compiler.cpp

ICEExt for Driver Studio3.2的sourcecode

                    }
                    else
                    {
                        pmas->mas_compiled_code[count++] = 0x81;    // add edx, out_size_sec - 1
                        pmas->mas_compiled_code[count++] = 0xC2;
                        *(ULONG *)(pmas->mas_compiled_code + count) = (ULONG)out_size_sec - 1;
                        count += 4;
                    }
                }

                pmas->mas_compiled_code[count++] = 0x76;    // jna +0Dh
                pmas->mas_compiled_code[count++] = 0x0D;

                pmas->mas_compiled_code[count++] = 0x52;    // push edx
                pmas->mas_compiled_code[count++] = 0xFF;    // call dword ptr [OffsetOfMakePageInFunction]
                pmas->mas_compiled_code[count++] = 0x15;
                *(int *)(pmas->mas_compiled_code + count) = (int)(&OffsetOfMakePageInFunction);
                count += 4;

                pmas->mas_compiled_code[count++] = 0x0B;    // or eax, eax
                pmas->mas_compiled_code[count++] = 0xC0;

                (pointer_level_fir > 1) ? tmp = 0xDD : tmp = 0xE7;
                if ((ULONG)out_size_sec > 0x7F) tmp += 0x3;

                pmas->mas_compiled_code[count++] = 0x74;    // jz -tmp
                pmas->mas_compiled_code[count++] = (UCHAR)tmp;

                pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, ebx
                pmas->mas_compiled_code[count++] = 0xC3;

                if (pointer_level_fir > 1)
                {
                    tmp = 0xCB;
                    if ((ULONG)out_size_sec > 0x7F) tmp += 0x3;

                    pmas->mas_compiled_code[count++] = 0x49;    // dec ecx
                    pmas->mas_compiled_code[count++] = 0x75;    // jnz -CB
                    pmas->mas_compiled_code[count++] = (UCHAR)tmp;
                }
                
                pmas->mas_compiled_code[count++] = 0xFC;    // cld
                pmas->mas_compiled_code[count++] = 0xB9;    // mov ecx, out_size_fir
                *(int *)(pmas->mas_compiled_code + count) = out_size_sec;
                count += 4;
                pmas->mas_compiled_code[count++] = 0xBE;    // mov esi, offset mas_for_cmps
                *(int *)(pmas->mas_compiled_code + count) = (int)mas_for_cmps;
                count += 4;
                pmas->mas_compiled_code[count++] = 0x8B;    // mov edi, eax
                pmas->mas_compiled_code[count++] = 0xF8;

                pmas->mas_compiled_code[count++] = 0xF3;    // repz cmpsb
                pmas->mas_compiled_code[count++] = 0xA6;

                pmas->mas_compiled_code[count++] = 0x09;    // or ecx, ecx
                pmas->mas_compiled_code[count++] = 0xC9;
            }
            else
            {
                if (reg_size_fir != 4) return false;
                value = *(PULONG)mas_sec;

                if (type_convertion_fir == 0 || type_convertion_fir == 3)
                    type_convertion_fir = 4;

                if (pointer_level_fir > 1)
                {
                    pmas->mas_compiled_code[count++] = 0xB9;    // mov ecx, pointer_level
                    *(int *)(pmas->mas_compiled_code + count) = pointer_level_fir;
                    count += 4;
                }

                pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, [ebp + offset]
                pmas->mas_compiled_code[count++] = 0x45;
                pmas->mas_compiled_code[count++] = reg_offset_fir;

                if (pointer_level_fir > 1)
                {
                    pmas->mas_compiled_code[count++] = 0xEB;   //  jmp +2
                    pmas->mas_compiled_code[count++] = 0x02;
                    pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, dword ptr [eax]
                    pmas->mas_compiled_code[count++] = 0x00;
                }

                pmas->mas_compiled_code[count++] = 0x50;    // push eax

                pmas->mas_compiled_code[count++] = 0xFF;    // call dword ptr [OffsetOfMakePageInFunction]
                pmas->mas_compiled_code[count++] = 0x15;
                *(int *)(pmas->mas_compiled_code + count) = (int)(&OffsetOfMakePageInFunction);
                count += 4;

                pmas->mas_compiled_code[count++] = 0x0B;    // or eax, eax
                pmas->mas_compiled_code[count++] = 0xC0;

                pmas->mas_compiled_code[count++] = 0x75;    // jne +5
                pmas->mas_compiled_code[count++] = 0x05;

                pmas->mas_compiled_code[count++] = 0xB4;    // mov ah, byte_for_reverse_eflags
                pmas->mas_compiled_code[count++] = byte_for_reverse_eflags;
                pmas->mas_compiled_code[count++] = 0x9E;    // sahf

                tmp = 0;
                switch (type_convertion_fir)
                {
                case 4:
                    (pointer_level_fir > 1) ? tmp = 0x20 : tmp = 0x1D;
                    break;

                case 2:
                    (pointer_level_fir > 1) ? tmp = 0x2A : tmp = 0x1D;
                    break;

                case 1:
                    (pointer_level_fir > 1) ? tmp = 0x22 : tmp = 0x04;
                }

                pmas->mas_compiled_code[count++] = 0xEB;    // jmp +tmp
                pmas->mas_compiled_code[count++] = (UCHAR)tmp;

                if (type_convertion_fir != 1 || pointer_level_fir > 1)
                {
                    pmas->mas_compiled_code[count++] = 0x8B;    // mov ebx, eax
                    pmas->mas_compiled_code[count++] = 0xD8;

                    pmas->mas_compiled_code[count++] = 0x8B;    // mov edx, eax
                    pmas->mas_compiled_code[count++] = 0xD0;

                    if ((type_convertion_fir == 2 || type_convertion_fir == 1) && pointer_level_fir > 1)
                    {
                        pmas->mas_compiled_code[count++] = 0x83;    // cmp ecx, 1
                        pmas->mas_compiled_code[count++] = 0xF9;
                        pmas->mas_compiled_code[count++] = 0x01;                

                        if (type_convertion_fir == 2)
                        {
                            pmas->mas_compiled_code[count++] = 0x75;    // jnz +5
                            pmas->mas_compiled_code[count++] = 0x05;

                            pmas->mas_compiled_code[count++] = 0x83;    // add edx, 1
                            pmas->mas_compiled_code[count++] = 0xC2;
                            pmas->mas_compiled_code[count++] = 0x01;

                            pmas->mas_compiled_code[count++] = 0xEB;    // jmp +3h
                            pmas->mas_compiled_code[count++] = 0x03;
                        }
                        else
                        {
                            pmas->mas_compiled_code[count++] = 0x74;    // jz +0F
                            pmas->mas_compiled_code[count++] = 0x12;
                        }
                    }

                    if (type_convertion_fir == 2 && pointer_level_fir == 1)
                    {
                        pmas->mas_compiled_code[count++] = 0x83;    // add edx, 1
                        pmas->mas_compiled_code[count++] = 0xC2;
                        pmas->mas_compiled_code[count++] = 0x01;
                    }
                    else
                    {
                        pmas->mas_compiled_code[count++] = 0x83;    // add edx, 3
                        pmas->mas_compiled_code[count++] = 0xC2;
                        pmas->mas_compiled_code[count++] = 0x03;
                    }

                    pmas->mas_compiled_code[count++] = 0x76;    // jna +0Dh
                    pmas->mas_compiled_code[count++] = 0x0D;

                    pmas->mas_compiled_code[count++] = 0x52;    // push edx
                    pmas->mas_compiled_code[count++] = 0xFF;    // call dword ptr [OffsetOfMakePageInFunction]
                    pmas->mas_compiled_code[count++] = 0x15;
                    *(int *)(pmas->mas_compiled_code + count) = (int)(&OffsetOfMakePageInFunction);
                    count += 4;

                    pmas->mas_compiled_code[count++] = 0x0B;    // or eax, eax
                    pmas->mas_compiled_code[count++] = 0xC0;

                    if (pointer_level_fir > 1)
                    {
                        switch (type_convertion_fir)
                        {
                        case 4:
                            pmas->mas_compiled_code[count++] = 0x74;    // jz -E7
                            pmas->mas_compiled_code[count++] = 0xE7;
                            break;

                        case 2:
                            pmas->mas_compiled_code[count++] = 0x74;    // jz -DD
                            pmas->mas_compiled_code[count++] = 0xDD;
                            break;

                        case 1:
                            pmas->mas_compiled_code[count++] = 0x74;    // jz -E2
                            pmas->mas_compiled_code[count++] = 0xE2;
                        }
                    }
                    else
                    {
                        pmas->mas_compiled_code[count++] = 0x74;    // jz -E7
                        pmas->mas_compiled_code[count++] = 0xE7;
                    }

                    pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, ebx
                    pmas->mas_compiled_code[count++] = 0xC3;

                    if (pointer_level_fir > 1)
                    {
                        switch (type_convertion_fir)
                        {
                        case 4:
                            pmas->mas_compiled_code[count++] = 0x49;    // dec ecx
                            pmas->mas_compiled_code[count++] = 0x75;    // jnz -D5
                            pmas->mas_compiled_code[count++] = 0xD5;
                            break;

                        case 2:
                            pmas->mas_compiled_code[count++] = 0x49;    // dec ecx
                            pmas->mas_compiled_code[count++] = 0x75;    // jnz -CB
                            pmas->mas_compiled_code[count++] = 0xCB;
                            break;

                        case 1:
                            pmas->mas_compiled_code[count++] = 0x49;    // dec ecx
                            pmas->mas_compiled_code[count++] = 0x75;    // jnz -D0
                            pmas->mas_compiled_code[count++] = 0xD0;
                        }
                    }
                }

                switch (type_convertion_fir)
                {
                case 4:
                    pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, dword ptr [eax]
                    pmas->mas_compiled_code[count++] = 0x00;
                    pmas->mas_compiled_code[count++] = 0x3D;    // cmp eax, value
                    *(int *)(pmas->mas_compiled_code + count) = (int)value;
                    count += 4;
                    break;

                case 2:
                    pmas->mas_compiled_code[count++] = 0x66;    // mov ax, word ptr [eax]
                    pmas->mas_compiled_code[count++] = 0x8B;
                    pmas->mas_compiled_code[count++] = 0x00;
                    pmas->mas_compiled_code[count++] = 0x66;    // cmp ax, value
                    pmas->mas_compiled_code[count++] = 0x3D;
                    *(short *)(pmas->mas_compiled_code + count) = (short)value;
                    count += 2;
                    break;

                case 1:
                    pmas->mas_compiled_code[count++] = 0x8A;    // mov al, byte ptr [eax]
                    pmas->mas_compiled_code[count++] = 0x00;
                    pmas->mas_compiled_code[count++] = 0x3C;    // cmp al, value
                    pmas->mas_compiled_code[count++] = (char)value;
                }
            }

            break;

        /////////////////////////////////////////////////////////////////////////////////
        // in case     eax == *(0x00400000)  or  *(0x00400000) == eax
        /////////////////////////////////////////////////////////////////////////////////

        case 0x0101101: case 0x1011010:

            int out_type;

            if (res & 0x100000)
            {
                value = *(PULONG)mas_sec;
                type_conv = type_convertion_sec;
                level = pointer_level_sec;
                offset_sec = reg_offset_fir;
                out_type = out_type_sec;
                size_sec = reg_size_fir;
            }
            else
            {
                value = *(PULONG)mas_fir;
                type_conv = type_convertion_fir;
                level = pointer_level_fir;
                offset_sec = reg_offset_sec;
                out_type = out_type_fir;
                size_sec = reg_size_sec;
            }

            if ((type_conv == 1 && size_sec > 1) || (type_conv == 2 && size_sec > 2))
                return false;

            if (type_conv == 3 || type_conv == 0) 
                type_conv = 4;

            cmp_exit = 5; // if *byte == byte
            if (type_conv == 4) 
            {
                if (size_sec == 4) cmp_exit = 0; // if *dword == dword
                else if (size_sec == 2) cmp_exit = 1; // if *dword == word
                else if (size_sec == 1) cmp_exit = 2; // if *dword == byte
            }
            else if (type_conv == 2)
            {
                if (size_sec == 2) cmp_exit = 3; // if *word == word
                else if (size_sec == 1) cmp_exit = 4; // if *word == byte
            }

            if (level > 1)
            {
                pmas->mas_compiled_code[count++] = 0xB9;    // mov ecx, pointer_level
                *(int *)(pmas->mas_compiled_code + count) = level;
                count += 4;
            }

            pmas->mas_compiled_code[count++] = 0xB8;    // mov eax, value
            *(int *)(pmas->mas_compiled_code + count) = (int)value;
            count += 4;

            if (level > 1)
            {
                pmas->mas_compiled_code[count++] = 0xEB;   //  jmp +2
                pmas->mas_compiled_code[count++] = 0x02;
                pmas->mas_compiled_code[count++] = 0x8B;    // mov eax, dword ptr [eax]
                pmas->mas_compiled_code[count++] = 0x00;
            }

            pmas->mas_compiled_code[count++] = 0x50;    // push eax

            pmas->ma