|
|
|
@ -3,13 +3,11 @@
|
|
|
|
|
|
|
|
|
|
namespace vm
|
|
|
|
|
{
|
|
|
|
|
vmp_rtn_t::vmp_rtn_t( llvm::LLVMContext *llvm_ctx, llvm::Module *llvm_module, std::uintptr_t rtn_begin,
|
|
|
|
|
std::vector< vm::instrs::code_block_t > vmp2_code_blocks )
|
|
|
|
|
: llvm_ctx( llvm_ctx ), llvm_module( llvm_module ), rtn_begin( rtn_begin ), vmp2_code_blocks( vmp2_code_blocks )
|
|
|
|
|
vmp_rtn_t::vmp_rtn_t( llvm::LLVMContext *llvm_ctx, llvm::Module *llvm_module, vm::ctx_t *vm_ctx,
|
|
|
|
|
std::uintptr_t rtn_begin, std::vector< vm::instrs::code_block_t > vmp2_code_blocks )
|
|
|
|
|
: llvm_ctx( llvm_ctx ), llvm_module( llvm_module ), vm_ctx( vm_ctx ), rtn_begin( rtn_begin ),
|
|
|
|
|
vmp2_code_blocks( vmp2_code_blocks )
|
|
|
|
|
{
|
|
|
|
|
// create native registers...
|
|
|
|
|
create_native_registers();
|
|
|
|
|
|
|
|
|
|
// create llvm::Function and llvm::BasicBlock's...
|
|
|
|
|
create_routine();
|
|
|
|
|
|
|
|
|
@ -17,65 +15,102 @@ namespace vm
|
|
|
|
|
ir_builder = std::make_shared< llvm::IRBuilder<> >( *llvm_ctx );
|
|
|
|
|
ir_builder->SetInsertPoint( llvm_code_blocks[ 0 ] );
|
|
|
|
|
|
|
|
|
|
// create native registers...
|
|
|
|
|
create_native_registers();
|
|
|
|
|
|
|
|
|
|
// create stack and stack pointer...
|
|
|
|
|
create_virtual_stack();
|
|
|
|
|
|
|
|
|
|
// lift vm enter pushes to llvm ir...
|
|
|
|
|
lift_vm_entry();
|
|
|
|
|
|
|
|
|
|
// create virtual registers...
|
|
|
|
|
create_virtual_registers();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void vmp_rtn_t::lift_vm_entry( void )
|
|
|
|
|
{
|
|
|
|
|
for ( const auto &instr : vm_ctx->vm_entry )
|
|
|
|
|
{
|
|
|
|
|
if ( instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSH )
|
|
|
|
|
{
|
|
|
|
|
// push [xxxxx] we know this is zero and the next push is the image base...
|
|
|
|
|
if ( instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY )
|
|
|
|
|
{
|
|
|
|
|
push( 8, llvm::ConstantInt::get( ir_builder->getInt64Ty(), 0ull ) );
|
|
|
|
|
push( 8, llvm::ConstantInt::get( ir_builder->getInt64Ty(), vm_ctx->image_base ) );
|
|
|
|
|
break; // dont make these if statements a switch case because we need to use this break...
|
|
|
|
|
}
|
|
|
|
|
else if ( instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE )
|
|
|
|
|
{
|
|
|
|
|
push( 8, llvm::ConstantInt::get( ir_builder->getInt64Ty(), instr.instr.operands[ 0 ].imm.value.u,
|
|
|
|
|
false ) );
|
|
|
|
|
}
|
|
|
|
|
else if ( instr.instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER )
|
|
|
|
|
{
|
|
|
|
|
push( 8, load_value( 8, native_registers[ instr.instr.operands[ 0 ].reg.value ] ) );
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
else if ( instr.instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ )
|
|
|
|
|
{
|
|
|
|
|
// just push 0 as the value itself wont matter...
|
|
|
|
|
push( 8, load_value( 8, native_registers[ ZYDIS_REGISTER_RFLAGS ] ) );
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void vmp_rtn_t::create_native_registers( void )
|
|
|
|
|
{
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RAX ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rax", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rax", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RAX ] = llvm_module->getGlobalVariable( "rax" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RBX ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rbx", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rbx", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RBX ] = llvm_module->getGlobalVariable( "rbx" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RCX ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rcx", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rcx", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RCX ] = llvm_module->getGlobalVariable( "rcx" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RDX ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rdx", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rdx", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RDX ] = llvm_module->getGlobalVariable( "rdx" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RSI ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rsi", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rsi", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RSI ] = llvm_module->getGlobalVariable( "rsi" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RDI ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rdi", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rdi", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RDI ] = llvm_module->getGlobalVariable( "rdi" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RBP ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rbp", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rbp", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RBP ] = llvm_module->getGlobalVariable( "rbp" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RSP ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rsp", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rsp", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RSP ] = llvm_module->getGlobalVariable( "rsp" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R8 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r8", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r8", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R8 ] = llvm_module->getGlobalVariable( "r8" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R9 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r9", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r9", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R9 ] = llvm_module->getGlobalVariable( "r9" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R10 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r10", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r10", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R10 ] = llvm_module->getGlobalVariable( "r10" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R11 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r11", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r11", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R11 ] = llvm_module->getGlobalVariable( "r11" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R12 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r12", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r12", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R12 ] = llvm_module->getGlobalVariable( "r12" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R13 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r13", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r13", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R13 ] = llvm_module->getGlobalVariable( "r13" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R14 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r14", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r14", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R14 ] = llvm_module->getGlobalVariable( "r14" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R15 ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r15", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "r15", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_R15 ] = llvm_module->getGlobalVariable( "r15" );
|
|
|
|
|
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RFLAGS ] =
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rflags", llvm::IntegerType::get( *llvm_ctx, 64 ) );
|
|
|
|
|
llvm_module->getOrInsertGlobal( "rflags", ir_builder->getInt64Ty() );
|
|
|
|
|
native_registers[ ZYDIS_REGISTER_RFLAGS ] = llvm_module->getGlobalVariable( "rflags" );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void vmp_rtn_t::create_virtual_registers( void )
|
|
|
|
@ -109,6 +144,114 @@ namespace vm
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void vmp_rtn_t::push( std::uint8_t byte_size, llvm::Value *input_value )
|
|
|
|
|
{
|
|
|
|
|
// Load the current stack index into a temporary variable
|
|
|
|
|
auto current_stack_index = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, 64 ), stack_ptr, false );
|
|
|
|
|
|
|
|
|
|
// Subtract the input value size from the current stack index
|
|
|
|
|
auto new_stack_index = ir_builder->CreateSub(
|
|
|
|
|
current_stack_index, llvm::ConstantInt::get( llvm::IntegerType::get( *llvm_ctx, 64 ), byte_size ) );
|
|
|
|
|
|
|
|
|
|
// Store the newly calculated stack index into VSP
|
|
|
|
|
ir_builder->CreateStore( new_stack_index, stack_ptr );
|
|
|
|
|
|
|
|
|
|
// Get a pointer to the top byte of the stack
|
|
|
|
|
llvm::Value *i64_zero = llvm::ConstantInt::get( *llvm_ctx, llvm::APInt( 64, 0 ) );
|
|
|
|
|
llvm::Value *indices[ 2 ] = { i64_zero, new_stack_index };
|
|
|
|
|
auto stack_ptr = ir_builder->CreateInBoundsGEP( virtual_stack, llvm::ArrayRef< llvm::Value * >( indices, 2 ) );
|
|
|
|
|
|
|
|
|
|
// Store the input value at the calculated stack address
|
|
|
|
|
if ( byte_size == 1 )
|
|
|
|
|
{
|
|
|
|
|
ir_builder->CreateStore( input_value, stack_ptr );
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
// Cast the pointer so the stack item width matches the width of the input value
|
|
|
|
|
auto casted_ptr = ir_builder->CreatePointerCast(
|
|
|
|
|
stack_ptr, llvm::PointerType::get( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), 0 ) );
|
|
|
|
|
|
|
|
|
|
ir_builder->CreateStore( input_value, casted_ptr );
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
llvm::Value *vmp_rtn_t::pop( std::uint8_t byte_size )
|
|
|
|
|
{
|
|
|
|
|
// Load the current stack index into a temporary variable
|
|
|
|
|
auto current_stack_index = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, 64 ), stack_ptr, false );
|
|
|
|
|
|
|
|
|
|
// Get a pointer to the top byte of the stack
|
|
|
|
|
llvm::Value *i64_zero = llvm::ConstantInt::get( *llvm_ctx, llvm::APInt( 64, 0 ) );
|
|
|
|
|
llvm::Value *indices[ 2 ] = { i64_zero, current_stack_index };
|
|
|
|
|
auto stack_ptr = ir_builder->CreateInBoundsGEP( virtual_stack, llvm::ArrayRef< llvm::Value * >( indices, 2 ) );
|
|
|
|
|
|
|
|
|
|
// Read the value at the top of the stack
|
|
|
|
|
llvm::Value *output_value = nullptr;
|
|
|
|
|
|
|
|
|
|
if ( byte_size == 1 )
|
|
|
|
|
{
|
|
|
|
|
output_value = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, 8 ), stack_ptr );
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
// Cast the current stack pointer so the stack item width matches the width of the output value
|
|
|
|
|
auto casted_ptr = ir_builder->CreatePointerCast(
|
|
|
|
|
stack_ptr, llvm::PointerType::get( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), 0 ) );
|
|
|
|
|
|
|
|
|
|
output_value = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), casted_ptr );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Subtract the input value size from the current stack index
|
|
|
|
|
auto new_stack_index = ir_builder->CreateAdd(
|
|
|
|
|
current_stack_index, llvm::ConstantInt::get( llvm::IntegerType::get( *llvm_ctx, 64 ), byte_size ) );
|
|
|
|
|
|
|
|
|
|
// Store the newly calculated stack index into VSP
|
|
|
|
|
ir_builder->CreateStore( new_stack_index, this->stack_ptr );
|
|
|
|
|
return output_value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
llvm::Value *vmp_rtn_t::peek( std::uint8_t byte_size, std::uint8_t byte_offset )
|
|
|
|
|
{
|
|
|
|
|
// Load the current stack index into a temporary variable
|
|
|
|
|
auto current_stack_index = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, 64 ), stack_ptr, false );
|
|
|
|
|
|
|
|
|
|
if ( byte_offset )
|
|
|
|
|
{
|
|
|
|
|
auto t1 = ir_builder->CreateAdd(
|
|
|
|
|
current_stack_index, llvm::ConstantInt::get( llvm::IntegerType::get( *llvm_ctx, 64 ), byte_offset ) );
|
|
|
|
|
|
|
|
|
|
current_stack_index = ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, 64 ), t1, false );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Get a pointer to the top byte of the stack + byte_offset (if any)
|
|
|
|
|
llvm::Value *i64_zero = llvm::ConstantInt::get( *llvm_ctx, llvm::APInt( 64, 0 ) );
|
|
|
|
|
llvm::Value *indices[ 2 ] = { i64_zero, current_stack_index };
|
|
|
|
|
auto stack_ptr = ir_builder->CreateInBoundsGEP( virtual_stack, llvm::ArrayRef< llvm::Value * >( indices, 2 ) );
|
|
|
|
|
|
|
|
|
|
if ( byte_size != 1 )
|
|
|
|
|
{
|
|
|
|
|
auto casted_ptr = ir_builder->CreatePointerCast(
|
|
|
|
|
stack_ptr, llvm::PointerType::get( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), 0 ) );
|
|
|
|
|
|
|
|
|
|
return ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), casted_ptr );
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
return ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), stack_ptr );
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
llvm::Value *vmp_rtn_t::load_value( std::uint8_t byte_size, llvm::GlobalValue *global )
|
|
|
|
|
{
|
|
|
|
|
return ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), global );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
llvm::Value *vmp_rtn_t::load_value( std::uint8_t byte_size, llvm::AllocaInst *var )
|
|
|
|
|
{
|
|
|
|
|
return ir_builder->CreateLoad( llvm::IntegerType::get( *llvm_ctx, byte_size * 8 ), var );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void vmp_rtn_t::create_virtual_stack( void )
|
|
|
|
|
{
|
|
|
|
|
// allocate stack space...
|
|
|
|
@ -117,7 +260,6 @@ namespace vm
|
|
|
|
|
|
|
|
|
|
// allocate stack pointer...
|
|
|
|
|
stack_ptr = ir_builder->CreateAlloca( llvm::IntegerType::get( *llvm_ctx, 64 ), nullptr, "sp" );
|
|
|
|
|
|
|
|
|
|
ir_builder->CreateStore( llvm::ConstantInt::get( llvm::IntegerType::getInt64Ty( *llvm_ctx ), 1024 ),
|
|
|
|
|
stack_ptr );
|
|
|
|
|
}
|
|
|
|
@ -131,8 +273,7 @@ namespace vm
|
|
|
|
|
{
|
|
|
|
|
if ( !vmp2::lifters::lift( this, vmp2_code_blocks[ idx ], vinstr, ir_builder.get() ) )
|
|
|
|
|
{
|
|
|
|
|
std::printf( "> failed to devirtualize virtual instruction with vm handler index = %d\n",
|
|
|
|
|
vinstr.opcode );
|
|
|
|
|
std::printf( "> failed to devirtualize virtual instruction with opcode = %d\n", vinstr.opcode );
|
|
|
|
|
|
|
|
|
|
llvm_module->print( llvm::outs(), nullptr );
|
|
|
|
|
return nullptr;
|
|
|
|
|