envi.archs.i386.emu

149

150 - def __init__(self):

151 # Set ourself up as an arch module *and* register context 152 #i386Module.__init__(self) 153 archmod = i386Module() 154 envi.Emulator.__init__(self, archmod=archmod) 155 156 for i in xrange(6): 157 self.setSegmentInfo(i, 0, 0xffffffff) 158 159 i386RegisterContext.__init__(self) 160 161 # Add our known calling conventions 162 self.addCallingConvention('stdcall', stdcall) 163 self.addCallingConvention('thiscall', thiscall) 164 self.addCallingConvention('cdecl', cdecl) 165 self.addCallingConvention('msfastcall', msfastcall) 166 self.addCallingConvention('bfastcall', bfastcall)

167

168 - def getSegmentIndex(self, op):

169 # FIXME this needs to account for push/pop/etc 170 if op.prefixes == 0: 171 return SEG_DS 172 if op.prefixes & PREFIX_ES: 173 return SEG_ES 174 elif op.prefixes & PREFIX_CS: 175 return SEG_CS 176 elif op.prefixes & PREFIX_SS: 177 return SEG_SS 178 elif op.prefixes & PREFIX_DS: 179 return SEG_DS 180 elif op.prefixes & PREFIX_FS: 181 return SEG_FS 182 elif op.prefixes & PREFIX_GS: 183 return SEG_GS 184 return SEG_DS

185

186 - def setFlag(self, which, state):

187 flags = self.getRegister(REG_EFLAGS) 188 if state: 189 flags |= which 190 else: 191 flags &= ~which 192 self.setRegister(REG_EFLAGS, flags)

193

194 - def getFlag(self, which):

195 flags = self.getRegister(REG_EFLAGS) 196 return bool(flags & which)

197

198 - def readMemValue(self, addr, size):

199 bytes = self.readMemory(addr, size) 200 if bytes == None: 201 return None 202 #FIXME change this (and all uses of it) to passing in format... 203 if len(bytes) != size: 204 raise Exception("Read Gave Wrong Length At 0x%.8x (va: 0x%.8x wanted %d got %d)" % (self.getProgramCounter(),addr, size, len(bytes))) 205 if size == 1: 206 return struct.unpack("B", bytes)[0] 207 elif size == 2: 208 return struct.unpack("<H", bytes)[0] 209 elif size == 4: 210 return struct.unpack("<I", bytes)[0] 211 elif size == 8: 212 return struct.unpack("<Q", bytes)[0]

213

214 - def writeMemValue(self, addr, value, size):

215 #FIXME change this (and all uses of it) to passing in format... 216 if size == 1: 217 bytes = struct.pack("B",value & 0xff) 218 elif size == 2: 219 bytes = struct.pack("<H",value & 0xffff) 220 elif size == 4: 221 bytes = struct.pack("<I", value & 0xffffffff) 222 elif size == 8: 223 bytes = struct.pack("<Q", value & 0xffffffffffffffff) 224 self.writeMemory(addr, bytes)

225

226 - def readMemSignedValue(self, addr, size):

227 bytes = self.readMemory(addr, size) 228 if bytes == None: 229 return None 230 if size == 1: 231 return struct.unpack("b", bytes)[0] 232 elif size == 2: 233 return struct.unpack("<h", bytes)[0] 234 elif size == 4: 235 return struct.unpack("<l", bytes)[0]

236

237 - def executeOpcode(self, op):

238 # NOTE: If an opcode method returns 239 # other than None, that is the new eip 240 meth = self.op_methods.get(op.mnem, None) 241 if meth == None: 242 raise envi.UnsupportedInstruction(self, op) 243 244 if op.prefixes & PREFIX_REP: 245 x = self.doRepPrefix(meth, op) 246 else: 247 x = meth(op) 248 249 if x == None: 250 pc = self.getProgramCounter() 251 x = pc+op.size 252 253 self.setProgramCounter(x)

254 255 ###### Conditional Callbacks ##### 256 257 # NOTE: for ease of validation, these are in the same order as the Jcc 258 # page in the intel manual. However, duplicate conditions (be/na) are 259 # reduced to their earliest (in the manual) form. 260

261 - def cond_a(self):

262 return self.getFlag(EFLAGS_CF) == 0 and self.getFlag(EFLAGS_ZF) == 0

263

264 - def cond_ae(self):

265 return self.getFlag(EFLAGS_CF) == 0

266

267 - def cond_b(self):

268 return self.getFlag(EFLAGS_CF) == 1

269

270 - def cond_be(self):

271 return self.getFlag(EFLAGS_CF) == 1 or self.getFlag(EFLAGS_ZF) == 1

272

273 - def cond_c(self):

274 return self.getFlag(EFLAGS_CF) == 1

275

276 - def cond_ecxz(self):

277 return self.getRegister(REG_ECX) == 0

278

279 - def cond_e(self):

280 return self.getFlag(EFLAGS_ZF) == 1

281

282 - def cond_g(self):

283 return self.getFlag(EFLAGS_ZF) == 0 and (self.getFlag(EFLAGS_SF) == self.getFlag(EFLAGS_OF))

284

285 - def cond_ge(self):

286 return self.getFlag(EFLAGS_SF) == self.getFlag(EFLAGS_OF)

287

288 - def cond_l(self):

289 return self.getFlag(EFLAGS_SF) != self.getFlag(EFLAGS_OF)

290

291 - def cond_le(self):

292 return (self.getFlag(EFLAGS_SF) != self.getFlag(EFLAGS_OF) or 293 (self.getFlag(EFLAGS_ZF) == 1))

294 295 # Some duplicates 296 cond_na = cond_be 297 cond_nae = cond_b 298 cond_nb = cond_ae 299 cond_nbe = cond_a 300 cond_nc = cond_ae 301

302 - def cond_ne(self):

303 return self.getFlag(EFLAGS_ZF) == 0

304 305 # A few more 306 cond_ng = cond_le 307 cond_nge = cond_l 308 cond_nl = cond_ge 309 cond_nle = cond_g 310

311 - def cond_no(self):

312 return self.getFlag(EFLAGS_OF) == 0

313

314 - def cond_np(self):

315 return self.getFlag(EFLAGS_PF) == 0

316

317 - def cond_ns(self):

318 return self.getFlag(EFLAGS_SF) == 0

319 320 cond_nz = cond_ne 321

322 - def cond_o(self):

323 return self.getFlag(EFLAGS_OF) == 1

324

325 - def cond_p(self):

326 return self.getFlag(EFLAGS_PF) == 1

327 328 cond_pe = cond_p 329 cond_po = cond_np 330

331 - def cond_s(self):

332 return self.getFlag(EFLAGS_SF) == 1

333 334 cond_z = cond_e 335 336 # FROM OTHER INSTRUCTIONS 337 cond_nc = cond_ae 338 cond_nl = cond_ge 339 340 ###### End Conditional Callbacks ##### 341

342 - def doPush(self, val):

343 esp = self.getRegister(REG_ESP) 344 esp -= 4 345 self.writeMemValue(esp, val, 4) 346 self.setRegister(REG_ESP, esp)

347

348 - def doPop(self):

349 esp = self.getRegister(REG_ESP) 350 val = self.readMemValue(esp, 4) 351 self.setRegister(REG_ESP, esp+4) 352 return val

353

354 - def integerSubtraction(self, op):

355 """ 356 Do the core of integer subtraction but only *return* the 357 resulting value rather than assigning it. 358 (allows cmp and sub to use the same code) 359 """ 360 # Src op gets sign extended to dst 361 dst = self.getOperValue(op, 0) 362 src = self.getOperValue(op, 1) 363 364 # So we can either do a BUNCH of crazyness with xor and shifting to 365 # get the necissary flags here, *or* we can just do both a signed and 366 # unsigned sub and use the results. 367 dsize = op.opers[0].tsize 368 ssize = op.opers[1].tsize 369 # Sign extend immediates where the sizes don't match 370 if dsize != ssize: 371 src = e_bits.sign_extend(src, ssize, dsize) 372 ssize = dsize 373 return self.intSubBase(src, dst, ssize, dsize)

374

375 - def intSubBase(self, src, dst, ssize, dsize):

376 377 usrc = e_bits.unsigned(src, ssize) 378 udst = e_bits.unsigned(dst, dsize) 379 380 ssrc = e_bits.signed(src, ssize) 381 sdst = e_bits.signed(dst, dsize) 382 383 ures = udst - usrc 384 sres = sdst - ssrc 385 386 #print "dsize/ssize: %d %d" % (dsize, ssize) 387 #print "unsigned: %d %d %d" % (usrc, udst, ures) 388 #print "signed: %d %d %d" % (ssrc, sdst, sres) 389 390 self.setFlag(EFLAGS_OF, e_bits.is_signed_overflow(sres, dsize)) 391 self.setFlag(EFLAGS_AF, e_bits.is_aux_carry(usrc, udst)) 392 self.setFlag(EFLAGS_CF, e_bits.is_unsigned_carry(ures, dsize)) 393 self.setFlag(EFLAGS_SF, e_bits.is_signed(ures, dsize)) 394 self.setFlag(EFLAGS_ZF, not sres) 395 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(ures)) 396 397 return ures

398

399 - def logicalAnd(self, op):

400 dst = self.getOperValue(op, 0) 401 src = self.getOperValue(op, 1) 402 403 dsize = op.opers[0].tsize 404 ssize = op.opers[1].tsize 405 406 # sign-extend an immediate if needed 407 if dsize != ssize: 408 src = e_bits.sign_extend(src, ssize, dsize) 409 ssize = dsize 410 411 # Make sure everybody's on the same bit page. 412 dst = e_bits.unsigned(dst, dsize) 413 src = e_bits.unsigned(src, ssize) 414 415 res = src & dst 416 417 self.setFlag(EFLAGS_AF, 0) # AF is undefined, but it seems like it is zeroed 418 self.setFlag(EFLAGS_OF, 0) 419 self.setFlag(EFLAGS_CF, 0) 420 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, dsize)) 421 self.setFlag(EFLAGS_ZF, not res) 422 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res)) 423 return res

424

425 - def doRepPrefix(self, meth, op):

426 #FIXME check for opcode family valid to rep 427 ret = None 428 ecx = self.getRegister(REG_ECX) 429 while ecx != 0: 430 ret = meth(op) 431 ecx -= 1 432 self.setRegister(REG_ECX, 0) 433 return ret

434

435 - def doRepzPrefix(self, meth, op):

436 pass

437 438 # Beginning of Instruction methods 439

440 - def i_adc(self, op):

441 dst = self.getOperValue(op, 0) 442 src = self.getOperValue(op, 1) 443 444 cf = 0 445 if self.getFlag(EFLAGS_CF): 446 cf = 1 447 448 dstsize = op.opers[0].tsize 449 srcsize = op.opers[1].tsize 450 451 if (isinstance(op.opers[1], i386ImmOper) and 452 srcsize < dstsize): 453 src = e_bits.sign_extend(src, srcsize, dstsize) 454 srcsize = dstsize 455 456 #FIXME perhaps unify the add/adc flags/arith code 457 res = dst + src + cf 458 459 tsize = op.opers[0].tsize 460 461 self.setFlag(EFLAGS_CF, e_bits.is_unsigned_carry(res, tsize)) 462 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res)) 463 self.setFlag(EFLAGS_AF, e_bits.is_aux_carry(src, dst)) 464 self.setFlag(EFLAGS_ZF, not res) 465 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, tsize)) 466 self.setFlag(EFLAGS_OF, e_bits.is_signed_overflow(res, tsize)) 467 468 self.setOperValue(op, 0, res)

469

470 - def i_add(self, op):

471 dst = self.getOperValue(op, 0) 472 src = self.getOperValue(op, 1) 473 474 dsize = op.opers[0].tsize 475 ssize = op.opers[1].tsize 476 477 if dsize > ssize: 478 src = e_bits.sign_extend(src, ssize, dsize) 479 ssize = dsize 480 481 udst = e_bits.unsigned(dst, dsize) 482 usrc = e_bits.unsigned(src, ssize) 483 sdst = e_bits.signed(dst, dsize) 484 ssrc = e_bits.signed(src, ssize) 485 486 ures = udst + usrc 487 sres = sdst + ssrc 488 489 self.setFlag(EFLAGS_CF, e_bits.is_unsigned_carry(ures, dsize)) 490 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(ures)) 491 self.setFlag(EFLAGS_AF, e_bits.is_aux_carry(src, dst)) 492 self.setFlag(EFLAGS_ZF, not ures) 493 self.setFlag(EFLAGS_SF, e_bits.is_signed(ures, dsize)) 494 self.setFlag(EFLAGS_OF, e_bits.is_signed_overflow(sres, dsize)) 495 496 self.setOperValue(op, 0, ures)

497

498 - def i_and(self, op):

499 #FIXME 24 and 25 opcodes should *not* get sign-extended. 500 res = self.logicalAnd(op) 501 self.setOperValue(op, 0, res)

502

503 - def i_arpl(self, op):

504 v1 = self.getOperValue(op, 0) 505 v2 = self.getOperValue(op, 1) 506 507 # Mask off the rpl 508 r1 = v1 & 3 509 r2 = v2 & 3 510 511 if r1 < r2: # If dest rpl < src rpl 512 self.setFlag(EFLAGS_ZF, True) 513 # Bump 2 bits off the bottom and add r2 514 self.setOperValue(op, 0, ((v1 >> 2) << 2) | r2) 515 else: 516 self.setFlag(EFLAGS_ZF, False)

517

518 - def i_bswap(self, op):

519 val = self.getOperValue(op, 0) 520 tsize = op.opers[0].tsize 521 self.setOperValue(op, 0, e_bits.byteswap(val, tsize))

522

523 - def i_bsr(self, op):

524 val = self.getOperValue(op, 0) 525 526 if val == 0: 527 # If the src is 0, set ZF and get out 528 self.setFlag(EFLAGS_ZF, True) 529 return 530 531 self.setFlag(EFLAGS_ZF, False) 532 533 tsize = op.opers[0].tsize 534 rmax = (tsize*8) - 1 535 while rmax >= 0: 536 if val & (1<<rmax): 537 self.setOperValue(op, 1, rmax) 538 return 539 rmax -= 1

540

541 - def doBitTest(self, op):

542 val = self.getOperValue(op, 0) 543 shift = self.getOperValue(op, 1) 544 mask = 1 << shift 545 self.setFlag(EFLAGS_CF, val & mask) 546 # Return the source and mask for btc/btr 547 return val,mask

548

549 - def i_bt(self, op):

550 self.doBitTest(op)

551

552 - def i_btc(self, op):

553 # bit test and toggle bit in source 554 val, mask = self.doBitTest(op) 555 self.setOperValue(op, 0, val ^ mask)

556

557 - def i_btr(self, op):

558 # bit test (and clear in the source) 559 val, mask = self.doBitTest(op) 560 mask = e_bits.unsigned(~val, op.opers[0].tsize) 561 self.setOperValue(op, 0, val & mask)

562

563 - def i_bts(self, op):

564 # bit test (and set in the source) 565 val, mask = self.doBitTest(op) 566 self.setOperValue(op, 0, val | mask)

567

568 - def i_call(self, op):

569 eip = self.getProgramCounter() 570 saved = eip + op.size 571 self.doPush(saved) 572 573 return self.getOperValue(op, 0)

574

575 - def i_clc(self, op):

576 self.setFlag(EFLAGS_CF, False)

577

578 - def i_cld(self, op):

579 self.setFlag(EFLAGS_DF, False)

580

581 - def i_cli(self, op):

582 self.setFlag(EFLAGS_IF, False)

583 584 # We include all the possible CMOVcc names just in case somebody 585 # gets hinkey with the disassembler.

586 - def i_cmova(self, op):

587 if self.cond_a(): return self.i_mov(op)

588 - def i_cmovae(self, op):

589 if self.cond_ae(): return self.i_mov(op)

590 - def i_cmovb(self, op):

591 if self.cond_b(): return self.i_mov(op)

592 - def i_cmovbe(self, op):

593 if self.cond_be(): return self.i_mov(op)

594 - def i_cmovc(self, op):

595 if self.cond_c(): return self.i_mov(op)

596 - def i_cmovecxz(self, op):

597 if self.cond_ecxz(): return self.i_mov(op)

598 - def i_cmove(self, op):

599 if self.cond_e(): return self.i_mov(op)

600 - def i_cmovg(self, op):

601 if self.cond_g(): return self.i_mov(op)

602 - def i_cmovge(self, op):

603 if self.cond_ge(): return self.i_mov(op)

604 - def i_cmovl(self, op):

605 if self.cond_l(): return self.i_mov(op)

606 - def i_cmovle(self, op):

607 if self.cond_le(): return self.i_mov(op)

608 i_cmovna = i_cmovbe 609 i_cmovnae = i_cmovb 610 i_cmovnb = i_cmovae 611 i_cmovnbe = i_cmova 612 i_cmovnc = i_cmovae

613 - def i_cmovne(self, op):

614 if self.cond_ne(): return self.i_mov(op)

615 i_cmovng = i_cmovle 616 i_cmovnge = i_cmovl 617 i_cmovnl = i_cmovge 618 i_cmovnle = i_cmovg

619 - def i_cmovno(self, op):

620 if self.cond_no(): return self.i_mov(op)

621 - def i_cmovnp(self, op):

622 if self.cond_np(): return self.i_mov(op)

623 - def i_cmovns(self, op):

624 if self.cond_ns(): return self.i_mov(op)

625 i_cmovnz = i_cmovne

626 - def i_cmovo(self, op):

627 if self.cond_o(): return self.i_mov(op)

628 - def i_cmovp(self, op):

629 if self.cond_p(): return self.i_mov(op)

630 i_cmovpe = i_cmovp 631 i_cmovpo = i_cmovnp

632 - def i_cmovs(self, op):

633 if self.cond_s(): return self.i_mov(op)

634 i_cmovz = i_cmove 635

636 - def i_cmp(self, op):

637 self.integerSubtraction(op)

638

639 - def doCmps(self, width):

640 esi = self.getRegister(REG_ESI) 641 edi = self.getRegister(REG_EDI) 642 643 644 # FIXME che 645 sval = self.readMemValue(esi, width) 646 dval = self.readMemValue(edi, width) 647 648 self.intSubBase(sval, dval, width, width) 649 650 if self.getFlag(EFLAGS_ZF): 651 if self.getFlag(EFLAGS_DF): # decrement 652 esi -= width 653 edi -= width 654 else: 655 esi += width 656 edi += width 657 self.setRegister(REG_ESI, esi) 658 self.setRegister(REG_EDI, edi)

659

660 - def i_cmpsb(self, op):

661 self.doCmps(1)

662

663 - def i_cmpsd(self, op):

664 """ 665 Compare the dword pointed at by ds:esi to ds:edi. 666 (if equal, update esi/edi by one acording to DF) 667 """ 668 width = 4 669 if op.prefixes & PREFIX_OP_SIZE: 670 width = 2 671 672 self.doCmps(width)

673

674 - def i_cmpxchg(self, op):

675 tsize = op.opers[0].tsize 676 if tsize == 4: 677 areg = REG_EAX 678 elif tsize == 1: 679 areg = REG_AL 680 else: 681 areg = REG_AX 682 683 aval = self.getRegister(areg) 684 tval = self.getOperValue(op, 0) 685 vval = self.getOperValue(op, 1) 686 687 #FIXME eflags... is this supposed to be a real cmp? 688 if aval == tval: 689 self.setFlag(EFLAGS_ZF, True) 690 self.setOperValue(op, 0, vval) 691 else: 692 self.setFlag(EFLAGS_ZF, False) 693 self.setRegister(areg, tval)

694

695 - def twoRegCompound(self, topreg, botreg, size):

696 """ 697 Build a compound value where the value of the top reg is shifted and 698 or'd with the value of the bot reg ( assuming they are size 699 bytes in length). The return is size * 2 wide (and unsigned). 700 """ 701 top = e_bits.unsigned(self.getRegister(topreg), size) 702 bot = e_bits.unsigned(self.getRegister(botreg), size) 703 704 return ((top << (size *8)) | bot)

705

706 - def regsFromCompound(self, val, size):

707 top = e_bits.unsigned(val >> (size * 8), size) 708 bot = e_bits.unsigned(val, size) 709 return (top, bot)

710

711 - def i_cmpxch8b(self, op):

712 size = 4 713 dsize = 8 714 if op.prefixes & PREFIX_OP_SIZE: 715 size = 2 716 dsize = 4 717 718 bignum = self.twoRegCompound(REG_EDX, REG_EAX, size) 719 testnum = self.getOperValue(op, 0) 720 if bignum == testnum: 721 self.setFlag(EFLAGS_ZF, 1) 722 resval = self.twoRegCompound(REG_ECX, REG_EBX, size) 723 self.setOperValue(op, 0, resval) 724 else: 725 self.setFlag(EFLAGS_ZF, 0) 726 edx,eax = self.regsFromCompound(testnum, dsize) 727 self.setRegister(REG_EDX, edx) 728 self.setRegister(REG_EAX, eax)

729

730 - def i_cdq(self, op):

731 return self.i_cwd(op)

732

733 - def i_cpuid(self, op):

734 eax = self.getRegister(REG_EAX) 735 print "FIXME: cpuid() returns NONSENSE (eax:0x%.8x)" % eax 736 self.setRegister(REG_EAX, 0) 737 self.setRegister(REG_EBX, 0) 738 self.setRegister(REG_ECX, 0) 739 self.setRegister(REG_EDX, 0)

740

741 - def i_cwd(self, op):

742 #FIXME handle 16 bit variant 743 eax = self.getRegister(REG_EAX) 744 745 if e_bits.is_signed(eax, 4): 746 self.setRegister(REG_EDX, 0xffffffff) 747 else: 748 self.setRegister(REG_EDX, 0)

749

750 - def i_dec(self, op):

751 val = self.getOperValue(op, 0) 752 if val == None: 753 self.undefFlags() 754 return 755 val -= 1 756 self.setOperValue(op, 0, val) 757 #FIXME change over to integer subtraction 758 759 self.setFlag(EFLAGS_OF, 0) #FIXME OF 760 self.setFlag(EFLAGS_SF, e_bits.is_signed(val, op.opers[0].tsize)) 761 self.setFlag(EFLAGS_ZF, not val) 762 self.setFlag(EFLAGS_AF, 0) #FIXME AF... 763 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(val))

764

765 - def i_div(self, op):

766 767 #FIXME this is probably broke 768 oper = op.opers[0] 769 val = self.getOperValue(op, 1) 770 if val == 0: raise envi.DivideByZero(self) 771 772 if oper.tsize == 1: 773 ax = self.getRegister(REG_AX) 774 quot = ax / val 775 rem = ax % val 776 if quot > 255: 777 #FIXME stuff 778 print "FIXME: division exception" 779 self.setRegister(REG_EAX, (quot << 8) + rem) 780 781 elif oper.tsize == 4: 782 #FIXME 16 bit over-ride 783 eax = self.getRegister(REG_EAX) 784 edx = self.getRegister(REG_EDX) 785 tot = (edx << 32) + eax 786 quot = tot / val 787 rem = tot % val 788 789 if quot > 0xffffffff: 790 print "FIXME: division exception" 791 792 self.setRegister(REG_EAX, quot) 793 self.setRegister(REG_EDX, rem) 794 795 else: 796 raise envi.UnsupportedInstruction(self, op)

797

798 - def i_enter(self, op):

799 locsize = self.getOperValue(op, 0) 800 depth = self.getOperValue(op, 1) 801 if depth != 0: 802 raise envi.UnsupportedInstruction(self, op) 803 804 esp = self.getRegister(REG_ESP) 805 ebp = self.getRegister(REG_EBP) 806 807 esp -= 4 # Room for the base pointer 808 809 self.writeMemValue(esp, ebp, 4) 810 self.setRegister(REG_EBP, esp) 811 esp -= locsize 812 self.setRegister(REG_ESP, esp)

813 814 # FIXME a whole bunch of float instructions whose 815 # processing is essentially ignored:

816 - def i_fldz(self, op):

817 pass

818

819 - def i_fild(self, op):

820 pass

821

822 - def i_fstp(self, op):

823 pass

824

825 - def i_idiv(self, op):

826 #FIXME this needs emulation testing! 827 tsize = op.opers[0].tsize 828 if tsize == 1: 829 ax = self.getRegister(REG_AX) 830 ax = e_bits.signed(ax, 2) 831 d = self.getOperValue(op, 0) 832 d = e_bits.signed(d, 1) 833 if d == 0: raise envi.DivideByZero(self) 834 q = ax / d 835 r = ax % d 836 res = ((r & 0xff) << 8) | (q & 0xff) 837 self.setRegister(REG_AX, res) 838 839 elif tsize == 2: 840 val = self.twoRegCompound(REG_DX, REG_AX, 2) 841 val = e_bits.signed(val, 4) 842 d = self.getOperValue(op, 0) 843 d = e_bits.signed(d, 2) 844 if d == 0: raise envi.DivideByZero(self) 845 q = val / d 846 r = val % d 847 848 self.setRegister(REG_AX, q) 849 self.setRegister(REG_DX, r) 850 851 elif tsize == 4: 852 val = self.twoRegCompound(REG_EDX, REG_EAX, 4) 853 val = e_bits.signed(val, 8) 854 d = self.getOperValue(op, 0) 855 d = e_bits.signed(d, 4) 856 if d == 0: raise envi.DivideByZero(self) 857 q = val / d 858 r = val % d 859 860 self.setRegister(REG_EAX, q) 861 self.setRegister(REG_EDX, r) 862 863 else: 864 raise envi.UnsupportedInstruction(self, op)

865

866 - def i_imul(self, op):

867 #FIXME eflags 868 # FIXME imul bugs 869 ocount = len(op.opers) 870 if ocount == 2: 871 dst = self.getOperValue(op, 0) 872 src = self.getOperValue(op, 1) 873 dsize = op.opers[0].tsize 874 ssize = op.opers[1].tsize 875 876 # FIXME all these are taken care of in disasm now... 877 if dsize > ssize: 878 src = e_bits.sign_extend(src, ssize, dsize) 879 ssize = dsize 880 881 res = dst * src 882 883 sof = e_bits.is_unsigned_carry(res, dsize) 884 self.setFlag(EFLAGS_CF, sof) 885 self.setFlag(EFLAGS_OF, sof) 886 887 self.setOperValue(op, 0, res) 888 889 elif ocount == 3: 890 dst = self.getOperValue(op, 0) 891 src1 = self.getOperValue(op, 1) 892 src2 = self.getOperValue(op, 2) 893 894 dsize = op.opers[0].tsize 895 ssize1 = op.opers[1].tsize 896 ssize2 = op.opers[2].tsize 897 898 if dsize > ssize2: # Only the last operand may be shorter imm 899 src2 = e_bits.sign_extend(src2, ssize2, dsize) 900 ssize2 = dsize 901 902 res = src1 * src2 903 904 sof = e_bits.is_unsigned_carry(res, dsize) 905 self.setFlag(EFLAGS_CF, sof) 906 self.setFlag(EFLAGS_OF, sof) 907 908 self.setOperValue(op, 0, res) 909 910 else: 911 raise envi.UnsupportedInstruction(self, op)

912

913 - def i_in(self, op):

914 raise envi.UnsupportedInstruction(self, op)

915

916 - def i_inc(self, op):

917 size = op.opers[0].tsize 918 val = self.getOperValue(op, 0) 919 920 sval = e_bits.signed(val, size) 921 sval += 1 922 923 self.setOperValue(op, 0, sval) 924 925 # Another arithmetic op where doing signed and unsigned is easier ;) 926 927 self.setFlag(EFLAGS_OF, e_bits.is_signed_overflow(sval, size)) 928 self.setFlag(EFLAGS_SF, e_bits.is_signed(sval, size)) 929 self.setFlag(EFLAGS_ZF, not sval) 930 self.setFlag(EFLAGS_AF, (sval & 0xf == 0)) 931 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(sval))

932

933 - def i_int(self, op):

934 raise envi.UnsupportedInstruction(self, op)

935

936 - def i_int3(self, op):

937 raise envi.BreakpointHit(self)

938

939 - def i_lea(self, op):

940 base = self.getOperAddr(op, 1) 941 self.setOperValue(op, 0, base)

942

943 - def decCounter(self):

944 """ 945 A helper to decrement and return the counter 946 """ 947 ecx = self.getRegister(REG_ECX) 948 ecx -= 1 949 self.setRegister(REG_ECX, ecx) 950 return ecx

951

952 - def i_lodsb(self, op):

953 esi = self.getRegister(REG_ESI) 954 newal = self.readMemoryFormat(esi, "<B")[0] 955 self.setRegister(REG_AL, newal) 956 if not self.getFlag(EFLAGS_DF): 957 esi += 1 958 else: 959 esi -= 1 960 self.setRegister(REG_ESI, esi)

961

962 - def i_lodsd(self, op):

963 esi = self.getRegister(REG_ESI) 964 neweax = self.readMemoryFormat(esi, "<L")[0] 965 #FIXME figgure out ADDR_SIZE vs OP_SIZE and which is which 966 self.setRegister(REG_EAX, neweax) 967 if not self.getFlag(EFLAGS_DF): 968 esi += 4 969 else: 970 esi -= 4 971 self.setRegister(REG_ESI, esi)

972

973 - def i_loop(self, op):

974 if self.decCounter() != 0: 975 return self.getOperValue(op, 0)

976

977 - def i_loopz(self, op):

978 if self.decCounter() != 0 and self.cond_e(): 979 return self.getOperValue(op, 0)

980

981 - def i_loopnz(self, op):

982 if self.decCounter() != 0 and self.cond_ne(): 983 return self.getOperValue(op, 0)

984 985 i_loope = i_loopz 986 i_loopne = i_loopnz 987

988 - def i_leave(self, op):

989 ebp = self.getRegister(REG_EBP) 990 self.setRegister(REG_ESP, ebp) 991 self.setRegister(REG_EBP, self.doPop())

992

993 - def i_mov(self, op):

994 val = self.getOperValue(op, 1) 995 self.setOperValue(op, 0, val)

996

997 - def i_movq(self, op):

998 val = self.getOperValue(op, 1) 999 self.setOperValue(op, 0, val)

1000

1001 - def i_movsb(self, op):

1002 esi = self.getRegister(REG_ESI) 1003 edi = self.getRegister(REG_EDI) 1004 bytes = self.readMemory(esi, 1) 1005 self.writeMemory(edi, bytes) 1006 if self.getFlag(EFLAGS_DF): 1007 self.setRegister(REG_ESI, esi-1) 1008 self.setRegister(REG_EDI, edi-1) 1009 else: 1010 self.setRegister(REG_ESI, esi+1) 1011 self.setRegister(REG_EDI, edi+1)

1012

1013 - def i_movsd(self, op):

1014 esi = self.getRegister(REG_ESI) 1015 edi = self.getRegister(REG_EDI) 1016 bytes = self.readMemory(esi, 4) 1017 self.writeMemory(edi, bytes) 1018 if self.getFlag(EFLAGS_DF): 1019 self.setRegister(REG_ESI, esi-4) 1020 self.setRegister(REG_EDI, edi-4) 1021 else: 1022 self.setRegister(REG_ESI, esi+4) 1023 self.setRegister(REG_EDI, edi+4)

1024

1025 - def i_movsx(self, op):

1026 osize = op.opers[1].tsize 1027 nsize = op.opers[0].tsize 1028 val = self.getOperValue(op, 1) 1029 val = e_bits.sign_extend(val, osize, nsize) 1030 self.setOperValue(op, 0, val)

1031

1032 - def i_movzx(self, op):

1033 val = self.getOperValue(op, 1) 1034 self.setOperValue(op, 0, val)

1035

1036 - def i_mul(self, op):

1037 #FIXME make sure these work right 1038 tsize = op.opers[0].tsize 1039 1040 val = self.getOperValue(op, 0) 1041 1042 # Return al/ax/eax as needed... 1043 a = self._emu_getGpReg(GPR_A, tsize) 1044 1045 res = a * val 1046 1047 if tsize == 1: 1048 self.setRegister(REG_AX, res) 1049 1050 elif tsize == 2: 1051 d,a = self.regsFromCompound(res, tsize) 1052 self._emu_setGpReg(GPR_A, a, tsize) 1053 self._emu_setGpReg(GPR_D, d, tsize) 1054 1055 # If the high order stuff was used, set CF/OF 1056 if res >> (tsize * 8): 1057 self.setFlag(EFLAGS_CF, True) 1058 self.setFlag(EFLAGS_OF, True) 1059 else: 1060 self.setFlag(EFLAGS_CF, False) 1061 self.setFlag(EFLAGS_OF, False)

1062

1063 - def _emu_setGpReg(self, reg, val, tsize):

1064 """ 1065 Automagically map all general purpose register accesses 1066 to their tsize equiv. Helps clean up a lot of code 1067 (and makes a nice place for AMD64 to hook ;) ) 1068 """ 1069 if tsize == 1: 1070 reg += 0x00080000 1071 elif tsize == 2: 1072 reg += 0x00100000 1073 self.setRegister(reg, value)

1074

1075 - def _emu_getGpReg(self, reg, tsize):

1076 """ 1077 Automagically map all general purpose register accesses 1078 to their tsize equiv. Helps clean up a lot of code 1079 (and makes a nice place for AMD64 to hook ;) ) 1080 """ 1081 if tsize == 1: 1082 reg += 0x00080000 1083 elif tsize == 2: 1084 reg += 0x00100000 1085 return self.getRegister(reg)

1086

1087 - def i_neg(self, op):

1088 tsize = op.opers[0].tsize 1089 val = self.getOperValue(op, 0) 1090 res = 0 - val 1091 self.setOperValue(op, 0, res) 1092 1093 self.setFlag(EFLAGS_CF, val != 0) 1094 self.setFlag(EFLAGS_ZF, not res) 1095 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, tsize)) 1096 #FIXME how does neg cause/not cause a carry? 1097 self.setFlag(EFLAGS_AF, 0) # FIXME EFLAGS_AF

1098

1099 - def i_nop(self, op):

1100 pass

1101

1102 - def i_not(self, op):

1103 val = self.getOperValue(op, 0) 1104 val ^= e_bits.u_maxes[op.opers[0].tsize] 1105 self.setOperValue(op, 0, val)

1106

1107 - def i_or(self, op):

1108 dst = self.getOperValue(op, 0) 1109 dsize = op.opers[0].tsize 1110 src = self.getOperValue(op, 1) 1111 ssize = op.opers[1].tsize 1112 1113 if dsize != ssize: 1114 src = e_bits.sign_extend(src, ssize, dsize) 1115 ssize = dsize 1116 1117 res = dst | src 1118 1119 self.setOperValue(op, 0, res) 1120 1121 self.setFlag(EFLAGS_OF, 0) 1122 self.setFlag(EFLAGS_CF, 0) 1123 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, dsize)) 1124 self.setFlag(EFLAGS_ZF, not res) 1125 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res))

1126

1127 - def i_pop(self, op):

1128 val = self.doPop() 1129 self.setOperValue(op, 0, val)

1130

1131 - def i_popad(self, op):

1132 #FIXME 16 bit? 1133 self.setRegister(REG_EDI, self.doPop()) 1134 self.setRegister(REG_ESI, self.doPop()) 1135 self.setRegister(REG_EBP, self.doPop()) 1136 self.doPop() # skip one 1137 self.setRegister(REG_EBX, self.doPop()) 1138 self.setRegister(REG_EDX, self.doPop()) 1139 self.setRegister(REG_ECX, self.doPop()) 1140 self.setRegister(REG_EAX, self.doPop())

1141

1142 - def i_popfd(self, op):

1143 eflags = self.doPop() 1144 self.setRegister(REG_EFLAGS, eflags)

1145

1146 - def i_push(self, op):

1147 val = self.getOperValue(op, 0) 1148 if isinstance(op.opers[0], i386ImmOper): 1149 val = e_bits.sign_extend(val, op.opers[0].tsize, 4) #FIXME 64bit 1150 self.doPush(val)

1151

1152 - def i_pushad(self, op):

1153 tmp = self.getRegister(REG_ESP) 1154 self.doPush(self.getRegister(REG_EAX)) 1155 self.doPush(self.getRegister(REG_ECX)) 1156 self.doPush(self.getRegister(REG_EDX)) 1157 self.doPush(self.getRegister(REG_EBX)) 1158 self.doPush(tmp) 1159 self.doPush(self.getRegister(REG_EBP)) 1160 self.doPush(self.getRegister(REG_ESI)) 1161 self.doPush(self.getRegister(REG_EDI))

1162

1163 - def i_pushfd(self, op):

1164 eflags = self.getRegister(REG_EFLAGS) 1165 self.doPush(eflags)

1166

1167 - def i_jmp(self, op):

1168 return self.getOperValue(op, 0)

1169 1170 # We include all the possible Jcc names just in case somebody 1171 # gets hinkey with the disassembler.

1172 - def i_ja(self, op):

1173 if self.cond_a(): return self.getOperValue(op, 0)

1174 - def i_jae(self, op):

1175 if self.cond_ae(): return self.getOperValue(op, 0)

1176 - def i_jb(self, op):

1177 if self.cond_b(): return self.getOperValue(op, 0)

1178 - def i_jbe(self, op):

1179 if self.cond_be(): return self.getOperValue(op, 0)

1180 - def i_jc(self, op):

1181 if self.cond_c(): return self.getOperValue(op, 0)

1182 - def i_jecxz(self, op):

1183 if self.cond_ecxz(): return self.getOperValue(op, 0)

1184 - def i_je(self, op):

1185 if self.cond_e(): return self.getOperValue(op, 0)

1186 - def i_jg(self, op):

1187 if self.cond_g(): return self.getOperValue(op, 0)

1188 - def i_jge(self, op):

1189 if self.cond_ge(): return self.getOperValue(op, 0)

1190 - def i_jl(self, op):

1191 if self.cond_l(): return self.getOperValue(op, 0)

1192 - def i_jle(self, op):

1193 if self.cond_le(): return self.getOperValue(op, 0)

1194 i_jna = i_jbe 1195 i_jnae = i_jb 1196 i_jnb = i_jae 1197 i_jnbe = i_ja 1198 i_jnc = i_jae

1199 - def i_jne(self, op):

1200 if self.cond_ne(): return self.getOperValue(op, 0)

1201 i_jng = i_jle 1202 i_jnge = i_jl 1203 i_jnl = i_jge 1204 i_jnle = i_jg

1205 - def i_jno(self, op):

1206 if self.cond_no(): return self.getOperValue(op, 0)

1207 - def i_jnp(self, op):

1208 if self.cond_np(): return self.getOperValue(op, 0)

1209 - def i_jns(self, op):

1210 if self.cond_ns(): return self.getOperValue(op, 0)

1211 i_jnz = i_jne

1212 - def i_jo(self, op):

1213 if self.cond_o(): return self.getOperValue(op, 0)

1214 - def i_jp(self, op):

1215 if self.cond_p(): return self.getOperValue(op, 0)

1216 i_jpe = i_jp 1217 i_jpo = i_jnp

1218 - def i_js(self, op):

1219 if self.cond_s(): return self.getOperValue(op, 0)

1220 i_jz = i_je 1221

1222 - def i_rcl(self, op):

1223 dsize = op.opers[0].tsize 1224 dst = self.getOperValue(op, 0) 1225 src = self.getOperValue(op, 1) 1226 1227 src = src & 0x1f 1228 1229 # Put that carry bit up there. 1230 if self.getFlag(EFLAGS_CF): 1231 dst = dst | (1 << (8 * dsize)) 1232 1233 # Add one to account for carry 1234 x = ((8*dsize) - src) + 1 1235 #FIXME is this the one that can end up negative? 1236 1237 res = (dst << src) | (dst >> x) 1238 cf = (res >> (8*dsize)) & 1 1239 res = e_bits.unsigned(res, dsize) 1240 1241 self.setFlag(EFLAGS_CF, cf) 1242 if src == 1: 1243 m1 = e_bits.msb(res, dsize) 1244 m2 = e_bits.msb(res << 1, dsize) 1245 self.setFlag(EFLAGS_OF, m1 ^ m2) 1246 1247 self.setOperValue(op, 0, res)

1248

1249 - def i_rcr(self, op):

1250 dsize = op.opers[0].tsize 1251 dst = self.getOperValue(op, 0) 1252 src = self.getOperValue(op, 1) 1253 1254 src = src & 0x1f 1255 # Put that carry bit up there. 1256 if self.getFlag(EFLAGS_CF): 1257 dst = dst | (1 << (8 * dsize)) 1258 1259 # Add one to account for carry 1260 x = ((8*dsize) - src) + 1 1261 1262 res = (dst >> src) | (dst << x) 1263 cf = (res >> (8*dsize)) & 1 1264 res = e_bits.unsigned(res, dsize) 1265 1266 self.setFlag(EFLAGS_CF, cf) 1267 if src == 1: 1268 m1 = e_bits.msb(res, dsize) 1269 m2 = e_bits.msb(res << 1, dsize) 1270 self.setFlag(EFLAGS_OF, m1 ^ m2) 1271 1272 self.setOperValue(op, 0, res)

1273

1274 - def i_rdtsc(self, op):

1275 """ 1276 Read the clock cycle counter into edx:eax 1277 """ 1278 self.setRegister(REG_EDX, 0) 1279 self.setRegister(REG_EAX, 0x414141)

1280

1281 - def i_rol(self, op):

1282 dstSize = op.opers[0].tsize 1283 count = self.getOperValue(op, 1) 1284 tempCount = shiftMask(count, dstSize) 1285 1286 if tempCount > 0: # Yeah, i know...weird. See the intel manual 1287 while tempCount: 1288 val = self.getOperValue(op, 0) 1289 tempCf = e_bits.msb(val, dstSize) 1290 self.setOperValue(op, 0, (val * 2) + tempCf) 1291 tempCount -= 1 1292 val = self.getOperValue(op, 0) 1293 self.setFlag(EFLAGS_CF, e_bits.lsb(val)) 1294 if count == 1: 1295 val = self.getOperValue(op, 0) 1296 cf = self.getFlag(EFLAGS_CF) 1297 self.setFlag(EFLAGS_OF, e_bits.msb(val, dstSize) ^ cf) 1298 else: 1299 self.setFlag(EFLAGS_OF, False)

1300

1301 - def i_ror(self, op):

1302 dstSize = op.opers[0].tsize 1303 count = self.getOperValue(op, 1) 1304 tempCount = shiftMask(count, dstSize) 1305 1306 if tempCount > 0: # Yeah, i know...weird. See the intel manual 1307 while tempCount: 1308 val = self.getOperValue(op, 0) 1309 tempCf = e_bits.lsb(val) 1310 self.setOperValue(op, 0, (val / 2) + (tempCf * (2 ** dstSize))) 1311 tempCount -= 1 1312 val = self.getOperValue(op, 0) 1313 self.setFlag(EFLAGS_CF, e_bits.msb(val, dstSize)) 1314 if count == 1: 1315 val = self.getOperValue(op, 0) 1316 cf = self.getFlag(EFLAGS_CF) 1317 # FIXME: This may be broke...the manual is kinda flaky here 1318 self.setFlag(EFLAGS_OF, e_bits.msb(val, dstSize) ^ (e_bits.msb(val, dstSize) - 1)) 1319 else: 1320 self.setFlag(EFLAGS_OF, False)

1321

1322 - def i_ret(self, op):

1323 ret = self.doPop() 1324 if len(op.opers): 1325 esp = self.getRegister(REG_ESP) 1326 ival = self.getOperValue(op, 0) 1327 self.setRegister(REG_ESP, esp+ival) 1328 return ret

1329

1330 - def i_sal(self, op):

1331 dsize = op.opers[0].tsize 1332 dst = self.getOperValue(op, 0) 1333 src = self.getOperValue(op, 1) 1334 1335 src = src & 0x1f 1336 1337 # According to intel manual, if src == 0 eflags are not changed 1338 if src == 0: 1339 return 1340 1341 res = dst << src 1342 cf = (res >> 8*dsize) & 1 1343 1344 res = e_bits.unsigned(res, dsize) 1345 1346 self.setFlag(EFLAGS_CF, cf) 1347 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, dsize)) 1348 self.setFlag(EFLAGS_ZF, not res) 1349 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res)) 1350 if src == 1: 1351 self.setFlag(EFLAGS_OF, not e_bits.msb(res, dsize) == cf) 1352 else: 1353 self.setFlag(EFLAGS_OF, 0) # Undefined, but zero'd on core2 duo 1354 1355 self.setOperValue(op, 0, res)

1356

1357 - def i_sar(self, op):

1358 dsize = op.opers[0].tsize 1359 dst = self.getOperValue(op, 0) 1360 src = self.getOperValue(op, 1) 1361 1362 src = src & 0x1f 1363 1364 # According to intel manual, if src == 0 eflags are not changed 1365 if src == 0: 1366 return 1367 1368 signed = e_bits.msb(dst, dsize) 1369 1370 res = dst >> src 1371 cf = (dst >> (src-1)) & 1 1372 1373 # If it was signed, we need to fill in all those bits we 1374 # shifted off with ones. 1375 if signed: 1376 x = (8*dsize) - src 1377 umax = e_bits.u_maxes[dsize] 1378 res |= (umax >> x) << x 1379 1380 res = e_bits.unsigned(res, dsize) 1381 1382 self.setFlag(EFLAGS_CF, cf) 1383 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, dsize)) 1384 self.setFlag(EFLAGS_ZF, not res) 1385 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res)) 1386 if src == 1: 1387 self.setFlag(EFLAGS_OF, False) 1388 else: 1389 self.setFlag(EFLAGS_OF, 0) # Undefined, but zero'd on core2 duo 1390 1391 self.setOperValue(op, 0, res)

1392

1393 - def i_shl(self, op):

1394 return self.i_sal(op)

1395

1396 - def i_shr(self, op):

1397 dsize = op.opers[0].tsize 1398 dst = self.getOperValue(op, 0) 1399 src = self.getOperValue(op, 1) 1400 1401 src = src & 0x1f 1402 1403 # According to intel manual, if src == 0 eflags are not changed 1404 if src == 0: 1405 return 1406 1407 res = dst >> src 1408 cf = (dst >> (src-1)) & 1 1409 1410 res = e_bits.unsigned(res, dsize) 1411 1412 self.setFlag(EFLAGS_CF, cf) 1413 self.setFlag(EFLAGS_SF, e_bits.is_signed(res, dsize)) 1414 self.setFlag(EFLAGS_ZF, not res) 1415 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(res)) 1416 if src == 1: 1417 self.setFlag(EFLAGS_OF, False) 1418 else: 1419 self.setFlag(EFLAGS_OF, 0) # Undefined, but zero'd on core2 duo 1420 1421 self.setOperValue(op, 0, res)

1422

1423 - def i_shrd(self, op):

1424 dsize = op.opers[0].tsize 1425 bsize = dsize * 8 1426 dst = self.getOperValue(op, 0) 1427 src = self.getOperValue(op, 1) 1428 cnt = self.getOperValue(op, 2) 1429 1430 cnt &= 0x1f # Reg gets masked down 1431 1432 if cnt == 0: 1433 return 1434 1435 if cnt > bsize: 1436 # result is "undfined" 1437 return 1438 1439 res = dst >> cnt 1440 res |= src << (bsize - cnt) 1441 1442 # We now have the bits masked into res, but it has become 1443 # wider than the original operand. 1444 1445 # Ret is masked down to size 1446 ret = e_bits.unsigned(res, dsize) 1447 1448 if cnt == 1: # Set OF on sign change 1449 dsign = e_bits.is_signed(dst, dsize) 1450 rsign = e_bits.is_signed(ret, dsize) 1451 self.setFlag(EFLAGS_OF, dsign != rsign) 1452 1453 # set carry to last shifted bit 1454 self.setFlag(EFLAGS_CF, (res << bsize) & 1) 1455 self.setFlag(EFLAGS_SF, e_bits.is_signed(ret, dsize)) 1456 self.setFlag(EFLAGS_ZF, not ret) 1457 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(ret)) 1458 1459 self.setOperValue(op, 0, ret)

1460

1461 - def i_shld(self, op):

1462 dsize = op.opers[0].tsize 1463 bsize = dsize * 8 1464 dst = self.getOperValue(op, 0) 1465 src = self.getOperValue(op, 1) 1466 cnt = self.getOperValue(op, 2) 1467 1468 cnt &= 0x1f # Reg gets masked down 1469 1470 if cnt == 0: 1471 return 1472 1473 if cnt > bsize: 1474 return 1475 1476 res = dst << cnt 1477 res |= src >> (bsize - cnt) 1478 ret = e_bits.unsigned(res, dsize) 1479 1480 if cnt == 1: # Set OF on sign change 1481 dsign = e_bits.is_signed(dst, dsize) 1482 rsign = e_bits.is_signed(ret, dsize) 1483 self.setFlag(EFLAGS_OF, dsign != rsign) 1484 1485 # set carry to last shifted bit 1486 self.setFlag(EFLAGS_CF, (dst << (cnt-1)) & 1) 1487 self.setFlag(EFLAGS_SF, e_bits.is_signed(ret, dsize)) 1488 self.setFlag(EFLAGS_ZF, not ret) 1489 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(ret)) 1490 1491 self.setOperValue(op, 0, ret)

1492

1493 - def i_scasb(self, op):

1494 al = self.getRegister(REG_AL) 1495 edi = self.getRegister(REG_EDI) 1496 base,size = self._emu_segments[SEG_ES] 1497 memval = ord(self.readMemory(base+edi, 1)) 1498 self.intSubBase(al, memval, 1, 1) 1499 if self.getFlag(EFLAGS_DF): 1500 edi -= 1 1501 else: 1502 edi += 1 1503 self.setRegister(REG_EDI, edi)

1504

1505 - def i_scasd(self, op):

1506 #FIXME probably need to handle oper prefix by hand here... 1507 eax = self.getRegister(REG_EAX) 1508 edi = self.getRegister(REG_EDI) 1509 base,size = self._emu_segments[SEG_ES] 1510 memval = struct.unpack("<L",self.readMemory(base+edi, 4))[0] 1511 self.intSubBase(eax, memval, 4, 4) 1512 if self.getFlag(EFLAGS_DF): 1513 edi -= 4 1514 else: 1515 edi += 4 1516 self.setRegister(REG_EDI, edi)

1517

1518 - def i_stosb(self, op):

1519 al = self.getRegister(REG_AL) 1520 edi = self.getRegister(REG_EDI) 1521 base,size = self._emu_segments[SEG_ES] 1522 self.writeMemory(base+edi, chr(al)) 1523 if self.getFlag(EFLAGS_DF): 1524 edi -= 1 1525 else: 1526 edi += 1 1527 self.setRegister(REG_EDI, edi)

1528

1529 - def i_stosd(self, op):

1530 eax = self.getRegister(REG_EAX) 1531 edi = self.getRegister(REG_EDI) 1532 base,size = self._emu_segments[SEG_ES] 1533 self.writeMemory(base+edi, struct.pack("<L", eax)) 1534 if self.getFlag(EFLAGS_DF): 1535 edi -= 4 1536 else: 1537 edi += 4 1538 self.setRegister(REG_EDI, edi)

1539 1540 # We include all the possible SETcc names just in case somebody 1541 # gets hinkey with the disassembler.

1542 - def i_seta(self, op): self.setOperValue(op, 0, int(self.cond_a()))

1543 - def i_setae(self, op): self.setOperValue(op, 0, int(self.cond_ae()))

1544 - def i_setb(self, op): self.setOperValue(op, 0, int(self.cond_b()))

1545 - def i_setbe(self, op): self.setOperValue(op, 0, int(self.cond_be()))

1546 - def i_setc(self, op): self.setOperValue(op, 0, int(self.cond_c()))

1547 - def i_setecxz(self, op): self.setOperValue(op, 0, int(self.cond_ecxz()))

1548 - def i_sete(self, op): self.setOperValue(op, 0, int(self.cond_e()))

1549 - def i_setg(self, op): self.setOperValue(op, 0, int(self.cond_g()))

1550 - def i_setge(self, op): self.setOperValue(op, 0, int(self.cond_ge()))

1551 - def i_setl(self, op): self.setOperValue(op, 0, int(self.cond_l()))

1552 - def i_setle(self, op): self.setOperValue(op, 0, int(self.cond_le()))

1553 i_setna = i_setbe 1554 i_setnae = i_setb 1555 i_setnb = i_setae 1556 i_setnbe = i_seta 1557 i_setnc = i_setae

1558 - def i_setne(self, op): self.setOperValue(op, 0, int(self.cond_ne()))

1559 i_setng = i_setle 1560 i_setnge = i_setl 1561 i_setnl = i_setge 1562 i_setnle = i_setg

1563 - def i_setno(self, op): self.setOperValue(op, 0, int(self.cond_no()))

1564 - def i_setnp(self, op): self.setOperValue(op, 0, int(self.cond_np()))

1565 - def i_setns(self, op): self.setOperValue(op, 0, int(self.cond_ns()))

1566 i_setnz = i_setne

1567 - def i_seto(self, op): self.setOperValue(op, 0, int(self.cond_o()))

1568 - def i_setp(self, op): self.setOperValue(op, 0, int(self.cond_p()))

1569 i_setpe = i_setp 1570 i_setpo = i_setnp

1571 - def i_sets(self, op): self.setOperValue(op, 0, int(self.cond_s()))

1572 i_setz = i_sete 1573

1574 - def i_sbb(self, op):

1575 dst = self.getOperValue(op, 0) 1576 src = self.getOperValue(op, 1) 1577 1578 # Much like "integer subtraction" but we need 1579 # too add in the carry flag 1580 if src == None or dst == None: 1581 self.undefFlags() 1582 return None 1583 1584 dsize = op.opers[0].tsize 1585 ssize = op.opers[1].tsize 1586 # Sign extend immediates where the sizes don't match 1587 if dsize != ssize: 1588 src = e_bits.sign_extend(src, ssize, dsize) 1589 ssize = dsize 1590 src += self.getFlag(EFLAGS_CF) 1591 res = self.intSubBase(src, dst, ssize, dsize) 1592 self.setOperValue(op, 0, res)

1593 1594 # FIXME scas stuff goes here 1595 # FIXME conditional byte set goes here

1596 - def i_stc(self, op):

1597 self.setFlag(EFLAGS_CF, True)

1598

1599 - def i_std(self, op):

1600 self.setFlag(EFLAGS_DF, True)

1601

1602 - def i_sti(self, op):

1603 self.setFlag(EFLAGS_IF, True)

1604 1605 # FIXME stos variants go here

1606 - def i_stosd(self, op):

1607 eax = self.getRegister(REG_EAX) 1608 edi = self.getRegister(REG_EDI) 1609 # FIXME shouldn't have to do this directly 1610 # FIXME this needs a 32/16 bit mode check 1611 base,size = self._emu_segments[SEG_ES] 1612 self.writeMemValue(base+edi, eax, 4) 1613 # FIXME edi inc must be by oper len 1614 self.setRegister(REG_EDI, edi+4)

1615

1616 - def i_sub(self, op):

1617 x = self.integerSubtraction(op) 1618 if x != None: 1619 self.setOperValue(op, 0, x)

1620

1621 - def i_test(self, op):

1622 self.logicalAnd(op)

1623

1624 - def i_wait(self, op):

1625 print "i_wait() is a stub..."

1626

1627 - def i_xadd(self, op):

1628 val1 = self.getOperValue(op, 0) 1629 val2 = self.getOperValue(op, 1) 1630 temp = val1 + val2 1631 self.setOperValue(op, 1, val1) 1632 self.setOperValue(op, 0, temp)

1633

1634 - def i_xchg(self, op):

1635 temp = self.getOperValue(op, 0) 1636 self.setOperValue(op, 0, self.getOperValue(op, 1)) 1637 self.setOperValue(op, 1, temp)

1638

1639 - def i_xor(self, op):

1640 dsize = op.opers[0].tsize 1641 ssize = op.opers[1].tsize 1642 dst = self.getOperValue(op, 0) 1643 src = self.getOperValue(op, 1) 1644 1645 ret = src ^ dst 1646 1647 self.setOperValue(op, 0, ret) 1648 1649 self.setFlag(EFLAGS_CF, 0) 1650 self.setFlag(EFLAGS_OF, 0) 1651 self.setFlag(EFLAGS_SF, e_bits.is_signed(ret, dsize)) 1652 self.setFlag(EFLAGS_ZF, not ret) 1653 self.setFlag(EFLAGS_PF, e_bits.is_parity_byte(ret)) 1654 self.setFlag(EFLAGS_AF, False) # Undefined but actually cleared on amd64 X2

1655

1656 - def i_pxor(self, op):

1657 return self.i_xor(op)

Source Code for Module envi.archs.i386.emu