From 5ead1d9345c7800dab5a933a998a2d941f5ed67a Mon Sep 17 00:00:00 2001 From: flobernd Date: Thu, 12 Jan 2017 20:14:12 +0100 Subject: [PATCH] Minor refactorings - The instruction pointer is now directly passed to the ZydisDecoderDecodeInstruction function - Removed the user-data pointer in the ZydisOperandInfo struct --- examples/FormatterHooks.c | 75 ++++++++++++++++++--------------- include/Zydis/Decoder.h | 58 +++++++------------------ include/Zydis/InstructionInfo.h | 6 +-- src/Decoder.c | 48 +++------------------ 4 files changed, 64 insertions(+), 123 deletions(-) diff --git a/examples/FormatterHooks.c b/examples/FormatterHooks.c index a3011d2..6eb058c 100644 --- a/examples/FormatterHooks.c +++ b/examples/FormatterHooks.c @@ -36,6 +36,8 @@ #include #include #include "FormatHelper.h" +#include +#include /* ============================================================================================== */ /* Static data */ @@ -46,38 +48,38 @@ */ static const char* conditionCodeStrings[0x20] = { - "eq", - "lt", - "le", - "unord", - "neq", - "nlt", - "nle", - "ord", - "eq_uq", - "nge", - "ngt", - "false", - "oq", - "ge", - "gt", - "true", - "eq_os", - "lt_oq", - "le_oq", - "unord_s", - "neq_us", - "nlt_uq", - "nle_uq", - "ord_s", - "eq_us", - "nge_uq", - "ngt_uq", - "false_os", - "neq_os", - "ge_oq", - "gt_oq", - "true_us" + /*00*/ "eq", + /*01*/ "lt", + /*02*/ "le", + /*03*/ "unord", + /*04*/ "neq", + /*05*/ "nlt", + /*06*/ "nle", + /*07*/ "ord", + /*08*/ "eq_uq", + /*09*/ "nge", + /*0A*/ "ngt", + /*0B*/ "false", + /*0C*/ "oq", + /*0D*/ "ge", + /*0E*/ "gt", + /*0F*/ "true", + /*10*/ "eq_os", + /*11*/ "lt_oq", + /*12*/ "le_oq", + /*13*/ "unord_s", + /*14*/ "neq_us", + /*15*/ "nlt_uq", + /*16*/ "nle_uq", + /*17*/ "ord_s", + /*18*/ "eq_us", + /*19*/ "nge_uq", + /*1A*/ "ngt_uq", + /*1B*/ "false_os", + /*1C*/ "neq_os", + /*1D*/ "ge_oq", + /*1E*/ "gt_oq", + /*1F*/ "true_us" }; /* ============================================================================================== */ @@ -175,7 +177,6 @@ void disassembleBuffer(uint8_t* data, size_t length, ZydisBool installHooks) { ZydisInstructionDecoder decoder; ZydisDecoderInitInstructionDecoder(&decoder, ZYDIS_DISASSEMBLER_MODE_64BIT); - ZydisDecoderSetInstructionPointer(&decoder, 0x007FFFFFFF400000); ZydisInstructionFormatter formatter; ZydisFormatterInitInstructionFormatterEx(&formatter, ZYDIS_FORMATTER_STYLE_INTEL, @@ -191,13 +192,17 @@ void disassembleBuffer(uint8_t* data, size_t length, ZydisBool installHooks) ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_HOOK_FORMAT_OPERAND_IMM, (const void**)&defaultFormatOperandImm); } - + + uint64_t instructionPointer = 0x007FFFFFFF400000; + ZydisInstructionInfo info; char buffer[256]; - while (ZYDIS_SUCCESS(ZydisDecoderDecodeInstruction(&decoder, data, length, &info))) + while (ZYDIS_SUCCESS( + ZydisDecoderDecodeInstruction(&decoder, data, length, instructionPointer, &info))) { data += info.length; length -= info.length; + instructionPointer += info.length; printf("%016" PRIX64 " ", info.instrAddress); ZydisFormatterFormatInstruction(&formatter, &info, &buffer[0], sizeof(buffer)); printf(" %s\n", &buffer[0]); diff --git a/include/Zydis/Decoder.h b/include/Zydis/Decoder.h index af60de4..accd8b0 100644 --- a/include/Zydis/Decoder.h +++ b/include/Zydis/Decoder.h @@ -79,11 +79,6 @@ typedef struct ZydisInstructionDecoder_ const uint8_t* buffer; size_t bufferLen; } input; - // TODO: (Maybe) remove from this struct and pass as argument - /** - * @brief The current instruction-pointer value. - */ - uint64_t instructionPointer; /** * @brief Internal field. @c TRUE, if the @c imm8 value is already initialized. */ @@ -130,58 +125,37 @@ typedef struct ZydisInstructionDecoder_ ZYDIS_EXPORT ZydisStatus ZydisDecoderInitInstructionDecoder(ZydisInstructionDecoder* decoder, ZydisDisassemblerMode disassemblerMode); -/** - * @brief Returns the current instruction-pointer of the given @c ZydisInstructionDecoder - * instance. - * - * @param decoder A pointer to the @c ZydisInstructionDecoder instance. - * @param instructionPointer A pointer to the memory that receives the current - * instruction-pointer. - * - * @return A zydis status code. - */ -ZYDIS_EXPORT ZydisStatus ZydisDecoderGetInstructionPointer( - const ZydisInstructionDecoder* decoder, uint64_t* instructionPointer); - -/** - * @brief Changes the instruction-pointer of the given @c ZydisInstructionDecoder instance. - * - * @param decoder A pointer to the @c ZydisInstructionDecoder instance. - * @param instructionPointer The new instruction-pointer value. - * - * @return A zydis status code. - */ -ZYDIS_EXPORT ZydisStatus ZydisDecoderSetInstructionPointer(ZydisInstructionDecoder* decoder, - uint64_t instructionPointer); - /** * @brief Decodes the instruction in the given input @c buffer. * - * @param decoder A pointer to the @c ZydisInstructionDecoder instance. - * @param buffer A pointer to the input buffer. - * @param bufferLen The length of the input buffer. - * @param info A pointer to the @c ZydisInstructionInfo struct, that receives the details - * about the decoded instruction. + * @param decoder A pointer to the @c ZydisInstructionDecoder instance. + * @param buffer A pointer to the input buffer. + * @param bufferLen The length of the input buffer. + * @param instructionPointer The instruction-pointer. + * @param info A pointer to the @c ZydisInstructionInfo struct, that receives the + * details about the decoded instruction. * * @return A zydis status code. */ ZYDIS_EXPORT ZydisStatus ZydisDecoderDecodeInstruction(ZydisInstructionDecoder* decoder, - const void* buffer, size_t bufferLen, ZydisInstructionInfo* info); + const void* buffer, size_t bufferLen, uint64_t instructionPointer, ZydisInstructionInfo* info); /** * @brief Decodes the instruction in the given input @c buffer. * - * @param decoder A pointer to the @c ZydisInstructionDecoder instance. - * @param buffer A pointer to the input buffer. - * @param bufferLen The length of the input buffer. - * @param flags Additional decoding flags. - * @param info A pointer to the @c ZydisInstructionInfo struct, that receives the details - * about the decoded instruction. + * @param decoder A pointer to the @c ZydisInstructionDecoder instance. + * @param buffer A pointer to the input buffer. + * @param bufferLen The length of the input buffer. + * @param instructionPointer The instruction-pointer. + * @param flags Additional decoding flags. + * @param info A pointer to the @c ZydisInstructionInfo struct, that receives the + * details about the decoded instruction. * * @return A zydis status code. */ ZYDIS_EXPORT ZydisStatus ZydisDecoderDecodeInstructionEx(ZydisInstructionDecoder* decoder, - const void* buffer, size_t bufferLen, ZydisDecoderFlags flags, ZydisInstructionInfo* info); + const void* buffer, size_t bufferLen, uint64_t instructionPointer, ZydisDecoderFlags flags, + ZydisInstructionInfo* info); /* ============================================================================================== */ diff --git a/include/Zydis/InstructionInfo.h b/include/Zydis/InstructionInfo.h index 04aa77e..c446684 100644 --- a/include/Zydis/InstructionInfo.h +++ b/include/Zydis/InstructionInfo.h @@ -370,10 +370,6 @@ typedef struct ZydisOperandInfo_ */ uint8_t dataOffset; } imm; - /** - * @brief This field is intended for custom data and may be freely set by the user. - */ - void* userData; } ZydisOperandInfo; /* ============================================================================================== */ @@ -490,7 +486,7 @@ typedef uint64_t ZydisInstructionAttributes; /** * @brief The instruction has the EVEX prefix. */ -#define ZYDIS_ATTRIB_HAS_EVEX 0x0000000000000020 +#define ZYDIS_ATTRIB_HAS_EVEX 0x0000000000000020 /** * @brief The instruction has one or more operands with position-relative offsets. */ diff --git a/src/Decoder.c b/src/Decoder.c index bc9895a..d2cc91c 100644 --- a/src/Decoder.c +++ b/src/Decoder.c @@ -2275,40 +2275,18 @@ ZydisStatus ZydisDecoderInitInstructionDecoder(ZydisInstructionDecoder* decoder, decoder->disassemblerMode = disassemblerMode; decoder->input.buffer = NULL; decoder->input.bufferLen = 0; - decoder->instructionPointer = 0; return ZYDIS_STATUS_SUCCESS; } -ZydisStatus ZydisDecoderGetInstructionPointer(const ZydisInstructionDecoder* decoder, - uint64_t* instructionPointer) -{ - if (!decoder || !instructionPointer) - { - return ZYDIS_STATUS_INVALID_PARAMETER; - } - *instructionPointer = decoder->instructionPointer; - return ZYDIS_STATUS_SUCCESS; -} - -ZydisStatus ZydisDecoderSetInstructionPointer(ZydisInstructionDecoder* decoder, - uint64_t instructionPointer) -{ - if (!decoder) - { - return ZYDIS_STATUS_INVALID_PARAMETER; - } - decoder->instructionPointer = instructionPointer; - return ZYDIS_STATUS_SUCCESS; -} - ZydisStatus ZydisDecoderDecodeInstruction(ZydisInstructionDecoder* decoder, - const void* buffer, size_t bufferLen, ZydisInstructionInfo* info) + const void* buffer, size_t bufferLen, uint64_t instructionPointer, ZydisInstructionInfo* info) { - return ZydisDecoderDecodeInstructionEx(decoder, buffer, bufferLen, 0, info); + return ZydisDecoderDecodeInstructionEx(decoder, buffer, bufferLen, instructionPointer, 0, info); } ZydisStatus ZydisDecoderDecodeInstructionEx(ZydisInstructionDecoder* decoder, - const void* buffer, size_t bufferLen, ZydisDecoderFlags flags, ZydisInstructionInfo* info) + const void* buffer, size_t bufferLen, uint64_t instructionPointer, ZydisDecoderFlags flags, + ZydisInstructionInfo* info) { (void)flags; @@ -2328,20 +2306,11 @@ ZydisStatus ZydisDecoderDecodeInstructionEx(ZydisInstructionDecoder* decoder, decoder->lastSegmentPrefix = 0; decoder->imm8initialized = ZYDIS_FALSE; - void* userData[6]; - for (int i = 0; i < 5; ++i) - { - userData[i] = info->operands[i].userData; - } - userData[5] = info->userData; + void* userData = info->userData; memset(info, 0, sizeof(*info)); info->mode = decoder->disassemblerMode; - info->instrAddress = decoder->instructionPointer; - for (int i = 0; i < 5; ++i) - { - info->operands[i].userData = userData[i]; - } - info->userData = userData[5]; + info->instrAddress = instructionPointer; + info->userData = userData; ZYDIS_CHECK(ZydisCollectOptionalPrefixes(decoder, info)); ZYDIS_CHECK(ZydisDecodeOpcode(decoder, info)); @@ -2426,9 +2395,6 @@ ZydisStatus ZydisDecoderDecodeInstructionEx(ZydisInstructionDecoder* decoder, } } - decoder->instructionPointer += info->length; - info->instrPointer = decoder->instructionPointer; - return ZYDIS_STATUS_SUCCESS; }