From 442edfd1c4c4de1e54a5deb62148ff3595198cea Mon Sep 17 00:00:00 2001
From: _xeroxz <xerox@back.engineering>
Date: Tue, 1 Jun 2021 16:09:11 -0700
Subject: [PATCH] added SHRW virtual instruction

---
 include/vmprofiler.hpp | 18 +++++++-----
 src/vmprofiles/shr.cpp | 64 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 7 deletions(-)

diff --git a/include/vmprofiler.hpp b/include/vmprofiler.hpp
index 532d42e..f4f3640 100644
--- a/include/vmprofiler.hpp
+++ b/include/vmprofiler.hpp
@@ -32,7 +32,6 @@ namespace vm
         {
             INVALID,
             PUSHVSP,
-            SHRQ,
             MULQ,
             DIVQ,
             CALL,
@@ -69,6 +68,9 @@ namespace vm
             SHLQ,
             SHLDW,
 
+            SHRQ,
+            SHRW,
+
             NANDQ,
             NANDDW
         };
@@ -152,8 +154,10 @@ namespace vm
             extern vm::handler::profile_t readq;
             extern vm::handler::profile_t readdw;
 
-            extern vm::handler::profile_t call;
             extern vm::handler::profile_t shrq;
+            extern vm::handler::profile_t shrw;
+
+            extern vm::handler::profile_t call;
             extern vm::handler::profile_t pushvsp;
             extern vm::handler::profile_t mulq;
             extern vm::handler::profile_t divq;
@@ -162,13 +166,13 @@ namespace vm
             extern vm::handler::profile_t vmexit;
 
             inline std::vector< vm::handler::profile_t * > all = {
-                &sregq,      &sregdw,      &sregw,      &lregq,    &lregdw,  &lconstq, &lconstbzxw, &lconstbsxdw,
-                &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstdw, &addq,    &adddw,   &addw,
+                &sregq,      &sregdw,      &sregw,      &lregq,    &lregdw, &lconstq, &lconstbzxw, &lconstbsxdw,
+                &lconstbsxq, &lconstdwsxq, &lconstwsxq, &lconstdw, &addq,   &adddw,   &addw,
 
-                &shlq,       &shldw,       &writeq,     &writedw,  &nandq,   &nanddw,
+                &shlq,       &shldw,       &writeq,     &writedw,  &nandq,  &nanddw,
 
-                &shrq,       &readq,       &readdw,     &mulq,     &pushvsp, &divq,    &jmp,        &vmexit,
-                &call };
+                &shrq,       &shrw,        &readq,      &readdw,   &mulq,   &pushvsp, &divq,       &jmp,
+                &vmexit,     &call };
         } // namespace profile
     }     // namespace handler
 } // namespace vm
\ No newline at end of file
diff --git a/src/vmprofiles/shr.cpp b/src/vmprofiles/shr.cpp
index e9ec812..610e2f7 100644
--- a/src/vmprofiles/shr.cpp
+++ b/src/vmprofiles/shr.cpp
@@ -69,6 +69,70 @@ namespace vm
                                instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
                                instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
                     } } } };
+            
+            vm::handler::profile_t shrw = {
+                // MOV AX, [RBP]
+                // MOV CL, [RBP+0x2]
+                // SUB RBP, 0x6
+                // SHR AX, CL
+                // MOV [RBP+0x8], AX
+                // PUSHFQ
+                // POP [RBP]
+                "SHRW",
+                SHRW,
+                NULL,
+                { { // MOV AX, [RBP]
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_AX &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP;
+                    },
+                    // MOV CL, [RBP+0x2]
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_CL &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 1 ].mem.base == ZYDIS_REGISTER_RBP &&
+                               instr.operands[ 1 ].mem.disp.value == 0x2;
+                    },
+                    // SUB RBP, 0x6
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_SUB &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RBP &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_IMMEDIATE &&
+                               instr.operands[ 1 ].imm.value.u == 0x6;
+                    },
+                    // SHR AX, CL
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_SHR &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_AX &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_CL;
+                    },
+                    // MOV [RBP+0x8], AX
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_MOV &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP &&
+                               instr.operands[ 0 ].mem.disp.value == 0x8 &&
+                               instr.operands[ 1 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
+                               instr.operands[ 1 ].reg.value == ZYDIS_REGISTER_AX;
+                    },
+                    // PUSHFQ
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_PUSHFQ;
+                    },
+                    // POP [RBP]
+                    []( const zydis_decoded_instr_t &instr ) -> bool {
+                        return instr.mnemonic == ZYDIS_MNEMONIC_POP &&
+                               instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_MEMORY &&
+                               instr.operands[ 0 ].mem.base == ZYDIS_REGISTER_RBP;
+                    } } } };
         }
     } // namespace handler
 } // namespace vm
\ No newline at end of file