contrast-agent 3.8.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (500) hide show
  1. checksums.yaml +7 -0
  2. data/.clang-format +5 -0
  3. data/.dockerignore +10 -0
  4. data/.gitignore +58 -0
  5. data/.gitmodules +6 -0
  6. data/.rspec +6 -0
  7. data/.simplecov +4 -0
  8. data/Gemfile +7 -0
  9. data/LICENSE.txt +12 -0
  10. data/Rakefile +15 -0
  11. data/exe/contrast_service +29 -0
  12. data/ext/build_funchook.rb +48 -0
  13. data/ext/cs__assess_active_record_named/cs__active_record_named.c +47 -0
  14. data/ext/cs__assess_active_record_named/cs__active_record_named.h +10 -0
  15. data/ext/cs__assess_active_record_named/extconf.rb +2 -0
  16. data/ext/cs__assess_array/cs__assess_array.c +38 -0
  17. data/ext/cs__assess_array/cs__assess_array.h +9 -0
  18. data/ext/cs__assess_array/extconf.rb +2 -0
  19. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +50 -0
  20. data/ext/cs__assess_basic_object/cs__assess_basic_object.h +17 -0
  21. data/ext/cs__assess_basic_object/extconf.rb +2 -0
  22. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +86 -0
  23. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +34 -0
  24. data/ext/cs__assess_fiber_track/extconf.rb +2 -0
  25. data/ext/cs__assess_hash/cs__assess_hash.c +64 -0
  26. data/ext/cs__assess_hash/cs__assess_hash.h +24 -0
  27. data/ext/cs__assess_hash/extconf.rb +2 -0
  28. data/ext/cs__assess_kernel/cs__assess_kernel.c +36 -0
  29. data/ext/cs__assess_kernel/cs__assess_kernel.h +10 -0
  30. data/ext/cs__assess_kernel/extconf.rb +2 -0
  31. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +47 -0
  32. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +18 -0
  33. data/ext/cs__assess_marshal_module/extconf.rb +2 -0
  34. data/ext/cs__assess_module/cs__assess_module.c +78 -0
  35. data/ext/cs__assess_module/cs__assess_module.h +25 -0
  36. data/ext/cs__assess_module/extconf.rb +2 -0
  37. data/ext/cs__assess_regexp/cs__assess_regexp.c +48 -0
  38. data/ext/cs__assess_regexp/cs__assess_regexp.h +22 -0
  39. data/ext/cs__assess_regexp/extconf.rb +2 -0
  40. data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c +63 -0
  41. data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h +29 -0
  42. data/ext/cs__assess_regexp_track/extconf.rb +2 -0
  43. data/ext/cs__assess_string/cs__assess_string.c +38 -0
  44. data/ext/cs__assess_string/cs__assess_string.h +19 -0
  45. data/ext/cs__assess_string/extconf.rb +2 -0
  46. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +31 -0
  47. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h +13 -0
  48. data/ext/cs__assess_string_interpolation26/extconf.rb +2 -0
  49. data/ext/cs__common/cs__common.c +60 -0
  50. data/ext/cs__common/cs__common.h +28 -0
  51. data/ext/cs__common/extconf.rb +20 -0
  52. data/ext/cs__contrast_patch/cs__contrast_patch.c +445 -0
  53. data/ext/cs__contrast_patch/cs__contrast_patch.h +196 -0
  54. data/ext/cs__contrast_patch/extconf.rb +2 -0
  55. data/ext/cs__protect_kernel/cs__protect_kernel.c +37 -0
  56. data/ext/cs__protect_kernel/cs__protect_kernel.h +11 -0
  57. data/ext/cs__protect_kernel/extconf.rb +2 -0
  58. data/ext/cs__scope/cs__scope.c +96 -0
  59. data/ext/cs__scope/cs__scope.h +33 -0
  60. data/ext/cs__scope/extconf.rb +2 -0
  61. data/ext/extconf_common.rb +49 -0
  62. data/funchook/LICENSE +360 -0
  63. data/funchook/Makefile +29 -0
  64. data/funchook/Makefile.in +29 -0
  65. data/funchook/README.md +121 -0
  66. data/funchook/appveyor.yml +42 -0
  67. data/funchook/autogen.sh +3 -0
  68. data/funchook/autom4te.cache/output.0 +4976 -0
  69. data/funchook/autom4te.cache/requests +78 -0
  70. data/funchook/autom4te.cache/traces.0 +364 -0
  71. data/funchook/config.guess +1530 -0
  72. data/funchook/config.log +490 -0
  73. data/funchook/config.status +1016 -0
  74. data/funchook/config.sub +1773 -0
  75. data/funchook/configure +4976 -0
  76. data/funchook/configure.ac +59 -0
  77. data/funchook/distorm/COPYING +26 -0
  78. data/funchook/distorm/MANIFEST +25 -0
  79. data/funchook/distorm/MANIFEST.in +4 -0
  80. data/funchook/distorm/README.md +12 -0
  81. data/funchook/distorm/disOps/disOps.py +795 -0
  82. data/funchook/distorm/disOps/x86db.py +404 -0
  83. data/funchook/distorm/disOps/x86header.py +247 -0
  84. data/funchook/distorm/disOps/x86sets.py +1664 -0
  85. data/funchook/distorm/examples/cs/TestdiStorm/Program.cs +79 -0
  86. data/funchook/distorm/examples/cs/TestdiStorm/Properties/AssemblyInfo.cs +36 -0
  87. data/funchook/distorm/examples/cs/TestdiStorm/TestdiStorm.csproj +69 -0
  88. data/funchook/distorm/examples/cs/distorm-net.sln +26 -0
  89. data/funchook/distorm/examples/cs/distorm-net/CodeInfo.cs +23 -0
  90. data/funchook/distorm/examples/cs/distorm-net/DecodedInst.cs +15 -0
  91. data/funchook/distorm/examples/cs/distorm-net/DecodedResult.cs +14 -0
  92. data/funchook/distorm/examples/cs/distorm-net/DecomposedInst.cs +36 -0
  93. data/funchook/distorm/examples/cs/distorm-net/DecomposedResult.cs +14 -0
  94. data/funchook/distorm/examples/cs/distorm-net/Opcodes.cs +1268 -0
  95. data/funchook/distorm/examples/cs/distorm-net/Opcodes.tt +37 -0
  96. data/funchook/distorm/examples/cs/distorm-net/Operand.cs +25 -0
  97. data/funchook/distorm/examples/cs/distorm-net/Properties/AssemblyInfo.cs +36 -0
  98. data/funchook/distorm/examples/cs/distorm-net/diStorm3.cs +411 -0
  99. data/funchook/distorm/examples/cs/distorm-net/distorm-net.csproj +80 -0
  100. data/funchook/distorm/examples/cs/readme +3 -0
  101. data/funchook/distorm/examples/ddk/README +48 -0
  102. data/funchook/distorm/examples/ddk/distorm.ini +11 -0
  103. data/funchook/distorm/examples/ddk/dummy.c +15 -0
  104. data/funchook/distorm/examples/ddk/main.c +91 -0
  105. data/funchook/distorm/examples/ddk/makefile +1 -0
  106. data/funchook/distorm/examples/ddk/sources +10 -0
  107. data/funchook/distorm/examples/java/Makefile +23 -0
  108. data/funchook/distorm/examples/java/distorm/src/Main.java +43 -0
  109. data/funchook/distorm/examples/java/distorm/src/diStorm3/CodeInfo.java +27 -0
  110. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedInst.java +32 -0
  111. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedResult.java +11 -0
  112. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedInst.java +89 -0
  113. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedResult.java +11 -0
  114. data/funchook/distorm/examples/java/distorm/src/diStorm3/OpcodeEnum.java +131 -0
  115. data/funchook/distorm/examples/java/distorm/src/diStorm3/Opcodes.java +1123 -0
  116. data/funchook/distorm/examples/java/distorm/src/diStorm3/Operand.java +24 -0
  117. data/funchook/distorm/examples/java/distorm/src/diStorm3/distorm3.java +41 -0
  118. data/funchook/distorm/examples/java/jdistorm.c +405 -0
  119. data/funchook/distorm/examples/java/jdistorm.h +40 -0
  120. data/funchook/distorm/examples/java/jdistorm.sln +20 -0
  121. data/funchook/distorm/examples/java/jdistorm.vcproj +208 -0
  122. data/funchook/distorm/examples/linux/Makefile +15 -0
  123. data/funchook/distorm/examples/linux/main.c +181 -0
  124. data/funchook/distorm/examples/tests/Makefile +15 -0
  125. data/funchook/distorm/examples/tests/main.cpp +42 -0
  126. data/funchook/distorm/examples/tests/main.py +66 -0
  127. data/funchook/distorm/examples/tests/test_distorm3.py +1672 -0
  128. data/funchook/distorm/examples/tests/tests.sln +20 -0
  129. data/funchook/distorm/examples/tests/tests.vcxproj +82 -0
  130. data/funchook/distorm/examples/tests/tests.vcxproj.filters +22 -0
  131. data/funchook/distorm/examples/win32/disasm.sln +25 -0
  132. data/funchook/distorm/examples/win32/disasm.vcxproj +201 -0
  133. data/funchook/distorm/examples/win32/disasm.vcxproj.filters +14 -0
  134. data/funchook/distorm/examples/win32/main.cpp +163 -0
  135. data/funchook/distorm/include/distorm.h +482 -0
  136. data/funchook/distorm/include/mnemonics.h +301 -0
  137. data/funchook/distorm/make/linux/Makefile +28 -0
  138. data/funchook/distorm/make/mac/Makefile +24 -0
  139. data/funchook/distorm/make/win32/cdistorm.vcxproj +239 -0
  140. data/funchook/distorm/make/win32/cdistorm.vcxproj.filters +80 -0
  141. data/funchook/distorm/make/win32/distorm.sln +25 -0
  142. data/funchook/distorm/make/win32/resource.h +14 -0
  143. data/funchook/distorm/make/win32/resource.rc +99 -0
  144. data/funchook/distorm/python/distorm3/__init__.py +957 -0
  145. data/funchook/distorm/python/distorm3/sample.py +51 -0
  146. data/funchook/distorm/setup.cfg +10 -0
  147. data/funchook/distorm/setup.py +266 -0
  148. data/funchook/distorm/src/config.h +169 -0
  149. data/funchook/distorm/src/decoder.c +641 -0
  150. data/funchook/distorm/src/decoder.h +33 -0
  151. data/funchook/distorm/src/distorm.c +413 -0
  152. data/funchook/distorm/src/instructions.c +597 -0
  153. data/funchook/distorm/src/instructions.h +463 -0
  154. data/funchook/distorm/src/insts.c +7939 -0
  155. data/funchook/distorm/src/insts.h +64 -0
  156. data/funchook/distorm/src/mnemonics.c +284 -0
  157. data/funchook/distorm/src/operands.c +1290 -0
  158. data/funchook/distorm/src/operands.h +28 -0
  159. data/funchook/distorm/src/prefix.c +368 -0
  160. data/funchook/distorm/src/prefix.h +64 -0
  161. data/funchook/distorm/src/textdefs.c +172 -0
  162. data/funchook/distorm/src/textdefs.h +57 -0
  163. data/funchook/distorm/src/wstring.c +47 -0
  164. data/funchook/distorm/src/wstring.h +35 -0
  165. data/funchook/distorm/src/x86defs.h +82 -0
  166. data/funchook/include/funchook.h +123 -0
  167. data/funchook/install-sh +527 -0
  168. data/funchook/src/Makefile +70 -0
  169. data/funchook/src/Makefile.in +70 -0
  170. data/funchook/src/__strerror.h +109 -0
  171. data/funchook/src/config.h +101 -0
  172. data/funchook/src/config.h.in +100 -0
  173. data/funchook/src/decoder.o +0 -0
  174. data/funchook/src/distorm.o +0 -0
  175. data/funchook/src/funchook.c +440 -0
  176. data/funchook/src/funchook.o +0 -0
  177. data/funchook/src/funchook_internal.h +155 -0
  178. data/funchook/src/funchook_io.c +182 -0
  179. data/funchook/src/funchook_io.h +64 -0
  180. data/funchook/src/funchook_io.o +0 -0
  181. data/funchook/src/funchook_syscall.S +134 -0
  182. data/funchook/src/funchook_syscall.o +0 -0
  183. data/funchook/src/funchook_unix.c +480 -0
  184. data/funchook/src/funchook_unix.o +0 -0
  185. data/funchook/src/funchook_windows.c +397 -0
  186. data/funchook/src/funchook_x86.c +622 -0
  187. data/funchook/src/funchook_x86.o +0 -0
  188. data/funchook/src/instructions.o +0 -0
  189. data/funchook/src/insts.o +0 -0
  190. data/funchook/src/libfunchook.so +0 -0
  191. data/funchook/src/mnemonics.o +0 -0
  192. data/funchook/src/operands.o +0 -0
  193. data/funchook/src/os_func.c +115 -0
  194. data/funchook/src/os_func.h +75 -0
  195. data/funchook/src/os_func.o +0 -0
  196. data/funchook/src/os_func_unix.c +94 -0
  197. data/funchook/src/os_func_unix.o +0 -0
  198. data/funchook/src/os_func_windows.c +32 -0
  199. data/funchook/src/prefix.o +0 -0
  200. data/funchook/src/printf_base.c +1688 -0
  201. data/funchook/src/printf_base.h +46 -0
  202. data/funchook/src/printf_base.o +0 -0
  203. data/funchook/src/textdefs.o +0 -0
  204. data/funchook/src/wstring.o +0 -0
  205. data/funchook/test/Makefile +43 -0
  206. data/funchook/test/Makefile.in +43 -0
  207. data/funchook/test/funchook_test +0 -0
  208. data/funchook/test/libfunchook_test.c +25 -0
  209. data/funchook/test/libfunchook_test.so +0 -0
  210. data/funchook/test/libfunchook_test2.c +18 -0
  211. data/funchook/test/suffix.list +600 -0
  212. data/funchook/test/test_main.c +430 -0
  213. data/funchook/test/test_main.o +0 -0
  214. data/funchook/test/x86_64_test.S +10 -0
  215. data/funchook/test/x86_64_test.o +0 -0
  216. data/funchook/test/x86_test.S +339 -0
  217. data/funchook/win32/config.h +1 -0
  218. data/funchook/win32/funchook.sln +52 -0
  219. data/funchook/win32/funchook.vcxproj +188 -0
  220. data/funchook/win32/funchook.vcxproj.filters +84 -0
  221. data/funchook/win32/funchook_test.vcxproj +170 -0
  222. data/funchook/win32/funchook_test.vcxproj.filters +22 -0
  223. data/funchook/win32/funchook_test_dll.vcxproj +184 -0
  224. data/funchook/win32/funchook_test_dll.vcxproj.filters +30 -0
  225. data/funchook/win32/funchook_test_exe.def +3 -0
  226. data/lib/contrast-agent.rb +8 -0
  227. data/lib/contrast.rb +57 -0
  228. data/lib/contrast/agent.rb +80 -0
  229. data/lib/contrast/agent/assess.rb +45 -0
  230. data/lib/contrast/agent/assess/adjusted_span.rb +25 -0
  231. data/lib/contrast/agent/assess/class_reverter.rb +82 -0
  232. data/lib/contrast/agent/assess/contrast_event.rb +398 -0
  233. data/lib/contrast/agent/assess/frozen_properties.rb +41 -0
  234. data/lib/contrast/agent/assess/insulator.rb +53 -0
  235. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +78 -0
  236. data/lib/contrast/agent/assess/policy/patcher.rb +85 -0
  237. data/lib/contrast/agent/assess/policy/policy.rb +116 -0
  238. data/lib/contrast/agent/assess/policy/policy_node.rb +289 -0
  239. data/lib/contrast/agent/assess/policy/policy_scanner.rb +44 -0
  240. data/lib/contrast/agent/assess/policy/preshift.rb +94 -0
  241. data/lib/contrast/agent/assess/policy/propagation_method.rb +260 -0
  242. data/lib/contrast/agent/assess/policy/propagation_node.rb +127 -0
  243. data/lib/contrast/agent/assess/policy/propagator.rb +35 -0
  244. data/lib/contrast/agent/assess/policy/propagator/append.rb +54 -0
  245. data/lib/contrast/agent/assess/policy/propagator/base.rb +37 -0
  246. data/lib/contrast/agent/assess/policy/propagator/center.rb +73 -0
  247. data/lib/contrast/agent/assess/policy/propagator/custom.rb +36 -0
  248. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +62 -0
  249. data/lib/contrast/agent/assess/policy/propagator/insert.rb +55 -0
  250. data/lib/contrast/agent/assess/policy/propagator/keep.rb +26 -0
  251. data/lib/contrast/agent/assess/policy/propagator/next.rb +42 -0
  252. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +50 -0
  253. data/lib/contrast/agent/assess/policy/propagator/remove.rb +76 -0
  254. data/lib/contrast/agent/assess/policy/propagator/replace.rb +27 -0
  255. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +38 -0
  256. data/lib/contrast/agent/assess/policy/propagator/select.rb +86 -0
  257. data/lib/contrast/agent/assess/policy/propagator/splat.rb +60 -0
  258. data/lib/contrast/agent/assess/policy/propagator/split.rb +49 -0
  259. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +169 -0
  260. data/lib/contrast/agent/assess/policy/propagator/trim.rb +81 -0
  261. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +79 -0
  262. data/lib/contrast/agent/assess/policy/source_method.rb +209 -0
  263. data/lib/contrast/agent/assess/policy/source_node.rb +62 -0
  264. data/lib/contrast/agent/assess/policy/trigger_method.rb +209 -0
  265. data/lib/contrast/agent/assess/policy/trigger_node.rb +198 -0
  266. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +77 -0
  267. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +31 -0
  268. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +40 -0
  269. data/lib/contrast/agent/assess/properties.rb +392 -0
  270. data/lib/contrast/agent/assess/rule.rb +18 -0
  271. data/lib/contrast/agent/assess/rule/base.rb +72 -0
  272. data/lib/contrast/agent/assess/rule/csrf.rb +66 -0
  273. data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +28 -0
  274. data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +69 -0
  275. data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +132 -0
  276. data/lib/contrast/agent/assess/rule/provider.rb +21 -0
  277. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +62 -0
  278. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +73 -0
  279. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +121 -0
  280. data/lib/contrast/agent/assess/rule/redos.rb +68 -0
  281. data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +47 -0
  282. data/lib/contrast/agent/assess/rule/response_watcher.rb +36 -0
  283. data/lib/contrast/agent/assess/rule/watcher.rb +36 -0
  284. data/lib/contrast/agent/assess/tag.rb +151 -0
  285. data/lib/contrast/agent/at_exit_hook.rb +33 -0
  286. data/lib/contrast/agent/class_reopener.rb +195 -0
  287. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +26 -0
  288. data/lib/contrast/agent/deadzone/policy/policy.rb +57 -0
  289. data/lib/contrast/agent/disable_reaction.rb +24 -0
  290. data/lib/contrast/agent/exclusion_matcher.rb +190 -0
  291. data/lib/contrast/agent/feature_state.rb +379 -0
  292. data/lib/contrast/agent/inventory/policy/policy.rb +32 -0
  293. data/lib/contrast/agent/inventory/policy/trigger_node.rb +22 -0
  294. data/lib/contrast/agent/logger_manager.rb +116 -0
  295. data/lib/contrast/agent/middleware.rb +352 -0
  296. data/lib/contrast/agent/module_data.rb +16 -0
  297. data/lib/contrast/agent/patching/policy/after_load_patch.rb +37 -0
  298. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +58 -0
  299. data/lib/contrast/agent/patching/policy/method_policy.rb +94 -0
  300. data/lib/contrast/agent/patching/policy/module_policy.rb +116 -0
  301. data/lib/contrast/agent/patching/policy/patch.rb +312 -0
  302. data/lib/contrast/agent/patching/policy/patch_status.rb +192 -0
  303. data/lib/contrast/agent/patching/policy/patcher.rb +310 -0
  304. data/lib/contrast/agent/patching/policy/policy.rb +138 -0
  305. data/lib/contrast/agent/patching/policy/policy_node.rb +80 -0
  306. data/lib/contrast/agent/patching/policy/policy_unpatcher.rb +28 -0
  307. data/lib/contrast/agent/patching/policy/trigger_node.rb +81 -0
  308. data/lib/contrast/agent/protect/policy/policy.rb +37 -0
  309. data/lib/contrast/agent/protect/policy/trigger_node.rb +23 -0
  310. data/lib/contrast/agent/protect/rule.rb +58 -0
  311. data/lib/contrast/agent/protect/rule/base.rb +300 -0
  312. data/lib/contrast/agent/protect/rule/base_service.rb +88 -0
  313. data/lib/contrast/agent/protect/rule/cmd_injection.rb +156 -0
  314. data/lib/contrast/agent/protect/rule/csrf.rb +118 -0
  315. data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +103 -0
  316. data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +85 -0
  317. data/lib/contrast/agent/protect/rule/default_scanner.rb +300 -0
  318. data/lib/contrast/agent/protect/rule/deserialization.rb +193 -0
  319. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +80 -0
  320. data/lib/contrast/agent/protect/rule/no_sqli.rb +101 -0
  321. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +40 -0
  322. data/lib/contrast/agent/protect/rule/path_traversal.rb +143 -0
  323. data/lib/contrast/agent/protect/rule/sqli.rb +101 -0
  324. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +16 -0
  325. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +38 -0
  326. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +22 -0
  327. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +19 -0
  328. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +20 -0
  329. data/lib/contrast/agent/protect/rule/xss.rb +24 -0
  330. data/lib/contrast/agent/protect/rule/xxe.rb +120 -0
  331. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +82 -0
  332. data/lib/contrast/agent/railtie.rb +30 -0
  333. data/lib/contrast/agent/reaction_processor.rb +47 -0
  334. data/lib/contrast/agent/request.rb +493 -0
  335. data/lib/contrast/agent/request_context.rb +225 -0
  336. data/lib/contrast/agent/require_state.rb +61 -0
  337. data/lib/contrast/agent/response.rb +215 -0
  338. data/lib/contrast/agent/rewriter.rb +244 -0
  339. data/lib/contrast/agent/scope.rb +28 -0
  340. data/lib/contrast/agent/service_heartbeat.rb +37 -0
  341. data/lib/contrast/agent/settings_state.rb +148 -0
  342. data/lib/contrast/agent/socket_client.rb +125 -0
  343. data/lib/contrast/agent/thread.rb +26 -0
  344. data/lib/contrast/agent/tracepoint_hook.rb +51 -0
  345. data/lib/contrast/agent/version.rb +8 -0
  346. data/lib/contrast/api.rb +17 -0
  347. data/lib/contrast/api/.gitkeep +0 -0
  348. data/lib/contrast/api/connection_status.rb +49 -0
  349. data/lib/contrast/api/socket.rb +43 -0
  350. data/lib/contrast/api/speedracer.rb +206 -0
  351. data/lib/contrast/api/tcp_socket.rb +31 -0
  352. data/lib/contrast/api/unix_socket.rb +25 -0
  353. data/lib/contrast/common_agent_configuration.rb +86 -0
  354. data/lib/contrast/components/agent.rb +85 -0
  355. data/lib/contrast/components/app_context.rb +188 -0
  356. data/lib/contrast/components/assess.rb +67 -0
  357. data/lib/contrast/components/config.rb +135 -0
  358. data/lib/contrast/components/contrast_service.rb +113 -0
  359. data/lib/contrast/components/heap_dump.rb +34 -0
  360. data/lib/contrast/components/interface.rb +178 -0
  361. data/lib/contrast/components/inventory.rb +23 -0
  362. data/lib/contrast/components/logger.rb +92 -0
  363. data/lib/contrast/components/protect.rb +38 -0
  364. data/lib/contrast/components/sampling.rb +41 -0
  365. data/lib/contrast/components/scope.rb +106 -0
  366. data/lib/contrast/components/settings.rb +140 -0
  367. data/lib/contrast/config.rb +33 -0
  368. data/lib/contrast/config/agent_configuration.rb +24 -0
  369. data/lib/contrast/config/application_configuration.rb +27 -0
  370. data/lib/contrast/config/assess_configuration.rb +22 -0
  371. data/lib/contrast/config/assess_rules_configuration.rb +18 -0
  372. data/lib/contrast/config/base_configuration.rb +105 -0
  373. data/lib/contrast/config/default_value.rb +16 -0
  374. data/lib/contrast/config/exception_configuration.rb +21 -0
  375. data/lib/contrast/config/heap_dump_configuration.rb +23 -0
  376. data/lib/contrast/config/inventory_configuration.rb +20 -0
  377. data/lib/contrast/config/logger_configuration.rb +20 -0
  378. data/lib/contrast/config/protect_configuration.rb +20 -0
  379. data/lib/contrast/config/protect_rule_configuration.rb +37 -0
  380. data/lib/contrast/config/protect_rules_configuration.rb +30 -0
  381. data/lib/contrast/config/root_configuration.rb +26 -0
  382. data/lib/contrast/config/ruby_configuration.rb +39 -0
  383. data/lib/contrast/config/sampling_configuration.rb +22 -0
  384. data/lib/contrast/config/server_configuration.rb +23 -0
  385. data/lib/contrast/config/service_configuration.rb +22 -0
  386. data/lib/contrast/configuration.rb +214 -0
  387. data/lib/contrast/core_extensions/assess.rb +51 -0
  388. data/lib/contrast/core_extensions/assess/array.rb +58 -0
  389. data/lib/contrast/core_extensions/assess/assess_extension.rb +145 -0
  390. data/lib/contrast/core_extensions/assess/basic_object.rb +15 -0
  391. data/lib/contrast/core_extensions/assess/erb.rb +42 -0
  392. data/lib/contrast/core_extensions/assess/exec_trigger.rb +48 -0
  393. data/lib/contrast/core_extensions/assess/fiber.rb +125 -0
  394. data/lib/contrast/core_extensions/assess/hash.rb +22 -0
  395. data/lib/contrast/core_extensions/assess/kernel.rb +95 -0
  396. data/lib/contrast/core_extensions/assess/module.rb +14 -0
  397. data/lib/contrast/core_extensions/assess/regexp.rb +206 -0
  398. data/lib/contrast/core_extensions/assess/string.rb +75 -0
  399. data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb +73 -0
  400. data/lib/contrast/core_extensions/delegator.rb +14 -0
  401. data/lib/contrast/core_extensions/eval_trigger.rb +52 -0
  402. data/lib/contrast/core_extensions/inventory.rb +22 -0
  403. data/lib/contrast/core_extensions/inventory/datastores.rb +37 -0
  404. data/lib/contrast/core_extensions/module.rb +42 -0
  405. data/lib/contrast/core_extensions/object.rb +27 -0
  406. data/lib/contrast/core_extensions/protect.rb +20 -0
  407. data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb +70 -0
  408. data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb +58 -0
  409. data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb +81 -0
  410. data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb +119 -0
  411. data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb +63 -0
  412. data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb +141 -0
  413. data/lib/contrast/core_extensions/protect/kernel.rb +30 -0
  414. data/lib/contrast/core_extensions/protect/psych.rb +7 -0
  415. data/lib/contrast/core_extensions/thread.rb +31 -0
  416. data/lib/contrast/internal_exception.rb +8 -0
  417. data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb +48 -0
  418. data/lib/contrast/rails_extensions/assess/active_record.rb +32 -0
  419. data/lib/contrast/rails_extensions/assess/active_record_named.rb +61 -0
  420. data/lib/contrast/rails_extensions/assess/configuration.rb +26 -0
  421. data/lib/contrast/rails_extensions/buffer.rb +30 -0
  422. data/lib/contrast/rails_extensions/rack.rb +45 -0
  423. data/lib/contrast/security_exception.rb +14 -0
  424. data/lib/contrast/sinatra_extensions/assess/cookie.rb +26 -0
  425. data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb +59 -0
  426. data/lib/contrast/tasks/service.rb +95 -0
  427. data/lib/contrast/utils/assess/sampling_util.rb +96 -0
  428. data/lib/contrast/utils/assess/tracking_util.rb +39 -0
  429. data/lib/contrast/utils/boolean_util.rb +33 -0
  430. data/lib/contrast/utils/cache.rb +69 -0
  431. data/lib/contrast/utils/class_util.rb +58 -0
  432. data/lib/contrast/utils/comment_range.rb +19 -0
  433. data/lib/contrast/utils/data_store_util.rb +23 -0
  434. data/lib/contrast/utils/duck_utils.rb +58 -0
  435. data/lib/contrast/utils/env_configuration_item.rb +52 -0
  436. data/lib/contrast/utils/environment_util.rb +152 -0
  437. data/lib/contrast/utils/freeze_util.rb +36 -0
  438. data/lib/contrast/utils/gemfile_reader.rb +191 -0
  439. data/lib/contrast/utils/hash_digest.rb +148 -0
  440. data/lib/contrast/utils/heap_dump_util.rb +113 -0
  441. data/lib/contrast/utils/invalid_configuration_util.rb +88 -0
  442. data/lib/contrast/utils/inventory_util.rb +126 -0
  443. data/lib/contrast/utils/io_util.rb +61 -0
  444. data/lib/contrast/utils/object_share.rb +117 -0
  445. data/lib/contrast/utils/operating_environment.rb +38 -0
  446. data/lib/contrast/utils/os.rb +49 -0
  447. data/lib/contrast/utils/path_util.rb +151 -0
  448. data/lib/contrast/utils/performs_logging.rb +152 -0
  449. data/lib/contrast/utils/preflight_util.rb +13 -0
  450. data/lib/contrast/utils/prevent_serialization.rb +52 -0
  451. data/lib/contrast/utils/rack_assess_session_cookie.rb +104 -0
  452. data/lib/contrast/utils/rails_assess_configuration.rb +95 -0
  453. data/lib/contrast/utils/random_util.rb +22 -0
  454. data/lib/contrast/utils/resource_loader.rb +23 -0
  455. data/lib/contrast/utils/ruby_ast_rewriter.rb +74 -0
  456. data/lib/contrast/utils/scope_util.rb +99 -0
  457. data/lib/contrast/utils/service_response_util.rb +116 -0
  458. data/lib/contrast/utils/service_sender_util.rb +98 -0
  459. data/lib/contrast/utils/sha256_builder.rb +69 -0
  460. data/lib/contrast/utils/sinatra_helper.rb +49 -0
  461. data/lib/contrast/utils/stack_trace_utils.rb +209 -0
  462. data/lib/contrast/utils/string_utils.rb +72 -0
  463. data/lib/contrast/utils/tag_util.rb +139 -0
  464. data/lib/contrast/utils/thread_tracker.rb +54 -0
  465. data/lib/contrast/utils/timer.rb +78 -0
  466. data/resources/assess/policy.json +1673 -0
  467. data/resources/csrf/inject.js +44 -0
  468. data/resources/deadzone/policy.json +55 -0
  469. data/resources/factory-bot-spec/spec_helper.rb +30 -0
  470. data/resources/inventory/policy.json +110 -0
  471. data/resources/protect/policy.json +417 -0
  472. data/resources/rubocops/kernel/catch_cop.rb +37 -0
  473. data/resources/rubocops/kernel/require_cop.rb +37 -0
  474. data/resources/rubocops/kernel/require_relative_cop.rb +33 -0
  475. data/resources/rubocops/module/autoload_cop.rb +37 -0
  476. data/resources/rubocops/module/const_defined_cop.rb +37 -0
  477. data/resources/rubocops/module/const_get_cop.rb +37 -0
  478. data/resources/rubocops/module/const_set_cop.rb +37 -0
  479. data/resources/rubocops/module/constants_cop.rb +37 -0
  480. data/resources/rubocops/module/name_cop.rb +37 -0
  481. data/resources/rubocops/object/class_cop.rb +37 -0
  482. data/resources/rubocops/object/freeze_cop.rb +37 -0
  483. data/resources/rubocops/object/frozen_cop.rb +37 -0
  484. data/resources/rubocops/object/is_a_cop.rb +37 -0
  485. data/resources/rubocops/object/method_cop.rb +37 -0
  486. data/resources/rubocops/object/respond_to_cop.rb +37 -0
  487. data/resources/rubocops/object/singleton_class_cop.rb +37 -0
  488. data/resources/rubocops/regexp/spelling_cop.rb +44 -0
  489. data/resources/rubocops/thread/new_cop.rb +39 -0
  490. data/resources/ruby-spec/ancestors_spec.rb +70 -0
  491. data/resources/ruby-spec/modulo_spec.rb +831 -0
  492. data/resources/ruby-spec/parameters_spec.rb +261 -0
  493. data/resources/ruby-spec/ruby_spec_spec_helper.rb +35 -0
  494. data/resources/test_marker.txt +1 -0
  495. data/ruby-agent.gemspec +129 -0
  496. data/service_executables/.gitkeep +0 -0
  497. data/service_executables/VERSION +1 -0
  498. data/service_executables/linux/contrast-service +0 -0
  499. data/service_executables/mac/contrast-service +0 -0
  500. metadata +945 -0
@@ -0,0 +1,80 @@
1
+ <?xml version="1.0" encoding="utf-8"?>
2
+ <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3
+ <ItemGroup>
4
+ <Filter Include="Source Files">
5
+ <UniqueIdentifier>{50ac9ad6-0895-4596-b142-1a7fad1b97d5}</UniqueIdentifier>
6
+ <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm</Extensions>
7
+ </Filter>
8
+ <Filter Include="Header Files">
9
+ <UniqueIdentifier>{8612ae75-7b41-4557-b23b-d3e14e7f9613}</UniqueIdentifier>
10
+ <Extensions>h;hpp;hxx;hm;inl;inc</Extensions>
11
+ </Filter>
12
+ </ItemGroup>
13
+ <ItemGroup>
14
+ <ClCompile Include="..\..\src\decoder.c">
15
+ <Filter>Source Files</Filter>
16
+ </ClCompile>
17
+ <ClCompile Include="..\..\src\distorm.c">
18
+ <Filter>Source Files</Filter>
19
+ </ClCompile>
20
+ <ClCompile Include="..\..\src\instructions.c">
21
+ <Filter>Source Files</Filter>
22
+ </ClCompile>
23
+ <ClCompile Include="..\..\src\insts.c">
24
+ <Filter>Source Files</Filter>
25
+ </ClCompile>
26
+ <ClCompile Include="..\..\src\mnemonics.c">
27
+ <Filter>Source Files</Filter>
28
+ </ClCompile>
29
+ <ClCompile Include="..\..\src\operands.c">
30
+ <Filter>Source Files</Filter>
31
+ </ClCompile>
32
+ <ClCompile Include="..\..\src\prefix.c">
33
+ <Filter>Source Files</Filter>
34
+ </ClCompile>
35
+ <ClCompile Include="..\..\src\textdefs.c">
36
+ <Filter>Source Files</Filter>
37
+ </ClCompile>
38
+ <ClCompile Include="..\..\src\wstring.c">
39
+ <Filter>Source Files</Filter>
40
+ </ClCompile>
41
+ <ClCompile Include="..\..\src\x86defs.c">
42
+ <Filter>Source Files</Filter>
43
+ </ClCompile>
44
+ </ItemGroup>
45
+ <ItemGroup>
46
+ <ClInclude Include="..\..\src\config.h">
47
+ <Filter>Header Files</Filter>
48
+ </ClInclude>
49
+ <ClInclude Include="..\..\include\distorm.h">
50
+ <Filter>Header Files</Filter>
51
+ </ClInclude>
52
+ <ClInclude Include="..\..\src\instructions.h">
53
+ <Filter>Header Files</Filter>
54
+ </ClInclude>
55
+ <ClInclude Include="..\..\src\insts.h">
56
+ <Filter>Header Files</Filter>
57
+ </ClInclude>
58
+ <ClInclude Include="..\..\include\mnemonics.h">
59
+ <Filter>Header Files</Filter>
60
+ </ClInclude>
61
+ <ClInclude Include="..\..\src\operands.h">
62
+ <Filter>Header Files</Filter>
63
+ </ClInclude>
64
+ <ClInclude Include="..\..\src\prefix.h">
65
+ <Filter>Header Files</Filter>
66
+ </ClInclude>
67
+ <ClInclude Include="..\..\src\textdefs.h">
68
+ <Filter>Header Files</Filter>
69
+ </ClInclude>
70
+ <ClInclude Include="..\..\src\wstring.h">
71
+ <Filter>Header Files</Filter>
72
+ </ClInclude>
73
+ <ClInclude Include="..\..\src\x86defs.h">
74
+ <Filter>Header Files</Filter>
75
+ </ClInclude>
76
+ </ItemGroup>
77
+ <ItemGroup>
78
+ <ResourceCompile Include="resource.rc" />
79
+ </ItemGroup>
80
+ </Project>
@@ -0,0 +1,25 @@
1
+ Microsoft Visual Studio Solution File, Format Version 11.00
2
+ # Visual Studio 2010
3
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "distorm", "cdistorm.vcxproj", "{15051CE1-AB10-4239-973D-01B84F2AD0A9}"
4
+ EndProject
5
+ Global
6
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
7
+ clib|Win32 = clib|Win32
8
+ clib|x64 = clib|x64
9
+ dll|Win32 = dll|Win32
10
+ dll|x64 = dll|x64
11
+ EndGlobalSection
12
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
13
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.ActiveCfg = clib|Win32
14
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.Build.0 = clib|Win32
15
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.ActiveCfg = clib|x64
16
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.Build.0 = clib|x64
17
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.ActiveCfg = dll|Win32
18
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.Build.0 = dll|Win32
19
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.ActiveCfg = dll|x64
20
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.Build.0 = dll|x64
21
+ EndGlobalSection
22
+ GlobalSection(SolutionProperties) = preSolution
23
+ HideSolutionNode = FALSE
24
+ EndGlobalSection
25
+ EndGlobal
@@ -0,0 +1,14 @@
1
+ //{{NO_DEPENDENCIES}}
2
+ // Microsoft Visual C++ generated include file.
3
+ // Used by resource.rc
4
+
5
+ // Next default values for new objects
6
+ //
7
+ #ifdef APSTUDIO_INVOKED
8
+ #ifndef APSTUDIO_READONLY_SYMBOLS
9
+ #define _APS_NEXT_RESOURCE_VALUE 101
10
+ #define _APS_NEXT_COMMAND_VALUE 40001
11
+ #define _APS_NEXT_CONTROL_VALUE 1001
12
+ #define _APS_NEXT_SYMED_VALUE 101
13
+ #endif
14
+ #endif
@@ -0,0 +1,99 @@
1
+ // Microsoft Visual C++ generated resource script.
2
+ //
3
+ #include "resource.h"
4
+
5
+ #define APSTUDIO_READONLY_SYMBOLS
6
+ /////////////////////////////////////////////////////////////////////////////
7
+ //
8
+ // Generated from the TEXTINCLUDE 2 resource.
9
+ //
10
+ #include "afxres.h"
11
+
12
+ /////////////////////////////////////////////////////////////////////////////
13
+ #undef APSTUDIO_READONLY_SYMBOLS
14
+
15
+ /////////////////////////////////////////////////////////////////////////////
16
+ // English (United States) resources
17
+
18
+ #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
19
+ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
20
+ #pragma code_page(1252)
21
+
22
+ #ifdef APSTUDIO_INVOKED
23
+ /////////////////////////////////////////////////////////////////////////////
24
+ //
25
+ // TEXTINCLUDE
26
+ //
27
+
28
+ 1 TEXTINCLUDE
29
+ BEGIN
30
+ "resource.h\0"
31
+ END
32
+
33
+ 2 TEXTINCLUDE
34
+ BEGIN
35
+ "#include ""afxres.h""\r\n"
36
+ "\0"
37
+ END
38
+
39
+ 3 TEXTINCLUDE
40
+ BEGIN
41
+ "\r\n"
42
+ "\0"
43
+ END
44
+
45
+ #endif // APSTUDIO_INVOKED
46
+
47
+
48
+ /////////////////////////////////////////////////////////////////////////////
49
+ //
50
+ // Version
51
+ //
52
+
53
+ VS_VERSION_INFO VERSIONINFO
54
+ FILEVERSION 3,3,4,0
55
+ PRODUCTVERSION 3,3,4,0
56
+ FILEFLAGSMASK 0x17L
57
+ #ifdef _DEBUG
58
+ FILEFLAGS 0x1L
59
+ #else
60
+ FILEFLAGS 0x0L
61
+ #endif
62
+ FILEOS 0x4L
63
+ FILETYPE 0x2L
64
+ FILESUBTYPE 0x0L
65
+ BEGIN
66
+ BLOCK "StringFileInfo"
67
+ BEGIN
68
+ BLOCK "040904b0"
69
+ BEGIN
70
+ VALUE "FileDescription", "diStorm3 module"
71
+ VALUE "FileVersion", "3.3.4.0"
72
+ VALUE "InternalName", "diStorm3"
73
+ VALUE "LegalCopyright", "Copyright (C) 2003-2016 Gil Dabah"
74
+ VALUE "OriginalFilename", "diStorm3.dll"
75
+ VALUE "ProductName", "diStorm3 Disassembler Library"
76
+ VALUE "ProductVersion", "3.3.4.0"
77
+ END
78
+ END
79
+ BLOCK "VarFileInfo"
80
+ BEGIN
81
+ VALUE "Translation", 0x409, 1200
82
+ END
83
+ END
84
+
85
+ #endif // English (United States) resources
86
+ /////////////////////////////////////////////////////////////////////////////
87
+
88
+
89
+
90
+ #ifndef APSTUDIO_INVOKED
91
+ /////////////////////////////////////////////////////////////////////////////
92
+ //
93
+ // Generated from the TEXTINCLUDE 3 resource.
94
+ //
95
+
96
+
97
+ /////////////////////////////////////////////////////////////////////////////
98
+ #endif // not APSTUDIO_INVOKED
99
+
@@ -0,0 +1,957 @@
1
+ # :[diStorm3}: Python binding
2
+ # Based on diStorm64 Python binding by Mario Vilas
3
+ # Initial support for decompose API added by Roee Shenberg
4
+ # Licensed under BSD in 2016.
5
+ #
6
+ # Compatible with Python2.6 and above.
7
+ #
8
+
9
+ info = (
10
+ "diStorm3 by Gil Dabah, https://github.com/gdabah/distorm/\n"
11
+ "Based on diStorm64 Python binding by Mario Vilas, http://breakingcode.wordpress.com/\n"
12
+ )
13
+
14
+ __revision__ = "$Id: distorm.py 186 2010-05-01 14:20:41Z gdabah $"
15
+
16
+ __all__ = [
17
+ 'Decode',
18
+ 'DecodeGenerator',
19
+ 'Decompose',
20
+ 'DecomposeGenerator',
21
+ 'Decode16Bits',
22
+ 'Decode32Bits',
23
+ 'Decode64Bits',
24
+ 'Mnemonics',
25
+ 'Registers',
26
+ ]
27
+
28
+ from ctypes import *
29
+ from os.path import split, join
30
+ from os import name as os_name
31
+ import sys
32
+
33
+ if sys.version_info[0] >= 3:
34
+ xrange = range
35
+
36
+ #==============================================================================
37
+ # Load the diStorm DLL
38
+
39
+ # Guess the DLL filename and load the library.
40
+ _distorm_path = split(__file__)[0]
41
+ if hasattr(sys, '_MEIPASS'):
42
+ _distorm_path = sys._MEIPASS
43
+ potential_libs = ['libdistorm3.so', 'libdistorm3.dylib']
44
+ if os_name == 'nt':
45
+ potential_libs = ['distorm3.dll', 'libdistorm3.dll']
46
+ lib_was_found = False
47
+ for i in potential_libs:
48
+ try:
49
+ _distorm_file = join(_distorm_path, i)
50
+ _distorm = cdll.LoadLibrary(_distorm_file)
51
+ lib_was_found = True
52
+ break
53
+ except OSError:
54
+ pass
55
+
56
+ if lib_was_found == False:
57
+ raise ImportError("Error loading the diStorm dynamic library (or cannot load library into process).")
58
+
59
+ # Get the decode C function (try 64 bits version first, only then 32 bits).
60
+ SUPPORT_64BIT_OFFSET = False
61
+ try:
62
+ internal_decode = _distorm.distorm_decode64
63
+ internal_decompose = _distorm.distorm_decompose64
64
+ internal_format = _distorm.distorm_format64
65
+ SUPPORT_64BIT_OFFSET = True
66
+ except AttributeError:
67
+ try:
68
+ internal_decode = _distorm.distorm_decode32
69
+ internal_decompose = _distorm.distorm_decompose32
70
+ internal_format = _distorm.distorm_format32
71
+ except AttributeError:
72
+ raise ImportError("Error loading distorm")
73
+
74
+ #==============================================================================
75
+ # diStorm C interface
76
+
77
+ MAX_TEXT_SIZE = 48 # See distorm.h for this value.
78
+ MAX_INSTRUCTIONS = 1000
79
+
80
+ DECRES_NONE = 0
81
+ DECRES_SUCCESS = 1
82
+ DECRES_MEMORYERR = 2
83
+ DECRES_INPUTERR = 3
84
+
85
+ if SUPPORT_64BIT_OFFSET:
86
+ _OffsetType = c_ulonglong
87
+ else:
88
+ _OffsetType = c_uint
89
+
90
+ class _WString (Structure):
91
+ _fields_ = [
92
+ ('length', c_uint),
93
+ ('p', c_char * MAX_TEXT_SIZE),
94
+ ]
95
+
96
+ class _CodeInfo (Structure):
97
+ _fields_ = [
98
+ ('codeOffset', _OffsetType),
99
+ ('nextOffset', _OffsetType),
100
+ ('code', c_char_p),
101
+ ('codeLen', c_int),
102
+ ('dt', c_byte),
103
+ ('features', c_uint),
104
+ ]
105
+
106
+ class _DecodedInst (Structure):
107
+ _fields_ = [
108
+ ('mnemonic', _WString),
109
+ ('operands', _WString),
110
+ ('instructionHex', _WString),
111
+ ('size', c_uint),
112
+ ('offset', _OffsetType),
113
+ ]
114
+
115
+ # _OperandType enum
116
+ _OperandType = c_ubyte
117
+
118
+ O_NONE = 0
119
+ O_REG = 1
120
+ O_IMM = 2
121
+ O_IMM1 = 3
122
+ O_IMM2 = 4
123
+ O_DISP = 5
124
+ O_SMEM = 6
125
+ O_MEM = 7
126
+ O_PC = 8
127
+ O_PTR = 9
128
+
129
+ class _Operand (Structure):
130
+ _fields_ = [
131
+ ('type', c_ubyte), # of type _OperandType
132
+ ('index', c_ubyte),
133
+ ('size', c_uint16),
134
+ ]
135
+
136
+ class _ex (Structure):
137
+ _fields_ = [
138
+ ('i1', c_uint32),
139
+ ('i2', c_uint32),
140
+ ]
141
+ class _ptr (Structure):
142
+ _fields_ = [
143
+ ('seg', c_uint16),
144
+ ('off', c_uint32),
145
+ ]
146
+
147
+ class _Value (Union):
148
+ _fields_ = [
149
+ ('sbyte', c_byte),
150
+ ('byte', c_ubyte),
151
+ ('sword', c_int16),
152
+ ('word', c_uint16),
153
+ ('sdword', c_int32),
154
+ ('dword', c_uint32),
155
+ ('sqword', c_int64),
156
+ ('qword', c_uint64),
157
+ ('addr', _OffsetType),
158
+ ('ptr', _ptr),
159
+ ('ex', _ex),
160
+ ]
161
+
162
+ class _DInst (Structure):
163
+ _fields_ = [
164
+ ('imm', _Value),
165
+ ('disp', c_uint64), # displacement. size is according to dispSize
166
+ ('addr', _OffsetType),
167
+ ('flags', c_uint16), # -1 if invalid. See C headers for more info
168
+ ('unusedPrefixesMask', c_uint16),
169
+ ('usedRegistersMask', c_uint32), # used registers mask.
170
+ ('opcode', c_uint16), # look up in opcode table
171
+ ('ops', _Operand*4),
172
+ ('size', c_ubyte),
173
+ ('segment', c_ubyte), # -1 if unused. See C headers for more info
174
+ ('base', c_ubyte), # base register for indirections
175
+ ('scale', c_ubyte), # ignore for values 0, 1 (other valid values - 2,4,8)
176
+ ('dispSize', c_ubyte),
177
+ ('meta', c_ubyte), # meta flags - instruction set class, etc. See C headers again...
178
+ ('modifiedFlagsMask', c_uint16), # CPU modified (output) flags by instruction.
179
+ ('testedFlagsMask', c_uint16), # CPU tested (input) flags by instruction.
180
+ ('undefinedFlagsMask', c_uint16) # CPU undefined flags by instruction.
181
+ ]
182
+
183
+ #==============================================================================
184
+ # diStorm Python interface
185
+
186
+ Decode16Bits = 0 # 80286 decoding
187
+ Decode32Bits = 1 # IA-32 decoding
188
+ Decode64Bits = 2 # AMD64 decoding
189
+ OffsetTypeSize = sizeof(_OffsetType)
190
+
191
+ Mnemonics = {
192
+ 0x679: "SLDT", 0x62: "POPA", 0x904: "UNPCKHPS", 0x115: "POPF", 0x11cf: "CMPLTSS",
193
+ 0x875: "VMOVSD", 0x79f: "PFPNACC", 0xb2a: "VMOVMSKPD", 0x74d: "INVLPGA", 0x90e: "UNPCKHPD",
194
+ 0x270: "SYSEXIT", 0x7c8: "PFSUB", 0x121e: "CMPLTSD", 0x1a73: "VPMULHUW", 0x1d4b: "VPHSUBSW",
195
+ 0x12c8: "VCMPNGEPS", 0x86d: "VMOVSS", 0x6f: "ARPL", 0x53a: "FICOMP", 0x162: "RETF",
196
+ 0x45d: "FCHS", 0x113a: "CMPLEPS", 0xf08: "PUNPCKHDQ", 0x2417: "VAESDEC", 0x5fe: "FUCOM",
197
+ 0x12b0: "VCMPORDPS", 0x19c1: "PSUBUSW", 0x1b5b: "PXOR", 0x1e25: "VPABSB", 0x24a: "WRMSR",
198
+ 0x12bb: "VCMPEQ_UQPS", 0x22cc: "VFMADDSUB231PD", 0x7df: "PFMAX", 0x16e3: "VCMPNEQ_OSSS",
199
+ 0x225a: "VFNMADD213PD", 0x3b8: "MOVNTI", 0x7d6: "PFCMPGT", 0x2380: "VFNMADD231SS",
200
+ 0x2466: "ROUNDPD", 0x1303: "VCMPGTPS", 0xbb5: "VRCPSS", 0x2150: "VFNMADD132SS",
201
+ 0x145a: "VCMPNGEPD", 0x2225: "VFMSUB213PD", 0x1875: "VCMPNEQ_OSSD", 0x2695: "VPSLLDQ",
202
+ 0x7a8: "PFCMPGE", 0x1495: "VCMPGTPD", 0x1a99: "CVTDQ2PD", 0x1227: "CMPLESD",
203
+ 0xae: "JNS", 0xdee: "VDIVSD", 0xb7: "JNP", 0x251e: "EXTRACTPS", 0x1f59: "PMOVZXBQ",
204
+ 0x9c: "JNZ", 0x5e8: "FCOMI", 0xefc: "VPUNPCKHWD", 0x1f44: "PMOVZXBD", 0x1ae0: "VMOVNTDQ",
205
+ 0x1e8a: "PMOVSXWD", 0x1108: "POPCNT", 0x8a: "JNO", 0x1ca5: "FNSAVE", 0x1a5: "LOOP",
206
+ 0xb1f: "VMOVMSKPS", 0x47b: "FLDL2T", 0x12d: "CMPS", 0x418: "FSUB", 0xdba: "DIVPS",
207
+ 0x1d31: "PHSUBD", 0x11c6: "CMPEQSS", 0x1e7: "CMC", 0xd15: "CVTTPS2DQ", 0xdc1: "DIVPD",
208
+ 0xf72: "VMOVD", 0x104: "CALL FAR", 0x1d88: "PMULHRSW", 0x1d92: "VPMULHRSW",
209
+ 0x1d20: "PHSUBW", 0x1215: "CMPEQSD", 0x3b2: "XADD", 0x2ae: "CMOVBE", 0x47: "CMP",
210
+ 0x24: "SBB", 0x1084: "VHADDPS", 0x26c3: "FXRSTOR64", 0x207a: "INVVPID", 0x20f: "LSL",
211
+ 0x1673: "VCMPNEQ_USSS", 0x107b: "VHADDPD", 0x38b: "LSS", 0x210d: "VFMSUB132PD",
212
+ 0x121: "LAHF", 0x802: "PFACC", 0x819: "PFRCPIT2", 0xe3d: "VPUNPCKLBW", 0x7e6: "PFRCPIT1",
213
+ 0x1fad: "PCMPGTQ", 0x4af: "FYL2X", 0x182f: "VCMPORD_SSD", 0x1949: "PSRLD",
214
+ 0x10f7: "SFENCE", 0xd0b: "CVTPS2DQ", 0x24c5: "PBLENDW", 0x21c4: "VFMSUBADD213PS",
215
+ 0xe8c: "PCMPGTB", 0xeb2: "PCMPGTD", 0x23ed: "VAESENC", 0x96d: "VMOVSHDUP",
216
+ 0x25b2: "MPSADBW", 0x14fd: "VCMPNLE_UQPD", 0x720: "VMMCALL", 0x1045: "INSERTQ",
217
+ 0x2268: "VFNMADD213SS", 0x9d5: "CVTPI2PD", 0x16f: "INT", 0x1d9d: "VPERMILPS",
218
+ 0x1e2: "HLT", 0x2059: "PHMINPOSUW", 0x5c1: "FCMOVNU", 0x2083: "INVPCID", 0x7b: "INS",
219
+ 0x657: "FCOMIP", 0x9cb: "CVTPI2PS", 0x2276: "VFNMADD213SD", 0xec5: "PACKUSWB",
220
+ 0xe4: "CBW", 0x731: "VMSAVE", 0x10e: "PUSHF", 0x65f: "NOT", 0x5a5: "FCMOVNB",
221
+ 0x245: "NOP", 0x4f8: "FSQRT", 0x1da8: "VPERMILPD", 0x51: "INC", 0x239: "UD2",
222
+ 0xffd: "VPCMPEQW", 0x262b: "PCMPISTRM", 0x1ee3: "VPCMPEQQ", 0x1163: "CMPNLEPS",
223
+ 0x183c: "VCMPEQ_USSD", 0x1414: "VCMPUNORDPD", 0x60d: "FADDP", 0x145: "RET",
224
+ 0x1010: "VPCMPEQD", 0x1fd9: "VPMINSD", 0x2558: "VPINSRB", 0xfea: "VPCMPEQB",
225
+ 0x1910: "ADDSUBPD", 0x22bc: "VFMADDSUB231PS", 0x16aa: "VCMPEQ_USSS", 0x1d66: "PSIGNW",
226
+ 0x1ebe: "VPMOVSXDQ", 0x201d: "VPMAXSD", 0x35b: "SETG", 0x200c: "VPMAXSB", 0x327: "SETA",
227
+ 0x306: "SETB", 0x26f5: "STMXCSR", 0x347: "SETL", 0x1acf: "MOVNTQ", 0x2f9: "SETO",
228
+ 0xbe3: "ANDNPD", 0x111c: "BSR", 0x8d0: "VMOVDDUP", 0x1b52: "VPMAXSW", 0x1d77: "PSIGND",
229
+ 0x33a: "SETP", 0x1d55: "PSIGNB", 0x395: "LFS", 0x32d: "SETS", 0x15a6: "VCMPUNORDSS",
230
+ 0xbdb: "ANDNPS", 0x2724: "VMXON", 0xbcb: "VANDPS", 0x703: "XSETBV", 0x1c3: "OUT",
231
+ 0x68a: "LTR", 0x2586: "VPINSRD", 0x1115: "TZCNT", 0xa6d: "VCVTTSS2SI", 0x2684: "VPSRLDQ",
232
+ 0x4d6: "FDECSTP", 0x267c: "PSRLDQ", 0x1883: "VCMPGE_OQSD", 0x268d: "PSLLDQ",
233
+ 0x51f: "FCOS", 0x4c5: "FXTRACT", 0x16f1: "VCMPGE_OQSS", 0x1ef7: "VMOVNTDQA",
234
+ 0x1533: "VCMPNGT_UQPD", 0x405: "FMUL", 0x13da: "VCMPGT_OQPS", 0x61b: "FCOMPP",
235
+ 0x790: "PF2ID", 0xf5: "CWD", 0x1340: "VCMPUNORD_SPS", 0x2ea: "CMOVLE", 0xfcd: "VPSHUFHW",
236
+ 0x156c: "VCMPGT_OQPD", 0x1cf6: "PHADDSW", 0x789: "PF2IW", 0xa37: "VMOVNTPD",
237
+ 0x411: "FCOMP", 0x8da: "UNPCKLPS", 0x1be5: "MASKMOVDQU", 0x570: "FCMOVBE",
238
+ 0x14b8: "VCMPLT_OQPD", 0xe2a: "VMAXSD", 0x142c: "VCMPNLTPD", 0x99d: "PREFETCHT2",
239
+ 0x991: "PREFETCHT1", 0x985: "PREFETCHT0", 0x8e4: "UNPCKLPD", 0xa57: "CVTTSS2SI",
240
+ 0x66e: "DIV", 0x1eb4: "PMOVSXDQ", 0x161d: "VCMPGESS", 0xef: "CDQE", 0x2708: "VSTMXCSR",
241
+ 0x549: "FISUBR", 0x1fc8: "VPMINSB", 0x2218: "VFMSUB213PS", 0x1326: "VCMPLT_OQPS",
242
+ 0x11d8: "CMPLESS", 0x1b14: "VPMINSW", 0x1c70: "FSTENV", 0x17af: "VCMPGESD",
243
+ 0x1dea: "VPTEST", 0x542: "FISUB", 0x205: "STD", 0xf29: "VPACKSSDW", 0x3d: "XOR",
244
+ 0xc95: "VMULPD", 0x1f1: "STC", 0x1fb: "STI", 0x26d8: "LDMXCSR", 0x1180: "CMPLTPD",
245
+ 0xbfd: "ORPS", 0x1f0c: "VPACKUSDW", 0x62b: "FSUBP", 0x67f: "STR", 0x41e: "FSUBR",
246
+ 0x1131: "CMPLTPS", 0x2323: "VFMADD231SD", 0x2733: "PAUSE", 0x1aa3: "CVTPD2DQ",
247
+ 0x372: "RSM", 0xb70: "VSQRTSD", 0xc09: "VORPS", 0x21a4: "VFMADDSUB213PS", 0x23e5: "AESENC",
248
+ 0x144d: "VCMPEQ_UQPD", 0x918: "VUNPCKHPS", 0x1d09: "PMADDUBSW", 0x136b: "VCMPNLE_UQPS",
249
+ 0x1b7e: "VPSLLW", 0x1bdb: "MASKMOVQ", 0x1c8: "CALL", 0xb67: "VSQRTSS", 0x19f2: "PADDUSB",
250
+ 0x1036: "VMREAD", 0x10eb: "XSAVEOPT64", 0x923: "VUNPCKHPD", 0xd5e: "VSUBPS",
251
+ 0xceb: "VCVTSS2SD", 0x242c: "VAESDECLAST", 0x1095: "HSUBPS", 0xaad: "VCVTSS2SI",
252
+ 0x25f2: "VPBLENDVB", 0x17b9: "VCMPGTSD", 0x58a: "FILD", 0xaf9: "VCOMISS", 0x108d: "HSUBPD",
253
+ 0x23b8: "VFNMSUB231SS", 0x1a53: "VPSRAD", 0x12a5: "VCMPNLEPS", 0x3e5: "SAL",
254
+ 0x214: "SYSCALL", 0xb95: "VRSQRTSS", 0x258f: "VPINSRQ", 0x26fe: "WRGSBASE",
255
+ 0xfc4: "VPSHUFD", 0x1e4b: "PMOVSXBW", 0x1a44: "VPSRAW", 0x1437: "VCMPNLEPD",
256
+ 0x3ff: "FADD", 0x3ea: "SAR", 0x713: "XEND", 0x2659: "AESKEYGENASSIST", 0xf1f: "PACKSSDW",
257
+ 0x21fe: "VFMADD213SS", 0xf90: "VMOVDQA", 0x8c5: "VMOVSLDUP", 0x508: "FRNDINT",
258
+ 0x1976: "PMULLW", 0xdcf: "DIVSD", 0xb0b: "MOVMSKPS", 0x202e: "VPMAXUW", 0xdde: "VDIVPD",
259
+ 0x1e55: "VPMOVSXBW", 0x1e9f: "PMOVSXWQ", 0x2048: "PMULLD", 0xf99: "VMOVDQU",
260
+ 0x22ae: "VFNMSUB213SD", 0x297: "CMOVAE", 0x14ab: "VCMPEQ_OSPD", 0xdd6: "VDIVPS",
261
+ 0x93: "JAE", 0xb15: "MOVMSKPD", 0xdc8: "DIVSS", 0x1cad: "FSAVE", 0x1eda: "PCMPEQQ",
262
+ 0xfd7: "VPSHUFLW", 0xff4: "PCMPEQW", 0x26eb: "VLDMXCSR", 0x211a: "VFMSUB132SS",
263
+ 0x11bc: "CMPORDPD", 0xba6: "RCPSS", 0x1b8d: "VPSLLD", 0x673: "IDIV", 0x1442: "VCMPORDPD",
264
+ 0xfe1: "PCMPEQB", 0x1007: "PCMPEQD", 0x1b9c: "VPSLLQ", 0x1f63: "VPMOVZXBQ",
265
+ 0x21d4: "VFMSUBADD213PD", 0x25e7: "VBLENDVPD", 0x116d: "CMPORDPS", 0xf34: "PUNPCKLQDQ",
266
+ 0x19eb: "VPAND", 0x147d: "VCMPNEQ_OQPD", 0x106b: "HADDPD", 0x192f: "VADDSUBPS",
267
+ 0x18e7: "VSHUFPD", 0xd76: "VSUBSD", 0xb55: "VSQRTPS", 0x947: "MOVSHDUP", 0x238e: "VFNMADD231SD",
268
+ 0x6cf: "VMLAUNCH", 0x1f23: "VMASKMOVPD", 0x1073: "HADDPS", 0x12eb: "VCMPNEQ_OQPS",
269
+ 0xe49: "PUNPCKLWD", 0x16c5: "VCMPNGT_UQSS", 0xb5e: "VSQRTPD", 0xd6e: "VSUBSS",
270
+ 0x18de: "VSHUFPS", 0x15b3: "VCMPNEQSS", 0x1b6f: "VLDDQU", 0x164a: "VCMPLT_OQSS",
271
+ 0x2740: "RDRAND", 0x1b39: "PADDSW", 0x1386: "VCMPEQ_USPS", 0xc03: "ORPD", 0x1a1f: "PANDN",
272
+ 0x4b6: "FPTAN", 0x551: "FIDIV", 0x17dc: "VCMPLT_OQSD", 0x2712: "VMPTRLD", 0x2330: "VFMSUB231PS",
273
+ 0x1745: "VCMPNEQSD", 0x1ed1: "VPMULDQ", 0x196: "LOOPNZ", 0x1282: "VCMPUNORDPS",
274
+ 0x3e0: "SHR", 0x37c: "SHRD", 0x6eb: "MONITOR", 0x3ef: "XABORT", 0x23f6: "AESENCLAST",
275
+ 0x854: "MOVSD", 0x18b4: "VPINSRW", 0x729: "VMLOAD", 0x92e: "MOVLHPS", 0x8bc: "VMOVLPD",
276
+ 0x1987: "MOVQ2DQ", 0xb45: "SQRTSS", 0x259e: "VDPPS", 0xd50: "SUBSS", 0x3ab: "MOVSX",
277
+ 0x951: "VMOVLHPS", 0x8b3: "VMOVLPS", 0xf13: "VPUNPCKHDQ", 0x1ac4: "VCVTPD2DQ",
278
+ 0x3db: "SHL", 0x84d: "MOVSS", 0x257e: "PINSRQ", 0x797: "PFNACC", 0xf88: "MOVDQU",
279
+ 0x80: "OUTS", 0x1bfe: "PSUBB", 0x377: "BTS", 0x390: "BTR", 0x1805: "VCMPNEQ_USSD",
280
+ 0x69b: "SGDT", 0x2316: "VFMADD231SS", 0x511: "FSCALE", 0x1c0d: "PSUBW", 0x11a8: "CMPNLTPD",
281
+ 0x1f02: "PACKUSDW", 0x20a: "LAR", 0x3a6: "BTC", 0x215e: "VFNMADD132SD", 0x1465: "VCMPNGTPD",
282
+ 0x1f39: "VPMOVZXBW", 0x2127: "VFMSUB132SD", 0x23d4: "AESIMC", 0x40b: "FCOM",
283
+ 0x1f4e: "VPMOVZXBD", 0x1924: "VADDSUBPD", 0x1c9e: "FINIT", 0x120b: "CMPORDSS",
284
+ 0x231: "WBINVD", 0x19e5: "PAND", 0x24e1: "VPALIGNR", 0x125a: "CMPORDSD", 0x1b61: "VPXOR",
285
+ 0xa1: "JBE", 0x46f: "FXAM", 0x10e1: "XSAVEOPT", 0x669: "MUL", 0x19dc: "VPMINUB",
286
+ 0x1b41: "VPADDSW", 0x1b4a: "PMAXSW", 0x256b: "VINSERTPS", 0x13f6: "VCMPEQPD",
287
+ 0x5f7: "FFREE", 0x1f17: "VMASKMOVPS", 0x18f0: "CMPXCHG8B", 0x2015: "PMAXSD",
288
+ 0x1b30: "VPADDSB", 0x10: "PUSH", 0x25d0: "VPCLMULQDQ", 0x1264: "VCMPEQPS",
289
+ 0x7f0: "PFRSQIT1", 0x2453: "ROUNDPS", 0x2ff: "SETNO", 0x6fb: "XGETBV", 0x1fd1: "PMINSD",
290
+ 0x1c3a: "PADDB", 0x4ce: "FPREM1", 0x200: "CLD", 0x52c: "FIMUL", 0xc1e: "XORPD",
291
+ 0x1ec: "CLC", 0x43c: "FSTP", 0x24b2: "BLENDPD", 0x1a05: "PADDUSW", 0x1c96: "FNINIT",
292
+ 0x319: "SETNZ", 0x1967: "PADDQ", 0xc17: "XORPS", 0x22a0: "VFNMSUB213SS", 0x333: "SETNS",
293
+ 0x525: "FIADD", 0x340: "SETNP", 0xf59: "VPUNPCKHQDQ", 0xd42: "SUBPS", 0x1246: "CMPNLTSD",
294
+ 0x684: "LLDT", 0x223f: "VFMSUB213SD", 0x1de3: "PTEST", 0x217a: "VFNMSUB132PD",
295
+ 0x279: "GETSEC", 0x1d7f: "VPSIGND", 0x1ab: "JCXZ", 0x11f7: "CMPNLTSS", 0x34d: "SETGE",
296
+ 0x1128: "CMPEQPS", 0x1bca: "PSADBW", 0x272b: "MOVSXD", 0x216c: "VFNMSUB132PS",
297
+ 0x185: "AAD", 0x2402: "VAESENCLAST", 0xf4d: "PUNPCKHQDQ", 0x88e: "MOVLPD",
298
+ 0x19fb: "VPADDUSW", 0x12de: "VCMPFALSEPS", 0x180: "AAM", 0xf40: "VPUNPCKLQDQ",
299
+ 0xd8c: "MINSS", 0x1c58: "PADDD", 0x1470: "VCMPFALSEPD", 0xe54: "VPUNPCKLWD",
300
+ 0x886: "MOVLPS", 0x73f: "CLGI", 0x4c: "AAS", 0x139: "LODS", 0x2d3: "CMOVNP",
301
+ 0xd93: "MINSD", 0x1f6: "CLI", 0xa62: "CVTTSD2SI", 0x533: "FICOM", 0x1f2f: "PMOVZXBW",
302
+ 0xc3c: "ADDPD", 0x770: "PREFETCHW", 0x134f: "VCMPNEQ_USPS", 0xc2d: "VXORPD",
303
+ 0x1b1d: "POR", 0x16: "POP", 0x2447: "VPERM2F128", 0x19e: "LOOPZ", 0x1ad7: "MOVNTDQ",
304
+ 0x1dc: "INT1", 0x382: "CMPXCHG", 0x1e0e: "VBROADCASTF128", 0x1525: "VCMPNGE_UQPD",
305
+ 0x1cd4: "PHADDW", 0xc25: "VXORPS", 0x14e1: "VCMPNEQ_USPD", 0xc35: "ADDPS",
306
+ 0x812: "PFMUL", 0x6a7: "LGDT", 0x68f: "VERR", 0x695: "VERW", 0x109d: "VHSUBPD",
307
+ 0x197e: "VPMULLW", 0x85b: "VMOVUPS", 0x174: "INTO", 0x1c8f: "FCLEX", 0x10a6: "VHSUBPS",
308
+ 0xccb: "CVTSD2SS", 0x48b: "FLDPI", 0x1e2d: "PABSW", 0xe1a: "VMAXPD", 0x1d3: "JMP FAR",
309
+ 0xecf: "VPACKUSWB", 0x581: "FUCOMPP", 0x864: "VMOVUPD", 0x82c: "PSWAPD", 0x1c49: "PADDW",
310
+ 0x1b86: "PSLLD", 0x756: "SWAPGS", 0x896: "MOVSLDUP", 0x9df: "CVTSI2SS", 0x17c3: "VCMPTRUESD",
311
+ 0x11e1: "CMPUNORDSS", 0xd36: "VCVTTPS2DQ", 0xb4d: "SQRTSD", 0x1e00: "VBROADCASTSD",
312
+ 0x1c1c: "PSUBD", 0xce: "TEST", 0x39a: "LGS", 0x1631: "VCMPTRUESS", 0x266: "SYSENTER",
313
+ 0x9e9: "CVTSI2SD", 0x175b: "VCMPNLESD", 0x1dbc: "VTESTPD", 0x98: "JZ", 0xde6: "VDIVSS",
314
+ 0xc10: "VORPD", 0xb3: "JP", 0xaa: "JS", 0xbc: "JL", 0xb82: "RSQRTSS", 0x1db3: "VTESTPS",
315
+ 0x86: "JO", 0xe12: "VMAXPS", 0x19ae: "PSUBUSB", 0xca: "JG", 0x1df2: "VBROADCASTSS",
316
+ 0xa6: "JA", 0x8f: "JB", 0xe9: "CWDE", 0x140a: "VCMPLEPD", 0x104e: "VMWRITE",
317
+ 0x1278: "VCMPLEPS", 0x1999: "PMOVMSKB", 0x2561: "INSERTPS", 0x2614: "PCMPESTRI",
318
+ 0x273a: "WAIT", 0x1541: "VCMPFALSE_OSPD", 0x25fd: "PCMPESTRM", 0xe60: "PUNPCKLDQ",
319
+ 0xc7f: "MULSS", 0xd66: "VSUBPD", 0x1177: "CMPEQPD", 0x17a1: "VCMPNEQ_OQSD",
320
+ 0xb02: "VCOMISD", 0xdaa: "VMINSS", 0x1c5f: "VPADDD", 0x258: "RDMSR", 0x1d6e: "VPSIGNW",
321
+ 0x1b1: "JECXZ", 0xc86: "MULSD", 0x154: "ENTER", 0x2439: "MOVBE", 0x102c: "VZEROALL",
322
+ 0x2748: "_3DNOW", 0xdb2: "VMINSD", 0x160f: "VCMPNEQ_OQSS", 0x7fa: "PFSUBR",
323
+ 0x12f9: "VCMPGEPS", 0x19b7: "VPSUBUSB", 0x2357: "VFMSUB231SD", 0x2037: "PMAXUD",
324
+ 0x269e: "FXSAVE", 0x590: "FISTTP", 0x148b: "VCMPGEPD", 0x249f: "BLENDPS", 0x172e: "VCMPLESD",
325
+ 0x5b7: "FCMOVNBE", 0x234a: "VFMSUB231SS", 0x25dc: "VBLENDVPS", 0x25bb: "VMPSADBW",
326
+ 0x19ca: "VPSUBUSW", 0x1724: "VCMPLTSD", 0x1eed: "MOVNTDQA", 0x18d6: "SHUFPD",
327
+ 0xd49: "SUBPD", 0xb3d: "SQRTPD", 0x964: "VMOVHPD", 0x6c7: "VMCALL", 0x20d9: "VFMADD132PD",
328
+ 0x15b: "LEAVE", 0x18ce: "SHUFPS", 0x1319: "VCMPEQ_OSPS", 0x261f: "VPCMPESTRI",
329
+ 0x1592: "VCMPLTSS", 0x2608: "VPCMPESTRM", 0x20cc: "VFMADD132PS", 0x6ad: "LIDT",
330
+ 0x4a8: "F2XM1", 0x95b: "VMOVHPS", 0x1f98: "PMOVZXDQ", 0x1020: "VZEROUPPER",
331
+ 0xb35: "SQRTPS", 0xbeb: "VANDNPS", 0x196e: "VPADDQ", 0x4e8: "FPREM", 0x1c50: "VPADDW",
332
+ 0x24d8: "PALIGNR", 0x1fc0: "PMINSB", 0xe9f: "PCMPGTW", 0x36c: "SHLD", 0x14f: "LDS",
333
+ 0x1c41: "VPADDB", 0x719: "VMRUN", 0x26b0: "RDFSBASE", 0xbf4: "VANDNPD", 0x190: "XLAT",
334
+ 0xd4: "XCHG", 0x4df: "FINCSTP", 0x1990: "MOVDQ2Q", 0x1b0c: "PMINSW", 0x6b3: "SMSW",
335
+ 0x1d5d: "VPSIGNB", 0x10c7: "XRSTOR", 0x24bb: "VBLENDPD", 0xc0: "JGE", 0x135d: "VCMPNLT_UQPS",
336
+ 0x1766: "VCMPORDSD", 0x24a8: "VBLENDPS", 0x469: "FTST", 0x1a8e: "CVTTPD2DQ",
337
+ 0x15d4: "VCMPORDSS", 0x14ef: "VCMPNLT_UQPD", 0x2188: "VFNMSUB132SS", 0x10cf: "XRSTOR64",
338
+ 0x29: "AND", 0xb8b: "VRSQRTPS", 0x10ff: "CLFLUSH", 0x1cc3: "PSHUFB", 0x442: "FLDENV",
339
+ 0xda: "MOV", 0xfaa: "PSHUFD", 0xc5: "JLE", 0x5d0: "FEDISI", 0x70b: "VMFUNC",
340
+ 0xea8: "VPCMPGTW", 0x809: "PFCMPEQ", 0x169d: "VCMPORD_SSS", 0xfa2: "PSHUFW",
341
+ 0x24f3: "VPEXTRB", 0x1ab9: "VCVTDQ2PD", 0xf79: "VMOVQ", 0x483: "FLDL2E", 0x250c: "VPEXTRD",
342
+ 0x1d28: "VPHSUBW", 0x2284: "VFNMSUB213PS", 0x21f1: "VFMADD213PD", 0x739: "STGI",
343
+ 0x4bd: "FPATAN", 0x2515: "VPEXTRQ", 0x437: "FST", 0x168: "INT 3", 0x598: "FIST",
344
+ 0x271b: "VMCLEAR", 0x1e75: "PMOVSXBQ", 0x42: "AAA", 0x1d39: "VPHSUBD", 0xa41: "CVTTPS2PI",
345
+ 0x114f: "CMPNEQPS", 0x155f: "VCMPGE_OQPD", 0x1b68: "LDDQU", 0xb79: "RSQRTPS",
346
+ 0xc59: "VADDPD", 0x7b8: "PFRCP", 0xcc1: "CVTSS2SD", 0x2196: "VFNMSUB132SD",
347
+ 0x632: "FDIVRP", 0x641: "FBLD", 0x361: "CPUID", 0x251: "RDTSC", 0x24ce: "VPBLENDW",
348
+ 0xd2b: "VCVTPS2DQ", 0x1b22: "VPOR", 0xc51: "VADDPS", 0x77b: "PI2FW", 0xd7e: "MINPS",
349
+ 0x17cf: "VCMPEQ_OSSD", 0x1bad: "VPMULUDQ", 0xe0b: "MAXSD", 0x2050: "VPMULLD",
350
+ 0x558: "FIDIVR", 0xad5: "VUCOMISS", 0x8a0: "MOVDDUP", 0x1ccb: "VPSHUFB", 0x1d42: "PHSUBSW",
351
+ 0x264d: "VPCMPISTRI", 0xe04: "MAXSS", 0x1a35: "VPAVGB", 0x16d3: "VCMPFALSE_OSSS",
352
+ 0xd85: "MINPD", 0x4ef: "FYL2XP1", 0xadf: "VUCOMISD", 0x23aa: "VFNMSUB231PD",
353
+ 0x1849: "VCMPNGE_UQSD", 0xc4a: "ADDSD", 0x6e3: "VMXOFF", 0x1958: "PSRLQ", 0x128f: "VCMPNEQPS",
354
+ 0x193a: "PSRLW", 0x1a4c: "PSRAD", 0x6a1: "SIDT", 0xe77: "PACKSSWB", 0x10af: "XSAVE",
355
+ 0x1421: "VCMPNEQPD", 0xfa: "CDQ", 0xc43: "ADDSS", 0x16b7: "VCMPNGE_UQSS", 0x2440: "CRC32",
356
+ 0x23dc: "VAESIMC", 0x2004: "PMAXSB", 0x2529: "VEXTRACTPS", 0x1813: "VCMPNLT_UQSD",
357
+ 0x1c05: "VPSUBB", 0x1f8d: "VPMOVZXWQ", 0x13bf: "VCMPNEQ_OSPS", 0xa1b: "MOVNTSS",
358
+ 0x2542: "VEXTRACTF128", 0x1b28: "PADDSB", 0x75: "IMUL", 0x3d6: "RCR", 0x14d2: "VCMPUNORD_SPD",
359
+ 0x3d1: "RCL", 0xa24: "MOVNTSD", 0x1551: "VCMPNEQ_OSPD", 0x1681: "VCMPNLT_UQSS",
360
+ 0xd57: "SUBSD", 0x13f: "SCAS", 0x25c5: "PCLMULQDQ", 0x7bf: "PFRSQRT", 0x2576: "PINSRD",
361
+ 0x623: "FSUBRP", 0x5b: "PUSHA", 0x1a16: "VPMAXUB", 0x1143: "CMPUNORDPS", 0x203f: "VPMAXUD",
362
+ 0x463: "FABS", 0x1e7f: "VPMOVSXBQ", 0x149f: "VCMPTRUEPD", 0x23e: "FEMMS", 0x163d: "VCMPEQ_OSSS",
363
+ 0x220b: "VFMADD213SD", 0x1e6a: "VPMOVSXBD", 0x1192: "CMPUNORDPD", 0x1907: "VMPTRST",
364
+ 0x18fb: "CMPXCHG16B", 0x130d: "VCMPTRUEPS", 0x12d3: "VCMPNGTPS", 0x1c87: "FNCLEX",
365
+ 0x123c: "CMPNEQSD", 0x1771: "VCMPEQ_UQSD", 0x579: "FCMOVU", 0x103e: "EXTRQ",
366
+ 0x25a5: "DPPD", 0x2e2: "CMOVGE", 0x2550: "PINSRB", 0x15df: "VCMPEQ_UQSS", 0x1d14: "VPMADDUBSW",
367
+ 0x11ed: "CMPNEQSS", 0x2309: "VFMADD231PD", 0x519: "FSIN", 0x1bf: "IN", 0x568: "FCMOVE",
368
+ 0x44a: "FLDCW", 0x2598: "DPPS", 0x560: "FCMOVB", 0x1941: "VPSRLW", 0x10bf: "LFENCE",
369
+ 0xaa3: "CVTSD2SI", 0x30c: "SETAE", 0x2a6: "CMOVNZ", 0x195f: "VPSRLQ", 0x614: "FMULP",
370
+ 0x9c2: "VMOVAPD", 0x1657: "VCMPLE_OQSS", 0x2c4: "CMOVNS", 0x5ae: "FCMOVNE",
371
+ 0x288: "CMOVNO", 0x1a85: "VPMULHW", 0x1950: "VPSRLD", 0x1061: "CVTPS2PH", 0xa85: "CVTPS2PI",
372
+ 0x1ce5: "PHADDD", 0xcad: "CVTPS2PD", 0x1e34: "VPABSW", 0x17e9: "VCMPLE_OQSD",
373
+ 0x9b9: "VMOVAPS", 0x1c14: "VPSUBW", 0x823: "PMULHRW", 0x9a9: "MOVAPS", 0x7b1: "PFMIN",
374
+ 0xf66: "MOVD", 0x937: "MOVHPS", 0xc71: "MULPS", 0x126e: "VCMPLTPS", 0x368: "BT",
375
+ 0x9b1: "MOVAPD", 0x1393: "VCMPNGE_UQPS", 0x1b8: "JRCXZ", 0xc78: "MULPD", 0x127: "MOVS",
376
+ 0x6bf: "INVLPG", 0xf6c: "MOVQ", 0xda2: "VMINPD", 0x1e3c: "PABSD", 0x11b: "SAHF",
377
+ 0x13e7: "VCMPTRUE_USPS", 0x782: "PI2FD", 0x1e1e: "PABSB", 0x2495: "VROUNDSD",
378
+ 0x1a26: "VPANDN", 0xe6b: "VPUNPCKLDQ", 0x63a: "FDIVP", 0x1c2b: "PSUBQ", 0x42b: "FDIVR",
379
+ 0x425: "FDIV", 0x1579: "VCMPTRUE_USPD", 0x766: "PREFETCH", 0x101a: "EMMS",
380
+ 0xd9a: "VMINPS", 0x22fc: "VFMADD231PS", 0x2292: "VFNMSUB213PD", 0xa99: "CVTSS2SI",
381
+ 0x93f: "MOVHPD", 0x29f: "CMOVZ", 0x1a62: "VPAVGW", 0xff: "CQO", 0x1c23: "VPSUBD",
382
+ 0x2cc: "CMOVP", 0x1588: "VCMPEQSS", 0x2bd: "CMOVS", 0x1e60: "PMOVSXBD", 0x2482: "VROUNDSS",
383
+ 0x1c32: "VPSUBQ", 0x2db: "CMOVL", 0x191a: "ADDSUBPS", 0x281: "CMOVO", 0x2b6: "CMOVA",
384
+ 0x290: "CMOVB", 0xeda: "PUNPCKHBW", 0x2642: "PCMPISTRI", 0x2f2: "CMOVG", 0x19a3: "VPMOVMSKB",
385
+ 0x2420: "AESDECLAST", 0x845: "MOVUPD", 0x20bc: "VFMSUBADD132PD", 0x1bd2: "VPSADBW",
386
+ 0x3f7: "XBEGIN", 0x246f: "VROUNDPD", 0x6b9: "LMSW", 0x2072: "INVEPT", 0x39f: "MOVZX",
387
+ 0xbbd: "ANDPS", 0x20ac: "VFMSUBADD132PS", 0x83d: "MOVUPS", 0x1627: "VCMPGTSS",
388
+ 0x1a6a: "PMULHUW", 0x25ab: "VDPPD", 0x24fc: "PEXTRD", 0x1602: "VCMPFALSESS",
389
+ 0x26ce: "RDGSBASE", 0x1b: "OR", 0x18c5: "VPEXTRW", 0x1af2: "VPSUBSB", 0x26ba: "FXRSTOR",
390
+ 0x21d: "CLTS", 0x1857: "VCMPNGT_UQSD", 0x15f7: "VCMPNGTSS", 0x5ef: "FRSTOR",
391
+ 0x1794: "VCMPFALSESD", 0x49a: "FLDLN2", 0x2535: "VINSERTF128", 0x1b03: "VPSUBSW",
392
+ 0x1ba4: "PMULUDQ", 0x56: "DEC", 0x13af: "VCMPFALSE_OSPS", 0x432: "FLD", 0x1fa2: "VPMOVZXDQ",
393
+ 0x2479: "ROUNDSS", 0x9f3: "VCVTSI2SS", 0x18bd: "PEXTRW", 0x26a6: "FXSAVE64",
394
+ 0x3c7: "ROL", 0x20f3: "VFMADD132SD", 0x1189: "CMPLEPD", 0xcf6: "VCVTSD2SS",
395
+ 0x605: "FUCOMP", 0x1ce: "JMP", 0x171a: "VCMPEQSD", 0xd01: "CVTDQ2PS", 0x16fe: "VCMPGT_OQSS",
396
+ 0x5e0: "FUCOMI", 0x1121: "LZCNT", 0xbad: "VRCPPS", 0x1a0e: "PMAXUB", 0x1ced: "VPHADDD",
397
+ 0x9fe: "VCVTSI2SD", 0x1890: "VCMPGT_OQSD", 0x3cc: "ROR", 0x22b: "INVD", 0xab8: "VCVTSD2SI",
398
+ 0x240f: "AESDEC", 0x1250: "CMPNLESD", 0x354: "SETLE", 0x22dc: "VFMSUBADD231PS",
399
+ 0x2364: "VFNMADD231PS", 0x10b6: "XSAVE64", 0xef1: "PUNPCKHWD", 0x1e94: "VPMOVSXWD",
400
+ 0xcb7: "CVTPD2PS", 0x8a9: "VMOVHLPS", 0x22ec: "VFMSUBADD231PD", 0xa8f: "CVTPD2PI",
401
+ 0x1201: "CMPNLESS", 0x1ec9: "PMULDQ", 0x1ea9: "VPMOVSXWQ", 0x1750: "VCMPNLTSD",
402
+ 0x2100: "VFMSUB132PS", 0x2372: "VFNMADD231PD", 0x1cbc: "FSTSW", 0x75e: "RDTSCP",
403
+ 0x10d9: "MFENCE", 0x20e6: "VFMADD132SS", 0x1ff3: "PMINUD", 0x5ca: "FENI", 0x68: "BOUND",
404
+ 0x245c: "VROUNDPS", 0xfbb: "PSHUFLW", 0xc9d: "VMULSS", 0x1865: "VCMPFALSE_OSSD",
405
+ 0xd20: "VCVTDQ2PS", 0x159c: "VCMPLESS", 0x457: "FNOP", 0x1159: "CMPNLTPS",
406
+ 0x129a: "VCMPNLTPS", 0x492: "FLDLG2", 0x223: "SYSRET", 0x1c80: "FSTCW", 0x2232: "VFMSUB213SS",
407
+ 0x745: "SKINIT", 0xbd3: "VANDPD", 0x4a2: "FLDZ", 0x33: "SUB", 0x1cdc: "VPHADDW",
408
+ 0x664: "NEG", 0x1fe2: "PMINUW", 0xdfd: "MAXPD", 0x1379: "VCMPORD_SPS", 0x133: "STOS",
409
+ 0x23c6: "VFNMSUB231SD", 0x1738: "VCMPUNORDSD", 0x834: "PAVGUSB", 0x150b: "VCMPORD_SPD",
410
+ 0xdf6: "MAXPS", 0x19d4: "PMINUB", 0x1bf1: "VMASKMOVDQU", 0x647: "FBSTP", 0x18ac: "PINSRW",
411
+ 0x1f78: "VPMOVZXWD", 0x1fea: "VPMINUW", 0x1821: "VCMPNLE_UQSD", 0x18a: "SALC",
412
+ 0x24eb: "PEXTRB", 0x8ee: "VUNPCKLPS", 0x168f: "VCMPNLE_UQSS", 0xf80: "MOVDQA",
413
+ 0x15be: "VCMPNLTSS", 0x1b95: "PSLLQ", 0xa2d: "VMOVNTPS", 0x1ffb: "VPMINUD",
414
+ 0x978: "PREFETCHNTA", 0x8f9: "VUNPCKLPD", 0x1057: "CVTPH2PS", 0x266a: "VAESKEYGENASSIST",
415
+ 0x1afb: "PSUBSW", 0x177e: "VCMPNGESD", 0x1c67: "FNSTENV", 0x1cb4: "FNSTSW",
416
+ 0x119e: "CMPNEQPD", 0x1a5b: "PAVGW", 0xa12: "MOVNTPD", 0x1518: "VCMPEQ_USPD",
417
+ 0x5d8: "FSETPM", 0x1dcf: "BLENDVPS", 0x21b4: "VFMADDSUB213PD", 0xb: "ADD",
418
+ 0x15ec: "VCMPNGESS", 0x1f: "ADC", 0x1aea: "PSUBSB", 0x1dd9: "BLENDVPD", 0xee5: "VPUNPCKHBW",
419
+ 0x25f: "RDPMC", 0xa09: "MOVNTPS", 0x1110: "BSF", 0x1400: "VCMPLTPD", 0x1a2e: "PAVGB",
420
+ 0xdf: "LEA", 0x1aad: "VCVTTPD2DQ", 0xe95: "VPCMPGTB", 0xebb: "VPCMPGTD", 0x475: "FLD1",
421
+ 0x1bc0: "VPMADDWD", 0x17f6: "VCMPUNORD_SSD", 0x14a: "LES", 0x313: "SETZ", 0x1fb6: "VPCMPGTQ",
422
+ 0xca5: "VMULSD", 0x21e4: "VFMADD213PS", 0x15c9: "VCMPNLESS", 0x87d: "MOVHLPS",
423
+ 0x2065: "VPHMINPOSUW", 0x1e43: "VPABSD", 0x1a3d: "PSRAW", 0x7cf: "PFADD", 0x209c: "VFMADDSUB132PD",
424
+ 0xaf1: "COMISD", 0x13cd: "VCMPGE_OQPS", 0xe22: "VMAXSS", 0x1230: "CMPUNORDSD",
425
+ 0x4ff: "FSINCOS", 0xae9: "COMISS", 0x208c: "VFMADDSUB132PS", 0xb9f: "RCPPS",
426
+ 0x2142: "VFNMADD132PD", 0x451: "FXCH", 0x2e: "DAA", 0x320: "SETBE", 0xcd5: "VCVTPS2PD",
427
+ 0x1bb7: "PMADDWD", 0xbc4: "ANDPD", 0x1333: "VCMPLE_OQPS", 0x1789: "VCMPNGTSD",
428
+ 0x239c: "VFNMSUB231PS", 0x64e: "FUCOMIP", 0xc8d: "VMULPS", 0x2134: "VFNMADD132PS",
429
+ 0x26e1: "WRFSBASE", 0x38: "DAS", 0x14c5: "VCMPLE_OQPD", 0x17a: "IRET", 0x3c0: "BSWAP",
430
+ 0xe32: "PUNPCKLBW", 0x2026: "PMAXUW", 0x2636: "VPCMPISTRM", 0x1b77: "PSLLW",
431
+ 0x1664: "VCMPUNORD_SSS", 0x224c: "VFNMADD213PS", 0xa79: "VCVTTSD2SI", 0x233d: "VFMSUB231PD",
432
+ 0x13a1: "VCMPNGT_UQPS", 0x1c78: "FNSTCW", 0x248c: "ROUNDSD", 0x11b2: "CMPNLEPD",
433
+ 0x2504: "PEXTRQ", 0x1a7d: "PMULHW", 0x1cff: "VPHADDSW", 0x59e: "FISTP", 0x1f83: "PMOVZXWQ",
434
+ 0xce0: "VCVTPD2PS", 0x170b: "VCMPTRUE_USSS", 0xc69: "VADDSD", 0x1dc5: "PBLENDVB",
435
+ 0x6d9: "VMRESUME", 0xacc: "UCOMISD", 0x1f6e: "PMOVZXWD", 0xa4c: "CVTTPD2PI",
436
+ 0xac3: "UCOMISS", 0xe81: "VPACKSSWB", 0xc61: "VADDSS", 0xfb2: "PSHUFHW", 0x189d: "VCMPTRUE_USSD",
437
+ 0x6f4: "MWAIT"
438
+ }
439
+
440
+ Registers = ["RAX", "RCX", "RDX", "RBX", "RSP", "RBP", "RSI", "RDI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15",
441
+ "EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", "EDI", "R8D", "R9D", "R10D", "R11D", "R12D", "R13D", "R14D", "R15D",
442
+ "AX", "CX", "DX", "BX", "SP", "BP", "SI", "DI", "R8W", "R9W", "R10W", "R11W", "R12W", "R13W", "R14W", "R15W",
443
+ "AL", "CL", "DL", "BL", "AH", "CH", "DH", "BH", "R8B", "R9B", "R10B", "R11B", "R12B", "R13B", "R14B", "R15B",
444
+ "SPL", "BPL", "SIL", "DIL",
445
+ "ES", "CS", "SS", "DS", "FS", "GS",
446
+ "RIP",
447
+ "ST0", "ST1", "ST2", "ST3", "ST4", "ST5", "ST6", "ST7",
448
+ "MM0", "MM1", "MM2", "MM3", "MM4", "MM5", "MM6", "MM7",
449
+ "XMM0", "XMM1", "XMM2", "XMM3", "XMM4", "XMM5", "XMM6", "XMM7", "XMM8", "XMM9", "XMM10", "XMM11", "XMM12", "XMM13", "XMM14", "XMM15",
450
+ "YMM0", "YMM1", "YMM2", "YMM3", "YMM4", "YMM5", "YMM6", "YMM7", "YMM8", "YMM9", "YMM10", "YMM11", "YMM12", "YMM13", "YMM14", "YMM15",
451
+ "CR0", "", "CR2", "CR3", "CR4", "", "", "", "CR8",
452
+ "DR0", "DR1", "DR2", "DR3", "", "", "DR6", "DR7"]
453
+
454
+ # Special case
455
+ R_NONE = 0xFF # -1 in uint8
456
+
457
+ FLAGS = [
458
+ # The instruction locks memory access.
459
+ "FLAG_LOCK",
460
+ # The instruction is prefixed with a REPNZ.
461
+ "FLAG_REPNZ",
462
+ # The instruction is prefixed with a REP, this can be a REPZ, it depends on the specific instruction.
463
+ "FLAG_REP",
464
+ # Indicates there is a hint taken for Jcc instructions only.
465
+ "FLAG_HINT_TAKEN",
466
+ # Indicates there is a hint non-taken for Jcc instructions only.
467
+ "FLAG_HINT_NOT_TAKEN",
468
+ # The Imm value is signed extended.
469
+ "FLAG_IMM_SIGNED",
470
+ # The destination operand is writable.
471
+ "FLAG_DST_WR",
472
+ # The instruction uses the RIP-relative indirection.
473
+ "FLAG_RIP_RELATIVE"
474
+ ]
475
+
476
+ # Instruction could not be disassembled. Special-case handling
477
+ FLAG_NOT_DECODABLE = 0xFFFF # -1 in uint16
478
+ # Some features
479
+ DF_NONE = 0
480
+ DF_MAXIMUM_ADDR16 = 1
481
+ DF_MAXIMUM_ADDR32 = 2
482
+ DF_RETURN_FC_ONLY = 4
483
+ # Flow control flags
484
+ DF_STOP_ON_CALL = 0x8
485
+ DF_STOP_ON_RET = 0x10
486
+ DF_STOP_ON_SYS = 0x20
487
+ DF_STOP_ON_UNC_BRANCH = 0x40
488
+ DF_STOP_ON_CND_BRANCH = 0x80
489
+ DF_STOP_ON_INT = 0x100
490
+ DF_STOP_ON_CMOV = 0x200
491
+ DF_STOP_ON_FLOW_CONTROL = (DF_STOP_ON_CALL | DF_STOP_ON_RET | DF_STOP_ON_SYS | \
492
+ DF_STOP_ON_UNC_BRANCH | DF_STOP_ON_CND_BRANCH | DF_STOP_ON_INT | DF_STOP_ON_CMOV)
493
+
494
+ def DecodeGenerator(codeOffset, code, dt):
495
+ """
496
+ @type codeOffset: long
497
+ @param codeOffset: Memory address where the code is located.
498
+ This is B{not} an offset into the code!
499
+ It's the actual memory address where it was read from.
500
+
501
+ @type code: str
502
+ @param code: Code to disassemble.
503
+
504
+ @type dt: int
505
+ @param dt: Disassembly type. Can be one of the following:
506
+
507
+ * L{Decode16Bits}: 80286 decoding
508
+
509
+ * L{Decode32Bits}: IA-32 decoding
510
+
511
+ * L{Decode64Bits}: AMD64 decoding
512
+
513
+ @rtype: generator of tuple( long, int, str, str )
514
+ @return: Generator of tuples. Each tuple represents an assembly instruction
515
+ and contains:
516
+ - Memory address of instruction.
517
+ - Size of instruction in bytes.
518
+ - Disassembly line of instruction.
519
+ - Hexadecimal dump of instruction.
520
+
521
+ @raise ValueError: Invalid arguments.
522
+ """
523
+
524
+ if not code:
525
+ return
526
+
527
+ if not codeOffset:
528
+ codeOffset = 0
529
+
530
+ if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
531
+ raise ValueError("Invalid decode type value: %r" % (dt,))
532
+
533
+ codeLen = len(code)
534
+ code_buf = create_string_buffer(code)
535
+ p_code = byref(code_buf)
536
+ result = (_DecodedInst * MAX_INSTRUCTIONS)()
537
+ p_result = byref(result)
538
+ instruction_off = 0
539
+
540
+ # Support cross Python compatibility
541
+ toUnicode = lambda s: s
542
+ spaceCh = b" "
543
+ if sys.version_info[0] >= 3:
544
+ if sys.version_info[1] > 0:
545
+ toUnicode = lambda s: s.decode()
546
+ else:
547
+ spaceCh = " "
548
+
549
+ while codeLen > 0:
550
+
551
+ usedInstructionsCount = c_uint(0)
552
+ status = internal_decode(_OffsetType(codeOffset), p_code, codeLen, dt, p_result, MAX_INSTRUCTIONS, byref(usedInstructionsCount))
553
+
554
+ if status == DECRES_INPUTERR:
555
+ raise ValueError("Invalid arguments passed to distorm_decode()")
556
+
557
+ used = usedInstructionsCount.value
558
+ if not used:
559
+ break
560
+
561
+ for index in xrange(used):
562
+ di = result[index]
563
+ asm = di.mnemonic.p
564
+ if len(di.operands.p):
565
+ asm += spaceCh + di.operands.p
566
+ pydi = (di.offset, di.size, toUnicode(asm), toUnicode(di.instructionHex.p))
567
+ instruction_off += di.size
568
+ yield pydi
569
+
570
+ di = result[used - 1]
571
+ delta = di.offset - codeOffset + result[used - 1].size
572
+ if delta <= 0:
573
+ break
574
+ codeOffset = codeOffset + delta
575
+ p_code = byref(code_buf, instruction_off)
576
+ codeLen = codeLen - delta
577
+
578
+ def Decode(offset, code, type = Decode32Bits):
579
+ """
580
+ @type offset: long
581
+ @param offset: Memory address where the code is located.
582
+ This is B{not} an offset into the code!
583
+ It's the actual memory address where it was read from.
584
+
585
+ @type code: str
586
+ @param code: Code to disassemble.
587
+
588
+ @type type: int
589
+ @param type: Disassembly type. Can be one of the following:
590
+
591
+ * L{Decode16Bits}: 80286 decoding
592
+
593
+ * L{Decode32Bits}: IA-32 decoding
594
+
595
+ * L{Decode64Bits}: AMD64 decoding
596
+
597
+ @rtype: list of tuple( long, int, str, str )
598
+ @return: List of tuples. Each tuple represents an assembly instruction
599
+ and contains:
600
+ - Memory address of instruction.
601
+ - Size of instruction in bytes.
602
+ - Disassembly line of instruction.
603
+ - Hexadecimal dump of instruction.
604
+
605
+ @raise ValueError: Invalid arguments.
606
+ """
607
+ return list(DecodeGenerator(offset, code, type))
608
+
609
+ OPERAND_NONE = ""
610
+ OPERAND_IMMEDIATE = "Immediate"
611
+ OPERAND_REGISTER = "Register"
612
+
613
+ # the operand is a memory address
614
+ OPERAND_ABSOLUTE_ADDRESS = "AbsoluteMemoryAddress" # The address calculated is absolute
615
+ OPERAND_MEMORY = "AbsoluteMemory" # The address calculated uses registers expression
616
+ OPERAND_FAR_MEMORY = "FarMemory" # like absolute but with selector/segment specified too
617
+
618
+ InstructionSetClasses = [
619
+ "ISC_UNKNOWN",
620
+ # Indicates the instruction belongs to the General Integer set.
621
+ "ISC_INTEGER",
622
+ # Indicates the instruction belongs to the 387 FPU set.
623
+ "ISC_FPU",
624
+ # Indicates the instruction belongs to the P6 set.
625
+ "ISC_P6",
626
+ # Indicates the instruction belongs to the MMX set.
627
+ "ISC_MMX",
628
+ # Indicates the instruction belongs to the SSE set.
629
+ "ISC_SSE",
630
+ # Indicates the instruction belongs to the SSE2 set.
631
+ "ISC_SSE2",
632
+ # Indicates the instruction belongs to the SSE3 set.
633
+ "ISC_SSE3",
634
+ # Indicates the instruction belongs to the SSSE3 set.
635
+ "ISC_SSSE3",
636
+ # Indicates the instruction belongs to the SSE4.1 set.
637
+ "ISC_SSE4_1",
638
+ # Indicates the instruction belongs to the SSE4.2 set.
639
+ "ISC_SSE4_2",
640
+ # Indicates the instruction belongs to the AMD's SSE4.A set.
641
+ "ISC_SSE4_A",
642
+ # Indicates the instruction belongs to the 3DNow! set.
643
+ "ISC_3DNOW",
644
+ # Indicates the instruction belongs to the 3DNow! Extensions set.
645
+ "ISC_3DNOWEXT",
646
+ # Indicates the instruction belongs to the VMX (Intel) set.
647
+ "ISC_VMX",
648
+ # Indicates the instruction belongs to the SVM (AMD) set.
649
+ "ISC_SVM",
650
+ # Indicates the instruction belongs to the AVX (Intel) set.
651
+ "ISC_AVX",
652
+ # Indicates the instruction belongs to the FMA (Intel) set.
653
+ "ISC_FMA",
654
+ # Indicates the instruction belongs to the AES/AVX (Intel) set.
655
+ "ISC_AES",
656
+ # Indicates the instruction belongs to the CLMUL (Intel) set.
657
+ "ISC_CLMUL",
658
+ ]
659
+
660
+ FlowControlFlags = [
661
+ # Indicates the instruction is not a flow-control instruction.
662
+ "FC_NONE",
663
+ # Indicates the instruction is one of: CALL, CALL FAR.
664
+ "FC_CALL",
665
+ # Indicates the instruction is one of: RET, IRET, RETF.
666
+ "FC_RET",
667
+ # Indicates the instruction is one of: SYSCALL, SYSRET, SYSENTER, SYSEXIT.
668
+ "FC_SYS",
669
+ # Indicates the instruction is one of: JMP, JMP FAR.
670
+ "FC_UNC_BRANCH",
671
+ # Indicates the instruction is one of:
672
+ # JCXZ, JO, JNO, JB, JAE, JZ, JNZ, JBE, JA, JS, JNS, JP, JNP, JL, JGE, JLE, JG, LOOP, LOOPZ, LOOPNZ.
673
+ "FC_CND_BRANCH",
674
+ # Indiciates the instruction is one of: INT, INT1, INT 3, INTO, UD2.
675
+ "FC_INT",
676
+ # Indicates the instruction is one of: CMOVxx.
677
+ "FC_CMOV"
678
+ ]
679
+
680
+ def _getOpSize(flags):
681
+ return ((flags >> 7) & 3)
682
+
683
+ def _getISC(metaflags):
684
+ realvalue = ((metaflags >> 3) & 0x1f)
685
+ return InstructionSetClasses[realvalue]
686
+
687
+ def _getFC(metaflags):
688
+ realvalue = (metaflags & 0x7)
689
+ try:
690
+ return FlowControlFlags[realvalue]
691
+ except IndexError:
692
+ print ("Bad meta-flags: {}".format(realvalue))
693
+ raise
694
+
695
+ def _getMnem(opcode):
696
+ return Mnemonics.get(opcode, "UNDEFINED")
697
+
698
+ def _unsignedToSigned64(val):
699
+ return int(val if val < 0x8000000000000000 else (val - 0x10000000000000000))
700
+
701
+ def _unsignedToSigned32(val):
702
+ return int(val if val < 0x80000000 else (val - 0x10000000))
703
+
704
+ if SUPPORT_64BIT_OFFSET:
705
+ _unsignedToSigned = _unsignedToSigned64
706
+ else:
707
+ _unsignedToSigned = _unsignedToSigned32
708
+
709
+ class Operand (object):
710
+ def __init__(self, type, *args):
711
+ self.type = type
712
+ self.index = None
713
+ self.name = ""
714
+ self.size = 0
715
+ self.value = 0
716
+ self.disp = 0
717
+ self.dispSize = 0
718
+ self.base = 0
719
+ self.segment = 0
720
+ if type == OPERAND_IMMEDIATE:
721
+ self.value = int(args[0])
722
+ self.size = args[1]
723
+ elif type == OPERAND_REGISTER:
724
+ self.index = args[0]
725
+ self.size = args[1]
726
+ self.name = Registers[self.index]
727
+ elif type == OPERAND_MEMORY:
728
+ self.base = args[0] if args[0] != R_NONE else None
729
+ self.index = args[1]
730
+ self.size = args[2]
731
+ self.scale = args[3] if args[3] > 1 else 1
732
+ self.disp = int(args[4])
733
+ self.dispSize = args[5]
734
+ self.segment = args[6]
735
+ elif type == OPERAND_ABSOLUTE_ADDRESS:
736
+ self.size = args[0]
737
+ self.disp = int(args[1])
738
+ self.dispSize = args[2]
739
+ self.segment = args[3]
740
+ elif type == OPERAND_FAR_MEMORY:
741
+ self.size = args[2]
742
+ self.seg = args[0]
743
+ self.off = args[1]
744
+
745
+ def _toText(self):
746
+ if self.type == OPERAND_IMMEDIATE:
747
+ if self.value >= 0:
748
+ return "0x%x" % self.value
749
+ else:
750
+ return "-0x%x" % abs(self.value)
751
+ elif self.type == OPERAND_REGISTER:
752
+ return self.name
753
+ elif self.type == OPERAND_ABSOLUTE_ADDRESS:
754
+ return '[0x%x]' % self.disp
755
+ elif self.type == OPERAND_FAR_MEMORY:
756
+ return '%s:%s' % (hex(self.seg), hex(self.off))
757
+ elif (self.type == OPERAND_MEMORY):
758
+ result = "["
759
+ if self.base != None:
760
+ result += Registers[self.base] + "+"
761
+ if self.index != None:
762
+ result += Registers[self.index]
763
+ if self.scale > 1:
764
+ result += "*%d" % self.scale
765
+ if self.disp >= 0:
766
+ result += "+0x%x" % self.disp
767
+ else:
768
+ result += "-0x%x" % abs(self.disp)
769
+ return result + "]"
770
+ def __str__(self):
771
+ return self._toText()
772
+
773
+
774
+ class Instruction (object):
775
+ def __init__(self, di, instructionBytes, dt):
776
+ "Expects a filled _DInst structure, and the corresponding byte code of the whole instruction"
777
+ #self.di = di
778
+ flags = di.flags
779
+ self.instructionBytes = instructionBytes
780
+ self.opcode = di.opcode
781
+ self.operands = []
782
+ self.flags = []
783
+ self.rawFlags = di.flags
784
+ self.instructionClass = _getISC(0)
785
+ self.flowControl = _getFC(0)
786
+ self.address = di.addr
787
+ self.size = di.size
788
+ self.dt = dt
789
+ self.valid = False
790
+ if di.segment != R_NONE:
791
+ self.segment = di.segment & 0x7f
792
+ self.isSegmentDefault = (di.segment & 0x80) == 0x80
793
+ else:
794
+ self.segment = R_NONE
795
+ self.isSegmentDefault = False
796
+ self.unusedPrefixesMask = di.unusedPrefixesMask
797
+
798
+ if flags == FLAG_NOT_DECODABLE:
799
+ self.mnemonic = 'DB 0x%02x' % (di.imm.byte)
800
+ self.flags = ['FLAG_NOT_DECODABLE']
801
+ return
802
+
803
+ self.valid = True
804
+ self.mnemonic = _getMnem(self.opcode)
805
+
806
+ # decompose the flags for a valid opcode
807
+ for index, flag in enumerate(FLAGS):
808
+ if (flags & (1 << index)) != 0:
809
+ self.flags.append(flag)
810
+
811
+ # read the operands
812
+ for operand in di.ops:
813
+ if operand.type != O_NONE:
814
+ self.operands.append(self._extractOperand(di, operand))
815
+
816
+ # decode the meta-flags
817
+ metas = di.meta
818
+ self.instructionClass = _getISC(metas)
819
+ self.flowControl = _getFC(metas)
820
+
821
+ def _extractOperand(self, di, operand):
822
+ # a single operand can be up to: reg1 + reg2*scale + constant
823
+ if operand.type == O_IMM:
824
+ if ("FLAG_IMM_SIGNED" in self.flags):
825
+ # immediate is sign-extended, do your thing. it's already signed, just make it Python-signed.
826
+ constant = _unsignedToSigned(di.imm.sqword)
827
+ else:
828
+ # immediate is zero-extended, though it's already aligned.
829
+ constant = di.imm.qword
830
+ return Operand(OPERAND_IMMEDIATE, constant, operand.size)
831
+ elif operand.type == O_IMM1: # first operand for ENTER
832
+ return Operand(OPERAND_IMMEDIATE, di.imm.ex.i1, operand.size)
833
+ elif operand.type == O_IMM2: # second operand for ENTER
834
+ return Operand(OPERAND_IMMEDIATE, di.imm.ex.i2, operand.size)
835
+ elif operand.type == O_REG:
836
+ return Operand(OPERAND_REGISTER, operand.index, operand.size)
837
+ elif operand.type == O_MEM:
838
+ return Operand(OPERAND_MEMORY, di.base, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
839
+ elif operand.type == O_SMEM:
840
+ return Operand(OPERAND_MEMORY, None, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
841
+ elif operand.type == O_DISP:
842
+ return Operand(OPERAND_ABSOLUTE_ADDRESS, operand.size, di.disp, di.dispSize, self.segment)
843
+ elif operand.type == O_PC:
844
+ return Operand(OPERAND_IMMEDIATE, _unsignedToSigned(di.imm.addr) + self.address + self.size, operand.size)
845
+ elif operand.type == O_PTR:
846
+ return Operand(OPERAND_FAR_MEMORY, di.imm.ptr.seg, di.imm.ptr.off, operand.size)
847
+ else:
848
+ raise ValueError("Unknown operand type encountered: %d!" % operand.type)
849
+
850
+ def _toText(self):
851
+ # use the decode which already returns the text formatted well (with prefixes, etc).
852
+ return Decode(self.address, self.instructionBytes, self.dt)[0][2]
853
+
854
+ def __str__(self):
855
+ return self._toText()
856
+
857
+
858
+ def DecomposeGenerator(codeOffset, code, dt, features = 0):
859
+ """
860
+ @type codeOffset: long
861
+ @param codeOffset: Memory address where the code is located.
862
+ This is B{not} an offset into the code!
863
+ It's the actual memory address where it was read from.
864
+
865
+ @type code: str, in Py3 bytes
866
+ @param code: Code to disassemble.
867
+
868
+ @type dt: int
869
+ @param dt: Disassembly type. Can be one of the following:
870
+
871
+ * L{Decode16Bits}: 80286 decoding
872
+
873
+ * L{Decode32Bits}: IA-32 decoding
874
+
875
+ * L{Decode64Bits}: AMD64 decoding
876
+
877
+ @type features: int
878
+ @param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
879
+ or other features, eg. DF_RETURN_FC_ONLY.
880
+
881
+ @rtype: generator of TODO
882
+ @return: Generator of TODO
883
+
884
+ @raise ValueError: Invalid arguments.
885
+ """
886
+
887
+ if not code:
888
+ return
889
+
890
+ if not codeOffset:
891
+ codeOffset = 0
892
+
893
+ if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
894
+ raise ValueError("Invalid decode type value: %r" % (dt,))
895
+
896
+ codeLen = len(code)
897
+ code_buf = create_string_buffer(code)
898
+ p_code = byref(code_buf)
899
+ result = (_DInst * MAX_INSTRUCTIONS)()
900
+ instruction_off = 0
901
+
902
+ while codeLen > 0:
903
+
904
+ usedInstructionsCount = c_uint(0)
905
+ codeInfo = _CodeInfo(_OffsetType(codeOffset), _OffsetType(0), cast(p_code, c_char_p), codeLen, dt, features)
906
+ status = internal_decompose(byref(codeInfo), byref(result), MAX_INSTRUCTIONS, byref(usedInstructionsCount))
907
+ if status == DECRES_INPUTERR:
908
+ raise ValueError("Invalid arguments passed to distorm_decode()")
909
+
910
+ used = usedInstructionsCount.value
911
+ if not used:
912
+ break
913
+
914
+ delta = 0
915
+ for index in range(used):
916
+ di = result[index]
917
+ yield Instruction(di, code[instruction_off : instruction_off + di.size], dt)
918
+ delta += di.size
919
+ instruction_off += di.size
920
+
921
+ if delta <= 0:
922
+ break
923
+ codeOffset = codeOffset + delta
924
+ p_code = byref(code_buf, instruction_off)
925
+ codeLen = codeLen - delta
926
+
927
+ if (features & DF_STOP_ON_FLOW_CONTROL) != 0:
928
+ break # User passed a stop flag.
929
+
930
+ def Decompose(offset, code, type = Decode32Bits, features = 0):
931
+ """
932
+ @type offset: long
933
+ @param offset: Memory address where the code is located.
934
+ This is B{not} an offset into the code!
935
+ It's the actual memory address where it was read from.
936
+
937
+ @type code: str, in Py3 bytes
938
+ @param code: Code to disassemble.
939
+
940
+ @type type: int
941
+ @param type: Disassembly type. Can be one of the following:
942
+
943
+ * L{Decode16Bits}: 80286 decoding
944
+
945
+ * L{Decode32Bits}: IA-32 decoding
946
+
947
+ * L{Decode64Bits}: AMD64 decoding
948
+
949
+ @type features: int
950
+ @param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
951
+ or other features, eg. DF_RETURN_FC_ONLY.
952
+
953
+ @rtype: TODO
954
+ @return: TODO
955
+ @raise ValueError: Invalid arguments.
956
+ """
957
+ return list(DecomposeGenerator(offset, code, type, features))