|
|
VERSION 1.0 CLASS
|
|
|
BEGIN
|
|
|
MultiUse = -1 'True
|
|
|
Persistable = 0 'NotPersistable
|
|
|
DataBindingBehavior = 0 'vbNone
|
|
|
DataSourceBehavior = 0 'vbNone
|
|
|
MTSTransactionMode = 0 'NotAnMTSObject
|
|
|
END
|
|
|
Attribute VB_Name = "CX86Operand"
|
|
|
Attribute VB_GlobalNameSpace = False
|
|
|
Attribute VB_Creatable = True
|
|
|
Attribute VB_PredeclaredId = False
|
|
|
Attribute VB_Exposed = False
|
|
|
Option Explicit
|
|
|
|
|
|
'Capstone Disassembly Engine bindings for VB6
|
|
|
'Contributed by FireEye FLARE Team
|
|
|
'Author: David Zimmer <david.zimmer@fireeye.com>, <dzzie@yahoo.com>
|
|
|
'License: Apache
|
|
|
'Copyright: FireEye 2017
|
|
|
|
|
|
|
|
|
'// Instruction operand sizeof() reports 48 bytes
|
|
|
'typedef struct cs_x86_op {
|
|
|
' x86_op_type type; // operand type
|
|
|
'
|
|
|
' union {
|
|
|
' x86_reg reg; // register value for REG operand
|
|
|
' int64_t imm; // immediate value for IMM operand
|
|
|
' double fp; // floating point value for FP operand
|
|
|
' x86_op_mem mem; // base/index/scale/disp value for MEM operand (24bytes max)
|
|
|
' };
|
|
|
'
|
|
|
' // size of this operand (in bytes).
|
|
|
' uint8_t size;
|
|
|
'
|
|
|
' // AVX broadcast type, or 0 if irrelevant
|
|
|
' x86_avx_bcast avx_bcast;
|
|
|
'
|
|
|
' // AVX zero opmask {z}
|
|
|
' bool avx_zero_opmask;
|
|
|
'} cs_x86_op;
|
|
|
|
|
|
'Instruction's operand referring to memory
|
|
|
'This is associated with X86_OP_MEM operand type above
|
|
|
'Public Type x86_op_mem
|
|
|
' segment As Long ' segment register (or X86_REG_INVALID if irrelevant) UNSIGNED
|
|
|
' base As Long ' base register (or X86_REG_INVALID if irrelevant) UNSIGNED
|
|
|
' index As Long ' index register (or X86_REG_INVALID if irrelevant) UNSIGNED
|
|
|
' scale As Long ' scale for index register
|
|
|
' disp As Currency ' displacement value
|
|
|
'End Type
|
|
|
|
|
|
'this shows the alignment padding used by compiler..
|
|
|
' cs_x86_op op;
|
|
|
' op.type = (x86_op_type)1;
|
|
|
' op.reg = (x86_reg)2;
|
|
|
' op.avx_bcast = (x86_avx_bcast)3;
|
|
|
' op.avx_zero_opmask = 4;
|
|
|
' op.size = 0xaa;
|
|
|
' printf("&cs_x86_op = %x", &op);
|
|
|
' _asm int 3
|
|
|
'
|
|
|
'
|
|
|
'0x0012FF34 01 00 00 00 cc cc cc cc 02 00 00 00 cc cc cc cc ....<2E><><EFBFBD><EFBFBD>....<2E><><EFBFBD><EFBFBD>
|
|
|
'0x0012FF44 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|
|
'0x0012FF54 aa cc cc cc 03 00 00 00 01 cc cc cc cc cc cc cc <20><><EFBFBD><EFBFBD>.....<2E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
|
|
|
|
|
Public optype As x86_op_type
|
|
|
Public size As Byte
|
|
|
Public avx_bcast As x86_avx_bcast
|
|
|
Public avx_zero_opmask As Boolean
|
|
|
|
|
|
'only one of the following will be set based on type
|
|
|
Public reg As x86_reg
|
|
|
Public fp As Currency
|
|
|
Public imm As Currency
|
|
|
Public mem As CX86OpMem
|
|
|
|
|
|
Private hEngine As Long
|
|
|
Private m_raw() As Byte
|
|
|
|
|
|
Function toString() As String
|
|
|
|
|
|
Dim ret() As String
|
|
|
|
|
|
push ret, "X86 Operand:"
|
|
|
push ret, String(45, "-")
|
|
|
|
|
|
If DEBUG_DUMP Then
|
|
|
push ret, "Raw: "
|
|
|
push ret, HexDump(m_raw)
|
|
|
End If
|
|
|
|
|
|
push ret, "Type: " & opStr()
|
|
|
push ret, "Size: " & size
|
|
|
If avx_bcast <> 0 Then push ret, "BCast: " & bcastStr()
|
|
|
If avx_zero_opmask Then push ret, "AvxOpMask: " & avx_zero_opmask
|
|
|
|
|
|
If optype = X86_OP_FP Then
|
|
|
push ret, "FP: " & cur2str(fp)
|
|
|
ElseIf optype = X86_OP_IMM Then
|
|
|
push ret, "IMM: " & cur2str(imm)
|
|
|
ElseIf optype = x86_op_mem Then
|
|
|
If mem.base <> 0 Then push ret, "Base: " & regName(hEngine, mem.base)
|
|
|
If mem.index <> 0 Then push ret, "Index: " & regName(hEngine, mem.index)
|
|
|
If mem.scale_ <> 1 Then push ret, "Scale: " & Hex(mem.scale_)
|
|
|
If mem.segment <> 0 Then push ret, "Seg: " & regName(hEngine, mem.segment)
|
|
|
If mem.disp <> 0 Then push ret, "Disp: " & cur2str(mem.disp)
|
|
|
ElseIf optype = X86_OP_REG Then
|
|
|
push ret, "Reg: " & regName(hEngine, reg)
|
|
|
End If
|
|
|
|
|
|
toString = Join(ret, vbCrLf)
|
|
|
|
|
|
End Function
|
|
|
|
|
|
Function opStr() As String
|
|
|
|
|
|
If optype = X86_OP_FP Then opStr = "X86_OP_FP"
|
|
|
If optype = x86_op_mem Then opStr = "x86_op_mem"
|
|
|
If optype = X86_OP_IMM Then opStr = "X86_OP_IMM"
|
|
|
If optype = X86_OP_REG Then opStr = "X86_OP_REG"
|
|
|
If optype = X86_OP_INVALID Then opStr = "X86_OP_INVALID"
|
|
|
|
|
|
If Len(opStr) = 0 Then
|
|
|
opStr = "Error: " & Hex(optype)
|
|
|
ElseIf DEBUG_DUMP Then
|
|
|
opStr = opStr & " (" & Hex(optype) & ")"
|
|
|
End If
|
|
|
|
|
|
End Function
|
|
|
|
|
|
Function bcastStr() As String
|
|
|
Dim r As String
|
|
|
|
|
|
If avx_bcast = X86_AVX_BCAST_INVALID Then r = "X86_AVX_BCAST_INVALID"
|
|
|
If avx_bcast = X86_AVX_BCAST_2 Then r = "X86_AVX_BCAST_2"
|
|
|
If avx_bcast = X86_AVX_BCAST_4 Then r = "X86_AVX_BCAST_4"
|
|
|
If avx_bcast = X86_AVX_BCAST_8 Then r = "X86_AVX_BCAST_8"
|
|
|
If avx_bcast = X86_AVX_BCAST_16 Then r = "X86_AVX_BCAST_16"
|
|
|
|
|
|
If Len(r) = 0 Then
|
|
|
r = "Unknown: " & Hex(avx_bcast)
|
|
|
ElseIf DEBUG_DUMP Then
|
|
|
r = r & " (" & Hex(avx_bcast) & ")"
|
|
|
End If
|
|
|
|
|
|
bcastStr = r
|
|
|
End Function
|
|
|
|
|
|
|
|
|
Friend Sub LoadDetails(lpStruct As Long, hCapstone As Long)
|
|
|
|
|
|
Dim opMem As x86_op_mem
|
|
|
Dim ptr As Long
|
|
|
|
|
|
Const align4 = 4
|
|
|
Const align3 = 3
|
|
|
|
|
|
hEngine = hCapstone
|
|
|
|
|
|
If DEBUG_DUMP Then
|
|
|
ReDim m_raw(48)
|
|
|
CopyMemory ByVal VarPtr(m_raw(0)), ByVal lpStruct, 48
|
|
|
End If
|
|
|
|
|
|
optype = readLng(lpStruct)
|
|
|
ptr = lpStruct + 4 + align4
|
|
|
|
|
|
If optype = X86_OP_FP Then
|
|
|
fp = readCur(ptr)
|
|
|
ElseIf optype = X86_OP_IMM Then
|
|
|
imm = readCur(ptr)
|
|
|
ElseIf optype = x86_op_mem Then
|
|
|
CopyMemory ByVal VarPtr(opMem), ByVal ptr, LenB(opMem)
|
|
|
Set mem = New CX86OpMem
|
|
|
mem.base = opMem.base
|
|
|
mem.disp = opMem.disp
|
|
|
mem.index = opMem.index
|
|
|
mem.scale_ = opMem.scale
|
|
|
mem.segment = opMem.segment
|
|
|
ElseIf optype = X86_OP_REG Then
|
|
|
reg = readLng(ptr)
|
|
|
End If
|
|
|
|
|
|
ptr = ptr + LenB(opMem)
|
|
|
|
|
|
size = readByte(ptr)
|
|
|
ptr = ptr + 1 + align3
|
|
|
|
|
|
avx_bcast = readLng(ptr)
|
|
|
ptr = ptr + 4
|
|
|
|
|
|
avx_zero_opmask = (readByte(ptr) = 1)
|
|
|
|
|
|
End Sub
|
|
|
|
|
|
Private Sub Class_Terminate()
|
|
|
'looks like everything is freeing up ok
|
|
|
'Debug.Print "Cx86Operand.Terminate"
|
|
|
End Sub
|
