From 450ced9740f7027ba3537f4a19b8378972794330 Mon Sep 17 00:00:00 2001
From: xtremegamer1 <rlyman308@gmail.com>
Date: Fri, 14 Oct 2022 07:11:08 -0600
Subject: [PATCH] Added handlers

---
 src/vmprofiles/and.cpp      | 61 +++++++++++++++++++++++++++++++++++++
 src/vmprofiles/writedr7.cpp |  4 ++-
 2 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 src/vmprofiles/and.cpp

diff --git a/src/vmprofiles/and.cpp b/src/vmprofiles/and.cpp
new file mode 100644
index 0000000..f6ac147
--- /dev/null
+++ b/src/vmprofiles/and.cpp
@@ -0,0 +1,61 @@
+#include <vminstrs.hpp>
+
+namespace vm::instrs {
+profiler_t _and = {
+    "AND",
+    mnemonic_t::_and,
+    {{// MOV REG, [VSP]
+      LOAD_VALUE,
+      // MOV REG, [VSP+OFFSET]
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[1].mem.base == vsp &&
+               instr.operands[1].mem.disp.has_displacement;
+      },
+      // AND [REG], REG
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_AND &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base != ZYDIS_REGISTER_NONE &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // PUSHFQ
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+      },
+      // POP [VSP]
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp;
+      }}},
+    [](zydis_reg_t& vip, zydis_reg_t& vsp,
+       hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
+      vinstr_t res{mnemonic_t::_and};
+      res.imm.has_imm = false;
+
+      // MOV REG [VSP+OFFSET]
+      const auto mov_vsp_offset = std::find_if(
+          hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
+          [&](emu_instr_t& instr) -> bool {
+            const auto& i = instr.m_instr;
+            return 
+                  i.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                  i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                  i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                  i.operands[1].mem.base == vsp &&
+                  i.operands[1].mem.disp.has_displacement;
+          });
+      if (mov_vsp_offset == hndlr.m_instrs.end())
+        return std::nullopt;
+
+      res.stack_size = mov_vsp_offset->m_instr.operands[0].size;
+      return res;
+    }};
+}
\ No newline at end of file
diff --git a/src/vmprofiles/writedr7.cpp b/src/vmprofiles/writedr7.cpp
index 2bdddd1..6218abf 100644
--- a/src/vmprofiles/writedr7.cpp
+++ b/src/vmprofiles/writedr7.cpp
@@ -1,5 +1,6 @@
 #include <vminstrs.hpp>
 
+//Write value on top of stack to dr7
 namespace vm::instrs {
 profiler_t writedr7 = {
   "WRITEDR7",
@@ -27,7 +28,8 @@ profiler_t writedr7 = {
   },
   [](zydis_reg_t& vip, zydis_reg_t& vsp,
       hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
-      vinstr_t res{mnemonic_t::write};
+      vinstr_t res{mnemonic_t::writedr7};
+      res.stack_size == 64;
       res.imm.has_imm = false;
       return res;
   }