metasm 1.0.1 → 1.0.2

data/{lib/metasm/ppc.rb → metasm/cpu/bpf.rb}

@@ -5,7 +5,5 @@
 
 
 require 'metasm/main'
-require 'metasm/ppc/parse'
-require 'metasm/ppc/encode'
-require 'metasm/ppc/decode'
-require 'metasm/ppc/decompile'
+require 'metasm/cpu/bpf/decode'
+require 'metasm/cpu/bpf/render'

data/metasm/cpu/bpf/decode.rb

@@ -0,0 +1,142 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/bpf/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class BPF
+	def build_bin_lookaside
+		opcode_list.inject({}) { |h, op| h.update op.bin => op }
+	end
+
+	# tries to find the opcode encoded at edata.ptr
+	def decode_findopcode(edata)
+		return if edata.ptr > edata.data.length-8
+		di = DecodedInstruction.new self
+		code = edata.data[edata.ptr, 2].unpack('v')[0]
+		return di if di.opcode = @bin_lookaside[code]
+	end
+
+	def decode_instr_op(edata, di)
+		op = di.opcode
+		di.instruction.opname = op.name
+		di.bin_length = 8
+		code, jt, jf, k = edata.read(8).unpack('vCCV')
+
+		op.args.each { |a|
+			di.instruction.args << case a
+			when :k;    Expression[k]
+			when :x;    Reg.new(:x)
+			when :a;    Reg.new(:a)
+			when :len;  Reg.new(:len)
+			when :p_k;  PktRef.new(nil, Expression[k], op.props[:msz])
+			when :p_xk; PktRef.new(Reg.new(:x), Expression[k], op.props[:msz])
+			when :m_k;  MemRef.new(nil, Expression[4*k], 4)
+			when :jt;   Expression[jt]
+			when :jf;   Expression[jf]
+			else raise "unhandled arg #{a}"
+			end
+		}
+
+		# je a, x, 0, 12 -> jne a, x, 12
+		# je a, x, 12, 0 -> je a, x, 12
+		if op.args[2] == :jt and di.instruction.args[2] == Expression[0]
+			di.opcode = op.dup
+			di.opcode.props.delete :stopexec
+			di.instruction.opname = { 'jg' => 'jle', 'jge' => 'jl', 'je' => 'jne', 'jtest' => 'jntest' }[di.instruction.opname]
+			di.instruction.args.delete_at(2)
+		elsif op.args[3] == :jf and di.instruction.args[3] == Expression[0]
+			di.opcode = op.dup
+			di.opcode.props.delete :stopexec
+			di.instruction.args.delete_at(3)
+		end
+
+		di
+	end
+
+	def decode_instr_interpret(di, addr)
+		if di.opcode.props[:setip]
+			delta = di.instruction.args[-1].reduce + 1
+			arg = Expression[addr, :+, 8*delta].reduce
+			di.instruction.args[-1] = Expression[arg]
+
+			if di.instruction.args.length == 4
+				delta = di.instruction.args[2].reduce + 1
+				arg = Expression[addr, :+, 8*delta].reduce
+				di.instruction.args[2] = Expression[arg]
+			end
+		end
+
+		di
+	end
+
+	# hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }
+	def backtrace_binding
+		@backtrace_binding ||= init_backtrace_binding
+	end
+	def backtrace_binding=(b) @backtrace_binding = b end
+
+	# populate the @backtrace_binding hash with default values
+	def init_backtrace_binding
+		@backtrace_binding ||= {}
+
+		opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
+			binding = case op
+			when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+			when 'add'; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1] } }
+			when 'sub'; lambda { |di, a0, a1| { a0 => Expression[a0, :-, a1] } }
+			when 'mul'; lambda { |di, a0, a1| { a0 => Expression[a0, :*, a1] } }
+			when 'div'; lambda { |di, a0, a1| { a0 => Expression[a0, :/, a1] } }
+			when 'shl'; lambda { |di, a0, a1| { a0 => Expression[a0, :<<, a1] } }
+			when 'shr'; lambda { |di, a0, a1| { a0 => Expression[a0, :>>, a1] } }
+			when 'neg'; lambda { |di, a0| { a0 => Expression[:-, a0] } }
+			when 'msh'; lambda { |di, a0, a1| { a0 => Expression[[a1, :&, 0xf], :<<, 2] } }
+			when 'jmp', 'jg', 'jge', 'je', 'jtest', 'ret'; lambda { |di, *a| { } }
+			end
+			@backtrace_binding[op] ||= binding if binding
+		}
+
+		@backtrace_binding
+	end
+
+	def get_backtrace_binding(di)
+		a = di.instruction.args.map { |arg|
+			case arg
+			when PktRef, MemRef, Reg; arg.symbolic(di)
+			else arg
+			end
+		}
+
+		if binding = backtrace_binding[di.opcode.name]
+			binding[di, *a]
+		else
+			puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+			{:incomplete_binding => Expression[1]}
+		end
+	end
+
+	def get_xrefs_x(dasm, di)
+		return [] if not di.opcode.props[:setip]
+
+		if di.instruction.args.length == 4
+			di.instruction.args[-2, 2]
+		else
+			di.instruction.args[-1, 1]
+		end
+	end
+
+	# updates an instruction's argument replacing an expression with another (eg label renamed)
+	def replace_instr_arg_immediate(i, old, new)
+		i.args.map! { |a|
+			case a
+			when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+			else a
+			end
+		}
+	end
+end
+end

data/metasm/cpu/bpf/main.rb

@@ -0,0 +1,60 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class BPF < CPU
+	class Reg
+		attr_accessor :v
+		def initialize(v)
+			@v = v
+		end
+
+		def symbolic(orig=nil) ; @v ; end
+	end
+
+	class MemRef
+		attr_accessor :base, :offset, :msz
+
+		def memtype
+			:mem
+		end
+
+		def initialize(base, offset, msz)
+			@base = base
+			@offset = offset
+			@msz = msz
+		end
+
+		def symbolic(orig)
+			p = Expression[memtype]
+			p = Expression[p, :+, @base.symbolic] if base
+			p = Expression[p, :+, @offset] if offset
+			Indirection[p, @msz, orig]
+		end
+	end
+
+	class PktRef < MemRef
+		def memtype
+			:pkt
+		end
+	end
+
+	def initialize(family = :latest)
+		super()
+		@endianness = :big
+		@size = 32
+		@family = family
+	end
+
+	def init_opcode_list
+		send("init_#@family")
+		@opcode_list
+	end
+end
+end
+

data/metasm/cpu/bpf/opcodes.rb

@@ -0,0 +1,81 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/bpf/main'
+
+module Metasm
+
+class BPF
+	def addop(name, bin, *args)
+		o = Opcode.new name, bin
+		args.each { |a|
+			o.args << a if @valid_args[a]
+			o.props.update a if a.kind_of?(::Hash)
+		}
+		@opcode_list << o
+	end
+
+	def addop_ldx(bin, src)
+		addop 'mov', bin | 0x00, :a, src
+		addop 'mov', bin | 0x01, :x, src
+	end
+
+	def addop_ldsz(bin, src)
+		addop 'mov', bin | 0x00, :a, src, :msz => 4
+		addop 'mov', bin | 0x08, :a, src, :msz => 2
+		addop 'mov', bin | 0x10, :a, src, :msz => 1
+	end
+
+	def addop_alu(name, bin)
+		addop name, bin | 0x04, :a, :k
+		addop name, bin | 0x0C, :a, :x
+	end
+
+	def addop_j(name, bin)
+		addop name, bin | 0x05 | 0x00, :a, :k, :jt, :jf, :setip => true, :stopexec => true
+		addop name, bin | 0x05 | 0x08, :a, :x, :jt, :jf, :setip => true, :stopexec => true
+	end
+
+	def init_bpf
+		@opcode_list = []
+		[:a, :k, :x, :len, :m_k, :p_k, :p_xk, :jt, :jf].each { |a| @valid_args[a] = true }
+
+		# LD/ST
+		addop_ldx  0x00, :k
+		addop_ldsz 0x20, :p_k
+		addop_ldsz 0x40, :p_xk
+		addop_ldx  0x60, :m_k
+		addop_ldx  0x80, :len
+		addop 'msh', 0xB1, :x, :p_k, :msz => 1
+		addop 'mov', 0x02, :m_k, :a
+		addop 'mov', 0x03, :m_k, :x
+
+		# ALU
+		addop_alu 'add', 0x00
+		addop_alu 'sub', 0x10
+		addop_alu 'mul', 0x20
+		addop_alu 'div', 0x30
+		addop_alu 'or',  0x40
+		addop_alu 'and', 0x50
+		addop_alu 'shl', 0x60
+		addop_alu 'shr', 0x70
+		addop 'neg', 0x84, :a
+
+		# JMP
+		addop   'jmp',  0x05, :k, :setip => true, :stopexec => true
+		addop_j 'je',   0x10
+		addop_j 'jg',   0x20
+		addop_j 'jge',  0x30
+		addop_j 'jtest',0x40
+		addop   'ret',  0x06, :k, :stopexec => true
+		addop   'ret',  0x16, :a, :stopexec => true
+
+		addop 'mov', 0x07, :x, :a
+		addop 'mov', 0x87, :a, :x
+	end
+
+	alias init_latest init_bpf
+end
+end

data/metasm/cpu/bpf/render.rb

@@ -0,0 +1,41 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/bpf/opcodes'
+require 'metasm/render'
+
+module Metasm
+class BPF
+	class Reg
+		include Renderable
+		def render ; [@v.to_s] end
+	end
+	class MemRef
+		include Renderable
+		def render
+			r = []
+			r << memtype
+			r << [nil, ' byte ', ' word ', nil, ' dword '][@msz]
+			r << '['
+			r << @base if @base
+			r << '+' if @base and @offset
+			r << @offset if @offset
+			r << ']'
+		end
+	end
+
+	def render_instruction(i)
+		r = []
+		r << i.opname
+		if not i.args.empty?
+			r << ' '
+			i.args.each { |a_| r << a_ << ', ' }
+			r.pop
+		end
+		r
+	end
+end
+end

data/metasm/cpu/cy16.rb

@@ -0,0 +1,9 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/cy16/decode'
+require 'metasm/cpu/cy16/render'

data/metasm/cpu/cy16/decode.rb

@@ -0,0 +1,253 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/cy16/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class CY16
+	def build_opcode_bin_mask(op)
+		# bit = 0 if can be mutated by an field value, 1 if fixed by opcode
+		op.bin_mask = 0
+		op.fields.each { |f, off|
+			op.bin_mask |= (@fields_mask[f] << off)
+		}
+		op.bin_mask ^= 0xffff
+	end
+
+	def build_bin_lookaside
+		# sets up a hash byte value => list of opcodes that may match
+		# opcode.bin_mask is built here
+		lookaside = Array.new(256) { [] }
+		opcode_list.each { |op|
+			build_opcode_bin_mask op
+			b   = (op.bin >> 8) & 0xff
+			msk = (op.bin_mask >> 8) & 0xff
+			for i in b..(b | (255^msk))
+				lookaside[i] << op if i & msk == b & msk
+			end
+		}
+		lookaside
+	end
+
+	def decode_findopcode(edata)
+		di = DecodedInstruction.new self
+		return if edata.ptr+2 > edata.length
+		bin = edata.decode_imm(:u16, @endianness)
+		edata.ptr -= 2
+		return di if di.opcode = @bin_lookaside[(bin >> 8) & 0xff].find { |op|
+			bin & op.bin_mask == op.bin & op.bin_mask
+		}
+	end
+
+
+	def decode_instr_op_r(val, edata)
+		bw = ((val & 0b1000) > 0 ? 1 : 2)
+		case val & 0b11_0000
+		when 0b00_0000
+			Reg.new(val)
+		when 0b01_0000
+			if val == 0b01_1111
+				Expression[edata.decode_imm(:u16, @endianness)]
+			else
+				Memref.new(Reg.new(8+(val&7)), nil, bw)
+			end
+		when 0b10_0000
+			if val & 7 == 7
+				Memref.new(nil, edata.decode_imm(:u16, @endianness), bw)
+			else
+				Memref.new(Reg.new(8+(val&7)), nil, bw, true)
+			end
+		when 0b11_0000
+			Memref.new(Reg.new(8+(val&7)), edata.decode_imm(:u16, @endianness), bw)
+		end
+
+	end
+
+	def decode_instr_op(edata, di)
+		before_ptr = edata.ptr
+		op = di.opcode
+		di.instruction.opname = op.name
+		bin = edata.decode_imm(:u16, @endianness)
+
+		field_val = lambda { |f|
+			if off = op.fields[f]
+				(bin >> off) & @fields_mask[f]
+			end
+		}
+
+		op.args.each { |a|
+			di.instruction.args << case a
+			when :rs, :rd; decode_instr_op_r(field_val[a], edata)
+			when :o7; Expression[2*Expression.make_signed(field_val[a], 7)]
+			when :x7; Expression[field_val[a]]
+			when :u3; Expression[field_val[a]+1]
+			else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
+			end
+		}
+
+		di.instruction.args.reverse!
+
+		di.bin_length += edata.ptr - before_ptr
+
+		di
+	rescue InvalidRD
+	end
+
+	def decode_instr_interpret(di, addr)
+		if di.opcode.props[:setip] and di.opcode.args.last == :o7
+			delta = di.instruction.args.last.reduce
+			arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
+			di.instruction.args[-1] = Expression[arg]
+		end
+
+		di
+	end
+
+	# hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }
+	def backtrace_binding
+		@backtrace_binding ||= init_backtrace_binding
+	end
+	def backtrace_binding=(b) @backtrace_binding = b end
+
+	# populate the @backtrace_binding hash with default values
+	def init_backtrace_binding
+		@backtrace_binding ||= {}
+
+		mask = 0xffff
+
+		opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
+			binding = case op
+			when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+			when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or', 'addi', 'subi'
+				lambda { |di, a0, a1|
+					e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&,
+						 'xor' => :^, 'or' => :|, 'addi' => :+, 'subi' => :- }[op]
+					ret = Expression[a0, e_op, a1]
+					ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbb'
+					# optimises eax ^ eax => 0
+					# avoid hiding memory accesses (to not hide possible fault)
+					ret = Expression[ret.reduce] if not a0.kind_of? Indirection
+					{ a0 => ret }
+				}
+			when 'cmp', 'test'; lambda { |di, *a| {} }
+			when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } }
+			when 'call'
+				lambda { |di, a0| { :sp => Expression[:sp, :-, 2],
+					  Indirection[:sp, 2, di.address] => Expression[di.next_addr] }
+				}
+			when 'ret'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } }
+			# TODO callCC, retCC ...
+			when /^j/; lambda { |di, *a| {} }
+			end
+
+			# TODO flags ?
+
+			@backtrace_binding[op] ||= binding if binding
+		}
+		@backtrace_binding
+	end
+
+	def get_backtrace_binding(di)
+		a = di.instruction.args.map { |arg|
+			case arg
+			when Memref, Reg; arg.symbolic(di)
+			else arg
+			end
+		}
+
+		if binding = backtrace_binding[di.opcode.basename]
+			bd = {}
+			di.instruction.args.each { |aa| bd[aa.base.symbolic] = Expression[aa.base.symbolic, :+, aa.sz] if aa.kind_of?(Memref) and aa.autoincr }
+			bd.update binding[di, *a]
+		else
+			puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+			# assume nothing except the 1st arg is modified
+			case a[0]
+			when Indirection, Symbol; { a[0] => Expression::Unknown }
+			when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {}
+			else {}
+			end.update(:incomplete_binding => Expression[1])
+		end
+	end
+
+	# patch a forward binding from the backtrace binding
+	def fix_fwdemu_binding(di, fbd)
+		case di.opcode.name
+		when 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2])
+		end
+		fbd
+	end
+
+	def get_xrefs_x(dasm, di)
+		return [] if not di.opcode.props[:setip]
+
+		return [Indirection[:sp, 2, di.address]] if di.opcode.name =~ /^r/
+
+		case tg = di.instruction.args.first
+		when Memref; [Expression[tg.symbolic(di)]]
+		when Reg; [Expression[tg.symbolic(di)]]
+		when Expression, ::Integer; [Expression[tg]]
+		else
+			puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG
+			[]
+		end
+	end
+
+	# checks if expr is a valid return expression matching the :saveip instruction
+	def backtrace_is_function_return(expr, di=nil)
+		expr = Expression[expr].reduce_rec
+		expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp]
+	end
+
+	# updates the function backtrace_binding
+	# if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand)
+	def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
+		b = f.backtrace_binding
+
+		bt_val = lambda { |r|
+			next if not retaddrlist
+			b[r] = Expression::Unknown
+			bt = []
+			retaddrlist.each { |retaddr|
+				bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true,
+					     :snapshot_addr => faddr, :origin => retaddr)
+			}
+			if bt.length != 1
+				b[r] = Expression::Unknown
+			else
+				b[r] = bt.first
+			end
+		}
+
+		if not wantregs.empty?
+			wantregs.each(&bt_val)
+		else
+			bt_val[:sp]
+		end
+
+		b
+	end
+
+	# returns true if the expression is an address on the stack
+	def backtrace_is_stack_address(expr)
+		Expression[expr].expr_externals.include?(:sp)
+	end
+
+	# updates an instruction's argument replacing an expression with another (eg label renamed)
+	def replace_instr_arg_immediate(i, old, new)
+		i.args.map! { |a|
+			case a
+			when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+			when Memref
+				a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset
+				a
+			else a
+			end
+		}
+	end
+end
+end