static void op_fillval(RAnal *anal, RAnalOp *op, csh *handle, cs_insn *insn) {
static RRegItem reg;
switch (op->type & R_ANAL_OP_TYPE_MASK) {
case R_ANAL_OP_TYPE_LOAD:
if (OPERAND(1).type == MIPS_OP_MEM) {
ZERO_FILL (reg);
op->src[0] = r_anal_value_new ();
op->src[0]->reg = ®
parse_reg_name (op->src[0]->reg, *handle, insn, 1);
op->src[0]->delta = OPERAND(1).mem.disp;
}
break;
case R_ANAL_OP_TYPE_STORE:
if (OPERAND(1).type == MIPS_OP_MEM) {
ZERO_FILL (reg);
op->dst = r_anal_value_new ();
op->dst->reg = ®
parse_reg_name (op->dst->reg, *handle, insn, 1);
op->dst->delta = OPERAND(1).mem.disp;
}
break;
case R_ANAL_OP_TYPE_SHL:
case R_ANAL_OP_TYPE_SHR:
case R_ANAL_OP_TYPE_SAR:
case R_ANAL_OP_TYPE_XOR:
case R_ANAL_OP_TYPE_SUB:
case R_ANAL_OP_TYPE_AND:
case R_ANAL_OP_TYPE_ADD:
case R_ANAL_OP_TYPE_OR:
SET_SRC_DST_3_REG_OR_IMM (op);
break;
case R_ANAL_OP_TYPE_MOV:
SET_SRC_DST_2_REGS (op);
break;
case R_ANAL_OP_TYPE_DIV:
SET_SRC_DST_3_REGS (op);
break;
}
if (insn && (insn->id == MIPS_INS_SLTI || insn->id == MIPS_INS_SLTIU)) {
SET_SRC_DST_3_IMM (op);
}
}
static int analop(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len) {
int n, ret, opsize = -1;
static csh hndl = 0;
static csh *handle = &hndl;
static int omode = -1;
static int obits = 32;
cs_insn* insn;
int mode = anal->big_endian? CS_MODE_BIG_ENDIAN: CS_MODE_LITTLE_ENDIAN;
mode |= (anal->bits==64)? CS_MODE_64: CS_MODE_32;
if (mode != omode || anal->bits != obits) {
cs_close (&hndl);
hndl = 0;
omode = mode;
obits = anal->bits;
}
// XXX no arch->cpu ?!?! CS_MODE_MICRO, N64
op->delay = 0;
op->type = R_ANAL_OP_TYPE_ILL;
if (len<4)
return -1;
op->size = 4;
if (hndl == 0) {
ret = cs_open (CS_ARCH_MIPS, mode, &hndl);
if (ret != CS_ERR_OK) goto fin;
cs_option (hndl, CS_OPT_DETAIL, CS_OPT_ON);
}
n = cs_disasm (hndl, (ut8*)buf, len, addr, 1, &insn);
if (n<1 || insn->size<1)
goto beach;
op->type = R_ANAL_OP_TYPE_NULL;
op->delay = 0;
op->jump = UT64_MAX;
op->fail = UT64_MAX;
opsize = op->size = insn->size;
switch (insn->id) {
case MIPS_INS_INVALID:
op->type = R_ANAL_OP_TYPE_ILL;
break;
case MIPS_INS_LB:
case MIPS_INS_LBU:
case MIPS_INS_LBUX:
case MIPS_INS_LW:
case MIPS_INS_LWC1:
case MIPS_INS_LWC2:
case MIPS_INS_LWL:
case MIPS_INS_LWR:
case MIPS_INS_LWXC1:
case MIPS_INS_LD:
case MIPS_INS_LDC1:
case MIPS_INS_LDC2:
case MIPS_INS_LDL:
case MIPS_INS_LDR:
case MIPS_INS_LDXC1:
op->type = R_ANAL_OP_TYPE_LOAD;
op->refptr = 4;
switch (OPERAND(1).type) {
case MIPS_OP_MEM:
if (OPERAND(1).mem.base == MIPS_REG_GP) {
op->ptr = anal->gp + OPERAND(1).mem.disp;
op->refptr = 4;
}
break;
case MIPS_OP_IMM:
op->ptr = OPERAND(1).imm;
break;
case MIPS_OP_REG:
// wtf?
break;
default:
break;
}
// TODO: fill
break;
case MIPS_INS_SW:
case MIPS_INS_SWC1:
case MIPS_INS_SWC2:
case MIPS_INS_SWL:
case MIPS_INS_SWR:
case MIPS_INS_SWXC1:
op->type = R_ANAL_OP_TYPE_STORE;
break;
case MIPS_INS_NOP:
op->type = R_ANAL_OP_TYPE_NOP;
break;
case MIPS_INS_SYSCALL:
case MIPS_INS_BREAK:
op->type = R_ANAL_OP_TYPE_TRAP;
break;
case MIPS_INS_JALR:
op->type = R_ANAL_OP_TYPE_UCALL;
op->delay = 1;
break;
case MIPS_INS_JAL:
case MIPS_INS_JALS:
case MIPS_INS_JALX:
case MIPS_INS_JRADDIUSP:
case MIPS_INS_BAL:
// (no blezal/bgtzal or blezall/bgtzall, only blezalc/bgtzalc)
case MIPS_INS_BLTZAL: // Branch on <0 and link
case MIPS_INS_BGEZAL: // Branch on >=0 and link
case MIPS_INS_BLTZALL: // "likely" versions
case MIPS_INS_BGEZALL:
case MIPS_INS_BLTZALC: // compact versions
case MIPS_INS_BLEZALC:
case MIPS_INS_BGEZALC:
case MIPS_INS_BGTZALC:
case MIPS_INS_JIALC:
case MIPS_INS_JIC:
op->type = R_ANAL_OP_TYPE_CALL;
op->jump = IMM(0);
switch (insn->id) {
case MIPS_INS_JIALC:
case MIPS_INS_JIC:
case MIPS_INS_BLTZALC:
case MIPS_INS_BLEZALC:
case MIPS_INS_BGEZALC:
case MIPS_INS_BGTZALC:
// compact vesions (no delay)
op->delay = 0;
op->fail = addr+4;
break;
default:
op->delay = 1;
op->fail = addr+8;
break;
}
break;
case MIPS_INS_LUI:
case MIPS_INS_MOVE:
op->type = R_ANAL_OP_TYPE_MOV;
SET_SRC_DST_2_REGS (op);
break;
case MIPS_INS_ADD:
case MIPS_INS_ADDI:
case MIPS_INS_ADDU:
case MIPS_INS_ADDIU:
case MIPS_INS_DADD:
case MIPS_INS_DADDI:
case MIPS_INS_DADDIU:
SET_VAL (op, 2);
SET_SRC_DST_3_REG_OR_IMM (op);
op->type = R_ANAL_OP_TYPE_ADD;
break;
case MIPS_INS_SUB:
case MIPS_INS_SUBV:
case MIPS_INS_SUBVI:
case MIPS_INS_DSUBU:
case MIPS_INS_FSUB:
case MIPS_INS_FMSUB:
case MIPS_INS_SUBU:
case MIPS_INS_DSUB:
case MIPS_INS_SUBS_S:
case MIPS_INS_SUBS_U:
case MIPS_INS_SUBUH:
case MIPS_INS_SUBUH_R:
SET_VAL (op,2);
SET_SRC_DST_3_REG_OR_IMM (op);
op->type = R_ANAL_OP_TYPE_SUB;
break;
case MIPS_INS_MULV:
case MIPS_INS_MULT:
case MIPS_INS_MULSA:
case MIPS_INS_FMUL:
case MIPS_INS_MUL:
case MIPS_INS_DMULT:
case MIPS_INS_DMULTU:
op->type = R_ANAL_OP_TYPE_MUL;
break;
case MIPS_INS_XOR:
case MIPS_INS_XORI:
SET_VAL (op,2);
SET_SRC_DST_3_REG_OR_IMM (op);
op->type = R_ANAL_OP_TYPE_XOR;
break;
case MIPS_INS_AND:
case MIPS_INS_ANDI:
SET_VAL (op,2);
SET_SRC_DST_3_REG_OR_IMM (op);
op->type = R_ANAL_OP_TYPE_AND;
break;
case MIPS_INS_NOT:
op->type = R_ANAL_OP_TYPE_NOT;
break;
case MIPS_INS_OR:
case MIPS_INS_ORI:
SET_VAL (op,2);
SET_SRC_DST_3_REG_OR_IMM (op);
op->type = R_ANAL_OP_TYPE_OR;
break;
case MIPS_INS_DIV:
case MIPS_INS_DIVU:
case MIPS_INS_DDIV:
case MIPS_INS_DDIVU:
case MIPS_INS_FDIV:
case MIPS_INS_DIV_S:
case MIPS_INS_DIV_U:
SET_SRC_DST_3_REGS (op);
op->type = R_ANAL_OP_TYPE_DIV;
break;
case MIPS_INS_CMPGDU:
case MIPS_INS_CMPGU:
case MIPS_INS_CMPU:
case MIPS_INS_CMPI:
op->type = R_ANAL_OP_TYPE_CMP;
break;
case MIPS_INS_J:
case MIPS_INS_B:
case MIPS_INS_BZ:
case MIPS_INS_BEQ:
case MIPS_INS_BNZ:
case MIPS_INS_BNE:
case MIPS_INS_BEQZ:
case MIPS_INS_BNEG:
case MIPS_INS_BNEGI:
case MIPS_INS_BNEZ:
case MIPS_INS_BTEQZ:
case MIPS_INS_BTNEZ:
case MIPS_INS_BLTZ:
case MIPS_INS_BLTZL:
case MIPS_INS_BLEZ:
case MIPS_INS_BLEZL:
case MIPS_INS_BGEZ:
case MIPS_INS_BGEZL:
case MIPS_INS_BGTZ:
case MIPS_INS_BGTZL:
case MIPS_INS_BLEZC:
case MIPS_INS_BGEZC:
case MIPS_INS_BLTZC:
case MIPS_INS_BGTZC:
if (insn->id == MIPS_INS_J || insn->id == MIPS_INS_B ) {
op->type = R_ANAL_OP_TYPE_JMP;
} else {
op->type = R_ANAL_OP_TYPE_CJMP;
}
if (OPERAND(0).type == MIPS_OP_IMM) {
op->jump = IMM(0);
} else if (OPERAND(1).type == MIPS_OP_IMM) {
op->jump = IMM(1);
} else if (OPERAND(2).type == MIPS_OP_IMM) {
op->jump = IMM(2);
}
switch (insn->id) {
case MIPS_INS_BLEZC:
case MIPS_INS_BGEZC:
case MIPS_INS_BLTZC:
case MIPS_INS_BGTZC:
// compact vesions (no delay)
op->delay = 0;
op->fail = addr+4;
break;
default:
op->delay = 1;
op->fail = addr+8;
break;
}
break;
case MIPS_INS_JR:
case MIPS_INS_JRC:
op->type = R_ANAL_OP_TYPE_JMP;
op->delay = 1;
// register is $ra, so jmp is a return
if (insn->detail->mips.operands[0].reg == MIPS_REG_RA) {
op->type = R_ANAL_OP_TYPE_RET;
}
break;
case MIPS_INS_SLTI:
case MIPS_INS_SLTIU:
SET_SRC_DST_3_IMM (op);
SET_VAL (op,2);
break;
case MIPS_INS_SHRAV:
case MIPS_INS_SHRAV_R:
case MIPS_INS_SHRA:
case MIPS_INS_SHRA_R:
case MIPS_INS_SRA:
op->type = R_ANAL_OP_TYPE_SAR;
SET_SRC_DST_3_REG_OR_IMM (op);
SET_VAL (op,2);
break;
case MIPS_INS_SHRL:
case MIPS_INS_SRLV:
case MIPS_INS_SRL:
op->type = R_ANAL_OP_TYPE_SHR;
SET_SRC_DST_3_REG_OR_IMM (op);
SET_VAL (op,2);
break;
case MIPS_INS_SLLV:
case MIPS_INS_SLL:
op->type = R_ANAL_OP_TYPE_SHL;
SET_SRC_DST_3_REG_OR_IMM (op);
SET_VAL (op,2);
break;
}
beach:
if (anal->decode) {
if (analop_esil (anal, op, addr, buf, len, &hndl, insn) != 0)
r_strbuf_fini (&op->esil);
}
cs_free (insn, n);
//cs_close (&handle);
fin:
return opsize;
}