static int is_sse(xed_decoded_inst_t* xedd)
{
const xed_extension_enum_t extension = xed_decoded_inst_get_extension(xedd);
const xed_category_enum_t category = xed_decoded_inst_get_category(xedd);
if(extension == XED_EXTENSION_SSE)
{
if(category != XED_CATEGORY_MMX &&
category != XED_CATEGORY_PREFETCH) /* exclude PREFETCH* insts */
return 1;
}
else if(extension == XED_EXTENSION_SSE2 ||
extension == XED_EXTENSION_SSSE3 ||
extension == XED_EXTENSION_SSE4)
{
if(category != XED_CATEGORY_MMX)
return 1;
}
else if(extension == XED_EXTENSION_AES ||
extension == XED_EXTENSION_PCLMULQDQ)
{
return 1;
}
return 0;
}
xed_uint_t disas_decode_binary(const xed_state_t* dstate,
const xed_uint8_t* hex_decode_text,
const unsigned int bytes,
xed_decoded_inst_t* xedd,
xed_uint64_t runtime_address) {
xed_uint64_t t1,t2;
xed_error_enum_t xed_error;
xed_bool_t okay;
if (CLIENT_VERBOSE) {
print_hex_line(hex_decode_text, bytes);
}
t1 = xed_get_time();
xed_error = xed_decode(xedd, hex_decode_text, bytes);
t2 = xed_get_time();
okay = (xed_error == XED_ERROR_NONE);
if (CLIENT_VERBOSE3) {
xed_uint64_t delta = t2-t1;
printf("Decode time = " XED_FMT_LU "\n", delta);
}
if (okay) {
if (CLIENT_VERBOSE1) {
char tbuf[XED_TMP_BUF_LEN];
xed_decoded_inst_dump(xedd,tbuf,XED_TMP_BUF_LEN);
printf("%s\n",tbuf);
}
if (CLIENT_VERBOSE) {
char buf[XED_TMP_BUF_LEN];
if (xed_decoded_inst_valid(xedd))
{
printf( "ICLASS: %s CATEGORY: %s EXTENSION: %s IFORM: %s"
" ISA_SET: %s\n",
xed_iclass_enum_t2str(xed_decoded_inst_get_iclass(xedd)),
xed_category_enum_t2str(xed_decoded_inst_get_category(xedd)),
xed_extension_enum_t2str(xed_decoded_inst_get_extension(xedd)),
xed_iform_enum_t2str(xed_decoded_inst_get_iform_enum(xedd)),
xed_isa_set_enum_t2str(xed_decoded_inst_get_isa_set(xedd)));
}
memset(buf,0,XED_TMP_BUF_LEN);
disassemble(buf,XED_TMP_BUF_LEN, xedd, runtime_address,0);
printf("SHORT: %s\n", buf);
}
return 1;
}
else {
xed_decode_error(0, 0, hex_decode_text, xed_error);
return 0;
}
(void) dstate; // pacify compiler
}
void xed_disas_test(xed_disas_info_t* di)
{
static int first = 1;
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
xed_uint64_t errors = 0;
#endif
unsigned int m;
unsigned char* z;
unsigned char* zlimit;
unsigned int length;
int skipping;
int last_all_zeros;
unsigned int i;
int okay;
xed_decoded_inst_t xedd;
xed_uint64_t runtime_instruction_address;
xed_dot_graph_supp_t* gs = 0;
xed_bool_t graph_empty = 1;
//#define XED_USE_DECODE_CACHE
#if defined(XED_USE_DECODE_CACHE)
xed_decode_cache_t cache;
xed_uint32_t n_cache_entries = 16 * 1024;
xed_decode_cache_entry_t* cache_entries =
(xed_decode_cache_entry_t*) malloc(n_cache_entries *
sizeof(xed_decode_cache_entry_t));
xed_decode_cache_initialize(&cache, cache_entries, n_cache_entries);
#endif
if(di->dot_graph_output)
{
xed_syntax_enum_t syntax = XED_SYNTAX_INTEL;
gs = xed_dot_graph_supp_create(syntax);
}
if(first)
{
xed_decode_stats_zero(&xed_stats, di);
first = 0;
}
m = di->ninst; // number of things to decode
z = di->a;
if(di->runtime_vaddr_disas_start)
if(di->runtime_vaddr_disas_start > di->runtime_vaddr)
z = (di->runtime_vaddr_disas_start - di->runtime_vaddr) + di->a;
zlimit = 0;
if(di->runtime_vaddr_disas_end)
{
if(di->runtime_vaddr_disas_end > di->runtime_vaddr)
zlimit = (di->runtime_vaddr_disas_end - di->runtime_vaddr) + di->a;
else /* end address is before start of this region -- skip it */
goto finish;
}
if(z >= di->q) /* start pointer is after end of section */
goto finish;
// for skipping long strings of zeros
skipping = 0;
last_all_zeros = 0;
for(i = 0; i < m; i++)
{
int ilim, elim;
if(zlimit && z >= zlimit)
{
if(di->xml_format == 0)
printf("# end of range.\n");
break;
}
if(z >= di->q)
{
if(di->xml_format == 0)
#if !defined(XED_ILD_ONLY)
printf("# end of text section.\n");
#endif
break;
}
/* if we get near the end of the section, clip the itext length */
ilim = 15;
elim = di->q - z;
if(elim < ilim)
ilim = elim;
if(CLIENT_VERBOSE3)
{
printf("\n==============================================\n");
printf("Decoding instruction " XED_FMT_U "\n", i);
printf("==============================================\n");
}
// if we get two full things of 0's in a row, start skipping.
if(all_zeros((xed_uint8_t*) z, ilim))
{
if(skipping)
{
z = z + ilim;
continue;
}
else if(last_all_zeros)
{
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
printf("...\n");
#endif
z = z + ilim;
skipping = 1;
continue;
}
else
last_all_zeros = 1;
}
else
{
skipping = 0;
last_all_zeros = 0;
}
runtime_instruction_address = ((xed_uint64_t)(z - di->a)) +
di->runtime_vaddr;
if(CLIENT_VERBOSE3)
{
char tbuf[XED_HEX_BUFLEN];
printf("Runtime Address " XED_FMT_LX , runtime_instruction_address);
xed_print_hex_line(tbuf, (xed_uint8_t*) z, ilim, XED_HEX_BUFLEN);
printf(" [%s]\n", tbuf);
}
okay = 0;
length = 0;
xed_decoded_inst_zero_set_mode(&xedd, di->dstate);
if(di->late_init)
(*di->late_init)(&xedd);
if(di->decode_only)
{
xed_uint64_t t1;
xed_uint64_t t2;
xed_error_enum_t xed_error = XED_ERROR_NONE;
t1 = xed_get_time();
#if defined(XED_USE_DECODE_CACHE)
xed_error = xed_decode_cache(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim,
&cache);
#else
xed_error = decode_internal(
&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim);
#endif
t2 = xed_get_time();
okay = (xed_error == XED_ERROR_NONE);
#if defined(PTI_XED_TEST)
if(okay)
pti_xed_test(&xedd,
XED_REINTERPRET_CAST(const xed_uint8_t*, z),
ilim,
runtime_instruction_address);
#endif
xed_decode_stats_reset(&xed_stats, t1, t2);
length = xed_decoded_inst_get_length(&xedd);
if(okay && length == 0)
{
printf("Zero length on decoded instruction!\n");
xed_decode_error(runtime_instruction_address,
z - di->a, z, xed_error);
xedex_derror("Dieing");
}
if(di->resync && di->symfn)
{
xed_bool_t resync = 0;
unsigned int x;
for(x = 1; x < length; x++)
{
char* name = (*di->symfn)(runtime_instruction_address + x,
di->caller_symbol_data);
if(name)
{
char buf[XED_HEX_BUFLEN];
/* bad news. We found a symbol in the middle of an
* instruction. That probably means decoding is
* messed up. This usually happens because of
* data-in the code/text section. We should reject
* the current instruction and pick up at the
* symbol address. */
printf("ERROR: found symbol in the middle of"
" an instruction. Resynchronizing...\n");
printf("ERROR: Rejecting: [");
xed_print_hex_line(buf, z, x, XED_HEX_BUFLEN);
printf("%s]\n", buf);
z += x;
resync = 1;
break;
}
}
if(resync)
continue;
}
xed_stats.total_ilen += length;
//we don't want to print out disassembly with ILD perf
#if !defined(XED_ILD_ONLY) && !defined(XED2_PERF_MEASURE)
if(okay)
{
if(CLIENT_VERBOSE1)
{
char tbuf[XED_TMP_BUF_LEN];
xed_decoded_inst_dump(&xedd, tbuf, XED_TMP_BUF_LEN);
printf("%s\n", tbuf);
}
if(CLIENT_VERBOSE)
{
char buffer[XED_TMP_BUF_LEN];
unsigned int dec_len;
unsigned int sp;
if(di->symfn)
{
char* name = (*di->symfn)(runtime_instruction_address,
di->caller_symbol_data);
if(name)
{
if(di->xml_format)
printf("\n<SYM>%s</SYM>\n", name);
else
printf("\nSYM %s:\n", name);
}
}
if(di->xml_format)
{
printf("<ASMLINE>\n");
printf(" <ADDR>" XED_FMT_LX "</ADDR>\n",
runtime_instruction_address);
printf(" <CATEGORY>%s</CATEGORY>\n",
xed_category_enum_t2str(
xed_decoded_inst_get_category(&xedd)));
printf(" <EXTENSION>%s</EXTENSION>\n",
xed_extension_enum_t2str(
xed_decoded_inst_get_extension(&xedd)));
printf(" <ITEXT>");
dec_len = xed_decoded_inst_get_length(&xedd);
xed_print_hex_line(buffer, (xed_uint8_t*) z,
dec_len, XED_TMP_BUF_LEN);
printf("%s</ITEXT>\n", buffer);
buffer[0] = 0;
disassemble(buffer, XED_TMP_BUF_LEN,
&xedd, runtime_instruction_address,
di->caller_symbol_data);
printf(" %s\n", buffer);
printf("</ASMLINE>\n");
}
else
{
printf("XDIS " XED_FMT_LX ": ",
runtime_instruction_address);
#if 0 /* test code for the new API */
if(xed_decoded_inst_masked_vector_operation(&xedd))
printf("MSK ");
else
printf(" ");
#endif
if(di->ast)
{
printf("%-6s ",
xed_ast_input_enum_t2str(
classify_avx_sse(&xedd)));
}
else
{
printf("%-9s ",
xed_category_enum_t2str(
xed_decoded_inst_get_category(&xedd)));
printf("%-6s ",
xed_extension_enum_t2str(
xed_decoded_inst_get_extension(&xedd)));
}
dec_len = xed_decoded_inst_get_length(&xedd);
xed_print_hex_line(buffer, (xed_uint8_t*) z,
dec_len, XED_HEX_BUFLEN);
printf("%s", buffer);
// pad out the instruction bytes
for(sp = dec_len; sp < 12; sp++)
printf(" ");
printf(" ");
buffer[0] = 0;
disassemble(buffer, XED_TMP_BUF_LEN,
&xedd,
runtime_instruction_address,
di->caller_symbol_data);
printf("%s", buffer);
if(gs)
{
graph_empty = 0;
xed_dot_graph_add_instruction(
gs,
&xedd,
runtime_instruction_address,
di->caller_symbol_data);
}
if(di->line_number_info_fn)
(*di->line_number_info_fn)(runtime_instruction_address);
printf("\n");
}
}
}
else
{
errors++;
xed_decode_error(runtime_instruction_address, z - di->a, z,
xed_error);
// just give a length of 1B to see if we can restart decode...
length = 1;
}
}
#if defined(XED_ENCODER)
else
{
void Disasm::disasm(std::ostream& out, uint8_t* codeStartAddr,
uint8_t* codeEndAddr) {
#ifdef HAVE_LIBXED
auto const endClr = m_opts.m_color.empty() ? "" : ANSI_COLOR_END;
char codeStr[MAX_INSTR_ASM_LEN];
xed_uint8_t *frontier;
xed_decoded_inst_t xedd;
uint64_t codeBase = uint64_t(codeStartAddr);
uint64_t ip;
// Decode and print each instruction
for (frontier = codeStartAddr, ip = (uint64_t)codeStartAddr;
frontier < codeEndAddr; ) {
xed_decoded_inst_zero_set_mode(&xedd, &m_xedState);
xed_decoded_inst_set_input_chip(&xedd, XED_CHIP_INVALID);
xed_error_enum_t xed_error = xed_decode(&xedd, frontier, 15);
if (xed_error != XED_ERROR_NONE) error("disasm error: xed_decode failed");
// Get disassembled instruction in codeStr
auto const syntax = m_opts.m_forceAttSyntax ? XED_SYNTAX_ATT
: s_xed_syntax;
if (!xed_format_context(syntax, &xedd, codeStr,
MAX_INSTR_ASM_LEN, ip, nullptr)) {
error("disasm error: xed_format_context failed");
}
uint32_t instrLen = xed_decoded_inst_get_length(&xedd);
// If it's a jump, we're printing relative offsets, and the dest
// is within the range we're printing, add the dest as a relative
// offset.
std::string jmpComment;
auto const cat = xed_decoded_inst_get_category(&xedd);
if (cat == XED_CATEGORY_COND_BR || cat == XED_CATEGORY_UNCOND_BR) {
if (m_opts.m_relativeOffset) {
auto disp = uint64_t(frontier + instrLen +
xed_decoded_inst_get_branch_displacement(&xedd) -
codeBase);
if (disp < uint64_t(codeEndAddr - codeStartAddr)) {
jmpComment = folly::format(" # {:#x}", disp).str();
}
}
}
for (int i = 0; i < m_opts.m_indentLevel; ++i) {
out << ' ';
}
out << m_opts.m_color;
if (m_opts.m_addresses) {
const char* fmt = m_opts.m_relativeOffset ? "{:3x}: " : "{:#10x}: ";
out << folly::format(fmt, ip - (m_opts.m_relativeOffset ? codeBase : 0));
}
if (m_opts.m_printEncoding) {
// print encoding, like in objdump
unsigned posi = 0;
for (; posi < instrLen; ++posi) {
out << folly::format("{:02x} ", (uint8_t)frontier[posi]);
}
for (; posi < 16; ++posi) {
out << " ";
}
}
out << codeStr << jmpComment << endClr << '\n';
frontier += instrLen;
ip += instrLen;
}
#else
out << "This binary was compiled without disassembly support\n";
#endif // HAVE_LIBXED
}
/* This is the central function
Given a memory address, reads a bunch of memory bytes and
calls the disassembler to obtain the information
Then it stores the information into the eh EntryHeader
*/
void decode_address(uint32_t address, EntryHeader *eh, int ignore_taint)
{
unsigned char insn_buf[MAX_INSN_BYTES];
unsigned int is_stackpush = 0, is_stackpop = 0;
unsigned int stackpushpop_acc = 0;
if (xed2chris_regmapping[XED_REG_EAX][0] == 0) {
init_xed2chris();
assert(xed2chris_regmapping[XED_REG_EAX][0] != 0);
}
/* Read memory from TEMU */
TEMU_read_mem(address, MAX_INSN_BYTES, insn_buf);
/* Disassemble instruction buffer */
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_error_enum_t xed_error =
xed_decode(&xedd, STATIC_CAST(const xed_uint8_t*,insn_buf), MAX_INSN_BYTES);
xed_bool_t okay = (xed_error == XED_ERROR_NONE);
if (!okay) return;
// Increase counters
tstats.insn_counter_decoded++;
int i;
/* Clear out Entry header */
memset(eh, 0, sizeof(EntryHeader));
/* Copy the address and instruction size */
eh->address = address;
eh->inst_size = xed_decoded_inst_get_length(&xedd);
if (eh->inst_size > MAX_INSN_BYTES) eh->inst_size = MAX_INSN_BYTES;
/* Copy instruction rawbytes */
memcpy(eh->rawbytes, insn_buf, eh->inst_size);
/* Get the number of XED operands */
const xed_inst_t* xi = xed_decoded_inst_inst(&xedd);
int xed_ops = xed_inst_noperands(xi);
int op_idx = -1;
/* Get the category of the instruction */
xed_category_enum_t category = xed_decoded_inst_get_category(&xedd);
/* Iterate over the XED operands */
for(i = 0; i < xed_ops; i++) {
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
/* Get operand */
const xed_operand_t* op = xed_inst_operand(xi,i);
xed_operand_enum_t op_name = xed_operand_name(op);
switch(op_name) {
/* Register */
case XED_OPERAND_REG0:
case XED_OPERAND_REG1:
case XED_OPERAND_REG2:
case XED_OPERAND_REG3:
case XED_OPERAND_REG4:
case XED_OPERAND_REG5:
case XED_OPERAND_REG6:
case XED_OPERAND_REG7:
case XED_OPERAND_REG8:
case XED_OPERAND_REG9:
case XED_OPERAND_REG10:
case XED_OPERAND_REG11:
case XED_OPERAND_REG12:
case XED_OPERAND_REG13:
case XED_OPERAND_REG14:
case XED_OPERAND_REG15: {
xed_reg_enum_t reg_id = xed_decoded_inst_get_reg(&xedd, op_name);
int regnum = xed2chris_regmapping[reg_id][1];
// Special handling for Push
if (reg_id == XED_REG_STACKPUSH) is_stackpush = 1;
else if (reg_id == XED_REG_STACKPOP) is_stackpop = 1;
if (-1 == regnum)
break;
else {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TRegister;
eh->operand[op_idx].addr = xed2chris_regmapping[reg_id][0];
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = TEMU_cpu_regs[regnum];
switch (eh->operand[op_idx].addr) {
case ax_reg:
case bx_reg:
case cx_reg:
case dx_reg:
case bp_reg:
case sp_reg:
case si_reg:
case di_reg:
eh->operand[op_idx].value &= 0xFFFF;
break;
case al_reg:
case bl_reg:
case cl_reg:
case dl_reg:
eh->operand[op_idx].value &= 0xFF;
break;
case ah_reg:
case bh_reg:
case ch_reg:
case dh_reg:
eh->operand[op_idx].value = (eh->operand[i].value & 0xFF00) >> 8;
break;
default:
break;
}
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
break;
}
/* Immediate */
case XED_OPERAND_IMM0: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
//xed_uint_t width = xed_decoded_inst_get_immediate_width(&xedd);
if (xed_decoded_inst_get_immediate_is_signed(&xedd)) {
xed_int32_t signed_imm_val =
xed_decoded_inst_get_signed_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) signed_imm_val;
}
else {
xed_uint64_t unsigned_imm_val =
xed_decoded_inst_get_unsigned_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
}
break;
break;
}
/* Special immediate only used in ENTER instruction */
case XED_OPERAND_IMM1: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
xed_uint8_t unsigned_imm_val =
xed_decoded_inst_get_second_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
break;
}
/* Memory */
case XED_OPERAND_AGEN:
case XED_OPERAND_MEM0:
case XED_OPERAND_MEM1: {
unsigned long base = 0;
unsigned long index = 0;
unsigned long scale = 1;
unsigned long segbase = 0;
unsigned short segsel = 0;
unsigned long displacement = 0;
unsigned int j;
size_t remaining = 0;
/* Set memory index */
int mem_idx = 0;
if (op_name == XED_OPERAND_MEM1) mem_idx = 1;
unsigned int memlen = xed_decoded_inst_operand_length (&xedd, i);
for (j = 0; j < memlen; j+=4) {
/* Initialization */
base = 0;
index = 0;
scale = 1;
segbase = 0;
segsel = 0;
displacement = 0;
remaining = memlen - j;
op_idx++;
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
eh->num_operands++;
eh->operand[op_idx].type = TMemLoc;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].length =
remaining > 4 ? 4 : (uint8_t) remaining;
// Get Segment register
xed_reg_enum_t seg_regid =
xed_decoded_inst_get_seg_reg(&xedd,mem_idx);
if (seg_regid != XED_REG_INVALID) {
const xed_operand_values_t *xopv =
xed_decoded_inst_operands_const(&xedd);
xed_bool_t default_segment =
xed_operand_values_using_default_segment (xopv,mem_idx);
if (!default_segment) {
eh->num_operands++;
int segmentreg = xed2chris_regmapping[seg_regid][0] - 100;
segbase = TEMU_cpu_segs[segmentreg].base;
segsel = TEMU_cpu_segs[segmentreg].selector;
eh->memregs[op_idx][0].type = TRegister;
eh->memregs[op_idx][0].length = 2;
eh->memregs[op_idx][0].addr = xed2chris_regmapping[seg_regid][0];
eh->memregs[op_idx][0].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][0].value = segsel;
eh->memregs[op_idx][0].usage = memsegment;
if (ignore_taint == 0)
set_operand_data(&(eh->memregs[op_idx][0]));
int dt;
if (segsel & 0x4) // ldt
dt = TEMU_cpu_ldt->base;
else //gdt
dt = TEMU_cpu_gdt->base;
segsel = segsel >> 3;
unsigned long segent = dt + 8 * segsel;
unsigned char segdes[8];
TEMU_read_mem(segent, 8, segdes);
#if 0
// debugging code to double check segbase value
unsigned long segbasenew = segdes[2] + segdes[3] * 256 +
segdes[4] * 256 * 256 + segdes[7] * 256 * 256 * 256;
if (segbase != segbasenew) {
term_printf("segbase unexpected: 0x%08lX v.s 0x%08lX\n",
segbase, segbasenew);
}
#endif
/* Segment descriptor is stored as a memory operand */
eh->num_operands+=2;
eh->memregs[op_idx][3].type = TMemLoc;
eh->memregs[op_idx][3].length = 4;
eh->memregs[op_idx][3].addr = segent;
eh->memregs[op_idx][3].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][3].value = *(uint32_t *) segdes;
eh->memregs[op_idx][3].tainted = 0;
eh->memregs[op_idx][3].usage = memsegent0;
eh->memregs[op_idx][4].type = TMemLoc;
eh->memregs[op_idx][4].length = 4;
eh->memregs[op_idx][4].addr = segent + 4;
eh->memregs[op_idx][4].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][4].value = *(uint32_t *) (segdes + 4);
eh->memregs[op_idx][4].tainted = 0;
eh->memregs[op_idx][4].usage = memsegent1;
}
}
// Get Base register
xed_reg_enum_t base_regid =
xed_decoded_inst_get_base_reg(&xedd,mem_idx);
if (base_regid != XED_REG_INVALID) {
eh->num_operands++;
int basereg = xed2chris_regmapping[base_regid][1];
base = TEMU_cpu_regs[basereg];
eh->memregs[op_idx][1].type = TRegister;
eh->memregs[op_idx][1].addr = xed2chris_regmapping[base_regid][0];
eh->memregs[op_idx][1].length = 4;
eh->memregs[op_idx][1].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][1].value = base;
eh->memregs[op_idx][1].usage = membase;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][1]));
}
// Get Index register and Scale
xed_reg_enum_t index_regid =
xed_decoded_inst_get_index_reg(&xedd,mem_idx);
if (mem_idx == 0 && index_regid != XED_REG_INVALID) {
eh->num_operands++;
int indexreg = xed2chris_regmapping[index_regid][1];
index = TEMU_cpu_regs[indexreg];
eh->memregs[op_idx][2].type = TRegister;
eh->memregs[op_idx][2].addr = xed2chris_regmapping[index_regid][0];
eh->memregs[op_idx][2].length = 4;
eh->memregs[op_idx][2].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][2].value = index;
eh->memregs[op_idx][2].usage = memindex;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][2]));
// Get Scale (AKA width) (only have a scale if the index exists)
if (xed_decoded_inst_get_scale(&xedd,i) != 0) {
scale = (unsigned long) xed_decoded_inst_get_scale(&xedd,mem_idx);
}
}
// Get displacement (AKA offset)
displacement =
(unsigned long) xed_decoded_inst_get_memory_displacement
(&xedd,mem_idx);
// Fix displacement for:
// 1) Any instruction that pushes into the stack, since ESP is
// decremented before memory operand is written using ESP.
// Affects: ENTER,PUSH,PUSHA,PUSHF,CALL
if (is_stackpush) {
stackpushpop_acc += eh->operand[op_idx].length;
displacement = displacement - stackpushpop_acc -j;
}
// 2) Pop instructions where the
// destination operand is a memory location that uses ESP
// as base or index register.
// The pop operations increments ESP and the written memory
// location address needs to be adjusted.
// Affects: pop (%esp)
else if ((category == XED_CATEGORY_POP) && (!is_stackpop)) {
if ((eh->memregs[op_idx][1].addr == esp_reg) ||
(eh->memregs[op_idx][2].addr == esp_reg))
{
displacement = displacement + eh->operand[op_idx].length;
}
}
// Calculate memory address accessed
eh->operand[op_idx].addr =
j + segbase + base + index * scale + displacement;
// Special handling for LEA instructions
if (op_name == XED_OPERAND_AGEN) {
eh->operand[op_idx].type = TMemAddress;
eh->operand[op_idx].length = 4;
has_page_fault = 0; // LEA won't trigger page fault
}
else {
has_page_fault = TEMU_read_mem(eh->operand[op_idx].addr,
(int)(eh->operand[op_idx].length),
(uint8_t *)&(eh->operand[op_idx].value));
}
// Check if instruction accesses user memory
// kernel_mem_start defined in shared/read_linux.c
if ((eh->operand[op_idx].addr < kernel_mem_start) &&
(op_name != XED_OPERAND_AGEN))
{
access_user_mem = 1;
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
}
break;
}
/* Jumps */
case XED_OPERAND_PTR: // pointer (always in conjunction with a IMM0)
case XED_OPERAND_RELBR: { // branch displacements
xed_uint_t disp = xed_decoded_inst_get_branch_displacement(&xedd);
/* Displacement is from instruction end */
/* Adjust displacement with instruction size */
disp = disp + eh->inst_size;
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TJump;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = disp;
break;
}
/* Floating point registers */
case XED_REG_X87CONTROL:
case XED_REG_X87STATUS:
case XED_REG_X87TOP:
case XED_REG_X87TAG:
case XED_REG_X87PUSH:
case XED_REG_X87POP:
case XED_REG_X87POP2:
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TFloatRegister;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
default:
break;
}
}
static PyObject *get_category(instruction_t *self)
{
return PyInt_FromLong(xed_decoded_inst_get_category(self->decoded_inst));
}
