Nixyri/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2024-11-22 04:05:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/GP-3583_Dan_fixWoW64--SQUASHED' into patch

Browse Source
This commit is contained in:
Ryan Kurtz 2023-06-29 06:31:32 -04:00
commit 5759352c43
6 changed files with 200 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Ghidra/Debug/Debugger-agent-dbgeng/src/main/java/agent/dbgeng/manager/cmd/AbstractDbgReadCommand.java
View File

@ -45,6 +45,9 @@ public abstract class AbstractDbgReadCommand extends AbstractDbgCommand<ULongSpa
@Override
public ULongSpanSet complete(DbgPendingCommand<?> pending) {
if (readLen == 0) {
return ULongSpanSet.of();
}
return ULongSpanSet.of(ULongSpan.extent(addr, readLen));
}
}

26
Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/platform/dbgeng/DbgengX64DisassemblyInject.java
View File

@ -23,7 +23,8 @@ import java.util.concurrent.*;
import java.util.stream.Collectors;
import ghidra.app.plugin.core.debug.disassemble.TraceDisassembleCommand;
import ghidra.app.plugin.core.debug.workflow.*;
import ghidra.app.plugin.core.debug.workflow.DisassemblyInject;
import ghidra.app.plugin.core.debug.workflow.DisassemblyInjectInfo;
import ghidra.app.services.DebuggerModelService;
import ghidra.app.services.TraceRecorder;
import ghidra.app.util.bin.ByteProvider;
@ -61,14 +62,18 @@ public class DbgengX64DisassemblyInject implements DisassemblyInject {
TraceRecorder recorder = modelService == null ? null : modelService.getRecorder(trace);
Collection<? extends TraceModule> modules =
trace.getModuleManager().getModulesAt(snap, first.getMinAddress());
Msg.debug(this, "Disassembling in modules: " +
modules.stream().map(TraceModule::getName).collect(Collectors.joining(",")));
Set<Mode> modes = modules.stream()
.map(m -> modeForModule(recorder, trace, snap, m))
.filter(m -> m != Mode.UNK)
.collect(Collectors.toSet());
Msg.debug(this, "Disassembling in mode(s): " + modes);
if (modes.size() != 1) {
return;
}
Mode mode = modes.iterator().next();
Register longModeReg = language.getRegister("longMode");
Register addrsizeReg = language.getRegister("addrsize");
Register opsizeReg = language.getRegister("opsize");
ProgramContextImpl context = new ProgramContextImpl(language);
@ -76,29 +81,38 @@ public class DbgengX64DisassemblyInject implements DisassemblyInject {
RegisterValue ctxVal = context.getDisassemblyContext(first.getMinAddress());
if (mode == Mode.X64) {
command.setInitialContext(ctxVal
.assign(longModeReg, BigInteger.ONE)
.assign(addrsizeReg, BigInteger.TWO)
.assign(opsizeReg, BigInteger.TWO));
.assign(opsizeReg, BigInteger.ONE));
}
else if (mode == Mode.X86) {
command.setInitialContext(ctxVal
.assign(longModeReg, BigInteger.ZERO)
.assign(addrsizeReg, BigInteger.ONE)
.assign(opsizeReg, BigInteger.ONE));
}
// Shouldn't ever get anything else.
}
private <T> T waitOn(CompletableFuture<T> future)
throws InterruptedException, ExecutionException, TimeoutException {
// Just don't hang the Ghidra task thread indefinitely.
return future.get(1000, TimeUnit.MILLISECONDS);
}
protected Mode modeForModule(TraceRecorder recorder, Trace trace, long snap,
TraceModule module) {
if (recorder != null && recorder.getSnap() == snap) {
AddressSet set = new AddressSet();
set.add(module.getBase(), module.getBase()); // Recorder should read page
try {
// This is on its own task thread, so whatever.
// Just don't hang it indefinitely.
recorder.readMemoryBlocks(set, TaskMonitor.DUMMY).get(1000, TimeUnit.MILLISECONDS);
waitOn(recorder.readMemoryBlocks(set, TaskMonitor.DUMMY));
waitOn(recorder.getTarget().getModel().flushEvents());
waitOn(recorder.flushTransactions());
trace.flushEvents();
}
catch (InterruptedException | ExecutionException | TimeoutException e) {
Msg.error("Could not read module header from target", e);
Msg.error(this, "Could not read module header from target", e);
// Try to parse whatever's there. If 0s, it'll come UNK.
}
}

1
Ghidra/Processors/x86/certification.manifest
View File

@ -34,6 +34,7 @@ data/languages/x86-16.gdis||GHIDRA||||END|
data/languages/x86-16.pspec||GHIDRA||||END|
data/languages/x86-32-golang.cspec||GHIDRA||||END|
data/languages/x86-32-golang.register.info||GHIDRA||||END|
data/languages/x86-64-compat32.pspec||GHIDRA||||END|
data/languages/x86-64-gcc.cspec||GHIDRA||||END|
data/languages/x86-64-golang.cspec||GHIDRA||||END|
data/languages/x86-64-golang.register.info||GHIDRA||||END|

159
Ghidra/Processors/x86/data/languages/x86-64-compat32.pspec Normal file
View File

@ -0,0 +1,159 @@
<?xml version="1.0" encoding="UTF-8"?>
<processor_spec>
<properties>
<property key="useOperandReferenceAnalyzerSwitchTables" value="true"/>
<property key="assemblyRating:x86:LE:64:compat32" value="GOLD"/>
</properties>
<programcounter register="RIP"/>
<context_data>
<context_set space="ram">
<set name="addrsize" val="1"/>
<set name="opsize" val="1"/>
<set name="rexprefix" val="0"/>
<set name="longMode" val="0"/>
</context_set>
<tracked_set space="ram">
<set name="DF" val="0"/>
</tracked_set>
</context_data>
<register_data>
<register name="DR0" group="DEBUG"/>
<register name="DR1" group="DEBUG"/>
<register name="DR2" group="DEBUG"/>
<register name="DR3" group="DEBUG"/>
<register name="DR4" group="DEBUG"/>
<register name="DR5" group="DEBUG"/>
<register name="DR6" group="DEBUG"/>
<register name="DR7" group="DEBUG"/>
<register name="DR8" group="DEBUG"/>
<register name="DR9" group="DEBUG"/>
<register name="DR10" group="DEBUG"/>
<register name="DR11" group="DEBUG"/>
<register name="DR12" group="DEBUG"/>
<register name="DR13" group="DEBUG"/>
<register name="DR14" group="DEBUG"/>
<register name="DR15" group="DEBUG"/>
<register name="CR0" group="CONTROL"/>
<register name="CR1" group="CONTROL"/>
<register name="CR2" group="CONTROL"/>
<register name="CR3" group="CONTROL"/>
<register name="CR4" group="CONTROL"/>
<register name="CR5" group="CONTROL"/>
<register name="CR6" group="CONTROL"/>
<register name="CR7" group="CONTROL"/>
<register name="CR8" group="CONTROL"/>
<register name="CR9" group="CONTROL"/>
<register name="CR10" group="CONTROL"/>
<register name="CR11" group="CONTROL"/>
<register name="CR12" group="CONTROL"/>
<register name="CR13" group="CONTROL"/>
<register name="CR14" group="CONTROL"/>
<register name="CR15" group="CONTROL"/>
<register name="C0" group="Cx"/>
<register name="C1" group="Cx"/>
<register name="C2" group="Cx"/>
<register name="C3" group="Cx"/>
<register name="ST0" group="ST"/>
<register name="ST1" group="ST"/>
<register name="ST2" group="ST"/>
<register name="ST3" group="ST"/>
<register name="ST4" group="ST"/>
<register name="ST5" group="ST"/>
<register name="ST6" group="ST"/>
<register name="ST7" group="ST"/>
<register name="FPUControlWord" group="FPU"/>
<register name="FPUStatusWord" group="FPU"/>
<register name="FPUTagWord" group="FPU"/>
<register name="FPUDataPointer" group="FPU"/>
<register name="FPUInstructionPointer" group="FPU"/>
<register name="FPULastInstructionOpcode" group="FPU"/>
<register name="MM0" group="MMX"/>
<register name="MM1" group="MMX"/>
<register name="MM2" group="MMX"/>
<register name="MM3" group="MMX"/>
<register name="MM4" group="MMX"/>
<register name="MM5" group="MMX"/>
<register name="MM6" group="MMX"/>
<register name="MM7" group="MMX"/>
<register name="YMM0" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM1" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM2" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM3" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM4" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM5" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM6" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM7" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM8" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM9" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM10" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM11" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM12" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM13" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM14" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="YMM15" group="AVX" vector_lane_sizes="1,2,4,8"/>
<register name="XMM0" vector_lane_sizes="1,2,4,8"/>
<register name="XMM1" vector_lane_sizes="1,2,4,8"/>
<register name="XMM2" vector_lane_sizes="1,2,4,8"/>
<register name="XMM3" vector_lane_sizes="1,2,4,8"/>
<register name="XMM4" vector_lane_sizes="1,2,4,8"/>
<register name="XMM5" vector_lane_sizes="1,2,4,8"/>
<register name="XMM6" vector_lane_sizes="1,2,4,8"/>
<register name="XMM7" vector_lane_sizes="1,2,4,8"/>
<register name="XMM8" vector_lane_sizes="1,2,4,8"/>
<register name="XMM9" vector_lane_sizes="1,2,4,8"/>
<register name="XMM10" vector_lane_sizes="1,2,4,8"/>
<register name="XMM11" vector_lane_sizes="1,2,4,8"/>
<register name="XMM12" vector_lane_sizes="1,2,4,8"/>
<register name="XMM13" vector_lane_sizes="1,2,4,8"/>
<register name="XMM14" vector_lane_sizes="1,2,4,8"/>
<register name="XMM15" vector_lane_sizes="1,2,4,8"/>
<register name="CF" group="FLAGS"/>
<register name="F1" group="FLAGS"/>
<register name="PF" group="FLAGS"/>
<register name="F3" group="FLAGS"/>
<register name="AF" group="FLAGS"/>
<register name="F5" group="FLAGS"/>
<register name="ZF" group="FLAGS"/>
<register name="SF" group="FLAGS"/>
<register name="TF" group="FLAGS"/>
<register name="IF" group="FLAGS"/>
<register name="DF" group="FLAGS"/>
<register name="OF" group="FLAGS"/>
<register name="IOPL" group="FLAGS"/>
<register name="NT" group="FLAGS"/>
<register name="F15" group="FLAGS"/>
<register name="RF" group="FLAGS"/>
<register name="VM" group="FLAGS"/>
<register name="AC" group="FLAGS"/>
<register name="VIF" group="FLAGS"/>
<register name="VIP" group="FLAGS"/>
<register name="ID" group="FLAGS"/>
<register name="rflags" group="FLAGS"/>
<register name="eflags" group="FLAGS"/>
<register name="flags" group="FLAGS"/>
<register name="bit64" hidden="true"/>
<register name="segover" hidden="true"/>
<register name="repneprefx" hidden="true"/>
<register name="repprefx" hidden="true"/>
<register name="rexWprefix" hidden="true"/>
<register name="rexRprefix" hidden="true"/>
<register name="rexXprefix" hidden="true"/>
<register name="rexBprefix" hidden="true"/>
<register name="xmmTmp1" hidden="true"/>
<register name="xmmTmp1_Qa" hidden="true"/>
<register name="xmmTmp1_Da" hidden="true"/>
<register name="xmmTmp1_Db" hidden="true"/>
<register name="xmmTmp1_Qb" hidden="true"/>
<register name="xmmTmp1_Dc" hidden="true"/>
<register name="xmmTmp1_Dd" hidden="true"/>
<register name="xmmTmp2" hidden="true"/>
<register name="xmmTmp2_Qa" hidden="true"/>
<register name="xmmTmp2_Da" hidden="true"/>
<register name="xmmTmp2_Db" hidden="true"/>
<register name="xmmTmp2_Qb" hidden="true"/>
<register name="xmmTmp2_Dc" hidden="true"/>
<register name="xmmTmp2_Dd" hidden="true"/>
<register name="rexprefix" hidden="true"/>
</register_data>
</processor_spec>

1
Ghidra/Processors/x86/data/languages/x86-64.pspec
View File

@ -9,7 +9,6 @@
<context_data>
<context_set space="ram">
<set name="addrsize" val="2"/>
<set name="bit64" val="1"/>
<set name="opsize" val="1"/>
<set name="rexprefix" val="0"/>
<set name="longMode" val="1"/>

20
Ghidra/Processors/x86/data/languages/x86.ldefs
View File

@ -63,7 +63,7 @@
<external_name tool="IDA-PRO" name="metapc"/>
<external_name tool="gnu" name="i8086"/>
<external_name tool="gdis.disassembler.options.file" name="x86-16.gdis"/>
</language>
</language>
<language processor="x86"
endian="little"
size="16"
@ -78,8 +78,8 @@
<external_name tool="IDA-PRO" name="8086p"/>
<external_name tool="gnu" name="i8086"/>
<external_name tool="gdis.disassembler.options.file" name="x86-16.gdis"/>
</language>
<language processor="x86"
</language>
<language processor="x86"
endian="little"
size="64"
variant="default"
@ -99,4 +99,18 @@
<external_name tool="DWARF.register.mapping.file" name="x86-64.dwarf"/>
<external_name tool="Golang.register.info.file" name="x86-64-golang.register.info"/>
</language>
<language processor="x86"
endian="little"
size="64"
variant="compat32"
version="2.14"
slafile="x86-64.sla"
processorspec="x86-64-compat32.pspec"
manualindexfile="../manuals/x86.idx"
id="x86:LE:64:compat32">
<description>Intel/AMD 64-bit x86 in 32-bit compatibility mode (long mode off)</description>
<compiler name="Visual Studio" spec="x86win.cspec" id="windows"/>
<compiler name="gcc" spec="x86gcc.cspec" id="gcc"/>
<external_name tool="DWARF.register.mapping.file" name="x86.dwarf"/>
</language>
</language_definitions>