-
Notifications
You must be signed in to change notification settings - Fork 236
/
Copy pathil.cpp
2240 lines (2123 loc) · 73.1 KB
/
il.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#include "il.h"
using namespace BinaryNinja;
using namespace mips;
#define INVALID_EXPRID ((uint32_t)-1)
typedef enum {
ZeroExtend,
SignExtend,
} ExtendType;
static ExprId SetRegisterOrNop(LowLevelILFunction& il,
size_t size,
size_t registerSize,
uint32_t reg,
ExprId expr,
ExtendType extend = SignExtend)
{
if (reg == REG_ZERO)
return il.Nop();
else
{
if (size < registerSize)
{
switch (extend)
{
case ZeroExtend:
expr = il.ZeroExtend(registerSize, expr);
break;
case SignExtend:
expr = il.SignExtend(registerSize, expr);
break;
}
}
return il.SetRegister(registerSize, reg, expr);
}
}
static void ConditionExecute(LowLevelILFunction& il, ExprId cond, ExprId trueCase, ExprId falseCase=INVALID_EXPRID)
{
LowLevelILLabel trueCode, falseCode, done;
if (falseCase == INVALID_EXPRID)
il.AddInstruction(il.If(cond, trueCode, done));
else
il.AddInstruction(il.If(cond, trueCode, falseCode));
il.MarkLabel(trueCode);
il.AddInstruction(trueCase);
il.AddInstruction(il.Goto(done));
if (falseCase != INVALID_EXPRID)
{
il.MarkLabel(falseCode);
il.AddInstruction(falseCase);
il.AddInstruction(il.Goto(done));
}
il.MarkLabel(done);
return;
}
static size_t GetILOperandMemoryAddress(LowLevelILFunction& il, InstructionOperand& operand, size_t addrSize, int32_t delta=0)
{
size_t offset = 0;
if (operand.reg == REG_ZERO)
return il.ConstPointer(addrSize, operand.immediate + (int64_t)delta);
if (operand.operandClass == MEM_IMM)
{
if (operand.immediate + (uint64_t)((int64_t)delta) >= 0x80000000)
offset = il.Sub(addrSize,
il.Register(addrSize, operand.reg),
il.Const(addrSize, -((int32_t)operand.immediate + delta)));
else
offset = il.Add(addrSize,
il.Register(addrSize, operand.reg),
il.Const(addrSize, operand.immediate + delta));
}
else if (operand.operandClass == MEM_REG)
{
if (operand.immediate + (uint64_t)((int64_t)delta) >= 0x80000000)
offset = il.Sub(addrSize,
il.Register(addrSize, operand.reg),
il.Register(addrSize, -((int32_t)operand.immediate + delta)));
else
offset = il.Add(addrSize,
il.Register(addrSize, operand.reg),
il.Register(addrSize, operand.immediate + delta));
}
return offset;
}
static size_t ReadILOperand(LowLevelILFunction& il,
const Instruction& instr,
size_t i,
size_t registerSize,
size_t opSize = SIZE_MAX,
bool isAddress = false)
{
if (opSize == SIZE_MAX)
{
opSize = registerSize;
}
InstructionOperand operand = instr.operands[i - 1];
switch (operand.operandClass)
{
case NONE:
return il.Undefined();
case IMM:
if (isAddress)
return il.Operand(i - 1, il.ConstPointer(registerSize, operand.immediate));
return il.Operand(i - 1, il.Const(opSize, operand.immediate));
case MEM_REG:
case MEM_IMM:
return il.Operand(i - 1, il.Load(opSize, GetILOperandMemoryAddress(il, operand, registerSize)));
default:
if (operand.reg == REG_ZERO)
return il.Operand(i - 1, il.Const(opSize, 0));
return il.Operand(i - 1, il.Register(opSize, operand.reg));
}
}
static size_t WriteILOperand(LowLevelILFunction& il, Instruction& instr, size_t i, size_t addrSize, size_t value)
{
InstructionOperand& operand = instr.operands[i - 1];
switch (operand.operandClass)
{
case NONE:
case IMM:
return il.Undefined();
case MEM_IMM:
case MEM_REG:
return il.Operand(i - 1, il.Store(addrSize, GetILOperandMemoryAddress(il, operand, addrSize), value));
default:
return il.Operand(i - 1, SetRegisterOrNop(il, addrSize, addrSize, operand.reg, value));
}
}
static size_t DirectJump(Architecture* arch, LowLevelILFunction& il, uint64_t target, size_t addrSize)
{
BNLowLevelILLabel* label = il.GetLabelForAddress(arch, target);
if (label)
return il.Goto(*label);
else
return il.Jump(il.ConstPointer(addrSize, target));
}
static void ConditionalJump(Architecture* arch, LowLevelILFunction& il, size_t cond, size_t addrSize, uint64_t t, uint64_t f)
{
BNLowLevelILLabel* trueLabel = il.GetLabelForAddress(arch, t);
BNLowLevelILLabel* falseLabel = il.GetLabelForAddress(arch, f);
if (trueLabel && falseLabel)
{
il.AddInstruction(il.If(cond, *trueLabel, *falseLabel));
return;
}
LowLevelILLabel trueCode, falseCode;
if (trueLabel)
{
il.AddInstruction(il.If(cond, *trueLabel, falseCode));
il.MarkLabel(falseCode);
il.AddInstruction(il.Jump(il.ConstPointer(addrSize, f)));
return;
}
if (falseLabel)
{
il.AddInstruction(il.If(cond, trueCode, *falseLabel));
il.MarkLabel(trueCode);
il.AddInstruction(il.Jump(il.ConstPointer(addrSize, t)));
return;
}
il.AddInstruction(il.If(cond, trueCode, falseCode));
il.MarkLabel(trueCode);
il.AddInstruction(il.Jump(il.ConstPointer(addrSize, t)));
il.MarkLabel(falseCode);
il.AddInstruction(il.Jump(il.ConstPointer(addrSize, f)));
}
ExprId GetConditionForInstruction(LowLevelILFunction& il, Instruction& instr, size_t registerSize)
{
switch (instr.operation)
{
case MIPS_BEQ:
case MIPS_BEQL:
return il.CompareEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), ReadILOperand(il, instr, 2, registerSize));
case MIPS_BNE:
case MIPS_BNEL:
return il.CompareNotEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), ReadILOperand(il, instr, 2, registerSize));
case MIPS_BEQZ:
return il.CompareEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BNEZ:
return il.CompareNotEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BGEZ:
case MIPS_BGEZL:
case MIPS_BGEZAL:
return il.CompareSignedGreaterEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BGTZ:
case MIPS_BGTZL:
return il.CompareSignedGreaterThan(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BLEZ:
case MIPS_BLEZL:
return il.CompareSignedLessEqual(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BLTZ:
case MIPS_BLTZL:
case MIPS_BLTZAL:
return il.CompareSignedLessThan(registerSize, ReadILOperand(il, instr, 1, registerSize), il.Const(registerSize, 0));
case MIPS_BC1F:
case MIPS_BC1FL:
if (instr.operands[0].operandClass == FLAG)
return il.Not(0, il.Flag(instr.operands[0].reg));
return il.Not(0, il.Flag(FPCCREG_FCC0));
case MIPS_BC1T:
case MIPS_BC1TL:
if (instr.operands[0].operandClass == FLAG)
return il.Flag(instr.operands[0].reg);
return il.Flag(FPCCREG_FCC0);
case CNMIPS_BBIT0:
return il.CompareEqual(registerSize,
il.And(registerSize,
ReadILOperand(il, instr, 1, registerSize),
il.Const(registerSize, 1 << instr.operands[1].immediate)
),
il.Const(registerSize, 0)
);
case CNMIPS_BBIT032:
return il.CompareEqual(registerSize,
il.And(registerSize,
ReadILOperand(il, instr, 1, registerSize),
il.Const(registerSize, ((uint64_t)1) << (instr.operands[1].immediate + 32))
),
il.Const(registerSize, 0)
);
case CNMIPS_BBIT1:
return il.CompareNotEqual(registerSize,
il.And(registerSize,
ReadILOperand(il, instr, 1, registerSize),
il.Const(registerSize, 1 << instr.operands[1].immediate)
),
il.Const(registerSize, 0)
);
case CNMIPS_BBIT132:
return il.CompareNotEqual(registerSize,
il.And(registerSize,
ReadILOperand(il, instr, 1, registerSize),
il.Const(registerSize, ((uint64_t)1) << (instr.operands[1].immediate + 32))
),
il.Const(registerSize, 0)
);
default:
LogError("Missing conditional: %d", instr.operation);
return il.Unimplemented();
}
}
static bool IsCop0ImplementationDefined(uint32_t reg, uint64_t sel)
{
switch (reg)
{
case 9:
switch (sel)
{
case 6:
case 7: return true;
default: return false;
}
break;
case 11:
switch (sel)
{
case 6:
case 7: return true;
default: return false;
}
break;
case 16:
switch (sel)
{
case 6:
case 7: return true;
default: return false;
}
break;
case 22: return true;
default: return false;
}
}
// Get the IL Register for a given cop0 register/selector pair.
// Returns REG_ZERO for unsupported/unimplemented values.
static Reg GetCop0Register(uint32_t reg, uint64_t sel)
{
switch (reg)
{
case 0:
switch (sel)
{
case 0: return REG_INDEX;
case 1: return REG_MVP_CONTROL;
case 2: return REG_MVP_CONF0;
case 3: return REG_MVP_CONF1;
}
break;
case 1:
switch (sel)
{
case 0: return REG_RANDOM;
case 1: return REG_VPE_CONTROL;
case 2: return REG_VPE_CONF0;
case 3: return REG_VPE_CONF1;
case 4: return REG_YQ_MASK;
case 5: return REG_VPE_SCHEDULE;
case 6: return REG_VPE_SCHE_FBACK;
case 7: return REG_VPE_OPT;
}
break;
case 2:
switch (sel)
{
case 0: return REG_ENTRY_LO0;
case 1: return REG_TC_STATUS;
case 2: return REG_TC_BIND;
case 3: return REG_TC_RESTART;
case 4: return REG_TC_HALT;
case 5: return REG_TC_CONTEXT;
case 6: return REG_TC_SCHEDULE;
case 7: return REG_TC_SCHE_FBACK;
}
break;
case 3:
switch (sel)
{
case 0: return REG_ENTRY_LO1;
}
break;
case 4:
switch (sel)
{
case 0: return REG_CONTEXT;
case 1: return REG_CONTEXT_CONFIG;
}
break;
case 5:
switch (sel)
{
case 0: return REG_PAGE_MASK;
case 1: return REG_PAGE_GRAIN;
}
break;
case 6:
switch (sel)
{
case 0: return REG_WIRED;
case 1: return REG_SRS_CONF0;
case 2: return REG_SRS_CONF1;
case 3: return REG_SRS_CONF2;
case 4: return REG_SRS_CONF3;
case 5: return REG_SRS_CONF4;
}
break;
case 7:
switch (sel)
{
case 0: return REG_HWR_ENA;
}
break;
case 8:
switch (sel)
{
case 0: return REG_BAD_VADDR;
}
break;
case 9:
switch (sel)
{
case 0: return REG_COUNT;
}
break;
case 10:
switch (sel)
{
case 0: return REG_ENTRY_HI;
}
break;
case 11:
switch (sel)
{
case 0: return REG_COMPARE;
}
break;
case 12:
switch (sel)
{
case 0: return REG_STATUS;
case 1: return REG_INT_CTL;
case 2: return REG_SRS_CTL;
case 3: return REG_SRS_MAP;
}
break;
case 13:
switch (sel)
{
case 0: return REG_CAUSE;
}
break;
case 14:
switch (sel)
{
case 0: return REG_EPC;
}
break;
case 15:
switch (sel)
{
case 0: return REG_PR_ID;
case 1: return REG_EBASE;
}
break;
case 16:
switch (sel)
{
case 0: return REG_CONFIG;
case 1: return REG_CONFIG1;
case 2: return REG_CONFIG2;
case 3: return REG_CONFIG3;
}
break;
case 17:
switch (sel)
{
case 0: return REG_LLADDR;
}
break;
case 20:
switch (sel)
{
case 0: return REG_XCONTEXT;
}
break;
case 23:
switch (sel)
{
case 0: return REG_DEBUG;
case 1: return REG_TRACE_CONTROL;
case 2: return REG_TRACE_CONTROL2;
case 3: return REG_USER_TRACE_DATA;
case 4: return REG_TRACE_BPC;
}
break;
case 24:
switch (sel)
{
case 0: return REG_DEPC;
}
break;
case 26:
switch (sel)
{
case 0: return REG_ERR_CTL;
}
break;
case 27:
switch (sel)
{
case 0: return REG_CACHE_ERR0;
case 1: return REG_CACHE_ERR1;
case 2: return REG_CACHE_ERR2;
case 3: return REG_CACHE_ERR3;
}
break;
case 30:
switch (sel)
{
case 0: return REG_ERROR_EPC;
}
break;
case 31:
switch (sel)
{
case 0: return REG_DESAVE;
}
break;
}
return REG_ZERO;
}
static Reg GetCaviumCop0Register(uint32_t reg, uint64_t sel)
{
switch (reg)
{
case 9:
switch (sel)
{
case 6: return CNREG0_CVM_COUNT;
case 7: return CNREG0_CVM_CTL;
default: return REG_ZERO;
}
break;
case 11:
switch (sel)
{
case 6: return CNREG0_POWTHROTTLE;
case 7: return CNREG0_CVM_MEM_CTL;
default: return REG_ZERO;
}
break;
case 22:
switch (sel)
{
case 0: return CNREG0_MULTICORE_DBG;
default: return REG_ZERO;
}
break;
default: return REG_ZERO;
}
}
static Reg GetCaviumCop2Register(uint32_t reg)
{
switch (reg)
{
case 0x0040: return CNREG2_0040_HSH_DAT0;
case 0x0041: return CNREG2_0041_HSH_DAT1;
case 0x0042: return CNREG2_0042_HSH_DAT2;
case 0x0043: return CNREG2_0043_HSH_DAT3;
case 0x0044: return CNREG2_0044_HSH_DAT4;
case 0x0045: return CNREG2_0045_HSH_DAT5;
case 0x0046: return CNREG2_0046_HSH_DAT6;
case 0x0048: return CNREG2_0048_HSH_IV0;
case 0x0049: return CNREG2_0049_HSH_IV1;
case 0x004a: return CNREG2_004A_HSH_IV2;
case 0x004b: return CNREG2_004B_HSH_IV3;
case 0x0050: return CNREG2_0050_SHA3_DAT24;
case 0x0051: return CNREG2_0051_SHA3_DAT15_RD;
case 0x0058: return CNREG2_0058_GFM_MUL_REFLECT0;
case 0x0059: return CNREG2_0059_GFM_MUL_REFLECT1;
case 0x005a: return CNREG2_005A_GFM_RESINP_REFLECT0;
case 0x005b: return CNREG2_005B_GFM_RESINP_REFLECT1;
case 0x005c: return CNREG2_005C_GFM_XOR0_REFLECT;
case 0x0080: return CNREG2_0080_3DES_KEY0;
case 0x0081: return CNREG2_0081_3DES_KEY1;
case 0x0082: return CNREG2_0082_3DES_KEY2;
case 0x0084: return CNREG2_0084_3DES_IV;
case 0x0088: return CNREG2_0088_3DES_RESULT_RD;
case 0x0098: return CNREG2_0098_3DES_RESULT_WR;
case 0x0100: return CNREG2_0100_AES_RESULT0;
case 0x0101: return CNREG2_0101_AES_RESULT1;
case 0x0102: return CNREG2_0102_AES_IV0;
case 0x0103: return CNREG2_0103_AES_IV1;
case 0x0104: return CNREG2_0104_AES_KEY0;
case 0x0105: return CNREG2_0105_AES_KEY1;
case 0x0106: return CNREG2_0106_AES_KEY2;
case 0x0107: return CNREG2_0107_AES_KEY3;
case 0x0108: return CNREG2_0108_AES_ENC_CBC0;
case 0x010a: return CNREG2_010A_AES_ENC0;
case 0x010c: return CNREG2_010C_AES_DEC_CBC0;
case 0x010e: return CNREG2_010E_AES_DEC0;
case 0x0110: return CNREG2_0110_AES_KEYLENGTH;
case 0x0111: return CNREG2_0111_AES_DAT0;
case 0x0115: return CNREG2_0115_CAMELLIA_FL;
case 0x0116: return CNREG2_0116_CAMELLIA_FLINV;
case 0x0200: return CNREG2_0200_CRC_POLYNOMIAL;
case 0x0201: return CNREG2_0201_CRC_IV;
case 0x0202: return CNREG2_0202_CRC_LEN;
case 0x0203: return CNREG2_0203_CRC_IV_REFLECT_RD;
case 0x0204: return CNREG2_0204_CRC_BYTE;
case 0x0205: return CNREG2_0205_CRC_HALF;
case 0x0206: return CNREG2_0206_CRC_WORD;
case 0x0211: return CNREG2_0211_CRC_IV_REFLECT_WR;
case 0x0214: return CNREG2_0214_CRC_BYTE_REFLECT;
case 0x0215: return CNREG2_0215_CRC_HALF_REFLECT;
case 0x0216: return CNREG2_0216_CRC_WORD_REFLECT;
case 0x0240: return CNREG2_0240_HSH_DATW0;
case 0x0241: return CNREG2_0241_HSH_DATW1;
case 0x0242: return CNREG2_0242_HSH_DATW2;
case 0x0243: return CNREG2_0243_HSH_DATW3;
case 0x0244: return CNREG2_0244_HSH_DATW4;
case 0x0245: return CNREG2_0245_HSH_DATW5;
case 0x0246: return CNREG2_0246_HSH_DATW6;
case 0x0247: return CNREG2_0247_HSH_DATW7;
case 0x0248: return CNREG2_0248_HSH_DATW8;
case 0x0249: return CNREG2_0249_HSH_DATW9;
case 0x024a: return CNREG2_024A_HSH_DATW10;
case 0x024b: return CNREG2_024B_HSH_DATW11;
case 0x024c: return CNREG2_024C_HSH_DATW12;
case 0x024d: return CNREG2_024D_HSH_DATW13;
case 0x024e: return CNREG2_024E_HSH_DATW14;
case 0x024f: return CNREG2_024F_SHA3_DAT15_RD;
case 0x0250: return CNREG2_0250_HSH_IVW0;
case 0x0251: return CNREG2_0251_HSH_IVW1;
case 0x0252: return CNREG2_0252_HSH_IVW2;
case 0x0253: return CNREG2_0253_HSH_IVW3;
case 0x0254: return CNREG2_0254_HSH_IVW4;
case 0x0255: return CNREG2_0255_HSH_IVW5;
case 0x0256: return CNREG2_0256_HSH_IVW6;
case 0x0257: return CNREG2_0257_HSH_IVW7;
case 0x0258: return CNREG2_0258_GFM_MUL0;
case 0x0259: return CNREG2_0259_GFM_MUL1;
case 0x025a: return CNREG2_025A_GFM_RESINP0;
case 0x025b: return CNREG2_025B_GFM_RESINP1;
case 0x025c: return CNREG2_025C_GFM_XOR0;
case 0x025e: return CNREG2_025E_GFM_POLY;
case 0x02c0: return CNREG2_02C0_SHA3_XORDAT0;
case 0x02c1: return CNREG2_02C1_SHA3_XORDAT1;
case 0x02c2: return CNREG2_02C2_SHA3_XORDAT2;
case 0x02c3: return CNREG2_02C3_SHA3_XORDAT3;
case 0x02c4: return CNREG2_02C4_SHA3_XORDAT4;
case 0x02c5: return CNREG2_02C5_SHA3_XORDAT5;
case 0x02c6: return CNREG2_02C6_SHA3_XORDAT6;
case 0x02c7: return CNREG2_02C7_SHA3_XORDAT7;
case 0x02c8: return CNREG2_02C8_SHA3_XORDAT8;
case 0x02c9: return CNREG2_02C9_SHA3_XORDAT9;
case 0x02ca: return CNREG2_02CA_SHA3_XORDAT10;
case 0x02cb: return CNREG2_02CB_SHA3_XORDAT11;
case 0x02cc: return CNREG2_02CC_SHA3_XORDAT12;
case 0x02cd: return CNREG2_02CD_SHA3_XORDAT13;
case 0x02ce: return CNREG2_02CE_SHA3_XORDAT14;
case 0x02cf: return CNREG2_02CF_SHA3_XORDAT15;
case 0x02d0: return CNREG2_02D0_SHA3_XORDAT16;
case 0x02d1: return CNREG2_02D1_SHA3_XORDAT17;
case 0x0400: return CNREG2_0400_LLM_READ_ADDR0;
case 0x0401: return CNREG2_0401_LLM_WRITE_ADDR_INTERNAL0;
case 0x0402: return CNREG2_0402_LLM_DATA0;
case 0x0404: return CNREG2_0404_LLM_READ64_ADDR0;
case 0x0405: return CNREG2_0405_LLM_WRITE64_ADDR_INTERNAL0;
case 0x0408: return CNREG2_0408_LLM_READ_ADDR1;
case 0x0409: return CNREG2_0409_LLM_WRITE_ADDR_INTERNAL1;
case 0x040a: return CNREG2_040a_LLM_DATA1;
case 0x040c: return CNREG2_040c_LLM_READ64_ADDR1;
case 0x040d: return CNREG2_040d_LLM_WRITE64_ADDR_INTERNAL1;
case 0x1202: return CNREG2_1202_CRC_LEN;
case 0x1207: return CNREG2_1207_CRC_DWORD;
case 0x1208: return CNREG2_1208_CRC_VAR;
case 0x1217: return CNREG2_1217_CRC_DWORD_REFLECT;
case 0x1218: return CNREG2_1218_CRC_VAR_REFLECT;
case 0x3109: return CNREG2_3109_AES_ENC_CBC1;
case 0x310b: return CNREG2_310B_AES_ENC1;
case 0x310d: return CNREG2_310D_AES_DEC_CBC1;
case 0x310f: return CNREG2_310F_AES_DEC1;
case 0x3114: return CNREG2_3114_CAMELLIA_ROUND;
case 0x3119: return CNREG2_3119_SMS4_ENC_CBC1;
case 0x311b: return CNREG2_311B_SMS4_ENC1;
case 0x311d: return CNREG2_311D_SMS4_DEC_CBC1;
case 0x311f: return CNREG2_311F_SMS4_DEC1;
case 0x4052: return CNREG2_4052_SHA3_STARTOP;
case 0x4047: return CNREG2_4047_HSH_STARTMD5;
case 0x404d: return CNREG2_404D_SNOW3G_START;
case 0x4055: return CNREG2_4055_ZUC_START;
case 0x4056: return CNREG2_4056_ZUC_MORE;
case 0x405d: return CNREG2_405D_GFM_XORMUL1_REFLECT;
case 0x404e: return CNREG2_404E_SNOW3G_MORE;
case 0x404f: return CNREG2_404F_HSH_STARTSHA256;
case 0x4057: return CNREG2_4057_HSH_STARTSHA;
case 0x4088: return CNREG2_4088_3DES_ENC_CBC;
case 0x4089: return CNREG2_4089_KAS_ENC_CBC;
case 0x408a: return CNREG2_408A_3DES_ENC;
case 0x408b: return CNREG2_408B_KAS_ENC;
case 0x408c: return CNREG2_408C_3DES_DEC_CBC;
case 0x408e: return CNREG2_408E_3DES_DEC;
case 0x4200: return CNREG2_4200_CRC_POLYNOMIAL_WR;
case 0x4210: return CNREG2_4210_CRC_POLYNOMIAL_REFLECT;
case 0x424f: return CNREG2_424F_HSH_STARTSHA512;
case 0x425d: return CNREG2_425D_GFM_XORMUL1;
default: return REG_ZERO;
}
}
static ExprId MoveFromCoprocessor(unsigned cop, LowLevelILFunction& il, size_t loadSize, uint32_t outReg, uint32_t reg, uint64_t sel, uint32_t decomposeFlags)
{
if (cop == 0)
{
Reg copReg = GetCop0Register(reg, sel);
if (copReg == REG_ZERO && IsCop0ImplementationDefined(reg, sel))
{
if ((decomposeFlags & DECOMPOSE_FLAGS_CAVIUM) != 0)
{
copReg = GetCaviumCop0Register(reg, sel);
}
}
if (copReg != REG_ZERO)
{
return il.Intrinsic(
{RegisterOrFlag::Register(outReg)},
loadSize == 4 ? MIPS_INTRIN_MFC0 : MIPS_INTRIN_DMFC0,
{il.Register(loadSize, copReg)});
}
}
else if (cop == 2)
{
if ((decomposeFlags & DECOMPOSE_FLAGS_CAVIUM) != 0)
{
Reg cop2Reg = GetCaviumCop2Register(reg);
if (cop2Reg != REG_ZERO)
{
return il.Intrinsic(
{RegisterOrFlag::Register(outReg)},
loadSize == 4 ? MIPS_INTRIN_MFC2 : MIPS_INTRIN_DMFC2,
{il.Register(loadSize, cop2Reg)});
}
}
}
return il.Intrinsic(
{RegisterOrFlag::Register(outReg)},
loadSize == 4 ? MIPS_INTRIN_MFC_UNIMPLEMENTED : MIPS_INTRIN_DMFC_UNIMPLEMENTED,
{il.Const(4, cop), il.Const(4, reg), il.Const(4, sel)});
}
static ExprId MoveToCoprocessor(unsigned cop, LowLevelILFunction& il, size_t storeSize, uint32_t reg, uint64_t sel, ExprId srcExpr, uint32_t decomposeFlags)
{
if (cop == 0)
{
Reg copReg = GetCop0Register(reg, sel);
if (copReg == REG_ZERO && IsCop0ImplementationDefined(reg, sel))
{
if ((decomposeFlags & DECOMPOSE_FLAGS_CAVIUM) != 0)
{
copReg = GetCaviumCop0Register(reg, sel);
}
}
if (copReg != REG_ZERO)
{
return il.Intrinsic(
{},
storeSize == 4 ? MIPS_INTRIN_MTC0 : MIPS_INTRIN_DMTC0,
{il.Register(storeSize, copReg), srcExpr});
}
}
else if (cop == 2)
{
if ((decomposeFlags & DECOMPOSE_FLAGS_CAVIUM) != 0)
{
Reg cop2Reg = GetCaviumCop2Register(reg);
if (cop2Reg != REG_ZERO)
{
return il.Intrinsic(
{},
storeSize == 4 ? MIPS_INTRIN_MTC2 : MIPS_INTRIN_DMTC2,
{il.Register(storeSize, cop2Reg), srcExpr});
}
}
}
return il.Intrinsic(
{},
storeSize == 4 ? MIPS_INTRIN_MTC_UNIMPLEMENTED : MIPS_INTRIN_DMTC_UNIMPLEMENTED,
{il.Const(4, cop), il.Const(4, reg), il.Const(4, sel), srcExpr});
}
static ExprId SimpleIntrinsic(LowLevelILFunction& il, MipsIntrinsic intrinsic)
{
return il.Intrinsic({}, intrinsic, {});
}
// returns 256-bit value of [0:64] || [regHi] || [regMid] || [regLo]
static ExprId Concat3to256(LowLevelILFunction& il, uint32_t regHi, uint32_t regMid, uint32_t regLo)
{
return il.Or(0x20,
il.ShiftLeft(0x20, il.ZeroExtend(0x20, il.Register(8, regHi)), il.Const(4, 0x80)),
il.Or(0x20,
il.ShiftLeft(0x20, il.ZeroExtend(0x20, il.Register(8, regMid)), il.Const(4, 0x40)),
il.ZeroExtend(0x20, il.Register(8, regLo))
)
);
}
static void SignExtendHiLo(LowLevelILFunction& il, size_t registerSize)
{
if (registerSize == 8)
{
il.AddInstruction(il.SetRegister(8, REG_HI,
il.SignExtend(8, il.LowPart(4, il.Register(registerSize, REG_HI)))
));
il.AddInstruction(il.SetRegister(8, REG_LO,
il.SignExtend(8, il.LowPart(4, il.Register(registerSize, REG_LO)))
));
}
}
bool GetLowLevelILForInstruction(Architecture* arch, uint64_t addr, LowLevelILFunction& il, Instruction& instr, size_t addrSize, uint32_t decomposeFlags)
{
LowLevelILLabel trueLabel, falseLabel, doneLabel, dirFlagSet, dirFlagClear, dirFlagDone;
InstructionOperand& op1 = instr.operands[0];
InstructionOperand& op2 = instr.operands[1];
InstructionOperand& op3 = instr.operands[2];
InstructionOperand& op4 = instr.operands[3];
LowLevelILLabel trueCode, falseCode, again;
size_t registerSize = addrSize;
BNEndianness endian = arch->GetEndianness();
switch (instr.operation)
{
case MIPS_ADD:
case MIPS_ADDU:
case MIPS_ADDI:
case MIPS_ADDIU:
if (op2.reg == REG_ZERO)
il.AddInstruction(SetRegisterOrNop(il, 4, registerSize, op1.reg, ReadILOperand(il, instr, 3, registerSize, 4)));
else
il.AddInstruction(
SetRegisterOrNop(il, 4, registerSize, op1.reg,
il.Add(4,
ReadILOperand(il, instr, 2, registerSize, 4),
ReadILOperand(il, instr, 3, registerSize, 4))));
break;
case MIPS_DADD:
case MIPS_DADDU:
case MIPS_DADDI:
case MIPS_DADDIU:
if (op2.reg == REG_ZERO)
il.AddInstruction(SetRegisterOrNop(il, 8, registerSize, op1.reg, ReadILOperand(il, instr, 3, registerSize)));
else
il.AddInstruction(
SetRegisterOrNop(il, 8, registerSize, op1.reg,
il.Add(8,
ReadILOperand(il, instr, 2, registerSize),
ReadILOperand(il, instr, 3, registerSize))));
break;
case MIPS_SUB:
case MIPS_SUBU:
il.AddInstruction(SetRegisterOrNop(il, 4, registerSize, op1.reg,
il.Sub(4,
ReadILOperand(il, instr, 2, registerSize, 4),
ReadILOperand(il, instr, 3, registerSize, 4))));
break;
case MIPS_DSUB:
case MIPS_DSUBU:
il.AddInstruction(SetRegisterOrNop(il, 8, registerSize, op1.reg,
il.Sub(8,
ReadILOperand(il, instr, 2, registerSize, 8),
ReadILOperand(il, instr, 3, registerSize, 8))));
break;
case MIPS_AND:
il.AddInstruction(SetRegisterOrNop(il, registerSize, registerSize, op1.reg,
il.And(registerSize,
ReadILOperand(il, instr, 2, registerSize),
ReadILOperand(il, instr, 3, registerSize))));
break;
case MIPS_ANDI:
il.AddInstruction(SetRegisterOrNop(il, registerSize, registerSize, op1.reg,
il.And(registerSize,
ReadILOperand(il, instr, 2, registerSize),
il.Operand(1, il.Const(4, 0x0000ffff & op3.immediate)))));
break;
case MIPS_DIV:
il.AddInstruction(il.SetRegister(4, REG_LO,
il.DivSigned(4,
ReadILOperand(il, instr, 1, registerSize, 4),
ReadILOperand(il, instr, 2, registerSize, 4))));
il.AddInstruction(il.SetRegister(4, REG_HI,
il.ModSigned(4,
ReadILOperand(il, instr, 1, registerSize, 4),
ReadILOperand(il, instr, 2, registerSize, 4))));
SignExtendHiLo(il, registerSize);
break;
case MIPS_DIVU:
il.AddInstruction(il.SetRegister(4, REG_LO,
il.DivUnsigned(4,
ReadILOperand(il, instr, 1, registerSize, 4),
ReadILOperand(il, instr, 2, registerSize, 4))));
il.AddInstruction(il.SetRegister(4, REG_HI,
il.ModUnsigned(4,
ReadILOperand(il, instr, 1, registerSize, 4),
ReadILOperand(il, instr, 2, registerSize, 4))));
SignExtendHiLo(il, registerSize);
break;
case MIPS_DDIV:
il.AddInstruction(il.SetRegister(8, REG_LO,
il.DivSigned(8,
ReadILOperand(il, instr, 1, registerSize, 8),
ReadILOperand(il, instr, 2, registerSize, 8))));
il.AddInstruction(il.SetRegister(8, REG_HI,
il.ModSigned(8,
ReadILOperand(il, instr, 1, registerSize, 8),
ReadILOperand(il, instr, 2, registerSize, 8))));
break;
case MIPS_DDIVU:
il.AddInstruction(il.SetRegister(8, REG_LO,
il.DivUnsigned(8,
ReadILOperand(il, instr, 1, registerSize, 8),
ReadILOperand(il, instr, 2, registerSize, 8))));
il.AddInstruction(il.SetRegister(8, REG_HI,
il.ModUnsigned(8,
ReadILOperand(il, instr, 1, registerSize, 8),
ReadILOperand(il, instr, 2, registerSize, 8))));
break;
case MIPS_MUL:
il.AddInstruction(SetRegisterOrNop(il, 4, registerSize, op1.reg,
il.Mult(4,
ReadILOperand(il, instr, 2, registerSize, 4),
ReadILOperand(il, instr, 3, registerSize, 4))));
break;
case MIPS_XOR:
il.AddInstruction(SetRegisterOrNop(il, registerSize, registerSize, op1.reg,
il.Xor(registerSize,
ReadILOperand(il, instr, 2, registerSize),
ReadILOperand(il, instr, 3, registerSize))));
break;
case MIPS_XORI:
il.AddInstruction(SetRegisterOrNop(il, registerSize, registerSize, op1.reg,
il.Xor(registerSize,
ReadILOperand(il, instr, 2, registerSize),
il.Operand(1,il.Const(4, 0x0000ffff & op3.immediate)))));
break;
case MIPS_B:
case MIPS_J:
il.AddInstruction(DirectJump(arch, il, op1.immediate, addrSize));
break;
case MIPS_JAL:
case MIPS_BAL:
if (op1.immediate == (addr + 8)) // Get PC construct
il.AddInstruction(il.SetRegister(addrSize, REG_RA, il.ConstPointer(addrSize ,addr + 8)));
else
il.AddInstruction(il.Call(il.ConstPointer(addrSize, op1.immediate)));
break;
case MIPS_BEQ:
case MIPS_BNE:
case MIPS_BEQL: //Branch likely
case MIPS_BNEL:
ConditionalJump(arch, il, GetConditionForInstruction(il, instr, registerSize), addrSize, op3.immediate, addr + 8);
return false;
case MIPS_BEQZ:
case MIPS_BGEZ:
case MIPS_BGTZ:
case MIPS_BLEZ:
case MIPS_BLTZ:
case MIPS_BNEZ:
case MIPS_BGEZL: //Branch likely
case MIPS_BGTZL:
case MIPS_BLEZL:
case MIPS_BLTZL:
ConditionalJump(arch, il, GetConditionForInstruction(il, instr, registerSize), addrSize, op2.immediate, addr + 8);
return false;
case MIPS_BC1F:
case MIPS_BC1FL:
if (op1.operandClass == FLAG)
ConditionalJump(arch, il, il.Not(0, il.Flag(op1.reg)), addrSize, op2.immediate, addr + 8);
else
ConditionalJump(arch, il, il.Not(0, il.Flag(FPCCREG_FCC0)), addrSize, op1.immediate, addr + 8);
return false;
case MIPS_BC1T:
case MIPS_BC1TL:
if (op1.operandClass == FLAG)
ConditionalJump(arch, il, il.Flag(op1.reg), addrSize, op2.immediate, addr + 8);
else
ConditionalJump(arch, il, il.Flag(FPCCREG_FCC0), addrSize, op1.immediate, addr + 8);
return false;
case MIPS_BGEZAL:
case MIPS_BLTZAL:
il.AddInstruction(il.If(GetConditionForInstruction(il, instr, registerSize), trueCode, falseCode));
il.MarkLabel(trueCode);
il.AddInstruction(il.Call(ReadILOperand(il, instr, 2, registerSize)));
il.MarkLabel(falseCode);
break;
case MIPS_BREAK:
il.AddInstruction(il.Breakpoint());
break;
case MIPS_CLO:
//count leading ones
//algorithm is as follows
//
//tmp0 = 0;
//again:
//if (((op2 << tmp) & 0x80000000) != 0)
//{
// tmp0 += 1;
// goto again;
//}
//
il.AddInstruction(il.SetRegister(1, LLIL_TEMP(0), il.Const(4,0)));
il.MarkLabel(again);
il.AddInstruction(il.If(il.CompareNotEqual(4,
il.And(4, il.ShiftLeft(4, ReadILOperand(il, instr, 2, registerSize, 4), il.Register(1, LLIL_TEMP(0))), il.Const(4, 0x80000000)),
il.Const(4,0)), trueCode, falseCode));
il.MarkLabel(trueCode);
il.AddInstruction(il.SetRegister(1, LLIL_TEMP(0), il.Add(1, il.Const(1,1), il.Register(1, LLIL_TEMP(0)))));