1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
#! /usr/bin/env python2
#-*- coding:utf-8 -*-
# Loosely based on ARM's sem.py
from __future__ import print_function
from builtins import range
from future.utils import viewitems
import unittest
import logging
import copy
from miasm2.ir.symbexec import SymbolicExecutionEngine
from miasm2.arch.x86.arch import mn_x86 as mn
from miasm2.arch.x86.sem import ir_x86_32 as ir_32, ir_x86_64 as ir_64
from miasm2.arch.x86.regs import *
from miasm2.expression.expression import *
from miasm2.expression.simplifications import expr_simp
from miasm2.core import parse_asm, asmblock
from miasm2.core.locationdb import LocationDB
logging.getLogger('cpuhelper').setLevel(logging.ERROR)
EXCLUDE_REGS = set([ir_32().IRDst, ir_64().IRDst])
m32 = 32
m64 = 64
def symb_exec(lbl, ir_arch, ircfg, inputstate, debug):
sympool = dict(regs_init)
sympool.update(inputstate)
symexec = SymbolicExecutionEngine(ir_arch, sympool)
symexec.run_at(ircfg, lbl)
if debug:
for k, v in viewitems(symexec.symbols):
if regs_init.get(k, None) != v:
print(k, v)
return {
k: v for k, v in viewitems(symexec.symbols)
if k not in EXCLUDE_REGS and regs_init.get(k, None) != v
}
def compute(ir, mode, asm, inputstate={}, debug=False):
loc_db = LocationDB()
instr = mn.fromstring(asm, loc_db, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
ir_arch = ir(loc_db)
ircfg = ir_arch.new_ircfg()
lbl = ir_arch.add_instr_to_ircfg(instr, ircfg)
return symb_exec(lbl, ir_arch, ircfg, inputstate, debug)
def compute_txt(ir, mode, txt, inputstate={}, debug=False):
asmcfg, loc_db = parse_asm.parse_txt(mn, mode, txt)
loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0)
patches = asmblock.asm_resolve_final(mn, asmcfg, loc_db)
ir_arch = ir(loc_db)
lbl = loc_db.get_name_location("main")
ircfg = ir_arch.new_ircfg_from_asmcfg(asmcfg)
return symb_exec(lbl, ir_arch, ircfg, inputstate, debug)
op_add = lambda a, b: a+b
op_sub = lambda a, b: a-b
op_mul = lambda a, b: a*b
op_div = lambda a, b: a //b
op_and = lambda a, b: a&b
op_or = lambda a, b: a|b
op_xor = lambda a, b: a^b
def int_vec_op(op, elt_size, reg_size, arg1, arg2):
arg1 = copy.deepcopy(arg1)
arg2 = copy.deepcopy(arg2)
assert(reg_size % elt_size == 0)
ret = 0
mask = (1<<elt_size)-1
nelts = reg_size // elt_size
for i in range(0, nelts):
ret |= (op(arg1 & mask, arg2 & mask) & mask) << (i*elt_size)
arg1 >>= elt_size
arg2 >>= elt_size
return ret
MMX_V0 = 0x0001020304050607
MMX_V1 = 0x0101010101010101
MMX_A = ExprId('A', 64)
MMX_B = ExprId('B', 64)
SSE_V0 = 0x00010203040506070001020304050607
SSE_V1 = 0x01010101010101010101010101010101
SSE_A = ExprId('A', 128)
SSE_B = ExprId('B', 128)
class TestX86Semantic(unittest.TestCase):
def int_sse_op(self, name, op, elt_size, reg_size, arg1, arg2):
arg1 = ExprInt(arg1, XMM0.size)
arg2 = ExprInt(arg2, XMM0.size)
sem = compute(ir_32, m32, '%s XMM0, XMM1' % name,
{XMM0: arg1, XMM1: arg2},
False)
ref = ExprInt(int_vec_op(op, elt_size, reg_size, arg1.arg, arg2.arg), XMM0.size)
self.assertEqual(sem, {XMM0: ref, XMM1: arg2})
def symb_sse_ops(self, names, a, b, ref):
asm = "\n\t".join(["%s XMM0, XMM1" % name for name in names])
asm = "main:\n\t" + asm
sem = compute_txt(ir_32, m32, asm,
{XMM0: a, XMM1: b},
False)
self.assertEqual(sem, {XMM0: ref, XMM1: b})
def mmx_logical_op(self, name, op, arg1, arg2):
arg1 = ExprInt(arg1, mm0.size)
arg2 = ExprInt(arg2, mm0.size)
sem = compute(ir_32, m32, '%s MM0, MM1' % name,
{mm0: arg1, mm1: arg2},
False)
ref = ExprInt(op(arg1.arg, arg2.arg), mm0.size)
self.assertEqual(sem, {mm0: ref, mm1: arg2})
def sse_logical_op(self, name, op, arg1, arg2):
arg1 = ExprInt(arg1, XMM0.size)
arg2 = ExprInt(arg2, XMM1.size)
sem = compute(ir_32, m32, '%s XMM0, XMM1' % name,
{XMM0: arg1, XMM1: arg2},
False)
ref = ExprInt(op(arg1.arg, arg2.arg), XMM0.size)
self.assertEqual(sem, {XMM0: ref, XMM1: arg2})
def test_SSE_ADD(self):
for op in (("PADDB", 8), ("PADDW", 16), ("PADDD", 32), ("PADDQ", 64)):
self.int_sse_op(op[0], op_add, op[1], 128, SSE_V0, SSE_V0)
self.int_sse_op(op[0], op_add, op[1], 128, SSE_V0, SSE_V1)
self.int_sse_op(op[0], op_add, op[1], 128, SSE_V1, SSE_V0)
self.int_sse_op(op[0], op_add, op[1], 128, SSE_V1, SSE_V1)
def test_SSE_SUB(self):
for op in (("PSUBB", 8), ("PSUBW", 16), ("PSUBD", 32), ("PSUBQ", 64)):
self.int_sse_op(op[0], op_sub, op[1], 128, SSE_V0, SSE_V0)
self.int_sse_op(op[0], op_sub, op[1], 128, SSE_V0, SSE_V1)
self.int_sse_op(op[0], op_sub, op[1], 128, SSE_V1, SSE_V0)
self.int_sse_op(op[0], op_sub, op[1], 128, SSE_V1, SSE_V1)
def test_SSE_simp(self):
self.symb_sse_ops(["PADDB", "PADDB", "PSUBB"], ExprInt(0, XMM0.size), SSE_A, SSE_A)
self.symb_sse_ops(["PADDB", "PADDQ", "PSUBQ"], ExprInt(0, XMM0.size), SSE_A, SSE_A)
self.symb_sse_ops(["PADDB", "PSUBQ", "PADDQ"], ExprInt(0, XMM0.size), SSE_A, SSE_A)
def test_AND(self):
self.mmx_logical_op("PAND", op_and, MMX_V0, MMX_V1)
self.sse_logical_op("PAND", op_and, SSE_V0, SSE_V1)
if __name__ == '__main__':
testsuite = unittest.TestLoader().loadTestsFromTestCase(TestX86Semantic)
report = unittest.TextTestRunner(verbosity=2).run(testsuite)
exit(len(report.errors + report.failures))
|