FIxed handlers

xtremegamer1 2 years ago
parent 4776d1e49f
commit 9713d1b144

@ -0,0 +1,44 @@
#include <vminstrs.hpp>
//Loads CR0 onto the stack
namespace vm::instrs {
profiler_t lcr0 = {
"LCR0",
mnemonic_t::lcr0,
{
// MOV REG, CR0
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[1].reg.value == ZYDIS_REGISTER_CR0;
},
// SUB VSP, OFFSET
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[0].reg.value == vsp &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_IMMEDIATE;
},
// MOV [VSP], REG
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[0].mem.base == vsp &&
instr.operands[0].mem.index == ZYDIS_REGISTER_NONE &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[1].reg.value != vsp;
}
},
[](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::lcr0};
res.imm.has_imm = false;
res.stack_size = 64;
return res;
}
};
}

@ -26,13 +26,13 @@ profiler_t read = {
hndlr.m_instrs.begin(), hndlr.m_instrs.end(), hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool { [&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr; const auto& i = instr.m_instr;
return i.mnemonic == ZYDIS_MNEMONIC_MOV && return i.mnemonic == ZYDIS_MNEMONIC_MOV || i.mnemonic == ZYDIS_MNEMONIC_MOVZX &&
i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER && i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY && i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
i.operands[1].mem.base != vsp; i.operands[1].mem.base != vsp;
}); });
res.stack_size = mov_reg_reg->m_instr.operands[0].size; res.stack_size = mov_reg_reg->m_instr.operands[1].size;
return res; return res;
}}; }};
} }

@ -1,40 +0,0 @@
#include <vminstrs.hpp>
namespace vm::instrs {
profiler_t readbzxw = {
"READ",
mnemonic_t::readbzxw,
{{// MOV REG, [VSP]
LOAD_VALUE,
// MOVZX REG, [REG]
[](const zydis_reg_t vip, const zydis_reg_t vsp,
const zydis_decoded_instr_t& instr) -> bool {
return instr.mnemonic == ZYDIS_MNEMONIC_MOVZX &&
instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
instr.operands[0].size == 16 &&
instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
instr.operands[1].size == 8 &&
instr.operands[1].mem.base != vsp;
},
// MOV [VSP], REG
STR_VALUE}},
[](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::read};
res.imm.has_imm = false;
// MOV REG, [REG]
const auto mov_reg_reg = std::find_if(
hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr;
return i.mnemonic == ZYDIS_MNEMONIC_MOVZX &&
i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
i.operands[1].mem.base != vsp;
});
res.stack_size = mov_reg_reg->m_instr.operands[0].size;
return res;
}};
}

@ -45,10 +45,10 @@ profiler_t shl = {
}}}, }}},
[](zydis_reg_t& vip, zydis_reg_t& vsp, [](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> { hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::shr}; vinstr_t res{mnemonic_t::shl};
res.imm.has_imm = false; res.imm.has_imm = false;
const auto shr_reg = std::find_if( const auto shl_reg = std::find_if(
hndlr.m_instrs.begin(), hndlr.m_instrs.end(), hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool { [&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr; const auto& i = instr.m_instr;
@ -57,7 +57,7 @@ profiler_t shl = {
i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
}); });
res.stack_size = shr_reg->m_instr.operands[0].size; res.stack_size = shl_reg->m_instr.operands[0].size;
return res; return res;
}}; }};
} }

@ -54,10 +54,10 @@ profiler_t shld = {
}}}, }}},
[](zydis_reg_t& vip, zydis_reg_t& vsp, [](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> { hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::shr}; vinstr_t res{mnemonic_t::shld};
res.imm.has_imm = false; res.imm.has_imm = false;
const auto shr_reg = std::find_if( const auto shld_reg = std::find_if(
hndlr.m_instrs.begin(), hndlr.m_instrs.end(), hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool { [&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr; const auto& i = instr.m_instr;
@ -66,7 +66,7 @@ profiler_t shld = {
i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
}); });
res.stack_size = shr_reg->m_instr.operands[0].size; res.stack_size = shld_reg->m_instr.operands[0].size;
return res; return res;
}}; }};

@ -54,10 +54,10 @@ profiler_t shrd = {
}}}, }}},
[](zydis_reg_t& vip, zydis_reg_t& vsp, [](zydis_reg_t& vip, zydis_reg_t& vsp,
hndlr_trace_t& hndlr) -> std::optional<vinstr_t> { hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
vinstr_t res{mnemonic_t::shr}; vinstr_t res{mnemonic_t::shrd};
res.imm.has_imm = false; res.imm.has_imm = false;
const auto shr_reg = std::find_if( const auto shrd_reg = std::find_if(
hndlr.m_instrs.begin(), hndlr.m_instrs.end(), hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
[&](emu_instr_t& instr) -> bool { [&](emu_instr_t& instr) -> bool {
const auto& i = instr.m_instr; const auto& i = instr.m_instr;
@ -66,7 +66,7 @@ profiler_t shrd = {
i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER; i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
}); });
res.stack_size = shr_reg->m_instr.operands[0].size; res.stack_size = shrd_reg->m_instr.operands[0].size;
return res; return res;
}}; }};

Loading…
Cancel
Save