contrast-agent 3.8.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (500) hide show
  1. checksums.yaml +7 -0
  2. data/.clang-format +5 -0
  3. data/.dockerignore +10 -0
  4. data/.gitignore +58 -0
  5. data/.gitmodules +6 -0
  6. data/.rspec +6 -0
  7. data/.simplecov +4 -0
  8. data/Gemfile +7 -0
  9. data/LICENSE.txt +12 -0
  10. data/Rakefile +15 -0
  11. data/exe/contrast_service +29 -0
  12. data/ext/build_funchook.rb +48 -0
  13. data/ext/cs__assess_active_record_named/cs__active_record_named.c +47 -0
  14. data/ext/cs__assess_active_record_named/cs__active_record_named.h +10 -0
  15. data/ext/cs__assess_active_record_named/extconf.rb +2 -0
  16. data/ext/cs__assess_array/cs__assess_array.c +38 -0
  17. data/ext/cs__assess_array/cs__assess_array.h +9 -0
  18. data/ext/cs__assess_array/extconf.rb +2 -0
  19. data/ext/cs__assess_basic_object/cs__assess_basic_object.c +50 -0
  20. data/ext/cs__assess_basic_object/cs__assess_basic_object.h +17 -0
  21. data/ext/cs__assess_basic_object/extconf.rb +2 -0
  22. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +86 -0
  23. data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +34 -0
  24. data/ext/cs__assess_fiber_track/extconf.rb +2 -0
  25. data/ext/cs__assess_hash/cs__assess_hash.c +64 -0
  26. data/ext/cs__assess_hash/cs__assess_hash.h +24 -0
  27. data/ext/cs__assess_hash/extconf.rb +2 -0
  28. data/ext/cs__assess_kernel/cs__assess_kernel.c +36 -0
  29. data/ext/cs__assess_kernel/cs__assess_kernel.h +10 -0
  30. data/ext/cs__assess_kernel/extconf.rb +2 -0
  31. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.c +47 -0
  32. data/ext/cs__assess_marshal_module/cs__assess_marshal_module.h +18 -0
  33. data/ext/cs__assess_marshal_module/extconf.rb +2 -0
  34. data/ext/cs__assess_module/cs__assess_module.c +78 -0
  35. data/ext/cs__assess_module/cs__assess_module.h +25 -0
  36. data/ext/cs__assess_module/extconf.rb +2 -0
  37. data/ext/cs__assess_regexp/cs__assess_regexp.c +48 -0
  38. data/ext/cs__assess_regexp/cs__assess_regexp.h +22 -0
  39. data/ext/cs__assess_regexp/extconf.rb +2 -0
  40. data/ext/cs__assess_regexp_track/cs__assess_regexp_track.c +63 -0
  41. data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h +29 -0
  42. data/ext/cs__assess_regexp_track/extconf.rb +2 -0
  43. data/ext/cs__assess_string/cs__assess_string.c +38 -0
  44. data/ext/cs__assess_string/cs__assess_string.h +19 -0
  45. data/ext/cs__assess_string/extconf.rb +2 -0
  46. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +31 -0
  47. data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.h +13 -0
  48. data/ext/cs__assess_string_interpolation26/extconf.rb +2 -0
  49. data/ext/cs__common/cs__common.c +60 -0
  50. data/ext/cs__common/cs__common.h +28 -0
  51. data/ext/cs__common/extconf.rb +20 -0
  52. data/ext/cs__contrast_patch/cs__contrast_patch.c +445 -0
  53. data/ext/cs__contrast_patch/cs__contrast_patch.h +196 -0
  54. data/ext/cs__contrast_patch/extconf.rb +2 -0
  55. data/ext/cs__protect_kernel/cs__protect_kernel.c +37 -0
  56. data/ext/cs__protect_kernel/cs__protect_kernel.h +11 -0
  57. data/ext/cs__protect_kernel/extconf.rb +2 -0
  58. data/ext/cs__scope/cs__scope.c +96 -0
  59. data/ext/cs__scope/cs__scope.h +33 -0
  60. data/ext/cs__scope/extconf.rb +2 -0
  61. data/ext/extconf_common.rb +49 -0
  62. data/funchook/LICENSE +360 -0
  63. data/funchook/Makefile +29 -0
  64. data/funchook/Makefile.in +29 -0
  65. data/funchook/README.md +121 -0
  66. data/funchook/appveyor.yml +42 -0
  67. data/funchook/autogen.sh +3 -0
  68. data/funchook/autom4te.cache/output.0 +4976 -0
  69. data/funchook/autom4te.cache/requests +78 -0
  70. data/funchook/autom4te.cache/traces.0 +364 -0
  71. data/funchook/config.guess +1530 -0
  72. data/funchook/config.log +490 -0
  73. data/funchook/config.status +1016 -0
  74. data/funchook/config.sub +1773 -0
  75. data/funchook/configure +4976 -0
  76. data/funchook/configure.ac +59 -0
  77. data/funchook/distorm/COPYING +26 -0
  78. data/funchook/distorm/MANIFEST +25 -0
  79. data/funchook/distorm/MANIFEST.in +4 -0
  80. data/funchook/distorm/README.md +12 -0
  81. data/funchook/distorm/disOps/disOps.py +795 -0
  82. data/funchook/distorm/disOps/x86db.py +404 -0
  83. data/funchook/distorm/disOps/x86header.py +247 -0
  84. data/funchook/distorm/disOps/x86sets.py +1664 -0
  85. data/funchook/distorm/examples/cs/TestdiStorm/Program.cs +79 -0
  86. data/funchook/distorm/examples/cs/TestdiStorm/Properties/AssemblyInfo.cs +36 -0
  87. data/funchook/distorm/examples/cs/TestdiStorm/TestdiStorm.csproj +69 -0
  88. data/funchook/distorm/examples/cs/distorm-net.sln +26 -0
  89. data/funchook/distorm/examples/cs/distorm-net/CodeInfo.cs +23 -0
  90. data/funchook/distorm/examples/cs/distorm-net/DecodedInst.cs +15 -0
  91. data/funchook/distorm/examples/cs/distorm-net/DecodedResult.cs +14 -0
  92. data/funchook/distorm/examples/cs/distorm-net/DecomposedInst.cs +36 -0
  93. data/funchook/distorm/examples/cs/distorm-net/DecomposedResult.cs +14 -0
  94. data/funchook/distorm/examples/cs/distorm-net/Opcodes.cs +1268 -0
  95. data/funchook/distorm/examples/cs/distorm-net/Opcodes.tt +37 -0
  96. data/funchook/distorm/examples/cs/distorm-net/Operand.cs +25 -0
  97. data/funchook/distorm/examples/cs/distorm-net/Properties/AssemblyInfo.cs +36 -0
  98. data/funchook/distorm/examples/cs/distorm-net/diStorm3.cs +411 -0
  99. data/funchook/distorm/examples/cs/distorm-net/distorm-net.csproj +80 -0
  100. data/funchook/distorm/examples/cs/readme +3 -0
  101. data/funchook/distorm/examples/ddk/README +48 -0
  102. data/funchook/distorm/examples/ddk/distorm.ini +11 -0
  103. data/funchook/distorm/examples/ddk/dummy.c +15 -0
  104. data/funchook/distorm/examples/ddk/main.c +91 -0
  105. data/funchook/distorm/examples/ddk/makefile +1 -0
  106. data/funchook/distorm/examples/ddk/sources +10 -0
  107. data/funchook/distorm/examples/java/Makefile +23 -0
  108. data/funchook/distorm/examples/java/distorm/src/Main.java +43 -0
  109. data/funchook/distorm/examples/java/distorm/src/diStorm3/CodeInfo.java +27 -0
  110. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedInst.java +32 -0
  111. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecodedResult.java +11 -0
  112. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedInst.java +89 -0
  113. data/funchook/distorm/examples/java/distorm/src/diStorm3/DecomposedResult.java +11 -0
  114. data/funchook/distorm/examples/java/distorm/src/diStorm3/OpcodeEnum.java +131 -0
  115. data/funchook/distorm/examples/java/distorm/src/diStorm3/Opcodes.java +1123 -0
  116. data/funchook/distorm/examples/java/distorm/src/diStorm3/Operand.java +24 -0
  117. data/funchook/distorm/examples/java/distorm/src/diStorm3/distorm3.java +41 -0
  118. data/funchook/distorm/examples/java/jdistorm.c +405 -0
  119. data/funchook/distorm/examples/java/jdistorm.h +40 -0
  120. data/funchook/distorm/examples/java/jdistorm.sln +20 -0
  121. data/funchook/distorm/examples/java/jdistorm.vcproj +208 -0
  122. data/funchook/distorm/examples/linux/Makefile +15 -0
  123. data/funchook/distorm/examples/linux/main.c +181 -0
  124. data/funchook/distorm/examples/tests/Makefile +15 -0
  125. data/funchook/distorm/examples/tests/main.cpp +42 -0
  126. data/funchook/distorm/examples/tests/main.py +66 -0
  127. data/funchook/distorm/examples/tests/test_distorm3.py +1672 -0
  128. data/funchook/distorm/examples/tests/tests.sln +20 -0
  129. data/funchook/distorm/examples/tests/tests.vcxproj +82 -0
  130. data/funchook/distorm/examples/tests/tests.vcxproj.filters +22 -0
  131. data/funchook/distorm/examples/win32/disasm.sln +25 -0
  132. data/funchook/distorm/examples/win32/disasm.vcxproj +201 -0
  133. data/funchook/distorm/examples/win32/disasm.vcxproj.filters +14 -0
  134. data/funchook/distorm/examples/win32/main.cpp +163 -0
  135. data/funchook/distorm/include/distorm.h +482 -0
  136. data/funchook/distorm/include/mnemonics.h +301 -0
  137. data/funchook/distorm/make/linux/Makefile +28 -0
  138. data/funchook/distorm/make/mac/Makefile +24 -0
  139. data/funchook/distorm/make/win32/cdistorm.vcxproj +239 -0
  140. data/funchook/distorm/make/win32/cdistorm.vcxproj.filters +80 -0
  141. data/funchook/distorm/make/win32/distorm.sln +25 -0
  142. data/funchook/distorm/make/win32/resource.h +14 -0
  143. data/funchook/distorm/make/win32/resource.rc +99 -0
  144. data/funchook/distorm/python/distorm3/__init__.py +957 -0
  145. data/funchook/distorm/python/distorm3/sample.py +51 -0
  146. data/funchook/distorm/setup.cfg +10 -0
  147. data/funchook/distorm/setup.py +266 -0
  148. data/funchook/distorm/src/config.h +169 -0
  149. data/funchook/distorm/src/decoder.c +641 -0
  150. data/funchook/distorm/src/decoder.h +33 -0
  151. data/funchook/distorm/src/distorm.c +413 -0
  152. data/funchook/distorm/src/instructions.c +597 -0
  153. data/funchook/distorm/src/instructions.h +463 -0
  154. data/funchook/distorm/src/insts.c +7939 -0
  155. data/funchook/distorm/src/insts.h +64 -0
  156. data/funchook/distorm/src/mnemonics.c +284 -0
  157. data/funchook/distorm/src/operands.c +1290 -0
  158. data/funchook/distorm/src/operands.h +28 -0
  159. data/funchook/distorm/src/prefix.c +368 -0
  160. data/funchook/distorm/src/prefix.h +64 -0
  161. data/funchook/distorm/src/textdefs.c +172 -0
  162. data/funchook/distorm/src/textdefs.h +57 -0
  163. data/funchook/distorm/src/wstring.c +47 -0
  164. data/funchook/distorm/src/wstring.h +35 -0
  165. data/funchook/distorm/src/x86defs.h +82 -0
  166. data/funchook/include/funchook.h +123 -0
  167. data/funchook/install-sh +527 -0
  168. data/funchook/src/Makefile +70 -0
  169. data/funchook/src/Makefile.in +70 -0
  170. data/funchook/src/__strerror.h +109 -0
  171. data/funchook/src/config.h +101 -0
  172. data/funchook/src/config.h.in +100 -0
  173. data/funchook/src/decoder.o +0 -0
  174. data/funchook/src/distorm.o +0 -0
  175. data/funchook/src/funchook.c +440 -0
  176. data/funchook/src/funchook.o +0 -0
  177. data/funchook/src/funchook_internal.h +155 -0
  178. data/funchook/src/funchook_io.c +182 -0
  179. data/funchook/src/funchook_io.h +64 -0
  180. data/funchook/src/funchook_io.o +0 -0
  181. data/funchook/src/funchook_syscall.S +134 -0
  182. data/funchook/src/funchook_syscall.o +0 -0
  183. data/funchook/src/funchook_unix.c +480 -0
  184. data/funchook/src/funchook_unix.o +0 -0
  185. data/funchook/src/funchook_windows.c +397 -0
  186. data/funchook/src/funchook_x86.c +622 -0
  187. data/funchook/src/funchook_x86.o +0 -0
  188. data/funchook/src/instructions.o +0 -0
  189. data/funchook/src/insts.o +0 -0
  190. data/funchook/src/libfunchook.so +0 -0
  191. data/funchook/src/mnemonics.o +0 -0
  192. data/funchook/src/operands.o +0 -0
  193. data/funchook/src/os_func.c +115 -0
  194. data/funchook/src/os_func.h +75 -0
  195. data/funchook/src/os_func.o +0 -0
  196. data/funchook/src/os_func_unix.c +94 -0
  197. data/funchook/src/os_func_unix.o +0 -0
  198. data/funchook/src/os_func_windows.c +32 -0
  199. data/funchook/src/prefix.o +0 -0
  200. data/funchook/src/printf_base.c +1688 -0
  201. data/funchook/src/printf_base.h +46 -0
  202. data/funchook/src/printf_base.o +0 -0
  203. data/funchook/src/textdefs.o +0 -0
  204. data/funchook/src/wstring.o +0 -0
  205. data/funchook/test/Makefile +43 -0
  206. data/funchook/test/Makefile.in +43 -0
  207. data/funchook/test/funchook_test +0 -0
  208. data/funchook/test/libfunchook_test.c +25 -0
  209. data/funchook/test/libfunchook_test.so +0 -0
  210. data/funchook/test/libfunchook_test2.c +18 -0
  211. data/funchook/test/suffix.list +600 -0
  212. data/funchook/test/test_main.c +430 -0
  213. data/funchook/test/test_main.o +0 -0
  214. data/funchook/test/x86_64_test.S +10 -0
  215. data/funchook/test/x86_64_test.o +0 -0
  216. data/funchook/test/x86_test.S +339 -0
  217. data/funchook/win32/config.h +1 -0
  218. data/funchook/win32/funchook.sln +52 -0
  219. data/funchook/win32/funchook.vcxproj +188 -0
  220. data/funchook/win32/funchook.vcxproj.filters +84 -0
  221. data/funchook/win32/funchook_test.vcxproj +170 -0
  222. data/funchook/win32/funchook_test.vcxproj.filters +22 -0
  223. data/funchook/win32/funchook_test_dll.vcxproj +184 -0
  224. data/funchook/win32/funchook_test_dll.vcxproj.filters +30 -0
  225. data/funchook/win32/funchook_test_exe.def +3 -0
  226. data/lib/contrast-agent.rb +8 -0
  227. data/lib/contrast.rb +57 -0
  228. data/lib/contrast/agent.rb +80 -0
  229. data/lib/contrast/agent/assess.rb +45 -0
  230. data/lib/contrast/agent/assess/adjusted_span.rb +25 -0
  231. data/lib/contrast/agent/assess/class_reverter.rb +82 -0
  232. data/lib/contrast/agent/assess/contrast_event.rb +398 -0
  233. data/lib/contrast/agent/assess/frozen_properties.rb +41 -0
  234. data/lib/contrast/agent/assess/insulator.rb +53 -0
  235. data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +78 -0
  236. data/lib/contrast/agent/assess/policy/patcher.rb +85 -0
  237. data/lib/contrast/agent/assess/policy/policy.rb +116 -0
  238. data/lib/contrast/agent/assess/policy/policy_node.rb +289 -0
  239. data/lib/contrast/agent/assess/policy/policy_scanner.rb +44 -0
  240. data/lib/contrast/agent/assess/policy/preshift.rb +94 -0
  241. data/lib/contrast/agent/assess/policy/propagation_method.rb +260 -0
  242. data/lib/contrast/agent/assess/policy/propagation_node.rb +127 -0
  243. data/lib/contrast/agent/assess/policy/propagator.rb +35 -0
  244. data/lib/contrast/agent/assess/policy/propagator/append.rb +54 -0
  245. data/lib/contrast/agent/assess/policy/propagator/base.rb +37 -0
  246. data/lib/contrast/agent/assess/policy/propagator/center.rb +73 -0
  247. data/lib/contrast/agent/assess/policy/propagator/custom.rb +36 -0
  248. data/lib/contrast/agent/assess/policy/propagator/database_write.rb +62 -0
  249. data/lib/contrast/agent/assess/policy/propagator/insert.rb +55 -0
  250. data/lib/contrast/agent/assess/policy/propagator/keep.rb +26 -0
  251. data/lib/contrast/agent/assess/policy/propagator/next.rb +42 -0
  252. data/lib/contrast/agent/assess/policy/propagator/prepend.rb +50 -0
  253. data/lib/contrast/agent/assess/policy/propagator/remove.rb +76 -0
  254. data/lib/contrast/agent/assess/policy/propagator/replace.rb +27 -0
  255. data/lib/contrast/agent/assess/policy/propagator/reverse.rb +38 -0
  256. data/lib/contrast/agent/assess/policy/propagator/select.rb +86 -0
  257. data/lib/contrast/agent/assess/policy/propagator/splat.rb +60 -0
  258. data/lib/contrast/agent/assess/policy/propagator/split.rb +49 -0
  259. data/lib/contrast/agent/assess/policy/propagator/substitution.rb +169 -0
  260. data/lib/contrast/agent/assess/policy/propagator/trim.rb +81 -0
  261. data/lib/contrast/agent/assess/policy/rewriter_patch.rb +79 -0
  262. data/lib/contrast/agent/assess/policy/source_method.rb +209 -0
  263. data/lib/contrast/agent/assess/policy/source_node.rb +62 -0
  264. data/lib/contrast/agent/assess/policy/trigger_method.rb +209 -0
  265. data/lib/contrast/agent/assess/policy/trigger_node.rb +198 -0
  266. data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb +77 -0
  267. data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb +31 -0
  268. data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb +40 -0
  269. data/lib/contrast/agent/assess/properties.rb +392 -0
  270. data/lib/contrast/agent/assess/rule.rb +18 -0
  271. data/lib/contrast/agent/assess/rule/base.rb +72 -0
  272. data/lib/contrast/agent/assess/rule/csrf.rb +66 -0
  273. data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb +28 -0
  274. data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb +69 -0
  275. data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb +132 -0
  276. data/lib/contrast/agent/assess/rule/provider.rb +21 -0
  277. data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb +62 -0
  278. data/lib/contrast/agent/assess/rule/provider/hardcoded_password.rb +73 -0
  279. data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +121 -0
  280. data/lib/contrast/agent/assess/rule/redos.rb +68 -0
  281. data/lib/contrast/agent/assess/rule/response_scanning_rule.rb +47 -0
  282. data/lib/contrast/agent/assess/rule/response_watcher.rb +36 -0
  283. data/lib/contrast/agent/assess/rule/watcher.rb +36 -0
  284. data/lib/contrast/agent/assess/tag.rb +151 -0
  285. data/lib/contrast/agent/at_exit_hook.rb +33 -0
  286. data/lib/contrast/agent/class_reopener.rb +195 -0
  287. data/lib/contrast/agent/deadzone/policy/deadzone_node.rb +26 -0
  288. data/lib/contrast/agent/deadzone/policy/policy.rb +57 -0
  289. data/lib/contrast/agent/disable_reaction.rb +24 -0
  290. data/lib/contrast/agent/exclusion_matcher.rb +190 -0
  291. data/lib/contrast/agent/feature_state.rb +379 -0
  292. data/lib/contrast/agent/inventory/policy/policy.rb +32 -0
  293. data/lib/contrast/agent/inventory/policy/trigger_node.rb +22 -0
  294. data/lib/contrast/agent/logger_manager.rb +116 -0
  295. data/lib/contrast/agent/middleware.rb +352 -0
  296. data/lib/contrast/agent/module_data.rb +16 -0
  297. data/lib/contrast/agent/patching/policy/after_load_patch.rb +37 -0
  298. data/lib/contrast/agent/patching/policy/after_load_patcher.rb +58 -0
  299. data/lib/contrast/agent/patching/policy/method_policy.rb +94 -0
  300. data/lib/contrast/agent/patching/policy/module_policy.rb +116 -0
  301. data/lib/contrast/agent/patching/policy/patch.rb +312 -0
  302. data/lib/contrast/agent/patching/policy/patch_status.rb +192 -0
  303. data/lib/contrast/agent/patching/policy/patcher.rb +310 -0
  304. data/lib/contrast/agent/patching/policy/policy.rb +138 -0
  305. data/lib/contrast/agent/patching/policy/policy_node.rb +80 -0
  306. data/lib/contrast/agent/patching/policy/policy_unpatcher.rb +28 -0
  307. data/lib/contrast/agent/patching/policy/trigger_node.rb +81 -0
  308. data/lib/contrast/agent/protect/policy/policy.rb +37 -0
  309. data/lib/contrast/agent/protect/policy/trigger_node.rb +23 -0
  310. data/lib/contrast/agent/protect/rule.rb +58 -0
  311. data/lib/contrast/agent/protect/rule/base.rb +300 -0
  312. data/lib/contrast/agent/protect/rule/base_service.rb +88 -0
  313. data/lib/contrast/agent/protect/rule/cmd_injection.rb +156 -0
  314. data/lib/contrast/agent/protect/rule/csrf.rb +118 -0
  315. data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb +103 -0
  316. data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb +85 -0
  317. data/lib/contrast/agent/protect/rule/default_scanner.rb +300 -0
  318. data/lib/contrast/agent/protect/rule/deserialization.rb +193 -0
  319. data/lib/contrast/agent/protect/rule/http_method_tampering.rb +80 -0
  320. data/lib/contrast/agent/protect/rule/no_sqli.rb +101 -0
  321. data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb +40 -0
  322. data/lib/contrast/agent/protect/rule/path_traversal.rb +143 -0
  323. data/lib/contrast/agent/protect/rule/sqli.rb +101 -0
  324. data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb +16 -0
  325. data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb +38 -0
  326. data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb +22 -0
  327. data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb +19 -0
  328. data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb +20 -0
  329. data/lib/contrast/agent/protect/rule/xss.rb +24 -0
  330. data/lib/contrast/agent/protect/rule/xxe.rb +120 -0
  331. data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb +82 -0
  332. data/lib/contrast/agent/railtie.rb +30 -0
  333. data/lib/contrast/agent/reaction_processor.rb +47 -0
  334. data/lib/contrast/agent/request.rb +493 -0
  335. data/lib/contrast/agent/request_context.rb +225 -0
  336. data/lib/contrast/agent/require_state.rb +61 -0
  337. data/lib/contrast/agent/response.rb +215 -0
  338. data/lib/contrast/agent/rewriter.rb +244 -0
  339. data/lib/contrast/agent/scope.rb +28 -0
  340. data/lib/contrast/agent/service_heartbeat.rb +37 -0
  341. data/lib/contrast/agent/settings_state.rb +148 -0
  342. data/lib/contrast/agent/socket_client.rb +125 -0
  343. data/lib/contrast/agent/thread.rb +26 -0
  344. data/lib/contrast/agent/tracepoint_hook.rb +51 -0
  345. data/lib/contrast/agent/version.rb +8 -0
  346. data/lib/contrast/api.rb +17 -0
  347. data/lib/contrast/api/.gitkeep +0 -0
  348. data/lib/contrast/api/connection_status.rb +49 -0
  349. data/lib/contrast/api/socket.rb +43 -0
  350. data/lib/contrast/api/speedracer.rb +206 -0
  351. data/lib/contrast/api/tcp_socket.rb +31 -0
  352. data/lib/contrast/api/unix_socket.rb +25 -0
  353. data/lib/contrast/common_agent_configuration.rb +86 -0
  354. data/lib/contrast/components/agent.rb +85 -0
  355. data/lib/contrast/components/app_context.rb +188 -0
  356. data/lib/contrast/components/assess.rb +67 -0
  357. data/lib/contrast/components/config.rb +135 -0
  358. data/lib/contrast/components/contrast_service.rb +113 -0
  359. data/lib/contrast/components/heap_dump.rb +34 -0
  360. data/lib/contrast/components/interface.rb +178 -0
  361. data/lib/contrast/components/inventory.rb +23 -0
  362. data/lib/contrast/components/logger.rb +92 -0
  363. data/lib/contrast/components/protect.rb +38 -0
  364. data/lib/contrast/components/sampling.rb +41 -0
  365. data/lib/contrast/components/scope.rb +106 -0
  366. data/lib/contrast/components/settings.rb +140 -0
  367. data/lib/contrast/config.rb +33 -0
  368. data/lib/contrast/config/agent_configuration.rb +24 -0
  369. data/lib/contrast/config/application_configuration.rb +27 -0
  370. data/lib/contrast/config/assess_configuration.rb +22 -0
  371. data/lib/contrast/config/assess_rules_configuration.rb +18 -0
  372. data/lib/contrast/config/base_configuration.rb +105 -0
  373. data/lib/contrast/config/default_value.rb +16 -0
  374. data/lib/contrast/config/exception_configuration.rb +21 -0
  375. data/lib/contrast/config/heap_dump_configuration.rb +23 -0
  376. data/lib/contrast/config/inventory_configuration.rb +20 -0
  377. data/lib/contrast/config/logger_configuration.rb +20 -0
  378. data/lib/contrast/config/protect_configuration.rb +20 -0
  379. data/lib/contrast/config/protect_rule_configuration.rb +37 -0
  380. data/lib/contrast/config/protect_rules_configuration.rb +30 -0
  381. data/lib/contrast/config/root_configuration.rb +26 -0
  382. data/lib/contrast/config/ruby_configuration.rb +39 -0
  383. data/lib/contrast/config/sampling_configuration.rb +22 -0
  384. data/lib/contrast/config/server_configuration.rb +23 -0
  385. data/lib/contrast/config/service_configuration.rb +22 -0
  386. data/lib/contrast/configuration.rb +214 -0
  387. data/lib/contrast/core_extensions/assess.rb +51 -0
  388. data/lib/contrast/core_extensions/assess/array.rb +58 -0
  389. data/lib/contrast/core_extensions/assess/assess_extension.rb +145 -0
  390. data/lib/contrast/core_extensions/assess/basic_object.rb +15 -0
  391. data/lib/contrast/core_extensions/assess/erb.rb +42 -0
  392. data/lib/contrast/core_extensions/assess/exec_trigger.rb +48 -0
  393. data/lib/contrast/core_extensions/assess/fiber.rb +125 -0
  394. data/lib/contrast/core_extensions/assess/hash.rb +22 -0
  395. data/lib/contrast/core_extensions/assess/kernel.rb +95 -0
  396. data/lib/contrast/core_extensions/assess/module.rb +14 -0
  397. data/lib/contrast/core_extensions/assess/regexp.rb +206 -0
  398. data/lib/contrast/core_extensions/assess/string.rb +75 -0
  399. data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb +73 -0
  400. data/lib/contrast/core_extensions/delegator.rb +14 -0
  401. data/lib/contrast/core_extensions/eval_trigger.rb +52 -0
  402. data/lib/contrast/core_extensions/inventory.rb +22 -0
  403. data/lib/contrast/core_extensions/inventory/datastores.rb +37 -0
  404. data/lib/contrast/core_extensions/module.rb +42 -0
  405. data/lib/contrast/core_extensions/object.rb +27 -0
  406. data/lib/contrast/core_extensions/protect.rb +20 -0
  407. data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb +70 -0
  408. data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb +58 -0
  409. data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb +81 -0
  410. data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb +119 -0
  411. data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb +63 -0
  412. data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb +141 -0
  413. data/lib/contrast/core_extensions/protect/kernel.rb +30 -0
  414. data/lib/contrast/core_extensions/protect/psych.rb +7 -0
  415. data/lib/contrast/core_extensions/thread.rb +31 -0
  416. data/lib/contrast/internal_exception.rb +8 -0
  417. data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb +48 -0
  418. data/lib/contrast/rails_extensions/assess/active_record.rb +32 -0
  419. data/lib/contrast/rails_extensions/assess/active_record_named.rb +61 -0
  420. data/lib/contrast/rails_extensions/assess/configuration.rb +26 -0
  421. data/lib/contrast/rails_extensions/buffer.rb +30 -0
  422. data/lib/contrast/rails_extensions/rack.rb +45 -0
  423. data/lib/contrast/security_exception.rb +14 -0
  424. data/lib/contrast/sinatra_extensions/assess/cookie.rb +26 -0
  425. data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb +59 -0
  426. data/lib/contrast/tasks/service.rb +95 -0
  427. data/lib/contrast/utils/assess/sampling_util.rb +96 -0
  428. data/lib/contrast/utils/assess/tracking_util.rb +39 -0
  429. data/lib/contrast/utils/boolean_util.rb +33 -0
  430. data/lib/contrast/utils/cache.rb +69 -0
  431. data/lib/contrast/utils/class_util.rb +58 -0
  432. data/lib/contrast/utils/comment_range.rb +19 -0
  433. data/lib/contrast/utils/data_store_util.rb +23 -0
  434. data/lib/contrast/utils/duck_utils.rb +58 -0
  435. data/lib/contrast/utils/env_configuration_item.rb +52 -0
  436. data/lib/contrast/utils/environment_util.rb +152 -0
  437. data/lib/contrast/utils/freeze_util.rb +36 -0
  438. data/lib/contrast/utils/gemfile_reader.rb +191 -0
  439. data/lib/contrast/utils/hash_digest.rb +148 -0
  440. data/lib/contrast/utils/heap_dump_util.rb +113 -0
  441. data/lib/contrast/utils/invalid_configuration_util.rb +88 -0
  442. data/lib/contrast/utils/inventory_util.rb +126 -0
  443. data/lib/contrast/utils/io_util.rb +61 -0
  444. data/lib/contrast/utils/object_share.rb +117 -0
  445. data/lib/contrast/utils/operating_environment.rb +38 -0
  446. data/lib/contrast/utils/os.rb +49 -0
  447. data/lib/contrast/utils/path_util.rb +151 -0
  448. data/lib/contrast/utils/performs_logging.rb +152 -0
  449. data/lib/contrast/utils/preflight_util.rb +13 -0
  450. data/lib/contrast/utils/prevent_serialization.rb +52 -0
  451. data/lib/contrast/utils/rack_assess_session_cookie.rb +104 -0
  452. data/lib/contrast/utils/rails_assess_configuration.rb +95 -0
  453. data/lib/contrast/utils/random_util.rb +22 -0
  454. data/lib/contrast/utils/resource_loader.rb +23 -0
  455. data/lib/contrast/utils/ruby_ast_rewriter.rb +74 -0
  456. data/lib/contrast/utils/scope_util.rb +99 -0
  457. data/lib/contrast/utils/service_response_util.rb +116 -0
  458. data/lib/contrast/utils/service_sender_util.rb +98 -0
  459. data/lib/contrast/utils/sha256_builder.rb +69 -0
  460. data/lib/contrast/utils/sinatra_helper.rb +49 -0
  461. data/lib/contrast/utils/stack_trace_utils.rb +209 -0
  462. data/lib/contrast/utils/string_utils.rb +72 -0
  463. data/lib/contrast/utils/tag_util.rb +139 -0
  464. data/lib/contrast/utils/thread_tracker.rb +54 -0
  465. data/lib/contrast/utils/timer.rb +78 -0
  466. data/resources/assess/policy.json +1673 -0
  467. data/resources/csrf/inject.js +44 -0
  468. data/resources/deadzone/policy.json +55 -0
  469. data/resources/factory-bot-spec/spec_helper.rb +30 -0
  470. data/resources/inventory/policy.json +110 -0
  471. data/resources/protect/policy.json +417 -0
  472. data/resources/rubocops/kernel/catch_cop.rb +37 -0
  473. data/resources/rubocops/kernel/require_cop.rb +37 -0
  474. data/resources/rubocops/kernel/require_relative_cop.rb +33 -0
  475. data/resources/rubocops/module/autoload_cop.rb +37 -0
  476. data/resources/rubocops/module/const_defined_cop.rb +37 -0
  477. data/resources/rubocops/module/const_get_cop.rb +37 -0
  478. data/resources/rubocops/module/const_set_cop.rb +37 -0
  479. data/resources/rubocops/module/constants_cop.rb +37 -0
  480. data/resources/rubocops/module/name_cop.rb +37 -0
  481. data/resources/rubocops/object/class_cop.rb +37 -0
  482. data/resources/rubocops/object/freeze_cop.rb +37 -0
  483. data/resources/rubocops/object/frozen_cop.rb +37 -0
  484. data/resources/rubocops/object/is_a_cop.rb +37 -0
  485. data/resources/rubocops/object/method_cop.rb +37 -0
  486. data/resources/rubocops/object/respond_to_cop.rb +37 -0
  487. data/resources/rubocops/object/singleton_class_cop.rb +37 -0
  488. data/resources/rubocops/regexp/spelling_cop.rb +44 -0
  489. data/resources/rubocops/thread/new_cop.rb +39 -0
  490. data/resources/ruby-spec/ancestors_spec.rb +70 -0
  491. data/resources/ruby-spec/modulo_spec.rb +831 -0
  492. data/resources/ruby-spec/parameters_spec.rb +261 -0
  493. data/resources/ruby-spec/ruby_spec_spec_helper.rb +35 -0
  494. data/resources/test_marker.txt +1 -0
  495. data/ruby-agent.gemspec +129 -0
  496. data/service_executables/.gitkeep +0 -0
  497. data/service_executables/VERSION +1 -0
  498. data/service_executables/linux/contrast-service +0 -0
  499. data/service_executables/mac/contrast-service +0 -0
  500. metadata +945 -0
@@ -0,0 +1,80 @@
1
+ <?xml version="1.0" encoding="utf-8"?>
2
+ <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3
+ <ItemGroup>
4
+ <Filter Include="Source Files">
5
+ <UniqueIdentifier>{50ac9ad6-0895-4596-b142-1a7fad1b97d5}</UniqueIdentifier>
6
+ <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm</Extensions>
7
+ </Filter>
8
+ <Filter Include="Header Files">
9
+ <UniqueIdentifier>{8612ae75-7b41-4557-b23b-d3e14e7f9613}</UniqueIdentifier>
10
+ <Extensions>h;hpp;hxx;hm;inl;inc</Extensions>
11
+ </Filter>
12
+ </ItemGroup>
13
+ <ItemGroup>
14
+ <ClCompile Include="..\..\src\decoder.c">
15
+ <Filter>Source Files</Filter>
16
+ </ClCompile>
17
+ <ClCompile Include="..\..\src\distorm.c">
18
+ <Filter>Source Files</Filter>
19
+ </ClCompile>
20
+ <ClCompile Include="..\..\src\instructions.c">
21
+ <Filter>Source Files</Filter>
22
+ </ClCompile>
23
+ <ClCompile Include="..\..\src\insts.c">
24
+ <Filter>Source Files</Filter>
25
+ </ClCompile>
26
+ <ClCompile Include="..\..\src\mnemonics.c">
27
+ <Filter>Source Files</Filter>
28
+ </ClCompile>
29
+ <ClCompile Include="..\..\src\operands.c">
30
+ <Filter>Source Files</Filter>
31
+ </ClCompile>
32
+ <ClCompile Include="..\..\src\prefix.c">
33
+ <Filter>Source Files</Filter>
34
+ </ClCompile>
35
+ <ClCompile Include="..\..\src\textdefs.c">
36
+ <Filter>Source Files</Filter>
37
+ </ClCompile>
38
+ <ClCompile Include="..\..\src\wstring.c">
39
+ <Filter>Source Files</Filter>
40
+ </ClCompile>
41
+ <ClCompile Include="..\..\src\x86defs.c">
42
+ <Filter>Source Files</Filter>
43
+ </ClCompile>
44
+ </ItemGroup>
45
+ <ItemGroup>
46
+ <ClInclude Include="..\..\src\config.h">
47
+ <Filter>Header Files</Filter>
48
+ </ClInclude>
49
+ <ClInclude Include="..\..\include\distorm.h">
50
+ <Filter>Header Files</Filter>
51
+ </ClInclude>
52
+ <ClInclude Include="..\..\src\instructions.h">
53
+ <Filter>Header Files</Filter>
54
+ </ClInclude>
55
+ <ClInclude Include="..\..\src\insts.h">
56
+ <Filter>Header Files</Filter>
57
+ </ClInclude>
58
+ <ClInclude Include="..\..\include\mnemonics.h">
59
+ <Filter>Header Files</Filter>
60
+ </ClInclude>
61
+ <ClInclude Include="..\..\src\operands.h">
62
+ <Filter>Header Files</Filter>
63
+ </ClInclude>
64
+ <ClInclude Include="..\..\src\prefix.h">
65
+ <Filter>Header Files</Filter>
66
+ </ClInclude>
67
+ <ClInclude Include="..\..\src\textdefs.h">
68
+ <Filter>Header Files</Filter>
69
+ </ClInclude>
70
+ <ClInclude Include="..\..\src\wstring.h">
71
+ <Filter>Header Files</Filter>
72
+ </ClInclude>
73
+ <ClInclude Include="..\..\src\x86defs.h">
74
+ <Filter>Header Files</Filter>
75
+ </ClInclude>
76
+ </ItemGroup>
77
+ <ItemGroup>
78
+ <ResourceCompile Include="resource.rc" />
79
+ </ItemGroup>
80
+ </Project>
@@ -0,0 +1,25 @@
1
+ Microsoft Visual Studio Solution File, Format Version 11.00
2
+ # Visual Studio 2010
3
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "distorm", "cdistorm.vcxproj", "{15051CE1-AB10-4239-973D-01B84F2AD0A9}"
4
+ EndProject
5
+ Global
6
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
7
+ clib|Win32 = clib|Win32
8
+ clib|x64 = clib|x64
9
+ dll|Win32 = dll|Win32
10
+ dll|x64 = dll|x64
11
+ EndGlobalSection
12
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
13
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.ActiveCfg = clib|Win32
14
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|Win32.Build.0 = clib|Win32
15
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.ActiveCfg = clib|x64
16
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.clib|x64.Build.0 = clib|x64
17
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.ActiveCfg = dll|Win32
18
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|Win32.Build.0 = dll|Win32
19
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.ActiveCfg = dll|x64
20
+ {15051CE1-AB10-4239-973D-01B84F2AD0A9}.dll|x64.Build.0 = dll|x64
21
+ EndGlobalSection
22
+ GlobalSection(SolutionProperties) = preSolution
23
+ HideSolutionNode = FALSE
24
+ EndGlobalSection
25
+ EndGlobal
@@ -0,0 +1,14 @@
1
+ //{{NO_DEPENDENCIES}}
2
+ // Microsoft Visual C++ generated include file.
3
+ // Used by resource.rc
4
+
5
+ // Next default values for new objects
6
+ //
7
+ #ifdef APSTUDIO_INVOKED
8
+ #ifndef APSTUDIO_READONLY_SYMBOLS
9
+ #define _APS_NEXT_RESOURCE_VALUE 101
10
+ #define _APS_NEXT_COMMAND_VALUE 40001
11
+ #define _APS_NEXT_CONTROL_VALUE 1001
12
+ #define _APS_NEXT_SYMED_VALUE 101
13
+ #endif
14
+ #endif
@@ -0,0 +1,99 @@
1
+ // Microsoft Visual C++ generated resource script.
2
+ //
3
+ #include "resource.h"
4
+
5
+ #define APSTUDIO_READONLY_SYMBOLS
6
+ /////////////////////////////////////////////////////////////////////////////
7
+ //
8
+ // Generated from the TEXTINCLUDE 2 resource.
9
+ //
10
+ #include "afxres.h"
11
+
12
+ /////////////////////////////////////////////////////////////////////////////
13
+ #undef APSTUDIO_READONLY_SYMBOLS
14
+
15
+ /////////////////////////////////////////////////////////////////////////////
16
+ // English (United States) resources
17
+
18
+ #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
19
+ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
20
+ #pragma code_page(1252)
21
+
22
+ #ifdef APSTUDIO_INVOKED
23
+ /////////////////////////////////////////////////////////////////////////////
24
+ //
25
+ // TEXTINCLUDE
26
+ //
27
+
28
+ 1 TEXTINCLUDE
29
+ BEGIN
30
+ "resource.h\0"
31
+ END
32
+
33
+ 2 TEXTINCLUDE
34
+ BEGIN
35
+ "#include ""afxres.h""\r\n"
36
+ "\0"
37
+ END
38
+
39
+ 3 TEXTINCLUDE
40
+ BEGIN
41
+ "\r\n"
42
+ "\0"
43
+ END
44
+
45
+ #endif // APSTUDIO_INVOKED
46
+
47
+
48
+ /////////////////////////////////////////////////////////////////////////////
49
+ //
50
+ // Version
51
+ //
52
+
53
+ VS_VERSION_INFO VERSIONINFO
54
+ FILEVERSION 3,3,4,0
55
+ PRODUCTVERSION 3,3,4,0
56
+ FILEFLAGSMASK 0x17L
57
+ #ifdef _DEBUG
58
+ FILEFLAGS 0x1L
59
+ #else
60
+ FILEFLAGS 0x0L
61
+ #endif
62
+ FILEOS 0x4L
63
+ FILETYPE 0x2L
64
+ FILESUBTYPE 0x0L
65
+ BEGIN
66
+ BLOCK "StringFileInfo"
67
+ BEGIN
68
+ BLOCK "040904b0"
69
+ BEGIN
70
+ VALUE "FileDescription", "diStorm3 module"
71
+ VALUE "FileVersion", "3.3.4.0"
72
+ VALUE "InternalName", "diStorm3"
73
+ VALUE "LegalCopyright", "Copyright (C) 2003-2016 Gil Dabah"
74
+ VALUE "OriginalFilename", "diStorm3.dll"
75
+ VALUE "ProductName", "diStorm3 Disassembler Library"
76
+ VALUE "ProductVersion", "3.3.4.0"
77
+ END
78
+ END
79
+ BLOCK "VarFileInfo"
80
+ BEGIN
81
+ VALUE "Translation", 0x409, 1200
82
+ END
83
+ END
84
+
85
+ #endif // English (United States) resources
86
+ /////////////////////////////////////////////////////////////////////////////
87
+
88
+
89
+
90
+ #ifndef APSTUDIO_INVOKED
91
+ /////////////////////////////////////////////////////////////////////////////
92
+ //
93
+ // Generated from the TEXTINCLUDE 3 resource.
94
+ //
95
+
96
+
97
+ /////////////////////////////////////////////////////////////////////////////
98
+ #endif // not APSTUDIO_INVOKED
99
+
@@ -0,0 +1,957 @@
1
+ # :[diStorm3}: Python binding
2
+ # Based on diStorm64 Python binding by Mario Vilas
3
+ # Initial support for decompose API added by Roee Shenberg
4
+ # Licensed under BSD in 2016.
5
+ #
6
+ # Compatible with Python2.6 and above.
7
+ #
8
+
9
+ info = (
10
+ "diStorm3 by Gil Dabah, https://github.com/gdabah/distorm/\n"
11
+ "Based on diStorm64 Python binding by Mario Vilas, http://breakingcode.wordpress.com/\n"
12
+ )
13
+
14
+ __revision__ = "$Id: distorm.py 186 2010-05-01 14:20:41Z gdabah $"
15
+
16
+ __all__ = [
17
+ 'Decode',
18
+ 'DecodeGenerator',
19
+ 'Decompose',
20
+ 'DecomposeGenerator',
21
+ 'Decode16Bits',
22
+ 'Decode32Bits',
23
+ 'Decode64Bits',
24
+ 'Mnemonics',
25
+ 'Registers',
26
+ ]
27
+
28
+ from ctypes import *
29
+ from os.path import split, join
30
+ from os import name as os_name
31
+ import sys
32
+
33
+ if sys.version_info[0] >= 3:
34
+ xrange = range
35
+
36
+ #==============================================================================
37
+ # Load the diStorm DLL
38
+
39
+ # Guess the DLL filename and load the library.
40
+ _distorm_path = split(__file__)[0]
41
+ if hasattr(sys, '_MEIPASS'):
42
+ _distorm_path = sys._MEIPASS
43
+ potential_libs = ['libdistorm3.so', 'libdistorm3.dylib']
44
+ if os_name == 'nt':
45
+ potential_libs = ['distorm3.dll', 'libdistorm3.dll']
46
+ lib_was_found = False
47
+ for i in potential_libs:
48
+ try:
49
+ _distorm_file = join(_distorm_path, i)
50
+ _distorm = cdll.LoadLibrary(_distorm_file)
51
+ lib_was_found = True
52
+ break
53
+ except OSError:
54
+ pass
55
+
56
+ if lib_was_found == False:
57
+ raise ImportError("Error loading the diStorm dynamic library (or cannot load library into process).")
58
+
59
+ # Get the decode C function (try 64 bits version first, only then 32 bits).
60
+ SUPPORT_64BIT_OFFSET = False
61
+ try:
62
+ internal_decode = _distorm.distorm_decode64
63
+ internal_decompose = _distorm.distorm_decompose64
64
+ internal_format = _distorm.distorm_format64
65
+ SUPPORT_64BIT_OFFSET = True
66
+ except AttributeError:
67
+ try:
68
+ internal_decode = _distorm.distorm_decode32
69
+ internal_decompose = _distorm.distorm_decompose32
70
+ internal_format = _distorm.distorm_format32
71
+ except AttributeError:
72
+ raise ImportError("Error loading distorm")
73
+
74
+ #==============================================================================
75
+ # diStorm C interface
76
+
77
+ MAX_TEXT_SIZE = 48 # See distorm.h for this value.
78
+ MAX_INSTRUCTIONS = 1000
79
+
80
+ DECRES_NONE = 0
81
+ DECRES_SUCCESS = 1
82
+ DECRES_MEMORYERR = 2
83
+ DECRES_INPUTERR = 3
84
+
85
+ if SUPPORT_64BIT_OFFSET:
86
+ _OffsetType = c_ulonglong
87
+ else:
88
+ _OffsetType = c_uint
89
+
90
+ class _WString (Structure):
91
+ _fields_ = [
92
+ ('length', c_uint),
93
+ ('p', c_char * MAX_TEXT_SIZE),
94
+ ]
95
+
96
+ class _CodeInfo (Structure):
97
+ _fields_ = [
98
+ ('codeOffset', _OffsetType),
99
+ ('nextOffset', _OffsetType),
100
+ ('code', c_char_p),
101
+ ('codeLen', c_int),
102
+ ('dt', c_byte),
103
+ ('features', c_uint),
104
+ ]
105
+
106
+ class _DecodedInst (Structure):
107
+ _fields_ = [
108
+ ('mnemonic', _WString),
109
+ ('operands', _WString),
110
+ ('instructionHex', _WString),
111
+ ('size', c_uint),
112
+ ('offset', _OffsetType),
113
+ ]
114
+
115
+ # _OperandType enum
116
+ _OperandType = c_ubyte
117
+
118
+ O_NONE = 0
119
+ O_REG = 1
120
+ O_IMM = 2
121
+ O_IMM1 = 3
122
+ O_IMM2 = 4
123
+ O_DISP = 5
124
+ O_SMEM = 6
125
+ O_MEM = 7
126
+ O_PC = 8
127
+ O_PTR = 9
128
+
129
+ class _Operand (Structure):
130
+ _fields_ = [
131
+ ('type', c_ubyte), # of type _OperandType
132
+ ('index', c_ubyte),
133
+ ('size', c_uint16),
134
+ ]
135
+
136
+ class _ex (Structure):
137
+ _fields_ = [
138
+ ('i1', c_uint32),
139
+ ('i2', c_uint32),
140
+ ]
141
+ class _ptr (Structure):
142
+ _fields_ = [
143
+ ('seg', c_uint16),
144
+ ('off', c_uint32),
145
+ ]
146
+
147
+ class _Value (Union):
148
+ _fields_ = [
149
+ ('sbyte', c_byte),
150
+ ('byte', c_ubyte),
151
+ ('sword', c_int16),
152
+ ('word', c_uint16),
153
+ ('sdword', c_int32),
154
+ ('dword', c_uint32),
155
+ ('sqword', c_int64),
156
+ ('qword', c_uint64),
157
+ ('addr', _OffsetType),
158
+ ('ptr', _ptr),
159
+ ('ex', _ex),
160
+ ]
161
+
162
+ class _DInst (Structure):
163
+ _fields_ = [
164
+ ('imm', _Value),
165
+ ('disp', c_uint64), # displacement. size is according to dispSize
166
+ ('addr', _OffsetType),
167
+ ('flags', c_uint16), # -1 if invalid. See C headers for more info
168
+ ('unusedPrefixesMask', c_uint16),
169
+ ('usedRegistersMask', c_uint32), # used registers mask.
170
+ ('opcode', c_uint16), # look up in opcode table
171
+ ('ops', _Operand*4),
172
+ ('size', c_ubyte),
173
+ ('segment', c_ubyte), # -1 if unused. See C headers for more info
174
+ ('base', c_ubyte), # base register for indirections
175
+ ('scale', c_ubyte), # ignore for values 0, 1 (other valid values - 2,4,8)
176
+ ('dispSize', c_ubyte),
177
+ ('meta', c_ubyte), # meta flags - instruction set class, etc. See C headers again...
178
+ ('modifiedFlagsMask', c_uint16), # CPU modified (output) flags by instruction.
179
+ ('testedFlagsMask', c_uint16), # CPU tested (input) flags by instruction.
180
+ ('undefinedFlagsMask', c_uint16) # CPU undefined flags by instruction.
181
+ ]
182
+
183
+ #==============================================================================
184
+ # diStorm Python interface
185
+
186
+ Decode16Bits = 0 # 80286 decoding
187
+ Decode32Bits = 1 # IA-32 decoding
188
+ Decode64Bits = 2 # AMD64 decoding
189
+ OffsetTypeSize = sizeof(_OffsetType)
190
+
191
+ Mnemonics = {
192
+ 0x679: "SLDT", 0x62: "POPA", 0x904: "UNPCKHPS", 0x115: "POPF", 0x11cf: "CMPLTSS",
193
+ 0x875: "VMOVSD", 0x79f: "PFPNACC", 0xb2a: "VMOVMSKPD", 0x74d: "INVLPGA", 0x90e: "UNPCKHPD",
194
+ 0x270: "SYSEXIT", 0x7c8: "PFSUB", 0x121e: "CMPLTSD", 0x1a73: "VPMULHUW", 0x1d4b: "VPHSUBSW",
195
+ 0x12c8: "VCMPNGEPS", 0x86d: "VMOVSS", 0x6f: "ARPL", 0x53a: "FICOMP", 0x162: "RETF",
196
+ 0x45d: "FCHS", 0x113a: "CMPLEPS", 0xf08: "PUNPCKHDQ", 0x2417: "VAESDEC", 0x5fe: "FUCOM",
197
+ 0x12b0: "VCMPORDPS", 0x19c1: "PSUBUSW", 0x1b5b: "PXOR", 0x1e25: "VPABSB", 0x24a: "WRMSR",
198
+ 0x12bb: "VCMPEQ_UQPS", 0x22cc: "VFMADDSUB231PD", 0x7df: "PFMAX", 0x16e3: "VCMPNEQ_OSSS",
199
+ 0x225a: "VFNMADD213PD", 0x3b8: "MOVNTI", 0x7d6: "PFCMPGT", 0x2380: "VFNMADD231SS",
200
+ 0x2466: "ROUNDPD", 0x1303: "VCMPGTPS", 0xbb5: "VRCPSS", 0x2150: "VFNMADD132SS",
201
+ 0x145a: "VCMPNGEPD", 0x2225: "VFMSUB213PD", 0x1875: "VCMPNEQ_OSSD", 0x2695: "VPSLLDQ",
202
+ 0x7a8: "PFCMPGE", 0x1495: "VCMPGTPD", 0x1a99: "CVTDQ2PD", 0x1227: "CMPLESD",
203
+ 0xae: "JNS", 0xdee: "VDIVSD", 0xb7: "JNP", 0x251e: "EXTRACTPS", 0x1f59: "PMOVZXBQ",
204
+ 0x9c: "JNZ", 0x5e8: "FCOMI", 0xefc: "VPUNPCKHWD", 0x1f44: "PMOVZXBD", 0x1ae0: "VMOVNTDQ",
205
+ 0x1e8a: "PMOVSXWD", 0x1108: "POPCNT", 0x8a: "JNO", 0x1ca5: "FNSAVE", 0x1a5: "LOOP",
206
+ 0xb1f: "VMOVMSKPS", 0x47b: "FLDL2T", 0x12d: "CMPS", 0x418: "FSUB", 0xdba: "DIVPS",
207
+ 0x1d31: "PHSUBD", 0x11c6: "CMPEQSS", 0x1e7: "CMC", 0xd15: "CVTTPS2DQ", 0xdc1: "DIVPD",
208
+ 0xf72: "VMOVD", 0x104: "CALL FAR", 0x1d88: "PMULHRSW", 0x1d92: "VPMULHRSW",
209
+ 0x1d20: "PHSUBW", 0x1215: "CMPEQSD", 0x3b2: "XADD", 0x2ae: "CMOVBE", 0x47: "CMP",
210
+ 0x24: "SBB", 0x1084: "VHADDPS", 0x26c3: "FXRSTOR64", 0x207a: "INVVPID", 0x20f: "LSL",
211
+ 0x1673: "VCMPNEQ_USSS", 0x107b: "VHADDPD", 0x38b: "LSS", 0x210d: "VFMSUB132PD",
212
+ 0x121: "LAHF", 0x802: "PFACC", 0x819: "PFRCPIT2", 0xe3d: "VPUNPCKLBW", 0x7e6: "PFRCPIT1",
213
+ 0x1fad: "PCMPGTQ", 0x4af: "FYL2X", 0x182f: "VCMPORD_SSD", 0x1949: "PSRLD",
214
+ 0x10f7: "SFENCE", 0xd0b: "CVTPS2DQ", 0x24c5: "PBLENDW", 0x21c4: "VFMSUBADD213PS",
215
+ 0xe8c: "PCMPGTB", 0xeb2: "PCMPGTD", 0x23ed: "VAESENC", 0x96d: "VMOVSHDUP",
216
+ 0x25b2: "MPSADBW", 0x14fd: "VCMPNLE_UQPD", 0x720: "VMMCALL", 0x1045: "INSERTQ",
217
+ 0x2268: "VFNMADD213SS", 0x9d5: "CVTPI2PD", 0x16f: "INT", 0x1d9d: "VPERMILPS",
218
+ 0x1e2: "HLT", 0x2059: "PHMINPOSUW", 0x5c1: "FCMOVNU", 0x2083: "INVPCID", 0x7b: "INS",
219
+ 0x657: "FCOMIP", 0x9cb: "CVTPI2PS", 0x2276: "VFNMADD213SD", 0xec5: "PACKUSWB",
220
+ 0xe4: "CBW", 0x731: "VMSAVE", 0x10e: "PUSHF", 0x65f: "NOT", 0x5a5: "FCMOVNB",
221
+ 0x245: "NOP", 0x4f8: "FSQRT", 0x1da8: "VPERMILPD", 0x51: "INC", 0x239: "UD2",
222
+ 0xffd: "VPCMPEQW", 0x262b: "PCMPISTRM", 0x1ee3: "VPCMPEQQ", 0x1163: "CMPNLEPS",
223
+ 0x183c: "VCMPEQ_USSD", 0x1414: "VCMPUNORDPD", 0x60d: "FADDP", 0x145: "RET",
224
+ 0x1010: "VPCMPEQD", 0x1fd9: "VPMINSD", 0x2558: "VPINSRB", 0xfea: "VPCMPEQB",
225
+ 0x1910: "ADDSUBPD", 0x22bc: "VFMADDSUB231PS", 0x16aa: "VCMPEQ_USSS", 0x1d66: "PSIGNW",
226
+ 0x1ebe: "VPMOVSXDQ", 0x201d: "VPMAXSD", 0x35b: "SETG", 0x200c: "VPMAXSB", 0x327: "SETA",
227
+ 0x306: "SETB", 0x26f5: "STMXCSR", 0x347: "SETL", 0x1acf: "MOVNTQ", 0x2f9: "SETO",
228
+ 0xbe3: "ANDNPD", 0x111c: "BSR", 0x8d0: "VMOVDDUP", 0x1b52: "VPMAXSW", 0x1d77: "PSIGND",
229
+ 0x33a: "SETP", 0x1d55: "PSIGNB", 0x395: "LFS", 0x32d: "SETS", 0x15a6: "VCMPUNORDSS",
230
+ 0xbdb: "ANDNPS", 0x2724: "VMXON", 0xbcb: "VANDPS", 0x703: "XSETBV", 0x1c3: "OUT",
231
+ 0x68a: "LTR", 0x2586: "VPINSRD", 0x1115: "TZCNT", 0xa6d: "VCVTTSS2SI", 0x2684: "VPSRLDQ",
232
+ 0x4d6: "FDECSTP", 0x267c: "PSRLDQ", 0x1883: "VCMPGE_OQSD", 0x268d: "PSLLDQ",
233
+ 0x51f: "FCOS", 0x4c5: "FXTRACT", 0x16f1: "VCMPGE_OQSS", 0x1ef7: "VMOVNTDQA",
234
+ 0x1533: "VCMPNGT_UQPD", 0x405: "FMUL", 0x13da: "VCMPGT_OQPS", 0x61b: "FCOMPP",
235
+ 0x790: "PF2ID", 0xf5: "CWD", 0x1340: "VCMPUNORD_SPS", 0x2ea: "CMOVLE", 0xfcd: "VPSHUFHW",
236
+ 0x156c: "VCMPGT_OQPD", 0x1cf6: "PHADDSW", 0x789: "PF2IW", 0xa37: "VMOVNTPD",
237
+ 0x411: "FCOMP", 0x8da: "UNPCKLPS", 0x1be5: "MASKMOVDQU", 0x570: "FCMOVBE",
238
+ 0x14b8: "VCMPLT_OQPD", 0xe2a: "VMAXSD", 0x142c: "VCMPNLTPD", 0x99d: "PREFETCHT2",
239
+ 0x991: "PREFETCHT1", 0x985: "PREFETCHT0", 0x8e4: "UNPCKLPD", 0xa57: "CVTTSS2SI",
240
+ 0x66e: "DIV", 0x1eb4: "PMOVSXDQ", 0x161d: "VCMPGESS", 0xef: "CDQE", 0x2708: "VSTMXCSR",
241
+ 0x549: "FISUBR", 0x1fc8: "VPMINSB", 0x2218: "VFMSUB213PS", 0x1326: "VCMPLT_OQPS",
242
+ 0x11d8: "CMPLESS", 0x1b14: "VPMINSW", 0x1c70: "FSTENV", 0x17af: "VCMPGESD",
243
+ 0x1dea: "VPTEST", 0x542: "FISUB", 0x205: "STD", 0xf29: "VPACKSSDW", 0x3d: "XOR",
244
+ 0xc95: "VMULPD", 0x1f1: "STC", 0x1fb: "STI", 0x26d8: "LDMXCSR", 0x1180: "CMPLTPD",
245
+ 0xbfd: "ORPS", 0x1f0c: "VPACKUSDW", 0x62b: "FSUBP", 0x67f: "STR", 0x41e: "FSUBR",
246
+ 0x1131: "CMPLTPS", 0x2323: "VFMADD231SD", 0x2733: "PAUSE", 0x1aa3: "CVTPD2DQ",
247
+ 0x372: "RSM", 0xb70: "VSQRTSD", 0xc09: "VORPS", 0x21a4: "VFMADDSUB213PS", 0x23e5: "AESENC",
248
+ 0x144d: "VCMPEQ_UQPD", 0x918: "VUNPCKHPS", 0x1d09: "PMADDUBSW", 0x136b: "VCMPNLE_UQPS",
249
+ 0x1b7e: "VPSLLW", 0x1bdb: "MASKMOVQ", 0x1c8: "CALL", 0xb67: "VSQRTSS", 0x19f2: "PADDUSB",
250
+ 0x1036: "VMREAD", 0x10eb: "XSAVEOPT64", 0x923: "VUNPCKHPD", 0xd5e: "VSUBPS",
251
+ 0xceb: "VCVTSS2SD", 0x242c: "VAESDECLAST", 0x1095: "HSUBPS", 0xaad: "VCVTSS2SI",
252
+ 0x25f2: "VPBLENDVB", 0x17b9: "VCMPGTSD", 0x58a: "FILD", 0xaf9: "VCOMISS", 0x108d: "HSUBPD",
253
+ 0x23b8: "VFNMSUB231SS", 0x1a53: "VPSRAD", 0x12a5: "VCMPNLEPS", 0x3e5: "SAL",
254
+ 0x214: "SYSCALL", 0xb95: "VRSQRTSS", 0x258f: "VPINSRQ", 0x26fe: "WRGSBASE",
255
+ 0xfc4: "VPSHUFD", 0x1e4b: "PMOVSXBW", 0x1a44: "VPSRAW", 0x1437: "VCMPNLEPD",
256
+ 0x3ff: "FADD", 0x3ea: "SAR", 0x713: "XEND", 0x2659: "AESKEYGENASSIST", 0xf1f: "PACKSSDW",
257
+ 0x21fe: "VFMADD213SS", 0xf90: "VMOVDQA", 0x8c5: "VMOVSLDUP", 0x508: "FRNDINT",
258
+ 0x1976: "PMULLW", 0xdcf: "DIVSD", 0xb0b: "MOVMSKPS", 0x202e: "VPMAXUW", 0xdde: "VDIVPD",
259
+ 0x1e55: "VPMOVSXBW", 0x1e9f: "PMOVSXWQ", 0x2048: "PMULLD", 0xf99: "VMOVDQU",
260
+ 0x22ae: "VFNMSUB213SD", 0x297: "CMOVAE", 0x14ab: "VCMPEQ_OSPD", 0xdd6: "VDIVPS",
261
+ 0x93: "JAE", 0xb15: "MOVMSKPD", 0xdc8: "DIVSS", 0x1cad: "FSAVE", 0x1eda: "PCMPEQQ",
262
+ 0xfd7: "VPSHUFLW", 0xff4: "PCMPEQW", 0x26eb: "VLDMXCSR", 0x211a: "VFMSUB132SS",
263
+ 0x11bc: "CMPORDPD", 0xba6: "RCPSS", 0x1b8d: "VPSLLD", 0x673: "IDIV", 0x1442: "VCMPORDPD",
264
+ 0xfe1: "PCMPEQB", 0x1007: "PCMPEQD", 0x1b9c: "VPSLLQ", 0x1f63: "VPMOVZXBQ",
265
+ 0x21d4: "VFMSUBADD213PD", 0x25e7: "VBLENDVPD", 0x116d: "CMPORDPS", 0xf34: "PUNPCKLQDQ",
266
+ 0x19eb: "VPAND", 0x147d: "VCMPNEQ_OQPD", 0x106b: "HADDPD", 0x192f: "VADDSUBPS",
267
+ 0x18e7: "VSHUFPD", 0xd76: "VSUBSD", 0xb55: "VSQRTPS", 0x947: "MOVSHDUP", 0x238e: "VFNMADD231SD",
268
+ 0x6cf: "VMLAUNCH", 0x1f23: "VMASKMOVPD", 0x1073: "HADDPS", 0x12eb: "VCMPNEQ_OQPS",
269
+ 0xe49: "PUNPCKLWD", 0x16c5: "VCMPNGT_UQSS", 0xb5e: "VSQRTPD", 0xd6e: "VSUBSS",
270
+ 0x18de: "VSHUFPS", 0x15b3: "VCMPNEQSS", 0x1b6f: "VLDDQU", 0x164a: "VCMPLT_OQSS",
271
+ 0x2740: "RDRAND", 0x1b39: "PADDSW", 0x1386: "VCMPEQ_USPS", 0xc03: "ORPD", 0x1a1f: "PANDN",
272
+ 0x4b6: "FPTAN", 0x551: "FIDIV", 0x17dc: "VCMPLT_OQSD", 0x2712: "VMPTRLD", 0x2330: "VFMSUB231PS",
273
+ 0x1745: "VCMPNEQSD", 0x1ed1: "VPMULDQ", 0x196: "LOOPNZ", 0x1282: "VCMPUNORDPS",
274
+ 0x3e0: "SHR", 0x37c: "SHRD", 0x6eb: "MONITOR", 0x3ef: "XABORT", 0x23f6: "AESENCLAST",
275
+ 0x854: "MOVSD", 0x18b4: "VPINSRW", 0x729: "VMLOAD", 0x92e: "MOVLHPS", 0x8bc: "VMOVLPD",
276
+ 0x1987: "MOVQ2DQ", 0xb45: "SQRTSS", 0x259e: "VDPPS", 0xd50: "SUBSS", 0x3ab: "MOVSX",
277
+ 0x951: "VMOVLHPS", 0x8b3: "VMOVLPS", 0xf13: "VPUNPCKHDQ", 0x1ac4: "VCVTPD2DQ",
278
+ 0x3db: "SHL", 0x84d: "MOVSS", 0x257e: "PINSRQ", 0x797: "PFNACC", 0xf88: "MOVDQU",
279
+ 0x80: "OUTS", 0x1bfe: "PSUBB", 0x377: "BTS", 0x390: "BTR", 0x1805: "VCMPNEQ_USSD",
280
+ 0x69b: "SGDT", 0x2316: "VFMADD231SS", 0x511: "FSCALE", 0x1c0d: "PSUBW", 0x11a8: "CMPNLTPD",
281
+ 0x1f02: "PACKUSDW", 0x20a: "LAR", 0x3a6: "BTC", 0x215e: "VFNMADD132SD", 0x1465: "VCMPNGTPD",
282
+ 0x1f39: "VPMOVZXBW", 0x2127: "VFMSUB132SD", 0x23d4: "AESIMC", 0x40b: "FCOM",
283
+ 0x1f4e: "VPMOVZXBD", 0x1924: "VADDSUBPD", 0x1c9e: "FINIT", 0x120b: "CMPORDSS",
284
+ 0x231: "WBINVD", 0x19e5: "PAND", 0x24e1: "VPALIGNR", 0x125a: "CMPORDSD", 0x1b61: "VPXOR",
285
+ 0xa1: "JBE", 0x46f: "FXAM", 0x10e1: "XSAVEOPT", 0x669: "MUL", 0x19dc: "VPMINUB",
286
+ 0x1b41: "VPADDSW", 0x1b4a: "PMAXSW", 0x256b: "VINSERTPS", 0x13f6: "VCMPEQPD",
287
+ 0x5f7: "FFREE", 0x1f17: "VMASKMOVPS", 0x18f0: "CMPXCHG8B", 0x2015: "PMAXSD",
288
+ 0x1b30: "VPADDSB", 0x10: "PUSH", 0x25d0: "VPCLMULQDQ", 0x1264: "VCMPEQPS",
289
+ 0x7f0: "PFRSQIT1", 0x2453: "ROUNDPS", 0x2ff: "SETNO", 0x6fb: "XGETBV", 0x1fd1: "PMINSD",
290
+ 0x1c3a: "PADDB", 0x4ce: "FPREM1", 0x200: "CLD", 0x52c: "FIMUL", 0xc1e: "XORPD",
291
+ 0x1ec: "CLC", 0x43c: "FSTP", 0x24b2: "BLENDPD", 0x1a05: "PADDUSW", 0x1c96: "FNINIT",
292
+ 0x319: "SETNZ", 0x1967: "PADDQ", 0xc17: "XORPS", 0x22a0: "VFNMSUB213SS", 0x333: "SETNS",
293
+ 0x525: "FIADD", 0x340: "SETNP", 0xf59: "VPUNPCKHQDQ", 0xd42: "SUBPS", 0x1246: "CMPNLTSD",
294
+ 0x684: "LLDT", 0x223f: "VFMSUB213SD", 0x1de3: "PTEST", 0x217a: "VFNMSUB132PD",
295
+ 0x279: "GETSEC", 0x1d7f: "VPSIGND", 0x1ab: "JCXZ", 0x11f7: "CMPNLTSS", 0x34d: "SETGE",
296
+ 0x1128: "CMPEQPS", 0x1bca: "PSADBW", 0x272b: "MOVSXD", 0x216c: "VFNMSUB132PS",
297
+ 0x185: "AAD", 0x2402: "VAESENCLAST", 0xf4d: "PUNPCKHQDQ", 0x88e: "MOVLPD",
298
+ 0x19fb: "VPADDUSW", 0x12de: "VCMPFALSEPS", 0x180: "AAM", 0xf40: "VPUNPCKLQDQ",
299
+ 0xd8c: "MINSS", 0x1c58: "PADDD", 0x1470: "VCMPFALSEPD", 0xe54: "VPUNPCKLWD",
300
+ 0x886: "MOVLPS", 0x73f: "CLGI", 0x4c: "AAS", 0x139: "LODS", 0x2d3: "CMOVNP",
301
+ 0xd93: "MINSD", 0x1f6: "CLI", 0xa62: "CVTTSD2SI", 0x533: "FICOM", 0x1f2f: "PMOVZXBW",
302
+ 0xc3c: "ADDPD", 0x770: "PREFETCHW", 0x134f: "VCMPNEQ_USPS", 0xc2d: "VXORPD",
303
+ 0x1b1d: "POR", 0x16: "POP", 0x2447: "VPERM2F128", 0x19e: "LOOPZ", 0x1ad7: "MOVNTDQ",
304
+ 0x1dc: "INT1", 0x382: "CMPXCHG", 0x1e0e: "VBROADCASTF128", 0x1525: "VCMPNGE_UQPD",
305
+ 0x1cd4: "PHADDW", 0xc25: "VXORPS", 0x14e1: "VCMPNEQ_USPD", 0xc35: "ADDPS",
306
+ 0x812: "PFMUL", 0x6a7: "LGDT", 0x68f: "VERR", 0x695: "VERW", 0x109d: "VHSUBPD",
307
+ 0x197e: "VPMULLW", 0x85b: "VMOVUPS", 0x174: "INTO", 0x1c8f: "FCLEX", 0x10a6: "VHSUBPS",
308
+ 0xccb: "CVTSD2SS", 0x48b: "FLDPI", 0x1e2d: "PABSW", 0xe1a: "VMAXPD", 0x1d3: "JMP FAR",
309
+ 0xecf: "VPACKUSWB", 0x581: "FUCOMPP", 0x864: "VMOVUPD", 0x82c: "PSWAPD", 0x1c49: "PADDW",
310
+ 0x1b86: "PSLLD", 0x756: "SWAPGS", 0x896: "MOVSLDUP", 0x9df: "CVTSI2SS", 0x17c3: "VCMPTRUESD",
311
+ 0x11e1: "CMPUNORDSS", 0xd36: "VCVTTPS2DQ", 0xb4d: "SQRTSD", 0x1e00: "VBROADCASTSD",
312
+ 0x1c1c: "PSUBD", 0xce: "TEST", 0x39a: "LGS", 0x1631: "VCMPTRUESS", 0x266: "SYSENTER",
313
+ 0x9e9: "CVTSI2SD", 0x175b: "VCMPNLESD", 0x1dbc: "VTESTPD", 0x98: "JZ", 0xde6: "VDIVSS",
314
+ 0xc10: "VORPD", 0xb3: "JP", 0xaa: "JS", 0xbc: "JL", 0xb82: "RSQRTSS", 0x1db3: "VTESTPS",
315
+ 0x86: "JO", 0xe12: "VMAXPS", 0x19ae: "PSUBUSB", 0xca: "JG", 0x1df2: "VBROADCASTSS",
316
+ 0xa6: "JA", 0x8f: "JB", 0xe9: "CWDE", 0x140a: "VCMPLEPD", 0x104e: "VMWRITE",
317
+ 0x1278: "VCMPLEPS", 0x1999: "PMOVMSKB", 0x2561: "INSERTPS", 0x2614: "PCMPESTRI",
318
+ 0x273a: "WAIT", 0x1541: "VCMPFALSE_OSPD", 0x25fd: "PCMPESTRM", 0xe60: "PUNPCKLDQ",
319
+ 0xc7f: "MULSS", 0xd66: "VSUBPD", 0x1177: "CMPEQPD", 0x17a1: "VCMPNEQ_OQSD",
320
+ 0xb02: "VCOMISD", 0xdaa: "VMINSS", 0x1c5f: "VPADDD", 0x258: "RDMSR", 0x1d6e: "VPSIGNW",
321
+ 0x1b1: "JECXZ", 0xc86: "MULSD", 0x154: "ENTER", 0x2439: "MOVBE", 0x102c: "VZEROALL",
322
+ 0x2748: "_3DNOW", 0xdb2: "VMINSD", 0x160f: "VCMPNEQ_OQSS", 0x7fa: "PFSUBR",
323
+ 0x12f9: "VCMPGEPS", 0x19b7: "VPSUBUSB", 0x2357: "VFMSUB231SD", 0x2037: "PMAXUD",
324
+ 0x269e: "FXSAVE", 0x590: "FISTTP", 0x148b: "VCMPGEPD", 0x249f: "BLENDPS", 0x172e: "VCMPLESD",
325
+ 0x5b7: "FCMOVNBE", 0x234a: "VFMSUB231SS", 0x25dc: "VBLENDVPS", 0x25bb: "VMPSADBW",
326
+ 0x19ca: "VPSUBUSW", 0x1724: "VCMPLTSD", 0x1eed: "MOVNTDQA", 0x18d6: "SHUFPD",
327
+ 0xd49: "SUBPD", 0xb3d: "SQRTPD", 0x964: "VMOVHPD", 0x6c7: "VMCALL", 0x20d9: "VFMADD132PD",
328
+ 0x15b: "LEAVE", 0x18ce: "SHUFPS", 0x1319: "VCMPEQ_OSPS", 0x261f: "VPCMPESTRI",
329
+ 0x1592: "VCMPLTSS", 0x2608: "VPCMPESTRM", 0x20cc: "VFMADD132PS", 0x6ad: "LIDT",
330
+ 0x4a8: "F2XM1", 0x95b: "VMOVHPS", 0x1f98: "PMOVZXDQ", 0x1020: "VZEROUPPER",
331
+ 0xb35: "SQRTPS", 0xbeb: "VANDNPS", 0x196e: "VPADDQ", 0x4e8: "FPREM", 0x1c50: "VPADDW",
332
+ 0x24d8: "PALIGNR", 0x1fc0: "PMINSB", 0xe9f: "PCMPGTW", 0x36c: "SHLD", 0x14f: "LDS",
333
+ 0x1c41: "VPADDB", 0x719: "VMRUN", 0x26b0: "RDFSBASE", 0xbf4: "VANDNPD", 0x190: "XLAT",
334
+ 0xd4: "XCHG", 0x4df: "FINCSTP", 0x1990: "MOVDQ2Q", 0x1b0c: "PMINSW", 0x6b3: "SMSW",
335
+ 0x1d5d: "VPSIGNB", 0x10c7: "XRSTOR", 0x24bb: "VBLENDPD", 0xc0: "JGE", 0x135d: "VCMPNLT_UQPS",
336
+ 0x1766: "VCMPORDSD", 0x24a8: "VBLENDPS", 0x469: "FTST", 0x1a8e: "CVTTPD2DQ",
337
+ 0x15d4: "VCMPORDSS", 0x14ef: "VCMPNLT_UQPD", 0x2188: "VFNMSUB132SS", 0x10cf: "XRSTOR64",
338
+ 0x29: "AND", 0xb8b: "VRSQRTPS", 0x10ff: "CLFLUSH", 0x1cc3: "PSHUFB", 0x442: "FLDENV",
339
+ 0xda: "MOV", 0xfaa: "PSHUFD", 0xc5: "JLE", 0x5d0: "FEDISI", 0x70b: "VMFUNC",
340
+ 0xea8: "VPCMPGTW", 0x809: "PFCMPEQ", 0x169d: "VCMPORD_SSS", 0xfa2: "PSHUFW",
341
+ 0x24f3: "VPEXTRB", 0x1ab9: "VCVTDQ2PD", 0xf79: "VMOVQ", 0x483: "FLDL2E", 0x250c: "VPEXTRD",
342
+ 0x1d28: "VPHSUBW", 0x2284: "VFNMSUB213PS", 0x21f1: "VFMADD213PD", 0x739: "STGI",
343
+ 0x4bd: "FPATAN", 0x2515: "VPEXTRQ", 0x437: "FST", 0x168: "INT 3", 0x598: "FIST",
344
+ 0x271b: "VMCLEAR", 0x1e75: "PMOVSXBQ", 0x42: "AAA", 0x1d39: "VPHSUBD", 0xa41: "CVTTPS2PI",
345
+ 0x114f: "CMPNEQPS", 0x155f: "VCMPGE_OQPD", 0x1b68: "LDDQU", 0xb79: "RSQRTPS",
346
+ 0xc59: "VADDPD", 0x7b8: "PFRCP", 0xcc1: "CVTSS2SD", 0x2196: "VFNMSUB132SD",
347
+ 0x632: "FDIVRP", 0x641: "FBLD", 0x361: "CPUID", 0x251: "RDTSC", 0x24ce: "VPBLENDW",
348
+ 0xd2b: "VCVTPS2DQ", 0x1b22: "VPOR", 0xc51: "VADDPS", 0x77b: "PI2FW", 0xd7e: "MINPS",
349
+ 0x17cf: "VCMPEQ_OSSD", 0x1bad: "VPMULUDQ", 0xe0b: "MAXSD", 0x2050: "VPMULLD",
350
+ 0x558: "FIDIVR", 0xad5: "VUCOMISS", 0x8a0: "MOVDDUP", 0x1ccb: "VPSHUFB", 0x1d42: "PHSUBSW",
351
+ 0x264d: "VPCMPISTRI", 0xe04: "MAXSS", 0x1a35: "VPAVGB", 0x16d3: "VCMPFALSE_OSSS",
352
+ 0xd85: "MINPD", 0x4ef: "FYL2XP1", 0xadf: "VUCOMISD", 0x23aa: "VFNMSUB231PD",
353
+ 0x1849: "VCMPNGE_UQSD", 0xc4a: "ADDSD", 0x6e3: "VMXOFF", 0x1958: "PSRLQ", 0x128f: "VCMPNEQPS",
354
+ 0x193a: "PSRLW", 0x1a4c: "PSRAD", 0x6a1: "SIDT", 0xe77: "PACKSSWB", 0x10af: "XSAVE",
355
+ 0x1421: "VCMPNEQPD", 0xfa: "CDQ", 0xc43: "ADDSS", 0x16b7: "VCMPNGE_UQSS", 0x2440: "CRC32",
356
+ 0x23dc: "VAESIMC", 0x2004: "PMAXSB", 0x2529: "VEXTRACTPS", 0x1813: "VCMPNLT_UQSD",
357
+ 0x1c05: "VPSUBB", 0x1f8d: "VPMOVZXWQ", 0x13bf: "VCMPNEQ_OSPS", 0xa1b: "MOVNTSS",
358
+ 0x2542: "VEXTRACTF128", 0x1b28: "PADDSB", 0x75: "IMUL", 0x3d6: "RCR", 0x14d2: "VCMPUNORD_SPD",
359
+ 0x3d1: "RCL", 0xa24: "MOVNTSD", 0x1551: "VCMPNEQ_OSPD", 0x1681: "VCMPNLT_UQSS",
360
+ 0xd57: "SUBSD", 0x13f: "SCAS", 0x25c5: "PCLMULQDQ", 0x7bf: "PFRSQRT", 0x2576: "PINSRD",
361
+ 0x623: "FSUBRP", 0x5b: "PUSHA", 0x1a16: "VPMAXUB", 0x1143: "CMPUNORDPS", 0x203f: "VPMAXUD",
362
+ 0x463: "FABS", 0x1e7f: "VPMOVSXBQ", 0x149f: "VCMPTRUEPD", 0x23e: "FEMMS", 0x163d: "VCMPEQ_OSSS",
363
+ 0x220b: "VFMADD213SD", 0x1e6a: "VPMOVSXBD", 0x1192: "CMPUNORDPD", 0x1907: "VMPTRST",
364
+ 0x18fb: "CMPXCHG16B", 0x130d: "VCMPTRUEPS", 0x12d3: "VCMPNGTPS", 0x1c87: "FNCLEX",
365
+ 0x123c: "CMPNEQSD", 0x1771: "VCMPEQ_UQSD", 0x579: "FCMOVU", 0x103e: "EXTRQ",
366
+ 0x25a5: "DPPD", 0x2e2: "CMOVGE", 0x2550: "PINSRB", 0x15df: "VCMPEQ_UQSS", 0x1d14: "VPMADDUBSW",
367
+ 0x11ed: "CMPNEQSS", 0x2309: "VFMADD231PD", 0x519: "FSIN", 0x1bf: "IN", 0x568: "FCMOVE",
368
+ 0x44a: "FLDCW", 0x2598: "DPPS", 0x560: "FCMOVB", 0x1941: "VPSRLW", 0x10bf: "LFENCE",
369
+ 0xaa3: "CVTSD2SI", 0x30c: "SETAE", 0x2a6: "CMOVNZ", 0x195f: "VPSRLQ", 0x614: "FMULP",
370
+ 0x9c2: "VMOVAPD", 0x1657: "VCMPLE_OQSS", 0x2c4: "CMOVNS", 0x5ae: "FCMOVNE",
371
+ 0x288: "CMOVNO", 0x1a85: "VPMULHW", 0x1950: "VPSRLD", 0x1061: "CVTPS2PH", 0xa85: "CVTPS2PI",
372
+ 0x1ce5: "PHADDD", 0xcad: "CVTPS2PD", 0x1e34: "VPABSW", 0x17e9: "VCMPLE_OQSD",
373
+ 0x9b9: "VMOVAPS", 0x1c14: "VPSUBW", 0x823: "PMULHRW", 0x9a9: "MOVAPS", 0x7b1: "PFMIN",
374
+ 0xf66: "MOVD", 0x937: "MOVHPS", 0xc71: "MULPS", 0x126e: "VCMPLTPS", 0x368: "BT",
375
+ 0x9b1: "MOVAPD", 0x1393: "VCMPNGE_UQPS", 0x1b8: "JRCXZ", 0xc78: "MULPD", 0x127: "MOVS",
376
+ 0x6bf: "INVLPG", 0xf6c: "MOVQ", 0xda2: "VMINPD", 0x1e3c: "PABSD", 0x11b: "SAHF",
377
+ 0x13e7: "VCMPTRUE_USPS", 0x782: "PI2FD", 0x1e1e: "PABSB", 0x2495: "VROUNDSD",
378
+ 0x1a26: "VPANDN", 0xe6b: "VPUNPCKLDQ", 0x63a: "FDIVP", 0x1c2b: "PSUBQ", 0x42b: "FDIVR",
379
+ 0x425: "FDIV", 0x1579: "VCMPTRUE_USPD", 0x766: "PREFETCH", 0x101a: "EMMS",
380
+ 0xd9a: "VMINPS", 0x22fc: "VFMADD231PS", 0x2292: "VFNMSUB213PD", 0xa99: "CVTSS2SI",
381
+ 0x93f: "MOVHPD", 0x29f: "CMOVZ", 0x1a62: "VPAVGW", 0xff: "CQO", 0x1c23: "VPSUBD",
382
+ 0x2cc: "CMOVP", 0x1588: "VCMPEQSS", 0x2bd: "CMOVS", 0x1e60: "PMOVSXBD", 0x2482: "VROUNDSS",
383
+ 0x1c32: "VPSUBQ", 0x2db: "CMOVL", 0x191a: "ADDSUBPS", 0x281: "CMOVO", 0x2b6: "CMOVA",
384
+ 0x290: "CMOVB", 0xeda: "PUNPCKHBW", 0x2642: "PCMPISTRI", 0x2f2: "CMOVG", 0x19a3: "VPMOVMSKB",
385
+ 0x2420: "AESDECLAST", 0x845: "MOVUPD", 0x20bc: "VFMSUBADD132PD", 0x1bd2: "VPSADBW",
386
+ 0x3f7: "XBEGIN", 0x246f: "VROUNDPD", 0x6b9: "LMSW", 0x2072: "INVEPT", 0x39f: "MOVZX",
387
+ 0xbbd: "ANDPS", 0x20ac: "VFMSUBADD132PS", 0x83d: "MOVUPS", 0x1627: "VCMPGTSS",
388
+ 0x1a6a: "PMULHUW", 0x25ab: "VDPPD", 0x24fc: "PEXTRD", 0x1602: "VCMPFALSESS",
389
+ 0x26ce: "RDGSBASE", 0x1b: "OR", 0x18c5: "VPEXTRW", 0x1af2: "VPSUBSB", 0x26ba: "FXRSTOR",
390
+ 0x21d: "CLTS", 0x1857: "VCMPNGT_UQSD", 0x15f7: "VCMPNGTSS", 0x5ef: "FRSTOR",
391
+ 0x1794: "VCMPFALSESD", 0x49a: "FLDLN2", 0x2535: "VINSERTF128", 0x1b03: "VPSUBSW",
392
+ 0x1ba4: "PMULUDQ", 0x56: "DEC", 0x13af: "VCMPFALSE_OSPS", 0x432: "FLD", 0x1fa2: "VPMOVZXDQ",
393
+ 0x2479: "ROUNDSS", 0x9f3: "VCVTSI2SS", 0x18bd: "PEXTRW", 0x26a6: "FXSAVE64",
394
+ 0x3c7: "ROL", 0x20f3: "VFMADD132SD", 0x1189: "CMPLEPD", 0xcf6: "VCVTSD2SS",
395
+ 0x605: "FUCOMP", 0x1ce: "JMP", 0x171a: "VCMPEQSD", 0xd01: "CVTDQ2PS", 0x16fe: "VCMPGT_OQSS",
396
+ 0x5e0: "FUCOMI", 0x1121: "LZCNT", 0xbad: "VRCPPS", 0x1a0e: "PMAXUB", 0x1ced: "VPHADDD",
397
+ 0x9fe: "VCVTSI2SD", 0x1890: "VCMPGT_OQSD", 0x3cc: "ROR", 0x22b: "INVD", 0xab8: "VCVTSD2SI",
398
+ 0x240f: "AESDEC", 0x1250: "CMPNLESD", 0x354: "SETLE", 0x22dc: "VFMSUBADD231PS",
399
+ 0x2364: "VFNMADD231PS", 0x10b6: "XSAVE64", 0xef1: "PUNPCKHWD", 0x1e94: "VPMOVSXWD",
400
+ 0xcb7: "CVTPD2PS", 0x8a9: "VMOVHLPS", 0x22ec: "VFMSUBADD231PD", 0xa8f: "CVTPD2PI",
401
+ 0x1201: "CMPNLESS", 0x1ec9: "PMULDQ", 0x1ea9: "VPMOVSXWQ", 0x1750: "VCMPNLTSD",
402
+ 0x2100: "VFMSUB132PS", 0x2372: "VFNMADD231PD", 0x1cbc: "FSTSW", 0x75e: "RDTSCP",
403
+ 0x10d9: "MFENCE", 0x20e6: "VFMADD132SS", 0x1ff3: "PMINUD", 0x5ca: "FENI", 0x68: "BOUND",
404
+ 0x245c: "VROUNDPS", 0xfbb: "PSHUFLW", 0xc9d: "VMULSS", 0x1865: "VCMPFALSE_OSSD",
405
+ 0xd20: "VCVTDQ2PS", 0x159c: "VCMPLESS", 0x457: "FNOP", 0x1159: "CMPNLTPS",
406
+ 0x129a: "VCMPNLTPS", 0x492: "FLDLG2", 0x223: "SYSRET", 0x1c80: "FSTCW", 0x2232: "VFMSUB213SS",
407
+ 0x745: "SKINIT", 0xbd3: "VANDPD", 0x4a2: "FLDZ", 0x33: "SUB", 0x1cdc: "VPHADDW",
408
+ 0x664: "NEG", 0x1fe2: "PMINUW", 0xdfd: "MAXPD", 0x1379: "VCMPORD_SPS", 0x133: "STOS",
409
+ 0x23c6: "VFNMSUB231SD", 0x1738: "VCMPUNORDSD", 0x834: "PAVGUSB", 0x150b: "VCMPORD_SPD",
410
+ 0xdf6: "MAXPS", 0x19d4: "PMINUB", 0x1bf1: "VMASKMOVDQU", 0x647: "FBSTP", 0x18ac: "PINSRW",
411
+ 0x1f78: "VPMOVZXWD", 0x1fea: "VPMINUW", 0x1821: "VCMPNLE_UQSD", 0x18a: "SALC",
412
+ 0x24eb: "PEXTRB", 0x8ee: "VUNPCKLPS", 0x168f: "VCMPNLE_UQSS", 0xf80: "MOVDQA",
413
+ 0x15be: "VCMPNLTSS", 0x1b95: "PSLLQ", 0xa2d: "VMOVNTPS", 0x1ffb: "VPMINUD",
414
+ 0x978: "PREFETCHNTA", 0x8f9: "VUNPCKLPD", 0x1057: "CVTPH2PS", 0x266a: "VAESKEYGENASSIST",
415
+ 0x1afb: "PSUBSW", 0x177e: "VCMPNGESD", 0x1c67: "FNSTENV", 0x1cb4: "FNSTSW",
416
+ 0x119e: "CMPNEQPD", 0x1a5b: "PAVGW", 0xa12: "MOVNTPD", 0x1518: "VCMPEQ_USPD",
417
+ 0x5d8: "FSETPM", 0x1dcf: "BLENDVPS", 0x21b4: "VFMADDSUB213PD", 0xb: "ADD",
418
+ 0x15ec: "VCMPNGESS", 0x1f: "ADC", 0x1aea: "PSUBSB", 0x1dd9: "BLENDVPD", 0xee5: "VPUNPCKHBW",
419
+ 0x25f: "RDPMC", 0xa09: "MOVNTPS", 0x1110: "BSF", 0x1400: "VCMPLTPD", 0x1a2e: "PAVGB",
420
+ 0xdf: "LEA", 0x1aad: "VCVTTPD2DQ", 0xe95: "VPCMPGTB", 0xebb: "VPCMPGTD", 0x475: "FLD1",
421
+ 0x1bc0: "VPMADDWD", 0x17f6: "VCMPUNORD_SSD", 0x14a: "LES", 0x313: "SETZ", 0x1fb6: "VPCMPGTQ",
422
+ 0xca5: "VMULSD", 0x21e4: "VFMADD213PS", 0x15c9: "VCMPNLESS", 0x87d: "MOVHLPS",
423
+ 0x2065: "VPHMINPOSUW", 0x1e43: "VPABSD", 0x1a3d: "PSRAW", 0x7cf: "PFADD", 0x209c: "VFMADDSUB132PD",
424
+ 0xaf1: "COMISD", 0x13cd: "VCMPGE_OQPS", 0xe22: "VMAXSS", 0x1230: "CMPUNORDSD",
425
+ 0x4ff: "FSINCOS", 0xae9: "COMISS", 0x208c: "VFMADDSUB132PS", 0xb9f: "RCPPS",
426
+ 0x2142: "VFNMADD132PD", 0x451: "FXCH", 0x2e: "DAA", 0x320: "SETBE", 0xcd5: "VCVTPS2PD",
427
+ 0x1bb7: "PMADDWD", 0xbc4: "ANDPD", 0x1333: "VCMPLE_OQPS", 0x1789: "VCMPNGTSD",
428
+ 0x239c: "VFNMSUB231PS", 0x64e: "FUCOMIP", 0xc8d: "VMULPS", 0x2134: "VFNMADD132PS",
429
+ 0x26e1: "WRFSBASE", 0x38: "DAS", 0x14c5: "VCMPLE_OQPD", 0x17a: "IRET", 0x3c0: "BSWAP",
430
+ 0xe32: "PUNPCKLBW", 0x2026: "PMAXUW", 0x2636: "VPCMPISTRM", 0x1b77: "PSLLW",
431
+ 0x1664: "VCMPUNORD_SSS", 0x224c: "VFNMADD213PS", 0xa79: "VCVTTSD2SI", 0x233d: "VFMSUB231PD",
432
+ 0x13a1: "VCMPNGT_UQPS", 0x1c78: "FNSTCW", 0x248c: "ROUNDSD", 0x11b2: "CMPNLEPD",
433
+ 0x2504: "PEXTRQ", 0x1a7d: "PMULHW", 0x1cff: "VPHADDSW", 0x59e: "FISTP", 0x1f83: "PMOVZXWQ",
434
+ 0xce0: "VCVTPD2PS", 0x170b: "VCMPTRUE_USSS", 0xc69: "VADDSD", 0x1dc5: "PBLENDVB",
435
+ 0x6d9: "VMRESUME", 0xacc: "UCOMISD", 0x1f6e: "PMOVZXWD", 0xa4c: "CVTTPD2PI",
436
+ 0xac3: "UCOMISS", 0xe81: "VPACKSSWB", 0xc61: "VADDSS", 0xfb2: "PSHUFHW", 0x189d: "VCMPTRUE_USSD",
437
+ 0x6f4: "MWAIT"
438
+ }
439
+
440
+ Registers = ["RAX", "RCX", "RDX", "RBX", "RSP", "RBP", "RSI", "RDI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15",
441
+ "EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", "EDI", "R8D", "R9D", "R10D", "R11D", "R12D", "R13D", "R14D", "R15D",
442
+ "AX", "CX", "DX", "BX", "SP", "BP", "SI", "DI", "R8W", "R9W", "R10W", "R11W", "R12W", "R13W", "R14W", "R15W",
443
+ "AL", "CL", "DL", "BL", "AH", "CH", "DH", "BH", "R8B", "R9B", "R10B", "R11B", "R12B", "R13B", "R14B", "R15B",
444
+ "SPL", "BPL", "SIL", "DIL",
445
+ "ES", "CS", "SS", "DS", "FS", "GS",
446
+ "RIP",
447
+ "ST0", "ST1", "ST2", "ST3", "ST4", "ST5", "ST6", "ST7",
448
+ "MM0", "MM1", "MM2", "MM3", "MM4", "MM5", "MM6", "MM7",
449
+ "XMM0", "XMM1", "XMM2", "XMM3", "XMM4", "XMM5", "XMM6", "XMM7", "XMM8", "XMM9", "XMM10", "XMM11", "XMM12", "XMM13", "XMM14", "XMM15",
450
+ "YMM0", "YMM1", "YMM2", "YMM3", "YMM4", "YMM5", "YMM6", "YMM7", "YMM8", "YMM9", "YMM10", "YMM11", "YMM12", "YMM13", "YMM14", "YMM15",
451
+ "CR0", "", "CR2", "CR3", "CR4", "", "", "", "CR8",
452
+ "DR0", "DR1", "DR2", "DR3", "", "", "DR6", "DR7"]
453
+
454
+ # Special case
455
+ R_NONE = 0xFF # -1 in uint8
456
+
457
+ FLAGS = [
458
+ # The instruction locks memory access.
459
+ "FLAG_LOCK",
460
+ # The instruction is prefixed with a REPNZ.
461
+ "FLAG_REPNZ",
462
+ # The instruction is prefixed with a REP, this can be a REPZ, it depends on the specific instruction.
463
+ "FLAG_REP",
464
+ # Indicates there is a hint taken for Jcc instructions only.
465
+ "FLAG_HINT_TAKEN",
466
+ # Indicates there is a hint non-taken for Jcc instructions only.
467
+ "FLAG_HINT_NOT_TAKEN",
468
+ # The Imm value is signed extended.
469
+ "FLAG_IMM_SIGNED",
470
+ # The destination operand is writable.
471
+ "FLAG_DST_WR",
472
+ # The instruction uses the RIP-relative indirection.
473
+ "FLAG_RIP_RELATIVE"
474
+ ]
475
+
476
+ # Instruction could not be disassembled. Special-case handling
477
+ FLAG_NOT_DECODABLE = 0xFFFF # -1 in uint16
478
+ # Some features
479
+ DF_NONE = 0
480
+ DF_MAXIMUM_ADDR16 = 1
481
+ DF_MAXIMUM_ADDR32 = 2
482
+ DF_RETURN_FC_ONLY = 4
483
+ # Flow control flags
484
+ DF_STOP_ON_CALL = 0x8
485
+ DF_STOP_ON_RET = 0x10
486
+ DF_STOP_ON_SYS = 0x20
487
+ DF_STOP_ON_UNC_BRANCH = 0x40
488
+ DF_STOP_ON_CND_BRANCH = 0x80
489
+ DF_STOP_ON_INT = 0x100
490
+ DF_STOP_ON_CMOV = 0x200
491
+ DF_STOP_ON_FLOW_CONTROL = (DF_STOP_ON_CALL | DF_STOP_ON_RET | DF_STOP_ON_SYS | \
492
+ DF_STOP_ON_UNC_BRANCH | DF_STOP_ON_CND_BRANCH | DF_STOP_ON_INT | DF_STOP_ON_CMOV)
493
+
494
+ def DecodeGenerator(codeOffset, code, dt):
495
+ """
496
+ @type codeOffset: long
497
+ @param codeOffset: Memory address where the code is located.
498
+ This is B{not} an offset into the code!
499
+ It's the actual memory address where it was read from.
500
+
501
+ @type code: str
502
+ @param code: Code to disassemble.
503
+
504
+ @type dt: int
505
+ @param dt: Disassembly type. Can be one of the following:
506
+
507
+ * L{Decode16Bits}: 80286 decoding
508
+
509
+ * L{Decode32Bits}: IA-32 decoding
510
+
511
+ * L{Decode64Bits}: AMD64 decoding
512
+
513
+ @rtype: generator of tuple( long, int, str, str )
514
+ @return: Generator of tuples. Each tuple represents an assembly instruction
515
+ and contains:
516
+ - Memory address of instruction.
517
+ - Size of instruction in bytes.
518
+ - Disassembly line of instruction.
519
+ - Hexadecimal dump of instruction.
520
+
521
+ @raise ValueError: Invalid arguments.
522
+ """
523
+
524
+ if not code:
525
+ return
526
+
527
+ if not codeOffset:
528
+ codeOffset = 0
529
+
530
+ if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
531
+ raise ValueError("Invalid decode type value: %r" % (dt,))
532
+
533
+ codeLen = len(code)
534
+ code_buf = create_string_buffer(code)
535
+ p_code = byref(code_buf)
536
+ result = (_DecodedInst * MAX_INSTRUCTIONS)()
537
+ p_result = byref(result)
538
+ instruction_off = 0
539
+
540
+ # Support cross Python compatibility
541
+ toUnicode = lambda s: s
542
+ spaceCh = b" "
543
+ if sys.version_info[0] >= 3:
544
+ if sys.version_info[1] > 0:
545
+ toUnicode = lambda s: s.decode()
546
+ else:
547
+ spaceCh = " "
548
+
549
+ while codeLen > 0:
550
+
551
+ usedInstructionsCount = c_uint(0)
552
+ status = internal_decode(_OffsetType(codeOffset), p_code, codeLen, dt, p_result, MAX_INSTRUCTIONS, byref(usedInstructionsCount))
553
+
554
+ if status == DECRES_INPUTERR:
555
+ raise ValueError("Invalid arguments passed to distorm_decode()")
556
+
557
+ used = usedInstructionsCount.value
558
+ if not used:
559
+ break
560
+
561
+ for index in xrange(used):
562
+ di = result[index]
563
+ asm = di.mnemonic.p
564
+ if len(di.operands.p):
565
+ asm += spaceCh + di.operands.p
566
+ pydi = (di.offset, di.size, toUnicode(asm), toUnicode(di.instructionHex.p))
567
+ instruction_off += di.size
568
+ yield pydi
569
+
570
+ di = result[used - 1]
571
+ delta = di.offset - codeOffset + result[used - 1].size
572
+ if delta <= 0:
573
+ break
574
+ codeOffset = codeOffset + delta
575
+ p_code = byref(code_buf, instruction_off)
576
+ codeLen = codeLen - delta
577
+
578
+ def Decode(offset, code, type = Decode32Bits):
579
+ """
580
+ @type offset: long
581
+ @param offset: Memory address where the code is located.
582
+ This is B{not} an offset into the code!
583
+ It's the actual memory address where it was read from.
584
+
585
+ @type code: str
586
+ @param code: Code to disassemble.
587
+
588
+ @type type: int
589
+ @param type: Disassembly type. Can be one of the following:
590
+
591
+ * L{Decode16Bits}: 80286 decoding
592
+
593
+ * L{Decode32Bits}: IA-32 decoding
594
+
595
+ * L{Decode64Bits}: AMD64 decoding
596
+
597
+ @rtype: list of tuple( long, int, str, str )
598
+ @return: List of tuples. Each tuple represents an assembly instruction
599
+ and contains:
600
+ - Memory address of instruction.
601
+ - Size of instruction in bytes.
602
+ - Disassembly line of instruction.
603
+ - Hexadecimal dump of instruction.
604
+
605
+ @raise ValueError: Invalid arguments.
606
+ """
607
+ return list(DecodeGenerator(offset, code, type))
608
+
609
+ OPERAND_NONE = ""
610
+ OPERAND_IMMEDIATE = "Immediate"
611
+ OPERAND_REGISTER = "Register"
612
+
613
+ # the operand is a memory address
614
+ OPERAND_ABSOLUTE_ADDRESS = "AbsoluteMemoryAddress" # The address calculated is absolute
615
+ OPERAND_MEMORY = "AbsoluteMemory" # The address calculated uses registers expression
616
+ OPERAND_FAR_MEMORY = "FarMemory" # like absolute but with selector/segment specified too
617
+
618
+ InstructionSetClasses = [
619
+ "ISC_UNKNOWN",
620
+ # Indicates the instruction belongs to the General Integer set.
621
+ "ISC_INTEGER",
622
+ # Indicates the instruction belongs to the 387 FPU set.
623
+ "ISC_FPU",
624
+ # Indicates the instruction belongs to the P6 set.
625
+ "ISC_P6",
626
+ # Indicates the instruction belongs to the MMX set.
627
+ "ISC_MMX",
628
+ # Indicates the instruction belongs to the SSE set.
629
+ "ISC_SSE",
630
+ # Indicates the instruction belongs to the SSE2 set.
631
+ "ISC_SSE2",
632
+ # Indicates the instruction belongs to the SSE3 set.
633
+ "ISC_SSE3",
634
+ # Indicates the instruction belongs to the SSSE3 set.
635
+ "ISC_SSSE3",
636
+ # Indicates the instruction belongs to the SSE4.1 set.
637
+ "ISC_SSE4_1",
638
+ # Indicates the instruction belongs to the SSE4.2 set.
639
+ "ISC_SSE4_2",
640
+ # Indicates the instruction belongs to the AMD's SSE4.A set.
641
+ "ISC_SSE4_A",
642
+ # Indicates the instruction belongs to the 3DNow! set.
643
+ "ISC_3DNOW",
644
+ # Indicates the instruction belongs to the 3DNow! Extensions set.
645
+ "ISC_3DNOWEXT",
646
+ # Indicates the instruction belongs to the VMX (Intel) set.
647
+ "ISC_VMX",
648
+ # Indicates the instruction belongs to the SVM (AMD) set.
649
+ "ISC_SVM",
650
+ # Indicates the instruction belongs to the AVX (Intel) set.
651
+ "ISC_AVX",
652
+ # Indicates the instruction belongs to the FMA (Intel) set.
653
+ "ISC_FMA",
654
+ # Indicates the instruction belongs to the AES/AVX (Intel) set.
655
+ "ISC_AES",
656
+ # Indicates the instruction belongs to the CLMUL (Intel) set.
657
+ "ISC_CLMUL",
658
+ ]
659
+
660
+ FlowControlFlags = [
661
+ # Indicates the instruction is not a flow-control instruction.
662
+ "FC_NONE",
663
+ # Indicates the instruction is one of: CALL, CALL FAR.
664
+ "FC_CALL",
665
+ # Indicates the instruction is one of: RET, IRET, RETF.
666
+ "FC_RET",
667
+ # Indicates the instruction is one of: SYSCALL, SYSRET, SYSENTER, SYSEXIT.
668
+ "FC_SYS",
669
+ # Indicates the instruction is one of: JMP, JMP FAR.
670
+ "FC_UNC_BRANCH",
671
+ # Indicates the instruction is one of:
672
+ # JCXZ, JO, JNO, JB, JAE, JZ, JNZ, JBE, JA, JS, JNS, JP, JNP, JL, JGE, JLE, JG, LOOP, LOOPZ, LOOPNZ.
673
+ "FC_CND_BRANCH",
674
+ # Indiciates the instruction is one of: INT, INT1, INT 3, INTO, UD2.
675
+ "FC_INT",
676
+ # Indicates the instruction is one of: CMOVxx.
677
+ "FC_CMOV"
678
+ ]
679
+
680
+ def _getOpSize(flags):
681
+ return ((flags >> 7) & 3)
682
+
683
+ def _getISC(metaflags):
684
+ realvalue = ((metaflags >> 3) & 0x1f)
685
+ return InstructionSetClasses[realvalue]
686
+
687
+ def _getFC(metaflags):
688
+ realvalue = (metaflags & 0x7)
689
+ try:
690
+ return FlowControlFlags[realvalue]
691
+ except IndexError:
692
+ print ("Bad meta-flags: {}".format(realvalue))
693
+ raise
694
+
695
+ def _getMnem(opcode):
696
+ return Mnemonics.get(opcode, "UNDEFINED")
697
+
698
+ def _unsignedToSigned64(val):
699
+ return int(val if val < 0x8000000000000000 else (val - 0x10000000000000000))
700
+
701
+ def _unsignedToSigned32(val):
702
+ return int(val if val < 0x80000000 else (val - 0x10000000))
703
+
704
+ if SUPPORT_64BIT_OFFSET:
705
+ _unsignedToSigned = _unsignedToSigned64
706
+ else:
707
+ _unsignedToSigned = _unsignedToSigned32
708
+
709
+ class Operand (object):
710
+ def __init__(self, type, *args):
711
+ self.type = type
712
+ self.index = None
713
+ self.name = ""
714
+ self.size = 0
715
+ self.value = 0
716
+ self.disp = 0
717
+ self.dispSize = 0
718
+ self.base = 0
719
+ self.segment = 0
720
+ if type == OPERAND_IMMEDIATE:
721
+ self.value = int(args[0])
722
+ self.size = args[1]
723
+ elif type == OPERAND_REGISTER:
724
+ self.index = args[0]
725
+ self.size = args[1]
726
+ self.name = Registers[self.index]
727
+ elif type == OPERAND_MEMORY:
728
+ self.base = args[0] if args[0] != R_NONE else None
729
+ self.index = args[1]
730
+ self.size = args[2]
731
+ self.scale = args[3] if args[3] > 1 else 1
732
+ self.disp = int(args[4])
733
+ self.dispSize = args[5]
734
+ self.segment = args[6]
735
+ elif type == OPERAND_ABSOLUTE_ADDRESS:
736
+ self.size = args[0]
737
+ self.disp = int(args[1])
738
+ self.dispSize = args[2]
739
+ self.segment = args[3]
740
+ elif type == OPERAND_FAR_MEMORY:
741
+ self.size = args[2]
742
+ self.seg = args[0]
743
+ self.off = args[1]
744
+
745
+ def _toText(self):
746
+ if self.type == OPERAND_IMMEDIATE:
747
+ if self.value >= 0:
748
+ return "0x%x" % self.value
749
+ else:
750
+ return "-0x%x" % abs(self.value)
751
+ elif self.type == OPERAND_REGISTER:
752
+ return self.name
753
+ elif self.type == OPERAND_ABSOLUTE_ADDRESS:
754
+ return '[0x%x]' % self.disp
755
+ elif self.type == OPERAND_FAR_MEMORY:
756
+ return '%s:%s' % (hex(self.seg), hex(self.off))
757
+ elif (self.type == OPERAND_MEMORY):
758
+ result = "["
759
+ if self.base != None:
760
+ result += Registers[self.base] + "+"
761
+ if self.index != None:
762
+ result += Registers[self.index]
763
+ if self.scale > 1:
764
+ result += "*%d" % self.scale
765
+ if self.disp >= 0:
766
+ result += "+0x%x" % self.disp
767
+ else:
768
+ result += "-0x%x" % abs(self.disp)
769
+ return result + "]"
770
+ def __str__(self):
771
+ return self._toText()
772
+
773
+
774
+ class Instruction (object):
775
+ def __init__(self, di, instructionBytes, dt):
776
+ "Expects a filled _DInst structure, and the corresponding byte code of the whole instruction"
777
+ #self.di = di
778
+ flags = di.flags
779
+ self.instructionBytes = instructionBytes
780
+ self.opcode = di.opcode
781
+ self.operands = []
782
+ self.flags = []
783
+ self.rawFlags = di.flags
784
+ self.instructionClass = _getISC(0)
785
+ self.flowControl = _getFC(0)
786
+ self.address = di.addr
787
+ self.size = di.size
788
+ self.dt = dt
789
+ self.valid = False
790
+ if di.segment != R_NONE:
791
+ self.segment = di.segment & 0x7f
792
+ self.isSegmentDefault = (di.segment & 0x80) == 0x80
793
+ else:
794
+ self.segment = R_NONE
795
+ self.isSegmentDefault = False
796
+ self.unusedPrefixesMask = di.unusedPrefixesMask
797
+
798
+ if flags == FLAG_NOT_DECODABLE:
799
+ self.mnemonic = 'DB 0x%02x' % (di.imm.byte)
800
+ self.flags = ['FLAG_NOT_DECODABLE']
801
+ return
802
+
803
+ self.valid = True
804
+ self.mnemonic = _getMnem(self.opcode)
805
+
806
+ # decompose the flags for a valid opcode
807
+ for index, flag in enumerate(FLAGS):
808
+ if (flags & (1 << index)) != 0:
809
+ self.flags.append(flag)
810
+
811
+ # read the operands
812
+ for operand in di.ops:
813
+ if operand.type != O_NONE:
814
+ self.operands.append(self._extractOperand(di, operand))
815
+
816
+ # decode the meta-flags
817
+ metas = di.meta
818
+ self.instructionClass = _getISC(metas)
819
+ self.flowControl = _getFC(metas)
820
+
821
+ def _extractOperand(self, di, operand):
822
+ # a single operand can be up to: reg1 + reg2*scale + constant
823
+ if operand.type == O_IMM:
824
+ if ("FLAG_IMM_SIGNED" in self.flags):
825
+ # immediate is sign-extended, do your thing. it's already signed, just make it Python-signed.
826
+ constant = _unsignedToSigned(di.imm.sqword)
827
+ else:
828
+ # immediate is zero-extended, though it's already aligned.
829
+ constant = di.imm.qword
830
+ return Operand(OPERAND_IMMEDIATE, constant, operand.size)
831
+ elif operand.type == O_IMM1: # first operand for ENTER
832
+ return Operand(OPERAND_IMMEDIATE, di.imm.ex.i1, operand.size)
833
+ elif operand.type == O_IMM2: # second operand for ENTER
834
+ return Operand(OPERAND_IMMEDIATE, di.imm.ex.i2, operand.size)
835
+ elif operand.type == O_REG:
836
+ return Operand(OPERAND_REGISTER, operand.index, operand.size)
837
+ elif operand.type == O_MEM:
838
+ return Operand(OPERAND_MEMORY, di.base, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
839
+ elif operand.type == O_SMEM:
840
+ return Operand(OPERAND_MEMORY, None, operand.index, operand.size, di.scale, _unsignedToSigned(di.disp), di.dispSize, self.segment)
841
+ elif operand.type == O_DISP:
842
+ return Operand(OPERAND_ABSOLUTE_ADDRESS, operand.size, di.disp, di.dispSize, self.segment)
843
+ elif operand.type == O_PC:
844
+ return Operand(OPERAND_IMMEDIATE, _unsignedToSigned(di.imm.addr) + self.address + self.size, operand.size)
845
+ elif operand.type == O_PTR:
846
+ return Operand(OPERAND_FAR_MEMORY, di.imm.ptr.seg, di.imm.ptr.off, operand.size)
847
+ else:
848
+ raise ValueError("Unknown operand type encountered: %d!" % operand.type)
849
+
850
+ def _toText(self):
851
+ # use the decode which already returns the text formatted well (with prefixes, etc).
852
+ return Decode(self.address, self.instructionBytes, self.dt)[0][2]
853
+
854
+ def __str__(self):
855
+ return self._toText()
856
+
857
+
858
+ def DecomposeGenerator(codeOffset, code, dt, features = 0):
859
+ """
860
+ @type codeOffset: long
861
+ @param codeOffset: Memory address where the code is located.
862
+ This is B{not} an offset into the code!
863
+ It's the actual memory address where it was read from.
864
+
865
+ @type code: str, in Py3 bytes
866
+ @param code: Code to disassemble.
867
+
868
+ @type dt: int
869
+ @param dt: Disassembly type. Can be one of the following:
870
+
871
+ * L{Decode16Bits}: 80286 decoding
872
+
873
+ * L{Decode32Bits}: IA-32 decoding
874
+
875
+ * L{Decode64Bits}: AMD64 decoding
876
+
877
+ @type features: int
878
+ @param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
879
+ or other features, eg. DF_RETURN_FC_ONLY.
880
+
881
+ @rtype: generator of TODO
882
+ @return: Generator of TODO
883
+
884
+ @raise ValueError: Invalid arguments.
885
+ """
886
+
887
+ if not code:
888
+ return
889
+
890
+ if not codeOffset:
891
+ codeOffset = 0
892
+
893
+ if dt not in (Decode16Bits, Decode32Bits, Decode64Bits):
894
+ raise ValueError("Invalid decode type value: %r" % (dt,))
895
+
896
+ codeLen = len(code)
897
+ code_buf = create_string_buffer(code)
898
+ p_code = byref(code_buf)
899
+ result = (_DInst * MAX_INSTRUCTIONS)()
900
+ instruction_off = 0
901
+
902
+ while codeLen > 0:
903
+
904
+ usedInstructionsCount = c_uint(0)
905
+ codeInfo = _CodeInfo(_OffsetType(codeOffset), _OffsetType(0), cast(p_code, c_char_p), codeLen, dt, features)
906
+ status = internal_decompose(byref(codeInfo), byref(result), MAX_INSTRUCTIONS, byref(usedInstructionsCount))
907
+ if status == DECRES_INPUTERR:
908
+ raise ValueError("Invalid arguments passed to distorm_decode()")
909
+
910
+ used = usedInstructionsCount.value
911
+ if not used:
912
+ break
913
+
914
+ delta = 0
915
+ for index in range(used):
916
+ di = result[index]
917
+ yield Instruction(di, code[instruction_off : instruction_off + di.size], dt)
918
+ delta += di.size
919
+ instruction_off += di.size
920
+
921
+ if delta <= 0:
922
+ break
923
+ codeOffset = codeOffset + delta
924
+ p_code = byref(code_buf, instruction_off)
925
+ codeLen = codeLen - delta
926
+
927
+ if (features & DF_STOP_ON_FLOW_CONTROL) != 0:
928
+ break # User passed a stop flag.
929
+
930
+ def Decompose(offset, code, type = Decode32Bits, features = 0):
931
+ """
932
+ @type offset: long
933
+ @param offset: Memory address where the code is located.
934
+ This is B{not} an offset into the code!
935
+ It's the actual memory address where it was read from.
936
+
937
+ @type code: str, in Py3 bytes
938
+ @param code: Code to disassemble.
939
+
940
+ @type type: int
941
+ @param type: Disassembly type. Can be one of the following:
942
+
943
+ * L{Decode16Bits}: 80286 decoding
944
+
945
+ * L{Decode32Bits}: IA-32 decoding
946
+
947
+ * L{Decode64Bits}: AMD64 decoding
948
+
949
+ @type features: int
950
+ @param features: A flow control stopping criterion, eg. DF_STOP_ON_CALL.
951
+ or other features, eg. DF_RETURN_FC_ONLY.
952
+
953
+ @rtype: TODO
954
+ @return: TODO
955
+ @raise ValueError: Invalid arguments.
956
+ """
957
+ return list(DecomposeGenerator(offset, code, type, features))