From 90e4e5cf16aa152c6f841cb53f6154058a8cfb20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=A4rkl?= Date: Fri, 21 Jan 2022 09:22:34 +0100 Subject: [PATCH] [RzIL] Fix rti and stack behavior in 6502 IL Detected with rz-tracetest --- librz/asm/arch/6502/6502_il.inc | 10 +++++----- test/db/asm/6502 | 16 ++++++++-------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/librz/asm/arch/6502/6502_il.inc b/librz/asm/arch/6502/6502_il.inc index eb9349ed5a..3b5f029b8f 100644 --- a/librz/asm/arch/6502/6502_il.inc +++ b/librz/asm/arch/6502/6502_il.inc @@ -128,14 +128,14 @@ static RzILOpEffect *status_byte_apply(RzILOpBitVector *sb) { static RzILOpEffect *stack_push(RzILOpBitVector *v) { return SEQ2( - SETG("sp", SUB(VARG("sp"), U8(1))), - STORE(APPEND(U8(1), VARG("sp")), v)); + STORE(APPEND(U8(1), VARG("sp")), v), + SETG("sp", SUB(VARG("sp"), U8(1)))); } static RzILOpEffect *stack_pop(const char *varname) { return SEQ2( - SETL(varname, LOAD(APPEND(U8(1), VARG("sp")))), - SETG("sp", ADD(VARG("sp"), U8(1)))); + SETG("sp", ADD(VARG("sp"), U8(1))), + SETL(varname, LOAD(APPEND(U8(1), VARG("sp"))))); } /////////////////////////////////////////////////////////////////////////////// @@ -399,7 +399,7 @@ static RzILOpEffect *_6502_il_op_jsr(ut16 target, ut64 offset) { * rti */ static RzILOpEffect *_6502_il_op_rti() { - return SEQ(3, + return SEQ(5, stack_pop("sr"), status_byte_apply(VARL("sr")), stack_pop("pcl"), diff --git a/test/db/asm/6502 b/test/db/asm/6502 index 4314a3a3de..57bfd06bf3 100644 --- a/test/db/asm/6502 +++ b/test/db/asm/6502 @@ -27,7 +27,7 @@ d "bit 0xcafe" 2cfeca 0x0 (seq (set tmp (load 0 (bv 16 0xcafe))) (seq (set N (ms d "bmi 0x02e4" 30d0 0x312 (branch (var N) (jmp (bv 16 0x2e4)) nop) d "bne 0x02e4" d0d0 0x312 (branch (! (var Z)) (jmp (bv 16 0x2e4)) nop) d "bpl 0x02e4" 10d0 0x312 (branch (! (var N)) (jmp (bv 16 0x2e4)) nop) -d "brk" 00 0x2040 (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x20))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20)))) (seq (set D false) (seq (set I true) (jmp (loadw 0 16 (bv 16 0xfffe)))))))) +d "brk" 00 0x2040 (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x20)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20))) (set sp (- (var sp) (bv 8 0x1)))) (seq (set D false) (seq (set I true) (jmp (loadw 0 16 (bv 16 0xfffe)))))))) d "bvc 0x02e4" 50d0 0x312 (branch (! (var V)) (jmp (bv 16 0x2e4)) nop) d "bvs 0x02e4" 70d0 0x312 (branch (var V) (jmp (bv 16 0x2e4)) nop) d "clc" 18 0x0 (set C false) @@ -70,7 +70,7 @@ d "inx" e8 0x0 (seq (set x (+ (var x) (bv 8 0x1))) (seq (set Z (is_zero (cast 8 d "iny" c8 0x0 (seq (set y (+ (var y) (bv 8 0x1))) (seq (set Z (is_zero (cast 8 false (var y)))) (set N (msb (cast 8 false (var y)))))) d "jmp 0xcafe" 4cfeca 0x0 (jmp (bv 16 0xcafe)) d "jmp (0xcafe)" 6cfeca 0x0 (jmp (loadw 0 16 (bv 16 0xcafe))) -d "jsr 0xcafe" 20feca 0x3240 (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x32))) (seq (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42))) (jmp (bv 16 0xcafe)))) +d "jsr 0xcafe" 20feca 0x3240 (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x32)) (set sp (- (var sp) (bv 8 0x1)))) (seq (seq (store 0 (append (bv 8 0x1) (var sp)) (bv 8 0x42)) (set sp (- (var sp) (bv 8 0x1)))) (jmp (bv 16 0xcafe)))) d "lda #0x42" a942 0x0 (seq (set a (bv 8 0x42)) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) d "lda 0x42" a542 0x0 (seq (set a (load 0 (bv 16 0x42))) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) d "lda 0x42,x" b542 0x0 (seq (set a (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) @@ -103,10 +103,10 @@ d "ora 0xcafe,x" 1dfeca 0x0 (seq (set a (| (var a) (load 0 (+ (bv 16 0xcafe) (ca d "ora 0xcafe,y" 19feca 0x0 (seq (set a (| (var a) (load 0 (+ (bv 16 0xcafe) (cast 16 false (var y)))))) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) d "ora (0x42,x)" 0142 0x0 (seq (set a (| (var a) (load 0 (append (load 0 (cast 16 false (+ (+ (bv 8 0x42) (var x)) (bv 8 0x1)))) (load 0 (cast 16 false (+ (bv 8 0x42) (var x)))))))) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) d "ora (0x42),y" 1142 0x0 (seq (set a (| (var a) (load 0 (+ (append (load 0 (cast 16 false (+ (bv 8 0x42) (bv 8 0x1)))) (load 0 (cast 16 false (bv 8 0x42)))) (cast 16 false (var y)))))) (seq (set Z (is_zero (var a))) (set N (msb (var a))))) -d "pha" 48 0x0 (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (var a))) -d "php" 08 0x0 (seq (set sp (- (var sp) (bv 8 0x1))) (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20)))) -d "pla" 68 0x0 (seq (seq (set tmp (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (set a (var tmp)) (seq (set Z (is_zero (var tmp))) (set N (msb (var tmp)))))) -d "plp" 28 0x0 (seq (seq (set tmp (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (set N (msb (var tmp))) (seq (set V (! (is_zero (& (var tmp) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var tmp) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var tmp) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var tmp) (bv 8 0x2))))) (set C (lsb (var tmp))))))))) +d "pha" 48 0x0 (seq (store 0 (append (bv 8 0x1) (var sp)) (var a)) (set sp (- (var sp) (bv 8 0x1)))) +d "php" 08 0x0 (seq (store 0 (append (bv 8 0x1) (var sp)) (| (| (ite (var N) (bv 8 0x80) (bv 8 0x0)) (| (ite (var V) (bv 8 0x40) (bv 8 0x0)) (| (ite (var D) (bv 8 0x8) (bv 8 0x0)) (| (ite (var I) (bv 8 0x4) (bv 8 0x0)) (| (ite (var Z) (bv 8 0x2) (bv 8 0x0)) (ite (var C) (bv 8 0x1) (bv 8 0x0))))))) (bv 8 0x20))) (set sp (- (var sp) (bv 8 0x1)))) +d "pla" 68 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set tmp (load 0 (append (bv 8 0x1) (var sp))))) (seq (set a (var tmp)) (seq (set Z (is_zero (var tmp))) (set N (msb (var tmp)))))) +d "plp" 28 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set tmp (load 0 (append (bv 8 0x1) (var sp))))) (seq (set N (msb (var tmp))) (seq (set V (! (is_zero (& (var tmp) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var tmp) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var tmp) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var tmp) (bv 8 0x2))))) (set C (lsb (var tmp))))))))) d "rol a" 2a 0x0 (seq (set tmp (var a)) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (set a (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) d "rol 0x42" 2642 0x0 (seq (set tmp (load 0 (bv 16 0x42))) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (store 0 (bv 16 0x42) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) d "rol 0x42,x" 3642 0x0 (seq (set tmp (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (| (<< (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x1) (bv 8 0x0)))) (seq (set C (msb (var tmp))) (seq (store 0 (cast 16 false (+ (bv 8 0x42) (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) @@ -117,8 +117,8 @@ d "ror 0x42" 6642 0x0 (seq (set tmp (load 0 (bv 16 0x42))) (seq (set res (| (>> d "ror 0x42,x" 7642 0x0 (seq (set tmp (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (cast 16 false (+ (bv 8 0x42) (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) d "ror 0xcafe" 6efeca 0x0 (seq (set tmp (load 0 (bv 16 0xcafe))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (bv 16 0xcafe) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) d "ror 0xcafe,x" 7efeca 0x0 (seq (set tmp (load 0 (+ (bv 16 0xcafe) (cast 16 false (var x))))) (seq (set res (| (>> (var tmp) (bv 3 0x1) false) (ite (var C) (bv 8 0x80) (bv 8 0x0)))) (seq (set C (lsb (var tmp))) (seq (store 0 (+ (bv 16 0xcafe) (cast 16 false (var x))) (var res)) (seq (set Z (is_zero (var res))) (set N (msb (var res)))))))) -d "rti" 40 0x0 (seq (seq (set sr (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (seq (set N (msb (var sr))) (seq (set V (! (is_zero (& (var sr) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var sr) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var sr) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var sr) (bv 8 0x2))))) (set C (lsb (var sr)))))))) (seq (set pcl (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))))) -d "rts" 60 0x0 (seq (seq (set pcl (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (seq (seq (set pch (load 0 (append (bv 8 0x1) (var sp)))) (set sp (+ (var sp) (bv 8 0x1)))) (jmp (+ (append (var pch) (var pcl)) (bv 16 0x1))))) +d "rti" 40 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set sr (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set N (msb (var sr))) (seq (set V (! (is_zero (& (var sr) (bv 8 0x40))))) (seq (set D (! (is_zero (& (var sr) (bv 8 0x8))))) (seq (set I (! (is_zero (& (var sr) (bv 8 0x4))))) (seq (set Z (! (is_zero (& (var sr) (bv 8 0x2))))) (set C (lsb (var sr)))))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pcl (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pch (load 0 (append (bv 8 0x1) (var sp))))) (jmp (append (var pch) (var pcl))))))) +d "rts" 60 0x0 (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pcl (load 0 (append (bv 8 0x1) (var sp))))) (seq (seq (set sp (+ (var sp) (bv 8 0x1))) (set pch (load 0 (append (bv 8 0x1) (var sp))))) (jmp (+ (append (var pch) (var pcl)) (bv 16 0x1))))) d "sbc #0x42" e942 0x0 (seq (set src (bv 8 0x42)) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8)))))))) d "sbc 0x42" e542 0x0 (seq (set src (load 0 (bv 16 0x42))) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8)))))))) d "sbc 0x42,x" f542 0x0 (seq (set src (load 0 (cast 16 false (+ (bv 8 0x42) (var x))))) (seq (set res (- (cast 9 false (var a)) (- (cast 9 false (var src)) (ite (var C) (bv 9 0x0) (bv 9 0x1))))) (seq (set C (! (msb (var res)))) (seq (set res8 (cast 8 false (var res))) (seq (seq (set Z (is_zero (var res8))) (set N (msb (var res8)))) (seq (set V (&& (^^ (msb (var a)) (msb (var res))) (^^ (msb (var a)) (msb (var src))))) (set a (var res8))))))))