int main()
{
xed_tables_init();
std::map<int, AbstractVariable*> container;
// main analyse process
VariableRecovery(code, (code + 64), container);
// print the variables.
printf("\n\nThe Variables:\n");
std::map<int, AbstractVariable*>::iterator ptr;
for(ptr = container.begin(); ptr != container.end(); ptr++)
{
printf("variable %d: offset: %d, size: %d\n", (ptr -> first + 6), (ptr -> second) -> offset, (ptr -> second) -> size);
}
printf("\n\n");
// infere the type and print it.
TypeInference(code, (code + 64), container);
return 0;
}
void init_disas(void)
{
xed_tables_init();
xed_state_zero(&dstate);
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b, XED_ADDRESS_WIDTH_32b);
}
Disasm::Disasm(const Disasm::Options& opts)
: m_opts(opts)
{
#ifdef HAVE_LIBXED
xed_state_init(&m_xedState, XED_MACHINE_MODE_LONG_64,
XED_ADDRESS_WIDTH_64b, XED_ADDRESS_WIDTH_64b);
xed_tables_init();
xed_register_disassembly_callback(addressToSymbol);
#endif // HAVE_LIBXED
}
int main(int argc, char** argv) {
// initialize the XED tables -- one time.
xed_tables_init();
dump_insts();
return 0;
(void) argc; (void) argv; //pacify compiler
}
Disasm::Disasm(const Disasm::Options& opts)
: m_opts(opts)
{
#ifdef HAVE_LIBXED
xed_state_init(&m_xedState, XED_MACHINE_MODE_LONG_64,
XED_ADDRESS_WIDTH_64b, XED_ADDRESS_WIDTH_64b);
xed_tables_init();
#if XED_ENCODE_ORDER_MAX_ENTRIES == 28 // Older version of XED library
xed_register_disassembly_callback(addressToSymbol);
#endif
#endif // HAVE_LIBXED
}
int main(int argc, char** argv) {
xed_machine_mode_enum_t mmode;
xed_bool_t long_mode = 1;
xed_decoded_inst_t ild;
xed_uint_t length = 0;
xed_uint_t i;
#define NTIMES 100
xed_uint64_t t1,t2,delta[NTIMES],tot;
unsigned char itext[15] = { 0xf2, 0x2e, 0x4f, 0x0F, 0x85, 0x99,
0x00, 0x00, 0x00 };
xed_state_t dstate;
// initialize the XED tables -- one time.
xed_tables_init();
// The state of the machine -- required for decoding
if (long_mode) {
mmode=XED_MACHINE_MODE_LONG_64;
}
else {
mmode=XED_MACHINE_MODE_LEGACY_32;
}
dstate.mmode = mmode;
for(i=0;i<NTIMES;i++) {
t1 = xed_get_time();
xed_decoded_inst_zero_set_mode(&ild, &dstate);
//xed_ild_init(&ild, mmode, itext, 15);
xed_ild_decode(&ild, itext, XED_MAX_INSTRUCTION_BYTES);
t2 = xed_get_time();
delta[i] = t2-t1;
}
tot = 0;
for(i=0;i<NTIMES;i++) {
printf("Decode time[%3d] = " XED_FMT_LU "\n", i,delta[i]);
if (i>0)
tot += delta[i];
}
printf("Avg time = " XED_FMT_LU "\n", tot/(NTIMES-1));
print_ild(&ild);
printf("length = %d\n",length);
return 0;
(void) argc; (void) argv; //pacify compiler
}
/* XED2 initialization */
void xed2_init()
{
xed_tables_init ();
xed_state_zero (&dstate);
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
// Format options
xed_format_options_t xed_foptions;
xed_foptions.hex_address_before_symbolic_name = 1;
xed_foptions.no_sign_extend_signed_immediates = 1;
xed_foptions.omit_unit_scale = 1;
xed_foptions.xml_a = 0;
xed_foptions.xml_f = 0;
xed_format_set_options(xed_foptions);
}
int main(int argc, char** argv) {
xed_machine_mode_enum_t mmode;
xed_address_width_enum_t stack_addr_width;
xed_bool_t long_mode = 0;
// create the decoded instruction, and fill in the machine mode (dstate)
// make up a simple 2Byte instruction to decode
unsigned int bytes = 0;
unsigned char itext[15] = { 0xf, 0x85, 0x99, 0x00, 0x00, 0x00 };
// initialize the XED tables -- one time.
xed_tables_init();
// The state of the machine -- required for decoding
if (long_mode) {
mmode=XED_MACHINE_MODE_LONG_64;
stack_addr_width = XED_ADDRESS_WIDTH_64b;
}
else {
mmode=XED_MACHINE_MODE_LEGACY_32;
stack_addr_width = XED_ADDRESS_WIDTH_32b;
}
// This is a test of error handling. I vary the instuction length from
// 0 bytes to 15 bytes. Normally, you should send in 15 bytes of itext
// unless you are near the end of a page and don't want to take a page
// fault or tlb miss. Note, you have to reinitialize the xedd each time
// you try to decode in to it.
// Try different instruction lengths to see when XED recognizes an
// instruction as valid.
for(bytes = 0;bytes<=15;bytes++) {
xed_error_enum_t xed_error;
xed_decoded_inst_t xedd;
xed_decoded_inst_zero(&xedd);
xed_decoded_inst_set_mode(&xedd, mmode, stack_addr_width);
xed_error = xed_decode(&xedd,
XED_STATIC_CAST(const xed_uint8_t*,itext),
bytes);
printf("%d %s\n",(int)bytes, xed_error_enum_t2str(xed_error));
}
return 0;
(void) argc; (void) argv; //pacify compiler
}
int main(int argc, char** argv)
{
xed_bool_t long_mode = 1;
xed_decoded_inst_t xedd;
xed_state_t dstate;
unsigned char itext[15] = { 0xf2, 0x2e, 0x4f, 0x0F, 0x85, 0x99,
0x00, 0x00, 0x00 };
xed_tables_init(); // one time per process
if (long_mode)
dstate.mmode=XED_MACHINE_MODE_LONG_64;
else
dstate.mmode=XED_MACHINE_MODE_LEGACY_32;
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_ild_decode(&xedd, itext, XED_MAX_INSTRUCTION_BYTES);
printf("length = %d\n",xed_decoded_inst_get_length(&xedd));
return 0;
(void) argc; (void) argv; //pacify compiler
}
int
main(int argc, char** argv) {
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_bool_t prot16 = 0;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
xed_machine_mode_enum_t mmode;
xed_address_width_enum_t stack_addr_width;
xed_tables_init();
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
else if (argc > 2 && strcmp(argv[1], "-16") == 0)
prot16 = 1;
if (long_mode) {
first_argv = 2;
mmode=XED_MACHINE_MODE_LONG_64;
stack_addr_width =XED_ADDRESS_WIDTH_64b;
}
else if (prot16) {
first_argv = 2;
mmode=XED_MACHINE_MODE_LEGACY_16;
stack_addr_width =XED_ADDRESS_WIDTH_16b;
}
else {
first_argv=1;
mmode=XED_MACHINE_MODE_LEGACY_32;
stack_addr_width =XED_ADDRESS_WIDTH_32b;
}
xed_decoded_inst_zero(&xedd);
xed_decoded_inst_set_mode(&xedd, mmode, stack_addr_width);
for( i=first_argv ;i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0;u<bytes; u++)
printf("%02x ", XED_STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n",
xed_error_enum_t2str(xed_error));
exit(1);
}
print_operands(&xedd);
return 0;
}
int
main(int argc, char** argv) {
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_bool_t prot16 = 0;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
xed_machine_mode_enum_t mmode;
xed_address_width_enum_t stack_addr_width;
xed_encoder_request_t* enc_req;
xed_uint8_t array[XED_MAX_INSTRUCTION_BYTES];
unsigned int enc_olen, ilen = XED_MAX_INSTRUCTION_BYTES;
xed_error_enum_t encode_okay;
xed_bool_t change_to_long_mode = 0;
xed_tables_init();
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
else if (argc > 2 && strcmp(argv[1], "-16") == 0)
prot16 = 1;
if (long_mode) {
first_argv = 2;
mmode=XED_MACHINE_MODE_LONG_64;
stack_addr_width =XED_ADDRESS_WIDTH_64b;
}
else if (prot16) {
first_argv = 2;
mmode=XED_MACHINE_MODE_LEGACY_16;
stack_addr_width =XED_ADDRESS_WIDTH_16b;
}
else {
first_argv=1;
mmode=XED_MACHINE_MODE_LEGACY_32;
stack_addr_width =XED_ADDRESS_WIDTH_32b;
}
xed_decoded_inst_zero(&xedd);
xed_decoded_inst_set_mode(&xedd, mmode, stack_addr_width);
for( i=first_argv ;i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0;u<bytes; u++)
printf("%02x ", XED_STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n",
xed_error_enum_t2str(xed_error));
exit(1);
}
//memset(buffer,0,BUFLEN);
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = XED_STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format_context(syntax, &xedd, buffer, BUFLEN, 0, 0, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n",
xed_syntax_enum_t2str(syntax));
}
printf("\n\nPreparing to encode ...\n");
enc_req = &xedd; // they are basically the same now
// convert decode structure to proper encode structure
xed_encoder_request_init_from_decode(&xedd);
change_to_long_mode = 0;
if (change_to_long_mode) {
// change to 64b mode
xed_state_t state;
xed_operand_values_t* ov;
xed_state_init2(&state,XED_MACHINE_MODE_LONG_64,XED_ADDRESS_WIDTH_64b);
ov = xed_decoded_inst_operands(&xedd);
xed_operand_values_set_mode(ov, &state);
xed_encoder_request_set_effective_address_size(enc_req, 64);
// need to fix base regs...
//xed_operand_values_set_operand_reg(ov, XED_OPERAND_BASE0, XED_REG_RSI);
xed_encoder_request_set_effective_operand_width(enc_req, 32);
}
printf("Encoding...\n");
encode_okay = xed_encode(enc_req, array, ilen, &enc_olen);
if (encode_okay != XED_ERROR_NONE) {
printf("Error code = %s\n", xed_error_enum_t2str(encode_okay));
}
else {
unsigned int j;
printf("Encodable: ");
for(j=0;j<enc_olen;j++) {
printf("%02x", array[j]);
}
printf("\n");
}
return 0;
}
int
main(int argc, char** argv)
{
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_state_t dstate;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
xed_tables_init();
xed_state_zero(&dstate);
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
if (long_mode) {
first_argv = 2;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
}
else {
first_argv=1;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
}
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
for( i=first_argv ;i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0;u<bytes; u++)
printf("%02x ", STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
//memset(buffer,0,BUFLEN);
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format(syntax, &xedd, buffer, BUFLEN, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n", xed_syntax_enum_t2str(syntax));
}
return 0;
}
int main(int argn, char **argv)
{
uint32_t depend_id = 0;
char *tail;
static struct option long_options[] = {
{"depend_id", 1, 0, 'd'},
{0, 0, 0, 0}
};
xed_tables_init();
// The state of the machine -- required for decoding
xed_state_t dstate;
xed_state_zero(&dstate);
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
while (1) {
int option_index = 0;
int c = getopt_long(argn, argv, "d:", long_options,
&option_index);
if (c == -1) break;
switch (c)
{
case 0:
if (long_options[option_index].flag != 0)
break;
printf ("option %s", long_options[option_index].name);
if (optarg)
printf(" with arg %s", optarg);
printf("\n");
break;
case 'd':
depend_id = strtol(optarg, &tail, 0);
break;
default:
abort();
}
}
//trace_record_t rec;
if(optind >= argn) {
printf("usage: %s [-d id] trace_file\n", argv[0]);
return -1;
}
FILE *fp = fopen(argv[optind++],"r");
if(!fp) {
printf("cannnot open %s! errno=%d\n", argv[optind-1], errno);
return -1;
}
if(depend_id == 0)
print_all_records(fp);
else
trace_back(fp, depend_id);
fclose(fp);
return 0;
}
int
main(int argc, char** argv)
{
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_bool_t real_mode = 0;
xed_bool_t protected_16 = 0;
xed_state_t dstate;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
unsigned int memop_index = 0;
unsigned int memops = 0;
xed_uint64_t out_addr = 0;
xed_tables_init();
xed_agen_register_callback( register_callback, segment_callback);
xed_state_zero(&dstate);
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
if (argc > 2 && strcmp(argv[1], "-r") == 0)
real_mode = 1;
if (argc > 2 && strcmp(argv[1], "-16") == 0)
protected_16 = 1;
if (long_mode) {
first_argv = 2;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
}
else if (protected_16) {
first_argv = 2;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_16,
XED_ADDRESS_WIDTH_16b,
XED_ADDRESS_WIDTH_16b);
}
else if (real_mode) {
first_argv = 2;
/* we say that real mode uses 16b addressing even though the
addresses returned are 20b long. */
xed_state_init(&dstate,
XED_MACHINE_MODE_REAL_16,
XED_ADDRESS_WIDTH_16b,
XED_ADDRESS_WIDTH_16b);
}
else {
first_argv=1;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
}
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
for( i=first_argv ; i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0; u<bytes; u++)
printf("%02x ", STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format(syntax, &xedd, buffer, BUFLEN, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n", xed_syntax_enum_t2str(syntax));
}
memops = xed_decoded_inst_number_of_memory_operands(&xedd);
printf("\nNumber of memory operands: %d\n", (int)memops);
for(memop_index=0; memop_index<memops; memop_index++) {
xed_error = xed_agen(&xedd, memop_index, 0, &out_addr);
if (xed_error != XED_ERROR_NONE) {
fprintf(stderr,"Agen error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
printf("\tMemory agen%d: " XED_FMT_LX "\n", (int)memop_index, out_addr);
}
return 0;
}
int main(int argc, char** argv) {
xed_ild_t ild;
xed_uint_t uargc = (xed_uint_t)argc;
xed_uint_t length = 0;
xed_uint_t dlen = 0;
xed_uint_t i,j,input_nibbles=0;
xed_uint8_t itext[XED_MAX_INSTRUCTION_BYTES];
char src[MAX_INPUT_NIBBLES+1];
xed_state_t dstate;
xed_decoded_inst_t xedd;
xed_uint_t first_argv;
xed_uint_t bytes;
xed_error_enum_t xed_error;
xed_chip_enum_t chip = XED_CHIP_INVALID;
int already_set_mode = 0;
// initialize the XED tables -- one time.
xed_tables_init();
xed_state_zero(&dstate);
first_argv = 1;
dstate.mmode=XED_MACHINE_MODE_LEGACY_32;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_32b;
for(i=1;i< uargc;i++) {
if (strcmp(argv[i], "-64") == 0) {
assert(already_set_mode == 0);
already_set_mode = 1;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
first_argv++;
}
else if (strcmp(argv[i], "-16") == 0) {
assert(already_set_mode == 0);
already_set_mode = 1;
dstate.mmode=XED_MACHINE_MODE_LEGACY_16;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_16b;
first_argv++;
}
else if (strcmp(argv[i], "-s16") == 0) {
already_set_mode = 1;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_16b;
first_argv++;
}
else if (strcmp(argv[i], "-chip") == 0) {
assert(i+1 < uargc);
chip = str2xed_chip_enum_t(argv[i+1]);
printf("Setting chip to %s\n", xed_chip_enum_t2str(chip));
assert(chip != XED_CHIP_INVALID);
first_argv+=2;
}
}
assert(first_argv < uargc);
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
if (first_argv >= uargc) {
printf("Need some hex instruction nibbles");
exit(1);
}
for(i=first_argv;i<uargc;i++) {
for(j=0;argv[i][j];j++) {
assert(input_nibbles < MAX_INPUT_NIBBLES);
src[input_nibbles] = argv[i][j];
input_nibbles++;
}
}
src[input_nibbles] = 0;
if (input_nibbles & 1) {
printf("Need an even number of nibbles");
exit(1);
}
bytes = xed_convert_ascii_to_hex(src, itext, XED_MAX_INSTRUCTION_BYTES);
printf("Attempting to decode: ");
for(i=0;i<bytes;i++) {
printf("%02x", itext[i]);
}
printf("\n");
xed_ild_init(&ild, dstate.mmode, chip, itext, XED_MAX_INSTRUCTION_BYTES);
length = xed_instruction_length_decode(&ild);
print_ild(&ild);
printf("ILD length = %d\n",length);
xed_decoded_inst_set_input_chip(&xedd, chip);
xed_error = xed_decode(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error) {
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
printf("Not enough bytes provided\n");
exit(1);
case XED_ERROR_INVALID_FOR_CHIP:
printf("The instruction was not valid for the specified chip.\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
printf("Could not decode given input.\n");
exit(1);
default:
printf("Unhandled error code %s\n",xed_error_enum_t2str(xed_error));
exit(1);
}
dlen = xed_decoded_inst_get_length(&xedd);
printf ("Traditional length = %d\n", dlen);
if (dlen != length) {
printf ("Length error\n");
exit(1);
}
printf ("Length matched\n");
return 0;
}
extern int main(int argc, char *argv[])
{
struct pt_image_section_cache *iscache;
struct ptxed_decoder decoder;
struct ptxed_options options;
struct ptxed_stats stats;
struct pt_config config;
struct pt_image *image;
const char *prog;
int errcode, i;
if (!argc) {
help("");
return 1;
}
prog = argv[0];
iscache = NULL;
image = NULL;
memset(&decoder, 0, sizeof(decoder));
decoder.type = pdt_block_decoder;
memset(&options, 0, sizeof(options));
memset(&stats, 0, sizeof(stats));
pt_config_init(&config);
iscache = pt_iscache_alloc(NULL);
if (!iscache) {
fprintf(stderr,
"%s: failed to allocate image section cache.\n", prog);
goto err;
}
image = pt_image_alloc(NULL);
if (!image) {
fprintf(stderr, "%s: failed to allocate image.\n", prog);
goto err;
}
for (i = 1; i < argc;) {
char *arg;
arg = argv[i++];
if (strcmp(arg, "--help") == 0 || strcmp(arg, "-h") == 0) {
help(prog);
goto out;
}
if (strcmp(arg, "--version") == 0) {
version(prog);
goto out;
}
if (strcmp(arg, "--pt") == 0) {
if (argc <= i) {
fprintf(stderr,
"%s: --pt: missing argument.\n", prog);
goto out;
}
arg = argv[i++];
if (ptxed_have_decoder(&decoder)) {
fprintf(stderr,
"%s: duplicate pt sources: %s.\n",
prog, arg);
goto err;
}
errcode = pt_cpu_errata(&config.errata, &config.cpu);
if (errcode < 0)
goto err;
errcode = load_pt(&config, arg, prog);
if (errcode < 0)
goto err;
switch (decoder.type) {
case pdt_insn_decoder:
decoder.variant.insn =
pt_insn_alloc_decoder(&config);
if (!decoder.variant.insn) {
fprintf(stderr, "%s: failed to create "
"decoder.\n", prog);
goto err;
}
errcode =
pt_insn_set_image(decoder.variant.insn,
image);
if (errcode < 0) {
fprintf(stderr,
"%s: failed to set image.\n",
prog);
goto err;
}
break;
case pdt_block_decoder:
decoder.variant.block =
pt_blk_alloc_decoder(&config);
if (!decoder.variant.block) {
fprintf(stderr, "%s: failed to create "
"decoder.\n", prog);
goto err;
}
errcode =
pt_blk_set_image(decoder.variant.block,
image);
if (errcode < 0) {
fprintf(stderr,
"%s: failed to set image.\n",
prog);
goto err;
}
break;
}
continue;
}
if (strcmp(arg, "--raw") == 0) {
if (argc <= i) {
fprintf(stderr,
"%s: --raw: missing argument.\n", prog);
goto out;
}
arg = argv[i++];
errcode = load_raw(iscache, image, arg, prog);
if (errcode < 0)
goto err;
continue;
}
#if defined(FEATURE_ELF)
if (strcmp(arg, "--elf") == 0) {
uint64_t base;
if (argc <= i) {
fprintf(stderr,
"%s: --elf: missing argument.\n", prog);
goto out;
}
arg = argv[i++];
base = 0ull;
errcode = extract_base(arg, &base);
if (errcode < 0)
goto err;
errcode = load_elf(iscache, image, arg, base, prog,
options.track_image);
if (errcode < 0)
goto err;
continue;
}
#endif /* defined(FEATURE_ELF) */
if (strcmp(arg, "--att") == 0) {
options.att_format = 1;
continue;
}
if (strcmp(arg, "--no-inst") == 0) {
options.dont_print_insn = 1;
continue;
}
if (strcmp(arg, "--quiet") == 0 || strcmp(arg, "-q") == 0) {
options.quiet = 1;
continue;
}
if (strcmp(arg, "--offset") == 0) {
options.print_offset = 1;
continue;
}
if (strcmp(arg, "--time") == 0) {
options.print_time = 1;
continue;
}
if (strcmp(arg, "--raw-insn") == 0) {
options.print_raw_insn = 1;
continue;
}
if (strcmp(arg, "--stat") == 0) {
options.print_stats = 1;
continue;
}
if (strcmp(arg, "--stat:insn") == 0) {
stats.flags |= ptxed_stat_insn;
continue;
}
if (strcmp(arg, "--stat:blocks") == 0) {
stats.flags |= ptxed_stat_blocks;
continue;
}
if (strcmp(arg, "--cpu") == 0) {
/* override cpu information before the decoder
* is initialized.
*/
if (ptxed_have_decoder(&decoder)) {
fprintf(stderr,
"%s: please specify cpu before the pt source file.\n",
prog);
goto err;
}
if (argc <= i) {
fprintf(stderr,
"%s: --cpu: missing argument.\n", prog);
goto out;
}
arg = argv[i++];
if (strcmp(arg, "auto") == 0) {
errcode = pt_cpu_read(&config.cpu);
if (errcode < 0) {
fprintf(stderr,
"%s: error reading cpu: %s.\n",
prog,
pt_errstr(pt_errcode(errcode)));
return 1;
}
continue;
}
if (strcmp(arg, "none") == 0) {
memset(&config.cpu, 0, sizeof(config.cpu));
continue;
}
errcode = pt_cpu_parse(&config.cpu, arg);
if (errcode < 0) {
fprintf(stderr,
"%s: cpu must be specified as f/m[/s]\n",
prog);
goto err;
}
continue;
}
if (strcmp(arg, "--mtc-freq") == 0) {
if (!get_arg_uint8(&config.mtc_freq, "--mtc-freq",
argv[i++], prog))
goto err;
continue;
}
if (strcmp(arg, "--nom-freq") == 0) {
if (!get_arg_uint8(&config.nom_freq, "--nom-freq",
argv[i++], prog))
goto err;
continue;
}
if (strcmp(arg, "--cpuid-0x15.eax") == 0) {
if (!get_arg_uint32(&config.cpuid_0x15_eax,
"--cpuid-0x15.eax", argv[i++],
prog))
goto err;
continue;
}
if (strcmp(arg, "--cpuid-0x15.ebx") == 0) {
if (!get_arg_uint32(&config.cpuid_0x15_ebx,
"--cpuid-0x15.ebx", argv[i++],
prog))
goto err;
continue;
}
if (strcmp(arg, "--verbose") == 0 || strcmp(arg, "-v") == 0) {
options.track_image = 1;
continue;
}
if (strcmp(arg, "--insn-decoder") == 0) {
if (ptxed_have_decoder(&decoder)) {
fprintf(stderr,
"%s: please specify %s before the pt "
"source file.\n", arg, prog);
goto err;
}
decoder.type = pdt_insn_decoder;
continue;
}
if (strcmp(arg, "--block-decoder") == 0) {
if (ptxed_have_decoder(&decoder)) {
fprintf(stderr,
"%s: please specify %s before the pt "
"source file.\n", arg, prog);
goto err;
}
decoder.type = pdt_block_decoder;
continue;
}
if (strcmp(arg, "--block:show-blocks") == 0) {
options.track_blocks = 1;
continue;
}
if (strcmp(arg, "--block:end-on-call") == 0) {
config.flags.variant.block.end_on_call = 1;
continue;
}
fprintf(stderr, "%s: unknown option: %s.\n", prog, arg);
goto err;
}
if (!ptxed_have_decoder(&decoder)) {
fprintf(stderr, "%s: no pt file.\n", prog);
goto err;
}
xed_tables_init();
/* If we didn't select any statistics, select them all depending on the
* decoder type.
*/
if (options.print_stats && !stats.flags) {
stats.flags |= ptxed_stat_insn;
if (decoder.type == pdt_block_decoder)
stats.flags |= ptxed_stat_blocks;
}
decode(&decoder, iscache, &options,
options.print_stats ? &stats : NULL);
if (options.print_stats)
print_stats(&stats);
out:
ptxed_free_decoder(&decoder);
pt_image_free(image);
pt_iscache_free(iscache);
return 0;
err:
ptxed_free_decoder(&decoder);
pt_image_free(image);
pt_iscache_free(iscache);
return 1;
}
int
main(int argc, char** argv)
{
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
xed_machine_mode_enum_t mmode;
xed_address_width_enum_t stack_addr_width;
xed_format_options_t format_options;
// one time initialization
xed_tables_init();
xed_set_verbosity( 99 );
memset(&format_options,0, sizeof(format_options));
format_options.hex_address_before_symbolic_name=0;
format_options.xml_a=0;
format_options.omit_unit_scale=0;
for(i=1;i<argc;i++) {
if (strcmp(argv[i], "-xml") == 0)
format_options.xml_a=1;
else if (strcmp(argv[i], "-no-unit-scale") == 0)
format_options.omit_unit_scale=1;
else if (strcmp(argv[i], "-64") == 0)
long_mode = 1;
else
break;
}
xed_format_set_options( format_options );
/// begin processing of instructions...
if (long_mode) {
mmode=XED_MACHINE_MODE_LONG_64;
stack_addr_width =XED_ADDRESS_WIDTH_64b;
}
else {
mmode=XED_MACHINE_MODE_LEGACY_32;
stack_addr_width =XED_ADDRESS_WIDTH_32b;
}
xed_decoded_inst_zero(&xedd);
xed_decoded_inst_set_mode(&xedd, mmode, stack_addr_width);
for( ;i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0;u<bytes; u++)
printf("%02x ", STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format(syntax, &xedd, buffer, BUFLEN, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n", xed_syntax_enum_t2str(syntax));
}
return 0;
}
//! Standard callback function - Initialize the plugin interface
plugin_interface_t * init_plugin()
{
// Fail to create the plugin log
if (!(loghandle = fopen(logfile, "w"))) {
fprintf(stderr, "cannot create %s\n", logfile);
return NULL;
}
// Init the function map, Don't really know its role
// Check the definition in shared/hooks/function_map
function_map_init();
// Same as above, Don't know nothing about it
// Check the definition in shared/hookapi
init_hookapi();
// Check the definition in shared/procmod
procmod_init();
// Check the definition in shared/reduce_taint. There
// is no documentation. The f**k.
reduce_taint_init();
// XED2 is a X86 Encoder / Decoder. My guess is that
// TEMU use this tool to translate instruction from
// assembly to machine language.
// Check the following link for XED2 documentation
// www.cs.virginia.edu/kim/publicity/pin/docs/24110/Xed/html/main.html
// Init XED instruction table
xed_tables_init();
// Zero-out the structure ?
xed_state_zero( &xed_state );
// Update the XED2 structure with some pre-defined values
xed_state_init( &xed_state, XED_MACHINE_MODE_LEGACY_32, XED_ADDRESS_WIDTH_32b, XED_ADDRESS_WIDTH_32b);
// The following portion of code registers all the
// call-back functions. Check the file TEMU_main.h
// for the full list of these functions.
// These functions are user-defined functions which
// we will play with
// Cleanup
interface.plugin_cleanup = detector_cleanup;
// How the taint analysis works
interface.taint_record_size = sizeof(taint_record_t);
interface.taint_propagate = detector_taint_propagate;
// Copy from sample plugin & hookfinder
interface.guest_message = detector_guest_message;
// Beginning of a block, used to indentify process
interface.block_begin = detector_block_begin;
// Beginning of an instruction
interface.insn_begin = detector_insn_begin;
// These twos are for user-interface
interface.term_cmds = detector_term_cmds;
interface.info_cmds = detector_info_cmds;
// Send a tainted keystroke
interface.send_keystroke = detector_send_keystroke;
// What to do with network I/O, we don't need this yet
// my_interface.nic_recv = detector_nic_recv;
// my_interface.nic_send = detector_nic_send;
// Need this to get the value of CR3 register
interface.monitored_cr3 = 0;
// We have TEMU interface now
return & interface;
}
void OfflineX86Code::xedInit() {
xed_state_init(&xed_state, XED_MACHINE_MODE_LONG_64,
XED_ADDRESS_WIDTH_64b, XED_ADDRESS_WIDTH_64b);
xed_tables_init();
xed_syntax = getenv("HHVM_INTEL_DISAS") ? XED_SYNTAX_INTEL : XED_SYNTAX_ATT;
}
