Commit 29adbb4f authored by swift_gan's avatar swift_gan Committed by swift_gan

[NativeHook]add decode filter

parent 1ca0a145
......@@ -23,7 +23,7 @@ goto label_matched; \
Arm32Decoder* Arm32Decoder::instant = new Arm32Decoder();
void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) {
bool thumb = isThumbCode(reinterpret_cast<Addr>(codeStart));
if (thumb) {
codeStart = getThumbCodeAddress(codeStart);
......@@ -36,9 +36,11 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
if (thumb && thumb32) {
CASE_T32(B32)
CASE_T32(LDR_LIT)
if (!onlyPcRelInst) {
CASE_T32(LDR_IMM)
CASE_T32(LDR_UIMM)
CASE_T32(MOV_MOVT_IMM)
}
if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
}
......@@ -50,17 +52,19 @@ void Arm32Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
CASE_T16(LDR_LIT)
CASE_T16(ADD_IMM_RDN)
CASE_T16(ADR)
if (!onlyPcRelInst) {
CASE_T16(ADD_REG)
CASE_T16(CMP_REG)
CASE_T16(CMP_REG_EXT)
CASE_T16(MOV_REG)
CASE_T16(POP)
CASE_T16(PUSH)
}
if (unit == nullptr) {
unit = reinterpret_cast<Unit<Base> *>(new INST_T16(UNKNOW)(*reinterpret_cast<STRUCT_T16(UNKNOW) *>(pc)));
}
} else {
//TODO
//TODO arm32 support
unit = reinterpret_cast<Unit<Base> *>(new INST_T32(UNKNOW)(*reinterpret_cast<STRUCT_T32(UNKNOW) *>(pc)));
}
......
......@@ -12,7 +12,7 @@ namespace SandHook {
class Arm32Decoder : public InstDecoder {
public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override;
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) override;
public:
static Arm32Decoder* instant;
};
......
......@@ -44,7 +44,7 @@ void* CodeRelocateA32::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__ allocBufferFirst(static_cast<U32>(len * 8));
void* curPc = __ getPC();
if (toPc == nullptr) {
Disassembler::get()->decode(startPc, len, *this);
Disassembler::get()->decode(startPc, len, *this, true);
} else {
//TODO
}
......
......@@ -17,26 +17,29 @@ goto label_matched; \
Arm64Decoder* Arm64Decoder::instant = new Arm64Decoder();
void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor) {
void Arm64Decoder::decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) {
InstA64 *pc = reinterpret_cast<InstA64 *>(codeStart);
Addr endAddr = (Addr) codeStart + codeLen;
Unit<Base>* unit = nullptr;
while((Addr) pc < endAddr) {
// pc relate insts
CASE(B_BL)
CASE(B_COND)
CASE(CBZ_CBNZ)
CASE(TBZ_TBNZ)
CASE(LDR_LIT)
CASE(ADR_ADRP)
if (onlyPcRelInst)
goto label_matched;
CASE(MOV_WIDE)
CASE(MOV_REG)
CASE(ADR_ADRP)
CASE(LDR_LIT)
CASE(LDR_IMM)
CASE(LDR_UIMM)
CASE(LDRSW_IMM)
CASE(LDRSW_UIMM)
CASE(STR_UIMM)
CASE(STR_IMM)
CASE(B_BL)
CASE(B_COND)
CASE(BR_BLR_RET)
CASE(CBZ_CBNZ)
CASE(TBZ_TBNZ)
CASE(SUB_EXT_REG)
CASE(SVC)
CASE(EXCEPTION_GEN)
......
......@@ -12,7 +12,7 @@ namespace SandHook {
class Arm64Decoder : public InstDecoder {
public:
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor) override;
void decode(void *codeStart, Addr codeLen, InstVisitor &visitor, bool onlyPcRelInst) override;
public:
static Arm64Decoder* instant;
};
......
......@@ -41,7 +41,7 @@ void* CodeRelocateA64::relocate(void *startPc, Addr len, void *toPc = nullptr) t
__ allocBufferFirst(static_cast<U32>(len * 8));
void* curPc = __ getPC();
if (toPc == nullptr) {
Disassembler::get()->decode(startPc, len, *this);
Disassembler::get()->decode(startPc, len, *this, true);
} else {
//TODO
}
......
......@@ -21,7 +21,7 @@ namespace SandHook {
class InstDecoder {
public:
virtual void decode(void* codeStart, Addr codeLen, InstVisitor& visitor) = 0;
virtual void decode(void* codeStart, Addr codeLen, InstVisitor& visitor, bool onlyPcRelInst = false) = 0;
};
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment