computation of Jcc & JMP target

DispatchCode · DispatchCode · commit 69d1be3cf60b · 2021-12-08T01:32:24.000+01:00
diff --git a/README.md b/README.md
@@ -107,6 +107,7 @@ Here below how you can use the struct. More infos and the other structs can be f
 | `modrm`           | `union`           | Union of four fields: `value`, `rm`, `reg` and `mod` (see [below](#modrm-union)). |
 | `disp`            | `uint64_t`        | Displacement field |
 | `imm`             | `uint64_t`        | Immediate value (a number) |
+| `label`           | `uint32_t`        | Address of Jcc/JMP, if present |
 | `_vex`            | `struct vex_info` | Available only if [`_ENABLED_VEX_INFO`](#enabling--disabling-features) is defined. Described [below](#vex_info-struct). |
 | `instr`           | `uint8_t[15]`     | Available only if [`_ENABLE_RAW_BYTES`](#enabling--disabling-features) is defined. |
 | `sib`             | `union`           | Union of four fields: `value`, `base`, `index` and `scaled` (see [below](#sib-union)). |
@@ -118,6 +119,7 @@ Here below how you can use the struct. More infos and the other structs can be f
 | `prefix_cnt`      | `int8_t`          | Count how many prefixes are available |
 | `set_prefix`      | `uint16_t`        | A field against which is possible to check if a determined prefix (belonging to `prefixes` enum) is present. |
 | `set_field`       | `uint16_t`        | A field against which is possible to check if a determined feature (belonging to `instruction_feature` enum) is available (e.g. FPU, SIB, DISP,...) |
+| `jcc_type`        | `uint8_t`         | The type of jump: Jcc or JMP with 1 or 2-bytes (refer to jmp_type enum) 
 
 ___
 
diff --git a/src/mca.c b/src/mca.c
@@ -1,3 +1,4 @@
+#include <stdio.h>
 #include "mca.h"
 
 static size_t *imm_table[4] = {0, imm_byte_2b,imm_byte_3b_38,imm_byte_3b_3A };
@@ -14,22 +15,22 @@ static inline void mca_vex_decode(struct instruction *instr, enum supported_arch
     instr->set_prefix |= VEX;
 
     if(instr->vex[0] == 0xC5) {
-        #ifdef _ENABLE_VEX_INFO
-            instr->_vex.type = instr->vex[0];
-            instr->_vex.val5 = instr->vex[1];
-        #endif
+#ifdef _ENABLE_VEX_INFO
+        instr->_vex.type = instr->vex[0];
+        instr->_vex.val5 = instr->vex[1];
+#endif
 
-        mca_decode_modrm(instr, arch, data, modrm_2b, imm_byte_2b);
+        mca_decode_modrm(instr, arch, data, modrm_2b, imm_byte_2b, NULL);
     }
     else if(instr->vex[0] == 0xC4) {
 
-        #ifdef _ENABLE_VEX_INFO
-            instr->_vex.type = instr->vex[0];
-            memcpy(&instr->_vex.val4, &instr->vex[1],2);
-        #endif
+#ifdef _ENABLE_VEX_INFO
+        instr->_vex.type = instr->vex[0];
+        memcpy(&instr->_vex.val4, &instr->vex[1],2);
+#endif
 
         int8_t index = instr->vex[1] & 0x3;
-        mca_decode_modrm(instr, arch, data, modrm_table[index], imm_table[index]);
+        mca_decode_modrm(instr, arch, data, modrm_table[index], imm_table[index], NULL);
     }
     // TODO  XOP, 0x8F
 
@@ -105,7 +106,7 @@ static inline int mca_imm_size(struct instruction *instr, size_t val, enum suppo
     }
 }
 
-static void mca_decode_modrm(struct instruction *instr, enum supported_architecture arch, const char *start_data, const size_t *modrm_table, const size_t *imm_table) {
+static void mca_decode_modrm(struct instruction *instr, enum supported_architecture arch, const char *start_data, const size_t *modrm_table, const size_t *imm_table, const size_t *jcc_table) {
     size_t val;
     if((val = modrm_table[instr->op])) {
         instr->set_field |= MODRM;
@@ -147,6 +148,32 @@ static void mca_decode_modrm(struct instruction *instr, enum supported_architect
         memcpy(&instr->imm, (start_data + instr->length), instr->imm_len);
         instr->length += instr->imm_len;
     }
+
+    uint16_t value = 0;
+    if(jcc_table != NULL && (value = jcc_table[instr->op])) {
+        switch(value) {
+            case j1:
+                instr->jcc_type = JMP_SHORT;
+            break;
+            case j2:
+                instr->jcc_type = JMP_FAR;
+            break;
+            case jc1:
+                instr->jcc_type = JCC_SHORT;
+            break;
+            case jc2:
+                instr->jcc_type = JCC_FAR;
+            default:
+                break; // avoid compiler warnings
+        }
+
+        // 1-byte
+        if(value & 0x10)
+            instr->label = (uint32_t)start_data + ((int8_t)instr->imm) + instr->length;
+        // 4-byte
+        else
+            instr->label = (uint32_t)start_data + ((int32_t)instr->imm) + instr->length;
+    }
 }
 
 static int mca_decode_2b(struct instruction *instr, enum supported_architecture arch, const char *data_src)
@@ -164,17 +191,17 @@ static int mca_decode_2b(struct instruction *instr, enum supported_architecture
         instr->length++;
 
         if(curr == 0x3A)
-            mca_decode_modrm(instr, arch, data_src, modreg_3b_3A, imm_byte_3b_3A);
+            mca_decode_modrm(instr, arch, data_src, modreg_3b_3A, imm_byte_3b_3A, NULL);
         else
-            mca_decode_modrm(instr, arch, data_src, modreg_3b_38, imm_byte_3b_38);
+            mca_decode_modrm(instr, arch, data_src, modreg_3b_38, imm_byte_3b_38, NULL);
 
         return instr->length;
     }
 
     instr->op = curr;
     instr->length++;
 
-    mca_decode_modrm(instr, arch, data_src, modrm_2b, imm_byte_2b);
+    mca_decode_modrm(instr, arch, data_src, modrm_2b, imm_byte_2b, op2b_labels);
 
     return instr->length;
 }
@@ -190,33 +217,33 @@ int mca_decode(struct instruction *instr, enum supported_architecture arch, char
         switch(curr) {
             case 0x26:
                 instr->set_prefix |= ES;
-            break;
+                break;
             case 0x2E:
                 instr->set_prefix |= CS;
-            break;
+                break;
             case 0x36:
                 instr->set_prefix |= SS;
-            break;
+                break;
             case 0x3E:
                 instr->set_prefix |= DS;
-            break;
+                break;
             case 0x48:
             case 0x49:
                 if(arch == X64)
                     instr->set_prefix |= OP64;
-            break;
+                break;
             case 0x64:
                 instr->set_prefix |= FS;
-            break;
+                break;
             case 0x65:
                 instr->set_prefix |= GS;
-            break;
+                break;
             case 0x66:
                 instr->set_prefix |= OS;
-            break;
+                break;
             case 0x67:
                 instr->set_prefix |= AS;
-            break;
+                break;
         }
 
         instr->set_field |= PREFIX;
@@ -235,9 +262,9 @@ int mca_decode(struct instruction *instr, enum supported_architecture arch, char
         else if(curr == 0x0F)
         {
             mca_decode_2b(instr, arch, start_data);
-            #ifdef _ENABLE_RAW_BYTES
+#ifdef _ENABLE_RAW_BYTES
             memcpy(instr->instr, start_data, instr->length);
-            #endif
+#endif
             return instr->length;
         }
 
@@ -251,7 +278,7 @@ int mca_decode(struct instruction *instr, enum supported_architecture arch, char
     {
         instr->length++;
         instr->op = curr;
-        mca_decode_modrm(instr, arch, start_data, modrm_1b, imm_byte_1b);
+        mca_decode_modrm(instr, arch, start_data, modrm_1b, imm_byte_1b, op1b_labels);
     }
 
 #ifdef _ENABLE_RAW_BYTES
diff --git a/src/mca.h b/src/mca.h
@@ -96,6 +96,42 @@ static size_t imm_byte_1b[256] = {
         /* F0 */ 0, 0, 0, 0, 0, 0, gr3b, gr3z, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
+/*
+ * first byte:
+ *   - 1: 1-byte
+ *   - 2: 4-byte
+ *
+ * second byte (LSB):
+ *   - 1: Jcc
+ *   - 2: JMP
+ *
+ */
+#define j1  0x12
+#define j2  0x22
+#define jc1 0x11
+#define jc2 0x21
+
+// check if the OP is Jcc or JMP
+static size_t op1b_labels[256] = {
+        //      00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
+        /* 00 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 10 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 20 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 30 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 40 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 50 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 60 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 70 */ jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1, jc1,
+        /* 80 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 90 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* A0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* B0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* C0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* D0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* E0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, j2, 0, j1, 0, 0, 0, 0,
+        /* F0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
 //
 // 2-byte OP look-up table
 
@@ -156,6 +192,27 @@ static size_t imm_byte_2b[256] = {
         /* F0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
+// check if the OP is Jcc or JMP
+static size_t op2b_labels[256] = {
+        //      00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
+        /* 00 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 10 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 20 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 30 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 40 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 50 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 60 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 70 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* 80 */ jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2, jc2,
+        /* 90 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* A0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* B0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* C0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* D0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* E0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        /* F0 */ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+
 //
 // 3-byte OP look-up table
 
@@ -250,6 +307,13 @@ static size_t imm_byte_3b_3A[256] = {
         /* F0 */ 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
 
+enum jmp_type {
+    JCC_SHORT = 1,  // 1-byte JCC
+    JCC_FAR   = 2,  // 2-byte JCC, 4bytes imm
+    JMP_SHORT = 4,  // 1-byte JMP
+    JMP_FAR   = 8,  // 4-byte JMP
+};
+
 enum prefixes {
     ES = 1,  // 0x26
     CS = 2,  // 0x2E
@@ -336,6 +400,7 @@ struct vex_info {
 struct instruction {
     uint64_t disp;
     uint64_t imm;
+    uint32_t label;
 
 #ifdef _ENABLE_VEX_INFO
     struct vex_info _vex;
@@ -390,6 +455,7 @@ struct instruction {
 
     uint16_t set_prefix; // bit mask
     uint16_t set_field;
+    uint8_t  jcc_type;
 
     int8_t vex_cnt;
     int8_t prefix_cnt;
@@ -400,7 +466,7 @@ struct instruction {
 // Functions
 //
 int mca_decode(struct instruction *instr, enum supported_architecture arch, char *data_src, int offset);
-static void mca_decode_modrm(struct instruction *instr, enum supported_architecture arch, const char *data_src, const size_t *modrm_table, const size_t *imm_table);
+static void mca_decode_modrm(struct instruction *instr, enum supported_architecture arch, const char *data_src, const size_t *modrm_table, const size_t *imm_table, const size_t *jcc_table);
 static inline bool mca_check_sib(uint8_t mod, uint8_t rm);
 static inline int mca_displacement_size(uint8_t mod, uint8_t rm);
 static inline int mca_imm_size(struct instruction *instr, size_t val, enum supported_architecture arch);
