mirror of https://github.com/x64dbg/zydis
Added tool for testing Zydis against CPU behaviour (Intel PIN)
This commit is contained in:
Joel Höner
parent
5b63557f3c
commit
cbc9460547
|
|
@ -0,0 +1,41 @@
|
|||
|
||||
#ifndef ZYDIS_EXPORT_H
|
||||
#define ZYDIS_EXPORT_H
|
||||
|
||||
#ifdef ZYDIS_STATIC_DEFINE
|
||||
# define ZYDIS_EXPORT
|
||||
# define ZYDIS_NO_EXPORT
|
||||
#else
|
||||
# ifndef ZYDIS_EXPORT
|
||||
# ifdef Zydis_EXPORTS
|
||||
/* We are building this library */
|
||||
# define ZYDIS_EXPORT
|
||||
# else
|
||||
/* We are using this library */
|
||||
# define ZYDIS_EXPORT
|
||||
# endif
|
||||
# endif
|
||||
|
||||
# ifndef ZYDIS_NO_EXPORT
|
||||
# define ZYDIS_NO_EXPORT
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#ifndef ZYDIS_DEPRECATED
|
||||
# define ZYDIS_DEPRECATED __attribute__ ((__deprecated__))
|
||||
#endif
|
||||
|
||||
#ifndef ZYDIS_DEPRECATED_EXPORT
|
||||
# define ZYDIS_DEPRECATED_EXPORT ZYDIS_EXPORT ZYDIS_DEPRECATED
|
||||
#endif
|
||||
|
||||
#ifndef ZYDIS_DEPRECATED_NO_EXPORT
|
||||
# define ZYDIS_DEPRECATED_NO_EXPORT ZYDIS_NO_EXPORT ZYDIS_DEPRECATED
|
||||
#endif
|
||||
|
||||
#define DEFINE_NO_DEPRECATED 0
|
||||
#if DEFINE_NO_DEPRECATED
|
||||
# define ZYDIS_NO_DEPRECATED
|
||||
#endif
|
||||
|
||||
#endif
|
||||
|
|
@ -0,0 +1,286 @@
|
|||
/**
|
||||
*
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
* of this software and associated documentation files (the "Software"), to deal
|
||||
* in the Software without restriction, including without limitation the rights
|
||||
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
* copies of the Software, and to permit persons to whom the Software is
|
||||
* furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
* SOFTWARE.
|
||||
*/
|
||||
|
||||
#include "pin.H"
|
||||
#include "xed-interface.h"
|
||||
|
||||
#include <iostream>
|
||||
#include <iomanip>
|
||||
#include <fstream>
|
||||
#include <set>
|
||||
#include <Zydis/Zydis.h>
|
||||
|
||||
/* ========================================================================== */
|
||||
/* TLS struct */
|
||||
/* ========================================================================== */
|
||||
|
||||
struct ThreadData
|
||||
{
|
||||
CONTEXT ctx;
|
||||
ZydisInstructionDecoder decoder;
|
||||
|
||||
ThreadData()
|
||||
{
|
||||
ZydisDecoderInitInstructionDecoderEx(
|
||||
&decoder, ZYDIS_DISASSEMBLER_MODE_64BIT, NULL, 0
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
/* ========================================================================== */
|
||||
/* Global variables */
|
||||
/* ========================================================================== */
|
||||
|
||||
TLS_KEY tls_key;
|
||||
std::ostream* out = &cerr;
|
||||
|
||||
PIN_LOCK unique_iforms_lock;
|
||||
std::set<xed_iform_enum_t> unique_iforms;
|
||||
|
||||
/* ========================================================================== */
|
||||
/* Tables */
|
||||
/* ========================================================================== */
|
||||
|
||||
struct RegMapping
|
||||
{
|
||||
REG pin;
|
||||
ZydisRegister zy;
|
||||
};
|
||||
|
||||
RegMapping reg_mapping[] = {
|
||||
// 64-bit GP register
|
||||
{REG_RAX, ZYDIS_REGISTER_RAX},
|
||||
{REG_RBX, ZYDIS_REGISTER_RBX},
|
||||
{REG_RCX, ZYDIS_REGISTER_RCX},
|
||||
{REG_RDX, ZYDIS_REGISTER_RDX},
|
||||
{REG_RSP, ZYDIS_REGISTER_RSP},
|
||||
{REG_RBP, ZYDIS_REGISTER_RBP},
|
||||
{REG_RSI, ZYDIS_REGISTER_RSI},
|
||||
{REG_RDI, ZYDIS_REGISTER_RDI},
|
||||
{REG_R8, ZYDIS_REGISTER_R8 },
|
||||
{REG_R9, ZYDIS_REGISTER_R9 },
|
||||
{REG_R10, ZYDIS_REGISTER_R10},
|
||||
{REG_R11, ZYDIS_REGISTER_R11},
|
||||
{REG_R12, ZYDIS_REGISTER_R12},
|
||||
{REG_R13, ZYDIS_REGISTER_R13},
|
||||
{REG_R14, ZYDIS_REGISTER_R14},
|
||||
{REG_R15, ZYDIS_REGISTER_R15},
|
||||
|
||||
// Segment registers
|
||||
{REG_SEG_ES, ZYDIS_REGISTER_ES},
|
||||
{REG_SEG_SS, ZYDIS_REGISTER_SS},
|
||||
{REG_SEG_SS, ZYDIS_REGISTER_SS},
|
||||
{REG_SEG_CS, ZYDIS_REGISTER_CS},
|
||||
{REG_SEG_DS, ZYDIS_REGISTER_DS},
|
||||
{REG_SEG_FS, ZYDIS_REGISTER_FS},
|
||||
{REG_SEG_GS, ZYDIS_REGISTER_GS},
|
||||
|
||||
// Mask registers
|
||||
{REG_K0, ZYDIS_REGISTER_K0},
|
||||
{REG_K1, ZYDIS_REGISTER_K1},
|
||||
{REG_K2, ZYDIS_REGISTER_K2},
|
||||
{REG_K3, ZYDIS_REGISTER_K3},
|
||||
{REG_K4, ZYDIS_REGISTER_K4},
|
||||
{REG_K5, ZYDIS_REGISTER_K5},
|
||||
{REG_K6, ZYDIS_REGISTER_K6},
|
||||
{REG_K7, ZYDIS_REGISTER_K7},
|
||||
|
||||
// TODO: XMM, YMM, ZMM, ST, TR
|
||||
|
||||
// Special registers
|
||||
{REG_MXCSR, ZYDIS_REGISTER_MXCSR},
|
||||
};
|
||||
|
||||
/* ========================================================================== */
|
||||
/* Command line switches */
|
||||
/* ========================================================================== */
|
||||
|
||||
KNOB<string> knob_out_file(
|
||||
KNOB_MODE_WRITEONCE, "pintool", "o", "", "Output file name"
|
||||
);
|
||||
|
||||
KNOB<bool> know_unique_iform(
|
||||
KNOB_MODE_WRITEONCE, "pintool", "unique_iform", "0",
|
||||
"Only instrument one instruction per iform"
|
||||
);
|
||||
|
||||
KNOB<bool> omit_op_checks(
|
||||
KNOB_MODE_WRITEONCE, "pintool", "omit_op_checks", "0",
|
||||
"Skip verification of operand write assumptions"
|
||||
);
|
||||
|
||||
KNOB<bool> omit_flag_checks(
|
||||
KNOB_MODE_WRITEONCE, "pintool", "omit_flag_checks", "1",
|
||||
"Skip verification of flag write assumptions"
|
||||
);
|
||||
|
||||
/* ========================================================================== */
|
||||
/* Instrumentation callbacks */
|
||||
/* ========================================================================== */
|
||||
|
||||
VOID PIN_FAST_ANALYSIS_CALL pre_ins_cb(THREADID tid, const CONTEXT* ctx)
|
||||
{
|
||||
ThreadData *tls = static_cast<ThreadData*>(PIN_GetThreadData(tls_key, tid));
|
||||
PIN_SaveContext(ctx, &tls->ctx);
|
||||
}
|
||||
|
||||
VOID PIN_FAST_ANALYSIS_CALL post_ins_cb(THREADID tid, const CONTEXT* post_ctx)
|
||||
{
|
||||
ThreadData *tls = static_cast<ThreadData*>(PIN_GetThreadData(tls_key, tid));
|
||||
|
||||
// Get IPs.
|
||||
ADDRINT pre_ip = PIN_GetContextReg(&tls->ctx, REG_INST_PTR);
|
||||
ADDRINT post_ip = PIN_GetContextReg(post_ctx, REG_INST_PTR);
|
||||
|
||||
// If the IP didn't change, we're probably dealing with a rep.
|
||||
// Skip instruction until last execution where fallthrough kicks in.
|
||||
ADDRINT ip_diff = post_ip - pre_ip;
|
||||
if (!ip_diff) return;
|
||||
|
||||
// Disassemble previously executed instruction.
|
||||
ZydisMemoryInput input;
|
||||
ZydisInputInitMemoryInput(&input, (void*)pre_ip, 15);
|
||||
ZydisDecoderSetInput(&tls->decoder, (ZydisCustomInput*)&input);
|
||||
|
||||
ZydisInstructionInfo insn_info;
|
||||
ZydisStatus decode_status = ZydisDecoderDecodeNextInstruction(
|
||||
&tls->decoder, &insn_info
|
||||
);
|
||||
|
||||
// Can we decode it?
|
||||
if (!ZYDIS_SUCCESS(decode_status)) {
|
||||
*out << "Decoding failure" << endl;
|
||||
goto error;
|
||||
}
|
||||
|
||||
// Does the length look like what we expected?
|
||||
if (insn_info.length != ip_diff) {
|
||||
*out << "Instruction length mismatch (expected "
|
||||
<< dec << ip_diff << ", got " << (int)insn_info.length
|
||||
<< ')' << endl;
|
||||
goto error;
|
||||
}
|
||||
|
||||
// Analyze operand effects.
|
||||
if (!omit_op_checks) {
|
||||
for (const RegMapping* map = reg_mapping
|
||||
; map < reg_mapping + sizeof reg_mapping / sizeof reg_mapping[0]
|
||||
; ++map) {
|
||||
|
||||
ADDRINT pre_reg_val = PIN_GetContextReg(&tls->ctx, map->pin);
|
||||
ADDRINT post_reg_val = PIN_GetContextReg(post_ctx, map->pin);
|
||||
|
||||
// Did the instruction touch this register?
|
||||
if (pre_reg_val != post_reg_val) {
|
||||
*out << "Reg value changed ("
|
||||
<< ZydisRegisterGetString(map->zy)
|
||||
<< ")!" << endl;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Analyze flag effects.
|
||||
if (!omit_flag_checks) {
|
||||
ADDRINT prev_flags = PIN_GetContextReg(&tls->ctx, REG_GFLAGS);
|
||||
ADDRINT new_flags = PIN_GetContextReg(post_ctx, REG_GFLAGS);
|
||||
ADDRINT changed_flags = prev_flags ^ new_flags;
|
||||
if (changed_flags) {
|
||||
// TODO: implement once flag infos are available.
|
||||
}
|
||||
}
|
||||
|
||||
return;
|
||||
|
||||
error:
|
||||
// Always print raw bytes on error.
|
||||
*out << "Raw bytes: ";
|
||||
for (size_t i = 0; i < 15; ++i) {
|
||||
*out << setfill('0') << setw(2) << hex
|
||||
<< (int)((uint8_t*)pre_ip)[i] << ' ';
|
||||
}
|
||||
*out << endl;
|
||||
}
|
||||
|
||||
VOID instruction(INS ins, VOID *v)
|
||||
{
|
||||
if (!INS_HasFallThrough(ins)) return;
|
||||
|
||||
xed_decoded_inst_t* xed = INS_XedDec(ins);
|
||||
xed_iform_enum_t iform = xed_decoded_inst_get_iform_enum(xed);
|
||||
|
||||
if (know_unique_iform.Value()) {
|
||||
PIN_GetLock(&unique_iforms_lock, 0);
|
||||
if (unique_iforms.find(iform) != unique_iforms.end()) {
|
||||
PIN_ReleaseLock(&unique_iforms_lock);
|
||||
return;
|
||||
}
|
||||
unique_iforms.insert(iform);
|
||||
*out << iform << endl;
|
||||
PIN_ReleaseLock(&unique_iforms_lock);
|
||||
}
|
||||
|
||||
INS_InsertCall(
|
||||
ins, IPOINT_BEFORE, (AFUNPTR)&pre_ins_cb,
|
||||
IARG_FAST_ANALYSIS_CALL, IARG_THREAD_ID, IARG_CONST_CONTEXT,
|
||||
IARG_END
|
||||
);
|
||||
INS_InsertCall(
|
||||
ins, IPOINT_AFTER, (AFUNPTR)&post_ins_cb,
|
||||
IARG_FAST_ANALYSIS_CALL, IARG_THREAD_ID, IARG_CONST_CONTEXT,
|
||||
IARG_END
|
||||
);
|
||||
}
|
||||
|
||||
VOID thread_start(THREADID tid, CONTEXT *ctx, INT32 flags, VOID* v)
|
||||
{
|
||||
ThreadData* tls = new ThreadData;
|
||||
PIN_SetThreadData(tls_key, tls, tid);
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
if (PIN_Init(argc, argv)) {
|
||||
cerr << KNOB_BASE::StringKnobSummary() << endl;
|
||||
return 1;
|
||||
}
|
||||
|
||||
// Open output file.
|
||||
string file_name = knob_out_file.Value();
|
||||
if (!file_name.empty()) {
|
||||
out = new std::ofstream(file_name.c_str());
|
||||
}
|
||||
|
||||
// Init TLS.
|
||||
tls_key = PIN_CreateThreadDataKey(0);
|
||||
PIN_InitLock(&unique_iforms_lock);
|
||||
|
||||
// Register hooks.
|
||||
PIN_AddThreadStartFunction(&thread_start, NULL);
|
||||
INS_AddInstrumentFunction(&instruction, NULL);
|
||||
|
||||
// Start the program, never returns.
|
||||
PIN_StartProgram();
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ========================================================================== */
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
##############################################################
|
||||
#
|
||||
# DO NOT EDIT THIS FILE!
|
||||
#
|
||||
##############################################################
|
||||
|
||||
# If the tool is built out of the kit, PIN_ROOT must be specified in the make invocation and point to the kit root.
|
||||
ifdef PIN_ROOT
|
||||
CONFIG_ROOT := $(PIN_ROOT)/source/tools/Config
|
||||
else
|
||||
CONFIG_ROOT := ../Config
|
||||
endif
|
||||
include $(CONFIG_ROOT)/makefile.config
|
||||
include makefile.rules
|
||||
include $(TOOLS_ROOT)/Config/makefile.default.rules
|
||||
|
||||
##############################################################
|
||||
#
|
||||
# DO NOT EDIT THIS FILE!
|
||||
#
|
||||
##############################################################
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
##############################################################
|
||||
#
|
||||
# This file includes all the test targets as well as all the
|
||||
# non-default build rules and test recipes.
|
||||
#
|
||||
##############################################################
|
||||
|
||||
|
||||
##############################################################
|
||||
#
|
||||
# Test targets
|
||||
#
|
||||
##############################################################
|
||||
|
||||
###### Place all generic definitions here ######
|
||||
|
||||
# This defines tests which run tools of the same name. This is simply for convenience to avoid
|
||||
# defining the test name twice (once in TOOL_ROOTS and again in TEST_ROOTS).
|
||||
# Tests defined here should not be defined in TOOL_ROOTS and TEST_ROOTS.
|
||||
TEST_TOOL_ROOTS := ZydisTestTool
|
||||
|
||||
OBJECT_ROOTS += \
|
||||
zydis/src/Decoder \
|
||||
zydis/src/Formatter \
|
||||
zydis/src/Input \
|
||||
zydis/src/InstructionDetails \
|
||||
zydis/src/InstructionTable \
|
||||
zydis/src/Mnemonic \
|
||||
zydis/src/Register \
|
||||
zydis/src/Utils \
|
||||
zydis/src/Zydis
|
||||
|
||||
# This defines the tests to be run that were not already defined in TEST_TOOL_ROOTS.
|
||||
TEST_ROOTS :=
|
||||
|
||||
# This defines the tools which will be run during the the tests, and were not already defined in
|
||||
# TEST_TOOL_ROOTS.
|
||||
TOOL_ROOTS :=
|
||||
|
||||
# This defines the static analysis tools which will be run during the the tests. They should not
|
||||
# be defined in TEST_TOOL_ROOTS. If a test with the same name exists, it should be defined in
|
||||
# TEST_ROOTS.
|
||||
# Note: Static analysis tools are in fact executables linked with the Pin Static Analysis Library.
|
||||
# This library provides a subset of the Pin APIs which allows the tool to perform static analysis
|
||||
# of an application or dll. Pin itself is not used when this tool runs.
|
||||
SA_TOOL_ROOTS :=
|
||||
|
||||
# This defines all the applications that will be run during the tests.
|
||||
APP_ROOTS :=
|
||||
|
||||
# This defines any additional object files that need to be compiled.
|
||||
OBJECT_ROOTS :=
|
||||
|
||||
# This defines any additional dlls (shared objects), other than the pintools, that need to be compiled.
|
||||
DLL_ROOTS :=
|
||||
|
||||
# This defines any static libraries (archives), that need to be built.
|
||||
LIB_ROOTS :=
|
||||
|
||||
###### Define the sanity subset ######
|
||||
|
||||
# This defines the list of tests that should run in sanity. It should include all the tests listed in
|
||||
# TEST_TOOL_ROOTS and TEST_ROOTS excluding only unstable tests.
|
||||
SANITY_SUBSET := $(TEST_TOOL_ROOTS) $(TEST_ROOTS)
|
||||
|
||||
|
||||
##############################################################
|
||||
#
|
||||
# Test recipes
|
||||
#
|
||||
##############################################################
|
||||
|
||||
# This section contains recipes for tests other than the default.
|
||||
# See makefile.default.rules for the default test rules.
|
||||
# All tests in this section should adhere to the naming convention: <testname>.test
|
||||
|
||||
|
||||
##############################################################
|
||||
#
|
||||
# Build rules
|
||||
#
|
||||
##############################################################
|
||||
|
||||
ADDITIONAL_INCLUDES := -Izydis/include -I.
|
||||
TOOL_CFLAGS += $(ADDITIONAL_INCLUDES)
|
||||
TOOL_CXXFLAGS += $(ADDITIONAL_INCLUDES)
|
||||
|
||||
$(OBJDIR)ZydisTestTool$(PINTOOL_SUFFIX): $(OBJDIR)ZydisTestTool$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Decoder$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Formatter$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Input$(OBJ_SUFFIX) $(OBJDIR)zydis/src/InstructionDetails$(OBJ_SUFFIX) $(OBJDIR)zydis/src/InstructionTable$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Mnemonic$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Register$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Utils$(OBJ_SUFFIX) $(OBJDIR)zydis/src/Zydis$(OBJ_SUFFIX)
|
||||
$(LINKER) $(TOOL_LDFLAGS) $(LINK_EXE)$@ $^ $(TOOL_LPATHS) $(TOOL_LIBS)
|
||||
Loading…
Reference in New Issue