mirror of https://github.com/Cisco-Talos/clamav
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
359 lines
14 KiB
359 lines
14 KiB
/*
|
|
* Copyright (C) 2008 Sourcefire, Inc.
|
|
*
|
|
* Authors: Török Edvin
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
|
|
* MA 02110-1301, USA.
|
|
*/
|
|
|
|
#ifndef DISASM_BC_H
|
|
#define DISASM_BC_H
|
|
/** @file */
|
|
/** X86 opcode */
|
|
enum X86OPS {
|
|
OP_INVALID,
|
|
OP_AAA,/**< Ascii Adjust after Addition */
|
|
OP_AAD,/**< Ascii Adjust AX before Division */
|
|
OP_AAM,/**< Ascii Adjust AX after Multiply */
|
|
OP_AAS,/**< Ascii Adjust AL after Subtraction */
|
|
OP_ADD,/**< Add */
|
|
OP_ADC,/**< Add with Carry */
|
|
OP_AND,/**< Logical And */
|
|
OP_ARPL,/**< Adjust Requested Privilege Level */
|
|
OP_BOUND,/**< Check Array Index Against Bounds */
|
|
OP_BSF,/**< Bit Scan Forward */
|
|
OP_BSR,/**< Bit Scan Reverse */
|
|
OP_BSWAP,/**< Byte Swap */
|
|
OP_BT,/**< Bit Test */
|
|
OP_BTC,/**< Bit Test and Complement */
|
|
OP_BTR,/**< Bit Test and Reset */
|
|
OP_BTS,/**< Bit Test and Set */
|
|
OP_CALL,/**< Call */
|
|
OP_CDQ,/**< Convert DoubleWord to QuadWord*/
|
|
OP_CWD,
|
|
OP_CWDE,/**< Convert Word to DoubleWord */
|
|
OP_CBW,/**< Convert Byte to Word */
|
|
OP_CLC,/**< Clear Carry Flag */
|
|
OP_CLD,/**< Clear Direction Flag */
|
|
OP_CLI,/**< Clear Interrupt Flag */
|
|
OP_CLTS,/**< Clear Task-Switched Flag in CR0 */
|
|
OP_CMC,/**< Complement Carry Flag */
|
|
OP_CMOVO,/**< Conditional Move if Overflow */
|
|
OP_CMOVNO,/**< Conditional Move if Not Overflow */
|
|
OP_CMOVC,/**< Conditional Move if Carry */
|
|
OP_CMOVNC,/**< Conditional Move if Not Carry */
|
|
OP_CMOVZ,/**< Conditional Move if Zero */
|
|
OP_CMOVNZ,/**< Conditional Move if Non-Zero */
|
|
OP_CMOVBE,/**< Conditional Move if Below or Equal */
|
|
OP_CMOVA,/**< Conditional Move if Above */
|
|
OP_CMOVS,/**< Conditional Move if Sign */
|
|
OP_CMOVNS,/**< Conditional Move if Not Sign */
|
|
OP_CMOVP,/**< Conditional Move if Parity */
|
|
OP_CMOVNP,/**< Conditional Move if Not Parity */
|
|
OP_CMOVL,/**< Conditional Move if Less */
|
|
OP_CMOVGE,/**< Conditional Move if Greater or Equal */
|
|
OP_CMOVLE,/**< Conditional Move if Less than or Equal */
|
|
OP_CMOVG,/**< Conditional Move if Greater */
|
|
OP_CMP,/**< Compare */
|
|
OP_CMPSD,/**< Compare String DoubleWord */
|
|
OP_CMPSW,/**< Compare String Word */
|
|
OP_CMPSB,/**< Compare String Byte */
|
|
OP_CMPXCHG,/**< Compare and Exchange */
|
|
OP_CMPXCHG8B,/**< Compare and Exchange Bytes */
|
|
OP_CPUID,/**< CPU Identification */
|
|
OP_DAA,/**< Decimal Adjust AL after Addition */
|
|
OP_DAS,/**< Decimal Adjust AL after Subtraction */
|
|
OP_DEC,/**< Decrement by 1 */
|
|
OP_DIV,/**< Unsigned Divide */
|
|
OP_ENTER,/**< Make Stack Frame for Procedure Parameters */
|
|
OP_FWAIT,/**< Wait */
|
|
OP_HLT,/**< Halt */
|
|
OP_IDIV,/**< Signed Divide */
|
|
OP_IMUL,/**< Signed Multiply */
|
|
OP_INC,/**< Increment by 1 */
|
|
OP_IN,/**< INput from port */
|
|
OP_INSD,/**< INput from port to String Doubleword */
|
|
OP_INSW,/**< INput from port to String Word */
|
|
OP_INSB,/**< INput from port to String Byte */
|
|
OP_INT,/**< INTerrupt */
|
|
OP_INT3,/**< INTerrupt 3 (breakpoint) */
|
|
OP_INTO,/**< INTerrupt 4 if Overflow */
|
|
OP_INVD,/**< Invalidate Internal Caches */
|
|
OP_INVLPG,/**< Invalidate TLB Entry */
|
|
OP_IRET,/**< Interrupt Return */
|
|
OP_JO,/**< Jump if Overflow */
|
|
OP_JNO,/**< Jump if Not Overflow */
|
|
OP_JC,/**< Jump if Carry */
|
|
OP_JNC,/**< Jump if Not Carry */
|
|
OP_JZ,/**< Jump if Zero */
|
|
OP_JNZ,/**< Jump if Not Zero */
|
|
OP_JBE,/**< Jump if Below or Equal */
|
|
OP_JA,/**< Jump if Above */
|
|
OP_JS,/**< Jump if Sign */
|
|
OP_JNS,/**< Jump if Not Sign */
|
|
OP_JP,/**< Jump if Parity */
|
|
OP_JNP,/**< Jump if Not Parity */
|
|
OP_JL,/**< Jump if Less */
|
|
OP_JGE,/**< Jump if Greater or Equal */
|
|
OP_JLE,/**< Jump if Less or Equal */
|
|
OP_JG,/**< Jump if Greater */
|
|
OP_JMP,/**< Jump (unconditional) */
|
|
OP_LAHF,/**< Load Status Flags into AH Register */
|
|
OP_LAR,/**< load Access Rights Byte */
|
|
OP_LDS,/**< Load Far Pointer into DS */
|
|
OP_LES,/**< Load Far Pointer into ES */
|
|
OP_LFS,/**< Load Far Pointer into FS */
|
|
OP_LGS,/**< Load Far Pointer into GS */
|
|
OP_LEA,/**< Load Effective Address */
|
|
OP_LEAVE,/**< High Level Procedure Exit */
|
|
OP_LGDT,/**< Load Global Descript Table Register */
|
|
OP_LIDT,/**< Load Interrupt Descriptor Table Register */
|
|
OP_LLDT,/**< Load Local Descriptor Table Register */
|
|
OP_PREFIX_LOCK,/**< Assert LOCK# Signal Prefix */
|
|
OP_LODSD,/**< Load String Dword*/
|
|
OP_LODSW,/**< Load String Word */
|
|
OP_LODSB,/**< Load String Byte */
|
|
OP_LOOP,/**< Loop According to ECX Counter */
|
|
OP_LOOPE,/**< Loop According to ECX Counter and ZF=1 */
|
|
OP_LOOPNE,/**< Looop According to ECX Counter and ZF=0 */
|
|
OP_JECXZ,/**< Jump if ECX is Zero */
|
|
OP_LSL,/**< Load Segment Limit */
|
|
OP_LSS,/**< Load Far Pointer into SS */
|
|
OP_LTR,/**< Load Task Register */
|
|
OP_MOV,/**< Move */
|
|
OP_MOVSD,/**< Move Data from String to String Doubleword */
|
|
OP_MOVSW,/**< Move Data from String to String Word */
|
|
OP_MOVSB,/**< Move Data from String to String Byte */
|
|
OP_MOVSX,/**< Move with Sign-Extension */
|
|
OP_MOVZX,/**< Move with Zero-Extension */
|
|
OP_MUL,/**< Unsigned Multiply */
|
|
OP_NEG,/**< Two's Complement Negation */
|
|
OP_NOP,/**< No Operation */
|
|
OP_NOT,/**< One's Complement Negation */
|
|
OP_OR,/**< Logical Inclusive OR */
|
|
OP_OUT,/**< Output to Port */
|
|
OP_OUTSD,/**< Output String to Port Doubleword */
|
|
OP_OUTSW,/**< Output String to Port Word */
|
|
OP_OUTSB,/**< Output String to Port Bytes */
|
|
OP_PUSH,/**< Push Onto the Stack */
|
|
OP_PUSHAD,/**< Push All Double General Purpose Registers */
|
|
OP_PUSHA,
|
|
OP_PUSHFD,/**< Push EFLAGS Register onto the Stack */
|
|
OP_PUSHF,
|
|
OP_POP,/**< Pop a Value from the Stack */
|
|
OP_POPAD,/**< Pop All Double General Purpose Registers from the Stack */
|
|
OP_POPFD,/**< Pop Stack into EFLAGS Register */
|
|
OP_POPF,
|
|
OP_RCL,/**< Rotate Carry Left */
|
|
OP_RCR,/**< Rotate Carry Right */
|
|
OP_RDMSR,/**< Read from Model Specific Register */
|
|
OP_RDPMC,/**< Read Performance Monitoring Counters */
|
|
OP_RDTSC,/**< Read Time-Stamp Coutner */
|
|
OP_PREFIX_REPE,/**< Repeat String Operation Prefix while Equal */
|
|
OP_PREFIX_REPNE,/**< Repeat String Operation Prefix while Not Equal */
|
|
OP_RETF,/**< Return from Far Procedure */
|
|
OP_RETN,/**< Return from Near Procedure */
|
|
OP_ROL,/**< Rotate Left */
|
|
OP_ROR,/**< Rotate Right */
|
|
OP_RSM,/**< Resumse from System Management Mode */
|
|
OP_SAHF,/**< Store AH into Flags */
|
|
OP_SAR,/**< Shift Arithmetic Right */
|
|
OP_SBB,/**< Subtract with Borrow */
|
|
OP_SCASD,/**< Scan String Doubleword */
|
|
OP_SCASW,/**< Scan String Word */
|
|
OP_SCASB,/**< Scan String Byte */
|
|
OP_SETO,/**< Set Byte on Overflow */
|
|
OP_SETNO,/**< Set Byte on Not Overflow */
|
|
OP_SETC,/**< Set Byte on Carry */
|
|
OP_SETNC,/**< Set Byte on Not Carry */
|
|
OP_SETZ,/**< Set Byte on Zero */
|
|
OP_SETNZ,/**< Set Byte on Not Zero */
|
|
OP_SETBE,/**< Set Byte on Below or Equal */
|
|
OP_SETA,/**< Set Byte on Above */
|
|
OP_SETS,/**< Set Byte on Sign */
|
|
OP_SETNS,/**< Set Byte on Not Sign */
|
|
OP_SETP,/**< Set Byte on Parity */
|
|
OP_SETNP,/**< Set Byte on Not Parity */
|
|
OP_SETL,/**< Set Byte on Less */
|
|
OP_SETGE,/**< Set Byte on Greater or Equal */
|
|
OP_SETLE,/**< Set Byte on Less or Equal */
|
|
OP_SETG,/**< Set Byte on Greater */
|
|
OP_SGDT,/**< Store Global Descriptor Table Register */
|
|
OP_SIDT,/**< Store Interrupt Descriptor Table Register */
|
|
OP_SHL,/**< Shift Left */
|
|
OP_SHLD,/**< Double Precision Shift Left */
|
|
OP_SHR,/**< Shift Right */
|
|
OP_SHRD,/**< Double Precision Shift Right */
|
|
OP_SLDT,/**< Store Local Descriptor Table Register */
|
|
OP_STOSD,/**< Store String Doubleword */
|
|
OP_STOSW,/**< Store String Word */
|
|
OP_STOSB,/**< Store String Byte */
|
|
OP_STR,/**< Store Task Register */
|
|
OP_STC,/**< Set Carry Flag */
|
|
OP_STD,/**< Set Direction Flag */
|
|
OP_STI,/**< Set Interrupt Flag */
|
|
OP_SUB,/**< Subtract */
|
|
OP_SYSCALL,/**< Fast System Call */
|
|
OP_SYSENTER,/**< Fast System Call */
|
|
OP_SYSEXIT,/**< Fast Return from Fast System Call */
|
|
OP_SYSRET,/**< Return from Fast System Call */
|
|
OP_TEST,/**< Logical Compare */
|
|
OP_UD2,/**< Undefined Instruction */
|
|
OP_VERR,/**< Verify a Segment for Reading */
|
|
OP_VERRW,/**< Verify a Segment for Writing */
|
|
OP_WBINVD,/**< Write Back and Invalidate Cache */
|
|
OP_WRMSR,/**< Write to Model Specific Register */
|
|
OP_XADD,/**< Exchange and Add */
|
|
OP_XCHG,/**< Exchange Register/Memory with Register */
|
|
OP_XLAT,/**< Table Look-up Translation */
|
|
OP_XOR,/**< Logical Exclusive OR */
|
|
OP_PREFIX_OPSIZE,
|
|
OP_PREFIX_ADDRSIZE,
|
|
OP_PREFIX_SEGMENT,
|
|
OP_2BYTE,
|
|
|
|
OP_FPU,/**< FPU operation */
|
|
|
|
OP_F2XM1,/**< Compute 2x-1 */
|
|
OP_FABS,/**< Absolute Value */
|
|
OP_FADD,/**< Floating Point Add */
|
|
OP_FADDP,/**< Floating Point Add, Pop */
|
|
OP_FBLD,/**< Load Binary Coded Decimal */
|
|
OP_FBSTP,/**< Store BCD Integer and Pop */
|
|
OP_FCHS,/**< Change Sign */
|
|
OP_FCLEX,/**< Clear Exceptions */
|
|
OP_FCMOVB,/**< Floating Point Move on Below */
|
|
OP_FCMOVBE,/**< Floating Point Move on Below or Equal */
|
|
OP_FCMOVE,/**< Floating Point Move on Equal */
|
|
OP_FCMOVNB,/**< Floating Point Move on Not Below */
|
|
OP_FCMOVNBE,/**< Floating Point Move on Not Below or Equal */
|
|
OP_FCMOVNE,/**< Floating Point Move on Not Equal */
|
|
OP_FCMOVNU,/**< Floating Point Move on Not Unordered */
|
|
OP_FCMOVU,/**< Floating Point Move on Unordered */
|
|
OP_FCOM,/**< Compare Floating Pointer Values and Set FPU Flags */
|
|
OP_FCOMI,/**< Compare Floating Pointer Values and Set EFLAGS */
|
|
OP_FCOMIP,/**< Compare Floating Pointer Values and Set EFLAGS, Pop */
|
|
OP_FCOMP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop */
|
|
OP_FCOMPP,/**< Compare Floating Pointer Values and Set FPU Flags, Pop Twice */
|
|
OP_FCOS,/**< Cosine */
|
|
OP_FDECSTP,/**< Decrement Stack Top Pointer */
|
|
OP_FDIV,/**< Floating Point Divide */
|
|
OP_FDIVP,/**< Floating Point Divide, Pop */
|
|
OP_FDIVR,/**< Floating Point Reverse Divide */
|
|
OP_FDIVRP,/**< Floating Point Reverse Divide, Pop */
|
|
OP_FFREE,/**< Free Floating Point Register */
|
|
OP_FIADD,/**< Floating Point Add */
|
|
OP_FICOM,/**< Compare Integer */
|
|
OP_FICOMP,/**< Compare Integer, Pop */
|
|
OP_FIDIV,/**< Floating Point Divide by Integer */
|
|
OP_FIDIVR,/**< Floating Point Reverse Divide by Integer */
|
|
OP_FILD,/**< Load Integer */
|
|
OP_FIMUL,/**< Floating Point Multiply with Integer */
|
|
OP_FINCSTP,/**< Increment Stack-Top Pointer */
|
|
OP_FINIT,/**< Initialize Floating-Point Unit */
|
|
OP_FIST,/**< Store Integer */
|
|
OP_FISTP,/**< Store Integer, Pop */
|
|
OP_FISTTP,/**< Store Integer with Truncation */
|
|
OP_FISUB,/**< Floating Point Integer Subtract */
|
|
OP_FISUBR,/**< Floating Point Reverse Integer Subtract */
|
|
OP_FLD,/**< Load Floating Point Value */
|
|
OP_FLD1,/**< Load Constant 1 */
|
|
OP_FLDCW,/**< Load x87 FPU Control Word */
|
|
OP_FLDENV,/**< Load x87 FPU Environment */
|
|
OP_FLDL2E,/**< Load Constant log_2(e) */
|
|
OP_FLDL2T,/**< Load Constant log_2(10) */
|
|
OP_FLDLG2,/**< Load Constant log_10(2) */
|
|
OP_FLDLN2,/**< Load Constant log_e(2) */
|
|
OP_FLDPI,/**< Load Constant PI */
|
|
OP_FLDZ,/**< Load Constant Zero */
|
|
OP_FMUL,/**< Floating Point Multiply */
|
|
OP_FMULP,/**< Floating Point Multiply, Pop */
|
|
OP_FNOP,/**< No Operation */
|
|
OP_FPATAN,/**< Partial Arctangent */
|
|
OP_FPREM,/**< Partial Remainder */
|
|
OP_FPREM1,/**< Partial Remainder */
|
|
OP_FPTAN,/**< Partial Tangent */
|
|
OP_FRNDINT,/**< Round to Integer */
|
|
OP_FRSTOR,/**< Restore x86 FPU State */
|
|
OP_FSCALE,/**< Scale */
|
|
OP_FSIN,/* Sine */
|
|
OP_FSINCOS,/**< Sine and Cosine */
|
|
OP_FSQRT,/**< Square Root */
|
|
OP_FSAVE,/**< Store x87 FPU State */
|
|
OP_FST,/**< Store Floating Point Value */
|
|
OP_FSTCW,/**< Store x87 FPU Control Word */
|
|
OP_FSTENV,/**< Store x87 FPU Environment */
|
|
OP_FSTP,/**< Store Floating Point Value, Pop */
|
|
OP_FSTSW,/**< Store x87 FPU Status Word */
|
|
OP_FSUB,/**< Floating Point Subtract */
|
|
OP_FSUBP,/**< Floating Point Subtract, Pop */
|
|
OP_FSUBR,/**< Floating Point Reverse Subtract */
|
|
OP_FSUBRP,/**< Floating Point Reverse Subtract, Pop */
|
|
OP_FTST,/**< Floating Point Test */
|
|
OP_FUCOM,/**< Floating Point Unordered Compare */
|
|
OP_FUCOMI,/**< Floating Point Unordered Compare with Integer */
|
|
OP_FUCOMIP,/**< Floating Point Unorder Compare with Integer, Pop */
|
|
OP_FUCOMP,/**< Floating Point Unorder Compare, Pop */
|
|
OP_FUCOMPP,/**< Floating Point Unorder Compare, Pop Twice */
|
|
OP_FXAM,/**< Examine ModR/M */
|
|
OP_FXCH,/**< Exchange Register Contents */
|
|
OP_FXTRACT,/**< Extract Exponent and Significand */
|
|
OP_FYL2X,/**< Compute y*log2x */
|
|
OP_FYL2XP1 /**< Compute y*log2(x+1) */
|
|
};
|
|
|
|
/** Access type */
|
|
enum DIS_ACCESS {
|
|
ACCESS_NOARG, /**< arg not present */
|
|
ACCESS_IMM, /**< immediate */
|
|
ACCESS_REL, /**< +/- immediate */
|
|
ACCESS_REG, /**< register */
|
|
ACCESS_MEM /**< [memory] */
|
|
};
|
|
|
|
/** for mem access, immediate and relative */
|
|
enum DIS_SIZE {
|
|
SIZEB,/**< Byte size access */
|
|
SIZEW,/**< Word size access */
|
|
SIZED,/**< Doubleword size access */
|
|
SIZEF,/**< 6-byte access (seg+reg pair)*/
|
|
SIZEQ,/**< Quadword access */
|
|
SIZET,/**< 10-byte access */
|
|
SIZEPTR /** ptr */
|
|
};
|
|
|
|
/** X86 registers */
|
|
enum X86REGS {
|
|
REG_EAX, REG_ECX, REG_EDX, REG_EBX, REG_ESP, REG_EBP, REG_ESI, REG_EDI,
|
|
REG_AX, REG_CX, REG_DX, REG_BX, REG_SP, REG_BP, REG_SI, REG_DI,
|
|
REG_AH, REG_CH, REG_DH, REG_BH, REG_AL, REG_CL, REG_DL, REG_BL,
|
|
REG_ES, REG_CS, REG_SS, REG_DS, REG_FS, REG_GS,
|
|
REG_CR0, REG_CR1, REG_CR2, REG_CR3, REG_CR4, REG_CR5, REG_CR6, REG_CR7,
|
|
REG_DR0, REG_DR1, REG_DR2, REG_DR3, REG_DR4, REG_DR5, REG_DR6, REG_DR7,
|
|
REG_ST0, REG_ST1, REG_ST2, REG_ST3, REG_ST4, REG_ST5, REG_ST6, REG_ST7,
|
|
REG_INVALID
|
|
};
|
|
|
|
/** disassembly result, 64-byte, matched by type-8 signatures */
|
|
struct DISASM_RESULT {
|
|
uint16_t real_op;
|
|
uint8_t opsize;
|
|
uint8_t adsize;
|
|
uint8_t segment;
|
|
uint8_t arg[3][10];
|
|
uint8_t extra[29];
|
|
};
|
|
#endif
|
|
|
|
|