Class: OneGadget::Emulators::AArch64

Inherits:
ArmFamily show all
Defined in:
lib/one_gadget/emulators/aarch64.rb

Overview

Emulator of aarch64.

Constant Summary

Constants inherited from ArmFamily

OneGadget::Emulators::ArmFamily::COMPARES, OneGadget::Emulators::ArmFamily::COND

Constants inherited from Processor

Processor::TERMINAL_CALL_RE

Constants included from Constraints

Constraints::ADDRESS_TYPES, Constraints::CLOBBERED, Constraints::NULLABLE_REQUIREMENTS, Constraints::POINTER_REQUIREMENTS

Constants included from Conditional

Conditional::COMPARE_OPS, Conditional::NEGATE, Conditional::RELATION, Conditional::ZERO

Instance Attribute Summary

Attributes inherited from Processor

#bp, #pc, #refused_line, #registers, #sp

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Processor

instruction_table, line_memo, #parse, #process, #reach_terminal_call, #terminal_call?

Methods included from TrackedMemory

#bp_based_stack, #get_corresponding_stack, #resolve_address, #setup_frame_pointer, #sp_based_stack, #writes_through

Methods included from Constraints

#address_deref0?, #closed_fds, #constraint_key, #constraints, #drop_implied_nonzero, #drop_restated_null, #render_constraint

Methods included from Conditional

#branch_on_bit, #branch_on_compare, #branch_on_zero, #comparisons_on, #handle_compare, #mnemonic, #operand_str, #record_compare, #resolve_pending_branch, #satisfiable?, #value_str

Constructor Details

#initialize ⇒ AArch64

Instantiate a OneGadget::Emulators::AArch64 object.



13
14
15
16
17
18
19
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 13

def initialize
  super(OneGadget::ABI.aarch64, 'sp')
  # Constant registers
  %w[xzr wzr].each { |r| @registers[r] = 0 }
  @pc = 'pc'
  setup_frame_pointer('x29') # track argv/data staged off the frame pointer
end

Class Method Details

.bits ⇒ Integer

AArch64 is 64-bit.

Returns:

  • (Integer) 


164
165
166
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 164

def bits
  64
end

Instance Method Details

#argument(idx) ⇒ Lambda, Integer

Return the argument value of calling a function.

Parameters:

  • idx (Integer) —

    The 0-based index of the argument.

Returns:

  • (Lambda, Integer) —

    The value held in register x<idx>, used for the +idx+-th argument.



71
72
73
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 71

def argument(idx)
  registers["x#{idx}"]
end

#instructions ⇒ Array<Instruction>

Supported instruction set.

Returns:



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 37

def instructions
  [
    Instruction.new('add', 3..4),
    Instruction.new('adrp', 2),
    Instruction.new('and', 3),
    Instruction.new('bic', 3),
    Instruction.new('bl', 1),
    Instruction.new('bti', 0..1),
    Instruction.new('dmb', 0..1),
    Instruction.new('dsb', 0..1),
    Instruction.new('eor', 3),
    Instruction.new('isb', 0..1),
    Instruction.new('ldr', 2..3),
    Instruction.new('ldrb', 2..3),
    Instruction.new('lsl', 3),
    Instruction.new('lsr', 3),
    Instruction.new('mov', 2),
    Instruction.new('mvn', 2),
    Instruction.new('nop', 0..1),
    Instruction.new('orr', 3),
    Instruction.new('stp', 3),
    Instruction.new('str', 2..3),
    Instruction.new('sub', 3..4)
  ]
end

#process!(cmd) ⇒ Boolean

Returns If successfully processed.

Parameters:

  • cmd (String) —

    One line from result of objdump.

Returns:

  • (Boolean) —

    If successfully processed.

See Also:



24
25
26
27
28
29
30
31
32
33
 
# File 'lib/one_gadget/emulators/aarch64.rb', line 24

def process!(cmd)
  resolve_pending_branch(cmd)
  cmd = cmd.gsub(/#-?(0x)?[0-9a-f]+/) { |v| v[1..] }
  mnem = mnemonic(cmd)
  return handle_compare(COMPARES[mnem], cmd) if COMPARES.key?(mnem)
  return handle_branch(mnem, cmd) != :fail if branch_mnem?(mnem)

  inst, args = parse(cmd)
  __send__(inst.handler, *args) != :fail
end