Add Int X86/64 instruction

tests/test_simple_x64.py

@@ -190,6 +190,11 @@ def test_assembler():
     CheckInstr(Shl)('RAX', 8)
     CheckInstr(Shl)('R15', 0x12)
 
+    CheckInstr(Int3)()
+    CheckInstr(Int)(0)
+    CheckInstr(Int)(3)
+    CheckInstr(Int)(0xff)
+
     # I really don't know why it's the inverse
     # But I don't care, it's Test dude..
     CheckInstr(x64.Test, expected_result="test r11, rax")('RAX', 'R11')
@@ -220,6 +225,7 @@ def test_assembler():
     CheckInstr(Xchg)('RAX', 'RSP')
     assert Xchg('RAX', 'RCX').get_code() == Xchg('RCX', 'RAX').get_code()
 
+
     # 32 / 64 bits register mixing
     CheckInstr(Mov)('ECX', 'EBX')
     CheckInstr(Mov)('RCX', mem('[EBX]'))

tests/test_simple_x86.py

@@ -174,6 +174,11 @@ def test_assembler():
     CheckInstr(Not)('EAX')
     CheckInstr(Not)(mem('[EAX]'))
 
+    CheckInstr(Int3)()
+    CheckInstr(Int)(0)
+    CheckInstr(Int)(3)
+    CheckInstr(Int)(0xff)
+
     CheckInstr(ScasB, expected_result="scasb al, byte ptr es:[edi]")()
     CheckInstr(ScasW, expected_result="scasw ax, word ptr es:[edi]")()
     CheckInstr(ScasD, expected_result="scasd eax, dword ptr es:[edi]")()

windows/native_exec/simple_x64.py

@@ -305,6 +305,13 @@ def accept_as_8immediat(x):
         raise ImmediatOverflow("8bits signed Immediat overflow")
 
 
+def accept_as_unsigned_8immediat(x):
+    try:
+        return struct.pack("<B", x)
+    except struct.error:
+        raise ImmediatOverflow("8bits signed Immediat overflow")
+
+
 def accept_as_16immediat(x):
     try:
         return struct.pack("<h", x)
@@ -355,6 +362,17 @@ class Imm8(object):
             return None, None, None
         return (1, BitArray.from_string(imm8), None)
 
+class UImm8(object):
+    def accept_arg(self, args, instr_state):
+        try:
+            x = int(args[0])
+        except (ValueError, TypeError):
+            return (None, None)
+        try:
+            imm8 = accept_as_unsigned_8immediat(x)
+        except ImmediatOverflow:
+            return None, None
+        return (1, BitArray.from_string(imm8), None)
 
 class Imm16(object):
     def accept_arg(self, args, instr_state):
@@ -798,6 +816,9 @@ class Ret(Instruction):
     encoding = [(RawBits.from_int(8, 0xc3),)]
 
 
+class Int(Instruction):
+    encoding = [(RawBits.from_int(8, 0xcd), UImm8())]
+
 class Int3(Instruction):
     encoding = [(RawBits.from_int(8, 0xcc),)]
 

windows/native_exec/simple_x86.py

@@ -268,6 +268,13 @@ def accept_as_8immediat(x):
         raise ImmediatOverflow("8bits signed Immediat overflow")
 
 
+def accept_as_unsigned_8immediat(x):
+    try:
+        return struct.pack("<B", x)
+    except struct.error:
+        raise ImmediatOverflow("8bits signed Immediat overflow")
+
+
 def accept_as_16immediat(x):
     try:
         return struct.pack("<h", x)
@@ -304,6 +311,18 @@ class Imm8(object):
             return None, None
         return (1, BitArray.from_string(imm8))
 
+class UImm8(object):
+    def accept_arg(self, args, instr_state):
+        try:
+            x = int(args[0])
+        except (ValueError, TypeError):
+            return (None, None)
+        try:
+            imm8 = accept_as_unsigned_8immediat(x)
+        except ImmediatOverflow:
+            return None, None
+        return (1, BitArray.from_string(imm8))
+
 
 class Imm16(object):
     def accept_arg(self, args, instr_state):
@@ -813,6 +832,8 @@ class Not(Instruction):
 class Retf(Instruction):
     encoding = [(RawBits.from_int(8, 0xcb),)]
 
+class Int(Instruction):
+    encoding = [(RawBits.from_int(8, 0xcd), UImm8())]
 
 class Int3(Instruction):
     encoding = [(RawBits.from_int(8, 0xcc),)]

windows/winobject/system.py

@@ -211,7 +211,10 @@ class System(object):
 
     @utils.fixedpropety
     def build_number(self):
-        return self.get_file_version("ntdll")
+        # This returns the last version where ntdll was updated
+        # Should look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
+        # values:  CurrentBuild + UBR
+        return self.get_file_version("comctl32")
 
     @staticmethod
     def enumerate_processes():