diff options
author | Cyrille Bagard <nocbos@gmail.com> | 2014-10-06 20:52:21 (GMT) |
---|---|---|
committer | Cyrille Bagard <nocbos@gmail.com> | 2014-10-06 20:52:21 (GMT) |
commit | 1d5f7f28f92251dc4d3bff8d87b3e3052ab9cab2 (patch) | |
tree | 1ad4346a8cbcd8379850f68d04cb8757371c05e1 /src/arch/arm/v7 | |
parent | ada6b756efd6ca109f6c46aa4d3eb11c17ad6b84 (diff) |
Got prepared to disassemble some ARMv7 instructions.
git-svn-id: svn://svn.gna.org/svn/chrysalide/trunk@409 abbe820e-26c8-41b2-8c08-b7b2b41f8b0a
Diffstat (limited to 'src/arch/arm/v7')
-rw-r--r-- | src/arch/arm/v7/Makefile.am | 1 | ||||
-rw-r--r-- | src/arch/arm/v7/arm.c | 414 | ||||
-rw-r--r-- | src/arch/arm/v7/arm.h | 39 | ||||
-rw-r--r-- | src/arch/arm/v7/instruction.c | 6 | ||||
-rw-r--r-- | src/arch/arm/v7/instruction.h | 2 | ||||
-rw-r--r-- | src/arch/arm/v7/processor.c | 77 |
6 files changed, 536 insertions, 3 deletions
diff --git a/src/arch/arm/v7/Makefile.am b/src/arch/arm/v7/Makefile.am index 1ac1c76..dc095ed 100644 --- a/src/arch/arm/v7/Makefile.am +++ b/src/arch/arm/v7/Makefile.am @@ -2,6 +2,7 @@ noinst_LTLIBRARIES = libarcharmv7.la libarcharmv7_la_SOURCES = \ + arm.h arm.c \ instruction.h instruction.c \ processor.h processor.c \ register.h register.c diff --git a/src/arch/arm/v7/arm.c b/src/arch/arm/v7/arm.c new file mode 100644 index 0000000..4953b6b --- /dev/null +++ b/src/arch/arm/v7/arm.c @@ -0,0 +1,414 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * arm.c - désassemblage des instructions ARMv7 + * + * Copyright (C) 2014 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "arm.h" + + +#include <stdint.h> + + +#include "../../../common/bconst.h" + + + + +/* Désassemble une instruction ARMv7 de données ou autre. */ +static GArchInstruction *process_armv7_data_processing_and_miscellaneous_instructions(uint32_t); + +/* Désassemble une instruction ARMv7 de données de registre. */ +static GArchInstruction *process_armv7_data_processing_register(uint32_t); + + + + +// process_armv7_instruction_set_encoding + +#define process_armv7_load_store_word_and_unsigned_byte(raw) NULL +#define process_armv7_load_store_word_and_unsigned_byte(raw) NULL +#define process_armv7_media_instructions(raw) NULL +#define process_armv7_branch_branch_with_link_and_block_data_transfer(raw) NULL +#define process_armv7_coprocessor_instructions_and_Supervisor_call(raw) NULL +#define process_armv7_unconditional_instructions(raw) NULL + + +// process_armv7_data_processing_and_miscellaneous_instructions + +#define process_armv7_data_processing_register_shifted_register(raw) NULL +#define process_armv7_extra_load_store_instructions(raw) NULL +#define process_armv7_miscellaneous_instructions(raw) NULL +#define process_armv7_halfword_multiply_and_multiply_accumulate(raw) NULL +#define process_armv7_multiply_and_multiply_accumulate(raw) NULL +#define process_armv7_synchronization_primitives(raw) NULL +#define process_armv7_extra_load_store_instructions_unprivileged(raw) NULL +#define process_armv7_extra_load_store_instructions(raw) NULL +#define process_armv7_data_processing_immediate(raw) NULL +#define armv7_read_instr_mov_immediate(raw) NULL +#define armv7_read_instr_movt(raw) NULL +#define process_armv7_msr_immediate_and_hints(raw) NULL + + +// process_armv7_data_processing_register + +#define armv7_read_instr_and_register(raw) NULL +#define armv7_read_instr_eor_register(raw) NULL +#define armv7_read_instr_sub_register(raw) NULL +#define armv7_read_instr_rsb_register(raw) NULL +#define armv7_read_instr_add_register(raw) NULL +#define armv7_read_instr_adc_register(raw) NULL +#define armv7_read_instr_sbc_register(raw) NULL +#define armv7_read_instr_rsc_register(raw) NULL +#define armv7_read_instr_tst_register(raw) NULL +#define armv7_read_instr_teq_register(raw) NULL +#define armv7_read_instr_cmp_register(raw) NULL +#define armv7_read_instr_cmn_register(raw) NULL +#define armv7_read_instr_orr_register(raw) NULL +#define armv7_read_instr_mov_register_arm(raw) NULL +#define armv7_read_instr_lsl_immediate(raw) NULL +#define armv7_read_instr_lsr_immediate(raw) NULL +#define armv7_read_instr_asr_immediate(raw) NULL +#define armv7_read_instr_rrx(raw) NULL +#define armv7_read_instr_ror_immediate(raw) NULL +#define armv7_read_instr_bic_register(raw) NULL +#define armv7_read_instr_mvn_register(raw) NULL + + + + + + +/****************************************************************************** +* * +* Paramètres : raw = donnée brute de 32 bits à désassembler. * +* * +* Description : Désassemble une instruction ARMv7 classique. * +* * +* Retour : Instruction mise en place ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GArchInstruction *process_armv7_instruction_set_encoding(uint32_t raw) +{ + GArchInstruction *result; /* Instruction à renvoyer */ + uint32_t cond; /* Champ 'cond' à retrouver */ + uint32_t op1; /* Champ 'op1' à retrouver */ + uint32_t op; /* Champ 'op' à retrouver */ + + /** + * Suit les directives de : + * § A5.1 ARM instruction set encoding + */ + + result = NULL; + + cond = (raw >> 28) & 0xf; + op1 = (raw >> 25) & 0x7; + op = (raw >> 4) & 0x1; + + + if (cond != b1111) + { + if ((op1 & b110) == b000) + result = process_armv7_data_processing_and_miscellaneous_instructions(raw); + + else if (op1 == b010) + result = process_armv7_load_store_word_and_unsigned_byte(raw); + + else if (op1 == b011) + { + if (op == b0) + result = process_armv7_load_store_word_and_unsigned_byte(raw); + + else + result = process_armv7_media_instructions(raw); + + } + + else if ((op1 & b110) == b100) + result = process_armv7_branch_branch_with_link_and_block_data_transfer(raw); + + else if ((op1 & b110) == b110) + result = process_armv7_coprocessor_instructions_and_Supervisor_call(raw); + + } + + else /* if (cond == b1111) */ + result = process_armv7_unconditional_instructions(raw); + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : raw = donnée brute de 32 bits à désassembler. * +* * +* Description : Désassemble une instruction ARMv7 de données ou autre. * +* * +* Retour : Instruction mise en place ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GArchInstruction *process_armv7_data_processing_and_miscellaneous_instructions(uint32_t raw) +{ + GArchInstruction *result; /* Instruction à retourner */ + uint32_t op; /* Champ 'op' à retrouver */ + uint32_t op1; /* Champ 'op1' à retrouver */ + uint32_t op2; /* Champ 'op2' à retrouver */ + + /** + * Suit les directives de : + * § A5.2 Data-processing and miscellaneous instructions + */ + + result = NULL; + + if (raw == 0xe1a0000a) + printf(" ---> data proc & misc\n"); + + op = (raw >> 25) & 0x1; + op1 = (raw >> 20) & 0x1f; + op2 = (raw >> 4) & 0xf; + + if (op == b0) + { + if ((op1 & b11001) != b10000) + { + if ((op2 & b0001) == b0000) + result = process_armv7_data_processing_register(raw); + + else if ((op2 & b1001) == b0001) + result = process_armv7_data_processing_register_shifted_register(raw); + + if (result != NULL) goto padpami_found; + + } + + else /* if ((op1 & b11001) == b10000) */ + { + if ((op2 & b1000) == b0000) + result = process_armv7_miscellaneous_instructions(raw); + + else if ((op2 & b1001) == b1000) + result = process_armv7_halfword_multiply_and_multiply_accumulate(raw); + + if (result != NULL) goto padpami_found; + + } + + if ((op1 & b10000) == b00000) + { + if (op2 == b1001) + result = process_armv7_multiply_and_multiply_accumulate(raw); + + if (result != NULL) goto padpami_found; + + } + + if ((op1 & b10000) == b10000) + { + if (op2 == b1001) + result = process_armv7_synchronization_primitives(raw); + + if (result != NULL) goto padpami_found; + + } + + if ((op1 & b10010) != b00010) + { + if (op2 == b1011) + result = process_armv7_extra_load_store_instructions(raw); + + else if ((op2 & b1101) == b1101) + result = process_armv7_extra_load_store_instructions(raw); + + if (result != NULL) goto padpami_found; + + } + + else /* if ((op1 & b10010) != b00010) */ + { + if (op2 == b1011) + result = process_armv7_extra_load_store_instructions_unprivileged(raw); + + else if ((op2 & b1101) == b1101) + result = process_armv7_extra_load_store_instructions(raw); + + if (result != NULL) goto padpami_found; + + } + + } + + else + { + if ((op1 & b11001) != b10000) + result = process_armv7_data_processing_immediate(raw); + + else if (op1 == b10000) + result = armv7_read_instr_mov_immediate(raw); + + else if (op1 == b10100) + result = armv7_read_instr_movt(raw); + + else if ((op1 & b11011) == b10010) + result = process_armv7_msr_immediate_and_hints(raw); + + } + + padpami_found: + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : raw = donnée brute de 32 bits à désassembler. * +* * +* Description : Désassemble une instruction ARMv7 de données de registre. * +* * +* Retour : Instruction mise en place ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GArchInstruction *process_armv7_data_processing_register(uint32_t raw) +{ + GArchInstruction *result; /* Instruction à retourner */ + uint32_t op; /* Champ 'op' à retrouver */ + uint32_t imm5; /* Champ 'imm5' à retrouver */ + uint32_t op2; /* Champ 'op2' à retrouver */ + + /** + * Suit les directives de : + * § A5.2.1 Data-processing (register) + */ + + result = NULL; + + if (raw == 0xe1a0000a) + printf(" ---> data proc register !\n"); + + op = (raw >> 20) & 0x1f; + imm5 = (raw >> 7) & 0x1f; + op2 = (raw >> 5) & 0x3; + + if ((op & b11110) == b00000) + result = armv7_read_instr_and_register(raw); + + else if ((op & b11110) == b00010) + result = armv7_read_instr_eor_register(raw); + + else if ((op & b11110) == b00100) + result = armv7_read_instr_sub_register(raw); + + else if ((op & b11110) == b00110) + result = armv7_read_instr_rsb_register(raw); + + else if ((op & b11110) == b01000) + result = armv7_read_instr_add_register(raw); + + else if ((op & b11110) == b01010) + result = armv7_read_instr_adc_register(raw); + + else if ((op & b11110) == b01100) + result = armv7_read_instr_sbc_register(raw); + + else if ((op & b11110) == b01110) + result = armv7_read_instr_rsc_register(raw); + + /* + else if ((op & b11001) == b10000) + result = process_armv7_data_processing_and_miscellaneous_instructions(raw); + */ + + else if (op == b10001) + result = armv7_read_instr_tst_register(raw); + + else if (op == b10011) + result = armv7_read_instr_teq_register(raw); + + else if (op == b10101) + result = armv7_read_instr_cmp_register(raw); + + else if (op == b10111) + result = armv7_read_instr_cmn_register(raw); + + else if ((op & b11110) == b11000) + result = armv7_read_instr_orr_register(raw); + + else if ((op & b11110) == b11010) + { + if (op2 == b00) + { + if (imm5 == b00000) + { + result = armv7_read_instr_mov_register_arm(raw); + if (raw == 0xe1a0000a) + printf(" ----> GOT IT :: %p\n", result); + } + + else + result = armv7_read_instr_lsl_immediate(raw); + + } + + else if (op2 == b01) + result = armv7_read_instr_lsr_immediate(raw); + + else if (op2 == b10) + result = armv7_read_instr_asr_immediate(raw); + + else if (op2 == b11) + { + if (imm5 == b00000) + result = armv7_read_instr_rrx(raw); + + else + result = armv7_read_instr_ror_immediate(raw); + + } + + } + + else if ((op & b11110) == b11100) + result = armv7_read_instr_bic_register(raw); + + else if ((op & b11110) == b11110) + result = armv7_read_instr_mvn_register(raw); + + return result; + +} + + + + + diff --git a/src/arch/arm/v7/arm.h b/src/arch/arm/v7/arm.h new file mode 100644 index 0000000..b9c2fe4 --- /dev/null +++ b/src/arch/arm/v7/arm.h @@ -0,0 +1,39 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * arm.h - prototypes pour le désassemblage des instructions ARMv7 + * + * Copyright (C) 2014 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _ARCH_ARM_V7_ARM_H +#define _ARCH_ARM_V7_ARM_H + + +#include "processor.h" +#include "../context.h" +#include "../../instruction.h" + + + +/* Désassemble une instruction ARMv7 classique. */ +GArchInstruction *process_armv7_instruction_set_encoding(uint32_t raw); + + + +#endif /* _ARCH_ARM_V7_ARM_H */ diff --git a/src/arch/arm/v7/instruction.c b/src/arch/arm/v7/instruction.c index 0fc95c9..24135f3 100644 --- a/src/arch/arm/v7/instruction.c +++ b/src/arch/arm/v7/instruction.c @@ -146,7 +146,7 @@ static void g_armv7_instruction_finalize(GArmV7Instruction *instr) /****************************************************************************** * * -* Paramètres : - * +* Paramètres : keyword = définition du nom humaine de l'instruction. * * * * Description : Crée une instruction pour l'architecture ARMv7. * * * @@ -156,12 +156,14 @@ static void g_armv7_instruction_finalize(GArmV7Instruction *instr) * * ******************************************************************************/ -GArmV7Instruction *g_armv7_instruction_new(void) +GArmV7Instruction *g_armv7_instruction_new(const char *keyword) { GArmV7Instruction *result; /* Structure à retourner */ result = g_object_new(G_TYPE_ARMV7_INSTRUCTION, NULL); + G_ARM_INSTRUCTION(result)->keyword = keyword; + return result; } diff --git a/src/arch/arm/v7/instruction.h b/src/arch/arm/v7/instruction.h index 0265911..97ee31a 100644 --- a/src/arch/arm/v7/instruction.h +++ b/src/arch/arm/v7/instruction.h @@ -50,7 +50,7 @@ typedef struct _GArmV7InstructionClass GArmV7InstructionClass; GType g_armv7_instruction_get_type(void); /* Crée une instruction pour l'architecture ARMv7. */ -GArmV7Instruction *g_armv7_instruction_new(void); +GArmV7Instruction *g_armv7_instruction_new(const char *); /* Définit si une instruction ARMv7 met à jour les drapeaux. */ void g_armv7_instruction_define_setflags(GArmV7Instruction *, bool); diff --git a/src/arch/arm/v7/processor.c b/src/arch/arm/v7/processor.c index bcd44e9..3ce1623 100644 --- a/src/arch/arm/v7/processor.c +++ b/src/arch/arm/v7/processor.c @@ -24,7 +24,10 @@ #include "processor.h" +#include "arm.h" +#include "../context.h" #include "../processor-int.h" +#include "../../raw.h" @@ -56,6 +59,9 @@ static void g_armv7_processor_dispose(GArmV7Processor *); /* Procède à la libération totale de la mémoire. */ static void g_armv7_processor_finalize(GArmV7Processor *); +/* Décode une instruction dans un flux de données. */ +static GArchInstruction *g_armv7_processor_disassemble(const GArmV7Processor *, GArmContext *, const bin_t *, vmpa2t *, phys_t); + /* Indique le type défini par la GLib pour le processeur ARMv7. */ @@ -77,12 +83,16 @@ G_DEFINE_TYPE(GArmV7Processor, g_armv7_processor, G_TYPE_ARM_PROCESSOR); static void g_armv7_processor_class_init(GArmV7ProcessorClass *klass) { GObjectClass *object_class; /* Autre version de la classe */ + GArchProcessorClass *proc; /* Encore une autre vision... */ object_class = G_OBJECT_CLASS(klass); + proc = G_ARCH_PROCESSOR_CLASS(klass); object_class->dispose = (GObjectFinalizeFunc/* ! */)g_armv7_processor_dispose; object_class->finalize = (GObjectFinalizeFunc)g_armv7_processor_finalize; + proc->disassemble = (disass_instr_fc)g_armv7_processor_disassemble; + } @@ -171,3 +181,70 @@ GArmV7Processor *g_armv7_processor_new(void) return result; } + + +/****************************************************************************** +* * +* Paramètres : proc = architecture visée par la procédure. * +* ctx = contexte lié à l'exécution du processeur. * +* data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* end = limite des données à analyser. * +* * +* Description : Désassemble une instruction dans un flux de données. * +* * +* Retour : Instruction mise en place ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GArchInstruction *g_armv7_processor_disassemble(const GArmV7Processor *proc, GArmContext *ctx, const bin_t *data, vmpa2t *pos, phys_t end) +{ + GArchInstruction *result; /* Instruction à renvoyer */ + phys_t start; /* Point de départ de lecture */ + uint32_t raw; /* Donnée 32 bits à analyser */ + + + + //printf("Position :: 0x%x\n", (unsigned int)get_phy_addr(pos)); + + // @ 0xae6c + // 0xe1a0000a + + // 1110 0001 1010 0000 0000 0000 0000 1010 + + + //exit(1); + + + raw = 0xe1a0000a; + + + start = get_phy_addr(pos); + + if (!read_u32(&raw, data, &start, end, G_ARCH_PROCESSOR(proc)->endianness)) + return NULL; + + + if (raw == 0xe1a0000a) + printf("read !!!!!!!\n"); + + + /* TODO : thumb... */ + + + result = process_armv7_instruction_set_encoding(raw); + + if (result != NULL) + advance_vmpa(pos, 4); + + else + result = g_raw_instruction_new_array(data, MDS_32_BITS, 1, pos, end, + G_ARCH_PROCESSOR(proc)->endianness); + + + + return result; + +} |