#include "glue.h"
#include "bddisasm.h"

Data Structures
struct	_MEMADDR
	Describes a memory address, as used in an instruction. More...

struct	_OPERAND_VALUE
	Describes an operand value. More...

Macros
#define	DEC_EFLAG_CF 0x00000001

#define	DEC_GET_FLAG(eflags, flag) ((eflags) >> (((flag) - 1) % 64))
	Gets the value of the indicated flag. More...

#define	DEC_OPT_NO_CACHE 0x00000001
	Flag used to hint the instruction decoder to not use the instruction cache. More...

#define	DEC_INVALID_GPA 0xFFFFFFFFFFFFFFFF
	Invalid GPA placeholder. More...

#define	QWORD_HIGH_PART_MASK 0xFFFFFFFF00000000
	High 32 bits mask. More...

#define	PW_FLAGS_SET_A BIT(0)

#define	PW_FLAGS_SET_D BIT(1)

Typedefs
typedef struct _MEMADDR	MEMADDR
	Describes a memory address, as used in an instruction. More...

typedef struct _MEMADDR *	PMEMADDR

typedef struct _OPERAND_VALUE	OPERAND_VALUE
	Describes an operand value. More...

typedef struct _OPERAND_VALUE *	POPERAND_VALUE

Enumerations
enum	{ opMov = 0, opXor, opAnd, opOr, opBts, opAdd }

Functions
INTSTATUS	IntDecDecodeInstruction (IG_CS_TYPE CsType, QWORD Gva, void *Instrux)
	Decode an instruction from the provided guest linear address. More...

INTSTATUS	IntDecDecodeInstructionFromBuffer (PBYTE Buffer, size_t BufferSize, IG_CS_TYPE CsType, void *Instrux)
	Decode an instruction from the provided buffer. More...

INTSTATUS	IntDecDecodeInstructionAtRip (DWORD CpuNumber, IG_ARCH_REGS Registers, IG_SEG_REGS Segments, INSTRUX *Instrux)
	Decode an instruction at current RIP on the provided VCPU. More...

INTSTATUS	IntDecDecodeInstructionAtRipWithCache (void Cache, DWORD CpuNumber, PIG_ARCH_REGS Registers, PINSTRUX Instrux, DWORD Options, BOOLEAN CacheHit, BOOLEAN *Added)
	Decode an instruction using the cache. More...

INTSTATUS	IntDecDecodeAccessSize (PINSTRUX Instrux, PIG_ARCH_REGS Registers, QWORD Gla, BYTE AccessType, DWORD *AccessSize)
	Decode the memory access size of a given instruction. More...

INTSTATUS	IntDecGetWrittenValueFromInstruction (PINSTRUX Instrux, PIG_ARCH_REGS Registers, PBYTE MemoryValue, OPERAND_VALUE *WrittenValue)
	Decode a written value from a memory write instruction. More...

INTSTATUS	IntDecEmulateInstruction (DWORD CpuNumber, PINSTRUX Instrux)
	Emulate a MOV or a PUSH instruction. More...

INTSTATUS	IntDecEmulatePTWrite (QWORD *NewValue)
	Emulate a page-table write. More...

INTSTATUS	IntDecEmulatePageWalk (QWORD Gla, QWORD Cr3, DWORD Flags)

INTSTATUS	IntDecGetAccessedMemCount (PINSTRUX Instrux, DWORD *Count)
	Decode the number of memory locations accessed by an instruction. More...

INTSTATUS	IntDecGetAccessedMem (PINSTRUX Instrux, PIG_ARCH_REGS Registers, PIG_XSAVE_AREA XsaveArea, MEMADDR Gla, DWORD Count)
	Decode each accessed address by an instruction. More...

INTSTATUS	IntDecGetSseRegValue (PIG_XSAVE_AREA XsaveArea, DWORD Reg, DWORD Size, OPERAND_VALUE *Value)
	Get the value of a vector register. Wrapper over IntDecGetSetSseRegValue. More...

INTSTATUS	IntDecSetSseRegValue (PIG_XSAVE_AREA XsaveArea, DWORD Reg, DWORD Size, OPERAND_VALUE *Value, BOOLEAN Commit)
	Sets the value of a vector register. Wrapper over IntDecGetSetSseRegValue. More...

INTSTATUS	IntDecEmulateRead (PINSTRUX Instrux, BYTE *SrcValueBuffer)
	Emulate a read access. More...

INTSTATUS	IntDecComputeLinearAddress (PINSTRUX Instrux, PND_OPERAND Operand, PIG_ARCH_REGS Registers, QWORD *LinearAddress)
	Given an instruction and a memory operand, it will compute the guest linear address encoded by that operand. More...

INTSTATUS	IntDecDecodeDestinationLinearAddressFromInstruction (PINSTRUX Instrux, PIG_ARCH_REGS Registers, QWORD *LinearAddress)
	Decode the destination memory linear address. More...

INTSTATUS	IntDecDecodeSourceLinearAddressFromInstruction (PINSTRUX Instrux, PIG_ARCH_REGS Registers, QWORD *LinearAddress)
	Decode the source memory linear address. More...

INTSTATUS	IntDecGetMaxvl (ND_OPERAND_SIZE *Maxvl)
	Computes the maximum vector length, given the enabled states inside the XCR0 register. More...

Macro Definition Documentation

◆ DEC_EFLAG_CF

#define DEC_EFLAG_CF 0x00000001

Definition at line 24 of file decoder.h.

Referenced by IntDecGetWrittenValueFromInstruction().

◆ DEC_GET_FLAG

#define DEC_GET_FLAG	(	eflags,
		flag
	)	((eflags) >> (((flag) - 1) % 64))

Gets the value of the indicated flag.

Definition at line 27 of file decoder.h.

Referenced by IntDecGetWrittenValueFromInstruction().

◆ DEC_INVALID_GPA

#define DEC_INVALID_GPA 0xFFFFFFFFFFFFFFFF

Invalid GPA placeholder.

Definition at line 33 of file decoder.h.

◆ DEC_OPT_NO_CACHE

#define DEC_OPT_NO_CACHE 0x00000001

Flag used to hint the instruction decoder to not use the instruction cache.

Definition at line 30 of file decoder.h.

Referenced by IntDecDecodeInstructionAtRipWithCache(), IntGetCurrentInstructionLength(), IntGetCurrentInstructionMnemonic(), IntHandleDtrViolation(), and IntHandleEptViolation().

◆ PW_FLAGS_SET_A

#define PW_FLAGS_SET_A BIT(0)

Definition at line 129 of file decoder.h.

Referenced by IntDecEmulatePageWalk(), and IntDecEmulateRead().

◆ PW_FLAGS_SET_D

#define PW_FLAGS_SET_D BIT(1)

Definition at line 130 of file decoder.h.

Referenced by IntDecEmulatePageWalk().

◆ QWORD_HIGH_PART_MASK

#define QWORD_HIGH_PART_MASK 0xFFFFFFFF00000000

High 32 bits mask.

Definition at line 36 of file decoder.h.

Typedef Documentation

◆ MEMADDR

typedef struct _MEMADDR MEMADDR

Describes a memory address, as used in an instruction.

◆ OPERAND_VALUE

typedef struct _OPERAND_VALUE OPERAND_VALUE

Describes an operand value.

◆ PMEMADDR

typedef struct _MEMADDR * PMEMADDR

◆ POPERAND_VALUE

typedef struct _OPERAND_VALUE * POPERAND_VALUE

Enumeration Type Documentation

◆ anonymous enum

anonymous enum

This is an enum describing supported page-table modification instructions.

Enumerator
opMov	MOV instruction.
opXor	XOR instruction.
opAnd	AND instruction.
opOr	OR instruction.
opBts	BTS instruction.
opAdd	ADD instruction.

Definition at line 14 of file decoder.h.

Function Documentation

◆ IntDecComputeLinearAddress()

INTSTATUS IntDecComputeLinearAddress	(	PINSTRUX	Instrux,
		PND_OPERAND	Operand,
		PIG_ARCH_REGS	Registers,
		QWORD *	LinearAddress
	)

Given an instruction and a memory operand, it will compute the guest linear address encoded by that operand.

Parameters

[in]	Instrux	The decoded instruction.
[in]	Operand	The memory operand.
[in]	Registers	Optional pointer to the general purpose registers state.
[out]	LinearAddress	The computed linear address associated with the provided operand.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If VSIB is used by the instruction.

Definition at line 790 of file decoder.c.

Referenced by IntDecDecodeDestinationLinearAddressFromInstruction(), IntDecDecodeSourceLinearAddressFromInstruction(), IntDecEmulatePTWrite(), IntDecGetAccessedMem(), IntDecGetWrittenValueFromInstruction(), IntGetValueFromOperand(), IntHandleDtrViolation(), and IntSetValueForOperand().

◆ IntDecDecodeAccessSize()

INTSTATUS IntDecDecodeAccessSize	(	PINSTRUX	Instrux,
		PIG_ARCH_REGS	Registers,
		QWORD	Gla,
		BYTE	AccessType,
		DWORD *	AccessSize
	)

Decode the memory access size of a given instruction.

This function will decode the memory access size from the provided instruction. Important note: this function assumes that the memory access as explicit (as part of an instruction execution). However, there are several cases where the CPU may access memory implicitly:

CPU page walk as part of VA translation or setting of an accessed/dirty bits (GPA access, read/write)
Stack access as part of an interrupt or exception delivery (GLA access, write)
IDT access as part of an interrupt or exception delivery (GLA access, read)
GDT/LDT access as part of a descriptor load or setting of an accessed bit (GLA access, read/write)
TSS access as part of a task switch or interrupt delivery - IST access (GLA access, read/write)
BTS/BTM/PEBS access as part of performance monitoring/branch tracing (GLA access, read/write)
PT (Processor Trace) accesses (GLA access, read/write)
MPX BNDLDX/BNDSTX instructions
SGX events? (read/write) Note that except for the implicit CPU page walk accesses, we can't really tell whether an access is caused by the instruction itself or by any other event, such as an interrupt/exception delivery that reads the IDT.

Parameters

[in]	Instrux	The decoded instruction.
[in]	Registers	The general purpose registers state.
[in]	Gla	Reserved for future use.
[in]	AccessType	The operand who`s access is equal to AccessType will be decoded (useful for MOVS instruction).
[out]	AccessSize	Will contain, upon successful return, the size of the memory operand who`s access is AccessType.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_NOT_FOUND	If a memory operand with access AccessType is not found.

Definition at line 731 of file decoder.c.

Referenced by IntHandleEptViolation().

◆ IntDecDecodeDestinationLinearAddressFromInstruction()

INTSTATUS IntDecDecodeDestinationLinearAddressFromInstruction	(	PINSTRUX	Instrux,
		PIG_ARCH_REGS	Registers,
		QWORD *	LinearAddress
	)

Decode the destination memory linear address.

Parameters

[in]	Instrux	The decoded instruction.
[in]	Registers	Optional pointer to the general purpose registers state.
[out]	LinearAddress	Will contain, upon successful exit, the written linear address.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_FOUND	If a memory operand that is written is not found.

Definition at line 1202 of file decoder.c.

Referenced by IntHandleEptViolation().

◆ IntDecDecodeInstruction()

INTSTATUS IntDecDecodeInstruction	(	IG_CS_TYPE	CsType,
		QWORD	Gva,
		void *	Instrux
	)

Decode an instruction from the provided guest linear address.

Will decode, in the context of the current CPU the instruction located at address GuestVirtualAddress. The decoded instruction will be returned in the Instrux argument. Note that this function does not use the instruction cache. It will map & decode the provided Gva on each call.

Parameters

[in]	CsType	Operating mode/mode in which the instruction must be decoded.
[in]	Gva	The guest virtual address that contains the instruction to be decoded.
[out]	Instrux	Will contain, upon successful return, the decoded instruction.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_PAGE_NOT_PRESENT	If the page containing the instruction is not mapped.
INT_STATUS_DISASM_ERROR	If the decoding failed.

Definition at line 180 of file decoder.c.

Referenced by IntDecDecodeInstructionAtRip(), IntDecDecodeInstructionAtRipWithCache(), IntDisasmGva(), IntLixApiHijackHook(), IntLixCrashFetchDmesgSymbol(), IntLixFindDataStart(), IntLixGuestFindPgd(), IntLixGuestFindProperSyscall(), IntLixGuestResolveExTableLimits(), IntLixPatchSwapgs(), IntLixResolveCurrentCpuOffset(), IntLixResolveCurrentProcessOffset(), IntLixResolveExeFileOffset(), IntLixResolveThreadStructOffset(), IntLixVdsoResolveImageAddress(), IntLogCurrentIP(), IntPeFindFunctionStart(), IntWinApiHookVeHandler(), and IntWinStackTraceGet64().

◆ IntDecDecodeInstructionAtRip()

INTSTATUS IntDecDecodeInstructionAtRip	(	DWORD	CpuNumber,
		IG_ARCH_REGS *	Registers,
		IG_SEG_REGS *	Segments,
		INSTRUX *	Instrux
	)

Decode an instruction at current RIP on the provided VCPU.

Will decode the instruction pointed by the current RIP on the provided CPU. If CpuNumber is not the current VCPU, make sure it is paused before doing any kind of query on it, since information from a running VCPU is undefined.

Parameters

[in]	CpuNumber	The CPU number.
[in]	Registers	The general purpose register state.
[in]	Segments	Optional pointer to the segment register state. If NULL, the segment registers will be fetched internally.
[out]	Instrux	Will contain, upon successful return, the decoded instruction.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If the provided CPU is not in 16, 32 or 64 bit mode.
INT_DISASM_ERROR	If a decoding error occurs.

Definition at line 384 of file decoder.c.

Referenced by IntHandleBreakpoint(), and IntUnpPageExecuteCallback().

◆ IntDecDecodeInstructionAtRipWithCache()

INTSTATUS IntDecDecodeInstructionAtRipWithCache	(	void *	Cache,
		DWORD	CpuNumber,
		PIG_ARCH_REGS	Registers,
		PINSTRUX	Instrux,
		DWORD	Options,
		BOOLEAN *	CacheHit,
		BOOLEAN *	Added
	)

Decode an instruction using the cache.

Given the CPU CpuNumber, this function will decode the instruction located at RIP, using the cache. If the instruction was already cached, it will be returned from there. Otherwise, it will be added to the cache, if Options does not contain DEC_OPT_NO_CACHE.

Parameters

[in]	Cache	The instruction cache.
[in]	CpuNumber	The CPU number for which the instruction at RIP will be decoded.
[in]	Registers	The general purpose registers state.
[out]	Instrux	Will contain, upon successful return, the decoded instruction.
[in]	Options	Decode options. Can be 0 or DEC_OPT_NO_CACHE, which indicates that the instruction should not be cached.
[out]	CacheHit	Optional, set to true if the cache was hit, or false otherwise.
[out]	Added	Optional, set to true if the instruction has been added to the cache, false otherwise.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_PAGE_NOT_PRESENT	If the page containing the instruction is swapped out.
INT_STATUS_NO_MAPPING_STRUCTURES	If the page containing the instruction is swapped out.
INT_STATUS_NOT_SUPPORTED	If the CR3 for the CPU CpuNumber does not point to a valid process.

Definition at line 449 of file decoder.c.

Referenced by IntGetCurrentInstructionLength(), IntGetCurrentInstructionMnemonic(), IntHandleDtrViolation(), and IntHandleEptViolation().

◆ IntDecDecodeInstructionFromBuffer()

INTSTATUS IntDecDecodeInstructionFromBuffer	(	PBYTE	Buffer,
		size_t	BufferSize,
		IG_CS_TYPE	CsType,
		void *	Instrux
	)

Decode an instruction from the provided buffer.

Decodes an instruction from the provided buffer. If the function fails, the Instrux parameter is undefined.

Parameters

[in]	Buffer	The buffer containing the instruction.
[in]	BufferSize	The size of the input buffer.
[in]	CsType	Operating mode (16, 32 or 64 bit).
[out]	Instrux	Will contain upon successful return the decoded instruction.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_DISASM_ERROR	If instruction decoding failed.

Definition at line 308 of file decoder.c.

Referenced by DbgTestSse(), IntDetRelocate(), IntDetSetHook(), IntDisasmBuffer(), IntDispatchVeAsEpt(), IntDumpCode(), IntFragExtractCodePattern(), IntFragExtractPattern(), IntGuestIsKptiActive(), IntLixGuestIsKptiActive(), IntPtiMonitorAllPtWriteCandidates(), IntVeDumpVeInfoPage(), IntVeFindKernelKvaShadowAndKernelExit(), IntWinGuestFindKernelCr3(), IntWinHalFindPerformanceCounterInternal(), and IntWinHalHandleHalHeapExec().

◆ IntDecDecodeSourceLinearAddressFromInstruction()

INTSTATUS IntDecDecodeSourceLinearAddressFromInstruction	(	PINSTRUX	Instrux,
		PIG_ARCH_REGS	Registers,
		QWORD *	LinearAddress
	)

Decode the source memory linear address.

Parameters

[in]	Instrux	The decoded instruction.
[in]	Registers	Optional pointer to the general purpose registers state.
[out]	LinearAddress	Will contain, upon successful exit, the read linear address.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_FOUND	If a memory operand that is read is not found.

Definition at line 1149 of file decoder.c.

Referenced by IntMemClkHandleRead().

◆ IntDecEmulateInstruction()

INTSTATUS IntDecEmulateInstruction	(	DWORD	CpuNumber,
		PINSTRUX	Instrux
	)

Emulate a MOV or a PUSH instruction.

This function emulates the instruction currently pointed by RIP on the provided CpuNumber. It is intended to be used only by detours handlers, and, as such, it only supports two instructions: PUSH and MOV. This function should not be called outside a direct detour handler.

Parameters

[in]	CpuNumber	The CPU context (should be IG_CURRENT_VCPU).
[in]	Instrux	The decoded instruction.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If an unsupported instruction is provided.

Definition at line 2592 of file decoder.c.

◆ IntDecEmulatePageWalk()

INTSTATUS IntDecEmulatePageWalk	(	QWORD	Gla,
		QWORD	Cr3,
		DWORD	Flags
	)

Emulates a page-walk by setting the A and/or D flags inside the required page-table levels. This function will always set the A bit at every level of the page-tables. The D flag will be set if the page is already A, and it has write permissions.

Parameters

[in]	Gla	The guest linear address for which A/D bits will be set.
[in]	Cr3	The CR3 used for the translation of Gla.
[in]	Flags	Contains the page-walk flags: PW_FLAGS_SET_A in order to set the A bit, PW_FLAGS_SET_D in order to set the D bit.

Return values

INT_STATUS_SUCCESS On success.

Definition at line 3613 of file decoder.c.

Referenced by IntDecEmulateRead().

◆ IntDecEmulatePTWrite()

INTSTATUS IntDecEmulatePTWrite ( QWORD * NewValue )

Emulate a page-table write.

Fast Page Table write emulator. This function makes some strong assumptions:

since this is a PT memory write, there is no need to make PT validations - we operate directly on physical memory;
since this is a PT memory write, there is no need to set A/D bits inside self-mapping PTs;
the instruction has been cached internally, so modifying it from another CPU will not affect us;
only the most common PT modifying instructions are supported (MOV, CMPXCHG, AND); all other will be emulated;
the written size must not exceed 8 bytes;
the instruction stores to memory; This function operates on the context of the current VCPU, and assumes the current instruction, pointed by RIP, is the one making the page-table entry modification.

Parameters

[out] NewValue The new value stored inside the page-table entry.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter has been supplied.
INT_STATUS_NOT_SUPPORTED	If the instruction is not supported.

Definition at line 2720 of file decoder.c.

Referenced by IntHookPtwEmulateWrite().

◆ IntDecEmulateRead()

INTSTATUS IntDecEmulateRead	(	PINSTRUX	Instrux,
		BYTE *	SrcValueBuffer
	)

Emulate a read access.

This function assumes that it is called for emulating instructions that read data from memory. If not NULL, SrcValueBuffer will be used instead of the real memory contents. Caller must ensure that SrcValueBuffer has a minimum size of gVcpu->AccessSize. Note that after calling this function some assumptions about the global state can't be made: on successful emulation, gVcpu->Regs.Rip will no longer point to the instruction bytes from which gVcpu->Instruction was decoded, but to the next instruction; as a result, calling IntDecEmulateRead twice on the same exit might prove fatal.

Parameters

[in]	Instrux	The decoded instruction.
[in]	SrcValueBuffer	Optional pointer to the source value buffer.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_NOT_SUPPORTED	If the emulation is not supported (invalid OS, architecture, instruction).

set the operand value, then update the RIP, we will still have the same problem, only in reverse: we may end up with the instruction being emulated, but the RIP still pointing to it

Definition at line 1570 of file decoder.c.

Referenced by IntHandleEptViolation().

◆ IntDecGetAccessedMem()

INTSTATUS IntDecGetAccessedMem	(	PINSTRUX	Instrux,
		PIG_ARCH_REGS	Registers,
		PIG_XSAVE_AREA	XsaveArea,
		MEMADDR *	Gla,
		DWORD *	Count
	)

Decode each accessed address by an instruction.

Given an instruction, it computes every accessed linear address. It assumes the caller has already allocated enough storage space inside Gla.

Parameters

[in]	Instrux	The decoded instruction.
[in]	Registers	Optional pointer to the general purpose registers state.
[in]	XsaveArea	Optional pointer to the XSAVE area.
[out]	Gla	Pointer to an array that will contain, upon return, each accessed Gla.
[in,out]	Count	On function entry, contains the number of slots available inside Gla. On return, it contains the actual number of entries stored in Gla array.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_DATA_BUFFER_TOO_SMALL	If the Gla array is too small.

Definition at line 3160 of file decoder.c.

Referenced by DbgTestSse(), and IntHandleEptViolation().

◆ IntDecGetAccessedMemCount()

INTSTATUS IntDecGetAccessedMemCount	(	PINSTRUX	Instrux,
		DWORD *	Count
	)

Decode the number of memory locations accessed by an instruction.

Given the decoded instruction, this function will return in Count the number of memory locations accessed by this instruction. There may be cases where an instruction accesses multiple locations - for example, POP [mem] will read the from the memory (stack) and it will store to the provided mem address. Another example includes instructions with VSIB addressing, which may access up to 16 different locations.

Parameters

[in]	Instrux	The decoded instruction.
[out]	Count	The number of memory locations accessed by the instruction.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.

Definition at line 3110 of file decoder.c.

Referenced by IntHandleEptViolation().

◆ IntDecGetMaxvl()

INTSTATUS IntDecGetMaxvl ( ND_OPERAND_SIZE * Maxvl )

Computes the maximum vector length, given the enabled states inside the XCR0 register.

Parameters

[out] Maxvl Contains, upon successful return, the maximum vector length: 128, 256 or 512 bits.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_NOT_FOUND	If XCR0 contains an invalid combination of bits.

Definition at line 3672 of file decoder.c.

Referenced by IntDecEmulateRead().

◆ IntDecGetSseRegValue()

INTSTATUS IntDecGetSseRegValue	(	PIG_XSAVE_AREA	XsaveArea,
		DWORD	Reg,
		DWORD	Size,
		OPERAND_VALUE *	Value
	)

Get the value of a vector register. Wrapper over IntDecGetSetSseRegValue.

Parameters

[in]	XsaveArea	Optional XSAVE area. If NULL, it will be queried internally.
[in]	Reg	The vector register to be accessed.
[in]	Size	The size to return/set in the vector register.
[out]	Value	The value of the vector register.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INSUFFICIENT_RESOURCES	If memory could not be allocated for the XSAVE area.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If an invalid register is specified (for example, XMM8 outside long-mode).

Definition at line 3561 of file decoder.c.

Referenced by IntDecComputeVsibLinearAddresses(), and IntGetValueFromOperand().

◆ IntDecGetWrittenValueFromInstruction()

INTSTATUS IntDecGetWrittenValueFromInstruction	(	PINSTRUX	Instrux,
		PIG_ARCH_REGS	Registers,
		PBYTE	MemoryValue,
		OPERAND_VALUE *	WrittenValue
	)

Decode a written value from a memory write instruction.

Get the written value from an INSTRUX. It only supports a basic set of instructions (MOV, STOSB, MOVSB, XCHG, ADD, XOR, etc.). WrittenValue will always contain the value that will be written in the destination operand. For instructions that write to more than one operand (XCHG, XADD, etc), the value written to the memory operand will be returned. For CMPXCHG, CMPXCHG8B and CMPXCHG16B the return value is computed based on the compare result. No checks are made on WrittenValue size. The caller should allocate enough for the largest possible operand size. For now, the only supported instruction for which more than a QWORD is needed is CMPXCHG16B (2 QWORDs)

Parameters

[in]	Instrux	The decoded instruction.
[in]	Registers	Optional pointer to the general purpose registers state.
[in]	MemoryValue	Optional parameter to an already mapped memory region containing the memory operand.
[out]	WrittenValue	Will contain, upon successful return, the written value to memory.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If an unsupported instruction is provided.

Definition at line 1861 of file decoder.c.

Referenced by IntExceptGetVictimEpt(), IntHookPtwEmulateWrite(), IntLixDrvIsLegitimateTextPoke(), IntWinDrvObjHandleWrite(), IntWinInfHookHandleSiloFirstWrite(), and IntWinInfHookSppViolationCallbackWmiPtrChanged().

◆ IntDecSetSseRegValue()

INTSTATUS IntDecSetSseRegValue	(	PIG_XSAVE_AREA	XsaveArea,
		DWORD	Reg,
		DWORD	Size,
		OPERAND_VALUE *	Value,
		BOOLEAN	Commit
	)

Sets the value of a vector register. Wrapper over IntDecGetSetSseRegValue.

Parameters

[in]	XsaveArea	Optional XSAVE area. If NULL, it will be queried internally.
[in]	Reg	The vector register to be accessed.
[in]	Size	The size to return/set in the vector register.
[in]	Value	The value of the vector register.
[in]	Commit	True if the vector register state must be committed.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INSUFFICIENT_RESOURCES	If memory could not be allocated for the XSAVE area.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_NOT_SUPPORTED	If an invalid register is specified (for example, XMM8 outside long-mode).

Definition at line 3586 of file decoder.c.

Referenced by IntSetValueForOperand().

Data Structures

Macros

Typedefs

Enumerations

Functions

Macro Definition Documentation

◆ DEC_EFLAG_CF

◆ DEC_GET_FLAG

◆ DEC_INVALID_GPA

◆ DEC_OPT_NO_CACHE

◆ PW_FLAGS_SET_A

◆ PW_FLAGS_SET_D

◆ QWORD_HIGH_PART_MASK

Typedef Documentation

◆ MEMADDR

◆ OPERAND_VALUE

◆ PMEMADDR

◆ POPERAND_VALUE

Enumeration Type Documentation

◆ anonymous enum

Function Documentation

◆ IntDecComputeLinearAddress()

◆ IntDecDecodeAccessSize()

◆ IntDecDecodeDestinationLinearAddressFromInstruction()

◆ IntDecDecodeInstruction()

◆ IntDecDecodeInstructionAtRip()

◆ IntDecDecodeInstructionAtRipWithCache()

◆ IntDecDecodeInstructionFromBuffer()

◆ IntDecDecodeSourceLinearAddressFromInstruction()

◆ IntDecEmulateInstruction()

◆ IntDecEmulatePageWalk()

◆ IntDecEmulatePTWrite()

◆ IntDecEmulateRead()

◆ IntDecGetAccessedMem()

◆ IntDecGetAccessedMemCount()

◆ IntDecGetMaxvl()

◆ IntDecGetSseRegValue()

◆ IntDecGetWrittenValueFromInstruction()

◆ IntDecSetSseRegValue()