1 /***************************************************************************************************
3 Zyan Disassembler Library (Zydis)
5 Original Author : Florian Bernd
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
14 * The above copyright notice and this permission notice shall be included in all
15 * copies or substantial portions of the Software.
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
25 ***************************************************************************************************/
27 #include <Zycore/LibC.h>
28 #include <Zydis/Utils.h>
30 /* ============================================================================================== */
31 /* Exported functions */
32 /* ============================================================================================== */
34 /* ---------------------------------------------------------------------------------------------- */
35 /* Address calculation */
36 /* ---------------------------------------------------------------------------------------------- */
38 // Signed integer overflow is expected behavior in this function, for wrapping around the
39 // instruction pointer on jumps right at the end of the address space.
40 ZYAN_NO_SANITIZE("signed-integer-overflow")
41 ZyanStatus
ZydisCalcAbsoluteAddress(const ZydisDecodedInstruction
* instruction
,
42 const ZydisDecodedOperand
* operand
, ZyanU64 runtime_address
, ZyanU64
* result_address
)
44 if (!instruction
|| !operand
|| !result_address
)
46 return ZYAN_STATUS_INVALID_ARGUMENT
;
49 switch (operand
->type
)
51 case ZYDIS_OPERAND_TYPE_MEMORY
:
52 if (!operand
->mem
.disp
.has_displacement
)
54 return ZYAN_STATUS_INVALID_ARGUMENT
;
56 if (operand
->mem
.base
== ZYDIS_REGISTER_EIP
)
58 *result_address
= ((ZyanU32
)runtime_address
+ instruction
->length
+
59 (ZyanU32
)operand
->mem
.disp
.value
);
60 return ZYAN_STATUS_SUCCESS
;
62 if (operand
->mem
.base
== ZYDIS_REGISTER_RIP
)
64 *result_address
= (ZyanU64
)(runtime_address
+ instruction
->length
+
65 operand
->mem
.disp
.value
);
66 return ZYAN_STATUS_SUCCESS
;
68 if ((operand
->mem
.base
== ZYDIS_REGISTER_NONE
) &&
69 (operand
->mem
.index
== ZYDIS_REGISTER_NONE
))
71 switch (instruction
->address_width
)
74 *result_address
= (ZyanU64
)operand
->mem
.disp
.value
& 0x000000000000FFFF;
75 return ZYAN_STATUS_SUCCESS
;
77 *result_address
= (ZyanU64
)operand
->mem
.disp
.value
& 0x00000000FFFFFFFF;
78 return ZYAN_STATUS_SUCCESS
;
80 *result_address
= (ZyanU64
)operand
->mem
.disp
.value
;
81 return ZYAN_STATUS_SUCCESS
;
83 return ZYAN_STATUS_INVALID_ARGUMENT
;
87 case ZYDIS_OPERAND_TYPE_IMMEDIATE
:
88 if (operand
->imm
.is_signed
&& operand
->imm
.is_relative
)
90 *result_address
= (ZyanU64
)((ZyanI64
)runtime_address
+ instruction
->length
+
91 operand
->imm
.value
.s
);
92 switch (instruction
->machine_mode
)
94 case ZYDIS_MACHINE_MODE_LONG_COMPAT_16
:
95 case ZYDIS_MACHINE_MODE_LEGACY_16
:
96 case ZYDIS_MACHINE_MODE_REAL_16
:
97 case ZYDIS_MACHINE_MODE_LONG_COMPAT_32
:
98 case ZYDIS_MACHINE_MODE_LEGACY_32
:
99 // `XBEGIN` is a special case as it doesn't truncate computed address
100 // This behavior is documented by Intel (SDM Vol. 2C):
101 // Use of the 16-bit operand size does not cause this address to be truncated to
102 // 16 bits, unlike a near jump to a relative offset.
103 if ((instruction
->operand_width
== 16) &&
104 (instruction
->mnemonic
!= ZYDIS_MNEMONIC_XBEGIN
))
106 *result_address
&= 0xFFFF;
109 case ZYDIS_MACHINE_MODE_LONG_64
:
112 return ZYAN_STATUS_INVALID_ARGUMENT
;
114 return ZYAN_STATUS_SUCCESS
;
121 return ZYAN_STATUS_INVALID_ARGUMENT
;
124 ZyanStatus
ZydisCalcAbsoluteAddressEx(const ZydisDecodedInstruction
* instruction
,
125 const ZydisDecodedOperand
* operand
, ZyanU64 runtime_address
,
126 const ZydisRegisterContext
* register_context
, ZyanU64
* result_address
)
128 // TODO: Test this with AGEN/MIB operands
129 // TODO: Add support for Gather/Scatter instructions
131 if (!instruction
|| !operand
|| !register_context
|| !result_address
)
133 return ZYAN_STATUS_INVALID_ARGUMENT
;
136 if ((operand
->type
!= ZYDIS_OPERAND_TYPE_MEMORY
) ||
137 ((operand
->mem
.base
== ZYDIS_REGISTER_NONE
) &&
138 (operand
->mem
.index
== ZYDIS_REGISTER_NONE
)) ||
139 (operand
->mem
.base
== ZYDIS_REGISTER_EIP
) ||
140 (operand
->mem
.base
== ZYDIS_REGISTER_RIP
))
142 return ZydisCalcAbsoluteAddress(instruction
, operand
, runtime_address
, result_address
);
145 ZyanU64 value
= operand
->mem
.disp
.value
;
146 if (operand
->mem
.base
)
148 value
+= register_context
->values
[operand
->mem
.base
];
150 if (operand
->mem
.index
)
152 value
+= register_context
->values
[operand
->mem
.index
] * operand
->mem
.scale
;
155 switch (instruction
->address_width
)
158 *result_address
= value
& 0x000000000000FFFF;
159 return ZYAN_STATUS_SUCCESS
;
161 *result_address
= value
& 0x00000000FFFFFFFF;
162 return ZYAN_STATUS_SUCCESS
;
164 *result_address
= value
;
165 return ZYAN_STATUS_SUCCESS
;
167 return ZYAN_STATUS_INVALID_ARGUMENT
;
171 /* ============================================================================================== */