1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
|
#include <stdlib.h>
#include <cpu.h>
#include <load.h>
#include <log.h>
#include <linux.h>
#include <mem.h>
#define MOD() ((modrm & 0xc0) >> 6)
#define RM() (modrm & 0x07)
#define DISP32() (U32())
#define DISP8() (S8())
#define REG() ((modrm & 0x38) >> 3)
#define ADDR() \
__extension__({ \
uint32_t _ret = 0; \
if (MOD() == 0) { \
if (RM() == 4) \
errln("TODO."); \
else if (RM() == 5) \
_ret = DISP32(); \
else \
_ret = GET_R32(RM()); \
} else if (MOD() == 1) { \
if (RM() == 4) \
errln("TODO."); \
else \
_ret = GET_R32(RM()) + DISP8(); \
} else { \
if (RM() == 4) \
errln("TODO."); \
else \
_ret = GET_R32(RM()) + DISP32(); \
} \
_ret; \
})
#define U8() (*(uint8_t *)mem_phys(rip++))
#define S8() (*(int8_t *)mem_phys(rip++))
#define U16() \
__extension__({ \
uint16_t ret = *(uint16_t *)mem_phys(rip); \
rip += 2; \
ret; \
})
#define S16() \
__extension__({ \
int16_t ret = *(int16_t *)mem_phys(rip); \
rip += 2; \
ret; \
})
#define U32() \
__extension__({ \
uint32_t ret = *(uint32_t *)mem_phys(rip); \
rip += 4; \
ret; \
})
#define S32() \
__extension__({ \
int32_t ret = *(int32_t *)mem_phys(rip); \
rip += 4; \
ret; \
})
#define U64() \
__extension__({ \
uint64_t ret = *(uint64_t *)mem_phys(rip); \
rip += 8; \
ret; \
})
#define S64() \
__extension__({ \
int64_t ret = *(int64_t *)mem_phys(rip); \
rip += 8; \
ret; \
})
#define GET_R8(r) (r < 8 ? regs[r] & 0xff : (regs[r - 8] >> 8) & 0xff)
#define GET_R32(r) ((uint32_t)regs[r])
#define GET_R64(r) ((uint64_t)regs[r])
#define SET_R8(r, v) \
__extension__({ \
if (r < 8) \
regs[r] = (regs[r] & 0xffffff00) | (uint32_t)v; \
else \
regs[r - 4] = (regs[r] = (regs[r] & 0xffff00ff) | \
((uint32_t)v << 8)) \
})
#define SET_R32(r, v) (regs[r] = v)
#define SET_R64(r, v) (regs[r] = v)
#define GET_RM8() (MOD() == 3 ? GET_R8(RM()) : *(uint8_t *)mem_phys(ADDR()))
#define GET_RM32() (MOD() == 3 ? GET_R32(RM()) : *(uint32_t *)mem_phys(ADDR()))
static struct cpu_interface *interface;
struct rip_history {
uint64_t rip;
struct rip_history *prev;
};
static uint64_t rip = 0;
static err (*pos_instructions[256])(void);
static err (*neg_instructions[256])(void);
static uint64_t regs[REGISTERS_COUNT] = { 0 };
static struct rip_history *rip_history;
static char instruction_response_factory[256] = { 0 };
static const char *register_names[REGISTERS_COUNT] = {
"RAX", "RCX", "RDX", "RBX", "RSP", "RBP", "RSI", "RDI",
"R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15",
};
static void print_state(void)
{
logln("rip=%x, rax=%x, rcx=%x, rdx=%x, rbx=%x, rsp=%x, rbp=%x, rsi=%x, rdi=%x,\nr8=%x, r9=%x, r10=%x, r11=%x, r12=%x, r13=%x, r14=%x, r15=%x",
rip, regs[RAX], regs[RCX], regs[RDX], regs[RBX], regs[RSP],
regs[RBP], regs[RSI], regs[RSI], regs[RDI], regs[R8], regs[R9],
regs[R10], regs[R11], regs[R12], regs[R13], regs[R14], regs[R15]);
}
static err pos_unknown_instruction(void)
{
errln("unknown positive instruction at rip=%d", rip);
return ERR;
}
static err neg_unknown_instruction(void)
{
errln("unknown negative instruction at rip=%d", rip);
return ERR;
}
static err pos_opcode(void)
{
uint8_t op = U8();
// TODO: is_*, j*
if (op == 0x05) {
sprintf(instruction_response_factory, "syscall");
return linux_call();
}
return ERR;
}
static err pos_mov_r32_rm32(void)
{
uint8_t modrm = U8();
uint8_t reg = REG();
uint32_t val = GET_RM32();
sprintf(instruction_response_factory, "mov %s, %x", register_names[reg],
val);
return OK;
}
static err pos_mov_r32_imm32(void)
{
rip--;
uint8_t reg = U8() - 0xb8;
uint32_t val = U32();
SET_R32(reg, val);
sprintf(instruction_response_factory, "mov %s, %#x",
register_names[reg], val);
return OK;
}
static err pos_nop(void)
{
sprintf(instruction_response_factory, "nop");
return OK;
}
static err pos_int(void)
{
uint8_t op = U8();
if (op == 0x80) {
// Linux syscall
// TODO: Support legacy syscalls (numbers are different)
return ERR;
}
return ERR;
}
static void initialize(void)
{
interface->reg_names(register_names, REGISTERS_COUNT);
for (int i = 0; i < 256; i++) {
pos_instructions[i] = pos_unknown_instruction;
neg_instructions[i] = neg_unknown_instruction;
}
pos_instructions[0x0f] = pos_opcode;
pos_instructions[0x8b] = pos_mov_r32_rm32;
pos_instructions[0x90] = pos_nop;
pos_instructions[0xcd] = pos_int;
/* for (int i = 0; i < 8; i++) */
/* pos_instructions[0xb0+i] = pos_mov_r8_imm8; */
for (int i = 0; i < 8; i++)
pos_instructions[0xb8 + i] = pos_mov_r32_imm32;
}
void *cpu_get_reg(uint8_t reg)
{
return ®s[reg];
}
// TODO: Different signature?
void cpu_set_reg(uint8_t reg, uint64_t val)
{
regs[reg] = val;
}
void cpu_register_interface(struct cpu_interface *cpu)
{
interface = cpu;
}
void cpu_exec(const char *path)
{
initialize();
vaddr addr = load(path);
if (!addr) {
errln("invalid entry address");
return;
}
rip = addr;
rip_history = malloc(sizeof(*rip_history));
rip_history->rip = rip;
rip_history->prev = 0;
}
err cpu_next(void)
{
uint8_t instr = U8();
if (!instr)
return END;
logln("%x", instr);
err ret = pos_instructions[instr]();
interface->instr_push(instruction_response_factory);
print_state();
struct rip_history *next = malloc(sizeof(*next));
next->rip = rip;
next->prev = rip_history;
rip_history = next;
return ret;
}
err cpu_prev(void)
{
struct rip_history *prev = rip_history->prev;
if (!prev)
return END;
rip = prev->rip;
uint8_t instr = U8();
if (!instr)
return ERR;
err ret = neg_instructions[instr]();
interface->instr_pop();
print_state();
free(rip_history);
rip_history = prev;
return ret;
}
void cpu_destroy(void)
{
while (rip_history) {
struct rip_history *temp = rip_history->prev;
free(rip_history);
rip_history = temp;
}
}
|
