x64dbg/testplugin
1
0 Fork 0
mirror of https://github.com/x64dbg/testplugin.git synced 2026-11-09 05:49:35 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity

Compare commits

base: x64dbg/testplugin:master
x64dbg/testplugin:v25 x64dbg/testplugin:unicorn_porn x64dbg/testplugin:master
x64dbg/testplugin:3fe9f6e2 x64dbg/testplugin:_scriptapi x64dbg/testplugin:Wingraph x64dbg/testplugin:AngelScript
...
compare: x64dbg/testplugin:v25
x64dbg/testplugin:v25 x64dbg/testplugin:unicorn_porn x64dbg/testplugin:master
x64dbg/testplugin:3fe9f6e2 x64dbg/testplugin:_scriptapi x64dbg/testplugin:Wingraph x64dbg/testplugin:AngelScript
11 Commits
master ... v25
Author SHA1 Message Date
mrexodia 4ceae85ca8 updated to the latest pluginsdk 2016-07-18 23:23:27 +02:00
mrexodia 4a30b8545d added sample exprfunction (works great!) 2016-07-07 13:40:24 +02:00
mrexodia 2fc6ffeef4 updated to latest pluginsdk 2016-07-07 13:40:06 +02:00
mrexodia af1cf8bdc8 updated to the latest pluginsdk version 2016-04-20 23:52:17 +02:00
Mr. eXoDia 204c9b4348 module & section enumeration example code (tested and working) 2015-08-02 19:54:45 +02:00
Mr. eXoDia 49ee4dea44 updated pluginsdk 2015-08-01 18:55:15 +02:00
Mr. eXoDia d278a31ffe support _scriptapi with AngelScript 2015-06-22 03:14:56 +02:00
Mr. eXoDia 3fe9f6e2d5 added AngelScript sample script engine code 2015-06-21 03:11:16 +02:00
Mr. eXoDia 406bf467ab updated pluginsdk 2015-06-21 03:10:09 +02:00
Mr. eXoDia 5daa06fea2 icons example 2015-04-27 00:28:38 +02:00
Mr. eXoDia bdd596c9e9 updated pluginsdk to v25 2015-04-27 00:28:10 +02:00
110 changed files with 19223 additions and 4771 deletions
Expand all files Collapse all files

No files matched your search

angelscript/angelscript.h
+1943
View File
File diff suppressed because it is too large. Load diff
angelscript/angelscript.lib
BIN
View File
Binary file not shown.
angelscript/angelscript64.lib
BIN
View File
Binary file not shown.
angelscript/sampleScript.as
+13
View File
@@ -0,0 +1,13 @@
void main()
{
// Print the value that we received
Print("Script started!\n");
// Do some stepping
for(int i=0; i<100; i++) {
Print("Stepping " + (i+1) + "...\n");
StepIn();
}
StepOver();
StepOut();
}
angelscript/scriptstdstring.cpp
+1237
View File
File diff suppressed because it is too large. Load diff
angelscript/scriptstdstring.h
+53
View File
@@ -0,0 +1,53 @@
//
// Script std::string
//
// This function registers the std::string type with AngelScript to be used as the default string type.
//
// The string type is registered as a value type, thus may have performance issues if a lot of
// string operations are performed in the script. However, for relatively few operations, this should
// not cause any problem for most applications.
//
#ifndef SCRIPTSTDSTRING_H
#define SCRIPTSTDSTRING_H
#ifndef ANGELSCRIPT_H
// Avoid having to inform include path if header is already include before
#include "angelscript.h"
#endif
#include <string>
//---------------------------
// Compilation settings
//
// The use of the string pool can improve performance quite drastically
// for scripts that work with a lot of literal string constants.
//
// 1 = on
// 0 = off
#ifndef AS_USE_STRINGPOOL
#define AS_USE_STRINGPOOL 1
#endif
// Sometimes it may be desired to use the same method names as used by C++ STL.
// This may for example reduce time when converting code from script to C++ or
// back.
//
// 0 = off
// 1 = on
#ifndef AS_USE_STLNAMES
#define AS_USE_STLNAMES 0
#endif
BEGIN_AS_NAMESPACE
void RegisterStdString(asIScriptEngine* engine);
void RegisterStdStringUtils(asIScriptEngine* engine);
END_AS_NAMESPACE
#endif
icons.h
+156
View File
@@ -0,0 +1,156 @@
#ifndef _ICONS_H
#define _ICONS_H
static unsigned char icon_rocket[762] =
{
0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00,
0x00, 0x0D, 0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x10, 0x08, 0x06, 0x00, 0x00, 0x00, 0x1F,
0xF3, 0xFF, 0x61, 0x00, 0x00, 0x00, 0x19, 0x74, 0x45, 0x58,
0x74, 0x53, 0x6F, 0x66, 0x74, 0x77, 0x61, 0x72, 0x65, 0x00,
0x41, 0x64, 0x6F, 0x62, 0x65, 0x20, 0x49, 0x6D, 0x61, 0x67,
0x65, 0x52, 0x65, 0x61, 0x64, 0x79, 0x71, 0xC9, 0x65, 0x3C,
0x00, 0x00, 0x02, 0x9C, 0x49, 0x44, 0x41, 0x54, 0x78, 0xDA,
0x84, 0x53, 0x5F, 0x48, 0x53, 0x61, 0x14, 0xFF, 0x7D, 0x77,
0xB7, 0xCD, 0x70, 0xFD, 0xD9, 0x6A, 0xA4, 0x73, 0xEB, 0x1F,
0xC3, 0x94, 0xB6, 0x5D, 0x72, 0x62, 0xA1, 0x08, 0x8A, 0x84,
0x82, 0x42, 0x24, 0x95, 0xD1, 0xC3, 0x4A, 0xCB, 0xE8, 0xA9,
0x57, 0x09, 0x7A, 0x2C, 0x0A, 0x7B, 0xA8, 0x40, 0x82, 0x09,
0xBD, 0xF8, 0x62, 0x0F, 0xBE, 0x04, 0x3E, 0xA4, 0x0F, 0x19,
0xE4, 0x88, 0x89, 0x6D, 0x12, 0x2B, 0x88, 0x48, 0x99, 0xA3,
0x39, 0x75, 0x13, 0xAE, 0x4D, 0xE7, 0xEE, 0x76, 0xEF, 0xED,
0xFB, 0xAE, 0xDD, 0xE1, 0x14, 0xEA, 0xC0, 0x8F, 0xEF, 0xE3,
0x9C, 0xFB, 0xFB, 0x9D, 0x73, 0xBE, 0x73, 0x2E, 0xC1, 0x2E,
0x33, 0x18, 0x0C, 0xE0, 0x38, 0x0E, 0xB2, 0x2C, 0x43, 0x51,
0x94, 0x9D, 0x21, 0xE1, 0x27, 0x21, 0x8F, 0x56, 0x55, 0xD5,
0x9A, 0x05, 0x4C, 0x1B, 0xD4, 0x91, 0x00, 0x86, 0x79, 0xBB,
0xDD, 0x0E, 0x42, 0x88, 0x06, 0x66, 0xEC, 0x8C, 0xC7, 0xE3,
0xBB, 0x75, 0x05, 0x8A, 0xF3, 0xCE, 0x9C, 0xD4, 0x55, 0xE8,
0xB9, 0x86, 0xEA, 0xDA, 0x5A, 0x48, 0x0B, 0x0B, 0x78, 0x3B,
0x3A, 0x7A, 0x87, 0xAF, 0xAC, 0xAC, 0xD4, 0x32, 0x32, 0xE8,
0xB6, 0x4B, 0x40, 0x23, 0x4B, 0x52, 0x3E, 0x30, 0x37, 0x17,
0x81, 0xF3, 0xD5, 0x6B, 0x4C, 0x09, 0x35, 0xF0, 0xD5, 0xD7,
0xE3, 0x10, 0x20, 0x71, 0xF8, 0xB7, 0x15, 0xC9, 0xC1, 0xE0,
0x34, 0xAB, 0x0F, 0xE1, 0xF0, 0x17, 0x78, 0x83, 0xDF, 0xB0,
0x10, 0x8B, 0xE1, 0x08, 0x21, 0x5B, 0xDC, 0xFF, 0xC8, 0xB3,
0x9F, 0xC3, 0x81, 0xB3, 0x6E, 0x2F, 0x0E, 0x1C, 0x6F, 0xC1,
0xEC, 0xEC, 0x57, 0x58, 0x2C, 0x15, 0x88, 0x51, 0x72, 0xC5,
0xD8, 0xA4, 0x78, 0x14, 0xD8, 0x22, 0x3E, 0x9F, 0x6F, 0x4F,
0x0B, 0xA1, 0x50, 0xA8, 0x98, 0xB9, 0xF3, 0x72, 0x2F, 0x0E,
0x57, 0x35, 0x6B, 0xFE, 0x54, 0xEC, 0x03, 0x5E, 0x0C, 0x0E,
0xC2, 0x68, 0xE4, 0xC4, 0x8E, 0x8E, 0xC6, 0x97, 0x65, 0x65,
0x65, 0xEF, 0x78, 0x16, 0x50, 0x55, 0xF5, 0x3A, 0x7D, 0x71,
0x27, 0xBB, 0x67, 0x32, 0x99, 0x02, 0x7D, 0xC8, 0x8D, 0x5C,
0x4E, 0x0A, 0x2C, 0x2D, 0x25, 0xE0, 0x3C, 0xE9, 0x41, 0xB5,
0xD7, 0xA7, 0x09, 0x7C, 0xE7, 0xC5, 0x12, 0x32, 0xFD, 0xEE,
0x13, 0x11, 0x04, 0x96, 0x0C, 0x03, 0x43, 0x43, 0x43, 0x4F,
0x57, 0x56, 0x56, 0x90, 0x4E, 0xA7, 0xD1, 0xD4, 0xD4, 0x84,
0x48, 0x24, 0x82, 0x86, 0x86, 0x0B, 0xF8, 0x31, 0xBF, 0x86,
0x50, 0x34, 0xAD, 0x55, 0xD8, 0x5C, 0x57, 0x25, 0xF6, 0xDD,
0xEC, 0x2C, 0x92, 0xB5, 0xB1, 0x5B, 0xAD, 0x56, 0x36, 0x73,
0x79, 0x66, 0x66, 0xA6, 0xE0, 0x72, 0xB9, 0xEA, 0x19, 0x99,
0xF5, 0xC8, 0x19, 0x38, 0x4C, 0x87, 0x3F, 0xA2, 0xE6, 0x94,
0x00, 0xA1, 0xC6, 0x41, 0x71, 0x4C, 0xBC, 0x7A, 0xA5, 0xAD,
0x84, 0xAC, 0x8D, 0xDD, 0x66, 0xB3, 0xB1, 0x16, 0x58, 0xE6,
0xBB, 0xD1, 0x68, 0x34, 0xC0, 0xC8, 0x39, 0x29, 0x87, 0xE4,
0xEF, 0x24, 0x14, 0x5E, 0x01, 0x51, 0x09, 0x5A, 0xCF, 0x5D,
0x2A, 0x29, 0x5B, 0x27, 0x6F, 0x6E, 0x6E, 0x82, 0xEB, 0x5B,
0x5D, 0xC5, 0xED, 0x54, 0x0A, 0xFD, 0xAA, 0x9A, 0x77, 0xBB,
0xDD, 0xF7, 0x4D, 0xE5, 0xA6, 0x22, 0xD9, 0x62, 0xB1, 0xC0,
0xE1, 0x74, 0xAC, 0x7B, 0x3C, 0x27, 0x86, 0x77, 0x92, 0x19,
0x71, 0x71, 0x71, 0x51, 0x03, 0x3F, 0xB0, 0x2D, 0x66, 0x43,
0x05, 0x6E, 0x9C, 0xE9, 0xC1, 0x7C, 0x7B, 0x5B, 0xFB, 0x93,
0x91, 0xF1, 0x91, 0x07, 0xCC, 0x69, 0x2E, 0x37, 0xAF, 0x07,
0xC7, 0x83, 0x07, 0xCD, 0x66, 0x73, 0x3E, 0x9B, 0xCD, 0x6A,
0xE4, 0x14, 0x4D, 0xC6, 0x04, 0x74, 0xD3, 0x67, 0xD7, 0x02,
0x3F, 0x92, 0xBD, 0x5D, 0xEA, 0xE9, 0xC7, 0xF7, 0x14, 0xBB,
0xBF, 0xCB, 0xFF, 0x4C, 0x27, 0x7B, 0x1A, 0x3D, 0xAC, 0x45,
0x22, 0x8A, 0x22, 0x12, 0x89, 0x44, 0x09, 0x59, 0x17, 0xD8,
0x4F, 0xB3, 0x5B, 0x70, 0x11, 0x71, 0x4C, 0x22, 0xD9, 0x3F,
0xA6, 0xD8, 0x6F, 0xA9, 0xEA, 0xAF, 0xEE, 0xD6, 0xEE, 0xC0,
0xC4, 0xFB, 0x89, 0x37, 0x9C, 0x91, 0x43, 0x3E, 0x9F, 0xE7,
0xE8, 0x78, 0x51, 0x28, 0x14, 0xF6, 0x6C, 0x1B, 0x59, 0x03,
0x1C, 0xB2, 0x17, 0xEE, 0xEC, 0x32, 0x5C, 0x53, 0xCB, 0xC8,
0x3E, 0x07, 0x22, 0x73, 0x74, 0xC3, 0x68, 0xCC, 0xC4, 0xF3,
0x7C, 0x35, 0x1D, 0x5F, 0x1D, 0xAD, 0x60, 0x99, 0x8A, 0x8C,
0x53, 0x5F, 0x0E, 0xDB, 0x31, 0x06, 0x89, 0x81, 0x09, 0x58,
0xA9, 0x6E, 0xF9, 0x43, 0x40, 0x1C, 0x06, 0x58, 0x0A, 0x23,
0xC5, 0x3E, 0x0A, 0x5E, 0x5B, 0x7E, 0xBA, 0x67, 0x14, 0xEC,
0xBF, 0x66, 0x31, 0xF9, 0xEF, 0xA9, 0xDF, 0xE5, 0x3F, 0x02,
0x0C, 0x00, 0xA5, 0xE1, 0x2F, 0x71, 0xD8, 0x1A, 0xDF, 0xDB,
0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42,
0x60, 0x82
};
static unsigned char icon_adler32[664] =
{
0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00,
0x00, 0x0D, 0x49, 0x48, 0x44, 0x52, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x10, 0x08, 0x06, 0x00, 0x00, 0x00, 0x1F,
0xF3, 0xFF, 0x61, 0x00, 0x00, 0x00, 0x19, 0x74, 0x45, 0x58,
0x74, 0x53, 0x6F, 0x66, 0x74, 0x77, 0x61, 0x72, 0x65, 0x00,
0x41, 0x64, 0x6F, 0x62, 0x65, 0x20, 0x49, 0x6D, 0x61, 0x67,
0x65, 0x52, 0x65, 0x61, 0x64, 0x79, 0x71, 0xC9, 0x65, 0x3C,
0x00, 0x00, 0x02, 0x3A, 0x49, 0x44, 0x41, 0x54, 0x78, 0xDA,
0x94, 0x93, 0x5F, 0x68, 0x92, 0x51, 0x18, 0xC6, 0x9F, 0xF3,
0x7D, 0x1A, 0x7C, 0x3A, 0x06, 0xC2, 0x24, 0x02, 0xBB, 0x30,
0x2A, 0x71, 0x88, 0x8D, 0xA0, 0x6E, 0xB2, 0xD2, 0x41, 0x17,
0x81, 0xCA, 0x17, 0x2B, 0xFA, 0x03, 0x0A, 0xC1, 0x12, 0x26,
0x06, 0x6D, 0xC4, 0x90, 0xBA, 0x30, 0x2F, 0xB2, 0x3F, 0x17,
0x5D, 0xEC, 0x22, 0xA8, 0x0D, 0x22, 0xA4, 0xBA, 0xC8, 0xD1,
0x4D, 0xD1, 0x45, 0x20, 0x6B, 0x83, 0xC8, 0x88, 0x99, 0x11,
0xC4, 0xA8, 0x51, 0x17, 0x93, 0x2E, 0xEC, 0x62, 0xD6, 0x14,
0x75, 0x47, 0x4F, 0xBE, 0x67, 0x4C, 0x08, 0x6C, 0xE1, 0x81,
0xC3, 0xCB, 0x7B, 0xDE, 0xDF, 0xF3, 0xF0, 0x9E, 0xF7, 0x3B,
0x1F, 0x53, 0x27, 0xD5, 0x3B, 0x00, 0xF6, 0xA1, 0xF7, 0x55,
0xE0, 0xB7, 0xF8, 0x84, 0x01, 0x2D, 0x0C, 0xF1, 0x2B, 0x4F,
0x7C, 0xE7, 0xE6, 0x9E, 0xC1, 0x6A, 0xB5, 0xFE, 0x57, 0x55,
0x2A, 0x95, 0xF0, 0xD8, 0x7B, 0x02, 0x86, 0xD4, 0x59, 0x46,
0xB9, 0xD2, 0x36, 0x60, 0x67, 0xB2, 0xB3, 0x68, 0x34, 0x1A,
0x18, 0xEE, 0xDF, 0x8E, 0x62, 0xB1, 0xB8, 0x65, 0x24, 0x8E,
0x78, 0xD2, 0x6D, 0x18, 0x34, 0xC1, 0x34, 0x4D, 0x43, 0xA5,
0x52, 0xC1, 0x60, 0x5D, 0xC3, 0xF2, 0xDB, 0x65, 0x1C, 0xB7,
0xEE, 0xEC, 0x1A, 0xA9, 0x4E, 0x1C, 0xF1, 0xA4, 0x23, 0x03,
0xA6, 0x5E, 0x54, 0x5F, 0xCF, 0x8E, 0x26, 0x8F, 0x38, 0xD6,
0x8C, 0xB8, 0x7A, 0x3B, 0x8B, 0x5F, 0x95, 0xE6, 0x3F, 0xDB,
0xEF, 0x37, 0xAB, 0xB8, 0x3E, 0x39, 0x8C, 0xA5, 0xBE, 0x75,
0x8C, 0xCC, 0x24, 0xE6, 0xF9, 0x14, 0x3F, 0x0A, 0x75, 0x4C,
0x9D, 0xD7, 0x1F, 0xE9, 0xC2, 0x15, 0x73, 0x09, 0xAF, 0xD7,
0x2B, 0x0A, 0x85, 0x82, 0x68, 0xB5, 0x5A, 0x22, 0x9F, 0xCF,
0x8B, 0x50, 0x28, 0x24, 0x23, 0xE5, 0x74, 0x4E, 0x75, 0xE2,
0x88, 0x27, 0x9D, 0x10, 0x02, 0x8A, 0x68, 0x0A, 0x76, 0xDA,
0xEE, 0xC4, 0xDC, 0xD8, 0x05, 0x70, 0xCE, 0x91, 0x4A, 0xA5,
0xA0, 0xEB, 0x3A, 0x9C, 0x4E, 0x27, 0xCA, 0xE5, 0x32, 0x12,
0x89, 0x84, 0xCC, 0x1D, 0x0E, 0x87, 0xAC, 0x13, 0x47, 0x3C,
0xE9, 0xA8, 0x2B, 0x03, 0xDD, 0xE5, 0xE1, 0xE7, 0x3C, 0xAE,
0xBD, 0xFB, 0x06, 0x0B, 0xB7, 0x20, 0x10, 0x08, 0xC0, 0xEF,
0xF7, 0x23, 0x9D, 0x4E, 0xA3, 0x56, 0xAB, 0xC1, 0xE3, 0xF1,
0x20, 0x12, 0x89, 0x20, 0x93, 0xC9, 0x48, 0x83, 0x43, 0x53,
0x77, 0x61, 0x3F, 0x68, 0xEF, 0xCC, 0x40, 0x01, 0x87, 0x72,
0xD2, 0xB6, 0x07, 0xAF, 0xCE, 0x87, 0xE4, 0x84, 0x49, 0x18,
0x0C, 0x06, 0xA5, 0x11, 0x19, 0x84, 0xC3, 0x61, 0x24, 0x93,
0x49, 0x79, 0x4E, 0x75, 0xE2, 0x88, 0x27, 0xDD, 0x46, 0x07,
0x1C, 0x2C, 0xFD, 0xE5, 0x23, 0x6E, 0x2C, 0xAE, 0xC0, 0xB4,
0x6E, 0x42, 0x2C, 0x16, 0x83, 0xDB, 0xED, 0x46, 0x2E, 0x97,
0x03, 0x63, 0x4C, 0xEE, 0x78, 0x3C, 0x2E, 0x87, 0x48, 0x9D,
0xF9, 0xEE, 0x3F, 0x80, 0x6D, 0xBF, 0x8D, 0x0C, 0x58, 0xC7,
0x60, 0x64, 0xC7, 0x2E, 0xB8, 0x7C, 0x4E, 0x5C, 0x7E, 0x9F,
0x45, 0x34, 0x1A, 0xFD, 0x6B, 0xF2, 0x74, 0x85, 0xCD, 0x65,
0xB5, 0x68, 0x98, 0xF6, 0x1D, 0xC3, 0x27, 0x53, 0x1D, 0x0B,
0x7C, 0xA1, 0x73, 0x05, 0xF6, 0xB4, 0xF8, 0x15, 0x97, 0xBE,
0xBF, 0xC1, 0xCD, 0xF1, 0xC3, 0x60, 0x5E, 0x86, 0x97, 0xF7,
0x4E, 0x75, 0x8D, 0x54, 0x27, 0x8E, 0xF8, 0xCD, 0x0E, 0x14,
0x34, 0xC0, 0xAA, 0xD5, 0x2A, 0x8C, 0x46, 0x23, 0x16, 0xD5,
0xDF, 0x18, 0x18, 0x1C, 0xC0, 0xF3, 0x9F, 0x2B, 0x5D, 0x23,
0xD5, 0x89, 0x23, 0x9E, 0x74, 0xD2, 0x40, 0x94, 0x05, 0x9B,
0xDE, 0x7D, 0x00, 0xED, 0x6F, 0x8D, 0x17, 0xAB, 0x3F, 0x60,
0x36, 0x9B, 0xB7, 0x8C, 0xC4, 0x11, 0x4F, 0x3A, 0xF9, 0x12,
0xB1, 0x17, 0x33, 0xE8, 0xC3, 0x50, 0xCF, 0xFF, 0xE2, 0x1A,
0x3E, 0x88, 0x25, 0x31, 0x4A, 0x2E, 0xDB, 0xDA, 0xDB, 0xD2,
0xDE, 0x6A, 0x0F, 0x72, 0x7A, 0xEF, 0xAB, 0xED, 0x97, 0x58,
0xFF, 0x23, 0xC0, 0x00, 0xB1, 0x22, 0x28, 0x4D, 0x19, 0x8C,
0xC8, 0xAB, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44,
0xAE, 0x42, 0x60, 0x82
};
#endif //_ICONS_H
install32.bat
+1 -1
View File
@@ -1,4 +1,4 @@
@echo off
set PLUGINDIR=..\x64_dbg\bin\x32\plugins
set PLUGINDIR=..\x64dbg\bin\x32\plugins
mkdir %PLUGINDIR%
copy bin\x32\testplugin.dll %PLUGINDIR%\testplugin.dp32
install64.bat
+1 -1
View File
@@ -1,4 +1,4 @@
@echo off
set PLUGINDIR=..\x64_dbg\bin\x64\plugins
set PLUGINDIR=..\x64dbg\bin\x64\plugins
mkdir %PLUGINDIR%
copy bin\x64\testplugin.dll %PLUGINDIR%\testplugin.dp64
pluginsdk/BeaEngine/BeaEngine.h
-392
View File
@@ -1,392 +0,0 @@
#ifndef _BEA_ENGINE_
#define _BEA_ENGINE_
#if defined(__cplusplus) && defined(__BORLANDC__)
namespace BeaEngine
{
#endif
#include "macros.h"
#include "export.h"
#include "basic_types.h"
#if !defined(BEA_ENGINE_STATIC)
#if defined(BUILD_BEA_ENGINE_DLL)
#define BEA_API bea__api_export__
#else
#define BEA_API bea__api_import__
#endif
#else
#define BEA_API
#endif
#define INSTRUCT_LENGTH 64
#pragma pack(1)
typedef struct
{
UInt8 W_;
UInt8 R_;
UInt8 X_;
UInt8 B_;
UInt8 state;
} REX_Struct ;
#pragma pack()
#pragma pack(1)
typedef struct
{
int Number;
int NbUndefined;
UInt8 LockPrefix;
UInt8 OperandSize;
UInt8 AddressSize;
UInt8 RepnePrefix;
UInt8 RepPrefix;
UInt8 FSPrefix;
UInt8 SSPrefix;
UInt8 GSPrefix;
UInt8 ESPrefix;
UInt8 CSPrefix;
UInt8 DSPrefix;
UInt8 BranchTaken;
UInt8 BranchNotTaken;
REX_Struct REX;
char alignment[2];
} PREFIXINFO ;
#pragma pack()
#pragma pack(1)
typedef struct
{
UInt8 OF_;
UInt8 SF_;
UInt8 ZF_;
UInt8 AF_;
UInt8 PF_;
UInt8 CF_;
UInt8 TF_;
UInt8 IF_;
UInt8 DF_;
UInt8 NT_;
UInt8 RF_;
UInt8 alignment;
} EFLStruct ;
#pragma pack()
#pragma pack(4)
typedef struct
{
Int32 BaseRegister;
Int32 IndexRegister;
Int32 Scale;
Int64 Displacement;
} MEMORYTYPE ;
#pragma pack()
#pragma pack(1)
typedef struct
{
Int32 Category; //INSTRUCTION_TYPE
Int32 Opcode;
char Mnemonic[16];
Int32 BranchType; //BRANCH_TYPE
EFLStruct Flags;
UInt64 AddrValue;
Int64 Immediat;
UInt32 ImplicitModifiedRegs;
} INSTRTYPE;
#pragma pack()
#pragma pack(1)
typedef struct
{
char ArgMnemonic[64];
Int32 ArgType; //ARGUMENTS_TYPE
Int32 ArgSize;
Int32 ArgPosition;
UInt32 AccessMode;
MEMORYTYPE Memory;
UInt32 SegmentReg;
} ARGTYPE;
#pragma pack()
/* reserved structure used for thread-safety */
/* unusable by customer */
#pragma pack(1)
typedef struct
{
UIntPtr EIP_;
UInt64 EIP_VA;
UIntPtr EIP_REAL;
Int32 OriginalOperandSize;
Int32 OperandSize;
Int32 MemDecoration;
Int32 AddressSize;
Int32 MOD_;
Int32 RM_;
Int32 INDEX_;
Int32 SCALE_;
Int32 BASE_;
Int32 MMX_;
Int32 SSE_;
Int32 CR_;
Int32 DR_;
Int32 SEG_;
Int32 REGOPCODE;
UInt32 DECALAGE_EIP;
Int32 FORMATNUMBER;
Int32 SYNTAX_;
UInt64 EndOfBlock;
Int32 RelativeAddress;
UInt32 Architecture;
Int32 ImmediatSize;
Int32 NB_PREFIX;
Int32 PrefRepe;
Int32 PrefRepne;
UInt32 SEGMENTREGS;
UInt32 SEGMENTFS;
Int32 third_arg;
Int32 TAB_;
Int32 ERROR_OPCODE;
REX_Struct REX;
Int32 OutOfBlock;
} InternalDatas;
#pragma pack()
/* ************** main structure ************ */
#pragma pack(1)
typedef struct _Disasm
{
UIntPtr EIP;
UInt64 VirtualAddr;
UInt32 SecurityBlock;
char CompleteInstr[INSTRUCT_LENGTH];
UInt32 Archi;
UInt64 Options;
INSTRTYPE Instruction;
ARGTYPE Argument1;
ARGTYPE Argument2;
ARGTYPE Argument3;
PREFIXINFO Prefix;
InternalDatas Reserved_;
} DISASM, *PDISASM, *LPDISASM;
#pragma pack()
#define ESReg 1
#define DSReg 2
#define FSReg 3
#define GSReg 4
#define CSReg 5
#define SSReg 6
#define InvalidPrefix 4
#define SuperfluousPrefix 2
#define NotUsedPrefix 0
#define MandatoryPrefix 8
#define InUsePrefix 1
#define LowPosition 0
#define HighPosition 1
enum INSTRUCTION_TYPE
{
GENERAL_PURPOSE_INSTRUCTION = 0x10000,
FPU_INSTRUCTION = 0x20000,
MMX_INSTRUCTION = 0x40000,
SSE_INSTRUCTION = 0x80000,
SSE2_INSTRUCTION = 0x100000,
SSE3_INSTRUCTION = 0x200000,
SSSE3_INSTRUCTION = 0x400000,
SSE41_INSTRUCTION = 0x800000,
SSE42_INSTRUCTION = 0x1000000,
SYSTEM_INSTRUCTION = 0x2000000,
VM_INSTRUCTION = 0x4000000,
UNDOCUMENTED_INSTRUCTION = 0x8000000,
AMD_INSTRUCTION = 0x10000000,
ILLEGAL_INSTRUCTION = 0x20000000,
AES_INSTRUCTION = 0x40000000,
CLMUL_INSTRUCTION = (int)0x80000000,
DATA_TRANSFER = 0x1,
ARITHMETIC_INSTRUCTION,
LOGICAL_INSTRUCTION,
SHIFT_ROTATE,
BIT_UInt8,
CONTROL_TRANSFER,
STRING_INSTRUCTION,
InOutINSTRUCTION,
ENTER_LEAVE_INSTRUCTION,
FLAG_CONTROL_INSTRUCTION,
SEGMENT_REGISTER,
MISCELLANEOUS_INSTRUCTION,
COMPARISON_INSTRUCTION,
LOGARITHMIC_INSTRUCTION,
TRIGONOMETRIC_INSTRUCTION,
UNSUPPORTED_INSTRUCTION,
LOAD_CONSTANTS,
FPUCONTROL,
STATE_MANAGEMENT,
CONVERSION_INSTRUCTION,
SHUFFLE_UNPACK,
PACKED_SINGLE_PRECISION,
SIMD128bits,
SIMD64bits,
CACHEABILITY_CONTROL,
FP_INTEGER_CONVERSION,
SPECIALIZED_128bits,
SIMD_FP_PACKED,
SIMD_FP_HORIZONTAL ,
AGENT_SYNCHRONISATION,
PACKED_ALIGN_RIGHT ,
PACKED_SIGN,
PACKED_BLENDING_INSTRUCTION,
PACKED_TEST,
PACKED_MINMAX,
HORIZONTAL_SEARCH,
PACKED_EQUALITY,
STREAMING_LOAD,
INSERTION_EXTRACTION,
DOT_PRODUCT,
SAD_INSTRUCTION,
ACCELERATOR_INSTRUCTION, /* crc32, popcnt (sse4.2) */
ROUND_INSTRUCTION
};
enum EFLAGS_STATES
{
TE_ = 1,
MO_ = 2,
RE_ = 4,
SE_ = 8,
UN_ = 0x10,
PR_ = 0x20
};
enum BRANCH_TYPE
{
//JO vs JNO
JO = 1,
JNO = -1,
//JC=JB=JNAE vs JNC=JNB=JAE
JC = 2,
JB = 2,
JNAE = 2,
JNC = -2,
JNB = -2,
JAE = -2,
//JE=JZ vs JNE=JNZ
JE = 3,
JZ = 3,
JNE = -3,
JNZ = -3,
//JA=JNBE vs JNA=JBE
JA = 4,
JNBE = 4,
JNA = -4,
JBE = -4,
//JS vs JNS
JS = 5,
JNS = -5,
//JP=JPE vs JNP=JPO
JP = 6,
JPE = 6,
JNP = -6,
JPO = -6,
//JL=JNGE vs JNL=JGE
JL = 7,
JNGE = 7,
JNL = -7,
JGE = -7,
//JG=JNLE vs JNG=JLE
JG = 8,
JNLE = 8,
JNG = -8,
JLE = -8,
//others
JECXZ = 9,
JmpType = 10,
CallType = 11,
RetType = 12,
};
enum ARGUMENTS_TYPE
{
NO_ARGUMENT = 0x10000000,
REGISTER_TYPE = 0x20000000,
MEMORY_TYPE = 0x40000000,
CONSTANT_TYPE = (int)0x80000000,
MMX_REG = 0x10000,
GENERAL_REG = 0x20000,
FPU_REG = 0x40000,
SSE_REG = 0x80000,
CR_REG = 0x100000,
DR_REG = 0x200000,
SPECIAL_REG = 0x400000,
MEMORY_MANAGEMENT_REG = 0x800000,
SEGMENT_REG = 0x1000000,
RELATIVE_ = 0x4000000,
ABSOLUTE_ = 0x8000000,
READ = 0x1,
WRITE = 0x2,
REG0 = 0x1,
REG1 = 0x2,
REG2 = 0x4,
REG3 = 0x8,
REG4 = 0x10,
REG5 = 0x20,
REG6 = 0x40,
REG7 = 0x80,
REG8 = 0x100,
REG9 = 0x200,
REG10 = 0x400,
REG11 = 0x800,
REG12 = 0x1000,
REG13 = 0x2000,
REG14 = 0x4000,
REG15 = 0x8000
};
enum SPECIAL_INFO
{
UNKNOWN_OPCODE = -1,
OUT_OF_BLOCK = 0,
/* === mask = 0xff */
NoTabulation = 0x00000000,
Tabulation = 0x00000001,
/* === mask = 0xff00 */
MasmSyntax = 0x00000000,
GoAsmSyntax = 0x00000100,
NasmSyntax = 0x00000200,
ATSyntax = 0x00000400,
/* === mask = 0xff0000 */
PrefixedNumeral = 0x00010000,
SuffixedNumeral = 0x00020000,
NoformatNumeral = 0x00030000,
CleanNumeral = 0x00000000,
/* === mask = 0xff000000 */
ShowSegmentRegs = 0x01000000
};
#ifdef __cplusplus
extern "C"
#endif
BEA_API int __bea_callspec__ Disasm(LPDISASM pDisAsm);
BEA_API const__ char* __bea_callspec__ BeaEngineVersion(void);
BEA_API const__ char* __bea_callspec__ BeaEngineRevision(void);
#if defined(__cplusplus) && defined(__BORLANDC__)
};
using namespace BeaEngine;
#endif
#endif
pluginsdk/BeaEngine/BeaEngine.lib
BIN
View File
Binary file not shown.
pluginsdk/BeaEngine/BeaEngine_64.lib
BIN
View File
Binary file not shown.
pluginsdk/BeaEngine/basic_types.h
-272
View File
@@ -1,272 +0,0 @@
/**
* @file basic_types.h
* @author <[email protected]>
* @date Thu Dec 24 19:31:22 2009
*
* @brief Definitions of fixed-size integer types for various platforms
*
* This file is part of BeaEngine.
*
* BeaEngine is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* BeaEngine is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with BeaEngine. If not, see <http://www.gnu.org/licenses/>. */
#ifndef __BEA_BASIC_TYPES_HPP__
#define __BEA_BASIC_TYPES_HPP__
#include <stddef.h>
#if defined(__GNUC__) || defined (__INTEL_COMPILER) || defined(__LCC__) || defined(__POCC__)
#include <stdint.h>
#endif
#if defined(_MSC_VER) && !defined(__BORLANDC__)
/*
* Windows/Visual C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed __int64 Int64;
typedef unsigned __int64 UInt64;
#if defined(_WIN64)
#define BEA_PTR_IS_64_BIT 1
typedef signed __int64 IntPtr;
typedef unsigned __int64 UIntPtr;
#else
typedef signed long IntPtr;
typedef size_t UIntPtr;
#endif
#define BEA_HAVE_INT64 1
#elif defined(__POCC__)
/*
* PellesC
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed long long Int64;
typedef unsigned long long UInt64;
#if defined(_WIN64)
#define BEA_PTR_IS_64_BIT 1
typedef signed long long IntPtr;
typedef unsigned long long UIntPtr;
#else
typedef signed long IntPtr;
typedef size_t UIntPtr;
#endif
#define BEA_HAVE_INT64 1
#elif defined(__GNUC__) || defined(__LCC__)
/*
* Unix/GCC
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef intptr_t IntPtr;
typedef uintptr_t UIntPtr;
#if defined(__LP64__)
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
typedef signed long Int64;
typedef unsigned long UInt64;
#else
#if defined (__INTEL_COMPILER) || defined (__ICC) || defined (_ICC)
typedef __int64 Int64;
typedef unsigned __int64 UInt64;
#else
typedef signed long long Int64;
typedef unsigned long long UInt64;
#endif
#endif
#define BEA_HAVE_INT64 1
#elif defined(__DECCXX)
/*
* Compaq C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed __int64 Int64;
typedef unsigned __int64 UInt64;
#if defined(__VMS)
#if defined(__32BITS)
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#else
typedef Int64 IntPtr;
typedef UInt64 UIntPtr;
#define BEA_PTR_IS_64_BIT 1
#endif
#else
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
#endif
#define BEA_HAVE_INT64 1
#elif defined(__HP_aCC)
/*
* HP Ansi C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#if defined(__LP64__)
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
typedef signed long Int64;
typedef unsigned long UInt64;
#else
typedef signed long long Int64;
typedef unsigned long long UInt64;
#endif
#define BEA_HAVE_INT64 1
#elif defined(__SUNPRO_CC) || defined(__SUNPRO_C)
/*
* SUN Forte C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#if defined(__sparcv9)
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
typedef signed long Int64;
typedef unsigned long UInt64;
#else
typedef signed long long Int64;
typedef unsigned long long UInt64;
#endif
#define BEA_HAVE_INT64 1
#elif defined(__IBMCPP__)
/*
* IBM XL C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#if defined(__64BIT__)
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
typedef signed long Int64;
typedef unsigned long UInt64;
#else
typedef signed long long Int64;
typedef unsigned long long UInt64;
#endif
#define BEA_HAVE_INT64 1
#elif defined(__BORLANDC__)
/*
* Borland C/C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef unsigned __int64 Int64;
typedef signed __int64 UInt64;
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#define BEA_HAVE_INT64 1
#elif defined(__WATCOMC__)
/*
* Watcom C/C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef unsigned __int64 Int64;
typedef signed __int64 UInt64;
#define BEA_HAVE_INT64 1
typedef size_t UIntPtr;
#elif defined(__sgi)
/*
* MIPSpro C++
*/
typedef signed char Int8;
typedef unsigned char UInt8;
typedef signed short Int16;
typedef unsigned short UInt16;
typedef signed int Int32;
typedef unsigned int UInt32;
typedef signed long IntPtr;
typedef unsigned long UIntPtr;
#if _MIPS_SZLONG == 64
#define BEA_PTR_IS_64_BIT 1
#define BEA_LONG_IS_64_BIT 1
typedef signed long Int64;
typedef unsigned long UInt64;
#else
typedef signed long long Int64;
typedef unsigned long long UInt64;
#endif
#define BEA_HAVE_INT64 1
#endif
#if defined(_MSC_VER) || defined(__BORLANDC__)
#define W64LIT(x) x##ui64
#else
#define W64LIT(x) x##ULL
#endif
#ifndef C_STATIC_ASSERT
#define C_STATIC_ASSERT(tag_name, x) \
typedef int cache_static_assert_ ## tag_name[(x) * 2-1]
#endif
C_STATIC_ASSERT(sizeof_Int8 , (sizeof(Int8) == 1));
C_STATIC_ASSERT(sizeof_UInt8, (sizeof(UInt8) == 1));
C_STATIC_ASSERT(sizeof_Int16 , (sizeof(Int16) == 2));
C_STATIC_ASSERT(sizeof_UInt16, (sizeof(UInt16) == 2));
C_STATIC_ASSERT(sizeof_Int32 , (sizeof(Int32) == 4));
C_STATIC_ASSERT(sizeof_UInt32, (sizeof(UInt32) == 4));
C_STATIC_ASSERT(sizeof_Int64 , (sizeof(Int64) == 8));
C_STATIC_ASSERT(sizeof_UInt64, (sizeof(UInt64) == 8));
#endif
pluginsdk/BeaEngine/export.h
-173
View File
@@ -1,173 +0,0 @@
/**
* @file export.h
* @author [email protected]
* @date Mon Sep 22 09:28:54 2008
*
* @brief This file sets things up for C dynamic library function definitions and
* static inlined functions
*
* This file is part of BeaEngine.
*
* BeaEngine is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* BeaEngine is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with BeaEngine. If not, see <http://www.gnu.org/licenses/>. */
#ifndef __BEA_EXPORT_H__
#define __BEA_EXPORT_H__
/* Set up for C function definitions, even when using C++ */
#ifdef __cplusplus
#define CPP_VISIBLE_BEGIN extern "C" {
#define CPP_VISIBLE_END }
#else
#define CPP_VISIBLE_BEGIN
#define CPP_VISIBLE_END
#endif
#if defined(_MSC_VER)
#pragma warning( disable: 4251 )
#endif
/* Some compilers use a special export keyword */
#ifndef bea__api_export__
# if defined(__BEOS__)
# if defined(__GNUC__)
# define bea__api_export__ __declspec(dllexport)
# else
# define bea__api_export__ __declspec(export)
# endif
# elif defined(_WIN32) || defined(_WIN64)
# ifdef __BORLANDC__
# define bea__api_export__ __declspec(dllexport)
# define bea__api_import__ __declspec(dllimport)
# elif defined(__WATCOMC__)
# define bea__api_export__ __declspec(dllexport)
# define bea__api_import__
# else
# define bea__api_export__ __declspec(dllexport)
# define bea__api_import__ __declspec(dllimport)
# endif
# elif defined(__OS2__)
# ifdef __WATCOMC__
# define bea__api_export__ __declspec(dllexport)
# define bea__api_import__
# else
# define bea__api_export__
# define bea__api_import__
# endif
# else
# if defined(_WIN32) && defined(__GNUC__) && __GNUC__ >= 4
# define bea__api_export__ __attribubea__ ((visibility("default")))
# define bea__api_import__ __attribubea__ ((visibility("default")))
# else
# define bea__api_export__
# define bea__api_import__
# endif
# endif
#endif
/* Use C calling convention by default*/
#ifndef __bea_callspec__
#if defined(BEA_USE_STDCALL)
#if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64)
#if defined(__BORLANDC__) || defined(__WATCOMC__) || defined(_MSC_VER) || defined(__MINGW32__) || defined(__POCC__)
#define __bea_callspec__ __stdcall
#else
#define __bea_callspec__
#endif
#else
#ifdef __OS2__
#define __bea_callspec__ _System
#else
#define __bea_callspec__
#endif
#endif
#else
#define __bea_callspec__
#endif
#endif
#ifdef __SYMBIAN32__
# ifndef EKA2
# undef bea__api_export__
# undef bea__api_import__
# define bea__api_export__
# define bea__api_import__
# elif !defined(__WINS__)
# undef bea__api_export__
# undef bea__api_import__
# define bea__api_export__ __declspec(dllexport)
# define bea__api_import__ __declspec(dllexport)
# endif /* !EKA2 */
#endif /* __SYMBIAN32__ */
#if defined(__GNUC__) && (__GNUC__ > 2)
#define BEA_EXPECT_CONDITIONAL(c) (__builtin_expect((c), 1))
#define BEA_UNEXPECT_CONDITIONAL(c) (__builtin_expect((c), 0))
#else
#define BEA_EXPECT_CONDITIONAL(c) (c)
#define BEA_UNEXPECT_CONDITIONAL(c) (c)
#endif
/* Set up compiler-specific options for inlining functions */
#ifndef BEA_HAS_INLINE
#if defined(__GNUC__) || defined(__POCC__) || defined(__WATCOMC__) || defined(__SUNPRO_C)
#define BEA_HAS_INLINE
#else
/* Add any special compiler-specific cases here */
#if defined(_MSC_VER) || defined(__BORLANDC__) || \
defined(__DMC__) || defined(__SC__) || \
defined(__WATCOMC__) || defined(__LCC__) || \
defined(__DECC) || defined(__EABI__)
#ifndef __inline__
#define __inline__ __inline
#endif
#define BEA_HAS_INLINE
#else
#if !defined(__MRC__) && !defined(_SGI_SOURCE)
#ifndef __inline__
#define __inline__ inline
#endif
#define BEA_HAS_INLINE
#endif /* Not a funky compiler */
#endif /* Visual C++ */
#endif /* GNU C */
#endif /* CACHE_HAS_INLINE */
/* If inlining isn't supported, remove "__inline__", turning static
inlined functions into static functions (resulting in code bloat
in all files which include the offending header files)
*/
#ifndef BEA_HAS_INLINE
#define __inline__
#endif
/* fix a bug with gcc under windows */
#if defined(__WIN32__) || defined(WIN32) || defined(_WIN32) || defined(_WIN64)
#if defined(__MINGW32__)
#define const__
#else
#define const__ const
#endif
#else
#define const__ const
#endif
#endif
pluginsdk/BeaEngine/libBeaEngine.a
BIN
View File
Binary file not shown.
pluginsdk/BeaEngine/libBeaEngine_64.a
BIN
View File
Binary file not shown.
pluginsdk/BeaEngine/macros.h
-41
View File
@@ -1,41 +0,0 @@
#ifndef __BEAENGINE_MACROS_H__
#define __BEAENGINE_MACROS_H__
/*
============================================================================
Compiler Silencing macros
Some compilers complain about parameters that are not used. This macro
should keep them quiet.
============================================================================
*/
# if defined (__GNUC__) && ((__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 2)))
# define BEA_UNUSED_ARG(a) (void) (a)
#elif defined (ghs) || defined (__GNUC__) || defined (__hpux) || defined (__sgi) || defined (__DECCXX) || defined (__rational__) || defined (__USLC__) || defined (BEA__RM544) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || defined(__BORLANDC__)
/*
Some compilers complain about "statement with no effect" with (a).
This eliminates the warnings, and no code is generated for the null
conditional statement. Note, that may only be true if -O is enabled,
such as with GreenHills (ghs) 1.8.8.
*/
# define BEA_UNUSED_ARG(a) do {/* null */} while (&a == 0)
#elif defined (__DMC__)
#if defined(__cplusplus)
#define BEA_UNUSED_ID(identifier)
template <class T>
inline void BEA_UNUSED_ARG(const T & BEA_UNUSED_ID(t)) { }
#else
#define BEA_UNUSED_ARG(a)
#endif
#else /* ghs || __GNUC__ || ..... */
# define BEA_UNUSED_ARG(a) (a)
#endif /* ghs || __GNUC__ || ..... */
#if defined (_MSC_VER) || defined(__sgi) || defined (ghs) || defined (__DECCXX) || defined(__BORLANDC__) || defined (BEA_RM544) || defined (__USLC__) || defined (__DCC__) || defined (__PGI) || defined (__TANDEM) || (defined (__HP_aCC) && (__HP_aCC >= 60500))
# define BEA_NOTREACHED(a)
#else /* __sgi || ghs || ..... */
# define BEA_NOTREACHED(a) a
#endif /* __sgi || ghs || ..... */
#endif /* __BEAENGINE_MACROS_H__ */
pluginsdk/DeviceNameResolver/DeviceNameResolver.h
+6 -6
View File
@@ -8,12 +8,12 @@ extern "C"
{
#endif
__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSize);
__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSize);
__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSize);
__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSize);
__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSize);
__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSize);
__declspec(dllexport) bool DevicePathToPathW(const wchar_t* szDevicePath, wchar_t* szPath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathToPathA(const char* szDevicePath, char* szPath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathFromFileHandleW(HANDLE hFile, wchar_t* szDevicePath, size_t nSizeInChars);
__declspec(dllexport) bool DevicePathFromFileHandleA(HANDLE hFile, char* szDevicePath, size_t nSizeInChars);
__declspec(dllexport) bool PathFromFileHandleW(HANDLE hFile, wchar_t* szPath, size_t nSizeInChars);
__declspec(dllexport) bool PathFromFileHandleA(HANDLE hFile, char* szPath, size_t nSizeInChars);
#ifdef __cplusplus
}
pluginsdk/_dbgfunctions.h
+104 -6
View File
@@ -27,18 +27,78 @@ typedef struct
DBGCALLSTACKENTRY* entries;
} DBGCALLSTACK;
typedef struct
{
duint addr;
duint handler;
} DBGSEHRECORD;
typedef struct
{
duint total;
DBGSEHRECORD* records;
} DBGSEHCHAIN;
typedef struct
{
DWORD dwProcessId;
char szExeFile[MAX_PATH];
} DBGPROCESSINFO;
typedef enum
{
InstructionBody = 0,
InstructionHeading = 1,
InstructionTailing = 2,
InstructionOverlapped = 3, // The byte was executed with differing instruction base addresses
DataByte, // This and the following is not implemented yet.
DataWord,
DataDWord,
DataQWord,
DataFloat,
DataDouble,
DataLongDouble,
DataXMM,
DataYMM,
DataMMX,
DataMixed, //the byte is accessed in multiple ways
InstructionDataMixed //the byte is both executed and written
} TRACERECORDBYTETYPE;
typedef enum
{
TraceRecordNone,
TraceRecordBitExec,
TraceRecordByteWithExecTypeAndCounter,
TraceRecordWordWithExecTypeAndCounter
} TRACERECORDTYPE;
typedef struct
{
duint Handle;
unsigned char TypeNumber;
unsigned int GrantedAccess;
} HANDLEINFO;
// The longest ip address is 1234:6789:1234:6789:1234:6789:123.567.901.345 (46 bytes)
#define TCP_ADDR_SIZE 50
typedef struct
{
char RemoteAddress[TCP_ADDR_SIZE];
unsigned short RemotePort;
char LocalAddress[TCP_ADDR_SIZE];
unsigned short LocalPort;
char StateText[TCP_ADDR_SIZE];
unsigned int State;
} TCPCONNECTIONINFO;
typedef bool (*ASSEMBLEATEX)(duint addr, const char* instruction, char* error, bool fillnop);
typedef bool (*SECTIONFROMADDR)(duint addr, char* section);
typedef bool (*MODNAMEFROMADDR)(duint addr, char* modname, bool extension);
typedef duint (*MODBASEFROMADDR)(duint addr);
typedef duint (*MODBASEFROMNAME)(const char* modname);
typedef duint (*MODSIZEFROMADDR)(duint addr);
typedef duint(*MODBASEFROMADDR)(duint addr);
typedef duint(*MODBASEFROMNAME)(const char* modname);
typedef duint(*MODSIZEFROMADDR)(duint addr);
typedef bool (*ASSEMBLE)(duint addr, unsigned char* dest, int* size, const char* instruction, char* error);
typedef bool (*PATCHGET)(duint addr);
typedef bool (*PATCHINRANGE)(duint start, duint end);
@@ -49,9 +109,10 @@ typedef bool (*PATCHRESTORE)(duint addr);
typedef int (*PATCHFILE)(DBGPATCHINFO* patchlist, int count, const char* szFileName, char* error);
typedef int (*MODPATHFROMADDR)(duint addr, char* path, int size);
typedef int (*MODPATHFROMNAME)(const char* modname, char* path, int size);
typedef bool (*DISASMFAST)(unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
typedef bool (*DISASMFAST)(const unsigned char* data, duint addr, BASIC_INSTRUCTION_INFO* basicinfo);
typedef void (*MEMUPDATEMAP)();
typedef void (*GETCALLSTACK)(DBGCALLSTACK* callstack);
typedef void (*GETSEHCHAIN)(DBGSEHCHAIN* sehchain);
typedef void (*SYMBOLDOWNLOADALLSYMBOLS)(const char* szSymbolStore);
typedef bool (*GETJIT)(char* jit, bool x64);
typedef bool (*GETJITAUTO)(bool* jitauto);
@@ -63,8 +124,26 @@ typedef bool (*PAGERIGHTSTOSTRING)(DWORD protect, char* rights);
typedef bool (*ISPROCESSELEVATED)();
typedef bool (*GETCMDLINE)(char* cmdline, size_t* cbsize);
typedef bool (*SETCMDLINE)(const char* cmdline);
typedef duint (*FILEOFFSETTOVA)(const char* modname, duint offset);
typedef duint (*VATOFILEOFFSET)(duint va);
typedef duint(*FILEOFFSETTOVA)(const char* modname, duint offset);
typedef duint(*VATOFILEOFFSET)(duint va);
typedef duint(*GETADDRFROMLINE)(const char* szSourceFile, int line, duint* displacement);
typedef bool (*GETSOURCEFROMADDR)(duint addr, char* szSourceFile, int* line);
typedef bool (*VALFROMSTRING)(const char* string, duint* value);
typedef bool (*PATCHGETEX)(duint addr, DBGPATCHINFO* info);
typedef bool (*GETBRIDGEBP)(BPXTYPE type, duint addr, BRIDGEBP* bp);
typedef bool (*STRINGFORMATINLINE)(const char* format, size_t resultSize, char* result);
typedef void (*GETMNEMONICBRIEF)(const char* mnem, size_t resultSize, char* result);
typedef unsigned int (*GETTRACERECORDHITCOUNT)(duint address);
typedef TRACERECORDBYTETYPE(*GETTRACERECORDBYTETYPE)(duint address);
typedef bool (*SETTRACERECORDTYPE)(duint pageAddress, TRACERECORDTYPE type);
typedef TRACERECORDTYPE(*GETTRACERECORDTYPE)(duint pageAddress);
typedef bool (*ENUMHANDLES)(ListOf(HANDLEINFO) handles);
typedef bool (*GETHANDLENAME)(duint handle, char* name, size_t nameSize, char* typeName, size_t typeNameSize);
typedef bool (*ENUMTCPCONNECTIONS)(ListOf(TCPCONNECTIONINFO) connections);
typedef duint(*GETDBGEVENTS)();
typedef int (*MODGETPARTY)(duint base);
typedef void (*MODSETPARTY)(duint base, int party);
typedef bool (*WATCHISWATCHDOGTRIGGERED)(unsigned int id);
typedef struct DBGFUNCTIONS_
{
@@ -87,6 +166,7 @@ typedef struct DBGFUNCTIONS_
DISASMFAST DisasmFast;
MEMUPDATEMAP MemUpdateMap;
GETCALLSTACK GetCallStack;
GETSEHCHAIN GetSEHChain;
SYMBOLDOWNLOADALLSYMBOLS SymbolDownloadAllSymbols;
GETJITAUTO GetJitAuto;
GETJIT GetJit;
@@ -100,6 +180,24 @@ typedef struct DBGFUNCTIONS_
SETCMDLINE SetCmdline;
FILEOFFSETTOVA FileOffsetToVa;
VATOFILEOFFSET VaToFileOffset;
GETADDRFROMLINE GetAddrFromLine;
GETSOURCEFROMADDR GetSourceFromAddr;
VALFROMSTRING ValFromString;
PATCHGETEX PatchGetEx;
GETBRIDGEBP GetBridgeBp;
STRINGFORMATINLINE StringFormatInline;
GETMNEMONICBRIEF GetMnemonicBrief;
GETTRACERECORDHITCOUNT GetTraceRecordHitCount;
GETTRACERECORDBYTETYPE GetTraceRecordByteType;
SETTRACERECORDTYPE SetTraceRecordType;
GETTRACERECORDTYPE GetTraceRecordType;
ENUMHANDLES EnumHandles;
GETHANDLENAME GetHandleName;
ENUMTCPCONNECTIONS EnumTcpConnections;
GETDBGEVENTS GetDbgEvents;
MODGETPARTY ModGetParty;
MODSETPARTY ModSetParty;
WATCHISWATCHDOGTRIGGERED WatchIsWatchdogTriggered;
} DBGFUNCTIONS;
#ifdef BUILD_DBG
pluginsdk/_plugin_types.h
+2 -1
View File
@@ -8,7 +8,7 @@
#else
#ifdef __GNUC__
#include "dbghelp\dbghelp.h"
#include "dbghelp/dbghelp.h"
#else
#include <dbghelp.h>
#endif // __GNUC__
@@ -19,6 +19,7 @@
#include "bridgemain.h"
#include "_dbgfunctions.h"
#include "jansson/jansson.h"
#endif // BUILD_DBG
pluginsdk/_plugins.h
+26 -2
View File
@@ -25,6 +25,9 @@
//defines
#define PLUG_SDKVERSION 1
#define PLUG_DB_LOADSAVE_DATA 1
#define PLUG_DB_LOADSAVE_ALL 2
//structures
typedef struct
{
@@ -46,6 +49,11 @@ typedef struct
int hMenuStack; //plugin stack menu handle
} PLUG_SETUPSTRUCT;
typedef struct
{
void* data; //user data
} PLUG_SCRIPTSTRUCT;
//callback structures
typedef struct
{
@@ -162,6 +170,12 @@ typedef struct
bool retval;
} PLUG_CB_WINEVENTGLOBAL;
typedef struct
{
json_t* root;
int loadSaveType;
} PLUG_CB_LOADSAVEDB;
//enums
typedef enum
{
@@ -185,12 +199,16 @@ typedef enum
CB_DEBUGEVENT, //PLUG_CB_DEBUGEVENT (called on any debug event)
CB_MENUENTRY, //PLUG_CB_MENUENTRY
CB_WINEVENT, //PLUG_CB_WINEVENT
CB_WINEVENTGLOBAL //PLUG_CB_WINEVENTGLOBAL
CB_WINEVENTGLOBAL, //PLUG_CB_WINEVENTGLOBAL
CB_LOADDB, //PLUG_CB_LOADSAVEDB
CB_SAVEDB //PLUG_CB_LOADSAVEDB
} CBTYPE;
//typedefs
typedef void (*CBPLUGIN)(CBTYPE cbType, void* callbackInfo);
typedef bool (*CBPLUGINCOMMAND)(int, char**);
typedef bool (*CBPLUGINCOMMAND)(int argc, char** argv);
typedef void (*CBPLUGINSCRIPT)();
typedef duint(*CBPLUGINEXPRFUNCTION)(int argc, duint* argv, void* userdata);
//exports
#ifdef __cplusplus
@@ -210,6 +228,12 @@ PLUG_IMPEXP int _plugin_menuadd(int hMenu, const char* title);
PLUG_IMPEXP bool _plugin_menuaddentry(int hMenu, int hEntry, const char* title);
PLUG_IMPEXP bool _plugin_menuaddseparator(int hMenu);
PLUG_IMPEXP bool _plugin_menuclear(int hMenu);
PLUG_IMPEXP void _plugin_menuseticon(int hMenu, const ICONDATA* icon);
PLUG_IMPEXP void _plugin_menuentryseticon(int pluginHandle, int hEntry, const ICONDATA* icon);
PLUG_IMPEXP void _plugin_startscript(CBPLUGINSCRIPT cbScript);
PLUG_IMPEXP bool _plugin_waituntilpaused();
PLUG_IMPEXP bool _plugin_registerexprfunction(int pluginHandle, const char* name, int argc, CBPLUGINEXPRFUNCTION cbFunction, void* userdata);
PLUG_IMPEXP bool _plugin_unregisterexprfunction(int pluginHandle, const char* name);
#ifdef __cplusplus
}
pluginsdk/_scriptapi.h
+8
View File
@@ -0,0 +1,8 @@
#ifndef _SCRIPT_API_H
#define _SCRIPT_API_H
#include "_plugins.h"
#define SCRIPT_EXPORT PLUG_IMPEXP
#endif //_SCRIPT_API_H
pluginsdk/_scriptapi_argument.h
+31
View File
@@ -0,0 +1,31 @@
#ifndef _SCRIPTAPI_ARGUMENT_H
#define _SCRIPTAPI_ARGUMENT_H
#include "_scriptapi.h"
namespace Script
{
namespace Argument
{
struct ArgumentInfo
{
char mod[MAX_MODULE_SIZE];
duint rvaStart;
duint rvaEnd;
bool manual;
duint instructioncount;
};
SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
SCRIPT_EXPORT bool Add(const ArgumentInfo* info);
SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
SCRIPT_EXPORT bool GetInfo(duint addr, ArgumentInfo* info);
SCRIPT_EXPORT bool Overlaps(duint start, duint end);
SCRIPT_EXPORT bool Delete(duint address);
SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(ArgumentInfo) list); //caller has the responsibility to free the list
}; //Argument
}; //Script
#endif //_SCRIPTAPI_ARGUMENT_H
pluginsdk/_scriptapi_assembler.h
+17
View File
@@ -0,0 +1,17 @@
#ifndef _SCRIPTAPI_ASSEMBLER_H
#define _SCRIPTAPI_ASSEMBLER_H
#include "_scriptapi.h"
namespace Script
{
namespace Assembler
{
SCRIPT_EXPORT bool Assemble(duint addr, unsigned char* dest, int* size, const char* instruction); //dest[16]
SCRIPT_EXPORT bool AssembleEx(duint addr, unsigned char* dest, int* size, const char* instruction, char* error); //dest[16], error[MAX_ERROR_SIZE]
SCRIPT_EXPORT bool AssembleMem(duint addr, const char* instruction);
SCRIPT_EXPORT bool AssembleMemEx(duint addr, const char* instruction, int* size, char* error, bool fillnop); //error[MAX_ERROR_SIZE]
}; //Assembler
}; //Script
#endif //_SCRIPTAPI_ASSEMBLER_H
pluginsdk/_scriptapi_bookmark.h
+28
View File
@@ -0,0 +1,28 @@
#ifndef _SCRIPTAPI_BOOKMARK_H
#define _SCRIPTAPI_BOOKMARK_H
#include "_scriptapi.h"
namespace Script
{
namespace Bookmark
{
struct BookmarkInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, bool manual = false);
SCRIPT_EXPORT bool Set(const BookmarkInfo* info);
SCRIPT_EXPORT bool Get(duint addr);
SCRIPT_EXPORT bool GetInfo(duint addr, BookmarkInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(BookmarkInfo) list); //caller has the responsibility to free the list
}; //Bookmark
}; //Script
#endif //_SCRIPTAPI_BOOKMARK_H
pluginsdk/_scriptapi_comment.h
+29
View File
@@ -0,0 +1,29 @@
#ifndef _SCRIPTAPI_COMMENT_H
#define _SCRIPTAPI_COMMENT_H
#include "_scriptapi.h"
namespace Script
{
namespace Comment
{
struct CommentInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char text[MAX_LABEL_SIZE];
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
SCRIPT_EXPORT bool Set(const CommentInfo* info);
SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_COMMENT_SIZE]
SCRIPT_EXPORT bool GetInfo(duint addr, CommentInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(CommentInfo) list); //caller has the responsibility to free the list
}; //Comment
}; //Script
#endif //_SCRIPTAPI_COMMENT_H
pluginsdk/_scriptapi_debug.h
+32
View File
@@ -0,0 +1,32 @@
#ifndef _SCRIPTAPI_DEBUG_H
#define _SCRIPTAPI_DEBUG_H
#include "_scriptapi.h"
namespace Script
{
namespace Debug
{
enum HardwareType
{
HardwareAccess,
HardwareWrite,
HardwareExecute
};
SCRIPT_EXPORT void Wait();
SCRIPT_EXPORT void Run();
SCRIPT_EXPORT void Pause();
SCRIPT_EXPORT void Stop();
SCRIPT_EXPORT void StepIn();
SCRIPT_EXPORT void StepOver();
SCRIPT_EXPORT void StepOut();
SCRIPT_EXPORT bool SetBreakpoint(duint address);
SCRIPT_EXPORT bool DeleteBreakpoint(duint address);
SCRIPT_EXPORT bool DisableBreakpoint(duint address);
SCRIPT_EXPORT bool SetHardwareBreakpoint(duint address, HardwareType type = HardwareExecute);
SCRIPT_EXPORT bool DeleteHardwareBreakpoint(duint address);
}; //Debug
}; //Script
#endif //_SCRIPTAPI_DEBUG_H
pluginsdk/_scriptapi_flag.h
+47
View File
@@ -0,0 +1,47 @@
#ifndef _SCRIPTAPI_FLAG_H
#define _SCRIPTAPI_FLAG_H
#include "_scriptapi.h"
namespace Script
{
namespace Flag
{
enum FlagEnum
{
ZF,
OF,
CF,
PF,
SF,
TF,
AF,
DF,
IF
};
SCRIPT_EXPORT bool Get(FlagEnum flag);
SCRIPT_EXPORT bool Set(FlagEnum flag, bool value);
SCRIPT_EXPORT bool GetZF();
SCRIPT_EXPORT bool SetZF(bool value);
SCRIPT_EXPORT bool GetOF();
SCRIPT_EXPORT bool SetOF(bool value);
SCRIPT_EXPORT bool GetCF();
SCRIPT_EXPORT bool SetCF(bool value);
SCRIPT_EXPORT bool GetPF();
SCRIPT_EXPORT bool SetPF(bool value);
SCRIPT_EXPORT bool GetSF();
SCRIPT_EXPORT bool SetSF(bool value);
SCRIPT_EXPORT bool GetTF();
SCRIPT_EXPORT bool SetTF(bool value);
SCRIPT_EXPORT bool GetAF();
SCRIPT_EXPORT bool SetAF(bool value);
SCRIPT_EXPORT bool GetDF();
SCRIPT_EXPORT bool SetDF(bool value);
SCRIPT_EXPORT bool GetIF();
SCRIPT_EXPORT bool SetIF(bool value);
};
};
#endif //_SCRIPTAPI_FLAG_H
pluginsdk/_scriptapi_function.h
+31
View File
@@ -0,0 +1,31 @@
#ifndef _SCRIPTAPI_FUNCTION_H
#define _SCRIPTAPI_FUNCTION_H
#include "_scriptapi.h"
namespace Script
{
namespace Function
{
struct FunctionInfo
{
char mod[MAX_MODULE_SIZE];
duint rvaStart;
duint rvaEnd;
bool manual;
duint instructioncount;
};
SCRIPT_EXPORT bool Add(duint start, duint end, bool manual, duint instructionCount = 0);
SCRIPT_EXPORT bool Add(const FunctionInfo* info);
SCRIPT_EXPORT bool Get(duint addr, duint* start = nullptr, duint* end = nullptr, duint* instructionCount = nullptr);
SCRIPT_EXPORT bool GetInfo(duint addr, FunctionInfo* info);
SCRIPT_EXPORT bool Overlaps(duint start, duint end);
SCRIPT_EXPORT bool Delete(duint address);
SCRIPT_EXPORT void DeleteRange(duint start, duint end, bool deleteManual = false);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(FunctionInfo) list); //caller has the responsibility to free the list
}; //Function
}; //Script
#endif //_SCRIPTAPI_FUNCTION_H
pluginsdk/_scriptapi_gui.h
+60
View File
@@ -0,0 +1,60 @@
#ifndef _SCRIPTAPI_GUI_H
#define _SCRIPTAPI_GUI_H
#include "_scriptapi.h"
namespace Script
{
namespace Gui
{
namespace Disassembly
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Disassembly
namespace Dump
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Dump
namespace Stack
{
SCRIPT_EXPORT bool SelectionGet(duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart();
SCRIPT_EXPORT duint SelectionGetEnd();
}; //Stack
}; //Gui
namespace Gui
{
enum Window
{
DisassemblyWindow,
DumpWindow,
StackWindow
};
SCRIPT_EXPORT bool SelectionGet(Window window, duint* start, duint* end);
SCRIPT_EXPORT bool SelectionSet(Window window, duint start, duint end);
SCRIPT_EXPORT duint SelectionGetStart(Window window);
SCRIPT_EXPORT duint SelectionGetEnd(Window window);
SCRIPT_EXPORT void Message(const char* message);
SCRIPT_EXPORT bool MessageYesNo(const char* message);
SCRIPT_EXPORT bool InputLine(const char* title, char* text); //text[GUI_MAX_LINE_SIZE]
SCRIPT_EXPORT bool InputValue(const char* title, duint* value);
SCRIPT_EXPORT void Refresh();
SCRIPT_EXPORT void AddQWidgetTab(void* qWidget);
SCRIPT_EXPORT void ShowQWidgetTab(void* qWidget);
SCRIPT_EXPORT void CloseQWidgetTab(void* qWidget);
}; //Gui
}; //Script
#endif //_SCRIPTAPI_GUI_H
pluginsdk/_scriptapi_label.h
+30
View File
@@ -0,0 +1,30 @@
#ifndef _SCRIPTAPI_LABEL_H
#define _SCRIPTAPI_LABEL_H
#include "_scriptapi.h"
namespace Script
{
namespace Label
{
struct LabelInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char text[MAX_LABEL_SIZE];
bool manual;
};
SCRIPT_EXPORT bool Set(duint addr, const char* text, bool manual = false);
SCRIPT_EXPORT bool Set(const LabelInfo* info);
SCRIPT_EXPORT bool FromString(const char* label, duint* addr);
SCRIPT_EXPORT bool Get(duint addr, char* text); //text[MAX_LABEL_SIZE]
SCRIPT_EXPORT bool GetInfo(duint addr, LabelInfo* info);
SCRIPT_EXPORT bool Delete(duint addr);
SCRIPT_EXPORT void DeleteRange(duint start, duint end);
SCRIPT_EXPORT void Clear();
SCRIPT_EXPORT bool GetList(ListOf(LabelInfo) list); //caller has the responsibility to free the list
}; //Label
}; //Script
#endif //_SCRIPTAPI_LABEL_H
pluginsdk/_scriptapi_memory.h
+29
View File
@@ -0,0 +1,29 @@
#ifndef _SCRIPTAPI_MEMORY_H
#define _SCRIPTAPI_MEMORY_H
#include "_scriptapi.h"
namespace Script
{
namespace Memory
{
SCRIPT_EXPORT bool Read(duint addr, void* data, duint size, duint* sizeRead);
SCRIPT_EXPORT bool Write(duint addr, const void* data, duint size, duint* sizeWritten);
SCRIPT_EXPORT bool IsValidPtr(duint addr);
SCRIPT_EXPORT duint RemoteAlloc(duint addr, duint size);
SCRIPT_EXPORT bool RemoteFree(duint addr);
SCRIPT_EXPORT unsigned char ReadByte(duint addr);
SCRIPT_EXPORT bool WriteByte(duint addr, unsigned char data);
SCRIPT_EXPORT unsigned short ReadWord(duint addr);
SCRIPT_EXPORT bool WriteWord(duint addr, unsigned short data);
SCRIPT_EXPORT unsigned int ReadDword(duint addr);
SCRIPT_EXPORT bool WriteDword(duint addr, unsigned int data);
SCRIPT_EXPORT unsigned long long ReadQword(duint addr);
SCRIPT_EXPORT bool WriteQword(duint addr, unsigned long long data);
SCRIPT_EXPORT duint ReadPtr(duint addr);
SCRIPT_EXPORT bool WritePtr(duint addr, duint data);
}; //Memory
}; //Script
#endif //_SCRIPTAPI_MEMORY_H
pluginsdk/_scriptapi_misc.h
+18
View File
@@ -0,0 +1,18 @@
#ifndef _SCRIPTAPI_MISC_H
#define _SCRIPTAPI_MISC_H
#include "_scriptapi.h"
namespace Script
{
namespace Misc
{
SCRIPT_EXPORT bool ParseExpression(const char* expression, duint* value);
SCRIPT_EXPORT duint RemoteGetProcAddress(const char* module, const char* api);
SCRIPT_EXPORT duint ResolveLabel(const char* label);
SCRIPT_EXPORT void* Alloc(duint size);
SCRIPT_EXPORT void Free(void* ptr);
}; //Misc
}; //Script
#endif //_SCRIPTAPI_MISC_H
pluginsdk/_scriptapi_module.h
+56
View File
@@ -0,0 +1,56 @@
#ifndef _SCRIPTAPI_MODULE_H
#define _SCRIPTAPI_MODULE_H
#include "_scriptapi.h"
namespace Script
{
namespace Module
{
struct ModuleInfo
{
duint base;
duint size;
duint entry;
int sectionCount;
char name[MAX_MODULE_SIZE];
char path[MAX_PATH];
};
struct ModuleSectionInfo
{
duint addr;
duint size;
char name[MAX_SECTION_SIZE * 5];
};
SCRIPT_EXPORT bool InfoFromAddr(duint addr, ModuleInfo* info);
SCRIPT_EXPORT bool InfoFromName(const char* name, ModuleInfo* info);
SCRIPT_EXPORT duint BaseFromAddr(duint addr);
SCRIPT_EXPORT duint BaseFromName(const char* name);
SCRIPT_EXPORT duint SizeFromAddr(duint addr);
SCRIPT_EXPORT duint SizeFromName(const char* name);
SCRIPT_EXPORT bool NameFromAddr(duint addr, char* name); //name[MAX_MODULE_SIZE]
SCRIPT_EXPORT bool PathFromAddr(duint addr, char* path); //path[MAX_PATH]
SCRIPT_EXPORT bool PathFromName(const char* name, char* path); //path[MAX_PATH]
SCRIPT_EXPORT duint EntryFromAddr(duint addr);
SCRIPT_EXPORT duint EntryFromName(const char* name);
SCRIPT_EXPORT int SectionCountFromAddr(duint addr);
SCRIPT_EXPORT int SectionCountFromName(const char* name);
SCRIPT_EXPORT bool SectionFromAddr(duint addr, int number, ModuleSectionInfo* section);
SCRIPT_EXPORT bool SectionFromName(const char* name, int number, ModuleSectionInfo* section);
SCRIPT_EXPORT bool SectionListFromAddr(duint addr, ListOf(ModuleSectionInfo) list);
SCRIPT_EXPORT bool SectionListFromName(const char* name, ListOf(ModuleSectionInfo) list);
SCRIPT_EXPORT bool GetMainModuleInfo(ModuleInfo* info);
SCRIPT_EXPORT duint GetMainModuleBase();
SCRIPT_EXPORT duint GetMainModuleSize();
SCRIPT_EXPORT duint GetMainModuleEntry();
SCRIPT_EXPORT int GetMainModuleSectionCount();
SCRIPT_EXPORT bool GetMainModuleName(char* name); //name[MAX_MODULE_SIZE]
SCRIPT_EXPORT bool GetMainModulePath(char* path); //path[MAX_PATH]
SCRIPT_EXPORT bool GetMainModuleSectionList(ListOf(ModuleSectionInfo) list); //caller has the responsibility to free the list
SCRIPT_EXPORT bool GetList(ListOf(ModuleInfo) list); //caller has the responsibility to free the list
}; //Module
}; //Script
#endif //_SCRIPTAPI_MODULE_H
pluginsdk/_scriptapi_pattern.h
+19
View File
@@ -0,0 +1,19 @@
#ifndef _SCRIPTAPI_PATTERN_H
#define _SCRIPTAPI_PATTERN_H
#include "_scriptapi.h"
namespace Script
{
namespace Pattern
{
SCRIPT_EXPORT duint Find(unsigned char* data, duint datasize, const char* pattern);
SCRIPT_EXPORT duint FindMem(duint start, duint size, const char* pattern);
SCRIPT_EXPORT void Write(unsigned char* data, duint datasize, const char* pattern);
SCRIPT_EXPORT void WriteMem(duint start, duint size, const char* pattern);
SCRIPT_EXPORT bool SearchAndReplace(unsigned char* data, duint datasize, const char* searchpattern, const char* replacepattern);
SCRIPT_EXPORT bool SearchAndReplaceMem(duint start, duint size, const char* searchpattern, const char* replacepattern);
};
};
#endif //_SCRIPTAPI_FIND_H
pluginsdk/_scriptapi_register.h
+265
View File
@@ -0,0 +1,265 @@
#ifndef _SCRIPTAPI_REGISTER_H
#define _SCRIPTAPI_REGISTER_H
#include "_scriptapi.h"
namespace Script
{
namespace Register
{
enum RegisterEnum
{
DR0,
DR1,
DR2,
DR3,
DR6,
DR7,
EAX,
AX,
AH,
AL,
EBX,
BX,
BH,
BL,
ECX,
CX,
CH,
CL,
EDX,
DX,
DH,
DL,
EDI,
DI,
ESI,
SI,
EBP,
BP,
ESP,
SP,
EIP,
#ifdef _WIN64
RAX,
RBX,
RCX,
RDX,
RSI,
SIL,
RDI,
DIL,
RBP,
BPL,
RSP,
SPL,
RIP,
R8,
R8D,
R8W,
R8B,
R9,
R9D,
R9W,
R9B,
R10,
R10D,
R10W,
R10B,
R11,
R11D,
R11W,
R11B,
R12,
R12D,
R12W,
R12B,
R13,
R13D,
R13W,
R13B,
R14,
R14D,
R14W,
R14B,
R15,
R15D,
R15W,
R15B,
#endif //_WIN64
CIP,
CSP,
}; //RegisterEnum
SCRIPT_EXPORT duint Get(RegisterEnum reg);
SCRIPT_EXPORT bool Set(RegisterEnum reg, duint value);
SCRIPT_EXPORT int Size(); //gets architecture register size in bytes
SCRIPT_EXPORT duint GetDR0();
SCRIPT_EXPORT bool SetDR0(duint value);
SCRIPT_EXPORT duint GetDR1();
SCRIPT_EXPORT bool SetDR1(duint value);
SCRIPT_EXPORT duint GetDR2();
SCRIPT_EXPORT bool SetDR2(duint value);
SCRIPT_EXPORT duint GetDR3();
SCRIPT_EXPORT bool SetDR3(duint value);
SCRIPT_EXPORT duint GetDR6();
SCRIPT_EXPORT bool SetDR6(duint value);
SCRIPT_EXPORT duint GetDR7();
SCRIPT_EXPORT bool SetDR7(duint value);
SCRIPT_EXPORT unsigned int GetEAX();
SCRIPT_EXPORT bool SetEAX(unsigned int value);
SCRIPT_EXPORT unsigned short GetAX();
SCRIPT_EXPORT bool SetAX(unsigned short value);
SCRIPT_EXPORT unsigned char GetAH();
SCRIPT_EXPORT bool SetAH(unsigned char value);
SCRIPT_EXPORT unsigned char GetAL();
SCRIPT_EXPORT bool SetAL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEBX();
SCRIPT_EXPORT bool SetEBX(unsigned int value);
SCRIPT_EXPORT unsigned short GetBX();
SCRIPT_EXPORT bool SetBX(unsigned short value);
SCRIPT_EXPORT unsigned char GetBH();
SCRIPT_EXPORT bool SetBH(unsigned char value);
SCRIPT_EXPORT unsigned char GetBL();
SCRIPT_EXPORT bool SetBL(unsigned char value);
SCRIPT_EXPORT unsigned int GetECX();
SCRIPT_EXPORT bool SetECX(unsigned int value);
SCRIPT_EXPORT unsigned short GetCX();
SCRIPT_EXPORT bool SetCX(unsigned short value);
SCRIPT_EXPORT unsigned char GetCH();
SCRIPT_EXPORT bool SetCH(unsigned char value);
SCRIPT_EXPORT unsigned char GetCL();
SCRIPT_EXPORT bool SetCL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEDX();
SCRIPT_EXPORT bool SetEDX(unsigned int value);
SCRIPT_EXPORT unsigned short GetDX();
SCRIPT_EXPORT bool SetDX(unsigned short value);
SCRIPT_EXPORT unsigned char GetDH();
SCRIPT_EXPORT bool SetDH(unsigned char value);
SCRIPT_EXPORT unsigned char GetDL();
SCRIPT_EXPORT bool SetDL(unsigned char value);
SCRIPT_EXPORT unsigned int GetEDI();
SCRIPT_EXPORT bool SetEDI(unsigned int value);
SCRIPT_EXPORT unsigned short GetDI();
SCRIPT_EXPORT bool SetDI(unsigned short value);
SCRIPT_EXPORT unsigned int GetESI();
SCRIPT_EXPORT bool SetESI(unsigned int value);
SCRIPT_EXPORT unsigned short GetSI();
SCRIPT_EXPORT bool SetSI(unsigned short value);
SCRIPT_EXPORT unsigned int GetEBP();
SCRIPT_EXPORT bool SetEBP(unsigned int value);
SCRIPT_EXPORT unsigned short GetBP();
SCRIPT_EXPORT bool SetBP(unsigned short value);
SCRIPT_EXPORT unsigned int GetESP();
SCRIPT_EXPORT bool SetESP(unsigned int value);
SCRIPT_EXPORT unsigned short GetSP();
SCRIPT_EXPORT bool SetSP(unsigned short value);
SCRIPT_EXPORT unsigned int GetEIP();
SCRIPT_EXPORT bool SetEIP(unsigned int value);
#ifdef _WIN64
SCRIPT_EXPORT unsigned long long GetRAX();
SCRIPT_EXPORT bool SetRAX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRBX();
SCRIPT_EXPORT bool SetRBX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRCX();
SCRIPT_EXPORT bool SetRCX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRDX();
SCRIPT_EXPORT bool SetRDX(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetRSI();
SCRIPT_EXPORT bool SetRSI(unsigned long long value);
SCRIPT_EXPORT unsigned char GetSIL();
SCRIPT_EXPORT bool SetSIL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRDI();
SCRIPT_EXPORT bool SetRDI(unsigned long long value);
SCRIPT_EXPORT unsigned char GetDIL();
SCRIPT_EXPORT bool SetDIL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRBP();
SCRIPT_EXPORT bool SetRBP(unsigned long long value);
SCRIPT_EXPORT unsigned char GetBPL();
SCRIPT_EXPORT bool SetBPL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRSP();
SCRIPT_EXPORT bool SetRSP(unsigned long long value);
SCRIPT_EXPORT unsigned char GetSPL();
SCRIPT_EXPORT bool SetSPL(unsigned char value);
SCRIPT_EXPORT unsigned long long GetRIP();
SCRIPT_EXPORT bool SetRIP(unsigned long long value);
SCRIPT_EXPORT unsigned long long GetR8();
SCRIPT_EXPORT bool SetR8(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR8D();
SCRIPT_EXPORT bool SetR8D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR8W();
SCRIPT_EXPORT bool SetR8W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR8B();
SCRIPT_EXPORT bool SetR8B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR9();
SCRIPT_EXPORT bool SetR9(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR9D();
SCRIPT_EXPORT bool SetR9D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR9W();
SCRIPT_EXPORT bool SetR9W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR9B();
SCRIPT_EXPORT bool SetR9B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR10();
SCRIPT_EXPORT bool SetR10(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR10D();
SCRIPT_EXPORT bool SetR10D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR10W();
SCRIPT_EXPORT bool SetR10W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR10B();
SCRIPT_EXPORT bool SetR10B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR11();
SCRIPT_EXPORT bool SetR11(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR11D();
SCRIPT_EXPORT bool SetR11D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR11W();
SCRIPT_EXPORT bool SetR11W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR11B();
SCRIPT_EXPORT bool SetR11B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR12();
SCRIPT_EXPORT bool SetR12(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR12D();
SCRIPT_EXPORT bool SetR12D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR12W();
SCRIPT_EXPORT bool SetR12W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR12B();
SCRIPT_EXPORT bool SetR12B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR13();
SCRIPT_EXPORT bool SetR13(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR13D();
SCRIPT_EXPORT bool SetR13D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR13W();
SCRIPT_EXPORT bool SetR13W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR13B();
SCRIPT_EXPORT bool SetR13B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR14();
SCRIPT_EXPORT bool SetR14(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR14D();
SCRIPT_EXPORT bool SetR14D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR14W();
SCRIPT_EXPORT bool SetR14W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR14B();
SCRIPT_EXPORT bool SetR14B(unsigned char value);
SCRIPT_EXPORT unsigned long long GetR15();
SCRIPT_EXPORT bool SetR15(unsigned long long value);
SCRIPT_EXPORT unsigned int GetR15D();
SCRIPT_EXPORT bool SetR15D(unsigned int value);
SCRIPT_EXPORT unsigned short GetR15W();
SCRIPT_EXPORT bool SetR15W(unsigned short value);
SCRIPT_EXPORT unsigned char GetR15B();
SCRIPT_EXPORT bool SetR15B(unsigned char value);
#endif //_WIN64
SCRIPT_EXPORT duint GetCIP();
SCRIPT_EXPORT bool SetCIP(duint value);
SCRIPT_EXPORT duint GetCSP();
SCRIPT_EXPORT bool SetCSP(duint value);
}; //Register
}; //Script
#endif //_SCRIPTAPI_REGISTER_H
pluginsdk/_scriptapi_stack.h
+16
View File
@@ -0,0 +1,16 @@
#ifndef _SCRIPTAPI_STACK_H
#define _SCRIPTAPI_STACK_H
#include "_scriptapi.h"
namespace Script
{
namespace Stack
{
SCRIPT_EXPORT duint Pop();
SCRIPT_EXPORT duint Push(duint value); //returns the previous top, equal to Peek(1)
SCRIPT_EXPORT duint Peek(int offset = 0); //offset is in multiples of Register::Size(), for easy x32/x64 portability
}; //Stack
}; //Script
#endif //_SCRIPTAPI_STACK_H
pluginsdk/_scriptapi_symbol.h
+30
View File
@@ -0,0 +1,30 @@
#ifndef _SCRIPTAPI_SYMBOL_H
#define _SCRIPTAPI_SYMBOL_H
#include "_scriptapi.h"
namespace Script
{
namespace Symbol
{
enum SymbolType
{
Function,
Import,
Export
};
struct SymbolInfo
{
char mod[MAX_MODULE_SIZE];
duint rva;
char name[MAX_LABEL_SIZE];
bool manual;
SymbolType type;
};
SCRIPT_EXPORT bool GetList(ListOf(SymbolInfo) list); //caller has the responsibility to free the list
}; //Symbol
}; //Script
#endif //_SCRIPTAPI_SYMBOL_H
pluginsdk/bridgegraph.h
+164
View File
@@ -0,0 +1,164 @@
#ifndef _GRAPH_H
#define _GRAPH_H
typedef struct
{
duint parentGraph; //function of which this node is a part
duint start; //start of the block
duint end; //end of the block (inclusive)
duint brtrue; //destination if condition is true
duint brfalse; //destination if condition is false
duint icount; //number of instructions in node
bool terminal; //node is a RET
bool split; //node is a split (brtrue points to the next node)
void* userdata; //user data
ListInfo exits; //exits (including brtrue and brfalse, duint)
ListInfo data; //block data
} BridgeCFNodeList;
typedef struct
{
duint entryPoint; //graph entry point
void* userdata; //user data
ListInfo nodes; //graph nodes (BridgeCFNodeList)
} BridgeCFGraphList;
#ifdef __cplusplus
#if _MSC_VER > 1300
#include <unordered_map>
#include <unordered_set>
#include <vector>
#include <utility>
struct BridgeCFNode
{
duint parentGraph; //function of which this node is a part
duint start; //start of the block
duint end; //end of the block (inclusive)
duint brtrue; //destination if condition is true
duint brfalse; //destination if condition is false
duint icount; //number of instructions in node
bool terminal; //node is a RET
bool split; //node is a split (brtrue points to the next node)
void* userdata; //user data
std::vector<duint> exits; //exits (including brtrue and brfalse)
std::vector<unsigned char> data; //block data
explicit BridgeCFNode(BridgeCFNodeList* nodeList, bool freedata = true)
{
if(!nodeList)
__debugbreak();
parentGraph = nodeList->parentGraph;
start = nodeList->start;
end = nodeList->end;
brtrue = nodeList->brtrue;
brfalse = nodeList->brfalse;
icount = nodeList->icount;
terminal = nodeList->terminal;
split = nodeList->split;
userdata = nodeList->userdata;
if(!BridgeList<duint>::ToVector(&nodeList->exits, exits, freedata))
__debugbreak();
if(!BridgeList<unsigned char>::ToVector(&nodeList->data, data, freedata))
__debugbreak();
}
explicit BridgeCFNode(duint parentGraph, duint start, duint end)
: parentGraph(parentGraph),
start(start),
end(end),
brtrue(0),
brfalse(0),
icount(0),
terminal(false),
split(false),
userdata(nullptr)
{
}
explicit BridgeCFNode()
: BridgeCFNode(0, 0, 0)
{
}
BridgeCFNodeList ToNodeList() const
{
BridgeCFNodeList out;
out.parentGraph = parentGraph;
out.start = start;
out.end = end;
out.brtrue = brtrue;
out.brfalse = brfalse;
out.icount = icount;
out.terminal = terminal;
out.split = split;
out.userdata = userdata;
BridgeList<duint>::CopyData(&out.exits, exits);
BridgeList<unsigned char>::CopyData(&out.data, data);
return std::move(out);
}
};
struct BridgeCFGraph
{
duint entryPoint; //graph entry point
void* userdata; //user data
std::unordered_map<duint, BridgeCFNode> nodes; //CFNode.start -> CFNode
std::unordered_map<duint, std::unordered_set<duint>> parents; //CFNode.start -> parents
explicit BridgeCFGraph(BridgeCFGraphList* graphList, bool freedata = true)
{
if(!graphList || graphList->nodes.size != graphList->nodes.count * sizeof(BridgeCFNodeList))
__debugbreak();
entryPoint = graphList->entryPoint;
userdata = graphList->userdata;
auto data = (BridgeCFNodeList*)graphList->nodes.data;
for(int i = 0; i < graphList->nodes.count; i++)
AddNode(BridgeCFNode(&data[i], freedata));
if(freedata && data)
BridgeFree(data);
}
explicit BridgeCFGraph(duint entryPoint)
: entryPoint(entryPoint),
userdata(nullptr)
{
}
void AddNode(const BridgeCFNode & node)
{
nodes[node.start] = node;
AddParent(node.start, node.brtrue);
AddParent(node.start, node.brfalse);
}
void AddParent(duint child, duint parent)
{
if(!child || !parent)
return;
auto found = parents.find(child);
if(found == parents.end())
parents[child] = std::unordered_set<duint>(std::initializer_list<duint> { parent });
else
found->second.insert(parent);
}
BridgeCFGraphList ToGraphList() const
{
BridgeCFGraphList out;
out.entryPoint = entryPoint;
out.userdata = userdata;
std::vector<BridgeCFNodeList> nodeList;
nodeList.reserve(nodes.size());
for(const auto & nodeIt : nodes)
nodeList.push_back(nodeIt.second.ToNodeList());
BridgeList<BridgeCFNodeList>::CopyData(&out.nodes, nodeList);
return std::move(out);
}
};
#endif //_MSC_VER
#endif //__cplusplus
#endif //_GRAPH_H
pluginsdk/bridgelist.h
+141
View File
@@ -0,0 +1,141 @@
#ifndef _LIST_H
#define _LIST_H
typedef struct
{
int count; //Number of element in the list.
size_t size; //Size of list in bytes (used for type checking).
void* data; //Pointer to the list contents. Must be deleted by the caller using BridgeFree (or BridgeList::Free).
} ListInfo;
#define ListOf(Type) ListInfo*
#ifdef __cplusplus
#include <vector>
/**
\brief A list object. This object is NOT thread safe.
\tparam Type BridgeList contents type.
*/
template<typename Type>
class BridgeList
{
public:
/**
\brief BridgeList constructor.
\param _freeData (Optional) the free function.
*/
explicit BridgeList()
{
memset(&_listInfo, 0, sizeof(_listInfo));
}
/**
\brief BridgeList destructor.
*/
~BridgeList()
{
Cleanup();
}
/**
\brief Gets the list data.
\return Returns ListInfo->data. Can be null if the list was never initialized. Will be destroyed once this object goes out of scope!
*/
Type* Data() const
{
return reinterpret_cast<Type*>(_listInfo.data);
}
/**
\brief Gets the number of elements in the list. This will crash the program if the data is not consistent with the specified template argument.
\return The number of elements in the list.
*/
int Count() const
{
if(_listInfo.size != _listInfo.count * sizeof(Type)) //make sure the user is using the correct type.
__debugbreak();
return _listInfo.count;
}
/**
\brief Cleans up the list, freeing the list data when it is not null.
*/
void Cleanup()
{
if(_listInfo.data)
{
BridgeFree(_listInfo.data);
_listInfo.data = nullptr;
}
}
/**
\brief Reference operator (cleans up the previous list)
\return Pointer to the ListInfo.
*/
ListInfo* operator&()
{
Cleanup();
return &_listInfo;
}
/**
\brief Array indexer operator. This will crash if you try to access out-of-bounds.
\param index Zero-based index of the item you want to get.
\return Reference to a value at that index.
*/
Type & operator[](size_t index) const
{
if(index >= size_t(Count())) //make sure the out-of-bounds access is caught as soon as possible.
__debugbreak();
return Data()[index];
}
/**
\brief Copies data to a ListInfo structure..
\param [out] listInfo If non-null, information describing the list.
\param listData Data to copy in the ListInfo structure.
\return true if it succeeds, false if it fails.
*/
static bool CopyData(ListInfo* listInfo, const std::vector<Type> & listData)
{
if(!listInfo)
return false;
listInfo->count = int(listData.size());
listInfo->size = listInfo->count * sizeof(Type);
if(listInfo->count)
{
listInfo->data = BridgeAlloc(listInfo->size);
Type* curItem = reinterpret_cast<Type*>(listInfo->data);
for(const auto & item : listData)
{
*curItem = item;
++curItem;
}
}
else
listInfo->data = nullptr;
return true;
}
static bool ToVector(const ListInfo* listInfo, std::vector<Type> & listData, bool freedata = true)
{
if(!listInfo || listInfo->size != listInfo->count * sizeof(Type) || (listInfo->count && !listInfo->data))
return false;
listData.resize(listInfo->count);
for(int i = 0; i < listInfo->count; i++)
listData[i] = ((Type*)listInfo->data)[i];
if(freedata && listInfo->data)
BridgeFree(listInfo->data);
return true;
}
private:
ListInfo _listInfo;
};
#endif //__cplusplus
#endif //_LIST_H
pluginsdk/bridgemain.h
+270 -22
View File
@@ -7,6 +7,9 @@
#include <stdbool.h>
#endif
//list structure (and C++ wrapper)
#include "bridgelist.h"
//default structure alignments forced
#ifdef _WIN64
#pragma pack(push, 16)
@@ -37,34 +40,48 @@ extern "C"
//Bridge defines
#define MAX_SETTING_SIZE 65536
#define DBG_VERSION 24
#define DBG_VERSION 25
//Bridge functions
BRIDGE_IMPEXP const char* BridgeInit();
BRIDGE_IMPEXP const char* BridgeStart();
BRIDGE_IMPEXP const wchar_t* BridgeInit();
BRIDGE_IMPEXP const wchar_t* BridgeStart();
BRIDGE_IMPEXP void* BridgeAlloc(size_t size);
BRIDGE_IMPEXP void BridgeFree(void* ptr);
BRIDGE_IMPEXP bool BridgeSettingGet(const char* section, const char* key, char* value);
BRIDGE_IMPEXP bool BridgeSettingGetUint(const char* section, const char* key, duint* value);
BRIDGE_IMPEXP bool BridgeSettingSet(const char* section, const char* key, const char* value);
BRIDGE_IMPEXP bool BridgeSettingSetUint(const char* section, const char* key, duint value);
BRIDGE_IMPEXP bool BridgeSettingFlush();
BRIDGE_IMPEXP bool BridgeSettingRead(int* errorLine);
BRIDGE_IMPEXP int BridgeGetDbgVersion();
#ifdef __cplusplus
}
#endif
#include "bridgegraph.h"
#ifdef __cplusplus
extern "C"
{
#endif
//Debugger defines
#define MAX_LABEL_SIZE 256
#define MAX_COMMENT_SIZE 512
#define MAX_MODULE_SIZE 256
#define MAX_IMPORT_SIZE 65536
#define MAX_BREAKPOINT_SIZE 256
#define MAX_CONDITIONAL_EXPR_SIZE 256
#define MAX_CONDITIONAL_TEXT_SIZE 256
#define MAX_SCRIPT_LINE_SIZE 2048
#define MAX_THREAD_NAME_SIZE 256
#define MAX_WATCH_NAME_SIZE 256
#define MAX_STRING_SIZE 512
#define MAX_ERROR_SIZE 512
#define RIGHTS_STRING_SIZE (sizeof("ERWCG") + 1)
#define MAX_SECTION_SIZE 10
#define TYPE_VALUE 1
#define TYPE_MEMORY 2
#define TYPE_ADDR 4
#define MAX_COMMAND_LINE_SIZE 256
#define MAX_MNEMONIC_SIZE 64
#define PAGE_SIZE 0x1000
@@ -95,7 +112,8 @@ typedef enum
flagcomment = 4,
flagbookmark = 8,
flagfunction = 16,
flagloop = 32
flagloop = 32,
flagargs = 64
} ADDRINFOFLAGS;
typedef enum
@@ -124,6 +142,24 @@ typedef enum
LOOP_END
} LOOPTYPE;
//order by most important type last
typedef enum
{
XREF_NONE,
XREF_DATA,
XREF_JMP,
XREF_CALL
} XREFTYPE;
typedef enum
{
ARG_NONE,
ARG_BEGIN,
ARG_MIDDLE,
ARG_END,
ARG_SINGLE
} ARGTYPE;
typedef enum
{
DBG_SCRIPT_LOAD, // param1=const char* filename, param2=unused
@@ -167,7 +203,30 @@ typedef enum
DBG_GET_STRING_AT, // param1=duint addr, param2=unused
DBG_GET_FUNCTIONS, // param1=unused, param2=unused
DBG_WIN_EVENT, // param1=MSG* message, param2=long* result
DBG_WIN_EVENT_GLOBAL // param1=MSG* message, param2=unused
DBG_WIN_EVENT_GLOBAL, // param1=MSG* message, param2=unused
DBG_INITIALIZE_LOCKS, // param1=unused, param2=unused
DBG_DEINITIALIZE_LOCKS, // param1=unused, param2=unused
DBG_GET_TIME_WASTED_COUNTER, // param1=unused, param2=unused
DBG_SYMBOL_ENUM_FROMCACHE, // param1=SYMBOLCBINFO* cbInfo, param2=unused
DBG_DELETE_COMMENT_RANGE, // param1=duint start, param2=duint end
DBG_DELETE_LABEL_RANGE, // param1=duint start, param2=duint end
DBG_DELETE_BOOKMARK_RANGE, // param1=duint start, param2=duint end
DBG_GET_XREF_COUNT_AT, // param1=duint addr, param2=unused
DBG_GET_XREF_TYPE_AT, // param1=duint addr, param2=unused
DBG_XREF_ADD, // param1=duint addr, param2=duint from
DBG_XREF_DEL_ALL, // param1=duint addr, param2=unused
DBG_XREF_GET, // param1=duint addr, param2=XREF_INFO* info
DBG_GET_ENCODE_TYPE_BUFFER, // param1=duint addr, param2=unused
DBG_ENCODE_TYPE_GET, // param1=duint addr, param2=duint size
DBG_DELETE_ENCODE_TYPE_RANGE, // param1=duint start, param2=duint end
DBG_ENCODE_SIZE_GET, // param1=duint addr, param2=duint codesize
DBG_DELETE_ENCODE_TYPE_SEG, // param1=duint addr, param2=unused
DBG_RELEASE_ENCODE_TYPE_BUFFER, // param1=void* buffer, param2=unused
DBG_ARGUMENT_GET, // param1=FUNCTION* info, param2=unused
DBG_ARGUMENT_OVERLAPS, // param1=FUNCTION* info, param2=unused
DBG_ARGUMENT_ADD, // param1=FUNCTION* info, param2=unused
DBG_ARGUMENT_DEL, // param1=FUNCTION* info, param2=unused
DBG_GET_WATCH_LIST // param1=ListOf(WATCHINFO), param2=unused
} DBGMSG;
typedef enum
@@ -273,6 +332,49 @@ typedef enum
size_qword = 8
} MEMORY_SIZE;
typedef enum
{
enc_unknown, //must be 0
enc_byte, //1 byte
enc_word, //2 bytes
enc_dword, //4 bytes
enc_fword, //6 bytes
enc_qword, //8 bytes
enc_tbyte, //10 bytes
enc_oword, //16 bytes
enc_mmword, //8 bytes
enc_xmmword, //16 bytes
enc_ymmword, //32 bytes
enc_zmmword, //64 bytes avx512 not supported
enc_real4, //4 byte float
enc_real8, //8 byte double
enc_real10, //10 byte decimal
enc_ascii, //ascii sequence
enc_unicode, //unicode sequence
enc_code, //start of code
enc_junk, //junk code
enc_middle //middle of data
} ENCODETYPE;
typedef enum
{
TYPE_UINT, // unsigned integer
TYPE_INT, // signed integer
TYPE_FLOAT,// single precision floating point value
TYPE_ASCII, // ascii string
TYPE_UNICODE, // unicode string
TYPE_INVALID // invalid watch expression or data type
} WATCHVARTYPE;
typedef enum
{
MODE_DISABLED, // watchdog is disabled
MODE_ISTRUE, // alert if expression is not 0
MODE_ISFALSE, // alert if expression is 0
MODE_CHANGED, // alert if expression is changed
MODE_UNCHANGED // alert if expression is not changed
} WATCHDOGMODE;
//Debugger typedefs
typedef MEMORY_SIZE VALUE_SIZE;
typedef struct SYMBOLINFO_ SYMBOLINFO;
@@ -303,6 +405,15 @@ typedef struct
char name[MAX_BREAKPOINT_SIZE];
char mod[MAX_MODULE_SIZE];
unsigned short slot;
// extended part
unsigned int hitCount;
bool fastResume;
bool silent;
char breakCondition[MAX_CONDITIONAL_EXPR_SIZE];
char logText[MAX_CONDITIONAL_TEXT_SIZE];
char logCondition[MAX_CONDITIONAL_EXPR_SIZE];
char commandText[MAX_CONDITIONAL_TEXT_SIZE];
char commandCondition[MAX_CONDITIONAL_EXPR_SIZE];
} BRIDGEBP;
typedef struct
@@ -311,10 +422,23 @@ typedef struct
BRIDGEBP* bp;
} BPMAP;
typedef struct
{
char WatchName[MAX_WATCH_NAME_SIZE];
char Expression[MAX_CONDITIONAL_EXPR_SIZE];
unsigned int window;
unsigned int id;
WATCHVARTYPE varType;
WATCHDOGMODE watchdogMode;
duint value;
bool watchdogTriggered;
} WATCHINFO;
typedef struct
{
duint start; //OUT
duint end; //OUT
duint instrcount; //OUT
} FUNCTION;
typedef struct
@@ -324,6 +448,7 @@ typedef struct
duint end; //OUT
} LOOP;
#ifndef _NO_ADDRINFO
typedef struct
{
int flags; //ADDRINFOFLAGS (IN)
@@ -333,13 +458,16 @@ typedef struct
bool isbookmark;
FUNCTION function;
LOOP loop;
FUNCTION args;
} ADDRINFO;
#endif
struct SYMBOLINFO_
{
duint addr;
char* decoratedSymbol;
char* undecoratedSymbol;
bool isImported;
};
typedef struct
@@ -501,6 +629,12 @@ typedef struct
#endif
} REGISTERCONTEXT;
typedef struct
{
DWORD code;
char name[128];
} LASTERROR;
typedef struct
{
REGISTERCONTEXT regcontext;
@@ -510,16 +644,17 @@ typedef struct
MXCSRFIELDS MxCsrFields;
X87STATUSWORDFIELDS x87StatusWordFields;
X87CONTROLWORDFIELDS x87ControlWordFields;
LASTERROR lastError;
} REGDUMP;
typedef struct
{
DISASM_ARGTYPE type;
DISASM_ARGTYPE type; //normal/memory
SEGMENTREG segment;
char mnemonic[64];
duint constant;
duint value;
duint memvalue;
duint constant; //constant in the instruction (imm/disp)
duint value; //equal to constant or equal to the register value
duint memvalue; //memsize:[value]
} DISASM_ARG;
typedef struct
@@ -540,8 +675,8 @@ typedef struct
typedef struct
{
int ThreadNumber;
HANDLE hThread;
DWORD dwThreadId;
HANDLE Handle;
DWORD ThreadId;
duint ThreadStartAddress;
duint ThreadLocalBase;
char threadName[MAX_THREAD_NAME_SIZE];
@@ -566,23 +701,28 @@ typedef struct
typedef struct
{
ULONG_PTR value; //displacement / addrvalue (rip-relative)
duint value; //displacement / addrvalue (rip-relative)
MEMORY_SIZE size; //byte/word/dword/qword
char mnemonic[MAX_MNEMONIC_SIZE];
} MEMORY_INFO;
typedef struct
{
ULONG_PTR value;
duint value;
VALUE_SIZE size;
} VALUE_INFO;
//definitions for BASIC_INSTRUCTION_INFO.type
#define TYPE_VALUE 1
#define TYPE_MEMORY 2
#define TYPE_ADDR 4
typedef struct
{
DWORD type; //value|memory|addr
VALUE_INFO value; //immediat
MEMORY_INFO memory;
ULONG_PTR addr; //addrvalue (jumps + calls)
duint addr; //addrvalue (jumps + calls)
bool branch; //jumps/calls
bool call; //instruction is a call
int size;
@@ -605,6 +745,18 @@ typedef struct
int depth;
} FUNCTION_LOOP_INFO;
typedef struct
{
duint addr;
XREFTYPE type;
} XREF_RECORD;
typedef struct
{
duint refcount;
XREF_RECORD* references;
} XREF_INFO;
//Debugger functions
BRIDGE_IMPEXP const char* DbgInit();
BRIDGE_IMPEXP void DbgExit();
@@ -620,10 +772,13 @@ BRIDGE_IMPEXP bool DbgIsDebugging();
BRIDGE_IMPEXP bool DbgIsJumpGoingToExecute(duint addr);
BRIDGE_IMPEXP bool DbgGetLabelAt(duint addr, SEGMENTREG segment, char* text);
BRIDGE_IMPEXP bool DbgSetLabelAt(duint addr, const char* text);
BRIDGE_IMPEXP void DbgClearLabelRange(duint start, duint end);
BRIDGE_IMPEXP bool DbgGetCommentAt(duint addr, char* text);
BRIDGE_IMPEXP bool DbgSetCommentAt(duint addr, const char* text);
BRIDGE_IMPEXP void DbgClearCommentRange(duint start, duint end);
BRIDGE_IMPEXP bool DbgGetBookmarkAt(duint addr);
BRIDGE_IMPEXP bool DbgSetBookmarkAt(duint addr, bool isbookmark);
BRIDGE_IMPEXP void DbgClearBookmarkRange(duint start, duint end);
BRIDGE_IMPEXP bool DbgGetModuleAt(duint addr, char* text);
BRIDGE_IMPEXP BPXTYPE DbgGetBpxTypeAt(duint addr);
BRIDGE_IMPEXP duint DbgValFromString(const char* string);
@@ -646,6 +801,7 @@ BRIDGE_IMPEXP SCRIPTLINETYPE DbgScriptGetLineType(int line);
BRIDGE_IMPEXP void DbgScriptSetIp(int line);
BRIDGE_IMPEXP bool DbgScriptGetBranchInfo(int line, SCRIPTBRANCH* info);
BRIDGE_IMPEXP void DbgSymbolEnum(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);
BRIDGE_IMPEXP void DbgSymbolEnumFromCache(duint base, CBSYMBOLENUM cbSymbolEnum, void* user);
BRIDGE_IMPEXP bool DbgAssembleAt(duint addr, const char* instruction);
BRIDGE_IMPEXP duint DbgModBaseFromName(const char* name);
BRIDGE_IMPEXP void DbgDisasmAt(duint addr, DISASM_INSTR* instr);
@@ -658,10 +814,19 @@ BRIDGE_IMPEXP bool DbgFunctionGet(duint addr, duint* start, duint* end);
BRIDGE_IMPEXP bool DbgFunctionOverlaps(duint start, duint end);
BRIDGE_IMPEXP bool DbgFunctionAdd(duint start, duint end);
BRIDGE_IMPEXP bool DbgFunctionDel(duint addr);
BRIDGE_IMPEXP bool DbgArgumentGet(duint addr, duint* start, duint* end);
BRIDGE_IMPEXP bool DbgArgumentOverlaps(duint start, duint end);
BRIDGE_IMPEXP bool DbgArgumentAdd(duint start, duint end);
BRIDGE_IMPEXP bool DbgArgumentDel(duint addr);
BRIDGE_IMPEXP bool DbgLoopGet(int depth, duint addr, duint* start, duint* end);
BRIDGE_IMPEXP bool DbgLoopOverlaps(int depth, duint start, duint end);
BRIDGE_IMPEXP bool DbgLoopAdd(duint start, duint end);
BRIDGE_IMPEXP bool DbgLoopDel(int depth, duint addr);
BRIDGE_IMPEXP bool DbgXrefAdd(duint addr, duint from);
BRIDGE_IMPEXP bool DbgXrefDelAll(duint addr);
BRIDGE_IMPEXP bool DbgXrefGet(duint addr, XREF_INFO* info);
BRIDGE_IMPEXP size_t DbgGetXrefCountAt(duint addr);
BRIDGE_IMPEXP XREFTYPE DbgGetXrefTypeAt(duint addr);
BRIDGE_IMPEXP bool DbgIsRunLocked();
BRIDGE_IMPEXP bool DbgIsBpDisabled(duint addr);
BRIDGE_IMPEXP bool DbgSetAutoCommentAt(duint addr, const char* text);
@@ -676,6 +841,17 @@ BRIDGE_IMPEXP bool DbgGetStringAt(duint addr, char* text);
BRIDGE_IMPEXP const DBGFUNCTIONS* DbgFunctions();
BRIDGE_IMPEXP bool DbgWinEvent(MSG* message, long* result);
BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message);
BRIDGE_IMPEXP bool DbgIsRunning();
BRIDGE_IMPEXP duint DbgGetTimeWastedCounter();
BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr);
BRIDGE_IMPEXP void* DbgGetEncodeTypeBuffer(duint addr);
BRIDGE_IMPEXP void DbgReleaseEncodeTypeBuffer(void* buffer);
BRIDGE_IMPEXP ENCODETYPE DbgGetEncodeTypeAt(duint addr, duint size);
BRIDGE_IMPEXP duint DbgGetEncodeSizeAt(duint addr, duint codesize);
BRIDGE_IMPEXP bool DbgSetEncodeType(duint addr, duint size, ENCODETYPE type);
BRIDGE_IMPEXP void DbgDelEncodeTypeRange(duint start, duint end);
BRIDGE_IMPEXP void DbgDelEncodeTypeSegment(duint start);
BRIDGE_IMPEXP bool DbgGetWatchList(ListOf(WATCHINFO) list);
//Gui defines
#define GUI_PLUGIN_MENU 0
@@ -723,7 +899,8 @@ typedef enum
GUI_REF_GETCELLCONTENT, // param1=int row, param2=int col
GUI_REF_RELOADDATA, // param1=unused, param2=unused
GUI_REF_SETSINGLESELECTION, // param1=int index, param2=bool scroll
GUI_REF_SETPROGRESS, // param1=int progress, param2=unused
GUI_REF_SETPROGRESS, // param1=int progress, param2=unused
GUI_REF_SETCURRENTTASKPROGRESS, // param1=int progress, param2=const char* taskTitle
GUI_REF_SETSEARCHSTARTCOL, // param1=int col param2=unused
GUI_STACK_DUMP_AT, // param1=duint addr, param2=duint csp
GUI_UPDATE_DUMP_VIEW, // param1=unused, param2=unused
@@ -740,18 +917,47 @@ typedef enum
GUI_GETLINE_WINDOW, // param1=const char* title, param2=char* text
GUI_AUTOCOMPLETE_ADDCMD, // param1=const char* cmd, param2=ununsed
GUI_AUTOCOMPLETE_DELCMD, // param1=const char* cmd, param2=ununsed
GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused
GUI_AUTOCOMPLETE_CLEARALL, // param1=unused, param2=unused
GUI_SCRIPT_ENABLEHIGHLIGHTING, // param1=bool enable, param2=unused
GUI_ADD_MSG_TO_STATUSBAR, // param1=const char* msg, param2=unused
GUI_UPDATE_SIDEBAR, // param1=unused, param2=unused
GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused
GUI_UPDATE_PATCHES, // param1=unused, param2=unused
GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused
GUI_UPDATE_SEHCHAIN, // param1=unused, param2=unused
GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused
GUI_UPDATE_MEMORY_VIEW, // param1=unused, param2=unused
GUI_REF_INITIALIZE // param1=const char* name param2=unused
GUI_REF_INITIALIZE, // param1=const char* name, param2=unused
GUI_LOAD_SOURCE_FILE, // param1=const char* path, param2=line
GUI_MENU_SET_ICON, // param1=int hMenu, param2=ICONINFO*
GUI_MENU_SET_ENTRY_ICON, // param1=int hEntry, param2=ICONINFO*
GUI_SHOW_CPU, // param1=unused, param2=unused
GUI_ADD_QWIDGET_TAB, // param1=QWidget*, param2=unused
GUI_SHOW_QWIDGET_TAB, // param1=QWidget*, param2=unused
GUI_CLOSE_QWIDGET_TAB, // param1=QWidget*, param2=unused
GUI_EXECUTE_ON_GUI_THREAD, // param1=GUICALLBACK, param2=unused
GUI_UPDATE_TIME_WASTED_COUNTER, // param1=unused, param2=unused
GUI_SET_GLOBAL_NOTES, // param1=const char* text, param2=unused
GUI_GET_GLOBAL_NOTES, // param1=char** text, param2=unused
GUI_SET_DEBUGGEE_NOTES, // param1=const char* text, param2=unused
GUI_GET_DEBUGGEE_NOTES, // param1=char** text, param2=unused
GUI_DUMP_AT_N, // param1=int index, param2=duint va
GUI_DISPLAY_WARNING, // param1=const char *text, param2=unused
GUI_REGISTER_SCRIPT_LANG, // param1=SCRIPTTYPEINFO* info, param2=unused
GUI_UNREGISTER_SCRIPT_LANG, // param1=int id, param2=unused
GUI_UPDATE_ARGUMENT_VIEW, // param1=unused, param2=unused
GUI_FOCUS_VIEW, // param1=int hWindow, param2=unused
GUI_UPDATE_WATCH_VIEW, // param1=unused, param2=unused
GUI_LOAD_GRAPH, // param1=BridgeCFGraphList* param2=unused
GUI_GRAPH_AT, // param1=duint addr param2=unused
GUI_UPDATE_GRAPH_VIEW // param1=unused, param2=unused
} GUIMSG;
//GUI Typedefs
typedef void (*GUICALLBACK)();
typedef bool (*GUISCRIPTEXECUTE)(const char* text);
typedef void (*GUISCRIPTCOMPLETER)(const char* text, char** entries, int* entryCount);
//GUI structures
typedef struct
{
@@ -766,7 +972,22 @@ typedef struct
duint end;
} SELECTIONDATA;
typedef struct
{
const void* data;
duint size;
} ICONDATA;
typedef struct
{
char name[64];
int id;
GUISCRIPTEXECUTE execute;
GUISCRIPTCOMPLETER completeCommand;
} SCRIPTTYPEINFO;
//GUI functions
//code page is utf8
BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip);
BRIDGE_IMPEXP void GuiSetDebugState(DBGSTATE state);
BRIDGE_IMPEXP void GuiAddLogMessage(const char* msg);
@@ -802,9 +1023,11 @@ BRIDGE_IMPEXP const char* GuiReferenceGetCellContent(int row, int col);
BRIDGE_IMPEXP void GuiReferenceReloadData();
BRIDGE_IMPEXP void GuiReferenceSetSingleSelection(int index, bool scroll);
BRIDGE_IMPEXP void GuiReferenceSetProgress(int progress);
BRIDGE_IMPEXP void GuiReferenceSetCurrentTaskProgress(int progress, const char* taskTitle);
BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col);
BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp);
BRIDGE_IMPEXP void GuiUpdateDumpView();
BRIDGE_IMPEXP void GuiUpdateWatchView();
BRIDGE_IMPEXP void GuiUpdateThreadView();
BRIDGE_IMPEXP void GuiUpdateMemoryView();
BRIDGE_IMPEXP void GuiAddRecentFile(const char* file);
@@ -825,7 +1048,32 @@ BRIDGE_IMPEXP void GuiUpdateSideBar();
BRIDGE_IMPEXP void GuiRepaintTableView();
BRIDGE_IMPEXP void GuiUpdatePatches();
BRIDGE_IMPEXP void GuiUpdateCallStack();
BRIDGE_IMPEXP void GuiUpdateMemoryView();
BRIDGE_IMPEXP void GuiUpdateSEHChain();
BRIDGE_IMPEXP void GuiLoadSourceFile(const char* path, int line);
BRIDGE_IMPEXP void GuiMenuSetIcon(int hMenu, const ICONDATA* icon);
BRIDGE_IMPEXP void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon);
BRIDGE_IMPEXP void GuiShowCpu();
BRIDGE_IMPEXP void GuiAddQWidgetTab(void* qWidget);
BRIDGE_IMPEXP void GuiShowQWidgetTab(void* qWidget);
BRIDGE_IMPEXP void GuiCloseQWidgetTab(void* qWidget);
BRIDGE_IMPEXP void GuiExecuteOnGuiThread(GUICALLBACK cbGuiThread);
BRIDGE_IMPEXP void GuiUpdateTimeWastedCounter();
BRIDGE_IMPEXP void GuiSetGlobalNotes(const char* text);
BRIDGE_IMPEXP void GuiGetGlobalNotes(char** text);
BRIDGE_IMPEXP void GuiSetDebuggeeNotes(const char* text);
BRIDGE_IMPEXP void GuiGetDebuggeeNotes(char** text);
BRIDGE_IMPEXP void GuiDumpAtN(duint va, int index);
BRIDGE_IMPEXP void GuiDisplayWarning(const char* title, const char* text);
BRIDGE_IMPEXP void GuiRegisterScriptLanguage(SCRIPTTYPEINFO* info);
BRIDGE_IMPEXP void GuiUnregisterScriptLanguage(int id);
BRIDGE_IMPEXP void GuiUpdateArgumentWidget();
BRIDGE_IMPEXP void GuiFocusView(int hWindow);
BRIDGE_IMPEXP bool GuiIsUpdateDisabled();
BRIDGE_IMPEXP void GuiUpdateEnable(bool updateNow);
BRIDGE_IMPEXP void GuiUpdateDisable();
BRIDGE_IMPEXP void GuiLoadGraph(BridgeCFGraphList* graph);
BRIDGE_IMPEXP void GuiGraphAt(duint addr);
BRIDGE_IMPEXP void GuiUpdateGraphView();
#ifdef __cplusplus
}
pluginsdk/capstone/arm.h
+950
View File
@@ -0,0 +1,950 @@
#ifndef CAPSTONE_ARM_H
#define CAPSTONE_ARM_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2013-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
//> ARM shift type
typedef enum arm_shifter
{
ARM_SFT_INVALID = 0,
ARM_SFT_ASR, // shift with immediate const
ARM_SFT_LSL, // shift with immediate const
ARM_SFT_LSR, // shift with immediate const
ARM_SFT_ROR, // shift with immediate const
ARM_SFT_RRX, // shift with immediate const
ARM_SFT_ASR_REG, // shift with register
ARM_SFT_LSL_REG, // shift with register
ARM_SFT_LSR_REG, // shift with register
ARM_SFT_ROR_REG, // shift with register
ARM_SFT_RRX_REG, // shift with register
} arm_shifter;
//> ARM condition code
typedef enum arm_cc
{
ARM_CC_INVALID = 0,
ARM_CC_EQ, // Equal Equal
ARM_CC_NE, // Not equal Not equal, or unordered
ARM_CC_HS, // Carry set >, ==, or unordered
ARM_CC_LO, // Carry clear Less than
ARM_CC_MI, // Minus, negative Less than
ARM_CC_PL, // Plus, positive or zero >, ==, or unordered
ARM_CC_VS, // Overflow Unordered
ARM_CC_VC, // No overflow Not unordered
ARM_CC_HI, // Unsigned higher Greater than, or unordered
ARM_CC_LS, // Unsigned lower or same Less than or equal
ARM_CC_GE, // Greater than or equal Greater than or equal
ARM_CC_LT, // Less than Less than, or unordered
ARM_CC_GT, // Greater than Greater than
ARM_CC_LE, // Less than or equal <, ==, or unordered
ARM_CC_AL // Always (unconditional) Always (unconditional)
} arm_cc;
typedef enum arm_sysreg
{
//> Special registers for MSR
ARM_SYSREG_INVALID = 0,
// SPSR* registers can be OR combined
ARM_SYSREG_SPSR_C = 1,
ARM_SYSREG_SPSR_X = 2,
ARM_SYSREG_SPSR_S = 4,
ARM_SYSREG_SPSR_F = 8,
// CPSR* registers can be OR combined
ARM_SYSREG_CPSR_C = 16,
ARM_SYSREG_CPSR_X = 32,
ARM_SYSREG_CPSR_S = 64,
ARM_SYSREG_CPSR_F = 128,
// independent registers
ARM_SYSREG_APSR = 256,
ARM_SYSREG_APSR_G,
ARM_SYSREG_APSR_NZCVQ,
ARM_SYSREG_APSR_NZCVQG,
ARM_SYSREG_IAPSR,
ARM_SYSREG_IAPSR_G,
ARM_SYSREG_IAPSR_NZCVQG,
ARM_SYSREG_IAPSR_NZCVQ,
ARM_SYSREG_EAPSR,
ARM_SYSREG_EAPSR_G,
ARM_SYSREG_EAPSR_NZCVQG,
ARM_SYSREG_EAPSR_NZCVQ,
ARM_SYSREG_XPSR,
ARM_SYSREG_XPSR_G,
ARM_SYSREG_XPSR_NZCVQG,
ARM_SYSREG_XPSR_NZCVQ,
ARM_SYSREG_IPSR,
ARM_SYSREG_EPSR,
ARM_SYSREG_IEPSR,
ARM_SYSREG_MSP,
ARM_SYSREG_PSP,
ARM_SYSREG_PRIMASK,
ARM_SYSREG_BASEPRI,
ARM_SYSREG_BASEPRI_MAX,
ARM_SYSREG_FAULTMASK,
ARM_SYSREG_CONTROL,
// Banked Registers
ARM_SYSREG_R8_USR,
ARM_SYSREG_R9_USR,
ARM_SYSREG_R10_USR,
ARM_SYSREG_R11_USR,
ARM_SYSREG_R12_USR,
ARM_SYSREG_SP_USR,
ARM_SYSREG_LR_USR,
ARM_SYSREG_R8_FIQ,
ARM_SYSREG_R9_FIQ,
ARM_SYSREG_R10_FIQ,
ARM_SYSREG_R11_FIQ,
ARM_SYSREG_R12_FIQ,
ARM_SYSREG_SP_FIQ,
ARM_SYSREG_LR_FIQ,
ARM_SYSREG_LR_IRQ,
ARM_SYSREG_SP_IRQ,
ARM_SYSREG_LR_SVC,
ARM_SYSREG_SP_SVC,
ARM_SYSREG_LR_ABT,
ARM_SYSREG_SP_ABT,
ARM_SYSREG_LR_UND,
ARM_SYSREG_SP_UND,
ARM_SYSREG_LR_MON,
ARM_SYSREG_SP_MON,
ARM_SYSREG_ELR_HYP,
ARM_SYSREG_SP_HYP,
ARM_SYSREG_SPSR_FIQ,
ARM_SYSREG_SPSR_IRQ,
ARM_SYSREG_SPSR_SVC,
ARM_SYSREG_SPSR_ABT,
ARM_SYSREG_SPSR_UND,
ARM_SYSREG_SPSR_MON,
ARM_SYSREG_SPSR_HYP,
} arm_sysreg;
//> The memory barrier constants map directly to the 4-bit encoding of
//> the option field for Memory Barrier operations.
typedef enum arm_mem_barrier
{
ARM_MB_INVALID = 0,
ARM_MB_RESERVED_0,
ARM_MB_OSHLD,
ARM_MB_OSHST,
ARM_MB_OSH,
ARM_MB_RESERVED_4,
ARM_MB_NSHLD,
ARM_MB_NSHST,
ARM_MB_NSH,
ARM_MB_RESERVED_8,
ARM_MB_ISHLD,
ARM_MB_ISHST,
ARM_MB_ISH,
ARM_MB_RESERVED_12,
ARM_MB_LD,
ARM_MB_ST,
ARM_MB_SY,
} arm_mem_barrier;
//> Operand type for instruction's operands
typedef enum arm_op_type
{
ARM_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
ARM_OP_REG, // = CS_OP_REG (Register operand).
ARM_OP_IMM, // = CS_OP_IMM (Immediate operand).
ARM_OP_MEM, // = CS_OP_MEM (Memory operand).
ARM_OP_FP, // = CS_OP_FP (Floating-Point operand).
ARM_OP_CIMM = 64, // C-Immediate (coprocessor registers)
ARM_OP_PIMM, // P-Immediate (coprocessor registers)
ARM_OP_SETEND, // operand for SETEND instruction
ARM_OP_SYSREG, // MSR/MSR special register operand
} arm_op_type;
//> Operand type for SETEND instruction
typedef enum arm_setend_type
{
ARM_SETEND_INVALID = 0, // Uninitialized.
ARM_SETEND_BE, // BE operand.
ARM_SETEND_LE, // LE operand
} arm_setend_type;
typedef enum arm_cpsmode_type
{
ARM_CPSMODE_INVALID = 0,
ARM_CPSMODE_IE = 2,
ARM_CPSMODE_ID = 3
} arm_cpsmode_type;
//> Operand type for SETEND instruction
typedef enum arm_cpsflag_type
{
ARM_CPSFLAG_INVALID = 0,
ARM_CPSFLAG_F = 1,
ARM_CPSFLAG_I = 2,
ARM_CPSFLAG_A = 4,
ARM_CPSFLAG_NONE = 16, // no flag
} arm_cpsflag_type;
//> Data type for elements of vector instructions.
typedef enum arm_vectordata_type
{
ARM_VECTORDATA_INVALID = 0,
// Integer type
ARM_VECTORDATA_I8,
ARM_VECTORDATA_I16,
ARM_VECTORDATA_I32,
ARM_VECTORDATA_I64,
// Signed integer type
ARM_VECTORDATA_S8,
ARM_VECTORDATA_S16,
ARM_VECTORDATA_S32,
ARM_VECTORDATA_S64,
// Unsigned integer type
ARM_VECTORDATA_U8,
ARM_VECTORDATA_U16,
ARM_VECTORDATA_U32,
ARM_VECTORDATA_U64,
// Data type for VMUL/VMULL
ARM_VECTORDATA_P8,
// Floating type
ARM_VECTORDATA_F32,
ARM_VECTORDATA_F64,
// Convert float <-> float
ARM_VECTORDATA_F16F64, // f16.f64
ARM_VECTORDATA_F64F16, // f64.f16
ARM_VECTORDATA_F32F16, // f32.f16
ARM_VECTORDATA_F16F32, // f32.f16
ARM_VECTORDATA_F64F32, // f64.f32
ARM_VECTORDATA_F32F64, // f32.f64
// Convert integer <-> float
ARM_VECTORDATA_S32F32, // s32.f32
ARM_VECTORDATA_U32F32, // u32.f32
ARM_VECTORDATA_F32S32, // f32.s32
ARM_VECTORDATA_F32U32, // f32.u32
ARM_VECTORDATA_F64S16, // f64.s16
ARM_VECTORDATA_F32S16, // f32.s16
ARM_VECTORDATA_F64S32, // f64.s32
ARM_VECTORDATA_S16F64, // s16.f64
ARM_VECTORDATA_S16F32, // s16.f64
ARM_VECTORDATA_S32F64, // s32.f64
ARM_VECTORDATA_U16F64, // u16.f64
ARM_VECTORDATA_U16F32, // u16.f32
ARM_VECTORDATA_U32F64, // u32.f64
ARM_VECTORDATA_F64U16, // f64.u16
ARM_VECTORDATA_F32U16, // f32.u16
ARM_VECTORDATA_F64U32, // f64.u32
} arm_vectordata_type;
//> ARM registers
typedef enum arm_reg
{
ARM_REG_INVALID = 0,
ARM_REG_APSR,
ARM_REG_APSR_NZCV,
ARM_REG_CPSR,
ARM_REG_FPEXC,
ARM_REG_FPINST,
ARM_REG_FPSCR,
ARM_REG_FPSCR_NZCV,
ARM_REG_FPSID,
ARM_REG_ITSTATE,
ARM_REG_LR,
ARM_REG_PC,
ARM_REG_SP,
ARM_REG_SPSR,
ARM_REG_D0,
ARM_REG_D1,
ARM_REG_D2,
ARM_REG_D3,
ARM_REG_D4,
ARM_REG_D5,
ARM_REG_D6,
ARM_REG_D7,
ARM_REG_D8,
ARM_REG_D9,
ARM_REG_D10,
ARM_REG_D11,
ARM_REG_D12,
ARM_REG_D13,
ARM_REG_D14,
ARM_REG_D15,
ARM_REG_D16,
ARM_REG_D17,
ARM_REG_D18,
ARM_REG_D19,
ARM_REG_D20,
ARM_REG_D21,
ARM_REG_D22,
ARM_REG_D23,
ARM_REG_D24,
ARM_REG_D25,
ARM_REG_D26,
ARM_REG_D27,
ARM_REG_D28,
ARM_REG_D29,
ARM_REG_D30,
ARM_REG_D31,
ARM_REG_FPINST2,
ARM_REG_MVFR0,
ARM_REG_MVFR1,
ARM_REG_MVFR2,
ARM_REG_Q0,
ARM_REG_Q1,
ARM_REG_Q2,
ARM_REG_Q3,
ARM_REG_Q4,
ARM_REG_Q5,
ARM_REG_Q6,
ARM_REG_Q7,
ARM_REG_Q8,
ARM_REG_Q9,
ARM_REG_Q10,
ARM_REG_Q11,
ARM_REG_Q12,
ARM_REG_Q13,
ARM_REG_Q14,
ARM_REG_Q15,
ARM_REG_R0,
ARM_REG_R1,
ARM_REG_R2,
ARM_REG_R3,
ARM_REG_R4,
ARM_REG_R5,
ARM_REG_R6,
ARM_REG_R7,
ARM_REG_R8,
ARM_REG_R9,
ARM_REG_R10,
ARM_REG_R11,
ARM_REG_R12,
ARM_REG_S0,
ARM_REG_S1,
ARM_REG_S2,
ARM_REG_S3,
ARM_REG_S4,
ARM_REG_S5,
ARM_REG_S6,
ARM_REG_S7,
ARM_REG_S8,
ARM_REG_S9,
ARM_REG_S10,
ARM_REG_S11,
ARM_REG_S12,
ARM_REG_S13,
ARM_REG_S14,
ARM_REG_S15,
ARM_REG_S16,
ARM_REG_S17,
ARM_REG_S18,
ARM_REG_S19,
ARM_REG_S20,
ARM_REG_S21,
ARM_REG_S22,
ARM_REG_S23,
ARM_REG_S24,
ARM_REG_S25,
ARM_REG_S26,
ARM_REG_S27,
ARM_REG_S28,
ARM_REG_S29,
ARM_REG_S30,
ARM_REG_S31,
ARM_REG_ENDING, // <-- mark the end of the list or registers
//> alias registers
ARM_REG_R13 = ARM_REG_SP,
ARM_REG_R14 = ARM_REG_LR,
ARM_REG_R15 = ARM_REG_PC,
ARM_REG_SB = ARM_REG_R9,
ARM_REG_SL = ARM_REG_R10,
ARM_REG_FP = ARM_REG_R11,
ARM_REG_IP = ARM_REG_R12,
} arm_reg;
// Instruction's operand referring to memory
// This is associated with ARM_OP_MEM operand type above
typedef struct arm_op_mem
{
arm_reg base; // base register
arm_reg index; // index register
int scale; // scale for index register (can be 1, or -1)
int disp; // displacement/offset value
int lshift; // left-shift on index register, or 0 if irrelevant.
} arm_op_mem;
// Instruction operand
typedef struct cs_arm_op
{
int vector_index; // Vector Index for some vector operands (or -1 if irrelevant)
struct
{
arm_shifter type;
unsigned int value;
} shift;
arm_op_type type; // operand type
union
{
int reg; // register value for REG/SYSREG operand
int32_t imm; // immediate value for C-IMM, P-IMM or IMM operand
double fp; // floating point value for FP operand
arm_op_mem mem; // base/index/scale/disp value for MEM operand
arm_setend_type setend; // SETEND instruction's operand type
};
// in some instructions, an operand can be subtracted or added to
// the base register,
bool subtracted; // if TRUE, this operand is subtracted. otherwise, it is added.
// How is this operand accessed? (READ, WRITE or READ|WRITE)
// This field is combined of cs_ac_type.
// NOTE: this field is irrelevant if engine is compiled in DIET mode.
uint8_t access;
// Neon lane index for NEON instructions (or -1 if irrelevant)
int8_t neon_lane;
} cs_arm_op;
// Instruction structure
typedef struct cs_arm
{
bool usermode; // User-mode registers to be loaded (for LDM/STM instructions)
int vector_size; // Scalar size for vector instructions
arm_vectordata_type vector_data; // Data type for elements of vector instructions
arm_cpsmode_type cps_mode; // CPS mode for CPS instruction
arm_cpsflag_type cps_flag; // CPS mode for CPS instruction
arm_cc cc; // conditional code for this insn
bool update_flags; // does this insn update flags?
bool writeback; // does this insn write-back?
arm_mem_barrier mem_barrier; // Option for some memory barrier instructions
// Number of operands of this instruction,
// or 0 when instruction has no operand.
uint8_t op_count;
cs_arm_op operands[36]; // operands for this instruction.
} cs_arm;
//> ARM instruction
typedef enum arm_insn
{
ARM_INS_INVALID = 0,
ARM_INS_ADC,
ARM_INS_ADD,
ARM_INS_ADR,
ARM_INS_AESD,
ARM_INS_AESE,
ARM_INS_AESIMC,
ARM_INS_AESMC,
ARM_INS_AND,
ARM_INS_BFC,
ARM_INS_BFI,
ARM_INS_BIC,
ARM_INS_BKPT,
ARM_INS_BL,
ARM_INS_BLX,
ARM_INS_BX,
ARM_INS_BXJ,
ARM_INS_B,
ARM_INS_CDP,
ARM_INS_CDP2,
ARM_INS_CLREX,
ARM_INS_CLZ,
ARM_INS_CMN,
ARM_INS_CMP,
ARM_INS_CPS,
ARM_INS_CRC32B,
ARM_INS_CRC32CB,
ARM_INS_CRC32CH,
ARM_INS_CRC32CW,
ARM_INS_CRC32H,
ARM_INS_CRC32W,
ARM_INS_DBG,
ARM_INS_DMB,
ARM_INS_DSB,
ARM_INS_EOR,
ARM_INS_ERET,
ARM_INS_VMOV,
ARM_INS_FLDMDBX,
ARM_INS_FLDMIAX,
ARM_INS_VMRS,
ARM_INS_FSTMDBX,
ARM_INS_FSTMIAX,
ARM_INS_HINT,
ARM_INS_HLT,
ARM_INS_HVC,
ARM_INS_ISB,
ARM_INS_LDA,
ARM_INS_LDAB,
ARM_INS_LDAEX,
ARM_INS_LDAEXB,
ARM_INS_LDAEXD,
ARM_INS_LDAEXH,
ARM_INS_LDAH,
ARM_INS_LDC2L,
ARM_INS_LDC2,
ARM_INS_LDCL,
ARM_INS_LDC,
ARM_INS_LDMDA,
ARM_INS_LDMDB,
ARM_INS_LDM,
ARM_INS_LDMIB,
ARM_INS_LDRBT,
ARM_INS_LDRB,
ARM_INS_LDRD,
ARM_INS_LDREX,
ARM_INS_LDREXB,
ARM_INS_LDREXD,
ARM_INS_LDREXH,
ARM_INS_LDRH,
ARM_INS_LDRHT,
ARM_INS_LDRSB,
ARM_INS_LDRSBT,
ARM_INS_LDRSH,
ARM_INS_LDRSHT,
ARM_INS_LDRT,
ARM_INS_LDR,
ARM_INS_MCR,
ARM_INS_MCR2,
ARM_INS_MCRR,
ARM_INS_MCRR2,
ARM_INS_MLA,
ARM_INS_MLS,
ARM_INS_MOV,
ARM_INS_MOVT,
ARM_INS_MOVW,
ARM_INS_MRC,
ARM_INS_MRC2,
ARM_INS_MRRC,
ARM_INS_MRRC2,
ARM_INS_MRS,
ARM_INS_MSR,
ARM_INS_MUL,
ARM_INS_MVN,
ARM_INS_ORR,
ARM_INS_PKHBT,
ARM_INS_PKHTB,
ARM_INS_PLDW,
ARM_INS_PLD,
ARM_INS_PLI,
ARM_INS_QADD,
ARM_INS_QADD16,
ARM_INS_QADD8,
ARM_INS_QASX,
ARM_INS_QDADD,
ARM_INS_QDSUB,
ARM_INS_QSAX,
ARM_INS_QSUB,
ARM_INS_QSUB16,
ARM_INS_QSUB8,
ARM_INS_RBIT,
ARM_INS_REV,
ARM_INS_REV16,
ARM_INS_REVSH,
ARM_INS_RFEDA,
ARM_INS_RFEDB,
ARM_INS_RFEIA,
ARM_INS_RFEIB,
ARM_INS_RSB,
ARM_INS_RSC,
ARM_INS_SADD16,
ARM_INS_SADD8,
ARM_INS_SASX,
ARM_INS_SBC,
ARM_INS_SBFX,
ARM_INS_SDIV,
ARM_INS_SEL,
ARM_INS_SETEND,
ARM_INS_SHA1C,
ARM_INS_SHA1H,
ARM_INS_SHA1M,
ARM_INS_SHA1P,
ARM_INS_SHA1SU0,
ARM_INS_SHA1SU1,
ARM_INS_SHA256H,
ARM_INS_SHA256H2,
ARM_INS_SHA256SU0,
ARM_INS_SHA256SU1,
ARM_INS_SHADD16,
ARM_INS_SHADD8,
ARM_INS_SHASX,
ARM_INS_SHSAX,
ARM_INS_SHSUB16,
ARM_INS_SHSUB8,
ARM_INS_SMC,
ARM_INS_SMLABB,
ARM_INS_SMLABT,
ARM_INS_SMLAD,
ARM_INS_SMLADX,
ARM_INS_SMLAL,
ARM_INS_SMLALBB,
ARM_INS_SMLALBT,
ARM_INS_SMLALD,
ARM_INS_SMLALDX,
ARM_INS_SMLALTB,
ARM_INS_SMLALTT,
ARM_INS_SMLATB,
ARM_INS_SMLATT,
ARM_INS_SMLAWB,
ARM_INS_SMLAWT,
ARM_INS_SMLSD,
ARM_INS_SMLSDX,
ARM_INS_SMLSLD,
ARM_INS_SMLSLDX,
ARM_INS_SMMLA,
ARM_INS_SMMLAR,
ARM_INS_SMMLS,
ARM_INS_SMMLSR,
ARM_INS_SMMUL,
ARM_INS_SMMULR,
ARM_INS_SMUAD,
ARM_INS_SMUADX,
ARM_INS_SMULBB,
ARM_INS_SMULBT,
ARM_INS_SMULL,
ARM_INS_SMULTB,
ARM_INS_SMULTT,
ARM_INS_SMULWB,
ARM_INS_SMULWT,
ARM_INS_SMUSD,
ARM_INS_SMUSDX,
ARM_INS_SRSDA,
ARM_INS_SRSDB,
ARM_INS_SRSIA,
ARM_INS_SRSIB,
ARM_INS_SSAT,
ARM_INS_SSAT16,
ARM_INS_SSAX,
ARM_INS_SSUB16,
ARM_INS_SSUB8,
ARM_INS_STC2L,
ARM_INS_STC2,
ARM_INS_STCL,
ARM_INS_STC,
ARM_INS_STL,
ARM_INS_STLB,
ARM_INS_STLEX,
ARM_INS_STLEXB,
ARM_INS_STLEXD,
ARM_INS_STLEXH,
ARM_INS_STLH,
ARM_INS_STMDA,
ARM_INS_STMDB,
ARM_INS_STM,
ARM_INS_STMIB,
ARM_INS_STRBT,
ARM_INS_STRB,
ARM_INS_STRD,
ARM_INS_STREX,
ARM_INS_STREXB,
ARM_INS_STREXD,
ARM_INS_STREXH,
ARM_INS_STRH,
ARM_INS_STRHT,
ARM_INS_STRT,
ARM_INS_STR,
ARM_INS_SUB,
ARM_INS_SVC,
ARM_INS_SWP,
ARM_INS_SWPB,
ARM_INS_SXTAB,
ARM_INS_SXTAB16,
ARM_INS_SXTAH,
ARM_INS_SXTB,
ARM_INS_SXTB16,
ARM_INS_SXTH,
ARM_INS_TEQ,
ARM_INS_TRAP,
ARM_INS_TST,
ARM_INS_UADD16,
ARM_INS_UADD8,
ARM_INS_UASX,
ARM_INS_UBFX,
ARM_INS_UDF,
ARM_INS_UDIV,
ARM_INS_UHADD16,
ARM_INS_UHADD8,
ARM_INS_UHASX,
ARM_INS_UHSAX,
ARM_INS_UHSUB16,
ARM_INS_UHSUB8,
ARM_INS_UMAAL,
ARM_INS_UMLAL,
ARM_INS_UMULL,
ARM_INS_UQADD16,
ARM_INS_UQADD8,
ARM_INS_UQASX,
ARM_INS_UQSAX,
ARM_INS_UQSUB16,
ARM_INS_UQSUB8,
ARM_INS_USAD8,
ARM_INS_USADA8,
ARM_INS_USAT,
ARM_INS_USAT16,
ARM_INS_USAX,
ARM_INS_USUB16,
ARM_INS_USUB8,
ARM_INS_UXTAB,
ARM_INS_UXTAB16,
ARM_INS_UXTAH,
ARM_INS_UXTB,
ARM_INS_UXTB16,
ARM_INS_UXTH,
ARM_INS_VABAL,
ARM_INS_VABA,
ARM_INS_VABDL,
ARM_INS_VABD,
ARM_INS_VABS,
ARM_INS_VACGE,
ARM_INS_VACGT,
ARM_INS_VADD,
ARM_INS_VADDHN,
ARM_INS_VADDL,
ARM_INS_VADDW,
ARM_INS_VAND,
ARM_INS_VBIC,
ARM_INS_VBIF,
ARM_INS_VBIT,
ARM_INS_VBSL,
ARM_INS_VCEQ,
ARM_INS_VCGE,
ARM_INS_VCGT,
ARM_INS_VCLE,
ARM_INS_VCLS,
ARM_INS_VCLT,
ARM_INS_VCLZ,
ARM_INS_VCMP,
ARM_INS_VCMPE,
ARM_INS_VCNT,
ARM_INS_VCVTA,
ARM_INS_VCVTB,
ARM_INS_VCVT,
ARM_INS_VCVTM,
ARM_INS_VCVTN,
ARM_INS_VCVTP,
ARM_INS_VCVTT,
ARM_INS_VDIV,
ARM_INS_VDUP,
ARM_INS_VEOR,
ARM_INS_VEXT,
ARM_INS_VFMA,
ARM_INS_VFMS,
ARM_INS_VFNMA,
ARM_INS_VFNMS,
ARM_INS_VHADD,
ARM_INS_VHSUB,
ARM_INS_VLD1,
ARM_INS_VLD2,
ARM_INS_VLD3,
ARM_INS_VLD4,
ARM_INS_VLDMDB,
ARM_INS_VLDMIA,
ARM_INS_VLDR,
ARM_INS_VMAXNM,
ARM_INS_VMAX,
ARM_INS_VMINNM,
ARM_INS_VMIN,
ARM_INS_VMLA,
ARM_INS_VMLAL,
ARM_INS_VMLS,
ARM_INS_VMLSL,
ARM_INS_VMOVL,
ARM_INS_VMOVN,
ARM_INS_VMSR,
ARM_INS_VMUL,
ARM_INS_VMULL,
ARM_INS_VMVN,
ARM_INS_VNEG,
ARM_INS_VNMLA,
ARM_INS_VNMLS,
ARM_INS_VNMUL,
ARM_INS_VORN,
ARM_INS_VORR,
ARM_INS_VPADAL,
ARM_INS_VPADDL,
ARM_INS_VPADD,
ARM_INS_VPMAX,
ARM_INS_VPMIN,
ARM_INS_VQABS,
ARM_INS_VQADD,
ARM_INS_VQDMLAL,
ARM_INS_VQDMLSL,
ARM_INS_VQDMULH,
ARM_INS_VQDMULL,
ARM_INS_VQMOVUN,
ARM_INS_VQMOVN,
ARM_INS_VQNEG,
ARM_INS_VQRDMULH,
ARM_INS_VQRSHL,
ARM_INS_VQRSHRN,
ARM_INS_VQRSHRUN,
ARM_INS_VQSHL,
ARM_INS_VQSHLU,
ARM_INS_VQSHRN,
ARM_INS_VQSHRUN,
ARM_INS_VQSUB,
ARM_INS_VRADDHN,
ARM_INS_VRECPE,
ARM_INS_VRECPS,
ARM_INS_VREV16,
ARM_INS_VREV32,
ARM_INS_VREV64,
ARM_INS_VRHADD,
ARM_INS_VRINTA,
ARM_INS_VRINTM,
ARM_INS_VRINTN,
ARM_INS_VRINTP,
ARM_INS_VRINTR,
ARM_INS_VRINTX,
ARM_INS_VRINTZ,
ARM_INS_VRSHL,
ARM_INS_VRSHRN,
ARM_INS_VRSHR,
ARM_INS_VRSQRTE,
ARM_INS_VRSQRTS,
ARM_INS_VRSRA,
ARM_INS_VRSUBHN,
ARM_INS_VSELEQ,
ARM_INS_VSELGE,
ARM_INS_VSELGT,
ARM_INS_VSELVS,
ARM_INS_VSHLL,
ARM_INS_VSHL,
ARM_INS_VSHRN,
ARM_INS_VSHR,
ARM_INS_VSLI,
ARM_INS_VSQRT,
ARM_INS_VSRA,
ARM_INS_VSRI,
ARM_INS_VST1,
ARM_INS_VST2,
ARM_INS_VST3,
ARM_INS_VST4,
ARM_INS_VSTMDB,
ARM_INS_VSTMIA,
ARM_INS_VSTR,
ARM_INS_VSUB,
ARM_INS_VSUBHN,
ARM_INS_VSUBL,
ARM_INS_VSUBW,
ARM_INS_VSWP,
ARM_INS_VTBL,
ARM_INS_VTBX,
ARM_INS_VCVTR,
ARM_INS_VTRN,
ARM_INS_VTST,
ARM_INS_VUZP,
ARM_INS_VZIP,
ARM_INS_ADDW,
ARM_INS_ASR,
ARM_INS_DCPS1,
ARM_INS_DCPS2,
ARM_INS_DCPS3,
ARM_INS_IT,
ARM_INS_LSL,
ARM_INS_LSR,
ARM_INS_ORN,
ARM_INS_ROR,
ARM_INS_RRX,
ARM_INS_SUBW,
ARM_INS_TBB,
ARM_INS_TBH,
ARM_INS_CBNZ,
ARM_INS_CBZ,
ARM_INS_POP,
ARM_INS_PUSH,
// special instructions
ARM_INS_NOP,
ARM_INS_YIELD,
ARM_INS_WFE,
ARM_INS_WFI,
ARM_INS_SEV,
ARM_INS_SEVL,
ARM_INS_VPUSH,
ARM_INS_VPOP,
ARM_INS_ENDING, // <-- mark the end of the list of instructions
} arm_insn;
//> Group of ARM instructions
typedef enum arm_insn_group
{
ARM_GRP_INVALID = 0, // = CS_GRP_INVALID
//> Generic groups
// all jump instructions (conditional+direct+indirect jumps)
ARM_GRP_JUMP, // = CS_GRP_JUMP
ARM_GRP_CALL, // = CS_GRP_CALL
ARM_GRP_INT = 4, // = CS_GRP_INT
ARM_GRP_PRIVILEGE = 6, // = CS_GRP_PRIVILEGE
//> Architecture-specific groups
ARM_GRP_CRYPTO = 128,
ARM_GRP_DATABARRIER,
ARM_GRP_DIVIDE,
ARM_GRP_FPARMV8,
ARM_GRP_MULTPRO,
ARM_GRP_NEON,
ARM_GRP_T2EXTRACTPACK,
ARM_GRP_THUMB2DSP,
ARM_GRP_TRUSTZONE,
ARM_GRP_V4T,
ARM_GRP_V5T,
ARM_GRP_V5TE,
ARM_GRP_V6,
ARM_GRP_V6T2,
ARM_GRP_V7,
ARM_GRP_V8,
ARM_GRP_VFP2,
ARM_GRP_VFP3,
ARM_GRP_VFP4,
ARM_GRP_ARM,
ARM_GRP_MCLASS,
ARM_GRP_NOTMCLASS,
ARM_GRP_THUMB,
ARM_GRP_THUMB1ONLY,
ARM_GRP_THUMB2,
ARM_GRP_PREV8,
ARM_GRP_FPVMLX,
ARM_GRP_MULOPS,
ARM_GRP_CRC,
ARM_GRP_DPVFP,
ARM_GRP_V6M,
ARM_GRP_VIRTUALIZATION,
ARM_GRP_ENDING,
} arm_insn_group;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/arm64.h
+1183
View File
File diff suppressed because it is too large. Load diff
pluginsdk/capstone/capstone.h
+747
View File
@@ -0,0 +1,747 @@
#ifndef CAPSTONE_ENGINE_H
#define CAPSTONE_ENGINE_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2013-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include <stdarg.h>
#if defined(CAPSTONE_HAS_OSXKERNEL)
#include <libkern/libkern.h>
#else
#include <stdlib.h>
#include <stdio.h>
#endif
#include "platform.h"
#ifdef _MSC_VER
#pragma warning(disable:4201)
#pragma warning(disable:4100)
#define CAPSTONE_API __cdecl
#ifdef CAPSTONE_SHARED
#define CAPSTONE_EXPORT __declspec(dllexport)
#else // defined(CAPSTONE_STATIC)
#define CAPSTONE_EXPORT
#endif
#else
#define CAPSTONE_API
#ifdef __GNUC__
#define CAPSTONE_EXPORT __attribute__((visibility("default")))
#else
#define CAPSTONE_EXPORT
#endif
#endif
#ifdef __GNUC__
#define CAPSTONE_DEPRECATED __attribute__((deprecated))
#elif defined(_MSC_VER)
#define CAPSTONE_DEPRECATED __declspec(deprecated)
#else
#pragma message("WARNING: You need to implement CAPSTONE_DEPRECATED for this compiler")
#define CAPSTONE_DEPRECATED
#endif
// Capstone API version
#define CS_API_MAJOR 4
#define CS_API_MINOR 0
// Version for bleeding edge code of the Github's "next" branch.
// Use this if you want the absolutely latest developement code.
// This version number will be bumped up whenever we have a new major change.
#define CS_NEXT_VERSION 3
// Macro to create combined version which can be compared to
// result of cs_version() API.
#define CS_MAKE_VERSION(major, minor) ((major << 8) + minor)
// Maximum size of an instruction mnemonic string.
#define CS_MNEMONIC_SIZE 32
// Handle using with all API
typedef size_t csh;
// Architecture type
typedef enum cs_arch
{
CS_ARCH_ARM = 0, // ARM architecture (including Thumb, Thumb-2)
CS_ARCH_ARM64, // ARM-64, also called AArch64
CS_ARCH_MIPS, // Mips architecture
CS_ARCH_X86, // X86 architecture (including x86 & x86-64)
CS_ARCH_PPC, // PowerPC architecture
CS_ARCH_SPARC, // Sparc architecture
CS_ARCH_SYSZ, // SystemZ architecture
CS_ARCH_XCORE, // XCore architecture
CS_ARCH_M68K, // 68K architecture
CS_ARCH_MAX,
CS_ARCH_ALL = 0xFFFF, // All architectures - for cs_support()
} cs_arch;
// Support value to verify diet mode of the engine.
// If cs_support(CS_SUPPORT_DIET) return True, the engine was compiled
// in diet mode.
#define CS_SUPPORT_DIET (CS_ARCH_ALL + 1)
// Support value to verify X86 reduce mode of the engine.
// If cs_support(CS_SUPPORT_X86_REDUCE) return True, the engine was compiled
// in X86 reduce mode.
#define CS_SUPPORT_X86_REDUCE (CS_ARCH_ALL + 2)
// Mode type
typedef enum cs_mode
{
CS_MODE_LITTLE_ENDIAN = 0, // little-endian mode (default mode)
CS_MODE_ARM = 0, // 32-bit ARM
CS_MODE_16 = 1 << 1, // 16-bit mode (X86)
CS_MODE_32 = 1 << 2, // 32-bit mode (X86)
CS_MODE_64 = 1 << 3, // 64-bit mode (X86, PPC)
CS_MODE_THUMB = 1 << 4, // ARM's Thumb mode, including Thumb-2
CS_MODE_MCLASS = 1 << 5, // ARM's Cortex-M series
CS_MODE_V8 = 1 << 6, // ARMv8 A32 encodings for ARM
CS_MODE_MICRO = 1 << 4, // MicroMips mode (MIPS)
CS_MODE_MIPS3 = 1 << 5, // Mips III ISA
CS_MODE_MIPS32R6 = 1 << 6, // Mips32r6 ISA
CS_MODE_V9 = 1 << 4, // SparcV9 mode (Sparc)
CS_MODE_QPX = 1 << 4, // Quad Processing eXtensions mode (PPC)
CS_MODE_M68K_000 = 1 << 1, // M68K 68000 mode
CS_MODE_M68K_010 = 1 << 2, // M68K 68010 mode
CS_MODE_M68K_020 = 1 << 3, // M68K 68020 mode
CS_MODE_M68K_030 = 1 << 4, // M68K 68030 mode
CS_MODE_M68K_040 = 1 << 5, // M68K 68040 mode
CS_MODE_M68K_060 = 1 << 6, // M68K 68060 mode
CS_MODE_BIG_ENDIAN = 1 << 31, // big-endian mode
CS_MODE_MIPS32 = CS_MODE_32, // Mips32 ISA (Mips)
CS_MODE_MIPS64 = CS_MODE_64, // Mips64 ISA (Mips)
} cs_mode;
typedef void* (CAPSTONE_API* cs_malloc_t)(size_t size);
typedef void* (CAPSTONE_API* cs_calloc_t)(size_t nmemb, size_t size);
typedef void* (CAPSTONE_API* cs_realloc_t)(void* ptr, size_t size);
typedef void (CAPSTONE_API* cs_free_t)(void* ptr);
typedef int (CAPSTONE_API* cs_vsnprintf_t)(char* str, size_t size, const char* format, va_list ap);
// User-defined dynamic memory related functions: malloc/calloc/realloc/free/vsnprintf()
// By default, Capstone uses system's malloc(), calloc(), realloc(), free() & vsnprintf().
typedef struct cs_opt_mem
{
cs_malloc_t malloc;
cs_calloc_t calloc;
cs_realloc_t realloc;
cs_free_t free;
cs_vsnprintf_t vsnprintf;
} cs_opt_mem;
// Customize mnemonic for instructions with alternative name.
// To reset existing customized instruction to its default mnemonic,
// call cs_option(CS_OPT_MNEMONIC) again with the same @id and NULL value
// for @mnemonic.
typedef struct cs_opt_mnem
{
// ID of instruction to be customized.
unsigned int id;
// Customized instruction mnemonic.
char* mnemonic;
} cs_opt_mnem;
// Runtime option for the disassembled engine
typedef enum cs_opt_type
{
CS_OPT_INVALID = 0, // No option specified
CS_OPT_SYNTAX, // Assembly output syntax
CS_OPT_DETAIL, // Break down instruction structure into details
CS_OPT_MODE, // Change engine's mode at run-time
CS_OPT_MEM, // User-defined dynamic memory related functions
CS_OPT_SKIPDATA, // Skip data when disassembling. Then engine is in SKIPDATA mode.
CS_OPT_SKIPDATA_SETUP, // Setup user-defined function for SKIPDATA option
CS_OPT_MNEMONIC, // Customize instruction mnemonic
CS_OPT_UNSIGNED, // print immediate operands in unsigned form
} cs_opt_type;
// Runtime option value (associated with option type above)
typedef enum cs_opt_value
{
CS_OPT_OFF = 0, // Turn OFF an option - default for CS_OPT_DETAIL, CS_OPT_SKIPDATA, CS_OPT_UNSIGNED.
CS_OPT_ON = 3, // Turn ON an option (CS_OPT_DETAIL, CS_OPT_SKIPDATA).
CS_OPT_SYNTAX_DEFAULT = 0, // Default asm syntax (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_INTEL, // X86 Intel asm syntax - default on X86 (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_ATT, // X86 ATT asm syntax (CS_OPT_SYNTAX).
CS_OPT_SYNTAX_NOREGNAME, // Prints register name with only number (CS_OPT_SYNTAX)
CS_OPT_SYNTAX_MASM, // X86 Intel Masm syntax (CS_OPT_SYNTAX).
} cs_opt_value;
//> Common instruction operand types - to be consistent across all architectures.
typedef enum cs_op_type
{
CS_OP_INVALID = 0, // uninitialized/invalid operand.
CS_OP_REG, // Register operand.
CS_OP_IMM, // Immediate operand.
CS_OP_MEM, // Memory operand.
CS_OP_FP, // Floating-Point operand.
} cs_op_type;
//> Common instruction operand access types - to be consistent across all architectures.
//> It is possible to combine access types, for example: CS_AC_READ | CS_AC_WRITE
typedef enum cs_ac_type
{
CS_AC_INVALID = 0, // Uninitialized/invalid access type.
CS_AC_READ = 1 << 0, // Operand read from memory or register.
CS_AC_WRITE = 1 << 1, // Operand write to memory or register.
} cs_ac_type;
//> Common instruction groups - to be consistent across all architectures.
typedef enum cs_group_type
{
CS_GRP_INVALID = 0, // uninitialized/invalid group.
CS_GRP_JUMP, // all jump instructions (conditional+direct+indirect jumps)
CS_GRP_CALL, // all call instructions
CS_GRP_RET, // all return instructions
CS_GRP_INT, // all interrupt instructions (int+syscall)
CS_GRP_IRET, // all interrupt return instructions
CS_GRP_PRIVILEGE, // all privileged instructions
} cs_group_type;
/*
User-defined callback function for SKIPDATA option.
See tests/test_skipdata.c for sample code demonstrating this API.
@code: the input buffer containing code to be disassembled.
This is the same buffer passed to cs_disasm().
@code_size: size (in bytes) of the above @code buffer.
@offset: the position of the currently-examining byte in the input
buffer @code mentioned above.
@user_data: user-data passed to cs_option() via @user_data field in
cs_opt_skipdata struct below.
@return: return number of bytes to skip, or 0 to immediately stop disassembling.
*/
typedef size_t (CAPSTONE_API* cs_skipdata_cb_t)(const uint8_t* code, size_t code_size, size_t offset, void* user_data);
// User-customized setup for SKIPDATA option
typedef struct cs_opt_skipdata
{
// Capstone considers data to skip as special "instructions".
// User can specify the string for this instruction's "mnemonic" here.
// By default (if @mnemonic is NULL), Capstone use ".byte".
const char* mnemonic;
// User-defined callback function to be called when Capstone hits data.
// If the returned value from this callback is positive (>0), Capstone
// will skip exactly that number of bytes & continue. Otherwise, if
// the callback returns 0, Capstone stops disassembling and returns
// immediately from cs_disasm()
// NOTE: if this callback pointer is NULL, Capstone would skip a number
// of bytes depending on architectures, as following:
// Arm: 2 bytes (Thumb mode) or 4 bytes.
// Arm64: 4 bytes.
// Mips: 4 bytes.
// PowerPC: 4 bytes.
// Sparc: 4 bytes.
// SystemZ: 2 bytes.
// X86: 1 bytes.
// XCore: 2 bytes.
cs_skipdata_cb_t callback; // default value is NULL
// User-defined data to be passed to @callback function pointer.
void* user_data;
} cs_opt_skipdata;
#include "arm.h"
#include "arm64.h"
#include "m68k.h"
#include "mips.h"
#include "ppc.h"
#include "sparc.h"
#include "systemz.h"
#include "x86.h"
#include "xcore.h"
// NOTE: All information in cs_detail is only available when CS_OPT_DETAIL = CS_OPT_ON
typedef struct cs_detail
{
uint16_t regs_read[12]; // list of implicit registers read by this insn
uint8_t regs_read_count; // number of implicit registers read by this insn
uint16_t regs_write[20]; // list of implicit registers modified by this insn
uint8_t regs_write_count; // number of implicit registers modified by this insn
uint8_t groups[8]; // list of group this instruction belong to
uint8_t groups_count; // number of groups this insn belongs to
// Architecture-specific instruction info
union
{
cs_x86 x86; // X86 architecture, including 16-bit, 32-bit & 64-bit mode
cs_arm64 arm64; // ARM64 architecture (aka AArch64)
cs_arm arm; // ARM architecture (including Thumb/Thumb2)
cs_m68k m68k; // M68K architecture
cs_mips mips; // MIPS architecture
cs_ppc ppc; // PowerPC architecture
cs_sparc sparc; // Sparc architecture
cs_sysz sysz; // SystemZ architecture
cs_xcore xcore; // XCore architecture
};
} cs_detail;
// Detail information of disassembled instruction
typedef struct cs_insn
{
// Instruction ID (basically a numeric ID for the instruction mnemonic)
// Find the instruction id in the '[ARCH]_insn' enum in the header file
// of corresponding architecture, such as 'arm_insn' in arm.h for ARM,
// 'x86_insn' in x86.h for X86, etc...
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
// NOTE: in Skipdata mode, "data" instruction has 0 for this id field.
unsigned int id;
// Address (EIP) of this instruction
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
uint64_t address;
// Size of this instruction
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
uint16_t size;
// Machine bytes of this instruction, with number of bytes indicated by @size above
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
uint8_t bytes[16];
// Ascii text of instruction mnemonic
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
char mnemonic[CS_MNEMONIC_SIZE];
// Ascii text of instruction operands
// This information is available even when CS_OPT_DETAIL = CS_OPT_OFF
char op_str[160];
// Pointer to cs_detail.
// NOTE: detail pointer is only valid when both requirements below are met:
// (1) CS_OP_DETAIL = CS_OPT_ON
// (2) Engine is not in Skipdata mode (CS_OP_SKIPDATA option set to CS_OPT_ON)
//
// NOTE 2: when in Skipdata mode, or when detail mode is OFF, even if this pointer
// is not NULL, its content is still irrelevant.
cs_detail* detail;
} cs_insn;
// Calculate the offset of a disassembled instruction in its buffer, given its position
// in its array of disassembled insn
// NOTE: this macro works with position (>=1), not index
#define CS_INSN_OFFSET(insns, post) (insns[post - 1].address - insns[0].address)
// All type of errors encountered by Capstone API.
// These are values returned by cs_errno()
typedef enum cs_err
{
CS_ERR_OK = 0, // No error: everything was fine
CS_ERR_MEM, // Out-Of-Memory error: cs_open(), cs_disasm(), cs_disasm_iter()
CS_ERR_ARCH, // Unsupported architecture: cs_open()
CS_ERR_HANDLE, // Invalid handle: cs_op_count(), cs_op_index()
CS_ERR_CSH, // Invalid csh argument: cs_close(), cs_errno(), cs_option()
CS_ERR_MODE, // Invalid/unsupported mode: cs_open()
CS_ERR_OPTION, // Invalid/unsupported option: cs_option()
CS_ERR_DETAIL, // Information is unavailable because detail option is OFF
CS_ERR_MEMSETUP, // Dynamic memory management uninitialized (see CS_OPT_MEM)
CS_ERR_VERSION, // Unsupported version (bindings)
CS_ERR_DIET, // Access irrelevant data in "diet" engine
CS_ERR_SKIPDATA, // Access irrelevant data for "data" instruction in SKIPDATA mode
CS_ERR_X86_ATT, // X86 AT&T syntax is unsupported (opt-out at compile time)
CS_ERR_X86_INTEL, // X86 Intel syntax is unsupported (opt-out at compile time)
CS_ERR_X86_MASM, // X86 Intel syntax is unsupported (opt-out at compile time)
} cs_err;
/*
Return combined API version & major and minor version numbers.
@major: major number of API version
@minor: minor number of API version
@return hexical number as (major << 8 | minor), which encodes both
major & minor versions.
NOTE: This returned value can be compared with version number made
with macro CS_MAKE_VERSION
For example, second API version would return 1 in @major, and 1 in @minor
The return value would be 0x0101
NOTE: if you only care about returned value, but not major and minor values,
set both @major & @minor arguments to NULL.
*/
CAPSTONE_EXPORT
unsigned int CAPSTONE_API cs_version(int* major, int* minor);
/*
This API can be used to either ask for archs supported by this library,
or check to see if the library was compile with 'diet' option (or called
in 'diet' mode).
To check if a particular arch is supported by this library, set @query to
arch mode (CS_ARCH_* value).
To verify if this library supports all the archs, use CS_ARCH_ALL.
To check if this library is in 'diet' mode, set @query to CS_SUPPORT_DIET.
@return True if this library supports the given arch, or in 'diet' mode.
*/
CAPSTONE_EXPORT
bool CAPSTONE_API cs_support(int query);
/*
Initialize CS handle: this must be done before any usage of CS.
@arch: architecture type (CS_ARCH_*)
@mode: hardware mode. This is combined of CS_MODE_*
@handle: pointer to handle, which will be updated at return time
@return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
for detailed error).
*/
CAPSTONE_EXPORT
cs_err CAPSTONE_API cs_open(cs_arch arch, cs_mode mode, csh* handle);
/*
Close CS handle: MUST do to release the handle when it is not used anymore.
NOTE: this must be only called when there is no longer usage of Capstone,
not even access to cs_insn array. The reason is the this API releases some
cached memory, thus access to any Capstone API after cs_close() might crash
your application.
In fact,this API invalidate @handle by ZERO out its value (i.e *handle = 0).
@handle: pointer to a handle returned by cs_open()
@return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
for detailed error).
*/
CAPSTONE_EXPORT
cs_err CAPSTONE_API cs_close(csh* handle);
/*
Set option for disassembling engine at runtime
@handle: handle returned by cs_open()
@type: type of option to be set
@value: option value corresponding with @type
@return: CS_ERR_OK on success, or other value on failure.
Refer to cs_err enum for detailed error.
NOTE: in the case of CS_OPT_MEM, handle's value can be anything,
so that cs_option(handle, CS_OPT_MEM, value) can (i.e must) be called
even before cs_open()
*/
CAPSTONE_EXPORT
cs_err CAPSTONE_API cs_option(csh handle, cs_opt_type type, size_t value);
/*
Report the last error number when some API function fail.
Like glibc's errno, cs_errno might not retain its old value once accessed.
@handle: handle returned by cs_open()
@return: error code of cs_err enum type (CS_ERR_*, see above)
*/
CAPSTONE_EXPORT
cs_err CAPSTONE_API cs_errno(csh handle);
/*
Return a string describing given error code.
@code: error code (see CS_ERR_* above)
@return: returns a pointer to a string that describes the error code
passed in the argument @code
*/
CAPSTONE_EXPORT
const char* CAPSTONE_API cs_strerror(cs_err code);
/*
Disassemble binary code, given the code buffer, size, address and number
of instructions to be decoded.
This API dynamically allocate memory to contain disassembled instruction.
Resulted instructions will be put into @*insn
NOTE 1: this API will automatically determine memory needed to contain
output disassembled instructions in @insn.
NOTE 2: caller must free the allocated memory itself to avoid memory leaking.
NOTE 3: for system with scarce memory to be dynamically allocated such as
OS kernel or firmware, the API cs_disasm_iter() might be a better choice than
cs_disasm(). The reason is that with cs_disasm(), based on limited available
memory, we have to calculate in advance how many instructions to be disassembled,
which complicates things. This is especially troublesome for the case @count=0,
when cs_disasm() runs uncontrollably (until either end of input buffer, or
when it encounters an invalid instruction).
@handle: handle returned by cs_open()
@code: buffer containing raw binary code to be disassembled.
@code_size: size of the above code buffer.
@address: address of the first instruction in given raw code buffer.
@insn: array of instructions filled in by this API.
NOTE: @insn will be allocated by this function, and should be freed
with cs_free() API.
@count: number of instructions to be disassembled, or 0 to get all of them
@return: the number of successfully disassembled instructions,
or 0 if this function failed to disassemble the given code
On failure, call cs_errno() for error code.
*/
CAPSTONE_EXPORT
size_t CAPSTONE_API cs_disasm(csh handle,
const uint8_t* code, size_t code_size,
uint64_t address,
size_t count,
cs_insn** insn);
/*
Deprecated function - to be retired in the next version!
Use cs_disasm() instead of cs_disasm_ex()
*/
CAPSTONE_EXPORT
CAPSTONE_DEPRECATED
size_t CAPSTONE_API cs_disasm_ex(csh handle,
const uint8_t* code, size_t code_size,
uint64_t address,
size_t count,
cs_insn** insn);
/*
Free memory allocated by cs_malloc() or cs_disasm() (argument @insn)
@insn: pointer returned by @insn argument in cs_disasm() or cs_malloc()
@count: number of cs_insn structures returned by cs_disasm(), or 1
to free memory allocated by cs_malloc().
*/
CAPSTONE_EXPORT
void CAPSTONE_API cs_free(cs_insn* insn, size_t count);
/*
Allocate memory for 1 instruction to be used by cs_disasm_iter().
@handle: handle returned by cs_open()
NOTE: when no longer in use, you can reclaim the memory allocated for
this instruction with cs_free(insn, 1)
*/
CAPSTONE_EXPORT
cs_insn* CAPSTONE_API cs_malloc(csh handle);
/*
Fast API to disassemble binary code, given the code buffer, size, address
and number of instructions to be decoded.
This API put the resulted instruction into a given cache in @insn.
See tests/test_iter.c for sample code demonstrating this API.
NOTE 1: this API will update @code, @size & @address to point to the next
instruction in the input buffer. Therefore, it is convenient to use
cs_disasm_iter() inside a loop to quickly iterate all the instructions.
While decoding one instruction at a time can also be achieved with
cs_disasm(count=1), some benchmarks shown that cs_disasm_iter() can be 30%
faster on random input.
NOTE 2: the cache in @insn can be created with cs_malloc() API.
NOTE 3: for system with scarce memory to be dynamically allocated such as
OS kernel or firmware, this API is recommended over cs_disasm(), which
allocates memory based on the number of instructions to be disassembled.
The reason is that with cs_disasm(), based on limited available memory,
we have to calculate in advance how many instructions to be disassembled,
which complicates things. This is especially troublesome for the case
@count=0, when cs_disasm() runs uncontrollably (until either end of input
buffer, or when it encounters an invalid instruction).
@handle: handle returned by cs_open()
@code: buffer containing raw binary code to be disassembled
@code_size: size of above code
@address: address of the first insn in given raw code buffer
@insn: pointer to instruction to be filled in by this API.
@return: true if this API successfully decode 1 instruction,
or false otherwise.
On failure, call cs_errno() for error code.
*/
CAPSTONE_EXPORT
bool CAPSTONE_API cs_disasm_iter(csh handle,
const uint8_t** code, size_t* size,
uint64_t* address, cs_insn* insn);
/*
Return friendly name of register in a string.
Find the instruction id from header file of corresponding architecture (arm.h for ARM,
x86.h for X86, ...)
WARN: when in 'diet' mode, this API is irrelevant because engine does not
store register name.
@handle: handle returned by cs_open()
@reg_id: register id
@return: string name of the register, or NULL if @reg_id is invalid.
*/
CAPSTONE_EXPORT
const char* CAPSTONE_API cs_reg_name(csh handle, unsigned int reg_id);
/*
Return friendly name of an instruction in a string.
Find the instruction id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
WARN: when in 'diet' mode, this API is irrelevant because the engine does not
store instruction name.
@handle: handle returned by cs_open()
@insn_id: instruction id
@return: string name of the instruction, or NULL if @insn_id is invalid.
*/
CAPSTONE_EXPORT
const char* CAPSTONE_API cs_insn_name(csh handle, unsigned int insn_id);
/*
Return friendly name of a group id (that an instruction can belong to)
Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
WARN: when in 'diet' mode, this API is irrelevant because the engine does not
store group name.
@handle: handle returned by cs_open()
@group_id: group id
@return: string name of the group, or NULL if @group_id is invalid.
*/
CAPSTONE_EXPORT
const char* CAPSTONE_API cs_group_name(csh handle, unsigned int group_id);
/*
Check if a disassembled instruction belong to a particular group.
Find the group id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
Internally, this simply verifies if @group_id matches any member of insn->groups array.
NOTE: this API is only valid when detail option is ON (which is OFF by default).
WARN: when in 'diet' mode, this API is irrelevant because the engine does not
update @groups array.
@handle: handle returned by cs_open()
@insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
@group_id: group that you want to check if this instruction belong to.
@return: true if this instruction indeed belongs to aboved group, or false otherwise.
*/
CAPSTONE_EXPORT
bool CAPSTONE_API cs_insn_group(csh handle, const cs_insn* insn, unsigned int group_id);
/*
Check if a disassembled instruction IMPLICITLY used a particular register.
Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
Internally, this simply verifies if @reg_id matches any member of insn->regs_read array.
NOTE: this API is only valid when detail option is ON (which is OFF by default)
WARN: when in 'diet' mode, this API is irrelevant because the engine does not
update @regs_read array.
@insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
@reg_id: register that you want to check if this instruction used it.
@return: true if this instruction indeed implicitly used aboved register, or false otherwise.
*/
CAPSTONE_EXPORT
bool CAPSTONE_API cs_reg_read(csh handle, const cs_insn* insn, unsigned int reg_id);
/*
Check if a disassembled instruction IMPLICITLY modified a particular register.
Find the register id from header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
Internally, this simply verifies if @reg_id matches any member of insn->regs_write array.
NOTE: this API is only valid when detail option is ON (which is OFF by default)
WARN: when in 'diet' mode, this API is irrelevant because the engine does not
update @regs_write array.
@insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
@reg_id: register that you want to check if this instruction modified it.
@return: true if this instruction indeed implicitly modified aboved register, or false otherwise.
*/
CAPSTONE_EXPORT
bool CAPSTONE_API cs_reg_write(csh handle, const cs_insn* insn, unsigned int reg_id);
/*
Count the number of operands of a given type.
Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
NOTE: this API is only valid when detail option is ON (which is OFF by default)
@handle: handle returned by cs_open()
@insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
@op_type: Operand type to be found.
@return: number of operands of given type @op_type in instruction @insn,
or -1 on failure.
*/
CAPSTONE_EXPORT
int CAPSTONE_API cs_op_count(csh handle, const cs_insn* insn, unsigned int op_type);
/*
Retrieve the position of operand of given type in <arch>.operands[] array.
Later, the operand can be accessed using the returned position.
Find the operand type in header file of corresponding architecture (arm.h for ARM, x86.h for X86, ...)
NOTE: this API is only valid when detail option is ON (which is OFF by default)
@handle: handle returned by cs_open()
@insn: disassembled instruction structure received from cs_disasm() or cs_disasm_iter()
@op_type: Operand type to be found.
@position: position of the operand to be found. This must be in the range
[1, cs_op_count(handle, insn, op_type)]
@return: index of operand of given type @op_type in <arch>.operands[] array
in instruction @insn, or -1 on failure.
*/
CAPSTONE_EXPORT
int CAPSTONE_API cs_op_index(csh handle, const cs_insn* insn, unsigned int op_type,
unsigned int position);
// Type of array to keep the list of registers
typedef uint16_t cs_regs[64];
/*
Retrieve all the registers accessed by an instruction, either explicitly or
implicitly.
WARN: when in 'diet' mode, this API is irrelevant because engine does not
store registers.
@handle: handle returned by cs_open()
@insn: disassembled instruction structure returned from cs_disasm() or cs_disasm_iter()
@regs_read: on return, this array contains all registers read by instruction.
@regs_read_count: number of registers kept inside @regs_read array.
@regs_write: on return, this array contains all registers written by instruction.
@regs_write_count: number of registers kept inside @regs_write array.
@return CS_ERR_OK on success, or other value on failure (refer to cs_err enum
for detailed error).
*/
CAPSTONE_EXPORT
cs_err CAPSTONE_API cs_regs_access(csh handle, const cs_insn* insn,
cs_regs regs_read, uint8_t* regs_read_count,
cs_regs regs_write, uint8_t* regs_write_count);
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/capstone_x64.lib
BIN
View File
Binary file not shown.
pluginsdk/capstone/capstone_x86.lib
BIN
View File
Binary file not shown.
pluginsdk/capstone/m68k.h
+607
View File
@@ -0,0 +1,607 @@
#ifndef CAPSTONE_M68K_H
#define CAPSTONE_M68K_H
/* Capstone Disassembly Engine */
/* By Daniel Collin <[email protected]>, 2015-2016 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
#define M68K_OPERAND_COUNT 4
//> M68K registers and special registers
typedef enum m68k_reg
{
M68K_REG_INVALID = 0,
M68K_REG_D0,
M68K_REG_D1,
M68K_REG_D2,
M68K_REG_D3,
M68K_REG_D4,
M68K_REG_D5,
M68K_REG_D6,
M68K_REG_D7,
M68K_REG_A0,
M68K_REG_A1,
M68K_REG_A2,
M68K_REG_A3,
M68K_REG_A4,
M68K_REG_A5,
M68K_REG_A6,
M68K_REG_A7,
M68K_REG_FP0,
M68K_REG_FP1,
M68K_REG_FP2,
M68K_REG_FP3,
M68K_REG_FP4,
M68K_REG_FP5,
M68K_REG_FP6,
M68K_REG_FP7,
M68K_REG_PC,
M68K_REG_SR,
M68K_REG_CCR,
M68K_REG_SFC,
M68K_REG_DFC,
M68K_REG_USP,
M68K_REG_VBR,
M68K_REG_CACR,
M68K_REG_CAAR,
M68K_REG_MSP,
M68K_REG_ISP,
M68K_REG_TC,
M68K_REG_ITT0,
M68K_REG_ITT1,
M68K_REG_DTT0,
M68K_REG_DTT1,
M68K_REG_MMUSR,
M68K_REG_URP,
M68K_REG_SRP,
M68K_REG_FPCR,
M68K_REG_FPSR,
M68K_REG_FPIAR,
M68K_REG_ENDING, // <-- mark the end of the list of registers
} m68k_reg;
//> M68K Addressing Modes
typedef enum m68k_address_mode
{
M68K_AM_NONE = 0, // No address mode.
M68K_AM_REG_DIRECT_DATA, // Register Direct - Data
M68K_AM_REG_DIRECT_ADDR, // Register Direct - Address
M68K_AM_REGI_ADDR, // Register Indirect - Address
M68K_AM_REGI_ADDR_POST_INC, // Register Indirect - Address with Postincrement
M68K_AM_REGI_ADDR_PRE_DEC, // Register Indirect - Address with Predecrement
M68K_AM_REGI_ADDR_DISP, // Register Indirect - Address with Displacement
M68K_AM_AREGI_INDEX_8_BIT_DISP, // Address Register Indirect With Index- 8-bit displacement
M68K_AM_AREGI_INDEX_BASE_DISP, // Address Register Indirect With Index- Base displacement
M68K_AM_MEMI_POST_INDEX, // Memory indirect - Postindex
M68K_AM_MEMI_PRE_INDEX, // Memory indirect - Preindex
M68K_AM_PCI_DISP, // Program Counter Indirect - with Displacement
M68K_AM_PCI_INDEX_8_BIT_DISP, // Program Counter Indirect with Index - with 8-Bit Displacement
M68K_AM_PCI_INDEX_BASE_DISP, // Program Counter Indirect with Index - with Base Displacement
M68K_AM_PC_MEMI_POST_INDEX, // Program Counter Memory Indirect - Postindexed
M68K_AM_PC_MEMI_PRE_INDEX, // Program Counter Memory Indirect - Preindexed
M68K_AM_ABSOLUTE_DATA_SHORT, // Absolute Data Addressing - Short
M68K_AM_ABSOLUTE_DATA_LONG, // Absolute Data Addressing - Long
M68K_AM_IMMEDIATE, // Immediate value
} m68k_address_mode;
//> Operand type for instruction's operands
typedef enum m68k_op_type
{
M68K_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
M68K_OP_REG, // = CS_OP_REG (Register operand).
M68K_OP_IMM, // = CS_OP_IMM (Immediate operand).
M68K_OP_MEM, // = CS_OP_MEM (Memory operand).
M68K_OP_FP_SINGLE, // single precision Floating-Point operand
M68K_OP_FP_DOUBLE, // double precision Floating-Point operand
M68K_OP_REG_BITS, // Register bits move
M68K_OP_REG_PAIR, // Register pair in the same op (upper 4 bits for first reg, lower for second)
} m68k_op_type;
// Instruction's operand referring to memory
// This is associated with M68K_OP_MEM operand type above
typedef struct m68k_op_mem
{
m68k_reg base_reg; // base register (or M68K_REG_INVALID if irrelevant)
m68k_reg index_reg; // index register (or M68K_REG_INVALID if irrelevant)
m68k_reg in_base_reg; // indirect base register (or M68K_REG_INVALID if irrelevant)
uint32_t in_disp; // indirect displacement
uint32_t out_disp; // other displacement
uint16_t disp; // displacement value
uint8_t scale; // scale for index register
uint8_t bitfield; // set to true if the two values below should be used
uint8_t width; // used for bf* instructions
uint8_t offset; // used for bf* instructions
uint8_t index_size; // 0 = w, 1 = l
} m68k_op_mem;
// Instruction operand
typedef struct cs_m68k_op
{
union
{
uint64_t imm; // immediate value for IMM operand
double dimm; // double imm
float simm; // float imm
m68k_reg reg; // register value for REG operand
struct // register pair in one operand
{
m68k_reg reg_0;
m68k_reg reg_1;
} reg_pair;
m68k_op_mem mem; // data when operand is targeting memory
uint32_t register_bits; // register bits for movem etc. (always in d0-d7, a0-a7, fp0 - fp7 order)
};
m68k_op_type type;
m68k_address_mode address_mode; // M68K addressing mode for this op
} cs_m68k_op;
// Operation size of the CPU instructions
typedef enum m68k_cpu_size
{
M68K_CPU_SIZE_NONE = 0, // unsized or unspecified
M68K_CPU_SIZE_BYTE = 1, // 1 byte in size
M68K_CPU_SIZE_WORD = 2, // 2 bytes in size
M68K_CPU_SIZE_LONG = 4, // 4 bytes in size
} m68k_cpu_size;
// Operation size of the FPU instructions (Notice that FPU instruction can also use CPU sizes if needed)
typedef enum m68k_fpu_size
{
M68K_FPU_SIZE_NONE = 0, // unsized like fsave/frestore
M68K_FPU_SIZE_SINGLE = 4, // 4 byte in size (single float)
M68K_FPU_SIZE_DOUBLE = 8, // 8 byte in size (double)
M68K_FPU_SIZE_EXTENDED = 12, // 12 byte in size (extended real format)
} m68k_fpu_size;
// Type of size that is being used for the current instruction
typedef enum m68k_size_type
{
M68K_SIZE_TYPE_INVALID = 0,
M68K_SIZE_TYPE_CPU,
M68K_SIZE_TYPE_FPU,
} m68k_size_type;
// Operation size of the current instruction (NOT the actually size of instruction)
typedef struct m68k_op_size
{
m68k_size_type type;
union
{
m68k_cpu_size cpu_size;
m68k_fpu_size fpu_size;
};
} m68k_op_size;
// The M68K instruction and it's operands
typedef struct cs_m68k
{
// Number of operands of this instruction or 0 when instruction has no operand.
cs_m68k_op operands[M68K_OPERAND_COUNT]; // operands for this instruction.
m68k_op_size op_size; // size of data operand works on in bytes (.b, .w, .l, etc)
uint8_t op_count; // number of operands for the instruction
} cs_m68k;
//> M68K instruction
typedef enum m68k_insn
{
M68K_INS_INVALID = 0,
M68K_INS_ABCD,
M68K_INS_ADD,
M68K_INS_ADDA,
M68K_INS_ADDI,
M68K_INS_ADDQ,
M68K_INS_ADDX,
M68K_INS_AND,
M68K_INS_ANDI,
M68K_INS_ASL,
M68K_INS_ASR,
M68K_INS_BHS,
M68K_INS_BLO,
M68K_INS_BHI,
M68K_INS_BLS,
M68K_INS_BCC,
M68K_INS_BCS,
M68K_INS_BNE,
M68K_INS_BEQ,
M68K_INS_BVC,
M68K_INS_BVS,
M68K_INS_BPL,
M68K_INS_BMI,
M68K_INS_BGE,
M68K_INS_BLT,
M68K_INS_BGT,
M68K_INS_BLE,
M68K_INS_BRA,
M68K_INS_BSR,
M68K_INS_BCHG,
M68K_INS_BCLR,
M68K_INS_BSET,
M68K_INS_BTST,
M68K_INS_BFCHG,
M68K_INS_BFCLR,
M68K_INS_BFEXTS,
M68K_INS_BFEXTU,
M68K_INS_BFFFO,
M68K_INS_BFINS,
M68K_INS_BFSET,
M68K_INS_BFTST,
M68K_INS_BKPT,
M68K_INS_CALLM,
M68K_INS_CAS,
M68K_INS_CAS2,
M68K_INS_CHK,
M68K_INS_CHK2,
M68K_INS_CLR,
M68K_INS_CMP,
M68K_INS_CMPA,
M68K_INS_CMPI,
M68K_INS_CMPM,
M68K_INS_CMP2,
M68K_INS_CINVL,
M68K_INS_CINVP,
M68K_INS_CINVA,
M68K_INS_CPUSHL,
M68K_INS_CPUSHP,
M68K_INS_CPUSHA,
M68K_INS_DBT,
M68K_INS_DBF,
M68K_INS_DBHI,
M68K_INS_DBLS,
M68K_INS_DBCC,
M68K_INS_DBCS,
M68K_INS_DBNE,
M68K_INS_DBEQ,
M68K_INS_DBVC,
M68K_INS_DBVS,
M68K_INS_DBPL,
M68K_INS_DBMI,
M68K_INS_DBGE,
M68K_INS_DBLT,
M68K_INS_DBGT,
M68K_INS_DBLE,
M68K_INS_DBRA,
M68K_INS_DIVS,
M68K_INS_DIVSL,
M68K_INS_DIVU,
M68K_INS_DIVUL,
M68K_INS_EOR,
M68K_INS_EORI,
M68K_INS_EXG,
M68K_INS_EXT,
M68K_INS_EXTB,
M68K_INS_FABS,
M68K_INS_FSABS,
M68K_INS_FDABS,
M68K_INS_FACOS,
M68K_INS_FADD,
M68K_INS_FSADD,
M68K_INS_FDADD,
M68K_INS_FASIN,
M68K_INS_FATAN,
M68K_INS_FATANH,
M68K_INS_FBF,
M68K_INS_FBEQ,
M68K_INS_FBOGT,
M68K_INS_FBOGE,
M68K_INS_FBOLT,
M68K_INS_FBOLE,
M68K_INS_FBOGL,
M68K_INS_FBOR,
M68K_INS_FBUN,
M68K_INS_FBUEQ,
M68K_INS_FBUGT,
M68K_INS_FBUGE,
M68K_INS_FBULT,
M68K_INS_FBULE,
M68K_INS_FBNE,
M68K_INS_FBT,
M68K_INS_FBSF,
M68K_INS_FBSEQ,
M68K_INS_FBGT,
M68K_INS_FBGE,
M68K_INS_FBLT,
M68K_INS_FBLE,
M68K_INS_FBGL,
M68K_INS_FBGLE,
M68K_INS_FBNGLE,
M68K_INS_FBNGL,
M68K_INS_FBNLE,
M68K_INS_FBNLT,
M68K_INS_FBNGE,
M68K_INS_FBNGT,
M68K_INS_FBSNE,
M68K_INS_FBST,
M68K_INS_FCMP,
M68K_INS_FCOS,
M68K_INS_FCOSH,
M68K_INS_FDBF,
M68K_INS_FDBEQ,
M68K_INS_FDBOGT,
M68K_INS_FDBOGE,
M68K_INS_FDBOLT,
M68K_INS_FDBOLE,
M68K_INS_FDBOGL,
M68K_INS_FDBOR,
M68K_INS_FDBUN,
M68K_INS_FDBUEQ,
M68K_INS_FDBUGT,
M68K_INS_FDBUGE,
M68K_INS_FDBULT,
M68K_INS_FDBULE,
M68K_INS_FDBNE,
M68K_INS_FDBT,
M68K_INS_FDBSF,
M68K_INS_FDBSEQ,
M68K_INS_FDBGT,
M68K_INS_FDBGE,
M68K_INS_FDBLT,
M68K_INS_FDBLE,
M68K_INS_FDBGL,
M68K_INS_FDBGLE,
M68K_INS_FDBNGLE,
M68K_INS_FDBNGL,
M68K_INS_FDBNLE,
M68K_INS_FDBNLT,
M68K_INS_FDBNGE,
M68K_INS_FDBNGT,
M68K_INS_FDBSNE,
M68K_INS_FDBST,
M68K_INS_FDIV,
M68K_INS_FSDIV,
M68K_INS_FDDIV,
M68K_INS_FETOX,
M68K_INS_FETOXM1,
M68K_INS_FGETEXP,
M68K_INS_FGETMAN,
M68K_INS_FINT,
M68K_INS_FINTRZ,
M68K_INS_FLOG10,
M68K_INS_FLOG2,
M68K_INS_FLOGN,
M68K_INS_FLOGNP1,
M68K_INS_FMOD,
M68K_INS_FMOVE,
M68K_INS_FSMOVE,
M68K_INS_FDMOVE,
M68K_INS_FMOVECR,
M68K_INS_FMOVEM,
M68K_INS_FMUL,
M68K_INS_FSMUL,
M68K_INS_FDMUL,
M68K_INS_FNEG,
M68K_INS_FSNEG,
M68K_INS_FDNEG,
M68K_INS_FNOP,
M68K_INS_FREM,
M68K_INS_FRESTORE,
M68K_INS_FSAVE,
M68K_INS_FSCALE,
M68K_INS_FSGLDIV,
M68K_INS_FSGLMUL,
M68K_INS_FSIN,
M68K_INS_FSINCOS,
M68K_INS_FSINH,
M68K_INS_FSQRT,
M68K_INS_FSSQRT,
M68K_INS_FDSQRT,
M68K_INS_FSF,
M68K_INS_FSBEQ,
M68K_INS_FSOGT,
M68K_INS_FSOGE,
M68K_INS_FSOLT,
M68K_INS_FSOLE,
M68K_INS_FSOGL,
M68K_INS_FSOR,
M68K_INS_FSUN,
M68K_INS_FSUEQ,
M68K_INS_FSUGT,
M68K_INS_FSUGE,
M68K_INS_FSULT,
M68K_INS_FSULE,
M68K_INS_FSNE,
M68K_INS_FST,
M68K_INS_FSSF,
M68K_INS_FSSEQ,
M68K_INS_FSGT,
M68K_INS_FSGE,
M68K_INS_FSLT,
M68K_INS_FSLE,
M68K_INS_FSGL,
M68K_INS_FSGLE,
M68K_INS_FSNGLE,
M68K_INS_FSNGL,
M68K_INS_FSNLE,
M68K_INS_FSNLT,
M68K_INS_FSNGE,
M68K_INS_FSNGT,
M68K_INS_FSSNE,
M68K_INS_FSST,
M68K_INS_FSUB,
M68K_INS_FSSUB,
M68K_INS_FDSUB,
M68K_INS_FTAN,
M68K_INS_FTANH,
M68K_INS_FTENTOX,
M68K_INS_FTRAPF,
M68K_INS_FTRAPEQ,
M68K_INS_FTRAPOGT,
M68K_INS_FTRAPOGE,
M68K_INS_FTRAPOLT,
M68K_INS_FTRAPOLE,
M68K_INS_FTRAPOGL,
M68K_INS_FTRAPOR,
M68K_INS_FTRAPUN,
M68K_INS_FTRAPUEQ,
M68K_INS_FTRAPUGT,
M68K_INS_FTRAPUGE,
M68K_INS_FTRAPULT,
M68K_INS_FTRAPULE,
M68K_INS_FTRAPNE,
M68K_INS_FTRAPT,
M68K_INS_FTRAPSF,
M68K_INS_FTRAPSEQ,
M68K_INS_FTRAPGT,
M68K_INS_FTRAPGE,
M68K_INS_FTRAPLT,
M68K_INS_FTRAPLE,
M68K_INS_FTRAPGL,
M68K_INS_FTRAPGLE,
M68K_INS_FTRAPNGLE,
M68K_INS_FTRAPNGL,
M68K_INS_FTRAPNLE,
M68K_INS_FTRAPNLT,
M68K_INS_FTRAPNGE,
M68K_INS_FTRAPNGT,
M68K_INS_FTRAPSNE,
M68K_INS_FTRAPST,
M68K_INS_FTST,
M68K_INS_FTWOTOX,
M68K_INS_HALT,
M68K_INS_ILLEGAL,
M68K_INS_JMP,
M68K_INS_JSR,
M68K_INS_LEA,
M68K_INS_LINK,
M68K_INS_LPSTOP,
M68K_INS_LSL,
M68K_INS_LSR,
M68K_INS_MOVE,
M68K_INS_MOVEA,
M68K_INS_MOVEC,
M68K_INS_MOVEM,
M68K_INS_MOVEP,
M68K_INS_MOVEQ,
M68K_INS_MOVES,
M68K_INS_MOVE16,
M68K_INS_MULS,
M68K_INS_MULU,
M68K_INS_NBCD,
M68K_INS_NEG,
M68K_INS_NEGX,
M68K_INS_NOP,
M68K_INS_NOT,
M68K_INS_OR,
M68K_INS_ORI,
M68K_INS_PACK,
M68K_INS_PEA,
M68K_INS_PFLUSH,
M68K_INS_PFLUSHA,
M68K_INS_PFLUSHAN,
M68K_INS_PFLUSHN,
M68K_INS_PLOADR,
M68K_INS_PLOADW,
M68K_INS_PLPAR,
M68K_INS_PLPAW,
M68K_INS_PMOVE,
M68K_INS_PMOVEFD,
M68K_INS_PTESTR,
M68K_INS_PTESTW,
M68K_INS_PULSE,
M68K_INS_REMS,
M68K_INS_REMU,
M68K_INS_RESET,
M68K_INS_ROL,
M68K_INS_ROR,
M68K_INS_ROXL,
M68K_INS_ROXR,
M68K_INS_RTD,
M68K_INS_RTE,
M68K_INS_RTM,
M68K_INS_RTR,
M68K_INS_RTS,
M68K_INS_SBCD,
M68K_INS_ST,
M68K_INS_SF,
M68K_INS_SHI,
M68K_INS_SLS,
M68K_INS_SCC,
M68K_INS_SHS,
M68K_INS_SCS,
M68K_INS_SLO,
M68K_INS_SNE,
M68K_INS_SEQ,
M68K_INS_SVC,
M68K_INS_SVS,
M68K_INS_SPL,
M68K_INS_SMI,
M68K_INS_SGE,
M68K_INS_SLT,
M68K_INS_SGT,
M68K_INS_SLE,
M68K_INS_STOP,
M68K_INS_SUB,
M68K_INS_SUBA,
M68K_INS_SUBI,
M68K_INS_SUBQ,
M68K_INS_SUBX,
M68K_INS_SWAP,
M68K_INS_TAS,
M68K_INS_TRAP,
M68K_INS_TRAPV,
M68K_INS_TRAPT,
M68K_INS_TRAPF,
M68K_INS_TRAPHI,
M68K_INS_TRAPLS,
M68K_INS_TRAPCC,
M68K_INS_TRAPHS,
M68K_INS_TRAPCS,
M68K_INS_TRAPLO,
M68K_INS_TRAPNE,
M68K_INS_TRAPEQ,
M68K_INS_TRAPVC,
M68K_INS_TRAPVS,
M68K_INS_TRAPPL,
M68K_INS_TRAPMI,
M68K_INS_TRAPGE,
M68K_INS_TRAPLT,
M68K_INS_TRAPGT,
M68K_INS_TRAPLE,
M68K_INS_TST,
M68K_INS_UNLK,
M68K_INS_UNPK,
M68K_INS_ENDING, // <-- mark the end of the list of instructions
} m68k_insn;
//> Group of M68K instructions
typedef enum m68k_group_type
{
M68K_GRP_INVALID = 0, // CS_GRUP_INVALID
M68K_GRP_JUMP, // = CS_GRP_JUMP
M68K_GRP_RET = 3, // = CS_GRP_RET
M68K_GRP_IRET = 5, // = CS_GRP_IRET
M68K_GRP_ENDING,// <-- mark the end of the list of groups
} m68k_group_type;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/mips.h
+962
View File
@@ -0,0 +1,962 @@
#ifndef CAPSTONE_MIPS_H
#define CAPSTONE_MIPS_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2013-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
// GCC MIPS toolchain has a default macro called "mips" which breaks
// compilation
#undef mips
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
//> Operand type for instruction's operands
typedef enum mips_op_type
{
MIPS_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
MIPS_OP_REG, // = CS_OP_REG (Register operand).
MIPS_OP_IMM, // = CS_OP_IMM (Immediate operand).
MIPS_OP_MEM, // = CS_OP_MEM (Memory operand).
} mips_op_type;
//> MIPS registers
typedef enum mips_reg
{
MIPS_REG_INVALID = 0,
//> General purpose registers
MIPS_REG_PC,
MIPS_REG_0,
MIPS_REG_1,
MIPS_REG_2,
MIPS_REG_3,
MIPS_REG_4,
MIPS_REG_5,
MIPS_REG_6,
MIPS_REG_7,
MIPS_REG_8,
MIPS_REG_9,
MIPS_REG_10,
MIPS_REG_11,
MIPS_REG_12,
MIPS_REG_13,
MIPS_REG_14,
MIPS_REG_15,
MIPS_REG_16,
MIPS_REG_17,
MIPS_REG_18,
MIPS_REG_19,
MIPS_REG_20,
MIPS_REG_21,
MIPS_REG_22,
MIPS_REG_23,
MIPS_REG_24,
MIPS_REG_25,
MIPS_REG_26,
MIPS_REG_27,
MIPS_REG_28,
MIPS_REG_29,
MIPS_REG_30,
MIPS_REG_31,
//> DSP registers
MIPS_REG_DSPCCOND,
MIPS_REG_DSPCARRY,
MIPS_REG_DSPEFI,
MIPS_REG_DSPOUTFLAG,
MIPS_REG_DSPOUTFLAG16_19,
MIPS_REG_DSPOUTFLAG20,
MIPS_REG_DSPOUTFLAG21,
MIPS_REG_DSPOUTFLAG22,
MIPS_REG_DSPOUTFLAG23,
MIPS_REG_DSPPOS,
MIPS_REG_DSPSCOUNT,
//> ACC registers
MIPS_REG_AC0,
MIPS_REG_AC1,
MIPS_REG_AC2,
MIPS_REG_AC3,
//> COP registers
MIPS_REG_CC0,
MIPS_REG_CC1,
MIPS_REG_CC2,
MIPS_REG_CC3,
MIPS_REG_CC4,
MIPS_REG_CC5,
MIPS_REG_CC6,
MIPS_REG_CC7,
//> FPU registers
MIPS_REG_F0,
MIPS_REG_F1,
MIPS_REG_F2,
MIPS_REG_F3,
MIPS_REG_F4,
MIPS_REG_F5,
MIPS_REG_F6,
MIPS_REG_F7,
MIPS_REG_F8,
MIPS_REG_F9,
MIPS_REG_F10,
MIPS_REG_F11,
MIPS_REG_F12,
MIPS_REG_F13,
MIPS_REG_F14,
MIPS_REG_F15,
MIPS_REG_F16,
MIPS_REG_F17,
MIPS_REG_F18,
MIPS_REG_F19,
MIPS_REG_F20,
MIPS_REG_F21,
MIPS_REG_F22,
MIPS_REG_F23,
MIPS_REG_F24,
MIPS_REG_F25,
MIPS_REG_F26,
MIPS_REG_F27,
MIPS_REG_F28,
MIPS_REG_F29,
MIPS_REG_F30,
MIPS_REG_F31,
MIPS_REG_FCC0,
MIPS_REG_FCC1,
MIPS_REG_FCC2,
MIPS_REG_FCC3,
MIPS_REG_FCC4,
MIPS_REG_FCC5,
MIPS_REG_FCC6,
MIPS_REG_FCC7,
//> AFPR128
MIPS_REG_W0,
MIPS_REG_W1,
MIPS_REG_W2,
MIPS_REG_W3,
MIPS_REG_W4,
MIPS_REG_W5,
MIPS_REG_W6,
MIPS_REG_W7,
MIPS_REG_W8,
MIPS_REG_W9,
MIPS_REG_W10,
MIPS_REG_W11,
MIPS_REG_W12,
MIPS_REG_W13,
MIPS_REG_W14,
MIPS_REG_W15,
MIPS_REG_W16,
MIPS_REG_W17,
MIPS_REG_W18,
MIPS_REG_W19,
MIPS_REG_W20,
MIPS_REG_W21,
MIPS_REG_W22,
MIPS_REG_W23,
MIPS_REG_W24,
MIPS_REG_W25,
MIPS_REG_W26,
MIPS_REG_W27,
MIPS_REG_W28,
MIPS_REG_W29,
MIPS_REG_W30,
MIPS_REG_W31,
MIPS_REG_HI,
MIPS_REG_LO,
MIPS_REG_P0,
MIPS_REG_P1,
MIPS_REG_P2,
MIPS_REG_MPL0,
MIPS_REG_MPL1,
MIPS_REG_MPL2,
MIPS_REG_ENDING, // <-- mark the end of the list or registers
// alias registers
MIPS_REG_ZERO = MIPS_REG_0,
MIPS_REG_AT = MIPS_REG_1,
MIPS_REG_V0 = MIPS_REG_2,
MIPS_REG_V1 = MIPS_REG_3,
MIPS_REG_A0 = MIPS_REG_4,
MIPS_REG_A1 = MIPS_REG_5,
MIPS_REG_A2 = MIPS_REG_6,
MIPS_REG_A3 = MIPS_REG_7,
MIPS_REG_T0 = MIPS_REG_8,
MIPS_REG_T1 = MIPS_REG_9,
MIPS_REG_T2 = MIPS_REG_10,
MIPS_REG_T3 = MIPS_REG_11,
MIPS_REG_T4 = MIPS_REG_12,
MIPS_REG_T5 = MIPS_REG_13,
MIPS_REG_T6 = MIPS_REG_14,
MIPS_REG_T7 = MIPS_REG_15,
MIPS_REG_S0 = MIPS_REG_16,
MIPS_REG_S1 = MIPS_REG_17,
MIPS_REG_S2 = MIPS_REG_18,
MIPS_REG_S3 = MIPS_REG_19,
MIPS_REG_S4 = MIPS_REG_20,
MIPS_REG_S5 = MIPS_REG_21,
MIPS_REG_S6 = MIPS_REG_22,
MIPS_REG_S7 = MIPS_REG_23,
MIPS_REG_T8 = MIPS_REG_24,
MIPS_REG_T9 = MIPS_REG_25,
MIPS_REG_K0 = MIPS_REG_26,
MIPS_REG_K1 = MIPS_REG_27,
MIPS_REG_GP = MIPS_REG_28,
MIPS_REG_SP = MIPS_REG_29,
MIPS_REG_FP = MIPS_REG_30, MIPS_REG_S8 = MIPS_REG_30,
MIPS_REG_RA = MIPS_REG_31,
MIPS_REG_HI0 = MIPS_REG_AC0,
MIPS_REG_HI1 = MIPS_REG_AC1,
MIPS_REG_HI2 = MIPS_REG_AC2,
MIPS_REG_HI3 = MIPS_REG_AC3,
MIPS_REG_LO0 = MIPS_REG_HI0,
MIPS_REG_LO1 = MIPS_REG_HI1,
MIPS_REG_LO2 = MIPS_REG_HI2,
MIPS_REG_LO3 = MIPS_REG_HI3,
} mips_reg;
// Instruction's operand referring to memory
// This is associated with MIPS_OP_MEM operand type above
typedef struct mips_op_mem
{
mips_reg base; // base register
int64_t disp; // displacement/offset value
} mips_op_mem;
// Instruction operand
typedef struct cs_mips_op
{
mips_op_type type; // operand type
union
{
mips_reg reg; // register value for REG operand
int64_t imm; // immediate value for IMM operand
mips_op_mem mem; // base/index/scale/disp value for MEM operand
};
} cs_mips_op;
// Instruction structure
typedef struct cs_mips
{
// Number of operands of this instruction,
// or 0 when instruction has no operand.
uint8_t op_count;
cs_mips_op operands[8]; // operands for this instruction.
} cs_mips;
//> MIPS instruction
typedef enum mips_insn
{
MIPS_INS_INVALID = 0,
MIPS_INS_ABSQ_S,
MIPS_INS_ADD,
MIPS_INS_ADDIUPC,
MIPS_INS_ADDIUR1SP,
MIPS_INS_ADDIUR2,
MIPS_INS_ADDIUS5,
MIPS_INS_ADDIUSP,
MIPS_INS_ADDQH,
MIPS_INS_ADDQH_R,
MIPS_INS_ADDQ,
MIPS_INS_ADDQ_S,
MIPS_INS_ADDSC,
MIPS_INS_ADDS_A,
MIPS_INS_ADDS_S,
MIPS_INS_ADDS_U,
MIPS_INS_ADDU16,
MIPS_INS_ADDUH,
MIPS_INS_ADDUH_R,
MIPS_INS_ADDU,
MIPS_INS_ADDU_S,
MIPS_INS_ADDVI,
MIPS_INS_ADDV,
MIPS_INS_ADDWC,
MIPS_INS_ADD_A,
MIPS_INS_ADDI,
MIPS_INS_ADDIU,
MIPS_INS_ALIGN,
MIPS_INS_ALUIPC,
MIPS_INS_AND,
MIPS_INS_AND16,
MIPS_INS_ANDI16,
MIPS_INS_ANDI,
MIPS_INS_APPEND,
MIPS_INS_ASUB_S,
MIPS_INS_ASUB_U,
MIPS_INS_AUI,
MIPS_INS_AUIPC,
MIPS_INS_AVER_S,
MIPS_INS_AVER_U,
MIPS_INS_AVE_S,
MIPS_INS_AVE_U,
MIPS_INS_B16,
MIPS_INS_BADDU,
MIPS_INS_BAL,
MIPS_INS_BALC,
MIPS_INS_BALIGN,
MIPS_INS_BBIT0,
MIPS_INS_BBIT032,
MIPS_INS_BBIT1,
MIPS_INS_BBIT132,
MIPS_INS_BC,
MIPS_INS_BC0F,
MIPS_INS_BC0FL,
MIPS_INS_BC0T,
MIPS_INS_BC0TL,
MIPS_INS_BC1EQZ,
MIPS_INS_BC1F,
MIPS_INS_BC1FL,
MIPS_INS_BC1NEZ,
MIPS_INS_BC1T,
MIPS_INS_BC1TL,
MIPS_INS_BC2EQZ,
MIPS_INS_BC2F,
MIPS_INS_BC2FL,
MIPS_INS_BC2NEZ,
MIPS_INS_BC2T,
MIPS_INS_BC2TL,
MIPS_INS_BC3F,
MIPS_INS_BC3FL,
MIPS_INS_BC3T,
MIPS_INS_BC3TL,
MIPS_INS_BCLRI,
MIPS_INS_BCLR,
MIPS_INS_BEQ,
MIPS_INS_BEQC,
MIPS_INS_BEQL,
MIPS_INS_BEQZ16,
MIPS_INS_BEQZALC,
MIPS_INS_BEQZC,
MIPS_INS_BGEC,
MIPS_INS_BGEUC,
MIPS_INS_BGEZ,
MIPS_INS_BGEZAL,
MIPS_INS_BGEZALC,
MIPS_INS_BGEZALL,
MIPS_INS_BGEZALS,
MIPS_INS_BGEZC,
MIPS_INS_BGEZL,
MIPS_INS_BGTZ,
MIPS_INS_BGTZALC,
MIPS_INS_BGTZC,
MIPS_INS_BGTZL,
MIPS_INS_BINSLI,
MIPS_INS_BINSL,
MIPS_INS_BINSRI,
MIPS_INS_BINSR,
MIPS_INS_BITREV,
MIPS_INS_BITSWAP,
MIPS_INS_BLEZ,
MIPS_INS_BLEZALC,
MIPS_INS_BLEZC,
MIPS_INS_BLEZL,
MIPS_INS_BLTC,
MIPS_INS_BLTUC,
MIPS_INS_BLTZ,
MIPS_INS_BLTZAL,
MIPS_INS_BLTZALC,
MIPS_INS_BLTZALL,
MIPS_INS_BLTZALS,
MIPS_INS_BLTZC,
MIPS_INS_BLTZL,
MIPS_INS_BMNZI,
MIPS_INS_BMNZ,
MIPS_INS_BMZI,
MIPS_INS_BMZ,
MIPS_INS_BNE,
MIPS_INS_BNEC,
MIPS_INS_BNEGI,
MIPS_INS_BNEG,
MIPS_INS_BNEL,
MIPS_INS_BNEZ16,
MIPS_INS_BNEZALC,
MIPS_INS_BNEZC,
MIPS_INS_BNVC,
MIPS_INS_BNZ,
MIPS_INS_BOVC,
MIPS_INS_BPOSGE32,
MIPS_INS_BREAK,
MIPS_INS_BREAK16,
MIPS_INS_BSELI,
MIPS_INS_BSEL,
MIPS_INS_BSETI,
MIPS_INS_BSET,
MIPS_INS_BZ,
MIPS_INS_BEQZ,
MIPS_INS_B,
MIPS_INS_BNEZ,
MIPS_INS_BTEQZ,
MIPS_INS_BTNEZ,
MIPS_INS_CACHE,
MIPS_INS_CEIL,
MIPS_INS_CEQI,
MIPS_INS_CEQ,
MIPS_INS_CFC1,
MIPS_INS_CFCMSA,
MIPS_INS_CINS,
MIPS_INS_CINS32,
MIPS_INS_CLASS,
MIPS_INS_CLEI_S,
MIPS_INS_CLEI_U,
MIPS_INS_CLE_S,
MIPS_INS_CLE_U,
MIPS_INS_CLO,
MIPS_INS_CLTI_S,
MIPS_INS_CLTI_U,
MIPS_INS_CLT_S,
MIPS_INS_CLT_U,
MIPS_INS_CLZ,
MIPS_INS_CMPGDU,
MIPS_INS_CMPGU,
MIPS_INS_CMPU,
MIPS_INS_CMP,
MIPS_INS_COPY_S,
MIPS_INS_COPY_U,
MIPS_INS_CTC1,
MIPS_INS_CTCMSA,
MIPS_INS_CVT,
MIPS_INS_C,
MIPS_INS_CMPI,
MIPS_INS_DADD,
MIPS_INS_DADDI,
MIPS_INS_DADDIU,
MIPS_INS_DADDU,
MIPS_INS_DAHI,
MIPS_INS_DALIGN,
MIPS_INS_DATI,
MIPS_INS_DAUI,
MIPS_INS_DBITSWAP,
MIPS_INS_DCLO,
MIPS_INS_DCLZ,
MIPS_INS_DDIV,
MIPS_INS_DDIVU,
MIPS_INS_DERET,
MIPS_INS_DEXT,
MIPS_INS_DEXTM,
MIPS_INS_DEXTU,
MIPS_INS_DI,
MIPS_INS_DINS,
MIPS_INS_DINSM,
MIPS_INS_DINSU,
MIPS_INS_DIV,
MIPS_INS_DIVU,
MIPS_INS_DIV_S,
MIPS_INS_DIV_U,
MIPS_INS_DLSA,
MIPS_INS_DMFC0,
MIPS_INS_DMFC1,
MIPS_INS_DMFC2,
MIPS_INS_DMOD,
MIPS_INS_DMODU,
MIPS_INS_DMTC0,
MIPS_INS_DMTC1,
MIPS_INS_DMTC2,
MIPS_INS_DMUH,
MIPS_INS_DMUHU,
MIPS_INS_DMUL,
MIPS_INS_DMULT,
MIPS_INS_DMULTU,
MIPS_INS_DMULU,
MIPS_INS_DOTP_S,
MIPS_INS_DOTP_U,
MIPS_INS_DPADD_S,
MIPS_INS_DPADD_U,
MIPS_INS_DPAQX_SA,
MIPS_INS_DPAQX_S,
MIPS_INS_DPAQ_SA,
MIPS_INS_DPAQ_S,
MIPS_INS_DPAU,
MIPS_INS_DPAX,
MIPS_INS_DPA,
MIPS_INS_DPOP,
MIPS_INS_DPSQX_SA,
MIPS_INS_DPSQX_S,
MIPS_INS_DPSQ_SA,
MIPS_INS_DPSQ_S,
MIPS_INS_DPSUB_S,
MIPS_INS_DPSUB_U,
MIPS_INS_DPSU,
MIPS_INS_DPSX,
MIPS_INS_DPS,
MIPS_INS_DROTR,
MIPS_INS_DROTR32,
MIPS_INS_DROTRV,
MIPS_INS_DSBH,
MIPS_INS_DSHD,
MIPS_INS_DSLL,
MIPS_INS_DSLL32,
MIPS_INS_DSLLV,
MIPS_INS_DSRA,
MIPS_INS_DSRA32,
MIPS_INS_DSRAV,
MIPS_INS_DSRL,
MIPS_INS_DSRL32,
MIPS_INS_DSRLV,
MIPS_INS_DSUB,
MIPS_INS_DSUBU,
MIPS_INS_EHB,
MIPS_INS_EI,
MIPS_INS_ERET,
MIPS_INS_EXT,
MIPS_INS_EXTP,
MIPS_INS_EXTPDP,
MIPS_INS_EXTPDPV,
MIPS_INS_EXTPV,
MIPS_INS_EXTRV_RS,
MIPS_INS_EXTRV_R,
MIPS_INS_EXTRV_S,
MIPS_INS_EXTRV,
MIPS_INS_EXTR_RS,
MIPS_INS_EXTR_R,
MIPS_INS_EXTR_S,
MIPS_INS_EXTR,
MIPS_INS_EXTS,
MIPS_INS_EXTS32,
MIPS_INS_ABS,
MIPS_INS_FADD,
MIPS_INS_FCAF,
MIPS_INS_FCEQ,
MIPS_INS_FCLASS,
MIPS_INS_FCLE,
MIPS_INS_FCLT,
MIPS_INS_FCNE,
MIPS_INS_FCOR,
MIPS_INS_FCUEQ,
MIPS_INS_FCULE,
MIPS_INS_FCULT,
MIPS_INS_FCUNE,
MIPS_INS_FCUN,
MIPS_INS_FDIV,
MIPS_INS_FEXDO,
MIPS_INS_FEXP2,
MIPS_INS_FEXUPL,
MIPS_INS_FEXUPR,
MIPS_INS_FFINT_S,
MIPS_INS_FFINT_U,
MIPS_INS_FFQL,
MIPS_INS_FFQR,
MIPS_INS_FILL,
MIPS_INS_FLOG2,
MIPS_INS_FLOOR,
MIPS_INS_FMADD,
MIPS_INS_FMAX_A,
MIPS_INS_FMAX,
MIPS_INS_FMIN_A,
MIPS_INS_FMIN,
MIPS_INS_MOV,
MIPS_INS_FMSUB,
MIPS_INS_FMUL,
MIPS_INS_MUL,
MIPS_INS_NEG,
MIPS_INS_FRCP,
MIPS_INS_FRINT,
MIPS_INS_FRSQRT,
MIPS_INS_FSAF,
MIPS_INS_FSEQ,
MIPS_INS_FSLE,
MIPS_INS_FSLT,
MIPS_INS_FSNE,
MIPS_INS_FSOR,
MIPS_INS_FSQRT,
MIPS_INS_SQRT,
MIPS_INS_FSUB,
MIPS_INS_SUB,
MIPS_INS_FSUEQ,
MIPS_INS_FSULE,
MIPS_INS_FSULT,
MIPS_INS_FSUNE,
MIPS_INS_FSUN,
MIPS_INS_FTINT_S,
MIPS_INS_FTINT_U,
MIPS_INS_FTQ,
MIPS_INS_FTRUNC_S,
MIPS_INS_FTRUNC_U,
MIPS_INS_HADD_S,
MIPS_INS_HADD_U,
MIPS_INS_HSUB_S,
MIPS_INS_HSUB_U,
MIPS_INS_ILVEV,
MIPS_INS_ILVL,
MIPS_INS_ILVOD,
MIPS_INS_ILVR,
MIPS_INS_INS,
MIPS_INS_INSERT,
MIPS_INS_INSV,
MIPS_INS_INSVE,
MIPS_INS_J,
MIPS_INS_JAL,
MIPS_INS_JALR,
MIPS_INS_JALRS16,
MIPS_INS_JALRS,
MIPS_INS_JALS,
MIPS_INS_JALX,
MIPS_INS_JIALC,
MIPS_INS_JIC,
MIPS_INS_JR,
MIPS_INS_JR16,
MIPS_INS_JRADDIUSP,
MIPS_INS_JRC,
MIPS_INS_JALRC,
MIPS_INS_LB,
MIPS_INS_LBU16,
MIPS_INS_LBUX,
MIPS_INS_LBU,
MIPS_INS_LD,
MIPS_INS_LDC1,
MIPS_INS_LDC2,
MIPS_INS_LDC3,
MIPS_INS_LDI,
MIPS_INS_LDL,
MIPS_INS_LDPC,
MIPS_INS_LDR,
MIPS_INS_LDXC1,
MIPS_INS_LH,
MIPS_INS_LHU16,
MIPS_INS_LHX,
MIPS_INS_LHU,
MIPS_INS_LI16,
MIPS_INS_LL,
MIPS_INS_LLD,
MIPS_INS_LSA,
MIPS_INS_LUXC1,
MIPS_INS_LUI,
MIPS_INS_LW,
MIPS_INS_LW16,
MIPS_INS_LWC1,
MIPS_INS_LWC2,
MIPS_INS_LWC3,
MIPS_INS_LWL,
MIPS_INS_LWM16,
MIPS_INS_LWM32,
MIPS_INS_LWPC,
MIPS_INS_LWP,
MIPS_INS_LWR,
MIPS_INS_LWUPC,
MIPS_INS_LWU,
MIPS_INS_LWX,
MIPS_INS_LWXC1,
MIPS_INS_LWXS,
MIPS_INS_LI,
MIPS_INS_MADD,
MIPS_INS_MADDF,
MIPS_INS_MADDR_Q,
MIPS_INS_MADDU,
MIPS_INS_MADDV,
MIPS_INS_MADD_Q,
MIPS_INS_MAQ_SA,
MIPS_INS_MAQ_S,
MIPS_INS_MAXA,
MIPS_INS_MAXI_S,
MIPS_INS_MAXI_U,
MIPS_INS_MAX_A,
MIPS_INS_MAX,
MIPS_INS_MAX_S,
MIPS_INS_MAX_U,
MIPS_INS_MFC0,
MIPS_INS_MFC1,
MIPS_INS_MFC2,
MIPS_INS_MFHC1,
MIPS_INS_MFHI,
MIPS_INS_MFLO,
MIPS_INS_MINA,
MIPS_INS_MINI_S,
MIPS_INS_MINI_U,
MIPS_INS_MIN_A,
MIPS_INS_MIN,
MIPS_INS_MIN_S,
MIPS_INS_MIN_U,
MIPS_INS_MOD,
MIPS_INS_MODSUB,
MIPS_INS_MODU,
MIPS_INS_MOD_S,
MIPS_INS_MOD_U,
MIPS_INS_MOVE,
MIPS_INS_MOVEP,
MIPS_INS_MOVF,
MIPS_INS_MOVN,
MIPS_INS_MOVT,
MIPS_INS_MOVZ,
MIPS_INS_MSUB,
MIPS_INS_MSUBF,
MIPS_INS_MSUBR_Q,
MIPS_INS_MSUBU,
MIPS_INS_MSUBV,
MIPS_INS_MSUB_Q,
MIPS_INS_MTC0,
MIPS_INS_MTC1,
MIPS_INS_MTC2,
MIPS_INS_MTHC1,
MIPS_INS_MTHI,
MIPS_INS_MTHLIP,
MIPS_INS_MTLO,
MIPS_INS_MTM0,
MIPS_INS_MTM1,
MIPS_INS_MTM2,
MIPS_INS_MTP0,
MIPS_INS_MTP1,
MIPS_INS_MTP2,
MIPS_INS_MUH,
MIPS_INS_MUHU,
MIPS_INS_MULEQ_S,
MIPS_INS_MULEU_S,
MIPS_INS_MULQ_RS,
MIPS_INS_MULQ_S,
MIPS_INS_MULR_Q,
MIPS_INS_MULSAQ_S,
MIPS_INS_MULSA,
MIPS_INS_MULT,
MIPS_INS_MULTU,
MIPS_INS_MULU,
MIPS_INS_MULV,
MIPS_INS_MUL_Q,
MIPS_INS_MUL_S,
MIPS_INS_NLOC,
MIPS_INS_NLZC,
MIPS_INS_NMADD,
MIPS_INS_NMSUB,
MIPS_INS_NOR,
MIPS_INS_NORI,
MIPS_INS_NOT16,
MIPS_INS_NOT,
MIPS_INS_OR,
MIPS_INS_OR16,
MIPS_INS_ORI,
MIPS_INS_PACKRL,
MIPS_INS_PAUSE,
MIPS_INS_PCKEV,
MIPS_INS_PCKOD,
MIPS_INS_PCNT,
MIPS_INS_PICK,
MIPS_INS_POP,
MIPS_INS_PRECEQU,
MIPS_INS_PRECEQ,
MIPS_INS_PRECEU,
MIPS_INS_PRECRQU_S,
MIPS_INS_PRECRQ,
MIPS_INS_PRECRQ_RS,
MIPS_INS_PRECR,
MIPS_INS_PRECR_SRA,
MIPS_INS_PRECR_SRA_R,
MIPS_INS_PREF,
MIPS_INS_PREPEND,
MIPS_INS_RADDU,
MIPS_INS_RDDSP,
MIPS_INS_RDHWR,
MIPS_INS_REPLV,
MIPS_INS_REPL,
MIPS_INS_RINT,
MIPS_INS_ROTR,
MIPS_INS_ROTRV,
MIPS_INS_ROUND,
MIPS_INS_SAT_S,
MIPS_INS_SAT_U,
MIPS_INS_SB,
MIPS_INS_SB16,
MIPS_INS_SC,
MIPS_INS_SCD,
MIPS_INS_SD,
MIPS_INS_SDBBP,
MIPS_INS_SDBBP16,
MIPS_INS_SDC1,
MIPS_INS_SDC2,
MIPS_INS_SDC3,
MIPS_INS_SDL,
MIPS_INS_SDR,
MIPS_INS_SDXC1,
MIPS_INS_SEB,
MIPS_INS_SEH,
MIPS_INS_SELEQZ,
MIPS_INS_SELNEZ,
MIPS_INS_SEL,
MIPS_INS_SEQ,
MIPS_INS_SEQI,
MIPS_INS_SH,
MIPS_INS_SH16,
MIPS_INS_SHF,
MIPS_INS_SHILO,
MIPS_INS_SHILOV,
MIPS_INS_SHLLV,
MIPS_INS_SHLLV_S,
MIPS_INS_SHLL,
MIPS_INS_SHLL_S,
MIPS_INS_SHRAV,
MIPS_INS_SHRAV_R,
MIPS_INS_SHRA,
MIPS_INS_SHRA_R,
MIPS_INS_SHRLV,
MIPS_INS_SHRL,
MIPS_INS_SLDI,
MIPS_INS_SLD,
MIPS_INS_SLL,
MIPS_INS_SLL16,
MIPS_INS_SLLI,
MIPS_INS_SLLV,
MIPS_INS_SLT,
MIPS_INS_SLTI,
MIPS_INS_SLTIU,
MIPS_INS_SLTU,
MIPS_INS_SNE,
MIPS_INS_SNEI,
MIPS_INS_SPLATI,
MIPS_INS_SPLAT,
MIPS_INS_SRA,
MIPS_INS_SRAI,
MIPS_INS_SRARI,
MIPS_INS_SRAR,
MIPS_INS_SRAV,
MIPS_INS_SRL,
MIPS_INS_SRL16,
MIPS_INS_SRLI,
MIPS_INS_SRLRI,
MIPS_INS_SRLR,
MIPS_INS_SRLV,
MIPS_INS_SSNOP,
MIPS_INS_ST,
MIPS_INS_SUBQH,
MIPS_INS_SUBQH_R,
MIPS_INS_SUBQ,
MIPS_INS_SUBQ_S,
MIPS_INS_SUBSUS_U,
MIPS_INS_SUBSUU_S,
MIPS_INS_SUBS_S,
MIPS_INS_SUBS_U,
MIPS_INS_SUBU16,
MIPS_INS_SUBUH,
MIPS_INS_SUBUH_R,
MIPS_INS_SUBU,
MIPS_INS_SUBU_S,
MIPS_INS_SUBVI,
MIPS_INS_SUBV,
MIPS_INS_SUXC1,
MIPS_INS_SW,
MIPS_INS_SW16,
MIPS_INS_SWC1,
MIPS_INS_SWC2,
MIPS_INS_SWC3,
MIPS_INS_SWL,
MIPS_INS_SWM16,
MIPS_INS_SWM32,
MIPS_INS_SWP,
MIPS_INS_SWR,
MIPS_INS_SWXC1,
MIPS_INS_SYNC,
MIPS_INS_SYNCI,
MIPS_INS_SYSCALL,
MIPS_INS_TEQ,
MIPS_INS_TEQI,
MIPS_INS_TGE,
MIPS_INS_TGEI,
MIPS_INS_TGEIU,
MIPS_INS_TGEU,
MIPS_INS_TLBP,
MIPS_INS_TLBR,
MIPS_INS_TLBWI,
MIPS_INS_TLBWR,
MIPS_INS_TLT,
MIPS_INS_TLTI,
MIPS_INS_TLTIU,
MIPS_INS_TLTU,
MIPS_INS_TNE,
MIPS_INS_TNEI,
MIPS_INS_TRUNC,
MIPS_INS_V3MULU,
MIPS_INS_VMM0,
MIPS_INS_VMULU,
MIPS_INS_VSHF,
MIPS_INS_WAIT,
MIPS_INS_WRDSP,
MIPS_INS_WSBH,
MIPS_INS_XOR,
MIPS_INS_XOR16,
MIPS_INS_XORI,
//> some alias instructions
MIPS_INS_NOP,
MIPS_INS_NEGU,
//> special instructions
MIPS_INS_JALR_HB, // jump and link with Hazard Barrier
MIPS_INS_JR_HB, // jump register with Hazard Barrier
MIPS_INS_ENDING,
} mips_insn;
//> Group of MIPS instructions
typedef enum mips_insn_group
{
MIPS_GRP_INVALID = 0, // = CS_GRP_INVALID
//> Generic groups
// all jump instructions (conditional+direct+indirect jumps)
MIPS_GRP_JUMP, // = CS_GRP_JUMP
// all call instructions
MIPS_GRP_CALL, // = CS_GRP_CALL
// all return instructions
MIPS_GRP_RET, // = CS_GRP_RET
// all interrupt instructions (int+syscall)
MIPS_GRP_INT, // = CS_GRP_INT
// all interrupt return instructions
MIPS_GRP_IRET, // = CS_GRP_IRET
// all privileged instructions
MIPS_GRP_PRIVILEGE, // = CS_GRP_PRIVILEGE
//> Architecture-specific groups
MIPS_GRP_BITCOUNT = 128,
MIPS_GRP_DSP,
MIPS_GRP_DSPR2,
MIPS_GRP_FPIDX,
MIPS_GRP_MSA,
MIPS_GRP_MIPS32R2,
MIPS_GRP_MIPS64,
MIPS_GRP_MIPS64R2,
MIPS_GRP_SEINREG,
MIPS_GRP_STDENC,
MIPS_GRP_SWAP,
MIPS_GRP_MICROMIPS,
MIPS_GRP_MIPS16MODE,
MIPS_GRP_FP64BIT,
MIPS_GRP_NONANSFPMATH,
MIPS_GRP_NOTFP64BIT,
MIPS_GRP_NOTINMICROMIPS,
MIPS_GRP_NOTNACL,
MIPS_GRP_NOTMIPS32R6,
MIPS_GRP_NOTMIPS64R6,
MIPS_GRP_CNMIPS,
MIPS_GRP_MIPS32,
MIPS_GRP_MIPS32R6,
MIPS_GRP_MIPS64R6,
MIPS_GRP_MIPS2,
MIPS_GRP_MIPS3,
MIPS_GRP_MIPS3_32,
MIPS_GRP_MIPS3_32R2,
MIPS_GRP_MIPS4_32,
MIPS_GRP_MIPS4_32R2,
MIPS_GRP_MIPS5_32R2,
MIPS_GRP_GP32BIT,
MIPS_GRP_GP64BIT,
MIPS_GRP_ENDING,
} mips_insn_group;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/platform.h
+110
View File
@@ -0,0 +1,110 @@
/* Capstone Disassembly Engine */
/* By Axel Souchet & Nguyen Anh Quynh, 2014 */
#ifndef CAPSTONE_PLATFORM_H
#define CAPSTONE_PLATFORM_H
// handle C99 issue (for pre-2013 VisualStudio)
#if !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
// MSVC
// stdbool.h
#if (_MSC_VER < 1800) || defined(_KERNEL_MODE)
// this system does not have stdbool.h
#ifndef __cplusplus
typedef unsigned char bool;
#define false 0
#define true 1
#endif // __cplusplus
#else
// VisualStudio 2013+ -> C99 is supported
#include <stdbool.h>
#endif // (_MSC_VER < 1800) || defined(_KERNEL_MODE)
#else
// not MSVC -> C99 is supported
#include <stdbool.h>
#endif // !defined(__CYGWIN__) && !defined(__MINGW32__) && !defined(__MINGW64__) && (defined (WIN32) || defined (WIN64) || defined (_WIN32) || defined (_WIN64))
// handle inttypes.h / stdint.h compatibility
#if defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
#include "windowsce/stdint.h"
#endif // defined(_WIN32_WCE) && (_WIN32_WCE < 0x800)
#if defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
// this system does not have inttypes.h
#if defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))
// this system does not have stdint.h
typedef signed char int8_t;
typedef signed short int16_t;
typedef signed int int32_t;
typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned int uint32_t;
typedef signed long long int64_t;
typedef unsigned long long uint64_t;
#define INT8_MIN (-127i8 - 1)
#define INT16_MIN (-32767i16 - 1)
#define INT32_MIN (-2147483647i32 - 1)
#define INT64_MIN (-9223372036854775807i64 - 1)
#define INT8_MAX 127i8
#define INT16_MAX 32767i16
#define INT32_MAX 2147483647i32
#define INT64_MAX 9223372036854775807i64
#define UINT8_MAX 0xffui8
#define UINT16_MAX 0xffffui16
#define UINT32_MAX 0xffffffffui32
#define UINT64_MAX 0xffffffffffffffffui64
#endif // defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE))
#define __PRI_8_LENGTH_MODIFIER__ "hh"
#define __PRI_64_LENGTH_MODIFIER__ "ll"
#define PRId8 __PRI_8_LENGTH_MODIFIER__ "d"
#define PRIi8 __PRI_8_LENGTH_MODIFIER__ "i"
#define PRIo8 __PRI_8_LENGTH_MODIFIER__ "o"
#define PRIu8 __PRI_8_LENGTH_MODIFIER__ "u"
#define PRIx8 __PRI_8_LENGTH_MODIFIER__ "x"
#define PRIX8 __PRI_8_LENGTH_MODIFIER__ "X"
#define PRId16 "hd"
#define PRIi16 "hi"
#define PRIo16 "ho"
#define PRIu16 "hu"
#define PRIx16 "hx"
#define PRIX16 "hX"
#if defined(_MSC_VER) && _MSC_VER <= 1700
#define PRId32 "ld"
#define PRIi32 "li"
#define PRIo32 "lo"
#define PRIu32 "lu"
#define PRIx32 "lx"
#define PRIX32 "lX"
#else // OSX
#define PRId32 "d"
#define PRIi32 "i"
#define PRIo32 "o"
#define PRIu32 "u"
#define PRIx32 "x"
#define PRIX32 "X"
#endif // defined(_MSC_VER) && _MSC_VER <= 1700
#define PRId64 __PRI_64_LENGTH_MODIFIER__ "d"
#define PRIi64 __PRI_64_LENGTH_MODIFIER__ "i"
#define PRIo64 __PRI_64_LENGTH_MODIFIER__ "o"
#define PRIu64 __PRI_64_LENGTH_MODIFIER__ "u"
#define PRIx64 __PRI_64_LENGTH_MODIFIER__ "x"
#define PRIX64 __PRI_64_LENGTH_MODIFIER__ "X"
#else
// this system has inttypes.h by default
#include <inttypes.h>
#endif // defined(CAPSTONE_HAS_OSXKERNEL) || (defined(_MSC_VER) && (_MSC_VER <= 1700 || defined(_KERNEL_MODE)))
#endif
pluginsdk/capstone/ppc.h
+1474
View File
File diff suppressed because it is too large. Load diff
pluginsdk/capstone/sparc.h
+530
View File
@@ -0,0 +1,530 @@
#ifndef CAPSTONE_SPARC_H
#define CAPSTONE_SPARC_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2014-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
// GCC SPARC toolchain has a default macro called "sparc" which breaks
// compilation
#undef sparc
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
//> Enums corresponding to Sparc condition codes, both icc's and fcc's.
typedef enum sparc_cc
{
SPARC_CC_INVALID = 0, // invalid CC (default)
//> Integer condition codes
SPARC_CC_ICC_A = 8 + 256, // Always
SPARC_CC_ICC_N = 0 + 256, // Never
SPARC_CC_ICC_NE = 9 + 256, // Not Equal
SPARC_CC_ICC_E = 1 + 256, // Equal
SPARC_CC_ICC_G = 10 + 256, // Greater
SPARC_CC_ICC_LE = 2 + 256, // Less or Equal
SPARC_CC_ICC_GE = 11 + 256, // Greater or Equal
SPARC_CC_ICC_L = 3 + 256, // Less
SPARC_CC_ICC_GU = 12 + 256, // Greater Unsigned
SPARC_CC_ICC_LEU = 4 + 256, // Less or Equal Unsigned
SPARC_CC_ICC_CC = 13 + 256, // Carry Clear/Great or Equal Unsigned
SPARC_CC_ICC_CS = 5 + 256, // Carry Set/Less Unsigned
SPARC_CC_ICC_POS = 14 + 256, // Positive
SPARC_CC_ICC_NEG = 6 + 256, // Negative
SPARC_CC_ICC_VC = 15 + 256, // Overflow Clear
SPARC_CC_ICC_VS = 7 + 256, // Overflow Set
//> Floating condition codes
SPARC_CC_FCC_A = 8 + 16 + 256, // Always
SPARC_CC_FCC_N = 0 + 16 + 256, // Never
SPARC_CC_FCC_U = 7 + 16 + 256, // Unordered
SPARC_CC_FCC_G = 6 + 16 + 256, // Greater
SPARC_CC_FCC_UG = 5 + 16 + 256, // Unordered or Greater
SPARC_CC_FCC_L = 4 + 16 + 256, // Less
SPARC_CC_FCC_UL = 3 + 16 + 256, // Unordered or Less
SPARC_CC_FCC_LG = 2 + 16 + 256, // Less or Greater
SPARC_CC_FCC_NE = 1 + 16 + 256, // Not Equal
SPARC_CC_FCC_E = 9 + 16 + 256, // Equal
SPARC_CC_FCC_UE = 10 + 16 + 256, // Unordered or Equal
SPARC_CC_FCC_GE = 11 + 16 + 256, // Greater or Equal
SPARC_CC_FCC_UGE = 12 + 16 + 256, // Unordered or Greater or Equal
SPARC_CC_FCC_LE = 13 + 16 + 256, // Less or Equal
SPARC_CC_FCC_ULE = 14 + 16 + 256, // Unordered or Less or Equal
SPARC_CC_FCC_O = 15 + 16 + 256, // Ordered
} sparc_cc;
//> Branch hint
typedef enum sparc_hint
{
SPARC_HINT_INVALID = 0, // no hint
SPARC_HINT_A = 1 << 0, // annul delay slot instruction
SPARC_HINT_PT = 1 << 1, // branch taken
SPARC_HINT_PN = 1 << 2, // branch NOT taken
} sparc_hint;
//> Operand type for instruction's operands
typedef enum sparc_op_type
{
SPARC_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
SPARC_OP_REG, // = CS_OP_REG (Register operand).
SPARC_OP_IMM, // = CS_OP_IMM (Immediate operand).
SPARC_OP_MEM, // = CS_OP_MEM (Memory operand).
} sparc_op_type;
//> SPARC registers
typedef enum sparc_reg
{
SPARC_REG_INVALID = 0,
SPARC_REG_F0,
SPARC_REG_F1,
SPARC_REG_F2,
SPARC_REG_F3,
SPARC_REG_F4,
SPARC_REG_F5,
SPARC_REG_F6,
SPARC_REG_F7,
SPARC_REG_F8,
SPARC_REG_F9,
SPARC_REG_F10,
SPARC_REG_F11,
SPARC_REG_F12,
SPARC_REG_F13,
SPARC_REG_F14,
SPARC_REG_F15,
SPARC_REG_F16,
SPARC_REG_F17,
SPARC_REG_F18,
SPARC_REG_F19,
SPARC_REG_F20,
SPARC_REG_F21,
SPARC_REG_F22,
SPARC_REG_F23,
SPARC_REG_F24,
SPARC_REG_F25,
SPARC_REG_F26,
SPARC_REG_F27,
SPARC_REG_F28,
SPARC_REG_F29,
SPARC_REG_F30,
SPARC_REG_F31,
SPARC_REG_F32,
SPARC_REG_F34,
SPARC_REG_F36,
SPARC_REG_F38,
SPARC_REG_F40,
SPARC_REG_F42,
SPARC_REG_F44,
SPARC_REG_F46,
SPARC_REG_F48,
SPARC_REG_F50,
SPARC_REG_F52,
SPARC_REG_F54,
SPARC_REG_F56,
SPARC_REG_F58,
SPARC_REG_F60,
SPARC_REG_F62,
SPARC_REG_FCC0, // Floating condition codes
SPARC_REG_FCC1,
SPARC_REG_FCC2,
SPARC_REG_FCC3,
SPARC_REG_FP,
SPARC_REG_G0,
SPARC_REG_G1,
SPARC_REG_G2,
SPARC_REG_G3,
SPARC_REG_G4,
SPARC_REG_G5,
SPARC_REG_G6,
SPARC_REG_G7,
SPARC_REG_I0,
SPARC_REG_I1,
SPARC_REG_I2,
SPARC_REG_I3,
SPARC_REG_I4,
SPARC_REG_I5,
SPARC_REG_I7,
SPARC_REG_ICC, // Integer condition codes
SPARC_REG_L0,
SPARC_REG_L1,
SPARC_REG_L2,
SPARC_REG_L3,
SPARC_REG_L4,
SPARC_REG_L5,
SPARC_REG_L6,
SPARC_REG_L7,
SPARC_REG_O0,
SPARC_REG_O1,
SPARC_REG_O2,
SPARC_REG_O3,
SPARC_REG_O4,
SPARC_REG_O5,
SPARC_REG_O7,
SPARC_REG_SP,
SPARC_REG_Y,
// special register
SPARC_REG_XCC,
SPARC_REG_ENDING, // <-- mark the end of the list of registers
// extras
SPARC_REG_O6 = SPARC_REG_SP,
SPARC_REG_I6 = SPARC_REG_FP,
} sparc_reg;
// Instruction's operand referring to memory
// This is associated with SPARC_OP_MEM operand type above
typedef struct sparc_op_mem
{
uint8_t base; // base register, can be safely interpreted as
// a value of type `sparc_reg`, but it is only
// one byte wide
uint8_t index; // index register, same conditions apply here
int32_t disp; // displacement/offset value
} sparc_op_mem;
// Instruction operand
typedef struct cs_sparc_op
{
sparc_op_type type; // operand type
union
{
sparc_reg reg; // register value for REG operand
int32_t imm; // immediate value for IMM operand
sparc_op_mem mem; // base/disp value for MEM operand
};
} cs_sparc_op;
// Instruction structure
typedef struct cs_sparc
{
sparc_cc cc; // code condition for this insn
sparc_hint hint; // branch hint: encoding as bitwise OR of sparc_hint.
// Number of operands of this instruction,
// or 0 when instruction has no operand.
uint8_t op_count;
cs_sparc_op operands[4]; // operands for this instruction.
} cs_sparc;
//> SPARC instruction
typedef enum sparc_insn
{
SPARC_INS_INVALID = 0,
SPARC_INS_ADDCC,
SPARC_INS_ADDX,
SPARC_INS_ADDXCC,
SPARC_INS_ADDXC,
SPARC_INS_ADDXCCC,
SPARC_INS_ADD,
SPARC_INS_ALIGNADDR,
SPARC_INS_ALIGNADDRL,
SPARC_INS_ANDCC,
SPARC_INS_ANDNCC,
SPARC_INS_ANDN,
SPARC_INS_AND,
SPARC_INS_ARRAY16,
SPARC_INS_ARRAY32,
SPARC_INS_ARRAY8,
SPARC_INS_B,
SPARC_INS_JMP,
SPARC_INS_BMASK,
SPARC_INS_FB,
SPARC_INS_BRGEZ,
SPARC_INS_BRGZ,
SPARC_INS_BRLEZ,
SPARC_INS_BRLZ,
SPARC_INS_BRNZ,
SPARC_INS_BRZ,
SPARC_INS_BSHUFFLE,
SPARC_INS_CALL,
SPARC_INS_CASX,
SPARC_INS_CAS,
SPARC_INS_CMASK16,
SPARC_INS_CMASK32,
SPARC_INS_CMASK8,
SPARC_INS_CMP,
SPARC_INS_EDGE16,
SPARC_INS_EDGE16L,
SPARC_INS_EDGE16LN,
SPARC_INS_EDGE16N,
SPARC_INS_EDGE32,
SPARC_INS_EDGE32L,
SPARC_INS_EDGE32LN,
SPARC_INS_EDGE32N,
SPARC_INS_EDGE8,
SPARC_INS_EDGE8L,
SPARC_INS_EDGE8LN,
SPARC_INS_EDGE8N,
SPARC_INS_FABSD,
SPARC_INS_FABSQ,
SPARC_INS_FABSS,
SPARC_INS_FADDD,
SPARC_INS_FADDQ,
SPARC_INS_FADDS,
SPARC_INS_FALIGNDATA,
SPARC_INS_FAND,
SPARC_INS_FANDNOT1,
SPARC_INS_FANDNOT1S,
SPARC_INS_FANDNOT2,
SPARC_INS_FANDNOT2S,
SPARC_INS_FANDS,
SPARC_INS_FCHKSM16,
SPARC_INS_FCMPD,
SPARC_INS_FCMPEQ16,
SPARC_INS_FCMPEQ32,
SPARC_INS_FCMPGT16,
SPARC_INS_FCMPGT32,
SPARC_INS_FCMPLE16,
SPARC_INS_FCMPLE32,
SPARC_INS_FCMPNE16,
SPARC_INS_FCMPNE32,
SPARC_INS_FCMPQ,
SPARC_INS_FCMPS,
SPARC_INS_FDIVD,
SPARC_INS_FDIVQ,
SPARC_INS_FDIVS,
SPARC_INS_FDMULQ,
SPARC_INS_FDTOI,
SPARC_INS_FDTOQ,
SPARC_INS_FDTOS,
SPARC_INS_FDTOX,
SPARC_INS_FEXPAND,
SPARC_INS_FHADDD,
SPARC_INS_FHADDS,
SPARC_INS_FHSUBD,
SPARC_INS_FHSUBS,
SPARC_INS_FITOD,
SPARC_INS_FITOQ,
SPARC_INS_FITOS,
SPARC_INS_FLCMPD,
SPARC_INS_FLCMPS,
SPARC_INS_FLUSHW,
SPARC_INS_FMEAN16,
SPARC_INS_FMOVD,
SPARC_INS_FMOVQ,
SPARC_INS_FMOVRDGEZ,
SPARC_INS_FMOVRQGEZ,
SPARC_INS_FMOVRSGEZ,
SPARC_INS_FMOVRDGZ,
SPARC_INS_FMOVRQGZ,
SPARC_INS_FMOVRSGZ,
SPARC_INS_FMOVRDLEZ,
SPARC_INS_FMOVRQLEZ,
SPARC_INS_FMOVRSLEZ,
SPARC_INS_FMOVRDLZ,
SPARC_INS_FMOVRQLZ,
SPARC_INS_FMOVRSLZ,
SPARC_INS_FMOVRDNZ,
SPARC_INS_FMOVRQNZ,
SPARC_INS_FMOVRSNZ,
SPARC_INS_FMOVRDZ,
SPARC_INS_FMOVRQZ,
SPARC_INS_FMOVRSZ,
SPARC_INS_FMOVS,
SPARC_INS_FMUL8SUX16,
SPARC_INS_FMUL8ULX16,
SPARC_INS_FMUL8X16,
SPARC_INS_FMUL8X16AL,
SPARC_INS_FMUL8X16AU,
SPARC_INS_FMULD,
SPARC_INS_FMULD8SUX16,
SPARC_INS_FMULD8ULX16,
SPARC_INS_FMULQ,
SPARC_INS_FMULS,
SPARC_INS_FNADDD,
SPARC_INS_FNADDS,
SPARC_INS_FNAND,
SPARC_INS_FNANDS,
SPARC_INS_FNEGD,
SPARC_INS_FNEGQ,
SPARC_INS_FNEGS,
SPARC_INS_FNHADDD,
SPARC_INS_FNHADDS,
SPARC_INS_FNOR,
SPARC_INS_FNORS,
SPARC_INS_FNOT1,
SPARC_INS_FNOT1S,
SPARC_INS_FNOT2,
SPARC_INS_FNOT2S,
SPARC_INS_FONE,
SPARC_INS_FONES,
SPARC_INS_FOR,
SPARC_INS_FORNOT1,
SPARC_INS_FORNOT1S,
SPARC_INS_FORNOT2,
SPARC_INS_FORNOT2S,
SPARC_INS_FORS,
SPARC_INS_FPACK16,
SPARC_INS_FPACK32,
SPARC_INS_FPACKFIX,
SPARC_INS_FPADD16,
SPARC_INS_FPADD16S,
SPARC_INS_FPADD32,
SPARC_INS_FPADD32S,
SPARC_INS_FPADD64,
SPARC_INS_FPMERGE,
SPARC_INS_FPSUB16,
SPARC_INS_FPSUB16S,
SPARC_INS_FPSUB32,
SPARC_INS_FPSUB32S,
SPARC_INS_FQTOD,
SPARC_INS_FQTOI,
SPARC_INS_FQTOS,
SPARC_INS_FQTOX,
SPARC_INS_FSLAS16,
SPARC_INS_FSLAS32,
SPARC_INS_FSLL16,
SPARC_INS_FSLL32,
SPARC_INS_FSMULD,
SPARC_INS_FSQRTD,
SPARC_INS_FSQRTQ,
SPARC_INS_FSQRTS,
SPARC_INS_FSRA16,
SPARC_INS_FSRA32,
SPARC_INS_FSRC1,
SPARC_INS_FSRC1S,
SPARC_INS_FSRC2,
SPARC_INS_FSRC2S,
SPARC_INS_FSRL16,
SPARC_INS_FSRL32,
SPARC_INS_FSTOD,
SPARC_INS_FSTOI,
SPARC_INS_FSTOQ,
SPARC_INS_FSTOX,
SPARC_INS_FSUBD,
SPARC_INS_FSUBQ,
SPARC_INS_FSUBS,
SPARC_INS_FXNOR,
SPARC_INS_FXNORS,
SPARC_INS_FXOR,
SPARC_INS_FXORS,
SPARC_INS_FXTOD,
SPARC_INS_FXTOQ,
SPARC_INS_FXTOS,
SPARC_INS_FZERO,
SPARC_INS_FZEROS,
SPARC_INS_JMPL,
SPARC_INS_LDD,
SPARC_INS_LD,
SPARC_INS_LDQ,
SPARC_INS_LDSB,
SPARC_INS_LDSH,
SPARC_INS_LDSW,
SPARC_INS_LDUB,
SPARC_INS_LDUH,
SPARC_INS_LDX,
SPARC_INS_LZCNT,
SPARC_INS_MEMBAR,
SPARC_INS_MOVDTOX,
SPARC_INS_MOV,
SPARC_INS_MOVRGEZ,
SPARC_INS_MOVRGZ,
SPARC_INS_MOVRLEZ,
SPARC_INS_MOVRLZ,
SPARC_INS_MOVRNZ,
SPARC_INS_MOVRZ,
SPARC_INS_MOVSTOSW,
SPARC_INS_MOVSTOUW,
SPARC_INS_MULX,
SPARC_INS_NOP,
SPARC_INS_ORCC,
SPARC_INS_ORNCC,
SPARC_INS_ORN,
SPARC_INS_OR,
SPARC_INS_PDIST,
SPARC_INS_PDISTN,
SPARC_INS_POPC,
SPARC_INS_RD,
SPARC_INS_RESTORE,
SPARC_INS_RETT,
SPARC_INS_SAVE,
SPARC_INS_SDIVCC,
SPARC_INS_SDIVX,
SPARC_INS_SDIV,
SPARC_INS_SETHI,
SPARC_INS_SHUTDOWN,
SPARC_INS_SIAM,
SPARC_INS_SLLX,
SPARC_INS_SLL,
SPARC_INS_SMULCC,
SPARC_INS_SMUL,
SPARC_INS_SRAX,
SPARC_INS_SRA,
SPARC_INS_SRLX,
SPARC_INS_SRL,
SPARC_INS_STBAR,
SPARC_INS_STB,
SPARC_INS_STD,
SPARC_INS_ST,
SPARC_INS_STH,
SPARC_INS_STQ,
SPARC_INS_STX,
SPARC_INS_SUBCC,
SPARC_INS_SUBX,
SPARC_INS_SUBXCC,
SPARC_INS_SUB,
SPARC_INS_SWAP,
SPARC_INS_TADDCCTV,
SPARC_INS_TADDCC,
SPARC_INS_T,
SPARC_INS_TSUBCCTV,
SPARC_INS_TSUBCC,
SPARC_INS_UDIVCC,
SPARC_INS_UDIVX,
SPARC_INS_UDIV,
SPARC_INS_UMULCC,
SPARC_INS_UMULXHI,
SPARC_INS_UMUL,
SPARC_INS_UNIMP,
SPARC_INS_FCMPED,
SPARC_INS_FCMPEQ,
SPARC_INS_FCMPES,
SPARC_INS_WR,
SPARC_INS_XMULX,
SPARC_INS_XMULXHI,
SPARC_INS_XNORCC,
SPARC_INS_XNOR,
SPARC_INS_XORCC,
SPARC_INS_XOR,
// alias instructions
SPARC_INS_RET,
SPARC_INS_RETL,
SPARC_INS_ENDING, // <-- mark the end of the list of instructions
} sparc_insn;
//> Group of SPARC instructions
typedef enum sparc_insn_group
{
SPARC_GRP_INVALID = 0, // = CS_GRP_INVALID
//> Generic groups
// all jump instructions (conditional+direct+indirect jumps)
SPARC_GRP_JUMP, // = CS_GRP_JUMP
//> Architecture-specific groups
SPARC_GRP_HARDQUAD = 128,
SPARC_GRP_V9,
SPARC_GRP_VIS,
SPARC_GRP_VIS2,
SPARC_GRP_VIS3,
SPARC_GRP_32BIT,
SPARC_GRP_64BIT,
SPARC_GRP_ENDING, // <-- mark the end of the list of groups
} sparc_insn_group;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/systemz.h
+839
View File
@@ -0,0 +1,839 @@
#ifndef CAPSTONE_SYSTEMZ_H
#define CAPSTONE_SYSTEMZ_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2014-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
//> Enums corresponding to SystemZ condition codes
typedef enum sysz_cc
{
SYSZ_CC_INVALID = 0, // invalid CC (default)
SYSZ_CC_O,
SYSZ_CC_H,
SYSZ_CC_NLE,
SYSZ_CC_L,
SYSZ_CC_NHE,
SYSZ_CC_LH,
SYSZ_CC_NE,
SYSZ_CC_E,
SYSZ_CC_NLH,
SYSZ_CC_HE,
SYSZ_CC_NL,
SYSZ_CC_LE,
SYSZ_CC_NH,
SYSZ_CC_NO,
} sysz_cc;
//> Operand type for instruction's operands
typedef enum sysz_op_type
{
SYSZ_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
SYSZ_OP_REG, // = CS_OP_REG (Register operand).
SYSZ_OP_IMM, // = CS_OP_IMM (Immediate operand).
SYSZ_OP_MEM, // = CS_OP_MEM (Memory operand).
SYSZ_OP_ACREG = 64, // Access register operand.
} sysz_op_type;
//> SystemZ registers
typedef enum sysz_reg
{
SYSZ_REG_INVALID = 0,
SYSZ_REG_0,
SYSZ_REG_1,
SYSZ_REG_2,
SYSZ_REG_3,
SYSZ_REG_4,
SYSZ_REG_5,
SYSZ_REG_6,
SYSZ_REG_7,
SYSZ_REG_8,
SYSZ_REG_9,
SYSZ_REG_10,
SYSZ_REG_11,
SYSZ_REG_12,
SYSZ_REG_13,
SYSZ_REG_14,
SYSZ_REG_15,
SYSZ_REG_CC,
SYSZ_REG_F0,
SYSZ_REG_F1,
SYSZ_REG_F2,
SYSZ_REG_F3,
SYSZ_REG_F4,
SYSZ_REG_F5,
SYSZ_REG_F6,
SYSZ_REG_F7,
SYSZ_REG_F8,
SYSZ_REG_F9,
SYSZ_REG_F10,
SYSZ_REG_F11,
SYSZ_REG_F12,
SYSZ_REG_F13,
SYSZ_REG_F14,
SYSZ_REG_F15,
SYSZ_REG_R0L,
SYSZ_REG_ENDING,
} sysz_reg;
// Instruction's operand referring to memory
// This is associated with SYSZ_OP_MEM operand type above
typedef struct sysz_op_mem
{
uint8_t base; // base register, can be safely interpreted as
// a value of type `sysz_reg`, but it is only
// one byte wide
uint8_t index; // index register, same conditions apply here
uint64_t length; // BDLAddr operand
int64_t disp; // displacement/offset value
} sysz_op_mem;
// Instruction operand
typedef struct cs_sysz_op
{
sysz_op_type type; // operand type
union
{
sysz_reg reg; // register value for REG operand
int64_t imm; // immediate value for IMM operand
sysz_op_mem mem; // base/disp value for MEM operand
};
} cs_sysz_op;
// Instruction structure
typedef struct cs_sysz
{
sysz_cc cc; // Code condition
// Number of operands of this instruction,
// or 0 when instruction has no operand.
uint8_t op_count;
cs_sysz_op operands[6]; // operands for this instruction.
} cs_sysz;
//> SystemZ instruction
typedef enum sysz_insn
{
SYSZ_INS_INVALID = 0,
SYSZ_INS_A,
SYSZ_INS_ADB,
SYSZ_INS_ADBR,
SYSZ_INS_AEB,
SYSZ_INS_AEBR,
SYSZ_INS_AFI,
SYSZ_INS_AG,
SYSZ_INS_AGF,
SYSZ_INS_AGFI,
SYSZ_INS_AGFR,
SYSZ_INS_AGHI,
SYSZ_INS_AGHIK,
SYSZ_INS_AGR,
SYSZ_INS_AGRK,
SYSZ_INS_AGSI,
SYSZ_INS_AH,
SYSZ_INS_AHI,
SYSZ_INS_AHIK,
SYSZ_INS_AHY,
SYSZ_INS_AIH,
SYSZ_INS_AL,
SYSZ_INS_ALC,
SYSZ_INS_ALCG,
SYSZ_INS_ALCGR,
SYSZ_INS_ALCR,
SYSZ_INS_ALFI,
SYSZ_INS_ALG,
SYSZ_INS_ALGF,
SYSZ_INS_ALGFI,
SYSZ_INS_ALGFR,
SYSZ_INS_ALGHSIK,
SYSZ_INS_ALGR,
SYSZ_INS_ALGRK,
SYSZ_INS_ALHSIK,
SYSZ_INS_ALR,
SYSZ_INS_ALRK,
SYSZ_INS_ALY,
SYSZ_INS_AR,
SYSZ_INS_ARK,
SYSZ_INS_ASI,
SYSZ_INS_AXBR,
SYSZ_INS_AY,
SYSZ_INS_BCR,
SYSZ_INS_BRC,
SYSZ_INS_BRCL,
SYSZ_INS_CGIJ,
SYSZ_INS_CGRJ,
SYSZ_INS_CIJ,
SYSZ_INS_CLGIJ,
SYSZ_INS_CLGRJ,
SYSZ_INS_CLIJ,
SYSZ_INS_CLRJ,
SYSZ_INS_CRJ,
SYSZ_INS_BER,
SYSZ_INS_JE,
SYSZ_INS_JGE,
SYSZ_INS_LOCE,
SYSZ_INS_LOCGE,
SYSZ_INS_LOCGRE,
SYSZ_INS_LOCRE,
SYSZ_INS_STOCE,
SYSZ_INS_STOCGE,
SYSZ_INS_BHR,
SYSZ_INS_BHER,
SYSZ_INS_JHE,
SYSZ_INS_JGHE,
SYSZ_INS_LOCHE,
SYSZ_INS_LOCGHE,
SYSZ_INS_LOCGRHE,
SYSZ_INS_LOCRHE,
SYSZ_INS_STOCHE,
SYSZ_INS_STOCGHE,
SYSZ_INS_JH,
SYSZ_INS_JGH,
SYSZ_INS_LOCH,
SYSZ_INS_LOCGH,
SYSZ_INS_LOCGRH,
SYSZ_INS_LOCRH,
SYSZ_INS_STOCH,
SYSZ_INS_STOCGH,
SYSZ_INS_CGIJNLH,
SYSZ_INS_CGRJNLH,
SYSZ_INS_CIJNLH,
SYSZ_INS_CLGIJNLH,
SYSZ_INS_CLGRJNLH,
SYSZ_INS_CLIJNLH,
SYSZ_INS_CLRJNLH,
SYSZ_INS_CRJNLH,
SYSZ_INS_CGIJE,
SYSZ_INS_CGRJE,
SYSZ_INS_CIJE,
SYSZ_INS_CLGIJE,
SYSZ_INS_CLGRJE,
SYSZ_INS_CLIJE,
SYSZ_INS_CLRJE,
SYSZ_INS_CRJE,
SYSZ_INS_CGIJNLE,
SYSZ_INS_CGRJNLE,
SYSZ_INS_CIJNLE,
SYSZ_INS_CLGIJNLE,
SYSZ_INS_CLGRJNLE,
SYSZ_INS_CLIJNLE,
SYSZ_INS_CLRJNLE,
SYSZ_INS_CRJNLE,
SYSZ_INS_CGIJH,
SYSZ_INS_CGRJH,
SYSZ_INS_CIJH,
SYSZ_INS_CLGIJH,
SYSZ_INS_CLGRJH,
SYSZ_INS_CLIJH,
SYSZ_INS_CLRJH,
SYSZ_INS_CRJH,
SYSZ_INS_CGIJNL,
SYSZ_INS_CGRJNL,
SYSZ_INS_CIJNL,
SYSZ_INS_CLGIJNL,
SYSZ_INS_CLGRJNL,
SYSZ_INS_CLIJNL,
SYSZ_INS_CLRJNL,
SYSZ_INS_CRJNL,
SYSZ_INS_CGIJHE,
SYSZ_INS_CGRJHE,
SYSZ_INS_CIJHE,
SYSZ_INS_CLGIJHE,
SYSZ_INS_CLGRJHE,
SYSZ_INS_CLIJHE,
SYSZ_INS_CLRJHE,
SYSZ_INS_CRJHE,
SYSZ_INS_CGIJNHE,
SYSZ_INS_CGRJNHE,
SYSZ_INS_CIJNHE,
SYSZ_INS_CLGIJNHE,
SYSZ_INS_CLGRJNHE,
SYSZ_INS_CLIJNHE,
SYSZ_INS_CLRJNHE,
SYSZ_INS_CRJNHE,
SYSZ_INS_CGIJL,
SYSZ_INS_CGRJL,
SYSZ_INS_CIJL,
SYSZ_INS_CLGIJL,
SYSZ_INS_CLGRJL,
SYSZ_INS_CLIJL,
SYSZ_INS_CLRJL,
SYSZ_INS_CRJL,
SYSZ_INS_CGIJNH,
SYSZ_INS_CGRJNH,
SYSZ_INS_CIJNH,
SYSZ_INS_CLGIJNH,
SYSZ_INS_CLGRJNH,
SYSZ_INS_CLIJNH,
SYSZ_INS_CLRJNH,
SYSZ_INS_CRJNH,
SYSZ_INS_CGIJLE,
SYSZ_INS_CGRJLE,
SYSZ_INS_CIJLE,
SYSZ_INS_CLGIJLE,
SYSZ_INS_CLGRJLE,
SYSZ_INS_CLIJLE,
SYSZ_INS_CLRJLE,
SYSZ_INS_CRJLE,
SYSZ_INS_CGIJNE,
SYSZ_INS_CGRJNE,
SYSZ_INS_CIJNE,
SYSZ_INS_CLGIJNE,
SYSZ_INS_CLGRJNE,
SYSZ_INS_CLIJNE,
SYSZ_INS_CLRJNE,
SYSZ_INS_CRJNE,
SYSZ_INS_CGIJLH,
SYSZ_INS_CGRJLH,
SYSZ_INS_CIJLH,
SYSZ_INS_CLGIJLH,
SYSZ_INS_CLGRJLH,
SYSZ_INS_CLIJLH,
SYSZ_INS_CLRJLH,
SYSZ_INS_CRJLH,
SYSZ_INS_BLR,
SYSZ_INS_BLER,
SYSZ_INS_JLE,
SYSZ_INS_JGLE,
SYSZ_INS_LOCLE,
SYSZ_INS_LOCGLE,
SYSZ_INS_LOCGRLE,
SYSZ_INS_LOCRLE,
SYSZ_INS_STOCLE,
SYSZ_INS_STOCGLE,
SYSZ_INS_BLHR,
SYSZ_INS_JLH,
SYSZ_INS_JGLH,
SYSZ_INS_LOCLH,
SYSZ_INS_LOCGLH,
SYSZ_INS_LOCGRLH,
SYSZ_INS_LOCRLH,
SYSZ_INS_STOCLH,
SYSZ_INS_STOCGLH,
SYSZ_INS_JL,
SYSZ_INS_JGL,
SYSZ_INS_LOCL,
SYSZ_INS_LOCGL,
SYSZ_INS_LOCGRL,
SYSZ_INS_LOCRL,
SYSZ_INS_LOC,
SYSZ_INS_LOCG,
SYSZ_INS_LOCGR,
SYSZ_INS_LOCR,
SYSZ_INS_STOCL,
SYSZ_INS_STOCGL,
SYSZ_INS_BNER,
SYSZ_INS_JNE,
SYSZ_INS_JGNE,
SYSZ_INS_LOCNE,
SYSZ_INS_LOCGNE,
SYSZ_INS_LOCGRNE,
SYSZ_INS_LOCRNE,
SYSZ_INS_STOCNE,
SYSZ_INS_STOCGNE,
SYSZ_INS_BNHR,
SYSZ_INS_BNHER,
SYSZ_INS_JNHE,
SYSZ_INS_JGNHE,
SYSZ_INS_LOCNHE,
SYSZ_INS_LOCGNHE,
SYSZ_INS_LOCGRNHE,
SYSZ_INS_LOCRNHE,
SYSZ_INS_STOCNHE,
SYSZ_INS_STOCGNHE,
SYSZ_INS_JNH,
SYSZ_INS_JGNH,
SYSZ_INS_LOCNH,
SYSZ_INS_LOCGNH,
SYSZ_INS_LOCGRNH,
SYSZ_INS_LOCRNH,
SYSZ_INS_STOCNH,
SYSZ_INS_STOCGNH,
SYSZ_INS_BNLR,
SYSZ_INS_BNLER,
SYSZ_INS_JNLE,
SYSZ_INS_JGNLE,
SYSZ_INS_LOCNLE,
SYSZ_INS_LOCGNLE,
SYSZ_INS_LOCGRNLE,
SYSZ_INS_LOCRNLE,
SYSZ_INS_STOCNLE,
SYSZ_INS_STOCGNLE,
SYSZ_INS_BNLHR,
SYSZ_INS_JNLH,
SYSZ_INS_JGNLH,
SYSZ_INS_LOCNLH,
SYSZ_INS_LOCGNLH,
SYSZ_INS_LOCGRNLH,
SYSZ_INS_LOCRNLH,
SYSZ_INS_STOCNLH,
SYSZ_INS_STOCGNLH,
SYSZ_INS_JNL,
SYSZ_INS_JGNL,
SYSZ_INS_LOCNL,
SYSZ_INS_LOCGNL,
SYSZ_INS_LOCGRNL,
SYSZ_INS_LOCRNL,
SYSZ_INS_STOCNL,
SYSZ_INS_STOCGNL,
SYSZ_INS_BNOR,
SYSZ_INS_JNO,
SYSZ_INS_JGNO,
SYSZ_INS_LOCNO,
SYSZ_INS_LOCGNO,
SYSZ_INS_LOCGRNO,
SYSZ_INS_LOCRNO,
SYSZ_INS_STOCNO,
SYSZ_INS_STOCGNO,
SYSZ_INS_BOR,
SYSZ_INS_JO,
SYSZ_INS_JGO,
SYSZ_INS_LOCO,
SYSZ_INS_LOCGO,
SYSZ_INS_LOCGRO,
SYSZ_INS_LOCRO,
SYSZ_INS_STOCO,
SYSZ_INS_STOCGO,
SYSZ_INS_STOC,
SYSZ_INS_STOCG,
SYSZ_INS_BASR,
SYSZ_INS_BR,
SYSZ_INS_BRAS,
SYSZ_INS_BRASL,
SYSZ_INS_J,
SYSZ_INS_JG,
SYSZ_INS_BRCT,
SYSZ_INS_BRCTG,
SYSZ_INS_C,
SYSZ_INS_CDB,
SYSZ_INS_CDBR,
SYSZ_INS_CDFBR,
SYSZ_INS_CDGBR,
SYSZ_INS_CDLFBR,
SYSZ_INS_CDLGBR,
SYSZ_INS_CEB,
SYSZ_INS_CEBR,
SYSZ_INS_CEFBR,
SYSZ_INS_CEGBR,
SYSZ_INS_CELFBR,
SYSZ_INS_CELGBR,
SYSZ_INS_CFDBR,
SYSZ_INS_CFEBR,
SYSZ_INS_CFI,
SYSZ_INS_CFXBR,
SYSZ_INS_CG,
SYSZ_INS_CGDBR,
SYSZ_INS_CGEBR,
SYSZ_INS_CGF,
SYSZ_INS_CGFI,
SYSZ_INS_CGFR,
SYSZ_INS_CGFRL,
SYSZ_INS_CGH,
SYSZ_INS_CGHI,
SYSZ_INS_CGHRL,
SYSZ_INS_CGHSI,
SYSZ_INS_CGR,
SYSZ_INS_CGRL,
SYSZ_INS_CGXBR,
SYSZ_INS_CH,
SYSZ_INS_CHF,
SYSZ_INS_CHHSI,
SYSZ_INS_CHI,
SYSZ_INS_CHRL,
SYSZ_INS_CHSI,
SYSZ_INS_CHY,
SYSZ_INS_CIH,
SYSZ_INS_CL,
SYSZ_INS_CLC,
SYSZ_INS_CLFDBR,
SYSZ_INS_CLFEBR,
SYSZ_INS_CLFHSI,
SYSZ_INS_CLFI,
SYSZ_INS_CLFXBR,
SYSZ_INS_CLG,
SYSZ_INS_CLGDBR,
SYSZ_INS_CLGEBR,
SYSZ_INS_CLGF,
SYSZ_INS_CLGFI,
SYSZ_INS_CLGFR,
SYSZ_INS_CLGFRL,
SYSZ_INS_CLGHRL,
SYSZ_INS_CLGHSI,
SYSZ_INS_CLGR,
SYSZ_INS_CLGRL,
SYSZ_INS_CLGXBR,
SYSZ_INS_CLHF,
SYSZ_INS_CLHHSI,
SYSZ_INS_CLHRL,
SYSZ_INS_CLI,
SYSZ_INS_CLIH,
SYSZ_INS_CLIY,
SYSZ_INS_CLR,
SYSZ_INS_CLRL,
SYSZ_INS_CLST,
SYSZ_INS_CLY,
SYSZ_INS_CPSDR,
SYSZ_INS_CR,
SYSZ_INS_CRL,
SYSZ_INS_CS,
SYSZ_INS_CSG,
SYSZ_INS_CSY,
SYSZ_INS_CXBR,
SYSZ_INS_CXFBR,
SYSZ_INS_CXGBR,
SYSZ_INS_CXLFBR,
SYSZ_INS_CXLGBR,
SYSZ_INS_CY,
SYSZ_INS_DDB,
SYSZ_INS_DDBR,
SYSZ_INS_DEB,
SYSZ_INS_DEBR,
SYSZ_INS_DL,
SYSZ_INS_DLG,
SYSZ_INS_DLGR,
SYSZ_INS_DLR,
SYSZ_INS_DSG,
SYSZ_INS_DSGF,
SYSZ_INS_DSGFR,
SYSZ_INS_DSGR,
SYSZ_INS_DXBR,
SYSZ_INS_EAR,
SYSZ_INS_FIDBR,
SYSZ_INS_FIDBRA,
SYSZ_INS_FIEBR,
SYSZ_INS_FIEBRA,
SYSZ_INS_FIXBR,
SYSZ_INS_FIXBRA,
SYSZ_INS_FLOGR,
SYSZ_INS_IC,
SYSZ_INS_ICY,
SYSZ_INS_IIHF,
SYSZ_INS_IIHH,
SYSZ_INS_IIHL,
SYSZ_INS_IILF,
SYSZ_INS_IILH,
SYSZ_INS_IILL,
SYSZ_INS_IPM,
SYSZ_INS_L,
SYSZ_INS_LA,
SYSZ_INS_LAA,
SYSZ_INS_LAAG,
SYSZ_INS_LAAL,
SYSZ_INS_LAALG,
SYSZ_INS_LAN,
SYSZ_INS_LANG,
SYSZ_INS_LAO,
SYSZ_INS_LAOG,
SYSZ_INS_LARL,
SYSZ_INS_LAX,
SYSZ_INS_LAXG,
SYSZ_INS_LAY,
SYSZ_INS_LB,
SYSZ_INS_LBH,
SYSZ_INS_LBR,
SYSZ_INS_LCDBR,
SYSZ_INS_LCEBR,
SYSZ_INS_LCGFR,
SYSZ_INS_LCGR,
SYSZ_INS_LCR,
SYSZ_INS_LCXBR,
SYSZ_INS_LD,
SYSZ_INS_LDEB,
SYSZ_INS_LDEBR,
SYSZ_INS_LDGR,
SYSZ_INS_LDR,
SYSZ_INS_LDXBR,
SYSZ_INS_LDXBRA,
SYSZ_INS_LDY,
SYSZ_INS_LE,
SYSZ_INS_LEDBR,
SYSZ_INS_LEDBRA,
SYSZ_INS_LER,
SYSZ_INS_LEXBR,
SYSZ_INS_LEXBRA,
SYSZ_INS_LEY,
SYSZ_INS_LFH,
SYSZ_INS_LG,
SYSZ_INS_LGB,
SYSZ_INS_LGBR,
SYSZ_INS_LGDR,
SYSZ_INS_LGF,
SYSZ_INS_LGFI,
SYSZ_INS_LGFR,
SYSZ_INS_LGFRL,
SYSZ_INS_LGH,
SYSZ_INS_LGHI,
SYSZ_INS_LGHR,
SYSZ_INS_LGHRL,
SYSZ_INS_LGR,
SYSZ_INS_LGRL,
SYSZ_INS_LH,
SYSZ_INS_LHH,
SYSZ_INS_LHI,
SYSZ_INS_LHR,
SYSZ_INS_LHRL,
SYSZ_INS_LHY,
SYSZ_INS_LLC,
SYSZ_INS_LLCH,
SYSZ_INS_LLCR,
SYSZ_INS_LLGC,
SYSZ_INS_LLGCR,
SYSZ_INS_LLGF,
SYSZ_INS_LLGFR,
SYSZ_INS_LLGFRL,
SYSZ_INS_LLGH,
SYSZ_INS_LLGHR,
SYSZ_INS_LLGHRL,
SYSZ_INS_LLH,
SYSZ_INS_LLHH,
SYSZ_INS_LLHR,
SYSZ_INS_LLHRL,
SYSZ_INS_LLIHF,
SYSZ_INS_LLIHH,
SYSZ_INS_LLIHL,
SYSZ_INS_LLILF,
SYSZ_INS_LLILH,
SYSZ_INS_LLILL,
SYSZ_INS_LMG,
SYSZ_INS_LNDBR,
SYSZ_INS_LNEBR,
SYSZ_INS_LNGFR,
SYSZ_INS_LNGR,
SYSZ_INS_LNR,
SYSZ_INS_LNXBR,
SYSZ_INS_LPDBR,
SYSZ_INS_LPEBR,
SYSZ_INS_LPGFR,
SYSZ_INS_LPGR,
SYSZ_INS_LPR,
SYSZ_INS_LPXBR,
SYSZ_INS_LR,
SYSZ_INS_LRL,
SYSZ_INS_LRV,
SYSZ_INS_LRVG,
SYSZ_INS_LRVGR,
SYSZ_INS_LRVR,
SYSZ_INS_LT,
SYSZ_INS_LTDBR,
SYSZ_INS_LTEBR,
SYSZ_INS_LTG,
SYSZ_INS_LTGF,
SYSZ_INS_LTGFR,
SYSZ_INS_LTGR,
SYSZ_INS_LTR,
SYSZ_INS_LTXBR,
SYSZ_INS_LXDB,
SYSZ_INS_LXDBR,
SYSZ_INS_LXEB,
SYSZ_INS_LXEBR,
SYSZ_INS_LXR,
SYSZ_INS_LY,
SYSZ_INS_LZDR,
SYSZ_INS_LZER,
SYSZ_INS_LZXR,
SYSZ_INS_MADB,
SYSZ_INS_MADBR,
SYSZ_INS_MAEB,
SYSZ_INS_MAEBR,
SYSZ_INS_MDB,
SYSZ_INS_MDBR,
SYSZ_INS_MDEB,
SYSZ_INS_MDEBR,
SYSZ_INS_MEEB,
SYSZ_INS_MEEBR,
SYSZ_INS_MGHI,
SYSZ_INS_MH,
SYSZ_INS_MHI,
SYSZ_INS_MHY,
SYSZ_INS_MLG,
SYSZ_INS_MLGR,
SYSZ_INS_MS,
SYSZ_INS_MSDB,
SYSZ_INS_MSDBR,
SYSZ_INS_MSEB,
SYSZ_INS_MSEBR,
SYSZ_INS_MSFI,
SYSZ_INS_MSG,
SYSZ_INS_MSGF,
SYSZ_INS_MSGFI,
SYSZ_INS_MSGFR,
SYSZ_INS_MSGR,
SYSZ_INS_MSR,
SYSZ_INS_MSY,
SYSZ_INS_MVC,
SYSZ_INS_MVGHI,
SYSZ_INS_MVHHI,
SYSZ_INS_MVHI,
SYSZ_INS_MVI,
SYSZ_INS_MVIY,
SYSZ_INS_MVST,
SYSZ_INS_MXBR,
SYSZ_INS_MXDB,
SYSZ_INS_MXDBR,
SYSZ_INS_N,
SYSZ_INS_NC,
SYSZ_INS_NG,
SYSZ_INS_NGR,
SYSZ_INS_NGRK,
SYSZ_INS_NI,
SYSZ_INS_NIHF,
SYSZ_INS_NIHH,
SYSZ_INS_NIHL,
SYSZ_INS_NILF,
SYSZ_INS_NILH,
SYSZ_INS_NILL,
SYSZ_INS_NIY,
SYSZ_INS_NR,
SYSZ_INS_NRK,
SYSZ_INS_NY,
SYSZ_INS_O,
SYSZ_INS_OC,
SYSZ_INS_OG,
SYSZ_INS_OGR,
SYSZ_INS_OGRK,
SYSZ_INS_OI,
SYSZ_INS_OIHF,
SYSZ_INS_OIHH,
SYSZ_INS_OIHL,
SYSZ_INS_OILF,
SYSZ_INS_OILH,
SYSZ_INS_OILL,
SYSZ_INS_OIY,
SYSZ_INS_OR,
SYSZ_INS_ORK,
SYSZ_INS_OY,
SYSZ_INS_PFD,
SYSZ_INS_PFDRL,
SYSZ_INS_RISBG,
SYSZ_INS_RISBHG,
SYSZ_INS_RISBLG,
SYSZ_INS_RLL,
SYSZ_INS_RLLG,
SYSZ_INS_RNSBG,
SYSZ_INS_ROSBG,
SYSZ_INS_RXSBG,
SYSZ_INS_S,
SYSZ_INS_SDB,
SYSZ_INS_SDBR,
SYSZ_INS_SEB,
SYSZ_INS_SEBR,
SYSZ_INS_SG,
SYSZ_INS_SGF,
SYSZ_INS_SGFR,
SYSZ_INS_SGR,
SYSZ_INS_SGRK,
SYSZ_INS_SH,
SYSZ_INS_SHY,
SYSZ_INS_SL,
SYSZ_INS_SLB,
SYSZ_INS_SLBG,
SYSZ_INS_SLBR,
SYSZ_INS_SLFI,
SYSZ_INS_SLG,
SYSZ_INS_SLBGR,
SYSZ_INS_SLGF,
SYSZ_INS_SLGFI,
SYSZ_INS_SLGFR,
SYSZ_INS_SLGR,
SYSZ_INS_SLGRK,
SYSZ_INS_SLL,
SYSZ_INS_SLLG,
SYSZ_INS_SLLK,
SYSZ_INS_SLR,
SYSZ_INS_SLRK,
SYSZ_INS_SLY,
SYSZ_INS_SQDB,
SYSZ_INS_SQDBR,
SYSZ_INS_SQEB,
SYSZ_INS_SQEBR,
SYSZ_INS_SQXBR,
SYSZ_INS_SR,
SYSZ_INS_SRA,
SYSZ_INS_SRAG,
SYSZ_INS_SRAK,
SYSZ_INS_SRK,
SYSZ_INS_SRL,
SYSZ_INS_SRLG,
SYSZ_INS_SRLK,
SYSZ_INS_SRST,
SYSZ_INS_ST,
SYSZ_INS_STC,
SYSZ_INS_STCH,
SYSZ_INS_STCY,
SYSZ_INS_STD,
SYSZ_INS_STDY,
SYSZ_INS_STE,
SYSZ_INS_STEY,
SYSZ_INS_STFH,
SYSZ_INS_STG,
SYSZ_INS_STGRL,
SYSZ_INS_STH,
SYSZ_INS_STHH,
SYSZ_INS_STHRL,
SYSZ_INS_STHY,
SYSZ_INS_STMG,
SYSZ_INS_STRL,
SYSZ_INS_STRV,
SYSZ_INS_STRVG,
SYSZ_INS_STY,
SYSZ_INS_SXBR,
SYSZ_INS_SY,
SYSZ_INS_TM,
SYSZ_INS_TMHH,
SYSZ_INS_TMHL,
SYSZ_INS_TMLH,
SYSZ_INS_TMLL,
SYSZ_INS_TMY,
SYSZ_INS_X,
SYSZ_INS_XC,
SYSZ_INS_XG,
SYSZ_INS_XGR,
SYSZ_INS_XGRK,
SYSZ_INS_XI,
SYSZ_INS_XIHF,
SYSZ_INS_XILF,
SYSZ_INS_XIY,
SYSZ_INS_XR,
SYSZ_INS_XRK,
SYSZ_INS_XY,
SYSZ_INS_ENDING, // <-- mark the end of the list of instructions
} sysz_insn;
//> Group of SystemZ instructions
typedef enum sysz_insn_group
{
SYSZ_GRP_INVALID = 0, // = CS_GRP_INVALID
//> Generic groups
// all jump instructions (conditional+direct+indirect jumps)
SYSZ_GRP_JUMP, // = CS_GRP_JUMP
//> Architecture-specific groups
SYSZ_GRP_DISTINCTOPS = 128,
SYSZ_GRP_FPEXTENSION,
SYSZ_GRP_HIGHWORD,
SYSZ_GRP_INTERLOCKEDACCESS1,
SYSZ_GRP_LOADSTOREONCOND,
SYSZ_GRP_ENDING, // <-- mark the end of the list of groups
} sysz_insn_group;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/capstone/x86.h
+1753
View File
File diff suppressed because it is too large. Load diff
pluginsdk/capstone/xcore.h
+243
View File
@@ -0,0 +1,243 @@
#ifndef CAPSTONE_XCORE_H
#define CAPSTONE_XCORE_H
/* Capstone Disassembly Engine */
/* By Nguyen Anh Quynh <[email protected]>, 2014-2015 */
#ifdef __cplusplus
extern "C" {
#endif
#include "platform.h"
#ifdef _MSC_VER
#pragma warning(disable:4201)
#endif
//> Operand type for instruction's operands
typedef enum xcore_op_type
{
XCORE_OP_INVALID = 0, // = CS_OP_INVALID (Uninitialized).
XCORE_OP_REG, // = CS_OP_REG (Register operand).
XCORE_OP_IMM, // = CS_OP_IMM (Immediate operand).
XCORE_OP_MEM, // = CS_OP_MEM (Memory operand).
} xcore_op_type;
//> XCore registers
typedef enum xcore_reg
{
XCORE_REG_INVALID = 0,
XCORE_REG_CP,
XCORE_REG_DP,
XCORE_REG_LR,
XCORE_REG_SP,
XCORE_REG_R0,
XCORE_REG_R1,
XCORE_REG_R2,
XCORE_REG_R3,
XCORE_REG_R4,
XCORE_REG_R5,
XCORE_REG_R6,
XCORE_REG_R7,
XCORE_REG_R8,
XCORE_REG_R9,
XCORE_REG_R10,
XCORE_REG_R11,
//> pseudo registers
XCORE_REG_PC, // pc
// internal thread registers
// see The-XMOS-XS1-Architecture(X7879A).pdf
XCORE_REG_SCP, // save pc
XCORE_REG_SSR, // save status
XCORE_REG_ET, // exception type
XCORE_REG_ED, // exception data
XCORE_REG_SED, // save exception data
XCORE_REG_KEP, // kernel entry pointer
XCORE_REG_KSP, // kernel stack pointer
XCORE_REG_ID, // thread ID
XCORE_REG_ENDING, // <-- mark the end of the list of registers
} xcore_reg;
// Instruction's operand referring to memory
// This is associated with XCORE_OP_MEM operand type above
typedef struct xcore_op_mem
{
uint8_t base; // base register, can be safely interpreted as
// a value of type `xcore_reg`, but it is only
// one byte wide
uint8_t index; // index register, same conditions apply here
int32_t disp; // displacement/offset value
int direct; // +1: forward, -1: backward
} xcore_op_mem;
// Instruction operand
typedef struct cs_xcore_op
{
xcore_op_type type; // operand type
union
{
xcore_reg reg; // register value for REG operand
int32_t imm; // immediate value for IMM operand
xcore_op_mem mem; // base/disp value for MEM operand
};
} cs_xcore_op;
// Instruction structure
typedef struct cs_xcore
{
// Number of operands of this instruction,
// or 0 when instruction has no operand.
uint8_t op_count;
cs_xcore_op operands[8]; // operands for this instruction.
} cs_xcore;
//> XCore instruction
typedef enum xcore_insn
{
XCORE_INS_INVALID = 0,
XCORE_INS_ADD,
XCORE_INS_ANDNOT,
XCORE_INS_AND,
XCORE_INS_ASHR,
XCORE_INS_BAU,
XCORE_INS_BITREV,
XCORE_INS_BLA,
XCORE_INS_BLAT,
XCORE_INS_BL,
XCORE_INS_BF,
XCORE_INS_BT,
XCORE_INS_BU,
XCORE_INS_BRU,
XCORE_INS_BYTEREV,
XCORE_INS_CHKCT,
XCORE_INS_CLRE,
XCORE_INS_CLRPT,
XCORE_INS_CLRSR,
XCORE_INS_CLZ,
XCORE_INS_CRC8,
XCORE_INS_CRC32,
XCORE_INS_DCALL,
XCORE_INS_DENTSP,
XCORE_INS_DGETREG,
XCORE_INS_DIVS,
XCORE_INS_DIVU,
XCORE_INS_DRESTSP,
XCORE_INS_DRET,
XCORE_INS_ECALLF,
XCORE_INS_ECALLT,
XCORE_INS_EDU,
XCORE_INS_EEF,
XCORE_INS_EET,
XCORE_INS_EEU,
XCORE_INS_ENDIN,
XCORE_INS_ENTSP,
XCORE_INS_EQ,
XCORE_INS_EXTDP,
XCORE_INS_EXTSP,
XCORE_INS_FREER,
XCORE_INS_FREET,
XCORE_INS_GETD,
XCORE_INS_GET,
XCORE_INS_GETN,
XCORE_INS_GETR,
XCORE_INS_GETSR,
XCORE_INS_GETST,
XCORE_INS_GETTS,
XCORE_INS_INCT,
XCORE_INS_INIT,
XCORE_INS_INPW,
XCORE_INS_INSHR,
XCORE_INS_INT,
XCORE_INS_IN,
XCORE_INS_KCALL,
XCORE_INS_KENTSP,
XCORE_INS_KRESTSP,
XCORE_INS_KRET,
XCORE_INS_LADD,
XCORE_INS_LD16S,
XCORE_INS_LD8U,
XCORE_INS_LDA16,
XCORE_INS_LDAP,
XCORE_INS_LDAW,
XCORE_INS_LDC,
XCORE_INS_LDW,
XCORE_INS_LDIVU,
XCORE_INS_LMUL,
XCORE_INS_LSS,
XCORE_INS_LSUB,
XCORE_INS_LSU,
XCORE_INS_MACCS,
XCORE_INS_MACCU,
XCORE_INS_MJOIN,
XCORE_INS_MKMSK,
XCORE_INS_MSYNC,
XCORE_INS_MUL,
XCORE_INS_NEG,
XCORE_INS_NOT,
XCORE_INS_OR,
XCORE_INS_OUTCT,
XCORE_INS_OUTPW,
XCORE_INS_OUTSHR,
XCORE_INS_OUTT,
XCORE_INS_OUT,
XCORE_INS_PEEK,
XCORE_INS_REMS,
XCORE_INS_REMU,
XCORE_INS_RETSP,
XCORE_INS_SETCLK,
XCORE_INS_SET,
XCORE_INS_SETC,
XCORE_INS_SETD,
XCORE_INS_SETEV,
XCORE_INS_SETN,
XCORE_INS_SETPSC,
XCORE_INS_SETPT,
XCORE_INS_SETRDY,
XCORE_INS_SETSR,
XCORE_INS_SETTW,
XCORE_INS_SETV,
XCORE_INS_SEXT,
XCORE_INS_SHL,
XCORE_INS_SHR,
XCORE_INS_SSYNC,
XCORE_INS_ST16,
XCORE_INS_ST8,
XCORE_INS_STW,
XCORE_INS_SUB,
XCORE_INS_SYNCR,
XCORE_INS_TESTCT,
XCORE_INS_TESTLCL,
XCORE_INS_TESTWCT,
XCORE_INS_TSETMR,
XCORE_INS_START,
XCORE_INS_WAITEF,
XCORE_INS_WAITET,
XCORE_INS_WAITEU,
XCORE_INS_XOR,
XCORE_INS_ZEXT,
XCORE_INS_ENDING, // <-- mark the end of the list of instructions
} xcore_insn;
//> Group of XCore instructions
typedef enum xcore_insn_group
{
XCORE_GRP_INVALID = 0, // = CS_GRP_INVALID
//> Generic groups
// all jump instructions (conditional+direct+indirect jumps)
XCORE_GRP_JUMP, // = CS_GRP_JUMP
XCORE_GRP_ENDING, // <-- mark the end of the list of groups
} xcore_insn_group;
#ifdef __cplusplus
}
#endif
#endif
pluginsdk/jansson/jansson.h
+5 -33
View File
@@ -15,18 +15,17 @@
#include "jansson_config.h"
#ifdef __cplusplus
extern "C"
{
extern "C" {
#endif
/* version */
#define JANSSON_MAJOR_VERSION 2
#define JANSSON_MINOR_VERSION 6
#define JANSSON_MINOR_VERSION 7
#define JANSSON_MICRO_VERSION 0
/* Micro version is omitted if it's 0 */
#define JANSSON_VERSION "2.6"
#define JANSSON_VERSION "2.7"
/* Version as a 3-byte hex number, e.g. 0x010201 == 1.2.1. Use this
for numeric comparisons, e.g. #if JANSSON_VERSION_HEX >= ... */
@@ -55,8 +54,6 @@ typedef struct json_t
size_t refcount;
} json_t;
typedef json_t* JSON;
#ifndef JANSSON_USING_CMAKE /* disabled if using cmake */
#if JSON_INTEGER_IS_LONG_LONG
#ifdef _WIN32
@@ -93,17 +90,6 @@ __declspec(dllimport) json_t* json_stringn(const char* value, size_t len);
__declspec(dllimport) json_t* json_string_nocheck(const char* value);
__declspec(dllimport) json_t* json_stringn_nocheck(const char* value, size_t len);
__declspec(dllimport) json_t* json_integer(json_int_t value);
static JSON_INLINE
json_t* json_hex(json_int_t value)
{
char hexvalue[20];
#ifdef _WIN64
sprintf(hexvalue, "0x%llX", value);
#else //x64
sprintf(hexvalue, "0x%X", value);
#endif //_WIN64
return json_string(hexvalue);
}
__declspec(dllimport) json_t* json_real(double value);
__declspec(dllimport) json_t* json_true(void);
__declspec(dllimport) json_t* json_false(void);
@@ -222,21 +208,6 @@ int json_array_insert(json_t* array, size_t ind, json_t* value)
__declspec(dllimport) const char* json_string_value(const json_t* string);
__declspec(dllimport) size_t json_string_length(const json_t* string);
__declspec(dllimport) json_int_t json_integer_value(const json_t* integer);
static JSON_INLINE
json_int_t json_hex_value(const json_t* hex)
{
json_int_t ret;
const char* hexvalue;
hexvalue = json_string_value(hex);
if(!hexvalue)
return 0;
#ifdef _WIN64
sscanf(hexvalue, "0x%llX", &ret);
#else //x64
sscanf(hexvalue, "0x%X", &ret);
#endif //_WIN64
return ret;
}
__declspec(dllimport) double json_real_value(const json_t* real);
__declspec(dllimport) double json_number_value(const json_t* json);
@@ -291,7 +262,8 @@ __declspec(dllimport) json_t* json_load_callback(json_load_callback_t callback,
/* encoding */
#define JSON_INDENT(n) ((n) & 0x1F)
#define JSON_MAX_INDENT 0x1F
#define JSON_INDENT(n) ((n) & JSON_MAX_INDENT)
#define JSON_COMPACT 0x20
#define JSON_ENSURE_ASCII 0x40
#define JSON_SORT_KEYS 0x80
pluginsdk/jansson/jansson_x64dbg.h
+29
View File
@@ -0,0 +1,29 @@
typedef json_t* JSON;
static JSON_INLINE
json_t* json_hex(unsigned json_int_t value)
{
char hexvalue[20];
#ifdef _WIN64
sprintf(hexvalue, "0x%llX", value);
#else //x64
sprintf(hexvalue, "0x%X", value);
#endif //_WIN64
return json_string(hexvalue);
}
static JSON_INLINE
unsigned json_int_t json_hex_value(const json_t* hex)
{
unsigned json_int_t ret;
const char* hexvalue;
hexvalue = json_string_value(hex);
if(!hexvalue)
return 0;
#ifdef _WIN64
sscanf(hexvalue, "0x%llX", &ret);
#else //x64
sscanf(hexvalue, "0x%X", &ret);
#endif //_WIN64
return ret;
}
pluginsdk/libx32_bridge.a
BIN
View File
Binary file not shown.
pluginsdk/libx32_dbg.a
BIN
View File
Binary file not shown.
pluginsdk/libx64_bridge.a
BIN
View File
Binary file not shown.
pluginsdk/libx64_dbg.a
BIN
View File
Binary file not shown.
pluginsdk/x32_bridge.lib
BIN
View File
Binary file not shown.
pluginsdk/x32_dbg.lib
BIN
View File
Binary file not shown.
pluginsdk/x32bridge.lib
BIN
View File
Binary file not shown.
pluginsdk/x32dbg.lib
BIN
View File
Binary file not shown.
pluginsdk/x64_bridge.lib
BIN
View File
Binary file not shown.
pluginsdk/x64_dbg.lib
BIN
View File
Binary file not shown.
pluginsdk/x64bridge.lib
BIN
View File
Binary file not shown.
pluginsdk/x64dbg.lib
BIN
View File
Binary file not shown.
pluginsdk/yara/yara.h
+30 -28
View File
@@ -1,28 +1,30 @@
/*
Copyright (c) 2007-2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_YARA_H
#define YR_YARA_H
#include "yara/utils.h"
#include "yara/filemap.h"
#include "yara/compiler.h"
#include "yara/modules.h"
#include "yara/object.h"
#include "yara/libyara.h"
#include "yara/error.h"
#endif
/*
Copyright (c) 2007-2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_YARA_H
#define YR_YARA_H
#include "yara/utils.h"
#include "yara/filemap.h"
#include "yara/compiler.h"
#include "yara/modules.h"
#include "yara/object.h"
#include "yara/libyara.h"
#include "yara/error.h"
#include "yara/stream.h"
#include "yara/hash.h"
#endif
pluginsdk/yara/yara/ahocorasick.h
+71 -50
View File
@@ -1,50 +1,71 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef _AHOCORASICK_H
#define _AHOCORASICK_H
#include "limits.h"
#include "atoms.h"
#include "types.h"
int yr_ac_create_automaton(
YR_ARENA* arena,
YR_AC_AUTOMATON** automaton);
int yr_ac_add_string(
YR_ARENA* arena,
YR_AC_AUTOMATON* automaton,
YR_STRING* string,
YR_ATOM_LIST_ITEM* atom);
YR_AC_STATE* yr_ac_next_state(
YR_AC_STATE* state,
uint8_t input);
int yr_ac_create_failure_links(
YR_ARENA* arena,
YR_AC_AUTOMATON* automaton);
void yr_ac_print_automaton(
YR_AC_AUTOMATON* automaton);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef _AHOCORASICK_H
#define _AHOCORASICK_H
#include "limits.h"
#include "atoms.h"
#include "types.h"
#define YR_AC_ROOT_STATE 0
#define YR_AC_NEXT_STATE(t) (t >> 32)
#define YR_AC_INVALID_TRANSITION(t, c) (((t) & 0xFFFF) != c)
#define YR_AC_MAKE_TRANSITION(state, code, flags) \
((uint64_t)((((uint64_t) state) << 32) | ((flags) << 16) | (code)))
#define YR_AC_USED_FLAG 0x1
#define YR_AC_USED_TRANSITION_SLOT(x) ((x) & (YR_AC_USED_FLAG << 16))
#define YR_AC_UNUSED_TRANSITION_SLOT(x) (!YR_AC_USED_TRANSITION_SLOT(x))
typedef struct _YR_AC_TABLES
{
YR_AC_TRANSITION* transitions;
YR_AC_MATCH_TABLE_ENTRY* matches;
} YR_AC_TABLES;
int yr_ac_automaton_create(
YR_AC_AUTOMATON** automaton);
int yr_ac_automaton_destroy(
YR_AC_AUTOMATON* automaton);
int yr_ac_add_string(
YR_AC_AUTOMATON* automaton,
YR_STRING* string,
YR_ATOM_LIST_ITEM* atom,
YR_ARENA* matches_arena);
int yr_ac_compile(
YR_AC_AUTOMATON* automaton,
YR_ARENA* arena,
YR_AC_TABLES* tables);
void yr_ac_print_automaton(
YR_AC_AUTOMATON* automaton);
#endif
pluginsdk/yara/yara/arena.h
+152 -151
View File
@@ -1,151 +1,152 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ARENA_H
#define YR_ARENA_H
#include <stdint.h>
#include <stddef.h>
#define ARENA_FLAGS_FIXED_SIZE 1
#define ARENA_FLAGS_COALESCED 2
#define ARENA_FILE_VERSION 6
#define EOL ((size_t) -1)
typedef struct _YR_RELOC
{
int32_t offset;
struct _YR_RELOC* next;
} YR_RELOC;
typedef struct _YR_ARENA_PAGE
{
uint8_t* new_address;
uint8_t* address;
size_t size;
size_t used;
YR_RELOC* reloc_list_head;
YR_RELOC* reloc_list_tail;
struct _YR_ARENA_PAGE* next;
struct _YR_ARENA_PAGE* prev;
} YR_ARENA_PAGE;
typedef struct _YR_ARENA
{
int flags;
YR_ARENA_PAGE* page_list_head;
YR_ARENA_PAGE* current_page;
} YR_ARENA;
int yr_arena_create(
size_t initial_size,
int flags,
YR_ARENA** arena);
void yr_arena_destroy(
YR_ARENA* arena);
void* yr_arena_base_address(
YR_ARENA* arena);
void* yr_arena_next_address(
YR_ARENA* arena,
void* address,
int offset);
int yr_arena_coalesce(
YR_ARENA* arena);
int yr_arena_reserve_memory(
YR_ARENA* arena,
size_t size);
int yr_arena_allocate_memory(
YR_ARENA* arena,
size_t size,
void** allocated_memory);
int yr_arena_allocate_struct(
YR_ARENA* arena,
size_t size,
void** allocated_memory,
...);
int yr_arena_make_relocatable(
YR_ARENA* arena,
void* base,
...);
int yr_arena_write_data(
YR_ARENA* arena,
void* data,
size_t size,
void** written_data);
int yr_arena_write_string(
YR_ARENA* arena,
const char* string,
char** written_string);
int yr_arena_append(
YR_ARENA* target_arena,
YR_ARENA* source_arena);
int yr_arena_save(
YR_ARENA* arena,
const char* filename);
int yr_arena_load(
const char* filename,
YR_ARENA** arena);
int yr_arena_duplicate(
YR_ARENA* arena,
YR_ARENA** duplicated);
void yr_arena_print(
YR_ARENA* arena);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ARENA_H
#define YR_ARENA_H
#include <stdint.h>
#include <stddef.h>
#include "stream.h"
#define ARENA_FLAGS_FIXED_SIZE 1
#define ARENA_FLAGS_COALESCED 2
#define ARENA_FILE_VERSION 10
#define EOL ((size_t) -1)
typedef struct _YR_RELOC
{
uint32_t offset;
struct _YR_RELOC* next;
} YR_RELOC;
typedef struct _YR_ARENA_PAGE
{
uint8_t* new_address;
uint8_t* address;
size_t size;
size_t used;
YR_RELOC* reloc_list_head;
YR_RELOC* reloc_list_tail;
struct _YR_ARENA_PAGE* next;
struct _YR_ARENA_PAGE* prev;
} YR_ARENA_PAGE;
typedef struct _YR_ARENA
{
int flags;
YR_ARENA_PAGE* page_list_head;
YR_ARENA_PAGE* current_page;
} YR_ARENA;
int yr_arena_create(
size_t initial_size,
int flags,
YR_ARENA** arena);
void yr_arena_destroy(
YR_ARENA* arena);
void* yr_arena_base_address(
YR_ARENA* arena);
void* yr_arena_next_address(
YR_ARENA* arena,
void* address,
size_t offset);
int yr_arena_coalesce(
YR_ARENA* arena);
int yr_arena_reserve_memory(
YR_ARENA* arena,
size_t size);
int yr_arena_allocate_memory(
YR_ARENA* arena,
size_t size,
void** allocated_memory);
int yr_arena_allocate_struct(
YR_ARENA* arena,
size_t size,
void** allocated_memory,
...);
int yr_arena_make_relocatable(
YR_ARENA* arena,
void* base,
...);
int yr_arena_write_data(
YR_ARENA* arena,
void* data,
size_t size,
void** written_data);
int yr_arena_write_string(
YR_ARENA* arena,
const char* string,
char** written_string);
int yr_arena_append(
YR_ARENA* target_arena,
YR_ARENA* source_arena);
int yr_arena_load_stream(
YR_STREAM* stream,
YR_ARENA** arena);
int yr_arena_save_stream(
YR_ARENA* arena,
YR_STREAM* stream);
int yr_arena_duplicate(
YR_ARENA* arena,
YR_ARENA** duplicated);
void yr_arena_print(
YR_ARENA* arena);
#endif
pluginsdk/yara/yara/atoms.h
+89 -89
View File
@@ -1,89 +1,89 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ATOMS_H
#define YR_ATOMS_H
#include "limits.h"
#include "re.h"
#define ATOM_TREE_LEAF 1
#define ATOM_TREE_AND 2
#define ATOM_TREE_OR 3
typedef struct _ATOM_TREE_NODE
{
uint8_t type;
uint8_t atom_length;
uint8_t atom[MAX_ATOM_LENGTH];
uint8_t* forward_code;
uint8_t* backward_code;
RE_NODE* recent_nodes[MAX_ATOM_LENGTH];
struct _ATOM_TREE_NODE* children_head;
struct _ATOM_TREE_NODE* children_tail;
struct _ATOM_TREE_NODE* next_sibling;
} ATOM_TREE_NODE;
typedef struct _ATOM_TREE
{
ATOM_TREE_NODE* current_leaf;
ATOM_TREE_NODE* root_node;
} ATOM_TREE;
typedef struct _YR_ATOM_LIST_ITEM
{
uint8_t atom_length;
uint8_t atom[MAX_ATOM_LENGTH];
uint16_t backtrack;
uint8_t* forward_code;
uint8_t* backward_code;
struct _YR_ATOM_LIST_ITEM* next;
} YR_ATOM_LIST_ITEM;
int yr_atoms_extract_from_re(
RE* re,
int flags,
YR_ATOM_LIST_ITEM** atoms);
int yr_atoms_extract_from_string(
uint8_t* string,
int string_length,
int flags,
YR_ATOM_LIST_ITEM** atoms);
int yr_atoms_min_quality(
YR_ATOM_LIST_ITEM* atom_list);
void yr_atoms_list_destroy(
YR_ATOM_LIST_ITEM* list_head);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ATOMS_H
#define YR_ATOMS_H
#include "limits.h"
#include "re.h"
#define ATOM_TREE_LEAF 1
#define ATOM_TREE_AND 2
#define ATOM_TREE_OR 3
typedef struct _ATOM_TREE_NODE
{
uint8_t type;
uint8_t atom_length;
uint8_t atom[MAX_ATOM_LENGTH];
uint8_t* forward_code;
uint8_t* backward_code;
RE_NODE* recent_nodes[MAX_ATOM_LENGTH];
struct _ATOM_TREE_NODE* children_head;
struct _ATOM_TREE_NODE* children_tail;
struct _ATOM_TREE_NODE* next_sibling;
} ATOM_TREE_NODE;
typedef struct _ATOM_TREE
{
ATOM_TREE_NODE* current_leaf;
ATOM_TREE_NODE* root_node;
} ATOM_TREE;
typedef struct _YR_ATOM_LIST_ITEM
{
uint8_t atom_length;
uint8_t atom[MAX_ATOM_LENGTH];
uint16_t backtrack;
uint8_t* forward_code;
uint8_t* backward_code;
struct _YR_ATOM_LIST_ITEM* next;
} YR_ATOM_LIST_ITEM;
int yr_atoms_extract_from_re(
RE* re,
int flags,
YR_ATOM_LIST_ITEM** atoms);
int yr_atoms_extract_from_string(
uint8_t* string,
int string_length,
int flags,
YR_ATOM_LIST_ITEM** atoms);
int yr_atoms_min_quality(
YR_ATOM_LIST_ITEM* atom_list);
void yr_atoms_list_destroy(
YR_ATOM_LIST_ITEM* list_head);
#endif
pluginsdk/yara/yara/compiler.h
+207 -196
View File
@@ -1,196 +1,207 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_COMPILER_H
#define YR_COMPILER_H
#include <stdio.h>
#include <setjmp.h>
#include "ahocorasick.h"
#include "arena.h"
#include "hash.h"
#include "utils.h"
#define YARA_ERROR_LEVEL_ERROR 0
#define YARA_ERROR_LEVEL_WARNING 1
typedef void (*YR_COMPILER_CALLBACK_FUNC)(
int error_level,
const char* file_name,
int line_number,
const char* message,
void* user_data);
typedef struct _YR_COMPILER
{
int errors;
int error_line;
int last_error;
int last_error_line;
int last_result;
jmp_buf error_recovery;
YR_ARENA* sz_arena;
YR_ARENA* rules_arena;
YR_ARENA* strings_arena;
YR_ARENA* code_arena;
YR_ARENA* re_code_arena;
YR_ARENA* automaton_arena;
YR_ARENA* compiled_rules_arena;
YR_ARENA* externals_arena;
YR_ARENA* namespaces_arena;
YR_ARENA* metas_arena;
YR_AC_AUTOMATON* automaton;
YR_HASH_TABLE* rules_table;
YR_HASH_TABLE* objects_table;
YR_NAMESPACE* current_namespace;
YR_STRING* current_rule_strings;
int current_rule_flags;
int namespaces_count;
int8_t* loop_address[MAX_LOOP_NESTING];
char* loop_identifier[MAX_LOOP_NESTING];
int loop_depth;
int loop_for_of_mem_offset;
int allow_includes;
char* file_name_stack[MAX_INCLUDE_DEPTH];
int file_name_stack_ptr;
FILE* file_stack[MAX_INCLUDE_DEPTH];
int file_stack_ptr;
char last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];
char lex_buf[LEX_BUF_SIZE];
char* lex_buf_ptr;
unsigned short lex_buf_len;
char include_base_dir[MAX_PATH];
void* user_data;
YR_COMPILER_CALLBACK_FUNC callback;
} YR_COMPILER;
#define yr_compiler_set_error_extra_info(compiler, info) \
strlcpy( \
compiler->last_error_extra_info, \
info, \
sizeof(compiler->last_error_extra_info)); \
#define yr_compiler_set_error_extra_info_fmt(compiler, fmt, ...) \
snprintf( \
compiler->last_error_extra_info, \
sizeof(compiler->last_error_extra_info), \
fmt, __VA_ARGS__);
int _yr_compiler_push_file(
YR_COMPILER* compiler,
FILE* fh);
FILE* _yr_compiler_pop_file(
YR_COMPILER* compiler);
int _yr_compiler_push_file_name(
YR_COMPILER* compiler,
const char* file_name);
void _yr_compiler_pop_file_name(
YR_COMPILER* compiler);
YR_API int yr_compiler_create(
YR_COMPILER** compiler);
YR_API void yr_compiler_destroy(
YR_COMPILER* compiler);
YR_API void yr_compiler_set_callback(
YR_COMPILER* compiler,
YR_COMPILER_CALLBACK_FUNC callback,
void* user_data);
YR_API int yr_compiler_add_file(
YR_COMPILER* compiler,
FILE* rules_file,
const char* namespace_,
const char* file_name);
YR_API int yr_compiler_add_string(
YR_COMPILER* compiler,
const char* rules_string,
const char* namespace_);
YR_API char* yr_compiler_get_error_message(
YR_COMPILER* compiler,
char* buffer,
int buffer_size);
YR_API char* yr_compiler_get_current_file_name(
YR_COMPILER* context);
YR_API int yr_compiler_define_integer_variable(
YR_COMPILER* compiler,
const char* identifier,
int64_t value);
YR_API int yr_compiler_define_boolean_variable(
YR_COMPILER* compiler,
const char* identifier,
int value);
YR_API int yr_compiler_define_float_variable(
YR_COMPILER* compiler,
const char* identifier,
double value);
YR_API int yr_compiler_define_string_variable(
YR_COMPILER* compiler,
const char* identifier,
const char* value);
YR_API int yr_compiler_get_rules(
YR_COMPILER* compiler,
YR_RULES** rules);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_COMPILER_H
#define YR_COMPILER_H
#include <stdio.h>
#include <setjmp.h>
#include "ahocorasick.h"
#include "arena.h"
#include "hash.h"
#include "utils.h"
#define YARA_ERROR_LEVEL_ERROR 0
#define YARA_ERROR_LEVEL_WARNING 1
typedef void (*YR_COMPILER_CALLBACK_FUNC)(
int error_level,
const char* file_name,
int line_number,
const char* message,
void* user_data);
typedef struct _YR_FIXUP
{
int64_t* address;
struct _YR_FIXUP* next;
} YR_FIXUP;
typedef struct _YR_COMPILER
{
int errors;
int error_line;
int last_error;
int last_error_line;
int last_result;
jmp_buf error_recovery;
YR_ARENA* sz_arena;
YR_ARENA* rules_arena;
YR_ARENA* strings_arena;
YR_ARENA* code_arena;
YR_ARENA* re_code_arena;
YR_ARENA* compiled_rules_arena;
YR_ARENA* externals_arena;
YR_ARENA* namespaces_arena;
YR_ARENA* metas_arena;
YR_ARENA* matches_arena;
YR_ARENA* automaton_arena;
YR_AC_AUTOMATON* automaton;
YR_HASH_TABLE* rules_table;
YR_HASH_TABLE* objects_table;
YR_HASH_TABLE* strings_table;
YR_NAMESPACE* current_namespace;
YR_RULE* current_rule;
YR_FIXUP* fixup_stack_head;
int namespaces_count;
uint8_t* loop_address[MAX_LOOP_NESTING];
char* loop_identifier[MAX_LOOP_NESTING];
int loop_depth;
int loop_for_of_mem_offset;
int allow_includes;
char* file_name_stack[MAX_INCLUDE_DEPTH];
int file_name_stack_ptr;
FILE* file_stack[MAX_INCLUDE_DEPTH];
int file_stack_ptr;
char last_error_extra_info[MAX_COMPILER_ERROR_EXTRA_INFO];
char lex_buf[LEX_BUF_SIZE];
char* lex_buf_ptr;
unsigned short lex_buf_len;
char include_base_dir[MAX_PATH];
void* user_data;
YR_COMPILER_CALLBACK_FUNC callback;
} YR_COMPILER;
#define yr_compiler_set_error_extra_info(compiler, info) \
strlcpy( \
compiler->last_error_extra_info, \
info, \
sizeof(compiler->last_error_extra_info)); \
#define yr_compiler_set_error_extra_info_fmt(compiler, fmt, ...) \
snprintf( \
compiler->last_error_extra_info, \
sizeof(compiler->last_error_extra_info), \
fmt, __VA_ARGS__);
int _yr_compiler_push_file(
YR_COMPILER* compiler,
FILE* fh);
FILE* _yr_compiler_pop_file(
YR_COMPILER* compiler);
int _yr_compiler_push_file_name(
YR_COMPILER* compiler,
const char* file_name);
void _yr_compiler_pop_file_name(
YR_COMPILER* compiler);
YR_API int yr_compiler_create(
YR_COMPILER** compiler);
YR_API void yr_compiler_destroy(
YR_COMPILER* compiler);
YR_API void yr_compiler_set_callback(
YR_COMPILER* compiler,
YR_COMPILER_CALLBACK_FUNC callback,
void* user_data);
YR_API int yr_compiler_add_file(
YR_COMPILER* compiler,
FILE* rules_file,
const char* namespace_,
const char* file_name);
YR_API int yr_compiler_add_string(
YR_COMPILER* compiler,
const char* rules_string,
const char* namespace_);
YR_API char* yr_compiler_get_error_message(
YR_COMPILER* compiler,
char* buffer,
int buffer_size);
YR_API char* yr_compiler_get_current_file_name(
YR_COMPILER* context);
YR_API int yr_compiler_define_integer_variable(
YR_COMPILER* compiler,
const char* identifier,
int64_t value);
YR_API int yr_compiler_define_boolean_variable(
YR_COMPILER* compiler,
const char* identifier,
int value);
YR_API int yr_compiler_define_float_variable(
YR_COMPILER* compiler,
const char* identifier,
double value);
YR_API int yr_compiler_define_string_variable(
YR_COMPILER* compiler,
const char* identifier,
const char* value);
YR_API int yr_compiler_get_rules(
YR_COMPILER* compiler,
YR_RULES** rules);
#endif
pluginsdk/yara/yara/elf.h
+34 -11
View File
@@ -45,16 +45,20 @@ typedef uint64_t elf64_xword_t;
#define ELF_ET_LOPROC 0xFF00 // Processor-specific
#define ELF_ET_HIPROC 0x00FF // Processor-specific
#define ELF_EM_NONE 0x0000 // no type
#define ELF_EM_M32 0x0001 // AT&T WE 32100
#define ELF_EM_SPARC 0x0002 // SPARC
#define ELF_EM_386 0x0003 // Intel 80386
#define ELF_EM_68K 0x0004 // Motorola 68000
#define ELF_EM_88K 0x0005 // Motorola 88000
#define ELF_EM_860 0x0007 // Intel 80860
#define ELF_EM_MIPS 0x0008 // MIPS RS3000
#define ELF_EM_ARM 0x0032 // ARM
#define ELF_EM_X86_64 0x003E // AMD/Intel x86_64
#define ELF_EM_NONE 0x0000 // no type
#define ELF_EM_M32 0x0001 // AT&T WE 32100
#define ELF_EM_SPARC 0x0002 // SPARC
#define ELF_EM_386 0x0003 // Intel 80386
#define ELF_EM_68K 0x0004 // Motorola 68000
#define ELF_EM_88K 0x0005 // Motorola 88000
#define ELF_EM_860 0x0007 // Intel 80860
#define ELF_EM_MIPS 0x0008 // MIPS I Architecture
#define ELF_EM_MIPS_RS3_LE 0x000A // MIPS RS3000 Little-endian
#define ELF_EM_PPC 0x0014 // PowerPC
#define ELF_EM_PPC64 0x0015 // 64-bit PowerPC
#define ELF_EM_ARM 0x0028 // ARM
#define ELF_EM_X86_64 0x003E // AMD/Intel x86_64
#define ELF_EM_AARCH64 0x00B7 // 64-bit ARM
#define ELF_CLASS_NONE 0x0000
#define ELF_CLASS_32 0x0001 // 32bit file
@@ -83,6 +87,25 @@ typedef uint64_t elf64_xword_t;
#define ELF_SHF_ALLOC 0x2 // Section is present during execution
#define ELF_SHF_EXECINSTR 0x4 // Section contains executable instructions
#define ELF_SHN_LORESERVE 0xFF00
#define ELF_PT_NULL 0 // The array element is unused
#define ELF_PT_LOAD 1 // Loadable segment
#define ELF_PT_DYNAMIC 2 // Segment contains dynamic linking info
#define ELF_PT_INTERP 3 // Contains interpreter pathname
#define ELF_PT_NOTE 4 // Location & size of auxiliary info
#define ELF_PT_SHLIB 5 // Reserved, unspecified semantics
#define ELF_PT_PHDR 6 // Location and size of program header table
#define ELF_PT_TLS 7 // Thread-Local Storage
#define ELF_PT_GNU_EH_FRAME 0x6474e550
#define ELF_PT_GNU_STACK 0x6474e551
#define ELF_PF_X 0x1 // Segment is executable
#define ELF_PF_W 0x2 // Segment is writable
#define ELF_PF_R 0x4 // Segment is readable
#define ELF_PN_XNUM 0xffff
#pragma pack(push,1)
typedef struct
@@ -199,4 +222,4 @@ typedef struct
#pragma pack(pop)
#endif
#endif
pluginsdk/yara/yara/error.h
+108 -100
View File
@@ -1,100 +1,108 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ERROR_H
#define YR_ERROR_H
#include <string.h>
#ifndef ERROR_SUCCESS
#define ERROR_SUCCESS 0
#endif
#define ERROR_INSUFICIENT_MEMORY 1
#define ERROR_COULD_NOT_ATTACH_TO_PROCESS 2
#define ERROR_COULD_NOT_OPEN_FILE 3
#define ERROR_COULD_NOT_MAP_FILE 4
#define ERROR_INVALID_FILE 6
#define ERROR_CORRUPT_FILE 7
#define ERROR_UNSUPPORTED_FILE_VERSION 8
#define ERROR_INVALID_REGULAR_EXPRESSION 9
#define ERROR_INVALID_HEX_STRING 10
#define ERROR_SYNTAX_ERROR 11
#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED 12
#define ERROR_DUPLICATED_LOOP_IDENTIFIER 13
#define ERROR_DUPLICATED_IDENTIFIER 14
#define ERROR_DUPLICATED_TAG_IDENTIFIER 15
#define ERROR_DUPLICATED_META_IDENTIFIER 16
#define ERROR_DUPLICATED_STRING_IDENTIFIER 17
#define ERROR_UNREFERENCED_STRING 18
#define ERROR_UNDEFINED_STRING 19
#define ERROR_UNDEFINED_IDENTIFIER 20
#define ERROR_MISPLACED_ANONYMOUS_STRING 21
#define ERROR_INCLUDES_CIRCULAR_REFERENCE 22
#define ERROR_INCLUDE_DEPTH_EXCEEDED 23
#define ERROR_WRONG_TYPE 24
#define ERROR_EXEC_STACK_OVERFLOW 25
#define ERROR_SCAN_TIMEOUT 26
#define ERROR_TOO_MANY_SCAN_THREADS 27
#define ERROR_CALLBACK_ERROR 28
#define ERROR_INVALID_ARGUMENT 29
#define ERROR_TOO_MANY_MATCHES 30
#define ERROR_INTERNAL_FATAL_ERROR 31
#define ERROR_NESTED_FOR_OF_LOOP 32
#define ERROR_INVALID_FIELD_NAME 33
#define ERROR_UNKNOWN_MODULE 34
#define ERROR_NOT_A_STRUCTURE 35
#define ERROR_NOT_INDEXABLE 36
#define ERROR_NOT_A_FUNCTION 37
#define ERROR_INVALID_FORMAT 38
#define ERROR_TOO_MANY_ARGUMENTS 39
#define ERROR_WRONG_ARGUMENTS 40
#define ERROR_WRONG_RETURN_TYPE 41
#define ERROR_DUPLICATED_STRUCTURE_MEMBER 42
#define FAIL_ON_ERROR(x) { \
int result = (x); \
if (result != ERROR_SUCCESS) \
return result; \
}
#define FAIL_ON_ERROR_WITH_CLEANUP(x, cleanup) { \
int result = (x); \
if (result != ERROR_SUCCESS) { \
cleanup; \
return result; \
} \
}
#define FAIL_ON_COMPILER_ERROR(x) { \
compiler->last_result = (x); \
if (compiler->last_result != ERROR_SUCCESS) \
return compiler->last_result; \
}
#ifdef NDEBUG
#define assertf(expr, msg) ((void)0)
#else
#define assertf(expr, msg, ...) \
if(!(expr)) { \
fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
abort(); \
}
#endif
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_ERROR_H
#define YR_ERROR_H
#include <string.h>
#if defined(_WIN32) || defined(__CYGWIN__)
#include <windows.h>
#endif
#ifndef ERROR_SUCCESS
#define ERROR_SUCCESS 0
#endif
#define ERROR_INSUFICIENT_MEMORY 1
#define ERROR_COULD_NOT_ATTACH_TO_PROCESS 2
#define ERROR_COULD_NOT_OPEN_FILE 3
#define ERROR_COULD_NOT_MAP_FILE 4
#define ERROR_INVALID_FILE 6
#define ERROR_CORRUPT_FILE 7
#define ERROR_UNSUPPORTED_FILE_VERSION 8
#define ERROR_INVALID_REGULAR_EXPRESSION 9
#define ERROR_INVALID_HEX_STRING 10
#define ERROR_SYNTAX_ERROR 11
#define ERROR_LOOP_NESTING_LIMIT_EXCEEDED 12
#define ERROR_DUPLICATED_LOOP_IDENTIFIER 13
#define ERROR_DUPLICATED_IDENTIFIER 14
#define ERROR_DUPLICATED_TAG_IDENTIFIER 15
#define ERROR_DUPLICATED_META_IDENTIFIER 16
#define ERROR_DUPLICATED_STRING_IDENTIFIER 17
#define ERROR_UNREFERENCED_STRING 18
#define ERROR_UNDEFINED_STRING 19
#define ERROR_UNDEFINED_IDENTIFIER 20
#define ERROR_MISPLACED_ANONYMOUS_STRING 21
#define ERROR_INCLUDES_CIRCULAR_REFERENCE 22
#define ERROR_INCLUDE_DEPTH_EXCEEDED 23
#define ERROR_WRONG_TYPE 24
#define ERROR_EXEC_STACK_OVERFLOW 25
#define ERROR_SCAN_TIMEOUT 26
#define ERROR_TOO_MANY_SCAN_THREADS 27
#define ERROR_CALLBACK_ERROR 28
#define ERROR_INVALID_ARGUMENT 29
#define ERROR_TOO_MANY_MATCHES 30
#define ERROR_INTERNAL_FATAL_ERROR 31
#define ERROR_NESTED_FOR_OF_LOOP 32
#define ERROR_INVALID_FIELD_NAME 33
#define ERROR_UNKNOWN_MODULE 34
#define ERROR_NOT_A_STRUCTURE 35
#define ERROR_NOT_INDEXABLE 36
#define ERROR_NOT_A_FUNCTION 37
#define ERROR_INVALID_FORMAT 38
#define ERROR_TOO_MANY_ARGUMENTS 39
#define ERROR_WRONG_ARGUMENTS 40
#define ERROR_WRONG_RETURN_TYPE 41
#define ERROR_DUPLICATED_STRUCTURE_MEMBER 42
#define ERROR_EMPTY_STRING 43
#define ERROR_DIVISION_BY_ZERO 44
#define ERROR_REGULAR_EXPRESSION_TOO_LARGE 45
#define ERROR_TOO_MANY_RE_FIBERS 46
#define FAIL_ON_ERROR(x) { \
int result = (x); \
if (result != ERROR_SUCCESS) \
return result; \
}
#define FAIL_ON_ERROR_WITH_CLEANUP(x, cleanup) { \
int result = (x); \
if (result != ERROR_SUCCESS) { \
cleanup; \
return result; \
} \
}
#define FAIL_ON_COMPILER_ERROR(x) { \
compiler->last_result = (x); \
if (compiler->last_result != ERROR_SUCCESS) \
return compiler->last_result; \
}
#ifdef NDEBUG
#define assertf(expr, msg, ...) ((void)0)
#else
#define assertf(expr, msg, ...) \
if(!(expr)) { \
fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
abort(); \
}
#endif
#endif
pluginsdk/yara/yara/exec.h
+162 -156
View File
@@ -1,156 +1,162 @@
/*
Copyright (c) 2013-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_EXEC_H
#define YR_EXEC_H
#include "hash.h"
#include "scan.h"
#include "types.h"
#include "rules.h"
#define UNDEFINED 0xFFFABADAFABADAFFLL
#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) UNDEFINED)
#define OP_ERROR 0
#define OP_HALT 255
#define OP_AND 1
#define OP_OR 2
#define OP_NOT 3
#define OP_BITWISE_NOT 4
#define OP_BITWISE_AND 5
#define OP_BITWISE_OR 6
#define OP_BITWISE_XOR 7
#define OP_SHL 8
#define OP_SHR 9
#define OP_MOD 10
#define OP_INT_TO_DBL 11
#define OP_STR_TO_BOOL 12
#define OP_PUSH 13
#define OP_POP 14
#define OP_CALL 15
#define OP_OBJ_LOAD 16
#define OP_OBJ_VALUE 17
#define OP_OBJ_FIELD 18
#define OP_INDEX_ARRAY 19
#define OP_COUNT 20
#define OP_FOUND 21
#define OP_FOUND_AT 22
#define OP_FOUND_IN 23
#define OP_OFFSET 24
#define OP_OF 25
#define OP_PUSH_RULE 26
#define OP_MATCH_RULE 27
#define OP_INCR_M 28
#define OP_CLEAR_M 29
#define OP_ADD_M 30
#define OP_POP_M 31
#define OP_PUSH_M 32
#define OP_SWAPUNDEF 33
#define OP_JNUNDEF 34
#define OP_JLE 35
#define OP_FILESIZE 36
#define OP_ENTRYPOINT 37
#define OP_CONTAINS 38
#define OP_MATCHES 39
#define OP_IMPORT 40
#define OP_LOOKUP_DICT 41
#define _OP_EQ 0
#define _OP_NEQ 1
#define _OP_LT 2
#define _OP_GT 3
#define _OP_LE 4
#define _OP_GE 5
#define _OP_ADD 6
#define _OP_SUB 7
#define _OP_MUL 8
#define _OP_DIV 9
#define _OP_MINUS 10
#define OP_INT_BEGIN 100
#define OP_INT_EQ (OP_INT_BEGIN + _OP_EQ)
#define OP_INT_NEQ (OP_INT_BEGIN + _OP_NEQ)
#define OP_INT_LT (OP_INT_BEGIN + _OP_LT)
#define OP_INT_GT (OP_INT_BEGIN + _OP_GT)
#define OP_INT_LE (OP_INT_BEGIN + _OP_LE)
#define OP_INT_GE (OP_INT_BEGIN + _OP_GE)
#define OP_INT_ADD (OP_INT_BEGIN + _OP_ADD)
#define OP_INT_SUB (OP_INT_BEGIN + _OP_SUB)
#define OP_INT_MUL (OP_INT_BEGIN + _OP_MUL)
#define OP_INT_DIV (OP_INT_BEGIN + _OP_DIV)
#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS)
#define OP_INT_END OP_INT_MINUS
#define OP_DBL_BEGIN 120
#define OP_DBL_EQ (OP_DBL_BEGIN + _OP_EQ)
#define OP_DBL_NEQ (OP_DBL_BEGIN + _OP_NEQ)
#define OP_DBL_LT (OP_DBL_BEGIN + _OP_LT)
#define OP_DBL_GT (OP_DBL_BEGIN + _OP_GT)
#define OP_DBL_LE (OP_DBL_BEGIN + _OP_LE)
#define OP_DBL_GE (OP_DBL_BEGIN + _OP_GE)
#define OP_DBL_ADD (OP_DBL_BEGIN + _OP_ADD)
#define OP_DBL_SUB (OP_DBL_BEGIN + _OP_SUB)
#define OP_DBL_MUL (OP_DBL_BEGIN + _OP_MUL)
#define OP_DBL_DIV (OP_DBL_BEGIN + _OP_DIV)
#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS)
#define OP_DBL_END OP_DBL_MINUS
#define OP_STR_BEGIN 140
#define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ)
#define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ)
#define OP_STR_LT (OP_STR_BEGIN + _OP_LT)
#define OP_STR_GT (OP_STR_BEGIN + _OP_GT)
#define OP_STR_LE (OP_STR_BEGIN + _OP_LE)
#define OP_STR_GE (OP_STR_BEGIN + _OP_GE)
#define OP_STR_END OP_STR_GE
#define IS_INT_OP(x) ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END)
#define IS_DBL_OP(x) ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END)
#define IS_STR_OP(x) ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END)
#define OP_READ_INT 240
#define OP_INT8 (OP_READ_INT + 0)
#define OP_INT16 (OP_READ_INT + 1)
#define OP_INT32 (OP_READ_INT + 2)
#define OP_UINT8 (OP_READ_INT + 3)
#define OP_UINT16 (OP_READ_INT + 4)
#define OP_UINT32 (OP_READ_INT + 5)
#define OP_INT8BE (OP_READ_INT + 6)
#define OP_INT16BE (OP_READ_INT + 7)
#define OP_INT32BE (OP_READ_INT + 8)
#define OP_UINT8BE (OP_READ_INT + 9)
#define OP_UINT16BE (OP_READ_INT + 10)
#define OP_UINT32BE (OP_READ_INT + 11)
#define OPERATION(operator, op1, op2) \
(IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (UNDEFINED) : (op1 operator op2)
#define COMPARISON(operator, op1, op2) \
(IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (0) : (op1 operator op2)
int yr_execute_code(
YR_RULES* rules,
YR_SCAN_CONTEXT* context,
int timeout,
time_t start_time);
#endif
/*
Copyright (c) 2013-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_EXEC_H
#define YR_EXEC_H
#include "hash.h"
#include "scan.h"
#include "types.h"
#include "rules.h"
#define UNDEFINED 0xFFFABADAFABADAFFLL
#define IS_UNDEFINED(x) ((size_t)(x) == (size_t) UNDEFINED)
#define OP_ERROR 0
#define OP_HALT 255
#define OP_AND 1
#define OP_OR 2
#define OP_NOT 3
#define OP_BITWISE_NOT 4
#define OP_BITWISE_AND 5
#define OP_BITWISE_OR 6
#define OP_BITWISE_XOR 7
#define OP_SHL 8
#define OP_SHR 9
#define OP_MOD 10
#define OP_INT_TO_DBL 11
#define OP_STR_TO_BOOL 12
#define OP_PUSH 13
#define OP_POP 14
#define OP_CALL 15
#define OP_OBJ_LOAD 16
#define OP_OBJ_VALUE 17
#define OP_OBJ_FIELD 18
#define OP_INDEX_ARRAY 19
#define OP_COUNT 20
#define OP_LENGTH 21
#define OP_FOUND 22
#define OP_FOUND_AT 23
#define OP_FOUND_IN 24
#define OP_OFFSET 25
#define OP_OF 26
#define OP_PUSH_RULE 27
#define OP_INIT_RULE 28
#define OP_MATCH_RULE 29
#define OP_INCR_M 30
#define OP_CLEAR_M 31
#define OP_ADD_M 32
#define OP_POP_M 33
#define OP_PUSH_M 34
#define OP_SWAPUNDEF 35
#define OP_JNUNDEF 36
#define OP_JLE 37
#define OP_FILESIZE 38
#define OP_ENTRYPOINT 39
#define OP_CONTAINS 40
#define OP_MATCHES 41
#define OP_IMPORT 42
#define OP_LOOKUP_DICT 43
#define OP_JFALSE 44
#define OP_JTRUE 45
#define _OP_EQ 0
#define _OP_NEQ 1
#define _OP_LT 2
#define _OP_GT 3
#define _OP_LE 4
#define _OP_GE 5
#define _OP_ADD 6
#define _OP_SUB 7
#define _OP_MUL 8
#define _OP_DIV 9
#define _OP_MINUS 10
#define OP_INT_BEGIN 100
#define OP_INT_EQ (OP_INT_BEGIN + _OP_EQ)
#define OP_INT_NEQ (OP_INT_BEGIN + _OP_NEQ)
#define OP_INT_LT (OP_INT_BEGIN + _OP_LT)
#define OP_INT_GT (OP_INT_BEGIN + _OP_GT)
#define OP_INT_LE (OP_INT_BEGIN + _OP_LE)
#define OP_INT_GE (OP_INT_BEGIN + _OP_GE)
#define OP_INT_ADD (OP_INT_BEGIN + _OP_ADD)
#define OP_INT_SUB (OP_INT_BEGIN + _OP_SUB)
#define OP_INT_MUL (OP_INT_BEGIN + _OP_MUL)
#define OP_INT_DIV (OP_INT_BEGIN + _OP_DIV)
#define OP_INT_MINUS (OP_INT_BEGIN + _OP_MINUS)
#define OP_INT_END OP_INT_MINUS
#define OP_DBL_BEGIN 120
#define OP_DBL_EQ (OP_DBL_BEGIN + _OP_EQ)
#define OP_DBL_NEQ (OP_DBL_BEGIN + _OP_NEQ)
#define OP_DBL_LT (OP_DBL_BEGIN + _OP_LT)
#define OP_DBL_GT (OP_DBL_BEGIN + _OP_GT)
#define OP_DBL_LE (OP_DBL_BEGIN + _OP_LE)
#define OP_DBL_GE (OP_DBL_BEGIN + _OP_GE)
#define OP_DBL_ADD (OP_DBL_BEGIN + _OP_ADD)
#define OP_DBL_SUB (OP_DBL_BEGIN + _OP_SUB)
#define OP_DBL_MUL (OP_DBL_BEGIN + _OP_MUL)
#define OP_DBL_DIV (OP_DBL_BEGIN + _OP_DIV)
#define OP_DBL_MINUS (OP_DBL_BEGIN + _OP_MINUS)
#define OP_DBL_END OP_DBL_MINUS
#define OP_STR_BEGIN 140
#define OP_STR_EQ (OP_STR_BEGIN + _OP_EQ)
#define OP_STR_NEQ (OP_STR_BEGIN + _OP_NEQ)
#define OP_STR_LT (OP_STR_BEGIN + _OP_LT)
#define OP_STR_GT (OP_STR_BEGIN + _OP_GT)
#define OP_STR_LE (OP_STR_BEGIN + _OP_LE)
#define OP_STR_GE (OP_STR_BEGIN + _OP_GE)
#define OP_STR_END OP_STR_GE
#define IS_INT_OP(x) ((x) >= OP_INT_BEGIN && (x) <= OP_INT_END)
#define IS_DBL_OP(x) ((x) >= OP_DBL_BEGIN && (x) <= OP_DBL_END)
#define IS_STR_OP(x) ((x) >= OP_STR_BEGIN && (x) <= OP_STR_END)
#define OP_READ_INT 240
#define OP_INT8 (OP_READ_INT + 0)
#define OP_INT16 (OP_READ_INT + 1)
#define OP_INT32 (OP_READ_INT + 2)
#define OP_UINT8 (OP_READ_INT + 3)
#define OP_UINT16 (OP_READ_INT + 4)
#define OP_UINT32 (OP_READ_INT + 5)
#define OP_INT8BE (OP_READ_INT + 6)
#define OP_INT16BE (OP_READ_INT + 7)
#define OP_INT32BE (OP_READ_INT + 8)
#define OP_UINT8BE (OP_READ_INT + 9)
#define OP_UINT16BE (OP_READ_INT + 10)
#define OP_UINT32BE (OP_READ_INT + 11)
#define OPERATION(operator, op1, op2) \
(IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (UNDEFINED) : (op1 operator op2)
#define COMPARISON(operator, op1, op2) \
(IS_UNDEFINED(op1) || IS_UNDEFINED(op2)) ? (0) : (op1 operator op2)
int yr_execute_code(
YR_RULES* rules,
YR_SCAN_CONTEXT* context,
int timeout,
time_t start_time);
#endif
pluginsdk/yara/yara/exefiles.h
+30 -30
View File
@@ -1,30 +1,30 @@
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_EXEFILES_H
#define YR_EXEFILES_H
uint64_t yr_get_entry_point_offset(
uint8_t* buffer,
size_t buffer_length);
uint64_t yr_get_entry_point_address(
uint8_t* buffer,
size_t buffer_length,
size_t base_address);
#endif
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_EXEFILES_H
#define YR_EXEFILES_H
uint64_t yr_get_entry_point_offset(
uint8_t* buffer,
size_t buffer_length);
uint64_t yr_get_entry_point_address(
uint8_t* buffer,
size_t buffer_length,
size_t base_address);
#endif
pluginsdk/yara/yara/filemap.h
+77 -62
View File
@@ -1,62 +1,77 @@
/*
Copyright (c) 2007-2015. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_FILEMAP_H
#define YR_FILEMAP_H
#ifdef _WIN32
#include <windows.h>
#define FILE_DESCRIPTOR HANDLE
#define off_t int64_t
#else
#include <sys/types.h>
#define FILE_DESCRIPTOR int
#endif
#include <stdlib.h>
#include <stdint.h>
#include "utils.h"
typedef struct _YR_MAPPED_FILE
{
FILE_DESCRIPTOR file;
size_t size;
uint8_t* data;
#ifdef _WIN32
HANDLE mapping;
#endif
} YR_MAPPED_FILE;
YR_API int yr_filemap_map(
const char* file_path,
YR_MAPPED_FILE* pmapped_file);
YR_API int yr_filemap_map_ex(
const char* file_path,
off_t offset,
size_t size,
YR_MAPPED_FILE* pmapped_file);
YR_API void yr_filemap_unmap(
YR_MAPPED_FILE* pmapped_file);
#endif
/*
Copyright (c) 2007-2015. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_FILEMAP_H
#define YR_FILEMAP_H
#ifdef _MSC_VER
#define off_t int64_t
#else
#include <sys/types.h>
#endif
#if defined(_WIN32) || defined(__CYGWIN__)
#include <windows.h>
#define YR_FILE_DESCRIPTOR HANDLE
#else
#define YR_FILE_DESCRIPTOR int
#endif
#include <stdlib.h>
#include <stdint.h>
#include "utils.h"
typedef struct _YR_MAPPED_FILE
{
YR_FILE_DESCRIPTOR file;
size_t size;
uint8_t* data;
#if defined(_WIN32) || defined(__CYGWIN__)
HANDLE mapping;
#endif
} YR_MAPPED_FILE;
YR_API int yr_filemap_map(
const char* file_path,
YR_MAPPED_FILE* pmapped_file);
YR_API int yr_filemap_map_fd(
YR_FILE_DESCRIPTOR file,
off_t offset,
size_t size,
YR_MAPPED_FILE* pmapped_file);
YR_API int yr_filemap_map_ex(
const char* file_path,
off_t offset,
size_t size,
YR_MAPPED_FILE* pmapped_file);
YR_API void yr_filemap_unmap(
YR_MAPPED_FILE* pmapped_file);
YR_API void yr_filemap_unmap_fd(
YR_MAPPED_FILE* pmapped_file);
#endif
pluginsdk/yara/yara/globals.h
+23 -23
View File
@@ -1,23 +1,23 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_GLOBALS_H
#define YR_GLOBALS_H
extern char lowercase[256];
extern char altercase[256];
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_GLOBALS_H
#define YR_GLOBALS_H
extern char lowercase[256];
extern char altercase[256];
#endif
pluginsdk/yara/yara/hash.h
+72 -66
View File
@@ -1,66 +1,72 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_HASH_H
#define YR_HASH_H
typedef struct _YR_HASH_TABLE_ENTRY
{
char* key;
char* ns;
void* value;
struct _YR_HASH_TABLE_ENTRY* next;
} YR_HASH_TABLE_ENTRY;
typedef struct _YR_HASH_TABLE
{
int size;
YR_HASH_TABLE_ENTRY* buckets[1];
} YR_HASH_TABLE;
typedef int (*YR_HASH_TABLE_FREE_VALUE_FUNC)(void* value);
int yr_hash_table_create(
int size,
YR_HASH_TABLE** table);
void yr_hash_table_destroy(
YR_HASH_TABLE* table,
YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
void* yr_hash_table_lookup(
YR_HASH_TABLE* table,
const char* key,
const char* ns);
int yr_hash_table_add(
YR_HASH_TABLE* table,
const char* key,
const char* ns,
void* value);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_HASH_H
#define YR_HASH_H
#include "utils.h"
typedef struct _YR_HASH_TABLE_ENTRY
{
char* key;
char* ns;
void* value;
struct _YR_HASH_TABLE_ENTRY* next;
} YR_HASH_TABLE_ENTRY;
typedef struct _YR_HASH_TABLE
{
int size;
YR_HASH_TABLE_ENTRY* buckets[1];
} YR_HASH_TABLE;
typedef int (*YR_HASH_TABLE_FREE_VALUE_FUNC)(void* value);
YR_API int yr_hash_table_create(
int size,
YR_HASH_TABLE** table);
YR_API void yr_hash_table_clean(
YR_HASH_TABLE* table,
YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
YR_API void yr_hash_table_destroy(
YR_HASH_TABLE* table,
YR_HASH_TABLE_FREE_VALUE_FUNC free_value);
YR_API void* yr_hash_table_lookup(
YR_HASH_TABLE* table,
const char* key,
const char* ns);
YR_API int yr_hash_table_add(
YR_HASH_TABLE* table,
const char* key,
const char* ns,
void* value);
#endif
pluginsdk/yara/yara/hex_lexer.h
+98 -98
View File
@@ -1,98 +1,98 @@
/*
Copyright (c) 2007. Victor M. Alvarez [[email protected]].
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "re.h"
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_FATAL_ERROR
#undef YY_DECL
#undef LEX_ENV
#define yyparse hex_yyparse
#define yylex hex_yylex
#define yyerror hex_yyerror
#define yyfatal hex_yyfatal
#define yychar hex_yychar
#define yydebug hex_yydebug
#define yynerrs hex_yynerrs
#define yyget_extra hex_yyget_extra
#define yyget_lineno hex_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#define YY_EXTRA_TYPE RE*
#define YY_USE_CONST
typedef struct _HEX_LEX_ENVIRONMENT
{
int token_count;
int inside_or;
int last_error_code;
char last_error_message[256];
} HEX_LEX_ENVIRONMENT;
#define YY_FATAL_ERROR(msg) hex_yyfatal(yyscanner, msg)
#define LEX_ENV ((HEX_LEX_ENVIRONMENT*) lex_env)
#include <hex_grammar.h>
#define YY_DECL int hex_yylex \
(YYSTYPE * yylval_param , yyscan_t yyscanner, HEX_LEX_ENVIRONMENT* lex_env)
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yylex(
YYSTYPE* yylval_param,
yyscan_t yyscanner,
HEX_LEX_ENVIRONMENT* lex_env);
int yyparse(
void* yyscanner,
HEX_LEX_ENVIRONMENT* lex_env);
void yyerror(
yyscan_t yyscanner,
HEX_LEX_ENVIRONMENT* lex_env,
const char* error_message);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
int yr_parse_hex_string(
const char* hex_string,
int flags,
RE** re,
RE_ERROR* error);
/*
Copyright (c) 2007. Victor M. Alvarez [[email protected]].
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "re.h"
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_FATAL_ERROR
#undef YY_DECL
#undef LEX_ENV
#define yyparse hex_yyparse
#define yylex hex_yylex
#define yyerror hex_yyerror
#define yyfatal hex_yyfatal
#define yychar hex_yychar
#define yydebug hex_yydebug
#define yynerrs hex_yynerrs
#define yyget_extra hex_yyget_extra
#define yyget_lineno hex_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#define YY_EXTRA_TYPE RE*
#define YY_USE_CONST
typedef struct _HEX_LEX_ENVIRONMENT
{
int token_count;
int inside_or;
int last_error_code;
char last_error_message[256];
} HEX_LEX_ENVIRONMENT;
#define YY_FATAL_ERROR(msg) hex_yyfatal(yyscanner, msg)
#define LEX_ENV ((HEX_LEX_ENVIRONMENT*) lex_env)
#include <hex_grammar.h>
#define YY_DECL int hex_yylex \
(YYSTYPE * yylval_param , yyscan_t yyscanner, HEX_LEX_ENVIRONMENT* lex_env)
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yylex(
YYSTYPE* yylval_param,
yyscan_t yyscanner,
HEX_LEX_ENVIRONMENT* lex_env);
int yyparse(
void* yyscanner,
HEX_LEX_ENVIRONMENT* lex_env);
void yyerror(
yyscan_t yyscanner,
HEX_LEX_ENVIRONMENT* lex_env,
const char* error_message);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
int yr_parse_hex_string(
const char* hex_string,
int flags,
RE** re,
RE_ERROR* error);
pluginsdk/yara/yara/lexer.h
+133 -131
View File
@@ -1,131 +1,133 @@
/*
Copyright (c) 2007. Victor M. Alvarez [[email protected]].
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "compiler.h"
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_DECL
#undef YY_FATAL_ERROR
#undef YY_EXTRA_TYPE
#define yyparse yara_yyparse
#define yylex yara_yylex
#define yyerror yara_yyerror
#define yyfatal yara_yyfatal
#define yywarning yara_yywarning
#define yychar yara_yychar
#define yydebug yara_yydebug
#define yynerrs yara_yynerrs
#define yyget_extra yara_yyget_extra
#define yyget_lineno yara_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#ifndef YY_TYPEDEF_EXPRESSION_T
#define YY_TYPEDEF_EXPRESSION_T
// Expression type constants are powers of two because they are used as flags.
// For example:
// CHECK_TYPE(whatever, EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT)
// The expression above is used to ensure that the type of "whatever" is either
// integer or float.
#define EXPRESSION_TYPE_BOOLEAN 1
#define EXPRESSION_TYPE_INTEGER 2
#define EXPRESSION_TYPE_STRING 4
#define EXPRESSION_TYPE_REGEXP 8
#define EXPRESSION_TYPE_OBJECT 16
#define EXPRESSION_TYPE_FLOAT 32
typedef struct _EXPRESSION
{
int type;
union
{
int64_t integer;
YR_OBJECT* object;
} value;
const char* identifier;
} EXPRESSION;
union YYSTYPE;
#endif
#define YY_DECL int yylex( \
union YYSTYPE* yylval_param, yyscan_t yyscanner, YR_COMPILER* compiler)
#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)
#define YY_EXTRA_TYPE YR_COMPILER*
#define YY_USE_CONST
int yyget_lineno(yyscan_t yyscanner);
int yylex(
union YYSTYPE* yylval_param,
yyscan_t yyscanner,
YR_COMPILER* compiler);
int yyparse(
void* yyscanner,
YR_COMPILER* compiler);
void yyerror(
yyscan_t yyscanner,
YR_COMPILER* compiler,
const char* error_message);
void yywarning(
yyscan_t yyscanner,
const char* warning_message);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yr_lex_parse_rules_string(
const char* rules_string,
YR_COMPILER* compiler);
int yr_lex_parse_rules_file(
FILE* rules_file,
YR_COMPILER* compiler);
/*
Copyright (c) 2007. Victor M. Alvarez [[email protected]].
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "compiler.h"
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_DECL
#undef YY_FATAL_ERROR
#undef YY_EXTRA_TYPE
#define yyparse yara_yyparse
#define yylex yara_yylex
#define yyerror yara_yyerror
#define yyfatal yara_yyfatal
#define yywarning yara_yywarning
#define yychar yara_yychar
#define yydebug yara_yydebug
#define yynerrs yara_yynerrs
#define yyget_extra yara_yyget_extra
#define yyget_lineno yara_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#ifndef YY_TYPEDEF_EXPRESSION_T
#define YY_TYPEDEF_EXPRESSION_T
// Expression type constants are powers of two because they are used as flags.
// For example:
// CHECK_TYPE(whatever, EXPRESSION_TYPE_INTEGER | EXPRESSION_TYPE_FLOAT)
// The expression above is used to ensure that the type of "whatever" is either
// integer or float.
#define EXPRESSION_TYPE_BOOLEAN 1
#define EXPRESSION_TYPE_INTEGER 2
#define EXPRESSION_TYPE_STRING 4
#define EXPRESSION_TYPE_REGEXP 8
#define EXPRESSION_TYPE_OBJECT 16
#define EXPRESSION_TYPE_FLOAT 32
typedef struct _EXPRESSION
{
int type;
union
{
int64_t integer;
YR_OBJECT* object;
SIZED_STRING* sized_string;
} value;
const char* identifier;
} EXPRESSION;
union YYSTYPE;
#endif
#define YY_DECL int yylex( \
union YYSTYPE* yylval_param, yyscan_t yyscanner, YR_COMPILER* compiler)
#define YY_FATAL_ERROR(msg) yara_yyfatal(yyscanner, msg)
#define YY_EXTRA_TYPE YR_COMPILER*
#define YY_USE_CONST
int yyget_lineno(yyscan_t yyscanner);
int yylex(
union YYSTYPE* yylval_param,
yyscan_t yyscanner,
YR_COMPILER* compiler);
int yyparse(
void* yyscanner,
YR_COMPILER* compiler);
void yyerror(
yyscan_t yyscanner,
YR_COMPILER* compiler,
const char* error_message);
void yywarning(
yyscan_t yyscanner,
const char* message_fmt,
...);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yr_lex_parse_rules_string(
const char* rules_string,
YR_COMPILER* compiler);
int yr_lex_parse_rules_file(
FILE* rules_file,
YR_COMPILER* compiler);
pluginsdk/yara/yara/libyara.h
+68 -49
View File
@@ -1,49 +1,68 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_LIBYARA_H
#define YR_LIBYARA_H
#include "utils.h"
#define YR_MAJOR_VERSION 3
#define YR_MINOR_VERSION 3
#define YR_MICRO_VERSION 0
// Version as a string
#define YR_VERSION "3.3.0"
// Version as a single 4-byte hex number, e.g. 0x030401 == 3.4.1.
#define YR_VERSION_HEX ((YR_MAJOR_VERSION << 16) | \
(YR_MINOR_VERSION << 8) | \
(YR_MICRO_VERSION << 0)
YR_API int yr_initialize(void);
YR_API int yr_finalize(void);
YR_API void yr_finalize_thread(void);
YR_API int yr_get_tidx(void);
YR_API void yr_set_tidx(int);
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_LIBYARA_H
#define YR_LIBYARA_H
#include "utils.h"
#define YR_MAJOR_VERSION 3
#define YR_MINOR_VERSION 4
#define YR_MICRO_VERSION 0
// Version as a string
#define YR_VERSION "3.4.0"
// Version as a single 4-byte hex number, e.g. 0x030401 == 3.4.1.
#define YR_VERSION_HEX ((YR_MAJOR_VERSION << 16) | \
(YR_MINOR_VERSION << 8) | \
(YR_MICRO_VERSION << 0))
// Enumerated type listing configuration options
typedef enum _YR_CONFIG_NAME
{
YR_CONFIG_STACK_SIZE,
YR_CONFIG_MAX
} YR_CONFIG_NAME;
#define DEFAULT_STACK_SIZE 16384
YR_API int yr_initialize(void);
YR_API int yr_finalize(void);
YR_API void yr_finalize_thread(void);
YR_API int yr_get_tidx(void);
YR_API void yr_set_tidx(int);
YR_API int yr_set_configuration(YR_CONFIG_NAME, void*);
YR_API int yr_get_configuration(YR_CONFIG_NAME, void*);
#endif
pluginsdk/yara/yara/limits.h
+52 -48
View File
@@ -1,48 +1,52 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_LIMITS_H
#define YR_LIMITS_H
// MAX_THREADS is the number of threads that can use a YR_RULES
// object simultaneosly. This value is limited by the number of
// bits in tidx_mask.
#define MAX_THREADS 32
#ifndef MAX_PATH
#define MAX_PATH 1024
#endif
#define MAX_COMPILER_ERROR_EXTRA_INFO 256
#define MAX_ATOM_LENGTH 4
#define MAX_LOOP_NESTING 4
#define MAX_ARENA_PAGES 32
#define MAX_INCLUDE_DEPTH 16
#define MAX_STRING_MATCHES 1000000
#define MAX_FUNCTION_ARGS 128
#define MAX_FAST_HEX_RE_STACK 300
#define MAX_OVERLOADED_FUNCTIONS 10
#define MAX_HEX_STRING_TOKENS 10000
#define LOOP_LOCAL_VARS 4
#define STRING_CHAINING_THRESHOLD 200
#define LEX_BUF_SIZE 1024
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_LIMITS_H
#define YR_LIMITS_H
#if defined(_WIN32) || defined(__CYGWIN__)
#include <windows.h>
#endif
// MAX_THREADS is the number of threads that can use a YR_RULES
// object simultaneosly. This value is limited by the number of
// bits in tidx_mask.
#define MAX_THREADS 32
#ifndef MAX_PATH
#define MAX_PATH 1024
#endif
#define MAX_COMPILER_ERROR_EXTRA_INFO 256
#define MAX_ATOM_LENGTH 4
#define MAX_LOOP_NESTING 4
#define MAX_ARENA_PAGES 32
#define MAX_INCLUDE_DEPTH 16
#define MAX_STRING_MATCHES 1000000
#define MAX_FUNCTION_ARGS 128
#define MAX_FAST_HEX_RE_STACK 300
#define MAX_OVERLOADED_FUNCTIONS 10
#define MAX_HEX_STRING_TOKENS 10000
#define LOOP_LOCAL_VARS 4
#define STRING_CHAINING_THRESHOLD 200
#define LEX_BUF_SIZE 8192
#endif
pluginsdk/yara/yara/mem.h
+63 -63
View File
@@ -1,63 +1,63 @@
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_MEM_H
#define YR_MEM_H
#include <stdio.h>
#include "config.h"
#ifdef DMALLOC
#define yr_malloc malloc
#define yr_calloc calloc
#define yr_realloc realloc
#define yr_free free
#define yr_strdup strdup
#define yr_strndup strndup
#include <dmalloc.h>
#else
void* yr_calloc(
size_t count,
size_t size);
void* yr_malloc(
size_t size);
void* yr_realloc(
void* ptr,
size_t size);
void yr_free(
void* ptr);
char* yr_strdup(
const char* str);
char* yr_strndup(
const char* str, size_t n);
#endif
int yr_heap_alloc();
int yr_heap_free();
#endif
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_MEM_H
#define YR_MEM_H
#include <stdio.h>
#include "config.h"
#ifdef DMALLOC
#define yr_malloc malloc
#define yr_calloc calloc
#define yr_realloc realloc
#define yr_free free
#define yr_strdup strdup
#define yr_strndup strndup
#include <dmalloc.h>
#else
void* yr_calloc(
size_t count,
size_t size);
void* yr_malloc(
size_t size);
void* yr_realloc(
void* ptr,
size_t size);
void yr_free(
void* ptr);
char* yr_strdup(
const char* str);
char* yr_strndup(
const char* str, size_t n);
#endif
int yr_heap_alloc(void);
int yr_heap_free(void);
#endif
pluginsdk/yara/yara/modules.h
+434 -439
View File
@@ -1,439 +1,434 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_MODULES_H
#define YR_MODULES_H
#include <assert.h>
#include <stdio.h>
#include <string.h>
#include <math.h>
#include "utils.h"
#include "limits.h"
#include "error.h"
#include "exec.h"
#include "types.h"
#include "object.h"
#include "libyara.h"
// Concatenation that macro-expands its arguments.
#define CONCAT(arg1, arg2) _CONCAT(arg1, arg2) // expands the arguments.
#define _CONCAT(arg1, arg2) arg1 ## arg2 // do the actual concatenation.
#define module_declarations CONCAT(MODULE_NAME, __declarations)
#define module_load CONCAT(MODULE_NAME, __load)
#define module_unload CONCAT(MODULE_NAME, __unload)
#define module_initialize CONCAT(MODULE_NAME, __initialize)
#define module_finalize CONCAT(MODULE_NAME, __finalize)
#define begin_declarations \
int module_declarations(YR_OBJECT* module) { \
YR_OBJECT* stack[64]; \
int stack_top = 0; \
stack[stack_top] = module;
#define end_declarations \
return ERROR_SUCCESS; }
#define begin_struct(name) { \
YR_OBJECT* structure; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
stack[stack_top], \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define begin_struct_array(name) { \
YR_OBJECT* structure; \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
array, \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define begin_struct_dictionary(name) { \
YR_OBJECT* structure; \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
array, \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define end_struct(name) { \
assert(stack[stack_top]->type == OBJECT_TYPE_STRUCTURE); \
assertf( \
strcmp(stack[stack_top]->identifier, name) == 0, \
"unbalanced begin_struct/end_struct"); \
stack_top--; \
}
#define end_struct_array(name) end_struct(name)
#define end_struct_dictionary(name) end_struct(name)
#define declare_integer(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_integer_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
array, \
NULL)); \
}
#define declare_integer_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
dict, \
NULL)); \
}
#define declare_float(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_float_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
array, \
NULL)); \
}
#define declare_float_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
dict, \
NULL)); \
}
#define declare_string(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_string_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
array, \
NULL)); \
}
#define declare_string_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
dict, \
NULL)); \
}
#define declare_function(name, args_fmt, ret_fmt, func) { \
YR_OBJECT* function; \
FAIL_ON_ERROR(yr_object_function_create( \
name, \
args_fmt, \
ret_fmt, \
func, \
stack[stack_top], \
&function)); \
}
#define define_function(func) \
int func ( \
void* __args, \
YR_SCAN_CONTEXT* __context, \
YR_OBJECT_FUNCTION* __function_obj)
#define sized_string_argument(n) \
((SIZED_STRING*)(size_t)((int64_t*) __args)[n-1])
#define string_argument(n) \
(sized_string_argument(n)->c_string)
#define integer_argument(n) \
(((int64_t*) __args)[n-1])
#define float_argument(n) \
(((double*) __args)[n-1])
#define regexp_argument(n) \
((RE_CODE)((int64_t*) __args)[n-1])
#define module() yr_object_get_root((YR_OBJECT*) __function_obj)
#define parent() (__function_obj->parent)
#define scan_context() (__context)
#define foreach_memory_block(context, block) \
for (block = (context)->mem_block; \
block != NULL; \
block = block->next) \
#define first_memory_block(context) \
(context)->mem_block
#define is_undefined(object, ...) \
yr_object_has_undefined_value(object, __VA_ARGS__)
#define get_object(object, ...) \
yr_object_lookup(object, 0, __VA_ARGS__)
#define get_integer(object, ...) \
yr_object_get_integer(object, __VA_ARGS__)
#define get_float(object, ...) \
yr_object_get_float(object, __VA_ARGS__)
#define get_string(object, ...) \
yr_object_get_string(object, __VA_ARGS__)
#define set_integer(value, object, ...) \
yr_object_set_integer(value, object, __VA_ARGS__)
#define set_float(value, object, ...) \
yr_object_set_float(value, object, __VA_ARGS__)
#define set_sized_string(value, len, object, ...) \
yr_object_set_string(value, len, object, __VA_ARGS__)
#define set_string(value, object, ...) \
set_sized_string(value, strlen(value), object, __VA_ARGS__)
#define return_integer(integer) { \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \
"return type differs from function declaration"); \
yr_object_set_integer( \
(integer), \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
#define return_float(double_) { \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \
"return type differs from function declaration"); \
double d = (double) (double_); \
yr_object_set_float( \
(d != (double) UNDEFINED) ? d : NAN, \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
#define return_string(string) { \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_STRING, \
"return type differs from function declaration"); \
char* s = (char*) (string); \
yr_object_set_string( \
(s != (char*) UNDEFINED) ? s : NULL, \
(s != (char*) UNDEFINED) ? strlen(s) : 0, \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
struct _YR_MODULE;
typedef int (*YR_EXT_INITIALIZE_FUNC)(
struct _YR_MODULE* module);
typedef int (*YR_EXT_FINALIZE_FUNC)(
struct _YR_MODULE* module);
typedef int (*YR_EXT_DECLARATIONS_FUNC)(
YR_OBJECT* module_object);
typedef int (*YR_EXT_LOAD_FUNC)(
YR_SCAN_CONTEXT* context,
YR_OBJECT* module_object,
void* module_data,
size_t module_data_size);
typedef int (*YR_EXT_UNLOAD_FUNC)(
YR_OBJECT* module_object);
typedef struct _YR_MODULE
{
tidx_mask_t is_loaded;
char* name;
YR_EXT_DECLARATIONS_FUNC declarations;
YR_EXT_LOAD_FUNC load;
YR_EXT_UNLOAD_FUNC unload;
YR_EXT_INITIALIZE_FUNC initialize;
YR_EXT_FINALIZE_FUNC finalize;
} YR_MODULE;
typedef struct _YR_MODULE_IMPORT
{
const char* module_name;
void* module_data;
size_t module_data_size;
} YR_MODULE_IMPORT;
int yr_modules_initialize(void);
int yr_modules_finalize(void);
int yr_modules_do_declarations(
const char* module_name,
YR_OBJECT* main_structure);
int yr_modules_load(
const char* module_name,
YR_SCAN_CONTEXT* context);
int yr_modules_unload_all(
YR_SCAN_CONTEXT* context);
void yr_modules_print_data(
YR_SCAN_CONTEXT* context);
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_MODULES_H
#define YR_MODULES_H
#include <assert.h>
#include <stdio.h>
#include <string.h>
#include <math.h>
#include "utils.h"
#include "limits.h"
#include "error.h"
#include "exec.h"
#include "types.h"
#include "object.h"
#include "libyara.h"
// Concatenation that macro-expands its arguments.
#define CONCAT(arg1, arg2) YARA_CONCAT(arg1, arg2) // expands the arguments.
#define YARA_CONCAT(arg1, arg2) arg1 ## arg2 // do the actual concatenation.
#define module_declarations CONCAT(MODULE_NAME, __declarations)
#define module_load CONCAT(MODULE_NAME, __load)
#define module_unload CONCAT(MODULE_NAME, __unload)
#define module_initialize CONCAT(MODULE_NAME, __initialize)
#define module_finalize CONCAT(MODULE_NAME, __finalize)
#define begin_declarations \
int module_declarations(YR_OBJECT* module) { \
YR_OBJECT* stack[64]; \
int stack_top = 0; \
stack[stack_top] = module;
#define end_declarations \
return ERROR_SUCCESS; }
#define begin_struct(name) { \
YR_OBJECT* structure; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
stack[stack_top], \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define begin_struct_array(name) { \
YR_OBJECT* structure; \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
array, \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define begin_struct_dictionary(name) { \
YR_OBJECT* structure; \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRUCTURE, \
name, \
array, \
&structure)); \
assertf( \
stack_top < sizeof(stack)/sizeof(stack[0]) - 1, \
"too many nested structures"); \
stack[++stack_top] = structure; \
}
#define end_struct(name) { \
assert(stack[stack_top]->type == OBJECT_TYPE_STRUCTURE); \
assertf( \
strcmp(stack[stack_top]->identifier, name) == 0, \
"unbalanced begin_struct/end_struct"); \
stack_top--; \
}
#define end_struct_array(name) end_struct(name)
#define end_struct_dictionary(name) end_struct(name)
#define declare_integer(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_integer_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
array, \
NULL)); \
}
#define declare_integer_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_INTEGER, \
name, \
dict, \
NULL)); \
}
#define declare_float(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_float_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
array, \
NULL)); \
}
#define declare_float_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_FLOAT, \
name, \
dict, \
NULL)); \
}
#define declare_string(name) { \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
stack[stack_top], \
NULL)); \
}
#define declare_string_array(name) { \
YR_OBJECT* array; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_ARRAY, \
name, \
stack[stack_top], \
&array)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
array, \
NULL)); \
}
#define declare_string_dictionary(name) { \
YR_OBJECT* dict; \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_DICTIONARY, \
name, \
stack[stack_top], \
&dict)); \
FAIL_ON_ERROR(yr_object_create( \
OBJECT_TYPE_STRING, \
name, \
dict, \
NULL)); \
}
#define declare_function(name, args_fmt, ret_fmt, func) { \
YR_OBJECT* function; \
FAIL_ON_ERROR(yr_object_function_create( \
name, \
args_fmt, \
ret_fmt, \
func, \
stack[stack_top], \
&function)); \
}
#define define_function(func) \
int func ( \
void* __args, \
YR_SCAN_CONTEXT* __context, \
YR_OBJECT_FUNCTION* __function_obj)
#define sized_string_argument(n) \
((SIZED_STRING*)(size_t)((int64_t*) __args)[n-1])
#define string_argument(n) \
(sized_string_argument(n)->c_string)
#define integer_argument(n) \
(((int64_t*) __args)[n-1])
#define float_argument(n) \
(((double*) __args)[n-1])
#define regexp_argument(n) \
((RE_CODE)((int64_t*) __args)[n-1])
#define module() yr_object_get_root((YR_OBJECT*) __function_obj)
#define parent() (__function_obj->parent)
#define scan_context() (__context)
#define foreach_memory_block(context, block) \
for (block = (context)->mem_block; \
block != NULL; \
block = block->next) \
#define first_memory_block(context) \
(context)->mem_block
#define is_undefined(object, ...) \
yr_object_has_undefined_value(object, __VA_ARGS__)
#define get_object(object, ...) \
yr_object_lookup(object, 0, __VA_ARGS__)
#define get_integer(object, ...) \
yr_object_get_integer(object, __VA_ARGS__)
#define get_float(object, ...) \
yr_object_get_float(object, __VA_ARGS__)
#define get_string(object, ...) \
yr_object_get_string(object, __VA_ARGS__)
#define set_integer(value, object, ...) \
yr_object_set_integer(value, object, __VA_ARGS__)
#define set_float(value, object, ...) \
yr_object_set_float(value, object, __VA_ARGS__)
#define set_sized_string(value, len, object, ...) \
yr_object_set_string(value, len, object, __VA_ARGS__)
#define set_string(value, object, ...) \
set_sized_string(value, strlen(value), object, __VA_ARGS__)
#define return_integer(integer) { \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_INTEGER, \
"return type differs from function declaration"); \
yr_object_set_integer( \
(integer), \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
#define return_float(double_) { \
double d = (double) (double_); \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_FLOAT, \
"return type differs from function declaration"); \
yr_object_set_float( \
(d != (double) UNDEFINED) ? d : NAN, \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
#define return_string(string) { \
char* s = (char*) (string); \
assertf( \
__function_obj->return_obj->type == OBJECT_TYPE_STRING, \
"return type differs from function declaration"); \
yr_object_set_string( \
(s != (char*) UNDEFINED) ? s : NULL, \
(s != (char*) UNDEFINED) ? strlen(s) : 0, \
__function_obj->return_obj, \
NULL); \
return ERROR_SUCCESS; \
}
struct _YR_MODULE;
typedef int (*YR_EXT_INITIALIZE_FUNC)(
struct _YR_MODULE* module);
typedef int (*YR_EXT_FINALIZE_FUNC)(
struct _YR_MODULE* module);
typedef int (*YR_EXT_DECLARATIONS_FUNC)(
YR_OBJECT* module_object);
typedef int (*YR_EXT_LOAD_FUNC)(
YR_SCAN_CONTEXT* context,
YR_OBJECT* module_object,
void* module_data,
size_t module_data_size);
typedef int (*YR_EXT_UNLOAD_FUNC)(
YR_OBJECT* module_object);
typedef struct _YR_MODULE
{
char* name;
YR_EXT_DECLARATIONS_FUNC declarations;
YR_EXT_LOAD_FUNC load;
YR_EXT_UNLOAD_FUNC unload;
YR_EXT_INITIALIZE_FUNC initialize;
YR_EXT_FINALIZE_FUNC finalize;
} YR_MODULE;
typedef struct _YR_MODULE_IMPORT
{
const char* module_name;
void* module_data;
size_t module_data_size;
} YR_MODULE_IMPORT;
int yr_modules_initialize(void);
int yr_modules_finalize(void);
int yr_modules_do_declarations(
const char* module_name,
YR_OBJECT* main_structure);
int yr_modules_load(
const char* module_name,
YR_SCAN_CONTEXT* context);
int yr_modules_unload_all(
YR_SCAN_CONTEXT* context);
#endif
pluginsdk/yara/yara/object.h
+165 -156
View File
@@ -1,156 +1,165 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_OBJECT_H
#define YR_OBJECT_H
#ifdef _MSC_VER
#include <float.h>
#define isnan _isnan
#define INFINITY (DBL_MAX + DBL_MAX)
#define NAN (INFINITY-INFINITY)
#endif
#include "types.h"
#define OBJECT_CREATE 1
#define OBJECT_TYPE_INTEGER 1
#define OBJECT_TYPE_STRING 2
#define OBJECT_TYPE_STRUCTURE 3
#define OBJECT_TYPE_ARRAY 4
#define OBJECT_TYPE_FUNCTION 5
#define OBJECT_TYPE_REGEXP 6
#define OBJECT_TYPE_DICTIONARY 7
#define OBJECT_TYPE_FLOAT 8
int yr_object_create(
int8_t type,
const char* identifier,
YR_OBJECT* parent,
YR_OBJECT** object);
int yr_object_function_create(
const char* identifier,
const char* arguments_fmt,
const char* return_fmt,
YR_MODULE_FUNC func,
YR_OBJECT* parent,
YR_OBJECT** function);
int yr_object_from_external_variable(
YR_EXTERNAL_VARIABLE* external,
YR_OBJECT** object);
void yr_object_destroy(
YR_OBJECT* object);
YR_OBJECT* yr_object_lookup_field(
YR_OBJECT* object,
const char* field_name);
YR_OBJECT* yr_object_lookup(
YR_OBJECT* root,
int flags,
const char* pattern,
...);
int yr_object_has_undefined_value(
YR_OBJECT* object,
const char* field,
...);
int64_t yr_object_get_integer(
YR_OBJECT* object,
const char* field,
...);
SIZED_STRING* yr_object_get_string(
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_integer(
int64_t value,
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_float(
double value,
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_string(
const char* value,
size_t len,
YR_OBJECT* object,
const char* field,
...);
YR_OBJECT* yr_object_array_get_item(
YR_OBJECT* object,
int flags,
int index);
int yr_object_array_set_item(
YR_OBJECT* object,
YR_OBJECT* item,
int index);
YR_OBJECT* yr_object_dict_get_item(
YR_OBJECT* object,
int flags,
const char* key);
int yr_object_dict_set_item(
YR_OBJECT* object,
YR_OBJECT* item,
const char* key);
int yr_object_structure_set_member(
YR_OBJECT* object,
YR_OBJECT* member);
YR_OBJECT* yr_object_get_root(
YR_OBJECT* object);
void yr_object_print_data(
YR_OBJECT* object,
int indent);
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_OBJECT_H
#define YR_OBJECT_H
#ifdef _MSC_VER
#include <float.h>
#define isnan _isnan
#ifndef INFINITY
#define INFINITY (DBL_MAX + DBL_MAX)
#endif
#ifndef NAN
#define NAN (INFINITY-INFINITY)
#endif
#endif
#include "types.h"
#define OBJECT_CREATE 1
#define OBJECT_TYPE_INTEGER 1
#define OBJECT_TYPE_STRING 2
#define OBJECT_TYPE_STRUCTURE 3
#define OBJECT_TYPE_ARRAY 4
#define OBJECT_TYPE_FUNCTION 5
#define OBJECT_TYPE_REGEXP 6
#define OBJECT_TYPE_DICTIONARY 7
#define OBJECT_TYPE_FLOAT 8
int yr_object_create(
int8_t type,
const char* identifier,
YR_OBJECT* parent,
YR_OBJECT** object);
int yr_object_function_create(
const char* identifier,
const char* arguments_fmt,
const char* return_fmt,
YR_MODULE_FUNC func,
YR_OBJECT* parent,
YR_OBJECT** function);
int yr_object_from_external_variable(
YR_EXTERNAL_VARIABLE* external,
YR_OBJECT** object);
void yr_object_destroy(
YR_OBJECT* object);
YR_OBJECT* yr_object_lookup_field(
YR_OBJECT* object,
const char* field_name);
YR_OBJECT* yr_object_lookup(
YR_OBJECT* root,
int flags,
const char* pattern,
...);
int yr_object_has_undefined_value(
YR_OBJECT* object,
const char* field,
...);
int64_t yr_object_get_integer(
YR_OBJECT* object,
const char* field,
...);
SIZED_STRING* yr_object_get_string(
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_integer(
int64_t value,
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_float(
double value,
YR_OBJECT* object,
const char* field,
...);
int yr_object_set_string(
const char* value,
size_t len,
YR_OBJECT* object,
const char* field,
...);
YR_OBJECT* yr_object_array_get_item(
YR_OBJECT* object,
int flags,
int index);
int yr_object_array_set_item(
YR_OBJECT* object,
YR_OBJECT* item,
int index);
YR_OBJECT* yr_object_dict_get_item(
YR_OBJECT* object,
int flags,
const char* key);
int yr_object_dict_set_item(
YR_OBJECT* object,
YR_OBJECT* item,
const char* key);
int yr_object_structure_set_member(
YR_OBJECT* object,
YR_OBJECT* member);
YR_OBJECT* yr_object_get_root(
YR_OBJECT* object);
YR_API void yr_object_print_data(
YR_OBJECT* object,
int indent,
int print_identifier);
#endif
pluginsdk/yara/yara/parser.h
+125 -120
View File
@@ -1,120 +1,125 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_PARSER_H
#define YR_PARSER_H
#include "lexer.h"
int yr_parser_emit(
yyscan_t yyscanner,
int8_t instruction,
int8_t** instruction_address);
int yr_parser_emit_with_arg(
yyscan_t yyscanner,
int8_t instruction,
int64_t argument,
int8_t** instruction_address);
int yr_parser_emit_with_arg_double(
yyscan_t yyscanner,
int8_t instruction,
double argument,
int8_t** instruction_address);
int yr_parser_emit_with_arg_reloc(
yyscan_t yyscanner,
int8_t instruction,
int64_t argument,
int8_t** instruction_address);
int yr_parser_check_types(
YR_COMPILER* compiler,
YR_OBJECT_FUNCTION* function,
const char* actual_args_fmt);
YR_STRING* yr_parser_lookup_string(
yyscan_t yyscanner,
const char* identifier);
int yr_parser_lookup_loop_variable(
yyscan_t yyscanner,
const char* identifier);
int yr_parser_reduce_rule_declaration(
yyscan_t yyscanner,
int flags,
const char* identifier,
char* tags,
YR_STRING* strings,
YR_META* metas);
YR_STRING* yr_parser_reduce_string_declaration(
yyscan_t yyscanner,
int flags,
const char* identifier,
SIZED_STRING* str);
YR_META* yr_parser_reduce_meta_declaration(
yyscan_t yyscanner,
int32_t type,
const char* identifier,
const char* string,
int32_t integer);
int yr_parser_reduce_string_identifier(
yyscan_t yyscanner,
const char* identifier,
int8_t instruction,
uint64_t at_offset);
int yr_parser_emit_pushes_for_strings(
yyscan_t yyscanner,
const char* identifier);
int yr_parser_reduce_external(
yyscan_t yyscanner,
const char* identifier,
int8_t intruction);
int yr_parser_reduce_import(
yyscan_t yyscanner,
SIZED_STRING* module_name);
int yr_parser_reduce_operation(
yyscan_t yyscanner,
const char* operation,
EXPRESSION left_operand,
EXPRESSION right_operand);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_PARSER_H
#define YR_PARSER_H
#include "lexer.h"
int yr_parser_emit(
yyscan_t yyscanner,
uint8_t instruction,
uint8_t** instruction_address);
int yr_parser_emit_with_arg(
yyscan_t yyscanner,
uint8_t instruction,
int64_t argument,
uint8_t** instruction_address,
int64_t** argument_address);
int yr_parser_emit_with_arg_double(
yyscan_t yyscanner,
uint8_t instruction,
double argument,
uint8_t** instruction_address,
double** argument_address);
int yr_parser_emit_with_arg_reloc(
yyscan_t yyscanner,
uint8_t instruction,
int64_t argument,
uint8_t** instruction_address,
int64_t** argument_address);
int yr_parser_check_types(
YR_COMPILER* compiler,
YR_OBJECT_FUNCTION* function,
const char* actual_args_fmt);
YR_STRING* yr_parser_lookup_string(
yyscan_t yyscanner,
const char* identifier);
int yr_parser_lookup_loop_variable(
yyscan_t yyscanner,
const char* identifier);
YR_RULE* yr_parser_reduce_rule_declaration_phase_1(
yyscan_t yyscanner,
int32_t flags,
const char* identifier);
int yr_parser_reduce_rule_declaration_phase_2(
yyscan_t yyscanner,
YR_RULE* rule);
YR_STRING* yr_parser_reduce_string_declaration(
yyscan_t yyscanner,
int32_t flags,
const char* identifier,
SIZED_STRING* str);
YR_META* yr_parser_reduce_meta_declaration(
yyscan_t yyscanner,
int32_t type,
const char* identifier,
const char* string,
int64_t integer);
int yr_parser_reduce_string_identifier(
yyscan_t yyscanner,
const char* identifier,
uint8_t instruction,
uint64_t at_offset);
int yr_parser_emit_pushes_for_strings(
yyscan_t yyscanner,
const char* identifier);
int yr_parser_reduce_external(
yyscan_t yyscanner,
const char* identifier,
uint8_t intruction);
int yr_parser_reduce_import(
yyscan_t yyscanner,
SIZED_STRING* module_name);
int yr_parser_reduce_operation(
yyscan_t yyscanner,
const char* operation,
EXPRESSION left_operand,
EXPRESSION right_operand);
#endif
pluginsdk/yara/yara/pe.h
+501 -491
View File
@@ -1,491 +1,501 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma pack(push, 1)
#ifdef _WIN32
#include <windows.h>
// These definitions are not present in older Windows headers.
#ifndef IMAGE_FILE_MACHINE_ARMNT
#define IMAGE_FILE_MACHINE_ARMNT 0x01c4
#endif
#ifndef IMAGE_FILE_MACHINE_ARM64
#define IMAGE_FILE_MACHINE_ARM64 0xaa64
#endif
#else
#include <stdint.h>
#include <stdlib.h>
typedef uint8_t BYTE;
typedef uint16_t WORD;
typedef uint32_t DWORD;
typedef int32_t LONG;
typedef uint32_t ULONG;
typedef uint64_t ULONGLONG;
#define FIELD_OFFSET(type, field) ((size_t)&(((type *)0)->field))
#ifndef _MAC
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
#define IMAGE_OS2_SIGNATURE 0x454E // NE
#define IMAGE_OS2_SIGNATURE_LE 0x454C // LE
#define IMAGE_VXD_SIGNATURE 0x454C // LE
#define IMAGE_NT_SIGNATURE 0x00004550 // PE00
#else
#define IMAGE_DOS_SIGNATURE 0x4D5A // MZ
#define IMAGE_OS2_SIGNATURE 0x4E45 // NE
#define IMAGE_OS2_SIGNATURE_LE 0x4C45 // LE
#define IMAGE_NT_SIGNATURE 0x50450000 // PE00
#endif
#pragma pack(push, 2)
typedef struct _IMAGE_DOS_HEADER // DOS .EXE header
{
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
LONG e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
#pragma pack(pop)
//
// File header format.
//
#pragma pack(push,4)
typedef struct _IMAGE_FILE_HEADER
{
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
#define IMAGE_SIZEOF_FILE_HEADER 20
#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Agressively trim working set
#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses
#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
#define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
#define IMAGE_FILE_SYSTEM 0x1000 // System File.
#define IMAGE_FILE_DLL 0x2000 // File is a DLL.
#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
#define IMAGE_FILE_MACHINE_UNKNOWN 0x0000
#define IMAGE_FILE_MACHINE_AM33 0x01d3
#define IMAGE_FILE_MACHINE_AMD64 0x8664
#define IMAGE_FILE_MACHINE_ARM 0x01c0
#define IMAGE_FILE_MACHINE_ARMNT 0x01c4
#define IMAGE_FILE_MACHINE_ARM64 0xaa64
#define IMAGE_FILE_MACHINE_EBC 0x0ebc
#define IMAGE_FILE_MACHINE_I386 0x014c
#define IMAGE_FILE_MACHINE_IA64 0x0200
#define IMAGE_FILE_MACHINE_M32R 0x9041
#define IMAGE_FILE_MACHINE_MIPS16 0x0266
#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366
#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466
#define IMAGE_FILE_MACHINE_POWERPC 0x01f0
#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1
#define IMAGE_FILE_MACHINE_R4000 0x0166
#define IMAGE_FILE_MACHINE_SH3 0x01a2
#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3
#define IMAGE_FILE_MACHINE_SH4 0x01a6
#define IMAGE_FILE_MACHINE_SH5 0x01a8
#define IMAGE_FILE_MACHINE_THUMB 0x01c2
#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169
// Section characteristics
#define IMAGE_SCN_CNT_CODE 0x00000020
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
#define IMAGE_SCN_GPREL 0x00008000
#define IMAGE_SCN_MEM_16BIT 0x00020000
#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
#define IMAGE_SCN_MEM_SHARED 0x10000000
#define IMAGE_SCN_MEM_EXECUTE 0x20000000
#define IMAGE_SCN_MEM_READ 0x40000000
#define IMAGE_SCN_MEM_WRITE 0x80000000
//
// Directory format.
//
typedef struct _IMAGE_DATA_DIRECTORY
{
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
//
// Optional header format.
//
typedef struct _IMAGE_OPTIONAL_HEADER32
{
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_OPTIONAL_HEADER64
{
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
typedef struct _IMAGE_NT_HEADERS32
{
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
typedef struct _IMAGE_NT_HEADERS64
{
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
// IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is
// the same either way.
#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
((BYTE*)ntheader + \
FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \
((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \
))
// Subsystem Values
#define IMAGE_SUBSYSTEM_UNKNOWN 0 // Unknown subsystem.
#define IMAGE_SUBSYSTEM_NATIVE 1 // Image doesn't require a subsystem.
#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 // Image runs in the Windows GUI subsystem.
#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 // Image runs in the Windows character subsystem.
#define IMAGE_SUBSYSTEM_OS2_CUI 5 // image runs in the OS/2 character subsystem.
#define IMAGE_SUBSYSTEM_POSIX_CUI 7 // image runs in the Posix character subsystem.
#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8 // image is a native Win9x driver.
//
// Section header format.
//
#define IMAGE_SIZEOF_SHORT_NAME 8
typedef struct _IMAGE_SECTION_HEADER
{
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union
{
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
#define IMAGE_SIZEOF_SECTION_HEADER 40
typedef struct _IMAGE_EXPORT_DIRECTORY
{
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
DWORD Name;
DWORD Base;
DWORD NumberOfFunctions;
DWORD NumberOfNames;
DWORD AddressOfFunctions;
DWORD AddressOfNames;
DWORD AddressOfNameOrdinals;
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
typedef struct _IMAGE_IMPORT_DESCRIPTOR
{
union
{
DWORD Characteristics;
DWORD OriginalFirstThunk;
} ;
DWORD TimeDateStamp;
DWORD ForwarderChain;
DWORD Name;
DWORD FirstThunk;
} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
typedef struct _IMAGE_IMPORT_BY_NAME
{
WORD Hint;
BYTE Name[1];
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
typedef struct _IMAGE_THUNK_DATA32
{
union
{
DWORD ForwarderString;
DWORD Function;
DWORD Ordinal;
DWORD AddressOfData;
} u1;
} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
#define IMAGE_ORDINAL_FLAG32 0x80000000
#define IMAGE_ORDINAL_FLAG64 0x8000000000000000L
typedef struct _IMAGE_THUNK_DATA64
{
union
{
ULONGLONG ForwarderString;
ULONGLONG Function;
ULONGLONG Ordinal;
ULONGLONG AddressOfData;
} u1;
} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
{
DWORD Name;
DWORD OffsetToData;
} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
typedef struct _IMAGE_RESOURCE_DATA_ENTRY
{
DWORD OffsetToData;
DWORD Size;
DWORD CodePage;
DWORD Reserved;
} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
typedef struct _IMAGE_RESOURCE_DIRECTORY
{
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
WORD NumberOfNamedEntries;
WORD NumberOfIdEntries;
} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
#pragma pack(pop)
#endif // _WIN32
typedef struct _VERSION_INFO
{
WORD Length;
WORD ValueLength;
WORD Type;
char Key[0];
} VERSION_INFO, *PVERSION_INFO;
#define WIN_CERT_REVISION_1_0 0x0100
#define WIN_CERT_REVISION_2_0 0x0200
#define WIN_CERT_TYPE_X509 0x0001
#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
#define WIN_CERT_TYPE_RESERVED_1 0x0003
#define WIN_CERT_TYPE_TS_STACK_SIGNED 0x0004
typedef struct _WIN_CERTIFICATE
{
DWORD Length;
WORD Revision;
WORD CertificateType;
BYTE Certificate[1];
} WIN_CERTIFICATE, *PWIN_CERTIFICATE;
//
// Rich signature.
// http://www.ntcore.com/files/richsign.htm
//
typedef struct _RICH_SIGNATURE
{
DWORD dans;
DWORD key1;
DWORD key2;
DWORD key3;
} RICH_SIGNATURE, *PRICH_SIGNATURE;
#define RICH_DANS 0x536e6144 // "DanS"
#define RICH_RICH 0x68636952 // "Rich"
typedef struct _RICH_DATA
{
size_t len;
BYTE* raw_data;
BYTE* clear_data;
} RICH_DATA, *PRICH_DATA;
#pragma pack(pop)
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma pack(push, 1)
#if defined(_WIN32) || defined(__CYGWIN__)
#include <windows.h>
// These definitions are not present in older Windows headers.
#ifndef IMAGE_FILE_MACHINE_ARMNT
#define IMAGE_FILE_MACHINE_ARMNT 0x01c4
#endif
#ifndef IMAGE_FILE_MACHINE_ARM64
#define IMAGE_FILE_MACHINE_ARM64 0xaa64
#endif
#else
#include <stdint.h>
#include <stdlib.h>
typedef uint8_t BYTE;
typedef uint16_t WORD;
typedef uint32_t DWORD;
typedef int32_t LONG;
typedef uint32_t ULONG;
typedef uint64_t ULONGLONG;
#define FIELD_OFFSET(type, field) ((size_t)&(((type *)0)->field))
#ifndef _MAC
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
#define IMAGE_OS2_SIGNATURE 0x454E // NE
#define IMAGE_OS2_SIGNATURE_LE 0x454C // LE
#define IMAGE_VXD_SIGNATURE 0x454C // LE
#define IMAGE_NT_SIGNATURE 0x00004550 // PE00
#else
#define IMAGE_DOS_SIGNATURE 0x4D5A // MZ
#define IMAGE_OS2_SIGNATURE 0x4E45 // NE
#define IMAGE_OS2_SIGNATURE_LE 0x4C45 // LE
#define IMAGE_NT_SIGNATURE 0x50450000 // PE00
#endif
#pragma pack(push, 2)
typedef struct _IMAGE_DOS_HEADER // DOS .EXE header
{
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
LONG e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
#pragma pack(pop)
//
// File header format.
//
#pragma pack(push,4)
typedef struct _IMAGE_FILE_HEADER
{
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
#define IMAGE_SIZEOF_FILE_HEADER 20
#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Agressively trim working set
#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses
#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
#define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
#define IMAGE_FILE_SYSTEM 0x1000 // System File.
#define IMAGE_FILE_DLL 0x2000 // File is a DLL.
#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
#define IMAGE_FILE_MACHINE_UNKNOWN 0x0000
#define IMAGE_FILE_MACHINE_AM33 0x01d3
#define IMAGE_FILE_MACHINE_AMD64 0x8664
#define IMAGE_FILE_MACHINE_ARM 0x01c0
#define IMAGE_FILE_MACHINE_ARMNT 0x01c4
#define IMAGE_FILE_MACHINE_ARM64 0xaa64
#define IMAGE_FILE_MACHINE_EBC 0x0ebc
#define IMAGE_FILE_MACHINE_I386 0x014c
#define IMAGE_FILE_MACHINE_IA64 0x0200
#define IMAGE_FILE_MACHINE_M32R 0x9041
#define IMAGE_FILE_MACHINE_MIPS16 0x0266
#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366
#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466
#define IMAGE_FILE_MACHINE_POWERPC 0x01f0
#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1
#define IMAGE_FILE_MACHINE_R4000 0x0166
#define IMAGE_FILE_MACHINE_SH3 0x01a2
#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3
#define IMAGE_FILE_MACHINE_SH4 0x01a6
#define IMAGE_FILE_MACHINE_SH5 0x01a8
#define IMAGE_FILE_MACHINE_THUMB 0x01c2
#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169
// Section characteristics
#define IMAGE_SCN_CNT_CODE 0x00000020
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
#define IMAGE_SCN_GPREL 0x00008000
#define IMAGE_SCN_MEM_16BIT 0x00020000
#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
#define IMAGE_SCN_MEM_SHARED 0x10000000
#define IMAGE_SCN_MEM_EXECUTE 0x20000000
#define IMAGE_SCN_MEM_READ 0x40000000
#define IMAGE_SCN_MEM_WRITE 0x80000000
//
// Directory format.
//
typedef struct _IMAGE_DATA_DIRECTORY
{
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
//
// Optional header format.
//
typedef struct _IMAGE_OPTIONAL_HEADER32
{
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_OPTIONAL_HEADER64
{
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
typedef struct _IMAGE_NT_HEADERS32
{
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
typedef struct _IMAGE_NT_HEADERS64
{
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
// IMAGE_FIRST_SECTION doesn't need 32/64 versions since the file header is
// the same either way.
#define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
((BYTE*)ntheader + \
FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) + \
((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \
))
// Subsystem Values
#define IMAGE_SUBSYSTEM_UNKNOWN 0 // Unknown subsystem.
#define IMAGE_SUBSYSTEM_NATIVE 1 // Image doesn't require a subsystem.
#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 // Image runs in the Windows GUI subsystem.
#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 // Image runs in the Windows character subsystem.
#define IMAGE_SUBSYSTEM_OS2_CUI 5 // image runs in the OS/2 character subsystem.
#define IMAGE_SUBSYSTEM_POSIX_CUI 7 // image runs in the Posix character subsystem.
#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8 // image is a native Win9x driver.
//
// Section header format.
//
#define IMAGE_SIZEOF_SHORT_NAME 8
typedef struct _IMAGE_SECTION_HEADER
{
BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
union
{
DWORD PhysicalAddress;
DWORD VirtualSize;
} Misc;
DWORD VirtualAddress;
DWORD SizeOfRawData;
DWORD PointerToRawData;
DWORD PointerToRelocations;
DWORD PointerToLinenumbers;
WORD NumberOfRelocations;
WORD NumberOfLinenumbers;
DWORD Characteristics;
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
#define IMAGE_SIZEOF_SECTION_HEADER 40
typedef struct _IMAGE_EXPORT_DIRECTORY
{
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
DWORD Name;
DWORD Base;
DWORD NumberOfFunctions;
DWORD NumberOfNames;
DWORD AddressOfFunctions;
DWORD AddressOfNames;
DWORD AddressOfNameOrdinals;
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
typedef struct _IMAGE_IMPORT_DESCRIPTOR
{
union
{
DWORD Characteristics;
DWORD OriginalFirstThunk;
} ;
DWORD TimeDateStamp;
DWORD ForwarderChain;
DWORD Name;
DWORD FirstThunk;
} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
typedef struct _IMAGE_IMPORT_BY_NAME
{
WORD Hint;
BYTE Name[1];
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
typedef struct _IMAGE_THUNK_DATA32
{
union
{
DWORD ForwarderString;
DWORD Function;
DWORD Ordinal;
DWORD AddressOfData;
} u1;
} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
#define IMAGE_ORDINAL_FLAG32 0x80000000
#define IMAGE_ORDINAL_FLAG64 0x8000000000000000L
typedef struct _IMAGE_THUNK_DATA64
{
union
{
ULONGLONG ForwarderString;
ULONGLONG Function;
ULONGLONG Ordinal;
ULONGLONG AddressOfData;
} u1;
} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
{
DWORD Name;
DWORD OffsetToData;
} IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
typedef struct _IMAGE_RESOURCE_DATA_ENTRY
{
DWORD OffsetToData;
DWORD Size;
DWORD CodePage;
DWORD Reserved;
} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
typedef struct _IMAGE_RESOURCE_DIRECTORY
{
DWORD Characteristics;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD MinorVersion;
WORD NumberOfNamedEntries;
WORD NumberOfIdEntries;
} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
#pragma pack(pop)
#endif // _WIN32
typedef struct _VERSION_INFO
{
WORD Length;
WORD ValueLength;
WORD Type;
char Key[0];
} VERSION_INFO, *PVERSION_INFO;
#define WIN_CERT_REVISION_1_0 0x0100
#define WIN_CERT_REVISION_2_0 0x0200
#define WIN_CERT_TYPE_X509 0x0001
#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
#define WIN_CERT_TYPE_RESERVED_1 0x0003
#define WIN_CERT_TYPE_TS_STACK_SIGNED 0x0004
typedef struct _WIN_CERTIFICATE
{
DWORD Length;
WORD Revision;
WORD CertificateType;
BYTE Certificate[0];
} WIN_CERTIFICATE, *PWIN_CERTIFICATE;
//
// Rich signature.
// http://www.ntcore.com/files/richsign.htm
//
#define RICH_VERSION_ID(id_version) (id_version >> 16)
#define RICH_VERSION_VERSION(id_version) (id_version & 0xFFFF)
typedef struct _RICH_VERSION_INFO
{
DWORD id_version; //tool id and version (use RICH_VERSION_ID and RICH_VERSION_VERSION macros)
DWORD times; //number of times this tool was used
} RICH_VERSION_INFO, *PRICH_VERSION_INFO;
typedef struct _RICH_SIGNATURE
{
DWORD dans;
DWORD key1;
DWORD key2;
DWORD key3;
RICH_VERSION_INFO versions[0];
} RICH_SIGNATURE, *PRICH_SIGNATURE;
#define RICH_DANS 0x536e6144 // "DanS"
#define RICH_RICH 0x68636952 // "Rich"
typedef struct _RICH_DATA
{
size_t len;
BYTE* raw_data;
BYTE* clear_data;
} RICH_DATA, *PRICH_DATA;
#pragma pack(pop)
pluginsdk/yara/yara/proc.h
+26 -26
View File
@@ -1,26 +1,26 @@
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_PROC_H
#define YR_PROC_H
#include "types.h"
int yr_process_get_memory(
int pid,
YR_MEMORY_BLOCK** first_block);
#endif
/*
Copyright (c) 2007. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_PROC_H
#define YR_PROC_H
#include "types.h"
int yr_process_get_memory(
int pid,
YR_MEMORY_BLOCK** first_block);
#endif
pluginsdk/yara/yara/re.h
+243 -240
View File
@@ -1,240 +1,243 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_RE_H
#define YR_RE_H
#include <ctype.h>
#include "arena.h"
#include "sizedstr.h"
#define RE_NODE_LITERAL 1
#define RE_NODE_MASKED_LITERAL 2
#define RE_NODE_ANY 3
#define RE_NODE_CONCAT 4
#define RE_NODE_ALT 5
#define RE_NODE_RANGE 6
#define RE_NODE_STAR 7
#define RE_NODE_PLUS 8
#define RE_NODE_CLASS 9
#define RE_NODE_WORD_CHAR 10
#define RE_NODE_NON_WORD_CHAR 11
#define RE_NODE_SPACE 12
#define RE_NODE_NON_SPACE 13
#define RE_NODE_DIGIT 14
#define RE_NODE_NON_DIGIT 15
#define RE_NODE_EMPTY 16
#define RE_NODE_ANCHOR_START 17
#define RE_NODE_ANCHOR_END 18
#define RE_NODE_WORD_BOUNDARY 19
#define RE_NODE_NON_WORD_BOUNDARY 20
#define RE_OPCODE_ANY 0xA0
#define RE_OPCODE_ANY_EXCEPT_NEW_LINE 0xA1
#define RE_OPCODE_LITERAL 0xA2
#define RE_OPCODE_LITERAL_NO_CASE 0xA3
#define RE_OPCODE_MASKED_LITERAL 0xA4
#define RE_OPCODE_CLASS 0xA5
#define RE_OPCODE_CLASS_NO_CASE 0xA6
#define RE_OPCODE_WORD_CHAR 0xA7
#define RE_OPCODE_NON_WORD_CHAR 0xA8
#define RE_OPCODE_SPACE 0xA9
#define RE_OPCODE_NON_SPACE 0xAA
#define RE_OPCODE_DIGIT 0xAB
#define RE_OPCODE_NON_DIGIT 0xAC
#define RE_OPCODE_MATCH 0xAD
#define RE_OPCODE_MATCH_AT_END 0xB0
#define RE_OPCODE_MATCH_AT_START 0xB1
#define RE_OPCODE_WORD_BOUNDARY 0xB2
#define RE_OPCODE_NON_WORD_BOUNDARY 0xB3
#define RE_OPCODE_SPLIT_A 0xC0
#define RE_OPCODE_SPLIT_B 0xC1
#define RE_OPCODE_PUSH 0xC2
#define RE_OPCODE_POP 0xC3
#define RE_OPCODE_JNZ 0xC4
#define RE_OPCODE_JUMP 0xC5
#define RE_FLAGS_FAST_HEX_REGEXP 0x02
#define RE_FLAGS_BACKWARDS 0x04
#define RE_FLAGS_EXHAUSTIVE 0x08
#define RE_FLAGS_WIDE 0x10
#define RE_FLAGS_NO_CASE 0x20
#define RE_FLAGS_SCAN 0x40
#define RE_FLAGS_DOT_ALL 0x80
#define RE_FLAGS_NOT_AT_START 0x100
typedef struct RE RE;
typedef struct RE_NODE RE_NODE;
typedef struct RE_ERROR RE_ERROR;
typedef uint8_t* RE_CODE;
#define CHAR_IN_CLASS(chr, cls) \
((cls)[(chr) / 8] & 1 << ((chr) % 8))
#define IS_WORD_CHAR(chr) \
(isalnum(chr) || (chr) == '_')
struct RE_NODE
{
int type;
union
{
int value;
int count;
int start;
};
union
{
int mask;
int end;
};
int greedy;
uint8_t* class_vector;
RE_NODE* left;
RE_NODE* right;
RE_CODE forward_code;
RE_CODE backward_code;
};
struct RE
{
uint32_t flags;
RE_NODE* root_node;
YR_ARENA* code_arena;
RE_CODE code;
};
struct RE_ERROR
{
char message[512];
};
typedef int RE_MATCH_CALLBACK_FUNC(
uint8_t* match,
int match_length,
int flags,
void* args);
int yr_re_create(
RE** re);
int yr_re_parse(
const char* re_string,
int flags,
RE** re,
RE_ERROR* error);
int yr_re_parse_hex(
const char* hex_string,
int flags,
RE** re,
RE_ERROR* error);
int yr_re_compile(
const char* re_string,
int flags,
YR_ARENA* code_arena,
RE** re,
RE_ERROR* error);
void yr_re_destroy(
RE* re);
void yr_re_print(
RE* re);
RE_NODE* yr_re_node_create(
int type,
RE_NODE* left,
RE_NODE* right);
void yr_re_node_destroy(
RE_NODE* node);
SIZED_STRING* yr_re_extract_literal(
RE* re);
int yr_re_contains_dot_star(
RE* re);
int yr_re_split_at_chaining_point(
RE* re,
RE** result_re,
RE** remainder_re,
int32_t* min_gap,
int32_t* max_gap);
int yr_re_emit_code(
RE* re,
YR_ARENA* arena);
int yr_re_exec(
RE_CODE re_code,
uint8_t* input,
size_t input_size,
int flags,
RE_MATCH_CALLBACK_FUNC callback,
void* callback_args);
int yr_re_match(
RE_CODE re_code,
const char* target);
int yr_re_initialize(void);
int yr_re_finalize(void);
int yr_re_finalize_thread(void);
#endif
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_RE_H
#define YR_RE_H
#include <ctype.h>
#include "arena.h"
#include "sizedstr.h"
#define RE_NODE_LITERAL 1
#define RE_NODE_MASKED_LITERAL 2
#define RE_NODE_ANY 3
#define RE_NODE_CONCAT 4
#define RE_NODE_ALT 5
#define RE_NODE_RANGE 6
#define RE_NODE_STAR 7
#define RE_NODE_PLUS 8
#define RE_NODE_CLASS 9
#define RE_NODE_WORD_CHAR 10
#define RE_NODE_NON_WORD_CHAR 11
#define RE_NODE_SPACE 12
#define RE_NODE_NON_SPACE 13
#define RE_NODE_DIGIT 14
#define RE_NODE_NON_DIGIT 15
#define RE_NODE_EMPTY 16
#define RE_NODE_ANCHOR_START 17
#define RE_NODE_ANCHOR_END 18
#define RE_NODE_WORD_BOUNDARY 19
#define RE_NODE_NON_WORD_BOUNDARY 20
#define RE_OPCODE_ANY 0xA0
#define RE_OPCODE_ANY_EXCEPT_NEW_LINE 0xA1
#define RE_OPCODE_LITERAL 0xA2
#define RE_OPCODE_LITERAL_NO_CASE 0xA3
#define RE_OPCODE_MASKED_LITERAL 0xA4
#define RE_OPCODE_CLASS 0xA5
#define RE_OPCODE_CLASS_NO_CASE 0xA6
#define RE_OPCODE_WORD_CHAR 0xA7
#define RE_OPCODE_NON_WORD_CHAR 0xA8
#define RE_OPCODE_SPACE 0xA9
#define RE_OPCODE_NON_SPACE 0xAA
#define RE_OPCODE_DIGIT 0xAB
#define RE_OPCODE_NON_DIGIT 0xAC
#define RE_OPCODE_MATCH 0xAD
#define RE_OPCODE_MATCH_AT_END 0xB0
#define RE_OPCODE_MATCH_AT_START 0xB1
#define RE_OPCODE_WORD_BOUNDARY 0xB2
#define RE_OPCODE_NON_WORD_BOUNDARY 0xB3
#define RE_OPCODE_SPLIT_A 0xC0
#define RE_OPCODE_SPLIT_B 0xC1
#define RE_OPCODE_PUSH 0xC2
#define RE_OPCODE_POP 0xC3
#define RE_OPCODE_JNZ 0xC4
#define RE_OPCODE_JUMP 0xC5
#define RE_FLAGS_FAST_HEX_REGEXP 0x02
#define RE_FLAGS_BACKWARDS 0x04
#define RE_FLAGS_EXHAUSTIVE 0x08
#define RE_FLAGS_WIDE 0x10
#define RE_FLAGS_NO_CASE 0x20
#define RE_FLAGS_SCAN 0x40
#define RE_FLAGS_DOT_ALL 0x80
#define RE_FLAGS_NOT_AT_START 0x100
#define RE_FLAGS_GREEDY 0x400
#define RE_FLAGS_UNGREEDY 0x800
typedef struct RE RE;
typedef struct RE_NODE RE_NODE;
typedef struct RE_ERROR RE_ERROR;
typedef uint8_t RE_SPLIT_ID_TYPE;
typedef uint8_t* RE_CODE;
#define CHAR_IN_CLASS(chr, cls) \
((cls)[(chr) / 8] & 1 << ((chr) % 8))
#define IS_WORD_CHAR(chr) \
(isalnum(chr) || (chr) == '_')
struct RE_NODE
{
int type;
union
{
int value;
int count;
int start;
};
union
{
int mask;
int end;
};
int greedy;
uint8_t* class_vector;
RE_NODE* left;
RE_NODE* right;
RE_CODE forward_code;
RE_CODE backward_code;
};
struct RE
{
uint32_t flags;
RE_NODE* root_node;
YR_ARENA* code_arena;
RE_CODE code;
};
struct RE_ERROR
{
char message[512];
};
typedef int RE_MATCH_CALLBACK_FUNC(
uint8_t* match,
int match_length,
int flags,
void* args);
int yr_re_create(
RE** re);
int yr_re_parse(
const char* re_string,
int flags,
RE** re,
RE_ERROR* error);
int yr_re_parse_hex(
const char* hex_string,
int flags,
RE** re,
RE_ERROR* error);
int yr_re_compile(
const char* re_string,
int flags,
YR_ARENA* code_arena,
RE** re,
RE_ERROR* error);
void yr_re_destroy(
RE* re);
void yr_re_print(
RE* re);
RE_NODE* yr_re_node_create(
int type,
RE_NODE* left,
RE_NODE* right);
void yr_re_node_destroy(
RE_NODE* node);
SIZED_STRING* yr_re_extract_literal(
RE* re);
int yr_re_contains_dot_star(
RE* re);
int yr_re_split_at_chaining_point(
RE* re,
RE** result_re,
RE** remainder_re,
int32_t* min_gap,
int32_t* max_gap);
int yr_re_emit_code(
RE* re,
YR_ARENA* arena);
int yr_re_exec(
RE_CODE re_code,
uint8_t* input,
size_t input_size,
int flags,
RE_MATCH_CALLBACK_FUNC callback,
void* callback_args);
int yr_re_match(
RE_CODE re_code,
const char* target);
int yr_re_initialize(void);
int yr_re_finalize(void);
int yr_re_finalize_thread(void);
#endif
pluginsdk/yara/yara/re_lexer.h
+97 -97
View File
@@ -1,97 +1,97 @@
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_FATAL_ERROR
#undef YY_DECL
#undef LEX_ENV
#define yyparse re_yyparse
#define yylex re_yylex
#define yyerror re_yyerror
#define yyfatal re_yyfatal
#define yychar re_yychar
#define yydebug re_yydebug
#define yynerrs re_yynerrs
#define yyget_extra re_yyget_extra
#define yyget_lineno re_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#define YY_EXTRA_TYPE RE*
#define YY_USE_CONST
typedef struct _RE_LEX_ENVIRONMENT
{
int negated_class;
uint8_t class_vector[32];
int last_error_code;
char last_error_message[256];
} RE_LEX_ENVIRONMENT;
#define LEX_ENV ((RE_LEX_ENVIRONMENT*) lex_env)
#define YY_FATAL_ERROR(msg) re_yyfatal(yyscanner, msg)
#include <re_grammar.h>
#define YY_DECL int re_yylex \
(YYSTYPE * yylval_param , yyscan_t yyscanner, RE_LEX_ENVIRONMENT* lex_env)
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yylex(
YYSTYPE* yylval_param,
yyscan_t yyscanner,
RE_LEX_ENVIRONMENT* lex_env);
int yyparse(
void* yyscanner,
RE_LEX_ENVIRONMENT* lex_env);
void yyerror(
yyscan_t yyscanner,
RE_LEX_ENVIRONMENT* lex_env,
const char* error_message);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
int yr_parse_re_string(
const char* re_string,
int flags,
RE** re,
RE_ERROR* error);
/*
Copyright (c) 2013. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#undef yyparse
#undef yylex
#undef yyerror
#undef yyfatal
#undef yychar
#undef yydebug
#undef yynerrs
#undef yyget_extra
#undef yyget_lineno
#undef YY_FATAL_ERROR
#undef YY_DECL
#undef LEX_ENV
#define yyparse re_yyparse
#define yylex re_yylex
#define yyerror re_yyerror
#define yyfatal re_yyfatal
#define yychar re_yychar
#define yydebug re_yydebug
#define yynerrs re_yynerrs
#define yyget_extra re_yyget_extra
#define yyget_lineno re_yyget_lineno
#ifndef YY_TYPEDEF_YY_SCANNER_T
#define YY_TYPEDEF_YY_SCANNER_T
typedef void* yyscan_t;
#endif
#define YY_EXTRA_TYPE RE*
#define YY_USE_CONST
typedef struct _RE_LEX_ENVIRONMENT
{
int negated_class;
uint8_t class_vector[32];
int last_error_code;
char last_error_message[256];
} RE_LEX_ENVIRONMENT;
#define LEX_ENV ((RE_LEX_ENVIRONMENT*) lex_env)
#define YY_FATAL_ERROR(msg) re_yyfatal(yyscanner, msg)
#include <re_grammar.h>
#define YY_DECL int re_yylex \
(YYSTYPE * yylval_param , yyscan_t yyscanner, RE_LEX_ENVIRONMENT* lex_env)
YY_EXTRA_TYPE yyget_extra(
yyscan_t yyscanner);
int yylex(
YYSTYPE* yylval_param,
yyscan_t yyscanner,
RE_LEX_ENVIRONMENT* lex_env);
int yyparse(
void* yyscanner,
RE_LEX_ENVIRONMENT* lex_env);
void yyerror(
yyscan_t yyscanner,
RE_LEX_ENVIRONMENT* lex_env,
const char* error_message);
void yyfatal(
yyscan_t yyscanner,
const char* error_message);
int yr_parse_re_string(
const char* re_string,
int flags,
RE** re,
RE_ERROR* error);
pluginsdk/yara/yara/rules.h
+147 -127
View File
@@ -1,127 +1,147 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_RULES_H
#define YR_RULES_H
#include "types.h"
#include "utils.h"
#define CALLBACK_MSG_RULE_MATCHING 1
#define CALLBACK_MSG_RULE_NOT_MATCHING 2
#define CALLBACK_MSG_SCAN_FINISHED 3
#define CALLBACK_MSG_IMPORT_MODULE 4
#define CALLBACK_CONTINUE 0
#define CALLBACK_ABORT 1
#define CALLBACK_ERROR 2
#define yr_rule_tags_foreach(rule, tag_name) \
for (tag_name = rule->tags; \
tag_name != NULL && *tag_name != '\0'; \
tag_name += strlen(tag_name) + 1)
#define yr_rule_metas_foreach(rule, meta) \
for (meta = rule->metas; !META_IS_NULL(meta); meta++)
#define yr_rule_strings_foreach(rule, string) \
for (string = rule->strings; !STRING_IS_NULL(string); string++)
#define yr_string_matches_foreach(string, match) \
for (match = STRING_MATCHES(string).head; match != NULL; match = match->next)
#define yr_rules_foreach(rules, rule) \
for (rule = rules->rules_list_head; !RULE_IS_NULL(rule); rule++)
YR_API int yr_rules_scan_mem(
YR_RULES* rules,
uint8_t* buffer,
size_t buffer_size,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_scan_file(
YR_RULES* rules,
const char* filename,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_scan_proc(
YR_RULES* rules,
int pid,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_save(
YR_RULES* rules,
const char* filename);
YR_API int yr_rules_load(
const char* filename,
YR_RULES** rules);
YR_API int yr_rules_destroy(
YR_RULES* rules);
YR_API int yr_rules_define_integer_variable(
YR_RULES* rules,
const char* identifier,
int64_t value);
YR_API int yr_rules_define_boolean_variable(
YR_RULES* rules,
const char* identifier,
int value);
YR_API int yr_rules_define_float_variable(
YR_RULES* rules,
const char* identifier,
double value);
YR_API int yr_rules_define_string_variable(
YR_RULES* rules,
const char* identifier,
const char* value);
YR_API void yr_rules_print_profiling_info(
YR_RULES* rules);
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_RULES_H
#define YR_RULES_H
#include "types.h"
#include "utils.h"
#include "filemap.h"
#define CALLBACK_MSG_RULE_MATCHING 1
#define CALLBACK_MSG_RULE_NOT_MATCHING 2
#define CALLBACK_MSG_SCAN_FINISHED 3
#define CALLBACK_MSG_IMPORT_MODULE 4
#define CALLBACK_MSG_MODULE_IMPORTED 5
#define CALLBACK_CONTINUE 0
#define CALLBACK_ABORT 1
#define CALLBACK_ERROR 2
#define yr_rule_tags_foreach(rule, tag_name) \
for (tag_name = rule->tags; \
tag_name != NULL && *tag_name != '\0'; \
tag_name += strlen(tag_name) + 1)
#define yr_rule_metas_foreach(rule, meta) \
for (meta = rule->metas; !META_IS_NULL(meta); meta++)
#define yr_rule_strings_foreach(rule, string) \
for (string = rule->strings; !STRING_IS_NULL(string); string++)
#define yr_string_matches_foreach(string, match) \
for (match = STRING_MATCHES(string).head; match != NULL; match = match->next)
#define yr_rules_foreach(rules, rule) \
for (rule = rules->rules_list_head; !RULE_IS_NULL(rule); rule++)
YR_API int yr_rules_scan_mem(
YR_RULES* rules,
uint8_t* buffer,
size_t buffer_size,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_scan_file(
YR_RULES* rules,
const char* filename,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_scan_fd(
YR_RULES* rules,
YR_FILE_DESCRIPTOR fd,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_scan_proc(
YR_RULES* rules,
int pid,
int flags,
YR_CALLBACK_FUNC callback,
void* user_data,
int timeout);
YR_API int yr_rules_save(
YR_RULES* rules,
const char* filename);
YR_API int yr_rules_save_stream(
YR_RULES* rules,
YR_STREAM* stream);
YR_API int yr_rules_load(
const char* filename,
YR_RULES** rules);
YR_API int yr_rules_load_stream(
YR_STREAM* stream,
YR_RULES** rules);
YR_API int yr_rules_destroy(
YR_RULES* rules);
YR_API int yr_rules_define_integer_variable(
YR_RULES* rules,
const char* identifier,
int64_t value);
YR_API int yr_rules_define_boolean_variable(
YR_RULES* rules,
const char* identifier,
int value);
YR_API int yr_rules_define_float_variable(
YR_RULES* rules,
const char* identifier,
double value);
YR_API int yr_rules_define_string_variable(
YR_RULES* rules,
const char* identifier,
const char* value);
YR_API void yr_rules_print_profiling_info(
YR_RULES* rules);
#endif
pluginsdk/yara/yara/scan.h
+35 -35
View File
@@ -1,35 +1,35 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_SCAN_H
#define YR_SCAN_H
#include "types.h"
#define SCAN_FLAGS_FAST_MODE 1
#define SCAN_FLAGS_PROCESS_MEMORY 2
int yr_scan_verify_match(
YR_AC_MATCH* ac_match,
uint8_t* data,
size_t data_size,
size_t data_base,
size_t offset,
YR_ARENA* matches_arena,
int flags);
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_SCAN_H
#define YR_SCAN_H
#include "types.h"
// Bitmasks for flags.
#define SCAN_FLAGS_FAST_MODE 1
#define SCAN_FLAGS_PROCESS_MEMORY 2
int yr_scan_verify_match(
YR_SCAN_CONTEXT* context,
YR_AC_MATCH* ac_match,
uint8_t* data,
size_t data_size,
size_t data_base,
size_t offset);
#endif
pluginsdk/yara/yara/sizedstr.h
+44 -42
View File
@@ -1,42 +1,44 @@
/*
Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef _SIZEDSTR_H
#define _SIZEDSTR_H
//
// This struct is used to support strings containing null chars. The length of
// the string is stored along the string data. However the string data is also
// terminated with a null char.
//
#define SIZED_STRING_FLAGS_NO_CASE 1
#define SIZED_STRING_FLAGS_DOT_ALL 2
typedef struct _SIZED_STRING
{
int length;
int flags;
char c_string[1];
} SIZED_STRING;
int sized_string_cmp(
SIZED_STRING* s1,
SIZED_STRING* s2);
#endif
/*
Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef _SIZEDSTR_H
#define _SIZEDSTR_H
#include <stddef.h>
//
// This struct is used to support strings containing null chars. The length of
// the string is stored along the string data. However the string data is also
// terminated with a null char.
//
#define SIZED_STRING_FLAGS_NO_CASE 1
#define SIZED_STRING_FLAGS_DOT_ALL 2
typedef struct _SIZED_STRING
{
size_t length;
int flags;
char c_string[1];
} SIZED_STRING;
int sized_string_cmp(
SIZED_STRING* s1,
SIZED_STRING* s2);
#endif
pluginsdk/yara/yara/stream.h
+59
View File
@@ -0,0 +1,59 @@
/*
Copyright (c) 2015. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_STREAM_H
#define YR_STREAM_H
#include <stddef.h>
typedef size_t (*YR_STREAM_READ_FUNC)(
void* ptr,
size_t size,
size_t count,
void* user_data);
typedef size_t (*YR_STREAM_WRITE_FUNC)(
const void* ptr,
size_t size,
size_t count,
void* user_data);
typedef struct _YR_STREAM
{
void* user_data;
YR_STREAM_READ_FUNC read;
YR_STREAM_WRITE_FUNC write;
} YR_STREAM;
size_t yr_stream_read(
void* ptr,
size_t size,
size_t count,
YR_STREAM* stream);
size_t yr_stream_write(
const void* ptr,
size_t size,
size_t count,
YR_STREAM* stream);
#endif
pluginsdk/yara/yara/strutils.h
+79 -77
View File
@@ -1,77 +1,79 @@
/*
Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_STRUTILS_H
#define YR_STRUTILS_H
#include <assert.h>
#include <stdlib.h>
#include <stdint.h>
#include "config.h"
#ifdef _WIN32
#define snprintf _snprintf
#define strcasecmp _stricmp
#define strncasecmp _strnicmp
#endif
uint64_t xtoi(
const char* hexstr);
#if !HAVE_STRLCPY
size_t strlcpy(
char* dst,
const char* src,
size_t size);
#endif
#if !HAVE_STRLCAT
size_t strlcat(
char* dst,
const char* src,
size_t size);
#endif
#if !HAVE_MEMMEM
void* memmem(
const void* haystack,
size_t haystack_size,
const void* needle,
size_t needle_size);
#endif
int strlen_w(
const char* w_str);
int strcmp_w(
const char* w_str,
const char* str);
size_t strlcpy_w(
char* dst,
const char* w_src,
size_t n);
#endif
/*
Copyright (c) 2007-2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_STRUTILS_H
#define YR_STRUTILS_H
#include <assert.h>
#include <stdlib.h>
#include <stdint.h>
#include "config.h"
// Cygwin already has these functions.
#if defined(_WIN32) && !defined(__CYGWIN__)
#if defined(_MSC_VER) && _MSC_VER < 1900
#define snprintf _snprintf
#endif
#define strcasecmp _stricmp
#define strncasecmp _strnicmp
#endif
uint64_t xtoi(
const char* hexstr);
#if !HAVE_STRLCPY && !defined(strlcpy)
size_t strlcpy(
char* dst,
const char* src,
size_t size);
#endif
#if !HAVE_STRLCAT && !defined(strlcat)
size_t strlcat(
char* dst,
const char* src,
size_t size);
#endif
#if !HAVE_MEMMEM && !defined(memmem)
void* memmem(
const void* haystack,
size_t haystack_size,
const void* needle,
size_t needle_size);
#endif
int strnlen_w(
const char* w_str);
int strcmp_w(
const char* w_str,
const char* str);
size_t strlcpy_w(
char* dst,
const char* w_src,
size_t n);
#endif
pluginsdk/yara/yara/threading.h
+52
View File
@@ -0,0 +1,52 @@
/*
Copyright (c) 2016. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_MUTEX_H
#define YR_MUTEX_H
#if defined(_WIN32) || defined(__CYGWIN__)
#include <windows.h>
typedef DWORD YR_THREAD_ID;
typedef DWORD YR_THREAD_STORAGE_KEY;
typedef HANDLE YR_MUTEX;
#else
#include <pthread.h>
typedef pthread_t YR_THREAD_ID;
typedef pthread_key_t YR_THREAD_STORAGE_KEY;
typedef pthread_mutex_t YR_MUTEX;
#endif
YR_THREAD_ID yr_current_thread_id(void);
int yr_mutex_create(YR_MUTEX*);
int yr_mutex_destroy(YR_MUTEX*);
int yr_mutex_lock(YR_MUTEX*);
int yr_mutex_unlock(YR_MUTEX*);
int yr_thread_storage_create(YR_THREAD_STORAGE_KEY*);
int yr_thread_storage_destroy(YR_THREAD_STORAGE_KEY*);
int yr_thread_storage_set_value(YR_THREAD_STORAGE_KEY*, void*);
void* yr_thread_storage_get_value(YR_THREAD_STORAGE_KEY*);
#endif
pluginsdk/yara/yara/types.h
+532 -524
View File
File diff suppressed because it is too large. Load diff
pluginsdk/yara/yara/utils.h
+77 -67
View File
@@ -1,67 +1,77 @@
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_UTILS_H
#define YR_UTILS_H
#ifndef TRUE
#define TRUE 1
#endif
#ifndef FALSE
#define FALSE 0
#endif
#ifndef NULL
#define NULL 0
#endif
#ifdef __cplusplus
#define YR_API extern "C" __declspec(dllimport)
#else
#define YR_API
#endif
#ifndef min
#define min(x, y) ((x < y) ? (x) : (y))
#endif
#ifndef max
#define max(x, y) ((x > y) ? (x) : (y))
#endif
#define PTR_TO_UINT64(x) ((uint64_t) (size_t) x)
#ifdef NDEBUG
#define assertf(expr, msg) ((void)0)
#else
#include <stdlib.h>
#define assertf(expr, msg, ...) \
if(!(expr)) { \
fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
abort(); \
}
#endif
#endif
/*
Copyright (c) 2014. The YARA Authors. All Rights Reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef YR_UTILS_H
#define YR_UTILS_H
#ifndef TRUE
#define TRUE 1
#endif
#ifndef FALSE
#define FALSE 0
#endif
#ifndef NULL
#define NULL 0
#endif
#ifdef __cplusplus
#define EXTERNC extern "C"
#else
#define EXTERNC
#endif
#if defined(__GNUC__)
#define YR_API EXTERNC __attribute__((visibility("default")))
#elif defined(_MSC_VER)
#define YR_API EXTERNC __declspec(dllexport)
#else
#define YR_API EXTERNC
#endif
#if defined(__GNUC__)
#define YR_ALIGN(n) __attribute__((aligned(n)))
#elif defined(_MSC_VER)
#define YR_ALIGN(n) __declspec(align(n))
#else
#define YR_ALIGN(n)
#endif
#define yr_min(x, y) ((x < y) ? (x) : (y))
#define yr_max(x, y) ((x > y) ? (x) : (y))
#define PTR_TO_INT64(x) ((int64_t) (size_t) x)
#ifdef NDEBUG
#define assertf(expr, msg, ...) ((void)0)
#else
#include <stdlib.h>
#define assertf(expr, msg, ...) \
if(!(expr)) { \
fprintf(stderr, "%s:%d: " msg "\n", __FILE__, __LINE__, ##__VA_ARGS__); \
abort(); \
}
#endif
#endif
Loaded 100 of 110 files, more files were not shown because too many files have changed in this diff. Show more