From ed42580b4e73b8ffc1ed695fe6517e89b14f5ca3 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Mon, 27 Jun 2016 14:51:47 +0200 Subject: [PATCH] Fix some x64 encoding of [NEW_REG] | pop/push [RAX] doest not contains a useless prefix anymore --- windows/native_exec/simple_x64.py | 9 ++++++--- windows/native_exec/test_simple_x64.py | 11 +++++++++++ 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/windows/native_exec/simple_x64.py b/windows/native_exec/simple_x64.py index 1cbd0c9..7129dbd 100644 --- a/windows/native_exec/simple_x64.py +++ b/windows/native_exec/simple_x64.py @@ -252,7 +252,9 @@ class X64RegisterSelector(object): def accept_arg(self, args, instr_state): x = args[0] try: - return (1, self.reg_opcode[x.upper()], BitArray(8, [0, 1, 0, 0 ,1 , 0, 0, 0])) + if getattr(instr_state.type, "default_32_bits", False): + return (1, self.reg_opcode[x.upper()], BitArray(8, [0, 1, 0, 0 ,1 , 0, 0, 0])) + return (1, self.reg_opcode[x.upper()], BitArray(8, [0, 1, 0, 0 ,0 , 0, 0, 0])) except (KeyError, AttributeError): pass try: @@ -603,6 +605,7 @@ class ModRM_REG64__MEM(SubModRM): # Those registers cannot be addressed without SIB FIRE_UP_SIB = not arg2.base or arg2.base.upper() in ["RSP", "RBP"] or arg2.index + FIRE_UP_SIB = FIRE_UP_SIB or X64.is_new_reg(arg2.base) if not FIRE_UP_SIB: self.setup_reg_as_register(arg1) @@ -695,7 +698,7 @@ class Slash(object): return arg_consum, value, rex return arg_consum - 1, value, rex -instr_state = collections.namedtuple('instr_state', ['previous', 'prefixes']) +instr_state = collections.namedtuple('instr_state', ['previous', 'prefixes', 'type']) class Instruction(object): @@ -711,7 +714,7 @@ class Instruction(object): #if hasattr(self, "default_32_bits") and self.default_32_bits: # full_rex = BitArray.from_int(8, 0x48) for element in type_encoding: - arg_consum, value, rex = element.accept_arg(args, instr_state(res, prefix)) + arg_consum, value, rex = element.accept_arg(args, instr_state(res, prefix, type(self))) if arg_consum is None: break res.append(value) diff --git a/windows/native_exec/test_simple_x64.py b/windows/native_exec/test_simple_x64.py index 6743288..087ce80 100644 --- a/windows/native_exec/test_simple_x64.py +++ b/windows/native_exec/test_simple_x64.py @@ -140,6 +140,11 @@ TestInstr(Mov)(mem('gs:[0x1122334455667788]'), 'RAX') TestInstr(Mov)(mem('[RAX]'), 0x11223344) TestInstr(Mov)(mem('[EAX]'), 0x11223344) TestInstr(Mov)(mem('[RBX]'), 0x11223344) +TestInstr(Mov)("R12", mem("[RAX]")) +TestInstr(Mov)("RAX", mem("[R12]")) +TestInstr(Mov)("RAX", mem("[RAX + R12]")) +TestInstr(Mov)("RAX", mem("[R12 + R12]")) +#TestInstr(Mov)("RSI", mem("[R12]")) TestInstr(And)('RCX', 'RBX') TestInstr(And)('RAX', 0x11223344) @@ -173,6 +178,8 @@ TestInstr(Test)(mem('[RDI + 0x100]'), 'RCX') assert Test(mem('[RDI + 0x100]'), 'RCX').get_code() == Test('RCX', mem('[RDI + 0x100]')).get_code() +TestInstr(Push)('RAX') +assert len(Push("RAX").get_code()) == 1 TestInstr(Push)('R15') TestInstr(Push)(0x42) TestInstr(Push)(-1) @@ -180,6 +187,10 @@ TestInstr(Push)(mem("[ECX]")) TestInstr(Push)(mem("[RCX]")) +TestInstr(Pop)('RAX') +assert len(Pop("RAX").get_code()) == 1 + + TestInstr(Call)('RAX') TestInstr(Call)(mem('[RAX + RCX * 8]')) TestInstr(Cpuid)()