contrast-agent 3.8.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.clang-format +5 -0
- data/.dockerignore +10 -0
- data/.gitignore +58 -0
- data/.gitmodules +6 -0
- data/.rspec +6 -0
- data/.simplecov +4 -0
- data/Gemfile +7 -0
- data/LICENSE.txt +12 -0
- data/Rakefile +15 -0
- data/exe/contrast_service +29 -0
- data/ext/build_funchook.rb +48 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.c +47 -0
- data/ext/cs__assess_active_record_named/cs__active_record_named.h +10 -0
- data/ext/cs__assess_active_record_named/extconf.rb +2 -0
- data/ext/cs__assess_array/cs__assess_array.c +38 -0
- data/ext/cs__assess_array/cs__assess_array.h +9 -0
- data/ext/cs__assess_array/extconf.rb +2 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.c +50 -0
- data/ext/cs__assess_basic_object/cs__assess_basic_object.h +17 -0
- data/ext/cs__assess_basic_object/extconf.rb +2 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +86 -0
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +34 -0
- data/ext/cs__assess_fiber_track/extconf.rb +2 -0
- data/ext/cs__assess_hash/cs__assess_hash.c +64 -0
- data/ext/cs__assess_hash/cs__assess_hash.h +24 -0
- data/ext/cs__assess_hash/extconf.rb +2 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.c +36 -0
- data/ext/cs__assess_kernel/cs__assess_kernel.h +10 -0
- data/ext/cs__assess_kernel/extconf.rb +2 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +47 -0
- data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +18 -0
- data/ext/cs__assess_marshal_module/extconf.rb +2 -0
- data/ext/cs__assess_module/cs__assess_module.c +78 -0
- data/ext/cs__assess_module/cs__assess_module.h +25 -0
- data/ext/cs__assess_module/extconf.rb +2 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.c +48 -0
- data/ext/cs__assess_regexp/cs__assess_regexp.h +22 -0
- data/ext/cs__assess_regexp/extconf.rb +2 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c +63 -0
- data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h +29 -0
- data/ext/cs__assess_regexp_track/extconf.rb +2 -0
- data/ext/cs__assess_string/cs__assess_string.c +38 -0
- data/ext/cs__assess_string/cs__assess_string.h +19 -0
- data/ext/cs__assess_string/extconf.rb +2 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +31 -0
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h +13 -0
- data/ext/cs__assess_string_interpolation26/extconf.rb +2 -0
- data/ext/cs__common/cs__common.c +60 -0
- data/ext/cs__common/cs__common.h +28 -0
- data/ext/cs__common/extconf.rb +20 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.c +445 -0
- data/ext/cs__contrast_patch/cs__contrast_patch.h +196 -0
- data/ext/cs__contrast_patch/extconf.rb +2 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.c +37 -0
- data/ext/cs__protect_kernel/cs__protect_kernel.h +11 -0
- data/ext/cs__protect_kernel/extconf.rb +2 -0
- data/ext/cs__scope/cs__scope.c +96 -0
- data/ext/cs__scope/cs__scope.h +33 -0
- data/ext/cs__scope/extconf.rb +2 -0
- data/ext/extconf_common.rb +49 -0
- data/funchook/LICENSE +360 -0
- data/funchook/Makefile +29 -0
- data/funchook/Makefile.in +29 -0
- data/funchook/README.md +121 -0
- data/funchook/appveyor.yml +42 -0
- data/funchook/autogen.sh +3 -0
- data/funchook/autom4te.cache/output.0 +4976 -0
- data/funchook/autom4te.cache/requests +78 -0
- data/funchook/autom4te.cache/traces.0 +364 -0
- data/funchook/config.guess +1530 -0
- data/funchook/config.log +490 -0
- data/funchook/config.status +1016 -0
- data/funchook/config.sub +1773 -0
- data/funchook/configure +4976 -0
- data/funchook/configure.ac +59 -0
- data/funchook/distorm/COPYING +26 -0
- data/funchook/distorm/MANIFEST +25 -0
- data/funchook/distorm/MANIFEST.in +4 -0
- data/funchook/distorm/README.md +12 -0
- data/funchook/distorm/disOps/disOps.py +795 -0
- data/funchook/distorm/disOps/x86db.py +404 -0
- data/funchook/distorm/disOps/x86header.py +247 -0
- data/funchook/distorm/disOps/x86sets.py +1664 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Program.cs +79 -0
- data/funchook/distorm/examples/cs/TestdiStorm/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/TestdiStorm/TestdiStorm.csproj +69 -0
- data/funchook/distorm/examples/cs/distorm-net.sln +26 -0
- data/funchook/distorm/examples/cs/distorm-net/CodeInfo.cs +23 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedInst.cs +15 -0
- data/funchook/distorm/examples/cs/distorm-net/DecodedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedInst.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/DecomposedResult.cs +14 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.cs +1268 -0
- data/funchook/distorm/examples/cs/distorm-net/Opcodes.tt +37 -0
- data/funchook/distorm/examples/cs/distorm-net/Operand.cs +25 -0
- data/funchook/distorm/examples/cs/distorm-net/Properties/AssemblyInfo.cs +36 -0
- data/funchook/distorm/examples/cs/distorm-net/diStorm3.cs +411 -0
- data/funchook/distorm/examples/cs/distorm-net/distorm-net.csproj +80 -0
- data/funchook/distorm/examples/cs/readme +3 -0
- data/funchook/distorm/examples/ddk/README +48 -0
- data/funchook/distorm/examples/ddk/distorm.ini +11 -0
- data/funchook/distorm/examples/ddk/dummy.c +15 -0
- data/funchook/distorm/examples/ddk/main.c +91 -0
- data/funchook/distorm/examples/ddk/makefile +1 -0
- data/funchook/distorm/examples/ddk/sources +10 -0
- data/funchook/distorm/examples/java/Makefile +23 -0
- data/funchook/distorm/examples/java/distorm/src/Main.java +43 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/CodeInfo.java +27 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedInst.java +32 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedInst.java +89 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedResult.java +11 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/OpcodeEnum.java +131 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Opcodes.java +1123 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/Operand.java +24 -0
- data/funchook/distorm/examples/java/distorm/src/diStorm3/distorm3.java +41 -0
- data/funchook/distorm/examples/java/jdistorm.c +405 -0
- data/funchook/distorm/examples/java/jdistorm.h +40 -0
- data/funchook/distorm/examples/java/jdistorm.sln +20 -0
- data/funchook/distorm/examples/java/jdistorm.vcproj +208 -0
- data/funchook/distorm/examples/linux/Makefile +15 -0
- data/funchook/distorm/examples/linux/main.c +181 -0
- data/funchook/distorm/examples/tests/Makefile +15 -0
- data/funchook/distorm/examples/tests/main.cpp +42 -0
- data/funchook/distorm/examples/tests/main.py +66 -0
- data/funchook/distorm/examples/tests/test_distorm3.py +1672 -0
- data/funchook/distorm/examples/tests/tests.sln +20 -0
- data/funchook/distorm/examples/tests/tests.vcxproj +82 -0
- data/funchook/distorm/examples/tests/tests.vcxproj.filters +22 -0
- data/funchook/distorm/examples/win32/disasm.sln +25 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj +201 -0
- data/funchook/distorm/examples/win32/disasm.vcxproj.filters +14 -0
- data/funchook/distorm/examples/win32/main.cpp +163 -0
- data/funchook/distorm/include/distorm.h +482 -0
- data/funchook/distorm/include/mnemonics.h +301 -0
- data/funchook/distorm/make/linux/Makefile +28 -0
- data/funchook/distorm/make/mac/Makefile +24 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj +239 -0
- data/funchook/distorm/make/win32/cdistorm.vcxproj.filters +80 -0
- data/funchook/distorm/make/win32/distorm.sln +25 -0
- data/funchook/distorm/make/win32/resource.h +14 -0
- data/funchook/distorm/make/win32/resource.rc +99 -0
- data/funchook/distorm/python/distorm3/__init__.py +957 -0
- data/funchook/distorm/python/distorm3/sample.py +51 -0
- data/funchook/distorm/setup.cfg +10 -0
- data/funchook/distorm/setup.py +266 -0
- data/funchook/distorm/src/config.h +169 -0
- data/funchook/distorm/src/decoder.c +641 -0
- data/funchook/distorm/src/decoder.h +33 -0
- data/funchook/distorm/src/distorm.c +413 -0
- data/funchook/distorm/src/instructions.c +597 -0
- data/funchook/distorm/src/instructions.h +463 -0
- data/funchook/distorm/src/insts.c +7939 -0
- data/funchook/distorm/src/insts.h +64 -0
- data/funchook/distorm/src/mnemonics.c +284 -0
- data/funchook/distorm/src/operands.c +1290 -0
- data/funchook/distorm/src/operands.h +28 -0
- data/funchook/distorm/src/prefix.c +368 -0
- data/funchook/distorm/src/prefix.h +64 -0
- data/funchook/distorm/src/textdefs.c +172 -0
- data/funchook/distorm/src/textdefs.h +57 -0
- data/funchook/distorm/src/wstring.c +47 -0
- data/funchook/distorm/src/wstring.h +35 -0
- data/funchook/distorm/src/x86defs.h +82 -0
- data/funchook/include/funchook.h +123 -0
- data/funchook/install-sh +527 -0
- data/funchook/src/Makefile +70 -0
- data/funchook/src/Makefile.in +70 -0
- data/funchook/src/__strerror.h +109 -0
- data/funchook/src/config.h +101 -0
- data/funchook/src/config.h.in +100 -0
- data/funchook/src/decoder.o +0 -0
- data/funchook/src/distorm.o +0 -0
- data/funchook/src/funchook.c +440 -0
- data/funchook/src/funchook.o +0 -0
- data/funchook/src/funchook_internal.h +155 -0
- data/funchook/src/funchook_io.c +182 -0
- data/funchook/src/funchook_io.h +64 -0
- data/funchook/src/funchook_io.o +0 -0
- data/funchook/src/funchook_syscall.S +134 -0
- data/funchook/src/funchook_syscall.o +0 -0
- data/funchook/src/funchook_unix.c +480 -0
- data/funchook/src/funchook_unix.o +0 -0
- data/funchook/src/funchook_windows.c +397 -0
- data/funchook/src/funchook_x86.c +622 -0
- data/funchook/src/funchook_x86.o +0 -0
- data/funchook/src/instructions.o +0 -0
- data/funchook/src/insts.o +0 -0
- data/funchook/src/libfunchook.so +0 -0
- data/funchook/src/mnemonics.o +0 -0
- data/funchook/src/operands.o +0 -0
- data/funchook/src/os_func.c +115 -0
- data/funchook/src/os_func.h +75 -0
- data/funchook/src/os_func.o +0 -0
- data/funchook/src/os_func_unix.c +94 -0
- data/funchook/src/os_func_unix.o +0 -0
- data/funchook/src/os_func_windows.c +32 -0
- data/funchook/src/prefix.o +0 -0
- data/funchook/src/printf_base.c +1688 -0
- data/funchook/src/printf_base.h +46 -0
- data/funchook/src/printf_base.o +0 -0
- data/funchook/src/textdefs.o +0 -0
- data/funchook/src/wstring.o +0 -0
- data/funchook/test/Makefile +43 -0
- data/funchook/test/Makefile.in +43 -0
- data/funchook/test/funchook_test +0 -0
- data/funchook/test/libfunchook_test.c +25 -0
- data/funchook/test/libfunchook_test.so +0 -0
- data/funchook/test/libfunchook_test2.c +18 -0
- data/funchook/test/suffix.list +600 -0
- data/funchook/test/test_main.c +430 -0
- data/funchook/test/test_main.o +0 -0
- data/funchook/test/x86_64_test.S +10 -0
- data/funchook/test/x86_64_test.o +0 -0
- data/funchook/test/x86_test.S +339 -0
- data/funchook/win32/config.h +1 -0
- data/funchook/win32/funchook.sln +52 -0
- data/funchook/win32/funchook.vcxproj +188 -0
- data/funchook/win32/funchook.vcxproj.filters +84 -0
- data/funchook/win32/funchook_test.vcxproj +170 -0
- data/funchook/win32/funchook_test.vcxproj.filters +22 -0
- data/funchook/win32/funchook_test_dll.vcxproj +184 -0
- data/funchook/win32/funchook_test_dll.vcxproj.filters +30 -0
- data/funchook/win32/funchook_test_exe.def +3 -0
- data/lib/contrast-agent.rb +8 -0
- data/lib/contrast.rb +57 -0
- data/lib/contrast/agent.rb +80 -0
- data/lib/contrast/agent/assess.rb +45 -0
- data/lib/contrast/agent/assess/adjusted_span.rb +25 -0
- data/lib/contrast/agent/assess/class_reverter.rb +82 -0
- data/lib/contrast/agent/assess/contrast_event.rb +398 -0
- data/lib/contrast/agent/assess/frozen_properties.rb +41 -0
- data/lib/contrast/agent/assess/insulator.rb +53 -0
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +78 -0
- data/lib/contrast/agent/assess/policy/patcher.rb +85 -0
- data/lib/contrast/agent/assess/policy/policy.rb +116 -0
- data/lib/contrast/agent/assess/policy/policy_node.rb +289 -0
- data/lib/contrast/agent/assess/policy/policy_scanner.rb +44 -0
- data/lib/contrast/agent/assess/policy/preshift.rb +94 -0
- data/lib/contrast/agent/assess/policy/propagation_method.rb +260 -0
- data/lib/contrast/agent/assess/policy/propagation_node.rb +127 -0
- data/lib/contrast/agent/assess/policy/propagator.rb +35 -0
- data/lib/contrast/agent/assess/policy/propagator/append.rb +54 -0
- data/lib/contrast/agent/assess/policy/propagator/base.rb +37 -0
- data/lib/contrast/agent/assess/policy/propagator/center.rb +73 -0
- data/lib/contrast/agent/assess/policy/propagator/custom.rb +36 -0
- data/lib/contrast/agent/assess/policy/propagator/database_write.rb +62 -0
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +55 -0
- data/lib/contrast/agent/assess/policy/propagator/keep.rb +26 -0
- data/lib/contrast/agent/assess/policy/propagator/next.rb +42 -0
- data/lib/contrast/agent/assess/policy/propagator/prepend.rb +50 -0
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +76 -0
- data/lib/contrast/agent/assess/policy/propagator/replace.rb +27 -0
- data/lib/contrast/agent/assess/policy/propagator/reverse.rb +38 -0
- data/lib/contrast/agent/assess/policy/propagator/select.rb +86 -0
- data/lib/contrast/agent/assess/policy/propagator/splat.rb +60 -0
- data/lib/contrast/agent/assess/policy/propagator/split.rb +49 -0
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +169 -0
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +81 -0
- data/lib/contrast/agent/assess/policy/rewriter_patch.rb +79 -0
- data/lib/contrast/agent/assess/policy/source_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/source_node.rb +62 -0
- data/lib/contrast/agent/assess/policy/trigger_method.rb +209 -0
- data/lib/contrast/agent/assess/policy/trigger_node.rb +198 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +77 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +31 -0
- data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +40 -0
- data/lib/contrast/agent/assess/properties.rb +392 -0
- data/lib/contrast/agent/assess/rule.rb +18 -0
- data/lib/contrast/agent/assess/rule/base.rb +72 -0
- data/lib/contrast/agent/assess/rule/csrf.rb +66 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +28 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +69 -0
- data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +132 -0
- data/lib/contrast/agent/assess/rule/provider.rb +21 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +62 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +73 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +121 -0
- data/lib/contrast/agent/assess/rule/redos.rb +68 -0
- data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +47 -0
- data/lib/contrast/agent/assess/rule/response_watcher.rb +36 -0
- data/lib/contrast/agent/assess/rule/watcher.rb +36 -0
- data/lib/contrast/agent/assess/tag.rb +151 -0
- data/lib/contrast/agent/at_exit_hook.rb +33 -0
- data/lib/contrast/agent/class_reopener.rb +195 -0
- data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +26 -0
- data/lib/contrast/agent/deadzone/policy/policy.rb +57 -0
- data/lib/contrast/agent/disable_reaction.rb +24 -0
- data/lib/contrast/agent/exclusion_matcher.rb +190 -0
- data/lib/contrast/agent/feature_state.rb +379 -0
- data/lib/contrast/agent/inventory/policy/policy.rb +32 -0
- data/lib/contrast/agent/inventory/policy/trigger_node.rb +22 -0
- data/lib/contrast/agent/logger_manager.rb +116 -0
- data/lib/contrast/agent/middleware.rb +352 -0
- data/lib/contrast/agent/module_data.rb +16 -0
- data/lib/contrast/agent/patching/policy/after_load_patch.rb +37 -0
- data/lib/contrast/agent/patching/policy/after_load_patcher.rb +58 -0
- data/lib/contrast/agent/patching/policy/method_policy.rb +94 -0
- data/lib/contrast/agent/patching/policy/module_policy.rb +116 -0
- data/lib/contrast/agent/patching/policy/patch.rb +312 -0
- data/lib/contrast/agent/patching/policy/patch_status.rb +192 -0
- data/lib/contrast/agent/patching/policy/patcher.rb +310 -0
- data/lib/contrast/agent/patching/policy/policy.rb +138 -0
- data/lib/contrast/agent/patching/policy/policy_node.rb +80 -0
- data/lib/contrast/agent/patching/policy/policy_unpatcher.rb +28 -0
- data/lib/contrast/agent/patching/policy/trigger_node.rb +81 -0
- data/lib/contrast/agent/protect/policy/policy.rb +37 -0
- data/lib/contrast/agent/protect/policy/trigger_node.rb +23 -0
- data/lib/contrast/agent/protect/rule.rb +58 -0
- data/lib/contrast/agent/protect/rule/base.rb +300 -0
- data/lib/contrast/agent/protect/rule/base_service.rb +88 -0
- data/lib/contrast/agent/protect/rule/cmd_injection.rb +156 -0
- data/lib/contrast/agent/protect/rule/csrf.rb +118 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +103 -0
- data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +85 -0
- data/lib/contrast/agent/protect/rule/default_scanner.rb +300 -0
- data/lib/contrast/agent/protect/rule/deserialization.rb +193 -0
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +80 -0
- data/lib/contrast/agent/protect/rule/no_sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +40 -0
- data/lib/contrast/agent/protect/rule/path_traversal.rb +143 -0
- data/lib/contrast/agent/protect/rule/sqli.rb +101 -0
- data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +16 -0
- data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +38 -0
- data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +22 -0
- data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +19 -0
- data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +20 -0
- data/lib/contrast/agent/protect/rule/xss.rb +24 -0
- data/lib/contrast/agent/protect/rule/xxe.rb +120 -0
- data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +82 -0
- data/lib/contrast/agent/railtie.rb +30 -0
- data/lib/contrast/agent/reaction_processor.rb +47 -0
- data/lib/contrast/agent/request.rb +493 -0
- data/lib/contrast/agent/request_context.rb +225 -0
- data/lib/contrast/agent/require_state.rb +61 -0
- data/lib/contrast/agent/response.rb +215 -0
- data/lib/contrast/agent/rewriter.rb +244 -0
- data/lib/contrast/agent/scope.rb +28 -0
- data/lib/contrast/agent/service_heartbeat.rb +37 -0
- data/lib/contrast/agent/settings_state.rb +148 -0
- data/lib/contrast/agent/socket_client.rb +125 -0
- data/lib/contrast/agent/thread.rb +26 -0
- data/lib/contrast/agent/tracepoint_hook.rb +51 -0
- data/lib/contrast/agent/version.rb +8 -0
- data/lib/contrast/api.rb +17 -0
- data/lib/contrast/api/.gitkeep +0 -0
- data/lib/contrast/api/connection_status.rb +49 -0
- data/lib/contrast/api/socket.rb +43 -0
- data/lib/contrast/api/speedracer.rb +206 -0
- data/lib/contrast/api/tcp_socket.rb +31 -0
- data/lib/contrast/api/unix_socket.rb +25 -0
- data/lib/contrast/common_agent_configuration.rb +86 -0
- data/lib/contrast/components/agent.rb +85 -0
- data/lib/contrast/components/app_context.rb +188 -0
- data/lib/contrast/components/assess.rb +67 -0
- data/lib/contrast/components/config.rb +135 -0
- data/lib/contrast/components/contrast_service.rb +113 -0
- data/lib/contrast/components/heap_dump.rb +34 -0
- data/lib/contrast/components/interface.rb +178 -0
- data/lib/contrast/components/inventory.rb +23 -0
- data/lib/contrast/components/logger.rb +92 -0
- data/lib/contrast/components/protect.rb +38 -0
- data/lib/contrast/components/sampling.rb +41 -0
- data/lib/contrast/components/scope.rb +106 -0
- data/lib/contrast/components/settings.rb +140 -0
- data/lib/contrast/config.rb +33 -0
- data/lib/contrast/config/agent_configuration.rb +24 -0
- data/lib/contrast/config/application_configuration.rb +27 -0
- data/lib/contrast/config/assess_configuration.rb +22 -0
- data/lib/contrast/config/assess_rules_configuration.rb +18 -0
- data/lib/contrast/config/base_configuration.rb +105 -0
- data/lib/contrast/config/default_value.rb +16 -0
- data/lib/contrast/config/exception_configuration.rb +21 -0
- data/lib/contrast/config/heap_dump_configuration.rb +23 -0
- data/lib/contrast/config/inventory_configuration.rb +20 -0
- data/lib/contrast/config/logger_configuration.rb +20 -0
- data/lib/contrast/config/protect_configuration.rb +20 -0
- data/lib/contrast/config/protect_rule_configuration.rb +37 -0
- data/lib/contrast/config/protect_rules_configuration.rb +30 -0
- data/lib/contrast/config/root_configuration.rb +26 -0
- data/lib/contrast/config/ruby_configuration.rb +39 -0
- data/lib/contrast/config/sampling_configuration.rb +22 -0
- data/lib/contrast/config/server_configuration.rb +23 -0
- data/lib/contrast/config/service_configuration.rb +22 -0
- data/lib/contrast/configuration.rb +214 -0
- data/lib/contrast/core_extensions/assess.rb +51 -0
- data/lib/contrast/core_extensions/assess/array.rb +58 -0
- data/lib/contrast/core_extensions/assess/assess_extension.rb +145 -0
- data/lib/contrast/core_extensions/assess/basic_object.rb +15 -0
- data/lib/contrast/core_extensions/assess/erb.rb +42 -0
- data/lib/contrast/core_extensions/assess/exec_trigger.rb +48 -0
- data/lib/contrast/core_extensions/assess/fiber.rb +125 -0
- data/lib/contrast/core_extensions/assess/hash.rb +22 -0
- data/lib/contrast/core_extensions/assess/kernel.rb +95 -0
- data/lib/contrast/core_extensions/assess/module.rb +14 -0
- data/lib/contrast/core_extensions/assess/regexp.rb +206 -0
- data/lib/contrast/core_extensions/assess/string.rb +75 -0
- data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb +73 -0
- data/lib/contrast/core_extensions/delegator.rb +14 -0
- data/lib/contrast/core_extensions/eval_trigger.rb +52 -0
- data/lib/contrast/core_extensions/inventory.rb +22 -0
- data/lib/contrast/core_extensions/inventory/datastores.rb +37 -0
- data/lib/contrast/core_extensions/module.rb +42 -0
- data/lib/contrast/core_extensions/object.rb +27 -0
- data/lib/contrast/core_extensions/protect.rb +20 -0
- data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb +70 -0
- data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb +58 -0
- data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb +81 -0
- data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb +119 -0
- data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb +63 -0
- data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb +141 -0
- data/lib/contrast/core_extensions/protect/kernel.rb +30 -0
- data/lib/contrast/core_extensions/protect/psych.rb +7 -0
- data/lib/contrast/core_extensions/thread.rb +31 -0
- data/lib/contrast/internal_exception.rb +8 -0
- data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb +48 -0
- data/lib/contrast/rails_extensions/assess/active_record.rb +32 -0
- data/lib/contrast/rails_extensions/assess/active_record_named.rb +61 -0
- data/lib/contrast/rails_extensions/assess/configuration.rb +26 -0
- data/lib/contrast/rails_extensions/buffer.rb +30 -0
- data/lib/contrast/rails_extensions/rack.rb +45 -0
- data/lib/contrast/security_exception.rb +14 -0
- data/lib/contrast/sinatra_extensions/assess/cookie.rb +26 -0
- data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb +59 -0
- data/lib/contrast/tasks/service.rb +95 -0
- data/lib/contrast/utils/assess/sampling_util.rb +96 -0
- data/lib/contrast/utils/assess/tracking_util.rb +39 -0
- data/lib/contrast/utils/boolean_util.rb +33 -0
- data/lib/contrast/utils/cache.rb +69 -0
- data/lib/contrast/utils/class_util.rb +58 -0
- data/lib/contrast/utils/comment_range.rb +19 -0
- data/lib/contrast/utils/data_store_util.rb +23 -0
- data/lib/contrast/utils/duck_utils.rb +58 -0
- data/lib/contrast/utils/env_configuration_item.rb +52 -0
- data/lib/contrast/utils/environment_util.rb +152 -0
- data/lib/contrast/utils/freeze_util.rb +36 -0
- data/lib/contrast/utils/gemfile_reader.rb +191 -0
- data/lib/contrast/utils/hash_digest.rb +148 -0
- data/lib/contrast/utils/heap_dump_util.rb +113 -0
- data/lib/contrast/utils/invalid_configuration_util.rb +88 -0
- data/lib/contrast/utils/inventory_util.rb +126 -0
- data/lib/contrast/utils/io_util.rb +61 -0
- data/lib/contrast/utils/object_share.rb +117 -0
- data/lib/contrast/utils/operating_environment.rb +38 -0
- data/lib/contrast/utils/os.rb +49 -0
- data/lib/contrast/utils/path_util.rb +151 -0
- data/lib/contrast/utils/performs_logging.rb +152 -0
- data/lib/contrast/utils/preflight_util.rb +13 -0
- data/lib/contrast/utils/prevent_serialization.rb +52 -0
- data/lib/contrast/utils/rack_assess_session_cookie.rb +104 -0
- data/lib/contrast/utils/rails_assess_configuration.rb +95 -0
- data/lib/contrast/utils/random_util.rb +22 -0
- data/lib/contrast/utils/resource_loader.rb +23 -0
- data/lib/contrast/utils/ruby_ast_rewriter.rb +74 -0
- data/lib/contrast/utils/scope_util.rb +99 -0
- data/lib/contrast/utils/service_response_util.rb +116 -0
- data/lib/contrast/utils/service_sender_util.rb +98 -0
- data/lib/contrast/utils/sha256_builder.rb +69 -0
- data/lib/contrast/utils/sinatra_helper.rb +49 -0
- data/lib/contrast/utils/stack_trace_utils.rb +209 -0
- data/lib/contrast/utils/string_utils.rb +72 -0
- data/lib/contrast/utils/tag_util.rb +139 -0
- data/lib/contrast/utils/thread_tracker.rb +54 -0
- data/lib/contrast/utils/timer.rb +78 -0
- data/resources/assess/policy.json +1673 -0
- data/resources/csrf/inject.js +44 -0
- data/resources/deadzone/policy.json +55 -0
- data/resources/factory-bot-spec/spec_helper.rb +30 -0
- data/resources/inventory/policy.json +110 -0
- data/resources/protect/policy.json +417 -0
- data/resources/rubocops/kernel/catch_cop.rb +37 -0
- data/resources/rubocops/kernel/require_cop.rb +37 -0
- data/resources/rubocops/kernel/require_relative_cop.rb +33 -0
- data/resources/rubocops/module/autoload_cop.rb +37 -0
- data/resources/rubocops/module/const_defined_cop.rb +37 -0
- data/resources/rubocops/module/const_get_cop.rb +37 -0
- data/resources/rubocops/module/const_set_cop.rb +37 -0
- data/resources/rubocops/module/constants_cop.rb +37 -0
- data/resources/rubocops/module/name_cop.rb +37 -0
- data/resources/rubocops/object/class_cop.rb +37 -0
- data/resources/rubocops/object/freeze_cop.rb +37 -0
- data/resources/rubocops/object/frozen_cop.rb +37 -0
- data/resources/rubocops/object/is_a_cop.rb +37 -0
- data/resources/rubocops/object/method_cop.rb +37 -0
- data/resources/rubocops/object/respond_to_cop.rb +37 -0
- data/resources/rubocops/object/singleton_class_cop.rb +37 -0
- data/resources/rubocops/regexp/spelling_cop.rb +44 -0
- data/resources/rubocops/thread/new_cop.rb +39 -0
- data/resources/ruby-spec/ancestors_spec.rb +70 -0
- data/resources/ruby-spec/modulo_spec.rb +831 -0
- data/resources/ruby-spec/parameters_spec.rb +261 -0
- data/resources/ruby-spec/ruby_spec_spec_helper.rb +35 -0
- data/resources/test_marker.txt +1 -0
- data/ruby-agent.gemspec +129 -0
- data/service_executables/.gitkeep +0 -0
- data/service_executables/VERSION +1 -0
- data/service_executables/linux/contrast-service +0 -0
- data/service_executables/mac/contrast-service +0 -0
- metadata +945 -0
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="utf-8"?>
|
|
2
|
+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
|
3
|
+
<ItemGroup>
|
|
4
|
+
<Filter Include="Source Files">
|
|
5
|
+
<UniqueIdentifier>{50ac9ad6-0895-4596-b142-1a7fad1b97d5}</UniqueIdentifier>
|
|
6
|
+
<Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm</Extensions>
|
|
7
|
+
</Filter>
|
|
8
|
+
<Filter Include="Header Files">
|
|
9
|
+
<UniqueIdentifier>{8612ae75-7b41-4557-b23b-d3e14e7f9613}</UniqueIdentifier>
|
|
10
|
+
<Extensions>h;hpp;hxx;hm;inl;inc</Extensions>
|
|
11
|
+
</Filter>
|
|
12
|
+
</ItemGroup>
|
|
13
|
+
<ItemGroup>
|
|
14
|
+
<ClCompile Include="..\..\src\decoder.c">
|
|
15
|
+
<Filter>Source Files</Filter>
|
|
16
|
+
</ClCompile>
|
|
17
|
+
<ClCompile Include="..\..\src\distorm.c">
|
|
18
|
+
<Filter>Source Files</Filter>
|
|
19
|
+
</ClCompile>
|
|
20
|
+
<ClCompile Include="..\..\src\instructions.c">
|
|
21
|
+
<Filter>Source Files</Filter>
|
|
22
|
+
</ClCompile>
|
|
23
|
+
<ClCompile Include="..\..\src\insts.c">
|
|
24
|
+
<Filter>Source Files</Filter>
|
|
25
|
+
</ClCompile>
|
|
26
|
+
<ClCompile Include="..\..\src\mnemonics.c">
|
|
27
|
+
<Filter>Source Files</Filter>
|
|
28
|
+
</ClCompile>
|
|
29
|
+
<ClCompile Include="..\..\src\operands.c">
|
|
30
|
+
<Filter>Source Files</Filter>
|
|
31
|
+
</ClCompile>
|
|
32
|
+
<ClCompile Include="..\..\src\prefix.c">
|
|
33
|
+
<Filter>Source Files</Filter>
|
|
34
|
+
</ClCompile>
|
|
35
|
+
<ClCompile Include="..\..\src\textdefs.c">
|
|
36
|
+
<Filter>Source Files</Filter>
|
|
37
|
+
</ClCompile>
|
|
38
|
+
<ClCompile Include="..\..\src\wstring.c">
|
|
39
|
+
<Filter>Source Files</Filter>
|
|
40
|
+
</ClCompile>
|
|
41
|
+
<ClCompile Include="..\..\src\x86defs.c">
|
|
42
|
+
<Filter>Source Files</Filter>
|
|
43
|
+
</ClCompile>
|
|
44
|
+
</ItemGroup>
|
|
45
|
+
<ItemGroup>
|
|
46
|
+
<ClInclude Include="..\..\src\config.h">
|
|
47
|
+
<Filter>Header Files</Filter>
|
|
48
|
+
</ClInclude>
|
|
49
|
+
<ClInclude Include="..\..\include\distorm.h">
|
|
50
|
+
<Filter>Header Files</Filter>
|
|
51
|
+
</ClInclude>
|
|
52
|
+
<ClInclude Include="..\..\src\instructions.h">
|
|
53
|
+
<Filter>Header Files</Filter>
|
|
54
|
+
</ClInclude>
|
|
55
|
+
<ClInclude Include="..\..\src\insts.h">
|
|
56
|
+
<Filter>Header Files</Filter>
|
|
57
|
+
</ClInclude>
|
|
58
|
+
<ClInclude Include="..\..\include\mnemonics.h">
|
|
59
|
+
<Filter>Header Files</Filter>
|
|
60
|
+
</ClInclude>
|
|
61
|
+
<ClInclude Include="..\..\src\operands.h">
|
|
62
|
+
<Filter>Header Files</Filter>
|
|
63
|
+
</ClInclude>
|
|
64
|
+
<ClInclude Include="..\..\src\prefix.h">
|
|
65
|
+
<Filter>Header Files</Filter>
|
|
66
|
+
</ClInclude>
|
|
67
|
+
<ClInclude Include="..\..\src\textdefs.h">
|
|
68
|
+
<Filter>Header Files</Filter>
|
|
69
|
+
</ClInclude>
|
|
70
|
+
<ClInclude Include="..\..\src\wstring.h">
|
|
71
|
+
<Filter>Header Files</Filter>
|
|
72
|
+
</ClInclude>
|
|
73
|
+
<ClInclude Include="..\..\src\x86defs.h">
|
|
74
|
+
<Filter>Header Files</Filter>
|
|
75
|
+
</ClInclude>
|
|
76
|
+
</ItemGroup>
|
|
77
|
+
<ItemGroup>
|
|
78
|
+
<ResourceCompile Include="resource.rc" />
|
|
79
|
+
</ItemGroup>
|
|
80
|
+
</Project>
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
Microsoft Visual Studio Solution File, Format Version 11.00
|
|
2
|
+
# Visual Studio 2010
|
|
3
|
+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "distorm", "cdistorm.vcxproj", "{15051CE1-AB10-4239-973D-01B84F2AD0A9}"
|
|
4
|
+
EndProject
|
|
5
|
+
Global
|
|
6
|
+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
|
7
|
+
clib|Win32 = clib|Win32
|
|
8
|
+
clib|x64 = clib|x64
|
|
9
|
+
dll|Win32 = dll|Win32
|
|
10
|
+
dll|x64 = dll|x64
|
|
11
|
+
EndGlobalSection
|
|
12
|
+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
|
13
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.ActiveCfg = clib|Win32
|
|
14
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.Build.0 = clib|Win32
|
|
15
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.ActiveCfg = clib|x64
|
|
16
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.Build.0 = clib|x64
|
|
17
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.ActiveCfg = dll|Win32
|
|
18
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.Build.0 = dll|Win32
|
|
19
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.ActiveCfg = dll|x64
|
|
20
|
+
{15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.Build.0 = dll|x64
|
|
21
|
+
EndGlobalSection
|
|
22
|
+
GlobalSection(SolutionProperties) = preSolution
|
|
23
|
+
HideSolutionNode = FALSE
|
|
24
|
+
EndGlobalSection
|
|
25
|
+
EndGlobal
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
//{{NO_DEPENDENCIES}}
|
|
2
|
+
// Microsoft Visual C++ generated include file.
|
|
3
|
+
// Used by resource.rc
|
|
4
|
+
|
|
5
|
+
// Next default values for new objects
|
|
6
|
+
//
|
|
7
|
+
#ifdef APSTUDIO_INVOKED
|
|
8
|
+
#ifndef APSTUDIO_READONLY_SYMBOLS
|
|
9
|
+
#define _APS_NEXT_RESOURCE_VALUE 101
|
|
10
|
+
#define _APS_NEXT_COMMAND_VALUE 40001
|
|
11
|
+
#define _APS_NEXT_CONTROL_VALUE 1001
|
|
12
|
+
#define _APS_NEXT_SYMED_VALUE 101
|
|
13
|
+
#endif
|
|
14
|
+
#endif
|
|
@@ -0,0 +1,99 @@
|
|
|
1
|
+
// Microsoft Visual C++ generated resource script.
|
|
2
|
+
//
|
|
3
|
+
#include "resource.h"
|
|
4
|
+
|
|
5
|
+
#define APSTUDIO_READONLY_SYMBOLS
|
|
6
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
7
|
+
//
|
|
8
|
+
// Generated from the TEXTINCLUDE 2 resource.
|
|
9
|
+
//
|
|
10
|
+
#include "afxres.h"
|
|
11
|
+
|
|
12
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
13
|
+
#undef APSTUDIO_READONLY_SYMBOLS
|
|
14
|
+
|
|
15
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
16
|
+
// English (United States) resources
|
|
17
|
+
|
|
18
|
+
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
|
|
19
|
+
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
|
|
20
|
+
#pragma code_page(1252)
|
|
21
|
+
|
|
22
|
+
#ifdef APSTUDIO_INVOKED
|
|
23
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
24
|
+
//
|
|
25
|
+
// TEXTINCLUDE
|
|
26
|
+
//
|
|
27
|
+
|
|
28
|
+
1 TEXTINCLUDE
|
|
29
|
+
BEGIN
|
|
30
|
+
"resource.h\0"
|
|
31
|
+
END
|
|
32
|
+
|
|
33
|
+
2 TEXTINCLUDE
|
|
34
|
+
BEGIN
|
|
35
|
+
"#include ""afxres.h""\r\n"
|
|
36
|
+
"\0"
|
|
37
|
+
END
|
|
38
|
+
|
|
39
|
+
3 TEXTINCLUDE
|
|
40
|
+
BEGIN
|
|
41
|
+
"\r\n"
|
|
42
|
+
"\0"
|
|
43
|
+
END
|
|
44
|
+
|
|
45
|
+
#endif // APSTUDIO_INVOKED
|
|
46
|
+
|
|
47
|
+
|
|
48
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
49
|
+
//
|
|
50
|
+
// Version
|
|
51
|
+
//
|
|
52
|
+
|
|
53
|
+
VS_VERSION_INFO VERSIONINFO
|
|
54
|
+
FILEVERSION 3,3,4,0
|
|
55
|
+
PRODUCTVERSION 3,3,4,0
|
|
56
|
+
FILEFLAGSMASK 0x17L
|
|
57
|
+
#ifdef _DEBUG
|
|
58
|
+
FILEFLAGS 0x1L
|
|
59
|
+
#else
|
|
60
|
+
FILEFLAGS 0x0L
|
|
61
|
+
#endif
|
|
62
|
+
FILEOS 0x4L
|
|
63
|
+
FILETYPE 0x2L
|
|
64
|
+
FILESUBTYPE 0x0L
|
|
65
|
+
BEGIN
|
|
66
|
+
BLOCK "StringFileInfo"
|
|
67
|
+
BEGIN
|
|
68
|
+
BLOCK "040904b0"
|
|
69
|
+
BEGIN
|
|
70
|
+
VALUE "FileDescription", "diStorm3 module"
|
|
71
|
+
VALUE "FileVersion", "3.3.4.0"
|
|
72
|
+
VALUE "InternalName", "diStorm3"
|
|
73
|
+
VALUE "LegalCopyright", "Copyright (C) 2003-2016 Gil Dabah"
|
|
74
|
+
VALUE "OriginalFilename", "diStorm3.dll"
|
|
75
|
+
VALUE "ProductName", "diStorm3 Disassembler Library"
|
|
76
|
+
VALUE "ProductVersion", "3.3.4.0"
|
|
77
|
+
END
|
|
78
|
+
END
|
|
79
|
+
BLOCK "VarFileInfo"
|
|
80
|
+
BEGIN
|
|
81
|
+
VALUE "Translation", 0x409, 1200
|
|
82
|
+
END
|
|
83
|
+
END
|
|
84
|
+
|
|
85
|
+
#endif // English (United States) resources
|
|
86
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
87
|
+
|
|
88
|
+
|
|
89
|
+
|
|
90
|
+
#ifndef APSTUDIO_INVOKED
|
|
91
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
92
|
+
//
|
|
93
|
+
// Generated from the TEXTINCLUDE 3 resource.
|
|
94
|
+
//
|
|
95
|
+
|
|
96
|
+
|
|
97
|
+
/////////////////////////////////////////////////////////////////////////////
|
|
98
|
+
#endif // not APSTUDIO_INVOKED
|
|
99
|
+
|
|
@@ -0,0 +1,957 @@
|
|
|
1
|
+
# :[diStorm3}: Python binding
|
|
2
|
+
# Based on diStorm64 Python binding by Mario Vilas
|
|
3
|
+
# Initial support for decompose API added by Roee Shenberg
|
|
4
|
+
# Licensed under BSD in 2016.
|
|
5
|
+
#
|
|
6
|
+
# Compatible with Python2.6 and above.
|
|
7
|
+
#
|
|
8
|
+
|
|
9
|
+
info = (
|
|
10
|
+
"diStorm3 by Gil Dabah, https://github.com/gdabah/distorm/\n"
|
|
11
|
+
"Based on diStorm64 Python binding by Mario Vilas, http://breakingcode.wordpress.com/\n"
|
|
12
|
+
)
|
|
13
|
+
|
|
14
|
+
__revision__ = "$Id: distorm.py 186 2010-05-01 14:20:41Z gdabah $"
|
|
15
|
+
|
|
16
|
+
__all__ = [
|
|
17
|
+
'Decode',
|
|
18
|
+
'DecodeGenerator',
|
|
19
|
+
'Decompose',
|
|
20
|
+
'DecomposeGenerator',
|
|
21
|
+
'Decode16Bits',
|
|
22
|
+
'Decode32Bits',
|
|
23
|
+
'Decode64Bits',
|
|
24
|
+
'Mnemonics',
|
|
25
|
+
'Registers',
|
|
26
|
+
]
|
|
27
|
+
|
|
28
|
+
from ctypes import *
|
|
29
|
+
from os.path import split, join
|
|
30
|
+
from os import name as os_name
|
|
31
|
+
import sys
|
|
32
|
+
|
|
33
|
+
if sys.version_info[0] >= 3:
|
|
34
|
+
xrange = range
|
|
35
|
+
|
|
36
|
+
#==============================================================================
|
|
37
|
+
# Load the diStorm DLL
|
|
38
|
+
|
|
39
|
+
# Guess the DLL filename and load the library.
|
|
40
|
+
_distorm_path = split(__file__)[0]
|
|
41
|
+
if hasattr(sys, '_MEIPASS'):
|
|
42
|
+
_distorm_path = sys._MEIPASS
|
|
43
|
+
potential_libs = ['libdistorm3.so', 'libdistorm3.dylib']
|
|
44
|
+
if os_name == 'nt':
|
|
45
|
+
potential_libs = ['distorm3.dll', 'libdistorm3.dll']
|
|
46
|
+
lib_was_found = False
|
|
47
|
+
for i in potential_libs:
|
|
48
|
+
try:
|
|
49
|
+
_distorm_file = join(_distorm_path, i)
|
|
50
|
+
_distorm = cdll.LoadLibrary(_distorm_file)
|
|
51
|
+
lib_was_found = True
|
|
52
|
+
break
|
|
53
|
+
except OSError:
|
|
54
|
+
pass
|
|
55
|
+
|
|
56
|
+
if lib_was_found == False:
|
|
57
|
+
raise ImportError("Error loading the diStorm dynamic library (or cannot load library into process).")
|
|
58
|
+
|
|
59
|
+
# Get the decode C function (try 64 bits version first, only then 32 bits).
|
|
60
|
+
SUPPORT_64BIT_OFFSET = False
|
|
61
|
+
try:
|
|
62
|
+
internal_decode = _distorm.distorm_decode64
|
|
63
|
+
internal_decompose = _distorm.distorm_decompose64
|
|
64
|
+
internal_format = _distorm.distorm_format64
|
|
65
|
+
SUPPORT_64BIT_OFFSET = True
|
|
66
|
+
except AttributeError:
|
|
67
|
+
try:
|
|
68
|
+
internal_decode = _distorm.distorm_decode32
|
|
69
|
+
internal_decompose = _distorm.distorm_decompose32
|
|
70
|
+
internal_format = _distorm.distorm_format32
|
|
71
|
+
except AttributeError:
|
|
72
|
+
raise ImportError("Error loading distorm")
|
|
73
|
+
|
|
74
|
+
#==============================================================================
|
|
75
|
+
# diStorm C interface
|
|
76
|
+
|
|
77
|
+
MAX_TEXT_SIZE = 48 # See distorm.h for this value.
|
|
78
|
+
MAX_INSTRUCTIONS = 1000
|
|
79
|
+
|
|
80
|
+
DECRES_NONE = 0
|
|
81
|
+
DECRES_SUCCESS = 1
|
|
82
|
+
DECRES_MEMORYERR = 2
|
|
83
|
+
DECRES_INPUTERR = 3
|
|
84
|
+
|
|
85
|
+
if SUPPORT_64BIT_OFFSET:
|
|
86
|
+
_OffsetType = c_ulonglong
|
|
87
|
+
else:
|
|
88
|
+
_OffsetType = c_uint
|
|
89
|
+
|
|
90
|
+
class _WString (Structure):
|
|
91
|
+
_fields_ = [
|
|
92
|
+
('length', c_uint),
|
|
93
|
+
('p', c_char * MAX_TEXT_SIZE),
|
|
94
|
+
]
|
|
95
|
+
|
|
96
|
+
class _CodeInfo (Structure):
|
|
97
|
+
_fields_ = [
|
|
98
|
+
('codeOffset', _OffsetType),
|
|
99
|
+
('nextOffset', _OffsetType),
|
|
100
|
+
('code', c_char_p),
|
|
101
|
+
('codeLen', c_int),
|
|
102
|
+
('dt', c_byte),
|
|
103
|
+
('features', c_uint),
|
|
104
|
+
]
|
|
105
|
+
|
|
106
|
+
class _DecodedInst (Structure):
|
|
107
|
+
_fields_ = [
|
|
108
|
+
('mnemonic', _WString),
|
|
109
|
+
('operands', _WString),
|
|
110
|
+
('instructionHex', _WString),
|
|
111
|
+
('size', c_uint),
|
|
112
|
+
('offset', _OffsetType),
|
|
113
|
+
]
|
|
114
|
+
|
|
115
|
+
# _OperandType enum
|
|
116
|
+
_OperandType = c_ubyte
|
|
117
|
+
|
|
118
|
+
O_NONE = 0
|
|
119
|
+
O_REG = 1
|
|
120
|
+
O_IMM = 2
|
|
121
|
+
O_IMM1 = 3
|
|
122
|
+
O_IMM2 = 4
|
|
123
|
+
O_DISP = 5
|
|
124
|
+
O_SMEM = 6
|
|
125
|
+
O_MEM = 7
|
|
126
|
+
O_PC = 8
|
|
127
|
+
O_PTR = 9
|
|
128
|
+
|
|
129
|
+
class _Operand (Structure):
|
|
130
|
+
_fields_ = [
|
|
131
|
+
('type', c_ubyte), # of type _OperandType
|
|
132
|
+
('index', c_ubyte),
|
|
133
|
+
('size', c_uint16),
|
|
134
|
+
]
|
|
135
|
+
|
|
136
|
+
class _ex (Structure):
|
|
137
|
+
_fields_ = [
|
|
138
|
+
('i1', c_uint32),
|
|
139
|
+
('i2', c_uint32),
|
|
140
|
+
]
|
|
141
|
+
class _ptr (Structure):
|
|
142
|
+
_fields_ = [
|
|
143
|
+
('seg', c_uint16),
|
|
144
|
+
('off', c_uint32),
|
|
145
|
+
]
|
|
146
|
+
|
|
147
|
+
class _Value (Union):
|
|
148
|
+
_fields_ = [
|
|
149
|
+
('sbyte', c_byte),
|
|
150
|
+
('byte', c_ubyte),
|
|
151
|
+
('sword', c_int16),
|
|
152
|
+
('word', c_uint16),
|
|
153
|
+
('sdword', c_int32),
|
|
154
|
+
('dword', c_uint32),
|
|
155
|
+
('sqword', c_int64),
|
|
156
|
+
('qword', c_uint64),
|
|
157
|
+
('addr', _OffsetType),
|
|
158
|
+
('ptr', _ptr),
|
|
159
|
+
('ex', _ex),
|
|
160
|
+
]
|
|
161
|
+
|
|
162
|
+
class _DInst (Structure):
|
|
163
|
+
_fields_ = [
|
|
164
|
+
('imm', _Value),
|
|
165
|
+
('disp', c_uint64), # displacement. size is according to dispSize
|
|
166
|
+
('addr', _OffsetType),
|
|
167
|
+
('flags', c_uint16), # -1 if invalid. See C headers for more info
|
|
168
|
+
('unusedPrefixesMask', c_uint16),
|
|
169
|
+
('usedRegistersMask', c_uint32), # used registers mask.
|
|
170
|
+
('opcode', c_uint16), # look up in opcode table
|
|
171
|
+
('ops', _Operand*4),
|
|
172
|
+
('size', c_ubyte),
|
|
173
|
+
('segment', c_ubyte), # -1 if unused. See C headers for more info
|
|
174
|
+
('base', c_ubyte), # base register for indirections
|
|
175
|
+
('scale', c_ubyte), # ignore for values 0, 1 (other valid values - 2,4,8)
|
|
176
|
+
('dispSize', c_ubyte),
|
|
177
|
+
('meta', c_ubyte), # meta flags - instruction set class, etc. See C headers again...
|
|
178
|
+
('modifiedFlagsMask', c_uint16), # CPU modified (output) flags by instruction.
|
|
179
|
+
('testedFlagsMask', c_uint16), # CPU tested (input) flags by instruction.
|
|
180
|
+
('undefinedFlagsMask', c_uint16) # CPU undefined flags by instruction.
|
|
181
|
+
]
|
|
182
|
+
|
|
183
|
+
#==============================================================================
|
|
184
|
+
# diStorm Python interface
|
|
185
|
+
|
|
186
|
+
Decode16Bits = 0 # 80286 decoding
|
|
187
|
+
Decode32Bits = 1 # IA-32 decoding
|
|
188
|
+
Decode64Bits = 2 # AMD64 decoding
|
|
189
|
+
OffsetTypeSize = sizeof(_OffsetType)
|
|
190
|
+
|
|
191
|
+
Mnemonics = {
|
|
192
|
+
0x679: "SLDT", 0x62: "POPA", 0x904: "UNPCKHPS", 0x115: "POPF", 0x11cf: "CMPLTSS",
|
|
193
|
+
0x875: "VMOVSD", 0x79f: "PFPNACC", 0xb2a: "VMOVMSKPD", 0x74d: "INVLPGA", 0x90e: "UNPCKHPD",
|
|
194
|
+
0x270: "SYSEXIT", 0x7c8: "PFSUB", 0x121e: "CMPLTSD", 0x1a73: "VPMULHUW", 0x1d4b: "VPHSUBSW",
|
|
195
|
+
0x12c8: "VCMPNGEPS", 0x86d: "VMOVSS", 0x6f: "ARPL", 0x53a: "FICOMP", 0x162: "RETF",
|
|
196
|
+
0x45d: "FCHS", 0x113a: "CMPLEPS", 0xf08: "PUNPCKHDQ", 0x2417: "VAESDEC", 0x5fe: "FUCOM",
|
|
197
|
+
0x12b0: "VCMPORDPS", 0x19c1: "PSUBUSW", 0x1b5b: "PXOR", 0x1e25: "VPABSB", 0x24a: "WRMSR",
|
|
198
|
+
0x12bb: "VCMPEQ_UQPS", 0x22cc: "VFMADDSUB231PD", 0x7df: "PFMAX", 0x16e3: "VCMPNEQ_OSSS",
|
|
199
|
+
0x225a: "VFNMADD213PD", 0x3b8: "MOVNTI", 0x7d6: "PFCMPGT", 0x2380: "VFNMADD231SS",
|
|
200
|
+
0x2466: "ROUNDPD", 0x1303: "VCMPGTPS", 0xbb5: "VRCPSS", 0x2150: "VFNMADD132SS",
|
|
201
|
+
0x145a: "VCMPNGEPD", 0x2225: "VFMSUB213PD", 0x1875: "VCMPNEQ_OSSD", 0x2695: "VPSLLDQ",
|
|
202
|
+
0x7a8: "PFCMPGE", 0x1495: "VCMPGTPD", 0x1a99: "CVTDQ2PD", 0x1227: "CMPLESD",
|
|
203
|
+
0xae: "JNS", 0xdee: "VDIVSD", 0xb7: "JNP", 0x251e: "EXTRACTPS", 0x1f59: "PMOVZXBQ",
|
|
204
|
+
0x9c: "JNZ", 0x5e8: "FCOMI", 0xefc: "VPUNPCKHWD", 0x1f44: "PMOVZXBD", 0x1ae0: "VMOVNTDQ",
|
|
205
|
+
0x1e8a: "PMOVSXWD", 0x1108: "POPCNT", 0x8a: "JNO", 0x1ca5: "FNSAVE", 0x1a5: "LOOP",
|
|
206
|
+
0xb1f: "VMOVMSKPS", 0x47b: "FLDL2T", 0x12d: "CMPS", 0x418: "FSUB", 0xdba: "DIVPS",
|
|
207
|
+
0x1d31: "PHSUBD", 0x11c6: "CMPEQSS", 0x1e7: "CMC", 0xd15: "CVTTPS2DQ", 0xdc1: "DIVPD",
|
|
208
|
+
0xf72: "VMOVD", 0x104: "CALL FAR", 0x1d88: "PMULHRSW", 0x1d92: "VPMULHRSW",
|
|
209
|
+
0x1d20: "PHSUBW", 0x1215: "CMPEQSD", 0x3b2: "XADD", 0x2ae: "CMOVBE", 0x47: "CMP",
|
|
210
|
+
0x24: "SBB", 0x1084: "VHADDPS", 0x26c3: "FXRSTOR64", 0x207a: "INVVPID", 0x20f: "LSL",
|
|
211
|
+
0x1673: "VCMPNEQ_USSS", 0x107b: "VHADDPD", 0x38b: "LSS", 0x210d: "VFMSUB132PD",
|
|
212
|
+
0x121: "LAHF", 0x802: "PFACC", 0x819: "PFRCPIT2", 0xe3d: "VPUNPCKLBW", 0x7e6: "PFRCPIT1",
|
|
213
|
+
0x1fad: "PCMPGTQ", 0x4af: "FYL2X", 0x182f: "VCMPORD_SSD", 0x1949: "PSRLD",
|
|
214
|
+
0x10f7: "SFENCE", 0xd0b: "CVTPS2DQ", 0x24c5: "PBLENDW", 0x21c4: "VFMSUBADD213PS",
|
|
215
|
+
0xe8c: "PCMPGTB", 0xeb2: "PCMPGTD", 0x23ed: "VAESENC", 0x96d: "VMOVSHDUP",
|
|
216
|
+
0x25b2: "MPSADBW", 0x14fd: "VCMPNLE_UQPD", 0x720: "VMMCALL", 0x1045: "INSERTQ",
|
|
217
|
+
0x2268: "VFNMADD213SS", 0x9d5: "CVTPI2PD", 0x16f: "INT", 0x1d9d: "VPERMILPS",
|
|
218
|
+
0x1e2: "HLT", 0x2059: "PHMINPOSUW", 0x5c1: "FCMOVNU", 0x2083: "INVPCID", 0x7b: "INS",
|
|
219
|
+
0x657: "FCOMIP", 0x9cb: "CVTPI2PS", 0x2276: "VFNMADD213SD", 0xec5: "PACKUSWB",
|
|
220
|
+
0xe4: "CBW", 0x731: "VMSAVE", 0x10e: "PUSHF", 0x65f: "NOT", 0x5a5: "FCMOVNB",
|
|
221
|
+
0x245: "NOP", 0x4f8: "FSQRT", 0x1da8: "VPERMILPD", 0x51: "INC", 0x239: "UD2",
|
|
222
|
+
0xffd: "VPCMPEQW", 0x262b: "PCMPISTRM", 0x1ee3: "VPCMPEQQ", 0x1163: "CMPNLEPS",
|
|
223
|
+
0x183c: "VCMPEQ_USSD", 0x1414: "VCMPUNORDPD", 0x60d: "FADDP", 0x145: "RET",
|
|
224
|
+
0x1010: "VPCMPEQD", 0x1fd9: "VPMINSD", 0x2558: "VPINSRB", 0xfea: "VPCMPEQB",
|
|
225
|
+
0x1910: "ADDSUBPD", 0x22bc: "VFMADDSUB231PS", 0x16aa: "VCMPEQ_USSS", 0x1d66: "PSIGNW",
|
|
226
|
+
0x1ebe: "VPMOVSXDQ", 0x201d: "VPMAXSD", 0x35b: "SETG", 0x200c: "VPMAXSB", 0x327: "SETA",
|
|
227
|
+
0x306: "SETB", 0x26f5: "STMXCSR", 0x347: "SETL", 0x1acf: "MOVNTQ", 0x2f9: "SETO",
|
|
228
|
+
0xbe3: "ANDNPD", 0x111c: "BSR", 0x8d0: "VMOVDDUP", 0x1b52: "VPMAXSW", 0x1d77: "PSIGND",
|
|
229
|
+
0x33a: "SETP", 0x1d55: "PSIGNB", 0x395: "LFS", 0x32d: "SETS", 0x15a6: "VCMPUNORDSS",
|
|
230
|
+
0xbdb: "ANDNPS", 0x2724: "VMXON", 0xbcb: "VANDPS", 0x703: "XSETBV", 0x1c3: "OUT",
|
|
231
|
+
0x68a: "LTR", 0x2586: "VPINSRD", 0x1115: "TZCNT", 0xa6d: "VCVTTSS2SI", 0x2684: "VPSRLDQ",
|
|
232
|
+
0x4d6: "FDECSTP", 0x267c: "PSRLDQ", 0x1883: "VCMPGE_OQSD", 0x268d: "PSLLDQ",
|
|
233
|
+
0x51f: "FCOS", 0x4c5: "FXTRACT", 0x16f1: "VCMPGE_OQSS", 0x1ef7: "VMOVNTDQA",
|
|
234
|
+
0x1533: "VCMPNGT_UQPD", 0x405: "FMUL", 0x13da: "VCMPGT_OQPS", 0x61b: "FCOMPP",
|
|
235
|
+
0x790: "PF2ID", 0xf5: "CWD", 0x1340: "VCMPUNORD_SPS", 0x2ea: "CMOVLE", 0xfcd: "VPSHUFHW",
|
|
236
|
+
0x156c: "VCMPGT_OQPD", 0x1cf6: "PHADDSW", 0x789: "PF2IW", 0xa37: "VMOVNTPD",
|
|
237
|
+
0x411: "FCOMP", 0x8da: "UNPCKLPS", 0x1be5: "MASKMOVDQU", 0x570: "FCMOVBE",
|
|
238
|
+
0x14b8: "VCMPLT_OQPD", 0xe2a: "VMAXSD", 0x142c: "VCMPNLTPD", 0x99d: "PREFETCHT2",
|
|
239
|
+
0x991: "PREFETCHT1", 0x985: "PREFETCHT0", 0x8e4: "UNPCKLPD", 0xa57: "CVTTSS2SI",
|
|
240
|
+
0x66e: "DIV", 0x1eb4: "PMOVSXDQ", 0x161d: "VCMPGESS", 0xef: "CDQE", 0x2708: "VSTMXCSR",
|
|
241
|
+
0x549: "FISUBR", 0x1fc8: "VPMINSB", 0x2218: "VFMSUB213PS", 0x1326: "VCMPLT_OQPS",
|
|
242
|
+
0x11d8: "CMPLESS", 0x1b14: "VPMINSW", 0x1c70: "FSTENV", 0x17af: "VCMPGESD",
|
|
243
|
+
0x1dea: "VPTEST", 0x542: "FISUB", 0x205: "STD", 0xf29: "VPACKSSDW", 0x3d: "XOR",
|
|
244
|
+
0xc95: "VMULPD", 0x1f1: "STC", 0x1fb: "STI", 0x26d8: "LDMXCSR", 0x1180: "CMPLTPD",
|
|
245
|
+
0xbfd: "ORPS", 0x1f0c: "VPACKUSDW", 0x62b: "FSUBP", 0x67f: "STR", 0x41e: "FSUBR",
|
|
246
|
+
0x1131: "CMPLTPS", 0x2323: "VFMADD231SD", 0x2733: "PAUSE", 0x1aa3: "CVTPD2DQ",
|
|
247
|
+
0x372: "RSM", 0xb70: "VSQRTSD", 0xc09: "VORPS", 0x21a4: "VFMADDSUB213PS", 0x23e5: "AESENC",
|
|
248
|
+
0x144d: "VCMPEQ_UQPD", 0x918: "VUNPCKHPS", 0x1d09: "PMADDUBSW", 0x136b: "VCMPNLE_UQPS",
|
|
249
|
+
0x1b7e: "VPSLLW", 0x1bdb: "MASKMOVQ", 0x1c8: "CALL", 0xb67: "VSQRTSS", 0x19f2: "PADDUSB",
|
|
250
|
+
0x1036: "VMREAD", 0x10eb: "XSAVEOPT64", 0x923: "VUNPCKHPD", 0xd5e: "VSUBPS",
|
|
251
|
+
0xceb: "VCVTSS2SD", 0x242c: "VAESDECLAST", 0x1095: "HSUBPS", 0xaad: "VCVTSS2SI",
|
|
252
|
+
0x25f2: "VPBLENDVB", 0x17b9: "VCMPGTSD", 0x58a: "FILD", 0xaf9: "VCOMISS", 0x108d: "HSUBPD",
|
|
253
|
+
0x23b8: "VFNMSUB231SS", 0x1a53: "VPSRAD", 0x12a5: "VCMPNLEPS", 0x3e5: "SAL",
|
|
254
|
+
0x214: "SYSCALL", 0xb95: "VRSQRTSS", 0x258f: "VPINSRQ", 0x26fe: "WRGSBASE",
|
|
255
|
+
0xfc4: "VPSHUFD", 0x1e4b: "PMOVSXBW", 0x1a44: "VPSRAW", 0x1437: "VCMPNLEPD",
|
|
256
|
+
0x3ff: "FADD", 0x3ea: "SAR", 0x713: "XEND", 0x2659: "AESKEYGENASSIST", 0xf1f: "PACKSSDW",
|
|
257
|
+
0x21fe: "VFMADD213SS", 0xf90: "VMOVDQA", 0x8c5: "VMOVSLDUP", 0x508: "FRNDINT",
|
|
258
|
+
0x1976: "PMULLW", 0xdcf: "DIVSD", 0xb0b: "MOVMSKPS", 0x202e: "VPMAXUW", 0xdde: "VDIVPD",
|
|
259
|
+
0x1e55: "VPMOVSXBW", 0x1e9f: "PMOVSXWQ", 0x2048: "PMULLD", 0xf99: "VMOVDQU",
|
|
260
|
+
0x22ae: "VFNMSUB213SD", 0x297: "CMOVAE", 0x14ab: "VCMPEQ_OSPD", 0xdd6: "VDIVPS",
|
|
261
|
+
0x93: "JAE", 0xb15: "MOVMSKPD", 0xdc8: "DIVSS", 0x1cad: "FSAVE", 0x1eda: "PCMPEQQ",
|
|
262
|
+
0xfd7: "VPSHUFLW", 0xff4: "PCMPEQW", 0x26eb: "VLDMXCSR", 0x211a: "VFMSUB132SS",
|
|
263
|
+
0x11bc: "CMPORDPD", 0xba6: "RCPSS", 0x1b8d: "VPSLLD", 0x673: "IDIV", 0x1442: "VCMPORDPD",
|
|
264
|
+
0xfe1: "PCMPEQB", 0x1007: "PCMPEQD", 0x1b9c: "VPSLLQ", 0x1f63: "VPMOVZXBQ",
|
|
265
|
+
0x21d4: "VFMSUBADD213PD", 0x25e7: "VBLENDVPD", 0x116d: "CMPORDPS", 0xf34: "PUNPCKLQDQ",
|
|
266
|
+
0x19eb: "VPAND", 0x147d: "VCMPNEQ_OQPD", 0x106b: "HADDPD", 0x192f: "VADDSUBPS",
|
|
267
|
+
0x18e7: "VSHUFPD", 0xd76: "VSUBSD", 0xb55: "VSQRTPS", 0x947: "MOVSHDUP", 0x238e: "VFNMADD231SD",
|
|
268
|
+
0x6cf: "VMLAUNCH", 0x1f23: "VMASKMOVPD", 0x1073: "HADDPS", 0x12eb: "VCMPNEQ_OQPS",
|
|
269
|
+
0xe49: "PUNPCKLWD", 0x16c5: "VCMPNGT_UQSS", 0xb5e: "VSQRTPD", 0xd6e: "VSUBSS",
|
|
270
|
+
0x18de: "VSHUFPS", 0x15b3: "VCMPNEQSS", 0x1b6f: "VLDDQU", 0x164a: "VCMPLT_OQSS",
|
|
271
|
+
0x2740: "RDRAND", 0x1b39: "PADDSW", 0x1386: "VCMPEQ_USPS", 0xc03: "ORPD", 0x1a1f: "PANDN",
|
|
272
|
+
0x4b6: "FPTAN", 0x551: "FIDIV", 0x17dc: "VCMPLT_OQSD", 0x2712: "VMPTRLD", 0x2330: "VFMSUB231PS",
|
|
273
|
+
0x1745: "VCMPNEQSD", 0x1ed1: "VPMULDQ", 0x196: "LOOPNZ", 0x1282: "VCMPUNORDPS",
|
|
274
|
+
0x3e0: "SHR", 0x37c: "SHRD", 0x6eb: "MONITOR", 0x3ef: "XABORT", 0x23f6: "AESENCLAST",
|
|
275
|
+
0x854: "MOVSD", 0x18b4: "VPINSRW", 0x729: "VMLOAD", 0x92e: "MOVLHPS", 0x8bc: "VMOVLPD",
|
|
276
|
+
0x1987: "MOVQ2DQ", 0xb45: "SQRTSS", 0x259e: "VDPPS", 0xd50: "SUBSS", 0x3ab: "MOVSX",
|
|
277
|
+
0x951: "VMOVLHPS", 0x8b3: "VMOVLPS", 0xf13: "VPUNPCKHDQ", 0x1ac4: "VCVTPD2DQ",
|
|
278
|
+
0x3db: "SHL", 0x84d: "MOVSS", 0x257e: "PINSRQ", 0x797: "PFNACC", 0xf88: "MOVDQU",
|
|
279
|
+
0x80: "OUTS", 0x1bfe: "PSUBB", 0x377: "BTS", 0x390: "BTR", 0x1805: "VCMPNEQ_USSD",
|
|
280
|
+
0x69b: "SGDT", 0x2316: "VFMADD231SS", 0x511: "FSCALE", 0x1c0d: "PSUBW", 0x11a8: "CMPNLTPD",
|
|
281
|
+
0x1f02: "PACKUSDW", 0x20a: "LAR", 0x3a6: "BTC", 0x215e: "VFNMADD132SD", 0x1465: "VCMPNGTPD",
|
|
282
|
+
0x1f39: "VPMOVZXBW", 0x2127: "VFMSUB132SD", 0x23d4: "AESIMC", 0x40b: "FCOM",
|
|
283
|
+
0x1f4e: "VPMOVZXBD", 0x1924: "VADDSUBPD", 0x1c9e: "FINIT", 0x120b: "CMPORDSS",
|
|
284
|
+
0x231: "WBINVD", 0x19e5: "PAND", 0x24e1: "VPALIGNR", 0x125a: "CMPORDSD", 0x1b61: "VPXOR",
|
|
285
|
+
0xa1: "JBE", 0x46f: "FXAM", 0x10e1: "XSAVEOPT", 0x669: "MUL", 0x19dc: "VPMINUB",
|
|
286
|
+
0x1b41: "VPADDSW", 0x1b4a: "PMAXSW", 0x256b: "VINSERTPS", 0x13f6: "VCMPEQPD",
|
|
287
|
+
0x5f7: "FFREE", 0x1f17: "VMASKMOVPS", 0x18f0: "CMPXCHG8B", 0x2015: "PMAXSD",
|
|
288
|
+
0x1b30: "VPADDSB", 0x10: "PUSH", 0x25d0: "VPCLMULQDQ", 0x1264: "VCMPEQPS",
|
|
289
|
+
0x7f0: "PFRSQIT1", 0x2453: "ROUNDPS", 0x2ff: "SETNO", 0x6fb: "XGETBV", 0x1fd1: "PMINSD",
|
|
290
|
+
0x1c3a: "PADDB", 0x4ce: "FPREM1", 0x200: "CLD", 0x52c: "FIMUL", 0xc1e: "XORPD",
|
|
291
|
+
0x1ec: "CLC", 0x43c: "FSTP", 0x24b2: "BLENDPD", 0x1a05: "PADDUSW", 0x1c96: "FNINIT",
|
|
292
|
+
0x319: "SETNZ", 0x1967: "PADDQ", 0xc17: "XORPS", 0x22a0: "VFNMSUB213SS", 0x333: "SETNS",
|
|
293
|
+
0x525: "FIADD", 0x340: "SETNP", 0xf59: "VPUNPCKHQDQ", 0xd42: "SUBPS", 0x1246: "CMPNLTSD",
|
|
294
|
+
0x684: "LLDT", 0x223f: "VFMSUB213SD", 0x1de3: "PTEST", 0x217a: "VFNMSUB132PD",
|
|
295
|
+
0x279: "GETSEC", 0x1d7f: "VPSIGND", 0x1ab: "JCXZ", 0x11f7: "CMPNLTSS", 0x34d: "SETGE",
|
|
296
|
+
0x1128: "CMPEQPS", 0x1bca: "PSADBW", 0x272b: "MOVSXD", 0x216c: "VFNMSUB132PS",
|
|
297
|
+
0x185: "AAD", 0x2402: "VAESENCLAST", 0xf4d: "PUNPCKHQDQ", 0x88e: "MOVLPD",
|
|
298
|
+
0x19fb: "VPADDUSW", 0x12de: "VCMPFALSEPS", 0x180: "AAM", 0xf40: "VPUNPCKLQDQ",
|
|
299
|
+
0xd8c: "MINSS", 0x1c58: "PADDD", 0x1470: "VCMPFALSEPD", 0xe54: "VPUNPCKLWD",
|
|
300
|
+
0x886: "MOVLPS", 0x73f: "CLGI", 0x4c: "AAS", 0x139: "LODS", 0x2d3: "CMOVNP",
|
|
301
|
+
0xd93: "MINSD", 0x1f6: "CLI", 0xa62: "CVTTSD2SI", 0x533: "FICOM", 0x1f2f: "PMOVZXBW",
|
|
302
|
+
0xc3c: "ADDPD", 0x770: "PREFETCHW", 0x134f: "VCMPNEQ_USPS", 0xc2d: "VXORPD",
|
|
303
|
+
0x1b1d: "POR", 0x16: "POP", 0x2447: "VPERM2F128", 0x19e: "LOOPZ", 0x1ad7: "MOVNTDQ",
|
|
304
|
+
0x1dc: "INT1", 0x382: "CMPXCHG", 0x1e0e: "VBROADCASTF128", 0x1525: "VCMPNGE_UQPD",
|
|
305
|
+
0x1cd4: "PHADDW", 0xc25: "VXORPS", 0x14e1: "VCMPNEQ_USPD", 0xc35: "ADDPS",
|
|
306
|
+
0x812: "PFMUL", 0x6a7: "LGDT", 0x68f: "VERR", 0x695: "VERW", 0x109d: "VHSUBPD",
|
|
307
|
+
0x197e: "VPMULLW", 0x85b: "VMOVUPS", 0x174: "INTO", 0x1c8f: "FCLEX", 0x10a6: "VHSUBPS",
|
|
308
|
+
0xccb: "CVTSD2SS", 0x48b: "FLDPI", 0x1e2d: "PABSW", 0xe1a: "VMAXPD", 0x1d3: "JMP FAR",
|
|
309
|
+
0xecf: "VPACKUSWB", 0x581: "FUCOMPP", 0x864: "VMOVUPD", 0x82c: "PSWAPD", 0x1c49: "PADDW",
|
|
310
|
+
0x1b86: "PSLLD", 0x756: "SWAPGS", 0x896: "MOVSLDUP", 0x9df: "CVTSI2SS", 0x17c3: "VCMPTRUESD",
|
|
311
|
+
0x11e1: "CMPUNORDSS", 0xd36: "VCVTTPS2DQ", 0xb4d: "SQRTSD", 0x1e00: "VBROADCASTSD",
|
|
312
|
+
0x1c1c: "PSUBD", 0xce: "TEST", 0x39a: "LGS", 0x1631: "VCMPTRUESS", 0x266: "SYSENTER",
|
|
313
|
+
0x9e9: "CVTSI2SD", 0x175b: "VCMPNLESD", 0x1dbc: "VTESTPD", 0x98: "JZ", 0xde6: "VDIVSS",
|
|
314
|
+
0xc10: "VORPD", 0xb3: "JP", 0xaa: "JS", 0xbc: "JL", 0xb82: "RSQRTSS", 0x1db3: "VTESTPS",
|
|
315
|
+
0x86: "JO", 0xe12: "VMAXPS", 0x19ae: "PSUBUSB", 0xca: "JG", 0x1df2: "VBROADCASTSS",
|
|
316
|
+
0xa6: "JA", 0x8f: "JB", 0xe9: "CWDE", 0x140a: "VCMPLEPD", 0x104e: "VMWRITE",
|
|
317
|
+
0x1278: "VCMPLEPS", 0x1999: "PMOVMSKB", 0x2561: "INSERTPS", 0x2614: "PCMPESTRI",
|
|
318
|
+
0x273a: "WAIT", 0x1541: "VCMPFALSE_OSPD", 0x25fd: "PCMPESTRM", 0xe60: "PUNPCKLDQ",
|
|
319
|
+
0xc7f: "MULSS", 0xd66: "VSUBPD", 0x1177: "CMPEQPD", 0x17a1: "VCMPNEQ_OQSD",
|
|
320
|
+
0xb02: "VCOMISD", 0xdaa: "VMINSS", 0x1c5f: "VPADDD", 0x258: "RDMSR", 0x1d6e: "VPSIGNW",
|
|
321
|
+
0x1b1: "JECXZ", 0xc86: "MULSD", 0x154: "ENTER", 0x2439: "MOVBE", 0x102c: "VZEROALL",
|
|
322
|
+
0x2748: "_3DNOW", 0xdb2: "VMINSD", 0x160f: "VCMPNEQ_OQSS", 0x7fa: "PFSUBR",
|
|
323
|
+
0x12f9: "VCMPGEPS", 0x19b7: "VPSUBUSB", 0x2357: "VFMSUB231SD", 0x2037: "PMAXUD",
|
|
324
|
+
0x269e: "FXSAVE", 0x590: "FISTTP", 0x148b: "VCMPGEPD", 0x249f: "BLENDPS", 0x172e: "VCMPLESD",
|
|
325
|
+
0x5b7: "FCMOVNBE", 0x234a: "VFMSUB231SS", 0x25dc: "VBLENDVPS", 0x25bb: "VMPSADBW",
|
|
326
|
+
0x19ca: "VPSUBUSW", 0x1724: "VCMPLTSD", 0x1eed: "MOVNTDQA", 0x18d6: "SHUFPD",
|
|
327
|
+
0xd49: "SUBPD", 0xb3d: "SQRTPD", 0x964: "VMOVHPD", 0x6c7: "VMCALL", 0x20d9: "VFMADD132PD",
|
|
328
|
+
0x15b: "LEAVE", 0x18ce: "SHUFPS", 0x1319: "VCMPEQ_OSPS", 0x261f: "VPCMPESTRI",
|
|
329
|
+
0x1592: "VCMPLTSS", 0x2608: "VPCMPESTRM", 0x20cc: "VFMADD132PS", 0x6ad: "LIDT",
|
|
330
|
+
0x4a8: "F2XM1", 0x95b: "VMOVHPS", 0x1f98: "PMOVZXDQ", 0x1020: "VZEROUPPER",
|
|
331
|
+
0xb35: "SQRTPS", 0xbeb: "VANDNPS", 0x196e: "VPADDQ", 0x4e8: "FPREM", 0x1c50: "VPADDW",
|
|
332
|
+
0x24d8: "PALIGNR", 0x1fc0: "PMINSB", 0xe9f: "PCMPGTW", 0x36c: "SHLD", 0x14f: "LDS",
|
|
333
|
+
0x1c41: "VPADDB", 0x719: "VMRUN", 0x26b0: "RDFSBASE", 0xbf4: "VANDNPD", 0x190: "XLAT",
|
|
334
|
+
0xd4: "XCHG", 0x4df: "FINCSTP", 0x1990: "MOVDQ2Q", 0x1b0c: "PMINSW", 0x6b3: "SMSW",
|
|
335
|
+
0x1d5d: "VPSIGNB", 0x10c7: "XRSTOR", 0x24bb: "VBLENDPD", 0xc0: "JGE", 0x135d: "VCMPNLT_UQPS",
|
|
336
|
+
0x1766: "VCMPORDSD", 0x24a8: "VBLENDPS", 0x469: "FTST", 0x1a8e: "CVTTPD2DQ",
|
|
337
|
+
0x15d4: "VCMPORDSS", 0x14ef: "VCMPNLT_UQPD", 0x2188: "VFNMSUB132SS", 0x10cf: "XRSTOR64",
|
|
338
|
+
0x29: "AND", 0xb8b: "VRSQRTPS", 0x10ff: "CLFLUSH", 0x1cc3: "PSHUFB", 0x442: "FLDENV",
|
|
339
|
+
0xda: "MOV", 0xfaa: "PSHUFD", 0xc5: "JLE", 0x5d0: "FEDISI", 0x70b: "VMFUNC",
|
|
340
|
+
0xea8: "VPCMPGTW", 0x809: "PFCMPEQ", 0x169d: "VCMPORD_SSS", 0xfa2: "PSHUFW",
|
|
341
|
+
0x24f3: "VPEXTRB", 0x1ab9: "VCVTDQ2PD", 0xf79: "VMOVQ", 0x483: "FLDL2E", 0x250c: "VPEXTRD",
|
|
342
|
+
0x1d28: "VPHSUBW", 0x2284: "VFNMSUB213PS", 0x21f1: "VFMADD213PD", 0x739: "STGI",
|
|
343
|
+
0x4bd: "FPATAN", 0x2515: "VPEXTRQ", 0x437: "FST", 0x168: "INT 3", 0x598: "FIST",
|
|
344
|
+
0x271b: "VMCLEAR", 0x1e75: "PMOVSXBQ", 0x42: "AAA", 0x1d39: "VPHSUBD", 0xa41: "CVTTPS2PI",
|
|
345
|
+
0x114f: "CMPNEQPS", 0x155f: "VCMPGE_OQPD", 0x1b68: "LDDQU", 0xb79: "RSQRTPS",
|
|
346
|
+
0xc59: "VADDPD", 0x7b8: "PFRCP", 0xcc1: "CVTSS2SD", 0x2196: "VFNMSUB132SD",
|
|
347
|
+
0x632: "FDIVRP", 0x641: "FBLD", 0x361: "CPUID", 0x251: "RDTSC", 0x24ce: "VPBLENDW",
|
|
348
|
+
0xd2b: "VCVTPS2DQ", 0x1b22: "VPOR", 0xc51: "VADDPS", 0x77b: "PI2FW", 0xd7e: "MINPS",
|
|
349
|
+
0x17cf: "VCMPEQ_OSSD", 0x1bad: "VPMULUDQ", 0xe0b: "MAXSD", 0x2050: "VPMULLD",
|
|
350
|
+
0x558: "FIDIVR", 0xad5: "VUCOMISS", 0x8a0: "MOVDDUP", 0x1ccb: "VPSHUFB", 0x1d42: "PHSUBSW",
|
|
351
|
+
0x264d: "VPCMPISTRI", 0xe04: "MAXSS", 0x1a35: "VPAVGB", 0x16d3: "VCMPFALSE_OSSS",
|
|
352
|
+
0xd85: "MINPD", 0x4ef: "FYL2XP1", 0xadf: "VUCOMISD", 0x23aa: "VFNMSUB231PD",
|
|
353
|
+
0x1849: "VCMPNGE_UQSD", 0xc4a: "ADDSD", 0x6e3: "VMXOFF", 0x1958: "PSRLQ", 0x128f: "VCMPNEQPS",
|
|
354
|
+
0x193a: "PSRLW", 0x1a4c: "PSRAD", 0x6a1: "SIDT", 0xe77: "PACKSSWB", 0x10af: "XSAVE",
|
|
355
|
+
0x1421: "VCMPNEQPD", 0xfa: "CDQ", 0xc43: "ADDSS", 0x16b7: "VCMPNGE_UQSS", 0x2440: "CRC32",
|
|
356
|
+
0x23dc: "VAESIMC", 0x2004: "PMAXSB", 0x2529: "VEXTRACTPS", 0x1813: "VCMPNLT_UQSD",
|
|
357
|
+
0x1c05: "VPSUBB", 0x1f8d: "VPMOVZXWQ", 0x13bf: "VCMPNEQ_OSPS", 0xa1b: "MOVNTSS",
|
|
358
|
+
0x2542: "VEXTRACTF128", 0x1b28: "PADDSB", 0x75: "IMUL", 0x3d6: "RCR", 0x14d2: "VCMPUNORD_SPD",
|
|
359
|
+
0x3d1: "RCL", 0xa24: "MOVNTSD", 0x1551: "VCMPNEQ_OSPD", 0x1681: "VCMPNLT_UQSS",
|
|
360
|
+
0xd57: "SUBSD", 0x13f: "SCAS", 0x25c5: "PCLMULQDQ", 0x7bf: "PFRSQRT", 0x2576: "PINSRD",
|
|
361
|
+
0x623: "FSUBRP", 0x5b: "PUSHA", 0x1a16: "VPMAXUB", 0x1143: "CMPUNORDPS", 0x203f: "VPMAXUD",
|
|
362
|
+
0x463: "FABS", 0x1e7f: "VPMOVSXBQ", 0x149f: "VCMPTRUEPD", 0x23e: "FEMMS", 0x163d: "VCMPEQ_OSSS",
|
|
363
|
+
0x220b: "VFMADD213SD", 0x1e6a: "VPMOVSXBD", 0x1192: "CMPUNORDPD", 0x1907: "VMPTRST",
|
|
364
|
+
0x18fb: "CMPXCHG16B", 0x130d: "VCMPTRUEPS", 0x12d3: "VCMPNGTPS", 0x1c87: "FNCLEX",
|
|
365
|
+
0x123c: "CMPNEQSD", 0x1771: "VCMPEQ_UQSD", 0x579: "FCMOVU", 0x103e: "EXTRQ",
|
|
366
|
+
0x25a5: "DPPD", 0x2e2: "CMOVGE", 0x2550: "PINSRB", 0x15df: "VCMPEQ_UQSS", 0x1d14: "VPMADDUBSW",
|
|
367
|
+
0x11ed: "CMPNEQSS", 0x2309: "VFMADD231PD", 0x519: "FSIN", 0x1bf: "IN", 0x568: "FCMOVE",
|
|
368
|
+
0x44a: "FLDCW", 0x2598: "DPPS", 0x560: "FCMOVB", 0x1941: "VPSRLW", 0x10bf: "LFENCE",
|
|
369
|
+
0xaa3: "CVTSD2SI", 0x30c: "SETAE", 0x2a6: "CMOVNZ", 0x195f: "VPSRLQ", 0x614: "FMULP",
|
|
370
|
+
0x9c2: "VMOVAPD", 0x1657: "VCMPLE_OQSS", 0x2c4: "CMOVNS", 0x5ae: "FCMOVNE",
|
|
371
|
+
0x288: "CMOVNO", 0x1a85: "VPMULHW", 0x1950: "VPSRLD", 0x1061: "CVTPS2PH", 0xa85: "CVTPS2PI",
|
|
372
|
+
0x1ce5: "PHADDD", 0xcad: "CVTPS2PD", 0x1e34: "VPABSW", 0x17e9: "VCMPLE_OQSD",
|
|
373
|
+
0x9b9: "VMOVAPS", 0x1c14: "VPSUBW", 0x823: "PMULHRW", 0x9a9: "MOVAPS", 0x7b1: "PFMIN",
|
|
374
|
+
0xf66: "MOVD", 0x937: "MOVHPS", 0xc71: "MULPS", 0x126e: "VCMPLTPS", 0x368: "BT",
|
|
375
|
+
0x9b1: "MOVAPD", 0x1393: "VCMPNGE_UQPS", 0x1b8: "JRCXZ", 0xc78: "MULPD", 0x127: "MOVS",
|
|
376
|
+
0x6bf: "INVLPG", 0xf6c: "MOVQ", 0xda2: "VMINPD", 0x1e3c: "PABSD", 0x11b: "SAHF",
|
|
377
|
+
0x13e7: "VCMPTRUE_USPS", 0x782: "PI2FD", 0x1e1e: "PABSB", 0x2495: "VROUNDSD",
|
|
378
|
+
0x1a26: "VPANDN", 0xe6b: "VPUNPCKLDQ", 0x63a: "FDIVP", 0x1c2b: "PSUBQ", 0x42b: "FDIVR",
|
|
379
|
+
0x425: "FDIV", 0x1579: "VCMPTRUE_USPD", 0x766: "PREFETCH", 0x101a: "EMMS",
|
|
380
|
+
0xd9a: "VMINPS", 0x22fc: "VFMADD231PS", 0x2292: "VFNMSUB213PD", 0xa99: "CVTSS2SI",
|
|
381
|
+
0x93f: "MOVHPD", 0x29f: "CMOVZ", 0x1a62: "VPAVGW", 0xff: "CQO", 0x1c23: "VPSUBD",
|
|
382
|
+
0x2cc: "CMOVP", 0x1588: "VCMPEQSS", 0x2bd: "CMOVS", 0x1e60: "PMOVSXBD", 0x2482: "VROUNDSS",
|
|
383
|
+
0x1c32: "VPSUBQ", 0x2db: "CMOVL", 0x191a: "ADDSUBPS", 0x281: "CMOVO", 0x2b6: "CMOVA",
|
|
384
|
+
0x290: "CMOVB", 0xeda: "PUNPCKHBW", 0x2642: "PCMPISTRI", 0x2f2: "CMOVG", 0x19a3: "VPMOVMSKB",
|
|
385
|
+
0x2420: "AESDECLAST", 0x845: "MOVUPD", 0x20bc: "VFMSUBADD132PD", 0x1bd2: "VPSADBW",
|
|
386
|
+
0x3f7: "XBEGIN", 0x246f: "VROUNDPD", 0x6b9: "LMSW", 0x2072: "INVEPT", 0x39f: "MOVZX",
|
|
387
|
+
0xbbd: "ANDPS", 0x20ac: "VFMSUBADD132PS", 0x83d: "MOVUPS", 0x1627: "VCMPGTSS",
|
|
388
|
+
0x1a6a: "PMULHUW", 0x25ab: "VDPPD", 0x24fc: "PEXTRD", 0x1602: "VCMPFALSESS",
|
|
389
|
+
0x26ce: "RDGSBASE", 0x1b: "OR", 0x18c5: "VPEXTRW", 0x1af2: "VPSUBSB", 0x26ba: "FXRSTOR",
|
|
390
|
+
0x21d: "CLTS", 0x1857: "VCMPNGT_UQSD", 0x15f7: "VCMPNGTSS", 0x5ef: "FRSTOR",
|
|
391
|
+
0x1794: "VCMPFALSESD", 0x49a: "FLDLN2", 0x2535: "VINSERTF128", 0x1b03: "VPSUBSW",
|
|
392
|
+
0x1ba4: "PMULUDQ", 0x56: "DEC", 0x13af: "VCMPFALSE_OSPS", 0x432: "FLD", 0x1fa2: "VPMOVZXDQ",
|
|
393
|
+
0x2479: "ROUNDSS", 0x9f3: "VCVTSI2SS", 0x18bd: "PEXTRW", 0x26a6: "FXSAVE64",
|
|
394
|
+
0x3c7: "ROL", 0x20f3: "VFMADD132SD", 0x1189: "CMPLEPD", 0xcf6: "VCVTSD2SS",
|
|
395
|
+
0x605: "FUCOMP", 0x1ce: "JMP", 0x171a: "VCMPEQSD", 0xd01: "CVTDQ2PS", 0x16fe: "VCMPGT_OQSS",
|
|
396
|
+
0x5e0: "FUCOMI", 0x1121: "LZCNT", 0xbad: "VRCPPS", 0x1a0e: "PMAXUB", 0x1ced: "VPHADDD",
|
|
397
|
+
0x9fe: "VCVTSI2SD", 0x1890: "VCMPGT_OQSD", 0x3cc: "ROR", 0x22b: "INVD", 0xab8: "VCVTSD2SI",
|
|
398
|
+
0x240f: "AESDEC", 0x1250: "CMPNLESD", 0x354: "SETLE", 0x22dc: "VFMSUBADD231PS",
|
|
399
|
+
0x2364: "VFNMADD231PS", 0x10b6: "XSAVE64", 0xef1: "PUNPCKHWD", 0x1e94: "VPMOVSXWD",
|
|
400
|
+
0xcb7: "CVTPD2PS", 0x8a9: "VMOVHLPS", 0x22ec: "VFMSUBADD231PD", 0xa8f: "CVTPD2PI",
|
|
401
|
+
0x1201: "CMPNLESS", 0x1ec9: "PMULDQ", 0x1ea9: "VPMOVSXWQ", 0x1750: "VCMPNLTSD",
|
|
402
|
+
0x2100: "VFMSUB132PS", 0x2372: "VFNMADD231PD", 0x1cbc: "FSTSW", 0x75e: "RDTSCP",
|
|
403
|
+
0x10d9: "MFENCE", 0x20e6: "VFMADD132SS", 0x1ff3: "PMINUD", 0x5ca: "FENI", 0x68: "BOUND",
|
|
404
|
+
0x245c: "VROUNDPS", 0xfbb: "PSHUFLW", 0xc9d: "VMULSS", 0x1865: "VCMPFALSE_OSSD",
|
|
405
|
+
0xd20: "VCVTDQ2PS", 0x159c: "VCMPLESS", 0x457: "FNOP", 0x1159: "CMPNLTPS",
|
|
406
|
+
0x129a: "VCMPNLTPS", 0x492: "FLDLG2", 0x223: "SYSRET", 0x1c80: "FSTCW", 0x2232: "VFMSUB213SS",
|
|
407
|
+
0x745: "SKINIT", 0xbd3: "VANDPD", 0x4a2: "FLDZ", 0x33: "SUB", 0x1cdc: "VPHADDW",
|
|
408
|
+
0x664: "NEG", 0x1fe2: "PMINUW", 0xdfd: "MAXPD", 0x1379: "VCMPORD_SPS", 0x133: "STOS",
|
|
409
|
+
0x23c6: "VFNMSUB231SD", 0x1738: "VCMPUNORDSD", 0x834: "PAVGUSB", 0x150b: "VCMPORD_SPD",
|
|
410
|
+
0xdf6: "MAXPS", 0x19d4: "PMINUB", 0x1bf1: "VMASKMOVDQU", 0x647: "FBSTP", 0x18ac: "PINSRW",
|
|
411
|
+
0x1f78: "VPMOVZXWD", 0x1fea: "VPMINUW", 0x1821: "VCMPNLE_UQSD", 0x18a: "SALC",
|
|
412
|
+
0x24eb: "PEXTRB", 0x8ee: "VUNPCKLPS", 0x168f: "VCMPNLE_UQSS", 0xf80: "MOVDQA",
|
|
413
|
+
0x15be: "VCMPNLTSS", 0x1b95: "PSLLQ", 0xa2d: "VMOVNTPS", 0x1ffb: "VPMINUD",
|
|
414
|
+
0x978: "PREFETCHNTA", 0x8f9: "VUNPCKLPD", 0x1057: "CVTPH2PS", 0x266a: "VAESKEYGENASSIST",
|
|
415
|
+
0x1afb: "PSUBSW", 0x177e: "VCMPNGESD", 0x1c67: "FNSTENV", 0x1cb4: "FNSTSW",
|
|
416
|
+
0x119e: "CMPNEQPD", 0x1a5b: "PAVGW", 0xa12: "MOVNTPD", 0x1518: "VCMPEQ_USPD",
|
|
417
|
+
0x5d8: "FSETPM", 0x1dcf: "BLENDVPS", 0x21b4: "VFMADDSUB213PD", 0xb: "ADD",
|
|
418
|
+
0x15ec: "VCMPNGESS", 0x1f: "ADC", 0x1aea: "PSUBSB", 0x1dd9: "BLENDVPD", 0xee5: "VPUNPCKHBW",
|
|
419
|
+
0x25f: "RDPMC", 0xa09: "MOVNTPS", 0x1110: "BSF", 0x1400: "VCMPLTPD", 0x1a2e: "PAVGB",
|
|
420
|
+
0xdf: "LEA", 0x1aad: "VCVTTPD2DQ", 0xe95: "VPCMPGTB", 0xebb: "VPCMPGTD", 0x475: "FLD1",
|
|
421
|
+
0x1bc0: "VPMADDWD", 0x17f6: "VCMPUNORD_SSD", 0x14a: "LES", 0x313: "SETZ", 0x1fb6: "VPCMPGTQ",
|
|
422
|
+
0xca5: "VMULSD", 0x21e4: "VFMADD213PS", 0x15c9: "VCMPNLESS", 0x87d: "MOVHLPS",
|
|
423
|
+
0x2065: "VPHMINPOSUW", 0x1e43: "VPABSD", 0x1a3d: "PSRAW", 0x7cf: "PFADD", 0x209c: "VFMADDSUB132PD",
|
|
424
|
+
0xaf1: "COMISD", 0x13cd: "VCMPGE_OQPS", 0xe22: "VMAXSS", 0x1230: "CMPUNORDSD",
|
|
425
|
+
0x4ff: "FSINCOS", 0xae9: "COMISS", 0x208c: "VFMADDSUB132PS", 0xb9f: "RCPPS",
|
|
426
|
+
0x2142: "VFNMADD132PD", 0x451: "FXCH", 0x2e: "DAA", 0x320: "SETBE", 0xcd5: "VCVTPS2PD",
|
|
427
|
+
0x1bb7: "PMADDWD", 0xbc4: "ANDPD", 0x1333: "VCMPLE_OQPS", 0x1789: "VCMPNGTSD",
|
|
428
|
+
0x239c: "VFNMSUB231PS", 0x64e: "FUCOMIP", 0xc8d: "VMULPS", 0x2134: "VFNMADD132PS",
|
|
429
|
+
0x26e1: "WRFSBASE", 0x38: "DAS", 0x14c5: "VCMPLE_OQPD", 0x17a: "IRET", 0x3c0: "BSWAP",
|
|
430
|
+
0xe32: "PUNPCKLBW", 0x2026: "PMAXUW", 0x2636: "VPCMPISTRM", 0x1b77: "PSLLW",
|
|
431
|
+
0x1664: "VCMPUNORD_SSS", 0x224c: "VFNMADD213PS", 0xa79: "VCVTTSD2SI", 0x233d: "VFMSUB231PD",
|
|
432
|
+
0x13a1: "VCMPNGT_UQPS", 0x1c78: "FNSTCW", 0x248c: "ROUNDSD", 0x11b2: "CMPNLEPD",
|
|
433
|
+
0x2504: "PEXTRQ", 0x1a7d: "PMULHW", 0x1cff: "VPHADDSW", 0x59e: "FISTP", 0x1f83: "PMOVZXWQ",
|
|
434
|
+
0xce0: "VCVTPD2PS", 0x170b: "VCMPTRUE_USSS", 0xc69: "VADDSD", 0x1dc5: "PBLENDVB",
|
|
435
|
+
0x6d9: "VMRESUME", 0xacc: "UCOMISD", 0x1f6e: "PMOVZXWD", 0xa4c: "CVTTPD2PI",
|
|
436
|
+
0xac3: "UCOMISS", 0xe81: "VPACKSSWB", 0xc61: "VADDSS", 0xfb2: "PSHUFHW", 0x189d: "VCMPTRUE_USSD",
|
|
437
|
+
0x6f4: "MWAIT"
|
|
438
|
+
}
|
|
439
|
+
|
|
440
|
+
Registers = ["RAX", "RCX", "RDX", "RBX", "RSP", "RBP", "RSI", "RDI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15",
|
|
441
|
+
"EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", "EDI", "R8D", "R9D", "R10D", "R11D", "R12D", "R13D", "R14D", "R15D",
|
|
442
|
+
"AX", "CX", "DX", "BX", "SP", "BP", "SI", "DI", "R8W", "R9W", "R10W", "R11W", "R12W", "R13W", "R14W", "R15W",
|
|
443
|
+
"AL", "CL", "DL", "BL", "AH", "CH", "DH", "BH", "R8B", "R9B", "R10B", "R11B", "R12B", "R13B", "R14B", "R15B",
|
|
444
|
+
"SPL", "BPL", "SIL", "DIL",
|
|
445
|
+
"ES", "CS", "SS", "DS", "FS", "GS",
|
|
446
|
+
"RIP",
|
|
447
|
+
"ST0", "ST1", "ST2", "ST3", "ST4", "ST5", "ST6", "ST7",
|
|
448
|
+
"MM0", "MM1", "MM2", "MM3", "MM4", "MM5", "MM6", "MM7",
|
|
449
|
+
"XMM0", "XMM1", "XMM2", "XMM3", "XMM4", "XMM5", "XMM6", "XMM7", "XMM8", "XMM9", "XMM10", "XMM11", "XMM12", "XMM13", "XMM14", "XMM15",
|
|
450
|
+
"YMM0", "YMM1", "YMM2", "YMM3", "YMM4", "YMM5", "YMM6", "YMM7", "YMM8", "YMM9", "YMM10", "YMM11", "YMM12", "YMM13", "YMM14", "YMM15",
|
|
451
|
+
"CR0", "", "CR2", "CR3", "CR4", "", "", "", "CR8",
|
|
452
|
+
"DR0", "DR1", "DR2", "DR3", "", "", "DR6", "DR7"]
|
|
453
|
+
|
|
454
|
+
# Special case
|
|
455
|
+
R_NONE = 0xFF # -1 in uint8
|
|
456
|
+
|
|
457
|
+
FLAGS = [
|
|
458
|
+
# The instruction locks memory access.
|
|
459
|
+
"FLAG_LOCK",
|
|
460
|
+
# The instruction is prefixed with a REPNZ.
|
|
461
|
+
"FLAG_REPNZ",
|
|
462
|
+
# The instruction is prefixed with a REP, this can be a REPZ, it depends on the specific instruction.
|
|
463
|
+
"FLAG_REP",
|
|
464
|
+
# Indicates there is a hint taken for Jcc instructions only.
|
|
465
|
+
"FLAG_HINT_TAKEN",
|
|
466
|
+
# Indicates there is a hint non-taken for Jcc instructions only.
|
|
467
|
+
"FLAG_HINT_NOT_TAKEN",
|
|
468
|
+
# The Imm value is signed extended.
|
|
469
|
+
"FLAG_IMM_SIGNED",
|
|
470
|
+
# The destination operand is writable.
|
|
471
|
+
"FLAG_DST_WR",
|
|
472
|
+
# The instruction uses the RIP-relative indirection.
|
|
473
|
+
"FLAG_RIP_RELATIVE"
|
|
474
|
+
]
|
|
475
|
+
|
|
476
|
+
# Instruction could not be disassembled. Special-case handling
|
|
477
|
+
FLAG_NOT_DECODABLE = 0xFFFF # -1 in uint16
|
|
478
|
+
# Some features
|
|
479
|
+
DF_NONE = 0
|
|
480
|
+
DF_MAXIMUM_ADDR16 = 1
|
|
481
|
+
DF_MAXIMUM_ADDR32 = 2
|
|
482
|
+
DF_RETURN_FC_ONLY = 4
|
|
483
|
+
# Flow control flags
|
|
484
|
+
DF_STOP_ON_CALL = 0x8
|
|
485
|
+
DF_STOP_ON_RET = 0x10
|
|
486
|
+
DF_STOP_ON_SYS = 0x20
|
|
487
|
+
DF_STOP_ON_UNC_BRANCH = 0x40
|
|
488
|
+
DF_STOP_ON_CND_BRANCH = 0x80
|
|
489
|
+
DF_STOP_ON_INT = 0x100
|
|
490
|
+
DF_STOP_ON_CMOV = 0x200
|
|
491
|
+
DF_STOP_ON_FLOW_CONTROL = (DF_STOP_ON_CALL | DF_STOP_ON_RET | DF_STOP_ON_SYS | \
|
|
492
|
+
DF_STOP_ON_UNC_BRANCH | DF_STOP_ON_CND_BRANCH | DF_STOP_ON_INT | DF_STOP_ON_CMOV)
|
|
493
|
+
|
|
494
|
+
def DecodeGenerator(codeOffset, code, dt):
|
|
495
|
+
"""
|
|
496
|
+
@type codeOffset: long
|
|
497
|
+
@param codeOffset: Memory address where the code is located.
|
|
498
|
+
This is B{not} an offset into the code!
|
|
499
|
+
It's the actual memory address where it was read from.
|
|
500
|
+
|
|
501
|
+
@type code: str
|
|
502
|
+
@param code: Code to disassemble.
|
|
503
|
+
|
|
504
|
+
@type dt: int
|
|
505
|
+
@param dt: Disassembly type. Can be one of the following:
|
|
506
|
+
|
|
507
|
+
* L{Decode16Bits}: 80286 decoding
|
|
508
|
+
|
|
509
|
+
* L{Decode32Bits}: IA-32 decoding
|
|
510
|
+
|
|
511
|
+
* L{Decode64Bits}: AMD64 decoding
|
|
512
|
+
|
|
513
|
+
@rtype: generator of tuple( long, int, str, str )
|
|
514
|
+
@return: Generator of tuples. Each tuple represents an assembly instruction
|
|
515
|
+
and contains:
|
|
516
|
+
- Memory address of instruction.
|
|
517
|
+
- Size of instruction in bytes.
|
|
518
|
+
- Disassembly line of instruction.
|
|
519
|
+
- Hexadecimal dump of instruction.
|
|
520
|
+
|
|
521
|
+
@raise ValueError: Invalid arguments.
|
|
522
|
+
"""
|
|
523
|
+
|
|
524
|
+
if not code:
|
|
525
|
+
return
|
|
526
|
+
|
|
527
|
+
if not codeOffset:
|
|
528
|
+
codeOffset = 0
|
|
529
|
+
|
|
530
|
+
if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
|
|
531
|
+
raise ValueError("Invalid decode type value: %r" % (dt,))
|
|
532
|
+
|
|
533
|
+
codeLen = len(code)
|
|
534
|
+
code_buf = create_string_buffer(code)
|
|
535
|
+
p_code = byref(code_buf)
|
|
536
|
+
result = (_DecodedInst * MAX_INSTRUCTIONS)()
|
|
537
|
+
p_result = byref(result)
|
|
538
|
+
instruction_off = 0
|
|
539
|
+
|
|
540
|
+
# Support cross Python compatibility
|
|
541
|
+
toUnicode = lambda s: s
|
|
542
|
+
spaceCh = b" "
|
|
543
|
+
if sys.version_info[0] >= 3:
|
|
544
|
+
if sys.version_info[1] > 0:
|
|
545
|
+
toUnicode = lambda s: s.decode()
|
|
546
|
+
else:
|
|
547
|
+
spaceCh = " "
|
|
548
|
+
|
|
549
|
+
while codeLen > 0:
|
|
550
|
+
|
|
551
|
+
usedInstructionsCount = c_uint(0)
|
|
552
|
+
status = internal_decode(_OffsetType(codeOffset), p_code, codeLen, dt, p_result, MAX_INSTRUCTIONS, byref(usedInstructionsCount))
|
|
553
|
+
|
|
554
|
+
if status == DECRES_INPUTERR:
|
|
555
|
+
raise ValueError("Invalid arguments passed to distorm_decode()")
|
|
556
|
+
|
|
557
|
+
used = usedInstructionsCount.value
|
|
558
|
+
if not used:
|
|
559
|
+
break
|
|
560
|
+
|
|
561
|
+
for index in xrange(used):
|
|
562
|
+
di = result[index]
|
|
563
|
+
asm = di.mnemonic.p
|
|
564
|
+
if len(di.operands.p):
|
|
565
|
+
asm += spaceCh + di.operands.p
|
|
566
|
+
pydi = (di.offset, di.size, toUnicode(asm), toUnicode(di.instructionHex.p))
|
|
567
|
+
instruction_off += di.size
|
|
568
|
+
yield pydi
|
|
569
|
+
|
|
570
|
+
di = result[used - 1]
|
|
571
|
+
delta = di.offset - codeOffset + result[used - 1].size
|
|
572
|
+
if delta <= 0:
|
|
573
|
+
break
|
|
574
|
+
codeOffset = codeOffset + delta
|
|
575
|
+
p_code = byref(code_buf, instruction_off)
|
|
576
|
+
codeLen = codeLen - delta
|
|
577
|
+
|
|
578
|
+
def Decode(offset, code, type = Decode32Bits):
|
|
579
|
+
"""
|
|
580
|
+
@type offset: long
|
|
581
|
+
@param offset: Memory address where the code is located.
|
|
582
|
+
This is B{not} an offset into the code!
|
|
583
|
+
It's the actual memory address where it was read from.
|
|
584
|
+
|
|
585
|
+
@type code: str
|
|
586
|
+
@param code: Code to disassemble.
|
|
587
|
+
|
|
588
|
+
@type type: int
|
|
589
|
+
@param type: Disassembly type. Can be one of the following:
|
|
590
|
+
|
|
591
|
+
* L{Decode16Bits}: 80286 decoding
|
|
592
|
+
|
|
593
|
+
* L{Decode32Bits}: IA-32 decoding
|
|
594
|
+
|
|
595
|
+
* L{Decode64Bits}: AMD64 decoding
|
|
596
|
+
|
|
597
|
+
@rtype: list of tuple( long, int, str, str )
|
|
598
|
+
@return: List of tuples. Each tuple represents an assembly instruction
|
|
599
|
+
and contains:
|
|
600
|
+
- Memory address of instruction.
|
|
601
|
+
- Size of instruction in bytes.
|
|
602
|
+
- Disassembly line of instruction.
|
|
603
|
+
- Hexadecimal dump of instruction.
|
|
604
|
+
|
|
605
|
+
@raise ValueError: Invalid arguments.
|
|
606
|
+
"""
|
|
607
|
+
return list(DecodeGenerator(offset, code, type))
|
|
608
|
+
|
|
609
|
+
OPERAND_NONE = ""
|
|
610
|
+
OPERAND_IMMEDIATE = "Immediate"
|
|
611
|
+
OPERAND_REGISTER = "Register"
|
|
612
|
+
|
|
613
|
+
# the operand is a memory address
|
|
614
|
+
OPERAND_ABSOLUTE_ADDRESS = "AbsoluteMemoryAddress" # The address calculated is absolute
|
|
615
|
+
OPERAND_MEMORY = "AbsoluteMemory" # The address calculated uses registers expression
|
|
616
|
+
OPERAND_FAR_MEMORY = "FarMemory" # like absolute but with selector/segment specified too
|
|
617
|
+
|
|
618
|
+
InstructionSetClasses = [
|
|
619
|
+
"ISC_UNKNOWN",
|
|
620
|
+
# Indicates the instruction belongs to the General Integer set.
|
|
621
|
+
"ISC_INTEGER",
|
|
622
|
+
# Indicates the instruction belongs to the 387 FPU set.
|
|
623
|
+
"ISC_FPU",
|
|
624
|
+
# Indicates the instruction belongs to the P6 set.
|
|
625
|
+
"ISC_P6",
|
|
626
|
+
# Indicates the instruction belongs to the MMX set.
|
|
627
|
+
"ISC_MMX",
|
|
628
|
+
# Indicates the instruction belongs to the SSE set.
|
|
629
|
+
"ISC_SSE",
|
|
630
|
+
# Indicates the instruction belongs to the SSE2 set.
|
|
631
|
+
"ISC_SSE2",
|
|
632
|
+
# Indicates the instruction belongs to the SSE3 set.
|
|
633
|
+
"ISC_SSE3",
|
|
634
|
+
# Indicates the instruction belongs to the SSSE3 set.
|
|
635
|
+
"ISC_SSSE3",
|
|
636
|
+
# Indicates the instruction belongs to the SSE4.1 set.
|
|
637
|
+
"ISC_SSE4_1",
|
|
638
|
+
# Indicates the instruction belongs to the SSE4.2 set.
|
|
639
|
+
"ISC_SSE4_2",
|
|
640
|
+
# Indicates the instruction belongs to the AMD's SSE4.A set.
|
|
641
|
+
"ISC_SSE4_A",
|
|
642
|
+
# Indicates the instruction belongs to the 3DNow! set.
|
|
643
|
+
"ISC_3DNOW",
|
|
644
|
+
# Indicates the instruction belongs to the 3DNow! Extensions set.
|
|
645
|
+
"ISC_3DNOWEXT",
|
|
646
|
+
# Indicates the instruction belongs to the VMX (Intel) set.
|
|
647
|
+
"ISC_VMX",
|
|
648
|
+
# Indicates the instruction belongs to the SVM (AMD) set.
|
|
649
|
+
"ISC_SVM",
|
|
650
|
+
# Indicates the instruction belongs to the AVX (Intel) set.
|
|
651
|
+
"ISC_AVX",
|
|
652
|
+
# Indicates the instruction belongs to the FMA (Intel) set.
|
|
653
|
+
"ISC_FMA",
|
|
654
|
+
# Indicates the instruction belongs to the AES/AVX (Intel) set.
|
|
655
|
+
"ISC_AES",
|
|
656
|
+
# Indicates the instruction belongs to the CLMUL (Intel) set.
|
|
657
|
+
"ISC_CLMUL",
|
|
658
|
+
]
|
|
659
|
+
|
|
660
|
+
FlowControlFlags = [
|
|
661
|
+
# Indicates the instruction is not a flow-control instruction.
|
|
662
|
+
"FC_NONE",
|
|
663
|
+
# Indicates the instruction is one of: CALL, CALL FAR.
|
|
664
|
+
"FC_CALL",
|
|
665
|
+
# Indicates the instruction is one of: RET, IRET, RETF.
|
|
666
|
+
"FC_RET",
|
|
667
|
+
# Indicates the instruction is one of: SYSCALL, SYSRET, SYSENTER, SYSEXIT.
|
|
668
|
+
"FC_SYS",
|
|
669
|
+
# Indicates the instruction is one of: JMP, JMP FAR.
|
|
670
|
+
"FC_UNC_BRANCH",
|
|
671
|
+
# Indicates the instruction is one of:
|
|
672
|
+
# JCXZ, JO, JNO, JB, JAE, JZ, JNZ, JBE, JA, JS, JNS, JP, JNP, JL, JGE, JLE, JG, LOOP, LOOPZ, LOOPNZ.
|
|
673
|
+
"FC_CND_BRANCH",
|
|
674
|
+
# Indiciates the instruction is one of: INT, INT1, INT 3, INTO, UD2.
|
|
675
|
+
"FC_INT",
|
|
676
|
+
# Indicates the instruction is one of: CMOVxx.
|
|
677
|
+
"FC_CMOV"
|
|
678
|
+
]
|
|
679
|
+
|
|
680
|
+
def _getOpSize(flags):
|
|
681
|
+
return ((flags >> 7) & 3)
|
|
682
|
+
|
|
683
|
+
def _getISC(metaflags):
|
|
684
|
+
realvalue = ((metaflags >> 3) & 0x1f)
|
|
685
|
+
return InstructionSetClasses[realvalue]
|
|
686
|
+
|
|
687
|
+
def _getFC(metaflags):
|
|
688
|
+
realvalue = (metaflags & 0x7)
|
|
689
|
+
try:
|
|
690
|
+
return FlowControlFlags[realvalue]
|
|
691
|
+
except IndexError:
|
|
692
|
+
print ("Bad meta-flags: {}".format(realvalue))
|
|
693
|
+
raise
|
|
694
|
+
|
|
695
|
+
def _getMnem(opcode):
|
|
696
|
+
return Mnemonics.get(opcode, "UNDEFINED")
|
|
697
|
+
|
|
698
|
+
def _unsignedToSigned64(val):
|
|
699
|
+
return int(val if val < 0x8000000000000000 else (val - 0x10000000000000000))
|
|
700
|
+
|
|
701
|
+
def _unsignedToSigned32(val):
|
|
702
|
+
return int(val if val < 0x80000000 else (val - 0x10000000))
|
|
703
|
+
|
|
704
|
+
if SUPPORT_64BIT_OFFSET:
|
|
705
|
+
_unsignedToSigned = _unsignedToSigned64
|
|
706
|
+
else:
|
|
707
|
+
_unsignedToSigned = _unsignedToSigned32
|
|
708
|
+
|
|
709
|
+
class Operand (object):
|
|
710
|
+
def __init__(self, type, *args):
|
|
711
|
+
self.type = type
|
|
712
|
+
self.index = None
|
|
713
|
+
self.name = ""
|
|
714
|
+
self.size = 0
|
|
715
|
+
self.value = 0
|
|
716
|
+
self.disp = 0
|
|
717
|
+
self.dispSize = 0
|
|
718
|
+
self.base = 0
|
|
719
|
+
self.segment = 0
|
|
720
|
+
if type == OPERAND_IMMEDIATE:
|
|
721
|
+
self.value = int(args[0])
|
|
722
|
+
self.size = args[1]
|
|
723
|
+
elif type == OPERAND_REGISTER:
|
|
724
|
+
self.index = args[0]
|
|
725
|
+
self.size = args[1]
|
|
726
|
+
self.name = Registers[self.index]
|
|
727
|
+
elif type == OPERAND_MEMORY:
|
|
728
|
+
self.base = args[0] if args[0] != R_NONE else None
|
|
729
|
+
self.index = args[1]
|
|
730
|
+
self.size = args[2]
|
|
731
|
+
self.scale = args[3] if args[3] > 1 else 1
|
|
732
|
+
self.disp = int(args[4])
|
|
733
|
+
self.dispSize = args[5]
|
|
734
|
+
self.segment = args[6]
|
|
735
|
+
elif type == OPERAND_ABSOLUTE_ADDRESS:
|
|
736
|
+
self.size = args[0]
|
|
737
|
+
self.disp = int(args[1])
|
|
738
|
+
self.dispSize = args[2]
|
|
739
|
+
self.segment = args[3]
|
|
740
|
+
elif type == OPERAND_FAR_MEMORY:
|
|
741
|
+
self.size = args[2]
|
|
742
|
+
self.seg = args[0]
|
|
743
|
+
self.off = args[1]
|
|
744
|
+
|
|
745
|
+
def _toText(self):
|
|
746
|
+
if self.type == OPERAND_IMMEDIATE:
|
|
747
|
+
if self.value >= 0:
|
|
748
|
+
return "0x%x" % self.value
|
|
749
|
+
else:
|
|
750
|
+
return "-0x%x" % abs(self.value)
|
|
751
|
+
elif self.type == OPERAND_REGISTER:
|
|
752
|
+
return self.name
|
|
753
|
+
elif self.type == OPERAND_ABSOLUTE_ADDRESS:
|
|
754
|
+
return '[0x%x]' % self.disp
|
|
755
|
+
elif self.type == OPERAND_FAR_MEMORY:
|
|
756
|
+
return '%s:%s' % (hex(self.seg), hex(self.off))
|
|
757
|
+
elif (self.type == OPERAND_MEMORY):
|
|
758
|
+
result = "["
|
|
759
|
+
if self.base != None:
|
|
760
|
+
result += Registers[self.base] + "+"
|
|
761
|
+
if self.index != None:
|
|
762
|
+
result += Registers[self.index]
|
|
763
|
+
if self.scale > 1:
|
|
764
|
+
result += "*%d" % self.scale
|
|
765
|
+
if self.disp >= 0:
|
|
766
|
+
result += "+0x%x" % self.disp
|
|
767
|
+
else:
|
|
768
|
+
result += "-0x%x" % abs(self.disp)
|
|
769
|
+
return result + "]"
|
|
770
|
+
def __str__(self):
|
|
771
|
+
return self._toText()
|
|
772
|
+
|
|
773
|
+
|
|
774
|
+
class Instruction (object):
|
|
775
|
+
def __init__(self, di, instructionBytes, dt):
|
|
776
|
+
"Expects a filled _DInst structure, and the corresponding byte code of the whole instruction"
|
|
777
|
+
#self.di = di
|
|
778
|
+
flags = di.flags
|
|
779
|
+
self.instructionBytes = instructionBytes
|
|
780
|
+
self.opcode = di.opcode
|
|
781
|
+
self.operands = []
|
|
782
|
+
self.flags = []
|
|
783
|
+
self.rawFlags = di.flags
|
|
784
|
+
self.instructionClass = _getISC(0)
|
|
785
|
+
self.flowControl = _getFC(0)
|
|
786
|
+
self.address = di.addr
|
|
787
|
+
self.size = di.size
|
|
788
|
+
self.dt = dt
|
|
789
|
+
self.valid = False
|
|
790
|
+
if di.segment != R_NONE:
|
|
791
|
+
self.segment = di.segment & 0x7f
|
|
792
|
+
self.isSegmentDefault = (di.segment & 0x80) == 0x80
|
|
793
|
+
else:
|
|
794
|
+
self.segment = R_NONE
|
|
795
|
+
self.isSegmentDefault = False
|
|
796
|
+
self.unusedPrefixesMask = di.unusedPrefixesMask
|
|
797
|
+
|
|
798
|
+
if flags == FLAG_NOT_DECODABLE:
|
|
799
|
+
self.mnemonic = 'DB 0x%02x' % (di.imm.byte)
|
|
800
|
+
self.flags = ['FLAG_NOT_DECODABLE']
|
|
801
|
+
return
|
|
802
|
+
|
|
803
|
+
self.valid = True
|
|
804
|
+
self.mnemonic = _getMnem(self.opcode)
|
|
805
|
+
|
|
806
|
+
# decompose the flags for a valid opcode
|
|
807
|
+
for index, flag in enumerate(FLAGS):
|
|
808
|
+
if (flags & (1 << index)) != 0:
|
|
809
|
+
self.flags.append(flag)
|
|
810
|
+
|
|
811
|
+
# read the operands
|
|
812
|
+
for operand in di.ops:
|
|
813
|
+
if operand.type != O_NONE:
|
|
814
|
+
self.operands.append(self._extractOperand(di, operand))
|
|
815
|
+
|
|
816
|
+
# decode the meta-flags
|
|
817
|
+
metas = di.meta
|
|
818
|
+
self.instructionClass = _getISC(metas)
|
|
819
|
+
self.flowControl = _getFC(metas)
|
|
820
|
+
|
|
821
|
+
def _extractOperand(self, di, operand):
|
|
822
|
+
# a single operand can be up to: reg1 + reg2*scale + constant
|
|
823
|
+
if operand.type == O_IMM:
|
|
824
|
+
if ("FLAG_IMM_SIGNED" in self.flags):
|
|
825
|
+
# immediate is sign-extended, do your thing. it's already signed, just make it Python-signed.
|
|
826
|
+
constant = _unsignedToSigned(di.imm.sqword)
|
|
827
|
+
else:
|
|
828
|
+
# immediate is zero-extended, though it's already aligned.
|
|
829
|
+
constant = di.imm.qword
|
|
830
|
+
return Operand(OPERAND_IMMEDIATE, constant, operand.size)
|
|
831
|
+
elif operand.type == O_IMM1: # first operand for ENTER
|
|
832
|
+
return Operand(OPERAND_IMMEDIATE, di.imm.ex.i1, operand.size)
|
|
833
|
+
elif operand.type == O_IMM2: # second operand for ENTER
|
|
834
|
+
return Operand(OPERAND_IMMEDIATE, di.imm.ex.i2, operand.size)
|
|
835
|
+
elif operand.type == O_REG:
|
|
836
|
+
return Operand(OPERAND_REGISTER, operand.index, operand.size)
|
|
837
|
+
elif operand.type == O_MEM:
|
|
838
|
+
return Operand(OPERAND_MEMORY, di.base, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
|
|
839
|
+
elif operand.type == O_SMEM:
|
|
840
|
+
return Operand(OPERAND_MEMORY, None, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
|
|
841
|
+
elif operand.type == O_DISP:
|
|
842
|
+
return Operand(OPERAND_ABSOLUTE_ADDRESS, operand.size, di.disp, di.dispSize, self.segment)
|
|
843
|
+
elif operand.type == O_PC:
|
|
844
|
+
return Operand(OPERAND_IMMEDIATE, _unsignedToSigned(di.imm.addr) + self.address + self.size, operand.size)
|
|
845
|
+
elif operand.type == O_PTR:
|
|
846
|
+
return Operand(OPERAND_FAR_MEMORY, di.imm.ptr.seg, di.imm.ptr.off, operand.size)
|
|
847
|
+
else:
|
|
848
|
+
raise ValueError("Unknown operand type encountered: %d!" % operand.type)
|
|
849
|
+
|
|
850
|
+
def _toText(self):
|
|
851
|
+
# use the decode which already returns the text formatted well (with prefixes, etc).
|
|
852
|
+
return Decode(self.address, self.instructionBytes, self.dt)[0][2]
|
|
853
|
+
|
|
854
|
+
def __str__(self):
|
|
855
|
+
return self._toText()
|
|
856
|
+
|
|
857
|
+
|
|
858
|
+
def DecomposeGenerator(codeOffset, code, dt, features = 0):
|
|
859
|
+
"""
|
|
860
|
+
@type codeOffset: long
|
|
861
|
+
@param codeOffset: Memory address where the code is located.
|
|
862
|
+
This is B{not} an offset into the code!
|
|
863
|
+
It's the actual memory address where it was read from.
|
|
864
|
+
|
|
865
|
+
@type code: str, in Py3 bytes
|
|
866
|
+
@param code: Code to disassemble.
|
|
867
|
+
|
|
868
|
+
@type dt: int
|
|
869
|
+
@param dt: Disassembly type. Can be one of the following:
|
|
870
|
+
|
|
871
|
+
* L{Decode16Bits}: 80286 decoding
|
|
872
|
+
|
|
873
|
+
* L{Decode32Bits}: IA-32 decoding
|
|
874
|
+
|
|
875
|
+
* L{Decode64Bits}: AMD64 decoding
|
|
876
|
+
|
|
877
|
+
@type features: int
|
|
878
|
+
@param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
|
|
879
|
+
or other features, eg. DF_RETURN_FC_ONLY.
|
|
880
|
+
|
|
881
|
+
@rtype: generator of TODO
|
|
882
|
+
@return: Generator of TODO
|
|
883
|
+
|
|
884
|
+
@raise ValueError: Invalid arguments.
|
|
885
|
+
"""
|
|
886
|
+
|
|
887
|
+
if not code:
|
|
888
|
+
return
|
|
889
|
+
|
|
890
|
+
if not codeOffset:
|
|
891
|
+
codeOffset = 0
|
|
892
|
+
|
|
893
|
+
if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
|
|
894
|
+
raise ValueError("Invalid decode type value: %r" % (dt,))
|
|
895
|
+
|
|
896
|
+
codeLen = len(code)
|
|
897
|
+
code_buf = create_string_buffer(code)
|
|
898
|
+
p_code = byref(code_buf)
|
|
899
|
+
result = (_DInst * MAX_INSTRUCTIONS)()
|
|
900
|
+
instruction_off = 0
|
|
901
|
+
|
|
902
|
+
while codeLen > 0:
|
|
903
|
+
|
|
904
|
+
usedInstructionsCount = c_uint(0)
|
|
905
|
+
codeInfo = _CodeInfo(_OffsetType(codeOffset), _OffsetType(0), cast(p_code, c_char_p), codeLen, dt, features)
|
|
906
|
+
status = internal_decompose(byref(codeInfo), byref(result), MAX_INSTRUCTIONS, byref(usedInstructionsCount))
|
|
907
|
+
if status == DECRES_INPUTERR:
|
|
908
|
+
raise ValueError("Invalid arguments passed to distorm_decode()")
|
|
909
|
+
|
|
910
|
+
used = usedInstructionsCount.value
|
|
911
|
+
if not used:
|
|
912
|
+
break
|
|
913
|
+
|
|
914
|
+
delta = 0
|
|
915
|
+
for index in range(used):
|
|
916
|
+
di = result[index]
|
|
917
|
+
yield Instruction(di, code[instruction_off : instruction_off + di.size], dt)
|
|
918
|
+
delta += di.size
|
|
919
|
+
instruction_off += di.size
|
|
920
|
+
|
|
921
|
+
if delta <= 0:
|
|
922
|
+
break
|
|
923
|
+
codeOffset = codeOffset + delta
|
|
924
|
+
p_code = byref(code_buf, instruction_off)
|
|
925
|
+
codeLen = codeLen - delta
|
|
926
|
+
|
|
927
|
+
if (features & DF_STOP_ON_FLOW_CONTROL) != 0:
|
|
928
|
+
break # User passed a stop flag.
|
|
929
|
+
|
|
930
|
+
def Decompose(offset, code, type = Decode32Bits, features = 0):
|
|
931
|
+
"""
|
|
932
|
+
@type offset: long
|
|
933
|
+
@param offset: Memory address where the code is located.
|
|
934
|
+
This is B{not} an offset into the code!
|
|
935
|
+
It's the actual memory address where it was read from.
|
|
936
|
+
|
|
937
|
+
@type code: str, in Py3 bytes
|
|
938
|
+
@param code: Code to disassemble.
|
|
939
|
+
|
|
940
|
+
@type type: int
|
|
941
|
+
@param type: Disassembly type. Can be one of the following:
|
|
942
|
+
|
|
943
|
+
* L{Decode16Bits}: 80286 decoding
|
|
944
|
+
|
|
945
|
+
* L{Decode32Bits}: IA-32 decoding
|
|
946
|
+
|
|
947
|
+
* L{Decode64Bits}: AMD64 decoding
|
|
948
|
+
|
|
949
|
+
@type features: int
|
|
950
|
+
@param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
|
|
951
|
+
or other features, eg. DF_RETURN_FC_ONLY.
|
|
952
|
+
|
|
953
|
+
@rtype: TODO
|
|
954
|
+
@return: TODO
|
|
955
|
+
@raise ValueError: Invalid arguments.
|
|
956
|
+
"""
|
|
957
|
+
return list(DecomposeGenerator(offset, code, type, features))
|