int length = 0;
- PrintDebug("Decoding Instruction at %p\n", (void *)instr_ptr);
+ PrintDebug(core->vm_info, core, "Decoding Instruction at %p\n", (void *)instr_ptr);
memset(instr, 0, sizeof(struct x86_instr));
form = op_code_to_form((uint8_t *)(instr_ptr + length), &length);
- PrintDebug("\t decoded as (%s)\n", op_form_to_str(form));
+ PrintDebug(core->vm_info, core, "\t decoded as (%s)\n", op_form_to_str(form));
if (form == INVALID_INSTR) {
- PrintError("Could not find instruction form (%x)\n", *(uint32_t *)(instr_ptr + length));
+ PrintError(core->vm_info, core, "Could not find instruction form (%x)\n", *(uint32_t *)(instr_ptr + length));
return -1;
}
ret = parse_operands(core, (uint8_t *)(instr_ptr + length), instr, form);
if (ret == -1) {
- PrintError("Could not parse instruction operands\n");
+ PrintError(core->vm_info, core, "Could not parse instruction operands\n");
return -1;
}
length += ret;
instr->instr_length += length;
#ifdef V3_CONFIG_DEBUG_DECODER
+ V3_Print(core->vm_info, core, "Decoding Instr at %p\n", (void *)core->rip);
v3_print_instr(instr);
+ V3_Print(core->vm_info, core, "CS DB FLag=%x\n", core->segments.cs.db);
#endif
return 0;
uint8_t * instr_start = instr_ptr;
- PrintDebug("\tOperand width=%d, Addr width=%d\n", operand_width, addr_width);
+ PrintDebug(core->vm_info, core, "\tOperand width=%d, Addr width=%d\n", operand_width, addr_width);
switch (form) {
case ADC_IMM2_8:
case AND_IMM2:
case OR_IMM2:
case SUB_IMM2:
- case XOR_IMM2:
- case MOV_IMM2:{
+ case XOR_IMM2:
+ case MOV_IMM2: {
uint8_t reg_code = 0;
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->dst_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
instr->src_operand.operand = *(uint16_t *)instr_ptr;
} else if (operand_width == 4) {
instr->src_operand.operand = *(uint32_t *)instr_ptr;
+ } else if (operand_width == 8) {
+ instr->src_operand.operand = *(sint32_t *)instr_ptr; // This is a special case for sign extended 64bit ops
} else {
- PrintError("Illegal operand width (%d)\n", operand_width);
+ PrintError(core->vm_info, core, "Illegal operand width (%d)\n", operand_width);
return -1;
}
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->dst_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->src_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
break;
}
+ case MOV_MEM2AL_8:
+ case MOV_MEM2AX: {
+
+ /* Use AX for destination operand */
+ instr->dst_operand.size = operand_width;
+ instr->dst_operand.type = REG_OPERAND;
+ instr->dst_operand.operand = (addr_t)&(core->vm_regs.rax);
+ instr->dst_operand.write = 1;
+
+ /* Get the correct offset -- (seg + offset) */
+ struct v3_segment * src_reg = get_instr_segment(core, instr);
+ addr_t offset = 0;
+
+ if (addr_width == 2) {
+ offset = *(uint16_t *)instr_ptr;
+ } else if (addr_width == 4) {
+ offset = *(uint32_t *)instr_ptr;
+ } else if (addr_width == 8) {
+ offset = *(uint64_t *)instr_ptr;
+ } else {
+ PrintError(core->vm_info, core, "illegal address width for %s (width=%d)\n",
+ op_form_to_str(form), addr_width);
+ return -1;
+ }
+
+ instr->src_operand.operand = ADDR_MASK(get_addr_linear(core, offset, src_reg),
+ get_addr_width(core, instr));
+
+ instr->src_operand.read = 1;
+ instr->src_operand.type = MEM_OPERAND;
+ instr->src_operand.size = addr_width;
+
+ instr_ptr += addr_width;
+ instr->num_operands = 2;
+
+ break;
+ }
+ case MOV_AL2MEM_8:
+ case MOV_AX2MEM: {
+
+ /* Use AX for src operand */
+ instr->src_operand.size = operand_width;
+ instr->src_operand.type = REG_OPERAND;
+ instr->src_operand.operand = (addr_t)&(core->vm_regs.rax);
+ instr->src_operand.write = 1;
+
+ /* Get the correct offset -- (seg + offset) */
+ struct v3_segment * dst_reg = get_instr_segment(core, instr);
+ addr_t offset = 0;
+
+ if (addr_width == 2) {
+ offset = *(uint16_t *)instr_ptr;
+ } else if (addr_width == 4) {
+ offset = *(uint32_t *)instr_ptr;
+ } else if (addr_width == 8) {
+ offset = *(uint64_t *)instr_ptr;
+ } else {
+ PrintError(core->vm_info, core, "illegal address width for %s (width=%d)\n",
+ op_form_to_str(form), addr_width);
+ return -1;
+ }
+
+ instr->dst_operand.operand = ADDR_MASK(get_addr_linear(core, offset, dst_reg),
+ get_addr_width(core, instr));
+
+ instr->dst_operand.read = 1;
+ instr->dst_operand.type = MEM_OPERAND;
+ instr->dst_operand.size = addr_width;
+
+ instr_ptr += addr_width;
+ instr->num_operands = 2;
+
+ break;
+ }
case MOVSX_8:
case MOVZX_8: {
uint8_t reg_code = 0;
instr->src_operand.size = 1;
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
instr->src_operand.size = 2;
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->dst_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand\n");
+ PrintError(core->vm_info, core, "Error decoding operand\n");
return -1;
}
instr->is_str_op = 1;
if (instr->prefixes.rep == 1) {
- instr->str_op_length = MASK(core->vm_regs.rcx, operand_width);
+ instr->str_op_length = MASK(core->vm_regs.rcx, addr_width);
} else {
instr->str_op_length = 1;
}
®_code);
if (ret == -1) {
- PrintError("Error decoding operand for (%s)\n", op_form_to_str(form));
+ PrintError(core->vm_info, core, "Error decoding operand for (%s)\n", op_form_to_str(form));
return -1;
}
®_code);
if (ret == -1) {
- PrintError("Error decoding operand for (%s)\n", op_form_to_str(form));
+ PrintError(core->vm_info, core, "Error decoding operand for (%s)\n", op_form_to_str(form));
return -1;
}
instr->is_str_op = 1;
if (instr->prefixes.rep == 1) {
- instr->str_op_length = MASK(core->vm_regs.rcx, operand_width);
+ instr->str_op_length = MASK(core->vm_regs.rcx, addr_width);
} else {
instr->str_op_length = 1;
}
break;
}
+ case INT: {
+ instr->dst_operand.type = IMM_OPERAND;
+ instr->dst_operand.size = operand_width;
+ instr->dst_operand.operand = *(uint8_t *)instr_ptr;
+ instr_ptr += operand_width;
+ instr->num_operands = 1;
+
+ break;
+ }
case INVLPG: {
uint8_t reg_code = 0;
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->dst_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand for (%s)\n", op_form_to_str(form));
+ PrintError(core->vm_info, core, "Error decoding operand for (%s)\n", op_form_to_str(form));
return -1;
}
ret = decode_rm_operand(core, instr_ptr, form, instr, &(instr->dst_operand), ®_code);
if (ret == -1) {
- PrintError("Error decoding operand for (%s)\n", op_form_to_str(form));
+ PrintError(core->vm_info, core, "Error decoding operand for (%s)\n", op_form_to_str(form));
return -1;
}
break;
}
default:
- PrintError("Invalid Instruction form: %s\n", op_form_to_str(form));
+ PrintError(core->vm_info, core, "Invalid Instruction form: %s\n", op_form_to_str(form));
return -1;
}
case INVLPG:
return V3_OP_INVLPG;
+ case INT:
+ return V3_OP_INT;
+
case MOV_CR2:
return V3_OP_MOVCR2;
case MOV_2CR:
return V3_OP_MOV2CR;
-
case MOV_MEM2_8:
case MOV_MEM2:
case MOV_2MEM_8: