From e74f291d564ca656d3f388abafb7b54d3371f70f Mon Sep 17 00:00:00 2001
From: xtremegamer1 <rlyman308@gmail.com>
Date: Sat, 15 Oct 2022 00:39:33 -0600
Subject: [PATCH] Added or virtual instruction

---
 CMakeLists.txt        |  1 +
 include/vminstrs.hpp  |  4 ++-
 src/vmprofiles/or.cpp | 61 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 src/vmprofiles/or.cpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index d5c4bf1..e7dd2b4 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -75,6 +75,7 @@ list(APPEND vmprofiler_SOURCES
 	"src/vmprofiles/write.cpp"
 	"src/vmprofiles/lcr0.cpp"
 	"src/vmprofiles/and.cpp"
+	"src/vmprofiles/or.cpp"
 	"src/vmprofiles/writedr7.cpp"
 	"src/vmutils.cpp"
 	"include/uc_allocation_tracker.hpp"
diff --git a/include/vminstrs.hpp b/include/vminstrs.hpp
index e8b61d6..7a3f327 100644
--- a/include/vminstrs.hpp
+++ b/include/vminstrs.hpp
@@ -16,6 +16,7 @@ enum class mnemonic_t : uint8_t {
   lreg,
   lconst,
   add,
+  _or,
   _and, //The fucking idiots who wrote the standard thought reserving the word "and" was appropriate
   div,
   idiv,
@@ -289,6 +290,7 @@ extern profiler_t sreg;
 extern profiler_t lreg;
 extern profiler_t lconst;
 extern profiler_t add;
+extern profiler_t _or;
 extern profiler_t _and;
 extern profiler_t lvsp;
 extern profiler_t svsp;
@@ -312,7 +314,7 @@ extern profiler_t vmexit;
 /// </summary>
 inline std::vector<profiler_t*> profiles = {
     &vmexit, &shl, &shld, &shr, &shrd, &imul, &nor,  &write, &svsp, &read, 
-    &nand, &lvsp, &add, &jmp, &_and, &sreg, &lreg, &lcr0,  &lconst, &nop, &writedr7};
+    &nand, &lvsp, &add, &jmp, &_or, &_and, &sreg, &lreg, &lcr0,  &lconst, &nop, &writedr7};
 
 /// <summary> 
 /// no i did not make this by hand, you cannot clown upon me!
diff --git a/src/vmprofiles/or.cpp b/src/vmprofiles/or.cpp
new file mode 100644
index 0000000..57a6911
--- /dev/null
+++ b/src/vmprofiles/or.cpp
@@ -0,0 +1,61 @@
+#include <vminstrs.hpp>
+
+namespace vm::instrs {
+profiler_t _or = {
+    "OR",
+    mnemonic_t::_or,
+    {{// MOV REG, [VSP]
+      LOAD_VALUE,
+      // MOV REG, [VSP+OFFSET]
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[1].mem.base == vsp &&
+               instr.operands[1].mem.disp.has_displacement;
+      },
+      // OR [REG], REG
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_OR &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base != ZYDIS_REGISTER_NONE &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // PUSHFQ
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+      },
+      // POP [VSP]
+      [](const zydis_reg_t vip, const zydis_reg_t vsp,
+         const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp;
+      }}},
+    [](zydis_reg_t& vip, zydis_reg_t& vsp,
+       hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
+      vinstr_t res{mnemonic_t::_or};
+      res.imm.has_imm = false;
+
+      // MOV REG [VSP+OFFSET]
+      const auto reg_vsp_offset = std::find_if(
+          hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
+          [&](emu_instr_t& instr) -> bool {
+            const auto& i = instr.m_instr;
+            return 
+                  i.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                  i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                  i.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                  i.operands[1].mem.base == vsp &&
+                  i.operands[1].mem.disp.has_displacement;
+          });
+      if (reg_vsp_offset == hndlr.m_instrs.end())
+        return std::nullopt;
+
+      res.stack_size = reg_vsp_offset->m_instr.operands[0].size;
+      return res;
+    }};
+}
\ No newline at end of file