xed_int64_t GetImmediate(xed_decoded_inst_t &xedd, int &mark)
{
const xed_operand_values_t* operandPtr = xed_decoded_inst_operands_const(&xedd);
mark = 0;
//Return true if there is an immediate operand.
if(xed_operand_values_has_immediate(operandPtr))
{
//Return true if the first immediate (IMM0) is signed.
xed_uint_t sign = xed_operand_values_get_immediate_is_signed(operandPtr);
if(sign)
{
mark = -1;
return xed_operand_values_get_immediate_int64(operandPtr);
}
else
{
mark = 1;
return (xed_int64_t)xed_operand_values_get_immediate_uint64(operandPtr);
}
}
return 0;
}
int MemoryOperandSize(xed_decoded_inst_t &xedd, int index)
{
//size2 = xed_decoded_inst_get_memop_address_width(&xedd, 0);
ASSERT(IsMemoryOperand(xedd, index));
const xed_operand_values_t* operandPtr = xed_decoded_inst_operands_const(&xedd);
int size = (int)xed_operand_values_get_memory_operand_length(operandPtr, 0);
// here the memory operation we concerned, is all MEM0
// currently, I am not very clear what does the MEM1 means.
return size * 8;
// here the size is 1, 2, 4;
}
void
VariableHunter::findAbsoluteVariable(xed_decoded_inst_t &xedd)
{
const xed_operand_values_t* operandPtr = xed_decoded_inst_operands_const(&xedd);
// we need to extract the variable from memory.
xed_bool_t mark = xed_operand_values_accesses_memory(operandPtr);
if(!mark){
return;
}
// we ignore the push or pop instruction
xed_iclass_enum_t iclass = xed_decoded_inst_get_iclass(&xedd);
if( iclass == XED_ICLASS_PUSH || iclass == XED_ICLASS_POP ||
iclass == XED_ICLASS_ENTER || iclass == XED_ICLASS_LEAVE ||
iclass == XED_ICLASS_RET_FAR || iclass == XED_ICLASS_RET_NEAR )
{
return;
}
xed_int32_t disp = (xed_int32_t)xed_operand_values_get_memory_displacement_int64(operandPtr);
xed_reg_enum_t base_reg = xed_operand_values_get_base_reg(operandPtr, 0);
xed_reg_enum_t index_reg = xed_operand_values_get_index_reg(operandPtr, 0);
if(base_reg == XED_REG_INVALID && index_reg == XED_REG_INVALID)
{
if(absolute_variable.find(disp) == absolute_variable.end())
{
AbstractVariable *var = new AbstractVariable();
var -> region = Absolute;
var -> offset = disp;
// we can assign a size here, if the later calculation change this size, everything is OK
// if this variable happen to be a boundary variable, the size of instruction will be the size of variable.
var -> size = xed_operand_values_get_memory_operand_length(operandPtr, 0);
absolute_variable.insert(std::make_pair<int, AbstractVariable*>(disp, var));
}
}
return;
}
void
VariableHunter::findStackVariable(xed_decoded_inst_t &xedd)
{
//unsigned int operandNum = xed_decoded_inst_noperands(&xedd);
const xed_operand_values_t* operandPtr = xed_decoded_inst_operands_const(&xedd);
bool trackanswer;
trackanswer = TrackState -> trackESP(xedd);
ASSERT(trackanswer);
// we need to extract the variable from memory.
xed_bool_t mark = xed_operand_values_accesses_memory(operandPtr);
if(!mark){
return;
}
// we ignore the push or pop instruction
xed_iclass_enum_t iclass = xed_decoded_inst_get_iclass(&xedd);
if( iclass == XED_ICLASS_PUSH || iclass == XED_ICLASS_POP ||
iclass == XED_ICLASS_ENTER || iclass == XED_ICLASS_LEAVE ||
iclass == XED_ICLASS_RET_FAR || iclass == XED_ICLASS_RET_NEAR )
{
return;
}
xed_int32_t disp = (xed_int32_t)xed_operand_values_get_memory_displacement_int64(operandPtr);
xed_reg_enum_t base_reg = xed_operand_values_get_base_reg(operandPtr, 0);
//xed_reg_enum_t index_reg = xed_operand_values_get_index_reg(operandPtr, 0);
//unsigned int length = xed_operand_values_get_memory_operand_length(operandPtr, 0);
//unsigned int scale = xed_operand_values_get_scale(operandPtr);
//xed_reg_enum_t seg_reg = xed_operand_values_get_seg_reg(operandPtr, 0); //segment reg
//EBP based memory access
if(base_reg == XED_REG_EBP)//&& index_reg == XED_REG_INVALID)
{
if(stack_variable.find(disp) == stack_variable.end())
{
AbstractVariable *var = new AbstractVariable();
var -> region = Stack;
var -> offset = disp;
stack_variable.insert(std::make_pair<int, AbstractVariable*>(disp, var));
}
}
//ESP based memory access
if(base_reg == XED_REG_ESP)// && index_reg == XED_REG_INVALID)
{
int distance = TrackState -> getESP();
disp = disp - distance;
// compute the ebp based offset
if(stack_variable.find(disp) == stack_variable.end())
{
AbstractVariable *var = new AbstractVariable();
var -> region = Stack;
var -> offset = disp;
// we can assign a size here, if the later calculation change this size, everything is OK
// if this variable happen to be a boundary variable, the size of this instruction will be the size of the variable
var -> size = xed_operand_values_get_memory_operand_length(operandPtr, 0);
// the unit is byte.
stack_variable.insert(std::make_pair<int, AbstractVariable*>(disp, var));
}
}
return;
}
/* This is the central function
Given a memory address, reads a bunch of memory bytes and
calls the disassembler to obtain the information
Then it stores the information into the eh EntryHeader
*/
void decode_address(uint32_t address, EntryHeader *eh, int ignore_taint)
{
unsigned char insn_buf[MAX_INSN_BYTES];
unsigned int is_stackpush = 0, is_stackpop = 0;
unsigned int stackpushpop_acc = 0;
if (xed2chris_regmapping[XED_REG_EAX][0] == 0) {
init_xed2chris();
assert(xed2chris_regmapping[XED_REG_EAX][0] != 0);
}
/* Read memory from TEMU */
TEMU_read_mem(address, MAX_INSN_BYTES, insn_buf);
/* Disassemble instruction buffer */
xed_decoded_inst_zero_set_mode(&xedd, &dstate);
xed_error_enum_t xed_error =
xed_decode(&xedd, STATIC_CAST(const xed_uint8_t*,insn_buf), MAX_INSN_BYTES);
xed_bool_t okay = (xed_error == XED_ERROR_NONE);
if (!okay) return;
// Increase counters
tstats.insn_counter_decoded++;
int i;
/* Clear out Entry header */
memset(eh, 0, sizeof(EntryHeader));
/* Copy the address and instruction size */
eh->address = address;
eh->inst_size = xed_decoded_inst_get_length(&xedd);
if (eh->inst_size > MAX_INSN_BYTES) eh->inst_size = MAX_INSN_BYTES;
/* Copy instruction rawbytes */
memcpy(eh->rawbytes, insn_buf, eh->inst_size);
/* Get the number of XED operands */
const xed_inst_t* xi = xed_decoded_inst_inst(&xedd);
int xed_ops = xed_inst_noperands(xi);
int op_idx = -1;
/* Get the category of the instruction */
xed_category_enum_t category = xed_decoded_inst_get_category(&xedd);
/* Iterate over the XED operands */
for(i = 0; i < xed_ops; i++) {
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
/* Get operand */
const xed_operand_t* op = xed_inst_operand(xi,i);
xed_operand_enum_t op_name = xed_operand_name(op);
switch(op_name) {
/* Register */
case XED_OPERAND_REG0:
case XED_OPERAND_REG1:
case XED_OPERAND_REG2:
case XED_OPERAND_REG3:
case XED_OPERAND_REG4:
case XED_OPERAND_REG5:
case XED_OPERAND_REG6:
case XED_OPERAND_REG7:
case XED_OPERAND_REG8:
case XED_OPERAND_REG9:
case XED_OPERAND_REG10:
case XED_OPERAND_REG11:
case XED_OPERAND_REG12:
case XED_OPERAND_REG13:
case XED_OPERAND_REG14:
case XED_OPERAND_REG15: {
xed_reg_enum_t reg_id = xed_decoded_inst_get_reg(&xedd, op_name);
int regnum = xed2chris_regmapping[reg_id][1];
// Special handling for Push
if (reg_id == XED_REG_STACKPUSH) is_stackpush = 1;
else if (reg_id == XED_REG_STACKPOP) is_stackpop = 1;
if (-1 == regnum)
break;
else {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TRegister;
eh->operand[op_idx].addr = xed2chris_regmapping[reg_id][0];
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = TEMU_cpu_regs[regnum];
switch (eh->operand[op_idx].addr) {
case ax_reg:
case bx_reg:
case cx_reg:
case dx_reg:
case bp_reg:
case sp_reg:
case si_reg:
case di_reg:
eh->operand[op_idx].value &= 0xFFFF;
break;
case al_reg:
case bl_reg:
case cl_reg:
case dl_reg:
eh->operand[op_idx].value &= 0xFF;
break;
case ah_reg:
case bh_reg:
case ch_reg:
case dh_reg:
eh->operand[op_idx].value = (eh->operand[i].value & 0xFF00) >> 8;
break;
default:
break;
}
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
break;
}
/* Immediate */
case XED_OPERAND_IMM0: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
//xed_uint_t width = xed_decoded_inst_get_immediate_width(&xedd);
if (xed_decoded_inst_get_immediate_is_signed(&xedd)) {
xed_int32_t signed_imm_val =
xed_decoded_inst_get_signed_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) signed_imm_val;
}
else {
xed_uint64_t unsigned_imm_val =
xed_decoded_inst_get_unsigned_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
}
break;
break;
}
/* Special immediate only used in ENTER instruction */
case XED_OPERAND_IMM1: {
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TImmediate;
eh->operand[op_idx].length =
(uint8_t) xed_decoded_inst_operand_length (&xedd, i);
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
xed_uint8_t unsigned_imm_val =
xed_decoded_inst_get_second_immediate(&xedd);
eh->operand[op_idx].value = (uint32_t) unsigned_imm_val;
break;
}
/* Memory */
case XED_OPERAND_AGEN:
case XED_OPERAND_MEM0:
case XED_OPERAND_MEM1: {
unsigned long base = 0;
unsigned long index = 0;
unsigned long scale = 1;
unsigned long segbase = 0;
unsigned short segsel = 0;
unsigned long displacement = 0;
unsigned int j;
size_t remaining = 0;
/* Set memory index */
int mem_idx = 0;
if (op_name == XED_OPERAND_MEM1) mem_idx = 1;
unsigned int memlen = xed_decoded_inst_operand_length (&xedd, i);
for (j = 0; j < memlen; j+=4) {
/* Initialization */
base = 0;
index = 0;
scale = 1;
segbase = 0;
segsel = 0;
displacement = 0;
remaining = memlen - j;
op_idx++;
if(op_idx >= MAX_NUM_OPERANDS)
break;
//assert(op_idx < MAX_NUM_OPERANDS);
eh->num_operands++;
eh->operand[op_idx].type = TMemLoc;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].length =
remaining > 4 ? 4 : (uint8_t) remaining;
// Get Segment register
xed_reg_enum_t seg_regid =
xed_decoded_inst_get_seg_reg(&xedd,mem_idx);
if (seg_regid != XED_REG_INVALID) {
const xed_operand_values_t *xopv =
xed_decoded_inst_operands_const(&xedd);
xed_bool_t default_segment =
xed_operand_values_using_default_segment (xopv,mem_idx);
if (!default_segment) {
eh->num_operands++;
int segmentreg = xed2chris_regmapping[seg_regid][0] - 100;
segbase = TEMU_cpu_segs[segmentreg].base;
segsel = TEMU_cpu_segs[segmentreg].selector;
eh->memregs[op_idx][0].type = TRegister;
eh->memregs[op_idx][0].length = 2;
eh->memregs[op_idx][0].addr = xed2chris_regmapping[seg_regid][0];
eh->memregs[op_idx][0].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][0].value = segsel;
eh->memregs[op_idx][0].usage = memsegment;
if (ignore_taint == 0)
set_operand_data(&(eh->memregs[op_idx][0]));
int dt;
if (segsel & 0x4) // ldt
dt = TEMU_cpu_ldt->base;
else //gdt
dt = TEMU_cpu_gdt->base;
segsel = segsel >> 3;
unsigned long segent = dt + 8 * segsel;
unsigned char segdes[8];
TEMU_read_mem(segent, 8, segdes);
#if 0
// debugging code to double check segbase value
unsigned long segbasenew = segdes[2] + segdes[3] * 256 +
segdes[4] * 256 * 256 + segdes[7] * 256 * 256 * 256;
if (segbase != segbasenew) {
term_printf("segbase unexpected: 0x%08lX v.s 0x%08lX\n",
segbase, segbasenew);
}
#endif
/* Segment descriptor is stored as a memory operand */
eh->num_operands+=2;
eh->memregs[op_idx][3].type = TMemLoc;
eh->memregs[op_idx][3].length = 4;
eh->memregs[op_idx][3].addr = segent;
eh->memregs[op_idx][3].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][3].value = *(uint32_t *) segdes;
eh->memregs[op_idx][3].tainted = 0;
eh->memregs[op_idx][3].usage = memsegent0;
eh->memregs[op_idx][4].type = TMemLoc;
eh->memregs[op_idx][4].length = 4;
eh->memregs[op_idx][4].addr = segent + 4;
eh->memregs[op_idx][4].access =
(uint8_t) XED_OPERAND_ACTION_INVALID;
eh->memregs[op_idx][4].value = *(uint32_t *) (segdes + 4);
eh->memregs[op_idx][4].tainted = 0;
eh->memregs[op_idx][4].usage = memsegent1;
}
}
// Get Base register
xed_reg_enum_t base_regid =
xed_decoded_inst_get_base_reg(&xedd,mem_idx);
if (base_regid != XED_REG_INVALID) {
eh->num_operands++;
int basereg = xed2chris_regmapping[base_regid][1];
base = TEMU_cpu_regs[basereg];
eh->memregs[op_idx][1].type = TRegister;
eh->memregs[op_idx][1].addr = xed2chris_regmapping[base_regid][0];
eh->memregs[op_idx][1].length = 4;
eh->memregs[op_idx][1].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][1].value = base;
eh->memregs[op_idx][1].usage = membase;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][1]));
}
// Get Index register and Scale
xed_reg_enum_t index_regid =
xed_decoded_inst_get_index_reg(&xedd,mem_idx);
if (mem_idx == 0 && index_regid != XED_REG_INVALID) {
eh->num_operands++;
int indexreg = xed2chris_regmapping[index_regid][1];
index = TEMU_cpu_regs[indexreg];
eh->memregs[op_idx][2].type = TRegister;
eh->memregs[op_idx][2].addr = xed2chris_regmapping[index_regid][0];
eh->memregs[op_idx][2].length = 4;
eh->memregs[op_idx][2].access = (uint8_t) XED_OPERAND_ACTION_R;
eh->memregs[op_idx][2].value = index;
eh->memregs[op_idx][2].usage = memindex;
if (ignore_taint == 0) set_operand_data(&(eh->memregs[op_idx][2]));
// Get Scale (AKA width) (only have a scale if the index exists)
if (xed_decoded_inst_get_scale(&xedd,i) != 0) {
scale = (unsigned long) xed_decoded_inst_get_scale(&xedd,mem_idx);
}
}
// Get displacement (AKA offset)
displacement =
(unsigned long) xed_decoded_inst_get_memory_displacement
(&xedd,mem_idx);
// Fix displacement for:
// 1) Any instruction that pushes into the stack, since ESP is
// decremented before memory operand is written using ESP.
// Affects: ENTER,PUSH,PUSHA,PUSHF,CALL
if (is_stackpush) {
stackpushpop_acc += eh->operand[op_idx].length;
displacement = displacement - stackpushpop_acc -j;
}
// 2) Pop instructions where the
// destination operand is a memory location that uses ESP
// as base or index register.
// The pop operations increments ESP and the written memory
// location address needs to be adjusted.
// Affects: pop (%esp)
else if ((category == XED_CATEGORY_POP) && (!is_stackpop)) {
if ((eh->memregs[op_idx][1].addr == esp_reg) ||
(eh->memregs[op_idx][2].addr == esp_reg))
{
displacement = displacement + eh->operand[op_idx].length;
}
}
// Calculate memory address accessed
eh->operand[op_idx].addr =
j + segbase + base + index * scale + displacement;
// Special handling for LEA instructions
if (op_name == XED_OPERAND_AGEN) {
eh->operand[op_idx].type = TMemAddress;
eh->operand[op_idx].length = 4;
has_page_fault = 0; // LEA won't trigger page fault
}
else {
has_page_fault = TEMU_read_mem(eh->operand[op_idx].addr,
(int)(eh->operand[op_idx].length),
(uint8_t *)&(eh->operand[op_idx].value));
}
// Check if instruction accesses user memory
// kernel_mem_start defined in shared/read_linux.c
if ((eh->operand[op_idx].addr < kernel_mem_start) &&
(op_name != XED_OPERAND_AGEN))
{
access_user_mem = 1;
}
if (ignore_taint == 0) set_operand_data(&(eh->operand[op_idx]));
}
break;
}
/* Jumps */
case XED_OPERAND_PTR: // pointer (always in conjunction with a IMM0)
case XED_OPERAND_RELBR: { // branch displacements
xed_uint_t disp = xed_decoded_inst_get_branch_displacement(&xedd);
/* Displacement is from instruction end */
/* Adjust displacement with instruction size */
disp = disp + eh->inst_size;
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TJump;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
eh->operand[op_idx].value = disp;
break;
}
/* Floating point registers */
case XED_REG_X87CONTROL:
case XED_REG_X87STATUS:
case XED_REG_X87TOP:
case XED_REG_X87TAG:
case XED_REG_X87PUSH:
case XED_REG_X87POP:
case XED_REG_X87POP2:
op_idx++;
eh->num_operands++;
eh->operand[op_idx].type = TFloatRegister;
eh->operand[op_idx].length = 4;
eh->operand[op_idx].access = (uint8_t) xed_operand_rw (op);
default:
break;
}
}
