class Metasm::CY16

Public Class Methods

new(family = :latest) click to toggle source
Calls superclass method
# File metasm/cpu/cy16/main.rb, line 50
def initialize(family = :latest)
        super()
        @endianness = :little
        @size = 16
        @family = family
end

Public Instance Methods

addop(name, bin, *args) click to toggle source
# File metasm/cpu/cy16/opcodes.rb, line 11
def addop(name, bin, *args)
        o = Opcode.new name, bin
        args.each { |a|
                o.args << a if @fields_mask[a] or @valid_args[a]
                o.props[a] = true if @valid_props[a]
                o.fields[a] = @fields_shift[a] if @fields_mask[a]
                raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a]
        }
        @opcode_list << o
end
addop_macrocc(name, bin, *args) click to toggle source
# File metasm/cpu/cy16/opcodes.rb, line 22
def addop_macrocc(name, bin, *args)
        %w[z nz b ae s ns o no a be g ge l le].each_with_index { |cc, i|
                dbin = bin
                dbin |= i << 8
                addop name + cc, dbin, *args
        }
end
backtrace_binding() click to toggle source

hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }

# File metasm/cpu/cy16/decode.rb, line 111
def backtrace_binding
        @backtrace_binding ||= init_backtrace_binding
end
backtrace_binding=(b) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 114
def backtrace_binding=(b) @backtrace_binding = b end
backtrace_is_function_return(expr, di=nil) click to toggle source

checks if expr is a valid return expression matching the :saveip instruction

# File metasm/cpu/cy16/decode.rb, line 201
def backtrace_is_function_return(expr, di=nil)
        expr = Expression[expr].reduce_rec
        expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp]
end
backtrace_is_stack_address(expr) click to toggle source

returns true if the expression is an address on the stack

# File metasm/cpu/cy16/decode.rb, line 236
def backtrace_is_stack_address(expr)
        Expression[expr].expr_externals.include?(:sp)
end
backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) click to toggle source

updates the function #backtrace_binding if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand)

# File metasm/cpu/cy16/decode.rb, line 208
def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
        b = f.backtrace_binding

        bt_val = lambda { |r|
                next if not retaddrlist
                b[r] = Expression::Unknown
                bt = []
                retaddrlist.each { |retaddr|
                        bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true,
                                     :snapshot_addr => faddr, :origin => retaddr)
                }
                if bt.length != 1
                        b[r] = Expression::Unknown
                else
                        b[r] = bt.first
                end
        }

        if not wantregs.empty?
                wantregs.each(&bt_val)
        else
                bt_val[:sp]
        end

        b
end
build_bin_lookaside() click to toggle source
# File metasm/cpu/cy16/decode.rb, line 21
def build_bin_lookaside
        # sets up a hash byte value => list of opcodes that may match
        # opcode.bin_mask is built here
        lookaside = Array.new(256) { [] }
        opcode_list.each { |op|
                build_opcode_bin_mask op
                b   = (op.bin >> 8) & 0xff
                msk = (op.bin_mask >> 8) & 0xff
                for i in b..(b | (255^msk))
                        lookaside[i] << op if i & msk == b & msk
                end
        }
        lookaside
end
build_opcode_bin_mask(op) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 12
def build_opcode_bin_mask(op)
        # bit = 0 if can be mutated by an field value, 1 if fixed by opcode
        op.bin_mask = 0
        op.fields.each { |f, off|
                op.bin_mask |= (@fields_mask[f] << off)
        }
        op.bin_mask ^= 0xffff
end
decode_findopcode(edata) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 36
def decode_findopcode(edata)
        di = DecodedInstruction.new self
        return if edata.ptr+2 > edata.length
        bin = edata.decode_imm(:u16, @endianness)
        edata.ptr -= 2
        return di if di.opcode = @bin_lookaside[(bin >> 8) & 0xff].find { |op|
                bin & op.bin_mask == op.bin & op.bin_mask
        }
end
decode_instr_interpret(di, addr) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 100
def decode_instr_interpret(di, addr)
        if di.opcode.props[:setip] and di.opcode.args.last == :o7
                delta = di.instruction.args.last.reduce
                arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
                di.instruction.args[-1] = Expression[arg]
        end

        di
end
decode_instr_op(edata, di) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 70
def decode_instr_op(edata, di)
        before_ptr = edata.ptr
        op = di.opcode
        di.instruction.opname = op.name
        bin = edata.decode_imm(:u16, @endianness)

        field_val = lambda { |f|
                if off = op.fields[f]
                        (bin >> off) & @fields_mask[f]
                end
        }

        op.args.each { |a|
                di.instruction.args << case a
                when :rs, :rd; decode_instr_op_r(field_val[a], edata)
                when :o7; Expression[2*Expression.make_signed(field_val[a], 7)]
                when :x7; Expression[field_val[a]]
                when :u3; Expression[field_val[a]+1]
                else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
                end
        }

        di.instruction.args.reverse!

        di.bin_length += edata.ptr - before_ptr

        di
rescue InvalidRD
end
decode_instr_op_r(val, edata) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 47
def decode_instr_op_r(val, edata)
        bw = ((val & 0b1000) > 0 ? 1 : 2)
        case val & 0b11_0000
        when 0b00_0000
                Reg.new(val)
        when 0b01_0000
                if val == 0b01_1111
                        Expression[edata.decode_imm(:u16, @endianness)]
                else
                        Memref.new(Reg.new(8+(val&7)), nil, bw)
                end
        when 0b10_0000
                if val & 7 == 7
                        Memref.new(nil, edata.decode_imm(:u16, @endianness), bw)
                else
                        Memref.new(Reg.new(8+(val&7)), nil, bw, true)
                end
        when 0b11_0000
                Memref.new(Reg.new(8+(val&7)), edata.decode_imm(:u16, @endianness), bw)
        end

end
fix_fwdemu_binding(di, fbd) click to toggle source

patch a forward binding from the backtrace binding

# File metasm/cpu/cy16/decode.rb, line 178
def fix_fwdemu_binding(di, fbd)
        case di.opcode.name
        when 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2])
        end
        fbd
end
get_backtrace_binding(di) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 154
def get_backtrace_binding(di)
        a = di.instruction.args.map { |arg|
                case arg
                when Memref, Reg; arg.symbolic(di)
                else arg
                end
        }

        if binding = backtrace_binding[di.opcode.basename]
                bd = {}
                di.instruction.args.each { |aa| bd[aa.base.symbolic] = Expression[aa.base.symbolic, :+, aa.sz] if aa.kind_of?(Memref) and aa.autoincr }
                bd.update binding[di, *a]
        else
                puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
                # assume nothing except the 1st arg is modified
                case a[0]
                when Indirection, Symbol; { a[0] => Expression::Unknown }
                when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {}
                else {}
                end.update(:incomplete_binding => Expression[1])
        end
end
get_xrefs_x(dasm, di) click to toggle source
# File metasm/cpu/cy16/decode.rb, line 185
def get_xrefs_x(dasm, di)
        return [] if not di.opcode.props[:setip]

        return [Indirection[:sp, 2, di.address]] if di.opcode.name =~ /^r/

        case tg = di.instruction.args.first
        when Memref; [Expression[tg.symbolic(di)]]
        when Reg; [Expression[tg.symbolic(di)]]
        when Expression, ::Integer; [Expression[tg]]
        else
                puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG
                []
        end
end
init_backtrace_binding() click to toggle source

populate the @backtrace_binding hash with default values

# File metasm/cpu/cy16/decode.rb, line 117
def init_backtrace_binding
        @backtrace_binding ||= {}

        mask = 0xffff

        opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
                binding = case op
                when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
                when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or', 'addi', 'subi'
                        lambda { |di, a0, a1|
                                e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&,
                                         'xor' => :^, 'or' => :|, 'addi' => :+, 'subi' => :- }[op]
                                ret = Expression[a0, e_op, a1]
                                ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbb'
                                # optimises eax ^ eax => 0
                                # avoid hiding memory accesses (to not hide possible fault)
                                ret = Expression[ret.reduce] if not a0.kind_of? Indirection
                                { a0 => ret }
                        }
                when 'cmp', 'test'; lambda { |di, *a| {} }
                when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } }
                when 'call'
                        lambda { |di, a0| { :sp => Expression[:sp, :-, 2],
                                  Indirection[:sp, 2, di.address] => Expression[di.next_addr] }
                        }
                when 'ret'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } }
                # TODO callCC, retCC ...
                when /^j/; lambda { |di, *a| {} }
                end

                # TODO flags ?

                @backtrace_binding[op] ||= binding if binding
        }
        @backtrace_binding
end
init_cy16() click to toggle source
# File metasm/cpu/cy16/opcodes.rb, line 30
def init_cy16
        @opcode_list = []
        @valid_args.update [:rs, :rd, :o7
        ].inject({}) { |h, v| h.update v => true }
        @fields_mask.update :rs => 0x3f, :rd => 0x3f, :o7 => 0x7f, :x7 => 0x7f, :u3 => 7
        @fields_shift.update :rs => 6, :rd => 0, :o7 => 0, :x7 => 0, :u3 => 6

        addop 'mov', 0<<12, :rs, :rd
        addop 'add', 1<<12, :rs, :rd
        addop 'adc', 2<<12, :rs, :rd
        addop 'addc',2<<12, :rs, :rd
        addop 'sub', 3<<12, :rs, :rd
        addop 'sbb', 4<<12, :rs, :rd
        addop 'subb',4<<12, :rs, :rd
        addop 'cmp', 5<<12, :rs, :rd
        addop 'and', 6<<12, :rs, :rd
        addop 'test',7<<12, :rs, :rd
        addop 'or',  8<<12, :rs, :rd
        addop 'xor', 9<<12, :rs, :rd

        addop_macrocc 'int', (10<<12), :x7
        addop 'int', (10<<12) | (15<<8), :x7
        addop_macrocc 'c', (10<<12) | (1<<7), :setip, :saveip, :rd
        addop 'call',(10<<12) | (15<<8) | (1<<7), :setip, :stopexec, :saveip, :rd
        addop_macrocc 'r', (12<<12) | (1<<7) | 0b010111, :setip       # must come before absolute jmp
        addop 'ret', (12<<12) | (15<<8) | (1<<7) | 0b010111, :setip, :stopexec
        addop_macrocc 'j', (12<<12), :setip, :o7      # relative
        addop 'jmp', (12<<12) | (15<<8), :setip, :stopexec, :o7       # relative
        addop_macrocc 'j', (12<<12) | (1<<7), :setip, :rd     # absolute
        addop 'jmp', (12<<12) | (15<<8) | (1<<7), :setip, :stopexec, :rd      # absolute

        addop 'shr', (13<<12) | (0<<9), :u3, :rd
        addop 'shl', (13<<12) | (1<<9), :u3, :rd
        addop 'ror', (13<<12) | (2<<9), :u3, :rd
        addop 'rol', (13<<12) | (3<<9), :u3, :rd
        addop 'addi',(13<<12) | (4<<9), :u3, :rd
        addop 'subi',(13<<12) | (5<<9), :u3, :rd
        addop 'not', (13<<12) | (7<<9) | (0<<6), :rd
        addop 'neg', (13<<12) | (7<<9) | (1<<6), :rd
        addop 'cbw', (13<<12) | (7<<9) | (4<<6), :rd
        addop 'sti', (13<<12) | (7<<9) | (7<<6) | 0
        addop 'cli', (13<<12) | (7<<9) | (7<<6) | 1
        addop 'stc', (13<<12) | (7<<9) | (7<<6) | 2
        addop 'clc', (13<<12) | (7<<9) | (7<<6) | 3
end
Also aliased as: init_latest
init_latest()
Alias for: init_cy16
init_opcode_list() click to toggle source
# File metasm/cpu/cy16/main.rb, line 57
def init_opcode_list
        send("init_#@family")
        @opcode_list
end
render_instruction(i) click to toggle source
# File metasm/cpu/cy16/render.rb, line 30
def render_instruction(i)
        r = []
        r << i.opname
        if not i.args.empty?
                r << ' '
                i.args.each { |a_| r << a_ << ', ' }
                r.pop
        end
        r
end
replace_instr_arg_immediate(i, old, new) click to toggle source

updates an instruction's argument replacing an expression with another (eg label renamed)

# File metasm/cpu/cy16/decode.rb, line 241
def replace_instr_arg_immediate(i, old, new)
        i.args.map! { |a|
                case a
                when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
                when Memref
                        a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset
                        a
                else a
                end
        }
end