Public-Mirror/gbe_fork
1
0
Fork 0
mirror of https://github.com/Detanup01/gbe_fork.git synced 2024-12-27 19:04:19 +08:00
Code Issues 1 Projects Releases Wiki Activity
gbe_fork/detours/disasm.cpp

4251 lines
159 KiB
C++
Raw Normal View History

Initial commit.
2019-04-13 12:21:56 -04:00
//////////////////////////////////////////////////////////////////////////////
//
// Detours Disassembler (disasm.cpp of detours.lib)
//
// Microsoft Research Detours Package, Version 4.0.1
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//
#if _MSC_VER >= 1900
#pragma warning(push)
#pragma warning(disable:4091) // empty typedef
#endif
#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1
#include <windows.h>
#include <limits.h>
// #define DETOUR_DEBUG 1
#define DETOURS_INTERNAL
#include "detours.h"
#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH
#error detours.h version mismatch
#endif
#if _MSC_VER >= 1900
#pragma warning(pop)
#endif
#undef ASSERT
#define ASSERT(x)
//////////////////////////////////////////////////////////////////////////////
//
// Special macros to handle the case when we are building disassembler for
// offline processing.
//
#if defined(DETOURS_X86_OFFLINE_LIBRARY) \
|| defined(DETOURS_X64_OFFLINE_LIBRARY) \
|| defined(DETOURS_ARM_OFFLINE_LIBRARY) \
|| defined(DETOURS_ARM64_OFFLINE_LIBRARY) \
|| defined(DETOURS_IA64_OFFLINE_LIBRARY)
#undef DETOURS_X64
#undef DETOURS_X86
#undef DETOURS_IA64
#undef DETOURS_ARM
#undef DETOURS_ARM64
#if defined(DETOURS_X86_OFFLINE_LIBRARY)
#define DetourCopyInstruction DetourCopyInstructionX86
#define DetourSetCodeModule DetourSetCodeModuleX86
#define CDetourDis CDetourDisX86
#define DETOURS_X86
#elif defined(DETOURS_X64_OFFLINE_LIBRARY)
#if !defined(DETOURS_64BIT)
// Fix this as/if bugs are discovered.
//#error X64 disassembler can only build for 64-bit.
#endif
#define DetourCopyInstruction DetourCopyInstructionX64
#define DetourSetCodeModule DetourSetCodeModuleX64
#define CDetourDis CDetourDisX64
#define DETOURS_X64
#elif defined(DETOURS_ARM_OFFLINE_LIBRARY)
#define DetourCopyInstruction DetourCopyInstructionARM
#define DetourSetCodeModule DetourSetCodeModuleARM
#define CDetourDis CDetourDisARM
#define DETOURS_ARM
#elif defined(DETOURS_ARM64_OFFLINE_LIBRARY)
#define DetourCopyInstruction DetourCopyInstructionARM64
#define DetourSetCodeModule DetourSetCodeModuleARM64
#define CDetourDis CDetourDisARM64
#define DETOURS_ARM64
#elif defined(DETOURS_IA64_OFFLINE_LIBRARY)
#define DetourCopyInstruction DetourCopyInstructionIA64
#define DetourSetCodeModule DetourSetCodeModuleIA64
#define DETOURS_IA64
#else
#error
#endif
#endif
//////////////////////////////////////////////////////////////////////////////
//
// Function:
// DetourCopyInstruction(PVOID pDst,
// PVOID *ppDstPool
// PVOID pSrc,
// PVOID *ppTarget,
// LONG *plExtra)
// Purpose:
// Copy a single instruction from pSrc to pDst.
//
// Arguments:
// pDst:
// Destination address for the instruction. May be NULL in which
// case DetourCopyInstruction is used to measure an instruction.
// If not NULL then the source instruction is copied to the
// destination instruction and any relative arguments are adjusted.
// ppDstPool:
// Destination address for the end of the constant pool. The
// constant pool works backwards toward pDst. All memory between
// pDst and *ppDstPool must be available for use by this function.
// ppDstPool may be NULL if pDst is NULL.
// pSrc:
// Source address of the instruction.
// ppTarget:
// Out parameter for any target instruction address pointed to by
// the instruction. For example, a branch or a jump insruction has
// a target, but a load or store instruction doesn't. A target is
// another instruction that may be executed as a result of this
// instruction. ppTarget may be NULL.
// plExtra:
// Out parameter for the number of extra bytes needed by the
// instruction to reach the target. For example, lExtra = 3 if the
// instruction had an 8-bit relative offset, but needs a 32-bit
// relative offset.
//
// Returns:
// Returns the address of the next instruction (following in the source)
// instruction. By subtracting pSrc from the return value, the caller
// can determinte the size of the instruction copied.
//
// Comments:
// By following the pTarget, the caller can follow alternate
// instruction streams. However, it is not always possible to determine
// the target based on static analysis. For example, the destination of
// a jump relative to a register cannot be determined from just the
// instruction stream. The output value, pTarget, can have any of the
// following outputs:
// DETOUR_INSTRUCTION_TARGET_NONE:
// The instruction has no targets.
// DETOUR_INSTRUCTION_TARGET_DYNAMIC:
// The instruction has a non-deterministic (dynamic) target.
// (i.e. the jump is to an address held in a register.)
// Address: The instruction has the specified target.
//
// When copying instructions, DetourCopyInstruction insures that any
// targets remain constant. It does so by adjusting any IP relative
// offsets.
//
#pragma data_seg(".detourd")
#pragma const_seg(".detourc")
//////////////////////////////////////////////////// X86 and X64 Disassembler.
//
// Includes full support for all x86 chips prior to the Pentium III, and some newer stuff.
//
#if defined(DETOURS_X64) || defined(DETOURS_X86)
class CDetourDis
{
public:
CDetourDis(_Out_opt_ PBYTE *ppbTarget,
_Out_opt_ LONG *plExtra);
PBYTE CopyInstruction(PBYTE pbDst, PBYTE pbSrc);
static BOOL SanityCheckSystem();
static BOOL SetCodeModule(PBYTE pbBeg, PBYTE pbEnd, BOOL fLimitReferencesToModule);
public:
struct COPYENTRY;
typedef const COPYENTRY * REFCOPYENTRY;
typedef PBYTE (CDetourDis::* COPYFUNC)(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
// nFlagBits flags.
enum {
DYNAMIC = 0x1u,
ADDRESS = 0x2u,
NOENLARGE = 0x4u,
RAX = 0x8u,
};
// ModR/M Flags
enum {
SIB = 0x10u,
RIP = 0x20u,
NOTSIB = 0x0fu,
};
struct COPYENTRY
{
// Many of these fields are often ignored. See ENTRY_DataIgnored.
ULONG nOpcode : 8; // Opcode (ignored)
ULONG nFixedSize : 4; // Fixed size of opcode
ULONG nFixedSize16 : 4; // Fixed size when 16 bit operand
ULONG nModOffset : 4; // Offset to mod/rm byte (0=none)
ULONG nRelOffset : 4; // Offset to relative target.
ULONG nFlagBits : 4; // Flags for DYNAMIC, etc.
COPYFUNC pfCopy; // Function pointer.
};
protected:
// These macros define common uses of nFixedSize, nFixedSize16, nModOffset, nRelOffset, nFlagBits, pfCopy.
#define ENTRY_DataIgnored 0, 0, 0, 0, 0,
#define ENTRY_CopyBytes1 1, 1, 0, 0, 0, &CDetourDis::CopyBytes
#ifdef DETOURS_X64
#define ENTRY_CopyBytes1Address 9, 5, 0, 0, ADDRESS, &CDetourDis::CopyBytes
#else
#define ENTRY_CopyBytes1Address 5, 3, 0, 0, ADDRESS, &CDetourDis::CopyBytes
#endif
#define ENTRY_CopyBytes1Dynamic 1, 1, 0, 0, DYNAMIC, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2 2, 2, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2Jump ENTRY_DataIgnored &CDetourDis::CopyBytesJump
#define ENTRY_CopyBytes2CantJump 2, 2, 0, 1, NOENLARGE, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2Dynamic 2, 2, 0, 0, DYNAMIC, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3 3, 3, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Dynamic 3, 3, 0, 0, DYNAMIC, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Or5 5, 3, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Or5Dynamic 5, 3, 0, 0, DYNAMIC, &CDetourDis::CopyBytes // x86 only
#ifdef DETOURS_X64
#define ENTRY_CopyBytes3Or5Rax 5, 3, 0, 0, RAX, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Or5Target 5, 5, 0, 1, 0, &CDetourDis::CopyBytes
#else
#define ENTRY_CopyBytes3Or5Rax 5, 3, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Or5Target 5, 3, 0, 1, 0, &CDetourDis::CopyBytes
#endif
#define ENTRY_CopyBytes4 4, 4, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes5 5, 5, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes5Or7Dynamic 7, 5, 0, 0, DYNAMIC, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes7 7, 7, 0, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2Mod 2, 2, 1, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2ModDynamic 2, 2, 1, 0, DYNAMIC, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2Mod1 3, 3, 1, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes2ModOperand 6, 4, 1, 0, 0, &CDetourDis::CopyBytes
#define ENTRY_CopyBytes3Mod 3, 3, 2, 0, 0, &CDetourDis::CopyBytes // SSE3 0F 38 opcode modrm
#define ENTRY_CopyBytes3Mod1 4, 4, 2, 0, 0, &CDetourDis::CopyBytes // SSE3 0F 3A opcode modrm .. imm8
#define ENTRY_CopyBytesPrefix ENTRY_DataIgnored &CDetourDis::CopyBytesPrefix
#define ENTRY_CopyBytesSegment ENTRY_DataIgnored &CDetourDis::CopyBytesSegment
#define ENTRY_CopyBytesRax ENTRY_DataIgnored &CDetourDis::CopyBytesRax
#define ENTRY_CopyF2 ENTRY_DataIgnored &CDetourDis::CopyF2
#define ENTRY_CopyF3 ENTRY_DataIgnored &CDetourDis::CopyF3 // 32bit x86 only
#define ENTRY_Copy0F ENTRY_DataIgnored &CDetourDis::Copy0F
#define ENTRY_Copy0F78 ENTRY_DataIgnored &CDetourDis::Copy0F78
#define ENTRY_Copy0F00 ENTRY_DataIgnored &CDetourDis::Copy0F00 // 32bit x86 only
#define ENTRY_Copy0FB8 ENTRY_DataIgnored &CDetourDis::Copy0FB8 // 32bit x86 only
#define ENTRY_Copy66 ENTRY_DataIgnored &CDetourDis::Copy66
#define ENTRY_Copy67 ENTRY_DataIgnored &CDetourDis::Copy67
#define ENTRY_CopyF6 ENTRY_DataIgnored &CDetourDis::CopyF6
#define ENTRY_CopyF7 ENTRY_DataIgnored &CDetourDis::CopyF7
#define ENTRY_CopyFF ENTRY_DataIgnored &CDetourDis::CopyFF
#define ENTRY_CopyVex2 ENTRY_DataIgnored &CDetourDis::CopyVex2
#define ENTRY_CopyVex3 ENTRY_DataIgnored &CDetourDis::CopyVex3
#define ENTRY_Invalid ENTRY_DataIgnored &CDetourDis::Invalid
#define ENTRY_End ENTRY_DataIgnored NULL
PBYTE CopyBytes(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyBytesPrefix(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyBytesSegment(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyBytesRax(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyBytesJump(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE Invalid(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE AdjustTarget(PBYTE pbDst, PBYTE pbSrc, UINT cbOp,
UINT cbTargetOffset, UINT cbTargetSize);
protected:
PBYTE Copy0F(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE Copy0F00(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // x86 only sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7
PBYTE Copy0F78(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // vmread, 66/extrq/ib/ib, F2/insertq/ib/ib
PBYTE Copy0FB8(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // jmpe or F3/popcnt
PBYTE Copy66(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE Copy67(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyF2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyF3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // x86 only
PBYTE CopyF6(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyF7(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyFF(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyVex2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyVex3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);
PBYTE CopyVexCommon(BYTE m, PBYTE pbDst, PBYTE pbSrc);
protected:
static const COPYENTRY s_rceCopyTable[257];
static const COPYENTRY s_rceCopyTable0F[257];
static const BYTE s_rbModRm[256];
static PBYTE s_pbModuleBeg;
static PBYTE s_pbModuleEnd;
static BOOL s_fLimitReferencesToModule;
protected:
BOOL m_bOperandOverride;
BOOL m_bAddressOverride;
BOOL m_bRaxOverride; // AMD64 only
BOOL m_bVex;
BOOL m_bF2;
BOOL m_bF3; // x86 only
BYTE m_nSegmentOverride;
PBYTE * m_ppbTarget;
LONG * m_plExtra;
LONG m_lScratchExtra;
PBYTE m_pbScratchTarget;
BYTE m_rbScratchDst[64]; // matches or exceeds rbCode
};
PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
_Inout_opt_ PVOID *ppDstPool,
_In_ PVOID pSrc,
_Out_opt_ PVOID *ppTarget,
_Out_opt_ LONG *plExtra)
{
UNREFERENCED_PARAMETER(ppDstPool); // x86 & x64 don't use a constant pool.
CDetourDis oDetourDisasm((PBYTE*)ppTarget, plExtra);
return oDetourDisasm.CopyInstruction((PBYTE)pDst, (PBYTE)pSrc);
}
/////////////////////////////////////////////////////////// Disassembler Code.
//
CDetourDis::CDetourDis(_Out_opt_ PBYTE *ppbTarget, _Out_opt_ LONG *plExtra)
{
m_bOperandOverride = FALSE;
m_bAddressOverride = FALSE;
m_bRaxOverride = FALSE;
m_bF2 = FALSE;
m_bF3 = FALSE;
m_bVex = FALSE;
m_ppbTarget = ppbTarget ? ppbTarget : &m_pbScratchTarget;
m_plExtra = plExtra ? plExtra : &m_lScratchExtra;
*m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_NONE;
*m_plExtra = 0;
}
PBYTE CDetourDis::CopyInstruction(PBYTE pbDst, PBYTE pbSrc)
{
// Configure scratch areas if real areas are not available.
if (NULL == pbDst) {
pbDst = m_rbScratchDst;
}
if (NULL == pbSrc) {
// We can't copy a non-existent instruction.
SetLastError(ERROR_INVALID_DATA);
return NULL;
}
// Figure out how big the instruction is, do the appropriate copy,
// and figure out what the target of the instruction is if any.
//
REFCOPYENTRY pEntry = &s_rceCopyTable[pbSrc[0]];
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyBytes(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
UINT nBytesFixed;
ASSERT(!m_bVex || pEntry->nFlagBits == 0);
ASSERT(!m_bVex || pEntry->nFixedSize == pEntry->nFixedSize16);
UINT const nModOffset = pEntry->nModOffset;
UINT const nFlagBits = pEntry->nFlagBits;
UINT const nFixedSize = pEntry->nFixedSize;
UINT const nFixedSize16 = pEntry->nFixedSize16;
if (nFlagBits & ADDRESS) {
nBytesFixed = m_bAddressOverride ? nFixedSize16 : nFixedSize;
}
#ifdef DETOURS_X64
// REX.W trumps 66
else if (m_bRaxOverride) {
nBytesFixed = nFixedSize + ((nFlagBits & RAX) ? 4 : 0);
}
#endif
else {
nBytesFixed = m_bOperandOverride ? nFixedSize16 : nFixedSize;
}
UINT nBytes = nBytesFixed;
UINT nRelOffset = pEntry->nRelOffset;
UINT cbTarget = nBytes - nRelOffset;
if (nModOffset > 0) {
ASSERT(nRelOffset == 0);
BYTE const bModRm = pbSrc[nModOffset];
BYTE const bFlags = s_rbModRm[bModRm];
nBytes += bFlags & NOTSIB;
if (bFlags & SIB) {
BYTE const bSib = pbSrc[nModOffset + 1];
if ((bSib & 0x07) == 0x05) {
if ((bModRm & 0xc0) == 0x00) {
nBytes += 4;
}
else if ((bModRm & 0xc0) == 0x40) {
nBytes += 1;
}
else if ((bModRm & 0xc0) == 0x80) {
nBytes += 4;
}
}
cbTarget = nBytes - nRelOffset;
}
#ifdef DETOURS_X64
else if (bFlags & RIP) {
nRelOffset = nModOffset + 1;
cbTarget = 4;
}
#endif
}
CopyMemory(pbDst, pbSrc, nBytes);
if (nRelOffset) {
*m_ppbTarget = AdjustTarget(pbDst, pbSrc, nBytes, nRelOffset, cbTarget);
#ifdef DETOURS_X64
if (pEntry->nRelOffset == 0) {
// This is a data target, not a code target, so we shouldn't return it.
*m_ppbTarget = NULL;
}
#endif
}
if (nFlagBits & NOENLARGE) {
*m_plExtra = -*m_plExtra;
}
if (nFlagBits & DYNAMIC) {
*m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
return pbSrc + nBytes;
}
PBYTE CDetourDis::CopyBytesPrefix(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
pbDst[0] = pbSrc[0];
pEntry = &s_rceCopyTable[pbSrc[1]];
return (this->*pEntry->pfCopy)(pEntry, pbDst + 1, pbSrc + 1);
}
PBYTE CDetourDis::CopyBytesSegment(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
{
m_nSegmentOverride = pbSrc[0];
return CopyBytesPrefix(0, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyBytesRax(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
{ // AMD64 only
if (pbSrc[0] & 0x8) {
m_bRaxOverride = TRUE;
}
return CopyBytesPrefix(0, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyBytesJump(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
(void)pEntry;
PVOID pvSrcAddr = &pbSrc[1];
PVOID pvDstAddr = NULL;
LONG_PTR nOldOffset = (LONG_PTR)*(signed char*&)pvSrcAddr;
LONG_PTR nNewOffset = 0;
*m_ppbTarget = pbSrc + 2 + nOldOffset;
if (pbSrc[0] == 0xeb) {
pbDst[0] = 0xe9;
pvDstAddr = &pbDst[1];
nNewOffset = nOldOffset - ((pbDst - pbSrc) + 3);
*(UNALIGNED LONG*&)pvDstAddr = (LONG)nNewOffset;
*m_plExtra = 3;
return pbSrc + 2;
}
ASSERT(pbSrc[0] >= 0x70 && pbSrc[0] <= 0x7f);
pbDst[0] = 0x0f;
pbDst[1] = 0x80 | (pbSrc[0] & 0xf);
pvDstAddr = &pbDst[2];
nNewOffset = nOldOffset - ((pbDst - pbSrc) + 4);
*(UNALIGNED LONG*&)pvDstAddr = (LONG)nNewOffset;
*m_plExtra = 4;
return pbSrc + 2;
}
PBYTE CDetourDis::AdjustTarget(PBYTE pbDst, PBYTE pbSrc, UINT cbOp,
UINT cbTargetOffset, UINT cbTargetSize)
{
PBYTE pbTarget = NULL;
#if 1 // fault injection to test test code
#if defined(DETOURS_X64)
typedef LONGLONG T;
#else
typedef LONG T;
#endif
T nOldOffset;
T nNewOffset;
PVOID pvTargetAddr = &pbDst[cbTargetOffset];
switch (cbTargetSize) {
case 1:
nOldOffset = *(signed char*&)pvTargetAddr;
break;
case 2:
nOldOffset = *(UNALIGNED SHORT*&)pvTargetAddr;
break;
case 4:
nOldOffset = *(UNALIGNED LONG*&)pvTargetAddr;
break;
#if defined(DETOURS_X64)
case 8:
nOldOffset = *(UNALIGNED LONGLONG*&)pvTargetAddr;
break;
#endif
default:
ASSERT(!"cbTargetSize is invalid.");
nOldOffset = 0;
break;
}
pbTarget = pbSrc + cbOp + nOldOffset;
nNewOffset = nOldOffset - (T)(pbDst - pbSrc);
switch (cbTargetSize) {
case 1:
*(CHAR*&)pvTargetAddr = (CHAR)nNewOffset;
if (nNewOffset < SCHAR_MIN || nNewOffset > SCHAR_MAX) {
*m_plExtra = sizeof(ULONG) - 1;
}
break;
case 2:
*(UNALIGNED SHORT*&)pvTargetAddr = (SHORT)nNewOffset;
if (nNewOffset < SHRT_MIN || nNewOffset > SHRT_MAX) {
*m_plExtra = sizeof(ULONG) - 2;
}
break;
case 4:
*(UNALIGNED LONG*&)pvTargetAddr = (LONG)nNewOffset;
if (nNewOffset < LONG_MIN || nNewOffset > LONG_MAX) {
*m_plExtra = sizeof(ULONG) - 4;
}
break;
#if defined(DETOURS_X64)
case 8:
*(UNALIGNED LONGLONG*&)pvTargetAddr = nNewOffset;
break;
#endif
}
#ifdef DETOURS_X64
// When we are only computing size, source and dest can be
// far apart, distance not encodable in 32bits. Ok.
// At least still check the lower 32bits.
if (pbDst >= m_rbScratchDst && pbDst < (sizeof(m_rbScratchDst) + m_rbScratchDst)) {
ASSERT((((size_t)pbDst + cbOp + nNewOffset) & 0xFFFFFFFF) == (((size_t)pbTarget) & 0xFFFFFFFF));
}
else
#endif
{
ASSERT(pbDst + cbOp + nNewOffset == pbTarget);
}
#endif
return pbTarget;
}
PBYTE CDetourDis::Invalid(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
(void)pbDst;
(void)pEntry;
ASSERT(!"Invalid Instruction");
return pbSrc + 1;
}
////////////////////////////////////////////////////// Individual Bytes Codes.
//
PBYTE CDetourDis::Copy0F(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
pbDst[0] = pbSrc[0];
pEntry = &s_rceCopyTable0F[pbSrc[1]];
return (this->*pEntry->pfCopy)(pEntry, pbDst + 1, pbSrc + 1);
}
PBYTE CDetourDis::Copy0F78(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
{
// vmread, 66/extrq, F2/insertq
static const COPYENTRY vmread = { 0x78, ENTRY_CopyBytes2Mod };
static const COPYENTRY extrq_insertq = { 0x78, ENTRY_CopyBytes4 };
ASSERT(!(m_bF2 && m_bOperandOverride));
// For insertq and presumably despite documentation extrq, mode must be 11, not checked.
// insertq/extrq/78 are followed by two immediate bytes, and given mode == 11, mod/rm byte is always one byte,
// and the 0x78 makes 4 bytes (not counting the 66/F2/F which are accounted for elsewhere)
REFCOPYENTRY const pEntry = ((m_bF2 || m_bOperandOverride) ? &extrq_insertq : &vmread);
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::Copy0F00(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
{
// jmpe is 32bit x86 only
// Notice that the sizes are the same either way, but jmpe is marked as "dynamic".
static const COPYENTRY other = { 0xB8, ENTRY_CopyBytes2Mod }; // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6 invalid/7
static const COPYENTRY jmpe = { 0xB8, ENTRY_CopyBytes2ModDynamic }; // jmpe/6 x86-on-IA64 syscalls
REFCOPYENTRY const pEntry = (((6 << 3) == ((7 << 3) & pbSrc[1])) ? &jmpe : &other);
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::Copy0FB8(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
{
// jmpe is 32bit x86 only
static const COPYENTRY popcnt = { 0xB8, ENTRY_CopyBytes2Mod };
static const COPYENTRY jmpe = { 0xB8, ENTRY_CopyBytes3Or5Dynamic }; // jmpe x86-on-IA64 syscalls
REFCOPYENTRY const pEntry = m_bF3 ? &popcnt : &jmpe;
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::Copy66(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{ // Operand-size override prefix
m_bOperandOverride = TRUE;
return CopyBytesPrefix(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::Copy67(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{ // Address size override prefix
m_bAddressOverride = TRUE;
return CopyBytesPrefix(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyF2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
m_bF2 = TRUE;
return CopyBytesPrefix(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyF3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{ // x86 only
m_bF3 = TRUE;
return CopyBytesPrefix(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyF6(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
(void)pEntry;
// TEST BYTE /0
if (0x00 == (0x38 & pbSrc[1])) { // reg(bits 543) of ModR/M == 0
static const COPYENTRY ce = { 0xf6, ENTRY_CopyBytes2Mod1 };
return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
}
// DIV /6
// IDIV /7
// IMUL /5
// MUL /4
// NEG /3
// NOT /2
static const COPYENTRY ce = { 0xf6, ENTRY_CopyBytes2Mod };
return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyF7(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{
(void)pEntry;
// TEST WORD /0
if (0x00 == (0x38 & pbSrc[1])) { // reg(bits 543) of ModR/M == 0
static const COPYENTRY ce = { 0xf7, ENTRY_CopyBytes2ModOperand };
return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
}
// DIV /6
// IDIV /7
// IMUL /5
// MUL /4
// NEG /3
// NOT /2
static const COPYENTRY ce = { 0xf7, ENTRY_CopyBytes2Mod };
return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyFF(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)
{ // INC /0
// DEC /1
// CALL /2
// CALL /3
// JMP /4
// JMP /5
// PUSH /6
// invalid/7
(void)pEntry;
static const COPYENTRY ce = { 0xff, ENTRY_CopyBytes2Mod };
PBYTE pbOut = (this->*ce.pfCopy)(&ce, pbDst, pbSrc);
BYTE const b1 = pbSrc[1];
if (0x15 == b1 || 0x25 == b1) { // CALL [], JMP []
#ifdef DETOURS_X64
// All segments but FS and GS are equivalent.
if (m_nSegmentOverride != 0x64 && m_nSegmentOverride != 0x65)
#else
if (m_nSegmentOverride == 0 || m_nSegmentOverride == 0x2E)
#endif
{
#ifdef DETOURS_X64
INT32 offset = *(UNALIGNED INT32*)&pbSrc[2];
PBYTE *ppbTarget = (PBYTE *)(pbSrc + 6 + offset);
#else
PBYTE *ppbTarget = (PBYTE *)(SIZE_T)*(UNALIGNED ULONG*)&pbSrc[2];
#endif
if (s_fLimitReferencesToModule &&
(ppbTarget < (PVOID)s_pbModuleBeg || ppbTarget >= (PVOID)s_pbModuleEnd)) {
*m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
else {
// This can access violate on random bytes. Use DetourSetCodeModule.
*m_ppbTarget = *ppbTarget;
}
}
else {
*m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
}
else if (0x10 == (0x30 & b1) || // CALL /2 or /3 --> reg(bits 543) of ModR/M == 010 or 011
0x20 == (0x30 & b1)) { // JMP /4 or /5 --> reg(bits 543) of ModR/M == 100 or 101
*m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
return pbOut;
}
PBYTE CDetourDis::CopyVexCommon(BYTE m, PBYTE pbDst, PBYTE pbSrc)
// m is first instead of last in the hopes of pbDst/pbSrc being
// passed along efficiently in the registers they were already in.
{
static const COPYENTRY ceF38 = { 0x38, ENTRY_CopyBytes2Mod };
static const COPYENTRY ceF3A = { 0x3A, ENTRY_CopyBytes2Mod1 };
static const COPYENTRY Invalid = { 0xC4, ENTRY_Invalid };
m_bVex = TRUE;
REFCOPYENTRY pEntry;
switch (m) {
default: pEntry = &Invalid; break;
case 1: pEntry = &s_rceCopyTable0F[pbSrc[0]]; break;
case 2: pEntry = &ceF38; break;
case 3: pEntry = &ceF3A; break;
}
switch (pbSrc[-1] & 3) { // p in last byte
case 0: break;
case 1: m_bOperandOverride = TRUE; break;
case 2: m_bF3 = TRUE; break;
case 3: m_bF2 = TRUE; break;
}
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
PBYTE CDetourDis::CopyVex3(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
// 3 byte VEX prefix 0xC4
{
#ifdef DETOURS_X86
const static COPYENTRY ceLES = { 0xC4, ENTRY_CopyBytes2Mod };
if ((pbSrc[1] & 0xC0) != 0xC0) {
REFCOPYENTRY pEntry = &ceLES;
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
#endif
pbDst[0] = pbSrc[0];
pbDst[1] = pbSrc[1];
pbDst[2] = pbSrc[2];
#ifdef DETOURS_X64
m_bRaxOverride |= !!(pbSrc[2] & 0x80); // w in last byte, see CopyBytesRax
#else
//
// TODO
//
// Usually the VEX.W bit changes the size of a general purpose register and is ignored for 32bit.
// Sometimes it is an opcode extension.
// Look in the Intel manual, in the instruction-by-instruction reference, for ".W1",
// without nearby wording saying it is ignored for 32bit.
// For example: "VFMADD132PD/VFMADD213PD/VFMADD231PD Fused Multiply-Add of Packed Double-Precision Floating-Point Values".
//
// Then, go through each such case and determine if W0 vs. W1 affect the size of the instruction. Probably not.
// Look for the same encoding but with "W1" changed to "W0".
// Here is one such pairing:
// VFMADD132PD/VFMADD213PD/VFMADD231PD Fused Multiply-Add of Packed Double-Precision Floating-Point Values
//
// VEX.DDS.128.66.0F38.W1 98 /r A V/V FMA Multiply packed double-precision floating-point values
// from xmm0 and xmm2/mem, add to xmm1 and
// put result in xmm0.
// VFMADD132PD xmm0, xmm1, xmm2/m128
//
// VFMADD132PS/VFMADD213PS/VFMADD231PS Fused Multiply-Add of Packed Single-Precision Floating-Point Values
// VEX.DDS.128.66.0F38.W0 98 /r A V/V FMA Multiply packed single-precision floating-point values
// from xmm0 and xmm2/mem, add to xmm1 and put
// result in xmm0.
// VFMADD132PS xmm0, xmm1, xmm2/m128
//
#endif
return CopyVexCommon(pbSrc[1] & 0x1F, pbDst + 3, pbSrc + 3);
}
PBYTE CDetourDis::CopyVex2(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)
// 2 byte VEX prefix 0xC5
{
#ifdef DETOURS_X86
const static COPYENTRY ceLDS = { 0xC5, ENTRY_CopyBytes2Mod };
if ((pbSrc[1] & 0xC0) != 0xC0) {
REFCOPYENTRY pEntry = &ceLDS;
return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);
}
#endif
pbDst[0] = pbSrc[0];
pbDst[1] = pbSrc[1];
return CopyVexCommon(1, pbDst + 2, pbSrc + 2);
}
//////////////////////////////////////////////////////////////////////////////
//
PBYTE CDetourDis::s_pbModuleBeg = NULL;
PBYTE CDetourDis::s_pbModuleEnd = (PBYTE)~(ULONG_PTR)0;
BOOL CDetourDis::s_fLimitReferencesToModule = FALSE;
BOOL CDetourDis::SetCodeModule(PBYTE pbBeg, PBYTE pbEnd, BOOL fLimitReferencesToModule)
{
if (pbEnd < pbBeg) {
return FALSE;
}
s_pbModuleBeg = pbBeg;
s_pbModuleEnd = pbEnd;
s_fLimitReferencesToModule = fLimitReferencesToModule;
return TRUE;
}
///////////////////////////////////////////////////////// Disassembler Tables.
//
const BYTE CDetourDis::s_rbModRm[256] = {
0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 0x
0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 1x
0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 2x
0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 3x
1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 4x
1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 5x
1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 6x
1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 7x
4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // 8x
4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // 9x
4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // Ax
4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // Bx
0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Cx
0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Dx
0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Ex
0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 // Fx
};
const CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable[257] =
{
{ 0x00, ENTRY_CopyBytes2Mod }, // ADD /r
{ 0x01, ENTRY_CopyBytes2Mod }, // ADD /r
{ 0x02, ENTRY_CopyBytes2Mod }, // ADD /r
{ 0x03, ENTRY_CopyBytes2Mod }, // ADD /r
{ 0x04, ENTRY_CopyBytes2 }, // ADD ib
{ 0x05, ENTRY_CopyBytes3Or5 }, // ADD iw
#ifdef DETOURS_X64
{ 0x06, ENTRY_Invalid }, // Invalid
{ 0x07, ENTRY_Invalid }, // Invalid
#else
{ 0x06, ENTRY_CopyBytes1 }, // PUSH
{ 0x07, ENTRY_CopyBytes1 }, // POP
#endif
{ 0x08, ENTRY_CopyBytes2Mod }, // OR /r
{ 0x09, ENTRY_CopyBytes2Mod }, // OR /r
{ 0x0A, ENTRY_CopyBytes2Mod }, // OR /r
{ 0x0B, ENTRY_CopyBytes2Mod }, // OR /r
{ 0x0C, ENTRY_CopyBytes2 }, // OR ib
{ 0x0D, ENTRY_CopyBytes3Or5 }, // OR iw
#ifdef DETOURS_X64
{ 0x0E, ENTRY_Invalid }, // Invalid
#else
{ 0x0E, ENTRY_CopyBytes1 }, // PUSH
#endif
{ 0x0F, ENTRY_Copy0F }, // Extension Ops
{ 0x10, ENTRY_CopyBytes2Mod }, // ADC /r
{ 0x11, ENTRY_CopyBytes2Mod }, // ADC /r
{ 0x12, ENTRY_CopyBytes2Mod }, // ADC /r
{ 0x13, ENTRY_CopyBytes2Mod }, // ADC /r
{ 0x14, ENTRY_CopyBytes2 }, // ADC ib
{ 0x15, ENTRY_CopyBytes3Or5 }, // ADC id
#ifdef DETOURS_X64
{ 0x16, ENTRY_Invalid }, // Invalid
{ 0x17, ENTRY_Invalid }, // Invalid
#else
{ 0x16, ENTRY_CopyBytes1 }, // PUSH
{ 0x17, ENTRY_CopyBytes1 }, // POP
#endif
{ 0x18, ENTRY_CopyBytes2Mod }, // SBB /r
{ 0x19, ENTRY_CopyBytes2Mod }, // SBB /r
{ 0x1A, ENTRY_CopyBytes2Mod }, // SBB /r
{ 0x1B, ENTRY_CopyBytes2Mod }, // SBB /r
{ 0x1C, ENTRY_CopyBytes2 }, // SBB ib
{ 0x1D, ENTRY_CopyBytes3Or5 }, // SBB id
#ifdef DETOURS_X64
{ 0x1E, ENTRY_Invalid }, // Invalid
{ 0x1F, ENTRY_Invalid }, // Invalid
#else
{ 0x1E, ENTRY_CopyBytes1 }, // PUSH
{ 0x1F, ENTRY_CopyBytes1 }, // POP
#endif
{ 0x20, ENTRY_CopyBytes2Mod }, // AND /r
{ 0x21, ENTRY_CopyBytes2Mod }, // AND /r
{ 0x22, ENTRY_CopyBytes2Mod }, // AND /r
{ 0x23, ENTRY_CopyBytes2Mod }, // AND /r
{ 0x24, ENTRY_CopyBytes2 }, // AND ib
{ 0x25, ENTRY_CopyBytes3Or5 }, // AND id
{ 0x26, ENTRY_CopyBytesSegment }, // ES prefix
#ifdef DETOURS_X64
{ 0x27, ENTRY_Invalid }, // Invalid
#else
{ 0x27, ENTRY_CopyBytes1 }, // DAA
#endif
{ 0x28, ENTRY_CopyBytes2Mod }, // SUB /r
{ 0x29, ENTRY_CopyBytes2Mod }, // SUB /r
{ 0x2A, ENTRY_CopyBytes2Mod }, // SUB /r
{ 0x2B, ENTRY_CopyBytes2Mod }, // SUB /r
{ 0x2C, ENTRY_CopyBytes2 }, // SUB ib
{ 0x2D, ENTRY_CopyBytes3Or5 }, // SUB id
{ 0x2E, ENTRY_CopyBytesSegment }, // CS prefix
#ifdef DETOURS_X64
{ 0x2F, ENTRY_Invalid }, // Invalid
#else
{ 0x2F, ENTRY_CopyBytes1 }, // DAS
#endif
{ 0x30, ENTRY_CopyBytes2Mod }, // XOR /r
{ 0x31, ENTRY_CopyBytes2Mod }, // XOR /r
{ 0x32, ENTRY_CopyBytes2Mod }, // XOR /r
{ 0x33, ENTRY_CopyBytes2Mod }, // XOR /r
{ 0x34, ENTRY_CopyBytes2 }, // XOR ib
{ 0x35, ENTRY_CopyBytes3Or5 }, // XOR id
{ 0x36, ENTRY_CopyBytesSegment }, // SS prefix
#ifdef DETOURS_X64
{ 0x37, ENTRY_Invalid }, // Invalid
#else
{ 0x37, ENTRY_CopyBytes1 }, // AAA
#endif
{ 0x38, ENTRY_CopyBytes2Mod }, // CMP /r
{ 0x39, ENTRY_CopyBytes2Mod }, // CMP /r
{ 0x3A, ENTRY_CopyBytes2Mod }, // CMP /r
{ 0x3B, ENTRY_CopyBytes2Mod }, // CMP /r
{ 0x3C, ENTRY_CopyBytes2 }, // CMP ib
{ 0x3D, ENTRY_CopyBytes3Or5 }, // CMP id
{ 0x3E, ENTRY_CopyBytesSegment }, // DS prefix
#ifdef DETOURS_X64
{ 0x3F, ENTRY_Invalid }, // Invalid
#else
{ 0x3F, ENTRY_CopyBytes1 }, // AAS
#endif
#ifdef DETOURS_X64 // For Rax Prefix
{ 0x40, ENTRY_CopyBytesRax }, // Rax
{ 0x41, ENTRY_CopyBytesRax }, // Rax
{ 0x42, ENTRY_CopyBytesRax }, // Rax
{ 0x43, ENTRY_CopyBytesRax }, // Rax
{ 0x44, ENTRY_CopyBytesRax }, // Rax
{ 0x45, ENTRY_CopyBytesRax }, // Rax
{ 0x46, ENTRY_CopyBytesRax }, // Rax
{ 0x47, ENTRY_CopyBytesRax }, // Rax
{ 0x48, ENTRY_CopyBytesRax }, // Rax
{ 0x49, ENTRY_CopyBytesRax }, // Rax
{ 0x4A, ENTRY_CopyBytesRax }, // Rax
{ 0x4B, ENTRY_CopyBytesRax }, // Rax
{ 0x4C, ENTRY_CopyBytesRax }, // Rax
{ 0x4D, ENTRY_CopyBytesRax }, // Rax
{ 0x4E, ENTRY_CopyBytesRax }, // Rax
{ 0x4F, ENTRY_CopyBytesRax }, // Rax
#else
{ 0x40, ENTRY_CopyBytes1 }, // INC
{ 0x41, ENTRY_CopyBytes1 }, // INC
{ 0x42, ENTRY_CopyBytes1 }, // INC
{ 0x43, ENTRY_CopyBytes1 }, // INC
{ 0x44, ENTRY_CopyBytes1 }, // INC
{ 0x45, ENTRY_CopyBytes1 }, // INC
{ 0x46, ENTRY_CopyBytes1 }, // INC
{ 0x47, ENTRY_CopyBytes1 }, // INC
{ 0x48, ENTRY_CopyBytes1 }, // DEC
{ 0x49, ENTRY_CopyBytes1 }, // DEC
{ 0x4A, ENTRY_CopyBytes1 }, // DEC
{ 0x4B, ENTRY_CopyBytes1 }, // DEC
{ 0x4C, ENTRY_CopyBytes1 }, // DEC
{ 0x4D, ENTRY_CopyBytes1 }, // DEC
{ 0x4E, ENTRY_CopyBytes1 }, // DEC
{ 0x4F, ENTRY_CopyBytes1 }, // DEC
#endif
{ 0x50, ENTRY_CopyBytes1 }, // PUSH
{ 0x51, ENTRY_CopyBytes1 }, // PUSH
{ 0x52, ENTRY_CopyBytes1 }, // PUSH
{ 0x53, ENTRY_CopyBytes1 }, // PUSH
{ 0x54, ENTRY_CopyBytes1 }, // PUSH
{ 0x55, ENTRY_CopyBytes1 }, // PUSH
{ 0x56, ENTRY_CopyBytes1 }, // PUSH
{ 0x57, ENTRY_CopyBytes1 }, // PUSH
{ 0x58, ENTRY_CopyBytes1 }, // POP
{ 0x59, ENTRY_CopyBytes1 }, // POP
{ 0x5A, ENTRY_CopyBytes1 }, // POP
{ 0x5B, ENTRY_CopyBytes1 }, // POP
{ 0x5C, ENTRY_CopyBytes1 }, // POP
{ 0x5D, ENTRY_CopyBytes1 }, // POP
{ 0x5E, ENTRY_CopyBytes1 }, // POP
{ 0x5F, ENTRY_CopyBytes1 }, // POP
#ifdef DETOURS_X64
{ 0x60, ENTRY_Invalid }, // Invalid
{ 0x61, ENTRY_Invalid }, // Invalid
{ 0x62, ENTRY_Invalid }, // Invalid (not yet implemented Intel EVEX support)
#else
{ 0x60, ENTRY_CopyBytes1 }, // PUSHAD
{ 0x61, ENTRY_CopyBytes1 }, // POPAD
{ 0x62, ENTRY_CopyBytes2Mod }, // BOUND /r
#endif
{ 0x63, ENTRY_CopyBytes2Mod }, // 32bit ARPL /r, 64bit MOVSXD
{ 0x64, ENTRY_CopyBytesSegment }, // FS prefix
{ 0x65, ENTRY_CopyBytesSegment }, // GS prefix
{ 0x66, ENTRY_Copy66 }, // Operand Prefix
{ 0x67, ENTRY_Copy67 }, // Address Prefix
{ 0x68, ENTRY_CopyBytes3Or5 }, // PUSH
{ 0x69, ENTRY_CopyBytes2ModOperand }, // IMUL /r iz
{ 0x6A, ENTRY_CopyBytes2 }, // PUSH
{ 0x6B, ENTRY_CopyBytes2Mod1 }, // IMUL /r ib
{ 0x6C, ENTRY_CopyBytes1 }, // INS
{ 0x6D, ENTRY_CopyBytes1 }, // INS
{ 0x6E, ENTRY_CopyBytes1 }, // OUTS/OUTSB
{ 0x6F, ENTRY_CopyBytes1 }, // OUTS/OUTSW
{ 0x70, ENTRY_CopyBytes2Jump }, // JO // 0f80
{ 0x71, ENTRY_CopyBytes2Jump }, // JNO // 0f81
{ 0x72, ENTRY_CopyBytes2Jump }, // JB/JC/JNAE // 0f82
{ 0x73, ENTRY_CopyBytes2Jump }, // JAE/JNB/JNC // 0f83
{ 0x74, ENTRY_CopyBytes2Jump }, // JE/JZ // 0f84
{ 0x75, ENTRY_CopyBytes2Jump }, // JNE/JNZ // 0f85
{ 0x76, ENTRY_CopyBytes2Jump }, // JBE/JNA // 0f86
{ 0x77, ENTRY_CopyBytes2Jump }, // JA/JNBE // 0f87
{ 0x78, ENTRY_CopyBytes2Jump }, // JS // 0f88
{ 0x79, ENTRY_CopyBytes2Jump }, // JNS // 0f89
{ 0x7A, ENTRY_CopyBytes2Jump }, // JP/JPE // 0f8a
{ 0x7B, ENTRY_CopyBytes2Jump }, // JNP/JPO // 0f8b
{ 0x7C, ENTRY_CopyBytes2Jump }, // JL/JNGE // 0f8c
{ 0x7D, ENTRY_CopyBytes2Jump }, // JGE/JNL // 0f8d
{ 0x7E, ENTRY_CopyBytes2Jump }, // JLE/JNG // 0f8e
{ 0x7F, ENTRY_CopyBytes2Jump }, // JG/JNLE // 0f8f
{ 0x80, ENTRY_CopyBytes2Mod1 }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 byte reg, immediate byte
{ 0x81, ENTRY_CopyBytes2ModOperand }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 byte reg, immediate word or dword
#ifdef DETOURS_X64
{ 0x82, ENTRY_Invalid }, // Invalid
#else
{ 0x82, ENTRY_CopyBytes2Mod1 }, // MOV al,x
#endif
{ 0x83, ENTRY_CopyBytes2Mod1 }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 reg, immediate byte
{ 0x84, ENTRY_CopyBytes2Mod }, // TEST /r
{ 0x85, ENTRY_CopyBytes2Mod }, // TEST /r
{ 0x86, ENTRY_CopyBytes2Mod }, // XCHG /r @todo
{ 0x87, ENTRY_CopyBytes2Mod }, // XCHG /r @todo
{ 0x88, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x89, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x8A, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x8B, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x8C, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x8D, ENTRY_CopyBytes2Mod }, // LEA /r
{ 0x8E, ENTRY_CopyBytes2Mod }, // MOV /r
{ 0x8F, ENTRY_CopyBytes2Mod }, // POP /0
{ 0x90, ENTRY_CopyBytes1 }, // NOP
{ 0x91, ENTRY_CopyBytes1 }, // XCHG
{ 0x92, ENTRY_CopyBytes1 }, // XCHG
{ 0x93, ENTRY_CopyBytes1 }, // XCHG
{ 0x94, ENTRY_CopyBytes1 }, // XCHG
{ 0x95, ENTRY_CopyBytes1 }, // XCHG
{ 0x96, ENTRY_CopyBytes1 }, // XCHG
{ 0x97, ENTRY_CopyBytes1 }, // XCHG
{ 0x98, ENTRY_CopyBytes1 }, // CWDE
{ 0x99, ENTRY_CopyBytes1 }, // CDQ
#ifdef DETOURS_X64
{ 0x9A, ENTRY_Invalid }, // Invalid
#else
{ 0x9A, ENTRY_CopyBytes5Or7Dynamic }, // CALL cp
#endif
{ 0x9B, ENTRY_CopyBytes1 }, // WAIT/FWAIT
{ 0x9C, ENTRY_CopyBytes1 }, // PUSHFD
{ 0x9D, ENTRY_CopyBytes1 }, // POPFD
{ 0x9E, ENTRY_CopyBytes1 }, // SAHF
{ 0x9F, ENTRY_CopyBytes1 }, // LAHF
{ 0xA0, ENTRY_CopyBytes1Address }, // MOV
{ 0xA1, ENTRY_CopyBytes1Address }, // MOV
{ 0xA2, ENTRY_CopyBytes1Address }, // MOV
{ 0xA3, ENTRY_CopyBytes1Address }, // MOV
{ 0xA4, ENTRY_CopyBytes1 }, // MOVS
{ 0xA5, ENTRY_CopyBytes1 }, // MOVS/MOVSD
{ 0xA6, ENTRY_CopyBytes1 }, // CMPS/CMPSB
{ 0xA7, ENTRY_CopyBytes1 }, // CMPS/CMPSW
{ 0xA8, ENTRY_CopyBytes2 }, // TEST
{ 0xA9, ENTRY_CopyBytes3Or5 }, // TEST
{ 0xAA, ENTRY_CopyBytes1 }, // STOS/STOSB
{ 0xAB, ENTRY_CopyBytes1 }, // STOS/STOSW
{ 0xAC, ENTRY_CopyBytes1 }, // LODS/LODSB
{ 0xAD, ENTRY_CopyBytes1 }, // LODS/LODSW
{ 0xAE, ENTRY_CopyBytes1 }, // SCAS/SCASB
{ 0xAF, ENTRY_CopyBytes1 }, // SCAS/SCASD
{ 0xB0, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB1, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB2, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB3, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB4, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB5, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB6, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB7, ENTRY_CopyBytes2 }, // MOV B0+rb
{ 0xB8, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xB9, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBA, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBB, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBC, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBD, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBE, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xBF, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb
{ 0xC0, ENTRY_CopyBytes2Mod1 }, // RCL/2 ib, etc.
{ 0xC1, ENTRY_CopyBytes2Mod1 }, // RCL/2 ib, etc.
{ 0xC2, ENTRY_CopyBytes3 }, // RET
{ 0xC3, ENTRY_CopyBytes1 }, // RET
{ 0xC4, ENTRY_CopyVex3 }, // LES, VEX 3-byte opcodes.
{ 0xC5, ENTRY_CopyVex2 }, // LDS, VEX 2-byte opcodes.
{ 0xC6, ENTRY_CopyBytes2Mod1 }, // MOV
{ 0xC7, ENTRY_CopyBytes2ModOperand }, // MOV/0 XBEGIN/7
{ 0xC8, ENTRY_CopyBytes4 }, // ENTER
{ 0xC9, ENTRY_CopyBytes1 }, // LEAVE
{ 0xCA, ENTRY_CopyBytes3Dynamic }, // RET
{ 0xCB, ENTRY_CopyBytes1Dynamic }, // RET
{ 0xCC, ENTRY_CopyBytes1Dynamic }, // INT 3
{ 0xCD, ENTRY_CopyBytes2Dynamic }, // INT ib
#ifdef DETOURS_X64
{ 0xCE, ENTRY_Invalid }, // Invalid
#else
{ 0xCE, ENTRY_CopyBytes1Dynamic }, // INTO
#endif
{ 0xCF, ENTRY_CopyBytes1Dynamic }, // IRET
{ 0xD0, ENTRY_CopyBytes2Mod }, // RCL/2, etc.
{ 0xD1, ENTRY_CopyBytes2Mod }, // RCL/2, etc.
{ 0xD2, ENTRY_CopyBytes2Mod }, // RCL/2, etc.
{ 0xD3, ENTRY_CopyBytes2Mod }, // RCL/2, etc.
#ifdef DETOURS_X64
{ 0xD4, ENTRY_Invalid }, // Invalid
{ 0xD5, ENTRY_Invalid }, // Invalid
#else
{ 0xD4, ENTRY_CopyBytes2 }, // AAM
{ 0xD5, ENTRY_CopyBytes2 }, // AAD
#endif
{ 0xD6, ENTRY_Invalid }, // Invalid
{ 0xD7, ENTRY_CopyBytes1 }, // XLAT/XLATB
{ 0xD8, ENTRY_CopyBytes2Mod }, // FADD, etc.
{ 0xD9, ENTRY_CopyBytes2Mod }, // F2XM1, etc.
{ 0xDA, ENTRY_CopyBytes2Mod }, // FLADD, etc.
{ 0xDB, ENTRY_CopyBytes2Mod }, // FCLEX, etc.
{ 0xDC, ENTRY_CopyBytes2Mod }, // FADD/0, etc.
{ 0xDD, ENTRY_CopyBytes2Mod }, // FFREE, etc.
{ 0xDE, ENTRY_CopyBytes2Mod }, // FADDP, etc.
{ 0xDF, ENTRY_CopyBytes2Mod }, // FBLD/4, etc.
{ 0xE0, ENTRY_CopyBytes2CantJump }, // LOOPNE cb
{ 0xE1, ENTRY_CopyBytes2CantJump }, // LOOPE cb
{ 0xE2, ENTRY_CopyBytes2CantJump }, // LOOP cb
{ 0xE3, ENTRY_CopyBytes2CantJump }, // JCXZ/JECXZ
{ 0xE4, ENTRY_CopyBytes2 }, // IN ib
{ 0xE5, ENTRY_CopyBytes2 }, // IN id
{ 0xE6, ENTRY_CopyBytes2 }, // OUT ib
{ 0xE7, ENTRY_CopyBytes2 }, // OUT ib
{ 0xE8, ENTRY_CopyBytes3Or5Target }, // CALL cd
{ 0xE9, ENTRY_CopyBytes3Or5Target }, // JMP cd
#ifdef DETOURS_X64
{ 0xEA, ENTRY_Invalid }, // Invalid
#else
{ 0xEA, ENTRY_CopyBytes5Or7Dynamic }, // JMP cp
#endif
{ 0xEB, ENTRY_CopyBytes2Jump }, // JMP cb
{ 0xEC, ENTRY_CopyBytes1 }, // IN ib
{ 0xED, ENTRY_CopyBytes1 }, // IN id
{ 0xEE, ENTRY_CopyBytes1 }, // OUT
{ 0xEF, ENTRY_CopyBytes1 }, // OUT
{ 0xF0, ENTRY_CopyBytesPrefix }, // LOCK prefix
{ 0xF1, ENTRY_CopyBytes1Dynamic }, // INT1 / ICEBP somewhat documented by AMD, not by Intel
{ 0xF2, ENTRY_CopyF2 }, // REPNE prefix
//#ifdef DETOURS_X86
{ 0xF3, ENTRY_CopyF3 }, // REPE prefix
//#else
// This does presently suffice for AMD64 but it requires tracing
// through a bunch of code to verify and seems not worth maintaining.
// { 0xF3, ENTRY_CopyBytesPrefix }, // REPE prefix
//#endif
{ 0xF4, ENTRY_CopyBytes1 }, // HLT
{ 0xF5, ENTRY_CopyBytes1 }, // CMC
{ 0xF6, ENTRY_CopyF6 }, // TEST/0, DIV/6
{ 0xF7, ENTRY_CopyF7 }, // TEST/0, DIV/6
{ 0xF8, ENTRY_CopyBytes1 }, // CLC
{ 0xF9, ENTRY_CopyBytes1 }, // STC
{ 0xFA, ENTRY_CopyBytes1 }, // CLI
{ 0xFB, ENTRY_CopyBytes1 }, // STI
{ 0xFC, ENTRY_CopyBytes1 }, // CLD
{ 0xFD, ENTRY_CopyBytes1 }, // STD
{ 0xFE, ENTRY_CopyBytes2Mod }, // DEC/1,INC/0
{ 0xFF, ENTRY_CopyFF }, // CALL/2
{ 0, ENTRY_End },
};
const CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable0F[257] =
{
#ifdef DETOURS_X86
{ 0x00, ENTRY_Copy0F00 }, // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7
#else
{ 0x00, ENTRY_CopyBytes2Mod }, // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7
#endif
{ 0x01, ENTRY_CopyBytes2Mod }, // INVLPG/7, etc.
{ 0x02, ENTRY_CopyBytes2Mod }, // LAR/r
{ 0x03, ENTRY_CopyBytes2Mod }, // LSL/r
{ 0x04, ENTRY_Invalid }, // _04
{ 0x05, ENTRY_CopyBytes1 }, // SYSCALL
{ 0x06, ENTRY_CopyBytes1 }, // CLTS
{ 0x07, ENTRY_CopyBytes1 }, // SYSRET
{ 0x08, ENTRY_CopyBytes1 }, // INVD
{ 0x09, ENTRY_CopyBytes1 }, // WBINVD
{ 0x0A, ENTRY_Invalid }, // _0A
{ 0x0B, ENTRY_CopyBytes1 }, // UD2
{ 0x0C, ENTRY_Invalid }, // _0C
{ 0x0D, ENTRY_CopyBytes2Mod }, // PREFETCH
{ 0x0E, ENTRY_CopyBytes1 }, // FEMMS (3DNow -- not in Intel documentation)
{ 0x0F, ENTRY_CopyBytes2Mod1 }, // 3DNow Opcodes
{ 0x10, ENTRY_CopyBytes2Mod }, // MOVSS MOVUPD MOVSD
{ 0x11, ENTRY_CopyBytes2Mod }, // MOVSS MOVUPD MOVSD
{ 0x12, ENTRY_CopyBytes2Mod }, // MOVLPD
{ 0x13, ENTRY_CopyBytes2Mod }, // MOVLPD
{ 0x14, ENTRY_CopyBytes2Mod }, // UNPCKLPD
{ 0x15, ENTRY_CopyBytes2Mod }, // UNPCKHPD
{ 0x16, ENTRY_CopyBytes2Mod }, // MOVHPD
{ 0x17, ENTRY_CopyBytes2Mod }, // MOVHPD
{ 0x18, ENTRY_CopyBytes2Mod }, // PREFETCHINTA...
{ 0x19, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1A, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1B, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1C, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1D, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1E, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD
{ 0x1F, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop
{ 0x20, ENTRY_CopyBytes2Mod }, // MOV/r
{ 0x21, ENTRY_CopyBytes2Mod }, // MOV/r
{ 0x22, ENTRY_CopyBytes2Mod }, // MOV/r
{ 0x23, ENTRY_CopyBytes2Mod }, // MOV/r
#ifdef DETOURS_X64
{ 0x24, ENTRY_Invalid }, // _24
#else
{ 0x24, ENTRY_CopyBytes2Mod }, // MOV/r,TR TR is test register on 80386 and 80486, removed in Pentium
#endif
{ 0x25, ENTRY_Invalid }, // _25
#ifdef DETOURS_X64
{ 0x26, ENTRY_Invalid }, // _26
#else
{ 0x26, ENTRY_CopyBytes2Mod }, // MOV TR/r TR is test register on 80386 and 80486, removed in Pentium
#endif
{ 0x27, ENTRY_Invalid }, // _27
{ 0x28, ENTRY_CopyBytes2Mod }, // MOVAPS MOVAPD
{ 0x29, ENTRY_CopyBytes2Mod }, // MOVAPS MOVAPD
{ 0x2A, ENTRY_CopyBytes2Mod }, // CVPI2PS &
{ 0x2B, ENTRY_CopyBytes2Mod }, // MOVNTPS MOVNTPD
{ 0x2C, ENTRY_CopyBytes2Mod }, // CVTTPS2PI &
{ 0x2D, ENTRY_CopyBytes2Mod }, // CVTPS2PI &
{ 0x2E, ENTRY_CopyBytes2Mod }, // UCOMISS UCOMISD
{ 0x2F, ENTRY_CopyBytes2Mod }, // COMISS COMISD
{ 0x30, ENTRY_CopyBytes1 }, // WRMSR
{ 0x31, ENTRY_CopyBytes1 }, // RDTSC
{ 0x32, ENTRY_CopyBytes1 }, // RDMSR
{ 0x33, ENTRY_CopyBytes1 }, // RDPMC
{ 0x34, ENTRY_CopyBytes1 }, // SYSENTER
{ 0x35, ENTRY_CopyBytes1 }, // SYSEXIT
{ 0x36, ENTRY_Invalid }, // _36
{ 0x37, ENTRY_CopyBytes1 }, // GETSEC
{ 0x38, ENTRY_CopyBytes3Mod }, // SSE3 Opcodes
{ 0x39, ENTRY_Invalid }, // _39
{ 0x3A, ENTRY_CopyBytes3Mod1 }, // SSE3 Opcodes
{ 0x3B, ENTRY_Invalid }, // _3B
{ 0x3C, ENTRY_Invalid }, // _3C
{ 0x3D, ENTRY_Invalid }, // _3D
{ 0x3E, ENTRY_Invalid }, // _3E
{ 0x3F, ENTRY_Invalid }, // _3F
{ 0x40, ENTRY_CopyBytes2Mod }, // CMOVO (0F 40)
{ 0x41, ENTRY_CopyBytes2Mod }, // CMOVNO (0F 41)
{ 0x42, ENTRY_CopyBytes2Mod }, // CMOVB & CMOVNE (0F 42)
{ 0x43, ENTRY_CopyBytes2Mod }, // CMOVAE & CMOVNB (0F 43)
{ 0x44, ENTRY_CopyBytes2Mod }, // CMOVE & CMOVZ (0F 44)
{ 0x45, ENTRY_CopyBytes2Mod }, // CMOVNE & CMOVNZ (0F 45)
{ 0x46, ENTRY_CopyBytes2Mod }, // CMOVBE & CMOVNA (0F 46)
{ 0x47, ENTRY_CopyBytes2Mod }, // CMOVA & CMOVNBE (0F 47)
{ 0x48, ENTRY_CopyBytes2Mod }, // CMOVS (0F 48)
{ 0x49, ENTRY_CopyBytes2Mod }, // CMOVNS (0F 49)
{ 0x4A, ENTRY_CopyBytes2Mod }, // CMOVP & CMOVPE (0F 4A)
{ 0x4B, ENTRY_CopyBytes2Mod }, // CMOVNP & CMOVPO (0F 4B)
{ 0x4C, ENTRY_CopyBytes2Mod }, // CMOVL & CMOVNGE (0F 4C)
{ 0x4D, ENTRY_CopyBytes2Mod }, // CMOVGE & CMOVNL (0F 4D)
{ 0x4E, ENTRY_CopyBytes2Mod }, // CMOVLE & CMOVNG (0F 4E)
{ 0x4F, ENTRY_CopyBytes2Mod }, // CMOVG & CMOVNLE (0F 4F)
{ 0x50, ENTRY_CopyBytes2Mod }, // MOVMSKPD MOVMSKPD
{ 0x51, ENTRY_CopyBytes2Mod }, // SQRTPS &
{ 0x52, ENTRY_CopyBytes2Mod }, // RSQRTTS RSQRTPS
{ 0x53, ENTRY_CopyBytes2Mod }, // RCPPS RCPSS
{ 0x54, ENTRY_CopyBytes2Mod }, // ANDPS ANDPD
{ 0x55, ENTRY_CopyBytes2Mod }, // ANDNPS ANDNPD
{ 0x56, ENTRY_CopyBytes2Mod }, // ORPS ORPD
{ 0x57, ENTRY_CopyBytes2Mod }, // XORPS XORPD
{ 0x58, ENTRY_CopyBytes2Mod }, // ADDPS &
{ 0x59, ENTRY_CopyBytes2Mod }, // MULPS &
{ 0x5A, ENTRY_CopyBytes2Mod }, // CVTPS2PD &
{ 0x5B, ENTRY_CopyBytes2Mod }, // CVTDQ2PS &
{ 0x5C, ENTRY_CopyBytes2Mod }, // SUBPS &
{ 0x5D, ENTRY_CopyBytes2Mod }, // MINPS &
{ 0x5E, ENTRY_CopyBytes2Mod }, // DIVPS &
{ 0x5F, ENTRY_CopyBytes2Mod }, // MASPS &
{ 0x60, ENTRY_CopyBytes2Mod }, // PUNPCKLBW/r
{ 0x61, ENTRY_CopyBytes2Mod }, // PUNPCKLWD/r
{ 0x62, ENTRY_CopyBytes2Mod }, // PUNPCKLWD/r
{ 0x63, ENTRY_CopyBytes2Mod }, // PACKSSWB/r
{ 0x64, ENTRY_CopyBytes2Mod }, // PCMPGTB/r
{ 0x65, ENTRY_CopyBytes2Mod }, // PCMPGTW/r
{ 0x66, ENTRY_CopyBytes2Mod }, // PCMPGTD/r
{ 0x67, ENTRY_CopyBytes2Mod }, // PACKUSWB/r
{ 0x68, ENTRY_CopyBytes2Mod }, // PUNPCKHBW/r
{ 0x69, ENTRY_CopyBytes2Mod }, // PUNPCKHWD/r
{ 0x6A, ENTRY_CopyBytes2Mod }, // PUNPCKHDQ/r
{ 0x6B, ENTRY_CopyBytes2Mod }, // PACKSSDW/r
{ 0x6C, ENTRY_CopyBytes2Mod }, // PUNPCKLQDQ
{ 0x6D, ENTRY_CopyBytes2Mod }, // PUNPCKHQDQ
{ 0x6E, ENTRY_CopyBytes2Mod }, // MOVD/r
{ 0x6F, ENTRY_CopyBytes2Mod }, // MOV/r
{ 0x70, ENTRY_CopyBytes2Mod1 }, // PSHUFW/r ib
{ 0x71, ENTRY_CopyBytes2Mod1 }, // PSLLW/6 ib,PSRAW/4 ib,PSRLW/2 ib
{ 0x72, ENTRY_CopyBytes2Mod1 }, // PSLLD/6 ib,PSRAD/4 ib,PSRLD/2 ib
{ 0x73, ENTRY_CopyBytes2Mod1 }, // PSLLQ/6 ib,PSRLQ/2 ib
{ 0x74, ENTRY_CopyBytes2Mod }, // PCMPEQB/r
{ 0x75, ENTRY_CopyBytes2Mod }, // PCMPEQW/r
{ 0x76, ENTRY_CopyBytes2Mod }, // PCMPEQD/r
{ 0x77, ENTRY_CopyBytes1 }, // EMMS
// extrq/insertq require mode=3 and are followed by two immediate bytes
{ 0x78, ENTRY_Copy0F78 }, // VMREAD/r, 66/EXTRQ/r/ib/ib, F2/INSERTQ/r/ib/ib
// extrq/insertq require mod=3, therefore ENTRY_CopyBytes2, but it ends up the same
{ 0x79, ENTRY_CopyBytes2Mod }, // VMWRITE/r, 66/EXTRQ/r, F2/INSERTQ/r
{ 0x7A, ENTRY_Invalid }, // _7A
{ 0x7B, ENTRY_Invalid }, // _7B
{ 0x7C, ENTRY_CopyBytes2Mod }, // HADDPS
{ 0x7D, ENTRY_CopyBytes2Mod }, // HSUBPS
{ 0x7E, ENTRY_CopyBytes2Mod }, // MOVD/r
{ 0x7F, ENTRY_CopyBytes2Mod }, // MOV/r
{ 0x80, ENTRY_CopyBytes3Or5Target }, // JO
{ 0x81, ENTRY_CopyBytes3Or5Target }, // JNO
{ 0x82, ENTRY_CopyBytes3Or5Target }, // JB,JC,JNAE
{ 0x83, ENTRY_CopyBytes3Or5Target }, // JAE,JNB,JNC
{ 0x84, ENTRY_CopyBytes3Or5Target }, // JE,JZ,JZ
{ 0x85, ENTRY_CopyBytes3Or5Target }, // JNE,JNZ
{ 0x86, ENTRY_CopyBytes3Or5Target }, // JBE,JNA
{ 0x87, ENTRY_CopyBytes3Or5Target }, // JA,JNBE
{ 0x88, ENTRY_CopyBytes3Or5Target }, // JS
{ 0x89, ENTRY_CopyBytes3Or5Target }, // JNS
{ 0x8A, ENTRY_CopyBytes3Or5Target }, // JP,JPE
{ 0x8B, ENTRY_CopyBytes3Or5Target }, // JNP,JPO
{ 0x8C, ENTRY_CopyBytes3Or5Target }, // JL,NGE
{ 0x8D, ENTRY_CopyBytes3Or5Target }, // JGE,JNL
{ 0x8E, ENTRY_CopyBytes3Or5Target }, // JLE,JNG
{ 0x8F, ENTRY_CopyBytes3Or5Target }, // JG,JNLE
{ 0x90, ENTRY_CopyBytes2Mod }, // CMOVO (0F 40)
{ 0x91, ENTRY_CopyBytes2Mod }, // CMOVNO (0F 41)
{ 0x92, ENTRY_CopyBytes2Mod }, // CMOVB & CMOVC & CMOVNAE (0F 42)
{ 0x93, ENTRY_CopyBytes2Mod }, // CMOVAE & CMOVNB & CMOVNC (0F 43)
{ 0x94, ENTRY_CopyBytes2Mod }, // CMOVE & CMOVZ (0F 44)
{ 0x95, ENTRY_CopyBytes2Mod }, // CMOVNE & CMOVNZ (0F 45)
{ 0x96, ENTRY_CopyBytes2Mod }, // CMOVBE & CMOVNA (0F 46)
{ 0x97, ENTRY_CopyBytes2Mod }, // CMOVA & CMOVNBE (0F 47)
{ 0x98, ENTRY_CopyBytes2Mod }, // CMOVS (0F 48)
{ 0x99, ENTRY_CopyBytes2Mod }, // CMOVNS (0F 49)
{ 0x9A, ENTRY_CopyBytes2Mod }, // CMOVP & CMOVPE (0F 4A)
{ 0x9B, ENTRY_CopyBytes2Mod }, // CMOVNP & CMOVPO (0F 4B)
{ 0x9C, ENTRY_CopyBytes2Mod }, // CMOVL & CMOVNGE (0F 4C)
{ 0x9D, ENTRY_CopyBytes2Mod }, // CMOVGE & CMOVNL (0F 4D)
{ 0x9E, ENTRY_CopyBytes2Mod }, // CMOVLE & CMOVNG (0F 4E)
{ 0x9F, ENTRY_CopyBytes2Mod }, // CMOVG & CMOVNLE (0F 4F)
{ 0xA0, ENTRY_CopyBytes1 }, // PUSH
{ 0xA1, ENTRY_CopyBytes1 }, // POP
{ 0xA2, ENTRY_CopyBytes1 }, // CPUID
{ 0xA3, ENTRY_CopyBytes2Mod }, // BT (0F A3)
{ 0xA4, ENTRY_CopyBytes2Mod1 }, // SHLD
{ 0xA5, ENTRY_CopyBytes2Mod }, // SHLD
{ 0xA6, ENTRY_CopyBytes2Mod }, // XBTS
{ 0xA7, ENTRY_CopyBytes2Mod }, // IBTS
{ 0xA8, ENTRY_CopyBytes1 }, // PUSH
{ 0xA9, ENTRY_CopyBytes1 }, // POP
{ 0xAA, ENTRY_CopyBytes1 }, // RSM
{ 0xAB, ENTRY_CopyBytes2Mod }, // BTS (0F AB)
{ 0xAC, ENTRY_CopyBytes2Mod1 }, // SHRD
{ 0xAD, ENTRY_CopyBytes2Mod }, // SHRD
// 0F AE mod76=mem mod543=0 fxsave
// 0F AE mod76=mem mod543=1 fxrstor
// 0F AE mod76=mem mod543=2 ldmxcsr
// 0F AE mod76=mem mod543=3 stmxcsr
// 0F AE mod76=mem mod543=4 xsave
// 0F AE mod76=mem mod543=5 xrstor
// 0F AE mod76=mem mod543=6 saveopt
// 0F AE mod76=mem mod543=7 clflush
// 0F AE mod76=11b mod543=5 lfence
// 0F AE mod76=11b mod543=6 mfence
// 0F AE mod76=11b mod543=7 sfence
// F3 0F AE mod76=11b mod543=0 rdfsbase
// F3 0F AE mod76=11b mod543=1 rdgsbase
// F3 0F AE mod76=11b mod543=2 wrfsbase
// F3 0F AE mod76=11b mod543=3 wrgsbase
{ 0xAE, ENTRY_CopyBytes2Mod }, // fxsave fxrstor ldmxcsr stmxcsr xsave xrstor saveopt clflush lfence mfence sfence rdfsbase rdgsbase wrfsbase wrgsbase
{ 0xAF, ENTRY_CopyBytes2Mod }, // IMUL (0F AF)
{ 0xB0, ENTRY_CopyBytes2Mod }, // CMPXCHG (0F B0)
{ 0xB1, ENTRY_CopyBytes2Mod }, // CMPXCHG (0F B1)
{ 0xB2, ENTRY_CopyBytes2Mod }, // LSS/r
{ 0xB3, ENTRY_CopyBytes2Mod }, // BTR (0F B3)
{ 0xB4, ENTRY_CopyBytes2Mod }, // LFS/r
{ 0xB5, ENTRY_CopyBytes2Mod }, // LGS/r
{ 0xB6, ENTRY_CopyBytes2Mod }, // MOVZX/r
{ 0xB7, ENTRY_CopyBytes2Mod }, // MOVZX/r
#ifdef DETOURS_X86
{ 0xB8, ENTRY_Copy0FB8 }, // jmpe f3/popcnt
#else
{ 0xB8, ENTRY_CopyBytes2Mod }, // f3/popcnt
#endif
{ 0xB9, ENTRY_Invalid }, // _B9
{ 0xBA, ENTRY_CopyBytes2Mod1 }, // BT & BTC & BTR & BTS (0F BA)
{ 0xBB, ENTRY_CopyBytes2Mod }, // BTC (0F BB)
{ 0xBC, ENTRY_CopyBytes2Mod }, // BSF (0F BC)
{ 0xBD, ENTRY_CopyBytes2Mod }, // BSR (0F BD)
{ 0xBE, ENTRY_CopyBytes2Mod }, // MOVSX/r
{ 0xBF, ENTRY_CopyBytes2Mod }, // MOVSX/r
{ 0xC0, ENTRY_CopyBytes2Mod }, // XADD/r
{ 0xC1, ENTRY_CopyBytes2Mod }, // XADD/r
{ 0xC2, ENTRY_CopyBytes2Mod1 }, // CMPPS &
{ 0xC3, ENTRY_CopyBytes2Mod }, // MOVNTI
{ 0xC4, ENTRY_CopyBytes2Mod1 }, // PINSRW /r ib
{ 0xC5, ENTRY_CopyBytes2Mod1 }, // PEXTRW /r ib
{ 0xC6, ENTRY_CopyBytes2Mod1 }, // SHUFPS & SHUFPD
{ 0xC7, ENTRY_CopyBytes2Mod }, // CMPXCHG8B (0F C7)
{ 0xC8, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xC9, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xCA, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xCB, ENTRY_CopyBytes1 }, // CVTPD2PI BSWAP 0F C8 + rd
{ 0xCC, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xCD, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xCE, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xCF, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd
{ 0xD0, ENTRY_CopyBytes2Mod }, // ADDSUBPS (untestd)
{ 0xD1, ENTRY_CopyBytes2Mod }, // PSRLW/r
{ 0xD2, ENTRY_CopyBytes2Mod }, // PSRLD/r
{ 0xD3, ENTRY_CopyBytes2Mod }, // PSRLQ/r
{ 0xD4, ENTRY_CopyBytes2Mod }, // PADDQ
{ 0xD5, ENTRY_CopyBytes2Mod }, // PMULLW/r
{ 0xD6, ENTRY_CopyBytes2Mod }, // MOVDQ2Q / MOVQ2DQ
{ 0xD7, ENTRY_CopyBytes2Mod }, // PMOVMSKB/r
{ 0xD8, ENTRY_CopyBytes2Mod }, // PSUBUSB/r
{ 0xD9, ENTRY_CopyBytes2Mod }, // PSUBUSW/r
{ 0xDA, ENTRY_CopyBytes2Mod }, // PMINUB/r
{ 0xDB, ENTRY_CopyBytes2Mod }, // PAND/r
{ 0xDC, ENTRY_CopyBytes2Mod }, // PADDUSB/r
{ 0xDD, ENTRY_CopyBytes2Mod }, // PADDUSW/r
{ 0xDE, ENTRY_CopyBytes2Mod }, // PMAXUB/r
{ 0xDF, ENTRY_CopyBytes2Mod }, // PANDN/r
{ 0xE0, ENTRY_CopyBytes2Mod }, // PAVGB
{ 0xE1, ENTRY_CopyBytes2Mod }, // PSRAW/r
{ 0xE2, ENTRY_CopyBytes2Mod }, // PSRAD/r
{ 0xE3, ENTRY_CopyBytes2Mod }, // PAVGW
{ 0xE4, ENTRY_CopyBytes2Mod }, // PMULHUW/r
{ 0xE5, ENTRY_CopyBytes2Mod }, // PMULHW/r
{ 0xE6, ENTRY_CopyBytes2Mod }, // CTDQ2PD &
{ 0xE7, ENTRY_CopyBytes2Mod }, // MOVNTQ
{ 0xE8, ENTRY_CopyBytes2Mod }, // PSUBB/r
{ 0xE9, ENTRY_CopyBytes2Mod }, // PSUBW/r
{ 0xEA, ENTRY_CopyBytes2Mod }, // PMINSW/r
{ 0xEB, ENTRY_CopyBytes2Mod }, // POR/r
{ 0xEC, ENTRY_CopyBytes2Mod }, // PADDSB/r
{ 0xED, ENTRY_CopyBytes2Mod }, // PADDSW/r
{ 0xEE, ENTRY_CopyBytes2Mod }, // PMAXSW /r
{ 0xEF, ENTRY_CopyBytes2Mod }, // PXOR/r
{ 0xF0, ENTRY_CopyBytes2Mod }, // LDDQU
{ 0xF1, ENTRY_CopyBytes2Mod }, // PSLLW/r
{ 0xF2, ENTRY_CopyBytes2Mod }, // PSLLD/r
{ 0xF3, ENTRY_CopyBytes2Mod }, // PSLLQ/r
{ 0xF4, ENTRY_CopyBytes2Mod }, // PMULUDQ/r
{ 0xF5, ENTRY_CopyBytes2Mod }, // PMADDWD/r
{ 0xF6, ENTRY_CopyBytes2Mod }, // PSADBW/r
{ 0xF7, ENTRY_CopyBytes2Mod }, // MASKMOVQ
{ 0xF8, ENTRY_CopyBytes2Mod }, // PSUBB/r
{ 0xF9, ENTRY_CopyBytes2Mod }, // PSUBW/r
{ 0xFA, ENTRY_CopyBytes2Mod }, // PSUBD/r
{ 0xFB, ENTRY_CopyBytes2Mod }, // FSUBQ/r
{ 0xFC, ENTRY_CopyBytes2Mod }, // PADDB/r
{ 0xFD, ENTRY_CopyBytes2Mod }, // PADDW/r
{ 0xFE, ENTRY_CopyBytes2Mod }, // PADDD/r
{ 0xFF, ENTRY_Invalid }, // _FF
{ 0, ENTRY_End },
};
BOOL CDetourDis::SanityCheckSystem()
{
ULONG n = 0;
for (; n < 256; n++) {
REFCOPYENTRY pEntry = &s_rceCopyTable[n];
if (n != pEntry->nOpcode) {
ASSERT(n == pEntry->nOpcode);
return FALSE;
}
}
if (s_rceCopyTable[256].pfCopy != NULL) {
ASSERT(!"Missing end marker.");
return FALSE;
}
for (n = 0; n < 256; n++) {
REFCOPYENTRY pEntry = &s_rceCopyTable0F[n];
if (n != pEntry->nOpcode) {
ASSERT(n == pEntry->nOpcode);
return FALSE;
}
}
if (s_rceCopyTable0F[256].pfCopy != NULL) {
ASSERT(!"Missing end marker.");
return FALSE;
}
return TRUE;
}
#endif // defined(DETOURS_X64) || defined(DETOURS_X86)
/////////////////////////////////////////////////////////// IA64 Disassembler.
//
#ifdef DETOURS_IA64
#if defined(_IA64_) != defined(DETOURS_IA64_OFFLINE_LIBRARY)
// Compile DETOUR_IA64_BUNDLE for native IA64 or cross, but not both -- we get duplicates otherwise.
const DETOUR_IA64_BUNDLE::DETOUR_IA64_METADATA DETOUR_IA64_BUNDLE::s_rceCopyTable[33] =
{
{ 0x00, M_UNIT, I_UNIT, I_UNIT, },
{ 0x01, M_UNIT, I_UNIT, I_UNIT, },
{ 0x02, M_UNIT, I_UNIT, I_UNIT, },
{ 0x03, M_UNIT, I_UNIT, I_UNIT, },
{ 0x04, M_UNIT, L_UNIT, X_UNIT, },
{ 0x05, M_UNIT, L_UNIT, X_UNIT, },
{ 0x06, 0, 0, 0, },
{ 0x07, 0, 0, 0, },
{ 0x08, M_UNIT, M_UNIT, I_UNIT, },
{ 0x09, M_UNIT, M_UNIT, I_UNIT, },
{ 0x0a, M_UNIT, M_UNIT, I_UNIT, },
{ 0x0b, M_UNIT, M_UNIT, I_UNIT, },
{ 0x0c, M_UNIT, F_UNIT, I_UNIT, },
{ 0x0d, M_UNIT, F_UNIT, I_UNIT, },
{ 0x0e, M_UNIT, M_UNIT, F_UNIT, },
{ 0x0f, M_UNIT, M_UNIT, F_UNIT, },
{ 0x10, M_UNIT, I_UNIT, B_UNIT, },
{ 0x11, M_UNIT, I_UNIT, B_UNIT, },
{ 0x12, M_UNIT, B_UNIT, B_UNIT, },
{ 0x13, M_UNIT, B_UNIT, B_UNIT, },
{ 0x14, 0, 0, 0, },
{ 0x15, 0, 0, 0, },
{ 0x16, B_UNIT, B_UNIT, B_UNIT, },
{ 0x17, B_UNIT, B_UNIT, B_UNIT, },
{ 0x18, M_UNIT, M_UNIT, B_UNIT, },
{ 0x19, M_UNIT, M_UNIT, B_UNIT, },
{ 0x1a, 0, 0, 0, },
{ 0x1b, 0, 0, 0, },
{ 0x1c, M_UNIT, F_UNIT, B_UNIT, },
{ 0x1d, M_UNIT, F_UNIT, B_UNIT, },
{ 0x1e, 0, 0, 0, },
{ 0x1f, 0, 0, 0, },
{ 0x00, 0, 0, 0, },
};
// 120 112 104 96 88 80 72 64 56 48 40 32 24 16 8 0
// f. e. d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0.
// 00
// f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.
// 0000 0000 0000 0000 0000 0000 0000 001f : Template [4..0]
// 0000 0000 0000 0000 0000 03ff ffff ffe0 : Zero [ 41.. 5]
// 0000 0000 0000 0000 0000 3c00 0000 0000 : Zero [ 45.. 42]
// 0000 0000 0007 ffff ffff c000 0000 0000 : One [ 82.. 46]
// 0000 0000 0078 0000 0000 0000 0000 0000 : One [ 86.. 83]
// 0fff ffff ff80 0000 0000 0000 0000 0000 : Two [123.. 87]
// f000 0000 0000 0000 0000 0000 0000 0000 : Two [127..124]
BYTE DETOUR_IA64_BUNDLE::GetTemplate() const
{
return (data[0] & 0x1f);
}
BYTE DETOUR_IA64_BUNDLE::GetInst0() const
{
return ((data[5] & 0x3c) >> 2);
}
BYTE DETOUR_IA64_BUNDLE::GetInst1() const
{
return ((data[10] & 0x78) >> 3);
}
BYTE DETOUR_IA64_BUNDLE::GetInst2() const
{
return ((data[15] & 0xf0) >> 4);
}
BYTE DETOUR_IA64_BUNDLE::GetUnit(BYTE slot) const
{
switch (slot) {
case 0: return GetUnit0();
case 1: return GetUnit1();
case 2: return GetUnit2();
}
__debugbreak();
return 0;
}
BYTE DETOUR_IA64_BUNDLE::GetUnit0() const
{
return s_rceCopyTable[data[0] & 0x1f].nUnit0;
}
BYTE DETOUR_IA64_BUNDLE::GetUnit1() const
{
return s_rceCopyTable[data[0] & 0x1f].nUnit1;
}
BYTE DETOUR_IA64_BUNDLE::GetUnit2() const
{
return s_rceCopyTable[data[0] & 0x1f].nUnit2;
}
UINT64 DETOUR_IA64_BUNDLE::GetData0() const
{
return (((wide[0] & 0x000003ffffffffe0) >> 5));
}
UINT64 DETOUR_IA64_BUNDLE::GetData1() const
{
return (((wide[0] & 0xffffc00000000000) >> 46) |
((wide[1] & 0x000000000007ffff) << 18));
}
UINT64 DETOUR_IA64_BUNDLE::GetData2() const
{
return (((wide[1] & 0x0fffffffff800000) >> 23));
}
VOID DETOUR_IA64_BUNDLE::SetInst(BYTE slot, BYTE nInst)
{
switch (slot)
{
case 0: SetInst0(nInst); return;
case 1: SetInst1(nInst); return;
case 2: SetInst2(nInst); return;
}
__debugbreak();
}
VOID DETOUR_IA64_BUNDLE::SetInst0(BYTE nInst)
{
data[5] = (data[5] & ~0x3c) | ((nInst << 2) & 0x3c);
}
VOID DETOUR_IA64_BUNDLE::SetInst1(BYTE nInst)
{
data[10] = (data[10] & ~0x78) | ((nInst << 3) & 0x78);
}
VOID DETOUR_IA64_BUNDLE::SetInst2(BYTE nInst)
{
data[15] = (data[15] & ~0xf0) | ((nInst << 4) & 0xf0);
}
VOID DETOUR_IA64_BUNDLE::SetData(BYTE slot, UINT64 nData)
{
switch (slot)
{
case 0: SetData0(nData); return;
case 1: SetData1(nData); return;
case 2: SetData2(nData); return;
}
__debugbreak();
}
VOID DETOUR_IA64_BUNDLE::SetData0(UINT64 nData)
{
wide[0] = (wide[0] & ~0x000003ffffffffe0) | (( nData << 5) & 0x000003ffffffffe0);
}
VOID DETOUR_IA64_BUNDLE::SetData1(UINT64 nData)
{
wide[0] = (wide[0] & ~0xffffc00000000000) | ((nData << 46) & 0xffffc00000000000);
wide[1] = (wide[1] & ~0x000000000007ffff) | ((nData >> 18) & 0x000000000007ffff);
}
VOID DETOUR_IA64_BUNDLE::SetData2(UINT64 nData)
{
wide[1] = (wide[1] & ~0x0fffffffff800000) | ((nData << 23) & 0x0fffffffff800000);
}
UINT64 DETOUR_IA64_BUNDLE::GetInstruction(BYTE slot) const
{
switch (slot) {
case 0: return GetInstruction0();
case 1: return GetInstruction1();
case 2: return GetInstruction2();
}
__debugbreak();
return 0;
}
UINT64 DETOUR_IA64_BUNDLE::GetInstruction0() const
{
// 41 bits from wide[0], skipping the 5 bit template.
return GetBits(wide[0], DETOUR_IA64_INSTRUCTION0_OFFSET, DETOUR_IA64_INSTRUCTION_SIZE);
}
UINT64 DETOUR_IA64_BUNDLE::GetInstruction1() const
{
// 64-46 bits from wide[0] and the rest from wide[1].
const UINT count0 = 64 - DETOUR_IA64_INSTRUCTION1_OFFSET;
const UINT count1 = DETOUR_IA64_INSTRUCTION_SIZE - count0;
return GetBits(wide[0], DETOUR_IA64_INSTRUCTION1_OFFSET, count0) | (GetBits(wide[1], 0, count1) << count0);
}
UINT64 DETOUR_IA64_BUNDLE::GetInstruction2() const
{
// Upper 41 bits of wide[1].
return wide[1] >> (64 - DETOUR_IA64_INSTRUCTION_SIZE);
}
void DETOUR_IA64_BUNDLE::SetInstruction(BYTE slot, UINT64 instruction)
{
switch (slot) {
case 0: SetInstruction0(instruction); return;
case 1: SetInstruction1(instruction); return;
case 2: SetInstruction2(instruction); return;
}
__debugbreak();
}
void DETOUR_IA64_BUNDLE::SetInstruction0(UINT64 instruction)
{
wide[0] = SetBits(wide[0], DETOUR_IA64_INSTRUCTION0_OFFSET, DETOUR_IA64_INSTRUCTION_SIZE, instruction);
}
void DETOUR_IA64_BUNDLE::SetInstruction1(UINT64 instruction)
{
UINT const count0 = 64 - DETOUR_IA64_INSTRUCTION1_OFFSET;
UINT const count1 = DETOUR_IA64_INSTRUCTION_SIZE - count0;
UINT64 const wide0 = SetBits(wide[0], DETOUR_IA64_INSTRUCTION1_OFFSET, count0, instruction);
UINT64 const wide1 = SetBits(wide[1], 0, count1, instruction >> count0);
wide[0] = wide0;
wide[1] = wide1;
}
void DETOUR_IA64_BUNDLE::SetInstruction2(UINT64 instruction)
{
// Set upper 41 bits of wide[1].
wide[1] = SetBits(wide[1], 64 - DETOUR_IA64_INSTRUCTION_SIZE, DETOUR_IA64_INSTRUCTION_SIZE, instruction);
}
UINT64 DETOUR_IA64_BUNDLE::SignExtend(UINT64 Value, UINT64 Offset)
// This definition is from the IA64 manual.
{
if ((Value & (((UINT64)1) << (Offset - 1))) == 0)
return Value;
UINT64 const new_value = Value | ((~(UINT64)0) << Offset);
return new_value;
}
UINT64 DETOUR_IA64_BUNDLE::GetBits(UINT64 Value, UINT64 Offset, UINT64 Count)
{
UINT64 const new_value = (Value >> Offset) & ~(~((UINT64)0) << Count);
return new_value;
}
UINT64 DETOUR_IA64_BUNDLE::SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field)
{
UINT64 const mask = (~((~(UINT64)0) << Count)) << Offset;
UINT64 const new_value = (Value & ~mask) | ((Field << Offset) & mask);
return new_value;
}
UINT64 DETOUR_IA64_BUNDLE::GetOpcode(UINT64 instruction)
// Get 4bit primary opcode.
{
UINT64 const opcode = GetBits(instruction, DETOUR_IA64_INSTRUCTION_SIZE - 4, 4);
return opcode;
}
UINT64 DETOUR_IA64_BUNDLE::GetX(UINT64 instruction)
// Get 1bit opcode extension.
{
UINT64 const x = GetBits(instruction, 33, 1);
return x;
}
UINT64 DETOUR_IA64_BUNDLE::GetX3(UINT64 instruction)
// Get 3bit opcode extension.
{
UINT64 const x3 = GetBits(instruction, 33, 3);
return x3;
}
UINT64 DETOUR_IA64_BUNDLE::GetX6(UINT64 instruction)
// Get 6bit opcode extension.
{
UINT64 const x6 = GetBits(instruction, 27, 6);
return x6;
}
UINT64 DETOUR_IA64_BUNDLE::GetImm7a(UINT64 instruction)
{
UINT64 const imm7a = GetBits(instruction, 6, 7);
return imm7a;
}
UINT64 DETOUR_IA64_BUNDLE::SetImm7a(UINT64 instruction, UINT64 imm7a)
{
UINT64 const new_instruction = SetBits(instruction, 6, 7, imm7a);
return new_instruction;
}
UINT64 DETOUR_IA64_BUNDLE::GetImm13c(UINT64 instruction)
{
UINT64 const imm13c = GetBits(instruction, 20, 13);
return imm13c;
}
UINT64 DETOUR_IA64_BUNDLE::SetImm13c(UINT64 instruction, UINT64 imm13c)
{
UINT64 const new_instruction = SetBits(instruction, 20, 13, imm13c);
return new_instruction;
}
UINT64 DETOUR_IA64_BUNDLE::GetSignBit(UINT64 instruction)
{
UINT64 const signBit = GetBits(instruction, 36, 1);
return signBit;
}
UINT64 DETOUR_IA64_BUNDLE::SetSignBit(UINT64 instruction, UINT64 signBit)
{
UINT64 const new_instruction = SetBits(instruction, 36, 1, signBit);
return new_instruction;
}
UINT64 DETOUR_IA64_BUNDLE::GetImm20a(UINT64 instruction)
{
UINT64 const imm20a = GetBits(instruction, 6, 20);
return imm20a;
}
UINT64 DETOUR_IA64_BUNDLE::SetImm20a(UINT64 instruction, UINT64 imm20a)
{
UINT64 const new_instruction = SetBits(instruction, 6, 20, imm20a);
return new_instruction;
}
UINT64 DETOUR_IA64_BUNDLE::GetImm20b(UINT64 instruction)
{
UINT64 const imm20b = GetBits(instruction, 13, 20);
return imm20b;
}
UINT64 DETOUR_IA64_BUNDLE::SetImm20b(UINT64 instruction, UINT64 imm20b)
{
UINT64 const new_instruction = SetBits(instruction, 13, 20, imm20b);
return new_instruction;
}
bool DETOUR_IA64_BUNDLE::RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst,
_In_ BYTE slot,
_Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const
/*
If pBundleExtra is provided and instruction is IP-relative,
this function relocates instruction to target pBundleExtra,
pBundleExtra is set to brl the original target, and return true.
[Not used] If pBundleExtra is not provided and instruction is IP-relative, return true.
Else return false.
The following IP-relative forms are recognized:
br and br.call
chk.s.m integer and float
chk.a.nc integer and float
chk.a.clr integer and float
chk.s.i
fchkf
Brl is handled elsewhere, because the code was previously written.
Branch prediction hints are not relocated.
*/
{
UINT64 const instruction = GetInstruction(slot);
UINT64 const opcode = GetOpcode(instruction);
size_t const dest = (size_t)pDst;
size_t const extra = (size_t)pBundleExtra;
switch (GetUnit(slot)) {
case F_UNIT:
// F14 fchkf
if (opcode == 0 && GetX(instruction) == 0 && GetX6(instruction) == 8) {
goto imm20a;
}
return false;
case M_UNIT:
// M20 x3 == 1 integer chk.s.m
// M21 x3 == 3 floating point chk.s
if (opcode == 1) {
UINT64 const x3 = GetX3(instruction);
if (x3 == 1 || x3 == 3) {
goto imm13_7;
}
}
// M22 x3 == 4 integer chk.a.nc
// M22 x3 == 5 integer chk.a.clr
// M23 x3 == 6 floating point chk.a.nc
// M23 x3 == 7 floating point chk.a.clr
if (opcode == 0) {
UINT64 const x3 = GetX3(instruction);
if (x3 == 4 || x3 == 5 || x3 == 6 || x3 == 7) {
goto imm20b;
}
}
return false;
case I_UNIT:
// I20
if (opcode == 0 && GetX3(instruction) == 1) { // chk.s.i
goto imm13_7;
}
return false;
case B_UNIT:
// B1 B2 B3
// 4 br
// 5 br.call
if (opcode == 4 || opcode == 5) {
goto imm20b;
}
return false;
}
return false;
UINT64 imm;
UINT64 new_instruction;
imm13_7:
imm = SignExtend((GetSignBit(instruction) << 20) | (GetImm13c(instruction) << 7) | GetImm7a(instruction), 21) << 4;
new_instruction = SetSignBit(SetImm13c(SetImm7a(instruction, (extra - dest) >> 4), (extra - dest) >> 11), extra < dest);
goto set_brl;
imm20a:
imm = SignExtend((GetSignBit(instruction) << 20) | GetImm20a(instruction), 21) << 4;
new_instruction = SetSignBit(SetImm20a(instruction, (extra - dest) >> 4), extra < dest);
goto set_brl;
imm20b:
imm = SignExtend((GetSignBit(instruction) << 20) | GetImm20b(instruction), 21) << 4;
new_instruction = SetSignBit(SetImm20b(instruction, (extra - dest) >> 4), extra < dest);
goto set_brl;
set_brl:
if (pBundleExtra != NULL) {
pDst->SetInstruction(slot, new_instruction);
pBundleExtra->SetBrl((size_t)this + imm);
}
return true;
}
UINT DETOUR_IA64_BUNDLE::RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst,
_Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const
/*
Having already copied the bundle unchanged, then relocate its instructions one at a time.
Return how many extra bytes are required to relocate the bundle.
*/
{
UINT nExtraBytes = 0;
for (BYTE slot = 0; slot < DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE; ++slot) {
if (!RelocateInstruction(pDst, slot, pBundleExtra)) {
continue;
}
pBundleExtra -= !!pBundleExtra;
nExtraBytes += sizeof(DETOUR_IA64_BUNDLE);
}
return nExtraBytes;
}
BOOL DETOUR_IA64_BUNDLE::IsBrl() const
{
// f.e. d.c. b.a. 9.8. 7.6. 5. 4. 3. 2. 1. 0.
// c000 0070 0000 0000 0000 00 01 00 00 00 05 : brl.sptk.few
// c8ff fff0 007f fff0 ffff 00 01 00 00 00 05 : brl.sptk.few
// c000 0048 0000 0000 0001 00 00 00 00 00 05 : brl.sptk.many
return ((wide[0] & 0x000000000000001e) == 0x0000000000000004 && // 4 or 5.
(wide[1] & 0xe000000000000000) == 0xc000000000000000); // c or d.
}
VOID DETOUR_IA64_BUNDLE::SetBrl()
{
wide[0] = 0x0000000100000005; // few
//wide[0] = 0x0000000180000005; // many
wide[1] = 0xc000000800000000;
}
UINT64 DETOUR_IA64_BUNDLE::GetBrlImm() const
{
return (
// 0x0000000000fffff0
((wide[1] & 0x00fffff000000000) >> 32) | // all 20 bits of imm20b.
// 0x000000ffff000000
((wide[0] & 0xffff000000000000) >> 24) | // bottom 16 bits of imm39.
// 0x7fffff0000000000
((wide[1] & 0x00000000007fffff) << 40) | // top 23 bits of imm39.
// 0x8000000000000000
((wide[1] & 0x0800000000000000) << 4) // single bit of i.
);
}
VOID DETOUR_IA64_BUNDLE::SetBrlImm(UINT64 imm)
{
wide[0] = ((wide[0] & ~0xffff000000000000) |
// 0xffff000000000000
((imm & 0x000000ffff000000) << 24) // bottom 16 bits of imm39.
);
wide[1] = ((wide[1] & ~0x08fffff0007fffff) |
// 0x00fffff000000000
((imm & 0x0000000000fffff0) << 32) | // all 20 bits of imm20b.
// 0x00000000007fffff
((imm & 0x7fffff0000000000) >> 40) | // top 23 bits of imm39.
// 0x0800000000000000
((imm & 0x8000000000000000) >> 4) // single bit of i.
);
}
UINT64 DETOUR_IA64_BUNDLE::GetBrlTarget() const
{
return (UINT64)this + GetBrlImm();
}
VOID DETOUR_IA64_BUNDLE::SetBrl(UINT64 target)
{
UINT64 imm = target - (UINT64)this;
SetBrl();
SetBrlImm(imm);
}
VOID DETOUR_IA64_BUNDLE::SetBrlTarget(UINT64 target)
{
UINT64 imm = target - (UINT64)this;
SetBrlImm(imm);
}
BOOL DETOUR_IA64_BUNDLE::IsMovlGp() const
{
// f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.
// 6fff f7f0 207f ffff ffff c001 0000 0004
// 6000 0000 2000 0000 0000 0001 0000 0004
return ((wide[0] & 0x00003ffffffffffe) == 0x0000000100000004 &&
(wide[1] & 0xf000080fff800000) == 0x6000000020000000);
}
UINT64 DETOUR_IA64_BUNDLE::GetMovlGp() const
{
UINT64 raw = (
// 0x0000000000000070
((wide[1] & 0x000007f000000000) >> 36) |
// 0x000000000000ff80
((wide[1] & 0x07fc000000000000) >> 43) |
// 0x00000000001f0000
((wide[1] & 0x0003e00000000000) >> 29) |
// 0x0000000000200000
((wide[1] & 0x0000100000000000) >> 23) |
// 0x000000ffffc00000
((wide[0] & 0xffffc00000000000) >> 24) |
// 0x7fffff0000000000
((wide[1] & 0x00000000007fffff) << 40) |
// 0x8000000000000000
((wide[1] & 0x0800000000000000) << 4)
);
return (INT64)raw;
}
VOID DETOUR_IA64_BUNDLE::SetMovlGp(UINT64 gp)
{
UINT64 raw = (UINT64)gp;
wide[0] = (0x0000000100000005 |
// 0xffffc00000000000
((raw & 0x000000ffffc00000) << 24)
);
wide[1] = (
0x6000000020000000 |
// 0x0000070000000000
((raw & 0x0000000000000070) << 36) |
// 0x07fc000000000000
((raw & 0x000000000000ff80) << 43) |
// 0x0003e00000000000
((raw & 0x00000000001f0000) << 29) |
// 0x0000100000000000
((raw & 0x0000000000200000) << 23) |
// 0x00000000007fffff
((raw & 0x7fffff0000000000) >> 40) |
// 0x0800000000000000
((raw & 0x8000000000000000) >> 4)
);
}
UINT DETOUR_IA64_BUNDLE::Copy(_Out_ DETOUR_IA64_BUNDLE *pDst,
_Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const
{
// Copy the bytes unchanged.
#pragma warning(suppress:6001) // using uninitialized *pDst
pDst->wide[0] = wide[0];
pDst->wide[1] = wide[1];
// Relocate if necessary.
UINT nExtraBytes = RelocateBundle(pDst, pBundleExtra);
if (GetUnit1() == L_UNIT && IsBrl()) {
pDst->SetBrlTarget(GetBrlTarget());
}
return nExtraBytes;
}
BOOL DETOUR_IA64_BUNDLE::SetNop(BYTE slot)
{
switch (GetUnit(slot)) {
case I_UNIT:
case M_UNIT:
case F_UNIT:
SetInst(slot, 0);
SetData(slot, 0x8000000);
return true;
case B_UNIT:
SetInst(slot, 2);
SetData(slot, 0);
return true;
}
DebugBreak();
return false;
}
BOOL DETOUR_IA64_BUNDLE::SetNop0()
{
return SetNop(0);
}
BOOL DETOUR_IA64_BUNDLE::SetNop1()
{
return SetNop(1);
}
BOOL DETOUR_IA64_BUNDLE::SetNop2()
{
return SetNop(2);
}
VOID DETOUR_IA64_BUNDLE::SetStop()
{
data[0] |= 0x01;
}
#endif // DETOURS_IA64
PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
_Inout_opt_ PVOID *ppDstPool,
_In_ PVOID pSrc,
_Out_opt_ PVOID *ppTarget,
_Out_opt_ LONG *plExtra)
{
LONG nExtra;
DETOUR_IA64_BUNDLE bExtra;
DETOUR_IA64_BUNDLE *pbSrc = (DETOUR_IA64_BUNDLE *)pSrc;
DETOUR_IA64_BUNDLE *pbDst = pDst ? (DETOUR_IA64_BUNDLE *)pDst : &bExtra;
plExtra = plExtra ? plExtra : &nExtra;
*plExtra = 0;
if (ppTarget != NULL) {
if (pbSrc->IsBrl()) {
*ppTarget = (PVOID)pbSrc->GetBrlTarget();
}
else {
*ppTarget = DETOUR_INSTRUCTION_TARGET_NONE;
}
}
*plExtra = (LONG)pbSrc->Copy(pbDst, ppDstPool ? ((DETOUR_IA64_BUNDLE*)*ppDstPool) - 1 : (DETOUR_IA64_BUNDLE*)NULL);
return pbSrc + 1;
}
#endif // DETOURS_IA64
#ifdef DETOURS_ARM
#define DETOURS_PFUNC_TO_PBYTE(p) ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1))
#define DETOURS_PBYTE_TO_PFUNC(p) ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1))
#define c_PCAdjust 4 // The PC value of an instruction is the PC address plus 4.
#define c_PC 15 // The register number for the Program Counter
#define c_LR 14 // The register number for the Link Register
#define c_SP 13 // The register number for the Stack Pointer
#define c_NOP 0xbf00 // A nop instruction
#define c_BREAK 0xdefe // A nop instruction
class CDetourDis
{
public:
CDetourDis();
PBYTE CopyInstruction(PBYTE pDst,
PBYTE *ppDstPool,
PBYTE pSrc,
PBYTE *ppTarget,
LONG *plExtra);
public:
typedef BYTE (CDetourDis::* COPYFUNC)(PBYTE pbDst, PBYTE pbSrc);
struct COPYENTRY {
USHORT nOpcode;
COPYFUNC pfCopy;
};
typedef const COPYENTRY * REFCOPYENTRY;
struct Branch5
{
DWORD Register : 3;
DWORD Imm5 : 5;
DWORD Padding : 1;
DWORD I : 1;
DWORD OpCode : 6;
};
struct Branch5Target
{
DWORD Padding : 1;
DWORD Imm5 : 5;
DWORD I : 1;
DWORD Padding2 : 25;
};
struct Branch8
{
DWORD Imm8 : 8;
DWORD Condition : 4;
DWORD OpCode : 4;
};
struct Branch8Target
{
DWORD Padding : 1;
DWORD Imm8 : 8;
DWORD Padding2 : 23;
};
struct Branch11
{
DWORD Imm11 : 11;
DWORD OpCode : 5;
};
struct Branch11Target
{
DWORD Padding : 1;
DWORD Imm11 : 11;
DWORD Padding2 : 20;
};
struct Branch20
{
DWORD Imm11 : 11;
DWORD J2 : 1;
DWORD IT : 1;
DWORD J1 : 1;
DWORD Other : 2;
DWORD Imm6 : 6;
DWORD Condition : 4;
DWORD Sign : 1;
DWORD OpCode : 5;
};
struct Branch20Target
{
DWORD Padding : 1;
DWORD Imm11 : 11;
DWORD Imm6 : 6;
DWORD J1 : 1;
DWORD J2 : 1;
DWORD Sign : 1;
INT32 Padding2 : 11;
};
struct Branch24
{
DWORD Imm11 : 11;
DWORD J2 : 1;
DWORD InstructionSet : 1;
DWORD J1 : 1;
DWORD Link : 1;
DWORD Branch : 1;
DWORD Imm10 : 10;
DWORD Sign : 1;
DWORD OpCode : 5;
};
struct Branch24Target
{
DWORD Padding : 1;
DWORD Imm11 : 11;
DWORD Imm10 : 10;
DWORD I2 : 1;
DWORD I1 : 1;
DWORD Sign : 1;
INT32 Padding2 : 7;
};
struct LiteralLoad8
{
DWORD Imm8 : 8;
DWORD Register : 3;
DWORD OpCode : 5;
};
struct LiteralLoad8Target
{
DWORD Padding : 2;
DWORD Imm8 : 8;
DWORD Padding2 : 22;
};
struct LiteralLoad12
{
DWORD Imm12 : 12;
DWORD Register : 4;
DWORD OpCodeSuffix : 7;
DWORD Add : 1;
DWORD OpCodePrefix : 8;
};
struct LiteralLoad12Target
{
DWORD Imm12 : 12;
DWORD Padding : 20;
};
struct ImmediateRegisterLoad32
{
DWORD Imm12 : 12;
DWORD DestinationRegister : 4;
DWORD SourceRegister: 4;
DWORD OpCode : 12;
};
struct ImmediateRegisterLoad16
{
DWORD DestinationRegister : 3;
DWORD SourceRegister: 3;
DWORD OpCode : 10;
};
struct TableBranch
{
DWORD IndexRegister : 4;
DWORD HalfWord : 1;
DWORD OpCodeSuffix : 11;
DWORD BaseRegister : 4;
DWORD OpCodePrefix : 12;
};
struct Shift
{
DWORD Imm2 : 2;
DWORD Imm3 : 3;
};
struct Add32
{
DWORD SecondOperandRegister : 4;
DWORD Type : 2;
DWORD Imm2 : 2;
DWORD DestinationRegister : 4;
DWORD Imm3 : 3;
DWORD Padding : 1;
DWORD FirstOperandRegister : 4;
DWORD SetFlags : 1;
DWORD OpCode : 11;
};
struct LogicalShiftLeft32
{
DWORD SourceRegister : 4;
DWORD Padding : 2;
DWORD Imm2 : 2;
DWORD DestinationRegister : 4;
DWORD Imm3 : 3;
DWORD Padding2 : 5;
DWORD SetFlags : 1;
DWORD OpCode : 11;
};
struct StoreImmediate12
{
DWORD Imm12 : 12;
DWORD SourceRegister : 4;
DWORD BaseRegister : 4;
DWORD OpCode : 12;
};
protected:
BYTE PureCopy16(BYTE* pSource, BYTE* pDest);
BYTE PureCopy32(BYTE* pSource, BYTE* pDest);
BYTE CopyMiscellaneous16(BYTE* pSource, BYTE* pDest);
BYTE CopyConditionalBranchOrOther16(BYTE* pSource, BYTE* pDest);
BYTE CopyUnConditionalBranch16(BYTE* pSource, BYTE* pDest);
BYTE CopyLiteralLoad16(BYTE* pSource, BYTE* pDest);
BYTE CopyBranchExchangeOrDataProcessing16(BYTE* pSource, BYTE* pDest);
BYTE CopyBranch24(BYTE* pSource, BYTE* pDest);
BYTE CopyBranchOrMiscellaneous32(BYTE* pSource, BYTE* pDest);
BYTE CopyLiteralLoad32(BYTE* pSource, BYTE* pDest);
BYTE CopyLoadAndStoreSingle(BYTE* pSource, BYTE* pDest);
BYTE CopyLoadAndStoreMultipleAndSRS(BYTE* pSource, BYTE* pDest);
BYTE CopyTableBranch(BYTE* pSource, BYTE* pDest);
BYTE BeginCopy32(BYTE* pSource, BYTE* pDest);
LONG DecodeBranch5(ULONG opcode);
USHORT EncodeBranch5(ULONG originalOpCode, LONG delta);
LONG DecodeBranch8(ULONG opcode);
USHORT EncodeBranch8(ULONG originalOpCode, LONG delta);
LONG DecodeBranch11(ULONG opcode);
USHORT EncodeBranch11(ULONG originalOpCode, LONG delta);
BYTE EmitBranch11(PUSHORT& pDest, LONG relativeAddress);
LONG DecodeBranch20(ULONG opcode);
ULONG EncodeBranch20(ULONG originalOpCode, LONG delta);
LONG DecodeBranch24(ULONG opcode, BOOL& fLink);
ULONG EncodeBranch24(ULONG originalOpCode, LONG delta, BOOL fLink);
LONG DecodeLiteralLoad8(ULONG instruction);
LONG DecodeLiteralLoad12(ULONG instruction);
BYTE EmitLiteralLoad8(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral);
BYTE EmitLiteralLoad12(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral);
BYTE EmitImmediateRegisterLoad32(PUSHORT& pDest, BYTE reg);
BYTE EmitImmediateRegisterLoad16(PUSHORT& pDest, BYTE reg);
BYTE EmitLongLiteralLoad(PUSHORT& pDest, BYTE reg, PVOID pTarget);
BYTE EmitLongBranch(PUSHORT& pDest, PVOID pTarget);
USHORT CalculateExtra(BYTE sourceLength, BYTE* pDestStart, BYTE* pDestEnd);
protected:
ULONG GetLongInstruction(BYTE* pSource)
{
return (((PUSHORT)pSource)[0] << 16) | (((PUSHORT)pSource)[1]);
}
BYTE EmitLongInstruction(PUSHORT& pDstInst, ULONG instruction)
{
*pDstInst++ = (USHORT)(instruction >> 16);
*pDstInst++ = (USHORT)instruction;
return sizeof(ULONG);
}
BYTE EmitShortInstruction(PUSHORT& pDstInst, USHORT instruction)
{
*pDstInst++ = instruction;
return sizeof(USHORT);
}
PBYTE Align4(PBYTE pValue)
{
return (PBYTE)(((size_t)pValue) & ~(ULONG)3u);
}
PBYTE CalculateTarget(PBYTE pSource, LONG delta)
{
return (pSource + delta + c_PCAdjust);
}
LONG CalculateNewDelta(PBYTE pTarget, BYTE* pDest)
{
return (LONG)(pTarget - (pDest + c_PCAdjust));
}
BYTE EmitAdd32(PUSHORT& pDstInst, BYTE op1Reg, BYTE op2Reg, BYTE dstReg, BYTE shiftAmount)
{
Shift& shift = (Shift&)(shiftAmount);
const BYTE shiftType = 0x00; // LSL
Add32 add = { op2Reg, shiftType, shift.Imm2, dstReg, shift.Imm3,
0x0, op1Reg, 0x0, 0x758 };
return EmitLongInstruction(pDstInst, (ULONG&)add);
}
BYTE EmitLogicalShiftLeft32(PUSHORT& pDstInst, BYTE srcReg, BYTE dstReg, BYTE shiftAmount)
{
Shift& shift = (Shift&)(shiftAmount);
LogicalShiftLeft32 shiftLeft = { srcReg, 0x00, shift.Imm2, dstReg, shift.Imm3, 0x1E,
0x00, 0x752 };
return EmitLongInstruction(pDstInst, (ULONG&)shiftLeft);
}
BYTE EmitStoreImmediate12(PUSHORT& pDstInst, BYTE srcReg, BYTE baseReg, USHORT offset)
{
StoreImmediate12 store = { offset, srcReg, baseReg, 0xF8C };
return EmitLongInstruction(pDstInst, (ULONG&)store);
}
protected:
PBYTE m_pbTarget;
PBYTE m_pbPool;
LONG m_lExtra;
BYTE m_rbScratchDst[64]; // matches or exceeds rbCode
static const COPYENTRY s_rceCopyTable[33];
};
LONG CDetourDis::DecodeBranch5(ULONG opcode)
{
Branch5& branch = (Branch5&)(opcode);
Branch5Target target;
ZeroMemory(&target, sizeof(target));
target.Imm5 = branch.Imm5;
target.I = branch.I;
// Return zero-extended value
return (LONG&)target;
}
USHORT CDetourDis::EncodeBranch5(ULONG originalOpCode, LONG delta)
{
// Too large for a 5 bit branch (5 bit branches can be up to 7 bits due to I and the trailing 0)
if (delta < 0 || delta > 0x7F) {
return 0;
}
Branch5& branch = (Branch5&)(originalOpCode);
Branch5Target& target = (Branch5Target&)(delta);
branch.Imm5 = target.Imm5;
branch.I = target.I;
return (USHORT&)branch;
}
LONG CDetourDis::DecodeBranch8(ULONG opcode)
{
Branch8& branch = (Branch8&)(opcode);
Branch8Target target;
ZeroMemory(&target, sizeof(target));
target.Imm8 = branch.Imm8;
// Return sign extended value
return (((LONG&)target) << 23) >> 23;
}
USHORT CDetourDis::EncodeBranch8(ULONG originalOpCode, LONG delta)
{
// Too large for 8 bit branch (8 bit branches can be up to 9 bits due to the trailing 0)
if (delta < (-(int)0x100) || delta > 0xFF) {
return 0;
}
Branch8& branch = (Branch8&)(originalOpCode);
Branch8Target& target = (Branch8Target&)(delta);
branch.Imm8 = target.Imm8;
return (USHORT&)branch;
}
LONG CDetourDis::DecodeBranch11(ULONG opcode)
{
Branch11& branch = (Branch11&)(opcode);
Branch11Target target;
ZeroMemory(&target, sizeof(target));
target.Imm11 = branch.Imm11;
// Return sign extended value
return (((LONG&)target) << 20) >> 20;
}
USHORT CDetourDis::EncodeBranch11(ULONG originalOpCode, LONG delta)
{
// Too large for an 11 bit branch (11 bit branches can be up to 12 bits due to the trailing 0)
if (delta < (-(int)0x800) || delta > 0x7FF) {
return 0;
}
Branch11& branch = (Branch11&)(originalOpCode);
Branch11Target& target = (Branch11Target&)(delta);
branch.Imm11 = target.Imm11;
return (USHORT&)branch;
}
BYTE CDetourDis::EmitBranch11(PUSHORT& pDest, LONG relativeAddress)
{
Branch11Target& target = (Branch11Target&)(relativeAddress);
Branch11 branch11 = { target.Imm11, 0x1C };
*pDest++ = (USHORT&)branch11;
return sizeof(USHORT);
}
LONG CDetourDis::DecodeBranch20(ULONG opcode)
{
Branch20& branch = (Branch20&)(opcode);
Branch20Target target;
ZeroMemory(&target, sizeof(target));
target.Imm11 = branch.Imm11;
target.Imm6 = branch.Imm6;
target.Sign = branch.Sign;
target.J1 = branch.J1;
target.J2 = branch.J2;
// Sign extend
if (target.Sign) {
target.Padding2 = -1;
}
return (LONG&)target;
}
ULONG CDetourDis::EncodeBranch20(ULONG originalOpCode, LONG delta)
{
// Too large for 20 bit branch (20 bit branches can be up to 21 bits due to the trailing 0)
if (delta < (-(int)0x100000) || delta > 0xFFFFF) {
return 0;
}
Branch20& branch = (Branch20&)(originalOpCode);
Branch20Target& target = (Branch20Target&)(delta);
branch.Imm11 = target.Imm11;
branch.Imm6 = target.Imm6;
branch.Sign = target.Sign;
branch.J1 = target.J1;
branch.J2 = target.J2;
return (ULONG&)branch;
}
LONG CDetourDis::DecodeBranch24(ULONG opcode, BOOL& fLink)
{
Branch24& branch = (Branch24&)(opcode);
Branch24Target target;
ZeroMemory(&target, sizeof(target));
target.Imm11 = branch.Imm11;
target.Imm10 = branch.Imm10;
target.Sign = branch.Sign;
target.I1 = ~(branch.J1 ^ target.Sign);
target.I2 = ~(branch.J2 ^ target.Sign);
fLink = branch.Link;
// Sign extend
if (target.Sign) {
target.Padding2 = -1;
}
return (LONG&)target;
}
ULONG CDetourDis::EncodeBranch24(ULONG originalOpCode, LONG delta, BOOL fLink)
{
// Too large for 24 bit branch (24 bit branches can be up to 25 bits due to the trailing 0)
if (delta < static_cast<int>(0xFF000000) || delta > static_cast<int>(0xFFFFFF)) {
return 0;
}
Branch24& branch = (Branch24&)(originalOpCode);
Branch24Target& target = (Branch24Target&)(delta);
branch.Imm11 = target.Imm11;
branch.Imm10 = target.Imm10;
branch.Link = fLink;
branch.Sign = target.Sign;
branch.J1 = ~(target.I1 ^ branch.Sign);
branch.J2 = ~(target.I2 ^ branch.Sign);
return (ULONG&)branch;
}
LONG CDetourDis::DecodeLiteralLoad8(ULONG instruction)
{
LiteralLoad8& load = (LiteralLoad8&)(instruction);
LiteralLoad8Target target;
ZeroMemory(&target, sizeof(target));
target.Imm8 = load.Imm8;
return (LONG&)target;
}
BYTE CDetourDis::EmitLiteralLoad8(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral)
{
// Note: We add 2 (which gets rounded down) because literals must be 32-bit
// aligned, but the ldr can be 16-bit aligned.
LONG newDelta = CalculateNewDelta((PBYTE)pLiteral + 2, (PBYTE)pDest);
LONG relative = ((newDelta > 0 ? newDelta : -newDelta) & 0x3FF);
LiteralLoad8Target& target = (LiteralLoad8Target&)(relative);
LiteralLoad8 load = { target.Imm8, targetRegister, 0x9 };
return EmitShortInstruction(pDest, (USHORT&)load);
}
LONG CDetourDis::DecodeLiteralLoad12(ULONG instruction)
{
LiteralLoad12& load = (LiteralLoad12&)(instruction);
LiteralLoad12Target target;
ZeroMemory(&target, sizeof(target));
target.Imm12 = load.Imm12;
return (LONG&)target;
}
BYTE CDetourDis::EmitLiteralLoad12(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral)
{
// Note: We add 2 (which gets rounded down) because literals must be 32-bit
// aligned, but the ldr can be 16-bit aligned.
LONG newDelta = CalculateNewDelta((PBYTE)pLiteral + 2, (PBYTE)pDest);
LONG relative = ((newDelta > 0 ? newDelta : -newDelta) & 0xFFF);
LiteralLoad12Target& target = (LiteralLoad12Target&)(relative);
target.Imm12 -= target.Imm12 & 3;
LiteralLoad12 load = { target.Imm12, targetRegister, 0x5F, (DWORD)(newDelta > 0), 0xF8 };
return EmitLongInstruction(pDest, (ULONG&)load);
}
BYTE CDetourDis::EmitImmediateRegisterLoad32(PUSHORT& pDest, BYTE reg)
{
ImmediateRegisterLoad32 load = { 0, reg, reg, 0xF8D };
return EmitLongInstruction(pDest, (ULONG&)load);
}
BYTE CDetourDis::EmitImmediateRegisterLoad16(PUSHORT& pDest, BYTE reg)
{
ImmediateRegisterLoad16 load = { reg, reg, 0x680 >> 2 };
return EmitShortInstruction(pDest, (USHORT&)load);
}
BYTE CDetourDis::EmitLongLiteralLoad(PUSHORT& pDest, BYTE targetRegister, PVOID pTarget)
{
*--((PULONG&)m_pbPool) = (ULONG)(size_t)pTarget;
// ldr rn, target.
BYTE size = EmitLiteralLoad12(pDest, targetRegister, m_pbPool);
// This only makes sense if targetRegister != PC;
// otherwise, we would have branched with the previous instruction anyway
if (targetRegister != c_PC) {
// ldr rn, [rn]
if (targetRegister <= 7) {
size = (BYTE)(size + EmitImmediateRegisterLoad16(pDest, targetRegister));
}
else {
size = (BYTE)(size + EmitImmediateRegisterLoad32(pDest, targetRegister));
}
}
return size;
}
BYTE CDetourDis::EmitLongBranch(PUSHORT& pDest, PVOID pTarget)
{
// Emit a long literal load into PC
BYTE size = EmitLongLiteralLoad(pDest, c_PC, DETOURS_PBYTE_TO_PFUNC(pTarget));
return size;
}
BYTE CDetourDis::PureCopy16(BYTE* pSource, BYTE* pDest)
{
*(USHORT *)pDest = *(USHORT *)pSource;
return sizeof(USHORT);
}
BYTE CDetourDis::PureCopy32(BYTE* pSource, BYTE* pDest)
{
*(UNALIGNED ULONG *)pDest = *(UNALIGNED ULONG*)pSource;
return sizeof(DWORD);
}
USHORT CDetourDis::CalculateExtra(BYTE sourceLength, BYTE* pDestStart, BYTE* pDestEnd)
{
ULONG destinationLength = (ULONG)(pDestEnd - pDestStart);
return static_cast<USHORT>((destinationLength > sourceLength) ? (destinationLength - sourceLength) : 0);
}
BYTE CDetourDis::CopyMiscellaneous16(BYTE* pSource, BYTE* pDest)
{
USHORT instruction = *(PUSHORT)(pSource);
// Compare and branch imm5 (CBZ, CBNZ)
if ((instruction & 0x100) && !(instruction & 0x400)) { // (1011x0x1xxxxxxxx)
LONG oldDelta = DecodeBranch5(instruction);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
LONG newDelta = CalculateNewDelta(pTarget, pDest);
instruction = EncodeBranch5(instruction, newDelta);
if (instruction) {
// Copy the 16 bit instruction over
*(PUSHORT)(pDest) = instruction;
return sizeof(USHORT); // The source instruction was 16 bits
}
// If that fails, re-encode with 'conditional branch' logic, without using the condition flags
// For example, cbz r2,+0x56 (0x90432) becomes:
//
// 001df73a b92a cbnz r2,001df748
// 001df73c e002 b 001df744
// 001df73e bf00 nop
// 001df740 0432 dc.h 0432
// 001df742 0009 dc.h 0009
// 001df744 f85ff008 ldr pc,=0x90432
//
// Store where we will be writing our conditional branch, and move past it so we can emit a long branch
PUSHORT pDstInst = (PUSHORT)(pDest);
PUSHORT pConditionalBranchInstruction = pDstInst++;
// Emit the long branch instruction
BYTE longBranchSize = EmitLongBranch(pDstInst, pTarget);
// Invert the CBZ/CBNZ instruction to move past our 'long branch' if the inverse comparison succeeds
// Write the CBZ/CBNZ instruction *before* the long branch we emitted above
// This had to be done out of order, since the size of a long branch can vary due to alignment restrictions
instruction = EncodeBranch5(*(PUSHORT)(pSource), longBranchSize - c_PCAdjust + sizeof(USHORT));
Branch5& branch = (Branch5&)(instruction);
branch.OpCode = (branch.OpCode & 0x02) ? 0x2C : 0x2E; // Invert the CBZ/CBNZ comparison
*pConditionalBranchInstruction = instruction;
// Compute the extra space needed for the branch sequence
m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));
return sizeof(USHORT); // The source instruction was 16 bits
}
// If-Then Instruction (IT)
if ((instruction >> 8 == 0xBF) && (instruction & 0xF)) { //(10111111xxxx(mask != 0b0000))
// ToDo: Implement IT handler
ASSERT(false);
return sizeof(USHORT);
}
// ADD/SUB, SXTH, SXTB, UXTH, UXTB, CBZ, CBNZ, PUSH, POP, REV, REV15, REVSH, NOP, YIELD, WFE, WFI, SEV, etc.
return PureCopy16(pSource, pDest);
}
BYTE CDetourDis::CopyConditionalBranchOrOther16(BYTE* pSource, BYTE* pDest)
{
USHORT instruction = *(PUSHORT)(pSource);
// Could be a conditional branch, an Undefined instruction or a Service System Call
// Only the former needs special logic
if ((instruction & 0xE00) != 0xE00) { // 1101(!=111x)xxxxxxxx
LONG oldDelta = DecodeBranch8(instruction);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
LONG newDelta = CalculateNewDelta(pTarget, pDest);
instruction = EncodeBranch8(instruction, newDelta);
if (instruction) {
// Copy the 16 bit instruction over
*(PUSHORT)(pDest) = instruction;
return sizeof(USHORT); // The source instruction was 16 bits
}
// If that fails, re-encode as a sequence of branches
// For example, bne +0x6E (0x90452) becomes:
//
// 001df758 d100 bne 001df75c
// 001df75a e005 b 001df768
// 001df75c e002 b 001df764
// 001df75e bf00 nop
// 001df760 0452 dc.h 0452
// 001df762 0009 dc.h 0009
// 001df764 f85ff008 ldr pc,=0x90452
//
// First, reuse the existing conditional branch to, if successful, branch down to a 'long branch' that we will emit below
USHORT newInstruction = EncodeBranch8(*(PUSHORT)(pSource), 0); // Due to the size of c_PCAdjust a zero-length branch moves 4 bytes forward, past the following unconditional branch
ASSERT(newInstruction);
PUSHORT pDstInst = (PUSHORT)(pDest);
*pDstInst++ = newInstruction;
// Next, prepare to insert an unconditional branch that will be hit if the condition above is not met. This branch will branch over the following 'long branch'
// We can't actually encode this branch yet though, because 'long branches' can vary in size
PUSHORT pUnconditionalBranchInstruction = pDstInst++;
// Then, emit a 'long branch' that will be hit if the original condition is met
BYTE longBranchSize = EmitLongBranch(pDstInst, pTarget);
// Finally, encode and emit the unconditional branch that will be used to branch past the 'long branch' if the initial condition was not met
Branch11 branch11 = { 0x00, 0x1C };
newInstruction = EncodeBranch11(*(DWORD*)(&branch11), longBranchSize - c_PCAdjust + sizeof(USHORT));
ASSERT(newInstruction);
*pUnconditionalBranchInstruction = newInstruction;
// Compute the extra space needed for the branch sequence
m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));
return sizeof(USHORT); // The source instruction was 16 bits
}
return PureCopy16(pSource, pDest);
}
BYTE CDetourDis::CopyUnConditionalBranch16(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = *(PUSHORT)(pSource);
LONG oldDelta = DecodeBranch11(instruction);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
LONG newDelta = CalculateNewDelta(pTarget, pDest);
instruction = EncodeBranch11(instruction, newDelta);
if (instruction) {
// Copy the 16 bit instruction over
*(PUSHORT)(pDest) = (USHORT)instruction;
return sizeof(USHORT); // The source instruction was 16 bits
}
// If that fails, re-encode as 32-bit
PUSHORT pDstInst = (PUSHORT)(pDest);
instruction = EncodeBranch24(0xf0009000, newDelta, FALSE);
if (instruction) {
// Copy both bytes of the instruction
EmitLongInstruction(pDstInst, instruction);
m_lExtra = sizeof(DWORD) - sizeof(USHORT); // The destination instruction was 32 bits
return sizeof(USHORT); // The source instruction was 16 bits
}
// If that fails, emit as a 'long branch'
if (!instruction) {
// For example, b +0x7FE (00090be6) becomes:
// 003f6d02 e001 b 003f6d08
// 003f6d04 0be6 dc.h 0be6
// 003f6d06 0009 dc.h 0009
// 003f6d08 f85ff008 ldr pc,=0x90BE6
EmitLongBranch(pDstInst, pTarget);
// Compute the extra space needed for the branch sequence
m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));
return sizeof(USHORT); // The source instruction was 16 bits
}
return sizeof(USHORT); // The source instruction was 16 bits
}
BYTE CDetourDis::CopyLiteralLoad16(BYTE* pSource, BYTE* pDest)
{
PBYTE pStart = pDest;
USHORT instruction = *(PUSHORT)(pSource);
LONG oldDelta = DecodeLiteralLoad8(instruction);
PBYTE pTarget = CalculateTarget(Align4(pSource), oldDelta);
// Re-encode as a 'long literal load'
// For example, ldr r0, [PC + 1E0] (0x905B4) becomes:
//
// 001df72c f85f0008 ldr r0,=0x905B4
// 001df730 f8d00000 ldr.w r0,[r0]
LiteralLoad8& load8 = (LiteralLoad8&)(instruction);
EmitLongLiteralLoad((PUSHORT&)pDest, load8.Register, pTarget);
m_lExtra = (LONG)(pDest - pStart - sizeof(USHORT));
return sizeof(USHORT); // The source instruction was 16 bits
}
BYTE CDetourDis::CopyBranchExchangeOrDataProcessing16(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = *(PUSHORT)(pSource);
// BX
if ((instruction & 0xff80) == 0x4700) {
// The target is stored in a register
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
// AND, LSR, TST, ADD, CMP, MOV
return PureCopy16(pSource, pDest);
}
const CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable[33] =
{
// Shift by immediate, move register
// ToDo: Not handling moves from PC
/* 0b00000 */ { 0x00, &CDetourDis::PureCopy16 },
/* 0b00001 */ { 0x01, &CDetourDis::PureCopy16 },
/* 0b00010 */ { 0x02, &CDetourDis::PureCopy16 },
// Add/subtract register
// Add/subtract immediate
/* 0b00011 */ { 0x03, &CDetourDis::PureCopy16},
// Add/subtract/compare/move immediate
/* 0b00100 */ { 0x04, &CDetourDis::PureCopy16 },
/* 0b00101 */ { 0x05, &CDetourDis::PureCopy16 },
/* 0b00110 */ { 0x06, &CDetourDis::PureCopy16 },
/* 0b00111 */ { 0x07, &CDetourDis::PureCopy16 },
// Data-processing register
// Special data processing
// Branch/exchange instruction set
/* 0b01000 */ { 0x08, &CDetourDis::CopyBranchExchangeOrDataProcessing16 },
// Load from literal pool
/* 0b01001 */ { 0x09, &CDetourDis::CopyLiteralLoad16 },
// Load/store register offset
/* 0b01010 */ { 0x0a, &CDetourDis::PureCopy16 },
/* 0b01011 */ { 0x0b, &CDetourDis::PureCopy16 },
// Load/store word/byte immediate offset.
/* 0b01100 */ { 0x0c, &CDetourDis::PureCopy16 },
/* 0b01101 */ { 0x0d, &CDetourDis::PureCopy16 },
/* 0b01110 */ { 0x0e, &CDetourDis::PureCopy16 },
/* 0b01111 */ { 0x0f, &CDetourDis::PureCopy16 },
// Load/store halfword immediate offset.
/* 0b10000 */ { 0x10, &CDetourDis::PureCopy16 },
/* 0b10001 */ { 0x11, &CDetourDis::PureCopy16 },
// Load from or store to stack
/* 0b10010 */ { 0x12, &CDetourDis::PureCopy16 },
/* 0b10011 */ { 0x13, &CDetourDis::PureCopy16 },
// Add to SP or PC
/* 0b10100 */ { 0x14, &CDetourDis::PureCopy16 },
// ToDo: Is ADR (T1) blitt-able?
// It adds a value to PC and stores the result in a register.
// Does this count as a 'target' for detours?
/* 0b10101 */ { 0x15, &CDetourDis::PureCopy16 },
// Miscellaneous
/* 0b10110 */ { 0x16, &CDetourDis::CopyMiscellaneous16 },
/* 0b10111 */ { 0x17, &CDetourDis::CopyMiscellaneous16 },
// Load/store multiple
/* 0b11000 */ { 0x18, &CDetourDis::PureCopy16 },
/* 0b11001 */ { 0x19, &CDetourDis::PureCopy16 },
// ToDo: Are we sure these are all safe?
// LDMIA, for example, can include an 'embedded' branch.
// Does this count as a 'target' for detours?
// Conditional branch
/* 0b11010 */ { 0x1a, &CDetourDis::CopyConditionalBranchOrOther16 },
// Conditional branch
// Undefined instruction
// Service (system) call
/* 0b11011 */ { 0x1b, &CDetourDis::CopyConditionalBranchOrOther16 },
// Unconditional branch
/* 0b11100 */ { 0x1c, &CDetourDis::CopyUnConditionalBranch16 },
// 32-bit instruction
/* 0b11101 */ { 0x1d, &CDetourDis::BeginCopy32 },
/* 0b11110 */ { 0x1e, &CDetourDis::BeginCopy32 },
/* 0b11111 */ { 0x1f, &CDetourDis::BeginCopy32 },
{ 0, NULL }
};
BYTE CDetourDis::CopyBranch24(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = GetLongInstruction(pSource);
BOOL fLink;
LONG oldDelta = DecodeBranch24(instruction, fLink);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
// Re-encode as 32-bit
PUSHORT pDstInst = (PUSHORT)(pDest);
LONG newDelta = CalculateNewDelta(pTarget, pDest);
instruction = EncodeBranch24(instruction, newDelta, fLink);
if (instruction) {
// Copy both bytes of the instruction
EmitLongInstruction(pDstInst, instruction);
return sizeof(DWORD);
}
// If that fails, re-encode as a 'long branch'
EmitLongBranch(pDstInst, pTarget);
// Compute the extra space needed for the instruction
m_lExtra = CalculateExtra(sizeof(DWORD), pDest, (BYTE*)(pDstInst));
return sizeof(DWORD); // The source instruction was 32 bits
}
BYTE CDetourDis::CopyBranchOrMiscellaneous32(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = GetLongInstruction(pSource);
if ((instruction & 0xf800d000) == 0xf0008000) { // B<c>.W <label>
LONG oldDelta = DecodeBranch20(instruction);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
// Re-encode as 32-bit
PUSHORT pDstInst = (PUSHORT)(pDest);
LONG newDelta = CalculateNewDelta(pTarget, pDest);
instruction = EncodeBranch20(instruction, newDelta);
if (instruction) {
// Copy both bytes of the instruction
EmitLongInstruction(pDstInst, instruction);
return sizeof(DWORD);
}
// If that fails, re-encode as a sequence of branches
// For example, bls.w +0x86 (00090480)| becomes:
//
// 001df788 f2408001 bls.w 001df78e
// 001df78c e004 b 001df798
// 001df78e e001 b 001df794
// 001df790 0480 dc.h 0480
// 001df792 0009 dc.h 0009
// 001df794 f85ff008 ldr pc,=0x90480
//
// First, reuse the existing conditional branch to, if successful,
// branch down to a 'long branch' that we will emit below
instruction = EncodeBranch20(GetLongInstruction(pSource), 2);
// Due to the size of c_PCAdjust a two-length branch moves 6 bytes forward,
// past the following unconditional branch
ASSERT(instruction);
EmitLongInstruction(pDstInst, instruction);
// Next, prepare to insert an unconditional branch that will be hit
// if the condition above is not met. This branch will branch over
// the following 'long branch'
// We can't actually encode this branch yet though, because
// 'long branches' can vary in size
PUSHORT pUnconditionalBranchInstruction = pDstInst++;
// Then, emit a 'long branch' that will be hit if the original condition is met
BYTE longBranchSize = EmitLongBranch(pDstInst, pTarget);
// Finally, encode and emit the unconditional branch that will be used
// to branch past the 'long branch' if the initial condition was not met
Branch11 branch11 = { 0x00, 0x1C };
instruction = EncodeBranch11(*(DWORD*)(&branch11), longBranchSize - c_PCAdjust + sizeof(USHORT));
ASSERT(instruction);
*pUnconditionalBranchInstruction = static_cast<USHORT>(instruction);
// Compute the extra space needed for the instruction
m_lExtra = CalculateExtra(sizeof(DWORD), pDest, (BYTE*)(pDstInst));
return sizeof(DWORD); // The source instruction was 32 bits
}
if ((instruction & 0xf800d000) == 0xf0009000) { // B.W <label>
// B <label> 11110xxxxxxxxxxx10xxxxxxxxxxxxxx
return CopyBranch24(pSource, pDest);
}
if ((instruction & 0xf800d000) == 0xf000d000) { // BL.W <label>
// B <label> 11110xxxxxxxxxxx10xxxxxxxxxxxxxx
PUSHORT pDstInst = (PUSHORT)(pDest);
BOOL fLink;
LONG oldDelta = DecodeBranch24(instruction, fLink);
PBYTE pTarget = CalculateTarget(pSource, oldDelta);
m_pbTarget = pTarget;
*--((PULONG&)m_pbPool) = (ULONG)(size_t)DETOURS_PBYTE_TO_PFUNC(pTarget);
// ldr lr, target.
EmitLiteralLoad12(pDstInst, c_LR, m_pbPool);
// blx lr
EmitShortInstruction(pDstInst, 0x47f0);
// Compute the extra space needed for the instruction
m_lExtra = CalculateExtra(sizeof(DWORD), pDest, (BYTE*)(pDstInst));
return sizeof(DWORD); // The source instruction was 32 bits
}
if ((instruction & 0xFFF0FFFF) == 0xF3C08F00) {
// BXJ 111100111100xxxx1000111100000000
// BXJ switches to Jazelle mode, which is not supported
ASSERT(false);
}
if ((instruction & 0xFFFFFF00) == 0xF3DE8F00) {
// SUBS PC, LR 111100111101111010001111xxxxxxxx
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
// Everything else should be blitt-able
return PureCopy32(pSource, pDest);
}
BYTE CDetourDis::CopyLiteralLoad32(BYTE* pSource, BYTE* pDest)
{
BYTE* pStart = pDest;
ULONG instruction = GetLongInstruction(pSource);
LONG oldDelta = DecodeLiteralLoad12(instruction);
PBYTE pTarget = CalculateTarget(Align4(pSource), oldDelta);
LiteralLoad12& load = (LiteralLoad12&)(instruction);
EmitLongLiteralLoad((PUSHORT&)pDest, load.Register, pTarget);
m_lExtra = (LONG)(pDest - pStart - sizeof(DWORD));
return sizeof(DWORD); // The source instruction was 32 bits
}
BYTE CDetourDis::CopyLoadAndStoreSingle(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = GetLongInstruction(pSource);
// Note: The following masks only look at the interesting bits
// (not the opCode prefix, since that check was performed in
// order to get to this function)
if (!(instruction & 0x100000)) {
// 1111 100x xxx0 xxxxxxxxxxxxxxxxxxxx : STR, STRB, STRH, etc.
return PureCopy32(pSource, pDest);
}
if ((instruction & 0xF81F0000) == 0xF81F0000) {
// 1111100xxxx11111xxxxxxxxxxxxxxxx : PC +/- Imm12
return CopyLiteralLoad32(pSource, pDest);
}
if ((instruction & 0xFE70F000) == 0xF81FF000) {
// 1111100xx001xxxx1111xxxxxxxxxxxx : PLD, PLI
// Convert PC-Relative PLD/PLI instructions to noops (1111100Xx00111111111xxxxxxxxxxxx)
if ((instruction & 0xFE7FF000) == 0xF81FF000) {
PUSHORT pDstInst = (PUSHORT)(pDest);
*pDstInst++ = c_NOP;
*pDstInst++ = c_NOP;
return sizeof(DWORD); // The source instruction was 32 bits
}
// All other PLD/PLI instructions are blitt-able
return PureCopy32(pSource, pDest);
}
// If the load is writing to PC
if ((instruction & 0xF950F000) == 0xF850F000) {
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
// All other loads LDR (immediate), etc.
return PureCopy32(pSource, pDest);
}
BYTE CDetourDis::CopyLoadAndStoreMultipleAndSRS(BYTE* pSource, BYTE* pDest)
{
// Probably all blitt-able, although not positive since some of these can result in a branch (LDMIA, POP, etc.)
return PureCopy32(pSource, pDest);
}
BYTE CDetourDis::CopyTableBranch(BYTE* pSource, BYTE* pDest)
{
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
ULONG instruction = GetLongInstruction(pSource);
TableBranch& tableBranch = (TableBranch&)(instruction);
// If the base register is anything other than PC, we can simply copy the instruction
if (tableBranch.BaseRegister != c_PC) {
return PureCopy32(pSource, pDest);
}
__debugbreak();
// If the base register is PC, we need to manually perform the table lookup
// For example, this:
//
// 7ef40000 e8dff002 tbb [pc,r2]
//
// becomes this:
//
// 7ef40404 b401 push {r0} ; pushed as a placeholder for the target address
// 7ef40406 e92d0005 push.w {r0,r2} ; scratch register and another register are pushed; there's a minimum of two registers in the list for push.w
// 7ef40410 4820 ldr r0,=0x7EF40004 ; load the table address from the literal pool
// 7ef40414 eb000042 add r0,r0,r2,lsl #1 ; add the index value to the address of the table to get the table entry; lsl only used if it's a TBH instruction
// 7ef40418 f8d00000 ldr.w r0,[r0] ; dereference the table entry to get the value of the target
// 7ef4041c ea4f0040 lsl r0,r0,#1 ; multiply the offset by 2 (per the spec)
// 7ef40420 eb00000f add.w r0,r0,pc ; Add the offset to pc to get the target address
// 7ef40424 f8cd000c str.w r0,[sp,#0xC] ; store the target address on the stack (into the first push)
// 7ef40428 e8bd0005 pop.w {r0,r2} ; scratch register and another register are popped; there's a minimum of two registers in the list for pop.w
// 7ef4042c bd00 pop {pc} ; pop the address into pc
//
// Push r0 to make room for our jump address on the stack
PUSHORT pDstInst = (PUSHORT)(pDest);
*pDstInst++ = 0xb401;
// Locate a scratch register
BYTE scrReg = 0;
while (scrReg == tableBranch.IndexRegister) {
++scrReg;
}
// Push scrReg and tableBranch.IndexRegister (push.w doesn't support pushing just 1 register)
DWORD pushInstruction = 0xe92d0000;
pushInstruction |= 1 << scrReg;
pushInstruction |= 1 << tableBranch.IndexRegister;
EmitLongInstruction(pDstInst, pushInstruction);
// Write the target address out to the 'literal pool';
// when the base register of a TBB/TBH is PC,
// the branch table immediately follows the instruction
BYTE* pTarget = CalculateTarget(pSource, 0);
*--((PUSHORT&)m_pbPool) = (USHORT)((size_t)pTarget & 0xffff);
*--((PUSHORT&)m_pbPool) = (USHORT)((size_t)pTarget >> 16);
// Load the literal pool value into our scratch register (this contains the address of the branch table)
// ldr rn, target
EmitLiteralLoad8(pDstInst, scrReg, m_pbPool);
// Add the index offset to the address of the branch table; the result will be the value within the table that contains the branch offset
// We need to multiply the index by two if we are using halfword indexing
// Will shift tableBranch.IndexRegister by 1 (multiply by 2) if using a TBH
EmitAdd32(pDstInst, scrReg, tableBranch.IndexRegister, scrReg, tableBranch.HalfWord);
// Dereference rn into rn, to load the value within the table
// ldr rn, [rn]
if (scrReg < 0x7) {
EmitImmediateRegisterLoad16(pDstInst, scrReg);
}
else {
EmitImmediateRegisterLoad32(pDstInst, scrReg);
}
// Multiply the offset by two to get the true offset value (as per the spec)
EmitLogicalShiftLeft32(pDstInst, scrReg, scrReg, 1);
// Add the offset to PC to get the target
EmitAdd32(pDstInst, scrReg, c_PC, scrReg, 0);
// Now write the contents of scrReg to the stack, so we can pop it into PC
// Write the address of the branch table entry to the stack, so we can pop it into PC
EmitStoreImmediate12(pDstInst, scrReg, c_SP, sizeof(DWORD) * 3);
// Pop scrReg and tableBranch.IndexRegister (pop.w doesn't support popping just 1 register)
DWORD popInstruction = 0xe8bd0000;
popInstruction |= 1 << scrReg;
popInstruction |= 1 << tableBranch.IndexRegister;
EmitLongInstruction(pDstInst, popInstruction);
// Pop PC
*pDstInst++ = 0xbd00;
// Compute the extra space needed for the branch sequence
m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));
return sizeof(DWORD);
}
BYTE CDetourDis::BeginCopy32(BYTE* pSource, BYTE* pDest)
{
ULONG instruction = GetLongInstruction(pSource);
// Immediate data processing instructions; ADD, SUB, MOV, MOVN, ADR, MOVT, BFC, SSAT16, etc.
if ((instruction & 0xF8008000) == 0xF0000000) { // 11110xxxxxxxxxxx0xxxxxxxxxxxxxxx
// Should all be blitt-able
// ToDo: What about ADR? Is it safe to do a straight-copy?
// ToDo: Not handling moves to or from PC
return PureCopy32(pSource, pDest);
}
// Non-Immediate data processing instructions; ADD, EOR, TST, etc.
if ((instruction & 0xEE000000) == 0xEA000000) { // 111x101xxxxxxxxxxxxxxxxxxxxxxx
// Should all be blitt-able
return PureCopy32(pSource, pDest);
}
// Load and store single data item, memory hints
if ((instruction & 0xFE000000) == 0xF8000000) { // 1111100xxxxxxxxxxxxxxxxxxxxxxxxx
return CopyLoadAndStoreSingle(pSource, pDest);
}
// Load and store, double and exclusive, and table branch
if ((instruction & 0xFE400000) == 0xE8400000) { // 1110100xx1xxxxxxxxxxxxxxxxxxxxxx
// Load and store double
if (instruction & 0x1200000) {
// LDRD, STRD (immediate) : xxxxxxxPxxWxxxxxxxxxxxxxxxxxxxxx where PW != 0b00
// The source register is PC
if ((instruction & 0xF0000) == 0xF0000) {
// ToDo: If the source register is PC, what should we do?
ASSERT(false);
}
// If either target registers are PC
if (((instruction & 0xF000) == 0xF000) ||
((instruction & 0xF00) == 0xF00)) {
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
return PureCopy32(pSource, pDest);
}
// Load and store exclusive
if (!(instruction & 0x800000)) { // LDREX, STREX : xxxxxxxx0xxxxxxxxxxxxxxxxxxxxxxx
if ((instruction & 0xF000) == 0xF000) { // xxxxxxxxxxxx1111xxxxxxxxxxxx
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;
}
return PureCopy32(pSource, pDest);
}
// Table branch
if ((instruction & 0x1000F0) == 0x100000 || // TBB : xxxxxxxxxxx1xxxxxxxxxxxx0000xxxx
(instruction & 0x1000F0) == 0x100010) { // TBH : xxxxxxxxxxx1xxxxxxxxxxxx0001xxxx
return CopyTableBranch(pSource, pDest);
}
// Load and store exclusive byte, halfword, doubleword (LDREXB, LDREXH, LDREXD, STREXB, STREXH, STREXD, etc.)
return PureCopy32(pSource, pDest);
}
// Load and store multiple, RFE and SRS
if ((instruction & 0xFE400000) == 0xE8000000) { // 1110100xx0xxxxxxxxxxxxxxxxxxxxxx
// Return from exception (RFE)
if ((instruction & 0xE9900000) == 0xE9900000 || // 1110100110x1xxxxxxxxxxxxxxxxxxxx
(instruction & 0xE8100000) == 0xE8100000) { // 1110100000x1xxxxxxxxxxxxxxxxxxxx
return PureCopy32(pSource, pDest);
}
return CopyLoadAndStoreMultipleAndSRS(pSource, pDest);
}
// Branches, miscellaneous control
if ((instruction & 0xF8008000) == 0xF0008000) { // 11110xxxxxxxxxxx0xxxxxxxxxxxxxxx
// Branches, miscellaneous control
return CopyBranchOrMiscellaneous32(pSource, pDest);
}
// Coprocessor instructions
if ((instruction & 0xEC000000) == 0xEC000000) { // 111x11xxxxxxxxxxxxxxxxxxxxxxxxxx
return PureCopy32(pSource, pDest);
}
// Unhandled instruction; should never make it this far
ASSERT(false);
return PureCopy32(pSource, pDest);
}
/////////////////////////////////////////////////////////// Disassembler Code.
//
CDetourDis::CDetourDis()
{
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_NONE;
m_pbPool = NULL;
m_lExtra = 0;
}
PBYTE CDetourDis::CopyInstruction(PBYTE pDst,
PBYTE *ppDstPool,
PBYTE pSrc,
PBYTE *ppTarget,
LONG *plExtra)
{
if (pDst && ppDstPool && ppDstPool != NULL) {
m_pbPool = (PBYTE)*ppDstPool;
}
else {
pDst = m_rbScratchDst;
m_pbPool = m_rbScratchDst + sizeof(m_rbScratchDst);
}
// Make sure the constant pool is 32-bit aligned.
m_pbPool -= ((ULONG_PTR)m_pbPool) & 3;
REFCOPYENTRY pEntry = &s_rceCopyTable[pSrc[1] >> 3];
ULONG size = (this->*pEntry->pfCopy)(pSrc, pDst);
pSrc += size;
// If the target is needed, store our target
if (ppTarget) {
*ppTarget = m_pbTarget;
}
if (plExtra) {
*plExtra = m_lExtra;
}
if (ppDstPool) {
*ppDstPool = m_pbPool;
}
return pSrc;
}
PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
_Inout_opt_ PVOID *ppDstPool,
_In_ PVOID pSrc,
_Out_opt_ PVOID *ppTarget,
_Out_opt_ LONG *plExtra)
{
CDetourDis state;
return (PVOID)state.CopyInstruction((PBYTE)pDst,
(PBYTE*)ppDstPool,
(PBYTE)pSrc,
(PBYTE*)ppTarget,
plExtra);
}
#endif // DETOURS_ARM
#ifdef DETOURS_ARM64
#define c_LR 30 // The register number for the Link Register
#define c_SP 31 // The register number for the Stack Pointer
#define c_NOP 0xd503201f // A nop instruction
#define c_BREAK (0xd4200000 | (0xf000 << 5)) // A break instruction
//
// Problematic instructions:
//
// ADR 0ll10000 hhhhhhhh hhhhhhhh hhhddddd & 0x9f000000 == 0x10000000 (l = low, h = high, d = Rd)
// ADRP 1ll10000 hhhhhhhh hhhhhhhh hhhddddd & 0x9f000000 == 0x90000000 (l = low, h = high, d = Rd)
//
// B.cond 01010100 iiiiiiii iiiiiiii iii0cccc & 0xff000010 == 0x54000000 (i = delta = SignExtend(imm19:00, 64), c = cond)
//
// B 000101ii iiiiiiii iiiiiiii iiiiiiii & 0xfc000000 == 0x14000000 (i = delta = SignExtend(imm26:00, 64))
// BL 100101ii iiiiiiii iiiiiiii iiiiiiii & 0xfc000000 == 0x94000000 (i = delta = SignExtend(imm26:00, 64))
//
// CBNZ z0110101 iiiiiiii iiiiiiii iiittttt & 0x7f000000 == 0x35000000 (z = size, i = delta = SignExtend(imm19:00, 64), t = Rt)
// CBZ z0110100 iiiiiiii iiiiiiii iiittttt & 0x7f000000 == 0x34000000 (z = size, i = delta = SignExtend(imm19:00, 64), t = Rt)
//
// LDR Wt 00011000 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x18000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDR Xt 01011000 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x58000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDRSW 10011000 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x98000000 (i = SignExtend(imm19:00, 64), t = Rt)
// PRFM 11011000 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0xd8000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDR St 00011100 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x1c000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDR Dt 01011100 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x5c000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDR Qt 10011100 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0x9c000000 (i = SignExtend(imm19:00, 64), t = Rt)
// LDR inv 11011100 iiiiiiii iiiiiiii iiittttt & 0xff000000 == 0xdc000000 (i = SignExtend(imm19:00, 64), t = Rt)
//
// TBNZ z0110111 bbbbbiii iiiiiiii iiittttt & 0x7f000000 == 0x37000000 (z = size, b = bitnum, i = SignExtend(imm14:00, 64), t = Rt)
// TBZ z0110110 bbbbbiii iiiiiiii iiittttt & 0x7f000000 == 0x36000000 (z = size, b = bitnum, i = SignExtend(imm14:00, 64), t = Rt)
//
class CDetourDis
{
public:
CDetourDis();
PBYTE CopyInstruction(PBYTE pDst,
PBYTE pSrc,
PBYTE *ppTarget,
LONG *plExtra);
public:
typedef BYTE (CDetourDis::* COPYFUNC)(PBYTE pbDst, PBYTE pbSrc);
union AddImm12
{
DWORD Assembled;
struct
{
DWORD Rd : 5; // Destination register
DWORD Rn : 5; // Source register
DWORD Imm12 : 12; // 12-bit immediate
DWORD Shift : 2; // shift (must be 0 or 1)
DWORD Opcode1 : 7; // Must be 0010001 == 0x11
DWORD Size : 1; // 0 = 32-bit, 1 = 64-bit
} s;
static DWORD Assemble(DWORD size, DWORD rd, DWORD rn, ULONG imm, DWORD shift)
{
AddImm12 temp;
temp.s.Rd = rd;
temp.s.Rn = rn;
temp.s.Imm12 = imm & 0xfff;
temp.s.Shift = shift;
temp.s.Opcode1 = 0x11;
temp.s.Size = size;
return temp.Assembled;
}
static DWORD AssembleAdd32(DWORD rd, DWORD rn, ULONG imm, DWORD shift) { return Assemble(0, rd, rn, imm, shift); }
static DWORD AssembleAdd64(DWORD rd, DWORD rn, ULONG imm, DWORD shift) { return Assemble(1, rd, rn, imm, shift); }
};
union Adr19
{
DWORD Assembled;
struct
{
DWORD Rd : 5; // Destination register
DWORD Imm19 : 19; // 19-bit upper immediate
DWORD Opcode1 : 5; // Must be 10000 == 0x10
DWORD Imm2 : 2; // 2-bit lower immediate
DWORD Type : 1; // 0 = ADR, 1 = ADRP
} s;
inline LONG Imm() const { DWORD Imm = (s.Imm19 << 2) | s.Imm2; return (LONG)(Imm << 11) >> 11; }
static DWORD Assemble(DWORD type, DWORD rd, LONG delta)
{
Adr19 temp;
temp.s.Rd = rd;
temp.s.Imm19 = (delta >> 2) & 0x7ffff;
temp.s.Opcode1 = 0x10;
temp.s.Imm2 = delta & 3;
temp.s.Type = type;
return temp.Assembled;
}
static DWORD AssembleAdr(DWORD rd, LONG delta) { return Assemble(0, rd, delta); }
static DWORD AssembleAdrp(DWORD rd, LONG delta) { return Assemble(1, rd, delta); }
};
union Bcc19
{
DWORD Assembled;
struct
{
DWORD Condition : 4; // Condition
DWORD Opcode1 : 1; // Must be 0
DWORD Imm19 : 19; // 19-bit immediate
DWORD Opcode2 : 8; // Must be 01010100 == 0x54
} s;
inline LONG Imm() const { return (LONG)(s.Imm19 << 13) >> 11; }
static DWORD AssembleBcc(DWORD condition, LONG delta)
{
Bcc19 temp;
temp.s.Condition = condition;
temp.s.Opcode1 = 0;
temp.s.Imm19 = delta >> 2;
temp.s.Opcode2 = 0x54;
return temp.Assembled;
}
};
union Branch26
{
DWORD Assembled;
struct
{
DWORD Imm26 : 26; // 26-bit immediate
DWORD Opcode1 : 5; // Must be 00101 == 0x5
DWORD Link : 1; // 0 = B, 1 = BL
} s;
inline LONG Imm() const { return (LONG)(s.Imm26 << 6) >> 4; }
static DWORD Assemble(DWORD link, LONG delta)
{
Branch26 temp;
temp.s.Imm26 = delta >> 2;
temp.s.Opcode1 = 0x5;
temp.s.Link = link;
return temp.Assembled;
}
static DWORD AssembleB(LONG delta) { return Assemble(0, delta); }
static DWORD AssembleBl(LONG delta) { return Assemble(1, delta); }
};
union Br
{
DWORD Assembled;
struct
{
DWORD Opcode1 : 5; // Must be 00000 == 0
DWORD Rn : 5; // Register number
DWORD Opcode2 : 22; // Must be 1101011000011111000000 == 0x3587c0 for Br
// 0x358fc0 for Brl
} s;
static DWORD Assemble(DWORD rn, bool link)
{
Br temp;
temp.s.Opcode1 = 0;
temp.s.Rn = rn;
temp.s.Opcode2 = 0x3587c0;
if (link)
temp.Assembled |= 0x00200000;
return temp.Assembled;
}
static DWORD AssembleBr(DWORD rn)
{
return Assemble(rn, false);
}
static DWORD AssembleBrl(DWORD rn)
{
return Assemble(rn, true);
}
};
union Cbz19
{
DWORD Assembled;
struct
{
DWORD Rt : 5; // Register to test
DWORD Imm19 : 19; // 19-bit immediate
DWORD Nz : 1; // 0 = CBZ, 1 = CBNZ
DWORD Opcode1 : 6; // Must be 011010 == 0x1a
DWORD Size : 1; // 0 = 32-bit, 1 = 64-bit
} s;
inline LONG Imm() const { return (LONG)(s.Imm19 << 13) >> 11; }
static DWORD Assemble(DWORD size, DWORD nz, DWORD rt, LONG delta)
{
Cbz19 temp;
temp.s.Rt = rt;
temp.s.Imm19 = delta >> 2;
temp.s.Nz = nz;
temp.s.Opcode1 = 0x1a;
temp.s.Size = size;
return temp.Assembled;
}
};
union LdrLit19
{
DWORD Assembled;
struct
{
DWORD Rt : 5; // Destination register
DWORD Imm19 : 19; // 19-bit immediate
DWORD Opcode1 : 2; // Must be 0
DWORD FpNeon : 1; // 0 = LDR Wt/LDR Xt/LDRSW/PRFM, 1 = LDR St/LDR Dt/LDR Qt
DWORD Opcode2 : 3; // Must be 011 = 3
DWORD Size : 2; // 00 = LDR Wt/LDR St, 01 = LDR Xt/LDR Dt, 10 = LDRSW/LDR Qt, 11 = PRFM/invalid
} s;
inline LONG Imm() const { return (LONG)(s.Imm19 << 13) >> 11; }
static DWORD Assemble(DWORD size, DWORD fpneon, DWORD rt, LONG delta)
{
LdrLit19 temp;
temp.s.Rt = rt;
temp.s.Imm19 = delta >> 2;
temp.s.Opcode1 = 0;
temp.s.FpNeon = fpneon;
temp.s.Opcode2 = 3;
temp.s.Size = size;
return temp.Assembled;
}
};
union LdrFpNeonImm9
{
DWORD Assembled;
struct
{
DWORD Rt : 5; // Destination register
DWORD Rn : 5; // Base register
DWORD Imm12 : 12; // 12-bit immediate
DWORD Opcode1 : 1; // Must be 1 == 1
DWORD Opc : 1; // Part of size
DWORD Opcode2 : 6; // Must be 111101 == 0x3d
DWORD Size : 2; // Size (0=8-bit, 1=16-bit, 2=32-bit, 3=64-bit, 4=128-bit)
} s;
static DWORD Assemble(DWORD size, DWORD rt, DWORD rn, ULONG imm)
{
LdrFpNeonImm9 temp;
temp.s.Rt = rt;
temp.s.Rn = rn;
temp.s.Imm12 = imm;
temp.s.Opcode1 = 1;
temp.s.Opc = size >> 2;
temp.s.Opcode2 = 0x3d;
temp.s.Size = size & 3;
return temp.Assembled;
}
};
union Mov16
{
DWORD Assembled;
struct
{
DWORD Rd : 5; // Destination register
DWORD Imm16 : 16; // Immediate
DWORD Shift : 2; // Shift amount (0=0, 1=16, 2=32, 3=48)
DWORD Opcode : 6; // Must be 100101 == 0x25
DWORD Type : 2; // 0 = MOVN, 1 = reserved, 2 = MOVZ, 3 = MOVK
DWORD Size : 1; // 0 = 32-bit, 1 = 64-bit
} s;
static DWORD Assemble(DWORD size, DWORD type, DWORD rd, DWORD imm, DWORD shift)
{
Mov16 temp;
temp.s.Rd = rd;
temp.s.Imm16 = imm;
temp.s.Shift = shift;
temp.s.Opcode = 0x25;
temp.s.Type = type;
temp.s.Size = size;
return temp.Assembled;
}
static DWORD AssembleMovn32(DWORD rd, DWORD imm, DWORD shift) { return Assemble(0, 0, rd, imm, shift); }
static DWORD AssembleMovn64(DWORD rd, DWORD imm, DWORD shift) { return Assemble(1, 0, rd, imm, shift); }
static DWORD AssembleMovz32(DWORD rd, DWORD imm, DWORD shift) { return Assemble(0, 2, rd, imm, shift); }
static DWORD AssembleMovz64(DWORD rd, DWORD imm, DWORD shift) { return Assemble(1, 2, rd, imm, shift); }
static DWORD AssembleMovk32(DWORD rd, DWORD imm, DWORD shift) { return Assemble(0, 3, rd, imm, shift); }
static DWORD AssembleMovk64(DWORD rd, DWORD imm, DWORD shift) { return Assemble(1, 3, rd, imm, shift); }
};
union Tbz14
{
DWORD Assembled;
struct
{
DWORD Rt : 5; // Register to test
DWORD Imm14 : 14; // 14-bit immediate
DWORD Bit : 5; // 5-bit index
DWORD Nz : 1; // 0 = TBZ, 1 = TBNZ
DWORD Opcode1 : 6; // Must be 011011 == 0x1b
DWORD Size : 1; // 0 = 32-bit, 1 = 64-bit
} s;
inline LONG Imm() const { return (LONG)(s.Imm14 << 18) >> 16; }
static DWORD Assemble(DWORD size, DWORD nz, DWORD rt, DWORD bit, LONG delta)
{
Tbz14 temp;
temp.s.Rt = rt;
temp.s.Imm14 = delta >> 2;
temp.s.Bit = bit;
temp.s.Nz = nz;
temp.s.Opcode1 = 0x1b;
temp.s.Size = size;
return temp.Assembled;
}
};
protected:
BYTE PureCopy32(BYTE* pSource, BYTE* pDest);
BYTE EmitMovImmediate(PULONG& pDstInst, BYTE rd, UINT64 immediate);
BYTE CopyAdr(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyBcc(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyB(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyBl(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyB_or_Bl(BYTE* pSource, BYTE* pDest, ULONG instruction, bool link);
BYTE CopyCbz(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyTbz(BYTE* pSource, BYTE* pDest, ULONG instruction);
BYTE CopyLdrLiteral(BYTE* pSource, BYTE* pDest, ULONG instruction);
protected:
ULONG GetInstruction(BYTE* pSource)
{
return ((PULONG)pSource)[0];
}
BYTE EmitInstruction(PULONG& pDstInst, ULONG instruction)
{
*pDstInst++ = instruction;
return sizeof(ULONG);
}
protected:
PBYTE m_pbTarget;
BYTE m_rbScratchDst[128]; // matches or exceeds rbCode
};
BYTE CDetourDis::PureCopy32(BYTE* pSource, BYTE* pDest)
{
*(ULONG *)pDest = *(ULONG*)pSource;
return sizeof(DWORD);
}
/////////////////////////////////////////////////////////// Disassembler Code.
//
CDetourDis::CDetourDis()
{
m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_NONE;
}
PBYTE CDetourDis::CopyInstruction(PBYTE pDst,
PBYTE pSrc,
PBYTE *ppTarget,
LONG *plExtra)
{
if (pDst == NULL) {
pDst = m_rbScratchDst;
}
DWORD Instruction = GetInstruction(pSrc);
ULONG CopiedSize;
if ((Instruction & 0x1f000000) == 0x10000000) {
CopiedSize = CopyAdr(pSrc, pDst, Instruction);
} else if ((Instruction & 0xff000010) == 0x54000000) {
CopiedSize = CopyBcc(pSrc, pDst, Instruction);
} else if ((Instruction & 0x7c000000) == 0x14000000) {
CopiedSize = CopyB_or_Bl(pSrc, pDst, Instruction, (Instruction & 0x80000000) != 0);
} else if ((Instruction & 0x7e000000) == 0x34000000) {
CopiedSize = CopyCbz(pSrc, pDst, Instruction);
} else if ((Instruction & 0x7e000000) == 0x36000000) {
CopiedSize = CopyTbz(pSrc, pDst, Instruction);
} else if ((Instruction & 0x3b000000) == 0x18000000) {
CopiedSize = CopyLdrLiteral(pSrc, pDst, Instruction);
} else {
CopiedSize = PureCopy32(pSrc, pDst);
}
// If the target is needed, store our target
if (ppTarget) {
*ppTarget = m_pbTarget;
}
if (plExtra) {
*plExtra = CopiedSize - sizeof(DWORD);
}
return pSrc + 4;
}
BYTE CDetourDis::EmitMovImmediate(PULONG& pDstInst, BYTE rd, UINT64 immediate)
{
DWORD piece[4];
piece[3] = (DWORD)((immediate >> 48) & 0xffff);
piece[2] = (DWORD)((immediate >> 32) & 0xffff);
piece[1] = (DWORD)((immediate >> 16) & 0xffff);
piece[0] = (DWORD)((immediate >> 0) & 0xffff);
int count = 0;
// special case: MOVN with 32-bit dest
if (piece[3] == 0 && piece[2] == 0 && piece[1] == 0xffff)
{
EmitInstruction(pDstInst, Mov16::AssembleMovn32(rd, piece[0] ^ 0xffff, 0));
count++;
}
// MOVN/MOVZ with 64-bit dest
else
{
int zero_pieces = (piece[3] == 0x0000) + (piece[2] == 0x0000) + (piece[1] == 0x0000) + (piece[0] == 0x0000);
int ffff_pieces = (piece[3] == 0xffff) + (piece[2] == 0xffff) + (piece[1] == 0xffff) + (piece[0] == 0xffff);
DWORD defaultPiece = (ffff_pieces > zero_pieces) ? 0xffff : 0x0000;
bool first = true;
for (int pieceNum = 3; pieceNum >= 0; pieceNum--)
{
DWORD curPiece = piece[pieceNum];
if (curPiece != defaultPiece || (pieceNum == 0 && first))
{
count++;
if (first)
{
if (defaultPiece == 0xffff)
{
EmitInstruction(pDstInst, Mov16::AssembleMovn64(rd, curPiece ^ 0xffff, pieceNum));
}
else
{
EmitInstruction(pDstInst, Mov16::AssembleMovz64(rd, curPiece, pieceNum));
}
first = false;
}
else
{
EmitInstruction(pDstInst, Mov16::AssembleMovk64(rd, curPiece, pieceNum));
}
}
}
}
return (BYTE)(count * sizeof(DWORD));
}
BYTE CDetourDis::CopyAdr(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
Adr19& decoded = (Adr19&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
// ADR case
if (decoded.s.Type == 0)
{
BYTE* pTarget = pSource + decoded.Imm();
LONG64 delta = pTarget - pDest;
LONG64 deltaPage = ((ULONG_PTR)pTarget >> 12) - ((ULONG_PTR)pDest >> 12);
// output as ADR
if (delta >= -(1 << 20) && delta < (1 << 20))
{
EmitInstruction(pDstInst, Adr19::AssembleAdr(decoded.s.Rd, (LONG)delta));
}
// output as ADRP; ADD
else if (deltaPage >= -(1 << 20) && (deltaPage < (1 << 20)))
{
EmitInstruction(pDstInst, Adr19::AssembleAdrp(decoded.s.Rd, (LONG)deltaPage));
EmitInstruction(pDstInst, AddImm12::AssembleAdd32(decoded.s.Rd, decoded.s.Rd, ((ULONG)(ULONG_PTR)pTarget) & 0xfff, 0));
}
// output as immediate move
else
{
EmitMovImmediate(pDstInst, decoded.s.Rd, (ULONG_PTR)pTarget);
}
}
// ADRP case
else
{
BYTE* pTarget = (BYTE*)((((ULONG_PTR)pSource >> 12) + decoded.Imm()) << 12);
LONG64 deltaPage = ((ULONG_PTR)pTarget >> 12) - ((ULONG_PTR)pDest >> 12);
// output as ADRP
if (deltaPage >= -(1 << 20) && (deltaPage < (1 << 20)))
{
EmitInstruction(pDstInst, Adr19::AssembleAdrp(decoded.s.Rd, (LONG)deltaPage));
}
// output as immediate move
else
{
EmitMovImmediate(pDstInst, decoded.s.Rd, (ULONG_PTR)pTarget);
}
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
BYTE CDetourDis::CopyBcc(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
Bcc19& decoded = (Bcc19&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
BYTE* pTarget = pSource + decoded.Imm();
m_pbTarget = pTarget;
LONG64 delta = pTarget - pDest;
LONG64 delta4 = pTarget - (pDest + 4);
// output as BCC
if (delta >= -(1 << 20) && delta < (1 << 20))
{
EmitInstruction(pDstInst, Bcc19::AssembleBcc(decoded.s.Condition, (LONG)delta));
}
// output as BCC <skip>; B
else if (delta4 >= -(1 << 27) && (delta4 < (1 << 27)))
{
EmitInstruction(pDstInst, Bcc19::AssembleBcc(decoded.s.Condition ^ 1, 8));
EmitInstruction(pDstInst, Branch26::AssembleB((LONG)delta4));
}
// output as MOV x17, Target; BCC <skip>; BR x17 (BIG assumption that x17 isn't being used for anything!!)
else
{
EmitMovImmediate(pDstInst, 17, (ULONG_PTR)pTarget);
EmitInstruction(pDstInst, Bcc19::AssembleBcc(decoded.s.Condition ^ 1, 8));
EmitInstruction(pDstInst, Br::AssembleBr(17));
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
BYTE CDetourDis::CopyB_or_Bl(BYTE* pSource, BYTE* pDest, ULONG instruction, bool link)
{
Branch26& decoded = (Branch26&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
BYTE* pTarget = pSource + decoded.Imm();
m_pbTarget = pTarget;
LONG64 delta = pTarget - pDest;
// output as B or BRL
if (delta >= -(1 << 27) && (delta < (1 << 27)))
{
EmitInstruction(pDstInst, Branch26::Assemble(link, (LONG)delta));
}
// output as MOV x17, Target; BR or BRL x17 (BIG assumption that x17 isn't being used for anything!!)
else
{
EmitMovImmediate(pDstInst, 17, (ULONG_PTR)pTarget);
EmitInstruction(pDstInst, Br::Assemble(17, link));
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
BYTE CDetourDis::CopyB(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
return CopyB_or_Bl(pSource, pDest, instruction, false);
}
BYTE CDetourDis::CopyBl(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
return CopyB_or_Bl(pSource, pDest, instruction, true);
}
BYTE CDetourDis::CopyCbz(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
Cbz19& decoded = (Cbz19&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
BYTE* pTarget = pSource + decoded.Imm();
m_pbTarget = pTarget;
LONG64 delta = pTarget - pDest;
LONG64 delta4 = pTarget - (pDest + 4);
// output as CBZ/NZ
if (delta >= -(1 << 20) && delta < (1 << 20))
{
EmitInstruction(pDstInst, Cbz19::Assemble(decoded.s.Size, decoded.s.Nz, decoded.s.Rt, (LONG)delta));
}
// output as CBNZ/Z <skip>; B
else if (delta4 >= -(1 << 27) && (delta4 < (1 << 27)))
{
EmitInstruction(pDstInst, Cbz19::Assemble(decoded.s.Size, decoded.s.Nz ^ 1, decoded.s.Rt, 8));
EmitInstruction(pDstInst, Branch26::AssembleB((LONG)delta4));
}
// output as MOV x17, Target; CBNZ/Z <skip>; BR x17 (BIG assumption that x17 isn't being used for anything!!)
else
{
EmitMovImmediate(pDstInst, 17, (ULONG_PTR)pTarget);
EmitInstruction(pDstInst, Cbz19::Assemble(decoded.s.Size, decoded.s.Nz ^ 1, decoded.s.Rt, 8));
EmitInstruction(pDstInst, Br::AssembleBr(17));
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
BYTE CDetourDis::CopyTbz(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
Tbz14& decoded = (Tbz14&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
BYTE* pTarget = pSource + decoded.Imm();
m_pbTarget = pTarget;
LONG64 delta = pTarget - pDest;
LONG64 delta4 = pTarget - (pDest + 4);
// output as TBZ/NZ
if (delta >= -(1 << 13) && delta < (1 << 13))
{
EmitInstruction(pDstInst, Tbz14::Assemble(decoded.s.Size, decoded.s.Nz, decoded.s.Rt, decoded.s.Bit, (LONG)delta));
}
// output as TBNZ/Z <skip>; B
else if (delta4 >= -(1 << 27) && (delta4 < (1 << 27)))
{
EmitInstruction(pDstInst, Tbz14::Assemble(decoded.s.Size, decoded.s.Nz ^ 1, decoded.s.Rt, decoded.s.Bit, 8));
EmitInstruction(pDstInst, Branch26::AssembleB((LONG)delta4));
}
// output as MOV x17, Target; TBNZ/Z <skip>; BR x17 (BIG assumption that x17 isn't being used for anything!!)
else
{
EmitMovImmediate(pDstInst, 17, (ULONG_PTR)pTarget);
EmitInstruction(pDstInst, Tbz14::Assemble(decoded.s.Size, decoded.s.Nz ^ 1, decoded.s.Rt, decoded.s.Bit, 8));
EmitInstruction(pDstInst, Br::AssembleBr(17));
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
BYTE CDetourDis::CopyLdrLiteral(BYTE* pSource, BYTE* pDest, ULONG instruction)
{
LdrLit19& decoded = (LdrLit19&)(instruction);
PULONG pDstInst = (PULONG)(pDest);
BYTE* pTarget = pSource + decoded.Imm();
LONG64 delta = pTarget - pDest;
// output as LDR
if (delta >= -(1 << 21) && delta < (1 << 21))
{
EmitInstruction(pDstInst, LdrLit19::Assemble(decoded.s.Size, decoded.s.FpNeon, decoded.s.Rt, (LONG)delta));
}
// output as move immediate
else if (decoded.s.FpNeon == 0)
{
UINT64 value = 0;
switch (decoded.s.Size)
{
case 0: value = *(ULONG*)pTarget; break;
case 1: value = *(UINT64*)pTarget; break;
case 2: value = *(LONG*)pTarget; break;
}
EmitMovImmediate(pDstInst, decoded.s.Rt, value);
}
// FP/NEON register: compute address in x17 and load from there (BIG assumption that x17 isn't being used for anything!!)
else
{
EmitMovImmediate(pDstInst, 17, (ULONG_PTR)pTarget);
EmitInstruction(pDstInst, LdrFpNeonImm9::Assemble(2 + decoded.s.Size, decoded.s.Rt, 17, 0));
}
return (BYTE)((BYTE*)pDstInst - pDest);
}
PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
_Inout_opt_ PVOID *ppDstPool,
_In_ PVOID pSrc,
_Out_opt_ PVOID *ppTarget,
_Out_opt_ LONG *plExtra)
{
UNREFERENCED_PARAMETER(ppDstPool);
CDetourDis state;
return (PVOID)state.CopyInstruction((PBYTE)pDst,
(PBYTE)pSrc,
(PBYTE*)ppTarget,
plExtra);
}
#endif // DETOURS_ARM64
BOOL WINAPI DetourSetCodeModule(_In_ HMODULE hModule,
_In_ BOOL fLimitReferencesToModule)
{
#if defined(DETOURS_X64) || defined(DETOURS_X86)
PBYTE pbBeg = NULL;
PBYTE pbEnd = (PBYTE)~(ULONG_PTR)0;
if (hModule != NULL) {
ULONG cbModule = DetourGetModuleSize(hModule);
pbBeg = (PBYTE)hModule;
pbEnd = (PBYTE)hModule + cbModule;
}
return CDetourDis::SetCodeModule(pbBeg, pbEnd, fLimitReferencesToModule);
#elif defined(DETOURS_ARM) || defined(DETOURS_ARM64) || defined(DETOURS_IA64)
(void)hModule;
(void)fLimitReferencesToModule;
return TRUE;
#else
#error unknown architecture (x86, x64, arm, arm64, ia64)
#endif
}
//
///////////////////////////////////////////////////////////////// End of File.
Reference in New Issue Copy Permalink