mirror of https://github.com/x64dbg/zydis
436 lines
14 KiB
C
436 lines
14 KiB
C
|
/***************************************************************************************************
|
||
|
|
||
|
Zyan Disassembler Engine (Zydis)
|
||
|
|
||
|
Original Author : Florian Bernd
|
||
|
|
||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||
|
* of this software and associated documentation files (the "Software"), to deal
|
||
|
* in the Software without restriction, including without limitation the rights
|
||
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||
|
* copies of the Software, and to permit persons to whom the Software is
|
||
|
* furnished to do so, subject to the following conditions:
|
||
|
*
|
||
|
* The above copyright notice and this permission notice shall be included in all
|
||
|
* copies or substantial portions of the Software.
|
||
|
*
|
||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||
|
* SOFTWARE.
|
||
|
|
||
|
***************************************************************************************************/
|
||
|
|
||
|
#include <stddef.h>
|
||
|
#include <stdbool.h>
|
||
|
#include <Zydis/Register.h>
|
||
|
|
||
|
/* ============================================================================================== */
|
||
|
/* Register strings */
|
||
|
/* ============================================================================================== */
|
||
|
|
||
|
const char* registerStrings[] =
|
||
|
{
|
||
|
"none",
|
||
|
// General purpose registers 64-bit
|
||
|
"rax", "rcx", "rdx", "rbx",
|
||
|
"rsp", "rbp", "rsi", "rdi",
|
||
|
"r8", "r9", "r10", "r11",
|
||
|
"r12", "r13", "r14", "r15",
|
||
|
// General purpose registers 32-bit
|
||
|
"eax", "ecx", "edx", "ebx",
|
||
|
"esp", "ebp", "esi", "edi",
|
||
|
"r8d", "r9d", "r10d", "r11d",
|
||
|
"r12d", "r13d", "r14d", "r15d",
|
||
|
// General purpose registers 16-bit
|
||
|
"ax", "cx", "dx", "bx",
|
||
|
"sp", "bp", "si", "di",
|
||
|
"r8w", "r9w", "r10w", "r11w",
|
||
|
"r12w", "r13w", "r14w", "r15w",
|
||
|
// General purpose registers 8-bit
|
||
|
"al", "cl", "dl", "bl",
|
||
|
"ah", "ch", "dh", "bh",
|
||
|
"spl", "bpl", "sil", "dil",
|
||
|
"r8b", "r9b", "r10b", "r11b",
|
||
|
"r12b", "r13b", "r14b", "r15b",
|
||
|
// Floating point legacy registers
|
||
|
"st0", "st1", "st2", "st3",
|
||
|
"st4", "st5", "st6", "st7",
|
||
|
// Floating point multimedia registers
|
||
|
"mm0", "mm1", "mm2", "mm3",
|
||
|
"mm4", "mm5", "mm6", "mm7",
|
||
|
// Floating point vector registers 512-bit
|
||
|
"zmm0", "zmm1", "zmm2", "zmm3",
|
||
|
"zmm4", "zmm5", "zmm6", "zmm7",
|
||
|
"zmm8", "zmm9", "zmm10", "zmm11",
|
||
|
"zmm12", "zmm13", "zmm14", "zmm15",
|
||
|
"zmm16", "zmm17", "zmm18", "zmm19",
|
||
|
"zmm20", "zmm21", "zmm22", "zmm23",
|
||
|
"zmm24", "zmm25", "zmm26", "zmm27",
|
||
|
"zmm28", "zmm29", "zmm30", "zmm31",
|
||
|
// Floating point vector registers 256-bit
|
||
|
"ymm0", "ymm1", "ymm2", "ymm3",
|
||
|
"ymm4", "ymm5", "ymm6", "ymm7",
|
||
|
"ymm8", "ymm9", "ymm10", "ymm11",
|
||
|
"ymm12", "ymm13", "ymm14", "ymm15",
|
||
|
"ymm16", "ymm17", "ymm18", "ymm19",
|
||
|
"ymm20", "ymm21", "ymm22", "ymm23",
|
||
|
"ymm24", "ymm25", "ymm26", "ymm27",
|
||
|
"ymm28", "ymm29", "ymm30", "ymm31",
|
||
|
// Floating point vector registers 128-bit
|
||
|
"xmm0", "xmm1", "xmm2", "xmm3",
|
||
|
"xmm4", "xmm5", "xmm6", "xmm7",
|
||
|
"xmm8", "xmm9", "xmm10", "xmm11",
|
||
|
"xmm12", "xmm13", "xmm14", "xmm15",
|
||
|
"xmm16", "xmm17", "xmm18", "xmm19",
|
||
|
"xmm20", "xmm21", "xmm22", "xmm23",
|
||
|
"xmm24", "xmm25", "xmm26", "xmm27",
|
||
|
"xmm28", "xmm29", "xmm30", "xmm31",
|
||
|
// Special registers
|
||
|
"rflags", "eflags", "flags", "rip",
|
||
|
"eip", "ip",
|
||
|
// Segment registers
|
||
|
"es", "ss", "cs", "ds",
|
||
|
"fs", "gs",
|
||
|
// Control registers
|
||
|
"cr0", "cr1", "cr2", "cr3",
|
||
|
"cr4", "cr5", "cr6", "cr7",
|
||
|
"cr8", "cr9", "cr10", "cr11",
|
||
|
"cr12", "cr13", "cr14", "cr15",
|
||
|
// Debug registers
|
||
|
"dr0", "dr1", "dr2", "dr3",
|
||
|
"dr4", "dr5", "dr6", "dr7",
|
||
|
"dr8", "dr9", "dr10", "dr11",
|
||
|
"dr12", "dr13", "dr14", "dr15",
|
||
|
// Mask registers
|
||
|
"k0", "k1", "k2", "k3",
|
||
|
"k4", "k5", "k6", "k7",
|
||
|
// Bounds registers
|
||
|
"bnd0", "bnd1", "bnd2", "bnd3"
|
||
|
};
|
||
|
|
||
|
/* ============================================================================================== */
|
||
|
/* Exported functions */
|
||
|
/* ============================================================================================== */
|
||
|
|
||
|
ZydisRegister ZydisRegisterGetById(ZydisRegisterClass registerClass, uint8_t id)
|
||
|
{
|
||
|
switch (registerClass)
|
||
|
{
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE8:
|
||
|
if (id > 19)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_AL + id;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE16:
|
||
|
if (id > 15)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_AX + id;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE32:
|
||
|
if (id > 15)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_EAX + id;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE64:
|
||
|
if (id > 15)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_RAX + id;
|
||
|
case ZYDIS_REGISTERCLASS_FLOATING_POINT:
|
||
|
if (id > 7)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_ST0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_MULTIMEDIA:
|
||
|
if (id > 7)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_MM0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR128:
|
||
|
if (id > 31)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_XMM0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR256:
|
||
|
if (id > 31)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_YMM0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR512:
|
||
|
if (id > 31)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_ZMM0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_SEGMENT:
|
||
|
if (id > 5)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_ES + id;
|
||
|
case ZYDIS_REGISTERCLASS_CONTROL:
|
||
|
if (id > 15)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_CR0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_DEBUG:
|
||
|
if (id > 15)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_DR0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_MASK:
|
||
|
if (id > 7)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_K0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_BOUNDS:
|
||
|
if (id > 3)
|
||
|
{
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_BND0 + id;
|
||
|
case ZYDIS_REGISTERCLASS_FLAGS:
|
||
|
case ZYDIS_REGISTERCLASS_IP:
|
||
|
// These registers are unique
|
||
|
break;
|
||
|
}
|
||
|
return ZYDIS_REGISTER_NONE;
|
||
|
}
|
||
|
|
||
|
const char* ZydisRegisterGetString(ZydisRegister reg)
|
||
|
{
|
||
|
if ((reg == 0) || (reg > (sizeof(registerStrings) / sizeof(registerStrings[0])) - 1))
|
||
|
{
|
||
|
return NULL;
|
||
|
}
|
||
|
return registerStrings[reg];
|
||
|
}
|
||
|
|
||
|
ZydisRegisterClass ZydisRegisterGetClass(ZydisRegister reg)
|
||
|
{
|
||
|
if ((reg >= ZYDIS_REGISTER_RAX) && (reg <= ZYDIS_REGISTER_R15))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_GENERAL_PURPOSE64;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_EAX) && (reg <= ZYDIS_REGISTER_R15D))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_GENERAL_PURPOSE32;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_AX) && (reg <= ZYDIS_REGISTER_R15W))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_GENERAL_PURPOSE16;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_AL) && (reg <= ZYDIS_REGISTER_R15B))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_GENERAL_PURPOSE8;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_ST0) && (reg <= ZYDIS_REGISTER_ST7))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_FLOATING_POINT;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_ZMM0) && (reg <= ZYDIS_REGISTER_ZMM31))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_VECTOR512;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_YMM0) && (reg <= ZYDIS_REGISTER_YMM31))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_VECTOR256;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_XMM0) && (reg <= ZYDIS_REGISTER_XMM31))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_VECTOR128;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_RFLAGS) && (reg <= ZYDIS_REGISTER_FLAGS))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_FLAGS;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_RIP) && (reg <= ZYDIS_REGISTER_IP))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_IP;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_ES) && (reg <= ZYDIS_REGISTER_GS))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_SEGMENT;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_CR0) && (reg <= ZYDIS_REGISTER_CR15))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_CONTROL;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_DR0) && (reg <= ZYDIS_REGISTER_DR15))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_DEBUG;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_K0) && (reg <= ZYDIS_REGISTER_K7))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_MASK;
|
||
|
}
|
||
|
if ((reg >= ZYDIS_REGISTER_BND0) && (reg <= ZYDIS_REGISTER_BND3))
|
||
|
{
|
||
|
return ZYDIS_REGISTERCLASS_BOUNDS;
|
||
|
}
|
||
|
return ZYDIS_REGISTERCLASS_INVALID;
|
||
|
}
|
||
|
|
||
|
ZydisRegisterSize ZydisRegisterGetSize(ZydisRegister reg)
|
||
|
{
|
||
|
ZydisRegisterClass registerClass = ZydisRegisterGetClass(reg);
|
||
|
switch (registerClass)
|
||
|
{
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE8:
|
||
|
return ZYDIS_REGISTERSIZE_8;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE16:
|
||
|
return ZYDIS_REGISTERSIZE_16;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE32:
|
||
|
return ZYDIS_REGISTERSIZE_32;
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE64:
|
||
|
return ZYDIS_REGISTERSIZE_64;
|
||
|
case ZYDIS_REGISTERCLASS_FLOATING_POINT:
|
||
|
return ZYDIS_REGISTERSIZE_80;
|
||
|
case ZYDIS_REGISTERCLASS_MULTIMEDIA:
|
||
|
return ZYDIS_REGISTERSIZE_64;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR128:
|
||
|
return ZYDIS_REGISTERSIZE_128;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR256:
|
||
|
return ZYDIS_REGISTERSIZE_256;
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR512:
|
||
|
return ZYDIS_REGISTERSIZE_512;
|
||
|
case ZYDIS_REGISTERCLASS_FLAGS:
|
||
|
return ZYDIS_REGISTERSIZE_DYNAMIC;
|
||
|
case ZYDIS_REGISTERCLASS_IP:
|
||
|
return ZYDIS_REGISTERSIZE_DYNAMIC;
|
||
|
case ZYDIS_REGISTERCLASS_SEGMENT:
|
||
|
return ZYDIS_REGISTERSIZE_16;
|
||
|
case ZYDIS_REGISTERCLASS_CONTROL:
|
||
|
return ZYDIS_REGISTERSIZE_DYNAMIC;
|
||
|
case ZYDIS_REGISTERCLASS_DEBUG:
|
||
|
return ZYDIS_REGISTERSIZE_DYNAMIC;
|
||
|
case ZYDIS_REGISTERCLASS_MASK:
|
||
|
return ZYDIS_REGISTERSIZE_64;
|
||
|
case ZYDIS_REGISTERCLASS_BOUNDS:
|
||
|
return ZYDIS_REGISTERSIZE_128;
|
||
|
}
|
||
|
return ZYDIS_REGISTERSIZE_INVALID;
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsGPR(ZydisRegister reg)
|
||
|
{
|
||
|
switch (ZydisRegisterGetClass(reg))
|
||
|
{
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE64:
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE32:
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE16:
|
||
|
case ZYDIS_REGISTERCLASS_GENERAL_PURPOSE8:
|
||
|
return true;
|
||
|
}
|
||
|
return false;
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsGPR8(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_GENERAL_PURPOSE8);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsGPR16(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_GENERAL_PURPOSE16);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsGPR32(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_GENERAL_PURPOSE32);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsGPR64(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_GENERAL_PURPOSE64);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsFPRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_FLOATING_POINT);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsMMRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_MULTIMEDIA);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsVR(ZydisRegister reg)
|
||
|
{
|
||
|
switch (ZydisRegisterGetClass(reg))
|
||
|
{
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR512:
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR256:
|
||
|
case ZYDIS_REGISTERCLASS_VECTOR128:
|
||
|
return true;
|
||
|
}
|
||
|
return false;
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsVR128(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_VECTOR128);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsVR256(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_VECTOR256);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsVR512(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_VECTOR512);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsFlagsRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_FLAGS);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsIPRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_IP);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsSegmentRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_SEGMENT);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsCR(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_CONTROL);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsDR(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_DEBUG);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsMaskRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_MASK);
|
||
|
}
|
||
|
|
||
|
bool ZydisRegisterIsBoundsRegister(ZydisRegister reg)
|
||
|
{
|
||
|
return (ZydisRegisterGetClass(reg) == ZYDIS_REGISTERCLASS_BOUNDS);
|
||
|
}
|
||
|
|
||
|
/* ============================================================================================== */
|