|
|
//----------------------------------------------------------------------------
//
// Disassembly portions of X86 machine implementation.
//
// Copyright (C) Microsoft Corporation, 2000-2001.
//
//----------------------------------------------------------------------------
#include "ntsdp.hpp"
#include "i386_dis.h"
// See Get/SetRegVal comments in machine.hpp.
#define RegValError Do_not_use_GetSetRegVal_in_machine_implementations
#define GetRegVal(index, val) RegValError
#define GetRegVal32(index) RegValError
#define GetRegVal64(index) RegValError
#define SetRegVal(index, val) RegValError
#define SetRegVal32(index, val) RegValError
#define SetRegVal64(index, val) RegValError
UCHAR g_X86Int3[] = { 0xcc };
//----------------------------------------------------------------------------
//
// BaseX86MachineInfo methods.
//
//----------------------------------------------------------------------------
/***** macros and defines *****/
#define X86_CS_OVR 0x2e
#define BIT20(b) ((b) & 0x07)
#define BIT53(b) (((b) >> 3) & 0x07)
#define BIT76(b) (((b) >> 6) & 0x03)
#define MAXOPLEN 10
#define OBOFFSET (m_Ptr64 ? 35 : 26)
#define OBOPERAND (m_Ptr64 ? 43 : 34)
#define OBLINEEND (g_OutputWidth - 3)
/***** static tables and variables *****/
char* g_X86Reg8[] ={ "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh", "r8b", "r9b", "r10b", "r11b", "r12b", "r13b", "r14b", "r15b"};char* g_Amd64ExtendedReg8[] ={ "al", "cl", "dl", "bl", "spl", "bpl", "sil", "dil"};char* g_X86RegBase[] ={ "ax", "cx", "dx", "bx", "sp", "bp", "si", "di", "8", "9", "10", "11", "12", "13", "14", "15"};char *g_X86Mrm16[] ={ "bx+si", "bx+di", "bp+si", "bp+di", "si", "di", "bp", "bx", "r8w", "r9w", "r10w", "r11w", "r12w", "r13w", "r14w", "r15w"};char *g_X86Mrm32[] ={ "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi", "r8d", "r9d", "r10d", "r11d", "r12d", "r13d", "r14d", "r15d"};char *g_X86Mrm64[] ={ "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"};
UCHAR g_X86Reg16Idx[] ={ X86_NBX, X86_NBX, X86_NBP, X86_NBP, X86_NSI, X86_NDI, X86_NBP, X86_NBX,};UCHAR g_X86Reg16Idx2[] ={ X86_NSI, X86_NDI, X86_NSI, X86_NDI};UCHAR g_X86RegIdx[] ={ X86_NAX, X86_NCX, X86_NDX, X86_NBX, X86_NSP, X86_NBP, X86_NSI, X86_NDI, AMD64_R8, AMD64_R9, AMD64_R10, AMD64_R11, AMD64_R12, AMD64_R13, AMD64_R14, AMD64_R15};
static char sregtab[] = "ecsdfg"; // first letter of ES, CS, SS, DS, FS, GS
char* g_CompareIb[] = { "eq", "lt", "le", "unord", "ne", "nlt", "nle", "ord" };
char hexdigit[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
static int mod; /* mod of mod/rm byte */static int rm; /* rm of mod/rm byte */static int ttt; /* return reg value (of mod/rm) */static unsigned char *pMem; /* current position in instruction */
ADDR EAaddr[2]; // offset of effective address
static int EAsize[2]; // size of effective address item
static char *pchEAseg[2]; // normal segment for operand
#define IPREL_MARKER "<-IPREL->"
BOOL g_X86ModrmHasIpRelOffset;LONG g_X86IpRelOffset;
int g_SegAddrMode; /* global address size in bits */int g_SegOpSize; /* global operand size in bits */int g_AddrMode; /* local address size in bits */int g_OpSize; /* operand size in bits */
int g_ExtendOpCode;int g_ExtendAny;int g_ExtendMrmReg;int g_ExtendSibIndex;int g_ExtendRm;
BOOL g_MovX; // Indicates a MOVSX or MOVZX.
BOOL g_MovSXD;BOOL g_ForceMrmReg32; // M/RM register is always 32-bit.
BOOL g_MmRegEa; // Use mm? registers in reg-only EA.
BOOL g_XmmRegEa; // Use xmm? registers in reg-only EA.
BOOL g_ControlFlow; // Control flow instruction.
int g_RepPrefix;
enum{ XMM_SS, XMM_SD, XMM_PS, XMM_PD,};
int g_XmmOpSize;
enum{ JCC_EA_NONE, // Branch must be no-branch + 1.
JCC_EA_NO_BRANCH, JCC_EA_BRANCH,};
// First entry are bits that must be zero, second
// and third entries are bit shifts for bits that must match.
ULONG g_JccCheckTable[][3] ={ X86_BIT_FLAGOF, 0, 0, // JNO
X86_BIT_FLAGCF, 0, 0, // JNB
X86_BIT_FLAGZF, 0, 0, // JNZ
X86_BIT_FLAGCF | X86_BIT_FLAGZF, 0, 0, // JNBE
X86_BIT_FLAGSF, 0, 0, // JNS
X86_BIT_FLAGPF, 0, 0, // JNP
0, 7, 11, // JNL
X86_BIT_FLAGZF, 7, 11, // JNLE
}; // internal function definitions
void OutputHexString(char **, PUCHAR, int);void OutputHexValue(char **, PUCHAR, int, int);void OutputExHexValue(char **, PUCHAR, int, int);void OutputHexCode(char **, PUCHAR, int);void X86OutputString(char **, char *);
void OutputHexAddr(PSTR *, PADDR);
#define FormSelAddress(Addr, Sel, Off) \
FormAddr(Sel, Off, 0, Addr)#define FormSegRegAddress(Addr, SegReg, Off) \
FormAddr(SegReg, Off, FORM_SEGREG, Addr)
voidGetSegAddrOpSizes(MachineInfo* Machine, PADDR Addr){ if ((Type(*Addr) & ADDR_1664) || ((Type(*Addr) & ADDR_FLAT) && Machine->m_ExecTypes[0] == IMAGE_FILE_MACHINE_AMD64)) { g_SegAddrMode = 64; // X86-64 defaults to 32-bit operand sizes even in 64-bit code.
// Only the address size changes. An operand size prefix
// switches from 32- to 64-bit.
g_SegOpSize = 32; } else if (Type(*Addr) & (ADDR_V86 | ADDR_16)) { g_SegAddrMode = 16; g_SegOpSize = 16; } else { g_SegAddrMode = 32; g_SegOpSize = 32; } g_AddrMode = g_SegAddrMode; g_OpSize = g_SegOpSize;}
voidOverrideAddrMode(void){ switch(g_SegAddrMode) { case 16: g_AddrMode = 32; break; case 32: g_AddrMode = 16; break; case 64: g_AddrMode = 32; break; default: DBG_ASSERT(FALSE); break; }}
voidOverrideOpSize(int OverrideOp){ switch(g_SegAddrMode) { case 16: g_OpSize = 32; break; case 32: g_OpSize = 16; break; case 64: // X86-64 defaults to 32-bit operand sizes even in 64-bit code.
// Only the address size changes. A REX operand size prefix
// switches from 32- to 64-bit.
if (OverrideOp == 0x66) { g_OpSize = 16; } else if (OverrideOp & 8) { g_OpSize = 64; } break; default: DBG_ASSERT(FALSE); break; }}
voidExtendOps(int opcode){ // x86-64 uses these opcodes as the REX override.
OverrideOpSize(opcode);
g_ExtendOpCode = opcode; g_ExtendAny = 8; if (opcode & 1) { g_ExtendRm = 8; } if (opcode & 2) { g_ExtendSibIndex = 8; } if (opcode & 4) { g_ExtendMrmReg = 8; }}
voidIgnoreExtend(void){ //
// Resets any extensions that may have happened.
// The REX prefix must be the last
// prefix of an instruction and is ignored otherwise,
// so this reset is done when any prefix is encountered
// after the REX prefix. This should normally never
// happen but technically it's valid code so we should handle it.
//
if (g_ExtendOpCode) { WarnOut("REX prefix ignored\n"); if (g_ExtendOpCode & 8) { // Op size was changed so put it back. This
// is tricky since in theory an op size override
// prefix could also be present, but let's not
// worry about that for now.
g_OpSize = g_SegOpSize; }
g_ExtendOpCode = 0; g_ExtendAny = 0; g_ExtendRm = 0; g_ExtendSibIndex = 0; g_ExtendMrmReg = 0; }}
struct AMD_3DNOW_OPSTR{ PSTR Str; UCHAR Opcode;};
AMD_3DNOW_OPSTR g_Amd3DNowOpStr[] ={ "pavgusb", 0xBF, "pfadd", 0x9E, "pfsub", 0x9A, "pfsubr", 0xAA, "pfacc", 0xAE, "pfcmpge", 0x90, "pfcmpgt", 0xA0, "pfcmpeq", 0xB0, "pfmin", 0x94, "pfmax", 0xA4, "pi2fd", 0x0D, "pf2id", 0x1D, "pfrcp", 0x96, "pfrsqrt", 0x97, "pfmul", 0xB4, "pfrcpit1", 0xA6, "pfrsqit1", 0xA7, "pfrcpit2", 0xB6, "pmulhrw", 0xB7, "pf2iw", 0x1C, "pfnacc", 0x8A, "pfpnacc", 0x8E, "pi2fw", 0x0C, "pswapd", 0xBB,};
PSTRGetAmd3DNowOpString(UCHAR Opcode){ UCHAR i;
for (i = 0; i < sizeof(g_Amd3DNowOpStr) / sizeof(g_Amd3DNowOpStr[0]); i++) { if (g_Amd3DNowOpStr[i].Opcode == Opcode) { return g_Amd3DNowOpStr[i].Str; } }
return NULL;}
BOOLBaseX86MachineInfo::Disassemble(PADDR paddr, PSTR pchDst, BOOL fEAout){ ULONG64 Offset = Off(*paddr); int opcode; /* current opcode */ int olen = 2; /* operand length */ int alen = 2; /* address length */ int end = FALSE; /* end of instruction flag */ int mrm = FALSE; /* indicator that modrm is generated*/ unsigned char *action; /* action for operand interpretation*/ long tmp; /* temporary storage field */ int indx; /* temporary index */ int action2; /* secondary action */ int instlen; /* instruction length */ int cBytes; // bytes read into instr buffer
int segOvr = 0; /* segment override opcode */ UCHAR membuf[X86_MAX_INSTRUCTION_LEN]; /* current instruction buffer */ char *pEAlabel = ""; // optional label for operand
char *pchResultBuf = pchDst; // working copy of pchDst pointer
char RepPrefixBuffer[32]; // rep prefix buffer
char *pchRepPrefixBuf = RepPrefixBuffer; // pointer to prefix buffer
char OpcodeBuffer[16]; // opcode buffer
char *pchOpcodeBuf = OpcodeBuffer; // pointer to opcode buffer
char OperandBuffer[MAX_SYMBOL_LEN + 20]; // operand buffer
char *pchOperandBuf = OperandBuffer; // pointer to operand buffer
char ModrmBuffer[MAX_SYMBOL_LEN + 20]; // modRM buffer
char *pchModrmBuf = ModrmBuffer; // pointer to modRM buffer
char EABuffer[64]; // effective address buffer
char *pchEABuf = EABuffer; // pointer to EA buffer
int obOpcode = OBOFFSET; int obOpcodeMin; int obOpcodeMax;
int obOperand = OBOPERAND; int obOperandMin; int obOperandMax;
int cbOpcode; int cbOperand; int cbOffset; int cbEAddr; int fTwoLines = FALSE; unsigned char BOPaction; int subcode; /* bop subcode */ int JccEa; LONGLONG Branch;
g_X86ModrmHasIpRelOffset = FALSE; g_MovX = FALSE; g_MovSXD = FALSE; g_ForceMrmReg32 = FALSE; g_MmRegEa = FALSE; g_XmmRegEa = FALSE; g_ControlFlow = FALSE; EAsize[0] = EAsize[1] = 0; // no effective address
pchEAseg[0] = dszDS_; pchEAseg[1] = dszES_; g_RepPrefix = 0; g_XmmOpSize = XMM_PS; g_ExtendOpCode = 0; g_ExtendAny = 0; g_ExtendMrmReg = 0; g_ExtendSibIndex = 0; g_ExtendRm = 0; JccEa = JCC_EA_NONE;
GetSegAddrOpSizes(this, paddr); alen = g_AddrMode / 8; olen = g_OpSize / 8;
OutputHexAddr(&pchResultBuf, paddr);
*pchResultBuf++ = ' ';
cBytes = (int)GetMemString(paddr, membuf, X86_MAX_INSTRUCTION_LEN); /* move full inst to local buffer */ pMem = membuf; /* point to begin of instruction */ opcode = *pMem++; /* get opcode */
if ( opcode == 0xc4 && *pMem == 0xC4 ) { pMem++; X86OutputString(&pchOpcodeBuf,"BOP"); action = &BOPaction; BOPaction = IB | END; subcode = *pMem; if ( subcode == 0x50 || subcode == 0x52 || subcode == 0x53 || subcode == 0x54 || subcode == 0x57 || subcode == 0x58 || subcode == 0x58 ) { BOPaction = IW | END; } } else { X86OutputString(&pchOpcodeBuf, distbl[opcode].instruct); action = actiontbl + distbl[opcode].opr; /* get operand action */ }
/***** loop through all operand actions *****/
do { action2 = (*action) & 0xc0; switch((*action++) & 0x3f) { case ALT: /* alter the opcode if not 16-bit */ if (g_OpSize > 16) { indx = *action++; pchOpcodeBuf = &OpcodeBuffer[indx]; if (indx == 0) { X86OutputString(&pchOpcodeBuf, g_OpSize == 32 ? dszCWDE : dszCDQE); } else if (g_OpSize == 64) { *pchOpcodeBuf++ = 'q'; if (indx == 1) { *pchOpcodeBuf++ = 'o'; } } else { *pchOpcodeBuf++ = 'd'; if (indx == 1) { *pchOpcodeBuf++ = 'q'; } } } break;
case XMMSD: /* SSE-style opcode rewriting */ { char ScalarOrPacked, SingleOrDouble; char* DquOrQ, *DqOrQ, *SsdxOrUpsd, *CvtPd, *CvtPs; char* MovQD6, *Shuf; char* Scan;
g_MmRegEa = TRUE; DquOrQ = "q"; DqOrQ = "q"; SsdxOrUpsd = "s?x"; CvtPd = NULL; CvtPs = NULL; MovQD6 = NULL; switch(g_RepPrefix) { case X86_REPN: // Scalar double operation.
ScalarOrPacked = 's'; SingleOrDouble = 'd'; CvtPd = "pd2dq"; MovQD6 = "dq2q"; Shuf = "lw"; g_XmmOpSize = XMM_SD; // Assume there was no other lock/rep/etc.
pchRepPrefixBuf = RepPrefixBuffer; break; case X86_REP: // Scalar single operation.
ScalarOrPacked = 's'; SingleOrDouble = 's'; CvtPd = "dq2pd"; CvtPs = "tps2dq"; MovQD6 = "q2dq"; Shuf = "hw"; g_XmmOpSize = XMM_SS; // Assume there was no other lock/rep/etc.
pchRepPrefixBuf = RepPrefixBuffer; break; default: // No rep prefix means packed single or double
// depending on operand size.
ScalarOrPacked = 'p'; SsdxOrUpsd = "up?"; if (g_OpSize == g_SegOpSize) { SingleOrDouble = 's'; CvtPs = "dq2ps"; Shuf = "w"; g_XmmOpSize = XMM_PS; } else { SingleOrDouble = 'd'; DqOrQ = "dq"; DquOrQ = "dqu"; CvtPd = "tpd2dq"; CvtPs = "ps2dq"; MovQD6 = "q"; Shuf = "d"; g_XmmRegEa = TRUE; g_XmmOpSize = XMM_PD; } break; }
pchOpcodeBuf = OpcodeBuffer; while (*pchOpcodeBuf && *pchOpcodeBuf != ' ') { switch(*pchOpcodeBuf) { case ':': *pchOpcodeBuf = ScalarOrPacked; break; case '?': *pchOpcodeBuf = SingleOrDouble; break; case ',': *pchOpcodeBuf = SingleOrDouble == 's' ? 'd' : 's'; break; }
pchOpcodeBuf++; }
switch(opcode) { case X86_MOVFREGMEM: case X86_MOVFMEMREG: // Append characters for MOVS[SD]X and MOVUP[SD].
strcpy(pchOpcodeBuf, SsdxOrUpsd); if ((Scan = strchr(pchOpcodeBuf, '?')) != NULL) { *Scan = SingleOrDouble; } pchOpcodeBuf += strlen(pchOpcodeBuf); break; case X86_MOVNT: // Append characters for MOVNTQ and MOVNTDQ.
X86OutputString(&pchOpcodeBuf, DqOrQ); break; case X86_MASKMOV: // Append characters for MASKMOVQ and MASKMOVDQU.
X86OutputString(&pchOpcodeBuf, DquOrQ); break; case X86_CVTPD: if (CvtPd == NULL) { // Invalid opcode.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszRESERVED); action2 = END; } else { // Append characters for CVT<PD>.
X86OutputString(&pchOpcodeBuf, CvtPd); } break; case X86_CVTPS: if (CvtPs == NULL) { // Invalid opcode.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszRESERVED); action2 = END; } else { // Append characters for CVT<PS>.
X86OutputString(&pchOpcodeBuf, CvtPs); } break; case X86_MOVQ_D6: if (MovQD6 == NULL) { // Invalid opcode.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszRESERVED); action2 = END; } else { // Append characters for MOVQ D6 family.
X86OutputString(&pchOpcodeBuf, MovQD6); } break; case X86_PSHUF: // Append characters for PSHUF variants.
X86OutputString(&pchOpcodeBuf, Shuf); break; } } break;
case AMD3DNOW: /* AMD 3DNow post-instruction byte */ { PSTR OpStr;
// Get the trailing byte and look up
// the opcode string.
OpStr = GetAmd3DNowOpString(*pMem++); if (OpStr == NULL) { // Not a defined 3DNow instruction.
// Leave the ??? in the opstring.
break; }
// Update opstring to real text.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, OpStr); } break; case STROP: // compute size of operands in indx
// also if dword operands, change fifth
// opcode letter from 'w' to 'd'.
if (opcode & 1) { if (g_OpSize == 64) { indx = 8; OpcodeBuffer[4] = 'q'; } else if (g_OpSize == 32) { indx = 4; OpcodeBuffer[4] = 'd'; } else { indx = 2; } } else { indx = 1; }
if (*action & 1) { if (fEAout) { if (g_AddrMode > 16) { FormSelAddress(&EAaddr[0], 0, GetReg64(X86_NSI)); } else { FormSegRegAddress(&EAaddr[0], SEGREG_DATA, GetReg16(X86_NSI)); } EAsize[0] = indx; } } if (*action++ & 2) { if (fEAout) { if (g_AddrMode > 16) { FormSelAddress(&EAaddr[1], 0, GetReg64(X86_NDI)); } else { FormSegRegAddress(&EAaddr[1], SEGREG_ES, GetReg16(X86_NDI)); } EAsize[1] = indx; } } break;
case CHR: /* insert a character */ *pchOperandBuf++ = *action++; break;
case CREG: /* set debug, test or control reg */ if (opcode & 0x04) { *pchOperandBuf++ = 't'; } else if (opcode & 0x01) { *pchOperandBuf++ = 'd'; } else { *pchOperandBuf++ = 'c'; } *pchOperandBuf++ = 'r'; if (ttt >= 10) { *pchOperandBuf++ = (char)('0' + ttt / 10); ttt %= 10; } *pchOperandBuf++ = (char)('0' + ttt); break;
case SREG2: /* segment register */ ttt = BIT53(opcode); // set value to fall through
case SREG3: /* segment register */ *pchOperandBuf++ = sregtab[ttt]; // reg is part of modrm
*pchOperandBuf++ = 's'; break;
case BRSTR: /* get index to register string */ ttt = *action++; /* from action table */ goto BREGlabel;
case BOREG: /* byte register (in opcode) */ ttt = BIT20(opcode); /* register is part of opcode */ goto BREGlabel;
case ALSTR: ttt = 0; /* point to AL register */ BREGlabel: case BREG: /* general register */ if (g_ExtendAny && ttt < 8) { X86OutputString(&pchOperandBuf, g_Amd64ExtendedReg8[ttt]); } else { X86OutputString(&pchOperandBuf, g_X86Reg8[ttt]); } break;
case WRSTR: /* get index to register string */ ttt = *action++; /* from action table */ goto WREGlabel;
case VOREG: /* register is part of opcode */ if (m_ExecTypes[0] == IMAGE_FILE_MACHINE_AMD64 && opcode >= 0x40 && opcode <= 0x4f) { // Get rid of the inc/dec text as this
// isn't really an inc/dec.
pchOpcodeBuf = OpcodeBuffer;
// Process the REX override.
ExtendOps(opcode); olen = g_OpSize / 8; action2 = 0; goto getNxtByte; } ttt = BIT20(opcode) + g_ExtendRm; goto VREGlabel;
case AXSTR: ttt = 0; /* point to eAX register */ VREGlabel: case VREG: /* general register */ if ((g_SegAddrMode == 64 && opcode >= 0x50 && opcode <= 0x5f) || ttt >= 8) { // Push/pops are always 64-bit in 64-bit segments.
*pchOperandBuf++ = 'r'; } else if (g_OpSize == 32 || opcode == X86_PEXTRW || opcode == X86_PMOVMSKB) { *pchOperandBuf++ = 'e'; } else if (g_OpSize == 64) { *pchOperandBuf++ = 'r'; } WREGlabel: case WREG: /* register is word size */ X86OutputString(&pchOperandBuf, g_X86RegBase[ttt]); if (ttt >= 8) { if (g_OpSize == 32) { *pchOperandBuf++ = 'd'; } else if (g_OpSize == 16) { *pchOperandBuf++ = 'w'; } } break;
case MMORWREG: if (g_XmmOpSize == XMM_SS || g_XmmOpSize == XMM_SD) { goto VREGlabel; } // Fall through.
MMWREGlabel: case MMWREG: if (g_OpSize != g_SegOpSize && opcode != X86_CVTSPSD2SPI) { *pchOperandBuf++ = 'x'; } *pchOperandBuf++ = 'm'; *pchOperandBuf++ = 'm'; if (ttt >= 10) { *pchOperandBuf++ = (char)('0' + ttt / 10); ttt %= 10; } *pchOperandBuf++ = ttt + '0'; break;
case XORMMREG: if (g_OpSize == g_SegOpSize) { goto MMWREGlabel; } // Fall through.
case XMMWREG: if (opcode != X86_PSHUF || g_XmmOpSize != XMM_PS) { *pchOperandBuf++ = 'x'; } *pchOperandBuf++ = 'm'; *pchOperandBuf++ = 'm'; if (ttt >= 10) { *pchOperandBuf++ = (char)('0' + ttt / 10); ttt %= 10; } *pchOperandBuf++ = ttt + '0'; break;
case IST_ST: X86OutputString(&pchOperandBuf, "st(0),st"); *(pchOperandBuf - 5) += (char)rm; break;
case ST_IST: X86OutputString(&pchOperandBuf, "st,"); case IST: X86OutputString(&pchOperandBuf, "st(0)"); *(pchOperandBuf - 2) += (char)rm; break;
case xBYTE: /* set instruction to byte only */ EAsize[0] = 1; pEAlabel = "byte ptr "; break;
case VAR: if ((g_SegAddrMode == 64 || g_ExtendAny > 0) && opcode == 0x63) { // In AMD64 REX32 and 64-bit modes this instruction
// is MOVSXD r64, r/m32 instead of ARPL r/m, reg.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszMOVSXD); action = &actiontbl[O_Reg_Modrm] + 1; g_OpSize = 64; g_MovSXD = TRUE; goto DWORDlabel; } else if (opcode == 0xff) { UCHAR Extra = BIT53(*pMem); if (Extra >= 2 && Extra <= 5) { g_ControlFlow = TRUE; // On x86-64 control-flow operations default to
// 64-bit opsize.
if (g_SegAddrMode == 64) { if (g_OpSize == 32) { g_OpSize = 64; } } } else if (g_SegAddrMode == 64 && Extra == 6) { // Push/pops are always 64-bit in 64-bit segments.
g_OpSize = 64; } } else if (g_SegAddrMode == 64 && opcode == 0x8f) { // Push/pops are always 64-bit in 64-bit segments.
g_OpSize = 64; } olen = g_OpSize / 8; if (g_OpSize == 64) { goto QWORDlabel; } else if (g_OpSize == 32) { goto DWORDlabel; }
case xWORD: if (opcode == X86_PINSRW) { g_ForceMrmReg32 = TRUE; } EAsize[0] = 2; pEAlabel = "word ptr "; break;
case EDWORD: // Control register opsize is mode-independent.
g_OpSize = g_SegAddrMode; if (g_OpSize == 64) { goto QWORDlabel; } case xDWORD: if (opcode == X86_MOVDQ_7E && g_RepPrefix == X86_REP) { // Switch to MOVQ xmm1, xmm2/m64.
pchRepPrefixBuf = RepPrefixBuffer; *(pchOpcodeBuf - 1) = 'q'; EAsize[0] = 8; pEAlabel = "qword ptr "; g_XmmRegEa = TRUE; action = &actiontbl[O_Sd_XmmReg_qModrm] + 2; break; } // Fall through.
DWORDlabel: EAsize[0] = 4; pEAlabel = "dword ptr "; break;
case XMMOWORD: if (opcode == X86_PSHUF) { if (g_XmmOpSize == XMM_PS) { g_MmRegEa = TRUE; goto QWORDlabel; } else { EAsize[0] = 16; pEAlabel = "oword ptr "; break; } } g_XmmRegEa = TRUE; if (opcode == X86_CVTPD) { if (g_XmmOpSize == XMM_SS) { EAsize[0] = 8; pEAlabel = "qword ptr "; } else { EAsize[0] = 16; pEAlabel = "oword ptr "; } break; } else if (opcode == X86_CVTPS) { EAsize[0] = 16; pEAlabel = "oword ptr "; break; } else if (opcode == X86_MOVQ_D6) { if (g_XmmOpSize == XMM_SD) { // Switch to MOVDQ2Q mm, xmm.
EAsize[0] = 16; pEAlabel = "oword ptr "; action = &actiontbl[O_MmReg_qModrm] + 1; break; } } else if (opcode == X86_MOVHLPS && g_XmmOpSize == XMM_PS && BIT76(*pMem) == 3) { // reg-reg form of MOVLPS is called MOVHLPS.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszMOVHLPS); } else if (opcode == X86_MOVLHPS && g_XmmOpSize == XMM_PS && BIT76(*pMem) == 3) { // reg-reg form of MOVHPS is called MOVLHPS.
pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszMOVLHPS); } // Fall through.
OWORDlabel: case OWORD: switch(g_XmmOpSize) { case XMM_SS: EAsize[0] = 4; pEAlabel = "dword ptr "; if (opcode == X86_MOVQ_D6) { // Switch to MOVQ xmm1, xmm2/m64.
g_XmmRegEa = FALSE; action = &actiontbl[O_Sd_XmmReg_qModrm] + 1; } break; case XMM_SD: EAsize[0] = 8; pEAlabel = "qword ptr "; break; default: if (opcode == 0x112 || opcode == 0x113 || opcode == 0x116 || opcode == 0x117 || opcode == X86_MOVQ_D6 || (g_OpSize == g_SegOpSize && (opcode == 0x12c || opcode == X86_CVTSPSD2SPI || opcode == X86_CVTSPSD2SPSD))) { EAsize[0] = 8; pEAlabel = "qword ptr "; } else { EAsize[0] = 16; pEAlabel = "oword ptr "; } break; } break;
case XMMXWORD: g_XmmRegEa = TRUE; if (g_OpSize == g_SegOpSize) { if (opcode == X86_MOVNT) { EAsize[0] = 8; pEAlabel = "qword ptr "; } else { EAsize[0] = 4; pEAlabel = "dword ptr "; } } else { if (opcode == X86_MOVNT) { EAsize[0] = 16; pEAlabel = "oword ptr "; } else { EAsize[0] = 8; pEAlabel = "qword ptr "; } } break;
case MMQWORD: if (g_OpSize != g_SegOpSize && (opcode == X86_MOVDQA_MR || opcode == X86_MOVDQA_RM)) { pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszMOVDQA); } if (opcode == X86_CVTSPI2SPSD) { g_XmmRegEa = FALSE; if (g_XmmOpSize == XMM_SS || g_XmmOpSize == XMM_SD) { g_MmRegEa = FALSE; goto DWORDlabel; } } else if (g_OpSize != g_SegOpSize) { goto OWORDlabel; } g_MmRegEa = TRUE; QWORDlabel: case QWORD: EAsize[0] = 8; pEAlabel = "qword ptr "; break;
case TBYTE: EAsize[0] = 10; pEAlabel = "tbyte ptr "; break;
case FARPTR: g_ControlFlow = TRUE; // On x86-64 control-flow operations default to
// 64-bit opsize.
if (g_SegAddrMode == 64) { if (g_OpSize == 32) { g_OpSize = 64; } } switch(g_OpSize) { case 16: EAsize[0] = 4; pEAlabel = "dword ptr "; break; default: EAsize[0] = 6; pEAlabel = "fword ptr "; break; } break;
case LMODRM: // output modRM data type
if (mod != 3) { X86OutputString(&pchOperandBuf, pEAlabel); } else { EAsize[0] = 0; }
case MODRM: /* output modrm string */ if (segOvr) /* in case of segment override */ { X86OutputString(&pchOperandBuf, distbl[segOvr].instruct); } *pchModrmBuf = '\0'; X86OutputString(&pchOperandBuf, ModrmBuffer); break;
case ADDRP: /* address pointer */ // segment
OutputHexString(&pchOperandBuf, pMem + olen, 2); *pchOperandBuf++ = ':'; // offset
OutputSymbol(&pchOperandBuf, pMem, olen, segOvr); pMem += olen + 2; break;
case JCC8: JccEa = ComputeJccEa(opcode, fEAout); // Fall through.
case REL8: /* relative address 8-bit */ if (opcode == 0xe3 && g_AddrMode > 16) { pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, g_AddrMode == 64 ? dszJRCXZ : dszJECXZ); } Branch = *(char *)pMem++; /* get the 8-bit rel offset */ goto DoRelDispl;
case JCCX: JccEa = ComputeJccEa(opcode, fEAout); // Fall through.
case REL16: /* relative address 16-/32-bit */ switch(g_AddrMode) { case 16: Branch = *(short UNALIGNED *)pMem; pMem += 2; break; default: Branch = *(long UNALIGNED *)pMem; pMem += 4; break; } DoRelDispl: /* calculate address */ Branch += Offset + (pMem - membuf); // rel8 and rel16 are only used in control-flow
// instructions so the target is always relative
// to CS. Pass in the CS override to force this.
OutputSymbol(&pchOperandBuf, (PUCHAR)&Branch, alen, X86_CS_OVR); break;
case UBYTE: // unsigned byte for int/in/out
OutputHexString(&pchOperandBuf, pMem, 1); // ubyte
pMem++; break;
case CMPIB: // Immediate byte comparison encoding for CMP[SP][SD].
if (*pMem < 8) { X86OutputString(&pchOperandBuf, g_CompareIb[*pMem]); pMem++; } else { olen = 1; goto DoImmed; } break; case IB: /* operand is immediate byte */ // postop for AAD/AAM is 0x0a
if ((opcode & ~1) == 0xd4) { // test post-opcode byte
if (*pMem++ != 0x0a) { X86OutputString(&pchOperandBuf, dszRESERVED); } break; } olen = 1; /* set operand length */ goto DoImmed;
case IW: /* operand is immediate word */ olen = 2; /* set operand length */
case IV: /* operand is word or dword */ DoImmed: // AMD64 immediates are only 64-bit in the case of
// mov reg, immed. All other operations involving
// immediates stay 32-bit.
if (olen == 8 && (opcode < 0xb8 || opcode > 0xbf)) { olen = 4; } OutputHexValue(&pchOperandBuf, pMem, olen, FALSE); pMem += olen; break;
case XB: OutputExHexValue(&pchOperandBuf, pMem, 1, g_OpSize / 8); pMem++; break; case OFFS: /* operand is offset */ EAsize[0] = (opcode & 1) ? olen : 1;
if (segOvr) /* in case of segment override */ { X86OutputString(&pchOperandBuf, distbl[segOvr].instruct); }
*pchOperandBuf++ = '['; // offset
OutputSymbol(&pchOperandBuf, pMem, alen, segOvr); pMem += alen; *pchOperandBuf++ = ']'; break;
case X86_GROUP: /* operand is of group 1,2,4,6 or 8 */ /* output opcode symbol */ X86OutputString(&pchOpcodeBuf, group[*action++][ttt]); break;
case GROUPT: /* operand is of group 3,5 or 7 */ indx = *action; /* get indx into group from action */ goto doGroupT;
case EGROUPT: /* x87 ESC (D8-DF) group index */ indx = BIT20(opcode) * 2; /* get group index from opcode */ /* some operand variations exist */ if (mod == 3) { /* for x87 and mod == 3 */ ++indx; /* take the next group table entry */ if (indx == 3) { /* for x87 ESC==D9 and mod==3 */ if (ttt > 3) { /* for those D9 instructions */ indx = 12 + ttt; /* offset index to table by 12 */ ttt = rm; /* set secondary index to rm */ } } else if (indx == 7) { /* for x87 ESC==DB and mod==3 */ if (ttt == 4) { /* if ttt==4 */ ttt = rm; /* set secondary group table index */ } else if ((ttt < 4) || (ttt > 4 && ttt < 7)) { // adjust for pentium pro opcodes
indx = 24; /* offset index to table by 24*/ } } } doGroupT: /* handle group with different types of operands */
X86OutputString(&pchOpcodeBuf, groupt[indx][ttt].instruct); action = actiontbl + groupt[indx][ttt].opr; /* get new action */ break;
case OPC0F: /* secondary opcode table (opcode 0F) */ opcode = *pMem++; /* get real opcode */ g_MovX = (BOOL)(opcode == 0xBF || opcode == 0xB7); // Point opcode into secondary opcode portion of table.
opcode += 256; goto getNxtByte1;
case ADR_OVR: /* address override */ IgnoreExtend(); olen = g_OpSize / 8; OverrideAddrMode(); alen = g_AddrMode / 8; goto getNxtByte;
case OPR_OVR: /* operand size override */ IgnoreExtend(); OverrideOpSize(opcode); olen = g_OpSize / 8; goto getNxtByte;
case SEG_OVR: /* handle segment override */ IgnoreExtend(); olen = g_OpSize / 8; segOvr = opcode; /* save segment override opcode */ pchOpcodeBuf = OpcodeBuffer; // restart the opcode string
goto getNxtByte;
case REP: /* handle rep/lock prefixes */ IgnoreExtend(); olen = g_OpSize / 8; g_RepPrefix = opcode; *pchOpcodeBuf = '\0'; if (pchRepPrefixBuf != RepPrefixBuffer) { *pchRepPrefixBuf++ = ' '; } X86OutputString(&pchRepPrefixBuf, OpcodeBuffer); pchOpcodeBuf = OpcodeBuffer; getNxtByte: opcode = *pMem++; /* next byte is opcode */ getNxtByte1: action = actiontbl + distbl[opcode].opr; X86OutputString(&pchOpcodeBuf, distbl[opcode].instruct); break;
case NOP: if (opcode == X86_PAUSE && g_RepPrefix == X86_REP) { pchRepPrefixBuf = RepPrefixBuffer; pchOpcodeBuf = OpcodeBuffer; X86OutputString(&pchOpcodeBuf, dszPAUSE); } // Fall through.
default: /* opcode has no operand */ break; }
/* secondary action */ switch (action2) { case MRM: /* generate modrm for later use */ /* ignore if it has been generated */ if (!mrm) { /* generate modrm */ DIdoModrm(&pchModrmBuf, segOvr, fEAout); mrm = TRUE; /* remember its generation */ } break;
case COM: /* insert a comma after operand */ *pchOperandBuf++ = ','; break;
case END: /* end of instruction */ end = TRUE; break; } } while (!end); /* loop til end of instruction */
/***** prepare disassembled instruction for output *****/
// dprintf("EAaddr[] = %08lx\n", (ULONG)Flat(EAaddr[0]));
instlen = (int)(pMem - membuf);
if (instlen < cBytes) { cBytes = instlen; }
OutputHexCode(&pchResultBuf, membuf, cBytes);
if (instlen > cBytes) { *pchResultBuf++ = '?'; *pchResultBuf++ = '?'; // point past unread byte
AddrAdd(paddr, 1); do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + OBOFFSET); X86OutputString(&pchResultBuf, "???\n"); *pchResultBuf++ = '\0'; return FALSE; }
AddrAdd(paddr, instlen);
PSTR Mark; // Now that we know the complete size of the instruction
// we can correctly compute IP-relative absolute addresses.
*pchOperandBuf = 0; if (g_X86ModrmHasIpRelOffset && (Mark = strstr(OperandBuffer, IPREL_MARKER)) != NULL) { PSTR TailFrom, TailTo; ULONG64 IpRelAddr; size_t TailLen; // Move the tail of the string to the end of the buffer
// to make space.
TailFrom = Mark + sizeof(IPREL_MARKER) - 1; TailLen = pchOperandBuf - TailFrom; TailTo = OperandBuffer + (sizeof(OperandBuffer) - 1 - TailLen); memmove(TailTo, TailFrom, TailLen);
// Compute the absolute address from the new IP
// and the offset and format it into the buffer.
IpRelAddr = Flat(*paddr) + g_X86IpRelOffset; OutputSymbol(&Mark, (PUCHAR)&IpRelAddr, g_SegAddrMode == 64 ? 8 : 4, X86_CS_OVR); if (Mark < TailTo) { memmove(Mark, TailTo, TailLen); pchOperandBuf = Mark + TailLen; } else if (Mark >= TailTo + TailLen) { pchOperandBuf = Mark; } else { pchOperandBuf = Mark + (TailLen - (Mark - TailTo)); } } // if fEAout is set, build each EA with trailing space in EABuf
// point back over final trailing space if buffer nonnull
if (fEAout) { for (indx = 0; indx < 2; indx++) { if (EAsize[indx]) { X86OutputString(&pchEABuf, segOvr ? distbl[segOvr].instruct : pchEAseg[indx]); OutputHexAddr(&pchEABuf, &EAaddr[indx]); *pchEABuf++ = '='; tmp = GetMemString(&EAaddr[indx], membuf, EAsize[indx]); if (tmp == EAsize[indx]) { OutputHexString(&pchEABuf, membuf, EAsize[indx]); } else { while (EAsize[indx]--) { *pchEABuf++ = '?'; *pchEABuf++ = '?'; } } *pchEABuf++ = ' '; } }
if (pchEABuf != EABuffer) { pchEABuf--; } switch(JccEa) { case JCC_EA_NO_BRANCH: X86OutputString(&pchEABuf, "[br=0]"); break; case JCC_EA_BRANCH: X86OutputString(&pchEABuf, "[br=1]"); break; } }
// compute lengths of component strings.
// if the rep string is nonnull,
// add the opcode string length to the operand
// make the rep string the opcode string
cbOffset = (int)(pchResultBuf - pchDst); cbOperand = (int)(pchOperandBuf - OperandBuffer); cbOpcode = (int)(pchOpcodeBuf - OpcodeBuffer); if (pchRepPrefixBuf != RepPrefixBuffer) { cbOperand += cbOpcode + (cbOperand != 0); cbOpcode = (int)(pchRepPrefixBuf - RepPrefixBuffer); } cbEAddr = (int)(pchEABuf - EABuffer);
// for really long strings, where the opcode and operand
// will not fit on a 77-character line, make two lines
// with the opcode on offset 0 on the second line with
// the operand following after one space
//if (cbOpcode + cbOperand > OBLINEEND - 1) {
// fTwoLines = TRUE;
// obOpcode = 0;
// obOperand = cbOpcode + 1;
// }
//else {
// compute the minimum and maximum offset values for
// opcode and operand strings.
// if strings are nonnull, add extra for separating space
obOpcodeMin = cbOffset + 1; obOperandMin = obOpcodeMin + cbOpcode + 1; obOperandMax = OBLINEEND - cbEAddr - (cbEAddr != 0) - cbOperand; obOpcodeMax = obOperandMax - (cbOperand != 0) - cbOpcode;
// if minimum offset is more than the maximum, the strings
// will not fit on one line. recompute the min/max
// values with no offset and EA strings.
// if (obOpcodeMin > obOpcodeMax) {
// fTwoLines = TRUE;
// obOpcodeMin = 0;
// obOperandMin = cbOpcode + 1;
// obOperandMax = OBLINEEND - cbOperand;
// obOpcodeMax = obOperandMax - (cbOperand != 0) - cbOpcode;
// }
// compute the opcode and operand offsets. set offset as
// close to the default values as possible.
if (obOpcodeMin > OBOFFSET) { obOpcode = obOpcodeMin; } else if (obOpcodeMax < OBOFFSET) { obOpcode = obOpcodeMax; }
obOperandMin = obOpcode + cbOpcode + 1;
if (obOperandMin > OBOPERAND) { obOperand = obOperandMin; } else if (obOperandMax < OBOPERAND) { obOperand = obOperandMax; } // }
// build the resultant string with the offsets computed
// if two lines are to be output,
// append the EAddr string
// output a new line and reset the pointer
if (fTwoLines) { if (pchEABuf != EABuffer) { do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + OBLINEEND - cbEAddr); *pchEABuf = '\0'; X86OutputString(&pchResultBuf, EABuffer); } *pchResultBuf++ = '\n'; pchDst = pchResultBuf; }
// output rep, opcode, and operand strings
do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + obOpcode);
if (pchRepPrefixBuf != RepPrefixBuffer) { *pchRepPrefixBuf = '\0'; X86OutputString(&pchResultBuf, RepPrefixBuffer); do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + obOperand); }
*pchOpcodeBuf = '\0'; X86OutputString(&pchResultBuf, OpcodeBuffer);
if (pchOperandBuf != OperandBuffer) { do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + obOperand); *pchOperandBuf = '\0'; X86OutputString(&pchResultBuf, OperandBuffer); }
// if one line is to be output, append the EAddr string
if (!fTwoLines && pchEABuf != EABuffer) { *pchEABuf = '\0'; do { *pchResultBuf++ = ' '; } while (pchResultBuf < pchDst + OBLINEEND - cbEAddr); X86OutputString(&pchResultBuf, EABuffer); }
*pchResultBuf++ = '\n'; *pchResultBuf = '\0'; return TRUE;}
voidBaseX86MachineInfo::GetNextOffset(BOOL StepOver, PADDR NextAddr, PULONG NextMachine){ int cBytes; UCHAR membuf[X86_MAX_INSTRUCTION_LEN]; // current instruction buffer
UCHAR *pMem; UCHAR opcode; int fPrefix = TRUE; int fRepPrefix = FALSE; int ttt; int rm; ULONG64 instroffset; int subcode;
// NextMachine is always the same.
*NextMachine = m_ExecTypes[0]; // read instruction stream bytes into membuf and set mode and
// opcode size flags
GetPC(NextAddr); instroffset = Flat(*NextAddr); GetSegAddrOpSizes(this, NextAddr);
/* move full inst to local buffer */ cBytes = (int)GetMemString(NextAddr, membuf, X86_MAX_INSTRUCTION_LEN); // Ensure that membuf is padded with innocuous bytes in
// the section that wasn't read.
if (cBytes < X86_MAX_INSTRUCTION_LEN) { memset(membuf + cBytes, 0xcc, X86_MAX_INSTRUCTION_LEN - cBytes); } /* point to begin of instruction */ pMem = membuf;
// read and process any prefixes first
do { opcode = *pMem++; /* get opcode */ if (opcode == 0x66) { OverrideOpSize(opcode); } else if (m_ExecTypes[0] == IMAGE_FILE_MACHINE_AMD64 && opcode >= 0x40 && opcode <= 0x4f) { ExtendOps(opcode); } else if (opcode == 0x67) { OverrideAddrMode(); } else if ((opcode & ~1) == 0xf2) { fRepPrefix = TRUE; } else if (opcode != 0xf0 && (opcode & ~0x18) != 0x26 && (opcode & ~1) != 0x64) { fPrefix = FALSE; } } while (fPrefix);
// for instructions that alter the TF (trace flag), return the
// offset of the next instruction despite the flag of StepOver
if (((opcode & ~0x3) == 0x9c) && !g_WatchTrace) { // 9c-9f, pushf, popf, sahf, lahf
; } else if (opcode == 0xcf) { ULONG64 RetAddr[2]; ADDR Sp; ULONG Seg; // cf - iret - get RA from stack
FormSegRegAddress(&Sp, SEGREG_STACK, GetReg64(X86_NSP));
if (GetMemString(&Sp, RetAddr, g_SegAddrMode / 4) != (ULONG)g_SegAddrMode / 4) { error(MEMORY); }
Seg = *(PUSHORT)((PUCHAR)RetAddr + g_SegAddrMode / 8); switch(g_SegAddrMode) { case 16: instroffset = EXTEND64(*(PUSHORT)RetAddr); break; case 32: instroffset = EXTEND64(*(PULONG)RetAddr); break; case 64: instroffset = RetAddr[0]; break; }
FormSelAddress(NextAddr, Seg, instroffset); ComputeFlatAddress(NextAddr, NULL); return; } else if (opcode == 0xc4 && *pMem == 0xc4) { subcode = *(pMem+1); if ( subcode == 0x50 || subcode == 0x52 || subcode == 0x53 || subcode == 0x54 || subcode == 0x57 || subcode == 0x58 || subcode == 0x5D ) { pMem += 3; } else { pMem += 2; } } else if (!StepOver) { // if tracing just return OFFSET_TRACE to trace
instroffset = OFFSET_TRACE; } else if (opcode == 0xe8) { // near direct jump
pMem += g_OpSize > 16 ? 4 : 2; } else if (opcode == 0x9a) { // far direct jump
pMem += g_OpSize > 16 ? 6 : 4; } else if (opcode == 0xcd || (opcode >= 0xe0 && opcode <= 0xe2)) { // loop / int nn instrs
pMem++; } else if (opcode == 0xff) { // indirect call - compute length
opcode = *pMem++; // get modRM
ttt = BIT53(opcode); if ((ttt & ~1) == 2) { mod = BIT76(opcode); if (mod != 3) { // nonregister operand
rm = BIT20(opcode); if (g_AddrMode > 16) { if (rm == 4) { rm = BIT20(*pMem++); // get base from SIB
} if (mod == 0) { if (rm == 5) { pMem += 4; // long direct address
} // else register
} else if (mod == 1) { pMem++; // register with byte offset
} else { pMem += 4; // register with long offset
} } else { // 16-bit mode
if (mod == 0) { if (rm == 6) { pMem += 2; // short direct address
} } else { pMem += mod; // reg, byte, word offset
} } } } else { instroffset = OFFSET_TRACE; // 0xff, but not call
} } else if (!((fRepPrefix && ((opcode & ~3) == 0x6c || (opcode & ~3) == 0xa4 || (opcode & ~1) == 0xaa || (opcode & ~3) == 0xac)) || opcode == 0xcc || opcode == 0xce)) { instroffset = OFFSET_TRACE; // not repeated string op
} // or int 3 / into
// if not enough bytes were read for instruction parse,
// just give up and trace the instruction
if (cBytes < pMem - (PUCHAR)membuf) { instroffset = OFFSET_TRACE; }
// if not tracing, compute the new instruction offset
if (instroffset != OFFSET_TRACE) { instroffset += pMem - (PUCHAR)membuf; }
Flat(*NextAddr) = instroffset; ComputeNativeAddress(NextAddr);}
/*...........................internal function..............................*//* *//* generate a mod/rm string *//* */
voidBaseX86MachineInfo::DIdoModrm (char **ppchBuf, int segOvr, BOOL fEAout){ int mrm; /* modrm byte */ char *src; /* source string */ int sib; int ss; int ind; int oldrm;
mrm = *pMem++; /* get the mrm byte from instruction */ mod = BIT76(mrm); /* get mod */ ttt = BIT53(mrm) + g_ExtendMrmReg; /* get reg - used outside routine */ rm = BIT20(mrm); /* get rm */
if (mod == 3) { rm += g_ExtendRm; /* register only mode */ if (g_XmmRegEa) { *(*ppchBuf)++ = 'x'; *(*ppchBuf)++ = 'm'; *(*ppchBuf)++ = 'm'; if (rm >= 10) { *(*ppchBuf)++ = (char)('0' + rm / 10); rm %= 10; } *(*ppchBuf)++ = rm + '0'; } else if (g_MmRegEa) { *(*ppchBuf)++ = 'm'; *(*ppchBuf)++ = 'm'; *(*ppchBuf)++ = rm + '0'; } else { if (EAsize[0] == 1) { /* point to 8-bit register */ if (g_ExtendAny && rm < 8) { src = g_Amd64ExtendedReg8[rm]; } else { src = g_X86Reg8[rm]; } X86OutputString(ppchBuf, src); } else { src = g_X86RegBase[rm]; if (g_ForceMrmReg32) { *(*ppchBuf)++ = 'e'; } else if (g_OpSize > 16 && !g_MovX) { /* make it a 32- or 64-bit register */ *(*ppchBuf)++ = (rm >= 8 || g_OpSize == 64 && !g_MovSXD) ? 'r' : 'e'; } X86OutputString(ppchBuf, src); if (rm >= 8) { if (g_OpSize == 32) { *(*ppchBuf)++ = 'd'; } else if (g_OpSize == 16) { *(*ppchBuf)++ = 'w'; } }
if (g_ControlFlow && fEAout) { // This is a call/jmp through a register.
// Output a code symbol for the target.
ULONG64 Target = GetReg64(g_X86RegIdx[rm]); *(*ppchBuf)++ = ' '; *(*ppchBuf)++ = '{'; OutputSymbol(ppchBuf, (PUCHAR)&Target, g_OpSize / 8, X86_CS_OVR); *(*ppchBuf)++ = '}'; } } } EAsize[0] = 0; // no EA value to output
return; }
if (g_AddrMode == 64) { oldrm = rm; if (rm == 4) { /* rm == 4 implies sib byte */ sib = *pMem++; /* get s_i_b byte */ rm = BIT20(sib); }
*(*ppchBuf)++ = '['; if (mod == 0 && rm == 5) { if (g_SegAddrMode == 64 && oldrm == 5) { // IP-relative 32-bit displacement. The
// displacement is relative to the IP of the
// next instruction, which can't be computed
// yet so just put in a marker for post-processing.
g_X86ModrmHasIpRelOffset = TRUE; g_X86IpRelOffset = *(LONG UNALIGNED *)pMem; X86OutputString(ppchBuf, IPREL_MARKER); } else { // Absolute 32-bit displacement.
OutputSymbol(ppchBuf, pMem, 4, segOvr); }
pMem += 4; } else { rm += g_ExtendRm; if (fEAout) { if (segOvr) { FormSegRegAddress(&EAaddr[0], GetSegReg(segOvr), GetReg64(g_X86RegIdx[rm])); pchEAseg[0] = distbl[segOvr].instruct; } else if (g_X86RegIdx[rm] == X86_NBP || g_X86RegIdx[rm] == X86_NSP) { FormSegRegAddress(&EAaddr[0], SEGREG_STACK, GetReg64(g_X86RegIdx[rm])); pchEAseg[0] = dszSS_; } else { FormSegRegAddress(&EAaddr[0], SEGREG_DATA, GetReg64(g_X86RegIdx[rm])); } } X86OutputString(ppchBuf, g_X86Mrm64[rm]); }
if (oldrm == 4) { // finish processing sib
ind = BIT53(sib); if (ind != 4) { ind += g_ExtendSibIndex; *(*ppchBuf)++ = '+'; X86OutputString(ppchBuf, g_X86Mrm64[ind]); ss = 1 << BIT76(sib); if (ss != 1) { *(*ppchBuf)++ = '*'; *(*ppchBuf)++ = (char)(ss + '0'); } if (fEAout) { AddrAdd(&EAaddr[0], GetReg64(g_X86RegIdx[ind]) * ss); } } } } else if (g_AddrMode == 32) { oldrm = rm; if (rm == 4) { /* rm == 4 implies sib byte */ sib = *pMem++; /* get s_i_b byte */ rm = BIT20(sib); }
*(*ppchBuf)++ = '['; if (mod == 0 && rm == 5) { if (g_SegAddrMode == 64 && oldrm == 5) { // IP-relative 32-bit displacement. The
// displacement is relative to the IP of the
// next instruction, which can't be computed
// yet so just put in a marker for post-processing.
g_X86ModrmHasIpRelOffset = TRUE; g_X86IpRelOffset = *(LONG UNALIGNED *)pMem; X86OutputString(ppchBuf, IPREL_MARKER); } else { // Absolute 32-bit displacement.
OutputSymbol(ppchBuf, pMem, 4, segOvr); }
pMem += 4; } else { rm += g_ExtendRm; if (fEAout) { if (segOvr) { FormSegRegAddress(&EAaddr[0], GetSegReg(segOvr), EXTEND64(GetReg32(g_X86RegIdx[rm]))); pchEAseg[0] = distbl[segOvr].instruct; } else if (g_X86RegIdx[rm] == X86_NBP || g_X86RegIdx[rm] == X86_NSP) { FormSegRegAddress(&EAaddr[0], SEGREG_STACK, EXTEND64(GetReg32(g_X86RegIdx[rm]))); pchEAseg[0] = dszSS_; } else { FormSegRegAddress(&EAaddr[0], SEGREG_DATA, EXTEND64(GetReg32(g_X86RegIdx[rm]))); } } X86OutputString(ppchBuf, g_X86Mrm32[rm]); }
if (oldrm == 4) { // finish processing sib
ind = BIT53(sib); if (ind != 4) { ind += g_ExtendSibIndex; *(*ppchBuf)++ = '+'; X86OutputString(ppchBuf, g_X86Mrm32[ind]); ss = 1 << BIT76(sib); if (ss != 1) { *(*ppchBuf)++ = '*'; *(*ppchBuf)++ = (char)(ss + '0'); } if (fEAout) { AddrAdd(&EAaddr[0], EXTEND64(GetReg32(g_X86RegIdx[ind])) * ss); } } } } else { // 16-bit addressing mode
*(*ppchBuf)++ = '['; if (mod == 0 && rm == 6) { OutputSymbol(ppchBuf, pMem, 2, segOvr); // 16-bit offset
pMem += 2; } else { if (fEAout) { if (segOvr) { FormSegRegAddress(&EAaddr[0], GetSegReg(segOvr), GetReg16(g_X86Reg16Idx[rm])); pchEAseg[0] = distbl[segOvr].instruct; } else if (g_X86Reg16Idx[rm] == X86_NBP) { FormSegRegAddress(&EAaddr[0], SEGREG_STACK, GetReg16(g_X86Reg16Idx[rm])); pchEAseg[0] = dszSS_; } else { FormSegRegAddress(&EAaddr[0], SEGREG_DATA, GetReg16(g_X86Reg16Idx[rm])); } if (rm < 4) { AddrAdd(&EAaddr[0], GetReg16(g_X86Reg16Idx2[rm])); } } X86OutputString(ppchBuf, g_X86Mrm16[rm]); } }
// output any displacement
if (mod == 1) { if (fEAout) { AddrAdd(&EAaddr[0], (long)*(char *)pMem); } OutputHexValue(ppchBuf, pMem, 1, TRUE); pMem++; } else if (mod == 2) { long tmp = 0; if (g_AddrMode > 16) { memmove(&tmp,pMem,sizeof(long)); if (fEAout) { AddrAdd(&EAaddr[0], tmp); } OutputHexValue(ppchBuf, pMem, 4, TRUE); pMem += 4; } else { memmove(&tmp,pMem,sizeof(short)); if (fEAout) { AddrAdd(&EAaddr[0], tmp); } OutputHexValue(ppchBuf, pMem, 2, TRUE); pMem += 2; } }
if (g_AddrMode == 16 && fEAout) { Off(EAaddr[0]) &= 0xffff; NotFlat(EAaddr[0]); Off(EAaddr[1]) &= 0xffff; NotFlat(EAaddr[1]); ComputeFlatAddress(&EAaddr[0], NULL); ComputeFlatAddress(&EAaddr[1], NULL); }
*(*ppchBuf)++ = ']';
// The value at the effective address may be pointing to an interesting
// symbol, as with indirect jumps or memory operations.
// If there's an EA and an exact symbol match, display
// the extra symbol.
if (fEAout) { DWORD64 symbol;
if (g_Target->ReadPointer(this, Flat(EAaddr[0]), &symbol) == S_OK) { char* pchBuf = *ppchBuf;
(*ppchBuf)++; if (OutputExactSymbol(ppchBuf, (PUCHAR)&symbol, m_Ptr64 ? 8 : 4, segOvr)) { *pchBuf = '{'; *(*ppchBuf)++ = '}'; } else { (*ppchBuf)--; } } }}
LONGLONGGetSignExtendedValue(int OpLen, PUCHAR Mem){ switch(OpLen) { case 1: return *(char *)Mem; case 2: return *(short UNALIGNED *)Mem; case 4: return *(long UNALIGNED *)Mem; case 8: return *(LONGLONG UNALIGNED *)Mem; }
DBG_ASSERT(FALSE); return 0;}
/*** OutputHexValue - output hex value
* 07-Jun-1999 -by- Andre Vachon* Purpose:* Output the value pointed by *ppchBuf of the specified* length. The value is treated as signed and leading* zeroes are not printed. The string is prefaced by a* '+' or '-' sign as appropriate.** Input:* *ppchBuf - pointer to text buffer to fill* *pchMemBuf - pointer to memory buffer to extract value* length - length in bytes of value (1, 2, and 4 supported)* fDisp - set if displacement to output '+'** Output:* *ppchBuf - pointer updated to next text character**************************************************************************/
voidOutputHexValue (char **ppchBuf, PUCHAR pchMemBuf, int length, int fDisp){ LONGLONG value; int index; char digit[32];
value = GetSignExtendedValue(length, pchMemBuf);
length <<= 1; // shift once to get hex length
if (value != 0 || !fDisp) { if (fDisp) { // use neg value for byte displacement
// assume very large DWORDs are negative too
if (value < 0 && (length == 2 || ((unsigned long)value & 0xff000000) == 0xff000000)) { value = -value; *(*ppchBuf)++ = '-'; } else { *(*ppchBuf)++ = '+'; } }
*(*ppchBuf)++ = '0'; *(*ppchBuf)++ = 'x'; for (index = length - 1; index != -1; index--) { digit[index] = (char)(value & 0xf); value >>= 4; } index = 0; while (digit[index] == 0 && index < length - 1) { index++; } while (index < length) { *(*ppchBuf)++ = hexdigit[digit[index++]]; } }}
voidOutputExHexValue(char **ppchBuf, PUCHAR pchMemBuf, int MemLen, int OpLen){ LONGLONG Value = GetSignExtendedValue(MemLen, pchMemBuf); OutputHexValue(ppchBuf, (PUCHAR)&Value, OpLen, FALSE);}
/*** OutputHexString - output hex string
** Purpose:* Output the value pointed by *ppchMemBuf of the specified* length. The value is treated as unsigned and leading* zeroes are printed.** Input:* *ppchBuf - pointer to text buffer to fill* *pchValue - pointer to memory buffer to extract value* length - length in bytes of value** Output:* *ppchBuf - pointer updated to next text character* *ppchMemBuf - pointer update to next memory byte**************************************************************************/
voidOutputHexString (char **ppchBuf, PUCHAR pchValue, int length){ UCHAR chMem;
pchValue += length; while (length--) { chMem = *--pchValue; *(*ppchBuf)++ = hexdigit[chMem >> 4]; *(*ppchBuf)++ = hexdigit[chMem & 0x0f]; }}
/*** OutputHexCode - output hex code
** Purpose:* Output the code pointed by pchMemBuf of the specified* length. The value is treated as unsigned and leading* zeroes are printed. This differs from OutputHexString* in that bytes are printed from low to high addresses.** Input:* *ppchBuf - pointer to text buffer to fill* pchMemBuf - pointer to memory buffer to extract value* length - length in bytes of value** Output:* *ppchBuf - pointer updated to next text character**************************************************************************/
void OutputHexCode (char **ppchBuf, PUCHAR pchMemBuf, int length){ UCHAR chMem;
while (length--) { chMem = *pchMemBuf++; *(*ppchBuf)++ = hexdigit[chMem >> 4]; *(*ppchBuf)++ = hexdigit[chMem & 0x0f]; }}
/*** X86OutputString - output string
** Purpose:* Copy the string into the buffer pointed by *ppBuf.** Input:* *pStr - pointer to string** Output:* *ppBuf points to next character in buffer.**************************************************************************/
voidX86OutputString ( char **ppBuf, char *pStr ){ while (*pStr) { *(*ppBuf)++ = *pStr++; }}
/*** OutputSymbol - output symbolic value
** Purpose:* Output the value in outvalue into the buffer* pointed by *pBuf. Express the value as a* symbol plus displacment, if possible.** Input:* *ppBuf - pointer to text buffer to fill* *pValue - pointer to memory buffer to extract value* length - length in bytes of value** Output:* *ppBuf - pointer updated to next text character**************************************************************************/
voidBaseX86MachineInfo::OutputSymbol ( char **ppBuf, PUCHAR pValue, int length, int segOvr ){ CHAR chSymbol[MAX_SYMBOL_LEN]; ULONG64 displacement; ULONG64 value;
value = 0; memcpy(&value, pValue, length); if (length == 4) { value = EXTEND64(value); }
if (IS_CONTEXT_ACCESSIBLE()) { FormSegRegAddress(&EAaddr[0], GetSegReg(segOvr), value); value = Flat(EAaddr[0]); }
GetSymbolStdCall(value, chSymbol, sizeof(chSymbol), &displacement, NULL); if (chSymbol[0]) { X86OutputString(ppBuf, chSymbol); OutputHexValue(ppBuf, (PUCHAR)&displacement, length, TRUE); *(*ppBuf)++ = ' '; *(*ppBuf)++ = '('; OutputHexString(ppBuf, pValue, length); *(*ppBuf)++ = ')'; } else { OutputHexString(ppBuf, pValue, length); }}
/*** OutputExactSymbol - Output symbolic value only for exact symbol
* matches.**************************************************************************/
BOOLBaseX86MachineInfo::OutputExactSymbol ( char **ppBuf, PUCHAR pValue, int length, int segOvr ){ CHAR chSymbol[MAX_SYMBOL_LEN]; ULONG64 displacement; ULONG64 value;
value = 0; memcpy(&value, pValue, length); if (length == 4) { value = EXTEND64(value); }
GetSymbolStdCall(value, chSymbol, sizeof(chSymbol), &displacement, NULL); if (chSymbol[0] && displacement == 0) { X86OutputString(ppBuf, chSymbol); OutputHexValue(ppBuf, (PUCHAR)&displacement, length, TRUE); *(*ppBuf)++ = ' '; *(*ppBuf)++ = '('; OutputHexString(ppBuf, pValue, length); *(*ppBuf)++ = ')'; return TRUE; } else { return FALSE; }}
voidOutputHexAddr(PSTR *ppBuffer, PADDR paddr){ sprintAddr(ppBuffer, paddr); // Remove trailing space.
(*ppBuffer)--; **ppBuffer = 0;}
ULONGBaseX86MachineInfo::GetSegReg(int SegOpcode){ switch(SegOpcode) { case 0x26: return SEGREG_ES; case X86_CS_OVR: return SEGREG_CODE; case 0x36: return SEGREG_STACK; case 0x64: return SEGREG_FS; case 0x65: return SEGREG_GS; case 0x3e: default: return SEGREG_DATA; }}
intBaseX86MachineInfo::ComputeJccEa(int Opcode, BOOL EaOut){ if (!EaOut) { return JCC_EA_NONE; }
ULONG Flags; int Branch;
if ((Opcode >= 0x70 && Opcode <= 0x7f) || (Opcode >= 0x180 && Opcode <= 0x18f)) { int Table = (Opcode >> 1) & 7;
Flags = GetReg32(X86_NFL); Branch = Opcode & 1; if ((Flags & g_JccCheckTable[Table][0]) != 0 || ((Flags >> g_JccCheckTable[Table][1]) & 1) != ((Flags >> g_JccCheckTable[Table][2]) & 1)) { Branch ^= 1; }
return JCC_EA_NO_BRANCH + Branch; } else { ULONG64 Cx = GetReg64(X86_NCX); switch(g_OpSize) { case 16: Cx &= 0xffff; break; case 32: Cx &= 0xffffffff; break; } switch(Opcode) { case 0xe0: // LOOPNE.
Flags = GetReg32(X86_NFL); Branch = (Flags & X86_BIT_FLAGZF) == 0 && Cx != 1 ? JCC_EA_BRANCH : JCC_EA_NO_BRANCH; break; case 0xe1: // LOOPE.
Flags = GetReg32(X86_NFL); Branch = (Flags & X86_BIT_FLAGZF) != 0 && Cx != 1 ? JCC_EA_BRANCH : JCC_EA_NO_BRANCH; break; case 0xe2: // LOOP.
Branch = Cx == 1 ? JCC_EA_NO_BRANCH : JCC_EA_BRANCH; break; case 0xe3: // J*CXZ.
Branch = Cx == 0 ? JCC_EA_BRANCH : JCC_EA_NO_BRANCH; break; default: DBG_ASSERT(FALSE); Branch = JCC_EA_NONE; break; }
return Branch; }}
BOOLBaseX86MachineInfo::IsBreakpointInstruction(PADDR Addr){ UCHAR Instr[X86_INT3_LEN];
if (GetMemString(Addr, Instr, X86_INT3_LEN) != X86_INT3_LEN) { return FALSE; }
return !memcmp(Instr, g_X86Int3, X86_INT3_LEN);}
HRESULTBaseX86MachineInfo::InsertBreakpointInstruction(PUSER_DEBUG_SERVICES Services, ULONG64 Process, ULONG64 Offset, PUCHAR SaveInstr, PULONG64 ChangeStart, PULONG ChangeLen){ if ((g_TargetMachineType != IMAGE_FILE_MACHINE_I386) && (g_Wow64exts != NULL)) { PPROCESS_INFO ProcInfo = FindProcessByHandle(Process); if (ProcInfo != NULL) { (*g_Wow64exts)(WOW64EXTS_FLUSH_CACHE_WITH_HANDLE, (ULONG64)ProcInfo->Handle, Offset, X86_INT3_LEN); } }
*ChangeStart = Offset; *ChangeLen = X86_INT3_LEN; ULONG Done; HRESULT Status;
Status = Services->ReadVirtual(Process, Offset, SaveInstr, X86_INT3_LEN, &Done); if (Status == S_OK && Done != X86_INT3_LEN) { Status = HRESULT_FROM_WIN32(ERROR_READ_FAULT); }
if (Status == S_OK) { Status = Services->WriteVirtual(Process, Offset, g_X86Int3, X86_INT3_LEN, &Done); if (Status == S_OK && Done != X86_INT3_LEN) { Status = HRESULT_FROM_WIN32(ERROR_WRITE_FAULT); } }
return Status;}
HRESULTBaseX86MachineInfo::RemoveBreakpointInstruction(PUSER_DEBUG_SERVICES Services, ULONG64 Process, ULONG64 Offset, PUCHAR SaveInstr, PULONG64 ChangeStart, PULONG ChangeLen){ if ((g_TargetMachineType != IMAGE_FILE_MACHINE_I386) && (g_Wow64exts != NULL)) { PPROCESS_INFO ProcInfo = FindProcessByHandle(Process); if (ProcInfo != NULL) { (*g_Wow64exts)(WOW64EXTS_FLUSH_CACHE_WITH_HANDLE, (ULONG64)ProcInfo->Handle, Offset, X86_INT3_LEN); } }
*ChangeStart = Offset; *ChangeLen = X86_INT3_LEN; ULONG Done; HRESULT Status;
Status = Services->WriteVirtual(Process, Offset, SaveInstr, X86_INT3_LEN, &Done); if (Status == S_OK && Done != X86_INT3_LEN) { Status = HRESULT_FROM_WIN32(ERROR_WRITE_FAULT); } return Status;}
voidBaseX86MachineInfo::AdjustPCPastBreakpointInstruction(PADDR Addr, ULONG BreakType){ if (BreakType == DEBUG_BREAKPOINT_CODE) { AddrAdd(Addr, X86_INT3_LEN); SetPC(Addr); }}
BOOLBaseX86MachineInfo::IsCallDisasm(PCSTR Disasm){ return strstr(Disasm, " call") != NULL;}
BOOLBaseX86MachineInfo::IsReturnDisasm(PCSTR Disasm){ return strstr(Disasm, " ret") != NULL || (IS_KERNEL_TARGET() && strstr(Disasm, " iretd") != NULL);}
BOOLBaseX86MachineInfo::IsSystemCallDisasm(PCSTR Disasm){ return (strstr(Disasm, " int ") != NULL && strstr(Disasm, " 2e") != NULL) || strstr(Disasm, " sysenter") != NULL || strstr(Disasm, " syscall") != NULL;}
BOOLBaseX86MachineInfo::IsDelayInstruction(PADDR Addr){ // X86 does not have delay slots.
return FALSE;}
voidBaseX86MachineInfo::GetEffectiveAddr(PADDR Addr){ *Addr = EAaddr[0];}
voidBaseX86MachineInfo::IncrementBySmallestInstruction(PADDR Addr){ AddrAdd(Addr, 1);}
voidBaseX86MachineInfo::DecrementBySmallestInstruction(PADDR Addr){ AddrSub(Addr, 1);}
//----------------------------------------------------------------------------
//
// X86MachineInfo methods.
//
//----------------------------------------------------------------------------
HRESULTX86MachineInfo::NewBreakpoint(DebugClient* Client, ULONG Type, ULONG Id, Breakpoint** RetBp){ HRESULT Status;
switch(Type & (DEBUG_BREAKPOINT_CODE | DEBUG_BREAKPOINT_DATA)) { case DEBUG_BREAKPOINT_CODE: *RetBp = new CodeBreakpoint(Client, Id, IMAGE_FILE_MACHINE_I386); Status = (*RetBp) ? S_OK : E_OUTOFMEMORY; break; case DEBUG_BREAKPOINT_DATA: *RetBp = new X86DataBreakpoint(Client, Id, X86_CR4, X86_DR6, IMAGE_FILE_MACHINE_I386); Status = (*RetBp) ? S_OK : E_OUTOFMEMORY; break; default: // Unknown breakpoint type.
Status = E_NOINTERFACE; }
return Status;}
voidX86MachineInfo::InsertAllDataBreakpoints(void){ PPROCESS_INFO ProcessSave = g_CurrentProcess; PTHREAD_INFO Thread;
// Update thread context for every thread.
g_CurrentProcess = g_ProcessHead; while (g_CurrentProcess != NULL) { Thread = g_CurrentProcess->ThreadHead; while (Thread != NULL) { ULONG Dr7Value;
BpOut("Thread %d data breaks %d\n", Thread->UserId, Thread->NumDataBreaks);
ChangeRegContext(Thread);
// Start with all breaks turned off.
Dr7Value = GetIntReg(X86_DR7) & ~X86_DR7_CTRL_03_MASK;
if (Thread->NumDataBreaks > 0) { ULONG i;
for (i = 0; i < Thread->NumDataBreaks; i++) { X86DataBreakpoint* Bp = (X86DataBreakpoint *)Thread->DataBreakBps[i];
ULONG64 Addr = Flat(*Bp->GetAddr()); BpOut(" dbp %d at %p\n", i, Addr); if (g_DataBreakpointsChanged) { SetReg32(X86_DR0 + i, (ULONG)Addr); } // There are two enable bits per breakpoint
// and four len/rw bits so split up enables
// and len/rw when shifting into place.
Dr7Value |= ((Bp->m_Dr7Bits & 0xffff0000) << (i * 4)) | ((Bp->m_Dr7Bits & X86_DR7_ALL_ENABLES) << (i * 2)); }
// The kernel automatically clears DR6 when it
// processes a DBGKD_CONTROL_SET.
if (IS_USER_TARGET()) { SetReg32(X86_DR6, 0); }
// Set local exact match, which is effectively global on NT.
Dr7Value |= X86_DR7_LOCAL_EXACT_ENABLE; }
BpOut(" thread %d DR7 %X\n", Thread->UserId, Dr7Value); SetReg32(X86_DR7, Dr7Value);
Thread = Thread->Next; }
g_CurrentProcess = g_CurrentProcess->Next; }
g_CurrentProcess = ProcessSave; if (g_CurrentProcess != NULL) { ChangeRegContext(g_CurrentProcess->CurrentThread); } else { ChangeRegContext(NULL); }}
voidX86MachineInfo::RemoveAllDataBreakpoints(void){ SetReg32(X86_DR7, 0);}
ULONGX86MachineInfo::IsBreakpointOrStepException(PEXCEPTION_RECORD64 Record, ULONG FirstChance, PADDR BpAddr, PADDR RelAddr){ if (Record->ExceptionCode == STATUS_BREAKPOINT || Record->ExceptionCode == STATUS_WX86_BREAKPOINT) { // Data breakpoints hit as STATUS_SINGLE_STEP so
// this can only be a code breakpoint.
if (IS_USER_TARGET() && FirstChance) { // Back up to the actual breakpoint instruction.
AddrSub(BpAddr, X86_INT3_LEN); SetPC(BpAddr); } return EXBS_BREAKPOINT_CODE; } else if (Record->ExceptionCode == STATUS_SINGLE_STEP || Record->ExceptionCode == STATUS_WX86_SINGLE_STEP) { // XXX t-tcheng - Conversion for Dr6, Dr7 not implemented yet...
ULONG Dr6 = GetIntReg(X86_DR6); ULONG Dr7 = GetIntReg(X86_DR7);
BpOut("X86 step: DR6 %X, DR7 %X\n", Dr6, Dr7);
// The single step bit should always be set if a data breakpoint
// is hit but also check the DR7 enables just in case.
if ((Dr6 & X86_DR6_SINGLE_STEP) || (Dr7 & X86_DR7_ALL_ENABLES) == 0 || (Dr6 & X86_DR6_BREAK_03) == 0) { // XXX drewb - The values in the last-branch MSRs are
// not helpful for unknown reasons. Leave this code
// off until we can determine whether there's a way
// to get the right branch source address.
#if 0
if (IS_REMOTE_KERNEL_TARGET() && m_SupportsBranchTrace) { ULONG64 LastIp;
if (NT_SUCCESS(DbgKdReadMsr(X86_MSR_LAST_BRANCH_FROM_IP, &LastIp))) { // The branch may have come from a different
// segment. We could try and determine what
// code segment it was by reading the stack to
// get the saved CS value but it's not worth
// it right now.
FormAddr(SEGREG_CODE, LastIp, FORM_CODE | FORM_SEGREG | X86_FORM_VM86(GetIntReg(X86_EFL)), RelAddr); } }#endif
// This is a true single step exception, not
// a data breakpoint.
return EXBS_STEP_INSTRUCTION; } else { // Some data breakpoint must be hit.
// There doesn't appear to be any way
// to get the faulting address so just leave the PC.
return EXBS_BREAKPOINT_DATA; } }
return EXBS_NONE;}
void X86MachineInfo::PrintStackFrameAddressesTitle(ULONG Flags){ PrintMultiPtrTitle("ChildEBP", 1); PrintMultiPtrTitle("RetAddr", 1);}
void X86MachineInfo::PrintStackFrameAddresses(ULONG Flags, PDEBUG_STACK_FRAME StackFrame){ dprintf("%s %s ", FormatAddr64(StackFrame->FrameOffset), FormatAddr64(StackFrame->ReturnOffset));}
voidX86MachineInfo::PrintStackArgumentsTitle(ULONG Flags){ PrintMultiPtrTitle("Args to Child", 3);}
void X86MachineInfo::PrintStackArguments(ULONG Flags, PDEBUG_STACK_FRAME StackFrame){ dprintf("%s %s %s ", FormatAddr64(StackFrame->Params[0]), FormatAddr64(StackFrame->Params[1]), FormatAddr64(StackFrame->Params[2]));}
void X86MachineInfo::PrintStackCallSiteTitle(ULONG Flags){}
void X86MachineInfo::PrintStackCallSite(ULONG Flags, PDEBUG_STACK_FRAME StackFrame, CHAR SymBuf[], DWORD64 Displacement, USHORT StdCallArgs){ // Truncate the displacement to 32 bits since it can never be
// greater than 32 bit for X86, and we don't want addresses with no
// symbols to show up with the leading 0xfffffff
MachineInfo::PrintStackCallSite(Flags, StackFrame, SymBuf, (DWORD64)(DWORD)Displacement, StdCallArgs);
if ((Flags & DEBUG_STACK_FUNCTION_INFO) && !StackFrame->FuncTableEntry) { if (StdCallArgs != 0xffff) { dprintf(" [Stdcall: %d]", StdCallArgs); } } else if ((Flags & DEBUG_STACK_FUNCTION_INFO) && StackFrame->FuncTableEntry) { PFPO_DATA FpoData = (PFPO_DATA)StackFrame->FuncTableEntry; switch(FpoData->cbFrame) { case FRAME_FPO: if (FpoData->fHasSEH) { dprintf(" (FPO: [SEH])"); } else { dprintf(" (FPO:"); if (FpoData->fUseBP) { dprintf(" [EBP 0x%s]", FormatAddr64(SAVE_EBP(StackFrame))); } dprintf(" [%d,%d,%d])", FpoData->cdwParams, FpoData->cdwLocals, FpoData->cbRegs); } break;
case FRAME_NONFPO: dprintf(" (FPO: [Non-Fpo])" ); break;
case FRAME_TRAP: if (!IS_KERNEL_TARGET()) { goto UnknownFpo; } dprintf(" (FPO: [%d,%d] TrapFrame%s @ %s)", FpoData->cdwParams, FpoData->cdwLocals, TRAP_EDITED(StackFrame) ? "" : "-EDITED", FormatAddr64(SAVE_TRAP(StackFrame))); break;
case FRAME_TSS: if (!IS_KERNEL_TARGET()) { goto UnknownFpo; } dprintf(" (FPO: TaskGate %lx:0)", (ULONG)TRAP_TSS(StackFrame)); break;
default: UnknownFpo: dprintf(" (UNKNOWN FPO TYPE)"); break; } }}
|
