00001 /* 00002 * Copyright (c) 2002 00003 * Politecnico di Torino. All rights reserved. 00004 * 00005 * Redistribution and use in source and binary forms, with or without 00006 * modification, are permitted provided that: (1) source code distributions 00007 * retain the above copyright notice and this paragraph in its entirety, (2) 00008 * distributions including binary code include the above copyright notice and 00009 * this paragraph in its entirety in the documentation or other materials 00010 * provided with the distribution, and (3) all advertising materials mentioning 00011 * features or use of this software display the following acknowledgement: 00012 * ``This product includes software developed by the Politecnico 00013 * di Torino, and its contributors.'' Neither the name of 00014 * the University nor the names of its contributors may be used to endorse 00015 * or promote products derived from this software without specific prior 00016 * written permission. 00017 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 00018 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 00019 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 00020 */ 00021 00030 // 00031 // Registers 00032 // 00033 #define EAX 0 00034 #define ECX 1 00035 #define EDX 2 00036 #define EBX 3 00037 #define ESP 4 00038 #define EBP 5 00039 #define ESI 6 00040 #define EDI 7 00041 00042 #define AX 0 00043 #define CX 1 00044 #define DX 2 00045 #define BX 3 00046 #define SP 4 00047 #define BP 5 00048 #define SI 6 00049 #define DI 7 00050 00051 #define AL 0 00052 #define CL 1 00053 #define DL 2 00054 #define BL 3 00055 00057 typedef struct binary_stream{ 00058 INT cur_ip; 00059 INT bpf_pc; 00060 PCHAR ibuf; 00061 PUINT refs; 00062 }binary_stream; 00063 00064 00070 typedef UINT (*BPF_filter_function)( binary_stream *, ULONG, UINT); 00071 00080 typedef void (*emit_func)(binary_stream *stream, ULONG value, UINT n); 00081 00083 typedef struct JIT_BPF_Filter{ 00084 BPF_filter_function Function; 00085 PINT mem; 00086 } 00087 JIT_BPF_Filter; 00088 00089 00090 00091 00092 /**************************/ 00093 /* X86 INSTRUCTION MACROS */ 00094 /**************************/ 00095 00097 #define MOVid(r32, i32) \ 00098 emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4); 00099 00101 #define MOVrd(dr32, sr32) \ 00102 emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1); 00103 00105 #define MOVodd(dr32, sr32, off) \ 00106 emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \ 00107 emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\ 00108 emitm(&stream, off, 1); 00109 00111 #define MOVobd(dr32, sr32, or32) \ 00112 emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \ 00113 emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\ 00114 emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1); 00115 00117 #define MOVobw(dr32, sr32, or32) \ 00118 emitm(&stream, 0x66, 1); \ 00119 emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \ 00120 emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\ 00121 emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1); 00122 00124 #define MOVobb(dr8, sr32, or32) \ 00125 emitm(&stream, 0x8a, 1); \ 00126 emitm(&stream, (dr8 & 0x7) << 3 | 4 , 1);\ 00127 emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1); 00128 00130 #define MOVomd(dr32, or32, sr32) \ 00131 emitm(&stream, 0x89, 1); \ 00132 emitm(&stream, (sr32 & 0x7) << 3 | 4 , 1);\ 00133 emitm(&stream, (or32 & 0x7) << 3 | (dr32 & 0x7) , 1); 00134 00136 #define BSWAP(dr32) \ 00137 emitm(&stream, 0xf, 1); \ 00138 emitm(&stream, 0x19 << 3 | dr32 , 1); 00139 00141 #define SWAP_AX() \ 00142 emitm(&stream, 0x86, 1); \ 00143 emitm(&stream, 0xc4 , 1); 00144 00146 #define PUSH(r32) \ 00147 emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1); 00148 00150 #define POP(r32) \ 00151 emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1); 00152 00154 #define RET() \ 00155 emitm(&stream, 12 << 4 | 0 << 3 | 3, 1); 00156 00158 #define ADDrd(dr32, sr32) \ 00159 emitm(&stream, 0x03, 1);\ 00160 emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1); 00161 00163 #define ADD_EAXi(i32) \ 00164 emitm(&stream, 0x05, 1);\ 00165 emitm(&stream, i32, 4); 00166 00168 #define ADDid(r32, i32) \ 00169 emitm(&stream, 0x81, 1);\ 00170 emitm(&stream, 24 << 3 | r32, 1);\ 00171 emitm(&stream, i32, 4); 00172 00174 #define ADDib(r32, i8) \ 00175 emitm(&stream, 0x83, 1);\ 00176 emitm(&stream, 24 << 3 | r32, 1);\ 00177 emitm(&stream, i8, 1); 00178 00180 #define SUBrd(dr32, sr32) \ 00181 emitm(&stream, 0x2b, 1);\ 00182 emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1); 00183 00185 #define SUB_EAXi(i32) \ 00186 emitm(&stream, 0x2d, 1);\ 00187 emitm(&stream, i32, 4); 00188 00190 #define MULrd(r32) \ 00191 emitm(&stream, 0xf7, 1);\ 00192 emitm(&stream, 7 << 5 | (r32 & 0x7), 1); 00193 00195 #define DIVrd(r32) \ 00196 emitm(&stream, 0xf7, 1);\ 00197 emitm(&stream, 15 << 4 | (r32 & 0x7), 1); 00198 00200 #define ANDib(r8, i8) \ 00201 emitm(&stream, 0x80, 1);\ 00202 emitm(&stream, 7 << 5 | r8, 1);\ 00203 emitm(&stream, i8, 1); 00204 00206 #define ANDid(r32, i32) \ 00207 if (r32 == EAX){ \ 00208 emitm(&stream, 0x25, 1);\ 00209 emitm(&stream, i32, 4);}\ 00210 else{ \ 00211 emitm(&stream, 0x81, 1);\ 00212 emitm(&stream, 7 << 5 | r32, 1);\ 00213 emitm(&stream, i32, 4);} 00214 00216 #define ANDrd(dr32, sr32) \ 00217 emitm(&stream, 0x23, 1);\ 00218 emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1); 00219 00221 #define ORrd(dr32, sr32) \ 00222 emitm(&stream, 0x0b, 1);\ 00223 emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1); 00224 00226 #define ORid(r32, i32) \ 00227 if (r32 == EAX){ \ 00228 emitm(&stream, 0x0d, 1);\ 00229 emitm(&stream, i32, 4);}\ 00230 else{ \ 00231 emitm(&stream, 0x81, 1);\ 00232 emitm(&stream, 25 << 3 | r32, 1);\ 00233 emitm(&stream, i32, 4);} 00234 00236 #define SHLib(r32, i8) \ 00237 emitm(&stream, 0xc1, 1);\ 00238 emitm(&stream, 7 << 5 | r32 & 0x7, 1);\ 00239 emitm(&stream, i8, 1); 00240 00242 #define SHL_CLrb(dr32) \ 00243 emitm(&stream, 0xd3, 1);\ 00244 emitm(&stream, 7 << 5 | dr32 & 0x7, 1); 00245 00247 #define SHRib(r32, i8) \ 00248 emitm(&stream, 0xc1, 1);\ 00249 emitm(&stream, 29 << 3 | r32 & 0x7, 1);\ 00250 emitm(&stream, i8, 1); 00251 00253 #define SHR_CLrb(dr32) \ 00254 emitm(&stream, 0xd3, 1);\ 00255 emitm(&stream, 29 << 3 | dr32 & 0x7, 1); 00256 00258 #define NEGd(r32) \ 00259 emitm(&stream, 0xf7, 1);\ 00260 emitm(&stream, 27 << 3 | r32 & 0x7, 1); 00261 00263 #define CMPodd(dr32, sr32, off) \ 00264 emitm(&stream, 3 << 4 | 3 | 1 << 3, 1); \ 00265 emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\ 00266 emitm(&stream, off, 1); 00267 00269 #define CMPrd(dr32, sr32) \ 00270 emitm(&stream, 0x3b, 1); \ 00271 emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1); 00272 00274 #define CMPid(dr32, i32) \ 00275 if (dr32 == EAX){ \ 00276 emitm(&stream, 0x3d, 1); \ 00277 emitm(&stream, i32, 4);} \ 00278 else{ \ 00279 emitm(&stream, 0x81, 1); \ 00280 emitm(&stream, 0x1f << 3 | (dr32 & 0x7), 1);\ 00281 emitm(&stream, i32, 4);} 00282 00284 #define JNEb(off8) \ 00285 emitm(&stream, 0x75, 1);\ 00286 emitm(&stream, off8, 1); 00287 00289 #define JE(off32) \ 00290 emitm(&stream, 0x0f, 1);\ 00291 emitm(&stream, 0x84, 1);\ 00292 emitm(&stream, off32, 4); 00293 00295 #define JLE(off32) \ 00296 emitm(&stream, 0x0f, 1);\ 00297 emitm(&stream, 0x8e, 1);\ 00298 emitm(&stream, off32, 4); 00299 00301 #define JLEb(off8) \ 00302 emitm(&stream, 0x7e, 1);\ 00303 emitm(&stream, off8, 1); 00304 00306 #define JA(off32) \ 00307 emitm(&stream, 0x0f, 1);\ 00308 emitm(&stream, 0x87, 1);\ 00309 emitm(&stream, off32, 4); 00310 00312 #define JAE(off32) \ 00313 emitm(&stream, 0x0f, 1);\ 00314 emitm(&stream, 0x83, 1);\ 00315 emitm(&stream, off32, 4); 00316 00318 #define JG(off32) \ 00319 emitm(&stream, 0x0f, 1);\ 00320 emitm(&stream, 0x8f, 1);\ 00321 emitm(&stream, off32, 4); 00322 00324 #define JGE(off32) \ 00325 emitm(&stream, 0x0f, 1);\ 00326 emitm(&stream, 0x8d, 1);\ 00327 emitm(&stream, off32, 4); 00328 00330 #define JMP(off32) \ 00331 emitm(&stream, 0xe9, 1);\ 00332 emitm(&stream, off32, 4); 00333 00342 /**************************/ 00343 /* Prototypes */ 00344 /**************************/ 00345 00363 JIT_BPF_Filter* BPF_jitter(struct bpf_insn *fp, INT nins); 00364 00376 BPF_filter_function BPFtoX86(struct bpf_insn *ins, UINT nins, INT *mem); 00383 void BPF_Destroy_JIT_Filter(JIT_BPF_Filter *Filter); 00384
documentation. Copyright (c) 2002 Politecnico di Torino. All rights reserved.