#include #include #include #include "libdis.h" #include "ia32_insn.h" #include "ia32_operand.h" #include "ia32_modrm.h" #include "ia32_reg.h" #include "x86_imm.h" #include "x86_operand_list.h" /* apply segment override to memory operand in insn */ static void apply_seg( x86_op_t *op, unsigned int prefixes ) { if (! prefixes ) return; /* apply overrides from prefix */ switch ( prefixes & PREFIX_REG_MASK ) { /* NOTE: that op->flags for segment override are not a bitfield */ case PREFIX_CS: op->flags.op_seg = x86_op_flags::op_cs_seg>>8; break; case PREFIX_SS: op->flags.op_seg = x86_op_flags::op_ss_seg>>8; break; case PREFIX_DS: op->flags.op_seg = x86_op_flags::op_ds_seg>>8; break; case PREFIX_ES: op->flags.op_seg = x86_op_flags::op_es_seg>>8; break; case PREFIX_FS: op->flags.op_seg = x86_op_flags::op_fs_seg>>8; break; case PREFIX_GS: op->flags.op_seg = x86_op_flags::op_gs_seg>>8; break; } return; } size_t Ia32_Decoder::decode_operand_value( unsigned char *buf, size_t buf_len, x86_op_t *op, unsigned int addr_meth, size_t op_size, unsigned int op_value, unsigned char modrm, size_t gen_regs ) { size_t size = 0; /* ++ Do Operand Addressing Method / Decode operand ++ */ switch (addr_meth) { /* This sets the operand Size based on the Intel Opcode Map * (Vol 2, Appendix A). Letter encodings are from section * A.1.1, 'Codes for Addressing Method' */ /* ---------------------- Addressing Method -------------- */ /* Note that decoding mod ModR/M operand adjusts the size of * the instruction, but decoding the reg operand does not. * This should not cause any problems, as every 'reg' operand * has an associated 'mod' operand. * Goddamn-Intel-Note: * Some Intel addressing methods [M, R] specify that modR/M * byte may only refer to a memory address/may only refer to * a register -- however Intel provides no clues on what to do * if, say, the modR/M for an M opcode decodes to a register * rather than a memory address ... returning 0 is out of the * question, as this would be an Immediate or a RelOffset, so * instead these modR/Ms are decoded with total disregard to * the M, R constraints. */ /* MODRM -- mod operand. sets size to at least 1! */ case ADDRMETH_E: /* ModR/M present, Gen reg or memory */ size = ia32_modrm_decode( buf, buf_len, op, gen_regs ); break; case ADDRMETH_M: /* ModR/M only refers to memory */ size = ia32_modrm_decode( buf, buf_len, op, gen_regs ); break; case ADDRMETH_Q: /* ModR/M present, MMX or Memory */ size = ia32_modrm_decode( buf, buf_len, op, REG_MMX_OFFSET ); break; case ADDRMETH_R: /* ModR/M mod == gen reg */ size = ia32_modrm_decode( buf, buf_len, op, gen_regs ); break; case ADDRMETH_W: /* ModR/M present, mem or SIMD reg */ size = ia32_modrm_decode( buf, buf_len, op, REG_SIMD_OFFSET ); break; /* MODRM -- reg operand. does not effect size! */ case ADDRMETH_C: /* ModR/M reg == control reg */ ia32_reg_decode( modrm, op, REG_CTRL_OFFSET ); break; case ADDRMETH_D: /* ModR/M reg == debug reg */ ia32_reg_decode( modrm, op, REG_DEBUG_OFFSET ); break; case ADDRMETH_G: /* ModR/M reg == gen-purpose reg */ ia32_reg_decode( modrm, op, gen_regs ); break; case ADDRMETH_P: /* ModR/M reg == qword MMX reg */ ia32_reg_decode( modrm, op, REG_MMX_OFFSET ); break; case ADDRMETH_S: /* ModR/M reg == segment reg */ ia32_reg_decode( modrm, op, REG_SEG_OFFSET ); break; case ADDRMETH_T: /* ModR/M reg == test reg */ ia32_reg_decode( modrm, op, REG_TEST_OFFSET ); break; case ADDRMETH_V: /* ModR/M reg == SIMD reg */ ia32_reg_decode( modrm, op, REG_SIMD_OFFSET ); break; /* No MODRM : note these set operand type explicitly */ case ADDRMETH_A: /* No modR/M -- direct addr */ op->type = op_absolute; /* segment:offset address used in far calls */ if ( m_decoded->addr_size == 4 ) { x86_imm_sized( buf, buf_len, &op->data.absolute.offset.off32, 4 ); size = 4; } else { x86_imm_sized( buf, buf_len,&op->data.absolute.offset.off16, 2 ); size = 2; } x86_imm_sized( buf+size, buf_len-size, &op->data.absolute.segment, 2 ); size+=2; break; case ADDRMETH_I: /* Immediate val */ op->type = op_immediate; /* if it ever becomes legal to have imm as dest and * there is a src ModR/M operand, we are screwed! */ if ( op->flags.op_signed ) { x86_imm_signsized(buf, buf_len, &op->data.byte, op_size); } else { x86_imm_sized(buf, buf_len, &op->data.byte, op_size); } size = op_size; break; case ADDRMETH_J: /* Rel offset to add to IP [jmp] */ /* this fills op->data.near_offset or op->data.far_offset depending on the size of the operand */ op->flags.op_signed = true; switch(op_size) { case 1: /* one-byte near offset */ op->type = op_relative_near; size = x86_imm_signsized(buf, buf_len, &op->data.relative_near, 1); break; case 2: op->type = op_relative_far; int16_t offset_val; size = x86_imm_signsized(buf, buf_len,&offset_val, 2); op->data.relative_far=offset_val; break; default: assert(false); size=0; } break; case ADDRMETH_O: /* No ModR/M; op is word/dword offset */ /* NOTE: these are actually RVAs not offsets to seg!! */ /* note bene: 'O' ADDR_METH uses addr_size to determine operand size */ op->type = op_offset; op->flags.op_pointer=true; x86_imm_sized( buf, buf_len, &op->data.offset, m_decoded->addr_size ); size = m_decoded->addr_size; break; /* Hard-coded: these are specified in the insn definition */ case ADDRMETH_F: /* EFLAGS register */ op->type = op_register; op->flags.op_hardcode=true; ia32_handle_register( &op->data.reg, REG_FLAGS_INDEX ); break; case ADDRMETH_X: /* Memory addressed by DS:SI [string] */ op->type = op_expression; op->flags.op_hardcode = true; op->flags.op_seg = x86_op_flags::op_ds_seg>>8; op->flags.op_pointer = true; op->flags.op_string = true; ia32_handle_register( &op->data.expression.base, REG_DWORD_OFFSET + 6 ); break; case ADDRMETH_Y: /* Memory addressed by ES:DI [string] */ op->type = op_expression; op->flags.op_hardcode = true; op->flags.op_seg = x86_op_flags::op_es_seg>>8; op->flags.op_pointer = true; op->flags.op_string = true; ia32_handle_register( &op->data.expression.base, REG_DWORD_OFFSET + 7 ); break; case ADDRMETH_RR: /* Gen Register hard-coded in opcode */ op->type = op_register; op->flags.op_hardcode = true; ia32_handle_register( &op->data.reg, op_value + gen_regs ); break; case ADDRMETH_RS: /* Seg Register hard-coded in opcode */ op->type = op_register; op->flags.op_hardcode = true; ia32_handle_register( &op->data.reg, op_value + REG_SEG_OFFSET ); break; case ADDRMETH_RF: /* FPU Register hard-coded in opcode */ op->type = op_register; op->flags.op_hardcode = true; ia32_handle_register( &op->data.reg, op_value + REG_FPU_OFFSET ); break; case ADDRMETH_RT: /* TST Register hard-coded in opcode */ op->type = op_register; op->flags.op_hardcode = true; ia32_handle_register( &op->data.reg, op_value + REG_TEST_OFFSET ); break; case ADDRMETH_II: /* Immediate hard-coded in opcode */ op->type = op_immediate; op->data.dword = op_value; op->flags.op_hardcode = true; break; case 0: /* Operand is not used */ default: /* ignore -- operand not used in this insn */ op->type = op_unused; /* this shouldn't happen! */ break; } return size; } size_t Ia32_Decoder::decode_operand_size( unsigned int op_type, x86_op_t *op ) { size_t size; /* ++ Do Operand Type ++ */ switch (op_type) { /* This sets the operand Size based on the Intel Opcode Map * (Vol 2, Appendix A). Letter encodings are from section * A.1.2, 'Codes for Operand Type' */ /* NOTE: in this routines, 'size' refers to the size * of the operand in the raw (encoded) instruction; * 'datatype' stores the actual size and datatype * of the operand */ /* ------------------------ Operand Type ----------------- */ case OPTYPE_c: /* byte or word [op size attr] */ size = (m_decoded->op_size == 4) ? 2 : 1; op->datatype = (size == 4) ? op_word : op_byte; break; case OPTYPE_a: /* 2 word or 2 dword [op size attr] */ /* pointer to a 16:16 or 32:32 BOUNDS operand */ size = (m_decoded->op_size == 4) ? 8 : 4; op->datatype = (size == 4) ? op_bounds32 : op_bounds16; break; case OPTYPE_v: /* word or dword [op size attr] */ size = (m_decoded->op_size == 4) ? 4 : 2; op->datatype = (size == 4) ? op_dword : op_word; break; case OPTYPE_p: /* 32/48-bit ptr [op size attr] */ /* technically these flags are not accurate: the * value s a 16:16 pointer or a 16:32 pointer, where * the first '16' is a segment */ size = (m_decoded->addr_size == 4) ? 6 : 4; op->datatype = (size == 6) ? op_descr32 : op_descr16; break; case OPTYPE_b: /* byte, ignore op-size */ size = 1; op->datatype = op_byte; break; case OPTYPE_w: /* word, ignore op-size */ size = 2; op->datatype = op_word; break; case OPTYPE_d: /* dword , ignore op-size */ size = 4; op->datatype = op_dword; break; case OPTYPE_s: /* 6-byte psuedo-descriptor */ /* ptr to 6-byte value which is 32:16 in 32-bit * mode, or 8:24:16 in 16-bit mode. The high byte * is ignored in 16-bit mode. */ size = 6; op->datatype = (m_decoded->addr_size == 4) ? op_pdescr32 : op_pdescr16; break; case OPTYPE_q: /* qword, ignore op-size */ size = 8; op->datatype = op_qword; break; case OPTYPE_dq: /* d-qword, ignore op-size */ size = 16; op->datatype = op_dqword; break; case OPTYPE_ps: /* 128-bit FP data */ size = 16; /* really this is 4 packed SP FP values */ op->datatype = op_ssimd; break; case OPTYPE_pd: /* 128-bit FP data */ size = 16; /* really this is 2 packed DP FP values */ op->datatype = op_dsimd; break; case OPTYPE_ss: /* Scalar elem of 128-bit FP data */ size = 16; /* this only looks at the low dword (4 bytes) * of the xmmm register passed as a param. * This is a 16-byte register where only 4 bytes * are used in the insn. Painful, ain't it? */ op->datatype = op_sssimd; break; case OPTYPE_sd: /* Scalar elem of 128-bit FP data */ size = 16; /* this only looks at the low qword (8 bytes) * of the xmmm register passed as a param. * This is a 16-byte register where only 8 bytes * are used in the insn. Painful, again... */ op->datatype = op_sdsimd; break; case OPTYPE_pi: /* qword mmx register */ size = 8; op->datatype = op_qword; break; case OPTYPE_si: /* dword integer register */ size = 4; op->datatype = op_dword; break; case OPTYPE_fs: /* single-real */ size = 4; op->datatype = op_sreal; break; case OPTYPE_fd: /* double real */ size = 8; op->datatype = op_dreal; break; case OPTYPE_fe: /* extended real */ size = 10; op->datatype = op_extreal; break; case OPTYPE_fb: /* packed BCD */ size = 10; op->datatype = op_bcd; break; case OPTYPE_fv: /* pointer to FPU env: 14 or 28-bytes */ size = (m_decoded->addr_size == 4)? 28 : 14; op->datatype = (size == 28)? op_fpuenv32: op_fpuenv16; break; case OPTYPE_ft: /* pointer to FPU env: 94 or 108 bytes */ size = (m_decoded->addr_size == 4)? 108 : 94; op->datatype = (size == 108)? op_fpustate32: op_fpustate16; break; case OPTYPE_fx: /* 512-byte register stack */ size = 512; op->datatype = op_fpregset; break; case OPTYPE_fp: /* floating point register */ size = 10; /* double extended precision */ op->datatype = op_fpreg; break; case OPTYPE_m: /* fake operand type used for "lea Gv, M" */ size = m_decoded->addr_size; op->datatype = (size == 4) ? op_dword : op_word; break; case OPTYPE_none: /* handle weird instructions that have no encoding but use a dword datatype, like invlpg */ size = 0; op->datatype = op_none; break; case 0: default: size = m_decoded->op_size; op->datatype = (size == 4) ? op_dword : op_word; break; } return size; } size_t Ia32_Decoder::ia32_decode_operand( unsigned char *buf, size_t buf_len, unsigned int raw_op, unsigned int raw_flags, unsigned int prefixes, unsigned char modrm ) { unsigned int addr_meth, op_type, op_size, gen_regs; x86_op_t *op; size_t size; /* ++ Yank optype and addr mode out of operand flags */ addr_meth = raw_flags & ADDRMETH_MASK; op_type = raw_flags & OPTYPE_MASK; if ( raw_flags == ARG_NONE ) { /* operand is not used in this instruction */ return 0; } /* allocate a new operand */ op = m_decoded->x86_operand_new(); /* ++ Copy flags from opcode table to x86_insn_t */ op->access = (enum x86_op_access) OP_PERM(raw_flags); op->flags.whole = (OP_FLAGS(raw_flags) >> 12); /* Get size (for decoding) and datatype of operand */ op_size = decode_operand_size(op_type, op); /* override default register set based on Operand Type */ /* this allows mixing of 8, 16, and 32 bit regs in insn */ if (op_size == 1) { gen_regs = REG_BYTE_OFFSET; } else if (op_size == 2) { gen_regs = REG_WORD_OFFSET; } else { gen_regs = REG_DWORD_OFFSET; } size = decode_operand_value( buf, buf_len, op, addr_meth, op_size, raw_op, modrm, gen_regs ); /* if operand is an address, apply any segment override prefixes */ if ( op->type == op_expression || op->type == op_offset ) { apply_seg(op, prefixes); } return size; /* return number of bytes in instruction */ }