393 lines
14 KiB
C++
393 lines
14 KiB
C++
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
/*
|
||
|
|
* Implementation of MiniDisassembler.
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include "mini_disassembler.h"
|
||
|
|
|
||
|
|
namespace sidestep {
|
||
|
|
|
||
|
|
MiniDisassembler::MiniDisassembler(bool operand_default_is_32_bits,
|
||
|
|
bool address_default_is_32_bits)
|
||
|
|
: operand_default_is_32_bits_(operand_default_is_32_bits),
|
||
|
|
address_default_is_32_bits_(address_default_is_32_bits) {
|
||
|
|
Initialize();
|
||
|
|
}
|
||
|
|
|
||
|
|
MiniDisassembler::MiniDisassembler()
|
||
|
|
: operand_default_is_32_bits_(true),
|
||
|
|
address_default_is_32_bits_(true) {
|
||
|
|
Initialize();
|
||
|
|
}
|
||
|
|
|
||
|
|
InstructionType MiniDisassembler::Disassemble(
|
||
|
|
unsigned char* start_byte,
|
||
|
|
unsigned int& instruction_bytes) {
|
||
|
|
// Clean up any state from previous invocations.
|
||
|
|
Initialize();
|
||
|
|
|
||
|
|
// Start by processing any prefixes.
|
||
|
|
unsigned char* current_byte = start_byte;
|
||
|
|
unsigned int size = 0;
|
||
|
|
InstructionType instruction_type = ProcessPrefixes(current_byte, size);
|
||
|
|
|
||
|
|
if (IT_UNKNOWN == instruction_type)
|
||
|
|
return instruction_type;
|
||
|
|
|
||
|
|
current_byte += size;
|
||
|
|
size = 0;
|
||
|
|
|
||
|
|
// Invariant: We have stripped all prefixes, and the operand_is_32_bits_
|
||
|
|
// and address_is_32_bits_ flags are correctly set.
|
||
|
|
|
||
|
|
instruction_type = ProcessOpcode(current_byte, 0, size);
|
||
|
|
|
||
|
|
// Check for error processing instruction
|
||
|
|
if ((IT_UNKNOWN == instruction_type_) || (IT_UNUSED == instruction_type_)) {
|
||
|
|
return IT_UNKNOWN;
|
||
|
|
}
|
||
|
|
|
||
|
|
current_byte += size;
|
||
|
|
|
||
|
|
// Invariant: operand_bytes_ indicates the total size of operands
|
||
|
|
// specified by the opcode and/or ModR/M byte and/or SIB byte.
|
||
|
|
// pCurrentByte points to the first byte after the ModR/M byte, or after
|
||
|
|
// the SIB byte if it is present (i.e. the first byte of any operands
|
||
|
|
// encoded in the instruction).
|
||
|
|
|
||
|
|
// We get the total length of any prefixes, the opcode, and the ModR/M and
|
||
|
|
// SIB bytes if present, by taking the difference of the original starting
|
||
|
|
// address and the current byte (which points to the first byte of the
|
||
|
|
// operands if present, or to the first byte of the next instruction if
|
||
|
|
// they are not). Adding the count of bytes in the operands encoded in
|
||
|
|
// the instruction gives us the full length of the instruction in bytes.
|
||
|
|
instruction_bytes += operand_bytes_ + (current_byte - start_byte);
|
||
|
|
|
||
|
|
// Return the instruction type, which was set by ProcessOpcode().
|
||
|
|
return instruction_type_;
|
||
|
|
}
|
||
|
|
|
||
|
|
void MiniDisassembler::Initialize() {
|
||
|
|
operand_is_32_bits_ = operand_default_is_32_bits_;
|
||
|
|
address_is_32_bits_ = address_default_is_32_bits_;
|
||
|
|
operand_bytes_ = 0;
|
||
|
|
have_modrm_ = false;
|
||
|
|
should_decode_modrm_ = false;
|
||
|
|
instruction_type_ = IT_UNKNOWN;
|
||
|
|
got_f2_prefix_ = false;
|
||
|
|
got_f3_prefix_ = false;
|
||
|
|
got_66_prefix_ = false;
|
||
|
|
}
|
||
|
|
|
||
|
|
InstructionType MiniDisassembler::ProcessPrefixes(unsigned char* start_byte,
|
||
|
|
unsigned int& size) {
|
||
|
|
InstructionType instruction_type = IT_GENERIC;
|
||
|
|
const Opcode& opcode = s_ia32_opcode_map_[0].table_[*start_byte];
|
||
|
|
|
||
|
|
switch (opcode.type_) {
|
||
|
|
case IT_PREFIX_ADDRESS:
|
||
|
|
address_is_32_bits_ = !address_default_is_32_bits_;
|
||
|
|
goto nochangeoperand;
|
||
|
|
case IT_PREFIX_OPERAND:
|
||
|
|
operand_is_32_bits_ = !operand_default_is_32_bits_;
|
||
|
|
nochangeoperand:
|
||
|
|
case IT_PREFIX:
|
||
|
|
|
||
|
|
if (0xF2 == (*start_byte))
|
||
|
|
got_f2_prefix_ = true;
|
||
|
|
else if (0xF3 == (*start_byte))
|
||
|
|
got_f3_prefix_ = true;
|
||
|
|
else if (0x66 == (*start_byte))
|
||
|
|
got_66_prefix_ = true;
|
||
|
|
|
||
|
|
instruction_type = opcode.type_;
|
||
|
|
size ++;
|
||
|
|
// we got a prefix, so add one and check next byte
|
||
|
|
ProcessPrefixes(start_byte + 1, size);
|
||
|
|
default:
|
||
|
|
break; // not a prefix byte
|
||
|
|
}
|
||
|
|
|
||
|
|
return instruction_type;
|
||
|
|
}
|
||
|
|
|
||
|
|
InstructionType MiniDisassembler::ProcessOpcode(unsigned char* start_byte,
|
||
|
|
unsigned int table_index,
|
||
|
|
unsigned int& size) {
|
||
|
|
const OpcodeTable& table = s_ia32_opcode_map_[table_index]; // Get our table
|
||
|
|
unsigned char current_byte = (*start_byte) >> table.shift_;
|
||
|
|
current_byte = current_byte & table.mask_; // Mask out the bits we will use
|
||
|
|
|
||
|
|
// Check whether the byte we have is inside the table we have.
|
||
|
|
if (current_byte < table.min_lim_ || current_byte > table.max_lim_) {
|
||
|
|
instruction_type_ = IT_UNKNOWN;
|
||
|
|
return instruction_type_;
|
||
|
|
}
|
||
|
|
|
||
|
|
const Opcode& opcode = table.table_[current_byte];
|
||
|
|
if (IT_UNUSED == opcode.type_) {
|
||
|
|
// This instruction is not used by the IA-32 ISA, so we indicate
|
||
|
|
// this to the user. Probably means that we were pointed to
|
||
|
|
// a byte in memory that was not the start of an instruction.
|
||
|
|
instruction_type_ = IT_UNUSED;
|
||
|
|
return instruction_type_;
|
||
|
|
} else if (IT_REFERENCE == opcode.type_) {
|
||
|
|
// We are looking at an opcode that has more bytes (or is continued
|
||
|
|
// in the ModR/M byte). Recursively find the opcode definition in
|
||
|
|
// the table for the opcode's next byte.
|
||
|
|
size++;
|
||
|
|
ProcessOpcode(start_byte + 1, opcode.table_index_, size);
|
||
|
|
return instruction_type_;
|
||
|
|
}
|
||
|
|
|
||
|
|
const SpecificOpcode* specific_opcode = (SpecificOpcode*)&opcode;
|
||
|
|
if (opcode.is_prefix_dependent_) {
|
||
|
|
if (got_f2_prefix_ && opcode.opcode_if_f2_prefix_.mnemonic_ != 0) {
|
||
|
|
specific_opcode = &opcode.opcode_if_f2_prefix_;
|
||
|
|
} else if (got_f3_prefix_ && opcode.opcode_if_f3_prefix_.mnemonic_ != 0) {
|
||
|
|
specific_opcode = &opcode.opcode_if_f3_prefix_;
|
||
|
|
} else if (got_66_prefix_ && opcode.opcode_if_66_prefix_.mnemonic_ != 0) {
|
||
|
|
specific_opcode = &opcode.opcode_if_66_prefix_;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// Inv: The opcode type is known.
|
||
|
|
instruction_type_ = specific_opcode->type_;
|
||
|
|
|
||
|
|
// Let's process the operand types to see if we have any immediate
|
||
|
|
// operands, and/or a ModR/M byte.
|
||
|
|
|
||
|
|
ProcessOperand(specific_opcode->flag_dest_);
|
||
|
|
ProcessOperand(specific_opcode->flag_source_);
|
||
|
|
ProcessOperand(specific_opcode->flag_aux_);
|
||
|
|
|
||
|
|
// Inv: We have processed the opcode and incremented operand_bytes_
|
||
|
|
// by the number of bytes of any operands specified by the opcode
|
||
|
|
// that are stored in the instruction (not registers etc.). Now
|
||
|
|
// we need to return the total number of bytes for the opcode and
|
||
|
|
// for the ModR/M or SIB bytes if they are present.
|
||
|
|
|
||
|
|
if (table.mask_ != 0xff) {
|
||
|
|
if (have_modrm_) {
|
||
|
|
// we're looking at a ModR/M byte so we're not going to
|
||
|
|
// count that into the opcode size
|
||
|
|
ProcessModrm(start_byte, size);
|
||
|
|
return IT_GENERIC;
|
||
|
|
} else {
|
||
|
|
// need to count the ModR/M byte even if it's just being
|
||
|
|
// used for opcode extension
|
||
|
|
size++;
|
||
|
|
return IT_GENERIC;
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if (have_modrm_) {
|
||
|
|
// The ModR/M byte is the next byte.
|
||
|
|
size++;
|
||
|
|
ProcessModrm(start_byte + 1, size);
|
||
|
|
return IT_GENERIC;
|
||
|
|
} else {
|
||
|
|
size++;
|
||
|
|
return IT_GENERIC;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
bool MiniDisassembler::ProcessOperand(int flag_operand) {
|
||
|
|
bool succeeded = true;
|
||
|
|
if (AM_NOT_USED == flag_operand)
|
||
|
|
return succeeded;
|
||
|
|
|
||
|
|
// Decide what to do based on the addressing mode.
|
||
|
|
switch (flag_operand & AM_MASK) {
|
||
|
|
// No ModR/M byte indicated by these addressing modes, and no
|
||
|
|
// additional (e.g. immediate) parameters.
|
||
|
|
case AM_A: // Direct address
|
||
|
|
case AM_F: // EFLAGS register
|
||
|
|
case AM_X: // Memory addressed by the DS:SI register pair
|
||
|
|
case AM_Y: // Memory addressed by the ES:DI register pair
|
||
|
|
case AM_IMPLICIT: // Parameter is implicit, occupies no space in
|
||
|
|
// instruction
|
||
|
|
break;
|
||
|
|
|
||
|
|
// There is a ModR/M byte but it does not necessarily need
|
||
|
|
// to be decoded.
|
||
|
|
case AM_C: // reg field of ModR/M selects a control register
|
||
|
|
case AM_D: // reg field of ModR/M selects a debug register
|
||
|
|
case AM_G: // reg field of ModR/M selects a general register
|
||
|
|
case AM_P: // reg field of ModR/M selects an MMX register
|
||
|
|
case AM_R: // mod field of ModR/M may refer only to a general register
|
||
|
|
case AM_S: // reg field of ModR/M selects a segment register
|
||
|
|
case AM_T: // reg field of ModR/M selects a test register
|
||
|
|
case AM_V: // reg field of ModR/M selects a 128-bit XMM register
|
||
|
|
have_modrm_ = true;
|
||
|
|
break;
|
||
|
|
|
||
|
|
// In these addressing modes, there is a ModR/M byte and it needs to be
|
||
|
|
// decoded. No other (e.g. immediate) params than indicated in ModR/M.
|
||
|
|
case AM_E: // Operand is either a general-purpose register or memory,
|
||
|
|
// specified by ModR/M byte
|
||
|
|
case AM_M: // ModR/M byte will refer only to memory
|
||
|
|
case AM_Q: // Operand is either an MMX register or memory (complex
|
||
|
|
// evaluation), specified by ModR/M byte
|
||
|
|
case AM_W: // Operand is either a 128-bit XMM register or memory (complex
|
||
|
|
// eval), specified by ModR/M byte
|
||
|
|
have_modrm_ = true;
|
||
|
|
should_decode_modrm_ = true;
|
||
|
|
break;
|
||
|
|
|
||
|
|
// These addressing modes specify an immediate or an offset value
|
||
|
|
// directly, so we need to look at the operand type to see how many
|
||
|
|
// bytes.
|
||
|
|
case AM_I: // Immediate data.
|
||
|
|
case AM_J: // Jump to offset.
|
||
|
|
case AM_O: // Operand is at offset.
|
||
|
|
switch (flag_operand & OT_MASK) {
|
||
|
|
case OT_B: // Byte regardless of operand-size attribute.
|
||
|
|
operand_bytes_ += OS_BYTE;
|
||
|
|
break;
|
||
|
|
case OT_C: // Byte or word, depending on operand-size attribute.
|
||
|
|
if (operand_is_32_bits_)
|
||
|
|
operand_bytes_ += OS_WORD;
|
||
|
|
else
|
||
|
|
operand_bytes_ += OS_BYTE;
|
||
|
|
break;
|
||
|
|
case OT_D: // Doubleword, regardless of operand-size attribute.
|
||
|
|
operand_bytes_ += OS_DOUBLE_WORD;
|
||
|
|
break;
|
||
|
|
case OT_DQ: // Double-quadword, regardless of operand-size attribute.
|
||
|
|
operand_bytes_ += OS_DOUBLE_QUAD_WORD;
|
||
|
|
break;
|
||
|
|
case OT_P: // 32-bit or 48-bit pointer, depending on operand-size
|
||
|
|
// attribute.
|
||
|
|
if (operand_is_32_bits_)
|
||
|
|
operand_bytes_ += OS_48_BIT_POINTER;
|
||
|
|
else
|
||
|
|
operand_bytes_ += OS_32_BIT_POINTER;
|
||
|
|
break;
|
||
|
|
case OT_PS: // 128-bit packed single-precision floating-point data.
|
||
|
|
operand_bytes_ += OS_128_BIT_PACKED_SINGLE_PRECISION_FLOATING;
|
||
|
|
break;
|
||
|
|
case OT_Q: // Quadword, regardless of operand-size attribute.
|
||
|
|
operand_bytes_ += OS_QUAD_WORD;
|
||
|
|
break;
|
||
|
|
case OT_S: // 6-byte pseudo-descriptor.
|
||
|
|
operand_bytes_ += OS_PSEUDO_DESCRIPTOR;
|
||
|
|
break;
|
||
|
|
case OT_SD: // Scalar Double-Precision Floating-Point Value
|
||
|
|
case OT_PD: // Unaligned packed double-precision floating point value
|
||
|
|
operand_bytes_ += OS_DOUBLE_PRECISION_FLOATING;
|
||
|
|
break;
|
||
|
|
case OT_SS:
|
||
|
|
// Scalar element of a 128-bit packed single-precision
|
||
|
|
// floating data.
|
||
|
|
// We simply return enItUnknown since we don't have to support
|
||
|
|
// floating point
|
||
|
|
succeeded = false;
|
||
|
|
break;
|
||
|
|
case OT_V: // Word or doubleword, depending on operand-size attribute.
|
||
|
|
if (operand_is_32_bits_)
|
||
|
|
operand_bytes_ += OS_DOUBLE_WORD;
|
||
|
|
else
|
||
|
|
operand_bytes_ += OS_WORD;
|
||
|
|
break;
|
||
|
|
case OT_W: // Word, regardless of operand-size attribute.
|
||
|
|
operand_bytes_ += OS_WORD;
|
||
|
|
break;
|
||
|
|
|
||
|
|
// Can safely ignore these.
|
||
|
|
case OT_A: // Two one-word operands in memory or two double-word
|
||
|
|
// operands in memory
|
||
|
|
case OT_PI: // Quadword MMX technology register (e.g. mm0)
|
||
|
|
case OT_SI: // Doubleword integer register (e.g., eax)
|
||
|
|
break;
|
||
|
|
|
||
|
|
default:
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
|
||
|
|
default:
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
|
||
|
|
return succeeded;
|
||
|
|
}
|
||
|
|
|
||
|
|
bool MiniDisassembler::ProcessModrm(unsigned char* start_byte,
|
||
|
|
unsigned int& size) {
|
||
|
|
// If we don't need to decode, we just return the size of the ModR/M
|
||
|
|
// byte (there is never a SIB byte in this case).
|
||
|
|
if (!should_decode_modrm_) {
|
||
|
|
size++;
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
// We never care about the reg field, only the combination of the mod
|
||
|
|
// and r/m fields, so let's start by packing those fields together into
|
||
|
|
// 5 bits.
|
||
|
|
unsigned char modrm = (*start_byte);
|
||
|
|
unsigned char mod = modrm & 0xC0; // mask out top two bits to get mod field
|
||
|
|
modrm = modrm & 0x07; // mask out bottom 3 bits to get r/m field
|
||
|
|
mod = mod >> 3; // shift the mod field to the right place
|
||
|
|
modrm = mod | modrm; // combine the r/m and mod fields as discussed
|
||
|
|
mod = mod >> 3; // shift the mod field to bits 2..0
|
||
|
|
|
||
|
|
// Invariant: modrm contains the mod field in bits 4..3 and the r/m field
|
||
|
|
// in bits 2..0, and mod contains the mod field in bits 2..0
|
||
|
|
|
||
|
|
const ModrmEntry* modrm_entry = 0;
|
||
|
|
if (address_is_32_bits_)
|
||
|
|
modrm_entry = &s_ia32_modrm_map_[modrm];
|
||
|
|
else
|
||
|
|
modrm_entry = &s_ia16_modrm_map_[modrm];
|
||
|
|
|
||
|
|
// Invariant: modrm_entry points to information that we need to decode
|
||
|
|
// the ModR/M byte.
|
||
|
|
|
||
|
|
// Add to the count of operand bytes, if the ModR/M byte indicates
|
||
|
|
// that some operands are encoded in the instruction.
|
||
|
|
if (modrm_entry->is_encoded_in_instruction_)
|
||
|
|
operand_bytes_ += modrm_entry->operand_size_;
|
||
|
|
|
||
|
|
// Process the SIB byte if necessary, and return the count
|
||
|
|
// of ModR/M and SIB bytes.
|
||
|
|
if (modrm_entry->use_sib_byte_) {
|
||
|
|
size++;
|
||
|
|
return ProcessSib(start_byte + 1, mod, size);
|
||
|
|
} else {
|
||
|
|
size++;
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
bool MiniDisassembler::ProcessSib(unsigned char* start_byte,
|
||
|
|
unsigned char mod,
|
||
|
|
unsigned int& size) {
|
||
|
|
// get the mod field from the 2..0 bits of the SIB byte
|
||
|
|
unsigned char sib_base = (*start_byte) & 0x07;
|
||
|
|
if (0x05 == sib_base) {
|
||
|
|
switch (mod) {
|
||
|
|
case 0x00: // mod == 00
|
||
|
|
case 0x02: // mod == 10
|
||
|
|
operand_bytes_ += OS_DOUBLE_WORD;
|
||
|
|
break;
|
||
|
|
case 0x01: // mod == 01
|
||
|
|
operand_bytes_ += OS_BYTE;
|
||
|
|
break;
|
||
|
|
case 0x03: // mod == 11
|
||
|
|
// According to the IA-32 docs, there does not seem to be a disp
|
||
|
|
// value for this value of mod
|
||
|
|
default:
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
size++;
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
}; // namespace sidestep
|