one_gadget 2.0.0 → 2.1.1

data/lib/one_gadget/abi.rb

@@ -14,6 +14,17 @@ module OneGadget
     # Registers of AArch64.
     AARCH64 = %w[xzr wzr sp] + 0.upto(30).map { |i| ["x#{i}", "w#{i}"] }.flatten
 
+    # Registers of RISC-V (RV64), by the ABI names objdump prints: it emits neither
+    # the numbered +x0+-+x15+ names nor +fp+ for +s0+, so neither is listed.
+    RISCV64 = %w[zero ra sp gp tp] + 0.upto(6).map { |i| "t#{i}" } +
+              0.upto(11).map { |i| "s#{i}" } + 0.upto(7).map { |i| "a#{i}" }
+
+    # Registers of MIPS (32-bit), by the names objdump prints: it emits the ABI
+    # names rather than the numbered +$0+-+$31+, and +fp+ rather than +s8+.
+    MIPS = %w[zero at v0 v1 gp sp fp ra] +
+           0.upto(3).map { |i| "a#{i}" } + 0.upto(9).map { |i| "t#{i}" } +
+           0.upto(7).map { |i| "s#{i}" } + 0.upto(1).map { |i| "k#{i}" }
+
     # Registers of ARM (32-bit).
     # objdump never prints the numbered name of a register that has a role name:
     # +r10+-+r15+ always appear as +sl+/+fp+/+ip+/+sp+/+lr+/+pc+, so those are
@@ -31,7 +42,12 @@ module OneGadget
               8.upto(15).map { |i| ["r#{i}d", "r#{i}"] }).to_h,
       i386: {},
       aarch64: 0.upto(30).to_h { |i| ["w#{i}", "x#{i}"] }.merge('wzr' => 'xzr'),
-      arm: {}
+      arm: {},
+      # RISC-V names no part of a register: its 32-bit operations are instructions
+      # of their own (+addiw+, +sext.w+), each writing the whole register.
+      riscv64: {},
+      # MIPS names no part of a register either.
+      mips: {}
     }.freeze
 
     # Registers a call may destroy, per each ABI's calling convention: the return
@@ -49,11 +65,19 @@ module OneGadget
       aarch64: (0.upto(7).to_a + 9.upto(18).to_a).map { |i| "x#{i}" },
       # AAPCS: r0-r3 arguments and return, ip (r12) the intra-procedure scratch,
       # and lr, which the call itself overwrites with the return address.
-      arm: %w[r0 r1 r2 r3 ip lr]
+      arm: %w[r0 r1 r2 r3 ip lr],
+      # RISC-V LP64: a0-a7 arguments (a0/a1 also the return), t0-t6 temporaries,
+      # and ra, which the call itself overwrites with the return address.
+      riscv64: %w[ra] + 0.upto(7).map { |i| "a#{i}" } + 0.upto(6).map { |i| "t#{i}" },
+      # o32: v0/v1 the return, a0-a3 arguments, t0-t9 temporaries, at the
+      # assembler's scratch, and ra, which the call itself overwrites. gp goes
+      # with them: PIC code reloads it from the stack after every call, because
+      # the callee establishes its own.
+      mips: %w[at v0 v1 gp ra] + 0.upto(3).map { |i| "a#{i}" } + 0.upto(9).map { |i| "t#{i}" }
     }.freeze
 
     # The register each ABI leaves an integer return value in.
-    RETURN_REGISTER = { amd64: 'rax', i386: 'eax', aarch64: 'x0', arm: 'r0' }.freeze
+    RETURN_REGISTER = { amd64: 'rax', i386: 'eax', aarch64: 'x0', arm: 'r0', riscv64: 'a0' }.freeze
 
     module_function
 
@@ -81,10 +105,22 @@ module OneGadget
       ARM
     end
 
+    # Registers' name of RISC-V (RV64).
+    # @return [Array<String>] List of registers.
+    def riscv64
+      RISCV64
+    end
+
+    # Registers' name of MIPS (32-bit).
+    # @return [Array<String>] List of registers.
+    def mips
+      MIPS
+    end
+
     # Returns all names of registers.
     # @return [Array<String>] List of registers.
     def all
-      amd64 + aarch64 + arm
+      amd64 + aarch64 + arm + riscv64 + mips
     end
 
     # Checks if the register is a stack-related pointer.
@@ -92,7 +128,7 @@ module OneGadget
     #   Register's name.
     # @return [Boolean] +true+ if +reg+ is a stack or frame pointer (e.g. +rsp+, +rbp+, +sp+).
     def stack_register?(reg)
-      %w[esp ebp rsp rbp sp x29].include?(reg)
+      %w[esp ebp rsp rbp sp x29 s0].include?(reg)
     end
   end
 end