/src/capstonev5/arch/X86/X86DisassemblerDecoder.c
Line | Count | Source (jump to first uncovered line) |
1 | | /*===-- X86DisassemblerDecoder.c - Disassembler decoder ------------*- C -*-===* |
2 | | * |
3 | | * The LLVM Compiler Infrastructure |
4 | | * |
5 | | * This file is distributed under the University of Illinois Open Source |
6 | | * License. See LICENSE.TXT for details. |
7 | | * |
8 | | *===----------------------------------------------------------------------===* |
9 | | * |
10 | | * This file is part of the X86 Disassembler. |
11 | | * It contains the implementation of the instruction decoder. |
12 | | * Documentation for the disassembler can be found in X86Disassembler.h. |
13 | | * |
14 | | *===----------------------------------------------------------------------===*/ |
15 | | |
16 | | /* Capstone Disassembly Engine */ |
17 | | /* By Nguyen Anh Quynh <aquynh@gmail.com>, 2013-2019 */ |
18 | | |
19 | | #ifdef CAPSTONE_HAS_X86 |
20 | | |
21 | | #include <stdarg.h> /* for va_*() */ |
22 | | #if defined(CAPSTONE_HAS_OSXKERNEL) |
23 | | #include <libkern/libkern.h> |
24 | | #else |
25 | | #include <stdlib.h> /* for exit() */ |
26 | | #endif |
27 | | |
28 | | #include <string.h> |
29 | | |
30 | | #include "../../cs_priv.h" |
31 | | #include "../../utils.h" |
32 | | |
33 | | #include "X86DisassemblerDecoder.h" |
34 | | #include "X86Mapping.h" |
35 | | |
36 | | /// Specifies whether a ModR/M byte is needed and (if so) which |
37 | | /// instruction each possible value of the ModR/M byte corresponds to. Once |
38 | | /// this information is known, we have narrowed down to a single instruction. |
39 | | struct ModRMDecision { |
40 | | uint8_t modrm_type; |
41 | | uint16_t instructionIDs; |
42 | | }; |
43 | | |
44 | | /// Specifies which set of ModR/M->instruction tables to look at |
45 | | /// given a particular opcode. |
46 | | struct OpcodeDecision { |
47 | | struct ModRMDecision modRMDecisions[256]; |
48 | | }; |
49 | | |
50 | | /// Specifies which opcode->instruction tables to look at given |
51 | | /// a particular context (set of attributes). Since there are many possible |
52 | | /// contexts, the decoder first uses CONTEXTS_SYM to determine which context |
53 | | /// applies given a specific set of attributes. Hence there are only IC_max |
54 | | /// entries in this table, rather than 2^(ATTR_max). |
55 | | struct ContextDecision { |
56 | | struct OpcodeDecision opcodeDecisions[IC_max]; |
57 | | }; |
58 | | |
59 | | #ifdef CAPSTONE_X86_REDUCE |
60 | | #include "X86GenDisassemblerTables_reduce.inc" |
61 | | #include "X86GenDisassemblerTables_reduce2.inc" |
62 | | #include "X86Lookup16_reduce.inc" |
63 | | #else |
64 | | #include "X86GenDisassemblerTables.inc" |
65 | | #include "X86GenDisassemblerTables2.inc" |
66 | | #include "X86Lookup16.inc" |
67 | | #endif |
68 | | |
69 | | /* |
70 | | * contextForAttrs - Client for the instruction context table. Takes a set of |
71 | | * attributes and returns the appropriate decode context. |
72 | | * |
73 | | * @param attrMask - Attributes, from the enumeration attributeBits. |
74 | | * @return - The InstructionContext to use when looking up an |
75 | | * an instruction with these attributes. |
76 | | */ |
77 | | static InstructionContext contextForAttrs(uint16_t attrMask) |
78 | 2.78M | { |
79 | 2.78M | return CONTEXTS_SYM[attrMask]; |
80 | 2.78M | } |
81 | | |
82 | | /* |
83 | | * modRMRequired - Reads the appropriate instruction table to determine whether |
84 | | * the ModR/M byte is required to decode a particular instruction. |
85 | | * |
86 | | * @param type - The opcode type (i.e., how many bytes it has). |
87 | | * @param insnContext - The context for the instruction, as returned by |
88 | | * contextForAttrs. |
89 | | * @param opcode - The last byte of the instruction's opcode, not counting |
90 | | * ModR/M extensions and escapes. |
91 | | * @return - true if the ModR/M byte is required, false otherwise. |
92 | | */ |
93 | | static int modRMRequired(OpcodeType type, |
94 | | InstructionContext insnContext, |
95 | | uint16_t opcode) |
96 | 2.78M | { |
97 | 2.78M | const struct OpcodeDecision *decision = NULL; |
98 | 2.78M | const uint8_t *indextable = NULL; |
99 | 2.78M | unsigned int index; |
100 | | |
101 | 2.78M | switch (type) { |
102 | 0 | default: break; |
103 | 2.46M | case ONEBYTE: |
104 | 2.46M | decision = ONEBYTE_SYM; |
105 | 2.46M | indextable = index_x86DisassemblerOneByteOpcodes; |
106 | 2.46M | break; |
107 | 176k | case TWOBYTE: |
108 | 176k | decision = TWOBYTE_SYM; |
109 | 176k | indextable = index_x86DisassemblerTwoByteOpcodes; |
110 | 176k | break; |
111 | 49.2k | case THREEBYTE_38: |
112 | 49.2k | decision = THREEBYTE38_SYM; |
113 | 49.2k | indextable = index_x86DisassemblerThreeByte38Opcodes; |
114 | 49.2k | break; |
115 | 68.2k | case THREEBYTE_3A: |
116 | 68.2k | decision = THREEBYTE3A_SYM; |
117 | 68.2k | indextable = index_x86DisassemblerThreeByte3AOpcodes; |
118 | 68.2k | break; |
119 | 0 | #ifndef CAPSTONE_X86_REDUCE |
120 | 15.4k | case XOP8_MAP: |
121 | 15.4k | decision = XOP8_MAP_SYM; |
122 | 15.4k | indextable = index_x86DisassemblerXOP8Opcodes; |
123 | 15.4k | break; |
124 | 2.15k | case XOP9_MAP: |
125 | 2.15k | decision = XOP9_MAP_SYM; |
126 | 2.15k | indextable = index_x86DisassemblerXOP9Opcodes; |
127 | 2.15k | break; |
128 | 930 | case XOPA_MAP: |
129 | 930 | decision = XOPA_MAP_SYM; |
130 | 930 | indextable = index_x86DisassemblerXOPAOpcodes; |
131 | 930 | break; |
132 | 2.71k | case THREEDNOW_MAP: |
133 | | // 3DNow instructions always have ModRM byte |
134 | 2.71k | return true; |
135 | 2.78M | #endif |
136 | 2.78M | } |
137 | | |
138 | | // return decision->opcodeDecisions[insnContext].modRMDecisions[opcode].modrm_type != MODRM_ONEENTRY; |
139 | 2.77M | index = indextable[insnContext]; |
140 | 2.77M | if (index) |
141 | 2.77M | return decision[index - 1].modRMDecisions[opcode].modrm_type != MODRM_ONEENTRY; |
142 | 8.07k | else |
143 | 8.07k | return false; |
144 | 2.77M | } |
145 | | |
146 | | /* |
147 | | * decode - Reads the appropriate instruction table to obtain the unique ID of |
148 | | * an instruction. |
149 | | * |
150 | | * @param type - See modRMRequired(). |
151 | | * @param insnContext - See modRMRequired(). |
152 | | * @param opcode - See modRMRequired(). |
153 | | * @param modRM - The ModR/M byte if required, or any value if not. |
154 | | * @return - The UID of the instruction, or 0 on failure. |
155 | | */ |
156 | | static InstrUID decode(OpcodeType type, |
157 | | InstructionContext insnContext, |
158 | | uint8_t opcode, |
159 | | uint8_t modRM) |
160 | 2.77M | { |
161 | 2.77M | const struct ModRMDecision *dec = NULL; |
162 | 2.77M | unsigned int index; |
163 | 2.77M | static const struct OpcodeDecision emptyDecision = { 0 }; |
164 | | |
165 | 2.77M | switch (type) { |
166 | 0 | default: break; // never reach |
167 | 2.46M | case ONEBYTE: |
168 | | // dec = &ONEBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
169 | 2.46M | index = index_x86DisassemblerOneByteOpcodes[insnContext]; |
170 | 2.46M | if (index) |
171 | 2.46M | dec = &ONEBYTE_SYM[index - 1].modRMDecisions[opcode]; |
172 | 245 | else |
173 | 245 | dec = &emptyDecision.modRMDecisions[opcode]; |
174 | 2.46M | break; |
175 | 176k | case TWOBYTE: |
176 | | //dec = &TWOBYTE_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
177 | 176k | index = index_x86DisassemblerTwoByteOpcodes[insnContext]; |
178 | 176k | if (index) |
179 | 173k | dec = &TWOBYTE_SYM[index - 1].modRMDecisions[opcode]; |
180 | 3.77k | else |
181 | 3.77k | dec = &emptyDecision.modRMDecisions[opcode]; |
182 | 176k | break; |
183 | 49.1k | case THREEBYTE_38: |
184 | | // dec = &THREEBYTE38_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
185 | 49.1k | index = index_x86DisassemblerThreeByte38Opcodes[insnContext]; |
186 | 49.1k | if (index) |
187 | 48.9k | dec = &THREEBYTE38_SYM[index - 1].modRMDecisions[opcode]; |
188 | 256 | else |
189 | 256 | dec = &emptyDecision.modRMDecisions[opcode]; |
190 | 49.1k | break; |
191 | 68.2k | case THREEBYTE_3A: |
192 | | //dec = &THREEBYTE3A_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
193 | 68.2k | index = index_x86DisassemblerThreeByte3AOpcodes[insnContext]; |
194 | 68.2k | if (index) |
195 | 68.1k | dec = &THREEBYTE3A_SYM[index - 1].modRMDecisions[opcode]; |
196 | 167 | else |
197 | 167 | dec = &emptyDecision.modRMDecisions[opcode]; |
198 | 68.2k | break; |
199 | 0 | #ifndef CAPSTONE_X86_REDUCE |
200 | 15.4k | case XOP8_MAP: |
201 | | // dec = &XOP8_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
202 | 15.4k | index = index_x86DisassemblerXOP8Opcodes[insnContext]; |
203 | 15.4k | if (index) |
204 | 12.6k | dec = &XOP8_MAP_SYM[index - 1].modRMDecisions[opcode]; |
205 | 2.80k | else |
206 | 2.80k | dec = &emptyDecision.modRMDecisions[opcode]; |
207 | 15.4k | break; |
208 | 2.15k | case XOP9_MAP: |
209 | | // dec = &XOP9_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
210 | 2.15k | index = index_x86DisassemblerXOP9Opcodes[insnContext]; |
211 | 2.15k | if (index) |
212 | 1.52k | dec = &XOP9_MAP_SYM[index - 1].modRMDecisions[opcode]; |
213 | 631 | else |
214 | 631 | dec = &emptyDecision.modRMDecisions[opcode]; |
215 | 2.15k | break; |
216 | 926 | case XOPA_MAP: |
217 | | // dec = &XOPA_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
218 | 926 | index = index_x86DisassemblerXOPAOpcodes[insnContext]; |
219 | 926 | if (index) |
220 | 730 | dec = &XOPA_MAP_SYM[index - 1].modRMDecisions[opcode]; |
221 | 196 | else |
222 | 196 | dec = &emptyDecision.modRMDecisions[opcode]; |
223 | 926 | break; |
224 | 2.71k | case THREEDNOW_MAP: |
225 | | // dec = &THREEDNOW_MAP_SYM.opcodeDecisions[insnContext].modRMDecisions[opcode]; |
226 | 2.71k | index = index_x86Disassembler3DNowOpcodes[insnContext]; |
227 | 2.71k | if (index) |
228 | 2.13k | dec = &THREEDNOW_MAP_SYM[index - 1].modRMDecisions[opcode]; |
229 | 589 | else |
230 | 589 | dec = &emptyDecision.modRMDecisions[opcode]; |
231 | 2.71k | break; |
232 | 2.77M | #endif |
233 | 2.77M | } |
234 | | |
235 | 2.77M | switch (dec->modrm_type) { |
236 | 0 | default: |
237 | | // debug("Corrupt table! Unknown modrm_type"); |
238 | 0 | return 0; |
239 | 1.36M | case MODRM_ONEENTRY: |
240 | 1.36M | return modRMTable[dec->instructionIDs]; |
241 | 1.12M | case MODRM_SPLITRM: |
242 | 1.12M | if (modFromModRM(modRM) == 0x3) |
243 | 205k | return modRMTable[dec->instructionIDs + 1]; |
244 | 919k | return modRMTable[dec->instructionIDs]; |
245 | 245k | case MODRM_SPLITREG: |
246 | 245k | if (modFromModRM(modRM) == 0x3) |
247 | 85.7k | return modRMTable[dec->instructionIDs+((modRM & 0x38) >> 3) + 8]; |
248 | 160k | return modRMTable[dec->instructionIDs+((modRM & 0x38) >> 3)]; |
249 | 45.4k | case MODRM_SPLITMISC: |
250 | 45.4k | if (modFromModRM(modRM) == 0x3) |
251 | 10.9k | return modRMTable[dec->instructionIDs+(modRM & 0x3f) + 8]; |
252 | 34.4k | return modRMTable[dec->instructionIDs+((modRM & 0x38) >> 3)]; |
253 | 0 | case MODRM_FULL: |
254 | 0 | return modRMTable[dec->instructionIDs+modRM]; |
255 | 2.77M | } |
256 | 2.77M | } |
257 | | |
258 | | /* |
259 | | * specifierForUID - Given a UID, returns the name and operand specification for |
260 | | * that instruction. |
261 | | * |
262 | | * @param uid - The unique ID for the instruction. This should be returned by |
263 | | * decode(); specifierForUID will not check bounds. |
264 | | * @return - A pointer to the specification for that instruction. |
265 | | */ |
266 | | static const struct InstructionSpecifier *specifierForUID(InstrUID uid) |
267 | 2.33M | { |
268 | 2.33M | return &INSTRUCTIONS_SYM[uid]; |
269 | 2.33M | } |
270 | | |
271 | | /* |
272 | | * consumeByte - Uses the reader function provided by the user to consume one |
273 | | * byte from the instruction's memory and advance the cursor. |
274 | | * |
275 | | * @param insn - The instruction with the reader function to use. The cursor |
276 | | * for this instruction is advanced. |
277 | | * @param byte - A pointer to a pre-allocated memory buffer to be populated |
278 | | * with the data read. |
279 | | * @return - 0 if the read was successful; nonzero otherwise. |
280 | | */ |
281 | | static int consumeByte(struct InternalInstruction* insn, uint8_t* byte) |
282 | 7.01M | { |
283 | 7.01M | int ret = insn->reader(insn->readerArg, byte, insn->readerCursor); |
284 | | |
285 | 7.01M | if (!ret) |
286 | 7.01M | ++(insn->readerCursor); |
287 | | |
288 | 7.01M | return ret; |
289 | 7.01M | } |
290 | | |
291 | | /* |
292 | | * lookAtByte - Like consumeByte, but does not advance the cursor. |
293 | | * |
294 | | * @param insn - See consumeByte(). |
295 | | * @param byte - See consumeByte(). |
296 | | * @return - See consumeByte(). |
297 | | */ |
298 | | static int lookAtByte(struct InternalInstruction* insn, uint8_t* byte) |
299 | 619k | { |
300 | 619k | return insn->reader(insn->readerArg, byte, insn->readerCursor); |
301 | 619k | } |
302 | | |
303 | | static void unconsumeByte(struct InternalInstruction* insn) |
304 | 2.59M | { |
305 | 2.59M | insn->readerCursor--; |
306 | 2.59M | } |
307 | | |
308 | | #define CONSUME_FUNC(name, type) \ |
309 | 402k | static int name(struct InternalInstruction* insn, type* ptr) { \ |
310 | 402k | type combined = 0; \ |
311 | 402k | unsigned offset; \ |
312 | 1.32M | for (offset = 0; offset < sizeof(type); ++offset) { \ |
313 | 919k | uint8_t byte; \ |
314 | 919k | int ret = insn->reader(insn->readerArg, \ |
315 | 919k | &byte, \ |
316 | 919k | insn->readerCursor + offset); \ |
317 | 919k | if (ret) \ |
318 | 919k | return ret; \ |
319 | 919k | combined = combined | ((uint64_t)byte << (offset * 8)); \ |
320 | 917k | } \ |
321 | 402k | *ptr = combined; \ |
322 | 400k | insn->readerCursor += sizeof(type); \ |
323 | 400k | return 0; \ |
324 | 402k | } X86DisassemblerDecoder.c:consumeInt8 Line | Count | Source | 309 | 163k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 163k | type combined = 0; \ | 311 | 163k | unsigned offset; \ | 312 | 327k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 163k | uint8_t byte; \ | 314 | 163k | int ret = insn->reader(insn->readerArg, \ | 315 | 163k | &byte, \ | 316 | 163k | insn->readerCursor + offset); \ | 317 | 163k | if (ret) \ | 318 | 163k | return ret; \ | 319 | 163k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 163k | } \ | 321 | 163k | *ptr = combined; \ | 322 | 163k | insn->readerCursor += sizeof(type); \ | 323 | 163k | return 0; \ | 324 | 163k | } |
X86DisassemblerDecoder.c:consumeInt16 Line | Count | Source | 309 | 35.3k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 35.3k | type combined = 0; \ | 311 | 35.3k | unsigned offset; \ | 312 | 105k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 70.6k | uint8_t byte; \ | 314 | 70.6k | int ret = insn->reader(insn->readerArg, \ | 315 | 70.6k | &byte, \ | 316 | 70.6k | insn->readerCursor + offset); \ | 317 | 70.6k | if (ret) \ | 318 | 70.6k | return ret; \ | 319 | 70.6k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 70.5k | } \ | 321 | 35.3k | *ptr = combined; \ | 322 | 35.2k | insn->readerCursor += sizeof(type); \ | 323 | 35.2k | return 0; \ | 324 | 35.3k | } |
X86DisassemblerDecoder.c:consumeInt32 Line | Count | Source | 309 | 57.5k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 57.5k | type combined = 0; \ | 311 | 57.5k | unsigned offset; \ | 312 | 286k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 229k | uint8_t byte; \ | 314 | 229k | int ret = insn->reader(insn->readerArg, \ | 315 | 229k | &byte, \ | 316 | 229k | insn->readerCursor + offset); \ | 317 | 229k | if (ret) \ | 318 | 229k | return ret; \ | 319 | 229k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 228k | } \ | 321 | 57.5k | *ptr = combined; \ | 322 | 57.0k | insn->readerCursor += sizeof(type); \ | 323 | 57.0k | return 0; \ | 324 | 57.5k | } |
X86DisassemblerDecoder.c:consumeUInt16 Line | Count | Source | 309 | 78.4k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 78.4k | type combined = 0; \ | 311 | 78.4k | unsigned offset; \ | 312 | 234k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 156k | uint8_t byte; \ | 314 | 156k | int ret = insn->reader(insn->readerArg, \ | 315 | 156k | &byte, \ | 316 | 156k | insn->readerCursor + offset); \ | 317 | 156k | if (ret) \ | 318 | 156k | return ret; \ | 319 | 156k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 156k | } \ | 321 | 78.4k | *ptr = combined; \ | 322 | 78.0k | insn->readerCursor += sizeof(type); \ | 323 | 78.0k | return 0; \ | 324 | 78.4k | } |
X86DisassemblerDecoder.c:consumeUInt32 Line | Count | Source | 309 | 60.3k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 60.3k | type combined = 0; \ | 311 | 60.3k | unsigned offset; \ | 312 | 300k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 240k | uint8_t byte; \ | 314 | 240k | int ret = insn->reader(insn->readerArg, \ | 315 | 240k | &byte, \ | 316 | 240k | insn->readerCursor + offset); \ | 317 | 240k | if (ret) \ | 318 | 240k | return ret; \ | 319 | 240k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 239k | } \ | 321 | 60.3k | *ptr = combined; \ | 322 | 59.7k | insn->readerCursor += sizeof(type); \ | 323 | 59.7k | return 0; \ | 324 | 60.3k | } |
X86DisassemblerDecoder.c:consumeUInt64 Line | Count | Source | 309 | 7.44k | static int name(struct InternalInstruction* insn, type* ptr) { \ | 310 | 7.44k | type combined = 0; \ | 311 | 7.44k | unsigned offset; \ | 312 | 66.3k | for (offset = 0; offset < sizeof(type); ++offset) { \ | 313 | 58.9k | uint8_t byte; \ | 314 | 58.9k | int ret = insn->reader(insn->readerArg, \ | 315 | 58.9k | &byte, \ | 316 | 58.9k | insn->readerCursor + offset); \ | 317 | 58.9k | if (ret) \ | 318 | 58.9k | return ret; \ | 319 | 58.9k | combined = combined | ((uint64_t)byte << (offset * 8)); \ | 320 | 58.8k | } \ | 321 | 7.44k | *ptr = combined; \ | 322 | 7.30k | insn->readerCursor += sizeof(type); \ | 323 | 7.30k | return 0; \ | 324 | 7.44k | } |
|
325 | | |
326 | | /* |
327 | | * consume* - Use the reader function provided by the user to consume data |
328 | | * values of various sizes from the instruction's memory and advance the |
329 | | * cursor appropriately. These readers perform endian conversion. |
330 | | * |
331 | | * @param insn - See consumeByte(). |
332 | | * @param ptr - A pointer to a pre-allocated memory of appropriate size to |
333 | | * be populated with the data read. |
334 | | * @return - See consumeByte(). |
335 | | */ |
336 | | CONSUME_FUNC(consumeInt8, int8_t) |
337 | | CONSUME_FUNC(consumeInt16, int16_t) |
338 | | CONSUME_FUNC(consumeInt32, int32_t) |
339 | | CONSUME_FUNC(consumeUInt16, uint16_t) |
340 | | CONSUME_FUNC(consumeUInt32, uint32_t) |
341 | | CONSUME_FUNC(consumeUInt64, uint64_t) |
342 | | |
343 | | static bool isREX(struct InternalInstruction *insn, uint8_t prefix) |
344 | 2.14M | { |
345 | 2.14M | if (insn->mode == MODE_64BIT) |
346 | 693k | return prefix >= 0x40 && prefix <= 0x4f; |
347 | | |
348 | 1.45M | return false; |
349 | 2.14M | } |
350 | | |
351 | | /* |
352 | | * setPrefixPresent - Marks that a particular prefix is present as mandatory |
353 | | * |
354 | | * @param insn - The instruction to be marked as having the prefix. |
355 | | * @param prefix - The prefix that is present. |
356 | | */ |
357 | | static void setPrefixPresent(struct InternalInstruction *insn, uint8_t prefix) |
358 | 297k | { |
359 | 297k | uint8_t nextByte; |
360 | | |
361 | 297k | switch (prefix) { |
362 | 58.4k | case 0xf0: // LOCK |
363 | 58.4k | insn->hasLockPrefix = true; |
364 | 58.4k | insn->repeatPrefix = 0; |
365 | 58.4k | break; |
366 | | |
367 | 69.6k | case 0xf2: // REPNE/REPNZ |
368 | 124k | case 0xf3: // REP or REPE/REPZ |
369 | 124k | if (lookAtByte(insn, &nextByte)) |
370 | 32 | break; |
371 | | // TODO: |
372 | | // 1. There could be several 0x66 |
373 | | // 2. if (nextByte == 0x66) and nextNextByte != 0x0f then |
374 | | // it's not mandatory prefix |
375 | | // 3. if (nextByte >= 0x40 && nextByte <= 0x4f) it's REX and we need |
376 | | // 0x0f exactly after it to be mandatory prefix |
377 | 124k | if (isREX(insn, nextByte) || nextByte == 0x0f || nextByte == 0x66) |
378 | | // The last of 0xf2 /0xf3 is mandatory prefix |
379 | 29.9k | insn->mandatoryPrefix = prefix; |
380 | | |
381 | 124k | insn->repeatPrefix = prefix; |
382 | 124k | insn->hasLockPrefix = false; |
383 | 124k | break; |
384 | | |
385 | 37.8k | case 0x66: |
386 | 37.8k | if (lookAtByte(insn, &nextByte)) |
387 | 56 | break; |
388 | | // 0x66 can't overwrite existing mandatory prefix and should be ignored |
389 | 37.8k | if (!insn->mandatoryPrefix && (nextByte == 0x0f || isREX(insn, nextByte))) |
390 | 11.8k | insn->mandatoryPrefix = prefix; |
391 | 37.8k | break; |
392 | 297k | } |
393 | 297k | } |
394 | | |
395 | | /* |
396 | | * readPrefixes - Consumes all of an instruction's prefix bytes, and marks the |
397 | | * instruction as having them. Also sets the instruction's default operand, |
398 | | * address, and other relevant data sizes to report operands correctly. |
399 | | * |
400 | | * @param insn - The instruction whose prefixes are to be read. |
401 | | * @return - 0 if the instruction could be read until the end of the prefix |
402 | | * bytes, and no prefixes conflicted; nonzero otherwise. |
403 | | */ |
404 | | static int readPrefixes(struct InternalInstruction* insn) |
405 | 2.03M | { |
406 | 2.03M | bool isPrefix = true; |
407 | 2.03M | uint8_t byte = 0; |
408 | 2.03M | uint8_t nextByte; |
409 | | |
410 | 4.36M | while (isPrefix) { |
411 | 2.33M | if (insn->mode == MODE_64BIT) { |
412 | | // eliminate consecutive redundant REX bytes in front |
413 | 752k | if (consumeByte(insn, &byte)) |
414 | 174 | return -1; |
415 | | |
416 | 752k | if ((byte & 0xf0) == 0x40) { |
417 | 121k | while(true) { |
418 | 121k | if (lookAtByte(insn, &byte)) // out of input code |
419 | 191 | return -1; |
420 | 121k | if ((byte & 0xf0) == 0x40) { |
421 | | // another REX prefix, but we only remember the last one |
422 | 14.9k | if (consumeByte(insn, &byte)) |
423 | 0 | return -1; |
424 | 14.9k | } else |
425 | 106k | break; |
426 | 121k | } |
427 | | |
428 | | // recover the last REX byte if next byte is not a legacy prefix |
429 | 106k | switch (byte) { |
430 | 3.96k | case 0xf2: /* REPNE/REPNZ */ |
431 | 6.18k | case 0xf3: /* REP or REPE/REPZ */ |
432 | 8.36k | case 0xf0: /* LOCK */ |
433 | 8.76k | case 0x2e: /* CS segment override -OR- Branch not taken */ |
434 | 9.04k | case 0x36: /* SS segment override -OR- Branch taken */ |
435 | 9.42k | case 0x3e: /* DS segment override */ |
436 | 10.2k | case 0x26: /* ES segment override */ |
437 | 10.9k | case 0x64: /* FS segment override */ |
438 | 12.0k | case 0x65: /* GS segment override */ |
439 | 14.6k | case 0x66: /* Operand-size override */ |
440 | 17.6k | case 0x67: /* Address-size override */ |
441 | 17.6k | break; |
442 | 88.6k | default: /* Not a prefix byte */ |
443 | 88.6k | unconsumeByte(insn); |
444 | 88.6k | break; |
445 | 106k | } |
446 | 645k | } else { |
447 | 645k | unconsumeByte(insn); |
448 | 645k | } |
449 | 752k | } |
450 | | |
451 | | /* If we fail reading prefixes, just stop here and let the opcode reader deal with it */ |
452 | 2.33M | if (consumeByte(insn, &byte)) |
453 | 182 | return -1; |
454 | | |
455 | 2.33M | if (insn->readerCursor - 1 == insn->startLocation |
456 | 2.33M | && (byte == 0xf2 || byte == 0xf3)) { |
457 | | // prefix requires next byte |
458 | 96.3k | if (lookAtByte(insn, &nextByte)) |
459 | 114 | return -1; |
460 | | |
461 | | /* |
462 | | * If the byte is 0xf2 or 0xf3, and any of the following conditions are |
463 | | * met: |
464 | | * - it is followed by a LOCK (0xf0) prefix |
465 | | * - it is followed by an xchg instruction |
466 | | * then it should be disassembled as a xacquire/xrelease not repne/rep. |
467 | | */ |
468 | 96.2k | if (((nextByte == 0xf0) || |
469 | 96.2k | ((nextByte & 0xfe) == 0x86 || (nextByte & 0xf8) == 0x90))) { |
470 | 4.52k | insn->xAcquireRelease = byte; |
471 | 4.52k | } |
472 | | |
473 | | /* |
474 | | * Also if the byte is 0xf3, and the following condition is met: |
475 | | * - it is followed by a "mov mem, reg" (opcode 0x88/0x89) or |
476 | | * "mov mem, imm" (opcode 0xc6/0xc7) instructions. |
477 | | * then it should be disassembled as an xrelease not rep. |
478 | | */ |
479 | 96.2k | if (byte == 0xf3 && (nextByte == 0x88 || nextByte == 0x89 || |
480 | 44.1k | nextByte == 0xc6 || nextByte == 0xc7)) { |
481 | 1.36k | insn->xAcquireRelease = byte; |
482 | 1.36k | } |
483 | | |
484 | 96.2k | if (isREX(insn, nextByte)) { |
485 | 12.2k | uint8_t nnextByte; |
486 | | |
487 | | // Go to REX prefix after the current one |
488 | 12.2k | if (consumeByte(insn, &nnextByte)) |
489 | 0 | return -1; |
490 | | |
491 | | // We should be able to read next byte after REX prefix |
492 | 12.2k | if (lookAtByte(insn, &nnextByte)) |
493 | 21 | return -1; |
494 | | |
495 | 12.2k | unconsumeByte(insn); |
496 | 12.2k | } |
497 | 96.2k | } |
498 | | |
499 | 2.33M | switch (byte) { |
500 | 58.4k | case 0xf0: /* LOCK */ |
501 | 128k | case 0xf2: /* REPNE/REPNZ */ |
502 | 183k | case 0xf3: /* REP or REPE/REPZ */ |
503 | | // only accept the last prefix |
504 | 183k | setPrefixPresent(insn, byte); |
505 | 183k | insn->prefix0 = byte; |
506 | 183k | break; |
507 | | |
508 | 12.5k | case 0x2e: /* CS segment override -OR- Branch not taken */ |
509 | 18.0k | case 0x36: /* SS segment override -OR- Branch taken */ |
510 | 25.7k | case 0x3e: /* DS segment override */ |
511 | 34.9k | case 0x26: /* ES segment override */ |
512 | 47.1k | case 0x64: /* FS segment override */ |
513 | 59.4k | case 0x65: /* GS segment override */ |
514 | 59.4k | switch (byte) { |
515 | 12.5k | case 0x2e: |
516 | 12.5k | insn->segmentOverride = SEG_OVERRIDE_CS; |
517 | 12.5k | insn->prefix1 = byte; |
518 | 12.5k | break; |
519 | 5.51k | case 0x36: |
520 | 5.51k | insn->segmentOverride = SEG_OVERRIDE_SS; |
521 | 5.51k | insn->prefix1 = byte; |
522 | 5.51k | break; |
523 | 7.65k | case 0x3e: |
524 | 7.65k | insn->segmentOverride = SEG_OVERRIDE_DS; |
525 | 7.65k | insn->prefix1 = byte; |
526 | 7.65k | break; |
527 | 9.28k | case 0x26: |
528 | 9.28k | insn->segmentOverride = SEG_OVERRIDE_ES; |
529 | 9.28k | insn->prefix1 = byte; |
530 | 9.28k | break; |
531 | 12.1k | case 0x64: |
532 | 12.1k | insn->segmentOverride = SEG_OVERRIDE_FS; |
533 | 12.1k | insn->prefix1 = byte; |
534 | 12.1k | break; |
535 | 12.2k | case 0x65: |
536 | 12.2k | insn->segmentOverride = SEG_OVERRIDE_GS; |
537 | 12.2k | insn->prefix1 = byte; |
538 | 12.2k | break; |
539 | 0 | default: |
540 | | // debug("Unhandled override"); |
541 | 0 | return -1; |
542 | 59.4k | } |
543 | 59.4k | setPrefixPresent(insn, byte); |
544 | 59.4k | break; |
545 | | |
546 | 37.8k | case 0x66: /* Operand-size override */ |
547 | 37.8k | insn->hasOpSize = true; |
548 | 37.8k | setPrefixPresent(insn, byte); |
549 | 37.8k | insn->prefix2 = byte; |
550 | 37.8k | break; |
551 | | |
552 | 17.0k | case 0x67: /* Address-size override */ |
553 | 17.0k | insn->hasAdSize = true; |
554 | 17.0k | setPrefixPresent(insn, byte); |
555 | 17.0k | insn->prefix3 = byte; |
556 | 17.0k | break; |
557 | 2.03M | default: /* Not a prefix byte */ |
558 | 2.03M | isPrefix = false; |
559 | 2.03M | break; |
560 | 2.33M | } |
561 | 2.33M | } |
562 | | |
563 | 2.03M | insn->vectorExtensionType = TYPE_NO_VEX_XOP; |
564 | | |
565 | 2.03M | if (byte == 0x62) { |
566 | 99.4k | uint8_t byte1, byte2; |
567 | | |
568 | 99.4k | if (consumeByte(insn, &byte1)) { |
569 | | // dbgprintf(insn, "Couldn't read second byte of EVEX prefix"); |
570 | 73 | return -1; |
571 | 73 | } |
572 | | |
573 | 99.3k | if (lookAtByte(insn, &byte2)) { |
574 | | // dbgprintf(insn, "Couldn't read third byte of EVEX prefix"); |
575 | 83 | unconsumeByte(insn); /* unconsume byte1 */ |
576 | 83 | unconsumeByte(insn); /* unconsume byte */ |
577 | 99.3k | } else { |
578 | 99.3k | if ((insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) && |
579 | 99.3k | ((~byte1 & 0xc) == 0xc) && ((byte2 & 0x4) == 0x4)) { |
580 | 85.8k | insn->vectorExtensionType = TYPE_EVEX; |
581 | 85.8k | } else { |
582 | 13.4k | unconsumeByte(insn); /* unconsume byte1 */ |
583 | 13.4k | unconsumeByte(insn); /* unconsume byte */ |
584 | 13.4k | } |
585 | 99.3k | } |
586 | | |
587 | 99.3k | if (insn->vectorExtensionType == TYPE_EVEX) { |
588 | 85.8k | insn->vectorExtensionPrefix[0] = byte; |
589 | 85.8k | insn->vectorExtensionPrefix[1] = byte1; |
590 | 85.8k | if (consumeByte(insn, &insn->vectorExtensionPrefix[2])) { |
591 | | // dbgprintf(insn, "Couldn't read third byte of EVEX prefix"); |
592 | 0 | return -1; |
593 | 0 | } |
594 | | |
595 | 85.8k | if (consumeByte(insn, &insn->vectorExtensionPrefix[3])) { |
596 | | // dbgprintf(insn, "Couldn't read fourth byte of EVEX prefix"); |
597 | 42 | return -1; |
598 | 42 | } |
599 | | |
600 | | /* We simulate the REX prefix for simplicity's sake */ |
601 | 85.8k | if (insn->mode == MODE_64BIT) { |
602 | 26.5k | insn->rexPrefix = 0x40 |
603 | 26.5k | | (wFromEVEX3of4(insn->vectorExtensionPrefix[2]) << 3) |
604 | 26.5k | | (rFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 2) |
605 | 26.5k | | (xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 1) |
606 | 26.5k | | (bFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 0); |
607 | 26.5k | } |
608 | | |
609 | | // dbgprintf(insn, "Found EVEX prefix 0x%hhx 0x%hhx 0x%hhx 0x%hhx", |
610 | | // insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1], |
611 | | // insn->vectorExtensionPrefix[2], insn->vectorExtensionPrefix[3]); |
612 | 85.8k | } |
613 | 1.93M | } else if (byte == 0xc4) { |
614 | 12.2k | uint8_t byte1; |
615 | | |
616 | 12.2k | if (lookAtByte(insn, &byte1)) { |
617 | | // dbgprintf(insn, "Couldn't read second byte of VEX"); |
618 | 19 | return -1; |
619 | 19 | } |
620 | | |
621 | 12.2k | if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) |
622 | 9.13k | insn->vectorExtensionType = TYPE_VEX_3B; |
623 | 3.07k | else |
624 | 3.07k | unconsumeByte(insn); |
625 | | |
626 | 12.2k | if (insn->vectorExtensionType == TYPE_VEX_3B) { |
627 | 9.13k | insn->vectorExtensionPrefix[0] = byte; |
628 | 9.13k | consumeByte(insn, &insn->vectorExtensionPrefix[1]); |
629 | 9.13k | consumeByte(insn, &insn->vectorExtensionPrefix[2]); |
630 | | |
631 | | /* We simulate the REX prefix for simplicity's sake */ |
632 | 9.13k | if (insn->mode == MODE_64BIT) |
633 | 3.19k | insn->rexPrefix = 0x40 |
634 | 3.19k | | (wFromVEX3of3(insn->vectorExtensionPrefix[2]) << 3) |
635 | 3.19k | | (rFromVEX2of3(insn->vectorExtensionPrefix[1]) << 2) |
636 | 3.19k | | (xFromVEX2of3(insn->vectorExtensionPrefix[1]) << 1) |
637 | 3.19k | | (bFromVEX2of3(insn->vectorExtensionPrefix[1]) << 0); |
638 | | |
639 | | // dbgprintf(insn, "Found VEX prefix 0x%hhx 0x%hhx 0x%hhx", |
640 | | // insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1], |
641 | | // insn->vectorExtensionPrefix[2]); |
642 | 9.13k | } |
643 | 1.92M | } else if (byte == 0xc5) { |
644 | 16.8k | uint8_t byte1; |
645 | | |
646 | 16.8k | if (lookAtByte(insn, &byte1)) { |
647 | | // dbgprintf(insn, "Couldn't read second byte of VEX"); |
648 | 29 | return -1; |
649 | 29 | } |
650 | | |
651 | 16.8k | if (insn->mode == MODE_64BIT || (byte1 & 0xc0) == 0xc0) |
652 | 13.3k | insn->vectorExtensionType = TYPE_VEX_2B; |
653 | 3.49k | else |
654 | 3.49k | unconsumeByte(insn); |
655 | | |
656 | 16.8k | if (insn->vectorExtensionType == TYPE_VEX_2B) { |
657 | 13.3k | insn->vectorExtensionPrefix[0] = byte; |
658 | 13.3k | consumeByte(insn, &insn->vectorExtensionPrefix[1]); |
659 | | |
660 | 13.3k | if (insn->mode == MODE_64BIT) |
661 | 1.65k | insn->rexPrefix = 0x40 |
662 | 1.65k | | (rFromVEX2of2(insn->vectorExtensionPrefix[1]) << 2); |
663 | | |
664 | 13.3k | switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { |
665 | 6.35k | default: |
666 | 6.35k | break; |
667 | 7.01k | case VEX_PREFIX_66: |
668 | 7.01k | insn->hasOpSize = true; |
669 | 7.01k | break; |
670 | 13.3k | } |
671 | | |
672 | | // dbgprintf(insn, "Found VEX prefix 0x%hhx 0x%hhx", |
673 | | // insn->vectorExtensionPrefix[0], |
674 | | // insn->vectorExtensionPrefix[1]); |
675 | 13.3k | } |
676 | 1.90M | } else if (byte == 0x8f) { |
677 | 10.2k | uint8_t byte1; |
678 | | |
679 | 10.2k | if (lookAtByte(insn, &byte1)) { |
680 | | // dbgprintf(insn, "Couldn't read second byte of XOP"); |
681 | 22 | return -1; |
682 | 22 | } |
683 | | |
684 | 10.2k | if ((byte1 & 0x38) != 0x0) /* 0 in these 3 bits is a POP instruction. */ |
685 | 8.56k | insn->vectorExtensionType = TYPE_XOP; |
686 | 1.68k | else |
687 | 1.68k | unconsumeByte(insn); |
688 | | |
689 | 10.2k | if (insn->vectorExtensionType == TYPE_XOP) { |
690 | 8.56k | insn->vectorExtensionPrefix[0] = byte; |
691 | 8.56k | consumeByte(insn, &insn->vectorExtensionPrefix[1]); |
692 | 8.56k | consumeByte(insn, &insn->vectorExtensionPrefix[2]); |
693 | | |
694 | | /* We simulate the REX prefix for simplicity's sake */ |
695 | 8.56k | if (insn->mode == MODE_64BIT) |
696 | 2.45k | insn->rexPrefix = 0x40 |
697 | 2.45k | | (wFromXOP3of3(insn->vectorExtensionPrefix[2]) << 3) |
698 | 2.45k | | (rFromXOP2of3(insn->vectorExtensionPrefix[1]) << 2) |
699 | 2.45k | | (xFromXOP2of3(insn->vectorExtensionPrefix[1]) << 1) |
700 | 2.45k | | (bFromXOP2of3(insn->vectorExtensionPrefix[1]) << 0); |
701 | | |
702 | 8.56k | switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { |
703 | 8.55k | default: |
704 | 8.55k | break; |
705 | 8.55k | case VEX_PREFIX_66: |
706 | 16 | insn->hasOpSize = true; |
707 | 16 | break; |
708 | 8.56k | } |
709 | | |
710 | | // dbgprintf(insn, "Found XOP prefix 0x%hhx 0x%hhx 0x%hhx", |
711 | | // insn->vectorExtensionPrefix[0], insn->vectorExtensionPrefix[1], |
712 | | // insn->vectorExtensionPrefix[2]); |
713 | 8.56k | } |
714 | 1.89M | } else if (isREX(insn, byte)) { |
715 | 88.6k | if (lookAtByte(insn, &nextByte)) |
716 | 0 | return -1; |
717 | | |
718 | 88.6k | insn->rexPrefix = byte; |
719 | | // dbgprintf(insn, "Found REX prefix 0x%hhx", byte); |
720 | 88.6k | } else |
721 | 1.80M | unconsumeByte(insn); |
722 | | |
723 | 2.03M | if (insn->mode == MODE_16BIT) { |
724 | 695k | insn->registerSize = (insn->hasOpSize ? 4 : 2); |
725 | 695k | insn->addressSize = (insn->hasAdSize ? 4 : 2); |
726 | 695k | insn->displacementSize = (insn->hasAdSize ? 4 : 2); |
727 | 695k | insn->immediateSize = (insn->hasOpSize ? 4 : 2); |
728 | 695k | insn->immSize = (insn->hasOpSize ? 4 : 2); |
729 | 1.33M | } else if (insn->mode == MODE_32BIT) { |
730 | 710k | insn->registerSize = (insn->hasOpSize ? 2 : 4); |
731 | 710k | insn->addressSize = (insn->hasAdSize ? 2 : 4); |
732 | 710k | insn->displacementSize = (insn->hasAdSize ? 2 : 4); |
733 | 710k | insn->immediateSize = (insn->hasOpSize ? 2 : 4); |
734 | 710k | insn->immSize = (insn->hasOpSize ? 2 : 4); |
735 | 710k | } else if (insn->mode == MODE_64BIT) { |
736 | 629k | if (insn->rexPrefix && wFromREX(insn->rexPrefix)) { |
737 | 83.8k | insn->registerSize = 8; |
738 | 83.8k | insn->addressSize = (insn->hasAdSize ? 4 : 8); |
739 | 83.8k | insn->displacementSize = 4; |
740 | 83.8k | insn->immediateSize = 4; |
741 | 83.8k | insn->immSize = 4; |
742 | 545k | } else { |
743 | 545k | insn->registerSize = (insn->hasOpSize ? 2 : 4); |
744 | 545k | insn->addressSize = (insn->hasAdSize ? 4 : 8); |
745 | 545k | insn->displacementSize = (insn->hasOpSize ? 2 : 4); |
746 | 545k | insn->immediateSize = (insn->hasOpSize ? 2 : 4); |
747 | 545k | insn->immSize = (insn->hasOpSize ? 4 : 8); |
748 | 545k | } |
749 | 629k | } |
750 | | |
751 | 2.03M | return 0; |
752 | 2.03M | } |
753 | | |
754 | | static int readModRM(struct InternalInstruction* insn); |
755 | | |
756 | | /* |
757 | | * readOpcode - Reads the opcode (excepting the ModR/M byte in the case of |
758 | | * extended or escape opcodes). |
759 | | * |
760 | | * @param insn - The instruction whose opcode is to be read. |
761 | | * @return - 0 if the opcode could be read successfully; nonzero otherwise. |
762 | | */ |
763 | | static int readOpcode(struct InternalInstruction* insn) |
764 | 2.03M | { |
765 | 2.03M | uint8_t current; |
766 | | |
767 | | // dbgprintf(insn, "readOpcode()"); |
768 | | |
769 | 2.03M | insn->opcodeType = ONEBYTE; |
770 | | |
771 | 2.03M | if (insn->vectorExtensionType == TYPE_EVEX) { |
772 | 85.8k | switch (mmFromEVEX2of4(insn->vectorExtensionPrefix[1])) { |
773 | 7 | default: |
774 | | // dbgprintf(insn, "Unhandled mm field for instruction (0x%hhx)", |
775 | | // mmFromEVEX2of4(insn->vectorExtensionPrefix[1])); |
776 | 7 | return -1; |
777 | 26.6k | case VEX_LOB_0F: |
778 | 26.6k | insn->opcodeType = TWOBYTE; |
779 | 26.6k | return consumeByte(insn, &insn->opcode); |
780 | 27.9k | case VEX_LOB_0F38: |
781 | 27.9k | insn->opcodeType = THREEBYTE_38; |
782 | 27.9k | return consumeByte(insn, &insn->opcode); |
783 | 31.2k | case VEX_LOB_0F3A: |
784 | 31.2k | insn->opcodeType = THREEBYTE_3A; |
785 | 31.2k | return consumeByte(insn, &insn->opcode); |
786 | 85.8k | } |
787 | 1.94M | } else if (insn->vectorExtensionType == TYPE_VEX_3B) { |
788 | 9.13k | switch (mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])) { |
789 | 60 | default: |
790 | | // dbgprintf(insn, "Unhandled m-mmmm field for instruction (0x%hhx)", |
791 | | // mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])); |
792 | 60 | return -1; |
793 | 1.97k | case VEX_LOB_0F: |
794 | | //insn->twoByteEscape = 0x0f; |
795 | 1.97k | insn->opcodeType = TWOBYTE; |
796 | 1.97k | return consumeByte(insn, &insn->opcode); |
797 | 3.14k | case VEX_LOB_0F38: |
798 | | //insn->twoByteEscape = 0x0f; |
799 | 3.14k | insn->opcodeType = THREEBYTE_38; |
800 | 3.14k | return consumeByte(insn, &insn->opcode); |
801 | 3.95k | case VEX_LOB_0F3A: |
802 | | //insn->twoByteEscape = 0x0f; |
803 | 3.95k | insn->opcodeType = THREEBYTE_3A; |
804 | 3.95k | return consumeByte(insn, &insn->opcode); |
805 | 9.13k | } |
806 | 1.94M | } else if (insn->vectorExtensionType == TYPE_VEX_2B) { |
807 | | //insn->twoByteEscape = 0x0f; |
808 | 13.3k | insn->opcodeType = TWOBYTE; |
809 | 13.3k | return consumeByte(insn, &insn->opcode); |
810 | 1.92M | } else if (insn->vectorExtensionType == TYPE_XOP) { |
811 | 8.56k | switch (mmmmmFromXOP2of3(insn->vectorExtensionPrefix[1])) { |
812 | 85 | default: |
813 | | // dbgprintf(insn, "Unhandled m-mmmm field for instruction (0x%hhx)", |
814 | | // mmmmmFromVEX2of3(insn->vectorExtensionPrefix[1])); |
815 | 85 | return -1; |
816 | 7.55k | case XOP_MAP_SELECT_8: |
817 | 7.55k | insn->opcodeType = XOP8_MAP; |
818 | 7.55k | return consumeByte(insn, &insn->opcode); |
819 | 655 | case XOP_MAP_SELECT_9: |
820 | 655 | insn->opcodeType = XOP9_MAP; |
821 | 655 | return consumeByte(insn, &insn->opcode); |
822 | 269 | case XOP_MAP_SELECT_A: |
823 | 269 | insn->opcodeType = XOPA_MAP; |
824 | 269 | return consumeByte(insn, &insn->opcode); |
825 | 8.56k | } |
826 | 8.56k | } |
827 | | |
828 | 1.91M | if (consumeByte(insn, ¤t)) |
829 | 0 | return -1; |
830 | | |
831 | | // save this first byte for MOVcr, MOVdr, MOVrc, MOVrd |
832 | 1.91M | insn->firstByte = current; |
833 | | |
834 | 1.91M | if (current == 0x0f) { |
835 | | // dbgprintf(insn, "Found a two-byte escape prefix (0x%hhx)", current); |
836 | 80.3k | insn->twoByteEscape = current; |
837 | | |
838 | 80.3k | if (consumeByte(insn, ¤t)) |
839 | 86 | return -1; |
840 | | |
841 | 80.3k | if (current == 0x38) { |
842 | | // dbgprintf(insn, "Found a three-byte escape prefix (0x%hhx)", current); |
843 | 576 | if (consumeByte(insn, ¤t)) |
844 | 4 | return -1; |
845 | | |
846 | 572 | insn->opcodeType = THREEBYTE_38; |
847 | 79.7k | } else if (current == 0x3a) { |
848 | | // dbgprintf(insn, "Found a three-byte escape prefix (0x%hhx)", current); |
849 | 252 | if (consumeByte(insn, ¤t)) |
850 | 3 | return -1; |
851 | | |
852 | 249 | insn->opcodeType = THREEBYTE_3A; |
853 | 79.4k | } else if (current == 0x0f) { |
854 | | // dbgprintf(insn, "Found a 3dnow escape prefix (0x%hhx)", current); |
855 | | // Consume operands before the opcode to comply with the 3DNow encoding |
856 | 1.47k | if (readModRM(insn)) |
857 | 11 | return -1; |
858 | | |
859 | 1.46k | if (consumeByte(insn, ¤t)) |
860 | 5 | return -1; |
861 | | |
862 | 1.45k | insn->opcodeType = THREEDNOW_MAP; |
863 | 78.0k | } else { |
864 | | // dbgprintf(insn, "Didn't find a three-byte escape prefix"); |
865 | 78.0k | insn->opcodeType = TWOBYTE; |
866 | 78.0k | } |
867 | 1.83M | } else if (insn->mandatoryPrefix) |
868 | | // The opcode with mandatory prefix must start with opcode escape. |
869 | | // If not it's legacy repeat prefix |
870 | 19.1k | insn->mandatoryPrefix = 0; |
871 | | |
872 | | /* |
873 | | * At this point we have consumed the full opcode. |
874 | | * Anything we consume from here on must be unconsumed. |
875 | | */ |
876 | | |
877 | 1.91M | insn->opcode = current; |
878 | | |
879 | 1.91M | return 0; |
880 | 1.91M | } |
881 | | |
882 | | // Hacky for FEMMS |
883 | | #define GET_INSTRINFO_ENUM |
884 | | #ifndef CAPSTONE_X86_REDUCE |
885 | | #include "X86GenInstrInfo.inc" |
886 | | #else |
887 | | #include "X86GenInstrInfo_reduce.inc" |
888 | | #endif |
889 | | |
890 | | /* |
891 | | * getIDWithAttrMask - Determines the ID of an instruction, consuming |
892 | | * the ModR/M byte as appropriate for extended and escape opcodes, |
893 | | * and using a supplied attribute mask. |
894 | | * |
895 | | * @param instructionID - A pointer whose target is filled in with the ID of the |
896 | | * instruction. |
897 | | * @param insn - The instruction whose ID is to be determined. |
898 | | * @param attrMask - The attribute mask to search. |
899 | | * @return - 0 if the ModR/M could be read when needed or was not |
900 | | * needed; nonzero otherwise. |
901 | | */ |
902 | | static int getIDWithAttrMask(uint16_t *instructionID, |
903 | | struct InternalInstruction* insn, |
904 | | uint16_t attrMask) |
905 | 2.78M | { |
906 | 2.78M | bool hasModRMExtension; |
907 | | |
908 | 2.78M | InstructionContext instructionClass = contextForAttrs(attrMask); |
909 | | |
910 | 2.78M | hasModRMExtension = modRMRequired(insn->opcodeType, |
911 | 2.78M | instructionClass, |
912 | 2.78M | insn->opcode); |
913 | | |
914 | 2.78M | if (hasModRMExtension) { |
915 | 1.41M | if (readModRM(insn)) |
916 | 3.03k | return -1; |
917 | | |
918 | 1.41M | *instructionID = decode(insn->opcodeType, |
919 | 1.41M | instructionClass, |
920 | 1.41M | insn->opcode, |
921 | 1.41M | insn->modRM); |
922 | 1.41M | } else { |
923 | 1.36M | *instructionID = decode(insn->opcodeType, |
924 | 1.36M | instructionClass, |
925 | 1.36M | insn->opcode, |
926 | 1.36M | 0); |
927 | 1.36M | } |
928 | | |
929 | 2.77M | return 0; |
930 | 2.78M | } |
931 | | |
932 | | /* |
933 | | * is16BitEquivalent - Determines whether two instruction names refer to |
934 | | * equivalent instructions but one is 16-bit whereas the other is not. |
935 | | * |
936 | | * @param orig - The instruction ID that is not 16-bit |
937 | | * @param equiv - The instruction ID that is 16-bit |
938 | | */ |
939 | | static bool is16BitEquivalent(unsigned orig, unsigned equiv) |
940 | 659k | { |
941 | 659k | size_t i; |
942 | 659k | uint16_t idx; |
943 | | |
944 | 659k | if ((idx = x86_16_bit_eq_lookup[orig]) != 0) { |
945 | 317k | for (i = idx - 1; i < ARR_SIZE(x86_16_bit_eq_tbl) && x86_16_bit_eq_tbl[i].first == orig; i++) { |
946 | 311k | if (x86_16_bit_eq_tbl[i].second == equiv) |
947 | 305k | return true; |
948 | 311k | } |
949 | 311k | } |
950 | | |
951 | 354k | return false; |
952 | 659k | } |
953 | | |
954 | | /* |
955 | | * is64Bit - Determines whether this instruction is a 64-bit instruction. |
956 | | * |
957 | | * @param name - The instruction that is not 16-bit |
958 | | */ |
959 | | static bool is64Bit(uint16_t id) |
960 | 36.7k | { |
961 | 36.7k | unsigned int i = find_insn(id); |
962 | 36.7k | if (i != -1) { |
963 | 36.5k | return insns[i].is64bit; |
964 | 36.5k | } |
965 | | |
966 | | // not found?? |
967 | 189 | return false; |
968 | 36.7k | } |
969 | | |
970 | | /* |
971 | | * getID - Determines the ID of an instruction, consuming the ModR/M byte as |
972 | | * appropriate for extended and escape opcodes. Determines the attributes and |
973 | | * context for the instruction before doing so. |
974 | | * |
975 | | * @param insn - The instruction whose ID is to be determined. |
976 | | * @return - 0 if the ModR/M could be read when needed or was not needed; |
977 | | * nonzero otherwise. |
978 | | */ |
979 | | static int getID(struct InternalInstruction *insn) |
980 | 2.03M | { |
981 | 2.03M | uint16_t attrMask; |
982 | 2.03M | uint16_t instructionID; |
983 | | |
984 | 2.03M | attrMask = ATTR_NONE; |
985 | | |
986 | 2.03M | if (insn->mode == MODE_64BIT) |
987 | 629k | attrMask |= ATTR_64BIT; |
988 | | |
989 | 2.03M | if (insn->vectorExtensionType != TYPE_NO_VEX_XOP) { |
990 | 116k | attrMask |= (insn->vectorExtensionType == TYPE_EVEX) ? ATTR_EVEX : ATTR_VEX; |
991 | | |
992 | 116k | if (insn->vectorExtensionType == TYPE_EVEX) { |
993 | 85.7k | switch (ppFromEVEX3of4(insn->vectorExtensionPrefix[2])) { |
994 | 72.5k | case VEX_PREFIX_66: |
995 | 72.5k | attrMask |= ATTR_OPSIZE; |
996 | 72.5k | break; |
997 | 1.97k | case VEX_PREFIX_F3: |
998 | 1.97k | attrMask |= ATTR_XS; |
999 | 1.97k | break; |
1000 | 2.63k | case VEX_PREFIX_F2: |
1001 | 2.63k | attrMask |= ATTR_XD; |
1002 | 2.63k | break; |
1003 | 85.7k | } |
1004 | | |
1005 | 85.7k | if (zFromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1006 | 11.2k | attrMask |= ATTR_EVEXKZ; |
1007 | 85.7k | if (bFromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1008 | 29.9k | attrMask |= ATTR_EVEXB; |
1009 | 85.7k | if (aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1010 | 60.8k | attrMask |= ATTR_EVEXK; |
1011 | 85.7k | if (lFromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1012 | 38.9k | attrMask |= ATTR_EVEXL; |
1013 | 85.7k | if (l2FromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1014 | 40.2k | attrMask |= ATTR_EVEXL2; |
1015 | 85.7k | } else if (insn->vectorExtensionType == TYPE_VEX_3B) { |
1016 | 9.06k | switch (ppFromVEX3of3(insn->vectorExtensionPrefix[2])) { |
1017 | 7.11k | case VEX_PREFIX_66: |
1018 | 7.11k | attrMask |= ATTR_OPSIZE; |
1019 | 7.11k | break; |
1020 | 408 | case VEX_PREFIX_F3: |
1021 | 408 | attrMask |= ATTR_XS; |
1022 | 408 | break; |
1023 | 1.13k | case VEX_PREFIX_F2: |
1024 | 1.13k | attrMask |= ATTR_XD; |
1025 | 1.13k | break; |
1026 | 9.06k | } |
1027 | | |
1028 | 9.06k | if (lFromVEX3of3(insn->vectorExtensionPrefix[2])) |
1029 | 5.60k | attrMask |= ATTR_VEXL; |
1030 | 21.8k | } else if (insn->vectorExtensionType == TYPE_VEX_2B) { |
1031 | 13.3k | switch (ppFromVEX2of2(insn->vectorExtensionPrefix[1])) { |
1032 | 7.00k | case VEX_PREFIX_66: |
1033 | 7.00k | attrMask |= ATTR_OPSIZE; |
1034 | 7.00k | break; |
1035 | 957 | case VEX_PREFIX_F3: |
1036 | 957 | attrMask |= ATTR_XS; |
1037 | 957 | break; |
1038 | 1.70k | case VEX_PREFIX_F2: |
1039 | 1.70k | attrMask |= ATTR_XD; |
1040 | 1.70k | break; |
1041 | 13.3k | } |
1042 | | |
1043 | 13.3k | if (lFromVEX2of2(insn->vectorExtensionPrefix[1])) |
1044 | 8.68k | attrMask |= ATTR_VEXL; |
1045 | 13.3k | } else if (insn->vectorExtensionType == TYPE_XOP) { |
1046 | 8.46k | switch (ppFromXOP3of3(insn->vectorExtensionPrefix[2])) { |
1047 | 6 | case VEX_PREFIX_66: |
1048 | 6 | attrMask |= ATTR_OPSIZE; |
1049 | 6 | break; |
1050 | 14 | case VEX_PREFIX_F3: |
1051 | 14 | attrMask |= ATTR_XS; |
1052 | 14 | break; |
1053 | 20 | case VEX_PREFIX_F2: |
1054 | 20 | attrMask |= ATTR_XD; |
1055 | 20 | break; |
1056 | 8.46k | } |
1057 | | |
1058 | 8.46k | if (lFromXOP3of3(insn->vectorExtensionPrefix[2])) |
1059 | 742 | attrMask |= ATTR_VEXL; |
1060 | 8.46k | } else { |
1061 | 0 | return -1; |
1062 | 0 | } |
1063 | 1.91M | } else if (!insn->mandatoryPrefix) { |
1064 | | // If we don't have mandatory prefix we should use legacy prefixes here |
1065 | 1.89M | if (insn->hasOpSize && (insn->mode != MODE_16BIT)) |
1066 | 20.8k | attrMask |= ATTR_OPSIZE; |
1067 | 1.89M | if (insn->hasAdSize) |
1068 | 13.5k | attrMask |= ATTR_ADSIZE; |
1069 | 1.89M | if (insn->opcodeType == ONEBYTE) { |
1070 | 1.83M | if (insn->repeatPrefix == 0xf3 && (insn->opcode == 0x90)) |
1071 | | // Special support for PAUSE |
1072 | 580 | attrMask |= ATTR_XS; |
1073 | 1.83M | } else { |
1074 | 58.8k | if (insn->repeatPrefix == 0xf2) |
1075 | 1.51k | attrMask |= ATTR_XD; |
1076 | 57.3k | else if (insn->repeatPrefix == 0xf3) |
1077 | 757 | attrMask |= ATTR_XS; |
1078 | 58.8k | } |
1079 | 1.89M | } else { |
1080 | 21.4k | switch (insn->mandatoryPrefix) { |
1081 | 8.48k | case 0xf2: |
1082 | 8.48k | attrMask |= ATTR_XD; |
1083 | 8.48k | break; |
1084 | 6.70k | case 0xf3: |
1085 | 6.70k | attrMask |= ATTR_XS; |
1086 | 6.70k | break; |
1087 | 6.28k | case 0x66: |
1088 | 6.28k | if (insn->mode != MODE_16BIT) |
1089 | 5.18k | attrMask |= ATTR_OPSIZE; |
1090 | 6.28k | break; |
1091 | 0 | case 0x67: |
1092 | 0 | attrMask |= ATTR_ADSIZE; |
1093 | 0 | break; |
1094 | 21.4k | } |
1095 | | |
1096 | 21.4k | } |
1097 | | |
1098 | 2.03M | if (insn->rexPrefix & 0x08) { |
1099 | 83.8k | attrMask |= ATTR_REXW; |
1100 | 83.8k | attrMask &= ~ATTR_ADSIZE; |
1101 | 83.8k | } |
1102 | | |
1103 | | /* |
1104 | | * JCXZ/JECXZ need special handling for 16-bit mode because the meaning |
1105 | | * of the AdSize prefix is inverted w.r.t. 32-bit mode. |
1106 | | */ |
1107 | 2.03M | if (insn->mode == MODE_16BIT && insn->opcodeType == ONEBYTE && |
1108 | 2.03M | insn->opcode == 0xE3) |
1109 | 3.23k | attrMask ^= ATTR_ADSIZE; |
1110 | | |
1111 | | /* |
1112 | | * In 64-bit mode all f64 superscripted opcodes ignore opcode size prefix |
1113 | | * CALL/JMP/JCC instructions need to ignore 0x66 and consume 4 bytes |
1114 | | */ |
1115 | 2.03M | if ((insn->mode == MODE_64BIT) && insn->hasOpSize) { |
1116 | 19.9k | switch (insn->opcode) { |
1117 | 260 | case 0xE8: |
1118 | 594 | case 0xE9: |
1119 | | // Take care of psubsb and other mmx instructions. |
1120 | 594 | if (insn->opcodeType == ONEBYTE) { |
1121 | 363 | attrMask ^= ATTR_OPSIZE; |
1122 | 363 | insn->immediateSize = 4; |
1123 | 363 | insn->displacementSize = 4; |
1124 | 363 | } |
1125 | 594 | break; |
1126 | 341 | case 0x82: |
1127 | 914 | case 0x83: |
1128 | 1.11k | case 0x84: |
1129 | 1.76k | case 0x85: |
1130 | 1.92k | case 0x86: |
1131 | 2.69k | case 0x87: |
1132 | 2.99k | case 0x88: |
1133 | 3.25k | case 0x89: |
1134 | 3.65k | case 0x8A: |
1135 | 4.01k | case 0x8B: |
1136 | 4.46k | case 0x8C: |
1137 | 4.62k | case 0x8D: |
1138 | 4.87k | case 0x8E: |
1139 | 5.12k | case 0x8F: |
1140 | | // Take care of lea and three byte ops. |
1141 | 5.12k | if (insn->opcodeType == TWOBYTE) { |
1142 | 800 | attrMask ^= ATTR_OPSIZE; |
1143 | 800 | insn->immediateSize = 4; |
1144 | 800 | insn->displacementSize = 4; |
1145 | 800 | } |
1146 | 5.12k | break; |
1147 | 19.9k | } |
1148 | 19.9k | } |
1149 | | |
1150 | | /* The following clauses compensate for limitations of the tables. */ |
1151 | 2.03M | if (insn->mode != MODE_64BIT && |
1152 | 2.03M | insn->vectorExtensionType != TYPE_NO_VEX_XOP) { |
1153 | 82.9k | if (getIDWithAttrMask(&instructionID, insn, attrMask)) { |
1154 | 35 | return -1; |
1155 | 35 | } |
1156 | | |
1157 | | /* |
1158 | | * The tables can't distinquish between cases where the W-bit is used to |
1159 | | * select register size and cases where its a required part of the opcode. |
1160 | | */ |
1161 | 82.9k | if ((insn->vectorExtensionType == TYPE_EVEX && |
1162 | 82.9k | wFromEVEX3of4(insn->vectorExtensionPrefix[2])) || |
1163 | 82.9k | (insn->vectorExtensionType == TYPE_VEX_3B && |
1164 | 49.7k | wFromVEX3of3(insn->vectorExtensionPrefix[2])) || |
1165 | 82.9k | (insn->vectorExtensionType == TYPE_XOP && |
1166 | 46.7k | wFromXOP3of3(insn->vectorExtensionPrefix[2]))) { |
1167 | 36.7k | uint16_t instructionIDWithREXW; |
1168 | | |
1169 | 36.7k | if (getIDWithAttrMask(&instructionIDWithREXW, |
1170 | 36.7k | insn, attrMask | ATTR_REXW)) { |
1171 | 9 | insn->instructionID = instructionID; |
1172 | 9 | insn->spec = specifierForUID(instructionID); |
1173 | 9 | return 0; |
1174 | 9 | } |
1175 | | |
1176 | | // If not a 64-bit instruction. Switch the opcode. |
1177 | 36.7k | if (!is64Bit(instructionIDWithREXW)) { |
1178 | 34.2k | insn->instructionID = instructionIDWithREXW; |
1179 | 34.2k | insn->spec = specifierForUID(instructionIDWithREXW); |
1180 | | |
1181 | 34.2k | return 0; |
1182 | 34.2k | } |
1183 | 36.7k | } |
1184 | 82.9k | } |
1185 | | |
1186 | | /* |
1187 | | * Absolute moves, umonitor, and movdir64b need special handling. |
1188 | | * -For 16-bit mode because the meaning of the AdSize and OpSize prefixes are |
1189 | | * inverted w.r.t. |
1190 | | * -For 32-bit mode we need to ensure the ADSIZE prefix is observed in |
1191 | | * any position. |
1192 | | */ |
1193 | 2.00M | if ((insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) || |
1194 | 2.00M | (insn->opcodeType == TWOBYTE && (insn->opcode == 0xAE)) || |
1195 | 2.00M | (insn->opcodeType == THREEBYTE_38 && insn->opcode == 0xF8)) { |
1196 | | /* Make sure we observed the prefixes in any position. */ |
1197 | 22.6k | if (insn->hasAdSize) |
1198 | 639 | attrMask |= ATTR_ADSIZE; |
1199 | | |
1200 | 22.6k | if (insn->hasOpSize) |
1201 | 686 | attrMask |= ATTR_OPSIZE; |
1202 | | |
1203 | | /* In 16-bit, invert the attributes. */ |
1204 | 22.6k | if (insn->mode == MODE_16BIT) { |
1205 | 8.81k | attrMask ^= ATTR_ADSIZE; |
1206 | | |
1207 | | /* The OpSize attribute is only valid with the absolute moves. */ |
1208 | 8.81k | if (insn->opcodeType == ONEBYTE && ((insn->opcode & 0xFC) == 0xA0)) |
1209 | 8.23k | attrMask ^= ATTR_OPSIZE; |
1210 | 8.81k | } |
1211 | | |
1212 | 22.6k | if (getIDWithAttrMask(&instructionID, insn, attrMask)) { |
1213 | 5 | return -1; |
1214 | 5 | } |
1215 | | |
1216 | 22.6k | insn->instructionID = instructionID; |
1217 | 22.6k | insn->spec = specifierForUID(instructionID); |
1218 | | |
1219 | 22.6k | return 0; |
1220 | 22.6k | } |
1221 | 1.97M | if (getIDWithAttrMask(&instructionID, insn, attrMask)) { |
1222 | 2.98k | return -1; |
1223 | 2.98k | } |
1224 | | |
1225 | 1.97M | if ((insn->mode == MODE_16BIT || insn->hasOpSize) && |
1226 | 1.97M | !(attrMask & ATTR_OPSIZE)) { |
1227 | | /* |
1228 | | * The instruction tables make no distinction between instructions that |
1229 | | * allow OpSize anywhere (i.e., 16-bit operations) and that need it in a |
1230 | | * particular spot (i.e., many MMX operations). In general we're |
1231 | | * conservative, but in the specific case where OpSize is present but not |
1232 | | * in the right place we check if there's a 16-bit operation. |
1233 | | */ |
1234 | 659k | const struct InstructionSpecifier *spec; |
1235 | 659k | uint16_t instructionIDWithOpsize; |
1236 | | |
1237 | 659k | spec = specifierForUID(instructionID); |
1238 | | |
1239 | 659k | if (getIDWithAttrMask(&instructionIDWithOpsize, |
1240 | 659k | insn, |
1241 | 659k | attrMask | ATTR_OPSIZE)) { |
1242 | | /* |
1243 | | * ModRM required with OpSize but not present; give up and return version |
1244 | | * without OpSize set |
1245 | | */ |
1246 | 4 | insn->instructionID = instructionID; |
1247 | 4 | insn->spec = spec; |
1248 | | |
1249 | 4 | return 0; |
1250 | 4 | } |
1251 | | |
1252 | 659k | if (is16BitEquivalent(instructionID, instructionIDWithOpsize) && |
1253 | 659k | (insn->mode == MODE_16BIT) ^ insn->hasOpSize) { |
1254 | 302k | insn->instructionID = instructionIDWithOpsize; |
1255 | 302k | insn->spec = specifierForUID(instructionIDWithOpsize); |
1256 | 357k | } else { |
1257 | 357k | insn->instructionID = instructionID; |
1258 | 357k | insn->spec = spec; |
1259 | 357k | } |
1260 | | |
1261 | 659k | return 0; |
1262 | 659k | } |
1263 | | |
1264 | 1.31M | if (insn->opcodeType == ONEBYTE && insn->opcode == 0x90 && |
1265 | 1.31M | insn->rexPrefix & 0x01) { |
1266 | | /* |
1267 | | * NOOP shouldn't decode as NOOP if REX.b is set. Instead |
1268 | | * it should decode as XCHG %r8, %eax. |
1269 | | */ |
1270 | 749 | const struct InstructionSpecifier *spec; |
1271 | 749 | uint16_t instructionIDWithNewOpcode; |
1272 | 749 | const struct InstructionSpecifier *specWithNewOpcode; |
1273 | | |
1274 | 749 | spec = specifierForUID(instructionID); |
1275 | | |
1276 | | /* Borrow opcode from one of the other XCHGar opcodes */ |
1277 | 749 | insn->opcode = 0x91; |
1278 | | |
1279 | 749 | if (getIDWithAttrMask(&instructionIDWithNewOpcode, insn, attrMask)) { |
1280 | 0 | insn->opcode = 0x90; |
1281 | |
|
1282 | 0 | insn->instructionID = instructionID; |
1283 | 0 | insn->spec = spec; |
1284 | |
|
1285 | 0 | return 0; |
1286 | 0 | } |
1287 | | |
1288 | 749 | specWithNewOpcode = specifierForUID(instructionIDWithNewOpcode); |
1289 | | |
1290 | | /* Change back */ |
1291 | 749 | insn->opcode = 0x90; |
1292 | | |
1293 | 749 | insn->instructionID = instructionIDWithNewOpcode; |
1294 | 749 | insn->spec = specWithNewOpcode; |
1295 | | |
1296 | 749 | return 0; |
1297 | 749 | } |
1298 | | |
1299 | 1.31M | insn->instructionID = instructionID; |
1300 | 1.31M | insn->spec = specifierForUID(insn->instructionID); |
1301 | | |
1302 | 1.31M | return 0; |
1303 | 1.31M | } |
1304 | | |
1305 | | /* |
1306 | | * readSIB - Consumes the SIB byte to determine addressing information for an |
1307 | | * instruction. |
1308 | | * |
1309 | | * @param insn - The instruction whose SIB byte is to be read. |
1310 | | * @return - 0 if the SIB byte was successfully read; nonzero otherwise. |
1311 | | */ |
1312 | | static int readSIB(struct InternalInstruction* insn) |
1313 | 45.0k | { |
1314 | 45.0k | SIBBase sibBaseBase = SIB_BASE_NONE; |
1315 | 45.0k | uint8_t index, base; |
1316 | | |
1317 | | // dbgprintf(insn, "readSIB()"); |
1318 | | |
1319 | 45.0k | if (insn->consumedSIB) |
1320 | 0 | return 0; |
1321 | | |
1322 | 45.0k | insn->consumedSIB = true; |
1323 | | |
1324 | 45.0k | switch (insn->addressSize) { |
1325 | 0 | case 2: |
1326 | | // dbgprintf(insn, "SIB-based addressing doesn't work in 16-bit mode"); |
1327 | 0 | return -1; |
1328 | 26.2k | case 4: |
1329 | 26.2k | insn->sibIndexBase = SIB_INDEX_EAX; |
1330 | 26.2k | sibBaseBase = SIB_BASE_EAX; |
1331 | 26.2k | break; |
1332 | 18.7k | case 8: |
1333 | 18.7k | insn->sibIndexBase = SIB_INDEX_RAX; |
1334 | 18.7k | sibBaseBase = SIB_BASE_RAX; |
1335 | 18.7k | break; |
1336 | 45.0k | } |
1337 | | |
1338 | 45.0k | if (consumeByte(insn, &insn->sib)) |
1339 | 69 | return -1; |
1340 | | |
1341 | 44.9k | index = indexFromSIB(insn->sib) | (xFromREX(insn->rexPrefix) << 3); |
1342 | | |
1343 | 44.9k | if (index == 0x4) { |
1344 | 10.5k | insn->sibIndex = SIB_INDEX_NONE; |
1345 | 34.4k | } else { |
1346 | 34.4k | insn->sibIndex = (SIBIndex)(insn->sibIndexBase + index); |
1347 | 34.4k | } |
1348 | | |
1349 | 44.9k | insn->sibScale = 1 << scaleFromSIB(insn->sib); |
1350 | | |
1351 | 44.9k | base = baseFromSIB(insn->sib) | (bFromREX(insn->rexPrefix) << 3); |
1352 | | |
1353 | 44.9k | switch (base) { |
1354 | 4.58k | case 0x5: |
1355 | 5.38k | case 0xd: |
1356 | 5.38k | switch (modFromModRM(insn->modRM)) { |
1357 | 2.87k | case 0x0: |
1358 | 2.87k | insn->eaDisplacement = EA_DISP_32; |
1359 | 2.87k | insn->sibBase = SIB_BASE_NONE; |
1360 | 2.87k | break; |
1361 | 1.74k | case 0x1: |
1362 | 1.74k | insn->eaDisplacement = EA_DISP_8; |
1363 | 1.74k | insn->sibBase = (SIBBase)(sibBaseBase + base); |
1364 | 1.74k | break; |
1365 | 764 | case 0x2: |
1366 | 764 | insn->eaDisplacement = EA_DISP_32; |
1367 | 764 | insn->sibBase = (SIBBase)(sibBaseBase + base); |
1368 | 764 | break; |
1369 | 0 | case 0x3: |
1370 | | // debug("Cannot have Mod = 0b11 and a SIB byte"); |
1371 | 0 | return -1; |
1372 | 5.38k | } |
1373 | 5.38k | break; |
1374 | 39.5k | default: |
1375 | 39.5k | insn->sibBase = (SIBBase)(sibBaseBase + base); |
1376 | 39.5k | break; |
1377 | 44.9k | } |
1378 | | |
1379 | 44.9k | return 0; |
1380 | 44.9k | } |
1381 | | |
1382 | | /* |
1383 | | * readDisplacement - Consumes the displacement of an instruction. |
1384 | | * |
1385 | | * @param insn - The instruction whose displacement is to be read. |
1386 | | * @return - 0 if the displacement byte was successfully read; nonzero |
1387 | | * otherwise. |
1388 | | */ |
1389 | | static int readDisplacement(struct InternalInstruction* insn) |
1390 | 346k | { |
1391 | 346k | int8_t d8; |
1392 | 346k | int16_t d16; |
1393 | 346k | int32_t d32; |
1394 | | |
1395 | | // dbgprintf(insn, "readDisplacement()"); |
1396 | | |
1397 | 346k | if (insn->consumedDisplacement) |
1398 | 0 | return 0; |
1399 | | |
1400 | 346k | insn->consumedDisplacement = true; |
1401 | 346k | insn->displacementOffset = insn->readerCursor - insn->startLocation; |
1402 | | |
1403 | 346k | switch (insn->eaDisplacement) { |
1404 | 89.6k | case EA_DISP_NONE: |
1405 | 89.6k | insn->consumedDisplacement = false; |
1406 | 89.6k | break; |
1407 | 163k | case EA_DISP_8: |
1408 | 163k | if (consumeInt8(insn, &d8)) |
1409 | 345 | return -1; |
1410 | 163k | insn->displacement = d8; |
1411 | 163k | break; |
1412 | 35.3k | case EA_DISP_16: |
1413 | 35.3k | if (consumeInt16(insn, &d16)) |
1414 | 152 | return -1; |
1415 | 35.2k | insn->displacement = d16; |
1416 | 35.2k | break; |
1417 | 57.5k | case EA_DISP_32: |
1418 | 57.5k | if (consumeInt32(insn, &d32)) |
1419 | 521 | return -1; |
1420 | 57.0k | insn->displacement = d32; |
1421 | 57.0k | break; |
1422 | 346k | } |
1423 | | |
1424 | | |
1425 | 345k | return 0; |
1426 | 346k | } |
1427 | | |
1428 | | /* |
1429 | | * readModRM - Consumes all addressing information (ModR/M byte, SIB byte, and |
1430 | | * displacement) for an instruction and interprets it. |
1431 | | * |
1432 | | * @param insn - The instruction whose addressing information is to be read. |
1433 | | * @return - 0 if the information was successfully read; nonzero otherwise. |
1434 | | */ |
1435 | | static int readModRM(struct InternalInstruction* insn) |
1436 | 3.26M | { |
1437 | 3.26M | uint8_t mod, rm, reg, evexrm; |
1438 | | |
1439 | | // dbgprintf(insn, "readModRM()"); |
1440 | | |
1441 | 3.26M | if (insn->consumedModRM) |
1442 | 2.22M | return 0; |
1443 | | |
1444 | 1.04M | insn->modRMOffset = (uint8_t)(insn->readerCursor - insn->startLocation); |
1445 | | |
1446 | 1.04M | if (consumeByte(insn, &insn->modRM)) |
1447 | 1.96k | return -1; |
1448 | | |
1449 | 1.04M | insn->consumedModRM = true; |
1450 | | |
1451 | | // save original ModRM for later reference |
1452 | 1.04M | insn->orgModRM = insn->modRM; |
1453 | | |
1454 | | // handle MOVcr, MOVdr, MOVrc, MOVrd by pretending they have MRM.mod = 3 |
1455 | 1.04M | if ((insn->firstByte == 0x0f && insn->opcodeType == TWOBYTE) && |
1456 | 1.04M | (insn->opcode >= 0x20 && insn->opcode <= 0x23 )) |
1457 | 998 | insn->modRM |= 0xC0; |
1458 | | |
1459 | 1.04M | mod = modFromModRM(insn->modRM); |
1460 | 1.04M | rm = rmFromModRM(insn->modRM); |
1461 | 1.04M | reg = regFromModRM(insn->modRM); |
1462 | | |
1463 | | /* |
1464 | | * This goes by insn->registerSize to pick the correct register, which messes |
1465 | | * up if we're using (say) XMM or 8-bit register operands. That gets fixed in |
1466 | | * fixupReg(). |
1467 | | */ |
1468 | 1.04M | switch (insn->registerSize) { |
1469 | 357k | case 2: |
1470 | 357k | insn->regBase = MODRM_REG_AX; |
1471 | 357k | insn->eaRegBase = EA_REG_AX; |
1472 | 357k | break; |
1473 | 622k | case 4: |
1474 | 622k | insn->regBase = MODRM_REG_EAX; |
1475 | 622k | insn->eaRegBase = EA_REG_EAX; |
1476 | 622k | break; |
1477 | 61.7k | case 8: |
1478 | 61.7k | insn->regBase = MODRM_REG_RAX; |
1479 | 61.7k | insn->eaRegBase = EA_REG_RAX; |
1480 | 61.7k | break; |
1481 | 1.04M | } |
1482 | | |
1483 | 1.04M | reg |= rFromREX(insn->rexPrefix) << 3; |
1484 | 1.04M | rm |= bFromREX(insn->rexPrefix) << 3; |
1485 | | |
1486 | 1.04M | evexrm = 0; |
1487 | 1.04M | if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT) { |
1488 | 26.3k | reg |= r2FromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; |
1489 | 26.3k | evexrm = xFromEVEX2of4(insn->vectorExtensionPrefix[1]) << 4; |
1490 | 26.3k | } |
1491 | | |
1492 | 1.04M | insn->reg = (Reg)(insn->regBase + reg); |
1493 | | |
1494 | 1.04M | switch (insn->addressSize) { |
1495 | 341k | case 2: { |
1496 | 341k | EABase eaBaseBase = EA_BASE_BX_SI; |
1497 | | |
1498 | 341k | switch (mod) { |
1499 | 195k | case 0x0: |
1500 | 195k | if (rm == 0x6) { |
1501 | 9.66k | insn->eaBase = EA_BASE_NONE; |
1502 | 9.66k | insn->eaDisplacement = EA_DISP_16; |
1503 | 9.66k | if (readDisplacement(insn)) |
1504 | 29 | return -1; |
1505 | 185k | } else { |
1506 | 185k | insn->eaBase = (EABase)(eaBaseBase + rm); |
1507 | 185k | insn->eaDisplacement = EA_DISP_NONE; |
1508 | 185k | } |
1509 | 195k | break; |
1510 | 195k | case 0x1: |
1511 | 52.9k | insn->eaBase = (EABase)(eaBaseBase + rm); |
1512 | 52.9k | insn->eaDisplacement = EA_DISP_8; |
1513 | 52.9k | insn->displacementSize = 1; |
1514 | 52.9k | if (readDisplacement(insn)) |
1515 | 96 | return -1; |
1516 | 52.8k | break; |
1517 | 52.8k | case 0x2: |
1518 | 25.7k | insn->eaBase = (EABase)(eaBaseBase + rm); |
1519 | 25.7k | insn->eaDisplacement = EA_DISP_16; |
1520 | 25.7k | if (readDisplacement(insn)) |
1521 | 123 | return -1; |
1522 | 25.5k | break; |
1523 | 67.0k | case 0x3: |
1524 | 67.0k | insn->eaBase = (EABase)(insn->eaRegBase + rm); |
1525 | 67.0k | if (readDisplacement(insn)) |
1526 | 0 | return -1; |
1527 | 67.0k | break; |
1528 | 341k | } |
1529 | 340k | break; |
1530 | 341k | } |
1531 | | |
1532 | 361k | case 4: |
1533 | 700k | case 8: { |
1534 | 700k | EABase eaBaseBase = (insn->addressSize == 4 ? EA_BASE_EAX : EA_BASE_RAX); |
1535 | | |
1536 | 700k | switch (mod) { |
1537 | 0 | default: break; |
1538 | 387k | case 0x0: |
1539 | 387k | insn->eaDisplacement = EA_DISP_NONE; /* readSIB may override this */ |
1540 | | // In determining whether RIP-relative mode is used (rm=5), |
1541 | | // or whether a SIB byte is present (rm=4), |
1542 | | // the extension bits (REX.b and EVEX.x) are ignored. |
1543 | 387k | switch (rm & 7) { |
1544 | 25.5k | case 0x4: // SIB byte is present |
1545 | 25.5k | insn->eaBase = (insn->addressSize == 4 ? |
1546 | 14.5k | EA_BASE_sib : EA_BASE_sib64); |
1547 | 25.5k | if (readSIB(insn) || readDisplacement(insn)) |
1548 | 41 | return -1; |
1549 | 25.5k | break; |
1550 | 25.5k | case 0x5: // RIP-relative |
1551 | 11.0k | insn->eaBase = EA_BASE_NONE; |
1552 | 11.0k | insn->eaDisplacement = EA_DISP_32; |
1553 | 11.0k | if (readDisplacement(insn)) |
1554 | 81 | return -1; |
1555 | 11.0k | break; |
1556 | 350k | default: |
1557 | 350k | insn->eaBase = (EABase)(eaBaseBase + rm); |
1558 | 350k | break; |
1559 | 387k | } |
1560 | 387k | break; |
1561 | 387k | case 0x1: |
1562 | 110k | insn->displacementSize = 1; |
1563 | | /* FALLTHROUGH */ |
1564 | 154k | case 0x2: |
1565 | 154k | insn->eaDisplacement = (mod == 0x1 ? EA_DISP_8 : EA_DISP_32); |
1566 | 154k | switch (rm & 7) { |
1567 | 19.4k | case 0x4: // SIB byte is present |
1568 | 19.4k | insn->eaBase = EA_BASE_sib; |
1569 | 19.4k | if (readSIB(insn) || readDisplacement(insn)) |
1570 | 109 | return -1; |
1571 | 19.3k | break; |
1572 | 134k | default: |
1573 | 134k | insn->eaBase = (EABase)(eaBaseBase + rm); |
1574 | 134k | if (readDisplacement(insn)) |
1575 | 608 | return -1; |
1576 | 134k | break; |
1577 | 154k | } |
1578 | 153k | break; |
1579 | 158k | case 0x3: |
1580 | 158k | insn->eaDisplacement = EA_DISP_NONE; |
1581 | 158k | insn->eaBase = (EABase)(insn->eaRegBase + rm + evexrm); |
1582 | 158k | break; |
1583 | 700k | } |
1584 | | |
1585 | 699k | break; |
1586 | 700k | } |
1587 | 1.04M | } /* switch (insn->addressSize) */ |
1588 | | |
1589 | 1.04M | return 0; |
1590 | 1.04M | } |
1591 | | |
1592 | | #define GENERIC_FIXUP_FUNC(name, base, prefix, mask) \ |
1593 | | static uint16_t name(struct InternalInstruction *insn, \ |
1594 | | OperandType type, \ |
1595 | | uint8_t index, \ |
1596 | 1.11M | uint8_t *valid) { \ |
1597 | 1.11M | *valid = 1; \ |
1598 | 1.11M | switch (type) { \ |
1599 | 0 | default: \ |
1600 | 0 | *valid = 0; \ |
1601 | 0 | return 0; \ |
1602 | 270k | case TYPE_Rv: \ |
1603 | 270k | return base + index; \ |
1604 | 505k | case TYPE_R8: \ |
1605 | 505k | index &= mask; \ |
1606 | 505k | if (index > 0xf) \ |
1607 | 505k | *valid = 0; \ |
1608 | 505k | if (insn->rexPrefix && \ |
1609 | 505k | index >= 4 && index <= 7) { \ |
1610 | 5.32k | return prefix##_SPL + (index - 4); \ |
1611 | 499k | } else { \ |
1612 | 499k | return prefix##_AL + index; \ |
1613 | 499k | } \ |
1614 | 505k | case TYPE_R16: \ |
1615 | 9.43k | index &= mask; \ |
1616 | 9.43k | if (index > 0xf) \ |
1617 | 9.43k | *valid = 0; \ |
1618 | 9.43k | return prefix##_AX + index; \ |
1619 | 505k | case TYPE_R32: \ |
1620 | 3.89k | index &= mask; \ |
1621 | 3.89k | if (index > 0xf) \ |
1622 | 3.89k | *valid = 0; \ |
1623 | 3.89k | return prefix##_EAX + index; \ |
1624 | 505k | case TYPE_R64: \ |
1625 | 24.9k | index &= mask; \ |
1626 | 24.9k | if (index > 0xf) \ |
1627 | 24.9k | *valid = 0; \ |
1628 | 24.9k | return prefix##_RAX + index; \ |
1629 | 505k | case TYPE_ZMM: \ |
1630 | 64.7k | return prefix##_ZMM0 + index; \ |
1631 | 505k | case TYPE_YMM: \ |
1632 | 52.4k | return prefix##_YMM0 + index; \ |
1633 | 505k | case TYPE_XMM: \ |
1634 | 115k | return prefix##_XMM0 + index; \ |
1635 | 505k | case TYPE_VK: \ |
1636 | 36.1k | index &= 0xf; \ |
1637 | 36.1k | if (index > 7) \ |
1638 | 36.1k | *valid = 0; \ |
1639 | 36.1k | return prefix##_K0 + index; \ |
1640 | 505k | case TYPE_MM64: \ |
1641 | 14.3k | return prefix##_MM0 + (index & 0x7); \ |
1642 | 505k | case TYPE_SEGMENTREG: \ |
1643 | 4.41k | if ((index & 7) > 5) \ |
1644 | 4.41k | *valid = 0; \ |
1645 | 4.41k | return prefix##_ES + (index & 7); \ |
1646 | 505k | case TYPE_DEBUGREG: \ |
1647 | 362 | return prefix##_DR0 + index; \ |
1648 | 505k | case TYPE_CONTROLREG: \ |
1649 | 636 | return prefix##_CR0 + index; \ |
1650 | 505k | case TYPE_BNDR: \ |
1651 | 12.5k | if (index > 3) \ |
1652 | 12.5k | *valid = 0; \ |
1653 | 12.5k | return prefix##_BND0 + index; \ |
1654 | 505k | case TYPE_MVSIBX: \ |
1655 | 0 | return prefix##_XMM0 + index; \ |
1656 | 505k | case TYPE_MVSIBY: \ |
1657 | 0 | return prefix##_YMM0 + index; \ |
1658 | 505k | case TYPE_MVSIBZ: \ |
1659 | 0 | return prefix##_ZMM0 + index; \ |
1660 | 1.11M | } \ |
1661 | 1.11M | } X86DisassemblerDecoder.c:fixupRegValue Line | Count | Source | 1596 | 902k | uint8_t *valid) { \ | 1597 | 902k | *valid = 1; \ | 1598 | 902k | switch (type) { \ | 1599 | 0 | default: \ | 1600 | 0 | *valid = 0; \ | 1601 | 0 | return 0; \ | 1602 | 202k | case TYPE_Rv: \ | 1603 | 202k | return base + index; \ | 1604 | 431k | case TYPE_R8: \ | 1605 | 431k | index &= mask; \ | 1606 | 431k | if (index > 0xf) \ | 1607 | 431k | *valid = 0; \ | 1608 | 431k | if (insn->rexPrefix && \ | 1609 | 431k | index >= 4 && index <= 7) { \ | 1610 | 3.77k | return prefix##_SPL + (index - 4); \ | 1611 | 427k | } else { \ | 1612 | 427k | return prefix##_AL + index; \ | 1613 | 427k | } \ | 1614 | 431k | case TYPE_R16: \ | 1615 | 7.48k | index &= mask; \ | 1616 | 7.48k | if (index > 0xf) \ | 1617 | 7.48k | *valid = 0; \ | 1618 | 7.48k | return prefix##_AX + index; \ | 1619 | 431k | case TYPE_R32: \ | 1620 | 1.90k | index &= mask; \ | 1621 | 1.90k | if (index > 0xf) \ | 1622 | 1.90k | *valid = 0; \ | 1623 | 1.90k | return prefix##_EAX + index; \ | 1624 | 431k | case TYPE_R64: \ | 1625 | 13.4k | index &= mask; \ | 1626 | 13.4k | if (index > 0xf) \ | 1627 | 13.4k | *valid = 0; \ | 1628 | 13.4k | return prefix##_RAX + index; \ | 1629 | 431k | case TYPE_ZMM: \ | 1630 | 51.3k | return prefix##_ZMM0 + index; \ | 1631 | 431k | case TYPE_YMM: \ | 1632 | 41.2k | return prefix##_YMM0 + index; \ | 1633 | 431k | case TYPE_XMM: \ | 1634 | 93.0k | return prefix##_XMM0 + index; \ | 1635 | 431k | case TYPE_VK: \ | 1636 | 34.3k | index &= 0xf; \ | 1637 | 34.3k | if (index > 7) \ | 1638 | 34.3k | *valid = 0; \ | 1639 | 34.3k | return prefix##_K0 + index; \ | 1640 | 431k | case TYPE_MM64: \ | 1641 | 9.16k | return prefix##_MM0 + (index & 0x7); \ | 1642 | 431k | case TYPE_SEGMENTREG: \ | 1643 | 4.41k | if ((index & 7) > 5) \ | 1644 | 4.41k | *valid = 0; \ | 1645 | 4.41k | return prefix##_ES + (index & 7); \ | 1646 | 431k | case TYPE_DEBUGREG: \ | 1647 | 362 | return prefix##_DR0 + index; \ | 1648 | 431k | case TYPE_CONTROLREG: \ | 1649 | 636 | return prefix##_CR0 + index; \ | 1650 | 431k | case TYPE_BNDR: \ | 1651 | 10.9k | if (index > 3) \ | 1652 | 10.9k | *valid = 0; \ | 1653 | 10.9k | return prefix##_BND0 + index; \ | 1654 | 431k | case TYPE_MVSIBX: \ | 1655 | 0 | return prefix##_XMM0 + index; \ | 1656 | 431k | case TYPE_MVSIBY: \ | 1657 | 0 | return prefix##_YMM0 + index; \ | 1658 | 431k | case TYPE_MVSIBZ: \ | 1659 | 0 | return prefix##_ZMM0 + index; \ | 1660 | 902k | } \ | 1661 | 902k | } |
X86DisassemblerDecoder.c:fixupRMValue Line | Count | Source | 1596 | 212k | uint8_t *valid) { \ | 1597 | 212k | *valid = 1; \ | 1598 | 212k | switch (type) { \ | 1599 | 0 | default: \ | 1600 | 0 | *valid = 0; \ | 1601 | 0 | return 0; \ | 1602 | 68.3k | case TYPE_Rv: \ | 1603 | 68.3k | return base + index; \ | 1604 | 73.4k | case TYPE_R8: \ | 1605 | 73.4k | index &= mask; \ | 1606 | 73.4k | if (index > 0xf) \ | 1607 | 73.4k | *valid = 0; \ | 1608 | 73.4k | if (insn->rexPrefix && \ | 1609 | 73.4k | index >= 4 && index <= 7) { \ | 1610 | 1.55k | return prefix##_SPL + (index - 4); \ | 1611 | 71.8k | } else { \ | 1612 | 71.8k | return prefix##_AL + index; \ | 1613 | 71.8k | } \ | 1614 | 73.4k | case TYPE_R16: \ | 1615 | 1.95k | index &= mask; \ | 1616 | 1.95k | if (index > 0xf) \ | 1617 | 1.95k | *valid = 0; \ | 1618 | 1.95k | return prefix##_AX + index; \ | 1619 | 73.4k | case TYPE_R32: \ | 1620 | 1.99k | index &= mask; \ | 1621 | 1.99k | if (index > 0xf) \ | 1622 | 1.99k | *valid = 0; \ | 1623 | 1.99k | return prefix##_EAX + index; \ | 1624 | 73.4k | case TYPE_R64: \ | 1625 | 11.4k | index &= mask; \ | 1626 | 11.4k | if (index > 0xf) \ | 1627 | 11.4k | *valid = 0; \ | 1628 | 11.4k | return prefix##_RAX + index; \ | 1629 | 73.4k | case TYPE_ZMM: \ | 1630 | 13.3k | return prefix##_ZMM0 + index; \ | 1631 | 73.4k | case TYPE_YMM: \ | 1632 | 11.2k | return prefix##_YMM0 + index; \ | 1633 | 73.4k | case TYPE_XMM: \ | 1634 | 22.2k | return prefix##_XMM0 + index; \ | 1635 | 73.4k | case TYPE_VK: \ | 1636 | 1.80k | index &= 0xf; \ | 1637 | 1.80k | if (index > 7) \ | 1638 | 1.80k | *valid = 0; \ | 1639 | 1.80k | return prefix##_K0 + index; \ | 1640 | 73.4k | case TYPE_MM64: \ | 1641 | 5.14k | return prefix##_MM0 + (index & 0x7); \ | 1642 | 73.4k | case TYPE_SEGMENTREG: \ | 1643 | 0 | if ((index & 7) > 5) \ | 1644 | 0 | *valid = 0; \ | 1645 | 0 | return prefix##_ES + (index & 7); \ | 1646 | 73.4k | case TYPE_DEBUGREG: \ | 1647 | 0 | return prefix##_DR0 + index; \ | 1648 | 73.4k | case TYPE_CONTROLREG: \ | 1649 | 0 | return prefix##_CR0 + index; \ | 1650 | 73.4k | case TYPE_BNDR: \ | 1651 | 1.67k | if (index > 3) \ | 1652 | 1.67k | *valid = 0; \ | 1653 | 1.67k | return prefix##_BND0 + index; \ | 1654 | 73.4k | case TYPE_MVSIBX: \ | 1655 | 0 | return prefix##_XMM0 + index; \ | 1656 | 73.4k | case TYPE_MVSIBY: \ | 1657 | 0 | return prefix##_YMM0 + index; \ | 1658 | 73.4k | case TYPE_MVSIBZ: \ | 1659 | 0 | return prefix##_ZMM0 + index; \ | 1660 | 212k | } \ | 1661 | 212k | } |
|
1662 | | |
1663 | | /* |
1664 | | * fixup*Value - Consults an operand type to determine the meaning of the |
1665 | | * reg or R/M field. If the operand is an XMM operand, for example, an |
1666 | | * operand would be XMM0 instead of AX, which readModRM() would otherwise |
1667 | | * misinterpret it as. |
1668 | | * |
1669 | | * @param insn - The instruction containing the operand. |
1670 | | * @param type - The operand type. |
1671 | | * @param index - The existing value of the field as reported by readModRM(). |
1672 | | * @param valid - The address of a uint8_t. The target is set to 1 if the |
1673 | | * field is valid for the register class; 0 if not. |
1674 | | * @return - The proper value. |
1675 | | */ |
1676 | | GENERIC_FIXUP_FUNC(fixupRegValue, insn->regBase, MODRM_REG, 0x1f) |
1677 | | GENERIC_FIXUP_FUNC(fixupRMValue, insn->eaRegBase, EA_REG, 0xf) |
1678 | | |
1679 | | /* |
1680 | | * fixupReg - Consults an operand specifier to determine which of the |
1681 | | * fixup*Value functions to use in correcting readModRM()'ss interpretation. |
1682 | | * |
1683 | | * @param insn - See fixup*Value(). |
1684 | | * @param op - The operand specifier. |
1685 | | * @return - 0 if fixup was successful; -1 if the register returned was |
1686 | | * invalid for its class. |
1687 | | */ |
1688 | | static int fixupReg(struct InternalInstruction *insn, |
1689 | | const struct OperandSpecifier *op) |
1690 | 1.92M | { |
1691 | 1.92M | uint8_t valid; |
1692 | | |
1693 | 1.92M | switch ((OperandEncoding)op->encoding) { |
1694 | 0 | default: |
1695 | | // debug("Expected a REG or R/M encoding in fixupReg"); |
1696 | 0 | return -1; |
1697 | 82.0k | case ENCODING_VVVV: |
1698 | 82.0k | insn->vvvv = (Reg)fixupRegValue(insn, |
1699 | 82.0k | (OperandType)op->type, |
1700 | 82.0k | insn->vvvv, |
1701 | 82.0k | &valid); |
1702 | 82.0k | if (!valid) |
1703 | 2 | return -1; |
1704 | 82.0k | break; |
1705 | 820k | case ENCODING_REG: |
1706 | 820k | insn->reg = (Reg)fixupRegValue(insn, |
1707 | 820k | (OperandType)op->type, |
1708 | 820k | insn->reg - insn->regBase, |
1709 | 820k | &valid); |
1710 | 820k | if (!valid) |
1711 | 62 | return -1; |
1712 | 820k | break; |
1713 | 6.82M | CASE_ENCODING_RM: |
1714 | 6.82M | if (insn->eaBase >= insn->eaRegBase) { |
1715 | 212k | insn->eaBase = (EABase)fixupRMValue(insn, |
1716 | 212k | (OperandType)op->type, |
1717 | 212k | insn->eaBase - insn->eaRegBase, |
1718 | 212k | &valid); |
1719 | 212k | if (!valid) |
1720 | 2 | return -1; |
1721 | 212k | } |
1722 | 1.01M | break; |
1723 | 1.92M | } |
1724 | | |
1725 | 1.92M | return 0; |
1726 | 1.92M | } |
1727 | | |
1728 | | /* |
1729 | | * readOpcodeRegister - Reads an operand from the opcode field of an |
1730 | | * instruction and interprets it appropriately given the operand width. |
1731 | | * Handles AddRegFrm instructions. |
1732 | | * |
1733 | | * @param insn - the instruction whose opcode field is to be read. |
1734 | | * @param size - The width (in bytes) of the register being specified. |
1735 | | * 1 means AL and friends, 2 means AX, 4 means EAX, and 8 means |
1736 | | * RAX. |
1737 | | * @return - 0 on success; nonzero otherwise. |
1738 | | */ |
1739 | | static int readOpcodeRegister(struct InternalInstruction* insn, uint8_t size) |
1740 | 247k | { |
1741 | 247k | if (size == 0) |
1742 | 189k | size = insn->registerSize; |
1743 | | |
1744 | 247k | switch (size) { |
1745 | 24.4k | case 1: |
1746 | 24.4k | insn->opcodeRegister = (Reg)(MODRM_REG_AL + ((bFromREX(insn->rexPrefix) << 3) |
1747 | 24.4k | | (insn->opcode & 7))); |
1748 | 24.4k | if (insn->rexPrefix && |
1749 | 24.4k | insn->opcodeRegister >= MODRM_REG_AL + 0x4 && |
1750 | 24.4k | insn->opcodeRegister < MODRM_REG_AL + 0x8) { |
1751 | 566 | insn->opcodeRegister = (Reg)(MODRM_REG_SPL |
1752 | 566 | + (insn->opcodeRegister - MODRM_REG_AL - 4)); |
1753 | 566 | } |
1754 | | |
1755 | 24.4k | break; |
1756 | 85.5k | case 2: |
1757 | 85.5k | insn->opcodeRegister = (Reg)(MODRM_REG_AX |
1758 | 85.5k | + ((bFromREX(insn->rexPrefix) << 3) |
1759 | 85.5k | | (insn->opcode & 7))); |
1760 | 85.5k | break; |
1761 | 104k | case 4: |
1762 | 104k | insn->opcodeRegister = (Reg)(MODRM_REG_EAX |
1763 | 104k | + ((bFromREX(insn->rexPrefix) << 3) |
1764 | 104k | | (insn->opcode & 7))); |
1765 | 104k | break; |
1766 | 33.4k | case 8: |
1767 | 33.4k | insn->opcodeRegister = (Reg)(MODRM_REG_RAX |
1768 | 33.4k | + ((bFromREX(insn->rexPrefix) << 3) |
1769 | 33.4k | | (insn->opcode & 7))); |
1770 | 33.4k | break; |
1771 | 247k | } |
1772 | | |
1773 | 247k | return 0; |
1774 | 247k | } |
1775 | | |
1776 | | /* |
1777 | | * readImmediate - Consumes an immediate operand from an instruction, given the |
1778 | | * desired operand size. |
1779 | | * |
1780 | | * @param insn - The instruction whose operand is to be read. |
1781 | | * @param size - The width (in bytes) of the operand. |
1782 | | * @return - 0 if the immediate was successfully consumed; nonzero |
1783 | | * otherwise. |
1784 | | */ |
1785 | | static int readImmediate(struct InternalInstruction* insn, uint8_t size) |
1786 | 522k | { |
1787 | 522k | uint8_t imm8; |
1788 | 522k | uint16_t imm16; |
1789 | 522k | uint32_t imm32; |
1790 | 522k | uint64_t imm64; |
1791 | | |
1792 | 522k | if (insn->numImmediatesConsumed == 2) { |
1793 | | // debug("Already consumed two immediates"); |
1794 | 0 | return -1; |
1795 | 0 | } |
1796 | | |
1797 | 522k | if (size == 0) |
1798 | 0 | size = insn->immediateSize; |
1799 | 522k | else |
1800 | 522k | insn->immediateSize = size; |
1801 | | |
1802 | 522k | insn->immediateOffset = insn->readerCursor - insn->startLocation; |
1803 | | |
1804 | 522k | switch (size) { |
1805 | 376k | case 1: |
1806 | 376k | if (consumeByte(insn, &imm8)) |
1807 | 771 | return -1; |
1808 | | |
1809 | 375k | insn->immediates[insn->numImmediatesConsumed] = imm8; |
1810 | 375k | break; |
1811 | 78.4k | case 2: |
1812 | 78.4k | if (consumeUInt16(insn, &imm16)) |
1813 | 370 | return -1; |
1814 | | |
1815 | 78.0k | insn->immediates[insn->numImmediatesConsumed] = imm16; |
1816 | 78.0k | break; |
1817 | 60.3k | case 4: |
1818 | 60.3k | if (consumeUInt32(insn, &imm32)) |
1819 | 566 | return -1; |
1820 | | |
1821 | 59.7k | insn->immediates[insn->numImmediatesConsumed] = imm32; |
1822 | 59.7k | break; |
1823 | 7.44k | case 8: |
1824 | 7.44k | if (consumeUInt64(insn, &imm64)) |
1825 | 138 | return -1; |
1826 | 7.30k | insn->immediates[insn->numImmediatesConsumed] = imm64; |
1827 | 7.30k | break; |
1828 | 522k | } |
1829 | | |
1830 | 521k | insn->numImmediatesConsumed++; |
1831 | | |
1832 | 521k | return 0; |
1833 | 522k | } |
1834 | | |
1835 | | /* |
1836 | | * readVVVV - Consumes vvvv from an instruction if it has a VEX prefix. |
1837 | | * |
1838 | | * @param insn - The instruction whose operand is to be read. |
1839 | | * @return - 0 if the vvvv was successfully consumed; nonzero |
1840 | | * otherwise. |
1841 | | */ |
1842 | | static int readVVVV(struct InternalInstruction* insn) |
1843 | 2.02M | { |
1844 | 2.02M | int vvvv; |
1845 | | |
1846 | 2.02M | if (insn->vectorExtensionType == TYPE_EVEX) |
1847 | 85.3k | vvvv = (v2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 4 | |
1848 | 85.3k | vvvvFromEVEX3of4(insn->vectorExtensionPrefix[2])); |
1849 | 1.94M | else if (insn->vectorExtensionType == TYPE_VEX_3B) |
1850 | 8.97k | vvvv = vvvvFromVEX3of3(insn->vectorExtensionPrefix[2]); |
1851 | 1.93M | else if (insn->vectorExtensionType == TYPE_VEX_2B) |
1852 | 13.2k | vvvv = vvvvFromVEX2of2(insn->vectorExtensionPrefix[1]); |
1853 | 1.92M | else if (insn->vectorExtensionType == TYPE_XOP) |
1854 | 8.35k | vvvv = vvvvFromXOP3of3(insn->vectorExtensionPrefix[2]); |
1855 | 1.91M | else |
1856 | 1.91M | return -1; |
1857 | | |
1858 | 115k | if (insn->mode != MODE_64BIT) |
1859 | 82.4k | vvvv &= 0xf; // Can only clear bit 4. Bit 3 must be cleared later. |
1860 | | |
1861 | 115k | insn->vvvv = (Reg)vvvv; |
1862 | | |
1863 | 115k | return 0; |
1864 | 2.02M | } |
1865 | | |
1866 | | /* |
1867 | | * readMaskRegister - Reads an mask register from the opcode field of an |
1868 | | * instruction. |
1869 | | * |
1870 | | * @param insn - The instruction whose opcode field is to be read. |
1871 | | * @return - 0 on success; nonzero otherwise. |
1872 | | */ |
1873 | | static int readMaskRegister(struct InternalInstruction* insn) |
1874 | 62.2k | { |
1875 | 62.2k | if (insn->vectorExtensionType != TYPE_EVEX) |
1876 | 0 | return -1; |
1877 | | |
1878 | 62.2k | insn->writemask = (Reg)(aaaFromEVEX4of4(insn->vectorExtensionPrefix[3])); |
1879 | | |
1880 | 62.2k | return 0; |
1881 | 62.2k | } |
1882 | | |
1883 | | /* |
1884 | | * readOperands - Consults the specifier for an instruction and consumes all |
1885 | | * operands for that instruction, interpreting them as it goes. |
1886 | | * |
1887 | | * @param insn - The instruction whose operands are to be read and interpreted. |
1888 | | * @return - 0 if all operands could be read; nonzero otherwise. |
1889 | | */ |
1890 | | static int readOperands(struct InternalInstruction* insn) |
1891 | 2.02M | { |
1892 | 2.02M | int hasVVVV, needVVVV; |
1893 | 2.02M | int sawRegImm = 0; |
1894 | 2.02M | int i; |
1895 | | |
1896 | | /* If non-zero vvvv specified, need to make sure one of the operands |
1897 | | uses it. */ |
1898 | 2.02M | hasVVVV = !readVVVV(insn); |
1899 | 2.02M | needVVVV = hasVVVV && (insn->vvvv != 0); |
1900 | | |
1901 | 14.1M | for (i = 0; i < X86_MAX_OPERANDS; ++i) { |
1902 | 12.1M | const OperandSpecifier *op = &x86OperandSets[insn->spec->operands][i]; |
1903 | 12.1M | switch (op->encoding) { |
1904 | 8.74M | case ENCODING_NONE: |
1905 | 8.84M | case ENCODING_SI: |
1906 | 8.96M | case ENCODING_DI: |
1907 | 8.96M | break; |
1908 | | |
1909 | 41.3k | CASE_ENCODING_VSIB: |
1910 | | // VSIB can use the V2 bit so check only the other bits. |
1911 | 41.3k | if (needVVVV) |
1912 | 3.88k | needVVVV = hasVVVV & ((insn->vvvv & 0xf) != 0); |
1913 | | |
1914 | 41.3k | if (readModRM(insn)) |
1915 | 0 | return -1; |
1916 | | |
1917 | | // Reject if SIB wasn't used. |
1918 | 7.80k | if (insn->eaBase != EA_BASE_sib && insn->eaBase != EA_BASE_sib64) |
1919 | 20 | return -1; |
1920 | | |
1921 | | // If sibIndex was set to SIB_INDEX_NONE, index offset is 4. |
1922 | 7.78k | if (insn->sibIndex == SIB_INDEX_NONE) |
1923 | 670 | insn->sibIndex = (SIBIndex)(insn->sibIndexBase + 4); |
1924 | | |
1925 | | // If EVEX.v2 is set this is one of the 16-31 registers. |
1926 | 7.78k | if (insn->vectorExtensionType == TYPE_EVEX && insn->mode == MODE_64BIT && |
1927 | 7.78k | v2FromEVEX4of4(insn->vectorExtensionPrefix[3])) |
1928 | 1.95k | insn->sibIndex = (SIBIndex)(insn->sibIndex + 16); |
1929 | | |
1930 | | // Adjust the index register to the correct size. |
1931 | 7.78k | switch (op->type) { |
1932 | 0 | default: |
1933 | | // debug("Unhandled VSIB index type"); |
1934 | 0 | return -1; |
1935 | 2.77k | case TYPE_MVSIBX: |
1936 | 2.77k | insn->sibIndex = (SIBIndex)(SIB_INDEX_XMM0 + |
1937 | 2.77k | (insn->sibIndex - insn->sibIndexBase)); |
1938 | 2.77k | break; |
1939 | 3.14k | case TYPE_MVSIBY: |
1940 | 3.14k | insn->sibIndex = (SIBIndex)(SIB_INDEX_YMM0 + |
1941 | 3.14k | (insn->sibIndex - insn->sibIndexBase)); |
1942 | 3.14k | break; |
1943 | 1.86k | case TYPE_MVSIBZ: |
1944 | 1.86k | insn->sibIndex = (SIBIndex)(SIB_INDEX_ZMM0 + |
1945 | 1.86k | (insn->sibIndex - insn->sibIndexBase)); |
1946 | 1.86k | break; |
1947 | 7.78k | } |
1948 | | |
1949 | | // Apply the AVX512 compressed displacement scaling factor. |
1950 | 7.78k | if (op->encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) |
1951 | 2.11k | insn->displacement *= 1 << (op->encoding - ENCODING_VSIB); |
1952 | 7.78k | break; |
1953 | | |
1954 | 820k | case ENCODING_REG: |
1955 | 12.5M | CASE_ENCODING_RM: |
1956 | 12.5M | if (readModRM(insn)) |
1957 | 0 | return -1; |
1958 | | |
1959 | 1.83M | if (fixupReg(insn, op)) |
1960 | 64 | return -1; |
1961 | | |
1962 | | // Apply the AVX512 compressed displacement scaling factor. |
1963 | 1.83M | if (op->encoding != ENCODING_REG && insn->eaDisplacement == EA_DISP_8) |
1964 | 161k | insn->displacement *= 1 << (op->encoding - ENCODING_RM); |
1965 | 1.83M | break; |
1966 | | |
1967 | 378k | case ENCODING_IB: |
1968 | 378k | if (sawRegImm) { |
1969 | | /* Saw a register immediate so don't read again and instead split the |
1970 | | previous immediate. FIXME: This is a hack. */ |
1971 | 1.71k | insn->immediates[insn->numImmediatesConsumed] = |
1972 | 1.71k | insn->immediates[insn->numImmediatesConsumed - 1] & 0xf; |
1973 | 1.71k | ++insn->numImmediatesConsumed; |
1974 | 1.71k | break; |
1975 | 1.71k | } |
1976 | 376k | if (readImmediate(insn, 1)) |
1977 | 771 | return -1; |
1978 | 375k | if (op->type == TYPE_XMM || op->type == TYPE_YMM) |
1979 | 3.90k | sawRegImm = 1; |
1980 | 375k | break; |
1981 | | |
1982 | 25.2k | case ENCODING_IW: |
1983 | 25.2k | if (readImmediate(insn, 2)) |
1984 | 106 | return -1; |
1985 | 25.1k | break; |
1986 | | |
1987 | 25.1k | case ENCODING_ID: |
1988 | 8.72k | if (readImmediate(insn, 4)) |
1989 | 82 | return -1; |
1990 | 8.64k | break; |
1991 | | |
1992 | 8.64k | case ENCODING_IO: |
1993 | 742 | if (readImmediate(insn, 8)) |
1994 | 12 | return -1; |
1995 | 730 | break; |
1996 | | |
1997 | 90.1k | case ENCODING_Iv: |
1998 | 90.1k | if (readImmediate(insn, insn->immediateSize)) |
1999 | 646 | return -1; |
2000 | 89.5k | break; |
2001 | | |
2002 | 89.5k | case ENCODING_Ia: |
2003 | 21.2k | if (readImmediate(insn, insn->addressSize)) |
2004 | 228 | return -1; |
2005 | | /* Direct memory-offset (moffset) immediate will get mapped |
2006 | | to memory operand later. We want the encoding info to |
2007 | | reflect that as well. */ |
2008 | 21.0k | insn->displacementOffset = insn->immediateOffset; |
2009 | 21.0k | insn->consumedDisplacement = true; |
2010 | 21.0k | insn->displacementSize = insn->immediateSize; |
2011 | 21.0k | insn->displacement = insn->immediates[insn->numImmediatesConsumed - 1]; |
2012 | 21.0k | insn->immediateOffset = 0; |
2013 | 21.0k | insn->immediateSize = 0; |
2014 | 21.0k | break; |
2015 | | |
2016 | 4.41k | case ENCODING_IRC: |
2017 | 4.41k | insn->RC = (l2FromEVEX4of4(insn->vectorExtensionPrefix[3]) << 1) | |
2018 | 4.41k | lFromEVEX4of4(insn->vectorExtensionPrefix[3]); |
2019 | 4.41k | break; |
2020 | | |
2021 | 24.4k | case ENCODING_RB: |
2022 | 24.4k | if (readOpcodeRegister(insn, 1)) |
2023 | 0 | return -1; |
2024 | 24.4k | break; |
2025 | | |
2026 | 24.4k | case ENCODING_RW: |
2027 | 0 | if (readOpcodeRegister(insn, 2)) |
2028 | 0 | return -1; |
2029 | 0 | break; |
2030 | | |
2031 | 0 | case ENCODING_RD: |
2032 | 0 | if (readOpcodeRegister(insn, 4)) |
2033 | 0 | return -1; |
2034 | 0 | break; |
2035 | | |
2036 | 33.1k | case ENCODING_RO: |
2037 | 33.1k | if (readOpcodeRegister(insn, 8)) |
2038 | 0 | return -1; |
2039 | 33.1k | break; |
2040 | | |
2041 | 189k | case ENCODING_Rv: |
2042 | 189k | if (readOpcodeRegister(insn, 0)) |
2043 | 0 | return -1; |
2044 | 189k | break; |
2045 | | |
2046 | 189k | case ENCODING_FP: |
2047 | 9.79k | break; |
2048 | | |
2049 | 82.0k | case ENCODING_VVVV: |
2050 | 82.0k | if (!hasVVVV) |
2051 | 0 | return -1; |
2052 | | |
2053 | 82.0k | needVVVV = 0; /* Mark that we have found a VVVV operand. */ |
2054 | | |
2055 | 82.0k | if (insn->mode != MODE_64BIT) |
2056 | 58.7k | insn->vvvv = (Reg)(insn->vvvv & 0x7); |
2057 | | |
2058 | 82.0k | if (fixupReg(insn, op)) |
2059 | 2 | return -1; |
2060 | 82.0k | break; |
2061 | | |
2062 | 82.0k | case ENCODING_WRITEMASK: |
2063 | 62.2k | if (readMaskRegister(insn)) |
2064 | 0 | return -1; |
2065 | 62.2k | break; |
2066 | | |
2067 | 424k | case ENCODING_DUP: |
2068 | 424k | break; |
2069 | | |
2070 | 0 | default: |
2071 | | // dbgprintf(insn, "Encountered an operand with an unknown encoding."); |
2072 | 0 | return -1; |
2073 | 12.1M | } |
2074 | 12.1M | } |
2075 | | |
2076 | | /* If we didn't find ENCODING_VVVV operand, but non-zero vvvv present, fail */ |
2077 | 2.02M | if (needVVVV) |
2078 | 20 | return -1; |
2079 | | |
2080 | 2.02M | return 0; |
2081 | 2.02M | } |
2082 | | |
2083 | | // return True if instruction is illegal to use with prefixes |
2084 | | // This also check & fix the isPrefixNN when a prefix is irrelevant. |
2085 | | static bool checkPrefix(struct InternalInstruction *insn) |
2086 | 2.02M | { |
2087 | | // LOCK prefix |
2088 | 2.02M | if (insn->hasLockPrefix) { |
2089 | 51.4k | switch(insn->instructionID) { |
2090 | 338 | default: |
2091 | | // invalid LOCK |
2092 | 338 | return true; |
2093 | | |
2094 | | // nop dword [rax] |
2095 | 229 | case X86_NOOPL: |
2096 | | |
2097 | | // DEC |
2098 | 377 | case X86_DEC16m: |
2099 | 584 | case X86_DEC32m: |
2100 | 899 | case X86_DEC64m: |
2101 | 1.18k | case X86_DEC8m: |
2102 | | |
2103 | | // ADC |
2104 | 1.37k | case X86_ADC16mi: |
2105 | 1.79k | case X86_ADC16mi8: |
2106 | 2.11k | case X86_ADC16mr: |
2107 | 2.33k | case X86_ADC32mi: |
2108 | 2.50k | case X86_ADC32mi8: |
2109 | 2.78k | case X86_ADC32mr: |
2110 | 3.10k | case X86_ADC64mi32: |
2111 | 3.56k | case X86_ADC64mi8: |
2112 | 3.73k | case X86_ADC64mr: |
2113 | 3.85k | case X86_ADC8mi: |
2114 | 4.20k | case X86_ADC8mi8: |
2115 | 4.49k | case X86_ADC8mr: |
2116 | 4.86k | case X86_ADC8rm: |
2117 | 5.10k | case X86_ADC16rm: |
2118 | 5.33k | case X86_ADC32rm: |
2119 | 5.59k | case X86_ADC64rm: |
2120 | | |
2121 | | // ADD |
2122 | 5.77k | case X86_ADD16mi: |
2123 | 6.25k | case X86_ADD16mi8: |
2124 | 6.82k | case X86_ADD16mr: |
2125 | 7.13k | case X86_ADD32mi: |
2126 | 7.32k | case X86_ADD32mi8: |
2127 | 8.03k | case X86_ADD32mr: |
2128 | 8.24k | case X86_ADD64mi32: |
2129 | 8.46k | case X86_ADD64mi8: |
2130 | 8.87k | case X86_ADD64mr: |
2131 | 9.37k | case X86_ADD8mi: |
2132 | 9.54k | case X86_ADD8mi8: |
2133 | 11.0k | case X86_ADD8mr: |
2134 | 11.2k | case X86_ADD8rm: |
2135 | 11.8k | case X86_ADD16rm: |
2136 | 12.5k | case X86_ADD32rm: |
2137 | 13.2k | case X86_ADD64rm: |
2138 | | |
2139 | | // AND |
2140 | 13.4k | case X86_AND16mi: |
2141 | 13.7k | case X86_AND16mi8: |
2142 | 14.0k | case X86_AND16mr: |
2143 | 14.2k | case X86_AND32mi: |
2144 | 14.6k | case X86_AND32mi8: |
2145 | 14.9k | case X86_AND32mr: |
2146 | 15.0k | case X86_AND64mi32: |
2147 | 15.3k | case X86_AND64mi8: |
2148 | 15.4k | case X86_AND64mr: |
2149 | 16.2k | case X86_AND8mi: |
2150 | 16.6k | case X86_AND8mi8: |
2151 | 16.9k | case X86_AND8mr: |
2152 | 17.2k | case X86_AND8rm: |
2153 | 17.5k | case X86_AND16rm: |
2154 | 17.9k | case X86_AND32rm: |
2155 | 18.1k | case X86_AND64rm: |
2156 | | |
2157 | | // BTC |
2158 | 18.2k | case X86_BTC16mi8: |
2159 | 18.3k | case X86_BTC16mr: |
2160 | 18.4k | case X86_BTC32mi8: |
2161 | 18.7k | case X86_BTC32mr: |
2162 | 18.8k | case X86_BTC64mi8: |
2163 | 19.1k | case X86_BTC64mr: |
2164 | | |
2165 | | // BTR |
2166 | 19.3k | case X86_BTR16mi8: |
2167 | 19.5k | case X86_BTR16mr: |
2168 | 19.6k | case X86_BTR32mi8: |
2169 | 20.0k | case X86_BTR32mr: |
2170 | 20.2k | case X86_BTR64mi8: |
2171 | 20.3k | case X86_BTR64mr: |
2172 | | |
2173 | | // BTS |
2174 | 20.8k | case X86_BTS16mi8: |
2175 | 21.2k | case X86_BTS16mr: |
2176 | 21.6k | case X86_BTS32mi8: |
2177 | 21.9k | case X86_BTS32mr: |
2178 | 22.0k | case X86_BTS64mi8: |
2179 | 22.3k | case X86_BTS64mr: |
2180 | | |
2181 | | // CMPXCHG |
2182 | 22.7k | case X86_CMPXCHG16B: |
2183 | 22.8k | case X86_CMPXCHG16rm: |
2184 | 23.1k | case X86_CMPXCHG32rm: |
2185 | 23.1k | case X86_CMPXCHG64rm: |
2186 | 23.3k | case X86_CMPXCHG8rm: |
2187 | 23.4k | case X86_CMPXCHG8B: |
2188 | | |
2189 | | // INC |
2190 | 24.1k | case X86_INC16m: |
2191 | 24.7k | case X86_INC32m: |
2192 | 25.0k | case X86_INC64m: |
2193 | 25.4k | case X86_INC8m: |
2194 | | |
2195 | | // NEG |
2196 | 25.6k | case X86_NEG16m: |
2197 | 25.8k | case X86_NEG32m: |
2198 | 26.0k | case X86_NEG64m: |
2199 | 26.1k | case X86_NEG8m: |
2200 | | |
2201 | | // NOT |
2202 | 26.5k | case X86_NOT16m: |
2203 | 26.9k | case X86_NOT32m: |
2204 | 27.1k | case X86_NOT64m: |
2205 | 27.3k | case X86_NOT8m: |
2206 | | |
2207 | | // OR |
2208 | 27.5k | case X86_OR16mi: |
2209 | 27.8k | case X86_OR16mi8: |
2210 | 28.6k | case X86_OR16mr: |
2211 | 29.0k | case X86_OR32mi: |
2212 | 29.4k | case X86_OR32mi8: |
2213 | 30.1k | case X86_OR32mr: |
2214 | 30.6k | case X86_OR64mi32: |
2215 | 31.0k | case X86_OR64mi8: |
2216 | 31.2k | case X86_OR64mr: |
2217 | 31.3k | case X86_OR8mi8: |
2218 | 31.6k | case X86_OR8mi: |
2219 | 31.8k | case X86_OR8mr: |
2220 | 32.4k | case X86_OR8rm: |
2221 | 32.8k | case X86_OR16rm: |
2222 | 33.3k | case X86_OR32rm: |
2223 | 33.6k | case X86_OR64rm: |
2224 | | |
2225 | | // SBB |
2226 | 33.9k | case X86_SBB16mi: |
2227 | 35.1k | case X86_SBB16mi8: |
2228 | 35.5k | case X86_SBB16mr: |
2229 | 36.1k | case X86_SBB32mi: |
2230 | 36.6k | case X86_SBB32mi8: |
2231 | 37.0k | case X86_SBB32mr: |
2232 | 37.3k | case X86_SBB64mi32: |
2233 | 37.9k | case X86_SBB64mi8: |
2234 | 38.0k | case X86_SBB64mr: |
2235 | 38.4k | case X86_SBB8mi: |
2236 | 38.6k | case X86_SBB8mi8: |
2237 | 38.9k | case X86_SBB8mr: |
2238 | | |
2239 | | // SUB |
2240 | 39.3k | case X86_SUB16mi: |
2241 | 39.7k | case X86_SUB16mi8: |
2242 | 39.9k | case X86_SUB16mr: |
2243 | 40.4k | case X86_SUB32mi: |
2244 | 40.7k | case X86_SUB32mi8: |
2245 | 40.9k | case X86_SUB32mr: |
2246 | 41.2k | case X86_SUB64mi32: |
2247 | 41.5k | case X86_SUB64mi8: |
2248 | 41.8k | case X86_SUB64mr: |
2249 | 42.0k | case X86_SUB8mi8: |
2250 | 42.1k | case X86_SUB8mi: |
2251 | 42.3k | case X86_SUB8mr: |
2252 | 42.6k | case X86_SUB8rm: |
2253 | 42.9k | case X86_SUB16rm: |
2254 | 43.4k | case X86_SUB32rm: |
2255 | 43.5k | case X86_SUB64rm: |
2256 | | |
2257 | | // XADD |
2258 | 43.6k | case X86_XADD16rm: |
2259 | 43.8k | case X86_XADD32rm: |
2260 | 44.1k | case X86_XADD64rm: |
2261 | 44.3k | case X86_XADD8rm: |
2262 | | |
2263 | | // XCHG |
2264 | 44.4k | case X86_XCHG16rm: |
2265 | 44.7k | case X86_XCHG32rm: |
2266 | 44.9k | case X86_XCHG64rm: |
2267 | 45.2k | case X86_XCHG8rm: |
2268 | | |
2269 | | // XOR |
2270 | 45.4k | case X86_XOR16mi: |
2271 | 45.8k | case X86_XOR16mi8: |
2272 | 46.2k | case X86_XOR16mr: |
2273 | 46.6k | case X86_XOR32mi: |
2274 | 46.9k | case X86_XOR32mi8: |
2275 | 47.3k | case X86_XOR32mr: |
2276 | 47.8k | case X86_XOR64mi32: |
2277 | 48.0k | case X86_XOR64mi8: |
2278 | 48.3k | case X86_XOR64mr: |
2279 | 48.6k | case X86_XOR8mi8: |
2280 | 49.0k | case X86_XOR8mi: |
2281 | 49.8k | case X86_XOR8mr: |
2282 | 50.1k | case X86_XOR8rm: |
2283 | 50.4k | case X86_XOR16rm: |
2284 | 50.8k | case X86_XOR32rm: |
2285 | 51.1k | case X86_XOR64rm: |
2286 | | |
2287 | | // this instruction can be used with LOCK prefix |
2288 | 51.1k | return false; |
2289 | 51.4k | } |
2290 | 51.4k | } |
2291 | | |
2292 | | #if 0 |
2293 | | // REPNE prefix |
2294 | | if (insn->repeatPrefix) { |
2295 | | // 0xf2 can be a part of instruction encoding, but not really a prefix. |
2296 | | // In such a case, clear it. |
2297 | | if (insn->twoByteEscape == 0x0f) { |
2298 | | insn->prefix0 = 0; |
2299 | | } |
2300 | | } |
2301 | | #endif |
2302 | | |
2303 | | // no invalid prefixes |
2304 | 1.97M | return false; |
2305 | 2.02M | } |
2306 | | |
2307 | | /* |
2308 | | * decodeInstruction - Reads and interprets a full instruction provided by the |
2309 | | * user. |
2310 | | * |
2311 | | * @param insn - A pointer to the instruction to be populated. Must be |
2312 | | * pre-allocated. |
2313 | | * @param reader - The function to be used to read the instruction's bytes. |
2314 | | * @param readerArg - A generic argument to be passed to the reader to store |
2315 | | * any internal state. |
2316 | | * @param startLoc - The address (in the reader's address space) of the first |
2317 | | * byte in the instruction. |
2318 | | * @param mode - The mode (real mode, IA-32e, or IA-32e in 64-bit mode) to |
2319 | | * decode the instruction in. |
2320 | | * @return - 0 if instruction is valid; nonzero if not. |
2321 | | */ |
2322 | | int decodeInstruction(struct InternalInstruction *insn, |
2323 | | byteReader_t reader, |
2324 | | const void *readerArg, |
2325 | | uint64_t startLoc, |
2326 | | DisassemblerMode mode) |
2327 | 2.03M | { |
2328 | 2.03M | insn->reader = reader; |
2329 | 2.03M | insn->readerArg = readerArg; |
2330 | 2.03M | insn->startLocation = startLoc; |
2331 | 2.03M | insn->readerCursor = startLoc; |
2332 | 2.03M | insn->mode = mode; |
2333 | 2.03M | insn->numImmediatesConsumed = 0; |
2334 | | |
2335 | 2.03M | if (readPrefixes(insn) || |
2336 | 2.03M | readOpcode(insn) || |
2337 | 2.03M | getID(insn) || |
2338 | 2.03M | insn->instructionID == 0 || |
2339 | 2.03M | checkPrefix(insn) || |
2340 | 2.03M | readOperands(insn)) |
2341 | 9.44k | return -1; |
2342 | | |
2343 | 2.02M | insn->length = (size_t)(insn->readerCursor - insn->startLocation); |
2344 | | |
2345 | | // instruction length must be <= 15 to be valid |
2346 | 2.02M | if (insn->length > 15) |
2347 | 83 | return -1; |
2348 | | |
2349 | 2.02M | if (insn->operandSize == 0) |
2350 | 2.02M | insn->operandSize = insn->registerSize; |
2351 | | |
2352 | 2.02M | insn->operands = &x86OperandSets[insn->spec->operands][0]; |
2353 | | |
2354 | 2.02M | return 0; |
2355 | 2.02M | } |
2356 | | |
2357 | | #endif |
2358 | | |