Skip to content

Commit bead3c1

Browse files
psrok1psrok1
committed
Code refactored
1 parent f22e47a commit bead3c1

18 files changed

+213
-231
lines changed

‎ANDN.c

+8-16
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
11
#include "Driver.h"
22
#include "Parser.h"
33

4-
inline int isANDN(char* instruction) {
5-
UNREFERENCED_PARAMETER(instruction); // <-- LINE TO REMOVE DURING IMPLEMENTATION
6-
return FALSE;
7-
}
8-
9-
int __stdcall ANDNInstructionHandler(
10-
char** instruction, // bytes of instruction
11-
CALLER_CONTEXT* context) // caller context
4+
int __stdcall ANDNInstructionEmulator(
5+
ParsedInstruction instruction,
6+
CALLER_CONTEXT* context)
127
{
13-
UNREFERENCED_PARAMETER(context); // <-- LINE TO REMOVE DURING IMPLEMENTATION
14-
if (isANDN(*instruction)) {
15-
// Parse and emulate
16-
return TRUE;
17-
}
18-
else
19-
return FALSE; // not supported -> not handled
20-
}
8+
UNREFERENCED_PARAMETER(instruction);
9+
UNREFERENCED_PARAMETER(context);
10+
11+
return TRUE;
12+
}

‎BEXTR.c

+8-16
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
11
#include "Driver.h"
22
#include "Parser.h"
33

4-
inline int isBEXTR(char* instruction) {
5-
UNREFERENCED_PARAMETER(instruction); // <-- LINE TO REMOVE DURING IMPLEMENTATION
6-
return FALSE;
7-
}
8-
9-
int __stdcall BEXTRInstructionHandler(
10-
char** instruction, // bytes of instruction
11-
CALLER_CONTEXT* context) // caller context
4+
int __stdcall BEXTRInstructionEmulator(
5+
ParsedInstruction instruction,
6+
CALLER_CONTEXT* context)
127
{
13-
UNREFERENCED_PARAMETER(context); // <-- LINE TO REMOVE DURING IMPLEMENTATION
14-
if (isBEXTR(*instruction)) {
15-
// Parse and emulate
16-
return TRUE;
17-
}
18-
else
19-
return FALSE; // not supported -> not handled
20-
}
8+
UNREFERENCED_PARAMETER(instruction);
9+
UNREFERENCED_PARAMETER(context);
10+
11+
return TRUE;
12+
}

‎BLSI.c

+8-16
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
11
#include "Driver.h"
22
#include "Parser.h"
33

4-
inline int isBLSI(char* instruction) {
5-
UNREFERENCED_PARAMETER(instruction); // <-- LINE TO REMOVE DURING IMPLEMENTATION
6-
return FALSE;
7-
}
8-
9-
int __stdcall BLSIInstructionHandler(
10-
char** instruction, // bytes of instruction
11-
CALLER_CONTEXT* context) // caller context
4+
int __stdcall BLSIInstructionEmulator(
5+
ParsedInstruction instruction,
6+
CALLER_CONTEXT* context)
127
{
13-
UNREFERENCED_PARAMETER(context); // <-- LINE TO REMOVE DURING IMPLEMENTATION
14-
if (isBLSI(*instruction)) {
15-
// Parse and emulate
16-
return TRUE;
17-
}
18-
else
19-
return FALSE; // not supported -> not handled
20-
}
8+
UNREFERENCED_PARAMETER(instruction);
9+
UNREFERENCED_PARAMETER(context);
10+
11+
return TRUE;
12+
}

‎BLSMSK.c

+8-16
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
11
#include "Driver.h"
22
#include "Parser.h"
33

4-
inline int isBLSMSK(char* instruction) {
5-
UNREFERENCED_PARAMETER(instruction); // <-- LINE TO REMOVE DURING IMPLEMENTATION
6-
return FALSE;
7-
}
8-
9-
int __stdcall BLSMSKInstructionHandler(
10-
char** instruction, // bytes of instruction
11-
CALLER_CONTEXT* context) // caller context
4+
int __stdcall BLSMSKInstructionEmulator(
5+
ParsedInstruction instruction,
6+
CALLER_CONTEXT* context)
127
{
13-
UNREFERENCED_PARAMETER(context); // <-- LINE TO REMOVE DURING IMPLEMENTATION
14-
if (isBLSMSK(*instruction)) {
15-
// Parse and emulate
16-
return TRUE;
17-
}
18-
else
19-
return FALSE; // not supported -> not handled
20-
}
8+
UNREFERENCED_PARAMETER(instruction);
9+
UNREFERENCED_PARAMETER(context);
10+
11+
return TRUE;
12+
}

‎BLSR.c

+8-16
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,12 @@
11
#include "Driver.h"
22
#include "Parser.h"
33

4-
inline int isBLSR(char* instruction) {
5-
UNREFERENCED_PARAMETER(instruction); // <-- LINE TO REMOVE DURING IMPLEMENTATION
6-
return FALSE;
7-
}
8-
9-
int __stdcall BLSRInstructionHandler(
10-
char** instruction, // bytes of instruction
11-
CALLER_CONTEXT* context) // caller context
4+
int __stdcall BLSRInstructionEmulator(
5+
ParsedInstruction instruction,
6+
CALLER_CONTEXT* context)
127
{
13-
UNREFERENCED_PARAMETER(context); // <-- LINE TO REMOVE DURING IMPLEMENTATION
14-
if (isBLSR(*instruction)) {
15-
// Parse and emulate
16-
return TRUE;
17-
}
18-
else
19-
return FALSE; // not supported -> not handled
20-
}
8+
UNREFERENCED_PARAMETER(instruction);
9+
UNREFERENCED_PARAMETER(context);
10+
11+
return TRUE;
12+
}

‎Consts.h

+10-8
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,13 @@
4040

4141
// Instruction descriptors
4242

43-
#define INSTR_ANDN 0x00000000
44-
#define INSTR_BEXTR 0x10000000
45-
#define INSTR_BLSI 0x20000000
46-
#define INSTR_BLSMSK 0x30000000
47-
#define INSTR_BLSR 0x40000000
48-
#define INSTR_LZCNT 0x50000000
49-
#define INSTR_POPCNT 0x60000000
50-
#define INSTR_TZCNT 0x70000000
43+
#define INSTR_ANDN 0x00000000
44+
#define INSTR_BEXTR 0x10000000
45+
#define INSTR_BLSI 0x20000000
46+
#define INSTR_BLSMSK 0x30000000
47+
#define INSTR_BLSR 0x40000000
48+
#define INSTR_LZCNT 0x50000000
49+
#define INSTR_POPCNT 0x60000000
50+
#define INSTR_TZCNT 0x70000000
51+
#define INSTR_DEBUG 0xFFFFFFFE
52+
#define INSTR_UNKNOWN 0xFFFFFFFF

‎Driver.c

+5-13
Original file line numberDiff line numberDiff line change
@@ -44,35 +44,27 @@ __declspec(naked) HookRoutine() {
4444
pushfd;
4545
pushad;
4646

47-
// Get address to interrupt handlers chain
48-
mov esi, offset handlers_chain;
49-
handlerLookup:
50-
// Load address of interrupt handler
51-
mov edi, [esi];
52-
lea esi, [esi + 4];
53-
// If NULL - end of chain, go to system handler
54-
test edi, edi;
55-
jz unhandledExc;
56-
5747
// Get fault address
5848
lea eax, [esp + 0x24];
5949
// Push pointer to stored context
6050
push esp;
6151
// Push fault address
6252
push eax;
6353
// Call handler
64-
call edi;
65-
54+
mov esi, offset HandleUndefInstruction;
55+
call esi;
56+
6657
// If handler refuses to handle exception: try next
6758
test eax, eax;
68-
jz handlerLookup;
59+
jz unhandledExc;
6960

7061
// If exception is handled:
7162
// Restore context and return from interrupt
7263
popad;
7364
popfd;
7465
iretd;
7566
unhandledExc:
67+
// If exception isn't handled:
7668
// Jumping to system handler
7769
popad
7870
popfd

‎Driver.h

+2-5
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,8 @@ extern void setRegValue(
5151
unsigned int value,
5252
CALLER_CONTEXT* context);
5353

54-
/***** Handlers.c *****/
54+
/*** Handlers.c ***/
5555

56-
typedef int(__stdcall *InstructionHandler)(char**, CALLER_CONTEXT*);
57-
#define EMULATOR_ROUTINE(name) int __stdcall name (char** instruction, CALLER_CONTEXT* context)
58-
59-
extern InstructionHandler handlers_chain[];
56+
extern int __stdcall HandleUndefInstruction(char** instruction, CALLER_CONTEXT* context);
6057

6158
#pragma pack(pop)

‎Emulators.h

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#pragma once
2+
3+
#include "Driver.h"
4+
#include "Parser.h"
5+
6+
typedef int(__stdcall *EmulatorRoutine)(ParsedInstruction, CALLER_CONTEXT*);
7+
8+
#define EMULATOR_ROUTINE_PTR(name) name##InstructionEmulator
9+
#define EMULATOR_ROUTINE(name) int __stdcall name##InstructionEmulator (ParsedInstruction instruction, CALLER_CONTEXT* context);
10+
11+
extern EMULATOR_ROUTINE(ANDN);
12+
extern EMULATOR_ROUTINE(BEXTR);
13+
extern EMULATOR_ROUTINE(BLSI);
14+
extern EMULATOR_ROUTINE(BLSMSK);
15+
extern EMULATOR_ROUTINE(BLSR);
16+
extern EMULATOR_ROUTINE(LZCNT);
17+
extern EMULATOR_ROUTINE(POPCNT);
18+
extern EMULATOR_ROUTINE(TZCNT);
19+
// @DEBUG
20+
extern EMULATOR_ROUTINE(Example);

‎Example.c

+20-27
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,24 @@
33

44
/* Example! */
55

6-
// Checking if opcode is associated with handled instruction
7-
inline int isUD2(char* instruction) {
8-
return instruction[0] == 0x0F && instruction[1] == 0x0B;
9-
}
10-
11-
int __stdcall UD2InstructionHandler(
12-
char** instruction, // bytes of instruction
13-
CALLER_CONTEXT* context) // caller context
6+
int __stdcall ExampleInstructionEmulator(
7+
ParsedInstruction instruction, // parsed instruction data
8+
CALLER_CONTEXT* context) // caller context
149
{
15-
if (isUD2(*instruction)) {
16-
// Setting GPR registers!
17-
// Using getters
18-
setRegValue(REG_ECX, 0xFACEFEED, context);
19-
setRegValue(REG_EDX, 0x00000000, context);
20-
// ... or in structure
21-
context->ecx = 0xFACEFEED;
22-
context->edx = 0x00000000;
23-
context->flags |= FLAG_ZF;
24-
// Other registers (SSE), memory etc. need to be set directly!
25-
__asm movhlps xmm5, xmm4;
26-
// Move EIP two bytes forward! [instruction length]
27-
(*instruction) += 2;
28-
// Handled!
29-
return TRUE;
30-
}
31-
else
32-
return FALSE; // not UD2 -> not handled
33-
}
10+
// Setting GPR registers!
11+
// Using setters
12+
setRegValue(REG_ECX, 0xFACEFEED, context);
13+
setRegValue(REG_EDX, 0x00000000, context);
14+
// .. or directly in structure
15+
context->ecx = 0xFACEFEED;
16+
context->edx = 0x00000000;
17+
context->flags |= FLAG_ZF;
18+
// Other registers (SSE), memory etc. need to be set directly!
19+
__asm movhlps xmm5, xmm4;
20+
// Memory? Use getEffectiveVA to get address from mem structure
21+
// But check earlier, whether you deal with 32b or 16b pointer!
22+
if(instruction.src1 == MEM_32)
23+
*((UINT32*)getEffectiveVA(instruction.mem, context)) = 0x00000000;
24+
// Success: handled!
25+
return TRUE;
26+
}

0 commit comments

Comments
 (0)