2016-11-26 20:08:37 +08:00
|
|
|
/***************************************************************************************************
|
|
|
|
|
2016-12-05 09:24:01 +08:00
|
|
|
Zyan Disassembler Library (Zydis)
|
2016-11-26 20:08:37 +08:00
|
|
|
|
|
|
|
Original Author : Florian Bernd
|
|
|
|
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
|
|
* in the Software without restriction, including without limitation the rights
|
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
|
|
* furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice shall be included in all
|
|
|
|
* copies or substantial portions of the Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
|
|
* SOFTWARE.
|
|
|
|
|
|
|
|
***************************************************************************************************/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @file
|
|
|
|
* @brief Demonstrates the hooking functionality of the @c ZydisInstructionFormatter class.
|
|
|
|
*
|
|
|
|
* This example demonstrates the hooking functionality of the @c ZydisInstructionFormatter class by
|
|
|
|
* rewriting the mnemonics of (V)CMPPS and (V)CMPPD to their corresponding alias-forms (based on
|
|
|
|
* the condition encoded in the immediate operand).
|
|
|
|
*/
|
|
|
|
|
2016-11-29 08:27:39 +08:00
|
|
|
#include <inttypes.h>
|
2016-11-26 20:08:37 +08:00
|
|
|
#include <Zydis/Zydis.h>
|
|
|
|
#include "FormatHelper.h"
|
2017-01-13 03:14:12 +08:00
|
|
|
#include <stdlib.h>
|
2016-11-26 20:08:37 +08:00
|
|
|
|
|
|
|
/* ============================================================================================== */
|
|
|
|
/* Static data */
|
|
|
|
/* ============================================================================================== */
|
|
|
|
|
|
|
|
/**
|
|
|
|
* @brief Static array with the condition-code strings.
|
|
|
|
*/
|
|
|
|
static const char* conditionCodeStrings[0x20] =
|
|
|
|
{
|
2017-01-13 03:14:12 +08:00
|
|
|
/*00*/ "eq",
|
|
|
|
/*01*/ "lt",
|
|
|
|
/*02*/ "le",
|
|
|
|
/*03*/ "unord",
|
|
|
|
/*04*/ "neq",
|
|
|
|
/*05*/ "nlt",
|
|
|
|
/*06*/ "nle",
|
|
|
|
/*07*/ "ord",
|
|
|
|
/*08*/ "eq_uq",
|
|
|
|
/*09*/ "nge",
|
|
|
|
/*0A*/ "ngt",
|
|
|
|
/*0B*/ "false",
|
|
|
|
/*0C*/ "oq",
|
|
|
|
/*0D*/ "ge",
|
|
|
|
/*0E*/ "gt",
|
|
|
|
/*0F*/ "true",
|
|
|
|
/*10*/ "eq_os",
|
|
|
|
/*11*/ "lt_oq",
|
|
|
|
/*12*/ "le_oq",
|
|
|
|
/*13*/ "unord_s",
|
|
|
|
/*14*/ "neq_us",
|
|
|
|
/*15*/ "nlt_uq",
|
|
|
|
/*16*/ "nle_uq",
|
|
|
|
/*17*/ "ord_s",
|
|
|
|
/*18*/ "eq_us",
|
|
|
|
/*19*/ "nge_uq",
|
|
|
|
/*1A*/ "ngt_uq",
|
|
|
|
/*1B*/ "false_os",
|
|
|
|
/*1C*/ "neq_os",
|
|
|
|
/*1D*/ "ge_oq",
|
|
|
|
/*1E*/ "gt_oq",
|
|
|
|
/*1F*/ "true_us"
|
2016-11-26 20:08:37 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
/* ============================================================================================== */
|
|
|
|
/* Hook callbacks */
|
|
|
|
/* ============================================================================================== */
|
|
|
|
|
|
|
|
ZydisFormatterFormatFunc defaultPrintMnemonic;
|
|
|
|
|
2017-07-03 09:58:25 +08:00
|
|
|
static ZydisStatus ZydisFormatterPrintMnemonic(const ZydisInstructionFormatter* formatter,
|
|
|
|
char** buffer, size_t bufferLen, ZydisDecodedInstruction* instruction)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
// We use the user-data field of the instruction-info to pass data to the
|
|
|
|
// @c ZydisFormatterFormatOperandImm function.
|
|
|
|
// In this case we are using a simple ordinal value, but you could pass a pointer to a
|
|
|
|
// complex datatype as well.
|
2017-07-03 09:58:25 +08:00
|
|
|
instruction->userData = (void*)1;
|
2016-11-26 20:08:37 +08:00
|
|
|
|
|
|
|
// Rewrite the instruction-mnemonic for the given instructions
|
2017-07-03 09:58:25 +08:00
|
|
|
if (instruction->operands[instruction->operandCount - 1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE)
|
|
|
|
{
|
|
|
|
uint8_t conditionCode =
|
|
|
|
(uint8_t)instruction->operands[instruction->operandCount - 1].imm.value.u;
|
|
|
|
switch (instruction->mnemonic)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
2017-07-03 09:58:25 +08:00
|
|
|
case ZYDIS_MNEMONIC_CMPPS:
|
|
|
|
if (conditionCode < 0x08)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
return ZydisStringBufferAppendFormat(buffer, bufferLen,
|
|
|
|
ZYDIS_STRBUF_APPEND_MODE_DEFAULT, "cmp%sps",
|
|
|
|
conditionCodeStrings[conditionCode]);
|
2017-07-03 09:58:25 +08:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case ZYDIS_MNEMONIC_CMPPD:
|
|
|
|
if (conditionCode < 0x08)
|
|
|
|
{
|
2016-11-26 20:08:37 +08:00
|
|
|
return ZydisStringBufferAppendFormat(buffer, bufferLen,
|
|
|
|
ZYDIS_STRBUF_APPEND_MODE_DEFAULT, "cmp%spd",
|
|
|
|
conditionCodeStrings[conditionCode]);
|
|
|
|
}
|
2017-07-03 09:58:25 +08:00
|
|
|
break;
|
|
|
|
case ZYDIS_MNEMONIC_VCMPPS:
|
|
|
|
if (conditionCode < 0x20)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
return ZydisStringBufferAppendFormat(buffer, bufferLen,
|
|
|
|
ZYDIS_STRBUF_APPEND_MODE_DEFAULT, "vcmp%sps",
|
|
|
|
conditionCodeStrings[conditionCode]);
|
2017-07-03 09:58:25 +08:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
case ZYDIS_MNEMONIC_VCMPPD:
|
|
|
|
if (conditionCode < 0x20)
|
|
|
|
{
|
2016-11-26 20:08:37 +08:00
|
|
|
return ZydisStringBufferAppendFormat(buffer, bufferLen,
|
|
|
|
ZYDIS_STRBUF_APPEND_MODE_DEFAULT, "vcmp%spd",
|
|
|
|
conditionCodeStrings[conditionCode]);
|
|
|
|
}
|
2017-07-03 09:58:25 +08:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
2016-11-26 20:08:37 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// We did not rewrite the instruction-mnemonic. Signal the @c ZydisFormatterFormatOperandImm
|
|
|
|
// function not to omit the operand
|
2017-07-03 09:58:25 +08:00
|
|
|
instruction->userData = (void*)0;
|
2016-11-26 20:08:37 +08:00
|
|
|
|
|
|
|
// Default mnemonic printing
|
2017-07-03 09:58:25 +08:00
|
|
|
return defaultPrintMnemonic(formatter, buffer, bufferLen, instruction);
|
2016-11-26 20:08:37 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* ---------------------------------------------------------------------------------------------- */
|
|
|
|
|
|
|
|
ZydisFormatterFormatOperandFunc defaultFormatOperandImm;
|
|
|
|
|
2017-07-03 09:58:25 +08:00
|
|
|
static ZydisStatus ZydisFormatterFormatOperandImm(const ZydisInstructionFormatter* formatter,
|
|
|
|
char** buffer, size_t bufferLen, ZydisDecodedInstruction* instruction,
|
|
|
|
ZydisDecodedOperand* operand)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
// The @c ZydisFormatterFormatMnemonic sinals us to omit the immediate (condition-code)
|
|
|
|
// operand, because it got replaced by the alias-mnemonic
|
2017-07-03 09:58:25 +08:00
|
|
|
if ((uintptr_t)instruction->userData == 1)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
// The formatter will automatically omit the operand, if the buffer remains unchanged
|
|
|
|
// after the callback returns
|
|
|
|
return ZYDIS_STATUS_SUCCESS;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Default immediate formatting
|
2017-07-03 09:58:25 +08:00
|
|
|
return defaultFormatOperandImm(formatter, buffer, bufferLen, instruction, operand);
|
2016-11-26 20:08:37 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
/* ---------------------------------------------------------------------------------------------- */
|
|
|
|
|
|
|
|
/* ============================================================================================== */
|
|
|
|
/* Helper functions */
|
|
|
|
/* ============================================================================================== */
|
|
|
|
|
2017-06-13 01:16:01 +08:00
|
|
|
void disassembleBuffer(ZydisInstructionDecoder* decoder, uint8_t* data, size_t length,
|
|
|
|
ZydisBool installHooks)
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
|
|
|
ZydisInstructionFormatter formatter;
|
|
|
|
ZydisFormatterInitInstructionFormatterEx(&formatter, ZYDIS_FORMATTER_STYLE_INTEL,
|
|
|
|
ZYDIS_FMTFLAG_FORCE_SEGMENTS | ZYDIS_FMTFLAG_FORCE_OPERANDSIZE,
|
|
|
|
ZYDIS_FORMATTER_ADDR_ABSOLUTE, ZYDIS_FORMATTER_DISP_DEFAULT, ZYDIS_FORMATTER_IMM_DEFAULT);
|
|
|
|
|
|
|
|
if (installHooks)
|
|
|
|
{
|
|
|
|
defaultPrintMnemonic = &ZydisFormatterPrintMnemonic;
|
|
|
|
ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_HOOK_PRINT_MNEMONIC,
|
|
|
|
(const void**)&defaultPrintMnemonic);
|
|
|
|
defaultFormatOperandImm = &ZydisFormatterFormatOperandImm;
|
|
|
|
ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_IMM,
|
|
|
|
(const void**)&defaultFormatOperandImm);
|
|
|
|
}
|
2017-01-13 03:14:12 +08:00
|
|
|
|
|
|
|
uint64_t instructionPointer = 0x007FFFFFFF400000;
|
|
|
|
|
2017-07-03 09:58:25 +08:00
|
|
|
ZydisDecodedInstruction instruction;
|
2016-11-26 20:08:37 +08:00
|
|
|
char buffer[256];
|
2017-01-13 03:14:12 +08:00
|
|
|
while (ZYDIS_SUCCESS(
|
2017-07-03 09:58:25 +08:00
|
|
|
ZydisDecoderDecodeBuffer(decoder, data, length, instructionPointer, &instruction)))
|
2016-11-26 20:08:37 +08:00
|
|
|
{
|
2017-07-03 09:58:25 +08:00
|
|
|
data += instruction.length;
|
|
|
|
length -= instruction.length;
|
|
|
|
instructionPointer += instruction.length;
|
|
|
|
printf("%016" PRIX64 " ", instruction.instrAddress);
|
|
|
|
ZydisFormatterFormatInstruction(&formatter, &instruction, &buffer[0], sizeof(buffer));
|
2016-11-26 20:08:37 +08:00
|
|
|
printf(" %s\n", &buffer[0]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* ============================================================================================== */
|
|
|
|
/* Entry point */
|
|
|
|
/* ============================================================================================== */
|
|
|
|
|
|
|
|
int main()
|
|
|
|
{
|
|
|
|
uint8_t data[] =
|
|
|
|
{
|
|
|
|
// cmpps xmm1, xmm4, 0x03
|
|
|
|
0x0F, 0xC2, 0xCC, 0x03,
|
|
|
|
|
2017-06-13 01:16:01 +08:00
|
|
|
// vcmppd xmm1, xmm2, xmm3, 0x17
|
2016-11-26 20:08:37 +08:00
|
|
|
0xC5, 0xE9, 0xC2, 0xCB, 0x17,
|
|
|
|
|
2017-07-03 09:58:25 +08:00
|
|
|
// vcmpps k2 {k7}, zmm2, zmmword ptr ds:[rax + rbx*4 + 0x100] {1to16}, 0x0F
|
2016-11-26 20:08:37 +08:00
|
|
|
0x62, 0xF1, 0x6C, 0x5F, 0xC2, 0x54, 0x98, 0x40, 0x0F
|
|
|
|
};
|
|
|
|
|
2017-07-03 09:58:25 +08:00
|
|
|
|
2017-06-13 01:16:01 +08:00
|
|
|
ZydisInstructionDecoder decoder;
|
|
|
|
ZydisDecoderInitInstructionDecoder(
|
2017-07-03 09:58:25 +08:00
|
|
|
&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64);
|
2017-06-13 01:16:01 +08:00
|
|
|
|
|
|
|
disassembleBuffer(&decoder, &data[0], sizeof(data), ZYDIS_FALSE);
|
2016-11-26 20:08:37 +08:00
|
|
|
puts("");
|
2017-06-13 01:16:01 +08:00
|
|
|
disassembleBuffer(&decoder, &data[0], sizeof(data), ZYDIS_TRUE);
|
2016-11-26 20:08:37 +08:00
|
|
|
|
|
|
|
getchar();
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* ============================================================================================== */
|