?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ntdll: Buffer pagemap reads in fill_working_set_info().
[wine.git] / libs / zydis / src / Decoder.c
blob2d73c554a28ba3db72e7524ace32faa6f54a1b6f
1 /***************************************************************************************************
2
3 Zyan Disassembler Library (Zydis)
4
5 Original Author : Florian Bernd
6
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in all
15 * copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 * SOFTWARE.
24
25 ***************************************************************************************************/
26
27 // ReSharper disable CppClangTidyClangDiagnosticImplicitFallthrough
28 // ReSharper disable CppClangTidyClangDiagnosticSwitchEnum
29 // ReSharper disable CppClangTidyClangDiagnosticCoveredSwitchDefault
30
31 // Temporarily disabled due to a LLVM issue:
32 // ReSharper disable CppClangTidyBugproneNarrowingConversions
33
34 #include <Zycore/LibC.h>
35 #include <Zydis/Decoder.h>
36 #include <Zydis/Status.h>
37 #include <Zydis/Internal/DecoderData.h>
38 #include <Zydis/Internal/SharedData.h>
39
40 /* ============================================================================================== */
41 /* Internal enums and types */
42 /* ============================================================================================== */
43
44 /* ---------------------------------------------------------------------------------------------- */
45 /* Decoder context */
46 /* ---------------------------------------------------------------------------------------------- */
47
48 /**
49 * Defines the `ZydisDecoderState` struct.
50 */
51 typedef struct ZydisDecoderState_
52 {
53 /**
54 * A pointer to the `ZydisDecoder` instance.
55 */
56 const ZydisDecoder* decoder;
57 /**
58 * A pointer to the `ZydisDecoderContext` struct.
59 */
60 ZydisDecoderContext* context;
61 /**
62 * The input buffer.
63 */
64 const ZyanU8* buffer;
65 /**
66 * The input buffer length.
67 */
68 ZyanUSize buffer_len;
69 /**
70 * Prefix information.
71 */
72 struct
73 {
74 /**
75 * Signals, if the instruction has a `LOCK` prefix (`F0`).
76 *
77 * This prefix originally belongs to group 1, but separating it from the other ones makes
78 * parsing easier for us later.
79 */
80 ZyanBool has_lock;
81 /**
82 * The effective prefix of group 1 (either `F2` or `F3`).
83 */
84 ZyanU8 group1;
85 /**
86 * The effective prefix of group 2 (`2E`, `36`, `3E`, `26`, `64` or `65`).
87 */
88 ZyanU8 group2;
89 /**
90 * The effective segment prefix.
91 */
92 ZyanU8 effective_segment;
93 /**
94 * The prefix that should be treated as the mandatory-prefix, if the
95 * current instruction needs one.
96 *
97 * The last `F3`/`F2` prefix has precedence over previous ones and
98 * `F3`/`F2` in general have precedence over `66`.
99 */
100 ZyanU8 mandatory_candidate;
101 /**
102 * The offset of the effective `LOCK` prefix.
103 */
104 ZyanU8 offset_lock;
105 /**
106 * The offset of the effective prefix in group 1.
107 */
108 ZyanU8 offset_group1;
109 /**
110 * The offset of the effective prefix in group 2.
111 */
112 ZyanU8 offset_group2;
113 /**
114 * The offset of the operand-size override prefix (`66`).
115 *
116 * This is the only prefix in group 3.
117 */
118 ZyanU8 offset_osz_override;
119 /**
120 * The offset of the address-size override prefix (`67`).
121 *
122 * This is the only prefix in group 4.
123 */
124 ZyanU8 offset_asz_override;
125 /**
126 * The offset of the effective segment prefix.
127 */
128 ZyanU8 offset_segment;
129 /**
130 * The offset of the mandatory-candidate prefix.
131 */
132 ZyanU8 offset_mandatory;
133 /**
134 * The offset of a possible `CET` `no-lock` prefix.
135 */
136 ZyanI8 offset_notrack;
137 } prefixes;
138 } ZydisDecoderState;
139
140 /* ---------------------------------------------------------------------------------------------- */
141 /* Register encoding */
142 /* ---------------------------------------------------------------------------------------------- */
143
144 /**
145 * Defines the `ZydisRegisterEncoding` enum.
146 */
147 typedef enum ZydisRegisterEncoding_
148 {
149 ZYDIS_REG_ENCODING_INVALID,
150 /**
151 * The register-id is encoded as part of the opcode (bits [3..0]).
152 *
153 * Possible extension by:
154 * - `REX.B`
155 */
156 ZYDIS_REG_ENCODING_OPCODE,
157 /**
158 * The register-id is encoded in `modrm.reg`.
159 *
160 * Possible extension by:
161 * - `.R`
162 * - `.R'` (vector only, EVEX/MVEX)
163 */
164 ZYDIS_REG_ENCODING_REG,
165 /**
166 * The register-id is encoded in `.vvvv`.
167 *
168 * Possible extension by:
169 * - `.v'` (vector only, EVEX/MVEX).
170 */
171 ZYDIS_REG_ENCODING_NDSNDD,
172 /**
173 * The register-id is encoded in `modrm.rm`.
174 *
175 * Possible extension by:
176 * - `.B`
177 * - `.X` (vector only, EVEX/MVEX)`
178 */
179 ZYDIS_REG_ENCODING_RM,
180 /**
181 * The register-id is encoded in `modrm.rm` or `sib.base` (if `SIB` is present).
182 *
183 * Possible extension by:
184 * - `.B`
185 */
186 ZYDIS_REG_ENCODING_BASE,
187 /**
188 * The register-id is encoded in `sib.index`.
189 *
190 * Possible extension by:
191 * - `.X`
192 */
193 ZYDIS_REG_ENCODING_INDEX,
194 /**
195 * The register-id is encoded in `sib.index`.
196 *
197 * Possible extension by:
198 * - `.X`
199 * - `.V'` (vector only, EVEX/MVEX)
200 */
201 ZYDIS_REG_ENCODING_VIDX,
202 /**
203 * The register-id is encoded in an additional 8-bit immediate value.
204 *
205 * Bits [7:4] in 64-bit mode with possible extension by bit [3] (vector only), bits [7:5] for
206 * all other modes.
207 */
208 ZYDIS_REG_ENCODING_IS4,
209 /**
210 * The register-id is encoded in `EVEX.aaa/MVEX.kkk`.
211 */
212 ZYDIS_REG_ENCODING_MASK,
213
214 /**
215 * Maximum value of this enum.
216 */
217 ZYDIS_REG_ENCODING_MAX_VALUE = ZYDIS_REG_ENCODING_MASK,
218 /**
219 * The minimum number of bits required to represent all values of this enum.
220 */
221 ZYDIS_REG_ENCODING_REQUIRED_BITS = ZYAN_BITS_TO_REPRESENT(ZYDIS_REG_ENCODING_MAX_VALUE)
222 } ZydisRegisterEncoding;
223
224 /* ---------------------------------------------------------------------------------------------- */
225
226 /* ============================================================================================== */
227 /* Internal functions */
228 /* ============================================================================================== */
229
230 /* ---------------------------------------------------------------------------------------------- */
231 /* Input helper functions */
232 /* ---------------------------------------------------------------------------------------------- */
233
234 /**
235 * Reads one byte from the current read-position of the input data-source.
236 *
237 * @param state A pointer to the `ZydisDecoderState` struct.
238 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
239 * @param value A pointer to the memory that receives the byte from the input data-source.
240 *
241 * @return A zyan status code.
242 *
243 * This function may fail, if the `ZYDIS_MAX_INSTRUCTION_LENGTH` limit got exceeded, or no more
244 * data is available.
245 */
246 static ZyanStatus ZydisInputPeek(ZydisDecoderState* state,
247 ZydisDecodedInstruction* instruction, ZyanU8* value)
248 {
249 ZYAN_ASSERT(state);
250 ZYAN_ASSERT(instruction);
251 ZYAN_ASSERT(value);
252
253 if (instruction->length >= ZYDIS_MAX_INSTRUCTION_LENGTH)
254 {
255 return ZYDIS_STATUS_INSTRUCTION_TOO_LONG;
256 }
257
258 if (state->buffer_len > 0)
259 {
260 *value = state->buffer[0];
261 return ZYAN_STATUS_SUCCESS;
262 }
263
264 return ZYDIS_STATUS_NO_MORE_DATA;
265 }
266
267 /**
268 * Increases the read-position of the input data-source by one byte.
269 *
270 * @param state A pointer to the `ZydisDecoderState` instance
271 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
272 *
273 * This function is supposed to get called ONLY after a successful call of `ZydisInputPeek`.
274 *
275 * This function increases the `length` field of the `ZydisDecodedInstruction` struct by one.
276 */
277 static void ZydisInputSkip(ZydisDecoderState* state, ZydisDecodedInstruction* instruction)
278 {
279 ZYAN_ASSERT(state);
280 ZYAN_ASSERT(instruction);
281 ZYAN_ASSERT(instruction->length < ZYDIS_MAX_INSTRUCTION_LENGTH);
282
283 ++instruction->length;
284 ++state->buffer;
285 --state->buffer_len;
286 }
287
288 /**
289 * Reads one byte from the current read-position of the input data-source and increases
290 * the read-position by one byte afterwards.
291 *
292 * @param state A pointer to the `ZydisDecoderState` struct.
293 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
294 * @param value A pointer to the memory that receives the byte from the input data-source.
295 *
296 * @return A zyan status code.
297 *
298 * This function acts like a subsequent call of `ZydisInputPeek` and `ZydisInputSkip`.
299 */
300 static ZyanStatus ZydisInputNext(ZydisDecoderState* state,
301 ZydisDecodedInstruction* instruction, ZyanU8* value)
302 {
303 ZYAN_ASSERT(state);
304 ZYAN_ASSERT(instruction);
305 ZYAN_ASSERT(value);
306
307 if (instruction->length >= ZYDIS_MAX_INSTRUCTION_LENGTH)
308 {
309 return ZYDIS_STATUS_INSTRUCTION_TOO_LONG;
310 }
311
312 if (state->buffer_len > 0)
313 {
314 *value = state->buffer++[0];
315 ++instruction->length;
316 --state->buffer_len;
317 return ZYAN_STATUS_SUCCESS;
318 }
319
320 return ZYDIS_STATUS_NO_MORE_DATA;
321 }
322
323 /**
324 * Reads a variable amount of bytes from the current read-position of the input
325 * data-source and increases the read-position by specified amount of bytes afterwards.
326 *
327 * @param state A pointer to the `ZydisDecoderState` struct.
328 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
329 * @param value A pointer to the memory that receives the byte from the input
330 * data-source.
331 * @param number_of_bytes The number of bytes to read from the input data-source.
332 *
333 * @return A zyan status code.
334 *
335 * This function acts like a subsequent call of `ZydisInputPeek` and `ZydisInputSkip`.
336 */
337 static ZyanStatus ZydisInputNextBytes(ZydisDecoderState* state,
338 ZydisDecodedInstruction* instruction, ZyanU8* value, ZyanU8 number_of_bytes)
339 {
340 ZYAN_ASSERT(state);
341 ZYAN_ASSERT(instruction);
342 ZYAN_ASSERT(value);
343
344 if (instruction->length + number_of_bytes > ZYDIS_MAX_INSTRUCTION_LENGTH)
345 {
346 return ZYDIS_STATUS_INSTRUCTION_TOO_LONG;
347 }
348
349 if (state->buffer_len >= number_of_bytes)
350 {
351 instruction->length += number_of_bytes;
352
353 ZYAN_MEMCPY(value, state->buffer, number_of_bytes);
354 state->buffer += number_of_bytes;
355 state->buffer_len -= number_of_bytes;
356
357 return ZYAN_STATUS_SUCCESS;
358 }
359
360 return ZYDIS_STATUS_NO_MORE_DATA;
361 }
362
363 /* ---------------------------------------------------------------------------------------------- */
364 /* Decode functions */
365 /* ---------------------------------------------------------------------------------------------- */
366
367 /**
368 * Decodes the `REX`-prefix.
369 *
370 * @param context A pointer to the `ZydisDecoderContext` struct.
371 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
372 * @param data The `REX` byte.
373 */
374 static void ZydisDecodeREX(ZydisDecoderContext* context, ZydisDecodedInstruction* instruction,
375 ZyanU8 data)
376 {
377 ZYAN_ASSERT(instruction);
378 ZYAN_ASSERT((data & 0xF0) == 0x40);
379
380 instruction->attributes |= ZYDIS_ATTRIB_HAS_REX;
381 instruction->raw.rex.W = (data >> 3) & 0x01;
382 instruction->raw.rex.R = (data >> 2) & 0x01;
383 instruction->raw.rex.X = (data >> 1) & 0x01;
384 instruction->raw.rex.B = (data >> 0) & 0x01;
385
386 // Update internal fields
387 context->vector_unified.W = instruction->raw.rex.W;
388 context->vector_unified.R = instruction->raw.rex.R;
389 context->vector_unified.X = instruction->raw.rex.X;
390 context->vector_unified.B = instruction->raw.rex.B;
391 }
392
393 /**
394 * Decodes the `XOP`-prefix.
395 *
396 * @param context A pointer to the `ZydisDecoderContext` struct.
397 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
398 * @param data The `XOP` bytes.
399 *
400 * @return A zyan status code.
401 */
402 static ZyanStatus ZydisDecodeXOP(ZydisDecoderContext* context,
403 ZydisDecodedInstruction* instruction, const ZyanU8 data[3])
404 {
405 ZYAN_ASSERT(instruction);
406 ZYAN_ASSERT(data[0] == 0x8F);
407 ZYAN_ASSERT(((data[1] >> 0) & 0x1F) >= 8);
408 ZYAN_ASSERT(instruction->raw.xop.offset == instruction->length - 3);
409
410 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_REAL_16)
411 {
412 // XOP is invalid in 16-bit real mode
413 return ZYDIS_STATUS_DECODING_ERROR;
414 }
415
416 instruction->attributes |= ZYDIS_ATTRIB_HAS_XOP;
417 instruction->raw.xop.R = (data[1] >> 7) & 0x01;
418 instruction->raw.xop.X = (data[1] >> 6) & 0x01;
419 instruction->raw.xop.B = (data[1] >> 5) & 0x01;
420 instruction->raw.xop.m_mmmm = (data[1] >> 0) & 0x1F;
421
422 if ((instruction->raw.xop.m_mmmm < 0x08) || (instruction->raw.xop.m_mmmm > 0x0A))
423 {
424 // Invalid according to the AMD documentation
425 return ZYDIS_STATUS_INVALID_MAP;
426 }
427
428 instruction->raw.xop.W = (data[2] >> 7) & 0x01;
429 instruction->raw.xop.vvvv = (data[2] >> 3) & 0x0F;
430 instruction->raw.xop.L = (data[2] >> 2) & 0x01;
431 instruction->raw.xop.pp = (data[2] >> 0) & 0x03;
432
433 // Update internal fields
434 context->vector_unified.W = instruction->raw.xop.W;
435 context->vector_unified.R = 0x01 & ~instruction->raw.xop.R;
436 context->vector_unified.X = 0x01 & ~instruction->raw.xop.X;
437 context->vector_unified.B = 0x01 & ~instruction->raw.xop.B;
438 context->vector_unified.L = instruction->raw.xop.L;
439 context->vector_unified.LL = instruction->raw.xop.L;
440 context->vector_unified.vvvv = (0x0F & ~instruction->raw.xop.vvvv);
441
442 return ZYAN_STATUS_SUCCESS;
443 }
444
445 /**
446 * Decodes the `VEX`-prefix.
447 *
448 * @param context A pointer to the `ZydisDecoderContext` struct.
449 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
450 * @param data The `VEX` bytes.
451 *
452 * @return A zyan status code.
453 */
454 static ZyanStatus ZydisDecodeVEX(ZydisDecoderContext* context,
455 ZydisDecodedInstruction* instruction, const ZyanU8 data[3])
456 {
457 ZYAN_ASSERT(instruction);
458 ZYAN_ASSERT((data[0] == 0xC4) || (data[0] == 0xC5));
459
460 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_REAL_16)
461 {
462 // VEX is invalid in 16-bit real mode
463 return ZYDIS_STATUS_DECODING_ERROR;
464 }
465
466 instruction->attributes |= ZYDIS_ATTRIB_HAS_VEX;
467 switch (data[0])
468 {
469 case 0xC4:
470 ZYAN_ASSERT(instruction->raw.vex.offset == instruction->length - 3);
471 instruction->raw.vex.size = 3;
472 instruction->raw.vex.R = (data[1] >> 7) & 0x01;
473 instruction->raw.vex.X = (data[1] >> 6) & 0x01;
474 instruction->raw.vex.B = (data[1] >> 5) & 0x01;
475 instruction->raw.vex.m_mmmm = (data[1] >> 0) & 0x1F;
476 instruction->raw.vex.W = (data[2] >> 7) & 0x01;
477 instruction->raw.vex.vvvv = (data[2] >> 3) & 0x0F;
478 instruction->raw.vex.L = (data[2] >> 2) & 0x01;
479 instruction->raw.vex.pp = (data[2] >> 0) & 0x03;
480 break;
481 case 0xC5:
482 ZYAN_ASSERT(instruction->raw.vex.offset == instruction->length - 2);
483 instruction->raw.vex.size = 2;
484 instruction->raw.vex.R = (data[1] >> 7) & 0x01;
485 instruction->raw.vex.X = 1;
486 instruction->raw.vex.B = 1;
487 instruction->raw.vex.m_mmmm = 1;
488 instruction->raw.vex.W = 0;
489 instruction->raw.vex.vvvv = (data[1] >> 3) & 0x0F;
490 instruction->raw.vex.L = (data[1] >> 2) & 0x01;
491 instruction->raw.vex.pp = (data[1] >> 0) & 0x03;
492 break;
493 default:
494 ZYAN_UNREACHABLE;
495 }
496
497 // Map 0 is only valid for some KNC instructions
498 #ifdef ZYDIS_DISABLE_KNC
499 if ((instruction->raw.vex.m_mmmm == 0) || (instruction->raw.vex.m_mmmm > 0x03))
500 #else
501 if (instruction->raw.vex.m_mmmm > 0x03)
502 #endif
503 {
504 // Invalid according to the intel documentation
505 return ZYDIS_STATUS_INVALID_MAP;
506 }
507
508 // Update internal fields
509 context->vector_unified.W = instruction->raw.vex.W;
510 context->vector_unified.R = 0x01 & ~instruction->raw.vex.R;
511 context->vector_unified.X = 0x01 & ~instruction->raw.vex.X;
512 context->vector_unified.B = 0x01 & ~instruction->raw.vex.B;
513 context->vector_unified.L = instruction->raw.vex.L;
514 context->vector_unified.LL = instruction->raw.vex.L;
515 context->vector_unified.vvvv = (0x0F & ~instruction->raw.vex.vvvv);
516
517 return ZYAN_STATUS_SUCCESS;
518 }
519
520 #ifndef ZYDIS_DISABLE_AVX512
521 /**
522 * Decodes the `EVEX`-prefix.
523 *
524 * @param context A pointer to the `ZydisDecoderContext` struct.
525 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
526 * @param data The `EVEX` bytes.
527 *
528 * @return A zyan status code.
529 */
530 static ZyanStatus ZydisDecodeEVEX(ZydisDecoderContext* context,
531 ZydisDecodedInstruction* instruction, const ZyanU8 data[4])
532 {
533 ZYAN_ASSERT(instruction);
534 ZYAN_ASSERT(data[0] == 0x62);
535 ZYAN_ASSERT(instruction->raw.evex.offset == instruction->length - 4);
536
537 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_REAL_16)
538 {
539 // EVEX is invalid in 16-bit real mode
540 return ZYDIS_STATUS_DECODING_ERROR;
541 }
542
543 instruction->attributes |= ZYDIS_ATTRIB_HAS_EVEX;
544 instruction->raw.evex.R = (data[1] >> 7) & 0x01;
545 instruction->raw.evex.X = (data[1] >> 6) & 0x01;
546 instruction->raw.evex.B = (data[1] >> 5) & 0x01;
547 instruction->raw.evex.R2 = (data[1] >> 4) & 0x01;
548
549 if (data[1] & 0x08)
550 {
551 // Invalid according to the intel documentation
552 return ZYDIS_STATUS_MALFORMED_EVEX;
553 }
554
555 instruction->raw.evex.mmm = (data[1] >> 0) & 0x07;
556
557 if ((instruction->raw.evex.mmm == 0x00) ||
558 (instruction->raw.evex.mmm == 0x04) ||
559 (instruction->raw.evex.mmm == 0x07))
560 {
561 // Invalid according to the intel documentation
562 return ZYDIS_STATUS_INVALID_MAP;
563 }
564
565 instruction->raw.evex.W = (data[2] >> 7) & 0x01;
566 instruction->raw.evex.vvvv = (data[2] >> 3) & 0x0F;
567
568 ZYAN_ASSERT(((data[2] >> 2) & 0x01) == 0x01);
569
570 instruction->raw.evex.pp = (data[2] >> 0) & 0x03;
571 instruction->raw.evex.z = (data[3] >> 7) & 0x01;
572 instruction->raw.evex.L2 = (data[3] >> 6) & 0x01;
573 instruction->raw.evex.L = (data[3] >> 5) & 0x01;
574 instruction->raw.evex.b = (data[3] >> 4) & 0x01;
575 instruction->raw.evex.V2 = (data[3] >> 3) & 0x01;
576
577 if (!instruction->raw.evex.V2 &&
578 (instruction->machine_mode != ZYDIS_MACHINE_MODE_LONG_64))
579 {
580 return ZYDIS_STATUS_MALFORMED_EVEX;
581 }
582
583 instruction->raw.evex.aaa = (data[3] >> 0) & 0x07;
584
585 if (instruction->raw.evex.z && !instruction->raw.evex.aaa)
586 {
587 return ZYDIS_STATUS_INVALID_MASK; // TODO: Dedicated status code
588 }
589
590 // Update internal fields
591 context->vector_unified.W = instruction->raw.evex.W;
592 context->vector_unified.R = 0x01 & ~instruction->raw.evex.R;
593 context->vector_unified.X = 0x01 & ~instruction->raw.evex.X;
594 context->vector_unified.B = 0x01 & ~instruction->raw.evex.B;
595 context->vector_unified.LL = (data[3] >> 5) & 0x03;
596 context->vector_unified.R2 = 0x01 & ~instruction->raw.evex.R2;
597 context->vector_unified.V2 = 0x01 & ~instruction->raw.evex.V2;
598 context->vector_unified.vvvv = 0x0F & ~instruction->raw.evex.vvvv;
599 context->vector_unified.mask = instruction->raw.evex.aaa;
600
601 if (!instruction->raw.evex.V2 && (instruction->machine_mode != ZYDIS_MACHINE_MODE_LONG_64))
602 {
603 return ZYDIS_STATUS_MALFORMED_EVEX;
604 }
605 if (!instruction->raw.evex.b && (context->vector_unified.LL == 3))
606 {
607 // LL = 3 is only valid for instructions with embedded rounding control
608 return ZYDIS_STATUS_MALFORMED_EVEX;
609 }
610
611 return ZYAN_STATUS_SUCCESS;
612 }
613 #endif
614
615 #ifndef ZYDIS_DISABLE_KNC
616 /**
617 * Decodes the `MVEX`-prefix.
618 *
619 * @param context A pointer to the `ZydisDecoderContext` struct.
620 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
621 * @param data The `MVEX` bytes.
622 *
623 * @return A zyan status code.
624 */
625 static ZyanStatus ZydisDecodeMVEX(ZydisDecoderContext* context,
626 ZydisDecodedInstruction* instruction, const ZyanU8 data[4])
627 {
628 ZYAN_ASSERT(instruction);
629 ZYAN_ASSERT(data[0] == 0x62);
630 ZYAN_ASSERT(instruction->raw.mvex.offset == instruction->length - 4);
631
632 if (instruction->machine_mode != ZYDIS_MACHINE_MODE_LONG_64)
633 {
634 // MVEX is only valid in 64-bit mode
635 return ZYDIS_STATUS_DECODING_ERROR;
636 }
637
638 instruction->attributes |= ZYDIS_ATTRIB_HAS_MVEX;
639 instruction->raw.mvex.R = (data[1] >> 7) & 0x01;
640 instruction->raw.mvex.X = (data[1] >> 6) & 0x01;
641 instruction->raw.mvex.B = (data[1] >> 5) & 0x01;
642 instruction->raw.mvex.R2 = (data[1] >> 4) & 0x01;
643 instruction->raw.mvex.mmmm = (data[1] >> 0) & 0x0F;
644
645 if (instruction->raw.mvex.mmmm > 0x03)
646 {
647 // Invalid according to the intel documentation
648 return ZYDIS_STATUS_INVALID_MAP;
649 }
650
651 instruction->raw.mvex.W = (data[2] >> 7) & 0x01;
652 instruction->raw.mvex.vvvv = (data[2] >> 3) & 0x0F;
653
654 ZYAN_ASSERT(((data[2] >> 2) & 0x01) == 0x00);
655
656 instruction->raw.mvex.pp = (data[2] >> 0) & 0x03;
657 instruction->raw.mvex.E = (data[3] >> 7) & 0x01;
658 instruction->raw.mvex.SSS = (data[3] >> 4) & 0x07;
659 instruction->raw.mvex.V2 = (data[3] >> 3) & 0x01;
660 instruction->raw.mvex.kkk = (data[3] >> 0) & 0x07;
661
662 // Update internal fields
663 context->vector_unified.W = instruction->raw.mvex.W;
664 context->vector_unified.R = 0x01 & ~instruction->raw.mvex.R;
665 context->vector_unified.X = 0x01 & ~instruction->raw.mvex.X;
666 context->vector_unified.B = 0x01 & ~instruction->raw.mvex.B;
667 context->vector_unified.R2 = 0x01 & ~instruction->raw.mvex.R2;
668 context->vector_unified.V2 = 0x01 & ~instruction->raw.mvex.V2;
669 context->vector_unified.LL = 2;
670 context->vector_unified.vvvv = 0x0F & ~instruction->raw.mvex.vvvv;
671 context->vector_unified.mask = instruction->raw.mvex.kkk;
672
673 return ZYAN_STATUS_SUCCESS;
674 }
675 #endif
676
677 /**
678 * Decodes the `ModRM`-byte.
679 *
680 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
681 * @param data The `ModRM` byte.
682 */
683 static void ZydisDecodeModRM(ZydisDecodedInstruction* instruction, ZyanU8 data)
684 {
685 ZYAN_ASSERT(instruction);
686 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_MODRM));
687 ZYAN_ASSERT(instruction->raw.modrm.offset == instruction->length - 1);
688
689 instruction->attributes |= ZYDIS_ATTRIB_HAS_MODRM;
690 instruction->raw.modrm.mod = (data >> 6) & 0x03;
691 instruction->raw.modrm.reg = (data >> 3) & 0x07;
692 instruction->raw.modrm.rm = (data >> 0) & 0x07;
693 }
694
695 /**
696 * Decodes the `SIB`-byte.
697 *
698 * @param instruction A pointer to the `ZydisDecodedInstruction` struct
699 * @param data The `SIB` byte.
700 */
701 static void ZydisDecodeSIB(ZydisDecodedInstruction* instruction, ZyanU8 data)
702 {
703 ZYAN_ASSERT(instruction);
704 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MODRM);
705 ZYAN_ASSERT(instruction->raw.modrm.rm == 4);
706 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_SIB));
707 ZYAN_ASSERT(instruction->raw.sib.offset == instruction->length - 1);
708
709 instruction->attributes |= ZYDIS_ATTRIB_HAS_SIB;
710 instruction->raw.sib.scale = (data >> 6) & 0x03;
711 instruction->raw.sib.index = (data >> 3) & 0x07;
712 instruction->raw.sib.base = (data >> 0) & 0x07;
713 }
714
715 /* ---------------------------------------------------------------------------------------------- */
716
717 /**
718 * Reads a displacement value.
719 *
720 * @param state A pointer to the `ZydisDecoderState` struct.
721 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
722 * @param size The physical size of the displacement value.
723 *
724 * @return A zyan status code.
725 */
726 static ZyanStatus ZydisReadDisplacement(ZydisDecoderState* state,
727 ZydisDecodedInstruction* instruction, ZyanU8 size)
728 {
729 ZYAN_ASSERT(state);
730 ZYAN_ASSERT(instruction);
731 ZYAN_ASSERT(instruction->raw.disp.size == 0);
732
733 instruction->raw.disp.size = size;
734 instruction->raw.disp.offset = instruction->length;
735
736 switch (size)
737 {
738 case 8:
739 {
740 ZyanU8 value;
741 ZYAN_CHECK(ZydisInputNext(state, instruction, &value));
742 instruction->raw.disp.value = *(ZyanI8*)&value;
743 break;
744 }
745 case 16:
746 {
747 ZyanU16 value;
748 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 2));
749 instruction->raw.disp.value = *(ZyanI16*)&value;
750 break;
751 }
752 case 32:
753 {
754 ZyanU32 value;
755 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 4));
756 instruction->raw.disp.value = *(ZyanI32*)&value;
757 break;
758 }
759 case 64:
760 {
761 ZyanU64 value;
762 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 8));
763 instruction->raw.disp.value = *(ZyanI64*)&value;
764 break;
765 }
766 default:
767 ZYAN_UNREACHABLE;
768 }
769
770 // TODO: Fix endianess on big-endian systems
771
772 return ZYAN_STATUS_SUCCESS;
773 }
774
775 /**
776 * Reads an immediate value.
777 *
778 * @param state A pointer to the `ZydisDecoderState` struct.
779 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
780 * @param id The immediate id (either `0` or `1`).
781 * @param size The physical size of the immediate value.
782 * @param is_signed Signals, if the immediate value is signed.
783 * @param is_relative Signals, if the immediate value is a relative offset.
784 *
785 * @return A zyan status code.
786 */
787 static ZyanStatus ZydisReadImmediate(ZydisDecoderState* state,
788 ZydisDecodedInstruction* instruction, ZyanU8 id, ZyanU8 size, ZyanBool is_signed,
789 ZyanBool is_relative)
790 {
791 ZYAN_ASSERT(state);
792 ZYAN_ASSERT(instruction);
793 ZYAN_ASSERT((id == 0) || (id == 1));
794 ZYAN_ASSERT(is_signed || !is_relative);
795 ZYAN_ASSERT(instruction->raw.imm[id].size == 0);
796
797 instruction->raw.imm[id].size = size;
798 instruction->raw.imm[id].offset = instruction->length;
799 instruction->raw.imm[id].is_signed = is_signed;
800 instruction->raw.imm[id].is_relative = is_relative;
801 switch (size)
802 {
803 case 8:
804 {
805 ZyanU8 value;
806 ZYAN_CHECK(ZydisInputNext(state, instruction, &value));
807 if (is_signed)
808 {
809 instruction->raw.imm[id].value.s = (ZyanI8)value;
810 } else
811 {
812 instruction->raw.imm[id].value.u = value;
813 }
814 break;
815 }
816 case 16:
817 {
818 ZyanU16 value;
819 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 2));
820 if (is_signed)
821 {
822 instruction->raw.imm[id].value.s = (ZyanI16)value;
823 } else
824 {
825 instruction->raw.imm[id].value.u = value;
826 }
827 break;
828 }
829 case 32:
830 {
831 ZyanU32 value;
832 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 4));
833 if (is_signed)
834 {
835 instruction->raw.imm[id].value.s = (ZyanI32)value;
836 } else
837 {
838 instruction->raw.imm[id].value.u = value;
839 }
840 break;
841 }
842 case 64:
843 {
844 ZyanU64 value;
845 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, (ZyanU8*)&value, 8));
846 if (is_signed)
847 {
848 instruction->raw.imm[id].value.s = (ZyanI64)value;
849 } else
850 {
851 instruction->raw.imm[id].value.u = value;
852 }
853 break;
854 }
855 default:
856 ZYAN_UNREACHABLE;
857 }
858
859 // TODO: Fix endianess on big-endian systems
860
861 return ZYAN_STATUS_SUCCESS;
862 }
863
864 /* ---------------------------------------------------------------------------------------------- */
865 /* Semantic instruction decoding */
866 /* ---------------------------------------------------------------------------------------------- */
867
868 #ifndef ZYDIS_MINIMAL_MODE
869 /**
870 * Calculates the register-id for a specific register-encoding and register-class.
871 *
872 * @param context A pointer to the `ZydisDecoderContext` struct.
873 * @param instruction A pointer to the ` ZydisDecodedInstruction` struct.
874 * @param encoding The register-encoding.
875 * @param register_class The register-class.
876 *
877 * @return A zyan status code.
878 *
879 * This function calculates the register-id by combining different fields and flags of previously
880 * decoded structs.
881 */
882 static ZyanU8 ZydisCalcRegisterId(const ZydisDecoderContext* context,
883 const ZydisDecodedInstruction* instruction, ZydisRegisterEncoding encoding,
884 ZydisRegisterClass register_class)
885 {
886 ZYAN_ASSERT(context);
887 ZYAN_ASSERT(instruction);
888
889 // TODO: Combine OPCODE and IS4 in `ZydisPopulateRegisterIds` and get rid of this
890 // TODO: function entirely
891
892 switch (encoding)
893 {
894 case ZYDIS_REG_ENCODING_REG:
895 return context->reg_info.id_reg;
896 case ZYDIS_REG_ENCODING_NDSNDD:
897 return context->reg_info.id_ndsndd;
898 case ZYDIS_REG_ENCODING_RM:
899 return context->reg_info.id_rm;
900 case ZYDIS_REG_ENCODING_BASE:
901 return context->reg_info.id_base;
902 case ZYDIS_REG_ENCODING_INDEX:
903 case ZYDIS_REG_ENCODING_VIDX:
904 return context->reg_info.id_index;
905 case ZYDIS_REG_ENCODING_OPCODE:
906 {
907 ZYAN_ASSERT((register_class == ZYDIS_REGCLASS_GPR8) ||
908 (register_class == ZYDIS_REGCLASS_GPR16) ||
909 (register_class == ZYDIS_REGCLASS_GPR32) ||
910 (register_class == ZYDIS_REGCLASS_GPR64));
911 ZyanU8 value = (instruction->opcode & 0x0F);
912 if (value > 7)
913 {
914 value = value - 8;
915 }
916 if (instruction->machine_mode != ZYDIS_MACHINE_MODE_LONG_64)
917 {
918 return value;
919 }
920 return value | (context->vector_unified.B << 3);
921 }
922 case ZYDIS_REG_ENCODING_IS4:
923 {
924 if (instruction->machine_mode != ZYDIS_MACHINE_MODE_LONG_64)
925 {
926 return (instruction->raw.imm[0].value.u >> 4) & 0x07;
927 }
928 ZyanU8 value = (instruction->raw.imm[0].value.u >> 4) & 0x0F;
929 // We have to check the instruction-encoding, because the extension by bit [3] is only
930 // valid for EVEX and MVEX instructions
931 if ((instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX) ||
932 (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX))
933 {
934 switch (register_class)
935 {
936 case ZYDIS_REGCLASS_XMM:
937 case ZYDIS_REGCLASS_YMM:
938 case ZYDIS_REGCLASS_ZMM:
939 value |= ((instruction->raw.imm[0].value.u & 0x08) << 1);
940 default:
941 break;
942 }
943 }
944 return value;
945 }
946 case ZYDIS_REG_ENCODING_MASK:
947 return context->vector_unified.mask;
948 default:
949 ZYAN_UNREACHABLE;
950 }
951 }
952 #endif
953
954 #ifndef ZYDIS_MINIMAL_MODE
955 /**
956 * Sets the operand-size and element-specific information for the given operand.
957 *
958 * @param context A pointer to the `ZydisDecoderContext` struct.
959 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
960 * @param operand A pointer to the `ZydisDecodedOperand` struct.
961 * @param definition A pointer to the `ZydisOperandDefinition` struct.
962 */
963 static void ZydisSetOperandSizeAndElementInfo(const ZydisDecoderContext* context,
964 const ZydisDecodedInstruction* instruction, ZydisDecodedOperand* operand,
965 const ZydisOperandDefinition* definition)
966 {
967 ZYAN_ASSERT(context);
968 ZYAN_ASSERT(instruction);
969 ZYAN_ASSERT(operand);
970 ZYAN_ASSERT(definition);
971
972 // Operand size
973 switch (operand->type)
974 {
975 case ZYDIS_OPERAND_TYPE_REGISTER:
976 {
977 if (definition->size[context->eosz_index])
978 {
979 operand->size = definition->size[context->eosz_index] * 8;
980 } else
981 {
982 operand->size = ZydisRegisterGetWidth(instruction->machine_mode,
983 operand->reg.value);
984 }
985 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
986 operand->element_size = operand->size;
987 break;
988 }
989 case ZYDIS_OPERAND_TYPE_MEMORY:
990 switch (instruction->encoding)
991 {
992 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
993 case ZYDIS_INSTRUCTION_ENCODING_3DNOW:
994 case ZYDIS_INSTRUCTION_ENCODING_XOP:
995 case ZYDIS_INSTRUCTION_ENCODING_VEX:
996 if (operand->mem.type == ZYDIS_MEMOP_TYPE_AGEN)
997 {
998 ZYAN_ASSERT(definition->size[context->eosz_index] == 0);
999 operand->size = instruction->address_width;
1000 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1001 } else
1002 {
1003 ZYAN_ASSERT(definition->size[context->eosz_index] ||
1004 (instruction->meta.category == ZYDIS_CATEGORY_AMX_TILE));
1005 operand->size = definition->size[context->eosz_index] * 8;
1006 }
1007 break;
1008 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
1009 #ifndef ZYDIS_DISABLE_AVX512
1010 if (definition->size[context->eosz_index])
1011 {
1012 // Operand size is hardcoded
1013 operand->size = definition->size[context->eosz_index] * 8;
1014 } else
1015 {
1016 // Operand size depends on the tuple-type, the element-size and the number of
1017 // elements
1018 ZYAN_ASSERT(instruction->avx.vector_length);
1019 ZYAN_ASSERT(context->evex.element_size);
1020 switch (context->evex.tuple_type)
1021 {
1022 case ZYDIS_TUPLETYPE_FV:
1023 if (instruction->avx.broadcast.mode)
1024 {
1025 operand->size = context->evex.element_size;
1026 } else
1027 {
1028 operand->size = instruction->avx.vector_length;
1029 }
1030 break;
1031 case ZYDIS_TUPLETYPE_HV:
1032 if (instruction->avx.broadcast.mode)
1033 {
1034 operand->size = context->evex.element_size;
1035 } else
1036 {
1037 operand->size = (ZyanU16)instruction->avx.vector_length / 2;
1038 }
1039 break;
1040 case ZYDIS_TUPLETYPE_QUARTER:
1041 if (instruction->avx.broadcast.mode)
1042 {
1043 operand->size = context->evex.element_size;
1044 }
1045 else
1046 {
1047 operand->size = (ZyanU16)instruction->avx.vector_length / 4;
1048 }
1049 break;
1050 default:
1051 ZYAN_UNREACHABLE;
1052 }
1053 }
1054 ZYAN_ASSERT(operand->size);
1055 #else
1056 ZYAN_UNREACHABLE;
1057 #endif
1058 break;
1059 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
1060 #ifndef ZYDIS_DISABLE_KNC
1061 if (definition->size[context->eosz_index])
1062 {
1063 // Operand size is hardcoded
1064 operand->size = definition->size[context->eosz_index] * 8;
1065 } else
1066 {
1067 ZYAN_ASSERT(definition->element_type == ZYDIS_IELEMENT_TYPE_VARIABLE);
1068 ZYAN_ASSERT(instruction->avx.vector_length == 512);
1069
1070 switch (instruction->avx.conversion.mode)
1071 {
1072 case ZYDIS_CONVERSION_MODE_INVALID:
1073 operand->size = 512;
1074 switch (context->mvex.functionality)
1075 {
1076 case ZYDIS_MVEX_FUNC_SF_32:
1077 case ZYDIS_MVEX_FUNC_SF_32_BCST_4TO16:
1078 case ZYDIS_MVEX_FUNC_UF_32:
1079 case ZYDIS_MVEX_FUNC_DF_32:
1080 operand->element_type = ZYDIS_ELEMENT_TYPE_FLOAT32;
1081 operand->element_size = 32;
1082 break;
1083 case ZYDIS_MVEX_FUNC_SF_32_BCST:
1084 operand->size = 256;
1085 operand->element_type = ZYDIS_ELEMENT_TYPE_FLOAT32;
1086 operand->element_size = 32;
1087 break;
1088 case ZYDIS_MVEX_FUNC_SI_32:
1089 case ZYDIS_MVEX_FUNC_SI_32_BCST_4TO16:
1090 case ZYDIS_MVEX_FUNC_UI_32:
1091 case ZYDIS_MVEX_FUNC_DI_32:
1092 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1093 operand->element_size = 32;
1094 break;
1095 case ZYDIS_MVEX_FUNC_SI_32_BCST:
1096 operand->size = 256;
1097 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1098 operand->element_size = 32;
1099 break;
1100 case ZYDIS_MVEX_FUNC_SF_64:
1101 case ZYDIS_MVEX_FUNC_UF_64:
1102 case ZYDIS_MVEX_FUNC_DF_64:
1103 operand->element_type = ZYDIS_ELEMENT_TYPE_FLOAT64;
1104 operand->element_size = 64;
1105 break;
1106 case ZYDIS_MVEX_FUNC_SI_64:
1107 case ZYDIS_MVEX_FUNC_UI_64:
1108 case ZYDIS_MVEX_FUNC_DI_64:
1109 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1110 operand->element_size = 64;
1111 break;
1112 default:
1113 ZYAN_UNREACHABLE;
1114 }
1115 break;
1116 case ZYDIS_CONVERSION_MODE_FLOAT16:
1117 operand->size = 256;
1118 operand->element_type = ZYDIS_ELEMENT_TYPE_FLOAT16;
1119 operand->element_size = 16;
1120 break;
1121 case ZYDIS_CONVERSION_MODE_SINT16:
1122 operand->size = 256;
1123 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1124 operand->element_size = 16;
1125 break;
1126 case ZYDIS_CONVERSION_MODE_UINT16:
1127 operand->size = 256;
1128 operand->element_type = ZYDIS_ELEMENT_TYPE_UINT;
1129 operand->element_size = 16;
1130 break;
1131 case ZYDIS_CONVERSION_MODE_SINT8:
1132 operand->size = 128;
1133 operand->element_type = ZYDIS_ELEMENT_TYPE_INT;
1134 operand->element_size = 8;
1135 break;
1136 case ZYDIS_CONVERSION_MODE_UINT8:
1137 operand->size = 128;
1138 operand->element_type = ZYDIS_ELEMENT_TYPE_UINT;
1139 operand->element_size = 8;
1140 break;
1141 default:
1142 ZYAN_UNREACHABLE;
1143 }
1144
1145 switch (instruction->avx.broadcast.mode)
1146 {
1147 case ZYDIS_BROADCAST_MODE_INVALID:
1148 // Nothing to do here
1149 break;
1150 case ZYDIS_BROADCAST_MODE_1_TO_8:
1151 case ZYDIS_BROADCAST_MODE_1_TO_16:
1152 operand->size = operand->element_size;
1153 break;
1154 case ZYDIS_BROADCAST_MODE_4_TO_8:
1155 case ZYDIS_BROADCAST_MODE_4_TO_16:
1156 operand->size = operand->element_size * 4;
1157 break;
1158 default:
1159 ZYAN_UNREACHABLE;
1160 }
1161 }
1162 #else
1163 ZYAN_UNREACHABLE;
1164 #endif
1165 break;
1166 default:
1167 ZYAN_UNREACHABLE;
1168 }
1169 break;
1170 case ZYDIS_OPERAND_TYPE_POINTER:
1171 ZYAN_ASSERT((instruction->raw.imm[0].size == 16) ||
1172 (instruction->raw.imm[0].size == 32));
1173 ZYAN_ASSERT( instruction->raw.imm[1].size == 16);
1174 operand->size = instruction->raw.imm[0].size + instruction->raw.imm[1].size;
1175 break;
1176 case ZYDIS_OPERAND_TYPE_IMMEDIATE:
1177 operand->size = definition->size[context->eosz_index] * 8;
1178 break;
1179 default:
1180 ZYAN_UNREACHABLE;
1181 }
1182
1183 // Element-type and -size
1184 if (definition->element_type && (definition->element_type != ZYDIS_IELEMENT_TYPE_VARIABLE))
1185 {
1186 ZydisGetElementInfo(definition->element_type, &operand->element_type,
1187 &operand->element_size);
1188 if (!operand->element_size)
1189 {
1190 // The element size is the same as the operand size. This is used for single element
1191 // scaling operands
1192 operand->element_size = operand->size;
1193 }
1194 }
1195
1196 // Element count
1197 if (operand->element_size && operand->size && (operand->element_type != ZYDIS_ELEMENT_TYPE_CC))
1198 {
1199 operand->element_count = operand->size / operand->element_size;
1200 } else
1201 {
1202 operand->element_count = 1;
1203 }
1204 }
1205 #endif
1206
1207 #ifndef ZYDIS_MINIMAL_MODE
1208 /**
1209 * Decodes an register-operand.
1210 *
1211 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
1212 * @param operand A pointer to the `ZydisDecodedOperand` struct.
1213 * @param register_class The register class.
1214 * @param register_id The register id.
1215 *
1216 * @return A zyan status code.
1217 */
1218 static ZyanStatus ZydisDecodeOperandRegister(const ZydisDecodedInstruction* instruction,
1219 ZydisDecodedOperand* operand, ZydisRegisterClass register_class, ZyanU8 register_id)
1220 {
1221 ZYAN_ASSERT(instruction);
1222 ZYAN_ASSERT(operand);
1223
1224 operand->type = ZYDIS_OPERAND_TYPE_REGISTER;
1225
1226 if (register_class == ZYDIS_REGCLASS_GPR8)
1227 {
1228 if ((instruction->attributes & ZYDIS_ATTRIB_HAS_REX) && (register_id >= 4))
1229 {
1230 operand->reg.value = ZYDIS_REGISTER_SPL + (register_id - 4);
1231 } else
1232 {
1233 operand->reg.value = ZYDIS_REGISTER_AL + register_id;
1234 }
1235 } else
1236 {
1237 operand->reg.value = ZydisRegisterEncode(register_class, register_id);
1238 ZYAN_ASSERT(operand->reg.value);
1239 /*if (!operand->reg.value)
1240 {
1241 return ZYAN_STATUS_BAD_REGISTER;
1242 }*/
1243 }
1244
1245 return ZYAN_STATUS_SUCCESS;
1246 }
1247 #endif
1248
1249 #ifndef ZYDIS_MINIMAL_MODE
1250 /**
1251 * Decodes a memory operand.
1252 *
1253 * @param context A pointer to the `ZydisDecoderContext` struct.
1254 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
1255 * @param operand A pointer to the `ZydisDecodedOperand` struct.
1256 * @param vidx_register_class The register-class to use as the index register-class for
1257 * instructions with `VSIB` addressing.
1258 *
1259 * @return A zyan status code.
1260 */
1261 static ZyanStatus ZydisDecodeOperandMemory(const ZydisDecoderContext* context,
1262 const ZydisDecodedInstruction* instruction, ZydisDecodedOperand* operand,
1263 ZydisRegisterClass vidx_register_class)
1264 {
1265 ZYAN_ASSERT(context);
1266 ZYAN_ASSERT(instruction);
1267 ZYAN_ASSERT(operand);
1268 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MODRM);
1269 ZYAN_ASSERT(instruction->raw.modrm.mod != 3);
1270 ZYAN_ASSERT(!vidx_register_class || ((instruction->raw.modrm.rm == 4) &&
1271 ((instruction->address_width == 32) || (instruction->address_width == 64))));
1272
1273 operand->type = ZYDIS_OPERAND_TYPE_MEMORY;
1274 operand->mem.type = ZYDIS_MEMOP_TYPE_MEM;
1275
1276 const ZyanU8 modrm_rm = instruction->raw.modrm.rm;
1277 ZyanU8 displacement_size = 0;
1278 switch (instruction->address_width)
1279 {
1280 case 16:
1281 {
1282 static const ZydisRegister bases[] =
1283 {
1284 ZYDIS_REGISTER_BX, ZYDIS_REGISTER_BX, ZYDIS_REGISTER_BP, ZYDIS_REGISTER_BP,
1285 ZYDIS_REGISTER_SI, ZYDIS_REGISTER_DI, ZYDIS_REGISTER_BP, ZYDIS_REGISTER_BX
1286 };
1287 static const ZydisRegister indices[] =
1288 {
1289 ZYDIS_REGISTER_SI, ZYDIS_REGISTER_DI, ZYDIS_REGISTER_SI, ZYDIS_REGISTER_DI,
1290 ZYDIS_REGISTER_NONE, ZYDIS_REGISTER_NONE, ZYDIS_REGISTER_NONE, ZYDIS_REGISTER_NONE
1291 };
1292 operand->mem.base = bases[modrm_rm];
1293 operand->mem.index = indices[modrm_rm];
1294 operand->mem.scale = (operand->mem.index == ZYDIS_REGISTER_NONE) ? 0 : 1;
1295 switch (instruction->raw.modrm.mod)
1296 {
1297 case 0:
1298 if (modrm_rm == 6)
1299 {
1300 displacement_size = 16;
1301 operand->mem.base = ZYDIS_REGISTER_NONE;
1302 }
1303 break;
1304 case 1:
1305 displacement_size = 8;
1306 break;
1307 case 2:
1308 displacement_size = 16;
1309 break;
1310 default:
1311 ZYAN_UNREACHABLE;
1312 }
1313 break;
1314 }
1315 case 32:
1316 {
1317 operand->mem.base = ZYDIS_REGISTER_EAX + ZydisCalcRegisterId(context, instruction,
1318 ZYDIS_REG_ENCODING_BASE, ZYDIS_REGCLASS_GPR32);
1319 switch (instruction->raw.modrm.mod)
1320 {
1321 case 0:
1322 if (modrm_rm == 5)
1323 {
1324 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
1325 {
1326 operand->mem.base = ZYDIS_REGISTER_EIP;
1327 } else
1328 {
1329 operand->mem.base = ZYDIS_REGISTER_NONE;
1330 }
1331 displacement_size = 32;
1332 }
1333 break;
1334 case 1:
1335 displacement_size = 8;
1336 break;
1337 case 2:
1338 displacement_size = 32;
1339 break;
1340 default:
1341 ZYAN_UNREACHABLE;
1342 }
1343 if (modrm_rm == 4)
1344 {
1345 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_SIB);
1346 operand->mem.index =
1347 ZydisRegisterEncode(vidx_register_class ? vidx_register_class : ZYDIS_REGCLASS_GPR32,
1348 ZydisCalcRegisterId(context, instruction,
1349 vidx_register_class ? ZYDIS_REG_ENCODING_VIDX : ZYDIS_REG_ENCODING_INDEX,
1350 vidx_register_class ? vidx_register_class : ZYDIS_REGCLASS_GPR32));
1351 operand->mem.scale = (1 << instruction->raw.sib.scale);
1352 if (operand->mem.index == ZYDIS_REGISTER_ESP)
1353 {
1354 operand->mem.index = ZYDIS_REGISTER_NONE;
1355 operand->mem.scale = 0;
1356 }
1357 if (operand->mem.base == ZYDIS_REGISTER_EBP)
1358 {
1359 if (instruction->raw.modrm.mod == 0)
1360 {
1361 operand->mem.base = ZYDIS_REGISTER_NONE;
1362 }
1363 displacement_size = (instruction->raw.modrm.mod == 1) ? 8 : 32;
1364 }
1365 } else
1366 {
1367 operand->mem.index = ZYDIS_REGISTER_NONE;
1368 operand->mem.scale = 0;
1369 }
1370 break;
1371 }
1372 case 64:
1373 {
1374 operand->mem.base = ZYDIS_REGISTER_RAX + ZydisCalcRegisterId(context, instruction,
1375 ZYDIS_REG_ENCODING_BASE, ZYDIS_REGCLASS_GPR64);
1376 switch (instruction->raw.modrm.mod)
1377 {
1378 case 0:
1379 if (modrm_rm == 5)
1380 {
1381 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
1382 {
1383 operand->mem.base = ZYDIS_REGISTER_RIP;
1384 } else
1385 {
1386 operand->mem.base = ZYDIS_REGISTER_NONE;
1387 }
1388 displacement_size = 32;
1389 }
1390 break;
1391 case 1:
1392 displacement_size = 8;
1393 break;
1394 case 2:
1395 displacement_size = 32;
1396 break;
1397 default:
1398 ZYAN_UNREACHABLE;
1399 }
1400 if ((modrm_rm & 0x07) == 4)
1401 {
1402 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_SIB);
1403 operand->mem.index =
1404 ZydisRegisterEncode(vidx_register_class ? vidx_register_class : ZYDIS_REGCLASS_GPR64,
1405 ZydisCalcRegisterId(context, instruction,
1406 vidx_register_class ? ZYDIS_REG_ENCODING_VIDX : ZYDIS_REG_ENCODING_INDEX,
1407 vidx_register_class ? vidx_register_class : ZYDIS_REGCLASS_GPR64));
1408 operand->mem.scale = (1 << instruction->raw.sib.scale);
1409 if (operand->mem.index == ZYDIS_REGISTER_RSP)
1410 {
1411 operand->mem.index = ZYDIS_REGISTER_NONE;
1412 operand->mem.scale = 0;
1413 }
1414 if ((operand->mem.base == ZYDIS_REGISTER_RBP) ||
1415 (operand->mem.base == ZYDIS_REGISTER_R13))
1416 {
1417 if (instruction->raw.modrm.mod == 0)
1418 {
1419 operand->mem.base = ZYDIS_REGISTER_NONE;
1420 }
1421 displacement_size = (instruction->raw.modrm.mod == 1) ? 8 : 32;
1422 }
1423 } else
1424 {
1425 operand->mem.index = ZYDIS_REGISTER_NONE;
1426 operand->mem.scale = 0;
1427 }
1428 break;
1429 }
1430 default:
1431 ZYAN_UNREACHABLE;
1432 }
1433 if (displacement_size)
1434 {
1435 ZYAN_ASSERT(instruction->raw.disp.size == displacement_size);
1436 operand->mem.disp.has_displacement = ZYAN_TRUE;
1437 operand->mem.disp.value = instruction->raw.disp.value;
1438 }
1439 return ZYAN_STATUS_SUCCESS;
1440 }
1441 #endif
1442
1443 #ifndef ZYDIS_MINIMAL_MODE
1444 /**
1445 * Decodes an implicit register operand.
1446 *
1447 * @param decoder A pointer to the `ZydisDecoder` instance.
1448 * @param context A pointer to the `ZydisDecoderContext` struct.
1449 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
1450 * @param operand A pointer to the `ZydisDecodedOperand` struct.
1451 * @param definition A pointer to the `ZydisOperandDefinition` struct.
1452 */
1453 static void ZydisDecodeOperandImplicitRegister(const ZydisDecoder* decoder,
1454 const ZydisDecoderContext* context, const ZydisDecodedInstruction* instruction,
1455 ZydisDecodedOperand* operand, const ZydisOperandDefinition* definition)
1456 {
1457 ZYAN_ASSERT(context);
1458 ZYAN_ASSERT(instruction);
1459 ZYAN_ASSERT(operand);
1460 ZYAN_ASSERT(definition);
1461
1462 operand->type = ZYDIS_OPERAND_TYPE_REGISTER;
1463
1464 switch (definition->op.reg.type)
1465 {
1466 case ZYDIS_IMPLREG_TYPE_STATIC:
1467 operand->reg.value = definition->op.reg.reg.reg;
1468 break;
1469 case ZYDIS_IMPLREG_TYPE_GPR_OSZ:
1470 {
1471 static const ZydisRegisterClass lookup[3] =
1472 {
1473 ZYDIS_REGCLASS_GPR16,
1474 ZYDIS_REGCLASS_GPR32,
1475 ZYDIS_REGCLASS_GPR64
1476 };
1477 operand->reg.value =
1478 ZydisRegisterEncode(lookup[context->eosz_index], definition->op.reg.reg.id);
1479 break;
1480 }
1481 case ZYDIS_IMPLREG_TYPE_GPR_ASZ:
1482 operand->reg.value = ZydisRegisterEncode(
1483 (instruction->address_width == 16) ? ZYDIS_REGCLASS_GPR16 :
1484 (instruction->address_width == 32) ? ZYDIS_REGCLASS_GPR32 : ZYDIS_REGCLASS_GPR64,
1485 definition->op.reg.reg.id);
1486 break;
1487 case ZYDIS_IMPLREG_TYPE_IP_ASZ:
1488 operand->reg.value =
1489 (instruction->address_width == 16) ? ZYDIS_REGISTER_IP :
1490 (instruction->address_width == 32) ? ZYDIS_REGISTER_EIP : ZYDIS_REGISTER_RIP;
1491 break;
1492 case ZYDIS_IMPLREG_TYPE_GPR_SSZ:
1493 operand->reg.value = ZydisRegisterEncode(
1494 (decoder->stack_width == ZYDIS_STACK_WIDTH_16) ? ZYDIS_REGCLASS_GPR16 :
1495 (decoder->stack_width == ZYDIS_STACK_WIDTH_32) ? ZYDIS_REGCLASS_GPR32 :
1496 ZYDIS_REGCLASS_GPR64,
1497 definition->op.reg.reg.id);
1498 break;
1499 case ZYDIS_IMPLREG_TYPE_IP_SSZ:
1500 operand->reg.value =
1501 (decoder->stack_width == ZYDIS_STACK_WIDTH_16) ? ZYDIS_REGISTER_EIP :
1502 (decoder->stack_width == ZYDIS_STACK_WIDTH_32) ? ZYDIS_REGISTER_EIP :
1503 ZYDIS_REGISTER_RIP;
1504 break;
1505 case ZYDIS_IMPLREG_TYPE_FLAGS_SSZ:
1506 operand->reg.value =
1507 (decoder->stack_width == ZYDIS_STACK_WIDTH_16) ? ZYDIS_REGISTER_FLAGS :
1508 (decoder->stack_width == ZYDIS_STACK_WIDTH_32) ? ZYDIS_REGISTER_EFLAGS :
1509 ZYDIS_REGISTER_RFLAGS;
1510 break;
1511 default:
1512 ZYAN_UNREACHABLE;
1513 }
1514 }
1515 #endif
1516
1517 #ifndef ZYDIS_MINIMAL_MODE
1518 /**
1519 * Decodes an implicit memory operand.
1520 *
1521 * @param decoder A pointer to the `ZydisDecoder` instance.
1522 * @param context A pointer to the `ZydisDecoderContext` struct.
1523 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
1524 * @param operand A pointer to the `ZydisDecodedOperand` struct.
1525 * @param definition A pointer to the `ZydisOperandDefinition` struct.
1526 */
1527 static void ZydisDecodeOperandImplicitMemory(const ZydisDecoder* decoder,
1528 const ZydisDecoderContext* context, const ZydisDecodedInstruction* instruction,
1529 ZydisDecodedOperand* operand, const ZydisOperandDefinition* definition)
1530 {
1531 ZYAN_ASSERT(context);
1532 ZYAN_ASSERT(operand);
1533 ZYAN_ASSERT(definition);
1534
1535 static const ZydisRegisterClass lookup[3] =
1536 {
1537 ZYDIS_REGCLASS_GPR16,
1538 ZYDIS_REGCLASS_GPR32,
1539 ZYDIS_REGCLASS_GPR64
1540 };
1541
1542 operand->type = ZYDIS_OPERAND_TYPE_MEMORY;
1543 operand->mem.type = ZYDIS_MEMOP_TYPE_MEM;
1544
1545 switch (definition->op.mem.base)
1546 {
1547 case ZYDIS_IMPLMEM_BASE_AGPR_REG:
1548 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index],
1549 ZydisCalcRegisterId(context, instruction, ZYDIS_REG_ENCODING_REG,
1550 lookup[context->easz_index]));
1551 break;
1552 case ZYDIS_IMPLMEM_BASE_AGPR_RM:
1553 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index],
1554 ZydisCalcRegisterId(context, instruction, ZYDIS_REG_ENCODING_RM,
1555 lookup[context->easz_index]));
1556 break;
1557 case ZYDIS_IMPLMEM_BASE_AAX:
1558 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index], 0);
1559 break;
1560 case ZYDIS_IMPLMEM_BASE_ADX:
1561 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index], 2);
1562 break;
1563 case ZYDIS_IMPLMEM_BASE_ABX:
1564 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index], 3);
1565 break;
1566 case ZYDIS_IMPLMEM_BASE_ASI:
1567 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index], 6);
1568 break;
1569 case ZYDIS_IMPLMEM_BASE_ADI:
1570 operand->mem.base = ZydisRegisterEncode(lookup[context->easz_index], 7);
1571 break;
1572 case ZYDIS_IMPLMEM_BASE_SSP:
1573 operand->mem.base = ZydisRegisterEncode(lookup[decoder->stack_width], 4);
1574 break;
1575 case ZYDIS_IMPLMEM_BASE_SBP:
1576 operand->mem.base = ZydisRegisterEncode(lookup[decoder->stack_width], 5);
1577 break;
1578 default:
1579 ZYAN_UNREACHABLE;
1580 }
1581
1582 if (definition->op.mem.seg)
1583 {
1584 operand->mem.segment =
1585 ZydisRegisterEncode(ZYDIS_REGCLASS_SEGMENT, definition->op.mem.seg - 1);
1586 ZYAN_ASSERT(operand->mem.segment);
1587 }
1588 }
1589 #endif
1590
1591 #ifndef ZYDIS_MINIMAL_MODE
1592 static ZyanStatus ZydisDecodeOperands(const ZydisDecoder* decoder, const ZydisDecoderContext* context,
1593 const ZydisDecodedInstruction* instruction, ZydisDecodedOperand* operands, ZyanU8 operand_count)
1594 {
1595 ZYAN_ASSERT(decoder);
1596 ZYAN_ASSERT(context);
1597 ZYAN_ASSERT(context->definition);
1598 ZYAN_ASSERT(instruction);
1599 ZYAN_ASSERT(operands);
1600 ZYAN_ASSERT(operand_count);
1601 ZYAN_ASSERT(operand_count <= instruction->operand_count);
1602
1603 const ZydisInstructionDefinition* definition = context->definition;
1604 const ZydisOperandDefinition* operand = ZydisGetOperandDefinitions(definition);
1605
1606 ZYAN_MEMSET(operands, 0, sizeof(ZydisDecodedOperand) * operand_count);
1607
1608 ZyanU8 imm_id = 0;
1609 for (ZyanU8 i = 0; i < operand_count; ++i)
1610 {
1611 ZydisRegisterClass register_class = ZYDIS_REGCLASS_INVALID;
1612
1613 operands[i].id = i;
1614 operands[i].visibility = operand->visibility;
1615 operands[i].actions = operand->actions;
1616 ZYAN_ASSERT(!(operand->actions &
1617 ZYDIS_OPERAND_ACTION_READ & ZYDIS_OPERAND_ACTION_CONDREAD) ||
1618 (operand->actions & ZYDIS_OPERAND_ACTION_READ) ^
1619 (operand->actions & ZYDIS_OPERAND_ACTION_CONDREAD));
1620 ZYAN_ASSERT(!(operand->actions &
1621 ZYDIS_OPERAND_ACTION_WRITE & ZYDIS_OPERAND_ACTION_CONDWRITE) ||
1622 (operand->actions & ZYDIS_OPERAND_ACTION_WRITE) ^
1623 (operand->actions & ZYDIS_OPERAND_ACTION_CONDWRITE));
1624
1625 // Implicit operands
1626 switch (operand->type)
1627 {
1628 case ZYDIS_SEMANTIC_OPTYPE_IMPLICIT_REG:
1629 ZydisDecodeOperandImplicitRegister(decoder, context, instruction, &operands[i], operand);
1630 break;
1631 case ZYDIS_SEMANTIC_OPTYPE_IMPLICIT_MEM:
1632 ZydisDecodeOperandImplicitMemory(decoder, context, instruction, &operands[i], operand);
1633 break;
1634 case ZYDIS_SEMANTIC_OPTYPE_IMPLICIT_IMM1:
1635 operands[i].type = ZYDIS_OPERAND_TYPE_IMMEDIATE;
1636 operands[i].size = 8;
1637 operands[i].imm.value.u = 1;
1638 operands[i].imm.is_signed = ZYAN_FALSE;
1639 operands[i].imm.is_relative = ZYAN_FALSE;
1640 break;
1641 default:
1642 break;
1643 }
1644 if (operands[i].type)
1645 {
1646 goto FinalizeOperand;
1647 }
1648
1649 operands[i].encoding = operand->op.encoding;
1650
1651 // Register operands
1652 switch (operand->type)
1653 {
1654 case ZYDIS_SEMANTIC_OPTYPE_GPR8:
1655 register_class = ZYDIS_REGCLASS_GPR8;
1656 break;
1657 case ZYDIS_SEMANTIC_OPTYPE_GPR16:
1658 register_class = ZYDIS_REGCLASS_GPR16;
1659 break;
1660 case ZYDIS_SEMANTIC_OPTYPE_GPR32:
1661 register_class = ZYDIS_REGCLASS_GPR32;
1662 break;
1663 case ZYDIS_SEMANTIC_OPTYPE_GPR64:
1664 register_class = ZYDIS_REGCLASS_GPR64;
1665 break;
1666 case ZYDIS_SEMANTIC_OPTYPE_GPR16_32_64:
1667 ZYAN_ASSERT((instruction->operand_width == 16) || (instruction->operand_width == 32) ||
1668 (instruction->operand_width == 64));
1669 register_class =
1670 (instruction->operand_width == 16) ? ZYDIS_REGCLASS_GPR16 : (
1671 (instruction->operand_width == 32) ? ZYDIS_REGCLASS_GPR32 : ZYDIS_REGCLASS_GPR64);
1672 break;
1673 case ZYDIS_SEMANTIC_OPTYPE_GPR32_32_64:
1674 ZYAN_ASSERT((instruction->operand_width == 16) || (instruction->operand_width == 32) ||
1675 (instruction->operand_width == 64));
1676 register_class =
1677 (instruction->operand_width == 16) ? ZYDIS_REGCLASS_GPR32 : (
1678 (instruction->operand_width == 32) ? ZYDIS_REGCLASS_GPR32 : ZYDIS_REGCLASS_GPR64);
1679 break;
1680 case ZYDIS_SEMANTIC_OPTYPE_GPR16_32_32:
1681 ZYAN_ASSERT((instruction->operand_width == 16) || (instruction->operand_width == 32) ||
1682 (instruction->operand_width == 64));
1683 register_class =
1684 (instruction->operand_width == 16) ? ZYDIS_REGCLASS_GPR16 : ZYDIS_REGCLASS_GPR32;
1685 break;
1686 case ZYDIS_SEMANTIC_OPTYPE_GPR_ASZ:
1687 ZYAN_ASSERT((instruction->address_width == 16) || (instruction->address_width == 32) ||
1688 (instruction->address_width == 64));
1689 register_class =
1690 (instruction->address_width == 16) ? ZYDIS_REGCLASS_GPR16 : (
1691 (instruction->address_width == 32) ? ZYDIS_REGCLASS_GPR32 : ZYDIS_REGCLASS_GPR64);
1692 break;
1693 case ZYDIS_SEMANTIC_OPTYPE_FPR:
1694 register_class = ZYDIS_REGCLASS_X87;
1695 break;
1696 case ZYDIS_SEMANTIC_OPTYPE_MMX:
1697 register_class = ZYDIS_REGCLASS_MMX;
1698 break;
1699 case ZYDIS_SEMANTIC_OPTYPE_XMM:
1700 register_class = ZYDIS_REGCLASS_XMM;
1701 break;
1702 case ZYDIS_SEMANTIC_OPTYPE_YMM:
1703 register_class = ZYDIS_REGCLASS_YMM;
1704 break;
1705 case ZYDIS_SEMANTIC_OPTYPE_ZMM:
1706 register_class = ZYDIS_REGCLASS_ZMM;
1707 break;
1708 case ZYDIS_SEMANTIC_OPTYPE_TMM:
1709 register_class = ZYDIS_REGCLASS_TMM;
1710 break;
1711 case ZYDIS_SEMANTIC_OPTYPE_BND:
1712 register_class = ZYDIS_REGCLASS_BOUND;
1713 break;
1714 case ZYDIS_SEMANTIC_OPTYPE_SREG:
1715 register_class = ZYDIS_REGCLASS_SEGMENT;
1716 break;
1717 case ZYDIS_SEMANTIC_OPTYPE_CR:
1718 register_class = ZYDIS_REGCLASS_CONTROL;
1719 break;
1720 case ZYDIS_SEMANTIC_OPTYPE_DR:
1721 register_class = ZYDIS_REGCLASS_DEBUG;
1722 break;
1723 case ZYDIS_SEMANTIC_OPTYPE_MASK:
1724 register_class = ZYDIS_REGCLASS_MASK;
1725 break;
1726 default:
1727 break;
1728 }
1729 if (register_class)
1730 {
1731 switch (operand->op.encoding)
1732 {
1733 case ZYDIS_OPERAND_ENCODING_MODRM_REG:
1734 ZYAN_CHECK(
1735 ZydisDecodeOperandRegister(
1736 instruction, &operands[i], register_class,
1737 ZydisCalcRegisterId(
1738 context, instruction, ZYDIS_REG_ENCODING_REG, register_class)));
1739 break;
1740 case ZYDIS_OPERAND_ENCODING_MODRM_RM:
1741 ZYAN_CHECK(
1742 ZydisDecodeOperandRegister(
1743 instruction, &operands[i], register_class,
1744 ZydisCalcRegisterId(
1745 context, instruction, ZYDIS_REG_ENCODING_RM, register_class)));
1746 break;
1747 case ZYDIS_OPERAND_ENCODING_OPCODE:
1748 ZYAN_CHECK(
1749 ZydisDecodeOperandRegister(
1750 instruction, &operands[i], register_class,
1751 ZydisCalcRegisterId(
1752 context, instruction, ZYDIS_REG_ENCODING_OPCODE, register_class)));
1753 break;
1754 case ZYDIS_OPERAND_ENCODING_NDSNDD:
1755 ZYAN_CHECK(
1756 ZydisDecodeOperandRegister(
1757 instruction, &operands[i], register_class,
1758 ZydisCalcRegisterId(
1759 context, instruction, ZYDIS_REG_ENCODING_NDSNDD, register_class)));
1760 break;
1761 case ZYDIS_OPERAND_ENCODING_MASK:
1762 ZYAN_CHECK(
1763 ZydisDecodeOperandRegister(
1764 instruction, &operands[i], register_class,
1765 ZydisCalcRegisterId(
1766 context, instruction, ZYDIS_REG_ENCODING_MASK, register_class)));
1767 break;
1768 case ZYDIS_OPERAND_ENCODING_IS4:
1769 ZYAN_CHECK(
1770 ZydisDecodeOperandRegister(
1771 instruction, &operands[i], register_class,
1772 ZydisCalcRegisterId(
1773 context, instruction, ZYDIS_REG_ENCODING_IS4, register_class)));
1774 break;
1775 default:
1776 ZYAN_UNREACHABLE;
1777 }
1778
1779 if (operand->is_multisource4)
1780 {
1781 operands[i].attributes |= ZYDIS_OATTRIB_IS_MULTISOURCE4;
1782 }
1783
1784 goto FinalizeOperand;
1785 }
1786
1787 // Memory operands
1788 switch (operand->type)
1789 {
1790 case ZYDIS_SEMANTIC_OPTYPE_MEM:
1791 ZYAN_CHECK(
1792 ZydisDecodeOperandMemory(
1793 context, instruction, &operands[i], ZYDIS_REGCLASS_INVALID));
1794 break;
1795 case ZYDIS_SEMANTIC_OPTYPE_MEM_VSIBX:
1796 ZYAN_CHECK(
1797 ZydisDecodeOperandMemory(
1798 context, instruction, &operands[i], ZYDIS_REGCLASS_XMM));
1799 operands[i].mem.type = ZYDIS_MEMOP_TYPE_VSIB;
1800 break;
1801 case ZYDIS_SEMANTIC_OPTYPE_MEM_VSIBY:
1802 ZYAN_CHECK(
1803 ZydisDecodeOperandMemory(
1804 context, instruction, &operands[i], ZYDIS_REGCLASS_YMM));
1805 operands[i].mem.type = ZYDIS_MEMOP_TYPE_VSIB;
1806 break;
1807 case ZYDIS_SEMANTIC_OPTYPE_MEM_VSIBZ:
1808 ZYAN_CHECK(
1809 ZydisDecodeOperandMemory(
1810 context, instruction, &operands[i], ZYDIS_REGCLASS_ZMM));
1811 operands[i].mem.type = ZYDIS_MEMOP_TYPE_VSIB;
1812 break;
1813 case ZYDIS_SEMANTIC_OPTYPE_PTR:
1814 ZYAN_ASSERT((instruction->raw.imm[0].size == 16) ||
1815 (instruction->raw.imm[0].size == 32));
1816 ZYAN_ASSERT(instruction->raw.imm[1].size == 16);
1817 operands[i].type = ZYDIS_OPERAND_TYPE_POINTER;
1818 operands[i].ptr.offset = (ZyanU32)instruction->raw.imm[0].value.u;
1819 operands[i].ptr.segment = (ZyanU16)instruction->raw.imm[1].value.u;
1820 break;
1821 case ZYDIS_SEMANTIC_OPTYPE_AGEN:
1822 operands[i].actions = 0; // TODO: Remove after generator update
1823 ZYAN_CHECK(
1824 ZydisDecodeOperandMemory(
1825 context, instruction, &operands[i], ZYDIS_REGCLASS_INVALID));
1826 operands[i].mem.type = ZYDIS_MEMOP_TYPE_AGEN;
1827 break;
1828 case ZYDIS_SEMANTIC_OPTYPE_MOFFS:
1829 ZYAN_ASSERT(instruction->raw.disp.size);
1830 operands[i].type = ZYDIS_OPERAND_TYPE_MEMORY;
1831 operands[i].mem.type = ZYDIS_MEMOP_TYPE_MEM;
1832 operands[i].mem.disp.has_displacement = ZYAN_TRUE;
1833 operands[i].mem.disp.value = instruction->raw.disp.value;
1834 break;
1835 case ZYDIS_SEMANTIC_OPTYPE_MIB:
1836 operands[i].actions = 0; // TODO: Remove after generator update
1837 ZYAN_CHECK(
1838 ZydisDecodeOperandMemory(
1839 context, instruction, &operands[i], ZYDIS_REGCLASS_INVALID));
1840 operands[i].mem.type = ZYDIS_MEMOP_TYPE_MIB;
1841 break;
1842 default:
1843 break;
1844 }
1845 if (operands[i].type)
1846 {
1847 #if !defined(ZYDIS_DISABLE_AVX512) || !defined(ZYDIS_DISABLE_KNC)
1848 // Handle compressed 8-bit displacement
1849 if (((instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX) ||
1850 (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX)) &&
1851 (instruction->raw.disp.size == 8))
1852 {
1853 operands[i].mem.disp.value *= context->cd8_scale;
1854 }
1855 #endif
1856
1857 goto FinalizeOperand;
1858 }
1859
1860 // Immediate operands
1861 switch (operand->type)
1862 {
1863 case ZYDIS_SEMANTIC_OPTYPE_REL:
1864 ZYAN_ASSERT(instruction->raw.imm[imm_id].is_relative);
1865 ZYAN_FALLTHROUGH;
1866 case ZYDIS_SEMANTIC_OPTYPE_IMM:
1867 ZYAN_ASSERT((imm_id == 0) || (imm_id == 1));
1868 operands[i].type = ZYDIS_OPERAND_TYPE_IMMEDIATE;
1869 operands[i].size = operand->size[context->eosz_index] * 8;
1870 if (operand->op.encoding == ZYDIS_OPERAND_ENCODING_IS4)
1871 {
1872 // The upper half of the 8-bit immediate is used to encode a register specifier
1873 ZYAN_ASSERT(instruction->raw.imm[imm_id].size == 8);
1874 operands[i].imm.value.u = (ZyanU8)instruction->raw.imm[imm_id].value.u & 0x0F;
1875 }
1876 else
1877 {
1878 operands[i].imm.value.u = instruction->raw.imm[imm_id].value.u;
1879 }
1880 operands[i].imm.is_signed = instruction->raw.imm[imm_id].is_signed;
1881 operands[i].imm.is_relative = instruction->raw.imm[imm_id].is_relative;
1882 ++imm_id;
1883 break;
1884 default:
1885 break;
1886 }
1887 ZYAN_ASSERT(operands[i].type == ZYDIS_OPERAND_TYPE_IMMEDIATE);
1888
1889 FinalizeOperand:
1890 // Set segment-register for memory operands
1891 if (operands[i].type == ZYDIS_OPERAND_TYPE_MEMORY)
1892 {
1893 if (!operand->ignore_seg_override &&
1894 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_CS)
1895 {
1896 operands[i].mem.segment = ZYDIS_REGISTER_CS;
1897 }
1898 else
1899 if (!operand->ignore_seg_override &&
1900 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_SS)
1901 {
1902 operands[i].mem.segment = ZYDIS_REGISTER_SS;
1903 }
1904 else
1905 if (!operand->ignore_seg_override &&
1906 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_DS)
1907 {
1908 operands[i].mem.segment = ZYDIS_REGISTER_DS;
1909 }
1910 else
1911 if (!operand->ignore_seg_override &&
1912 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_ES)
1913 {
1914 operands[i].mem.segment = ZYDIS_REGISTER_ES;
1915 }
1916 else
1917 if (!operand->ignore_seg_override &&
1918 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_FS)
1919 {
1920 operands[i].mem.segment = ZYDIS_REGISTER_FS;
1921 }
1922 else
1923 if (!operand->ignore_seg_override &&
1924 instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT_GS)
1925 {
1926 operands[i].mem.segment = ZYDIS_REGISTER_GS;
1927 }
1928 else
1929 {
1930 if (operands[i].mem.segment == ZYDIS_REGISTER_NONE)
1931 {
1932 if ((operands[i].mem.base == ZYDIS_REGISTER_RSP) ||
1933 (operands[i].mem.base == ZYDIS_REGISTER_RBP) ||
1934 (operands[i].mem.base == ZYDIS_REGISTER_ESP) ||
1935 (operands[i].mem.base == ZYDIS_REGISTER_EBP) ||
1936 (operands[i].mem.base == ZYDIS_REGISTER_SP) ||
1937 (operands[i].mem.base == ZYDIS_REGISTER_BP))
1938 {
1939 operands[i].mem.segment = ZYDIS_REGISTER_SS;
1940 }
1941 else
1942 {
1943 operands[i].mem.segment = ZYDIS_REGISTER_DS;
1944 }
1945 }
1946 }
1947 }
1948
1949 ZydisSetOperandSizeAndElementInfo(context, instruction, &operands[i], operand);
1950 ++operand;
1951 }
1952
1953 #if !defined(ZYDIS_DISABLE_AVX512) || !defined(ZYDIS_DISABLE_KNC)
1954 // Fix operand-action for EVEX/MVEX instructions with merge-mask
1955 if (instruction->avx.mask.mode == ZYDIS_MASK_MODE_MERGING)
1956 {
1957 ZYAN_ASSERT(operand_count >= 1);
1958 switch (operands[0].actions)
1959 {
1960 case ZYDIS_OPERAND_ACTION_WRITE:
1961 if (operands[0].type == ZYDIS_OPERAND_TYPE_MEMORY)
1962 {
1963 operands[0].actions = ZYDIS_OPERAND_ACTION_CONDWRITE;
1964 }
1965 else
1966 {
1967 operands[0].actions = ZYDIS_OPERAND_ACTION_READ_CONDWRITE;
1968 }
1969 break;
1970 case ZYDIS_OPERAND_ACTION_READWRITE:
1971 operands[0].actions = ZYDIS_OPERAND_ACTION_READ_CONDWRITE;
1972 break;
1973 default:
1974 break;
1975 }
1976 }
1977 #endif
1978
1979 return ZYAN_STATUS_SUCCESS;
1980 }
1981 #endif
1982
1983 /* ---------------------------------------------------------------------------------------------- */
1984
1985 #ifndef ZYDIS_MINIMAL_MODE
1986 /**
1987 * Sets attributes for the given instruction.
1988 *
1989 * @param state A pointer to the `ZydisDecoderState` struct.
1990 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
1991 * @param definition A pointer to the `ZydisInstructionDefinition` struct.
1992 */
1993 static void ZydisSetAttributes(ZydisDecoderState* state, ZydisDecodedInstruction* instruction,
1994 const ZydisInstructionDefinition* definition)
1995 {
1996 ZYAN_ASSERT(state);
1997 ZYAN_ASSERT(instruction);
1998 ZYAN_ASSERT(definition);
1999
2000 if (definition->cpu_state != ZYDIS_RW_ACTION_NONE)
2001 {
2002 static const ZydisInstructionAttributes mapping[ZYDIS_RW_ACTION_MAX_VALUE + 1] =
2003 {
2004 /* NONE */ 0,
2005 /* READ */ ZYDIS_ATTRIB_CPU_STATE_CR,
2006 /* WRITE */ ZYDIS_ATTRIB_CPU_STATE_CW,
2007 /* READWRITE */ ZYDIS_ATTRIB_CPU_STATE_CR | ZYDIS_ATTRIB_CPU_STATE_CW
2008 };
2009 ZYAN_ASSERT(definition->cpu_state < ZYAN_ARRAY_LENGTH(mapping));
2010 instruction->attributes |= mapping[definition->cpu_state];
2011 }
2012
2013 if (definition->fpu_state != ZYDIS_RW_ACTION_NONE)
2014 {
2015 static const ZydisInstructionAttributes mapping[ZYDIS_RW_ACTION_MAX_VALUE + 1] =
2016 {
2017 /* NONE */ 0,
2018 /* READ */ ZYDIS_ATTRIB_FPU_STATE_CR,
2019 /* WRITE */ ZYDIS_ATTRIB_FPU_STATE_CW,
2020 /* READWRITE */ ZYDIS_ATTRIB_FPU_STATE_CR | ZYDIS_ATTRIB_FPU_STATE_CW
2021 };
2022 ZYAN_ASSERT(definition->fpu_state < ZYAN_ARRAY_LENGTH(mapping));
2023 instruction->attributes |= mapping[definition->fpu_state];
2024 }
2025
2026 if (definition->xmm_state != ZYDIS_RW_ACTION_NONE)
2027 {
2028 static const ZydisInstructionAttributes mapping[ZYDIS_RW_ACTION_MAX_VALUE + 1] =
2029 {
2030 /* NONE */ 0,
2031 /* READ */ ZYDIS_ATTRIB_XMM_STATE_CR,
2032 /* WRITE */ ZYDIS_ATTRIB_XMM_STATE_CW,
2033 /* READWRITE */ ZYDIS_ATTRIB_XMM_STATE_CR | ZYDIS_ATTRIB_XMM_STATE_CW
2034 };
2035 ZYAN_ASSERT(definition->xmm_state < ZYAN_ARRAY_LENGTH(mapping));
2036 instruction->attributes |= mapping[definition->xmm_state];
2037 }
2038
2039 switch (instruction->encoding)
2040 {
2041 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
2042 {
2043 const ZydisInstructionDefinitionLEGACY* def =
2044 (const ZydisInstructionDefinitionLEGACY*)definition;
2045
2046 if (def->is_privileged)
2047 {
2048 instruction->attributes |= ZYDIS_ATTRIB_IS_PRIVILEGED;
2049 }
2050 if (def->accepts_LOCK)
2051 {
2052 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_LOCK;
2053 if (state->prefixes.has_lock)
2054 {
2055 instruction->attributes |= ZYDIS_ATTRIB_HAS_LOCK;
2056 instruction->raw.prefixes[state->prefixes.offset_lock].type =
2057 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2058 }
2059 }
2060 if (def->accepts_REP)
2061 {
2062 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_REP;
2063 }
2064 if (def->accepts_REPEREPZ)
2065 {
2066 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_REPE;
2067 }
2068 if (def->accepts_REPNEREPNZ)
2069 {
2070 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_REPNE;
2071 }
2072 if (def->accepts_BOUND)
2073 {
2074 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_BND;
2075 }
2076 if (def->accepts_XACQUIRE)
2077 {
2078 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_XACQUIRE;
2079 }
2080 if (def->accepts_XRELEASE)
2081 {
2082 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_XRELEASE;
2083 }
2084 if (def->accepts_hle_without_lock)
2085 {
2086 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_HLE_WITHOUT_LOCK;
2087 }
2088
2089 switch (state->prefixes.group1)
2090 {
2091 case 0xF2:
2092 if (instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_REPNE)
2093 {
2094 instruction->attributes |= ZYDIS_ATTRIB_HAS_REPNE;
2095 break;
2096 }
2097 if (instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_XACQUIRE)
2098 {
2099 if ((instruction->attributes & ZYDIS_ATTRIB_HAS_LOCK) ||
2100 (def->accepts_hle_without_lock))
2101 {
2102 instruction->attributes |= ZYDIS_ATTRIB_HAS_XACQUIRE;
2103 break;
2104 }
2105 }
2106 if ((state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_MPX)) &&
2107 instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_BND)
2108 {
2109 instruction->attributes |= ZYDIS_ATTRIB_HAS_BND;
2110 break;
2111 }
2112 break;
2113 case 0xF3:
2114 if (instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_REP)
2115 {
2116 instruction->attributes |= ZYDIS_ATTRIB_HAS_REP;
2117 break;
2118 }
2119 if (instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_REPE)
2120 {
2121 instruction->attributes |= ZYDIS_ATTRIB_HAS_REPE;
2122 break;
2123 }
2124 if (instruction->attributes & ZYDIS_ATTRIB_ACCEPTS_XRELEASE)
2125 {
2126 if ((instruction->attributes & ZYDIS_ATTRIB_HAS_LOCK) ||
2127 (def->accepts_hle_without_lock))
2128 {
2129 instruction->attributes |= ZYDIS_ATTRIB_HAS_XRELEASE;
2130 break;
2131 }
2132 }
2133 break;
2134 default:
2135 break;
2136 }
2137 if ((instruction->raw.prefixes[state->prefixes.offset_group1].type ==
2138 ZYDIS_PREFIX_TYPE_IGNORED) &&
2139 (instruction->attributes & (
2140 ZYDIS_ATTRIB_HAS_REP | ZYDIS_ATTRIB_HAS_REPE | ZYDIS_ATTRIB_HAS_REPNE |
2141 ZYDIS_ATTRIB_HAS_BND | ZYDIS_ATTRIB_HAS_XACQUIRE | ZYDIS_ATTRIB_HAS_XRELEASE)))
2142 {
2143 instruction->raw.prefixes[state->prefixes.offset_group1].type =
2144 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2145 }
2146
2147 if (def->accepts_branch_hints)
2148 {
2149 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_BRANCH_HINTS;
2150 switch (state->prefixes.group2)
2151 {
2152 case 0x2E:
2153 instruction->attributes |= ZYDIS_ATTRIB_HAS_BRANCH_NOT_TAKEN;
2154 instruction->raw.prefixes[state->prefixes.offset_group2].type =
2155 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2156 break;
2157 case 0x3E:
2158 instruction->attributes |= ZYDIS_ATTRIB_HAS_BRANCH_TAKEN;
2159 instruction->raw.prefixes[state->prefixes.offset_group2].type =
2160 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2161 break;
2162 default:
2163 break;
2164 }
2165 }
2166
2167 if (def->accepts_NOTRACK)
2168 {
2169 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_NOTRACK;
2170 if ((state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_CET)) &&
2171 (state->prefixes.offset_notrack >= 0))
2172 {
2173 instruction->attributes |= ZYDIS_ATTRIB_HAS_NOTRACK;
2174 instruction->raw.prefixes[state->prefixes.offset_notrack].type =
2175 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2176 }
2177 }
2178
2179 if (def->accepts_segment && !def->accepts_branch_hints)
2180 {
2181 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_SEGMENT;
2182 if (state->prefixes.effective_segment &&
2183 !(instruction->attributes & ZYDIS_ATTRIB_HAS_NOTRACK))
2184 {
2185 switch (state->prefixes.effective_segment)
2186 {
2187 case 0x2E:
2188 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_CS;
2189 break;
2190 case 0x36:
2191 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_SS;
2192 break;
2193 case 0x3E:
2194 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_DS;
2195 break;
2196 case 0x26:
2197 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_ES;
2198 break;
2199 case 0x64:
2200 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_FS;
2201 break;
2202 case 0x65:
2203 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_GS;
2204 break;
2205 default:
2206 ZYAN_UNREACHABLE;
2207 }
2208 }
2209 if (instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT)
2210 {
2211 instruction->raw.prefixes[state->prefixes.offset_segment].type =
2212 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2213 }
2214 }
2215
2216 break;
2217 }
2218 case ZYDIS_INSTRUCTION_ENCODING_3DNOW:
2219 case ZYDIS_INSTRUCTION_ENCODING_XOP:
2220 case ZYDIS_INSTRUCTION_ENCODING_VEX:
2221 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
2222 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
2223 if (definition->accepts_segment)
2224 {
2225 instruction->attributes |= ZYDIS_ATTRIB_ACCEPTS_SEGMENT;
2226 if (state->prefixes.effective_segment)
2227 {
2228 switch (state->prefixes.effective_segment)
2229 {
2230 case 0x2E:
2231 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_CS;
2232 break;
2233 case 0x36:
2234 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_SS;
2235 break;
2236 case 0x3E:
2237 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_DS;
2238 break;
2239 case 0x26:
2240 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_ES;
2241 break;
2242 case 0x64:
2243 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_FS;
2244 break;
2245 case 0x65:
2246 instruction->attributes |= ZYDIS_ATTRIB_HAS_SEGMENT_GS;
2247 break;
2248 default:
2249 ZYAN_UNREACHABLE;
2250 }
2251 }
2252 if (instruction->attributes & ZYDIS_ATTRIB_HAS_SEGMENT)
2253 {
2254 instruction->raw.prefixes[state->prefixes.offset_segment].type =
2255 ZYDIS_PREFIX_TYPE_EFFECTIVE;
2256 }
2257 }
2258 break;
2259 default:
2260 ZYAN_UNREACHABLE;
2261 }
2262 }
2263 #endif
2264
2265 #ifndef ZYDIS_MINIMAL_MODE
2266 /**
2267 * Sets AVX-specific information for the given instruction.
2268 *
2269 * @param context A pointer to the `ZydisDecoderContext` struct.
2270 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
2271 * @param definition A pointer to the `ZydisInstructionDefinition` struct.
2272 *
2273 * Information set for `XOP`:
2274 * - Vector Length
2275 *
2276 * Information set for `VEX`:
2277 * - Vector length
2278 * - Static broadcast-factor
2279 *
2280 * Information set for `EVEX`:
2281 * - Vector length
2282 * - Broadcast-factor (static and dynamic)
2283 * - Rounding-mode and SAE
2284 * - Mask mode
2285 * - Compressed 8-bit displacement scale-factor
2286 *
2287 * Information set for `MVEX`:
2288 * - Vector length
2289 * - Broadcast-factor (static and dynamic)
2290 * - Rounding-mode and SAE
2291 * - Swizzle- and conversion-mode
2292 * - Mask mode
2293 * - Eviction hint
2294 * - Compressed 8-bit displacement scale-factor
2295 */
2296 static void ZydisSetAVXInformation(ZydisDecoderContext* context,
2297 ZydisDecodedInstruction* instruction, const ZydisInstructionDefinition* definition)
2298 {
2299 ZYAN_ASSERT(context);
2300 ZYAN_ASSERT(instruction);
2301 ZYAN_ASSERT(definition);
2302
2303 switch (instruction->encoding)
2304 {
2305 case ZYDIS_INSTRUCTION_ENCODING_XOP:
2306 {
2307 // Vector length
2308 static const ZyanU16 lookup[2] =
2309 {
2310 128,
2311 256
2312 };
2313 ZYAN_ASSERT(context->vector_unified.LL < ZYAN_ARRAY_LENGTH(lookup));
2314 instruction->avx.vector_length = lookup[context->vector_unified.LL];
2315 break;
2316 }
2317 case ZYDIS_INSTRUCTION_ENCODING_VEX:
2318 {
2319 // Vector length
2320 static const ZyanU16 lookup[2] =
2321 {
2322 128,
2323 256
2324 };
2325 ZYAN_ASSERT(context->vector_unified.LL < ZYAN_ARRAY_LENGTH(lookup));
2326 instruction->avx.vector_length = lookup[context->vector_unified.LL];
2327
2328 // Static broadcast-factor
2329 const ZydisInstructionDefinitionVEX* def =
2330 (const ZydisInstructionDefinitionVEX*)definition;
2331 if (def->broadcast)
2332 {
2333 instruction->avx.broadcast.is_static = ZYAN_TRUE;
2334 static ZydisBroadcastMode broadcasts[ZYDIS_VEX_STATIC_BROADCAST_MAX_VALUE + 1] =
2335 {
2336 ZYDIS_BROADCAST_MODE_INVALID,
2337 ZYDIS_BROADCAST_MODE_1_TO_2,
2338 ZYDIS_BROADCAST_MODE_1_TO_4,
2339 ZYDIS_BROADCAST_MODE_1_TO_8,
2340 ZYDIS_BROADCAST_MODE_1_TO_16,
2341 ZYDIS_BROADCAST_MODE_1_TO_32,
2342 ZYDIS_BROADCAST_MODE_2_TO_4
2343 };
2344 instruction->avx.broadcast.mode = broadcasts[def->broadcast];
2345 }
2346 break;
2347 }
2348 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
2349 {
2350 #ifndef ZYDIS_DISABLE_AVX512
2351 const ZydisInstructionDefinitionEVEX* def =
2352 (const ZydisInstructionDefinitionEVEX*)definition;
2353
2354 // Vector length
2355 ZyanU8 vector_length = context->vector_unified.LL;
2356 if (def->vector_length)
2357 {
2358 vector_length = def->vector_length - 1;
2359 }
2360 static const ZyanU16 lookup[3] =
2361 {
2362 128,
2363 256,
2364 512
2365 };
2366 ZYAN_ASSERT(vector_length < ZYAN_ARRAY_LENGTH(lookup));
2367 instruction->avx.vector_length = lookup[vector_length];
2368
2369 context->evex.tuple_type = def->tuple_type;
2370 if (def->tuple_type)
2371 {
2372 ZYAN_ASSERT(instruction->raw.modrm.mod != 3);
2373 ZYAN_ASSERT(def->element_size);
2374
2375 // Element size
2376 static const ZyanU8 element_sizes[ZYDIS_IELEMENT_SIZE_MAX_VALUE + 1] =
2377 {
2378 0, 8, 16, 32, 64, 128
2379 };
2380 ZYAN_ASSERT(def->element_size < ZYAN_ARRAY_LENGTH(element_sizes));
2381 context->evex.element_size = element_sizes[def->element_size];
2382
2383 // Compressed disp8 scale and broadcast-factor
2384 switch (def->tuple_type)
2385 {
2386 case ZYDIS_TUPLETYPE_FV:
2387 {
2388 const ZyanU8 evex_b = instruction->raw.evex.b;
2389 ZYAN_ASSERT(evex_b < 2);
2390 ZYAN_ASSERT(!evex_b || ((!context->vector_unified.W && (context->evex.element_size == 16 ||
2391 context->evex.element_size == 32)) ||
2392 ( context->vector_unified.W && context->evex.element_size == 64)));
2393 ZYAN_ASSERT(!evex_b || def->functionality == ZYDIS_EVEX_FUNC_BC);
2394
2395 static const ZyanU8 scales[2][3][3] =
2396 {
2397 /*B0*/ { /*16*/ { 16, 32, 64 }, /*32*/ { 16, 32, 64 }, /*64*/ { 16, 32, 64 } },
2398 /*B1*/ { /*16*/ { 2, 2, 2 }, /*32*/ { 4, 4, 4 }, /*64*/ { 8, 8, 8 } }
2399 };
2400 static const ZydisBroadcastMode broadcasts[2][3][3] =
2401 {
2402 /*B0*/
2403 {
2404 /*16*/
2405 {
2406 ZYDIS_BROADCAST_MODE_INVALID,
2407 ZYDIS_BROADCAST_MODE_INVALID,
2408 ZYDIS_BROADCAST_MODE_INVALID
2409 },
2410 /*32*/
2411 {
2412 ZYDIS_BROADCAST_MODE_INVALID,
2413 ZYDIS_BROADCAST_MODE_INVALID,
2414 ZYDIS_BROADCAST_MODE_INVALID
2415 },
2416 /*64*/
2417 {
2418 ZYDIS_BROADCAST_MODE_INVALID,
2419 ZYDIS_BROADCAST_MODE_INVALID,
2420 ZYDIS_BROADCAST_MODE_INVALID
2421 }
2422 },
2423 /*B1*/
2424 {
2425 /*16*/
2426 {
2427 ZYDIS_BROADCAST_MODE_1_TO_8,
2428 ZYDIS_BROADCAST_MODE_1_TO_16,
2429 ZYDIS_BROADCAST_MODE_1_TO_32
2430 },
2431 /*32*/
2432 {
2433 ZYDIS_BROADCAST_MODE_1_TO_4,
2434 ZYDIS_BROADCAST_MODE_1_TO_8,
2435 ZYDIS_BROADCAST_MODE_1_TO_16
2436 },
2437 /*64*/
2438 {
2439 ZYDIS_BROADCAST_MODE_1_TO_2,
2440 ZYDIS_BROADCAST_MODE_1_TO_4,
2441 ZYDIS_BROADCAST_MODE_1_TO_8
2442 }
2443 }
2444 };
2445
2446 const ZyanU8 size_index = context->evex.element_size >> 5;
2447 ZYAN_ASSERT(size_index < 3);
2448
2449 context->cd8_scale = scales[evex_b][size_index][vector_length];
2450 instruction->avx.broadcast.mode = broadcasts[evex_b][size_index][vector_length];
2451 break;
2452 }
2453 case ZYDIS_TUPLETYPE_HV:
2454 {
2455 const ZyanU8 evex_b = instruction->raw.evex.b;
2456 ZYAN_ASSERT(evex_b < 2);
2457 ZYAN_ASSERT(!context->vector_unified.W);
2458 ZYAN_ASSERT((context->evex.element_size == 16) ||
2459 (context->evex.element_size == 32));
2460 ZYAN_ASSERT(!evex_b || def->functionality == ZYDIS_EVEX_FUNC_BC);
2461
2462 static const ZyanU8 scales[2][2][3] =
2463 {
2464 /*B0*/ { /*16*/ { 8, 16, 32 }, /*32*/ { 8, 16, 32 } },
2465 /*B1*/ { /*16*/ { 2, 2, 2 }, /*32*/ { 4, 4, 4 } }
2466 };
2467 static const ZydisBroadcastMode broadcasts[2][2][3] =
2468 {
2469 /*B0*/
2470 {
2471 /*16*/
2472 {
2473 ZYDIS_BROADCAST_MODE_INVALID,
2474 ZYDIS_BROADCAST_MODE_INVALID,
2475 ZYDIS_BROADCAST_MODE_INVALID
2476 },
2477 /*32*/
2478 {
2479 ZYDIS_BROADCAST_MODE_INVALID,
2480 ZYDIS_BROADCAST_MODE_INVALID,
2481 ZYDIS_BROADCAST_MODE_INVALID
2482 }
2483 },
2484 /*B1*/
2485 {
2486 /*16*/
2487 {
2488 ZYDIS_BROADCAST_MODE_1_TO_4,
2489 ZYDIS_BROADCAST_MODE_1_TO_8,
2490 ZYDIS_BROADCAST_MODE_1_TO_16
2491 },
2492 /*32*/
2493 {
2494 ZYDIS_BROADCAST_MODE_1_TO_2,
2495 ZYDIS_BROADCAST_MODE_1_TO_4,
2496 ZYDIS_BROADCAST_MODE_1_TO_8
2497 }
2498 }
2499 };
2500
2501 const ZyanU8 size_index = context->evex.element_size >> 5;
2502 ZYAN_ASSERT(size_index < 3);
2503
2504 context->cd8_scale = scales[evex_b][size_index][vector_length];
2505 instruction->avx.broadcast.mode = broadcasts[evex_b][size_index][vector_length];
2506 break;
2507 }
2508 case ZYDIS_TUPLETYPE_FVM:
2509 {
2510 static const ZyanU8 scales[3] =
2511 {
2512 16, 32, 64
2513 };
2514 context->cd8_scale = scales[vector_length];
2515 break;
2516 }
2517 case ZYDIS_TUPLETYPE_GSCAT:
2518 switch (context->vector_unified.W)
2519 {
2520 case 0:
2521 ZYAN_ASSERT(context->evex.element_size == 32);
2522 break;
2523 case 1:
2524 ZYAN_ASSERT(context->evex.element_size == 64);
2525 break;
2526 default:
2527 ZYAN_UNREACHABLE;
2528 }
2529 ZYAN_FALLTHROUGH;
2530 case ZYDIS_TUPLETYPE_T1S:
2531 {
2532 static const ZyanU8 scales[6] =
2533 {
2534 /* */ 0,
2535 /* 8*/ 1,
2536 /* 16*/ 2,
2537 /* 32*/ 4,
2538 /* 64*/ 8,
2539 /*128*/ 16,
2540 };
2541 ZYAN_ASSERT(def->element_size < ZYAN_ARRAY_LENGTH(scales));
2542 context->cd8_scale = scales[def->element_size];
2543 break;
2544 };
2545 case ZYDIS_TUPLETYPE_T1F:
2546 {
2547 static const ZyanU8 scales[3] =
2548 {
2549 /* 16*/ 2,
2550 /* 32*/ 4,
2551 /* 64*/ 8
2552 };
2553
2554 const ZyanU8 size_index = context->evex.element_size >> 5;
2555 ZYAN_ASSERT(size_index < 3);
2556
2557 context->cd8_scale = scales[size_index];
2558 break;
2559 }
2560 case ZYDIS_TUPLETYPE_T1_4X:
2561 ZYAN_ASSERT(context->evex.element_size == 32);
2562 ZYAN_ASSERT(context->vector_unified.W == 0);
2563 context->cd8_scale = 16;
2564 break;
2565 case ZYDIS_TUPLETYPE_T2:
2566 switch (context->vector_unified.W)
2567 {
2568 case 0:
2569 ZYAN_ASSERT(context->evex.element_size == 32);
2570 context->cd8_scale = 8;
2571 break;
2572 case 1:
2573 ZYAN_ASSERT(context->evex.element_size == 64);
2574 ZYAN_ASSERT((instruction->avx.vector_length == 256) ||
2575 (instruction->avx.vector_length == 512));
2576 context->cd8_scale = 16;
2577 break;
2578 default:
2579 ZYAN_UNREACHABLE;
2580 }
2581 break;
2582 case ZYDIS_TUPLETYPE_T4:
2583 switch (context->vector_unified.W)
2584 {
2585 case 0:
2586 ZYAN_ASSERT(context->evex.element_size == 32);
2587 ZYAN_ASSERT((instruction->avx.vector_length == 256) ||
2588 (instruction->avx.vector_length == 512));
2589 context->cd8_scale = 16;
2590 break;
2591 case 1:
2592 ZYAN_ASSERT(context->evex.element_size == 64);
2593 ZYAN_ASSERT(instruction->avx.vector_length == 512);
2594 context->cd8_scale = 32;
2595 break;
2596 default:
2597 ZYAN_UNREACHABLE;
2598 }
2599 break;
2600 case ZYDIS_TUPLETYPE_T8:
2601 ZYAN_ASSERT(!context->vector_unified.W);
2602 ZYAN_ASSERT(instruction->avx.vector_length == 512);
2603 ZYAN_ASSERT(context->evex.element_size == 32);
2604 context->cd8_scale = 32;
2605 break;
2606 case ZYDIS_TUPLETYPE_HVM:
2607 {
2608 static const ZyanU8 scales[3] =
2609 {
2610 8, 16, 32
2611 };
2612 context->cd8_scale = scales[vector_length];
2613 break;
2614 }
2615 case ZYDIS_TUPLETYPE_QVM:
2616 {
2617 static const ZyanU8 scales[3] =
2618 {
2619 4, 8, 16
2620 };
2621 context->cd8_scale = scales[vector_length];
2622 break;
2623 }
2624 case ZYDIS_TUPLETYPE_OVM:
2625 {
2626 static const ZyanU8 scales[3] =
2627 {
2628 2, 4, 8
2629 };
2630 context->cd8_scale = scales[vector_length];
2631 break;
2632 }
2633 case ZYDIS_TUPLETYPE_M128:
2634 context->cd8_scale = 16;
2635 break;
2636 case ZYDIS_TUPLETYPE_DUP:
2637 {
2638 static const ZyanU8 scales[3] =
2639 {
2640 8, 32, 64
2641 };
2642 context->cd8_scale = scales[vector_length];
2643 break;
2644 }
2645 case ZYDIS_TUPLETYPE_QUARTER:
2646 {
2647 const ZyanU8 evex_b = instruction->raw.evex.b;
2648 ZYAN_ASSERT(evex_b < 2);
2649 ZYAN_ASSERT(!context->vector_unified.W);
2650 ZYAN_ASSERT(context->evex.element_size == 16);
2651 ZYAN_ASSERT(!evex_b || def->functionality == ZYDIS_EVEX_FUNC_BC);
2652
2653 static const ZyanU8 scales[2][3] =
2654 {
2655 /*B0*/ { 4, 8, 16 },
2656 /*B1*/ { 2, 2, 2 }
2657 };
2658 static const ZydisBroadcastMode broadcasts[2][3] =
2659 {
2660 /*B0*/
2661 {
2662 ZYDIS_BROADCAST_MODE_INVALID,
2663 ZYDIS_BROADCAST_MODE_INVALID,
2664 ZYDIS_BROADCAST_MODE_INVALID
2665 },
2666 /*B1*/
2667 {
2668 ZYDIS_BROADCAST_MODE_1_TO_2,
2669 ZYDIS_BROADCAST_MODE_1_TO_4,
2670 ZYDIS_BROADCAST_MODE_1_TO_8
2671 }
2672 };
2673 context->cd8_scale = scales[evex_b][vector_length];
2674 instruction->avx.broadcast.mode = broadcasts[evex_b][vector_length];
2675 break;
2676 }
2677 default:
2678 ZYAN_UNREACHABLE;
2679 }
2680 } else
2681 {
2682 ZYAN_ASSERT(instruction->raw.modrm.mod == 3);
2683 }
2684
2685 // Static broadcast-factor
2686 if (def->broadcast)
2687 {
2688 ZYAN_ASSERT(!instruction->avx.broadcast.mode);
2689 instruction->avx.broadcast.is_static = ZYAN_TRUE;
2690 static const ZydisBroadcastMode broadcasts[ZYDIS_EVEX_STATIC_BROADCAST_MAX_VALUE + 1] =
2691 {
2692 ZYDIS_BROADCAST_MODE_INVALID,
2693 ZYDIS_BROADCAST_MODE_1_TO_2,
2694 ZYDIS_BROADCAST_MODE_1_TO_4,
2695 ZYDIS_BROADCAST_MODE_1_TO_8,
2696 ZYDIS_BROADCAST_MODE_1_TO_16,
2697 ZYDIS_BROADCAST_MODE_1_TO_32,
2698 ZYDIS_BROADCAST_MODE_1_TO_64,
2699 ZYDIS_BROADCAST_MODE_2_TO_4,
2700 ZYDIS_BROADCAST_MODE_2_TO_8,
2701 ZYDIS_BROADCAST_MODE_2_TO_16,
2702 ZYDIS_BROADCAST_MODE_4_TO_8,
2703 ZYDIS_BROADCAST_MODE_4_TO_16,
2704 ZYDIS_BROADCAST_MODE_8_TO_16
2705 };
2706 ZYAN_ASSERT(def->broadcast < ZYAN_ARRAY_LENGTH(broadcasts));
2707 instruction->avx.broadcast.mode = broadcasts[def->broadcast];
2708 }
2709
2710 // Rounding mode and SAE
2711 if (instruction->raw.evex.b)
2712 {
2713 switch (def->functionality)
2714 {
2715 case ZYDIS_EVEX_FUNC_INVALID:
2716 case ZYDIS_EVEX_FUNC_BC:
2717 // Noting to do here
2718 break;
2719 case ZYDIS_EVEX_FUNC_RC:
2720 instruction->avx.rounding.mode = ZYDIS_ROUNDING_MODE_RN + context->vector_unified.LL;
2721 ZYAN_FALLTHROUGH;
2722 case ZYDIS_EVEX_FUNC_SAE:
2723 instruction->avx.has_sae = ZYAN_TRUE;
2724 break;
2725 default:
2726 ZYAN_UNREACHABLE;
2727 }
2728 }
2729
2730 // Mask
2731 instruction->avx.mask.reg = ZYDIS_REGISTER_K0 + instruction->raw.evex.aaa;
2732 switch (def->mask_override)
2733 {
2734 case ZYDIS_MASK_OVERRIDE_DEFAULT:
2735 instruction->avx.mask.mode = ZYDIS_MASK_MODE_MERGING + instruction->raw.evex.z;
2736 break;
2737 case ZYDIS_MASK_OVERRIDE_ZEROING:
2738 instruction->avx.mask.mode = ZYDIS_MASK_MODE_ZEROING;
2739 break;
2740 case ZYDIS_MASK_OVERRIDE_CONTROL:
2741 instruction->avx.mask.mode = ZYDIS_MASK_MODE_CONTROL + instruction->raw.evex.z;
2742 break;
2743 default:
2744 ZYAN_UNREACHABLE;
2745 }
2746 if (!instruction->raw.evex.aaa)
2747 {
2748 instruction->avx.mask.mode = ZYDIS_MASK_MODE_DISABLED;
2749 }
2750 #else
2751 ZYAN_UNREACHABLE;
2752 #endif
2753 break;
2754 }
2755 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
2756 {
2757 #ifndef ZYDIS_DISABLE_KNC
2758 // Vector length
2759 instruction->avx.vector_length = 512;
2760
2761 const ZydisInstructionDefinitionMVEX* def =
2762 (const ZydisInstructionDefinitionMVEX*)definition;
2763
2764 // Static broadcast-factor
2765 ZyanU8 index = def->has_element_granularity;
2766 ZYAN_ASSERT(!index || !def->broadcast);
2767 if (!index && def->broadcast)
2768 {
2769 instruction->avx.broadcast.is_static = ZYAN_TRUE;
2770 switch (def->broadcast)
2771 {
2772 case ZYDIS_MVEX_STATIC_BROADCAST_1_TO_8:
2773 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_1_TO_8;
2774 index = 1;
2775 break;
2776 case ZYDIS_MVEX_STATIC_BROADCAST_1_TO_16:
2777 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_1_TO_16;
2778 index = 1;
2779 break;
2780 case ZYDIS_MVEX_STATIC_BROADCAST_4_TO_8:
2781 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_4_TO_8;
2782 index = 2;
2783 break;
2784 case ZYDIS_MVEX_STATIC_BROADCAST_4_TO_16:
2785 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_4_TO_16;
2786 index = 2;
2787 break;
2788 default:
2789 ZYAN_UNREACHABLE;
2790 }
2791 }
2792
2793 // Compressed disp8 scale and broadcast-factor
2794 switch (def->functionality)
2795 {
2796 case ZYDIS_MVEX_FUNC_IGNORED:
2797 case ZYDIS_MVEX_FUNC_INVALID:
2798 case ZYDIS_MVEX_FUNC_RC:
2799 case ZYDIS_MVEX_FUNC_SAE:
2800 case ZYDIS_MVEX_FUNC_SWIZZLE_32:
2801 case ZYDIS_MVEX_FUNC_SWIZZLE_64:
2802 // Nothing to do here
2803 break;
2804 case ZYDIS_MVEX_FUNC_F_32:
2805 case ZYDIS_MVEX_FUNC_I_32:
2806 case ZYDIS_MVEX_FUNC_F_64:
2807 case ZYDIS_MVEX_FUNC_I_64:
2808 context->cd8_scale = 64;
2809 break;
2810 case ZYDIS_MVEX_FUNC_SF_32:
2811 case ZYDIS_MVEX_FUNC_SF_32_BCST:
2812 case ZYDIS_MVEX_FUNC_SF_32_BCST_4TO16:
2813 case ZYDIS_MVEX_FUNC_UF_32:
2814 {
2815 static const ZyanU8 lookup[3][8] =
2816 {
2817 { 64, 4, 16, 32, 16, 16, 32, 32 },
2818 { 4, 0, 0, 2, 1, 1, 2, 2 },
2819 { 16, 0, 0, 8, 4, 4, 8, 8 }
2820 };
2821 ZYAN_ASSERT(instruction->raw.mvex.SSS < ZYAN_ARRAY_LENGTH(lookup[index]));
2822 context->cd8_scale = lookup[index][instruction->raw.mvex.SSS];
2823 break;
2824 }
2825 case ZYDIS_MVEX_FUNC_SI_32:
2826 case ZYDIS_MVEX_FUNC_UI_32:
2827 case ZYDIS_MVEX_FUNC_SI_32_BCST:
2828 case ZYDIS_MVEX_FUNC_SI_32_BCST_4TO16:
2829 {
2830 static const ZyanU8 lookup[3][8] =
2831 {
2832 { 64, 4, 16, 0, 16, 16, 32, 32 },
2833 { 4, 0, 0, 0, 1, 1, 2, 2 },
2834 { 16, 0, 0, 0, 4, 4, 8, 8 }
2835 };
2836 ZYAN_ASSERT(instruction->raw.mvex.SSS < ZYAN_ARRAY_LENGTH(lookup[index]));
2837 context->cd8_scale = lookup[index][instruction->raw.mvex.SSS];
2838 break;
2839 }
2840 case ZYDIS_MVEX_FUNC_SF_64:
2841 case ZYDIS_MVEX_FUNC_UF_64:
2842 case ZYDIS_MVEX_FUNC_SI_64:
2843 case ZYDIS_MVEX_FUNC_UI_64:
2844 {
2845 static const ZyanU8 lookup[3][3] =
2846 {
2847 { 64, 8, 32 },
2848 { 8, 0, 0 },
2849 { 32, 0, 0 }
2850 };
2851 ZYAN_ASSERT(instruction->raw.mvex.SSS < ZYAN_ARRAY_LENGTH(lookup[index]));
2852 context->cd8_scale = lookup[index][instruction->raw.mvex.SSS];
2853 break;
2854 }
2855 case ZYDIS_MVEX_FUNC_DF_32:
2856 case ZYDIS_MVEX_FUNC_DI_32:
2857 {
2858 static const ZyanU8 lookup[2][8] =
2859 {
2860 { 64, 0, 0, 32, 16, 16, 32, 32 },
2861 { 4, 0, 0, 2, 1, 1, 2, 2 }
2862 };
2863 ZYAN_ASSERT(index < 2);
2864 ZYAN_ASSERT(instruction->raw.mvex.SSS < ZYAN_ARRAY_LENGTH(lookup[index]));
2865 context->cd8_scale = lookup[index][instruction->raw.mvex.SSS];
2866 break;
2867 }
2868 case ZYDIS_MVEX_FUNC_DF_64:
2869 case ZYDIS_MVEX_FUNC_DI_64:
2870 {
2871 static const ZyanU8 lookup[2][1] =
2872 {
2873 { 64 },
2874 { 8 }
2875 };
2876 ZYAN_ASSERT(index < 2);
2877 ZYAN_ASSERT(instruction->raw.mvex.SSS < ZYAN_ARRAY_LENGTH(lookup[index]));
2878 context->cd8_scale = lookup[index][instruction->raw.mvex.SSS];
2879 break;
2880 }
2881 default:
2882 ZYAN_UNREACHABLE;
2883 }
2884
2885 // Rounding mode, sae, swizzle, convert
2886 context->mvex.functionality = def->functionality;
2887 switch (def->functionality)
2888 {
2889 case ZYDIS_MVEX_FUNC_IGNORED:
2890 case ZYDIS_MVEX_FUNC_INVALID:
2891 case ZYDIS_MVEX_FUNC_F_32:
2892 case ZYDIS_MVEX_FUNC_I_32:
2893 case ZYDIS_MVEX_FUNC_F_64:
2894 case ZYDIS_MVEX_FUNC_I_64:
2895 // Nothing to do here
2896 break;
2897 case ZYDIS_MVEX_FUNC_RC:
2898 instruction->avx.rounding.mode = ZYDIS_ROUNDING_MODE_RN + (instruction->raw.mvex.SSS & 3);
2899 ZYAN_FALLTHROUGH;
2900 case ZYDIS_MVEX_FUNC_SAE:
2901 if (instruction->raw.mvex.SSS >= 4)
2902 {
2903 instruction->avx.has_sae = ZYAN_TRUE;
2904 }
2905 break;
2906 case ZYDIS_MVEX_FUNC_SWIZZLE_32:
2907 case ZYDIS_MVEX_FUNC_SWIZZLE_64:
2908 instruction->avx.swizzle.mode = ZYDIS_SWIZZLE_MODE_DCBA + instruction->raw.mvex.SSS;
2909 break;
2910 case ZYDIS_MVEX_FUNC_SF_32:
2911 case ZYDIS_MVEX_FUNC_SF_32_BCST:
2912 case ZYDIS_MVEX_FUNC_SF_32_BCST_4TO16:
2913 switch (instruction->raw.mvex.SSS)
2914 {
2915 case 0:
2916 break;
2917 case 1:
2918 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_1_TO_16;
2919 break;
2920 case 2:
2921 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_4_TO_16;
2922 break;
2923 case 3:
2924 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_FLOAT16;
2925 break;
2926 case 4:
2927 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT8;
2928 break;
2929 case 5:
2930 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT8;
2931 break;
2932 case 6:
2933 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT16;
2934 break;
2935 case 7:
2936 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT16;
2937 break;
2938 default:
2939 ZYAN_UNREACHABLE;
2940 }
2941 break;
2942 case ZYDIS_MVEX_FUNC_SI_32:
2943 case ZYDIS_MVEX_FUNC_SI_32_BCST:
2944 case ZYDIS_MVEX_FUNC_SI_32_BCST_4TO16:
2945 switch (instruction->raw.mvex.SSS)
2946 {
2947 case 0:
2948 break;
2949 case 1:
2950 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_1_TO_16;
2951 break;
2952 case 2:
2953 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_4_TO_16;
2954 break;
2955 case 4:
2956 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT8;
2957 break;
2958 case 5:
2959 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT8;
2960 break;
2961 case 6:
2962 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT16;
2963 break;
2964 case 7:
2965 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT16;
2966 break;
2967 default:
2968 ZYAN_UNREACHABLE;
2969 }
2970 break;
2971 case ZYDIS_MVEX_FUNC_SF_64:
2972 case ZYDIS_MVEX_FUNC_SI_64:
2973 switch (instruction->raw.mvex.SSS)
2974 {
2975 case 0:
2976 break;
2977 case 1:
2978 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_1_TO_8;
2979 break;
2980 case 2:
2981 instruction->avx.broadcast.mode = ZYDIS_BROADCAST_MODE_4_TO_8;
2982 break;
2983 default:
2984 ZYAN_UNREACHABLE;
2985 }
2986 break;
2987 case ZYDIS_MVEX_FUNC_UF_32:
2988 case ZYDIS_MVEX_FUNC_DF_32:
2989 switch (instruction->raw.mvex.SSS)
2990 {
2991 case 0:
2992 break;
2993 case 3:
2994 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_FLOAT16;
2995 break;
2996 case 4:
2997 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT8;
2998 break;
2999 case 5:
3000 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT8;
3001 break;
3002 case 6:
3003 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT16;
3004 break;
3005 case 7:
3006 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT16;
3007 break;
3008 default:
3009 ZYAN_UNREACHABLE;
3010 }
3011 break;
3012 case ZYDIS_MVEX_FUNC_UF_64:
3013 case ZYDIS_MVEX_FUNC_DF_64:
3014 break;
3015 case ZYDIS_MVEX_FUNC_UI_32:
3016 case ZYDIS_MVEX_FUNC_DI_32:
3017 switch (instruction->raw.mvex.SSS)
3018 {
3019 case 0:
3020 break;
3021 case 4:
3022 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT8;
3023 break;
3024 case 5:
3025 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT8;
3026 break;
3027 case 6:
3028 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_UINT16;
3029 break;
3030 case 7:
3031 instruction->avx.conversion.mode = ZYDIS_CONVERSION_MODE_SINT16;
3032 break;
3033 default:
3034 ZYAN_UNREACHABLE;
3035 }
3036 break;
3037 case ZYDIS_MVEX_FUNC_UI_64:
3038 case ZYDIS_MVEX_FUNC_DI_64:
3039 break;
3040 default:
3041 ZYAN_UNREACHABLE;
3042 }
3043
3044 // Eviction hint
3045 if ((instruction->raw.modrm.mod != 3) && instruction->raw.mvex.E)
3046 {
3047 instruction->avx.has_eviction_hint = ZYAN_TRUE;
3048 }
3049
3050 // Mask
3051 instruction->avx.mask.mode = ZYDIS_MASK_MODE_MERGING;
3052 instruction->avx.mask.reg = ZYDIS_REGISTER_K0 + instruction->raw.mvex.kkk;
3053 #else
3054 ZYAN_UNREACHABLE;
3055 #endif
3056 break;
3057 }
3058 default:
3059 // Nothing to do here
3060 break;
3061 }
3062 }
3063 #endif
3064
3065 /* ---------------------------------------------------------------------------------------------- */
3066 /* Physical instruction decoding */
3067 /* ---------------------------------------------------------------------------------------------- */
3068
3069 /**
3070 * Collects optional instruction prefixes.
3071 *
3072 * @param state A pointer to the `ZydisDecoderState` struct.
3073 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
3074 *
3075 * @return A zyan status code.
3076 *
3077 * This function sets the corresponding flag for each prefix and automatically decodes the last
3078 * `REX`-prefix (if exists).
3079 */
3080 static ZyanStatus ZydisCollectOptionalPrefixes(ZydisDecoderState* state,
3081 ZydisDecodedInstruction* instruction)
3082 {
3083 ZYAN_ASSERT(state);
3084 ZYAN_ASSERT(instruction);
3085 ZYAN_ASSERT(instruction->raw.prefix_count == 0);
3086
3087 ZyanU8 rex = 0x00;
3088 ZyanU8 offset = 0;
3089 ZyanBool done = ZYAN_FALSE;
3090 do
3091 {
3092 ZyanU8 prefix_byte;
3093 ZYAN_CHECK(ZydisInputPeek(state, instruction, &prefix_byte));
3094 switch (prefix_byte)
3095 {
3096 case 0xF0:
3097 state->prefixes.has_lock = ZYAN_TRUE;
3098 state->prefixes.offset_lock = offset;
3099 break;
3100 case 0xF2:
3101 ZYAN_FALLTHROUGH;
3102 case 0xF3:
3103 state->prefixes.group1 = prefix_byte;
3104 state->prefixes.mandatory_candidate = prefix_byte;
3105 state->prefixes.offset_group1 = offset;
3106 state->prefixes.offset_mandatory = offset;
3107 break;
3108 case 0x2E:
3109 ZYAN_FALLTHROUGH;
3110 case 0x36:
3111 ZYAN_FALLTHROUGH;
3112 case 0x3E:
3113 ZYAN_FALLTHROUGH;
3114 case 0x26:
3115 if (state->decoder->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
3116 {
3117 if ((prefix_byte == 0x3E) &&
3118 (state->prefixes.effective_segment != 0x64) &&
3119 (state->prefixes.effective_segment != 0x65))
3120 {
3121 state->prefixes.offset_notrack = offset;
3122 }
3123 state->prefixes.group2 = prefix_byte;
3124 state->prefixes.offset_group2 = offset;
3125 break;
3126 }
3127 ZYAN_FALLTHROUGH;
3128 case 0x64:
3129 ZYAN_FALLTHROUGH;
3130 case 0x65:
3131 state->prefixes.group2 = prefix_byte;
3132 state->prefixes.offset_group2 = offset;
3133 state->prefixes.effective_segment = prefix_byte;
3134 state->prefixes.offset_segment = offset;
3135 state->prefixes.offset_notrack = -1;
3136 break;
3137 case 0x66:
3138 // context->prefixes.has_osz_override = ZYAN_TRUE;
3139 state->prefixes.offset_osz_override = offset;
3140 if (!state->prefixes.mandatory_candidate)
3141 {
3142 state->prefixes.mandatory_candidate = 0x66;
3143 state->prefixes.offset_mandatory = offset;
3144 }
3145 instruction->attributes |= ZYDIS_ATTRIB_HAS_OPERANDSIZE;
3146 break;
3147 case 0x67:
3148 // context->prefixes.has_asz_override = ZYAN_TRUE;
3149 state->prefixes.offset_asz_override = offset;
3150 instruction->attributes |= ZYDIS_ATTRIB_HAS_ADDRESSSIZE;
3151 break;
3152 default:
3153 if ((state->decoder->machine_mode == ZYDIS_MACHINE_MODE_LONG_64) &&
3154 (prefix_byte & 0xF0) == 0x40)
3155 {
3156 rex = prefix_byte;
3157 instruction->raw.rex.offset = offset;
3158 } else
3159 {
3160 done = ZYAN_TRUE;
3161 }
3162 break;
3163 }
3164 if (!done)
3165 {
3166 // Invalidate `REX`, if it's not the last legacy prefix
3167 if (rex && (rex != prefix_byte))
3168 {
3169 rex = 0x00;
3170 instruction->raw.rex.offset = 0;
3171 }
3172 instruction->raw.prefixes[instruction->raw.prefix_count++].value = prefix_byte;
3173 ZydisInputSkip(state, instruction);
3174 ++offset;
3175 }
3176 } while (!done);
3177
3178 if (instruction->attributes & ZYDIS_ATTRIB_HAS_OPERANDSIZE)
3179 {
3180 instruction->raw.prefixes[state->prefixes.offset_osz_override].type =
3181 ZYDIS_PREFIX_TYPE_EFFECTIVE;
3182 }
3183 if (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE)
3184 {
3185 instruction->raw.prefixes[state->prefixes.offset_asz_override].type =
3186 ZYDIS_PREFIX_TYPE_EFFECTIVE;
3187 }
3188 if (rex)
3189 {
3190 instruction->raw.prefixes[instruction->raw.rex.offset].type = ZYDIS_PREFIX_TYPE_EFFECTIVE;
3191 ZydisDecodeREX(state->context, instruction, rex);
3192 }
3193 if ((state->decoder->machine_mode != ZYDIS_MACHINE_MODE_LONG_64) &&
3194 (state->prefixes.group2 == 0x3E))
3195 {
3196 state->prefixes.offset_notrack = state->prefixes.offset_group2;
3197 }
3198
3199 return ZYAN_STATUS_SUCCESS;
3200 }
3201
3202 /**
3203 * Decodes optional instruction parts like the ModRM byte, the SIB byte and
3204 * additional displacements and/or immediate values.
3205 *
3206 * @param state A pointer to the `ZydisDecoderState` struct.
3207 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
3208 * @param info A pointer to the `ZydisInstructionEncodingInfo` struct.
3209 *
3210 * @return A zyan status code.
3211 */
3212 static ZyanStatus ZydisDecodeOptionalInstructionParts(ZydisDecoderState* state,
3213 ZydisDecodedInstruction* instruction, const ZydisInstructionEncodingInfo* info)
3214 {
3215 ZYAN_ASSERT(state);
3216 ZYAN_ASSERT(instruction);
3217 ZYAN_ASSERT(info);
3218
3219 ZydisDecoderContext* context = state->context;
3220
3221 if (info->flags & ZYDIS_INSTR_ENC_FLAG_HAS_MODRM)
3222 {
3223 if (!instruction->raw.modrm.offset)
3224 {
3225 instruction->raw.modrm.offset = instruction->length;
3226 ZyanU8 modrm_byte;
3227 ZYAN_CHECK(ZydisInputNext(state, instruction, &modrm_byte));
3228 ZydisDecodeModRM(instruction, modrm_byte);
3229 }
3230
3231 if (!(info->flags & ZYDIS_INSTR_ENC_FLAG_FORCE_REG_FORM))
3232 {
3233 ZyanU8 has_sib = 0;
3234 ZyanU8 displacement_size = 0;
3235 switch (instruction->address_width)
3236 {
3237 case 16:
3238 switch (instruction->raw.modrm.mod)
3239 {
3240 case 0:
3241 if (instruction->raw.modrm.rm == 6)
3242 {
3243 displacement_size = 16;
3244 }
3245 break;
3246 case 1:
3247 displacement_size = 8;
3248 break;
3249 case 2:
3250 displacement_size = 16;
3251 break;
3252 case 3:
3253 break;
3254 default:
3255 ZYAN_UNREACHABLE;
3256 }
3257 break;
3258 case 32:
3259 case 64:
3260 has_sib =
3261 (instruction->raw.modrm.mod != 3) && (instruction->raw.modrm.rm == 4);
3262 switch (instruction->raw.modrm.mod)
3263 {
3264 case 0:
3265 if (instruction->raw.modrm.rm == 5)
3266 {
3267 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
3268 {
3269 instruction->attributes |= ZYDIS_ATTRIB_IS_RELATIVE;
3270 }
3271 displacement_size = 32;
3272 }
3273 break;
3274 case 1:
3275 displacement_size = 8;
3276 break;
3277 case 2:
3278 displacement_size = 32;
3279 break;
3280 case 3:
3281 break;
3282 default:
3283 ZYAN_UNREACHABLE;
3284 }
3285 break;
3286 default:
3287 ZYAN_UNREACHABLE;
3288 }
3289 if (has_sib)
3290 {
3291 instruction->raw.sib.offset = instruction->length;
3292 ZyanU8 sib_byte;
3293 ZYAN_CHECK(ZydisInputNext(state, instruction, &sib_byte));
3294 ZydisDecodeSIB(instruction, sib_byte);
3295 if (instruction->raw.sib.base == 5)
3296 {
3297 displacement_size = (instruction->raw.modrm.mod == 1) ? 8 : 32;
3298 }
3299 }
3300 if (displacement_size)
3301 {
3302 ZYAN_CHECK(ZydisReadDisplacement(state, instruction, displacement_size));
3303 }
3304 }
3305
3306 context->reg_info.is_mod_reg = (instruction->raw.modrm.mod == 3) ||
3307 (info->flags & ZYDIS_INSTR_ENC_FLAG_FORCE_REG_FORM);
3308 }
3309
3310 if (info->flags & ZYDIS_INSTR_ENC_FLAG_HAS_DISP)
3311 {
3312 ZYAN_CHECK(ZydisReadDisplacement(
3313 state, instruction, info->disp.size[context->easz_index]));
3314 }
3315
3316 if (info->flags & ZYDIS_INSTR_ENC_FLAG_HAS_IMM0)
3317 {
3318 if (info->imm[0].is_relative)
3319 {
3320 instruction->attributes |= ZYDIS_ATTRIB_IS_RELATIVE;
3321 }
3322 ZYAN_CHECK(ZydisReadImmediate(state, instruction, 0,
3323 info->imm[0].size[context->eosz_index], info->imm[0].is_signed,
3324 info->imm[0].is_relative));
3325 }
3326
3327 if (info->flags & ZYDIS_INSTR_ENC_FLAG_HAS_IMM1)
3328 {
3329 ZYAN_ASSERT(!(info->flags & ZYDIS_INSTR_ENC_FLAG_HAS_DISP));
3330 ZYAN_CHECK(ZydisReadImmediate(state, instruction, 1,
3331 info->imm[1].size[context->eosz_index], info->imm[1].is_signed,
3332 info->imm[1].is_relative));
3333 }
3334
3335 return ZYAN_STATUS_SUCCESS;
3336 }
3337
3338 /* ---------------------------------------------------------------------------------------------- */
3339
3340 /**
3341 * Sets the effective operand size for the given instruction.
3342 *
3343 * @param context A pointer to the `ZydisDecoderContext` struct
3344 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
3345 * @param definition A pointer to the `ZydisInstructionDefinition` struct.
3346 */
3347 static void ZydisSetEffectiveOperandWidth(ZydisDecoderContext* context,
3348 ZydisDecodedInstruction* instruction, const ZydisInstructionDefinition* definition)
3349 {
3350 ZYAN_ASSERT(context);
3351 ZYAN_ASSERT(instruction);
3352 ZYAN_ASSERT(definition);
3353
3354 static const ZyanU8 operand_size_map[8][8] =
3355 {
3356 // Default for most instructions
3357 {
3358 16, // 16 __ W0
3359 32, // 16 66 W0
3360 32, // 32 __ W0
3361 16, // 32 66 W0
3362 32, // 64 __ W0
3363 16, // 64 66 W0
3364 64, // 64 __ W1
3365 64 // 64 66 W1
3366 },
3367 // Operand size is forced to 8-bit (this is done later to preserve the `eosz_index`)
3368 {
3369 16, // 16 __ W0
3370 32, // 16 66 W0
3371 32, // 32 __ W0
3372 16, // 32 66 W0
3373 32, // 64 __ W0
3374 16, // 64 66 W0
3375 64, // 64 __ W1
3376 64 // 64 66 W1
3377 },
3378 // Operand size override 0x66 is ignored
3379 {
3380 16, // 16 __ W0
3381 16, // 16 66 W0
3382 32, // 32 __ W0
3383 32, // 32 66 W0
3384 32, // 64 __ W0
3385 32, // 64 66 W0
3386 64, // 64 __ W1
3387 64 // 64 66 W1
3388 },
3389 // REX.W promotes to 32-bit instead of 64-bit
3390 {
3391 16, // 16 __ W0
3392 32, // 16 66 W0
3393 32, // 32 __ W0
3394 16, // 32 66 W0
3395 32, // 64 __ W0
3396 16, // 64 66 W0
3397 32, // 64 __ W1
3398 32 // 64 66 W1
3399 },
3400 // Operand size defaults to 64-bit in 64-bit mode
3401 {
3402 16, // 16 __ W0
3403 32, // 16 66 W0
3404 32, // 32 __ W0
3405 16, // 32 66 W0
3406 64, // 64 __ W0
3407 16, // 64 66 W0
3408 64, // 64 __ W1
3409 64 // 64 66 W1
3410 },
3411 // Operand size is forced to 64-bit in 64-bit mode
3412 {
3413 16, // 16 __ W0
3414 32, // 16 66 W0
3415 32, // 32 __ W0
3416 16, // 32 66 W0
3417 64, // 64 __ W0
3418 64, // 64 66 W0
3419 64, // 64 __ W1
3420 64 // 64 66 W1
3421 },
3422 // Operand size is forced to 32-bit, if no REX.W is present.
3423 {
3424 32, // 16 __ W0
3425 32, // 16 66 W0
3426 32, // 32 __ W0
3427 32, // 32 66 W0
3428 32, // 64 __ W0
3429 32, // 64 66 W0
3430 64, // 64 __ W1
3431 64 // 64 66 W1
3432 },
3433 // Operand size is forced to 64-bit in 64-bit mode and forced to 32-bit in all other modes.
3434 // This is used for e.g. `mov CR, GPR` and `mov GPR, CR`.
3435 {
3436 32, // 16 __ W0
3437 32, // 16 66 W0
3438 32, // 32 __ W0
3439 32, // 32 66 W0
3440 64, // 64 __ W0
3441 64, // 64 66 W0
3442 64, // 64 __ W1
3443 64 // 64 66 W1
3444 }
3445 };
3446
3447 ZyanU8 index = (instruction->attributes & ZYDIS_ATTRIB_HAS_OPERANDSIZE) ? 1 : 0;
3448 if ((instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_COMPAT_32) ||
3449 (instruction->machine_mode == ZYDIS_MACHINE_MODE_LEGACY_32))
3450 {
3451 index += 2;
3452 }
3453 else if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
3454 {
3455 index += 4;
3456 index += (context->vector_unified.W & 0x01) << 1;
3457 }
3458
3459 ZYAN_ASSERT(definition->operand_size_map < ZYAN_ARRAY_LENGTH(operand_size_map));
3460 ZYAN_ASSERT(index < ZYAN_ARRAY_LENGTH(operand_size_map[definition->operand_size_map]));
3461
3462 instruction->operand_width = operand_size_map[definition->operand_size_map][index];
3463 context->eosz_index = instruction->operand_width >> 5;
3464
3465 // TODO: Cleanup code and remove hardcoded condition
3466 if (definition->operand_size_map == 1)
3467 {
3468 instruction->operand_width = 8;
3469 }
3470 }
3471
3472 /**
3473 * Sets the effective address width for the given instruction.
3474 *
3475 * @param context A pointer to the `ZydisDecoderContext` struct.
3476 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
3477 * @param definition A pointer to the `ZydisInstructionDefinition` struct.
3478 */
3479 static void ZydisSetEffectiveAddressWidth(ZydisDecoderContext* context,
3480 ZydisDecodedInstruction* instruction, const ZydisInstructionDefinition* definition)
3481 {
3482 ZYAN_ASSERT(context);
3483 ZYAN_ASSERT(instruction);
3484
3485 static const ZyanU8 address_size_map[3][8] =
3486 {
3487 // Default for most instructions
3488 {
3489 16, // 16 __
3490 32, // 16 67
3491 32, // 32 __
3492 16, // 32 67
3493 64, // 64 __
3494 32 // 64 67
3495 },
3496 // The address-size override is ignored
3497 {
3498 16, // 16 __
3499 16, // 16 67
3500 32, // 32 __
3501 32, // 32 67
3502 64, // 64 __
3503 64 // 64 67
3504 },
3505 // The address-size is forced to 64-bit in 64-bit mode and 32-bit in non 64-bit mode. This
3506 // is used by e.g. `ENCLS`, `ENCLV`, `ENCLU`.
3507 {
3508 32, // 16 __
3509 32, // 16 67
3510 32, // 32 __
3511 32, // 32 67
3512 64, // 64 __
3513 64 // 64 67
3514 }
3515 };
3516
3517 ZyanU8 index = (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE) ? 1 : 0;
3518 if ((instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_COMPAT_32) ||
3519 (instruction->machine_mode == ZYDIS_MACHINE_MODE_LEGACY_32))
3520 {
3521 index += 2;
3522 }
3523 else if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
3524 {
3525 index += 4;
3526 }
3527
3528 ZYAN_ASSERT(definition->address_size_map < ZYAN_ARRAY_LENGTH(address_size_map));
3529 ZYAN_ASSERT(index < ZYAN_ARRAY_LENGTH(address_size_map[definition->address_size_map]));
3530
3531 instruction->address_width = address_size_map[definition->address_size_map][index];
3532 context->easz_index = instruction->address_width >> 5;
3533 }
3534
3535 /* ---------------------------------------------------------------------------------------------- */
3536
3537 static ZyanStatus ZydisNodeHandlerXOP(const ZydisDecodedInstruction* instruction, ZyanU16* index)
3538 {
3539 ZYAN_ASSERT(instruction);
3540 ZYAN_ASSERT(index);
3541
3542 switch (instruction->encoding)
3543 {
3544 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
3545 *index = 0;
3546 break;
3547 case ZYDIS_INSTRUCTION_ENCODING_XOP:
3548 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_XOP);
3549 *index = (instruction->raw.xop.m_mmmm - 0x08) + (instruction->raw.xop.pp * 3) + 1;
3550 break;
3551 default:
3552 ZYAN_UNREACHABLE;
3553 }
3554 return ZYAN_STATUS_SUCCESS;
3555 }
3556
3557 static ZyanStatus ZydisNodeHandlerVEX(const ZydisDecodedInstruction* instruction, ZyanU16* index)
3558 {
3559 ZYAN_ASSERT(instruction);
3560 ZYAN_ASSERT(index);
3561
3562 switch (instruction->encoding)
3563 {
3564 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
3565 *index = 0;
3566 break;
3567 case ZYDIS_INSTRUCTION_ENCODING_VEX:
3568 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX);
3569 *index = instruction->raw.vex.m_mmmm + (instruction->raw.vex.pp << 2) + 1;
3570 break;
3571 default:
3572 ZYAN_UNREACHABLE;
3573 }
3574 return ZYAN_STATUS_SUCCESS;
3575 }
3576
3577 static ZyanStatus ZydisNodeHandlerEMVEX(const ZydisDecodedInstruction* instruction, ZyanU16* index)
3578 {
3579 ZYAN_ASSERT(instruction);
3580 ZYAN_ASSERT(index);
3581
3582 switch (instruction->encoding)
3583 {
3584 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
3585 *index = 0;
3586 break;
3587 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
3588 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX);
3589 *index = instruction->raw.evex.mmm + (instruction->raw.evex.pp << 3) + 1;
3590 break;
3591 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
3592 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX);
3593 *index = instruction->raw.mvex.mmmm + (instruction->raw.mvex.pp << 2) + 33;
3594 break;
3595 default:
3596 ZYAN_UNREACHABLE;
3597 }
3598 return ZYAN_STATUS_SUCCESS;
3599 }
3600
3601 static ZyanStatus ZydisNodeHandlerOpcode(ZydisDecoderState* state,
3602 ZydisDecodedInstruction* instruction, ZyanU16* index)
3603 {
3604 ZYAN_ASSERT(state);
3605 ZYAN_ASSERT(instruction);
3606 ZYAN_ASSERT(index);
3607
3608 // Handle possible encoding-prefix and opcode-map changes
3609 switch (instruction->encoding)
3610 {
3611 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
3612 ZYAN_CHECK(ZydisInputNext(state, instruction, &instruction->opcode));
3613 switch (instruction->opcode_map)
3614 {
3615 case ZYDIS_OPCODE_MAP_DEFAULT:
3616 switch (instruction->opcode)
3617 {
3618 case 0x0F:
3619 instruction->opcode_map = ZYDIS_OPCODE_MAP_0F;
3620 break;
3621 case 0xC4:
3622 case 0xC5:
3623 case 0x62:
3624 {
3625 ZyanU8 next_input;
3626 ZYAN_CHECK(ZydisInputPeek(state, instruction, &next_input));
3627 if (((next_input & 0xF0) >= 0xC0) ||
3628 (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64))
3629 {
3630 if (instruction->attributes & ZYDIS_ATTRIB_HAS_REX)
3631 {
3632 return ZYDIS_STATUS_ILLEGAL_REX;
3633 }
3634 if (state->prefixes.has_lock)
3635 {
3636 return ZYDIS_STATUS_ILLEGAL_LOCK;
3637 }
3638 if (state->prefixes.mandatory_candidate)
3639 {
3640 return ZYDIS_STATUS_ILLEGAL_LEGACY_PFX;
3641 }
3642 ZyanU8 prefix_bytes[4] = { 0, 0, 0, 0 };
3643 prefix_bytes[0] = instruction->opcode;
3644 switch (instruction->opcode)
3645 {
3646 case 0xC4:
3647 instruction->raw.vex.offset = instruction->length - 1;
3648 // Read additional 3-byte VEX-prefix data
3649 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX));
3650 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, &prefix_bytes[1], 2));
3651 break;
3652 case 0xC5:
3653 instruction->raw.vex.offset = instruction->length - 1;
3654 // Read additional 2-byte VEX-prefix data
3655 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX));
3656 ZYAN_CHECK(ZydisInputNext(state, instruction, &prefix_bytes[1]));
3657 break;
3658 case 0x62:
3659 #if !defined(ZYDIS_DISABLE_AVX512) || !defined(ZYDIS_DISABLE_KNC)
3660 // Read additional EVEX/MVEX-prefix data
3661 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX));
3662 ZYAN_ASSERT(!(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX));
3663 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, &prefix_bytes[1], 3));
3664 break;
3665 #else
3666 return ZYDIS_STATUS_DECODING_ERROR;
3667 #endif
3668 default:
3669 ZYAN_UNREACHABLE;
3670 }
3671 switch (instruction->opcode)
3672 {
3673 case 0xC4:
3674 case 0xC5:
3675 // Decode VEX-prefix
3676 instruction->encoding = ZYDIS_INSTRUCTION_ENCODING_VEX;
3677 ZYAN_CHECK(ZydisDecodeVEX(state->context, instruction, prefix_bytes));
3678 instruction->opcode_map =
3679 ZYDIS_OPCODE_MAP_DEFAULT + instruction->raw.vex.m_mmmm;
3680 break;
3681 case 0x62:
3682 #if defined(ZYDIS_DISABLE_AVX512) && defined(ZYDIS_DISABLE_KNC)
3683 return ZYDIS_STATUS_DECODING_ERROR;
3684 #else
3685 switch ((prefix_bytes[2] >> 2) & 0x01)
3686 {
3687 case 0:
3688 #ifndef ZYDIS_DISABLE_KNC
3689 instruction->raw.mvex.offset = instruction->length - 4;
3690 // `KNC` instructions are only valid in 64-bit mode.
3691 // This condition catches the `MVEX` encoded ones to save a bunch of
3692 // `mode` filters in the data-tables.
3693 // `KNC` instructions with `VEX` encoding still require a `mode` filter.
3694 if (state->decoder->machine_mode != ZYDIS_MACHINE_MODE_LONG_64)
3695 {
3696 return ZYDIS_STATUS_DECODING_ERROR;
3697 }
3698 // Decode MVEX-prefix
3699 instruction->encoding = ZYDIS_INSTRUCTION_ENCODING_MVEX;
3700 ZYAN_CHECK(ZydisDecodeMVEX(state->context, instruction, prefix_bytes));
3701 instruction->opcode_map =
3702 ZYDIS_OPCODE_MAP_DEFAULT + instruction->raw.mvex.mmmm;
3703 break;
3704 #else
3705 return ZYDIS_STATUS_DECODING_ERROR;
3706 #endif
3707 case 1:
3708 #ifndef ZYDIS_DISABLE_AVX512
3709 instruction->raw.evex.offset = instruction->length - 4;
3710 // Decode EVEX-prefix
3711 instruction->encoding = ZYDIS_INSTRUCTION_ENCODING_EVEX;
3712 ZYAN_CHECK(ZydisDecodeEVEX(state->context, instruction, prefix_bytes));
3713 instruction->opcode_map =
3714 ZYDIS_OPCODE_MAP_DEFAULT + instruction->raw.evex.mmm;
3715 break;
3716 #else
3717 return ZYDIS_STATUS_DECODING_ERROR;
3718 #endif
3719 default:
3720 ZYAN_UNREACHABLE;
3721 }
3722 break;
3723 #endif
3724 default:
3725 ZYAN_UNREACHABLE;
3726 }
3727 }
3728 break;
3729 }
3730 case 0x8F:
3731 {
3732 ZyanU8 next_input;
3733 ZYAN_CHECK(ZydisInputPeek(state, instruction, &next_input));
3734 if ((next_input & 0x1F) >= 8)
3735 {
3736 if (instruction->attributes & ZYDIS_ATTRIB_HAS_REX)
3737 {
3738 return ZYDIS_STATUS_ILLEGAL_REX;
3739 }
3740 if (state->prefixes.has_lock)
3741 {
3742 return ZYDIS_STATUS_ILLEGAL_LOCK;
3743 }
3744 if (state->prefixes.mandatory_candidate)
3745 {
3746 return ZYDIS_STATUS_ILLEGAL_LEGACY_PFX;
3747 }
3748 instruction->raw.xop.offset = instruction->length - 1;
3749 ZyanU8 prefixBytes[3] = { 0x8F, 0x00, 0x00 };
3750 // Read additional xop-prefix data
3751 ZYAN_CHECK(ZydisInputNextBytes(state, instruction, &prefixBytes[1], 2));
3752 // Decode xop-prefix
3753 instruction->encoding = ZYDIS_INSTRUCTION_ENCODING_XOP;
3754 ZYAN_CHECK(ZydisDecodeXOP(state->context, instruction, prefixBytes));
3755 instruction->opcode_map =
3756 ZYDIS_OPCODE_MAP_XOP8 + instruction->raw.xop.m_mmmm - 0x08;
3757 }
3758 break;
3759 }
3760 default:
3761 break;
3762 }
3763 break;
3764 case ZYDIS_OPCODE_MAP_0F:
3765 switch (instruction->opcode)
3766 {
3767 case 0x0F:
3768 if (state->prefixes.has_lock)
3769 {
3770 return ZYDIS_STATUS_ILLEGAL_LOCK;
3771 }
3772 instruction->encoding = ZYDIS_INSTRUCTION_ENCODING_3DNOW;
3773 instruction->opcode_map = ZYDIS_OPCODE_MAP_0F0F;
3774 break;
3775 case 0x38:
3776 instruction->opcode_map = ZYDIS_OPCODE_MAP_0F38;
3777 break;
3778 case 0x3A:
3779 instruction->opcode_map = ZYDIS_OPCODE_MAP_0F3A;
3780 break;
3781 default:
3782 break;
3783 }
3784 break;
3785 case ZYDIS_OPCODE_MAP_0F38:
3786 case ZYDIS_OPCODE_MAP_0F3A:
3787 case ZYDIS_OPCODE_MAP_XOP8:
3788 case ZYDIS_OPCODE_MAP_XOP9:
3789 case ZYDIS_OPCODE_MAP_XOPA:
3790 // Nothing to do here
3791 break;
3792 default:
3793 ZYAN_UNREACHABLE;
3794 }
3795 break;
3796 case ZYDIS_INSTRUCTION_ENCODING_3DNOW:
3797 // All 3DNOW (0x0F 0x0F) instructions are using the same operand encoding. We just
3798 // decode a random (pi2fw) instruction and extract the actual opcode later.
3799 *index = 0x0C;
3800 return ZYAN_STATUS_SUCCESS;
3801 default:
3802 ZYAN_CHECK(ZydisInputNext(state, instruction, &instruction->opcode));
3803 break;
3804 }
3805
3806 *index = instruction->opcode;
3807 return ZYAN_STATUS_SUCCESS;
3808 }
3809
3810 static ZyanStatus ZydisNodeHandlerMode(const ZydisDecodedInstruction* instruction, ZyanU16* index)
3811 {
3812 ZYAN_ASSERT(instruction);
3813 ZYAN_ASSERT(index);
3814
3815 switch (instruction->machine_mode)
3816 {
3817 case ZYDIS_MACHINE_MODE_LONG_COMPAT_16:
3818 case ZYDIS_MACHINE_MODE_LEGACY_16:
3819 case ZYDIS_MACHINE_MODE_REAL_16:
3820 *index = 0;
3821 break;
3822 case ZYDIS_MACHINE_MODE_LONG_COMPAT_32:
3823 case ZYDIS_MACHINE_MODE_LEGACY_32:
3824 *index = 1;
3825 break;
3826 case ZYDIS_MACHINE_MODE_LONG_64:
3827 *index = 2;
3828 break;
3829 default:
3830 ZYAN_UNREACHABLE;
3831 }
3832 return ZYAN_STATUS_SUCCESS;
3833 }
3834
3835 static ZyanStatus ZydisNodeHandlerModeCompact(const ZydisDecodedInstruction* instruction,
3836 ZyanU16* index)
3837 {
3838 ZYAN_ASSERT(instruction);
3839 ZYAN_ASSERT(index);
3840
3841 *index = (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64) ? 0 : 1;
3842 return ZYAN_STATUS_SUCCESS;
3843 }
3844
3845 static ZyanStatus ZydisNodeHandlerModrmMod(ZydisDecoderState* state,
3846 ZydisDecodedInstruction* instruction, ZyanU16* index)
3847 {
3848 ZYAN_ASSERT(state);
3849 ZYAN_ASSERT(instruction);
3850 ZYAN_ASSERT(index);
3851
3852 if (!instruction->raw.modrm.offset)
3853 {
3854 instruction->raw.modrm.offset = instruction->length;
3855 ZyanU8 modrm_byte;
3856 ZYAN_CHECK(ZydisInputNext(state, instruction, &modrm_byte));
3857 ZydisDecodeModRM(instruction, modrm_byte);
3858 }
3859 *index = instruction->raw.modrm.mod;
3860 return ZYAN_STATUS_SUCCESS;
3861 }
3862
3863 static ZyanStatus ZydisNodeHandlerModrmModCompact(ZydisDecoderState* state,
3864 ZydisDecodedInstruction* instruction, ZyanU16* index)
3865 {
3866 ZYAN_CHECK(ZydisNodeHandlerModrmMod(state, instruction, index));
3867 *index = (*index == 0x3) ? 0 : 1;
3868 return ZYAN_STATUS_SUCCESS;
3869 }
3870
3871 static ZyanStatus ZydisNodeHandlerModrmReg(ZydisDecoderState* state,
3872 ZydisDecodedInstruction* instruction, ZyanU16* index)
3873 {
3874 ZYAN_ASSERT(state);
3875 ZYAN_ASSERT(instruction);
3876 ZYAN_ASSERT(index);
3877
3878 if (!instruction->raw.modrm.offset)
3879 {
3880 instruction->raw.modrm.offset = instruction->length;
3881 ZyanU8 modrm_byte;
3882 ZYAN_CHECK(ZydisInputNext(state, instruction, &modrm_byte));
3883 ZydisDecodeModRM(instruction, modrm_byte);
3884 }
3885 *index = instruction->raw.modrm.reg;
3886 return ZYAN_STATUS_SUCCESS;
3887 }
3888
3889 static ZyanStatus ZydisNodeHandlerModrmRm(ZydisDecoderState* state,
3890 ZydisDecodedInstruction* instruction, ZyanU16* index)
3891 {
3892 ZYAN_ASSERT(state);
3893 ZYAN_ASSERT(instruction);
3894 ZYAN_ASSERT(index);
3895
3896 if (!instruction->raw.modrm.offset)
3897 {
3898 instruction->raw.modrm.offset = instruction->length;
3899 ZyanU8 modrm_byte;
3900 ZYAN_CHECK(ZydisInputNext(state, instruction, &modrm_byte));
3901 ZydisDecodeModRM(instruction, modrm_byte);
3902 }
3903 *index = instruction->raw.modrm.rm;
3904 return ZYAN_STATUS_SUCCESS;
3905 }
3906
3907 static ZyanStatus ZydisNodeHandlerMandatoryPrefix(const ZydisDecoderState* state,
3908 ZydisDecodedInstruction* instruction, ZyanU16* index)
3909 {
3910 ZYAN_ASSERT(state);
3911 ZYAN_ASSERT(instruction);
3912 ZYAN_ASSERT(index);
3913
3914 switch (state->prefixes.mandatory_candidate)
3915 {
3916 case 0x66:
3917 instruction->raw.prefixes[state->prefixes.offset_mandatory].type =
3918 ZYDIS_PREFIX_TYPE_MANDATORY;
3919 instruction->attributes &= ~ZYDIS_ATTRIB_HAS_OPERANDSIZE;
3920 *index = 2;
3921 break;
3922 case 0xF3:
3923 instruction->raw.prefixes[state->prefixes.offset_mandatory].type =
3924 ZYDIS_PREFIX_TYPE_MANDATORY;
3925 *index = 3;
3926 break;
3927 case 0xF2:
3928 instruction->raw.prefixes[state->prefixes.offset_mandatory].type =
3929 ZYDIS_PREFIX_TYPE_MANDATORY;
3930 *index = 4;
3931 break;
3932 default:
3933 *index = 1;
3934 break;
3935 }
3936 // TODO: Consume prefix and make sure it's available again, if we need to fallback
3937
3938 return ZYAN_STATUS_SUCCESS;
3939 }
3940
3941 static ZyanStatus ZydisNodeHandlerOperandSize(const ZydisDecoderState* state,
3942 ZydisDecodedInstruction* instruction, ZyanU16* index)
3943 {
3944 ZYAN_ASSERT(state);
3945 ZYAN_ASSERT(instruction);
3946 ZYAN_ASSERT(index);
3947
3948 if ((instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64) &&
3949 (state->context->vector_unified.W))
3950 {
3951 *index = 2;
3952 } else
3953 {
3954 if (instruction->attributes & ZYDIS_ATTRIB_HAS_OPERANDSIZE)
3955 {
3956 instruction->raw.prefixes[state->prefixes.offset_osz_override].type =
3957 ZYDIS_PREFIX_TYPE_EFFECTIVE;
3958 }
3959 switch (instruction->machine_mode)
3960 {
3961 case ZYDIS_MACHINE_MODE_LONG_COMPAT_16:
3962 case ZYDIS_MACHINE_MODE_LEGACY_16:
3963 case ZYDIS_MACHINE_MODE_REAL_16:
3964 *index = (instruction->attributes & ZYDIS_ATTRIB_HAS_OPERANDSIZE) ? 1 : 0;
3965 break;
3966 case ZYDIS_MACHINE_MODE_LONG_COMPAT_32:
3967 case ZYDIS_MACHINE_MODE_LEGACY_32:
3968 case ZYDIS_MACHINE_MODE_LONG_64:
3969 *index = (instruction->attributes & ZYDIS_ATTRIB_HAS_OPERANDSIZE) ? 0 : 1;
3970 break;
3971 default:
3972 ZYAN_UNREACHABLE;
3973 }
3974 }
3975
3976 return ZYAN_STATUS_SUCCESS;
3977 }
3978
3979 static ZyanStatus ZydisNodeHandlerAddressSize(ZydisDecodedInstruction* instruction, ZyanU16* index)
3980 {
3981 ZYAN_ASSERT(instruction);
3982 ZYAN_ASSERT(index);
3983
3984 /*if (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE)
3985 {
3986 instruction->raw.prefixes[context->prefixes.offset_asz_override].type =
3987 ZYDIS_PREFIX_TYPE_EFFECTIVE;
3988 }*/
3989 switch (instruction->machine_mode)
3990 {
3991 case ZYDIS_MACHINE_MODE_LONG_COMPAT_16:
3992 case ZYDIS_MACHINE_MODE_LEGACY_16:
3993 case ZYDIS_MACHINE_MODE_REAL_16:
3994 *index = (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE) ? 1 : 0;
3995 break;
3996 case ZYDIS_MACHINE_MODE_LONG_COMPAT_32:
3997 case ZYDIS_MACHINE_MODE_LEGACY_32:
3998 *index = (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE) ? 0 : 1;
3999 break;
4000 case ZYDIS_MACHINE_MODE_LONG_64:
4001 *index = (instruction->attributes & ZYDIS_ATTRIB_HAS_ADDRESSSIZE) ? 1 : 2;
4002 break;
4003 default:
4004 ZYAN_UNREACHABLE;
4005 }
4006
4007 return ZYAN_STATUS_SUCCESS;
4008 }
4009
4010 static ZyanStatus ZydisNodeHandlerVectorLength(const ZydisDecoderContext* context,
4011 const ZydisDecodedInstruction* instruction, ZyanU16* index)
4012 {
4013 ZYAN_ASSERT(context);
4014 ZYAN_ASSERT(instruction);
4015 ZYAN_ASSERT(index);
4016
4017 switch (instruction->encoding)
4018 {
4019 case ZYDIS_INSTRUCTION_ENCODING_XOP:
4020 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_XOP);
4021 break;
4022 case ZYDIS_INSTRUCTION_ENCODING_VEX:
4023 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX);
4024 break;
4025 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
4026 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX);
4027 break;
4028 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
4029 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX);
4030 break;
4031 default:
4032 ZYAN_UNREACHABLE;
4033 }
4034
4035 *index = context->vector_unified.LL;
4036 if (*index == 3)
4037 {
4038 return ZYDIS_STATUS_DECODING_ERROR;
4039 }
4040 return ZYAN_STATUS_SUCCESS;
4041 }
4042
4043 static ZyanStatus ZydisNodeHandlerRexW(const ZydisDecoderContext* context,
4044 const ZydisDecodedInstruction* instruction, ZyanU16* index)
4045 {
4046 ZYAN_ASSERT(context);
4047 ZYAN_ASSERT(instruction);
4048 ZYAN_ASSERT(index);
4049
4050 switch (instruction->encoding)
4051 {
4052 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
4053 // nothing to do here
4054 break;
4055 case ZYDIS_INSTRUCTION_ENCODING_XOP:
4056 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_XOP);
4057 break;
4058 case ZYDIS_INSTRUCTION_ENCODING_VEX:
4059 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX);
4060 break;
4061 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
4062 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX);
4063 break;
4064 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
4065 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX);
4066 break;
4067 default:
4068 ZYAN_UNREACHABLE;
4069 }
4070 *index = context->vector_unified.W;
4071 return ZYAN_STATUS_SUCCESS;
4072 }
4073
4074 static ZyanStatus ZydisNodeHandlerRexB(const ZydisDecoderContext* context,
4075 const ZydisDecodedInstruction* instruction, ZyanU16* index)
4076 {
4077 ZYAN_ASSERT(context);
4078 ZYAN_ASSERT(instruction);
4079 ZYAN_ASSERT(index);
4080
4081 switch (instruction->encoding)
4082 {
4083 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
4084 // nothing to do here
4085 break;
4086 case ZYDIS_INSTRUCTION_ENCODING_XOP:
4087 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_XOP);
4088 break;
4089 case ZYDIS_INSTRUCTION_ENCODING_VEX:
4090 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_VEX);
4091 break;
4092 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
4093 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX);
4094 break;
4095 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
4096 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX);
4097 break;
4098 default:
4099 ZYAN_UNREACHABLE;
4100 }
4101 *index = context->vector_unified.B;
4102 return ZYAN_STATUS_SUCCESS;
4103 }
4104
4105 #ifndef ZYDIS_DISABLE_AVX512
4106 static ZyanStatus ZydisNodeHandlerEvexB(const ZydisDecodedInstruction* instruction, ZyanU16* index)
4107 {
4108 ZYAN_ASSERT(instruction);
4109 ZYAN_ASSERT(index);
4110
4111 ZYAN_ASSERT(instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX);
4112 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_EVEX);
4113 *index = instruction->raw.evex.b;
4114 return ZYAN_STATUS_SUCCESS;
4115 }
4116 #endif
4117
4118 #ifndef ZYDIS_DISABLE_KNC
4119 static ZyanStatus ZydisNodeHandlerMvexE(const ZydisDecodedInstruction* instruction, ZyanU16* index)
4120 {
4121 ZYAN_ASSERT(instruction);
4122 ZYAN_ASSERT(index);
4123
4124 ZYAN_ASSERT(instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX);
4125 ZYAN_ASSERT(instruction->attributes & ZYDIS_ATTRIB_HAS_MVEX);
4126 *index = instruction->raw.mvex.E;
4127 return ZYAN_STATUS_SUCCESS;
4128 }
4129 #endif
4130
4131 /* ---------------------------------------------------------------------------------------------- */
4132
4133 /**
4134 * Populates the internal register id fields for `REG`, `RM`, `NDSNDD`, `BASE` and `INDEX`/`VIDX`
4135 * encoded operands and performs sanity checks.
4136 *
4137 * @param context A pointer to the `ZydisDecoderContext` struct.
4138 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
4139 * @param def_reg The type definition for the `.reg` encoded operand.
4140 * @param def_rm The type definition for the `.rm` encoded operand.
4141 * @param def_ndsndd The type definition for the `.vvvv` encoded operand.
4142 *
4143 * @return A zyan status code.
4144 *
4145 * This function sets all unused register ids to `-1`. This rule does currently not apply to
4146 * `base` and `index`.
4147 *
4148 * Definition encoding:
4149 * - `def_reg` -> `ZydisRegisterKind`
4150 * - `def_ndsndd` -> `ZydisRegisterKind`
4151 * - `def_rm` -> `ZydisRegisterKind` (`.mod == 3`) or ZydisMemoryOperandType (`.mod != 3`)
4152 */
4153 static ZyanStatus ZydisPopulateRegisterIds(ZydisDecoderContext* context,
4154 const ZydisDecodedInstruction* instruction, ZyanU8 def_reg, ZyanU8 def_rm, ZyanU8 def_ndsndd)
4155 {
4156 ZYAN_ASSERT(context);
4157 ZYAN_ASSERT(instruction);
4158
4159 const ZyanBool is_64_bit = (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64);
4160 const ZyanBool is_reg = context->reg_info.is_mod_reg;
4161 const ZyanBool has_sib = !is_reg && (instruction->raw.modrm.rm == 4);
4162 const ZyanBool has_vsib = has_sib && (def_rm == ZYDIS_MEMOP_TYPE_VSIB);
4163
4164 ZyanU8 id_reg = instruction->raw.modrm.reg;
4165 ZyanU8 id_rm = instruction->raw.modrm.rm;
4166 ZyanU8 id_ndsndd = is_64_bit ? context->vector_unified.vvvv : context->vector_unified.vvvv & 0x07;
4167 ZyanU8 id_base = has_sib ? instruction->raw.sib.base : instruction->raw.modrm.rm;
4168 ZyanU8 id_index = instruction->raw.sib.index;
4169
4170 if (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_64)
4171 {
4172 const ZyanBool is_emvex = (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX) ||
4173 (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX);
4174
4175 // The `index` extension by `.v'` is only valid for VSIB operands
4176 const ZyanU8 vsib_v2 = has_vsib ? context->vector_unified.V2 : 0;
4177 // The `rm` extension by `.X` is only valid for EVEX/MVEX instructions
4178 const ZyanU8 evex_x = is_emvex ? context->vector_unified.X : 0;
4179
4180 id_reg |= (context->vector_unified.R2 << 4) | (context->vector_unified.R << 3);
4181 id_rm |= (evex_x << 4) | (context->vector_unified.B << 3);
4182 id_ndsndd |= (context->vector_unified.V2 << 4) ;
4183 id_base |= (context->vector_unified.B << 3);
4184 id_index |= (vsib_v2 << 4) | (context->vector_unified.X << 3);
4185
4186 // The masking emulates the actual CPU behavior and does not verify if the resulting ids
4187 // are actually valid for the given register kind.
4188
4189 static const ZyanU8 mask_reg[ZYDIS_REGKIND_MAX_VALUE + 1] =
4190 {
4191 /* INVALID */ 0,
4192 /* GPR */ (1 << 5) - 1,
4193 /* X87 */ (1 << 3) - 1, // ignore `.R`, ignore `.R'`
4194 /* MMX */ (1 << 3) - 1, // ignore `.R`, ignore `.R'`
4195 /* VR */ (1 << 5) - 1,
4196 /* TMM */ (1 << 5) - 1,
4197 /* SEGMENT */ (1 << 3) - 1, // ignore `.R`, ignore `.R'`
4198 /* TEST */ (1 << 3) - 1, // ignore `.R`, ignore `.R'`
4199 /* CONTROL */ (1 << 4) - 1, // ignore `.R'`
4200 /* DEBUG */ (1 << 4) - 1, // ignore `.R'`
4201 /* MASK */ (1 << 5) - 1,
4202 /* BOUND */ (1 << 4) - 1 // ignore `.R'`
4203 };
4204 id_reg &= mask_reg[def_reg];
4205
4206 static const ZyanU8 mask_rm[ZYDIS_REGKIND_MAX_VALUE + 1] =
4207 {
4208 /* INVALID */ 0,
4209 /* GPR */ (1 << 4) - 1, // ignore `.X`
4210 /* X87 */ (1 << 3) - 1, // ignore `.B`, ignore `.X`
4211 /* MMX */ (1 << 3) - 1, // ignore `.B`, ignore `.X`
4212 /* VR */ (1 << 5) - 1,
4213 /* TMM */ (1 << 4) - 1, // ignore `.X`
4214 /* SEGMENT */ (1 << 3) - 1, // ignore `.B`, ignore `.X`
4215 /* TEST */ (1 << 3) - 1, // ignore `.B`, ignore `.X`
4216 /* CONTROL */ (1 << 4) - 1, // ignore `.X`
4217 /* DEBUG */ (1 << 4) - 1, // ignore `.X`
4218 /* MASK */ (1 << 3) - 1, // ignore `.B`, ignore `.X`
4219 /* BOUND */ (1 << 4) - 1 // ignore `.X`
4220 };
4221 id_rm &= (is_reg ? mask_rm[def_rm] : 0xFF);
4222
4223 // Commented out for future reference. Not required at the moment as it's always either
4224 // a "take all" or "take nothing" situation.
4225
4226 //static const ZyanU8 mask_ndsndd[ZYDIS_REGKIND_MAX_VALUE + 1] =
4227 //{
4228 // /* INVALID */ 0,
4229 // /* GPR */ (1 << 5) - 1,
4230 // /* X87 */ 0, // never encoded in `.vvvv`
4231 // /* MMX */ 0, // never encoded in `.vvvv`
4232 // /* VR */ (1 << 5) - 1,
4233 // /* TMM */ (1 << 5) - 1,
4234 // /* SEGMENT */ 0, // never encoded in `.vvvv`
4235 // /* TEST */ 0, // never encoded in `.vvvv`
4236 // /* CONTROL */ 0, // never encoded in `.vvvv`
4237 // /* DEBUG */ 0, // never encoded in `.vvvv`
4238 // /* MASK */ (1 << 5) - 1,
4239 // /* BOUND */ 0 // never encoded in `.vvvv`
4240 //};
4241 }
4242
4243 // Validate
4244
4245 // `.vvvv` is not allowed, if the instruction does not encode a NDS/NDD operand
4246 if (!def_ndsndd && context->vector_unified.vvvv)
4247 {
4248 return ZYDIS_STATUS_BAD_REGISTER;
4249 }
4250 // `.v'` is not allowed, if the instruction does not encode a NDS/NDD or VSIB operand
4251 if (!def_ndsndd && !has_vsib && context->vector_unified.V2)
4252 {
4253 return ZYDIS_STATUS_BAD_REGISTER;
4254 }
4255
4256 static const ZyanU8 available_regs[2][ZYDIS_REGKIND_MAX_VALUE + 1] =
4257 {
4258 // 16/32 bit mode
4259 {
4260 /* INVALID */ 255,
4261 /* GPR */ 8,
4262 /* X87 */ 8,
4263 /* MMX */ 8,
4264 /* VR */ 8,
4265 /* TMM */ 8,
4266 /* SEGMENT */ 6,
4267 /* TEST */ 8,
4268 /* CONTROL */ 8,
4269 /* DEBUG */ 8,
4270 /* MASK */ 8,
4271 /* BOUND */ 4
4272 },
4273 // 64 bit mode
4274 {
4275 /* INVALID */ 255,
4276 /* GPR */ 16,
4277 /* X87 */ 8,
4278 /* MMX */ 8,
4279 /* VR */ 32,
4280 /* TMM */ 8,
4281 /* SEGMENT */ 6,
4282 /* TEST */ 8,
4283 /* CONTROL */ 16,
4284 // Attempts to reference DR8..DR15 result in undefined opcode (#UD) exceptions. DR4 and
4285 // DR5 are only valid, if the debug extension (DE) flag in CR4 is set. As we can't
4286 // check this at runtime we just allow them.
4287 /* DEBUG */ 8,
4288 /* MASK */ 8,
4289 /* BOUND */ 4
4290 }
4291 };
4292
4293 if ((id_reg >= available_regs[is_64_bit][def_reg]) ||
4294 (id_ndsndd >= available_regs[is_64_bit][def_ndsndd]) ||
4295 (is_reg && (id_rm >= available_regs[is_64_bit][def_rm])))
4296 {
4297 return ZYDIS_STATUS_BAD_REGISTER;
4298 }
4299
4300 ZyanI8 id_cr = -1;
4301 if (def_reg == ZYDIS_REGKIND_CONTROL)
4302 {
4303 id_cr = id_reg;
4304 }
4305 if (is_reg && (def_rm == ZYDIS_REGKIND_CONTROL))
4306 {
4307 id_cr = id_rm;
4308 }
4309 if (id_cr >= 0)
4310 {
4311 // Attempts to reference CR1, CR5, CR6, CR7, and CR9..CR15 result in undefined opcode (#UD)
4312 // exceptions
4313 static const ZyanU8 lookup[16] =
4314 {
4315 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0
4316 };
4317 ZYAN_ASSERT((ZyanUSize)id_cr < ZYAN_ARRAY_LENGTH(lookup));
4318 if (!lookup[id_cr])
4319 {
4320 return ZYDIS_STATUS_BAD_REGISTER;
4321 }
4322 }
4323
4324 // Assign to context
4325
4326 context->reg_info.id_reg = def_reg ? id_reg : -1;
4327 context->reg_info.id_rm = def_rm && is_reg ? id_rm : -1;
4328 context->reg_info.id_ndsndd = def_ndsndd ? id_ndsndd : -1;
4329 context->reg_info.id_base = id_base; // TODO: Set unused register to -1 as well
4330 context->reg_info.id_index = id_index; // TODO: Set unused register to -1 as well
4331
4332 return ZYAN_STATUS_SUCCESS;
4333 }
4334
4335 /**
4336 * Checks for certain post-decode error-conditions.
4337 *
4338 * @param state A pointer to the `ZydisDecoderState` struct.
4339 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
4340 * @param definition A pointer to the `ZydisInstructionDefinition` struct.
4341 *
4342 * @return A zyan status code.
4343 *
4344 * This function is called immediately after a valid instruction-definition was found.
4345 */
4346 static ZyanStatus ZydisCheckErrorConditions(ZydisDecoderState* state,
4347 const ZydisDecodedInstruction* instruction, const ZydisInstructionDefinition* definition)
4348 {
4349 ZYAN_ASSERT(state);
4350 ZYAN_ASSERT(instruction);
4351 ZYAN_ASSERT(definition);
4352
4353 ZyanU8 def_reg = definition->op_reg;
4354 ZyanU8 def_rm = definition->op_rm;
4355 ZyanU8 def_ndsndd = ZYDIS_REGKIND_INVALID;
4356 ZyanBool is_gather = ZYAN_FALSE;
4357 ZyanBool no_source_dest_match = ZYAN_FALSE;
4358 ZyanBool no_source_source_match = ZYAN_FALSE;
4359 #if !defined(ZYDIS_DISABLE_AVX512) || !defined(ZYDIS_DISABLE_KNC)
4360 ZydisMaskPolicy mask_policy = ZYDIS_MASK_POLICY_INVALID;
4361 #endif
4362
4363 switch (instruction->encoding)
4364 {
4365 case ZYDIS_INSTRUCTION_ENCODING_LEGACY:
4366 {
4367 const ZydisInstructionDefinitionLEGACY* def =
4368 (const ZydisInstructionDefinitionLEGACY*)definition;
4369
4370 if (def->requires_protected_mode &&
4371 (instruction->machine_mode == ZYDIS_MACHINE_MODE_REAL_16))
4372 {
4373 return ZYDIS_STATUS_DECODING_ERROR;
4374 }
4375
4376 if (def->no_compat_mode &&
4377 ((instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_COMPAT_16) ||
4378 (instruction->machine_mode == ZYDIS_MACHINE_MODE_LONG_COMPAT_32)))
4379 {
4380 return ZYDIS_STATUS_DECODING_ERROR;
4381 }
4382
4383 if (state->prefixes.has_lock && !def->accepts_LOCK)
4384 {
4385 return ZYDIS_STATUS_ILLEGAL_LOCK;
4386 }
4387 break;
4388 }
4389 case ZYDIS_INSTRUCTION_ENCODING_3DNOW:
4390 {
4391 break;
4392 }
4393 case ZYDIS_INSTRUCTION_ENCODING_XOP:
4394 {
4395 const ZydisInstructionDefinitionXOP* def =
4396 (const ZydisInstructionDefinitionXOP*)definition;
4397 def_ndsndd = def->op_ndsndd;
4398 break;
4399 }
4400 case ZYDIS_INSTRUCTION_ENCODING_VEX:
4401 {
4402 const ZydisInstructionDefinitionVEX* def =
4403 (const ZydisInstructionDefinitionVEX*)definition;
4404 def_ndsndd = def->op_ndsndd;
4405 is_gather = def->is_gather;
4406 no_source_source_match = def->no_source_source_match;
4407 break;
4408 }
4409 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
4410 {
4411 #ifndef ZYDIS_DISABLE_AVX512
4412 const ZydisInstructionDefinitionEVEX* def =
4413 (const ZydisInstructionDefinitionEVEX*)definition;
4414 def_ndsndd = def->op_ndsndd;
4415 is_gather = def->is_gather;
4416 no_source_dest_match = def->no_source_dest_match;
4417 mask_policy = def->mask_policy;
4418
4419 // Check for invalid zero-mask
4420 if ((instruction->raw.evex.z) && (!def->accepts_zero_mask))
4421 {
4422 return ZYDIS_STATUS_INVALID_MASK; // TODO: Dedicated status code
4423 }
4424 #else
4425 ZYAN_UNREACHABLE;
4426 #endif
4427 break;
4428 }
4429 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
4430 {
4431 #ifndef ZYDIS_DISABLE_KNC
4432 const ZydisInstructionDefinitionMVEX* def =
4433 (const ZydisInstructionDefinitionMVEX*)definition;
4434 def_ndsndd = def->op_ndsndd;
4435 is_gather = def->is_gather;
4436 mask_policy = def->mask_policy;
4437
4438 // Check for invalid MVEX.SSS values
4439 static const ZyanU8 lookup[26][8] =
4440 {
4441 // ZYDIS_MVEX_FUNC_IGNORED
4442 { 1, 1, 1, 1, 1, 1, 1, 1 },
4443 // ZYDIS_MVEX_FUNC_INVALID
4444 { 1, 0, 0, 0, 0, 0, 0, 0 },
4445 // ZYDIS_MVEX_FUNC_RC
4446 { 1, 1, 1, 1, 1, 1, 1, 1 },
4447 // ZYDIS_MVEX_FUNC_SAE
4448 { 1, 1, 1, 1, 1, 1, 1, 1 },
4449 // ZYDIS_MVEX_FUNC_F_32
4450 { 1, 0, 0, 0, 0, 0, 0, 0 },
4451 // ZYDIS_MVEX_FUNC_I_32
4452 { 1, 0, 0, 0, 0, 0, 0, 0 },
4453 // ZYDIS_MVEX_FUNC_F_64
4454 { 1, 0, 0, 0, 0, 0, 0, 0 },
4455 // ZYDIS_MVEX_FUNC_I_64
4456 { 1, 0, 0, 0, 0, 0, 0, 0 },
4457 // ZYDIS_MVEX_FUNC_SWIZZLE_32
4458 { 1, 1, 1, 1, 1, 1, 1, 1 },
4459 // ZYDIS_MVEX_FUNC_SWIZZLE_64
4460 { 1, 1, 1, 1, 1, 1, 1, 1 },
4461 // ZYDIS_MVEX_FUNC_SF_32
4462 { 1, 1, 1, 1, 1, 0, 1, 1 },
4463 // ZYDIS_MVEX_FUNC_SF_32_BCST
4464 { 1, 1, 1, 0, 0, 0, 0, 0 },
4465 // ZYDIS_MVEX_FUNC_SF_32_BCST_4TO16
4466 { 1, 0, 1, 0, 0, 0, 0, 0 },
4467 // ZYDIS_MVEX_FUNC_SF_64
4468 { 1, 1, 1, 0, 0, 0, 0, 0 },
4469 // ZYDIS_MVEX_FUNC_SI_32
4470 { 1, 1, 1, 0, 1, 1, 1, 1 },
4471 // ZYDIS_MVEX_FUNC_SI_32_BCST
4472 { 1, 1, 1, 0, 0, 0, 0, 0 },
4473 // ZYDIS_MVEX_FUNC_SI_32_BCST_4TO16
4474 { 1, 0, 1, 0, 0, 0, 0, 0 },
4475 // ZYDIS_MVEX_FUNC_SI_64
4476 { 1, 1, 1, 0, 0, 0, 0, 0 },
4477 // ZYDIS_MVEX_FUNC_UF_32
4478 { 1, 0, 0, 1, 1, 1, 1, 1 },
4479 // ZYDIS_MVEX_FUNC_UF_64
4480 { 1, 0, 0, 0, 0, 0, 0, 0 },
4481 // ZYDIS_MVEX_FUNC_UI_32
4482 { 1, 0, 0, 0, 1, 1, 1, 1 },
4483 // ZYDIS_MVEX_FUNC_UI_64
4484 { 1, 0, 0, 0, 0, 0, 0, 0 },
4485 // ZYDIS_MVEX_FUNC_DF_32
4486 { 1, 0, 0, 1, 1, 1, 1, 1 },
4487 // ZYDIS_MVEX_FUNC_DF_64
4488 { 1, 0, 0, 0, 0, 0, 0, 0 },
4489 // ZYDIS_MVEX_FUNC_DI_32
4490 { 1, 0, 0, 0, 1, 1, 1, 1 },
4491 // ZYDIS_MVEX_FUNC_DI_64
4492 { 1, 0, 0, 0, 0, 0, 0, 0 }
4493 };
4494 ZYAN_ASSERT(def->functionality < ZYAN_ARRAY_LENGTH(lookup));
4495 ZYAN_ASSERT(instruction->raw.mvex.SSS < 8);
4496 if (!lookup[def->functionality][instruction->raw.mvex.SSS])
4497 {
4498 return ZYDIS_STATUS_DECODING_ERROR;
4499 }
4500 #else
4501 ZYAN_UNREACHABLE;
4502 #endif
4503 break;
4504 }
4505 default:
4506 ZYAN_UNREACHABLE;
4507 }
4508
4509 ZydisDecoderContext* context = state->context;
4510 const ZyanBool is_reg = context->reg_info.is_mod_reg;
4511
4512 ZyanU8 no_rip_rel = ZYAN_FALSE;
4513 ZyanU8 is_sr_dest_reg = ZYAN_FALSE;
4514 ZyanU8 is_sr_dest_rm = ZYAN_FALSE;
4515 if (def_reg)
4516 {
4517 is_sr_dest_reg = ZYDIS_OPDEF_GET_REG_HIGH_BIT(def_reg);
4518 def_reg = ZYDIS_OPDEF_GET_REG(def_reg);
4519 }
4520 if (def_rm)
4521 {
4522 if (is_reg)
4523 {
4524 is_sr_dest_rm = ZYDIS_OPDEF_GET_REG_HIGH_BIT(def_rm);
4525 def_rm = ZYDIS_OPDEF_GET_REG(def_rm);
4526 }
4527 else
4528 {
4529 no_rip_rel = ZYDIS_OPDEF_GET_MEM_HIGH_BIT(def_rm);
4530 def_rm = ZYDIS_OPDEF_GET_MEM(def_rm);
4531 }
4532 }
4533
4534 // Check RIP-relative memory addressing
4535 if (no_rip_rel)
4536 {
4537 const ZyanBool is_rip_rel =
4538 (state->decoder->machine_mode == ZYDIS_MACHINE_MODE_LONG_64) &&
4539 (instruction->raw.modrm.mod == 0) && (instruction->raw.modrm.rm == 5);
4540 if (is_rip_rel)
4541 {
4542 return ZYDIS_STATUS_BAD_REGISTER;
4543 }
4544 }
4545
4546 // Populate- and validate register constraints
4547 ZYAN_CHECK(ZydisPopulateRegisterIds(context, instruction, def_reg, def_rm, def_ndsndd));
4548
4549 // `ZYDIS_REGISTER_CS` is not allowed as `MOV` target
4550 if (is_sr_dest_reg && (context->reg_info.id_reg == 1))
4551 {
4552 return ZYDIS_STATUS_BAD_REGISTER;
4553 }
4554 if (is_sr_dest_rm && (context->reg_info.id_rm == 1))
4555 {
4556 return ZYDIS_STATUS_BAD_REGISTER;
4557 }
4558
4559 // Check gather registers
4560 if (is_gather)
4561 {
4562 // ZYAN_ASSERT(has_VSIB);
4563 ZYAN_ASSERT(instruction->raw.modrm.mod != 3);
4564 ZYAN_ASSERT(instruction->raw.modrm.rm == 4);
4565
4566 const ZyanU8 index = context->reg_info.id_index;
4567 ZyanU8 dest = context->reg_info.id_reg;
4568 ZyanU8 mask = 0xF0;
4569
4570 if (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_VEX)
4571 {
4572 ZYAN_ASSERT((def_reg == ZYDIS_REGKIND_VR) &&
4573 (def_rm == ZYDIS_MEMOP_TYPE_VSIB) &&
4574 (def_ndsndd == ZYDIS_REGKIND_VR));
4575 mask = context->reg_info.id_ndsndd;
4576 }
4577
4578 if ((instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX) ||
4579 (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_MVEX))
4580 {
4581 ZYAN_ASSERT(((def_reg == ZYDIS_REGKIND_INVALID) ||
4582 (def_reg == ZYDIS_REGKIND_VR)) &&
4583 (def_rm == ZYDIS_MEMOP_TYPE_VSIB) &&
4584 (def_ndsndd == ZYDIS_REGKIND_INVALID));
4585
4586 // Some gather instructions (like `VGATHERPF0{D|Q}{PS|PD}`) do not have a destination
4587 // operand
4588 if (!def_reg)
4589 {
4590 dest = 0xF1;
4591 }
4592 }
4593
4594 // If any pair of the index, mask, or destination registers are the same, the instruction
4595 // results a UD fault
4596 if ((dest == index) || (dest == mask) || (index == mask))
4597 {
4598 return ZYDIS_STATUS_BAD_REGISTER;
4599 }
4600 }
4601
4602 // Check if any source register matches the destination register
4603 if (no_source_dest_match)
4604 {
4605 ZYAN_ASSERT((instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_EVEX) ||
4606 (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_VEX));
4607
4608 const ZyanU8 dest = context->reg_info.id_reg;
4609 const ZyanU8 source1 = context->reg_info.id_ndsndd;
4610 const ZyanU8 source2 = context->reg_info.id_rm;
4611
4612 if ((dest == source1) || (is_reg && (dest == source2)))
4613 {
4614 return ZYDIS_STATUS_BAD_REGISTER;
4615 }
4616 }
4617
4618 // If any pair of the source or destination registers are the same, the instruction results a
4619 // UD fault
4620 if (no_source_source_match) // TODO: Find better name
4621 {
4622 ZYAN_ASSERT(instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_VEX);
4623 ZYAN_ASSERT(is_reg);
4624
4625 const ZyanU8 dest = context->reg_info.id_reg;
4626 const ZyanU8 source1 = context->reg_info.id_ndsndd;
4627 const ZyanU8 source2 = context->reg_info.id_rm;
4628
4629 if ((dest == source1) || (dest == source2) || (source1 == source2))
4630 {
4631 return ZYDIS_STATUS_BAD_REGISTER;
4632 }
4633 }
4634
4635 #if !defined(ZYDIS_DISABLE_AVX512) || !defined(ZYDIS_DISABLE_KNC)
4636 // Check for invalid MASK registers
4637 switch (mask_policy)
4638 {
4639 case ZYDIS_MASK_POLICY_INVALID:
4640 case ZYDIS_MASK_POLICY_ALLOWED:
4641 // Nothing to do here
4642 break;
4643 case ZYDIS_MASK_POLICY_REQUIRED:
4644 if (!context->vector_unified.mask)
4645 {
4646 return ZYDIS_STATUS_INVALID_MASK;
4647 }
4648 break;
4649 case ZYDIS_MASK_POLICY_FORBIDDEN:
4650 if (context->vector_unified.mask)
4651 {
4652 return ZYDIS_STATUS_INVALID_MASK;
4653 }
4654 break;
4655 default:
4656 ZYAN_UNREACHABLE;
4657 }
4658 #endif
4659
4660 return ZYAN_STATUS_SUCCESS;
4661 }
4662
4663 /* ---------------------------------------------------------------------------------------------- */
4664
4665 /**
4666 * Uses the decoder-tree to decode the current instruction.
4667 *
4668 * @param state A pointer to the `ZydisDecoderState` struct.
4669 * @param instruction A pointer to the `ZydisDecodedInstruction` struct.
4670 *
4671 * @return A zyan status code.
4672 */
4673 static ZyanStatus ZydisDecodeInstruction(ZydisDecoderState* state,
4674 ZydisDecodedInstruction* instruction)
4675 {
4676 ZYAN_ASSERT(state);
4677 ZYAN_ASSERT(instruction);
4678
4679 // Iterate through the decoder tree
4680 const ZydisDecoderTreeNode* node = ZydisDecoderTreeGetRootNode();
4681 const ZydisDecoderTreeNode* temp = ZYAN_NULL;
4682 ZydisDecoderTreeNodeType node_type;
4683 do
4684 {
4685 node_type = node->type;
4686 ZyanU16 index = 0;
4687 ZyanStatus status = 0;
4688 switch (node_type)
4689 {
4690 case ZYDIS_NODETYPE_INVALID:
4691 if (temp)
4692 {
4693 node = temp;
4694 temp = ZYAN_NULL;
4695 node_type = ZYDIS_NODETYPE_FILTER_MANDATORY_PREFIX;
4696 if (state->prefixes.mandatory_candidate != 0x00)
4697 {
4698 instruction->raw.prefixes[state->prefixes.offset_mandatory].type =
4699 ZYDIS_PREFIX_TYPE_IGNORED;
4700 }
4701 if (state->prefixes.mandatory_candidate == 0x66)
4702 {
4703 if (state->prefixes.offset_osz_override ==
4704 state->prefixes.offset_mandatory)
4705 {
4706 instruction->raw.prefixes[state->prefixes.offset_mandatory].type =
4707 ZYDIS_PREFIX_TYPE_EFFECTIVE;
4708 }
4709 instruction->attributes |= ZYDIS_ATTRIB_HAS_OPERANDSIZE;
4710 }
4711 continue;
4712 }
4713 return ZYDIS_STATUS_DECODING_ERROR;
4714 case ZYDIS_NODETYPE_FILTER_XOP:
4715 status = ZydisNodeHandlerXOP(instruction, &index);
4716 break;
4717 case ZYDIS_NODETYPE_FILTER_VEX:
4718 status = ZydisNodeHandlerVEX(instruction, &index);
4719 break;
4720 case ZYDIS_NODETYPE_FILTER_EMVEX:
4721 status = ZydisNodeHandlerEMVEX(instruction, &index);
4722 break;
4723 case ZYDIS_NODETYPE_FILTER_OPCODE:
4724 status = ZydisNodeHandlerOpcode(state, instruction, &index);
4725 break;
4726 case ZYDIS_NODETYPE_FILTER_MODE:
4727 status = ZydisNodeHandlerMode(instruction, &index);
4728 break;
4729 case ZYDIS_NODETYPE_FILTER_MODE_COMPACT:
4730 status = ZydisNodeHandlerModeCompact(instruction, &index);
4731 break;
4732 case ZYDIS_NODETYPE_FILTER_MODRM_MOD:
4733 status = ZydisNodeHandlerModrmMod(state, instruction, &index);
4734 break;
4735 case ZYDIS_NODETYPE_FILTER_MODRM_MOD_COMPACT:
4736 status = ZydisNodeHandlerModrmModCompact(state, instruction, &index);
4737 break;
4738 case ZYDIS_NODETYPE_FILTER_MODRM_REG:
4739 status = ZydisNodeHandlerModrmReg(state, instruction, &index);
4740 break;
4741 case ZYDIS_NODETYPE_FILTER_MODRM_RM:
4742 status = ZydisNodeHandlerModrmRm(state, instruction, &index);
4743 break;
4744 case ZYDIS_NODETYPE_FILTER_PREFIX_GROUP1:
4745 index = state->prefixes.group1 ? 1 : 0;
4746 break;
4747 case ZYDIS_NODETYPE_FILTER_MANDATORY_PREFIX:
4748 status = ZydisNodeHandlerMandatoryPrefix(state, instruction, &index);
4749 temp = ZydisDecoderTreeGetChildNode(node, 0);
4750 // TODO: Return to this point, if index == 0 contains a value and the previous path
4751 // TODO: was not successful
4752 // TODO: Restore consumed prefix
4753 break;
4754 case ZYDIS_NODETYPE_FILTER_OPERAND_SIZE:
4755 status = ZydisNodeHandlerOperandSize(state, instruction, &index);
4756 break;
4757 case ZYDIS_NODETYPE_FILTER_ADDRESS_SIZE:
4758 status = ZydisNodeHandlerAddressSize(instruction, &index);
4759 break;
4760 case ZYDIS_NODETYPE_FILTER_VECTOR_LENGTH:
4761 status = ZydisNodeHandlerVectorLength(state->context, instruction, &index);
4762 break;
4763 case ZYDIS_NODETYPE_FILTER_REX_W:
4764 status = ZydisNodeHandlerRexW(state->context, instruction, &index);
4765 break;
4766 case ZYDIS_NODETYPE_FILTER_REX_B:
4767 status = ZydisNodeHandlerRexB(state->context, instruction, &index);
4768 break;
4769 #ifndef ZYDIS_DISABLE_AVX512
4770 case ZYDIS_NODETYPE_FILTER_EVEX_B:
4771 status = ZydisNodeHandlerEvexB(instruction, &index);
4772 break;
4773 #endif
4774 #ifndef ZYDIS_DISABLE_KNC
4775 case ZYDIS_NODETYPE_FILTER_MVEX_E:
4776 status = ZydisNodeHandlerMvexE(instruction, &index);
4777 break;
4778 #endif
4779 case ZYDIS_NODETYPE_FILTER_MODE_AMD:
4780 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_AMD_BRANCHES));
4781 break;
4782 case ZYDIS_NODETYPE_FILTER_MODE_KNC:
4783 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_KNC));
4784 break;
4785 case ZYDIS_NODETYPE_FILTER_MODE_MPX:
4786 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_MPX));
4787 break;
4788 case ZYDIS_NODETYPE_FILTER_MODE_CET:
4789 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_CET));
4790 break;
4791 case ZYDIS_NODETYPE_FILTER_MODE_LZCNT:
4792 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_LZCNT));
4793 break;
4794 case ZYDIS_NODETYPE_FILTER_MODE_TZCNT:
4795 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_TZCNT));
4796 break;
4797 case ZYDIS_NODETYPE_FILTER_MODE_WBNOINVD:
4798 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_WBNOINVD));
4799 break;
4800 case ZYDIS_NODETYPE_FILTER_MODE_CLDEMOTE:
4801 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_CLDEMOTE));
4802 break;
4803 case ZYDIS_NODETYPE_FILTER_MODE_IPREFETCH:
4804 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_IPREFETCH));
4805 break;
4806 case ZYDIS_NODETYPE_FILTER_MODE_UD0_COMPAT:
4807 index = !!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_UD0_COMPAT));
4808 break;
4809 default:
4810 if (node_type & ZYDIS_NODETYPE_DEFINITION_MASK)
4811 {
4812 const ZydisInstructionDefinition* definition;
4813 ZydisGetInstructionDefinition(instruction->encoding, node->value, &definition);
4814 ZydisSetEffectiveOperandWidth(state->context, instruction, definition);
4815 ZydisSetEffectiveAddressWidth(state->context, instruction, definition);
4816
4817 const ZydisInstructionEncodingInfo* info;
4818 ZydisGetInstructionEncodingInfo(node, &info);
4819 ZYAN_CHECK(ZydisDecodeOptionalInstructionParts(state, instruction, info));
4820 ZYAN_CHECK(ZydisCheckErrorConditions(state, instruction, definition));
4821
4822 if (instruction->encoding == ZYDIS_INSTRUCTION_ENCODING_3DNOW)
4823 {
4824 // Get actual 3DNOW opcode and definition
4825 ZYAN_CHECK(ZydisInputNext(state, instruction, &instruction->opcode));
4826 node = ZydisDecoderTreeGetRootNode();
4827 node = ZydisDecoderTreeGetChildNode(node, 0x0F);
4828 node = ZydisDecoderTreeGetChildNode(node, 0x0F);
4829 node = ZydisDecoderTreeGetChildNode(node, instruction->opcode);
4830 if (node->type == ZYDIS_NODETYPE_INVALID)
4831 {
4832 return ZYDIS_STATUS_DECODING_ERROR;
4833 }
4834 ZYAN_ASSERT(node->type == ZYDIS_NODETYPE_FILTER_MODRM_MOD_COMPACT);
4835 node = ZydisDecoderTreeGetChildNode(
4836 node, (instruction->raw.modrm.mod == 0x3) ? 0 : 1);
4837 ZYAN_ASSERT(node->type & ZYDIS_NODETYPE_DEFINITION_MASK);
4838 ZydisGetInstructionDefinition(instruction->encoding, node->value, &definition);
4839 }
4840
4841 instruction->mnemonic = definition->mnemonic;
4842
4843 #ifndef ZYDIS_MINIMAL_MODE
4844
4845 instruction->operand_count = definition->operand_count;
4846 instruction->operand_count_visible = definition->operand_count_visible;
4847 state->context->definition = definition;
4848
4849 instruction->meta.category = definition->category;
4850 instruction->meta.isa_set = definition->isa_set;
4851 instruction->meta.isa_ext = definition->isa_ext;
4852 instruction->meta.branch_type = definition->branch_type;
4853 ZYAN_ASSERT((instruction->meta.branch_type == ZYDIS_BRANCH_TYPE_NONE) ||
4854 ((instruction->meta.category == ZYDIS_CATEGORY_CALL) ||
4855 (instruction->meta.category == ZYDIS_CATEGORY_COND_BR) ||
4856 (instruction->meta.category == ZYDIS_CATEGORY_UNCOND_BR) ||
4857 (instruction->meta.category == ZYDIS_CATEGORY_RET)));
4858 instruction->meta.exception_class = definition->exception_class;
4859
4860 if (!(state->decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_MINIMAL)))
4861 {
4862 ZydisSetAttributes(state, instruction, definition);
4863 switch (instruction->encoding)
4864 {
4865 case ZYDIS_INSTRUCTION_ENCODING_XOP:
4866 case ZYDIS_INSTRUCTION_ENCODING_VEX:
4867 case ZYDIS_INSTRUCTION_ENCODING_EVEX:
4868 case ZYDIS_INSTRUCTION_ENCODING_MVEX:
4869 ZydisSetAVXInformation(state->context, instruction, definition);
4870 break;
4871 default:
4872 break;
4873 }
4874
4875 const ZydisDefinitionAccessedFlags* flags;
4876 if (ZydisGetAccessedFlags(definition, &flags))
4877 {
4878 instruction->attributes |= ZYDIS_ATTRIB_CPUFLAG_ACCESS;
4879 }
4880 instruction->cpu_flags = &flags->cpu_flags;
4881 instruction->fpu_flags = &flags->fpu_flags;
4882 }
4883
4884 #endif
4885
4886 return ZYAN_STATUS_SUCCESS;
4887 }
4888 ZYAN_UNREACHABLE;
4889 }
4890 ZYAN_CHECK(status);
4891 node = ZydisDecoderTreeGetChildNode(node, index);
4892 } while ((node_type != ZYDIS_NODETYPE_INVALID) && !(node_type & ZYDIS_NODETYPE_DEFINITION_MASK));
4893 return ZYAN_STATUS_SUCCESS;
4894 }
4895
4896 /* ---------------------------------------------------------------------------------------------- */
4897
4898 /* ============================================================================================== */
4899 /* Exported functions */
4900 /* ============================================================================================== */
4901
4902 ZyanStatus ZydisDecoderInit(ZydisDecoder* decoder, ZydisMachineMode machine_mode,
4903 ZydisStackWidth stack_width)
4904 {
4905 ZYAN_STATIC_ASSERT(ZYDIS_DECODER_MODE_MAX_VALUE <= 32);
4906
4907 static const ZyanU32 decoder_modes =
4908 #ifdef ZYDIS_MINIMAL_MODE
4909 (1 << ZYDIS_DECODER_MODE_MINIMAL) |
4910 #endif
4911 (1 << ZYDIS_DECODER_MODE_MPX) |
4912 (1 << ZYDIS_DECODER_MODE_CET) |
4913 (1 << ZYDIS_DECODER_MODE_LZCNT) |
4914 (1 << ZYDIS_DECODER_MODE_TZCNT) |
4915 (1 << ZYDIS_DECODER_MODE_CLDEMOTE) |
4916 (1 << ZYDIS_DECODER_MODE_IPREFETCH);
4917
4918 if (!decoder)
4919 {
4920 return ZYAN_STATUS_INVALID_ARGUMENT;
4921 }
4922 switch (machine_mode)
4923 {
4924 case ZYDIS_MACHINE_MODE_LONG_64:
4925 if (stack_width != ZYDIS_STACK_WIDTH_64)
4926 {
4927 return ZYAN_STATUS_INVALID_ARGUMENT;
4928 }
4929 break;
4930 case ZYDIS_MACHINE_MODE_LONG_COMPAT_32:
4931 case ZYDIS_MACHINE_MODE_LONG_COMPAT_16:
4932 case ZYDIS_MACHINE_MODE_LEGACY_32:
4933 case ZYDIS_MACHINE_MODE_LEGACY_16:
4934 case ZYDIS_MACHINE_MODE_REAL_16:
4935 if ((stack_width != ZYDIS_STACK_WIDTH_16) && (stack_width != ZYDIS_STACK_WIDTH_32))
4936 {
4937 return ZYAN_STATUS_INVALID_ARGUMENT;
4938 }
4939 break;
4940 default:
4941 return ZYAN_STATUS_INVALID_ARGUMENT;
4942 }
4943
4944 decoder->machine_mode = machine_mode;
4945 decoder->stack_width = stack_width;
4946 decoder->decoder_mode = decoder_modes;
4947
4948 return ZYAN_STATUS_SUCCESS;
4949 }
4950
4951 ZyanStatus ZydisDecoderEnableMode(ZydisDecoder* decoder, ZydisDecoderMode mode, ZyanBool enabled)
4952 {
4953 if (!decoder || ((ZyanUSize)mode > ZYDIS_DECODER_MODE_MAX_VALUE))
4954 {
4955 return ZYAN_STATUS_INVALID_ARGUMENT;
4956 }
4957
4958 #ifdef ZYDIS_MINIMAL_MODE
4959 if ((mode == ZYDIS_DECODER_MODE_MINIMAL) && !enabled)
4960 {
4961 return ZYAN_STATUS_INVALID_OPERATION;
4962 }
4963 #endif
4964
4965 if (enabled)
4966 {
4967 decoder->decoder_mode |= (1 << mode);
4968 }
4969 else
4970 {
4971 decoder->decoder_mode &= ~(1 << mode);
4972 }
4973
4974 return ZYAN_STATUS_SUCCESS;
4975 }
4976
4977 ZyanStatus ZydisDecoderDecodeFull(const ZydisDecoder* decoder,
4978 const void* buffer, ZyanUSize length, ZydisDecodedInstruction* instruction,
4979 ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT])
4980 {
4981 if (!decoder || !instruction || !buffer || !operands)
4982 {
4983 return ZYAN_STATUS_INVALID_ARGUMENT;
4984 }
4985 if (!length)
4986 {
4987 return ZYDIS_STATUS_NO_MORE_DATA;
4988 }
4989 if (decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_MINIMAL))
4990 {
4991 return ZYAN_STATUS_MISSING_DEPENDENCY; // TODO: Introduce better status code
4992 }
4993
4994 ZydisDecoderContext context;
4995 ZYAN_CHECK(ZydisDecoderDecodeInstruction(decoder, &context, buffer, length, instruction));
4996 ZYAN_CHECK(ZydisDecoderDecodeOperands(decoder, &context, instruction, operands,
4997 instruction->operand_count));
4998 ZYAN_MEMSET(&operands[instruction->operand_count], 0,
4999 (ZYDIS_MAX_OPERAND_COUNT - instruction->operand_count) * sizeof(operands[0]));
5000
5001 return ZYAN_STATUS_SUCCESS;
5002 }
5003
5004 ZyanStatus ZydisDecoderDecodeInstruction(const ZydisDecoder* decoder, ZydisDecoderContext* context,
5005 const void* buffer, ZyanUSize length, ZydisDecodedInstruction* instruction)
5006 {
5007 if (!decoder || !instruction || !buffer)
5008 {
5009 return ZYAN_STATUS_INVALID_ARGUMENT;
5010 }
5011
5012 if (!length)
5013 {
5014 return ZYDIS_STATUS_NO_MORE_DATA;
5015 }
5016
5017 ZydisDecoderState state;
5018 ZYAN_MEMSET(&state, 0, sizeof(state));
5019 state.decoder = decoder;
5020 state.buffer = (const ZyanU8*)buffer;
5021 state.buffer_len = length;
5022 state.prefixes.offset_notrack = -1;
5023
5024 ZydisDecoderContext default_context;
5025 if (!context)
5026 {
5027 // Use a fallback context if no custom one has been provided
5028 context = &default_context;
5029 }
5030 ZYAN_MEMSET(context, 0, sizeof(*context));
5031 state.context = context;
5032
5033 ZYAN_MEMSET(instruction, 0, sizeof(*instruction));
5034 instruction->machine_mode = decoder->machine_mode;
5035 instruction->stack_width = 16 << decoder->stack_width;
5036
5037 ZYAN_CHECK(ZydisCollectOptionalPrefixes(&state, instruction));
5038 ZYAN_CHECK(ZydisDecodeInstruction(&state, instruction));
5039
5040 instruction->raw.encoding2 = instruction->encoding;
5041
5042 return ZYAN_STATUS_SUCCESS;
5043 }
5044
5045 ZyanStatus ZydisDecoderDecodeOperands(const ZydisDecoder* decoder,
5046 const ZydisDecoderContext* context, const ZydisDecodedInstruction* instruction,
5047 ZydisDecodedOperand* operands, ZyanU8 operand_count)
5048 {
5049 #ifdef ZYDIS_MINIMAL_MODE
5050
5051 ZYAN_UNUSED(decoder);
5052 ZYAN_UNUSED(context);
5053 ZYAN_UNUSED(instruction);
5054 ZYAN_UNUSED(operands);
5055 ZYAN_UNUSED(operand_count);
5056
5057 return ZYAN_STATUS_MISSING_DEPENDENCY; // TODO: Introduce better status code
5058
5059 #else
5060
5061 if (!decoder || !context || !context->definition || !instruction ||
5062 (operand_count && !operands) || (operand_count > ZYDIS_MAX_OPERAND_COUNT))
5063 {
5064 return ZYAN_STATUS_INVALID_ARGUMENT;
5065 }
5066
5067 if (decoder->decoder_mode & (1 << ZYDIS_DECODER_MODE_MINIMAL))
5068 {
5069 return ZYAN_STATUS_MISSING_DEPENDENCY; // TODO: Introduce better status code
5070 }
5071
5072 operand_count = ZYAN_MIN(operand_count, instruction->operand_count);
5073 if (!operand_count)
5074 {
5075 return ZYAN_STATUS_SUCCESS;
5076 }
5077
5078 return ZydisDecodeOperands(decoder, context, instruction, operands, operand_count);
5079
5080 #endif
5081 }
5082
5083 /* ============================================================================================== */
Windows API implementation