From fc310689a5b07114d7d110ac544d66e1d18aa5ba Mon Sep 17 00:00:00 2001
From: John Doe <xerox@hacks.ltd>
Date: Mon, 27 Dec 2021 21:39:43 -0800
Subject: [PATCH] added shr profile

---
 CMakeLists.txt         |  1 +
 include/vminstrs.hpp   |  7 +++--
 src/vmprofiles/shr.cpp | 69 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+), 3 deletions(-)
 create mode 100644 src/vmprofiles/shr.cpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 02857c0..f7b5290 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -62,6 +62,7 @@ list(APPEND vmprofiler_SOURCES
 	"src/vmprofiles/nand.cpp"
 	"src/vmprofiles/nor.cpp"
 	"src/vmprofiles/read.cpp"
+	"src/vmprofiles/shr.cpp"
 	"src/vmprofiles/sreg.cpp"
 	"src/vmprofiles/svsp.cpp"
 	"src/vmprofiles/write.cpp"
diff --git a/include/vminstrs.hpp b/include/vminstrs.hpp
index d55eda1..ef3c0c9 100644
--- a/include/vminstrs.hpp
+++ b/include/vminstrs.hpp
@@ -149,13 +149,14 @@ extern profiler_t nor;
 extern profiler_t read;
 extern profiler_t write;
 extern profiler_t imul;
+extern profiler_t shr;
 
 /// <summary>
 /// unsorted vector of profiles... they get sorted once at runtime...
 /// </summary>
-inline std::vector<profiler_t*> profiles = {&imul, &nor,  &write, &svsp,
-                                            &read, &nand, &lvsp,  &add,
-                                            &jmp,  &sreg, &lreg,  &lconst};
+inline std::vector<profiler_t*> profiles = {&shr,  &imul, &nor,   &write, &svsp,
+                                            &read, &nand, &lvsp,  &add,   &jmp,
+                                            &sreg, &lreg, &lconst};
 
 /// <summary>
 /// no i did not make this by hand, you cannot clown upon me!
diff --git a/src/vmprofiles/shr.cpp b/src/vmprofiles/shr.cpp
new file mode 100644
index 0000000..330f48d
--- /dev/null
+++ b/src/vmprofiles/shr.cpp
@@ -0,0 +1,69 @@
+#include <vminstrs.hpp>
+
+namespace vm::instrs {
+profiler_t shr = {
+    "SHR",
+    mnemonic_t::shr,
+    {{// MOV REG, [VSP]
+      LOAD_VALUE,
+      // MOV REG, [VSP+OFFSET]
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[1].mem.base == vsp &&
+               instr.operands[1].mem.disp.has_displacement;
+      },
+      // SHR REG, REG
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_SHR &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // MOV [VSP+OFFSET], REG
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp &&
+               instr.operands[0].mem.disp.has_displacement &&
+               instr.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+      },
+      // PUSHFQ
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+      },
+      // POP [VSP]
+      [&](const zydis_reg_t vip,
+          const zydis_reg_t vsp,
+          const zydis_decoded_instr_t& instr) -> bool {
+        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+               instr.operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+               instr.operands[0].mem.base == vsp;
+      }}},
+    [&](zydis_reg_t& vip,
+        zydis_reg_t& vsp,
+        hndlr_trace_t& hndlr) -> std::optional<vinstr_t> {
+      vinstr_t res{mnemonic_t::shr};
+      res.imm.has_imm = false;
+
+      const auto shr_reg = std::find_if(
+          hndlr.m_instrs.begin(), hndlr.m_instrs.end(),
+          [&](emu_instr_t& instr) -> bool {
+            const auto& i = instr.m_instr;
+            return i.mnemonic == ZYDIS_MNEMONIC_SHR &&
+                   i.operands[0].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                   i.operands[1].type == ZYDIS_OPERAND_TYPE_REGISTER;
+          });
+
+      res.stack_size = shr_reg->m_instr.operands[0].size;
+      return res;
+    }};
+}
\ No newline at end of file