/*
* decode_ext()
*
* Decode opcode extensions (if any)
*/
static int
decode_ext(struct ud *u, uint16_t ptr)
{
uint8_t idx = 0;
if ((ptr & 0x8000) == 0) {
return decode_insn(u, ptr);
}
u->le = &ud_lookup_table_list[(~0x8000 & ptr)];
if (u->le->type == UD_TAB__OPC_3DNOW) {
return decode_3dnow(u);
}
switch (u->le->type) {
case UD_TAB__OPC_MOD:
/* !11 = 0, 11 = 1 */
idx = (MODRM_MOD(modrm(u)) + 1) / 4;
break;
/* disassembly mode/operand size/address size based tables.
* 16 = 0,, 32 = 1, 64 = 2
*/
case UD_TAB__OPC_MODE:
idx = u->dis_mode / 32;
break;
case UD_TAB__OPC_OSIZE:
idx = eff_opr_mode(u->dis_mode, REX_W(u->pfx_rex), u->pfx_opr) / 32;
break;
case UD_TAB__OPC_ASIZE:
idx = eff_adr_mode(u->dis_mode, u->pfx_adr) / 32;
break;
case UD_TAB__OPC_X87:
idx = modrm(u) - 0xC0;
break;
case UD_TAB__OPC_VENDOR:
if (u->vendor == UD_VENDOR_ANY) {
/* choose a valid entry */
idx = (u->le->table[idx] != 0) ? 0 : 1;
} else if (u->vendor == UD_VENDOR_AMD) {
idx = 0;
} else {
idx = 1;
}
break;
case UD_TAB__OPC_RM:
idx = MODRM_RM(modrm(u));
break;
case UD_TAB__OPC_REG:
idx = MODRM_REG(modrm(u));
break;
case UD_TAB__OPC_SSE:
return decode_ssepfx(u);
default:
assert(!"not reached");
break;
}
return decode_ext(u, u->le->table[idx]);
}
/*
* decode_modrm_reg
*
* Decodes reg field of mod/rm byte
*
*/
static inline void
decode_modrm_reg(struct ud *u,
struct ud_operand *operand,
unsigned int type,
unsigned int size)
{
uint8_t reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(modrm(u));
decode_reg(u, operand, type, reg, size);
}
/*
* Figure out which fixups arch_uprobe_post_xol() will need to perform, and
* annotate arch_uprobe->fixups accordingly. To start with,
* arch_uprobe->fixups is either zero or it reflects rip-related fixups.
*/
static void prepare_fixups(struct arch_uprobe *auprobe, struct insn *insn)
{
bool fix_ip = true, fix_call = false; /* defaults */
int reg;
insn_get_opcode(insn); /* should be a nop */
switch (OPCODE1(insn)) {
case 0x9d:
/* popf */
auprobe->fixups |= UPROBE_FIX_SETF;
break;
case 0xc3: /* ret/lret */
case 0xcb:
case 0xc2:
case 0xca:
/* ip is correct */
fix_ip = false;
break;
case 0xe8: /* call relative - Fix return addr */
fix_call = true;
break;
case 0x9a: /* call absolute - Fix return addr, not ip */
fix_call = true;
fix_ip = false;
break;
case 0xff:
insn_get_modrm(insn);
reg = MODRM_REG(insn);
if (reg == 2 || reg == 3) {
/* call or lcall, indirect */
/* Fix return addr; ip is correct. */
fix_call = true;
fix_ip = false;
} else if (reg == 4 || reg == 5) {
/* jmp or ljmp, indirect */
/* ip is correct. */
fix_ip = false;
}
break;
case 0xea: /* jmp absolute -- ip is correct */
fix_ip = false;
break;
default:
break;
}
if (fix_ip)
auprobe->fixups |= UPROBE_FIX_IP;
if (fix_call)
auprobe->fixups |= UPROBE_FIX_CALL;
}
/*
* decode_modrm_reg
*
* Decodes reg field of mod/rm byte
*
*/
static void
decode_modrm_reg(struct ud *u,
struct ud_operand *operand,
unsigned int type,
unsigned int size)
{
uint8_t reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(modrm(u));
operand->type = UD_OP_REG;
operand->size = resolve_operand_size(u, size);
if (type == T_GPR) {
operand->base = decode_gpr(u, operand->size, reg);
} else {
operand->base = resolve_reg(u, type, reg);
}
}
/*
* decode_modrm_rm
*
* Decodes rm field of mod/rm byte
*
*/
static void
decode_modrm_rm(struct ud *u,
struct ud_operand *op,
unsigned char type,
unsigned int size)
{
unsigned char mod, rm, reg;
/* get mod, r/m and reg fields */
mod = MODRM_MOD(modrm(u));
rm = (REX_B(u->pfx_rex) << 3) | MODRM_RM(modrm(u));
reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(modrm(u));
op->size = resolve_operand_size(u, size);
/*
* If mod is 11b, then the modrm.rm specifies a register.
*
*/
if (mod == 3) {
op->type = UD_OP_REG;
if (type == T_GPR) {
op->base = decode_gpr(u, op->size, rm);
} else {
op->base = resolve_reg(u, type, (REX_B(u->pfx_rex) << 3) | (rm & 7));
}
return;
}
/*
* !11 => Memory Address
*/
op->type = UD_OP_MEM;
if (u->adr_mode == 64) {
op->base = UD_R_RAX + rm;
if (mod == 1) {
op->offset = 8;
} else if (mod == 2) {
op->offset = 32;
} else if (mod == 0 && (rm & 7) == 5) {
op->base = UD_R_RIP;
op->offset = 32;
} else {
op->offset = 0;
}
/*
* Scale-Index-Base (SIB)
*/
if ((rm & 7) == 4) {
inp_next(u);
op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
op->index = UD_R_RAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));
op->base = UD_R_RAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));
/* special conditions for base reference */
if (op->index == UD_R_RSP) {
op->index = UD_NONE;
op->scale = UD_NONE;
}
if (op->base == UD_R_RBP || op->base == UD_R_R13) {
if (mod == 0) {
op->base = UD_NONE;
}
if (mod == 1) {
op->offset = 8;
} else {
op->offset = 32;
}
}
}
} else if (u->adr_mode == 32) {
op->base = UD_R_EAX + rm;
if (mod == 1) {
op->offset = 8;
} else if (mod == 2) {
op->offset = 32;
} else if (mod == 0 && rm == 5) {
op->base = UD_NONE;
op->offset = 32;
} else {
op->offset = 0;
}
/* Scale-Index-Base (SIB) */
if ((rm & 7) == 4) {
inp_next(u);
op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
op->index = UD_R_EAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));
op->base = UD_R_EAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));
if (op->index == UD_R_ESP) {
op->index = UD_NONE;
op->scale = UD_NONE;
}
/* special condition for base reference */
if (op->base == UD_R_EBP) {
if (mod == 0) {
op->base = UD_NONE;
}
if (mod == 1) {
op->offset = 8;
} else {
op->offset = 32;
}
}
}
} else {
const unsigned int bases[] = { UD_R_BX, UD_R_BX, UD_R_BP, UD_R_BP,
UD_R_SI, UD_R_DI, UD_R_BP, UD_R_BX };
const unsigned int indices[] = { UD_R_SI, UD_R_DI, UD_R_SI, UD_R_DI,
UD_NONE, UD_NONE, UD_NONE, UD_NONE };
op->base = bases[rm & 7];
op->index = indices[rm & 7];
if (mod == 0 && rm == 6) {
op->offset= 16;
op->base = UD_NONE;
} else if (mod == 1) {
op->offset = 8;
} else if (mod == 2) {
op->offset = 16;
}
}
/*
* extract offset, if any
*/
switch (op->offset) {
case 8 : op->lval.ubyte = inp_uint8(u); break;
case 16: op->lval.uword = inp_uint16(u); break;
case 32: op->lval.udword = inp_uint32(u); break;
case 64: op->lval.uqword = inp_uint64(u); break;
default: break;
}
}
/*
* If arch_uprobe->insn doesn't use rip-relative addressing, return
* immediately. Otherwise, rewrite the instruction so that it accesses
* its memory operand indirectly through a scratch register. Set
* arch_uprobe->fixups and arch_uprobe->rip_rela_target_address
* accordingly. (The contents of the scratch register will be saved
* before we single-step the modified instruction, and restored
* afterward.)
*
* We do this because a rip-relative instruction can access only a
* relatively small area (+/- 2 GB from the instruction), and the XOL
* area typically lies beyond that area. At least for instructions
* that store to memory, we can't execute the original instruction
* and "fix things up" later, because the misdirected store could be
* disastrous.
*
* Some useful facts about rip-relative instructions:
*
* - There's always a modrm byte.
* - There's never a SIB byte.
* - The displacement is always 4 bytes.
*/
static void
handle_riprel_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, struct insn *insn)
{
u8 *cursor;
u8 reg;
if (mm->context.ia32_compat)
return;
auprobe->rip_rela_target_address = 0x0;
if (!insn_rip_relative(insn))
return;
/*
* insn_rip_relative() would have decoded rex_prefix, modrm.
* Clear REX.b bit (extension of MODRM.rm field):
* we want to encode rax/rcx, not r8/r9.
*/
if (insn->rex_prefix.nbytes) {
cursor = auprobe->insn + insn_offset_rex_prefix(insn);
*cursor &= 0xfe; /* Clearing REX.B bit */
}
/*
* Point cursor at the modrm byte. The next 4 bytes are the
* displacement. Beyond the displacement, for some instructions,
* is the immediate operand.
*/
cursor = auprobe->insn + insn_offset_modrm(insn);
insn_get_length(insn);
/*
* Convert from rip-relative addressing to indirect addressing
* via a scratch register. Change the r/m field from 0x5 (%rip)
* to 0x0 (%rax) or 0x1 (%rcx), and squeeze out the offset field.
*/
reg = MODRM_REG(insn);
if (reg == 0) {
/*
* The register operand (if any) is either the A register
* (%rax, %eax, etc.) or (if the 0x4 bit is set in the
* REX prefix) %r8. In any case, we know the C register
* is NOT the register operand, so we use %rcx (register
* #1) for the scratch register.
*/
auprobe->fixups = UPROBE_FIX_RIP_CX;
/* Change modrm from 00 000 101 to 00 000 001. */
*cursor = 0x1;
} else {
/* Use %rax (register #0) for the scratch register. */
auprobe->fixups = UPROBE_FIX_RIP_AX;
/* Change modrm from 00 xxx 101 to 00 xxx 000 */
*cursor = (reg << 3);
}
/* Target address = address of next instruction + (signed) offset */
auprobe->rip_rela_target_address = (long)insn->length + insn->displacement.value;
/* Displacement field is gone; slide immediate field (if any) over. */
if (insn->immediate.nbytes) {
cursor++;
memmove(cursor, cursor + insn->displacement.nbytes, insn->immediate.nbytes);
}
return;
}
/* -----------------------------------------------------------------------------
* decode_modrm() - Decodes ModRM Byte
* -----------------------------------------------------------------------------
*/
static void
decode_modrm(struct ud* u, struct ud_operand *op, unsigned int s,
unsigned char rm_type, struct ud_operand *opreg,
unsigned int reg_size, unsigned char reg_type)
{
unsigned char mod, rm, reg;
inp_next(u);
/* get mod, r/m and reg fields */
mod = MODRM_MOD(inp_curr(u));
rm = (REX_B(u->pfx_rex) << 3) | MODRM_RM(inp_curr(u));
reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(inp_curr(u));
op->size = (uint8_t) resolve_operand_size(u, s);
/* if mod is 11b, then the UD_R_m specifies a gpr/mmx/sse/control/debug */
if (mod == 3) {
op->type = UD_OP_REG;
if (rm_type == T_GPR)
op->base = decode_gpr(u, op->size, rm);
else op->base = resolve_reg(u, rm_type, (REX_B(u->pfx_rex) << 3) | (rm&7));
}
/* else its memory addressing */
else {
op->type = UD_OP_MEM;
/* 64bit addressing */
if (u->adr_mode == 64) {
op->base = UD_R_RAX + rm;
/* get offset type */
if (mod == 1)
op->offset = 8;
else if (mod == 2)
op->offset = 32;
else if (mod == 0 && (rm & 7) == 5) {
op->base = UD_R_RIP;
op->offset = 32;
} else op->offset = 0;
/* Scale-Index-Base (SIB) */
if ((rm & 7) == 4) {
inp_next(u);
op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
op->index = UD_R_RAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));
op->base = UD_R_RAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));
/* special conditions for base reference */
if (op->index == UD_R_RSP) {
op->index = UD_NONE;
op->scale = UD_NONE;
}
if (op->base == UD_R_RBP || op->base == UD_R_R13) {
if (mod == 0)
op->base = UD_NONE;
if (mod == 1)
op->offset = 8;
else op->offset = 32;
}
}
}
/* 32-Bit addressing mode */
else if (u->adr_mode == 32) {
/* get base */
op->base = UD_R_EAX + rm;
/* get offset type */
if (mod == 1)
op->offset = 8;
else if (mod == 2)
op->offset = 32;
else if (mod == 0 && rm == 5) {
op->base = UD_NONE;
op->offset = 32;
} else op->offset = 0;
/* Scale-Index-Base (SIB) */
if ((rm & 7) == 4) {
inp_next(u);
op->scale = (1 << SIB_S(inp_curr(u))) & ~1;
op->index = UD_R_EAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3));
op->base = UD_R_EAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3));
if (op->index == UD_R_ESP) {
op->index = UD_NONE;
op->scale = UD_NONE;
}
/* special condition for base reference */
if (op->base == UD_R_EBP) {
if (mod == 0)
op->base = UD_NONE;
if (mod == 1)
op->offset = 8;
else op->offset = 32;
}
}
}
/* 16bit addressing mode */
else {
switch (rm) {
case 0: op->base = UD_R_BX; op->index = UD_R_SI; break;
case 1: op->base = UD_R_BX; op->index = UD_R_DI; break;
case 2: op->base = UD_R_BP; op->index = UD_R_SI; break;
case 3: op->base = UD_R_BP; op->index = UD_R_DI; break;
case 4: op->base = UD_R_SI; break;
case 5: op->base = UD_R_DI; break;
case 6: op->base = UD_R_BP; break;
case 7: op->base = UD_R_BX; break;
}
if (mod == 0 && rm == 6) {
op->offset= 16;
op->base = UD_NONE;
}
else if (mod == 1)
op->offset = 8;
else if (mod == 2)
op->offset = 16;
}
}
/* extract offset, if any */
switch(op->offset) {
case 8 : op->lval.ubyte = inp_uint8(u); break;
case 16: op->lval.uword = inp_uint16(u); break;
case 32: op->lval.udword = inp_uint32(u); break;
default: break;
}
/* resolve register encoded in reg field */
if (opreg) {
opreg->type = UD_OP_REG;
opreg->size = (uint8_t)resolve_operand_size(u, reg_size);
if (reg_type == T_GPR)
opreg->base = decode_gpr(u, opreg->size, reg);
else opreg->base = resolve_reg(u, reg_type, reg);
}
}
/* Searches the instruction tables for the right entry.
*/
static int search_itab( struct ud * u )
{
struct ud_itab_entry * e = NULL;
enum ud_itab_index table;
uint8_t peek;
uint8_t did_peek = 0;
uint8_t curr;
uint8_t index;
/* if in state of error, return */
if ( u->error )
return -1;
/* get first byte of opcode. */
inp_next(u);
if ( u->error )
return -1;
curr = inp_curr(u);
/* resolve xchg, nop, pause crazyness */
if ( 0x90 == curr ) {
if ( !( u->dis_mode == 64 && REX_B( u->pfx_rex ) ) ) {
if ( u->pfx_rep ) {
u->pfx_rep = 0;
e = & ie_pause;
} else {
e = & ie_nop;
}
goto found_entry;
}
}
/* get top-level table */
if ( 0x0F == curr ) {
table = ITAB__0F;
curr = inp_next(u);
if ( u->error )
return -1;
/* 2byte opcodes can be modified by 0x66, F3, and F2 prefixes */
if ( 0x66 == u->pfx_insn ) {
if ( ud_itab_list[ ITAB__PFX_SSE66__0F ][ curr ].mnemonic != UD_Iinvalid ) {
table = ITAB__PFX_SSE66__0F;
u->pfx_opr = 0;
}
} else if ( 0xF2 == u->pfx_insn ) {
if ( ud_itab_list[ ITAB__PFX_SSEF2__0F ][ curr ].mnemonic != UD_Iinvalid ) {
table = ITAB__PFX_SSEF2__0F;
u->pfx_repne = 0;
}
} else if ( 0xF3 == u->pfx_insn ) {
if ( ud_itab_list[ ITAB__PFX_SSEF3__0F ][ curr ].mnemonic != UD_Iinvalid ) {
table = ITAB__PFX_SSEF3__0F;
u->pfx_repe = 0;
u->pfx_rep = 0;
}
}
/* pick an instruction from the 1byte table */
} else {
table = ITAB__1BYTE;
}
index = curr;
search:
e = & ud_itab_list[ table ][ index ];
/* if mnemonic constant is a standard instruction constant
* our search is over.
*/
if ( e->mnemonic < UD_Id3vil ) {
if ( e->mnemonic == UD_Iinvalid ) {
if ( did_peek ) {
inp_next( u ); if ( u->error ) return -1;
}
goto found_entry;
}
goto found_entry;
}
table = e->prefix;
switch ( e->mnemonic )
{
case UD_Igrp_reg:
peek = inp_peek( u );
did_peek = 1;
index = MODRM_REG( peek );
break;
case UD_Igrp_mod:
peek = inp_peek( u );
did_peek = 1;
index = MODRM_MOD( peek );
if ( index == 3 )
index = ITAB__MOD_INDX__11;
else
index = ITAB__MOD_INDX__NOT_11;
break;
case UD_Igrp_rm:
curr = inp_next( u );
did_peek = 0;
if ( u->error )
return -1;
index = MODRM_RM( curr );
break;
case UD_Igrp_x87:
curr = inp_next( u );
did_peek = 0;
if ( u->error )
return -1;
index = curr - 0xC0;
break;
case UD_Igrp_osize:
if ( u->opr_mode == 64 )
index = ITAB__MODE_INDX__64;
else if ( u->opr_mode == 32 )
index = ITAB__MODE_INDX__32;
else
index = ITAB__MODE_INDX__16;
break;
case UD_Igrp_asize:
if ( u->adr_mode == 64 )
index = ITAB__MODE_INDX__64;
else if ( u->adr_mode == 32 )
index = ITAB__MODE_INDX__32;
else
index = ITAB__MODE_INDX__16;
break;
case UD_Igrp_mode:
if ( u->dis_mode == 64 )
index = ITAB__MODE_INDX__64;
else if ( u->dis_mode == 32 )
index = ITAB__MODE_INDX__32;
else
index = ITAB__MODE_INDX__16;
break;
case UD_Igrp_vendor:
if ( u->vendor == UD_VENDOR_INTEL )
index = ITAB__VENDOR_INDX__INTEL;
else if ( u->vendor == UD_VENDOR_AMD )
index = ITAB__VENDOR_INDX__AMD;
/* else */
/* assert( !"unrecognized vendor id" ); */
break;
case UD_Id3vil:
/* assert( !"invalid instruction mnemonic constant Id3vil" ); */
break;
default:
/* assert( !"invalid instruction mnemonic constant" ); */
break;
}
goto search;
found_entry:
u->itab_entry = e;
u->mnemonic = u->itab_entry->mnemonic;
return 0;
}
