1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
extern crate yaxpeax_arch;
extern crate yaxpeax_x86;
use std::fmt::Write;
use yaxpeax_arch::Decodable;
use yaxpeax_x86::{Instruction, Opcode, decode_one};
fn decode(bytes: &[u8]) -> Option<Instruction> {
let mut instr = Instruction::invalid();
match decode_one(bytes.iter().map(|x| *x).take(16).collect::<Vec<u8>>(), &mut instr) {
Some(()) => Some(instr),
None => None
}
}
fn test_display(data: &[u8], expected: &'static str) {
let mut hex = String::new();
for b in data {
write!(hex, "{:02x}", b);
}
match Instruction::decode(data.into_iter().map(|x| *x)) {
Some(instr) => {
let text = format!("{}", instr);
assert!(
text == expected,
"display error for {}:\n decoded: {:?}\n displayed: {}\n expected: {}\n",
hex,
instr,
text,
expected
);
},
None => {
assert!(false, "decode error for {}:\n expected: {}\n", hex, expected);
}
}
}
#[test]
fn test_arithmetic() {
test_display(&[0x81, 0xec, 0x10, 0x03, 0x00, 0x00], "sub esp, 0x310");
}
#[test]
fn test_E_decode() {
test_display(&[0xff, 0x75, 0xb8], "push [rbp - 0x48]");
test_display(&[0xff, 0x75, 0x08], "push [rbp + 0x8]");
}
// SETLE, SETNG, ...
#[test]
fn test_mov() {
// test_display(&[0xa1, 0x93, 0x62, 0xc4, 0x00, 0x12, 0x34, 0x12, 0x34], "mov eax, [0x3412341200c46293]");
// RCT.exe 32bit version, TODO: FIX
test_display(&[0xa1, 0x93, 0x62, 0xc4, 0x00], "mov eax, [0xc46293]");
test_display(&[0x48, 0xc7, 0x04, 0x24, 0x00, 0x00, 0x00, 0x00], "mov [rsp], 0x0");
test_display(&[0x48, 0x89, 0x44, 0x24, 0x08], "mov [rsp + 0x8], rax");
test_display(&[0x48, 0x89, 0x43, 0x18], "mov [rbx + 0x18], rax");
test_display(&[0x48, 0xc7, 0x43, 0x10, 0x00, 0x00, 0x00, 0x00], "mov [rbx + 0x10], 0x0");
test_display(&[0x49, 0x89, 0x4e, 0x08], "mov [r14 + 0x8], rcx");
test_display(&[0x48, 0x8b, 0x32], "mov rsi, [rdx]");
test_display(&[0x49, 0x89, 0x46, 0x10], "mov [r14 + 0x10], rax");
test_display(&[0x4d, 0x0f, 0x43, 0xec, 0x49], "cmovnb r13, r12");
test_display(&[0x0f, 0xb6, 0x06], "movzx eax, byte [rsi]");
test_display(&[0x0f, 0xb7, 0x06], "movzx eax, word [rsi]");
test_display(&[0x89, 0x55, 0x94], "mov [rbp - 0x6c], edx");
}
#[test]
fn test_stack() {
test_display(&[0x66, 0x41, 0x50], "push r8w");
}
#[test]
fn test_prefixes() {
test_display(&[0x66, 0x41, 0x31, 0xc0], "xor r8w, ax");
test_display(&[0x66, 0x41, 0x32, 0xc0], "xor al, r8b");
test_display(&[0x40, 0x32, 0xc5], "xor al, bpl");
}
#[test]
fn test_control_flow() {
test_display(&[0x73, 0x31], "jnb 0x31");
test_display(&[0x72, 0x5a], "jb 0x5a");
test_display(&[0x0f, 0x86, 0x8b, 0x01, 0x00, 0x00], "jna 0x18b");
test_display(&[0x74, 0x47], "jz 0x47");
test_display(&[0xff, 0x15, 0x7e, 0x72, 0x24, 0x00], "call [rip + 0x24727e]");
test_display(&[0xc3], "ret");
}
#[test]
fn test_test_cmp() {
test_display(&[0x48, 0x3d, 0x01, 0xf0, 0xff, 0xff], "cmp rax, -0xfff");
test_display(&[0x3d, 0x01, 0xf0, 0xff, 0xff], "cmp eax, -0xfff");
test_display(&[0x48, 0x83, 0xf8, 0xff], "cmp rax, -0x1");
test_display(&[0x48, 0x39, 0xc6], "cmp rsi, rax");
}
#[test]
#[ignore]
// VEX prefixes are not supported at the moment, in any form
fn test_avx() {
test_display(&[0xc5, 0xf8, 0x10, 0x00], "vmovups xmm0, xmmword [rax]");
}
#[test]
fn test_push_pop() {
test_display(&[0x5b], "pop rbx");
test_display(&[0x41, 0x5e], "pop r14");
test_display(&[0x68, 0x7f, 0x63, 0xc4, 0x00], "push 0xc4637f");
}
#[test]
fn test_misc() {
test_display(&[0x48, 0x8d, 0xa4, 0xc7, 0x20, 0x00, 0x00, 0x12], "lea rsp, [rdi + rax * 8 + 0x12000020]");
test_display(&[0x33, 0xc0], "xor eax, eax");
test_display(&[0x48, 0x8d, 0x53, 0x08], "lea rdx, [rbx + 0x8]");
test_display(&[0x31, 0xc9], "xor ecx, ecx");
test_display(&[0x48, 0x29, 0xc8], "sub rax, rcx");
test_display(&[0x48, 0x03, 0x0b], "add rcx, [rbx]");
test_display(&[0x48, 0x8d, 0x0c, 0x12], "lea rcx, [rdx + rdx]");
test_display(&[0xf6, 0xc2, 0x18], "test dl, 0x18");
}
|
