metasm 1.0.1 → 1.0.2

data/metasm/cpu/cy16/main.rb

@@ -0,0 +1,63 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class CY16 < CPU
+	class Reg
+		class << self
+			attr_accessor :s_to_i, :i_to_s
+		end
+		@i_to_s = (0..14).inject({}) { |h, i| h.update i => "r#{i}" }
+		@i_to_s[15] = 'sp'
+		@s_to_i = @i_to_s.invert
+
+		attr_accessor :i
+		def initialize(i)
+			@i = i
+		end
+
+		def symbolic(orig=nil) ; to_s.to_sym ; end
+
+		def self.from_str(s)
+			raise "Bad name #{s.inspect}" if not x = @s_to_i[s]
+			new(x)
+		end
+	end
+
+	class Memref
+		attr_accessor :base, :offset, :sz, :autoincr
+		def initialize(base, offset, sz=nil, autoincr=nil)
+			@base = base
+			offset = Expression[offset] if offset
+			@offset = offset
+			@sz = sz
+			@autoincr = autoincr
+		end
+
+		def symbolic(orig)
+			p = nil
+			p = Expression[p, :+, @base.symbolic] if base
+			p = Expression[p, :+, @offset] if offset
+			Indirection[p.reduce, @sz, orig]
+		end
+	end
+
+	def initialize(family = :latest)
+		super()
+		@endianness = :little
+		@size = 16
+		@family = family
+	end
+
+	def init_opcode_list
+		send("init_#@family")
+		@opcode_list
+	end
+end
+end
+

data/metasm/cpu/cy16/opcodes.rb

@@ -0,0 +1,78 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/cy16/main'
+
+module Metasm
+
+class CY16
+	def addop(name, bin, *args)
+		o = Opcode.new name, bin
+		args.each { |a|
+			o.args << a if @fields_mask[a] or @valid_args[a]
+			o.props[a] = true if @valid_props[a]
+			o.fields[a] = @fields_shift[a] if @fields_mask[a]
+			raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a]
+		}
+		@opcode_list << o
+	end
+
+	def addop_macrocc(name, bin, *args)
+		%w[z nz b ae s ns o no a be g ge l le].each_with_index { |cc, i|
+			dbin = bin
+			dbin |= i << 8
+			addop name + cc, dbin, *args
+		}
+	end
+
+	def init_cy16
+		@opcode_list = []
+		@valid_args.update [:rs, :rd, :o7
+		].inject({}) { |h, v| h.update v => true }
+		@fields_mask.update :rs => 0x3f, :rd => 0x3f, :o7 => 0x7f, :x7 => 0x7f, :u3 => 7
+		@fields_shift.update :rs => 6, :rd => 0, :o7 => 0, :x7 => 0, :u3 => 6
+
+		addop 'mov', 0<<12, :rs, :rd
+		addop 'add', 1<<12, :rs, :rd
+		addop 'adc', 2<<12, :rs, :rd
+		addop 'addc',2<<12, :rs, :rd
+		addop 'sub', 3<<12, :rs, :rd
+		addop 'sbb', 4<<12, :rs, :rd
+		addop 'subb',4<<12, :rs, :rd
+		addop 'cmp', 5<<12, :rs, :rd
+		addop 'and', 6<<12, :rs, :rd
+		addop 'test',7<<12, :rs, :rd
+		addop 'or',  8<<12, :rs, :rd
+		addop 'xor', 9<<12, :rs, :rd
+
+		addop_macrocc 'int', (10<<12), :x7
+		addop 'int', (10<<12) | (15<<8), :x7
+		addop_macrocc 'c', (10<<12) | (1<<7), :setip, :saveip, :rd
+		addop 'call',(10<<12) | (15<<8) | (1<<7), :setip, :stopexec, :saveip, :rd
+		addop_macrocc 'r', (12<<12) | (1<<7) | 0b010111, :setip	# must come before absolute jmp
+		addop 'ret', (12<<12) | (15<<8) | (1<<7) | 0b010111, :setip, :stopexec
+		addop_macrocc 'j', (12<<12), :setip, :o7	# relative
+		addop 'jmp', (12<<12) | (15<<8), :setip, :stopexec, :o7	# relative
+		addop_macrocc 'j', (12<<12) | (1<<7), :setip, :rd	# absolute
+		addop 'jmp', (12<<12) | (15<<8) | (1<<7), :setip, :stopexec, :rd	# absolute
+
+		addop 'shr', (13<<12) | (0<<9), :u3, :rd
+		addop 'shl', (13<<12) | (1<<9), :u3, :rd
+		addop 'ror', (13<<12) | (2<<9), :u3, :rd
+		addop 'rol', (13<<12) | (3<<9), :u3, :rd
+		addop 'addi',(13<<12) | (4<<9), :u3, :rd
+		addop 'subi',(13<<12) | (5<<9), :u3, :rd
+		addop 'not', (13<<12) | (7<<9) | (0<<6), :rd
+		addop 'neg', (13<<12) | (7<<9) | (1<<6), :rd
+		addop 'cbw', (13<<12) | (7<<9) | (4<<6), :rd
+		addop 'sti', (13<<12) | (7<<9) | (7<<6) | 0
+		addop 'cli', (13<<12) | (7<<9) | (7<<6) | 1
+		addop 'stc', (13<<12) | (7<<9) | (7<<6) | 2
+		addop 'clc', (13<<12) | (7<<9) | (7<<6) | 3
+	end
+
+	alias init_latest init_cy16
+end
+end

data/metasm/cpu/cy16/render.rb

@@ -0,0 +1,41 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/cy16/opcodes'
+require 'metasm/render'
+
+module Metasm
+class CY16
+	class Reg
+		include Renderable
+		def render ; [self.class.i_to_s[@i]] end
+	end
+	class Memref
+		include Renderable
+		def render
+			r = []
+			r << (@sz == 1 ? 'byte ptr ' : 'word ptr ')
+			r << '['
+			r << @base if @base
+			r << '++' if @autoincr
+			r << ' + ' if @base and @offset
+			r << @offset if @offset
+			r << ']'
+		end
+	end
+
+	def render_instruction(i)
+		r = []
+		r << i.opname
+		if not i.args.empty?
+			r << ' '
+			i.args.each { |a_| r << a_ << ', ' }
+			r.pop
+		end
+		r
+	end
+end
+end

data/metasm/cpu/dalvik.rb

@@ -0,0 +1,11 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+class Metasm::Dalvik < Metasm::CPU
+end
+
+require 'metasm/main'
+require 'metasm/cpu/dalvik/decode'

data/{lib/metasm → metasm/cpu}/dalvik/decode.rb

@@ -3,7 +3,7 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/dalvik/opcodes'
+require 'metasm/cpu/dalvik/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -12,7 +12,7 @@ class Dalvik
 	end
 
 	def decode_findopcode(edata)
-		return if edata.ptr >= edata.data.length
+		return if edata.ptr+2 > edata.length
 		di = DecodedInstruction.new(self)
 		di.opcode = opcode_list[edata.decode_imm(:u16, @endianness) & 0xff]
 		edata.ptr -= 2
@@ -22,7 +22,7 @@ class Dalvik
 	def decode_instr_op(edata, di)
 		op = di.opcode
 		di.instruction.opname = op.name
-		
+
 		val = [edata.decode_imm(:u16, @endianness)]
 
 		op.args.each { |a|
@@ -80,7 +80,7 @@ class Dalvik
 				Expression[Expression.make_signed((val[1] >> 8) & 0xff, 8)]
 			when :rlist4, :rlist5
 				cnt = (val[0] >> 12) & 0xf
-			       	val << edata.decode_imm(:u16, @endianness)
+				val << edata.decode_imm(:u16, @endianness)
 				[cnt, 4].min.times {
 					di.instruction.args << Reg.new(val[-1] & 0xf)
 					val[-1] >>= 4
@@ -96,20 +96,40 @@ class Dalvik
 				next
 			when :m16
 				val << edata.decode_imm(:u16, @endianness)
-				Method.new(@dex, val.last)
+				DexMethod.new(@dex, val.last)
+			when :fld16
+				val << edata.decode_imm(:u16, @endianness)
+				DexField.new(@dex, val.last)
+			when :typ16
+				val << edata.decode_imm(:u16, @endianness)
+				DexType.new(@dex, val.last)
+			when :str16
+				val << edata.decode_imm(:u16, @endianness)
+				DexString.new(@dex, val.last)
 			else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
 			end
 		}
 
 		di.bin_length = val.length*2
 
+		return if edata.ptr > edata.length
+
+		di
+	end
+
+	def decode_instr_interpret(di, addr)
+		if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname =~ /^if|^goto/
+			arg = Expression[addr, :+, [di.instruction.args.last, :*, 2]].reduce
+			di.instruction.args[-1] = Expression[arg]
+		end
+
 		di
 	end
 
 	def backtrace_binding
 		@backtrace_binding ||= init_backtrace_binding
 	end
- 
+
 	def init_backtrace_binding
 		@backtrace_binding ||= {}
 		sz = @size/8
@@ -117,12 +137,12 @@ class Dalvik
 			case op.name
 			when /invoke/
 				@backtrace_binding[op.name] = lambda { |di, *args| {
-					:callstack => Expression[:callstack, :-, sz], 
+					:callstack => Expression[:callstack, :-, sz],
 					Indirection[:callstack, sz] => Expression[di.next_addr]
 				} }
 			when /return/
 				@backtrace_binding[op.name] = lambda { |di, *args| {
-			       		:callstack => Expression[:callstack, :+, sz]
+					:callstack => Expression[:callstack, :+, sz]
 				} }
 			end
 		}
@@ -136,9 +156,9 @@ class Dalvik
 			else arg
 			end
 		}
-	
+
 		if binding = backtrace_binding[di.opcode.name]
-			bd = binding[di, *a]
+			binding[di, *a]
 		else
 			puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
 			# assume nothing except the 1st arg is modified
@@ -150,18 +170,20 @@ class Dalvik
 		end
 
 	end
-	
+
 	def get_xrefs_x(dasm, di)
 		if di.opcode.props[:saveip]
 			m = di.instruction.args.first
-			if m.kind_of? Method and m.off
+			if m.kind_of?(DexMethod) and m.off
 				[m.off]
 			else
 				[:default]
 			end
 		elsif di.opcode.props[:setip]
-			if di.opcode.name =~ /return/
+			if di.opcode.name =~ /^return/
 				[Indirection[:callstack, @size/8]]
+			elsif di.opcode.name =~ /^if|^goto/
+				[di.instruction.args.last]
 			else
 				[]	# [di.instruction.args.last]
 			end

data/{lib/metasm → metasm/cpu}/dalvik/main.rb

@@ -23,13 +23,14 @@ class Dalvik < CPU
 		end
 	end
 
-	class Method
+	class DexMethod
 		attr_accessor :dex, :midx, :off
 		def initialize(dex, midx)
 			@dex = dex
 			@midx = midx
 			if @dex and m = @dex.methods[midx] and c = @dex.classes[m.classidx] and c.data and
-				me = (c.data.direct_methods+c.data.virtual_methods).find { |mm| mm.method == m }
+				me = (c.data.direct_methods+c.data.virtual_methods).find { |mm| mm.methodid == midx }
+				# FIXME this doesnt work
 				@off = me.codeoff + me.code.insns_off
 			end
 		end
@@ -44,6 +45,54 @@ class Dalvik < CPU
 		end
 	end
 
+	class DexField
+		attr_accessor :dex, :fidx
+		def initialize(dex, fidx)
+			@dex = dex
+			@fidx = fidx
+		end
+
+		def to_s
+			if @dex and f = @dex.fields[@fidx]
+				@dex.types[f.classidx] + '->' + @dex.strings[f.nameidx]
+			else
+				"field_#@fidx"
+			end
+		end
+	end
+
+	class DexType
+		attr_accessor :dex, :tidx
+		def initialize(dex, tidx)
+			@dex = dex
+			@tidx = tidx
+		end
+
+		def to_s
+			if @dex and f = @dex.types[@tidx]
+				f
+			else
+				"type_#@tidx"
+			end
+		end
+	end
+
+	class DexString
+		attr_accessor :dex, :sidx
+		def initialize(dex, sidx)
+			@dex = dex
+			@sidx = sidx
+		end
+
+		def to_s
+			if @dex and f = @dex.strings[@sidx]
+				f.inspect
+			else
+				"string_#@sidx"
+			end
+		end
+	end
+
 	def initialize(*args)
 		super()
 		@size = args.grep(Integer).first || 32

data/{lib/metasm → metasm/cpu}/dalvik/opcodes.rb

@@ -11,7 +11,7 @@
 # the opcode number is in the low-order byte, and determines the
 # argument format, which may take up to 4 other words
 
-require 'metasm/dalvik/main'
+require 'metasm/cpu/dalvik/main'
 
 module Metasm
 class Dalvik
@@ -61,9 +61,11 @@ invoke_virtual_quick invoke_virtual_quick_range invoke_super_quick invoke_super_
 unused_fc unused_fd unused_fe unused_ff]
 
 	def init_dalvik
-		@valid_props << :canthrow
-		@valid_args = [:i16, :i16_32hi, :i16_64hi, :i32, :iaa, :ib, :icc, :u16, :u32, :u64,
-			:r16, :ra, :raa, :rb, :rbb, :rcc, :rlist16, :rlist4, :rlist5, :m16]
+		@valid_props[:canthrow] = true
+		[:i16, :i16_32hi, :i16_64hi, :i32, :iaa, :ib, :icc, :u16, :u32, :u64,
+		 :r16, :ra, :raa, :rb, :rbb, :rcc, :rlist16, :rlist4, :rlist5,
+		 :m16, :fld16, :typ16, :str16
+		].each { |a| @valid_args[a] = true }
 		@opcode_list = []
 
 		OPCODES.each_with_index { |n, b|
@@ -80,7 +82,7 @@ unused_fc unused_fd unused_fe unused_ff]
 	def addop_args(op)
 		fmt = case op.name
 		when 'goto'
-  			:fmt10t
+			:fmt10t
 		when 'nop', 'return_void'
 			:fmt10x
 		when 'const_4'
@@ -119,12 +121,16 @@ unused_fc unused_fd unused_fe unused_ff]
 			:fmt20t
 		when 'goto_32'
 			:fmt30t
-		when 'const_string', 'const_class', 'check_cast',
-			'new_instance', 'sget', 'sget_wide', 'sget_object',
+		when 'const_string'
+			:fmt21c_str
+		when 'const_class', 'check_cast',
+			'new_instance'
+			:fmt21c_typ
+		when 'sget', 'sget_wide', 'sget_object',
 			'sget_boolean', 'sget_byte', 'sget_char', 'sget_short',
 			'sput', 'sput_wide', 'sput_object', 'sput_boolean',
 			'sput_byte', 'sput_char', 'sput_short'
-			:fmt21c
+			:fmt21c_fld
 		when 'const_16', 'const_wide_16'
 			:fmt21s
 		when 'if_eqz', 'if_nez', 'if_ltz', 'if_gez', 'if_gtz', 'if_lez'
@@ -214,7 +220,9 @@ unused_fc unused_fd unused_fe unused_ff]
 		when :fmt10t; op.args << :iaa
 		when :fmt20t; op.args << :i16
 		when :fmt20bc; op.args << :iaa << :u16
-		when :fmt21c; op.args << :raa << :u16
+		when :fmt21c_str; op.args << :raa << :str16
+		when :fmt21c_typ; op.args << :raa << :typ16
+		when :fmt21c_fld; op.args << :raa << :fld16
 		when :fmt22x; op.args << :raa << :r16
 		when :fmt21s, :fmt21t; op.args << :raa << :i16
 		when :fmt21h; op.args << :raa << :i16_32hi
@@ -222,7 +230,7 @@ unused_fc unused_fd unused_fe unused_ff]
 		when :fmt23x; op.args << :raa << :rbb << :rcc
 		when :fmt22b; op.args << :raa << :rbb << :icc
 		when :fmt22s, :fmt22t; op.args << :ra << :rb << :i16
-		when :fmt22c, :fmt22cs; op.args << :ra << :rb << :u16
+		when :fmt22c, :fmt22cs; op.args << :ra << :rb << :fld16
 		when :fmt30t; op.args << :i32
 		when :fmt31t, :fmt31c; op.args << :raa << :u32
 		when :fmt32x; op.args << :r16 << :r16
@@ -238,7 +246,7 @@ unused_fc unused_fd unused_fe unused_ff]
 		when :fmt3inline
 			op.args << :r16 << :rlist4
 		when :fmt3rc, :fmt3rms
-		       	# rlist = :r16, :r16+1, :r16+2, ..., :r16+:iaa-1
+			# rlist = :r16, :r16+1, :r16+2, ..., :r16+:iaa-1
 			op.args << :r16 << :rlist16
 		when :fmt51l
 			# u64 = u16 | (u16 << 16) | ...