Class: OneGadget::Emulators::AArch64

Inherits:
ArmFamily show all
Defined in:
lib/one_gadget/emulators/aarch64.rb

Overview

Emulator of aarch64.

Constant Summary

Constants inherited from ArmFamily

OneGadget::Emulators::ArmFamily::COMPARES, OneGadget::Emulators::ArmFamily::COND

Constants inherited from Processor

Processor::ADDRESS_TYPES, Processor::CLOBBERED, Processor::NULLABLE_REQUIREMENTS, Processor::POINTER_REQUIREMENTS, Processor::TERMINAL_CALL_RE

Constants included from Conditional

Conditional::COMPARE_OPS, Conditional::NEGATE, Conditional::RELATION

Instance Attribute Summary

Attributes inherited from Processor

#bp, #pc, #refused_line, #registers, #sp

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Processor

#address_deref0?, #bp_based_stack, #closed_fds, #constraint_key, #constraints, #drop_implied_nonzero, #drop_restated_null, #get_corresponding_stack, instruction_table, line_memo, #parse, #process, #reach_terminal_call, #render_constraint, #resolve_address, #setup_frame_pointer, #sp_based_stack, #terminal_call?

Methods included from Conditional

#branch_on_bit, #branch_on_compare, #branch_on_zero, #comparisons_on, #handle_compare, #mnemonic, #operand_str, #record_compare, #resolve_pending_branch, #satisfiable?, #value_str

Constructor Details

#initialize ⇒ AArch64

Instantiate a OneGadget::Emulators::AArch64 object.



13
14
15
16
17
18
19
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 13

def initialize
  super(OneGadget::ABI.aarch64, 'sp')
  # Constant registers
  %w[xzr wzr].each { |r| @registers[r] = 0 }
  @pc = 'pc'
  setup_frame_pointer('x29') # track argv/data staged off the frame pointer
end

Class Method Details

.bits ⇒ Object

AArch64 is 64-bit.



161
162
163
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 161

def bits
  64
end

Instance Method Details

#argument(idx) ⇒ Lambda, Integer

Return the argument value of calling a function.

Parameters:

  • idx (Integer) —

    The 0-based index of the argument.

Returns:

  • (Lambda, Integer) —

    The value held in register x<idx>, used for the +idx+-th argument.



69
70
71
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 69

def argument(idx)
  registers["x#{idx}"]
end

#instructions ⇒ Array<Instruction>

Supported instruction set.

Returns:



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 36

def instructions
  [
    Instruction.new('add', 3..4),
    Instruction.new('adrp', 2),
    Instruction.new('and', 3),
    Instruction.new('bic', 3),
    Instruction.new('bl', 1),
    Instruction.new('bti', 0..1),
    Instruction.new('dmb', 0..1),
    Instruction.new('dsb', 0..1),
    Instruction.new('eor', 3),
    Instruction.new('isb', 0..1),
    Instruction.new('ldr', 2..3),
    Instruction.new('ldrb', 2..3),
    Instruction.new('lsl', 3),
    Instruction.new('lsr', 3),
    Instruction.new('mov', 2),
    Instruction.new('mvn', 2),
    Instruction.new('nop', 0..1),
    Instruction.new('orr', 3),
    Instruction.new('stp', 3),
    Instruction.new('str', 2..3),
    Instruction.new('sub', 3..4)
  ]
end

#process!(cmd) ⇒ Object

See Also:



22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 22

def process!(cmd)
  resolve_pending_branch(cmd)
  cmd = cmd.gsub(/#-?(0x)?[0-9a-f]+/) { |v| v[1..] }
  mnem = mnemonic(cmd)
  return handle_compare(COMPARES[mnem], cmd) if COMPARES.key?(mnem)
  return handle_branch(mnem, cmd) != :fail if branch_mnem?(mnem)

  inst, args = parse(cmd)
  sym = :"inst_#{inst.inst}"
  __send__(sym, *args) != :fail
end