132 lines
4.5 KiB
C
132 lines
4.5 KiB
C
/***************************************************************************************************
|
|
|
|
Zyan Disassembler Library (Zydis)
|
|
|
|
Original Author : Joel Hoener
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in all
|
|
* copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
|
|
***************************************************************************************************/
|
|
|
|
/**
|
|
* @file
|
|
*
|
|
* Example on assembling a basic function returning `0x1337` in `rax`.
|
|
*/
|
|
|
|
#include <Zydis/Zydis.h>
|
|
#include <Zycore/LibC.h>
|
|
#include <Zycore/API/Memory.h>
|
|
|
|
#include <inttypes.h>
|
|
|
|
/* ============================================================================================== */
|
|
/* Entry point */
|
|
/* ============================================================================================== */
|
|
|
|
static void ExpectSuccess(ZyanStatus status)
|
|
{
|
|
if (ZYAN_FAILED(status))
|
|
{
|
|
fprintf(stderr, "Something failed: 0x%08X\n", status);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
static void AppendInstruction(const ZydisEncoderRequest* req, ZyanU8** buffer,
|
|
ZyanUSize* buffer_length)
|
|
{
|
|
assert(req);
|
|
assert(buffer);
|
|
assert(buffer_length);
|
|
|
|
ZyanUSize instr_length = *buffer_length;
|
|
ExpectSuccess(ZydisEncoderEncodeInstruction(req, *buffer, &instr_length));
|
|
*buffer += instr_length;
|
|
*buffer_length -= instr_length;
|
|
}
|
|
|
|
static ZyanUSize AssembleCode(ZyanU8* buffer, ZyanUSize buffer_length)
|
|
{
|
|
assert(buffer);
|
|
assert(buffer_length);
|
|
|
|
ZyanU8* write_ptr = buffer;
|
|
ZyanUSize remaining_length = buffer_length;
|
|
|
|
// Assemble `mov rax, 0x1337`.
|
|
ZydisEncoderRequest req;
|
|
memset(&req, 0, sizeof(req));
|
|
req.mnemonic = ZYDIS_MNEMONIC_MOV;
|
|
req.machine_mode = ZYDIS_MACHINE_MODE_LONG_64;
|
|
req.operand_count = 2;
|
|
req.operands[0].type = ZYDIS_OPERAND_TYPE_REGISTER;
|
|
req.operands[0].reg.value = ZYDIS_REGISTER_RAX;
|
|
req.operands[1].type = ZYDIS_OPERAND_TYPE_IMMEDIATE;
|
|
req.operands[1].imm.u = 0x1337;
|
|
AppendInstruction(&req, &write_ptr, &remaining_length);
|
|
|
|
// Assemble `ret`.
|
|
memset(&req, 0, sizeof(req));
|
|
req.mnemonic = ZYDIS_MNEMONIC_RET;
|
|
req.machine_mode = ZYDIS_MACHINE_MODE_LONG_64;
|
|
AppendInstruction(&req, &write_ptr, &remaining_length);
|
|
|
|
return buffer_length - remaining_length;
|
|
}
|
|
|
|
int main(void)
|
|
{
|
|
// Allocate 2 pages of memory. We won't need nearly as much, but it simplifies
|
|
// re-protecting the memory to RWX later.
|
|
const ZyanUSize page_size = 0x1000;
|
|
const ZyanUSize alloc_size = page_size * 2;
|
|
ZyanU8* buffer = malloc(alloc_size);
|
|
|
|
// Assemble our function.
|
|
const ZyanUSize length = AssembleCode(buffer, alloc_size);
|
|
|
|
// Print a hex-dump of the assembled code.
|
|
puts("Created byte-code:");
|
|
for (ZyanUSize i = 0; i < length; ++i)
|
|
{
|
|
printf("%02X ", buffer[i]);
|
|
}
|
|
puts("");
|
|
|
|
#ifdef ZYAN_X64
|
|
|
|
// Align pointer to typical page size.
|
|
void* aligned = (void*)((ZyanUPointer)buffer & ~(page_size-1));
|
|
|
|
// Re-protect the heap region as RWX. Don't do this at home, kids!
|
|
ExpectSuccess(ZyanMemoryVirtualProtect(aligned, alloc_size, ZYAN_PAGE_EXECUTE_READWRITE));
|
|
|
|
// Create a function pointer for our buffer.
|
|
typedef ZyanU64(*FnPtr)();
|
|
const FnPtr func_ptr = (FnPtr)(uintptr_t)buffer;
|
|
|
|
// Call the function!
|
|
const ZyanU64 result = func_ptr();
|
|
printf("Return value of JITed code: 0x%016" PRIx64 "\n", result);
|
|
|
|
#endif
|
|
}
|
|
|
|
/* ============================================================================================== */
|