mirror of
https://github.com/hedge-dev/XenonRecomp.git
synced 2025-08-04 03:25:26 +00:00
213 lines
4.1 KiB
C
213 lines
4.1 KiB
C
/* Capstone Disassembly Engine */
|
|
/* BPF Backend by david942j <david942j@gmail.com>, 2019 */
|
|
|
|
#ifndef CAPSTONE_BPF_H
|
|
#define CAPSTONE_BPF_H
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#include "platform.h"
|
|
|
|
#ifdef _MSC_VER
|
|
#pragma warning(disable:4201)
|
|
#endif
|
|
|
|
/// Operand type for instruction's operands
|
|
typedef enum bpf_op_type {
|
|
BPF_OP_INVALID = 0,
|
|
|
|
BPF_OP_REG,
|
|
BPF_OP_IMM,
|
|
BPF_OP_OFF,
|
|
BPF_OP_MEM,
|
|
BPF_OP_MMEM, ///< M[k] in cBPF
|
|
BPF_OP_MSH, ///< corresponds to cBPF's BPF_MSH mode
|
|
BPF_OP_EXT, ///< cBPF's extension (not eBPF)
|
|
} bpf_op_type;
|
|
|
|
/// BPF registers
|
|
typedef enum bpf_reg {
|
|
BPF_REG_INVALID = 0,
|
|
|
|
///< cBPF
|
|
BPF_REG_A,
|
|
BPF_REG_X,
|
|
|
|
///< eBPF
|
|
BPF_REG_R0,
|
|
BPF_REG_R1,
|
|
BPF_REG_R2,
|
|
BPF_REG_R3,
|
|
BPF_REG_R4,
|
|
BPF_REG_R5,
|
|
BPF_REG_R6,
|
|
BPF_REG_R7,
|
|
BPF_REG_R8,
|
|
BPF_REG_R9,
|
|
BPF_REG_R10,
|
|
|
|
BPF_REG_ENDING,
|
|
} bpf_reg;
|
|
|
|
/// Instruction's operand referring to memory
|
|
/// This is associated with BPF_OP_MEM operand type above
|
|
typedef struct bpf_op_mem {
|
|
bpf_reg base; ///< base register
|
|
uint32_t disp; ///< offset value
|
|
} bpf_op_mem;
|
|
|
|
typedef enum bpf_ext_type {
|
|
BPF_EXT_INVALID = 0,
|
|
|
|
BPF_EXT_LEN,
|
|
} bpf_ext_type;
|
|
|
|
/// Instruction operand
|
|
typedef struct cs_bpf_op {
|
|
bpf_op_type type;
|
|
union {
|
|
uint8_t reg; ///< register value for REG operand
|
|
uint64_t imm; ///< immediate value IMM operand
|
|
uint32_t off; ///< offset value, used in jump & call
|
|
bpf_op_mem mem; ///< base/disp value for MEM operand
|
|
/* cBPF only */
|
|
uint32_t mmem; ///< M[k] in cBPF
|
|
uint32_t msh; ///< corresponds to cBPF's BPF_MSH mode
|
|
uint32_t ext; ///< cBPF's extension (not eBPF)
|
|
};
|
|
|
|
/// How is this operand accessed? (READ, WRITE or READ|WRITE)
|
|
/// This field is combined of cs_ac_type.
|
|
/// NOTE: this field is irrelevant if engine is compiled in DIET mode.
|
|
uint8_t access;
|
|
} cs_bpf_op;
|
|
|
|
/// Instruction structure
|
|
typedef struct cs_bpf {
|
|
uint8_t op_count;
|
|
cs_bpf_op operands[4];
|
|
} cs_bpf;
|
|
|
|
/// BPF instruction
|
|
typedef enum bpf_insn {
|
|
BPF_INS_INVALID = 0,
|
|
|
|
///< ALU
|
|
BPF_INS_ADD,
|
|
BPF_INS_SUB,
|
|
BPF_INS_MUL,
|
|
BPF_INS_DIV,
|
|
BPF_INS_OR,
|
|
BPF_INS_AND,
|
|
BPF_INS_LSH,
|
|
BPF_INS_RSH,
|
|
BPF_INS_NEG,
|
|
BPF_INS_MOD,
|
|
BPF_INS_XOR,
|
|
BPF_INS_MOV, ///< eBPF only
|
|
BPF_INS_ARSH, ///< eBPF only
|
|
|
|
///< ALU64, eBPF only
|
|
BPF_INS_ADD64,
|
|
BPF_INS_SUB64,
|
|
BPF_INS_MUL64,
|
|
BPF_INS_DIV64,
|
|
BPF_INS_OR64,
|
|
BPF_INS_AND64,
|
|
BPF_INS_LSH64,
|
|
BPF_INS_RSH64,
|
|
BPF_INS_NEG64,
|
|
BPF_INS_MOD64,
|
|
BPF_INS_XOR64,
|
|
BPF_INS_MOV64,
|
|
BPF_INS_ARSH64,
|
|
|
|
///< Byteswap, eBPF only
|
|
BPF_INS_LE16,
|
|
BPF_INS_LE32,
|
|
BPF_INS_LE64,
|
|
BPF_INS_BE16,
|
|
BPF_INS_BE32,
|
|
BPF_INS_BE64,
|
|
BPF_INS_BSWAP16,
|
|
BPF_INS_BSWAP32,
|
|
BPF_INS_BSWAP64,
|
|
|
|
///< Load
|
|
BPF_INS_LDW, ///< eBPF only
|
|
BPF_INS_LDH,
|
|
BPF_INS_LDB,
|
|
BPF_INS_LDDW, ///< eBPF only: load 64-bit imm
|
|
BPF_INS_LDXW, ///< eBPF only
|
|
BPF_INS_LDXH, ///< eBPF only
|
|
BPF_INS_LDXB, ///< eBPF only
|
|
BPF_INS_LDXDW, ///< eBPF only
|
|
|
|
///< Store
|
|
BPF_INS_STW, ///< eBPF only
|
|
BPF_INS_STH, ///< eBPF only
|
|
BPF_INS_STB, ///< eBPF only
|
|
BPF_INS_STDW, ///< eBPF only
|
|
BPF_INS_STXW, ///< eBPF only
|
|
BPF_INS_STXH, ///< eBPF only
|
|
BPF_INS_STXB, ///< eBPF only
|
|
BPF_INS_STXDW, ///< eBPF only
|
|
BPF_INS_XADDW, ///< eBPF only
|
|
BPF_INS_XADDDW, ///< eBPF only
|
|
|
|
///< Jump
|
|
BPF_INS_JMP,
|
|
BPF_INS_JEQ,
|
|
BPF_INS_JGT,
|
|
BPF_INS_JGE,
|
|
BPF_INS_JSET,
|
|
BPF_INS_JNE, ///< eBPF only
|
|
BPF_INS_JSGT, ///< eBPF only
|
|
BPF_INS_JSGE, ///< eBPF only
|
|
BPF_INS_CALL, ///< eBPF only
|
|
BPF_INS_CALLX, ///< eBPF only
|
|
BPF_INS_EXIT, ///< eBPF only
|
|
BPF_INS_JLT, ///< eBPF only
|
|
BPF_INS_JLE, ///< eBPF only
|
|
BPF_INS_JSLT, ///< eBPF only
|
|
BPF_INS_JSLE, ///< eBPF only
|
|
|
|
///< Return, cBPF only
|
|
BPF_INS_RET,
|
|
|
|
///< Misc, cBPF only
|
|
BPF_INS_TAX,
|
|
BPF_INS_TXA,
|
|
|
|
BPF_INS_ENDING,
|
|
|
|
// alias instructions
|
|
BPF_INS_LD = BPF_INS_LDW, ///< cBPF only
|
|
BPF_INS_LDX = BPF_INS_LDXW, ///< cBPF only
|
|
BPF_INS_ST = BPF_INS_STW, ///< cBPF only
|
|
BPF_INS_STX = BPF_INS_STXW, ///< cBPF only
|
|
} bpf_insn;
|
|
|
|
/// Group of BPF instructions
|
|
typedef enum bpf_insn_group {
|
|
BPF_GRP_INVALID = 0, ///< = CS_GRP_INVALID
|
|
|
|
BPF_GRP_LOAD,
|
|
BPF_GRP_STORE,
|
|
BPF_GRP_ALU,
|
|
BPF_GRP_JUMP,
|
|
BPF_GRP_CALL, ///< eBPF only
|
|
BPF_GRP_RETURN,
|
|
BPF_GRP_MISC, ///< cBPF only
|
|
|
|
BPF_GRP_ENDING,
|
|
} bpf_insn_group;
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|