diff options
Diffstat (limited to 'plugins/dalvik/processor.c')
| -rw-r--r-- | plugins/dalvik/processor.c | 583 |
1 files changed, 583 insertions, 0 deletions
diff --git a/plugins/dalvik/processor.c b/plugins/dalvik/processor.c new file mode 100644 index 0000000..16d6644 --- /dev/null +++ b/plugins/dalvik/processor.c @@ -0,0 +1,583 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * processor.c - manipulation du processeur de la VM Dalvik + * + * Copyright (C) 2010-2017 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * Chrysalide is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * Chrysalide is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "processor.h" + + +#include <assert.h> + + +#include <arch/processor-int.h> +#include <plugins/dex/format.h> + + +#include "context.h" +#include "instruction.h" +#include "opcodes/opcodes.h" +#include "pseudo/fill.h" +#include "pseudo/switch.h" + + + +/* Définition du processeur de la VM Dalvik (instance) */ +struct _GDalvikProcessor +{ + GArchProcessor parent; /* Instance parente */ + +}; + + +/* Définition du processeur de la VM Dalvik (classe) */ +struct _GDalvikProcessorClass +{ + GArchProcessorClass parent; /* Classe parente */ + +}; + + +/* Initialise la classe des processeurs de VM Dalvik. */ +static void g_dalvik_processor_class_init(GDalvikProcessorClass *); + +/* Initialise une instance de processeur de VM Dalvik. */ +static void g_dalvik_processor_init(GDalvikProcessor *); + +/* Supprime toutes les références externes. */ +static void g_dalvik_processor_dispose(GDalvikProcessor *); + +/* Procède à la libération totale de la mémoire. */ +static void g_dalvik_processor_finalize(GDalvikProcessor *); + +/* Fournit un contexte pour l'exécution du processeur Dalvik. */ +static GDalvikContext *g_dalvik_processor_get_context(const GDalvikProcessor *); + +/* Fournit un contexte pour la décompilation Dalvik. */ +//static GDalvikDContext *g_dalvik_processor_get_decomp_context(const GDalvikProcessor *); + +/* Décode une instruction dans un flux de données. */ +static GArchInstruction *g_dalvik_processor_disassemble(const GArchProcessor *, GDalvikContext *, const GBinContent *, vmpa2t *, GExeFormat *); + +/* Décode une pseudo-instruction dans un flux de données. */ +static GArchInstruction *g_dalvik_processor_disassemble_pseudo(const GArchProcessor *, GDalvikContext *, const GBinContent *, vmpa2t *, uint8_t); + + + +/* Indique le type défini par la GLib pour le processeur DALVIK. */ +G_DEFINE_TYPE(GDalvikProcessor, g_dalvik_processor, G_TYPE_ARCH_PROCESSOR); + + + +/****************************************************************************** +* * +* Paramètres : klass = classe à initialiser. * +* * +* Description : Initialise la classe des processeurs de VM Dalvik. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_processor_class_init(GDalvikProcessorClass *klass) +{ + GObjectClass *object; /* Autre version de la classe */ + GArchProcessorClass *proc; /* Encore une autre vision... */ + + object = G_OBJECT_CLASS(klass); + + object->dispose = (GObjectFinalizeFunc/* ! */)g_dalvik_processor_dispose; + object->finalize = (GObjectFinalizeFunc)g_dalvik_processor_finalize; + + proc = G_ARCH_PROCESSOR_CLASS(klass); + + proc->disassemble = (disass_instr_fc)g_dalvik_processor_disassemble; + +} + + +/****************************************************************************** +* * +* Paramètres : proc = instance à initialiser. * +* * +* Description : Initialise une instance de processeur de VM Dalvik. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_processor_init(GDalvikProcessor *proc) +{ + GArchProcessor *parent; /* Instance parente */ + + parent = G_ARCH_PROCESSOR(proc); + + parent->endianness = SRE_LITTLE; + parent->memsize = MDS_32_BITS; + parent->inssize = MDS_16_BITS; + + parent->get_ctx = (get_processor_context_fc)g_dalvik_processor_get_context; + //parent->get_dec_ctx = (get_decomp_context_fc)g_dalvik_processor_get_decomp_context; + +} + + +/****************************************************************************** +* * +* Paramètres : proc = instance d'objet GLib à traiter. * +* * +* Description : Supprime toutes les références externes. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_processor_dispose(GDalvikProcessor *proc) +{ + G_OBJECT_CLASS(g_dalvik_processor_parent_class)->dispose(G_OBJECT(proc)); + +} + + +/****************************************************************************** +* * +* Paramètres : bookmark = instance d'objet GLib à traiter. * +* * +* Description : Procède à la libération totale de la mémoire. * +* * +* Retour : - * +* * +* Remarques : - * +* * +******************************************************************************/ + +static void g_dalvik_processor_finalize(GDalvikProcessor *proc) +{ + G_OBJECT_CLASS(g_dalvik_processor_parent_class)->finalize(G_OBJECT(proc)); + +} + + +/****************************************************************************** +* * +* Paramètres : - * +* * +* Description : Crée le support de l'architecture Dalvik. * +* * +* Retour : Architecture mise en place. * +* * +* Remarques : - * +* * +******************************************************************************/ + +GArchProcessor *g_dalvik_processor_new(void) +{ + GArchProcessor *result; /* Structure à retourner */ + + result = g_object_new(G_TYPE_DALVIK_PROCESSOR, NULL); + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : proc = architecture, spectatrice ici. * +* * +* Description : Fournit un contexte pour l'exécution du processeur Dalvik. * +* * +* Retour : Contexte mis en place. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GDalvikContext *g_dalvik_processor_get_context(const GDalvikProcessor *proc) +{ + return g_dalvik_context_new(); + +} + + +/****************************************************************************** +* * +* Paramètres : proc = architecture, spectatrice ici. * +* * +* Description : Fournit un contexte pour la décompilation Dalvik. * +* * +* Retour : Contexte mis en place. * +* * +* Remarques : - * +* * +******************************************************************************/ +#if 0 +static GDalvikDContext *g_dalvik_processor_get_decomp_context(const GDalvikProcessor *proc) +{ + return g_dalvik_dcontext_new(); + +} +#endif + + +/****************************************************************************** +* * +* Paramètres : proc = architecture visée par la procédure. * +* ctx = contexte lié à l'exécution du processeur. * +* content = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* format = format du fichier contenant le code. * +* * +* Description : Désassemble une instruction dans un flux de données. * +* * +* Retour : Instruction mise en place ou NULL en cas d'échec. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GArchInstruction *g_dalvik_processor_disassemble(const GArchProcessor *proc, GDalvikContext *ctx, const GBinContent *content, vmpa2t *pos, GExeFormat *format) +{ + GArchInstruction *result; /* Instruction à renvoyer */ + uint8_t raw8; /* Donnée de 8 bits à analyser */ + DalvikOpcodes id; /* Identifiant d'instruction */ + + static const disass_instr_fc decodings[DOP_COUNT] = { + + [DOP_NOP] = dalvik_read_instr_nop, + [DOP_MOVE] = dalvik_read_instr_move, + [DOP_MOVE_FROM_16] = dalvik_read_instr_move_from16, + [DOP_MOVE_16] = dalvik_read_instr_move_16, + [DOP_MOVE_WIDE] = dalvik_read_instr_move_wide, + [DOP_MOVE_WIDE_FROM_16] = dalvik_read_instr_move_wide_from16, + [DOP_MOVE_WIDE_16] = dalvik_read_instr_move_wide_16, + [DOP_MOVE_OBJECT] = dalvik_read_instr_move_object, + [DOP_MOVE_OBJECT_FROM_16] = dalvik_read_instr_move_object_from16, + [DOP_MOVE_OBJECT_16] = dalvik_read_instr_move_object_16, + [DOP_MOVE_RESULT] = dalvik_read_instr_move_result, + [DOP_MOVE_RESULT_WIDE] = dalvik_read_instr_move_result_wide, + [DOP_MOVE_RESULT_OBJECT] = dalvik_read_instr_move_result_object, + [DOP_MOVE_EXCEPTION] = dalvik_read_instr_move_exception, + [DOP_RETURN_VOID] = dalvik_read_instr_return_void, + [DOP_RETURN] = dalvik_read_instr_return, + [DOP_RETURN_WIDE] = dalvik_read_instr_return_wide, + [DOP_RETURN_OBJECT] = dalvik_read_instr_return_object, + [DOP_CONST_4] = dalvik_read_instr_const_4, + [DOP_CONST_16] = dalvik_read_instr_const_16, + [DOP_CONST] = dalvik_read_instr_const, + [DOP_CONST_HIGH16] = dalvik_read_instr_const_high16, + [DOP_CONST_WIDE_16] = dalvik_read_instr_const_wide_16, + [DOP_CONST_WIDE_32] = dalvik_read_instr_const_wide_32, + [DOP_CONST_WIDE] = dalvik_read_instr_const_wide, + [DOP_CONST_WIDE_HIGH16] = dalvik_read_instr_const_wide_high16, + [DOP_CONST_STRING] = dalvik_read_instr_const_string, + [DOP_CONST_STRING_JUMBO] = dalvik_read_instr_const_string_jumbo, + [DOP_CONST_CLASS] = dalvik_read_instr_const_class, + [DOP_MONITOR_ENTER] = dalvik_read_instr_monitor_enter, + [DOP_MONITOR_EXIT] = dalvik_read_instr_monitor_exit, + [DOP_CHECK_CAST] = dalvik_read_instr_check_cast, + [DOP_INSTANCE_OF] = dalvik_read_instr_instance_of, + [DOP_ARRAY_LENGTH] = dalvik_read_instr_array_length, + [DOP_NEW_INSTANCE] = dalvik_read_instr_new_instance, + [DOP_NEW_ARRAY] = dalvik_read_instr_new_array, + [DOP_FILLED_NEW_ARRAY] = dalvik_read_instr_filled_new_array, + [DOP_FILLED_NEW_ARRAY_RANGE]= dalvik_read_instr_filled_new_array_range, + [DOP_FILL_ARRAY_DATA] = dalvik_read_instr_fill_array_data, + [DOP_THROW] = dalvik_read_instr_throw, + [DOP_GOTO] = dalvik_read_instr_goto, + [DOP_GOTO_16] = dalvik_read_instr_goto_16, + [DOP_GOTO_32] = dalvik_read_instr_goto_32, + [DOP_PACKED_SWITCH] = dalvik_read_instr_packed_switch, + [DOP_SPARSE_SWITCH] = dalvik_read_instr_sparse_switch, + [DOP_CMPL_FLOAT] = dalvik_read_instr_cmpl_float, + [DOP_CMPG_FLOAT] = dalvik_read_instr_cmpg_float, + [DOP_CMPL_DOUBLE] = dalvik_read_instr_cmpl_double, + [DOP_CMPG_DOUBLE] = dalvik_read_instr_cmpg_double, + [DOP_CMP_LONG] = dalvik_read_instr_cmp_long, + [DOP_IF_EQ] = dalvik_read_instr_if_eq, + [DOP_IF_NE] = dalvik_read_instr_if_ne, + [DOP_IF_LT] = dalvik_read_instr_if_lt, + [DOP_IF_GE] = dalvik_read_instr_if_ge, + [DOP_IF_GT] = dalvik_read_instr_if_gt, + [DOP_IF_LE] = dalvik_read_instr_if_le, + [DOP_IF_EQZ] = dalvik_read_instr_if_eqz, + [DOP_IF_NEZ] = dalvik_read_instr_if_nez, + [DOP_IF_LTZ] = dalvik_read_instr_if_ltz, + [DOP_IF_GEZ] = dalvik_read_instr_if_gez, + [DOP_IF_GTZ] = dalvik_read_instr_if_gtz, + [DOP_IF_LEZ] = dalvik_read_instr_if_lez, + [DOP_AGET] = dalvik_read_instr_aget, + [DOP_AGET_WIDE] = dalvik_read_instr_aget_wide, + [DOP_AGET_OBJECT] = dalvik_read_instr_aget_object, + [DOP_AGET_BOOLEAN] = dalvik_read_instr_aget_boolean, + [DOP_AGET_BYTE] = dalvik_read_instr_aget_byte, + [DOP_AGET_CHAR] = dalvik_read_instr_aget_char, + [DOP_AGET_SHORT] = dalvik_read_instr_aget_short, + [DOP_APUT] = dalvik_read_instr_aput, + [DOP_APUT_WIDE] = dalvik_read_instr_aput_wide, + [DOP_APUT_OBJECT] = dalvik_read_instr_aput_object, + [DOP_APUT_BOOLEAN] = dalvik_read_instr_aput_boolean, + [DOP_APUT_BYTE] = dalvik_read_instr_aput_byte, + [DOP_APUT_CHAR] = dalvik_read_instr_aput_char, + [DOP_APUT_SHORT] = dalvik_read_instr_aput_short, + [DOP_IGET] = dalvik_read_instr_iget, + [DOP_IGET_WIDE] = dalvik_read_instr_iget_wide, + [DOP_IGET_OBJECT] = dalvik_read_instr_iget_object, + [DOP_IGET_BOOLEAN] = dalvik_read_instr_iget_boolean, + [DOP_IGET_BYTE] = dalvik_read_instr_iget_byte, + [DOP_IGET_CHAR] = dalvik_read_instr_iget_char, + [DOP_IGET_SHORT] = dalvik_read_instr_iget_short, + [DOP_IPUT] = dalvik_read_instr_iput, + [DOP_IPUT_WIDE] = dalvik_read_instr_iput_wide, + [DOP_IPUT_OBJECT] = dalvik_read_instr_iput_object, + [DOP_IPUT_BOOLEAN] = dalvik_read_instr_iput_boolean, + [DOP_IPUT_BYTE] = dalvik_read_instr_iput_byte, + [DOP_IPUT_CHAR] = dalvik_read_instr_iput_char, + [DOP_IPUT_SHORT] = dalvik_read_instr_iput_short, + [DOP_SGET] = dalvik_read_instr_sget, + [DOP_SGET_WIDE] = dalvik_read_instr_sget_wide, + [DOP_SGET_OBJECT] = dalvik_read_instr_sget_object, + [DOP_SGET_BOOLEAN] = dalvik_read_instr_sget_boolean, + [DOP_SGET_BYTE] = dalvik_read_instr_sget_byte, + [DOP_SGET_CHAR] = dalvik_read_instr_sget_char, + [DOP_SGET_SHORT] = dalvik_read_instr_sget_short, + [DOP_SPUT] = dalvik_read_instr_sput, + [DOP_SPUT_WIDE] = dalvik_read_instr_sput_wide, + [DOP_SPUT_OBJECT] = dalvik_read_instr_sput_object, + [DOP_SPUT_BOOLEAN] = dalvik_read_instr_sput_boolean, + [DOP_SPUT_BYTE] = dalvik_read_instr_sput_byte, + [DOP_SPUT_CHAR] = dalvik_read_instr_sput_char, + [DOP_SPUT_SHORT] = dalvik_read_instr_sput_short, + [DOP_INVOKE_VIRTUAL] = dalvik_read_instr_invoke_virtual, + [DOP_INVOKE_SUPER] = dalvik_read_instr_invoke_super, + [DOP_INVOKE_DIRECT] = dalvik_read_instr_invoke_direct, + [DOP_INVOKE_STATIC] = dalvik_read_instr_invoke_static, + [DOP_INVOKE_INTERFACE] = dalvik_read_instr_invoke_interface, + [DOP_INVOKE_VIRTUAL_RANGE] = dalvik_read_instr_invoke_virtual_range, + [DOP_INVOKE_SUPER_RANGE] = dalvik_read_instr_invoke_super_range, + [DOP_INVOKE_DIRECT_RANGE] = dalvik_read_instr_invoke_direct_range, + [DOP_INVOKE_STATIC_RANGE] = dalvik_read_instr_invoke_static_range, + [DOP_INVOKE_INTERFACE_RANGE]= dalvik_read_instr_invoke_interface_range, + [DOP_NEG_INT] = dalvik_read_instr_neg_int, + [DOP_NOT_INT] = dalvik_read_instr_not_int, + [DOP_NEG_LONG] = dalvik_read_instr_neg_long, + [DOP_NOT_LONG] = dalvik_read_instr_not_long, + [DOP_NEG_FLOAT] = dalvik_read_instr_neg_float, + [DOP_NEG_DOUBLE] = dalvik_read_instr_neg_double, + [DOP_TO_INT_LONG] = dalvik_read_instr_int_to_long, + [DOP_TO_INT_FLOAT] = dalvik_read_instr_int_to_float, + [DOP_TO_INT_DOUBLE] = dalvik_read_instr_int_to_double, + [DOP_TO_LONG_INT] = dalvik_read_instr_long_to_int, + [DOP_TO_LONG_FLOAT] = dalvik_read_instr_long_to_float, + [DOP_TO_LONG_DOUBLE] = dalvik_read_instr_long_to_double, + [DOP_TO_FLOAT_INT] = dalvik_read_instr_float_to_int, + [DOP_TO_FLOAT_LONG] = dalvik_read_instr_float_to_long, + [DOP_TO_FLOAT_DOUBLE] = dalvik_read_instr_float_to_double, + [DOP_TO_DOUBLE_INT] = dalvik_read_instr_double_to_int, + [DOP_TO_DOUBLE_LONG] = dalvik_read_instr_double_to_long, + [DOP_TO_DOUBLE_FLOAT] = dalvik_read_instr_double_to_float, + [DOP_TO_INT_BYTE] = dalvik_read_instr_int_to_byte, + [DOP_TO_INT_CHAR] = dalvik_read_instr_int_to_char, + [DOP_TO_INT_SHORT] = dalvik_read_instr_int_to_short, + [DOP_ADD_INT] = dalvik_read_instr_add_int, + [DOP_SUB_INT] = dalvik_read_instr_sub_int, + [DOP_MUL_INT] = dalvik_read_instr_mul_int, + [DOP_DIV_INT] = dalvik_read_instr_div_int, + [DOP_REM_INT] = dalvik_read_instr_rem_int, + [DOP_AND_INT] = dalvik_read_instr_and_int, + [DOP_OR_INT] = dalvik_read_instr_or_int, + [DOP_XOR_INT] = dalvik_read_instr_xor_int, + [DOP_SHL_INT] = dalvik_read_instr_shl_int, + [DOP_SHR_INT] = dalvik_read_instr_shr_int, + [DOP_USHR_INT] = dalvik_read_instr_ushr_int, + [DOP_ADD_LONG] = dalvik_read_instr_add_long, + [DOP_SUB_LONG] = dalvik_read_instr_sub_long, + [DOP_MUL_LONG] = dalvik_read_instr_mul_long, + [DOP_DIV_LONG] = dalvik_read_instr_div_long, + [DOP_REM_LONG] = dalvik_read_instr_rem_long, + [DOP_AND_LONG] = dalvik_read_instr_and_long, + [DOP_OR_LONG] = dalvik_read_instr_or_long, + [DOP_XOR_LONG] = dalvik_read_instr_xor_long, + [DOP_SHL_LONG] = dalvik_read_instr_shl_long, + [DOP_SHR_LONG] = dalvik_read_instr_shr_long, + [DOP_USHR_LONG] = dalvik_read_instr_ushr_long, + [DOP_ADD_FLOAT] = dalvik_read_instr_add_float, + [DOP_SUB_FLOAT] = dalvik_read_instr_sub_float, + [DOP_MUL_FLOAT] = dalvik_read_instr_mul_float, + [DOP_DIV_FLOAT] = dalvik_read_instr_div_float, + [DOP_REM_FLOAT] = dalvik_read_instr_rem_float, + [DOP_ADD_DOUBLE] = dalvik_read_instr_add_double, + [DOP_SUB_DOUBLE] = dalvik_read_instr_sub_double, + [DOP_MUL_DOUBLE] = dalvik_read_instr_mul_double, + [DOP_DIV_DOUBLE] = dalvik_read_instr_div_double, + [DOP_REM_DOUBLE] = dalvik_read_instr_rem_double, + [DOP_ADD_INT_2ADDR] = dalvik_read_instr_add_int_2addr, + [DOP_SUB_INT_2ADDR] = dalvik_read_instr_sub_int_2addr, + [DOP_MUL_INT_2ADDR] = dalvik_read_instr_mul_int_2addr, + [DOP_DIV_INT_2ADDR] = dalvik_read_instr_div_int_2addr, + [DOP_REM_INT_2ADDR] = dalvik_read_instr_rem_int_2addr, + [DOP_AND_INT_2ADDR] = dalvik_read_instr_and_int_2addr, + [DOP_OR_INT_2ADDR] = dalvik_read_instr_or_int_2addr, + [DOP_XOR_INT_2ADDR] = dalvik_read_instr_xor_int_2addr, + [DOP_SHL_INT_2ADDR] = dalvik_read_instr_shl_int_2addr, + [DOP_SHR_INT_2ADDR] = dalvik_read_instr_shr_int_2addr, + [DOP_USHR_INT_2ADDR] = dalvik_read_instr_ushr_int_2addr, + [DOP_ADD_LONG_2ADDR] = dalvik_read_instr_add_long_2addr, + [DOP_SUB_LONG_2ADDR] = dalvik_read_instr_sub_long_2addr, + [DOP_MUL_LONG_2ADDR] = dalvik_read_instr_mul_long_2addr, + [DOP_DIV_LONG_2ADDR] = dalvik_read_instr_div_long_2addr, + [DOP_REM_LONG_2ADDR] = dalvik_read_instr_rem_long_2addr, + [DOP_AND_LONG_2ADDR] = dalvik_read_instr_and_long_2addr, + [DOP_OR_LONG_2ADDR] = dalvik_read_instr_or_long_2addr, + [DOP_XOR_LONG_2ADDR] = dalvik_read_instr_xor_long_2addr, + [DOP_SHL_LONG_2ADDR] = dalvik_read_instr_shl_long_2addr, + [DOP_SHR_LONG_2ADDR] = dalvik_read_instr_shr_long_2addr, + [DOP_USHR_LONG_2ADDR] = dalvik_read_instr_ushr_long_2addr, + [DOP_ADD_FLOAT_2ADDR] = dalvik_read_instr_add_float_2addr, + [DOP_SUB_FLOAT_2ADDR] = dalvik_read_instr_sub_float_2addr, + [DOP_MUL_FLOAT_2ADDR] = dalvik_read_instr_mul_float_2addr, + [DOP_DIV_FLOAT_2ADDR] = dalvik_read_instr_div_float_2addr, + [DOP_REM_FLOAT_2ADDR] = dalvik_read_instr_rem_float_2addr, + [DOP_ADD_DOUBLE_2ADDR] = dalvik_read_instr_add_double_2addr, + [DOP_SUB_DOUBLE_2ADDR] = dalvik_read_instr_sub_double_2addr, + [DOP_MUL_DOUBLE_2ADDR] = dalvik_read_instr_mul_double_2addr, + [DOP_DIV_DOUBLE_2ADDR] = dalvik_read_instr_div_double_2addr, + [DOP_REM_DOUBLE_2ADDR] = dalvik_read_instr_rem_double_2addr, + [DOP_ADD_INT_LIT16] = dalvik_read_instr_add_int_lit16, + [DOP_RSUB_INT] = dalvik_read_instr_rsub_int, + [DOP_MUL_INT_LIT16] = dalvik_read_instr_mul_int_lit16, + [DOP_DIV_INT_LIT16] = dalvik_read_instr_div_int_lit16, + [DOP_REM_INT_LIT16] = dalvik_read_instr_rem_int_lit16, + [DOP_AND_INT_LIT16] = dalvik_read_instr_and_int_lit16, + [DOP_OR_INT_LIT16] = dalvik_read_instr_or_int_lit16, + [DOP_XOR_INT_LIT16] = dalvik_read_instr_xor_int_lit16, + [DOP_ADD_INT_LIT8] = dalvik_read_instr_add_int_lit8, + [DOP_RSUB_INT_LIT8] = dalvik_read_instr_rsub_int_lit8, + [DOP_MUL_INT_LIT8] = dalvik_read_instr_mul_int_lit8, + [DOP_DIV_INT_LIT8] = dalvik_read_instr_div_int_lit8, + [DOP_REM_INT_LIT8] = dalvik_read_instr_rem_int_lit8, + [DOP_AND_INT_LIT8] = dalvik_read_instr_and_int_lit8, + [DOP_OR_INT_LIT8] = dalvik_read_instr_or_int_lit8, + [DOP_XOR_INT_LIT8] = dalvik_read_instr_xor_int_lit8, + [DOP_SHL_INT_LIT8] = dalvik_read_instr_shl_int_lit8, + [DOP_SHR_INT_LIT8] = dalvik_read_instr_shr_int_lit8, + [DOP_USHR_INT_LIT8] = dalvik_read_instr_ushr_int_lit8 + + }; + + /* Données brutes associées à une instruction ? */ + + result = g_dalvik_context_get_raw_data(ctx, content, pos); + + if (result != NULL) goto gdpd_done; + + /* Pseudo-instruction... */ + + if (!g_binary_content_read_u8(content, pos, &raw8)) + return NULL; + + result = g_dalvik_processor_disassemble_pseudo(proc, ctx, content, pos, raw8); + + if (result != NULL) goto gdpd_done; + + /* ... ou instruction classique */ + + assert(raw8 < DOP_COUNT); + + id = (DalvikOpcodes)raw8; + + if (decodings[id] != NULL) + result = decodings[id](proc, G_PROC_CONTEXT(ctx), content, pos, format); + + gdpd_done: + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : proc = architecture visée par la procédure. * +* data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* end = limite des données à analyser. * +* addr = adresse virtuelle de l'instruction. * +* low8 = 8 bits de poids faible déjà lus. * +* * +* Description : Décode une pseudo-instruction dans un flux de données. * +* * +* Retour : Instruction mise en place ou NULL si aucune trouvée. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static GArchInstruction *g_dalvik_processor_disassemble_pseudo(const GArchProcessor *proc, GDalvikContext *ctx, const GBinContent *content, vmpa2t *pos, uint8_t low8) +{ + GArchInstruction *result; /* Instruction à renvoyer */ + vmpa2t tmp; /* Position modifiable */ + uint8_t high8; /* Nouvelle octet à venir lire */ + uint16_t ident; /* Valeur lue dans le code */ + + /* Vérification astucieuse et rapide...*/ + if (low8 != 0x00 /* DOP_NOP */) + return NULL; + + result = NULL; + + copy_vmpa(&tmp, pos); + + if (!g_binary_content_read_u8(content, pos, &high8)) + goto gdpdp_exit; + + ident = high8 << 8 | low8; + + switch (ident) + { + case DPO_PACKED_SWITCH: + case DPO_SPARSE_SWITCH: + result = g_dalvik_switch_instr_new(ident, ctx, content, pos); + break; + + case DPO_FILL_ARRAY_DATA: + result = g_dalvik_fill_instr_new(ident, ctx, content, pos); + break; + + default: + result = NULL; + break; + + } + + gdpdp_exit: + + if (result == NULL) + copy_vmpa(pos, &tmp); + + return result; + +} |