + # print 'prefix', hex(rex) + # p.rex_x.value = o_rex_x + # p.rex_b.value = o_rex_b + + p.rex_x.value = (rex >> 1) & 1 + p.rex_b.value = rex & 1 + + if o_rex_x is not None and p.rex_x.value != o_rex_x: + continue + if o_rex_b is not None and p.rex_b.value != o_rex_b: + continue + + mod, re, rm = getmodrm(modrm) + # check re on parent + if re != p.reg.value: + continue + # p.mod.value.append(mod) + # p.rm.value.append(rm) + + if sib: + # print 'REX', p.rex_x.value, p.rex_b.value + # print hex(modrm), hex(sib) + # if (modrm & 0xFF == 4 and sib & 0xFF == 0x5 + # and p.rex_b.value ==1 and p.rex_x.value == 0): + # pass + s_scale, s_index, s_base = getmodrm(sib) + # p.sib_scale.value, p.sib_index.value, + # p.sib_base.value = getmodrm(sib) + # p.sib_scale.decode(mod) + # p.sib_index.decode(re) + # p.sib_base.decode(rm) + # p.sib_scale.value.append(mod) + # p.sib_index.value.append(re) + # p.sib_base.value.append(rm) + else: + # p.sib_scale.value.append(None) + # p.sib_index.value.append(None) + # p.sib_base.value.append(None) + s_scale, s_index, s_base = None, None, None + + # print 'IIII', repr(p.disp), f_imm in v + # if p.disp and not f_imm in vo: + # continue + # if not p.disp and f_imm in vo: + # continue + # if p.disp: + # if p.disp.l != f_imm2size[vo[f_imm]]: + # continue + # print "DISP", repr(p.disp), p.disp.l + # p.disp.value = int(disp.arg) + # print 'append' + # print mod, rm, s_scale, s_index, s_base, disp + # print p.mod, p.rm + # out_c.append((mod, rm, s_scale, s_index, s_base, disp)) + p.mod.value = mod + p.rm.value = rm + p.sib_scale.value = s_scale + p.sib_index.value = s_index + p.sib_base.value = s_base + p.disp.value = disp + if disp is not None: + p.disp.l = f_imm2size[vo[f_imm]] + + yield True + + raise StopIteration + + def encode(self): + e = self.expr + # print "eee", e + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + admode = p.v_admode() + mode = e.size + mm = hasattr(self.parent, 'mm') + xmm = hasattr(self.parent, 'xmm') + v_cand, segm, ok = expr2modrm(e, p, 1, xmm=xmm, mm=mm) + if segm: + p.g2.value = segm2enc[segm] + # print "REZ1", v_cand, ok + for x in self.gen_cand(v_cand, admode): + yield x + + +class x86_rm_w8(x86_rm_arg): + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, p.w8.value) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + if p.w8.value is None: + if e.size == 8: + p.w8.value = 0 + else: + p.w8.value = 1 + + # print 'TTTTT', e + v_cand, segm, ok = expr2modrm(e, p, p.w8.value) + if segm: + p.g2.value = segm2enc[segm] + # print "REZ2", v_cand, ok + for x in self.gen_cand(v_cand, p.v_admode()): + # print 'REZ', p.rex_x.value + yield x + + +class x86_rm_sx(x86_rm_arg): + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, p.w8.value, 1) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + if p.w8.value is None: + if e.size == 8: + p.w8.value = 0 + else: + p.w8.value = 1 + v_cand, segm, ok = expr2modrm(e, p, p.w8.value, 1) + if segm: + p.g2.value = segm2enc[segm] + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_sxd(x86_rm_arg): + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, 1, 2) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + v_cand, segm, ok = expr2modrm(e, p, 1, 2) + if segm: + p.g2.value = segm2enc[segm] + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_sd(x86_rm_arg): + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, 1) + if not isinstance(e, ExprMem): + return False + if p.sd.value == 0: + e = ExprMem(e.arg, 32) + else: + e = ExprMem(e.arg, 64) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + if not e.size in [32, 64]: + raise StopIteration + p.sd.value = 0 + v_cand, segm, ok = expr2modrm(e, p, 1) + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_wd(x86_rm_arg): + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, 1) + if not isinstance(e, ExprMem): + return False + if p.wd.value == 0: + e = ExprMem(e.arg, 32) + else: + e = ExprMem(e.arg, 16) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + p = self.parent + p.wd.value = 0 + v_cand, segm, ok = expr2modrm(e, p, 1) + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_m80(x86_rm_arg): + msize = 80 + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + # print "aaa", xx + e = modrm2expr(xx, p, 1) + if not isinstance(e, ExprMem): + return False + e = ExprMem(e.arg, self.msize) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if isinstance(e, ExprInt): + raise StopIteration + if not isinstance(e, ExprMem) or e.size != self.msize: + raise StopIteration + p = self.parent + mode = p.mode + if mode == 64: + mode = 32 + e = ExprMem(e.arg, mode) + v_cand, segm, ok = expr2modrm(e, p, 1) + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_m08(x86_rm_arg): + msize = 8 + + def decode(self, v): + p = self.parent + xx = self.get_modrm() + e = modrm2expr(xx, p, 0) + self.expr = e + return e is not None + + def encode(self): + e = self.expr + if e.size != 8: + raise StopIteration + """ + if not isinstance(e, ExprMem) or e.size != self.msize: + raise StopIteration + """ + p = self.parent + mode = p.mode + # if mode == 64: + # mode = 32 + # e = ExprMem(e.arg, mode) + v_cand, segm, ok = expr2modrm(e, p, 0) + for x in self.gen_cand(v_cand, p.v_admode()): + yield x + + +class x86_rm_m16(x86_rm_m80): + msize = 16 + + +class x86_rm_m64(x86_rm_m80): + msize = 64 + + +class x86_rm_reg_noarg(object): + prio = default_prio + 1 + + parser = gpreg + + def fromstring(self, s, parser_result=None): + # print 'parsing reg', s, opmode + if not hasattr(self.parent, 'sx') and hasattr(self.parent, "w8"): + self.parent.w8.value = 1 + if parser_result: + e, start, stop = parser_result[self.parser] + # print 'reg result', e, start, stop + if e is None: + return None, None + self.expr = e + if self.expr.size == 8: + if hasattr(self.parent, 'sx') or not hasattr(self.parent, 'w8'): + return None, None + self.parent.w8.value = 0 + return start, stop + try: + v, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + self.expr = v[0] + if self.expr.size == 0: + if hasattr(self.parent, 'sx') or not hasattr(self.parent, 'w8'): + return None, None + self.parent.w8.value = 0 + + # print 'parsed', s, self.expr + return start, stop + + def getrexsize(self): + return self.parent.rex_r.value + + def setrexsize(self, v): + self.parent.rex_r.value = v + + def decode(self, v): + v = v & self.lmask + p = self.parent + opmode = p.v_opmode() + # if hasattr(p, 'sx'): + # opmode = 16 + if not hasattr(p, 'sx') and (hasattr(p, 'w8') and p.w8.value == 0): + opmode = 8 + r = size2gpregs[opmode] + if p.mode == 64 and self.getrexsize(): + v |= 0x8 + # print "XXX", p.v_opmode(), p.rex_p.value + if p.v_opmode() == 64 or p.rex_p.value == 1: + if not hasattr(p, 'sx') and (hasattr(p, 'w8') and p.w8.value == 0): + # if (hasattr(p, 'w8') and p.w8.value == 0): + r = gpregs08_64 + """ + if v < 8: + self.expr = r.expr[v] + else: + self.expr = size2gpregs[64].expr[v] + """ + if hasattr(p, "xmm") or hasattr(p, "xmmreg"): + e = gpregs_xmm.expr[v] + elif hasattr(p, "mm") or hasattr(p, "mmreg"): + e = gpregs_mm.expr[v] + else: + e = r.expr[v] + self.expr = e + return True + + def encode(self): + if not isinstance(self.expr, ExprId): + return False + if self.expr in gpregs64.expr and not hasattr(self.parent, 'stk'): + self.parent.rex_w.value = 1 + # print self.parent.opmode + # fd + opmode = self.parent.v_opmode() + # if hasattr(self.parent, 'sx'): + # opmode = 16 + # print 'reg encode', self.expr, opmode + if not hasattr(self.parent, 'sx') and hasattr(self.parent, 'w8'): + self.parent.w8.value = 1 + if self.expr.size == 8: + if hasattr(self.parent, 'sx') or not hasattr(self.parent, 'w8'): + return False + self.parent.w8.value = 0 + opmode = 8 + r = size2gpregs[opmode] + # print "YYY", opmode, self.expr + if ((hasattr(self.parent, 'xmm') or hasattr(self.parent, 'xmmreg')) + and self.expr in gpregs_xmm.expr): + i = gpregs_xmm.expr.index(self.expr) + elif ((hasattr(self.parent, 'mm') or hasattr(self.parent, 'mmreg')) + and self.expr in gpregs_mm.expr): + i = gpregs_mm.expr.index(self.expr) + elif self.expr in r.expr: + i = r.expr.index(self.expr) + elif (opmode == 8 and self.parent.mode == 64 and + self.expr in gpregs08_64.expr): + i = gpregs08_64.expr.index(self.expr) + self.parent.rex_p.value = 1 + else: + log.debug("cannot encode reg %r" % self.expr) + return False + # print "zzz", opmode, self.expr, i, self.parent.mode + if self.parent.v_opmode() == 64: + if i > 7: + self.setrexsize(1) + i -= 8 + elif self.parent.mode == 64 and i > 7: + i -= 8 + # print 'rrr', self.getrexsize() + # self.parent.rex_b.value = 1 + self.setrexsize(1) + if hasattr(self.parent, 'xmm') or hasattr(self.parent, 'mm'): + if i > 7: + i -= 8 + self.value = i + if self.value > self.lmask: + log.debug("cannot encode field value %x %x" % + (self.value, self.lmask)) + return False + # print 'RR ok' + return True + + +class x86_rm_reg(x86_rm_reg_noarg, m_arg): + pass + + +class x86_reg(x86_rm_reg): + + def getrexsize(self): + return self.parent.rex_b.value + + def setrexsize(self, v): + self.parent.rex_b.value = v + + +class x86_reg_noarg(x86_rm_reg_noarg): + + def getrexsize(self): + return self.parent.rex_b.value + + def setrexsize(self, v): + self.parent.rex_b.value = v + + +class x86_rm_segm(reg_noarg, m_arg): + prio = default_prio + 1 + reg_info = segmreg + parser = reg_info.parser + + +class x86_rm_cr(reg_noarg, m_arg): + prio = default_prio + 1 + reg_info = crregs + parser = reg_info.parser + + +class x86_rm_dr(reg_noarg, m_arg): + prio = default_prio + 1 + reg_info = drregs + parser = reg_info.parser + + +class x86_rm_flt(reg_noarg, m_arg): + prio = default_prio + 1 + reg_info = fltregs + parser = reg_info.parser + + +class bs_fbit(bsi): + + def decode(self, v): + # value already decoded in pre_dis_info + # print "jj", self.value + return True + + +class bs_cl1(bsi, m_arg): + parser = cl_or_imm + + def decode(self, v): + if v == 1: + self.expr = regs08_expr[1] + else: + self.expr = ExprInt8(1) + return True + + def encode(self): + if self.expr == regs08_expr[1]: + self.value = 1 + elif isinstance(self.expr, ExprInt) and int(self.expr.arg) == 1: + self.value = 0 + else: + return False + return True + + +def sib_cond(cls, mode, v): + if admode_prefix((mode, v["opmode"], v["admode"])) == 16: + return None + if v['mod'] == 0b11: + return None + elif v['rm'] == 0b100: + return cls.ll + else: + return None + return v['rm'] == 0b100 + + +class bs_cond_scale(bs_cond): + # cond must return field len + ll = 2 + + @classmethod + def flen(cls, mode, v): + return sib_cond(cls, mode, v) + + def encode(self): + if self.value is None: + self.value = 0 + self.l = 0 + return True + return super(bs_cond, self).encode() + + def decode(self, v): + self.value = v + return True + + +class bs_cond_index(bs_cond_scale): + ll = 3 + + @classmethod + def flen(cls, mode, v): + return sib_cond(cls, mode, v) + + +class bs_cond_disp(bs_cond): + # cond must return field len + + @classmethod + def flen(cls, mode, v): + # print 'disp cond', mode, + # print v, v_admode_info(mode, v['opmode'], v['admode']) + # if v_admode_info(mode, v['opmode'], v['admode']) ==16: + if admode_prefix((mode, v['opmode'], v['admode'])) == 16: + if v['mod'] == 0b00: + if v['rm'] == 0b110: + return 16 + else: + return None + elif v['mod'] == 0b01: + return 8 + elif v['mod'] == 0b10: + return 16 + return None + # 32, 64 + if 'sib_base' in v and v['sib_base'] == 0b101: + if v['mod'] == 0b00: + return 32 + elif v['mod'] == 0b01: + return 8 + elif v['mod'] == 0b10: + return 32 + else: + return None + + if v['mod'] == 0b00: + if v['rm'] == 0b101: + return 32 + else: + return None + elif v['mod'] == 0b01: + return 8 + elif v['mod'] == 0b10: + return 32 + else: + return None + + def encode(self): + if self.value is None: + self.value = 0 + self.l = 0 + return True + self.value = swap_uint(self.l, self.value) + return True + + def decode(self, v): + admode = self.parent.v_admode() + v = swap_uint(self.l, v) + self.value = v + v = sign_ext(v, self.l, admode) + v = ExprInt_fromsize(admode, v) + self.expr = v + return True + + +class bs_cond_imm(bs_cond_scale, m_arg): + parser = int_or_expr + max_size = 32 + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + else: + try: + e, start, stop = self.parser.scanString(s).next() + except StopIteration: + e = None + self.expr = e + + if len(self.parent.args) > 1: + l = self.parent.args[0].expr.size + else: + l = self.parent.v_opmode() + # l = min(l, self.max_size) + # l = offsize(self.parent) + if isinstance(self.expr, ExprInt): + v = int(self.expr.arg) + mask = ((1 << l) - 1) + v = v & mask + e = ExprInt_fromsize(l, v) + self.expr = e + + if self.expr is None: + log.debug('cannot fromstring int %r' % s) + return None, None + return start, stop + + @classmethod + def flen(cls, mode, v): + if 'w8' not in v or v['w8'] == 1: + if 'se' in v and v['se'] == 1: + return 8 + else: + # osize = v_opmode_info(mode, v['opmode'], v['admode']) + # osize = opmode_prefix((mode, v['opmode'], v['admode'])) + osize = v_opmode_info(mode, v['opmode'], v['rex_w'], 0) + osize = min(osize, cls.max_size) + return osize + return 8 + + def getmaxlen(self): + return 32 + + def encode(self): + if not isinstance(self.expr, ExprInt): + raise StopIteration + arg0_expr = self.parent.args[0].expr + self.parent.rex_w.value = 0 + # special case for push + if len(self.parent.args) == 1: + v = int(self.expr.arg) + l = self.parent.v_opmode() + l = min(l, self.max_size) + + self.l = l + mask = ((1 << self.l) - 1) + # print 'ext', self.l, l, hex(v), hex(sign_ext(v & ((1<<self.l)-1), + # self.l, l)) + if v != sign_ext(v & mask, self.l, l): + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + # print hex(self.value) + yield True + raise StopIteration + + # assume 2 args; use first arg to guess op size + if arg0_expr.size == 64: + self.parent.rex_w.value = 1 + + l = self.parent.v_opmode() # self.parent.args[0].expr.size + # print 'imm enc', l, self.parent.rex_w.value + v = int(self.expr.arg) + # print "imms size", l, hex(v), arg0_expr.size + if arg0_expr.size == 8: + if not hasattr(self.parent, 'w8'): + raise StopIteration + self.parent.w8.value = 0 + l = 8 + if hasattr(self.parent, 'se'): + self.parent.se.value = 0 + elif hasattr(self.parent, 'se'): + if hasattr(self.parent, 'w8'): + self.parent.w8.value = 1 + # print 'test', 8, hex(v), + # print hex(sign_ext(v & 0xFF, 8, arg0_expr.size)) + # try to generate signed extended version + if v == sign_ext(v & 0xFF, 8, arg0_expr.size): + # print 'setse' + self.parent.se.value = 1 + self.l = 8 + self.value = v & 0xFF + yield True + self.parent.se.value = 0 + else: + if hasattr(self.parent, 'w8'): + self.parent.w8.value = 1 + if l == 64: + self.l = self.getmaxlen() + else: + self.l = l + # l = min(l, self.max_size) + + mask = ((1 << self.l) - 1) + # print 'ext', self.l, l, hex(v), hex(sign_ext(v & ((1<<self.l)-1), + # self.l, l)) + if v != sign_ext(v & mask, self.l, l): + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + # print hex(self.value) + yield True + + def decode(self, v): + opmode = self.parent.v_opmode() + v = swap_uint(self.l, v) + self.value = v + l_out = opmode + if hasattr(self.parent, 'w8') and self.parent.w8.value == 0: + l_out = 8 + v = sign_ext(v, self.l, l_out) + v = ExprInt_fromsize(l_out, v) + self.expr = v + # print self.expr, repr(self.expr) + return True + + +class bs_cond_imm64(bs_cond_imm): + max_size = 64 + + def getmaxlen(self): + return 64 + + @classmethod + def flen(cls, mode, v): + if 'w8' not in v or v['w8'] == 1: + if 'se' in v and v['se'] == 1: + return 8 + else: + osize = v_opmode_info(mode, v['opmode'], v['rex_w'], 0) + return osize + else: + return 8 + + +class bs_rel_off(bs_cond_imm): # m_arg): + parser = int_or_expr + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + else: + try: + e, start, stop = self.parser.scanString(s).next() + except StopIteration: + e = None + self.expr = e + l = self.parent.mode + if isinstance(self.expr, ExprInt): + v = int(self.expr.arg) + mask = ((1 << l) - 1) + v = v & mask + e = ExprInt_fromsize(l, v) + self.expr = e + return start, stop + + @classmethod + def flen(cls, mode, v): + osize = v_opmode_info(mode, v['opmode'], v['rex_w'], 0) + if osize == 16: + return 16 + else: + return 32 + + def encode(self): + if not isinstance(self.expr, ExprInt): + raise StopIteration + arg0_expr = self.parent.args[0].expr + if self.l != 0: + l = self.l + else: + l = self.parent.v_opmode() # self.parent.args[0].expr.size + self.l = l + # if l == 16: + # self.l = 16 + # else: + # self.l = 32 + l = offsize(self.parent) + + # l = self.parent.v_opmode()#self.parent.args[0].expr.size + # print 'imm enc', l, self.parent.rex_w.value + v = int(self.expr.arg) + mask = ((1 << self.l) - 1) + # print 'ext', self.l, l, hex(v), hex(sign_ext(v & ((1<<self.l)-1), + # self.l, l)) + if self.l > l: + raise StopIteration + if v != sign_ext(v & mask, self.l, l): + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + # print hex(self.value) + yield True + + def decode(self, v): + v = swap_uint(self.l, v) + size = offsize(self.parent) + v = sign_ext(v, self.l, size) + v = ExprInt_fromsize(size, v) + self.expr = v + # print self.expr, repr(self.expr) + return True + + +class bs_rel_off08(bs_rel_off): + + @classmethod + def flen(cls, mode, v): + return 8 + + +class bs_moff(bsi): + + @classmethod + def flen(cls, mode, v): + osize = v_opmode_info(mode, v['opmode'], v['rex_w'], 0) + if osize == 16: + return 16 + else: + return 32 + + def encode(self): + if not hasattr(self.parent, "mseg"): + raise StopIteration + m = self.parent.mseg.expr + if (not (isinstance(m, ExprMem) and m.is_op_segm() and + isinstance(m.arg.args[0], ExprInt))): + raise StopIteration + l = self.parent.v_opmode() # self.parent.args[0].expr.size + if l == 16: + self.l = 16 + else: + self.l = 32 + # print 'imm enc', l, self.parent.rex_w.value + v = int(m.arg.args[1].arg) + mask = ((1 << self.l) - 1) + # print 'ext', self.l, l, hex(v), hex(sign_ext(v & ((1<<self.l)-1), + # self.l, l)) + if v != sign_ext(v & mask, self.l, l): + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + # print hex(self.value) + yield True + + def decode(self, v): + opmode = self.parent.v_opmode() + if opmode == 64: + return False + v = swap_uint(self.l, v) + self.value = v + v = sign_ext(v, self.l, opmode) + v = ExprInt_fromsize(opmode, v) + self.expr = v + # print self.expr, repr(self.expr) + return True + + +class bs_movoff(m_arg): + parser = deref_mem + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + if e is None: + return None, None + # print 'fromstring', hex(e), self.int2expr + if not isinstance(e, ExprMem): + return None, None + self.expr = e + if self.expr is None: + return None, None + return start, stop + try: + v, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + if not isinstance(e, ExprMem): + return None, None + e = v[0] + if e is None: + log.debug('cannot fromstring int %r' % s) + return None, None + self.expr = e + return start, stop + + @classmethod + def flen(cls, mode, v): + if mode == 64: + if v['admode']: + return 32 + else: + return 64 + asize = v_admode_info(mode, v['admode']) + return asize + + def encode(self): + e = self.expr + p = self.parent + if not isinstance(e, ExprMem) or not isinstance(e.arg, ExprInt): + raise StopIteration + self.l = p.v_admode() + # print 'imm enc', l, self.parent.rex_w.value + v = int(e.arg.arg) + mask = ((1 << self.l) - 1) + if v != mask & v: + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + yield True + + def decode(self, v): + if self.parent.mode == 64: + if self.parent.admode == 1: + l = 32 + else: + l = 64 + else: + l = self.parent.v_admode() + v = swap_uint(self.l, v) + self.value = v + v = sign_ext(v, self.l, l) + v = ExprInt_fromsize(l, v) + size = self.parent.v_opmode() + if self.parent.w8.value == 0: + size = 8 + self.expr = ExprMem(v, size) + # print self.expr, repr(self.expr) + return True + + @staticmethod + def arg2str(e): + sz = {8: 'BYTE', 16: 'WORD', 32: 'DWORD', 64: 'QWORD', 80: 'TBYTE'} + o = sz[e.size] + ' PTR [%s]' % e.arg + return "%s" % o + + +class bs_msegoff(m_arg): + parser = deref_ptr + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + if e is None: + return None, None + self.expr = e + if self.expr is None: + return None, None + return start, stop + try: + v, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + e = v[0] + if e is None: + log.debug('cannot fromstring int %r' % s) + return None, None + self.expr = e + return start, stop + + def encode(self): + if not (isinstance(self.expr, ExprMem) and self.expr.is_op_segm()): + raise StopIteration + if not isinstance(self.expr.arg.args[0], ExprInt): + raise StopIteration + if not isinstance(self.expr.arg.args[1], ExprInt): + raise StopIteration + l = self.parent.v_opmode() # self.parent.args[0].expr.size + # print 'imm enc', l, self.parent.rex_w.value + v = int(self.expr.arg.args[0].arg) + mask = ((1 << self.l) - 1) + # print 'ext', self.l, l, hex(v), hex(sign_ext(v & ((1<<self.l)-1), + # self.l, l)) + if v != sign_ext(v & mask, self.l, l): + raise StopIteration + self.value = swap_uint(self.l, v & ((1 << self.l) - 1)) + yield True + + def decode(self, v): + opmode = self.parent.v_opmode() + v = swap_uint(self.l, v) + self.value = v + v = sign_ext(v, self.l, opmode) + v = ExprInt_fromsize(opmode, v) + e = ExprMem(ExprOp('segm', v, self.parent.off.expr)) + self.expr = e + # print self.expr, repr(self.expr) + return True + + @staticmethod + def arg2str(e): + return "%s:%s" % (e.arg.args[0], e.arg.args[1]) + + +d_rex_p = bs(l=0, cls=(bs_fbit,), fname="rex_p") +d_rex_w = bs(l=0, cls=(bs_fbit,), fname="rex_w") +d_rex_r = bs(l=0, cls=(bs_fbit,), fname="rex_r") +d_rex_x = bs(l=0, cls=(bs_fbit,), fname="rex_x") +d_rex_b = bs(l=0, cls=(bs_fbit,), fname="rex_b") + +d_g1 = bs(l=0, cls=(bs_fbit,), fname="g1") +d_g2 = bs(l=0, cls=(bs_fbit,), fname="g2") + + +d_cl1 = bs(l=1, cls=(bs_cl1,), fname="cl1") + + +w8 = bs(l=1, fname="w8") +se = bs(l=1, fname="se") + +sx = bs(l=0, fname="sx") +sxd = bs(l=0, fname="sx") + + +xmm = bs(l=0, fname="xmm") +mm = bs(l=0, fname="mm") +xmmreg = bs(l=0, fname="xmmreg") +mmreg = bs(l=0, fname="mmreg") + +pref_f2 = bs(l=0, fname="prefixed", default="\xf2") +pref_f3 = bs(l=0, fname="prefixed", default="\xf3") +pref_66 = bs(l=0, fname="prefixed", default="\x66") +no_xmm_pref = bs(l=0, fname="no_xmm_pref") + +sib_scale = bs(l=2, cls=(bs_cond_scale,), fname = "sib_scale") +sib_index = bs(l=3, cls=(bs_cond_index,), fname = "sib_index") +sib_base = bs(l=3, cls=(bs_cond_index,), fname = "sib_base") + +disp = bs(l=0, cls=(bs_cond_disp,), fname = "disp") + + +u08 = bs(l=8, cls=(x86_08, m_arg)) +u07 = bs(l=7, cls=(x86_08, m_arg)) +u16 = bs(l=16, cls=(x86_16, m_arg)) +u32 = bs(l=32, cls=(x86_32, m_arg)) +s3264 = bs(l=32, cls=(x86_s32to64, m_arg)) + +u08_3 = bs(l=0, cls=(x86_imm_fix, m_arg), ival = 3) + +d0 = bs("000", fname='reg') +d1 = bs("001", fname='reg') +d2 = bs("010", fname='reg') +d3 = bs("011", fname='reg') +d4 = bs("100", fname='reg') +d5 = bs("101", fname='reg') +d6 = bs("110", fname='reg') +d7 = bs("111", fname='reg') + +sd = bs(l=1, fname="sd") +wd = bs(l=1, fname="wd") + +stk = bs(l=0, fname="stk") + + +class field_size: + prio = default_prio + + def __init__(self, d=None): + if d is None: + d = {} + self.d = d + + def get(self, opm, adm=None): + return self.d[opm] + +d_imm64 = bs(l=0, fname="imm64") + +# d_eax = bs_eax(l=0) +d_eax = bs(l=0, cls=(bs_eax, ), fname='eax') +d_edx = bs(l=0, cls=(bs_edx, ), fname='edx') +d_st = bs(l=0, cls=(x86_reg_st, ), fname='st') +# d_imm = bs(l=0, cls=(bs_cond_imm,), fname="imm") +d_imm = bs(l=0, cls=(bs_cond_imm,), fname="imm") +d_imm64 = bs(l=0, cls=(bs_cond_imm64,), fname="imm") +d_ax = bs(l=0, cls=(r_ax, ), fname='ax') +d_dx = bs(l=0, cls=(r_dx, ), fname='dx') +d_cl = bs(l=0, cls=(r_cl, ), fname='cl') + +d_cs = bs(l=0, cls=(bs_cs, ), fname='cs') +d_ds = bs(l=0, cls=(bs_ds, ), fname='ds') +d_es = bs(l=0, cls=(bs_es, ), fname='es') +d_ss = bs(l=0, cls=(bs_ss, ), fname='ss') +d_fs = bs(l=0, cls=(bs_fs, ), fname='fs') +d_gs = bs(l=0, cls=(bs_gs, ), fname='gs') + +rel_off = bs(l=0, cls=(bs_rel_off,), fname="off") +rel_off08 = bs(l=8, cls=(bs_rel_off08,), fname="off") +moff = bs(l=0, cls=(bs_moff,), fname="off") +msegoff = bs(l=16, cls=(bs_msegoff,), fname="mseg") +movoff = bs(l=0, cls=(bs_movoff,), fname="off") +mod = bs(l=2, fname="mod") + +rmreg = bs(l=3, cls=(x86_rm_reg, ), order =1, fname = "reg") +reg = bs(l=3, cls=(x86_reg, ), order =1, fname = "reg") +regnoarg = bs(l=3, default_val="000", order=1, fname="reg") +segm = bs(l=3, cls=(x86_rm_segm, ), order =1, fname = "reg") +crreg = bs(l=3, cls=(x86_rm_cr, ), order =1, fname = "reg") +drreg = bs(l=3, cls=(x86_rm_dr, ), order =1, fname = "reg") + +fltreg = bs(l=3, cls=(x86_rm_flt, ), order =1, fname = "reg") + +rm = bs(l=3, fname="rm") + +rm_arg = bs(l=0, cls=(x86_rm_arg,), fname='rmarg') +rm_arg_w8 = bs(l=0, cls=(x86_rm_w8,), fname='rmarg') +rm_arg_sx = bs(l=0, cls=(x86_rm_sx,), fname='rmarg') +rm_arg_sxd = bs(l=0, cls=(x86_rm_sxd,), fname='rmarg') +rm_arg_sd = bs(l=0, cls=(x86_rm_sd,), fname='rmarg') +rm_arg_wd = bs(l=0, cls=(x86_rm_wd,), fname='rmarg') +rm_arg_m80 = bs(l=0, cls=(x86_rm_m80,), fname='rmarg') +rm_arg_m64 = bs(l=0, cls=(x86_rm_m64,), fname='rmarg') +rm_arg_m08 = bs(l=0, cls=(x86_rm_m08,), fname='rmarg') +rm_arg_m16 = bs(l=0, cls=(x86_rm_m16,), fname='rmarg') + +swapargs = bs_swapargs(l=1, fname="swap", mn_mod=range(1 << 1)) + + +cond_list = ["O", "NO", "B", "AE", + "Z", "NZ", "BE", "A", + "S", "NS", "PE", "NP", + #"L", "NL", "NG", "G"] + "L", "GE", "LE", "G"] +cond = bs_mod_name(l=4, fname='cond', mn_mod=cond_list) + + +def rmmod(r, rm_arg_x=rm_arg): + return [mod, r, rm, sib_scale, sib_index, sib_base, disp, rm_arg_x] + +# +# mode | reg | rm # +# + +# +# scale | index | base # +# + +# +# Prefix | REX prefix | Opcode | mod/rm | sib | displacement | immediate # +# + + +def addop(name, fields, args=None, alias=False): + dct = {"fields": fields} + dct["alias"] = alias + if args is not None: + dct['args'] = args + type(name, (mn_x86,), dct) +""" +class ia32_aaa(mn_x86): + fields = [bs8(0x37)] +""" +addop("aaa", [bs8(0x37)]) +addop("aas", [bs8(0x3F)]) +addop("aad", [bs8(0xd5), u08]) +addop("aam", [bs8(0xd4), u08]) + +addop("adc", [bs("0001010"), w8, d_eax, d_imm]) +addop("adc", [bs("100000"), se, w8] + rmmod(d2, rm_arg_w8) + [d_imm]) +addop("adc", [bs("000100"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("add", [bs("0000010"), w8, d_eax, d_imm]) +addop("add", [bs("100000"), se, w8] + rmmod(d0, rm_arg_w8) + [d_imm]) +addop("add", [bs("000000"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("and", [bs("0010010"), w8, d_eax, d_imm]) +addop("and", [bs("100000"), se, w8] + rmmod(d4, rm_arg_w8) + [d_imm]) +addop("and", [bs("001000"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("bsf", [bs8(0x0f), bs8(0xbc)] + rmmod(rmreg)) +addop("bsr", [bs8(0x0f), bs8(0xbd), mod, + rmreg, rm, sib_scale, sib_index, sib_base, disp, rm_arg]) + +addop("bswap", [bs8(0x0f), bs('11001'), reg]) + +addop("bt", [bs8(0x0f), bs8(0xa3)] + rmmod(rmreg), [rm_arg, rmreg]) +addop("bt", [bs8(0x0f), bs8(0xba)] + rmmod(d4) + [u08]) +addop("btc", [bs8(0x0f), bs8(0xbb)] + rmmod(rmreg), [rm_arg, rmreg]) +addop("btc", [bs8(0x0f), bs8(0xba)] + rmmod(d7) + [u08]) + + +addop("btr", [bs8(0x0f), bs8(0xb3)] + rmmod(rmreg), [rm_arg, rmreg]) +addop("btr", [bs8(0x0f), bs8(0xba)] + rmmod(d6) + [u08]) +addop("bts", [bs8(0x0f), bs8(0xab)] + rmmod(rmreg), [rm_arg, rmreg]) +addop("bts", [bs8(0x0f), bs8(0xba)] + rmmod(d5) + [u08]) + +addop("call", [bs8(0xe8), rel_off]) +addop("call", [bs8(0xff), stk] + rmmod(d2)) +addop("call", [bs8(0x9a), moff, msegoff]) + + +class bs_op_mode(bsi): + + def decode(self, v): + opmode = self.parent.v_opmode() + # print "MODE", opmode, self.mode + return opmode == self.mode + + +class bs_ad_mode(bsi): + + def decode(self, v): + admode = self.parent.v_admode() + # print "MODE", opmode, self.mode + return admode == self.mode + + +class bs_op_mode_no64(bsi): + + def encode(self): + if self.parent.mode == 64: + return False + return super(bs_op_mode_no64, self).encode() + + def decode(self, v): + if self.parent.mode == 64: + return False + opmode = self.parent.v_opmode() + # print "MODE", opmode, self.mode + return opmode == self.mode + + +bs_opmode16 = bs(l=0, cls=(bs_op_mode,), mode = 16, fname="fopmode") +bs_opmode32 = bs(l=0, cls=(bs_op_mode,), mode = 32, fname="fopmode") +bs_opmode64 = bs(l=0, cls=(bs_op_mode,), mode = 64, fname="fopmode") + + +bs_admode16 = bs(l=0, cls=(bs_ad_mode,), mode = 16, fname="fadmode") +bs_admode32 = bs(l=0, cls=(bs_ad_mode,), mode = 32, fname="fadmode") +bs_admode64 = bs(l=0, cls=(bs_ad_mode,), mode = 64, fname="fadmode") + +bs_opmode16_no64 = bs(l=0, cls=(bs_op_mode_no64,), mode = 16, fname="fopmode") +bs_opmode32_no64 = bs(l=0, cls=(bs_op_mode_no64,), mode = 32, fname="fopmode") + +# class ia32_call(mn_x86): +# fields = [bs8(0xff)] + rmmod(d3) +# conv_name = {16:'CBW', 32:'CWDE', 64:'CDQE'} +# bs_conv_name = bs_modname_size(l=0, name=conv_name) +addop("cbw", [bs8(0x98), bs_opmode16]) +addop("cwde", [bs8(0x98), bs_opmode32]) +addop("cdqe", [bs8(0x98), bs_opmode64]) + +addop("clc", [bs8(0xf8)]) +addop("cld", [bs8(0xfc)]) +addop("cli", [bs8(0xfa)]) +addop("clts", [bs8(0x0f), bs8(0x06)]) +addop("cmc", [bs8(0xf5)]) + +addop("cmov", [bs8(0x0f), bs('0100'), cond] + rmmod(rmreg)) + +addop("cmp", [bs("0011110"), w8, d_eax, d_imm]) +addop("cmp", [bs("100000"), se, w8] + rmmod(d7, rm_arg_w8) + [d_imm]) +addop("cmp", [bs("001110"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + + +addop("cmpsb", [bs8(0xa6)]) +# cmps_name = {16:'CMPSW', 32:'CMPSD', 64:'CMPSQ'} +# bs_cmps_name = bs_modname_size(l=0, name=cmps_name) +# addop("cmps", [bs8(0xa7), bs_cmps_name]) +addop("cmpsw", [bs8(0xa7), bs_opmode16]) +addop("cmpsd", [bs8(0xa7), bs_opmode32]) +addop("cmpsq", [bs8(0xa7), bs_opmode64]) + +addop("cmpxchg", [bs8(0x0f), bs('1011000'), w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) +# XXX TODO CMPXCHG8/16 +addop("cpuid", [bs8(0x0f), bs8(0xa2)]) + +# convbis_name = {16:'CWD', 32:'CDQ', 64:'CQO'} +# bs_convbis_name = bs_modname_size(l=0, name=convbis_name) +# addop("convbis", [bs8(0x99), bs_convbis_name]) +addop("cwd", [bs8(0x99), bs_opmode16]) +addop("cdq", [bs8(0x99), bs_opmode32]) +addop("cqo", [bs8(0x99), bs_opmode64]) + + +addop("daa", [bs8(0x27)]) +addop("das", [bs8(0x2f)]) +addop("dec", [bs('1111111'), w8] + rmmod(d1, rm_arg_w8)) +addop("dec", [bs('01001'), reg]) +addop("div", [bs('1111011'), w8] + rmmod(d6, rm_arg_w8)) +addop("enter", [bs8(0xc8), u16, u08]) + +# float ##### +addop("fwait", [bs8(0x9b)]) + +addop("f2xm1", [bs8(0xd9), bs8(0xf0)]) +addop("fabs", [bs8(0xd9), bs8(0xe1)]) + +addop("fadd", [bs("11011"), sd, bs("00")] + rmmod(d0, rm_arg_sd)) +addop("fadd", [bs("11011"), swapargs, bs("00"), + bs("11000"), d_st, fltreg], [d_st, fltreg]) +addop("faddp", [bs8(0xde), bs("11000"), fltreg, d_st]) +addop("fiadd", [bs("11011"), wd, bs("10")] + rmmod(d0, rm_arg_wd)) + +addop("fbld", [bs8(0xdf)] + rmmod(d4, rm_arg_m80)) +addop("fbldp", [bs8(0xdf)] + rmmod(d6, rm_arg_m80)) +addop("fchs", [bs8(0xd9), bs8(0xe0)]) +# addop("fclex", [bs8(0x9b), bs8(0xdb), bs8(0xe2)]) +addop("fnclex", [bs8(0xdb), bs8(0xe2)]) + +addop("fcmovb", [bs8(0xda), bs("11000"), d_st, fltreg]) +addop("fcmove", [bs8(0xda), bs("11001"), d_st, fltreg]) +addop("fcmovbe", [bs8(0xda), bs("11010"), d_st, fltreg]) +addop("fcmovu", [bs8(0xda), bs("11011"), d_st, fltreg]) +addop("fcmovnb", [bs8(0xdb), bs("11000"), d_st, fltreg]) +addop("fcmovne", [bs8(0xdb), bs("11001"), d_st, fltreg]) +addop("fcmovnbe", [bs8(0xdb), bs("11010"), d_st, fltreg]) +addop("fcmovnu", [bs8(0xdb), bs("11011"), d_st, fltreg]) + +addop("fcom", [bs("11011"), sd, bs("00")] + rmmod(d2, rm_arg_sd)) +addop("fcom", [bs("11011"), swapargs, bs("00"), + bs("11010"), d_st, fltreg], [d_st, fltreg]) +addop("fcomp", [bs("11011"), sd, bs("00")] + rmmod(d3, rm_arg_sd)) +addop("fcomp", + [bs("11011"), swapargs, bs("00"), bs("11011"), + d_st, fltreg], [d_st, fltreg]) +addop("fcompp", [bs8(0xde), bs8(0xd9)]) + +addop("fcomi", [bs8(0xdb), bs("11110"), d_st, fltreg]) +addop("fcomip", [bs8(0xdf), bs("11110"), d_st, fltreg]) +addop("fucomi", [bs8(0xdb), bs("11101"), d_st, fltreg]) +addop("fucomip", [bs8(0xdf), bs("11101"), d_st, fltreg]) + +addop("fcos", [bs8(0xd9), bs8(0xff)]) +addop("fdecstp", [bs8(0xd9), bs8(0xf6)]) + + +addop("fdiv", [bs("11011"), sd, bs("00")] + rmmod(d6, rm_arg_sd)) +addop("fdiv", [bs8(0xd8), bs("11110"), d_st, fltreg]) +addop("fdiv", [bs8(0xdc), bs("11111"), fltreg, d_st]) +addop("fdivp", [bs8(0xde), bs("11111"), fltreg, d_st]) +addop("fidiv", [bs("11011"), wd, bs("10")] + rmmod(d6, rm_arg_wd)) + +addop("fdivr", [bs("11011"), sd, bs("00")] + rmmod(d7, rm_arg_sd)) +addop("fdivr", [bs8(0xd8), bs("11111"), d_st, fltreg]) +addop("fdivr", [bs8(0xdc), bs("11110"), fltreg, d_st]) +addop("fdivrp", [bs8(0xde), bs("11110"), fltreg, d_st]) +addop("fidivr", [bs("11011"), wd, bs("10")] + rmmod(d7, rm_arg_wd)) + +addop("ffree", [bs8(0xdd), bs("11000"), fltreg]) +addop("ficom", [bs("11011"), wd, bs("10")] + rmmod(d2, rm_arg_wd)) +addop("ficomp", [bs("11011"), wd, bs("10")] + rmmod(d3, rm_arg_wd)) +addop("fild", [bs("11011"), wd, bs("11")] + rmmod(d0, rm_arg_wd)) +addop("fild", [bs8(0xdf)] + rmmod(d5, rm_arg_m64)) + +addop("fincstp", [bs8(0xd9), bs8(0xf7)]) + +# addop("finit", [bs8(0x9b), bs8(0xdb), bs8(0xe3)]) +addop("fninit", [bs8(0xdb), bs8(0xe3)]) + +addop("fist", [bs("11011"), wd, bs("11")] + rmmod(d2, rm_arg_wd)) +addop("fistp", [bs("11011"), wd, bs("11")] + rmmod(d3, rm_arg_wd)) +addop("fistp", [bs8(0xdf)] + rmmod(d7, rm_arg_m64)) + +addop("fisttp", [bs("11011"), wd, bs("11")] + rmmod(d1, rm_arg_wd)) +addop("fisttp", [bs8(0xdd)] + rmmod(d1, rm_arg_m64)) + +addop("fld", [bs("11011"), sd, bs("01")] + rmmod(d0, rm_arg_sd)) +addop("fld", [bs8(0xdb)] + rmmod(d5, rm_arg_m80)) +addop("fld", [bs8(0xd9), bs("11000"), fltreg]) + +addop("fld1", [bs8(0xd9), bs8(0xe8)]) +addop("fldl2t", [bs8(0xd9), bs8(0xe9)]) +addop("fldl2e", [bs8(0xd9), bs8(0xea)]) +addop("fldpi", [bs8(0xd9), bs8(0xeb)]) +addop("fldlg2", [bs8(0xd9), bs8(0xec)]) +addop("fldln2", [bs8(0xd9), bs8(0xed)]) +addop("fldz", [bs8(0xd9), bs8(0xee)]) + +addop("fldcw", [bs8(0xd9)] + rmmod(d5, rm_arg_m16)) +addop("fldenv", [bs8(0xd9)] + rmmod(d4, rm_arg_m80)) # XXX TODO: m14? + +addop("fmul", [bs("11011"), sd, bs("00")] + rmmod(d1, rm_arg_sd)) +addop("fmul", [bs("11011"), swapargs, bs("00"), + bs("11001"), d_st, fltreg], [d_st, fltreg]) +addop("fmulp", [bs8(0xde), bs("11001"), fltreg, d_st]) +addop("fimul", [bs("11011"), wd, bs("10")] + rmmod(d1, rm_arg_wd)) + +addop("fnop", [bs8(0xd9), bs8(0xd0)]) +addop("fpatan", [bs8(0xd9), bs8(0xf3)]) +addop("fprem", [bs8(0xd9), bs8(0xf8)]) +addop("fprem1", [bs8(0xd9), bs8(0xf5)]) +addop("fptan", [bs8(0xd9), bs8(0xf2)]) +addop("frndint", [bs8(0xd9), bs8(0xfc)]) +addop("frstor", [bs8(0xdd)] + rmmod(d4, rm_arg_m80)) # XXX TODO: m94 ? +# addop("fsave", [bs8(0x9b), bs8(0xdd)] + rmmod(d6, rm_arg_m80)) # XXX +# TODO: m94 ? +addop("fnsave", [bs8(0xdd)] + rmmod(d6, rm_arg_m80)) # XXX TODO: m94 ? + +addop("fscale", [bs8(0xd9), bs8(0xfd)]) +addop("fsin", [bs8(0xd9), bs8(0xfe)]) +addop("fsincos", [bs8(0xd9), bs8(0xfb)]) +addop("fsqrt", [bs8(0xd9), bs8(0xfa)]) + +addop("fst", [bs("11011"), sd, bs("01")] + rmmod(d2, rm_arg_sd)) +addop("fst", [bs8(0xdd), bs("11010"), fltreg]) +addop("fstp", [bs("11011"), sd, bs("01")] + rmmod(d3, rm_arg_sd)) +addop("fstp", [bs8(0xdb)] + rmmod(d7, rm_arg_m80)) +addop("fstp", [bs8(0xdd), bs("11011"), fltreg]) + +# addop("fstcw", [bs8(0x9b), bs8(0xd9)] + rmmod(d7, rm_arg_m16)) +addop("fnstcw", [bs8(0xd9)] + rmmod(d7, rm_arg_m16)) +# addop("fstenv", [bs8(0x9b), bs8(0xd9)] + rmmod(d6, rm_arg_m80)) # XXX +# TODO: m14? +addop("fnstenv", [bs8(0xd9)] + rmmod(d6, rm_arg_m80)) # XXX TODO: m14? +# addop("fstsw", [bs8(0x9b), bs8(0xdd)] + rmmod(d7, rm_arg_m16)) +addop("fnstsw", [bs8(0xdd)] + rmmod(d7, rm_arg_m16)) +# addop("fstsw", [bs8(0x9b), bs8(0xdf), bs8(0xe0), d_ax]) +addop("fnstsw", [bs8(0xdf), bs8(0xe0), d_ax]) + +addop("fsub", [bs("11011"), sd, bs("00")] + rmmod(d4, rm_arg_sd)) +addop("fsub", [bs8(0xd8), bs("11100"), d_st, fltreg]) +addop("fsub", [bs8(0xdc), bs("11101"), fltreg, d_st]) +addop("fsubp", [bs8(0xde), bs("11101"), fltreg, d_st]) +addop("fisub", [bs("11011"), wd, bs("10")] + rmmod(d4, rm_arg_wd)) + +addop("fsubr", [bs("11011"), sd, bs("00")] + rmmod(d5, rm_arg_sd)) +addop("fsubr", [bs8(0xd8), bs("11101"), d_st, fltreg]) +addop("fsubr", [bs8(0xdc), bs("11100"), fltreg, d_st]) +addop("fsubrp", [bs8(0xde), bs("11100"), fltreg, d_st]) +addop("fisubr", [bs("11011"), wd, bs("10")] + rmmod(d5, rm_arg_wd)) +addop("ftst", [bs8(0xd9), bs8(0xe4)]) + + +addop("fucom", [bs8(0xdd), bs("11100"), fltreg]) +addop("fucomp", [bs8(0xdd), bs("11101"), fltreg]) +addop("fucompp", [bs8(0xda), bs8(0xe9)]) + +addop("fxam", [bs8(0xd9), bs8(0xe5)]) +addop("fxch", [bs8(0xd9), bs("11001"), fltreg]) +addop("fxrstor", [bs8(0x0f), bs8(0xae)] + + rmmod(d1, rm_arg_m80)) # XXX TODO m512 +addop("fxsave", [bs8(0x0f), bs8(0xae)] + + rmmod(d0, rm_arg_m80)) # XXX TODO m512 + +addop("fxtract", [bs8(0xd9), bs8(0xf4)]) +addop("fyl2x", [bs8(0xd9), bs8(0xf1)]) +addop("fyl2xp1", [bs8(0xd9), bs8(0xf9)]) + +addop("hlt", [bs8(0xf4)]) +addop("icebp", [bs8(0xf1)]) + +addop("idiv", [bs('1111011'), w8] + rmmod(d7, rm_arg_w8)) + +addop("imul", [bs('1111011'), w8] + rmmod(d5, rm_arg_w8)) +addop("imul", [bs8(0x0f), bs8(0xaf)] + rmmod(rmreg)) + +addop("imul", [bs("011010"), se, bs('1')] + rmmod(rmreg) + [d_imm]) + +addop("in", [bs("1110010"), w8, d_eax, u08]) +addop("in", [bs("1110110"), w8, d_eax, d_edx]) + +addop("inc", [bs('1111111'), w8] + rmmod(d0, rm_arg_w8)) +addop("inc", [bs('01000'), reg]) + +addop("insb", [bs8(0x6c)]) +# ins_name = {16:'INSW', 32:'INSD', 64:'INSD'} +# bs_ins_name = bs_modname_size(l=0, name=ins_name) +# addop("ins", [bs8(0x6d), bs_ins_name]) +addop("insw", [bs8(0x6d), bs_opmode16]) +addop("insd", [bs8(0x6d), bs_opmode32]) +addop("insd", [bs8(0x6d), bs_opmode64]) + +addop("int", [bs8(0xcc), u08_3]) +addop("int", [bs8(0xcd), u08]) +addop("into", [bs8(0xce)]) +addop("invd", [bs8(0x0f), bs8(0x08)]) +addop("invlpg", [bs8(0x0f), bs8(0x01)] + rmmod(d7)) + +# iret_name = {16:'IRET', 32:'IRETD', 64:'IRETQ'} +# bs_iret_name = bs_modname_size(l=0, name=iret_name) +# addop("iret", [bs8(0xcf), stk, bs_iret_name]) +addop("iret", [bs8(0xcf), stk, bs_opmode16]) +addop("iretd", [bs8(0xcf), stk, bs_opmode32]) +addop("iretq", [bs8(0xcf), stk, bs_opmode64]) + +addop("j", [bs('0111'), cond, rel_off08]) +# bs_jecxz_name = bs_modname_jecx(l=0) +# addop("jecxz", [bs8(0xe3), rel_off08, bs_jecxz_name]) + +addop("jcxz", [bs8(0xe3), rel_off08, bs_admode16]) +addop("jecxz", [bs8(0xe3), rel_off08, bs_admode32]) +addop("jrcxz", [bs8(0xe3), rel_off08, bs_admode64]) + +addop("j", [bs8(0x0f), bs('1000'), cond, rel_off]) +addop("jmp", [bs8(0xeb), rel_off08]) +addop("jmp", [bs8(0xe9), rel_off]) +# TODO XXX replace stk force64? +addop("jmp", [bs8(0xff), stk] + rmmod(d4)) +addop("jmp", [bs8(0xea), moff, msegoff]) + +addop("jmpf", [bs8(0xff), stk] + rmmod(d5)) + +addop("lahf", [bs8(0x9f)]) +addop("lar", [bs8(0x0f), bs8(0x02)] + rmmod(rmreg)) + +# XXX TODO LDS LES ... +addop("lea", [bs8(0x8d)] + rmmod(rmreg)) +addop("leave", [bs8(0xc9)]) + +addop("lodsb", [bs8(0xac)]) +# lods_name = {16:'LODSW', 32:'LODSD', 64:'LODSQ'} +# bs_lods_name = bs_modname_size(l=0, name=lods_name) +# addop("lods", [bs8(0xad), bs_lods_name]) +addop("lodsw", [bs8(0xad), bs_opmode16]) +addop("lodsd", [bs8(0xad), bs_opmode32]) +addop("lodsq", [bs8(0xad), bs_opmode64]) + +addop("loop", [bs8(0xe2), rel_off08]) +addop("loope", [bs8(0xe1), rel_off08]) +addop("loopne", [bs8(0xe0), rel_off08]) +addop("lsl", [bs8(0x0f), bs8(0x03)] + rmmod(rmreg)) +addop("monitor", [bs8(0x0f), bs8(0x01), bs8(0xc8)]) + +addop("mov", [bs("100010"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) +addop("mov", [bs("100011"), swapargs, bs('0')] + rmmod(segm), [rm_arg, segm]) +addop("mov", [bs("101000"), swapargs, w8, d_eax, movoff], [d_eax, movoff]) +addop("mov", [bs("1011"), w8, reg, d_imm64]) +addop("mov", [bs("1100011"), w8] + rmmod(d0, rm_arg_w8) + [d_imm]) +addop("mov", [bs8(0x0f), bs("001000"), swapargs, bs('0')] + + rmmod(crreg), [rm_arg, crreg]) +addop("mov", [bs8(0x0f), bs("001000"), swapargs, bs('1')] + + rmmod(drreg), [rm_arg, drreg]) +addop("movsb", [bs8(0xa4)]) +# movs_name = {16:'MOVSW', 32:'MOVSD', 64:'MOVSQ'} +# bs_movs_name = bs_modname_size(l=0, name=movs_name) +# addop("movs", [bs8(0xa5), bs_movs_name]) +addop("movsw", [bs8(0xa5), bs_opmode16]) +addop("movsd", [bs8(0xa5), bs_opmode32]) +addop("movsq", [bs8(0xa5), bs_opmode64]) + +addop("movsx", [bs8(0x0f), bs("1011111"), w8, sx] + rmmod(rmreg, rm_arg_sx)) +# addop("movsxd", [bs8(0x63), sxd] + rmmod(rmreg, rm_arg_sxd)) +type("movsxd", (mn_x86,), { + "fields": [bs8(0x63), sxd] + rmmod(rmreg, rm_arg_sxd), + "modes": [64], 'alias': False}) + +addop("movups", + [bs8(0x0f), bs8(0x10), xmm, no_xmm_pref] + rmmod(rmreg, rm_arg)) +addop("movsd", [bs8(0x0f), bs("0001000"), swapargs, xmm, pref_f2] + + rmmod(rmreg, rm_arg), [xmm, rm_arg]) +addop("movss", [bs8(0x0f), bs8(0x10), xmm, pref_f3] + rmmod(rmreg, rm_arg)) +addop("movupd", [bs8(0x0f), bs8(0x10), xmm, pref_66] + rmmod(rmreg, rm_arg)) + + +addop("addss", [bs8(0x0f), bs8(0x58), xmm, pref_f3] + rmmod(rmreg, rm_arg)) +addop("addsd", [bs8(0x0f), bs8(0x58), xmm, pref_f2] + rmmod(rmreg, rm_arg)) + +addop("subss", [bs8(0x0f), bs8(0x5c), xmm, pref_f3] + rmmod(rmreg, rm_arg)) +addop("subsd", [bs8(0x0f), bs8(0x5c), xmm, pref_f2] + rmmod(rmreg, rm_arg)) + +addop("mulss", [bs8(0x0f), bs8(0x59), xmm, pref_f3] + rmmod(rmreg, rm_arg)) +addop("mulsd", [bs8(0x0f), bs8(0x59), xmm, pref_f2] + rmmod(rmreg, rm_arg)) + +addop("divss", [bs8(0x0f), bs8(0x5e), xmm, pref_f3] + rmmod(rmreg, rm_arg)) +addop("divsd", [bs8(0x0f), bs8(0x5e), xmm, pref_f2] + rmmod(rmreg, rm_arg)) + + +addop("pminsw", [bs8(0x0f), bs8(0xea), mm, no_xmm_pref] + rmmod(rmreg, rm_arg)) +addop("pminsw", [bs8(0x0f), bs8(0xea), xmm, pref_66] + rmmod(rmreg, rm_arg)) + + +addop("pxor", [bs8(0x0f), bs8(0xef), xmm] + rmmod(rmreg, rm_arg)) + +addop("ucomiss", + [bs8(0x0f), bs8(0x2e), xmm, no_xmm_pref] + rmmod(rmreg, rm_arg)) +addop("ucomisd", [bs8(0x0f), bs8(0x2e), xmm, pref_66] + rmmod(rmreg, rm_arg)) + +addop("andps", [bs8(0x0f), bs8(0x54), xmm, no_xmm_pref] + rmmod(rmreg, rm_arg)) +addop("andpd", [bs8(0x0f), bs8(0x54), xmm, pref_66] + rmmod(rmreg, rm_arg)) + + +addop("maxsd", [bs8(0x0f), bs8(0x5f), xmm, pref_f2] + rmmod(rmreg, rm_arg)) + +addop("cvtsi2sd", + [bs8(0x0f), bs8(0x2a), xmmreg, pref_f2] + rmmod(rmreg, rm_arg)) +addop("cvtsi2ss", + [bs8(0x0f), bs8(0x2a), xmmreg, pref_f3] + rmmod(rmreg, rm_arg)) + + +addop("cvttsd2ss", + [bs8(0x0f), bs8(0x2c), xmmreg, pref_f2] + rmmod(rmreg, rm_arg)) +addop("cvttss2si", + [bs8(0x0f), bs8(0x2c), xmmreg, pref_f3] + rmmod(rmreg, rm_arg)) + + +# type("movupd", (mn_x86,), {"fields":[bs8(0x0f), bs8(0x10), xmm, pref_f2] +# + rmmod(rmreg, rm_arg_sxd), 'prefixed':'\xf2'}) + +addop("movzx", [bs8(0x0f), bs("1011011"), w8, sx] + rmmod(rmreg, rm_arg_sx)) +addop("mul", [bs('1111011'), w8] + rmmod(d4, rm_arg_w8)) + +addop("neg", [bs('1111011'), w8] + rmmod(d3, rm_arg_w8)) +addop("nop", [bs8(0x0f), bs8(0x1f)] + rmmod(d0, rm_arg)) # XXX TODO m512 +addop("not", [bs('1111011'), w8] + rmmod(d2, rm_arg_w8)) +addop("or", [bs("0000110"), w8, d_eax, d_imm]) +addop("or", [bs("100000"), se, w8] + rmmod(d1, rm_arg_w8) + [d_imm]) +addop("or", [bs("000010"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) +addop("out", [bs("1110011"), w8, u08, d_eax]) +addop("out", [bs("1110111"), w8, d_edx, d_eax]) + +addop("outsb", [bs8(0x6e)]) +# outs_name = {16:'OUTSW', 32:'OUTSD', 64:'OUTSD'} +# bs_outs_name = bs_modname_size(l=0, name=outs_name) +# addop("outs", [bs8(0x6f), bs_outs_name]) +addop("outsw", [bs8(0x6f), bs_opmode16]) +addop("outsd", [bs8(0x6f), bs_opmode32]) +addop("outsd", [bs8(0x6f), bs_opmode64]) + + +# addop("pause", [bs8(0xf3), bs8(0x90)]) + +addop("pop", [bs8(0x8f), stk] + rmmod(d0)) +addop("pop", [bs("01011"), stk, reg]) +addop("pop", [bs8(0x1f), d_ds]) +addop("pop", [bs8(0x07), d_es]) +addop("pop", [bs8(0x17), d_ss]) +addop("pop", [bs8(0x0f), bs8(0xa1), d_fs]) +addop("pop", [bs8(0x0f), bs8(0xa9), d_gs]) + +# popa_name = {16:'POPA', 32:'POPAD'} +# bs_popa_name = bs_modname_size(l=0, name=popa_name) +# addop("popa", [bs8(0x61), bs_popa_name]) +addop("popa", [bs8(0x61), bs_opmode16]) +addop("popad", [bs8(0x61), bs_opmode32]) + +# popf_name = {16:'POPF', 32:'POPFD', 64:'POPFQ'} +# bs_popf_name = bs_modname_size(l=0, name=popf_name) +# addop("popf", [bs8(0x9d), bs_popf_name]) +addop("popf", [bs8(0x9d), bs_opmode16]) +addop("popfd", [bs8(0x9d), bs_opmode32]) +addop("popfq", [bs8(0x9d), bs_opmode64]) + +addop("prefetch0", [bs8(0x0f), bs8(0x18)] + rmmod(d1, rm_arg_m08)) +addop("prefetch1", [bs8(0x0f), bs8(0x18)] + rmmod(d2, rm_arg_m08)) +addop("prefetch2", [bs8(0x0f), bs8(0x18)] + rmmod(d3, rm_arg_m08)) +addop("prefetchnta", [bs8(0x0f), bs8(0x18)] + rmmod(d0, rm_arg_m08)) + +addop("push", [bs8(0xff), stk] + rmmod(d6)) +addop("push", [bs("01010"), stk, reg]) +addop("push", [bs8(0x6a), rel_off08, stk]) +addop("push", [bs8(0x68), d_imm, stk]) +addop("push", [bs8(0x0e), d_cs]) +addop("push", [bs8(0x16), d_ss]) +addop("push", [bs8(0x1e), d_ds]) +addop("push", [bs8(0x06), d_es]) +addop("push", [bs8(0x0f), bs8(0xa0), d_fs]) +addop("push", [bs8(0x0f), bs8(0xa8), d_gs]) + +# pusha_name = {16:'PUSHA', 32:'PUSHAD'} +# bs_pusha_name = bs_modname_size(l=0, name=pusha_name) +# addop("pusha", [bs8(0x60), bs_pusha_name]) +addop("pusha", [bs8(0x60), bs_opmode16_no64]) +addop("pushad", [bs8(0x60), bs_opmode32_no64]) + + +# pushf_name = {16:'PUSHF', 32:'PUSHFD', 64:'PUSHFQ'} +# bs_pushf_name = bs_modname_size(l=0, name=pushf_name) +# addop("pushf", [bs8(0x9c), bs_pushf_name]) +addop("pushf", [bs8(0x9c), bs_opmode16]) +addop("pushfd", [bs8(0x9c), bs_opmode32]) +addop("pushfq", [bs8(0x9c), bs_opmode64]) + +addop("rcl", [bs('110100'), d_cl1, w8] + + rmmod(d2, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("rcl", [bs('1100000'), w8] + rmmod(d2, rm_arg_w8) + [u08]) +addop("rcr", [bs('110100'), d_cl1, w8] + + rmmod(d3, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("rcr", [bs('1100000'), w8] + rmmod(d3, rm_arg_w8) + [u08]) +addop("rol", [bs('110100'), d_cl1, w8] + + rmmod(d0, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("rol", [bs('1100000'), w8] + rmmod(d0, rm_arg_w8) + [u08]) +addop("ror", [bs('110100'), d_cl1, w8] + + rmmod(d1, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("ror", [bs('1100000'), w8] + rmmod(d1, rm_arg_w8) + [u08]) + +addop("rdmsr", [bs8(0x0f), bs8(0x32)]) +addop("rdpmc", [bs8(0x0f), bs8(0x33)]) +addop("rdtsc", [bs8(0x0f), bs8(0x31)]) +addop("ret", [bs8(0xc3), stk]) +addop("ret", [bs8(0xc2), stk, u16]) +addop("retf", [bs8(0xcb), stk]) +addop("retf", [bs8(0xca), stk, u16]) + +addop("rsm", [bs8(0x0f), bs8(0xaa)]) +addop("sahf", [bs8(0x9e)]) + +# XXX tipo in doc: /4 instead of /6 +addop("sal", [bs('110100'), d_cl1, w8] + + rmmod(d6, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("sal", [bs('1100000'), w8] + rmmod(d6, rm_arg_w8) + [u08]) +addop("sar", [bs('110100'), d_cl1, w8] + + rmmod(d7, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("sar", [bs('1100000'), w8] + rmmod(d7, rm_arg_w8) + [u08]) + +addop("scasb", [bs8(0xae)]) +# scas_name = {16:'SCASW', 32:'SCASD', 64:'SCASQ'} +# bs_scas_name = bs_modname_size(l=0, name=scas_name) +# addop("scas", [bs8(0xaf), bs_scas_name]) +addop("scasw", [bs8(0xaf), bs_opmode16]) +addop("scasd", [bs8(0xaf), bs_opmode32]) +addop("scasq", [bs8(0xaf), bs_opmode64]) + +addop("shl", [bs('110100'), d_cl1, w8] + + rmmod(d4, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("shl", [bs('1100000'), w8] + rmmod(d4, rm_arg_w8) + [u08]) +addop("shr", [bs('110100'), d_cl1, w8] + + rmmod(d5, rm_arg_w8), [rm_arg_w8, d_cl1]) +addop("shr", [bs('1100000'), w8] + rmmod(d5, rm_arg_w8) + [u08]) + +addop("sbb", [bs("0001110"), w8, d_eax, d_imm]) +addop("sbb", [bs("100000"), se, w8] + rmmod(d3, rm_arg_w8) + [d_imm]) +addop("sbb", [bs("000110"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("set", [bs8(0x0f), bs('1001'), cond] + rmmod(regnoarg, rm_arg_m08)) +addop("sgdt", [bs8(0x0f), bs8(0x01)] + rmmod(d0)) +addop("shld", [bs8(0x0f), bs8(0xa4)] + + rmmod(rmreg) + [u08], [rm_arg, rmreg, u08]) +addop("shld", [bs8(0x0f), bs8(0xa5)] + + rmmod(rmreg) + [d_cl], [rm_arg, rmreg, d_cl]) +addop("shrd", [bs8(0x0f), bs8(0xac)] + + rmmod(rmreg) + [u08], [rm_arg, rmreg, u08]) +addop("shrd", [bs8(0x0f), bs8(0xad)] + + rmmod(rmreg) + [d_cl], [rm_arg, rmreg, d_cl]) +addop("sidt", [bs8(0x0f), bs8(0x01)] + rmmod(d1)) +addop("sldt", [bs8(0x0f), bs8(0x00)] + rmmod(d0)) +addop("smsw", [bs8(0x0f), bs8(0x01)] + rmmod(d4)) +addop("stc", [bs8(0xf9)]) +addop("std", [bs8(0xfd)]) +addop("sti", [bs8(0xfb)]) +addop("stosb", [bs8(0xaa)]) +# stos_name = {16:'STOSW', 32:'STOSD', 64:'STOSQ'} +# bs_stos_name = bs_modname_size(l=0, name=stos_name) +# addop("stos", [bs8(0xab), bs_stos_name]) +addop("stosw", [bs8(0xab), bs_opmode16]) +addop("stosd", [bs8(0xab), bs_opmode32]) +addop("stosq", [bs8(0xab), bs_opmode64]) + +addop("str", [bs8(0x0f), bs8(0x00)] + rmmod(d1)) + +addop("sub", [bs("0010110"), w8, d_eax, d_imm]) +addop("sub", [bs("100000"), se, w8] + rmmod(d5, rm_arg_w8) + [d_imm]) +addop("sub", [bs("001010"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("syscall", [bs8(0x0f), bs8(0x05)]) +addop("sysenter", [bs8(0x0f), bs8(0x34)]) +addop("sysexit", [bs8(0x0f), bs8(0x35)]) +addop("sysret", [bs8(0x0f), bs8(0x07)]) +addop("test", [bs("1010100"), w8, d_eax, d_imm]) +addop("test", [bs("1111011"), w8] + rmmod(d0, rm_arg_w8) + [d_imm]) +addop("test", [bs("1000010"), w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) +addop("ud2", [bs8(0x0f), bs8(0x0b)]) +addop("verr", [bs8(0x0f), bs8(0x00)] + rmmod(d4)) +addop("verw", [bs8(0x0f), bs8(0x00)] + rmmod(d5)) +addop("wbind", [bs8(0x0f), bs8(0x09)]) +addop("wrmsr", [bs8(0x0f), bs8(0x30)]) +addop("xadd", [bs8(0x0f), bs("1100000"), w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + +addop("nop", [bs8(0x90)], alias=True) + +addop("xchg", [bs('10010'), d_eax, reg]) +addop("xchg", [bs('1000011'), w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) +addop("xlat", [bs8(0xd7)]) + + +addop("xor", [bs("0011010"), w8, d_eax, d_imm]) +addop("xor", [bs("100000"), se, w8] + rmmod(d6, rm_arg_w8) + [d_imm]) +addop("xor", [bs("001100"), swapargs, w8] + + rmmod(rmreg, rm_arg_w8), [rm_arg_w8, rmreg]) + + +# xorps_name = {16:'XORPD', 32:'XORPS', 64:'XORPS'} +# bs_xorps_name = bs_modname_size(l=0, name=xorps_name) +# addop("xorps", [bs8(0x0f), bs8(0x57), xmm] + rmmod(rmreg) + [ +# bs_xorps_name] ) +addop("xorpd", [bs8(0x0f), bs8(0x57), xmm] + rmmod(rmreg) + [bs_opmode16]) +addop("xorps", [bs8(0x0f), bs8(0x57), xmm] + rmmod(rmreg) + [bs_opmode32]) +addop("xorps", [bs8(0x0f), bs8(0x57), xmm] + rmmod(rmreg) + [bs_opmode64]) + +# movaps_name = {16:'MOVAPD', 32:'MOVAPS', 64:'MOVAPS'} +# bs_movaps_name = bs_modname_size(l=0, name=movaps_name) +# addop("movaps", [bs8(0x0f), bs("0010100"), swapargs, xmm] + rmmod(rmreg, +# rm_arg) + [ bs_movaps_name], [rmreg, rm_arg]) +addop("movapd", [bs8(0x0f), bs("0010100"), swapargs, xmm] + + rmmod(rmreg, rm_arg) + [bs_opmode16], [rmreg, rm_arg]) +addop("movaps", [bs8(0x0f), bs("0010100"), swapargs, xmm] + + rmmod(rmreg, rm_arg) + [bs_opmode32], [rmreg, rm_arg]) +addop("movaps", [bs8(0x0f), bs("0010100"), swapargs, xmm] + + rmmod(rmreg, rm_arg) + [bs_opmode64], [rmreg, rm_arg]) + +mn_x86.bintree = factor_one_bit(mn_x86.bintree) +# mn_x86.bintree = factor_fields_all(mn_x86.bintree) +""" +mod reg r/m + XX XXX XXX + +""" + + +def print_size(e): + print e, e.size + return e diff --git a/miasm2/arch/x86/disasm.py b/miasm2/arch/x86/disasm.py new file mode 100644 index 00000000..7185a973 --- /dev/null +++ b/miasm2/arch/x86/disasm.py @@ -0,0 +1,51 @@ +from miasm2.core.asmbloc import asm_constraint, asm_label, disasmEngine +from miasm2.expression.expression import ExprId +from arch import mn_x86 + + +def cb_x86_callpop(mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + """ + 1000: call 1005 + 1005: pop + """ + if len(cur_bloc.lines) < 1: + return + l = cur_bloc.lines[-1] + if l.name != 'CALL': + return + dst = l.args[0] + if not (isinstance(dst, ExprId) and isinstance(dst.name, asm_label)): + return + if dst.name.offset != l.offset + l.l: + return + l.name = 'PUSH' + # cur_bloc.bto.pop() + cur_bloc.bto[0].c_bto = asm_constraint.c_next + + +cb_x86_funcs = [cb_x86_callpop] + + +def cb_x86_disasm(mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool): + for func in cb_x86_funcs: + func(mn, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool) + + +class dis_x86(disasmEngine): + attrib = None + + def __init__(self, bs=None, **kwargs): + super(dis_x86, self).__init__(mn_x86, self.attrib, bs, **kwargs) + self.dis_bloc_callback = cb_x86_disasm + + +class dis_x86_16(dis_x86): + attrib = 16 + + +class dis_x86_32(dis_x86): + attrib = 32 + + +class dis_x86_64(dis_x86): + attrib = 64 diff --git a/miasm2/arch/x86/ira.py b/miasm2/arch/x86/ira.py new file mode 100644 index 00000000..04cb4cca --- /dev/null +++ b/miasm2/arch/x86/ira.py @@ -0,0 +1,91 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.expression.expression import * +from miasm2.core.graph import DiGraph +from miasm2.ir.ir import ir, irbloc +from miasm2.ir.analysis import ira +from miasm2.arch.x86.sem import ir_x86_16, ir_x86_32, ir_x86_64 + + +class ir_a_x86_16(ir_x86_16, ira): + + def __init__(self, symbol_pool=None): + ir_x86_16.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.AX + + # for test XXX TODO + def set_dead_regs(self, b): + b.rw[-1][1].add(self.arch.regs.zf) + b.rw[-1][1].add(self.arch.regs.of) + b.rw[-1][1].add(self.arch.regs.pf) + b.rw[-1][1].add(self.arch.regs.cf) + b.rw[-1][1].add(self.arch.regs.nf) + b.rw[-1][1].add(self.arch.regs.af) + + def get_out_regs(self, b): + return set([self.ret_reg, self.sp]) + + def add_unused_regs(self): + leaves = [self.blocs[n] for n in self.g.leafs()] + for b in leaves: + self.set_dead_regs(b) + + def call_effects(self, ad): + irs = [[ExprAff(self.ret_reg, ExprOp('call_func_ret', ad, self.sp)), + ExprAff(self.sp, ExprOp('call_func_stack', ad, self.sp)), + ]] + return irs + + def post_add_bloc(self, bloc, ir_blocs): + ir.post_add_bloc(self, bloc, ir_blocs) + if not bloc.lines: + return + l = bloc.lines[-1] + sub_call_dst = None + if not l.is_subcall(): + return + sub_call_dst = l.args[0] + if self.ExprIsLabel(sub_call_dst): + sub_call_dst = sub_call_dst.name + for b in ir_blocs: + l = b.lines[-1] + sub_call_dst = None + if not l.is_subcall(): + continue + sub_call_dst = l.args[0] + if self.ExprIsLabel(sub_call_dst): + sub_call_dst = sub_call_dst.name + lbl = bloc.get_next() + new_lbl = self.gen_label() + irs = self.call_effects(l.args[0]) + nbloc = irbloc(new_lbl, ExprId(lbl, size=self.pc.size), irs) + nbloc.lines = [l] + self.blocs[new_lbl] = nbloc + b.dst = ExprId(new_lbl, size=self.pc.size) + return + + +class ir_a_x86_32(ir_x86_32, ir_a_x86_16): + + def __init__(self, symbol_pool=None): + ir_x86_32.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.EAX + + +class ir_a_x86_64(ir_x86_64, ir_a_x86_16): + + def __init__(self, symbol_pool=None): + ir_x86_64.__init__(self, symbol_pool) + self.ret_reg = self.arch.regs.RAX + + def call_effects(self, ad): + irs = [[ExprAff(self.ret_reg, ExprOp('call_func_ret', ad, self.sp, + self.arch.regs.RCX, + self.arch.regs.RDX, + self.arch.regs.R8, + self.arch.regs.R9, + )), + ExprAff(self.sp, ExprOp('call_func_stack', ad, self.sp)), + ]] + return irs diff --git a/miasm2/arch/x86/regs.py b/miasm2/arch/x86/regs.py new file mode 100644 index 00000000..532b4f0c --- /dev/null +++ b/miasm2/arch/x86/regs.py @@ -0,0 +1,405 @@ +from miasm2.expression.expression import * +from miasm2.core.cpu import reg_info + + +IP = ExprId('IP', 16) +EIP = ExprId('EIP', 32) +RIP = ExprId('RIP', 64) +exception_flags = ExprId('exception_flags', 32) + +# GP + + +regs08_str = ["AL", "CL", "DL", "BL", "AH", "CH", "DH", "BH"] + \ + ["R%dB" % (i + 8) for i in xrange(8)] +regs08_expr = [ExprId(x, 8) for x in regs08_str] + +regs08_64_str = ["AL", "CL", "DL", "BL", "SPL", "BPL", "SIL", "DIL"] + \ + ["R%dB" % (i + 8) for i in xrange(8)] +regs08_64_expr = [ExprId(x, 8) for x in regs08_64_str] + + +regs16_str = ["AX", "CX", "DX", "BX", "SP", "BP", "SI", "DI"] + \ + ["R%dW" % (i + 8) for i in xrange(8)] +regs16_expr = [ExprId(x, 16) for x in regs16_str] + +regs32_str = ["EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", "EDI"] + \ + ["R%dD" % (i + 8) for i in xrange(8)] +regs32_expr = [ExprId(x, 32) for x in regs32_str] + +regs64_str = ["RAX", "RCX", "RDX", "RBX", "RSP", "RBP", "RSI", "RDI", + "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15", + "RIP"] +regs64_expr = [ExprId(x, 64) for x in regs64_str] + + +regs_xmm_str = ["XMM%d" % i for i in xrange(16)] +regs_xmm_expr = [ExprId(x, 128) for x in regs_xmm_str] + +regs_mm_str = ["MM%d" % i for i in xrange(16)] +regs_mm_expr = [ExprId(x, 64) for x in regs_mm_str] + + +gpregs08 = reg_info(regs08_str, regs08_expr) +gpregs08_64 = reg_info(regs08_64_str, regs08_64_expr) +gpregs16 = reg_info(regs16_str, regs16_expr) +gpregs32 = reg_info(regs32_str, regs32_expr) +gpregs64 = reg_info(regs64_str, regs64_expr) + +gpregs_xmm = reg_info(regs_xmm_str, regs_xmm_expr) +gpregs_mm = reg_info(regs_mm_str, regs_mm_expr) + +r08_eax = reg_info([regs08_str[0]], [regs08_expr[0]]) +r16_eax = reg_info([regs16_str[0]], [regs16_expr[0]]) +r32_eax = reg_info([regs32_str[0]], [regs32_expr[0]]) +r64_eax = reg_info([regs64_str[0]], [regs64_expr[0]]) + +r08_ecx = reg_info([regs08_str[1]], [regs08_expr[1]]) + +r_eax_all = reg_info( + [regs08_str[0], regs16_str[0], regs32_str[0], regs64_str[0]], + [regs08_expr[0], regs16_expr[0], regs32_expr[0], regs64_expr[0]]) +r_edx_all = reg_info( + [regs08_str[2], regs16_str[2], regs32_str[2], regs64_str[2]], + [regs08_expr[2], regs16_expr[2], regs32_expr[2], regs64_expr[2]]) + +r16_edx = reg_info([regs16_str[2]], [regs16_expr[2]]) + + +selectr_str = ["ES", "CS", "SS", "DS", "FS", "GS"] +selectr_expr = [ExprId(x, 16) for x in selectr_str] +segmreg = reg_info(selectr_str, selectr_expr) + +crregs32_str = ["CR%d" % i for i in xrange(8)] +crregs32_expr = [ExprId(x, 32) for x in crregs32_str] +crregs = reg_info(crregs32_str, crregs32_expr) + + +drregs32_str = ["DR%d" % i for i in xrange(8)] +drregs32_expr = [ExprId(x, 32) for x in drregs32_str] +drregs = reg_info(drregs32_str, drregs32_expr) + + +fltregs32_str = ["ST(%d)" % i for i in xrange(8)] +fltregs32_expr = [ExprId(x, 64) for x in fltregs32_str] +fltregs = reg_info(fltregs32_str, fltregs32_expr) + +r_st_all = reg_info(['ST'], + [ExprId('ST', 64)]) + +r_cs_all = reg_info(['CS'], + [ExprId('CS', 16)]) +r_ds_all = reg_info(['DS'], + [ExprId('DS', 16)]) +r_es_all = reg_info(['ES'], + [ExprId('ES', 16)]) +r_ss_all = reg_info(['SS'], + [ExprId('SS', 16)]) +r_fs_all = reg_info(['FS'], + [ExprId('FS', 16)]) +r_gs_all = reg_info(['GS'], + [ExprId('GS', 16)]) + + +AL = regs08_expr[0] +CL = regs08_expr[1] +DL = regs08_expr[2] +BL = regs08_expr[3] +AH = regs08_expr[4] +CH = regs08_expr[5] +DH = regs08_expr[6] +BH = regs08_expr[7] +R8B = regs08_expr[8] +R9B = regs08_expr[9] +R10B = regs08_expr[10] +R11B = regs08_expr[11] +R12B = regs08_expr[12] +R13B = regs08_expr[13] +R14B = regs08_expr[14] +R15B = regs08_expr[15] +R15B = regs08_expr[15] + +SPL = regs08_64_expr[4] +BPL = regs08_64_expr[5] +SIL = regs08_64_expr[6] +DIL = regs08_64_expr[7] + + +AX = regs16_expr[0] +CX = regs16_expr[1] +DX = regs16_expr[2] +BX = regs16_expr[3] +SP = regs16_expr[4] +BP = regs16_expr[5] +SI = regs16_expr[6] +DI = regs16_expr[7] +R8W = regs16_expr[8] +R9W = regs16_expr[9] +R10W = regs16_expr[10] +R11W = regs16_expr[11] +R12W = regs16_expr[12] +R13W = regs16_expr[13] +R14W = regs16_expr[14] +R15W = regs16_expr[15] + + +EAX = regs32_expr[0] +ECX = regs32_expr[1] +EDX = regs32_expr[2] +EBX = regs32_expr[3] +ESP = regs32_expr[4] +EBP = regs32_expr[5] +ESI = regs32_expr[6] +EDI = regs32_expr[7] +R8D = regs32_expr[8] +R9D = regs32_expr[9] +R10D = regs32_expr[10] +R11D = regs32_expr[11] +R12D = regs32_expr[12] +R13D = regs32_expr[13] +R14D = regs32_expr[14] +R15D = regs32_expr[15] + + +RAX = regs64_expr[0] +RCX = regs64_expr[1] +RDX = regs64_expr[2] +RBX = regs64_expr[3] +RSP = regs64_expr[4] +RBP = regs64_expr[5] +RSI = regs64_expr[6] +RDI = regs64_expr[7] +R8 = regs64_expr[8] +R9 = regs64_expr[9] +R10 = regs64_expr[10] +R11 = regs64_expr[11] +R12 = regs64_expr[12] +R13 = regs64_expr[13] +R14 = regs64_expr[14] +R15 = regs64_expr[15] + + +reg_zf = 'zf' +reg_nf = 'nf' +reg_pf = 'pf' +reg_of = 'of' +reg_cf = 'cf' +reg_tf = 'tf' +reg_if = 'i_f' +reg_df = 'df' +reg_af = 'af' +reg_iopl = 'iopl_f' +reg_nt = 'nt' +reg_rf = 'rf' +reg_vm = 'vm' +reg_ac = 'ac' +reg_vif = 'vif' +reg_vip = 'vip' +reg_id = 'i_d' + + +reg_es = "ES" +reg_cs = "CS" +reg_ss = "SS" +reg_ds = "DS" +reg_fs = "FS" +reg_gs = "GS" + +reg_dr0 = 'DR0' +reg_dr1 = 'DR1' +reg_dr2 = 'DR2' +reg_dr3 = 'DR3' +reg_dr4 = 'DR4' +reg_dr5 = 'DR5' +reg_dr6 = 'DR6' +reg_dr7 = 'DR7' + +reg_cr0 = 'CR0' +reg_cr1 = 'CR1' +reg_cr2 = 'CR2' +reg_cr3 = 'CR3' +reg_cr4 = 'CR4' +reg_cr5 = 'CR5' +reg_cr6 = 'CR6' +reg_cr7 = 'CR7' + +reg_mm0 = 'MM0' +reg_mm1 = 'MM1' +reg_mm2 = 'MM2' +reg_mm3 = 'MM3' +reg_mm4 = 'MM4' +reg_mm5 = 'MM5' +reg_mm6 = 'MM6' +reg_mm7 = 'MM7' + + +reg_tsc1 = "tsc1" +reg_tsc2 = "tsc2" + +reg_float_c0 = 'float_c0' +reg_float_c1 = 'float_c1' +reg_float_c2 = 'float_c2' +reg_float_c3 = 'float_c3' +reg_float_stack_ptr = "float_stack_ptr" +reg_float_control = 'reg_float_control' +reg_float_eip = 'reg_float_eip' +reg_float_cs = 'reg_float_cs' +reg_float_address = 'reg_float_address' +reg_float_ds = 'reg_float_ds' + + +reg_float_st0 = 'float_st0' +reg_float_st1 = 'float_st1' +reg_float_st2 = 'float_st2' +reg_float_st3 = 'float_st3' +reg_float_st4 = 'float_st4' +reg_float_st5 = 'float_st5' +reg_float_st6 = 'float_st6' +reg_float_st7 = 'float_st7' + + +dr0 = ExprId(reg_dr0) +dr1 = ExprId(reg_dr1) +dr2 = ExprId(reg_dr2) +dr3 = ExprId(reg_dr3) +dr4 = ExprId(reg_dr4) +dr5 = ExprId(reg_dr5) +dr6 = ExprId(reg_dr6) +dr7 = ExprId(reg_dr7) + +cr0 = ExprId(reg_cr0) +cr1 = ExprId(reg_cr1) +cr2 = ExprId(reg_cr2) +cr3 = ExprId(reg_cr3) +cr4 = ExprId(reg_cr4) +cr5 = ExprId(reg_cr5) +cr6 = ExprId(reg_cr6) +cr7 = ExprId(reg_cr7) + +mm0 = ExprId(reg_mm0, 64) +mm1 = ExprId(reg_mm1, 64) +mm2 = ExprId(reg_mm2, 64) +mm3 = ExprId(reg_mm3, 64) +mm4 = ExprId(reg_mm4, 64) +mm5 = ExprId(reg_mm5, 64) +mm6 = ExprId(reg_mm6, 64) +mm7 = ExprId(reg_mm7, 64) + + +# tmp1= ExprId(reg_tmp1) +zf = ExprId(reg_zf, size=1) +nf = ExprId(reg_nf, size=1) +pf = ExprId(reg_pf, size=1) +of = ExprId(reg_of, size=1) +cf = ExprId(reg_cf, size=1) +tf = ExprId(reg_tf, size=1) +i_f = ExprId(reg_if, size=1) +df = ExprId(reg_df, size=1) +af = ExprId(reg_af, size=1) +iopl = ExprId(reg_iopl, size=2) +nt = ExprId(reg_nt, size=1) +rf = ExprId(reg_rf, size=1) +vm = ExprId(reg_vm, size=1) +ac = ExprId(reg_ac, size=1) +vif = ExprId(reg_vif, size=1) +vip = ExprId(reg_vip, size=1) +i_d = ExprId(reg_id, size=1) + +ES = ExprId(reg_es, size=16) +CS = ExprId(reg_cs, size=16) +SS = ExprId(reg_ss, size=16) +DS = ExprId(reg_ds, size=16) +FS = ExprId(reg_fs, size=16) +GS = ExprId(reg_gs, size=16) + +tsc1 = ExprId(reg_tsc1, size=32) +tsc2 = ExprId(reg_tsc2, size=32) + +float_c0 = ExprId(reg_float_c0, size=1) +float_c1 = ExprId(reg_float_c1, size=1) +float_c2 = ExprId(reg_float_c2, size=1) +float_c3 = ExprId(reg_float_c3, size=1) +float_stack_ptr = ExprId(reg_float_stack_ptr, size=3) +float_control = ExprId(reg_float_control, 16) +float_eip = ExprId(reg_float_eip) +float_cs = ExprId(reg_float_cs, size=16) +float_address = ExprId(reg_float_address) +float_ds = ExprId(reg_float_ds, size=16) + +float_st0 = ExprId(reg_float_st0, 64) +float_st1 = ExprId(reg_float_st1, 64) +float_st2 = ExprId(reg_float_st2, 64) +float_st3 = ExprId(reg_float_st3, 64) +float_st4 = ExprId(reg_float_st4, 64) +float_st5 = ExprId(reg_float_st5, 64) +float_st6 = ExprId(reg_float_st6, 64) +float_st7 = ExprId(reg_float_st7, 64) + +EAX_init = ExprId('EAX_init') +EBX_init = ExprId('EBX_init') +ECX_init = ExprId('ECX_init') +EDX_init = ExprId('EDX_init') +ESI_init = ExprId('ESI_init') +EDI_init = ExprId('EDI_init') +ESP_init = ExprId('ESP_init') +EBP_init = ExprId('EBP_init') + + +RAX_init = ExprId('RAX_init', 64) +RBX_init = ExprId('RBX_init', 64) +RCX_init = ExprId('RCX_init', 64) +RDX_init = ExprId('RDX_init', 64) +RSI_init = ExprId('RSI_init', 64) +RDI_init = ExprId('RDI_init', 64) +RSP_init = ExprId('RSP_init', 64) +RBP_init = ExprId('RBP_init', 64) + + +all_regs_ids = [ + AL, CL, DL, BL, AH, CH, DH, BH, + R8B, R9B, R10B, R11B, R12B, R13B, R14B, R15B, R15B, + SPL, BPL, SIL, DIL, + AX, CX, DX, BX, SP, BP, SI, DI, + R8W, R9W, R10W, R11W, R12W, R13W, R14W, R15W, + IP, + EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI, + R8D, R9D, R10D, R11D, R12D, R13D, R14D, R15D, + EIP, + + RAX, RBX, RCX, RDX, RSP, RBP, RIP, RSI, RDI, + R8, R9, R10, R11, R12, R13, R14, R15, R15, + zf, nf, pf, of, cf, af, df, + tf, i_f, iopl, nt, rf, vm, ac, vif, vip, i_d, + float_control, float_eip, float_cs, float_address, float_ds, + tsc1, tsc2, + ES, CS, SS, DS, FS, GS, + float_st0, float_st1, float_st2, float_st3, + float_st4, float_st5, float_st6, float_st7, + float_c0, float_c1, float_c2, float_c3, + cr0, cr3, + dr0, dr1, dr2, dr3, dr4, dr5, dr6, dr7, + float_stack_ptr, + mm0, mm1, mm2, mm3, mm4, mm5, mm6, mm7, + + exception_flags, +] + fltregs32_expr + +all_regs_ids_byname = dict([(x.name, x) for x in all_regs_ids]) + +all_regs_ids_init = [ExprId("%s_init" % x.name, x.size) for x in all_regs_ids] + +regs_init = {} +for i, r in enumerate(all_regs_ids): + all_regs_ids_init[i].is_term = True + regs_init[r] = all_regs_ids_init[i] + + +mRAX = {16: AX, 32: EAX, 64: RAX} +mRBX = {16: BX, 32: EBX, 64: RBX} +mRCX = {16: CX, 32: ECX, 64: RCX} +mRDX = {16: DX, 32: EDX, 64: RDX} +mRSI = {16: SI, 32: ESI, 64: RSI} +mRDI = {16: DI, 32: EDI, 64: RDI} +mRBP = {16: BP, 32: EBP, 64: RBP} +mRSP = {16: SP, 32: ESP, 64: RSP} +mRIP = {16: IP, 32: EIP, 64: RIP} diff --git a/miasm2/arch/x86/sem.py b/miasm2/arch/x86/sem.py new file mode 100644 index 00000000..4b8a357b --- /dev/null +++ b/miasm2/arch/x86/sem.py @@ -0,0 +1,3029 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# + +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from miasm2.arch.x86.regs import * +from miasm2.arch.x86.arch import mn_x86, repeat_mn, replace_regs +from miasm2.core.asmbloc import expr_is_int_or_label +from miasm2.ir.ir import ir, irbloc +import math +import struct +from regs import * + +# interrupt with eip update after instr +EXCEPT_SOFT_BP = (1 << 1) +EXCEPT_INT_XX = (1 << 2) + +EXCEPT_BREAKPOINT_INTERN = (1 << 10) + +EXCEPT_NUM_UPDT_EIP = (1 << 11) +# interrupt with eip at instr +EXCEPT_UNK_MEM_AD = (1 << 12) +EXCEPT_THROW_SEH = (1 << 13) +EXCEPT_UNK_EIP = (1 << 14) +EXCEPT_ACCESS_VIOL = (1 << 14) +EXCEPT_INT_DIV_BY_ZERO = (1 << 16) +EXCEPT_PRIV_INSN = (1 << 17) +EXCEPT_ILLEGAL_INSN = (1 << 18) +EXCEPT_UNK_MNEMO = (1 << 19) + + +""" +http://www.emulators.com/docs/nx11_flags.htm + +CF(A+B) = (((A XOR B) XOR D) < 0) XOR (((A XOR D) AND NOT (A XOR B)) < 0) +CF(A-B) = (((A XOR B) XOR D) < 0) XOR (((A XOR D) AND (A XOR B)) < 0) + +OF(A+B) = ((A XOR D) AND NOT (A XOR B)) < 0 +OF(A-B) = ((A XOR D) AND (A XOR B)) < 0 +""" + + +float_list = [ + float_st0, + float_st1, + float_st2, + float_st3, + float_st4, + float_st5, + float_st6, + float_st7, +] + + +# XXX TODO make default check against 0 or not 0 (same eq as in C) + + +def update_flag_zf(a): + return [ExprAff(zf, ExprCond(a, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))] + + +def update_flag_nf(a): + return [ExprAff(nf, a.msb())] + + +def update_flag_pf(a): + return [ExprAff(pf, ExprOp('parity', a & ExprInt_from(a, 0xFF)))] + + +def update_flag_af(a): + return [ExprAff(af, ExprCond((a & ExprInt_from(a, 0x10)), + ExprInt_from(af, 1), ExprInt_from(af, 0)))] + + +def update_flag_znp(a): + e = [] + e += update_flag_zf(a) + e += update_flag_nf(a) + e += update_flag_pf(a) + return e + + +def update_flag_logic(a): + e = [] + e += update_flag_znp(a) + e.append(ExprAff(of, ExprInt_from(of, 0))) + e.append(ExprAff(cf, ExprInt_from(cf, 0))) + return e + + +def update_flag_arith(a): + e = [] + e += update_flag_znp(a) + return e + + +def check_ops_msb(a, b, c): + if not a or not b or not c or a != b or a != c: + raise ValueError('bad ops size %s %s %s' % (a, b, c)) + + +def arith_flag(a, b, c): + a_s, b_s, c_s = a.size, b.size, c.size + check_ops_msb(a_s, b_s, c_s) + a_s, b_s, c_s = a.msb(), b.msb(), c.msb() + return a_s, b_s, c_s + +# checked: ok for adc add because b & c before +cf + + +def update_flag_add_cf(a, b, c): + return ExprAff(cf, (((a ^ b) ^ c) ^ ((a ^ c) & (~(a ^ b)))).msb()) + + +def update_flag_add_of(a, b, c): + return ExprAff(of, (((a ^ c) & (~(a ^ b)))).msb()) + + +# checked: ok for sbb add because b & c before +cf +def update_flag_sub_cf(a, b, c): + return ExprAff(cf, (((a ^ b) ^ c) ^ ((a ^ c) & (a ^ b))).msb()) + + +def update_flag_sub_of(a, b, c): + return ExprAff(of, (((a ^ c) & (a ^ b))).msb()) + +# z = x+y (+cf?) + + +def update_flag_add(x, y, z): + e = [] + e.append(update_flag_add_cf(x, y, z)) + e.append(update_flag_add_of(x, y, z)) + return e + +# z = x-y (+cf?) + + +def update_flag_sub(x, y, z): + e = [] + e.append(update_flag_sub_cf(x, y, z)) + e.append(update_flag_sub_of(x, y, z)) + return e + + +def set_float_cs_eip(instr): + e = [] + # XXX TODO check float updt + e.append(ExprAff(float_eip, ExprInt_from(float_eip, instr.offset))) + e.append(ExprAff(float_cs, CS)) + return e + + +def mov(ir, instr, a, b): + if a in [ES, CS, SS, DS, FS, GS]: + b = b[:a.size] + if b in [ES, CS, SS, DS, FS, GS]: + b = b.zeroExtend(a.size) + e = [ExprAff(a, b)] + return None, e, [] + + +def xchg(ir, instr, a, b): + e = [] + e.append(ExprAff(a, b)) + e.append(ExprAff(b, a)) + return None, e, [] + + +def movzx(ir, instr, a, b): + e = [ExprAff(a, b.zeroExtend(a.size))] + return None, e, [] + + +def movsx(ir, instr, a, b): + e = [ExprAff(a, b.signExtend(a.size))] + return None, e, [] + + +def lea(ir, instr, a, b): + src = b.arg + if src.size > a.size: + src = src[:a.size] + e = [ExprAff(a, src)] + return None, e, [] + + +def add(ir, instr, a, b): + e = [] + c = a + b + e += update_flag_arith(c) + e += update_flag_af(c) + e += update_flag_add(a, b, c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def xadd(ir, instr, a, b): + e = [] + c = a + b + e += update_flag_arith(c) + e += update_flag_af(c) + e += update_flag_add(b, a, c) + e.append(ExprAff(b, a)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def adc(ir, instr, a, b): + e = [] + c = a + (b + ExprCompose([(ExprInt_fromsize(a.size - 1, 0), 1, a.size), + (cf, 0, 1)])) + e += update_flag_arith(c) + e += update_flag_af(c) + e += update_flag_add(a, b, c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def sub(ir, instr, a, b): + e = [] + c = a - b + e += update_flag_arith(c) + e += update_flag_af(c) + e += update_flag_sub(a, b, c) + e.append(ExprAff(a, c)) + return None, e, [] + +# a-(b+cf) + + +def sbb(ir, instr, a, b): + e = [] + c = a - (b + ExprCompose([(ExprInt_fromsize(a.size - 1, 0), 1, a.size), + (cf, 0, 1)])) + e += update_flag_arith(c) + e += update_flag_af(c) + e += update_flag_sub(a, b, c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def neg(ir, instr, b): + e = [] + a = ExprInt_from(b, 0) + + c = a - b + e += update_flag_arith(c) + e += update_flag_sub(a, b, c) + e += update_flag_af(c) + e.append(ExprAff(b, c)) + return None, e, [] + + +def l_not(ir, instr, b): + e = [] + c = ~b + e.append(ExprAff(b, c)) + return None, e, [] + + +def l_cmp(ir, instr, a, b): + e = [] + c = a - b + e += update_flag_arith(c) + e += update_flag_sub(a, b, c) + e += update_flag_af(c) + return None, e, [] + + +def xor(ir, instr, a, b): + e = [] + c = a ^ b + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def l_or(ir, instr, a, b): + e = [] + c = a | b + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def l_and(ir, instr, a, b): + e = [] + c = a & b + e += update_flag_logic(c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def l_test(ir, instr, a, b): + e = [] + c = a & b + e += update_flag_logic(c) + return None, e, [] + + +def l_rol(ir, instr, a, b): + e = [] + b = b.zeroExtend(a.size) + c = ExprOp('<<<', a, b) + + new_cf = c[:1] + e.append(ExprAff(cf, new_cf)) + # hack (only valid if b=1) + e.append(ExprAff(of, c.msb() ^ new_cf)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def l_ror(ir, instr, a, b): + e = [] + b = b.zeroExtend(a.size) + c = ExprOp('>>>', a, b) + + e.append(ExprAff(cf, c.msb())) + # hack (only valid if b=1): when count == 1: a = msb-1(dest) + e.append(ExprAff(of, (c ^ a).msb())) + e.append(ExprAff(a, c)) + return None, e, [] + + +def rcl(ir, instr, a, b): + e = [] + b = b.zeroExtend(a.size) + c = ExprOp('<<<c_rez', a, b, cf.zeroExtend(a.size)) + new_cf = ExprOp('<<<c_cf', a, b, cf.zeroExtend(a.size))[:1] + + e.append(ExprAff(cf, new_cf)) + # hack (only valid if b=1) + e.append(ExprAff(of, c.msb() ^ new_cf)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def rcr(ir, instr, a, b): + e = [] + b = b.zeroExtend(a.size) + c = ExprOp('>>>c_rez', a, b, cf.zeroExtend(a.size)) + new_cf = ExprOp('>>>c_cf', a, b, cf.zeroExtend(a.size))[:1] + + e.append(ExprAff(cf, new_cf)) + # hack (only valid if b=1) + e.append(ExprAff(of, (a ^ c).msb())) + e.append(ExprAff(a, c)) + + return None, e, [] + + +def get_shift(a, b): + # b.size must match a + b = b.zeroExtend(a.size) + if a.size == 64: + shift = b & ExprInt_from(b, 0x3f) + else: + shift = b & ExprInt_from(b, 0x1f) + shift = expr_simp(shift) + return shift + + +def sar(ir, instr, a, b): + + shifter = get_shift(a, b) + c = ExprOp('a>>', a, shifter) + + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + + new_cf = ExprOp('a>>', a, (shifter - ExprInt_from(a, 1)))[:1] + + e_do = [ + ExprAff(cf, new_cf), + ExprAff(of, ExprInt_from(of, 0)), + ExprAff(a, c) + ] + + e_do += update_flag_znp(c) + + # dont generate conditional shifter on constant + if isinstance(shifter, ExprInt): + if int(shifter.arg) != 0: + return None, e_do, [] + else: + raise NotImplementedError("TODO check me") + + return ExprCond(shifter, lbl_do, lbl_skip), + [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def shr(ir, instr, a, b): + e = [] + # TODO FIX AS SAR! + shifter = get_shift(a, b) + c = ExprOp('>>', a, shifter) + + new_cf = ExprOp('>>', a, (shifter - ExprInt_from(a, 1)))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + e.append(ExprAff(of, a.msb())) + e += update_flag_znp(c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def shrd_cl(ir, instr, a, b): + e = [] + opmode, admode = s, instr.v_admode() + shifter = mRCX[instr.mode][:8].zeroExtend(a.size) & ExprInt_from(a, 0x1f) + c = (a >> shifter) | (b << (ExprInt_from(a, a.size) - shifter)) + new_cf = (a >> (shifter - ExprInt_from(a, 1)))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + e.append(ExprAff(of, a.msb())) + e += update_flag_znp(c) + e.append(ExprAff(a, c)) + return None, e, [] + + +def shrd(ir, instr, a, b, c): + e = [] + shifter = get_shift(a, c) + + d = (a >> shifter) | (b << (ExprInt_from(a, a.size) - shifter)) + new_cf = (a >> (shifter - ExprInt_from(a, 1)))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + e.append(ExprAff(of, a.msb())) + e += update_flag_znp(d) + e.append(ExprAff(a, d)) + return None, e, [] + + +def sal(ir, instr, a, b): + e = [] + shifter = get_shift(a, b) + c = ExprOp('a<<', a, shifter) + new_cf = (a >> (ExprInt_from(a, a.size) - shifter))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + e += update_flag_znp(c) + e.append(ExprAff(of, c.msb() ^ new_cf)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def shl(ir, instr, a, b): + e = [] + shifter = get_shift(a, b) + c = a << shifter + new_cf = (a >> (ExprInt_from(a, a.size) - shifter))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + e += update_flag_znp(c) + e.append(ExprAff(of, c.msb() ^ new_cf)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def shld_cl(ir, instr, a, b): + return shld(ir, instr, a, b, ecx) + + +def shld(ir, instr, a, b, c): + e = [] + shifter = c.zeroExtend(a.size) & ExprInt_from(a, 0x1f) + c = ExprOp('|', + a << shifter, + b >> (ExprInt_from(a, a.size) - shifter) + ) + + new_cf = (a >> (ExprInt_from(a, a.size) - shifter))[:1] + e.append(ExprAff(cf, ExprCond(shifter, + new_cf, + cf) + ) + ) + # XXX todo: don't update flag if shifter is 0 + e += update_flag_znp(c) + e.append(ExprAff(of, c.msb() ^ new_cf)) + e.append(ExprAff(a, ExprCond(shifter, + c, + a))) + return None, e, [] + + +# XXX todo ### +def cmc(ir, instr): + e = [ExprAff(cf, ExprCond(cf, ExprInt_from(cf, 0), ExprInt_from(cf, 1)))] + return None, e, [] + + +def clc(ir, instr): + e = [ExprAff(cf, ExprInt_from(cf, 0))] + return None, e, [] + + +def stc(ir, instr): + e = [ExprAff(cf, ExprInt_from(cf, 1))] + return None, e, [] + + +def cld(ir, instr): + e = [ExprAff(df, ExprInt_from(df, 0))] + return None, e, [] + + +def std(ir, instr): + e = [ExprAff(df, ExprInt_from(df, 1))] + return None, e, [] + + +def cli(ir, instr): + e = [ExprAff(i_f, ExprInt_from(i_f, 0))] + return None, e, [] + + +def sti(ir, instr): + e = [ExprAff(exception_flags, ExprInt32(EXCEPT_PRIV_INSN))] + e = [] # XXX TODO HACK + return None, e, [] + + +def inc(ir, instr, a): + e = [] + b = ExprInt_from(a, 1) + c = a + b + e += update_flag_arith(c) + e += update_flag_af(c) + + e.append(update_flag_add_of(a, b, c)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def dec(ir, instr, a): + e = [] + b = ExprInt_from(a, -1) + c = a + b + e += update_flag_arith(c) + e += update_flag_af(c) + + e.append(update_flag_add_of(a, b, c)) + e.append(ExprAff(a, c)) + return None, e, [] + + +def push(ir, instr, a): + e = [] + s = instr.mode + size = instr.v_opmode() + opmode, admode = s, instr.v_admode() + # special case segment regs + if a in [ES, CS, SS, DS, FS, GS]: + pass + if not s in [16, 32, 64]: + raise ValueError('bad size stacker!') + if isinstance(a, ExprInt): + a = ExprInt_fromsize(s, a.arg) + + c = mRSP[instr.mode][:s] - ExprInt_fromsize(s, s / 8) + e.append(ExprAff(mRSP[instr.mode][:s], c)) + # we sub vopmode to stack, but mem access is arg size wide + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(ExprMem(c, a.size), a)) + return None, e, [] + + +def pop(ir, instr, a): + e = [] + s = instr.mode + size = instr.v_opmode() + opmode, admode = s, instr.v_admode() + # special case segment regs + if a in [ES, CS, SS, DS, FS, GS]: + s = admode + if not s in [16, 32, 64]: + raise ValueError('bad size stacker!') + new_esp = mRSP[instr.mode][:s] + ExprInt_fromsize(s, s / 8) + e.append(ExprAff(mRSP[instr.mode][:s], new_esp)) + # XXX FIX XXX for pop [esp] + if isinstance(a, ExprMem): + a = a.replace_expr({mRSP[instr.mode]: new_esp}) + c = mRSP[instr.mode][:s] + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(a, ExprMem(c, a.size))) + return None, e, [] + + +def sete(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(zf, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def setnz(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(zf, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def setl(ir, instr, a): + e = [] + e.append( + ExprAff(a, ExprCond(nf - of, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def setg(ir, instr, a): + e = [] + a0 = ExprInt_from(a, 0) + a1 = ExprInt_from(a, 1) + e.append(ExprAff(a, ExprCond(zf, a0, a1) & ExprCond(nf - of, a0, a1))) + return None, e, [] + + +def setge(ir, instr, a): + e = [] + e.append( + ExprAff(a, ExprCond(nf - of, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def seta(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf | zf, + ExprInt_from(a, 0), + ExprInt_from(a, 1)))) + + return None, e, [] + + +def setae(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def setb(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def setbe(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf | zf, + ExprInt_from(a, 1), + ExprInt_from(a, 0))) + ) + return None, e, [] + + +def setns(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(nf, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def sets(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(nf, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def seto(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(of, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def setp(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(pf, ExprInt_from(a, 1), ExprInt_from(a, 0)))) + return None, e, [] + + +def setnp(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(pf, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def setle(ir, instr, a): + e = [] + a0 = ExprInt_from(a, 0) + a1 = ExprInt_from(a, 1) + e.append(ExprAff(a, ExprCond(zf, a1, a0) | ExprCond(nf ^ of, a1, a0))) + return None, e, [] + + +def setna(ir, instr, a): + e = [] + a0 = ExprInt_from(a, 0) + a1 = ExprInt_from(a, 1) + e.append(ExprAff(a, ExprCond(cf, a1, a0) & ExprCond(zf, a1, a0))) + return None, e, [] + + +def setnbe(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf | zf, + ExprInt_from(a, 0), + ExprInt_from(a, 1))) + ) + return None, e, [] + + +def setno(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(of, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def setnb(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprCond(cf, ExprInt_from(a, 0), ExprInt_from(a, 1)))) + return None, e, [] + + +def setalc(ir, instr): + a = mRAX[instr.mode][0:8] + e = [] + e.append( + ExprAff(a, ExprCond(cf, ExprInt_from(a, 0xff), ExprInt_from(a, 0)))) + return None, e, [] + + +def bswap(ir, instr, a): + e = [] + if a.size == 16: + c = ExprCompose([(a[:8], 8, 16), + (a[8:16], 0, 8), + ]) + elif a.size == 32: + c = ExprCompose([(a[:8], 24, 32), + (a[8:16], 16, 24), + (a[16:24], 8, 16), + (a[24:32], 0, 8), + ]) + elif a.size == 64: + c = ExprCompose([(a[:8], 56, 64), + (a[8:16], 48, 56), + (a[16:24], 40, 48), + (a[24:32], 32, 40), + (a[32:40], 24, 32), + (a[40:48], 16, 24), + (a[48:56], 8, 16), + (a[56:64], 0, 8), + ]) + else: + raise ValueError('the size DOES matter') + e.append(ExprAff(a, c)) + return None, e, [] + + +def cmps(ir, instr, size): + lbl_cmp = ExprId(ir.gen_label(), instr.mode) + lbl_df_0 = ExprId(ir.gen_label(), instr.mode) + lbl_df_1 = ExprId(ir.gen_label(), instr.mode) + lbl_next = ExprId(ir.get_next_label(instr), instr.mode) + + s = instr.v_admode() + a = ExprMem(mRDI[instr.mode][:s], size) + b = ExprMem(mRSI[instr.mode][:s], size) + + dummy, e, extra = l_cmp(ir, instr, a, b) + + e0 = [] + e0.append(ExprAff(a.arg, a.arg + ExprInt_from(a.arg, size / 8))) + e0.append(ExprAff(b.arg, b.arg + ExprInt_from(b.arg, size / 8))) + e0 = irbloc(lbl_df_0.name, lbl_next, [e0]) + + e1 = [] + e1.append(ExprAff(a.arg, a.arg - ExprInt_from(a.arg, size / 8))) + e1.append(ExprAff(b.arg, b.arg - ExprInt_from(b.arg, size / 8))) + e1 = irbloc(lbl_df_1.name, lbl_next, [e1]) + + return ExprCond(df, lbl_df_1, lbl_df_0), e, [e0, e1] + + +def scas(ir, instr, size): + lbl_cmp = ExprId(ir.gen_label(), instr.mode) + lbl_df_0 = ExprId(ir.gen_label(), instr.mode) + lbl_df_1 = ExprId(ir.gen_label(), instr.mode) + lbl_next = ExprId(ir.get_next_label(instr), instr.mode) + + s = instr.v_admode() + a = ExprMem(mRDI[instr.mode][:s], size) + + dummy, e, extra = l_cmp(ir, instr, mRAX[instr.mode][:size], a) + + e0 = [] + e0.append(ExprAff(a.arg, a.arg + ExprInt_from(a.arg, size / 8))) + e0 = irbloc(lbl_df_0.name, lbl_next, [e0]) + + e1 = [] + e1.append(ExprAff(a.arg, a.arg - ExprInt_from(a.arg, size / 8))) + e1 = irbloc(lbl_df_1.name, lbl_next, [e1]) + + return ExprCond(df, lbl_df_1, lbl_df_0), e, [e0, e1] + + +def compose_eflag(s=32): + args = [] + + regs = [cf, ExprInt1(1), pf, ExprInt1( + 0), af, ExprInt1(0), zf, nf, tf, i_f, df, of] + for i in xrange(len(regs)): + args.append((regs[i], i, i + 1)) + + args.append((iopl, 12, 14)) + + if s == 32: + regs = [nt, ExprInt1(0), rf, vm, ac, vif, vip, i_d] + elif s == 16: + regs = [nt, ExprInt1(0)] + else: + raise ValueError('unk size') + for i in xrange(len(regs)): + args.append((regs[i], i + 14, i + 15)) + if s == 32: + args.append((ExprInt_fromsize(10, 0), 22, 32)) + return ExprCompose(args) + + +def pushfd(ir, instr): + return push(ir, instr, compose_eflag()) + + +def pushfw(ir, instr): + return push(ir, instr, compose_eflag(16)) + + +def popfd(ir, instr): + tmp = ExprMem(mRSP[instr.mode]) + e = [] + e.append(ExprAff(cf, ExprSlice(tmp, 0, 1))) + e.append(ExprAff(pf, ExprSlice(tmp, 2, 3))) + e.append(ExprAff(af, ExprSlice(tmp, 4, 5))) + e.append(ExprAff(zf, ExprSlice(tmp, 6, 7))) + e.append(ExprAff(nf, ExprSlice(tmp, 7, 8))) + e.append(ExprAff(tf, ExprSlice(tmp, 8, 9))) + e.append(ExprAff(i_f, ExprSlice(tmp, 9, 10))) + e.append(ExprAff(df, ExprSlice(tmp, 10, 11))) + e.append(ExprAff(of, ExprSlice(tmp, 11, 12))) + e.append(ExprAff(iopl, ExprSlice(tmp, 12, 14))) + e.append(ExprAff(nt, ExprSlice(tmp, 14, 15))) + e.append(ExprAff(rf, ExprSlice(tmp, 16, 17))) + e.append(ExprAff(vm, ExprSlice(tmp, 17, 18))) + e.append(ExprAff(ac, ExprSlice(tmp, 18, 19))) + e.append(ExprAff(vif, ExprSlice(tmp, 19, 20))) + e.append(ExprAff(vip, ExprSlice(tmp, 20, 21))) + e.append(ExprAff(i_d, ExprSlice(tmp, 21, 22))) + e.append(ExprAff(mRSP[instr.mode], mRSP[instr.mode] + ExprInt32(4))) + e.append(ExprAff(exception_flags, + ExprCond(ExprSlice(tmp, 8, 9), + ExprInt32(EXCEPT_SOFT_BP), + exception_flags + ) + ) + ) + return None, e, [] + + +def popfw(ir, instr): + tmp = ExprMem(esp) + e = [] + e.append(ExprAff(cf, ExprSlice(tmp, 0, 1))) + e.append(ExprAff(pf, ExprSlice(tmp, 2, 3))) + e.append(ExprAff(af, ExprSlice(tmp, 4, 5))) + e.append(ExprAff(zf, ExprSlice(tmp, 6, 7))) + e.append(ExprAff(nf, ExprSlice(tmp, 7, 8))) + e.append(ExprAff(tf, ExprSlice(tmp, 8, 9))) + e.append(ExprAff(i_f, ExprSlice(tmp, 9, 10))) + e.append(ExprAff(df, ExprSlice(tmp, 10, 11))) + e.append(ExprAff(of, ExprSlice(tmp, 11, 12))) + e.append(ExprAff(iopl, ExprSlice(tmp, 12, 14))) + e.append(ExprAff(nt, ExprSlice(tmp, 14, 15))) + e.append(ExprAff(esp, esp + ExprInt32(2))) + return None, e, [] + + +def pushad(ir, instr): + e = [] + s = instr.v_opmode() + opmode, admode = s, instr.v_admode() + if not s in [16, 32, 64]: + raise ValueError('bad size stacker!') + + regs = [ + mRAX[instr.mode][:s], mRCX[instr.mode][ + :s], mRDX[instr.mode][:s], mRBX[instr.mode][:s], + mRSP[instr.mode][:s], mRBP[instr.mode][:s], + mRSI[instr.mode][:s], mRDI[instr.mode][:s]] + + for i in xrange(len(regs)): + c = mRSP[instr.mode][:s] + ExprInt_fromsize(s, -(s / 8) * (i + 1)) + e.append(ExprAff(ExprMem(c, s), regs[i])) + e.append(ExprAff(mRSP[instr.mode][:s], c)) + return None, e, [] + + +def popad(ir, instr): + e = [] + s = instr.v_opmode() + opmode, admode = s, instr.v_admode() + if not s in [16, 32, 64]: + raise ValueError('bad size stacker!') + regs = [ + mRAX[instr.mode][:s], mRCX[instr.mode][ + :s], mRDX[instr.mode][:s], mRBX[instr.mode][:s], + mRSP[instr.mode][:s], mRBP[instr.mode][:s], + mRSI[instr.mode][:s], mRDI[instr.mode][:s]] + myesp = mRSP[instr.mode][:s] + regs.reverse() + for i in xrange(len(regs)): + if regs[i] == myesp: + continue + c = myesp + ExprInt_from(myesp, ((s / 8) * i)) + e.append(ExprAff(regs[i], ExprMem(c, s))) + + c = myesp + ExprInt_from(myesp, ((s / 8) * (i + 1))) + e.append(ExprAff(myesp, c)) + + return None, e, [] + + +def call(ir, instr, dst): + e = [] + # opmode, admode = instr.opmode, instr.admode + s = dst.size + meip = mRIP[instr.mode] + opmode, admode = s, instr.v_admode() + myesp = mRSP[instr.mode][:opmode] + n = ExprId(ir.get_next_label(instr), instr.mode) + + c = myesp + ExprInt_fromsize(s, (-s / 8)) + e.append(ExprAff(myesp, c)) + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(ExprMem(c, size=s), n)) + e.append(ExprAff(meip, dst.zeroExtend(instr.mode))) + if not expr_is_int_or_label(dst): + dst = meip + return dst, e, [] + + +def ret(ir, instr, a=None): + e = [] + s = instr.mode + meip = mRIP[instr.mode] + opmode, admode = instr.v_opmode(), instr.v_admode() + s = opmode + myesp = mRSP[instr.mode][:s] + + if a is None: + a = ExprInt_fromsize(s, 0) + e.append(ExprAff(myesp, (myesp + (ExprInt_fromsize(s, (s / 8)))))) + else: + a = a.zeroExtend(s) + e.append(ExprAff(myesp, (myesp + (ExprInt_fromsize(s, (s / 8)) + a)))) + c = myesp + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(meip, ExprMem(c, size=s).zeroExtend(s))) + return meip, e, [] + + +def retf(ir, instr, a=None): + e = [] + s = instr.mode + meip = mRIP[instr.mode] + opmode, admode = instr.v_opmode(), instr.v_admode() + if a is None: + a = ExprInt_fromsize(s, 0) + s = opmode + myesp = mRSP[instr.mode][:s] + + a = a.zeroExtend(s) + + e.append(ExprAff(myesp, (myesp + (ExprInt_fromsize(s, (s / 8)) + a)))) + + c = myesp + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(meip, ExprMem(c, size=s).zeroExtend(s))) + # e.append(ExprAff(meip, ExprMem(c, size = s))) + c = myesp + ExprInt_fromsize(s, (s / 8)) + if ir.do_stk_segm: + c = ExprOp('segm', SS, c) + e.append(ExprAff(CS, ExprMem(c, size=16))) + + return meip, e, [] + + +def leave(ir, instr): + opmode, admode = instr.v_opmode(), instr.v_admode() + s = opmode + myesp = mRSP[instr.mode] + + e = [] + e.append(ExprAff(mRBP[s], ExprMem(mRBP[instr.mode], size=s))) + e.append(ExprAff(myesp, + ExprInt_fromsize(instr.mode, instr.mode / 8) + mRBP[instr.mode])) + return None, e, [] + + +def enter(ir, instr, a, b): + opmode, admode = instr.v_opmode(), instr.v_admode() + s = opmode + myesp = mRSP[instr.mode][:s] + myebp = mRBP[instr.mode][:s] + + a = a.zeroExtend(s) + + e = [] + esp_tmp = myesp - ExprInt_fromsize(s, s / 8) + e.append(ExprAff(ExprMem(esp_tmp, + size=s), + myebp)) + e.append(ExprAff(myebp, esp_tmp)) + e.append(ExprAff(myesp, myesp - (a + ExprInt_fromsize(s, s / 8)))) + return None, e, [] + + +def jmp(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + e.append(ExprAff(meip, dst)) # dst.zeroExtend(instr.mode))) + if isinstance(dst, ExprMem): + dst = meip + return dst, e, [] + + +def jmpf(ir, instr, a): + e = [] + meip = mRIP[instr.mode] + assert(isinstance(a, ExprMem) and + isinstance(a.arg, ExprOp) and + a.arg.op == "segm") + segm = a.arg.args[0] + base = a.arg.args[1] + s = instr.mode + print segm, base + m1 = ExprMem(ExprOp('segm', segm, base), 16) + m2 = ExprMem(ExprOp('segm', segm, base + ExprInt_from(base, 2)), s) + + e.append(ExprAff(meip, m1)) + e.append(ExprAff(CS, m2)) + return meip, e, [] + + +def jz(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(zf, dst, n).zeroExtend(instr.mode) + e = [ExprAff(meip, dst_o)] + return dst_o, e, [] + + +def jcxz(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(mRCX[instr.mode][:16], n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jecxz(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(mRCX[instr.mode][:32], n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jrcxz(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(mRCX[instr.mode], n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jnz(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(zf, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jp(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(pf, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jnp(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(pf, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def ja(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(cf | zf, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jae(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(cf, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jb(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(cf, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jbe(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(cf | zf, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jge(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(nf - of, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jg(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(zf | (nf - of), n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jl(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(nf - of, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jle(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(zf | (nf - of), dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def js(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(nf, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jns(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(nf, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jo(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(of, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def jno(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + n = ExprId(ir.get_next_label(instr), instr.mode) + dst_o = ExprCond(of, n, dst).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + return dst_o, e, [] + + +def loop(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + s = instr.v_opmode() + opmode, admode = s, instr.v_admode() + myecx = mRCX[instr.mode][:admode] + + n = ExprId(ir.get_next_label(instr), instr.mode) + c = myecx - ExprInt_from(myecx, 1) + e.append(ExprAff(myecx, c)) + e.append(ExprAff(meip, ExprCond(c, dst, n).zeroExtend(instr.mode))) + dst_o = ExprCond(myecx, dst, n).zeroExtend(instr.mode) + return dst_o, e, [] + + +def loopne(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + s = instr.v_opmode() + opmode, admode = s, instr.v_admode() + myecx = mRCX[instr.mode][:admode] + + n = ExprId(ir.get_next_label(instr), instr.mode) + + c = ExprOp('==', + mRCX[instr.mode][:s] - ExprInt_fromsize(s, 1), + ExprInt_fromsize(s, 0)) ^ ExprInt1(1) + c &= zf ^ ExprInt1(1) + + e.append(ExprAff(myecx, myecx - ExprInt_from(myecx, 1))) + e.append(ExprAff(meip, ExprCond(c, dst, n).zeroExtend(instr.mode))) + + # for dst, ecx has been modified! + c = ExprOp('==', + mRCX[instr.mode][:s], + ExprInt_fromsize(s, 0)) ^ ExprInt1(1) + c &= zf ^ ExprInt1(1) + dst_o = ExprCond(c, dst, n).zeroExtend(instr.mode) + return dst_o, e, [] + + +def loope(ir, instr, dst): + e = [] + meip = mRIP[instr.mode] + s = instr.v_opmode() + opmode, admode = s, instr.v_admode() + myecx = mRCX[instr.mode][:admode] + + n = ExprId(ir.get_next_label(instr), instr.mode) + c = ExprOp('==', + mRCX[instr.mode][:s] - ExprInt_fromsize(s, 1), + ExprInt_fromsize(s, 0)) ^ ExprInt1(1) + c &= zf + e.append(ExprAff(myecx, myecx - ExprInt_from(myecx, 1))) + dst_o = ExprCond(c, dst, n).zeroExtend(instr.mode) + e.append(ExprAff(meip, dst_o)) + + # for dst, ecx has been modified! + c = ExprOp('==', + mRCX[instr.mode][:s], + ExprInt_fromsize(s, 0)) ^ ExprInt1(1) + c &= zf + dst_o = ExprCond(c, dst, n).zeroExtend(instr.mode) + return dst_o, e, [] + + +# XXX size to do; eflag +def div(ir, instr, a): + e = [] + s = a.size + if s == 8: + b = mRAX[instr.mode][:16] + elif s == 16: + s1, s2 = mRDX[instr.mode][:16], mRAX[instr.mode][:16] + b = ExprCompose([(s1, 0, 16), + (s1, 16, 32)]) + elif s == 32: + s1, s2 = mRDX[instr.mode][:32], mRAX[instr.mode][:32] + b = ExprCompose([(s2, 0, 32), + (s1, 32, 64)]) + elif s == 64: + s1, s2 = mRDX[instr.mode], mRAX[instr.mode] + b = ExprCompose([(s2, 0, 64), + (s1, 64, 128)]) + else: + raise ValueError('div arg not impl', a) + + c_d = ExprOp('udiv', b, a.zeroExtend(b.size)) + c_r = ExprOp('umod', b, a.zeroExtend(b.size)) + + # if 8 bit div, only ax is affected + if s == 8: + e.append(ExprAff(b, ExprCompose([(c_d[:8], 0, 8), + (c_r[:8], 8, 16)]))) + else: + e.append(ExprAff(s1, c_r[:s])) + e.append(ExprAff(s2, c_d[:s])) + return None, e, [] + +# XXX size to do; eflag + + +def idiv(ir, instr, a): + e = [] + s = a.size + + if s == 8: + b = mRAX[instr.mode][:16] + elif s == 16: + s1, s2 = mRDX[instr.mode][:16], mRAX[instr.mode][:16] + b = ExprCompose([(s1, 0, 16), + (s1, 16, 32)]) + elif s == 32: + s1, s2 = mRDX[instr.mode][:32], mRAX[instr.mode][:32] + b = ExprCompose([(s2, 0, 32), + (s1, 32, 64)]) + else: + raise ValueError('div arg not impl', a) + + c_d = ExprOp('idiv', b, a.signExtend(b.size)) + c_r = ExprOp('imod', b, a.signExtend(b.size)) + + # if 8 bit div, only ax is affected + if s == 8: + e.append(ExprAff(b, ExprCompose([(c_d[:8], 0, 8), + (c_r[:8], 8, 16)]))) + else: + e.append(ExprAff(s1, c_r[:s])) + e.append(ExprAff(s2, c_d[:s])) + return None, e, [] + +# XXX size to do; eflag + + +def mul(ir, instr, a): + e = [] + size = a.size + if a.size in [16, 32, 64]: + result = ExprOp('*', + mRAX[instr.mode][:size].zeroExtend(size * 2), + a.zeroExtend(size * 2)) + e.append(ExprAff(mRAX[instr.mode][:size], result[:size])) + e.append(ExprAff(mRDX[instr.mode][:size], result[size:size * 2])) + + elif a.size == 8: + result = ExprOp('*', + mRAX[instr.mode][:8].zeroExtend(16), + a.zeroExtend(16)) + e.append(ExprAff(mRAX[instr.mode][:16], result)) + else: + raise ValueError('unknow size') + + e.append(ExprAff(of, ExprCond(result[size:size * 2], + ExprInt1(1), + ExprInt1(0)))) + e.append(ExprAff(cf, ExprCond(result[size:size * 2], + ExprInt1(1), + ExprInt1(0)))) + + return None, e, [] + + +def imul(ir, instr, a, b=None, c=None): + e = [] + size = a.size + if b is None: + if size in [16, 32, 64]: + result = ExprOp('*', + mRAX[instr.mode][:size].signExtend(size * 2), + a.signExtend(size * 2)) + e.append(ExprAff(mRAX[instr.mode][:size], result[:size])) + e.append(ExprAff(mRDX[instr.mode][:size], result[size:size * 2])) + elif size == 8: + dst = mRAX[instr.mode][:16] + result = ExprOp('*', + mRAX[instr.mode][:8].signExtend(16), + a.signExtend(16)) + + e.append(ExprAff(dst, result)) + e.append( + ExprAff(cf, ExprCond(result - result[:size].signExtend(size * 2), + ExprInt1(1), + ExprInt1(0)))) + e.append( + ExprAff(of, ExprCond(result - result[:size].signExtend(size * 2), + ExprInt1(1), + ExprInt1(0)))) + + else: + if c is None: + c = b + b = a + result = ExprOp('*', + b.signExtend(size * 2), + c.signExtend(size * 2)) + e.append(ExprAff(a, result[:size])) + + e.append( + ExprAff(cf, ExprCond(result - result[:size].signExtend(size * 2), + ExprInt1(1), + ExprInt1(0)))) + e.append( + ExprAff(of, ExprCond(result - result[:size].signExtend(size * 2), + ExprInt1(1), + ExprInt1(0)))) + return None, e, [] + + +def cbw(ir, instr): + e = [] + tempAL = mRAX[instr.mode][:8] + tempAX = mRAX[instr.mode][:16] + e.append(ExprAff(tempAX, tempAL.signExtend(16))) + return None, e, [] + + +def cwde(ir, instr): + e = [] + tempAX = mRAX[instr.mode][:16] + tempEAX = mRAX[instr.mode][:32] + e.append(ExprAff(tempEAX, tempAX.signExtend(32))) + return None, e, [] + + +def cdqe(ir, instr): + e = [] + tempEAX = mRAX[instr.mode][:32] + tempRAX = mRAX[instr.mode][:64] + e.append(ExprAff(tempRAX, tempEAX.signExtend(64))) + return None, e, [] + + +def cwd(ir, instr): + e = [] + tempAX = mRAX[instr.mode][:16] + tempDX = mRDX[instr.mode][:16] + c = tempAX.signExtend(32) + e.append(ExprAff(tempAX, c[:16])) + e.append(ExprAff(tempDX, c[16:32])) + return None, e, [] + + +def cdq(ir, instr): + e = [] + tempEAX = mRAX[instr.mode][:32] + tempEDX = mRDX[instr.mode][:32] + c = tempEAX.signExtend(64) + e.append(ExprAff(tempEAX, c[:32])) + e.append(ExprAff(tempEDX, c[32:64])) + return None, e, [] + + +def cqo(ir, instr): + e = [] + tempRAX = mRAX[instr.mode][:64] + tempRDX = mRDX[instr.mode][:64] + c = tempEAX.signExtend(128) + e.append(ExprAff(tempRAX, c[:64])) + e.append(ExprAff(tempRDX, c[64:127])) + return None, e, [] + + +def stos(ir, instr, size): + lbl_df_0 = ExprId(ir.gen_label(), instr.mode) + lbl_df_1 = ExprId(ir.gen_label(), instr.mode) + lbl_next = ExprId(ir.get_next_label(instr), instr.mode) + + s = instr.v_admode() + + addr_o = mRDI[instr.mode][:s] + addr = addr_o + addr_p = addr + ExprInt_from(addr, size / 8) + addr_m = addr - ExprInt_from(addr, size / 8) + if ir.do_str_segm: + mss = ES + if instr.additional_info.g2.value: + raise NotImplementedError("add segm support") + addr = ExprOp('segm', mss, addr) + + b = mRAX[instr.mode][:size] + + e0 = [] + e0.append(ExprAff(addr_o, addr_p)) + e0 = irbloc(lbl_df_0.name, lbl_next, [e0]) + + e1 = [] + e1.append(ExprAff(addr_o, addr_m)) + e1 = irbloc(lbl_df_1.name, lbl_next, [e1]) + + e = [] + e.append(ExprAff(ExprMem(addr, size), b)) + + return ExprCond(df, lbl_df_1, lbl_df_0), e, [e0, e1] + + +def lods(ir, instr, size): + lbl_df_0 = ExprId(ir.gen_label(), instr.mode) + lbl_df_1 = ExprId(ir.gen_label(), instr.mode) + lbl_next = ExprId(ir.get_next_label(instr), instr.mode) + e = [] + s = instr.v_admode() + + addr_o = mRSI[instr.mode][:s] + addr = addr_o + addr_p = addr + ExprInt_from(addr, size / 8) + addr_m = addr - ExprInt_from(addr, size / 8) + if ir.do_str_segm: + mss = DS + if instr.additional_info.g2.value: + raise NotImplementedError("add segm support") + addr = ExprOp('segm', mss, addr) + + b = mRAX[instr.mode][:size] + + e0 = [] + e0.append(ExprAff(addr_o, addr_p)) + e0 = irbloc(lbl_df_0.name, lbl_next, [e0]) + + e1 = [] + e1.append(ExprAff(addr_o, addr_m)) + e1 = irbloc(lbl_df_1.name, lbl_next, [e1]) + + e = [] + e.append(ExprAff(b, ExprMem(addr, size))) + + return ExprCond(df, lbl_df_1, lbl_df_0), e, [e0, e1] + + +def movs(ir, instr, size): + lbl_df_0 = ExprId(ir.gen_label(), instr.mode) + lbl_df_1 = ExprId(ir.gen_label(), instr.mode) + lbl_next = ExprId(ir.get_next_label(instr), instr.mode) + + s = instr.v_admode() + # a = ExprMem(mRDI[instr.mode][:s], size) + # b = ExprMem(mRSI[instr.mode][:s], size) + + a = mRDI[instr.mode][:s] + b = mRSI[instr.mode][:s] + + e = [] + src = b + dst = a + if ir.do_str_segm: + if instr.additional_info.g2.value: + raise NotImplementedError("add segm support") + src = ExprOp('segm', DS, src) + dst = ExprOp('segm', ES, dst) + e.append(ExprAff(ExprMem(dst, size), ExprMem(src, size))) + + e0 = [] + e0.append(ExprAff(a, a + ExprInt_from(a, size / 8))) + e0.append(ExprAff(b, b + ExprInt_from(b, size / 8))) + e0 = irbloc(lbl_df_0.name, lbl_next, [e0]) + + e1 = [] + e1.append(ExprAff(a, a - ExprInt_from(a, size / 8))) + e1.append(ExprAff(b, b - ExprInt_from(b, size / 8))) + e1 = irbloc(lbl_df_1.name, lbl_next, [e1]) + + return ExprCond(df, lbl_df_1, lbl_df_0), e, [e0, e1] + + +def float_prev(flt): + if not flt in float_list: + return None + i = float_list.index(flt) + if i == 0: + raise ValueError('broken index') + flt = float_list[i - 1] + return flt + + +def float_pop(avoid_flt=None): + avoid_flt = float_prev(avoid_flt) + e = [] + if avoid_flt != float_st0: + e.append(ExprAff(float_st0, float_st1)) + if avoid_flt != float_st1: + e.append(ExprAff(float_st1, float_st2)) + if avoid_flt != float_st2: + e.append(ExprAff(float_st2, float_st3)) + if avoid_flt != float_st3: + e.append(ExprAff(float_st3, float_st4)) + if avoid_flt != float_st4: + e.append(ExprAff(float_st4, float_st5)) + if avoid_flt != float_st5: + e.append(ExprAff(float_st5, float_st6)) + if avoid_flt != float_st6: + e.append(ExprAff(float_st6, float_st7)) + if avoid_flt != float_st7: + e.append(ExprAff(float_st7, ExprInt_from(float_st7, 0))) + e.append( + ExprAff(float_stack_ptr, float_stack_ptr - ExprInt_fromsize(3, 1))) + return e + +# XXX TODO + + +def fcom(ir, instr, a, b): + e = [] + """ + if isinstance(a, ExprMem): + src = ExprOp('mem_%.2d_to_double'%a.size, a) + else: + src = a + """ + src = b + e.append(ExprAff(float_c0, ExprOp('fcom_c0', a, src.zeroExtend(a.size)))) + e.append(ExprAff(float_c1, ExprOp('fcom_c1', a, src.zeroExtend(a.size)))) + e.append(ExprAff(float_c2, ExprOp('fcom_c2', a, src.zeroExtend(a.size)))) + e.append(ExprAff(float_c3, ExprOp('fcom_c3', a, src.zeroExtend(a.size)))) + + e += set_float_cs_eip(instr) + return None, e, [] + + +def ficom(ir, instr, a): + e = [] + e += set_float_cs_eip(instr) + return None, e, [] + + +def fcomi(ir, instr, a): + # Invalid emulation + InvalidEmulation + + +def fcomip(ir, instr, a): + # Invalid emulation + InvalidEmulation + + +def fucomi(ir, instr, a): + # Invalid emulation + InvalidEmulation + + +def fucomip(ir, instr, a): + # Invalid emulation, only read/write analysis is valid + cond = ExprOp('fcomp', float_st0, a) + e = [] + e.append( + ExprAff(zf, ExprCond(cond, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))) + e.append( + ExprAff(pf, ExprCond(cond, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))) + e.append( + ExprAff(cf, ExprCond(cond, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))) + return None, e, [] + + +def fcomp(ir, instr, a, b): + dst, e, extra = fcom(ir, instr, a, b) + e += float_pop() + e += set_float_cs_eip(instr) + return dst, e, extra + + +def fld(ir, instr, a): + if isinstance(a, ExprMem): + src = ExprOp('mem_%.2d_to_double' % a.size, a) + else: + src = a + + e = [] + e.append(ExprAff(float_st7, float_st6)) + e.append(ExprAff(float_st6, float_st5)) + e.append(ExprAff(float_st5, float_st4)) + e.append(ExprAff(float_st4, float_st3)) + e.append(ExprAff(float_st3, float_st2)) + e.append(ExprAff(float_st2, float_st1)) + e.append(ExprAff(float_st1, float_st0)) + e.append(ExprAff(float_st0, src)) + e.append( + ExprAff(float_stack_ptr, float_stack_ptr + ExprInt_fromsize(3, 1))) + + e += set_float_cs_eip(instr) + return None, e, [] + + +def fst(ir, instr, a): + e = [] + if isinstance(a, ExprMem): + src = ExprOp('double_to_mem_%2d' % a.size, float_st0) + else: + src = float_st0 + e.append(ExprAff(a, src)) + + e += set_float_cs_eip(instr) + return None, e, [] + + +def fstp(ir, instr, a): + dst, e, extra = fst(ir, instr, a) + e += float_pop(a) + return dst, e, extra + + +def fist(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprOp('double_to_int_%d' % a.size, float_st0))) + + e += set_float_cs_eip(instr) + return None, e, [] + + +def fistp(ir, instr, a): + dst, e, extra = fist(ir, instr, a) + e += float_pop(a) + return dst, e, extra + + +def fild(ir, instr, a): + # XXXXX + src = ExprOp('int_%.2d_to_double' % a.size, a) + e = [] + e += set_float_cs_eip(instr) + dst, e_fld, extra = fld(ir, instr, src) + e += e_fld + return dst, e, extra + + +def fldz(ir, instr): + return fld(ir, instr, ExprOp('int_32_to_double', ExprInt32(0))) + + +def fld1(ir, instr): + return fld(ir, instr, ExprOp('int_32_to_double', ExprInt32(1))) + + +def fldl2e(ir, instr): + x = struct.pack('d', 1 / math.log(2)) + x = struct.unpack('Q', x)[0] + return fld(ir, instr, ExprOp('mem_64_to_double', ExprInt64(x))) + + +def fldlg2(ir, instr): + x = struct.pack('d', math.log10(2)) + x = struct.unpack('Q', x)[0] + return fld(ir, instr, ExprOp('mem_64_to_double', ExprInt64(x))) + + +def fadd(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(a, ExprOp('fadd', a, src))) + + e += set_float_cs_eip(instr) + return None, e, [] + + +def faddp(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(float_prev(a), ExprOp('fadd', a, src))) + e += set_float_cs_eip(instr) + e += float_pop(a) + return None, e, [] + + +def fninit(ir, instr): + e = [] + e += set_float_cs_eip(instr) + return None, e, [] + + +def fnstenv(ir, instr, a): + e = [] + # XXX TODO tag word, ... + status_word = ExprCompose([(ExprInt8(0), 0, 8), + (float_c0, 8, 9), + (float_c1, 9, 10), + (float_c2, 10, 11), + (float_stack_ptr, 11, 14), + (float_c3, 14, 15), + (ExprInt1(0), 15, 16), + ]) + + s = instr.mode + ad = ExprMem(a.arg, size=16) + e.append(ExprAff(ad, float_control)) + ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 1), size=16) + e.append(ExprAff(ad, status_word)) + ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 3), size=s) + e.append(ExprAff(ad, float_eip[:s])) + ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 4), size=16) + e.append(ExprAff(ad, float_cs)) + ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 5), size=s) + e.append(ExprAff(ad, float_address[:s])) + ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 6), size=16) + e.append(ExprAff(ad, float_ds)) + return None, e, [] + + +def fsub(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(a, ExprOp('fsub', a, src))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fmul(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(a, ExprOp('fmul', a, src))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fdiv(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(a, ExprOp('fdiv', a, src))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fdivr(ir, instr, a, b=None): + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(a, ExprOp('fdiv', src, a))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fdivp(ir, instr, a, b=None): + # Invalid emulation + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(float_prev(a), ExprOp('fdiv', a, src))) + e += set_float_cs_eip(instr) + e += float_pop(a) + return None, e, [] + + +def fmulp(ir, instr, a, b=None): + # Invalid emulation + if b is None: + b = a + a = float_st0 + e = [] + if isinstance(b, ExprMem): + src = ExprOp('mem_%.2d_to_double' % b.size, b) + else: + src = b + e.append(ExprAff(float_prev(a), ExprOp('fmul', a, src))) + e += set_float_cs_eip(instr) + e += float_pop(a) + return None, e, [] + + +def ftan(ir, instr, a): + e = [] + if isinstance(a, ExprMem): + src = ExprOp('mem_%.2d_to_double' % a.size, a) + else: + src = a + e.append(ExprAff(float_st0, ExprOp('ftan', src))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fxch(ir, instr, a): + e = [] + if isinstance(a, ExprMem): + src = ExprOp('mem_%.2d_to_double' % a.size, a) + else: + src = a + e.append(ExprAff(float_st0, src)) + e.append(ExprAff(src, float_st0)) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fptan(ir, instr): + e = [] + e.append(ExprAff(float_st7, float_st6)) + e.append(ExprAff(float_st6, float_st5)) + e.append(ExprAff(float_st5, float_st4)) + e.append(ExprAff(float_st4, float_st3)) + e.append(ExprAff(float_st3, float_st2)) + e.append(ExprAff(float_st2, float_st1)) + e.append(ExprAff(float_st1, ExprOp('ftan', float_st0))) + e.append(ExprAff(float_st0, ExprOp('int_32_to_double', ExprInt32(1)))) + e.append( + ExprAff(float_stack_ptr, float_stack_ptr + ExprInt_fromsize(3, 1))) + return None, e, [] + + +def frndint(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('frndint', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fsin(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('fsin', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fcos(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('fcos', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fscale(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('fscale', float_st0, float_st1))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def f2xm1(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('f2xm1', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fsqrt(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('fsqrt', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fabs(ir, instr): + e = [] + e.append(ExprAff(float_st0, ExprOp('fabs', float_st0))) + e += set_float_cs_eip(instr) + return None, e, [] + + +def fnstsw(ir, instr, dst): + args = [(ExprInt8(0), 0, 8), + (float_c0, 8, 9), + (float_c1, 9, 10), + (float_c2, 10, 11), + (float_stack_ptr, 11, 14), + (float_c3, 14, 15), + (ExprInt1(0), 15, 16)] + e = [ExprAff(dst, ExprCompose(args))] + return None, e, [] + + +def fnstcw(ir, instr, a): + e = [] + e.append(ExprAff(a, float_control)) + return None, e, [] + + +def fldcw(ir, instr, a): + e = [] + e.append(ExprAff(float_control, a)) + return None, e, [] + + +def fwait(ir, instr): + return None, [], None + + +def nop(ir, instr, a=None): + return None, [], [] + + +def hlt(ir, instr): + e = [] + except_int = EXCEPT_PRIV_INSN + e.append(ExprAff(exception_flags, ExprInt32(except_int))) + return None, e, [] + + +def rdtsc(ir, instr): + e = [] + myEAX = mRAX[instr.mode] + myEDX = mRDX[instr.mode] + e.append(ExprAff(tsc1, tsc1 + ExprInt32(1))) + e.append(ExprAff(myEAX, tsc1)) + e.append(ExprAff(myEDX, tsc2)) + return None, e, [] + + +# XXX TODO +def daa(ir, instr): + return None, [], None + + +def aam(ir, instr, a): + e = [] + tempAL = mRAX[instr.mode][0:8] + newEAX = ExprCompose([ + (tempAL % a, 0, 8), + (tempAL / a, 8, 16), + (mRAX[instr.mode][16:], 16, mRAX[instr.mode].size), + ]) + e += [ExprAff(mRAX[instr.mode], newEAX)] + e += update_flag_arith(newEAX) + return None, e, [] + + +def aad(ir, instr, a): + e = [] + tempAL = mRAX[instr.mode][0:8] + tempAH = mRAX[instr.mode][8:16] + newEAX = ExprCompose([ + ((tempAL + (tempAH * a)) & ExprInt8(0xFF), 0, 8), + (ExprInt8(0), 8, 16), + (mRAX[instr.mode][16:], + 16, mRAX[instr.mode].size), + ]) + e += [ExprAff(mRAX[instr.mode], newEAX)] + e += update_flag_arith(newEAX) + return None, e, [] + + +def aaa(ir, instr, ): + e = [] + c = (mRAX[instr.mode][:8] & ExprInt8(0xf)) - ExprInt8(9) + + c = ExprCond(c.msb(), + ExprInt1(0), + ExprInt1(1)) & \ + ExprCond(c, + ExprInt1(1), + ExprInt1(0)) + + c |= af & ExprInt1(1) + # set AL + m_al = ExprCond(c, + (mRAX[instr.mode][:8] + ExprInt8(6)) & ExprInt8(0xF), + mRAX[instr.mode][:8] & ExprInt8(0xF)) + m_ah = ExprCond(c, + mRAX[instr.mode][8:16] + ExprInt8(1), + mRAX[instr.mode][8:16]) + + e.append(ExprAff(mRAX[instr.mode], ExprCompose([ + (m_al, 0, 8), (m_ah, 8, 16), + (mRAX[instr.mode][16:], 16, mRAX[instr.mode].size)]))) + e.append(ExprAff(af, c)) + e.append(ExprAff(cf, c)) + return None, e, [] + + +def aas(ir, instr, ): + e = [] + c = (mRAX[instr.mode][:8] & ExprInt8(0xf)) - ExprInt8(9) + + c = ExprCond(c.msb(), + ExprInt1(0), + ExprInt1(1)) & \ + ExprCond(c, + ExprInt1(1), + ExprInt1(0)) + + c |= af & ExprInt1(1) + # set AL + m_al = ExprCond(c, + (mRAX[instr.mode][:8] - ExprInt8(6)) & ExprInt8(0xF), + mRAX[instr.mode][:8] & ExprInt8(0xF)) + m_ah = ExprCond(c, + mRAX[instr.mode][8:16] - ExprInt8(1), + mRAX[instr.mode][8:16]) + + e.append(ExprAff(mRAX[instr.mode], ExprCompose([ + (m_al, 0, 8), (m_ah, 8, 16), + (mRAX[instr.mode][16:], 16, mRAX[instr.mode].size)]))) + e.append(ExprAff(af, c)) + e.append(ExprAff(cf, c)) + return None, e, [] + + +def bsf(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + + e = [ExprAff(zf, ExprCond(b, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))] + + e_do = [] + e_do.append(ExprAff(a, ExprOp('bsf', b))) + return ExprCond(b, + lbl_do, lbl_skip), e, [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def bsr(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + + e = [ExprAff(zf, ExprCond(b, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))] + + e_do = [] + e_do.append(ExprAff(a, ExprOp('bsr', b))) + return ExprCond(b, + lbl_do, lbl_skip), e, [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def arpl(ir, instr, a, b): + e = [] + e.append(ExprAff(exception_flags, ExprInt32(1 << 7))) + return None, e, [] + + +def ins(ir, instr, size): + e = [] + e.append(ExprAff(exception_flags, ExprInt32(1 << 7))) + return None, e, [] + + +def sidt(ir, instr, a): + e = [] + if not isinstance(a, ExprMem) or a.size != 32: + raise ValueError('not exprmem 32bit instance!!') + b = a.arg + print "DEFAULT SIDT ADDRESS %s!!" % str(a) + e.append(ExprAff(ExprMem(b, 32), ExprInt32(0xe40007ff))) + e.append( + ExprAff(ExprMem(ExprOp("+", b, + ExprInt_from(b, 4)), 16), ExprInt16(0x8245))) + return None, e, [] + + +def sldt(ir, instr, a): + # XXX TOOD + e = [ExprAff(exception_flags, ExprInt32(EXCEPT_PRIV_INSN))] + return None, e, [] + + +def cmovz(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + + dum, e_do, extra_irs = mov(ir, instr, a, b) + return ExprCond(zf, + lbl_do, lbl_skip), [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def cmovnz(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(zf, a, b))) + return None, e, [] + + +def cmovge(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(nf ^ of, a, b))) + return None, e, [] + + +def cmovg(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(zf | (nf ^ of), a, b))) + return None, e, [] + + +def cmovl(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(nf ^ of, b, a))) + return None, e, [] + + +def cmovle(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond((nf ^ of) | zf, b, a))) + return None, e, [] + + +def cmova(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + dum, e_do, extra_irs = mov(ir, instr, a, b) + return ExprCond(cf | zf, + lbl_skip, lbl_do), [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def cmovae(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + dum, e_do, extra_irs = mov(ir, instr, a, b) + return ExprCond(cf, + lbl_skip, lbl_do), [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def cmovbe(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + dum, e_do, extra_irs = mov(ir, instr, a, b) + return ExprCond(cf | zf, + lbl_do, lbl_skip), [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def cmovb(ir, instr, a, b): + lbl_do = ExprId(ir.gen_label(), instr.mode) + lbl_skip = ExprId(ir.get_next_label(instr), instr.mode) + dum, e_do, extra_irs = mov(ir, instr, a, b) + return ExprCond(cf, + lbl_do, lbl_skip), [], [irbloc(lbl_do.name, lbl_skip, [e_do])] + + +def cmovo(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(of, b, a))) + return None, e, [] + + +def cmovno(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond(of, a, b))) + return None, e, [] + + +def cmovs(ir, instr, a, b): + e = [] + # SF is called nf in miasm + e.append(ExprAff(a, ExprCond(nf, b, a))) + return None, e, [] + + +def cmovns(ir, instr, a, b): + e = [] + # SF is called nf in miasm + e.append(ExprAff(a, ExprCond(nf, a, b))) + return None, e, [] + + +def icebp(ir, instr): + e = [] + e.append(ExprAff(exception_flags, + ExprInt32(EXCEPT_PRIV_INSN))) + return None, e, [] +# XXX + + +def l_int(ir, instr, a): + e = [] + # XXX + if a.arg in [1, 3]: + except_int = EXCEPT_SOFT_BP + else: + except_int = EXCEPT_INT_XX + e.append(ExprAff(exception_flags, + ExprInt32(except_int))) + return None, e, [] + + +def l_sysenter(ir, instr): + e = [] + e.append(ExprAff(exception_flags, + ExprInt32(EXCEPT_PRIV_INSN))) + return None, e, [] + +# XXX + + +def l_out(ir, instr, a, b): + e = [] + e.append(ExprAff(exception_flags, + ExprInt32(EXCEPT_PRIV_INSN))) + return None, e, [] + +# XXX + + +def l_outs(ir, instr, size): + e = [] + e.append(ExprAff(exception_flags, + ExprInt32(EXCEPT_PRIV_INSN))) + return None, e, [] + +# XXX actually, xlat performs al = (ds:[e]bx + ZeroExtend(al)) + + +def xlat(ir, instr): + e = [] + a = ExprCompose([(ExprInt_fromsize(24, 0), 8, 32), + (mRAX[instr.mode][0:8], 0, 8)]) + b = ExprMem(ExprOp('+', mRBX[instr.mode], a), 8) + e.append(ExprAff(mRAX[instr.mode][0:8], b)) + return None, e, [] + + +def cpuid(ir, instr): + e = [] + e.append( + ExprAff(mRAX[instr.mode], + ExprOp('cpuid', mRAX[instr.mode], ExprInt32(0)))) + e.append( + ExprAff(mRBX[instr.mode], + ExprOp('cpuid', mRAX[instr.mode], ExprInt32(1)))) + e.append( + ExprAff(mRCX[instr.mode], + ExprOp('cpuid', mRAX[instr.mode], ExprInt32(2)))) + e.append( + ExprAff(mRDX[instr.mode], + ExprOp('cpuid', mRAX[instr.mode], ExprInt32(3)))) + return None, e, [] + + +def bittest_get(a, b): + b = b.zeroExtend(a.size) + if isinstance(a, ExprMem): + off_bit = ExprOp('&', b, ExprInt_from(a, a.size - 1)) + off_byte = (b >> ExprInt_from(a, 3)) & \ + ExprOp('!', ExprInt_from(a, a.size / 8 - 1)) + + d = ExprMem(a.arg + off_byte, a.size) + # d = ExprOp('>>', mem, off_bit) + else: + off_bit = ExprOp('&', b, ExprInt_from(a, a.size - 1)) + d = a + # d = ExprOp('>>', a, off_bit) + return d, off_bit + + +def bt(ir, instr, a, b): + e = [] + b = b.zeroExtend(a.size) + d, off_bit = bittest_get(a, b) + d = d >> off_bit + e.append(ExprAff(cf, d[:1])) + return None, e, [] + + +def btc(ir, instr, a, b): + e = [] + d, off_bit = bittest_get(a, b) + e.append(ExprAff(cf, (d >> off_bit)[:1])) + + m = ExprInt_from(a, 1) << off_bit + e.append(ExprAff(d, d ^ m)) + + return None, e, [] + + +def bts(ir, instr, a, b): + e = [] + d, off_bit = bittest_get(a, b) + e.append(ExprAff(cf, (d >> off_bit)[:1])) + m = ExprInt_from(a, 1) << off_bit + e.append(ExprAff(d, d | m)) + + return None, e, [] + + +def btr(ir, instr, a, b): + e = [] + d, off_bit = bittest_get(a, b) + e.append(ExprAff(cf, (d >> off_bit)[:1])) + m = ~(ExprInt_from(a, 1) << off_bit) + e.append(ExprAff(d, d & m)) + + return None, e, [] + + +def into(ir, instr): + return None, [], None + + +def l_in(ir, instr, a, b): + e = [] + e.append(ExprAff(exception_flags, + ExprInt32(EXCEPT_PRIV_INSN))) + return None, e, [] + + +def cmpxchg(ir, instr, a, b): + e = [] + + c = mRAX[instr.mode][:a.size] + cond = c - a + e.append( + ExprAff(zf, ExprCond(cond, ExprInt_from(zf, 0), ExprInt_from(zf, 1)))) + e.append(ExprAff(a, ExprCond(cond, + b, + a) + )) + e.append(ExprAff(c, ExprCond(cond, + a, + c) + )) + return None, e, [] + + +def lds(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprMem(b.arg, size=a.size))) + e.append(ExprAff(ds, ExprMem(b.arg + ExprInt_from(a, 2), + size=16))) + return None, e, [] + + +def les(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprMem(b.arg, size=a.size))) + e.append(ExprAff(es, ExprMem(b.arg + ExprInt_from(a, 2), + size=16))) + return None, e, [] + + +def lss(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprMem(b.arg, size=a.size))) + e.append(ExprAff(ss, ExprMem(b.arg + ExprInt_from(a, 2), + size=16))) + return None, e, [] + + +def lahf(ir, instr): + e = [] + args = [] + regs = [cf, ExprInt1(1), pf, ExprInt1(0), af, ExprInt1(0), zf, nf] + for i in xrange(len(regs)): + args.append((regs[i], i, i + 1)) + e.append(ExprAff(mRAX[instr.mode][8:16], ExprCompose(args))) + return None, e, [] + + +def sahf(ir, instr): + tmp = mRAX[instr.mode][8:16] + e = [] + e.append(ExprAff(cf, tmp[0:1])) + e.append(ExprAff(pf, tmp[2:3])) + e.append(ExprAff(af, tmp[4:5])) + e.append(ExprAff(zf, tmp[6:7])) + e.append(ExprAff(nf, tmp[7:8])) + return None, e, [] + + +def lar(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprOp('access_segment', b))) + e.append(ExprAff(zf, ExprOp('access_segment_ok', b))) + return None, e, [] + + +def lsl(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprOp('load_segment_limit', b))) + e.append(ExprAff(zf, ExprOp('load_segment_limit_ok', b))) + return None, e, [] + + +def fclex(ir, instr): + # XXX TODO + return None, [], None + + +def fnclex(ir, instr): + # XXX TODO + return None, [], None + + +def l_str(ir, instr, a): + e = [] + e.append(ExprAff(a, ExprOp('load_tr_segment_selector', ExprInt32(0)))) + return None, e, [] + + +def movd(ir, instr, a, b): + e = [] + if a.size == 64: + e.append(ExprAff(a, ExprCompose([(ExprInt32(0), 32, 64), (b, 0, 32)]))) + else: + e.append(ExprAff(a, b[0:32])) + return None, e, [] + + +def xorps(ir, instr, a, b): + e = [] + if isinstance(b, ExprMem): + b = ExprMem(b.arg, a.size) + e.append(ExprAff(a, ExprOp('xorps', a, b))) + return None, e, [] + + +def movaps(ir, instr, a, b): + e = [] + if isinstance(a, ExprMem): + a = ExprMem(a.arg, b.size) + if isinstance(b, ExprMem): + b = ExprMem(b.arg, a.size) + e.append(ExprAff(a, b)) + return None, e, [] + + +def pminsw(ir, instr, a, b): + e = [] + e.append(ExprAff(a, ExprCond((a - b).msb(), a, b))) + return None, e, [] + + +def cvtsi2sd(ir, instr, a, b): + e = [] + e.append(ExprAff(a[:b.size], ExprOp('cvtsi2sd', b))) + return None, e, [] + + +def movss(ir, instr, a, b): + e = [] + e.append(ExprAff(a[:b.size], ExprOp('movss', b))) + return None, e, [] + + +def ucomiss(ir, instr, a, b): + e = [] + e.append(ExprAff(zf, ExprOp('ucomiss_zf', a[:32], b[:32]))) + e.append(ExprAff(pf, ExprOp('ucomiss_pf', a[:32], b[:32]))) + e.append(ExprAff(cf, ExprOp('ucomiss_cf', a[:32], b[:32]))) + + e.append(ExprAff(of, ExprInt1(0))) + e.append(ExprAff(af, ExprInt1(0))) + e.append(ExprAff(nf, ExprInt1(0))) + + return None, e, [] + +mnemo_func = {'mov': mov, + 'xchg': xchg, + 'movzx': movzx, + 'movsx': movsx, + 'movsxd': movsx, + 'lea': lea, + 'add': add, + 'xadd': xadd, + 'adc': adc, + 'sub': sub, + 'sbb': sbb, + 'neg': neg, + 'not': l_not, + 'cmp': l_cmp, + 'xor': xor, + 'or': l_or, + 'and': l_and, + 'test': l_test, + 'rol': l_rol, + 'ror': l_ror, + 'rcl': rcl, + 'rcr': rcr, + 'sar': sar, + 'shr': shr, + 'shrd_cl': shrd_cl, + 'sal': sal, + 'shl': shl, + 'shld_cl': shld_cl, + 'shld': shld, + 'cmc': cmc, + 'clc': clc, + 'stc': stc, + 'cld': cld, + 'std': std, + 'cli': cli, + 'sti': sti, + 'bsf': bsf, + 'bsr': bsr, + 'inc': inc, + 'dec': dec, + 'push': push, + 'pop': pop, + 'sete': sete, + 'setnz': setnz, + 'setl': setl, + 'setg': setg, + 'setge': setge, + 'seta': seta, + 'setae': setae, + 'setb': setb, + 'setbe': setbe, + 'setns': setns, + 'sets': sets, + 'seto': seto, + 'setp': setp, + 'setpe': setp, + 'setnp': setnp, + 'setpo': setnp, + 'setle': setle, + 'setng': setle, + 'setna': setna, + 'setnbe': setnbe, + 'setno': setno, + 'setnc': setnb, + 'setz': sete, + 'setne': setnz, + 'setnb': setae, + 'setnae': setb, + 'setc': setb, + 'setnge': setl, + 'setnl': setge, + 'setnle': setg, + 'setalc': setalc, + 'bswap': bswap, + 'cmpsb': lambda ir, instr: cmps(ir, instr, 8), + 'cmpsw': lambda ir, instr: cmps(ir, instr, 16), + 'cmpsd': lambda ir, instr: cmps(ir, instr, 32), + 'scasb': lambda ir, instr: scas(ir, instr, 8), + 'scasw': lambda ir, instr: scas(ir, instr, 16), + 'scasd': lambda ir, instr: scas(ir, instr, 32), + 'pushfd': pushfd, + 'pushfw': pushfw, + 'popfd': popfd, + 'popfw': popfw, + 'pushad': pushad, + 'pusha': pushad, + 'popad': popad, + 'popa': popad, + 'call': call, + 'ret': ret, + 'retf': retf, + 'leave': leave, + 'enter': enter, + 'jmp': jmp, + 'jmpf': jmpf, + 'jz': jz, + 'je': jz, + 'jcxz': jcxz, + 'jecxz': jecxz, + 'jrcxz': jrcxz, + 'jnz': jnz, + 'jp': jp, + 'jpe': jp, + 'jnp': jnp, + 'ja': ja, + 'jae': jae, + 'jb': jb, + 'jbe': jbe, + 'jg': jg, + 'jge': jge, + 'jl': jl, + 'jle': jle, + 'js': js, + 'jns': jns, + 'jo': jo, + 'jno': jno, + 'jecxz': jecxz, + 'loop': loop, + 'loopne': loopne, + 'loope': loope, + 'div': div, + 'mul': mul, + 'imul': imul, + 'idiv': idiv, + + 'cbw': cbw, + 'cwde': cwde, + 'cdqe': cdqe, + + 'cwd': cwd, + 'cdq': cdq, + 'cqo': cqo, + + 'daa': daa, + 'aam': aam, + 'aad': aad, + 'aaa': aaa, + 'aas': aas, + 'shrd': shrd, + 'stosb': lambda ir, instr: stos(ir, instr, 8), + 'stosw': lambda ir, instr: stos(ir, instr, 16), + 'stosd': lambda ir, instr: stos(ir, instr, 32), + 'stosq': lambda ir, instr: stos(ir, instr, 64), + + 'lodsb': lambda ir, instr: lods(ir, instr, 8), + 'lodsw': lambda ir, instr: lods(ir, instr, 16), + 'lodsd': lambda ir, instr: lods(ir, instr, 32), + + 'movsb': lambda ir, instr: movs(ir, instr, 8), + 'movsw': lambda ir, instr: movs(ir, instr, 16), + 'movsd': lambda ir, instr: movs(ir, instr, 32), + 'movsq': lambda ir, instr: movs(ir, instr, 64), + 'fcomp': fcomp, + 'nop': nop, + 'fnop': nop, # XXX + 'hlt': hlt, + 'rdtsc': rdtsc, + 'fst': fst, + 'fstp': fstp, + 'fist': fist, + 'fistp': fistp, + 'fld': fld, + 'fldz': fldz, + 'fld1': fld1, + 'fldl2e': fldl2e, + 'fldlg2': fldlg2, + 'fild': fild, + 'fadd': fadd, + 'fninit': fninit, + 'faddp': faddp, + 'fsub': fsub, + 'fmul': fmul, + 'fmulp': fmulp, + 'fdiv': fdiv, + 'fdivr': fdivr, + 'fdivp': fdivp, + 'fxch': fxch, + 'fptan': fptan, + 'frndint': frndint, + 'fsin': fsin, + 'fcos': fcos, + 'fscale': fscale, + 'f2xm1': f2xm1, + 'fsqrt': fsqrt, + 'fabs': fabs, + 'fnstsw': fnstsw, + 'fnstcw': fnstcw, + 'fldcw': fldcw, + 'fwait': fwait, + 'fnstenv': fnstenv, + 'sidt': sidt, + 'sldt': sldt, + 'arpl': arpl, + 'cmovz': cmovz, + 'cmove': cmovz, + 'cmovnz': cmovnz, + 'cmovge': cmovge, + 'cmovnl': cmovge, + 'cmovg': cmovg, + 'cmovl': cmovl, + 'cmova': cmova, + 'cmovae': cmovae, + 'cmovbe': cmovbe, + 'cmovb': cmovb, + 'cmovnge': cmovl, + 'cmovle': cmovle, + 'cmovng': cmovle, + 'cmovo': cmovo, + 'cmovno': cmovno, + 'cmovs': cmovs, + 'cmovns': cmovns, + 'icebp': icebp, + 'int': l_int, + 'xlat': xlat, + 'bt': bt, + 'cpuid': cpuid, + 'jo': jo, + 'fcom': fcom, + 'ficom': ficom, + 'fcomi': fcomi, + 'fcomip': fcomip, + 'fucomi': fucomi, + 'fucomip': fucomip, + 'insb': lambda ir, instr: ins(ir, instr, 8), + 'insw': lambda ir, instr: ins(ir, instr, 16), + 'insd': lambda ir, instr: ins(ir, instr, 32), + 'btc': btc, + 'bts': bts, + 'btr': btr, + 'into': into, + 'in': l_in, + 'outsb': lambda ir, instr: l_outs(ir, instr, 8), + 'outsw': lambda ir, instr: l_outs(ir, instr, 16), + 'outsd': lambda ir, instr: l_outs(ir, instr, 32), + + 'out': l_out, + "sysenter": l_sysenter, + "cmpxchg": cmpxchg, + "lds": lds, + "les": les, + "lss": lss, + "lahf": lahf, + "sahf": sahf, + "lar": lar, + "lsl": lsl, + "fclex": fclex, + "fnclex": fnclex, + "str": l_str, + "movd": movd, + "movaps": movaps, + "xorps": xorps, + + "pminsw": pminsw, + "cvtsi2sd": cvtsi2sd, + "movss": movss, + + "ucomiss": ucomiss, + } + + +class ir_x86_16(ir): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_x86, 16, symbol_pool) + self.do_stk_segm = False + self.do_ds_segm = False + self.do_str_segm = False + self.do_all_segm = False + self.pc = IP + self.sp = SP + + def mod_pc(self, instr, instr_ir, extra_ir): + pass + + def get_ir(self, instr): + args = instr.args[:] + my_ss = None + if self.do_ds_segm: + my_ss = DS + if self.do_all_segm and instr.additional_info.g2.value: + my_ss = {1: CS, 2: SS, 3: DS, 4: ES, 5: FS, 6: GS}[ + instr.additional_info.g2.value] + if my_ss is not None: + for i, a in enumerate(args): + if isinstance(a, ExprMem) and not a.is_op_segm(): + args[i] = ExprMem(ExprOp('segm', my_ss, a.arg), a.size) + + dst, instr_ir, extra_ir = mnemo_func[ + instr.name.lower()](self, instr, *args) + self.mod_pc(instr, instr_ir, extra_ir) + + self.mod_pc(instr, instr_ir, extra_ir) + instr.additional_info.except_on_instr = False + if instr.additional_info.g1.value & 6 == 0 or \ + not instr.name in repeat_mn: + return dst, instr_ir, extra_ir + instr.additional_info.except_on_instr = True + # get instruction size + s = {"B": 8, "W": 16, "D": 32, 'Q': 64}[instr.name[-1]] + size = instr.v_opmode() + c_reg = mRCX[instr.mode][:size] + out_ir = [] + zf_val = None + # set if zf is tested (cmps, scas) + for e in instr_ir: # +[updt_c]: + if e.dst == zf: + zf_val = e.src + + # end condition + if zf_val is None: + c_cond = ExprCond(c_reg, ExprInt1(0), ExprInt1(1)) + elif instr.additional_info.g1.value & 2: # REPNE + # c_cond = ExprCond(c_reg, ExprInt1(0), ExprInt1(1)) | (zf_val) + c_cond = ExprCond(c_reg, ExprInt1(0), ExprInt1(1)) | (zf) + elif instr.additional_info.g1.value & 4: # REP + # c_cond = ExprCond(c_reg, ExprInt1(0), ExprInt1(1)) | + # (zf_val^ExprInt32(1)) + c_cond = ExprCond( + c_reg, ExprInt1(0), ExprInt1(1)) | (zf ^ ExprInt1(1)) + + # gen while + lbl_do = ExprId(self.gen_label(), instr.mode) + lbl_end = ExprId(self.gen_label(), instr.mode) + lbl_skip = ExprId(self.get_next_label(instr), instr.mode) + lbl_next = ExprId(self.get_next_label(instr), instr.mode) + + for b in extra_ir: + # print repr(b) + # print b + # self.replace_expr_in_ir(b, {lbl_next:lbl_end}) + b.dst = b.dst.replace_expr({lbl_next: lbl_end}) + # print b + + cond_bloc = [] + cond_bloc.append(ExprAff(c_reg, c_reg - ExprInt_from(c_reg, 1))) + cond_bloc = irbloc( + lbl_end.name, ExprCond(c_cond, lbl_skip, lbl_do), [cond_bloc]) + e_do = instr_ir + + c = irbloc(lbl_do.name, dst, [e_do]) + c.except_automod = False + return ExprCond(c_reg, lbl_do, lbl_skip), [], [cond_bloc, c] + extra_ir + + def expr_fix_regs_for_mode(self, e, mode=64): + return e.replace_expr(replace_regs[mode]) + + def expraff_fix_regs_for_mode(self, e, mode=64): + dst = self.expr_fix_regs_for_mode(e.dst, mode) + src = self.expr_fix_regs_for_mode(e.src, mode) + return ExprAff(dst, src) + + def irbloc_fix_regs_for_mode(self, irbloc, mode=64): + for irs in irbloc.irs: + for i, e in enumerate(irs): + """ + special case for 64 bits: + if destination is a 32 bit reg, zero extend the 64 bit reg + """ + if mode == 64: + if (isinstance(e.dst, ExprId) and e.dst.size == 32 and + e.dst in replace_regs[64]): + src = self.expr_fix_regs_for_mode(e.src, mode) + dst = replace_regs[64][e.dst].arg + e = ExprAff(dst, src.zeroExtend(64)) + irs[i] = self.expr_fix_regs_for_mode(e, mode) + irbloc.dst = self.expr_fix_regs_for_mode(irbloc.dst, mode) + + +class ir_x86_32(ir_x86_16): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_x86, 32, symbol_pool) + self.do_stk_segm = False + self.do_ds_segm = False + self.do_str_segm = False + self.do_all_segm = False + self.pc = EIP + self.sp = ESP + + +class ir_x86_64(ir_x86_16): + + def __init__(self, symbol_pool=None): + ir.__init__(self, mn_x86, 64, symbol_pool) + self.do_stk_segm = False + self.do_ds_segm = False + self.do_str_segm = False + self.do_all_segm = False + self.pc = RIP + self.sp = RSP + + def mod_pc(self, instr, instr_ir, extra_ir): + # fix RIP for 64 bit + for i, x in enumerate(instr_ir): + if x.dst != self.pc: + x.dst = x.dst.replace_expr( + {self.pc: ExprInt64(instr.offset + instr.l)}) + x = ExprAff(x.dst, x.src.replace_expr( + {self.pc: ExprInt64(instr.offset + instr.l)})) + instr_ir[i] = x + for b in extra_ir: + for irs in b.irs: + for i, x in enumerate(irs): + if x.dst != self.pc: + x.dst = x.dst.replace_expr( + {self.pc: ExprInt64(instr.offset + instr.l)}) + x = ExprAff(x.dst, x.src.replace_expr( + {self.pc: ExprInt64(instr.offset + instr.l)})) + irs[i] = x diff --git a/miasm2/core/__init__.py b/miasm2/core/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/core/__init__.py diff --git a/miasm2/core/asmbloc.py b/miasm2/core/asmbloc.py new file mode 100644 index 00000000..945eb990 --- /dev/null +++ b/miasm2/core/asmbloc.py @@ -0,0 +1,1412 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import logging +import miasm2.expression.expression as m2_expr +from miasm2.expression.modint import moduint, modint +from miasm2.core.graph import DiGraph +from utils import Disasm_Exception +from miasm2.core.graph import DiGraph +import inspect + +log_asmbloc = logging.getLogger("asmbloc") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log_asmbloc.addHandler(console_handler) +log_asmbloc.setLevel(logging.WARNING) + + +def whoami(): + return inspect.stack()[2][3] + + +def is_int(a): + return isinstance(a, int) or isinstance(a, long) or \ + isinstance(a, moduint) or isinstance(a, modint) + + +def expr_is_label(e): + if isinstance(e, m2_expr.ExprId) and isinstance(e.name, asm_label): + return True + return False + + +def expr_is_int_or_label(e): + if isinstance(e, m2_expr.ExprInt): + return True + if isinstance(e, m2_expr.ExprId) and isinstance(e.name, asm_label): + return True + return False + + +class asm_label: + + def __init__(self, name="", offset=None): + # print whoami() + self.fixedblocs = False + if is_int(name): + name = "loc_%.16X" % (int(name) & 0xFFFFFFFFFFFFFFFF) + self.name = name + self.attrib = None + if offset is None: + self.offset = offset + else: + self.offset = int(offset) + self._hash = hash((self.name, self.offset)) + + def __str__(self): + if isinstance(self.offset, (int, long)): + return "%s:0x%08x" % (self.name, self.offset) + else: + return "%s:%s" % (self.name, str(self.offset)) + + def __repr__(self): + rep = '<asmlabel ' + if self.name: + rep += repr(self.name) + ' ' + rep += '>' + return rep + + def __hash__(self): + return self._hash + + def __eq__(self, a): + if isinstance(a, asm_label): + return self._hash == a._hash + else: + return False + + +class asm_raw: + + def __init__(self, raw=""): + self.raw = raw + + def __str__(self): + return repr(self.raw) + + +class asm_constraint(object): + c_to = "c_to" + c_next = "c_next" + c_bad = "c_bad" + + def __init__(self, label=None, c_t=c_to): + self.label = label + self.c_t = c_t + self._hash = hash((self.label, self.c_t)) + + def __str__(self): + return "%s:%s" % (str(self.c_t), str(self.label)) + + def __hash__(self): + return self._hash + + def __eq__(self, a): + if isinstance(a, asm_constraint): + return self._hash == a._hash + else: + return False + + +class asm_constraint_next(asm_constraint): + + def __init__(self, label=None): + super(asm_constraint_next, self).__init__( + label, c_t=asm_constraint.c_next) + + +class asm_constraint_to(asm_constraint): + + def __init__(self, label=None): + super(asm_constraint_to, self).__init__( + label, c_t=asm_constraint.c_to) + + +class asm_constraint_bad(asm_constraint): + + def __init__(self, label=None): + super(asm_constraint_bad, self).__init__( + label, c_t=asm_constraint.c_bad) + + +class asm_bloc: + + def __init__(self, label=None): + self.bto = set() + self.lines = [] + self.label = label + + def __str__(self): + out = [] + out.append(str(self.label)) + for l in self.lines: + out.append(str(l)) + if self.bto: + lbls = ["->"] + for l in self.bto: + if l is None: + lbls.append("Unknown? ") + else: + lbls.append(str(l) + " ") + lbls = '\t'.join(lbls) + out.append(lbls) + return '\n'.join(out) + + def addline(self, l): + self.lines.append(l) + + def addto(self, c): + assert(type(self.bto) is set) + self.bto.add(c) + + def split(self, offset, l): + log_asmbloc.debug('split at %x' % offset) + i = -1 + offsets = [x.offset for x in self.lines] + if not l.offset in offsets: + log_asmbloc.warning( + 'cannot split bloc at %X ' % offset + + 'middle instruction? default middle') + offsets.sort() + return None + new_bloc = asm_bloc(l) + i = offsets.index(offset) + + self.lines, new_bloc.lines = self.lines[:i], self.lines[i:] + flow_mod_instr = self.get_flow_instr() + log_asmbloc.debug('flow mod %r' % flow_mod_instr) + c = asm_constraint(l, asm_constraint.c_next) + # move dst if flowgraph modifier was in original bloc + # (usecase: split delayslot bloc) + if flow_mod_instr: + for xx in self.bto: + log_asmbloc.debug('lbl %s' % xx) + c_next = set( + [x for x in self.bto if x.c_t == asm_constraint.c_next]) + c_to = [x for x in self.bto if x.c_t != asm_constraint.c_next] + self.bto = set([c] + c_to) + new_bloc.bto = c_next + else: + new_bloc.bto = self.bto + self.bto = set([c]) + return new_bloc + + def get_range(self): + if len(self.lines): + return self.lines[0].offset, self.lines[-1].offset + else: + return 0, 0 + + def get_offsets(self): + return [x.offset for x in self.lines] + + def add_cst(self, offset, c_t, symbol_pool): + if type(offset) in [int, long]: + l = symbol_pool.getby_offset_create(offset) + elif type(offset) is str: + l = symbol_pool.getby_name_create(offset) + elif isinstance(offset, asm_label): + l = offset + else: + raise ValueError('unknown offset type %r' % offset) + c = asm_constraint(l, c_t) + self.bto.add(c) + + def get_flow_instr(self): + if not self.lines: + return None + for i in xrange(-1, -1 - self.lines[0].delayslot - 1, -1): + l = self.lines[i] + if l.splitflow() or l.breakflow(): + raise NotImplementedError('not fully functional') + return l + + def get_subcall_instr(self): + if not self.lines: + return None + for i in xrange(-1, -1 - self.lines[0].delayslot - 1, -1): + l = self.lines[i] + if l.is_subcall(): + return l + + def get_next(self): + for x in self.bto: + if x.c_t == asm_constraint.c_next: + return x.label + return None + + +class asm_symbol_pool: + + def __init__(self, no_collision=True): + self.labels = [] + self.s = {} + self.s_offset = {} + self.no_collision = no_collision + self.label_num = 0 + + def add_label(self, name="", offset=None): + """ + This should be the only method to create new asm_label objects + """ + l = asm_label(name, offset) + collision = None + if l.offset in self.s_offset and l != self.s_offset[l.offset]: + collision = 'offset' + if l.name in self.s and l != self.s[l.name]: + collision = 'name' + if self.no_collision and collision == 'offset': + raise ValueError('symbol %s has same offset as %s' % + (l, self.s_offset[l.offset])) + if self.no_collision and collision == 'name': + raise ValueError( + 'symbol %s has same name as %s' % (l, self.s[l.name])) + self.labels.append(l) + if l.offset is not None: + self.s_offset[l.offset] = l + if l.name != "": + self.s[l.name] = l + return l + + def remove(self, obj): + """ + obj can be an asm_label or an offset + """ + if isinstance(obj, asm_label): + if obj.name in self.s: + del(self.s[obj.name]) + if obj.offset is not None and obj.offset in self.s_offset: + del(self.s_offset[obj.offset]) + else: + offset = int(obj) + if offset in self.s_offset: + obj = self.s_offset[offset] + del(self.s_offset[offset]) + if obj.name in self.s: + del(self.s[obj.name]) + + def del_offset(self, l=None): + if l is not None: + if l.offset in self.s_offset: + del(self.s_offset[l.offset]) + l.offset = None + else: + self.s_offset = {} + for l in self.s: + self.s[l].offset = None + + def getby_offset(self, offset): + return self.s_offset.get(offset, None) + + def getby_name(self, name): + return self.s.get(name, None) + + def getby_name_create(self, name): + l = self.getby_name(name) + if l is None: + l = self.add_label(name) + return l + + def getby_offset_create(self, offset): + l = self.getby_offset(offset) + if l is None: + l = self.add_label(offset, offset) + return l + + def rename(self, s, newname): + if not s.name in self.s: + log_asmbloc.warn('unk symb') + return + del(self.s[s.name]) + s.name = newname + self.s[s.name] = s + + def set_offset(self, label, offset): + # Note that there is a special case when the offset is a list + # it happens when offsets are recomputed in resolve_symbol* + if not label in self.labels: + raise ValueError('label %s not in symbol pool' % label) + if not isinstance(label.offset, list) and label.offset in self.s_offset: + del(self.s_offset[label.offset]) + label.offset = offset + if not isinstance(label.offset, list): + self.s_offset[label.offset] = label + + def items(self): + return self.labels[:] + + def __str__(self): + return reduce(lambda x, y: x + str(y) + '\n', self.labels, "") + + def __in__(self, obj): + if obj in self.s: + return True + if obj in self.s_offset: + return True + return False + + def __getitem__(self, item): + if item in self.s: + return self.s[item] + if item in self.s_offset: + return self.s_offset[item] + raise KeyError('unknown symbol %r' % item) + + def __contains__(self, item): + return item in self.s or item in self.s_offset + + def merge(self, symbol_pool): + self.labels += symbol_pool.labels + self.s.update(symbol_pool.s) + self.s_offset.update(symbol_pool.s_offset) + + def gen_label(self): + l = self.add_label("lbl_gen_%.8X" % (self.label_num)) + self.label_num += 1 + return l + + +def dis_bloc(mnemo, pool_bin, cur_bloc, offset, job_done, symbol_pool, + dont_dis=[], split_dis=[ + ], follow_call=False, patch_instr_symb=True, + dontdis_retcall=False, lines_wd=None, + dis_bloc_callback=None, dont_dis_nulstart_bloc=False, + attrib={}): + # pool_bin.offset = offset + lines_cpt = 0 + in_delayslot = False + delayslot_count = mnemo.delayslot + offsets_to_dis = set() + add_next_offset = False + log_asmbloc.debug("dis at %X" % int(offset)) + while not in_delayslot or delayslot_count > 0: + if in_delayslot: + delayslot_count -= 1 + + if offset in dont_dis or (lines_cpt > 0 and offset in split_dis): + cur_bloc.add_cst(offset, asm_constraint.c_next, symbol_pool) + offsets_to_dis.add(offset) + break + + lines_cpt += 1 + if lines_wd is not None and lines_cpt > lines_wd: + # log_asmbloc.warning( "lines watchdog reached at %X"%int(offset)) + break + + if offset in job_done: + cur_bloc.add_cst(offset, asm_constraint.c_next, symbol_pool) + break + + off_i = offset + try: + # print repr(pool_bin.getbytes(offset, 4)) + instr = mnemo.dis(pool_bin, attrib, offset) + except (Disasm_Exception, IOError), e: + log_asmbloc.warning(e) + instr = None + + if instr is None: + log_asmbloc.warning("cannot disasm at %X" % int(off_i)) + cur_bloc.add_cst(off_i, asm_constraint.c_bad, symbol_pool) + break + + # XXX TODO nul start block option + if dont_dis_nulstart_bloc and instr.b.count('\x00') == instr.l: + log_asmbloc.warning("reach nul instr at %X" % int(off_i)) + cur_bloc.add_cst(off_i, asm_constraint.c_bad, symbol_pool) + break + + # special case: flow graph modificator in delayslot + if in_delayslot and instr and (instr.splitflow() or instr.breakflow()): + add_next_offset = True + break + + job_done.add(offset) + log_asmbloc.debug("dis at %X" % int(offset)) + + offset += instr.l + log_asmbloc.debug(instr) + log_asmbloc.debug(instr.args) + + cur_bloc.addline(instr) + if not instr.breakflow(): + continue + # test split + if instr.splitflow() and not (instr.is_subcall() and dontdis_retcall): + add_next_offset = True + # cur_bloc.add_cst(n, asm_constraint.c_next, symbol_pool) + pass + if instr.dstflow(): + instr.dstflow2label(symbol_pool) + dst = instr.getdstflow(symbol_pool) + dstn = [] + for d in dst: + if isinstance(d, m2_expr.ExprId) and isinstance(d.name, asm_label): + dstn.append(d.name) + dst = dstn + if (not instr.is_subcall()) or follow_call: + cur_bloc.bto.update( + [asm_constraint(x, asm_constraint.c_to) for x in dst]) + + # get in delayslot mode + in_delayslot = True + delayslot_count = instr.delayslot + + for c in cur_bloc.bto: + if c.c_t == asm_constraint.c_bad: + continue + if isinstance(c.label, asm_label): + offsets_to_dis.add(c.label.offset) + + if add_next_offset: + cur_bloc.add_cst(offset, asm_constraint.c_next, symbol_pool) + offsets_to_dis.add(offset) + + if dis_bloc_callback is not None: + dis_bloc_callback( + mnemo, attrib, pool_bin, cur_bloc, offsets_to_dis, symbol_pool) + # print 'dst', [hex(x) for x in offsets_to_dis] + return offsets_to_dis + + +def split_bloc(mnemo, attrib, pool_bin, blocs, + symbol_pool, more_ref=None, dis_bloc_callback=None): + i = -1 + err = False + if not more_ref: + more_ref = [] + + # get all possible dst + bloc_dst = [symbol_pool.s_offset[x] for x in more_ref] + for b in blocs: + for c in b.bto: + if not isinstance(c.label, asm_label): + continue + if c.c_t == asm_constraint.c_bad: + continue + bloc_dst.append(c.label) + + bloc_dst = [x.offset for x in bloc_dst if x.offset is not None] + + j = -1 + while j < len(blocs) - 1: + j += 1 + cb = blocs[j] + a, b = cb.get_range() + + for off in bloc_dst: + if not (off > a and off <= b): + continue + l = symbol_pool.getby_offset_create(off) + new_b = cb.split(off, l) + log_asmbloc.debug("split bloc %x" % off) + if new_b is None: + log_asmbloc.error("cannot split %x!!" % off) + err = True + break + if dis_bloc_callback: + offsets_to_dis = set( + [x.label.offset for x in new_b.bto + if isinstance(x.label, asm_label)]) + dis_bloc_callback( + mnemo, attrib, pool_bin, new_b, offsets_to_dis, + symbol_pool) + blocs.append(new_b) + a, b = cb.get_range() + + """ + if err: + break + """ + return blocs + + +def dis_bloc_all(mnemo, pool_bin, offset, job_done, symbol_pool, dont_dis=[], + split_dis=[], follow_call=False, patch_instr_symb=True, + dontdis_retcall=False, + blocs_wd=None, lines_wd=None, blocs=None, + dis_bloc_callback=None, dont_dis_nulstart_bloc=False, + attrib={}): + log_asmbloc.info("dis bloc all") + if blocs is None: + blocs = [] + todo = [offset] + + bloc_cpt = 0 + while len(todo): + bloc_cpt += 1 + if blocs_wd is not None and bloc_cpt > blocs_wd: + log_asmbloc.debug("blocs watchdog reached at %X" % int(offset)) + break + + n = int(todo.pop(0)) + if n is None: + continue + if n in job_done: + continue + + if n in dont_dis: + continue + dd_flag = False + for dd in dont_dis: + if not isinstance(dd, tuple): + continue + dd_a, dd_b = dd + if dd_a <= n < dd_b: + dd_flag = True + break + if dd_flag: + continue + l = symbol_pool.getby_offset_create(n) + cur_bloc = asm_bloc(l) + todo += dis_bloc(mnemo, pool_bin, cur_bloc, n, job_done, symbol_pool, + dont_dis, split_dis, follow_call, patch_instr_symb, + dontdis_retcall, + dis_bloc_callback=dis_bloc_callback, + lines_wd=lines_wd, + dont_dis_nulstart_bloc=dont_dis_nulstart_bloc, + attrib=attrib) + blocs.append(cur_bloc) + + return split_bloc(mnemo, attrib, pool_bin, blocs, + symbol_pool, dis_bloc_callback=dis_bloc_callback) + + +def bloc2graph(blocs, label=False, lines=True): + # rankdir=LR; + out = """ +digraph asm_graph { +size="80,50"; +node [ +fontsize = "16", +shape = "box" +]; +""" + for b in blocs: + out += '%s [\n' % b.label.name + out += 'label = "' + + out += b.label.name + "\\l\\\n" + if lines: + for l in b.lines: + if label: + out += "%.8X " % l.offset + out += ("%s\\l\\\n" % l).replace('"', '\\"') + out += '"\n];\n' + + for b in blocs: + for n in b.bto: + # print 'xxxx', n.label, n.label.__class__ + # if isinstance(n.label, ExprId): + # print n.label.name, n.label.name.__class__ + if isinstance(n.label, m2_expr.ExprId): + dst, name, cst = b.label.name, n.label.name, n.c_t + # out+='%s -> %s [ label = "%s" ];\n'%(b.label.name, + # n.label.name, n.c_t) + elif isinstance(b.label, asm_label): + dst, name, cst = b.label.name, n.label.name, n.c_t + else: + continue + out += '%s -> %s [ label = "%s" ];\n' % (dst, name, cst) + + out += "}" + return out + + +def conservative_asm(mnemo, mode, instr, symbols, conservative): + """ + Asm instruction; + Try to keep original instruction bytes if it exists + """ + candidates = mnemo.asm(instr, symbols) + if not candidates: + raise ValueError('cannot asm:%s' % str(instr)) + if not hasattr(instr, "b"): + return candidates[0], candidates + if instr.b in candidates: + return instr.b, candidates + if conservative: + for c in candidates: + if len(c) == len(instr.b): + return c, candidates + return candidates[0], candidates + + +def guess_blocs_size(mnemo, mode, blocs, symbols): + """ + Asm and compute max bloc length + """ + for b in blocs: + log_asmbloc.debug('---') + blen = 0 + blen_max = 0 + for instr in b.lines: + if isinstance(instr, asm_raw): + candidates = [instr.raw] + c = instr.raw + data = c + l = len(c) + else: + l = mnemo.max_instruction_len + data = None + instr.data = data + instr.l = l + blen += l + + b.blen = blen + # bloc with max rel values encoded + b.blen_max = blen + blen_max + log_asmbloc.info("blen: %d max: %d" % (b.blen, b.blen_max)) + + +def group_blocs(blocs): + """ + this function group asm blocs with next constraints + """ + log_asmbloc.info('group_blocs') + # group adjacent blocs + rest = blocs[:] + groups_bloc = {} + d = dict([(x.label, x) for x in rest]) + log_asmbloc.debug([str(x.label) for x in rest]) + + while rest: + b = [rest.pop()] + # find recursive son + fini = False + while not fini: + fini = True + for c in b[-1].bto: + if c.c_t != asm_constraint.c_next: + continue + if c.label in d and d[c.label] in rest: + b.append(d[c.label]) + rest.remove(d[c.label]) + fini = False + break + # check if son in group: + found_in_group = False + for c in b[-1].bto: + if c.c_t != asm_constraint.c_next: + continue + if c.label in groups_bloc: + b += groups_bloc[c.label] + del(groups_bloc[c.label]) + groups_bloc[b[0].label] = b + found_in_group = True + break + + if not found_in_group: + groups_bloc[b[0].label] = b + + # create max label range for bigbloc + for l in groups_bloc: + l.total_max_l = reduce(lambda x, y: x + y.blen_max, groups_bloc[l], 0) + log_asmbloc.debug(("offset totalmax l", l.offset, l.total_max_l)) + if is_int(l.offset): + hof = hex(int(l.offset)) + else: + hof = l.name + log_asmbloc.debug(("offset totalmax l", hof, l.total_max_l)) + return groups_bloc + + +def gen_free_space_intervals(f, max_offset=0xFFFFFFFF): + interval = {} + offset_label = dict([(x.offset_free, x) for x in f]) + offset_label_order = offset_label.keys() + offset_label_order.sort() + offset_label_order.append(max_offset) + offset_label_order.reverse() + + unfree_stop = 0L + while len(offset_label_order) > 1: + offset = offset_label_order.pop() + offset_end = offset + f[offset_label[offset]] + prev = 0 + if unfree_stop > offset_end: + space = 0 + else: + space = offset_label_order[-1] - offset_end + if space < 0: + space = 0 + interval[offset_label[offset]] = space + if offset_label_order[-1] in offset_label: + prev = offset_label[offset_label_order[-1]] + prev = f[prev] + + interval[offset_label[offset]] = space + + unfree_stop = max( + unfree_stop, offset_end, offset_label_order[-1] + prev) + return interval + + +def add_dont_erase(f, dont_erase=[]): + tmp_symbol_pool = asm_symbol_pool() + for a, b in dont_erase: + l = tmp_symbol_pool.add_label(a, a) + l.offset_free = a + f[l] = b - a + return + + +def gen_non_free_mapping(group_bloc, dont_erase=[]): + non_free_mapping = {} + # calculate free space for bloc placing + for g in group_bloc: + rest_len = 0 + g.fixedblocs = False + # if a label in the group is fixed + diff_offset = 0 + for b in group_bloc[g]: + if not is_int(b.label.offset): + diff_offset += b.blen_max + continue + g.fixedblocs = True + g.offset_free = b.label.offset - diff_offset + break + if g.fixedblocs: + non_free_mapping[g] = g.total_max_l + + log_asmbloc.debug("non free bloc:") + log_asmbloc.debug(non_free_mapping) + add_dont_erase(non_free_mapping, dont_erase) + log_asmbloc.debug("non free more:") + log_asmbloc.debug(non_free_mapping) + return non_free_mapping + + +def resolve_symbol( + group_bloc, symbol_pool, dont_erase=[], max_offset=0xFFFFFFFF): + """ + place all asmblocs + """ + log_asmbloc.info('resolve_symbol') + log_asmbloc.info(str(dont_erase)) + bloc_list = [] + unr_bloc = reduce(lambda x, y: x + group_bloc[y], group_bloc, []) + ending_ad = [] + + non_free_mapping = gen_non_free_mapping(group_bloc, dont_erase) + free_interval = gen_free_space_intervals(non_free_mapping, max_offset) + log_asmbloc.debug(free_interval) + + # first big ones + g_tab = [(x.total_max_l, x) for x in group_bloc] + g_tab.sort() + g_tab.reverse() + g_tab = [x[1] for x in g_tab] + + # g_tab => label of grouped blov + # group_bloc => dict of grouped bloc labeled-key + + # first, near callee placing algo + for g in g_tab: + if g.fixedblocs: + continue + finish = False + for x in group_bloc: + if not x in free_interval.keys(): + continue + if free_interval[x] < g.total_max_l: + continue + + for b in group_bloc[x]: + for c in b.bto: + if c.label == g: + tmp = free_interval[x] - g.total_max_l + log_asmbloc.debug( + "consumed %d rest: %d" % (g.total_max_l, int(tmp))) + free_interval[g] = tmp + del(free_interval[x]) + symbol_pool.set_offset( + g, [group_bloc[x][-1].label, group_bloc[x][-1], 1]) + g.fixedblocs = True + finish = True + break + if finish: + break + if finish: + break + + # second, bigger in smaller algo + for g in g_tab: + if g.fixedblocs: + continue + # chose smaller free_interval first + k_tab = [(free_interval[x], x) for x in free_interval] + k_tab.sort() + k_tab = [x[1] for x in k_tab] + # choose free_interval + for k in k_tab: + if g.total_max_l > free_interval[k]: + continue + symbol_pool.set_offset( + g, [group_bloc[k][-1].label, group_bloc[k][-1], 1]) + tmp = free_interval[k] - g.total_max_l + log_asmbloc.debug( + "consumed %d rest: %d" % (g.total_max_l, int(tmp))) + free_interval[g] = tmp + del(free_interval[k]) + + g.fixedblocs = True + break + + while unr_bloc: + # propagate know offset + resolving = False + i = 0 + while i < len(unr_bloc): + if unr_bloc[i].label.offset is None: + i += 1 + continue + resolving = True + log_asmbloc.info("bloc %s resolved" % unr_bloc[i].label) + bloc_list.append((unr_bloc[i], 0)) + g_found = None + for g in g_tab: + if unr_bloc[i] in group_bloc[g]: + if g_found is not None: + raise ValueError('blocin multiple group!!!') + g_found = g + my_group = group_bloc[g_found] + + index = my_group.index(unr_bloc[i]) + if index > 0 and my_group[index - 1] in unr_bloc: + symbol_pool.set_offset( + my_group[index - 1].label, + [unr_bloc[i].label, unr_bloc[i - 1], -1]) + if index < len(my_group) - 1 and my_group[index + 1] in unr_bloc: + symbol_pool.set_offset( + my_group[index + 1].label, + [unr_bloc[i].label, unr_bloc[i], 1]) + del unr_bloc[i] + + if not resolving: + log_asmbloc.warn("cannot resolve symbol! (no symbol fix found)") + else: + continue + + for g in g_tab: + print g + if g.fixedblocs: + print "fixed" + else: + print "not fixed" + raise ValueError('enable to fix bloc') + return bloc_list + + +def calc_symbol_offset(symbol_pool): + s_to_use = set() + + s_dependent = {} + + for label in symbol_pool.items(): + if label.offset is None: + # raise ValueError("symbol missing?", label) + #print "symbol missing?? %s" % label + label.offset_g = None + continue + if not is_int(label.offset): + # construct dependant blocs tree + s_d = label.offset[0] + if not s_d in s_dependent: + s_dependent[s_d] = set() + s_dependent[s_d].add(label) + else: + s_to_use.add(label) + label.offset_g = label.offset + + while s_to_use: + label = s_to_use.pop() + if not label in s_dependent: + continue + for l in s_dependent[label]: + if label.offset_g is None: + raise ValueError("unknown symbol: %s" % str(label.name)) + l.offset_g = label.offset_g + l.offset_g[1].blen * l.offset_g[2] + s_to_use.add(l) + + +def asmbloc_final(mnemo, mode, blocs, symbol_pool, symb_reloc_off=None, conservative = False): + log_asmbloc.info("asmbloc_final") + if symb_reloc_off is None: + symb_reloc_off = {} + fini = False + # asm with minimal instr len + # check if dst label are ok to this encoded form + # recompute if not + # TODO XXXX: implement todo list to remove n^high complexity! + while fini is not True: + + fini = True + my_symb_reloc_off = {} + + calc_symbol_offset(symbol_pool) + + symbols = asm_symbol_pool() + for s, v in symbol_pool.s.items(): + symbols.add_label(s, v.offset_g) + # print symbols + # test if bad encoded relative + for b, t in blocs: + + offset_i = 0 + blen = 0 + my_symb_reloc_off[b.label] = [] + for instr in b.lines: + if isinstance(instr, asm_raw): + offset_i += instr.l # len(instr.data) + continue + # if not [True for a in instr.arg if mnemo.has_symb(a)]: + # offset_i+=len(instr.data) + # continue + sav_a = instr.args[:] # [a.expr for a in instr.args] + # print [str(x) for x in sav_a] + args_e = instr.resolve_args_with_symbols(symbols) + for i, e in enumerate(args_e): + # print 'ee', e.size, e + instr.args[i] = e + + instr.offset = b.label.offset_g + offset_i + if instr.dstflow(): + # instr.l = len(instr.data) + instr.fixDstOffset() + """ + lbls = {} + xxx = instr.getdstflow() + if len(xxx) !=1: + raise ValueError('multi dst ?!') + label = mnemo.get_label(xxx[0]) + is_mem = mnemo.is_mem(xxx[0]) + lbls[label.name] = label.offset_g + instr.fixdst(lbls, b.label.offset_g+b.blen, is_mem) + """ + # else: + # instr.arg = [mnemo.fix_symbol(a, symbol_pool) + # for a in instr.arg] + # pass + symbol_reloc_off = [] + old_l = instr.l + c, candidates = conservative_asm( + mnemo, mode, instr, symbol_reloc_off, conservative) + + # print "XXXX", instr + # print candidates + for i, e in enumerate(sav_a): + instr.args[i] = e + + if len(c) != instr.l: + # good len, bad offset...XXX + b.blen = b.blen - old_l + len(c) + instr.data = c + instr.l = len(c) + fini = False + continue + found = False + for cpos, c in enumerate(candidates): + # if len(c) == len(instr.data): + if len(c) == instr.l: + # print 'UPDD', repr(instr.data), repr(c) + # b.blen = b.blen-old_l+len(c) + instr.data = c + instr.l = len(c) + + found = True + break + if not found: + raise ValueError('something wrong in instr.data') + + if cpos < len(symbol_reloc_off): + my_s = symbol_reloc_off[cpos] + else: + my_s = None + + if my_s is not None: + my_symb_reloc_off[b.label].append(offset_i + my_s) + offset_i += instr.l + blen += instr.l + assert(len(instr.data) == instr.l) + # we have fixed all relative values + # recompute good offsets + for label in symbol_pool.items(): + # if label.offset_g is None: + # fdfd + symbol_pool.set_offset(label, label.offset_g) + + for a, b in my_symb_reloc_off.items(): + symb_reloc_off[a] = b + + +def asm_resolve_final(mnemo, mode, blocs, symbol_pool, dont_erase=[], + max_offset=0xFFFFFFFF, + symb_reloc_off=None, constrain_pos=False): + if symb_reloc_off is None: + symb_reloc_off = {} + # asmbloc(mnemo, mode, blocs, symbol_pool) + guess_blocs_size(mnemo, mode, blocs, symbol_pool) + bloc_g = group_blocs(blocs) + + resolved_b = resolve_symbol(bloc_g, symbol_pool, dont_erase=dont_erase, + max_offset=max_offset) + + asmbloc_final(mnemo, mode, resolved_b, symbol_pool, symb_reloc_off) + written_bytes = {} + patches = {} + for b, t in resolved_b: + offset = b.label.offset + for i in b.lines: + assert(i.data is not None) + patches[offset] = i.data + for c in range(i.l): + if offset + c in written_bytes: + raise ValueError( + "overlapping bytes in asssembly %X" % int(offset)) + written_bytes[offset + c] = 1 + i.offset = offset + i.l = i.l + offset += i.l + + return resolved_b, patches + + +def blist2graph(ab): + """ + ab: list of asmbloc + return: graph of asmbloc + """ + g = DiGraph() + g.lbl2bloc = {} + for b in ab: + g.lbl2bloc[b.label] = b + g.add_node(b.label) + for x in b.bto: + g.add_edge(b.label, x.label) + return g + + +class basicblocs: + + def __init__(self, ab=[]): + self.blocs = {} + self.g = DiGraph() + self.add_blocs(ab) + + def add(self, b): + self.blocs[b.label] = b + self.g.add_node(b.label) + for dst in b.bto: + if isinstance(dst.label, asm_label): + self.g.add_edge(b.label, dst.label) + + def add_blocs(self, ab): + for b in ab: + self.add(b) + + def get_bad_dst(self): + o = set() + for b in self.blocs.values(): + for c in b.bto: + if c.c_t == asm_constraint.c_bad: + o.add(b) + return o + + +def find_parents(blocs, l): + p = set() + for b in blocs: + if l in [x.label for x in b.bto if isinstance(x.label, asm_label)]: + p.add(b.label) + return p + + +def bloc_blink(blocs): + for b in blocs: + b.parents = find_parents(blocs, b.label) + + +def getbloc_around(blocs, a, level=3, done=None, blocby_label=None): + + if not blocby_label: + blocby_label = {} + for b in blocs: + blocby_label[b.label] = b + if done is None: + done = set() + + done.add(a) + if not level: + return done + for b in a.parents: + b = blocby_label[b] + if b in done: + continue + done.update(getbloc_around(blocs, b, level - 1, done, blocby_label)) + for b in a.bto: + b = blocby_label[b.label] + if b in done: + continue + done.update(getbloc_around(blocs, b, level - 1, done, blocby_label)) + return done + + +def getbloc_parents(blocs, a, level=3, done=None, blocby_label=None): + + if not blocby_label: + blocby_label = {} + for b in blocs: + blocby_label[b.label] = b + if done is None: + done = set() + + done.add(a) + if not level: + return done + for b in a.parents: + b = blocby_label[b] + if b in done: + continue + done.update(getbloc_parents(blocs, b, level - 1, done, blocby_label)) + return done + +# get ONLY level_X parents + + +def getbloc_parents_strict( + blocs, a, level=3, rez=None, done=None, blocby_label=None): + + if not blocby_label: + blocby_label = {} + for b in blocs: + blocby_label[b.label] = b + if rez is None: + rez = set() + if done is None: + done = set() + + done.add(a) + if level == 0: + rez.add(a) + if not level: + return rez + for b in a.parents: + b = blocby_label[b] + if b in done: + continue + rez.update(getbloc_parents_strict( + blocs, b, level - 1, rez, done, blocby_label)) + return rez + + +def bloc_find_path_next(blocs, blocby_label, a, b, path=None): + if path == None: + path = [] + if a == b: + return [path] + + all_path = [] + for x in a.bto: + if x.c_t != asm_constraint.c_next: + continue + if not x.label in blocby_label: + print 'XXX unknown label' + continue + x = blocby_label[x.label] + all_path += bloc_find_path_next(blocs, blocby_label, x, b, path + [a]) + # stop if at least one path found + if all_path: + return all_path + return all_path + + +def bloc_merge(blocs, symbol_pool, dont_merge=[]): + i = -1 + """ + # TODO XXXX implement find all path for digraph + + g = blist2graph(blocs) + g.lbl2node = dict([(b.label, b) for b in blocs]) + + while i<len(blocs)-1: + i+=1 + b = blocs[i] + if b.label in dont_merge: + continue + + successors = [x for x in g.successors(b.label)] + predecessors = [x for x in g.predecessors(b.label)] + # if bloc doesn't self ref + if b.label in successors: + continue + # and bloc has only one parent + if len(predecessors) != 1: + continue + # may merge + bpl = predecessors[0] + + # and parent has only one son + p_s = [x for x in g.successors(bpl)] + if len(p_s)!=1: + continue + + bp = g.lbl2node[bpl] + # and parent has not a next constraint yet + found = False + for gpl in g.predecessors(bpl): + gp = g.lbl2node[gpl] + for x in gp.bto: + if x.c_t != asm_constraint.c_next: + continue + if x.label == bpl: + found = True + break + if found: + break + if found: + continue + if bp.lines: + l = bp.lines[-1] + #jmp opt; jcc opt + if l.is_subcall(): + continue + if l.breakflow() and l.dstflow(): + bp.lines.pop() + #merge + #sons = b.bto[:] + + # update parents + for s in b.bto: + if not isinstance(s.label, asm_label): continue + if s.label.name == None: + continue + if not s.label in g.lbl2node: + print "unknown parent XXX" + continue + bs = g.lbl2node[s.label] + for p in g.predecessors(bs.label): + if p == b.label: + bs.parents.discard(p) + bs.parents.add(bp.label) + bp.lines+=b.lines + bp.bto = b.bto + #symbol_pool.remove(b.label) + del(blocs[i]) + i = -1 + + return + """ + blocby_label = {} + for b in blocs: + blocby_label[b.label] = b + b.parents = find_parents(blocs, b.label) + + while i < len(blocs) - 1: + i += 1 + b = blocs[i] + if b.label in dont_merge: + continue + p = set(b.parents) + # if bloc dont self ref + if b.label in p: + continue + # and bloc has only one parent + if len(p) != 1: + continue + # may merge + bpl = p.pop() + # bp = getblocby_label(blocs, bpl) + bp = blocby_label[bpl] + # and parent has only one son + if len(bp.bto) != 1: + continue + """ + and will not create next loop composed of constraint_next from son to + parent + """ + path = bloc_find_path_next(blocs, blocby_label, b, bp) + if path: + continue + if bp.lines: + l = bp.lines[-1] + # jmp opt; jcc opt + if l.is_subcall(): + continue + if l.breakflow() and l.dstflow(): + bp.lines.pop() + # merge + # sons = b.bto[:] + + # update parents + for s in b.bto: + if not isinstance(s.label, asm_label): + continue + if s.label.name == None: + continue + if not s.label in blocby_label: + print "unknown parent XXX" + continue + bs = blocby_label[s.label] + for p in list(bs.parents): + if p == b.label: + bs.parents.discard(p) + bs.parents.add(bp.label) + bp.lines += b.lines + bp.bto = b.bto + # symbol_pool.remove(b.label) + del(blocs[i]) + i = -1 + + +class disasmEngine(object): + + def __init__(self, arch, attrib, bs=None, **kwargs): + self.arch = arch + self.attrib = attrib + self.bs = bs + self.symbol_pool = asm_symbol_pool() + self.dont_dis = [] + self.split_dis = [] + self.follow_call = False + self.patch_instr_symb = True + self.dontdis_retcall = False + self.lines_wd = None + self.blocs_wd = None + self.dis_bloc_callback = None + self.dont_dis_nulstart_bloc = False + self.job_done = set() + self.__dict__.update(kwargs) + + def dis_bloc(self, offset): + job_done = set() + l = self.symbol_pool.getby_offset_create(offset) + current_bloc = asm_bloc(l) + dis_bloc(self.arch, self.bs, current_bloc, offset, self.job_done, + self.symbol_pool, + dont_dis=self.dont_dis, split_dis=self.split_dis, + follow_call=self.follow_call, + patch_instr_symb=self.patch_instr_symb, + dontdis_retcall=self.dontdis_retcall, + lines_wd=self.lines_wd, + dis_bloc_callback=self.dis_bloc_callback, + dont_dis_nulstart_bloc=self.dont_dis_nulstart_bloc, + attrib=self.attrib) + return current_bloc + + def dis_multibloc(self, offset, blocs=None): + blocs = dis_bloc_all(self.arch, self.bs, offset, self.job_done, + self.symbol_pool, + dont_dis=self.dont_dis, split_dis=self.split_dis, + follow_call=self.follow_call, + patch_instr_symb=self.patch_instr_symb, + dontdis_retcall=self.dontdis_retcall, + blocs_wd=self.blocs_wd, + lines_wd=self.lines_wd, + blocs=blocs, + dis_bloc_callback=self.dis_bloc_callback, + dont_dis_nulstart_bloc=self.dont_dis_nulstart_bloc, + attrib=self.attrib) + return blocs + diff --git a/miasm2/core/bin_stream.py b/miasm2/core/bin_stream.py new file mode 100644 index 00000000..7ae6d3fa --- /dev/null +++ b/miasm2/core/bin_stream.py @@ -0,0 +1,175 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# + + +class bin_stream(object): + + def __init__(self, *args, **kargs): + pass + + def __repr__(self): + return "<%s !!>" % self.__class__.__name__ + + def hexdump(self, offset, l): + return + + def getbytes(self, start, l=1): + return self.bin[start:start + l] + + def getbits(self, start, n): + if not n: + return 0 + o = 0 + if n > self.getlen() * 8: + raise ValueError('not enought bits %r %r' % (n, len(self.bin) * 8)) + while n: + # print 'xxx', n, start + i = start / 8 + c = self.getbytes(i) + if not c: + raise IOError + c = ord(c) + # print 'o', hex(c) + r = 8 - start % 8 + c &= (1 << r) - 1 + # print 'm', hex(c) + l = min(r, n) + # print 'd', r-l + c >>= (r - l) + o <<= l + o |= c + n -= l + start += l + return o + + +class bin_stream_str(bin_stream): + + def __init__(self, bin="", offset=0L, shift=0): + bin_stream.__init__(self) + if offset > len(bin): + raise IOError + self.bin = bin + self.offset = offset + self.shift = shift + self.l = len(bin) + if "is_addr_in" in self.bin.__class__.__dict__: + self.is_addr_in = lambda ad: self.bin.is_addr_in(ad) + + def getbytes(self, start, l=1): + if start + l > self.l: + raise IOError + + return super(bin_stream_str, self).getbytes(start + self.shift, l) + + def readbs(self, l=1): + if self.offset + l > self.l: + raise IOError + self.offset += l + print hex(self.offset + self.shift) + return self.bin[self.offset - l + self.shift:self.offset + self.shift] + + def writebs(self, l=1): + raise ValueError('writebs unsupported') + + def __str__(self): + out = self.bin[self.offset + self.shift:] + return out + + def setoffset(self, val): + self.offset = val + + def __len__(self): + return len(self.bin) - self.offset + self.shift + + def getlen(self): + return len(self.bin) - self.offset + self.shift + + +class bin_stream_file(bin_stream): + + def __init__(self, bin, offset=0L): + bin_stream.__init__(self) + self.bin = bin + self.bin.seek(0, 2) + self.l = self.bin.tell() + self.offset = offset + + def getoffset(self): + return self.bin.tell() + + def setoffset(self, val): + self.bin.seek(val) + offset = property(getoffset, setoffset) + + def readbs(self, l=1): + if self.offset + l > self.l: + raise IOError + return self.bin.read(l) + + def writebs(self, l=1): + if self.offset + l > self.l: + raise IOError + return self.bin.write(l) + + def __str__(self): + return str(self.bin) + + +class bin_stream_pe(bin_stream): + + def __init__(self, bin="", offset=0L): + bin_stream.__init__(self) + # print 'ELF/PE' + self.mylen = len(bin) + if offset > bin.__len__(): + raise IOError + self.bin = bin + self.offset = offset + self.l = bin.__len__() + if "is_addr_in" in self.bin.__class__.__dict__: + self.is_addr_in = lambda ad: self.bin.is_addr_in(ad) + + def getlen(self): + return self.mylen + # s = self.bin.parent.SHList[-1] + # l = self.bin.parent.rva2virt(s.addr+s.size) + # return l + + def readbs(self, l=1): + if self.offset + l > self.l: + raise IOError + self.offset += l + return self.bin(self.offset - l, self.offset) + + def writebs(self, l=1): + raise ValueError('writebs unsupported') + + def getbytes(self, start, l=1): + return self.bin(start, start + l) + + def __str__(self): + out = self.bin[self.offset:] + return out + + def setoffset(self, val): + self.offset = val + + +class bin_stream_elf(bin_stream_pe): + pass diff --git a/miasm2/core/cpu.py b/miasm2/core/cpu.py new file mode 100644 index 00000000..7d672caa --- /dev/null +++ b/miasm2/core/cpu.py @@ -0,0 +1,1804 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import re +import struct +import logging +from pyparsing import * +from miasm2.expression.expression import * +from miasm2.core import asmbloc +from collections import defaultdict +from bin_stream import bin_stream, bin_stream_str +from utils import Disasm_Exception +from miasm2.expression.simplifications import expr_simp + +log = logging.getLogger("cpuhelper") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.WARN) + +# size2int = {8:ExprInt8, 16:ExprInt16, 32:ExprInt32,64:ExprInt64} + + +class bitobj: + + def __init__(self, s=""): + if not s: + bits = [] + else: + bits = list(bin(int(str(s).encode('hex'), 16))[2:]) + bits = [int(x) for x in bits] + if len(bits) % 8: + bits = [0 for x in xrange(8 - (len(bits) % 8))] + bits + bits = ['0' for x in xrange(len(s) * 8 - len(bits))] + bits + self.bits = bits + self.offset = 0 + + def __len__(self): + return len(self.bits) - self.offset + + def getbits(self, n): + if not n: + return 0 + o = 0 + if n > len(self.bits) - self.offset: + raise ValueError('not enought bits %r %r' % (n, len(self.bits))) + b = self.bits[self.offset:self.offset + n] + b = int("".join([str(x) for x in b]), 2) + self.offset += n + return b + + def putbits(self, b, n): + if not n: + return + bits = list(bin(b)[2:]) + bits = [int(x) for x in bits] + bits = [0 for x in xrange(n - len(bits))] + bits + self.bits += bits + + def tostring(self): + if len(self.bits) % 8: + raise ValueError( + 'num bits must be 8 bit aligned: %d' % len(self.bits)) + b = int("".join([str(x) for x in self.bits]), 2) + b = "%X" % b + b = '0' * (len(self.bits) / 4 - len(b)) + b + b = b.decode('hex') + return b + + def reset(self): + self.offset = 0 + + def copy_state(self): + b = self.__class__() + b.bits = self.bits + b.offset = self.offset + return b + + +def literal_list(l): + l = l[:] + l.sort() + l = l[::-1] + o = Literal(l[0]) + for x in l[1:]: + o |= Literal(x) + return o + + +class reg_info: + + def __init__(self, reg_str, reg_expr): + self.str = reg_str + self.expr = reg_expr + self.parser = literal_list(reg_str).setParseAction(self.reg2expr) + + def reg2expr(self, s): + i = self.str.index(s[0]) + return self.expr[i] + + def expr2regi(self, e): + return self.expr.index(e) + + +def gen_reg(rname, env, sz=32): + """ + Gen reg expr and parser + Equivalent to: + PC = ExprId('PC') + reg_pc_str = ['PC'] + reg_pc_expr = [ExprId(x, sz) for x in reg_pc_str] + regpc = reg_info(reg_pc_str, reg_pc_expr) + + class bs_rname(m_reg): + reg = regi_rname + + bsrname = bs(l=0, cls=(bs_rname,)) + + """ + rnamel = rname.lower() + r = ExprId(rname, sz) + reg_str = [rname] + reg_expr = [r] + regi = reg_info(reg_str, reg_expr) + # define as global val + cname = "bs_" + rnamel + c = type(cname, (m_reg,), {'reg': regi}) + env[rname] = r + env["regi_" + rnamel] = regi + env[cname] = c + env["bs" + rnamel] = bs(l=0, cls=(c,)) + return r, regi + +LPARENTHESIS = Literal("(") +RPARENTHESIS = Literal(")") + + +# + + +def int2expr(t): + v = t[0] + return (ExprInt, v) + + +def parse_op(t): + v = t[0] + return (ExprOp, v) + + +def parse_id(t): + v = t[0] + return (ExprId, v) + + +def ast_parse_op(t): + if len(t) == 1: + return t[0] + if len(t) == 2: + if t[0] in ['-', '+', '!']: + return ExprOp(t[0], t[1]) + if len(t) == 3: + args = [t[0], t[2]] + return ExprOp(t[1], t[0], t[2]) + t = t[::-1] + while len(t) >= 3: + o1, op, o2 = t.pop(), t.pop(), t.pop() + e = ExprOp(op, o1, o2) + t.append(e) + if len(t) != 1: + raise NotImplementedError('strange op') + return t[0] + + +def ast_id2expr(a): + return ExprId(a, 32) + + +def ast_int2expr(a): + return ExprInt32(a) + + +def ast_raw2expr(a, my_id2expr, my_int2expr): + assert(isinstance(a, tuple)) + if a[0] is ExprId: + e = my_id2expr(a[1]) + elif a[0] is ExprInt: + e = my_int2expr(a[1]) + elif a[0] is ExprOp: + out = [] + for x in a[1]: + if isinstance(x, tuple): + x = ast_raw2expr(x, my_id2expr, my_int2expr) + out.append(x) + e = ast_parse_op(out) + else: + raise TypeError('unknown type') + return e + + +def ast_get_ids(a): + assert(isinstance(a, tuple)) + if a[0] is ExprId: + return set([a[1]]) + elif a[0] is ExprInt: + return set() + elif a[0] is ExprOp: + out = set() + for x in a[1]: + if isinstance(x, tuple): + out.update(ast_get_ids(x)) + return out + raise TypeError('unknown type') + + +def _extract_ast_core(a): + assert(isinstance(a, tuple)) + if a[0] in [ExprInt, ExprId]: + return a + elif a[0] is ExprOp: + out = [] + for x in a[1]: + if isinstance(x, tuple): + x = _extract_ast_core(x) + out.append(x) + return tuple([a[0]] + [out]) + else: + raise TypeError('unknown type') + + +def extract_ast_core(v, my_id2expr, my_int2expr): + ast_tokens = _extract_ast_core(v) + ids = ast_get_ids(ast_tokens) + # print 'IDS', ids + ids_expr = [my_id2expr(x) for x in ids] + # print 'IDS_expr', ids_expr + sizes = set([i.size for i in ids_expr]) + # print "SIZE", sizes + if len(sizes) == 0: + pass + elif len(sizes) == 1: + size = sizes.pop() + my_int2expr = lambda x: ExprInt_fromsize(size, x) + else: + raise ValueError('multiple sizes in ids') + e = ast_raw2expr(ast_tokens, my_id2expr, my_int2expr) + return e + + +class parse_ast: + + def __init__(self, id2expr, int2expr, extract_ast=extract_ast_core): + self.id2expr = id2expr + self.int2expr = int2expr + self.extract_ast_core = extract_ast + + def __call__(self, v): + v = v[0] + if isinstance(v, Expr): + return v + return self.extract_ast_core(v, self.id2expr, self.int2expr) + + +def neg_int(t): + x = -t[0] + return x + + +integer = Word(nums).setParseAction(lambda s, l, t: int(t[0])) +hex_int = Combine(Literal('0x') + Word(hexnums)).setParseAction( + lambda s, l, t: int(t[0], 16)) + +# str_int = (Optional('-') + (hex_int | integer)) +str_int_pos = (hex_int | integer) +str_int_neg = (Suppress('-') + (hex_int | integer)).setParseAction(neg_int) + +str_int = str_int_pos | str_int_neg +str_int.setParseAction(int2expr) + +logicop = oneOf('& | ^ >> << <<< >>>') +signop = oneOf('+ -') +multop = oneOf('* / %') +plusop = oneOf('+ -') + + +def gen_base_expr(): + variable = Word(alphas + "_$.", alphanums + "_") + variable.setParseAction(parse_id) + operand = str_int | variable + base_expr = operatorPrecedence(operand, + [("!", 1, opAssoc.RIGHT, parse_op), + (logicop, 2, opAssoc.RIGHT, parse_op), + (signop, 1, opAssoc.RIGHT, parse_op), + (multop, 2, opAssoc.LEFT, parse_op), + (plusop, 2, opAssoc.LEFT, parse_op), ] + ) + return variable, operand, base_expr + + +variable, operand, base_expr = gen_base_expr() + +my_var_parser = parse_ast(ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + +# + + +default_prio = 0x1337 + + +def isbin(s): + return re.match('[0-1]+$', s) + + +def int2bin(i, l): + s = '0' * l + bin(i)[2:] + return s[-l:] + + +def myror32(v, r): + return ((v & 0xFFFFFFFFL) >> r) | ((v << (32 - r)) & 0xFFFFFFFFL) + + +def myrol32(v, r): + return ((v & 0xFFFFFFFFL) >> (32 - r)) | ((v << r) & 0xFFFFFFFFL) + + +class bs(object): + all_new_c = {} + prio = default_prio + + def __init__(self, strbits=None, l=None, cls=None, + fname=None, order=0, flen=None, **kargs): + if fname is None: + # fname = hex(id((strbits, l, cls, fname, order, flen, kargs))) + # fname = hex(id((strbits, l, fname, order, flen))) + # print str((strbits, l, cls, fname, order, flen, kargs)) + fname = hex(id(str((strbits, l, cls, fname, order, flen, kargs)))) + # print fname + if strbits is None: + strbits = "" # "X"*l + elif l is None: + l = len(strbits) + if strbits and isbin(strbits): + value = int(strbits, 2) + elif 'default_val' in kargs: + value = int(kargs['default_val'], 2) + else: + value = None + allbits = list(strbits) + allbits.reverse() + fbits = 0 + fmask = 0 + while allbits: + a = allbits.pop() + if a == " ": + continue + fbits <<= 1 + fmask <<= 1 + if a in '01': + a = int(a) + fbits |= a + fmask |= 1 + lmask = (1 << l) - 1 + # gen conditional field + # if flen is None: + # flen = lambda mode, v:l + if cls: + for b in cls: + if 'flen' in b.__dict__: + flen = getattr(b, 'flen') + + self.strbits = strbits + self.l = l + self.cls = cls + self.fname = fname + self.order = order + self.lmask = lmask + self.fbits = fbits + self.fmask = fmask + self.flen = flen + self.value = value + self.kargs = kargs + + def __getitem__(self, item): + return getattr(self, item) + + def __repr__(self): + o = self.__class__.__name__ + if self.fname: + o += "_%s" % self.fname + o += "_%(strbits)s" % self + if self.cls: + o += '_' + '_'.join([x.__name__ for x in self.cls]) + return o + + def gen(self, parent): + c_name = 'nbsi' + if self.cls: + c_name += '_' + '_'.join([x.__name__ for x in self.cls]) + bases = list(self.cls) + else: + bases = [] + # bsi added at end of list + # used to use first function of added class + bases += [bsi] + # new_c = type(c_name, tuple(bases), {}) + k = c_name, tuple(bases) + if k in self.all_new_c: + new_c = self.all_new_c[k] + else: + new_c = type(c_name, tuple(bases), {}) + self.all_new_c[k] = new_c + c = new_c(parent, + self.strbits, self.l, self.cls, + self.fname, self.order, self.lmask, self.fbits, + self.fmask, self.value, self.flen, **self.kargs) + return c + + def check_fbits(self, v): + return v & self.fmask == self.fbits + + @classmethod + def flen(cls, v): + raise NotImplementedError('not fully functional') + + +class dum_arg(object): + + def __init__(self, e=None): + self.expr = e + + @staticmethod + def arg2str(e): + return str(e) + + +class bsopt(bs): + + def ispresent(self): + return True + + +class bsi(object): + + def __init__(self, parent, strbits, l, cls, fname, order, + lmask, fbits, fmask, value, flen, **kargs): + self.parent = parent + self.strbits = strbits + self.l = l + self.cls = cls + self.fname = fname + self.order = order + self.lmask = lmask + self.fbits = fbits + self.fmask = fmask + self.flen = flen + self.value = value + self.kargs = kargs + self.__dict__.update(self.kargs) + + def decode(self, v): + self.value = v & self.lmask + return True + + def encode(self): + # self.value = v&self.lmask + return True + + def clone(self): + s = self.__class__(self.parent, + self.strbits, self.l, self.cls, + self.fname, self.order, self.lmask, self.fbits, + self.fmask, self.value, self.flen, **self.kargs) + s.__dict__.update(self.kargs) + if hasattr(self, 'expr'): + s.expr = self.expr + return s + + def __hash__(self): + kargs = [] + for k, v in self.kargs.items(): + if isinstance(v, list): + v = tuple(v) + kargs.append((k, v)) + l = [self.strbits, self.l, self.cls, + self.fname, self.order, self.lmask, self.fbits, + self.fmask, self.value] # + kargs + # l = [self.value] + return hash(tuple(l)) + + +class bs_divert(object): + prio = default_prio + + def __init__(self, **kargs): + self.args = kargs + + def __getattr__(self, item): + if item in self.__dict__: + return self.__dict__[item] + elif item in self.args: + return self.args.get(item) + else: + raise AttributeError + + +class bs_name(bs_divert): + prio = 1 + + def divert(self, i, candidates): + out = [] + for candidate in candidates: + cls, name, bases, dct, fields = candidate + for new_name, value in self.args['name'].items(): + nfields = fields[:] + s = int2bin(value, self.args['l']) + args = dict(self.args) + args.update({'strbits': s}) + f = bs(**args) + nfields[i] = f + ndct = dict(dct) + ndct['name'] = new_name + out.append((cls, new_name, bases, ndct, nfields)) + return out + + +class bs_mod_name(bs_divert): + prio = 2 + + def divert(self, i, candidates): + out = [] + for candidate in candidates: + cls, name, bases, dct, fields = candidate + for value, new_name in enumerate(self.args['mn_mod']): + nfields = fields[:] + s = int2bin(value, self.args['l']) + args = dict(self.args) + args.update({'strbits': s}) + f = bs(**args) + nfields[i] = f + ndct = dict(dct) + # new_name = ndct['name'] + new_name + ndct['name'] = self.modname(ndct['name'], value) + # ndct['name'] = new_name + out.append((cls, new_name, bases, ndct, nfields)) + return out + + def modname(self, name, i): + return name + self.args['mn_mod'][i] + + +class bs_cond(bsi): + pass + + +class bs_swapargs(bs_divert): + + def divert(self, i, candidates): + # print candidates + out = [] + for cls, name, bases, dct, fields in candidates: + # args not permuted + ndct = dict(dct) + nfields = fields[:] + # gen fix field + f = gen_bsint(0, self.args['l'], self.args) + nfields[i] = f + out.append((cls, name, bases, ndct, nfields)) + + # args permuted + ndct = dict(dct) + nfields = fields[:] + ap = ndct['args_permut'][:] + a = ap.pop(0) + b = ap.pop(0) + ndct['args_permut'] = [b, a] + ap + # print ndct['args_permut'] + # gen fix field + f = gen_bsint(1, self.args['l'], self.args) + nfields[i] = f + + out.append((cls, name, bases, ndct, nfields)) + return out + + +class m_arg(object): + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + self.expr = e + return start, stop + try: + v, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + self.expr = v[0] + return start, stop + + @staticmethod + def arg2str(e): + return str(e) + + +class m_reg(m_arg): + prio = default_prio + + @property + def parser(self): + return self.reg.parser + + def decode(self, v): + self.expr = self.reg.expr[0] + return True + + def encode(self): + return self.expr == self.reg.expr[0] + + @staticmethod + def arg2str(e): + return str(e) + + +class reg_noarg(object): + reg_info = None + parser = None + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + self.expr = e + return start, stop + try: + v, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + self.expr = v[0] + return start, stop + + @staticmethod + def arg2str(e): + return str(e) + + def decode(self, v): + v = v & self.lmask + if v >= len(self.reg_info.expr): + return False + self.expr = self.reg_info.expr[v] + return True + + def encode(self): + if not self.expr in self.reg_info.expr: + log.debug("cannot encode reg %r" % self.expr) + return False + self.value = self.reg_info.expr.index(self.expr) + if self.value > self.lmask: + log.debug("cannot encode field value %x %x" % + (self.value, self.lmask)) + return False + return True + + def check_fbits(self, v): + return v & self.fmask == self.fbits + + +class mn_prefix: + + def __init__(self): + b = None + + +def swap16(v): + return struct.unpack('<H', struct.pack('>H', v))[0] + + +def swap32(v): + return struct.unpack('<I', struct.pack('>I', v))[0] + + +def perm_inv(p): + o = [None for x in xrange(len(p))] + for i, x in enumerate(p): + o[x] = i + return o + + +def gen_bsint(value, l, args): + s = int2bin(value, l) + args = dict(args) + args.update({'strbits': s}) + f = bs(**args) + return f + +total_scans = 0 + + +def branch2nodes(branch, nodes=None): + if nodes is None: + node = [] + for k, v in branch.items(): + if not isinstance(v, dict): + continue + for k2 in v.keys(): + nodes.append((k, k2)) + branch2nodes(v, nodes) + + +def factor_one_bit(tree): + if isinstance(tree, set): + return tree + new_keys = defaultdict(lambda: defaultdict(dict)) + if len(tree) == 1: + return tree + for k, v in tree.items(): + # print k, v + if k == "mn": + new_keys[k] = v + continue + l, fmask, fbits, fname, flen = k + if flen is not None or l <= 1: + new_keys[k] = v + continue + cfmask = fmask >> (l - 1) + nfmask = fmask & ((1 << (l - 1)) - 1) + cfbits = fbits >> (l - 1) + nfbits = fbits & ((1 << (l - 1)) - 1) + ck = 1, cfmask, cfbits, None, flen + nk = l - 1, nfmask, nfbits, fname, flen + # print ck + if nk in new_keys[ck]: + raise NotImplementedError('not fully functional') + new_keys[ck][nk] = v + for k, v in new_keys.items(): + new_keys[k] = factor_one_bit(v) + # try factor sons + if len(new_keys) != 1: + return new_keys + subtree = new_keys.values()[0] + if len(subtree) != 1: + return new_keys + if subtree.keys()[0] == 'mn': + return new_keys + + return new_keys + + +def factor_fields(tree): + if not isinstance(tree, dict): + return tree + if len(tree) != 1: + return tree + # merge + k1, v1 = tree.items()[0] + if k1 == "mn": + return tree + l1, fmask1, fbits1, fname1, flen1 = k1 + if fname1 is not None: + return tree + if flen1 is not None: + return tree + + if not isinstance(v1, dict): + return tree + if len(v1) != 1: + return tree + k2, v2 = v1.items()[0] + if k2 == "mn": + return tree + l2, fmask2, fbits2, fname2, flen2 = k2 + if fname2 is not None: + return tree + if flen2 is not None: + return tree + l = l1 + l2 + fmask = (fmask1 << l2) | fmask2 + fbits = (fbits1 << l2) | fbits2 + fname = fname2 + flen = flen2 + k = l, fmask, fbits, fname, flen + new_keys = {k: v2} + return new_keys + + +def factor_fields_all(tree): + if not isinstance(tree, dict): + return tree + new_keys = {} + for k, v in tree.items(): + v = factor_fields(v) + new_keys[k] = factor_fields_all(v) + return new_keys + + +def factor_tree(tree): + new_keys = {} + i = 1 + min_len = min([x[0] for x in tree.keys()]) + while i < min_len: + + i += 1 + + +def graph_tree(tree): + nodes = [] + branch2nodes(tree, nodes) + + out = """ + digraph G { + """ + for a, b in nodes: + # print a, id(a) + # print b, id(b) + if b == 'mn': + continue + out += "%s -> %s;\n" % (id(a), id(b)) + out += "}" + open('graph.txt', 'w').write(out) + + +def add_candidate_to_tree(tree, c): + branch = tree + for f in c.fields: + if f.l == 0: + continue + # print len(bits), f.l + # if f.flen: + # pass + # print f + node = f.l, f.fmask, f.fbits, f.fname, f.flen + # node = f.strbits, f.l, f.cls, f.fname, f.order, f.lmask, f.fbits, + # f.fmask, f.value#, tuple(f.kargs.items()) + + if not node in branch: + branch[node] = {} + branch = branch[node] + if not 'mn' in branch: + branch['mn'] = set() + branch['mn'].add(c) + + +def add_candidate(bases, c): + add_candidate_to_tree(bases[0].bintree, c) + + +def getfieldby_name(fields, fname): + f = filter(lambda x: hasattr(x, 'fname') and x.fname == fname, fields) + if len(f) != 1: + raise ValueError('more than one field with name: %s' % fname) + return f[0] + + +def getfieldindexby_name(fields, fname): + for i, f in enumerate(fields): + if hasattr(f, 'fname') and f.fname == fname: + return f, i + return None + + +class metamn(type): + + def __new__(mcs, name, bases, dct): + if name == "cls_mn" or name.startswith('mn_'): + return type.__new__(mcs, name, bases, dct) + alias = dct.get('alias', False) + # fields = [bm_cond]+dct['fields'] + fields = bases[0].mod_fields(dct['fields']) + # print 'f1', dct['fields'] + # print 'f2', fields + if not 'name' in dct: + dct["name"] = bases[0].getmn(name) + if 'args' in dct: + # special case for permuted arguments + o = [] + p = [] + for i, a in enumerate(dct['args']): + o.append((i, a)) + if a in fields: + p.append((fields.index(a), a)) + p.sort() + p = [x[1] for x in p] + p = [dct['args'].index(x) for x in p] + dct['args_permut'] = perm_inv(p) + # order fields + f_ordered = [x for x in enumerate(fields)] + f_ordered.sort(key=lambda x: (x[1].prio, x[0])) + candidates = bases[0].gen_modes(mcs, name, bases, dct, fields) + for i, fc in f_ordered: + # print fc, isinstance(fc, bs_divert) + if isinstance(fc, bs_divert): + # print 'iiii', fc + candidates = fc.divert(i, candidates) + for cls, name, bases, dct, fields in candidates: + ndct = dict(dct) + fields = [f for f in fields if f] + ndct['fields'] = fields + ndct['mn_len'] = sum([x.l for x in fields]) + c = type.__new__(cls, name, bases, ndct) + c.alias = alias + c.check_mnemo(fields) + c.num = bases[0].num + bases[0].num += 1 + bases[0].all_mn.append(c) + mode = dct['mode'] + # print 'add mnemo', c.name, c.mode, len(bases[0].all_mn_mode[mode]) + # print fields + # if 'args_permut' in dct: + # print dct['args_permut'] + bases[0].all_mn_mode[mode].append(c) + bases[0].all_mn_name[c.name].append(c) + i = c() + i.init_class() + bases[0].all_mn_inst[c].append(i) + add_candidate(bases, c) + # gen byte lookup + off = 0 + o = "" + for f in i.fields_order: + if not isinstance(f, bsi): + raise ValueError('f is not bsi') + if f.l == 0: + continue + # if f.fmask: + o += f.strbits + # print o, len(o) + # fd + return c + + +class instruction(object): + + def __init__(self, name, mode, args, args_str=None, additional_info=None): + self.name = name + self.mode = mode + self.args = args + if args_str is None: + raise NotImplementedError('not fully functional') + self.args_str = args_str + self.additional_info = additional_info + + def gen_args(self, args): + out = ', '.join([str(x) for x in args]) + return out + + def __str__(self): + o = "%-10s " % self.name + args = [] + args_str = self.args_str + if args_str is None: + args_str = [lambda x:str(x) for i in xrange(len(self.args))] + for arg, arg_str in zip(self.args, args_str): + if not isinstance(arg, Expr): + raise ValueError('zarb arg type') + x = arg_str(arg) + args.append(x) + o += self.gen_args(args) + return o + + def resolve_args_with_symbols(self, symbols=None): + if symbols is None: + symbols = {} + args_out = [] + for a in self.args: + e = a + # try to resolve symbols using symbols (0 for default value) + ids = get_expr_ids(e) + fixed_ids = {} + for x in ids: + if isinstance(x.name, asmbloc.asm_label): + name = x.name.name + if not name in symbols: + raise ValueError('unresolved symbol! %r' % x) + else: + name = x.name + # special symbol + if name == '$': + value = ExprInt_from(x, self.offset) + fixed_ids[x] = value + continue + if not name in symbols: + continue + if symbols[name].offset is None: + default_size = self.get_symbol_size(x, symbols) + value = ExprInt_fromsize(default_size, 0) # default value + else: + size = x.size + if size is None: + default_size = self.get_symbol_size(x, symbols) + size = default_size + value = ExprInt_fromsize(size, symbols[name].offset) + fixed_ids[x] = value + e = e.replace_expr(fixed_ids) + # print 'replaced e', e, fixed_ids + e = expr_simp(e) + # print 'replaced e simp', e, fixed_ids + args_out.append(e) + # print "args out", [str(x) for x in args_out] + return args_out + + def get_info(self, c): + return + + +class cls_mn(object): + __metaclass__ = metamn + args_symb = [] + instruction = instruction + + @classmethod + def guess_mnemo(cls, bs, mode, pre_dis_info, offset): + candidates = [] + + candidates = set() + + fname_values = pre_dis_info + todo = [(0, dict(fname_values), branch, offset * 8) + for branch in cls.bintree.items()] + cpt = 0 + if hasattr(bs, 'getlen'): + bs_l = bs.getlen() + else: + bs_l = len(bs) + # print fname_values + for bvalo, fname_values, branch, offset_b in todo: + (l, fmask, fbits, fname, flen), vals = branch + cpt += 1 + # print 'len', l, fmask, fbits, fname, flen + if flen is not None: + l = flen(mode, fname_values) + # print 'len', fname, l + if l is not None: + # print fname, hex(bs_l), l + if bs_l * 8 - offset_b < l: + continue + # print hex(offset_b) + v = cls.getbits(bs, offset_b, l) + bval = (bvalo << l) + v + # print 'TEST', bval, fname, offset_b, cpt, (l, fmask, fbits), + # hex(v), hex(v & fmask), hex(fbits), v & fmask == fbits + offset_b += l + if v & fmask != fbits: + continue + if fname is not None and not fname in fname_values: + fname_values[fname] = bval + bval = 0 + # print vals + for nb, v in vals.items(): + if 'mn' in nb: + candidates.update(v) + else: + todo.append((bval, dict(fname_values), (nb, v), offset_b)) + + candidates = [c for c in candidates] # if c.mode == mode] + + if not candidates: + raise Disasm_Exception('cannot disasm (guess) at %X' % offset) + return candidates + + def reset_class(self): + for f in self.fields_order: + if f.strbits and isbin(f.strbits): + # print 'a', + f.value = int(f.strbits, 2) + elif 'default_val' in f.kargs: + # print 'b', + f.value = int(f.kargs['default_val'], 2) + else: + # print 'c', + f.value = None + # print "reset", f.fname, f.value + if f.fname: + # print 'SET asm', f.fname + setattr(self, f.fname, f) + + def init_class(self): + args = [] + fields_order = [] + to_decode = [] + off = 0 + for i, fc in enumerate(self.fields): + f = fc.gen(self) + f.offset = off + off += f.l + fields_order.append(f) + to_decode.append((i, f)) + + if isinstance(f, m_arg): + args.append(f) + # print f, fc.fname + if f.fname: + # print 'SET asm', f.fname + setattr(self, f.fname, f) + # print args + if hasattr(self, 'args_permut'): + args = [args[self.args_permut[i]] + for i in xrange(len(self.args_permut))] + to_decode.sort(key=lambda x: (x[1].order, x[0])) + to_decode = [fields_order.index(f[1]) for f in to_decode] + self.args = args + self.fields_order = fields_order + self.to_decode = to_decode + + def add_pre_dis_info(self, prefix=None): + return True + + @classmethod + def getbits(cls, bs, offset_b, l): + return bs.getbits(offset_b, l) + + @classmethod + def getbytes(cls, bs, offset, l): + return bs.getbytes(offset, l) + + @classmethod + def pre_dis(cls, v_o, mode_o, offset): + return {}, v_o, mode_o, offset, 0 + + def post_dis(self): + return self + + @classmethod + def check_mnemo(cls, fields): + pass + + @classmethod + def mod_fields(cls, fields): + return fields + + @classmethod + def dis(cls, bs_o, mode_o, offset=0): + if not isinstance(bs_o, bin_stream): + bs_o = bin_stream_str(bs_o) + loggg = False + # bs_o == 'fg\x11\x90\x00\x00'#False#'\x48\x15\x44\x33\x22\x11'==bs_o + # print 'disfunc', repr(bs_o) + offset_o = offset + # print 'DIS', hex(offset), mode_o#repr(bs_o.bin) + pre_dis_info, bs, mode, offset, prefix_len = cls.pre_dis( + bs_o, mode_o, offset) + candidates = cls.guess_mnemo(bs, mode, pre_dis_info, offset) + # print 'guess', repr(v), mode, prefix.rex_w + out = [] + out_c = [] + # print 'DIS CAND', len(candidates), mode + if hasattr(bs, 'getlen'): + bs_l = bs.getlen() + else: + bs_l = len(bs) + + alias = False + for c in candidates: + # print 'RRR' + if loggg: + print "*" * 40, mode, c.mode + print c.fields + # c.mode_o = mode_o + # off = c.parse_prefix(mode_o, v) + # bits = bin_stream(v)#[:c.mn_len/8]) + + # c = c() + # c.init_class() + c = cls.all_mn_inst[c][0] + # c.init_class() + c.reset_class() + c.mode = mode + # for f in c.fields_order: print f.is_present + + if not c.add_pre_dis_info(pre_dis_info): # = prefix#cls.mnprefix() + continue + # print "zz", c.rex_w.value + """ + if prefix.opmode != c.mp[1]: + continue + if prefix.admode != c.mp[2]: + continue + """ + + args = [] + todo = {} + getok = True + fname_values = dict(pre_dis_info) + offset_b = offset * 8 + # print pre_dis_info + total_l = 0 + for i, f in enumerate(c.fields_order): + # print 'XX', i, f, id(f) + # print 'ZZ', c.rex_x.value + if f.flen is not None: + l = f.flen(mode, fname_values) + else: + l = f.l + # print 'len', l + # print "zz", c.rex_w, c.rex_w.value + if l is not None: + total_l += l + f.l = l + f.is_present = True + if loggg: + print "FIELD", f.__class__, f.fname, offset_b, l + if bs_l * 8 - offset_b < l: + getok = False + break + bv = cls.getbits(bs, offset_b, l) + offset_b += l + if not f.fname in fname_values: + fname_values[f.fname] = bv + todo[i] = bv + else: + f.is_present = False + todo[i] = None + + # print "decode", id(f), f.fname, + # print "l", l, "off", offset_b, "v", todo[i] + # print "zzz", c.rex_w, c.rex_w.value + + if not getok: + continue + + # print 'PRIOdec', [(x[0], x[1].order) for x in c.to_decode] + for i in c.to_decode: + f = c.fields_order[i] + if f.is_present: + # print "zz", f.fname, f.is_present, c.rex_w.value, + # c.rex_b.value, c.rex_x.value + ret = f.decode(todo[i]) + if not ret: + log.debug("cannot decode %r" % (f)) + break + + if not ret: + continue + for a in c.args: + a.expr = expr_simp(a.expr) + # print offset, offset_o, total_l + c.l = prefix_len + total_l / 8 + c.b = cls.getbytes(bs, offset, total_l / 8) + c.offset = offset_o + c = c.post_dis() + if c is None: + continue + c_args = [a.expr for a in c.args] + c_args_str = [] + for a in c.args: + if hasattr(a, 'arg2str'): + c_args_str.append(a.arg2str) + else: + raise NotImplementedError('not fully functional') + c_args_str.append(str) + # c_args_str = [a.arg2str for a in c.args] + instr = cls.instruction(c.name, mode, c_args, c_args_str, + additional_info=c.additional_info()) + instr.l = prefix_len + total_l / 8 + instr.b = cls.getbytes(bs, offset, total_l / 8) + instr.offset = offset_o + instr.get_info(c) + # instr = c.post_dis() + if c.alias: + alias = True + out.append(instr) + out_c.append(c) + if not out: + raise Disasm_Exception('cannot disasm at %X' % offset_o) + if len(out) != 1: + if not alias: + log.warning('dis multiple args ret default') + + assert(len(out) == 2) + for i, o in enumerate(out_c): + if o.alias: + return out[i] + raise NotImplementedError('not fully functional') + # for xx in out: + # print xx + # if xx.name == "ADC": + # pass + return out[0] + + @classmethod + def fromstring(cls, s, mode): + global total_scans + name = re.search('(\S+)', s).groups() + if not name: + raise ValueError('cannot find name', s) + name = name[0] + # print "mnemo_name", name + if not name in cls.all_mn_name: + raise ValueError('unknown name', name) + clist = [x for x in cls.all_mn_name[name]] # if x.mode == mode] + out = [] + out_args = [] + parsers = defaultdict(dict) + # print 'ASM CAND', len(clist), name + + for cc in clist: + #""" + # c = cc() + # c.init_class() + #""" + """ + c = cls.all_mn_inst[cc][0] + c.reset_class() + c.mode = mode + """ + for c in cls.get_cls_instance(cc, mode): + args_expr = [] + args_str = s[len(name):].strip(' ') + + start = 0 + cannot_parse = False + len_o = len(args_str) + + for i, f in enumerate(c.args): + start_i = len_o - len(args_str) + # print i, "will parse", repr(args_str) + if type(f.parser) == tuple: + parser = f.parser + else: + parser = (f.parser,) + for p in parser: + if p in parsers[(i, start_i)]: + continue + try: + total_scans += 1 + # print type(p) + v, start, stop = p.scanString(args_str).next() + # print "pp", args_str, v, start, stop + except StopIteration: + v, start, stop = [None], None, None + if start != 0: + v, start, stop = [None], None, None + parsers[(i, start_i)][p] = v[0], start, stop + + start, stop = f.fromstring(args_str, parsers[(i, start_i)]) + # print args_str, start, stop#, f.expr + # if start is not None: print f.expr + if start != 0: + log.debug("cannot fromstring %r" % (args_str)) + cannot_parse = True + # print "cannot_parse1" + break + if f.expr is None: + raise NotImplementedError('not fully functional') + # print "f expr", repr(f.expr) + f.expr = expr_simp(f.expr) + args_expr.append(f.expr) + a = args_str[start:stop] + args_str = args_str[stop:].strip(' ') + if args_str.startswith(','): + args_str = args_str[1:] + args_str = args_str.strip(' ') + if args_str: + # print "cannot_parse", repr(args_str) + cannot_parse = True + if cannot_parse: + continue + # print [x for x in c.args] + # print [str(x) for x in c.args] + """ + try: + c.value() + except Exception, e: + log.debug("cannot encode %r\n%s"%(e, traceback.format_exc())) + cannot_parse = True + if cannot_parse: + continue + """ + out.append(c) + out_args.append(args_expr) + break + + if len(out) == 0: + raise ValueError('cannot fromstring %r' % s) + if len(out) != 1: + log.warning('fromstring multiple args ret default') + # raise ValueError("cannot parse %r (%d cand)"%(s, len(out))) + c = out[0] + c_args = out_args[0] + + c_args_str = [] + for a in c.args: + if hasattr(a, 'arg2str'): + c_args_str.append(a.arg2str) + else: + raise NotImplementedError('not fully functional') + c_args_str.append(str) + + instr = cls.instruction(c.name, mode, c_args, c_args_str, + additional_info=c.additional_info()) + # instruction(name, attrib, args, args_str, additional_info): + # c = c() + # c.init_class() + # re parse instruction + """ + args_str = s[len(name):].strip(' ') + for i, f in enumerate(c.args): + if isinstance(f, m_arg): + start, stop = f.fromstring(args_str) + args_str = args_str[stop:].strip(' ') + if args_str.startswith(','): + args_str = args_str[1:] + args_str = args_str.strip(' ') + """ + + return instr + + def dup_info(self, infos): + return + + @classmethod + def get_cls_instance(cls, cc, mode, infos=None): + c = cls.all_mn_inst[cc][0] + + c.reset_class() + c.add_pre_dis_info() + c.dup_info(infos) + + c.mode = mode + yield c + + @classmethod + def asm(cls, instr, symbols=None): + # t = time.time() + """ + Re asm instruction by searching mnemo using name and args. We then + can modify args and get the hex of a modified instruction + """ + clist = cls.all_mn_name[instr.name] + clist = [x for x in clist] # if x.mode == instr.mode] + # print 'ASM CAN', len(clist) + vals = [] + candidates = [] + # print "resolve" + args = instr.resolve_args_with_symbols(symbols) + # print "ok", [str(x) for x in args] + """ + args = [] + for i, f in enumerate(cls.args): + e = f.expr + # try to resolve symbols using symbols (0 for default value) + if symbols: + #print 'origine', e + ids = get_expr_ids(e) + fixed_ids = {} + for x in ids: + if not x.name in symbols: + #print 'not IN', x + continue + if symbols[x.name].offset is None: + value = ExprInt32(0) # default value + else: + value = ExprInt_fromsize(x.size, symbols[x.name].offset) + fixed_ids[x] = value + e = e.replace_expr(fixed_ids) + #print 'replaced e', e, fixed_ids + e = expr_simp(e) + #print 'replaced e simp', e, fixed_ids + args.append(e) + """ + for cc in clist: + # if cc.mode != cls.mode: + # continue + """ + c = c() + c.init_class() + """ + for c in cls.get_cls_instance( + cc, instr.mode, instr.additional_info): + + # c = cls.all_mn_inst[cc][0] + # c = cc() + # c.init_class() + + cannot_parse = False + if len(c.args) != len(instr.args): + continue + # print c.mode, c.mp, c.fields[6:] + # print "eee", c.fields + # print [str(x.expr) for x in cls.args] + # only fix args expr + for i in xrange(len(c.args)): + c.args[i].expr = args[i] + # print 'ARGS', [str(x) for x in args] + # for a in c.args: + # print a.expr, + # print + # print instr.mode + v = c.value(instr.mode) + if not v: + log.debug("cannot encode %r" % (c)) + cannot_parse = True + if cannot_parse: + continue + vals += v + candidates.append((c, v)) + if len(vals) == 0: + raise ValueError('cannot asm %r %r' % + (instr.name, [str(x) for x in instr.args])) + if len(vals) != 1: + log.debug('asm multiple args ret default') + # raise ValueError("cannot parse %r (%d cand)"%(s, len(out))) + """ + for x in out: + print repr(x.value()) + print [str(a.expr) for a in x.args] + """ + vals = cls.filter_asm_candidates(instr, candidates) + # vals = list(set(vals)) + # vals.sort(key=lambda x:len(x)) + # dt = time.time() - t + # print 'TIME', dt, str(cls) + + return vals + + @classmethod + def filter_asm_candidates(cls, instr, candidates): + o = [] + for c, v in candidates: + o += v + o.sort(key=lambda x: len(x)) + return o + + def value(self, mode): + # print 'PRIOenc', [(x, self.fields_order[x].order) for x in + # self.to_decode[::-1]] + todo = [(0, [(x, self.fields_order[x]) for x in self.to_decode[::-1]])] + # print todo + result = [] + done = [] + cpt = 0 + + # print 'VALUE'#, self.fields[6:] + while todo: + index, to_decode = todo.pop() + # TEST XXX + for i, f in to_decode: + setattr(self, f.fname, f) + # print 'todo:', len(todo), index, to_decode + # print "OOOOOOO" + # if (index, hash(tuple(to_decode))) in done: + if (index, [x[1].value for x in to_decode]) in done: + # print 'skip', to_decode + continue + done.append((index, [x[1].value for x in to_decode])) + + # done.append((index, to_decode)) + cpt += 1 + can_encode = True + for i, f in to_decode[index:]: + # print 'before', f.value, repr(f) + ret = f.encode() + # print 'encode', len(todo), index, f.fname, f.value, f.l, ret + # print 'ret', ret + if not ret: + log.debug('cannot encode %r' % f) + can_encode = False + break + index += 1 + if ret is True: + continue + + # print ret, index + gcpt = 0 + for i in ret: + gcpt += 1 + o = [] + if ((index, [xx[1].value for xx in to_decode]) in todo or + (index, [xx[1].value for xx in to_decode]) in done): + raise NotImplementedError('not fully functional') + continue + for p, f in to_decode: + fnew = f.clone() + o.append((p, fnew)) + todo.append((index, o)) + can_encode = False + # print 'gcpt', gcpt + break + if not can_encode: + continue + result.append(to_decode) + # print 'CPT', cpt + # print "HEX", len(result), result + return self.decoded2bytes(result) + + def encodefields(self, decoded): + bits = bitobj() + for p, f in decoded: + setattr(self, f.fname, f) + + if f.value is None: + continue + bits.putbits(f.value, f.l) + # if f.l: + # print f.l, hex(f.value), len(bits.bits), bits.bits + xx = bits.tostring() + return bits.tostring() + + def decoded2bytes(self, result): + if not result: + return [] + + out = [] + for decoded in result: + decoded.sort() + # print [f.value for p, f in decoded] + o = self.encodefields(decoded) + if o is None: + continue + out.append(o) + out = list(set(out)) + return out + + def gen_args(self, args): + out = ', '.join([str(x) for x in args]) + return out + + def args2str(self): + args = [] + for arg in self.args: + # XXX todo test + if not (isinstance(arg, Expr) or isinstance(arg.expr, Expr)): + raise ValueError('zarb arg type') + x = str(arg) + args.append(x) + return args + + def __str__(self): + o = "%-10s " % self.name + args = [] + for arg in self.args: + # XXX todo test + if not (isinstance(arg, Expr) or isinstance(arg.expr, Expr)): + raise ValueError('zarb arg type') + x = str(arg) + args.append(x) + + o += self.gen_args(args) + return o + + def parse_prefix(self, v): + return 0 + + def set_dst_symbol(self, symbol_pool): + dst = self.getdstflow(symbol_pool) + args = [] + for d in dst: + if isinstance(d, ExprInt): + l = symbol_pool.getby_offset_create(int(d.arg)) + # print l + a = ExprId(l.name, d.size) + else: + a = d + args.append(a) + self.args_symb = args + + def getdstflow(self, symbol_pool): + return [self.args[0].expr] + + +class imm_noarg(object): + # parser = str_int + intsize = 32 + intmask = (1 << intsize) - 1 + # expr2int = lambda self,x:int(self.expr.arg&self.lmask) + + def int2expr(self, v): + if (v & ~self.intmask) != 0: + return None + return ExprInt_fromsize(self.intsize, v) + + def expr2int(self, e): + if not isinstance(e, ExprInt): + return None + v = int(e.arg) + # print "testimm2", hex(v), hex(self.intmask) + if v & ~self.intmask != 0: + return None + return v + + def fromstring(self, s, parser_result=None): + if parser_result: + e, start, stop = parser_result[self.parser] + else: + try: + e, start, stop = self.parser.scanString(s).next() + except StopIteration: + return None, None + if e is None: + return None, None + # print 'fromstring', hex(e), self.int2expr + assert(isinstance(e, Expr)) + if isinstance(e, tuple): + self.expr = self.int2expr(e[1]) + elif isinstance(e, Expr): + self.expr = e + else: + raise TypeError('zarb expr') + if self.expr is None: + log.debug('cannot fromstring int %r' % s) + return None, None + return start, stop + + def decodeval(self, v): + return v + + def encodeval(self, v): + if v > self.lmask: + return False + return v + + @staticmethod + def arg2str(e): + return str(e) + + def decode(self, v): + v = v & self.lmask + v = self.decodeval(v) + e = self.int2expr(v) + if not e: + return False + self.expr = e + return True + + def encode(self): + v = self.expr2int(self.expr) + if v is None: + return False + v = self.encodeval(v) + if v is False: + return False + self.value = v + return True + + +class imm08_noarg(object): + int2expr = lambda self, x: ExprInt08(x) + + +class imm16_noarg(object): + int2expr = lambda self, x: ExprInt16(x) + + +class imm32_noarg(object): + int2expr = lambda self, x: ExprInt32(x) + + +class imm64_noarg(object): + int2expr = lambda self, x: ExprInt64(x) + + +class int32_noarg(imm_noarg): + intsize = 32 + intmask = (1 << intsize) - 1 + + def decode(self, v): + v = sign_ext(v, self.l, self.intsize) + v = self.decodeval(v) + self.expr = self.int2expr(v) + return True + + def encode(self): + if not isinstance(self.expr, ExprInt): + return False + v = int(self.expr.arg) + if sign_ext(v & self.lmask, self.l, self.intsize) != v: + return False + v = self.encodeval(v & self.lmask) + self.value = v & self.lmask + return True + + +def swap_uint(size, i): + if size == 8: + return i & 0xff + elif size == 16: + return struct.unpack('<H', struct.pack('>H', i & 0xffff))[0] + elif size == 32: + return struct.unpack('<I', struct.pack('>I', i & 0xffffffff))[0] + elif size == 64: + return struct.unpack('<Q', struct.pack('>Q', i & 0xffffffffffffffff))[0] + raise ValueError('unknown int len %r' % size) + + +def swap_sint(size, i): + if size == 8: + return i + elif size == 16: + return struct.unpack('<h', struct.pack('>H', i & 0xffff))[0] + elif size == 32: + return struct.unpack('<i', struct.pack('>I', i & 0xffffffff))[0] + elif size == 64: + return struct.unpack('<q', struct.pack('>Q', i & 0xffffffffffffffff))[0] + raise ValueError('unknown int len %r' % size) + + +def sign_ext(v, s_in, s_out): + assert(s_in <= s_out) + v &= (1 << s_in) - 1 + sign_in = v & (1 << (s_in - 1)) + if not sign_in: + return v + m = (1 << (s_out)) - 1 + m ^= (1 << s_in) - 1 + v |= m + return v diff --git a/miasm2/core/graph.py b/miasm2/core/graph.py new file mode 100644 index 00000000..47047269 --- /dev/null +++ b/miasm2/core/graph.py @@ -0,0 +1,126 @@ +class DiGraph: + + def __init__(self): + self._nodes = set() + self._edges = [] + self._nodes_to = {} + self._nodes_from = {} + + def __repr__(self): + out = [] + for n in self._nodes: + out.append(str(n)) + for a, b in self._edges: + out.append("%s -> %s" % (a, b)) + return '\n'.join(out) + + def nodes(self): + return self._nodes + + def edges(self): + return self._edges + + def add_node(self, n): + if n in self._nodes: + return + self._nodes.add(n) + self._nodes_to[n] = [] + self._nodes_from[n] = [] + + def add_edge(self, a, b): + if not a in self._nodes: + self.add_node(a) + if not b in self._nodes: + self.add_node(b) + self._edges.append((a, b)) + self._nodes_to[a].append((a, b)) + self._nodes_from[b].append((a, b)) + + def add_uniq_edge(self, a, b): + if (a, b) in self._edges: + return + else: + self.add_edge(a, b) + + def del_edge(self, a, b): + self._edges.remove((a, b)) + self._nodes_to[a].remove((a, b)) + self._nodes_from[b].remove((a, b)) + + def predecessors_iter(self, n): + if not n in self._nodes_from: + raise StopIteration + for a, _ in self._nodes_from[n]: + yield a + + def predecessors(self, n): + return [x for x in self.predecessors_iter(n)] + + def successors_iter(self, n): + if not n in self._nodes_to: + raise StopIteration + for _, b in self._nodes_to[n]: + yield b + + def successors(self, n): + return [x for x in self.successors_iter(n)] + + def leaves_iter(self): + for n in self._nodes: + if len(self._nodes_to[n]) == 0: + yield n + + def leaves(self): + return [x for x in self.leaves_iter()] + + def roots_iter(self): + for n in self._nodes: + if len(self._nodes_from[n]) == 0: + yield n + + def roots(self): + return [x for x in self.roots_iter()] + + def find_path(self, a, b, cycles_count=0, done=None): + if done is None: + done = {} + if b in done and done[b] > cycles_count: + return [[]] + if a == b: + return [[a]] + out = [] + for n in self.predecessors(b): + done_n = dict(done) + done_n[b] = done_n.get(b, 0) + 1 + for path in self.find_path(a, n, cycles_count, done_n): + if path and path[0] == a: + out.append(path + [b]) + return out + + def node2str(self, n): + return str(n) + + def edge2str(self, a, b): + return "" + + def dot(self): + out = """ +digraph asm_graph { +graph [ +splines=polyline, +]; +node [ +fontsize = "16", +shape = "box" +]; +""" + for n in self.nodes(): + out += '%s [label="%s"];\n' % ( + hash(n) & 0xFFFFFFFFFFFFFFFF, self.node2str(n)) + + for a, b in self.edges(): + out += '%s -> %s [label="%s"]\n' % (hash(a) & 0xFFFFFFFFFFFFFFFF, + hash(b) & 0xFFFFFFFFFFFFFFFF, + self.edge2str(a, b)) + out += "}" + return out diff --git a/miasm2/core/interval.py b/miasm2/core/interval.py new file mode 100644 index 00000000..cd2a793e --- /dev/null +++ b/miasm2/core/interval.py @@ -0,0 +1,238 @@ +INT_EQ = 0 +INT_B_IN_A = 1 +INT_A_IN_B = -1 +INT_DISJOIN = 2 +INT_JOIN = 3 +INT_JOIN_AB = 4 +INT_JOIN_BA = 5 + +# 0 => eq +# 1 => b in a +# -1 => a in b +# 2 => disjoin +# 3 => join +# 4 => join a,b touch +# 5 => join b,a touch + + +def cmp_interval(a, b): + if a == b: + return INT_EQ + a1, a2 = a + b1, b2 = b + if a1 <= b1 and a2 >= b2: + return INT_B_IN_A + if b1 <= a1 and b2 >= a2: + return INT_A_IN_B + if a2 + 1 == b1: + return INT_JOIN_AB + if b2 + 1 == a1: + return INT_JOIN_BA + if a1 > b2 + 1 or b1 > a2 + 1: + return INT_DISJOIN + return INT_JOIN + +# interval is: [a, b] + + +class interval: + + def __init__(self, a=None): + if a is None: + a = [] + if isinstance(a, interval): + a = a.intervals + self.is_cannon = False + self.intervals = a + self.cannon() + + def __iter__(self): + for x in self.intervals: + yield x + + @classmethod + def cannon_list(cls, tmp): + """ + Return a cannonizes list of intervals + """ + tmp = sorted([x for x in tmp if x[0] <= x[1]]) + out = [] + if not tmp: + return out + out.append(tmp.pop()) + while tmp: + x = tmp.pop() + rez = cmp_interval(out[-1], x) + # print out[-1], x, rez + if rez == INT_EQ: + continue + elif rez == INT_DISJOIN: + out.append(x) + elif rez == INT_B_IN_A: + continue + elif rez in [INT_JOIN, INT_JOIN_AB, INT_JOIN_BA, INT_A_IN_B]: + u, v = x + while out and cmp_interval(out[-1], (u, v)) in [ + INT_JOIN, INT_JOIN_AB, INT_JOIN_BA, INT_A_IN_B]: + u = min(u, out[-1][0]) + v = max(v, out[-1][1]) + out.pop() + out.append((u, v)) + else: + raise ValueError('unknown state', rez) + return out[::-1] + + def cannon(self): + if self.is_cannon is True: + return + self.intervals = interval.cannon_list(self.intervals) + self.is_cannon = True + + def __repr__(self): + if self.intervals: + o = " U ".join(["[0x%X 0x%X]" % (x[0], x[1]) + for x in self.intervals]) + else: + o = "[]" + return o + + def __contains__(self, i): + if isinstance(i, interval): + for x in self.intervals: + is_out = True + for y in i.intervals: + if cmp_interval(x, y) in [INT_EQ, INT_B_IN_A]: + is_out = False + break + if is_out: + return False + return True + else: + for x in self.intervals: + if x[0] <= i <= x[1]: + return True + return False + + def __eq__(self, i): + return self.intervals == i.intervals + + def __add__(self, i): + if isinstance(i, interval): + i = i.intervals + i = interval(self.intervals + i) + return i + + def __sub__(self, v): + to_test = self.intervals[:] + i = -1 + to_del = v.intervals[:] + while i < len(to_test) - 1: + i += 1 + x = to_test[i] + if x[0] > x[1]: + del(to_test[i]) + i -= 1 + continue + + while to_del and to_del[0][1] < x[0]: + del(to_del[0]) + + for y in to_del: + if y[0] > x[1]: + break + rez = cmp_interval(x, y) + if rez == INT_DISJOIN: + continue + elif rez == INT_EQ: + del(to_test[i]) + i -= 1 + break + elif rez == INT_A_IN_B: + del(to_test[i]) + i -= 1 + break + elif rez == INT_B_IN_A: + del(to_test[i]) + i1 = (x[0], y[0] - 1) + i2 = (y[1] + 1, x[1]) + to_test[i:i] = [i1, i2] + i -= 1 + break + elif rez in [INT_JOIN_AB, INT_JOIN_BA]: + continue + elif rez == INT_JOIN: + del(to_test[i]) + if x[0] < y[0]: + to_test[i:i] = [(x[0], y[0] - 1)] + else: + to_test[i:i] = [(y[1] + 1, x[1])] + i -= 1 + break + else: + raise ValueError('unknown state', rez) + return interval(to_test) + + def __and__(self, v): + out = [] + for x in self.intervals: + # print "x", x + if x[0] > x[1]: + continue + for y in v.intervals: + # print 'y', y + rez = cmp_interval(x, y) + # print x, y, rez + if rez == INT_DISJOIN: + continue + elif rez == INT_EQ: + out.append(x) + continue + elif rez == INT_A_IN_B: + out.append(x) + continue + elif rez == INT_B_IN_A: + out.append(y) + continue + elif rez == INT_JOIN_AB: + continue + elif rez == INT_JOIN_BA: + continue + elif rez == INT_JOIN: + if x[0] < y[0]: + out.append((y[0], x[1])) + else: + out.append((x[0], y[1])) + continue + else: + raise ValueError('unknown state', rez) + return interval(out) + + def hull(self): + if not self.intervals: + return None, None + return self.intervals[0][0], self.intervals[-1][1] + + def show(self, img_x=1350, img_y=20, dry_run=False): + """ + show image representing the itnerval + """ + try: + import Image + import ImageDraw + except ImportError: + print 'cannot import python PIL imaging' + return + + img = Image.new('RGB', (img_x, img_y), (100, 100, 100)) + draw = ImageDraw.Draw(img) + i_min, i_max = self.hull() + + print hex(i_min), hex(i_max) + + def addr2x(addr): + return (addr - i_min) * img_x / (i_max - i_min) + for a, b in self.intervals: + draw.rectangle((addr2x(a), 0, addr2x(b), img_y), (200, 0, 0)) + + if dry_run is False: + img.show() diff --git a/miasm2/core/parse_asm.py b/miasm2/core/parse_asm.py new file mode 100644 index 00000000..c8967dab --- /dev/null +++ b/miasm2/core/parse_asm.py @@ -0,0 +1,237 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import re +import struct +import miasm2.expression.expression as m2_expr +from miasm2.core.asmbloc import * + +declarator = {'byte': 'B', + 'word': 'H', + 'dword': 'I', + 'qword': 'Q', + 'long': 'I', 'zero': 'I', + } + + +def guess_next_new_label(symbol_pool, gen_label_index=0): + i = 0 + gen_name = "loc_%.8X" + while True: + name = gen_name % i + l = symbol_pool.getby_name(name) + if l is None: + return symbol_pool.add_label(name) + i += 1 + + +def parse_txt(mnemo, attrib, txt, symbol_pool=None, gen_label_index=0): + if symbol_pool is None: + symbol_pool = asm_symbol_pool() + + lines_text = [] + lines_data = [] + lines_bss = [] + + lines = lines_text + # parse each line + for line in txt.split('\n'): + # empty + if re.match(r'\s*$', line): + continue + # comment + if re.match(r'\s*;\S*', line): + continue + # labels to forget + r = re.match(r'\s*\.LF[BE]\d\s*:', line) + if r: + continue + # label beginning with .L + r = re.match(r'\s*(\.L\S+)\s*:', line) + if r: + l = r.groups()[0] + l = symbol_pool.getby_name_create(l) + lines.append(l) + continue + # directive + if re.match(r'\s*\.', line): + r = re.match(r'\s*\.(\S+)', line) + directive = r.groups()[0] + if directive == 'text': + lines = lines_text + continue + if directive == 'data': + lines = lines_data + continue + if directive == 'bss': + lines = lines_bss + continue + if directive in ['string', 'ascii']: + # XXX HACK + line = line.replace(r'\n', '\n').replace(r'\r', '\r') + raw = line[line.find(r'"') + 1:line.rfind(r"'")] + if directive == 'string': + raw += "\x00" + lines.append(asm_raw(raw)) + continue + if directive == 'ustring': + # XXX HACK + line = line.replace(r'\n', '\n').replace(r'\r', '\r') + raw = line[line.find(r'"') + 1:line.rfind(r"'")] + "\x00" + raw = "".join(map(lambda x: x + '\x00', raw)) + lines.append(asm_raw(raw)) + continue + if directive in declarator: + data_raw = line[r.end():].split() + try: + data_int = [] + for b in data_raw: + if re.search(r'0x', b): + data_int.append(int(b, 16)) + else: + data_int.append(int(b) % (1 << 32)) + raw = reduce(lambda x, y: x + struct.pack( + declarator[directive], y), data_int, "") + except ValueError: + raw = line + lines.append(asm_raw(raw)) + continue + if directive == 'comm': + # TODO + continue + if directive == 'split': # custom command + lines.append(asm_raw(line.strip())) + continue + if directive == 'dontsplit': # custom command + lines.append(asm_raw(line.strip())) + continue + if directive in ['file', 'intel_syntax', 'globl', 'local', + 'type', 'size', 'align', 'ident', 'section']: + continue + if directive[0:4] == 'cfi_': + continue + + raise ValueError("unknown directive %s" % str(directive)) + + # label + r = re.match(r'\s*(\S+)\s*:', line) + if r: + l = r.groups()[0] + l = symbol_pool.getby_name_create(l) + lines.append(l) + continue + + # code + if ';' in line: + line = line[:line.find(';')] + line = line.strip(' ').strip('\t') + instr = mnemo.fromstring(line, attrib) + if instr.dstflow(): + instr.dstflow2label(symbol_pool) + lines.append(instr) + + log_asmbloc.info("___pre asm oki___") + # make blocs + # gen_label_index = 0 + + blocs_sections = [] + bloc_num = 0 + for lines in [lines_text, lines_data, lines_bss]: + state = 0 + i = 0 + blocs = [] + blocs_sections.append(blocs) + bloc_to_nlink = None + block_may_link = False + while i < len(lines): + # print 'DEAL', lines[i], state + # no current bloc + if state == 0: + if not isinstance(lines[i], asm_label): + l = guess_next_new_label(symbol_pool) + lines[i:i] = [l] + else: + l = lines[i] + b = asm_bloc(l) + b.bloc_num = bloc_num + bloc_num += 1 + blocs.append(b) + state = 1 + i += 1 + if bloc_to_nlink: + # print 'nlink!' + bloc_to_nlink.addto( + asm_constraint(b.label, asm_constraint.c_next)) + bloc_to_nlink = None + + # in bloc + elif state == 1: + # asm_raw + if isinstance(lines[i], asm_raw): + if lines[i].raw.startswith('.split'): + state = 0 + block_may_link = False + i += 1 + elif lines[i].raw.startswith('.dontsplit'): + # print 'dontsplit' + state = 1 + block_may_link = True + i += 1 + else: + b.addline(lines[i]) + i += 1 + # asm_label + elif isinstance(lines[i], asm_label): + if block_may_link: + # print 'nlink!' + b.addto( + asm_constraint(lines[i], asm_constraint.c_next)) + block_may_link = False + state = 0 + # instruction + else: + b.addline(lines[i]) + if lines[i].dstflow(): + ''' + mydst = lines[i].args + if len(mydst)==1 and mnemo.get_symbols(mydst[0]): + arg = dict(mydst[0]) + symbs = mnemo.get_symbols(arg) + """ + TODO XXX redo this (as many miasm parts) + """ + l = symbs[0][0] + lines[i].setdstflow([l]) + b.addto(asm_constraint(l, asm_constraint.c_to)) + ''' + for x in lines[i].getdstflow(symbol_pool): + if not isinstance(x, m2_expr.ExprId): + continue + if x in mnemo.regs.all_regs_ids: + continue + b.addto(asm_constraint(x, asm_constraint.c_to)) + + # TODO XXX redo this really + + if not lines[i].breakflow() and i + 1 < len(lines): + if isinstance(lines[i + 1], asm_label): + l = lines[i + 1] + else: + l = guess_next_new_label(symbol_pool) + lines[i + 1:i + 1] = [l] + else: + state = 0 + + if lines[i].splitflow(): + bloc_to_nlink = b + if not lines[i].breakflow() or lines[i].splitflow(): + block_may_link = True + else: + block_may_link = False + + i += 1 + + for b in blocs_sections[0]: + log_asmbloc.info(b) + + return blocs_sections, symbol_pool diff --git a/miasm2/core/utils.py b/miasm2/core/utils.py new file mode 100644 index 00000000..44d1e8e2 --- /dev/null +++ b/miasm2/core/utils.py @@ -0,0 +1,39 @@ +import struct + +upck8 = lambda x: struct.unpack('B', x)[0] +upck16 = lambda x: struct.unpack('H', x)[0] +upck32 = lambda x: struct.unpack('I', x)[0] +upck64 = lambda x: struct.unpack('Q', x)[0] +pck16 = lambda x: struct.pack('H', x) +pck32 = lambda x: struct.pack('I', x) +pck64 = lambda x: struct.pack('Q', x) + + +class Disasm_Exception(Exception): + pass + + +def hexdump(src, length=16): + FILTER = ''.join( + [(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)]) + lines = [] + for c in xrange(0, len(src), length): + chars = src[c:c + length] + hex = ' '.join(["%02x" % ord(x) for x in chars]) + printable = ''.join( + ["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars]) + lines.append("%04x %-*s %s\n" % (c, length * 3, hex, printable)) + print ''.join(lines) + +# stackoverflow.com/questions/2912231 + +import collections + + +class keydefaultdict(collections.defaultdict): + + def __missing__(self, key): + if self.default_factory is None: + raise KeyError(key) + value = self[key] = self.default_factory(key) + return value diff --git a/miasm2/expression/__init__.py b/miasm2/expression/__init__.py new file mode 100644 index 00000000..fbabaacf --- /dev/null +++ b/miasm2/expression/__init__.py @@ -0,0 +1,18 @@ +#!/usr/bin/env python +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# diff --git a/miasm2/expression/expression.py b/miasm2/expression/expression.py new file mode 100644 index 00000000..3d73ee10 --- /dev/null +++ b/miasm2/expression/expression.py @@ -0,0 +1,1253 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# These module implements Miasm IR components and basic operations related. +# IR components are : +# - ExprInt +# - ExprId +# - ExprAff +# - ExprCond +# - ExprMem +# - ExprOp +# - ExprSlice +# - ExprCompose +# + + +import itertools +from miasm2.expression.modint import * +from miasm2.core.graph import DiGraph + + +def visit_chk(visitor): + "Function decorator launching callback on Expression visit" + def wrapped(e, cb, test_visit=lambda x: True): + if (test_visit is not None) and (not test_visit(e)): + return e + e_new = visitor(e, cb, test_visit) + if e_new is None: + return None + e_new2 = cb(e_new) + return e_new2 + return wrapped + +# Hashing constants +EXPRINT = 1 +EXPRID = 2 +EXPRAFF = 3 +EXPRCOND = 4 +EXPRMEM = 5 +EXPROP = 6 +EXPRSLICE = 5 +EXPRCOMPOSE = 5 + +# Expression display + + +class DiGraphExpr(DiGraph): + + """Enhanced graph for Expression diplay + Expression are displayed as a tree with node and edge labeled + with only relevant information""" + + def node2str(self, node): + if isinstance(node, ExprOp): + return node.op + elif isinstance(node, ExprId): + return node.name + elif isinstance(node, ExprMem): + return "@%d" % node.size + elif isinstance(node, ExprCompose): + return "{ %d }" % node.size + elif isinstance(node, ExprCond): + return "? %d" % node.size + elif isinstance(node, ExprSlice): + return "[%d:%d]" % (node.start, node.stop) + return str(node) + + def edge2str(self, nfrom, nto): + if isinstance(nfrom, ExprCompose): + for i in nfrom.args: + if i[0] == nto: + return "[%s, %s]" % (i[1], i[2]) + elif isinstance(nfrom, ExprCond): + if nfrom.cond == nto: + return "?" + elif nfrom.src1 == nto: + return "True" + elif nfrom.src2 == nto: + return "False" + + return "" + + +# IR definitions + +class Expr(object): + + "Parent class for Miasm Expressions" + + is_term = False # Terminal expression + is_simp = False # Expression already simplified + is_canon = False # Expression already canonised + is_eval = False # Expression already evalued + + def set_size(self, value): + raise ValueError('size is not mutable') + size = property(lambda self: self._size) + + def __init__(self, arg): + self.arg = arg + + # Common operations + def __str__(self): + return str(self.arg) + + def __getitem__(self, i): + if not isinstance(i, slice): + raise TypeError("Expression: Bad slice: %s" % i) + start, stop, step = i.indices(self.size) + if step != 1: + raise ValueError("Expression: Bad slice: %s" % i) + return ExprSlice(self, start, stop) + + def get_size(self): + raise DeprecationWarning("use X.size instead of X.get_size()") + + def get_r(self, mem_read=False, cst_read=False): + return self.arg.get_r(mem_read, cst_read) + + def get_w(self): + return self.arg.get_w() + + def __repr__(self): + return "<%s_%d_0x%x>" % (self.__class__.__name__, self.size, id(self)) + + def __hash__(self): + return self._hash + + def __eq__(self, a): + if isinstance(a, Expr): + return self._hash == a._hash + else: + return False + + def __ne__(self, a): + return not self.__eq__(a) + + def __add__(self, a): + return ExprOp('+', self, a) + + def __sub__(self, a): + return ExprOp('+', self, ExprOp('-', a)) + + def __div__(self, a): + return ExprOp('/', self, a) + + def __mod__(self, a): + return ExprOp('%', self, a) + + def __mul__(self, a): + return ExprOp('*', self, a) + + def __lshift__(self, a): + return ExprOp('<<', self, a) + + def __rshift__(self, a): + return ExprOp('>>', self, a) + + def __xor__(self, a): + return ExprOp('^', self, a) + + def __or__(self, a): + return ExprOp('|', self, a) + + def __and__(self, a): + return ExprOp('&', self, a) + + def __neg__(self): + return ExprOp('-', self) + + def __invert__(self): + s = self.size + return ExprOp('^', self, ExprInt(mod_size2uint[s](size2mask(s)))) + + def copy(self): + "Deep copy of the expression" + return self.visit(lambda x: x) + + def replace_expr(self, dct=None): + """Find and replace sub expression using dct + @dct: dictionnary of Expr -> * + """ + if dct is None: + dct = {} + + def my_replace(e, dct): + if e in dct: + return dct[e] + return e + return self.visit(lambda e: my_replace(e, dct)) + + def canonize(self): + "Canonize the Expression" + + def must_canon(e): + # print 'test VISIT', e + return not e.is_simp + + def my_canon(e): + if e.is_simp: + return e + if isinstance(e, ExprOp): + if e.is_associative(): + # ((a+b) + c) => (a + b + c) + args = [] + for a in e.args: + if isinstance(a, ExprOp) and e.op == a.op: + args += a.args + else: + args.append(a) + args = canonize_expr_list(args) + new_e = ExprOp(e.op, *args) + else: + new_e = e + elif isinstance(e, ExprCompose): + new_e = ExprCompose(canonize_expr_list_compose(e.args)) + else: + new_e = e + return new_e + return self.visit(my_canon, must_canon) + + def msb(self): + "Return the Most Significant Bit" + s = self.size + return self[s - 1:s] + + def zeroExtend(self, size): + """Zero extend to size + @size: int + """ + assert(self.size <= size) + if self.size == size: + return self + ad_size = size - self.size + n = ExprInt_fromsize(ad_size, 0) + return ExprCompose([(self, 0, self.size), + (n, self.size, size)]) + + def signExtend(self, size): + """Sign extend to size + @size: int + """ + assert(self.size <= size) + if self.size == size: + return self + ad_size = size - self.size + c = ExprCompose([(self, 0, self.size), + (ExprCond(self.msb(), + ExprInt_fromsize( + ad_size, size2mask(ad_size)), + ExprInt_fromsize(ad_size, 0)), + self.size, size) + ]) + return c + + def graph_recursive(self, graph): + """Recursive method used by graph + @graph: miasm2.core.graph.DiGraph instance + Update @graph instance to include sons + This is an Abstract method""" + + raise ValueError("Abstract method") + + def graph(self): + """Return a DiGraph instance standing for Expr tree + Instance's display functions have been override for better visibility + Wrapper on graph_recursive""" + + # Create recursively the graph + graph = DiGraphExpr() + self.graph_recursive(graph) + + return graph + + def set_mask(self, value): + raise ValueError('mask is not mutable') + mask = property(lambda self: ExprInt_fromsize(self.size, -1)) + + +class ExprInt(Expr): + + """An ExprInt represent a constant in Miasm IR. + + Some use cases: + - Constant 0x42 + - Constant -0x30 + - Constant 0x12345678 on 32bits + """ + + def __init__(self, arg): + """Create an ExprInt from a numpy int + @arg: numpy int""" + + if not is_modint(arg): + raise ValueError('arg must by numpy int! %s' % arg) + + self.arg = arg + self._size = self.arg.size + self._hash = self.myhash() + + def __get_int(self): + "Return self integer representation" + return int(self.arg & size2mask(self.size)) + + def __str__(self): + if self.arg < 0: + return str("-0x%X" % (- self.__get_int())) + else: + return str("0x%X" % self.__get_int()) + + def get_r(self, mem_read=False, cst_read=False): + if cst_read: + return set([self]) + else: + return set() + + def get_w(self): + return set() + + def __contains__(self, e): + return self == e + + def myhash(self): + return hash((EXPRINT, self.arg, self.size)) + + def __repr__(self): + return Expr.__repr__(self)[:-1] + " 0x%X>" % self.__get_int() + + @visit_chk + def visit(self, cb, tv=None): + return self + + def copy(self): + return ExprInt(self.arg) + + def depth(self): + return 1 + + def graph_recursive(self, graph): + graph.add_node(self) + + +class ExprId(Expr): + + """An ExprId represent an identifier in Miasm IR. + + Some use cases: + - EAX register + - 'start' offset + - variable v1 + """ + + def __init__(self, name, size=32, is_term=False): + """Create an identifier + @name: str, identifier's name + @size: int, identifier's size + @is_term: boolean, is the identifier a terminal expression ? + """ + + self.name, self._size = name, size + self.is_term = is_term + self._hash = self.myhash() + + def __str__(self): + return str(self.name) + + def get_r(self, mem_read=False, cst_read=False): + return set([self]) + + def get_w(self): + return set([self]) + + def __contains__(self, e): + return self == e + + def myhash(self): + # TODO XXX: hash size ?? + return hash((EXPRID, self.name, self._size)) + + def __repr__(self): + return Expr.__repr__(self)[:-1] + " %s>" % self.name + + @visit_chk + def visit(self, cb, tv=None): + return self + + def copy(self): + return ExprId(self.name, self._size) + + def depth(self): + return 1 + + def graph_recursive(self, graph): + graph.add_node(self) + + +class ExprAff(Expr): + + """An ExprAff represent an affection from an Expression to another one. + + Some use cases: + - var1 <- 2 + """ + + def __init__(self, dst, src): + """Create an ExprAff for dst <- src + @dst: Expr, affectation destination + @src: Expr, affectation source + """ + + if dst.size != src.size: + raise ValueError( + "sanitycheck: ExprAff args must have same size! %s" % + ([(str(x), x.size) for x in [dst, src]])) + + if isinstance(dst, ExprSlice): + # Complete the source with missing slice parts + self.dst = dst.arg + rest = [(ExprSlice(dst.arg, r[0], r[1]), r[0], r[1]) + for r in dst.slice_rest()] + all_a = [(src, dst.start, dst.stop)] + rest + all_a.sort(key=lambda x: x[1]) + self.src = ExprCompose(all_a) + + else: + self.dst, self.src = dst, src + + self._hash = self.myhash() + self._size = self.dst.size + + def __str__(self): + return "%s = %s" % (str(self.dst), str(self.src)) + + def get_r(self, mem_read=False, cst_read=False): + r = self.src.get_r(mem_read, cst_read) + if isinstance(self.dst, ExprMem): + r.update(self.dst.arg.get_r(mem_read, cst_read)) + return r + + def get_w(self): + if isinstance(self.dst, ExprMem): + return set([self.dst]) # [memreg] + else: + return self.dst.get_w() + + def __contains__(self, e): + return self == e or self.src.__contains__(e) or self.dst.__contains__(e) + + def myhash(self): + return hash((EXPRAFF, self.dst._hash, self.src._hash)) + + # XXX /!\ for hackish expraff to slice + def get_modified_slice(self): + """Return an Expr list of extra expressions needed during the + object instanciation""" + + dst = self.dst + if not isinstance(self.src, ExprCompose): + raise ValueError("Get mod slice not on expraff slice", str(self)) + modified_s = [] + for x in self.src.args: + if (not isinstance(x[0], ExprSlice) or + x[0].arg != dst or + x[1] != x[0].start or + x[2] != x[0].stop): + # If x is not the initial expression + modified_s.append(x) + return modified_s + + @visit_chk + def visit(self, cb, tv=None): + dst, src = self.dst.visit(cb, tv), self.src.visit(cb, tv) + if dst == self.dst and src == self.src: + return self + else: + return ExprAff(dst, src) + + def copy(self): + return ExprAff(self.dst.copy(), self.src.copy()) + + def depth(self): + return max(self.src.depth(), self.dst.depth()) + 1 + + def graph_recursive(self, graph): + graph.add_node(self) + for a in [self.src, self.dst]: + a.graph_recursive(graph) + graph.add_uniq_edge(self, a) + + +class ExprCond(Expr): + + """An ExprCond stand for a condition on an Expr + + Use cases: + - var1 < var2 + - min(var1, var2) + - if (cond) then ... else ... + """ + + def __init__(self, cond, src1, src2): + """Create an ExprCond + @cond: Expr, condition + @src1: Expr, value if condition is evaled to not zero + @src2: Expr, value if condition is evaled zero + """ + + self.cond, self.src1, self.src2 = cond, src1, src2 + assert(src1.size == src2.size) + self._hash = self.myhash() + self._size = self.src1.size + + def __str__(self): + return "%s?(%s,%s)" % (str(self.cond), str(self.src1), str(self.src2)) + + def get_r(self, mem_read=False, cst_read=False): + out_src1 = self.src1.get_r(mem_read, cst_read) + out_src2 = self.src2.get_r(mem_read, cst_read) + return self.cond.get_r(mem_read, + cst_read).union(out_src1).union(out_src2) + + def get_w(self): + return set() + + def __contains__(self, e): + return (self == e or + self.cond.__contains__(e) or + self.src1.__contains__(e) or + self.src2.__contains__(e)) + + def myhash(self): + return hash((EXPRCOND, self.cond._hash, + self.src1._hash, self.src2._hash)) + + @visit_chk + def visit(self, cb, tv=None): + cond = self.cond.visit(cb, tv) + src1 = self.src1.visit(cb, tv) + src2 = self.src2.visit(cb, tv) + if cond == self.cond and \ + src1 == self.src1 and \ + src2 == self.src2: + return self + return ExprCond(cond, src1, src2) + + def copy(self): + return ExprCond(self.cond.copy(), + self.src1.copy(), + self.src2.copy()) + + def depth(self): + return max(self.cond.depth(), + self.src1.depth(), + self.src2.depth()) + 1 + + def graph_recursive(self, graph): + graph.add_node(self) + for a in [self.cond, self.src1, self.src2]: + a.graph_recursive(graph) + graph.add_uniq_edge(self, a) + + +class ExprMem(Expr): + + """An ExprMem stand for a memory access + + Use cases: + - Memory read + - Memory write + """ + + def __init__(self, arg, size=32): + """Create an ExprMem + @arg: Expr, memory access address + @size: int, memory access size + """ + if not isinstance(arg, Expr): + raise ValueError( + 'ExprMem: arg must be an Expr (not %s)' % type(arg)) + + self.arg, self._size = arg, size + self._hash = self.myhash() + + def __str__(self): + return "@%d[%s]" % (self._size, str(self.arg)) + + def get_r(self, mem_read=False, cst_read=False): + if mem_read: + return set(self.arg.get_r(mem_read, cst_read).union(set([self]))) + else: + return set([self]) + + def get_w(self): + return set([self]) # [memreg] + + def __contains__(self, e): + return self == e or self.arg.__contains__(e) + + def myhash(self): + return hash((EXPRMEM, self.arg._hash, self._size)) + + @visit_chk + def visit(self, cb, tv=None): + arg = self.arg.visit(cb, tv) + if arg == self.arg: + return self + return ExprMem(arg, self._size) + + def copy(self): + arg = self.arg.copy() + return ExprMem(arg, size=self._size) + + def is_op_segm(self): + return isinstance(self.arg, ExprOp) and self.arg.op == 'segm' + + def depth(self): + return self.arg.depth() + 1 + + def graph_recursive(self, graph): + graph.add_node(self) + self.arg.graph_recursive(graph) + graph.add_uniq_edge(self, self.arg) + + +class ExprOp(Expr): + + """An ExprOp stand for an operation between Expr + + Use cases: + - var1 XOR var2 + - var1 + var2 + var3 + - parity bit(var1) + """ + + def __init__(self, op, *args): + """Create an ExprOp + @op: str, operation + @*args: Expr, operand list + """ + + sizes = set([x.size for x in args]) + + if None not in sizes and len(sizes) != 1: + # Special cases : operande sizes can differ + if op not in ["segm"]: + raise ValueError( + "sanitycheck: ExprOp args must have same size! %s" % + ([(str(x), x.size) for x in args])) + + if not isinstance(op, str): + raise ValueError("ExprOp: 'op' argument must be a string") + + self.op, self.args = op, tuple(args) + self._hash = self.myhash() + + # Set size for special cases + if self.op in [ + '==', 'parity', 'fcom_c0', 'fcom_c1', 'fcom_c2', 'fcom_c3', + "access_segment_ok", "load_segment_limit_ok", "bcdadd_cf", + "ucomiss_zf", "ucomiss_pf", "ucomiss_cf"]: + sz = 1 + elif self.op in ['mem_16_to_double', 'mem_32_to_double', + 'mem_64_to_double', 'mem_80_to_double', + 'int_16_to_double', 'int_32_to_double', + 'int_64_to_double', 'int_80_to_double']: + sz = 64 + elif self.op in ['double_to_mem_16', 'double_to_int_16']: + sz = 16 + elif self.op in ['double_to_mem_32', 'double_to_int_32']: + sz = 32 + elif self.op in ['double_to_mem_64', 'double_to_int_64']: + sz = 64 + elif self.op in ['double_to_mem_80', 'double_to_int_80']: + sz = 80 + elif self.op in ['segm']: + sz = self.args[1].size + else: + if None in sizes: + sz = None + else: + # All arguments have the same size + sz = list(sizes)[0] + + self._size = sz + + def __str__(self): + if self.is_associative(): + return '(' + self.op.join([str(x) for x in self.args]) + ')' + if len(self.args) == 2: + return '(' + str(self.args[0]) + \ + ' ' + self.op + ' ' + str(self.args[1]) + ')' + elif len(self.args) > 2: + return self.op + '(' + ', '.join([str(x) for x in self.args]) + ')' + else: + return reduce(lambda x, y: x + ' ' + str(y), + self.args, + '(' + str(self.op)) + ')' + + def get_r(self, mem_read=False, cst_read=False): + return reduce(lambda x, y: + x.union(y.get_r(mem_read, cst_read)), self.args, set()) + + def get_w(self): + raise ValueError('op cannot be written!', self) + + def __contains__(self, e): + if self == e: + return True + for a in self.args: + if a.__contains__(e): + return True + return False + + def myhash(self): + h_hargs = [x._hash for x in self.args] + return hash((EXPROP, self.op, tuple(h_hargs))) + + def is_associative(self): + "Return True iff current operation is associative" + return (self.op in ['+', '*', '^', '&', '|']) + + def is_commutative(self): + "Return True iff current operation is commutative" + return (self.op in ['+', '*', '^', '&', '|']) + + @visit_chk + def visit(self, cb, tv=None): + args = [a.visit(cb, tv) for a in self.args] + modified = any([x[0] != x[1] for x in zip(self.args, args)]) + if modified: + return ExprOp(self.op, *args) + return self + + def copy(self): + args = [a.copy() for a in self.args] + return ExprOp(self.op, *args) + + def depth(self): + depth = [a.depth() for a in self.args] + return max(depth) + 1 + + def graph_recursive(self, graph): + graph.add_node(self) + for a in self.args: + a.graph_recursive(graph) + graph.add_uniq_edge(self, a) + + +class ExprSlice(Expr): + + def __init__(self, arg, start, stop): + assert(start < stop) + self.arg, self.start, self.stop = arg, start, stop + self._hash = self.myhash() + self._size = self.stop - self.start + + def __str__(self): + return "%s[%d:%d]" % (str(self.arg), self.start, self.stop) + + def get_r(self, mem_read=False, cst_read=False): + return self.arg.get_r(mem_read, cst_read) + + def get_w(self): + return self.arg.get_w() + + def __contains__(self, e): + if self == e: + return True + return self.arg.__contains__(e) + + def myhash(self): + return hash((EXPRSLICE, self.arg._hash, self.start, self.stop)) + + @visit_chk + def visit(self, cb, tv=None): + arg = self.arg.visit(cb, tv) + if arg == self.arg: + return self + return ExprSlice(arg, self.start, self.stop) + + def copy(self): + return ExprSlice(self.arg.copy(), self.start, self.stop) + + def depth(self): + return self.arg.depth() + 1 + + def slice_rest(self): + "Return the completion of the current slice" + size = self.arg.size + if self.start >= size or self.stop > size: + raise ValueError('bad slice rest %s %s %s' % + (size, self.start, self.stop)) + + if self.start == self.stop: + return [(0, size)] + + rest = [] + if self.start != 0: + rest.append((0, self.start)) + if self.stop < size: + rest.append((self.stop, size)) + + return rest + + def graph_recursive(self, graph): + graph.add_node(self) + self.arg.graph_recursive(graph) + graph.add_uniq_edge(self, self.arg) + + +class ExprCompose(Expr): + + """ + Compose is like a hambuger. + It's arguments are tuple of: (Expression, start, stop) + start and stop are intergers, determining Expression position in the compose. + + Burger Example: + ExprCompose([(salad, 0, 3), (cheese, 3, 10), (beacon, 10, 16)]) + In the example, salad.size == 3. + """ + + def __init__(self, args): + """Create an ExprCompose + @args: tuple(Expr, int, int) + """ + + for e, start, stop in args: + if e.size != stop - start: + raise ValueError( + "sanitycheck: ExprCompose args must have correct size!" + + " %r %r %r" % (e, e.size, stop - start)) + + # Transform args to lists + o = [] + for e, a, b in args: + assert(a >= 0 and b >= 0) + o.append(tuple([e, a, b])) + self.args = tuple(o) + + self._hash = self.myhash() + self._size = max([x[2] + for x in self.args]) - min([x[1] for x in self.args]) + + def __str__(self): + return '{' + ', '.join(['%s,%d,%d' % + (str(x[0]), x[1], x[2]) for x in self.args]) + '}' + + def get_r(self, mem_read=False, cst_read=False): + return reduce(lambda x, y: + x.union(y[0].get_r(mem_read, cst_read)), self.args, set()) + + def get_w(self): + return reduce(lambda x, y: + x.union(y[0].get_r(mem_read, cst_read)), self.args, set()) + + def __contains__(self, e): + if self == e: + return True + for a in self.args: + if a == e: + return True + if a[0].__contains__(e): + return True + return False + + def myhash(self): + h_args = [EXPRCOMPOSE] + [(x[0]._hash, x[1], x[2]) for x in self.args] + return hash(tuple(h_args)) + + @visit_chk + def visit(self, cb, tv=None): + args = [(a[0].visit(cb, tv), a[1], a[2]) for a in self.args] + modified = any([x[0] != x[1] for x in zip(self.args, args)]) + if modified: + return ExprCompose(args) + return self + + def copy(self): + args = [(a[0].copy(), a[1], a[2]) for a in self.args] + return ExprCompose(args) + + def depth(self): + depth = [a[0].depth() for a in self.args] + return max(depth) + 1 + + def graph_recursive(self, graph): + graph.add_node(self) + for a in self.args: + a[0].graph_recursive(graph) + graph.add_uniq_edge(self, a[0]) + + +# Expression order for comparaison +expr_order_dict = {ExprId: 1, + ExprCond: 2, + ExprMem: 3, + ExprOp: 4, + ExprSlice: 5, + ExprCompose: 7, + ExprInt: 8, + } + + +def compare_exprs_compose(e1, e2): + # Sort by start bit address, then expr, then stop but address + x = cmp(e1[1], e2[1]) + if x: + return x + x = compare_exprs(e1[0], e2[0]) + if x: + return x + x = cmp(e1[2], e2[2]) + return x + + +def compare_expr_list_compose(l1_e, l2_e): + # Sort by list elements in incremental order, then by list size + for i in xrange(min(len(l1_e), len(l2_e))): + x = compare_exprs_compose(l1_e[i], l2_e[i]) + if x: + return x + return cmp(len(l1_e), len(l2_e)) + + +def compare_expr_list(l1_e, l2_e): + # Sort by list elements in incremental order, then by list size + for i in xrange(min(len(l1_e), len(l2_e))): + x = compare_exprs(l1_e[i], l2_e[i]) + if x: + return x + return cmp(len(l1_e), len(l2_e)) + + +def compare_exprs(e1, e2): + """Compare 2 expressions for canonization + @e1: Expr + @e2: Expr + 0 => == + 1 => e1 > e2 + -1 => e1 < e2 + """ + c1 = e1.__class__ + c2 = e2.__class__ + if c1 != c2: + return cmp(expr_order_dict[c1], expr_order_dict[c2]) + if e1 == e2: + return 0 + if c1 == ExprInt: + return cmp(e1.arg, e2.arg) + elif c1 == ExprId: + x = cmp(e1.name, e2.name) + if x: + return x + return cmp(e1._size, e2._size) + elif c1 == ExprAff: + raise NotImplementedError( + "Comparaison from an ExprAff not yet implemented") + elif c2 == ExprCond: + x = compare_exprs(e1.cond, e2.cond) + if x: + return x + x = compare_exprs(e1.src1, e2.src1) + if x: + return x + x = compare_exprs(e1.src2, e2.src2) + return x + elif c1 == ExprMem: + x = compare_exprs(e1.arg, e2.arg) + if x: + return x + return cmp(e1._size, e2._size) + elif c1 == ExprOp: + if e1.op != e2.op: + return cmp(e1.op, e2.op) + return compare_expr_list(e1.args, e2.args) + elif c1 == ExprSlice: + x = compare_exprs(e1.arg, e2.arg) + if x: + return x + x = cmp(e1.start, e2.start) + if x: + return x + x = cmp(e1.stop, e2.stop) + return x + elif c1 == ExprCompose: + return compare_expr_list_compose(e1.args, e2.args) + raise NotImplementedError( + "Comparaison between %r %r not implemented" % (e1, e2)) + + +def canonize_expr_list(l): + l = list(l) + l.sort(cmp=compare_exprs) + return l + + +def canonize_expr_list_compose(l): + l = list(l) + l.sort(cmp=compare_exprs_compose) + return l + +# Generate ExprInt with common size + + +def ExprInt1(i): + return ExprInt(uint1(i)) + + +def ExprInt8(i): + return ExprInt(uint8(i)) + + +def ExprInt16(i): + return ExprInt(uint16(i)) + + +def ExprInt32(i): + return ExprInt(uint32(i)) + + +def ExprInt64(i): + return ExprInt(uint64(i)) + + +def ExprInt_from(e, i): + "Generate ExprInt with size equal to expression" + return ExprInt(mod_size2uint[e.size](i)) + + +def ExprInt_fromsize(size, i): + "Generate ExprInt with a given size" + return ExprInt(mod_size2uint[size](i)) + + +def get_expr_ids_visit(e, ids): + if isinstance(e, ExprId): + ids.add(e) + return e + + +def get_expr_ids(e): + ids = set() + e.visit(lambda x: get_expr_ids_visit(x, ids)) + return ids + + +def test_set(e, v, tks, result): + """Test if v can correspond to e. If so, update the context in result. + Otherwise, return False + @e : Expr + @v : Expr + @tks : list of ExprId, available jokers + @result : dictionnary of ExprId -> Expr, current context + """ + + if not v in tks: + return e == v + if v in result and result[v] != e: + return False + result[v] = e + return result + + +def MatchExpr(e, m, tks, result=None): + """Try to match m expression with e expression with tks jokers. + Result is output dictionnary with matching joker values. + @e : Expr to test + @m : Targetted Expr + @tks : list of ExprId, available jokers + @result : dictionnary of ExprId -> Expr, output matching context + """ + + if result is None: + result = {} + + if m in tks: + # m is a Joker + return test_set(e, m, tks, result) + + if isinstance(e, ExprInt): + return test_set(e, m, tks, result) + + elif isinstance(e, ExprId): + return test_set(e, m, tks, result) + + elif isinstance(e, ExprOp): + + # e need to be the same operation than m + if not isinstance(m, ExprOp): + return False + if e.op != m.op: + return False + if len(e.args) != len(m.args): + return False + + # Perform permutation only if the current operation is commutative + if e.is_commutative(): + permutations = itertools.permutations(e.args) + else: + permutations = [e.args] + + # For each permutations of arguments + for permut in permutations: + good = True + # We need to use a copy of result to not override it + myresult = dict(result) + for a1, a2 in zip(permut, m.args): + r = MatchExpr(a1, a2, tks, myresult) + # If the current permutation do not match EVERY terms + if r is False: + good = False + break + if good is True: + # We found a possibility + for k, v in myresult.items(): + # Updating result in place (to keep pointer in recursion) + result[k] = v + return result + return False + + # Recursive tests + + elif isinstance(e, ExprMem): + if not isinstance(m, ExprMem): + return False + if e._size != m._size: + return False + return MatchExpr(e.arg, m.arg, tks, result) + + elif isinstance(e, ExprSlice): + if not isinstance(m, ExprSlice): + return False + if e.start != m.start or e.stop != m.stop: + return False + return MatchExpr(e.arg, m.arg, tks, result) + + elif isinstance(e, ExprCond): + if not isinstance(m, ExprCond): + return False + r = MatchExpr(e.cond, m.cond, tks, result) + if r is False: + return False + r = MatchExpr(e.src1, m.src1, tks, result) + if r is False: + return False + r = MatchExpr(e.src2, m.src2, tks, result) + if r is False: + return False + return result + + elif isinstance(e, ExprCompose): + if not isinstance(m, ExprCompose): + return False + for a1, a2 in zip(e.args, m.args): + if a1[1] != a2[1] or a1[2] != a2[2]: + return False + r = MatchExpr(a1[0], a2[0], tks, result) + if r is False: + return False + return result + + else: + raise NotImplementedError("MatchExpr: Unknown type: %s" % type(e)) + + +def SearchExpr(e, m, tks, result=None): + # TODO XXX: to test + if result is None: + result = set() + + def visit_search(e, m, tks, result): + r = {} + MatchExpr(e, m, tks, r) + if r: + result.add(tuple(r.items())) + return e + e.visit(lambda x: visit_search(x, m, tks, result)) + + +def get_rw(exprs): + o_r = set() + o_w = set() + for e in exprs: + o_r.update(e.get_r(mem_read=True)) + for e in exprs: + o_w.update(e.get_w()) + return o_r, o_w + + +def get_list_rw(exprs, mem_read=False, cst_read=True): + """ + return list of read/write reg/cst/mem for each expressions + """ + list_rw = [] + # cst_num = 0 + for e in exprs: + o_r = set() + o_w = set() + # get r/w + o_r.update(e.get_r(mem_read=mem_read, cst_read=cst_read)) + if isinstance(e.dst, ExprMem): + o_r.update(e.dst.arg.get_r(mem_read=mem_read, cst_read=cst_read)) + o_w.update(e.get_w()) + # each cst is indexed + o_r_rw = set() + for r in o_r: + # if isinstance(r, ExprInt): + # r = ExprOp('cst_%d'%cst_num, r) + # cst_num += 1 + o_r_rw.add(r) + o_r = o_r_rw + list_rw.append((o_r, o_w)) + + return list_rw + + +def get_expr_ops(e): + def visit_getops(e, out=None): + if out is None: + out = set() + if isinstance(e, ExprOp): + out.add(e.op) + return e + ops = set() + e.visit(lambda x: visit_getops(x, ops)) + return ops + + +def get_expr_mem(e): + def visit_getmem(e, out=None): + if out is None: + out = set() + if isinstance(e, ExprMem): + out.add(e) + return e + ops = set() + e.visit(lambda x: visit_getmem(x, ops)) + return ops diff --git a/miasm2/expression/expression_helper.py b/miasm2/expression/expression_helper.py new file mode 100644 index 00000000..cd59730b --- /dev/null +++ b/miasm2/expression/expression_helper.py @@ -0,0 +1,196 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# + +# Expressions manipulation functions +import miasm2.expression.expression as m2_expr + + +def parity(a): + tmp = (a) & 0xFFL + cpt = 1 + while tmp != 0: + cpt ^= tmp & 1 + tmp >>= 1 + return cpt + + +def merge_sliceto_slice(args): + sources = {} + non_slice = {} + sources_int = {} + for a in args: + if isinstance(a[0], m2_expr.ExprInt): + # sources_int[a.start] = a + # copy ExprInt because we will inplace modify arg just below + # /!\ TODO XXX never ever modify inplace args... + sources_int[a[1]] = (m2_expr.ExprInt_fromsize(a[2] - a[1], + a[0].arg.__class__( + a[0].arg)), + a[1], + a[2]) + elif isinstance(a[0], m2_expr.ExprSlice): + if not a[0].arg in sources: + sources[a[0].arg] = [] + sources[a[0].arg].append(a) + else: + non_slice[a[1]] = a + # find max stop to determine size + max_size = None + for a in args: + if max_size is None or max_size < a[2]: + max_size = a[2] + + # first simplify all num slices + final_sources = [] + sorted_s = [] + for x in sources_int.values(): + # mask int + v = x[0].arg & ((1 << (x[2] - x[1])) - 1) + x[0].arg = v + sorted_s.append((x[1], x)) + sorted_s.sort() + while sorted_s: + start, v = sorted_s.pop() + out = [m2_expr.ExprInt(v[0].arg), v[1], v[2]] + size = v[2] - v[1] + while sorted_s: + if sorted_s[-1][1][2] != start: + break + s_start, s_stop = sorted_s[-1][1][1], sorted_s[-1][1][2] + size += s_stop - s_start + a = m2_expr.mod_size2uint[size]( + (int(out[0].arg) << (out[1] - s_start)) + + int(sorted_s[-1][1][0].arg)) + out[0].arg = a + sorted_s.pop() + out[1] = s_start + out[0] = m2_expr.ExprInt_fromsize(size, out[0].arg) + final_sources.append((start, out)) + + final_sources_int = final_sources + # check if same sources have corresponding start/stop + # is slice AND is sliceto + simp_sources = [] + for args in sources.values(): + final_sources = [] + sorted_s = [] + for x in args: + sorted_s.append((x[1], x)) + sorted_s.sort() + while sorted_s: + start, v = sorted_s.pop() + ee = v[0].arg[v[0].start:v[0].stop] + out = ee, v[1], v[2] + while sorted_s: + if sorted_s[-1][1][2] != start: + break + if sorted_s[-1][1][0].stop != out[0].start: + break + + start = sorted_s[-1][1][1] + # out[0].start = sorted_s[-1][1][0].start + o_e, _, o_stop = out + o1, o2 = sorted_s[-1][1][0].start, o_e.stop + o_e = o_e.arg[o1:o2] + out = o_e, start, o_stop + # update _size + # out[0]._size = out[0].stop-out[0].start + sorted_s.pop() + out = out[0], start, out[2] + + final_sources.append((start, out)) + + simp_sources += final_sources + + simp_sources += final_sources_int + + for i, v in non_slice.items(): + simp_sources.append((i, v)) + + simp_sources.sort() + simp_sources = [x[1] for x in simp_sources] + return simp_sources + + +op_propag_cst = ['+', '*', '^', '&', '|', '>>', + '<<', "a>>", ">>>", "/", "%", 'idiv', 'irem'] + + +def is_pure_int(e): + """ + return True if expr is only composed with integers + /!\ ExprCond returns True is src1 and src2 are integers + """ + def modify_cond(e): + if isinstance(e, m2_expr.ExprCond): + return e.src1 | e.src2 + return e + + def find_int(e, s): + if isinstance(e, m2_expr.ExprId) or isinstance(e, m2_expr.ExprMem): + s.add(e) + return e + s = set() + new_e = e.visit(modify_cond) + new_e.visit(lambda x: find_int(x, s)) + if s: + return False + return True + + +def is_int_or_cond_src_int(e): + if isinstance(e, m2_expr.ExprInt): + return True + if isinstance(e, m2_expr.ExprCond): + return (isinstance(e.src1, m2_expr.ExprInt) and + isinstance(e.src2, m2_expr.ExprInt)) + return False + + +def fast_unify(seq, idfun=None): + # order preserving unifying list function + if idfun is None: + idfun = lambda x: x + seen = {} + result = [] + for item in seq: + marker = idfun(item) + + if marker in seen: + continue + seen[marker] = 1 + result.append(item) + return result + +def get_missing_interval(all_intervals, i_min=0, i_max=32): + """Return a list of missing interval in all_interval + @all_interval: list of (int, int) + @i_min: int, minimal missing interval bound + @i_max: int, maximal missing interval bound""" + + my_intervals = all_intervals[:] + my_intervals.sort() + my_intervals.append((i_max, i_max)) + + missing_i = [] + last_pos = i_min + for start, stop in my_intervals: + if last_pos != start: + missing_i.append((last_pos, start)) + last_pos = stop + return missing_i diff --git a/miasm2/expression/modint.py b/miasm2/expression/modint.py new file mode 100644 index 00000000..ffe1574c --- /dev/null +++ b/miasm2/expression/modint.py @@ -0,0 +1,224 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +class moduint(object): + + def __init__(self, arg): + if isinstance(arg, moduint): + arg = arg.arg + self.arg = arg % self.__class__.limit + assert(self.arg >= 0 and self.arg < self.__class__.limit) + + def __repr__(self): + return self.__class__.__name__ + '(' + hex(self.arg) + ')' + + def __hash__(self): + return hash(self.arg) + + @classmethod + def maxcast(cls, c2): + c2 = c2.__class__ + if cls.size > c2.size: + return cls + else: + return c2 + + def __cmp__(self, y): + if isinstance(y, moduint): + return cmp(self.arg, y.arg) + else: + return cmp(self.arg, y) + + def __add__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg + y.arg) + else: + return self.__class__(self.arg + y) + + def __and__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg & y.arg) + else: + return self.__class__(self.arg & y) + + def __div__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg / y.arg) + else: + return self.__class__(self.arg / y) + + def __int__(self): + return int(self.arg) + + def __long__(self): + return long(self.arg) + + def __invert__(self): + return self.__class__(~self.arg) + + def __lshift__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg << y.arg) + else: + return self.__class__(self.arg << y) + + def __mod__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg % y.arg) + else: + return self.__class__(self.arg % y) + + def __mul__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg * y.arg) + else: + return self.__class__(self.arg * y) + + def __neg__(self): + return self.__class__(-self.arg) + + def __or__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg | y.arg) + else: + return self.__class__(self.arg | y) + + def __radd__(self, y): + return self.__add__(y) + + def __rand__(self, y): + return self.__and__(y) + + def __rdiv__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(y.arg / self.arg) + else: + return self.__class__(y / self.arg) + + def __rlshift__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(y.arg << self.arg) + else: + return self.__class__(y << self.arg) + + def __rmod__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(y.arg % self.arg) + else: + return self.__class__(y % self.arg) + + def __rmul__(self, y): + return self.__mul__(y) + + def __ror__(self, y): + return self.__or__(y) + + def __rrshift__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(y.arg >> self.arg) + else: + return self.__class__(y >> self.arg) + + def __rshift__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg >> y.arg) + else: + return self.__class__(self.arg >> y) + + def __rsub__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(y.arg - self.arg) + else: + return self.__class__(y - self.arg) + + def __rxor__(self, y): + return self.__xor__(y) + + def __sub__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg - y.arg) + else: + return self.__class__(self.arg - y) + + def __xor__(self, y): + if isinstance(y, moduint): + cls = self.maxcast(y) + return cls(self.arg ^ y.arg) + else: + return self.__class__(self.arg ^ y) + + def __hex__(self): + return hex(self.arg) + + def __abs__(self): + return abs(self.arg) + + def __rpow__(self, v): + return v ** self.arg + + def __pow__(self, v): + return self.__class__(self.arg ** v) + + +class modint(moduint): + + def __init__(self, arg): + if isinstance(arg, moduint): + arg = arg.arg + a = arg % self.__class__.limit + if a >= self.__class__.limit / 2: + a -= self.__class__.limit + self.arg = a + assert(self.arg >= -self.__class__.limit / + 2 and self.arg < self.__class__.limit) + + +def is_modint(a): + return isinstance(a, moduint) + + +def size2mask(size): + return (1 << size) - 1 + +mod_size2uint = {} +mod_size2int = {} + +mod_uint2size = {} +mod_int2size = {} + + +def define_common_int(): + "Define common int: ExprInt1, ExprInt2, .." + global mod_size2int, mod_int2size, mod_size2uint, mod_uint2size + + common_int = xrange(1, 257) + + for i in common_int: + name = 'uint%d' % i + c = type(name, (moduint,), {"size": i, "limit": 1 << i}) + globals()[name] = c + mod_size2uint[i] = c + mod_uint2size[c] = i + + for i in common_int: + name = 'int%d' % i + c = type(name, (modint,), {"size": i, "limit": 1 << i}) + globals()[name] = c + mod_size2int[i] = c + mod_int2size[c] = i + +define_common_int() diff --git a/miasm2/expression/simplifications.py b/miasm2/expression/simplifications.py new file mode 100644 index 00000000..29d19614 --- /dev/null +++ b/miasm2/expression/simplifications.py @@ -0,0 +1,605 @@ +# +# Simplification methods library # +# + +from miasm2.expression.expression import * +from miasm2.expression.expression_helper import * + +# Common passes +# ------------- + + +def simp_cst_propagation(e_s, e): + """This passe includes: + - Constant folding + - Common logical identities + - Common binary identities + """ + + # merge associatif op + if not isinstance(e, ExprOp): + return e + args = list(e.args) + op = e.op + # simpl integer manip + # int OP int => int + if op in op_propag_cst: + while (len(args) >= 2 and + isinstance(args[-1], ExprInt) and + isinstance(args[-2], ExprInt)): + i2 = args.pop() + i1 = args.pop() + if op == '+': + o = i1.arg + i2.arg + elif op == '*': + o = i1.arg * i2.arg + elif op == '^': + o = i1.arg ^ i2.arg + elif op == '&': + o = i1.arg & i2.arg + elif op == '|': + o = i1.arg | i2.arg + elif op == '>>': + o = i1.arg >> i2.arg + elif op == '<<': + o = i1.arg << i2.arg + elif op == 'a>>': + x1 = mod_size2int[i1.arg.size](i1.arg) + x2 = mod_size2int[i2.arg.size](i2.arg) + o = mod_size2uint[i1.arg.size](x1 >> x2) + elif op == '>>>': + o = i1.arg >> i2.arg | i1.arg << (i1.size - i2.arg) + elif op == '/': + o = i1.arg / i2.arg + elif op == '%': + o = i1.arg % i2.arg + elif op == 'idiv': + assert(i2.arg) + x1 = mod_size2int[i1.arg.size](i1.arg) + x2 = mod_size2int[i2.arg.size](i2.arg) + o = mod_size2uint[i1.arg.size](x1 / x2) + elif op == 'irem': + assert(i2.arg) + x1 = mod_size2int[i1.arg.size](i1.arg) + x2 = mod_size2int[i2.arg.size](i2.arg) + o = mod_size2uint[i1.arg.size](x1 % x2) + + o = ExprInt_fromsize(i1.size, o) + args.append(o) + + # bsf(int) => int + if op == "bsf" and isinstance(args[0], ExprInt) and args[0].arg != 0: + i = 0 + while args[0].arg & (1 << i) == 0: + i += 1 + return ExprInt_from(args[0], i) + + # bsr(int) => int + if op == "bsr" and isinstance(args[0], ExprInt) and args[0].arg != 0: + i = args[0].size - 1 + while args[0].arg & (1 << i) == 0: + i -= 1 + return ExprInt_from(args[0], i) + + # -(-(A)) => A + if op == '-' and len(args) == 1 and isinstance(args[0], ExprOp) and \ + args[0].op == '-' and len(args[0].args) == 1: + return args[0].args[0] + + # -(int) => -int + if op == '-' and len(args) == 1 and isinstance(args[0], ExprInt): + return ExprInt(-args[0].arg) + # A op 0 =>A + if op in ['+', '-', '|', "^", "<<", ">>", "<<<", ">>>"] and len(args) > 1: + if isinstance(args[-1], ExprInt) and args[-1].arg == 0: + args.pop() + # A * 1 =>A + if op == "*" and len(args) > 1: + if isinstance(args[-1], ExprInt) and args[-1].arg == 1: + args.pop() + + # for cannon form + # A * -1 => - A + if op == "*" and len(args) > 1: + if (isinstance(args[-1], ExprInt) and + args[-1].arg == (1 << args[-1].size) - 1): + args.pop() + args[-1] = - args[-1] + + # op A => A + if op in ['+', '*', '^', '&', '|', '>>', '<<', + 'a>>', '<<<', '>>>', 'idiv', 'irem'] and len(args) == 1: + return args[0] + + # A-B => A + (-B) + if op == '-' and len(args) > 1: + if len(args) > 2: + raise ValueError( + 'sanity check fail on expr -: should have one or 2 args ' + + '%r %s' % (e, e)) + return ExprOp('+', args[0], -args[1]) + + # A op 0 => 0 + if op in ['&', "*"] and isinstance(args[1], ExprInt) and args[1].arg == 0: + return ExprInt_from(e, 0) + + # - (A + B +...) => -A + -B + -C + if (op == '-' and + len(args) == 1 and + isinstance(args[0], ExprOp) and + args[0].op == '+'): + args = [-a for a in args[0].args] + e = ExprOp('+', *args) + return e + + # -(a?int1:int2) => (a?-int1:-int2) + if (op == '-' and + len(args) == 1 and + isinstance(args[0], ExprCond) and + isinstance(args[0].src1, ExprInt) and + isinstance(args[0].src2, ExprInt)): + i1 = args[0].src1 + i2 = args[0].src2 + i1 = ExprInt_from(i1, -i1.arg) + i2 = ExprInt_from(i2, -i2.arg) + return ExprCond(args[0].cond, i1, i2) + + i = 0 + while i < len(args) - 1: + j = i + 1 + while j < len(args): + # A ^ A => 0 + if op == '^' and args[i] == args[j]: + args[i] = ExprInt_from(args[i], 0) + del(args[j]) + continue + # A + (- A) => 0 + if op == '+' and isinstance(args[j], ExprOp) and args[j].op == "-": + if len(args[j].args) == 1 and args[i] == args[j].args[0]: + args[i] = ExprInt_from(args[i], 0) + del(args[j]) + continue + # (- A) + A => 0 + if op == '+' and isinstance(args[i], ExprOp) and args[i].op == "-": + if len(args[i].args) == 1 and args[j] == args[i].args[0]: + args[i] = ExprInt_from(args[i], 0) + del(args[j]) + continue + # A | A => A + if op == '|' and args[i] == args[j]: + del(args[j]) + continue + # A & A => A + if op == '&' and args[i] == args[j]: + del(args[j]) + continue + j += 1 + i += 1 + + if op in ['|', '&', '%', '/'] and len(args) == 1: + return args[0] + + # A <<< A.size => A + if (op in ['<<<', '>>>'] and + isinstance(args[1], ExprInt) and + args[1].arg == args[0].size): + return args[0] + + # A <<< X <<< Y => A <<< (X+Y) (ou <<< >>>) + if (op in ['<<<', '>>>'] and + isinstance(args[0], ExprOp) and + args[0].op in ['<<<', '>>>']): + op1 = op + op2 = args[0].op + if op1 == op2: + op = op1 + args1 = args[0].args[1] + args[1] + else: + op = op2 + args1 = args[0].args[1] - args[1] + + args0 = args[0].args[0] + args = [args0, args1] + + # ((A & A.mask) + if op == "&" and args[-1] == e.mask: + return ExprOp('&', *args[:-1]) + + # ((A | A.mask) + if op == "|" and args[-1] == e.mask: + return args[-1] + + # ! (!X + int) => X - int + # TODO + + # ((A & mask) >> shift) whith mask < 2**shift => 0 + if (op == ">>" and + isinstance(args[1], ExprInt) and + isinstance(args[0], ExprOp) and args[0].op == "&"): + if (isinstance(args[0].args[1], ExprInt) and + 2 ** args[1].arg >= args[0].args[1].arg): + return ExprInt_from(args[0], 0) + + # int == int => 0 or 1 + if (op == '==' and + isinstance(args[0], ExprInt) and + isinstance(args[1], ExprInt)): + if args[0].arg == args[1].arg: + return ExprInt_from(args[0], 1) + else: + return ExprInt_from(args[0], 0) + #(A|int == 0) => 0 with int != 0 + if op == '==' and isinstance(args[1], ExprInt) and args[1].arg == 0: + if isinstance(args[0], ExprOp) and args[0].op == '|' and\ + isinstance(args[0].args[1], ExprInt) and \ + args[0].args[1].arg != 0: + return ExprInt_from(args[0], 0) + + # parity(int) => int + if op == 'parity' and isinstance(args[0], ExprInt): + return ExprInt1(parity(args[0].arg)) + + # (-a) * b * (-c) * (-d) => (-a) * b * c * d + if op == "*" and len(args) > 1: + new_args = [] + counter = 0 + for a in args: + if isinstance(a, ExprOp) and a.op == '-' and len(a.args) == 1: + new_args.append(a.args[0]) + counter += 1 + else: + new_args.append(a) + if counter % 2: + return -ExprOp(op, *new_args) + args = new_args + + return ExprOp(op, *args) + + +def simp_cond_op_int(e_s, e): + "Extract conditions from operations" + + if not isinstance(e, ExprOp): + return e + if not e.op in ["+", "|", "^", "&", "*", '<<', '>>', 'a>>']: + return e + if len(e.args) < 2: + return e + if not isinstance(e.args[-1], ExprInt): + return e + a_int = e.args[-1] + conds = [] + for a in e.args[:-1]: + if not isinstance(a, ExprCond): + return e + conds.append(a) + if not conds: + return e + c = conds.pop() + c = ExprCond(c.cond, + ExprOp(e.op, c.src1, a_int), + ExprOp(e.op, c.src2, a_int)) + conds.append(c) + new_e = ExprOp(e.op, *conds) + return new_e + + +def simp_cond_factor(e_s, e): + "Merge similar conditions" + if not isinstance(e, ExprOp): + return e + if not e.op in ["+", "|", "^", "&", "*", '<<', '>>', 'a>>']: + return e + if len(e.args) < 2: + return e + conds = {} + not_conds = [] + multi_cond = False + for a in e.args: + if not isinstance(a, ExprCond): + not_conds.append(a) + continue + c = a.cond + if not c in conds: + conds[c] = [] + else: + multi_cond = True + conds[c].append(a) + if not multi_cond: + return e + c_out = not_conds[:] + for c, vals in conds.items(): + new_src1 = [x.src1 for x in vals] + new_src2 = [x.src2 for x in vals] + src1 = e_s.expr_simp_wrapper(ExprOp(e.op, *new_src1)) + src2 = e_s.expr_simp_wrapper(ExprOp(e.op, *new_src2)) + c_out.append(ExprCond(c, src1, src2)) + + if len(c_out) == 1: + new_e = c_out[0] + else: + new_e = ExprOp(e.op, *c_out) + return new_e + + +def simp_slice(e_s, e): + "Slice optimization" + + # slice(A, 0, a.size) => A + if e.start == 0 and e.stop == e.arg.size: + return e.arg + # Slice(int) => int + elif isinstance(e.arg, ExprInt): + total_bit = e.stop - e.start + mask = (1 << (e.stop - e.start)) - 1 + return ExprInt_fromsize(total_bit, (e.arg.arg >> e.start) & mask) + # Slice(Slice(A, x), y) => Slice(A, z) + elif isinstance(e.arg, ExprSlice): + if e.stop - e.start > e.arg.stop - e.arg.start: + raise ValueError('slice in slice: getting more val', str(e)) + + new_e = ExprSlice(e.arg.arg, e.start + e.arg.start, + e.start + e.arg.start + (e.stop - e.start)) + return new_e + # Slice(Compose(A), x) => Slice(A, y) + elif isinstance(e.arg, ExprCompose): + for a in e.arg.args: + if a[1] <= e.start and a[2] >= e.stop: + new_e = a[0][e.start - a[1]:e.stop - a[1]] + return new_e + # ExprMem(x, size)[:A] => ExprMem(x, a) + # XXXX todo hum, is it safe? + elif (isinstance(e.arg, ExprMem) and + e.start == 0 and + e.arg.size > e.stop and e.stop % 8 == 0): + e = ExprMem(e.arg.arg, size=e.stop) + return e + # distributivity of slice and & + # (a & int)[x:y] => 0 if int[x:y] == 0 + elif (isinstance(e.arg, ExprOp) and + e.arg.op == "&" and + isinstance(e.arg.args[-1], ExprInt)): + tmp = e_s.expr_simp_wrapper(e.arg.args[-1][e.start:e.stop]) + if isinstance(tmp, ExprInt) and tmp.arg == 0: + return tmp + # distributivity of slice and exprcond + # (a?int1:int2)[x:y] => (a?int1[x:y]:int2[x:y]) + elif (isinstance(e.arg, ExprCond) and + isinstance(e.arg.src1, ExprInt) and + isinstance(e.arg.src2, ExprInt)): + src1 = e.arg.src1[e.start:e.stop] + src2 = e.arg.src2[e.start:e.stop] + e = ExprCond(e.arg.cond, src1, src2) + + # (a * int)[0:y] => (a[0:y] * int[0:y]) + elif (isinstance(e.arg, ExprOp) and + e.arg.op == "*" and + isinstance(e.arg.args[-1], ExprInt)): + args = [e_s.expr_simp_wrapper(a[e.start:e.stop]) for a in e.arg.args] + e = ExprOp(e.arg.op, *args) + + return e + + +def simp_compose(e_s, e): + "Commons simplification on ExprCompose" + args = merge_sliceto_slice(e.args) + out = [] + # compose of compose + for a in args: + if isinstance(a[0], ExprCompose): + for x, start, stop in a[0].args: + out.append((x, start + a[1], stop + a[1])) + else: + out.append(a) + args = out + # Compose(a) with a.size = compose.size => a + if len(args) == 1 and args[0][1] == 0 and args[0][2] == e.size: + return args[0][0] + + # {(X[X.size-z, 0, z), (0, z, X.size)} => (X >> x) + if (len(args) == 2 and + isinstance(args[1][0], ExprInt) and + args[1][0].arg == 0): + a1 = args[0] + a2 = args[1] + if (isinstance(a1[0], ExprSlice) and + a1[1] == 0 and a1[0].stop == a1[0].arg.size): + if a2[1] == a1[0].size and a2[2] == a1[0].arg.size: + new_e = a1[0].arg >> ExprInt_fromsize( + a1[0].arg.size, a1[0].start) + return new_e + + # Compose with ExprCond with integers for src1/src2 and intergers => + # propagage integers + # {XXX?(0x0,0x1)?(0x0,0x1),0,8, 0x0,8,32} => XXX?(int1, int2) + + ok = True + expr_cond = None + expr_ints = [] + for i, a in enumerate(args): + if not is_int_or_cond_src_int(a[0]): + ok = False + break + expr_ints.append(a) + if isinstance(a[0], ExprCond): + if expr_cond is not None: + ok = False + expr_cond = i + cond = a[0] + + if ok and expr_cond is not None: + src1 = [] + src2 = [] + for i, a in enumerate(expr_ints): + if i == expr_cond: + src1.append((a[0].src1, a[1], a[2])) + src2.append((a[0].src2, a[1], a[2])) + else: + src1.append(a) + src2.append(a) + src1 = e_s.apply_simp(ExprCompose(src1)) + src2 = e_s.apply_simp(ExprCompose(src2)) + if isinstance(src1, ExprInt) and isinstance(src2, ExprInt): + return ExprCond(cond.cond, src1, src2) + return ExprCompose(args) + + +def simp_cond(e_s, e): + "Common simplifications on ExprCond" + if not isinstance(e, ExprCond): + return e + # eval exprcond src1/src2 with satifiable/unsatisfiable condition + # propagation + if (not isinstance(e.cond, ExprInt)) and e.cond.size == 1: + src1 = e.src1.replace_expr({e.cond: ExprInt1(1)}) + src2 = e.src2.replace_expr({e.cond: ExprInt1(0)}) + if src1 != e.src1 or src2 != e.src2: + return ExprCond(e.cond, src1, src2) + + # -A ? B:C => A ? B:C + if (isinstance(e.cond, ExprOp) and + e.cond.op == '-' and + len(e.cond.args) == 1): + e = ExprCond(e.cond.args[0], e.src1, e.src2) + # a?x:x + elif e.src1 == e.src2: + e = e.src1 + # int ? A:B => A or B + elif isinstance(e.cond, ExprInt): + if e.cond.arg == 0: + e = e.src2 + else: + e = e.src1 + # a?(a?b:c):x => a?b:x + elif isinstance(e.src1, ExprCond) and e.cond == e.src1.cond: + e = ExprCond(e.cond, e.src1.src1, e.src2) + # a?x:(a?b:c) => a?x:c + elif isinstance(e.src2, ExprCond) and e.cond == e.src2.cond: + e = ExprCond(e.cond, e.src1, e.src2.src2) + # a|int ? b:c => b with int != 0 + elif (isinstance(e.cond, ExprOp) and + e.cond.op == '|' and + isinstance(e.cond.args[1], ExprInt) and + e.cond.args[1].arg != 0): + return e.src1 + + # (C?int1:int2)?(A:B) => + elif (isinstance(e.cond, ExprCond) and + isinstance(e.cond.src1, ExprInt) and + isinstance(e.cond.src2, ExprInt)): + int1 = e.cond.src1.arg.arg + int2 = e.cond.src2.arg.arg + if int1 and int2: + e = e.src1 + elif int1 == 0 and int2 == 0: + e = e.src2 + elif int1 == 0 and int2: + e = ExprCond(e.cond.cond, e.src2, e.src1) + elif int1 and int2 == 0: + e = ExprCond(e.cond.cond, e.src1, e.src2) + return e + + +# Expression Simplifier +# --------------------- + + +class ExpressionSimplifier(object): + + """Wrapper on expression simplification passes. + + Instance handle passes lists. + + Available passes lists are: + - commons: common passes such as constant folding + - heavy : rare passes (for instance, in case of obfuscation) + """ + + # Common passes + PASS_COMMONS = { + m2_expr.ExprOp: [simp_cst_propagation, + simp_cond_op_int, + simp_cond_factor], + m2_expr.ExprSlice: [simp_slice], + m2_expr.ExprCompose: [simp_compose], + m2_expr.ExprCond: [simp_cond], + } + + # Heavy passes + PASS_HEAVY = {} + + def __init__(self): + self.expr_simp_cb = {} + + def enable_passes(self, passes): + """Add passes from @passes + @passes: dict(Expr class : list(callback)) + + Callback signature: Expr callback(ExpressionSimplifier, Expr) + """ + + for k, v in passes.items(): + self.expr_simp_cb[k] = fast_unify(self.expr_simp_cb.get(k, []) + v) + + def apply_simp(self, expression): + """Apply enabled simplifications on expression + @expression: Expr instance + Return an Expr instance""" + + cls = expression.__class__ + for simp_func in self.expr_simp_cb.get(cls, []): + # Apply simplifications + expression = simp_func(self, expression) + + # If class changes, stop to prevent wrong simplifications + if expression.__class__ is not cls: + break + + return expression + + def expr_simp(self, expression): + """Apply enabled simplifications on expression and find a stable state + @expression: Expr instance + Return an Expr instance""" + + if expression.is_simp: + return expression + + # Find a stable state + while True: + # Canonize and simplify + e_new = self.apply_simp(expression.canonize()) + if e_new == expression: + break + + # Launch recursivity + expression = self.expr_simp_wrapper(e_new) + expression.is_simp = True + + # Mark expression as simplified + e_new.is_simp = True + return e_new + + def expr_simp_wrapper(self, expression, callback=None): + """Apply enabled simplifications on expression + @expression: Expr instance + @manual_callback: If set, call this function instead of normal one + Return an Expr instance""" + + if expression.is_simp: + return expression + + if callback is None: + callback = self.expr_simp + + return expression.visit(callback, lambda e: not(e.is_simp)) + + def __call__(self, expression, callback=None): + "Wrapper on expr_simp_wrapper" + return self.expr_simp_wrapper(expression, callback) + + +# Public ExprSimplificationPass instance with commons passes +expr_simp = ExpressionSimplifier() +expr_simp.enable_passes(ExpressionSimplifier.PASS_COMMONS) diff --git a/miasm2/expression/stp.py b/miasm2/expression/stp.py new file mode 100644 index 00000000..7ef96166 --- /dev/null +++ b/miasm2/expression/stp.py @@ -0,0 +1,68 @@ +from miasm2.expression.expression import * + + +""" +Quick implementation of miasm traduction to stp langage +TODO XXX: finish +""" + + +def ExprInt_strcst(self): + b = bin(int(self.arg))[2::][::-1] + b += "0" * self.size + b = b[:self.size][::-1] + return "0bin" + b + + +def ExprId_strcst(self): + return self.name + + +def genop(op, size, a, b): + return op + '(' + str(size) + ',' + a + ', ' + b + ')' + + +def genop_nosize(op, size, a, b): + return op + '(' + a + ', ' + b + ')' + + +def ExprOp_strcst(self): + op = self.op + op_dct = {"|": " | ", + "&": " & "} + if op in op_dct: + return '(' + op_dct[op].join([x.strcst() for x in self.args]) + ')' + op_dct = {"-": "BVUMINUS"} + if op in op_dct: + return op_dct[op] + '(' + self.args[0].strcst() + ')' + op_dct = {"^": ("BVXOR", genop_nosize), + "+": ("BVPLUS", genop)} + if not op in op_dct: + raise ValueError('implement op', op) + op, f = op_dct[op] + args = [x.strcst() for x in self.args][::-1] + a = args.pop() + b = args.pop() + size = self.args[0].size + out = f(op, size, a, b) + while args: + out = f(op, size, out, args.pop()) + return out + + +def ExprSlice_strcst(self): + return '(' + self.arg.strcst() + ')[%d:%d]' % (self.stop - 1, self.start) + + +def ExprCond_strcst(self): + cond = self.cond.strcst() + src1 = self.src1.strcst() + src2 = self.src2.strcst() + return "(IF %s=(%s) THEN %s ELSE %s ENDIF)" % ( + "0bin%s" % ('0' * self.cond.size), cond, src2, src1) + +ExprInt.strcst = ExprInt_strcst +ExprId.strcst = ExprId_strcst +ExprOp.strcst = ExprOp_strcst +ExprCond.strcst = ExprCond_strcst +ExprSlice.strcst = ExprSlice_strcst diff --git a/miasm2/ir/__init__.py b/miasm2/ir/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/ir/__init__.py diff --git a/miasm2/ir/analysis.py b/miasm2/ir/analysis.py new file mode 100644 index 00000000..5b65acca --- /dev/null +++ b/miasm2/ir/analysis.py @@ -0,0 +1,228 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.ir.symbexec import symbexec +from miasm2.core.graph import DiGraph +from miasm2.expression.expression import * + + +class ira: + + def sort_dst(self, todo, done): + out = set() + while todo: + dst = todo.pop() + if self.ExprIsLabel(dst): + done.add(dst) + elif isinstance(dst, ExprMem) or isinstance(dst, ExprInt): + done.add(dst) + elif isinstance(dst, ExprCond): + todo.add(dst.src1) + todo.add(dst.src2) + elif isinstance(dst, ExprId): + out.add(dst) + else: + done.add(dst) + return out + + def dst_trackback(self, b): + dst = b.dst + todo = set([dst]) + out = set() + done = set() + + for irs in reversed(b.irs): + if len(todo) == 0: + break + out = self.sort_dst(todo, done) + found = set() + follow = set() + for i in irs: + if not out: + break + for o in out: + if i.dst == o: + follow.add(i.src) + found.add(o) + for o in found: + out.remove(o) + + for o in out: + if not o in found: + follow.add(o) + todo = follow + out = self.sort_dst(todo, done) + + return done + + def gen_graph(self, link_all = False): + """ + Gen irbloc digraph + @link_all: also gen edges to non present irblocs + """ + self.g = DiGraph() + for lbl, b in self.blocs.items(): + # print 'add', lbl + self.g.add_node(lbl) + # dst = self.get_bloc_dst(b) + dst = self.dst_trackback(b) + # print "\tdst", dst + for d in dst: + if isinstance(d, ExprInt): + d = ExprId( + self.symbol_pool.getby_offset_create(int(d.arg))) + if self.ExprIsLabel(d): + if d.name in self.blocs or link_all is True: + self.g.add_edge(lbl, d.name) + + def graph(self): + out = """ + digraph asm_graph { + size="80,50"; + node [ + fontsize = "16", + shape = "box" + ]; + """ + all_lbls = {} + for lbl in self.g.nodes(): + if not lbl in self.blocs: + continue + b = self.blocs[lbl] + ir_txt = [str(lbl)] + for irs in b.irs: + for l in irs: + ir_txt.append(str(l)) + ir_txt.append("") + ir_txt.append("DstBloc: %s" % str(b.dst)) + ir_txt.append("") + all_lbls[id(lbl)] = "\l\\\n".join(ir_txt) + for l, v in all_lbls.items(): + out += '%s [label="%s"];\n' % (l, v) + + for a, b in self.g.edges(): + out += '%s -> %s;\n' % (id(a), id(b)) + out += '}' + return out + + def remove_dead(self, b): + for ir, _, c_out in zip(b.irs, b.c_in, b.c_out): + j = 0 + while j < len(ir): + i_cur = ir[j] + if not isinstance(i_cur.dst, ExprId): + pass + elif (isinstance(i_cur.src, ExprOp) and + i_cur.src.op.startswith('call')): + # /!\ never remove ir calls + pass + elif not i_cur.dst in c_out: + del(ir[j]) + continue + j += 1 + + def remove_blocs_dead(self): + for b in self.blocs.values(): + self.remove_dead(b) + + # for test XXX TODO + def set_dead_regs(self, b): + pass + + def add_unused_regs(self): + pass + + def compute_in_out(self, b): + # get out/in from bloc sons + modified = False + # set b in + if b.c_in[-1] != set(b.r[-1].union(b.c_out[-1].difference(b.w[-1]))): + modified = True + b.c_in[-1] = set(b.r[-1].union(b.c_out[-1].difference(b.w[-1]))) + + # set b out + c_out = set() + has_son = False + for n_son in self.g.successors(b.label): + # print n_me, n_son + has_son = True + if not n_son in self.blocs: + print "leaf has lost her sons!" + continue + b_son = self.blocs[n_son] + c_out.update(b_son.c_in[0]) + if not has_son: + # special case: leaf nodes architecture dependant + c_out = self.get_out_regs(b) + if b.c_out[-1] != set(c_out): + modified = True + b.c_out[-1] = set(c_out) + + # get out/in for bloc + for i in reversed(xrange(len(b.irs))): + if b.c_in[i] != set(b.r[i].union(b.c_out[i].difference(b.w[i]))): + modified = True + b.c_in[i] = set(b.r[i].union(b.c_out[i].difference(b.w[i]))) + if b.c_out[i] != set(b.c_in[i + 1]): + modified = True + b.c_out[i] = set(b.c_in[i + 1]) + return modified + + def test_in_out_fix(self): + fixed = True + for n in self.g.nodes(): + if not n in self.blocs: + # leaf has lost her son + continue + b = self.blocs[n] + if b.c_in != b.l_in or b.c_out != b.l_out: + fixed = False + b.l_in = [set(x) for x in b.c_in] + b.l_out = [set(x) for x in b.c_out] + return fixed + + def compute_dead(self): + self.get_rw() + + it = 0 + fixed_point = False + print 'iteration...', + while not fixed_point: + print it, + it += 1 + for n in self.g.nodes(): + if not n in self.blocs: + # leaf has lost her son + continue + b = self.blocs[n] + self.compute_in_out(b) + + fixed_point = self.test_in_out_fix() + print + + def dead_simp(self): + self.compute_dead() + self.remove_blocs_dead() + self.simplify_blocs() + + def gen_equations(self): + for irb in self.blocs.values(): + symbols_init = {} + for r in self.arch.regs.all_regs_ids: + x = ExprId(r.name, r.size) + x.is_term = True + symbols_init[r] = x + sb = symbexec(self.arch, dict(symbols_init)) + sb.emulbloc(irb) + eqs = [] + for n_w in sb.symbols: + v = sb.symbols[n_w] + if n_w in symbols_init and symbols_init[n_w] == v: + continue + eqs.append(ExprAff(n_w, v)) + print '*' * 40 + print irb + for eq in eqs: + eq + irb.irs = [eqs] + irb.lines = [None] diff --git a/miasm2/ir/ir.py b/miasm2/ir/ir.py new file mode 100644 index 00000000..a5d079ca --- /dev/null +++ b/miasm2/ir/ir.py @@ -0,0 +1,299 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +# +# Copyright (C) 2013 Fabrice Desclaux +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# + + +import miasm2.expression.expression as m2_expr +from miasm2.expression.expression_helper import get_missing_interval +from miasm2.core import asmbloc +from miasm2.expression.simplifications import expr_simp +from miasm2.core.graph import DiGraph +from miasm2.core.asmbloc import asm_symbol_pool + + +class irbloc: + + def __init__(self, label, dst=None, irs=None, lines=None): + assert(isinstance(label, asmbloc.asm_label)) + self.label = label + self.dst = dst + self.lines = [] + self.irs = [] + if irs is not None: + self.irs = irs + if lines is not None: + self.lines = lines + self.except_automod = True + + def get_rw(self): + self.r = [] + self.w = [] + self.c_out = [] + self.c_in = [] + self.l_out = [] + self.l_in = [] + for ir in self.irs: + r, w = set(), set() + for i in ir: + r.update([x for x in i.get_r(True) if isinstance(x, m2_expr.ExprId)]) + w.update([x for x in i.get_w() if isinstance(x, m2_expr.ExprId)]) + if isinstance(i.dst, m2_expr.ExprMem): + r.update([x for x in i.dst.arg.get_r(True) + if isinstance(x, m2_expr.ExprId)]) + self.r.append(r) + self.w.append(w) + self.c_out.append(set()) + self.c_in.append(set()) + self.l_out.append(set()) + self.l_in.append(set()) + # get rw for dst + i = self.dst + r, w = set(), set() + if i is not None: + r.update([x for x in i.get_r(True) if isinstance(x, m2_expr.ExprId)]) + self.r.append(r) + self.w.append(w) + self.c_out.append(set()) + self.c_in.append(set()) + self.l_out.append(set()) + self.l_in.append(set()) + + def __str__(self): + o = [] + o.append('%s' % self.label) + for expr in self.irs: + for e in expr: + o.append('\t%s' % e) + o.append("") + o.append('\tDst: %s' % self.dst) + + return "\n".join(o) + + +class ir(object): + + def __init__(self, arch, attrib, symbol_pool=None): + if symbol_pool is None: + symbol_pool = asm_symbol_pool() + self.symbol_pool = symbol_pool + self.blocs = {} + self.pc = arch.getpc(attrib) + self.sp = arch.getsp(attrib) + self.arch = arch + self.attrib = attrib + + def instr2ir(self, l): + dst, ir_bloc_cur, ir_blocs_extra = self.get_ir(l) + return dst, ir_bloc_cur, ir_blocs_extra + + def get_bloc(self, ad): + if isinstance(ad, m2_expr.ExprId) and isinstance(ad.name, + asmbloc.asm_label): + ad = ad.name + if isinstance(ad, m2_expr.ExprInt): + ad = int(ad.arg) + if type(ad) in [int, long]: + ad = self.symbol_pool.getby_offset(ad) + elif isinstance(ad, asmbloc.asm_label): + ad = self.symbol_pool.getby_name(ad.name) + return self.blocs.get(ad, None) + + def add_instr(self, l, ad=0, gen_pc_updt = False): + b = asmbloc.asm_bloc(l) + b.lines = [l] + self.add_bloc(b, gen_pc_updt) + + def merge_multi_affect(self, affect_list): + """ + If multiple affection to a same ExprId are present in @affect_list, + merge them (in place). + For instance, XCGH AX, AL semantic is + [ + RAX = {RAX[0:8],0,8, RAX[0:8],8,16, RAX[16:64],16,64} + RAX = {RAX[8:16],0,8, RAX[8:64],8,64} + ] + This function will update @affect_list to replace previous ExprAff by + [ + RAX = {RAX[8:16],0,8, RAX[0:8],8,16, RAX[16:64],16,64} + ] + """ + + # Extract side effect + effect = {} + for expr in affect_list: + effect[expr.dst] = effect.get(expr.dst, []) + [expr] + + # Find candidates + for dst, expr_list in effect.items(): + if len(expr_list) <= 1: + continue + + # Only treat ExprCompose list + if any(map(lambda e: not(isinstance(e.src, m2_expr.ExprCompose)), + expr_list)): + continue + + # Find collision + e_colision = reduce( + lambda x, y: x + y, [e.get_modified_slice() for e in expr_list]) + + # Sort interval collision + known_intervals = sorted([(x[1], x[2]) for x in set(e_colision)]) + + # Fill with missing data + missing_i = get_missing_interval(known_intervals, 0, e.src.size) + + rest = [(m2_expr.ExprSlice(dst, r[0], r[1]), r[0], r[1]) + for r in missing_i] + + # Build the merging expression + slices = e_colision + rest + slices.sort(key=lambda x: x[1]) + final_dst = m2_expr.ExprCompose(slices) + + # Remove unused expression + for expr in expr_list: + affect_list.remove(expr) + + # Add the merged one + affect_list.append(m2_expr.ExprAff(dst, final_dst)) + + + def getby_offset(self, offset): + out = set() + for irb in self.blocs.values(): + for l in irb.lines: + if l.offset <= offset < l.offset + l.l: + out.add(irb) + return out + + def gen_pc_update(self, c, l): + c.irs.append([m2_expr.ExprAff(self.pc, m2_expr.ExprInt_from(self.pc, + l.offset))]) + c.lines.append(l) + + def add_bloc(self, bloc, gen_pc_updt = False): + c = None + ir_blocs_all = [] + for l in bloc.lines: + if c is None: + # print 'new c' + label = self.get_label(l) + c = irbloc(label) + ir_blocs_all.append(c) + bloc_dst = None + # print 'Translate', l + dst, ir_bloc_cur, ir_blocs_extra = self.instr2ir(l) + # print ir_bloc_cur + # for xxx in ir_bloc_cur: + # print "\t", xxx + assert((dst is None) or (bloc_dst is None)) + bloc_dst = dst + if bloc_dst is not None: + c.dst = bloc_dst + + if gen_pc_updt is not False: + self.gen_pc_update(c, l) + + c.irs.append(ir_bloc_cur) + c.lines.append(l) + if ir_blocs_extra: + # print 'split' + for b in ir_blocs_extra: + b.lines = [l] * len(b.irs) + ir_blocs_all += ir_blocs_extra + c = None + self.post_add_bloc(bloc, ir_blocs_all) + return ir_blocs_all + + def expr_fix_regs_for_mode(self, e, *args, **kwargs): + return e + + def expraff_fix_regs_for_mode(self, e, *args, **kwargs): + return e + + def irbloc_fix_regs_for_mode(self, irbloc, *args, **kwargs): + return + + def is_pc_written(self, b): + all_pc = self.arch.pc.values() + for irs in b.irs: + for ir in irs: + if ir.dst in all_pc: + return ir + return None + + def set_empty_dst_to_next(self, bloc, ir_blocs): + for b in ir_blocs: + if b.dst is not None: + continue + dst = m2_expr.ExprId(self.get_next_label(bloc.lines[-1]), + self.pc.size) + b.dst = dst + + def gen_edges(self, bloc, ir_blocs): + pass + + def post_add_bloc(self, bloc, ir_blocs): + self.set_empty_dst_to_next(bloc, ir_blocs) + self.gen_edges(bloc, ir_blocs) + + for irb in ir_blocs: + self.irbloc_fix_regs_for_mode(irb, self.attrib) + + # Detect multi-affectation + for affect_list in irb.irs: + self.merge_multi_affect(affect_list) + + self.blocs[irb.label] = irb + + + def get_label(self, instr): + l = self.symbol_pool.getby_offset_create(instr.offset) + return l + + def gen_label(self): + # TODO: fix hardcoded offset + l = self.symbol_pool.gen_label() + return l + + def get_next_label(self, instr): + l = self.symbol_pool.getby_offset_create(instr.offset + instr.l) + return l + + def simplify_blocs(self): + for b in self.blocs.values(): + for ir in b.irs: + for i, r in enumerate(ir): + ir[i].src = expr_simp(r.src) + ir[i].dst = expr_simp(r.dst) + + def replace_expr_in_ir(self, bloc, rep): + for irs in bloc.irs: + for i, l in enumerate(irs): + irs[i] = l.replace_expr(rep) + + def get_rw(self): + for b in self.blocs.values(): + b.get_rw() + + def ExprIsLabel(self, l): + return isinstance(l, m2_expr.ExprId) and isinstance(l.name, + asmbloc.asm_label) diff --git a/miasm2/ir/ir2C.py b/miasm2/ir/ir2C.py new file mode 100644 index 00000000..64591b44 --- /dev/null +++ b/miasm2/ir/ir2C.py @@ -0,0 +1,601 @@ +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from miasm2.core import asmbloc +import logging + + +log_to_c_h = logging.getLogger("ir_helper") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log_to_c_h.addHandler(console_handler) +log_to_c_h.setLevel(logging.WARN) + + +def ExprInt_toC(self): + return str(self) + + +def ExprId_toC(self): + if isinstance(self.name, asmbloc.asm_label): + return "0x%x" % self.name.offset + return str(self) + + +def ExprAff_toC(self): + return "%s = %s" % (self.dst.toC(), self.src.toC()) + + +def ExprCond_toC(self): + return "(%s?%s:%s)" % (self.cond.toC(), self.src1.toC(), self.src2.toC()) + + +def ExprMem_toC(self): + return "MEM_LOOKUP_%.2d(vm_mngr, %s)" % (self._size, self.arg.toC()) + + +def ExprOp_toC(self): + dct_shift = {'a>>': "right_arith", + '>>': "right_logic", + '<<': "left_logic", + 'a<<': "left_logic", + } + dct_rot = {'<<<': 'rot_left', + '>>>': 'rot_right', + } + dct_div = {'div8': "div_op", + 'div16': "div_op", + 'div32': "div_op", + 'idiv32': "div_op", # XXX to test + 'rem8': "rem_op", + 'rem16': "rem_op", + 'rem32': "rem_op", + 'irem32': "rem_op", # XXX to test + '<<<c_rez': 'rcl_rez_op', + '<<<c_cf': 'rcl_cf_op', + '>>>c_rez': 'rcr_rez_op', + '>>>c_cf': 'rcr_cf_op', + } + if len(self.args) == 1: + if self.op == 'parity': + return "parity(%s&0x%x)" % ( + self.args[0].toC(), size2mask(self.args[0].size)) + elif self.op == '!': + return "(~ %s)&0x%x" % ( + self.args[0].toC(), size2mask(self.args[0].size)) + elif self.op in ["hex2bcd", "bcd2hex"]: + return "%s_%d(%s)" % ( + self.op, self.args[0].size, self.args[0].toC()) + elif (self.op.startswith("double_to_") or + self.op.endswith("_to_double") or + self.op.startswith("access_") or + self.op.startswith("load_") or + self.op in ["-", "ftan", "frndint", "f2xm1", + "fsin", "fsqrt", "fabs", "fcos"]): + return "%s(%s)" % (self.op, self.args[0].toC()) + else: + raise ValueError('unknown op: %r' % self.op) + elif len(self.args) == 2: + if self.op == "==": + return '(((%s&0x%x) == (%s&0x%x))?1:0)' % ( + self.args[0].toC(), size2mask(self.args[0].size), + self.args[1].toC(), size2mask(self.args[1].size)) + elif self.op in dct_shift: + return 'shift_%s_%.2d(%s , %s)' % (dct_shift[self.op], + self.args[0].size, + self.args[0].toC(), + self.args[1].toC()) + elif self.is_associative(): + o = ['(%s&0x%x)' % (a.toC(), size2mask(a.size)) for a in self.args] + o = str(self.op).join(o) + return "((%s)&0x%x)" % (o, size2mask(self.args[0].size)) + elif self.op in ["%", "/"]: + o = ['(%s&0x%x)' % (a.toC(), size2mask(a.size)) for a in self.args] + o = str(self.op).join(o) + return "((%s)&0x%x)" % (o, size2mask(self.args[0].size)) + elif self.op in ['-']: + return '(((%s&0x%x) %s (%s&0x%x))&0x%x)' % ( + self.args[0].toC(), size2mask(self.args[0].size), + str(self.op), + self.args[1].toC(), size2mask(self.args[1].size), + size2mask(self.args[0].size)) + elif self.op in dct_rot: + return '(%s(%s, %s, %s) &0x%x)' % (dct_rot[self.op], + self.args[0].size, + self.args[0].toC(), + self.args[1].toC(), + size2mask(self.args[0].size)) + elif self.op in ['bsr', 'bsf']: + return 'my_%s(%s, %s)' % (self.op, + self.args[0].toC(), + self.args[1].toC()) + elif self.op.startswith('cpuid'): + return "%s(%s, %s)" % ( + self.op, self.args[0].toC(), self.args[1].toC()) + elif self.op.startswith("fcom"): + return "%s(%s, %s)" % ( + self.op, self.args[0].toC(), self.args[1].toC()) + elif self.op in ["fadd", "fsub", "fdiv", 'fmul', "fscale"]: + return "%s(%s, %s)" % ( + self.op, self.args[0].toC(), self.args[1].toC()) + elif self.op == "segm": + return "segm2addr(vmcpu, %s, %s)" % ( + self.args[0].toC(), self.args[1].toC()) + elif self.op in ['udiv', 'umod', 'idiv', 'imod']: + return '%s%d(vmcpu, %s, %s)' % (self.op, + self.args[0].size, + self.args[0].toC(), + self.args[1].toC()) + elif self.op in ["bcdadd", "bcdadd_cf"]: + return "%s_%d(%s, %s)" % (self.op, self.args[0].size, + self.args[0].toC(), + self.args[1].toC()) + else: + raise ValueError('unknown op: %r' % self.op) + elif len(self.args) == 3 and self.op in dct_div: + return '(%s(%s, %s, %s, %s) &0x%x)' % (dct_div[self.op], + self.args[0].size, + self.args[0].toC(), + self.args[1].toC(), + self.args[2].toC(), + size2mask(self.args[0].size)) + elif len(self.args) >= 3 and self.is_associative(): # ????? + o = ['(%s&0x%x)' % (a.toC(), size2mask(a.size)) for a in self.args] + o = str(self.op).join(o) + r = "((%s)&0x%x)" % (o, size2mask(self.args[0].size)) + return r + else: + raise NotImplementedError('unknown op: %s' % self) + + +def ExprSlice_toC(self): + # XXX check mask for 64 bit & 32 bit compat + return "((%s>>%d) & 0x%X)" % (self.arg.toC(), + self.start, + (1 << (self.stop - self.start)) - 1) + + +def ExprCompose_toC(self): + out = [] + # XXX check mask for 64 bit & 32 bit compat + dst_cast = "uint%d_t" % self.size + for x in self.args: + out.append("(((%s)(%s & 0x%X)) << %d)" % (dst_cast, + x[0].toC(), + (1 << (x[2] - x[1])) - 1, + x[1])) + out = ' | '.join(out) + return '(' + out + ')' + + +ExprInt.toC = ExprInt_toC +ExprId.toC = ExprId_toC +ExprAff.toC = ExprAff_toC +ExprCond.toC = ExprCond_toC +ExprMem.toC = ExprMem_toC +ExprOp.toC = ExprOp_toC +ExprSlice.toC = ExprSlice_toC +ExprCompose.toC = ExprCompose_toC + +prefetch_id = [] +prefetch_id_size = {} +for size in [8, 16, 32, 64]: + prefetch_id_size[size] = [] + for i in xrange(20): + name = 'pfmem%.2d_%d' % (size, i) + c = ExprId(name, size) + globals()[name] = c + prefetch_id.append(c) + prefetch_id_size[size].append(c) + + +reg_float_st0 = 'float_st0' +reg_float_st1 = 'float_st1' +reg_float_st2 = 'float_st2' +reg_float_st3 = 'float_st3' +reg_float_st4 = 'float_st4' +reg_float_st5 = 'float_st5' +reg_float_st6 = 'float_st6' +reg_float_st7 = 'float_st7' + + +float_st0 = ExprId(reg_float_st0, 64) +float_st1 = ExprId(reg_float_st1, 64) +float_st2 = ExprId(reg_float_st2, 64) +float_st3 = ExprId(reg_float_st3, 64) +float_st4 = ExprId(reg_float_st4, 64) +float_st5 = ExprId(reg_float_st5, 64) +float_st6 = ExprId(reg_float_st6, 64) +float_st7 = ExprId(reg_float_st7, 64) + +fltregs32_str = ["ST(%d)" % i for i in xrange(8)] +fltregs32_expr = [ExprId(x, 64) for x in fltregs32_str] + + +float_id_e = [ + float_st0, + float_st1, + float_st2, + float_st3, + float_st4, + float_st5, + float_st6, + float_st7, +] + fltregs32_expr + + +def init_arch_C(arch): + arch.id2Cid = {} + for x in arch.regs.all_regs_ids + prefetch_id: + arch.id2Cid[x] = ExprId('vmcpu->' + str(x), x.size) + for i in xrange(8): + arch.id2Cid[ExprId('ST(%d)' % i, 64)] = ExprId( + 'vmcpu->' + "float_st%d" % i, 64) + + arch.id2newCid = {} + + for x in arch.regs.all_regs_ids + prefetch_id: + arch.id2newCid[x] = ExprId('vmcpu->%s_new' % x, x.size) + + for i in xrange(8): + arch.id2newCid[ExprId('ST(%d)' % i, 64)] = ExprId( + 'vmcpu->' + "float_st%d_new" % i, 64) + + +def patch_c_id(arch, e): + return e.replace_expr(arch.id2Cid) + + +def patch_c_new_id(arch, e): + return e.replace_expr(arch.id2newCid) + + +mask_int = 0xffffffffffffffff + + +pre_instr_test_exception = r""" +// pre instruction test exception +if (vm_mngr->exception_flags) { + %s; + RETURN_PC; +} +""" + + +code_exception_fetch_mem_at_instr = r""" +// except fetch mem at instr +if (vm_mngr->exception_flags & EXCEPT_DO_NOT_UPDATE_PC) { + %s; + RETURN_PC; +} +""" +code_exception_fetch_mem_post_instr = r""" +// except fetch mem post instr +if (vm_mngr->exception_flags) { + %s; + RETURN_PC; +} +""" + + +code_exception_fetch_mem_at_instr_noautomod = r""" +// except fetch mem at instr noauto +if ((vm_mngr->exception_flags & ~EXCEPT_CODE_AUTOMOD) & EXCEPT_DO_NOT_UPDATE_PC) { + %s; + RETURN_PC; +} +""" +code_exception_fetch_mem_post_instr_noautomod = r""" +// except post instr noauto +if (vm_mngr->exception_flags & ~EXCEPT_CODE_AUTOMOD) { + %s; + RETURN_PC; +} +""" + + +code_exception_at_instr = r""" +// except at instr +if (vmcpu->exception_flags && vmcpu->exception_flags > EXCEPT_NUM_UPDT_EIP) { + %s; + RETURN_PC; +} +""" + +code_exception_post_instr = r""" +// except post instr +if (vmcpu->exception_flags) { + if (vmcpu->exception_flags > EXCEPT_NUM_UPDT_EIP) + %s; + else + %s; + RETURN_PC; +} +""" + + +code_exception_at_instr_noautomod = r""" +if ((vmcpu->exception_flags & ~EXCEPT_CODE_AUTOMOD) && vmcpu->exception_flags > EXCEPT_NUM_UPDT_EIP) { + %s; + RETURN_PC; +} +""" + +code_exception_post_instr_noautomod = r""" +if (vmcpu->exception_flags & ~EXCEPT_CODE_AUTOMOD) { + if (vmcpu->exception_flags > EXCEPT_NUM_UPDT_EIP) + %s; + else + %s; + RETURN_PC; +} +""" + + +my_size_mask = {1: 1, 2: 3, 3: 7, 7: 0x7f, + 8: 0xFF, + 16: 0xFFFF, + 32: 0xFFFFFFFF, + 64: 0xFFFFFFFFFFFFFFFFL} + +exception_flags = ExprId('exception_flags', 32) + + +def set_pc(my_ir, src): + dst = my_ir.jit_pc + if not isinstance(src, Expr): + src = ExprInt_from(dst, src) + e = ExprAff(dst, src.zeroExtend(dst.size)) + return e + + +def Expr2C(my_ir, l, exprs, gen_exception_code=False): + id_to_update = [] + out = ["// %s" % (l)] + out_pc = [] + + dst_dict = {} + src_mem = {} + + prefect_index = {8: 0, 16: 0, 32: 0, 64: 0} + new_expr = [] + + e = set_pc(my_ir, l.offset & mask_int) + #out.append("%s;" % patch_c_id(my_ir.arch, e).toC()) + + pc_is_dst = False + fetch_mem = False + set_exception_flags = False + for e in exprs: + assert(isinstance(e, ExprAff)) + assert(not isinstance(e.dst, ExprOp)) + if isinstance(e.dst, ExprId): + if not e.dst in dst_dict: + dst_dict[e.dst] = [] + dst_dict[e.dst].append(e) + else: + new_expr.append(e) + # test exception flags + ops = get_expr_ops(e) + if set(['umod', 'udiv']).intersection(ops): + set_exception_flags = True + if e.dst == exception_flags: + set_exception_flags = True + # TODO XXX test function whose set exception_flags + + # search mem lookup for generate mem read prefetch + rs = e.src.get_r(mem_read=True) + for r in rs: + if (not isinstance(r, ExprMem)) or r in src_mem: + continue + fetch_mem = True + index = prefect_index[r.size] + prefect_index[r.size] += 1 + pfmem = prefetch_id_size[r.size][index] + src_mem[r] = pfmem + + for dst, exs in dst_dict.items(): + if len(exs) == 1: + new_expr += exs + continue + exs = [expr_simp(x) for x in exs] + log_to_c_h.debug('warning: detected multi dst to same id') + log_to_c_h.debug('\t'.join([str(x) for x in exs])) + new_expr += exs + out_mem = [] + + # first, generate mem prefetch + mem_k = src_mem.keys() + mem_k.sort() + for k in mem_k: + str_src = patch_c_id(my_ir.arch, k).toC() + str_dst = patch_c_id(my_ir.arch, src_mem[k]).toC() + out.append('%s = %s;' % (str_dst, str_src)) + src_w_len = {} + for k, v in src_mem.items(): + src_w_len[k] = v + for e in new_expr: + src, dst = e.src, e.dst + # reload src using prefetch + src = src.replace_expr(src_w_len) + str_src = patch_c_id(my_ir.arch, src).toC() + str_dst = patch_c_id(my_ir.arch, dst).toC() + if isinstance(dst, ExprId): + id_to_update.append(dst) + str_dst = patch_c_new_id(my_ir.arch, dst) + if dst in float_id_e: + # dont mask float affectation + out.append('%s = (%s);' % (str_dst, str_src)) + else: + out.append('%s = (%s)&0x%X;' % (str_dst, str_src, + my_size_mask[src.size])) + elif isinstance(dst, ExprMem): + fetch_mem = True + str_dst = str_dst.replace('MEM_LOOKUP', 'MEM_WRITE') + out_mem.append('%s, %s);' % (str_dst[:-1], str_src)) + + if e.dst == my_ir.arch.pc[my_ir.attrib]: + pc_is_dst = True + out_pc += ["RETURN_PC;"] + + # if len(id_to_update) != len(set(id_to_update)): + # raise ValueError('Not implemented: multi dst to same id!', str([str(x) + # for x in exprs])) + out += out_mem + + if gen_exception_code: + if fetch_mem: + e = set_pc(my_ir, l.offset & mask_int) + s1 = "%s" % patch_c_id(my_ir.arch, e).toC() + out.append(code_exception_fetch_mem_at_instr_noautomod % s1) + if set_exception_flags: + e = set_pc(my_ir, l.offset & mask_int) + s1 = "%s" % patch_c_id(my_ir.arch, e).toC() + out.append(code_exception_at_instr_noautomod % s1) + + for i in id_to_update: + out.append('%s = %s;' % + (patch_c_id(my_ir.arch, i), patch_c_new_id(my_ir.arch, i))) + + post_instr = [] + # test stop exec #### + if gen_exception_code: + if set_exception_flags: + if pc_is_dst: + post_instr.append("if (vm_mngr->exception_flags) { " + + "/*pc = 0x%X; */RETURN_PC; }" % (l.offset)) + else: + e = set_pc(my_ir, l.offset & mask_int) + s1 = "%s" % patch_c_id(my_ir.arch, e).toC() + e = set_pc(my_ir, (l.offset + l.l) & mask_int) + s2 = "%s" % patch_c_id(my_ir.arch, e).toC() + post_instr.append( + code_exception_post_instr_noautomod % (s1, s2)) + + if fetch_mem: + if l.additional_info.except_on_instr: + offset = l.offset + else: + offset = l.offset + l.l + + e = set_pc(my_ir, offset & mask_int) + s1 = "%s" % patch_c_id(my_ir.arch, e).toC() + post_instr.append( + code_exception_fetch_mem_post_instr_noautomod % (s1)) + + # pc manip after all modifications + return out, post_instr, post_instr + out_pc + + +def label2offset(e): + if not isinstance(e, ExprId): + return e + if not isinstance(e.name, asmbloc.asm_label): + return e + return ExprInt_from(e, e.name.offset) + + +def expr2pyobj(arch, e): + if isinstance(e, ExprId): + if isinstance(e.name, asmbloc.asm_label): + src_c = 'PyString_FromStringAndSize("%s", %d)' % ( + e.name.name, len(e.name.name)) + else: + src_c = 'PyLong_FromUnsignedLongLong(%s)' % patch_c_id(arch, e) + else: + raise NotImplementedError('unknown type for e: %s' % type(e)) + return src_c + + +def ir2C(my_ir, irbloc, lbl_done, + gen_exception_code=False, log_mn=False, log_regs=False): + out = [] + # print "TRANS" + # print irbloc + out.append(["%s:" % irbloc.label.name]) + assert(len(irbloc.irs) == len(irbloc.lines)) + for l, exprs in zip(irbloc.lines, irbloc.irs): + if l.offset not in lbl_done: + e = set_pc(my_ir, l.offset & mask_int) + s1 = "%s" % patch_c_id(my_ir.arch, e).toC() + out.append([pre_instr_test_exception % (s1)]) + lbl_done.add(l.offset) + + if log_regs: + out.append([r'dump_gpregs(vmcpu);']) + + if log_mn: + out.append(['printf("%.8X %s\\n");' % (l.offset, str(l))]) + # print l + # gen pc update + post_instr = "" + c_code, post_instr, _ = Expr2C(my_ir, l, exprs, gen_exception_code) + out.append(c_code + post_instr) + return out + + +def irblocs2C(my_ir, resolvers, label, irblocs, + gen_exception_code=False, log_mn=False, log_regs=False): + out = [] + out.append("goto %s;" % label.name) + bloc_labels = [x.label for x in irblocs] + assert(label in bloc_labels) + + lbl_done = set([None]) + + for irbloc in irblocs: + # XXXX TEST + if irbloc.label.offset is None: + b_out = ir2C(my_ir, irbloc, lbl_done, gen_exception_code) + else: + b_out = ir2C( + my_ir, irbloc, lbl_done, gen_exception_code, log_mn, log_regs) + for exprs in b_out: + for l in exprs: + out.append(l) + dst = irbloc.dst + out.append("") + if asmbloc.expr_is_label(dst): + if dst.name in bloc_labels: + out.append("goto %s;" % dst.name.name) + else: + resolver = resolvers.get_resolver(dst.name.offset) + + e = set_pc(my_ir, dst.name.offset & mask_int) + #out.append("%s;" % patch_c_id(my_ir.arch, e).toC()) + out.append(resolver.ret()) + elif isinstance(dst, ExprSlice) and isinstance(dst.arg, ExprId): + e = set_pc(my_ir, dst) + #out.append("%s;" % patch_c_id(my_ir.arch, e).toC()) + + e = patch_c_id(my_ir.arch, dst).toC() + out.append("return PyLong_FromUnsignedLongLong(%s);" % e) + + elif isinstance(dst, ExprId): + e = set_pc(my_ir, dst) + #out.append("%s;" % patch_c_id(my_ir.arch, e).toC()) + + e = patch_c_id(my_ir.arch, dst).toC() + out.append("return PyLong_FromUnsignedLongLong(%s);" % e) + elif isinstance(dst, ExprCond): + dst_cond_c = patch_c_id(my_ir.arch, dst.cond).toC() + out.append("if (%s)" % dst_cond_c) + + if dst.src1.name in bloc_labels: + out.append(" goto %s;" % dst.src1.name.name) + else: + resolver = resolvers.get_resolver(dst.src1.name.offset) + out.append(resolver.ret()) + + out.append("else") + + if dst.src2.name in bloc_labels: + out.append(" goto %s;" % dst.src2.name.name) + else: + resolver = resolvers.get_resolver(dst.src2.name.offset) + out.append(resolver.ret()) + + else: + raise NotImplementedError('unknown type for dst: %s' % type(dst)) + #print '\n'.join(out) + return out + diff --git a/miasm2/ir/symbexec.py b/miasm2/ir/symbexec.py new file mode 100644 index 00000000..08608142 --- /dev/null +++ b/miasm2/ir/symbexec.py @@ -0,0 +1,435 @@ +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp +from miasm2.core import asmbloc +import logging + + +log = logging.getLogger("symbexec") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.INFO) + + +class symbols(): + + def __init__(self, init=None): + if init is None: + init = {} + self.symbols_id = {} + self.symbols_mem = {} + for k, v in init.items(): + self[k] = v + + def __contains__(self, a): + if not isinstance(a, ExprMem): + return self.symbols_id.__contains__(a) + if not self.symbols_mem.__contains__(a.arg): + return False + return self.symbols_mem[a.arg][0].size == a.size + + def __getitem__(self, a): + if not isinstance(a, ExprMem): + return self.symbols_id.__getitem__(a) + if not a.arg in self.symbols_mem: + raise KeyError, a + m = self.symbols_mem.__getitem__(a.arg) + if m[0].size != a.size: + raise KeyError, a + return m[1] + + def __setitem__(self, a, v): + if not isinstance(a, ExprMem): + self.symbols_id.__setitem__(a, v) + return + self.symbols_mem.__setitem__(a.arg, (a, v)) + + def __iter__(self): + for a in self.symbols_id: + yield a + for a in self.symbols_mem: + yield self.symbols_mem[a][0] + + def __delitem__(self, a): + if not isinstance(a, ExprMem): + self.symbols_id.__delitem__(a) + else: + self.symbols_mem.__delitem__(a.arg) + + def items(self): + k = self.symbols_id.items() + [x for x in self.symbols_mem.values()] + return k + + def keys(self): + k = self.symbols_id.keys() + [x[0] for x in self.symbols_mem.values()] + return k + + def copy(self): + p = symbols() + p.symbols_id = dict(self.symbols_id) + p.symbols_mem = dict(self.symbols_mem) + return p + + def inject_info(self, info): + s = symbols() + for k, v in self.items(): + k = expr_simp(k.replace_expr(info)) + v = expr_simp(v.replace_expr(info)) + s[k] = v + return s + + +class symbexec: + + def __init__(self, arch, known_symbols, + func_read=None, + func_write=None, + sb_expr_simp=expr_simp): + self.symbols = symbols() + for k, v in known_symbols.items(): + self.symbols[k] = v + self.func_read = func_read + self.func_write = func_write + self.arch = arch + self.expr_simp = sb_expr_simp + + def find_mem_by_addr(self, e): + if e in self.symbols.symbols_mem: + return self.symbols.symbols_mem[e][0] + return None + + def eval_ExprId(self, e, eval_cache=None): + if isinstance(e.name, asmbloc.asm_label) and e.name.offset is not None: + return ExprInt_from(e, e.name.offset) + if not e in self.symbols: + # raise ValueError('unknown symbol %s'% e) + return e + return self.symbols[e] + + def eval_ExprInt(self, e, eval_cache=None): + return e + + def eval_ExprMem(self, e, eval_cache=None): + a_val = self.expr_simp(self.eval_expr(e.arg, eval_cache)) + if a_val != e.arg: + a = self.expr_simp(ExprMem(a_val, size=e.size)) + else: + a = e + if a in self.symbols: + return self.symbols[a] + tmp = None + # test if mem lookup is known + if a_val in self.symbols.symbols_mem: + tmp = self.symbols.symbols_mem[a_val][0] + if tmp is None: + + v = self.find_mem_by_addr(a_val) + if not v: + out = [] + ov = self.get_mem_overlapping(a, eval_cache) + off_base = 0 + ov.sort() + # ov.reverse() + for off, x in ov: + # off_base = off * 8 + # x_size = self.symbols[x].size + if off >= 0: + m = min(a.size - off * 8, x.size) + ee = ExprSlice(self.symbols[x], 0, m) + ee = self.expr_simp(ee) + out.append((ee, off_base, off_base + m)) + off_base += m + else: + m = min(a.size - off * 8, x.size) + ee = ExprSlice(self.symbols[x], -off * 8, m) + ff = self.expr_simp(ee) + new_off_base = off_base + m + off * 8 + out.append((ff, off_base, new_off_base)) + off_base = new_off_base + if out: + missing_slice = self.rest_slice(out, 0, a.size) + for sa, sb in missing_slice: + ptr = self.expr_simp(a_val + ExprInt32(sa / 8)) + mm = ExprMem(ptr, size=sb - sa) + mm.is_term = True + mm.is_simp = True + out.append((mm, sa, sb)) + out.sort(key=lambda x: x[1]) + # for e, sa, sb in out: + # print str(e), sa, sb + ee = ExprSlice(ExprCompose(out), 0, a.size) + ee = self.expr_simp(ee) + return ee + if self.func_read and isinstance(a.arg, ExprInt): + return self.func_read(a) + else: + # XXX hack test + a.is_term = True + return a + # bigger lookup + if a.size > tmp.size: + rest = a.size + ptr = a_val + out = [] + ptr_index = 0 + while rest: + v = self.find_mem_by_addr(ptr) + if v is None: + # raise ValueError("cannot find %s in mem"%str(ptr)) + val = ExprMem(ptr, 8) + v = val + diff_size = 8 + elif rest >= v.size: + val = self.symbols[v] + diff_size = v.size + else: + diff_size = rest + val = self.symbols[v][0:diff_size] + val = (val, ptr_index, ptr_index + diff_size) + out.append(val) + ptr_index += diff_size + rest -= diff_size + ptr = self.expr_simp(self.eval_expr(ExprOp('+', ptr, + ExprInt_from(ptr, v.size / 8)), eval_cache)) + e = self.expr_simp(ExprCompose(out)) + return e + # part lookup + tmp = self.expr_simp(ExprSlice(self.symbols[tmp], 0, a.size)) + return tmp + + def eval_expr_visit(self, e, eval_cache=None): + # print 'visit', e, e.is_term + if e.is_term: + return e + c = e.__class__ + deal_class = {ExprId: self.eval_ExprId, + ExprInt: self.eval_ExprInt, + ExprMem: self.eval_ExprMem, + } + # print 'eval', e + if c in deal_class: + e = deal_class[c](e, eval_cache) + # print "ret", e + if not (isinstance(e, ExprId) or isinstance(e, ExprInt)): + e.is_term = True + return e + + def eval_expr(self, e, eval_cache=None): + r = e.visit(lambda x: self.eval_expr_visit(x, eval_cache)) + return r + + def modified_regs(self, init_state=None): + if init_state is None: + init_state = self.arch.regs.regs_init + ids = self.symbols.symbols_id.keys() + ids.sort() + for i in ids: + if i in init_state and \ + i in self.symbols.symbols_id and \ + self.symbols.symbols_id[i] == init_state[i]: + continue + yield i + + def modified_mems(self, init_state=None): + mems = self.symbols.symbols_mem.values() + mems.sort() + for m, _ in mems: + yield m + + def modified(self, init_state=None): + for r in self.modified_regs(init_state): + yield r + for m in self.modified_mems(init_state): + yield m + + def dump_id(self): + ids = self.symbols.symbols_id.keys() + ids.sort() + for i in ids: + if i in self.arch.regs.regs_init and \ + i in self.symbols.symbols_id and \ + self.symbols.symbols_id[i] == self.arch.regs.regs_init[i]: + continue + print i, self.symbols.symbols_id[i] + + def dump_mem(self): + mems = self.symbols.symbols_mem.values() + mems.sort() + for m, v in mems: + print m, v + + def rest_slice(self, slices, start, stop): + o = [] + last = start + for _, a, b in slices: + if a == last: + last = b + continue + o.append((last, a)) + last = b + if last != stop: + o.append((b, stop)) + return o + + def substract_mems(self, a, b): + ex = ExprOp('-', b.arg, a.arg) + ex = self.expr_simp(self.eval_expr(ex, {})) + if not isinstance(ex, ExprInt): + return None + ptr_diff = int(int32(ex.arg)) + out = [] + if ptr_diff < 0: + # [a ] + #[b ]XXX + sub_size = b.size + ptr_diff * 8 + if sub_size >= a.size: + pass + else: + ex = ExprOp('+', a.arg, ExprInt_from(a.arg, sub_size / 8)) + ex = self.expr_simp(self.eval_expr(ex, {})) + + rest_ptr = ex + rest_size = a.size - sub_size + + val = self.symbols[a][sub_size:a.size] + out = [(ExprMem(rest_ptr, rest_size), val)] + else: + #[a ] + # XXXX[b ]YY + + #[a ] + # XXXX[b ] + + out = [] + # part X + if ptr_diff > 0: + val = self.symbols[a][0:ptr_diff * 8] + out.append((ExprMem(a.arg, ptr_diff * 8), val)) + # part Y + if ptr_diff * 8 + b.size < a.size: + + ex = ExprOp('+', b.arg, ExprInt_from(b.arg, b.size / 8)) + ex = self.expr_simp(self.eval_expr(ex, {})) + + rest_ptr = ex + rest_size = a.size - (ptr_diff * 8 + b.size) + val = self.symbols[a][ptr_diff * 8 + b.size:a.size] + out.append((ExprMem(ex, val.size), val)) + return out + + # give mem stored overlapping requested mem ptr + def get_mem_overlapping(self, e, eval_cache=None): + if not isinstance(e, ExprMem): + raise ValueError('mem overlap bad arg') + ov = [] + # suppose max mem size is 64 bytes, compute all reachable addresses + to_test = [] + base_ptr = self.expr_simp(e.arg) + for i in xrange(-7, e.size / 8): + ex = self.expr_simp( + self.eval_expr(base_ptr + ExprInt_from(e.arg, i), eval_cache)) + to_test.append((i, ex)) + + for i, x in to_test: + if not x in self.symbols.symbols_mem: + continue + ex = self.expr_simp(self.eval_expr(e.arg - x, eval_cache)) + if not isinstance(ex, ExprInt): + raise ValueError('ex is not ExprInt') + ptr_diff = int32(ex.arg) + if ptr_diff >= self.symbols.symbols_mem[x][1].size / 8: + # print "too long!" + continue + ov.append((i, self.symbols.symbols_mem[x][0])) + return ov + + def eval_ir_expr(self, exprs): + pool_out = {} + + eval_cache = {} + + for e in exprs: + if not isinstance(e, ExprAff): + raise TypeError('not affect', str(e)) + + src = self.eval_expr(e.src, eval_cache) + if isinstance(e.dst, ExprMem): + a = self.eval_expr(e.dst.arg, eval_cache) + a = self.expr_simp(a) + # search already present mem + tmp = None + # test if mem lookup is known + tmp = ExprMem(a, e.dst.size) + dst = tmp + if self.func_write and isinstance(dst.arg, ExprInt): + self.func_write(self, dst, src, pool_out) + else: + pool_out[dst] = src + + elif isinstance(e.dst, ExprId): + pool_out[e.dst] = src + else: + raise ValueError("affected zarb", str(e.dst)) + + return pool_out.items() + + def eval_ir(self, ir): + mem_dst = [] + # src_dst = [(x.src, x.dst) for x in ir] + src_dst = self.eval_ir_expr(ir) + + for dst, src in src_dst: + if isinstance(dst, ExprMem): + mem_overlap = self.get_mem_overlapping(dst) + for _, base in mem_overlap: + diff_mem = self.substract_mems(base, dst) + del(self.symbols[base]) + for new_mem, new_val in diff_mem: + new_val.is_term = True + self.symbols[new_mem] = new_val + src_o = self.expr_simp(src) + # print 'SRCo', src_o + # src_o.is_term = True + self.symbols[dst] = src_o + if isinstance(dst, ExprMem): + mem_dst.append(dst) + return mem_dst + + def emulbloc(self, bloc_ir, step=False): + for ir in bloc_ir.irs: + self.eval_ir(ir) + if step: + print '_' * 80 + self.dump_id() + if bloc_ir.dst is None: + return None + return self.eval_expr(bloc_ir.dst) + + def emul_ir_bloc(self, myir, ad): + b = myir.get_bloc(ad) + if b is not None: + ad = self.emulbloc(b) + return ad + + def emul_ir_blocs(self, myir, ad, lbl_stop=None): + while True: + b = myir.get_bloc(ad) + if b is None: + break + if b.label == lbl_stop: + break + ad = self.emulbloc(b) + return ad + + def del_mem_above_stack(self, sp): + sp_val = self.symbols[sp] + for mem_ad, (mem, _) in self.symbols.symbols_mem.items(): + # print mem_ad, sp_val + diff = self.eval_expr(mem_ad - sp_val, {}) + diff = expr_simp(diff) + if not isinstance(diff, ExprInt): + continue + m = expr_simp(diff.msb()) + if m.arg == 1: + del(self.symbols[mem]) + diff --git a/miasm2/jitter/Jitllvm.c b/miasm2/jitter/Jitllvm.c new file mode 100644 index 00000000..ab077b05 --- /dev/null +++ b/miasm2/jitter/Jitllvm.c @@ -0,0 +1,36 @@ +#include <Python.h> + +#include <inttypes.h> + +#include <stdint.h> + +PyObject* llvm_exec_bloc(PyObject* self, PyObject* args) +{ + uint64_t (*func)(void*, void*); + uint64_t vm; + uint64_t cpu; + uint64_t ret; + + if (!PyArg_ParseTuple(args, "KKK", &func, &cpu, &vm)) + return NULL; + ret = func((void*)cpu, (void*)vm); + return PyLong_FromUnsignedLongLong( (uint64_t)ret); +} + + +static PyMethodDef LLVMMethods[] = { + {"llvm_exec_bloc", llvm_exec_bloc, METH_VARARGS, + "llvm exec bloc"}, + {NULL, NULL, 0, NULL} /* Sentinel */ +}; + +PyMODINIT_FUNC +initJitllvm(void) +{ + PyObject *m; + + m = Py_InitModule("Jitllvm", LLVMMethods); + if (m == NULL) + return; + +} diff --git a/miasm2/jitter/Jittcc.c b/miasm2/jitter/Jittcc.c new file mode 100644 index 00000000..4b16f0b1 --- /dev/null +++ b/miasm2/jitter/Jittcc.c @@ -0,0 +1,226 @@ +/* +** Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License as published by +** the Free Software Foundation; either version 2 of the License, or +** (at your option) any later version. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License along +** with this program; if not, write to the Free Software Foundation, Inc., +** 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +*/ +#include <Python.h> + +#include <inttypes.h> +#include <libtcc.h> + +#include <stdint.h> + + + +/* tcc global state */ +TCCState *tcc_state = NULL; + + +int include_array_count = 0; +char **include_array = NULL; + + +int lib_array_count = 0; +char **lib_array = NULL; + +//char *libcodenat_path = NULL; + + +void tcc_init_state(void) +{ + int i; + + tcc_state = tcc_new(); + if (!tcc_state) { + fprintf(stderr, "Impossible de creer un contexte TCC\n"); + exit(1); + } + tcc_set_output_type(tcc_state, TCC_OUTPUT_MEMORY); + + //tcc_add_file(tcc_state, libcodenat_path); + for (i=0;i<lib_array_count; i++){ + tcc_add_file(tcc_state, lib_array[i]); + } + + for (i=0;i<include_array_count; i++){ + tcc_add_include_path(tcc_state, include_array[i]); + } +} + + + + +PyObject* tcc_set_emul_lib_path(PyObject* self, PyObject* args) +{ + char* include_arg; + char* lib_arg; + + char* str1, * str2; + + if (!PyArg_ParseTuple(args, "ss", + &include_arg, + &lib_arg)) + return NULL; + /* + if (include_array) + free(include_array); + */ + + str2 = strdup(include_arg); + while (str2){ + str1 = strsep(&str2, ";"); + if (str1){ + include_array_count ++; + include_array = realloc(include_array, + include_array_count * sizeof(char*)); + include_array[include_array_count-1] = strdup(str1); + fprintf(stderr, "adding include file: %s\n", str1); + } + } + + + str2 = strdup(lib_arg); + while (str2){ + str1 = strsep(&str2, ";"); + if (str1){ + lib_array_count ++; + lib_array = realloc(lib_array, + lib_array_count * sizeof(char*)); + lib_array[lib_array_count-1] = strdup(str1); + fprintf(stderr, "adding lib file: %s\n", str1); + } + } + + /* + libcodenat_path = (char*)malloc(strlen(libcodenat_path_arg)+1); + strcpy(libcodenat_path, libcodenat_path_arg); + */ + Py_INCREF(Py_None); + + + return Py_None; +} + + +PyObject* tcc_exec_bloc(PyObject* self, PyObject* args) +{ + PyObject* (*func)(void*, void*); + uint64_t vm; + uint64_t cpu; + PyObject* ret; + + if (!PyArg_ParseTuple(args, "KKK", &func, &cpu, &vm)) + return NULL; + ret = func((void*)cpu, (void*)vm); + return ret; +} + +PyObject* tcc_compil(PyObject* self, PyObject* args) +{ + char* func_name; + char* func_code; + int (*entry)(void); + + tcc_init_state(); + + if (!PyArg_ParseTuple(args, "ss", &func_name, &func_code)) + return NULL; + + if (tcc_compile_string(tcc_state, func_code) != 0) { + fprintf(stderr, "Erreur de compilation !\n"); + fprintf(stderr, "%s\n", func_code); + exit(0); + } + /* XXX use tinycc devel with -fPIC patch in makefile */ + if (tcc_relocate(tcc_state, TCC_RELOCATE_AUTO) < 0) { + fprintf(stderr, "tcc relocate error\n"); + exit(0); + } + entry = tcc_get_symbol(tcc_state, func_name); + if (!entry){ + fprintf(stderr, "Erreur de symbole %s!\n", func_name); + fprintf(stderr, "%s\n", func_name); + exit(0); + } + return PyLong_FromUnsignedLongLong((uint64_t)entry); + +} + + + +PyObject* tcc_loop_exec(PyObject* self, PyObject* args) +{ + //PyObject* (*func)(void*, void*); + uint64_t* vm; + uint64_t* cpu; + PyObject* ret; + PyObject* func; + PyObject* pArgs; + + + if (!PyArg_ParseTuple(args, "OKK", &func, &cpu, &vm)) + return NULL; + + while (1) { + if (!PyCallable_Check (func)) { + fprintf(stderr, "function not callable!\n"); + exit(0); + } + + pArgs = PyTuple_New(2); + PyTuple_SetItem(pArgs, 0, PyLong_FromUnsignedLongLong((uint64_t)cpu)); + PyTuple_SetItem(pArgs, 1, PyLong_FromUnsignedLongLong((uint64_t)vm)); + ret = PyObject_CallObject(func, pArgs); + Py_DECREF(2); + + if (ret == Py_None) { + Py_INCREF(Py_None); + return Py_None; + } + func = ret; + } + + return ret; +} + + + +static PyObject *TccError; + + +static PyMethodDef TccMethods[] = { + {"tcc_set_emul_lib_path", tcc_set_emul_lib_path, METH_VARARGS, + "init tcc path"}, + {"tcc_exec_bloc", tcc_exec_bloc, METH_VARARGS, + "tcc exec bloc"}, + {"tcc_compil", tcc_compil, METH_VARARGS, + "tcc compil"}, + {NULL, NULL, 0, NULL} /* Sentinel */ +}; + +PyMODINIT_FUNC +initJittcc(void) +{ + PyObject *m; + + m = Py_InitModule("Jittcc", TccMethods); + if (m == NULL) + return; + + TccError = PyErr_NewException("tcc.error", NULL, NULL); + Py_INCREF(TccError); + PyModule_AddObject(m, "error", TccError); +} + diff --git a/miasm2/jitter/Makefile b/miasm2/jitter/Makefile new file mode 100644 index 00000000..7d43f28c --- /dev/null +++ b/miasm2/jitter/Makefile @@ -0,0 +1,17 @@ +all: vm_mngr.so Jit_x86.so Jittcc.so + + +vm_mngr.so: vm_mngr.c vm_mngr.h vm_mngr_py.c + gcc -I /usr/include/python2.7 -shared -fPIC vm_mngr.c vm_mngr_py.c -o vm_mngr.so + +Jit_x86.so: arch/Jit_x86.c + gcc -I /usr/include/python2.7 -shared -fPIC arch/Jit_x86.c -o arch/Jit_x86.so + +Jit_arm.so: arch/Jit_arm.c + gcc -I /usr/include/python2.7 -shared -fPIC arch/Jit_arm.c -o arch/Jit_arm.so + +Jittcc.so: Jittcc.c + gcc -I /usr/include/python2.7 -shared -fPIC Jittcc.c -o Jittcc.so -ltcc + +clean: + rm vm_mngr.so Jittcc.so arch/Jit_x86.so \ No newline at end of file diff --git a/miasm2/jitter/__init__.py b/miasm2/jitter/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/jitter/__init__.py diff --git a/miasm2/jitter/arch/JitCore.h b/miasm2/jitter/arch/JitCore.h new file mode 100644 index 00000000..2686cb46 --- /dev/null +++ b/miasm2/jitter/arch/JitCore.h @@ -0,0 +1,66 @@ + +#define PyGetInt(item, value) \ + if (PyInt_Check(item)){ \ + value = (uint64_t)PyInt_AsLong(item); \ + } \ + else if (PyLong_Check(item)){ \ + value = (uint64_t)PyLong_AsUnsignedLongLong(item); \ + } \ + else{ \ + RAISE(PyExc_TypeError,"arg must be int"); \ + } \ + + +#define PyGetInt_ret0(item, value) \ + if (PyInt_Check(item)){ \ + value = (uint64_t)PyInt_AsLong(item); \ + } \ + else if (PyLong_Check(item)){ \ + value = (uint64_t)PyLong_AsUnsignedLongLong(item); \ + } \ + else{ \ + printf("error\n"); return 0; \ + } \ + + + +#define getset_reg_u64(regname) \ + static PyObject *JitCpu_get_ ## regname (JitCpu *self, void *closure) \ + { \ + return PyLong_FromUnsignedLongLong((uint64_t)(self->vmcpu. regname )); \ + } \ + static int JitCpu_set_ ## regname (JitCpu *self, PyObject *value, void *closure) \ + { \ + uint64_t val; \ + PyGetInt_ret0(value, val); \ + self->vmcpu. regname = val; \ + return 0; \ + } + +#define getset_reg_u32(regname) \ + static PyObject *JitCpu_get_ ## regname (JitCpu *self, void *closure) \ + { \ + return PyLong_FromUnsignedLongLong((uint32_t)(self->vmcpu. regname )); \ + } \ + static int JitCpu_set_ ## regname (JitCpu *self, PyObject *value, void *closure) \ + { \ + uint32_t val; \ + PyGetInt_ret0(value, val); \ + self->vmcpu. regname = val; \ + return 0; \ + } + + +#define getset_reg_u16(regname) \ + static PyObject *JitCpu_get_ ## regname (JitCpu *self, void *closure) \ + { \ + return PyLong_FromUnsignedLongLong((uint16_t)(self->vmcpu. regname )); \ + } \ + static int JitCpu_set_ ## regname (JitCpu *self, PyObject *value, void *closure) \ + { \ + uint16_t val; \ + PyGetInt_ret0(value, val); \ + self->vmcpu. regname = val; \ + return 0; \ + } + diff --git a/miasm2/jitter/arch/JitCore_arm.c b/miasm2/jitter/arch/JitCore_arm.c new file mode 100644 index 00000000..7e64ae77 --- /dev/null +++ b/miasm2/jitter/arch/JitCore_arm.c @@ -0,0 +1,388 @@ +#include <Python.h> +#include "JitCore.h" +#include "structmember.h" +#include <stdint.h> +#include <inttypes.h> +#include "JitCore_arm.h" + +#define RAISE(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return p;} + +typedef struct _reg_dict{ + char* name; + unsigned long offset; +} reg_dict; + + +#define PyGetInt(item, value) \ + if (PyInt_Check(item)){ \ + value = (uint64_t)PyInt_AsLong(item); \ + } \ + else if (PyLong_Check(item)){ \ + value = (uint64_t)PyLong_AsUnsignedLongLong(item); \ + } \ + else{ \ + RAISE(PyExc_TypeError,"arg must be int"); \ + } \ + +reg_dict gpreg_dict[] = { {.name = "R0", .offset = offsetof(vm_cpu_t, R0)}, + {.name = "R1", .offset = offsetof(vm_cpu_t, R1)}, + {.name = "R2", .offset = offsetof(vm_cpu_t, R2)}, + {.name = "R3", .offset = offsetof(vm_cpu_t, R3)}, + {.name = "R4", .offset = offsetof(vm_cpu_t, R4)}, + {.name = "R5", .offset = offsetof(vm_cpu_t, R5)}, + {.name = "R6", .offset = offsetof(vm_cpu_t, R6)}, + {.name = "R7", .offset = offsetof(vm_cpu_t, R7)}, + {.name = "R8", .offset = offsetof(vm_cpu_t, R8)}, + {.name = "R9", .offset = offsetof(vm_cpu_t, R9)}, + {.name = "R10", .offset = offsetof(vm_cpu_t, R10)}, + {.name = "R11", .offset = offsetof(vm_cpu_t, R11)}, + {.name = "R12", .offset = offsetof(vm_cpu_t, R12)}, + {.name = "SP", .offset = offsetof(vm_cpu_t, SP)}, + {.name = "LR", .offset = offsetof(vm_cpu_t, LR)}, + {.name = "PC", .offset = offsetof(vm_cpu_t, PC)}, + + {.name = "zf", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "nf", .offset = offsetof(vm_cpu_t, nf)}, + {.name = "of", .offset = offsetof(vm_cpu_t, of)}, + {.name = "cf", .offset = offsetof(vm_cpu_t, cf)}, +}; + +/************************** JitCpu object **************************/ + +typedef struct { + PyObject_HEAD + PyObject *cpu; /* cpu */ + vm_cpu_t vmcpu; +} JitCpu; + + + +#define get_reg(reg) do { \ + o = PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.reg); \ + PyDict_SetItemString(dict, #reg, o); \ + Py_DECREF(o); \ + } while(0); + + + +PyObject* vm_get_gpreg(JitCpu* self) +{ + PyObject *dict = PyDict_New(); + PyObject *o; + + get_reg(R0); + get_reg(R1); + get_reg(R2); + get_reg(R3); + get_reg(R4); + get_reg(R5); + get_reg(R6); + get_reg(R7); + get_reg(R8); + get_reg(R9); + get_reg(R10); + get_reg(R11); + get_reg(R12); + get_reg(SP); + get_reg(LR); + get_reg(PC); + + get_reg(zf); + get_reg(nf); + get_reg(of); + get_reg(cf); + + return dict; +} + +PyObject* _vm_set_gpreg(JitCpu* self, PyObject *dict) +{ + PyObject *d_key, *d_value = NULL; + Py_ssize_t pos = 0; + uint64_t val; + unsigned int i, found; + + if(!PyDict_Check(dict)) + RAISE(PyExc_TypeError, "arg must be dict"); + while(PyDict_Next(dict, &pos, &d_key, &d_value)){ + if(!PyString_Check(d_key)) + RAISE(PyExc_TypeError, "key must be str"); + + PyGetInt(d_value, val); + + + found = 0; + for (i=0; i < sizeof(gpreg_dict)/sizeof(reg_dict); i++){ + if (strcmp(PyString_AsString(d_key), gpreg_dict[i].name)) + continue; + *((uint32_t*)(((char*)&(self->vmcpu)) + gpreg_dict[i].offset)) = val; + found = 1; + break; + } + + if (found) + continue; + fprintf(stderr, "unkown key: %s\n", PyString_AsString(d_key)); + RAISE(PyExc_ValueError, "unkown reg"); + } + return NULL; +} + +PyObject* vm_set_gpreg(JitCpu* self, PyObject *args) +{ + PyObject* dict; + if (!PyArg_ParseTuple(args, "O", &dict)) + return NULL; + _vm_set_gpreg(self, dict); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_set_exception(JitCpu* self, PyObject* args) +{ + PyObject *item1; + uint64_t i; + + if (!PyArg_ParseTuple(args, "O", &item1)) + return NULL; + + PyGetInt(item1, i); + + self->vmcpu.exception_flags = i; + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_get_exception(JitCpu* self, PyObject* args) +{ + return PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.exception_flags); +} + + +PyObject * vm_init_regs(JitCpu* self) +{ + memset(&self->vmcpu, 0, sizeof(vm_cpu_t)); + + Py_INCREF(Py_None); + return Py_None; + +} + +void dump_gpregs(vm_cpu_t* vmcpu) +{ + printf("R0 %.16"PRIX32" R1 %.16"PRIX32" R2 %.16"PRIX32" R3 %.16"PRIX32"\n", + vmcpu->R0, vmcpu->R1, vmcpu->R2, vmcpu->R3); + printf("R4 %.16"PRIX32" R5 %.16"PRIX32" R6 %.16"PRIX32" R7 %.16"PRIX32"\n", + vmcpu->R4, vmcpu->R5, vmcpu->R6, vmcpu->R7); + printf("R8 %.16"PRIX32" R9 %.16"PRIX32" R10 %.16"PRIX32" R11 %.16"PRIX32"\n", + vmcpu->R8, vmcpu->R9, vmcpu->R10, vmcpu->R11); + printf("R12 %.16"PRIX32" SP %.16"PRIX32" LR %.16"PRIX32" PC %.16"PRIX32"\n", + vmcpu->R12, vmcpu->SP, vmcpu->LR, vmcpu->PC); + printf("zf %.16"PRIX32" nf %.16"PRIX32" of %.16"PRIX32" cf %.16"PRIX32"\n", + vmcpu->zf, vmcpu->nf, vmcpu->of, vmcpu->cf); +} + + +PyObject * vm_dump_gpregs(JitCpu* self, PyObject* args) +{ + vm_cpu_t* vmcpu; + + vmcpu = &self->vmcpu; + dump_gpregs(vmcpu); + Py_INCREF(Py_None); + return Py_None; +} + + + +static void +JitCpu_dealloc(JitCpu* self) +{ + self->ob_type->tp_free((PyObject*)self); +} + + +static PyObject * +JitCpu_new(PyTypeObject *type, PyObject *args, PyObject *kwds) +{ + JitCpu *self; + + self = (JitCpu *)type->tp_alloc(type, 0); + return (PyObject *)self; +} + +static PyObject * +JitCpu_get_cpu(JitCpu *self, void *closure) +{ + return PyLong_FromUnsignedLongLong((uint64_t)&(self->vmcpu)); +} + +static int +JitCpu_set_cpu(JitCpu *self, PyObject *value, void *closure) +{ + PyErr_SetString(PyExc_TypeError, "immutable cpu"); + return -1; +} + +static PyMemberDef JitCpu_members[] = { + {NULL} /* Sentinel */ +}; + +static PyMethodDef JitCpu_methods[] = { + {"vm_init_regs", (PyCFunction)vm_init_regs, METH_NOARGS, + "X"}, + {"vm_dump_gpregs", (PyCFunction)vm_dump_gpregs, METH_NOARGS, + "X"}, + {"vm_get_gpreg", (PyCFunction)vm_get_gpreg, METH_NOARGS, + "X"}, + {"vm_set_gpreg", (PyCFunction)vm_set_gpreg, METH_VARARGS, + "X"}, + {"vm_get_exception", (PyCFunction)vm_get_exception, METH_VARARGS, + "X"}, + {"vm_set_exception", (PyCFunction)vm_set_exception, METH_VARARGS, + "X"}, + {NULL} /* Sentinel */ +}; + +static int +JitCpu_init(JitCpu *self, PyObject *args, PyObject *kwds) +{ + + + fprintf(stderr, "ad cpu: %p\n", &(self->vmcpu)); + + return 0; +} + +getset_reg_u32(R0); +getset_reg_u32(R1); +getset_reg_u32(R2); +getset_reg_u32(R3); +getset_reg_u32(R4); +getset_reg_u32(R5); +getset_reg_u32(R6); +getset_reg_u32(R7); +getset_reg_u32(R8); +getset_reg_u32(R9); +getset_reg_u32(R10); +getset_reg_u32(R11); +getset_reg_u32(R12); +getset_reg_u32(SP); +getset_reg_u32(LR); +getset_reg_u32(PC); + +getset_reg_u32(zf); +getset_reg_u32(nf); +getset_reg_u32(of); +getset_reg_u32(cf); + + +static PyGetSetDef JitCpu_getseters[] = { + {"cpu", + (getter)JitCpu_get_cpu, (setter)JitCpu_set_cpu, + "first name", + NULL}, + + {"R0" , (getter)JitCpu_get_R0 , (setter)JitCpu_set_R0 , "R0" , NULL}, + {"R1" , (getter)JitCpu_get_R1 , (setter)JitCpu_set_R1 , "R1" , NULL}, + {"R2" , (getter)JitCpu_get_R2 , (setter)JitCpu_set_R2 , "R2" , NULL}, + {"R3" , (getter)JitCpu_get_R3 , (setter)JitCpu_set_R3 , "R3" , NULL}, + {"R4" , (getter)JitCpu_get_R4 , (setter)JitCpu_set_R4 , "R4" , NULL}, + {"R5" , (getter)JitCpu_get_R5 , (setter)JitCpu_set_R5 , "R5" , NULL}, + {"R6" , (getter)JitCpu_get_R6 , (setter)JitCpu_set_R6 , "R6" , NULL}, + {"R7" , (getter)JitCpu_get_R7 , (setter)JitCpu_set_R7 , "R7" , NULL}, + {"R8" , (getter)JitCpu_get_R8 , (setter)JitCpu_set_R8 , "R8" , NULL}, + {"R9" , (getter)JitCpu_get_R9 , (setter)JitCpu_set_R9 , "R9" , NULL}, + {"R10", (getter)JitCpu_get_R10, (setter)JitCpu_set_R10, "R10", NULL}, + {"R11", (getter)JitCpu_get_R11, (setter)JitCpu_set_R11, "R11", NULL}, + {"R12", (getter)JitCpu_get_R12, (setter)JitCpu_set_R12, "R12", NULL}, + {"SP" , (getter)JitCpu_get_SP , (setter)JitCpu_set_SP , "SP" , NULL}, + {"LR" , (getter)JitCpu_get_LR , (setter)JitCpu_set_LR , "LR" , NULL}, + {"PC" , (getter)JitCpu_get_PC , (setter)JitCpu_set_PC , "PC" , NULL}, + + {"zf", (getter)JitCpu_get_zf, (setter)JitCpu_set_zf, "zf", NULL}, + {"nf", (getter)JitCpu_get_nf, (setter)JitCpu_set_nf, "nf", NULL}, + {"of", (getter)JitCpu_get_of, (setter)JitCpu_set_of, "of", NULL}, + {"cf", (getter)JitCpu_get_cf, (setter)JitCpu_set_cf, "cf", NULL}, + + {NULL} /* Sentinel */ +}; + + +static PyTypeObject JitCpuType = { + PyObject_HEAD_INIT(NULL) + 0, /*ob_size*/ + "JitCore_arm.JitCpu", /*tp_name*/ + sizeof(JitCpu), /*tp_basicsize*/ + 0, /*tp_itemsize*/ + (destructor)JitCpu_dealloc,/*tp_dealloc*/ + 0, /*tp_print*/ + 0, /*tp_getattr*/ + 0, /*tp_setattr*/ + 0, /*tp_compare*/ + 0, /*tp_repr*/ + 0, /*tp_as_number*/ + 0, /*tp_as_sequence*/ + 0, /*tp_as_mapping*/ + 0, /*tp_hash */ + 0, /*tp_call*/ + 0, /*tp_str*/ + 0, /*tp_getattro*/ + 0, /*tp_setattro*/ + 0, /*tp_as_buffer*/ + Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /*tp_flags*/ + "JitCpu objects", /* tp_doc */ + 0, /* tp_traverse */ + 0, /* tp_clear */ + 0, /* tp_richcompare */ + 0, /* tp_weaklistoffset */ + 0, /* tp_iter */ + 0, /* tp_iternext */ + JitCpu_methods, /* tp_methods */ + JitCpu_members, /* tp_members */ + JitCpu_getseters, /* tp_getset */ + 0, /* tp_base */ + 0, /* tp_dict */ + 0, /* tp_descr_get */ + 0, /* tp_descr_set */ + 0, /* tp_dictoffset */ + (initproc)JitCpu_init, /* tp_init */ + 0, /* tp_alloc */ + JitCpu_new, /* tp_new */ +}; + + + +static PyMethodDef JitCore_arm_Methods[] = { + + /* + + */ + {NULL, NULL, 0, NULL} /* Sentinel */ + +}; + +static PyObject *JitCore_arm_Error; + +PyMODINIT_FUNC +initJitCore_arm(void) +{ + PyObject *m; + + if (PyType_Ready(&JitCpuType) < 0) + return; + + m = Py_InitModule("JitCore_arm", JitCore_arm_Methods); + if (m == NULL) + return; + + JitCore_arm_Error = PyErr_NewException("JitCore_arm.error", NULL, NULL); + Py_INCREF(JitCore_arm_Error); + PyModule_AddObject(m, "error", JitCore_arm_Error); + + Py_INCREF(&JitCpuType); + PyModule_AddObject(m, "JitCpu", (PyObject *)&JitCpuType); + +} + diff --git a/miasm2/jitter/arch/JitCore_arm.h b/miasm2/jitter/arch/JitCore_arm.h new file mode 100644 index 00000000..e92db860 --- /dev/null +++ b/miasm2/jitter/arch/JitCore_arm.h @@ -0,0 +1,147 @@ + +typedef struct { + uint32_t exception_flags; + uint32_t exception_flags_new; + + /* gpregs */ + uint32_t R0; + uint32_t R1; + uint32_t R2; + uint32_t R3; + uint32_t R4; + uint32_t R5; + uint32_t R6; + uint32_t R7; + uint32_t R8; + uint32_t R9; + uint32_t R10; + uint32_t R11; + uint32_t R12; + uint32_t SP; + uint32_t LR; + uint32_t PC; + + uint32_t R0_new; + uint32_t R1_new; + uint32_t R2_new; + uint32_t R3_new; + uint32_t R4_new; + uint32_t R5_new; + uint32_t R6_new; + uint32_t R7_new; + uint32_t R8_new; + uint32_t R9_new; + uint32_t R10_new; + uint32_t R11_new; + uint32_t R12_new; + uint32_t SP_new; + uint32_t LR_new; + uint32_t PC_new; + + /* eflag */ + uint32_t zf; + uint32_t nf; + uint32_t of; + uint32_t cf; + + uint32_t zf_new; + uint32_t nf_new; + uint32_t of_new; + uint32_t cf_new; + + + uint8_t pfmem08_0; + uint8_t pfmem08_1; + uint8_t pfmem08_2; + uint8_t pfmem08_3; + uint8_t pfmem08_4; + uint8_t pfmem08_5; + uint8_t pfmem08_6; + uint8_t pfmem08_7; + uint8_t pfmem08_8; + uint8_t pfmem08_9; + uint8_t pfmem08_10; + uint8_t pfmem08_11; + uint8_t pfmem08_12; + uint8_t pfmem08_13; + uint8_t pfmem08_14; + uint8_t pfmem08_15; + uint8_t pfmem08_16; + uint8_t pfmem08_17; + uint8_t pfmem08_18; + uint8_t pfmem08_19; + + + uint16_t pfmem16_0; + uint16_t pfmem16_1; + uint16_t pfmem16_2; + uint16_t pfmem16_3; + uint16_t pfmem16_4; + uint16_t pfmem16_5; + uint16_t pfmem16_6; + uint16_t pfmem16_7; + uint16_t pfmem16_8; + uint16_t pfmem16_9; + uint16_t pfmem16_10; + uint16_t pfmem16_11; + uint16_t pfmem16_12; + uint16_t pfmem16_13; + uint16_t pfmem16_14; + uint16_t pfmem16_15; + uint16_t pfmem16_16; + uint16_t pfmem16_17; + uint16_t pfmem16_18; + uint16_t pfmem16_19; + + + uint32_t pfmem32_0; + uint32_t pfmem32_1; + uint32_t pfmem32_2; + uint32_t pfmem32_3; + uint32_t pfmem32_4; + uint32_t pfmem32_5; + uint32_t pfmem32_6; + uint32_t pfmem32_7; + uint32_t pfmem32_8; + uint32_t pfmem32_9; + uint32_t pfmem32_10; + uint32_t pfmem32_11; + uint32_t pfmem32_12; + uint32_t pfmem32_13; + uint32_t pfmem32_14; + uint32_t pfmem32_15; + uint32_t pfmem32_16; + uint32_t pfmem32_17; + uint32_t pfmem32_18; + uint32_t pfmem32_19; + + + uint64_t pfmem64_0; + uint64_t pfmem64_1; + uint64_t pfmem64_2; + uint64_t pfmem64_3; + uint64_t pfmem64_4; + uint64_t pfmem64_5; + uint64_t pfmem64_6; + uint64_t pfmem64_7; + uint64_t pfmem64_8; + uint64_t pfmem64_9; + uint64_t pfmem64_10; + uint64_t pfmem64_11; + uint64_t pfmem64_12; + uint64_t pfmem64_13; + uint64_t pfmem64_14; + uint64_t pfmem64_15; + uint64_t pfmem64_16; + uint64_t pfmem64_17; + uint64_t pfmem64_18; + uint64_t pfmem64_19; + + + uint32_t segm_base[0x10000]; + +}vm_cpu_t; + + + +#define RETURN_PC return PyLong_FromUnsignedLongLong(vmcpu->PC); diff --git a/miasm2/jitter/arch/JitCore_msp430.c b/miasm2/jitter/arch/JitCore_msp430.c new file mode 100644 index 00000000..17c1497e --- /dev/null +++ b/miasm2/jitter/arch/JitCore_msp430.c @@ -0,0 +1,694 @@ +#include <Python.h> +#include "JitCore.h" +#include "structmember.h" +#include <stdint.h> +#include <inttypes.h> +#include "JitCore_msp430.h" + +#define RAISE(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return p;} + +/* +void check_align(uint64_t addr) +{ + if (addr & 1) { + printf("unaligned mem lookup %X\n", addr); + exit(0); + } +} + +void VM_MEM_WRITE_08(vm_mngr_t* vm_mngr, uint64_t addr, unsigned char src) +{ + //check_align(addr); + MEM_WRITE_08(vm_mngr, addr, src); +} + +void VM_MEM_WRITE_16(vm_mngr_t* vm_mngr, uint64_t addr, unsigned short src) +{ + check_align(addr); + MEM_WRITE_16(vm_mngr, addr, src); +} + +void VM_MEM_WRITE_32(vm_mngr_t* vm_mngr, uint64_t addr, unsigned int src) +{ + check_align(addr); + MEM_WRITE_32(vm_mngr, addr, src); +} + +void VM_MEM_WRITE_64(vm_mngr_t* vm_mngr, uint64_t addr, uint64_t src) +{ + check_align(addr); + MEM_WRITE_64(vm_mngr, addr, src); +} +*/ + +typedef struct _reg_dict{ + char* name; + unsigned long offset; +} reg_dict; + + +#define PyGetInt(item, value) \ + if (PyInt_Check(item)){ \ + value = (uint64_t)PyInt_AsLong(item); \ + } \ + else if (PyLong_Check(item)){ \ + value = (uint64_t)PyLong_AsUnsignedLongLong(item); \ + } \ + else{ \ + RAISE(PyExc_TypeError,"arg must be int"); \ + } \ + +reg_dict gpreg_dict[] = { {.name = "PC", .offset = offsetof(vm_cpu_t, PC)}, + {.name = "SP", .offset = offsetof(vm_cpu_t, SP)}, + //{.name = "SR", .offset = offsetof(vm_cpu_t, SR)}, + {.name = "R3", .offset = offsetof(vm_cpu_t, R3)}, + {.name = "R4", .offset = offsetof(vm_cpu_t, R4)}, + {.name = "R5", .offset = offsetof(vm_cpu_t, R5)}, + {.name = "R6", .offset = offsetof(vm_cpu_t, R6)}, + {.name = "R7", .offset = offsetof(vm_cpu_t, R7)}, + {.name = "R8", .offset = offsetof(vm_cpu_t, R8)}, + {.name = "R9", .offset = offsetof(vm_cpu_t, R9)}, + {.name = "R10", .offset = offsetof(vm_cpu_t, R10)}, + {.name = "R11", .offset = offsetof(vm_cpu_t, R11)}, + {.name = "R12", .offset = offsetof(vm_cpu_t, R12)}, + {.name = "R13", .offset = offsetof(vm_cpu_t, R13)}, + {.name = "R14", .offset = offsetof(vm_cpu_t, R14)}, + {.name = "R15", .offset = offsetof(vm_cpu_t, R15)}, + + {.name = "zf", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "nf", .offset = offsetof(vm_cpu_t, nf)}, + {.name = "of", .offset = offsetof(vm_cpu_t, of)}, + {.name = "cf", .offset = offsetof(vm_cpu_t, cf)}, + + {.name = "cpuoff", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "gie", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "osc", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "scg0", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "scg1", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "res", .offset = offsetof(vm_cpu_t, zf)}, + +}; + +/************************** JitCpu object **************************/ + +typedef struct { + PyObject_HEAD + PyObject *cpu; /* cpu */ + vm_cpu_t vmcpu; +} JitCpu; + + + +#define get_reg(reg) do { \ + o = PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.reg); \ + PyDict_SetItemString(dict, #reg, o); \ + Py_DECREF(o); \ + } while(0); + + + +PyObject* vm_get_gpreg(JitCpu* self) +{ + PyObject *dict = PyDict_New(); + PyObject *o; + + get_reg(PC); + get_reg(SP); + //get_reg(SR); + get_reg(R3); + get_reg(R4); + get_reg(R5); + get_reg(R6); + get_reg(R7); + get_reg(R8); + get_reg(R9); + get_reg(R10); + get_reg(R11); + get_reg(R12); + get_reg(R13); + get_reg(R14); + get_reg(R15); + + get_reg(zf); + get_reg(nf); + get_reg(of); + get_reg(cf); + + get_reg(cpuoff); + get_reg(gie); + get_reg(osc); + get_reg(scg0); + get_reg(scg1); + get_reg(res); + + + return dict; +} + +#define get_reg_off(reg) do { \ + o = PyLong_FromUnsignedLongLong((uint64_t)offsetof(vm_cpu_t, reg)); \ + PyDict_SetItemString(dict, #reg, o); \ + Py_DECREF(o); \ + } while(0); + + +PyObject* get_gpreg_offset_all(void) +{ + PyObject *dict = PyDict_New(); + PyObject *o; + get_reg_off(exception_flags); + get_reg_off(exception_flags_new); + get_reg_off(PC); + get_reg_off(SP); + get_reg_off(R3); + get_reg_off(R4); + get_reg_off(R5); + get_reg_off(R6); + get_reg_off(R7); + get_reg_off(R8); + get_reg_off(R9); + get_reg_off(R10); + get_reg_off(R11); + get_reg_off(R12); + get_reg_off(R13); + get_reg_off(R14); + get_reg_off(R15); + get_reg_off(PC_new); + get_reg_off(SP_new); + get_reg_off(SR_new); + get_reg_off(R3_new); + get_reg_off(R4_new); + get_reg_off(R5_new); + get_reg_off(R6_new); + get_reg_off(R7_new); + get_reg_off(R8_new); + get_reg_off(R9_new); + get_reg_off(R10_new); + get_reg_off(R11_new); + get_reg_off(R12_new); + get_reg_off(R13_new); + get_reg_off(R14_new); + get_reg_off(R15_new); + get_reg_off(zf); + get_reg_off(nf); + get_reg_off(of); + get_reg_off(cf); + get_reg_off(cpuoff); + get_reg_off(gie); + get_reg_off(osc); + get_reg_off(scg0); + get_reg_off(scg1); + get_reg_off(res); + get_reg_off(zf_new); + get_reg_off(nf_new); + get_reg_off(of_new); + get_reg_off(cf_new); + get_reg_off(cpuoff_new); + get_reg_off(gie_new); + get_reg_off(osc_new); + get_reg_off(scg0_new); + get_reg_off(scg1_new); + get_reg_off(res_new); + get_reg_off(pfmem08_0); + get_reg_off(pfmem08_1); + get_reg_off(pfmem08_2); + get_reg_off(pfmem08_3); + get_reg_off(pfmem08_4); + get_reg_off(pfmem08_5); + get_reg_off(pfmem08_6); + get_reg_off(pfmem08_7); + get_reg_off(pfmem08_8); + get_reg_off(pfmem08_9); + get_reg_off(pfmem08_10); + get_reg_off(pfmem08_11); + get_reg_off(pfmem08_12); + get_reg_off(pfmem08_13); + get_reg_off(pfmem08_14); + get_reg_off(pfmem08_15); + get_reg_off(pfmem08_16); + get_reg_off(pfmem08_17); + get_reg_off(pfmem08_18); + get_reg_off(pfmem08_19); + get_reg_off(pfmem16_0); + get_reg_off(pfmem16_1); + get_reg_off(pfmem16_2); + get_reg_off(pfmem16_3); + get_reg_off(pfmem16_4); + get_reg_off(pfmem16_5); + get_reg_off(pfmem16_6); + get_reg_off(pfmem16_7); + get_reg_off(pfmem16_8); + get_reg_off(pfmem16_9); + get_reg_off(pfmem16_10); + get_reg_off(pfmem16_11); + get_reg_off(pfmem16_12); + get_reg_off(pfmem16_13); + get_reg_off(pfmem16_14); + get_reg_off(pfmem16_15); + get_reg_off(pfmem16_16); + get_reg_off(pfmem16_17); + get_reg_off(pfmem16_18); + get_reg_off(pfmem16_19); + get_reg_off(pfmem32_0); + get_reg_off(pfmem32_1); + get_reg_off(pfmem32_2); + get_reg_off(pfmem32_3); + get_reg_off(pfmem32_4); + get_reg_off(pfmem32_5); + get_reg_off(pfmem32_6); + get_reg_off(pfmem32_7); + get_reg_off(pfmem32_8); + get_reg_off(pfmem32_9); + get_reg_off(pfmem32_10); + get_reg_off(pfmem32_11); + get_reg_off(pfmem32_12); + get_reg_off(pfmem32_13); + get_reg_off(pfmem32_14); + get_reg_off(pfmem32_15); + get_reg_off(pfmem32_16); + get_reg_off(pfmem32_17); + get_reg_off(pfmem32_18); + get_reg_off(pfmem32_19); + get_reg_off(pfmem64_0); + get_reg_off(pfmem64_1); + get_reg_off(pfmem64_2); + get_reg_off(pfmem64_3); + get_reg_off(pfmem64_4); + get_reg_off(pfmem64_5); + get_reg_off(pfmem64_6); + get_reg_off(pfmem64_7); + get_reg_off(pfmem64_8); + get_reg_off(pfmem64_9); + get_reg_off(pfmem64_10); + get_reg_off(pfmem64_11); + get_reg_off(pfmem64_12); + get_reg_off(pfmem64_13); + get_reg_off(pfmem64_14); + get_reg_off(pfmem64_15); + get_reg_off(pfmem64_16); + get_reg_off(pfmem64_17); + get_reg_off(pfmem64_18); + get_reg_off(pfmem64_19); + return dict; +} + + +PyObject* _vm_set_gpreg(JitCpu* self, PyObject *dict) +{ + PyObject *d_key, *d_value = NULL; + Py_ssize_t pos = 0; + uint64_t val; + unsigned int i, found; + + if(!PyDict_Check(dict)) + RAISE(PyExc_TypeError, "arg must be dict"); + while(PyDict_Next(dict, &pos, &d_key, &d_value)){ + if(!PyString_Check(d_key)) + RAISE(PyExc_TypeError, "key must be str"); + + PyGetInt(d_value, val); + + + found = 0; + for (i=0; i < sizeof(gpreg_dict)/sizeof(reg_dict); i++){ + if (strcmp(PyString_AsString(d_key), gpreg_dict[i].name)) + continue; + *((uint32_t*)(((char*)&(self->vmcpu)) + gpreg_dict[i].offset)) = val; + found = 1; + break; + } + + if (found) + continue; + fprintf(stderr, "unkown key: %s\n", PyString_AsString(d_key)); + RAISE(PyExc_ValueError, "unkown reg"); + } + return NULL; +} + +uint8_t const bcd2bin_data[] = { + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, + 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 0, 0, 0, 0, 0, 0, + 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 0, 0, 0, 0, 0, 0, + 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 0, 0, 0, 0, 0, 0, + 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 0, 0, 0, 0, 0, 0, + 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 0, 0, 0, 0, 0, 0, + 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 0, 0, 0, 0, 0, 0, + 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 0, 0, 0, 0, 0, 0, + 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 0, 0, 0, 0, 0, 0, + 90, 91, 92, 93, 94, 95, 96, 97, 98, 99 +}; + +uint8_t const bin2bcd_data[] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, + 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, + 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, + 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, + 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, + 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, + 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, + 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, + 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99 +}; + +inline uint16_t bcdadd_16(uint16_t a, uint16_t b) +{ + int carry = 0; + int i,j = 0; + uint16_t res = 0; + int nib_a, nib_b; + for (i = 0; i < 16; i += 4) { + nib_a = (a >> i) & (0xF); + nib_b = (b >> i) & (0xF); + + j = (carry + nib_a + nib_b); + if (j >= 10) { + carry = 1; + j -= 10; + j &=0xf; + } + else { + carry = 0; + } + res += j << i; + } + return res; +} + +inline uint16_t bcdadd_cf_16(uint16_t a, uint16_t b) +{ + int carry = 0; + int i,j = 0; + int nib_a, nib_b; + for (i = 0; i < 16; i += 4) { + nib_a = (a >> i) & (0xF); + nib_b = (b >> i) & (0xF); + + j = (carry + nib_a + nib_b); + if (j >= 10) { + carry = 1; + j -= 10; + j &=0xf; + } + else { + carry = 0; + } + } + return carry; +} + + +inline uint16_t hex2bcd_16(uint16_t a) +{ + return bcd2bin_data[a & 0xFF] + (bcd2bin_data[(a >> 8) & 0xFF] * 100); +} + +inline uint8_t hex2bcd_8(uint8_t a) +{ + return bcd2bin_data[a & 0xFF]; +} + +inline uint8_t bcd2hex_8(uint8_t a) +{ + return bin2bcd_data[a & 0xFF]; +} + +inline uint16_t bcd2hex_16(uint16_t a) +{ + return bcd2bin_data[a % 100] | (bcd2bin_data[(a / 100)] << 8); +} + + +PyObject* vm_set_gpreg(JitCpu* self, PyObject *args) +{ + PyObject* dict; + if (!PyArg_ParseTuple(args, "O", &dict)) + return NULL; + _vm_set_gpreg(self, dict); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_set_exception(JitCpu* self, PyObject* args) +{ + PyObject *item1; + uint64_t i; + + if (!PyArg_ParseTuple(args, "O", &item1)) + return NULL; + + PyGetInt(item1, i); + + self->vmcpu.exception_flags = i; + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_get_exception(JitCpu* self, PyObject* args) +{ + return PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.exception_flags); +} + + +PyObject * vm_init_regs(JitCpu* self) +{ + memset(&self->vmcpu, 0, sizeof(vm_cpu_t)); + + Py_INCREF(Py_None); + return Py_None; + +} + +void dump_gpregs(vm_cpu_t* vmcpu) +{ + + printf("PC %.4"PRIX32" SP %.4"PRIX32" R3 %.4"PRIX32" ", + vmcpu->PC, vmcpu->SP, vmcpu->R3); + printf("R4 %.4"PRIX32" R5 %.4"PRIX32" R6 %.4"PRIX32" R7 %.4"PRIX32"\n", + vmcpu->R4, vmcpu->R5, vmcpu->R6, vmcpu->R7); + printf("R8 %.4"PRIX32" R9 %.4"PRIX32" R10 %.4"PRIX32" R11 %.4"PRIX32" ", + vmcpu->R8, vmcpu->R9, vmcpu->R10, vmcpu->R11); + printf("R12 %.4"PRIX32" R13 %.4"PRIX32" R14 %.4"PRIX32" R15 %.4"PRIX32"\n", + vmcpu->R12, vmcpu->R13, vmcpu->R14, vmcpu->R15); + printf("zf %.4"PRIX32" nf %.4"PRIX32" of %.4"PRIX32" cf %.4"PRIX32"\n", + vmcpu->zf, vmcpu->nf, vmcpu->of, vmcpu->cf); +} + + +PyObject * vm_dump_gpregs(JitCpu* self, PyObject* args) +{ + vm_cpu_t* vmcpu; + + vmcpu = &self->vmcpu; + dump_gpregs(vmcpu); + Py_INCREF(Py_None); + return Py_None; +} + + + +static void +JitCpu_dealloc(JitCpu* self) +{ + self->ob_type->tp_free((PyObject*)self); +} + + +static PyObject * +JitCpu_new(PyTypeObject *type, PyObject *args, PyObject *kwds) +{ + JitCpu *self; + + self = (JitCpu *)type->tp_alloc(type, 0); + return (PyObject *)self; +} + +static PyObject * +JitCpu_get_cpu(JitCpu *self, void *closure) +{ + return PyLong_FromUnsignedLongLong((uint64_t)&(self->vmcpu)); +} + +static int +JitCpu_set_cpu(JitCpu *self, PyObject *value, void *closure) +{ + PyErr_SetString(PyExc_TypeError, "immutable cpu"); + return -1; +} + +static PyMemberDef JitCpu_members[] = { + {NULL} /* Sentinel */ +}; + +static PyMethodDef JitCpu_methods[] = { + {"vm_init_regs", (PyCFunction)vm_init_regs, METH_NOARGS, + "X"}, + {"vm_dump_gpregs", (PyCFunction)vm_dump_gpregs, METH_NOARGS, + "X"}, + {"vm_get_gpreg", (PyCFunction)vm_get_gpreg, METH_NOARGS, + "X"}, + {"vm_set_gpreg", (PyCFunction)vm_set_gpreg, METH_VARARGS, + "X"}, + {"vm_get_exception", (PyCFunction)vm_get_exception, METH_VARARGS, + "X"}, + {"vm_set_exception", (PyCFunction)vm_set_exception, METH_VARARGS, + "X"}, + {NULL} /* Sentinel */ +}; + +static int +JitCpu_init(JitCpu *self, PyObject *args, PyObject *kwds) +{ + + + fprintf(stderr, "ad cpu: %p\n", &(self->vmcpu)); + + return 0; +} + +getset_reg_u16(PC); +getset_reg_u16(SP); +getset_reg_u16(R3); +getset_reg_u16(R4); +getset_reg_u16(R5); +getset_reg_u16(R6); +getset_reg_u16(R7); +getset_reg_u16(R8); +getset_reg_u16(R9); +getset_reg_u16(R10); +getset_reg_u16(R11); +getset_reg_u16(R12); +getset_reg_u16(R13); +getset_reg_u16(R14); +getset_reg_u16(R15); +getset_reg_u16(zf); +getset_reg_u16(nf); +getset_reg_u16(of); +getset_reg_u16(cf); +getset_reg_u16(cpuoff); +getset_reg_u16(gie); +getset_reg_u16(osc); +getset_reg_u16(scg0); +getset_reg_u16(scg1); +getset_reg_u16(res); + + + + +static PyGetSetDef JitCpu_getseters[] = { + {"cpu", + (getter)JitCpu_get_cpu, (setter)JitCpu_set_cpu, + "first name", + NULL}, + + + {"PC" , (getter)JitCpu_get_PC , (setter)JitCpu_set_PC , "PC" , NULL}, + {"SP" , (getter)JitCpu_get_SP , (setter)JitCpu_set_SP , "SP" , NULL}, + {"R3" , (getter)JitCpu_get_R3 , (setter)JitCpu_set_R3 , "R3" , NULL}, + {"R4" , (getter)JitCpu_get_R4 , (setter)JitCpu_set_R4 , "R4" , NULL}, + {"R5" , (getter)JitCpu_get_R5 , (setter)JitCpu_set_R5 , "R5" , NULL}, + {"R6" , (getter)JitCpu_get_R6 , (setter)JitCpu_set_R6 , "R6" , NULL}, + {"R7" , (getter)JitCpu_get_R7 , (setter)JitCpu_set_R7 , "R7" , NULL}, + {"R8" , (getter)JitCpu_get_R8 , (setter)JitCpu_set_R8 , "R8" , NULL}, + {"R9" , (getter)JitCpu_get_R9 , (setter)JitCpu_set_R9 , "R9" , NULL}, + {"R10" , (getter)JitCpu_get_R10 , (setter)JitCpu_set_R10 , "R10" , NULL}, + {"R11" , (getter)JitCpu_get_R11 , (setter)JitCpu_set_R11 , "R11" , NULL}, + {"R12" , (getter)JitCpu_get_R12 , (setter)JitCpu_set_R12 , "R12" , NULL}, + {"R13" , (getter)JitCpu_get_R13 , (setter)JitCpu_set_R13 , "R13" , NULL}, + {"R14" , (getter)JitCpu_get_R14 , (setter)JitCpu_set_R14 , "R14" , NULL}, + {"R15" , (getter)JitCpu_get_R15 , (setter)JitCpu_set_R15 , "R15" , NULL}, + {"zf" , (getter)JitCpu_get_zf , (setter)JitCpu_set_zf , "zf" , NULL}, + {"nf" , (getter)JitCpu_get_nf , (setter)JitCpu_set_nf , "nf" , NULL}, + {"of" , (getter)JitCpu_get_of , (setter)JitCpu_set_of , "of" , NULL}, + {"cf" , (getter)JitCpu_get_cf , (setter)JitCpu_set_cf , "cf" , NULL}, + {"cpuoff" , (getter)JitCpu_get_cpuoff , (setter)JitCpu_set_cpuoff , "cpuoff" , NULL}, + {"gie" , (getter)JitCpu_get_gie , (setter)JitCpu_set_gie , "gie" , NULL}, + {"osc" , (getter)JitCpu_get_osc , (setter)JitCpu_set_osc , "osc" , NULL}, + {"scg0" , (getter)JitCpu_get_scg0 , (setter)JitCpu_set_scg0 , "scg0" , NULL}, + {"scg1" , (getter)JitCpu_get_scg1 , (setter)JitCpu_set_scg1 , "scg1" , NULL}, + {"res" , (getter)JitCpu_get_res , (setter)JitCpu_set_res , "res" , NULL}, + + {NULL} /* Sentinel */ +}; + + + +static PyTypeObject JitCpuType = { + PyObject_HEAD_INIT(NULL) + 0, /*ob_size*/ + "JitCore_msp430.JitCpu", /*tp_name*/ + sizeof(JitCpu), /*tp_basicsize*/ + 0, /*tp_itemsize*/ + (destructor)JitCpu_dealloc,/*tp_dealloc*/ + 0, /*tp_print*/ + 0, /*tp_getattr*/ + 0, /*tp_setattr*/ + 0, /*tp_compare*/ + 0, /*tp_repr*/ + 0, /*tp_as_number*/ + 0, /*tp_as_sequence*/ + 0, /*tp_as_mapping*/ + 0, /*tp_hash */ + 0, /*tp_call*/ + 0, /*tp_str*/ + 0, /*tp_getattro*/ + 0, /*tp_setattro*/ + 0, /*tp_as_buffer*/ + Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /*tp_flags*/ + "JitCpu objects", /* tp_doc */ + 0, /* tp_traverse */ + 0, /* tp_clear */ + 0, /* tp_richcompare */ + 0, /* tp_weaklistoffset */ + 0, /* tp_iter */ + 0, /* tp_iternext */ + JitCpu_methods, /* tp_methods */ + JitCpu_members, /* tp_members */ + JitCpu_getseters, /* tp_getset */ + 0, /* tp_base */ + 0, /* tp_dict */ + 0, /* tp_descr_get */ + 0, /* tp_descr_set */ + 0, /* tp_dictoffset */ + (initproc)JitCpu_init, /* tp_init */ + 0, /* tp_alloc */ + JitCpu_new, /* tp_new */ +}; + + + +static PyMethodDef JitCore_msp430_Methods[] = { + + /* + + */ + {"get_gpreg_offset_all", (PyCFunction)get_gpreg_offset_all, METH_NOARGS}, + {NULL, NULL, 0, NULL} /* Sentinel */ + +}; + +static PyObject *JitCore_msp430_Error; + +PyMODINIT_FUNC +initJitCore_msp430(void) +{ + PyObject *m; + + if (PyType_Ready(&JitCpuType) < 0) + return; + + m = Py_InitModule("JitCore_msp430", JitCore_msp430_Methods); + if (m == NULL) + return; + + JitCore_msp430_Error = PyErr_NewException("JitCore_msp430.error", NULL, NULL); + Py_INCREF(JitCore_msp430_Error); + PyModule_AddObject(m, "error", JitCore_msp430_Error); + + Py_INCREF(&JitCpuType); + PyModule_AddObject(m, "JitCpu", (PyObject *)&JitCpuType); + +} + diff --git a/miasm2/jitter/arch/JitCore_msp430.h b/miasm2/jitter/arch/JitCore_msp430.h new file mode 100644 index 00000000..c65989b0 --- /dev/null +++ b/miasm2/jitter/arch/JitCore_msp430.h @@ -0,0 +1,171 @@ + +typedef struct { + uint32_t exception_flags; + uint32_t exception_flags_new; + + /* gpregs */ + uint32_t PC; + uint32_t SP; + uint32_t R3; + uint32_t R4; + uint32_t R5; + uint32_t R6; + uint32_t R7; + uint32_t R8; + uint32_t R9; + uint32_t R10; + uint32_t R11; + uint32_t R12; + uint32_t R13; + uint32_t R14; + uint32_t R15; + + uint32_t PC_new; + uint32_t SP_new; + uint32_t SR_new; + uint32_t R3_new; + uint32_t R4_new; + uint32_t R5_new; + uint32_t R6_new; + uint32_t R7_new; + uint32_t R8_new; + uint32_t R9_new; + uint32_t R10_new; + uint32_t R11_new; + uint32_t R12_new; + uint32_t R13_new; + uint32_t R14_new; + uint32_t R15_new; + + /* eflag */ + uint32_t zf; + uint32_t nf; + uint32_t of; + uint32_t cf; + + uint32_t cpuoff; + uint32_t gie; + uint32_t osc; + uint32_t scg0; + uint32_t scg1; + uint32_t res; + + + uint32_t zf_new; + uint32_t nf_new; + uint32_t of_new; + uint32_t cf_new; + + uint32_t cpuoff_new; + uint32_t gie_new; + uint32_t osc_new; + uint32_t scg0_new; + uint32_t scg1_new; + uint32_t res_new; + + + uint8_t pfmem08_0; + uint8_t pfmem08_1; + uint8_t pfmem08_2; + uint8_t pfmem08_3; + uint8_t pfmem08_4; + uint8_t pfmem08_5; + uint8_t pfmem08_6; + uint8_t pfmem08_7; + uint8_t pfmem08_8; + uint8_t pfmem08_9; + uint8_t pfmem08_10; + uint8_t pfmem08_11; + uint8_t pfmem08_12; + uint8_t pfmem08_13; + uint8_t pfmem08_14; + uint8_t pfmem08_15; + uint8_t pfmem08_16; + uint8_t pfmem08_17; + uint8_t pfmem08_18; + uint8_t pfmem08_19; + + + uint16_t pfmem16_0; + uint16_t pfmem16_1; + uint16_t pfmem16_2; + uint16_t pfmem16_3; + uint16_t pfmem16_4; + uint16_t pfmem16_5; + uint16_t pfmem16_6; + uint16_t pfmem16_7; + uint16_t pfmem16_8; + uint16_t pfmem16_9; + uint16_t pfmem16_10; + uint16_t pfmem16_11; + uint16_t pfmem16_12; + uint16_t pfmem16_13; + uint16_t pfmem16_14; + uint16_t pfmem16_15; + uint16_t pfmem16_16; + uint16_t pfmem16_17; + uint16_t pfmem16_18; + uint16_t pfmem16_19; + + + uint32_t pfmem32_0; + uint32_t pfmem32_1; + uint32_t pfmem32_2; + uint32_t pfmem32_3; + uint32_t pfmem32_4; + uint32_t pfmem32_5; + uint32_t pfmem32_6; + uint32_t pfmem32_7; + uint32_t pfmem32_8; + uint32_t pfmem32_9; + uint32_t pfmem32_10; + uint32_t pfmem32_11; + uint32_t pfmem32_12; + uint32_t pfmem32_13; + uint32_t pfmem32_14; + uint32_t pfmem32_15; + uint32_t pfmem32_16; + uint32_t pfmem32_17; + uint32_t pfmem32_18; + uint32_t pfmem32_19; + + + uint64_t pfmem64_0; + uint64_t pfmem64_1; + uint64_t pfmem64_2; + uint64_t pfmem64_3; + uint64_t pfmem64_4; + uint64_t pfmem64_5; + uint64_t pfmem64_6; + uint64_t pfmem64_7; + uint64_t pfmem64_8; + uint64_t pfmem64_9; + uint64_t pfmem64_10; + uint64_t pfmem64_11; + uint64_t pfmem64_12; + uint64_t pfmem64_13; + uint64_t pfmem64_14; + uint64_t pfmem64_15; + uint64_t pfmem64_16; + uint64_t pfmem64_17; + uint64_t pfmem64_18; + uint64_t pfmem64_19; + + + uint32_t segm_base[0x10000]; + +}vm_cpu_t; + +#define RETURN_PC return PyLong_FromUnsignedLongLong(vmcpu->PC); + +uint16_t bcdadd_16(uint16_t a, uint16_t b); + +uint16_t bcdadd_cf_16(uint16_t a, uint16_t b); + +uint16_t hex2bcd_16(uint16_t a); + +uint8_t hex2bcd_8(uint8_t a); + +uint8_t bcd2hex_8(uint8_t a); + +uint16_t bcd2hex_16(uint16_t a); diff --git a/miasm2/jitter/arch/JitCore_x86.c b/miasm2/jitter/arch/JitCore_x86.c new file mode 100644 index 00000000..107491c1 --- /dev/null +++ b/miasm2/jitter/arch/JitCore_x86.c @@ -0,0 +1,873 @@ +#include <Python.h> +#include "JitCore.h" +#include "structmember.h" +#include <stdint.h> +#include <inttypes.h> +#include "../queue.h" +#include "../vm_mngr.h" +#include "JitCore_x86.h" + +#define RAISE(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return p;} +#define RAISE_ret0(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return 0;} + +typedef struct _reg_dict{ + char* name; + size_t offset; +} reg_dict; + + +reg_dict gpreg_dict[] = { {.name = "RAX", .offset = offsetof(vm_cpu_t, RAX)}, + {.name = "RBX", .offset = offsetof(vm_cpu_t, RBX)}, + {.name = "RCX", .offset = offsetof(vm_cpu_t, RCX)}, + {.name = "RDX", .offset = offsetof(vm_cpu_t, RDX)}, + {.name = "RSI", .offset = offsetof(vm_cpu_t, RSI)}, + {.name = "RDI", .offset = offsetof(vm_cpu_t, RDI)}, + {.name = "RSP", .offset = offsetof(vm_cpu_t, RSP)}, + {.name = "RBP", .offset = offsetof(vm_cpu_t, RBP)}, + + {.name = "R8", .offset = offsetof(vm_cpu_t, R8)}, + {.name = "R9", .offset = offsetof(vm_cpu_t, R9)}, + {.name = "R10", .offset = offsetof(vm_cpu_t, R10)}, + {.name = "R11", .offset = offsetof(vm_cpu_t, R11)}, + {.name = "R12", .offset = offsetof(vm_cpu_t, R12)}, + {.name = "R13", .offset = offsetof(vm_cpu_t, R13)}, + {.name = "R14", .offset = offsetof(vm_cpu_t, R14)}, + {.name = "R15", .offset = offsetof(vm_cpu_t, R15)}, + + {.name = "RIP", .offset = offsetof(vm_cpu_t, RIP)}, + + {.name = "zf", .offset = offsetof(vm_cpu_t, zf)}, + {.name = "nf", .offset = offsetof(vm_cpu_t, nf)}, + {.name = "pf", .offset = offsetof(vm_cpu_t, pf)}, + {.name = "of", .offset = offsetof(vm_cpu_t, of)}, + {.name = "cf", .offset = offsetof(vm_cpu_t, cf)}, + {.name = "af", .offset = offsetof(vm_cpu_t, af)}, + {.name = "df", .offset = offsetof(vm_cpu_t, df)}, + + {.name = "ES", .offset = offsetof(vm_cpu_t, ES)}, + {.name = "CS", .offset = offsetof(vm_cpu_t, CS)}, + {.name = "SS", .offset = offsetof(vm_cpu_t, SS)}, + {.name = "DS", .offset = offsetof(vm_cpu_t, DS)}, + {.name = "FS", .offset = offsetof(vm_cpu_t, FS)}, + {.name = "GS", .offset = offsetof(vm_cpu_t, GS)}, + +}; + + + +/************************** JitCpu object **************************/ + +typedef struct { + PyObject_HEAD + PyObject *cpu; /* cpu */ + vm_cpu_t vmcpu; +} JitCpu; + + + +#define get_reg(reg) do { \ + o = PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.reg); \ + PyDict_SetItemString(dict, #reg, o); \ + Py_DECREF(o); \ + } while(0); + + +PyObject* vm_get_gpreg(JitCpu* self) +{ + PyObject *dict = PyDict_New(); + PyObject *o; + + get_reg(RAX); + get_reg(RBX); + get_reg(RCX); + get_reg(RDX); + get_reg(RSI); + get_reg(RDI); + get_reg(RSP); + get_reg(RBP); + + get_reg(R8); + get_reg(R9); + get_reg(R10); + get_reg(R11); + get_reg(R12); + get_reg(R13); + get_reg(R14); + get_reg(R15); + + get_reg(RIP); + + get_reg(zf); + get_reg(nf); + get_reg(pf); + get_reg(of); + get_reg(cf); + get_reg(af); + get_reg(df); + + + get_reg(ES); + get_reg(CS); + get_reg(SS); + get_reg(DS); + get_reg(FS); + get_reg(GS); + + return dict; +} + + + + +PyObject* _vm_set_gpreg(JitCpu* self, PyObject *dict) +{ + PyObject *d_key, *d_value = NULL; + Py_ssize_t pos = 0; + uint64_t val; + unsigned int i, found; + + if(!PyDict_Check(dict)) + RAISE(PyExc_TypeError, "arg must be dict"); + while(PyDict_Next(dict, &pos, &d_key, &d_value)){ + if(!PyString_Check(d_key)) + RAISE(PyExc_TypeError, "key must be str"); + + PyGetInt(d_value, val); + + found = 0; + for (i=0; i < sizeof(gpreg_dict)/sizeof(reg_dict); i++){ + if (strcmp(PyString_AsString(d_key), gpreg_dict[i].name)) + continue; + *((uint64_t*)(((char*)&(self->vmcpu)) + gpreg_dict[i].offset)) = val; + found = 1; + break; + } + + if (found) + continue; + fprintf(stderr, "unkown key: %s\n", PyString_AsString(d_key)); + RAISE(PyExc_ValueError, "unkown reg"); + } + return NULL; +} + +PyObject* vm_set_gpreg(JitCpu* self, PyObject *args) +{ + PyObject* dict; + if (!PyArg_ParseTuple(args, "O", &dict)) + return NULL; + _vm_set_gpreg(self, dict); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject * vm_init_regs(JitCpu* self) +{ + memset(&self->vmcpu, 0, sizeof(vm_cpu_t)); + + self->vmcpu.tsc1 = 0x22222222; + self->vmcpu.tsc2 = 0x11111111; + self->vmcpu.i_f = 1; + + Py_INCREF(Py_None); + return Py_None; + +} + +void dump_gpregs(vm_cpu_t* vmcpu) +{ + + printf("RAX %.16"PRIX64" RBX %.16"PRIX64" RCX %.16"PRIX64" RDX %.16"PRIX64"\n", + vmcpu->RAX, vmcpu->RBX, vmcpu->RCX, vmcpu->RDX); + printf("RSI %.16"PRIX64" RDI %.16"PRIX64" RSP %.16"PRIX64" RBP %.16"PRIX64"\n", + vmcpu->RSI, vmcpu->RDI, vmcpu->RSP, vmcpu->RBP); + printf("zf %.16"PRIX64" nf %.16"PRIX64" of %.16"PRIX64" cf %.16"PRIX64"\n", + vmcpu->zf, vmcpu->nf, vmcpu->of, vmcpu->cf); + printf("RIP %.16"PRIX64"\n", + vmcpu->RIP); + +} + +PyObject * vm_dump_gpregs(JitCpu* self, PyObject* args) +{ + vm_cpu_t* vmcpu; + + vmcpu = &self->vmcpu; + dump_gpregs(vmcpu); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_set_segm_base(JitCpu* self, PyObject* args) +{ + PyObject *item1, *item2; + uint64_t segm_num, segm_base; + + if (!PyArg_ParseTuple(args, "OO", &item1, &item2)) + return NULL; + + PyGetInt(item1, segm_num); + PyGetInt(item2, segm_base); + self->vmcpu.segm_base[segm_num] = segm_base; + + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_get_segm_base(JitCpu* self, PyObject* args) +{ + PyObject *item1; + uint64_t segm_num; + PyObject* v; + + if (!PyArg_ParseTuple(args, "O", &item1)) + return NULL; + PyGetInt(item1, segm_num); + v = PyInt_FromLong((long)self->vmcpu.segm_base[segm_num]); + return v; +} + +uint64_t segm2addr(vm_cpu_t* vmcpu, uint64_t segm, uint64_t addr) +{ + return addr + vmcpu->segm_base[segm]; +} + + +PyObject* vm_set_exception(JitCpu* self, PyObject* args) +{ + PyObject *item1; + uint64_t i; + + if (!PyArg_ParseTuple(args, "O", &item1)) + return NULL; + + PyGetInt(item1, i); + + self->vmcpu.exception_flags = i; + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_get_exception(JitCpu* self, PyObject* args) +{ + return PyLong_FromUnsignedLongLong((uint64_t)self->vmcpu.exception_flags); +} + + + +#define UDIV(sizeA, sizeB) \ + uint ## sizeA ## _t udiv ## sizeB (vm_cpu_t* vmcpu, uint ## sizeB ## _t a, uint ## sizeB ## _t b) \ + { \ + uint ## sizeA ## _t r; \ + if (b == 0) { \ + vmcpu->exception_flags |= EXCEPT_INT_DIV_BY_ZERO; \ + return 0; \ + } \ + r = a/b; \ + return r; \ + } + + +#define UMOD(sizeA, sizeB) \ + uint ## sizeA ## _t umod ## sizeB (vm_cpu_t* vmcpu, uint ## sizeB ## _t a, uint ## sizeB ## _t b) \ + { \ + uint ## sizeA ## _t r; \ + if (b == 0) { \ + vmcpu->exception_flags |= EXCEPT_INT_DIV_BY_ZERO; \ + return 0; \ + } \ + r = a%b; \ + return r; \ + } + + +#define IDIV(sizeA) \ + int ## sizeA ## _t idiv ## sizeA (vm_cpu_t* vmcpu, int ## sizeA ## _t a, int ## sizeA ## _t b) \ + { \ + int ## sizeA ## _t r; \ + if (b == 0) { \ + vmcpu->exception_flags |= EXCEPT_INT_DIV_BY_ZERO; \ + return 0; \ + } \ + r = a/b; \ + return r; \ + } + + +#define IMOD(sizeA) \ + int ## sizeA ## _t imod ## sizeA (vm_cpu_t* vmcpu, int ## sizeA ## _t a, int ## sizeA ## _t b) \ + { \ + int ## sizeA ## _t r; \ + if (b == 0) { \ + vmcpu->exception_flags |= EXCEPT_INT_DIV_BY_ZERO; \ + return 0; \ + } \ + r = a%b; \ + return r; \ + } + +UDIV(8, 16) +UDIV(16, 32) +UDIV(32, 64) + +UMOD(8, 16) +UMOD(16, 32) +UMOD(32, 64) + + +IDIV(16) +IDIV(32) +IDIV(64) + +IMOD(16) +IMOD(32) +IMOD(64) + + + + +static void +JitCpu_dealloc(JitCpu* self) +{ + self->ob_type->tp_free((PyObject*)self); +} + + +static PyObject * +JitCpu_new(PyTypeObject *type, PyObject *args, PyObject *kwds) +{ + JitCpu *self; + + self = (JitCpu *)type->tp_alloc(type, 0); + return (PyObject *)self; +} + +static PyObject * +JitCpu_get_cpu(JitCpu *self, void *closure) +{ + return PyLong_FromUnsignedLongLong((uint64_t)&(self->vmcpu)); +} + +static int +JitCpu_set_cpu(JitCpu *self, PyObject *value, void *closure) +{ + PyErr_SetString(PyExc_TypeError, "immutable cpu"); + return -1; +} + +static PyMemberDef JitCpu_members[] = { + {NULL} /* Sentinel */ +}; + +static PyMethodDef JitCpu_methods[] = { + {"vm_init_regs", (PyCFunction)vm_init_regs, METH_NOARGS, + "X"}, + {"vm_dump_gpregs", (PyCFunction)vm_dump_gpregs, METH_NOARGS, + "X"}, + {"vm_get_gpreg", (PyCFunction)vm_get_gpreg, METH_NOARGS, + "X"}, + {"vm_set_gpreg", (PyCFunction)vm_set_gpreg, METH_VARARGS, + "X"}, + {"vm_get_segm_base", (PyCFunction)vm_get_segm_base, METH_VARARGS, + "X"}, + {"vm_set_segm_base", (PyCFunction)vm_set_segm_base, METH_VARARGS, + "X"}, + {"vm_get_exception", (PyCFunction)vm_get_exception, METH_VARARGS, + "X"}, + {"vm_set_exception", (PyCFunction)vm_set_exception, METH_VARARGS, + "X"}, + {NULL} /* Sentinel */ +}; + +static int +JitCpu_init(JitCpu *self, PyObject *args, PyObject *kwds) +{ + + + fprintf(stderr, "ad cpu: %p\n", &(self->vmcpu)); + + return 0; +} +/* +static PyObject *JitCpu_get_RAX(JitCpu *self, void *closure) +{ + return PyLong_FromUnsignedLongLong((uint64_t)(self->vmcpu.RAX)); +} + +static int JitCpu_set_RAX(JitCpu *self, PyObject *value, void *closure) +{ + uint64_t val; + PyGetInt_ret0(value, val); + self->vmcpu.RAX = val; + return 0; +} +*/ + + +#define getset_reg_E_u32(regname) \ + static PyObject *JitCpu_get_E ## regname (JitCpu *self, void *closure) \ + { \ + return PyLong_FromUnsignedLongLong((uint32_t)(self->vmcpu.R ## regname & 0xFFFFFFFF )); \ + } \ + static int JitCpu_set_E ## regname (JitCpu *self, PyObject *value, void *closure) \ + { \ + uint64_t val; \ + PyGetInt_ret0(value, val); \ + val &= 0xFFFFFFFF; \ + val |= self->vmcpu.R ##regname & 0xFFFFFFFF00000000ULL; \ + self->vmcpu.R ## regname = val; \ + return 0; \ + } + + + +#define getset_reg_R_u16(regname) \ + static PyObject *JitCpu_get_ ## regname (JitCpu *self, void *closure) \ + { \ + return PyLong_FromUnsignedLongLong((uint16_t)(self->vmcpu.R ## regname & 0xFFFF )); \ + } \ + static int JitCpu_set_ ## regname (JitCpu *self, PyObject *value, void *closure) \ + { \ + uint64_t val; \ + PyGetInt_ret0(value, val); \ + val &= 0xFFFF; \ + val |= self->vmcpu.R ##regname & 0xFFFFFFFFFFFF0000ULL; \ + self->vmcpu.R ## regname = val; \ + return 0; \ + } + + +getset_reg_u64(RAX); +getset_reg_u64(RBX); +getset_reg_u64(RCX); +getset_reg_u64(RDX); +getset_reg_u64(RSI); +getset_reg_u64(RDI); +getset_reg_u64(RSP); +getset_reg_u64(RBP); + +getset_reg_u64(R8); +getset_reg_u64(R9); +getset_reg_u64(R10); +getset_reg_u64(R11); +getset_reg_u64(R12); +getset_reg_u64(R13); +getset_reg_u64(R14); +getset_reg_u64(R15); + +getset_reg_u64(RIP); + +getset_reg_u64(zf); +getset_reg_u64(nf); +getset_reg_u64(pf); +getset_reg_u64(of); +getset_reg_u64(cf); +getset_reg_u64(af); +getset_reg_u64(df); + + +getset_reg_u64(ES); +getset_reg_u64(CS); +getset_reg_u64(SS); +getset_reg_u64(DS); +getset_reg_u64(FS); +getset_reg_u64(GS); + + +getset_reg_E_u32(AX); +getset_reg_E_u32(BX); +getset_reg_E_u32(CX); +getset_reg_E_u32(DX); +getset_reg_E_u32(SI); +getset_reg_E_u32(DI); +getset_reg_E_u32(SP); +getset_reg_E_u32(BP); +getset_reg_E_u32(IP); + +getset_reg_R_u16(AX); +getset_reg_R_u16(BX); +getset_reg_R_u16(CX); +getset_reg_R_u16(DX); +getset_reg_R_u16(SI); +getset_reg_R_u16(DI); +getset_reg_R_u16(SP); +getset_reg_R_u16(BP); + +#define get_reg_off(reg) do { \ + o = PyLong_FromUnsignedLongLong((uint64_t)offsetof(vm_cpu_t, reg)); \ + PyDict_SetItemString(dict, #reg, o); \ + Py_DECREF(o); \ + } while(0); + + +PyObject* get_gpreg_offset_all(void) +{ + PyObject *dict = PyDict_New(); + PyObject *o; + + get_reg_off(exception_flags); + get_reg_off(exception_flags_new); + + get_reg_off(RAX); + get_reg_off(RBX); + get_reg_off(RCX); + get_reg_off(RDX); + get_reg_off(RSI); + get_reg_off(RDI); + get_reg_off(RSP); + get_reg_off(RBP); + get_reg_off(R8); + get_reg_off(R9); + get_reg_off(R10); + get_reg_off(R11); + get_reg_off(R12); + get_reg_off(R13); + get_reg_off(R14); + get_reg_off(R15); + get_reg_off(RIP); + get_reg_off(RAX_new); + get_reg_off(RBX_new); + get_reg_off(RCX_new); + get_reg_off(RDX_new); + get_reg_off(RSI_new); + get_reg_off(RDI_new); + get_reg_off(RSP_new); + get_reg_off(RBP_new); + get_reg_off(R8_new); + get_reg_off(R9_new); + get_reg_off(R10_new); + get_reg_off(R11_new); + get_reg_off(R12_new); + get_reg_off(R13_new); + get_reg_off(R14_new); + get_reg_off(R15_new); + get_reg_off(RIP_new); + get_reg_off(zf); + get_reg_off(nf); + get_reg_off(pf); + get_reg_off(of); + get_reg_off(cf); + get_reg_off(af); + get_reg_off(df); + get_reg_off(zf_new); + get_reg_off(nf_new); + get_reg_off(pf_new); + get_reg_off(of_new); + get_reg_off(cf_new); + get_reg_off(af_new); + get_reg_off(df_new); + get_reg_off(tf); + get_reg_off(i_f); + get_reg_off(iopl_f); + get_reg_off(nt); + get_reg_off(rf); + get_reg_off(vm); + get_reg_off(ac); + get_reg_off(vif); + get_reg_off(vip); + get_reg_off(i_d); + get_reg_off(tf_new); + get_reg_off(i_f_new); + get_reg_off(iopl_f_new); + get_reg_off(nt_new); + get_reg_off(rf_new); + get_reg_off(vm_new); + get_reg_off(ac_new); + get_reg_off(vif_new); + get_reg_off(vip_new); + get_reg_off(i_d_new); + get_reg_off(my_tick); + get_reg_off(cond); + + get_reg_off(float_st0); + get_reg_off(float_st1); + get_reg_off(float_st2); + get_reg_off(float_st3); + get_reg_off(float_st4); + get_reg_off(float_st5); + get_reg_off(float_st6); + get_reg_off(float_st7); + get_reg_off(float_st0_new); + get_reg_off(float_st1_new); + get_reg_off(float_st2_new); + get_reg_off(float_st3_new); + get_reg_off(float_st4_new); + get_reg_off(float_st5_new); + get_reg_off(float_st6_new); + get_reg_off(float_st7_new); + + get_reg_off(ES); + get_reg_off(CS); + get_reg_off(SS); + get_reg_off(DS); + get_reg_off(FS); + get_reg_off(GS); + get_reg_off(ES_new); + get_reg_off(CS_new); + get_reg_off(SS_new); + get_reg_off(DS_new); + get_reg_off(FS_new); + get_reg_off(GS_new); + + get_reg_off(pfmem08_0); + get_reg_off(pfmem08_1); + get_reg_off(pfmem08_2); + get_reg_off(pfmem08_3); + get_reg_off(pfmem08_4); + get_reg_off(pfmem08_5); + get_reg_off(pfmem08_6); + get_reg_off(pfmem08_7); + get_reg_off(pfmem08_8); + get_reg_off(pfmem08_9); + get_reg_off(pfmem08_10); + get_reg_off(pfmem08_11); + get_reg_off(pfmem08_12); + get_reg_off(pfmem08_13); + get_reg_off(pfmem08_14); + get_reg_off(pfmem08_15); + get_reg_off(pfmem08_16); + get_reg_off(pfmem08_17); + get_reg_off(pfmem08_18); + get_reg_off(pfmem08_19); + get_reg_off(pfmem16_0); + get_reg_off(pfmem16_1); + get_reg_off(pfmem16_2); + get_reg_off(pfmem16_3); + get_reg_off(pfmem16_4); + get_reg_off(pfmem16_5); + get_reg_off(pfmem16_6); + get_reg_off(pfmem16_7); + get_reg_off(pfmem16_8); + get_reg_off(pfmem16_9); + get_reg_off(pfmem16_10); + get_reg_off(pfmem16_11); + get_reg_off(pfmem16_12); + get_reg_off(pfmem16_13); + get_reg_off(pfmem16_14); + get_reg_off(pfmem16_15); + get_reg_off(pfmem16_16); + get_reg_off(pfmem16_17); + get_reg_off(pfmem16_18); + get_reg_off(pfmem16_19); + get_reg_off(pfmem32_0); + get_reg_off(pfmem32_1); + get_reg_off(pfmem32_2); + get_reg_off(pfmem32_3); + get_reg_off(pfmem32_4); + get_reg_off(pfmem32_5); + get_reg_off(pfmem32_6); + get_reg_off(pfmem32_7); + get_reg_off(pfmem32_8); + get_reg_off(pfmem32_9); + get_reg_off(pfmem32_10); + get_reg_off(pfmem32_11); + get_reg_off(pfmem32_12); + get_reg_off(pfmem32_13); + get_reg_off(pfmem32_14); + get_reg_off(pfmem32_15); + get_reg_off(pfmem32_16); + get_reg_off(pfmem32_17); + get_reg_off(pfmem32_18); + get_reg_off(pfmem32_19); + get_reg_off(pfmem64_0); + get_reg_off(pfmem64_1); + get_reg_off(pfmem64_2); + get_reg_off(pfmem64_3); + get_reg_off(pfmem64_4); + get_reg_off(pfmem64_5); + get_reg_off(pfmem64_6); + get_reg_off(pfmem64_7); + get_reg_off(pfmem64_8); + get_reg_off(pfmem64_9); + get_reg_off(pfmem64_10); + get_reg_off(pfmem64_11); + get_reg_off(pfmem64_12); + get_reg_off(pfmem64_13); + get_reg_off(pfmem64_14); + get_reg_off(pfmem64_15); + get_reg_off(pfmem64_16); + get_reg_off(pfmem64_17); + get_reg_off(pfmem64_18); + get_reg_off(pfmem64_19); + + get_reg_off(MM0); + get_reg_off(MM1); + get_reg_off(MM2); + get_reg_off(MM3); + get_reg_off(MM4); + get_reg_off(MM5); + get_reg_off(MM6); + get_reg_off(MM7); + get_reg_off(MM0_new); + get_reg_off(MM1_new); + get_reg_off(MM2_new); + get_reg_off(MM3_new); + get_reg_off(MM4_new); + get_reg_off(MM5_new); + get_reg_off(MM6_new); + get_reg_off(MM7_new); + return dict; +} + + +static PyGetSetDef JitCpu_getseters[] = { + {"cpu", + (getter)JitCpu_get_cpu, (setter)JitCpu_set_cpu, + "first name", + NULL}, + + {"RAX", (getter)JitCpu_get_RAX, (setter)JitCpu_set_RAX, "RAX", NULL}, + {"RBX", (getter)JitCpu_get_RBX, (setter)JitCpu_set_RBX, "RBX", NULL}, + {"RCX", (getter)JitCpu_get_RCX, (setter)JitCpu_set_RCX, "RCX", NULL}, + {"RDX", (getter)JitCpu_get_RDX, (setter)JitCpu_set_RDX, "RDX", NULL}, + {"RSI", (getter)JitCpu_get_RSI, (setter)JitCpu_set_RSI, "RSI", NULL}, + {"RDI", (getter)JitCpu_get_RDI, (setter)JitCpu_set_RDI, "RDI", NULL}, + {"RSP", (getter)JitCpu_get_RSP, (setter)JitCpu_set_RSP, "RSP", NULL}, + {"RBP", (getter)JitCpu_get_RBP, (setter)JitCpu_set_RBP, "RBP", NULL}, + {"R8", (getter)JitCpu_get_R8, (setter)JitCpu_set_R8, "R8", NULL}, + {"R9", (getter)JitCpu_get_R9, (setter)JitCpu_set_R9, "R9", NULL}, + {"R10", (getter)JitCpu_get_R10, (setter)JitCpu_set_R10, "R10", NULL}, + {"R11", (getter)JitCpu_get_R11, (setter)JitCpu_set_R11, "R11", NULL}, + {"R12", (getter)JitCpu_get_R12, (setter)JitCpu_set_R12, "R12", NULL}, + {"R13", (getter)JitCpu_get_R13, (setter)JitCpu_set_R13, "R13", NULL}, + {"R14", (getter)JitCpu_get_R14, (setter)JitCpu_set_R14, "R14", NULL}, + {"R15", (getter)JitCpu_get_R15, (setter)JitCpu_set_R15, "R15", NULL}, + {"RIP", (getter)JitCpu_get_RIP, (setter)JitCpu_set_RIP, "RIP", NULL}, + {"zf", (getter)JitCpu_get_zf, (setter)JitCpu_set_zf, "zf", NULL}, + {"nf", (getter)JitCpu_get_nf, (setter)JitCpu_set_nf, "nf", NULL}, + {"pf", (getter)JitCpu_get_pf, (setter)JitCpu_set_pf, "pf", NULL}, + {"of", (getter)JitCpu_get_of, (setter)JitCpu_set_of, "of", NULL}, + {"cf", (getter)JitCpu_get_cf, (setter)JitCpu_set_cf, "cf", NULL}, + {"af", (getter)JitCpu_get_af, (setter)JitCpu_set_af, "af", NULL}, + {"df", (getter)JitCpu_get_df, (setter)JitCpu_set_df, "df", NULL}, + {"ES", (getter)JitCpu_get_ES, (setter)JitCpu_set_ES, "ES", NULL}, + {"CS", (getter)JitCpu_get_CS, (setter)JitCpu_set_CS, "CS", NULL}, + {"SS", (getter)JitCpu_get_SS, (setter)JitCpu_set_SS, "SS", NULL}, + {"DS", (getter)JitCpu_get_DS, (setter)JitCpu_set_DS, "DS", NULL}, + {"FS", (getter)JitCpu_get_FS, (setter)JitCpu_set_FS, "FS", NULL}, + {"GS", (getter)JitCpu_get_GS, (setter)JitCpu_set_GS, "GS", NULL}, + + {"EAX", (getter)JitCpu_get_EAX, (setter)JitCpu_set_EAX, "EAX", NULL}, + {"EBX", (getter)JitCpu_get_EBX, (setter)JitCpu_set_EBX, "EBX", NULL}, + {"ECX", (getter)JitCpu_get_ECX, (setter)JitCpu_set_ECX, "ECX", NULL}, + {"EDX", (getter)JitCpu_get_EDX, (setter)JitCpu_set_EDX, "EDX", NULL}, + {"ESI", (getter)JitCpu_get_ESI, (setter)JitCpu_set_ESI, "ESI", NULL}, + {"EDI", (getter)JitCpu_get_EDI, (setter)JitCpu_set_EDI, "EDI", NULL}, + {"ESP", (getter)JitCpu_get_ESP, (setter)JitCpu_set_ESP, "ESP", NULL}, + {"EBP", (getter)JitCpu_get_EBP, (setter)JitCpu_set_EBP, "EBP", NULL}, + {"EIP", (getter)JitCpu_get_EIP, (setter)JitCpu_set_EIP, "EIP", NULL}, + + {"AX", (getter)JitCpu_get_AX, (setter)JitCpu_set_AX, "AX", NULL}, + {"BX", (getter)JitCpu_get_BX, (setter)JitCpu_set_BX, "BX", NULL}, + {"CX", (getter)JitCpu_get_CX, (setter)JitCpu_set_CX, "CX", NULL}, + {"DX", (getter)JitCpu_get_DX, (setter)JitCpu_set_DX, "DX", NULL}, + {"SI", (getter)JitCpu_get_SI, (setter)JitCpu_set_SI, "SI", NULL}, + {"DI", (getter)JitCpu_get_DI, (setter)JitCpu_set_DI, "DI", NULL}, + {"SP", (getter)JitCpu_get_SP, (setter)JitCpu_set_SP, "SP", NULL}, + {"BP", (getter)JitCpu_get_BP, (setter)JitCpu_set_BP, "BP", NULL}, + + + {NULL} /* Sentinel */ +}; + + +static PyTypeObject JitCpuType = { + PyObject_HEAD_INIT(NULL) + 0, /*ob_size*/ + "JitCore_x86.JitCpu", /*tp_name*/ + sizeof(JitCpu), /*tp_basicsize*/ + 0, /*tp_itemsize*/ + (destructor)JitCpu_dealloc,/*tp_dealloc*/ + 0, /*tp_print*/ + 0, /*tp_getattr*/ + 0, /*tp_setattr*/ + 0, /*tp_compare*/ + 0, /*tp_repr*/ + 0, /*tp_as_number*/ + 0, /*tp_as_sequence*/ + 0, /*tp_as_mapping*/ + 0, /*tp_hash */ + 0, /*tp_call*/ + 0, /*tp_str*/ + 0, /*tp_getattro*/ + 0, /*tp_setattro*/ + 0, /*tp_as_buffer*/ + Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /*tp_flags*/ + "JitCpu objects", /* tp_doc */ + 0, /* tp_traverse */ + 0, /* tp_clear */ + 0, /* tp_richcompare */ + 0, /* tp_weaklistoffset */ + 0, /* tp_iter */ + 0, /* tp_iternext */ + JitCpu_methods, /* tp_methods */ + JitCpu_members, /* tp_members */ + JitCpu_getseters, /* tp_getset */ + 0, /* tp_base */ + 0, /* tp_dict */ + 0, /* tp_descr_get */ + 0, /* tp_descr_set */ + 0, /* tp_dictoffset */ + (initproc)JitCpu_init, /* tp_init */ + 0, /* tp_alloc */ + JitCpu_new, /* tp_new */ +}; + + + +static PyMethodDef JitCore_x86_Methods[] = { + + /* + + */ + {"get_gpreg_offset_all", (PyCFunction)get_gpreg_offset_all, METH_NOARGS}, + {NULL, NULL, 0, NULL} /* Sentinel */ + +}; + +static PyObject *JitCore_x86_Error; + +PyMODINIT_FUNC +initJitCore_x86(void) +{ + PyObject *m; + + if (PyType_Ready(&JitCpuType) < 0) + return; + + m = Py_InitModule("JitCore_x86", JitCore_x86_Methods); + if (m == NULL) + return; + + JitCore_x86_Error = PyErr_NewException("JitCore_x86.error", NULL, NULL); + Py_INCREF(JitCore_x86_Error); + PyModule_AddObject(m, "error", JitCore_x86_Error); + + Py_INCREF(&JitCpuType); + PyModule_AddObject(m, "JitCpu", (PyObject *)&JitCpuType); + +} + + + + + + + + + + + + + + + + + + + + + + diff --git a/miasm2/jitter/arch/JitCore_x86.h b/miasm2/jitter/arch/JitCore_x86.h new file mode 100644 index 00000000..7d4379a8 --- /dev/null +++ b/miasm2/jitter/arch/JitCore_x86.h @@ -0,0 +1,293 @@ + +typedef struct { + uint32_t exception_flags; + uint32_t exception_flags_new; + + + /* gpregs */ + uint64_t RAX; + uint64_t RBX; + uint64_t RCX; + uint64_t RDX; + uint64_t RSI; + uint64_t RDI; + uint64_t RSP; + uint64_t RBP; + uint64_t R8; + uint64_t R9; + uint64_t R10; + uint64_t R11; + uint64_t R12; + uint64_t R13; + uint64_t R14; + uint64_t R15; + + uint64_t RIP; + + uint64_t RAX_new; + uint64_t RBX_new; + uint64_t RCX_new; + uint64_t RDX_new; + uint64_t RSI_new; + uint64_t RDI_new; + uint64_t RSP_new; + uint64_t RBP_new; + uint64_t R8_new; + uint64_t R9_new; + uint64_t R10_new; + uint64_t R11_new; + uint64_t R12_new; + uint64_t R13_new; + uint64_t R14_new; + uint64_t R15_new; + + uint64_t RIP_new; + + /* eflag */ + uint64_t zf; + uint64_t nf; + uint64_t pf; + uint64_t of; + uint64_t cf; + uint64_t af; + uint64_t df; + + uint64_t zf_new; + uint64_t nf_new; + uint64_t pf_new; + uint64_t of_new; + uint64_t cf_new; + uint64_t af_new; + uint64_t df_new; + + uint64_t tf; + uint64_t i_f; + uint64_t iopl_f; + uint64_t nt; + uint64_t rf; + uint64_t vm; + uint64_t ac; + uint64_t vif; + uint64_t vip; + uint64_t i_d; + + uint64_t tf_new; + uint64_t i_f_new; + uint64_t iopl_f_new; + uint64_t nt_new; + uint64_t rf_new; + uint64_t vm_new; + uint64_t ac_new; + uint64_t vif_new; + uint64_t vip_new; + uint64_t i_d_new; + + uint64_t my_tick; + + uint64_t cond; + + double float_st0; + double float_st1; + double float_st2; + double float_st3; + double float_st4; + double float_st5; + double float_st6; + double float_st7; + + double float_st0_new; + double float_st1_new; + double float_st2_new; + double float_st3_new; + double float_st4_new; + double float_st5_new; + double float_st6_new; + double float_st7_new; + + unsigned int float_c0; + unsigned int float_c1; + unsigned int float_c2; + unsigned int float_c3; + + unsigned int float_c0_new; + unsigned int float_c1_new; + unsigned int float_c2_new; + unsigned int float_c3_new; + + unsigned int float_stack_ptr; + unsigned int float_stack_ptr_new; + + unsigned int reg_float_control; + unsigned int reg_float_control_new; + + unsigned int reg_float_eip; + unsigned int reg_float_eip_new; + unsigned int reg_float_cs; + unsigned int reg_float_cs_new; + unsigned int reg_float_address; + unsigned int reg_float_address_new; + unsigned int reg_float_ds; + unsigned int reg_float_ds_new; + + + unsigned int tsc1; + unsigned int tsc2; + + unsigned int tsc1_new; + unsigned int tsc2_new; + + + uint64_t ES; + uint64_t CS; + uint64_t SS; + uint64_t DS; + uint64_t FS; + uint64_t GS; + + uint64_t ES_new; + uint64_t CS_new; + uint64_t SS_new; + uint64_t DS_new; + uint64_t FS_new; + uint64_t GS_new; + + unsigned int cr0; + unsigned int cr0_new; + + unsigned int cr3; + unsigned int cr3_new; + + + + uint8_t pfmem08_0; + uint8_t pfmem08_1; + uint8_t pfmem08_2; + uint8_t pfmem08_3; + uint8_t pfmem08_4; + uint8_t pfmem08_5; + uint8_t pfmem08_6; + uint8_t pfmem08_7; + uint8_t pfmem08_8; + uint8_t pfmem08_9; + uint8_t pfmem08_10; + uint8_t pfmem08_11; + uint8_t pfmem08_12; + uint8_t pfmem08_13; + uint8_t pfmem08_14; + uint8_t pfmem08_15; + uint8_t pfmem08_16; + uint8_t pfmem08_17; + uint8_t pfmem08_18; + uint8_t pfmem08_19; + + + uint16_t pfmem16_0; + uint16_t pfmem16_1; + uint16_t pfmem16_2; + uint16_t pfmem16_3; + uint16_t pfmem16_4; + uint16_t pfmem16_5; + uint16_t pfmem16_6; + uint16_t pfmem16_7; + uint16_t pfmem16_8; + uint16_t pfmem16_9; + uint16_t pfmem16_10; + uint16_t pfmem16_11; + uint16_t pfmem16_12; + uint16_t pfmem16_13; + uint16_t pfmem16_14; + uint16_t pfmem16_15; + uint16_t pfmem16_16; + uint16_t pfmem16_17; + uint16_t pfmem16_18; + uint16_t pfmem16_19; + + + uint32_t pfmem32_0; + uint32_t pfmem32_1; + uint32_t pfmem32_2; + uint32_t pfmem32_3; + uint32_t pfmem32_4; + uint32_t pfmem32_5; + uint32_t pfmem32_6; + uint32_t pfmem32_7; + uint32_t pfmem32_8; + uint32_t pfmem32_9; + uint32_t pfmem32_10; + uint32_t pfmem32_11; + uint32_t pfmem32_12; + uint32_t pfmem32_13; + uint32_t pfmem32_14; + uint32_t pfmem32_15; + uint32_t pfmem32_16; + uint32_t pfmem32_17; + uint32_t pfmem32_18; + uint32_t pfmem32_19; + + + uint64_t pfmem64_0; + uint64_t pfmem64_1; + uint64_t pfmem64_2; + uint64_t pfmem64_3; + uint64_t pfmem64_4; + uint64_t pfmem64_5; + uint64_t pfmem64_6; + uint64_t pfmem64_7; + uint64_t pfmem64_8; + uint64_t pfmem64_9; + uint64_t pfmem64_10; + uint64_t pfmem64_11; + uint64_t pfmem64_12; + uint64_t pfmem64_13; + uint64_t pfmem64_14; + uint64_t pfmem64_15; + uint64_t pfmem64_16; + uint64_t pfmem64_17; + uint64_t pfmem64_18; + uint64_t pfmem64_19; + + + uint64_t MM0; + uint64_t MM1; + uint64_t MM2; + uint64_t MM3; + uint64_t MM4; + uint64_t MM5; + uint64_t MM6; + uint64_t MM7; + + uint64_t MM0_new; + uint64_t MM1_new; + uint64_t MM2_new; + uint64_t MM3_new; + uint64_t MM4_new; + uint64_t MM5_new; + uint64_t MM6_new; + uint64_t MM7_new; + + uint32_t segm_base[0x10000]; + +}vm_cpu_t; + + + +void dump_gpregs(vm_cpu_t* vmcpu); +uint64_t segm2addr(vm_cpu_t* vmcpu, uint64_t segm, uint64_t addr); + + +uint32_t udiv64(vm_cpu_t* vmcpu, uint64_t a, uint64_t b); +uint32_t umod64(vm_cpu_t* vmcpu, uint64_t a, uint64_t b); +int64_t idiv64(vm_cpu_t* vmcpu, int64_t a, int64_t b); +int64_t imod64(vm_cpu_t* vmcpu, int64_t a, int64_t b); + +uint16_t udiv32(vm_cpu_t* vmcpu, uint32_t a, uint32_t b); +uint16_t umod32(vm_cpu_t* vmcpu, uint32_t a, uint32_t b); +int32_t idiv32(vm_cpu_t* vmcpu, int32_t a, int32_t b); +int32_t imod32(vm_cpu_t* vmcpu, int32_t a, int32_t b); + +uint8_t udiv16(vm_cpu_t* vmcpu, uint16_t a, uint16_t b); +uint8_t umod16(vm_cpu_t* vmcpu, uint16_t a, uint16_t b); +int16_t idiv16(vm_cpu_t* vmcpu, int16_t a, int16_t b); +int16_t imod16(vm_cpu_t* vmcpu, int16_t a, int16_t b); + +#define RETURN_PC return PyLong_FromUnsignedLongLong(vmcpu->RIP); diff --git a/miasm2/jitter/arch/__init__.py b/miasm2/jitter/arch/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/jitter/arch/__init__.py diff --git a/miasm2/jitter/csts.py b/miasm2/jitter/csts.py new file mode 100644 index 00000000..e4b315e1 --- /dev/null +++ b/miasm2/jitter/csts.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + + +# VM Mngr Exceptions +EXCEPT_DO_NOT_UPDATE_PC = 1 << 25 + +EXCEPT_CODE_AUTOMOD = (1 << 0) +EXCEPT_SOFT_BP = (1 << 1) +EXCEPT_INT_XX = (1 << 2) +EXCEPT_BREAKPOINT_INTERN = (1 << 10) + +EXCEPT_ACCESS_VIOL = ((1 << 14) | EXCEPT_DO_NOT_UPDATE_PC) +# VM Mngr constants + +PAGE_READ = 1 +PAGE_WRITE = 2 +PAGE_EXEC = 4 + +BREAKPOINT_READ = 1 +BREAKPOINT_WRITE = 2 + diff --git a/miasm2/jitter/jitcore.py b/miasm2/jitter/jitcore.py new file mode 100644 index 00000000..34ae3be9 --- /dev/null +++ b/miasm2/jitter/jitcore.py @@ -0,0 +1,252 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +from miasm2.core import asmbloc +from miasm2.core.interval import interval +from csts import * + + +class JitCore(object): + + "JiT management. This is an abstract class" + + def __init__(self, my_ir, bs=None): + """Initialise a JitCore instance. + @my_ir: ir instance for current architecture + @bs: bitstream + """ + + self.my_ir = my_ir + self.bs = bs + self.known_blocs = {} + self.lbl2jitbloc = {} + self.lbl2bloc = {} + self.log_mn = False + self.log_regs = False + self.log_newbloc = False + self.segm_to_do = set() + self.job_done = set() + self.jitcount = 0 + self.addr2obj = {} + self.addr2objref = {} + self.blocs_mem_interval = interval() + self.disasm_cb = None + self.split_dis = set() + + self.options = {"jit_maxline": 50 # Maximum number of line jitted + } + + def set_options(self, **kwargs): + "Set options relative to the backend" + + self.options.update(kwargs) + + def add_disassembly_splits(self, *args): + """The disassembly engine will stop on address in args if they + are not at the block beginning""" + self.split_dis.update(set(args)) + + def remove_disassembly_splits(self, *args): + """The disassembly engine will no longer stop on address in args""" + self.split_dis.difference_update(set(args)) + + def load(self, arch, attrib): + "Initialise the Jitter according to arch and attrib" + + raise Exception("DO NOT instanciate JitCore") + + def __get_bloc_min_max(self, cur_bloc): + "Update cur_bloc to set min/max address" + + if cur_bloc.lines: + cur_bloc.ad_min = cur_bloc.lines[0].offset + cur_bloc.ad_max = cur_bloc.lines[-1].offset + cur_bloc.lines[-1].l + + def __add_bloc_to_mem_interval(self, vm, bloc): + "Update vm to include bloc addresses in its memory range" + + self.blocs_mem_interval += interval([(bloc.ad_min, bloc.ad_max - 1)]) + + vm.vm_reset_code_bloc_pool() + for a, b in self.blocs_mem_interval: + vm.vm_add_code_bloc(a, b + 1) + + def jitirblocs(self, label, irblocs): + """JiT a group of irblocs. + @label: the label of the irblocs + @irblocs: a gorup of irblocs + """ + + raise Exception("DO NOT instanciate JitCore") + + def add_bloc(self, b): + """Add a bloc to JiT and JiT it. + @b: the bloc to add + """ + + irblocs = self.my_ir.add_bloc(b, gen_pc_updt = True) + b.irblocs = irblocs + self.jitirblocs(b.label, irblocs) + + def __disbloc(self, addr, cpu, vm): + "Disassemble a new bloc and JiT it" + + # Get the bloc + if isinstance(addr, asmbloc.asm_label): + addr = addr.offset + + l = self.my_ir.symbol_pool.getby_offset_create(addr) + cur_bloc = asmbloc.asm_bloc(l) + + # Disassemble it + try: + asmbloc.dis_bloc(self.my_ir.arch, self.bs, cur_bloc, addr, + set(), self.my_ir.symbol_pool, [], + follow_call=False, patch_instr_symb=True, + dontdis_retcall=False, + lines_wd=self.options["jit_maxline"], + # max 10 asm lines + attrib=self.my_ir.attrib, + split_dis=self.split_dis) + except IOError: + # vm_exception_flag is set + pass + + # Logging + if self.log_newbloc: + print cur_bloc + if self.disasm_cb is not None: + self.disasm_cb(cur_bloc) + # Update label -> bloc + self.lbl2bloc[l] = cur_bloc + + # Store min/max bloc address needed in jit automod code + self.__get_bloc_min_max(cur_bloc) + + # JiT it + self.add_bloc(cur_bloc) + + # Update jitcode mem range + self.__add_bloc_to_mem_interval(vm, cur_bloc) + + def jit_call(self, label, cpu, vmmngr): + """Call the function label with cpu and vmmngr states + @label: function's label + @cpu: address of the cpu state structure + @vmmngr: address of the memory state structure + """ + + fc_ptr = self.lbl2jitbloc[label] + return self.exec_wrapper(fc_ptr, cpu, vmmngr) + + def runbloc(self, cpu, vm, lbl): + """Run the bloc starting at lbl. + @cpu: JitCpu instance + @vm: VmMngr instance + @lbl: target label + """ + + if lbl is None: + lbl = cpu.vm_get_gpreg()[self.my_ir.pc.name] + + if not lbl in self.lbl2jitbloc: + # Need to JiT the bloc + self.__disbloc(lbl, cpu, vm) + + # Run the bloc and update cpu/vmmngr state + ret = self.jit_call(lbl, cpu.cpu, vm.vmmngr) + + return ret + + def __blocs2memrange(self, blocs): + """Return an interval instance standing for blocs addresses + @blocs: list of asm_bloc instances + """ + + mem_range = interval() + + for b in blocs: + mem_range += interval([(b.ad_min, b.ad_max - 1)]) + + return mem_range + + def __updt_jitcode_mem_range(self, vm): + """Rebuild the VM blocs address memory range + @vm: VmMngr instance + """ + + # Reset the current pool + vm.vm_reset_code_bloc_pool() + + # Add blocs in the pool + for a, b in self.blocs_mem_interval: + vm.vm_add_code_bloc(a, b + 1) + + def __del_bloc_in_range(self, ad1, ad2): + """Find and remove jitted bloc in range [ad1, ad2]. + Return the list of bloc removed. + @ad1: First address + @ad2: Last address + """ + + # Find concerned blocs + modified_blocs = set() + for b in self.lbl2bloc.values(): + if not b.lines: + continue + if b.ad_max <= ad1 or b.ad_min >= ad2: + # Bloc not modified + pass + else: + # Modified blocs + modified_blocs.add(b) + + # Generate interval to delete + del_interval = self.__blocs2memrange(modified_blocs) + + # Remove interval from monitored interval list + self.blocs_mem_interval -= del_interval + + # Remove modified blocs + for b in modified_blocs: + try: + for irbloc in b.irblocs: + + # Remove offset -> jitted bloc link + if irbloc.label.offset in self.lbl2jitbloc: + del(self.lbl2jitbloc[irbloc.label.offset]) + + except AttributeError: + # The bloc has never been translated in IR + if b.label.offset in self.lbl2jitbloc: + del(self.lbl2jitbloc[b.label.offset]) + + # Remove label -> bloc link + del(self.lbl2bloc[b.label]) + + return modified_blocs + + def updt_automod_code(self, vm, addr, size): + """Remove code jitted in range [addr, addr + size] + @vm: VmMngr instance + @addr: Address of modified code in sandbox + @size: Modification range size (in bits) + """ + + self.__del_bloc_in_range(addr, addr + size / 8) + self.__updt_jitcode_mem_range(vm) + diff --git a/miasm2/jitter/jitcore_llvm.py b/miasm2/jitter/jitcore_llvm.py new file mode 100644 index 00000000..f081d281 --- /dev/null +++ b/miasm2/jitter/jitcore_llvm.py @@ -0,0 +1,157 @@ +import os +import importlib +import hashlib +try: + from llvmconvert import * +except ImportError: + pass +import jitcore +import Jitllvm + + +class JitCore_LLVM(jitcore.JitCore): + + "JiT management, using LLVM as backend" + + # Architecture dependant libraries + arch_dependent_libs = {"x86": "arch/JitCore_x86.so"} + + def __init__(self, my_ir, bs=None): + super(JitCore_LLVM, self).__init__(my_ir, bs) + + self.options.update({"safe_mode": False, # Verify each function + "optimise": False, # Optimise functions + "log_func": False, # Print LLVM functions + "log_assembly": False, # Print assembly executed + "cache_ir": None # SaveDir for cached .ll + }) + + self.exec_wrapper = Jitllvm.llvm_exec_bloc + self.exec_engines = [] + + def load(self, arch): + + # Library to load within Jit context + libs_to_load = [] + + # Get the vm_mngr librairy + lib_dir = os.path.dirname(os.path.realpath(__file__)) + vm_mngr_path = os.path.join(lib_dir, 'vm_mngr.so') + libs_to_load.append(vm_mngr_path) + + # Get architecture dependant Jitcore library (if any) + try: + jit_lib = os.path.join( + lib_dir, self.arch_dependent_libs[arch.name]) + libs_to_load.append(jit_lib) + except KeyError: + pass + + # Create a context + self.context = LLVMContext_JIT(libs_to_load) + + # Set the optimisation level + self.context.optimise_level() + + # Save the current architecture parameters + self.arch = arch + + # Get the correspondance between registers and vmcpu struct + mod_name = "miasm2.jitter.arch.JitCore_%s" % (arch.name) + mod = importlib.import_module(mod_name) + self.context.set_vmcpu(mod.get_gpreg_offset_all()) + + # Save module base + self.mod_base_str = str(self.context.mod) + + # Set IRs transformation to apply + self.context.set_IR_transformation(self.my_ir.expr_fix_regs_for_mode) + + def add_bloc(self, bloc): + + # Search in IR cache + if self.options["cache_ir"] is not None: + + # /!\ This part is under development + # Use it at your own risk + + # Compute Hash : label + bloc binary + func_name = bloc.label.name + to_hash = func_name + + # Get binary from bloc + for line in bloc.lines: + b = line.b + to_hash += b + + # Compute Hash + md5 = hashlib.md5(to_hash).hexdigest() + + # Try to load the function from cache + filename = self.options["cache_ir"] + md5 + ".ll" + + try: + fcontent = open(filename) + content = fcontent.read() + fcontent.close() + + except IOError: + content = None + + if content is None: + # Compute the IR + super(JitCore_LLVM, self).add_bloc(bloc) + + # Save it + fdest = open(filename, "w") + dump = str(self.context.mod.get_function_named(func_name)) + my = "declare i16 @llvm.bswap.i16(i16) nounwind readnone\n" + + fdest.write(self.mod_base_str + my + dump) + fdest.close() + + else: + import llvm.core as llvm_c + import llvm.ee as llvm_e + my_mod = llvm_c.Module.from_assembly(content) + func = my_mod.get_function_named(func_name) + exec_en = llvm_e.ExecutionEngine.new(my_mod) + self.exec_engines.append(exec_en) + + # We can use the same exec_engine + ptr = self.exec_engines[0].get_pointer_to_function(func) + + # Store a pointer on the function jitted code + self.lbl2jitbloc[bloc.label.offset] = ptr + + else: + super(JitCore_LLVM, self).add_bloc(bloc) + + def jitirblocs(self, label, irblocs): + + # Build a function in the context + func = LLVMFunction(self.context, label.name) + + # Set log level + func.log_regs = self.log_regs + func.log_mn = self.log_mn + + # Import irblocs + func.from_blocs(irblocs) + + # Verify + if self.options["safe_mode"] is True: + func.verify() + + # Optimise + if self.options["optimise"] is True: + func.optimise() + + # Log + if self.options["log_func"] is True: + print func + if self.options["log_assembly"] is True: + print func.get_assembly() + + # Store a pointer on the function jitted code + self.lbl2jitbloc[label.offset] = func.get_function_pointer() diff --git a/miasm2/jitter/jitcore_tcc.py b/miasm2/jitter/jitcore_tcc.py new file mode 100644 index 00000000..ee33bcd0 --- /dev/null +++ b/miasm2/jitter/jitcore_tcc.py @@ -0,0 +1,146 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import os +from miasm2.ir.ir2C import irblocs2C +from subprocess import Popen, PIPE +import jitcore +from distutils.sysconfig import get_python_inc +import Jittcc + + +def jit_tcc_compil(func_name, func_code): + global Jittcc + c = Jittcc.tcc_compil(func_name, func_code) + return c + + +class jit_tcc_code(): + + def __init__(self, c): + self.c = c + + def __call__(self, cpu, vm): + return Jittcc.tcc_exec_bloc(self.c, cpu, vm) + + +def gen_core(arch, attrib): + lib_dir = os.path.dirname(os.path.realpath(__file__)) + + txt = "" + txt += '#include "%s/queue.h"\n' % lib_dir + txt += '#include "%s/vm_mngr.h"\n' % lib_dir + txt += '#include "%s/arch/JitCore_%s.h"\n' % (lib_dir, arch.name) + + txt += r''' +#define RAISE(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return p;} +''' + return txt + + +def gen_C_source(my_ir, func_code): + c_source = "" + c_source += "\n".join(func_code) + + c_source = gen_core(my_ir.arch, my_ir.attrib) + c_source + + c_source = """ + #ifdef __x86_64__ + #ifndef __LP64__ + /* + for ubuntu ?!? XXX TODO + /!\ force 64 bit system using 64 bits libc + change this to __ILP32__ to do so. + */ + #define __LP64__ + #endif + #endif + """ + "#include <Python.h>\n" + c_source + + return c_source + + +class objref: + + def __init__(self, obj): + self.obj = obj + + +class myresolver: + + def __init__(self, offset): + self.offset = offset + + def ret(self): + return "return PyLong_FromUnsignedLongLong(0x%X);" % self.offset + +from miasm2.core.utils import keydefaultdict + + +class resolver: + + def __init__(self): + self.resolvers = keydefaultdict(myresolver) + + def get_resolver(self, offset): + return self.resolvers[offset] + + +class JitCore_Tcc(jitcore.JitCore): + + "JiT management, using LibTCC as backend" + + def __init__(self, my_ir, bs=None): + super(JitCore_Tcc, self).__init__(my_ir, bs) + self.resolver = resolver() + self.exec_wrapper = Jittcc.tcc_exec_bloc + + def load(self, arch): + # os.path.join(os.path.dirname(os.path.realpath(__file__)), "jitter") + lib_dir = os.path.dirname(os.path.realpath(__file__)) + libs = [] + libs.append(os.path.join(lib_dir, 'vm_mngr.so')) + libs.append(os.path.join(lib_dir, 'arch/JitCore_%s.so' % (arch.name))) + libs = ';'.join(libs) + jittcc_path = Jittcc.__file__ + include_dir = os.path.dirname(jittcc_path) + include_dir += ";" + os.path.join(include_dir, "arch") + # print include_dir + + # XXX HACK + # As debian/ubuntu have moved some include files using arch directory, + # TCC doesn't know them, so we get the info from GCC + # For example /usr/include/x86_64-linux-gnu which contains limits.h + p = Popen(["cc", "-Wp,-v", "-E", "-"], + stdout=PIPE, stderr=PIPE, stdin=PIPE) + p.stdin.close() + include_files = p.stderr.read().split('\n') + include_files = [x[1:] + for x in include_files if x.startswith(' /usr/include')] + include_files += [include_dir, get_python_inc()] + + include_files = ";".join(include_files) + Jittcc.tcc_set_emul_lib_path(include_files, libs) + + def jitirblocs(self, label, irblocs): + # irbloc = self.lbl2irbloc[lbl] + f_name = "bloc_%s" % label.name + f_declaration = \ + 'PyObject* %s(vm_cpu_t* vmcpu, vm_mngr_t* vm_mngr)' % f_name + out = irblocs2C(self.my_ir, self.resolver, label, irblocs, + gen_exception_code=True, + log_mn=self.log_mn, + log_regs=self.log_regs) + out = [f_declaration + '{'] + out + ['}\n'] + c_code = out + + func_code = gen_C_source(self.my_ir, c_code) + # print func_code + # open('tmp_%.4d.c'%self.jitcount, "w").write(func_code) + self.jitcount += 1 + mcode = jit_tcc_compil(f_name, func_code) + jcode = jit_tcc_code(mcode) + self.lbl2jitbloc[label.offset] = mcode + self.addr2obj[label.offset] = jcode + self.addr2objref[label.offset] = objref(jcode) + # print "ADDR2CODE", hex(b.label.offset), hex(id(jcode)) diff --git a/miasm2/jitter/jitload.py b/miasm2/jitter/jitload.py new file mode 100644 index 00000000..d9aca929 --- /dev/null +++ b/miasm2/jitter/jitload.py @@ -0,0 +1,1089 @@ +#!/usr/bin/env python + +import os +from miasm2.core import asmbloc +from collections import defaultdict +import struct +from elfesteem import pe +from elfesteem import cstruct +from elfesteem import * +from vm_mngr import * +from vm_mngr import VmMngr + +from csts import * +from miasm2.core.utils import * +from jitcore_tcc import JitCore_Tcc +from jitcore_llvm import JitCore_LLVM +from miasm2.core.bin_stream import bin_stream + +from miasm2.ir.ir2C import init_arch_C +import inspect + +import logging + +log = logging.getLogger('jitload.py') +hnd = logging.StreamHandler() +hnd.setFormatter(logging.Formatter("[%(levelname)s]: %(message)s")) +log.addHandler(hnd) +log.setLevel(logging.CRITICAL) + +""" +name2jit = {'x86':JitCore_x86, + 'arm':JitCore_arm, + 'msp430':JitCore_msp430, + } +""" + + +def whoami(): + return inspect.stack()[2][3] + + +class bin_stream_vm(bin_stream): + + def __init__(self, vm, offset=0L, base_offset=0L): + self.offset = offset + self.base_offset = base_offset + self.vm = vm + + def getlen(self): + return 0xFFFFFFFFFFFFFFFF + + def getbytes(self, start, l=1): + try: + s = self.vm.vm_get_mem(start + self.base_offset, l) + except: + raise IOError('cannot get mem ad', hex(start)) + return s + + def readbs(self, l=1): + try: + s = self.vm.vm_get_mem(self.offset + self.base_offset, l) + except: + raise IOError('cannot get mem ad', hex(self.offset)) + self.offset += l + return s + + def writebs(self, l=1): + raise ValueError('writebs unsupported') + + def setoffset(self, val): + self.offset = val + + +def get_import_address(e): + import2addr = defaultdict(set) + if e.DirImport.impdesc is None: + return import2addr + for s in e.DirImport.impdesc: + # fthunk = e.rva2virt(s.firstthunk) + # l = "%2d %-25s %s" % (i, repr(s.dlldescname), repr(s)) + libname = s.dlldescname.name.lower() + for ii, imp in enumerate(s.impbynames): + if isinstance(imp, pe.ImportByName): + funcname = imp.name + else: + funcname = imp + # l = " %2d %-16s" % (ii, repr(funcname)) + import2addr[(libname, funcname)].add( + e.rva2virt(s.firstthunk + e._wsize * ii / 8)) + return import2addr + + +def preload_pe(vm, e, runtime_lib, patch_vm_imp=True): + fa = get_import_address(e) + dyn_funcs = {} + # log.debug('imported funcs: %s' % fa) + for (libname, libfunc), ads in fa.items(): + for ad in ads: + ad_base_lib = runtime_lib.lib_get_add_base(libname) + ad_libfunc = runtime_lib.lib_get_add_func(ad_base_lib, libfunc, ad) + + libname_s = canon_libname_libfunc(libname, libfunc) + dyn_funcs[libname_s] = ad_libfunc + if patch_vm_imp: + vm.vm_set_mem( + ad, struct.pack(cstruct.size2type[e._wsize], ad_libfunc)) + return dyn_funcs + + +def get_import_address_elf(e): + import2addr = defaultdict(set) + for sh in e.sh: + if not hasattr(sh, 'rel'): + continue + for k, v in sh.rel.items(): + import2addr[('xxx', k)].add(v.offset) + return import2addr + + +def preload_elf(vm, e, runtime_lib, patch_vm_imp=True): + # XXX quick hack + fa = get_import_address_elf(e) + dyn_funcs = {} + # log.debug('imported funcs: %s' % fa) + for (libname, libfunc), ads in fa.items(): + for ad in ads: + ad_base_lib = runtime_lib.lib_get_add_base(libname) + ad_libfunc = runtime_lib.lib_get_add_func(ad_base_lib, libfunc, ad) + + libname_s = canon_libname_libfunc(libname, libfunc) + dyn_funcs[libname_s] = ad_libfunc + if patch_vm_imp: + log.debug('patch %s %s %s' % + (hex(ad), hex(ad_libfunc), libfunc)) + vm.vm_set_mem( + ad, struct.pack(cstruct.size2type[e.size], ad_libfunc)) + return runtime_lib, dyn_funcs + + +def is_redirected_export(e, ad): + # test is ad points to code or dll name + out = '' + for i in xrange(0x200): + c = e.virt(ad + i) + if c == "\x00": + break + out += c + if not (c.isalnum() or c in "_.-+*$@&#()[]={}"): + return False + if not "." in out: + return False + i = out.find('.') + return out[:i], out[i + 1:] + + +def get_export_name_addr_list(e): + out = [] + # add func name + for i, n in enumerate(e.DirExport.f_names): + addr = e.DirExport.f_address[e.DirExport.f_nameordinals[i].ordinal] + f_name = n.name.name + # log.debug('%s %s' % (f_name, hex(e.rva2virt(addr.rva)))) + out.append((f_name, e.rva2virt(addr.rva))) + + # add func ordinal + for i, o in enumerate(e.DirExport.f_nameordinals): + addr = e.DirExport.f_address[o.ordinal] + # log.debug('%s %s %s' % (o.ordinal, e.DirExport.expdesc.base, + # hex(e.rva2virt(addr.rva)))) + out.append( + (o.ordinal + e.DirExport.expdesc.base, e.rva2virt(addr.rva))) + return out + + +def canon_libname_libfunc(libname, libfunc): + dn = libname.split('.')[0] + if type(libfunc) == str: + return "%s_%s" % (dn, libfunc) + else: + return str(dn), libfunc + + +class libimp: + + def __init__(self, lib_base_ad=0x71111000, **kargs): + self.name2off = {} + self.libbase2lastad = {} + self.libbase_ad = lib_base_ad + self.lib_imp2ad = {} + self.lib_imp2dstad = {} + self.fad2cname = {} + self.fad2info = {} + self.all_exported_lib = [] + + def lib_get_add_base(self, name): + name = name.lower().strip(' ') + if not "." in name: + log.debug('warning adding .dll to modulename') + name += '.dll' + log.debug('%s' % name) + + if name in self.name2off: + ad = self.name2off[name] + else: + ad = self.libbase_ad + log.debug('new lib %s %s' % (name, hex(ad))) + self.name2off[name] = ad + self.libbase2lastad[ad] = ad + 0x1 + self.lib_imp2ad[ad] = {} + self.lib_imp2dstad[ad] = {} + self.libbase_ad += 0x1000 + return ad + + def lib_get_add_func(self, libad, imp_ord_or_name, dst_ad=None): + if not libad in self.name2off.values(): + raise ValueError('unknown lib base!', hex(libad)) + + # test if not ordinatl + # if imp_ord_or_name >0x10000: + # imp_ord_or_name = vm_get_str(imp_ord_or_name, 0x100) + # imp_ord_or_name = imp_ord_or_name[:imp_ord_or_name.find('\x00')] + + #/!\ can have multiple dst ad + if not imp_ord_or_name in self.lib_imp2dstad[libad]: + self.lib_imp2dstad[libad][imp_ord_or_name] = set() + self.lib_imp2dstad[libad][imp_ord_or_name].add(dst_ad) + + if imp_ord_or_name in self.lib_imp2ad[libad]: + return self.lib_imp2ad[libad][imp_ord_or_name] + # log.debug('new imp %s %s' % (imp_ord_or_name, dst_ad)) + ad = self.libbase2lastad[libad] + self.libbase2lastad[libad] += 0x11 # arbitrary + self.lib_imp2ad[libad][imp_ord_or_name] = ad + + name_inv = dict([(x[1], x[0]) for x in self.name2off.items()]) + c_name = canon_libname_libfunc(name_inv[libad], imp_ord_or_name) + self.fad2cname[ad] = c_name + self.fad2info[ad] = libad, imp_ord_or_name + return ad + + def check_dst_ad(self): + for ad in self.lib_imp2dstad: + all_ads = self.lib_imp2dstad[ad].values() + all_ads.sort() + for i, x in enumerate(all_ads[:-1]): + if x is None or all_ads[i + 1] is None: + return False + if x + 4 != all_ads[i + 1]: + return False + return True + + def add_export_lib(self, e, name): + self.all_exported_lib.append(e) + # will add real lib addresses to database + if name in self.name2off: + ad = self.name2off[name] + else: + log.debug('new lib %s' % name) + ad = e.NThdr.ImageBase + libad = ad + self.name2off[name] = ad + self.libbase2lastad[ad] = ad + 0x1 + self.lib_imp2ad[ad] = {} + self.lib_imp2dstad[ad] = {} + self.libbase_ad += 0x1000 + + ads = get_export_name_addr_list(e) + todo = ads + # done = [] + while todo: + # for imp_ord_or_name, ad in ads: + imp_ord_or_name, ad = todo.pop() + + # if export is a redirection, search redirected dll + # and get function real addr + ret = is_redirected_export(e, ad) + if ret: + exp_dname, exp_fname = ret + # log.debug('export redirection %s' % imp_ord_or_name) + # log.debug('source %s %s' % (exp_dname, exp_fname)) + exp_dname = exp_dname + '.dll' + exp_dname = exp_dname.lower() + # if dll auto refes in redirection + if exp_dname == name: + libad_tmp = self.name2off[exp_dname] + if not exp_fname in self.lib_imp2ad[libad_tmp]: + # schedule func + todo = [(imp_ord_or_name, ad)] + todo + continue + elif not exp_dname in self.name2off: + raise ValueError('load %r first' % exp_dname) + c_name = canon_libname_libfunc(exp_dname, exp_fname) + libad_tmp = self.name2off[exp_dname] + ad = self.lib_imp2ad[libad_tmp][exp_fname] + # log.debug('%s' % hex(ad)) + # if not imp_ord_or_name in self.lib_imp2dstad[libad]: + # self.lib_imp2dstad[libad][imp_ord_or_name] = set() + # self.lib_imp2dstad[libad][imp_ord_or_name].add(dst_ad) + + # log.debug('new imp %s %s' % (imp_ord_or_name, hex(ad))) + self.lib_imp2ad[libad][imp_ord_or_name] = ad + + name_inv = dict([(x[1], x[0]) for x in self.name2off.items()]) + c_name = canon_libname_libfunc( + name_inv[libad], imp_ord_or_name) + self.fad2cname[ad] = c_name + self.fad2info[ad] = libad, imp_ord_or_name + + def gen_new_lib(self, e, filter=lambda x: True): + new_lib = [] + for n, ad in self.name2off.items(): + out_ads = dict() + for k, vs in self.lib_imp2dstad[ad].items(): + for v in vs: + out_ads[v] = k + all_ads = self.lib_imp2dstad[ad].values() + all_ads = reduce(lambda x, y: x + list(y), all_ads, []) + all_ads = [x for x in all_ads if filter(x)] + # log.debug('%s' % [hex(x) for x in all_ads]) + all_ads.sort() + # first, drop None + if not all_ads: + continue + for i, x in enumerate(all_ads): + if not x in [0, None]: + break + all_ads = all_ads[i:] + while all_ads: + othunk = all_ads[0] + i = 0 + while i + 1 < len(all_ads) and all_ads[i] + 4 == all_ads[i + 1]: + i += 1 + funcs = [out_ads[x] for x in all_ads[:i + 1]] + try: + off = e.virt2off(othunk) + except pe.InvalidOffset: + off = None + if off is not None: # e.is_in_virt_address(othunk): + new_lib.append(({"name": n, + "firstthunk": off}, + funcs) + ) + all_ads = all_ads[i + 1:] + return new_lib + + +def vm_load_pe(vm, fname, align_s=True, load_hdr=True, + **kargs): + e = pe_init.PE(open(fname, 'rb').read(), **kargs) + + aligned = True + for s in e.SHList: + if s.addr & 0xFFF: + aligned = False + break + + if aligned: + if load_hdr: + hdr_len = max(0x200, e.NThdr.sectionalignment) + min_len = min(e.SHList[0].addr, hdr_len) + pe_hdr = e.content[:hdr_len] + pe_hdr = pe_hdr + min_len * "\x00" + pe_hdr = pe_hdr[:min_len] + vm.vm_add_memory_page( + e.NThdr.ImageBase, PAGE_READ | PAGE_WRITE, pe_hdr) + if align_s: + for i, s in enumerate(e.SHList[:-1]): + s.size = e.SHList[i + 1].addr - s.addr + s.rawsize = s.size + s.data = strpatchwork.StrPatchwork(s.data[:s.size]) + s.offset = s.addr + s = e.SHList[-1] + s.size = (s.size + 0xfff) & 0xfffff000 + for s in e.SHList: + data = str(s.data) + data += "\x00" * (s.size - len(data)) + # log.debug('SECTION %s %s' % (hex(s.addr), + # hex(e.rva2virt(s.addr)))) + vm.vm_add_memory_page( + e.rva2virt(s.addr), PAGE_READ | PAGE_WRITE, data) + # s.offset = s.addr + return e + + # not aligned + log.warning('pe is not aligned, creating big section') + min_addr = None + max_addr = None + data = "" + + if load_hdr: + data = e.content[:0x400] + data += (e.SHList[0].addr - len(data)) * "\x00" + min_addr = 0 + + for i, s in enumerate(e.SHList): + if i < len(e.SHList) - 1: + s.size = e.SHList[i + 1].addr - s.addr + s.rawsize = s.size + s.offset = s.addr + + if min_addr is None or s.addr < min_addr: + min_addr = s.addr + if max_addr is None or s.addr + s.size > max_addr: + max_addr = s.addr + max(s.size, len(s.data)) + min_addr = e.rva2virt(min_addr) + max_addr = e.rva2virt(max_addr) + log.debug('%s %s %s' % + (hex(min_addr), hex(max_addr), hex(max_addr - min_addr))) + + vm.vm_add_memory_page(min_addr, + PAGE_READ | PAGE_WRITE, + (max_addr - min_addr) * "\x00") + for s in e.SHList: + log.debug('%s %s' % (hex(e.rva2virt(s.addr)), len(s.data))) + vm.vm_set_mem(e.rva2virt(s.addr), str(s.data)) + return e + + +def vm_load_elf(vm, fname, **kargs): + e = elf_init.ELF(open(fname, 'rb').read(), **kargs) + for p in e.ph.phlist: + if p.ph.type != 1: + continue + log.debug('%s %s %s' % + (hex(p.ph.vaddr), hex(p.ph.offset), hex(p.ph.filesz))) + data = e._content[p.ph.offset:p.ph.offset + p.ph.filesz] + r_vaddr = p.ph.vaddr & ~0xFFF + data = (p.ph.vaddr - r_vaddr) * "\x00" + data + data += (((len(data) + 0xFFF) & ~0xFFF) - len(data)) * "\x00" + vm.vm_add_memory_page(r_vaddr, PAGE_READ | PAGE_WRITE, data) + return e +""" +def init_jitter(arch, attrib): + jitarch = name2jit[(arch.name, attrib)] + jitarch.vm_init_regs() + init_memory_page_pool() + init_code_bloc_pool() + init_memory_breakpoint() + jit_tcc_init(arch, attrib) + +def init_stack(arch, attrib, stack_size = 0x10000, stack_base = 0x1230000, **kargs): + jitarch = name2jit[(arch.name, attrib)] + + vm_add_memory_page(stack_base, PAGE_READ|PAGE_WRITE, "\x00"*stack_size) + regs = jitarch.vm_get_gpreg() + regs[arch.sp[attrib].name] = stack_base+stack_size + jitarch.vm_set_gpreg(regs) + regs = jitarch.vm_get_gpreg() +""" + + +def vm_load_pe_lib(fname_in, libs, lib_path_base, patch_vm_imp, **kargs): + fname = os.path.join(lib_path_base, fname_in) + e = vm_load_pe(fname, **kargs) + libs.add_export_lib(e, fname_in) + # preload_pe(e, libs, patch_vm_imp) + return e + + +def vm_load_pe_libs(libs_name, libs, lib_path_base="win_dll", + patch_vm_imp=True, **kargs): + lib_imgs = {} + for fname in libs_name: + e = vm_load_pe_lib(fname, libs, lib_path_base, patch_vm_imp) + lib_imgs[fname] = e + return lib_imgs + + +def vm_fix_imports_pe_libs(lib_imgs, libs, lib_path_base="win_dll", + patch_vm_imp=True, **kargs): + for e in lib_imgs.values(): + preload_pe(e, libs, patch_vm_imp) + + + +class CallbackHandler(object): + + "Handle a list of callback" + + def __init__(self): + self.callbacks = {} # Key -> [callback list] + + def add_callback(self, name, callback): + "Add a callback to the key 'name'" + self.callbacks[name] = self.callbacks.get(name, []) + [callback] + + def set_callback(self, name, *args): + "Set the list of callback for key 'name'" + self.callbacks[name] = args + + def get_callbacks(self, name): + "Return the list of callbacks associated to key 'name'" + return self.callbacks.get(name, []) + + def remove_callback(self, callback): + """Remove the callback from the list. + Return the list of empty keys (removed)""" + + to_check = set() + for key, cb_list in self.callbacks.items(): + try: + cb_list.remove(callback) + to_check.add(key) + except ValueError: + pass + + empty_keys = [] + for key in to_check: + if len(self.callbacks[key]) == 0: + empty_keys.append(key) + del(self.callbacks[key]) + + return empty_keys + + def call_callbacks(self, name, *args): + """Call callbacks associated to key 'name' with arguments args. While + callbacks return True, continue with next callback. + Iterator on other results.""" + + res = True + + for c in self.get_callbacks(name): + res = c(*args) + if res is not True: + yield res + + def __call__(self, name, *args): + "Wrapper for call_callbacks" + return self.call_callbacks(name, *args) + + +class CallbackHandlerBitflag(CallbackHandler): + + "Handle a list of callback with conditions on bitflag" + + def __call__(self, bitflag, *args): + """Call each callbacks associated with bit set in bitflag. While + callbacks return True, continue with next callback. + Iterator on other results""" + + res = True + for b in self.callbacks.keys(): + + if b & bitflag != 0: + # If the flag matched + for res in self.call_callbacks(b, *args): + if res is not True: + yield res + + +class ExceptionHandle(): + + "Return type for exception handler" + + def __init__(self, except_flag): + self.except_flag = except_flag + + @classmethod + def memoryBreakpoint(cls): + return cls(EXCEPT_BREAKPOINT_INTERN) + + def __eq__(self, to_cmp): + if not isinstance(to_cmp, ExceptionHandle): + return False + return (self.except_flag == to_cmp.except_flag) + + +class jitter: + + "Main class for JIT handling" + + def __init__(self, my_ir, jit_type="tcc"): + """Init an instance of jitter. + @my_ir: ir instance for this architecture + @jit_type: JiT backend to use. Available options are: + - "tcc" + - "llvm" + """ + + self.arch = my_ir.arch + self.attrib = my_ir.attrib + arch_name = my_ir.arch.name # (my_ir.arch.name, my_ir.attrib) + if arch_name == "x86": + from arch import JitCore_x86 as jcore + elif arch_name == "arm": + from arch import JitCore_arm as jcore + elif arch_name == "msp430": + from arch import JitCore_msp430 as jcore + else: + raise ValueError("unsupported jit arch!") + + self.cpu = jcore.JitCpu() + self.vm = VmMngr() + self.bs = bin_stream_vm(self.vm) + self.my_ir = my_ir + init_arch_C(self.arch) + + if jit_type == "tcc": + self.jit = JitCore_Tcc(self.my_ir, self.bs) + elif jit_type == "llvm": + self.jit = JitCore_LLVM(self.my_ir, self.bs) + else: + raise Exception("Unkown JiT Backend") + + self.cpu.vm_init_regs() + self.vm.vm_init_memory_page_pool() + self.vm.vm_init_code_bloc_pool() + self.vm.vm_init_memory_breakpoint() + + self.vm.vm_set_addr2obj(self.jit.addr2obj) + + self.jit.load(self.arch) + self.stack_size = 0x10000 + self.stack_base = 0x1230000 + + # Init callback handler + self.breakpoints_handler = CallbackHandler() + self.exceptions_handler = CallbackHandlerBitflag() + self.init_exceptions_handler() + self.exec_cb = None + + def init_exceptions_handler(self): + "Add common exceptions handlers" + + def exception_automod(jitter): + "Tell the JiT backend to update blocs modified" + addr = self.vm.vm_get_last_write_ad() + size = self.vm.vm_get_last_write_size() + + self.jit.updt_automod_code(self.vm, addr, size) + self.vm.vm_set_exception(0) + + return True + + def exception_memory_breakpoint(jitter): + "Stop the execution and return an identifier" + return ExceptionHandle.memoryBreakpoint() + + self.add_exception_handler(EXCEPT_CODE_AUTOMOD, exception_automod) + self.add_exception_handler(EXCEPT_BREAKPOINT_INTERN, + exception_memory_breakpoint) + + def add_breakpoint(self, addr, callback): + """Add a callback associated with addr. + @addr: breakpoint address + @callback: function with definition (jitter instance) + """ + self.breakpoints_handler.add_callback(addr, callback) + self.jit.add_disassembly_splits(addr) + + def remove_breakpoints_by_callback(self, callback): + """Remove callbacks associated with breakpoint. + @callback: callback to remove + """ + empty_keys = self.breakpoints_handler.remove_callback(callback) + for key in empty_keys: + self.jit.remove_disassembly_splits(key) + + def add_exception_handler(self, flag, callback): + """Add a callback associated with an exception flag. + @flag: bitflag + @callback: function with definition (jitter instance) + """ + self.exceptions_handler.add_callback(flag, callback) + + def runbloc(self, pc): + """Wrapper on JiT backend. Run the code at PC and return the next PC. + @pc: address of code to run""" + + return self.jit.runbloc(self.cpu, self.vm, pc) + + def runiter_once(self, pc): + """Iterator on callbacks results on code running from PC. + Check exceptions before breakpoints.""" + + self.pc = pc + + # Callback called before exec + if self.exec_cb is not None: + res = self.exec_cb(self) + if res is not True: + yield res + + # Check breakpoints + old_pc = self.pc + for res in self.breakpoints_handler(self.pc, self): + if res is not True: + yield res + + # If a callback changed pc, re call every callback + if old_pc != self.pc: + return + + # Exceptions should never be activated before run + assert(self.get_exception() == 0) + + # Run the bloc at PC + self.pc = self.runbloc(self.pc) + + # Check exceptions + exception_flag = self.get_exception() + for res in self.exceptions_handler(exception_flag, self): + if res is not True: + yield res + + def init_run(self, pc): + """Create an iterator on pc with runiter. + @pc: address of code to run + """ + self.run_iterator = self.runiter_once(pc) + self.pc = pc + self.run = True + + def continue_run(self, step=False): + """PRE: init_run. + Continue the run of the current session until iterator returns or run is + set to False. + If step is True, run only one time. + Return the iterator value""" + + while self.run: + try: + return self.run_iterator.next() + except StopIteration: + pass + + self.run_iterator = self.runiter_once(self.pc) + + if step is True: + return None + + return None + + def init_stack(self): + self.vm.vm_add_memory_page( + self.stack_base, PAGE_READ | PAGE_WRITE, "\x00" * self.stack_size) + sp = self.arch.getsp(self.attrib) + setattr(self.cpu, sp.name, self.stack_base + self.stack_size) + # regs = self.cpu.vm_get_gpreg() + # regs[sp.name] = self.stack_base+self.stack_size + # self.cpu.vm_set_gpreg(regs) + + def get_exception(self): + return self.cpu.vm_get_exception() | self.vm.vm_get_exception() + + # commun functions + def get_str_ansi(self, addr, max_char=None): + """Get ansi str from vm. + @addr: address in memory + @max_char: maximum len""" + l = 0 + tmp = addr + while ((max_char is None or l < max_char) and + self.vm.vm_get_mem(tmp, 1) != "\x00"): + tmp += 1 + l += 1 + return self.vm.vm_get_mem(addr, l) + + def get_str_unic(self, addr, max_char=None): + """Get unicode str from vm. + @addr: address in memory + @max_char: maximum len""" + l = 0 + tmp = addr + while ((max_char is None or l < max_char) and + self.vm.vm_get_mem(tmp, 2) != "\x00\x00"): + tmp += 2 + l += 2 + s = self.vm.vm_get_mem(addr, l) + s = s[::2] # TODO: real unicode decoding + return s + + def set_str_ansi(self, addr, s): + """Set an ansi string in memory""" + s = s + "\x00" + self.vm.vm_set_mem(addr, s) + + def set_str_unic(self, addr, s): + """Set an unicode string in memory""" + s = "\x00".join(list(s)) + '\x00' * 3 + self.vm.vm_set_mem(addr, s) + + +class jitter_x86_16(jitter): + + def __init__(self, *args, **kwargs): + from miasm2.arch.x86.sem import ir_x86_16 + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_16(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint16_t(self, v): + self.cpu.SP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.SP, pck16(v)) + + def vm_pop_uint16_t(self): + x = upck16(self.vm.vm_get_mem(self.cpu.SP, self.my_ir.sp.size / 8)) + self.cpu.SP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck16(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) + return x + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.IP = self.pc + + +class jitter_x86_32(jitter): + + def __init__(self, *args, **kwargs): + from miasm2.arch.x86.sem import ir_x86_32 + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_32(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint32_t(self, v): + self.cpu.ESP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.ESP, pck32(v)) + + def vm_pop_uint32_t(self): + x = upck32(self.vm.vm_get_mem(self.cpu.ESP, self.my_ir.sp.size / 8)) + self.cpu.ESP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck32(self.vm.vm_get_mem(self.cpu.ESP + 4 * n, 4)) + return x + + # calling conventions + + # stdcall + def func_args_stdcall(self, n_args): + ret_ad = self.vm_pop_uint32_t() + args = [] + for _ in xrange(n_args): + args.append(self.vm_pop_uint32_t()) + log.debug('%s %s %s' % (whoami(), hex(ret_ad), [hex(x) for x in args])) + return ret_ad, args + + def func_ret_stdcall(self, ret_addr, ret_value1=None, ret_value2=None): + self.cpu.EIP = ret_addr + if ret_value1 is not None: + self.cpu.EAX = ret_value1 + if ret_value2 is not None: + self.cpu.EDX = ret_value + + # cdecl + def func_args_cdecl(self, n_args, dolog=True): + ret_ad = self.vm_pop_uint32_t() + args = [] + for i in xrange(n_args): + args.append(self.get_stack_arg(i)) + if dolog: + log.debug('%s %s %s' % + (whoami(), hex(ret_ad), [hex(x) for x in args])) + return ret_ad, args + + def func_ret_cdecl(self, ret_addr, ret_value): + self.cpu.EIP = ret_addr + self.cpu.EAX = ret_value + + def add_lib_handler(self, libs, user_globals=None): + """Add a function to handle libs call with breakpoints + @libs: libimp instance + @user_globals: dictionnary for defined user function + """ + if user_globals is None: + user_globals = {} + + from miasm2.jitter.os_dep import win_api_x86_32 + + def handle_lib(jitter): + fname = libs.fad2cname[jitter.pc] + if fname in user_globals: + f = user_globals[fname] + elif fname in win_api_x86_32.__dict__: + f = win_api_x86_32.__dict__[fname] + else: + log.debug('%s' % repr(fname)) + raise ValueError('unknown api', hex(jitter.vm_pop_uint32_t()), repr(fname)) + f(jitter) + jitter.pc = getattr(jitter.cpu, jitter.my_ir.pc.name) + return True + + for f_addr in libs.fad2cname: + self.add_breakpoint(f_addr, handle_lib) + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.EIP = self.pc + + +class jitter_x86_64(jitter): + + def __init__(self, *args, **kwargs): + from miasm2.arch.x86.sem import ir_x86_64 + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_64(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint64_t(self, v): + self.cpu.RSP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.RSP, pck64(v)) + + def vm_pop_uint64_t(self): + x = upck64(self.vm.vm_get_mem(self.cpu.RSP, self.my_ir.sp.size / 8)) + self.cpu.RSP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck64(self.vm.vm_get_mem(self.cpu.RSP + 4 * n, 4)) + return x + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.RIP = self.pc + + +class jitter_arm(jitter): + + def __init__(self, *args, **kwargs): + from miasm2.arch.arm.sem import ir_arm + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_arm(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.PC + + def vm_push_uint32_t(self, v): + self.cpu.SP -= 4 + self.vm.vm_set_mem(self.cpu.SP, pck32(v)) + + def vm_pop_uint32_t(self): + x = upck32(self.vm.vm_get_mem(self.cpu.SP, 4)) + self.cpu.SP += 4 + return x + + def get_stack_arg(self, n): + x = upck32(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) + return x + + # calling conventions + + def func_args_fastcall(self, n_args): + args = [] + for i in xrange(min(n_args, 4)): + args.append(self.cpu.vm_get_gpreg()['R%d' % i]) + for i in xrange(max(0, n_args - 4)): + args.append(self.get_stack_arg(i)) + log.debug('%s %s' % (whoami(), [hex(x) for x in args])) + return args + + def func_ret_fastcall(self, ret_value=None): + self.pc = self.cpu.PC = self.cpu.LR + if ret_value is not None: + self.cpu.R0 = ret_value + return True + + def add_lib_handler(self, libs): + from miasm2.jitter.os_dep import linux_stdlib + for offset, fname in libs.fad2cname.iteritems(): + if fname in linux_stdlib.__dict__: + self.add_breakpoint(offset, linux_stdlib.__dict__[fname]) + else: + log.warning( + 'jitter libhandler: %s function not found!' % fname) + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.PC = self.pc + + +def vm2pe(myjit, fname, libs=None, e_orig=None, + max_addr=1 << 64, min_addr=0x401000, + min_section_offset=0x1000, img_base=None, + added_funcs=None): + mye = pe_init.PE() + + if img_base is None: + img_base = e_orig.NThdr.ImageBase + + mye.NThdr.ImageBase = img_base + all_mem = myjit.vm.vm_get_all_memory() + addrs = all_mem.keys() + addrs.sort() + mye.Opthdr.AddressOfEntryPoint = mye.virt2rva(myjit.cpu.EIP) + first = True + for ad in addrs: + if not min_addr <= ad < max_addr: + continue + log.debug('%s' % hex(ad)) + if first: + mye.SHList.add_section( + "%.8X" % ad, + addr=ad - mye.NThdr.ImageBase, + data=all_mem[ad]['data'], + offset=min_section_offset) + else: + mye.SHList.add_section( + "%.8X" % ad, + addr=ad - mye.NThdr.ImageBase, + data=all_mem[ad]['data']) + first = False + if libs: + if added_funcs is not None: + # name_inv = dict([(x[1], x[0]) for x in libs.name2off.items()]) + + for addr, funcaddr in added_func: + libbase, dllname = libs.fad2info[funcaddr] + libs.lib_get_add_func(libbase, dllname, addr) + + new_dll = libs.gen_new_lib(mye, lambda x: mye.virt.is_addr_in(x)) + else: + new_dll = {} + + log.debug('%s' % new_dll) + + mye.DirImport.add_dlldesc(new_dll) + s_imp = mye.SHList.add_section("import", rawsize=len(mye.DirImport)) + mye.DirImport.set_rva(s_imp.addr) + log.debug('%s' % repr(mye.SHList)) + if e_orig: + # resource + xx = str(mye) + mye.content = xx + ad = e_orig.NThdr.optentries[pe.DIRECTORY_ENTRY_RESOURCE].rva + log.debug('dirres %s' % hex(ad)) + if ad != 0: + mye.NThdr.optentries[pe.DIRECTORY_ENTRY_RESOURCE].rva = ad + mye.DirRes = pe.DirRes.unpack(xx, ad, mye) + # log.debug('%s' % repr(mye.DirRes)) + s_res = mye.SHList.add_section( + name="myres", rawsize=len(mye.DirRes)) + mye.DirRes.set_rva(s_res.addr) + log.debug('%s' % repr(mye.DirRes)) + # generation + open(fname, 'w').write(str(mye)) + + +class jitter_msp430(jitter): + + def __init__(self, *args, **kwargs): + from miasm2.arch.msp430.sem import ir_msp430 + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_msp430(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.PC + + def vm_push_uint16_t(self, v): + regs = self.cpu.vm_get_gpreg() + regs['SP'] -= 2 + self.cpu.vm_set_gpreg(regs) + self.vm.vm_set_mem(regs['SP'], pck16(v)) + + def vm_pop_uint16_t(self): + regs = self.cpu.vm_get_gpreg() + x = upck16(self.vm.vm_get_mem(regs['SP'], 2)) + regs['SP'] += 2 + self.cpu.vm_set_gpreg(regs) + return x + + def get_stack_arg(self, n): + regs = self.cpu.vm_get_gpreg() + x = upck16(self.vm.vm_get_mem(regs['SP'] + 2 * n, 2)) + return x + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.PC = self.pc + diff --git a/miasm2/jitter/llvmconvert.py b/miasm2/jitter/llvmconvert.py new file mode 100644 index 00000000..406a36c9 --- /dev/null +++ b/miasm2/jitter/llvmconvert.py @@ -0,0 +1,982 @@ +# +# +# Miasm2 Extension: # +# - Miasm2 IR to LLVM IR # +# - JiT # +# +# Requires: # +# - llvmpy (tested on v0.11.2) # +# +# Authors : Fabrice DESCLAUX (CEA/DAM), Camille MOUGEY (CEA/DAM) # +# +# + +import llvm +import llvm.core as llvm_c +import llvm.ee as llvm_e +import llvm.passes as llvm_p +import miasm2.expression.expression as m2_expr +import miasm2.jitter.csts as m2_csts +import miasm2.core.asmbloc as m2_asmbloc + + +class LLVMType(llvm_c.Type): + + "Handle LLVM Type" + + int_cache = {} + + @classmethod + def int(cls, size=32): + try: + return cls.int_cache[size] + except KeyError: + cls.int_cache[size] = llvm_c.Type.int(size) + return cls.int_cache[size] + + @classmethod + def pointer(cls, addr): + "Generic pointer for execution" + return llvm_e.GenericValue.pointer(addr) + + @classmethod + def generic(cls, e): + "Generic value for execution" + if isinstance(e, m2_expr.ExprInt): + return llvm_e.GenericValue.int(LLVMType.int(e.size), int(e.arg)) + elif isinstance(e, llvm_e.GenericValue): + return e + else: + raise ValueError() + + +class LLVMContext(): + + "Context for llvm binding. Stand for a LLVM Module" + + known_fc = {} + + def __init__(self, name="mod"): + "Initialize a context with a module named 'name'" + self.mod = llvm_c.Module.new(name) + self.pass_manager = llvm_p.FunctionPassManager.new(self.mod) + self.exec_engine = llvm_e.ExecutionEngine.new(self.mod) + self.add_fc(self.known_fc) + + def optimise_level(self, classic_passes=True, dead_passes=True): + """Set the optimisation level : + classic_passes : + - combine instruction + - reassociate + - global value numbering + - simplify cfg + + dead_passes : + - dead code + - dead store + - dead instructions + """ + + # Set up the optimiser pipeline + + if classic_passes is True: + # self.pass_manager.add(llvm_p.PASS_INSTCOMBINE) + self.pass_manager.add(llvm_p.PASS_REASSOCIATE) + self.pass_manager.add(llvm_p.PASS_GVN) + self.pass_manager.add(llvm_p.PASS_SIMPLIFYCFG) + + if dead_passes is True: + self.pass_manager.add(llvm_p.PASS_DCE) + self.pass_manager.add(llvm_p.PASS_DSE) + self.pass_manager.add(llvm_p.PASS_DIE) + + self.pass_manager.initialize() + + def get_execengine(self): + "Return the Execution Engine associated with this context" + return self.exec_engine + + def get_passmanager(self): + "Return the Pass Manager associated with this context" + return self.exec_engine + + def get_module(self): + "Return the module associated with this context" + return self.mod + + def add_shared_library(self, filename): + "Load the shared library 'filename'" + return llvm_c.load_library_permanently(filename) + + def add_fc(self, fc): + "Add function into known_fc" + + for name, detail in fc.items(): + self.mod.add_function(LLVMType.function(detail["ret"], + detail["args"]), + name) + + +class LLVMContext_JIT(LLVMContext): + + "Extend LLVMContext_JIT in order to handle memory management" + + def __init__(self, library_filenames, name="mod"): + "Init a LLVMContext object, and load the mem management shared library" + LLVMContext.__init__(self, name) + for lib_fname in library_filenames: + self.add_shared_library(lib_fname) + self.add_memlookups() + self.add_get_exceptionflag() + self.add_op() + self.add_log_functions() + self.vmcpu = {} + + def add_memlookups(self): + "Add MEM_LOOKUP functions" + + fc = {} + p8 = llvm_c.PointerType.pointer(LLVMType.int(8)) + for i in [8, 16, 32, 64]: + fc["MEM_LOOKUP_%02d" % i] = {"ret": LLVMType.int(i), + "args": [p8, + LLVMType.int(64)]} + + fc["MEM_WRITE_%02d" % i] = {"ret": LLVMType.void(), + "args": [p8, + LLVMType.int(64), + LLVMType.int(i)]} + + self.add_fc(fc) + + def add_get_exceptionflag(self): + "Add 'get_exception_flag' function" + p8 = llvm_c.PointerType.pointer(LLVMType.int(8)) + self.add_fc({"get_exception_flag": {"ret": LLVMType.int(64), + "args": [p8]}}) + + def add_op(self): + "Add operations functions" + + p8 = llvm_c.PointerType.pointer(LLVMType.int(8)) + self.add_fc({"parity": {"ret": LLVMType.int(), + "args": [LLVMType.int()]}}) + self.add_fc({"rot_left": {"ret": LLVMType.int(), + "args": [LLVMType.int(), + LLVMType.int(), + LLVMType.int()]}}) + self.add_fc({"rot_right": {"ret": LLVMType.int(), + "args": [LLVMType.int(), + LLVMType.int(), + LLVMType.int()]}}) + + self.add_fc({"segm2addr": {"ret": LLVMType.int(64), + "args": [p8, + LLVMType.int(64), + LLVMType.int(64)]}}) + + for k in [8, 16]: + self.add_fc({"bcdadd_%s" % k: {"ret": LLVMType.int(k), + "args": [LLVMType.int(k), + LLVMType.int(k)]}}) + self.add_fc({"bcdadd_cf_%s" % k: {"ret": LLVMType.int(k), + "args": [LLVMType.int(k), + LLVMType.int(k)]}}) + + for k in [16, 32, 64]: + self.add_fc({"imod%s" % k: {"ret": LLVMType.int(k), + "args": [p8, + LLVMType.int(k), + LLVMType.int(k)]}}) + self.add_fc({"idiv%s" % k: {"ret": LLVMType.int(k), + "args": [p8, + LLVMType.int(k), + LLVMType.int(k)]}}) + + def add_log_functions(self): + "Add functions for state logging" + + p8 = llvm_c.PointerType.pointer(LLVMType.int(8)) + self.add_fc({"dump_gpregs": {"ret": LLVMType.void(), + "args": [p8]}}) + + def set_vmcpu(self, lookup_table): + "Set the correspondance between register name and vmcpu offset" + + self.vmcpu = lookup_table + + def set_IR_transformation(self, *args): + """Set a list of transformation to apply on expression before their + treatments. + args: function Expr(Expr)""" + self.IR_transformation_functions = args + + +class LLVMFunction(): + + "Represent a llvm function" + + # Default logging values + log_mn = False + log_regs = False + + def __init__(self, llvm_context, name="fc"): + "Create a new function with name fc" + self.llvm_context = llvm_context + self.mod = self.llvm_context.get_module() + + self.my_args = [] # (Expr, LLVMType, Name) + self.ret_type = None + self.builder = None + self.entry_bbl = None + + self.branch_counter = 0 + self.name = name + + def new_branch_name(self): + "Return a new branch name" + + self.branch_counter += 1 + return "%s" % self.branch_counter + + def viewCFG(self): + "Show the CFG of the current function" + self.fc.viewCFG() + + def append_basic_block(self, label): + """Add a new basic block to the current function. + @label: str or asmlabel + Return the corresponding LLVM Basic Block""" + name = self.canonize_label_name(label) + bbl = self.fc.append_basic_block(name) + self.name2bbl[label] = bbl + + return bbl + + def init_fc(self): + "Init the function" + + # Build type for fc signature + fc_type = LLVMType.function( + self.ret_type, [k[1] for k in self.my_args]) + + # Add fc in module + try: + fc = self.mod.add_function(fc_type, self.name) + except llvm.LLVMException: + # Overwrite the previous function + previous_fc = self.mod.get_function_named(self.name) + previous_fc.delete() + fc = self.mod.add_function(fc_type, self.name) + + # Name args + for i, a in enumerate(self.my_args): + fc.args[i].name = a[2] + + # Initialize local variable pool + self.local_vars = {} + self.local_vars_pointers = {} + for i, a in enumerate(self.my_args): + self.local_vars[a[2]] = fc.args[i] + + # Init cache + self.expr_cache = {} + self.main_stream = True + self.name2bbl = {} + self.offsets_jitted = set() + + # Function link + self.fc = fc + + # Add a first BasicBlock + self.entry_bbl = self.append_basic_block("entry") + + # Instruction builder + self.builder = llvm_c.Builder.new(self.entry_bbl) + + def CreateEntryBlockAlloca(self, var_type): + "Create an alloca instruction at the beginning of the current fc" + builder = self.builder + current_bbl = builder.basic_block + builder.position_at_end(self.entry_bbl) + + ret = builder.alloca(var_type) + builder.position_at_end(current_bbl) + return ret + + def get_ptr_by_expr(self, expr): + """"Return a pointer casted corresponding to ExprId expr. If it is not + already computed, compute it at the end of entry_bloc""" + + name = expr.name + + try: + # If the pointer has already been computed + ptr_casted = self.local_vars_pointers[name] + + except KeyError: + # Get current objects + builder = self.builder + current_bbl = builder.basic_block + + # Go at the right position + entry_bloc_bbl = self.entry_bbl + builder.position_at_end(entry_bloc_bbl) + + # Compute the pointer address + offset = self.llvm_context.vmcpu[name] + + # Pointer cast + ptr = builder.gep(self.local_vars["vmcpu"], + [llvm_c.Constant.int(LLVMType.int(), + offset)]) + int_size = LLVMType.int(expr.size) + ptr_casted = builder.bitcast(ptr, + llvm_c.PointerType.pointer(int_size)) + # Store in cache + self.local_vars_pointers[name] = ptr_casted + + # Reset builder + builder.position_at_end(current_bbl) + + return ptr_casted + + def clear_cache(self, regs_updated): + "Remove from the cache values which depends on regs_updated" + + regs_updated_set = set(regs_updated) + + for expr in self.expr_cache.keys(): + if expr.get_r(True).isdisjoint(regs_updated_set) is not True: + self.expr_cache.pop(expr) + + def update_cache(self, name, value): + "Add 'name' = 'value' to the cache iff main_stream = True" + + if self.main_stream is True: + self.expr_cache[name] = value + + def add_ir(self, expr): + "Add a Miasm2 IR to the last bbl. Return the var created" + + if self.main_stream is True and expr in self.expr_cache: + return self.expr_cache[expr] + + builder = self.builder + + if isinstance(expr, m2_expr.ExprInt): + ret = llvm_c.Constant.int(LLVMType.int(expr.size), int(expr.arg)) + self.update_cache(expr, ret) + return ret + + if isinstance(expr, m2_expr.ExprId): + name = expr.name + if not isinstance(name, str): + # Resolve label + offset = name.offset + ret = llvm_c.Constant.int(LLVMType.int(expr.size), offset) + self.update_cache(expr, ret) + return ret + + try: + # If expr.name is already known (args) + return self.local_vars[name] + except KeyError: + pass + + ptr_casted = self.get_ptr_by_expr(expr) + + var = builder.load(ptr_casted, name) + self.update_cache(expr, var) + return var + + if isinstance(expr, m2_expr.ExprOp): + op = expr.op + + if op == "parity": + fc_ptr = self.mod.get_function_named("parity") + arg = builder.zext(self.add_ir(expr.args[0]), + LLVMType.int()) + ret = builder.call(fc_ptr, [arg]) + ret = builder.trunc(ret, LLVMType.int(expr.size)) + self.update_cache(expr, ret) + return ret + + if op in ["<<<", ">>>"]: + fc_name = "rot_left" if op == "<<<" else "rot_right" + fc_ptr = self.mod.get_function_named(fc_name) + args = [self.add_ir(arg) for arg in expr.args] + arg_size = expr.args[0].size + if arg_size < 32: + # Cast args + args = [builder.zext(arg, LLVMType.int(32)) + for arg in args] + arg_size_cst = llvm_c.Constant.int(LLVMType.int(), + arg_size) + ret = builder.call(fc_ptr, [arg_size_cst] + args) + if arg_size < 32: + # Cast ret + ret = builder.trunc(ret, LLVMType.int(arg_size)) + self.update_cache(expr, ret) + return ret + + if op == "bcdadd": + size = expr.args[0].size + fc_ptr = self.mod.get_function_named("bcdadd_%s" % size) + args = [self.add_ir(arg) for arg in expr.args] + ret = builder.call(fc_ptr, args) + self.update_cache(expr, ret) + return ret + + if op == "bcdadd_cf": + size = expr.args[0].size + fc_ptr = self.mod.get_function_named("bcdadd_cf_%s" % size) + args = [self.add_ir(arg) for arg in expr.args] + ret = builder.call(fc_ptr, args) + ret = builder.trunc(ret, LLVMType.int(expr.size)) + self.update_cache(expr, ret) + return ret + + if op == "-": + zero = llvm_c.Constant.int(LLVMType.int(expr.size), + 0) + ret = builder.sub(zero, self.add_ir(expr.args[0])) + self.update_cache(expr, ret) + return ret + + if op == "segm": + fc_ptr = self.mod.get_function_named("segm2addr") + args_casted = [builder.zext(self.add_ir(arg), LLVMType.int(64)) + for arg in expr.args] + args = [self.local_vars["vmcpu"]] + args_casted + ret = builder.call(fc_ptr, args) + ret = builder.trunc(ret, LLVMType.int(expr.size)) + self.update_cache(expr, ret) + return ret + + if op in ["imod", "idiv"]: + fc_ptr = self.mod.get_function_named( + "%s%s" % (op, expr.args[0].size)) + args_casted = [self.add_ir(arg) for arg in expr.args] + args = [self.local_vars["vmcpu"]] + args_casted + ret = builder.call(fc_ptr, args) + self.update_cache(expr, ret) + return ret + + if len(expr.args) > 1: + + if op == "*": + callback = builder.mul + elif op == "+": + callback = builder.add + elif op == "&": + callback = builder.and_ + elif op == "^": + callback = builder.xor + elif op == "|": + callback = builder.or_ + elif op == ">>": + callback = builder.lshr + elif op == "<<": + callback = builder.shl + elif op == "a>>": + callback = builder.ashr + elif op == "udiv": + callback = builder.udiv + elif op == "umod": + callback = builder.urem + else: + raise NotImplementedError('Unknown op: %s' % op) + + last = self.add_ir(expr.args[0]) + + for i in range(1, len(expr.args)): + last = callback(last, + self.add_ir(expr.args[i])) + + self.update_cache(expr, last) + + return last + + raise NotImplementedError() + + if isinstance(expr, m2_expr.ExprMem): + + fc_name = "MEM_LOOKUP_%02d" % expr.size + fc_ptr = self.mod.get_function_named(fc_name) + addr_casted = builder.zext(self.add_ir(expr.arg), + LLVMType.int(64)) + + ret = builder.call(fc_ptr, [self.local_vars["vmmngr"], + addr_casted]) + + self.update_cache(expr, ret) + return ret + + if isinstance(expr, m2_expr.ExprCond): + # Compute cond + cond = self.add_ir(expr.cond) + zero_casted = llvm_c.Constant.int(LLVMType.int(expr.cond.size), + 0) + condition_bool = builder.icmp(llvm_c.ICMP_NE, cond, + zero_casted) + + # Alloc return var + alloca = self.CreateEntryBlockAlloca(LLVMType.int(expr.size)) + + # Create bbls + branch_id = self.new_branch_name() + then_block = self.append_basic_block('then%s' % branch_id) + else_block = self.append_basic_block('else%s' % branch_id) + merge_block = self.append_basic_block('ifcond%s' % branch_id) + + builder.cbranch(condition_bool, then_block, else_block) + + # Deactivate object caching + current_main_stream = self.main_stream + self.main_stream = False + + # Then Bloc + builder.position_at_end(then_block) + then_value = self.add_ir(expr.src1) + builder.store(then_value, alloca) + builder.branch(merge_block) + + # Else Bloc + builder.position_at_end(else_block) + else_value = self.add_ir(expr.src2) + builder.store(else_value, alloca) + builder.branch(merge_block) + + # Merge bloc + builder.position_at_end(merge_block) + ret = builder.load(alloca) + + # Reactivate object caching + self.main_stream = current_main_stream + + self.update_cache(expr, ret) + return ret + + if isinstance(expr, m2_expr.ExprSlice): + + src = self.add_ir(expr.arg) + + # Remove trailing bits + if expr.start != 0: + to_shr = llvm_c.Constant.int(LLVMType.int(expr.arg.size), + expr.start) + shred = builder.lshr(src, + to_shr) + else: + shred = src + + # Remove leading bits + to_and = llvm_c.Constant.int(LLVMType.int(expr.arg.size), + (1 << (expr.stop - expr.start)) - 1) + anded = builder.and_(shred, + to_and) + + # Cast into e.size + ret = builder.trunc(anded, + LLVMType.int(expr.size)) + + self.update_cache(expr, ret) + return ret + + if isinstance(expr, m2_expr.ExprCompose): + + args = [] + + # Build each part + for arg in expr.args: + src, start, stop = arg + + # src & (stop - start) + src = self.add_ir(src) + src_casted = builder.zext(src, + LLVMType.int(expr.size)) + to_and = llvm_c.Constant.int(LLVMType.int(expr.size), + (1 << (stop - start)) - 1) + anded = builder.and_(src_casted, + to_and) + + if (start != 0): + # result << start + to_shl = llvm_c.Constant.int(LLVMType.int(expr.size), + start) + shled = builder.shl(anded, to_shl) + final = shled + else: + # Optimisation + final = anded + + args.append(final) + + # result = part1 | part2 | ... + last = args[0] + for i in xrange(1, len(expr.args)): + last = builder.or_(last, args[i]) + + self.update_cache(expr, last) + return last + + raise Exception("UnkownExpression", expr.__class__.__name__) + + def set_ret(self, var): + "Add a ret of var to the last bbl" + self.builder.ret(var) + + def from_expr(self, expr): + "Build the function from an expression" + + # Build function signature + args = expr.get_r(True) + for a in args: + if not isinstance(a, m2_expr.ExprMem): + self.my_args.append((a, LLVMType.int(a.size), a.name)) + + self.ret_type = LLVMType.int(expr.size) + + # Initialise the function + self.init_fc() + + ret = self.add_ir(expr) + + self.set_ret(ret) + + def affect(self, src, dst, add_new=True): + "Affect from M2 src to M2 dst. If add_new, add a suffix '_new' to dest" + + # Source + src = self.add_ir(src) + + # Destination + builder = self.builder + self.add_ir(m2_expr.ExprId("vmcpu")) + + if isinstance(dst, m2_expr.ExprId): + dst_name = dst.name + "_new" if add_new else dst.name + + ptr_casted = self.get_ptr_by_expr( + m2_expr.ExprId(dst_name, dst.size)) + builder.store(src, ptr_casted) + + elif isinstance(dst, m2_expr.ExprMem): + self.add_ir(dst.arg) + + # Function call + fc_name = "MEM_WRITE_%02d" % dst.size + fc_ptr = self.mod.get_function_named(fc_name) + dst = self.add_ir(dst.arg) + dst_casted = builder.zext(dst, LLVMType.int(64)) + builder.call(fc_ptr, [self.local_vars["vmmngr"], + dst_casted, + src]) + + else: + raise Exception("UnknownAffectationType") + + def check_error(self, line, except_do_not_update_pc=False): + """Add a check for memory errors. + @line: Irbloc line corresponding to the current instruction + If except_do_not_update_pc, check only for exception which do not + require a pc update""" + + # VmMngr "get_exception_flag" return's size + size = 64 + t_size = LLVMType.int(size) + + # Current address + pc_to_return = line.offset + + # Get exception flag value + builder = self.builder + fc_ptr = self.mod.get_function_named("get_exception_flag") + exceptionflag = builder.call(fc_ptr, [self.local_vars["vmmngr"]]) + + if except_do_not_update_pc is True: + auto_mod_flag = m2_csts.EXCEPT_DO_NOT_UPDATE_PC + m2_flag = llvm_c.Constant.int(t_size, auto_mod_flag) + exceptionflag = builder.and_(exceptionflag, m2_flag) + + # Compute cond + zero_casted = llvm_c.Constant.int(t_size, 0) + condition_bool = builder.icmp(llvm_c.ICMP_NE, + exceptionflag, + zero_casted) + + # Create bbls + branch_id = self.new_branch_name() + then_block = self.append_basic_block('then%s' % branch_id) + merge_block = self.append_basic_block('ifcond%s' % branch_id) + + builder.cbranch(condition_bool, then_block, merge_block) + + # Deactivate object caching + current_main_stream = self.main_stream + self.main_stream = False + + # Then Bloc + builder.position_at_end(then_block) + builder.ret(llvm_c.Constant.int(self.ret_type, pc_to_return)) + + builder.position_at_end(merge_block) + + # Reactivate object caching + self.main_stream = current_main_stream + + def log_instruction(self, instruction, line): + "Print current instruction and registers if options are set" + + # Get builder + builder = self.builder + + if self.log_mn is True: + print instruction # TODO + + if self.log_regs is True: + # Call dump general purpose registers + fc_ptr = self.mod.get_function_named("dump_gpregs") + builder.call(fc_ptr, [self.local_vars["vmcpu"]]) + + def add_bloc(self, bloc, lines): + "Add a bloc of instruction in the current function" + + for instruction, line in zip(bloc, lines): + new_reg = set() + + # Check general errors only at the beggining of instruction + if line.offset not in self.offsets_jitted: + self.offsets_jitted.add(line.offset) + self.check_error(line) + + # Log mn and registers if options is set + self.log_instruction(instruction, line) + + + # Pass on empty instruction + if len(instruction) == 0: + continue + + for expression in instruction: + # Apply preinit transformation + for func in self.llvm_context.IR_transformation_functions: + expression = func(expression) + + # Treat current expression + self.affect(expression.src, expression.dst) + + # Save registers updated + new_reg.update(expression.dst.get_w()) + + # Check for errors (without updating PC) + self.check_error(line, except_do_not_update_pc=True) + + # new -> normal + reg_written = [] + for r in new_reg: + if isinstance(r, m2_expr.ExprId): + r_new = m2_expr.ExprId(r.name + "_new", r.size) + reg_written += [r, r_new] + self.affect(r_new, r, add_new=False) + + # Clear cache + self.clear_cache(reg_written) + self.main_stream = True + + def from_bloc(self, bloc, final_expr): + """Build the function from a bloc, with the dst equation. + Prototype : f(i8* vmcpu, i8* vmmngr)""" + + # Build function signature + self.my_args.append((m2_expr.ExprId("vmcpu"), + llvm_c.PointerType.pointer(LLVMType.int(8)), + "vmcpu")) + self.my_args.append((m2_expr.ExprId("vmmngr"), + llvm_c.PointerType.pointer(LLVMType.int(8)), + "vmmngr")) + self.ret_type = LLVMType.int(final_expr.size) + + # Initialise the function + self.init_fc() + + # Add content + self.add_bloc(bloc, []) + + # Finalise the function + self.set_ret(self.add_ir(final_expr)) + + raise NotImplementedError("Not tested") + + def canonize_label_name(self, label): + """Canonize @label names to a common form. + @label: str or asmlabel instance""" + if isinstance(label, str): + return label + elif isinstance(label, m2_asmbloc.asm_label): + return "label_%s" % label.name + else: + raise ValueError("label must either be str or asmlabel") + + def get_basic_bloc_by_label(self, label): + "Return the bbl corresponding to label, None otherwise" + return self.name2bbl.get(self.canonize_label_name(label), None) + + def gen_ret_or_branch(self, dest): + """Manage the dest ExprId. If label, branch on it if it is known. + Otherwise, return the ExprId or the offset value""" + + builder = self.builder + + if isinstance(dest, m2_expr.ExprId): + dest_name = dest.name + elif isinstance(dest, m2_expr.ExprSlice) and \ + isinstance(dest.arg, m2_expr.ExprId): + # Manage ExprId mask case + dest_name = dest.arg.name + else: + raise ValueError() + + if not isinstance(dest_name, str): + label = dest_name + target_bbl = self.get_basic_bloc_by_label(label) + if target_bbl is None: + builder.ret(self.add_ir(dest)) + else: + builder.branch(target_bbl) + else: + builder.ret(self.add_ir(dest)) + + def add_irbloc(self, irbloc): + "Add the content of irbloc at the corresponding labeled block" + builder = self.builder + + bloc = irbloc.irs + dest = irbloc.dst + label = irbloc.label + lines = irbloc.lines + + # Get labeled basic bloc + label_block = self.get_basic_bloc_by_label(label) + builder.position_at_end(label_block) + + # Erase cache + self.expr_cache = {} + + # Add the content of the bloc with corresponding lines + self.add_bloc(bloc, lines) + + # Erase cache + self.expr_cache = {} + + # Manage ret + for func in self.llvm_context.IR_transformation_functions: + dest = func(dest) + + if isinstance(dest, m2_expr.ExprCond): + # Compute cond + cond = self.add_ir(dest.cond) + zero_casted = llvm_c.Constant.int(LLVMType.int(dest.cond.size), + 0) + condition_bool = builder.icmp(llvm_c.ICMP_NE, cond, + zero_casted) + + # Create bbls + branch_id = self.new_branch_name() + then_block = self.append_basic_block('then%s' % branch_id) + else_block = self.append_basic_block('else%s' % branch_id) + + builder.cbranch(condition_bool, then_block, else_block) + + # Then Bloc + builder.position_at_end(then_block) + self.gen_ret_or_branch(dest.src1) + + # Else Bloc + builder.position_at_end(else_block) + self.gen_ret_or_branch(dest.src2) + + elif isinstance(dest, m2_expr.ExprId): + self.gen_ret_or_branch(dest) + + elif isinstance(dest, m2_expr.ExprSlice): + self.gen_ret_or_branch(dest) + + else: + raise Exception("Bloc dst has to be an ExprId or an ExprCond") + + def from_blocs(self, blocs): + """Build the function from a list of bloc (irbloc instances). + Prototype : f(i8* vmcpu, i8* vmmngr)""" + + # Build function signature + self.my_args.append((m2_expr.ExprId("vmcpu"), + llvm_c.PointerType.pointer(LLVMType.int(8)), + "vmcpu")) + self.my_args.append((m2_expr.ExprId("vmmngr"), + llvm_c.PointerType.pointer(LLVMType.int(8)), + "vmmngr")) + ret_size = blocs[0].dst.size + + self.ret_type = LLVMType.int(ret_size) + + # Initialise the function + self.init_fc() + + # Create basic blocks (for label branchs) + entry_bbl, builder = self.entry_bbl, self.builder + + for irbloc in blocs: + name = self.canonize_label_name(irbloc.label) + self.append_basic_block(name) + + # Add content + builder.position_at_end(entry_bbl) + + for irbloc in blocs: + self.add_irbloc(irbloc) + + # Branch entry_bbl on first label + builder.position_at_end(entry_bbl) + first_label_bbl = self.get_basic_bloc_by_label(blocs[0].label) + builder.branch(first_label_bbl) + + def __str__(self): + "Print the llvm IR corresponding to the current module" + + return str(self.fc) + + def verify(self): + "Verify the module syntax" + + return self.mod.verify() + + def get_assembly(self): + "Return native assembly corresponding to the current module" + + return self.mod.to_native_assembly() + + def optimise(self): + "Optimise the function in place" + while self.llvm_context.pass_manager.run(self.fc): + continue + + def __call__(self, *args): + "Eval the function with arguments args" + + e = self.llvm_context.get_execengine() + + genargs = [LLVMType.generic(a) for a in args] + ret = e.run_function(self.fc, genargs) + + return ret.as_int() + + def get_function_pointer(self): + "Return a pointer on the Jitted function" + e = self.llvm_context.get_execengine() + + return e.get_pointer_to_function(self.fc) + +# TODO: +# - Add more expressions diff --git a/miasm2/jitter/os_dep/__init__.py b/miasm2/jitter/os_dep/__init__.py new file mode 100644 index 00000000..e69de29b --- /dev/null +++ b/miasm2/jitter/os_dep/__init__.py diff --git a/miasm2/jitter/os_dep/linux_stdlib.py b/miasm2/jitter/os_dep/linux_stdlib.py new file mode 100644 index 00000000..0a1e0bfb --- /dev/null +++ b/miasm2/jitter/os_dep/linux_stdlib.py @@ -0,0 +1,78 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from sys import stdout +from string import printable + + +def xxx_isprint(jitter): + ''' + #include <ctype.h> + int isprint(int c); + + checks for any printable character including space. + ''' + c, = jitter.func_args_fastcall(1) + ret = chr(c & 0xFF) in printable and 1 or 0 + return jitter.func_ret_fastcall(ret) + + +def xxx_memcpy(jitter): + ''' + #include <string.h> + void *memcpy(void *dest, const void *src, size_t n); + + copies n bytes from memory area src to memory area dest. + ''' + dest, src, n, = jitter.func_args_fastcall(3) + jitter.vm.vm_set_mem(dest, jitter.vm.vm_get_mem(src, n)) + return jitter.func_ret_fastcall(dest) + + +def xxx_puts(jitter): + ''' + #include <stdio.h> + int puts(const char *s); + + writes the string s and a trailing newline to stdout. + ''' + s, = jitter.func_args_fastcall(1) + while True: + c = jitter.vm.vm_get_mem(s, 1) + s += 1 + if c == '\x00': + break + stdout.write(c) + stdout.write('\n') + return jitter.func_ret_fastcall(1) + + +def xxx_snprintf(jitter): + ''' + #include <stdio.h> + int snprintf(char *str, size_t size, const char *format, ...); + + writes to string str according to format format and at most size bytes. + ''' + str, size, format, = jitter.func_args_fastcall(3) + curarg, output = 4, '' + while True: + c = jitter.vm.vm_get_mem(format, 1) + format += 1 + if c == '\x00': + break + if c == '%': + token = '%' + while True: + c = jitter.vm.vm_get_mem(format, 1) + format += 1 + token += c + if c in '%cdfsux': + break + c = token % jitter.func_args_fastcall(curarg)[-1] + curarg += 1 + output += c + output = output[:size - 1] + ret = len(output) + jitter.vm.vm_set_mem(str, output + '\x00') + return jitter.func_ret_fastcall(ret) diff --git a/miasm2/jitter/os_dep/win_api_x86_32.py b/miasm2/jitter/os_dep/win_api_x86_32.py new file mode 100644 index 00000000..b6813efc --- /dev/null +++ b/miasm2/jitter/os_dep/win_api_x86_32.py @@ -0,0 +1,3069 @@ +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +import struct +try: + from Crypto.Hash import MD5, SHA +except ImportError: + print "cannot find crypto, skipping" +import inspect +from zlib import crc32 +import os +import stat +import time +from miasm2.jitter.csts import * +from miasm2.core.utils import * +import string + + +MAX_PATH = 260 + + +def get_next_alloc_addr(size): + global alloc_ad + ret = winobjs.alloc_ad + winobjs.alloc_ad = (winobjs.alloc_ad + size + winobjs.alloc_align - 1) + winobjs.alloc_ad &= (0xffffffff ^ (winobjs.alloc_align - 1)) + return ret + + +def alloc_mem(myjit, msize): + alloc_addr = get_next_alloc_addr(msize) + myjit.vm.vm_add_memory_page( + alloc_addr, PAGE_READ | PAGE_WRITE, "\x00" * msize) + return alloc_addr + +""" +typedef struct tagPROCESSENTRY32 { + DWORD dwSize; + DWORD cntUsage; + DWORD th32ProcessID; + ULONG_PTR th32DefaultHeapID; + DWORD th32ModuleID; + DWORD cntThreads; + DWORD th32ParentProcessID; + LONG pcPriClassBase; + DWORD dwFlags; + TCHAR szExeFile[MAX_PATH]; +} PROCESSENTRY32, *PPROCESSENTRY32; +""" + + +access_dict = {0x0: 0, + 0x1: 0, + 0x2: PAGE_READ, + 0x4: PAGE_READ | PAGE_WRITE, + 0x10: PAGE_EXEC, + 0x20: PAGE_EXEC | PAGE_READ, + 0x40: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + 0x80: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + # 0x80: PAGE_EXECUTE_WRITECOPY + 0x100: 0 + } + +access_dict_inv = dict([(x[1], x[0]) for x in access_dict.items()]) + + +class whandle(): + + def __init__(self, name, info): + self.name = name + self.info = info + + def __repr__(self): + return '<%r %r %r>' % (self.__class__.__name__, self.name, self.info) + + +class handle_generator(): + + def __init__(self): + self.offset = 600 + self.all_handles = {} + + def add(self, name, info=None): + self.offset += 1 + h = whandle(name, info) + self.all_handles[self.offset] = h + + print repr(self) + return self.offset + + def __repr__(self): + out = '<%r\n' % self.__class__.__name__ + ks = self.all_handles.keys() + ks.sort() + + for k in ks: + out += " %r %r\n" % (k, self.all_handles[k]) + out += '>' + return out + + def __contains__(self, e): + return e in self.all_handles + + def __getitem__(self, item): + return self.all_handles.__getitem__(item) + + def __delitem__(self, item): + self.all_handles.__delitem__(item) + + +class c_winobjs: + + def __init__(self): + self.alloc_ad = 0x20000000 + self.alloc_align = 0x1000 + self.handle_toolhelpsnapshot = 0xaaaa00 + self.toolhelpsnapshot_info = {} + self.handle_curprocess = 0xaaaa01 + self.dbg_present = 0 + self.tickcount = 0 + self.dw_pid_dummy1 = 0x111 + self.dw_pid_explorer = 0x222 + self.dw_pid_dummy2 = 0x333 + self.dw_pid_cur = 0x444 + self.module_fname_nux = None + self.module_name = "test.exe" + self.module_path = "c:\\mydir\\" + self.module_name + self.hcurmodule = None + self.module_filesize = None + self.getversion = 0x0A280105 + self.getforegroundwindow = 0x333333 + self.cryptcontext_hwnd = 0x44400 + self.cryptcontext_bnum = 0x44000 + self.cryptcontext_num = 0 + self.cryptcontext = {} + self.phhash_crypt_md5 = 0x55555 + self.files_hwnd = {} + self.windowlong_dw = 0x77700 + self.module_cur_hwnd = 0x88800 + self.module_file_nul = 0x999000 + self.runtime_dll = None + self.current_pe = None + self.tls_index = 0xf + self.tls_values = {} + self.handle_pool = handle_generator() + self.handle_mapped = {} + self.hkey_handles = {0x80000001: "hkey_current_user"} + + self.nt_mdl = {} + self.nt_mdl_ad = None + self.nt_mdl_cur = 0 + self.win_event_num = 0x13370 + self.cryptdll_md5_h = {} + + self.lastwin32error = 0 + self.mutex = {} + self.env_variables = {} + self.events_pool = {} + self.find_data = None +winobjs = c_winobjs() + + +process_list = [ + [ + 0x40, # DWORD dwSize; + 0, # DWORD cntUsage; + winobjs.dw_pid_dummy1, # DWORD th32ProcessID; + 0x11111111, # ULONG_PTR th32DefaultHeapID; + 0x11111112, # DWORD th32ModuleID; + 1, # DWORD cntThreads; + winobjs.dw_pid_explorer, # DWORD th32ParentProcessID; + 0xbeef, # LONG pcPriClassBase; + 0x0, # DWORD dwFlags; + "dummy1.exe" # TCHAR szExeFile[MAX_PATH]; + ], + [ + 0x40, # DWORD dwSize; + 0, # DWORD cntUsage; + winobjs.dw_pid_explorer, # DWORD th32ProcessID; + 0x11111111, # ULONG_PTR th32DefaultHeapID; + 0x11111112, # DWORD th32ModuleID; + 1, # DWORD cntThreads; + 4, # DWORD th32ParentProcessID; + 0xbeef, # LONG pcPriClassBase; + 0x0, # DWORD dwFlags; + "explorer.exe" # TCHAR szExeFile[MAX_PATH]; + ], + + [ + 0x40, # DWORD dwSize; + 0, # DWORD cntUsage; + winobjs.dw_pid_dummy2, # DWORD th32ProcessID; + 0x11111111, # ULONG_PTR th32DefaultHeapID; + 0x11111112, # DWORD th32ModuleID; + 1, # DWORD cntThreads; + winobjs.dw_pid_explorer, # DWORD th32ParentProcessID; + 0xbeef, # LONG pcPriClassBase; + 0x0, # DWORD dwFlags; + "dummy2.exe" # TCHAR szExeFile[MAX_PATH]; + ], + + [ + 0x40, # DWORD dwSize; + 0, # DWORD cntUsage; + winobjs.dw_pid_cur, # DWORD th32ProcessID; + 0x11111111, # ULONG_PTR th32DefaultHeapID; + 0x11111112, # DWORD th32ModuleID; + 1, # DWORD cntThreads; + winobjs.dw_pid_explorer, # DWORD th32ParentProcessID; + 0xbeef, # LONG pcPriClassBase; + 0x0, # DWORD dwFlags; + winobjs.module_name # TCHAR szExeFile[MAX_PATH]; + ], + + +] + + +def whoami(): + return inspect.stack()[1][3] + + +class hobj: + pass + + +class mdl: + + def __init__(self, ad, l): + self.ad = ad + self.l = l + + def __str__(self): + return struct.pack('LL', self.ad, self.l) + + +def get_str_ansi(myjit, ad_str, max_char=None): + l = 0 + tmp = ad_str + while ((max_char is None or l < max_char) and + myjit.vm.vm_get_mem(tmp, 1) != "\x00"): + tmp += 1 + l += 1 + return myjit.vm.vm_get_mem(ad_str, l) + + +def get_str_unic(myjit, ad_str, max_char=None): + l = 0 + tmp = ad_str + while ((max_char is None or l < max_char) and + myjit.vm.vm_get_mem(tmp, 2) != "\x00\x00"): + tmp += 2 + l += 2 + s = myjit.vm.vm_get_mem(ad_str, l) + s = s[::2] # TODO: real unicode decoding + return s + + +def set_str_ansi(s): + return s + "\x00" + + +def set_str_unic(s): + return "\x00".join(list(s)) + '\x00' * 3 + + +def kernel32_HeapAlloc(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + heap, flags, size = args + + alloc_addr = alloc_mem(myjit, size) + + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_HeapFree(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + heap, flags, pmem = args + + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_GlobalAlloc(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + uflags, msize = args + alloc_addr = get_next_alloc_addr(msize) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_LocalFree(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + lpvoid, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_LocalAlloc(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + uflags, msize = args + alloc_addr = alloc_mem(myjit, msize) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_GlobalFree(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ad, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_IsDebuggerPresent(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.dbg_present) + + +def kernel32_CreateToolhelp32Snapshot(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + dwflags, th32processid = args + myjit.func_ret_stdcall(ret_ad, winobjs.handle_toolhelpsnapshot) + + +def kernel32_GetCurrentProcess(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.handle_curprocess) + + +def kernel32_GetCurrentProcessId(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.dw_pid_cur) + + +def kernel32_Process32First(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + s_handle, ad_pentry = args + + pentry = struct.pack( + 'IIIIIIIII', *process_list[0][:-1]) + process_list[0][-1] + myjit.vm.vm_set_mem(ad_pentry, pentry) + winobjs.toolhelpsnapshot_info[s_handle] = 0 + + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_Process32Next(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + s_handle, ad_pentry = args + + winobjs.toolhelpsnapshot_info[s_handle] += 1 + if winobjs.toolhelpsnapshot_info[s_handle] >= len(process_list): + ret = 0 + else: + ret = 1 + n = winobjs.toolhelpsnapshot_info[s_handle] + print whoami(), hex(ret_ad), '(', hex(s_handle), hex(ad_pentry), ')' + pentry = struct.pack( + 'IIIIIIIII', *process_list[n][:-1]) + process_list[n][-1] + myjit.vm.vm_set_mem(ad_pentry, pentry) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetTickCount(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + winobjs.tickcount += 1 + myjit.func_ret_stdcall(ret_ad, winobjs.tickcount) + + +def kernel32_GetVersion(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.getversion) + + +def my_GetVersionEx(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(1) + ptr_struct, = args + + s = struct.pack("IIIII", + 0x114, # struct size + 0x5, # maj vers + 0x2, # min vers + 0xa28, # build nbr + 0x2, # platform id + ) + t = set_str("Service pack 4") + t = s + (t + '\x00' * 128 * 2)[:128 * 2] + t += struct.pack('HHHBB', 3, 0, 0x100, 1, 0) + s = t + myjit.vm.vm_set_mem(ptr_struct, s) + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetVersionExA(myjit): + my_GetVersionEx(myjit, whoami(), set_str_ansi) + + +def kernel32_GetVersionExW(myjit): + my_GetVersionEx(myjit, whoami(), set_str_unic) + + +def kernel32_GetPriorityClass(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hwnd, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_SetPriorityClass(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + hwnd, dwpclass = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_CloseHandle(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hwnd, = args + myjit.func_ret_stdcall(ret_ad, 1) + + +def user32_GetForegroundWindow(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.getforegroundwindow) + + +def user32_FindWindowA(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + pclassname, pwindowname = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def user32_GetTopWindow(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hwnd, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def user32_BlockInput(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + b, = args + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptAcquireContext(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(5) + phprov, pszcontainer, pszprovider, dwprovtype, dwflags = args + + if pszprovider: + prov = get_str(myjit, pszprovider) + else: + prov = "NONE" + print 'prov:', prov + myjit.vm.vm_set_mem(phprov, pck32(winobjs.cryptcontext_hwnd)) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptAcquireContextA(myjit): + advapi32_CryptAcquireContext(myjit, whoami(), get_str_ansi) + + +def advapi32_CryptAcquireContextW(myjit): + advapi32_CryptAcquireContext(myjit, whoami(), get_str_unic) + + +def advapi32_CryptCreateHash(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hprov, algid, hkey, dwflags, phhash = args + + winobjs.cryptcontext_num += 1 + + if algid == 0x00008003: + print 'algo is MD5' + myjit.vm.vm_set_mem( + phhash, pck32(winobjs.cryptcontext_bnum + winobjs.cryptcontext_num)) + winobjs.cryptcontext[ + winobjs.cryptcontext_bnum + winobjs.cryptcontext_num] = hobj() + winobjs.cryptcontext[ + winobjs.cryptcontext_bnum + winobjs.cryptcontext_num].h = MD5.new() + elif algid == 0x00008004: + print 'algo is SHA1' + myjit.vm.vm_set_mem( + phhash, pck32(winobjs.cryptcontext_bnum + winobjs.cryptcontext_num)) + winobjs.cryptcontext[ + winobjs.cryptcontext_bnum + winobjs.cryptcontext_num] = hobj() + winobjs.cryptcontext[ + winobjs.cryptcontext_bnum + winobjs.cryptcontext_num].h = SHA.new() + else: + raise ValueError('un impl algo1') + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptHashData(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + hhash, pbdata, dwdatalen, dwflags = args + + if not hhash in winobjs.cryptcontext: + raise ValueError("unknown crypt context") + + data = myjit.vm.vm_get_mem(pbdata, dwdatalen) + print 'will hash %X' % dwdatalen + print repr(data[:10]) + "..." + winobjs.cryptcontext[hhash].h.update(data) + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptGetHashParam(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hhash, param, pbdata, dwdatalen, dwflags = args + + if not hhash in winobjs.cryptcontext: + raise ValueError("unknown crypt context") + + if param == 2: + # XXX todo: save h state? + h = winobjs.cryptcontext[hhash].h.digest() + else: + raise ValueError('not impl', param) + myjit.vm.vm_set_mem(pbdata, h) + myjit.vm.vm_set_mem(dwdatalen, pck32(len(h))) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptReleaseContext(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + hhash, flags = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def advapi32_CryptDeriveKey(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hprov, algid, hbasedata, dwflags, phkey = args + + if algid == 0x6801: + print 'using DES' + else: + raise ValueError('un impl algo2') + h = winobjs.cryptcontext[hbasedata].h.digest() + print 'hash', repr(h) + winobjs.cryptcontext[hbasedata].h_result = h + myjit.vm.vm_set_mem(phkey, pck32(hbasedata)) + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptDestroyHash(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hhash, = args + myjit.func_ret_stdcall(ret_ad, 1) + + +def advapi32_CryptDecrypt(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hkey, hhash, final, dwflags, pbdata, pdwdatalen = args + raise NotImplementedError() + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_CreateFile(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(7) + (lpfilename, access, dwsharedmode, lpsecurityattr, + dwcreationdisposition, dwflagsandattr, htemplatefile) = args + + fname = get_str(myjit, lpfilename) + print 'fname', fname + fname_o = fname[:] + ret = 0xffffffff + + # test if file is original binary + f = fname_o + """ + if "\\" in fname_o: + f = fname_o[fname_o.rfind('\\')+1:] + else: + f = fname_o + """ + print f.lower(), winobjs.module_path.lower() + is_original_file = f.lower() == winobjs.module_path.lower() + + if fname.upper() in [r"\\.\SICE", r"\\.\NTICE", r"\\.\SIWVID"]: + pass + elif fname.upper() in ['NUL']: + ret = winobjs.module_cur_hwnd + else: + # nuxify path + fname = fname.replace('\\', "/").lower() + # go in sandbox files + f = os.path.join('file_sb', fname) + if access & 0x80000000: + # read + if dwcreationdisposition == 2: + # create_always + if os.access(f, os.R_OK): + # but file exist + pass + else: + raise NotImplementedError("Untested case") # to test + h = open(f, 'rb+') + elif dwcreationdisposition == 3: + # open_existing + if os.access(f, os.R_OK): + s = os.stat(f) + if stat.S_ISDIR(s.st_mode): + ret = winobjs.handle_pool.add(f, 0x1337) + else: + h = open(f, 'rb+') + ret = winobjs.handle_pool.add(f, h) + else: + print "FILE %r DOES NOT EXIST!" % fname + pass + elif dwcreationdisposition == 1: + # create new + if os.access(f, os.R_OK): + # file exist + # ret = 80 + winobjs.lastwin32error = 80 + pass + else: + open(f, 'w') + h = open(f, 'rb+') + ret = winobjs.handle_pool.add(f, h) + else: + raise NotImplementedError("Untested case") + elif access & 0x40000000: + # write + if dwcreationdisposition == 3: + # open existing + if is_original_file: + # cannot open self in write mode! + pass + elif os.access(f, os.R_OK): + s = os.stat(f) + if stat.S_ISDIR(s.st_mode): + # open dir + ret = winobjs.handle_pool.add(f, 0x1337) + else: + h = open(f, 'rb+') + ret = winobjs.handle_pool.add(f, h) + else: + raise NotImplementedError("Untested case") # to test + elif dwcreationdisposition == 5: + # truncate_existing + if is_original_file: + pass + else: + raise NotImplementedError("Untested case") # to test + else: + # raise NotImplementedError("Untested case") # to test + h = open(f, 'w') + ret = winobjs.handle_pool.add(f, h) + else: + raise NotImplementedError("Untested case") + + # h = open(f, 'rb+') + # ret = winobjs.handle_pool.add(f, h) + print 'ret', hex(ret) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_CreateFileA(myjit): + kernel32_CreateFile(myjit, whoami(), get_str_ansi) + + +def kernel32_CreateFileW(myjit): + kernel32_CreateFile(myjit, whoami(), lambda x, y: get_str_unic(myjit, y)) + + +def kernel32_ReadFile(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + (hwnd, lpbuffer, nnumberofbytestoread, + lpnumberofbytesread, lpoverlapped) = args + + if hwnd == winobjs.module_cur_hwnd: + pass + elif hwnd in winobjs.handle_pool: + pass + else: + raise ValueError('unknown hwnd!') + + eax = 0xffffffff + data = None + if hwnd in winobjs.files_hwnd: + data = winobjs.files_hwnd[ + winobjs.module_cur_hwnd].read(nnumberofbytestoread) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + data = wh.info.read(nnumberofbytestoread) + else: + raise ValueError('unknown filename') + + if data is not None: + if (lpnumberofbytesread): + myjit.vm.vm_set_mem(lpnumberofbytesread, pck32(len(data))) + myjit.vm.vm_set_mem(lpbuffer, data) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetFileSize(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + hwnd, lpfilesizehight = args + + if hwnd == winobjs.module_cur_hwnd: + ret = len(open(winobjs.module_fname_nux).read()) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + print wh + ret = len(open(wh.name).read()) + else: + raise ValueError('unknown hwnd!') + + if lpfilesizehight != 0: + myjit.vm.vm_set_mem(lpfilesizehight, pck32(ret)) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetFileSizeEx(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + hwnd, lpfilesizehight = args + + if hwnd == winobjs.module_cur_hwnd: + l = len(open(winobjs.module_fname_nux).read()) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + print wh + l = len(open(wh.name).read()) + else: + raise ValueError('unknown hwnd!') + + if lpfilesizehight == 0: + raise NotImplementedError("Untested case") + myjit.vm.vm_set_mem(lpfilesizehight, pck32( + l & 0xffffffff) + pck32((l >> 32) & 0xffffffff)) + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_FlushInstructionCache(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + hprocess, lpbasead, dwsize = args + myjit.func_ret_stdcall(ret_ad, 0x1337) + + +def kernel32_VirtualProtect(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + lpvoid, dwsize, flnewprotect, lpfloldprotect = args + + # XXX mask hpart + flnewprotect &= 0xFFF + + if not flnewprotect in access_dict: + raise ValueError('unknown access dw!') + myjit.vm.vm_set_mem_access(lpvoid, access_dict[flnewprotect]) + + # XXX todo real old protect + if lpfloldprotect: + myjit.vm.vm_set_mem(lpfloldprotect, pck32(0x40)) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_VirtualAlloc(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + lpvoid, dwsize, alloc_type, flprotect = args + + access_dict = {0x0: 0, + 0x1: 0, + 0x2: PAGE_READ, + 0x4: PAGE_READ | PAGE_WRITE, + 0x10: PAGE_EXEC, + 0x20: PAGE_EXEC | PAGE_READ, + 0x40: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + 0x100: 0 + } + + access_dict_inv = dict([(x[1], x[0]) for x in access_dict.items()]) + + if not flprotect in access_dict: + raise ValueError('unknown access dw!') + + if lpvoid == 0: + alloc_addr = get_next_alloc_addr(dwsize) + myjit.vm.vm_add_memory_page( + alloc_addr, access_dict[flprotect], "\x00" * dwsize) + else: + all_mem = myjit.vm.vm_get_all_memory() + if lpvoid in all_mem: + alloc_addr = lpvoid + myjit.vm.vm_set_mem_access(lpvoid, access_dict[flprotect]) + else: + alloc_addr = get_next_alloc_addr(dwsize) + # alloc_addr = lpvoid + myjit.vm.vm_add_memory_page( + alloc_addr, access_dict[flprotect], "\x00" * dwsize) + + print 'Memory addr:', hex(alloc_addr) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_VirtualFree(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + lpvoid, dwsize, alloc_type = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def user32_GetWindowLongA(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + hwnd, nindex = args + myjit.func_ret_stdcall(ret_ad, winobjs.windowlong_dw) + + +def user32_SetWindowLongA(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + hwnd, nindex, newlong = args + myjit.func_ret_stdcall(ret_ad, winobjs.windowlong_dw) + + +def kernel32_GetModuleFileName(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(3) + hmodule, lpfilename, nsize = args + + if hmodule in [0, winobjs.hcurmodule]: + p = winobjs.module_path[:] + elif (winobjs.runtime_dll and + hmodule in winobjs.runtime_dll.name2off.values()): + name_inv = dict([(x[1], x[0]) + for x in winobjs.runtime_dll.name2off.items()]) + p = name_inv[hmodule] + else: + print ValueError('unknown module h', hex(hmodule)) + p = None + + if p is None: + l = 0 + elif nsize < len(p): + p = p[:nsize] + l = len(p) + else: + l = len(p) + + print repr(p) + if p: + myjit.vm.vm_set_mem(lpfilename, set_str(p)) + + myjit.func_ret_stdcall(ret_ad, l) + + +def kernel32_GetModuleFileNameA(myjit): + kernel32_GetModuleFileName(myjit, whoami(), set_str_ansi) + + +def kernel32_GetModuleFileNameW(myjit): + kernel32_GetModuleFileName(myjit, whoami(), set_str_unic) + + +def kernel32_CreateMutex(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(3) + print funcname + mutexattr, initowner, lpname = args + + if lpname: + name = get_str(myjit, lpname) + print repr(name) + else: + name = None + if initowner: + if name in winobjs.mutex: + raise NotImplementedError("Untested case") + ret = 0 + else: + winobjs.mutex[name] = id(name) + ret = winobjs.mutex[name] + else: + if name in winobjs.mutex: + raise NotImplementedError("Untested case") + ret = 0 + else: + winobjs.mutex[name] = id(name) + ret = winobjs.mutex[name] + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_CreateMutexA(myjit): + kernel32_CreateMutex(myjit, whoami(), get_str_ansi) + + +def kernel32_CreateMutexW(myjit): + kernel32_CreateMutex(myjit, whoami(), get_str_unic) + + +def shell32_SHGetSpecialFolderLocation(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + hwndowner, nfolder, ppidl = args + myjit.vm.vm_set_mem(ppidl, pck32(nfolder)) + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_SHGetPathFromIDList(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(2) + pidl, ppath = args + + if pidl == 7: # CSIDL_STARTUP: + s = "c:\\doc\\user\\startmenu\\programs\\startup" + s = set_str(s) + else: + raise ValueError('pidl not implemented', pidl) + myjit.vm.vm_set_mem(ppath, s) + myjit.func_ret_stdcall(ret_ad, 1) + + +def shell32_SHGetPathFromIDListW(myjit): + kernel32_SHGetPathFromIDList(myjit, whoami(), set_str_unic) + + +def shell32_SHGetPathFromIDListA(myjit): + kernel32_SHGetPathFromIDList(myjit, whoami(), set_str_ansi) + + +def kernel32_GetLastError(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, winobjs.lastwin32error) + + +def kernel32_SetLastError(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + e, = args + # lasterr addr + # ad = seh_helper.FS_0_AD + 0x34 + # myjit.vm.vm_set_mem(ad, pck32(e)) + winobjs.lastwin32error = e + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_RestoreLastError(myjit): + kernel32_SetLastError(myjit) + + +def kernel32_LoadLibraryA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + dllname, = args + + libname = get_str_ansi(myjit, dllname, 0x100) + print repr(libname) + + ret = winobjs.runtime_dll.lib_get_add_base(libname) + print "ret", hex(ret) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_LoadLibraryExA(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + dllname, hfile, flags = args + + if hfile != 0: + raise NotImplementedError("Untested case") + libname = get_str_ansi(myjit, dllname, 0x100) + print repr(libname) + + ret = winobjs.runtime_dll.lib_get_add_base(libname) + print "ret", hex(ret) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetProcAddress(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + libbase, fname = args + fname = fname & 0xFFFFFFFF + if fname < 0x10000: + fname = fname + else: + fname = get_str_ansi(myjit, fname, 0x100) + if not fname: + fname = None + print repr(fname) + if fname is not None: + ad = winobjs.runtime_dll.lib_get_add_func(libbase, fname) + else: + ad = 0 + ad = winobjs.runtime_dll.lib_get_add_func(libbase, fname) + + myjit.func_ret_stdcall(ret_ad, ad) + + +def kernel32_LoadLibraryW(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + dllname, = args + + libname = get_str_unic(myjit, dllname, 0x100) + print repr(libname) + + ret = winobjs.runtime_dll.lib_get_add_base(libname) + print "ret", hex(ret) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetModuleHandle(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(1) + dllname, = args + + if dllname: + libname = get_str(myjit, dllname) + print repr(libname) + if libname: + ret = winobjs.runtime_dll.lib_get_add_base(libname) + else: + print 'unknown module!' + ret = 0 + else: + ret = winobjs.current_pe.NThdr.ImageBase + print "default img base", hex(ret) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetModuleHandleA(myjit): + kernel32_GetModuleHandle(myjit, whoami(), get_str_ansi) + + +def kernel32_GetModuleHandleW(myjit): + kernel32_GetModuleHandle(myjit, whoami(), get_str_unic) + + +def kernel32_VirtualLock(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + lpaddress, dwsize = args + myjit.func_ret_stdcall(ret_ad, 1) + + +class systeminfo: + oemId = 0 + dwPageSize = 0x1000 + lpMinimumApplicationAddress = 0x10000 + lpMaximumApplicationAddress = 0x7ffeffff + dwActiveProcessorMask = 0x1 + numberOfProcessors = 0x1 + ProcessorsType = 586 + dwAllocationgranularity = 0x10000 + wProcessorLevel = 0x6 + ProcessorRevision = 0xf0b + + def pack(self): + return struct.pack('IIIIIIIIHH', + self.oemId, + self.dwPageSize, + self.lpMinimumApplicationAddress, + self.lpMaximumApplicationAddress, + self.dwActiveProcessorMask, + self.numberOfProcessors, + self.ProcessorsType, + self.dwAllocationgranularity, + self.wProcessorLevel, + self.ProcessorRevision) + + +def kernel32_GetSystemInfo(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + sys_ptr, = args + sysinfo = systeminfo() + myjit.vm.vm_set_mem(sys_ptr, sysinfo.pack()) + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_IsWow64Process(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + h, bool_ptr = args + + myjit.vm.vm_set_mem(bool_ptr, pck32(0)) + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetCommandLineA(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + s = winobjs.module_path + '\x00' + s = '"%s"' % s + alloc_addr = alloc_mem(myjit, 0x1000) + myjit.vm.vm_set_mem(alloc_addr, s) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_GetCommandLineW(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + s = winobjs.module_path + '\x00' + s = set_str_unic('"%s"' % s) + alloc_addr = alloc_mem(myjit, 0x1000) + myjit.vm.vm_set_mem(alloc_addr, s) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def shell32_CommandLineToArgvW(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + pcmd, pnumargs = args + cmd = get_str_unic(myjit, pcmd) + print repr(cmd) + tks = cmd.split(' ') + addr = alloc_mem(myjit, len(cmd) * 2 + 4 * len(tks)) + addr_ret = alloc_mem(myjit, 4 * (len(tks) + 1)) + o = 0 + for i, t in enumerate(tks): + x = set_str_unic(t) + "\x00\x00" + myjit.vm.vm_set_mem(addr_ret + 4 * i, pck32(addr + o)) + myjit.vm.vm_set_mem(addr + o, x) + o += len(x) + 2 + + myjit.vm.vm_set_mem(addr_ret + 4 * i, pck32(0)) + myjit.vm.vm_set_mem(pnumargs, pck32(len(tks))) + myjit.func_ret_stdcall(ret_ad, addr_ret) + + +def cryptdll_MD5Init(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ad_ctx, = args + index = len(winobjs.cryptdll_md5_h) + h = MD5.new() + winobjs.cryptdll_md5_h[index] = h + + myjit.vm.vm_set_mem(ad_ctx, pck32(index)) + myjit.func_ret_stdcall(ret_ad, 0) + + +def cryptdll_MD5Update(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ad_ctx, ad_input, inlen = args + + index = myjit.vm.vm_get_mem(ad_ctx, 4) + index = upck32(index) + if not index in winobjs.cryptdll_md5_h: + raise ValueError('unknown h context', index) + + data = myjit.vm.vm_get_mem(ad_input, inlen) + winobjs.cryptdll_md5_h[index].update(data) + print hexdump(data) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def cryptdll_MD5Final(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ad_ctx, = args + + index = myjit.vm.vm_get_mem(ad_ctx, 4) + index = upck32(index) + if not index in winobjs.cryptdll_md5_h: + raise ValueError('unknown h context', index) + h = winobjs.cryptdll_md5_h[index].digest() + myjit.vm.vm_set_mem(ad_ctx + 88, h) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlInitAnsiString(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + ad_ctx, ad_str = args + + s = get_str_ansi(myjit, ad_str) + l = len(s) + print "string", l, s + myjit.vm.vm_set_mem(ad_ctx, pw(l) + pw(l + 1) + pck32(ad_str)) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlHashUnicodeString(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + ad_ctxu, case_i, h_id, phout = args + + print hex(h_id) + if h_id != 1: + raise ValueError('unk hash unicode', h_id) + + l1, l2, ptra = struct.unpack('HHL', myjit.vm.vm_get_mem(ad_ctxu, 8)) + print hex(l1), hex(l2), hex(ptra) + s = myjit.vm.vm_get_mem(ptra, l1) + print repr(s) + s = s[:-1] + print repr(s) + hv = 0 + + if case_i: + s = s.lower() + for c in s: + hv = ((65599 * hv) + ord(c)) & 0xffffffff + print "unicode h", hex(hv) + myjit.vm.vm_set_mem(phout, pck32(hv)) + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_RtlMoveMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ad_dst, ad_src, m_len = args + data = myjit.vm.vm_get_mem(ad_src, m_len) + myjit.vm.vm_set_mem(ad_dst, data) + print hexdump(data) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlAnsiCharToUnicodeChar(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ad_ad_ch, = args + ad_ch = upck32(myjit.vm.vm_get_mem(ad_ad_ch, 4)) + print hex(ad_ch) + ch = ord(myjit.vm.vm_get_mem(ad_ch, 1)) + myjit.vm.vm_set_mem(ad_ad_ch, pck32(ad_ch + 1)) + + print repr(ch), repr(chr(ch)) + myjit.func_ret_stdcall(ret_ad, ch) + + +def ntdll_RtlFindCharInUnicodeString(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + flags, main_str_ad, search_chars_ad, pos_ad = args + + print flags + if flags != 0: + raise ValueError('unk flags') + + ml1, ml2, mptra = struct.unpack('HHL', myjit.vm.vm_get_mem(main_str_ad, 8)) + print ml1, ml2, hex(mptra) + sl1, sl2, sptra = struct.unpack( + 'HHL', myjit.vm.vm_get_mem(search_chars_ad, 8)) + print sl1, sl2, hex(sptra) + main_data = myjit.vm.vm_get_mem(mptra, ml1)[:-1] + search_data = myjit.vm.vm_get_mem(sptra, sl1)[:-1] + + print repr(main_data) + print repr(search_data) + + pos = None + for i, c in enumerate(main_data): + for s in search_data: + if s == c: + pos = i + break + if pos: + break + print pos + if pos is None: + ret = 0xC0000225 + myjit.vm.vm_set_mem(pos_ad, pck32(0)) + else: + ret = 0 + myjit.vm.vm_set_mem(pos_ad, pck32(pos)) + + myjit.func_ret_stdcall(ret_ad, ret) + + +def ntdll_RtlComputeCrc32(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + dwinit, pdata, ilen = args + + data = myjit.vm.vm_get_mem(pdata, ilen) + print hex(dwinit) + print hexdump(data) + crc_r = crc32(data, dwinit) + print "crc32", hex(crc_r) + myjit.func_ret_stdcall(ret_ad, crc_r) + + +def ntdll_RtlExtendedIntegerMultiply(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + b2, b1, bm = args + a = (b1 << 32) + b2 + a = a * bm + print hex(a) + myjit.func_ret_stdcall(ret_ad, a & 0xffffffff, (a >> 32) & 0xffffffff) + + +def ntdll_RtlLargeIntegerAdd(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + a2, a1, b2, b1 = args + a = (a1 << 32) + a2 + (b1 << 32) + b2 + print hex(a) + myjit.func_ret_stdcall(ret_ad, a & 0xffffffff, (a >> 32) & 0xffffffff) + + +def ntdll_RtlLargeIntegerShiftRight(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + a2, a1, m = args + a = ((a1 << 32) + a2) >> m + print hex(a) + myjit.func_ret_stdcall(ret_ad, a & 0xffffffff, (a >> 32) & 0xffffffff) + + +def ntdll_RtlEnlargedUnsignedMultiply(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + a, b = args + a = a * b + print hex(a) + myjit.func_ret_stdcall(ret_ad, a & 0xffffffff, (a >> 32) & 0xffffffff) + + +def ntdll_RtlLargeIntegerSubtract(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + a2, a1, b2, b1 = args + a = (a1 << 32) + a2 - (b1 << 32) + b2 + print hex(a) + myjit.func_ret_stdcall(ret_ad, a & 0xffffffff, (a >> 32) & 0xffffffff) + + +def ntdll_RtlCompareMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ad1, ad2, m_len = args + data1 = myjit.vm.vm_get_mem(ad1, m_len) + data2 = myjit.vm.vm_get_mem(ad2, m_len) + + print hexdump(data1) + print hexdump(data2) + i = 0 + while data1[i] == data2[i]: + i += 1 + if i >= m_len: + break + + myjit.func_ret_stdcall(ret_ad, i) + + +def user32_GetMessagePos(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0x00110022) + + +def kernel32_Sleep(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + t, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_ZwUnmapViewOfSection(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + h, ad = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_IsBadReadPtr(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + lp, ucb = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_KeInitializeEvent(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + my_event, my_type, my_state = args + myjit.vm.vm_set_mem(my_event, pck32(winobjs.win_event_num)) + winobjs.win_event_num += 1 + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_RtlGetVersion(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ptr_version, = args + + s = struct.pack("IIIII", + 0x114, # struct size + 0x5, # maj vers + 0x2, # min vers + 0x666, # build nbr + 0x2, # platform id + ) + set_str_unic("Service pack 4") + + myjit.vm.vm_set_mem(ptr_version, s) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_RtlVerifyVersionInfo(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ptr_version, = args + + s = myjit.vm.vm_get_mem(ptr_version, 0x5 * 4) + print repr(s) + s_size, s_majv, s_minv, s_buildn, s_platform = struct.unpack('IIIII', s) + print s_size, s_majv, s_minv, s_buildn, s_platform + raise NotImplementedError("Untested case") + myjit.vm.vm_set_mem(ptr_version, s) + myjit.func_ret_stdcall(ret_ad, 0) + + +def hal_ExAcquireFastMutex(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0) + + +def mdl2ad(n): + return winobjs.nt_mdl_ad + 0x10 * n + + +def ad2mdl(ad): + return ((ad - winobjs.nt_mdl_ad) & 0xFFFFFFFFL) / 0x10 + + +def ntoskrnl_IoAllocateMdl(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + v_addr, l, second_buf, chargequota, pirp = args + m = mdl(v_addr, l) + winobjs.nt_mdl[winobjs.nt_mdl_cur] = m + myjit.vm.vm_set_mem(mdl2ad(winobjs.nt_mdl_cur), str(m)) + myjit.func_ret_stdcall(ret_ad, mdl2ad(winobjs.nt_mdl_cur)) + winobjs.nt_mdl_cur += 1 + + +def ntoskrnl_MmProbeAndLockPages(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + p_mdl, access_mode, op = args + + if not ad2mdl(p_mdl) in winobjs.nt_mdl: + raise ValueError('unk mdl', hex(p_mdl)) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_MmMapLockedPagesSpecifyCache(myjit): + ret_ad, args = myjit.func_args_stdcall(6) + p_mdl, access_mode, cache_type, base_ad, bugcheckonfailure, priority = args + if not ad2mdl(p_mdl) in winobjs.nt_mdl: + raise ValueError('unk mdl', hex(p_mdl)) + + myjit.func_ret_stdcall(ret_ad, winobjs.nt_mdl[ad2mdl(p_mdl)].ad) + + +def ntoskrnl_MmProtectMdlSystemAddress(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + p_mdl, prot = args + if not ad2mdl(p_mdl) in winobjs.nt_mdl: + raise ValueError('unk mdl', hex(p_mdl)) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_MmUnlockPages(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + p_mdl, = args + if not ad2mdl(p_mdl) in winobjs.nt_mdl: + raise ValueError('unk mdl', hex(p_mdl)) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_IoFreeMdl(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + p_mdl, = args + if not ad2mdl(p_mdl) in winobjs.nt_mdl: + raise ValueError('unk mdl', hex(p_mdl)) + del(winobjs.nt_mdl[ad2mdl(p_mdl)]) + myjit.func_ret_stdcall(ret_ad, 0) + + +def hal_ExReleaseFastMutex(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_RtlQueryRegistryValues(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + relativeto, path, querytable, context, environ = args + p = get_str_unic(myjit, path) + print repr(p) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntoskrnl_ExAllocatePoolWithTagPriority(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + pool_type, nbr_of_bytes, tag, priority = args + + alloc_addr = get_next_alloc_addr(nbr_of_bytes) + myjit.vm.vm_add_memory_page( + alloc_addr, PAGE_READ | PAGE_WRITE, "\x00" * nbr_of_bytes) + + print "ad", hex(alloc_addr) + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def my_lstrcmp(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(2) + ptr_str1, ptr_str2 = args + s1 = get_str(ptr_str1) + s2 = get_str(ptr_str2) + print '%s (%r, %r)' % (' ' * len(funcname), s1, s2) + myjit.func_ret_stdcall(ret_ad, cmp(s1, s2)) + + +def kernel32_lstrcmpA(myjit): + my_lstrcmp(myjit, whoami(), lambda x: get_str_ansi(myjit, x)) + + +def kernel32_lstrcmpiA(myjit): + my_lstrcmp(myjit, whoami(), lambda x: get_str_ansi(myjit, x).lower()) + + +def kernel32_lstrcmpW(myjit): + my_lstrcmp(myjit, whoami(), lambda x: get_str_unic(myjit, x)) + + +def kernel32_lstrcmpiW(myjit): + my_lstrcmp(myjit, whoami(), lambda x: get_str_unic(myjit, x).lower()) + + +def kernel32_lstrcmpi(myjit): + my_lstrcmp(myjit, whoami(), lambda x: get_str_ansi(myjit, x).lower()) + + +def my_strcpy(myjit, funcname, get_str, set_str): + ret_ad, args = myjit.func_args_stdcall(2) + ptr_str1, ptr_str2 = args + s2 = get_str(myjit, ptr_str2) + print '%s (%r)' % (funcname, s2) + myjit.vm.vm_set_mem(ptr_str1, set_str(s2)) + myjit.func_ret_stdcall(ret_ad, ptr_str1) + + +def kernel32_lstrcpyW(myjit): + my_strcpy(myjit, whoami(), get_str_unic, + lambda x: set_str_unic(x) + "\x00\x00") + + +def kernel32_lstrcpyA(myjit): + my_strcpy(myjit, whoami(), get_str_ansi, lambda x: x + "\x00") + + +def kernel32_lstrcpy(myjit): + my_strcpy(myjit, whoami(), get_str_ansi, lambda x: x + "\x00") + + +def kernel32_lstrcpyn(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ptr_str1, ptr_str2, mlen = args + s2 = get_str_ansi(myjit, ptr_str2) + print repr(s2) + s2 = s2[:mlen] + myjit.vm.vm_set_mem(ptr_str1, s2) + + myjit.func_ret_stdcall(ret_ad, ptr_str1) + + +def my_strlen(myjit, funcname, get_str, mylen): + ret_ad, args = myjit.func_args_stdcall(1) + arg_src, = args + src = get_str(myjit, arg_src) + print funcname, repr(src) + myjit.func_ret_stdcall(ret_ad, mylen(src)) + + +def kernel32_lstrlenA(myjit): + my_strlen(myjit, whoami(), get_str_ansi, lambda x: len(x)) + + +def kernel32_lstrlenW(myjit): + my_strlen(myjit, whoami(), get_str_unic, lambda x: len(x)) + + +def kernel32_lstrlen(myjit): + my_strlen(myjit, whoami(), get_str_ansi, lambda x: len(x)) + + +def my_lstrcat(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(3) + ptr_str1, ptr_str2 = args + s1 = get_str(myjit, ptr_str1) + s2 = get_str(myjit, ptr_str2) + print '%s (%r, %r)' % (whoami(), s1, s2) + + s = s1 + s2 + print repr(s) + myjit.vm.vm_set_mem(ptr_str1, s1 + s2) + myjit.func_ret_stdcall(ret_ad, ptr_str1) + + +def kernel32_lstrcatA(myjit): + my_lstrcat(myjit, whoami(), get_str_ansi) + + +def kernel32_lstrcatW(myjit): + my_lstrcat(myjit, whoami(), get_str_unic) + + +def kernel32_GetUserGeoID(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + geoclass, = args + if geoclass == 14: + ret = 12345678 + elif geoclass == 16: + ret = 55667788 + else: + raise ValueError('unknown geolcass') + + myjit.func_ret_stdcall(ret_ad, ret) + + +def my_GetVolumeInformation(myjit, funcname, get_str, set_str): + ret_ad, args = myjit.func_args_stdcall(8) + (lprootpathname, lpvolumenamebuffer, nvolumenamesize, + lpvolumeserialnumber, lpmaximumcomponentlength, lpfilesystemflags, + lpfilesystemnamebuffer, nfilesystemnamesize) = args + + print funcname, hex(lprootpathname), hex(lpvolumenamebuffer), \ + hex(nvolumenamesize), hex(lpvolumeserialnumber), \ + hex(lpmaximumcomponentlength), hex(lpfilesystemflags), \ + hex(lpfilesystemnamebuffer), hex(nfilesystemnamesize) + + if lprootpathname: + s = get_str(myjit, lprootpathname) + print repr(s) + + if lpvolumenamebuffer: + s = "volumename" + s = s[:nvolumenamesize] + myjit.vm.vm_set_mem(lpvolumenamebuffer, set_str(s)) + + if lpvolumeserialnumber: + myjit.vm.vm_set_mem(lpvolumeserialnumber, pck32(11111111)) + if lpmaximumcomponentlength: + myjit.vm.vm_set_mem(lpmaximumcomponentlength, pck32(0xff)) + if lpfilesystemflags: + myjit.vm.vm_set_mem(lpfilesystemflags, pck32(22222222)) + + if lpfilesystemnamebuffer: + s = "filesystemname" + s = s[:nfilesystemnamesize] + myjit.vm.vm_set_mem(lpfilesystemnamebuffer, set_str(s)) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetVolumeInformationA(myjit): + my_GetVolumeInformation( + myjit, whoami(), get_str_ansi, lambda x: x + "\x00") + + +def kernel32_GetVolumeInformationW(myjit): + my_GetVolumeInformation(myjit, whoami(), get_str_unic, set_str_unic) + + +def kernel32_MultiByteToWideChar(myjit): + ret_ad, args = myjit.func_args_stdcall(6) + (codepage, dwflags, lpmultibytestr, + cbmultibyte, lpwidecharstr, cchwidechar) = args + + print whoami(), hex(ret_ad), \ + hex(codepage), hex(dwflags), hex(lpmultibytestr), hex( + cbmultibyte), hex(lpwidecharstr), hex(cchwidechar) + src = get_str_ansi(myjit, lpmultibytestr) + '\x00' + l = len(src) + print repr(src) + + src = "\x00".join(list(src)) + print repr(src), hex(len(src)) + myjit.vm.vm_set_mem(lpwidecharstr, src) + myjit.func_ret_stdcall(ret_ad, l) + + +def my_GetEnvironmentVariable(myjit, funcname, get_str, set_str, mylen): + ret_ad, args = myjit.func_args_stdcall(3) + lpname, lpbuffer, nsize = args + + s = get_str(myjit, lpname) + if get_str == get_str_unic: + s = s + print 'variable', repr(s) + if s in winobjs.env_variables: + v = set_str(winobjs.env_variables[s]) + else: + print 'WARNING unknown env variable', repr(s) + v = "" + print 'return', repr(v) + myjit.vm.vm_set_mem(lpbuffer, v) + myjit.func_ret_stdcall(ret_ad, mylen(v)) + + +def my_GetSystemDirectory(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(2) + lpbuffer, usize = args + print funcname + + s = "c:\\windows\\system32" + l = len(s) + s = set_str(s) + myjit.vm.vm_set_mem(lpbuffer, s) + + myjit.func_ret_stdcall(ret_ad, l) + + +def kernel32_GetSystemDirectoryA(myjit): + my_GetSystemDirectory(myjit, whoami(), set_str_ansi) + + +def kernel32_GetSystemDirectoryW(myjit): + my_GetSystemDirectory(myjit, whoami(), set_str_unic) + + +def my_CreateDirectory(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(2) + lppath, secattrib = args + p = get_str(myjit, lppath) + myjit.func_ret_stdcall(ret_ad, 0x1337) + + +def kernel32_CreateDirectoryW(myjit): + my_CreateDirectory(myjit, whoami(), get_str_unic) + + +def kernel32_CreateDirectoryA(myjit): + my_CreateDirectory(myjit, whoami(), get_str_ansi) + + +def kernel32_GetEnvironmentVariableA(myjit): + my_GetEnvironmentVariable(myjit, whoami(), + get_str_ansi, + lambda x: x + "\x00", + lambda x: len(x)) + + +def kernel32_GetEnvironmentVariableW(myjit): + my_GetEnvironmentVariable(myjit, whoami(), + get_str_unic, + lambda x: "\x00".join(list(x + "\x00")), + lambda x: len(x)) + + +def my_CreateEvent(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(4) + lpeventattributes, bmanualreset, binitialstate, lpname = args + if lpname: + s = get_str(myjit, lpname) + else: + s = None + print repr(s) + if not s in winobjs.events_pool: + winobjs.events_pool[s] = (bmanualreset, binitialstate) + else: + print 'WARNING: known event' + + myjit.func_ret_stdcall(ret_ad, id(s)) + + +def kernel32_CreateEventA(myjit): + my_CreateEvent(myjit, whoami(), get_str_ansi) + + +def kernel32_CreateEventW(myjit): + my_CreateEvent(myjit, whoami(), get_str_unic) + + +def kernel32_WaitForSingleObject(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + handle, dwms = args + + print whoami(), hex(ret_ad), hex(handle), hex(dwms) + + t_start = time.time() * 1000 + found = False + while True: + if dwms and dwms + t_start > time.time() * 1000: + ret = 0x102 + break + for k, v in winobjs.events_pool.items(): + if k != handle: + continue + found = True + if winobjs.events_pool[k][1] == 1: + ret = 0 + break + if not found: + print 'unknown handle' + ret = 0xffffffff + break + time.sleep(0.1) + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_SetFileAttributesA(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + lpfilename, dwfileattributes = args + print whoami(), hex(ret_ad), hex(lpfilename), hex(dwfileattributes) + + if lpfilename: + fname = get_str_ansi(myjit, lpfilename) + print "filename", repr(fname) + ret = 1 + else: + ret = 0 + myjit.vm.vm_set_mem(seh_helper.FS_0_AD + 0x34, pck32(3)) + + myjit.func_ret_stdcall(ret_ad, ret) + + +def ntdll_RtlMoveMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + dst, src, l = args + s = myjit.vm.vm_get_mem(src, l) + myjit.vm.vm_set_mem(dst, s) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def ntdll_ZwQuerySystemInformation(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + (systeminformationclass, systeminformation, + systeminformationl, returnl) = args + if systeminformationclass == 2: + # SYSTEM_PERFORMANCE_INFORMATION + o = struct.pack('II', 0x22222222, 0x33333333) + o += "\x00" * systeminformationl + o = o[:systeminformationl] + myjit.vm.vm_set_mem(systeminformation, o) + else: + raise ValueError('unknown sysinfo class', systeminformationclass) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_ZwProtectVirtualMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + handle, lppvoid, pdwsize, flnewprotect, lpfloldprotect = args + + ad = upck32(myjit.vm.vm_get_mem(lppvoid, 4)) + dwsize = upck32(myjit.vm.vm_get_mem(pdwsize, 4)) + print 'ad', hex(ad), 'size', hex(dwsize) + # XXX mask hpart + flnewprotect &= 0xFFF + + if not flnewprotect in access_dict: + raise ValueError('unknown access dw!') + myjit.vm.vm_set_mem_access(ad, access_dict[flnewprotect]) + + # XXX todo real old protect + myjit.vm.vm_set_mem(lpfloldprotect, pck32(0x40)) + + dump_memory_page_pool_py() + myjit.func_ret_stdcall(ret_ad, 1) + + +def ntdll_ZwAllocateVirtualMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(6) + handle, lppvoid, zerobits, pdwsize, alloc_type, flprotect = args + + ad = upck32(myjit.vm.vm_get_mem(lppvoid, 4)) + dwsize = upck32(myjit.vm.vm_get_mem(pdwsize, 4)) + print 'ad', hex(ad), 'size', hex(dwsize) + + access_dict = {0x0: 0, + 0x1: 0, + 0x2: PAGE_READ, + 0x4: PAGE_READ | PAGE_WRITE, + 0x10: PAGE_EXEC, + 0x20: PAGE_EXEC | PAGE_READ, + 0x40: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + 0x100: 0 + } + + access_dict_inv = dict([(x[1], x[0]) for x in access_dict.items()]) + + if not flprotect in access_dict: + raise ValueError('unknown access dw!') + + alloc_addr = get_next_alloc_addr(dwsize) + myjit.vm.vm_add_memory_page( + alloc_addr, access_dict[flprotect], "\x00" * dwsize) + myjit.vm.vm_set_mem(lppvoid, pck32(alloc_addr)) + + print 'ret', hex(alloc_addr) + dump_memory_page_pool_py() + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_ZwFreeVirtualMemory(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + handle, lppvoid, pdwsize, alloc_type = args + ad = upck32(myjit.vm.vm_get_mem(lppvoid, 4)) + dwsize = upck32(myjit.vm.vm_get_mem(pdwsize, 4)) + print 'ad', hex(ad), 'size', hex(dwsize) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlInitString(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + pstring, source = args + s = get_str_ansi(myjit, source) + print "str", repr(s) + + l = len(s) + 1 + + o = struct.pack('HHI', l, l, source) + myjit.vm.vm_set_mem(pstring, o) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlAnsiStringToUnicodeString(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + dst, src, alloc_str = args + + l1, l2, p_src = struct.unpack('HHI', myjit.vm.vm_get_mem(src, 0x8)) + print hex(l1), hex(l2), hex(p_src) + s = get_str_ansi(myjit, p_src) + print "str", repr(s) + s = ("\x00".join(s + "\x00")) + l = len(s) + 1 + if alloc_str: + print 'alloc' + alloc_addr = get_next_alloc_addr(l) + myjit.vm.vm_add_memory_page( + alloc_addr, PAGE_READ | PAGE_WRITE, "\x00" * l) + else: + print 'use buf' + alloc_addr = p_src + myjit.vm.vm_set_mem(alloc_addr, s) + o = struct.pack('HHI', l, l, alloc_addr) + myjit.vm.vm_set_mem(dst, o) + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_LdrLoadDll(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + path, flags, modname, modhandle = args + + print whoami(), hex(ret_ad), + print '(', hex(path), hex(flags), hex(modname), hex(modhandle), ')' + l1, l2, p_src = struct.unpack('HHI', myjit.vm.vm_get_mem(modname, 0x8)) + print hex(l1), hex(l2), hex(p_src) + s = get_str_unic(myjit, p_src) + print repr(s) + libname = s.lower() + print repr(libname) + + ad = winobjs.runtime_dll.lib_get_add_base(libname) + print "ret", hex(ad) + myjit.vm.vm_set_mem(modhandle, pck32(ad)) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_RtlFreeUnicodeString(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + src, = args + + l1, l2, p_src = struct.unpack('HHI', myjit.vm.vm_get_mem(src, 0x8)) + print hex(l1), hex(l2), hex(p_src) + s = get_str_unic(myjit, p_src) + print "str", repr(s) + print repr(s) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_LdrGetProcedureAddress(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + libbase, pfname, opt, p_ad = args + + l1, l2, p_src = struct.unpack('HHI', myjit.vm.vm_get_mem(pfname, 0x8)) + print hex(l1), hex(l2), hex(p_src) + fname = get_str_ansi(myjit, p_src) + print "str", repr(fname) + + ad = winobjs.runtime_dll.lib_get_add_func(libbase, fname) + + myjit.vm.vm_set_mem(p_ad, pck32(ad)) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def ntdll_memset(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + arg_addr, arg_c, arg_size = args + + myjit.vm.vm_set_mem(arg_addr, chr(arg_c) * arg_size) + myjit.func_ret_stdcall(ret_ad, arg_addr) + + +def msvcrt_memset(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + arg_addr, arg_c, arg_size = args + + myjit.vm.vm_set_mem(arg_addr, chr(arg_c) * arg_size) + myjit.func_ret_cdecl(ret_ad, arg_addr) + + +def msvcrt_memcpy(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + dst, src, size = args + + s = myjit.vm.vm_get_mem(src, size) + myjit.vm.vm_set_mem(dst, s) + myjit.func_ret_cdecl(ret_ad, dst) + + +def msvcrt_memcmp(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + ps1, ps2, size = args + + s1 = myjit.vm.vm_get_mem(ps1, size) + s2 = myjit.vm.vm_get_mem(ps2, size) + ret = cmp(s1, s2) + myjit.func_ret_cdecl(ret_ad, ret) + + +def shlwapi_PathFindExtensionA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + path_ad, = args + + path = get_str_ansi(myjit, path_ad) + print repr(path) + i = path.rfind('.') + if i == -1: + i = path_ad + len(path) + else: + i = path_ad + i + myjit.func_ret_stdcall(ret_ad, i) + + +def shlwapi_PathRemoveFileSpecW(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + path_ad, = args + + path = get_str_unic(myjit, path_ad) + print repr(path) + i = path.rfind('\\') + if i == -1: + i = 0 + myjit.vm.vm_set_mem(path_ad + i * 2, "\x00\x00") + path = get_str_unic(myjit, path_ad) + print repr(path) + myjit.func_ret_stdcall(ret_ad, 1) + + +def shlwapi_PathIsPrefixW(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + ptr_prefix, ptr_path = args + prefix = get_str_unic(myjit, ptr_prefix) + path = get_str_unic(myjit, ptr_path) + print repr(prefix), repr(path) + + if path.startswith(prefix): + ret = 1 + else: + ret = 0 + myjit.func_ret_stdcall(ret_ad, ret) + + +def shlwapi_PathIsDirectoryW(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ppath, = args + fname = get_str_unic(myjit, ppath) + + fname = fname.replace('\\', "/").lower() + f = os.path.join('file_sb', fname) + + s = os.stat(f) + ret = 0 + if stat.S_ISDIR(s.st_mode): + ret = 1 + + myjit.func_ret_cdecl(ret_ad, ret) + + +def shlwapi_PathIsFileSpec(funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(1) + path_ad, = args + path = get_str(myjit, path_ad) + print repr(path) + if path.find(':') != -1 and path.find('\\') != -1: + ret = 0 + else: + ret = 1 + + myjit.func_ret_stdcall(ret_ad, ret) + + +def shlwapi_PathGetDriveNumber(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(1) + path_ad, = args + path = get_str(myjit, path_ad) + print repr(path) + l = ord(path[0].upper()) - ord('A') + if 0 <= l <= 25: + ret = l + else: + ret = -1 + + myjit.func_ret_stdcall(ret_ad, ret) + + +def shlwapi_PathGetDriveNumberA(myjit): + shlwapi_PathGetDriveNumber(myjit, whoami(), get_str_ansi) + + +def shlwapi_PathGetDriveNumberW(myjit): + shlwapi_PathGetDriveNumber(myjit, whoami(), get_str_unic) + + +def shlwapi_PathIsFileSpecA(myjit): + shlwapi_PathIsFileSpec(whoami(), get_str_ansi) + + +def shlwapi_PathIsFileSpecW(myjit): + shlwapi_PathIsFileSpec(whoami(), get_str_unic) + + +def shlwapi_StrToIntA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + i_str_ad, = args + i_str = get_str_ansi(myjit, i_str_ad) + print repr(i_str) + try: + i = int(i_str) + except: + print 'WARNING cannot convert int' + i = 0 + + myjit.func_ret_stdcall(ret_ad, i) + + +def shlwapi_StrToInt64Ex(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(3) + pstr, flags, pret = args + i_str = get_str(myjit, pstr) + if get_str is get_str_unic: + i_str = i_str + print repr(i_str) + + if flags == 0: + r = int(i_str) + elif flags == 1: + r = int(i_str, 16) + else: + raise ValueError('cannot decode int') + + myjit.vm.vm_set_mem(pret, struct.pack('q', r)) + + myjit.func_ret_stdcall(ret_ad, i) + + +def shlwapi_StrToInt64ExA(myjit): + shlwapi_StrToInt64Ex(myjit, whoami(), get_str_ansi) + + +def shlwapi_StrToInt64ExW(myjit): + shlwapi_StrToInt64Ex(myjit, whoami(), get_str_unic) + + +def user32_IsCharAlpha(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(1) + c, = args + try: + c = chr(c) + except: + print 'bad char', c + c = "\x00" + if c.isalpha(myjit): + ret = 1 + else: + ret = 0 + myjit.func_ret_stdcall(ret_ad, ret) + + +def user32_IsCharAlphaA(myjit): + user32_IsCharAlpha(myjit, whoami(), get_str_ansi) + + +def user32_IsCharAlphaW(myjit): + user32_IsCharAlpha(myjit, whoami(), get_str_unic) + + +def user32_IsCharAlphaNumericA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + c, = args + c = chr(c) + if c.isalnum(myjit): + ret = 1 + else: + ret = 0 + myjit.func_ret_stdcall(ret_ad, ret) + + +def shlwapi_StrCmpNIA(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ptr_str1, ptr_str2, nchar = args + s1 = get_str_ansi(myjit, ptr_str1).lower() + s2 = get_str_ansi(myjit, ptr_str2).lower() + s1 = s1[:nchar] + s2 = s2[:nchar] + + print repr(s1), repr(s2) + myjit.func_ret_stdcall(ret_ad, cmp(s1, s2)) + + +def advapi32_RegOpenKeyEx(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(5) + hkey, subkey, reserved, access, phandle = args + if subkey: + s_subkey = get_str(myjit, subkey).lower() + else: + s_subkey = "" + print hex(hkey) + print repr(s_subkey) + print winobjs.hkey_handles + + ret_hkey = 0 + ret = 2 + if hkey in winobjs.hkey_handles: + if s_subkey: + h = hash(s_subkey) & 0xffffffff + print hex(h) + if h in winobjs.hkey_handles: + ret_hkey = h + ret = 0 + else: + print 'unknown skey' + + print 'set hkey', hex(ret_hkey) + myjit.vm.vm_set_mem(phandle, pck32(ret_hkey)) + + myjit.func_ret_stdcall(ret_ad, ret) + + +def advapi32_RegOpenKeyExA(myjit): + advapi32_RegOpenKeyEx(myjit, whoami(), get_str_ansi) + + +def advapi32_RegOpenKeyExW(myjit): + advapi32_RegOpenKeyEx(myjit, whoami(), get_str_unic) + + +def advapi32_RegSetValue(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(5) + hkey, psubkey, valuetype, pvalue, length = args + if psubkey: + subkey = get_str(myjit, psubkey).lower() + else: + subkey = "" + print repr(subkey) + + if pvalue: + value = myjit.vm.vm_get_mem(pvalue, length) + else: + value = None + print repr(value) + myjit.func_ret_stdcall(ret_ad, 0) + + +def advapi32_RegSetValueA(myjit): + advapi32_RegSetValue(myjit, whoami(), get_str_ansi) + + +def advapi32_RegSetValueW(myjit): + advapi32_RegSetValue(myjit, whoami(), get_str_unic) + + +def kernel32_GetThreadLocale(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0x40c) + + +def kernel32_GetLocaleInfo(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(4) + localeid, lctype, lplcdata, cchdata = args + + buf = None + ret = 0 + if localeid == 0x40c: + if lctype == 0x3: + buf = "ENGLISH" + buf = buf[:cchdata - 1] + print 'SET', buf + myjit.vm.vm_set_mem(lplcdata, set_str(buf)) + ret = len(buf) + else: + raise ValueError('unimpl localeid') + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetLocaleInfoA(myjit): + kernel32_GetLocaleInfo(myjit, whoami(), set_str_ansi) + + +def kernel32_GetLocaleInfoW(myjit): + kernel32_GetLocaleInfo(myjit, whoami(), set_str_unic) + + +def kernel32_TlsAlloc(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + winobjs.tls_index += 1 + myjit.func_ret_stdcall(ret_ad, winobjs.tls_index) + + +def kernel32_TlsFree(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_TlsSetValue(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + tlsindex, tlsvalue = args + winobjs.tls_values[tlsindex] = tlsvalue + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_TlsGetValue(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + tlsindex, = args + + print whoami(), hex(tlsindex) + + if not tlsindex in winobjs.tls_values: + raise ValueError("unknown tls val", repr(tlsindex)) + myjit.func_ret_stdcall(ret_ad, winobjs.tls_values[tlsindex]) + + +def user32_GetKeyboardType(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + typeflag, = args + + ret = 0 + if typeflag == 0: + ret = 4 + else: + raise ValueError('unimpl keyboard type') + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetStartupInfo(myjit, funcname, set_str): + ret_ad, args = myjit.func_args_stdcall(1) + ptr, = args + + print funcname, hex(ptr) + + s = "\x00" * 0x2c + "\x81\x00\x00\x00" + "\x0a" + + myjit.vm.vm_set_mem(ptr, s) + myjit.func_ret_stdcall(ret_ad, ptr) + + +def kernel32_GetStartupInfoA(myjit): + kernel32_GetStartupInfo(myjit, whoami(), set_str_ansi) + + +def kernel32_GetStartupInfoW(myjit): + kernel32_GetStartupInfo(myjit, whoami(), set_str_unic) + + +def kernel32_GetCurrentThreadId(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0x113377) + + +def kernel32_InitializeCriticalSection(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + lpcritic, = args + myjit.func_ret_stdcall(ret_ad, 0) + + +def user32_GetSystemMetrics(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + nindex, = args + + ret = 0 + if nindex in [0x2a, 0x4a]: + ret = 0 + else: + raise ValueError('unimpl index') + myjit.func_ret_stdcall(ret_ad, ret) + + +def wsock32_WSAStartup(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + version, pwsadata = args + myjit.vm.vm_set_mem(pwsadata, "\x01\x01\x02\x02WinSock 2.0\x00") + + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_GetLocalTime(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + lpsystemtime, = args + + s = struct.pack('HHHHHHHH', + 2011, # year + 10, # month + 5, # dayofweek + 7, # day + 13, # hour + 37, # minutes + 00, # seconds + 999, # millisec + ) + myjit.vm.vm_set_mem(lpsystemtime, s) + myjit.func_ret_stdcall(ret_ad, lpsystemtime) + + +def kernel32_GetSystemTime(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + lpsystemtime, = args + + print whoami(), hex(ret_ad), hex(lpsystemtime) + + s = struct.pack('HHHHHHHH', + 2011, # year + 10, # month + 5, # dayofweek + 7, # day + 13, # hour + 37, # minutes + 00, # seconds + 999, # millisec + ) + myjit.vm.vm_set_mem(lpsystemtime, s) + myjit.func_ret_stdcall(ret_ad, lpsystemtime) + + +def kernel32_CreateFileMapping(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(6) + hfile, lpattr, flprotect, dwmaximumsizehigh, dwmaximumsizelow, lpname = args + + if lpname: + f = get_str(myjit, lpname) + else: + f = None + print repr(f) + + if not hfile in winobjs.handle_pool: + raise ValueError('unknown handle') + + ret = winobjs.handle_pool.add('filemapping', hfile) + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_CreateFileMappingA(myjit): + kernel32_CreateFileMapping(myjit, whoami(), get_str_ansi) + + +def kernel32_CreateFileMappingW(myjit): + kernel32_CreateFileMapping(myjit, whoami(), get_str_unic) + + +def kernel32_MapViewOfFile(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hfile, flprotect, dwfileoffsethigh, dwfileoffsetlow, length = args + + if not hfile in winobjs.handle_pool: + raise ValueError('unknown handle') + hmap = winobjs.handle_pool[hfile] + print hmap + if not hmap.info in winobjs.handle_pool: + raise ValueError('unknown file handle') + + hfile_o = winobjs.handle_pool[hmap.info] + print hfile_o + fd = hfile_o.info + fd.seek((dwfileoffsethigh << 32) | dwfileoffsetlow) + if length: + data = fd.read(length) + else: + data = fd.read() + length = len(data) + + print 'mapp total:', hex(len(data)) + access_dict = {0x0: 0, + 0x1: 0, + 0x2: PAGE_READ, + 0x4: PAGE_READ | PAGE_WRITE, + 0x10: PAGE_EXEC, + 0x20: PAGE_EXEC | PAGE_READ, + 0x40: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + 0x100: 0 + } + access_dict_inv = dict([(x[1], x[0]) for x in access_dict.items()]) + + if not flprotect in access_dict: + raise ValueError('unknown access dw!') + + alloc_addr = alloc_mem(myjit, len(data)) + myjit.vm.vm_set_mem(alloc_addr, data) + + winobjs.handle_mapped[ + alloc_addr] = hfile_o, dwfileoffsethigh, dwfileoffsetlow, length + print 'return', hex(alloc_addr) + + myjit.func_ret_stdcall(ret_ad, alloc_addr) + + +def kernel32_UnmapViewOfFile(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + ad, = args + + if not ad in winobjs.handle_mapped: + raise NotImplementedError("Untested case") + """ + hfile_o, dwfileoffsethigh, dwfileoffsetlow, length = winobjs.handle_mapped[ad] + off = (dwfileoffsethigh<<32) | dwfileoffsetlow + s = myjit.vm.vm_get_mem(ad, length) + hfile_o.info.seek(off) + hfile_o.info.write(s) + hfile_o.info.close() + """ + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetDriveType(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(1) + pathname, = args + + print funcname, hex(pathname) + + p = get_str(myjit, pathname) + print repr(p) + p = p.upper() + + ret = 0 + if p[0] == "C": + ret = 3 + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetDriveTypeA(myjit): + kernel32_GetDriveType(myjit, whoami(), get_str_ansi) + + +def kernel32_GetDriveTypeW(myjit): + kernel32_GetDriveType(myjit, whoami(), get_str_unic) + + +def kernel32_GetDiskFreeSpace(myjit, funcname, get_str): + ret_ad, args = myjit.func_args_stdcall(5) + (lprootpathname, lpsectorpercluster, lpbytespersector, + lpnumberoffreeclusters, lptotalnumberofclusters) = args + + if lprootpathname: + rootpath = get_str(myjit, lprootpathname) + else: + rootpath = "" + print repr(rootpath) + + myjit.vm.vm_set_mem(lpsectorpercluster, pck32(8)) + myjit.vm.vm_set_mem(lpbytespersector, pck32(0x200)) + myjit.vm.vm_set_mem(lpnumberoffreeclusters, pck32(0x222222)) + myjit.vm.vm_set_mem(lptotalnumberofclusters, pck32(0x333333)) + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_GetDiskFreeSpaceA(myjit): + kernel32_GetDiskFreeSpace(myjit, whoami(), get_str_ansi) + + +def kernel32_GetDiskFreeSpaceW(myjit): + kernel32_GetDiskFreeSpace(myjit, whoami(), get_str_unic) + + +def kernel32_VirtualQuery(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + ad, lpbuffer, dwl = args + + access_dict = {0x0: 0, + 0x1: 0, + 0x2: PAGE_READ, + 0x4: PAGE_READ | PAGE_WRITE, + 0x10: PAGE_EXEC, + 0x20: PAGE_EXEC | PAGE_READ, + 0x40: PAGE_EXEC | PAGE_READ | PAGE_WRITE, + 0x100: 0 + } + access_dict_inv = dict([(x[1], x[0]) for x in access_dict.items()]) + + all_mem = myjit.vm.vm_get_all_memory() + found = None + for basead, m in all_mem.items(): + if basead <= ad < basead + m['size']: + found = ad, m + break + if not found: + raise ValueError('cannot find mem', hex(ad)) + + if dwl != 0x1c: + raise ValueError('strange mem len', hex(dwl)) + s = struct.pack('IIIIIII', + ad, + basead, + access_dict_inv[m['access']], + m['size'], + 0x1000, + access_dict_inv[m['access']], + 0x01000000) + myjit.vm.vm_set_mem(lpbuffer, s) + + myjit.func_ret_stdcall(ret_ad, dwl) + + +def kernel32_GetProcessAffinityMask(myjit): + ret_ad, args = myjit.func_args_stdcall(3) + hprocess, procaffmask, systemaffmask = args + myjit.vm.vm_set_mem(procaffmask, pck32(1)) + myjit.vm.vm_set_mem(systemaffmask, pck32(1)) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def msvcrt_rand(myjit): + ret_ad, args = myjit.func_args_cdecl(0) + myjit.func_ret_stdcall(ret_ad, 0x666) + + +def kernel32_SetFilePointer(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + hwnd, distance, p_distance_high, movemethod = args + + if hwnd == winobjs.module_cur_hwnd: + pass + elif hwnd in winobjs.handle_pool: + pass + else: + raise ValueError('unknown hwnd!') + + eax = 0xffffffff + data = None + if hwnd in winobjs.files_hwnd: + winobjs.files_hwnd[winobjs.module_cur_hwnd].seek(distance) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + data = wh.info.seek(distance) + else: + raise ValueError('unknown filename') + myjit.func_ret_stdcall(ret_ad, distance) + + +def kernel32_SetFilePointerEx(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + hwnd, distance_l, distance_h, pnewfileptr, movemethod = args + + distance = distance_l | (distance_h << 32) + if distance: + TODO_XXX + + if pnewfileptr: + TODO_XXX + if hwnd == winobjs.module_cur_hwnd: + pass + elif hwnd in winobjs.handle_pool: + pass + else: + raise ValueError('unknown hwnd!') + + eax = 0xffffffff + data = None + if hwnd in winobjs.files_hwnd: + winobjs.files_hwnd[winobjs.module_cur_hwnd].seek(distance) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + data = wh.info.seek(distance) + else: + raise ValueError('unknown filename') + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_SetEndOfFile(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hwnd, = args + if hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + wh.info.seek(0, 2) + else: + raise ValueError('unknown filename') + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_FlushFileBuffers(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + hwnd, = args + if hwnd in winobjs.handle_pool: + pass + else: + raise ValueError('unknown filename') + myjit.func_ret_stdcall(ret_ad, 1) + + +def kernel32_WriteFile(myjit): + ret_ad, args = myjit.func_args_stdcall(5) + (hwnd, lpbuffer, nnumberofbytestowrite, + lpnumberofbyteswrite, lpoverlapped) = args + + data = myjit.vm.vm_get_mem(lpbuffer, nnumberofbytestowrite) + + if hwnd == winobjs.module_cur_hwnd: + pass + elif hwnd in winobjs.handle_pool: + pass + else: + raise ValueError('unknown hwnd!') + + eax = 0xffffffff + if hwnd in winobjs.files_hwnd: + winobjs.files_hwnd[winobjs.module_cur_hwnd].write(data) + elif hwnd in winobjs.handle_pool: + wh = winobjs.handle_pool[hwnd] + wh.info.write(data) + else: + raise ValueError('unknown filename') + + if (lpnumberofbyteswrite): + myjit.vm.vm_set_mem(lpnumberofbyteswrite, pck32(len(data))) + + myjit.func_ret_stdcall(ret_ad, 1) + + +def user32_IsCharUpperA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + c, = args + + if c & 0x20: + ret = 0 + else: + ret = 1 + myjit.func_ret_stdcall(ret_ad, ret) + + +def user32_IsCharLowerA(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + c, = args + + if c & 0x20: + ret = 1 + else: + ret = 0 + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetSystemDefaultLangID(myjit): + ret_ad, args = myjit.func_args_stdcall(0) + myjit.func_ret_stdcall(ret_ad, 0x409) # encglish + + +def msvcrt_malloc(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + msize, = args + addr = alloc_mem(myjit, msize) + myjit.func_ret_cdecl(ret_ad, addr) + + +def msvcrt_free(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + ptr, = args + myjit.func_ret_cdecl(ret_ad, 0) + + +def msvcrt_fopen(myjit): + ret_ad, args = myjit.func_args_cdecl(2) + fname, rw = args + + fname = get_str_ansi(myjit, fname) + rw = get_str_ansi(myjit, rw) + print fname, rw + if rw in ['rb', 'wb+']: + fname = fname.replace('\\', "/").lower() + f = os.path.join('file_sb', fname) + h = open(f, rw) + eax = winobjs.handle_pool.add(f, h) + alloc_addr = alloc_mem(myjit, 0x20) + myjit.vm.vm_set_mem(alloc_addr, pck32(0x11112222) + pck32( + 0) + pck32(0) + pck32(0) + pck32(eax)) # pck32(0x11112222) + else: + raise NotImplementedError("Untested case") + + myjit.func_ret_cdecl(ret_ad, alloc_addr) + + +def msvcrt_fseek(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + stream, offset, orig = args + fd = upck32(myjit.vm.vm_get_mem(stream + 0x10, 4)) + print hex(fd) + + if not fd in winobjs.handle_pool: + raise NotImplementedError("Untested case") + o = winobjs.handle_pool[fd] + o.info.seek(offset, orig) + myjit.func_ret_cdecl(ret_ad, 0) + + +def msvcrt_ftell(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + stream, = args + fd = upck32(myjit.vm.vm_get_mem(stream + 0x10, 4)) + print hex(fd) + + if not fd in winobjs.handle_pool: + raise NotImplementedError("Untested case") + o = winobjs.handle_pool[fd] + off = o.info.tell() + myjit.func_ret_cdecl(ret_ad, off) + + +def msvcrt_rewind(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + stream, = args + fd = upck32(myjit.vm.vm_get_mem(stream + 0x10, 4)) + print hex(fd) + + if not fd in winobjs.handle_pool: + raise NotImplementedError("Untested case") + o = winobjs.handle_pool[fd] + off = o.info.seek(0, 0) + myjit.func_ret_cdecl(ret_ad, 0) + + +def msvcrt_fread(myjit): + ret_ad, args = myjit.func_args_cdecl(4) + buf, size, nmemb, stream = args + fd = upck32(myjit.vm.vm_get_mem(stream + 0x10, 4)) + print hex(fd) + if not fd in winobjs.handle_pool: + raise NotImplementedError("Untested case") + + data = winobjs.handle_pool[fd].info.read(size * nmemb) + myjit.vm.vm_set_mem(buf, data) + myjit.func_ret_cdecl(ret_ad, nmemb) + + +def msvcrt_fclose(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + stream, = args + fd = upck32(myjit.vm.vm_get_mem(stream + 0x10, 4)) + print hex(fd) + + if not fd in winobjs.handle_pool: + raise NotImplementedError("Untested case") + o = winobjs.handle_pool[fd] + off = o.info.close() + myjit.func_ret_cdecl(ret_ad, 0) + + +def msvcrt_atexit(myjit): + ret_ad, args = myjit.func_args_cdecl(1) + func, = args + myjit.func_ret_cdecl(ret_ad, 0) + + +def user32_MessageBoxA(myjit): + ret_ad, args = myjit.func_args_stdcall(4) + hwnd, lptext, lpcaption, utype = args + + text = get_str_ansi(myjit, lptext) + caption = get_str_ansi(myjit, lpcaption) + + print 'Caption:', repr(caption), 'Text:', repr(text) + + myjit.func_ret_stdcall(ret_ad, 0) + + +def kernel32_myGetTempPath(myjit, func): + ret_ad, args = myjit.func_args_stdcall(2) + l, buf = args + + l = 'c:\\temp\\' + myjit.vm.vm_set_mem(buf, func(l + '\x00')) + myjit.func_ret_stdcall(ret_ad, len(l)) + + +def kernel32_GetTempPathA(myjit): + kernel32_myGetTempPath(myjit, set_str_ansi) + + +def kernel32_GetTempPathW(myjit): + kernel32_myGetTempPath(myjit, set_str_unic) + + +temp_num = 0 + + +def kernel32_GetTempFileNameA(myjit): + global temp_num + ret_ad, args = myjit.func_args_stdcall(4) + path, ext, unique, buf = args + + temp_num += 1 + if ext: + ext = get_str_ansi(myjit, ext) + else: + ext = 'tmp' + if path: + path = get_str_ansi(myjit, path) + else: + path = "xxx" + print ext, path + fname = path + "\\" + "temp%.4d" % temp_num + "." + ext + print fname + myjit.vm.vm_set_mem(buf, fname) + + myjit.func_ret_stdcall(ret_ad, 0) + + +class win32_find_data: + fileattrib = 0 + creationtime = 0 + lastaccesstime = 0 + lastwritetime = 0 + filesizehigh = 0 + filesizelow = 0 + dwreserved0 = 0 + dwreserved1 = 0x1337beef + cfilename = "" + alternamefilename = "" + + def __init__(self, **kargs): + for k, v in kargs.items(): + setattr(self, k, v) + + def toStruct(self): + s = struct.pack('=IQQQIIII', + self.fileattrib, + self.creationtime, + self.lastaccesstime, + self.lastwritetime, + self.filesizehigh, + self.filesizelow, + self.dwreserved0, + self.dwreserved1) + fname = self.cfilename + '\x00' * win_api_x86_32.MAX_PATH + fname = fname[:win_api_x86_32.MAX_PATH] + s += fname + fname = self.alternamefilename + '\x00' * 14 + fname = fname[:14] + s += fname + return s + + +class find_data_mngr: + + def __init__(self): + self.patterns = {} + self.flist = [] + # handle number -> (flist index, current index in list) + self.handles = {} + + def add_list(self, pattern, flist): + index = len(self.flist) + self.flist.append(flist) + + self.patterns[pattern] = index + + def findfirst(self, pattern): + assert(pattern in self.patterns) + findex = self.patterns[pattern] + h = len(self.handles) + 1 + self.handles[h] = [findex, 0] + return h + + def findnext(self, h): + assert(h in self.handles) + findex, index = self.handles[h] + if index >= len(self.flist[findex]): + return None + fname = self.flist[findex][index] + self.handles[h][1] += 1 + + return fname + + +def kernel32_FindFirstFileA(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + pfilepattern, pfindfiledata = args + + filepattern = get_str_ansi(myjit, pfilepattern) + print repr(filepattern) + h = winobjs.find_data.findfirst(filepattern) + + fname = winobjs.find_data.findnext(h) + fdata = win32_find_data(cfilename=fname) + + myjit.vm.vm_set_mem(pfindfiledata, fdata.toStruct()) + myjit.func_ret_stdcall(ret_ad, h) + + +def kernel32_FindNextFileA(myjit): + ret_ad, args = myjit.func_args_stdcall(2) + handle, pfindfiledata = args + + fname = winobjs.find_data.findnext(handle) + if fname is None: + ret = 0 + else: + ret = 1 + fdata = win32_find_data(cfilename=fname) + myjit.vm.vm_set_mem(pfindfiledata, fdata.toStruct()) + + myjit.func_ret_stdcall(ret_ad, ret) + + +def kernel32_GetNativeSystemInfo(myjit): + ret_ad, args = myjit.func_args_stdcall(1) + sys_ptr, = args + sysinfo = systeminfo() + myjit.vm.vm_set_mem(sys_ptr, sysinfo.pack()) + myjit.func_ret_stdcall(ret_ad, 0) + + +def raw2guid(r): + o = struct.unpack('IHHHBBBBBB', r) + return '{%.8X-%.4X-%.4X-%.4X-%.2X%.2X%.2X%.2X%.2X%.2X}' % o + + +digs = string.digits + string.lowercase + + +def int2base(x, base): + if x < 0: + sign = -1 + elif x == 0: + return '0' + else: + sign = 1 + x *= sign + digits = [] + while x: + digits.append(digs[x % base]) + x /= base + if sign < 0: + digits.append('-') + digits.reverse() + return ''.join(digits) + + +def msvcrt__ultow(myjit): + ret_ad, args = myjit.func_args_cdecl(3) + value, p, radix = args + + value &= 0xFFFFFFFF + if not radix in [10, 16, 20]: + TODO_TEST + s = int2base(value, radix) + myjit.vm.vm_set_mem(p, set_str_unic(s + "\x00")) + myjit.func_ret_cdecl(ret_ad, p) + + +def msvcrt_myfopen(myjit, func): + ret_ad, args = myjit.func_args_cdecl(2) + pfname, pmode = args + + + fname = func(myjit, pfname) + rw = func(myjit, pmode) + print repr(fname) + print repr(rw) + + if rw in ['r', 'rb', 'wb+']: + fname = fname.replace('\\', "/").lower() + f = os.path.join('file_sb', fname) + h = open(f, rw) + eax = winobjs.handle_pool.add(f, h) + dwsize = 0x20 + alloc_addr = alloc_mem(myjit, dwsize) + pp = pck32(0x11112222)+pck32(0)+pck32(0)+pck32(0)+pck32(eax)#pdw(0x11112222) + myjit.vm.vm_set_mem(alloc_addr, pp) + + + else: + raise ValueError('unknown access mode %s'%rw) + + myjit.func_ret_cdecl(ret_ad, alloc_addr) + +def msvcrt__wfopen(myjit): + msvcrt_myfopen(myjit, get_str_unic) + +def msvcrt_fopen(myjit): + msvcrt_myfopen(myjit, get_str_ansi) diff --git a/miasm2/jitter/os_dep/win_api_x86_32_seh.py b/miasm2/jitter/os_dep/win_api_x86_32_seh.py new file mode 100644 index 00000000..4136c592 --- /dev/null +++ b/miasm2/jitter/os_dep/win_api_x86_32_seh.py @@ -0,0 +1,896 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +# +# Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +import logging +from elfesteem import pe_init +from miasm2.jitter.vm_mngr import * +from miasm2.jitter.csts import * +from miasm2.core.utils import * +from miasm2.arch import x86 +import os + +# Constants Windows +EXCEPTION_BREAKPOINT = 0x80000003 +EXCEPTION_ACCESS_VIOLATION = 0xc0000005 +EXCEPTION_INT_DIVIDE_BY_ZERO = 0xc0000094 +EXCEPTION_PRIV_INSTRUCTION = 0xc0000096 +EXCEPTION_ILLEGAL_INSTRUCTION = 0xc000001d + + +log = logging.getLogger("seh_helper") +console_handler = logging.StreamHandler() +console_handler.setFormatter(logging.Formatter("%(levelname)-5s: %(message)s")) +log.addHandler(console_handler) +log.setLevel(logging.WARN) + +FS_0_AD = 0x7ff70000 +PEB_AD = 0x7ffdf000 +LDR_AD = 0x340000 + +MAX_MODULES = 0x40 + +# fs:[0] Page (TIB) +tib_address = FS_0_AD +peb_address = PEB_AD +peb_ldr_data_offset = 0x1ea0 +peb_ldr_data_address = LDR_AD + peb_ldr_data_offset # PEB_AD + 0x1000 + + +modules_list_offset = 0x1f00 + +InInitializationOrderModuleList_offset = 0x1ee0 # 0x1f48 +InInitializationOrderModuleList_address = LDR_AD + \ + InInitializationOrderModuleList_offset # PEB_AD + 0x2000 + +InLoadOrderModuleList_offset = 0x1ee0 + \ + MAX_MODULES * 0x1000 # 0x1f48 + MAX_MODULES*0x1000 +InLoadOrderModuleList_address = LDR_AD + \ + InLoadOrderModuleList_offset # PEB_AD + 0x2000 + +# in_load_order_module_1 = LDR_AD + +# in_load_order_module_list_offset#PEB_AD + 0x3000 +default_seh = PEB_AD + 0x20000 + +process_environment_address = 0x10000 +process_parameters_address = 0x200000 + +context_address = 0x201000 +exception_record_address = context_address + 0x1000 +return_from_exception = 0x6eadbeef + +FAKE_SEH_B_AD = context_address + 0x2000 + +cur_seh_ad = FAKE_SEH_B_AD + +loaded_modules = ["ntdll.dll", "kernel32.dll"] +main_pe = None +main_pe_name = "c:\\xxx\\toto.exe" + + +def build_fake_teb(): + """ + +0x000 NtTib : _NT_TIB + +0x01c EnvironmentPointer : Ptr32 Void + +0x020 ClientId : _CLIENT_ID + +0x028 ActiveRpcHandle : Ptr32 Void + +0x02c ThreadLocalStoragePointer : Ptr32 Void + +0x030 ProcessEnvironmentBlock : Ptr32 _PEB + +0x034 LastErrorValue : Uint4B + ... + """ + o = "" + o += pck32(default_seh) + o += (0x18 - len(o)) * "\x00" + o += pck32(tib_address) + + o += (0x30 - len(o)) * "\x00" + o += pck32(peb_address) + o += pck32(0x11223344) + + return o + + +def build_fake_peb(): + """ + +0x000 InheritedAddressSpace : UChar + +0x001 ReadImageFileExecOptions : UChar + +0x002 BeingDebugged : UChar + +0x003 SpareBool : UChar + +0x004 Mutant : Ptr32 Void + +0x008 ImageBaseAddress : Ptr32 Void + +0x00c Ldr : Ptr32 _PEB_LDR_DATA + +0x010 processparameter + """ + + offset_serverdata = 0x100 + offset_data1 = 0x108 + offset_data2 = 0x110 + o = "" + o += "\x00" * 0x8 + if main_pe: + o += pck32(main_pe.NThdr.ImageBase) + else: + o += "AAAA" + o += pck32(peb_ldr_data_address) + o += pck32(process_parameters_address) + + o += (0x54 - len(o)) * "A" + o += pck32(peb_address + offset_serverdata) + o += (0x64 - len(o)) * "E" + o += pck32(1) # number of cpu + + o += (offset_serverdata - len(o)) * "B" + o += pck32(0x33333333) + o += pck32(peb_address + offset_data1) + o += (offset_data1 - len(o)) * "C" + o += pck32(0x44444444) + o += pck32(peb_address + offset_data2) + o += (offset_data2 - len(o)) * "D" + o += pck32(0x55555555) + o += pck32(0x0077007C) + return o + + +def build_fake_ldr_data(modules_info): + """ + +0x000 Length : Uint4B + +0x004 Initialized : UChar + +0x008 SsHandle : Ptr32 Void + +0x00c InLoadOrderModuleList : _LIST_ENTRY + +0x014 InMemoryOrderModuleList : _LIST_ENTRY + +0x01C InInitializationOrderModuleList : _LIST_ENTRY + """ + o = "" + # ldr offset pad + o += "\x00" * peb_ldr_data_offset + o += "\x00" * 0xc + # text XXX + + # get main pe info + m_e = None + for bname, (addr, e) in modules_info.items(): + if e == main_pe: + m_e = (e, bname, addr) + break + if not m_e: + log.warn('no main pe, ldr data will be unconsistant') + else: + print 'inloadorder first', hex(m_e[2]) + o += pck32(m_e[2]) + pck32(0) + + # get ntdll + ntdll_e = None + for bname, (addr, e) in modules_info.items(): + if bname[::2].lower() == "ntdll.dll": + ntdll_e = (e, bname, addr) + continue + if not ntdll_e: + log.warn('no ntdll, ldr data will be unconsistant') + else: + print 'ntdll', hex(ntdll_e[2]) + o += pck32(ntdll_e[2] + 0x8) + pck32(0) # XXX TODO + o += pck32(ntdll_e[2] + 0x10) + pck32(0) + + return o + +# def build_fake_InInitializationOrderModuleList(modules_name): +# """ +# +0x000 Flink : Ptr32 -+ This distance +# +0x004 Blink : Ptr32 | is eight bytes +# +0x018 DllBase : Ptr32 Void -+ DllBase +# +0x01c EntryPoint : Ptr32 Void +# +0x020 SizeOfImage : Uint4B +# +0x024 FullDllName : _UNICODE_STRING +# +0x02c BaseDllName : _UNICODE_STRING +# +0x034 Flags : Uint4B +# +0x038 LoadCount : Uint2B +# +0x03a TlsIndex : Uint2B +# +0x03c HashLinks : _LIST_ENTRY +# +0x03c SectionPointer : Ptr32 Void +# +0x040 CheckSum : Uint4B +# +0x044 TimeDateStamp : Uint4B +# +0x044 LoadedImports : Ptr32 Void +# +0x048 EntryPointActivationContext : Ptr32 Void +# +0x04c PatchInformation : Ptr32 Void +# """ +# +# o = "" +# offset_name = 0x700 +# for i, m in enumerate(modules_name): +# fname = os.path.join('win_dll', m) +# if isinstance(m, tuple): +# fname, e = m +# else: +# fname, e = m, None +# bname = os.path.split(fname)[1].lower() +# bname = "\x00".join(bname)+"\x00" +# print "add module", repr(bname) +# print hex(InInitializationOrderModuleList_address+i*0x1000) +# if e == None: +# e = pe_init.PE(open(fname, 'rb').read()) +# +# next_ad = InInitializationOrderModuleList_address + (i+1)*0x1000 +# if i == len(modules_name) -1: +# next_ad = InInitializationOrderModuleList_address +# m_o = "" +# m_o += pck32(next_ad ) +# m_o += pck32(InInitializationOrderModuleList_address + (i-1)*0x1000) +# m_o += pck32(next_ad + 8 ) +# m_o += pck32(InInitializationOrderModuleList_address +# + (i-1)*0x1000 + 8) +# m_o += pck32(next_ad + 0x10 ) +# m_o += pck32(InInitializationOrderModuleList_address +# + (i-1)*0x1000 + 0x10) +# m_o += pck32(e.NThdr.ImageBase) +# m_o += pck32(e.rva2virt(e.Opthdr.AddressOfEntryPoint)) +# m_o += pck32(e.NThdr.sizeofimage) +# +# m_o += (0x24 - len(m_o))*"A" +# print hex(len(bname)), repr(bname) +# m_o += struct.pack('HH', len(bname), len(bname)+2) +# m_o += pck32(InInitializationOrderModuleList_address +# + i*0x1000+offset_name) +# +# m_o += (0x2C - len(m_o))*"A" +# m_o += struct.pack('HH', len(bname), len(bname)+2) +# m_o += pck32(InInitializationOrderModuleList_address +# + i*0x1000+offset_name) +# +# m_o += (offset_name - len(m_o))*"B" +# m_o += bname +# m_o += "\x00"*3 +# +# +# m_o += (0x1000 - len(m_o))*"J" +# +# print "module", "%.8X"%e.NThdr.ImageBase, fname +# +# o += m_o +# return o +# +dummy_e = pe_init.PE() +dummy_e.NThdr.ImageBase = 0 +dummy_e.Opthdr.AddressOfEntryPoint = 0 +dummy_e.NThdr.sizeofimage = 0 + + +def create_modules_chain(myjit, modules_name): + modules_info = {} + base_addr = LDR_AD + modules_list_offset # XXXX + offset_name = 0x500 + offset_path = 0x600 + + out = "" + for i, m in enumerate([(main_pe_name, main_pe), + ("", dummy_e)] + modules_name): + addr = base_addr + i * 0x1000 + # fname = os.path.join('win_dll', m) + if isinstance(m, tuple): + fname, e = m + else: + fname, e = m, None + bpath = fname.replace('/', '\\') + bname = os.path.split(fname)[1].lower() + bname = "\x00".join(bname) + "\x00" + # print "add module", repr(bname), repr(bpath) + # print hex(InInitializationOrderModuleList_address+i*0x1000) + if e is None: + if i == 0: + full_name = fname + else: + full_name = os.path.join("win_dll", fname) + try: + e = pe_init.PE(open(full_name, 'rb').read()) + except IOError: + log.error('no main pe, ldr data will be unconsistant!!') + e = None + if e is None: + continue + print "add module", hex(e.NThdr.ImageBase), repr(bname) + + modules_info[bname] = addr, e + + m_o = "" + m_o += pck32(0) + m_o += pck32(0) + m_o += pck32(0) + m_o += pck32(0) + m_o += pck32(0) + m_o += pck32(0) + m_o += pck32(e.NThdr.ImageBase) + m_o += pck32(e.rva2virt(e.Opthdr.AddressOfEntryPoint)) + m_o += pck32(e.NThdr.sizeofimage) + + m_o += (0x24 - len(m_o)) * "A" + print hex(len(bname)), repr(bname) + m_o += struct.pack('HH', len(bname), len(bname) + 2) + m_o += pck32(addr + offset_path) + + m_o += (0x2C - len(m_o)) * "A" + m_o += struct.pack('HH', len(bname), len(bname) + 2) + m_o += pck32(addr + offset_name) + + m_o += (offset_name - len(m_o)) * "B" + m_o += bname + m_o += "\x00" * 3 + + m_o += (offset_path - len(m_o)) * "B" + m_o += "\x00".join(bpath) + "\x00" + m_o += "\x00" * 3 + # out += m_o + myjit.vm.vm_set_mem(addr, m_o) + return modules_info + + +def fix_InLoadOrderModuleList(myjit, module_info): + print "fix inloadorder" + # first binary is PE + # last is dumm_e + olist = [] + m_e = None + d_e = None + for m in [main_pe_name, ""] + loaded_modules: + + if isinstance(m, tuple): + fname, e = m + else: + fname, e = m, None + + if "/" in fname: + fname = fname[fname.rfind("/") + 1:] + bname = '\x00'.join(fname) + '\x00' + if not bname.lower() in module_info: + log.warn('module not found, ldr data will be unconsistant') + continue + + addr, e = module_info[bname.lower()] + # for bname, (addr, e) in module_info.items(): + print bname + if e == main_pe: + m_e = (e, bname, addr) + continue + elif e == dummy_e: + d_e = (e, bname, addr) + continue + olist.append((e, bname, addr)) + if not m_e or not d_e: + log.warn('no main pe, ldr data will be unconsistant') + else: + olist[0:0] = [m_e] + olist.append(d_e) + + last_addr = 0 + for i in xrange(len(olist)): + e, bname, addr = olist[i] + p_e, p_bname, p_addr = olist[(i - 1) % len(olist)] + n_e, n_bname, n_addr = olist[(i + 1) % len(olist)] + myjit.vm.vm_set_mem(addr + 0, pck32(n_addr) + pck32(p_addr)) + + +def fix_InMemoryOrderModuleList(myjit, module_info): + # first binary is PE + # last is dumm_e + olist = [] + m_e = None + d_e = None + for m in [main_pe_name, ""] + loaded_modules: + + if isinstance(m, tuple): + fname, e = m + else: + fname, e = m, None + + if "/" in fname: + fname = fname[fname.rfind("/") + 1:] + bname = '\x00'.join(fname) + '\x00' + if not bname.lower() in module_info: + log.warn('module not found, ldr data will be unconsistant') + continue + addr, e = module_info[bname.lower()] + # for bname, (addr, e) in module_info.items(): + print bname + if e == main_pe: + m_e = (e, bname, addr) + continue + elif e == dummy_e: + d_e = (e, bname, addr) + continue + olist.append((e, bname, addr)) + if not m_e or not d_e: + log.warn('no main pe, ldr data will be unconsistant') + else: + olist[0:0] = [m_e] + olist.append(d_e) + + last_addr = 0 + + for i in xrange(len(olist)): + e, bname, addr = olist[i] + p_e, p_bname, p_addr = olist[(i - 1) % len(olist)] + n_e, n_bname, n_addr = olist[(i + 1) % len(olist)] + myjit.vm.vm_set_mem( + addr + 0x8, pck32(n_addr + 0x8) + pck32(p_addr + 0x8)) + + +def fix_InInitializationOrderModuleList(myjit, module_info): + # first binary is ntdll + # second binary is kernel32 + olist = [] + ntdll_e = None + kernel_e = None + for bname, (addr, e) in module_info.items(): + if bname[::2].lower() == "ntdll.dll": + ntdll_e = (e, bname, addr) + continue + elif bname[::2].lower() == "kernel32.dll": + kernel_e = (e, bname, addr) + continue + elif e == dummy_e: + d_e = (e, bname, addr) + continue + elif e == main_pe: + continue + olist.append((e, bname, addr)) + if not ntdll_e or not kernel_e or not d_e: + log.warn('no kernel ntdll, ldr data will be unconsistant') + else: + olist[0:0] = [ntdll_e] + olist[1:1] = [kernel_e] + + olist.append(d_e) + + last_addr = 0 + for i in xrange(len(olist)): + e, bname, addr = olist[i] + p_e, p_bname, p_addr = olist[(i - 1) % len(olist)] + n_e, n_bname, n_addr = olist[(i + 1) % len(olist)] + myjit.vm.vm_set_mem( + addr + 0x10, pck32(n_addr + 0x10) + pck32(p_addr + 0x10)) + + +def add_process_env(myjit): + env_str = 'ALLUSEESPROFILE=C:\\Documents and Settings\\All Users\x00' + env_str = '\x00'.join(env_str) + env_str += "\x00" * 0x10 + myjit.vm.vm_add_memory_page(process_environment_address, + PAGE_READ | PAGE_WRITE, + env_str) + myjit.vm.vm_set_mem(process_environment_address, env_str) + + +def add_process_parameters(myjit): + o = "" + o += pck32(0x1000) # size + o += "E" * (0x48 - len(o)) + o += pck32(process_environment_address) + myjit.vm.vm_add_memory_page(process_parameters_address, + PAGE_READ | PAGE_WRITE, + o) + + +def build_fake_InLoadOrderModuleList(modules_name): + """ + +0x000 Flink : Ptr32 -+ This distance + +0x004 Blink : Ptr32 | is eight bytes + +0x018 DllBase : Ptr32 Void -+ DllBase -> _IMAGE_DOS_HEADER + +0x01c EntryPoint : Ptr32 Void + +0x020 SizeOfImage : Uint4B + +0x024 FullDllName : _UNICODE_STRING + +0x02c BaseDllName : _UNICODE_STRING + +0x034 Flags : Uint4B + +0x038 LoadCount : Uint2B + +0x03a TlsIndex : Uint2B + +0x03c HashLinks : _LIST_ENTRY + +0x03c SectionPointer : Ptr32 Void + +0x040 CheckSum : Uint4B + +0x044 TimeDateStamp : Uint4B + +0x044 LoadedImports : Ptr32 Void + +0x048 EntryPointActivationContext : Ptr32 Void + +0x04c PatchInformation : Ptr32 Void + """ + + o = "" + offset_name = 0x700 + first_name = "\x00".join(main_pe_name + "\x00\x00") + + o = "" + o += pck32(InLoadOrderModuleList_address) + o += pck32(InLoadOrderModuleList_address + + (len(modules_name) - 1) * 0x1000) + o += pck32(InLoadOrderModuleList_address + 8) + o += pck32(InLoadOrderModuleList_address + + (len(modules_name) - 1) * 0x1000 + 8) + o += pck32(InLoadOrderModuleList_address + 0x10) + o += pck32(InLoadOrderModuleList_address + + (len(modules_name) - 1) * 0x1000 + 0x10) + + if main_pe: + o += pck32(main_pe.NThdr.ImageBase) + o += pck32(main_pe.rva2virt(main_pe.Opthdr.AddressOfEntryPoint)) + else: + # no fixed values + pass + + o += (0x24 - len(o)) * "A" + o += struct.pack('HH', len(first_name), len(first_name)) + o += pck32(InLoadOrderModuleList_address + offset_name) + + o += (0x2C - len(o)) * "A" + o += struct.pack('HH', len(first_name), len(first_name)) + o += pck32(InLoadOrderModuleList_address + offset_name) + + o += (offset_name - len(o)) * "B" + o += first_name + o += (0x1000 - len(o)) * "C" + for i, m in enumerate(modules_name): + # fname = os.path.join('win_dll', m) + if isinstance(m, tuple): + fname, e = m + else: + fname, e = m, None + bname = os.path.split(fname)[1].lower() + bname = "\x00".join(bname) + "\x00" + print hex(InLoadOrderModuleList_address + i * 0x1000) + if e is None: + e = pe_init.PE(open(fname, 'rb').read()) + + print "add module", hex(e.NThdr.ImageBase), repr(bname) + + next_ad = InLoadOrderModuleList_address + (i + 1) * 0x1000 + if i == len(modules_name) - 1: + next_ad = InLoadOrderModuleList_address + m_o = "" + m_o += pck32(next_ad) + m_o += pck32(InLoadOrderModuleList_address + (i - 1) * 0x1000) + m_o += pck32(next_ad + 8) + m_o += pck32(InLoadOrderModuleList_address + (i - 1) * 0x1000 + 8) + m_o += pck32(next_ad + 0x10) + m_o += pck32(InLoadOrderModuleList_address + (i - 1) * 0x1000 + 0x10) + m_o += pck32(e.NThdr.ImageBase) + m_o += pck32(e.rva2virt(e.Opthdr.AddressOfEntryPoint)) + m_o += pck32(e.NThdr.sizeofimage) + + m_o += (0x24 - len(m_o)) * "A" + print hex(len(bname)), repr(bname) + m_o += struct.pack('HH', len(bname), len(bname) + 2) + m_o += pck32(InLoadOrderModuleList_address + i * 0x1000 + offset_name) + + m_o += (0x2C - len(m_o)) * "A" + m_o += struct.pack('HH', len(bname), len(bname) + 2) + m_o += pck32(InLoadOrderModuleList_address + i * 0x1000 + offset_name) + + m_o += (offset_name - len(m_o)) * "B" + m_o += bname + m_o += "\x00" * 3 + + m_o += (0x1000 - len(m_o)) * "J" + + print "module", "%.8X" % e.NThdr.ImageBase, fname + + o += m_o + return o + + +all_seh_ad = dict([(x, None) + for x in xrange(FAKE_SEH_B_AD, FAKE_SEH_B_AD + 0x1000, 0x20)]) +# http://blog.fireeye.com/research/2010/08/download_exec_notes.html + + +def init_seh(myjit): + global seh_count + seh_count = 0 + # myjit.vm.vm_add_memory_page(tib_address, PAGE_READ | PAGE_WRITE, + # p(default_seh) + p(0) * 11 + p(peb_address)) + myjit.vm.vm_add_memory_page( + FS_0_AD, PAGE_READ | PAGE_WRITE, build_fake_teb()) + # myjit.vm.vm_add_memory_page(peb_address, PAGE_READ | PAGE_WRITE, p(0) * + # 3 + p(peb_ldr_data_address)) + myjit.vm.vm_add_memory_page( + peb_address, PAGE_READ | PAGE_WRITE, build_fake_peb()) + # myjit.vm.vm_add_memory_page(peb_ldr_data_address, PAGE_READ | + # PAGE_WRITE, p(0) * 3 + p(in_load_order_module_list_address) + p(0) * + # 0x20) + + """ + ldr_data += "\x00"*(InInitializationOrderModuleList_offset - len(ldr_data)) + ldr_data += build_fake_InInitializationOrderModuleList(loaded_modules) + ldr_data += "\x00"*(InLoadOrderModuleList_offset - len(ldr_data)) + ldr_data += build_fake_InLoadOrderModuleList(loaded_modules) + """ + myjit.vm.vm_add_memory_page( + LDR_AD, PAGE_READ | PAGE_WRITE, "\x00" * MAX_MODULES * 0x1000) + module_info = create_modules_chain(myjit, loaded_modules) + fix_InLoadOrderModuleList(myjit, module_info) + fix_InMemoryOrderModuleList(myjit, module_info) + fix_InInitializationOrderModuleList(myjit, module_info) + + ldr_data = build_fake_ldr_data(module_info) + myjit.vm.vm_set_mem(LDR_AD, ldr_data) + add_process_env(myjit) + add_process_parameters(myjit) + + # myjit.vm.vm_add_memory_page(in_load_order_module_list_address, + # PAGE_READ | PAGE_WRITE, p(0) * 40) + # myjit.vm.vm_add_memory_page(in_load_order_module_list_address, + # PAGE_READ | PAGE_WRITE, build_fake_inordermodule(loaded_modules)) + myjit.vm.vm_add_memory_page(default_seh, PAGE_READ | PAGE_WRITE, pck32( + 0xffffffff) + pck32(0x41414141) + pck32(0x42424242)) + + myjit.vm.vm_add_memory_page( + context_address, PAGE_READ | PAGE_WRITE, '\x00' * 0x2cc) + myjit.vm.vm_add_memory_page( + exception_record_address, PAGE_READ | PAGE_WRITE, '\x00' * 200) + + myjit.vm.vm_add_memory_page( + FAKE_SEH_B_AD, PAGE_READ | PAGE_WRITE, 0x10000 * "\x00") + +# http://www.codeproject.com/KB/system/inject2exe.aspx#RestorethefirstRegistersContext5_1 + + +def regs2ctxt(regs): + ctxt = "" + ctxt += '\x00\x00\x00\x00' # ContextFlags + ctxt += '\x00\x00\x00\x00' * 6 # drX + ctxt += '\x00' * 112 # float context + ctxt += '\x00\x00\x00\x00' + '\x3b\x00\x00\x00' + \ + '\x23\x00\x00\x00' + '\x23\x00\x00\x00' # segment selectors + ctxt += pck32(regs['EDI']) + pck32(regs['ESI']) + pck32(regs['EBX']) + \ + pck32(regs['EDX']) + pck32(regs['ECX']) + pck32(regs['EAX']) + \ + pck32(regs['EBP']) + pck32(regs['EIP']) # gpregs + ctxt += '\x23\x00\x00\x00' # cs + ctxt += '\x00\x00\x00\x00' # eflags + ctxt += pck32(regs['ESP']) # esp + ctxt += '\x23\x00\x00\x00' # ss segment selector + return ctxt + + +def ctxt2regs(ctxt): + ctxt = ctxt[:] + regs = {} + # regs['ctxtsflags'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + for i in xrange(8): + if i in [4, 5]: + continue + # regs['dr%d'%i] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + + ctxt = ctxt[112:] # skip float + + # regs['seg_gs'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + # regs['seg_fs'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + # regs['seg_es'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + # regs['seg_ds'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + + regs['EDI'], regs['ESI'], regs['EBX'], regs['EDX'], regs['ECX'], regs[ + 'EAX'], regs['EBP'], regs['EIP'] = struct.unpack('I' * 8, ctxt[:4 * 8]) + ctxt = ctxt[4 * 8:] + + # regs['seg_cs'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + + # regs['eflag'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + + regs['ESP'] = upck32(ctxt[:4]) + ctxt = ctxt[4:] + + for a, b in regs.items(): + print a, hex(b) + # skip extended + return regs + + +def get_free_seh_place(): + global all_seh_ad + ads = all_seh_ad.keys() + ads.sort() + for ad in ads: + v = all_seh_ad[ad] + if v is None: + print 'TAKING SEH', hex(ad) + all_seh_ad[ad] = True + return ad + raise ValueError('too many stacked seh ') + + +def free_seh_place(ad): + print 'RELEASING SEH', hex(ad) + + if not ad in all_seh_ad: + raise ValueError('zarb seh ad!', hex(ad)) + if all_seh_ad[ad] is not True: + # @wisk typolol + raise ValueError('seh alreaedy remouvede?!!', hex(ad)) + all_seh_ad[ad] = None + + +def fake_seh_handler(myjit, except_code): + global seh_count + regs = myjit.cpu.vm_get_gpreg() + print '-> exception at', hex(myjit.cpu.EIP), seh_count + seh_count += 1 + + # Help lambda + p = lambda s: struct.pack('I', s) + + # dump_gpregs_py() + # jitarch.dump_gpregs() + # Forge a CONTEXT + ctxt = '\x00\x00\x00\x00' + '\x00\x00\x00\x00' * 6 + '\x00' * 112 + ctxt += '\x00\x00\x00\x00' + '\x3b\x00\x00\x00' + '\x23\x00\x00\x00' + ctxt += '\x23\x00\x00\x00' + ctxt += pck32(myjit.cpu.EDI) + pck32(myjit.cpu.ESI) + \ + pck32(myjit.cpu.EBX) + pck32(myjit.cpu.EDX) + \ + pck32(myjit.cpu.ECX) + pck32(myjit.cpu.EAX) + \ + pck32(myjit.cpu.EBP) + pck32(myjit.cpu.EIP) + ctxt += '\x23\x00\x00\x00' + '\x00\x00\x00\x00' + pck32(myjit.cpu.ESP) + ctxt += '\x23\x00\x00\x00' + # ctxt = regs2ctxt(regs) + + # Find a room for seh + # seh = (get_memory_page_max_address_py()+0x1000)&0xfffff000 + + # Get current seh (fs:[0]) + seh_ptr = upck32(myjit.vm.vm_get_mem(tib_address, 4)) + + # Retrieve seh fields + old_seh, eh, safe_place = struct.unpack( + 'III', myjit.vm.vm_get_mem(seh_ptr, 0xc)) + + print '-> seh_ptr', hex(seh_ptr), '-> { old_seh', + print hex(old_seh), 'eh', hex(eh), 'safe_place', hex(safe_place), '}' + # print '-> write SEH at', hex(seh&0xffffffff) + + # Write current seh + # myjit.vm.vm_add_memory_page(seh, PAGE_READ | PAGE_WRITE, p(old_seh) + + # p(eh) + p(safe_place) + p(0x99999999)) + + # Write context + myjit.vm.vm_set_mem(context_address, ctxt) + + # Write exception_record + + """ + #http://msdn.microsoft.com/en-us/library/aa363082(v=vs.85).aspx + + typedef struct _EXCEPTION_RECORD { + DWORD ExceptionCode; + DWORD ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + PVOID ExceptionAddress; + DWORD NumberParameters; + ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; + } EXCEPTION_RECORD, *PEXCEPTION_RECORD; + """ + + myjit.vm.vm_set_mem(exception_record_address, pck32(except_code) + + pck32(0) + pck32(0) + pck32(myjit.cpu.EIP) + + pck32(0) + pck32(0)) + + # Prepare the stack + myjit.vm_push_uint32_t(context_address) # Context + myjit.vm_push_uint32_t(seh_ptr) # SEH + myjit.vm_push_uint32_t(exception_record_address) # ExceptRecords + myjit.vm_push_uint32_t(return_from_exception) # Ret address + + # Set fake new current seh for exception + fake_seh_ad = get_free_seh_place() + print hex(fake_seh_ad) + myjit.vm.vm_set_mem(fake_seh_ad, pck32(seh_ptr) + pck32( + 0xaaaaaaaa) + pck32(0xaaaaaabb) + pck32(0xaaaaaacc)) + myjit.vm.vm_set_mem(tib_address, pck32(fake_seh_ad)) + + dump_seh(myjit) + + print '-> jumping at', hex(eh) + myjit.vm.vm_set_exception(0) + myjit.cpu.vm_set_exception(0) + + # XXX set ebx to nul? + myjit.cpu.EBX = 0 + + return eh + +fake_seh_handler.base = FAKE_SEH_B_AD + + +def dump_seh(myjit): + print 'dump_seh:' + print '-> tib_address:', hex(tib_address) + cur_seh_ptr = upck32(myjit.vm.vm_get_mem(tib_address, 4)) + indent = 1 + loop = 0 + while True: + if loop > 5: + print "too many seh, quit" + return + prev_seh, eh = struct.unpack('II', myjit.vm.vm_get_mem(cur_seh_ptr, 8)) + print '\t' * indent + 'seh_ptr:', hex(cur_seh_ptr), + print ' -> { prev_seh:', hex(prev_seh), 'eh:', hex(eh), '}' + if prev_seh in [0xFFFFFFFF, 0]: + break + cur_seh_ptr = prev_seh + indent += 1 + loop += 1 + + +def set_win_fs_0(myjit, fs=4): + regs = myjit.cpu.vm_get_gpreg() + regs['FS'] = 0x4 + myjit.cpu.vm_set_gpreg(regs) + myjit.cpu.vm_set_segm_base(regs['FS'], FS_0_AD) + segm_to_do = set([x86.regs.FS]) + return segm_to_do + + +def add_modules_info(pe_in, pe_in_name="toto.exe", all_pe=None): + global main_pe, main_pe_name, loaded_modules + if all_pe is None: + all_pe = [] + main_pe = pe_in + main_pe_name = pe_in_name + loaded_modules = all_pe + + +def return_from_seh(myjit): + "Handle return after a call to fake seh handler" + + # Get current context + myjit.cpu.ESP = upck32(myjit.vm.vm_get_mem(context_address + 0xc4, 4)) + logging.info('-> new esp: %x' % myjit.cpu.ESP) + + # Rebuild SEH + old_seh = upck32(myjit.vm.vm_get_mem(tib_address, 4)) + new_seh = upck32(myjit.vm.vm_get_mem(old_seh, 4)) + logging.info('-> old seh: %x' % old_seh) + logging.info('-> new seh: %x' % new_seh) + myjit.vm.vm_set_mem(tib_address, pck32(new_seh)) + + dump_seh(myjit) + + # Release SEH + free_seh_place(old_seh) + + if myjit.cpu.EAX == 0x0: + # ExceptionContinueExecution + print '-> seh continues' + ctxt_ptr = context_address + print '-> context:', hex(ctxt_ptr) + + # Get registers changes + ctxt_str = myjit.vm.vm_get_mem(ctxt_ptr, 0x2cc) + regs = ctxt2regs(ctxt_str) + myjit.pc = regs["EIP"] + for reg_name, reg_value in regs.items(): + setattr(myjit.cpu, reg_name, reg_value) + + logging.info('-> context::Eip: %x' % myjit.pc) + + elif myjit.cpu.EAX == -1: + raise NotImplementedError("-> seh try to go to the next handler") + + elif myjit.cpu.EAX == 1: + # ExceptionContinueSearch + raise NotImplementedError("-> seh, gameover") diff --git a/miasm2/jitter/queue.h b/miasm2/jitter/queue.h new file mode 100644 index 00000000..0caf72fb --- /dev/null +++ b/miasm2/jitter/queue.h @@ -0,0 +1,553 @@ +/*- + * Copyright (c) 1991, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * @(#)queue.h 8.5 (Berkeley) 8/20/94 + * $FreeBSD$ + */ + +#ifndef _SYS_QUEUE_H_ +#define _SYS_QUEUE_H_ + +//#include <sys/cdefs.h> + +/* + * This file defines four types of data structures: singly-linked lists, + * singly-linked tail queues, lists and tail queues. + * + * A singly-linked list is headed by a single forward pointer. The elements + * are singly linked for minimum space and pointer manipulation overhead at + * the expense of O(n) removal for arbitrary elements. New elements can be + * added to the list after an existing element or at the head of the list. + * Elements being removed from the head of the list should use the explicit + * macro for this purpose for optimum efficiency. A singly-linked list may + * only be traversed in the forward direction. Singly-linked lists are ideal + * for applications with large datasets and few or no removals or for + * implementing a LIFO queue. + * + * A singly-linked tail queue is headed by a pair of pointers, one to the + * head of the list and the other to the tail of the list. The elements are + * singly linked for minimum space and pointer manipulation overhead at the + * expense of O(n) removal for arbitrary elements. New elements can be added + * to the list after an existing element, at the head of the list, or at the + * end of the list. Elements being removed from the head of the tail queue + * should use the explicit macro for this purpose for optimum efficiency. + * A singly-linked tail queue may only be traversed in the forward direction. + * Singly-linked tail queues are ideal for applications with large datasets + * and few or no removals or for implementing a FIFO queue. + * + * A list is headed by a single forward pointer (or an array of forward + * pointers for a hash table header). The elements are doubly linked + * so that an arbitrary element can be removed without a need to + * traverse the list. New elements can be added to the list before + * or after an existing element or at the head of the list. A list + * may only be traversed in the forward direction. + * + * A tail queue is headed by a pair of pointers, one to the head of the + * list and the other to the tail of the list. The elements are doubly + * linked so that an arbitrary element can be removed without a need to + * traverse the list. New elements can be added to the list before or + * after an existing element, at the head of the list, or at the end of + * the list. A tail queue may be traversed in either direction. + * + * For details on the use of these macros, see the queue(3) manual page. + * + * + * SLIST LIST STAILQ TAILQ + * _HEAD + + + + + * _HEAD_INITIALIZER + + + + + * _ENTRY + + + + + * _INIT + + + + + * _EMPTY + + + + + * _FIRST + + + + + * _NEXT + + + + + * _PREV - - - + + * _LAST - - + + + * _FOREACH + + + + + * _FOREACH_SAFE + + + + + * _FOREACH_REVERSE - - - + + * _FOREACH_REVERSE_SAFE - - - + + * _INSERT_HEAD + + + + + * _INSERT_BEFORE - + - + + * _INSERT_AFTER + + + + + * _INSERT_TAIL - - + + + * _CONCAT - - + + + * _REMOVE_HEAD + - + - + * _REMOVE + + + + + * + */ +#define QUEUE_MACRO_DEBUG 0 +#if QUEUE_MACRO_DEBUG +/* Store the last 2 places the queue element or head was altered */ +struct qm_trace { + char * lastfile; + int lastline; + char * prevfile; + int prevline; +}; + +#define TRACEBUF struct qm_trace trace; +#define TRASHIT(x) do {(x) = (void *)-1;} while (0) + +#define QMD_TRACE_HEAD(head) do { \ + (head)->trace.prevline = (head)->trace.lastline; \ + (head)->trace.prevfile = (head)->trace.lastfile; \ + (head)->trace.lastline = __LINE__; \ + (head)->trace.lastfile = __FILE__; \ +} while (0) + +#define QMD_TRACE_ELEM(elem) do { \ + (elem)->trace.prevline = (elem)->trace.lastline; \ + (elem)->trace.prevfile = (elem)->trace.lastfile; \ + (elem)->trace.lastline = __LINE__; \ + (elem)->trace.lastfile = __FILE__; \ +} while (0) + +#else +#define QMD_TRACE_ELEM(elem) +#define QMD_TRACE_HEAD(head) +#define TRACEBUF +#define TRASHIT(x) +#endif /* QUEUE_MACRO_DEBUG */ + +/* + * Singly-linked List declarations. + */ +#define SLIST_HEAD(name, type) \ +struct name { \ + struct type *slh_first; /* first element */ \ +} + +#define SLIST_HEAD_INITIALIZER(head) \ + { NULL } + +#define SLIST_ENTRY(type) \ +struct { \ + struct type *sle_next; /* next element */ \ +} + +/* + * Singly-linked List functions. + */ +#define SLIST_EMPTY(head) ((head)->slh_first == NULL) + +#define SLIST_FIRST(head) ((head)->slh_first) + +#define SLIST_FOREACH(var, head, field) \ + for ((var) = SLIST_FIRST((head)); \ + (var); \ + (var) = SLIST_NEXT((var), field)) + +#define SLIST_FOREACH_SAFE(var, head, field, tvar) \ + for ((var) = SLIST_FIRST((head)); \ + (var) && ((tvar) = SLIST_NEXT((var), field), 1); \ + (var) = (tvar)) + +#define SLIST_FOREACH_PREVPTR(var, varp, head, field) \ + for ((varp) = &SLIST_FIRST((head)); \ + ((var) = *(varp)) != NULL; \ + (varp) = &SLIST_NEXT((var), field)) + +#define SLIST_INIT(head) do { \ + SLIST_FIRST((head)) = NULL; \ +} while (0) + +#define SLIST_INSERT_AFTER(slistelm, elm, field) do { \ + SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field); \ + SLIST_NEXT((slistelm), field) = (elm); \ +} while (0) + +#define SLIST_INSERT_HEAD(head, elm, field) do { \ + SLIST_NEXT((elm), field) = SLIST_FIRST((head)); \ + SLIST_FIRST((head)) = (elm); \ +} while (0) + +#define SLIST_NEXT(elm, field) ((elm)->field.sle_next) + +#define SLIST_REMOVE(head, elm, type, field) do { \ + if (SLIST_FIRST((head)) == (elm)) { \ + SLIST_REMOVE_HEAD((head), field); \ + } \ + else { \ + struct type *curelm = SLIST_FIRST((head)); \ + while (SLIST_NEXT(curelm, field) != (elm)) \ + curelm = SLIST_NEXT(curelm, field); \ + SLIST_NEXT(curelm, field) = \ + SLIST_NEXT(SLIST_NEXT(curelm, field), field); \ + } \ +} while (0) + +#define SLIST_REMOVE_HEAD(head, field) do { \ + SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field); \ +} while (0) + +/* + * Singly-linked Tail queue declarations. + */ +#define STAILQ_HEAD(name, type) \ +struct name { \ + struct type *stqh_first;/* first element */ \ + struct type **stqh_last;/* addr of last next element */ \ +} + +#define STAILQ_HEAD_INITIALIZER(head) \ + { NULL, &(head).stqh_first } + +#define STAILQ_ENTRY(type) \ +struct { \ + struct type *stqe_next; /* next element */ \ +} + +/* + * Singly-linked Tail queue functions. + */ +#define STAILQ_CONCAT(head1, head2) do { \ + if (!STAILQ_EMPTY((head2))) { \ + *(head1)->stqh_last = (head2)->stqh_first; \ + (head1)->stqh_last = (head2)->stqh_last; \ + STAILQ_INIT((head2)); \ + } \ +} while (0) + +#define STAILQ_EMPTY(head) ((head)->stqh_first == NULL) + +#define STAILQ_FIRST(head) ((head)->stqh_first) + +#define STAILQ_FOREACH(var, head, field) \ + for((var) = STAILQ_FIRST((head)); \ + (var); \ + (var) = STAILQ_NEXT((var), field)) + + +#define STAILQ_FOREACH_SAFE(var, head, field, tvar) \ + for ((var) = STAILQ_FIRST((head)); \ + (var) && ((tvar) = STAILQ_NEXT((var), field), 1); \ + (var) = (tvar)) + +#define STAILQ_INIT(head) do { \ + STAILQ_FIRST((head)) = NULL; \ + (head)->stqh_last = &STAILQ_FIRST((head)); \ +} while (0) + +#define STAILQ_INSERT_AFTER(head, tqelm, elm, field) do { \ + if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\ + (head)->stqh_last = &STAILQ_NEXT((elm), field); \ + STAILQ_NEXT((tqelm), field) = (elm); \ +} while (0) + +#define STAILQ_INSERT_HEAD(head, elm, field) do { \ + if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL) \ + (head)->stqh_last = &STAILQ_NEXT((elm), field); \ + STAILQ_FIRST((head)) = (elm); \ +} while (0) + +#define STAILQ_INSERT_TAIL(head, elm, field) do { \ + STAILQ_NEXT((elm), field) = NULL; \ + *(head)->stqh_last = (elm); \ + (head)->stqh_last = &STAILQ_NEXT((elm), field); \ +} while (0) + +#define STAILQ_LAST(head, type, field) \ + (STAILQ_EMPTY((head)) ? \ + NULL : \ + ((struct type *) \ + ((char *)((head)->stqh_last) - __offsetof(struct type, field)))) + +#define STAILQ_NEXT(elm, field) ((elm)->field.stqe_next) + +#define STAILQ_REMOVE(head, elm, type, field) do { \ + if (STAILQ_FIRST((head)) == (elm)) { \ + STAILQ_REMOVE_HEAD((head), field); \ + } \ + else { \ + struct type *curelm = STAILQ_FIRST((head)); \ + while (STAILQ_NEXT(curelm, field) != (elm)) \ + curelm = STAILQ_NEXT(curelm, field); \ + if ((STAILQ_NEXT(curelm, field) = \ + STAILQ_NEXT(STAILQ_NEXT(curelm, field), field)) == NULL)\ + (head)->stqh_last = &STAILQ_NEXT((curelm), field);\ + } \ +} while (0) + +#define STAILQ_REMOVE_HEAD(head, field) do { \ + if ((STAILQ_FIRST((head)) = \ + STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL) \ + (head)->stqh_last = &STAILQ_FIRST((head)); \ +} while (0) + +#define STAILQ_REMOVE_HEAD_UNTIL(head, elm, field) do { \ + if ((STAILQ_FIRST((head)) = STAILQ_NEXT((elm), field)) == NULL) \ + (head)->stqh_last = &STAILQ_FIRST((head)); \ +} while (0) + +/* + * List declarations. + */ +#define LIST_HEAD(name, type) \ +struct name { \ + struct type *lh_first; /* first element */ \ +} + +#define LIST_HEAD_INITIALIZER(head) \ + { NULL } + +#define LIST_ENTRY(type) \ +struct { \ + struct type *le_next; /* next element */ \ + struct type **le_prev; /* address of previous next element */ \ +} + +/* + * List functions. + */ + +#define LIST_EMPTY(head) ((head)->lh_first == NULL) + +#define LIST_FIRST(head) ((head)->lh_first) + +#define LIST_FOREACH(var, head, field) \ + for ((var) = LIST_FIRST((head)); \ + (var); \ + (var) = LIST_NEXT((var), field)) + +#define LIST_FOREACH_SAFE(var, head, field, tvar) \ + for ((var) = LIST_FIRST((head)); \ + (var) && ((tvar) = LIST_NEXT((var), field), 1); \ + (var) = (tvar)) + +#define LIST_INIT(head) do { \ + LIST_FIRST((head)) = NULL; \ +} while (0) + +#define LIST_INSERT_AFTER(listelm, elm, field) do { \ + if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\ + LIST_NEXT((listelm), field)->field.le_prev = \ + &LIST_NEXT((elm), field); \ + LIST_NEXT((listelm), field) = (elm); \ + (elm)->field.le_prev = &LIST_NEXT((listelm), field); \ +} while (0) + +#define LIST_INSERT_BEFORE(listelm, elm, field) do { \ + (elm)->field.le_prev = (listelm)->field.le_prev; \ + LIST_NEXT((elm), field) = (listelm); \ + *(listelm)->field.le_prev = (elm); \ + (listelm)->field.le_prev = &LIST_NEXT((elm), field); \ +} while (0) + +#define LIST_INSERT_HEAD(head, elm, field) do { \ + if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \ + LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\ + LIST_FIRST((head)) = (elm); \ + (elm)->field.le_prev = &LIST_FIRST((head)); \ +} while (0) + +#define LIST_NEXT(elm, field) ((elm)->field.le_next) + +#define LIST_REMOVE(elm, field) do { \ + if (LIST_NEXT((elm), field) != NULL) \ + LIST_NEXT((elm), field)->field.le_prev = \ + (elm)->field.le_prev; \ + *(elm)->field.le_prev = LIST_NEXT((elm), field); \ +} while (0) + +/* + * Tail queue declarations. + */ +#define TAILQ_HEAD(name, type) \ +struct name { \ + struct type *tqh_first; /* first element */ \ + struct type **tqh_last; /* addr of last next element */ \ + TRACEBUF \ +} + +#define TAILQ_HEAD_INITIALIZER(head) \ + { NULL, &(head).tqh_first } + +#define TAILQ_ENTRY(type) \ +struct { \ + struct type *tqe_next; /* next element */ \ + struct type **tqe_prev; /* address of previous next element */ \ + TRACEBUF \ +} + +/* + * Tail queue functions. + */ +#define TAILQ_CONCAT(head1, head2, field) do { \ + if (!TAILQ_EMPTY(head2)) { \ + *(head1)->tqh_last = (head2)->tqh_first; \ + (head2)->tqh_first->field.tqe_prev = (head1)->tqh_last; \ + (head1)->tqh_last = (head2)->tqh_last; \ + TAILQ_INIT((head2)); \ + QMD_TRACE_HEAD(head); \ + QMD_TRACE_HEAD(head2); \ + } \ +} while (0) + +#define TAILQ_EMPTY(head) ((head)->tqh_first == NULL) + +#define TAILQ_FIRST(head) ((head)->tqh_first) + +#define TAILQ_FOREACH(var, head, field) \ + for ((var) = TAILQ_FIRST((head)); \ + (var); \ + (var) = TAILQ_NEXT((var), field)) + +#define TAILQ_FOREACH_SAFE(var, head, field, tvar) \ + for ((var) = TAILQ_FIRST((head)); \ + (var) && ((tvar) = TAILQ_NEXT((var), field), 1); \ + (var) = (tvar)) + +#define TAILQ_FOREACH_REVERSE(var, head, headname, field) \ + for ((var) = TAILQ_LAST((head), headname); \ + (var); \ + (var) = TAILQ_PREV((var), headname, field)) + +#define TAILQ_FOREACH_REVERSE_SAFE(var, head, headname, field, tvar) \ + for ((var) = TAILQ_LAST((head), headname); \ + (var) && ((tvar) = TAILQ_PREV((var), headname, field), 1); \ + (var) = (tvar)) + +#define TAILQ_INIT(head) do { \ + TAILQ_FIRST((head)) = NULL; \ + (head)->tqh_last = &TAILQ_FIRST((head)); \ + QMD_TRACE_HEAD(head); \ +} while (0) + +#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do { \ + if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\ + TAILQ_NEXT((elm), field)->field.tqe_prev = \ + &TAILQ_NEXT((elm), field); \ + else { \ + (head)->tqh_last = &TAILQ_NEXT((elm), field); \ + QMD_TRACE_HEAD(head); \ + } \ + TAILQ_NEXT((listelm), field) = (elm); \ + (elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field); \ + QMD_TRACE_ELEM(&(elm)->field); \ + QMD_TRACE_ELEM(&listelm->field); \ +} while (0) + +#define TAILQ_INSERT_BEFORE(listelm, elm, field) do { \ + (elm)->field.tqe_prev = (listelm)->field.tqe_prev; \ + TAILQ_NEXT((elm), field) = (listelm); \ + *(listelm)->field.tqe_prev = (elm); \ + (listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field); \ + QMD_TRACE_ELEM(&(elm)->field); \ + QMD_TRACE_ELEM(&listelm->field); \ +} while (0) + +#define TAILQ_INSERT_HEAD(head, elm, field) do { \ + if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL) \ + TAILQ_FIRST((head))->field.tqe_prev = \ + &TAILQ_NEXT((elm), field); \ + else \ + (head)->tqh_last = &TAILQ_NEXT((elm), field); \ + TAILQ_FIRST((head)) = (elm); \ + (elm)->field.tqe_prev = &TAILQ_FIRST((head)); \ + QMD_TRACE_HEAD(head); \ + QMD_TRACE_ELEM(&(elm)->field); \ +} while (0) + +#define TAILQ_INSERT_TAIL(head, elm, field) do { \ + TAILQ_NEXT((elm), field) = NULL; \ + (elm)->field.tqe_prev = (head)->tqh_last; \ + *(head)->tqh_last = (elm); \ + (head)->tqh_last = &TAILQ_NEXT((elm), field); \ + QMD_TRACE_HEAD(head); \ + QMD_TRACE_ELEM(&(elm)->field); \ +} while (0) + +#define TAILQ_LAST(head, headname) \ + (*(((struct headname *)((head)->tqh_last))->tqh_last)) + +#define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next) + +#define TAILQ_PREV(elm, headname, field) \ + (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last)) + +#define TAILQ_REMOVE(head, elm, field) do { \ + if ((TAILQ_NEXT((elm), field)) != NULL) \ + TAILQ_NEXT((elm), field)->field.tqe_prev = \ + (elm)->field.tqe_prev; \ + else { \ + (head)->tqh_last = (elm)->field.tqe_prev; \ + QMD_TRACE_HEAD(head); \ + } \ + *(elm)->field.tqe_prev = TAILQ_NEXT((elm), field); \ + TRASHIT((elm)->field.tqe_next); \ + TRASHIT((elm)->field.tqe_prev); \ + QMD_TRACE_ELEM(&(elm)->field); \ +} while (0) + + +#ifdef _KERNEL + +/* + * XXX insque() and remque() are an old way of handling certain queues. + * They bogusly assumes that all queue heads look alike. + */ + +struct quehead { + struct quehead *qh_link; + struct quehead *qh_rlink; +}; + +#if defined(__GNUC__) || defined(__INTEL_COMPILER) + +static __inline void +insque(void *a, void *b) +{ + struct quehead *element = (struct quehead *)a, + *head = (struct quehead *)b; + + element->qh_link = head->qh_link; + element->qh_rlink = head; + head->qh_link = element; + element->qh_link->qh_rlink = element; +} + +static __inline void +remque(void *a) +{ + struct quehead *element = (struct quehead *)a; + + element->qh_link->qh_rlink = element->qh_rlink; + element->qh_rlink->qh_link = element->qh_link; + element->qh_rlink = 0; +} + +#else /* !(__GNUC__ || __INTEL_COMPILER) */ + +void insque(void *a, void *b); +void remque(void *a); + +#endif /* __GNUC__ || __INTEL_COMPILER */ + +#endif /* _KERNEL */ + +#endif /* !_SYS_QUEUE_H_ */ diff --git a/miasm2/jitter/vm_mngr.c b/miasm2/jitter/vm_mngr.c new file mode 100644 index 00000000..7d47fadc --- /dev/null +++ b/miasm2/jitter/vm_mngr.c @@ -0,0 +1,1640 @@ +/* +** Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License as published by +** the Free Software Foundation; either version 2 of the License, or +** (at your option) any later version. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License along +** with this program; if not, write to the Free Software Foundation, Inc., +** 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +*/ +#include <Python.h> + +#include <stdio.h> +#include <stdlib.h> +#include <ctype.h> +#include <string.h> + +#include <stdint.h> +#include <inttypes.h> +#include <math.h> + +#include "queue.h" +#include "vm_mngr.h" + + + + +/* +struct memory_page_list_head memory_page_pool; +struct code_bloc_list_head code_bloc_pool; + +struct memory_breakpoint_info_head memory_breakpoint_pool; +*/ + +/****************memory manager**************/ + + + + +#define MIN(a,b) (((a)<(b))?(a):(b)) +#define MAX(a,b) (((a)>(b))?(a):(b)) + + +//#define DEBUG_MIASM_AUTOMOD_CODE + + + + + +void print_val(uint64_t base, uint64_t addr) +{ + uint64_t *ptr = (uint64_t *) addr; + fprintf(stderr, "addr 0x%"PRIX64" val 0x%"PRIX64"\n", addr-base, *ptr); +} + + +int is_mem_mapped(vm_mngr_t* vm_mngr, uint64_t ad) +{ + struct memory_page_node * mpn; + /* + mpn = memory_page_pool_tab[ad>>MEMORY_PAGE_POOL_MASK_BIT]; + if ( mpn && (mpn->ad <= ad) && (ad < mpn->ad + mpn->size)) + return 1; + */ + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + if ((mpn->ad <= ad) && (ad <mpn->ad + mpn->size)) + return 1; + } + + return 0; +} + + +/* return the address base of the memory page + containing addr +*/ +uint64_t get_mem_base_addr(vm_mngr_t* vm_mngr, uint64_t ad, uint64_t *addr_base) +{ + struct memory_page_node * mpn; + /* + mpn = memory_page_pool_tab[ad>>MEMORY_PAGE_POOL_MASK_BIT]; + if ( mpn && (mpn->ad <= ad) && (ad < mpn->ad + mpn->size)){ + *addr_base = mpn->ad; + return 1; + } + */ + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + if ((mpn->ad <= ad) && (ad <mpn->ad + mpn->size)) { + *addr_base = mpn->ad; + return 1; + } + } + return 0; +} + +struct memory_page_node * get_memory_page_from_address(vm_mngr_t* vm_mngr, uint64_t ad) +{ + struct memory_page_node * mpn; +#if 0 + mpn = memory_page_pool_tab[ad>>MEMORY_PAGE_POOL_MASK_BIT]; + if ( mpn && (mpn->ad <= ad) && (ad < mpn->ad + mpn->size)) + return mpn; + + fprintf(stderr, "WARNING: address 0x%"PRIX64" is not mapped in virtual memory:\n", ad); + //dump_memory_page_pool(); + //dump_gpregs(); + //exit(-1); + vm_mngr->exception_flags |= EXCEPT_ACCESS_VIOL; + + return NULL; +#else + + //printf("search for page ad: %X\n", ad); + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + if ((mpn->ad <= ad) && (ad < mpn->ad + mpn->size)) + return mpn; + } + fprintf(stderr, "WARNING: address 0x%"PRIX64" is not mapped in virtual memory:\n", ad); + //dump_memory_page_pool(); + //dump_gpregs(); + //exit(-1); + vm_mngr->exception_flags |= EXCEPT_ACCESS_VIOL; + return NULL; +#endif +} + + + + +static inline uint64_t memory_page_read(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t ad) +{ + struct memory_page_node * mpn; + unsigned char * addr; + uint64_t ret = 0; + struct memory_breakpoint_info * b; + + + mpn = get_memory_page_from_address(vm_mngr, ad); + if (!mpn) + return 0; + + if ((mpn->access & PAGE_READ) == 0){ + fprintf(stderr, "access to non readable page!! %"PRIX64"\n", ad); + vm_mngr->exception_flags |= EXCEPT_ACCESS_VIOL; + return 0; + } + + /* check read breakpoint*/ + LIST_FOREACH(b, &vm_mngr->memory_breakpoint_pool, next){ + if ((b->access & BREAKPOINT_READ) == 0) + continue; + if ((b->ad <= ad) && (ad < b->ad + b->size)) + vm_mngr->exception_flags |= EXCEPT_BREAKPOINT_INTERN; + } + + + addr = &((unsigned char*)mpn->ad_hp)[ad - mpn->ad]; + + /* read fits in a page */ + if (ad - mpn->ad + my_size/8 <= mpn->size){ + switch(my_size){ + case 8: + ret = *((unsigned char*)addr)&0xFF; + break; + case 16: + ret = *((unsigned short*)addr)&0xFFFF; + ret = Endian16_Swap(ret); + break; + case 32: + ret = *((unsigned int*)addr)&0xFFFFFFFF; + ret = Endian32_Swap(ret); + break; + case 64: + ret = *((uint64_t*)addr)&0xFFFFFFFFFFFFFFFFULL; + ret = Endian64_Swap(ret); + break; + default: + exit(0); + break; + } + } + /* read is multiple page wide */ + else{ + unsigned int new_size = my_size; + int index = 0; + fprintf(stderr, "read multiple page! %"PRIX64" %d\n", ad, new_size); + dump_memory_page_pool(vm_mngr); + while (new_size){ + mpn = get_memory_page_from_address(vm_mngr, ad); + if (!mpn) + return 0; + addr = &((unsigned char*)mpn->ad_hp)[ad - mpn->ad]; + ret |= (*((unsigned char*)addr)&0xFF)<<(index); + index +=8; + new_size -= 8; + ad ++; + } + switch(my_size){ + case 8: + ret = ret; + break; + case 16: + ret = Endian16_Swap(ret); + break; + case 32: + ret = Endian32_Swap(ret); + break; + case 64: + ret = Endian64_Swap(ret); + break; + default: + exit(0); + break; + } + } + return ret; +} + +static inline void memory_page_write(vm_mngr_t* vm_mngr, unsigned int my_size, + uint64_t ad, uint64_t src) +{ + struct memory_page_node * mpn; + unsigned char * addr; + struct memory_breakpoint_info * b; + + mpn = get_memory_page_from_address(vm_mngr, ad); + if (!mpn) + return; + + if ((mpn->access & PAGE_WRITE) == 0){ + fprintf(stderr, "access to non writable page!! %"PRIX64"\n", ad); + vm_mngr->exception_flags |= EXCEPT_ACCESS_VIOL; + return ; + } + + /* check read breakpoint*/ + LIST_FOREACH(b, &vm_mngr->memory_breakpoint_pool, next){ + if ((b->access & BREAKPOINT_WRITE) == 0) + continue; + if ((b->ad <= ad) && (ad < b->ad + b->size)) + vm_mngr->exception_flags |= EXCEPT_BREAKPOINT_INTERN; + } + + addr = &((unsigned char*)mpn->ad_hp)[ad - mpn->ad]; + + /* write fits in a page */ + if (ad - mpn->ad + my_size/8 <= mpn->size){ + switch(my_size){ + case 8: + *((unsigned char*)addr) = src&0xFF; + break; + case 16: + src = Endian16_Swap(src); + *((unsigned short*)addr) = src&0xFFFF; + break; + case 32: + src = Endian32_Swap(src); + *((unsigned int*)addr) = src&0xFFFFFFFF; + break; + case 64: + src = Endian64_Swap(src); + *((uint64_t*)addr) = src&0xFFFFFFFFFFFFFFFFULL; + break; + default: + exit(0); + break; + } + } + /* write is multiple page wide */ + else{ + fprintf(stderr, "write multiple page! %"PRIX64" %d\n", ad, my_size); + dump_memory_page_pool(vm_mngr); + switch(my_size){ + + case 8: + src = src; + break; + case 16: + src = Endian16_Swap(src); + break; + case 32: + src = Endian32_Swap(src); + break; + case 64: + src = Endian64_Swap(src); + break; + default: + exit(0); + break; + } + while (my_size){ + mpn = get_memory_page_from_address(vm_mngr, ad); + if (!mpn) + return; + + addr = &((unsigned char*)mpn->ad_hp)[ad - mpn->ad]; + *((unsigned char*)addr) = src&0xFF; + my_size -= 8; + src >>=8; + ad ++; + } + } +} + +/* TODO: Those functions have to be moved to a common operations file, with + * parity, ... + */ + +inline uint16_t bcdadd_16(uint16_t a, uint16_t b) +{ + int carry = 0; + int i,j = 0; + uint16_t res = 0; + int nib_a, nib_b; + for (i = 0; i < 16; i += 4) { + nib_a = (a >> i) & (0xF); + nib_b = (b >> i) & (0xF); + + j = (carry + nib_a + nib_b); + if (j >= 10) { + carry = 1; + j -= 10; + j &=0xf; + } + else { + carry = 0; + } + res += j << i; + } + return res; +} + +inline uint16_t bcdadd_cf_16(uint16_t a, uint16_t b) +{ + int carry = 0; + int i,j = 0; + int nib_a, nib_b; + for (i = 0; i < 16; i += 4) { + nib_a = (a >> i) & (0xF); + nib_b = (b >> i) & (0xF); + + j = (carry + nib_a + nib_b); + if (j >= 10) { + carry = 1; + j -= 10; + j &=0xf; + } + else { + carry = 0; + } + } + return carry; +} +// ################## + +void dump_code_bloc(vm_mngr_t* vm_mngr) +{ + struct code_bloc_node * cbp; + LIST_FOREACH(cbp, &vm_mngr->code_bloc_pool, next){ + fprintf(stderr, "%"PRIX64"%"PRIX64"\n", cbp->ad_start, cbp->ad_stop); + } + +} + +inline void check_write_code_bloc(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t addr) +{ + struct code_bloc_node * cbp; + vm_mngr->last_write_ad = addr; + vm_mngr->last_write_size = my_size; + + + + //if(vmmngr.my_tick> my_tick) + // printf("M_WRITE %2d %.8X %.8X\n", my_size, addr, src); + if (!(addr + my_size/8 <= vm_mngr->code_bloc_pool_ad_min || + addr >=vm_mngr->code_bloc_pool_ad_max)){ + LIST_FOREACH(cbp, &vm_mngr->code_bloc_pool, next){ + if ((cbp->ad_start < addr + my_size/8) && + (addr < cbp->ad_stop)){ +#ifdef DEBUG_MIASM_AUTOMOD_CODE + fprintf(stderr, "**********************************\n"); + fprintf(stderr, "self modifying code %"PRIX64" %.8X\n", + addr, my_size); + fprintf(stderr, "**********************************\n"); + //dump_code_bloc(vm_mngr); +#endif + vm_mngr->exception_flags |= EXCEPT_CODE_AUTOMOD; + + break; + } + } + } +} + +PyObject* addr2BlocObj(vm_mngr_t* vm_mngr, uint64_t addr) +{ + PyObject* pyaddr; + PyObject* b; + + //printf("addr2blocobj %"PRIx64"\n", addr); + pyaddr = PyLong_FromUnsignedLongLong(addr); + /* + Py_INCREF(pyaddr); + return pyaddr; + */ + b = PyDict_GetItem(vm_mngr->addr2obj, pyaddr); + if (b == NULL) { + Py_INCREF(Py_None); + return Py_None; + } + + //printf("addr2blocobj OBJ %p\n", b); + Py_INCREF(b); + return b; +} + +/* +PyObject* add_code_resolver(vm_mngr_t* vm_mngr, uint64_t addr) +{ + pyaddr = PyLong_FromUnsignedLongLong(addr); + + func_resolver* f = malloc(sizeof(func_resolver)); + f->func = addr2blocobj; + fsdfsd + return f; +} +*/ +/* +void MEM_WRITE(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t addr, unsigned int src) +{ + struct code_bloc_node * cbp; + + vm_mngr->last_write_ad = addr; + vm_mngr->last_write_size = my_size; + + //if(vmmngr.my_tick> my_tick) + // printf("M_WRITE %2d %.8X %.8X\n", my_size, addr, src); + if (!(addr + my_size/8 <= vm_mngr->code_bloc_pool_ad_min || + addr >= vm_mngr->code_bloc_pool_ad_max)){ + LIST_FOREACH(cbp, &vm_mngr->code_bloc_pool, next){ + if ((cbp->ad_start <= addr + my_size/8) && + (addr < cbp->ad_stop)){ +#ifdef DEBUG_MIASM_AUTOMOD_CODE + fprintf(stderr, "self modifying code %"PRIX64" %.8X\n", + addr, my_size); +#endif + vm_mngr->exception_flags |= EXCEPT_CODE_AUTOMOD; + break; + } + } + } + + memory_page_write(vm_mngr, my_size, addr, src); +} +*/ +void MEM_WRITE_08(vm_mngr_t* vm_mngr, uint64_t addr, unsigned char src) +{ + check_write_code_bloc(vm_mngr, 8, addr); + memory_page_write(vm_mngr, 8, addr, src); +} + +void MEM_WRITE_16(vm_mngr_t* vm_mngr, uint64_t addr, unsigned short src) +{ + check_write_code_bloc(vm_mngr, 16, addr); + memory_page_write(vm_mngr, 16, addr, src); +} +void MEM_WRITE_32(vm_mngr_t* vm_mngr, uint64_t addr, unsigned int src) +{ + check_write_code_bloc(vm_mngr, 32, addr); + memory_page_write(vm_mngr, 32, addr, src); +} +void MEM_WRITE_64(vm_mngr_t* vm_mngr, uint64_t addr, uint64_t src) +{ + check_write_code_bloc(vm_mngr, 64, addr); + memory_page_write(vm_mngr, 64, addr, src); +} + +unsigned int MEM_LOOKUP(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t addr) +{ + unsigned int ret; + ret = memory_page_read(vm_mngr, my_size, addr); + return ret; +} + +unsigned char MEM_LOOKUP_08(vm_mngr_t* vm_mngr, uint64_t addr) +{ + unsigned char ret; + ret = memory_page_read(vm_mngr, 8, addr); + return ret; +} +unsigned short MEM_LOOKUP_16(vm_mngr_t* vm_mngr, uint64_t addr) +{ + unsigned short ret; + ret = memory_page_read(vm_mngr, 16, addr); + return ret; +} +unsigned int MEM_LOOKUP_32(vm_mngr_t* vm_mngr, uint64_t addr) +{ + unsigned int ret; + ret = memory_page_read(vm_mngr, 32, addr); + return ret; +} +uint64_t MEM_LOOKUP_64(vm_mngr_t* vm_mngr, uint64_t addr) +{ + uint64_t ret; + ret = memory_page_read(vm_mngr, 64, addr); + return ret; +} + +inline unsigned int parity(unsigned int a) +{ +#if defined(__builtin_parity) + return __builtin_parity(a); +#else + unsigned int tmp, cpt; + + tmp = a&0xFF; + cpt = 1; + while (tmp!=0){ + cpt^=tmp&1; + tmp>>=1; + } + return cpt; +#endif +} + + +int shift_right_arith(unsigned int size, int a, unsigned int b) +{ + int i32_a; + short i16_a; + char i8_a; + switch(size){ + case 8: + i8_a = a; + return (i8_a >> b)&0xff; + case 16: + i16_a = a; + return (i16_a >> b)&0xffff; + case 32: + i32_a = a; + return (i32_a >> b)&0xffffffff; + default: + fprintf(stderr, "inv size in shift %d\n", size); + exit(0); + } +} +/* +int shift_right_arith_08(int a, unsigned int b) +{ + char i8_a; + i8_a = a; + return (i8_a >> b)&0xff; +} + +int shift_right_arith_16(int a, unsigned int b) +{ + short i16_a; + i16_a = a; + return (i16_a >> b)&0xffff; +} + +int shift_right_arith_32(int a, unsigned int b) +{ + int i32_a; + i32_a = a; + return (i32_a >> b)&0xffffffff; +} +*/ +unsigned int shift_right_logic(unsigned int size, + unsigned int a, unsigned int b) +{ + unsigned int u32_a; + unsigned short u16_a; + unsigned char u8_a; + switch(size){ + case 8: + u8_a = a; + return (u8_a >> b)&0xff; + case 16: + u16_a = a; + return (u16_a >> b)&0xffff; + case 32: + u32_a = a; + return (u32_a >> b)&0xffffffff; + default: + fprintf(stderr, "inv size in shift %d\n", size); + exit(0); + } +} +/* +int shift_right_logic_08(unsigned int a, unsigned int b) +{ + unsigned char u8_a; + u8_a = a; + return (u8_a >> b)&0xff; +} + +int shift_right_logic_16(unsigned int a, unsigned int b) +{ + unsigned short u16_a; + u16_a = a; + return (u16_a >> b)&0xffff; +} + +int shift_right_logic_32(unsigned int a, unsigned int b) +{ + unsigned int u32_a; + u32_a = a; + return (u32_a >> b)&0xffffffff; +} +*/ +int shift_left_logic(unsigned int size, unsigned int a, unsigned int b) +{ + switch(size){ + case 8: + return (a<<b)&0xff; + case 16: + return (a<<b)&0xffff; + case 32: + return (a<<b)&0xffffffff; + default: + fprintf(stderr, "inv size in shift %d\n", size); + exit(0); + } +} +/* +int shift_left_logic_O8(unsigned int a, unsigned int b) +{ + return (a<<b)&0xff; +} + +int shift_left_logic_16(unsigned int a, unsigned int b) +{ + return (a<<b)&0xffff; +} + +int shift_left_logic_32(unsigned int a, unsigned int b) +{ + return (a<<b)&0xffffffff; +} +*/ + +unsigned int mul_lo_op(unsigned int size, unsigned int a, unsigned int b) +{ + unsigned int mask; + + switch (size) { + case 8: mask = 0xff; break; + case 16: mask = 0xffff; break; + case 32: mask = 0xffffffff; break; + default: fprintf(stderr, "inv size in mul %d\n", size); exit(0); + } + + a &= mask; + b &= mask; + return ((int64_t)a * (int64_t) b) & mask; +} + +unsigned int mul_hi_op(unsigned int size, unsigned int a, unsigned int b) +{ + uint64_t res = 0; + unsigned int mask; + + switch (size) { + case 8: mask = 0xff; break; + case 16: mask = 0xffff; break; + case 32: mask = 0xffffffff; break; + default: fprintf(stderr, "inv size in mul %d\n", size); exit(0); + } + + a &= mask; + b &= mask; + res = ((uint64_t)a * (uint64_t)b); + return (res >> 32) & mask; +} + + +unsigned int imul_lo_op_08(char a, char b) +{ + return a*b; +} + +unsigned int imul_lo_op_16(short a, short b) +{ + return a*b; +} + +unsigned int imul_lo_op_32(int a, int b) +{ + return a*b; +} + +int imul_hi_op_08(char a, char b) +{ + int64_t res = 0; + res = a*b; + return res>>8; +} + +int imul_hi_op_16(short a, short b) +{ + int64_t res = 0; + res = a*b; + return res>>16; +} + +int imul_hi_op_32(int a, int b) +{ + int64_t res = 0; + res = (int64_t)a*(int64_t)b; + //printf("%x %x dd %"PRIx64"\n", a, b, res); + return res>>32ULL; +} + +unsigned int umul16_lo(unsigned short a, unsigned short b) +{ + return (a*b) & 0xffff; +} + +unsigned int umul16_hi(unsigned short a, unsigned short b) +{ + uint32_t c; + c = a*b; + return (c>>16) & 0xffff; +} + + + + +unsigned int div_op(unsigned int size, unsigned int a, unsigned int b, unsigned int c) +{ + int64_t num; + if (c == 0) + { + //vmmngr.exception_flags |= EXCEPT_INT_DIV_BY_ZERO; + return 0; + } + num = ((int64_t)a << size) + b; + num/=(int64_t)c; + return num; +} + + +unsigned int rem_op(unsigned int size, unsigned int a, unsigned int b, unsigned int c) +{ + int64_t num; + + if (c == 0) + { + //vmmngr.exception_flags |= EXCEPT_INT_DIV_BY_ZERO; + return 0; + } + + num = ((int64_t)a << size) + b; + num = (int64_t)num-c*(num/c); + return num; +} + + +unsigned int rot_left(unsigned int size, unsigned int a, unsigned int b) +{ + unsigned int tmp; + + b = b&0x1F; + b %= size; + switch(size){ + case 8: + tmp = (a << b) | ((a&0xFF) >> (size-b)); + return tmp&0xff; + case 16: + tmp = (a << b) | ((a&0xFFFF) >> (size-b)); + return tmp&0xffff; + case 32: + tmp = (a << b) | ((a&0xFFFFFFFF) >> (size-b)); + return tmp&0xffffffff; + default: + fprintf(stderr, "inv size in rotleft %d\n", size); + exit(0); + } +} + +unsigned int rot_right(unsigned int size, unsigned int a, unsigned int b) +{ + unsigned int tmp; + + b = b&0x1F; + b %= size; + switch(size){ + case 8: + tmp = ((a&0xFF) >> b) | (a << (size-b)); + return tmp&0xff; + case 16: + tmp = ((a&0xFFFF) >> b) | (a << (size-b)); + return tmp&0xffff; + case 32: + tmp = ((a&0xFFFFFFFF) >> b) | (a << (size-b)); + return tmp&0xffffffff; + default: + fprintf(stderr, "inv size in rotleft %d\n", size); + exit(0); + } +} + + +int rcl_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf) +{ + uint64_t tmp; + + + size++; + b %= size; + + if (b == 0) { + switch(size){ + case 8+1: + return a&0xff; + case 16+1: + return a&0xffff; + case 32+1: + return a&0xffffffff; + default: + fprintf(stderr, "inv size in rclleft %d\n", size); + exit(0); + } + } + + tmp = (a<<1) | cf; + b -=1; + switch(size){ + case 8+1: + tmp = (tmp << b) | ((tmp&0x1FF) >> (size-b)); + return tmp&0xff; + case 16+1: + tmp = (tmp << b) | ((tmp&0x1FFFF) >> (size-b)); + return tmp&0xffff; + case 32+1: + tmp = (tmp << b) | ((tmp&0x1FFFFFFFFULL) >> (size-b)); + return tmp&0xffffffff; + default: + fprintf(stderr, "inv size in rclleft %d\n", size); + exit(0); + } +} + +int rcr_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf) +{ + return rcl_rez_op(size, a, size+1-b, cf); + +} + + +int rcl_cf_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf) +{ + uint64_t tmp; + + tmp = (cf<< size) | a; + + size++; + b %= size; + + switch(size){ + case 8+1: + tmp = (tmp << b) | ((tmp&0x1FF) >> (size-b)); + return (tmp>>8)&1; + case 16+1: + tmp = (tmp << b) | ((tmp&0x1FFFF) >> (size-b)); + return (tmp>>16)&1; + case 32+1: + tmp = (tmp << b) | ((tmp&0x1FFFFFFFFULL) >> (size-b)); + return (tmp>>32)&1; + default: + fprintf(stderr, "inv size in rclleft %d\n", size); + exit(0); + } +} + +int rcr_cf_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf) +{ + return rcl_cf_op(size, a, size+1-b, cf); +} +unsigned int my_bsr(unsigned int a, unsigned int b) +{ + int i; + + for (i=31; i>=0; i--){ + if (b & (1<<i)) + return i; + } + return a; +} + +unsigned int my_bsf(unsigned int a, unsigned int b) +{ + int i; + + for (i=0; i<32; i++){ + if (b & (1<<i)) + return i; + } + return a; +} + + +unsigned int my_imul08(unsigned int a, unsigned int b) +{ + char a08, b08; + short a16; + + a08 = a&0xFF; + b08 = b&0xFF; + a16 = a08*b08; + return (int)a16; +} + + + +unsigned int cpuid(unsigned int a, unsigned int reg_num) +{ + if (reg_num >3){ + fprintf(stderr, "not implemented cpuid reg %x\n", reg_num); + exit(-1); + } + + if (a == 0){ + switch(reg_num){ + case 0: + return 0xa; + case 1: + return 0x756E6547; + case 2: + return 0x6C65746E; + case 3: + return 0x49656E69; + } + } + + else if (a == 1){ + switch(reg_num){ + case 0: + //return 0x000006FB; + return 0x00020652; + case 1: + //return 0x02040800; + return 0x00000800; + case 2: + //return 0x0004E3BD; + return 0x00000209; + case 3: + //return 0xBFEBFBFF; + return 0x078bf9ff; + } + } + else{ + fprintf(stderr, "WARNING not implemented cpuid index %X!\n", a); + //exit(-1); + } + return 0; +} + +#define DEBUG_MIASM_DOUBLE + +void dump_float(void) +{ + /* + printf("%e\n", vmmngr.float_st0); + printf("%e\n", vmmngr.float_st1); + printf("%e\n", vmmngr.float_st2); + printf("%e\n", vmmngr.float_st3); + printf("%e\n", vmmngr.float_st4); + printf("%e\n", vmmngr.float_st5); + printf("%e\n", vmmngr.float_st6); + printf("%e\n", vmmngr.float_st7); + */ +} + +double mem_32_to_double(unsigned int m) +{ + float f; + double d; + + f = *((float*)&m); + d = f; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%d float %e\n", m, d); +#endif + return d; +} + + +double mem_64_to_double(uint64_t m) +{ + double d; + d = *((double*)&m); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%"PRId64" double %e\n", m, d); +#endif + return d; +} + +double int_16_to_double(unsigned int m) +{ + double d; + + d = (double)(m&0xffff); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%d double %e\n", m, d); +#endif + return d; +} + +double int_32_to_double(unsigned int m) +{ + double d; + + d = (double)m; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%d double %e\n", m, d); +#endif + return d; +} + +double int_64_to_double(uint64_t m) +{ + double d; + + d = (double)m; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%"PRId64" double %e\n", m, d); +#endif + return d; +} + +int32_t double_to_int_32(double d) +{ + int32_t i; + + i = (int32_t)d; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e int %d\n", d, i); +#endif + return i; +} + +int64_t double_to_int_64(double d) +{ + int64_t i; + + i = (int64_t)d; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e int %"PRId64"\n", d, i); +#endif + return i; +} + + +double fadd(double a, double b) +{ + double c; + c = a + b; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e + %e -> %e\n", a, b, c); +#endif + return c; +} + +double fsub(double a, double b) +{ + double c; + c = a - b; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e - %e -> %e\n", a, b, c); +#endif + return c; +} + +double fmul(double a, double b) +{ + double c; + c = a * b; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e * %e -> %e\n", a, b, c); +#endif + return c; +} + +double fdiv(double a, double b) +{ + double c; + c = a / b; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e / %e -> %e\n", a, b, c); +#endif + return c; +} + +double ftan(double a) +{ + double b; + b = tan(a); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e tan %e\n", a, b); +#endif + return b; +} + +double frndint(double a) +{ + int64_t b; + double c; + b = (int64_t)a; + c = (double)b; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e double %e\n", a, c); +#endif + return c; +} + +double fsin(double a) +{ + double b; + b = sin(a); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e sin %e\n", a, b); +#endif + return b; +} + +double fcos(double a) +{ + double b; + b = cos(a); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e cos %e\n", a, b); +#endif + return b; +} + + +double fscale(double a, double b) +{ + double c; + c = a * exp2(trunc(b)); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e *exp2 %e -> %e\n", a, b, c); +#endif + return c; +} + +double f2xm1(double a) +{ + double b; + b = exp2(a)-1; +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e exp2 -1 %e\n", a, b); +#endif + return b; +} + +double fsqrt(double a) +{ + double b; + b = sqrt(a); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e sqrt %e\n", a, b); +#endif + return b; +} + +double fabs(double a) +{ + double b; + b = abs(a); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%e abs %e\n", a, b); +#endif + return b; +} + + + +unsigned int fcom_c0(double a, double b) +{ + if (a>=b) + return 0; + return 1; +} +unsigned int fcom_c1(double a, double b) +{ + //XXX + return 0; +} +unsigned int fcom_c2(double a, double b) +{ + return 0; +} +unsigned int fcom_c3(double a, double b) +{ + if (a==b) + return 1; + return 0; +} + + +unsigned int double_to_mem_32(double d) +{ + unsigned int m; + float f; + f = d; + m = *((unsigned int*)&f); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%d %e\n", m, d); +#endif + return m; +} + +uint64_t double_to_mem_64(double d) +{ + uint64_t m; + m = *((uint64_t*)&d); +#ifdef DEBUG_MIASM_DOUBLE + dump_float(); + printf("%"PRId64" %e\n", m, d); +#endif + return m; +} + +struct memory_page_node * create_memory_page_node(uint64_t ad, unsigned int size, unsigned int access) +{ + struct memory_page_node * mpn; + void* p; + + mpn = malloc(sizeof(*mpn)); + if (!mpn){ + fprintf(stderr, "cannot alloc mpn\n"); + return NULL; + } + p = malloc(size); + if (!p){ + fprintf(stderr, "cannot alloc %d\n", size); + return NULL; + } + mpn->ad = ad; + mpn->size = size; + mpn->access = access; + mpn->ad_hp = p; + + return mpn; +} + + +struct code_bloc_node * create_code_bloc_node(uint64_t ad_start, uint64_t ad_stop) +{ + struct code_bloc_node * cbp; + + cbp = malloc(sizeof(*cbp)); + if (!cbp){ + fprintf(stderr, "cannot alloc cbp\n"); + exit(-1); + } + + cbp->ad_start = ad_start; + cbp->ad_stop = ad_stop; + + return cbp; +} + + +void add_code_bloc(vm_mngr_t* vm_mngr, struct code_bloc_node* cbp) +{ + LIST_INSERT_HEAD(&vm_mngr->code_bloc_pool, cbp, next); + if (vm_mngr->code_bloc_pool_ad_min> cbp->ad_start) + vm_mngr->code_bloc_pool_ad_min = cbp->ad_start; + if (vm_mngr->code_bloc_pool_ad_max< cbp->ad_stop) + vm_mngr->code_bloc_pool_ad_max = cbp->ad_stop; +} + +void dump_code_bloc_pool(vm_mngr_t* vm_mngr) +{ + struct code_bloc_node * cbp; + + LIST_FOREACH(cbp, &vm_mngr->code_bloc_pool, next){ + printf("ad start %"PRIX64" ad_stop %"PRIX64"\n", + cbp->ad_start, + cbp->ad_stop); + } +} + + +void init_memory_page_pool(vm_mngr_t* vm_mngr) +{ + unsigned int i; + LIST_INIT(&vm_mngr->memory_page_pool); + for (i=0;i<MAX_MEMORY_PAGE_POOL_TAB; i++) + vm_mngr->memory_page_pool_tab[i] = NULL; +} + +void init_code_bloc_pool(vm_mngr_t* vm_mngr) +{ + LIST_INIT(&vm_mngr->code_bloc_pool); + vm_mngr->code_bloc_pool_ad_min = 0xffffffff; + vm_mngr->code_bloc_pool_ad_max = 0; +} + +void init_memory_breakpoint(vm_mngr_t* vm_mngr) +{ + LIST_INIT(&vm_mngr->memory_breakpoint_pool); +} + + +void reset_memory_page_pool(vm_mngr_t* vm_mngr) +{ + struct memory_page_node * mpn; + unsigned int i; + + while (!LIST_EMPTY(&vm_mngr->memory_page_pool)) { + mpn = LIST_FIRST(&vm_mngr->memory_page_pool); + LIST_REMOVE(mpn, next); + free(mpn->ad_hp); + free(mpn); + } + for (i=0;i<MAX_MEMORY_PAGE_POOL_TAB; i++) + vm_mngr->memory_page_pool_tab[i] = NULL; + +} + + +void reset_code_bloc_pool(vm_mngr_t* vm_mngr) +{ + struct code_bloc_node * cbp; + + + while (!LIST_EMPTY(&vm_mngr->code_bloc_pool)) { + cbp = LIST_FIRST(&vm_mngr->code_bloc_pool); + LIST_REMOVE(cbp, next); + free(cbp); + } + vm_mngr->code_bloc_pool_ad_min = 0xffffffff; + vm_mngr->code_bloc_pool_ad_max = 0; +} + + +void reset_memory_breakpoint(vm_mngr_t* vm_mngr) +{ + struct memory_breakpoint_info * mpn; + + while (!LIST_EMPTY(&vm_mngr->memory_breakpoint_pool)) { + mpn = LIST_FIRST(&vm_mngr->memory_breakpoint_pool); + LIST_REMOVE(mpn, next); + free(mpn); + } + +} + + +int is_mpn_in_tab(vm_mngr_t* vm_mngr, struct memory_page_node* mpn_a) +{ + struct memory_page_node * mpn; + + /* + for (i=mpn_a->ad >> MEMORY_PAGE_POOL_MASK_BIT; + i<(mpn_a->ad + mpn_a->size + PAGE_SIZE - 1)>>MEMORY_PAGE_POOL_MASK_BIT; + i++){ + if (memory_page_pool_tab[i] !=NULL){ + return 1; + } + } + */ + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + if (mpn->ad >= mpn_a->ad + mpn_a->size) + continue; + if (mpn->ad + mpn->size <= mpn_a->ad) + continue; + printf("is mpn in! %"PRIX64" %"PRIX64" \n", mpn_a->ad, mpn_a->size); + printf("known:! %"PRIX64" %"PRIX64" \n", mpn->ad, mpn->size); + + return 1; + } + + return 0; +} + +void insert_mpn_in_tab(struct memory_page_node* mpn_a) +{ + /* + for (i=mpn_a->ad >> MEMORY_PAGE_POOL_MASK_BIT; + i<(mpn_a->ad + mpn_a->size + PAGE_SIZE - 1)>>MEMORY_PAGE_POOL_MASK_BIT; + i++){ + if (memory_page_pool_tab[i] !=NULL){ + fprintf(stderr, "known page in tab\n"); + exit(1); + } + memory_page_pool_tab[i] = mpn_a; + } + */ + +} + +void add_memory_page(vm_mngr_t* vm_mngr, struct memory_page_node* mpn_a) +{ + struct memory_page_node * mpn; + struct memory_page_node * lmpn; + + if (LIST_EMPTY(&vm_mngr->memory_page_pool)){ + LIST_INSERT_HEAD(&vm_mngr->memory_page_pool, mpn_a, next); + insert_mpn_in_tab(mpn_a); + return; + } + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + lmpn = mpn; + if (mpn->ad < mpn_a->ad) + continue; + LIST_INSERT_BEFORE(mpn, mpn_a, next); + insert_mpn_in_tab(mpn_a); + return; + } + LIST_INSERT_AFTER(lmpn, mpn_a, next); + insert_mpn_in_tab(mpn_a); + +} + +void dump_memory_page_pool(vm_mngr_t* vm_mngr) +{ + struct memory_page_node * mpn; + + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + printf("ad %"PRIX64" size %"PRIX64" %c%c%c hpad %p\n", + mpn->ad, + mpn->size, + mpn->access & PAGE_READ? 'R':'_', + mpn->access & PAGE_WRITE? 'W':'_', + mpn->access & PAGE_EXEC? 'X':'_', + mpn->ad_hp + ); + } +} + +void dump_memory_breakpoint_pool(vm_mngr_t* vm_mngr) +{ + struct memory_breakpoint_info * mpn; + + LIST_FOREACH(mpn, &vm_mngr->memory_breakpoint_pool, next){ + printf("ad %"PRIX64" size %"PRIX64" access %"PRIX64"\n", + mpn->ad, + mpn->size, + mpn->access + ); + } +} + + +void add_memory_breakpoint(vm_mngr_t* vm_mngr, uint64_t ad, uint64_t size, unsigned int access) +{ + struct memory_breakpoint_info * mpn_a; + mpn_a = malloc(sizeof(*mpn_a)); + if (!mpn_a) { + printf("cannot alloc\n"); + exit(0); + } + mpn_a->ad = ad; + mpn_a->size = size; + mpn_a->access = access; + + LIST_INSERT_HEAD(&vm_mngr->memory_breakpoint_pool, mpn_a, next); + +} + +void remove_memory_breakpoint(vm_mngr_t* vm_mngr, uint64_t ad, unsigned int access) +{ + struct memory_breakpoint_info * mpn; + + LIST_FOREACH(mpn, &vm_mngr->memory_breakpoint_pool, next){ + if (mpn->ad == ad && mpn->access == access) + LIST_REMOVE(mpn, next); + } + +} + + + + + + + +unsigned int get_memory_page_next(vm_mngr_t* vm_mngr, unsigned int n_ad) +{ + struct memory_page_node * mpn; + uint64_t ad = 0; + + LIST_FOREACH(mpn, &vm_mngr->memory_page_pool, next){ + if (mpn->ad < n_ad) + continue; + + if (ad == 0 || mpn->ad <ad) + ad = mpn->ad; + } + return ad; +} + + +#if 0 +unsigned int get_memory_page_from_min_ad(unsigned int size) +{ + struct memory_page_node * mpn; + unsigned int c_ad ; + unsigned int min_ad = min_page_ad; + int end = 0; + /* first, find free min ad */ + while (!end){ + end = 1; + LIST_FOREACH(mpn, &memory_page_pool, next){ + c_ad = (mpn->ad + mpn->size+0x1000)&0xfffff000; + if (c_ad <= min_ad) + continue; + if (mpn->ad <= min_ad){ + min_ad = c_ad; + end = 0; + break; + } + if (mpn->ad - min_ad < size){ + min_ad = c_ad; + end = 0; + break; + } + } + } + return min_ad; + } +#endif + + + +/********************************************/ + +void hexdump(char* m, unsigned int l) +{ + int i, j, last; + last = 0; + for (i=0;i<l;i++){ + if (!(i%0x10) && i){ + last = i; + printf(" "); + for (j=-0x10;j<0;j++){ + if (isprint(m[i+j])){ + printf("%c", m[i+j]); + } + else{ + printf("."); + } + } + printf("\n"); + } + printf("%.2X ", m[i]&0xFF); + } + l-=last; + if (l){ + for (j=i;j<last+0x10;j++) + printf(" "); + printf(" "); + for (j = 0;l;j++){ + if (isprint(m[last+j])){ + printf("%c", m[last+j]); + } + else{ + printf("."); + } + l--; + } + } + printf("\n"); + +} + + + + +unsigned int access_segment(unsigned int d) +{ + // XXX TODO + printf("access segment %X\n", d); + return 0; +} +unsigned int access_segment_ok(unsigned int d) +{ + // XXX TODO + printf("access segment ok %X\n", d); + return 0; +} + +unsigned int load_segment_limit(unsigned int d) +{ + // XXX TODO + printf("load segment limit %X\n", d); + return 0; +} +unsigned int load_segment_limit_ok(unsigned int d) +{ + // XXX TODO + printf("load segment limit ok %X\n", d); + return 0; +} + +unsigned int load_tr_segment_selector(unsigned int d) +{ + // XXX TODO + return 0; +} + +// Return vm_mngr's exception flag value +uint64_t get_exception_flag(vm_mngr_t* vm_mngr) +{ + return vm_mngr->exception_flags; +} diff --git a/miasm2/jitter/vm_mngr.h b/miasm2/jitter/vm_mngr.h new file mode 100644 index 00000000..1e032200 --- /dev/null +++ b/miasm2/jitter/vm_mngr.h @@ -0,0 +1,363 @@ +/* +** Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License as published by +** the Free Software Foundation; either version 2 of the License, or +** (at your option) any later version. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License along +** with this program; if not, write to the Free Software Foundation, Inc., +** 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +*/ +#ifndef CODENAT_H +#define CODENAT_H + + +#if __BYTE_ORDER == __BIG_ENDIAN +#define Endian16_Swap(value) \ + ((((uint16_t)((value) & 0x00FF)) << 8) | \ + (((uint16_t)((value) & 0xFF00)) >> 8)) + +#define Endian32_Swap(value) \ + ((((uint32_t)((value) & 0x000000FF)) << 24) | \ + (((uint32_t)((value) & 0x0000FF00)) << 8) | \ + (((uint32_t)((value) & 0x00FF0000)) >> 8) | \ + (((uint32_t)((value) & 0xFF000000)) >> 24)) + +#define Endian64_Swap(value) \ + (((((uint64_t)value)<<56) & 0xFF00000000000000ULL) | \ + ((((uint64_t)value)<<40) & 0x00FF000000000000ULL) | \ + ((((uint64_t)value)<<24) & 0x0000FF0000000000ULL) | \ + ((((uint64_t)value)<< 8) & 0x000000FF00000000ULL) | \ + ((((uint64_t)value)>> 8) & 0x00000000FF000000ULL) | \ + ((((uint64_t)value)>>24) & 0x0000000000FF0000ULL) | \ + ((((uint64_t)value)>>40) & 0x000000000000FF00ULL) | \ + ((((uint64_t)value)>>56) & 0x00000000000000FFULL)) +#else +#define Endian16_Swap(value) (value) + +#define Endian32_Swap(value) (value) + +#define Endian64_Swap(value) (value) +#endif + + + + +LIST_HEAD(memory_page_list_head, memory_page_node); +LIST_HEAD(code_bloc_list_head, code_bloc_node); +LIST_HEAD(memory_breakpoint_info_head, memory_breakpoint_info); + + +#define BREAKPOINT_READ 1 +#define BREAKPOINT_WRITE 2 + + + +#define MAX_MEMORY_PAGE_POOL_TAB 0x100000 +#define MEMORY_PAGE_POOL_MASK_BIT 12 +#define PAGE_SIZE (1<<MEMORY_PAGE_POOL_MASK_BIT) + +typedef struct { + + struct memory_page_list_head memory_page_pool; + struct code_bloc_list_head code_bloc_pool; + struct memory_breakpoint_info_head memory_breakpoint_pool; + + struct memory_page_node *memory_page_pool_tab[MAX_MEMORY_PAGE_POOL_TAB]; + + unsigned int *code_addr_tab; + unsigned int code_bloc_pool_ad_min; + unsigned int code_bloc_pool_ad_max; + + uint64_t exception_flags; + uint64_t exception_flags_new; + uint64_t last_write_ad; + uint64_t last_write_size ; + PyObject *cb_automod; + PyObject *addr2obj; +}vm_mngr_t; + + + +typedef struct { + PyObject *func; +}func_resolver; + + + + +//extern vm_mngr_t vmmngr; + +struct memory_page_node { + uint64_t ad; + uint64_t size; + uint64_t access; + void* ad_hp; + LIST_ENTRY(memory_page_node) next; +}; + + + +struct code_bloc_node { + uint64_t ad_start; + uint64_t ad_stop; + uint64_t ad_code; + LIST_ENTRY(code_bloc_node) next; +}; + + +struct memory_breakpoint_info { + uint64_t ad; + uint64_t size; + uint64_t access; + LIST_ENTRY(memory_breakpoint_info) next; +}; + + +#define PAGE_READ 1 +#define PAGE_WRITE 2 +#define PAGE_EXEC 4 + +#define EXCEPT_DO_NOT_UPDATE_PC (1<<25) + +// interrupt with eip update after instr +#define EXCEPT_CODE_AUTOMOD (1<<0) +#define EXCEPT_SOFT_BP (1<<1) +#define EXCEPT_INT_XX (1<<2) + +#define EXCEPT_BREAKPOINT_INTERN (1<<10) + +#define EXCEPT_NUM_UPDT_EIP (1<<11) +// interrupt with eip at instr +#define EXCEPT_UNK_MEM_AD ((1<<12) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_THROW_SEH ((1<<13) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_UNK_EIP ((1<<14) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_ACCESS_VIOL ((1<<14) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_INT_DIV_BY_ZERO ((1<<16) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_PRIV_INSN ((1<<17) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_ILLEGAL_INSN ((1<<18) | EXCEPT_DO_NOT_UPDATE_PC) +#define EXCEPT_UNK_MNEMO ((1<<19) | EXCEPT_DO_NOT_UPDATE_PC) + + +int is_mem_mapped(vm_mngr_t* vm_mngr, uint64_t ad); +uint64_t get_mem_base_addr(vm_mngr_t* vm_mngr, uint64_t addr, uint64_t *addr_base); +void MEM_WRITE(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t addr, unsigned int src); +unsigned int MEM_LOOKUP(vm_mngr_t* vm_mngr, unsigned int my_size, uint64_t addr); + + +void MEM_WRITE_08(vm_mngr_t* vm_mngr, uint64_t addr, unsigned char src); +void MEM_WRITE_16(vm_mngr_t* vm_mngr, uint64_t addr, unsigned short src); +void MEM_WRITE_32(vm_mngr_t* vm_mngr, uint64_t addr, unsigned int src); +void MEM_WRITE_64(vm_mngr_t* vm_mngr, uint64_t addr, uint64_t src); + + +unsigned char MEM_LOOKUP_08(vm_mngr_t* vm_mngr, uint64_t addr); +unsigned short MEM_LOOKUP_16(vm_mngr_t* vm_mngr, uint64_t addr); +unsigned int MEM_LOOKUP_32(vm_mngr_t* vm_mngr, uint64_t addr); +uint64_t MEM_LOOKUP_64(vm_mngr_t* vm_mngr, uint64_t addr); + + +void MEM_WRITE_08_PASSTHROUGH(uint64_t addr, unsigned char src); +void MEM_WRITE_16_PASSTHROUGH(uint64_t addr, unsigned short src); +void MEM_WRITE_32_PASSTHROUGH(uint64_t addr, unsigned int src); +void MEM_WRITE_64_PASSTHROUGH(uint64_t addr, uint64_t src); +unsigned char MEM_LOOKUP_08_PASSTHROUGH(uint64_t addr); +unsigned short MEM_LOOKUP_16_PASSTHROUGH(uint64_t addr); +unsigned int MEM_LOOKUP_32_PASSTHROUGH(uint64_t addr); +uint64_t MEM_LOOKUP_64_PASSTHROUGH(uint64_t addr); + + +inline unsigned int parity(unsigned int a); +unsigned int my_imul08(unsigned int a, unsigned int b); + +void vm_throw(vm_mngr_t* vm_mngr, unsigned long flags); +int shift_right_arith(unsigned int size, int a, unsigned int b); +unsigned int shift_right_logic(unsigned int size, unsigned int a, unsigned int b); +int shift_left_logic(unsigned int size, unsigned int a, unsigned int b); +/* +int shift_left_logic_08(unsigned int a, unsigned int b); +int shift_left_logic_16(unsigned int a, unsigned int b); +int shift_left_logic_32(unsigned int a, unsigned int b); +*/ +unsigned int mul_lo_op(unsigned int size, unsigned int a, unsigned int b); +unsigned int mul_hi_op(unsigned int size, unsigned int a, unsigned int b); +unsigned int imul_lo_op_08(char a, char b); +unsigned int imul_lo_op_16(short a, short b); +unsigned int imul_lo_op_32(int a, int b); +int imul_hi_op_08(char a, char b); +int imul_hi_op_16(short a, short b); +int imul_hi_op_32(int a, int b); + + +unsigned int umul16_lo(unsigned short a, unsigned short b); +unsigned int umul16_hi(unsigned short a, unsigned short b); + + +unsigned int div_op(unsigned int size, unsigned int a, unsigned int b, unsigned int c); +unsigned int rem_op(unsigned int size, unsigned int a, unsigned int b, unsigned int c); +unsigned int rot_left(unsigned int size, unsigned int a, unsigned int b); +unsigned int rot_right(unsigned int size, unsigned int a, unsigned int b); +int rcl_rez_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf); +int rcl_cf_op(unsigned int size, unsigned int a, unsigned int b, unsigned int cf); + +//PyObject* _vm_push_uint32_t(PyObject *item); +//PyObject* _vm_pop_uint32_t(void); +////PyObject* _vm_put_str(PyObject *item); +//PyObject* _vm_set_mem(PyObject *item, PyObject *item_str); +//PyObject* _vm_set_mem_access(PyObject *addr, PyObject *access); +//PyObject* _vm_get_str(PyObject *item, PyObject *item_len); +//PyObject* _vm_add_memory_page(PyObject *item, PyObject *access, PyObject *item_str); +//PyObject* _vm_add_code_bloc(PyObject *item1, PyObject *item2);//, PyObject *item3); +//PyObject* _call_pyfunc_from_globals(char* funcname); +//PyObject* _call_pyfunc_from_eip(void); +// +//PyObject* call_pyfunc_from_globals(char* funcname); +// +//PyObject* _vm_get_gpreg(void); + +void hexdump(char* m, unsigned int l); + +struct code_bloc_node * create_code_bloc_node(uint64_t ad_start, uint64_t ad_stop); +void add_code_bloc(vm_mngr_t* vm_mngr, struct code_bloc_node* cbp); + +struct memory_page_node * create_memory_page_node(uint64_t ad, unsigned int size, unsigned int access);//memory_page* mp); +void init_memory_page_pool(vm_mngr_t* vm_mngr); +void init_code_bloc_pool(vm_mngr_t* vm_mngr); +void reset_memory_page_pool(vm_mngr_t* vm_mngr); +void reset_code_bloc_pool(vm_mngr_t* vm_mngr); +void dump_code_bloc_pool(vm_mngr_t* vm_mngr); +void add_memory_page(vm_mngr_t* vm_mngr, struct memory_page_node* mpn_a); + + +void init_memory_breakpoint(vm_mngr_t* vm_mngr); +void reset_memory_breakpoint(vm_mngr_t* vm_mngr); +void add_memory_breakpoint(vm_mngr_t* vm_mngr, uint64_t ad, uint64_t size, unsigned int access); +void remove_memory_breakpoint(vm_mngr_t* vm_mngr, uint64_t ad, unsigned int access); + +void add_memory_page(vm_mngr_t* vm_mngr, struct memory_page_node* mpn); + +void dump_memory_page_pool(vm_mngr_t* vm_mngr); +void dump_memory_breakpoint_pool(vm_mngr_t* vm_mngr); +//PyObject* _vm_get_all_memory(void); +PyObject* addr2BlocObj(vm_mngr_t* vm_mngr, uint64_t addr); + + + + +/********************************************/ + +//PyObject* _vm_get_cpu_state(void); +//PyObject* _vm_set_cpu_state(PyObject * s_cpustate); + + +//void memory_page_write(unsigned int my_size, uint64_t ad, unsigned int src); +//unsigned int memory_page_read(unsigned int my_size, uint64_t ad); +unsigned int get_memory_page_max_address(void); +unsigned int get_memory_page_max_user_address(void); + + +int is_mpn_in_tab(vm_mngr_t* vm_mngr, struct memory_page_node* mpn_a); + + +void _func_free(void); +void _func_alloc(void); +unsigned int _get_memory_page_max_address_py(void); +unsigned int _get_memory_page_max_user_address_py(void); +unsigned int _get_memory_page_from_min_ad_py(unsigned int size); + +void _func_malloc_memory_page(void); +void _func_free_memory_page(void); +void _func_virtualalloc_memory_page(void); +void _func_virtualfree_memory_page(void); +void _func_loadlib_fake(void); +void _func_getproc_fake(void); + + +void func_free(void); +void func_alloc(void); +unsigned int get_memory_page_max_address_py(void); +unsigned int get_memory_page_max_user_address_py(void); +unsigned int get_memory_page_from_min_ad_py(unsigned int size); +struct memory_page_node * get_memory_page_from_address(vm_mngr_t*, uint64_t ad); +void func_malloc_memory_page(void); +void func_free_memory_page(void); +void func_virtualalloc_memory_page(void); +void func_virtualfree_memory_page(void); +void func_loadlib_fake(void); +void func_getproc_fake(void); + + +//PyObject* _vm_exec_bloc(PyObject* my_eip, PyObject* known_blocs); + +unsigned int cpuid(unsigned int a, unsigned int reg_num); +double int2double(unsigned int m); +//PyObject* _vm_exec_blocs(PyObject* my_eip); + +double fadd(double a, double b); +double fsub(double a, double b); +double fmul(double a, double b); +double fdiv(double a, double b); +double ftan(double a); +double frndint(double a); +double fsin(double a); +double fcos(double a); +double fscale(double a, double b); +double f2xm1(double a); +double fsqrt(double a); +double fabs(double a); +unsigned int fcom_c0(double a, double b); +unsigned int fcom_c1(double a, double b); +unsigned int fcom_c2(double a, double b); +unsigned int fcom_c3(double a, double b); + + + +double mem_32_to_double(unsigned int m); +double mem_64_to_double(uint64_t m); +double int_16_to_double(unsigned int m); +double int_32_to_double(unsigned int m); +double int_64_to_double(uint64_t m); +int32_t double_to_int_32(double d); +int64_t double_to_int_64(double d); +double fadd(double a, double b); +unsigned int double_to_mem_32(double d); +uint64_t double_to_mem_64(double d); + +unsigned int access_segment(unsigned int d); +unsigned int access_segment_ok(unsigned int d); + +unsigned int load_segment_limit(unsigned int d); +unsigned int load_segment_limit_ok(unsigned int d); + +unsigned int load_tr_segment_selector(unsigned int d); + +#define shift_right_arith_08(a, b)\ + ((((char)(a)) >> ((int)(b)&0x1f))&0xff) +#define shift_right_arith_16(a, b)\ + ((((short)(a)) >> ((int)(b)&0x1f))&0xffff) +#define shift_right_arith_32(a, b)\ + ((((int)(a)) >> ((int)(b)&0x1f))&0xffffffff) + + +#define shift_right_logic_08(a, b)\ + ((((unsigned char)(a)) >> ((unsigned int)(b)&0x1f))&0xff) +#define shift_right_logic_16(a, b)\ + ((((unsigned short)(a)) >> ((unsigned int)(b)&0x1f))&0xffff) +#define shift_right_logic_32(a, b)\ + ((((unsigned int)(a)) >> ((unsigned int)(b)&0x1f))&0xffffffff) + +#define shift_left_logic_08(a, b)\ + (((a)<<((b)&0x1f))&0xff) +#define shift_left_logic_16(a, b)\ + (((a)<<((b)&0x1f))&0xffff) +#define shift_left_logic_32(a, b)\ + (((a)<<((b)&0x1f))&0xffffffff) + +#endif diff --git a/miasm2/jitter/vm_mngr_py.c b/miasm2/jitter/vm_mngr_py.c new file mode 100644 index 00000000..a8085d92 --- /dev/null +++ b/miasm2/jitter/vm_mngr_py.c @@ -0,0 +1,939 @@ +/* +** Copyright (C) 2011 EADS France, Fabrice Desclaux <fabrice.desclaux@eads.net> +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License as published by +** the Free Software Foundation; either version 2 of the License, or +** (at your option) any later version. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License along +** with this program; if not, write to the Free Software Foundation, Inc., +** 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +*/ +#include <Python.h> +#include "structmember.h" +#include <stdint.h> +#include <inttypes.h> +#include "queue.h" +#include "vm_mngr.h" + +#define MIN(a,b) (((a)<(b))?(a):(b)) +#define MAX(a,b) (((a)>(b))?(a):(b)) + +extern struct memory_page_list_head memory_page_pool; +extern struct code_bloc_list_head code_bloc_pool; + +#define RAISE(errtype, msg) {PyObject* p; p = PyErr_Format( errtype, msg ); return p;} + + + +typedef struct { + PyObject_HEAD + PyObject *vmmngr; + vm_mngr_t vm_mngr; +} VmMngr; + + +PyObject* _vm_get_exception(unsigned int xcpt) +{ + PyObject*p; + + if (!xcpt) + p = NULL; + else if (xcpt & EXCEPT_CODE_AUTOMOD) + p = PyErr_Format( PyExc_RuntimeError, "EXCEPT_CODE_AUTOMOD" ); + else if (xcpt & EXCEPT_UNK_EIP) + p = PyErr_Format( PyExc_RuntimeError, "EXCEPT_UNK_EIP" ); + else if (xcpt & EXCEPT_UNK_MEM_AD) + p = PyErr_Format( PyExc_RuntimeError, "EXCEPT_UNK_MEM_AD" ); + + else p = PyErr_Format( PyExc_RuntimeError, "EXCEPT_UNKNOWN" ); + return p; +} + + +#define PyGetInt(item, value) \ + if (PyInt_Check(item)){ \ + value = (uint64_t)PyInt_AsLong(item); \ + } \ + else if (PyLong_Check(item)){ \ + value = (uint64_t)PyLong_AsUnsignedLongLong(item); \ + } \ + else{ \ + RAISE(PyExc_TypeError,"arg must be int"); \ + } \ + + +PyObject* vm_is_mem_mapped(VmMngr* self, PyObject* item) +{ + PyObject *addr; + uint64_t page_addr; + uint32_t ret; + if (!PyArg_ParseTuple(item, "O", &addr)) + return NULL; + + PyGetInt(addr, page_addr); + + ret = is_mem_mapped(&self->vm_mngr, page_addr); + return PyInt_FromLong((long)ret); +} + + + +PyObject* vm_get_mem_base_addr(VmMngr* self, PyObject* item) +{ + PyObject *addr; + + uint64_t page_addr; + uint64_t addr_base; + unsigned int ret; + + if (!PyArg_ParseTuple(item, "O", &addr)) + return NULL; + + PyGetInt(addr, page_addr); + + ret = get_mem_base_addr(&self->vm_mngr, page_addr, &addr_base); + if (ret == 0){ + Py_INCREF(Py_None); + return Py_None; + } + return PyLong_FromUnsignedLongLong((uint64_t)addr_base); +} + + +PyObject* vm_add_memory_page(VmMngr* self, PyObject* args) +{ + PyObject *addr; + PyObject *access; + PyObject *item_str; + uint64_t buf_size; + char* buf_data; + Py_ssize_t length; + uint64_t ret = 0x1337beef; + uint64_t page_addr; + uint64_t page_access; + + struct memory_page_node * mpn; + + if (!PyArg_ParseTuple(args, "OOO", &addr, &access, &item_str)) + return NULL; + + PyGetInt(addr, page_addr); + PyGetInt(access, page_access); + + if(!PyString_Check(item_str)) + RAISE(PyExc_TypeError,"arg must be str"); + + buf_size = PyString_Size(item_str); + PyString_AsStringAndSize(item_str, &buf_data, &length); + + fprintf(stderr, "add page %"PRIX64" %"PRIX64" %"PRIX64"\n", page_addr, buf_size, page_access); + mpn = create_memory_page_node(page_addr, buf_size, page_access); + if (mpn == NULL) + RAISE(PyExc_TypeError,"cannot create page"); + if (is_mpn_in_tab(&self->vm_mngr, mpn)) + RAISE(PyExc_TypeError,"known page in memory"); + + memcpy(mpn->ad_hp, buf_data, buf_size); + add_memory_page(&self->vm_mngr, mpn); + + return PyLong_FromUnsignedLongLong((uint64_t)ret); + +} + + + + +PyObject* vm_set_mem(VmMngr* self, PyObject* args) +{ + PyObject *addr; + PyObject *item_str; + + uint64_t buf_size; + char* buf_data; + Py_ssize_t length; + int ret = 0x1337; + uint64_t val; + uint64_t l; + + struct memory_page_node * mpn; + + if (!PyArg_ParseTuple(args, "OO", &addr, &item_str)) + return NULL; + + PyGetInt(addr, val); + + if(!PyString_Check(item_str)) + RAISE(PyExc_TypeError,"arg must be str"); + + buf_size = PyString_Size(item_str); + PyString_AsStringAndSize(item_str, &buf_data, &length); + + /* read is multiple page wide */ + while (buf_size){ + mpn = get_memory_page_from_address(&self->vm_mngr, val); + if (!mpn){ + PyErr_SetString(PyExc_RuntimeError, "cannot find address"); + return 0; + } + l = MIN(buf_size, mpn->size - (val-mpn->ad)); + memcpy(mpn->ad_hp + (val-mpn->ad), buf_data, l); + buf_data += l; + val += l; + buf_size -= l; + } + + return PyLong_FromUnsignedLongLong((uint64_t)ret); +} + +PyObject* vm_set_mem_access(VmMngr* self, PyObject* args) +{ + PyObject *addr; + PyObject *access; + + uint64_t ret = 0x1337beef; + uint64_t page_addr; + uint64_t page_access; + struct memory_page_node * mpn; + + if (!PyArg_ParseTuple(args, "OO", &addr, &access)) + return NULL; + + PyGetInt(addr, page_addr); + PyGetInt(access, page_access); + + mpn = get_memory_page_from_address(&self->vm_mngr, page_addr); + mpn->access = page_access; + return PyLong_FromUnsignedLongLong((uint64_t)ret); +} + + + + +PyObject* vm_get_mem(VmMngr* self, PyObject* args) +{ + PyObject *item; + PyObject *item_len; + + uint64_t buf_addr; + uint64_t buf_len; + PyObject *obj_out; + struct memory_page_node * mpn; + char * buf_out; + char * addr_tmp; + char * addr_out; + uint64_t off; + uint64_t l; + uint64_t my_size; + + if (!PyArg_ParseTuple(args, "OO", &item, &item_len)) + return NULL; + + PyGetInt(item, buf_addr); + PyGetInt(item_len, buf_len); + + my_size = buf_len; + buf_out = malloc(buf_len); + if (!buf_out){ + fprintf(stderr, "cannot alloc read\n"); + exit(-1); + } + + addr_out = buf_out; + + /* read is multiple page wide */ + while (my_size){ + mpn = get_memory_page_from_address(&self->vm_mngr, buf_addr); + if (!mpn){ + PyErr_SetString(PyExc_RuntimeError, "cannot find address"); + return 0; + } + + off = buf_addr - mpn->ad; + addr_tmp = &((char*)mpn->ad_hp)[off]; + + l = MIN(my_size, mpn->size - off); + memcpy(addr_out, addr_tmp, l); + my_size -= l; + addr_out +=l; + buf_addr +=l; + } + + obj_out = PyString_FromStringAndSize(buf_out, buf_len); + free(buf_out); + return obj_out; +} + +PyObject* vm_add_memory_breakpoint(VmMngr* self, PyObject* args) +{ + PyObject *ad; + PyObject *size; + PyObject *access; + + uint64_t b_ad; + uint64_t b_size; + uint64_t b_access; + + if (!PyArg_ParseTuple(args, "OOO", &ad, &size, &access)) + return NULL; + + PyGetInt(ad, b_ad); + PyGetInt(size, b_size); + PyGetInt(access, b_access); + + add_memory_breakpoint(&self->vm_mngr, b_ad, b_size, b_access); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_remove_memory_breakpoint(VmMngr* self, PyObject* args) +{ + PyObject *ad; + PyObject *access; + uint64_t b_ad; + uint64_t b_access; + + if (!PyArg_ParseTuple(args, "OO", &ad, &access)) + return NULL; + + PyGetInt(ad, b_ad); + PyGetInt(access, b_access); + remove_memory_breakpoint(&self->vm_mngr, b_ad, b_access); + + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_get_last_write_ad(VmMngr* self, PyObject* args) +{ + return PyInt_FromLong((uint64_t)self->vm_mngr.last_write_ad); +} + +PyObject* vm_get_last_write_size(VmMngr* self, PyObject* args) +{ + return PyLong_FromUnsignedLongLong((uint64_t)self->vm_mngr.last_write_size); +} + +PyObject* vm_set_exception(VmMngr* self, PyObject* args) +{ + PyObject *item1; + uint64_t i; + + if (!PyArg_ParseTuple(args, "O", &item1)) + return NULL; + + PyGetInt(item1, i); + + self->vm_mngr.exception_flags = i; + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_get_exception(VmMngr* self, PyObject* args) +{ + return PyLong_FromUnsignedLongLong((uint64_t)self->vm_mngr.exception_flags); +} + + + + +PyObject* vm_init_memory_page_pool(VmMngr* self, PyObject* args) +{ + init_memory_page_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_init_code_bloc_pool(VmMngr* self, PyObject* args) +{ + init_code_bloc_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + +PyObject* vm_init_memory_breakpoint(VmMngr* self, PyObject* args) +{ + init_memory_breakpoint(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + +PyObject* vm_reset_memory_breakpoint(VmMngr* self, PyObject* args) +{ + reset_memory_breakpoint(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + + + + + + +PyObject* vm_dump_memory_page_pool(VmMngr* self, PyObject* args) +{ + dump_memory_page_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_dump_memory_breakpoint(VmMngr* self, PyObject* args) +{ + dump_memory_breakpoint_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; +} + + +PyObject* vm_get_all_memory(VmMngr* self, PyObject* args) +{ + PyObject *o; + struct memory_page_node * mpn; + PyObject *dict; + PyObject *dict2; + + + dict = PyDict_New(); + + LIST_FOREACH(mpn, &self->vm_mngr.memory_page_pool, next){ + + dict2 = PyDict_New(); + + o = PyString_FromStringAndSize(mpn->ad_hp, mpn->size); + PyDict_SetItemString(dict2, "data", o); + Py_DECREF(o); + + o = PyInt_FromLong((long)mpn->size); + PyDict_SetItemString(dict2, "size", o); + Py_DECREF(o); + + o = PyInt_FromLong((long)mpn->access); + PyDict_SetItemString(dict2, "access", o); + Py_DECREF(o); + + o = PyInt_FromLong((long)mpn->ad); + PyDict_SetItem(dict, o, dict2); + Py_DECREF(o); + Py_DECREF(dict2); + } + return dict; +} + + +PyObject* vm_reset_memory_page_pool(VmMngr* self, PyObject* args) +{ + reset_memory_page_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + +PyObject* vm_reset_code_bloc_pool(VmMngr* self, PyObject* args) +{ + reset_code_bloc_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + + + + + + +PyObject* vm_call_pyfunc_from_globals(VmMngr* self, PyObject* args) +{ + char* funcname; + PyObject *mod, *func, *rslt, *globals, *func_globals; + + + if (!PyArg_ParseTuple(args, "s", &funcname)) + return NULL; + + + fprintf(stderr, "getting pyfunc %s\n", funcname); + mod = PyEval_GetBuiltins(); + + if (!mod) { + fprintf(stderr, "cannot find module\n"); + exit(0); + } + + func_globals = PyDict_GetItemString(mod, "globals"); + if (!func_globals) { + fprintf(stderr, "cannot find function globals\n"); + exit(0); + } + + if (!PyCallable_Check (func_globals)) { + fprintf(stderr, "function not callable\n"); + exit(0); + } + + globals = PyObject_CallObject (func_globals, NULL); + if (!globals) { + fprintf(stderr, "cannot get globals\n"); + exit(0); + } + + func = PyDict_GetItemString (globals, funcname); + if (!func) { + fprintf(stderr, "cannot find function %s\n", funcname); + exit(0); + } + + if (!PyCallable_Check (func)) { + fprintf(stderr, "function not callable\n"); + exit(0); + } + + rslt = PyObject_CallObject (func, NULL); + return rslt; +} + +PyObject* vm_add_code_bloc(VmMngr *self, PyObject *args) +{ + PyObject *item1; + PyObject *item2; + uint64_t ret = 0x1337beef; + uint64_t ad_start, ad_stop, ad_code = 0; + + struct code_bloc_node * cbp; + + if (!PyArg_ParseTuple(args, "OO", &item1, &item2)) + return NULL; + + PyGetInt(item1, ad_start); + PyGetInt(item2, ad_stop); + + cbp = create_code_bloc_node(ad_start, ad_stop); + cbp->ad_start = ad_start; + cbp->ad_stop = ad_stop; + cbp->ad_code = ad_code; + add_code_bloc(&self->vm_mngr, cbp); + return PyLong_FromUnsignedLongLong((uint64_t)ret); +} + +PyObject* vm_dump_code_bloc_pool(VmMngr* self) +{ + dump_code_bloc_pool(&self->vm_mngr); + Py_INCREF(Py_None); + return Py_None; + +} + + +PyObject* vm_exec_blocs(VmMngr* self, PyObject* args) +{ + PyObject* my_eip; + PyObject* b; + PyObject* module; + PyObject* func; + PyObject* meip; + uint64_t tmp; + + PyObject* known_blocs; + PyObject* e; + + if (!PyArg_ParseTuple(args, "OO", &my_eip, &known_blocs)) + return NULL; + + if(!PyDict_Check(known_blocs)) + RAISE(PyExc_TypeError, "arg must be dict"); + + PyGetInt(my_eip, tmp); + meip = PyLong_FromUnsignedLongLong((uint64_t)tmp); + while (1){ + b = PyDict_GetItem(known_blocs, meip); + if (b == NULL) + return meip; + + module = PyObject_GetAttrString(b, "module_c"); + if (module == NULL){ + fprintf(stderr, "assert eip module_c in pyobject\n"); + exit(0); + } + func = PyObject_GetAttrString(module, "func"); + if (func == NULL){ + fprintf(stderr, "assert func module_c in pyobject\n"); + exit(0); + } + + Py_DECREF(module); + if (!PyCallable_Check (func)) { + fprintf(stderr, "function not callable\n"); + exit(0); + } + Py_DECREF(meip); + //printf("exec bloc %"PRIX64"\n", tmp); + meip = PyObject_CallObject (func, NULL); + + Py_DECREF(func); + e = PyErr_Occurred (); + if (e){ + fprintf(stderr, "exception\n"); + return meip; + } + + if (self->vm_mngr.exception_flags) + return meip; + + } +} + + + +PyObject* vm_exec_bloc(PyObject* self, PyObject* args) +{ + PyObject* b; + PyObject* module; + PyObject* func; + PyObject* meip; + uint64_t tmp; + + PyObject* my_eip; + PyObject* known_blocs; + PyObject* e; + + if (!PyArg_ParseTuple(args, "OO", &my_eip, &known_blocs)) + return NULL; + + + if (PyInt_Check(my_eip)){ + tmp = (uint64_t)PyInt_AsLong(my_eip); + } + else if (PyLong_Check(my_eip)){ + tmp = (uint64_t)PyLong_AsUnsignedLongLong(my_eip); + } + else{ + RAISE(PyExc_TypeError,"arg1 must be int"); + } + + meip = PyInt_FromLong((long)tmp); + b = PyDict_GetItem(known_blocs, my_eip); + if (b == NULL) + return meip; + module = PyObject_GetAttrString(b, "module_c"); + if (module == NULL) + return meip; + func = PyObject_GetAttrString(module, "func"); + if (func == NULL) + return meip; + Py_DECREF(module); + if (!PyCallable_Check (func)) { + fprintf(stderr, "function not callable\n"); + exit(0); + } + Py_DECREF(meip); + meip = PyObject_CallObject (func, NULL); + + Py_DECREF(func); + e = PyErr_Occurred (); + if (e){ + fprintf(stderr, "exception\n"); + return meip; + } + + return meip; +} + + +PyObject* vm_set_automod_cb(VmMngr* self, PyObject* args) +{ + PyObject* cb_automod; + + if (!PyArg_ParseTuple(args, "O", &cb_automod)) + return NULL; + + if (self->vm_mngr.cb_automod != NULL){ + Py_DECREF(self->vm_mngr.cb_automod); + } + + Py_INCREF(cb_automod); + self->vm_mngr.cb_automod = cb_automod; + Py_INCREF(Py_None); + return Py_None; +} + +PyObject* vm_set_addr2obj(VmMngr* self, PyObject* args) +{ + PyObject* addr2obj; + + if (!PyArg_ParseTuple(args, "O", &addr2obj)) + return NULL; + + if (self->vm_mngr.addr2obj != NULL){ + Py_DECREF(self->vm_mngr.addr2obj); + } + + Py_INCREF(addr2obj); + self->vm_mngr.addr2obj = addr2obj; + Py_INCREF(Py_None); + return Py_None; +} + + + +/* +PyObject* add_jitbloc(VmMngr* self, PyObject* args) +{ + PyObject* jitobj; + + if (!PyArg_ParseTuple(args, "O", &addr2obj)) + return NULL; + + Py_INCREF(Py_None); + return Py_None; + +} +*/ + + + + +static void +VmMngr_dealloc(VmMngr* self) +{ + self->ob_type->tp_free((PyObject*)self); +} + + +static PyObject * +VmMngr_new(PyTypeObject *type, PyObject *args, PyObject *kwds) +{ + VmMngr *self; + + self = (VmMngr *)type->tp_alloc(type, 0); + return (PyObject *)self; +} + +static PyObject * +VmMngr_get_vmmngr(VmMngr *self, void *closure) +{ + return PyLong_FromUnsignedLongLong((uint64_t)&(self->vm_mngr)); +} + +static int +VmMngr_set_vmmngr(VmMngr *self, PyObject *value, void *closure) +{ + PyErr_SetString(PyExc_TypeError, "immutable vmmngr"); + return -1; +} + +static PyMemberDef VmMngr_members[] = { + {NULL} /* Sentinel */ +}; + +static PyMethodDef VmMngr_methods[] = { + {"vm_init_memory_page_pool", (PyCFunction)vm_init_memory_page_pool, METH_VARARGS, + "X"}, + {"vm_init_memory_breakpoint", (PyCFunction)vm_init_memory_breakpoint, METH_VARARGS, + "X"}, + {"vm_init_code_bloc_pool",(PyCFunction)vm_init_code_bloc_pool, METH_VARARGS, + "X"}, + {"vm_set_mem_access", (PyCFunction)vm_set_mem_access, METH_VARARGS, + "X"}, + {"vm_set_mem", (PyCFunction)vm_set_mem, METH_VARARGS, + "X"}, + {"vm_set_automod_cb", (PyCFunction)vm_set_automod_cb, METH_VARARGS, + "X"}, + {"vm_set_addr2obj", (PyCFunction)vm_set_addr2obj, METH_VARARGS, + "X"}, + {"vm_add_code_bloc",(PyCFunction)vm_add_code_bloc, METH_VARARGS, + "X"}, + {"vm_exec_bloc",(PyCFunction)vm_exec_bloc, METH_VARARGS, + "X"}, + {"vm_exec_blocs",(PyCFunction)vm_exec_blocs, METH_VARARGS, + "X"}, + {"vm_get_mem", (PyCFunction)vm_get_mem, METH_VARARGS, + "X"}, + {"vm_add_memory_page",(PyCFunction)vm_add_memory_page, METH_VARARGS, + "X"}, + {"vm_add_memory_breakpoint",(PyCFunction)vm_add_memory_breakpoint, METH_VARARGS, + "X"}, + {"vm_remove_memory_breakpoint",(PyCFunction)vm_remove_memory_breakpoint, METH_VARARGS, + "X"}, + {"vm_set_exception", (PyCFunction)vm_set_exception, METH_VARARGS, + "X"}, + {"vm_dump_memory_page_pool", (PyCFunction)vm_dump_memory_page_pool, METH_VARARGS, + "X"}, + {"vm_dump_memory_breakpoint", (PyCFunction)vm_dump_memory_breakpoint, METH_VARARGS, + "X"}, + {"vm_get_all_memory",(PyCFunction)vm_get_all_memory, METH_VARARGS, + "X"}, + {"vm_reset_memory_page_pool", (PyCFunction)vm_reset_memory_page_pool, METH_VARARGS, + "X"}, + {"vm_reset_memory_breakpoint", (PyCFunction)vm_reset_memory_breakpoint, METH_VARARGS, + "X"}, + {"vm_reset_code_bloc_pool", (PyCFunction)vm_reset_code_bloc_pool, METH_VARARGS, + "X"}, + {"vm_call_pyfunc_from_globals",(PyCFunction)vm_call_pyfunc_from_globals, METH_VARARGS, + "X"}, + + {"vm_get_exception",(PyCFunction)vm_get_exception, METH_VARARGS, + "X"}, + {"vm_get_exception",(PyCFunction)vm_get_exception, METH_VARARGS, + "X"}, + {"vm_get_last_write_ad", (PyCFunction)vm_get_last_write_ad, METH_VARARGS, + "X"}, + {"vm_get_last_write_size",(PyCFunction)vm_get_last_write_size, METH_VARARGS, + "X"}, + + {NULL} /* Sentinel */ +}; + +static int +VmMngr_init(VmMngr *self, PyObject *args, PyObject *kwds) +{ + + + fprintf(stderr, "ad cpu: %p\n", &(self->vm_mngr)); + memset(&(self->vm_mngr), 0, sizeof(self->vm_mngr)); + return 0; +} + +static PyGetSetDef VmMngr_getseters[] = { + {"vmmngr", + (getter)VmMngr_get_vmmngr, (setter)VmMngr_set_vmmngr, + "first name", + NULL}, + {NULL} /* Sentinel */ +}; + + +static PyTypeObject VmMngrType = { + PyObject_HEAD_INIT(NULL) + 0, /*ob_size*/ + "JitCore_x86_32.VmMngr", /*tp_name*/ + sizeof(VmMngr), /*tp_basicsize*/ + 0, /*tp_itemsize*/ + (destructor)VmMngr_dealloc,/*tp_dealloc*/ + 0, /*tp_print*/ + 0, /*tp_getattr*/ + 0, /*tp_setattr*/ + 0, /*tp_compare*/ + 0, /*tp_repr*/ + 0, /*tp_as_number*/ + 0, /*tp_as_sequence*/ + 0, /*tp_as_mapping*/ + 0, /*tp_hash */ + 0, /*tp_call*/ + 0, /*tp_str*/ + 0, /*tp_getattro*/ + 0, /*tp_setattro*/ + 0, /*tp_as_buffer*/ + Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /*tp_flags*/ + "VmMngr objects", /* tp_doc */ + 0, /* tp_traverse */ + 0, /* tp_clear */ + 0, /* tp_richcompare */ + 0, /* tp_weaklistoffset */ + 0, /* tp_iter */ + 0, /* tp_iternext */ + VmMngr_methods, /* tp_methods */ + VmMngr_members, /* tp_members */ + VmMngr_getseters, /* tp_getset */ + 0, /* tp_base */ + 0, /* tp_dict */ + 0, /* tp_descr_get */ + 0, /* tp_descr_set */ + 0, /* tp_dictoffset */ + (initproc)VmMngr_init, /* tp_init */ + 0, /* tp_alloc */ + VmMngr_new, /* tp_new */ +}; + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +static PyObject *Vm_Mngr_Error; + + +static PyMethodDef Vm_Mngr_Methods[] = { + + {NULL, NULL, 0, NULL} /* Sentinel */ + +}; + + +PyMODINIT_FUNC +initvm_mngr(void) +{ + PyObject *m; + + if (PyType_Ready(&VmMngrType) < 0) + return; + + m = Py_InitModule("vm_mngr", Vm_Mngr_Methods); + if (m == NULL) + return; + + Vm_Mngr_Error = PyErr_NewException("vm_mngr_.error", NULL, NULL); + Py_INCREF(Vm_Mngr_Error); + PyModule_AddObject(m, "error", Vm_Mngr_Error); + + Py_INCREF(&VmMngrType); + PyModule_AddObject(m, "VmMngr", (PyObject *)&VmMngrType); + +} + diff --git a/setup.py b/setup.py new file mode 100755 index 00000000..5292a849 --- /dev/null +++ b/setup.py @@ -0,0 +1,135 @@ +#! /usr/bin/env python + +from distutils.core import setup, Extension +from distutils.util import get_platform +import shutil +import os, sys + +def buil_all(): + packages=['miasm2', + 'miasm2/arch', + 'miasm2/arch/x86', + 'miasm2/arch/arm', + 'miasm2/arch/msp430', + 'miasm2/arch/sh4', + 'miasm2/core', + 'miasm2/expression', + 'miasm2/ir', + 'miasm2/analysis', + 'miasm2/jitter', + 'miasm2/jitter/arch', + 'miasm2/jitter/os_dep', + ] + + ext_modules_no_tcc = [ + Extension("miasm2.jitter.vm_mngr", + ["miasm2/jitter/vm_mngr.c", + "miasm2/jitter/vm_mngr_py.c"]), + Extension("miasm2.jitter.arch.JitCore_x86", + ["miasm2/jitter/arch/JitCore_x86.c"]), + Extension("miasm2.jitter.arch.JitCore_arm", + ["miasm2/jitter/arch/JitCore_arm.c"]), + Extension("miasm2.jitter.arch.JitCore_msp430", + ["miasm2/jitter/arch/JitCore_msp430.c"]), + Extension("miasm2.jitter.Jitllvm", + ["miasm2/jitter/Jitllvm.c"]), + ] + + ext_modules_all = [ + Extension("miasm2.jitter.vm_mngr", + ["miasm2/jitter/vm_mngr.c", + "miasm2/jitter/vm_mngr_py.c"]), + Extension("miasm2.jitter.arch.JitCore_x86", + ["miasm2/jitter/arch/JitCore_x86.c"]), + Extension("miasm2.jitter.arch.JitCore_arm", + ["miasm2/jitter/arch/JitCore_arm.c"]), + Extension("miasm2.jitter.arch.JitCore_msp430", + ["miasm2/jitter/arch/JitCore_msp430.c"]), + Extension("miasm2.jitter.Jitllvm", + ["miasm2/jitter/Jitllvm.c"]), + Extension("miasm2.jitter.Jittcc", + ["miasm2/jitter/Jittcc.c"], + libraries=["tcc"]) + ] + + + print 'building' + build_ok = False + for name, ext_modules in [('all', ext_modules_all), + ('notcc', ext_modules_no_tcc)]: + print 'build with', repr(name) + try: + s = setup( + name = 'Miasm', + version = '2.0', + packages = packages, + package_data = {'miasm2':['jitter/*.h', + 'jitter/arch/*.h',]}, + ext_modules = ext_modules, + # Metadata + author = 'Fabrice Desclaux', + author_email = 'serpilliere@droid-corp.org', + description = 'Machine code manipulation library', + license = 'GPLv2', + # keywords = '', + # url = '', + ) + except SystemExit, e: + print repr(e) + continue + build_ok = True + break + if not build_ok: + raise ValueError('Unable to build Miasm!') + print 'build', name + if name == 'notcc': + print + print "*"*80 + print "Warning: TCC is not properly installed," + print "Miasm will be installed without TCC Jitter" + print "Etheir install TCC or use LLVM jitter" + print "*"*80 + print + # we copy libraries from build dir to current miasm directory + build_base = None + if 'build' in s.command_options: + if 'build_base' in s.command_options['build']: + build_base = s.command_options['build']['build_base'] + if build_base is None: + build_base = "build" + plat_specifier = ".%s-%s" % (get_platform(), sys.version[0:3]) + build_base = os.path.join('build','lib' + plat_specifier) + print build_base + +def buil_no_tcc(): + setup( + name = 'Miasm', + version = '2.0', + packages=['miasm2', 'miasm2/tools', + 'miasm2/expression', 'miasm2/graph', 'miasm2/arch', + 'miasm2/core', 'miasm2/tools/emul_lib' ], + package_data = {'miasm2':['tools/emul_lib/*.h']}, + # data_files = [('toto', ['miasm2/tools/emul_lib/queue.h'])], + # Metadata + author = 'Fabrice Desclaux', + author_email = 'serpilliere@droid-corp.org', + description = 'Machine code manipulation library', + license = 'GPLv2', + # keywords = '', + # url = '', + ) + + +def try_build(): + buil_all() + """ + try: + buil_all() + return + except: + print "WARNING cannot build with libtcc!, trying without it" + print "Miasm will not be able to emulate code" + buil_no_tcc() + """ + +try_build() diff --git a/test/arch/arm/arch.py b/test/arch/arm/arch.py new file mode 100644 index 00000000..e6b3fdda --- /dev/null +++ b/test/arch/arm/arch.py @@ -0,0 +1,517 @@ +import os +import time +from miasm2.arch.arm.arch import * + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + +if 0: + a = bs('00') + b = bs('01') + c = bs(l=2) + d = bs(l=4, fname='rd') + e = bs_name(l=1, name={'ADD': 0, 'SUB': 1}) + assert(isinstance(e, bs_divert)) + scc = bs_mod_name(l=1, mn_mod=['', 'S']) + f = bs(l=1, cls=(arm_reg,)) + + class arm_mov(mn_arm): + fields = [bs('0000'), bs('0000'), bs('0000')] + + class arm_DATA(mn_arm): + fields = [bs('1111'), e, scc, f, bs('0')] + mn = mn_arm.dis(0xF000000) + + +if 0: + import cProfile + cProfile.run('mn_arm.dis("\xe1\xa0\xa0\x06", mode_arm)') + # l = mn_arm.dis(bin_stream("\xe1\xa0\xa0\x06"), mode_arm) + # print l + """ + mode = 64 + l = mn_x86.fromstring("ADC DWORD PTR [RAX], 0x11223344", mode) + print 'xx' + #t= time.time() + import cProfile + def f(): + x = l.asm(mode) + print x + cProfile.run('f()') + """ + + +def h2i(s): + return s.replace(' ', '').decode('hex') + + +def u16swap(i): + return struct.unpack('<H', struct.pack('>H', i))[0] + +reg_tests_arm = [ + ("001504F4 MOV R1, LR", + "0e10a0e1"), + ("00150500 ADD R2, R8, R0", + "002088e0"), + ("001504E8 MOV LR, 0x3E8", + "faefa0e3"), + ("001504F0 RSB R0, R0, R3", + "030060e0"), + ("000E6F50 MUL R2, LR, R6", + "9e0602e0"), + ("000620D8 MLA R12, R0, R5, R3", + "90352ce0"), + ("00026798 ADDS R2, R4, R0", + "002094e0"), + ("0003EA9C MVN R7, R2", + "0270e0e1"), + ("C00CD4DC BL 0x7C", + "1F0000EB"), + ("C00CF110 BL 0xFFFFFDEC", + "7BFFFFEB"), + + + ("000829b0 BLNE 0xFFF87110", + "441cfe1b"), + + ("C00EC608 TEQ R4, R5", + "050034e1"), + ("C00CD53C CMP R9, R8", + "080059e1"), + ("C00CD5D8 MOV R1, 0x60000000", + "0612a0e3"), + ("C00CEC18 MOV R2, R1 LSL 0x14", + "012aa0e1"), + ("C00CF828 ORR R0, R2, R1 LSL R0", + "110082e1"), + ("C00D8A14 EOR R7, R2, R7 LSR 0x8", + "277422e0"), + ("C00CD2E4 MRS R1, CPSR_cxsf", + "00100fe1"), + ("C019BE2C MRS R5, SPSR_cxsf", + "00504fe1"), + ("C00CD2F0 MSR CPSR_cf, R1", + "01f029e1"), + ("C00D8A24 LDRB R2, [R3, 0xFFFFFFFF]", # LDRB R2, [R3, #-1] + "012053e5"), + ("C01E59F8 LDREQ R0, [R1, R0 LSL 0x2]", # LDREQ R0, [R1, R0, LSL 2] + "00019107"), + ("C046855C LDR R0, [R9, R0 LSL 0x4]", # + "000299e7"), + ('c012a8d8 LDREQ R0, [R0]', + '00009005'), + ("C00D8AA8 LDR R0, [R2], 0x4", # LDR R0, [R2], 4 + "040092e4"), + ("C00D8A9C LDR R0, [PC, 0x514]", + "14059fe5"), + ("C03C7A38 LDR R5, [R0, 0xD4]!", + "d450b0e5"), + ("C00EA214 LDMIA R0, {R0, R1}", # LDMIA R0, {R0, R1} + "030090e8"), + ("C0121D70 LDMGEIA R1, {R0, R1}", + "030091a8"), + ("C0124E68 LDMIB R1, {R4, R12}", + "101091e9"), + ("C012D2A0 LDMDA R7, {R0, R2}", + "050017e8"), + ("C0130A64 LDMFD SP, {R0, R1}", + "03009de8"), + ("C016AAD0 LDMFD SP!, {R8}", + "0001bde8"), + ("C00E0F98 LDMED SP, {R4, R6}", + "50009de9"), + ("C0161AC0 STMFD SP!, {R8}", # stmfd + "00012de9"), + ("C00E0710 STMIA R5, {R8, R9}", + "000385e8"), + ("C0460580 STMFA SP, {R8, R10}", + "00058de9"), + ("C04FFBD0 STMEA SP, {R9, R10}", + "00068de8"), + ("C00CEB10 STMDB R8, {SP, LR}^", + "006048e9"), + ("C0129534 STMIB R6, {R0, R9}", + "010286e9"), + ("C01293BC STMFD SP!, {R4-R11, LR}", + "F04F2DE9"), + ("C02FA8B4 SVCEQ 0x196A0B", + "0B6a190f"), + ("C00EF814 SVCMI 0x495020", + "2050494F"), + ("C00ED5CC CDPCS p3, 0x2, c7, c14, c5, 0x3", + "65732e2e"), + ("C00EFE88 CDPVS p13, 0x2, c6, c0, c15, 0x3", + "6F6D206e"), + ("C0148ED0 LDCVS p11, c5, [R4], 0xFFFFFF94!", # -0x6C TODO XXX no wb ! + "1B5B346C"), + ("C00ED374 MRCHI p15, 0x5, LR, c14, c9, 0x7", + "f9efbe8e"), + ("C00F3D24 MCRVS p0, 0x3, R2, c9, c4, 0x3", + "7420696e"), + ("xxxxxxxx UND 0x0, 0x0", + "100000e6"), + ("xxxxxxxx BKPT 0x0, 0x0", + "700020e1"), + ("c00d153c LDRH R2, [R4, 0xCA]", + "ba2cd4e1"), + ("c00d18a8 LDRH R6, [R12]", + "b060dce1"), + ("c00d8134 STRH R3, [R6, 0x2]", + "b230c6e1"), + ("c00d80c4 STRH R3, [R6]", + "b030c6e1"), + + ("00031F40 LDRD R8, [R7]", + "D080C7E1"), + + ("c0104a34 LDRD R0, [SP, 0x8]", + "D800CDE1"), + ("C013DC68 LDRD R6, [R0, 0xFFFFFFF8]", + "D86040E1"), + + ("C0120CC0 LDRSB R1, [SP, 0x8]", + "D810DDE1"), + + ("C0105C28 LDRSH R0, [R8, 0xA]", + "FA00D8E1"), + + ("C00D8FF4 LDRH R3, [R12, R3]", + "B3309CE1"), + ("C012D1A4 LDRSB R2, [R2, R1]", + "D12092E1"), + + ("c0115a84 STRD R0, [SP, 0x18]", + "F801CDE1"), + ("c0124a18 STRD R2, [R0, 0xFFFFFFF8]", + "F82040E1"), + + ("0002F5A8 MOV R2, 0x2710", + "102702E3"), + + ("0002F5B0 UMULL R2, R3, R3, R2", + "932283E0"), + ("C045D260 SMULL R3, R2, LR, R2", + "9E32C2E0"), + ("C03E6440 SMLAL R2, R0, R1, R0", + "9120E0E0"), + + ("C00CFA40 BLX R12", + "3CFF2FE1"), + ("C010DE1C BLX 0x1ECCEA", + "3AB307FB"), + + ("00013028 MOV R9, 0x6E75", + "759E06E3"), + + ("0001302C MOVT R9, 0x64", + "649040E3"), + + ("0004A38C CLZ R3, R2", + "123F6FE1"), + + ("C0132564 BLX 0xFFFCF06C", + "1B3CFFFA"), + + ("C0297028 QADD R7, R6, R6", + "567006E1"), + + ("6330A0E1 MOV R3, R3 RRX", + "6330A0E1"), + +] +ts = time.time() + +for s, l in reg_tests_arm: + print "-" * 80 + s = s[12:] + b = h2i((l)) + mn = mn_arm.dis(b, mode_arm) + print [str(x) for x in mn.args] + print s + print mn + assert(str(mn) == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + l = mn_arm.fromstring(s, mode_arm) + # print l + assert(str(l) == s) + a = mn_arm.asm(l) + print [x for x in a] + print repr(b) + # print mn.args + assert(b in a) + +reg_tests_armt = [ + ("0006ff5c LSLS R2, R0, 0x1A", + "8206"), + ("0006fe06 LSRS R3, R3, 0x7", + "db09"), + ("0006af9c ASRS R0, R2, 0x1", + "5010"), + ("0006b1ea ADDS R1, R4, R5", + "6119"), + ("0006b304 ADDS R2, R0, 0x1", + "421c"), + ("0006bc80 SUBS R3, R1, 0x1", + "4b1e"), + ("0006f1d0 SUBS R2, R6, R3", + "f21a"), + ("0006af30 MOVS R3, 0x1", + "0123"), + ("0006b0ee CMP R3, 0x1", + "012b"), + ("C0100242 CMP R2, 0x0", + "002A"), + ("0006b0f2 SUBS R3, 0x1", + "013b"), + ("0006b12c ADDS R0, 0x4", + "0430"), + + ("0006b944 ANDS R2, R5", + "2a40"), + ("0014df06 EORS R2, R0", + "4240"), + ("0008b66e LSLS R7, R1", + "8f40"), + ("002e7e0c LSRS R4, R0", + "c440"), + ("003258b6 ASRS R2, R3", + "1a41"), + # adcs + # sbcs + # rors + ("0017b754 TST R0, R2", + "1042"), + ("0006e3fc NEGS R5, R5", + "6d42"), + ("0006b1fc CMP R6, R7", + "be42"), + ("001845ea CMN R3, R0", + "c342"), + ("001845ea ORRS R0, R4", + "2043"), + # muls + # bic + ("0006b90e MVNS R0, R3", + "d843"), + + ("0006bcac CMP R6, R9", + "4e45"), + ("0006bcf0 CMP R3, R1", + "8b42"), + ("0006c26c CMP R12, LR", + "f445"), + ("0006c8e4 CMP R8, R2", + "9045"), + ("0006af70 MOV R1, R0", + "0146"), + ("0006b3d0 MOV R1, SP", + "6946"), + ("0006b47c MOV R8, R0", + "8046"), + ("0006bc8e MOV R8, SP", + "e846"), + ("0006aee0 BX LR", + "7047"), + ("000a9d30 BX R2", + "1047"), + + ("0006b2dc LDR R0, [PC]", + "0048"), + ("00078798 LDR R3, [PC, 0x1]", + "014b"), + + ("00072dc2 LDR R3, [R3, R0]", + "1b58"), + ("0008e5d4 LDR R2, [R4, R0]", + "2258"), + ("0018e8ce LDRB R3, [R0, R4]", + "035d"), + ("0007b976 STR R6, [R5, R4]", + "2e51"), + ("000b5b42 STRB R7, [R1, R4]", + "0f55"), + + ("002b02ae STRH R1, [R0, R3]", + "c152"), + ("002ea7de LDRH R5, [R6, R4]", + "355b"), + # ldsb + # ldsh + + ("000a65c6 LDR R7, [R0, 0x10]", + "0769"), + ("0006b308 LDRB R5, [R1, 0x4]", + "0d79"), + ("0006b014 STR R4, [R4, 0x38]", + "a463"), + ("0006b006 STRB R5, [R0, 0x10]", + "0574"), + + ("0009b598 STRH R3, [R4, 0x2]", + "6380"), + ("000748da LDRH R2, [R6, 0x30]", + "328E"), + + ("0006aed2 STR R3, [SP, 0x24]", + "0993"), + ("0006ae6c LDR R3, [SP, 0x4]", + "019b"), + + ("0006aed0 ADD R1, SP, 0x20", + "08a9"), + ("000xxxxx ADD R1, PC, 0x20", + "08a1"), + + ("0006aed8 ADD SP, 0x30", + "0cb0"), + ("0006c1b0 SUB SP, 0x18", + "86b0"), + + + ("0006aeee POP {R4, PC}", + "10bd"), + ("0006b03a POP {R4-R6, PC}", + "70bd"), + ("0006aee4 PUSH {R4, LR}", + "10b5"), + ("0006b084 PUSH {R0, R1, R4-R6, LR}", + "73b5"), + ("003139a0 PUSH {LR}", + "00b5"), + ("00220f44 PUSH {R2, R3}", + "0cb4"), + + ("00076c54 LDMIA R1!, {R0, R1}", + "03c9"), + ("000a1c16 STMIA R6!, {R0-R3}", + "0fc6"), + + ("0006af78 BEQ 0x6", + "03d0"), + ("000747b4 BCC 0xFFFFFFE6", + "f3d3"), + # swi + + ("0007479c B 0xE", + "07e0"), + ("0006b946 B 0xFFFFFFE4", + "f2e7"), + ("C010163C BLX 0x1F916C", + "F9F1B6E8"), + ("C01015E8 BL 0x1F8D5C", + "F8F1AEFE"), + + + #("000xxxxx BL 0x0", + # "00F8"), + #("000xxxxx BL 0x4000", + # "04F0"), + #("000xxxxx BL 0xFFFFF000", + # "FFF7"), + + + #("0006aea4 MOV R5, R1", + # "460d"), + + # adc + # adc + ("00000000 UND ", + "01de"), + + ("00000000 BLX R7", + "B847"), + + ("00000000 CBZ R4, 0x2E", + "bcb1"), + ("00000000 CBNZ R0, 0x2A", + "a8b9"), + + +] +print "#" * 40, 'armthumb', '#' * 40 + +for s, l in reg_tests_armt: + print "-" * 80 + s = s[12:] + b = h2i((l)) + print b.encode('hex') + mn = mn_armt.dis(b, mode_armthumb) + print [str(x) for x in mn.args] + print s + print mn + assert(str(mn) == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + l = mn_armt.fromstring(s, mode_armthumb) + # print l + assert(str(l) == s) + a = mn_armt.asm(l) + print [x for x in a] + print repr(b) + # print mn.args + assert(b in a) + +""" +print "*"*30, "START SPECIAL PARSING", "*"*30 +parse_tests = [ + "MOV LR, toto", + "MOV LR, 1+toto", + "MOV LR, (lend-lstart)^toto<<<R1", + "MOV LR, R1 LSL (l_end-l_start)^toto<<<R1", + "MOV LR, R1 LSL (l_end-l_start)^toto<<<R1", + "EOR R0, R1, toto^titi+1", + ] + +for l in parse_tests: + print "-"*80 + l = mn_arm.fromstring(l, mode_arm) + print l.name, ", ".join([str(a) for a in l.args]) +""" + + +print 'TEST time', time.time() - ts + +# speed test arm +o = "" +for s, l in reg_tests_arm: + s = s[12:] + b = h2i((l)) + o += b + +while len(o) < 1000: + o += o +bs = bin_stream_str(o) +off = 0 +instr_num = 0 +ts = time.time() +while off < bs.getlen(): + mn = mn_arm.dis(bs, mode_arm, off) + instr_num += 1 + off += 4 +print 'instr per sec:', instr_num / (time.time() - ts) + + +# speed test thumb +o = "" +for s, l in reg_tests_armt: + s = s[12:] + b = h2i((l)) + o += b + +while len(o) < 1000: + o += o +bs = bin_stream_str(o) +off = 0 +instr_num = 0 +ts = time.time() +while off < bs.getlen(): + mn = mn_armt.dis(bs, mode_armthumb, off) + # print instr_num, off, str(mn) + instr_num += 1 + off += mn.l +print 'instr per sec:', instr_num / (time.time() - ts) + +import cProfile +cProfile.run(r'mn_arm.dis("\xe1\xa0\xa0\x06", mode_arm)') diff --git a/test/arch/arm/sem.py b/test/arch/arm/sem.py new file mode 100644 index 00000000..be36e90b --- /dev/null +++ b/test/arch/arm/sem.py @@ -0,0 +1,321 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest +import logging + +from miasm2.ir.symbexec import symbexec +from miasm2.arch.arm.arch import mn_arm as mn, mode_arm as mode +from miasm2.arch.arm.sem import ir_arm as ir +from miasm2.arch.arm.regs import * +from miasm2.expression.expression import * + +logging.getLogger('cpuhelper').setLevel(logging.ERROR) +EXCLUDE_REGS = set() + + +def M(addr): + return ExprMem(ExprInt_fromsize(16, addr), 16) + + +def compute(asm, inputstate={}, debug=False): + sympool = dict(regs_init) + sympool.update({k: ExprInt_from(k, v) for k, v in inputstate.iteritems()}) + symexec = symbexec(mn, sympool) + instr = mn.fromstring(asm, mode) + code = mn.asm(instr)[0] + instr = mn.dis(code, mode) + instr.offset = inputstate.get(PC, 0) + interm = ir() + interm.add_instr(instr) + symexec.emul_ir_blocs(interm, instr.offset) + if debug: + for k, v in symexec.symbols.items(): + if regs_init.get(k, None) != v: + print k, v + return {k: v.arg.arg for k, v in symexec.symbols.items() + if k not in EXCLUDE_REGS and regs_init.get(k, None) != v} + + +class TestARMSemantic(unittest.TestCase): + + # def test_condition(self): + # §A8.3: Conditional execution + # pass + + def test_shift(self): + # §A8.4: Shifts applied to a register + self.assertEqual( + compute('MOV R4, R4 ', {R4: 0xDEADBEEF, }), {R4: 0xDEADBEEF, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 LSL 0') + self.assertEqual( + compute('MOV R4, R4 LSL 1', {R4: 0xDEADBEEF, }), {R4: 0xBD5B7DDE, }) + self.assertEqual( + compute('MOV R4, R4 LSL 16', {R4: 0xDEADBEEF, }), {R4: 0xBEEF0000, }) + self.assertEqual( + compute('MOV R4, R4 LSL 31', {R4: 0xDEADBEEF, }), {R4: 0x80000000, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 LSL 32') + self.assertEqual( + compute('MOV R4, R4 LSL R5', {R4: 0xDEADBEEF, R5: 0xBADBAD01, }), {R4: 0xBD5B7DDE, R5: 0xBADBAD01, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 LSR 0') + self.assertEqual( + compute('MOV R4, R4 LSR 1', {R4: 0xDEADBEEF, }), {R4: 0x6F56DF77, }) + self.assertEqual( + compute('MOV R4, R4 LSR 16', {R4: 0xDEADBEEF, }), {R4: 0x0000DEAD, }) + self.assertEqual( + compute('MOV R4, R4 LSR 31', {R4: 0xDEADBEEF, }), {R4: 0x00000001, }) + self.assertEqual( + compute('MOV R4, R4 LSR 32', {R4: 0xDEADBEEF, }), {R4: 0xDEADBEEF, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 LSR 33') + self.assertEqual( + compute('MOV R4, R4 LSR R5', {R4: 0xDEADBEEF, R5: 0xBADBAD01, }), {R4: 0x6F56DF77, R5: 0xBADBAD01, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 ASR 0') + self.assertEqual( + compute('MOV R4, R4 ASR 1', {R4: 0xDEADBEEF, }), {R4: 0xEF56DF77, }) + self.assertEqual( + compute('MOV R4, R4 ASR 16', {R4: 0xDEADBEEF, }), {R4: 0xFFFFDEAD, }) + self.assertEqual( + compute('MOV R4, R4 ASR 31', {R4: 0xDEADBEEF, }), {R4: 0xFFFFFFFF, }) + self.assertEqual( + compute('MOV R4, R4 ASR 32', {R4: 0xDEADBEEF, }), {R4: 0xDEADBEEF, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 ASR 33') + self.assertEqual( + compute('MOV R4, R4 ASR R5', {R4: 0xDEADBEEF, R5: 0xBADBAD01, }), {R4: 0xEF56DF77, R5: 0xBADBAD01, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 ROR 0') + self.assertEqual( + compute('MOV R4, R4 ROR 1', {R4: 0xDEADBEEF, }), {R4: 0xEF56DF77, }) + self.assertEqual( + compute('MOV R4, R4 ROR 16', {R4: 0xDEADBEEF, }), {R4: 0xBEEFDEAD, }) + self.assertEqual( + compute('MOV R4, R4 ROR 31', {R4: 0xDEADBEEF, }), {R4: 0xBD5B7DDF, }) + self.assertRaises(ValueError, compute, 'MOV R4, R4 ROR 32') + self.assertEqual( + compute('MOV R4, R4 ROR R5', {R4: 0xDEADBEEF, R5: 0xBADBAD01, }), {R4: 0xEF56DF77, R5: 0xBADBAD01, }) + self.assertEqual(compute('MOV R4, R4 RRX ', {cf: 0, R4: 0xDEADBEEF, }), { + cf: 0, R4: 0x6F56DF77, }) + self.assertEqual(compute('MOV R4, R4 RRX ', {cf: 1, R4: 0xDEADBEEF, }), { + cf: 1, R4: 0xEF56DF77, }) + + def test_ADC(self): + # §A8.8.1: ADC{S}{<c>}{<q>} {<Rd>,} <Rn>, #<const> + self.assertRaises( + ValueError, compute, 'ADC R4, 0x00000001 ') + self.assertEqual(compute('ADC R4, R4, 0x00000001 ', { + cf: 0, R4: 0x00000000, }), {cf: 0, R4: 0x00000001, }) + self.assertEqual(compute('ADC R4, R4, 0x00000000 ', { + cf: 1, R4: 0x00000000, }), {cf: 1, R4: 0x00000001, }) + self.assertEqual(compute('ADC PC, R4, 0x00000001 ', { + cf: 0, R4: 0xFFFFFFFF, PC: 0x55555555, }), {cf: 0, R4: 0xFFFFFFFF, PC: 0x00000000, }) + self.assertEqual(compute('ADC PC, R4, 0x00000000 ', { + cf: 1, R4: 0xFFFFFFFF, PC: 0x55555555, }), {cf: 1, R4: 0xFFFFFFFF, PC: 0x00000000, }) + self.assertEqual(compute('ADCS R4, R4, 0x80000000 ', {cf: 0, R4: 0x80000000, }), { + nf: 0, zf: 1, cf: 0, of: 1, R4: 0x00000000, }) + self.assertEqual(compute('ADCS R4, R4, 0xFF000000 ', {cf: 1, R4: 0x00FFFFFE, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xFFFFFFFF, }) + self.assertEqual(compute('ADCS PC, R4, 0x00000000 ', { + cf: 0, R4: 0x00000000, PC: 0x55555555, }), {cf: 0, R4: 0x00000000, PC: 0x00000000, }) + self.assertEqual(compute('ADCS PC, R4, 0xFF000000 ', { + cf: 1, R4: 0x01000000, PC: 0x55555555, }), {cf: 1, R4: 0x01000000, PC: 0x00000001, }) + + # §A8.8.2: ADC{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {,<shift>} + self.assertRaises( + ValueError, compute, 'ADC R4, R5 ') + self.assertEqual(compute('ADC R4, R4, R5 ', { + cf: 1, R4: 0xFFFFFFFF, R5: 0x00000000, }), {cf: 1, R4: 0x00000000, R5: 0x00000000, }) + self.assertEqual(compute('ADC R4, R4, R5 LSL 1 ', { + cf: 0, R4: 0x00000001, R5: 0x00000008, }), {cf: 0, R4: 0x00000011, R5: 0x00000008, }) + self.assertEqual(compute('ADC R4, R4, R5 LSR 2 ', { + cf: 1, R4: 0x00000000, R5: 0x80000041, }), {cf: 1, R4: 0x20000011, R5: 0x80000041, }) + self.assertEqual(compute('ADC R4, R4, R5 ASR 3 ', { + cf: 0, R4: 0x00000001, R5: 0x80000081, }), {cf: 0, R4: 0xF0000011, R5: 0x80000081, }) + self.assertEqual(compute('ADC R4, R4, R5 ROR 4 ', { + cf: 1, R4: 0xFFFFFFFF, R5: 0x0000010F, }), {cf: 1, R4: 0xF0000010, R5: 0x0000010F, }) + self.assertEqual(compute('ADC R4, R4, R5 RRX ', { + cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), {cf: 1, R4: 0x80000080, R5: 0x00000101, }) + self.assertEqual(compute('ADCS R4, R4, R5 ', {cf: 1, R4: 0xFFFFFFFF, R5: 0x00000000, }), { + nf: 0, zf: 1, cf: 0, of: 0, R4: 0x00000000, R5: 0x00000000, }) + self.assertEqual(compute('ADCS R4, R4, R5 LSL 1 ', {cf: 0, R4: 0x00000001, R5: 0x00000008, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000011, R5: 0x00000008, }) + self.assertEqual(compute('ADCS R4, R4, R5 LSR 2 ', {cf: 1, R4: 0x00000000, R5: 0x80000041, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x20000011, R5: 0x80000041, }) + self.assertEqual(compute('ADCS R4, R4, R5 ASR 3 ', {cf: 0, R4: 0x00000001, R5: 0x80000081, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xF0000011, R5: 0x80000081, }) + self.assertEqual(compute('ADCS R4, R4, R5 ROR 4 ', {cf: 1, R4: 0xFFFFFFFF, R5: 0x0000010F, }), { + nf: 1, zf: 0, cf: 0, of: 0, R4: 0xF0000010, R5: 0x0000010F, }) + self.assertEqual(compute('ADCS R4, R4, R5 RRX ', {cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), { + nf: 1, zf: 0, cf: 0, of: 0, R4: 0x80000080, R5: 0x00000101, }) + + # §A8.8.3: ADC{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <type> <Rs> + self.assertEqual(compute('ADC R4, R6, R4 LSL R5', { + cf: 0, R4: 0x00000001, R5: 0x00000004, R6: 0, }), {cf: 0, R4: 0x00000010, R5: 0x00000004, R6: 0, }) + self.assertEqual(compute('ADC R4, R6, R4 LSR R5', { + cf: 1, R4: 0x00000110, R5: 0x80000004, R6: 0, }), {cf: 1, R4: 0x00000012, R5: 0x80000004, R6: 0, }) + self.assertEqual(compute('ADC R4, R6, R4 ASR R5', { + cf: 0, R4: 0x80000010, R5: 0xF0000001, R6: 0, }), {cf: 0, R4: 0xC0000008, R5: 0xF0000001, R6: 0, }) + self.assertEqual(compute('ADC R4, R6, R4 ROR R5', { + cf: 1, R4: 0x000000FF, R5: 0x00000F04, R6: 0, }), {cf: 1, R4: 0xF0000010, R5: 0x00000F04, R6: 0, }) + self.assertEqual(compute('ADCS R4, R6, R4 LSL R5', {cf: 0, R4: 0x00000001, R5: 0x00000004, R6: 0, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000010, R5: 0x00000004, R6: 0, }) + self.assertEqual(compute('ADCS R4, R6, R4 LSR R5', {cf: 1, R4: 0x00000110, R5: 0x80000004, R6: 0, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000012, R5: 0x80000004, R6: 0, }) + self.assertEqual(compute('ADCS R4, R6, R4 ASR R5', {cf: 0, R4: 0x80000010, R5: 0xF0000001, R6: 0, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xC0000008, R5: 0xF0000001, R6: 0, }) + self.assertEqual(compute('ADCS R4, R6, R4 ROR R5', {cf: 1, R4: 0x000000FF, R5: 0x00000F04, R6: 0, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xF0000010, R5: 0x00000F04, R6: 0, }) + + def test_ADD(self): + # §A8.8.{5,9}: ADD{S}{<c>}{<q>} {<Rd>,} <Rn>, #<const> + self.assertRaises( + ValueError, compute, 'ADD R4, 0x00000001 ') + self.assertEqual(compute('ADD R4, R4, 0x00000001 ', { + R4: 0x00000000, }), {R4: 0x00000001, }) + self.assertEqual(compute('ADD R4, R4, 0x00000000 ', { + R4: 0x00000000, }), {R4: 0x00000000, }) + self.assertEqual(compute('ADD PC, R4, 0x00000001 ', { + R4: 0xFFFFFFFF, PC: 0x55555555, }), {R4: 0xFFFFFFFF, PC: 0x00000000, }) + self.assertEqual(compute('ADD PC, R4, 0x00000000 ', { + R4: 0xFFFFFFFF, PC: 0x55555555, }), {R4: 0xFFFFFFFF, PC: 0xFFFFFFFF, }) + self.assertEqual(compute('ADDS R4, R4, 0x80000000 ', {R4: 0x80000000, }), { + nf: 0, zf: 1, cf: 0, of: 1, R4: 0x00000000, }) + self.assertEqual(compute('ADDS R4, R4, 0xFF000000 ', {R4: 0x00FFFFFE, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xFFFFFFFE, }) + self.assertEqual(compute('ADDS PC, R4, 0x00000000 ', { + R4: 0x00000000, PC: 0x55555555, }), {R4: 0x00000000, PC: 0x00000000, }) + self.assertEqual(compute('ADDS PC, R4, 0xFF000000 ', { + R4: 0x01000000, PC: 0x55555555, }), {R4: 0x01000000, PC: 0x00000000, }) + # SP special part + self.assertEqual(compute('ADD R4, SP, 0x00000001 ', { + R4: 0x00000000, SP: 0x00000000, }), {R4: 0x00000001, SP: 0x00000000, }) + + # §A8.8.{7,11}: ADD{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {,<shift>} + self.assertRaises( + ValueError, compute, 'ADD R4, R5 ') + self.assertEqual(compute('ADD R4, R4, R5 ', { + R4: 0xFFFFFFFF, R5: 0x00000001, }), {R4: 0x00000000, R5: 0x00000001, }) + self.assertEqual(compute('ADD R4, R4, R5 LSL 1 ', { + R4: 0x00000001, R5: 0x00000008, }), {R4: 0x00000011, R5: 0x00000008, }) + self.assertEqual(compute('ADD R4, R4, R5 LSR 2 ', { + R4: 0x00000000, R5: 0x80000041, }), {R4: 0x20000010, R5: 0x80000041, }) + self.assertEqual(compute('ADD R4, R4, R5 ASR 3 ', { + R4: 0x00000001, R5: 0x80000081, }), {R4: 0xF0000011, R5: 0x80000081, }) + self.assertEqual(compute('ADD R4, R4, R5 ROR 4 ', { + R4: 0xFFFFFFFF, R5: 0x0000010F, }), {R4: 0xF000000F, R5: 0x0000010F, }) + self.assertEqual(compute('ADD R4, R4, R5 RRX ', { + cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), {cf: 1, R4: 0x8000007F, R5: 0x00000101, }) + self.assertEqual(compute('ADDS R4, R4, R5 ', {R4: 0xFFFFFFFF, R5: 0x00000001, }), { + nf: 0, zf: 1, cf: 0, of: 0, R4: 0x00000000, R5: 0x00000001, }) + self.assertEqual(compute('ADDS R4, R4, R5 LSL 1 ', {R4: 0x00000001, R5: 0x00000008, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000011, R5: 0x00000008, }) + self.assertEqual(compute('ADDS R4, R4, R5 LSR 2 ', {R4: 0x00000000, R5: 0x80000041, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x20000010, R5: 0x80000041, }) + self.assertEqual(compute('ADDS R4, R4, R5 ASR 3 ', {R4: 0x00000001, R5: 0x80000081, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xF0000011, R5: 0x80000081, }) + self.assertEqual(compute('ADDS R4, R4, R5 ROR 4 ', {R4: 0xFFFFFFFF, R5: 0x0000010F, }), { + nf: 1, zf: 0, cf: 0, of: 0, R4: 0xF000000F, R5: 0x0000010F, }) + self.assertEqual(compute('ADDS R4, R4, R5 RRX ', {cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), { + nf: 1, zf: 0, cf: 0, of: 0, R4: 0x8000007F, R5: 0x00000101, }) + # SP special part + self.assertEqual(compute('ADD R4, SP, R4 LSR 1 ', { + R4: 0x00000002, SP: 0x00000000, }), {R4: 0x00000001, SP: 0x00000000, }) + + # §A8.8.8: ADD{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <type> <Rs> + self.assertEqual(compute('ADD R4, R6, R4 LSL R5', { + R4: 0x00000001, R5: 0x00000004, R6: 0, }), {R4: 0x00000010, R5: 0x00000004, R6: 0, }) + self.assertEqual(compute('ADD R4, R6, R4 LSR R5', { + R4: 0x00000110, R5: 0x80000004, R6: 0, }), {R4: 0x00000011, R5: 0x80000004, R6: 0, }) + self.assertEqual(compute('ADD R4, R6, R4 ASR R5', { + R4: 0x80000010, R5: 0xF0000001, R6: 0, }), {R4: 0xC0000008, R5: 0xF0000001, R6: 0, }) + self.assertEqual(compute('ADD R4, R6, R4 ROR R5', { + R4: 0x000000FF, R5: 0x00000F04, R6: 0, }), {R4: 0xF000000F, R5: 0x00000F04, R6: 0, }) + self.assertEqual(compute('ADDS R4, R6, R4 LSL R5', {R4: 0x00000001, R5: 0x00000004, R6: 0, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000010, R5: 0x00000004, R6: 0, }) + self.assertEqual(compute('ADDS R4, R6, R4 LSR R5', {R4: 0x00000110, R5: 0x80000004, R6: 0, }), { + nf: 0, zf: 0, cf: 1, of: 0, R4: 0x00000011, R5: 0x80000004, R6: 0, }) + self.assertEqual(compute('ADDS R4, R6, R4 ASR R5', {R4: 0x80000010, R5: 0xF0000001, R6: 0, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xC0000008, R5: 0xF0000001, R6: 0, }) + self.assertEqual(compute('ADDS R4, R6, R4 ROR R5', {R4: 0x000000FF, R5: 0x00000F04, R6: 0, }), { + nf: 1, zf: 0, cf: 1, of: 0, R4: 0xF000000F, R5: 0x00000F04, R6: 0, }) + + def test_ADR(self): + # §A8.8.12: ADR{<c>}{<q>} <Rd>, <label> <==> ADD{<c>}{<q>} <Rd>, PC, #<const> + pass + + def test_AND(self): + # §A8.8.13: AND{S}{<c>}{<q>} {<Rd>,} <Rn>, #<const> + self.assertRaises( + ValueError, compute, 'AND R4, 0x00000001 ') + self.assertEqual(compute('AND R4, R4, 0x00000001 ', { + R4: 0xDEADBEEF, }), {R4: 0x00000001, }) + self.assertEqual(compute('AND R4, R4, 0x00000000 ', { + R4: 0x00000000, }), {R4: 0x00000000, }) + self.assertEqual(compute('AND PC, R4, 0x00000001 ', { + R4: 0xFFFFFFFF, PC: 0x55555555, }), {R4: 0xFFFFFFFF, PC: 0x00000001, }) + self.assertEqual(compute('AND PC, R4, 0x00000000 ', { + R4: 0xFFFFFFFF, PC: 0x55555555, }), {R4: 0xFFFFFFFF, PC: 0x00000000, }) + self.assertEqual(compute('ANDS R4, R4, 0x000000FF ', {R4: 0xFFFFFF00, }), { + nf: 0, zf: 1, cf: 0, R4: 0x00000000, }) + self.assertEqual(compute('ANDS R4, R4, 0xFF000000 ', {R4: 0xFF000000, }), { + nf: 1, zf: 0, cf: 0, R4: 0xFF000000, }) + self.assertEqual(compute('ANDS PC, R4, 0x000000FF ', { + R4: 0xFFFFFF00, PC: 0x55555555, }), {R4: 0xFFFFFF00, PC: 0x00000000, }) + self.assertEqual(compute('ANDS PC, R4, 0xFF000000 ', { + R4: 0xFF000000, PC: 0x55555555, }), {R4: 0xFF000000, PC: 0xFF000000, }) + + # §A8.8.14: AND{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {,<shift>} + self.assertRaises( + ValueError, compute, 'AND R4, R5 ') + self.assertEqual(compute('AND R4, R4, R5 ', { + R4: 0xFFFFFFFE, R5: 0x00000001, }), {R4: 0x00000000, R5: 0x00000001, }) + self.assertEqual(compute('AND R4, R4, R5 LSL 1 ', { + R4: 0x00000011, R5: 0x00000008, }), {R4: 0x00000010, R5: 0x00000008, }) + self.assertEqual(compute('AND R4, R4, R5 LSR 2 ', { + R4: 0xFFFFFFFF, R5: 0x80000041, }), {R4: 0x20000010, R5: 0x80000041, }) + self.assertEqual(compute('AND R4, R4, R5 ASR 3 ', { + R4: 0xF00000FF, R5: 0x80000081, }), {R4: 0xF0000010, R5: 0x80000081, }) + self.assertEqual(compute('AND R4, R4, R5 ROR 4 ', { + R4: 0xFFFFFFFF, R5: 0x000000FF, }), {R4: 0xF000000F, R5: 0x000000FF, }) + self.assertEqual(compute('AND R4, R4, R5 RRX ', { + cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), {cf: 1, R4: 0x80000080, R5: 0x00000101, }) + self.assertEqual(compute('ANDS R4, R4, R5 ', {R4: 0xFFFFFFFE, R5: 0x00000001, }), { + nf: 0, zf: 1, cf: 0, R4: 0x00000000, R5: 0x00000001, }) + self.assertEqual(compute('ANDS R4, R4, R5 LSL 1 ', {R4: 0x00000011, R5: 0x00000008, }), { + nf: 0, zf: 0, cf: 0, R4: 0x00000010, R5: 0x00000008, }) + self.assertEqual(compute('ANDS R4, R4, R5 LSR 2 ', {R4: 0xFFFFFFFF, R5: 0x80000041, }), { + nf: 0, zf: 0, cf: 0, R4: 0x20000010, R5: 0x80000041, }) + self.assertEqual(compute('ANDS R4, R4, R5 ASR 3 ', {R4: 0xF00000FF, R5: 0x80000081, }), { + nf: 1, zf: 0, cf: 0, R4: 0xF0000010, R5: 0x80000081, }) + self.assertEqual(compute('ANDS R4, R4, R5 ROR 4 ', {R4: 0xFFFFFFFF, R5: 0x000000FF, }), { + nf: 1, zf: 0, cf: 0, R4: 0xF000000F, R5: 0x000000FF, }) + self.assertEqual(compute('ANDS R4, R4, R5 RRX ', {cf: 1, R4: 0xFFFFFFFF, R5: 0x00000101, }), { + nf: 1, zf: 0, cf: 0, R4: 0x80000080, R5: 0x00000101, }) + + # §A8.8.15: AND{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <type> <Rs> + self.assertEqual(compute('AND R4, R6, R4 LSL R5', { + R4: 0x00000001, R5: 0x00000004, R6: -1, }), {R4: 0x00000010, R5: 0x00000004, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('AND R4, R6, R4 LSR R5', { + R4: 0x00000110, R5: 0x80000004, R6: -1, }), {R4: 0x00000011, R5: 0x80000004, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('AND R4, R6, R4 ASR R5', { + R4: 0x80000010, R5: 0xF0000001, R6: -1, }), {R4: 0xC0000008, R5: 0xF0000001, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('AND R4, R6, R4 ROR R5', { + R4: 0x000000FF, R5: 0x00000F04, R6: -1, }), {R4: 0xF000000F, R5: 0x00000F04, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('ANDS R4, R6, R4 LSL R5', {R4: 0x00000001, R5: 0x00000004, R6: -1, }), { + nf: 0, zf: 0, cf: 0, R4: 0x00000010, R5: 0x00000004, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('ANDS R4, R6, R4 LSR R5', {R4: 0x00000110, R5: 0x80000004, R6: -1, }), { + nf: 0, zf: 0, cf: 0, R4: 0x00000011, R5: 0x80000004, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('ANDS R4, R6, R4 ASR R5', {R4: 0x80000010, R5: 0xF0000001, R6: -1, }), { + nf: 1, zf: 0, cf: 0, R4: 0xC0000008, R5: 0xF0000001, R6: 0xFFFFFFFF, }) + self.assertEqual(compute('ANDS R4, R6, R4 ROR R5', {R4: 0x000000FF, R5: 0x00000F04, R6: -1, }), { + nf: 1, zf: 0, cf: 0, R4: 0xF000000F, R5: 0x00000F04, R6: 0xFFFFFFFF, }) + + def test_ASR(self): + # §A8.8.16: ASR{S}{<c>}{<q>} {<Rd>,} <Rm>, #<imm> <==> MOV{S}{<c>}{<q>} {<Rd>,} <Rm>, ASR #<n> + pass + + # §A8.8.17: ASR{S}{<c>}{<q>} {<Rd>,} <Rn>, <Rm> <==> MOV{S}{<c>}{<q>} {<Rd>,} <Rn>, ASR <Rm> + pass + + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestARMSemantic) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) diff --git a/test/arch/msp430/arch.py b/test/arch/msp430/arch.py new file mode 100644 index 00000000..f3e82955 --- /dev/null +++ b/test/arch/msp430/arch.py @@ -0,0 +1,110 @@ + +import os +import time +from miasm2.arch.msp430.arch import * + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + + +def h2i(s): + return s.replace(' ', '').decode('hex') + + +def u16swap(i): + return struct.unpack('<H', struct.pack('>H', i))[0] + + +reg_tests_msp = [ + ("4456 mov.w SP, R4", + "0441"), + ("4d4f mov.b R13, R15", + "4f4d"), + ("49fe mov.w @R13, R9", + "294d"), + ("4982 mov.w 0x10(R14), R13", + "1d4e1000"), + ("4972 mov.w R14, 0x0(SP)", + "814e0000"), + ("46de mov.w 0x2(R14), 0x2(R13)", + "9d4e02000200"), + ("469e mov.w @0x2400, R11", + "1b420024"), + ("4c14 mov.w 0x4A96, R15", + "3f40964a"), + ("47c0 mov.w 0x1, R8", + "1843"), + ("48fc mov.w 0x2, R10", + "2a43"), + ("44fe mov.w 0x4, R7", + "2742"), + ("4a28 mov.w 0xFFFF, R15", + "3f43"), + ("4416 mov.w R5, @0x15C", + "82455c01"), + + ("4a22 add.w R11, R15", + "0f5b"), + ("448e sub.w R15, SP", + "018f"), + ("4474 cmp.b @R15, R13", + "6d9f"), + ("46a8 bit.w 0x1, R13", + "1db3"), + ("440a bis.w 0x5A08, R5", + "35d0085a"), + ("4c1a xor.w R15, R10", + "0aef"), + ("4408 and.b 0xFF, R5", + "75f3"), + + + ("4cf0 push.w SR", + "0212"), + ("4d6e push.w 0x0", + "0312"), + ("45dc push.w 0x2(R11)", + "1b120200"), + ("49cc push.w R11", + "0b12"), + + ("443a call 0x4B66", + "b012664b"), + + ("4442 jmp 0xFFFA", + "fd3f"), + ("4422 jnz 0xFFF2", + "f923"), + + ("xxxx mov.b @R13+, 0x0(R14)", + "fe4d0000"), + + ("4a36 mov.w @SP+, PC", + "3041"), + + +] + +ts = time.time() + +for s, l in reg_tests_msp: + print "-" * 80 + s = s[8:] + b = h2i((l)) + print repr(b) + mn = mn_msp430.dis(b, None) + print [str(x) for x in mn.args] + print s + print mn + assert(str(mn) == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + l = mn_msp430.fromstring(s, None) + # print l + assert(str(l) == s) + a = mn_msp430.asm(l) + print [x for x in a] + print repr(b) + # print mn.args + assert(b in a) diff --git a/test/arch/msp430/sem.py b/test/arch/msp430/sem.py new file mode 100644 index 00000000..55da5d56 --- /dev/null +++ b/test/arch/msp430/sem.py @@ -0,0 +1,143 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest +import logging + +from miasm2.ir.symbexec import symbexec +from miasm2.arch.msp430.arch import mn_msp430 as mn, mode_msp430 as mode +from miasm2.arch.msp430.sem import ir_msp430 as ir +from miasm2.arch.msp430.regs import * +from miasm2.expression.expression import * + +logging.getLogger('cpuhelper').setLevel(logging.ERROR) +EXCLUDE_REGS = set([res]) + + +def M(addr): + return ExprMem(ExprInt_fromsize(16, addr), 16) + + +def compute(asm, inputstate={}, debug=False): + sympool = dict(regs_init) + sympool.update({k: ExprInt_from(k, v) for k, v in inputstate.iteritems()}) + symexec = symbexec(mn, sympool) + instr = mn.fromstring(asm, mode) + code = mn.asm(instr)[0] + instr = mn.dis(code, mode) + instr.offset = inputstate.get(PC, 0) + interm = ir() + interm.add_instr(instr) + symexec.emul_ir_blocs(interm, instr.offset) + if debug: + for k, v in symexec.symbols.items(): + if regs_init.get(k, None) != v: + print k, v + return {k: v.arg.arg for k, v in symexec.symbols.items() + if k not in EXCLUDE_REGS and regs_init.get(k, None) != v} + + +class TestMSP430Semantic(unittest.TestCase): + + def test_ADD_W(self): + # Testing status flags + self.assertEqual(compute('add.w 0x0000, R4', {R4: 0x0001, }), { + R4: 0x0001, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w 0x0000, R4', {R4: 0xFFFF, }), { + R4: 0xFFFF, nf: 1, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w 0x0000, R4', {R4: 0x0000, }), { + R4: 0x0000, nf: 0, zf: 1, cf: 0, of: 0}) + self.assertEqual(compute('add.w 0x0002, R4', {R4: 0xFFFF, }), { + R4: 0x0001, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('add.w 0x7FFF, R4', {R4: 0x7FFF, }), { + R4: 0xFFFE, nf: 1, zf: 0, cf: 0, of: 1}) + self.assertEqual(compute('add.w 0x8001, R4', {R4: 0x8001, }), { + R4: 0x0002, nf: 0, zf: 0, cf: 1, of: 1}) + # Testing addressing mode + self.assertEqual(compute('add.w R5, R4', {R4: 0x1F53, R5: 0x28C4, }), { + R4: 0x4817, R5: 0x28C4, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w @R5, R4', {R4: 0x1F53, R5: 0x28C4, M(0x28C4): 0, }), { + R4: 0x1F53, R5: 0x28C4, M(0x28C4): 0, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w @R5+, R4', {R4: 0x1F53, R5: 0x28C4, M(0x28C4): 0, }), { + R4: 0x1F53, R5: 0x28C6, M(0x28C4): 0, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w 1(R5), R4', {R4: 0x1F53, R5: 0x28C4, M(0x28C5): 0, }), { + R4: 0x1F53, R5: 0x28C4, M(0x28C5): 0, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w @0x0000, R4', {R4: 0x1F53, M(0): 0x28C4, }), { + R4: 0x4817, M(0): 0x28C4, nf: 0, zf: 0, cf: 0, of: 0}) + self.assertEqual(compute('add.w 0x0000, R4', {R4: 0x1F53, }), { + R4: 0x1F53, nf: 0, zf: 0, cf: 0, of: 0}) + + def test_AND_B(self): + # Testing status flags + self.assertEqual(compute('and.b 0x0001, R4', {R4: 0x0001, }), { + R4: 0x0001, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.b 0xFFFF, R4', {R4: 0xFFFF, }), { + R4: 0x00FF, nf: 1, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.b 0x0000, R4', {R4: 0x0000, }), { + R4: 0x0000, nf: 0, zf: 1, cf: 0, of: 0}) + # Testing addressing mode + self.assertEqual(compute('and.b R5, R4', {R4: 0x1F53, R5: 0x38C4, }), { + R4: 0x0040, R5: 0x38C4, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.b @R5, R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C4): 0, }), { + R4: 0x0000, R5: 0x38C4, M(0x38C4): 0, nf: 0, zf: 1, cf: 0, of: 0}) + self.assertEqual(compute('and.b @R5+, R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C4): 0, }), { + R4: 0x0000, R5: 0x38C5, M(0x38C4): 0, nf: 0, zf: 1, cf: 0, of: 0}) + self.assertEqual(compute('and.b 1(R5), R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C5): 1, }), { + R4: 0x0001, R5: 0x38C4, M(0x38C5): 1, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.b @0x0000, R4', {R4: 0x1F53, M(0): 0x38C4, }), { + R4: 0x0040, M(0): 0x38C4, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.b 0xFFFF, R4', {R4: 0x1F53, }), { + R4: 0x0053, nf: 0, zf: 0, cf: 1, of: 0}) + + def test_AND_W(self): + # Testing status flags + self.assertEqual(compute('and.w 0x0001, R4', {R4: 0x0001, }), { + R4: 0x0001, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.w 0xFFFF, R4', {R4: 0xFFFF, }), { + R4: 0xFFFF, nf: 1, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.w 0x0000, R4', {R4: 0x0000, }), { + R4: 0x0000, nf: 0, zf: 1, cf: 0, of: 0}) + # Testing addressing mode + self.assertEqual(compute('and.w R5, R4', {R4: 0x1F53, R5: 0x38C4, }), { + R4: 0x1840, R5: 0x38C4, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.w @R5, R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C4): 0, }), { + R4: 0x0000, R5: 0x38C4, M(0x38C4): 0, nf: 0, zf: 1, cf: 0, of: 0}) + self.assertEqual(compute('and.w @R5+, R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C4): 0, }), { + R4: 0x0000, R5: 0x38C6, M(0x38C4): 0, nf: 0, zf: 1, cf: 0, of: 0}) + self.assertEqual(compute('and.w 1(R5), R4', {R4: 0x1F53, R5: 0x38C4, M(0x38C5): 1, }), { + R4: 0x0001, R5: 0x38C4, M(0x38C5): 1, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.w @0x0000, R4', {R4: 0x1F53, M(0): 0x38C4, }), { + R4: 0x1840, M(0): 0x38C4, nf: 0, zf: 0, cf: 1, of: 0}) + self.assertEqual(compute('and.w 0xFFFF, R4', {R4: 0x1F53, }), { + R4: 0x1F53, nf: 0, zf: 0, cf: 1, of: 0}) + + def test_BIC_B(self): + # Testing addressing mode + self.assertEqual( + compute('bic.b 0x0000, R4', {R4: 0x1F53, }), {R4: 0x0053, }) + # self.assertEqual(compute('bic.b 0x0000, @R4', {R4:0x1F53,M(0x1F53):0x569D, }), {R4:0x1F53,M(0x1F53):0x38C4, }) + # self.assertEqual(compute('bic.b 0x38C4, @R4+', {R4:0x1F53,M(0x1F53):0x569D, }), {R4:0x1F55,M(0x1F53):0x38C4, }) + # self.assertEqual(compute('bic.b 0x38C4, 1(R4)', {R4:0x1F53,M(0x1F54):0x569D, }), {R4:0x1F53,M(0x1F54):0x5619, }) + # self.assertEqual(compute('bic.b 0x0000, @0x0000', { M(0x0000):0x569D, }), { M(0x0000):0x38C4, }) + # self.assertEqual(compute('bic.b 0x38C4, 0xFFFE', { + # }), { }) + + def test_CALL(self): + # Testing addressing mode + self.assertEqual(compute('call R4', {PC: 0x0100, SP: 0x0400, R4: 0x1F53, }), { + PC: 0x1F53, SP: 0x03FE, R4: 0x1F53, M(0x03FE): 0x102, }) + self.assertEqual(compute('call @R4', {PC: 0x0100, SP: 0x0400, R4: 0x1F53, M(0x1F53): 0x38C4, }), { + PC: 0x38C4, SP: 0x03FE, R4: 0x1F53, M(0x1F53): 0x38C4, M(0x03FE): 0x102, }) + self.assertEqual(compute('call @R4+', {PC: 0x0100, SP: 0x0400, R4: 0x1F53, M(0x1F53): 0x38C4, }), { + PC: 0x38C4, SP: 0x03FE, R4: 0x1F55, M(0x1F53): 0x38C4, M(0x03FE): 0x102, }) + self.assertEqual(compute('call 1(R4)', {PC: 0x0100, SP: 0x0400, R4: 0x1F53, M(0x1F54): 0x38C4, }), { + PC: 0x38C4, SP: 0x03FE, R4: 0x1F53, M(0x1F54): 0x38C4, M(0x03FE): 0x104, }) + self.assertEqual(compute('call @0x0000', {PC: 0x0100, SP: 0x0400, M(0x0000): 0x38C4, }), { + PC: 0x38C4, SP: 0x03FE, M(0x0000): 0x38C4, M(0x03FE): 0x104, }) + self.assertEqual(compute('call 0xFFFE', {PC: 0x0100, SP: 0x0400, }), { + PC: 0xFFFE, SP: 0x03FE, M(0x03FE): 0x104, }) + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestMSP430Semantic) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) diff --git a/test/arch/sh4/arch.py b/test/arch/sh4/arch.py new file mode 100644 index 00000000..b7e79d30 --- /dev/null +++ b/test/arch/sh4/arch.py @@ -0,0 +1,436 @@ +import os +import time +from sys import stderr +from miasm2.arch.sh4.arch import * + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) + + +def h2i(s): + return s.replace(' ', '').decode('hex') + +reg_tests_sh4 = [ + # vxworks + ("c80022f2 MOV 0x10, R6", + "10e6"), + ("c8002250 MOV 0xFFFFFFFF, R0", + "ffe0"), + ("c800226a MOV.W @(PC,0xC0), R9", + "5e99"), + ("c8002006 MOV.L @(PC&0xFFFFFFFC,0x10), R15", + "03df"), + ("c800cfc4 MOV R4, R9", + "4369"), + ("C8005004 MOV.B R1, @R2", + "1022"), + ("C8002E04 MOV.W R0, @R8", + '0128'), + ("c800223e MOV.L R1, @R14", + "122E"), + + ("c8002002 MOV.L @R1, R0", + "1260"), + ("c8002E08 MOV.W @R8, R1", + "8161"), + ("c800357c MOV.B @R4, R1", + "4061"), + + ("c8002220 MOV.L R8, @-R15", + "862f"), + ("c8022a66 MOV.B R4, @-R0", + "4420"), + ("c8002310 MOV.L @R15+, R14", + "f66e"), + ("c80038a4 MOV.W @R8+, R5", + "8565"), + ("xxxxxxxx MOV.B R0, @(R8,0x2)", + "8280"), + ("xxxxxxxx MOV.W R0, @(R8,0x4)", + "8281"), + ("c8002274 MOV.L R0, @(R9,0x8)", + "0219"), + ("xxxxxxxx MOV.B @(R8,0x8), R0", + "8884"), + ("xxxxxxxx MOV.W @(R8,0x10), R0", + "8885"), + ("c8002500 MOV.L @(R14,0x4), R5", + "e155"), + ("xxxxxxxx MOV.B R4, @(R0,R8)", + "4408"), + ("xxxxxxxx MOV.W R4, @(R0,R8)", + "4508"), + ("xxxxxxxx MOV.L R4, @(R0,R8)", + "4608"), + ("xxxxxxxx MOV.B @(R0,R4), R8", + "4c08"), + ("xxxxxxxx MOV.W @(R0,R4), R8", + "4d08"), + ("xxxxxxxx MOV.L @(R0,R4), R8", + "4e08"), + ("xxxxxxxx MOV.B R0, @(GBR,0x4)", + "04c0"), + ("xxxxxxxx MOV.W R0, @(GBR,0x8)", + "04c1"), + ("xxxxxxxx MOV.L R0, @(GBR,0x10)", + "04c2"), + ("xxxxxxxx MOV.B @(GBR,0x4), R0", + "04c4"), + ("xxxxxxxx MOV.W @(GBR,0x8), R0", + "04c5"), + ("xxxxxxxx MOV.L @(GBR,0x10), R0", + "04c6"), + #("xxxxxxxx MOV PC&0xFFFFFFFC+0x14, R0", + # "04c7"), + ("xxxxxxxx SWAPB R2, R1", + "2861"), + ("c803f492 SWAPW R4, R9", + "4969"), + ("xxxxxxxx XTRCT R4, R9", + "4d29"), + ("c8002270 ADD R12, R9", + "cc39"), + ("c8002238 ADD 0xFFFFFFFC, R15", + "FC7F"), + ("c80164cc ADDC R0, R1", + "0e31"), + ("xxxxxxxx ADDV R0, R1", + "0f31"), + ("c8002994 CMPEQ 0x20, R0", + "2088"), + ("c80029d2 CMPEQ R2, R1", + "2031"), + ("c8003964 CMPHS R5, R3", + "5233"), + ("c8002df2 CMPGE R0, R1", + "0331"), + ("c80029a4 CMPHI R1, R0", + "1630"), + ("c8002bfe CMPGT R10, R8", + "a738"), + ("c8002bf8 CMPPZ R0", + "1140"), + ("c8006294 CMPPL R2", + "1542"), + ("c8033800 CMPSTR R14, R4", + "ec24"), + ("xxxxxxxx DIV1 R14, R4", + "e434"), + ("c8d960de DIV0S R0, R3", + "0723"), + ("xxxxxxxx DIV0U ", + "1900"), + ("c800dcd8 DMULS R1, R0", + "1d30"), + ("c80164da DMULU R3, R8", + "3538"), + ("c80024e2 DT R10", + "104a"), + ("c800343a EXTSB R1, R1", + "1e61"), + ("c8002bf6 EXTSW R0, R0", + "0f60"), + ("c8002fba EXTUB R0, R0", + "0c60"), + ("c8002398 EXTUW R0, R0", + "0d60"), + ("xxxxxxxx MAC.L @R5+, @R4+", + "5f04"), + ("xxxxxxxx MAC.W @R5+, @R4+", + "5f44"), + ("c8005112 MULL R1, R3", + "1703"), + ("xxxxxxxx MULSW R1, R3", + "1F23"), + ("xxxxxxxx MULUW R1, R3", + "1e23"), + ("c8004856 NEG R1, R8", + "1b68"), + ("c80054fc NEGC R9, R7", + "9a67"), + ("c8004b36 SUB R1, R5", + "1835"), + ("c800a536 SUBC R1, R0", + "1a30"), + ("xxxxxxxx SUBV R1, R0", + "1b30"), + ("c80023ca AND R0, R5", + "0925"), + ("c800257c AND 0x2, R0", + "02c9"), + ("xxxxxxxx AND.B 0x2, @(GBR,R0)", + "02cd"), + ("c80065fe NOT R5, R1", + "5761"), + ("c8002586 OR R10, R1", + "ab21"), + ("c80023aa OR 0x4, R0", + "04cb"), + ("xxxxxxxx OR.B 0x4, @(GBR,R0)", + "04cf"), + ("xxxxxxxx TAS.B @R8", + "1b48"), + ("c8002368 TST R10, R13", + "a82d"), + ("c8003430 TST 0x11, R0", + "11c8"), + ("xxxxxxxx TST.B 0x4, @(GBR,R0)", + "04cc"), + ("c8003978 XOR R1, R6", + "1a26"), + ("c8028270 XOR 0x1, R0", + "01ca"), + ("xxxxxxxx XOR.B 0x4, @(GBR,R0)", + "04cE"), + ("xxxxxxxx ROTL R9", + "0449"), + ("xxxxxxxx ROTR R9", + "0549"), + ("xxxxxxxx ROTCL R9", + "2449"), + ("xxxxxxxx ROTCR R9", + "2549"), + ("xxxxxxxx SHAL R11", + "204b"), + ("xxxxxxxx SHAR R11", + "214b"), + ("c800236c SHLD R6, R10", + "6d4a"), + ("xxxxxxxx SHLL R11", + "004b"), + ("xxxxxxxx SHLR R11", + "014b"), + ("xxxxxxxx SHLL2 R11", + "084b"), + ("xxxxxxxx SHLR2 R11", + "094b"), + ("xxxxxxxx SHLL8 R11", + "184b"), + ("xxxxxxxx SHLR8 R11", + "194b"), + ("xxxxxxxx SHLL16 R11", + "284b"), + ("xxxxxxxx SHLR16 R11", + "294b"), + ("c8002c00 BF 0xFFFFFFF4", + "f48b"), + ("c80023c2 BFS 0xFFFFFFD8", + "d88f"), + ("c8002266 BT 0x5B", + "5b89"), + ("c8002266 BTS 0x5C", + "5c8d"), + ("c8002326 BRA 0xFFFFFFF0", + "f0af"), + ("c8004b4a BRAF R1", + "2301"), + ("c8055da4 BSR 0xFFFFFE48", + "48be"), + ("xxxxxxxx BSRF R1", + "0301"), + ("c80027b4 JMP.L @R1", + "2b41"), + ("c800200c JSR.L @R0", + "0b40"), + ("c800231a RTS ", + "0b00"), + ("xxxxxxxx CLRMAC ", + "2800"), + ("xxxxxxxx CLRS ", + "4800"), + ("xxxxxxxx CLRT ", + "0800"), + ("c8002004 LDC R0, SR", + "0e40"), + ("c800200e LDC R1, GBR", + "1e41"), + ("c8064bd4 LDC R8, VBR", + "2e48"), + ("xxxxxxxx LDC R8, SSR", + "3e48"), + ("xxxxxxxx LDC R8, SPC", + "4e48"), + ("xxxxxxxx LDC R8, DBR", + "fa48"), + ("xxxxxxxx LDC R8, R0_BANK", + "8e48"), + ("xxxxxxxx LDC.L @R8+, SR", + "0748"), + ("xxxxxxxx LDC.L @R8+, GBR", + "1748"), + ("xxxxxxxx LDC.L @R8+, VBR", + "2748"), + ("xxxxxxxx LDC.L @R8+, SSR", + "3748"), + ("xxxxxxxx LDC.L @R8+, SPC", + "4748"), + ("xxxxxxxx LDC.L @R8+, DBR", + "f648"), + ("xxxxxxxx LDC.L @R8+, R2_BANK", + "a748"), + ("xxxxxxxx LDS R8, MACH", + "0a48"), + ("xxxxxxxx LDS R8, MACL", + "1a48"), + ("xxxxxxxx LDS R8, PR", + "2a48"), + ("xxxxxxxx LDS.L @R8+, MACH", + "0648"), + ("xxxxxxxx LDS.L @R8+, MACL", + "1648"), + ("xxxxxxxx LDTLB ", + "3800"), + ("xxxxxxxx MOVCA.L R0, @R8", + "c308"), + ("xxxxxxxx NOP ", + "0900"), + ("xxxxxxxx OCBI.L @R8", + "9308"), + ("xxxxxxxx OCBP.L @R8", + "a308"), + ("xxxxxxxx OCBWB.L @R8", + "b308"), + ("xxxxxxxx PREF.L @R8", + "8308"), + ("xxxxxxxx STS MACH, R8", + "0a08"), + ("xxxxxxxx STS MACL, R8", + "1a08"), + ("xxxxxxxx STS PR, R8", + "2a08"), + ("xxxxxxxx STS.L MACH, @-R8", + "0248"), + ("xxxxxxxx STS.L MACL, @-R8", + "1248"), + ("xxxxxxxx STS.L PR, @-R8", + "2248"), + + + + + + ("c8004b50 STC GBR, R0", + "1200"), + ("c8064516 STC VBR, R1", + "2201"), + ("c8004b54 STC SSR, R1", + "3201"), + ("c801ed6c STC SPC, R0", + "4200"), + ("xxxxxxxx STC SGR, R0", + "3a00"), + ("xxxxxxxx STC DBR, R0", + "fa00"), + ("c8004b56 STC R3_BANK, R1", + "B201"), + ("xxxxxxxx STC.L SR, @-R8", + "0348"), + ("xxxxxxxx STC.L GBR, @-R8", + "1348"), + ("xxxxxxxx STC.L VBR, @-R8", + "2348"), + ("xxxxxxxx STC.L SSR, @-R8", + "3348"), + ("xxxxxxxx STC.L SPC, @-R8", + "4348"), + ("xxxxxxxx STC.L DBR, @-R8", + "f248"), + ("xxxxxxxx STC.L R7_BANK, @-R8", + "f348"), + ("c803b130 TRAPA 0xE0", + "e0c3"), + + ("xxxxxxxx FLDI0 FR8", + "8df8"), + ("xxxxxxxx FLDI1 FR8", + "9df8"), + ("c8019ca8 FMOV FR15, FR5", + "fcf5"), + ("c800affe FMOV.S @R1, FR4", + "18f4"), + ("c80283f6 FMOV.S @(R0,R14), FR5", + "e6f5"), + ("c800aff8 FMOV.S @R1+, FR5", + "19f5"), + ("c80cb692 FMOV.S FR0, @R2", + "0af2"), + ("c80cb694 FMOV.S FR1, @-R2", + "1bf2"), + ("c80283aa FMOV.S FR1, @(R0,R14)", + "17fe"), + ("c800ce16 FLDS FR13, FPUL", + "1dfd"), + ("c800ce08 FSTS FPUL, FR13", + "0dfd"), + ("xxxxxxxx FABS FR8", + "5df8"), + ("c800cf28 FADD FR2, FR6", + "20f6"), + ("c805dacc FCMPEQ FR2, FR6", + "24f6"), + ("c8028406 FCMPGT FR4, FR2", + "45f2"), + ("c8019ca4 FDIV FR2, FR12", + "23fc"), + ("c800ce5e FLOAT FPUL, FR2", + "2df2"), + ("xxxxxxxx FMAC FR0, FR1, FR2", + "1ef2"), + ("c800b006 FMUL FR2, FR4", + "22f4"), + ("c805e412 FNEG FR14", + "4dfe"), + ("xxxxxxxx FSQRT FR14", + "6dfe"), + ("c8030400 FSUB FR4, FR2", + "41f2"), + ("c80303ba FTRC FR2, FPUL", + "3df2"), + +] + +for s, l in reg_tests_sh4: + print "-" * 80 + s = s[12:] + b = h2i((l)) + print b.encode('hex') + mn = mn_sh4.dis(b, None) + print [str(x) for x in mn.args] + print s + print mn + assert(str(mn) == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + l = mn_sh4.fromstring(s, None) + # print l + assert(str(l) == s) + a = mn_sh4.asm(l) + print [x for x in a] + print repr(b) + # print mn.args + assert(b in a) + + +# speed test +o = "" +for s, l, in reg_tests_sh4: + s = s[12:] + b = h2i((l)) + o += b + +while len(o) < 1000: + o += o +bs = bin_stream_str(o) +off = 0 +instr_num = 0 +ts = time.time() +while off < bs.getlen(): + mn = mn_sh4.dis(bs, None, off) + print instr_num, off, mn.l, str(mn) + instr_num += 1 + off += mn.l +print 'instr per sec:', instr_num / (time.time() - ts) + +import cProfile +cProfile.run(r'mn_sh4.dis("\x17\xfe", None)') diff --git a/test/arch/x86/arch.py b/test/arch/x86/arch.py new file mode 100644 index 00000000..98545b4f --- /dev/null +++ b/test/arch/x86/arch.py @@ -0,0 +1,1779 @@ +import os +import time +from miasm2.arch.x86.arch import * + +filename = os.environ.get('PYTHONSTARTUP') +if filename and os.path.isfile(filename): + execfile(filename) +for s in ["[EAX]", + "[0x10]", + "[EBX + 0x10]", + "[EBX + ECX*0x10]", + "[EBX + ECX*0x10 + 0x1337]"]: + (e, a, b) = deref_mem_ad.scanString(s).next() + print 'expr', e[0] + +print '---' + +mylabel16 = ExprId('mylabel16', 16) +mylabel32 = ExprId('mylabel32', 32) +mylabel64 = ExprId('mylabel64', 64) + +reg_and_id = dict(mn_x86.regs.all_regs_ids_byname) +reg_and_id.update({'mylabel16': mylabel16, + 'mylabel32': mylabel32, + 'mylabel64': mylabel64, + }) + + +def my_ast_id2expr(t): + r = reg_and_id.get(t, ExprId(t, size=32)) + return r + +my_var_parser = parse_ast(my_ast_id2expr, ast_int2expr) +base_expr.setParseAction(my_var_parser) + +for s in ['EAX', + "BYTE PTR [EAX]", + "WORD PTR [EAX]", + "DWORD PTR [ECX+0x1337]", + "QWORD PTR [RAX+4*RCX + 0x1337]", + "DWORD PTR [EAX+EBX]", + "QWORD PTR [RAX+RBX+0x55667788]", + "BYTE PTR CS:[EAX]", + "QWORD PTR [RAX+RBX+mylabel64]", + "BYTE PTR [RAX+RBX+mylabel64]", + "BYTE PTR [AX+BX+mylabel16]", + "BYTE PTR [mylabel32]", + ]: + print '*' * 80 + print s + (e, a, b) = rmarg.scanString(s).next() + print 'expr', e[0] + e[0].visit(print_size) + + +def h2i(s): + return int(s.replace(' ', '').decode('hex')[::].encode('hex'), 16) + + +m16 = 16 # (16, 16) +m32 = 32 # (32, 32) +m64 = 64 # (64, 64) +reg_tests = [ + + (m32, "00000000 AAA", + "37"), + (m32, "00000000 AAS", + "3F"), + (m32, "00000000 AAD 0x11", + "d511"), + (m32, "00000000 AAM 0x11", + "d411"), + (m32, "00000000 ADC AL, 0x11", + "1411"), + (m32, "00000000 ADC EAX, 0x11223344", + "1544332211"), + (m16, "00000000 ADC AX, 0x1122", + "152211"), + (m64, "00000000 ADC EAX, 0x11223344", + "1544332211"), + (m64, "00000000 ADC RAX, 0x11223344", + "481544332211"), + (m32, "00000000 ADC EAX, 0xFFFFFFFC", + "83d0fc"), + (m64, "00000000 ADC RAX, 0xFFFFFFFFFFFFFFFC", + "4883d0fc"), + (m16, "00000000 ADC AX, 0xFFFC", + "83d0fc"), + (m64, "00000000 ADC EAX, 0xFFFFFFFC", + "15fcffffff"), + (m64, "00000000 ADC RAX, 0xFFFFFFFFFFFFFFFC", + "4815fcffffff"), + (m16, "00000000 ADC WORD PTR [BX+SI], 0x1122", + "81102211"), + (m32, "00000000 ADC DWORD PTR [EAX], 0x11223344", + "811044332211"), + (m32, "00000000 ADC DWORD PTR [EAX+EBX+0xFFFFFFFE], 0x11223344", + "815418fe44332211"), + (m32, "00000000 ADC DWORD PTR [EAX+EBX+0x55667788], 0x11223344", + "8194188877665544332211"), + (m64, "00000000 ADC DWORD PTR [RAX], 0x11223344", + "811044332211"), + (m64, "00000000 ADC QWORD PTR [RAX], 0x11223344", + "48811044332211"), + (m64, "00000000 ADC QWORD PTR [RAX+RBX], 0x11223344", + "4881141844332211"), + (m64, "00000000 ADC QWORD PTR [RAX+RBX+0x55667788], 0x11223344", + "488194188877665544332211"), + (m64, "00000000 ADC QWORD PTR [RAX+RBX+0xFFFFFFFFFFFFFFFE], 0x11223344", + "48815403fe44332211"), + (m64, "00000000 ADC QWORD PTR [EAX], 0x11223344", + "6748811044332211"), + (m32, "00000000 ADC BYTE PTR [EAX], 0x11", + "801011"), + (m16, "00000000 ADC DX, 0x1122", + "81d22211"), + (m32, "00000000 ADC EDX, 0x11223344", + "81d244332211"), + (m64, "00000000 ADC RDX, 0x11223344", + "4881d244332211"), + (m32, "00000000 ADC DWORD PTR [EAX+EBX], 0x11223344", + "81141844332211"), + (m32, "00000000 ADC DWORD PTR [EAX+EBX], EAX", + "110418"), + (m64, "00000000 ADC QWORD PTR [RAX+RBX], RAX", + "48110418"), + (m32, "00000000 ADC BYTE PTR [EAX+EBX], AL", + "100418"), + (m32, "00000000 ADC AL, BYTE PTR [EAX+EBX]", + "120418"), + (m16, "00000000 ADC WORD PTR [BX+SI], DX", + "1110"), + (m32, "00000000 ADC WORD PTR [BX+SI], DX", + "66671110"), + (m16, "00000000 ADC DWORD PTR [EBX+ESI], EDX", + "6667111433"), + + # prefix test + (m32, "00000000 ADC AX, 0x1122", + "66152211"), + + (m32, "00000000 ADC EAX, 0x11223344", + "1544332211"), + + (m16, "00000000 ADC WORD PTR [BX+DI], 0x1", + "831101"), + (m32, "00000000 ADC DWORD PTR [EAX+EBX+0xFFFFFFFE], 0x1", + "835403fe01"), + (m32, "00000000 ADC WORD PTR [EAX+EBX+0xFFFFFFFE], 0x1", + "66835403fe01"), + (m64, "00000000 ADC DWORD PTR [RAX+RBX+0xFFFFFFFFFFFFFFFE], 0x1", + "835403fe01"), + # + (m32, "00000000 ADC DWORD PTR [EAX+EBX*0x4+0xFFFFFFFE], 0x1", + "835498fe01"), + + (m64, "00000000 ADC QWORD PTR [RAX+RBX], R8", + "4c110418"), + (m64, "00000000 ADC QWORD PTR [RAX+RBX], R15", + "4c113c18"), + + (m64, "00000000 ADC QWORD PTR [R8], RAX", + "491100"), + (m64, "00000000 ADC QWORD PTR [R8+R9], RAX", + "4b110408"), + (m64, "00000000 ADC QWORD PTR [R8+RBP], RAX", + "49110428"), + (m64, "00000000 ADC QWORD PTR [RBP+R8*0x4], RAX", + "4a11448500"), + (m64, "00000000 ADC QWORD PTR [RBP+R12*0x4], RAX", + "4a1144a500"), + (m64, "00000000 ADC QWORD PTR [RSP+R12*0x4], RAX", + "4a1104a4"), + (m64, "00000000 ADC QWORD PTR [R12*0x5], RAX", + "4b1104a4"), + (m64, "00000000 ADC QWORD PTR [R12*0x5+0x11], RAX", + "4b1144a411"), + (m64, "00000000 ADC QWORD PTR [RBP+R12*0x4+0x10], RAX", + "4a1144a510"), + + (m32, "00000000 ADD AL, 0x11", + "0411"), + (m32, "00000000 ADD EAX, 0x11223344", + "0544332211"), + + + (m32, "00000000 AND AL, 0x11", + "2411"), + (m32, "00000000 AND EAX, 0x11223344", + "2544332211"), + (m64, "00000000 AND CX, R14W", + "664123CE"), + (m64, "00000000 AND R12W, R14W", + "664521f4"), + + + + (m32, "00000000 BSF EAX, DWORD PTR [EAX]", + "0fbc00"), + + (m32, "00000000 BSR EAX, DWORD PTR [EAX]", + "0fbd00"), + + (m32, "00000000 BSWAP EAX", + "0fc8"), + + (m32, "00000000 BT DWORD PTR [EAX], EAX", + "0fa300"), + (m32, "00000000 BT DWORD PTR [EAX], 0x11", + "0fba2011"), + (m32, "00000000 BT DWORD PTR [EAX], 0xFF", + "0fba20ff"), + (m64, "00000000 BT R9D, 0x1E", + "410fbae11e"), + + (m32, "00000000 BTC DWORD PTR [EAX], EAX", + "0fbb00"), + (m32, "00000000 BTC DWORD PTR [EAX], 0x42", + "0fba3842"), + + + (m32, "00000000 BTR DWORD PTR [EAX], EAX", + "0fb300"), + (m32, "00000000 BTR DWORD PTR [EAX], 0x42", + "0fba3042"), + + + (m32, "00000000 BTS DWORD PTR [EAX], EAX", + "0fab00"), + (m32, "00000000 BTS DWORD PTR [EAX], 0x42", + "0fba2842"), + + + (m32, "00000000 CALL 0x112233", + "e833221100"), + (m64, "00000000 CALL 0x112233", + "e833221100"), + (m32, "00000000 CALL DWORD PTR [EAX]", + "ff10"), + (m64, "00000000 CALL QWORD PTR [RAX]", + "ff10"), + + (m32, "00000000 CALL 0x6655:0x44332211", + "9a112233445566"), + (m32, "00000000 CALL 0x6655:0xFF332211", + "9a112233FF5566"), + + + (m16, "00000000 CBW", + "98"), + (m16, "00000000 CWDE", + "6698"), + (m32, "00000000 CWDE", + "98"), + (m64, "00000000 CWDE", + "98"), + (m64, "00000000 CDQE", + "4898"), + + (m32, "00000000 CMOVO EAX, DWORD PTR [EAX]", + "0f4000"), + (m32, "00000000 CMOVNO EAX, DWORD PTR [EAX]", + "0f4100"), + (m32, "00000000 CMOVB EAX, DWORD PTR [EAX]", + "0f4200"), + (m32, "00000000 CMOVAE EAX, DWORD PTR [EAX]", + "0f4300"), + (m32, "00000000 CMOVZ EAX, DWORD PTR [EAX]", + "0f4400"), + (m32, "00000000 CMOVNZ EAX, DWORD PTR [EAX]", + "0f4500"), + (m32, "00000000 CMOVBE EAX, DWORD PTR [EAX]", + "0f4600"), + (m32, "00000000 CMOVA EAX, DWORD PTR [EAX]", + "0f4700"), + (m32, "00000000 CMOVS EAX, DWORD PTR [EAX]", + "0f4800"), + (m32, "00000000 CMOVNS EAX, DWORD PTR [EAX]", + "0f4900"), + (m32, "00000000 CMOVPE EAX, DWORD PTR [EAX]", + "0f4A00"), + (m32, "00000000 CMOVNP EAX, DWORD PTR [EAX]", + "0f4B00"), + (m32, "00000000 CMOVL EAX, DWORD PTR [EAX]", + "0f4C00"), + (m32, "00000000 CMOVGE EAX, DWORD PTR [EAX]", + "0f4D00"), + (m32, "00000000 CMOVLE EAX, DWORD PTR [EAX]", + "0f4E00"), + (m32, "00000000 CMOVG EAX, DWORD PTR [EAX]", + "0f4F00"), + + (m32, "00000000 CMP EAX, DWORD PTR [EAX]", + "3b00"), + + (m32, "00000000 CMPXCHG BYTE PTR [EAX], AL", + "0fb000"), + (m32, "00000000 CMPXCHG DWORD PTR [EAX], EAX", + "0fb100"), + + (m32, "00000000 CDQ", + "99"), + (m64, "00000000 CQO", + "4899"), + + (m32, "00000000 DEC BYTE PTR [EAX]", + "fe08"), + (m32, "00000000 DEC DWORD PTR [EAX]", + "ff08"), + + (m32, "00000000 DEC ECX", + "49"), + + (m32, "00000000 DIV BL", + "f6f3"), + (m32, "00000000 DIV EBX", + "f7f3"), + + (m32, "00000000 ENTER 0x12, 0x0", + "c8120000"), + (m32, "00000000 ENTER 0x12, 0x66", + "c8120066"), + + (m32, "00000000 F2XM1", + "D9f0"), + (m32, "00000000 FABS", + "D9e1"), + + (m16, "00000000 FADD DWORD PTR [BX+SI]", + "D800"), + (m32, "00000000 FADD DWORD PTR [EAX]", + "D800"), + (m32, "00000000 FADD QWORD PTR [EAX]", + "DC00"), + + (m32, "00000000 FADD ST, ST(2)", + "D8C2"), + (m32, "00000000 FADD ST(2), ST", + "DCC2"), + + (m32, "00000000 FADDP ST(2), ST", + "DEC2"), + + (m16, "00000000 FIADD DWORD PTR [BX+SI]", + "DA00"), + (m32, "00000000 FIADD DWORD PTR [EAX]", + "DA00"), + (m32, "00000000 FIADD WORD PTR [EAX]", + "DE00"), + + (m32, "00000000 FBLD TBYTE PTR [EAX]", + "DF20"), + (m64, "00000000 FBLD TBYTE PTR [RAX]", + "DF20"), + + (m32, "00000000 FBLDP TBYTE PTR [EAX]", + "DF30"), + (m64, "00000000 FBLDP TBYTE PTR [RAX]", + "DF30"), + + (m16, "00000000 FCHS", + "d9e0"), + (m32, "00000000 FCHS", + "d9e0"), + (m64, "00000000 FCHS", + "d9e0"), + + + #(m32, "00000000 FCLEX", + # "9bdbe2"), + (m32, "00000000 FNCLEX", + "dbe2"), + + (m32, "00000000 FCMOVB ST, ST(2)", + "dac2"), + + (m32, "00000000 FCOM DWORD PTR [EAX]", + "d810"), + (m32, "00000000 FCOM QWORD PTR [EAX]", + "dC10"), + (m32, "00000000 FCOMP DWORD PTR [EAX]", + "d818"), + (m32, "00000000 FCOMP QWORD PTR [EAX]", + "dC18"), + (m32, "00000000 FCOMPP", + "ded9"), + + (m32, "00000000 FCOMI ST, ST(2)", + "dbf2"), + (m32, "00000000 FCOMIP ST, ST(2)", + "dff2"), + + (m32, "00000000 FUCOMI ST, ST(2)", + "dbea"), + (m32, "00000000 FUCOMIP ST, ST(2)", + "dfea"), + + (m32, "00000000 FCOS", + "d9ff"), + + (m32, "00000000 FDECSTP", + "d9f6"), + + + (m16, "00000000 FDIV DWORD PTR [BX+SI]", + "D830"), + (m32, "00000000 FDIV DWORD PTR [EAX]", + "D830"), + (m32, "00000000 FDIV QWORD PTR [EAX]", + "DC30"), + + (m32, "00000000 FDIV ST, ST(2)", + "D8F2"), + (m32, "00000000 FDIV ST(2), ST", + "DCFA"), + + (m32, "00000000 FDIVP ST(2), ST", + "DEFA"), + + (m16, "00000000 FIDIV DWORD PTR [BX+SI]", + "DA30"), + (m32, "00000000 FIDIV DWORD PTR [EAX]", + "DA30"), + (m32, "00000000 FIDIV WORD PTR [EAX]", + "DE30"), + + + + (m16, "00000000 FDIVR DWORD PTR [BX+SI]", + "D838"), + (m32, "00000000 FDIVR DWORD PTR [EAX]", + "D838"), + (m32, "00000000 FDIVR QWORD PTR [EAX]", + "DC38"), + + (m32, "00000000 FDIVR ST, ST(2)", + "D8Fa"), + (m32, "00000000 FDIVR ST(2), ST", + "DCF2"), + + (m32, "00000000 FDIVRP ST(2), ST", + "DEF2"), + + (m16, "00000000 FIDIVR DWORD PTR [BX+SI]", + "DA38"), + (m32, "00000000 FIDIVR DWORD PTR [EAX]", + "DA38"), + (m32, "00000000 FIDIVR WORD PTR [EAX]", + "DE38"), + + (m32, "00000000 FFREE ST(2)", + "DDC2"), + + (m32, "00000000 FICOM WORD PTR [EAX]", + "DE10"), + (m32, "00000000 FICOM DWORD PTR [EAX]", + "DA10"), + + (m32, "00000000 FICOMP WORD PTR [EAX]", + "DE18"), + (m32, "00000000 FICOMP DWORD PTR [EAX]", + "DA18"), + + (m32, "00000000 FILD WORD PTR [EAX]", + "DF00"), + (m32, "00000000 FILD DWORD PTR [EAX]", + "DB00"), + + + (m32, "00000000 FILD QWORD PTR [EAX]", + "DF28"), + + (m32, "00000000 FINCSTP", + "d9f7"), + + #(m32, "00000000 FINIT", + # "9bdbe3"), + (m32, "00000000 FNINIT", + "dbe3"), + + (m32, "00000000 FIST WORD PTR [EAX]", + "DF10"), + (m32, "00000000 FIST DWORD PTR [EAX]", + "DB10"), + + (m32, "00000000 FISTP WORD PTR [EAX]", + "DF18"), + (m32, "00000000 FISTP DWORD PTR [EAX]", + "DB18"), + + (m32, "00000000 FISTP QWORD PTR [EAX]", + "Df38"), + + (m32, "00000000 FISTTP WORD PTR [EAX]", + "DF08"), + (m32, "00000000 FISTTP DWORD PTR [EAX]", + "DB08"), + + (m32, "00000000 FISTTP QWORD PTR [EAX]", + "Dd08"), + + (m32, "00000000 FLD DWORD PTR [EAX]", + "d900"), + (m32, "00000000 FLD QWORD PTR [EAX]", + "dd00"), + + (m32, "00000000 FLD TBYTE PTR [EAX]", + "db28"), + (m32, "00000000 FLD ST(2)", + "d9c2"), + + + (m32, "00000000 FLD1", + "d9e8"), + (m32, "00000000 FLDL2T", + "d9e9"), + (m32, "00000000 FLDL2E", + "d9eA"), + (m32, "00000000 FLDPI", + "d9eB"), + (m32, "00000000 FLDLG2", + "d9eC"), + (m32, "00000000 FLDLN2", + "d9eD"), + (m32, "00000000 FLDZ", + "d9eE"), + + (m32, "00000000 FLDCW WORD PTR [EAX]", + "d928"), + + + + (m16, "00000000 FMUL DWORD PTR [BX+SI]", + "D808"), + (m32, "00000000 FMUL DWORD PTR [EAX]", + "D808"), + (m32, "00000000 FMUL QWORD PTR [EAX]", + "DC08"), + + (m32, "00000000 FMUL ST, ST(2)", + "D8Ca"), + (m32, "00000000 FMUL ST(2), ST", + "DCCa"), + + (m32, "00000000 FMULP ST(2), ST", + "DECa"), + + (m16, "00000000 FIMUL DWORD PTR [BX+SI]", + "DA08"), + (m32, "00000000 FIMUL DWORD PTR [EAX]", + "DA08"), + (m32, "00000000 FIMUL WORD PTR [EAX]", + "DE08"), + + (m32, "00000000 FNOP", + "D9d0"), + (m32, "00000000 FPATAN", + "D9f3"), + (m32, "00000000 FPREM", + "D9f8"), + (m32, "00000000 FPREM1", + "D9f5"), + (m32, "00000000 FPTAN", + "D9f2"), + (m32, "00000000 FRNDINT", + "D9fc"), + + (m32, "00000000 FRSTOR TBYTE PTR [EAX]", + "dd20"), + + #(m32, "00000000 FSAVE TBYTE PTR [EAX]", + # "9bdd30"), + (m32, "00000000 FNSAVE TBYTE PTR [EAX]", + "dd30"), + + (m32, "00000000 FSCALE", + "d9fd"), + + (m32, "00000000 FSIN", + "d9fe"), + (m32, "00000000 FSINCOS", + "d9fb"), + (m32, "00000000 FSQRT", + "d9fa"), + + + + (m32, "00000000 FST DWORD PTR [EAX]", + "D910"), + (m32, "00000000 FST QWORD PTR [EAX]", + "DD10"), + + (m32, "00000000 FST ST(2)", + "ddd2"), + + (m32, "00000000 FSTP DWORD PTR [EAX]", + "D918"), + (m32, "00000000 FSTP QWORD PTR [EAX]", + "Dd18"), + (m32, "00000000 FSTP TBYTE PTR [EAX]", + "db38"), + + #(m32, "00000000 FSTCW WORD PTR [EAX]", + # "9bd938"), + (m32, "00000000 FNSTCW WORD PTR [EAX]", + "d938"), + + (m32, "00000000 FNSTENV TBYTE PTR [EAX]", + "d930"), + #(m32, "00000000 FSTENV TBYTE PTR [EAX]", + # "9bd930"), + + (m32, "00000000 FNSTSW WORD PTR [EAX]", + "dd38"), + #(m32, "00000000 FSTSW WORD PTR [EAX]", + # "9bdd38"), + + #(m32, "00000000 FSTSW AX", + # "9bdfe0"), + (m32, "00000000 FNSTSW AX", + "dfe0"), + + (m16, "00000000 FSUB DWORD PTR [BX+SI]", + "D820"), + (m32, "00000000 FSUB DWORD PTR [EAX]", + "D820"), + (m32, "00000000 FSUB QWORD PTR [EAX]", + "DC20"), + + (m32, "00000000 FSUB ST, ST(2)", + "D8E2"), + (m32, "00000000 FSUB ST(2), ST", + "DCEA"), + + (m32, "00000000 FSUBP ST(2), ST", + "DEEA"), + + (m16, "00000000 FISUB DWORD PTR [BX+SI]", + "DA20"), + (m32, "00000000 FISUB DWORD PTR [EAX]", + "DA20"), + (m32, "00000000 FISUB WORD PTR [EAX]", + "DE20"), + + + + (m16, "00000000 FSUBR DWORD PTR [BX+SI]", + "D828"), + (m32, "00000000 FSUBR DWORD PTR [EAX]", + "D828"), + (m32, "00000000 FSUBR QWORD PTR [EAX]", + "DC28"), + + (m32, "00000000 FSUBR ST, ST(2)", + "D8EA"), + (m32, "00000000 FSUBR ST(2), ST", + "DCE2"), + + (m32, "00000000 FSUBRP ST(2), ST", + "DEE2"), + + (m16, "00000000 FISUBR DWORD PTR [BX+SI]", + "DA28"), + (m32, "00000000 FISUBR DWORD PTR [EAX]", + "DA28"), + (m32, "00000000 FISUBR WORD PTR [EAX]", + "DE28"), + + (m32, "00000000 FTST", + "d9e4"), + + (m32, "00000000 FUCOM ST(2)", + "dde2"), + (m32, "00000000 FUCOMP ST(2)", + "DDEA"), + (m32, "00000000 FUCOMPP", + "DAe9"), + + (m32, "00000000 FXAM", + "d9e5"), + + (m32, "00000000 FXCH ST(2)", + "d9ca"), + + (m32, "00000000 FXRSTOR TBYTE PTR [EAX]", + "0fae08"), + (m32, "00000000 FXSAVE TBYTE PTR [EAX]", + "0fae00"), + + (m32, "00000000 FXTRACT", + "d9f4"), + (m32, "00000000 FYL2X", + "d9f1"), + (m32, "00000000 FYL2XP1", + "d9f9"), + + (m32, "00000000 HLT", + "f4"), + (m32, "00000000 ICEBP", + "f1"), + + (m32, "00000000 IDIV BYTE PTR [EAX]", + "f638"), + (m32, "00000000 IDIV DWORD PTR [EAX]", + "f738"), + + (m32, "00000000 IMUL EAX, DWORD PTR [EAX]", + "0faf00"), + + + (m32, "00000000 IMUL EAX, EBX, 0x8", + "6bc308"), + (m32, "00000000 IMUL EAX, EBX, 0xFFFFFFFF", + "6bc3FF"), + (m32, "00000000 IMUL EAX, DWORD PTR [EBX], 0x11223344", + "690344332211"), + (m64, "00000000 IMUL RAX, QWORD PTR [RBX], 0x11223344", + "48690344332211"), + (m64, "00000000 IMUL RAX, QWORD PTR [RBX], 0x11223344", + "48690344332211"), + (m64, "00000000 IMUL RAX, QWORD PTR [RBX], 0xFFFFFFFFF1223344", + "486903443322F1"), + (m16, "00000000 IMUL AX, BX, 0x8", + "6bc308"), + (m16, "00000000 IMUL AX, BX, 0xFFF0", + "6bc3F0"), + + (m32, "00000000 IN AL, 0x12", + "e412"), + (m32, "00000000 IN EAX, 0x12", + "e512"), + (m64, "00000000 IN RAX, 0x12", + "48e512"), + + (m32, "00000000 IN AL, DL", + "EC"), + (m32, "00000000 IN EAX, EDX", + "ED"), + (m32, "00000000 IN AX, DX", + "66ED"), + + (m32, "00000000 INC DWORD PTR [EAX]", + "ff00"), + (m32, "00000000 INC ECX", + "41"), + + (m32, "00000000 INT 0x3", + "CC"), + (m32, "00000000 INT 0x21", + "CD21"), + + (m16, "00000000 IRET", + "CF"), + (m32, "00000000 IRETD", + "CF"), + (m64, "00000000 IRETQ", + "48CF"), + + (m32, "00000000 JA 0x12", + "7712"), + (m32, "00000000 JA 0xFFFFFFEE", + "77EE"), + (m64, "00000000 JA 0xFFFFFFFFFFFFFFEE", + "77EE"), + + #(m32, "00000000 JA 0xFFEE", + # "6677EE"), + #(m64, "00000000 JA 0xFFEE", + # "6677EE"), + + + (m16, "00000000 JCXZ 0xFFEE", + "E3EE"), + (m16, "00000000 JECXZ 0xFFEE", + "67E3EE"), + (m32, "00000000 JECXZ 0xFFFFFFEE", + "E3EE"), + (m32, "00000000 JCXZ 0xFFFFFFEE", + "67E3EE"), + (m32, "00000000 JCXZ 0xFFEE", + "6667E3EE"), + (m64, "00000000 JRCXZ 0xFFFFFFFFFFFFFFEE", + "E3EE"), + (m64, "00000000 JECXZ 0xFFFFFFFFFFFFFFEE", + "67E3EE"), + + + (m32, "00000000 MOV BYTE PTR [EAX], AL", + "8800"), + (m32, "00000000 MOV AL, BYTE PTR [EAX]", + "8a00"), + (m32, "00000000 MOV EAX, DWORD PTR [EAX]", + "8b00"), + (m32, "00000000 MOV DWORD PTR [EAX], EAX", + "8900"), + (m64, "00000000 MOV ECX, DWORD PTR [RCX]", + "8b09"), + (m64, "00000000 MOV DWORD PTR [RCX], ECX", + "8909"), + (m64, "00000000 MOV QWORD PTR [RAX], RAX", + "488900"), + + (m32, "00000000 MOV EAX, EBX", + "89d8"), + (m32, "00000000 MOV EAX, EBX", + "8bc3"), + + + (m16, "00000000 MOV WORD PTR [BX+SI], ES", + "8c00"), + (m32, "00000000 MOV DWORD PTR [EAX], ES", + "8c00"), + (m32, "00000000 MOV ES, DWORD PTR [EAX]", + "8e00"), + (m32, "00000000 MOV DWORD PTR [EAX], CS", + "8c08"), + (m64, "00000000 MOV DWORD PTR [RCX], ES", + "8c01"), + + (m16, "00000000 MOV BH, 0x12", + "b712"), + (m16, "00000000 MOV DI, 0x1122", + "bf2211"), + + (m32, "00000000 MOV AL, 0x12", + "b012"), + (m32, "00000000 MOV EAX, 0x11223344", + "b844332211"), + (m32, "00000000 MOV BH, 0x12", + "b712"), + (m32, "00000000 MOV EDI, 0x11223344", + "bf44332211"), + + (m64, "00000000 MOV BH, 0x12", + "b712"), + (m64, "00000000 MOV EDI, 0x11223344", + "bf44332211"), + + (m16, "00000000 MOV WORD PTR [BX], 0x1122", + "c7072211"), + (m32, "00000000 MOV DWORD PTR [EAX], 0x11223344", + "c70044332211"), + (m64, "00000000 MOV DWORD PTR [RCX], 0x11223344", + "c70144332211"), + + (m32, "00000000 MOV CR0, EAX", + "0f22c0"), + (m32, "00000000 MOV EAX, CR0", + "0f20c0"), + + (m32, "00000000 MOV EAX, DR0", + "0f21c0"), + (m32, "00000000 MOV DR0, EAX", + "0f23c0"), + + (m64, "00000000 MOV DWORD PTR [RSP+0x20], 0x10", + "C744242010000000"), + (m64, "00000000 MOV DWORD PTR [RBX+0x20], 0x30", + "c744a32030000000"), + (m64, "00000000 MOV DWORD PTR [R12+0x20], 0x10", + "41C744242010000000"), + + (m32, "00000000 MOV BYTE PTR [EBX+0xFFFFFF98], 0xCC", + "C64398CC"), + + (m64, "00000000 MOV BYTE PTR [R11+0xFFFFFFFFFFFFFF98], 0xCC", + "41C64398CC"), + + (m64, "00000000 MOV RAX, 0x1122334455667788", + "48b88877665544332211"), + + (m64, "00000000 MOV RDX, 0x1122334455667788", + "48ba8877665544332211"), + + + + (m64, "00000000 MOV RAX, RBX", + "4889d8"), + (m64, "00000000 MOV RAX, RBX", + "4A89d8"), + (m64, "00000000 MOV RAX, R11", + "4C89d8"), + (m64, "00000000 MOV R8D, EBX", + "4189d8"), + (m64, "00000000 MOV R8D, EBX", + "4389d8"), + (m64, "00000000 MOV EAX, R11D", + "4489d8"), + (m64, "00000000 MOV R8D, R11D", + "4589d8"), + (m64, "00000000 MOV EAX, R11D", + "4689d8"), + (m64, "00000000 MOV R8D, R11D", + "4789d8"), + + (m64, "00000000 MOV BYTE PTR [RBX+0x3], R11B", + "44885B03"), + + (m32, "00000000 MOV AL, BYTE PTR [0x11223344]", + "A044332211"), + (m32, "00000000 MOV BYTE PTR [0x11223344], AL", + "A244332211"), + (m32, "00000000 MOV EAX, DWORD PTR [0x11223344]", + "A144332211"), + (m32, "00000000 MOV DWORD PTR [0x11223344], EAX", + "A344332211"), + + (m32, "00000000 MOV WORD PTR [0x11223344], AX", + "66A344332211"), + + (m32, "00000000 MOV DWORD PTR [0x1122], EAX", + "67A32211"), + + + + (m16, "00000000 MOV AL, BYTE PTR [0x1122]", + "A02211"), + (m16, "00000000 MOV BYTE PTR [0x1122], AL", + "A22211"), + (m16, "00000000 MOV AX, WORD PTR [0x1122]", + "A12211"), + (m16, "00000000 MOV WORD PTR [0x1122], AX", + "A32211"), + + (m64, "00000000 MOV AL, BYTE PTR [0x1122334455667788]", + "A08877665544332211"), + (m64, "00000000 MOV BYTE PTR [0x1122334455667788], AL", + "A28877665544332211"), + (m64, "00000000 MOV EAX, DWORD PTR [0x1122334455667788]", + "A18877665544332211"), + (m64, "00000000 MOV DWORD PTR [0x1122334455667788], EAX", + "A38877665544332211"), + + + + (m32, "00000000 MOV EAX, DWORD PTR CS:[EAX]", + "2e8b00"), + (m32, "00000000 MOV EAX, DWORD PTR SS:[EAX]", + "368b00"), + (m32, "00000000 MOV EAX, DWORD PTR DS:[EAX]", + "3e8b00"), + (m32, "00000000 MOV EAX, DWORD PTR ES:[EAX]", + "268b00"), + (m32, "00000000 MOV EAX, DWORD PTR FS:[EAX]", + "648b00"), + (m32, "00000000 MOV EAX, DWORD PTR GS:[EAX]", + "658b00"), + + + + (m32, "00000000 MOVSX EAX, BYTE PTR [EAX]", + "0fbe00"), + (m32, "00000000 MOVSX EAX, WORD PTR [EAX]", + "0fbf00"), + + (m64, "00000000 MOVSX RAX, BYTE PTR [RAX]", + "480fbe00"), + (m64, "00000000 MOVSX RAX, WORD PTR [RAX]", + "480fbf00"), + + (m16, "00000000 MOVZX AX, BYTE PTR [BX+SI]", + "0fb600"), + (m16, "00000000 MOVZX AX, WORD PTR [BX+SI]", + "0fb700"), + + (m32, "00000000 MOVZX EAX, BYTE PTR [EAX]", + "0fb600"), + (m32, "00000000 MOVZX EAX, WORD PTR [EAX]", + "0fb700"), + + (m64, "00000000 MOVSXD R8, EAX", + "4c63c0"), + + + (m32, "00000000 MUL BYTE PTR [EAX]", + "f620"), + (m32, "00000000 MUL EBX", + "f7e3"), + + (m16, "00000000 CMPSW", + "a7"), + (m32, "00000000 CMPSW", + "66a7"), + (m32, "00000000 CMPSD", + "a7"), + + (m64, "00000000 CMPSD", + "a7"), + (m64, "00000000 CMPSQ", + "48a7"), + + (m16, "00000000 LODSB", + "aC"), + (m32, "00000000 LODSB", + "66ac"), + (m16, "00000000 LODSW", + "ad"), + (m32, "00000000 LODSW", + "66ad"), + (m32, "00000000 LODSD", + "ad"), + + (m64, "00000000 LODSD", + "ad"), + (m64, "00000000 LODSQ", + "48ad"), + + + + (m32, "00000000 NEG BYTE PTR [EAX]", + "f618"), + (m32, "00000000 NEG EBX", + "f7db"), + + #(m32, "00000000 NOP", + # "90"), + + (m32, "00000000 NOP DWORD PTR [EAX]", + "0f1f00"), + + (m32, "00000000 NOT BYTE PTR [EAX]", + "f610"), + (m32, "00000000 NOT EBX", + "f7d3"), + + (m32, "00000000 OR AL, 0x11", + "0c11"), + (m32, "00000000 OR EAX, 0x11223344", + "0d44332211"), + (m32, "00000000 OR BYTE PTR [EAX], 0x11", + "800811"), + (m32, "00000000 OR DWORD PTR [EAX], 0x11223344", + "810844332211"), + (m32, "00000000 OR DWORD PTR [EAX], 0x11", + "830811"), + (m32, "00000000 OR BYTE PTR [EAX], AL", + "0800"), + (m32, "00000000 OR DWORD PTR [EAX], EAX", + "0900"), + (m32, "00000000 OR AL, BYTE PTR [EAX]", + "0A00"), + (m32, "00000000 OR EAX, DWORD PTR [EAX]", + "0B00"), + + (m32, "00000000 OUT 0x12, AL", + "e612"), + (m32, "00000000 OUT 0x12, EAX", + "e712"), + (m64, "00000000 OUT 0x12, RAX", + "48e712"), + + (m32, "00000000 OUT DL, AL", + "EE"), + (m32, "00000000 OUT EDX, EAX", + "EF"), + (m32, "00000000 OUT DX, AX", + "66EF"), + + (m32, "00000000 OUTSB", + "6e"), + (m32, "00000000 OUTSD", + "6f"), + (m32, "00000000 OUTSW", + "666f"), + (m64, "00000000 OUTSD", + "6f"), + (m64, "00000000 OUTSW", + "666f"), + + #(m32, "00000000 PAUSE", + # "f390"), + + + (m16, "00000000 POP WORD PTR [BX+SI]", + "8f00"), + (m32, "00000000 POP DWORD PTR [EAX]", + "8f00"), + (m64, "00000000 POP QWORD PTR [RAX]", + "8f00"), + + + (m32, "00000000 POP EAX", + "8fC0"), + (m64, "00000000 POP RAX", + "8fC0"), + + (m32, "00000000 POP EAX", + "58"), + (m64, "00000000 POP RAX", + "58"), + (m64, "00000000 POP R10", + "415a"), + + (m32, "00000000 POP DS", + "1f"), + (m32, "00000000 POP ES", + "07"), + (m32, "00000000 POP SS", + "17"), + (m32, "00000000 POP FS", + "0fa1"), + (m32, "00000000 POP GS", + "0fa9"), + + (m16, "00000000 POPA", + "61"), + (m32, "00000000 POPAD", + "61"), + + (m16, "00000000 POPF", + "9d"), + (m32, "00000000 POPFD", + "9d"), + (m64, "00000000 POPFD", + "9d"), + (m64, "00000000 POPFQ", + "489d"), + + (m32, "00000000 PREFETCH0 BYTE PTR [EAX]", + "0f1808"), + (m32, "00000000 PREFETCH1 BYTE PTR [EAX]", + "0f1810"), + (m32, "00000000 PREFETCH2 BYTE PTR [EAX]", + "0f1818"), + (m32, "00000000 PREFETCHNTA BYTE PTR [EAX]", + "0f1800"), + + + (m16, "00000000 PUSH AX", + "50"), + (m32, "00000000 PUSH EAX", + "50"), + (m64, "00000000 PUSH RAX", + "50"), + (m64, "00000000 PUSH R10", + "4152"), + (m16, "00000000 PUSH WORD PTR [BX+SI]", + "FF30"), + (m16, "00000000 PUSH WORD PTR [EAX]", + "67FF30"), + (m16, "00000000 PUSH DWORD PTR [EAX]", + "6667FF30"), + (m32, "00000000 PUSH DWORD PTR [EAX]", + "FF30"), + (m64, "00000000 PUSH QWORD PTR [RAX]", + "FF30"), + + (m16, "00000000 PUSH 0x11", + "6a11"), + (m32, "00000000 PUSH 0x11223344", + "6844332211"), + (m32, "00000000 PUSH 0x1122", + "66682211"), + (m32, "00000000 PUSH 0x80", + "6880000000"), + + (m64, "00000000 PUSH 0x11223344", + "6844332211"), + + (m32, "00000000 PUSH CS", + "0e"), + (m32, "00000000 PUSH SS", + "16"), + (m32, "00000000 PUSH DS", + "1E"), + (m32, "00000000 PUSH ES", + "06"), + (m32, "00000000 PUSH FS", + "0fa0"), + (m32, "00000000 PUSH GS", + "0fa8"), + + (m16, "00000000 PUSHA", + "60"), + (m32, "00000000 PUSHAD", + "60"), + + (m16, "00000000 PUSHF", + "9c"), + (m32, "00000000 PUSHFD", + "9c"), + (m64, "00000000 PUSHFD", + "9c"), + (m64, "00000000 PUSHFQ", + "489c"), + + (m32, "00000000 RCL BYTE PTR [EAX], 0x1", + "D010"), + (m32, "00000000 RCL BYTE PTR [EAX], CL", + "d210"), + + (m32, "00000000 RCL DWORD PTR [EAX], 0x1", + "D110"), + (m32, "00000000 RCL DWORD PTR [EAX], CL", + "d310"), + + (m32, "00000000 RCL BYTE PTR [EAX], 0x11", + "c01011"), + (m32, "00000000 RCL DWORD PTR [EAX], 0x11", + "c11011"), + + (m64, "00000000 RCL QWORD PTR [RAX], 0x1", + "48D110"), + (m64, "00000000 RCL QWORD PTR [RAX], CL", + "48d310"), + + (m64, "00000000 RCL BYTE PTR [RAX], 0x11", + "c01011"), + (m64, "00000000 RCL QWORD PTR [RAX], 0x11", + "48c11011"), + + + + + (m32, "00000000 RCR BYTE PTR [EAX], 0x1", + "D018"), + (m32, "00000000 RCR BYTE PTR [EAX], CL", + "d218"), + + (m32, "00000000 RCR DWORD PTR [EAX], 0x1", + "D118"), + (m32, "00000000 RCR DWORD PTR [EAX], CL", + "d318"), + + (m32, "00000000 RCR BYTE PTR [EAX], 0x11", + "c01811"), + (m32, "00000000 RCR DWORD PTR [EAX], 0x11", + "c11811"), + + (m64, "00000000 RCR QWORD PTR [RAX], 0x1", + "48D118"), + (m64, "00000000 RCR QWORD PTR [RAX], CL", + "48d318"), + + (m64, "00000000 RCR BYTE PTR [RAX], 0x11", + "c01811"), + (m64, "00000000 RCR QWORD PTR [RAX], 0x11", + "48c11811"), + + + + + (m32, "00000000 ROL BYTE PTR [EAX], 0x1", + "D000"), + (m32, "00000000 ROL BYTE PTR [EAX], CL", + "d200"), + + (m32, "00000000 ROL DWORD PTR [EAX], 0x1", + "D100"), + (m32, "00000000 ROL DWORD PTR [EAX], CL", + "d300"), + + (m32, "00000000 ROL BYTE PTR [EAX], 0x11", + "c00011"), + (m32, "00000000 ROL DWORD PTR [EAX], 0x11", + "c10011"), + + (m64, "00000000 ROL QWORD PTR [RAX], 0x1", + "48D100"), + (m64, "00000000 ROL QWORD PTR [RAX], CL", + "48d300"), + + (m64, "00000000 ROL BYTE PTR [RAX], 0x11", + "c00011"), + (m64, "00000000 ROL QWORD PTR [RAX], 0x11", + "48c10011"), + + + + (m32, "00000000 ROR BYTE PTR [EAX], 0x1", + "D008"), + (m32, "00000000 ROR BYTE PTR [EAX], CL", + "d208"), + + (m32, "00000000 ROR DWORD PTR [EAX], 0x1", + "D108"), + (m32, "00000000 ROR DWORD PTR [EAX], CL", + "d308"), + + (m32, "00000000 ROR BYTE PTR [EAX], 0x11", + "c00811"), + (m32, "00000000 ROR DWORD PTR [EAX], 0x11", + "c10811"), + + (m64, "00000000 ROR QWORD PTR [RAX], 0x1", + "48D108"), + (m64, "00000000 ROR QWORD PTR [RAX], CL", + "48d308"), + + (m64, "00000000 ROR BYTE PTR [RAX], 0x11", + "c00811"), + (m64, "00000000 ROR QWORD PTR [RAX], 0x11", + "48c10811"), + + + + (m32, "00000000 RDMSR", + "0f32"), + (m32, "00000000 RDPMC", + "0f33"), + (m32, "00000000 RDTSC", + "0f31"), + + (m32, "00000000 INSB", + "6C"), + (m16, "00000000 INSW", + "6D"), + (m32, "00000000 INSD", + "6D"), + (m64, "00000000 INSD", + "486D"), + (m64, "00000000 INSD", + "6D"), + + + (m32, "00000000 MOVSB", + "a4"), + (m16, "00000000 MOVSW", + "a5"), + (m32, "00000000 MOVSD", + "a5"), + (m64, "00000000 MOVSQ", + "48a5"), + (m64, "00000000 MOVSD", + "a5"), + + (m32, "00000000 OUTSB", + "6e"), + (m16, "00000000 OUTSW", + "6f"), + (m32, "00000000 OUTSD", + "6f"), + (m64, "00000000 OUTSD", + "486f"), + (m64, "00000000 OUTSD", + "6f"), + + + (m32, "00000000 LODSB", + "ac"), + (m16, "00000000 LODSW", + "ad"), + (m32, "00000000 LODSD", + "ad"), + (m64, "00000000 LODSQ", + "48ad"), + (m64, "00000000 LODSD", + "ad"), + + (m32, "00000000 STOSB", + "aa"), + (m16, "00000000 STOSW", + "ab"), + (m32, "00000000 STOSD", + "ab"), + (m64, "00000000 STOSQ", + "48ab"), + (m64, "00000000 STOSD", + "ab"), + + + (m32, "00000000 CMPSB", + "a6"), + (m16, "00000000 CMPSW", + "a7"), + (m32, "00000000 CMPSD", + "a7"), + (m64, "00000000 CMPSQ", + "48a7"), + (m64, "00000000 CMPSD", + "a7"), + + + (m32, "00000000 SCASB", + "ae"), + (m16, "00000000 SCASW", + "af"), + (m32, "00000000 SCASD", + "af"), + (m64, "00000000 SCASQ", + "48af"), + (m64, "00000000 SCASD", + "af"), + + (m32, "00000000 REPNE SCASB", + "F2AE"), + (m32, "00000000 REPE SCASB", + "F3AE"), + (m32, "00000000 REPE LODSD", + "F3ad"), + + (m32, "00000000 RET", + "c3"), + + (m32, "00000000 RET 0x1122", + "C22211"), + + (m32, "00000000 RETF 0x1122", + "CA2211"), + + (m32, "00000000 RSM", + "0faa"), + (m32, "00000000 SAHF", + "9e"), + + (m32, "00000000 SAL BYTE PTR [EAX], 0x1", + "D030"), + (m32, "00000000 SAL BYTE PTR [EAX], CL", + "d230"), + + (m32, "00000000 SAR BYTE PTR [EAX], 0x1", + "D038"), + (m32, "00000000 SAR BYTE PTR [EAX], CL", + "d238"), + + (m32, "00000000 SHL BYTE PTR [EAX], 0x1", + "D020"), + (m32, "00000000 SHL BYTE PTR [EAX], CL", + "d220"), + + (m32, "00000000 SHR BYTE PTR [EAX], 0x1", + "D028"), + (m32, "00000000 SHR BYTE PTR [EAX], CL", + "d228"), + + + (m32, "00000000 SBB AL, 0x11", + "1c11"), + (m32, "00000000 SBB EAX, 0x11223344", + "1D44332211"), + (m32, "00000000 SBB BYTE PTR [EAX], 0x11", + "801811"), + (m32, "00000000 SBB DWORD PTR [EAX], 0x11223344", + "811844332211"), + (m32, "00000000 SBB BYTE PTR [EAX], AL", + "1800"), + (m32, "00000000 SBB DWORD PTR [EAX], EAX", + "1900"), + (m32, "00000000 SBB AL, BYTE PTR [EAX]", + "1A00"), + (m32, "00000000 SBB EAX, DWORD PTR [EAX]", + "1B00"), + (m64, "00000000 SBB QWORD PTR [RAX], RAX", + "481900"), + + + (m32, "00000000 SETA BYTE PTR [EAX]", + "0f9700"), + (m32, "00000000 SETO BYTE PTR [EAX]", + "0f9000"), + (m32, "00000000 SETNZ AL", + "0f95C0"), + + (m32, "00000000 SGDT DWORD PTR [EAX]", + "0f0100"), + + (m32, "00000000 SHLD DWORD PTR [EAX], EAX, 0x11", + "0fa40011"), + (m32, "00000000 SHLD DWORD PTR [EAX], EAX, CL", + "0fa500"), + + (m64, "00000000 SHLD QWORD PTR [RAX], RAX, 0x11", + "480fa40011"), + (m64, "00000000 SHLD QWORD PTR [RAX], RAX, CL", + "480fa500"), + + (m32, "00000000 SHRD DWORD PTR [EAX], EAX, 0x11", + "0fac0011"), + (m32, "00000000 SHRD DWORD PTR [EAX], EAX, CL", + "0fad00"), + + (m64, "00000000 SHRD QWORD PTR [RAX], RAX, 0x11", + "480fac0011"), + (m64, "00000000 SHRD QWORD PTR [RAX], RAX, CL", + "480fad00"), + + (m32, "00000000 SIDT DWORD PTR [EAX]", + "0f0108"), + + + + (m32, "00000000 SUB AL, 0x11", + "2c11"), + (m32, "00000000 SUB EAX, 0x11223344", + "2D44332211"), + (m32, "00000000 SUB BYTE PTR [EAX], 0x11", + "802811"), + (m32, "00000000 SUB DWORD PTR [EAX], 0x11223344", + "812844332211"), + (m32, "00000000 SUB BYTE PTR [EAX], AL", + "2800"), + (m32, "00000000 SUB DWORD PTR [EAX], EAX", + "2900"), + (m32, "00000000 SUB AL, BYTE PTR [EAX]", + "2A00"), + (m32, "00000000 SUB EAX, DWORD PTR [EAX]", + "2B00"), + (m32, "00000000 SUB EBX, DWORD PTR [EBP+0xFFFFF858]", + "2b9d58f8ffff"), + + + (m64, "00000000 SYSCALL", + "0f05"), + (m64, "00000000 SYSENTER", + "0f34"), + (m64, "00000000 SYSEXIT", + "0f35"), + (m64, "00000000 SYSRET", + "0f07"), + + + + (m32, "00000000 TEST AL, 0x11", + "a811"), + (m32, "00000000 TEST EAX, 0x11223344", + "A944332211"), + + (m32, "00000000 TEST BYTE PTR [EAX], 0x11", + "f60011"), + (m32, "00000000 TEST DWORD PTR [EAX], 0x11223344", + "f70044332211"), + + (m32, "00000000 TEST BYTE PTR [EAX], AL", + "8400"), + (m32, "00000000 TEST DWORD PTR [EAX], EAX", + "8500"), + + (m32, "00000000 UD2", + "0f0b"), + + (m32, "00000000 VERR DWORD PTR [EAX]", + "0f0020"), + + (m32, "00000000 VERW DWORD PTR [EAX]", + "0f0028"), + + (m32, "00000000 WBIND", + "0f09"), + + (m32, "00000000 WRMSR", + "0f30"), + + (m32, "00000000 XADD BYTE PTR [EAX], AL", + "0fc000"), + (m32, "00000000 XADD DWORD PTR [EAX], EAX", + "0fc100"), + + (m16, "00000000 XCHG AX, CX", + "91"), + + (m32, "00000000 XCHG EAX, ECX", + "91"), + + (m64, "00000000 XCHG EAX, ECX", + "91"), + (m64, "00000000 XCHG RAX, RCX", + "4891"), + + (m32, "00000000 NOP", + "90"), + + + (m32, "00000000 XCHG BYTE PTR [EAX], AL", + "8600"), + (m32, "00000000 XCHG DWORD PTR [EAX], EAX", + "8700"), + + + (m32, "00000000 XOR AL, 0x11", + "3411"), + (m32, "00000000 XOR EAX, 0x11223344", + "3544332211"), + (m32, "00000000 XOR BYTE PTR [EAX], 0x11", + "803011"), + (m32, "00000000 XOR DWORD PTR [EAX], 0x11223344", + "813044332211"), + (m32, "00000000 XOR DWORD PTR [EAX], 0xFFFFFFFF", + "8330FF"), + (m32, "00000000 XOR BYTE PTR [EAX], AL", + "3000"), + (m32, "00000000 XOR DWORD PTR [EAX], EAX", + "3100"), + (m32, "00000000 XOR EAX, DWORD PTR [EAX]", + "3300"), + + (m32, "00000000 XORPS XMM1, XMM2", + "0f57ca"), + (m32, "00000000 XORPS XMM1, DWORD PTR [EDI+0x42]", + "0f574f42"), + (m32, "00000000 XORPD XMM1, XMM2", + "660f57ca"), + + (m32, "00000000 MOVAPS DWORD PTR [EBP+0xFFFFFFB8], XMM0", + "0f2945b8"), + (m32, "00000000 MOVAPS XMM0, DWORD PTR [EBP+0xFFFFFFB8]", + "0f2845b8"), + (m32, "00000000 MOVAPD WORD PTR [EBP+0xFFFFFFB8], XMM0", + "660f2945b8"), + + (m32, "00000000 MOVUPS XMM2, DWORD PTR [ECX]", + "0f1011"), + (m32, "00000000 MOVSD XMM2, DWORD PTR [ECX]", + "f20f1011"), + (m32, "00000000 MOVSD DWORD PTR [EBP+0xFFFFFFD8], XMM0", + "f20f1145d8"), + (m32, "00000000 MOVSS XMM2, DWORD PTR [ECX]", + "f30f1011"), + (m32, "00000000 MOVUPD XMM2, DWORD PTR [ECX]", + "660f1011"), + + (m32, "00000000 ADDSS XMM2, DWORD PTR [ECX]", + "f30f5811"), + (m32, "00000000 ADDSD XMM2, DWORD PTR [ECX]", + "f20f5811"), + + (m32, "00000000 MULSD XMM2, DWORD PTR [ECX]", + "f20f5911"), + + + (m32, "00000000 PXOR XMM0, XMM0", + "0fefc0"), + (m32, "00000000 UCOMISD XMM0, DWORD PTR [EBP+0xFFFFFFD8]", + "660f2e45d8"), + (m32, "00000000 ANDPD XMM0, DWORD PTR [EBX+0x2CBD27]", + "660f548327bd2c00"), + + (m32, "00000000 SUBSD XMM1, XMM0", + "f20f5cc8"), + + (m32, "00000000 MAXSD XMM0, DWORD PTR [EBX+0x2CBD37]", + "f20f5f8337bd2c00"), + + (m32, "00000000 CVTSI2SD XMM0, EBX", + "f20f2ac3"), + + (m32, "00000000 PMINSW MM0, MM1", + "0feac1"), + (m32, "00000000 PMINSW XMM0, XMM1", + "660feac1"), + + (m64, "00000000 MOV BYTE PTR [RSI], DIL", + "40883E"), + (m32, "00000000 MOVZX EAX, BH", + "0fb6c7"), + (m64, "00000000 MOVZX EAX, BH", + "0fb6c7"), + (m64, "00000000 MOVZX EAX, DIL", + "400fb6c7"), + (m64, "00000000 MOV BYTE PTR [RCX], SIL", + "408831"), + (m64, "00000000 CMP SIL, CL", + "4038ce"), + + (m64, "00000000 SETZ DIL", + "400f94c7"), + (m64, "00000000 SETNZ BPL", + "400f95c5"), + (m64, "00000000 MOV CL, BPL", + "4088e9"), + (m64, "00000000 AND DIL, 0x0", + "4080e700"), + (m64, "00000000 MOV DIL, AL", + "4088c7"), + (m64, "00000000 MOV DIL, BYTE PTR [RSI]", + "408a3e"), + (m64, "00000000 DEC DIL", + "40fecf"), + + (m64, "00000000 TEST DIL, DIL", + "4084ff"), + (m32, "00000000 JMP EDX", + "FFE2"), + (m64, "00000000 JMP RDX", + "FFE2"), +] + + + # mode = 64 + # l = mn_x86.dis('\x4D\x11\x7c\x18\x00', mode) + # print l + #""" + # mode = 64 + # l = mn_x86.fromstring("ADC DWORD PTR [RAX], 0x11223344", mode) + # print 'xx' + # t= time.time() + # import cProfile + # def f(): + # x = l.asm(mode) + # print x + # cProfile.run('f()') + # l.asm(mode) + # print time.time()-t +# reg_tests = reg_tests[-1:] + +fname64 = ('exe64.bin', 'r+') +if not os.access(fname64[0], os.R_OK): + fname64 = ('regression_test64_ia32.bin', 'w') + +test_file = {16: open('regression_test16_ia32.bin', 'w'), + 32: open('regression_test32_ia32.bin', 'w'), + # 64:open('regression_test64_ia32.bin', 'w+')} + # 64:open('testmnemo', 'r+')} + 64: open(*fname64)} +ts = time.time() +# test_file[16].write("\x90"*0x10000) +# test_file[32].write("\x90"*0x10000) +file64off = 0x2524c +test_file[64].seek(0x400) +test_file[64].write('\x90' * 0x30000) +test_file[64].seek(file64off) +for mode, s, l, in reg_tests: + print "-" * 80 + s = s[12:] + b = l.decode('hex') + print mode, repr(b) + mn = mn_x86.dis(b, mode) + print "dis args", [(str(x), x.size) for x in mn.args] + print s + print mn + assert(str(mn).strip() == s) + # print hex(b) + # print [str(x.get()) for x in mn.args] + print 'fromstring', repr(s) + l = mn_x86.fromstring(s, mode) + # print l + print 'str args', [(str(x), x.size) for x in l.args] + assert(str(l).strip(' ') == s) + a = mn_x86.asm(l) + print 'asm result', [x for x in a] + print repr(b) + # test_file[mode[0]].write(b) + + for x in a: + print "BYTES", repr(x) + test_file[mode].write(x) + test_file[mode].write("\x90" * 2) + + print 'test re dis' + for x in a: + print repr(x) + rl = mn_x86.dis(x, mode) + assert(str(rl).strip(' ') == s) + print repr(b), a + assert(b in a) + # print mn.args +print 'TEST time', time.time() - ts + + +# speed test thumb +o = "" +mode_x = m32 +for mode, s, l, in reg_tests: + if mode != mode_x: + continue + s = s[12:] + b = l.decode('hex') + o += b + +while len(o) < 1000: + o += o +open('x86_speed_reg_test.bin', 'w').write(o) + + +def profile_dis(o): + bs = bin_stream_str(o) + off = 0 + instr_num = 0 + ts = time.time() + while off < bs.getlen(): + mn = mn_x86.dis(bs, mode_x, off) + # print instr_num, off, mn.l, str(mn) + instr_num += 1 + off += mn.l + print 'instr per sec:', instr_num / (time.time() - ts) + +import cProfile +# cProfile.run(r'mn_x86.dis("\x81\x54\x18\xfe\x44\x33\x22\x11", m32)') +cProfile.run('profile_dis(o)') +# profile_dis(o) diff --git a/test/core/graph.py b/test/core/graph.py new file mode 100644 index 00000000..a419a686 --- /dev/null +++ b/test/core/graph.py @@ -0,0 +1,18 @@ +from miasm2.core.graph import * + +g = DiGraph() +g.add_node('a') +g.add_node('b') + +g.add_edge('a', 'b') +g.add_edge('a', 'c') +g.add_edge('a', 'c') +g.add_edge('c', 'c') + +print g + +print [x for x in g.successors('a')] +print [x for x in g.predecessors('a')] +print [x for x in g.predecessors('b')] +print [x for x in g.predecessors('c')] +print [x for x in g.successors('c')] diff --git a/test/core/interval.py b/test/core/interval.py new file mode 100644 index 00000000..34537d25 --- /dev/null +++ b/test/core/interval.py @@ -0,0 +1,156 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +from miasm2.core.interval import * +from random import randint +from pdb import pm + +i1 = interval([(1, 3)]) +i2 = interval([(2, 5)]) +i3 = interval([(3, 5)]) +i4 = interval([(5, 8)]) + +i5 = interval([(1, 5)]) +i6 = interval([(1, 3), (5, 8)]) +i7 = interval([(2, 8)]) +i8 = interval([(1, 8)]) +i9 = interval([(4, 5)]) + +i10 = interval([(1, 1)]) +i11 = interval([(1, 2)]) +i12 = interval([(2, 2)]) +i13 = interval([(2, 4)]) +i14 = interval([(0, 1), (3, 5), (7, 10)]) +i15 = interval([(0, 12)]) +i16 = interval([(2, 8)]) + +i_empty = interval() + +assert(repr(i_empty) == '[]') + +assert(interval(i1) == i1) + +i1.cannon() +i1.cannon() + +assert(cmp_interval(i1.intervals[0], i2.intervals[0]) == INT_JOIN) +assert(cmp_interval(i1.intervals[0], i3.intervals[0]) == INT_JOIN) +assert(cmp_interval(i1.intervals[0], i4.intervals[0]) == INT_DISJOIN) +assert(cmp_interval(i2.intervals[0], i3.intervals[0]) == INT_B_IN_A) +assert(cmp_interval(i3.intervals[0], i2.intervals[0]) == INT_A_IN_B) +assert(cmp_interval(i1.intervals[0], i1.intervals[0]) == INT_EQ) +assert(cmp_interval(i1.intervals[0], i9.intervals[0]) == INT_JOIN_AB) +assert(cmp_interval(i9.intervals[0], i1.intervals[0]) == INT_JOIN_BA) + +assert((i1 in i2) is False) +assert((i2 in i1) is False) +assert((i1 in i3) is False) +assert((i2 in i3) is False) + +assert((i3 in i2)) +assert((i2 in i3) is False) + +assert(interval.cannon_list(i1.intervals) == i1.intervals) + +assert(i1 + i2 == i5) +assert(i1 + i3 == i5) +assert(i1 + i4 == i6) + +assert(i2 + i3 == i2) +assert(i2 + i4 == i7) +assert(i1 + i2 + i4 == i8) + +assert(i1 - i2 == i10) +assert(i1 - i3 == i11) +assert(i1 - i4 == i1) +assert(i2 - i3 == i12) +assert(i2 - i4 == i13) +assert(i8 - i1 == interval([(4, 8)])) +assert(i8 - i2 == interval([(1, 1), (6, 8)])) + +assert(i10 + i12 == i11) +assert(i1 - i1 == interval()) +assert(i6 - i6 == interval()) +assert(i6 - i6 - i1 == interval()) +assert(i1 - i10 == interval([(2, 3)])) + +assert(i1 & i1 == i1) +assert(i1 & i2 == interval([(2, 3)])) +assert(i1 & i3 == interval([(3, 3)])) +assert(i3 & i1 == interval([(3, 3)])) +assert(i1 & i4 == interval([])) +assert(i4 & i1 == interval([])) +assert(i1 & i5 == i1) +assert(i5 & i1 == i1) +assert(i1 & i6 == i1) +assert(i5 & i13 == i13) +assert(i6 & i6 == i6) +assert(i14 & i15 == i14) +assert(i15 & i14 == i14) +assert(i14 & i16 == interval([(3, 5), (7, 8)])) + +x1 = [(7, 87), (76, 143), (94, 129), (79, 89), (46, 100)] +assert(interval(x1) == interval([(7, 143)])) +x2 = [(11, 16), (35, 74), (18, 114), (91, 188), (3, 75)] +assert(interval(x2) == interval([(3, 188)])) + +i1.hull() +i1.show(dry_run=True) + +assert(i_empty.hull() == (None, None)) + + +def gen_random_interval(l=100): + r = [] + for j in xrange(5): + a = randint(0, l) + b = a + randint(0, l) + r.append((a, b)) + return r + + +def check_add(r1, r2): + i_sum = interval(r1) + interval(r2) + for a, b in r1 + r2: + for i in xrange(a, b + 1): + assert(i in i_sum) + + +def check_sub(r1, r2): + i1 = interval(r1) + i2 = interval(r2) + i_sub = i1 - i2 + for a, b in r1: + for i in xrange(a, b + 1): + if i in i2: + assert(i not in i_sub) + else: + assert(i in i_sub) + + +def check_and(r1, r2): + i1 = interval(r1) + i2 = interval(r2) + i_and = i1 & i2 + for a, b in r1: + for i in xrange(a, b + 1): + if i in i2: + assert(i in i_and) + else: + assert(i not in i_and) + + +for i in xrange(1000): + r1 = gen_random_interval() + r2 = gen_random_interval() + r3 = gen_random_interval() + + check_add(r1, r2) + check_sub(r1, r2) + check_and(r1, r2) + + a = interval(r1) + b = interval(r2) + c = interval(r3) + assert((a & b) - c == a & (b - c) == (a - c) & (b - c)) + assert(a - (b & c) == (a - b) + (a - c)) diff --git a/test/core/parse_asm.py b/test/core/parse_asm.py new file mode 100644 index 00000000..c2a6dc72 --- /dev/null +++ b/test/core/parse_asm.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest + + +class TestParseAsm(unittest.TestCase): + + def test_ParseTxt(self): + from miasm2.arch.x86.arch import mn_x86 + from miasm2.core.parse_asm import parse_txt + + ASM0 = ''' + ; + .LFB0: + .LA: + .text + .data + .bss + .string + .ustring + .byte 0 0x0 + .byte a + .comm + .split + .dontsplit + .file + .cfi_0 + label: + JMP EAX ;comment + ''' + ASM1 = ''' + .XXX + ''' + self.assertTrue(parse_txt(mn_x86, 32, ASM0)) + self.assertRaises(ValueError, parse_txt, mn_x86, 32, ASM1) + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestParseAsm) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) diff --git a/test/expression/modint.py b/test/expression/modint.py new file mode 100644 index 00000000..e7c19d0c --- /dev/null +++ b/test/expression/modint.py @@ -0,0 +1,59 @@ +from miasm2.expression.modint import * + +a = uint8(0x42) +b = uint8(0xFF) +c = uint8(0x4) + +d = uint1(0) +e = uint1(1) + +f = uint8(0x1) + + +print a, b, c +print a + b, a + c, b + c +print a == a, a == b, a == 0x42, a == 0x78 +print a != b, a != a +print d, e +print d + e, d + d, e + e, e + e + e, e + 0x11 + +assert(f == 1) +assert(f + 1 == 2) +assert(2 == f + 1) +assert(f + 0xff == 0) +assert(f & 0 == 0) +assert(f & 0xff == f) +assert(0xff & f == f) +assert(f / 1 == f) +assert(1 / f == f) +assert(int(f) == 1) +assert(long(f) == 1) +assert(~f == 0xfe) +assert(f << 1 == 2) +assert(f << 8 == 0) +assert(1 << f == 2) +assert(0x80 << f == 0) +assert(f % 2 == f) +assert(f % 1 == 0) +assert(2 % f == 0) +assert(f * 2 == 2) +assert(2 * f == 2) +assert(f * f == 1) +assert(f * uint8(0x80) == 0x80) +assert(-f == 0xff) +assert(f | f == f) +assert(f | 0 == f) +assert(2 | f == 3) +assert(f >> 0 == f) +assert(f >> 1 == 0) +assert(0x10 >> f == 0x8) +assert(0x100 >> f == 0x80) # XXXX +assert(0x1000 >> f == 0x0) # XXXX +assert(f ^ f == 0) +assert(f ^ 0 == f) +assert(0 ^ f == f) +assert(1 ^ f == 0) + +print e + c, c + e, c - e, e - c +print 1000 * a +print hex(a) diff --git a/test/expression/simplifications.py b/test/expression/simplifications.py new file mode 100644 index 00000000..19f43d6e --- /dev/null +++ b/test/expression/simplifications.py @@ -0,0 +1,258 @@ +# +# Expression simplification regression tests # +# +from pdb import pm +from miasm2.expression.expression import * +from miasm2.expression.simplifications import expr_simp + +# Define example objects +a = ExprId('a') +b = ExprId('b') +c = ExprId('c') +d = ExprId('d') +e = ExprId('e') + +m = ExprMem(a) +s = a[:8] + +i1 = ExprInt(uint32(0x1)) +i2 = ExprInt(uint32(0x2)) +cc = ExprCond(a, b, c) + +o = ExprCompose([(a[:8], 8, 16), + (a[8:16], 0, 8)]) + +o2 = ExprCompose([(a[8:16], 0, 8), + (a[:8], 8, 16)]) + +l = [a[:8], b[:8], c[:8], m[:8], s, i1[:8], i2[:8], o[:8]] +l2 = l[::-1] + + +x = ExprMem(a + b + ExprInt32(0x42)) + +# Define tests: (expression to simplify, expected value) +to_test = [(ExprInt32(1) - ExprInt32(1), ExprInt32(0)), + ((ExprInt32(5) + c + a + b - a + ExprInt32(1) - ExprInt32(5)), + b + c + ExprInt32(1)), + (a + b + c - a - b - c + a, a), + (a + a + b + c - (a + (b + c)), a), + (c ^ b ^ a ^ c ^ b, a), + (a ^ ExprInt32(0), a), + ((a + b) - b, a), + (-(ExprInt32(0) - ((a + b) - b)), a), + + (ExprOp('<<<', a, ExprInt32(32)), a), + (ExprOp('>>>', a, ExprInt32(32)), a), + (ExprOp('>>>', a, ExprInt32(0)), a), + (ExprOp('<<', a, ExprInt32(0)), a), + + (ExprOp('<<<', a, ExprOp('<<<', b, c)), + ExprOp('<<<', a, ExprOp('<<<', b, c))), + (ExprOp('<<<', ExprOp('<<<', a, b), c), + ExprOp('<<<', ExprOp('<<<', a, b), c)), + (ExprOp('<<<', ExprOp('>>>', a, b), c), + ExprOp('<<<', ExprOp('>>>', a, b), c)), + (ExprOp('>>>', ExprOp('<<<', a, b), c), + ExprOp('>>>', ExprOp('<<<', a, b), c)), + (ExprOp('>>>', ExprOp('<<<', a, b), b), + ExprOp('>>>', ExprOp('<<<', a, b), b)), + + + (ExprOp('>>>', ExprOp('<<<', a, ExprInt32(10)), ExprInt32(2)), + ExprOp('<<<', a, ExprInt32(8))), + + (ExprOp('>>>', ExprOp('<<<', a, ExprInt32(10)), ExprInt32(2)) ^ ExprOp('>>>', ExprOp('<<<', a, ExprInt32(10)), ExprInt32(2)), + ExprInt32(0)), + (ExprOp(">>", (a & ExprInt32(0xF)), ExprInt32(0x15)), + ExprInt32(0)), + (ExprOp(">>", (ExprInt32(0x12345678)), ExprInt32(0x4)), + ExprInt32(0x1234567)), + (ExprOp("a>>", (ExprInt32(0x12345678)), ExprInt32(0x4)), + ExprInt32(0x1234567)), + (ExprOp("a>>", (ExprInt32(0xF1234567)), ExprInt32(0x4)), + ExprInt32(0xFF123456)), + (ExprOp("a>>", (ExprInt32(0xF1234567)), ExprInt32(28)), + ExprInt32(0xFFFFFFFF)), + (ExprOp("==", ExprInt32(12), ExprInt32(10)), ExprInt32(0)), + (ExprOp("==", ExprInt32(12), ExprInt32(12)), ExprInt32(1)), + (ExprOp("==", a | ExprInt32(12), ExprInt32(0)), ExprInt32(0)), + (ExprOp("==", a | ExprInt32(12), ExprInt32(14)), + ExprOp("==", a | ExprInt32(12), ExprInt32(14))), + (ExprOp("parity", ExprInt32(0xf)), ExprInt1(1)), + (ExprOp("parity", ExprInt32(0xe)), ExprInt1(0)), + (ExprInt32(0x4142)[:32], ExprInt32(0x4142)), + (ExprInt32(0x4142)[:8], ExprInt8(0x42)), + (ExprInt32(0x4142)[8:16], ExprInt8(0x41)), + (a[:32], a), + (a[:8][:8], a[:8]), + (a[:16][:8], a[:8]), + (a[8:16][:8], a[8:16]), + (a[8:32][:8], a[8:16]), + (a[:16][8:16], a[8:16]), + (ExprCompose([(a, 0, 32)]), a), + (ExprCompose([(a[:16], 0, 16)]), a[:16]), + (ExprCompose([(a[:16], 0, 16), (a[:16], 16, 32)]), + ExprCompose([(a[:16], 0, 16), (a[:16], 16, 32)]),), + (ExprCompose([(a[:16], 0, 16), (a[16:32], 16, 32)]), a), + + (ExprMem(a)[:32], ExprMem(a)), + (ExprMem(a)[:16], ExprMem(a, size=16)), + + (ExprCond(ExprInt32(1), a, b), a), + (ExprCond(ExprInt32(0), b, a), a), + + (ExprInt32(0x80000000)[31:32], ExprInt1(1)), + (ExprCompose([ + (ExprInt16(0x1337)[ + :8], 0, 8), (ExprInt16(0x1337)[8:16], 8, 16)]), + ExprInt16(0x1337)), + + (ExprCompose([(ExprInt32(0x1337beef)[8:16], 8, 16), + (ExprInt32(0x1337beef)[:8], 0, 8), + (ExprInt32(0x1337beef)[16:32], 16, 32)]), + ExprInt32(0x1337BEEF)), + (ExprCond(a, + ExprCond(a, + b, + c), + d), ExprCond(a, b, d)), + ((a & b & ExprInt32(0x12))[31:32], ExprInt1(0)), + + (ExprCompose([ + (ExprCond(a, ExprInt16(0x10), ExprInt16(0x20)), 0, 16), + (ExprInt16(0x1337), 16, 32)]), + ExprCond(a, ExprInt32(0x13370010), ExprInt32(0x13370020))), + (ExprCond(ExprCond(a, ExprInt1(0), ExprInt1(1)), b, c), + ExprCond(a, c, b)), + (ExprCond(a, ExprInt32(0x10), ExprInt32(0x20)) + ExprInt32(0x13370000), + ExprCond(a, ExprInt32(0x13370010), ExprInt32(0x13370020))), + + (ExprCond(a, ExprInt32(0x10), ExprInt32(0x20)) + ExprCond(a, ExprInt32(0x13370000), ExprInt32(0x13380000)), + ExprCond(a, ExprInt32(0x13370010), ExprInt32(0x13380020))), + (-ExprCond(a, ExprInt32(0x1), ExprInt32(0x2)), + ExprCond(a, ExprInt32(-0x1), ExprInt32(-0x2))), + (ExprOp('*', a, b, c, ExprInt32(0x12))[0:17], + ExprOp( + '*', a[0:17], b[0:17], c[0:17], ExprInt(mod_size2uint[17](0x12)))), + (ExprOp('*', a, ExprInt32(0xffffffff)), + -a), + (ExprOp('*', -a, -b, c, ExprInt32(0x12)), + ExprOp('*', a, b, c, ExprInt32(0x12))), + (ExprOp('*', -a, -b, -c, ExprInt32(0x12)), + ExprOp('*', -a, b, c, ExprInt32(0x12))), + (a | ExprInt32(0xffffffff), + ExprInt32(0xffffffff)), + (ExprCond(a, ExprInt32(1), ExprInt32(2)) * ExprInt32(4), + ExprCond(a, ExprInt32(4), ExprInt32(8))), + (ExprCond(a, b, c) + ExprCond(a, d, e), + ExprCond(a, b + d, c + e)), + (ExprCond(a, b, c) * ExprCond(a, d, e), + ExprCond(a, b * d, c * e)), + + (ExprCond(a, ExprInt32(8), ExprInt32(4)) >> ExprInt32(1), + ExprCond(a, ExprInt32(4), ExprInt32(2))), + + (ExprCond(a, b, c) >> ExprCond(a, d, e), + ExprCond(a, b >> d, c >> e)), + + (a & b & ExprInt_fromsize(a.size, -1), a & b), + (a | b | ExprInt_fromsize(a.size, -1), + ExprInt_fromsize(a.size, -1)), +] + +for e, e_check in to_test[:]: + # + print "#" * 80 + e_check = expr_simp(e_check) + # print str(e), str(e_check) + e_new = expr_simp(e) + print "original: ", str(e), "new: ", str(e_new) + rez = e_new == e_check + if not rez: + raise ValueError( + 'bug in expr_simp simp(%s) is %s and should be %s' % (e, e_new, e_check)) + + +x = ExprId('x') +y = ExprId('y') +z = ExprId('z') +a = ExprId('a') +b = ExprId('b') +c = ExprId('c') + + +jra = ExprId('jra') +jrb = ExprId('jrb') +jrint1 = ExprId('jrint1') + + +e1 = ExprMem((a & ExprInt32(0xFFFFFFFC)) + ExprInt32(0x10), 32) +e2 = ExprMem((a & ExprInt32(0xFFFFFFFC)) + b, 32) +e3 = (a ^ b ^ ((a ^ b) & (b ^ (b - a))) ^ (b - a)).canonize() + +match_tests = [ + (MatchExpr(ExprInt32(12), a, [a]), {a: ExprInt32(12)}), + (MatchExpr(x, a, [a]), {a: x}), + (MatchExpr(x + y, a, [a]), {a: x + y}), + (MatchExpr(x + y, a + y, [a]), {a: x}), + (MatchExpr(x + y, x + a, [a]), {a: y}), + (MatchExpr(x + y, a + b, [a, b]), {a: x, b: y}), + (MatchExpr(x + ExprInt32(12), a + b, [a, b]), {a: x, b: ExprInt32(12)}), + (MatchExpr(ExprMem(x), a, [a]), {a: ExprMem(x)}), + (MatchExpr(ExprMem(x), ExprMem(a), [a]), {a: x}), + (MatchExpr(x[0:8], a, [a]), {a: x[0:8]}), + (MatchExpr(x[0:8], a[0:8], [a]), {a: x}), + (MatchExpr(ExprCond(x, y, z), a, [a]), {a: ExprCond(x, y, z)}), + (MatchExpr(ExprCond(x, y, z), + ExprCond(a, b, c), [a, b, c]), + {a: x, b: y, c: z}), + (MatchExpr(ExprCompose([(x[:8], 0, 8), (y[:8], 8, 16)]), a, [a]), + {a: ExprCompose([(x[:8], 0, 8), (y[:8], 8, 16)])}), + (MatchExpr(ExprCompose([(x[:8], 0, 8), (y[:8], 8, 16)]), + ExprCompose([(a[:8], 0, 8), (b[:8], 8, 16)]), [a, b]), + {a: x, b: y}), + (MatchExpr(e1, e2, [b]), {b: ExprInt32(0x10)}), + (MatchExpr(e3, + (((jra ^ jrb) & (jrb ^ jrint1)) + ^ jra ^ jrb ^ jrint1).canonize(), + [jra, jrb, jrint1]), + {jra: a, jrb: b, jrint1: b - a}), +] + +for test, res in match_tests: + assert(test == res) + + +get_tests = [ + (ExprAff(ExprMem(a), ExprMem(b)).get_r(True), set([a, b, ExprMem(b)])), + (ExprAff(ExprMem(a), ExprMem(b)).get_w(), set([ExprMem(a)])), + (ExprAff(ExprMem(ExprMem(a)), ExprMem(b)) + .get_r(True), set([a, b, ExprMem(b), ExprMem(a)])), +] + + +for test, res in get_tests: + assert(test == res) + + +to_test = [(a + b, b + a), + (a + m, m + a), + ((a[:8] + s), (s + a[:8])), + ((m[:8] + s), (s + m[:8])), + ((i1 + i2), (i2 + i1)), + ((a + i2), (i2 + a)), + ((m + i2), (i2 + m)), + ((s + i2[:8]), (i2[:8] + s)), + (o, o2), + (ExprOp('+', *l), ExprOp('+', *l2)), + ] + +for x, y in to_test: + x, y = x.canonize(), y.canonize() + + assert(x == y) + assert(str(x) == str(y)) + print x + +print 'all tests ok' diff --git a/test/expression/stp.py b/test/expression/stp.py new file mode 100644 index 00000000..fe09e865 --- /dev/null +++ b/test/expression/stp.py @@ -0,0 +1,35 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest + + +class TestIrIr2STP(unittest.TestCase): + + def test_ExprOp_strcst(self): + from miasm2.expression.expression import ExprInt32, ExprOp + import miasm2.expression.stp # /!\ REALLY DIRTY HACK + args = [ExprInt32(i) for i in xrange(9)] + + self.assertEqual( + ExprOp('|', *args[:2]).strcst(), r'(0bin00000000000000000000000000000000 | 0bin00000000000000000000000000000001)') + self.assertEqual( + ExprOp('-', *args[:2]).strcst(), r'BVUMINUS(0bin00000000000000000000000000000000)') + self.assertEqual( + ExprOp('+', *args[:3]).strcst(), r'BVPLUS(32,BVPLUS(32,0bin00000000000000000000000000000000, 0bin00000000000000000000000000000001), 0bin00000000000000000000000000000010)') + self.assertRaises(ValueError, ExprOp('X', *args[:1]).strcst) + + def test_ExprSlice_strcst(self): + from miasm2.expression.expression import ExprInt32, ExprSlice + import miasm2.expression.stp # /!\ REALLY DIRTY HACK + args = [ExprInt32(i) for i in xrange(9)] + + self.assertEqual( + args[0][1:2].strcst(), r'(0bin00000000000000000000000000000000)[1:1]') + self.assertRaises(ValueError, args[0].__getitem__, slice(1,7,2)) + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestIrIr2STP) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) + diff --git a/test/ir/ir2C.py b/test/ir/ir2C.py new file mode 100644 index 00000000..c5ae1b8f --- /dev/null +++ b/test/ir/ir2C.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest + + +class TestIrIr2C(unittest.TestCase): + + def test_ExprOp_toC(self): + from miasm2.expression.expression import ExprInt32, ExprOp + import miasm2.ir.ir2C # /!\ REALLY DIRTY HACK + args = [ExprInt32(i) for i in xrange(9)] + + # Unary operators + self.assertEqual( + ExprOp('parity', *args[:1]).toC(), r'parity(0x0&0xffffffff)') + self.assertEqual( + ExprOp('!', *args[:1]).toC(), r'(~ 0x0)&0xffffffff') + self.assertEqual( + ExprOp('hex2bcd', *args[:1]).toC(), r'hex2bcd_32(0x0)') + self.assertEqual(ExprOp('fabs', *args[:1]).toC(), r'fabs(0x0)') + self.assertRaises(ValueError, ExprOp('X', *args[:1]).toC) + + # Binary operators + self.assertEqual( + ExprOp('==', *args[:2]).toC(), r'(((0x0&0xffffffff) == (0x1&0xffffffff))?1:0)') + self.assertEqual( + ExprOp('%', *args[:2]).toC(), r'(((0x0&0xffffffff)%(0x1&0xffffffff))&0xffffffff)') + self.assertEqual( + ExprOp('-', *args[:2]).toC(), r'(((0x0&0xffffffff) - (0x1&0xffffffff))&0xffffffff)') + self.assertEqual( + ExprOp('bsr', *args[:2]).toC(), r'my_bsr(0x0, 0x1)') + self.assertEqual( + ExprOp('cpuid0', *args[:2]).toC(), r'cpuid0(0x0, 0x1)') + self.assertEqual( + ExprOp('fcom0', *args[:2]).toC(), r'fcom0(0x0, 0x1)') + self.assertEqual( + ExprOp('fadd', *args[:2]).toC(), r'fadd(0x0, 0x1)') + self.assertEqual( + ExprOp('segm', *args[:2]).toC(), r'segm2addr(vmcpu, 0x0, 0x1)') + self.assertEqual( + ExprOp('imod', *args[:2]).toC(), r'imod32(vmcpu, 0x0, 0x1)') + self.assertEqual( + ExprOp('bcdadd', *args[:2]).toC(), r'bcdadd_32(0x0, 0x1)') + self.assertRaises(ValueError, ExprOp('X', *args[:2]).toC) + + # Ternary operators + self.assertEqual( + ExprOp('div8', *args[:3]).toC(), r'(div_op(32, 0x0, 0x1, 0x2) &0xffffffff)') + + # Other cases + self.assertEqual( + ExprOp('+', *args[:3]).toC(), r'(((0x0&0xffffffff)+(0x1&0xffffffff)+(0x2&0xffffffff))&0xffffffff)') + self.assertRaises(NotImplementedError, ExprOp('X', *args[:3]).toC) + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestIrIr2C) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) diff --git a/test/ir/symbexec.py b/test/ir/symbexec.py new file mode 100644 index 00000000..0d3db7e8 --- /dev/null +++ b/test/ir/symbexec.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python +#-*- coding:utf-8 -*- + +import unittest + + +class TestSymbExec(unittest.TestCase): + + def test_ClassDef(self): + from miasm2.expression.expression import ExprInt32, ExprId, ExprMem, ExprCompose + from miasm2.arch.x86.arch import mn_x86 + from miasm2.ir.symbexec import symbexec + + addrX = ExprInt32(-1) + addr0 = ExprInt32(0) + addr1 = ExprInt32(1) + addr8 = ExprInt32(8) + addr9 = ExprInt32(9) + addr20 = ExprInt32(20) + addr40 = ExprInt32(40) + addr50 = ExprInt32(50) + mem0 = ExprMem(addr0) + mem1 = ExprMem(addr1) + mem8 = ExprMem(addr8) + mem9 = ExprMem(addr9) + mem20 = ExprMem(addr20) + mem40v = ExprMem(addr40, 8) + mem40w = ExprMem(addr40, 16) + mem50v = ExprMem(addr50, 8) + mem50w = ExprMem(addr50, 16) + id_x = ExprId('x') + id_y = ExprId('y', 8) + id_a = ExprId('a') + id_eax = ExprId('eax_init') + + e = symbexec( + mn_x86, {mem0: id_x, mem1: id_y, mem9: id_x, mem40w: id_x, mem50v: id_y, id_a: addr0, id_eax: addr0}) + self.assertEqual(e.find_mem_by_addr(addr0), mem0) + self.assertEqual(e.find_mem_by_addr(addrX), None) + self.assertEqual(e.eval_ExprMem(ExprMem(addr1 - addr1)), id_x) + self.assertEqual(e.eval_ExprMem(ExprMem(addr1, 8)), id_y) + self.assertEqual(e.eval_ExprMem(ExprMem(addr1 + addr1)), ExprCompose( + [(id_x[16:32], 0, 16), (ExprMem(ExprInt32(4), 16), 16, 32)])) + self.assertEqual(e.eval_ExprMem(mem8), ExprCompose( + [(id_x[0:24], 0, 24), (ExprMem(ExprInt32(11), 8), 24, 32)])) + self.assertEqual(e.eval_ExprMem(mem40v), id_x[:8]) + self.assertEqual(e.eval_ExprMem(mem50w), ExprCompose( + [(id_y, 0, 8), (ExprMem(ExprInt32(51), 8), 8, 16)])) + self.assertEqual(e.eval_ExprMem(mem20), mem20) + e.func_read = lambda x: x + self.assertEqual(e.eval_ExprMem(mem20), mem20) + self.assertEqual(set(e.modified()), set(e.symbols)) + self.assertRaises( + KeyError, e.symbols.__getitem__, ExprMem(ExprInt32(100))) + +if __name__ == '__main__': + testsuite = unittest.TestLoader().loadTestsFromTestCase(TestSymbExec) + report = unittest.TextTestRunner(verbosity=2).run(testsuite) + exit(len(report.errors + report.failures)) diff --git a/test/test_all.py b/test/test_all.py new file mode 100644 index 00000000..378755a4 --- /dev/null +++ b/test/test_all.py @@ -0,0 +1,443 @@ +import subprocess +import sys +import os +import time +import argparse +import tempfile + +# Available tests + +all_tests = { + "test": { + "architecture": [ + ["arch/x86/arch.py"], + ["arch/arm/arch.py"], + ["arch/arm/sem.py"], + ["arch/msp430/arch.py"], + ["arch/msp430/sem.py"], + ["arch/sh4/arch.py"], + ], + "core": [ + ["core/interval.py"], + ["core/graph.py"], + ["core/parse_asm.py"], + ], + "expression": [ + ["expression/modint.py"], + ["expression/stp.py"], + ["expression/simplifications.py"], + ], + "ir": [ + ["ir/ir2C.py"], + ["ir/symbexec.py"], + ], + "order": [ + "architecture", + "core", + "expression", + "ir", + ], + }, + "example": { + "assembler": [ + ["asm_x86.py"], + ["asm_arm.py"], + ["asm_box_x86_32.py"], + ["asm_box_x86_32_enc.py"], + ["asm_box_x86_32_mod.py"], + ["asm_box_x86_32_mod_self.py"], + ["asm_box_x86_32_repmod.py"], + ["disasm_01.py"], + ["disasm_02.py"], + ["disasm_03.py", "box_upx.exe", "0x410f90"], + ], + "expression": [ + ["symbol_exec.py"], + ["expression/manip_expression1.py"], + ["expression/manip_expression2.py"], + ["expression/manip_expression3.py"], + ["expression/manip_expression4.py", + "expression/sc_connect_back.bin", "0x2e"], + ["expression/manip_expression5.py"], + ["expression/manip_expression6.py"], + ["expression/manip_expression7.py"], + ["test_dis.py", "-g", "-s", "-m", "arm", "demo_arm.bin", "0"], + ["test_dis.py", "-g", "-s", "-m", + "x86_32", "box_x86_32.bin", "0x401000"], + ["expression/solve_condition_stp.py", + "expression/simple_test.bin"], + ], + "jitter": [ + ["unpack_upx.py", "--jitter", "tcc", "box_upx.exe"], + ["unpack_upx.py", "--jitter", "llvm", "box_upx.exe"], + ["test_jit_x86_32.py", "x86_32_sc.bin"], + ["test_jit_arm.py", "md5_arm", "A684"], + ["sandbox_pe_x86_32.py", "--jitter", "tcc", "box_x86_32.bin"], + ["sandbox_pe_x86_32.py", "--jitter", "llvm", "box_x86_32.bin"], + ["sandbox_pe_x86_32.py", "--jitter", "tcc", "box_x86_32_enc.bin"], + ["sandbox_pe_x86_32.py", "--jitter", "llvm", "box_x86_32_enc.bin"], + ["sandbox_pe_x86_32.py", "--jitter", "tcc", "box_x86_32_mod.bin"], + ["sandbox_pe_x86_32.py", "--jitter", "llvm", "box_x86_32_mod.bin"], + ["sandbox_pe_x86_32.py", "--jitter", + "tcc", "box_x86_32_mod_self.bin"], + ["sandbox_pe_x86_32.py", "--jitter", + "llvm", "box_x86_32_mod_self.bin"], + ["sandbox_pe_x86_32.py", "--jitter", + "tcc", "box_x86_32_repmod.bin"], + ["sandbox_pe_x86_32.py", "--jitter", + "llvm", "box_x86_32_repmod.bin"], + ], + "order": [ + "assembler", + "expression", + "jitter", + ], + }, + "order": [ + "test", + "example", + ], +} + +# Cosmetic + + +def getTerminalSize(): + "Return the size of the terminal : COLUMNS, LINES" + + env = os.environ + + def ioctl_GWINSZ(fd): + try: + import fcntl + import termios + import struct + import os + cr = struct.unpack('hh', fcntl.ioctl(fd, termios.TIOCGWINSZ, + '1234')) + except: + return + return cr + cr = ioctl_GWINSZ(0) or ioctl_GWINSZ(1) or ioctl_GWINSZ(2) + if not cr: + try: + fd = os.open(os.ctermid(), os.O_RDONLY) + cr = ioctl_GWINSZ(fd) + os.close(fd) + except: + pass + if not cr: + cr = (env.get('LINES', 25), env.get('COLUMNS', 80)) + return int(cr[1]), int(cr[0]) + + +WIDTH = getTerminalSize()[0] +colors = {"red": "\033[91;1m", + "end": "\033[0m", + "green": "\033[92;1m", + "lightcyan": "\033[96m", + "blue": "\033[94;1m"} + + +def write_colored(text, color, already_printed=0): + text_colored = colors[color] + text + colors["end"] + print " " * (WIDTH - already_printed - len(text)) + text_colored + + +def write_underline(text): + print "\033[4m" + text + colors["end"] + + +def print_conf(conf, value): + return colors["green"] + conf + ": " + colors["end"] + str(value) + + +def clr_screen(global_state, pstate): + "Update the screen to display some information" + + # Header + to_print = [] + to_print.append(" " * (global_state["termSize"][0] / 2 - 10) + colors[ + "blue"] + "Miasm2 Regression tests" + colors["end"]) + to_print.append("") + to_print.append("=" * global_state["termSize"][0]) + to_print.append("") + to_print.append(print_conf("Current mode", "Multiprocessing")) + to_print.append(print_conf("Nb CPU detected", global_state["cpu_c"])) + to_print.append("") + to_print.append("=" * global_state["termSize"][0]) + to_print.append("") + to_print.append( + print_conf("Current section", global_state["section"].upper())) + to_print.append( + print_conf("Current subsection", global_state["subsection"].upper())) + test_done = 0 + test_failed = 0 + message = global_state["message"] + "\n" + for k, v in pstate.items(): + if v["status"] != "running": + test_done += 1 + if v["status"] != 0: + test_failed += 1 + message += colors["red"] + "FAIL: " + colors["end"] + k + message += v["message"] + "\n" + + to_print.append(print_conf("Success rate", "%d/%d" % + (test_done - test_failed, test_done))) + printed_time = time.strftime( + "%M:%S", time.gmtime(time.time() - global_state["init_time"])) + to_print.append(print_conf("Cumulated time", printed_time)) + to_print.append("") + to_print.append("=" * global_state["termSize"][0]) + + cur = "\n".join(to_print) + cur += "\n" + + # Message + cur += message + print cur + already_printed = cur.count("\n") + + # Current state + current_job = [] + for t in pstate.values(): + if t["status"] == "running": + current_job.append(t) + print "\n" * (global_state["termSize"][1] - already_printed - 3 - len(current_job)) + + for j in current_job: + s = "[" + colors["lightcyan"] + j["command"] + colors["end"] + s_end = time.strftime( + "%M:%Ss", time.gmtime(time.time() - j["init_time"])) + l = len(j["command"]) + len(s_end) + 4 + len(str(j["pid"])) + 2 + s_end += " " + colors["blue"] + str(j["pid"]) + colors["end"] + "]" + print "%s%s%s" % (s, " " * (global_state["termSize"][0] - l), s_end) + +# Tests handling + + +def are_tests_finished(test_names, done): + for t in test_names: + if t not in done: + return False + return True + + +def are_tests_finished_multi(test_names, pstate): + for t in test_names: + t = " ".join(t) + if t not in pstate.keys(): + return False + if pstate[t]["status"] == "running": + return False + return True + + +def test_iter(done): + "Return an iterator on next tests, wait for previous sections" + + for section_name in all_tests["order"]: + # Go to the right directory + os.chdir(os.path.join("..", section_name)) + + # Update global state + section_content = all_tests[section_name] + write_underline(section_name.upper()) + + for subsection_name in section_content["order"]: + subsection_content = section_content[subsection_name] + write_underline("%s > %s" % (section_name.upper(), + subsection_name.upper())) + for test_line in subsection_content: + yield test_line + + while not(are_tests_finished(subsection_content, done)): + time.sleep(0.050) + + +def test_iter_multi(global_state, pstate): + "Multiprocessor version of test_iter" + + # Global message : subsections done + message = "" + + for section_name in all_tests["order"]: + # Update global state + section_content = all_tests[section_name] + global_state["section"] = section_name + + for subsection_name in section_content["order"]: + subsection_content = section_content[subsection_name] + beg_time = time.time() + global_state["subsection"] = subsection_name + + for test_line in subsection_content: + yield test_line + + while not(are_tests_finished_multi(subsection_content, pstate)): + # Wait for task to finish, update the screen + time.sleep(0.100) + clr_screen(global_state, pstate) + + message += "%s > %s completed in %.08f seconds\n" % (section_name.upper(), + subsection_name.upper( + ), + time.time() - beg_time) + global_state["message"] = message + + # Final update + clr_screen(global_state, pstate) + + +def run_test(test, coveragerc=None): + s = "Running tests on %s ..." % " ".join(test) + sys.stdout.write(s) + sys.stdout.flush() + + args = test + if coveragerc is not None: + args = ["-m", "coverage", "run", "--rcfile", coveragerc, "-a"] + test + + # Launch test + testpy = subprocess.Popen(["python"] + args, stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + outputs = testpy.communicate() + + # Check result + if testpy.returncode == 0: + write_colored("OK", "green", len(s)) + else: + write_colored("ERROR", "red", len(s)) + print outputs[1] + + +def run_test_parallel(test, current, global_state): + + pid = os.getpid() + test_key = " ".join(test) + + # Keep current PID + current[test_key] = {"status": "running", + "pid": pid, + "command": test_key, + "init_time": time.time()} + + # Go to the right directory + os.chdir(os.path.join("..", global_state["section"])) + + # Launch test + testpy = subprocess.Popen(["python"] + test, stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + outputs = testpy.communicate() + + # Check result + message = "" + if testpy.returncode != 0: + message = outputs[1] + + # Update result + current[test_key] = {"status": testpy.returncode, + "message": message} + +# Multiprocessing handling + +try: + from multiprocessing import Manager, Pool, cpu_count + multiproc = True +except ImportError: + multiproc = False + +# Argument parsing +parser = argparse.ArgumentParser(description="Miasm2 testing tool") +parser.add_argument("-m", "--mono", help="Force monothreading", + action="store_true") +parser.add_argument("-c", "--coverage", help="Include code coverage", + action="store_true") +args = parser.parse_args() + +if args.mono is True or args.coverage is True: + multiproc = False + +# Handle coverage +coveragerc = None +if args.coverage is True: + try: + import coverage + except ImportError: + print "%(red)s[Coverage]%(end)s Python 'coverage' module is required" % colors + exit(-1) + + # Create directory + suffix = "_" + str(int(time.time())) + cov_dir = tempfile.mkdtemp(suffix, "m2_coverage_") + + # Create configuration file + coveragerc = os.path.join(cov_dir, ".coveragerc") + coverage = os.path.join(cov_dir, ".coverage") + + from ConfigParser import ConfigParser + from os.path import expanduser + + config = ConfigParser() + config.read(['/etc/coveragerc', expanduser('~/.coveragerc')]) + if not config.has_section('run'): + config.add_section('run') + config.set('run', 'data_file', coverage) + config.write(open(coveragerc, 'w')) + + # Inform the user + d = {"blue": colors['blue'], + "end": colors['end'], + "cov_dir": cov_dir} + print "[%(blue)sCoverage%(end)s] Report will be written in %(cov_dir)s" % d + +# Handle llvm modularity + +llvm = True +try: + import llvm +except ImportError: + llvm = False + +# if llvm.version != (3,2): +# llvm = False + +if llvm is False: + print "%(red)s[LLVM]%(end)s Python 'py-llvm 3.2' module is required for llvm tests" % colors + + # Remove llvm tests + for test in all_tests["example"]["jitter"]: + if "llvm" in test: + all_tests["example"]["jitter"].remove(test) + print "%(red)s[LLVM]%(end)s Remove" % colors, " ".join(test) + + # Let the user see messages + time.sleep(0.5) + +# Run tests + +if multiproc is False: + done = list() + for test in test_iter(done): + run_test(test, coveragerc=coveragerc) + done.append(test) + +else: + # Parallel version + cpu_c = cpu_count() + global_state = {"cpu_c": cpu_c, + "init_time": time.time(), + "termSize": getTerminalSize(), + "message": ""} + + manager = Manager() + pool = Pool(processes=cpu_c) + current = manager.dict() + + for test in test_iter_multi(global_state, current): + pool.apply_async(run_test_parallel, (test, + current, + global_state)) + + pool.close() + pool.join() |