arno/bddisasm
1
0
Fork 0
mirror of https://github.com/bitdefender/bddisasm.git synced 2024-11-18 05:28:09 +00:00
Code Issues Releases Wiki Activity
f62c8a2238
bddisasm/bdshemu/bdshemu.c

3183 lines
96 KiB
C
Raw Blame History

/*
* Copyright (c) 2020 Bitdefender
* SPDX-License-Identifier: Apache-2.0
*/
//
// bdshemu.c
//
#include "bdshemu.h"
#include "../bddisasm/include/nd_crt.h"
#ifdef __clang__
#include <wmmintrin.h>
#else
#if defined(ND_ARCH_X64) || defined(ND_ARCH_X86)
#include <immintrin.h>
#endif // defined(ND_ARCH_X64) || defined(ND_ARCH_X86)
#endif // __clang__
//
// A generic emulator value.
//
typedef struct _SHEMU_VALUE
{
union
{
ND_UINT8 Bytes[ND_MAX_REGISTER_SIZE];
ND_UINT16 Words[ND_MAX_REGISTER_SIZE / sizeof(ND_UINT16)];
ND_UINT32 Dwords[ND_MAX_REGISTER_SIZE / sizeof(ND_UINT32)];
ND_UINT64 Qwords[ND_MAX_REGISTER_SIZE / sizeof(ND_UINT64)];
struct
{
ND_UINT16 FpuControlWord;
ND_UINT16 FpuStatusWord;
ND_UINT16 FpuTagWord;
ND_UINT16 Rsvd;
ND_UINT32 FpuDataPointer;
ND_UINT32 FpuInstructionPointer;
ND_UINT32 FpuLastInstructionOpcode;
} FpuEnvironment;
struct
{
ND_UINT16 FpuControlWord;
ND_UINT16 FpuStatuwsWord;
ND_UINT16 FpuTagWord;
ND_UINT16 FpuOpcode;
ND_UINT64 FpuRip;
ND_UINT64 FpuDataPointer;
ND_UINT32 Mxcsr;
ND_UINT32 MxcsrMask;
} XsaveArea;
struct
{
ND_UINT16 Limit;
ND_UINT64 Base;
} Descriptor;
} Value;
ND_OPERAND_SIZE Size;
} SHEMU_VALUE, *PSHEMU_VALUE;
enum
{
FM_LOGIC,
FM_SHL,
FM_SHR,
FM_SAR,
FM_SUB,
FM_ADD,
} FLAGS_MODE;
#define GET_OP(ctx, op, val) { \
SHEMU_STATUS status = ShemuGetOperandValue(ctx, op, val); \
if (SHEMU_SUCCESS != status) \
{ \
return status; \
} \
}
#define SET_OP(ctx, op, val) { \
SHEMU_STATUS status = ShemuSetOperandValue(ctx, op, val); \
if (SHEMU_SUCCESS != status) \
{ \
return status; \
} \
}
#define GET_FLAG(ctx, flg) (!!((ctx)->Registers.RegFlags & (flg)))
#define SET_FLAG(ctx, flg, val) ((ctx)->Registers.RegFlags = (val) ? ((ctx)->Registers.RegFlags | flg) : \
((ctx)->Registers.RegFlags & ~(flg)))
#define SET_FLAGS(ctx, dst, src1, src2, fm) ShemuSetFlags(ctx, dst.Value.Qwords[0], src1.Value.Qwords[0], \
src2.Value.Qwords[0], dst.Size, fm)
#define SHELLBMP(ctx) ((ctx)->Intbuf)
#define STACKBMP(ctx) ((ctx)->Intbuf + (ctx)->ShellcodeSize)
#define SHELLBMP_SIZE(ctx) ((ctx)->ShellcodeSize)
#define STACKBMP_SIZE(ctx) ((ctx)->StackSize)
#define MAX(a, b) ((a) < (b) ? (b) : (a))
#define MIN(a, b) ((a) > (b) ? (b) : (a))
//
// ShemuPrintf - simple version
//
#ifndef BDDISASM_NO_FORMAT
static void
shemu_printf(
SHEMU_CONTEXT *Context,
char *formatstring,
...
)
{
char buff[1024];
va_list args;
if (ND_NULL == Context->Log)
{
return;
}
nd_memzero(buff, sizeof(buff));
va_start(args, formatstring);
nd_vsnprintf_s(buff, sizeof(buff), sizeof(buff) - 1, formatstring, args);
va_end(args);
Context->Log(buff);
}
#else
#define shemu_printf(Context, formatstring, ...)
#endif // !BDDISASM_NO_FORMAT
//
// shemu_memcpy
//
static void *
shemu_memcpy(
void *Dest,
const void *Source,
ND_SIZET Size
)
{
void *start = Dest;
ND_UINT32 index = 0;
if (ND_NULL == Dest)
{
return ND_NULL;
}
if (ND_NULL == Source)
{
return ND_NULL;
}
while (Size--)
{
*(char *)Dest = *((char *)Source + index);
Dest = (char *)Dest + 1;
index++;
}
return start;
}
//
// ShemuBts
//
inline static ND_UINT8
ShemuBts(
ND_UINT8 *BitMap,
ND_UINT64 Position
)
{
ND_UINT8 old;
old = (BitMap[Position / 8] >> (Position % 8)) & 1;
BitMap[Position / 8] |= 1 << (Position % 8);
return old;
}
//
// ShemuBtr
//
inline static ND_UINT8
ShemuBtr(
ND_UINT8 *BitMap,
ND_UINT64 Position
)
{
ND_UINT8 old;
old = (BitMap[Position / 8] >> (Position % 8)) & 1;
BitMap[Position / 8] &= ~(1 << (Position % 8));
return old;
}
//
// ShemuBt
//
inline static ND_UINT8
ShemuBt(
ND_UINT8 *BitMap,
ND_UINT64 Position
)
{
return (BitMap[Position / 8] >> (Position % 8)) & 1;
}
//
// ShemuSetBits
//
static void
ShemuSetBits(
ND_UINT8 *Bitmap,
ND_UINT64 Start,
ND_UINT64 Size,
ND_BOOL Val
)
//
// No size validations here; the caller has to make sure the ranges are all good.
//
{
ND_UINT64 i;
for (i = 0; i < Size; i++)
{
if (Val)
{
ShemuBts(Bitmap, (ND_UINT64)(Start + i));
}
else
{
ShemuBtr(Bitmap, (ND_UINT64)(Start + i));
}
}
}
////
//// ShemuAllBitsSet
////
//static ND_BOOL
//ShemuAllBitsSet(
// ND_UINT8 *Bitmap,
// ND_UINT64 Start,
// ND_UINT32 Size
// )
////
//// No size validations here; the caller has to make sure the ranges are all good.
////
//{
// ND_UINT32 i;
//
// for (i = 0; i < Size; i++)
// {
// if (!ShemuBt(Bitmap, (ND_UINT64)(Start + i)))
// {
// return ND_FALSE;
// }
// }
//
// return ND_TRUE;
//}
//
// ShemuAnyBitsSet
//
static ND_BOOL
ShemuAnyBitsSet(
ND_UINT8 *Bitmap,
ND_UINT64 Start,
ND_UINT32 Size
)
//
// No size validations here; the caller has to make sure the ranges are all good.
//
{
ND_UINT32 i;
for (i = 0; i < Size; i++)
{
if (ShemuBt(Bitmap, (ND_UINT64)(Start + i)))
{
return ND_TRUE;
}
}
return ND_FALSE;
}
//
// ShemuSetFlags
//
static void
ShemuSetFlags(
SHEMU_CONTEXT *Context,
ND_UINT64 Dst,
ND_UINT64 Src1,
ND_UINT64 Src2,
ND_OPERAND_SIZE Size,
ND_UINT8 FlagsMode
)
{
ND_UINT8 pfArr[16] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4 };
// Mask the operands with their respective size.
Dst = ND_TRIM(Size, Dst);
Src1 = ND_TRIM(Size, Src1);
Src2 = ND_TRIM(Size, Src2);
if (FlagsMode == FM_SHL || FlagsMode == FM_SHR || FlagsMode == FM_SAR)
{
// Shift with 0 count does not affect flags.
if (Src2 == 0)
{
return;
}
}
// PF set if the first bytes has an even number of 1 bits.
if ((pfArr[Dst & 0xF] + pfArr[(Dst >> 4) & 0xF]) % 2 == 0)
{
Context->Registers.RegFlags |= NDR_RFLAG_PF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_PF;
}
// ZF set if the result is zero.
if (Dst == 0)
{
Context->Registers.RegFlags |= NDR_RFLAG_ZF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_ZF;
}
// SF is set if the sign flag is set.
if (ND_GET_SIGN(Size, Dst) != 0)
{
Context->Registers.RegFlags |= NDR_RFLAG_SF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_SF;
}
// OF and CF are handled differently for some instructions.
if (FM_LOGIC == FlagsMode)
{
// OF and CF are cleared on logic instructions.
Context->Registers.RegFlags &= ~(NDR_RFLAG_OF | NDR_RFLAG_CF);
}
else if (FM_SHL == FlagsMode)
{
// CF is the last bit shifted out of the destination.
if (ND_GET_BIT((Size * 8ULL) - Src2, Src1))
{
Context->Registers.RegFlags |= NDR_RFLAG_CF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_CF;
}
if (Src2 == 1)
{
if (ND_GET_BIT(Size * 8ULL - 1, Src1) ^ ND_GET_BIT(Size * 8ULL - 2, Src1))
{
Context->Registers.RegFlags |= NDR_RFLAG_OF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_OF;
}
}
}
else if (FM_SHR == FlagsMode)
{
// CF is the last bit shifted out of the destination.
if (ND_GET_BIT(Src2 - 1, Src1))
{
Context->Registers.RegFlags |= NDR_RFLAG_CF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_CF;
}
if (Src2 == 1)
{
if (ND_GET_BIT(Size * 8ULL - 1, Src1))
{
Context->Registers.RegFlags |= NDR_RFLAG_OF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_OF;
}
}
}
else if (FM_SAR == FlagsMode)
{
// CF is the last bit shifted out of the destination. In case of SAR, if the shift ammount exceeds the operand
// size, CF will be 1 if the result is -1, or 0 if the result is 0.
if (ND_GET_BIT(Src2 - 1, Src1) || ((Src2 >= (ND_UINT64)Size * 8) && Dst != 0))
{
Context->Registers.RegFlags |= NDR_RFLAG_CF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_CF;
}
Context->Registers.RegFlags &= ~NDR_RFLAG_OF;
}
else
{
// Set CF.
if ((FM_SUB == FlagsMode) && ((Src1 < Src2) || (Src1 == Src2 && Dst != 0)))
{
Context->Registers.RegFlags |= NDR_RFLAG_CF;
}
else if ((FM_ADD == FlagsMode) && ((Dst < Src1) || (Dst == Src1 && Src2 != 0)))
{
Context->Registers.RegFlags |= NDR_RFLAG_CF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_CF;
}
// Set OF.
if (FM_SUB == FlagsMode)
{
if ((ND_GET_SIGN(Size, Src1) && !ND_GET_SIGN(Size, Src2) && !ND_GET_SIGN(Size, Dst)) ||
(!ND_GET_SIGN(Size, Src1) && ND_GET_SIGN(Size, Src2) && ND_GET_SIGN(Size, Dst)))
{
Context->Registers.RegFlags |= NDR_RFLAG_OF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_OF;
}
}
else if (FM_ADD == FlagsMode)
{
if (ND_GET_SIGN(Size, Src1) == ND_GET_SIGN(Size, Src2) &&
ND_GET_SIGN(Size, Src1) != ND_GET_SIGN(Size, Dst))
{
Context->Registers.RegFlags |= NDR_RFLAG_OF;
}
else
{
Context->Registers.RegFlags &= ~NDR_RFLAG_OF;
}
}
}
}
//
// ShemuEvalCondition
//
static ND_BOOL
ShemuEvalCondition(
SHEMU_CONTEXT *Context,
ND_UINT8 ConditionCode
)
{
switch (ConditionCode)
{
case ND_COND_OVERFLOW: // O
if (GET_FLAG(Context, NDR_RFLAG_OF) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_OVERFLOW): // NO
if (GET_FLAG(Context, NDR_RFLAG_OF) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_CARRY: // C/B/NAE
if (GET_FLAG(Context, NDR_RFLAG_CF) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_CARRY): // NC/NB/AE
if (GET_FLAG(Context, NDR_RFLAG_CF) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_ZERO: // E/Z
if (GET_FLAG(Context, NDR_RFLAG_ZF) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_ZERO): // NE/NZ
if (GET_FLAG(Context, NDR_RFLAG_ZF) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_BELOW_OR_EQUAL: // BE/NA
if ((GET_FLAG(Context, NDR_RFLAG_CF) | (GET_FLAG(Context, NDR_RFLAG_ZF))) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_BELOW_OR_EQUAL): // A/NBE
if ((GET_FLAG(Context, NDR_RFLAG_CF) | (GET_FLAG(Context, NDR_RFLAG_ZF))) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_SIGN: // S
if (GET_FLAG(Context, NDR_RFLAG_SF) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_SIGN): // NS
if (GET_FLAG(Context, NDR_RFLAG_SF) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_PARITY: // P
if (GET_FLAG(Context, NDR_RFLAG_PF) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_PARITY): // NP
if (GET_FLAG(Context, NDR_RFLAG_PF) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_LESS: // L/NGE
if ((GET_FLAG(Context, NDR_RFLAG_SF) ^ GET_FLAG(Context, NDR_RFLAG_OF)) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_LESS): // NL/GE
if ((GET_FLAG(Context, NDR_RFLAG_SF) ^ GET_FLAG(Context, NDR_RFLAG_OF)) == 0)
{
return ND_TRUE;
}
break;
case ND_COND_LESS_OR_EQUAL: // LE/NG
if (((GET_FLAG(Context, NDR_RFLAG_SF) ^ GET_FLAG(Context, NDR_RFLAG_OF)) |
(GET_FLAG(Context, NDR_RFLAG_ZF))) == 1)
{
return ND_TRUE;
}
break;
case ND_COND_NOT(ND_COND_LESS_OR_EQUAL): // NLE/G
if (((GET_FLAG(Context, NDR_RFLAG_SF) ^ GET_FLAG(Context, NDR_RFLAG_OF)) |
(GET_FLAG(Context, NDR_RFLAG_ZF))) == 0)
{
return ND_TRUE;
}
break;
}
return ND_FALSE;
}
//
// ShemuIsShellcodePtr
//
inline static ND_BOOL
ShemuIsShellcodePtr(
SHEMU_CONTEXT *Context,
ND_UINT64 Gla,
ND_UINT32 Size
)
{
return (Gla >= Context->ShellcodeBase && Gla < Context->ShellcodeBase + Context->ShellcodeSize &&
Gla + Size > Context->ShellcodeBase && Gla + Size <= Context->ShellcodeBase + Context->ShellcodeSize);
}
//
// ShemuIsStackPtr
//
inline static ND_BOOL
ShemuIsStackPtr(
SHEMU_CONTEXT *Context,
ND_UINT64 Gla,
ND_UINT32 Size
)
{
return (Gla >= Context->StackBase && Gla < Context->StackBase + Context->StackSize &&
Gla + Size > Context->StackBase && Gla + Size <= Context->StackBase + Context->StackSize);
}
//
// ShemuGetGprValue
//
static ND_UINT64
ShemuGetGprValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg,
ND_UINT32 Size,
ND_BOOL High8
)
{
switch (Size)
{
case 1:
if (High8)
{
// AH, CH, DH or BH accessed.
return (*(&Context->Registers.RegRax + Reg - 4) >> 8) & 0xff;
}
else
{
return *(&Context->Registers.RegRax + Reg) & 0xff;
}
case 2:
return *(&Context->Registers.RegRax + Reg) & 0xffff;
case 4:
return *(&Context->Registers.RegRax + Reg) & 0xffffffff;
default:
return *(&Context->Registers.RegRax + Reg);
}
}
//
// ShemuGetGprValue
//
static void
ShemuSetGprValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg,
ND_UINT32 Size,
ND_UINT64 Value,
ND_BOOL High8
)
{
ND_UINT32 bit;
switch (Size)
{
case 1:
if (High8)
{
// AH, CH, DH or BH accessed.
*((ND_UINT8 *)(&Context->Registers.RegRax + Reg - 4) + 1) = Value & 0xFF;
}
else
{
*((ND_UINT8 *)(&Context->Registers.RegRax + Reg)) = Value & 0xff;
}
break;
case 2:
*((ND_UINT16 *)(&Context->Registers.RegRax + Reg)) = Value & 0xffff;
break;
case 4:
// Higher ND_UINT32 is always set to zero.
*(&Context->Registers.RegRax + Reg) = Value & 0xffffffff;
break;
default:
*(&Context->Registers.RegRax + Reg) = Value;
break;
}
if (High8)
{
bit = Reg - 4;
}
else
{
bit = Reg;
}
// Mark the GPR as being dirty/written.
Context->DirtyGprBitmap |= (1 << bit);
}
//
// ShemuCmpGprValue
//
static ND_BOOL
ShemuCmpGprValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg,
ND_UINT32 Size,
ND_UINT64 Value,
ND_BOOL High8
)
{
switch (Size)
{
case 1:
if (High8)
{
// AH, CH, DH or BH.
return *((ND_UINT8 *)(&Context->Registers.RegRax + Reg - 4) + 1) == (Value & 0xff);
}
else
{
return *((ND_UINT8 *)(&Context->Registers.RegRax + Reg)) == (Value & 0xff);
}
case 2:
return *((ND_UINT16 *)(&Context->Registers.RegRax + Reg)) == (Value & 0xffff);
case 4:
return *((ND_UINT32 *)(&Context->Registers.RegRax + Reg)) == (Value & 0xffffffff);
default:
return *(&Context->Registers.RegRax + Reg) == Value;
}
}
//
// ShemuGetSegValue
//
static ND_UINT64
ShemuGetSegValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg
)
{
switch (Reg)
{
case NDR_ES:
return Context->Segments.Es.Selector;
case NDR_CS:
return Context->Segments.Cs.Selector;
case NDR_SS:
return Context->Segments.Ss.Selector;
case NDR_DS:
return Context->Segments.Ds.Selector;
case NDR_FS:
return Context->Segments.Fs.Selector;
case NDR_GS:
return Context->Segments.Gs.Selector;
}
return 0;
}
//
// ShemuSetSegValue
//
static void
ShemuSetSegValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg,
ND_UINT16 Value
)
{
switch (Reg)
{
case NDR_ES:
Context->Segments.Es.Selector = Value;
break;
case NDR_CS:
Context->Segments.Cs.Selector = Value;
break;
case NDR_SS:
Context->Segments.Ss.Selector = Value;
break;
case NDR_DS:
Context->Segments.Ds.Selector = Value;
break;
case NDR_FS:
Context->Segments.Fs.Selector = Value;
break;
case NDR_GS:
Context->Segments.Gs.Selector = Value;
break;
}
}
//
// ShemuGetSegBase
//
static ND_UINT64
ShemuGetSegBase(
SHEMU_CONTEXT *Context,
ND_UINT32 Reg
)
{
switch (Reg)
{
case NDR_ES:
return Context->Segments.Es.Base;
case NDR_CS:
return Context->Segments.Cs.Base;
case NDR_SS:
return Context->Segments.Ss.Base;
case NDR_DS:
return Context->Segments.Ds.Base;
case NDR_FS:
return Context->Segments.Fs.Base;
case NDR_GS:
return Context->Segments.Gs.Base;
}
return 0;
}
//
// ShemuComputeLinearAddress
//
static ND_UINT64
ShemuComputeLinearAddress(
SHEMU_CONTEXT *Context,
PND_OPERAND Operand
)
{
ND_UINT64 gla = 0;
if (Operand->Info.Memory.HasBase)
{
gla += ShemuGetGprValue(Context, Operand->Info.Memory.Base, Operand->Info.Memory.BaseSize, ND_FALSE);
}
if (Operand->Info.Memory.HasIndex)
{
gla += ShemuGetGprValue(Context, Operand->Info.Memory.Index, Operand->Info.Memory.IndexSize, ND_FALSE) *
Operand->Info.Memory.Scale;
}
// Note that this also handles the case where moffset (absolute addressing) is used, as HasDisp will be set when
// IsDirect is also set.
if (Operand->Info.Memory.HasDisp)
{
gla += Operand->Info.Memory.Disp;
}
if (Operand->Info.Memory.IsRipRel)
{
gla += Context->Registers.RegRip;
}
// Special handling for BT, BTR, BTS, BTC instructions with bitbase addressing.
if (Operand->Info.Memory.IsBitbase)
{
ND_UINT64 bitbase, op1size, op2size, reg;
op1size = Context->Instruction.Operands[0].Size;
op2size = Context->Instruction.Operands[1].Size;
reg = ((ND_UINT64*)&Context->Registers.RegRax)[Context->Instruction.Operands[1].Info.Register.Reg];
// Note: only BT* with register source (NOT immediate) support bitbase addressing.
bitbase = ND_SIGN_EX(op2size, reg);
if (bitbase & (1ULL << 63))
{
gla -= ((~bitbase >> 3) & ~(op1size - 1)) + op1size;
}
else
{
gla += (bitbase >> 3) & ~(op1size - 1);
}
}
// Special handling for stack operations: if we have a PUSH, we have to subtract the accessed size, as, in fact,
// [RSP - size] is accessed, not [RSP].
if (Operand->Info.Memory.IsStack)
{
if (Operand->Access.Write || Operand->Access.CondWrite)
{
gla -= Operand->Size;
}
}
// Make sure we truncate the linear address to the address size.
switch (Context->Instruction.AddrMode)
{
case ND_ADDR_32:
gla &= 0xFFFFFFFF;
break;
case ND_ADDR_16:
gla &= 0xFFFF;
default:
break;
}
// Memory operands usually have a segment. Note that we don't care about any segment checks, since we're most
// likely be provided with flat segments. If checks should be needed, dedicated callbacks should be added.
if (Operand->Info.Memory.HasSeg)
{
gla += ShemuGetSegBase(Context, Operand->Info.Memory.Seg);
if (Context->Mode != ND_CODE_64)
{
// Truncate to 32 bit outside 64 bit.
gla &= 0xFFFFFFFF;
}
}
return gla;
}
//
// ShemuGetMemValue
//
static SHEMU_STATUS
ShemuGetMemValue(
SHEMU_CONTEXT *Context,
ND_UINT64 Gla,
ND_UINT32 Size,
ND_UINT8 *Value
)
{
ND_UINT8 *addr;
ND_UINT32 offset;
if (ShemuIsShellcodePtr(Context, Gla, Size))
{
addr = Context->Shellcode;
offset = (ND_UINT32)(Gla - Context->ShellcodeBase);
}
else if (ShemuIsStackPtr(Context, Gla, Size))
{
addr = Context->Stack;
offset = (ND_UINT32)(Gla - Context->StackBase);
}
else
{
ND_BOOL res = ND_FALSE;
// We allow a maximum number of external memory accesses, due to performance reasons.
if (++Context->ExtMemAccess > Context->MemThreshold)
{
return SHEMU_ABORT_GLA_OUTSIDE;
}
// NOTE: The accessed GLA may partially access an internal address (shellcode or stack) and an external address.
// Since the AccessMemory callback can be provided with the full SHEMU_CONTEXT, the integrator can choose how
// to handle those accesses; some options are:
// - Don't handle them at all, and return error (ND_FALSE);
// - Handle them by reading the actual memory value; this has the disadvantage that if the shellcode/stack
// portion has been modified due to emulation, the AccessMemory function would return the original memory
// value;
// - Handle them properly, by returning the emulated values for the internal addresses, and the external
// values for the external addresses.
// bdshemu does not care directly about this, and lets the integrator choose his own strategy.
if (ND_NULL != Context->AccessMemory)
{
res = Context->AccessMemory(Context, Gla, Size, Value, ND_FALSE);
}
if (res)
{
return SHEMU_SUCCESS;
}
return SHEMU_ABORT_GLA_OUTSIDE;
}
switch (Size)
{
case 1:
*Value = *(addr + offset);
break;
case 2:
*(ND_UINT16 *)Value = *(ND_UINT16 *)(addr + offset);
break;
case 4:
*(ND_UINT32 *)Value = *(ND_UINT32 *)(addr + offset);
break;
case 8:
*(ND_UINT64 *)Value = *(ND_UINT64 *)(addr + offset);
break;
default:
shemu_memcpy(Value, addr + offset, Size);
break;
}
return SHEMU_SUCCESS;
}
//
// ShemuSetMemValue
//
static SHEMU_STATUS
ShemuSetMemValue(
SHEMU_CONTEXT *Context,
ND_UINT64 Gla,
ND_UINT32 Size,
ND_UINT8 *Value
)
{
ND_UINT8 *addr;
ND_UINT32 offset;
if (ShemuIsShellcodePtr(Context, Gla, Size))
{
addr = Context->Shellcode;
offset = (ND_UINT32)(Gla - Context->ShellcodeBase);
// Bypass self-writes, if needed to.
if (!!(Context->Options & SHEMU_OPT_BYPASS_SELF_WRITES))
{
return SHEMU_SUCCESS;
}
}
else if (ShemuIsStackPtr(Context, Gla, Size))
{
addr = Context->Stack;
offset = (ND_UINT32)(Gla - Context->StackBase);
}
else
{
ND_BOOL res = ND_FALSE;
// We allow a maximum number of external memory accesses, due to performance reasons.
if (++Context->ExtMemAccess > Context->MemThreshold)
{
return SHEMU_ABORT_GLA_OUTSIDE;
}
// Handling external stores made by the shellcode can be done in a variety of ways by the integrator. Some
// of the solutions are:
// - Abort on external stores; this will cause the emulation to immediately stop;
// - Discard external stores; this is very simple, and it assumes that modified memory addresses will
// not be read later on by the shellcode;
// - Create a store-buffer like structure, where every external store is cached; when a load is issued on
// a previously written address, the value from the store-buffer can be returned;
// For obvious reasons, actually storing the value at the indicated address is a very, very bad idea.
if (ND_NULL != Context->AccessMemory)
{
res = Context->AccessMemory(Context, Gla, Size, Value, ND_TRUE);
}
if (res)
{
return SHEMU_SUCCESS;
}
return SHEMU_ABORT_GLA_OUTSIDE;
}
switch (Size)
{
case 1:
*(addr + offset) = *Value & 0xff;
break;
case 2:
*(ND_UINT16 *)(addr + offset) = *(ND_UINT16 *)Value & 0xffff;
break;
case 4:
*(ND_UINT32 *)(addr + offset) = *(ND_UINT32 *)Value & 0xffffffff;
break;
case 8:
*(ND_UINT64 *)(addr + offset) = *(ND_UINT64 *)Value;
break;
default:
shemu_memcpy(addr + offset, Value, Size);
break;
}
return SHEMU_SUCCESS;
}
//
// ShemuGetOperandValue
//
static SHEMU_STATUS
ShemuGetOperandValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Operand,
SHEMU_VALUE *Value
)
{
SHEMU_STATUS status;
PND_OPERAND op = &Context->Instruction.Operands[Operand];
Value->Size = op->Size;
if (Value->Size > sizeof(Value->Value))
{
return SHEMU_ABORT_OP_TOO_LARGE;
}
if (op->Type == ND_OP_REG)
{
switch (op->Info.Register.Type)
{
case ND_REG_GPR:
Value->Value.Qwords[0] = ShemuGetGprValue(Context, op->Info.Register.Reg, op->Size,
op->Info.Register.IsHigh8);
break;
case ND_REG_SEG:
Value->Value.Qwords[0] = ShemuGetSegValue(Context, op->Info.Register.Reg);
break;
case ND_REG_MMX:
Value->Value.Qwords[0] = Context->MmxRegisters[op->Info.Register.Reg];
break;
case ND_REG_SSE:
shemu_memcpy(Value->Value.Bytes,
&Context->SseRegisters[op->Info.Register.Reg],
op->Size);
break;
case ND_REG_RIP:
Value->Value.Qwords[0] = ND_TRIM(Value->Size, Context->Registers.RegRip);
break;
case ND_REG_FLG:
Value->Value.Qwords[0] = Context->Registers.RegFlags;
break;
case ND_REG_CR:
switch (op->Info.Register.Reg)
{
case NDR_CR0:
Value->Value.Qwords[0] = Context->Registers.RegCr0;
break;
case NDR_CR2:
Value->Value.Qwords[0] = Context->Registers.RegCr2;
break;
case NDR_CR3:
Value->Value.Qwords[0] = Context->Registers.RegCr3;
break;
case NDR_CR4:
Value->Value.Qwords[0] = Context->Registers.RegCr4;
break;
case NDR_CR8:
Value->Value.Qwords[0] = Context->Registers.RegCr8;
break;
default:
return SHEMU_ABORT_REGISTER_NOT_SUPPORTED;
}
break;
default:
return SHEMU_ABORT_REGISTER_NOT_SUPPORTED;
}
}
else if (op->Type == ND_OP_MEM)
{
ND_UINT64 gla = ShemuComputeLinearAddress(Context, op);
ND_UINT32 offset;
ND_UINT8 seg;
if (op->Info.Memory.IsAG)
{
// Address generation instruction, the result is the linear address itself.
Value->Value.Qwords[0] = gla;
goto done_gla;
}
if (Context->Ring == 3)
{
// User-mode TIB offset that contains the PEB address.
offset = Context->Mode == ND_CODE_32 ? 0x30 : 0x60;
seg = Context->Mode == ND_CODE_32 ? ND_PREFIX_G2_SEG_FS : ND_PREFIX_G2_SEG_GS;
}
else
{
// Kernel-mode KPCR offset that contains the current KTHREAD address.
offset = Context->Mode == ND_CODE_32 ? 0x124 : 0x188;
seg = Context->Mode == ND_CODE_32 ? ND_PREFIX_G2_SEG_FS : ND_PREFIX_G2_SEG_GS;
}
// Check if this is a TIB/PCR access. Make sure the FS/GS register is used for the access, in order to avoid
// ND_FALSE positives where legitimate code accesses a linear TIB directly.
// Note that this covers accesses to the PEB field inside the TIB.
if (gla == Context->TibBase + offset && Context->Instruction.Seg == seg)
{
Context->Flags |= SHEMU_FLAG_TIB_ACCESS;
}
// Note that this covers accesses to the Wow32Reserved in Wow64 mode. That field can be used to issue
// syscalls.
if (gla == Context->TibBase + 0xC0 && Context->Instruction.Seg == seg && Context->Mode == ND_CODE_32)
{
Context->Flags |= SHEMU_FLAG_TIB_ACCESS_WOW32;
}
// Check for accesses inside the KUSER_SHARED_DATA (SharedUserData). This page contains some
// global system information, it may host shellcodes, and is hard-coded at this address.
if (gla >= 0x7FFE0000 && gla < 0x7FFE1000)
{
Context->Flags |= SHEMU_FLAG_SUD_ACCESS;
}
// Check if we are reading a previously saved RIP. Ignore RET category, which naturally uses the saved RIP.
// Also, ignore RMW instruction which naturally read the current value - this could happen if the code
// modifies the return value, for example "ADD qword [rsp], r8".
if (Context->Instruction.Category != ND_CAT_RET && !(op->Access.Access & ND_ACCESS_ANY_WRITE) &&
ShemuIsStackPtr(Context, gla, op->Size) &&
ShemuAnyBitsSet(STACKBMP(Context), gla - Context->StackBase, op->Size))
{
Context->Flags |= SHEMU_FLAG_LOAD_RIP;
}
// Get the memory value.
status = ShemuGetMemValue(Context, gla, Value->Size, Value->Value.Bytes);
if (SHEMU_SUCCESS != status)
{
return status;
}
// If this is a stack access, we need to update the stack pointer.
if (op->Info.Memory.IsStack)
{
ND_UINT64 regval = ShemuGetGprValue(Context, NDR_RSP, (2 << Context->Instruction.DefStack), ND_FALSE);
regval += op->Size;
ShemuSetGprValue(Context, NDR_RSP, (2 << Context->Instruction.DefStack), regval, ND_FALSE);
}
// If this is a string operation, make sure we update RSI/RDI.
if (op->Info.Memory.IsString)
{
ND_UINT64 regval = ShemuGetGprValue(Context, op->Info.Memory.Base, op->Info.Memory.BaseSize, ND_FALSE);
regval = GET_FLAG(Context, NDR_RFLAG_DF) ? regval - op->Size : regval + op->Size;
ShemuSetGprValue(Context, op->Info.Memory.Base, op->Info.Memory.BaseSize, regval, ND_FALSE);
}
done_gla:;
}
else if (op->Type == ND_OP_IMM)
{
Value->Value.Qwords[0] = op->Info.Immediate.Imm;
}
else if (op->Type == ND_OP_CONST)
{
Value->Value.Qwords[0] = op->Info.Constant.Const;
}
else if (op->Type == ND_OP_OFFS)
{
Value->Value.Qwords[0] = op->Info.RelativeOffset.Rel;
}
else
{
return SHEMU_ABORT_UNSUPPORTED_INSTRUX;
}
return SHEMU_SUCCESS;
}
//
// ShemuSetOperandValue
//
static SHEMU_STATUS
ShemuSetOperandValue(
SHEMU_CONTEXT *Context,
ND_UINT32 Operand,
SHEMU_VALUE *Value
)
{
SHEMU_STATUS status;
PND_OPERAND op = &Context->Instruction.Operands[Operand];
if (op->Type == ND_OP_REG)
{
switch (op->Info.Register.Type)
{
case ND_REG_GPR:
if (Context->Instruction.Instruction == ND_INS_XCHG &&
op->Info.Register.Reg == NDR_RSP)
{
Context->Flags |= SHEMU_FLAG_STACK_PIVOT;
}
ShemuSetGprValue(Context, op->Info.Register.Reg, op->Size, Value->Value.Qwords[0],
op->Info.Register.IsHigh8);
break;
case ND_REG_SEG:
ShemuSetSegValue(Context, op->Info.Register.Reg, Value->Value.Words[0]);
break;
case ND_REG_MMX:
Context->MmxRegisters[op->Info.Register.Reg] = Value->Value.Qwords[0];
// Only log these when they're written.
if (Context->Options & SHEMU_OPT_TRACE_EMULATION)
{
shemu_printf(Context, " MM%d = 0x%016llx\n", op->Info.Register.Reg, Value->Value.Qwords[0]);
}
break;
case ND_REG_SSE:
// Zero the register first.
nd_memzero(&Context->SseRegisters[op->Info.Register.Reg], ND_MAX_REGISTER_SIZE);
// Copy the value.
shemu_memcpy(&Context->SseRegisters[op->Info.Register.Reg],
Value->Value.Bytes,
op->Size);
// Only log these when they're written.
if (Context->Options & SHEMU_OPT_TRACE_EMULATION)
{
shemu_printf(Context,
" %cMM%d (HI_32) = 0x%016llx%016llx%016llx%016llx\n",
op->Size == 16 ? 'X' : op->Size == 32 ? 'Y' : 'Z', op->Info.Register.Reg,
Value->Value.Qwords[7], Value->Value.Qwords[6],
Value->Value.Qwords[5], Value->Value.Qwords[4]);
shemu_printf(Context,
" %cMM%d (LO_32) = 0x%016llx%016llx%016llx%016llx\n",
op->Size == 16 ? 'X' : op->Size == 32 ? 'Y' : 'Z', op->Info.Register.Reg,
Value->Value.Qwords[3], Value->Value.Qwords[2],
Value->Value.Qwords[1], Value->Value.Qwords[0]);
}
break;
case ND_REG_RIP:
Context->Registers.RegRip = ND_TRIM(Value->Size, Value->Value.Qwords[0]);
break;
case ND_REG_FLG:
Context->Registers.RegFlags = ND_TRIM(Value->Size, Value->Value.Qwords[0]);
break;
case ND_REG_CR:
switch (op->Info.Register.Reg)
{
case NDR_CR0:
Context->Registers.RegCr0 = Value->Value.Qwords[0];
break;
case NDR_CR2:
Context->Registers.RegCr2 = Value->Value.Qwords[0];
break;
case NDR_CR3:
Context->Registers.RegCr3 = Value->Value.Qwords[0];
break;
case NDR_CR4:
Context->Registers.RegCr4 = Value->Value.Qwords[0];
break;
case NDR_CR8:
Context->Registers.RegCr8 = Value->Value.Qwords[0];
break;
default:
return SHEMU_ABORT_REGISTER_NOT_SUPPORTED;
}
break;
default:
return SHEMU_ABORT_REGISTER_NOT_SUPPORTED;
}
}
else if (op->Type == ND_OP_MEM)
{
// Compute the GLA.
ND_UINT64 gla = ShemuComputeLinearAddress(Context, op);
// Handle self-write. We store a 1 for each written byte inside the shellcode space. Once the modified bytes
// are executed, we can trigger the self-write detection.
if (ShemuIsShellcodePtr(Context, gla, op->Size))
{
ShemuSetBits(SHELLBMP(Context), gla - Context->ShellcodeBase, op->Size, 1);
}
// Handle RIP save on the stack.
if (ShemuIsStackPtr(Context, gla, MAX(op->Size, Context->Instruction.WordLength)))
{
ND_UINT8 stckstrlen = 0;
ND_UINT32 i;
// Note: only Context->Instruction.WordLength bits are flagged as RIP, as that is the RIP size.
if (Context->Instruction.Instruction == ND_INS_CALLNR ||
Context->Instruction.Instruction == ND_INS_CALLNI)
{
ShemuSetBits(STACKBMP(Context), gla - Context->StackBase, Context->Instruction.WordLength, 1);
}
else if (Context->Instruction.Instruction == ND_INS_FNSTENV)
{
// OK: op->Size will be the FPU state size.
ShemuSetBits(STACKBMP(Context), (gla + 0xC) - Context->StackBase, Context->Instruction.WordLength, 1);
}
else if (Context->Instruction.Instruction == ND_INS_FXSAVE ||
Context->Instruction.Instruction == ND_INS_FXSAVE64)
{
// OK: op->Size will be the FXSAVE size.
ShemuSetBits(STACKBMP(Context), (gla + 0x8) - Context->StackBase, Context->Instruction.WordLength, 1);
}
else
{
// Something is written on a previously saved RIP; reset it.
ShemuSetBits(STACKBMP(Context), gla - Context->StackBase, op->Size, 0);
}
// Check if a string is being saved on the stack. Typically used by shellcodes like this:
// PUSH str0
// PUSH str1
// ...
// PUSH strn
// Other variants may exist, but all we care about are stores on the stack, and all are checked.
// Note that we will ignore registers which have not been modified during emulation; those are considered
// input values for the emulated code, and may be pointers or other data. We are interested only in
// stack values built within the emulate code.
for (i = 0; i < Value->Size; i++)
{
unsigned char c = Value->Value.Bytes[i];
if ((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') ||
c == '\\' || c == '/' || c == ':' || c == ' ')
{
stckstrlen++;
}
else
{
break;
}
}
if (stckstrlen == Value->Size)
{
// Make sure the value is not present inside a non-dirty GPR.
for (i = 0; i < 16; i++)
{
if (ShemuCmpGprValue(Context, i, Value->Size, Value->Value.Qwords[0], ND_FALSE) &&
(0 == (Context->DirtyGprBitmap & (1 << i))))
{
// A register is saved on the stack, but that register wasn't written during the emulation.
stckstrlen = 0;
break;
}
}
}
Context->StrLength += stckstrlen;
if (Context->StrLength >= Context->StrThreshold)
{
Context->Flags |= SHEMU_FLAG_STACK_STR;
}
if (stckstrlen != Value->Size)
{
// Not a full string stored on the stack, reset the counter.
Context->StrLength = 0;
}
}
// Set the value.
status = ShemuSetMemValue(Context, gla, MIN(op->Size, Value->Size), Value->Value.Bytes);
if (SHEMU_SUCCESS != status)
{
return status;
}
// If this is a stack access, we need to update the stack pointer.
if (op->Info.Memory.IsStack)
{
ND_UINT64 regval = ShemuGetGprValue(Context, NDR_RSP, (2 << Context->Instruction.DefStack), ND_FALSE);
regval -= op->Size;
ShemuSetGprValue(Context, NDR_RSP, (2 << Context->Instruction.DefStack), regval, ND_FALSE);
}
// If this is a string operation, make sure we update RSI/RDI.
if (op->Info.Memory.IsString)
{
ND_UINT64 regval = ShemuGetGprValue(Context, op->Info.Memory.Base, op->Info.Memory.BaseSize, ND_FALSE);
regval = GET_FLAG(Context, NDR_RFLAG_DF) ? regval - op->Size : regval + op->Size;
ShemuSetGprValue(Context, op->Info.Memory.Base, op->Info.Memory.BaseSize, regval, ND_FALSE);
}
}
else
{
return SHEMU_ABORT_INVALID_INSTRUX;
}
return SHEMU_SUCCESS;
}
//
// ShemuMultiply64Unsigned
//
static void
ShemuMultiply64Unsigned(
ND_UINT64 Operand1,
ND_UINT64 Operand2,
ND_UINT64 *ResHigh,
ND_UINT64 *ResLow
)
{
ND_UINT64 xLow = (ND_UINT64)(ND_UINT32)Operand1;
ND_UINT64 xHigh = Operand1 >> 32;
ND_UINT64 yLow = (ND_UINT64)(ND_UINT32)Operand2;
ND_UINT64 yHigh = Operand2 >> 32;
ND_UINT64 p0 = xLow * yLow;
ND_UINT64 p1 = xLow * yHigh;
ND_UINT64 p2 = xHigh * yLow;
ND_UINT64 p3 = xHigh * yHigh;
ND_UINT32 cy = (ND_UINT32)(((p0 >> 32) + (ND_UINT32)p1 + (ND_UINT32)p2) >> 32);
*ResLow = p0 + (p1 << 32) + (p2 << 32);
*ResHigh = p3 + (p1 >> 32) + (p2 >> 32) + cy;
}
//
// ShemuMultiply64Signed
//
static void
ShemuMultiply64Signed(
ND_SINT64 Operand1,
ND_SINT64 Operand2,
ND_SINT64 *ResHigh,
ND_SINT64 *ResLow
)
{
ShemuMultiply64Unsigned((ND_UINT64)Operand1, (ND_UINT64)Operand2, (ND_UINT64 *)ResHigh, (ND_UINT64 *)ResLow);
if (Operand1 < 0LL) *ResHigh -= Operand2;
if (Operand2 < 0LL) *ResHigh -= Operand1;
}
//
// ShemuCheckDiv
//
static ND_BOOL
ShemuCheckDiv(
ND_UINT64 Divident,
ND_UINT64 Divider,
ND_UINT8 Size // The size of the Source (Divider). The Divident is twice as large.
)
{
// Returns ND_TRUE if all checks are OK, and Divident / Divider will not cause #DE.
if (Divider == 0)
{
// Division by zero.
return ND_FALSE;
}
// If the result won't fit in the destination, a #DE would be generated.
switch (Size)
{
case 1:
if (((Divident >> 8) & 0xFF) >= Divider)
{
return ND_FALSE;
}
break;
case 2:
if (((Divident >> 16) & 0xFFFF) >= Divider)
{
return ND_FALSE;
}
break;
case 4:
if (((Divident >> 32) & 0xFFFFFFFF) >= Divider)
{
return ND_FALSE;
}
break;
default:
// 64 bit source division is not supported.
return ND_FALSE;
}
return ND_TRUE;
}
//
// ShemuCheckIdiv
//
static ND_BOOL
ShemuCheckIdiv(
ND_SINT64 Divident,
ND_SINT64 Divider,
ND_UINT8 Size // The size of the Source (Divider).
)
{
ND_BOOL neg1, neg2;
ND_UINT64 quotient, max;
neg1 = Divident < 0;
neg2 = Divider < 0;
if (neg1)
{
Divident = -Divident;
}
if (neg2)
{
Divider = -Divider;
}
// Do checks when dividing positive values.
if (!ShemuCheckDiv(Divident, Divider, Size))
{
return ND_FALSE;
}
// Get the positive quotient.
quotient = (ND_UINT64)Divident / (ND_UINT64)Divider;
max = (Size == 1) ? 0x80 : (Size == 2) ? 0x8000 : (Size == 4) ? 0x80000000 : 0x8000000000000000;
if (neg1 ^ neg2)
{
// The Divident and the Divider have different signs, the quotient must be negative. If it's positive => #DE.
if (ND_GET_SIGN(Size, quotient) && quotient != max)
{
return ND_FALSE;
}
}
else
{
// Both the Divident and the Divider are positive/negative, so a positive result must be produced. If it's
// negative => #DE.
if (ND_GET_SIGN(Size, quotient))
{
return ND_FALSE;
}
}
return ND_TRUE;
}
//
// ShemuPrintContext
//
#ifndef BDDISASM_NO_FORMAT
static void
ShemuPrintContext(
SHEMU_CONTEXT *Context
)
{
char text[ND_MIN_BUF_SIZE] = { 0 };
NdToText(&Context->Instruction, Context->Registers.RegRip, ND_MIN_BUF_SIZE, text);
shemu_printf(Context, " RAX = 0x%016llx RCX = 0x%016llx RDX = 0x%016llx RBX = 0x%016llx\n",
Context->Registers.RegRax, Context->Registers.RegRcx, Context->Registers.RegRdx, Context->Registers.RegRbx);
shemu_printf(Context, " RSP = 0x%016llx RBP = 0x%016llx RSI = 0x%016llx RDI = 0x%016llx\n",
Context->Registers.RegRsp, Context->Registers.RegRbp, Context->Registers.RegRsi, Context->Registers.RegRdi);
shemu_printf(Context, " R8 = 0x%016llx R9 = 0x%016llx R10 = 0x%016llx R11 = 0x%016llx\n",
Context->Registers.RegR8, Context->Registers.RegR9, Context->Registers.RegR10, Context->Registers.RegR11);
shemu_printf(Context, " R12 = 0x%016llx R13 = 0x%016llx R14 = 0x%016llx R15 = 0x%016llx\n",
Context->Registers.RegR12, Context->Registers.RegR13, Context->Registers.RegR14, Context->Registers.RegR15);
shemu_printf(Context, " RIP = 0x%016llx RFLAGS = 0x%016llx ",
Context->Registers.RegRip, Context->Registers.RegFlags);
shemu_printf(Context, " CF:%d PF:%d AF:%d ZF:%d SF:%d TF:%d IF:%d DF:%d OF:%d\n",
GET_FLAG(Context, NDR_RFLAG_CF),
GET_FLAG(Context, NDR_RFLAG_PF),
GET_FLAG(Context, NDR_RFLAG_AF),
GET_FLAG(Context, NDR_RFLAG_ZF),
GET_FLAG(Context, NDR_RFLAG_SF),
GET_FLAG(Context, NDR_RFLAG_TF),
GET_FLAG(Context, NDR_RFLAG_IF),
GET_FLAG(Context, NDR_RFLAG_DF),
GET_FLAG(Context, NDR_RFLAG_OF));
shemu_printf(Context, "Emulating: 0x%016llx %s\n", Context->Registers.RegRip, text);
}
#else
#define ShemuPrintContext(Context)
#endif // !BDDISASM_NO_FORMAT
//
// ShemuEmulate
//
SHEMU_STATUS
ShemuEmulate(
SHEMU_CONTEXT *Context
)
{
SHEMU_VALUE res = { 0 }, dst = { 0 }, src = { 0 }, rcx = { 0 }, aux = { 0 };
ND_BOOL stop = ND_FALSE, cf;
ND_UINT16 cs = 0;
ND_UINT64 tsc = 0x1248fe7a5c30;
if (ND_NULL == Context)
{
return SHEMU_ABORT_INVALID_PARAMETER;
}
if (ND_NULL == Context->Shellcode)
{
return SHEMU_ABORT_INVALID_PARAMETER;
}
if (ND_NULL == Context->Stack)
{
return SHEMU_ABORT_INVALID_PARAMETER;
}
if (ND_NULL == Context->Intbuf)
{
return SHEMU_ABORT_INVALID_PARAMETER;
}
if (SHEMU_INTERNAL_BUFFER_SIZE(Context) > Context->IntbufSize)
{
return SHEMU_ABORT_INVALID_PARAMETER;
}
if (Context->NopThreshold == 0)
{
Context->NopThreshold = SHEMU_DEFAULT_NOP_THRESHOLD;
}
if (Context->StrThreshold == 0)
{
Context->StrThreshold = SHEMU_DEFAULT_STR_THRESHOLD;
}
while (Context->InstructionsCount++ < Context->MaxInstructionsCount)
{
NDSTATUS ndstatus;
ND_UINT64 rip;
ND_UINT32 i;
tsc++;
// Reset all the operands to 0.
nd_memzero(&dst, sizeof(dst));
nd_memzero(&src, sizeof(src));
nd_memzero(&res, sizeof(res));
nd_memzero(&aux, sizeof(aux));
nd_memzero(&rcx, sizeof(rcx));
// The stop flag has been set, this means we've reached a valid instruction, but that instruction cannot be
// emulated (for example, SYSCALL, INT, system instructions, etc).
if (stop)
{
return SHEMU_ABORT_CANT_EMULATE;
}
// If we already have a detection and we wish to stop on detections, do so now.
if ((0 != Context->Flags) && (0 != (Context->Options & SHEMU_OPT_STOP_ON_EXPLOIT)))
{
return SHEMU_ABORT_SHELLCODE_DETECTED;
}
// Make sure the RIP is pointing in the right area. We test only 1 byte - the decoder will make sure it can
// access as many bytes as needed and return error in case it can't.
if (!ShemuIsShellcodePtr(Context, Context->Registers.RegRip, 1))
{
return SHEMU_ABORT_BRANCH_OUTSIDE;
}
// Get the offset inside the shellcode buffer.
rip = Context->Registers.RegRip - Context->ShellcodeBase;
// Decode the next instruction.
ndstatus = NdDecodeEx(&Context->Instruction, Context->Shellcode + rip,
Context->ShellcodeSize - (ND_SIZET)rip, Context->Mode, Context->Mode);
if (!ND_SUCCESS(ndstatus))
{
if (ND_STATUS_BUFFER_TOO_SMALL == ndstatus)
{
return SHEMU_ABORT_BRANCH_OUTSIDE;
}
else
{
return SHEMU_ABORT_INVALID_INSTRUX;
}
}
// Paranoid check...
if (!ShemuIsShellcodePtr(Context, Context->Registers.RegRip, Context->Instruction.Length))
{
return SHEMU_ABORT_BRANCH_OUTSIDE;
}
// Check if we just fetched an instruction from a previously written area, to raise self-write alert.
if (ShemuAnyBitsSet(SHELLBMP(Context), rip, Context->Instruction.Length))
{
Context->Flags |= SHEMU_FLAG_WRITE_SELF;
}
// Dump the context.
if (Context->Options & SHEMU_OPT_TRACE_EMULATION)
{
ShemuPrintContext(Context);
}
// The RIP is incremented BEFORE actually emulating the instruction. This is what the CPU does as well.
Context->Registers.RegRip += Context->Instruction.Length;
// FPU instructions are "pass-through", we just want to save the RIP, so we can emulate FNSTENV.
if ((Context->Instruction.IsaSet == ND_SET_X87) && (Context->Instruction.Instruction != ND_INS_FNSTENV))
{
Context->Registers.FpuRip = Context->Registers.RegRip - Context->Instruction.Length;
continue;
}
switch (Context->Instruction.Instruction)
{
case ND_INS_FNSTENV:
src.Size = Context->Instruction.Operands[0].Size;
src.Value.FpuEnvironment.FpuInstructionPointer = (ND_UINT32)Context->Registers.FpuRip;
SET_OP(Context, 0, &src);
break;
case ND_INS_FXSAVE:
case ND_INS_FXSAVE64:
src.Size = MIN(Context->Instruction.Operands[0].Size, sizeof(src.Value.XsaveArea));
src.Value.XsaveArea.FpuRip = Context->Registers.FpuRip;
SET_OP(Context, 0, &src);
break;
case ND_INS_MOV_CR:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
// Fall through.
case ND_INS_MOV:
case ND_INS_MOVZX:
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_MOVSX:
case ND_INS_MOVSXD:
GET_OP(Context, 1, &src);
GET_OP(Context, 0, &dst);
dst.Value.Qwords[0] = ND_SIGN_EX(src.Size, src.Value.Qwords[0]);
SET_OP(Context, 0, &dst);
break;
case ND_INS_CMOVcc:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
if (ShemuEvalCondition(Context, Context->Instruction.Condition))
{
SET_OP(Context, 0, &src);
}
else
{
// Write back the same value that was already present in destination. This has the side-effect of
// clearing the upper 32 bit in the 64 bit destination register while in long mode.
SET_OP(Context, 0, &dst);
}
break;
case ND_INS_SETcc:
if (ShemuEvalCondition(Context, Context->Instruction.Condition))
{
src.Size = Context->Instruction.Operands[0].Size;
src.Value.Qwords[0] = 1;
}
else
{
src.Size = Context->Instruction.Operands[0].Size;
src.Value.Qwords[0] = 0;
}
SET_OP(Context, 0, &src);
break;
case ND_INS_XLATB:
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_XCHG:
GET_OP(Context, 1, &src);
GET_OP(Context, 0, &dst);
SET_OP(Context, 1, &dst);
SET_OP(Context, 0, &src);
break;
case ND_INS_XADD:
GET_OP(Context, 1, &src);
GET_OP(Context, 0, &dst);
res.Size = dst.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] + src.Value.Qwords[0];
SET_FLAGS(Context, res, dst, src, FM_ADD);
SET_OP(Context, 1, &dst);
SET_OP(Context, 0, &res);
break;
case ND_INS_CMPXCHG:
GET_OP(Context, 2, &src);
GET_OP(Context, 0, &dst);
res.Size = src.Size;
// Note: The accumulator is compared with the destination, not the other way around.
res.Value.Qwords[0] = src.Value.Qwords[0] - dst.Value.Qwords[0];
SET_FLAGS(Context, res, src, dst, FM_SUB);
if (src.Value.Qwords[0] == dst.Value.Qwords[0])
{
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
}
else
{
SET_OP(Context, 2, &dst);
}
break;
case ND_INS_ADD:
case ND_INS_ADC:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = src.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] + src.Value.Qwords[0];
if (ND_INS_ADC == Context->Instruction.Instruction)
{
res.Value.Qwords[0] += GET_FLAG(Context, NDR_RFLAG_CF);
}
SET_FLAGS(Context, res, dst, src, FM_ADD);
SET_OP(Context, 0, &res);
break;
case ND_INS_SUB:
case ND_INS_SBB:
case ND_INS_CMP:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = src.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] - src.Value.Qwords[0];
if (ND_INS_SBB == Context->Instruction.Instruction)
{
res.Value.Qwords[0] -= GET_FLAG(Context, NDR_RFLAG_CF);
}
SET_FLAGS(Context, res, dst, src, FM_SUB);
if (ND_INS_CMP != Context->Instruction.Instruction)
{
SET_OP(Context, 0, &res);
}
break;
case ND_INS_INC:
GET_OP(Context, 0, &dst);
src.Size = dst.Size;
src.Value.Qwords[0] = 1;
res.Size = src.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] + src.Value.Qwords[0];
cf = GET_FLAG(Context, NDR_RFLAG_CF);
SET_FLAGS(Context, res, dst, src, FM_ADD);
SET_FLAG(Context, NDR_RFLAG_CF, cf);
SET_OP(Context, 0, &res);
break;
case ND_INS_DEC:
GET_OP(Context, 0, &dst);
src.Size = dst.Size;
src.Value.Qwords[0] = 1;
res.Size = src.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] - src.Value.Qwords[0];
cf = GET_FLAG(Context, NDR_RFLAG_CF);
SET_FLAGS(Context, res, dst, src, FM_SUB);
SET_FLAG(Context, NDR_RFLAG_CF, cf);
SET_OP(Context, 0, &res);
break;
case ND_INS_PUSH:
case ND_INS_PUSHF:
GET_OP(Context, 0, &src);
SET_OP(Context, 1, &src);
break;
case ND_INS_POP:
case ND_INS_POPF:
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_PUSHA:
case ND_INS_PUSHAD:
src.Size = 32;
src.Value.Dwords[7] = (ND_UINT32)Context->Registers.RegRax;
src.Value.Dwords[6] = (ND_UINT32)Context->Registers.RegRcx;
src.Value.Dwords[5] = (ND_UINT32)Context->Registers.RegRdx;
src.Value.Dwords[4] = (ND_UINT32)Context->Registers.RegRbx;
src.Value.Dwords[3] = (ND_UINT32)Context->Registers.RegRsp;
src.Value.Dwords[2] = (ND_UINT32)Context->Registers.RegRbp;
src.Value.Dwords[1] = (ND_UINT32)Context->Registers.RegRsi;
src.Value.Dwords[0] = (ND_UINT32)Context->Registers.RegRdi;
SET_OP(Context, 1, &src);
break;
case ND_INS_POPA:
case ND_INS_POPAD:
GET_OP(Context, 1, &src);
Context->Registers.RegRax = src.Value.Dwords[7];
Context->Registers.RegRcx = src.Value.Dwords[6];
Context->Registers.RegRdx = src.Value.Dwords[5];
Context->Registers.RegRbx = src.Value.Dwords[4];
Context->Registers.RegRsp = src.Value.Dwords[3];
Context->Registers.RegRbp = src.Value.Dwords[2];
Context->Registers.RegRsi = src.Value.Dwords[1];
Context->Registers.RegRdi = src.Value.Dwords[0];
break;
case ND_INS_LEA:
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_SHL:
case ND_INS_SAL:
case ND_INS_SHR:
case ND_INS_SAR:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
if (dst.Size == 8)
{
src.Value.Qwords[0] &= 0x3f;
}
else
{
src.Value.Qwords[0] &= 0x1f;
}
res.Size = dst.Size;
if (ND_INS_SHL == Context->Instruction.Instruction ||
ND_INS_SAL == Context->Instruction.Instruction)
{
res.Value.Qwords[0] = dst.Value.Qwords[0] << src.Value.Qwords[0];
}
else if (ND_INS_SHR == Context->Instruction.Instruction)
{
res.Value.Qwords[0] = dst.Value.Qwords[0] >> src.Value.Qwords[0];
}
else
{
ND_SINT64 val = ND_SIGN_EX(dst.Size, dst.Value.Qwords[0]);
val = val >> src.Value.Qwords[0];
res.Value.Qwords[0] = (ND_UINT64)val;
}
if (src.Value.Qwords[0] != 0)
{
// 0 bit shifts do not affect the flags.
if (ND_INS_SHL == Context->Instruction.Instruction ||
ND_INS_SAL == Context->Instruction.Instruction)
{
SET_FLAGS(Context, res, dst, src, FM_SHL);
}
else if (ND_INS_SHR == Context->Instruction.Instruction)
{
SET_FLAGS(Context, res, dst, src, FM_SHR);
}
else
{
SET_FLAGS(Context, res, dst, src, FM_SAR);
}
}
SET_OP(Context, 0, &res);
break;
case ND_INS_RCL:
case ND_INS_RCR:
case ND_INS_ROL:
case ND_INS_ROR:
{
ND_UINT32 cnt, tempcnt, cntmask;
ND_UINT8 tempCF = 0;
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
cnt = (ND_UINT32)src.Value.Qwords[0];
tempcnt = 0;
cntmask = ((dst.Size == 8) ? 0x3F : 0x1F);
if (ND_INS_RCL == Context->Instruction.Instruction ||
ND_INS_RCR == Context->Instruction.Instruction)
{
switch (dst.Size)
{
case 1: tempcnt = (cnt & 0x1F) % 9; break;
case 2: tempcnt = (cnt & 0x1F) % 17; break;
case 4: tempcnt = (cnt & 0x1F); break;
case 8: tempcnt = (cnt & 0x3F); break;
default: break;
}
}
else
{
tempcnt = (cnt & cntmask) % (dst.Size * 8);
}
if (ND_INS_RCL == Context->Instruction.Instruction)
{
while (tempcnt != 0)
{
tempCF = ND_MSB(dst.Size, dst.Value.Qwords[0]);
dst.Value.Qwords[0] = (dst.Value.Qwords[0] << 1) + GET_FLAG(Context, NDR_RFLAG_CF);
SET_FLAG(Context, NDR_RFLAG_CF, tempCF);
tempcnt--;
}
if ((cnt & cntmask) == 1)
{
SET_FLAG(Context, NDR_RFLAG_OF, ND_MSB(dst.Size, dst.Value.Qwords[0]) ^
GET_FLAG(Context, NDR_RFLAG_CF));
}
}
else if (ND_INS_RCR == Context->Instruction.Instruction)
{
if ((cnt & cntmask) == 1)
{
SET_FLAG(Context, NDR_RFLAG_OF, ND_MSB(dst.Size, dst.Value.Qwords[0]) ^
GET_FLAG(Context, NDR_RFLAG_CF));
}
while (tempcnt != 0)
{
tempCF = ND_LSB(dst.Size, dst.Value.Qwords[0]);
dst.Value.Qwords[0] = (dst.Value.Qwords[0] >> 1) +
((ND_UINT64)GET_FLAG(Context, NDR_RFLAG_CF) << (dst.Size * 8 - 1));
SET_FLAG(Context, NDR_RFLAG_CF, tempCF);
tempcnt--;
}
}
else if (ND_INS_ROL == Context->Instruction.Instruction)
{
while (tempcnt != 0)
{
tempCF = ND_MSB(dst.Size, dst.Value.Qwords[0]);
dst.Value.Qwords[0] = (dst.Value.Qwords[0] << 1) + tempCF;
tempcnt--;
}
if ((cnt & cntmask) != 0)
{
SET_FLAG(Context, NDR_RFLAG_CF, dst.Value.Qwords[0] & 1);
}
if ((cnt & cntmask) == 1)
{
SET_FLAG(Context, NDR_RFLAG_OF, ND_MSB(dst.Size, dst.Value.Qwords[0]) ^
GET_FLAG(Context, NDR_RFLAG_CF));
}
}
else // ND_INS_ROR
{
while (tempcnt != 0)
{
tempCF = ND_LSB(dst.Size, dst.Value.Qwords[0]);
dst.Value.Qwords[0] = (dst.Value.Qwords[0] >> 1) + ((ND_UINT64)tempCF << (dst.Size * 8 - 1));
tempcnt--;
}
if ((cnt & cntmask) != 0)
{
SET_FLAG(Context, NDR_RFLAG_CF, ND_MSB(dst.Size, dst.Value.Qwords[0]));
}
if ((cnt & cntmask) == 1)
{
SET_FLAG(Context, NDR_RFLAG_OF, ND_MSB(dst.Size, dst.Value.Qwords[0]) ^ ND_GET_BIT(dst.Size * 8ULL - 2, dst.Value.Qwords[0]));
}
}
SET_OP(Context, 0, &dst);
}
break;
case ND_INS_OR:
case ND_INS_XOR:
case ND_INS_AND:
case ND_INS_TEST:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = dst.Size;
if (ND_INS_OR == Context->Instruction.Instruction)
{
res.Value.Qwords[0] = dst.Value.Qwords[0] | src.Value.Qwords[0];
}
else if (ND_INS_XOR == Context->Instruction.Instruction)
{
res.Value.Qwords[0] = dst.Value.Qwords[0] ^ src.Value.Qwords[0];
}
else
{
res.Value.Qwords[0] = dst.Value.Qwords[0] & src.Value.Qwords[0];
}
if (ND_INS_TEST != Context->Instruction.Instruction)
{
SET_OP(Context, 0, &res);
}
SET_FLAGS(Context, res, dst, src, FM_LOGIC);
break;
case ND_INS_NOT:
GET_OP(Context, 0, &dst);
dst.Value.Qwords[0] = ~dst.Value.Qwords[0];
SET_OP(Context, 0, &dst);
break;
case ND_INS_NEG:
GET_OP(Context, 0, &src);
dst.Size = src.Size;
dst.Value.Qwords[0] = 0;
res.Size = src.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] - src.Value.Qwords[0];
SET_OP(Context, 0, &res);
SET_FLAGS(Context, res, dst, src, FM_SUB);
SET_FLAG(Context, NDR_RFLAG_CF, src.Value.Qwords[0] != 0);
break;
case ND_INS_BT:
case ND_INS_BTS:
case ND_INS_BTR:
case ND_INS_BTC:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
src.Value.Qwords[0] %= dst.Size * 8ULL;
// Store the bit inside CF.
SET_FLAG(Context, NDR_RFLAG_CF, (dst.Value.Qwords[0] >> src.Value.Qwords[0]) & 1);
if (ND_INS_BTS == Context->Instruction.Instruction)
{
dst.Value.Qwords[0] |= (1ULL << src.Value.Qwords[0]);
}
else if (ND_INS_BTR == Context->Instruction.Instruction)
{
dst.Value.Qwords[0] &= ~(1ULL << src.Value.Qwords[0]);
}
else if (ND_INS_BTC == Context->Instruction.Instruction)
{
dst.Value.Qwords[0] ^= (1ULL << src.Value.Qwords[0]);
}
if (ND_INS_BT != Context->Instruction.Instruction)
{
SET_OP(Context, 0, &dst);
}
break;
case ND_INS_Jcc:
if (ShemuEvalCondition(Context, Context->Instruction.Condition))
{
// Modify the RIP if the branch is taken.
GET_OP(Context, 1, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.RelativeOffset.Rel;
SET_OP(Context, 1, &aux);
}
break;
case ND_INS_JrCXZ:
// Fetch the rCX value. It could be CX, ECX or RCX, depending on address size.
GET_OP(Context, 1, &rcx);
if (rcx.Value.Qwords[0] == 0)
{
// Modify the RIP if the branch is taken.
GET_OP(Context, 2, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.RelativeOffset.Rel;
SET_OP(Context, 2, &aux);
}
break;
case ND_INS_LOOP:
case ND_INS_LOOPNZ:
case ND_INS_LOOPZ:
// rCX is decremented first. Note that the size depends on address size.
GET_OP(Context, 1, &rcx);
rcx.Value.Qwords[0]--;
SET_OP(Context, 1, &rcx);
if (rcx.Value.Qwords[0] > 0)
{
if (((ND_INS_LOOPNZ == Context->Instruction.Instruction) && (0 == GET_FLAG(Context, NDR_RFLAG_ZF))) ||
((ND_INS_LOOPZ == Context->Instruction.Instruction) && (0 != GET_FLAG(Context, NDR_RFLAG_ZF))) ||
(ND_INS_LOOP == Context->Instruction.Instruction))
{
// Modify the RIP if the branch is taken.
GET_OP(Context, 2, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.RelativeOffset.Rel;
SET_OP(Context, 2, &aux);
}
}
break;
case ND_INS_JMPNR:
GET_OP(Context, 1, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.RelativeOffset.Rel;
SET_OP(Context, 1, &aux);
break;
case ND_INS_JMPNI:
GET_OP(Context, 0, &src);
SET_OP(Context, 1, &src); // Set the RIP to the new value.
break;
case ND_INS_CALLNR:
// Save the EIP on the stack.
GET_OP(Context, 1, &aux);
SET_OP(Context, 2, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.RelativeOffset.Rel;
SET_OP(Context, 1, &aux);
break;
case ND_INS_CALLNI:
GET_OP(Context, 0, &src);
GET_OP(Context, 1, &dst); // The RIP
SET_OP(Context, 2, &dst); // Save the RIP on the stack.
SET_OP(Context, 1, &src); // Set the RIP to the new value.
break;
case ND_INS_RETN:
if (!Context->Instruction.HasImm1)
{
// The simple RET form, 0xC3
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
}
else
{
// The RET Imm16 form, 0xC2
GET_OP(Context, 3, &src);
SET_OP(Context, 1, &src);
// Patch the RSP register.
GET_OP(Context, 2, &aux);
aux.Value.Qwords[0] += Context->Instruction.Operands[0].Info.Immediate.Imm;
SET_OP(Context, 2, &aux);
}
break;
case ND_INS_JMPFD:
case ND_INS_CALLFD:
cs = (ND_UINT16)Context->Instruction.Operands[0].Info.Address.BaseSeg;
goto check_far_branch;
case ND_INS_JMPFI:
case ND_INS_CALLFI:
case ND_INS_IRET:
case ND_INS_RETF:
if (Context->Instruction.Instruction == ND_INS_RETF)
{
if (Context->Instruction.Operands[0].Type == ND_OP_IMM)
{
// RETF imm
GET_OP(Context, 3, &src);
}
else
{
// RETF
GET_OP(Context, 2, &src);
}
}
else if (Context->Instruction.Instruction == ND_INS_IRET)
{
// IRET
GET_OP(Context, 2, &src);
}
else
{
// JMP/CALL far
GET_OP(Context, 0, &src);
}
// The destination code segment is the second WORD/DWORD/QWORD.
switch (Context->Instruction.WordLength)
{
case 2:
cs = (ND_UINT16)src.Value.Words[1];
break;
case 4:
cs = (ND_UINT16)src.Value.Dwords[1];
break;
case 8:
cs = (ND_UINT16)src.Value.Qwords[1];
break;
default:
cs = 0;
break;
}
check_far_branch:
if (Context->Mode == ND_CODE_32 && cs == 0x33)
{
Context->Flags |= SHEMU_FLAG_HEAVENS_GATE;
}
// We may, in the future, emulate far branches, but they imply some tricky context switches (including
// the default TEB), so it may not be as straight forward as it seems. For now, all we wish to achieve
// is detection of far branches in long-mode, from Wow 64.
stop = ND_TRUE;
break;
case ND_INS_LODS:
case ND_INS_STOS:
case ND_INS_MOVS:
// Fetch the rCX register, which is the third operand in case of repeated instructions.
while (Context->InstructionsCount < Context->MaxInstructionsCount)
{
GET_OP(Context, 2, &rcx);
if (Context->Instruction.IsRepeated && (rcx.Value.Qwords[0] == 0))
{
break;
}
// Load the source into the destination.
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
if (Context->Instruction.IsRepeated)
{
// Decrement RCX.
rcx.Value.Qwords[0]--;
SET_OP(Context, 2, &rcx);
}
else
{
break;
}
Context->InstructionsCount++;
}
break;
case ND_INS_SCAS:
case ND_INS_CMPS:
while (Context->InstructionsCount < Context->MaxInstructionsCount)
{
GET_OP(Context, 2, &rcx);
if (Context->Instruction.IsRepeated && (rcx.Value.Qwords[0] == 0))
{
break;
}
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = dst.Size;
res.Value.Qwords[0] = dst.Value.Qwords[0] - src.Value.Qwords[0];
ShemuSetFlags(Context, res.Value.Qwords[0], dst.Value.Qwords[0], src.Value.Qwords[0], res.Size, FM_SUB);
if (Context->Instruction.IsRepeated)
{
// Decrement RCX.
rcx.Value.Qwords[0]--;
SET_OP(Context, 2, &rcx);
if (Context->Instruction.HasRepRepzXrelease && !GET_FLAG(Context, NDR_RFLAG_ZF))
{
break;
}
if (Context->Instruction.HasRepnzXacquireBnd && GET_FLAG(Context, NDR_RFLAG_ZF))
{
break;
}
}
else
{
break;
}
Context->InstructionsCount++;
}
break;
case ND_INS_MUL:
case ND_INS_IMUL:
if (Context->Instruction.ExpOperandsCount == 1)
{
// MUL or IMUL with a single explicit operand.
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = dst.Size * 2;
}
else if (Context->Instruction.ExpOperandsCount == 2)
{
// IMUL with 2 explicit operands.
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
res.Size = dst.Size;
}
else
{
// IMUL with 3 operands. The first operand is the write-only destination.
GET_OP(Context, 1, &dst);
GET_OP(Context, 2, &src);
res.Size = dst.Size;
}
if (dst.Size == 1)
{
if (ND_INS_MUL == Context->Instruction.Instruction)
{
res.Value.Words[0] = dst.Value.Bytes[0] * src.Value.Bytes[0];
}
else
{
res.Value.Words[0] = (ND_SINT8)dst.Value.Bytes[0] * (ND_SINT8)src.Value.Bytes[0];
}
}
else if (dst.Size == 2)
{
if (ND_INS_MUL == Context->Instruction.Instruction)
{
res.Value.Dwords[0] = dst.Value.Words[0] * src.Value.Words[0];
}
else
{
res.Value.Dwords[0] = (ND_SINT16)dst.Value.Words[0] * (ND_SINT16)src.Value.Words[0];
}
}
else if (dst.Size == 4)
{
if (ND_INS_MUL == Context->Instruction.Instruction)
{
res.Value.Qwords[0] = dst.Value.Qwords[0] * src.Value.Qwords[0];
}
else
{
res.Value.Qwords[0] = (ND_SINT64)(ND_SINT32)dst.Value.Dwords[0] * (ND_SINT64)(ND_SINT32)src.Value.Dwords[0];
}
}
else
{
if (ND_INS_MUL == Context->Instruction.Instruction)
{
ShemuMultiply64Unsigned(dst.Value.Qwords[0], src.Value.Qwords[0],
&res.Value.Qwords[1], &res.Value.Qwords[0]);
}
else
{
ShemuMultiply64Signed(dst.Value.Qwords[0], src.Value.Qwords[0],
(ND_SINT64*)&res.Value.Qwords[1], (ND_SINT64*)&res.Value.Qwords[0]);
}
}
if (Context->Instruction.ExpOperandsCount == 1)
{
// The result is stored in AX, DX:AX, EDX:EAX or RDX:RAX for the single-operand form.
switch (dst.Size)
{
case 1:
*((ND_UINT16*)&Context->Registers.RegRax) = res.Value.Words[0];
break;
case 2:
*((ND_UINT16*)&Context->Registers.RegRdx) = res.Value.Words[1];
*((ND_UINT16*)&Context->Registers.RegRax) = res.Value.Words[0];
break;
case 4:
Context->Registers.RegRdx = res.Value.Dwords[1];
Context->Registers.RegRax = res.Value.Dwords[0];
break;
case 8:
Context->Registers.RegRdx = res.Value.Qwords[1];
Context->Registers.RegRax = res.Value.Qwords[0];
break;
}
}
else
{
// The result is truncated and stored in the destination operand for the 2 & 3 operands forms.
SET_OP(Context, 0, &res);
}
// Set the flags.
if (ND_INS_MUL == Context->Instruction.Instruction)
{
ND_UINT8 cfof = 0;
// CF and OF are set to 0 if the high part of the result is 0, otherwise they are set to 1.
switch (dst.Size)
{
case 1:
cfof = (0 == res.Value.Bytes[1]) ? 0 : 1;
break;
case 2:
cfof = (0 == res.Value.Words[1]) ? 0 : 1;
break;
case 4:
cfof = (0 == res.Value.Dwords[1]) ? 0 : 1;
break;
case 8:
cfof = (0 == res.Value.Qwords[1]) ? 0 : 1;
break;
}
SET_FLAG(Context, NDR_RFLAG_CF, cfof);
SET_FLAG(Context, NDR_RFLAG_OF, cfof);
}
else
{
// The CF and OF flags are set when the signed integer value of the intermediate product differs from
// the sign extended operand - size - truncated product, otherwise the CF and OF flags are cleared.
ND_UINT8 cfof = 0, sign = 0;
sign = ND_MSB(dst.Size, res.Value.Qwords[0]);
switch (dst.Size)
{
case 1:
cfof = (0 == res.Value.Bytes[1] && 0 == sign) ||
((ND_UINT8)-1 == res.Value.Bytes[1] && 1 == sign) ? 0 : 1;
break;
case 2:
cfof = (0 == res.Value.Words[1] && 0 == sign) ||
((ND_UINT16)-1 == res.Value.Words[1] && 1 == sign) ? 0 : 1;
break;
case 4:
cfof = (0 == res.Value.Dwords[1] && 0 == sign) ||
((ND_UINT32)-1 == res.Value.Dwords[1] && 1 == sign) ? 0 : 1;
break;
case 8:
cfof = (0 == res.Value.Qwords[1] && 0 == sign) ||
((ND_UINT64)-1 == res.Value.Qwords[1] && 1 == sign) ? 0 : 1;
break;
}
SET_FLAG(Context, NDR_RFLAG_CF, cfof);
SET_FLAG(Context, NDR_RFLAG_OF, cfof);
}
break;
case ND_INS_DIV:
case ND_INS_IDIV:
// DIV and IDIV only exist with a single explicit operand encoding. All flags are undefined.
GET_OP(Context, 0, &src);
if (src.Size == 1)
{
ND_UINT16 divident;
divident = (ND_UINT16)Context->Registers.RegRax;
if (ND_INS_DIV == Context->Instruction.Instruction)
{
if (!ShemuCheckDiv(divident, src.Value.Bytes[0], 1))
{
stop = ND_TRUE;
break;
}
res.Value.Bytes[0] = (ND_UINT8)(divident / src.Value.Bytes[0]);
res.Value.Bytes[1] = (ND_UINT8)(divident % src.Value.Bytes[0]);
}
else
{
if (!ShemuCheckIdiv((ND_SINT64)(ND_SINT16)divident, (ND_SINT64)(ND_SINT8)src.Value.Bytes[0], 1))
{
stop = ND_TRUE;
break;
}
res.Value.Bytes[0] = (ND_SINT8)((ND_SINT16)divident / (ND_SINT8)src.Value.Bytes[0]);
res.Value.Bytes[1] = (ND_SINT8)((ND_SINT16)divident % (ND_SINT8)src.Value.Bytes[0]);
}
// Result in AX (AL - quotient, AH - reminder).
*((ND_UINT16*)&Context->Registers.RegRax) = res.Value.Words[0];
}
else if (src.Size == 2)
{
ND_UINT32 divident;
divident = ((ND_UINT32)(ND_UINT16)Context->Registers.RegRdx << 16) |
(ND_UINT32)(ND_UINT16)Context->Registers.RegRax;
if (ND_INS_DIV == Context->Instruction.Instruction)
{
if (!ShemuCheckDiv(divident, src.Value.Words[0], 2))
{
stop = ND_TRUE;
break;
}
res.Value.Words[0] = (ND_UINT16)(divident / src.Value.Words[0]);
res.Value.Words[1] = (ND_UINT16)(divident % src.Value.Words[0]);
}
else
{
if (!ShemuCheckIdiv((ND_SINT64)(ND_SINT32)divident, (ND_SINT64)(ND_SINT16)src.Value.Words[0], 2))
{
stop = ND_TRUE;
break;
}
res.Value.Words[0] = (ND_SINT16)((ND_SINT32)divident / (ND_SINT16)src.Value.Words[0]);
res.Value.Words[1] = (ND_SINT16)((ND_SINT32)divident % (ND_SINT16)src.Value.Words[0]);
}
*((ND_UINT16*)&Context->Registers.RegRdx) = res.Value.Words[1];
*((ND_UINT16*)&Context->Registers.RegRax) = res.Value.Words[0];
}
else if (src.Size == 4)
{
ND_UINT64 divident;
divident = ((ND_UINT64)(ND_UINT32)Context->Registers.RegRdx << 32) |
(ND_UINT64)(ND_UINT32)Context->Registers.RegRax;
if (ND_INS_DIV == Context->Instruction.Instruction)
{
if (!ShemuCheckDiv(divident, src.Value.Dwords[0], 4))
{
stop = ND_TRUE;
break;
}
res.Value.Dwords[0] = (ND_UINT32)(divident / src.Value.Dwords[0]);
res.Value.Dwords[1] = (ND_UINT32)(divident % src.Value.Dwords[0]);
}
else
{
if (!ShemuCheckIdiv((ND_SINT64)divident, (ND_SINT64)(ND_SINT32)src.Value.Dwords[0], 4))
{
stop = ND_TRUE;
break;
}
res.Value.Dwords[0] = (ND_SINT32)((ND_SINT64)divident / (ND_SINT32)src.Value.Dwords[0]);
res.Value.Dwords[1] = (ND_SINT32)((ND_SINT64)divident % (ND_SINT32)src.Value.Dwords[0]);
}
Context->Registers.RegRdx = res.Value.Dwords[1];
Context->Registers.RegRax = res.Value.Dwords[0];
}
else if (src.Size == 8)
{
/// Not implemented!
}
break;
case ND_INS_CLD:
SET_FLAG(Context, NDR_RFLAG_DF, 0);
break;
case ND_INS_STD:
SET_FLAG(Context, NDR_RFLAG_DF, 1);
break;
case ND_INS_CLC:
SET_FLAG(Context, NDR_RFLAG_CF, 0);
break;
case ND_INS_STC:
SET_FLAG(Context, NDR_RFLAG_CF, 1);
break;
case ND_INS_CMC:
Context->Registers.RegFlags ^= NDR_RFLAG_CF;
break;
case ND_INS_STI:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
SET_FLAG(Context, NDR_RFLAG_IF, 1);
break;
case ND_INS_CLI:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
SET_FLAG(Context, NDR_RFLAG_IF, 0);
break;
case ND_INS_SAHF:
{
ND_UINT8 ah = (Context->Registers.RegRax >> 8) & 0xFF;
// Handle reserved bits.
ah |= (1 << 1);
ah &= ~((1 << 3) | (1 << 5));
((ND_UINT8 *)&Context->Registers.RegFlags)[0] = ah;
}
break;
case ND_INS_LAHF:
{
ND_UINT8 ah = ((ND_UINT8 *)&Context->Registers.RegFlags)[0];
((ND_UINT8 *)&Context->Registers.RegRax)[1] = ah;
}
break;
case ND_INS_SALC:
if (GET_FLAG(Context, NDR_RFLAG_CF))
{
*((ND_UINT8 *)&Context->Registers.RegRax) = 0xFF;
}
else
{
*((ND_UINT8 *)&Context->Registers.RegRax) = 0x0;
}
break;
case ND_INS_NOP:
Context->NopCount++;
break;
case ND_INS_WAIT:
break;
case ND_INS_CBW:
case ND_INS_CWDE:
case ND_INS_CDQE:
GET_OP(Context, 1, &src);
dst.Size = src.Size * 2;
dst.Value.Qwords[0] = ND_SIGN_EX(src.Size, src.Value.Qwords[0]);
SET_OP(Context, 0, &dst);
break;
case ND_INS_CWD:
case ND_INS_CDQ:
case ND_INS_CQO:
GET_OP(Context, 1, &src);
dst.Size = src.Size;
if (ND_GET_SIGN(src.Size, src.Value.Qwords[0]))
{
dst.Value.Qwords[0] = 0xFFFFFFFFFFFFFFFF;
}
else
{
dst.Value.Qwords[0] = 0;
}
SET_OP(Context, 0, &dst);
break;
case ND_INS_AAA:
case ND_INS_AAD:
case ND_INS_AAM:
case ND_INS_AAS:
case ND_INS_DAA:
case ND_INS_DAS:
// Ignore these for now.
break;
case ND_INS_ENDBR:
// Acts as a NOP, it's just a hint to the decoder.
break;
case ND_INS_LFENCE:
case ND_INS_SFENCE:
case ND_INS_MFENCE:
// Nothing can be done for them, really.
break;
case ND_INS_CPUID:
// OK; EAX, EBX, ECX and EDX are modified, which also zeroes the high 32 bit.
Context->Registers.RegRax = 0;
Context->Registers.RegRbx = 0;
Context->Registers.RegRcx = 0;
Context->Registers.RegRdx = 0;
break;
// Some basic MMX/SSE instructions supported.
case ND_INS_EMMS:
nd_memzero(Context->MmxRegisters, sizeof(Context->MmxRegisters));
break;
case ND_INS_MOVD:
case ND_INS_MOVQ:
case ND_INS_MOVDQU:
case ND_INS_MOVDQA:
// memzero the source; if the source size is less than the destination size, the upper bits will be zero.
// Note that we don't really care about #GP on unaligned MOVDQA accesses...
nd_memzero(src.Value.Bytes, sizeof(src.Value.Bytes));
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_PUNPCKLBW:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
if (dst.Size == 8)
{
// Operating on MMX register.
dst.Value.Bytes[7] = src.Value.Bytes[3];
dst.Value.Bytes[6] = dst.Value.Bytes[3];
dst.Value.Bytes[5] = src.Value.Bytes[2];
dst.Value.Bytes[4] = dst.Value.Bytes[2];
dst.Value.Bytes[3] = src.Value.Bytes[1];
dst.Value.Bytes[2] = dst.Value.Bytes[1];
dst.Value.Bytes[1] = src.Value.Bytes[0];
}
else
{
// Operating on XMM register.
dst.Value.Bytes[15] = src.Value.Bytes[7];
dst.Value.Bytes[14] = dst.Value.Bytes[7];
dst.Value.Bytes[13] = src.Value.Bytes[6];
dst.Value.Bytes[12] = dst.Value.Bytes[6];
dst.Value.Bytes[11] = src.Value.Bytes[5];
dst.Value.Bytes[10] = dst.Value.Bytes[5];
dst.Value.Bytes[9] = src.Value.Bytes[4];
dst.Value.Bytes[8] = src.Value.Bytes[4];
dst.Value.Bytes[7] = src.Value.Bytes[3];
dst.Value.Bytes[6] = dst.Value.Bytes[3];
dst.Value.Bytes[5] = src.Value.Bytes[2];
dst.Value.Bytes[4] = dst.Value.Bytes[2];
dst.Value.Bytes[3] = src.Value.Bytes[1];
dst.Value.Bytes[2] = dst.Value.Bytes[1];
dst.Value.Bytes[1] = src.Value.Bytes[0];
}
SET_OP(Context, 0, &dst);
break;
case ND_INS_PXOR:
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
for (i = 0; i < dst.Size; i++)
{
dst.Value.Bytes[i] ^= src.Value.Bytes[i];
}
SET_OP(Context, 0, &dst);
break;
// Some basic AVX/AVX2 instructions support.
case ND_INS_VMOVD:
case ND_INS_VMOVQ:
case ND_INS_VMOVDQU:
case ND_INS_VMOVDQA:
// First clear out the entire register. If less than MAX_VL bits are written, the upper bits are set to 0.
nd_memzero(src.Value.Bytes, sizeof(src.Value.Bytes));
nd_memzero(dst.Value.Bytes, sizeof(dst.Value.Bytes));
dst.Size = ND_MAX_REGISTER_SIZE;
SET_OP(Context, 0, &dst);
// Fetch the source, and write the destination.
GET_OP(Context, 1, &src);
SET_OP(Context, 0, &src);
break;
case ND_INS_VPBROADCASTB:
case ND_INS_VPBROADCASTW:
case ND_INS_VPBROADCASTD:
case ND_INS_VPBROADCASTQ:
GET_OP(Context, 1, &src);
dst.Size = Context->Instruction.Operands[0].Size;
for (i = 0; i < dst.Size / src.Size; i++)
{
switch (src.Size)
{
case 1:
dst.Value.Bytes[i] = src.Value.Bytes[0];
break;
case 2:
dst.Value.Words[i] = src.Value.Words[0];
break;
case 4:
dst.Value.Dwords[i] = src.Value.Dwords[0];
break;
default:
dst.Value.Qwords[i] = src.Value.Qwords[0];
break;
}
}
SET_OP(Context, 0, &dst);
break;
case ND_INS_VPXOR:
GET_OP(Context, 1, &dst);
GET_OP(Context, 2, &src);
for (i = 0; i < dst.Size; i++)
{
dst.Value.Bytes[i] ^= src.Value.Bytes[i];
}
SET_OP(Context, 0, &dst);
break;
// Software interrupt/SYSCALL/SYSENTER.
case ND_INS_INT:
if (Context->Instruction.Immediate1 == 0x80 ||
Context->Instruction.Immediate1 == 0x2E)
{
Context->Flags |= SHEMU_FLAG_SYSCALL;
}
stop = ND_TRUE;
break;
case ND_INS_SYSCALL:
case ND_INS_SYSENTER:
Context->Flags |= SHEMU_FLAG_SYSCALL;
stop = ND_TRUE;
break;
// Some basic privileged instructions supported, specific to kernel-mode shellcodes.
case ND_INS_SWAPGS:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
Context->Flags |= SHEMU_FLAG_SWAPGS;
stop = ND_TRUE;
break;
case ND_INS_RDMSR:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
if ((Context->Registers.RegRcx == 0xC0000082 && ND_CODE_64 == Context->Mode) ||
(Context->Registers.RegRcx == 0x00000176 && ND_CODE_32 == Context->Mode))
{
Context->Flags |= SHEMU_FLAG_SYSCALL_MSR_READ;
}
stop = ND_TRUE;
break;
case ND_INS_WRMSR:
if (Context->Ring != 0)
{
return SHEMU_ABORT_NO_PRIVILEGE;
}
if ((Context->Registers.RegRcx == 0xC0000082 && ND_CODE_64 == Context->Mode) ||
(Context->Registers.RegRcx == 0x00000176 && ND_CODE_32 == Context->Mode))
{
Context->Flags |= SHEMU_FLAG_SYSCALL_MSR_WRITE;
}
stop = ND_TRUE;
break;
case ND_INS_SIDT:
if (Context->Ring == 0)
{
// Flag this only in ring0, as we treat the SHEMU_FLAG_SIDT as a ring0 specific indicator - it can be
// used to locate the kernel image.
Context->Flags |= SHEMU_FLAG_SIDT;
}
stop = ND_TRUE;
break;
#if defined(ND_ARCH_X64) || defined(ND_ARCH_X86)
case ND_INS_AESIMC:
case ND_INS_AESDEC:
case ND_INS_AESDECLAST:
{
__m128i val, key;
// Make sure AES support is present, and we can emulate AES decryption using AES instructions.
if (0 == (Context->Options & SHEMU_OPT_SUPPORT_AES))
{
stop = ND_TRUE;
break;
}
GET_OP(Context, 0, &dst);
GET_OP(Context, 1, &src);
shemu_memcpy(&val, &dst, 16);
shemu_memcpy(&key, &src, 16);
if (Context->Instruction.Instruction == ND_INS_AESDEC)
{
val = _mm_aesdec_si128(val, key);
}
else if (Context->Instruction.Instruction == ND_INS_AESDECLAST)
{
val = _mm_aesdeclast_si128(val, key);
}
else if (Context->Instruction.Instruction == ND_INS_AESIMC)
{
val = _mm_aesimc_si128(key);
}
shemu_memcpy(&dst, &val, 16);
SET_OP(Context, 0, &dst);
break;
}
#endif
case ND_INS_RDTSC:
src.Size = 4;
// Set EAX to lower 32 bits.
src.Value.Dwords[0] = tsc & 0xFFFFFFFF;
SET_OP(Context, 0, &src);
// Set EDX to upper 32 bits.
src.Value.Dwords[0] = tsc >> 32;
SET_OP(Context, 1, &src);
break;
default:
return SHEMU_ABORT_UNSUPPORTED_INSTRUX;
}
}
// Minimum percent of the instructions were NOPs => consider we have a NOP sled. Note that we get here only if
// the maximum number of instructions has been emulated successfully; if the emulation is aborted for any reason,
// this code will have no effect.
if ((Context->InstructionsCount >= Context->MaxInstructionsCount / 2) &&
(Context->NopCount >= Context->InstructionsCount * Context->NopThreshold / 100))
{
Context->Flags |= SHEMU_FLAG_NOP_SLED;
return SHEMU_ABORT_SHELLCODE_DETECTED;
}
return SHEMU_SUCCESS;
}
Reference in New Issue View Git Blame Copy Permalink