Probleme emulateur asm x86 en c#

**hardcpp** · 13/01/2014, 16h05

Bonjour, je me retrouve actuellement confronté a un problème, j'ai peut de connaissance en assembleur mais j'essaye d'apprendre sur le tas. J'essaye actuellement d’exécuté (en émulation) une courte fonction assembleur a distance dans un processus exécuté.

Code de la fonction :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
.text:0065B1B1 sub_65B1B1      proc near               ; CODE XREF: sub_6978BD+Fp
.text:0065B1B1                                         ; sub_6985A9+Fp ...
.text:0065B1B1                 push    esi
.text:0065B1B2                 push    edi
.text:0065B1B3                 mov     edi, ecx
.text:0065B1B5                 mov     ecx, [edi+8]
.text:0065B1B8                 mov     eax, [ecx]
.text:0065B1BA                 call    dword ptr [eax] ; 65B5D7
.text:0065B1BC                 mov     ecx, [edi+4]
.text:0065B1BF                 mov     esi, eax
.text:0065B1C1                 mov     eax, [ecx]
.text:0065B1C3                 and     esi, 0Fh
.text:0065B1C6                 call    dword ptr [eax]
.text:0065B1C8                 mov     ecx, esi
.text:0065B1CA                 pop     edi
.text:0065B1CB                 rol     eax, cl
.text:0065B1CD                 pop     esi
.text:0065B1CE                 retn
.text:0065B1CE sub_65B1B1      endp

Via ce code

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
    public class Registers
    {
        public uint EAX = 0;
        public uint EBX = 0;
        public uint ECX = 0;
        public uint EDX = 0;
        public uint ESP = 0;
        public uint EBP = 0;
        public uint ESI = 0;
        public uint EDI = 0;
    }
 
    class Opcode
    {
        public static uint ParseSubFunction(uint p_Address, uint p_MaxAddress, Registers p_Registers)
        {
            uint l_CurrentAddr      = p_Address;
            uint l_LastCurrentAddr  = p_Address;
            byte l_CurrentByte = 0;
 
            System.Console.WriteLine("Parse function {0}", p_Address.ToString("X8"));
 
            do
            {
                l_CurrentByte = Process.Memory.Read<byte>(l_CurrentAddr);
 
                if (l_CurrentByte == 0x57) // push edi
                    l_CurrentAddr++;
                else if (l_CurrentByte == 0x51) // push ecx
                    l_CurrentAddr++;
                else if (l_CurrentByte == 0x56) // push esi
                    l_CurrentAddr++;
                else if (l_CurrentByte == 0x5F) // pop edi
                    l_CurrentAddr++;
                else if (l_CurrentByte == 0x5E) // pop esi
                    l_CurrentAddr++;
                else if (l_CurrentByte == 0xD3) // rol eax, cl
                    l_CurrentAddr += 2;
                else if (l_CurrentByte == 0x74) // jz xx
                    l_CurrentAddr += 2;
                else if (l_CurrentByte == 0x8B) // mov
                {
                    l_CurrentByte = Process.Memory.Read<byte>(l_CurrentAddr + 1);
 
                    if (l_CurrentByte == 0x0D)  // mov ecx, xxxxxxxx
                    {
                        p_Registers.ECX = Process.Memory.Read<uint>(Process.Memory.Read<uint>(l_CurrentAddr + 2));
                        l_CurrentAddr += 6;
                    }
                    else if (l_CurrentByte == 0x01)  // mov eax, [ecx]
                    {
                        p_Registers.EAX = Process.Memory.Read<uint>(p_Registers.ECX);
                        l_CurrentAddr += 2;
                    }
                    else if (l_CurrentByte == 0xCE)  // mov ecx, esi
                    {
                        p_Registers.ECX = p_Registers.ESI;
                        l_CurrentAddr += 2;
                    }
                    else if (l_CurrentByte == 0xF0)  // mov esi, eax
                    {
                        p_Registers.ESI = p_Registers.EAX;
                        l_CurrentAddr += 2;
                    }
                    else if (l_CurrentByte == 0xF9)  // mov edi, ecx
                    {
                        p_Registers.EDI = p_Registers.ECX;
                        l_CurrentAddr += 2;
                    }
                    else if (l_CurrentByte == 0x4F)  // mov ecx, [edi+xx]
                    {
                        byte l_Offset = Process.Memory.Read<byte>(l_CurrentAddr + 2);
                        p_Registers.ECX = Process.Memory.Read<uint>(p_Registers.EDI + l_Offset);
                        l_CurrentAddr += 3;
                    }
                }
                else if (l_CurrentByte == 0xFF) // call
                {
                    l_CurrentByte = Process.Memory.Read<byte>(l_CurrentAddr + 1);
 
                    if (l_CurrentByte == 0x10) // call dword ptr [eax]
                    {
                        l_CurrentAddr += 2;
 
                        uint l_FunctionAddr = Process.Memory.Read<uint>(p_Registers.EAX);
                        System.Console.WriteLine("Call {0} from {1}", l_FunctionAddr.ToString("X8"), l_CurrentAddr.ToString("X8"));
                        if (ParseSubFunction(l_FunctionAddr, 0, p_Registers) == 0)
                        {
                            System.Console.WriteLine("ExtractDataHandler failed on function 0x" + p_Address.ToString("X8"));
                            return 0;
                        }
                    }
                }
                else if (l_CurrentByte == 0x83) // and
                {
                    l_CurrentByte = Process.Memory.Read<byte>(l_CurrentAddr + 1);
 
                    if (l_CurrentByte == 0xE6) // and esi, XX
                    {
                        uint l_Mask = (uint)Process.Memory.Read<byte>(l_CurrentAddr + 2);
                        p_Registers.ESI = p_Registers.ESI & l_Mask;
                        l_CurrentAddr += 3;
                    }
                }
                else if (l_CurrentByte == 0xE8) // call xxxxxxxx
                {
                    int l_RelOffset = Process.Memory.Read<int>(l_CurrentAddr + 1);
                    uint l_Addr      = (l_CurrentAddr - (uint)(-l_RelOffset)) + 5;
 
                    if (ParseSubFunction(l_Addr, 0, p_Registers) == 0)
                    {
                        System.Console.WriteLine("ExtractDataHandler failed on function 0x" + p_Address.ToString("X8"));
                        return 0;
                    }
 
                    l_CurrentAddr += 5;
                }
                else if (l_CurrentByte == 0xB8) // mov eax, xxxxxxxx
                {
                    p_Registers.EAX = Process.Memory.Read<uint>(l_CurrentAddr + 1);
                    l_CurrentAddr += 5;
 
                }
                else if (l_CurrentByte == 0xB9) // mov ecx, xxxxxxxx
                {
                    p_Registers.ECX = Process.Memory.Read<uint>(l_CurrentAddr + 1);
                    l_CurrentAddr += 5;
                }
                else if (l_CurrentByte == 0x2B) // sub
                {
                    l_CurrentByte = Process.Memory.Read<byte>(l_CurrentAddr + 1);
 
                    if (l_CurrentByte == 0xC8)  // sub ecx, eax
                    {
                        p_Registers.ECX = p_Registers.ECX - p_Registers.EAX;
                        l_CurrentAddr += 2;
                    }
                    else if (l_CurrentByte == 0xCE)  // sub ecx, eax
                    {
                        p_Registers.ECX = p_Registers.ECX - p_Registers.ESI;
                        l_CurrentAddr += 2;
                    }
                }
                else if (l_CurrentByte == 0xC3 && p_MaxAddress == 0) // retn
                    return 1;
 
                if (l_LastCurrentAddr == l_CurrentAddr)
                {
                    System.Console.WriteLine("ExtractDataHandler failed at 0x" + l_CurrentAddr.ToString("X8") + " opcode " + l_CurrentByte.ToString("X2") + "not handled");
                    return 0;
                }
 
                l_LastCurrentAddr = l_CurrentAddr;
 
            } while ((p_MaxAddress == 0 ? l_CurrentByte != 0xC3 /* retn */ : l_CurrentAddr < p_MaxAddress));
 
            return 1;
        }

Tout ce deroule bien, mais apres l'instruction

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

call    dword ptr [eax] ; 65B5D7

plus rien de fonctionne.

Retour de mon app :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
Parse function 0065B1B1
Call 0065B5D7 from 0065B1BC
Parse function 0065B5D7
Call 0065B1B1 from 0065B1C8
Parse function 0065B1B1

Le deuxième call dans la fonction

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
.text:0065B1C3                 and     esi, 0Fh
.text:0065B1C6                 call    dword ptr [eax]

Me renvoie sur la la fonction contenant ce code alors que via un debugger [eax] contient une adresse différente.

J'apprecirai grandement de l'aide je tourne en rond depuis 6h x).

**n5Rzn1D9dC** · 14/01/2014, 16h07

Salut,

A ce que je vois tu utilises IDA.
Ce serait déjà mieux avec un "vrais" debugger, comme "Immunity debugger".

Ensuite là tu essais d'apprendre l'asm en appelant du code asm à partir d'un code C ?
C'est se compliquer grave la vie : /

Télécharge par exemple "Fasm", regarde les exemples, et code purement en asm, sans C.

Sinon pour ton problème, regarde si l'adresse d'eax est correcte, mais avec "Immunity", ou avec un simple "printf" placé juste avant l'appel.
Là tout de suite je ne comprend pas ton code, donc difficile de pouvoir t'aider mieux que ça.

a+

**hardcpp** · 14/01/2014, 20h34

IDA est aussi un vrai debugger avec plus de feature (plugin perso)

le but de mon programme et d’exécuté le code distant dans un process c# sans faire de call dans le processus cible (probleme threading & autres)

Mon problème venais de mon implémentation de ma fonction Rol en asm qui était foireuse.

Problème corrigé.

**ctrlD** · 15/01/2014, 00h18

C++, programmation objet..? déjà du mal avec le langage machine, le C et ses 50 000 synonymes de définitions d'espace mémoire...

public class register initialise tout les registres : eax, edx, ecx, edx, etc

Avec l'asm, c'est une question d'ordonnancement, dans quel ordre on effectue les opérations pour un résultat voulu : allumer une cigarette sans prendre le briquet d'abord ... bam fatal error, si t'as trouvé une solution c'est chouette... dommage que tu ne publie pas la correction de ton problème pour tous

**n5Rzn1D9dC** · 15/01/2014, 11h59

Envoyé par hardcpp

IDA est aussi un vrai debugger avec plus de feature (plugin perso)

Disons que c'est à mis chemin entre un desassembleur et un debugger.
"Interactive disassembler" comme ils l'appellent eux-même.

**hardcpp** · 15/01/2014, 16h49

Envoyé par ctrlD

C++, programmation objet..? déjà du mal avec le langage machine, le C et ses 50 000 synonymes de définitions d'espace mémoire...

public class register initialise tout les registres : eax, edx, ecx, edx, etc

Avec l'asm, c'est une question d'ordonnancement, dans quel ordre on effectue les opérations pour un résultat voulu : allumer une cigarette sans prendre le briquet d'abord ... bam fatal error, si t'as trouvé une solution c'est chouette... dommage que tu ne publie pas la correction de ton problème pour tous

voila la solution :

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
 
namespace HardCPPWoWDumper.Hooking.Tools
{
    /// <summary>
    /// X86 Memory
    /// </summary>
    public abstract class VX86Memory
    {
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract Byte ReadByte();
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract UInt32 ReadDword();
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract Int32 ReadSDword();
 
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract Byte ReadByte(UInt32 p_Address);
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract UInt32 ReadDword(UInt32 p_Address);
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public abstract Int32 ReadSDword(UInt32 p_Address);
 
        /// <summary>
        /// Get Read address
        /// </summary>
        /// <returns></returns>
        public abstract UInt32 GetReadAddress();
        /// <summary>
        /// Set read address
        /// </summary>
        /// <param name="p_Address"></param>
        public abstract void SetReadAddress(UInt32 p_Address);
    }
 
    /// <summary>
    /// X86 Memory => remote process
    /// </summary> 
    public class VX86Memory_RemoteProcess : VX86Memory
    {
        /// <summary>
        /// Constructor
        /// </summary>
        /// <param name="p_Process"></param>
        public VX86Memory_RemoteProcess(MyMemory.Memory p_Process)
        {
            m_Process = p_Process;
        }
 
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override Byte ReadByte()
        {
            Byte l_Value = ReadByte(m_CurrentAddress);
 
            m_CurrentAddress +=  1;
 
            return l_Value;
        }
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override UInt32 ReadDword()
        {
            UInt32 l_Value = ReadDword(m_CurrentAddress);
 
            m_CurrentAddress += 4;
 
            return l_Value;
        }
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override Int32 ReadSDword()
        {
            Int32 l_Value = ReadSDword(m_CurrentAddress);
 
            m_CurrentAddress += 4;
 
            return l_Value;
        }
 
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override Byte ReadByte(UInt32 p_Address)
        {
            return m_Process.Read<Byte>(p_Address);
        }
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override UInt32 ReadDword(UInt32 p_Address)
        {
            return m_Process.Read<UInt32>(p_Address);
        }
        /// <summary>
        /// Read
        /// </summary>
        /// <returns></returns>
        public override Int32 ReadSDword(UInt32 p_Address)
        {
            return m_Process.Read<Int32>(p_Address);
        }
 
        /// <summary>
        /// Get Read address
        /// </summary>
        /// <returns></returns>
        public override UInt32 GetReadAddress()
        {
            return m_CurrentAddress;
        }
        /// <summary>
        /// Set read address
        /// </summary>
        /// <param name="p_Address"></param>
        public override void SetReadAddress(UInt32 p_Address)
        {
            m_CurrentAddress = p_Address;
        }
 
        #region Data
        /// <summary>
        /// Current address in the remote process
        /// </summary>
        private UInt32 m_CurrentAddress;
        /// <summary>
        /// Memory process
        /// </summary>
        private MyMemory.Memory m_Process;
        #endregion
    }
}

Code :

Sélectionner tout - Visualiser dans une fenêtre à part

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
 
namespace HardCPPWoWDumper.Hooking.Tools
{
    /// <summary>
    /// Cpu registers
    /// </summary>
    public class VX86Registers
    {
        /// <summary>
        /// EAX
        /// </summary>
        public uint EAX { get { return m_EAX[m_EAX.Count - 1]; } set { m_EAX[m_EAX.Count - 1] = value; } }
        /// <summary>
        /// EBX
        /// </summary>
        public uint EBX { get { return m_EBX[m_EBX.Count - 1]; } set { m_EBX[m_EBX.Count - 1] = value; } }
        /// <summary>
        /// ECX
        /// </summary>
        public uint ECX { get { return m_ECX[m_ECX.Count - 1]; } set { m_ECX[m_ECX.Count - 1] = value; } }
        /// <summary>
        /// EDX
        /// </summary>
        public uint EDX { get { return m_EDX[m_EDX.Count - 1]; } set { m_EDX[m_EDX.Count - 1] = value; } }
        /// <summary>
        /// ESP
        /// </summary>
        public uint ESP { get { return m_ESP[m_ESP.Count - 1]; } set { m_ESP[m_ESP.Count - 1] = value; } }
        /// <summary>
        /// EBP
        /// </summary>
        public uint EBP { get { return m_EBP[m_EBP.Count - 1]; } set { m_EBP[m_EBP.Count - 1] = value; } }
        /// <summary>
        /// ESI
        /// </summary>
        public uint ESI { get { return m_ESI[m_ESI.Count - 1]; } set { m_ESI[m_ESI.Count - 1] = value; } }
        /// <summary>
        /// EDI
        /// </summary>
        public uint EDI { get { return m_EDI[m_EDI.Count - 1]; } set { m_EDI[m_EDI.Count - 1] = value; } }
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        /// <summary>
        /// Dump registers into console
        /// </summary>
        public void Dump()
        {
            System.Console.WriteLine("-----------------------------------");
            System.Console.WriteLine("Register Dump");
            System.Console.WriteLine("-----------------------------------");
            System.Console.WriteLine("EAX : " + EAX.ToString("X8"));
            System.Console.WriteLine("EBX : " + EBX.ToString("X8"));
            System.Console.WriteLine("ECX : " + ECX.ToString("X8"));
            System.Console.WriteLine("EDX : " + EDX.ToString("X8"));
            System.Console.WriteLine("ESP : " + ESP.ToString("X8"));
            System.Console.WriteLine("EBP : " + EBP.ToString("X8"));
            System.Console.WriteLine("ESI : " + ESI.ToString("X8"));
            System.Console.WriteLine("EDI : " + EDI.ToString("X8"));
            System.Console.WriteLine("-----------------------------------");
        }
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        #region Push
        /// <summary>
        /// Push EDI
        /// </summary>
        public void PushEdi()
        {
            m_EDI.Add(m_EDI[m_EDI.Count - 1]);
        }
        /// <summary>
        /// Push ECX
        /// </summary>
        public void PushEcx()
        {
            m_ECX.Add(m_ECX[m_ECX.Count - 1]);
        }
        /// <summary>
        /// Push ESI
        /// </summary>
        public void PushEsi()
        {
            m_ESI.Add(m_ESI[m_ESI.Count - 1]);
        }
        /// <summary>
        /// Push EBP
        /// </summary>
        public void PushEbp()
        {
            m_EBP.Add(m_EBP[m_EBP.Count - 1]);
        }
        #endregion Push
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        #region Pop
        /// <summary>
        /// Pop EDI
        /// </summary>
        public void PopEdi()
        {
            if (m_EDI.Count == 1)
                return;
 
            m_EDI.RemoveAt(m_EDI.Count - 1);
        }
        /// <summary>
        /// Pop ECX
        /// </summary>
        public void PopEcx()
        {
            if (m_ECX.Count == 1)
                return;
 
            m_ECX.RemoveAt(m_ECX.Count - 1);
        }
        /// <summary>
        /// Pop ESI
        /// </summary>
        public void PopEsi()
        {
            if (m_ESI.Count == 1)
                return;
 
            m_ESI.RemoveAt(m_ESI.Count - 1);
        }
        /// <summary>
        /// POP EBP
        /// </summary>
        public void PopEbp()
        {
            if (m_EBP.Count == 1)
                return;
 
            m_EBP.RemoveAt(m_EBP.Count - 1);
        }
        #endregion
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        #region Data
        /// <summary>
        /// EAX
        /// </summary>
        private List<uint> m_EAX = new List<uint>() { 0 };
        /// <summary>
        /// EBC
        /// </summary>
        private List<uint> m_EBX = new List<uint>() { 0 };
        /// <summary>
        /// ECX
        /// </summary>
        private List<uint> m_ECX = new List<uint>() { 0 };
        /// <summary>
        /// EDX
        /// </summary>
        private List<uint> m_EDX = new List<uint>() { 0 };
        /// <summary>
        /// ESP
        /// </summary>
        private List<uint> m_ESP = new List<uint>() { 0 };
        /// <summary>
        /// EBP
        /// </summary>
        private List<uint> m_EBP = new List<uint>() { 0 };
        /// <summary>
        /// ESI
        /// </summary>
        private List<uint> m_ESI = new List<uint>() { 0 };
        /// <summary>
        /// EDI
        /// </summary>
        private List<uint> m_EDI = new List<uint>() { 0 };
        #endregion
    }
 
    /// <summary>
    /// Virtual CPU
    /// </summary>
    public class VX86Cpu
    {
        /// <summary>
        /// Set cpu registers
        /// </summary>
        /// <param name="p_Register"></param>
        public void SetRegisters(VX86Registers p_Register)
        {
            m_Registers = p_Register;
        }
        /// <summary>
        /// Set memory
        /// </summary>
        /// <param name="p_Memory"></param>
        public void SetMemory(VX86Memory p_Memory)
        {
            m_Memory = p_Memory;
        }
        /// <summary>
        /// Set tracing
        /// </summary>
        /// <param name="p_Tracing"></param>
        public void SetTracing(bool p_Tracing)
        {
            Tracing = p_Tracing;
        }
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        public void Trace(UInt32 p_Address, String p_Str)
        {
            if (Tracing)
                System.Console.WriteLine("[VX86CPU] At 0x{0} => " + p_Str, p_Address.ToString("X8"));
        }
 
        public uint ParseFunction(UInt32 p_MaxAddress = 0)
        {
            Byte l_CurrentByte = 0;
 
            do
            {
                //m_Registers.Dump();
                bool l_Error = false;
                l_CurrentByte = m_Memory.ReadByte();
 
                //////////////////////////////////////////////////////////////////////////
                /// PUSH
                //////////////////////////////////////////////////////////////////////////
                if (l_CurrentByte == 0x57) // push edi
                {
                    Trace(m_Memory.GetReadAddress(), "push edi");
                    m_Registers.PushEdi();
                }
                else if (l_CurrentByte == 0x55) // push ebp
                {
                    Trace(m_Memory.GetReadAddress(), "push ebp");
                    m_Registers.PushEbp();
                }
                else if (l_CurrentByte == 0x51) // push ecx
                {
                    Trace(m_Memory.GetReadAddress(), "push ecx");
                    m_Registers.PushEcx();
                }
                else if (l_CurrentByte == 0x56) // push esi
                {
                    Trace(m_Memory.GetReadAddress(), "push esi");
                    m_Registers.PushEsi();
                }
                //////////////////////////////////////////////////////////////////////////
                /// POP
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x5F) // pop edi
                {
                    Trace(m_Memory.GetReadAddress(), "pop edi");
                    m_Registers.PopEdi();
                }
                else if (l_CurrentByte == 0x5E) // pop esi
                {
                    Trace(m_Memory.GetReadAddress(), "push esi");
                    m_Registers.PopEsi();
                }
                else if (l_CurrentByte == 0x5D) // pop ebp
                {
                    Trace(m_Memory.GetReadAddress(), "push ebp");
                    m_Registers.PopEbp();
                }
                //////////////////////////////////////////////////////////////////////////
                /// ROL
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xD3) // rol eax,
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xC0)  // rol eax, cl
                    {
                        Trace(m_Memory.GetReadAddress(), "rol eax, cl");
 
                        UInt32 l_RolCount = m_Registers.ECX & 0xFF;
 
                        for (UInt32 l_I = 0; l_I < l_RolCount; l_I++)
                            m_Registers.EAX = Rol(m_Registers.EAX);
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// JZ
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x74) // jz xx
                {
                    Trace(m_Memory.GetReadAddress(), "jz location");
 
                    m_Memory.ReadByte();
                }
                //////////////////////////////////////////////////////////////////////////
                /// MOV
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x8B) // mov
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0x0D)  // mov ecx, xxxxxxxx
                    {
                        Trace(m_Memory.GetReadAddress(), "mov ecx, 0x" + m_Memory.ReadDword(m_Memory.ReadDword(m_Memory.GetReadAddress())).ToString("X8"));
                        m_Registers.ECX = m_Memory.ReadDword(m_Memory.ReadDword());
                    }
                    else if (l_CurrentByte == 0x01)  // mov eax, [ecx]
                    {
                        Trace(m_Memory.GetReadAddress(), "mov ecx, [ecx]");
                        m_Registers.EAX = m_Memory.ReadDword(m_Registers.ECX);
                    }
                    else if (l_CurrentByte == 0xCE)  // mov ecx, esi
                    {
                        Trace(m_Memory.GetReadAddress(), "mov ecx, esi");
                        m_Registers.ECX = m_Registers.ESI;
                    }
                    else if (l_CurrentByte == 0xF8)  // mov edi, eax
                    {
                        Trace(m_Memory.GetReadAddress(), "mov edi, eax");
                        m_Registers.EDI = m_Registers.EAX;
                    }
                    else if (l_CurrentByte == 0xF9)  // mov edi, ecx
                    {
                        Trace(m_Memory.GetReadAddress(), "mov edi, ecx");
                        m_Registers.EDI = m_Registers.ECX;
                    }
                    else if (l_CurrentByte == 0xF0)  // mov esi, eax
                    {
                        Trace(m_Memory.GetReadAddress(), "mov esi, eax");
                        m_Registers.ESI = m_Registers.EAX;
                    }
                    else if (l_CurrentByte == 0xF1)  // mov esi, ecx
                    {
                        Trace(m_Memory.GetReadAddress(), "mov esi, ecx");
                        m_Registers.ESI = m_Registers.ECX;
                    }
                    else if (l_CurrentByte == 0xCF)  // mov ecx, edi
                    {
                        Trace(m_Memory.GetReadAddress(), "mov ecx, edi");
                        m_Registers.ECX = m_Registers.EDI;
                    }
                    else if (l_CurrentByte == 0x4F)  // mov ecx, [edi+xx]
                    {
                        byte l_Offset = m_Memory.ReadByte();
 
                        Trace(m_Memory.GetReadAddress(), "mov ecx, [edi+" + l_Offset.ToString("X2") + "]");
 
                        m_Registers.ECX = m_Memory.ReadDword(m_Registers.EDI + l_Offset);
                    }
                    else if (l_CurrentByte == 0x4E)  // mov ecx, [esi+xx]
                    {
                        byte l_Offset = m_Memory.ReadByte();
 
                        Trace(m_Memory.GetReadAddress(), "mov ecx, [esi+0x" + l_Offset.ToString("X2") + "]");
 
                        m_Registers.ECX = m_Memory.ReadDword(m_Registers.ESI + l_Offset);
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// CALL / PUSH
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xFF) // call or push
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0x10) // call dword ptr [eax]
                    {
                        Trace(m_Memory.GetReadAddress(), "call dword ptr [eax]");
 
                        UInt32 l_FunctionAddr   = m_Memory.ReadDword(m_Registers.EAX);
                        UInt32 l_LastAddr       = m_Memory.GetReadAddress();
 
                        m_Memory.SetReadAddress(l_FunctionAddr);
 
                        if (ParseFunction() == 0)
                        {
                            System.Console.WriteLine("[VX86CPU] Execution of 0x{0} at 0x{1} failed.", l_FunctionAddr.ToString("X8"), l_LastAddr.ToString("X8"));
                            return 0;
                        }
 
                        m_Memory.SetReadAddress(l_LastAddr);
                    }
                    //else if (l_CurrentByte == 0x35) // push dword_xxxxxxxx
                    //{
                    //    uint l_Addr = (uint)Process.Memory.Read<byte>(l_CurrentAddr + 2);
 
 
                    //    l_CurrentAddr += 6;
                    //}
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// AND
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x83) // and
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xE6) // and esi, XX
                    {
                        uint l_Mask = (uint)m_Memory.ReadByte();
 
                        Trace(m_Memory.GetReadAddress(), "and esi, 0x" + l_Mask.ToString("X2"));
 
                        m_Registers.ESI = m_Registers.ESI & l_Mask;
                    }
                    else if (l_CurrentByte == 0xE1) // and ecx, XX
                    {
                        uint l_Mask = (uint)m_Memory.ReadByte();
 
                        Trace(m_Memory.GetReadAddress(), "and ecx, 0x" + l_Mask.ToString("X2"));
 
                        m_Registers.ECX = m_Registers.ECX & l_Mask;
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// XOR
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x33) // xor
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xC7) // xor eax, edi
                    {
                        Trace(m_Memory.GetReadAddress(), "xor eax, edi");
                        m_Registers.EAX = m_Registers.EAX ^ m_Registers.EDI;
                    }
                    else if (l_CurrentByte == 0xC6) // xor eax, esi
                    {
                        Trace(m_Memory.GetReadAddress(), "xor eax, esi");
                        m_Registers.EAX = m_Registers.EAX ^ m_Registers.ESI;
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// CALL
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xE8) // call xxxxxxxx
                {
                    Int32   l_RelOffset = m_Memory.ReadSDword();
                    UInt32  l_Addr      = (m_Memory.GetReadAddress() - (uint)(-l_RelOffset));
 
                    Trace(m_Memory.GetReadAddress(), "call 0x" + l_Addr.ToString("X8"));
 
                    UInt32 l_LastAddr = m_Memory.GetReadAddress();
 
                    m_Memory.SetReadAddress(l_Addr);
 
                    if (ParseFunction() == 0)
                    {
                        System.Console.WriteLine("[VX86CPU] Execution of 0x{0} at 0x{1} failed.", l_Addr.ToString("X8"), l_LastAddr.ToString("X8"));
                        return 0;
                    }
 
                    m_Memory.SetReadAddress(l_LastAddr);
                }
                //////////////////////////////////////////////////////////////////////////
                /// MOV
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xB8) // mov eax, xxxxxxxx
                {
                    Trace(m_Memory.GetReadAddress(), "mov eax, 0x" + m_Memory.ReadDword(m_Memory.GetReadAddress()).ToString("X8"));
                    m_Registers.EAX = m_Memory.ReadDword();
                }
                //////////////////////////////////////////////////////////////////////////
                /// MOV
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xB9) // mov ecx, xxxxxxxx
                {
                    Trace(m_Memory.GetReadAddress(), "mov ecx, 0x" + m_Memory.ReadDword(m_Memory.GetReadAddress()).ToString("X8"));
                    m_Registers.ECX = m_Memory.ReadDword();
                }
                //////////////////////////////////////////////////////////////////////////
                /// SUB
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x2B) // sub
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xC8)  // sub ecx, eax
                    {
                        Trace(m_Memory.GetReadAddress(), "sub ecx, eax");
                        m_Registers.ECX = m_Registers.ECX - m_Registers.EAX;
                    }
                    else if (l_CurrentByte == 0xCE)  // sub ecx, esi
                    {
                        Trace(m_Memory.GetReadAddress(), "sub ecx, esi");
                        m_Registers.ECX = m_Registers.ECX - m_Registers.ESI;
                    }
                    else if (l_CurrentByte == 0xC7)  // sub eax, edx
                    {
                        Trace(m_Memory.GetReadAddress(), "sub eax, edx");
                        m_Registers.EAX = m_Registers.EAX - m_Registers.EDX;
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// ADD
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x03) // add
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xC7)  // add eax, edi
                    {
                        Trace(m_Memory.GetReadAddress(), "add eax, edi");
                        m_Registers.EAX = m_Registers.EAX + m_Registers.EDI;
                    }
                    else if (l_CurrentByte == 0xCE)  // add ecx, esi
                    {
                        Trace(m_Memory.GetReadAddress(), "add ecx, esi");
                        m_Registers.ECX = m_Registers.ECX + m_Registers.ESI;
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// IMUL
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0x0F) // imul
                {
                    l_CurrentByte = m_Memory.ReadByte();
 
                    if (l_CurrentByte == 0xAF)  // imul eax, 
                    {
                        l_CurrentByte = m_Memory.ReadByte();
 
                        if (l_CurrentByte == 0xC1)  // imul eax, ecx
                        {
                            Trace(m_Memory.GetReadAddress(), "imul eax, ecx");
                            m_Registers.EAX = m_Registers.EAX * m_Registers.ECX;
                        }
                    }
                    else
                        l_Error = true;
                }
                //////////////////////////////////////////////////////////////////////////
                /// RETN
                //////////////////////////////////////////////////////////////////////////
                else if (l_CurrentByte == 0xC3 && p_MaxAddress == 0) // retn
                {
                    Trace(m_Memory.GetReadAddress(), "retn");
                    return 1;
                }
                else
                    l_Error = true;
 
                if (l_Error)
                {
                    System.Console.WriteLine("[VX86CPU] Instruction 0x{0} at 0x{1} not hanled " + p_MaxAddress.ToString("X8"), l_CurrentByte.ToString("X2"), (m_Memory.GetReadAddress() - 1).ToString("X8"));
                    return 0;
                }
 
            } while ((p_MaxAddress == 0 ? l_CurrentByte != 0xC3 /* retn */ : m_Memory.GetReadAddress() < p_MaxAddress));
 
            return 1;
        }
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        #region ROR
        /// <summary>
        /// ROR
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public ulong Ror(ulong p_Value)
        {
            return ((p_Value & 1) << 63) | (p_Value >> 1);
        }
        /// <summary>
        /// ROR
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public uint Ror(uint p_Value)
        {
            return ((p_Value & 1) << 31) | (p_Value >> 1);
        }
        /// <summary>
        /// ROR
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public ushort Ror(ushort p_Value)
        {
            return (ushort)(((p_Value & 1) << 15) | (p_Value >> 1));
        }
        /// <summary>
        /// ROR
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public byte Ror(byte p_Value)
        {
            return (byte)(((p_Value & 1) << 7) | (p_Value >> 1));
        }
        #endregion
 
        #region ROL
        /// <summary>
        /// ROL
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public ulong Rol(ulong p_Value)
        {
            return ((p_Value & 0x8000000000000000) >> 63) | (p_Value << 1);
        }
        /// <summary>
        /// ROL
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public uint Rol(uint p_Value)
        {
            return ((p_Value & 0x80000000) >> 31) | (p_Value << 1);
        }
        /// <summary>
        /// ROL
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public ushort Rol(ushort p_Value)
        {
            return (ushort)(((p_Value & 0x8000) >> 15) | (p_Value << 1));
        }
        /// <summary>
        /// ROL
        /// </summary>
        /// <param name="p_Value"></param>
        /// <returns></returns>
        public byte Rol(byte p_Value)
        {
            return (byte)(((p_Value & 0x80) >> 7) | (p_Value << 1));
        }
        #endregion ROL
 
        //////////////////////////////////////////////////////////////////////////
        //////////////////////////////////////////////////////////////////////////
 
        #region Data
        /// <summary>
        /// Cpu registers
        /// </summary>
        private VX86Registers m_Registers = null;
        /// <summary>
        /// CPU Memory
        /// </summary>
        private VX86Memory m_Memory = null;
        /// <summary>
        /// Is tracing
        /// </summary>
        private bool Tracing = false;
        #endregion
    }
}

Probleme emulateur asm x86 en c#

x86 32-bits / 64-bits Assembleur

Discussions similaires

Partager

Partager