metasm 1.0.0 → 1.0.5

data/{lib/metasm → metasm}/exe_format/shellcode.rb

@@ -69,11 +69,11 @@ class Shellcode < ExeFormat
 		parse(*a) if not a.empty?
 		@encoded << assemble_sequence(@source, @cpu)
 		@source.clear
-		encode
+		self
 	end
 
 	def encode(binding={})
-		@encoded.fixup! binding
+		@encoded.fixup! binding if binding.kind_of? Hash
 		@encoded.fixup @encoded.binding(@base_addr)
 		@encoded.fill @encoded.rawsize
 		self
@@ -107,7 +107,11 @@ class Shellcode < ExeFormat
 	# returns a virtual subclass of Shellcode whose cpu_from_headers will return cpu
 	def self.withcpu(cpu)
 		c = Class.new(self)
-		c.send(:define_method, :cpu_from_headers) { cpu }
+		c.send(:define_method, :cpu_from_headers) {
+			cpu = Metasm.const_get(cpu) if cpu.kind_of?(::String)
+			cpu = cpu.new if cpu.kind_of?(::Class) and cpu.ancestors.include?(CPU)
+			cpu
+		}
 		c
 	end
 end

data/metasm/exe_format/shellcode_rwx.rb

@@ -0,0 +1,114 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+
+module Metasm
+# Similar to Shellcode, with distinct sections per memory permission (R / RW / RX)
+# encoding-side only
+class Shellcode_RWX < ExeFormat
+	# the array of source elements (Instr/Data etc)
+	attr_accessor :source_r, :source_w, :source_x
+	# base address per section
+	attr_accessor :base_r, :base_w, :base_x
+	# encodeddata
+	attr_accessor :encoded_r, :encoded_w, :encoded_x
+
+	def initialize(cpu=nil)
+		@base_r = @base_w = @base_x = nil
+		@encoded_r = EncodedData.new
+		@encoded_w = EncodedData.new
+		@encoded_x = EncodedData.new
+
+		super(cpu)
+	end
+
+	def parse_init
+		@source_r = []
+		@source_w = []
+		@source_x = []
+		@cursource = @source_x
+		super()
+	end
+
+	# allows definition of the base address
+	def parse_parser_instruction(instr)
+		case instr.raw.downcase
+		when '.base', '.baseaddr', '.base_addr'
+			# ".base_addr <expression>"
+			# expression should #reduce to integer
+			@lexer.skip_space
+			raise instr, 'syntax error' if not base = Expression.parse(@lexer).reduce
+			raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol
+			if @cursource.equal?(@source_r)
+				@base_r = base
+			elsif @cursource.equal?(@source_w)
+				@base_w = base
+			elsif @cursource.equal?(@source_x)
+				@base_x = base
+			else raise instr, "Where am I ?"
+			end
+		when '.rdata', '.rodata'
+			@cursource = @source_r
+		when '.data', '.bss'
+			@cursource = @source_w
+		when '.text'
+			@cursource = @source_x
+		else super(instr)
+		end
+	end
+
+	# encodes the source found in self.source
+	# appends it to self.encoded
+	# clears self.source
+	# the optional parameter may contain a binding used to fixup! self.encoded
+	# uses self.base_addr if it exists
+	def assemble(*a)
+		parse(*a) if not a.empty?
+		@encoded_r << assemble_sequence(@source_r, @cpu); @source_r.clear
+		@encoded_w << assemble_sequence(@source_w, @cpu); @source_w.clear
+		@encoded_x << assemble_sequence(@source_x, @cpu); @source_x.clear
+		self
+	end
+
+	def encode(binding={})
+		bd = {}
+		bd.update @encoded_r.binding(@base_r)
+		bd.update @encoded_w.binding(@base_w)
+		bd.update @encoded_x.binding(@base_x)
+		bd.update binding if binding.kind_of?(Hash)
+		@encoded_r.fixup bd
+		@encoded_w.fixup bd
+		@encoded_x.fixup bd
+		self
+	end
+	alias fixup encode
+
+	# resolve inter-section xrefs, raise if unresolved relocations remain
+	# call this when you have assembled+allocated memory for every section
+	def fixup_check(base_r=nil, base_w=nil, base_x=nil, bd={})
+		if base_r.kind_of?(Hash)
+			bd = base_r
+			base_r = nil
+		end
+		@base_r = base_r if base_r
+		@base_w = base_w if base_w
+		@base_x = base_x if base_x
+		fixup bd
+		ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x
+		raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty?
+		self
+	end
+
+	def encode_string(*a)
+		encode(*a)
+		ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x
+		ed.fixup(ed.binding)
+		raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty?
+		ed.data
+	end
+end
+end

data/metasm/exe_format/swf.rb

@@ -0,0 +1,205 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+begin
+	require 'zlib'
+rescue LoadError
+end
+
+module Metasm
+class SWF < ExeFormat
+	attr_accessor :signature, :version, :header, :chunks
+
+	CHUNK_TYPE = {
+		0 => 'End', 1 => 'ShowFrame', 2 => 'DefineShape', 3 => 'FreeCharacter',
+		4 => 'PlaceObject', 5 => 'RemoveObject', 6 => 'DefineBits', 7 => 'DefineButton',
+		8 => 'JPEGTables', 9 => 'SetBackgroundColor', 10 => 'DefineFont', 11 => 'DefineText',
+		12 => 'DoAction', 13 => 'DefineFontInfo', 14 => 'DefineSound', 15 => 'StartSound',
+		16 => 'StopSound', 17 => 'DefineButtonSound', 18 => 'SoundStreamHead', 19 => 'SoundStreamBlock',
+		20 => 'DefineBitsLossless', 21 => 'DefineBitsJPEG2', 22 => 'DefineShape2', 23 => 'DefineButtonCxform',
+		24 => 'Protect', 25 => 'PathsArePostScript', 26 => 'PlaceObject2',
+		28 => 'RemoveObject2', 29 => 'SyncFrame', 31 => 'FreeAll',
+		32 => 'DefineShape3', 33 => 'DefineText2', 34 => 'DefineButton2', 35 => 'DefineBitsJPEG3',
+		36 => 'DefineBitsLossless2', 37 => 'DefineEditText', 38 => 'DefineVideo', 39 => 'DefineSprite',
+		40 => 'NameCharacter', 41 => 'ProductInfo', 42 => 'DefineTextFormat', 43 => 'FrameLabel',
+		44 => 'DefineBehavior', 45 => 'SoundStreamHead2', 46 => 'DefineMorphShape', 47 => 'FrameTag',
+		48 => 'DefineFont2', 49 => 'GenCommand', 50 => 'DefineCommandObj', 51 => 'CharacterSet',
+		52 => 'FontRef', 53 => 'DefineFunction', 54 => 'PlaceFunction', 55 => 'GenTagObject',
+		56 => 'ExportAssets', 57 => 'ImportAssets', 58 => 'EnableDebugger', 59 => 'DoInitAction',
+		60 => 'DefineVideoStream', 61 => 'VideoFrame', 62 => 'DefineFontInfo2', 63 => 'DebugID',
+		64 => 'EnableDebugger2', 65 => 'ScriptLimits', 66 => 'SetTabIndex', 67 => 'DefineShape4',
+		68 => 'DefineMorphShape2', 69 => 'FileAttributes', 70 => 'PlaceObject3', 71 => 'ImportAssets2',
+		72 => 'DoABC', 76 => 'SymbolClass', 82 => 'DoABC2',
+	}
+
+	class SerialStruct < Metasm::SerialStruct
+		new_int_field :u8, :u16, :u32, :f16, :f32
+	end
+
+	class Rectangle < SerialStruct
+		virtual :nbits, :xmin, :xmax, :ymin, :ymax
+
+		def decode(swf)
+			byte = swf.decode_u8
+			bleft = 3
+			@nbits = byte >> bleft
+			@xmin, @xmax, @ymin, @ymax = (0..3).map {
+				nb = @nbits
+				v = 0
+				while nb > bleft
+					nb -= bleft
+					v |= (byte & ((1<<bleft)-1)) << nb
+
+					bleft = 8
+					byte = swf.decode_u8
+				end
+				v |= (byte >> (bleft-nb)) & ((1<<nb)-1)
+				bleft -= nb
+
+				Expression.make_signed(v, @nbits)
+			}
+		end
+
+		def set_default_values(swf)
+			@xmin ||= 0
+			@xmax ||= 31
+			@ymin ||= 0
+			@ymax ||= 31
+			@nbits = (0..30).find { |nb|
+				[@xmin, @xmax, @ymin, @ymax].all? { |v|
+					if nb == 0
+						v == 0
+					elsif v >= 0
+						# reserve sign bit
+						(v >> (nb-1)) == 0
+					else
+						(v >> nb) == -1
+					end
+				} } || 31
+		end
+
+		def encode(swf)
+			ed = super(swf)
+
+			byte = @nbits << 3
+			bleft = 3
+			[@xmin, @xmax, @ymin, @ymax].each { |v|
+				nb = @nbits
+				while nb > bleft
+					byte |= (v >> (nb-bleft)) & ((1<<bleft)-1)
+					nb -= bleft
+
+					ed << byte
+					byte = 0
+					bleft = 8
+				end
+				byte |= (v & ((1<<nb)-1)) << (bleft-nb)
+				bleft -= nb
+			}
+			ed << byte if bleft < 8
+
+			ed
+		end
+	end
+
+	class Header < SerialStruct
+		virtual :view
+		u16 :framerate	# XXX bigendian...
+		u16 :framecount
+
+		def bswap_framerate(swf)
+			@framerate = ((@framerate >> 8) & 0xff) | ((@framerate & 0xff) << 8) if swf.endianness == :little
+		end
+
+		def decode(swf)
+			@view = Rectangle.decode(swf)
+			super(swf)
+			bswap_framerate(swf)
+		end
+
+		def encode(swf)
+			ed = @view.encode(swf)
+			bswap_framerate(swf)
+			ed << super(swf)
+			bswap_framerate(swf)
+			ed
+		end
+	end
+
+	class Chunk < SerialStruct
+		bitfield :u16, 0 => :length_, 6 => :tag
+		fld_enum :tag, CHUNK_TYPE
+		attr_accessor :data
+
+		def decode(swf)
+			super(swf)
+			@length = (@length_ == 0x3f ? swf.decode_u32 : @length_)
+			@data = swf.encoded.read(@length)
+		end
+
+		def set_default_values(swf)
+			@length = @data.length
+			@length_ = [@length, 0x3f].min
+		end
+
+		def encode(swf)
+			super(swf) <<
+			(swf.encode_u32(@length) if @length >= 0x3f) <<
+			@data
+		end
+	end
+
+	def decode_u8( edata=@encoded) edata.decode_imm(:u8,  @endianness) end
+	def decode_u16(edata=@encoded) edata.decode_imm(:u16, @endianness) end
+	def decode_u32(edata=@encoded) edata.decode_imm(:u32, @endianness) end
+	def decode_f16(edata=@encoded) edata.decode_imm(:i16, @endianness)/256.0 end
+	def decode_f32(edata=@encoded) edata.decode_imm(:i32, @endianness)/65536.0 end
+	def encode_u8(w)  Expression[w].encode(:u8,  @endianness) end
+	def encode_u16(w) Expression[w].encode(:u16, @endianness) end
+	def encode_u32(w) Expression[w].encode(:u32, @endianness) end
+	def encode_f16(w) Expression[(w*256).to_i].encode(:u16, @endianness) end
+	def encode_f32(w) Expression[(w*65536).to_i].encode(:u32, @endianness) end
+	def sizeof_u8 ; 1 ; end
+	def sizeof_u16 ; 2 ; end
+	def sizeof_u32 ; 4 ; end
+	def sizeof_f16 ; 2 ; end
+	def sizeof_f32 ; 4 ; end
+
+	attr_accessor :endianness
+	def initialize(cpu = nil)
+		@endianness = :little
+		@header = Header.new
+		@chunks = []
+		super(cpu)
+	end
+
+	def decode_header
+		@signature = @encoded.read(3)
+		@version = decode_u8
+		@data_length = decode_u32
+		case @signature
+		when 'FWS'
+		when 'CWS'
+			# data_length = uncompressed data length
+			data = @encoded.read(@encoded.length-8)
+			data = Zlib::Inflate.inflate(data)
+			@encoded = EncodedData.new(data)
+		else raise InvalidExeFormat, "Bad signature #{@signature.inspect}"
+		end
+		@data_length = [@data_length, @encoded.length].min
+		@header = Header.decode(self)
+	end
+
+	def decode
+		decode_header
+		while @encoded.ptr < @data_length
+			@chunks << Chunk.decode(self)
+		end
+	end
+end
+end

data/metasm/exe_format/wasm.rb

@@ -0,0 +1,402 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+
+
+module Metasm
+# WebAssembly
+# leb integer encoding taken from dex.rb
+class WasmFile < ExeFormat
+	MAGIC = "\0asm"
+	MAGIC.force_encoding('binary') if MAGIC.respond_to?(:force_encoding)
+
+	SECTION_NAME = { 1 => 'Type', 2 => 'Import', 3 => 'Function', 4 => 'Table',
+		         5 => 'Memory', 6 => 'Global', 7 => 'Export', 8 => 'Start',
+			 9 => 'Element', 10 => 'Code', 11 => 'Data' }
+
+	TYPE = { -1 => 'i32', -2 => 'i64', -3 => 'f32', -4 => 'f64',
+		 -0x10 => 'anyfunc', -0x20 => 'func', -0x40 => 'none' }
+
+	EXTERNAL_KIND = { 0 => 'function', 1 => 'table', 2 => 'memory', 3 => 'global' }
+
+	# begin WTF
+	OPCODE_IMM_COUNT = Hash.new(0)
+	[2, 3, 4, 0xc, 0xd, 0x10].each { |op| OPCODE_IMM_COUNT[op] = 1 }
+	OPCODE_IMM_COUNT[0x11] = 2
+	(0x20..0x24).each { |op| OPCODE_IMM_COUNT[op] = 1 }
+	(0x28..0x3e).each { |op| OPCODE_IMM_COUNT[op] = 2 }
+	(0x3f..0x42).each { |op| OPCODE_IMM_COUNT[op] = 1 }
+	# 0x43 followed by uint32, 0x44 followed by uint64 (float constants)
+	# end WTF
+
+
+	class SerialStruct < Metasm::SerialStruct
+		# TODO move uleb/sleb to new_field for sizeof
+		new_int_field :u4, :uleb, :sleb
+	end
+
+	class Header < SerialStruct
+		mem :sig, 4, MAGIC
+		decode_hook { |exe, hdr| raise InvalidExeFormat, "E: invalid WasmFile signature #{hdr.sig.inspect}" if hdr.sig != MAGIC }
+		u4 :ver, 1
+	end
+
+	class Module < SerialStruct
+		uleb :id
+		fld_enum :id, SECTION_NAME
+		uleb :payload_len
+		attr_accessor :edata, :raw_offset, :name
+
+		def decode(exe)
+			super(exe)
+			@raw_offset = exe.encoded.ptr
+			@edata = exe.encoded[exe.encoded.ptr, @payload_len]
+			exe.encoded.ptr += @payload_len
+		end
+	end
+
+	attr_accessor :endianness
+
+	def encode_u4(val) Expression[val].encode(:u32, @endianness) end
+	def decode_u4(edata = @encoded) edata.decode_imm(:u32, @endianness) end
+	def sizeof_u4 ; 4 ; end
+	def encode_uleb(val, signed=false)
+		v = val
+		out = EncodedData.new
+		while v > 0x7f or v < -0x40 or (signed and v > 0x3f)
+			out << Expression[0x80 | (v&0x7f)].encode(:u8, @endianness)
+			v >>= 7
+		end
+		out << Expression[v & 0x7f].encode(:u8, @endianness)
+	end
+	def decode_uleb(ed = @encoded, signed=false)
+		v = s = 0
+		while s < 10*7
+			b = ed.read(1).unpack('C').first.to_i
+			v |= (b & 0x7f) << s
+			s += 7
+			break if (b&0x80) == 0
+		end
+		v = Expression.make_signed(v, s) if signed
+		v
+	end
+	def encode_sleb(val) encode_uleb(val, true) end
+	def decode_sleb(ed = @encoded) decode_uleb(ed, true) end
+	attr_accessor :header, :modules, :type, :import, :function_signature,
+		:table, :memory, :global, :export, :start_function_index,
+		:element, :function_body, :data, :code_info
+
+	def initialize(endianness=:little)
+		@endianness = endianness
+		@encoded = EncodedData.new
+		super()
+	end
+
+	def decode_type(edata=@encoded)
+		form = decode_sleb(edata)
+		type = TYPE[form] || "unk_type_#{form}"
+		if type == 'func'
+			type = { :params => [], :ret => [] }
+			decode_uleb(edata).times {
+				type[:params] << decode_type(edata)
+			}
+			decode_uleb(edata).times {
+				type[:ret] << decode_type(edata)
+			}
+		end
+		type
+	end
+
+	# return the nth global
+	# use the @global array and the @import array
+	def get_global_nr(nr)
+		glob_imports = @import.to_a.find_all { |i| i[:kind] == 'global' }
+		return glob_imports[nr] if nr < glob_imports.length
+		nr -= glob_imports.length
+		@global[nr]
+	end
+
+	# return the nth function body
+	# use the @function_body array and the @import array
+	def get_function_nr(nr)
+		func_imports = @import.to_a.find_all { |i| i[:kind] == 'function' }
+		return func_imports[nr] if nr < func_imports.length
+		nr -= func_imports.length
+		@function_body[nr]
+	end
+
+	def type_to_s(t)
+		return t unless t.kind_of?(::Hash)
+		(t[:ret].map { |tt| type_to_s(tt) }.join(', ') << ' f(' << t[:params].map { |tt| type_to_s(tt) }.join(', ') << ')').strip
+	end
+
+	def decode_limits(edata=@encoded)
+		flags = decode_uleb(edata)
+		out = { :initial_size => decode_uleb(edata) }
+		out[:maximum] = decode_uleb(edata) if flags & 1
+		out
+	end
+
+	# wtf
+	# read wasm bytecode until reaching the end opcode
+	# return the byte offset
+	def read_code_until_end(m=nil)
+		if m
+			raw_offset = m.raw_offset + m.edata.ptr
+			edata = m.edata
+		else
+			edata = @encoded
+		end
+
+		while op = edata.decode_imm(:u8, @endianness)
+			case op
+			when 0xb
+				# end opcode
+				return raw_offset
+			when 0xe
+				# indirect branch wtf
+				decode_uleb(edata).times { decode_uleb(edata) }
+				decode_uleb(edata)
+			when 0x43
+				edata.read(4)
+			when 0x44
+				edata.read(8)
+			else
+				OPCODE_IMM_COUNT[op].times { decode_uleb(edata) }
+			end
+		end
+		raw_offset
+	end
+
+	def decode_header
+		@header = Header.decode(self)
+		@modules = []
+	end
+
+	def decode
+		decode_header
+		while @encoded.ptr < @encoded.length
+			@modules << Module.decode(self)
+		end
+		@modules.each { |m|
+			@encoded.add_export(new_label("module_#{m.id}"), m.raw_offset)
+			f = "decode_module_#{m.id.to_s.downcase}"
+			send(f, m) if respond_to?(f)
+		}
+		func_imports = @import.to_a.find_all { |i| i[:kind] == 'function' }
+		export.to_a.each { |e|
+			next if e[:kind] != 'function'	# TODO resolve init_offset for globals etc?
+			idx = e[:index] - func_imports.length
+			next if not fb = function_body.to_a[idx]
+			@encoded.add_export(new_label(e[:field]), fb[:init_offset], true)
+		}
+		# bytecode start addr => { :local_var => [], :params => [], :ret => [] }
+		# :local_var absent for external code (imported funcs)
+		@code_info = {}
+		import.to_a.each { |i|
+			next unless i[:kind] == 'function'
+			@code_info["#{i[:module]}_#{i[:field]}"] = { :params => i[:type][:params], :ret => i[:type][:ret] }
+		}
+		function_body.to_a.each { |fb|
+			@code_info[fb[:init_offset]] = { :local_var => fb[:local_var], :params => fb[:type][:params], :ret => fb[:type][:ret] }
+		}
+		global_idx = import.to_a.find_all { |i| i[:kind] == 'global' }.length - 1
+		global.to_a.each { |g|
+			@code_info[g[:init_offset]] = { :local_var => [], :params => [], :ret => [g[:type]] }
+			@encoded.add_export new_label("global_#{global_idx += 1}_init"), g[:init_offset]
+		}
+		element.to_a.each { |e|
+			@code_info[e[:init_offset]] = { :local_var => [], :params => [], :ret => ['i32'] }
+		}
+		data.to_a.each { |d|
+			@code_info[d[:init_offset]] = { :local_var => [], :params => [], :ret => ['i32'] }
+		}
+	end
+
+	def decode_module_type(m)
+		@type = []
+		decode_uleb(m.edata).times {
+			@type << decode_type(m.edata)
+		}
+	end
+
+	def decode_module_import(m)
+		@import = []
+		decode_uleb(m.edata).times {
+			i = {}
+			i[:module] = m.edata.read(decode_uleb(m.edata))
+			i[:field] = m.edata.read(decode_uleb(m.edata))
+			kind = decode_uleb(m.edata)
+			i[:kind] = EXTERNAL_KIND[kind] || kind
+			case i[:kind]
+			when 'function'
+				i[:type] = @type[decode_uleb(m.edata)]	# XXX keep index only, in case @type is not yet known ?
+			when 'table'
+				i[:type] = decode_type(m.edata)
+				i[:limits] = decode_limits(m.edata)
+			when 'memory'
+				i[:limits] = decode_limits(m.edata)
+			when 'global'
+				i[:type] = decode_type(m.edata)
+				i[:mutable] = decode_uleb(m.edata)
+			end
+			@import << i
+		}
+	end
+
+	def decode_module_function(m)
+		@function_signature = []
+		idx = 0
+		decode_uleb(m.edata).times {
+			@function_signature << @type[decode_uleb(m.edata)]
+			@function_body[idx][:type] = @function_signature[idx] if function_body
+			idx += 1
+		}
+	end
+
+	def decode_module_table(m)
+		@table = []
+		decode_uleb(m.edata).times {
+			@table << { :type => decode_type(m.edata), :limits => decode_limits(m.edata) }
+		}
+	end
+
+	def decode_module_memory(m)
+		@memory = []
+		decode_uleb(m.edata).times {
+			@memory << { :limits => decode_limits(m.edata) }
+		}
+	end
+
+	def decode_module_global(m)
+		@global = []
+		decode_uleb(m.edata).times {
+			@global << { :type => decode_type(m.edata), :mutable => decode_uleb(m.edata), :init_offset => read_code_until_end(m) }
+		}
+	end
+
+	def decode_module_export(m)
+		@export = []
+		decode_uleb(m.edata).times {
+			flen = decode_uleb(m.edata)
+			fld = m.edata.read(flen)
+			kind = decode_uleb(m.edata)
+			kind = EXTERNAL_KIND[kind] || kind
+			index = decode_uleb(m.edata)
+			@export << { :field => fld, :kind => kind, :index => index }
+		}
+	end
+
+	def decode_module_start(m)
+		@start_function_index = decode_uleb(m.edata)
+	end
+
+	def decode_module_element(m)
+		@element = []
+		decode_uleb(m.edata).times {
+			seg = { :table_index => decode_uleb(m.edata),
+				:init_offset => read_code_until_end(m),
+				:elems => [] }
+			decode_uleb(m.edata).times {
+				seg[:elems] << decode_uleb(m.edata)
+			}
+			@element << seg
+			@encoded.add_export new_label("element_#{@element.length-1}_init_addr"), @element.last[:init_offset]
+		}
+	end
+
+	def decode_module_code(m)
+		@function_body = []
+		idx = 0
+		decode_uleb(m.edata).times {
+			local_vars = []
+			body_size = decode_uleb(m.edata)	# size of local defs + bytecode (in bytes)
+			next_ptr = m.edata.ptr + body_size
+			decode_uleb(m.edata).times {		# nr of local vars types
+				n_vars_of_this_type = decode_uleb(m.edata)	# nr of local vars of this type
+				type = decode_type(m.edata)	# actual type
+				n_vars_of_this_type.times {
+					local_vars << type
+				}
+			}
+			code_offset = m.raw_offset + m.edata.ptr	# bytecode comes next
+			m.edata.ptr = next_ptr
+			@function_body << { :local_var => local_vars, :init_offset => code_offset }
+			@function_body.last[:type] = @function_signature[idx] if function_signature
+			@encoded.add_export new_label("function_#{@function_body.length-1}"), @function_body.last[:init_offset]
+			idx += 1
+		}
+	end
+
+	def decode_module_data(m)
+		@data = []
+		decode_uleb(m.edata).times {
+			idx = decode_uleb(m.edata)
+			initoff = read_code_until_end(m)
+			data_len = decode_uleb(m.edata)
+			data_start_ptr = m.raw_offset + m.edata.ptr
+			data = m.edata.read(data_len)
+			data_end_ptr = m.raw_offset + m.edata.ptr
+
+			@data << { :index => idx, :init_offset => initoff, :data => data }
+			@encoded.add_export new_label("data_#{@data.length-1}_init_addr"), initoff
+			@encoded.add_export new_label("data_#{@data.length-1}_start"), data_start_ptr
+			@encoded.add_export new_label("data_#{@data.length-1}_end"), data_end_ptr
+		}
+	end
+
+	def decode_module_0(m)
+		# id == 0 for not well-known modules
+		# the module name is encoded at start of payload (uleb name length + actual name)
+		m.name = m.edata.read(decode_uleb(m.edata))
+		f = "decode_module_0_#{m.name.downcase}"
+		send(f, m) if respond_to?(f)
+	end
+
+	def decode_module_0_name(m)
+		# TODO parse stored names of local variables etc
+	end
+
+	def cpu_from_headers
+		WebAsm.new(self)
+	end
+
+	def init_disassembler
+		dasm = super()
+		function_body.to_a.each { |fb|
+			v = []
+			fb[:local_var].map { |lv| type_to_s(lv) }.each { |lv|
+				v.last && lv == v.last.last ? v.last << lv : v << [lv]
+			}
+			v.map! { |sublist|
+				# i32 ; i32 ; i32 ; i32 ; i32 ; i32 ; i64  ->  5 * i32 ; i64
+				sublist.length > 3 ? "#{sublist.length} * #{sublist.first}" : sublist.join(' ; ')
+			}
+			dasm.add_comment fb[:init_offset], "proto: #{fb[:type] ? type_to_s(fb[:type]) : 'unknown'}"
+			dasm.add_comment fb[:init_offset], "vars: #{v.join(' ; ')}"
+		}
+		global.to_a.each { |g|
+			dasm.add_comment g[:init_offset], "type: #{type_to_s(g[:type])}"
+		}
+		dasm.function[:default] = @cpu.disassembler_default_func
+		dasm
+	end
+
+	def each_section
+		yield @encoded, 0
+	end
+
+	def get_default_entrypoints
+		global.to_a.map { |g| g[:init_offset] } +
+		element.to_a.map { |e| e[:init_offset] } +
+		data.to_a.map { |d| d[:init_offset] } +
+		function_body.to_a.map { |f| f[:init_offset] }
+	end
+end
+end