smallworld-re 1.0.0__py3-none-any.whl

smallworld/analyses/unstable/code_coverage.py

@@ -0,0 +1,54 @@
+import copy
+import logging
+import typing
+
+from ... import emulators, exceptions, hinting, state
+from .. import analysis
+
+logger = logging.getLogger(__name__)
+hinter = hinting.get_hinter(__name__)
+
+
+class CodeCoverage(analysis.Analysis):
+    """A simple analysis that logs jumps, calls, and returns.
+
+    Arguments:
+        num_instructions: The number of instructions to execute.
+    """
+
+    def __init__(self, *args, num_instructions: int = 10, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.num_instructions = num_instructions
+
+    name = "code-coverage"
+    description = ""
+    version = "0.0.1"
+
+    def run(self, state: state.Machine) -> None:
+        machine = copy.deepcopy(state)
+        cpu = machine.get_cpu()
+        emulator = emulators.UnicornEmulator(cpu.platform)
+        machine.apply(emulator)
+        coverage: typing.Dict[int, int] = {}
+        for i in range(self.num_instructions):
+            pc = emulator.read_register_content("pc")
+            if pc in coverage:
+                coverage[pc] += 1
+            else:
+                coverage[pc] = 1
+
+            try:
+                emulator.step()
+            except exceptions.EmulationStop:
+                break
+            except exceptions.EmulationError as e:
+                exhint = hinting.EmulationException(
+                    message="Emulation single step raised an exception",
+                    pc=pc,
+                    instruction_num=i,
+                    exception=str(e),
+                )
+                hinter.info(exhint)
+                break
+        hint = hinting.CoverageHint(message="Coverage for execution", coverage=coverage)
+        hinter.info(hint)

smallworld/analyses/unstable/code_reachable.py

@@ -0,0 +1,44 @@
+import copy
+import logging
+
+from ... import emulators, exceptions, hinting, state
+from .. import analysis
+
+logger = logging.getLogger(__name__)
+hinter = hinting.get_hinter(__name__)
+
+
+class CodeReachable(analysis.Analysis):
+    """A simple analysis that logs what code is reachable by symbolic execution."""
+
+    def __init__(self, max_steps=500, **kwargs):
+        self.steps_left = max_steps
+        super().__init__(**kwargs)
+
+    name = "code-reachable"
+    description = ""
+    version = "0.0.1"
+
+    def run(self, state: state.Machine) -> None:
+        machine = copy.deepcopy(state)
+        cpu = machine.get_cpu()
+        emulator = emulators.AngrEmulator(cpu.platform)
+        machine.apply(emulator)
+
+        try:
+            while self.steps_left is None or self.steps_left > 0:
+                emulator.step()
+                if emulator.mgr:
+                    for s in emulator.mgr.active:
+                        pc = s._ip.concrete_value
+                        hint = hinting.ReachableCodeHint(
+                            message=f"Address {hex(pc)} is reachable via symbolic execution",
+                            address=pc,
+                        )
+                        hinter.info(hint)
+                if self.steps_left is not None:
+                    self.steps_left -= 1
+        except exceptions.EmulationStop:
+            return
+        except emulators.angr.PathTerminationSignal:
+            return

smallworld/analyses/unstable/control_flow_tracer.py

@@ -0,0 +1,71 @@
+import copy
+import logging
+
+from ... import emulators, exceptions, hinting, instructions, state
+from .. import analysis
+
+logger = logging.getLogger(__name__)
+hinter = hinting.get_hinter(__name__)
+
+
+class ControlFlowTracer(analysis.Analysis):
+    """A simple analysis that logs jumps, calls, and returns.
+
+    Arguments:
+        num_instructions: The number of instructions to execute.
+    """
+
+    def __init__(self, *args, num_instructions: int = 10, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.num_instructions = num_instructions
+
+    name = "control-flow-tracer"
+    description = ""
+    version = "0.0.1"
+
+    def run(self, state: state.Machine) -> None:
+        machine = copy.deepcopy(state)
+        cpu = machine.get_cpu()
+        emulator = emulators.UnicornEmulator(cpu.platform)
+        machine.apply(emulator)
+
+        from_instruction = None
+
+        for i in range(self.num_instructions):
+            instruction = emulator.current_instruction()
+            if from_instruction:
+                hint = hinting.ControlFlowHint(
+                    message="Control Flow Change",
+                    from_instruction=instructions.Instruction.from_capstone(
+                        from_instruction
+                    ),
+                    to_instruction=instructions.Instruction.from_capstone(instruction),
+                )
+                hinter.info(hint)
+                from_instruction = None
+            if self.is_cfi(instruction):
+                from_instruction = instruction
+            try:
+                emulator.step()
+            except exceptions.EmulationStop:
+                break
+            except exceptions.EmulationError as e:
+                exhint = hinting.EmulationException(
+                    message="Emulation single step raised an exception",
+                    pc=instruction.address,
+                    instruction_num=i,
+                    exception=str(e),
+                )
+                hinter.info(exhint)
+                break
+
+    def is_cfi(self, instruction):
+        for g in instruction.groups:
+            group_name = instruction.group_name(g)
+            if group_name == "jump":
+                return True
+            elif group_name == "call":
+                return True
+            elif group_name == "ret":
+                return True
+        return False

smallworld/analyses/unstable/pointer_finder.py

@@ -0,0 +1,90 @@
+import copy
+import logging
+
+from unicorn import unicorn_const
+
+from ... import emulators, exceptions, hinting, instructions, state
+from .. import analysis
+
+logger = logging.getLogger(__name__)
+hinter = hinting.get_hinter(__name__)
+
+
+class PointerFinder(analysis.Analysis):
+    """A simple analysis that logs when a register is used as a pointer.
+
+    Arguments:
+        num_instructions: The number of instructions to execute.
+    """
+
+    def __init__(self, *args, num_instructions: int = 10, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.num_instructions = num_instructions
+
+    name = "pointer-finder"
+    description = ""
+    version = "0.0.1"
+
+    def find_the_pointer(self, cs_instruction, write):
+        i = instructions.Instruction.from_capstone(cs_instruction)
+        p = None
+        if write:
+            for w in i.writes:
+                if type(w) is instructions.BSIDMemoryReferenceOperand:
+                    p = w
+                    break
+        else:
+            for r in i.reads:
+                if type(r) is instructions.BSIDMemoryReferenceOperand:
+                    p = r
+                    break
+
+        assert p, "we can't find the pointer"
+        hint = hinting.PointerHint(message="Pointer Found", instruction=i, pointer=r)
+        hinter.info(hint)
+
+    def run(self, state: state.Machine) -> None:
+        machine = copy.deepcopy(state)
+        cpu = machine.get_cpu()
+        emulator = emulators.UnicornEmulator(cpu.platform)
+        machine.apply(emulator)
+
+        def hook_valid_access(uc, access, address, size, value, user_data):
+            instruction = emulator.current_instruction()
+            if access == unicorn_const.UC_MEM_WRITE:
+                self.find_the_pointer(instruction, True)
+            else:
+                self.find_the_pointer(instruction, False)
+
+        def hook_invalid_access(uc, access, address, size, value, user_data):
+            instruction = emulator.current_instruction()
+            if access == unicorn_const.UC_MEM_WRITE_UNMAPPED:
+                self.find_the_pointer(instruction, True)
+            else:
+                self.find_the_pointer(instruction, False)
+            return False
+
+        emulator.engine.hook_add(
+            unicorn_const.UC_HOOK_MEM_WRITE | unicorn_const.UC_HOOK_MEM_READ,
+            hook_valid_access,
+        )
+        emulator.engine.hook_add(
+            unicorn_const.UC_HOOK_MEM_READ_UNMAPPED
+            | unicorn_const.UC_HOOK_MEM_WRITE_UNMAPPED,
+            hook_invalid_access,
+        )
+
+        for i in range(self.num_instructions):
+            try:
+                emulator.step()
+            except exceptions.EmulationStop:
+                break
+            except exceptions.EmulationError as e:
+                exhint = hinting.EmulationException(
+                    message="Emulation single step raised an exception",
+                    pc=emulator.current_instruction().address,
+                    instruction_num=i,
+                    exception=str(e),
+                )
+                hinter.info(exhint)
+                break

smallworld/arch/aarch64_arch.py

@@ -0,0 +1,286 @@
+info = {
+    # *** General purpose registers ***
+    "x0": ("x0", (0, 8)),
+    "w0": ("x0", (0, 4)),
+    "x1": ("x1", (0, 8)),
+    "w1": ("x1", (0, 4)),
+    "x2": ("x2", (0, 8)),
+    "w2": ("x2", (0, 4)),
+    "x3": ("x3", (0, 8)),
+    "w3": ("x3", (0, 4)),
+    "x4": ("x4", (0, 8)),
+    "w4": ("x4", (0, 4)),
+    "x5": ("x5", (0, 8)),
+    "w5": ("x5", (0, 4)),
+    "x6": ("x6", (0, 8)),
+    "w6": ("x6", (0, 4)),
+    "x7": ("x7", (0, 8)),
+    "w7": ("x7", (0, 4)),
+    "x8": ("x8", (0, 8)),
+    "w8": ("x8", (0, 4)),
+    "x9": ("x9", (0, 8)),
+    "w9": ("x9", (0, 4)),
+    "x10": ("x10", (0, 8)),
+    "w10": ("x10", (0, 4)),
+    "x11": ("x11", (0, 8)),
+    "w11": ("x11", (0, 4)),
+    "x12": ("x12", (0, 8)),
+    "w12": ("x12", (0, 4)),
+    "x13": ("x13", (0, 8)),
+    "w13": ("x13", (0, 4)),
+    "x14": ("x14", (0, 8)),
+    "w14": ("x14", (0, 4)),
+    "x15": ("x15", (0, 8)),
+    "w15": ("x15", (0, 4)),
+    "x16": ("x16", (0, 8)),
+    "w16": ("x16", (0, 4)),
+    "x17": ("x17", (0, 8)),
+    "w17": ("x17", (0, 4)),
+    "x18": ("x18", (0, 8)),
+    "w18": ("x18", (0, 4)),
+    "x19": ("x19", (0, 8)),
+    "w19": ("x19", (0, 4)),
+    "x20": ("x20", (0, 8)),
+    "w20": ("x20", (0, 4)),
+    "x21": ("x21", (0, 8)),
+    "w21": ("x21", (0, 4)),
+    "x22": ("x22", (0, 8)),
+    "w22": ("x22", (0, 4)),
+    "x23": ("x23", (0, 8)),
+    "w23": ("x23", (0, 4)),
+    "x24": ("x24", (0, 8)),
+    "w24": ("x24", (0, 4)),
+    "x25": ("x25", (0, 8)),
+    "w25": ("x25", (0, 4)),
+    "x26": ("x26", (0, 8)),
+    "w26": ("x26", (0, 4)),
+    "x27": ("x27", (0, 8)),
+    "w27": ("x27", (0, 4)),
+    "x28": ("x28", (0, 8)),
+    "w28": ("x28", (0, 4)),
+    "x29": ("x29", (0, 8)),
+    "w29": ("x29", (0, 4)),
+    "x30": ("x30", (0, 8)),
+    "w30": ("x30", (0, 4)),
+    # Program Counter
+    "pc": ("pc", (0, 8)),
+    # Stack Pointer
+    "sp": ("sp", (0, 8)),
+    "wsp": ("sp", (0, 4)),
+    # Frame Pointer
+    "fp": ("x29", (0, 8)),
+    # Link Register
+    "lr": ("x30", (0, 8)),
+    # Zero Register
+    "xzr": ("xzr", (0, 8)),
+    "wzr": ("xzr", (0, 4)),
+    # *** System Control Registers ***
+    # NOTE: "_elX" indicates that only exception level X or greater can access this register.
+    # NOTE: This list is far from complete; it only covers what Unicorn supports
+    # Condition Code Register
+    "fpcr": ("fpcr", (0, 8)),
+    # Floating Point Status Register
+    "fpsr": ("fpsr", (0, 8)),
+    # Banked stack pointers for exception handlers
+    "sp_el0": ("sp_el0", (0, 8)),
+    "sp_el1": ("sp_el1", (0, 8)),
+    "sp_el2": ("sp_el2", (0, 8)),
+    "sp_el3": ("sp_el3", (0, 8)),
+    # Banked link regiusters for exception handlers
+    # NOTE: Unicorn thinks there's an elr_el0; according to docs, it doesn't exist
+    "elr_el1": ("elr_el1", (0, 8)),
+    "elr_el2": ("elr_el2", (0, 8)),
+    "elr_el3": ("elr_el3", (0, 8)),
+    # Banked exception syndrome registers for exception handlers
+    # NOTE: Unicorn thinks there's a far_el0; according to docs, it doesn't exist
+    "far_el1": ("far_el1", (0, 8)),
+    "far_el2": ("far_el2", (0, 8)),
+    "far_el3": ("far_el3", (0, 8)),
+    # Banked vector base address registers for exception handlers
+    # NOTE: vbar_el0 doesn't exist in angr.
+    # Since vbar_el0 and el1 are aliases for each other, vbar_el1 must be the "real" register.
+    "vbar_el1": ("vbar_el1", (0, 8)),
+    "vbar_el0": ("vbar_el0", (0, 8)),
+    "vbar_el2": ("vbar_el2", (0, 8)),
+    "vbar_el3": ("vbar_el3", (0, 8)),
+    # Coprocessor access control register
+    "cpacr_el1": ("cpacr_el1", (0, 8)),
+    # Memory Attribute Indirection Register
+    "mair_el1": ("mair_el1", (0, 8)),
+    # Physical Address Register
+    "par_el1": ("par_el1", (0, 8)),
+    # Translation Table Zero Base Register
+    "ttbr0_el1": ("ttbr0_el1", (0, 8)),
+    # Translation Table One Base Register
+    "ttbr1_el1": ("ttbr1_el1", (0, 8)),
+    # Thread ID Register
+    # NOTE: According to docs, there should be an el2 and el3 copy, too.
+    "tpidr_el0": ("tpidr_el0", (0, 8)),
+    "tpidr_el1": ("tpidr_el1", (0, 8)),
+    # Userspace-visible Thread ID register
+    "tpidrro_el0": ("tpidrro_el0", (0, 8)),
+    # *** Floating Point Registers ***
+    # Scalar Floating Point Registers
+    "q0": ("q0", (0, 16)),
+    "d0": ("q0", (0, 8)),
+    "s0": ("q0", (0, 4)),
+    "h0": ("q0", (0, 2)),
+    "b0": ("q0", (0, 1)),
+    "q1": ("q1", (0, 16)),
+    "d1": ("q1", (0, 8)),
+    "s1": ("q1", (0, 4)),
+    "h1": ("q1", (0, 2)),
+    "b1": ("q1", (0, 1)),
+    "q2": ("q2", (0, 16)),
+    "d2": ("q2", (0, 8)),
+    "s2": ("q2", (0, 4)),
+    "h2": ("q2", (0, 2)),
+    "b2": ("q2", (0, 1)),
+    "q3": ("q3", (0, 16)),
+    "d3": ("q3", (0, 8)),
+    "s3": ("q3", (0, 4)),
+    "h3": ("q3", (0, 2)),
+    "b3": ("q3", (0, 1)),
+    "q4": ("q4", (0, 16)),
+    "d4": ("q4", (0, 8)),
+    "s4": ("q4", (0, 4)),
+    "h4": ("q4", (0, 2)),
+    "b4": ("q4", (0, 1)),
+    "q5": ("q5", (0, 16)),
+    "d5": ("q5", (0, 8)),
+    "s5": ("q5", (0, 4)),
+    "h5": ("q5", (0, 2)),
+    "b5": ("q5", (0, 1)),
+    "q6": ("q6", (0, 16)),
+    "d6": ("q6", (0, 8)),
+    "s6": ("q6", (0, 4)),
+    "h6": ("q6", (0, 2)),
+    "b6": ("q6", (0, 1)),
+    "q7": ("q7", (0, 16)),
+    "d7": ("q7", (0, 8)),
+    "s7": ("q7", (0, 4)),
+    "h7": ("q7", (0, 2)),
+    "b7": ("q7", (0, 1)),
+    "q8": ("q8", (0, 16)),
+    "d8": ("q8", (0, 8)),
+    "s8": ("q8", (0, 4)),
+    "h8": ("q8", (0, 2)),
+    "b8": ("q8", (0, 1)),
+    "q9": ("q9", (0, 16)),
+    "d9": ("q9", (0, 8)),
+    "s9": ("q9", (0, 4)),
+    "h9": ("q9", (0, 2)),
+    "b9": ("q9", (0, 1)),
+    "q10": ("q10", (0, 16)),
+    "d10": ("q10", (0, 8)),
+    "s10": ("q10", (0, 4)),
+    "h10": ("q10", (0, 2)),
+    "b10": ("q10", (0, 1)),
+    "q11": ("q11", (0, 16)),
+    "d11": ("q11", (0, 8)),
+    "s11": ("q11", (0, 4)),
+    "h11": ("q11", (0, 2)),
+    "b11": ("q11", (0, 1)),
+    "q12": ("q12", (0, 16)),
+    "d12": ("q12", (0, 8)),
+    "s12": ("q12", (0, 4)),
+    "h12": ("q12", (0, 2)),
+    "b12": ("q12", (0, 1)),
+    "q13": ("q13", (0, 16)),
+    "d13": ("q13", (0, 8)),
+    "s13": ("q13", (0, 4)),
+    "h13": ("q13", (0, 2)),
+    "b13": ("q13", (0, 1)),
+    "q14": ("q14", (0, 16)),
+    "d14": ("q14", (0, 8)),
+    "s14": ("q14", (0, 4)),
+    "h14": ("q14", (0, 2)),
+    "b14": ("q14", (0, 1)),
+    "q15": ("q15", (0, 16)),
+    "d15": ("q15", (0, 8)),
+    "s15": ("q15", (0, 4)),
+    "h15": ("q15", (0, 2)),
+    "b15": ("q15", (0, 1)),
+    "q16": ("q16", (0, 16)),
+    "d16": ("q16", (0, 8)),
+    "s16": ("q16", (0, 4)),
+    "h16": ("q16", (0, 2)),
+    "b16": ("q16", (0, 1)),
+    "q17": ("q17", (0, 16)),
+    "d17": ("q17", (0, 8)),
+    "s17": ("q17", (0, 4)),
+    "h17": ("q17", (0, 2)),
+    "b17": ("q17", (0, 1)),
+    "q18": ("q18", (0, 16)),
+    "d18": ("q18", (0, 8)),
+    "s18": ("q18", (0, 4)),
+    "h18": ("q18", (0, 2)),
+    "b18": ("q18", (0, 1)),
+    "q19": ("q19", (0, 16)),
+    "d19": ("q19", (0, 8)),
+    "s19": ("q19", (0, 4)),
+    "h19": ("q19", (0, 2)),
+    "b19": ("q19", (0, 1)),
+    "q20": ("q20", (0, 16)),
+    "d20": ("q20", (0, 8)),
+    "s20": ("q20", (0, 4)),
+    "h20": ("q20", (0, 2)),
+    "b20": ("q20", (0, 1)),
+    "q21": ("q21", (0, 16)),
+    "d21": ("q21", (0, 8)),
+    "s21": ("q21", (0, 4)),
+    "h21": ("q21", (0, 2)),
+    "b21": ("q21", (0, 1)),
+    "q22": ("q22", (0, 16)),
+    "d22": ("q22", (0, 8)),
+    "s22": ("q22", (0, 4)),
+    "h22": ("q22", (0, 2)),
+    "b22": ("q22", (0, 1)),
+    "q23": ("q23", (0, 16)),
+    "d23": ("q23", (0, 8)),
+    "s23": ("q23", (0, 4)),
+    "h23": ("q23", (0, 2)),
+    "b23": ("q23", (0, 1)),
+    "q24": ("q24", (0, 16)),
+    "d24": ("q24", (0, 8)),
+    "s24": ("q24", (0, 4)),
+    "h24": ("q24", (0, 2)),
+    "b24": ("q24", (0, 1)),
+    "q25": ("q25", (0, 16)),
+    "d25": ("q25", (0, 8)),
+    "s25": ("q25", (0, 4)),
+    "h25": ("q25", (0, 2)),
+    "b25": ("q25", (0, 1)),
+    "q26": ("q26", (0, 16)),
+    "d26": ("q26", (0, 8)),
+    "s26": ("q26", (0, 4)),
+    "h26": ("q26", (0, 2)),
+    "b26": ("q26", (0, 1)),
+    "q27": ("q27", (0, 16)),
+    "d27": ("q27", (0, 8)),
+    "s27": ("q27", (0, 4)),
+    "h27": ("q27", (0, 2)),
+    "b27": ("q27", (0, 1)),
+    "q28": ("q28", (0, 16)),
+    "d28": ("q28", (0, 8)),
+    "s28": ("q28", (0, 4)),
+    "h28": ("q28", (0, 2)),
+    "b28": ("q28", (0, 1)),
+    "q29": ("q29", (0, 16)),
+    "d29": ("q29", (0, 8)),
+    "s29": ("q29", (0, 4)),
+    "h29": ("q29", (0, 2)),
+    "b29": ("q29", (0, 1)),
+    "q30": ("q30", (0, 16)),
+    "d30": ("q30", (0, 8)),
+    "s30": ("q30", (0, 4)),
+    "h30": ("q30", (0, 2)),
+    "b30": ("q30", (0, 1)),
+    "q31": ("q31", (0, 16)),
+    "d31": ("q31", (0, 8)),
+    "s31": ("q31", (0, 4)),
+    "h31": ("q31", (0, 2)),
+    "b31": ("q31", (0, 1)),
+    # Vector registers
+    # TODO: Figure out how to model these
+}

smallworld/arch/amd64_arch.py

@@ -0,0 +1,86 @@
+info = {
+    "rax": ("rax", (0, 8)),
+    "eax": ("rax", (0, 4)),
+    "ax": ("rax", (0, 2)),
+    "al": ("rax", (0, 1)),
+    "ah": ("rax", (1, 2)),
+    "rbx": ("rbx", (0, 8)),
+    "ebx": ("rbx", (0, 4)),
+    "bx": ("rbx", (0, 2)),
+    "bl": ("rbx", (0, 1)),
+    "bh": ("rbx", (1, 2)),
+    "rcx": ("rcx", (0, 8)),
+    "ecx": ("rcx", (0, 4)),
+    "cx": ("rcx", (0, 2)),
+    "cl": ("rcx", (0, 1)),
+    "ch": ("rcx", (1, 2)),
+    "rdx": ("rdx", (0, 8)),
+    "edx": ("rdx", (0, 4)),
+    "dx": ("rdx", (0, 2)),
+    "dl": ("rdx", (0, 1)),
+    "dh": ("rdx", (1, 2)),
+    "r8": ("r8", (0, 8)),
+    "r8d": ("r8", (0, 4)),
+    "r8w": ("r8", (0, 2)),
+    "r8b": ("r8", (0, 1)),
+    "r9": ("r9", (0, 8)),
+    "r9d": ("r9", (0, 4)),
+    "r9w": ("r9", (0, 2)),
+    "r9b": ("r9", (0, 1)),
+    "r10": ("r10", (0, 8)),
+    "r10d": ("r10", (0, 4)),
+    "r10w": ("r10", (0, 2)),
+    "r10b": ("r10", (0, 1)),
+    "r11": ("r11", (0, 8)),
+    "r11d": ("r11", (0, 4)),
+    "r11w": ("r11", (0, 2)),
+    "r11b": ("r11", (0, 1)),
+    "r12": ("r12", (0, 8)),
+    "r12d": ("r12", (0, 4)),
+    "r12w": ("r12", (0, 2)),
+    "r12b": ("r12", (0, 1)),
+    "r13": ("r13", (0, 8)),
+    "r13d": ("r13", (0, 4)),
+    "r13w": ("r13", (0, 2)),
+    "r13b": ("r13", (0, 1)),
+    "r14": ("r14", (0, 8)),
+    "r14d": ("r14", (0, 4)),
+    "r14w": ("r14", (0, 2)),
+    "r14b": ("r14", (0, 1)),
+    "r15": ("r15", (0, 8)),
+    "r15d": ("r15", (0, 4)),
+    "r15w": ("r15", (0, 2)),
+    "r15b": ("r15", (0, 1)),
+    "rsi": ("rsi", (0, 8)),
+    "esi": ("rsi", (0, 4)),
+    "si": ("rsi", (0, 2)),
+    "sil": ("rsi", (0, 1)),
+    "rdi": ("rdi", (0, 8)),
+    "edi": ("rdi", (0, 4)),
+    "di": ("rdi", (0, 2)),
+    "dil": ("rdi", (0, 1)),
+    "rbp": ("rbp", (0, 8)),
+    "ebp": ("rbp", (0, 4)),
+    "bp": ("rbp", (0, 2)),
+    "bpl": ("rbp", (0, 1)),
+    "rsp": ("rsp", (0, 8)),
+    "esp": ("rsp", (0, 4)),
+    "sp": ("rsp", (0, 2)),
+    "spl": ("rsp", (0, 1)),
+    "rip": ("rip", (0, 8)),
+    "eip": ("rip", (0, 4)),
+    "ip": ("rip", (0, 2)),
+    "cs": ("cs", (0, 2)),
+    "ds": ("ds", (0, 2)),
+    "es": ("es", (0, 2)),
+    "fs": ("fs", (0, 2)),
+    "gs": ("fs", (0, 2)),
+    "rflags": ("rflags", (0, 8)),
+    "eflags": ("rflags", (0, 4)),
+    "flags": ("rflags", (0, 2)),
+    "cr0": ("cr0", (0, 8)),
+    "cr1": ("cr1", (0, 8)),
+    "cr2": ("cr2", (0, 8)),
+    "cr3": ("cr3", (0, 8)),
+    "cr4": ("cr4", (0, 8)),
+}

smallworld/arch/i386_arch.py

@@ -0,0 +1,44 @@
+info = {
+    "eax": ("eax", (0, 4)),
+    "ax": ("eax", (0, 2)),
+    "al": ("eax", (0, 1)),
+    "ah": ("eax", (1, 2)),
+    "ebx": ("ebx", (0, 4)),
+    "bx": ("ebx", (0, 2)),
+    "bl": ("ebx", (0, 1)),
+    "bh": ("ebx", (1, 2)),
+    "ecx": ("ecx", (0, 4)),
+    "cx": ("ecx", (0, 2)),
+    "cl": ("ecx", (0, 1)),
+    "ch": ("ecx", (1, 2)),
+    "edx": ("edx", (0, 4)),
+    "dx": ("edx", (0, 2)),
+    "dl": ("edx", (0, 1)),
+    "dh": ("edx", (1, 2)),
+    "esi": ("esi", (0, 4)),
+    "si": ("esi", (0, 2)),
+    "sil": ("edi", (0, 1)),
+    "edi": ("edi", (0, 4)),
+    "di": ("edi", (0, 2)),
+    "dil": ("edi", (0, 1)),
+    "ebp": ("ebp", (0, 4)),
+    "bp": ("ebp", (0, 2)),
+    "bpl": ("ebp", (0, 1)),
+    "esp": ("esp", (0, 4)),
+    "sp": ("esp", (0, 2)),
+    "spl": ("esp", (0, 1)),
+    "eip": ("eip", (0, 4)),
+    "ip": ("eip", (0, 2)),
+    "cs": ("cs", (0, 2)),
+    "ds": ("ds", (0, 2)),
+    "es": ("es", (0, 2)),
+    "fs": ("fs", (0, 2)),
+    "gs": ("fs", (0, 2)),
+    "eflags": ("eflags", (0, 4)),
+    "flags": ("eflags", (0, 2)),
+    "cr0": ("cr0", (0, 4)),
+    "cr1": ("cr1", (0, 4)),
+    "cr2": ("cr2", (0, 4)),
+    "cr3": ("cr3", (0, 4)),
+    "cr4": ("cr4", (0, 4)),
+}