/* OpenIDA - Outil d'analyse de fichiers binaires * processor.c - manipulation du processeur de la VM Dalvik * * Copyright (C) 2010 Cyrille Bagard * * This file is part of OpenIDA. * * OpenIDA is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * OpenIDA is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Foobar. If not, see . */ #include "processor.h" #include "instruction.h" #include "opcodes.h" #include "../processor-int.h" /* Définition du processeur de la VM Dalvik (instance) */ struct _GDalvikProcessor { GArchProcessor parent; /* Instance parente */ }; /* Définition du processeur de la VM Dalvik (classe) */ struct _GDalvikProcessorClass { GArchProcessorClass parent; /* Classe parente */ }; /* Initialise la classe des processeurs de VM Dalvik. */ static void g_dalvik_processor_class_init(GDalvikProcessorClass *); /* Initialise une instance de processeur de VM Dalvik. */ static void g_dalvik_processor_init(GDalvikProcessor *); /* Décode une instruction dans un flux de données. */ static GArchInstruction *g_dalvik_processor_decode_instruction(const GDalvikProcessor *, const bin_t *, off_t *, off_t, vmpa_t); /* Indique le type défini par la GLib pour le processeur DALVIK. */ G_DEFINE_TYPE(GDalvikProcessor, g_dalvik_processor, G_TYPE_ARCH_PROCESSOR); /****************************************************************************** * * * Paramètres : klass = classe à initialiser. * * * * Description : Initialise la classe des processeurs de VM Dalvik. * * * * Retour : - * * * * Remarques : - * * * ******************************************************************************/ static void g_dalvik_processor_class_init(GDalvikProcessorClass *klass) { } /****************************************************************************** * * * Paramètres : proc = instance à initialiser. * * * * Description : Initialise une instance de processeur de VM Dalvik. * * * * Retour : - * * * * Remarques : - * * * ******************************************************************************/ static void g_dalvik_processor_init(GDalvikProcessor *proc) { GArchProcessor *parent; /* Instance parente */ parent = G_ARCH_PROCESSOR(proc); parent->endianness = SRE_LITTLE; parent->memsize = MDS_32_BITS; parent->inssize = MDS_16_BITS; parent->decode = (decode_instruction_fc)g_dalvik_processor_decode_instruction; } /****************************************************************************** * * * Paramètres : - * * * * Description : Crée le support de l'architecture Dalvik. * * * * Retour : Architecture mise en place. * * * * Remarques : - * * * ******************************************************************************/ GArchProcessor *g_dalvik_processor_new(void) { GArchProcessor *result; /* Structure à retourner */ result = g_object_new(G_TYPE_DALVIK_PROCESSOR, NULL); return result; } /****************************************************************************** * * * Paramètres : proc = architecture visée par la procédure. * * data = flux de données à analyser. * * pos = position courante dans ce flux. [OUT] * * len = taille totale des données à analyser. * * addr = adresse virtuelle de l'instruction. * * * * Description : Décode une instruction dans un flux de données. * * * * Retour : Instruction mise en place. * * * * Remarques : - * * * ******************************************************************************/ static GArchInstruction *g_dalvik_processor_decode_instruction(const GDalvikProcessor *proc, const bin_t *data, off_t *pos, off_t len, vmpa_t addr) { GArchInstruction *result; /* Instruction à renvoyer */ DalvikOpcodes id; /* Identifiant d'instruction */ static const dalvik_read_instr decodings[DOP_COUNT] = { [DOP_NOP] = dalvik_read_instr_nop, [DOP_MOVE] = dalvik_read_instr_move, [DOP_MOVE_OBJECT] = dalvik_read_instr_move_object, [DOP_MOVE_RESULT] = dalvik_read_instr_move_result, [DOP_MOVE_RESULT_WIDE] = dalvik_read_instr_move_result_wide, [DOP_MOVE_RESULT_OBJECT] = dalvik_read_instr_move_result_object, [DOP_MOVE_EXCEPTION] = dalvik_read_instr_move_exception, [DOP_RETURN_VOID] = dalvik_read_instr_return_void, [DOP_RETURN] = dalvik_read_instr_return, [DOP_RETURN_WIDE] = dalvik_read_instr_return_wide, [DOP_RETURN_OBJECT] = dalvik_read_instr_return_object, [DOP_CONST_4] = dalvik_read_instr_const_4, [DOP_CONST_16] = dalvik_read_instr_const_16, [DOP_CONST] = dalvik_read_instr_const, [DOP_CONST_HIGH16] = dalvik_read_instr_const_high16, [DOP_CONST_WIDE_16] = dalvik_read_instr_const_wide_16, [DOP_CONST_WIDE] = dalvik_read_instr_const_wide, [DOP_CONST_STRING] = dalvik_read_instr_const_string, [DOP_CHECK_CAST] = dalvik_read_instr_check_cast, [DOP_ARRAY_LENGTH] = dalvik_read_instr_array_length, [DOP_NEW_INSTANCE] = dalvik_read_instr_new_instance, [DOP_NEW_ARRAY] = dalvik_read_instr_new_array, [DOP_GOTO] = dalvik_read_instr_goto, [DOP_GOTO_16] = dalvik_read_instr_goto_16, [DOP_GOTO_32] = dalvik_read_instr_goto_32, [DOP_CMPL_FLOAT] = dalvik_read_instr_cmpl_float, [DOP_CMPG_FLOAT] = dalvik_read_instr_cmpg_float, [DOP_CMPL_DOUBLE] = dalvik_read_instr_cmpl_double, [DOP_CMPG_DOUBLE] = dalvik_read_instr_cmpg_double, [DOP_CMP_LONG] = dalvik_read_instr_cmp_long, [DOP_IF_EQ] = dalvik_read_instr_if_eq, [DOP_IF_NE] = dalvik_read_instr_if_ne, [DOP_IF_LT] = dalvik_read_instr_if_lt, [DOP_IF_GE] = dalvik_read_instr_if_ge, [DOP_IF_GT] = dalvik_read_instr_if_gt, [DOP_IF_LE] = dalvik_read_instr_if_le, [DOP_IF_EQZ] = dalvik_read_instr_if_eqz, [DOP_IF_NEZ] = dalvik_read_instr_if_nez, [DOP_IF_LTZ] = dalvik_read_instr_if_ltz, [DOP_IF_GEZ] = dalvik_read_instr_if_gez, [DOP_IF_GTZ] = dalvik_read_instr_if_gtz, [DOP_IF_LEZ] = dalvik_read_instr_if_lez, [DOP_AGET] = dalvik_read_instr_aget, [DOP_AGET_WIDE] = dalvik_read_instr_aget_wide, [DOP_AGET_OBJECT] = dalvik_read_instr_aget_object, [DOP_AGET_BOOLEAN] = dalvik_read_instr_aget_boolean, [DOP_AGET_BYTE] = dalvik_read_instr_aget_byte, [DOP_AGET_CHAR] = dalvik_read_instr_aget_char, [DOP_AGET_SHORT] = dalvik_read_instr_aget_short, [DOP_APUT] = dalvik_read_instr_aput, [DOP_APUT_WIDE] = dalvik_read_instr_aput_wide, [DOP_APUT_OBJECT] = dalvik_read_instr_aput_object, [DOP_APUT_BOOLEAN] = dalvik_read_instr_aput_boolean, [DOP_APUT_BYTE] = dalvik_read_instr_aput_byte, [DOP_APUT_CHAR] = dalvik_read_instr_aput_char, [DOP_APUT_SHORT] = dalvik_read_instr_aput_short, [DOP_IGET] = dalvik_read_instr_iget, [DOP_IGET_WIDE] = dalvik_read_instr_iget_wide, [DOP_IGET_OBJECT] = dalvik_read_instr_iget_object, [DOP_IGET_BOOLEAN] = dalvik_read_instr_iget_boolean, [DOP_IGET_BYTE] = dalvik_read_instr_iget_byte, [DOP_IGET_CHAR] = dalvik_read_instr_iget_char, [DOP_IGET_SHORT] = dalvik_read_instr_iget_short, [DOP_IPUT] = dalvik_read_instr_iput, [DOP_IPUT_WIDE] = dalvik_read_instr_iput_wide, [DOP_IPUT_OBJECT] = dalvik_read_instr_iput_object, [DOP_IPUT_BOOLEAN] = dalvik_read_instr_iput_boolean, [DOP_IPUT_BYTE] = dalvik_read_instr_iput_byte, [DOP_IPUT_CHAR] = dalvik_read_instr_iput_char, [DOP_IPUT_SHORT] = dalvik_read_instr_iput_short, [DOP_SGET] = dalvik_read_instr_sget, [DOP_SGET_WIDE] = dalvik_read_instr_sget_wide, [DOP_SGET_OBJECT] = dalvik_read_instr_sget_object, [DOP_SGET_BOOLEAN] = dalvik_read_instr_sget_boolean, [DOP_SGET_BYTE] = dalvik_read_instr_sget_byte, [DOP_SGET_CHAR] = dalvik_read_instr_sget_char, [DOP_SGET_SHORT] = dalvik_read_instr_sget_short, [DOP_SPUT] = dalvik_read_instr_sput, [DOP_SPUT_WIDE] = dalvik_read_instr_sput_wide, [DOP_SPUT_OBJECT] = dalvik_read_instr_sput_object, [DOP_SPUT_BOOLEAN] = dalvik_read_instr_sput_boolean, [DOP_SPUT_BYTE] = dalvik_read_instr_sput_byte, [DOP_SPUT_CHAR] = dalvik_read_instr_sput_char, [DOP_SPUT_SHORT] = dalvik_read_instr_sput_short, [DOP_INVOKE_VIRTUAL] = dalvik_read_instr_invoke_virtual, [DOP_INVOKE_SUPER] = dalvik_read_instr_invoke_super, [DOP_INVOKE_DIRECT] = dalvik_read_instr_invoke_direct, [DOP_INVOKE_STATIC] = dalvik_read_instr_invoke_static, [DOP_INVOKE_INTERFACE] = dalvik_read_instr_invoke_interface, [DOP_TO_INT_LONG] = dalvik_read_instr_to_int_long, [DOP_TO_INT_FLOAT] = dalvik_read_instr_to_int_float, [DOP_TO_INT_DOUBLE] = dalvik_read_instr_to_int_double, [DOP_TO_LONG_INT] = dalvik_read_instr_to_long_int, [DOP_TO_LONG_FLOAT] = dalvik_read_instr_to_long_float, [DOP_TO_LONG_DOUBLE] = dalvik_read_instr_to_long_double, [DOP_TO_FLOAT_INT] = dalvik_read_instr_to_float_int, [DOP_TO_FLOAT_LONG] = dalvik_read_instr_to_float_long, [DOP_TO_FLOAT_DOUBLE] = dalvik_read_instr_to_float_double, [DOP_TO_DOUBLE_INT] = dalvik_read_instr_to_double_int, [DOP_TO_DOUBLE_LONG] = dalvik_read_instr_to_double_long, [DOP_TO_DOUBLE_FLOAT] = dalvik_read_instr_to_double_float, [DOP_TO_INT_BYTE] = dalvik_read_instr_to_int_byte, [DOP_TO_INT_CHAR] = dalvik_read_instr_to_int_char, [DOP_TO_INT_SHORT] = dalvik_read_instr_to_int_short, [DOP_ADD_INT] = dalvik_read_instr_add_int, [DOP_SUB_INT] = dalvik_read_instr_sub_int, [DOP_MUL_INT] = dalvik_read_instr_mul_int, [DOP_DIV_INT] = dalvik_read_instr_div_int, [DOP_REM_INT] = dalvik_read_instr_rem_int, [DOP_AND_INT] = dalvik_read_instr_and_int, [DOP_OR_INT] = dalvik_read_instr_or_int, [DOP_XOR_INT] = dalvik_read_instr_xor_int, [DOP_ADD_INT_2ADDR] = dalvik_read_instr_add_int_2addr, [DOP_MUL_INT_2ADDR] = dalvik_read_instr_mul_int_2addr, [DOP_DIV_INT_2ADDR] = dalvik_read_instr_div_int_2addr, [DOP_REM_INT_2ADDR] = dalvik_read_instr_rem_int_2addr, [DOP_AND_INT_2ADDR] = dalvik_read_instr_and_int_2addr, [DOP_OR_INT_2ADDR] = dalvik_read_instr_or_int_2addr, [DOP_XOR_INT_2ADDR] = dalvik_read_instr_xor_int_2addr, [DOP_MUL_DOUBLE_2ADDR] = dalvik_read_instr_mul_double_2addr, [DOP_ADD_INT_LIT16] = dalvik_read_instr_add_int_lit16, [DOP_RSUB_INT] = dalvik_read_instr_rsub_int, [DOP_MUL_INT_LIT16] = dalvik_read_instr_mul_int_lit16, [DOP_DIV_INT_LIT16] = dalvik_read_instr_div_int_lit16, [DOP_REM_INT_LIT16] = dalvik_read_instr_rem_int_lit16, [DOP_AND_INT_LIT16] = dalvik_read_instr_and_int_lit16, [DOP_OR_INT_LIT16] = dalvik_read_instr_or_int_lit16, [DOP_XOR_INT_LIT16] = dalvik_read_instr_xor_int_lit16, [DOP_ADD_INT_LIT8] = dalvik_read_instr_add_int_lit8, [DOP_RSUB_INT_LIT8] = dalvik_read_instr_rsub_int_lit8, [DOP_MUL_INT_LIT8] = dalvik_read_instr_mul_int_lit8, [DOP_DIV_INT_LIT8] = dalvik_read_instr_div_int_lit8, [DOP_REM_INT_LIT8] = dalvik_read_instr_rem_int_lit8, [DOP_AND_INT_LIT8] = dalvik_read_instr_and_int_lit8, [DOP_OR_INT_LIT8] = dalvik_read_instr_or_int_lit8, [DOP_XOR_INT_LIT8] = dalvik_read_instr_xor_int_lit8 }; id = dalvik_guess_next_instruction(data, *pos, len); if (id != DOP_COUNT) (*pos)++; if (id == DOP_COUNT) result = NULL; else result = decodings[id](data, pos, len, addr, proc); return result; }