metasm 1.0.0 → 1.0.5

data/metasm/cpu/openrisc/main.rb

@@ -0,0 +1,70 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class OpenRisc < CPU
+	class Reg
+		attr_accessor :v
+		def initialize(v)
+			@v = v
+		end
+
+		def symbolic(di=nil)
+			if @v != 0 or not di or di.instruction.args[0].object_id == self.object_id
+				"r#@v".to_sym
+			else
+				# r0 is always 0, but we still return :r0 when writing to it (ie its the 1st instr arg)
+				Expression[0]
+			end
+		end
+	end
+
+	class FpReg
+		attr_accessor :v
+		def initialize(v)
+			@v = v
+		end
+
+		def symbolic(di=nil) ; "f#@v".to_sym ; end
+	end
+
+	class Memref
+		attr_accessor :base, :offset, :msz
+
+		def initialize(base, offset, msz)
+			@base = base
+			@offset = offset
+			@msz = msz
+		end
+
+		def symbolic(di)
+			p = Expression[@base.symbolic] if base
+			p = Expression[p, :+, @offset] if offset
+			Indirection[p.reduce, @msz, (di.address if di)]
+		end
+	end
+
+	def initialize(family = :latest, endianness = :big, delay_slot = 1)
+		super()
+		@endianness = endianness
+		@size = 32
+		@family = family
+		@delay_slot = delay_slot
+	end
+
+	def init_opcode_list
+		send("init_#@family")
+		@opcode_list
+	end
+
+	def delay_slot(di=nil)
+		@delay_slot
+	end
+end
+end
+

data/metasm/cpu/openrisc/opcodes.rb

@@ -0,0 +1,109 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/openrisc/main'
+
+module Metasm
+
+# https://github.com/s-macke/jor1k/blob/master/js/worker/or1k/safecpu.js
+class OpenRisc
+	def addop(name, bin, *args)
+		o = Opcode.new name, bin
+		args.each { |a|
+			o.bin_mask = a if a.kind_of?(Integer)
+			o.args << a if @valid_args[a]
+			o.props.update a if a.kind_of?(::Hash)
+		}
+		@opcode_list << o
+	end
+
+	def init_or1k
+		@opcode_list = []
+		@valid_args = [ :rA, :rB, :rD, :fA, :fB, :fD, :disp26, :uimm16, :simm16, :uimm5, :rA_simm16, :rA_smoo ].inject({}) { |h, a| h.update a => true }
+		@fields_off = { :rD => 21, :rA => 16, :rB => 11, :disp26 => 0, :uimm16 => 0, :simm16 => 0, :uimm5 => 0, :smoo => 0 }
+		@fields_mask = { :rD => 0x1F, :rA => 0x1F, :rB => 0x1F, :disp26 => 0x3FFFFFF, :simm16 => 0xFFFF, :uimm16 => 0xFFFF, :uimm5 => 0x1F, :smoo => 0x3E007FF }
+
+		addop 'j',     0x0000_0000, 0x03FF_FFFF, :disp26, :setip => true, :stopexec => true
+		addop 'jal',   0x0400_0000, 0x03FF_FFFF, :disp26, :setip => true, :stopexec => true, :saveip => true
+		addop 'bnf',   0x0C00_0000, 0x03FF_FFFF, :disp26, :setip => true	# branch if not flag
+		addop 'bf',    0x1000_0000, 0x03FF_FFFF, :disp26, :setip => true
+		addop 'nop',   0x1400_0000, 0x03FF_FFFF
+		addop 'movhi', 0x1800_0000, 0x03FE_FFFF, :rD, :uimm16
+		addop 'macrc', 0x1801_0000, 0x03FE_FFFF
+		addop 'trap',  0x2100_0000, 0x0000_FFFF
+		addop 'sys',   0x2000_0000, 0x03FF_FFFF		# args ?
+		addop 'rfe',   0x2400_0000, 0x03FF_FFFF
+		addop 'jr',    0x4400_0000, 0x03FF_FFFF, :rB, :setip => true, :stopexec => true
+		addop 'jalr',  0x4800_0000, 0x03FF_FFFF, :rB, :setip => true, :stopexec => true, :saveip => true
+		addop 'lwa',   0x6C00_0000, 0x03FF_FFFF, :rD, :rA_simm16
+		addop 'lwz',   0x8400_0000, 0x03FF_FFFF, :rD, :rA_simm16, :memsz => 4
+		addop 'lbz',   0x8C00_0000, 0x03FF_FFFF, :rD, :rA_simm16, :memsz => 1
+		addop 'lbs',   0x9000_0000, 0x03FF_FFFF, :rD, :rA_simm16, :memsz => 1	# lbz + sign-expand byte
+		addop 'lhz',   0x9400_0000, 0x03FF_FFFF, :rD, :rA_simm16, :memsz => 2
+		addop 'lhs',   0x9800_0000, 0x03FF_FFFF, :rD, :rA_simm16, :memsz => 2
+		addop 'add',   0x9C00_0000, 0x03FF_FFFF, :rD, :rA, :simm16
+		addop 'and',   0xA400_0000, 0x03FF_FFFF, :rD, :rA, :uimm16
+		addop 'or',    0xA800_0000, 0x03FF_FFFF, :rD, :rA, :uimm16
+		addop 'xor',   0xAC00_0000, 0x03FF_FFFF, :rD, :rA, :simm16
+		addop 'mfspr', 0xB400_0000, 0x03FF_FFFF, :rD, :rA, :simm16
+		addop 'shl',   0xB800_0000, 0x03FF_FF3F, :rD, :rA, :uimm5
+		addop 'ror',   0xB800_0040, 0x03FF_FF3F, :rD, :rA, :uimm5
+		addop 'sar',   0xB800_0080, 0x03FF_FF3F, :rD, :rA, :uimm5
+		addop 'sfeq',  0xBC00_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'sfne',  0xBC20_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'sfgtu', 0xBC40_0000, 0x001F_FFFF, :rA, :uimm16
+		addop 'sfgeu', 0xBC60_0000, 0x001F_FFFF, :rA, :uimm16
+		addop 'sfltu', 0xBC80_0000, 0x001F_FFFF, :rA, :uimm16
+		addop 'sfleu', 0xBCA0_0000, 0x001F_FFFF, :rA, :uimm16
+		addop 'sfgts', 0xBD40_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'sfges', 0xBD60_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'sflts', 0xBD80_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'sfles', 0xBDA0_0000, 0x001F_FFFF, :rA, :simm16
+		addop 'mtspr', 0xC000_0000, 0x03FF_FFFF, :rA_smoo, :rB		# smoo = (ins & 0x7ff) | ((ins >> 10) & 0xf800) ; setspr((rA|smoo), rB)
+		addop 'add',   0xC800_0000, 0x03FF_FF00, :fD, :fA, :fB		# FPU
+		addop 'sub',   0xC800_0001, 0x03FF_FF00, :fD, :fA, :fB
+		addop 'mul',   0xC800_0002, 0x03FF_FF00, :fD, :fA, :fB
+		addop 'div',   0xC800_0003, 0x03FF_FF00, :fD, :fA, :fB
+		addop 'itof',  0xC800_0004, 0x03FF_FF00, :fD, :rA
+		addop 'ftoi',  0xC800_0005, 0x03FF_FF00, :rD, :fA
+		addop 'madd',  0xC800_0007, 0x03FF_FF00, :fD, :fA, :fB		# fD += fA*fB
+		addop 'sfeq',  0xC800_0008, 0x03FF_FF00, :fA, :fB
+		addop 'sfne',  0xC800_0009, 0x03FF_FF00, :fA, :fB
+		addop 'sfgt',  0xC800_000A, 0x03FF_FF00, :fA, :fB
+		addop 'sfge',  0xC800_000B, 0x03FF_FF00, :fA, :fB
+		addop 'sflt',  0xC800_000C, 0x03FF_FF00, :fA, :fB
+		addop 'sfle',  0xC800_000D, 0x03FF_FF00, :fA, :fB
+		addop 'swa',   0xCC00_0000, 0x03FF_FFFF, :rA_smoo, :rB, :memsz => 4	# sw + setf(ra_smoo == current_EA ?)
+		addop 'sw',    0xD400_0000, 0x03FF_FFFF, :rA_smoo, :rB, :memsz => 4
+		addop 'sb',    0xD800_0000, 0x03FF_FFFF, :rA_smoo, :rB, :memsz => 1
+		addop 'sh',    0xDC00_0000, 0x03FF_FFFF, :rA_smoo, :rB, :memsz => 2
+		addop 'add',   0xE000_0000, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'sub',   0xE000_0002, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'and',   0xE000_0003, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'or',    0xE000_0004, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'xor',   0xE000_0005, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'shl',   0xE000_0008, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'ff1',   0xE000_000F, 0x03FF_FC30, :rD, :rA, :rB	# find first bit == 1
+		addop 'shr',   0xE000_0048, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'sar',   0xE000_0088, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'fl1',   0xE000_010F, 0x03FF_FC30, :rD, :rA, :rB	# find last bit
+		addop 'mul',   0xE000_0306, 0x03FF_FC30, :rD, :rA, :rB	# signed multiply ?
+		addop 'div',   0xE000_0309, 0x03FF_FC30, :rD, :rA, :rB
+		addop 'divu',  0xE000_030A, 0x03FF_FC30, :rD, :rA, :rB	# rD = rA&0xffffffff / rB&0xffffffff
+		addop 'sfeq',  0xE400_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfne',  0xE420_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfgtu', 0xE440_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfgeu', 0xE460_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfltu', 0xE480_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfleu', 0xE4A0_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfgts', 0xE540_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfges', 0xE560_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sflts', 0xE580_0000, 0x001F_FFFF, :rA, :rB
+		addop 'sfles', 0xE5A0_0000, 0x001F_FFFF, :rA, :rB
+	end
+
+	alias init_latest init_or1k
+end
+end

data/metasm/cpu/openrisc/render.rb

@@ -0,0 +1,37 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/openrisc/opcodes'
+require 'metasm/render'
+
+module Metasm
+class OpenRisc
+	class Reg
+		include Renderable
+		def render ; ["r#@v"] end
+	end
+
+	class FpReg
+		include Renderable
+		def render ; ["f#@v"] end
+	end
+
+	class Memref
+		include Renderable
+		def render
+			off = @offset
+			off = nil if off == Expression[0]
+			r = []
+			r << { 1 => 'byte ', 2 => 'word ', 4 => 'dword ', 8 => 'qword ' }[@msz]
+			r << '['
+			r << @base if @base
+			r << '+' if @base and off
+			r << off if off
+			r << ']'
+		end
+	end
+end
+end

data/{lib/metasm → metasm/cpu}/pic16c/decode.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/pic16c/opcodes'
+require 'metasm/cpu/pic16c/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -17,22 +17,21 @@ class Pic16c
 		}
 		op.bin_mask.map! { |v| 255 ^ v }
 	end
-	
+
 	def build_bin_lookaside
 		# sets up a hash byte value => list of opcodes that may match
 		# opcode.bin_mask is built here
 		lookaside = Array.new(256) { [] }
 		@opcode_list.each { |op|
-			
+
 			build_opcode_bin_mask op
-			
+
 			b   = op.bin[0]
 			msk = op.bin_mask[0]
-			
-			
+
 			for i in b..(b | (255^msk))
 				ext if i & msk != b & msk
-				
+
 				lookaside[i] << op
 			end
 		}

data/{lib/metasm → metasm/cpu}/pic16c/opcodes.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/pic16c/main'
+require 'metasm/cpu/pic16c/main'
 
 module Metasm
 class Pic16c

data/metasm/cpu/ppc.rb

@@ -0,0 +1,11 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/ppc/parse'
+require 'metasm/cpu/ppc/encode'
+require 'metasm/cpu/ppc/decode'
+require 'metasm/cpu/ppc/decompile'

data/{lib/metasm → metasm/cpu}/ppc/decode.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/opcodes'
+require 'metasm/cpu/ppc/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -13,8 +13,8 @@ class PowerPC
 		# bit = 0 if can be mutated by an field value, 1 if fixed by opcode
 		return if not op.bin.kind_of? Integer
 		op.bin_mask = 0
-		op.args.each { |f|
-			op.bin_mask |= @fields_mask[f] << @fields_shift[f]
+		op.fields.each { |k, (m, s)|
+			op.bin_mask |= m << s
 		}
 		op.bin_mask = 0xffff_ffff ^ op.bin_mask
 	end
@@ -37,7 +37,7 @@ class PowerPC
 	end
 
 	def decode_findopcode(edata)
-		return if edata.ptr >= edata.data.length
+		return if edata.ptr+4 > edata.length
 		di = DecodedInstruction.new(self)
 		val = edata.decode_imm(:u32, @endianness)
 		edata.ptr -= 4
@@ -67,14 +67,20 @@ class PowerPC
 			when :fra, :frb, :frc, :frs, :frt; FPR.new field_val[a]
 			when :ra_i16, :ra_i16s, :ra_i16q
 				i = field_val[{:ra_i16 => :d, :ra_i16s => :ds, :ra_i16q => :dq}[a]]
-			       	Memref.new GPR.new(field_val[:ra]), Expression[i]
-			when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :ma, :mb, :me, :ma_, :mb_, :me_; Expression[field_val[a]]
-			when :ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :ign_bi, :aa, :lk, :oe, :rc, :l; next
+				Memref.new GPR.new(field_val[:ra]), Expression[i]
+			when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :mb, :me, :mb_, :me_, :u; Expression[field_val[a]]
+			when :ba, :bf, :bfa, :bt; CR.new field_val[a]
+			when :bb, :bh, :flm, :fxm, :l_, :l__, :lev, :nb, :sh_, :spr, :sr, :tbr, :th, :to
+				puts "PPC.decode: unsupported argument #{a.inspect}" if $VERBOSE	# TODO
+				Expression[field_val[a]]
 			else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
 			end
 		}
+
 		di.bin_length += edata.ptr - before_ptr
 
+		return if edata.ptr > edata.length
+
 		decode_aliases(di.instruction)
 
 		di
@@ -84,8 +90,8 @@ class PowerPC
 		case i.opname
 		when /^n?or\.?$/
 			if i.args[1] == i.args[2]
-	 			i.args.pop
-	 			i.opname = {'or' => 'mr', 'or.' => 'mr.', 'nor' => 'not', 'nor.' => 'not.'}[i.opname]
+				i.args.pop
+				i.opname = {'or' => 'mr', 'or.' => 'mr.', 'nor' => 'not', 'nor.' => 'not.'}[i.opname]
 			end
 		when /^addi/
 			if a = i.args[2].reduce and a.kind_of? Integer and a < 0
@@ -107,7 +113,7 @@ class PowerPC
 	# else just add the offset +off+ of the instruction + its length (off may be an Expression)
 	# assumes edata.ptr points just after the instruction (as decode_instr_op left it)
 	# do not call twice on the same di !
- 	def decode_instr_interpret(di, addr)
+	def decode_instr_interpret(di, addr)
 		if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.opcode.name[0] != ?t and di.opcode.name[-1] != ?a
 			arg = Expression[addr, :+, di.instruction.args.last].reduce
 			di.instruction.args[-1] = Expression[arg]
@@ -170,12 +176,6 @@ class PowerPC
 		df
 	end
 
-	# hash opname => lambda { |di, *sym_args| binding }
-	def backtrace_binding
-		@backtrace_binding ||= init_backtrace_binding
-	end
-	def backtrace_binding=(b) @backtrace_binding = b end
-
 	def init_backtrace_binding
 		@backtrace_binding ||= {}
 		opcode_list.map { |ol| ol.name }.uniq.each { |op|
@@ -191,11 +191,11 @@ class PowerPC
 				ptr = m.pointer.externals.grep(Symbol).first
 				ret[ptr] = m.pointer if ptr != a0
 				ret
-		       	}
+			}
 			when 'lwz'; lambda { |di, a0, m| { a0 => Expression[m] } }
 			when 'stwu'; lambda { |di, a0, m|
 				{ m => Expression[a0], m.pointer.externals.grep(Symbol).first => m.pointer }
-		       	}
+			}
 			when 'stw'; lambda { |di, a0, m| { m => Expression[a0] } }
 			when 'rlwinm'; lambda { |di, a0, a1, sh, mb, me|
 				mb, me = mb.reduce, me.reduce
@@ -225,25 +225,6 @@ class PowerPC
 		@backtrace_binding
 	end
 
-	def get_backtrace_binding(di)
-		a = di.instruction.args.map { |arg|
-			case arg
-			when Memref; arg.symbolic(di.address)
-			when Reg; arg.symbolic
-			else arg
-			end
-		}
-
-		binding = if binding = backtrace_binding[di.instruction.opname]
-			binding[di, *a]
-		else
-			puts "unknown instruction to emu #{di}" if $VERBOSE
-			{}
-		end
-
-		binding
-	end
-
 	def get_xrefs_x(dasm, di)
 		return [] if not di.opcode.props[:setip]
 

data/{lib/metasm → metasm/cpu}/ppc/decompile.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/main'
+require 'metasm/cpu/ppc/main'
 
 module Metasm
 class PowerPC
@@ -25,7 +25,7 @@ class PowerPC
 	# returns { blockaddr => [list of vars that are needed by a following block] }
 	def decompile_func_finddeps(dcmp, blocks, func)
 		deps_r = {} ; deps_w = {} ; deps_to = {}
-		deps_subfunc = {} 	# things read/written by subfuncs
+		deps_subfunc = {}	# things read/written by subfuncs
 
 		# find read/writes by each block
 		blocks.each { |b, to|
@@ -43,7 +43,7 @@ class PowerPC
 					end
 				}
 				#a << :eax if di.opcode.name == 'ret'		# standard ABI
-				
+
 				deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b]
 				deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
 			}

data/{lib/metasm → metasm/cpu}/ppc/encode.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/opcodes'
+require 'metasm/cpu/ppc/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -31,7 +31,7 @@ class PowerPC
 
 		op.args.zip(instr.args).each { |sym, arg|
 			case sym
-			when :rs, :rt, :rd
+			when :rs, :rt, :rd, :ba, :bf, :bfa, :bt
 				set_field[sym, arg.i]
 			when :ft
 				set_field[sym, arg.i]