diff --git a/.gitmodules b/.gitmodules index cf3d0958..cfc35697 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +1,3 @@ -[submodule "src/capstone_wrapper"] - path = src/capstone_wrapper - url = https://github.com/x64dbg/capstone_wrapper.git [submodule "src/gui/Translations"] path = src/gui/Translations url = https://github.com/x64dbg/Translations.git diff --git a/build.bat b/build.bat index 36b22ae2..4cc81b28 100644 --- a/build.bat +++ b/build.bat @@ -60,9 +60,9 @@ if "%2"=="" ( echo Building with SonarQube build-wrapper --out-dir bw-output build.bat %2 if not defined APPVEYOR_PULL_REQUEST_NUMBER ( -sonar-scanner -Dsonar.projectKey=x64dbg -Dsonar.sources=. -Dsonar.cfamily.build-wrapper-output=bw-output -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=mrexodia-github -Dsonar.login=%SONARQUBE_TOKEN% -Dsonar.exclusions=src/capstone_wrapper/**,src/dbg/btparser/**,src/gui_build/**,src/zydis_wrapper/zydis/** +sonar-scanner -Dsonar.projectKey=x64dbg -Dsonar.sources=. -Dsonar.cfamily.build-wrapper-output=bw-output -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=mrexodia-github -Dsonar.login=%SONARQUBE_TOKEN% -Dsonar.exclusions=src/dbg/btparser/**,src/gui_build/**,src/zydis_wrapper/zydis/** ) else ( -sonar-scanner -Dsonar.projectKey=x64dbg -Dsonar.sources=. -Dsonar.cfamily.build-wrapper-output=bw-output -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=mrexodia-github -Dsonar.login=%SONARQUBE_TOKEN% -Dsonar.exclusions=src/capstone_wrapper/**,src/dbg/btparser/**,src/gui_build/**,src/zydis_wrapper/zydis/** -Dsonar.analysis.mode=preview -Dsonar.github.pullRequest=%APPVEYOR_PULL_REQUEST_NUMBER% -Dsonar.github.repository=x64dbg/x64dbg -Dsonar.github.oauth=%GITHUB_TOKEN% +sonar-scanner -Dsonar.projectKey=x64dbg -Dsonar.sources=. -Dsonar.cfamily.build-wrapper-output=bw-output -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=mrexodia-github -Dsonar.login=%SONARQUBE_TOKEN% -Dsonar.exclusions=src/dbg/btparser/**,src/gui_build/**,src/zydis_wrapper/zydis/** -Dsonar.analysis.mode=preview -Dsonar.github.pullRequest=%APPVEYOR_PULL_REQUEST_NUMBER% -Dsonar.github.repository=x64dbg/x64dbg -Dsonar.github.oauth=%GITHUB_TOKEN% ) goto :restorepath diff --git a/deps b/deps index ccb293e2..67f089f8 160000 --- a/deps +++ b/deps @@ -1 +1 @@ -Subproject commit ccb293e2ff6076e07d5e01e08717a168487e7b4a +Subproject commit 67f089f8416d806101913ec619cbb557540d2f64 diff --git a/release.bat b/release.bat index fff48b06..0f0995a2 100644 --- a/release.bat +++ b/release.bat @@ -6,7 +6,6 @@ mkdir %RELEASEDIR% echo pluginsdk mkdir %RELEASEDIR%\pluginsdk -mkdir %RELEASEDIR%\pluginsdk\capstone mkdir %RELEASEDIR%\pluginsdk\dbghelp mkdir %RELEASEDIR%\pluginsdk\DeviceNameResolver mkdir %RELEASEDIR%\pluginsdk\jansson @@ -16,7 +15,6 @@ mkdir %RELEASEDIR%\pluginsdk\XEDParse mkdir %RELEASEDIR%\pluginsdk\yara mkdir %RELEASEDIR%\pluginsdk\yara\yara -xcopy src\capstone_wrapper\capstone %RELEASEDIR%\pluginsdk\capstone /S /Y xcopy src\dbg\dbghelp %RELEASEDIR%\pluginsdk\dbghelp /S /Y xcopy src\dbg\DeviceNameResolver %RELEASEDIR%\pluginsdk\DeviceNameResolver /S /Y xcopy src\dbg\jansson %RELEASEDIR%\pluginsdk\jansson /S /Y diff --git a/src/capstone_wrapper b/src/capstone_wrapper deleted file mode 160000 index 578d387f..00000000 --- a/src/capstone_wrapper +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 578d387f3c89692613990f049317194d70be1c14 diff --git a/src/dbg/x64dbg_dbg.vcxproj b/src/dbg/x64dbg_dbg.vcxproj index d848aaba..0b19099a 100644 --- a/src/dbg/x64dbg_dbg.vcxproj +++ b/src/dbg/x64dbg_dbg.vcxproj @@ -320,14 +320,6 @@ true false - - {c9b06e6e-3534-4e7b-9c00-c3ea33cc4e15} - true - true - false - true - false - {E6548308-401E-3A8A-5819-905DB90522A6} @@ -376,26 +368,26 @@ $(ProjectDir)..\..\bin\x32\ $(Platform)\$(Configuration)\ x32dbg - $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir)..\capstone_wrapper;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) + $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) false $(ProjectDir)..\..\bin\x32d\ $(Platform)\$(Configuration)\ x32dbg - $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir)..\capstone_wrapper;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) + $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) false $(ProjectDir)..\..\bin\x64\ x64dbg - $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir)..\capstone_wrapper;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) + $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) false $(ProjectDir)..\..\bin\x64d\ x64dbg - $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir)..\capstone_wrapper;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) + $(ProjectDir)..\zydis_wrapper;$(ProjectDir)..\zydis_wrapper\zydis\include;$(ProjectDir);$(ProjectDir)analysis;$(ProjectDir)commands;$(IncludePath) @@ -419,7 +411,7 @@ Windows true true - ntdll\ntdll_x86.lib;keystone\keystone_x86.lib;$(ProjectDir)..\zydis_wrapper\bin\x32\zydis_wrapper.lib;$(ProjectDir)..\capstone_wrapper\bin\x32\capstone_wrapper.lib;$(ProjectDir)..\capstone_wrapper\capstone\capstone_x86.lib;yara\yara_x86.lib;lz4\lz4_x86.lib;jansson\jansson_x86.lib;DeviceNameResolver\DeviceNameResolver_x86.lib;XEDParse\XEDParse_x86.lib;$(SolutionDir)bin\x32\x32bridge.lib;dbghelp\dbghelp_x86.lib;TitanEngine\TitanEngine_x86.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) + ntdll\ntdll_x86.lib;keystone\keystone_x86.lib;$(ProjectDir)..\zydis_wrapper\bin\x32\zydis_wrapper.lib;yara\yara_x86.lib;lz4\lz4_x86.lib;jansson\jansson_x86.lib;DeviceNameResolver\DeviceNameResolver_x86.lib;XEDParse\XEDParse_x86.lib;$(SolutionDir)bin\x32\x32bridge.lib;dbghelp\dbghelp_x86.lib;TitanEngine\TitanEngine_x86.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) @@ -440,7 +432,7 @@ Windows false false - ntdll\ntdll_x86.lib;keystone\keystone_x86.lib;$(ProjectDir)..\zydis_wrapper\bin\x32d\zydis_wrapper.lib;$(ProjectDir)..\capstone_wrapper\bin\x32d\capstone_wrapper.lib;$(ProjectDir)..\capstone_wrapper\capstone\capstone_x86.lib;yara\yara_x86.lib;lz4\lz4_x86.lib;jansson\jansson_x86.lib;DeviceNameResolver\DeviceNameResolver_x86.lib;XEDParse\XEDParse_x86.lib;$(SolutionDir)bin\x32d\x32bridge.lib;dbghelp\dbghelp_x86.lib;TitanEngine\TitanEngine_x86.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) + ntdll\ntdll_x86.lib;keystone\keystone_x86.lib;$(ProjectDir)..\zydis_wrapper\bin\x32d\zydis_wrapper.lib;yara\yara_x86.lib;lz4\lz4_x86.lib;jansson\jansson_x86.lib;DeviceNameResolver\DeviceNameResolver_x86.lib;XEDParse\XEDParse_x86.lib;$(SolutionDir)bin\x32d\x32bridge.lib;dbghelp\dbghelp_x86.lib;TitanEngine\TitanEngine_x86.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) @@ -467,7 +459,7 @@ Windows true true - $(ProjectDir)..\zydis_wrapper\bin\x64\zydis_wrapper.lib;$(ProjectDir)..\capstone_wrapper\bin\x64\capstone_wrapper.lib;$(ProjectDir)..\capstone_wrapper\capstone\capstone_x64.lib;ntdll\ntdll_x64.lib;keystone\keystone_x64.lib;yara\yara_x64.lib;lz4\lz4_x64.lib;jansson\jansson_x64.lib;DeviceNameResolver\DeviceNameResolver_x64.lib;XEDParse\XEDParse_x64.lib;$(SolutionDir)bin\x64\x64bridge.lib;dbghelp\dbghelp_x64.lib;TitanEngine\TitanEngine_x64.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) + $(ProjectDir)..\zydis_wrapper\bin\x64\zydis_wrapper.lib;ntdll\ntdll_x64.lib;keystone\keystone_x64.lib;yara\yara_x64.lib;lz4\lz4_x64.lib;jansson\jansson_x64.lib;DeviceNameResolver\DeviceNameResolver_x64.lib;XEDParse\XEDParse_x64.lib;$(SolutionDir)bin\x64\x64bridge.lib;dbghelp\dbghelp_x64.lib;TitanEngine\TitanEngine_x64.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) @@ -491,7 +483,7 @@ Windows false false - $(ProjectDir)..\zydis_wrapper\bin\x64d\zydis_wrapper.lib;$(ProjectDir)..\capstone_wrapper\bin\x64d\capstone_wrapper.lib;$(ProjectDir)..\capstone_wrapper\capstone\capstone_x64.lib;ntdll\ntdll_x64.lib;keystone\keystone_x64.lib;yara\yara_x64.lib;lz4\lz4_x64.lib;jansson\jansson_x64.lib;DeviceNameResolver\DeviceNameResolver_x64.lib;XEDParse\XEDParse_x64.lib;$(SolutionDir)bin\x64d\x64bridge.lib;dbghelp\dbghelp_x64.lib;TitanEngine\TitanEngine_x64.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) + $(ProjectDir)..\zydis_wrapper\bin\x64d\zydis_wrapper.lib;ntdll\ntdll_x64.lib;keystone\keystone_x64.lib;yara\yara_x64.lib;lz4\lz4_x64.lib;jansson\jansson_x64.lib;DeviceNameResolver\DeviceNameResolver_x64.lib;XEDParse\XEDParse_x64.lib;$(SolutionDir)bin\x64d\x64bridge.lib;dbghelp\dbghelp_x64.lib;TitanEngine\TitanEngine_x64.lib;ws2_32.lib;psapi.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;shlwapi.lib;%(AdditionalDependencies) diff --git a/src/gui/Src/BasicView/Disassembly.cpp b/src/gui/Src/BasicView/Disassembly.cpp index 1033d83a..195b7ee3 100644 --- a/src/gui/Src/BasicView/Disassembly.cpp +++ b/src/gui/Src/BasicView/Disassembly.cpp @@ -6,7 +6,6 @@ #include "MainWindow.h" #include "CachedFontMetrics.h" #include "QBeaEngine.h" -#include "CsQBeaEngine.h" #include "MemoryPage.h" Disassembly::Disassembly(QWidget* parent) : AbstractTableView(parent), mDisassemblyPopup(this) @@ -34,8 +33,6 @@ Disassembly::Disassembly(QWidget* parent) : AbstractTableView(parent), mDisassem mDisasm = new QBeaEngine(maxModuleSize); mDisasm->UpdateConfig(); - mCsDisasm = new CsQBeaEngine(maxModuleSize); - mCsDisasm->UpdateConfig(); mCodeFoldingManager = nullptr; duint setting; diff --git a/src/gui/Src/BasicView/Disassembly.h b/src/gui/Src/BasicView/Disassembly.h index 12422661..7ec88073 100644 --- a/src/gui/Src/BasicView/Disassembly.h +++ b/src/gui/Src/BasicView/Disassembly.h @@ -6,7 +6,6 @@ class CodeFoldingHelper; class QBeaEngine; -class CsQBeaEngine; class MemoryPage; class Disassembly : public AbstractTableView @@ -224,7 +223,6 @@ protected: bool mPopupEnabled; MemoryPage* mMemPage; QBeaEngine* mDisasm; - CsQBeaEngine* mCsDisasm; bool mShowMnemonicBrief; XREF_INFO mXrefInfo; CodeFoldingHelper* mCodeFoldingManager; diff --git a/src/gui/Src/Disassembler/CsQBeaEngine.cpp b/src/gui/Src/Disassembler/CsQBeaEngine.cpp deleted file mode 100644 index 67200182..00000000 --- a/src/gui/Src/Disassembler/CsQBeaEngine.cpp +++ /dev/null @@ -1,329 +0,0 @@ -#include "CsQBeaEngine.h" -#include "StringUtil.h" -#include "EncodeMap.h" -#include "CodeFolding.h" - -CsQBeaEngine::CsQBeaEngine(int maxModuleSize) - : _tokenizer(maxModuleSize), mCodeFoldingManager(nullptr), _bLongDataInst(false) -{ - CsCapstoneTokenizer::UpdateColors(); - UpdateDataInstructionMap(); - this->mEncodeMap = new EncodeMap(); -} - -CsQBeaEngine::~CsQBeaEngine() -{ - delete this->mEncodeMap; -} - -/** - * @brief Return the address of the nth instruction before the instruction pointed by ip. @n - * This function has been grabbed from OllyDbg ("Disassembleback" in asmserv.c) - * - * @param[in] data Address of the data to disassemble - * @param[in] base Original base address of the memory page (Required to disassemble destination addresses) - * @param[in] size Size of the data block pointed by data - * @param[in] ip RVA of the current instruction (Relative to data pointer) - * @param[in] n Number of instruction back - * - * @return Return the RVA (Relative to the data pointer) of the nth instruction before the instruction pointed by ip - */ -ulong CsQBeaEngine::DisassembleBack(byte_t* data, duint base, duint size, duint ip, int n) -{ - int i; - uint abuf[128], addr, back, cmdsize; - unsigned char* pdata; - - // Reset Disasm Structure - Capstone cp; - - // Check if the pointer is not null - if(data == NULL) - return 0; - - // Round the number of back instructions to 127 - if(n < 0) - n = 0; - else if(n > 127) - n = 127; - - // Check if the instruction pointer ip is not outside the memory range - if(ip >= size) - ip = size - 1; - - // Obvious answer - if(n == 0) - return ip; - - if(ip < (uint)n) - return ip; - - //TODO: buffer overflow due to unchecked "back" value - back = MAX_DISASM_BUFFER * (n + 3); // Instruction length limited to 16 - - if(ip < back) - back = ip; - - addr = ip - back; - if(mCodeFoldingManager && mCodeFoldingManager->isFolded(addr + base)) - { - duint newback = mCodeFoldingManager->getFoldBegin(addr + base); - if(newback >= base && newback < size + base) - addr = newback - base; - } - - pdata = data + addr; - - for(i = 0; addr < ip; i++) - { - abuf[i % 128] = addr; - - if(mCodeFoldingManager && mCodeFoldingManager->isFolded(addr + base)) - { - duint newaddr = mCodeFoldingManager->getFoldBegin(addr + base); - if(newaddr >= base) - { - addr = newaddr - base; - } - cmdsize = mCodeFoldingManager->getFoldEnd(addr + base) - (addr + base) + 1; - } - else - { - if(!cp.DisassembleSafe(addr + base, pdata, (int)size)) - cmdsize = 2; //heuristic for better output (FF FE or FE FF are usually part of an instruction) - else - cmdsize = cp.Size(); - - cmdsize = mEncodeMap->getDataSize(base + addr, cmdsize); - - } - - - pdata += cmdsize; - addr += cmdsize; - back -= cmdsize; - size -= cmdsize; - } - - if(i < n) - return abuf[0]; - else - return abuf[(i - n + 128) % 128]; - -} - -/** - * @brief Return the address of the nth instruction after the instruction pointed by ip. @n - * This function has been grabbed from OllyDbg ("Disassembleforward" in asmserv.c) - * - * @param[in] data Address of the data to disassemble - * @param[in] base Original base address of the memory page (Required to disassemble destination addresses) - * @param[in] size Size of the data block pointed by data - * @param[in] ip RVA of the current instruction (Relative to data pointer) - * @param[in] n Number of instruction next - * - * @return Return the RVA (Relative to the data pointer) of the nth instruction after the instruction pointed by ip - */ -ulong CsQBeaEngine::DisassembleNext(byte_t* data, duint base, duint size, duint ip, int n) -{ - int i; - uint cmdsize; - unsigned char* pdata; - - // Reset Disasm Structure - Capstone cp; - - if(data == NULL) - return 0; - - if(ip >= size) - ip = size - 1; - - if(n <= 0) - return ip; - - - pdata = data + ip; - size -= ip; - - for(i = 0; i < n && size > 0; i++) - { - if(mCodeFoldingManager && mCodeFoldingManager->isFolded(ip + base)) - { - cmdsize = mCodeFoldingManager->getFoldEnd(ip + base) - (ip + base) + 1; - } - else - { - if(!cp.DisassembleSafe(ip + base, pdata, (int)size)) - cmdsize = 1; - else - cmdsize = cp.Size(); - - cmdsize = mEncodeMap->getDataSize(base + ip, cmdsize); - - } - - pdata += cmdsize; - ip += cmdsize; - size -= cmdsize; - } - - return ip; -} - -/** - * @brief Disassemble the instruction at the given ip RVA. - * - * @param[in] data Pointer to memory data (Can be either a buffer or the original data memory) - * @param[in] size Size of the memory pointed by data (Can be the memory page size if data points to the original memory page base address) - * @param[in] origBase Original base address of the memory page (Required to disassemble destination addresses) - * @param[in] origInstRVA Original Instruction RVA of the instruction to disassemble - * - * @return Return the disassembled instruction - */ -Instruction_t CsQBeaEngine::DisassembleAt(byte_t* data, duint size, duint origBase, duint origInstRVA, bool datainstr) -{ - if(datainstr) - { - ENCODETYPE type = mEncodeMap->getDataType(origBase + origInstRVA); - if(!mEncodeMap->isCode(type)) - return DecodeDataAt(data, size, origBase, origInstRVA, type); - } - //tokenize - CapstoneTokenizer::InstructionToken cap; - _tokenizer.Tokenize(origBase + origInstRVA, data, size, cap); - int len = _tokenizer.Size(); - - const auto & cp = _tokenizer.GetCapstone(); - bool success = cp.Success(); - - - auto branchType = Instruction_t::None; - Instruction_t wInst; - if(success && (cp.InGroup(CS_GRP_JUMP) || cp.IsLoop() || cp.InGroup(CS_GRP_CALL) || cp.InGroup(CS_GRP_RET))) - { - wInst.branchDestination = DbgGetBranchDestination(origBase + origInstRVA); - switch(cp.GetId()) - { - case X86_INS_JMP: - case X86_INS_LJMP: - branchType = Instruction_t::Unconditional; - break; - case X86_INS_CALL: - case X86_INS_LCALL: - branchType = Instruction_t::Call; - break; - default: - branchType = cp.InGroup(CS_GRP_RET) ? Instruction_t::None : Instruction_t::Conditional; - break; - } - } - else - wInst.branchDestination = 0; - - wInst.instStr = QString(cp.InstructionText().c_str()); - wInst.dump = QByteArray((const char*)data, len); - wInst.rva = origInstRVA; - if(mCodeFoldingManager && mCodeFoldingManager->isFolded(origInstRVA)) - wInst.length = mCodeFoldingManager->getFoldEnd(origInstRVA + origBase) - (origInstRVA + origBase) + 1; - else - wInst.length = len; - wInst.branchType = branchType; - wInst.tokens = cap; - - if(success) - { - cp.RegInfo(reginfo); - cp.FlagInfo(flaginfo); - - auto flaginfo2reginfo = [](uint8_t info) - { - auto result = 0; -#define checkFlag(test, reg) result |= (info & test) == test ? reg : 0 - checkFlag(Capstone::Modify, Capstone::Write); - checkFlag(Capstone::Prior, Capstone::None); - checkFlag(Capstone::Reset, Capstone::Write); - checkFlag(Capstone::Set, Capstone::Write); - checkFlag(Capstone::Test, Capstone::Read); - checkFlag(Capstone::Undefined, Capstone::None); -#undef checkFlag - return result; - }; - - for(uint8_t i = Capstone::FLAG_INVALID; i < Capstone::FLAG_ENDING; i++) - if(flaginfo[i]) - { - reginfo[X86_REG_EFLAGS] = Capstone::None; - wInst.regsReferenced.push_back({cp.FlagName(Capstone::Flag(i)), flaginfo2reginfo(flaginfo[i])}); - } - - reginfo[ArchValue(X86_REG_EIP, X86_REG_RIP)] = Capstone::None; - for(uint8_t i = X86_REG_INVALID; i < X86_REG_ENDING; i++) - if(reginfo[i]) - wInst.regsReferenced.push_back({cp.RegName(x86_reg(i)), reginfo[i]}); - } - - return wInst; -} - -Instruction_t CsQBeaEngine::DecodeDataAt(byte_t* data, duint size, duint origBase, duint origInstRVA, ENCODETYPE type) -{ - //tokenize - CapstoneTokenizer::InstructionToken cap; - - auto infoIter = dataInstMap.constFind(type); - if(infoIter == dataInstMap.end()) - infoIter = dataInstMap.constFind(enc_byte); - - int len = mEncodeMap->getDataSize(origBase + origInstRVA, 1); - - QString mnemonic = _bLongDataInst ? infoIter.value().longName : infoIter.value().shortName; - - len = std::min(len, (int)size); - - QString datastr = GetDataTypeString(data, len, type); - - _tokenizer.TokenizeData(mnemonic, datastr, cap); - - Instruction_t wInst; - wInst.instStr = mnemonic + " " + datastr; - wInst.dump = QByteArray((const char*)data, len); - wInst.rva = origInstRVA; - wInst.length = len; - wInst.branchType = Instruction_t::None; - wInst.branchDestination = 0; - wInst.tokens = cap; - - return wInst; -} - -void CsQBeaEngine::UpdateDataInstructionMap() -{ - dataInstMap.clear(); - dataInstMap.insert(enc_byte, {"db", "byte", "int8"}); - dataInstMap.insert(enc_word, {"dw", "word", "short"}); - dataInstMap.insert(enc_dword, {"dd", "dword", "int"}); - dataInstMap.insert(enc_fword, {"df", "fword", "fword"}); - dataInstMap.insert(enc_qword, {"dq", "qword", "long"}); - dataInstMap.insert(enc_tbyte, {"tbyte", "tbyte", "tbyte"}); - dataInstMap.insert(enc_oword, {"oword", "oword", "oword"}); - dataInstMap.insert(enc_mmword, {"mmword", "mmword", "long long"}); - dataInstMap.insert(enc_xmmword, {"xmmword", "xmmword", "_m128"}); - dataInstMap.insert(enc_ymmword, {"ymmword", "ymmword", "_m256"}); - dataInstMap.insert(enc_real4, {"real4", "real4", "float"}); - dataInstMap.insert(enc_real8, {"real8", "real8", "double"}); - dataInstMap.insert(enc_real10, {"real10", "real10", "long double"}); - dataInstMap.insert(enc_ascii, {"ascii", "ascii", "string"}); - dataInstMap.insert(enc_unicode, {"unicode", "unicode", "wstring"}); -} - -void CsQBeaEngine::setCodeFoldingManager(CodeFoldingHelper* CodeFoldingManager) -{ - mCodeFoldingManager = CodeFoldingManager; -} - -void CsQBeaEngine::UpdateConfig() -{ - _bLongDataInst = ConfigBool("Disassembler", "LongDataInstruction"); - _tokenizer.UpdateConfig(); -} diff --git a/src/gui/Src/Disassembler/CsQBeaEngine.h b/src/gui/Src/Disassembler/CsQBeaEngine.h deleted file mode 100644 index 6db9e536..00000000 --- a/src/gui/Src/Disassembler/CsQBeaEngine.h +++ /dev/null @@ -1,47 +0,0 @@ -#ifndef CSQBEAENGINE_H -#define CSQBEAENGINE_H - -#include -#include -#include "cs_capstone_gui.h" -#include "QBeaEngine.h" // for instruction_t - -class EncodeMap; -class CodeFoldingHelper; - -class CsQBeaEngine -{ -public: - explicit CsQBeaEngine(int maxModuleSize); - ~CsQBeaEngine(); - ulong DisassembleBack(byte_t* data, duint base, duint size, duint ip, int n); - ulong DisassembleNext(byte_t* data, duint base, duint size, duint ip, int n); - Instruction_t DisassembleAt(byte_t* data, duint size, duint origBase, duint origInstRVA, bool datainstr = true); - Instruction_t DecodeDataAt(byte_t* data, duint size, duint origBase, duint origInstRVA, ENCODETYPE type); - void setCodeFoldingManager(CodeFoldingHelper* CodeFoldingManager); - void UpdateConfig(); - - EncodeMap* getEncodeMap() - { - return mEncodeMap; - } - -private: - struct DataInstructionInfo - { - QString shortName; - QString longName; - QString cName; - }; - - void UpdateDataInstructionMap(); - CsCapstoneTokenizer _tokenizer; - QHash dataInstMap; - bool _bLongDataInst; - EncodeMap* mEncodeMap; - CodeFoldingHelper* mCodeFoldingManager; - uint8_t reginfo[X86_REG_ENDING]; - uint8_t flaginfo[Capstone::FLAG_ENDING]; -}; - -#endif // CSQBEAENGINE_H diff --git a/src/gui/Src/Disassembler/cs_capstone_gui.cpp b/src/gui/Src/Disassembler/cs_capstone_gui.cpp deleted file mode 100644 index 6ad4d5e8..00000000 --- a/src/gui/Src/Disassembler/cs_capstone_gui.cpp +++ /dev/null @@ -1,630 +0,0 @@ -#include "cs_capstone_gui.h" -#include "Configuration.h" -#include "StringUtil.h" -#include "CachedFontMetrics.h" - -CsCapstoneTokenizer::CsCapstoneTokenizer(int maxModuleLength) - : _maxModuleLength(maxModuleLength), - _success(false), - isNop(false), - _mnemonicType(CapstoneTokenizer::TokenType::Uncategorized) -{ - SetConfig(false, false, false, false, false, false, false, false, false); -} - -static CapstoneTokenizer::TokenColor colorNamesMap[CapstoneTokenizer::TokenType::Last]; -QHash CsCapstoneTokenizer::stringPoolMap; -int CsCapstoneTokenizer::poolId = 0; - -void CsCapstoneTokenizer::addColorName(CapstoneTokenizer::TokenType type, QString color, QString backgroundColor) -{ - colorNamesMap[int(type)] = CapstoneTokenizer::TokenColor(color, backgroundColor); -} - -void CsCapstoneTokenizer::addStringsToPool(const QString & strings) -{ - QStringList stringList = strings.split(' ', QString::SkipEmptyParts); - for(const QString & string : stringList) - stringPoolMap.insert(string, poolId); - poolId++; -} - -void CsCapstoneTokenizer::UpdateColors() -{ - //filling - addColorName(CapstoneTokenizer::TokenType::Comma, "InstructionCommaColor", "InstructionCommaBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::Space, "", ""); - addColorName(CapstoneTokenizer::TokenType::ArgumentSpace, "", ""); - addColorName(CapstoneTokenizer::TokenType::MemoryOperatorSpace, "", ""); - //general instruction parts - addColorName(CapstoneTokenizer::TokenType::Prefix, "InstructionPrefixColor", "InstructionPrefixBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::Uncategorized, "InstructionUncategorizedColor", "InstructionUncategorizedBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::Address, "InstructionAddressColor", "InstructionAddressBackgroundColor"); //jump/call destinations - addColorName(CapstoneTokenizer::TokenType::Value, "InstructionValueColor", "InstructionValueBackgroundColor"); - //mnemonics - addColorName(CapstoneTokenizer::TokenType::MnemonicNormal, "InstructionMnemonicColor", "InstructionMnemonicBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicPushPop, "InstructionPushPopColor", "InstructionPushPopBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicCall, "InstructionCallColor", "InstructionCallBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicRet, "InstructionRetColor", "InstructionRetBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicCondJump, "InstructionConditionalJumpColor", "InstructionConditionalJumpBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicUncondJump, "InstructionUnconditionalJumpColor", "InstructionUnconditionalJumpBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicNop, "InstructionNopColor", "InstructionNopBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicFar, "InstructionFarColor", "InstructionFarBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicInt3, "InstructionInt3Color", "InstructionInt3BackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MnemonicUnusual, "InstructionUnusualColor", "InstructionUnusualBackgroundColor"); - //memory - addColorName(CapstoneTokenizer::TokenType::MemorySize, "InstructionMemorySizeColor", "InstructionMemorySizeBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemorySegment, "InstructionMemorySegmentColor", "InstructionMemorySegmentBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryBrackets, "InstructionMemoryBracketsColor", "InstructionMemoryBracketsBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryStackBrackets, "InstructionMemoryStackBracketsColor", "InstructionMemoryStackBracketsBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryBaseRegister, "InstructionMemoryBaseRegisterColor", "InstructionMemoryBaseRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryIndexRegister, "InstructionMemoryIndexRegisterColor", "InstructionMemoryIndexRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryScale, "InstructionMemoryScaleColor", "InstructionMemoryScaleBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MemoryOperator, "InstructionMemoryOperatorColor", "InstructionMemoryOperatorBackgroundColor"); - //registers - addColorName(CapstoneTokenizer::TokenType::GeneralRegister, "InstructionGeneralRegisterColor", "InstructionGeneralRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::FpuRegister, "InstructionFpuRegisterColor", "InstructionFpuRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::MmxRegister, "InstructionMmxRegisterColor", "InstructionMmxRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::XmmRegister, "InstructionXmmRegisterColor", "InstructionXmmRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::YmmRegister, "InstructionYmmRegisterColor", "InstructionYmmRegisterBackgroundColor"); - addColorName(CapstoneTokenizer::TokenType::ZmmRegister, "InstructionZmmRegisterColor", "InstructionZmmRegisterBackgroundColor"); -} - -void CsCapstoneTokenizer::UpdateStringPool() -{ - poolId = 0; - stringPoolMap.clear(); - // These registers must be in lower case. - addStringsToPool("rax eax ax al ah"); - addStringsToPool("rbx ebx bx bl bh"); - addStringsToPool("rcx ecx cx cl ch"); - addStringsToPool("rdx edx dx dl dh"); - addStringsToPool("rsi esi si sil"); - addStringsToPool("rdi edi di dil"); - addStringsToPool("rbp ebp bp bpl"); - addStringsToPool("rsp esp sp spl"); - addStringsToPool("r8 r8d r8w r8b"); - addStringsToPool("r9 r9d r9w r9b"); - addStringsToPool("r10 r10d r10w r10b"); - addStringsToPool("r11 r11d r11w r11b"); - addStringsToPool("r12 r12d r12w r12b"); - addStringsToPool("r13 r13d r13w r13b"); - addStringsToPool("r14 r14d r14w r14b"); - addStringsToPool("r15 r15d r15w r15b"); - addStringsToPool("xmm0 ymm0"); - addStringsToPool("xmm1 ymm1"); - addStringsToPool("xmm2 ymm2"); - addStringsToPool("xmm3 ymm3"); - addStringsToPool("xmm4 ymm4"); - addStringsToPool("xmm5 ymm5"); - addStringsToPool("xmm6 ymm6"); - addStringsToPool("xmm7 ymm7"); - addStringsToPool("xmm8 ymm8"); - addStringsToPool("xmm9 ymm9"); - addStringsToPool("xmm10 ymm10"); - addStringsToPool("xmm11 ymm11"); - addStringsToPool("xmm12 ymm12"); - addStringsToPool("xmm13 ymm13"); - addStringsToPool("xmm14 ymm14"); - addStringsToPool("xmm15 ymm15"); -} - -bool CsCapstoneTokenizer::Tokenize(duint addr, const unsigned char* data, int datasize, CapstoneTokenizer::InstructionToken & instruction) -{ - _inst = CapstoneTokenizer::InstructionToken(); - - _success = _cp.DisassembleSafe(addr, data, datasize); - if(_success) - { - isNop = _cp.IsNop(); - if(!tokenizeMnemonic()) - return false; - - for(int i = 0; i < _cp.OpCount(); i++) - { - if(i) - { - addToken(CapstoneTokenizer::TokenType::Comma, ","); - if(_bArgumentSpaces) - addToken(CapstoneTokenizer::TokenType::ArgumentSpace, " "); - } - if(!tokenizeOperand(_cp[i])) - return false; - } - } - else - { - isNop = false; - addToken(CapstoneTokenizer::TokenType::MnemonicUnusual, "???"); - } - - if(_bNoHighlightOperands) - { - while(_inst.tokens.size() && _inst.tokens[_inst.tokens.size() - 1].type == CapstoneTokenizer::TokenType::Space) - _inst.tokens.pop_back(); - for(CapstoneTokenizer::SingleToken & token : _inst.tokens) - token.type = _mnemonicType; - } - - instruction = _inst; - - return true; -} - -bool CsCapstoneTokenizer::TokenizeData(const QString & datatype, const QString & data, CapstoneTokenizer::InstructionToken & instruction) -{ - _inst = CapstoneTokenizer::InstructionToken(); - isNop = false; - - if(!tokenizeMnemonic(CapstoneTokenizer::TokenType::MnemonicNormal, datatype)) - return false; - - addToken(CapstoneTokenizer::TokenType::Value, data); - - instruction = _inst; - - return true; -} - -void CsCapstoneTokenizer::UpdateConfig() -{ - SetConfig(ConfigBool("Disassembler", "Uppercase"), - ConfigBool("Disassembler", "TabbedMnemonic"), - ConfigBool("Disassembler", "ArgumentSpaces"), - ConfigBool("Disassembler", "HidePointerSizes"), - ConfigBool("Disassembler", "HideNormalSegments"), - ConfigBool("Disassembler", "MemorySpaces"), - ConfigBool("Disassembler", "NoHighlightOperands"), - ConfigBool("Disassembler", "NoCurrentModuleText"), - ConfigBool("Disassembler", "0xPrefixValues")); - _maxModuleLength = (int)ConfigUint("Disassembler", "MaxModuleSize"); - UpdateStringPool(); -} - -void CsCapstoneTokenizer::SetConfig(bool bUppercase, bool bTabbedMnemonic, bool bArgumentSpaces, bool bHidePointerSizes, bool bHideNormalSegments, bool bMemorySpaces, bool bNoHighlightOperands, bool bNoCurrentModuleText, bool b0xPrefixValues) -{ - _bUppercase = bUppercase; - _bTabbedMnemonic = bTabbedMnemonic; - _bArgumentSpaces = bArgumentSpaces; - _bHidePointerSizes = bHidePointerSizes; - _bHideNormalSegments = bHideNormalSegments; - _bMemorySpaces = bMemorySpaces; - _bNoHighlightOperands = bNoHighlightOperands; - _bNoCurrentModuleText = bNoCurrentModuleText; - _b0xPrefixValues = b0xPrefixValues; -} - -int CsCapstoneTokenizer::Size() const -{ - return _success ? _cp.Size() : 1; -} - -const Capstone & CsCapstoneTokenizer::GetCapstone() const -{ - return _cp; -} - -void CsCapstoneTokenizer::TokenToRichText(const CapstoneTokenizer::InstructionToken & instr, RichTextPainter::List & richTextList, const CapstoneTokenizer::SingleToken* highlightToken) -{ - QColor highlightColor = ConfigColor("InstructionHighlightColor"); - for(const auto & token : instr.tokens) - { - RichTextPainter::CustomRichText_t richText; - richText.highlight = TokenEquals(&token, highlightToken); - richText.highlightColor = highlightColor; - richText.flags = RichTextPainter::FlagNone; - richText.text = token.text; - if(token.type < CapstoneTokenizer::TokenType::Last) - { - const auto & tokenColor = colorNamesMap[int(token.type)]; - richText.flags = tokenColor.flags; - richText.textColor = tokenColor.color; - richText.textBackground = tokenColor.backgroundColor; - } - richTextList.push_back(richText); - } -} - -bool CsCapstoneTokenizer::TokenFromX(const CapstoneTokenizer::InstructionToken & instr, CapstoneTokenizer::SingleToken & token, int x, CachedFontMetrics* fontMetrics) -{ - if(x < instr.x) //before the first token - return false; - int len = int(instr.tokens.size()); - for(int i = 0, xStart = instr.x; i < len; i++) - { - const auto & curToken = instr.tokens.at(i); - int curWidth = fontMetrics->width(curToken.text); - int xEnd = xStart + curWidth; - if(x >= xStart && x < xEnd) - { - token = curToken; - return true; - } - xStart = xEnd; - } - return false; //not found -} - -bool CsCapstoneTokenizer::IsHighlightableToken(const CapstoneTokenizer::SingleToken & token) -{ - switch(token.type) - { - case CapstoneTokenizer::TokenType::Comma: - case CapstoneTokenizer::TokenType::Space: - case CapstoneTokenizer::TokenType::ArgumentSpace: - case CapstoneTokenizer::TokenType::Uncategorized: - case CapstoneTokenizer::TokenType::MemoryOperatorSpace: - case CapstoneTokenizer::TokenType::MemoryBrackets: - case CapstoneTokenizer::TokenType::MemoryStackBrackets: - case CapstoneTokenizer::TokenType::MemoryOperator: - return false; - break; - } - return true; -} - -bool CsCapstoneTokenizer::tokenTextPoolEquals(const QString & a, const QString & b) -{ - if(a.compare(b, Qt::CaseInsensitive) == 0) - return true; - auto found1 = stringPoolMap.find(a.toLower()); - auto found2 = stringPoolMap.find(b.toLower()); - if(found1 == stringPoolMap.end() || found2 == stringPoolMap.end()) - return false; - return found1.value() == found2.value(); -} - -bool CsCapstoneTokenizer::TokenEquals(const CapstoneTokenizer::SingleToken* a, const CapstoneTokenizer::SingleToken* b, bool ignoreSize) -{ - if(!a || !b) - return false; - if(a->value.size != 0 && b->value.size != 0) //we have a value - { - if(!ignoreSize && a->value.size != b->value.size) - return false; - else if(a->value.value != b->value.value) - return false; - } - return tokenTextPoolEquals(a->text, b->text); -} - -void CsCapstoneTokenizer::addToken(CapstoneTokenizer::TokenType type, QString text, const CapstoneTokenizer::TokenValue & value) -{ - switch(type) - { - case CapstoneTokenizer::TokenType::Space: - case CapstoneTokenizer::TokenType::ArgumentSpace: - case CapstoneTokenizer::TokenType::MemoryOperatorSpace: - break; - default: - text = text.trimmed(); - break; - } - if(_bUppercase && !value.size) - text = text.toUpper(); - _inst.tokens.push_back(CapstoneTokenizer::SingleToken(isNop ? CapstoneTokenizer::TokenType::MnemonicNop : type, text, value)); -} - -void CsCapstoneTokenizer::addToken(CapstoneTokenizer::TokenType type, const QString & text) -{ - addToken(type, text, CapstoneTokenizer::TokenValue()); -} - -void CsCapstoneTokenizer::addMemoryOperator(char operatorText) -{ - if(_bMemorySpaces) - addToken(CapstoneTokenizer::TokenType::MemoryOperatorSpace, " "); - QString text; - text += operatorText; - addToken(CapstoneTokenizer::TokenType::MemoryOperator, text); - if(_bMemorySpaces) - addToken(CapstoneTokenizer::TokenType::MemoryOperatorSpace, " "); -} - -QString CsCapstoneTokenizer::printValue(const CapstoneTokenizer::TokenValue & value, bool expandModule, int maxModuleLength) const -{ - QString labelText; - char label_[MAX_LABEL_SIZE] = ""; - char module_[MAX_MODULE_SIZE] = ""; - QString moduleText; - duint addr = value.value; - bool bHasLabel = DbgGetLabelAt(addr, SEG_DEFAULT, label_); - labelText = QString(label_); - bool bHasModule; - if(_bNoCurrentModuleText) - { - duint size, base; - base = DbgMemFindBaseAddr(this->GetCapstone().Address(), &size); - if(addr >= base && addr < base + size) - bHasModule = false; - else - bHasModule = (expandModule && DbgGetModuleAt(addr, module_) && !QString(labelText).startsWith("JMP.&")); - } - else - bHasModule = (expandModule && DbgGetModuleAt(addr, module_) && !QString(labelText).startsWith("JMP.&")); - moduleText = QString(module_); - if(maxModuleLength != -1) - moduleText.truncate(maxModuleLength); - if(moduleText.length()) - moduleText += "."; - QString addrText = ToHexString(addr); - QString finalText; - if(bHasLabel && bHasModule) // - finalText = QString("<%1%2>").arg(moduleText).arg(labelText); - else if(bHasModule) //module.addr - finalText = QString("%1%2").arg(moduleText).arg(addrText); - else if(bHasLabel) //