|
#define | EAX 0 |
#define | ECX 1 |
#define | EDX 2 |
#define | EBX 3 |
#define | ESP 4 |
#define | EBP 5 |
#define | ESI 6 |
#define | EDI 7 |
#define | AX 0 |
#define | CX 1 |
#define | DX 2 |
#define | BX 3 |
#define | SP 4 |
#define | BP 5 |
#define | SI 6 |
#define | DI 7 |
#define | AL 0 |
#define | CL 1 |
#define | DL 2 |
#define | BL 3 |
#define | MOVid(r32, i32) |
| mov r32,i32
|
#define | MOVrd(dr32, sr32) |
| mov dr32,sr32
|
#define | MOVodd(dr32, sr32, off) |
| mov dr32,sr32[off]
|
#define | MOVobd(dr32, sr32, or32) |
| mov dr32,sr32[or32]
|
#define | MOVobw(dr32, sr32, or32) |
| mov dr16,sr32[or32]
|
#define | MOVobb(dr8, sr32, or32) |
| mov dr8,sr32[or32]
|
#define | MOVomd(dr32, or32, sr32) |
| mov [dr32][or32],sr32
|
#define | BSWAP(dr32) |
| bswap dr32
|
#define | SWAP_AX() |
| xchg al,ah
|
#define | PUSH(r32) |
| push r32
|
#define | POP(r32) |
| pop r32
|
#define | RET() |
| ret
|
#define | ADDrd(dr32, sr32) |
| add dr32,sr32
|
#define | ADD_EAXi(i32) |
| add eax,i32
|
#define | ADDid(r32, i32) |
| add r32,i32
|
#define | ADDib(r32, i8) |
| add r32,i8
|
#define | SUBrd(dr32, sr32) |
| sub dr32,sr32
|
#define | SUB_EAXi(i32) |
| sub eax,i32
|
#define | MULrd(r32) |
| mul r32
|
#define | DIVrd(r32) |
| div r32
|
#define | ANDib(r8, i8) |
| and r8,i8
|
#define | ANDid(r32, i32) |
| and r32,i32
|
#define | ANDrd(dr32, sr32) |
| and dr32,sr32
|
#define | ORrd(dr32, sr32) |
| or dr32,sr32
|
#define | ORid(r32, i32) |
| or r32,i32
|
#define | SHLib(r32, i8) |
| shl r32,i8
|
#define | SHL_CLrb(dr32) |
| shl dr32,cl
|
#define | SHRib(r32, i8) |
| shr r32,i8
|
#define | SHR_CLrb(dr32) |
| shr dr32,cl
|
#define | NEGd(r32) |
| neg r32
|
#define | CMPodd(dr32, sr32, off) |
| cmp dr32,sr32[off]
|
#define | CMPrd(dr32, sr32) |
| cmp dr32,sr32
|
#define | CMPid(dr32, i32) |
| cmp dr32,i32
|
#define | JNEb(off8) |
| jne off32
|
#define | JAb(off8) |
| ja off32
|
#define | JE(off32) |
| je off32
|
#define | JLE(off32) |
| jle off32
|
#define | JLEb(off8) |
| jle off8
|
#define | JBEb(off8) |
| jbe off8
|
#define | JBb(off8) |
| jb off8
|
#define | JA(off32) |
| ja off32
|
#define | JAE(off32) |
| jae off32
|
#define | JG(off32) |
| jg off32
|
#define | JGE(off32) |
| jge off32
|
#define | JMP(off32) |
| jmp off32
|
|
typedef struct binary_stream | binary_stream |
| A stream of X86 binary code.
|
typedef UINT(__cdecl * | BPF_filter_function) (PVOID *, ULONG, UINT) |
| Prototype of a filtering function created by the jitter.
|
typedef void(* | emit_func) (binary_stream *stream, ULONG value, UINT n) |
| Prototype of the emit functions.
|
typedef struct JIT_BPF_Filter | JIT_BPF_Filter |
| Structure describing a x86 filtering program created by the jitter.
|
◆ ADD_EAXi
Value: emitm(&stream, 0x05, 1);\
emitm(&stream, i32, 4);
add eax,i32
Definition at line 175 of file jitter.h.
◆ ADDib
#define ADDib |
( |
| r32, |
|
|
| i8 ) |
Value: emitm(&stream, 0x83, 1);\
emitm(&stream, 24 << 3 | r32, 1);\
emitm(&stream, i8, 1);
add r32,i8
Definition at line 186 of file jitter.h.
◆ ADDid
#define ADDid |
( |
| r32, |
|
|
| i32 ) |
Value: emitm(&stream, 0x81, 1);\
emitm(&stream, 24 << 3 | r32, 1);\
emitm(&stream, i32, 4);
add r32,i32
Definition at line 180 of file jitter.h.
◆ ADDrd
#define ADDrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x03, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);
add dr32,sr32
Definition at line 170 of file jitter.h.
◆ AL
◆ ANDib
Value: emitm(&stream, 0x80, 1);\
emitm(&stream, 7 << 5 | r8, 1);\
emitm(&stream, i8, 1);
and r8,i8
Definition at line 212 of file jitter.h.
◆ ANDid
#define ANDid |
( |
| r32, |
|
|
| i32 ) |
Value:
emitm(&stream, 0x25, 1);\
emitm(&stream, i32, 4);}\
else{ \
emitm(&stream, 0x81, 1);\
emitm(&stream, 7 << 5 | r32, 1);\
emitm(&stream, i32, 4);}
and r32,i32
Definition at line 218 of file jitter.h.
◆ ANDrd
#define ANDrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x23, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
and dr32,sr32
Definition at line 228 of file jitter.h.
◆ AX
◆ BL
◆ BP
◆ BSWAP
Value: emitm(&stream, 0xf, 1); \
emitm(&stream, 0x19 << 3 | dr32 , 1);
bswap dr32
Definition at line 148 of file jitter.h.
◆ BX
◆ CL
◆ CMPid
#define CMPid |
( |
| dr32, |
|
|
| i32 ) |
Value:
emitm(&stream, 0x3d, 1); \
emitm(&stream, i32, 4);} \
else{ \
emitm(&stream, 0x81, 1); \
emitm(&stream, 0x1f << 3 | (dr32 & 0x7), 1);\
emitm(&stream, i32, 4);}
cmp dr32,i32
Definition at line 286 of file jitter.h.
◆ CMPodd
#define CMPodd |
( |
| dr32, |
|
|
| sr32, |
|
|
| off ) |
Value: emitm(&stream, 3 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
emitm(&stream, off, 1);
cmp dr32,sr32[off]
Definition at line 275 of file jitter.h.
◆ CMPrd
#define CMPrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x3b, 1); \
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
cmp dr32,sr32
Definition at line 281 of file jitter.h.
◆ CX
◆ DI
◆ DIVrd
Value: emitm(&stream, 0xf7, 1);\
emitm(&stream, 15 << 4 | (r32 & 0x7), 1);
div r32
Definition at line 207 of file jitter.h.
◆ DL
◆ DX
◆ EAX
◆ EBP
◆ EBX
◆ ECX
◆ EDI
◆ EDX
◆ ESI
◆ ESP
◆ JA
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x87, 1);\
emitm(&stream, off32, 4);
ja off32
Definition at line 333 of file jitter.h.
◆ JAb
Value: emitm(&stream, 0x77, 1);\
emitm(&stream, off8, 1);
ja off32
Definition at line 301 of file jitter.h.
◆ JAE
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x83, 1);\
emitm(&stream, off32, 4);
jae off32
Definition at line 339 of file jitter.h.
◆ JBb
Value: emitm(&stream, 0x72, 1);\
emitm(&stream, off8, 1);
jb off8
Definition at line 328 of file jitter.h.
◆ JBEb
Value: emitm(&stream, 0x76, 1);\
emitm(&stream, off8, 1);
jbe off8
Definition at line 323 of file jitter.h.
◆ JE
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x84, 1);\
emitm(&stream, off32, 4);
je off32
Definition at line 306 of file jitter.h.
◆ JG
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8f, 1);\
emitm(&stream, off32, 4);
jg off32
Definition at line 345 of file jitter.h.
◆ JGE
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8d, 1);\
emitm(&stream, off32, 4);
jge off32
Definition at line 351 of file jitter.h.
◆ JLE
Value: emitm(&stream, 0x0f, 1);\
emitm(&stream, 0x8e, 1);\
emitm(&stream, off32, 4);
jle off32
Definition at line 312 of file jitter.h.
◆ JLEb
Value: emitm(&stream, 0x7e, 1);\
emitm(&stream, off8, 1);
jle off8
Definition at line 318 of file jitter.h.
◆ JMP
Value: emitm(&stream, 0xe9, 1);\
emitm(&stream, off32, 4);
jmp off32
Definition at line 357 of file jitter.h.
◆ JNEb
Value: emitm(&stream, 0x75, 1);\
emitm(&stream, off8, 1);
jne off32
Definition at line 296 of file jitter.h.
◆ MOVid
#define MOVid |
( |
| r32, |
|
|
| i32 ) |
Value: emitm(&stream, 11 << 4 | 1 << 3 | r32 & 0x7, 1); emitm(&stream, i32, 4);
mov r32,i32
Definition at line 109 of file jitter.h.
◆ MOVobb
#define MOVobb |
( |
| dr8, |
|
|
| sr32, |
|
|
| or32 ) |
Value: emitm(&stream, 0x8a, 1); \
emitm(&stream, (dr8 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);
mov dr8,sr32[or32]
Definition at line 136 of file jitter.h.
◆ MOVobd
#define MOVobd |
( |
| dr32, |
|
|
| sr32, |
|
|
| or32 ) |
Value: emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);
mov dr32,sr32[or32]
Definition at line 123 of file jitter.h.
◆ MOVobw
#define MOVobw |
( |
| dr32, |
|
|
| sr32, |
|
|
| or32 ) |
Value: emitm(&stream, 0x66, 1); \
emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, (dr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (sr32 & 0x7) , 1);
mov dr16,sr32[or32]
Definition at line 129 of file jitter.h.
◆ MOVodd
#define MOVodd |
( |
| dr32, |
|
|
| sr32, |
|
|
| off ) |
Value: emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); \
emitm(&stream, 1 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);\
emitm(&stream, off, 1);
mov dr32,sr32[off]
Definition at line 117 of file jitter.h.
◆ MOVomd
#define MOVomd |
( |
| dr32, |
|
|
| or32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x89, 1); \
emitm(&stream, (sr32 & 0x7) << 3 | 4 , 1);\
emitm(&stream, (or32 & 0x7) << 3 | (dr32 & 0x7) , 1);
mov [dr32][or32],sr32
Definition at line 142 of file jitter.h.
◆ MOVrd
#define MOVrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 8 << 4 | 3 | 1 << 3, 1); emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
mov dr32,sr32
Definition at line 113 of file jitter.h.
◆ MULrd
Value: emitm(&stream, 0xf7, 1);\
emitm(&stream, 7 << 5 | (r32 & 0x7), 1);
mul r32
Definition at line 202 of file jitter.h.
◆ NEGd
Value: emitm(&stream, 0xf7, 1);\
emitm(&stream, 27 << 3 | r32 & 0x7, 1);
neg r32
Definition at line 270 of file jitter.h.
◆ ORid
#define ORid |
( |
| r32, |
|
|
| i32 ) |
Value:
emitm(&stream, 0x0d, 1);\
emitm(&stream, i32, 4);}\
else{ \
emitm(&stream, 0x81, 1);\
emitm(&stream, 25 << 3 | r32, 1);\
emitm(&stream, i32, 4);}
or r32,i32
Definition at line 238 of file jitter.h.
◆ ORrd
#define ORrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x0b, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | sr32 & 0x7, 1);
or dr32,sr32
Definition at line 233 of file jitter.h.
◆ POP
Value: emitm(&stream, 5 << 4 | 1 << 3 | r32 & 0x7, 1);
pop r32
Definition at line 162 of file jitter.h.
◆ PUSH
Value: emitm(&stream, 5 << 4 | 0 << 3 | r32 & 0x7, 1);
push r32
Definition at line 158 of file jitter.h.
◆ RET
Value: emitm(&stream, 12 << 4 | 0 << 3 | 3, 1);
ret
Definition at line 166 of file jitter.h.
◆ SHL_CLrb
Value: emitm(&stream, 0xd3, 1);\
emitm(&stream, 7 << 5 | dr32 & 0x7, 1);
shl dr32,cl
Definition at line 254 of file jitter.h.
◆ SHLib
#define SHLib |
( |
| r32, |
|
|
| i8 ) |
Value: emitm(&stream, 0xc1, 1);\
emitm(&stream, 7 << 5 | r32 & 0x7, 1);\
emitm(&stream, i8, 1);
shl r32,i8
Definition at line 248 of file jitter.h.
◆ SHR_CLrb
Value: emitm(&stream, 0xd3, 1);\
emitm(&stream, 29 << 3 | dr32 & 0x7, 1);
shr dr32,cl
Definition at line 265 of file jitter.h.
◆ SHRib
#define SHRib |
( |
| r32, |
|
|
| i8 ) |
Value: emitm(&stream, 0xc1, 1);\
emitm(&stream, 29 << 3 | r32 & 0x7, 1);\
emitm(&stream, i8, 1);
shr r32,i8
Definition at line 259 of file jitter.h.
◆ SI
◆ SP
◆ SUB_EAXi
Value: emitm(&stream, 0x2d, 1);\
emitm(&stream, i32, 4);
sub eax,i32
Definition at line 197 of file jitter.h.
◆ SUBrd
#define SUBrd |
( |
| dr32, |
|
|
| sr32 ) |
Value: emitm(&stream, 0x2b, 1);\
emitm(&stream, 3 << 6 | (dr32 & 0x7) << 3 | (sr32 & 0x7), 1);
sub dr32,sr32
Definition at line 192 of file jitter.h.
◆ SWAP_AX
Value: emitm(&stream, 0x86, 1); \
emitm(&stream, 0xc4 , 1);
xchg al,ah
Definition at line 153 of file jitter.h.
◆ binary_stream
typedef struct binary_stream binary_stream |
A stream of X86 binary code.
◆ BPF_filter_function
typedef UINT(__cdecl * BPF_filter_function) (PVOID *, ULONG, UINT) |
Prototype of a filtering function created by the jitter.
The syntax and the meaning of the parameters is analogous to the one of bpf_filter(). Notice that the filter is not among the parameters, because it is hardwired in the function.
Definition at line 82 of file jitter.h.
◆ emit_func
typedef void(* emit_func) (binary_stream *stream, ULONG value, UINT n) |
Prototype of the emit functions.
Different emit functions are used to create the reference table and to generate the actual filtering code. This allows to have simpler instruction macros. The first parameter is the stream that will receive the data. The secon one is a variable containing the data, the third one is the length, that can be 1,2 or 4 since it is possible to emit a byte, a short or a work at a time.
Definition at line 92 of file jitter.h.
◆ JIT_BPF_Filter
typedef struct JIT_BPF_Filter JIT_BPF_Filter |
Structure describing a x86 filtering program created by the jitter.
documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2010
CACE Technologies. Copyright (c) 2010-2013
Riverbed Technology. All rights reserved.