From 4946ffe81e3edf35061a07cf4425f9accff11888 Mon Sep 17 00:00:00 2001 From: Cyrille Bagard Date: Sat, 6 Sep 2008 21:30:01 +0000 Subject: Added more support for lea and push opcodes. git-svn-id: svn://svn.gna.org/svn/chrysalide/trunk@25 abbe820e-26c8-41b2-8c08-b7b2b41f8b0a --- ChangeLog | 18 +++++++++ src/arch/x86/Makefile.am | 1 + src/arch/x86/instruction.h | 4 ++ src/arch/x86/op_lea.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++ src/arch/x86/op_push.c | 52 ++++++++++++++++++++++++++ src/arch/x86/opcodes.h | 6 +++ src/arch/x86/processor.c | 4 ++ 7 files changed, 177 insertions(+) create mode 100644 src/arch/x86/op_lea.c diff --git a/ChangeLog b/ChangeLog index 4cdf2d9..09205e3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,23 @@ 2008-09-06 Cyrille Bagard + * src/arch/x86/instruction.h: + Add more support for lea and push opcodes. + + * src/arch/x86/Makefile.am: + Add op_lea.c to libarchx86_a_SOURCES. + + * src/arch/x86/opcodes.h: + Add more support for lea and push opcodes. + + * src/arch/x86/op_lea.c: + New entry: support the lea opcode. + + * src/arch/x86/op_push.c: + * src/arch/x86/processor.c: + Add more support for lea and push opcodes. + +2008-09-06 Cyrille Bagard + * src/binary.c: * src/binary.h: Display found symbols when loading binary data. diff --git a/src/arch/x86/Makefile.am b/src/arch/x86/Makefile.am index aba9e5b..238cf61 100644 --- a/src/arch/x86/Makefile.am +++ b/src/arch/x86/Makefile.am @@ -11,6 +11,7 @@ libarchx86_a_SOURCES = \ op_hlt.c \ op_inc.c \ op_int.c \ + op_lea.c \ op_leave.c \ op_nop.c \ op_mov.c \ diff --git a/src/arch/x86/instruction.h b/src/arch/x86/instruction.h index f8c2f7d..1a9b6d4 100644 --- a/src/arch/x86/instruction.h +++ b/src/arch/x86/instruction.h @@ -90,6 +90,8 @@ typedef enum _X86Opcodes X86_OP_MOV_FROM_CONTENT1632, /* mov ([0x66] 0x8b) */ + X86_OP_LEA, /* lea ([0x66] 0x8d) */ /* 66 ? */ + X86_OP_NOP, /* nop (0x90) */ X86_OP_MOV_E_AX, /* mov ([0x66] 0xb8) */ @@ -113,6 +115,8 @@ typedef enum _X86Opcodes X86_OP_HLT, /* hlt (0xf4) */ + X86_OP_PUSH_CONTENT, /* push ([0x66] 0xff) */ /* 66 ? */ + X86_OP_COUNT } X86Opcodes; diff --git a/src/arch/x86/op_lea.c b/src/arch/x86/op_lea.c new file mode 100644 index 0000000..2622ebf --- /dev/null +++ b/src/arch/x86/op_lea.c @@ -0,0 +1,92 @@ + +/* OpenIDA - Outil d'analyse de fichiers binaires + * op_lea.c - décodage des chargements d'adresse effective + * + * Copyright (C) 2008 Cyrille Bagard + * + * This file is part of OpenIDA. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see . + */ + + +#include + + +#include "../instruction-int.h" +#include "opcodes.h" +#include "operand.h" + + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* offset = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * +* Description : Décode une instruction de type 'lea' (16 ou 32 bits). * +* * +* Retour : Instruction mise en place ou NULL. * +* * +* Remarques : - * +* * +******************************************************************************/ + +asm_x86_instr *read_instr_lea(const uint8_t *data, off_t *pos, off_t len, uint64_t offset, const asm_x86_processor *proc) +{ + asm_x86_instr *result; /* Instruction à retourner */ + AsmOperandSize oprsize; /* Taille des opérandes */ + asm_x86_operand *reg1; /* Registre de destination */ + asm_x86_operand *reg2; /* Registre de source */ + + result = (asm_x86_instr *)calloc(1, sizeof(asm_x86_instr)); + + /* Utilisation des registres 32 bits ? */ + if (data[*pos] == 0x66) + { + oprsize = switch_x86_operand_size(proc); + (*pos)++; + } + else oprsize = get_x86_current_operand_size(proc); + + ASM_INSTRUCTION(result)->opcode = data[(*pos)++]; + + reg1 = x86_create_reg1632_operand_from_modrm(data[*pos], oprsize == AOS_32_BITS, false); + if (reg1 == NULL) + { + (*pos)--; + free(result); + return NULL; + } + + reg2 = x86_create_content1632_operand(data, pos, len, oprsize == AOS_32_BITS, true); + if (reg2 == NULL) + { + (*pos)--; + free(result); + return NULL; + } + + ASM_INSTRUCTION(result)->operands = (asm_operand **)calloc(2, sizeof(asm_operand *)); + ASM_INSTRUCTION(result)->operands_count = 2; + + ASM_INSTRUCTION(result)->operands[0] = ASM_OPERAND(reg1); + ASM_INSTRUCTION(result)->operands[1] = ASM_OPERAND(reg2); + + return result; + +} diff --git a/src/arch/x86/op_push.c b/src/arch/x86/op_push.c index 0edd9bc..b577177 100644 --- a/src/arch/x86/op_push.c +++ b/src/arch/x86/op_push.c @@ -47,6 +47,58 @@ * * ******************************************************************************/ +asm_x86_instr *read_instr_push_content(const uint8_t *data, off_t *pos, off_t len, uint64_t offset, const asm_x86_processor *proc) +{ + asm_x86_instr *result; /* Instruction à retourner */ + AsmOperandSize oprsize; /* Taille des opérandes */ + asm_x86_operand *content; /* Registre de source */ + + result = (asm_x86_instr *)calloc(1, sizeof(asm_x86_instr)); + + /* Utilisation des registres 32 bits ? */ + if (data[*pos] == 0x66) + { + oprsize = switch_x86_operand_size(proc); + (*pos)++; + } + else oprsize = get_x86_current_operand_size(proc); + + ASM_INSTRUCTION(result)->opcode = data[(*pos)++]; + + content = x86_create_content1632_operand(data, pos, len, oprsize == AOS_32_BITS, true); + if (content == NULL) + { + (*pos)--; + free(result); + return NULL; + } + + ASM_INSTRUCTION(result)->operands = (asm_operand **)calloc(1, sizeof(asm_operand *)); + ASM_INSTRUCTION(result)->operands_count = 1; + + ASM_INSTRUCTION(result)->operands[0] = ASM_OPERAND(content); + + return result; + +} + + +/****************************************************************************** +* * +* Paramètres : data = flux de données à analyser. * +* pos = position courante dans ce flux. [OUT] * +* len = taille totale des données à analyser. * +* offset = adresse virtuelle de l'instruction. * +* proc = architecture ciblée par le désassemblage. * +* * +* Description : Décode une instruction de type 'push' (16 ou 32 bits). * +* * +* Retour : Instruction mise en place ou NULL. * +* * +* Remarques : - * +* * +******************************************************************************/ + asm_x86_instr *read_instr_push_imm1632(const uint8_t *data, off_t *pos, off_t len, uint64_t offset, const asm_x86_processor *proc) { asm_x86_instr *result; /* Instruction à retourner */ diff --git a/src/arch/x86/opcodes.h b/src/arch/x86/opcodes.h index 349ea40..1d3611f 100644 --- a/src/arch/x86/opcodes.h +++ b/src/arch/x86/opcodes.h @@ -58,6 +58,9 @@ asm_x86_instr *read_instr_inc_1632(const uint8_t *, off_t *, off_t, uint64_t, co /* Décode une instruction de type 'int'. */ asm_x86_instr *read_instr_int(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); +/* Décode une instruction de type 'lea' (16 ou 32 bits). */ +asm_x86_instr *read_instr_lea(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); + /* Décode une instruction de type 'leave'. */ asm_x86_instr *read_instr_leave(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); @@ -83,6 +86,9 @@ asm_x86_instr *read_instr_or8_with_reg1632(const uint8_t *, off_t *, off_t, uint asm_x86_instr *read_instr_pop_reg1632(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); /* Décode une instruction de type 'push' (16 ou 32 bits). */ +asm_x86_instr *read_instr_push_content(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); + +/* Décode une instruction de type 'push' (16 ou 32 bits). */ asm_x86_instr *read_instr_push_imm1632(const uint8_t *, off_t *, off_t, uint64_t, const asm_x86_processor *); /* Décode une instruction de type 'push' (16 ou 32 bits). */ diff --git a/src/arch/x86/processor.c b/src/arch/x86/processor.c index f632f4b..c7382ed 100644 --- a/src/arch/x86/processor.c +++ b/src/arch/x86/processor.c @@ -247,6 +247,8 @@ void x86_register_instructions(asm_x86_processor *proc) register_opcode(proc->opcodes[X86_OP_MOV_FROM_CONTENT1632], 0x66, 0x8b, "mov", read_instr_mov_from_content_1632); + register_opcode(proc->opcodes[X86_OP_LEA], 0x66, 0x8d, "lea", read_instr_lea); + register_opcode(proc->opcodes[X86_OP_NOP], 0x00, 0x90, "nop", read_instr_nop); register_opcode(proc->opcodes[X86_OP_MOV_E_AX], 0x66, 0xb8, "mov", read_instr_mov_to_1632); @@ -271,6 +273,8 @@ void x86_register_instructions(asm_x86_processor *proc) register_opcode(proc->opcodes[X86_OP_HLT], 0x00, 0xf4, "hlt", read_instr_hlt); + register_opcode(proc->opcodes[X86_OP_PUSH_CONTENT], 0x66, 0xff, "push", read_instr_push_content); + } -- cgit v0.11.2-87-g4458