static target_ulong Instrument_CALL_NEAR(target_ulong pc)
{
uint32_t mem_addr;
xed_reg_enum_t reg_id;
target_ulong target;
PEMU_read_mem(pc, 15, pemu_inst.PEMU_inst_buf);
xed_decoded_inst_zero_set_mode(&pemu_inst.PEMU_xedd_g, &pemu_inst.PEMU_dstate);
xed_error_enum_t xed_error = xed_decode(&pemu_inst.PEMU_xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, pemu_inst.PEMU_inst_buf), 15);
const xed_inst_t * ins = xed_decoded_inst_inst(&pemu_inst.PEMU_xedd_g);
const xed_operand_t *op = xed_inst_operand(ins, 0);
xed_operand_enum_t op_name = xed_operand_name(op);
if (operand_is_mem(op_name, &mem_addr, 0)) {
PEMU_read_mem(mem_addr,sizeof(target) , &target);
}
else if (operand_is_reg(op_name, ®_id)){
target = PEMU_get_reg(reg_id);
}
else{
int len = xed_decoded_inst_get_length(&pemu_inst.PEMU_xedd_g);
target = xed_decoded_inst_get_branch_displacement(&pemu_inst.PEMU_xedd_g) + pc + len;
}
return target;
}
ADDRINT GetInstructionLength (ADDRINT ip)
{
xed_state_t dstate;
xed_error_enum_t xed_error;
xed_decoded_inst_t xedd;
ostringstream os;
if (sizeof(ADDRINT) == 4)
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
else
xed_state_init(&dstate,
XED_MACHINE_MODE_LONG_64,
XED_ADDRESS_WIDTH_64b,
XED_ADDRESS_WIDTH_64b);
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
UINT32 len = 15;
xed_error = xed_decode(&xedd, reinterpret_cast<const UINT8*>(ip), len);
if (xed_error != XED_ERROR_NONE)
{
printf ("Failure to decode at %p\n", (char *)ip);
exit (1);
}
return xed_decoded_inst_get_length(&xedd);
}
unsigned int disas_get_target(unsigned int start_pc, struct PEMU_INST *inst)
{
PEMU_read_mem(start_pc, 15, inst->PEMU_inst_buf);
xed_decoded_inst_zero_set_mode(&inst->PEMU_xedd_g, &inst->PEMU_dstate);
xed_error_enum_t xed_error = xed_decode(&inst->PEMU_xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, inst->PEMU_inst_buf), 15);
if (xed_error != XED_ERROR_NONE) {
fprintf(stderr, "error in disas_get_target\n");
exit(0);
}
const xed_inst_t *xi = xed_decoded_inst_inst(&inst->PEMU_xedd_g);
if(xed_decoded_inst_get_iclass(&inst->PEMU_xedd_g) != XED_ICLASS_CALL_NEAR) {
return 0;
}
const xed_operand_t *op = xed_inst_operand(xi, 0);
xed_reg_enum_t reg_id;
xed_operand_enum_t op_name = xed_operand_name(op);
unsigned int dest, tmp;
if(operand_is_relbr(op_name, &dest)){
dest += (start_pc + xed_decoded_inst_get_length(&inst->PEMU_xedd_g));
}else if(operand_is_reg(op_name, ®_id)){
dest = PEMU_get_reg(reg_id);
}else if(operand_is_mem4(op_name, &dest,0)){
PEMU_read_mem(dest, 4, &tmp);
dest = tmp;
}
return dest;
}
xed_error_enum_t disas_one_inst_ex(target_ulong pc, struct PEMU_INST *inst)
{
PEMU_read_mem(pc, 15, inst->PEMU_inst_buf);
xed_decoded_inst_zero_set_mode(&inst->PEMU_xedd_g, &inst->PEMU_dstate);
xed_error_enum_t xed_error = xed_decode(&inst->PEMU_xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, inst->PEMU_inst_buf), 15);
return xed_error;
}
xed_error_enum_t disas_one_inst_ex(target_ulong pc, struct PEMU_INST *inst)
{
PEMU_read_mem(pc, 15, inst->PEMU_inst_buf);
xed_decoded_inst_zero_set_mode(&inst->PEMU_xedd_g, &inst->PEMU_dstate);
xed_error_enum_t xed_error = xed_decode(&inst->PEMU_xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, inst->PEMU_inst_buf), 15);
xed_decoded_inst_dump_att_format(&inst->PEMU_xedd_g, inst->PEMU_inst_str, sizeof(inst->PEMU_inst_str), 0);
//printf("%x\t%s\n", pc, inst->PEMU_inst_str);
return xed_error;
}
static xed_error_enum_t disas_one_inst(target_ulong pc)
{
char buf[15];
if(PEMU_read_mem(pc, 15, buf)!=0)
tlb_fill(cpu_single_env, pc+14, 0, 0, 0);
xed_decoded_inst_zero_set_mode(&xedd_g, &dstate);
xed_error_enum_t xed_error = xed_decode(&xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, buf), 15);
return xed_error;
}
int main(int argc, char** argv) {
xed_machine_mode_enum_t mmode;
xed_bool_t long_mode = 1;
xed_decoded_inst_t ild;
xed_uint_t length = 0;
xed_uint_t i;
#define NTIMES 100
xed_uint64_t t1,t2,delta[NTIMES],tot;
unsigned char itext[15] = { 0xf2, 0x2e, 0x4f, 0x0F, 0x85, 0x99,
0x00, 0x00, 0x00 };
xed_state_t dstate;
// initialize the XED tables -- one time.
xed_tables_init();
// The state of the machine -- required for decoding
if (long_mode) {
mmode=XED_MACHINE_MODE_LONG_64;
}
else {
mmode=XED_MACHINE_MODE_LEGACY_32;
}
dstate.mmode = mmode;
for(i=0;i<NTIMES;i++) {
t1 = xed_get_time();
xed_decoded_inst_zero_set_mode(&ild, &dstate);
//xed_ild_init(&ild, mmode, itext, 15);
xed_ild_decode(&ild, itext, XED_MAX_INSTRUCTION_BYTES);
t2 = xed_get_time();
delta[i] = t2-t1;
}
tot = 0;
for(i=0;i<NTIMES;i++) {
printf("Decode time[%3d] = " XED_FMT_LU "\n", i,delta[i]);
if (i>0)
tot += delta[i];
}
printf("Avg time = " XED_FMT_LU "\n", tot/(NTIMES-1));
print_ild(&ild);
printf("length = %d\n",length);
return 0;
(void) argc; (void) argv; //pacify compiler
}
xed_error_enum_t disas_callnear_ex(target_ulong pc, struct PEMU_INST *inst)
{
PEMU_read_mem(pc, 15, inst->PEMU_inst_buf);
if(pemu_inst.PEMU_inst_buf[0] != (char)0xe8
&& pemu_inst.PEMU_inst_buf[0] != (char)0xff) {
return XED_ERROR_LAST;
}
xed_decoded_inst_zero_set_mode(&inst->PEMU_xedd_g, &inst->PEMU_dstate);
xed_error_enum_t xed_error = xed_decode(&inst->PEMU_xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, inst->PEMU_inst_buf), 15);
//xed_decoded_inst_dump_att_format(&inst->PEMU_xedd_g, inst->PEMU_inst_str, sizeof(inst->PEMU_inst_str), 0);
return xed_error;
}
xed_iclass_enum_t
xed_iclass(char* ins)
{
xed_decoded_inst_t xedd;
xed_decoded_inst_t *xptr = &xedd;
xed_decoded_inst_zero_set_mode(xptr, &dbg_xed_machine_state);
xed_error_enum_t xed_error = xed_decode(xptr, (uint8_t*) ins, 15);
if (xed_error != XED_ERROR_NONE) {
fprintf(stderr, "!! XED decode failure of insruction @ %p", ins);
return XED_ICLASS_INVALID;
}
return xed_decoded_inst_get_iclass(xptr);
}
bool VariableRecovery(BYTE *startAddr, BYTE *endAddr, std::map<int, AbstractVariable*> &container)
{
const unsigned int maxInstructionLength = 15; // the max length of a x86 instruction is 15byte
xed_decoded_inst_t xedd;
int instLength, index;
BYTE *currentAddr = startAddr;
char buffer[1024];
VariableHunter *varHunter = new VariableHunter(); // initialize the variable hunter
static const xed_state_t dstate = { XED_MACHINE_MODE_LEGACY_32, XED_ADDRESS_WIDTH_32b };
//currently, we only implement the 32bit machine
index = 0;
while(currentAddr < endAddr) // only small than, can't be equal.
{
memset(buffer, 0, sizeof(buffer));
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_error_enum_t xedCode = xed_decode(&xedd, (uint8_t*)currentAddr, maxInstructionLength);
if(xedCode == XED_ERROR_NONE)
{
instLength = xed_decoded_inst_get_length(&xedd); //get the length of the instruction in byte
xed_uint64_t runtime_address = (xed_uint64_t)currentAddr;
xed_decoded_inst_dump_intel_format(&xedd, buffer, 1024, runtime_address);
printf("0x%x\t\t%s\n", index, buffer);
varHunter -> findVariable(xedd);
currentAddr += instLength;
index += instLength;
}
else
return false;
}
varHunter -> getResult(container);
delete varHunter;
return true;
}
void print_trace_record(trace_record_t *rec)
{
xed_decoded_inst_t xDecode;
char asm_buf[32];
int i;
if(rec->is_new) {
printf("NEW eip=%08x esp=%08x caller=%08x callee=%08x M[%08x]=%08x \n",
rec->eip, rec->esp, rec->caller, rec->callee, rec->mem_addr,
rec->mem_val);
printf(" id=%08x", rec->define.dst_id[0]);
for(i=1; rec->define.dst_id[i] && i<4; i++)
printf(", %08x", rec->define.dst_id[i]);
printf("\n");
}
else {
printf("OLD eip=%08x esp=%08x caller=%08x callee=%08x is_move=%d\n",
rec->eip, rec->esp, rec->caller, rec->callee, rec->prop.is_move);
if(rec->mem_addr)
printf(" M[%08x]=%08x\n", rec->mem_addr, rec->mem_val);
printf(" src_id=%08x", rec->prop.src_id[0]);
for(i=1; rec->prop.src_id[i] !=0 && i<12; i++)
printf(", %08x", rec->prop.src_id[i]);
printf("\n");
printf(" dst_id=%08x", rec->prop.dst_id[0]);
for(i=1; rec->prop.dst_id[i] !=0 && i<4; i++)
printf(", %08x", rec->prop.dst_id[i]);
printf("\n");
}
if(rec->address_id)
printf(" address_id=%08x\n", rec->address_id);
/* printf(" raw_insn: ");
for(i=0; i<16; i++)
printf("%02x ", (uint8_t)rec->raw_insn[i]); */
xed_decoded_inst_zero_set_mode(&xDecode, &g_xState);
xed_error_enum_t xed_error = xed_decode(&xDecode, rec->raw_insn, 16);
if(xed_error == XED_ERROR_NONE) {
xed_format_intel(&xDecode, asm_buf, sizeof(asm_buf), rec->eip);
printf("%s\n", asm_buf);
}
}
VOID use_xed(ADDRINT pc) {
#if defined(TARGET_IA32E)
static const xed_state_t dstate = {XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b};
#else
static const xed_state_t dstate = { XED_MACHINE_MODE_LEGACY_32, XED_ADDRESS_WIDTH_32b};
#endif
xed_decoded_inst_t xedd;
xed_decoded_inst_zero_set_mode(&xedd,&dstate);
UINT64 ticks_start, ticks_stop, delta;
//FIXME: pass in the proper length...
const unsigned int max_inst_len = 15;
ticks_start = get_time();
#define USE_DECODE_CACHE
#if defined(USE_DECODE_CACHE)
xed_error_enum_t xed_code = xed_decode_cache(&xedd, reinterpret_cast<UINT8*>(pc), max_inst_len, &cache);
#else
xed_error_enum_t xed_code = xed_decode(&xedd, reinterpret_cast<UINT8*>(pc), max_inst_len);
#endif
ticks_stop = get_time();
delta = ticks_stop - ticks_start;
//cerr << ticks_start << " " << ticks_stop << " " << delta << endl;
UINT64 bin = delta/50;
if ((INT64)delta < 0)
rejects++;
else if (bin >= MAX_BINS)
histo[MAX_BINS-1] += 1;
else
histo[bin] += 1;
BOOL xed_ok = (xed_code == XED_ERROR_NONE);
i++;
if (i>(1024*1024) && xed_ok) {
i=0;
j++;
*out << j*1024*1024 << endl;
Fini(0,0);
*out << hex << std::setw(8) << pc << " " << dec;
char buf[2048];
xed_decoded_inst_dump_intel_format(&xedd, buf, 2048, 0);
*out << buf << endl;
}
}
void
x86_dump_ins(void *ins)
{
xed_decoded_inst_t xedd;
xed_decoded_inst_t *xptr = &xedd;
xed_error_enum_t xed_error;
char inst_buf[1024];
char errbuf[2048];
xed_decoded_inst_zero_set_mode(xptr, &x86_decoder_settings.xed_settings);
xed_error = xed_decode(xptr, (uint8_t*) ins, 15);
if (xed_error == XED_ERROR_NONE) {
xed_format_xed(xptr, inst_buf, sizeof(inst_buf),
(xed_uint64_t)(uintptr_t)ins);
sprintf(errbuf, "(%p, %d bytes, %s) %s \n" , ins,
xed_decoded_inst_get_length(xptr),
xed_iclass_enum_t2str(iclass(xptr)), inst_buf);
}
else {
#if defined(ENABLE_XOP) && defined (HOST_CPU_x86_64)
amd_decode_t decode_res;
adv_amd_decode(&decode_res, ins);
if (decode_res.success) {
if (decode_res.weak)
sprintf(errbuf, "(%p, %d bytes) weak AMD XOP \n", ins, (int) decode_res.len);
else
sprintf(errbuf, "(%p, %d bytes) robust AMD XOP \n", ins, (int) decode_res.len);
}
else
#endif // ENABLE_XOP and HOST_CPU_x86_64
sprintf(errbuf, "x86_dump_ins: xed decode error addr=%p, code = %d\n",
ins, (int) xed_error);
}
EMSG(errbuf);
fprintf(stderr, errbuf);
fflush(stderr);
}
int main(int argc, char** argv)
{
xed_bool_t long_mode = 1;
xed_decoded_inst_t xedd;
xed_state_t dstate;
unsigned char itext[15] = { 0xf2, 0x2e, 0x4f, 0x0F, 0x85, 0x99,
0x00, 0x00, 0x00 };
xed_tables_init(); // one time per process
if (long_mode)
dstate.mmode=XED_MACHINE_MODE_LONG_64;
else
dstate.mmode=XED_MACHINE_MODE_LEGACY_32;
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_ild_decode(&xedd, itext, XED_MAX_INSTRUCTION_BYTES);
printf("length = %d\n",xed_decoded_inst_get_length(&xedd));
return 0;
(void) argc; (void) argv; //pacify compiler
}
int
main(int argc, char** argv)
{
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_state_t dstate;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
xed_tables_init();
xed_state_zero(&dstate);
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
if (long_mode) {
first_argv = 2;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
}
else {
first_argv=1;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
}
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
for( i=first_argv ;i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0;u<bytes; u++)
printf("%02x ", STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
//memset(buffer,0,BUFLEN);
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format(syntax, &xedd, buffer, BUFLEN, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n", xed_syntax_enum_t2str(syntax));
}
return 0;
}
int
main(int argc, char** argv)
{
xed_error_enum_t xed_error;
xed_bool_t long_mode = 0;
xed_bool_t real_mode = 0;
xed_bool_t protected_16 = 0;
xed_state_t dstate;
unsigned int first_argv;
unsigned int bytes = 0;
unsigned char itext[XED_MAX_INSTRUCTION_BYTES];
int i;
unsigned int u;
xed_decoded_inst_t xedd;
#define BUFLEN 1000
char buffer[BUFLEN];
xed_bool_t ok;
unsigned int isyntax;
xed_syntax_enum_t syntax;
unsigned int memop_index = 0;
unsigned int memops = 0;
xed_uint64_t out_addr = 0;
xed_tables_init();
xed_agen_register_callback( register_callback, segment_callback);
xed_state_zero(&dstate);
xed_set_verbosity( 99 );
if (argc > 2 && strcmp(argv[1], "-64") == 0)
long_mode = 1;
if (argc > 2 && strcmp(argv[1], "-r") == 0)
real_mode = 1;
if (argc > 2 && strcmp(argv[1], "-16") == 0)
protected_16 = 1;
if (long_mode) {
first_argv = 2;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
}
else if (protected_16) {
first_argv = 2;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_16,
XED_ADDRESS_WIDTH_16b,
XED_ADDRESS_WIDTH_16b);
}
else if (real_mode) {
first_argv = 2;
/* we say that real mode uses 16b addressing even though the
addresses returned are 20b long. */
xed_state_init(&dstate,
XED_MACHINE_MODE_REAL_16,
XED_ADDRESS_WIDTH_16b,
XED_ADDRESS_WIDTH_16b);
}
else {
first_argv=1;
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
}
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
for( i=first_argv ; i < argc; i++) {
xed_uint8_t x = (xed_uint8_t)(xed_atoi_hex(argv[i]));
assert(bytes < XED_MAX_INSTRUCTION_BYTES);
itext[bytes++] = x;
}
if (bytes == 0) {
fprintf(stderr, "Must supply some hex bytes\n");
exit(1);
}
printf("PARSING BYTES: ");
for( u=0; u<bytes; u++)
printf("%02x ", STATIC_CAST(unsigned int,itext[u]));
printf("\n");
xed_error = xed_decode(&xedd,
REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error)
{
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
fprintf(stderr,"Not enough bytes provided\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
fprintf(stderr,"Could not decode given input.\n");
exit(1);
default:
fprintf(stderr,"Unhandled error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
xed_decoded_inst_dump(&xedd,buffer, BUFLEN);
printf("%s\n",buffer);
for(isyntax= XED_SYNTAX_XED; isyntax < XED_SYNTAX_LAST; isyntax++) {
syntax = STATIC_CAST(xed_syntax_enum_t, isyntax);
ok = xed_format(syntax, &xedd, buffer, BUFLEN, 0);
if (ok)
printf("%s syntax: %s\n", xed_syntax_enum_t2str(syntax), buffer);
else
printf("Error disassembling %s syntax\n", xed_syntax_enum_t2str(syntax));
}
memops = xed_decoded_inst_number_of_memory_operands(&xedd);
printf("\nNumber of memory operands: %d\n", (int)memops);
for(memop_index=0; memop_index<memops; memop_index++) {
xed_error = xed_agen(&xedd, memop_index, 0, &out_addr);
if (xed_error != XED_ERROR_NONE) {
fprintf(stderr,"Agen error code %s\n", xed_error_enum_t2str(xed_error));
exit(1);
}
printf("\tMemory agen%d: " XED_FMT_LX "\n", (int)memop_index, out_addr);
}
return 0;
}
static void print_inst(INST *inst)
{
//#if 0
xed_decoded_inst_zero_set_mode(&xedd_g, &dstate);
xed_error_enum_t xed_error = xed_decode(&xedd_g,
XED_STATIC_CAST(const xed_uint8_t *, inst->inst), 15);
#ifdef STATISTICS
g_inst_num++;
#endif
// fprintf(output, "\/\/0x%x\n", g_pc);
if (xed_error == XED_ERROR_NONE)
{
#ifdef WINDOWS_FORMAT
xed_decoded_inst_dump_intel_format(&xedd_g, g_inst_str, sizeof(g_inst_str), 0);
#else
xed_decoded_inst_dump_att_format(&xedd_g, g_inst_str, sizeof(g_inst_str), 0);
//xed_decoded_inst_dump_intel_format(&xedd_g, g_inst_str, sizeof(g_inst_str), 0);
#endif
const xed_inst_t *xi = xed_decoded_inst_inst(&xedd_g);
patch_operand(xi);
switch(inst->type){
case INCALL:
case INJMP:
case NORMAL:
format_normal(xi);
break;
case JMP:
case TAIL:
format_jmp(xi);
break;
case CALL:
format_direct_call(xi);
break;
case JCC:
case LOOP:
format_jcc(xi);
break;
case LEA_8:
case LEA_16:
case LEA_32:
format_lea(xi);
default:
break;
}
// fprintf(stdout, "results:\"%s\\n\\t\"\n", inst_buffer);
if(get_jmp_dst(g_pc))
#ifdef WINDOWS_FORMAT
fprintf(output, "L_0x%x:\n", g_pc);
#else
fprintf(output, "\"L_0x%x:\"\n", g_pc);
#endif
#ifdef DEBUG
print_debug();
#endif
#ifdef WINDOWS_FORMAT
fprintf(output, "%s\n", inst_buffer);
#else
fprintf(output, "\"%s\\n\\t\"\n", inst_buffer);
#endif
//patch safety guard
switch(inst->type){
case INJMP:
case JCC:
if(safety_guard[0]){
#ifdef WINDOWS_FORMAT
fprintf(output, "%s\n", safety_guard);
#else
fprintf(output, "\"%s\\n\\t\"\n", safety_guard);
#endif
}
break;
}
}
//#endif
}
static string
disassemble(UINT64 start, UINT64 stop) {
UINT64 pc = start;
xed_state_t dstate;
xed_syntax_enum_t syntax = XED_SYNTAX_INTEL;
xed_error_enum_t xed_error;
xed_decoded_inst_t xedd;
ostringstream os;
if (sizeof(ADDRINT) == 4)
xed_state_init(&dstate,
XED_MACHINE_MODE_LEGACY_32,
XED_ADDRESS_WIDTH_32b,
XED_ADDRESS_WIDTH_32b);
else
xed_state_init(&dstate,
XED_MACHINE_MODE_LONG_64,
XED_ADDRESS_WIDTH_64b,
XED_ADDRESS_WIDTH_64b);
/*while( pc < stop )*/ {
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
UINT32 len = 15;
if (stop - pc < 15)
len = stop-pc;
xed_error = xed_decode(&xedd, reinterpret_cast<const UINT8*>(pc), len);
bool okay = (xed_error == XED_ERROR_NONE);
iostream::fmtflags fmt = os.flags();
os << std::setfill('0')
<< "XDIS "
<< std::hex
<< std::setw(sizeof(ADDRINT)*2)
<< pc
<< std::dec
<< ": "
<< std::setfill(' ')
<< std::setw(4);
if (okay) {
char buffer[200];
unsigned int dec_len, sp;
os << xed_extension_enum_t2str(xed_decoded_inst_get_extension(&xedd));
dec_len = xed_decoded_inst_get_length(&xedd);
print_hex_line(buffer, reinterpret_cast<UINT8*>(pc), dec_len);
os << " " << buffer;
for ( sp=dec_len; sp < 12; sp++) // pad out the instruction bytes
os << " ";
os << " ";
memset(buffer,0,200);
int dis_okay = xed_format(syntax, &xedd, buffer, 200, pc);
if (dis_okay)
os << buffer << endl;
else
os << "Error disasassembling pc 0x" << std::hex << pc << std::dec << endl;
pc += dec_len;
}
else { // print the byte and keep going.
UINT8 memval = *reinterpret_cast<UINT8*>(pc);
os << "???? " // no extension
<< std::hex
<< std::setw(2)
<< std::setfill('0')
<< static_cast<UINT32>(memval)
<< std::endl;
pc += 1;
}
os.flags(fmt);
}
return os.str();
}
static int read_instruction_v50(trace_interface_t * trace, x86_inst_t * insn,
int disassemble_insn)
{
int i, j;
int count = 0;
if (!trace || !insn)
return -1;
entry_header_t * eh = &(insn->eh);
FILE *stream = trace->trace_stream;
// Read address
if (fread(eh, 4, 1, stream) < 1)
return -1;
// Set PID (not in trace)
eh->pid = -1;
// Read thread identifier
if (fread(&(eh->tid), 4, 1, stream) < 1)
return -1;
// Read instruction size
if (fread(&(eh->inst_size), 2, 1, stream) < 1)
return -1;
// Read num_operands and tp
if (fread(&(eh->num_operands), 2, 1, stream) < 1)
return -1;
// Read eflags and cc_op
if (fread(&(eh->eflags), 8, 1, stream) < 1)
return -1;
// Read df
uint32_t df;
if (fread(&df, 4, 1, stream) < 1)
return -1;
eh->df = (df == 1) ? 1 : -1;
// Read rawbytes
if (fread(&(eh->rawbytes), eh->inst_size, 1, stream) < 1)
return -1;
// Read operands
for (i = 0; i < eh->num_operands; i++) {
// Read the operand tentatively into the operand array
if (read_operand_v50(stream, &(eh->operand[count])) != 0)
return -1;
// If memory addressing register, move to memreg array correct position
switch (eh->operand[count].usage) {
case membase:
memcpy(&(eh->memregs[count-1][1]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memindex:
memcpy(&(eh->memregs[count-1][2]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegment:
memcpy(&(eh->memregs[count-1][0]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegent0:
memcpy(&(eh->memregs[count-1][3]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegent1:
memcpy(&(eh->memregs[count-1][4]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memdisplacement:
case memscale:
case eflags:
fprintf(stderr, "Found invalid operand usage for trace v50\n");
return -1;
default:
for (j = 0; j < MAX_NUM_MEMREGS; j++) {
eh->memregs[count][j].type = TNone;
}
count++;
break;
}
}
eh->operand[count].type = TNone;
/* Set instruction counter and increase next instruction counter */
insn->insn_ctr = trace->trace_next_insn_ctr++;
/* Disassemble instruction if requested */
if (disassemble_insn) {
xed_decoded_inst_zero_set_mode(&(insn->xed_inst), &dstate);
xed_error_enum_t xed_error =
xed_decode(&(insn->xed_inst),
XED_STATIC_CAST(const xed_uint8_t*,(insn->eh).rawbytes),
MAX_INSN_BYTES);
assert(xed_error == XED_ERROR_NONE);
}
return 0;
}
static int read_instruction_v60(trace_interface_t * trace, x86_inst_t * insn,
int disassemble_insn)
{
int i, j;
int count = 0;
if (!trace || !insn)
return -1;
entry_header_t * eh = &(insn->eh);
FILE *stream = trace->trace_stream;
// Read address, pid, tid, inst_size, num_operands, tp, df, eflags, cc_op
if (fread(eh, ENTRY_HEADER_FIXED_SIZE, 1, stream) < 1)
return -1;
// Special return if found trailer
if (eh->address == 0xffffffff)
return -2;
// Read rawbytes
if (fread(&(eh->rawbytes), eh->inst_size, 1, stream) < 1)
return -1;
// Build operand and memregs arrays
for (i = 0; i < eh->num_operands; i++) {
// Read the operand tentatively into the operand array
if (read_operand_v60(stream, &(eh->operand[count])) != 0)
return -1;
// If memory addressing register, move to memreg array correct position
switch (eh->operand[count].usage) {
case membase:
memcpy(&(eh->memregs[count-1][1]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memindex:
memcpy(&(eh->memregs[count-1][2]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegment:
memcpy(&(eh->memregs[count-1][0]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegent0:
memcpy(&(eh->memregs[count-1][3]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memsegent1:
memcpy(&(eh->memregs[count-1][4]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memdisplacement:
memcpy(&(eh->memregs[count-1][5]), &(eh->operand[count]),
sizeof(OperandVal));
break;
case memscale:
memcpy(&(eh->memregs[count-1][6]), &(eh->operand[count]),
sizeof(OperandVal));
break;
default:
for (j = 0; j < MAX_NUM_MEMREGS; j++) {
eh->memregs[count][j].type = TNone;
}
count++;
break;
}
}
eh->operand[count].type = TNone;
/* Set instruction counter and increase next instruction counter */
insn->insn_ctr = trace->trace_next_insn_ctr++;
/* Disassemble instruction if requested */
if (disassemble_insn) {
xed_decoded_inst_zero_set_mode(&(insn->xed_inst), &dstate);
xed_error_enum_t xed_error =
xed_decode(&(insn->xed_inst),
XED_STATIC_CAST(const xed_uint8_t*,(insn->eh).rawbytes),
MAX_INSN_BYTES);
assert(xed_error == XED_ERROR_NONE);
}
return 0;
}
static void print_block(struct pt_block *block,
struct pt_image_section_cache *iscache,
const struct ptxed_options *options,
const struct ptxed_stats *stats,
uint64_t offset, uint64_t time)
{
xed_machine_mode_enum_t mode;
xed_state_t xed;
uint64_t last_ip;
if (!block || !options) {
printf("[internal error]\n");
return;
}
if (block->resynced)
printf("[overflow]\n");
if (block->enabled)
printf("[enabled]\n");
if (block->resumed)
printf("[resumed]\n");
if (options->track_blocks) {
printf("[block");
if (stats)
printf(" %" PRIx64, stats->blocks);
printf("]\n");
}
mode = translate_mode(block->mode);
xed_state_init2(&xed, mode, XED_ADDRESS_WIDTH_INVALID);
last_ip = 0ull;
for (; block->ninsn; --block->ninsn) {
xed_decoded_inst_t inst;
xed_error_enum_t xederrcode;
uint8_t raw[pt_max_insn_size], *praw;
int size, errcode;
/* For truncated block, the last instruction is provided in the
* block since it can't be read entirely from the image section
* cache.
*/
if (block->truncated && (block->ninsn == 1)) {
praw = block->raw;
size = block->size;
} else {
praw = raw;
size = pt_iscache_read(iscache, raw, sizeof(raw),
block->isid, block->ip);
if (size < 0) {
printf(" [error reading insn: (%d) %s]\n", size,
pt_errstr(pt_errcode(size)));
break;
}
}
xed_decoded_inst_zero_set_mode(&inst, &xed);
if (block->speculative)
printf("? ");
if (options->print_offset)
printf("%016" PRIx64 " ", offset);
if (options->print_time)
printf("%016" PRIx64 " ", time);
printf("%016" PRIx64, block->ip);
xederrcode = xed_decode(&inst, praw, size);
if (xederrcode != XED_ERROR_NONE) {
printf(" [xed decode error: (%u) %s]\n", xederrcode,
xed_error_enum_t2str(xederrcode));
break;
}
if (!options->dont_print_insn)
xed_print_insn(&inst, block->ip, options);
printf("\n");
last_ip = block->ip;
errcode = xed_next_ip(&block->ip, &inst, last_ip);
if (errcode < 0) {
diagnose_block_at("reconstruct error", offset, block,
errcode);
break;
}
}
/* Decode should have brought us to @block->end_ip. */
if (last_ip != block->end_ip)
diagnose_block_at("reconstruct error", offset, block,
-pte_nosync);
if (block->interrupted)
printf("[interrupt]\n");
if (block->aborted)
printf("[aborted]\n");
if (block->committed)
printf("[committed]\n");
if (block->disabled)
printf("[disabled]\n");
if (block->stopped)
printf("[stopped]\n");
}
static void print_insn(const struct pt_insn *insn, xed_state_t *xed,
const struct ptxed_options *options, uint64_t offset,
uint64_t time)
{
if (!insn || !options) {
printf("[internal error]\n");
return;
}
if (insn->resynced)
printf("[overflow]\n");
if (insn->enabled)
printf("[enabled]\n");
if (insn->resumed)
printf("[resumed]\n");
if (insn->speculative)
printf("? ");
if (options->print_offset)
printf("%016" PRIx64 " ", offset);
if (options->print_time)
printf("%016" PRIx64 " ", time);
printf("%016" PRIx64, insn->ip);
if (!options->dont_print_insn) {
xed_machine_mode_enum_t mode;
xed_decoded_inst_t inst;
xed_error_enum_t errcode;
mode = translate_mode(insn->mode);
xed_state_set_machine_mode(xed, mode);
xed_decoded_inst_zero_set_mode(&inst, xed);
errcode = xed_decode(&inst, insn->raw, insn->size);
switch (errcode) {
case XED_ERROR_NONE:
xed_print_insn(&inst, insn->ip, options);
break;
default:
printf(" [xed decode error: (%u) %s]", errcode,
xed_error_enum_t2str(errcode));
break;
}
}
printf("\n");
if (insn->interrupted)
printf("[interrupt]\n");
if (insn->aborted)
printf("[aborted]\n");
if (insn->committed)
printf("[committed]\n");
if (insn->disabled)
printf("[disabled]\n");
if (insn->stopped)
printf("[stopped]\n");
}
void OfflineX86Code::disasm(FILE* file,
TCA fileStartAddr,
TCA codeStartAddr,
uint64_t codeLen,
const PerfEventsMap<TCA>& perfEvents,
BCMappingInfo bcMappingInfo,
bool printAddr /* =true */,
bool printBinary /* =false */) {
char codeStr[MAX_INSTR_ASM_LEN];
xed_uint8_t* code = (xed_uint8_t*) alloca(codeLen);
xed_uint8_t* frontier;
TCA ip;
TCA r10val = 0;
size_t currBC = 0;
if (codeLen == 0) return;
auto const offset = codeStartAddr - fileStartAddr;
if (fseek(file, offset, SEEK_SET)) {
error("disasm error: seeking file");
}
size_t readLen = fread(code, codeLen, 1, file);
if (readLen != 1) {
error("Failed to read {} bytes at offset {} from code file due to {}",
codeLen, offset, feof(file) ? "EOF" : "read error");
}
xed_decoded_inst_t xedd;
// Decode and print each instruction
for (frontier = code, ip = codeStartAddr; frontier < code + codeLen; ) {
xed_decoded_inst_zero_set_mode(&xedd, &xed_state);
xed_decoded_inst_set_input_chip(&xedd, XED_CHIP_INVALID);
xed_error_enum_t xed_error = xed_decode(&xedd, frontier, 15);
if (xed_error != XED_ERROR_NONE) break;
// Get disassembled instruction in codeStr
if (!xed_format_context(xed_syntax, &xedd, codeStr,
MAX_INSTR_ASM_LEN, (uint64_t)ip, nullptr
#if XED_ENCODE_ORDER_MAX_ENTRIES != 28 // Newer version of XED library
, 0
#endif
)) {
error("disasm error: xed_format_context failed");
}
// Annotate the x86 with its bytecode.
currBC = printBCMapping(bcMappingInfo, currBC, (TCA)ip);
if (printAddr) printf("%14p: ", ip);
uint32_t instrLen = xed_decoded_inst_get_length(&xedd);
if (printBinary) {
uint32_t i;
for (i=0; i < instrLen; i++) {
printf("%02X", frontier[i]);
}
for (; i < 16; i++) {
printf(" ");
}
}
// For calls, we try to figure out the destination symbol name.
// We look both at relative branches and the pattern:
// move r10, IMMEDIATE
// call r10
xed_iclass_enum_t iclass = xed_decoded_inst_get_iclass(&xedd);
string callDest = "";
if (iclass == XED_ICLASS_CALL_NEAR || iclass == XED_ICLASS_CALL_FAR) {
const xed_inst_t *xi = xed_decoded_inst_inst(&xedd);
always_assert(xed_inst_noperands(xi) >= 1);
const xed_operand_t *opnd = xed_inst_operand(xi, 0);
xed_operand_enum_t opndName = xed_operand_name(opnd);
if (opndName == XED_OPERAND_RELBR) {
if (xed_decoded_inst_get_branch_displacement_width(&xedd)) {
xed_int32_t disp = xed_decoded_inst_get_branch_displacement(&xedd);
TCA addr = ip + instrLen + disp;
callDest = getSymbolName(addr);
}
} else if (opndName == XED_OPERAND_REG0) {
if (xed_decoded_inst_get_reg(&xedd, opndName) == XED_REG_R10) {
callDest = getSymbolName(r10val);
}
}
} else if (iclass == XED_ICLASS_MOV) {
// Look for moves into r10 and keep r10val updated
const xed_inst_t* xi = xed_decoded_inst_inst(&xedd);
always_assert(xed_inst_noperands(xi) >= 2);
const xed_operand_t *destOpnd = xed_inst_operand(xi, 0);
xed_operand_enum_t destOpndName = xed_operand_name(destOpnd);
if (destOpndName == XED_OPERAND_REG0 &&
xed_decoded_inst_get_reg(&xedd, destOpndName) == XED_REG_R10) {
const xed_operand_t *srcOpnd = xed_inst_operand(xi, 1);
xed_operand_enum_t srcOpndName = xed_operand_name(srcOpnd);
if (srcOpndName == XED_OPERAND_IMM0) {
TCA addr = (TCA)xed_decoded_inst_get_unsigned_immediate(&xedd);
r10val = addr;
}
}
}
if (!perfEvents.empty()) {
printEventStats((TCA)ip, instrLen, perfEvents);
} else {
printf("%48s", "");
}
printf("%s%s\n", codeStr, callDest.c_str());
frontier += instrLen;
ip += instrLen;
}
}
void Disasm::disasm(std::ostream& out, uint8_t* codeStartAddr,
uint8_t* codeEndAddr) {
#ifdef HAVE_LIBXED
auto const endClr = m_opts.m_color.empty() ? "" : ANSI_COLOR_END;
char codeStr[MAX_INSTR_ASM_LEN];
xed_uint8_t *frontier;
xed_decoded_inst_t xedd;
uint64_t codeBase = uint64_t(codeStartAddr);
uint64_t ip;
// Decode and print each instruction
for (frontier = codeStartAddr, ip = (uint64_t)codeStartAddr;
frontier < codeEndAddr; ) {
xed_decoded_inst_zero_set_mode(&xedd, &m_xedState);
xed_decoded_inst_set_input_chip(&xedd, XED_CHIP_INVALID);
xed_error_enum_t xed_error = xed_decode(&xedd, frontier, 15);
if (xed_error != XED_ERROR_NONE) error("disasm error: xed_decode failed");
// Get disassembled instruction in codeStr
auto const syntax = m_opts.m_forceAttSyntax ? XED_SYNTAX_ATT
: s_xed_syntax;
if (!xed_format_context(syntax, &xedd, codeStr,
MAX_INSTR_ASM_LEN, ip, nullptr)) {
error("disasm error: xed_format_context failed");
}
uint32_t instrLen = xed_decoded_inst_get_length(&xedd);
// If it's a jump, we're printing relative offsets, and the dest
// is within the range we're printing, add the dest as a relative
// offset.
std::string jmpComment;
auto const cat = xed_decoded_inst_get_category(&xedd);
if (cat == XED_CATEGORY_COND_BR || cat == XED_CATEGORY_UNCOND_BR) {
if (m_opts.m_relativeOffset) {
auto disp = uint64_t(frontier + instrLen +
xed_decoded_inst_get_branch_displacement(&xedd) -
codeBase);
if (disp < uint64_t(codeEndAddr - codeStartAddr)) {
jmpComment = folly::format(" # {:#x}", disp).str();
}
}
}
for (int i = 0; i < m_opts.m_indentLevel; ++i) {
out << ' ';
}
out << m_opts.m_color;
if (m_opts.m_addresses) {
const char* fmt = m_opts.m_relativeOffset ? "{:3x}: " : "{:#10x}: ";
out << folly::format(fmt, ip - (m_opts.m_relativeOffset ? codeBase : 0));
}
if (m_opts.m_printEncoding) {
// print encoding, like in objdump
unsigned posi = 0;
for (; posi < instrLen; ++posi) {
out << folly::format("{:02x} ", (uint8_t)frontier[posi]);
}
for (; posi < 16; ++posi) {
out << " ";
}
}
out << codeStr << jmpComment << endClr << '\n';
frontier += instrLen;
ip += instrLen;
}
#else
out << "This binary was compiled without disassembly support\n";
#endif // HAVE_LIBXED
}
/* This is the central function
Given a memory address, reads a bunch of memory bytes and
calls the disassembler to obtain the information
Then it stores the information into the eh EntryHeader
*/
void decode_address(uint32_t address, EntryHeader *eh, int ignore_taint)
{
unsigned char insn_buf[MAX_INSN_BYTES];
unsigned int is_stackpush = 0, is_stackpop = 0;
unsigned int stackpushpop_acc = 0;
if (xed2chris_regmapping[XED_REG_EAX][0] == 0) {
init_xed2chris();
assert(xed2chris_regmapping[XED_REG_EAX][0] != 0);
}
/* Read memory from TEMU */
TEMU_read_mem(address, MAX_INSN_BYTES, insn_buf);
/* Disassemble instruction buffer */
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_error_enum_t xed_error =
xed_decode(&xedd, STATIC_CAST(const xed_uint8_t*,insn_buf), MAX_INSN_BYTES);
xed_bool_t okay = (xed_error == XED_ERROR_NONE);
if (!okay) return;
// Increase counters
tstats.insn_counter_decoded++;
int i;
/* Clear out Entry header */
memset(eh, 0, sizeof(EntryHeader));
/* Copy the address and instruction size */
eh->address = address;
eh->inst_size = xed_decoded_inst_get_length(&xedd);
if (eh->inst_size > MAX_INSN_BYTES) eh->inst_size = MAX_INSN_BYTES;
/* Copy instruction rawbytes */
memcpy(eh->rawbytes, insn_buf, eh->inst_size);
/* Get the number of XED operands */
const xed_inst_t* xi = xed_decoded_inst_inst(&xedd);
int xed_ops = xed_inst_noperands(xi);
int op_idx = -1;
/* Get the category of the instruction */
xed_category_enum_t category = xed_decoded_inst_get_category(&xedd);
/* Iterate over the XED operands */
for(i = 0; i < xed_ops; i++) {
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
/* Get operand */
const xed_operand_t* op = xed_inst_operand(xi,i);
xed_operand_enum_t op_name = xed_operand_name(op);
switch(op_name) {
/* Register */
case XED_OPERAND_REG0:
case XED_OPERAND_REG1:
case XED_OPERAND_REG2:
case XED_OPERAND_REG3:
case XED_OPERAND_REG4:
case XED_OPERAND_REG5:
case XED_OPERAND_REG6:
case XED_OPERAND_REG7:
case XED_OPERAND_REG8:
case XED_OPERAND_REG9:
case XED_OPERAND_REG10:
case XED_OPERAND_REG11:
case XED_OPERAND_REG12:
case XED_OPERAND_REG13:
case XED_OPERAND_REG14:
case XED_OPERAND_REG15: {
xed_reg_enum_t reg_id = xed_decoded_inst_get_reg(&xedd, op_name);
int regnum = xed2chris_regmapping[reg_id][1];
// Special handling for Push
if (reg_id == XED_REG_STACKPUSH) is_stackpush = 1;
else if (reg_id == XED_REG_STACKPOP) is_stackpop = 1;
if (-1 == regnum)
break;
else {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TRegister;
eh->operand[op_idx].addr = xed2chris_regmapping[reg_id][0];
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = TEMU_cpu_regs[regnum];
switch (eh->operand[op_idx].addr) {
case ax_reg:
case bx_reg:
case cx_reg:
case dx_reg:
case bp_reg:
case sp_reg:
case si_reg:
case di_reg:
eh->operand[op_idx].value &= 0xFFFF;
break;
case al_reg:
case bl_reg:
case cl_reg:
case dl_reg:
eh->operand[op_idx].value &= 0xFF;
break;
case ah_reg:
case bh_reg:
case ch_reg:
case dh_reg:
eh->operand[op_idx].value = (eh->operand[i].value & 0xFF00) >> 8;
break;
default:
break;
}
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
break;
}
/* Immediate */
case XED_OPERAND_IMM0: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
//xed_uint_t width = xed_decoded_inst_get_immediate_width(&xedd);
if (xed_decoded_inst_get_immediate_is_signed(&xedd)) {
xed_int32_t signed_imm_val =
xed_decoded_inst_get_signed_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) signed_imm_val;
}
else {
xed_uint64_t unsigned_imm_val =
xed_decoded_inst_get_unsigned_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
}
break;
break;
}
/* Special immediate only used in ENTER instruction */
case XED_OPERAND_IMM1: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
xed_uint8_t unsigned_imm_val =
xed_decoded_inst_get_second_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
break;
}
/* Memory */
case XED_OPERAND_AGEN:
case XED_OPERAND_MEM0:
case XED_OPERAND_MEM1: {
unsigned long base = 0;
unsigned long index = 0;
unsigned long scale = 1;
unsigned long segbase = 0;
unsigned short segsel = 0;
unsigned long displacement = 0;
unsigned int j;
size_t remaining = 0;
/* Set memory index */
int mem_idx = 0;
if (op_name == XED_OPERAND_MEM1) mem_idx = 1;
unsigned int memlen = xed_decoded_inst_operand_length (&xedd, i);
for (j = 0; j < memlen; j+=4) {
/* Initialization */
base = 0;
index = 0;
scale = 1;
segbase = 0;
segsel = 0;
displacement = 0;
remaining = memlen - j;
op_idx++;
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
eh->num_operands++;
eh->operand[op_idx].type = TMemLoc;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].length =
remaining > 4 ? 4 : (uint8_t) remaining;
// Get Segment register
xed_reg_enum_t seg_regid =
xed_decoded_inst_get_seg_reg(&xedd,mem_idx);
if (seg_regid != XED_REG_INVALID) {
const xed_operand_values_t *xopv =
xed_decoded_inst_operands_const(&xedd);
xed_bool_t default_segment =
xed_operand_values_using_default_segment (xopv,mem_idx);
if (!default_segment) {
eh->num_operands++;
int segmentreg = xed2chris_regmapping[seg_regid][0] - 100;
segbase = TEMU_cpu_segs[segmentreg].base;
segsel = TEMU_cpu_segs[segmentreg].selector;
eh->memregs[op_idx][0].type = TRegister;
eh->memregs[op_idx][0].length = 2;
eh->memregs[op_idx][0].addr = xed2chris_regmapping[seg_regid][0];
eh->memregs[op_idx][0].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][0].value = segsel;
eh->memregs[op_idx][0].usage = memsegment;
if (ignore_taint == 0)
set_operand_data(&(eh->memregs[op_idx][0]));
int dt;
if (segsel & 0x4) // ldt
dt = TEMU_cpu_ldt->base;
else //gdt
dt = TEMU_cpu_gdt->base;
segsel = segsel >> 3;
unsigned long segent = dt + 8 * segsel;
unsigned char segdes[8];
TEMU_read_mem(segent, 8, segdes);
#if 0
// debugging code to double check segbase value
unsigned long segbasenew = segdes[2] + segdes[3] * 256 +
segdes[4] * 256 * 256 + segdes[7] * 256 * 256 * 256;
if (segbase != segbasenew) {
term_printf("segbase unexpected: 0x%08lX v.s 0x%08lX\n",
segbase, segbasenew);
}
#endif
/* Segment descriptor is stored as a memory operand */
eh->num_operands+=2;
eh->memregs[op_idx][3].type = TMemLoc;
eh->memregs[op_idx][3].length = 4;
eh->memregs[op_idx][3].addr = segent;
eh->memregs[op_idx][3].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][3].value = *(uint32_t *) segdes;
eh->memregs[op_idx][3].tainted = 0;
eh->memregs[op_idx][3].usage = memsegent0;
eh->memregs[op_idx][4].type = TMemLoc;
eh->memregs[op_idx][4].length = 4;
eh->memregs[op_idx][4].addr = segent + 4;
eh->memregs[op_idx][4].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][4].value = *(uint32_t *) (segdes + 4);
eh->memregs[op_idx][4].tainted = 0;
eh->memregs[op_idx][4].usage = memsegent1;
}
}
// Get Base register
xed_reg_enum_t base_regid =
xed_decoded_inst_get_base_reg(&xedd,mem_idx);
if (base_regid != XED_REG_INVALID) {
eh->num_operands++;
int basereg = xed2chris_regmapping[base_regid][1];
base = TEMU_cpu_regs[basereg];
eh->memregs[op_idx][1].type = TRegister;
eh->memregs[op_idx][1].addr = xed2chris_regmapping[base_regid][0];
eh->memregs[op_idx][1].length = 4;
eh->memregs[op_idx][1].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][1].value = base;
eh->memregs[op_idx][1].usage = membase;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][1]));
}
// Get Index register and Scale
xed_reg_enum_t index_regid =
xed_decoded_inst_get_index_reg(&xedd,mem_idx);
if (mem_idx == 0 && index_regid != XED_REG_INVALID) {
eh->num_operands++;
int indexreg = xed2chris_regmapping[index_regid][1];
index = TEMU_cpu_regs[indexreg];
eh->memregs[op_idx][2].type = TRegister;
eh->memregs[op_idx][2].addr = xed2chris_regmapping[index_regid][0];
eh->memregs[op_idx][2].length = 4;
eh->memregs[op_idx][2].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][2].value = index;
eh->memregs[op_idx][2].usage = memindex;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][2]));
// Get Scale (AKA width) (only have a scale if the index exists)
if (xed_decoded_inst_get_scale(&xedd,i) != 0) {
scale = (unsigned long) xed_decoded_inst_get_scale(&xedd,mem_idx);
}
}
// Get displacement (AKA offset)
displacement =
(unsigned long) xed_decoded_inst_get_memory_displacement
(&xedd,mem_idx);
// Fix displacement for:
// 1) Any instruction that pushes into the stack, since ESP is
// decremented before memory operand is written using ESP.
// Affects: ENTER,PUSH,PUSHA,PUSHF,CALL
if (is_stackpush) {
stackpushpop_acc += eh->operand[op_idx].length;
displacement = displacement - stackpushpop_acc -j;
}
// 2) Pop instructions where the
// destination operand is a memory location that uses ESP
// as base or index register.
// The pop operations increments ESP and the written memory
// location address needs to be adjusted.
// Affects: pop (%esp)
else if ((category == XED_CATEGORY_POP) && (!is_stackpop)) {
if ((eh->memregs[op_idx][1].addr == esp_reg) ||
(eh->memregs[op_idx][2].addr == esp_reg))
{
displacement = displacement + eh->operand[op_idx].length;
}
}
// Calculate memory address accessed
eh->operand[op_idx].addr =
j + segbase + base + index * scale + displacement;
// Special handling for LEA instructions
if (op_name == XED_OPERAND_AGEN) {
eh->operand[op_idx].type = TMemAddress;
eh->operand[op_idx].length = 4;
has_page_fault = 0; // LEA won't trigger page fault
}
else {
has_page_fault = TEMU_read_mem(eh->operand[op_idx].addr,
(int)(eh->operand[op_idx].length),
(uint8_t *)&(eh->operand[op_idx].value));
}
// Check if instruction accesses user memory
// kernel_mem_start defined in shared/read_linux.c
if ((eh->operand[op_idx].addr < kernel_mem_start) &&
(op_name != XED_OPERAND_AGEN))
{
access_user_mem = 1;
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
}
break;
}
/* Jumps */
case XED_OPERAND_PTR: // pointer (always in conjunction with a IMM0)
case XED_OPERAND_RELBR: { // branch displacements
xed_uint_t disp = xed_decoded_inst_get_branch_displacement(&xedd);
/* Displacement is from instruction end */
/* Adjust displacement with instruction size */
disp = disp + eh->inst_size;
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TJump;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = disp;
break;
}
/* Floating point registers */
case XED_REG_X87CONTROL:
case XED_REG_X87STATUS:
case XED_REG_X87TOP:
case XED_REG_X87TAG:
case XED_REG_X87PUSH:
case XED_REG_X87POP:
case XED_REG_X87POP2:
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TFloatRegister;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
default:
break;
}
}
int main(int argc, char** argv) {
xed_ild_t ild;
xed_uint_t uargc = (xed_uint_t)argc;
xed_uint_t length = 0;
xed_uint_t dlen = 0;
xed_uint_t i,j,input_nibbles=0;
xed_uint8_t itext[XED_MAX_INSTRUCTION_BYTES];
char src[MAX_INPUT_NIBBLES+1];
xed_state_t dstate;
xed_decoded_inst_t xedd;
xed_uint_t first_argv;
xed_uint_t bytes;
xed_error_enum_t xed_error;
xed_chip_enum_t chip = XED_CHIP_INVALID;
int already_set_mode = 0;
// initialize the XED tables -- one time.
xed_tables_init();
xed_state_zero(&dstate);
first_argv = 1;
dstate.mmode=XED_MACHINE_MODE_LEGACY_32;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_32b;
for(i=1;i< uargc;i++) {
if (strcmp(argv[i], "-64") == 0) {
assert(already_set_mode == 0);
already_set_mode = 1;
dstate.mmode=XED_MACHINE_MODE_LONG_64;
first_argv++;
}
else if (strcmp(argv[i], "-16") == 0) {
assert(already_set_mode == 0);
already_set_mode = 1;
dstate.mmode=XED_MACHINE_MODE_LEGACY_16;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_16b;
first_argv++;
}
else if (strcmp(argv[i], "-s16") == 0) {
already_set_mode = 1;
dstate.stack_addr_width=XED_ADDRESS_WIDTH_16b;
first_argv++;
}
else if (strcmp(argv[i], "-chip") == 0) {
assert(i+1 < uargc);
chip = str2xed_chip_enum_t(argv[i+1]);
printf("Setting chip to %s\n", xed_chip_enum_t2str(chip));
assert(chip != XED_CHIP_INVALID);
first_argv+=2;
}
}
assert(first_argv < uargc);
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
if (first_argv >= uargc) {
printf("Need some hex instruction nibbles");
exit(1);
}
for(i=first_argv;i<uargc;i++) {
for(j=0;argv[i][j];j++) {
assert(input_nibbles < MAX_INPUT_NIBBLES);
src[input_nibbles] = argv[i][j];
input_nibbles++;
}
}
src[input_nibbles] = 0;
if (input_nibbles & 1) {
printf("Need an even number of nibbles");
exit(1);
}
bytes = xed_convert_ascii_to_hex(src, itext, XED_MAX_INSTRUCTION_BYTES);
printf("Attempting to decode: ");
for(i=0;i<bytes;i++) {
printf("%02x", itext[i]);
}
printf("\n");
xed_ild_init(&ild, dstate.mmode, chip, itext, XED_MAX_INSTRUCTION_BYTES);
length = xed_instruction_length_decode(&ild);
print_ild(&ild);
printf("ILD length = %d\n",length);
xed_decoded_inst_set_input_chip(&xedd, chip);
xed_error = xed_decode(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*,itext),
bytes);
switch(xed_error) {
case XED_ERROR_NONE:
break;
case XED_ERROR_BUFFER_TOO_SHORT:
printf("Not enough bytes provided\n");
exit(1);
case XED_ERROR_INVALID_FOR_CHIP:
printf("The instruction was not valid for the specified chip.\n");
exit(1);
case XED_ERROR_GENERAL_ERROR:
printf("Could not decode given input.\n");
exit(1);
default:
printf("Unhandled error code %s\n",xed_error_enum_t2str(xed_error));
exit(1);
}
dlen = xed_decoded_inst_get_length(&xedd);
printf ("Traditional length = %d\n", dlen);
if (dlen != length) {
printf ("Length error\n");
exit(1);
}
printf ("Length matched\n");
return 0;
}
void xed_disas_test(xed_disas_info_t* di)
{
static int first = 1;
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
xed_uint64_t errors = 0;
#endif
unsigned int m;
unsigned char* z;
unsigned char* zlimit;
unsigned int length;
int skipping;
int last_all_zeros;
unsigned int i;
int okay;
xed_decoded_inst_t xedd;
xed_uint64_t runtime_instruction_address;
xed_dot_graph_supp_t* gs = 0;
xed_bool_t graph_empty = 1;
//#define XED_USE_DECODE_CACHE
#if defined(XED_USE_DECODE_CACHE)
xed_decode_cache_t cache;
xed_uint32_t n_cache_entries = 16 * 1024;
xed_decode_cache_entry_t* cache_entries =
(xed_decode_cache_entry_t*) malloc(n_cache_entries *
sizeof(xed_decode_cache_entry_t));
xed_decode_cache_initialize(&cache, cache_entries, n_cache_entries);
#endif
if(di->dot_graph_output)
{
xed_syntax_enum_t syntax = XED_SYNTAX_INTEL;
gs = xed_dot_graph_supp_create(syntax);
}
if(first)
{
xed_decode_stats_zero(&xed_stats, di);
first = 0;
}
m = di->ninst; // number of things to decode
z = di->a;
if(di->runtime_vaddr_disas_start)
if(di->runtime_vaddr_disas_start > di->runtime_vaddr)
z = (di->runtime_vaddr_disas_start - di->runtime_vaddr) + di->a;
zlimit = 0;
if(di->runtime_vaddr_disas_end)
{
if(di->runtime_vaddr_disas_end > di->runtime_vaddr)
zlimit = (di->runtime_vaddr_disas_end - di->runtime_vaddr) + di->a;
else /* end address is before start of this region -- skip it */
goto finish;
}
if(z >= di->q) /* start pointer is after end of section */
goto finish;
// for skipping long strings of zeros
skipping = 0;
last_all_zeros = 0;
for(i = 0; i < m; i++)
{
int ilim, elim;
if(zlimit && z >= zlimit)
{
if(di->xml_format == 0)
printf("# end of range.\n");
break;
}
if(z >= di->q)
{
if(di->xml_format == 0)
#if !defined(XED_ILD_ONLY)
printf("# end of text section.\n");
#endif
break;
}
/* if we get near the end of the section, clip the itext length */
ilim = 15;
elim = di->q - z;
if(elim < ilim)
ilim = elim;
if(CLIENT_VERBOSE3)
{
printf("\n==============================================\n");
printf("Decoding instruction " XED_FMT_U "\n", i);
printf("==============================================\n");
}
// if we get two full things of 0's in a row, start skipping.
if(all_zeros((xed_uint8_t*) z, ilim))
{
if(skipping)
{
z = z + ilim;
continue;
}
else if(last_all_zeros)
{
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
printf("...\n");
#endif
z = z + ilim;
skipping = 1;
continue;
}
else
last_all_zeros = 1;
}
else
{
skipping = 0;
last_all_zeros = 0;
}
runtime_instruction_address = ((xed_uint64_t)(z - di->a)) +
di->runtime_vaddr;
if(CLIENT_VERBOSE3)
{
char tbuf[XED_HEX_BUFLEN];
printf("Runtime Address " XED_FMT_LX , runtime_instruction_address);
xed_print_hex_line(tbuf, (xed_uint8_t*) z, ilim, XED_HEX_BUFLEN);
printf(" [%s]\n", tbuf);
}
okay = 0;
length = 0;
xed_decoded_inst_zero_set_mode(&xedd, di->dstate);
if(di->late_init)
(*di->late_init)(&xedd);
if(di->decode_only)
{
xed_uint64_t t1;
xed_uint64_t t2;
xed_error_enum_t xed_error = XED_ERROR_NONE;
t1 = xed_get_time();
#if defined(XED_USE_DECODE_CACHE)
xed_error = xed_decode_cache(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim,
&cache);
#else
xed_error = decode_internal(
&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim);
#endif
t2 = xed_get_time();
okay = (xed_error == XED_ERROR_NONE);
#if defined(PTI_XED_TEST)
if(okay)
pti_xed_test(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim,
runtime_instruction_address);
#endif
xed_decode_stats_reset(&xed_stats, t1, t2);
length = xed_decoded_inst_get_length(&xedd);
if(okay && length == 0)
{
printf("Zero length on decoded instruction!\n");
xed_decode_error(runtime_instruction_address,
z - di->a, z, xed_error);
xedex_derror("Dieing");
}
if(di->resync && di->symfn)
{
xed_bool_t resync = 0;
unsigned int x;
for(x = 1; x < length; x++)
{
char* name = (*di->symfn)(runtime_instruction_address + x,
di->caller_symbol_data);
if(name)
{
char buf[XED_HEX_BUFLEN];
/* bad news. We found a symbol in the middle of an
* instruction. That probably means decoding is
* messed up. This usually happens because of
* data-in the code/text section. We should reject
* the current instruction and pick up at the
* symbol address. */
printf("ERROR: found symbol in the middle of"
" an instruction. Resynchronizing...\n");
printf("ERROR: Rejecting: [");
xed_print_hex_line(buf, z, x, XED_HEX_BUFLEN);
printf("%s]\n", buf);
z += x;
resync = 1;
break;
}
}
if(resync)
continue;
}
xed_stats.total_ilen += length;
//we don't want to print out disassembly with ILD perf
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
if(okay)
{
if(CLIENT_VERBOSE1)
{
char tbuf[XED_TMP_BUF_LEN];
xed_decoded_inst_dump(&xedd, tbuf, XED_TMP_BUF_LEN);
printf("%s\n", tbuf);
}
if(CLIENT_VERBOSE)
{
char buffer[XED_TMP_BUF_LEN];
unsigned int dec_len;
unsigned int sp;
if(di->symfn)
{
char* name = (*di->symfn)(runtime_instruction_address,
di->caller_symbol_data);
if(name)
{
if(di->xml_format)
printf("\n<SYM>%s</SYM>\n", name);
else
printf("\nSYM %s:\n", name);
}
}
if(di->xml_format)
{
printf("<ASMLINE>\n");
printf(" <ADDR>" XED_FMT_LX "</ADDR>\n",
runtime_instruction_address);
printf(" <CATEGORY>%s</CATEGORY>\n",
xed_category_enum_t2str(
xed_decoded_inst_get_category(&xedd)));
printf(" <EXTENSION>%s</EXTENSION>\n",
xed_extension_enum_t2str(
xed_decoded_inst_get_extension(&xedd)));
printf(" <ITEXT>");
dec_len = xed_decoded_inst_get_length(&xedd);
xed_print_hex_line(buffer, (xed_uint8_t*) z,
dec_len, XED_TMP_BUF_LEN);
printf("%s</ITEXT>\n", buffer);
buffer[0] = 0;
disassemble(buffer, XED_TMP_BUF_LEN,
&xedd, runtime_instruction_address,
di->caller_symbol_data);
printf(" %s\n", buffer);
printf("</ASMLINE>\n");
}
else
{
printf("XDIS " XED_FMT_LX ": ",
runtime_instruction_address);
#if 0 /* test code for the new API */
if(xed_decoded_inst_masked_vector_operation(&xedd))
printf("MSK ");
else
printf(" ");
#endif
if(di->ast)
{
printf("%-6s ",
xed_ast_input_enum_t2str(
classify_avx_sse(&xedd)));
}
else
{
printf("%-9s ",
xed_category_enum_t2str(
xed_decoded_inst_get_category(&xedd)));
printf("%-6s ",
xed_extension_enum_t2str(
xed_decoded_inst_get_extension(&xedd)));
}
dec_len = xed_decoded_inst_get_length(&xedd);
xed_print_hex_line(buffer, (xed_uint8_t*) z,
dec_len, XED_HEX_BUFLEN);
printf("%s", buffer);
// pad out the instruction bytes
for(sp = dec_len; sp < 12; sp++)
printf(" ");
printf(" ");
buffer[0] = 0;
disassemble(buffer, XED_TMP_BUF_LEN,
&xedd,
runtime_instruction_address,
di->caller_symbol_data);
printf("%s", buffer);
if(gs)
{
graph_empty = 0;
xed_dot_graph_add_instruction(
gs,
&xedd,
runtime_instruction_address,
di->caller_symbol_data);
}
if(di->line_number_info_fn)
(*di->line_number_info_fn)(runtime_instruction_address);
printf("\n");
}
}
}
else
{
errors++;
xed_decode_error(runtime_instruction_address, z - di->a, z,
xed_error);
// just give a length of 1B to see if we can restart decode...
length = 1;
}
}
#if defined(XED_ENCODER)
else
{
TCA OfflineX86Code::collectJmpTargets(FILE *file,
TCA fileStartAddr,
TCA codeStartAddr,
uint64_t codeLen,
vector<TCA> *jmpTargets) {
xed_uint8_t* code = (xed_uint8_t*) alloca(codeLen);
xed_uint8_t* frontier;
TCA ip;
if (codeLen == 0) return 0;
if (fseek(file, codeStartAddr - fileStartAddr, SEEK_SET)) {
error("collectJmpTargets error: seeking file");
}
size_t readLen = fread(code, codeLen, 1, file);
if (readLen != 1) error("collectJmpTargets error: reading file");
xed_decoded_inst_t xedd;
xed_iclass_enum_t iclass = XED_ICLASS_NOP;
// Decode each instruction
for (frontier = code, ip = codeStartAddr; frontier < code + codeLen; ) {
xed_decoded_inst_zero_set_mode(&xedd, &xed_state);
xed_decoded_inst_set_input_chip(&xedd, XED_CHIP_INVALID);
xed_error_enum_t xed_error = xed_decode(&xedd, frontier, 15);
if (xed_error != XED_ERROR_NONE) break;
uint32_t instrLen = xed_decoded_inst_get_length(&xedd);
iclass = xed_decoded_inst_get_iclass(&xedd);
if (iclass >= XED_ICLASS_JB && iclass <= XED_ICLASS_JZ) {
const xed_inst_t *xi = xed_decoded_inst_inst(&xedd);
always_assert(xed_inst_noperands(xi) >= 1);
const xed_operand_t *opnd = xed_inst_operand(xi, 0);
xed_operand_enum_t opndName = xed_operand_name(opnd);
if (opndName == XED_OPERAND_RELBR) {
always_assert(xed_decoded_inst_get_branch_displacement_width(&xedd));
xed_int32_t disp = xed_decoded_inst_get_branch_displacement(&xedd);
TCA addr = ip + instrLen + disp;
jmpTargets->push_back(addr);
}
}
frontier += instrLen;
ip += instrLen;
}
// If the code sequence falls thru, then add the next instruction as a
// possible target
bool fallsThru = (iclass != XED_ICLASS_JMP &&
iclass != XED_ICLASS_JMP_FAR &&
iclass != XED_ICLASS_RET_NEAR &&
iclass != XED_ICLASS_RET_FAR);
if (fallsThru) {
jmpTargets->push_back(ip);
return ip;
}
return 0;
}
