portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[RzIL] Fix rti and stack behavior in 6502 IL

Browse source 
Detected with rz-tracetest
This commit is contained in:
Florian Märkl 2022-01-21 09:22:34 +01:00 committed by GitHub
parent 6c0af1b9ca
commit 90e4e5cf16
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
librz/asm/arch/6502/6502_il.inc
View file

@ -128,14 +128,14 @@ static RzILOpEffect *status_byte_apply(RzILOpBitVector *sb) {
static RzILOpEffect *stack_push(RzILOpBitVector *v) {
return SEQ2(
SETG("sp", SUB(VARG("sp"), U8(1))),
STORE(APPEND(U8(1), VARG("sp")), v));
STORE(APPEND(U8(1), VARG("sp")), v),
SETG("sp", SUB(VARG("sp"), U8(1))));
}
static RzILOpEffect *stack_pop(const char *varname) {
return SEQ2(
SETL(varname, LOAD(APPEND(U8(1), VARG("sp")))),
SETG("sp", ADD(VARG("sp"), U8(1))));
SETG("sp", ADD(VARG("sp"), U8(1))),
SETL(varname, LOAD(APPEND(U8(1), VARG("sp")))));
}
///////////////////////////////////////////////////////////////////////////////
@ -399,7 +399,7 @@ static RzILOpEffect *_6502_il_op_jsr(ut16 target, ut64 offset) {
* rti
*/
static RzILOpEffect *_6502_il_op_rti() {
return SEQ(3,
return SEQ(5,
stack_pop("sr"),
status_byte_apply(VARL("sr")),
stack_pop("pcl"),

16
test/db/asm/6502
View file

@ -27,7 +27,7 @@ d "bit 0xcafe" 2cfeca 0x0 (seq (set tmp (load 0 (bv 16 0xcafe))) (seq (set N (ms
d "bmi 0x02e4" 30d0 0x312 (branch (var N) (jmp (bv 16 0x2e4)) nop)
d "bne 0x02e4" d0d0 0x312 (branch (! (var Z)) (jmp (bv 16 0x2e4)) nop)
d "bpl 0x02e4" 10d0 0x312 (branch (! (var N)) (jmp (bv 16 0x2e4)) nop)
d "brk" 00 0x2040 (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x20))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20)))) (seq (set D false) (seq (set I true) (jmp (loadw 0 16 (bv 16 0xfffe))))))))
d "brk" 00 0x2040 (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x20)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20))) (set sp (- (var sp) (bv 8 0x1)))) (seq (set D false) (seq (set I true) (jmp (loadw 0 16 (bv 16 0xfffe))))))))
d "bvc 0x02e4" 50d0 0x312 (branch (! (var V)) (jmp (bv 16 0x2e4)) nop)
d "bvs 0x02e4" 70d0 0x312 (branch (var V) (jmp (bv 16 0x2e4)) nop)
d "clc" 18 0x0 (set C false)
@ -70,7 +70,7 @@ d "inx" e8 0x0 (seq (set x (+ (var x) (bv 8 0x1))) (seq (set Z (is_zero (cast 8
d "iny" c8 0x0 (seq (set y (+ (var y) (bv 8 0x1))) (seq (set Z (is_zero (cast 8 false (var y)))) (set N (msb (cast 8 false (var y))))))
d "jmp 0xcafe" 4cfeca 0x0 (jmp (bv 16 0xcafe))
d "jmp (0xcafe)" 6cfeca 0x0 (jmp (loadw 0 16 (bv 16 0xcafe)))
d "jsr 0xcafe" 20feca 0x3240 (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x32))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42))) (jmp (bv 16 0xcafe))))
d "jsr 0xcafe" 20feca 0x3240 (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x32)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42)) (set sp (- (var sp) (bv 8 0x1)))) (jmp (bv 16 0xcafe))))
d "lda #0x42" a942 0x0 (seq (set a (bv 8 0x42)) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
d "lda 0x42" a542 0x0 (seq (set a (load 0 (bv 16 0x42))) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
d "lda 0x42,x" b542 0x0 (seq (set a (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
@ -103,10 +103,10 @@ d "ora 0xcafe,x" 1dfeca 0x0 (seq (set a (| (var a) (load 0 (+ (bv 16 0xcafe) (ca
d "ora 0xcafe,y" 19feca 0x0 (seq (set a (| (var a) (load 0 (+ (bv 16 0xcafe) (cast 16 false (var y)))))) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
d "ora (0x42,x)" 0142 0x0 (seq (set a (| (var a) (load 0 (append (load 0 (cast 16 false (+ (+ (bv 8 0x42) (var x)) (bv 8 0x1)))) (load 0 (cast 16 false (+ (bv 8 0x42) (var x)))))))) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
d "ora (0x42),y" 1142 0x0 (seq (set a (| (var a) (load 0 (+ (append (load 0 (cast 16 false (+ (bv 8 0x42) (bv 8 0x1)))) (load 0 (cast 16 false (bv 8 0x42)))) (cast 16 false (var y)))))) (seq (set Z (is_zero (var a))) (set N (msb (var a)))))
d "pha" 48 0x0 (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (var a)))
d "php" 08 0x0 (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20))))
d "pla" 68 0x0 (seq (seq (set tmp (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (set a (var tmp)) (seq (set Z (is_zero (var tmp))) (set N (msb (var tmp))))))
d "plp" 28 0x0 (seq (seq (set tmp (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (set N (msb (var tmp))) (seq (set V (! (is_zero (& (var tmp) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var tmp) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var tmp) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var tmp) (bv 8 0x2))))) (set C (lsb (var tmp)))))))))
d "pha" 48 0x0 (seq (store 0 (append (bv 8 0x1) (var sp)) (var a)) (set sp (- (var sp) (bv 8 0x1))))
d "php" 08 0x0 (seq (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20))) (set sp (- (var sp) (bv 8 0x1))))
d "pla" 68 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set tmp (load 0 (append (bv 8 0x1) (var sp))))) (seq (set a (var tmp)) (seq (set Z (is_zero (var tmp))) (set N (msb (var tmp))))))
d "plp" 28 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set tmp (load 0 (append (bv 8 0x1) (var sp))))) (seq (set N (msb (var tmp))) (seq (set V (! (is_zero (& (var tmp) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var tmp) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var tmp) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var tmp) (bv 8 0x2))))) (set C (lsb (var tmp)))))))))
d "rol a" 2a 0x0 (seq (set tmp (var a)) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (set a (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
d "rol 0x42" 2642 0x0 (seq (set tmp (load 0 (bv 16 0x42))) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (store 0 (bv 16 0x42) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
d "rol 0x42,x" 3642 0x0 (seq (set tmp (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (store 0 (cast 16 false (+ (bv 8 0x42) (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
@ -117,8 +117,8 @@ d "ror 0x42" 6642 0x0 (seq (set tmp (load 0 (bv 16 0x42))) (seq (set res (| (>>
d "ror 0x42,x" 7642 0x0 (seq (set tmp (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (cast 16 false (+ (bv 8 0x42) (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
d "ror 0xcafe" 6efeca 0x0 (seq (set tmp (load 0 (bv 16 0xcafe))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (bv 16 0xcafe) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
d "ror 0xcafe,x" 7efeca 0x0 (seq (set tmp (load 0 (+ (bv 16 0xcafe) (cast 16 false (var x))))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (+ (bv 16 0xcafe) (cast 16 false (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res))))))))
d "rti" 40 0x0 (seq (seq (set sr (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (seq (set N (msb (var sr))) (seq (set V (! (is_zero (& (var sr) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var sr) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var sr) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var sr) (bv 8 0x2))))) (set C (lsb (var sr)))))))) (seq (set pcl (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1))))))
d "rts" 60 0x0 (seq (seq (set pcl (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (seq (set pch (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (jmp (+ (append (var pch) (var pcl)) (bv 16 0x1)))))
d "rti" 40 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set sr (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set N (msb (var sr))) (seq (set V (! (is_zero (& (var sr) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var sr) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var sr) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var sr) (bv 8 0x2))))) (set C (lsb (var sr)))))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pcl (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pch (load 0 (append (bv 8 0x1) (var sp))))) (jmp (append (var pch) (var pcl)))))))
d "rts" 60 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pcl (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pch (load 0 (append (bv 8 0x1) (var sp))))) (jmp (+ (append (var pch) (var pcl)) (bv 16 0x1)))))
d "sbc #0x42" e942 0x0 (seq (set src (bv 8 0x42)) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8))))))))
d "sbc 0x42" e542 0x0 (seq (set src (load 0 (bv 16 0x42))) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8))))))))
d "sbc 0x42,x" f542 0x0 (seq (set src (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8))))))))