53bf5c497f
- Add LICENSES directory - Download additional licenses used - Add .reuse directory - Add doc about SPDX/reuse Co-authored-by: Florian Märkl <info@florianmaerkl.de>
1158 lines
34 KiB
C
1158 lines
34 KiB
C
// SPDX-FileCopyrightText: 2012-2016 pancake <pancake@nopcode.org>
|
|
// SPDX-License-Identifier: LGPL-3.0-only
|
|
|
|
#include <string.h>
|
|
#include <rz_types.h>
|
|
#include <rz_lib.h>
|
|
#include <rz_asm.h>
|
|
#include <rz_analysis.h>
|
|
|
|
#define ARC_REG_ILINK1 0x1d
|
|
#define ARC_REG_ILINK2 0x1e
|
|
#define ARC_REG_BLINK 0x1f
|
|
#define ARC_REG_LIMM 0x3e
|
|
#define ARC_REG_PCL 0x3f
|
|
|
|
/* the CPU fields that we decode get stored in this struct */
|
|
typedef struct arc_fields_t {
|
|
ut8 opcode; /* major opcode */
|
|
ut8 subopcode; /* sub opcode */
|
|
ut8 format; /* operand format */
|
|
ut8 format2;
|
|
ut8 cond;
|
|
ut16 a; /* destination register */
|
|
ut16 b; /* source/destination register */
|
|
ut16 c; /* source/destintaion register */
|
|
ut8 mode_aa;
|
|
ut8 mode_zz;
|
|
ut8 mode_m;
|
|
ut8 mode_n; /* Delay slot flag */
|
|
st64 imm; /* data stored in the opcode */
|
|
st64 limm; /* data stored immediately following the opcode */
|
|
} arc_fields;
|
|
|
|
static void arccompact_dump_fields(ut64 addr, ut32 words[2], arc_fields *f) {
|
|
#if DEBUG
|
|
/* Quick and dirty debug print */
|
|
eprintf("DEBUG: 0x%04llx: %08x op=0x%x subop=0x%x format=0x%x fields.a=0x%x fields.b=0x%x fields.c=0x%x imm=%i limm=%lli\n",
|
|
addr, words[0], f->opcode, f->subopcode, f->format, f->a, f->b, f->c, f->imm, f->limm);
|
|
#endif
|
|
}
|
|
|
|
/* For (arguably valid) reasons, the ARCompact CPU uses "middle endian"
|
|
encoding on Little-Endian systems
|
|
*/
|
|
static inline ut32 rz_read_me32_arc(const void *src) {
|
|
const ut8 *s = src;
|
|
return (((ut32)s[1]) << 24) | (((ut32)s[0]) << 16) | (((ut32)s[3]) << 8) | (((ut32)s[2]) << 0);
|
|
}
|
|
|
|
static int sign_ext(int bits, int imm) {
|
|
int maxsint = (1 << (bits - 1)) - 1;
|
|
int maxuint = (1 << (bits)) - 1;
|
|
|
|
if (imm > maxsint) {
|
|
/* sign extend */
|
|
imm = -maxuint + imm - 1;
|
|
}
|
|
return imm;
|
|
}
|
|
|
|
#define SIGN_EXT_S7(imm) sign_ext(7, imm);
|
|
#define SIGN_EXT_S8(imm) sign_ext(8, imm);
|
|
#define SIGN_EXT_S9(imm) sign_ext(9, imm);
|
|
#define SIGN_EXT_S10(imm) sign_ext(10, imm);
|
|
#define SIGN_EXT_S12(imm) sign_ext(12, imm);
|
|
#define SIGN_EXT_S13(imm) sign_ext(13, imm);
|
|
#define SIGN_EXT_S21(imm) sign_ext(21, imm);
|
|
#define SIGN_EXT_S25(imm) sign_ext(25, imm);
|
|
|
|
static int map_cond2rizin(ut8 cond) {
|
|
switch (cond) {
|
|
case 0: return RZ_ANALYSIS_COND_AL;
|
|
case 1: return RZ_ANALYSIS_COND_EQ;
|
|
case 2: return RZ_ANALYSIS_COND_NE;
|
|
case 3: return RZ_ANALYSIS_COND_PL;
|
|
case 4: return RZ_ANALYSIS_COND_MI;
|
|
case 7: return RZ_ANALYSIS_COND_VS;
|
|
case 8: return RZ_ANALYSIS_COND_VC;
|
|
case 9: return RZ_ANALYSIS_COND_GT;
|
|
case 0xa: return RZ_ANALYSIS_COND_GE;
|
|
case 0xb: return RZ_ANALYSIS_COND_LT;
|
|
case 0xc: return RZ_ANALYSIS_COND_LE;
|
|
case 0xd: return RZ_ANALYSIS_COND_HI;
|
|
case 0xe: return RZ_ANALYSIS_COND_LS;
|
|
#if 0
|
|
/* TODO: */
|
|
/* - rizin defines RZ_ANALYSIS_COND_LO as carry clear and _HS as carry set */
|
|
/* which appears different to the ARC definitions. */
|
|
/* Need to do some math and double check the details */
|
|
case 5: return RZ_ANALYSIS_COND_?? - CS,C,LO - Carry set & LO
|
|
case 6: return RZ_ANALYSIS_COND_?? - CC,NC,HS - Carry clear & HS
|
|
/* - Positive non-zero doesnt map to any Radare cond code. Perhaps just add it? */
|
|
case 0xf: return RZ_ANALYSIS_COND_?? - PNZ - Positive non-zero
|
|
#endif
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
static void arcompact_jump(RzAnalysisOp *op, ut64 addr, ut64 jump, ut8 delay) {
|
|
op->jump = jump;
|
|
op->fail = addr + op->size;
|
|
op->delay = delay;
|
|
}
|
|
|
|
static void arcompact_jump_cond(RzAnalysisOp *op, ut64 addr, ut64 jump, ut8 delay, ut8 cond) {
|
|
arcompact_jump(op, addr, jump, delay);
|
|
op->cond = map_cond2rizin(cond);
|
|
}
|
|
|
|
static void arcompact_branch(RzAnalysisOp *op, ut64 addr, st64 offset, ut8 delay) {
|
|
arcompact_jump(op, addr, (addr & ~3) + offset, delay);
|
|
}
|
|
|
|
static void map_zz2refptr(RzAnalysisOp *op, ut8 mode_zz) {
|
|
switch (mode_zz) {
|
|
case 0: op->refptr = 4; break;
|
|
case 1: op->refptr = 1; break;
|
|
case 2: op->refptr = 2; break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
}
|
|
|
|
static int arcompact_genops_jmp(RzAnalysisOp *op, ut64 addr, arc_fields *f, ut64 basic_type) {
|
|
ut64 type_ujmp;
|
|
ut64 type_cjmp;
|
|
ut64 type_ucjmp;
|
|
|
|
switch (basic_type) {
|
|
case RZ_ANALYSIS_OP_TYPE_JMP:
|
|
type_ujmp = RZ_ANALYSIS_OP_TYPE_UJMP;
|
|
type_cjmp = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
type_ucjmp = RZ_ANALYSIS_OP_TYPE_UCJMP;
|
|
break;
|
|
case RZ_ANALYSIS_OP_TYPE_CALL:
|
|
type_ujmp = RZ_ANALYSIS_OP_TYPE_UCALL;
|
|
type_cjmp = RZ_ANALYSIS_OP_TYPE_CCALL;
|
|
type_ucjmp = RZ_ANALYSIS_OP_TYPE_UCCALL;
|
|
break;
|
|
default:
|
|
return -1; /* Should not happen */
|
|
}
|
|
|
|
f->cond = f->a & 0x1f;
|
|
|
|
switch (f->format) {
|
|
case 0: /* unconditional jumps via reg or long imm */
|
|
if (f->c == ARC_REG_LIMM) {
|
|
/* limm */
|
|
op->type = basic_type;
|
|
arcompact_jump(op, addr, f->limm, f->mode_n);
|
|
return op->size;
|
|
}
|
|
if (f->c == ARC_REG_ILINK1 || f->c == ARC_REG_ILINK2 || f->c == ARC_REG_BLINK) {
|
|
/* ilink1, ilink2, blink */
|
|
/* Note: not valid for basic_type == CALL */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_RET;
|
|
op->delay = f->mode_n;
|
|
return op->size;
|
|
}
|
|
op->type = type_ujmp;
|
|
return op->size;
|
|
case 1: /* unconditional jumps via u6 imm */
|
|
op->type = basic_type;
|
|
arcompact_jump(op, addr, f->c, f->mode_n);
|
|
return op->size;
|
|
case 2: /* unconditional jumps via s12 imm */
|
|
op->type = basic_type;
|
|
f->imm = (f->a << 6 | f->c);
|
|
f->imm = SIGN_EXT_S12(f->imm);
|
|
arcompact_jump(op, addr, f->imm, f->mode_n);
|
|
return op->size;
|
|
case 3: /* conditional jumps */
|
|
if (f->mode_m == 0) {
|
|
if (f->c == ARC_REG_LIMM) {
|
|
op->type = type_cjmp;
|
|
arcompact_jump_cond(op, addr, f->limm, f->mode_n, f->cond);
|
|
return op->size;
|
|
}
|
|
if (f->c == ARC_REG_ILINK1 || f->c == ARC_REG_ILINK2 || f->c == ARC_REG_BLINK) {
|
|
/* ilink1, ilink2, blink */
|
|
/* Note: not valid for basic_type == CALL */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CRET;
|
|
op->cond = map_cond2rizin(f->cond);
|
|
op->delay = f->mode_n;
|
|
return op->size;
|
|
}
|
|
|
|
op->cond = map_cond2rizin(f->cond);
|
|
op->type = type_ucjmp;
|
|
return op->size;
|
|
}
|
|
|
|
op->type = type_cjmp;
|
|
arcompact_jump_cond(op, addr, f->c, f->mode_n, f->cond);
|
|
return op->size;
|
|
}
|
|
|
|
/* should not be reached */
|
|
return 0;
|
|
}
|
|
|
|
static int arcompact_genops(RzAnalysisOp *op, ut64 addr, ut32 words[2]) {
|
|
arc_fields fields = { 0 };
|
|
|
|
fields.format = (words[0] & 0x00c00000) >> 22;
|
|
fields.subopcode = (words[0] & 0x003f0000) >> 16;
|
|
fields.c = (words[0] & 0x00000fc0) >> 6;
|
|
fields.a = (words[0] & 0x0000003f);
|
|
fields.b = (words[0] & 0x07000000) >> 24 | (words[0] & 0x7000) >> 9;
|
|
fields.mode_n = 0;
|
|
|
|
/* increase the size to cover any limm reg fields */
|
|
if (fields.b == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
/* FIXME: MOV<.f> 0,x is encoded as fields.b == ARC_REG_LIMM, but no limm */
|
|
} else if ((fields.format == 0 || fields.format == 1) && (fields.a == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
} else if ((fields.format == 0) && (fields.c == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
} else if ((fields.format == 3) && ((fields.a & 0x20) == 0x20) && (fields.c == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
}
|
|
|
|
if (fields.format == 1) {
|
|
/* REG_U6IMM */
|
|
fields.imm = fields.c;
|
|
} else if (fields.format == 2) {
|
|
/* REG_S12IMM */
|
|
fields.imm = SIGN_EXT_S12(fields.c | fields.a << 6);
|
|
}
|
|
|
|
switch (fields.subopcode) {
|
|
case 0x00: /* add */
|
|
if ((fields.format == 1 || fields.format == 2) && fields.b == ARC_REG_PCL) {
|
|
/* dst = PCL + src */
|
|
op->ptr = (addr & ~3) + fields.imm;
|
|
op->refptr = 1; /* HACK! we don't actually know what size it is */
|
|
}
|
|
case 0x01: /* add with carry */
|
|
case 0x14: /* add with left shift by 1 */
|
|
case 0x15: /* add with left shift by 2 */
|
|
case 0x16: /* add with left shift by 3 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 0x02: /* subtract */
|
|
case 0x03: /* subtract with carry */
|
|
case 0x0e: /* reverse subtract */
|
|
case 0x17: /* subtract with left shift by 1 */
|
|
case 0x18: /* subtract with left shift by 2 */
|
|
case 0x19: /* subtract with left shift by 3 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 0x04: /* logical bitwise AND */
|
|
case 0x06: /* logical bitwise AND with invert */
|
|
case 0x10: /* bit clear */
|
|
case 0x13: /* bit mask */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
case 0x05: /* logical bitwise OR */
|
|
case 0x0f: /* bit set */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_OR;
|
|
break;
|
|
case 0x07: /* logical bitwise exclusive-OR */
|
|
case 0x12: /* bit xor */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_XOR;
|
|
break;
|
|
case 0x08: /* larger of 2 signed integers */
|
|
case 0x09: /* smaller of 2 signed integers */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CMOV;
|
|
break;
|
|
case 0x0a: /* move */
|
|
if (fields.format == 2) {
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
op->val = SIGN_EXT_S12(fields.a << 6 | fields.c);
|
|
} else if (fields.format == 3) {
|
|
fields.cond = fields.a & 0x1f;
|
|
op->cond = map_cond2rizin(fields.cond);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CMOV;
|
|
if ((fields.a & 0x20)) {
|
|
/* its a move from imm u6 */
|
|
op->val = fields.c;
|
|
} else if (fields.c == ARC_REG_LIMM) {
|
|
/* its a move from limm */
|
|
op->val = fields.limm;
|
|
}
|
|
}
|
|
break;
|
|
case 0x0b: /* test */
|
|
case 0x0c: /* compare */
|
|
case 0x0d: /* reverse compare */
|
|
case 0x11: /* bit test */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
|
|
break;
|
|
case 0x1a: /* 32 X 32 signed multiply */
|
|
case 0x1b: /* 32 X 32 signed multiply */
|
|
case 0x1c: /* 32 X 32 unsigned multiply */
|
|
case 0x1d: /* 32 X 32 unsigned multiply */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MUL;
|
|
break;
|
|
case 0x21: /* Jump with delay slot */
|
|
fields.mode_n = 1;
|
|
/* fall through */
|
|
case 0x20: /* Jump */
|
|
fields.mode_m = (words[0] & 0x20) >> 5;
|
|
arcompact_genops_jmp(op, addr, &fields, RZ_ANALYSIS_OP_TYPE_JMP);
|
|
break;
|
|
case 0x23: /* jump and link with delay slot */
|
|
fields.mode_n = 1;
|
|
/* fall through */
|
|
case 0x22: /* jump and link */
|
|
fields.mode_m = (words[0] & 0x20) >> 5;
|
|
arcompact_genops_jmp(op, addr, &fields, RZ_ANALYSIS_OP_TYPE_CALL);
|
|
break;
|
|
case 0x1e: /* Reserved */
|
|
case 0x1f: /* Reserved */
|
|
case 0x24: /* Reserved */
|
|
case 0x25: /* Reserved */
|
|
case 0x26: /* Reserved */
|
|
case 0x27: /* Reserved */
|
|
case 0x2c: /* Reserved */
|
|
case 0x2d: /* Reserved */
|
|
case 0x2e: /* Reserved */
|
|
case 0x38: /* Reserved */
|
|
case 0x39: /* Reserved */
|
|
case 0x3a: /* Reserved */
|
|
case 0x3b: /* Reserved */
|
|
case 0x3c: /* Reserved */
|
|
case 0x3d: /* Reserved */
|
|
case 0x3e: /* Reserved */
|
|
case 0x3f: /* Reserved */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
case 0x28: /* loop (16-bit aligned target address) */
|
|
/* this is essentially a COME FROM instruction!! */
|
|
/* TODO: describe it to rizin better? */
|
|
switch (fields.format) {
|
|
case 2: /* Loop Set Up (Unconditional) */
|
|
fields.imm = SIGN_EXT_S13((fields.c | (fields.a << 6)) << 1);
|
|
op->jump = (addr & ~3) + fields.imm;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
op->fail = addr + op->size;
|
|
break;
|
|
case 3: /* Loop Set Up (Conditional) */
|
|
fields.imm = fields.c << 1;
|
|
fields.cond = fields.a & 0x1f;
|
|
op->cond = map_cond2rizin(fields.a & 0x1f);
|
|
op->jump = (addr & ~3) + fields.imm;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
op->fail = addr + op->size;
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
case 0x29: /* set status flags */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
break;
|
|
case 0x2a: /* load from auxiliary register. */
|
|
case 0x2b: /* store to auxiliary register. */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_IO;
|
|
break;
|
|
case 0x2f: /* Single Operand Instructions, 0x04, [0x2F, 0x00 - 0x3F] */
|
|
switch (fields.a) {
|
|
case 0: /* Arithmetic shift left by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAL;
|
|
break;
|
|
case 1: /* Arithmetic shift right by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAR;
|
|
break;
|
|
case 2: /* Logical shift right by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHR;
|
|
break;
|
|
case 3: /* Rotate right */
|
|
case 4: /* Rotate right through carry */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ROR;
|
|
break;
|
|
case 5: /* Sign extend byte */
|
|
case 6: /* Sign extend word */
|
|
case 7: /* Zero extend byte */
|
|
case 8: /* Zero extend word */
|
|
// op->type = RZ_ANALYSIS_OP_TYPE_UNK;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
/* TODO: a better encoding for SIGN and ZERO EXTEND instructions */
|
|
break;
|
|
case 9: /* Absolute */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ABS;
|
|
break;
|
|
case 0xa: /* Logical NOT */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NOT;
|
|
break;
|
|
case 0xb: /* Rotate left through carry */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ROL;
|
|
break;
|
|
case 0xc: /* Atomic Exchange */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_XCHG;
|
|
break;
|
|
case 0x3f: /* See Zero operand (ZOP) table */
|
|
switch (fields.b) {
|
|
case 1: /* Sleep */
|
|
/* TODO: a better encoding for this */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NULL;
|
|
break;
|
|
case 2: /* Software interrupt */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SWI;
|
|
break;
|
|
case 3: /* Wait for all data-based memory transactions to complete */
|
|
/* TODO: a better encoding for this */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NULL;
|
|
break;
|
|
case 4: /* Return from interrupt/exception */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_RET;
|
|
break;
|
|
case 5: /* Breakpoint instruction */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
case 0x30:
|
|
case 0x31:
|
|
case 0x32:
|
|
case 0x33:
|
|
case 0x34:
|
|
case 0x35:
|
|
case 0x36:
|
|
case 0x37: /* Load Register-Register, 0x04, [0x30 - 0x37] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
break;
|
|
}
|
|
|
|
arccompact_dump_fields(addr, words, &fields);
|
|
return op->size;
|
|
}
|
|
|
|
static int arcompact_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *data, int len) {
|
|
ut32 words[2]; /* storage for the de-swizled opcode data */
|
|
arc_fields fields;
|
|
|
|
/* ARCompact ISA, including */
|
|
/* ARCtangent-A5, ARC 600, ARC 700 */
|
|
|
|
/* no unaligned code */
|
|
if (addr % 2 != 0) {
|
|
/* this fixes some of the reverse disassembly issues */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
return 0;
|
|
}
|
|
if (len < 8) {
|
|
//when rz_read_me32_arc/be32 oob read
|
|
return 0;
|
|
}
|
|
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UNK;
|
|
op->ptr = UT64_MAX;
|
|
op->val = UT64_MAX;
|
|
op->jump = UT64_MAX;
|
|
op->fail = UT64_MAX;
|
|
op->refptr = 0;
|
|
op->delay = 0;
|
|
|
|
if (analysis->big_endian) {
|
|
words[0] = rz_read_be32(&data[0]);
|
|
words[1] = rz_read_be32(&data[4]);
|
|
} else {
|
|
words[0] = rz_read_me32_arc(&data[0]);
|
|
words[1] = rz_read_me32_arc(&data[4]);
|
|
}
|
|
|
|
fields.opcode = (words[0] & 0xf8000000) >> 27;
|
|
|
|
op->size = (fields.opcode >= 0x0c) ? 2 : 4;
|
|
op->nopcode = op->size;
|
|
// eprintf ("%x\n", fields.opcode);
|
|
|
|
switch (fields.opcode) {
|
|
case 0:
|
|
fields.format = (words[0] & 0x00010000) >> 16;
|
|
fields.a = (words[0] & 0x07fe0000) >> 17;
|
|
fields.b = (words[0] & 0x0000ffc0) >> 6;
|
|
fields.c = (words[0] & 0x0000000f);
|
|
fields.mode_n = (words[0] & 0x20) >> 5;
|
|
fields.limm = fields.a << 1 | fields.b << 11;
|
|
|
|
if (fields.format == 0) {
|
|
/* Branch Conditionally 0x00 [0x0] */
|
|
fields.limm = SIGN_EXT_S21(fields.limm);
|
|
fields.cond = (words[0] & 0x1f);
|
|
op->cond = map_cond2rizin(fields.cond);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
} else {
|
|
/* Branch Unconditional Far 0x00 [0x1] */
|
|
fields.limm |= (fields.c & 0x0f) << 21;
|
|
/* the & 0xf clearly shows we don't overflow */
|
|
/* TODO: don't generate code to show this */
|
|
fields.limm = SIGN_EXT_S25(fields.limm);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_JMP;
|
|
}
|
|
arcompact_branch(op, addr, fields.limm, fields.mode_n);
|
|
break;
|
|
case 1:
|
|
fields.format = (words[0] & 0x00010000) >> 16;
|
|
fields.mode_n = (words[0] & 0x20) >> 5;
|
|
|
|
if (fields.format == 1) {
|
|
fields.format2 = (words[0] & 0x10) >> 4;
|
|
fields.subopcode = (words[0] & 0x0f);
|
|
fields.b = (words[0] & 0x07000000) >> 24 | (words[0] & 0x7000) >> 9;
|
|
fields.c = (words[0] & 0x00000fc0) >> 6;
|
|
fields.imm = SIGN_EXT_S9((words[0] & 0x00fe0000) >> 16 | (words[0] & 0x8000) >> 7);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
|
|
if (fields.format2 == 0) {
|
|
/* Branch on Compare Register-Register, 0x01, [0x1, 0x0] */
|
|
if (fields.b == ARC_REG_LIMM || fields.c == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
}
|
|
/* TODO: cond codes (using the "br" mapping) */
|
|
} else {
|
|
/* Branch on Compare/Bit Test Register-Immediate, 0x01, [0x1, 0x1] */
|
|
/* TODO: cond codes and imm u6 (using the "br" mapping) */
|
|
}
|
|
arcompact_branch(op, addr, fields.imm, fields.mode_n);
|
|
} else {
|
|
fields.format2 = (words[0] & 0x00020000) >> 17;
|
|
fields.a = (words[0] & 0x07fc0000) >> 18;
|
|
fields.b = (words[0] & 0x0000ffc0) >> 6;
|
|
fields.c = (words[0] & 0x0000000f);
|
|
fields.imm = fields.a << 2 | fields.b << 11;
|
|
|
|
if (fields.format2 == 0) {
|
|
/* Branch and Link Conditionally, 0x01, [0x0, 0x0] */
|
|
fields.imm = SIGN_EXT_S21(fields.imm);
|
|
fields.cond = (words[0] & 0x1f);
|
|
op->cond = map_cond2rizin(fields.cond);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CCALL;
|
|
} else {
|
|
/* Branch and Link Unconditional Far, 0x01, [0x0, 0x1] */
|
|
fields.imm |= (fields.c & 0x0f) << 21;
|
|
/* the & 0xf clearly shows we don't overflow */
|
|
/* TODO: don't generate code to show this */
|
|
fields.imm = SIGN_EXT_S25(fields.imm);
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CALL;
|
|
}
|
|
arcompact_branch(op, addr, fields.imm, fields.mode_n);
|
|
}
|
|
break;
|
|
case 2: /* Load Register with Offset, 0x02 */
|
|
fields.a = (words[0] & 0x0000003f);
|
|
fields.b = (words[0] & 0x07000000) >> 24 | (words[0] & 0x7000) >> 9;
|
|
fields.imm = SIGN_EXT_S9((words[0] & 0x00ff0000) >> 16 | (words[0] & 0x8000) >> 7);
|
|
/* fields.mode_aa = (words[0] & 0x600) >> 9; */
|
|
fields.mode_zz = (words[0] & 0x180) >> 7;
|
|
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
|
|
/* dst (fields.a) cannot be an extension core register */
|
|
if (fields.a == ARC_REG_PCL || fields.a == 61 || (fields.a >= 0x20 && fields.a <= 0x2b)) {
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
}
|
|
|
|
map_zz2refptr(op, fields.mode_zz);
|
|
|
|
if (fields.b == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
op->ptr = fields.limm + fields.imm;
|
|
/* fields.aa is reserved - and ignored with limm */
|
|
} else if (fields.b == ARC_REG_PCL) { /* PCL */
|
|
op->ptr = (addr & ~3) + fields.imm;
|
|
}
|
|
/* TODO: set op with GP,FP,SP src/dst details */
|
|
break;
|
|
case 3: /* Store Register with Offset, 0x03 */
|
|
fields.c = (words[0] & 0xfc0) >> 6;
|
|
fields.b = (words[0] & 0x07000000) >> 24 | (words[0] & 0x7000) >> 9;
|
|
fields.imm = SIGN_EXT_S9((words[0] & 0x00ff0000) >> 16 | (words[0] & 0x8000) >> 7);
|
|
/* ut8 mode_aa = (words[0] & 0x18) >> 3; */
|
|
fields.mode_zz = (words[0] & 0x6) >> 1;
|
|
|
|
op->type = RZ_ANALYSIS_OP_TYPE_STORE;
|
|
|
|
map_zz2refptr(op, fields.mode_zz);
|
|
|
|
if (fields.b == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
op->ptr = fields.limm;
|
|
} else if (fields.c == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
op->val = fields.limm;
|
|
}
|
|
|
|
if (fields.b == ARC_REG_PCL) { /* PCL */
|
|
op->ptr = (addr & ~3) + fields.imm;
|
|
}
|
|
/* TODO: set op with GP,FP,SP src/dst details */
|
|
break;
|
|
case 4: /* General Operations */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
return arcompact_genops(op, addr, words);
|
|
case 5:
|
|
case 6:
|
|
case 7:
|
|
case 8: /* 32-bit Extension Instructions, 0x05 - 0x08 */
|
|
fields.subopcode = (words[0] & 0x003f0000) >> 16;
|
|
fields.format = (words[0] & 0x00c00000) >> 22;
|
|
fields.c = (words[0] & 0x00000fc0) >> 6;
|
|
fields.a = (words[0] & 0x0000003f);
|
|
fields.b = (words[0] & 0x07000000) >> 24 | (words[0] & 0x7000) >> 9;
|
|
|
|
if (fields.b == ARC_REG_LIMM) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
} else if ((fields.format == 0 || fields.format == 1) && (fields.a == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
} else if ((fields.format == 0) && (fields.c == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
} else if ((fields.format == 3) && ((fields.a & 0x20) == 0x20) && (fields.c == ARC_REG_LIMM)) {
|
|
op->size = 8;
|
|
fields.limm = words[1];
|
|
}
|
|
/* TODO: fill in the extansion functions */
|
|
// op->type = RZ_ANALYSIS_OP_TYPE_UNK;
|
|
// op->type = RZ_ANALYSIS_OP_TYPE_SHL;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHR;
|
|
break;
|
|
case 0x09:
|
|
case 0x0a:
|
|
case 0x0b: /* Market Specific Extension Instructions, 0x09 - 0x0B */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UNK;
|
|
break;
|
|
case 0x0c: /* Load /Add Register-Register, 0x0C, [0x00 - 0x03] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
fields.subopcode = (words[0] & 0x00180000) >> 19;
|
|
/* fields.a = (words[0] & 0x00070000) >> 16; */
|
|
/* fields.c = (words[0] & 0x00e00000) >> 21; */
|
|
/* fields.b = (words[0] & 0x07000000) >> 24; */
|
|
|
|
switch (fields.subopcode) {
|
|
case 0: /* Load long word (reg.+reg.) */
|
|
case 1: /* Load unsigned byte (reg.+reg.) */
|
|
case 2: /* Load unsigned word (reg.+reg.) */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
break;
|
|
case 3: /* Add */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
}
|
|
break;
|
|
case 0x0d: /* Add/Sub/Shift Register-Immediate, 0x0D, [0x00 - 0x03] */
|
|
fields.subopcode = (words[0] & 0x00180000) >> 19;
|
|
/* fields.imm = (words[0] & 0x00070000) >> 16; src2 u3 */
|
|
/* fields.c = (words[0] & 0x00e00000) >> 21; dst */
|
|
/* fields.b = (words[0] & 0x07000000) >> 24; src1 */
|
|
|
|
switch (fields.subopcode) {
|
|
case 0: /* Add */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 1: /* Subtract */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 2: /* Multiple arithmetic shift left */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHL;
|
|
break;
|
|
case 3: /* Multiple arithmetic shift right */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHR;
|
|
break;
|
|
}
|
|
break;
|
|
case 0x0e: /* Mov/Cmp/Add with High Register, 0x0E, [0x00 - 0x03] */
|
|
fields.subopcode = (words[0] & 0x00180000) >> 19;
|
|
/* fields.b = (words[0] & 0x07000000) >> 24; dst, src1 */
|
|
fields.c = (words[0] & 0x00e00000) >> 21 | (words[0] & 0x00070000) >> 13; /* src2 */
|
|
|
|
if (fields.c == ARC_REG_LIMM) {
|
|
op->size = 6;
|
|
op->val = (words[0] & 0x0000ffff) << 16 | (words[1] & 0xffff0000) >> 16;
|
|
}
|
|
|
|
switch (fields.subopcode) {
|
|
case 0: /* Add */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 1: /* Move */
|
|
case 3: /* Move */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
break;
|
|
case 2: /* Compare */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
|
|
break;
|
|
}
|
|
break;
|
|
case 0xf: /* General Register Format Instructions, 0x0F, [0x00 - 0x1F] */
|
|
fields.subopcode = (words[0] & 0x001f0000) >> 16;
|
|
fields.c = (words[0] & 0x00e00000) >> (16 + 5);
|
|
fields.b = (words[0] & 0x07000000) >> (16 + 8);
|
|
|
|
switch (fields.subopcode) {
|
|
case 0: /* Single Operand, Jumps and Special Format Instructions, 0x0F, [0x00, 0x00 - 0x07] */
|
|
switch (fields.c) {
|
|
case 0: /* J_S [r]*/
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UJMP;
|
|
arcompact_jump(op, 0, 0, 0);
|
|
break;
|
|
case 1: /* J_S.D [r] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UJMP;
|
|
arcompact_jump(op, 0, 0, 1);
|
|
break;
|
|
case 2: /* JL_S [r] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UCALL;
|
|
arcompact_jump(op, 0, 0, 0);
|
|
break;
|
|
case 3: /* JL_S.D [r] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UCALL;
|
|
arcompact_jump(op, 0, 0, 1);
|
|
break;
|
|
case 4:
|
|
case 5: /* Reserved - instruction error */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
case 6: /* SUB_S.NE [b] */
|
|
op->cond = RZ_ANALYSIS_COND_NE;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 7: /* Zero Operand Instructions, 0x0F, [0x00, 0x07, 0x00 - 0x07] */
|
|
switch (fields.b) {
|
|
case 0: /* nop_s */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
|
|
op->size = 4;
|
|
break;
|
|
case 1:
|
|
case 2:
|
|
case 3: /* unimplemented and Reserved - instruction error */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
case 4: /* JEQ_S [blink] */
|
|
op->cond = RZ_ANALYSIS_COND_EQ;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CRET;
|
|
break;
|
|
case 5: /* JNE_S [blink] */
|
|
op->cond = RZ_ANALYSIS_COND_NE;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CRET;
|
|
break;
|
|
case 7: /* J_S.D [blink] */
|
|
op->delay = 1;
|
|
/* fall through */
|
|
case 6: /* J_S [blink] */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_RET;
|
|
break;
|
|
}
|
|
break;
|
|
}
|
|
break;
|
|
case 1:
|
|
case 3:
|
|
case 8:
|
|
case 9:
|
|
case 0xa:
|
|
case 0x17: /* Reserved - instruction error */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
case 2:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 4:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
case 5:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_OR;
|
|
break;
|
|
case 6: /* Logical bitwise AND with invert */
|
|
/* dest = src1 AND NOT src2 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
case 7:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_XOR;
|
|
break;
|
|
case 0xb: /* Test */
|
|
/* no dst, b AND c */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
case 0xc:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MUL;
|
|
break;
|
|
case 0xd: /* Sign extend byte */
|
|
case 0xe: /* Sign extend word */
|
|
case 0xf: /* Zero extend byte */
|
|
case 0x10: /* Zero extend word */
|
|
case 0x13: /* Negate */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CPL;
|
|
break;
|
|
case 0x11:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ABS;
|
|
break;
|
|
case 0x12:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NOT;
|
|
break;
|
|
case 0x14: /* Add with left shift by 1 */
|
|
case 0x15: /* Add with left shift by 2 */
|
|
case 0x16: /* Add with left shift by 3 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 0x18: /* Multiple arithmetic shift left */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAL;
|
|
break;
|
|
case 0x19: /* Multiple logical shift right */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHR;
|
|
break;
|
|
case 0x1a: /* Multiple arithmetic shift right */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAR;
|
|
break;
|
|
case 0x1b: /* Arithmetic shift left by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAL;
|
|
break;
|
|
case 0x1c: /* Arithmetic shift right by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAR;
|
|
break;
|
|
case 0x1d: /* Logical shift right by one */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHL;
|
|
break;
|
|
case 0x1e:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
|
|
/* TODO: the description sounds more like a */
|
|
/* RZ_ANALYSIS_OP_TYPE_SWI, but I don't know what */
|
|
/* difference that would make to rizin */
|
|
break;
|
|
case 0x1f:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
|
|
/* TODO: this should be RZ_ANALYSIS_OP_TYPE_DEBUG, */
|
|
/* but that type is commented out */
|
|
break;
|
|
}
|
|
break;
|
|
case 0x10: /* LD_S c,[b,u7] */
|
|
case 0x11: /* LDB_S c,[b,u5] */
|
|
case 0x12: /* LDW_S c,[b,u6] */
|
|
case 0x13: /* LDW_S.X c,[b,u6] */
|
|
/* Load/Store with Offset, 0x10 - 0x16 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
break;
|
|
case 0x14: /* ST_S c, [b, u7] */
|
|
case 0x15: /* STB_S c, [b, u5] */
|
|
case 0x16: /* STW_S c, [b, u6] */
|
|
/* Load/Store with Offset, 0x10 - 0x16 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_STORE;
|
|
break;
|
|
case 0x17: /* Shift/Subtract/Bit Immediate, 0x17, [0x00 - 0x07] */
|
|
fields.subopcode = (words[0] & 0x00e00000) >> (16 + 5);
|
|
switch (fields.subopcode) {
|
|
case 0: /* Multiple arithmetic shift left */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAL;
|
|
break;
|
|
case 1: /* Multiple logical shift left */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SHL;
|
|
break;
|
|
case 2: /* Multiple arithmetic shift right */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SAR;
|
|
break;
|
|
case 3: /* Subtract */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 4: /* Bit set */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_OR;
|
|
break;
|
|
case 5: /* Bit clear */
|
|
case 6: /* Bit mask */
|
|
case 7: /* Bit test */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
}
|
|
break;
|
|
case 0x18: /* Stack Pointer Based Instructions, 0x18, [0x00 - 0x07] */
|
|
fields.subopcode = (words[0] & 0x00e00000) >> (16 + 5);
|
|
switch (fields.subopcode) {
|
|
case 0: /* Load long word sp-rel. */
|
|
case 1: /* Load unsigned byte sp-rel. */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
break;
|
|
case 2: /* Store long word sp-rel. */
|
|
case 3: /* Store unsigned byte sp-rel. */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_STORE;
|
|
break;
|
|
case 4: /* Add */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 5: /* Add/Subtract SP Relative, 0x18, [0x05, 0x00-0x07] */
|
|
fields.b = (words[0] & 0x07000000) >> (16 + 8);
|
|
switch (fields.b) {
|
|
case 0: /* Add immediate to SP */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 1: /* Subtract immediate from SP */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
case 6: /* POP Register from Stack, 0x18, [0x06, 0x00-0x1F] */
|
|
fields.c = (words[0] & 0x001f0000) >> 16;
|
|
switch (fields.c) {
|
|
case 1: /* Pop register from stack */
|
|
case 0x11: /* Pop blink from stack */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_POP;
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
case 7: /* PUSH Register to Stack, 0x18, [0x07, 0x00-0x1F] */
|
|
fields.c = (words[0] & 0x001f0000) >> 16;
|
|
switch (fields.c) {
|
|
case 1: /* Push register to stack */
|
|
case 0x11: /* Push blink to stack */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_PUSH;
|
|
break;
|
|
default:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ILL;
|
|
break;
|
|
}
|
|
break;
|
|
}
|
|
break;
|
|
case 0x19: /* Load/Add GP-Relative, 0x19, [0x00 - 0x03] */
|
|
fields.subopcode = (words[0] & 0x06000000) >> (16 + 9);
|
|
switch (fields.subopcode) {
|
|
case 0: /* Load gp-relative (32-bit aligned) to r0 */
|
|
case 1: /* Load unsigned byte gp-relative (8-bit aligned) to r0 */
|
|
case 2: /* Load unsigned word gp-relative (16-bit aligned) to r0 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
break;
|
|
case 3: /* Add gp-relative (32-bit aligned) to r0 */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
}
|
|
op->type = RZ_ANALYSIS_OP_TYPE_UNK;
|
|
break;
|
|
case 0x1a: /* Load PCL-Relative, 0x1A */
|
|
fields.c = (words[0] & 0x00ff0000) >> 14;
|
|
op->ptr = (addr & ~3) + fields.c;
|
|
op->refptr = 4;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
|
|
break;
|
|
case 0x1b: /* Move Immediate, 0x1B */
|
|
op->val = (words[0] & 0x00ff0000) >> 16;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
|
break;
|
|
case 0x1c: /* ADD/CMP Immediate, 0x1C, [0x00 - 0x01] */
|
|
fields.subopcode = (words[0] & 0x00800000) >> (16 + 7);
|
|
if (fields.subopcode == 0) {
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
} else {
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CMP;
|
|
}
|
|
break;
|
|
case 0x1d: /* Branch on Compare Register with Zero, 0x1D, [0x00 - 0x01] */
|
|
/* fields.subopcode = (words[0] & 0x00800000) >> (16+7); */
|
|
fields.imm = SIGN_EXT_S8((words[0] & 0x007f0000) >> (16 - 1));
|
|
/* fields.subopcode? reg NE: reg EQ; */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
arcompact_branch(op, addr, fields.imm, 0);
|
|
break;
|
|
case 0x1e: /* Branch Conditionally, 0x1E, [0x00 - 0x03] */
|
|
fields.subopcode = (words[0] & 0x06000000) >> (16 + 9);
|
|
fields.imm = SIGN_EXT_S10((words[0] & 0x01ff0000) >> (16 - 1));
|
|
switch (fields.subopcode) {
|
|
case 0: /* B_S */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_JMP;
|
|
break;
|
|
case 1: /* BEQ_S */
|
|
op->cond = RZ_ANALYSIS_COND_EQ;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
break;
|
|
case 2: /* BNE_S */
|
|
op->cond = RZ_ANALYSIS_COND_NE;
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
break;
|
|
case 3: /* Bcc_S */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
fields.imm = SIGN_EXT_S7((words[0] & 0x003f0000) >> (16 - 1));
|
|
/* TODO: cond codes (looks like it is the BR table again?) */
|
|
break;
|
|
}
|
|
arcompact_branch(op, addr, fields.imm, 0);
|
|
break;
|
|
case 0x1f: /* Branch and Link Unconditionally, 0x1F */
|
|
fields.imm = SIGN_EXT_S13((words[0] & 0x07ff0000) >> (16 - 2));
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CALL;
|
|
arcompact_branch(op, addr, fields.imm, 0);
|
|
break;
|
|
}
|
|
arccompact_dump_fields(addr, words, &fields);
|
|
return op->size;
|
|
}
|
|
|
|
static int arc_op(RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *data, int len, RzAnalysisOpMask mask) {
|
|
const ut8 *b = (ut8 *)data;
|
|
|
|
if (analysis->bits == 16) {
|
|
return arcompact_op(analysis, op, addr, data, len);
|
|
}
|
|
|
|
/* ARCtangent A4 */
|
|
op->size = 4;
|
|
op->fail = addr + 4;
|
|
ut8 basecode = (len > 3) ? ((b[3] & 0xf8) >> 3) : 0;
|
|
switch (basecode) {
|
|
case 0x04: /* Branch */
|
|
case 0x05: /* Branch with Link */
|
|
case 0x06: /* Loop */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
op->jump = addr + 4 + ((rz_read_le32(&data[0]) & 0x07ffff80) >> (7 - 2));
|
|
break;
|
|
case 0x07: /* Conditional Jump and Jump with Link */
|
|
op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
|
|
op->jump = 0;
|
|
break;
|
|
case 0x08:
|
|
case 0x09:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ADD;
|
|
break;
|
|
case 0x0a:
|
|
case 0x0b:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_SUB;
|
|
break;
|
|
case 0x0c:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_AND;
|
|
break;
|
|
case 0x0d:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_OR;
|
|
break;
|
|
case 0x0f:
|
|
if ((b[0] == 0xff) && (b[1] == 0xff)) {
|
|
op->type = RZ_ANALYSIS_OP_TYPE_NOP;
|
|
break;
|
|
}
|
|
op->type = RZ_ANALYSIS_OP_TYPE_XOR;
|
|
break;
|
|
case 0x13:
|
|
op->type = RZ_ANALYSIS_OP_TYPE_ROR;
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
return op->size;
|
|
}
|
|
|
|
static int archinfo(RzAnalysis *analysis, int query) {
|
|
if (analysis->bits != 16) {
|
|
return -1;
|
|
}
|
|
switch (query) {
|
|
case RZ_ANALYSIS_ARCHINFO_ALIGN:
|
|
return 2;
|
|
case RZ_ANALYSIS_ARCHINFO_MIN_OP_SIZE:
|
|
/* all ops are at least 1 word long */
|
|
return 2;
|
|
case RZ_ANALYSIS_ARCHINFO_MAX_OP_SIZE:
|
|
return 8;
|
|
default:
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
static bool set_reg_profile(RzAnalysis *analysis) {
|
|
if (analysis->bits != 16) {
|
|
return false;
|
|
}
|
|
const char *p16 =
|
|
"=PC pcl\n"
|
|
"=SP sp\n"
|
|
"=LR blink\n"
|
|
// "=BP r27\n" // ??
|
|
"=A0 r0\n"
|
|
"=A1 r1\n"
|
|
"=A2 r2\n"
|
|
"=A3 r3\n"
|
|
|
|
"gpr r0 .32 0 0\n"
|
|
"gpr r1 .32 4 0\n"
|
|
"gpr r2 .32 8 0\n"
|
|
"gpr r3 .32 12 0\n"
|
|
"gpr r4 .32 16 0\n"
|
|
"gpr r5 .32 20 0\n"
|
|
"gpr r6 .32 24 0\n"
|
|
"gpr r7 .32 28 0\n"
|
|
"gpr r8 .32 32 0\n"
|
|
"gpr r9 .32 36 0\n"
|
|
"gpr r10 .32 40 0\n"
|
|
"gpr r11 .32 44 0\n"
|
|
"gpr r12 .32 48 0\n"
|
|
"gpr r13 .32 52 0\n"
|
|
"gpr r14 .32 56 0\n"
|
|
"gpr r15 .32 60 0\n"
|
|
"gpr r16 .32 64 0\n"
|
|
"gpr r17 .32 68 0\n"
|
|
"gpr r18 .32 72 0\n"
|
|
"gpr r19 .32 76 0\n"
|
|
"gpr r20 .32 80 0\n"
|
|
"gpr r21 .32 84 0\n"
|
|
"gpr r22 .32 88 0\n"
|
|
"gpr r23 .32 92 0\n"
|
|
"gpr r24 .32 96 0\n"
|
|
"gpr r25 .32 100 0\n"
|
|
"gpr gp .32 104 0\n"
|
|
"gpr fp .32 108 0\n"
|
|
"gpr sp .32 112 0\n"
|
|
"gpr ilink1 .32 116 0\n"
|
|
"gpr ilink2 .32 120 0\n"
|
|
"gpr blink .32 124 0\n"
|
|
"gpr lp_count .32 128 0\n"
|
|
"gpr pcl .32 132 0\n";
|
|
|
|
/* TODO: */
|
|
/* Should I add the Auxiliary Register Set? */
|
|
/* it contains the flag bits, amongst other things */
|
|
return rz_reg_set_profile_string(analysis->reg, p16);
|
|
}
|
|
|
|
RzAnalysisPlugin rz_analysis_plugin_arc = {
|
|
.name = "arc",
|
|
.arch = "arc",
|
|
.license = "LGPL3",
|
|
.bits = 16 | 32,
|
|
.desc = "ARC code analysis plugin",
|
|
.op = &arc_op,
|
|
.archinfo = archinfo,
|
|
.set_reg_profile = set_reg_profile,
|
|
};
|
|
|
|
#ifndef RZ_PLUGIN_INCORE
|
|
RZ_API RzLibStruct rizin_plugin = {
|
|
.type = RZ_LIB_TYPE_ANALYSIS,
|
|
.data = &rz_analysis_plugin_arc,
|
|
.version = RZ_VERSION,
|
|
};
|
|
#endif
|