Added or virtual instruction

xtremegamer1 2 years ago
parent bcf5c66643
commit 2cc88f60ab

@ -75,6 +75,7 @@ list(APPEND vmprofiler_SOURCES
"src/vmprofiles/write.cpp"
"src/vmprofiles/lcr0.cpp"
"src/vmprofiles/and.cpp"
"src/vmprofiles/or.cpp"
"src/vmprofiles/writedr7.cpp"
"src/vmutils.cpp"
"include/uc_allocation_tracker.hpp"

@ -16,6 +16,7 @@ enum class mnemonic_t : uint8_t {
lreg,
lconst,
add,
_or,
_and, //The fucking idiots who wrote the standard thought reserving the word "and" was appropriate
div,
idiv,
@ -289,6 +290,7 @@ extern profiler_t sreg;
extern profiler_t lreg;
extern profiler_t lconst;
extern profiler_t add;
extern profiler_t _or;
extern profiler_t _and;
extern profiler_t lvsp;
extern profiler_t svsp;
@ -312,7 +314,7 @@ extern profiler_t vmexit;
/// </summary>
inline std::vector<profiler_t*> profiles = {
&vmexit, &shl, &shld, &shr, &shrd, &imul, &nor, &write, &svsp, &read,
&nand, &lvsp, &add, &jmp, &_and, &sreg, &lreg, &lcr0, &lconst, &nop, &writedr7};
&nand, &lvsp, &add, &jmp, &_or, &_and, &sreg, &lreg, &lcr0, &lconst, &nop, &writedr7};
/// <summary>
/// no i did not make this by hand, you cannot clown upon me!

@ -0,0 +1,61 @@
#include <vminstrs.hpp>
namespace vm::instrs {
profiler_t _or = {
"OR",
mnemonic_t::_or,
{{// MOV REG, [VSP]
LOAD_VALUE,
// MOV REG, [VSP+OFFSET]
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[1].mem.base == vsp &&
instr.operands[1].mem.disp.has_displacement;
},
// OR [REG], REG
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_OR &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[0].mem.base != ZYDIS_REGISTER_NONE &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
},
// PUSHFQ
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
},
// POP [VSP]
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[0].mem.base == vsp;
}}},
[](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::_or};
res.imm.has_imm = false;
// MOV REG [VSP+OFFSET]
const auto reg_vsp_offset = std::find_if(
hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr;
return
i.mnemonic == ZYDIS_MNEMONIC_MOV &&
i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
i.operands[1].mem.base == vsp &&
i.operands[1].mem.disp.has_displacement;
});
if (reg_vsp_offset == hndlr.m_instrs.end())
return std::nullopt;
res.stack_size = reg_vsp_offset->m_instr.operands[0].size;
return res;
}};
}
Loading…
Cancel
Save