...
|
...
|
@@ -1,5 +1,7 @@
|
1
|
1
|
/*
|
2
|
|
- * Copyright (C) 2008 Sourcefire, Inc.
|
|
2
|
+ * Copyright (C) 2008-2013 Sourcefire, Inc.
|
|
3
|
+ * Copyright (C) 2014 Cisco Systems, Inc. and/or its affiliates.
|
|
4
|
+ * All rights reserved.
|
3
|
5
|
*
|
4
|
6
|
* Authors: aCaB <acab@clamav.net>
|
5
|
7
|
*
|
...
|
...
|
@@ -93,57 +95,57 @@ static const uint8_t sizemap[SIZE_NOSIZE+1][2] = {
|
93
|
93
|
|
94
|
94
|
static const uint8_t regmap[SIZE_DWORD+1][ADDR_REG_GS+1] = {
|
95
|
95
|
/* SIZE_BYTE */
|
96
|
|
- {REG_AL, REG_CL, REG_DL, REG_BL, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
96
|
+ {X86_REG_AL, X86_REG_CL, X86_REG_DL, X86_REG_BL, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
97
|
97
|
/* SIZE_BYTEH */
|
98
|
|
- {REG_AH, REG_CH, REG_DH, REG_BH, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
98
|
+ {X86_REG_AH, X86_REG_CH, X86_REG_DH, X86_REG_BH, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
99
|
99
|
/* SIZE_WORD */
|
100
|
|
- {REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI, REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS},
|
|
100
|
+ {X86_REG_AX, X86_REG_CX, X86_REG_DX, X86_REG_BX, X86_REG_SP, X86_REG_BP, X86_REG_SI, X86_REG_DI, X86_REG_ES, X86_REG_CS, X86_REG_SS, X86_REG_DS, X86_REG_FS, X86_REG_GS},
|
101
|
101
|
/* SIZE_DWORD */
|
102
|
|
- {REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID}
|
|
102
|
+ {X86_REG_EAX, X86_REG_ECX, X86_REG_EDX, X86_REG_EBX, X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID}
|
103
|
103
|
};
|
104
|
104
|
|
105
|
105
|
static const uint8_t mrm_regmap[3][8] = {
|
106
|
106
|
/* SIZEB */
|
107
|
|
- {REG_AL, REG_CL, REG_DL, REG_BL, REG_AH, REG_CH, REG_DH, REG_BH},
|
|
107
|
+ {X86_REG_AL, X86_REG_CL, X86_REG_DL, X86_REG_BL, X86_REG_AH, X86_REG_CH, X86_REG_DH, X86_REG_BH},
|
108
|
108
|
/* SIZEW */
|
109
|
|
- {REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI},
|
|
109
|
+ {X86_REG_AX, X86_REG_CX, X86_REG_DX, X86_REG_BX, X86_REG_SP, X86_REG_BP, X86_REG_SI, X86_REG_DI},
|
110
|
110
|
/* SIZED */
|
111
|
|
- {REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI}
|
|
111
|
+ {X86_REG_EAX, X86_REG_ECX, X86_REG_EDX, X86_REG_EBX, X86_REG_ESP, X86_REG_EBP, X86_REG_ESI, X86_REG_EDI}
|
112
|
112
|
};
|
113
|
113
|
|
114
|
114
|
static const uint8_t mrm_sregmap[3][8] = {
|
115
|
115
|
/* SIZEB */
|
116
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
116
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
117
|
117
|
/* SIZEW */
|
118
|
|
- {REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS, REG_INVALID, REG_INVALID},
|
|
118
|
+ {X86_REG_ES, X86_REG_CS, X86_REG_SS, X86_REG_DS, X86_REG_FS, X86_REG_GS, X86_REG_INVALID, X86_REG_INVALID},
|
119
|
119
|
/* SIZED */
|
120
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID}
|
|
120
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID}
|
121
|
121
|
};
|
122
|
122
|
|
123
|
123
|
static const uint8_t mrm_cregmap[3][8] = {
|
124
|
124
|
/* SIZEB */
|
125
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
125
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
126
|
126
|
/* SIZEW */
|
127
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
127
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
128
|
128
|
/* SIZED */
|
129
|
|
- {REG_CR0, REG_INVALID, BREG_CR2, REG_CR3, REG_CR4, REG_INVALID, REG_INVALID, REG_INVALID}
|
|
129
|
+ {X86_REG_CR0, X86_REG_INVALID, X86_REG_CR2, X86_REG_CR3, X86_REG_CR4, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID}
|
130
|
130
|
};
|
131
|
131
|
|
132
|
132
|
static const uint8_t mrm_dregmap[3][8] = {
|
133
|
133
|
/* SIZEB */
|
134
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
134
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
135
|
135
|
/* SIZEW */
|
136
|
|
- {REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID, REG_INVALID},
|
|
136
|
+ {X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID, X86_REG_INVALID},
|
137
|
137
|
/* SIZED */
|
138
|
|
- {REG_DR0, REG_DR1, REG_DR2, REG_DR3, REG_INVALID, REG_INVALID, REG_DR6, REG_DR7}
|
|
138
|
+ {X86_REG_DR0, X86_REG_DR1, X86_REG_DR2, X86_REG_DR3, X86_REG_INVALID, X86_REG_INVALID, X86_REG_DR6, X86_REG_DR7}
|
139
|
139
|
};
|
140
|
140
|
|
141
|
141
|
static const struct {
|
142
|
142
|
enum X86REGS r1;
|
143
|
143
|
enum X86REGS r2;
|
144
|
144
|
} mrm_regmapw[8] = {
|
145
|
|
- {REG_BX, REG_SI}, {REG_BX, REG_DI}, {REG_BP, REG_SI}, {REG_BP, REG_DI}, {REG_SI, REG_INVALID}, {REG_DI, REG_INVALID}, {REG_BP, REG_INVALID}, {REG_BX, REG_INVALID}
|
146
|
|
-};
|
|
145
|
+ {X86_REG_BX, X86_REG_SI}, {X86_REG_BX, X86_REG_DI}, {X86_REG_BP, X86_REG_SI}, {X86_REG_BP, X86_REG_DI}, {X86_REG_SI, X86_REG_INVALID}, {X86_REG_DI, X86_REG_INVALID}, {X86_REG_BP, X86_REG_INVALID}, {X86_REG_BX, X86_REG_INVALID}
|
|
146
|
+};
|
147
|
147
|
|
148
|
148
|
static const struct {
|
149
|
149
|
enum X86OPS op;
|
...
|
...
|
@@ -1219,7 +1221,7 @@ static void spam_x86(struct DISASMED *s, char *hr) {
|
1219
|
1219
|
if(s->segment) hr += sprintf(hr, "%s:", x86regs[s->segment]);
|
1220
|
1220
|
*hr++ = '[';
|
1221
|
1221
|
*hr = '\0';
|
1222
|
|
- if(s->args[i].arg.marg.r1!=REG_INVALID) {
|
|
1222
|
+ if(s->args[i].arg.marg.r1!=X86_REG_INVALID) {
|
1223
|
1223
|
switch(s->args[i].arg.marg.scale) {
|
1224
|
1224
|
case 1:
|
1225
|
1225
|
hr += sprintf(hr, "%s", x86regs[s->args[i].arg.marg.r1]);
|
...
|
...
|
@@ -1232,7 +1234,7 @@ static void spam_x86(struct DISASMED *s, char *hr) {
|
1232
|
1232
|
gotstuff="+";
|
1233
|
1233
|
}
|
1234
|
1234
|
}
|
1235
|
|
- if(s->args[i].arg.marg.r2!=REG_INVALID) {
|
|
1235
|
+ if(s->args[i].arg.marg.r2!=X86_REG_INVALID) {
|
1236
|
1236
|
hr += sprintf(hr, "%s%s", gotstuff, x86regs[s->args[i].arg.marg.r2]);
|
1237
|
1237
|
gotstuff="+";
|
1238
|
1238
|
}
|
...
|
...
|
@@ -1309,10 +1311,10 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1309
|
1309
|
reversed = 1;
|
1310
|
1310
|
case X87_R:
|
1311
|
1311
|
s->args[reversed^1].access = ACCESS_REG;
|
1312
|
|
- s->args[reversed^1].reg = REG_ST0;
|
|
1312
|
+ s->args[reversed^1].reg = X86_REG_ST0;
|
1313
|
1313
|
case X87_ONE:
|
1314
|
1314
|
s->args[reversed].access = ACCESS_REG;
|
1315
|
|
- s->args[reversed].reg = REG_ST0 + (rm&7);
|
|
1315
|
+ s->args[reversed].reg = X86_REG_ST0 + (rm&7);
|
1316
|
1316
|
break;
|
1317
|
1317
|
case X87_NONE:
|
1318
|
1318
|
break;
|
...
|
...
|
@@ -1340,24 +1342,24 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1340
|
1340
|
base&=7;
|
1341
|
1341
|
|
1342
|
1342
|
s->args[0].arg.marg.scale = 1<<scale;
|
1343
|
|
- if((s->args[0].arg.marg.r2=mrm_regmap[SIZED][base])==REG_EBP && mod==0) {
|
1344
|
|
- s->args[0].arg.marg.r2=REG_INVALID;
|
|
1343
|
+ if((s->args[0].arg.marg.r2=mrm_regmap[SIZED][base])==X86_REG_EBP && mod==0) {
|
|
1344
|
+ s->args[0].arg.marg.r2=X86_REG_INVALID;
|
1345
|
1345
|
mod=2;
|
1346
|
1346
|
}
|
1347
|
|
- if((s->args[0].arg.marg.r1=mrm_regmap[SIZED][idx])==REG_ESP) {
|
|
1347
|
+ if((s->args[0].arg.marg.r1=mrm_regmap[SIZED][idx])==X86_REG_ESP) {
|
1348
|
1348
|
s->args[0].arg.marg.r1=s->args[0].arg.marg.r2;
|
1349
|
|
- s->args[0].arg.marg.scale = (s->args[0].arg.marg.r2!=REG_INVALID);
|
1350
|
|
- s->args[0].arg.marg.r2=REG_INVALID;
|
|
1349
|
+ s->args[0].arg.marg.scale = (s->args[0].arg.marg.r2!=X86_REG_INVALID);
|
|
1350
|
+ s->args[0].arg.marg.r2=X86_REG_INVALID;
|
1351
|
1351
|
}
|
1352
|
1352
|
} else {
|
1353
|
1353
|
if (mod==0 && rm==5) {
|
1354
|
1354
|
mod=2;
|
1355
|
|
- s->args[0].arg.marg.r1=REG_INVALID;
|
|
1355
|
+ s->args[0].arg.marg.r1=X86_REG_INVALID;
|
1356
|
1356
|
} else {
|
1357
|
1357
|
s->args[0].arg.marg.scale=1;
|
1358
|
1358
|
s->args[0].arg.marg.r1=mrm_regmap[SIZED][rm];
|
1359
|
1359
|
}
|
1360
|
|
- s->args[0].arg.marg.r2=REG_INVALID;
|
|
1360
|
+ s->args[0].arg.marg.r2=X86_REG_INVALID;
|
1361
|
1361
|
}
|
1362
|
1362
|
if(mod==2) mod+=mod;
|
1363
|
1363
|
for (i=0; i<mod; i++) {
|
...
|
...
|
@@ -1367,7 +1369,7 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1367
|
1367
|
}
|
1368
|
1368
|
} else {
|
1369
|
1369
|
if (mod==0 && rm==6) {
|
1370
|
|
- s->args[0].arg.marg.r1=REG_INVALID;
|
|
1370
|
+ s->args[0].arg.marg.r1=X86_REG_INVALID;
|
1371
|
1371
|
mod=2;
|
1372
|
1372
|
} else {
|
1373
|
1373
|
s->args[0].arg.marg.scale=1;
|
...
|
...
|
@@ -1490,7 +1492,7 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1490
|
1490
|
}
|
1491
|
1491
|
|
1492
|
1492
|
s->args[reversed^1].access = ACCESS_REG;
|
1493
|
|
- if ((s->args[reversed^1].reg = p[s->args[reversed].size][rop]) == REG_INVALID) INVALIDATE;
|
|
1493
|
+ if ((s->args[reversed^1].reg = p[s->args[reversed].size][rop]) == X86_REG_INVALID) INVALIDATE;
|
1494
|
1494
|
|
1495
|
1495
|
/* MOVZX size fixxup */
|
1496
|
1496
|
if(s->real_op == OP_MOVZX || s->real_op == OP_MOVSX)
|
...
|
...
|
@@ -1527,24 +1529,24 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1527
|
1527
|
base&=7;
|
1528
|
1528
|
|
1529
|
1529
|
s->args[reversed].arg.marg.scale = 1<<scale;
|
1530
|
|
- if((s->args[reversed].arg.marg.r2=mrm_regmap[SIZED][base])==REG_EBP && mod==0) {
|
1531
|
|
- s->args[reversed].arg.marg.r2=REG_INVALID;
|
|
1530
|
+ if((s->args[reversed].arg.marg.r2=mrm_regmap[SIZED][base])==X86_REG_EBP && mod==0) {
|
|
1531
|
+ s->args[reversed].arg.marg.r2=X86_REG_INVALID;
|
1532
|
1532
|
mod=2;
|
1533
|
1533
|
}
|
1534
|
|
- if((s->args[reversed].arg.marg.r1=mrm_regmap[SIZED][idx])==REG_ESP) {
|
|
1534
|
+ if((s->args[reversed].arg.marg.r1=mrm_regmap[SIZED][idx])==X86_REG_ESP) {
|
1535
|
1535
|
s->args[reversed].arg.marg.r1=s->args[reversed].arg.marg.r2;
|
1536
|
|
- s->args[reversed].arg.marg.scale = (s->args[reversed].arg.marg.r2!=REG_INVALID);
|
1537
|
|
- s->args[reversed].arg.marg.r2=REG_INVALID;
|
|
1536
|
+ s->args[reversed].arg.marg.scale = (s->args[reversed].arg.marg.r2!=X86_REG_INVALID);
|
|
1537
|
+ s->args[reversed].arg.marg.r2=X86_REG_INVALID;
|
1538
|
1538
|
}
|
1539
|
1539
|
} else {
|
1540
|
1540
|
if (mod==0 && rm==5) {
|
1541
|
1541
|
mod=2;
|
1542
|
|
- s->args[reversed].arg.marg.r1=REG_INVALID;
|
|
1542
|
+ s->args[reversed].arg.marg.r1=X86_REG_INVALID;
|
1543
|
1543
|
} else {
|
1544
|
1544
|
s->args[reversed].arg.marg.scale=1;
|
1545
|
1545
|
s->args[reversed].arg.marg.r1=mrm_regmap[SIZED][rm];
|
1546
|
1546
|
}
|
1547
|
|
- s->args[reversed].arg.marg.r2=REG_INVALID;
|
|
1547
|
+ s->args[reversed].arg.marg.r2=X86_REG_INVALID;
|
1548
|
1548
|
}
|
1549
|
1549
|
if(mod==2) mod+=mod;
|
1550
|
1550
|
for (i=0; i<mod; i++) {
|
...
|
...
|
@@ -1557,7 +1559,7 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1557
|
1557
|
} else s->args[reversed].arg.marg.disp=0;
|
1558
|
1558
|
} else {
|
1559
|
1559
|
if (mod==0 && rm==6) {
|
1560
|
|
- s->args[reversed].arg.marg.r1=REG_INVALID;
|
|
1560
|
+ s->args[reversed].arg.marg.r1=X86_REG_INVALID;
|
1561
|
1561
|
mod=2;
|
1562
|
1562
|
} else {
|
1563
|
1563
|
s->args[reversed].arg.marg.scale=1;
|
...
|
...
|
@@ -1597,8 +1599,8 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1597
|
1597
|
s->args[0].size=sizemap[x86ops[table][s->table_op].dsize][s->opsize];
|
1598
|
1598
|
assert(s->args[0].size!=255);
|
1599
|
1599
|
s->args[0].size>>=1;
|
1600
|
|
- s->args[0].arg.marg.r1=REG_INVALID;
|
1601
|
|
- s->args[0].arg.marg.r2=REG_INVALID;
|
|
1600
|
+ s->args[0].arg.marg.r1=X86_REG_INVALID;
|
|
1601
|
+ s->args[0].arg.marg.r2=X86_REG_INVALID;
|
1602
|
1602
|
for (i=0; i<sz; i++) {
|
1603
|
1603
|
GETBYTE(b);
|
1604
|
1604
|
s->args[0].arg.marg.disp+=b<<(i*8);
|
...
|
...
|
@@ -1661,8 +1663,8 @@ static const uint8_t *disasm_x86(const uint8_t *command, unsigned int len, struc
|
1661
|
1661
|
s->args[1].size=sizemap[x86ops[table][s->table_op].ssize][s->opsize];
|
1662
|
1662
|
assert(s->args[1].size!=255);
|
1663
|
1663
|
s->args[1].size>>=1;
|
1664
|
|
- s->args[1].arg.marg.r1=REG_INVALID;
|
1665
|
|
- s->args[1].arg.marg.r2=REG_INVALID;
|
|
1664
|
+ s->args[1].arg.marg.r1=X86_REG_INVALID;
|
|
1665
|
+ s->args[1].arg.marg.r2=X86_REG_INVALID;
|
1666
|
1666
|
for (i=0; i<sz; i++) {
|
1667
|
1667
|
GETBYTE(b);
|
1668
|
1668
|
s->args[1].arg.marg.disp+=b<<(i*8);
|