metasm 1.0.1 → 1.0.2

data/metasm/cpu/ia32.rb

@@ -0,0 +1,17 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+# fix autorequire warning
+class Metasm::Ia32 < Metasm::CPU
+end
+
+require 'metasm/main'
+require 'metasm/cpu/ia32/parse'
+require 'metasm/cpu/ia32/encode'
+require 'metasm/cpu/ia32/decode'
+require 'metasm/cpu/ia32/render'
+require 'metasm/cpu/ia32/compile_c'
+require 'metasm/cpu/ia32/decompile'
+require 'metasm/cpu/ia32/debug'

data/{lib/metasm → metasm/cpu}/ia32/compile_c.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/parse'
+require 'metasm/cpu/ia32/parse'
 require 'metasm/compile_c'
 
 module Metasm
@@ -527,7 +527,7 @@ class CCompiler < C::Compiler
 			if expr.rexpr.type.specifier == :unsigned and r.sz == 64
 				label = new_label('unsign_float')
 				if m.sz == 64 and @cpusz < 64
-					foo, m = get_composite_parts m
+					m = get_composite_parts(m)[1]
 				end
 				m2 = m
 				m2 = make_volatile(m, expr.rexpr.type) if m.kind_of? ModRM
@@ -637,7 +637,7 @@ class CCompiler < C::Compiler
 			# both sides are already cast to the same type by the precompiler
 			# XXX expr.type.pointer?
 			if expr.type.integral? and expr.type.name == :ptr and expr.lexpr.type.kind_of? C::BaseType and
-				typesize[expr.lexpr.type.name] == typesize[:ptr]
+					typesize[expr.lexpr.type.name] == typesize[:ptr]
 				expr.lexpr.type.name = :ptr
 			end
 			l = c_cexpr_inner(expr.lexpr)
@@ -711,6 +711,7 @@ class CCompiler < C::Compiler
 					end
 				when :-
 					r = c_cexpr_inner(expr.rexpr)
+					r = resolve_address r if r.kind_of? Address
 					if r.kind_of? Expression
 						unuse l, r
 						l = Address.new(l.modrm.dup)
@@ -1077,6 +1078,7 @@ class CCompiler < C::Compiler
 		when 'add', 'sub', 'and', 'or', 'xor'
 			r = make_volatile(r, type) if l.kind_of? ModRM and r.kind_of? ModRM
 			unuse r
+			r = Reg.new(r.val, l.sz) if r.kind_of?(Reg) and l.kind_of?(ModRM) and l.sz and l.sz != r.sz	# add byte ptr [eax], bl
 			instr op, l, r
 		when 'shr', 'sar', 'shl'
 			if r.kind_of? Expression
@@ -1509,10 +1511,6 @@ class CCompiler < C::Compiler
 #File.open('m-dbg-precomp.c', 'w') { |fd| fd.puts @parser }
 #File.open('m-dbg-src.asm', 'w') { |fd| fd.puts @source }
 	end
-
-	def check_reserved_name(var)
-		Reg.s_to_i[var.name] or super(var)
-	end
 end
 
 	def new_ccompiler(parser, exe=ExeFormat.new)

data/{lib/metasm → metasm/cpu}/ia32/debug.rb

@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 
 module Metasm
 class Ia32
@@ -18,7 +18,7 @@ class Ia32
 		@dbg_register_flags ||= :eflags
 	end
 
-	def dbg_register_list 
+	def dbg_register_list
 		@dbg_register_list ||= [:eax, :ebx, :ecx, :edx, :esi, :edi, :ebp, :esp, :eip]
 	end
 
@@ -46,10 +46,10 @@ class Ia32
 	end
 
 	def dbg_enable_singlestep(dbg)
-		dbg_set_flag(dbg, :t)
+		dbg_set_flag(dbg, :t) if dbg_get_flag(dbg, :t) == 0
 	end
 	def dbg_disable_singlestep(dbg)
-		dbg_unset_flag(dbg, :t)
+		dbg_unset_flag(dbg, :t) if dbg_get_flag(dbg, :t) != 0
 	end
 
 	def dbg_enable_bp(dbg, bp)
@@ -113,7 +113,7 @@ class Ia32
 		if dbg[:dr6] == 0 and dbg[:dr7] == 0
 			dbg[:dr7] = 0x10000	# some OS (eg Windows) only return dr6 if dr7 != 0
 		end
-		dbg[:dr6] = 0
+		dbg[:dr6] = 0 if dbg[:dr6] & 0x400f != 0
 	end
 
 	def dbg_evt_bpx(dbg, b)

data/{lib/metasm → metasm/cpu}/ia32/decode.rb

@@ -4,13 +4,13 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 require 'metasm/decode'
 
 module Metasm
 class Ia32
 	class ModRM
-		def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg)
+		def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg, h = {})
 			m = (byte >> 6) & 3
 			rm = byte & 7
 
@@ -28,7 +28,11 @@ class Ia32
 						b = Reg.new(a, adsz)
 					else
 						s = 1
-						i = Reg.new(a, adsz)
+						if h[:mrmvex]
+							i = SimdReg.new(a, h[:mrmvex])
+						else
+							i = Reg.new(a, adsz)
+						end
 					end
 
 				when :sib
@@ -37,7 +41,11 @@ class Ia32
 					ii = ((sib >> 3) & 7)
 					if ii != 4
 						s = 1 << ((sib >> 6) & 3)
-						i = Reg.new(ii, adsz)
+						if h[:mrmvex]
+							i = SimdReg.new(ii, h[:mrmvex])
+						else
+							i = Reg.new(ii, adsz)
+						end
 					end
 
 					bb = sib & 7
@@ -52,11 +60,12 @@ class Ia32
 				end
 			}
 
-			if imm and imm.reduce.kind_of? Integer and imm.reduce < -0x10_0000
+			if imm and ir = imm.reduce and ir.kind_of?(Integer) and ir < 0 and (ir < -0x10_0000 or (!b and !i))
 				# probably a base address -> unsigned
 				imm = Expression[imm.reduce & ((1 << (adsz || 32)) - 1)]
 			end
 
+			opsz = h[:argsz] if h[:argsz]
 			new adsz, opsz, s, i, b, imm, seg
 		end
 	end
@@ -90,8 +99,7 @@ class Ia32
 			msk = op.bin_mask[0]
 
 			for i in b..(b | (255^msk))
-				next if i & msk != b & msk
-				lookaside[i] << op
+				lookaside[i] << op if i & msk == b & msk
 			end
 		}
 		lookaside
@@ -117,8 +125,6 @@ class Ia32
 				v = byte & 7
 			end
 			instr.prefix[:seg] = SegReg.new(v)
-
-			instr.prefix[:jmphint] = ((byte & 0x10) == 0x10)
 		else
 			return false
 		end
@@ -133,11 +139,10 @@ class Ia32
 		while edata.ptr < edata.data.length
 			pfx = di.instruction.prefix || {}
 			byte = edata.data[edata.ptr]
-			byte = byte.unpack('C').first if byte.kind_of? ::String	# 1.9
+			byte = byte.unpack('C').first if byte.kind_of?(::String)
 			return di if di.opcode = @bin_lookaside[byte].find { |op|
 				# fetch the relevant bytes from edata
 				bseq = edata.data[edata.ptr, op.bin.length].unpack('C*')
-				di.opcode = op if op.props[:opsz]	# needed by opsz(di)
 
 				# check against full opcode mask
 				op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) } and
@@ -147,12 +152,17 @@ class Ia32
 				  (fld = op.fields[:seg2A]  and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg2A] == 1) or
 				  (fld = op.fields[:seg3A]  and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3A] < 4) or
 				  (fld = op.fields[:seg3A] || op.fields[:seg3] and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3] > 5) or
-				  (fld = op.fields[:modrmA] and (bseq[fld[0]] >> fld[1]) & 0xC0 == 0xC0) or
-				  (sz = op.props[:opsz] and opsz(di) != sz) or
+				  (op.props[:modrmA] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 == 0xC0) or
+				  (op.props[:modrmR] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 != 0xC0) or
+				  (fld = op.fields[:vex_vvvv] and @size != 64 and (bseq[fld[0]] >> fld[1]) & @fields_mask[:vex_vvvv] < 8) or
+				  (sz = op.props[:opsz] and opsz(di, op) != sz) or
+				  (sz = op.props[:adsz] and adsz(di, op) != sz) or
 				  (ndpfx = op.props[:needpfx] and not pfx[:list].to_a.include? ndpfx) or
+				  (pfx[:adsz] and op.props[:adsz] and op.props[:adsz] == @size) or
 				  # return non-ambiguous opcode (eg push.i16 in 32bit mode) / sync with addop_post in opcode.rb
-				  (pfx[:opsz] and (op.args == [:i] or op.args == [:farptr] or op.name[0, 3] == 'ret') and not op.props[:opsz]) or
-				  (pfx[:adsz] and op.props[:adsz] and op.props[:adsz] == @size)
+				  (pfx[:opsz] and not op.props[:opsz] and (op.args == [:i] or op.args == [:farptr] or op.name == 'ret')) or
+				  (pfx[:adsz] and not op.props[:adsz] and (op.props[:strop] or op.props[:stropz] or op.args.include?(:mrm_imm) or op.args.include?(:modrm) or op.name =~ /loop|xlat/)) or
+				  (op.name == 'nop' and op.bin[0] == 0x90 and di.instruction.prefix and di.instruction.prefix[:rex_b])
 				 )
 			}
 
@@ -174,19 +184,21 @@ class Ia32
 		when 0xF2, 0xF3; pfx.delete :rep
 		end
 
+		if op.props[:setip] and not op.props[:stopexec] and pfx[:seg]
+			case pfx.delete(:seg).val
+			when 1; pfx[:jmphint] = 'hintnojmp'
+			when 3; pfx[:jmphint] = 'hintjmp'
+			end
+		end
+
 		field_val = lambda { |f|
 			if fld = op.fields[f]
 				(bseq[fld[0]] >> fld[1]) & @fields_mask[f]
 			end
 		}
 
-		opsz = opsz(di)
-
-		if pfx[:adsz]
-			adsz = 48 - @size
-		else
-			adsz = @size
-		end
+		opsz = op.props[:argsz] || opsz(di)
+		adsz = (pfx[:adsz] ? 48 - @size : @size)
 
 		mmxsz = ((op.props[:xmmx] && pfx[:opsz]) ? 128 : 64)
 		op.args.each { |a|
@@ -199,15 +211,23 @@ class Ia32
 			when :regfp;  FpReg.new   field_val[a]
 			when :regmmx; SimdReg.new field_val[a], mmxsz
 			when :regxmm; SimdReg.new field_val[a], 128
+			when :regymm; SimdReg.new field_val[a], 256
 
 			when :farptr; Farptr.decode edata, @endianness, opsz
 			when :i8, :u8, :u16; Expression[edata.decode_imm(a, @endianness)]
 			when :i; Expression[edata.decode_imm("#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym, @endianness)]
 
-			when :mrm_imm;  ModRM.decode edata, (adsz == 16 ? 6 : 5), @endianness, adsz, opsz, pfx[:seg]
-			when :modrm, :modrmA; ModRM.decode edata, field_val[a], @endianness, adsz, opsz, pfx[:seg]
-			when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx[:seg], SimdReg
-			when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx[:seg], SimdReg
+			when :mrm_imm;  ModRM.decode edata, (adsz == 16 ? 6 : 5), @endianness, adsz, opsz, pfx.delete(:seg)
+			when :modrm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, opsz, pfx.delete(:seg)
+			when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz]
+			when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]
+			when :modrmymm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 256, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]
+
+			when :vexvreg; Reg.new((field_val[:vex_vvvv] ^ 0xf), opsz)
+			when :vexvxmm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 128)
+			when :vexvymm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 256)
+			when :i4xmm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 128)
+			when :i4ymm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 256)
 
 			when :imm_val1; Expression[1]
 			when :imm_val3; Expression[3]
@@ -221,6 +241,8 @@ class Ia32
 
 		di.bin_length += edata.ptr - before_ptr
 
+		return false if edata.ptr > edata.length
+
 		if op.name == 'movsx' or op.name == 'movzx'
 			if di.opcode.props[:argsz] == 8
 				di.instruction.args[1].sz = 8
@@ -232,9 +254,10 @@ class Ia32
 			else
 				di.instruction.args[0].sz = @size
 			end
+		elsif op.name == 'crc32'
+			di.instruction.args[0].sz = 32
 		end
 
-		pfx.delete :seg
 		case pfx.delete(:rep)
 		when :nz
 			if di.opcode.props[:strop]
@@ -257,7 +280,7 @@ class Ia32
 	# adds the eip delta to the offset +off+ of the instruction (may be an Expression) + its bin_length
 	# do not call twice on the same di !
 	def decode_instr_interpret(di, addr)
-		if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname[0, 3] != 'ret'
+		if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname !~ /^i?ret/
 			delta = di.instruction.args.last.reduce
 			arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
 			di.instruction.args[-1] = Expression[arg]
@@ -306,11 +329,16 @@ class Ia32
 	end
 	def backtrace_binding=(b) @backtrace_binding = b end
 
-	def opsz(di)
-		ret = @size
-		ret = di.opcode.props[:argsz] if di and di.opcode.props[:argsz]
-		ret = 48 - ret if di and not di.opcode.props[:argsz] and di.instruction.prefix and di.instruction.prefix[:opsz]
-		ret
+	def opsz(di, op=nil)
+		if di and di.instruction.prefix and di.instruction.prefix[:opsz] and (op || di.opcode).props[:needpfx] != 0x66; 48-@size
+		else @size
+		end
+	end
+
+	def adsz(di, op=nil)
+		if di and di.instruction.prefix and di.instruction.prefix[:adsz] and (op || di.opcode).props[:needpfx] != 0x67; 48-@size
+		else @size
+		end
 	end
 
 	# populate the @backtrace_binding hash with default values
@@ -318,15 +346,37 @@ class Ia32
 		@backtrace_binding ||= {}
 
 		eax, ecx, edx, ebx, esp, ebp, esi, edi = register_symbols
+		ebx = ebx
 
 		mask = lambda { |di| (1 << opsz(di))-1 }	# 32bits => 0xffff_ffff
 		sign = lambda { |v, di| Expression[[[v, :&, mask[di]], :>>, opsz(di)-1], :'!=', 0] }
 
 		opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
 			binding = case op
-			when 'mov', 'movsx', 'movzx', 'movsxd', 'movd', 'movq'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+			when 'mov', 'movzx', 'movd', 'movq'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+			when 'movsx', 'movsxd'
+				lambda { |di, a0, a1|
+					sz1 = di.instruction.args[1].sz
+					sign1 = Expression[[a1, :>>, sz1-1], :&, 1]
+					{ a0 => Expression[[a1, :|, [sign1, :*, (-1 << sz1)]], :&, mask[di]] }
+				}
 			when 'lea'; lambda { |di, a0, a1| { a0 => a1.target } }
-			when 'xchg'; lambda { |di, a0, a1| { a0 => Expression[a1], a1 => Expression[a0] } }
+			when 'xchg'; lambda { |di, a0, a1|
+				# specialcase xchg al, ah (conflict on eax not handled in get_backtrace_binding)
+				if a0.kind_of?(Expression) and a1.kind_of?(Expression) and
+						a0.op == :& and a0.rexpr == 255 and
+						a1.op == :& and a1.rexpr == 255 and
+						((a0.lexpr.kind_of?(Expression) and a0.lexpr.lexpr == a1.lexpr and a0.lexpr.op == :>> and a0.lexpr.rexpr == 8) or
+						 (a1.lexpr.kind_of?(Expression) and a1.lexpr.lexpr == a0.lexpr and a1.lexpr.op == :>> and a1.lexpr.rexpr == 8))
+					tgreg = a0.lexpr.kind_of?(Expression) ? a1.lexpr : a0.lexpr
+					invmask = (@size == 64 ? 0xffff_ffff_ffff_0000 : 0xffff_0000)
+					{ tgreg => Expression[[tgreg, :&, invmask], :|,
+					   [[[tgreg, :>>, 8], :&, 0x00ff], :|,
+					    [[tgreg, :<<, 8], :&, 0xff00]]] }
+				else
+					{ a0 => Expression[a1], a1 => Expression[a0] }
+				end
+			}
 			when 'add', 'sub', 'or', 'xor', 'and', 'pxor', 'adc', 'sbb'
 				lambda { |di, a0, a1|
 					e_op = { 'add' => :+, 'sub' => :-, 'or' => :|, 'and' => :&, 'xor' => :^, 'pxor' => :^, 'adc' => :+, 'sbb' => :- }[op]
@@ -346,13 +396,23 @@ class Ia32
 				lambda { |di, a0, a1|
 					e_op = (op[2] == ?r ? :>> : :<<)
 					inv_op = {:<< => :>>, :>> => :<< }[e_op]
-					sz = [a1, :%, opsz(di)]
-					isz = [[opsz(di), :-, a1], :%, opsz(di)]
+					operandsize = di.instruction.args[0].sz
+					operandmask = (1 << operandsize) - 1
+					sz = [a1, :%, operandsize]
+					isz = [[operandsize, :-, a1], :%, operandsize]
 					# ror a, b  =>  (a >> b) | (a << (32-b))
-					{ a0 => Expression[[[a0, e_op, sz], :|, [a0, inv_op, isz]], :&, mask[di]] }
+					{ a0 => Expression[[[[a0, :&, operandmask], e_op, sz], :|, [[a0, :&, operandmask], inv_op, isz]], :&, operandmask] }
 				}
 			when 'sar', 'shl', 'sal'; lambda { |di, a0, a1| { a0 => Expression[a0, (op[-1] == ?r ? :>> : :<<), [a1, :%, [opsz(di), 32].max]] } }
 			when 'shr'; lambda { |di, a0, a1| { a0 => Expression[[a0, :&, mask[di]], :>>, [a1, :%, opsz(di)]] } }
+			when 'shrd'
+				lambda { |di, a0, a1, a2|
+					{ a0 => Expression[[a0, :>>, [a2, :%, opsz(di)]], :|, [a1, :<<, [[opsz(di), :-, a2], :%, opsz(di)]]] }
+				}
+			when 'shld'
+				lambda { |di, a0, a1, a2|
+					{ a0 => Expression[[a0, :<<, [a2, :%, opsz(di)]], :|, [a1, :>>, [[opsz(di), :-, a2], :%, opsz(di)]]] }
+				}
 			when 'cwd', 'cdq', 'cqo'; lambda { |di| { Expression[edx, :&, mask[di]] => Expression[mask[di], :*, sign[eax, di]] } }
 			when 'cbw', 'cwde', 'cdqe'; lambda { |di|
 				o2 = opsz(di)/2 ; m2 = (1 << o2) - 1
@@ -363,7 +423,7 @@ class Ia32
 			when 'pop'
 				lambda { |di, a0| { esp => Expression[esp, :+, opsz(di)/8],
 					a0 => Indirection[esp, opsz(di)/8, di.address] } }
-			when 'pushfd'
+			when 'pushfd', 'pushf'
 				# TODO Unknown per bit
 				lambda { |di|
 					efl = Expression[0x202]
@@ -373,8 +433,8 @@ class Ia32
 					bts[7, :eflag_s]
 					bts[11, :eflag_o]
 					{ esp => Expression[esp, :-, opsz(di)/8], Indirection[esp, opsz(di)/8, di.address] => efl }
-			       	}
-			when 'popfd'
+				}
+			when 'popfd', 'popf'
 				lambda { |di| bt = lambda { |pos| Expression[[Indirection[esp, opsz(di)/8, di.address], :>>, pos], :&, 1] }
 					{ esp => Expression[esp, :+, opsz(di)/8], :eflag_c => bt[0], :eflag_z => bt[6], :eflag_s => bt[7], :eflag_o => bt[11] } }
 			when 'sahf'
@@ -412,9 +472,25 @@ class Ia32
 					ret
 				}
 			when 'call'
-				lambda { |di, a0| { esp => Expression[esp, :-, opsz(di)/8],
-					Indirection[esp, opsz(di)/8, di.address] => Expression[di.next_addr] } }
+				lambda { |di, a0|
+					sz = opsz(di)/8
+					if a0.kind_of? Farptr
+						{ esp => Expression[esp, :-, 2*sz],
+						  Indirection[esp, sz, di.address] => Expression[di.next_addr],
+						  Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown }
+					else
+						{ esp => Expression[esp, :-, sz],
+						  Indirection[esp, sz, di.address] => Expression[di.next_addr] }
+					end
+				}
+			when 'callf'
+				lambda { |di, a0|
+					sz = opsz(di)/8
+					{ esp => Expression[esp, :-, 2*sz],
+					  Indirection[esp, sz, di.address] => Expression[di.next_addr],
+					  Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown } }
 			when 'ret'; lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/8, :+, a[0] || 0]] } }
+			when 'retf';lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/4, :+, a[0] || 0]] } }
 			when 'loop', 'loopz', 'loopnz'; lambda { |di, a0| { ecx => Expression[ecx, :-, 1] } }
 			when 'enter'
 				lambda { |di, a0, a1|
@@ -427,7 +503,7 @@ class Ia32
 					(1..depth).each { |i|
 						b[Indirection[[esp, :+, a0.reduce+i*sz], sz, di.address]] =
 						b[Indirection[[ebp, :-, i*sz], sz, di.address]] =
-						       	Expression::Unknown # TODO Indirection[[ebp, :-, i*sz], sz, di.address]
+							Expression::Unknown # TODO Indirection[[ebp, :-, i*sz], sz, di.address]
 					}
 					b
 				}
@@ -435,21 +511,46 @@ class Ia32
 			when 'aaa'; lambda { |di| { eax => Expression::Unknown, :incomplete_binding => Expression[1] } }
 			when 'imul'
 				lambda { |di, *a|
-					# 1 operand form == same as 'mul' (ax:dx stuff)
-					next { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } if not a[1]
+					if not a[1]
+						# 1 operand from: store result in edx:eax
+						bd = {}
+						m = mask[di]
+						s = opsz(di)
+						e = Expression[Expression.make_signed(Expression[a[0], :&, m], s), :*, Expression.make_signed(Expression[eax, :&, m], s)]
+						if s == 8
+							bd[Expression[eax, :&, 0xffff]] = e
+						else
+							bd[Expression[eax, :&, m]] = Expression[e, :&, m]
+							bd[Expression[edx, :&, m]] = Expression[[e, :>>, opsz(di)], :&, m]
+						end
+						# XXX eflags?
+						next bd
+					end
 
 					if a[2]; e = Expression[a[1], :*, a[2]]
 					else e = Expression[[a[0], :*, a[1]], :&, (1 << (di.instruction.args.first.sz || opsz(di))) - 1]
 					end
 					{ a[0] => e }
 				}
-			when 'mul', 'div', 'idiv'; lambda { |di, *a| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
+			when 'mul'
+				lambda { |di, *a|
+					m = mask[di]
+					e = Expression[a, :*, [eax, :&, m]]
+					if opsz(di) == 8
+						{ Expression[eax, :&, 0xffff] => e }
+					else
+						{ Expression[eax, :&, m] => Expression[e, :&, m],
+						  Expression[edx, :&, m] => Expression[[e, :>>, opsz(di)], :&, m] }
+					end
+				}
+			when 'div', 'idiv'; lambda { |di, *a| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
 			when 'rdtsc'; lambda { |di| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
-			when /^(stos|movs|lods|scas|cmps)[bwd]$/
-				lambda { |di|
-					op =~ /^(stos|movs|lods|scas|cmps)([bwd])$/
+			when /^(stos|movs|lods|scas|cmps)[bwdq]$/
+				lambda { |di, *a|
+					next {:incomplete_binding => 1} if di.opcode.args.include?(:regxmm)	# XXX movsd xmm0, xmm1...
+					op =~ /^(stos|movs|lods|scas|cmps)([bwdq])$/
 					e_op = $1
-					sz = { 'b' => 1, 'w' => 2, 'd' => 4 }[$2]
+					sz = { 'b' => 1, 'w' => 2, 'd' => 4, 'q' => 8 }[$2]
 					eax_ = Reg.new(0, 8*sz).symbolic
 					dir = :+
 					if di.block and (di.block.list.find { |ddi| ddi.opcode.name == 'std' } rescue nil)
@@ -477,7 +578,7 @@ class Ia32
 						end
 					when 'scas'
 						case pfx[:rep]
-						when nil; { edi => Expression[edi, dir, sz] }
+						when nil; { edi => Expression[edi, dir, sz], :eflag_z => Expression[pedi, :==, Expression[eax, :&, (1 << (sz*8))-1]] }
 						else { edi => Expression::Unknown, ecx => Expression::Unknown }
 						end
 					when 'cmps'
@@ -506,7 +607,7 @@ class Ia32
 					ret
 				}
 			when 'fstenv', 'fnstenv'
-			       	lambda { |di, a0|
+				lambda { |di, a0|
 					# stores the address of the last non-control fpu instr run
 					lastfpuinstr = di.block.list[0...di.block.list.index(di)].reverse.find { |pdi|
 						case pdi.opcode.name
@@ -535,7 +636,8 @@ class Ia32
 				a0 => Expression[a0, :^, [1, :<<, [a1, :%, opsz(di)]]] } }
 			when 'bswap'
 				lambda { |di, a0|
-					if opsz(di) == 64
+					case opsz(di)
+					when 64
 						{ a0 => Expression[
 							[[[[a0, :&, 0xff000000_00000000], :>>, 56],   :|,
 							  [[a0, :&, 0x00ff0000_00000000], :>>, 40]],  :|,
@@ -545,12 +647,15 @@ class Ia32
 							  [[a0, :&, 0x00000000_00ff0000], :<<, 24]],  :|,
 							 [[[a0, :&, 0x00000000_0000ff00], :<<, 40],   :|,
 							  [[a0, :&, 0x00000000_000000ff], :<<, 56]]]] }
-					else	# XXX opsz != 32 => undef
+					when 32
 						{ a0 => Expression[
 							[[[a0, :&, 0xff000000], :>>, 24],  :|,
 							 [[a0, :&, 0x00ff0000], :>>,  8]], :|,
 							[[[a0, :&, 0x0000ff00], :<<,  8],  :|,
 							 [[a0, :&, 0x000000ff], :<<, 24]]] }
+					when 16
+						# bswap ax => mov ax, 0
+						{ a0 => 0 }
 					end
 				}
 			when 'nop', 'pause', 'wait', 'cmp', 'test'; lambda { |di, *a| {} }
@@ -602,7 +707,11 @@ class Ia32
 			when 'imul', 'mul', 'idiv', 'div', /^(scas|cmps)[bwdq]$/
 				lambda { |di, *a|
 					ret = (binding ? binding[di, *a] : {})
-					ret[:eflag_z] = ret[:eflag_s] = ret[:eflag_c] = ret[:eflag_o] = Expression::Unknown	# :incomplete_binding ?
+					ret[:eflag_z] ||= Expression::Unknown
+					ret[:eflag_s] ||= Expression::Unknown
+					ret[:eflag_c] ||= Expression::Unknown
+					ret[:eflag_o] ||= Expression::Unknown
+					# :incomplete_binding ?
 					ret
 				}
 			end
@@ -675,6 +784,30 @@ class Ia32
 		end
 	end
 
+	# patch a forward binding from the backtrace binding
+	# fixes fwdemu for push/pop/call/ret
+	def fix_fwdemu_binding(di, fbd)
+		if di.instruction.args.grep(ModRM).find { |m| m.seg and m.symbolic(di).target.lexpr =~ /^segment_base_/ }
+			fbd = fbd.dup
+			fbd[:incomplete_binding] = Expression[1]
+		end
+
+		case di.opcode.name
+		when 'push', 'call'
+			fbd = fbd.dup
+			sz = opsz(di)/8
+			esp = register_symbols[4]
+			if i = fbd.delete(Indirection[esp, sz])
+				fbd[Indirection[[esp, :-, sz], sz]] = i
+			end
+		when 'pop', 'ret' # nothing to do
+		when /^(push|pop|call|ret|enter|leave|stos|movs|lods|scas|cmps)/
+			fbd = fbd.dup
+			fbd[:incomplete_binding] = Expression[1]	# TODO
+		end
+		fbd
+	end
+
 	def get_xrefs_x(dasm, di)
 		return [] if not di.opcode.props[:setip]
 
@@ -683,8 +816,8 @@ class Ia32
 		when 'ret'; return [Indirection[register_symbols[4], sz/8, di.address]]
 		when 'jmp', 'call'
 			a = di.instruction.args.first
-			if dasm and a.kind_of?(ModRM) and a.imm and a.s == sz/8 and not a.b and dasm.get_section_at(a.imm)
-				return get_xrefs_x_jmptable(dasm, di, a, sz)
+			if dasm and a.kind_of?(ModRM) and a.imm and (a.s == sz/8 or a.s == 4) and not a.b and dasm.get_section_at(a.imm)
+				return get_xrefs_x_jmptable(dasm, di, a, a.s*8)
 			end
 		end
 
@@ -724,6 +857,19 @@ class Ia32
 			}
 			l = dasm.auto_label_at(mrm.imm, 'jmp_table', 'xref')
 			replace_instr_arg_immediate(di.instruction, mrm.imm, Expression[l])
+			# add 'case 1' comments
+			cases = {}
+			ret.each_with_index { |ind, idx|
+				idx -= 1	# ret[0] = symbolic
+				next if idx < 0
+				a = dasm.backtrace(ind, di.address)
+				if a.length == 1 and a[0].kind_of?(Expression) and addr = a[0].reduce and addr.kind_of?(::Integer)
+					(cases[addr] ||= []) << idx
+				end
+			}
+			cases.each { |addr, list|
+				dasm.add_comment(addr, "case #{list.join(', ')}:")
+			}
 			return ret
 		end
 
@@ -735,7 +881,7 @@ class Ia32
 			s = dasm.get_section_at(mrm.imm)
 			v = 0
 		end
-		loop do
+		while s[0].ptr < s[0].length
 			ptr = dasm.normalize s[0].decode_imm("u#{sz}".to_sym, @endianness)
 			diff = Expression[ptr, :-, di.address].reduce
 			if (diff.kind_of? ::Integer and diff.abs < 4096) or (di.opcode.basename == 'call' and ptr != 0 and dasm.get_section_at(ptr))
@@ -1164,5 +1310,46 @@ class Ia32
 
 		binding
 	end
+
+	# trace the stack pointer register across a function, rename occurences of esp+XX to esp+var_XX
+	def name_local_vars(dasm, funcaddr)
+		esp = register_symbols[4]
+		func = dasm.function[funcaddr]
+		subs = []
+		dasm.trace_function_register(funcaddr, esp => 0) { |di, r, off, trace|
+			next if r.to_s =~ /flag/
+			if di.opcode.name == 'call' and tf = di.block.to_normal.find { |t| dasm.function[t] and dasm.function[t].localvars }
+				subs << [trace[esp], dasm.function[tf].localvars]
+			end
+			di.instruction.args.grep(ModRM).each { |mrm|
+				b = mrm.b || (mrm.i if mrm.s == 1)
+				# its a modrm => b is read, so ignore r/off (not yet applied), use trace only
+				stackoff = trace[b.symbolic] if b
+				next if not stackoff
+				imm = mrm.imm || Expression[0]
+				frameoff = imm + stackoff
+				if frameoff.kind_of?(::Integer)
+					# XXX register args ? non-ABI standard register args ? (eg optimized x64)
+					str = 'var_%X' % (-frameoff)
+					str = 'arg_%X' % (frameoff-@size/8) if frameoff > 0
+					str = func.get_localvar_stackoff(frameoff, di, str) if func
+					imm = imm.expr if imm.kind_of?(ExpressionString)
+					mrm.imm = ExpressionString.new(imm, str, :stackvar)
+				end
+			}
+			off = off.reduce if off.kind_of?(Expression)
+			next unless off.kind_of?(Integer)
+			off
+		}
+		# if subfunctions are called at a fixed stack offset, rename var_3c -> subarg_0
+		if func and func.localvars and not subs.empty? and subs.all? { |sb| sb[0] == subs.first[0] }
+			func.localvars.each { |varoff, varname|
+				subargnames = subs.map { |o, sb| sb[varoff-o+@size/8] }.compact
+				if subargnames.uniq.length == 1
+					varname.replace 'sub'+subargnames[0]
+				end
+			}
+		end
+	end
 end
 end