fisk 2.2.0 → 2.3.0

data/lib/fisk.rb

@@ -16,12 +16,16 @@ class Fisk
     def extended_register?; false; end
     def memory?;            false; end
     def rip?;               false; end
+    def immediate?;         false; end
+    def absolute_location?; false; end
   end
 
   class Operand
     include OperandPredicates
 
-    def works? type; self.type == type; end
+    def works? op
+      self.type == op.type
+    end
 
     def rex_value
       value >> 3
@@ -51,17 +55,24 @@ class Fisk
         @value = value
       end
 
-      def works? type
+      def works? op
+        type = op.type
         type == self.name || type == self.type
       end
 
       def op_value
-        value & 0x7
+        value
       end
 
       def extended_register?
         @value > 7 || EXTENDED_R8.include?(self)
       end
+
+      def register?; true; end
+
+      def to_register
+        self
+      end
     end
 
     class Rip < Operand
@@ -71,7 +82,8 @@ class Fisk
         @displacement = displacement
       end
 
-      def works? type
+      def works? op
+        type = op.type
         type == "m64" || type == "m"
       end
 
@@ -103,6 +115,7 @@ class Fisk
       end
 
       def temp_register?; true; end
+      def register?; true; end
 
       def op_value
         reg.op_value
@@ -120,6 +133,10 @@ class Fisk
         reg.value
       end
 
+      def to_register
+        self
+      end
+
       def reg
         unless @register
           raise Errors::UnassignedRegister, "Temporary register #{name} hasn't been assigned a real register"
@@ -187,26 +204,46 @@ class Fisk
   end
 
   class Memory < Operand
-    attr_reader :displacement
+    attr_reader :register, :displacement
 
     def initialize register, displacement
       @register     = register
       @displacement = displacement
     end
 
+    def extended_register?
+      @register.extended_register?
+    end
+
     def value
       @register.value
     end
 
+    def + displacement
+      self.class.new(register, self.displacement + displacement)
+    end
+
     def memory?; true; end
-  end
 
-  class M64 < Memory
-    def type
-      "m64"
+    def rex_value
+      @register.rex_value
     end
   end
 
+  [8, 16, 32, 64].each do |size|
+    class_eval <<~eostr, __FILE__, __LINE__ + 1
+      class M#{size} < Memory
+        def type
+          "m#{size}"
+        end
+
+        def size; #{size}; end
+      end
+
+      def m#{size} val, displacement = 0; M#{size}.new(val, displacement); end
+    eostr
+  end
+
   class M < Memory
     def type
       "m"
@@ -217,34 +254,42 @@ class Fisk
     Registers::Rip.new(displacement)
   end
 
-  def m64 x, displacement = 0
-    M64.new x, displacement
-  end
-
   def m x, displacement = 0
     M.new x, displacement
   end
 
+  class ImmediateOperand < ValueOperand
+    def immediate?; true; end
+
+    def works? insn_op
+      insn_op.immediate? && size <= insn_op.size
+    end
+  end
+
   # Define all immediate value methods of different sizes
   [8, 16, 32, 64].each do |size|
     class_eval <<~eostr, __FILE__, __LINE__ + 1
-      class Imm#{size} < ValueOperand
+      class Imm#{size} < ImmediateOperand
         def type
           "imm#{size}"
         end
+
+        def size; #{size}; end
       end
 
       def imm#{size} val; Imm#{size}.new(val.to_i); end
     eostr
   end
 
-  class Rel8 < ValueOperand
+  class Relative < ValueOperand; end
+
+  class Rel8 < Relative
     def type
       "rel8"
     end
   end
 
-  class Rel32 < ValueOperand
+  class Rel32 < Relative
     def type
       "rel32"
     end
@@ -269,7 +314,8 @@ class Fisk
       @name = name
     end
 
-    def works? type
+    def works? op
+      type = op.type
       type == "rel32"
     end
 
@@ -332,6 +378,7 @@ class Fisk
       @form      = form
       @operands  = operands
       @retry     = false
+      @saved_pos = 0
     end
 
     def retry?; true; end
@@ -342,7 +389,7 @@ class Fisk
         if op.rip? && op.unresolved?
           # Try resolving the operands
           if labels.key?(op.displacement.name)
-            Registers::Rip.new labels[op.displacement.name]
+            Registers::Rip.new labels[op.displacement.name] - @saved_pos
           else
             Registers::Rip.new 0x0CAFE
           end
@@ -352,6 +399,46 @@ class Fisk
       end
 
       @form.encodings.first.encode buffer, operands
+      @saved_pos = buffer.pos
+    end
+  end
+
+  class AbsoluteJumpInstruction
+    include InstructionPredicates
+
+    def initialize insn, form, operand
+      @insn       = insn
+      @form       = form
+      @operand    = operand
+      @must_retry = false
+    end
+
+    def jump?
+      true
+    end
+
+    def target
+      @operand.name
+    end
+
+    def encode buffer, labels
+      form              = find_form "rel32"
+      encoding          = form.encodings.first
+      operand_klass     = Rel32
+
+      pos = buffer.pos
+      rel_jump = 0xCAFE
+      2.times do
+        buffer.seek pos, IO::SEEK_SET
+        encoding.encode buffer, [operand_klass.new(rel_jump)]
+        rel_jump = @operand.value - buffer.address
+      end
+    end
+
+    private
+
+    def find_form form_type
+      @insn.forms.find { |form| form.operands.first.type == form_type }
     end
   end
 
@@ -405,6 +492,10 @@ class Fisk
         buffer.seek pos, IO::SEEK_SET
         encoding.encode buffer, [operand_klass.new(jump_len)]
       else
+        if @must_retry
+          # We retried once, but the label wasn't defined
+          raise Errors::MissingLabel, "Label `#{target}` was used, but not defined"
+        end
         @must_retry = true
         encoding.encode buffer, [operand_klass.new(0x0CAFE)]
       end
@@ -502,6 +593,10 @@ class Fisk
 
   # Insert a label named +name+ at the current position in the instructions.
   def put_label name
+    if @labels.key? name
+      raise Errors::LabelAlreadyDefined, "Label `#{name}` is already defined"
+    end
+    @labels[name] = nil
     @instructions << Label.new(name)
     self
   end
@@ -519,6 +614,14 @@ class Fisk
     Registers::Temp.new name, "r64"
   end
 
+  # Allocate a register and yield it to the block.  The register will be
+  # automatically released after the block is finished.
+  def with_register name = "temp"
+    reg = register(name)
+    yield reg
+    release_register reg
+  end
+
   # Assign registers to any temporary registers.  Only registers in +list+
   # will be used when selecting register assignments
   def assign_registers list, local: false
@@ -571,6 +674,8 @@ class Fisk
 
   # Create a signed immediate value of the right width
   def imm val
+    val = val.to_i
+
     if val >= -0x7F - 1 && val <= 0x7F
       imm8 val
     elsif val >=  -0x7FFF - 1 && val <= 0x7FFF
@@ -586,6 +691,8 @@ class Fisk
 
   # Create an unsigned immediate value of the right width
   def uimm val
+    val = val.to_i
+
     if val < 0
       raise ArgumentError, "#{val} is negative"
     elsif val <= 0xFF
@@ -609,6 +716,23 @@ class Fisk
     Rel32.new val
   end
 
+  class AbsoluteLocation < Rel32
+    def absolute_location?;  true; end
+  end
+
+  # Creates an "absolute" location.  Use this for JUMP instructions where you
+  # know the absolute location but want a relative location calculated later.
+  #
+  # For example:
+  #
+  #   fisk.jmp fisk.absolute(0xCAFE)
+  #
+  # The emitted JMP instruction will use a calculated relative address (this is
+  # because x64 doesn't have a jump to absolute position).
+  def absolute val
+    AbsoluteLocation.new val
+  end
+
   def lit val
     Lit.new val
   end
@@ -686,7 +810,7 @@ class Fisk
     forms = insns.forms.find_all do |insn|
       if insn.operands.length == params.length
         params.zip(insn.operands).all? { |want_op, have_op|
-          want_op.works?(have_op.type)
+          want_op.works?(have_op)
         }
       else
         false
@@ -719,6 +843,10 @@ class Fisk
         end
       end
 
+      if param.absolute_location? && insns.name =~ /^(?:J|CALL)/
+        insn = AbsoluteJumpInstruction.new(insns, form, params.first)
+      end
+
       if param.temp_register?
         if param.end_point
           raise Errors::UseAfterInvalidationError, "Register #{param.name} used after release"

data/test/test_fisk.rb

@@ -8,6 +8,147 @@ class FiskTest < Fisk::Test
     @fisk = Fisk.new
   end
 
+  def test_rdi_is_register
+    assert_predicate Fisk::Registers::RDI, :register?
+  end
+
+  def test_push_all
+    regs = Fisk::Registers.constants.grep(/^R[A-Z0-9]{1,2}/).find_all { |r|
+      Fisk::Registers.const_get(r).type == "r64"
+    }.map { |r| Fisk::Registers.const_get(r) }
+
+    regs.each do |reg|
+      @fisk = Fisk.new
+      fisk.push(reg)
+      i = disasm(fisk.to_binary).first
+      assert_equal "push", i.mnemonic.to_s
+      assert_equal reg.name, i.op_str.to_s
+    end
+  end
+
+  def test_push_read_all
+    regs = Fisk::Registers.constants.grep(/^R[A-Z0-9]{1,2}/).find_all { |r|
+      Fisk::Registers.const_get(r).type == "r64"
+    }.map { |r| Fisk::Registers.const_get(r) }
+
+    regs.each do |reg|
+      @fisk = Fisk.new
+      fisk.push(fisk.m64(reg))
+      i = disasm(fisk.to_binary).first
+      assert_equal "push", i.mnemonic.to_s
+      assert_equal "qword ptr [#{reg.name}]", i.op_str.to_s
+    end
+  end
+
+  def test_push_read_rsp_to_reg
+    fisk.mov(fisk.rax, fisk.m64(fisk.rsp))
+    i = disasm(fisk.to_binary).first
+    assert_equal "mov", i.mnemonic.to_s
+    assert_equal "rax, qword ptr [rsp]", i.op_str.to_s
+  end
+
+  def test_push_read_r8
+    fisk.push(fisk.m64(fisk.r8))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [r8]", i.op_str.to_s
+  end
+
+  def test_push_read_r11
+    fisk.push(fisk.m64(fisk.r11))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [r11]", i.op_str.to_s
+  end
+
+  def test_push_read_r12
+    fisk.push(fisk.m64(fisk.r12))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [r12]", i.op_str.to_s
+  end
+
+  def test_push_read_r13
+    fisk.push(fisk.m64(fisk.r13))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [r13]", i.op_str.to_s
+  end
+
+  def test_push_read_rsp
+    fisk.push(fisk.m64(fisk.rsp))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [rsp]", i.op_str.to_s
+  end
+
+  def test_push_read_rbp
+    fisk.push(fisk.m64(fisk.rbp))
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "qword ptr [rbp]", i.op_str.to_s
+  end
+
+  def test_push_rsp
+    fisk.push(fisk.rsp)
+    i = disasm(fisk.to_binary).first
+    assert_equal "push", i.mnemonic.to_s
+    assert_equal "rsp", i.op_str.to_s
+  end
+
+  def test_multiple_put_label_raises
+    fisk.put_label(:continue)
+    assert_raises Fisk::Errors::LabelAlreadyDefined do
+      fisk.put_label(:continue)
+    end
+  end
+
+  def test_missing_jump_label_raises
+    fisk.jz(fisk.label(:continue))
+    assert_raises Fisk::Errors::MissingLabel do
+      fisk.to_binary
+    end
+  end
+
+  def test_to_register
+    assert_equal fisk.r9, fisk.r9.to_register
+    temp = fisk.register
+    assert_equal temp, temp.to_register
+  end
+
+  def test_immediate_predicate
+    assert_predicate fisk.imm8(1), :immediate?
+    refute_predicate fisk.r9, :immediate?
+  end
+
+  def test_32_memory_sizes
+    fisk.mov(fisk.eax, fisk.m32(fisk.eax))
+    i = disasm(fisk.to_binary).first
+    assert_equal "mov", i.mnemonic.to_s
+    assert_equal "eax, dword ptr [rax]", i.op_str.to_s
+  end
+
+  def test_16_memory_sizes
+    fisk.mov(fisk.ax, fisk.m16(fisk.ax))
+    i = disasm(fisk.to_binary).first
+    assert_equal "mov", i.mnemonic.to_s
+    assert_equal "ax, word ptr [rax]", i.op_str.to_s
+  end
+
+  def test_8_memory_sizes
+    fisk.mov(fisk.al, fisk.m8(fisk.ax))
+    i = disasm(fisk.to_binary).first
+    assert_equal "mov", i.mnemonic.to_s
+    assert_equal "al, byte ptr [rax]", i.op_str.to_s
+  end
+
+  def test_find_compatible_instruction
+    fisk.mov(fisk.r9, fisk.imm8(1))
+    i = disasm(fisk.to_binary).first
+    assert_equal "mov", i.mnemonic.to_s
+    assert_equal "r9, 1", i.op_str.to_s
+  end
+
   def test_jump_target
     expected_pos = nil
     fisk.jz(fisk.label(:continue))
@@ -26,7 +167,6 @@ class FiskTest < Fisk::Test
     define_method "test_#{reg}_to_offset" do
       fisk.lea(fisk.send(reg), fisk.rip(15))
 
-      bytes = fisk.to_binary
       i = disasm(fisk.to_binary).first
 
       assert_equal "lea", i.mnemonic.to_s
@@ -44,7 +184,7 @@ class FiskTest < Fisk::Test
     i = disasm(fisk.to_binary).first
 
     assert_equal "mov", i.mnemonic.to_s
-    assert_equal "rax, qword ptr [rip + 0xa]", i.op_str.to_s
+    assert_equal "rax, qword ptr [rip + 3]", i.op_str.to_s
   end
 
   def test_m64_encoding

data/test/test_run_fisk.rb

@@ -2,6 +2,132 @@ require "helper"
 require "fisk/helpers"
 
 class RunFiskTest < Fisk::Test
+  def test_buffer_raises_on_seek
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    assert_raises do
+      jitbuf.seek 4097
+    end
+  end
+
+  def test_buffer_raises_on_write
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    4096.times { jitbuf.putc 0x3C }
+    assert_raises do
+      jitbuf.putc 0x3C
+    end
+  end
+
+  def test_jit_jump_absolute
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    fisk = Fisk.new { |__|
+      __.jmp(__.absolute(jitbuf.memory.to_i))
+    }
+    fisk.write_to jitbuf
+    jump = disasm(jitbuf.memory[0, 4096])[0]
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0", jump.op_str.to_s
+  end
+
+  def test_jit_jump_patch
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    jump_pos = nil
+    fisk = Fisk.new { |__|
+      __.push(__.rbp)
+        .mov(__.rbp, __.rsp)
+        .mov(__.rax, __.imm64(-123))
+
+      __.lazy { |pos| jump_pos = pos }
+        .jmp(__.rel32(1234))
+    }
+    fisk.write_to jitbuf
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0x4e5", jump.op_str.to_s
+
+    jitbuf.patch_jump at: jump_pos, to: jitbuf.memory.to_i
+
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0", jump.op_str.to_s
+
+    jitbuf.patch_jump at: jump_pos, to: jitbuf.memory.to_i + 0xFF
+
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0xff", jump.op_str.to_s
+  end
+
+  def test_jit_patch_jump_type
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    jump_pos = nil
+    fisk = Fisk.new { |__|
+      __.push(__.rbp)
+        .mov(__.rbp, __.rsp)
+        .mov(__.rax, __.imm64(-123))
+
+      __.lazy { |pos| jump_pos = pos }
+        .jmp(__.rel32(1234))
+    }
+    fisk.write_to jitbuf
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0x4e5", jump.op_str.to_s
+
+    jitbuf.patch_jump at: jump_pos, to: jitbuf.memory.to_i, type: :jg
+
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+    assert_equal "jg", jump.mnemonic.to_s
+    assert_equal "0", jump.op_str.to_s
+
+    jitbuf.patch_jump at: jump_pos, to: jitbuf.memory.to_i + 0xFF, type: :jne
+
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+    assert_equal "jne", jump.mnemonic.to_s
+    assert_equal "0xff", jump.op_str.to_s
+  end
+
+  def test_jit_patch_maintains_position
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    jump_pos = nil
+    fisk = Fisk.new { |__|
+      __.push(__.rbp)
+        .mov(__.rbp, __.rsp)
+        .mov(__.rax, __.imm64(-123))
+
+      __.lazy { |pos| jump_pos = pos }
+        .jmp(__.rel32(1234))
+    }
+    fisk.write_to jitbuf
+    jump = disasm(jitbuf.memory[0, 4096])[3]
+
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0x4e5", jump.op_str.to_s
+
+    pos = jitbuf.pos
+    jitbuf.patch_jump at: jump_pos, to: jitbuf.memory.to_i, type: :jg
+    assert_equal pos, jitbuf.pos
+  end
+
+  def test_write_jump_moves
+    jitbuf = Fisk::Helpers.jitbuffer 4096
+    fisk = Fisk.new { |__|
+      __.push(__.rbp)
+        .mov(__.rbp, __.rsp)
+        .mov(__.rax, __.imm64(-123))
+    }
+    fisk.write_to jitbuf
+
+    current_pos = jitbuf.pos
+    jitbuf.write_jump(to: jitbuf.address + 0xFF)
+
+    jump = disasm(jitbuf.memory[current_pos, jitbuf.pos])[0]
+
+    assert_equal "jmp", jump.mnemonic.to_s
+    assert_equal "0xff", jump.op_str.to_s
+  end
+
   def test_negative
     fisk = Fisk.new
     jitbuf = Fisk::Helpers.jitbuffer 4096

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fisk
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Aaron Patterson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-02 00:00:00.000000000 Z
+date: 2021-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest