понедельник, 22 октября 2012 г.

AVX/XOP instructions processor extender for IDA Pro

It was very surprising (for me) but even latest IDA Pro 6.3 advanced still does not support AVX and XOP instructions (just try to disasm bytes C5 F1 58 CA for example)
So I wrote a very simple processor extender plugin for decoding this instructions
Sources can be downloaded here

IDA Pro 6.X with SDK. I think this plugin also can be built on v5.X
Visual Studio 2008

Since I am too lazy I ripped all disasm tables from Bochs. I added a perl script parse.pl in data directory to generate bochs.inc file. You can generate bochs.inc with commands like
cd bochs-2.6\disasm
grep IA_AVX opcodes.inc > my
grep IA_XOP opcodes.inc >> my
grep IA_BMI opcodes.inc >> my
grep IA_FMA4 opcodes.inc >> my
grep IA_TBM opcodes.inc >> my
perl parse.pl -c my >bochs.inc

Plugin just registers hook_to_notification_point(HT_IDP, ...) and handles the following event_id:
  • custom_ana - uses bochs disasm to fill IDA Pro cmd structure
  • custom_mnem - to supply instruction name
  • custom_outop - it looks like currently IDA Pro doesn't have support for YMM registers, so I made a dirty hack - although comments in intel.hpp claims that XMM stored in op.o_idpspec5 actually they stored like any ordinal register in op->reg. So I added YMM to op->reg too but with op->dtyp == dt_ldbl
Known problems 
  • fourth operand cannot be displayed. I don`t know if this is some internal IDA restriction or I made a mistake somewhere in my code
  • ModRM is being displayed incorrectly sometimes
  • no segment registers support
  • debug version cannot be built
  • vzeroupper & vzeroall both have instruction vzeroupper. Perhaps this is a bug in Bochs disasm
  • probably over 9000 issues were left unnoticed yet

Комментариев нет:

Отправить комментарий