diff --git a/.gitmodules b/.gitmodules index e33db3e..07ee610 100644 --- a/.gitmodules +++ b/.gitmodules @@ -4,3 +4,9 @@ [submodule "dependencies/linux-pe"] path = dependencies/linux-pe url = https://github.com/can1357/linux-pe.git +[submodule "dependencies/xed"] + path = dependencies/xed + url = https://github.com/intelxed/xed.git +[submodule "dependencies/mbuild"] + path = dependencies/mbuild + url = https://github.com/intelxed/mbuild.git diff --git a/dependencies/mbuild b/dependencies/mbuild new file mode 160000 index 0000000..09b6654 --- /dev/null +++ b/dependencies/mbuild @@ -0,0 +1 @@ +Subproject commit 09b6654be0c52bf1df44e88c88b411a67b624cbd diff --git a/dependencies/xed b/dependencies/xed new file mode 160000 index 0000000..428712c --- /dev/null +++ b/dependencies/xed @@ -0,0 +1 @@ +Subproject commit 428712c28e831573579b7f749db63d3a58dcdbd9 diff --git a/include/lloiff.hpp b/include/lloiff.hpp index f171260..0970a1e 100644 --- a/include/lloiff.hpp +++ b/include/lloiff.hpp @@ -5,6 +5,13 @@ #include #include +#define XED_ENCODER +extern "C" +{ + #include + #include +} + namespace llo { /// @@ -13,6 +20,31 @@ namespace llo class lloiff_t { public: + /// + /// section protections structure... + /// + struct iff_prot_t + { + /// + /// the raw characteristics of the original binary file... + /// + std::uint64_t characteristics; + + /// + /// bit field structure containing IL version of characteristics... + /// + union + { + struct + { + std::uint32_t is_executable : 1; + std::uint32_t is_writable : 1; + std::uint32_t is_discardable : 1; + }; + std::uint32_t flags; + } prot; + }; + /// /// iff section struct containing IL information about a section... /// @@ -27,6 +59,18 @@ namespace llo /// vector of raw bytes containing the original bytes of this section... /// std::vector< std::uint8_t > raw; + + /// + /// IL and native characteristics of a section... + /// contains information such as: is the section executable, + /// writable, and or discardable? + /// + iff_prot_t characteristics; + + /// + /// a vector containing every single instruction of this section... + /// + std::vector< xed_decoded_inst_t > instrs; }; /// diff --git a/llo-s1.vcxproj b/llo-s1.vcxproj index 068ea48..3843fd1 100644 --- a/llo-s1.vcxproj +++ b/llo-s1.vcxproj @@ -43,6 +43,42 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -98,11 +134,11 @@ true - $(ProjectDir)include;$(IncludePath);$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\ + $(ProjectDir)include;$(IncludePath);$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\;$(ProjectDir)dependencies\xed\include\public\xed;$(ProjectDir)dependencies\xed\obj\;$(ProjectDir)dependencies\xed\obj\wkit\include\xed\ false - $(VC_IncludePath);$(WindowsSDK_IncludePath);;$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\ + $(VC_IncludePath);$(WindowsSDK_IncludePath);;$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\;$(ProjectDir)dependencies\xed\include\public\xed;$(ProjectDir)dependencies\xed\obj\;$(ProjectDir)dependencies\xed\obj\wkit\include\xed\ @@ -115,7 +151,7 @@ Console true - %(AdditionalDependencies) + $(ProjectDir)dependencies\xed\obj\wkit\lib\xed.lib;%(AdditionalDependencies) true true @@ -129,13 +165,14 @@ NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true stdcpplatest + CompileAsCpp Console true true true - %(AdditionalDependencies) + $(ProjectDir)dependencies\xed\obj\wkit\lib\xed.lib;%(AdditionalDependencies) true true diff --git a/llo-s1.vcxproj.filters b/llo-s1.vcxproj.filters index b878e66..34f1fd3 100644 --- a/llo-s1.vcxproj.filters +++ b/llo-s1.vcxproj.filters @@ -39,6 +39,9 @@ {9bd2b0b0-4ae2-4d9d-8620-4b596f84d20d} + + {52d58ded-b48c-456a-98fe-4dfb9e81e1a9} + @@ -161,6 +164,114 @@ Header Files\llodctor + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + + + Header Files\xed + diff --git a/llo-s1.vcxproj.user b/llo-s1.vcxproj.user index 16c21f5..8fc586e 100644 --- a/llo-s1.vcxproj.user +++ b/llo-s1.vcxproj.user @@ -1,7 +1,7 @@  - -i llo-s1.lib + -i demo.lib WindowsLocalDebugger diff --git a/src/llodctor/llodctor_coff.cpp b/src/llodctor/llodctor_coff.cpp index 025663e..88d4903 100644 --- a/src/llodctor/llodctor_coff.cpp +++ b/src/llodctor/llodctor_coff.cpp @@ -4,15 +4,42 @@ namespace llo::s1 { void dctor_coff_t::generate( lloiff_t &iff ) { - std::for_each( img_header->get_sections(), img_header->get_sections() + num_sections, - [ & ]( const coff::section_header_t section_header ) { - lloiff_t::iff_section_t section{ - std::string( section_header.name.to_string( img_header->get_strings() ) ) }; + std::for_each( + img_header->get_sections(), img_header->get_sections() + num_sections, + [ & ]( const coff::section_header_t section_header ) { + const auto section_name = std::string( section_header.name.to_string( img_header->get_strings() ) ); + lloiff_t::iff_section_t iff_section{ section_name }; - section.raw = { img.data() + section_header.ptr_raw_data, - img.data() + section_header.ptr_raw_data + section_header.size_raw_data }; + iff_section.raw = { img.data() + section_header.ptr_raw_data, + img.data() + section_header.ptr_raw_data + section_header.size_raw_data }; - iff.sections.emplace_back( section ); - } ); + const auto &prots = section_header.prots; + iff_section.characteristics.prot = { prots.mem_execute, prots.mem_write, prots.mem_discardable }; + iff_section.characteristics.characteristics = section_header.prots.flags; + + // if the section is writable then we want to disassamble the entire section... + if ( iff_section.characteristics.prot.is_executable && iff_section.raw.data() ) + { + std::uint32_t offset = 0u; + xed_error_enum_t err; + + xed_decoded_inst_t instr; + xed_state_t istate{ XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b }; + xed_decoded_inst_zero_set_mode( &instr, &istate ); + + // keep looping over the section, lower the number of bytes each time... + while ( ( err = xed_decode( &instr, iff_section.raw.data() + offset, + iff_section.raw.size() - offset ) ) == XED_ERROR_NONE ) + { + offset += xed_decoded_inst_get_length( &instr ); + iff_section.instrs.push_back( instr ); + + // need to set this so that instr can be used to decode again... + xed_decoded_inst_zero_set_mode( &instr, &istate ); + } + } + + iff.sections.emplace_back( iff_section ); + } ); } } // namespace llo::s1 \ No newline at end of file diff --git a/src/llodctor/llodctor_pe.cpp b/src/llodctor/llodctor_pe.cpp index f52896e..7da2a33 100644 --- a/src/llodctor/llodctor_pe.cpp +++ b/src/llodctor/llodctor_pe.cpp @@ -2,14 +2,42 @@ void llo::s1::dctor_pe_t::generate( lloiff_t &iff ) { - // lift section information to iff... - for ( auto idx = 0u; idx < section_count; ++idx ) - { - iff.sections.push_back( { std::string( sections[ idx ].name.to_string() ), - { img.data(), img.data() + sections[ idx ].ptr_raw_data } } ); - - // TODO... more information probably can be lifted/added... - } + std::for_each( sections, sections + section_count, [ & ]( const win::section_header_t §ion_header ) { + llo::lloiff_t::iff_section_t iff_section{ + std::string( section_header.name.to_string() ), + { img.data() + section_header.ptr_raw_data, + img.data() + section_header.ptr_raw_data + section_header.size_raw_data } }; + + const auto &prots = section_header.prots; + iff_section.characteristics.prot = { prots.mem_execute, prots.mem_write, prots.mem_discardable }; + iff_section.characteristics.characteristics = section_header.prots.flags; + + // if the section is writable then we want to disassamble the entire section... + if ( iff_section.characteristics.prot.is_executable && iff_section.raw.data() ) + { + std::uint32_t offset = 0u; + xed_error_enum_t err; + + xed_decoded_inst_t instr; + xed_state_t istate{ XED_MACHINE_MODE_LONG_64, XED_ADDRESS_WIDTH_64b }; + xed_decoded_inst_zero_set_mode( &instr, &istate ); + + // keep looping over the section, lower the number of bytes each time... + while ( ( err = xed_decode( &instr, iff_section.raw.data() + offset, iff_section.raw.size() - offset ) ) == + XED_ERROR_NONE ) + { + offset += xed_decoded_inst_get_length( &instr ); + iff_section.instrs.push_back( instr ); + + // need to set this so that instr can be used to decode again... + xed_decoded_inst_zero_set_mode( &instr, &istate ); + } + + std::printf( "> err = %d, offset = %d, size = %d\n", err, offset, iff_section.raw.size() ); + } + + iff.sections.emplace_back( iff_section ); + } ); // run symbol loader pass... this could be pdb, map, etc... if ( symbol_loader ) diff --git a/src/main.cpp b/src/main.cpp index e0bea89..12be5e4 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -10,7 +10,7 @@ int __cdecl main( int argc, const char *argv[] ) { argparse::argument_parser_t cli_parser( "llo stage-one", "llo stage one demo" ); - + cli_parser.add_argument() .names( { "-i", "--input" } ) .description( "input file, must be a supported file format..." ) @@ -90,17 +90,35 @@ int __cdecl main( int argc, const char *argv[] ) return -1; } + xed_tables_init(); llo::lloiff_t iff( name, image ); file_dctor->generate( iff ); std::printf( "> iff number of children = %d\n", iff.children.size() ); - for ( auto &child : iff.children ) + + for ( auto §ion : iff.sections ) { + std::printf( "> section name = %s\n", section.section_name.get_data().c_str() ); + std::printf( "> section data = %p\n", section.raw.data() ); + + if ( section.characteristics.prot.is_executable ) + std::printf( "> number of instructions = %d\n", section.instrs.size() ); + + std::printf( "> size of raw section = %d\n", section.raw.size() ); + } + for ( auto &child : iff.children ) + { for ( auto §ion : child->sections ) { std::printf( "> section name = %s\n", section.section_name.get_data().c_str() ); + std::printf( "> section data = %p\n", section.raw.data() ); + + if ( section.characteristics.prot.is_executable ) + std::printf( "> number of instructions = %d\n", section.instrs.size() ); + std::printf( "> size of raw section = %d\n", section.raw.size() ); } } + std::getchar(); } \ No newline at end of file