some more playing with zydis

This commit is contained in:
georgemoralis 2023-05-30 16:27:11 +03:00
parent 5a72e51f4e
commit 66ea5329d2
5 changed files with 30 additions and 10 deletions

View file

@ -1,6 +1,7 @@
#include "Linker.h" #include "Linker.h"
#include "../Memory.h" #include "../Memory.h"
#include "../../Util/Log.h" #include "../../Util/Log.h"
#include "../../Util/Disassembler.h"
constexpr bool debug_loader = true; constexpr bool debug_loader = true;
@ -138,4 +139,22 @@ void Linker::LoadModuleToMemory(Module* m)
} }
} }
LOG_INFO_IF(debug_loader, "program entry addr ..........: {:#018x}\n", m->elf->GetElfEntry() + m->base_virtual_addr); LOG_INFO_IF(debug_loader, "program entry addr ..........: {:#018x}\n", m->elf->GetElfEntry() + m->base_virtual_addr);
auto* rt1 = reinterpret_cast<uint8_t*>(m->elf->GetElfEntry() + m->base_virtual_addr);
ZyanU64 runtime_address = m->elf->GetElfEntry() + m->base_virtual_addr;
// Loop over the instructions in our buffer.
ZyanUSize offset = 0;
ZydisDisassembledInstruction instruction;
while (ZYAN_SUCCESS(ZydisDisassembleIntel(
/* machine_mode: */ ZYDIS_MACHINE_MODE_LONG_64,
/* runtime_address: */ runtime_address,
/* buffer: */ rt1 + offset,
/* length: */ sizeof(rt1) - offset,
/* instruction: */ &instruction
))) {
printf("%016" PRIX64 " %s\n", runtime_address, instruction.text);
offset += instruction.info.length;
runtime_address += instruction.info.length;
}
} }

View file

@ -446,7 +446,7 @@ std::string Elf::ElfPheaderTypeStr(u32 type) {
return "Loadable"; return "Loadable";
case PT_DYNAMIC: case PT_DYNAMIC:
return "Dynamic"; return "Dynamic";
case PT_INERP: case PT_INTERP:
return "Interpreter Path"; return "Interpreter Path";
case PT_NOTE: case PT_NOTE:
return "Note"; return "Note";

View file

@ -242,7 +242,7 @@ typedef enum : u32 {
PT_NULL = 0x0, PT_NULL = 0x0,
PT_LOAD = 0x1, PT_LOAD = 0x1,
PT_DYNAMIC = 0x2, PT_DYNAMIC = 0x2,
PT_INERP = 0x3, PT_INTERP = 0x3,
PT_NOTE = 0x4, PT_NOTE = 0x4,
PT_SHLIB = 0x5, PT_SHLIB = 0x5,
PT_PHDR = 0x6, PT_PHDR = 0x6,

View file

@ -12,25 +12,25 @@ Disassembler::~Disassembler()
{ {
} }
void Disassembler::printInstruction(void* code)//print a single instruction void Disassembler::printInstruction(void* code,u64 address)//print a single instruction
{ {
ZydisDecodedInstruction instruction; ZydisDecodedInstruction instruction;
ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT_VISIBLE]; ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT_VISIBLE];
ZyanStatus status = ZydisDecoderDecodeFull(&m_decoder, code, ZYDIS_MAX_INSTRUCTION_LENGTH,&instruction, operands); ZyanStatus status = ZydisDecoderDecodeFull(&m_decoder, code, sizeof(code), &instruction, operands);
if (!ZYAN_SUCCESS(status)) if (!ZYAN_SUCCESS(status))
{ {
printf("decode instruction failed at %p\n", code); printf("decode instruction failed at %p\n", code);
} }
else else
{ {
printInst(instruction, operands); printInst(instruction, operands,address);
} }
} }
void Disassembler::printInst(ZydisDecodedInstruction& inst, ZydisDecodedOperand* operands) void Disassembler::printInst(ZydisDecodedInstruction& inst, ZydisDecodedOperand* operands,u64 address)
{ {
const int bufLen = 256; const int bufLen = 256;
char szBuffer[bufLen]; char szBuffer[bufLen];
ZydisFormatterFormatInstruction(&m_formatter, &inst, operands,inst.operand_count_visible, szBuffer, sizeof(szBuffer), 0,NULL); ZydisFormatterFormatInstruction(&m_formatter, &inst, operands,inst.operand_count_visible, szBuffer, sizeof(szBuffer), address, ZYAN_NULL);
printf("instruction: %s\n", szBuffer); printf("instruction: %s\n", szBuffer);
} }

View file

@ -1,14 +1,15 @@
#pragma once #pragma once
#include "zydis/Zydis.h" #include "zydis/Zydis.h"
#include "../types.h"
class Disassembler class Disassembler
{ {
public: public:
Disassembler(); Disassembler();
~Disassembler(); ~Disassembler();
void printInst(ZydisDecodedInstruction& inst, ZydisDecodedOperand* operands); void printInst(ZydisDecodedInstruction& inst, ZydisDecodedOperand* operands,u64 address);
void printInstruction(void* code); void printInstruction(void* code,u64 address);
private: private:
ZydisDecoder m_decoder; ZydisDecoder m_decoder;