TestMu Conference is Back! Future of Testing + AI LambdaTest G2 Announcement

How to use makeGen method of x86 Package

Best Syzkaller code snippet using x86.makeGen

pseudo.go

Source:pseudo.go

...11		Mode:   1<<iset.ModeLast - 1,12		Priv:   true,13		Pseudo: true,14		generator: func(cfg *iset.Config, r *rand.Rand) []byte {15			gen := makeGen(cfg, r)16			msr := msrs[r.Intn(len(msrs))]17			gen.mov32(regECX, msr)18			gen.byte(0x0f, 0x32) // rdmsr19			return gen.text20		},21	},22	{23		Name:   "PSEUDO_WRMSR",24		Mode:   1<<iset.ModeLast - 1,25		Priv:   true,26		Pseudo: true,27		generator: func(cfg *iset.Config, r *rand.Rand) []byte {28			gen := makeGen(cfg, r)29			msr := msrs[r.Intn(len(msrs))]30			v := iset.GenerateInt(cfg, r, 8)31			gen.mov32(regECX, msr)32			gen.mov32(regEAX, uint32(v>>0))33			gen.mov32(regEDX, uint32(v>>32))34			gen.byte(0x0f, 0x30) // wrmsr35			return gen.text36		},37	},38	{39		Name:   "PSEUDO_PCI_READ",40		Mode:   1<<iset.ModeLast - 1,41		Priv:   true,42		Pseudo: true,43		generator: func(cfg *iset.Config, r *rand.Rand) []byte {44			gen := makeGen(cfg, r)45			addr, port, size := pciAddrPort(r)46			gen.out32(0xcf8, addr)47			gen.in(port, size)48			return gen.text49		},50	},51	{52		Name:   "PSEUDO_PCI_WRITE",53		Mode:   1<<iset.ModeLast - 1,54		Priv:   true,55		Pseudo: true,56		generator: func(cfg *iset.Config, r *rand.Rand) []byte {57			gen := makeGen(cfg, r)58			addr, port, size := pciAddrPort(r)59			val := iset.GenerateInt(cfg, r, 4)60			gen.out32(0xcf8, addr)61			gen.out(port, uint32(val), size)62			return gen.text63		},64	},65	{66		Name:   "PSEUDO_PORT_READ",67		Mode:   1<<iset.ModeLast - 1,68		Priv:   true,69		Pseudo: true,70		generator: func(cfg *iset.Config, r *rand.Rand) []byte {71			gen := makeGen(cfg, r)72			port := ports[r.Intn(len(ports))]73			gen.in(port, r.Intn(3))74			return gen.text75		},76	},77	{78		Name:   "PSEUDO_PORT_WRITE",79		Mode:   1<<iset.ModeLast - 1,80		Priv:   true,81		Pseudo: true,82		generator: func(cfg *iset.Config, r *rand.Rand) []byte {83			gen := makeGen(cfg, r)84			port := ports[r.Intn(len(ports))]85			val := iset.GenerateInt(cfg, r, 4)86			gen.out(port, uint32(val), r.Intn(3))87			return gen.text88		},89	},90	{91		Name:   "PSEUDO_XOR_CR",92		Mode:   1<<iset.ModeLast - 1,93		Priv:   true,94		Pseudo: true,95		generator: func(cfg *iset.Config, r *rand.Rand) []byte {96			gen := makeGen(cfg, r)97			cr := controlRegisters[r.Intn(len(controlRegisters))]98			var v uint3299			if cr == 8 {100				v = uint32(r.Intn(15) + 1)101			} else {102				bit := controlRegistersBits[cr][r.Intn(len(controlRegistersBits[cr]))]103				v = 1 << bit104			}105			gen.readCR(cr)106			gen.xor32(regEAX, v)107			gen.writeCR(cr)108			return gen.text109		},110	},111	{112		Name:   "PSEUDO_XOR_EFER",113		Mode:   1<<iset.ModeLast - 1,114		Priv:   true,115		Pseudo: true,116		generator: func(cfg *iset.Config, r *rand.Rand) []byte {117			gen := makeGen(cfg, r)118			gen.mov32(regECX, eferMSR)119			gen.byte(0x0f, 0x32) // rdmsr120			bit := eferBits[r.Intn(len(eferBits))]121			gen.xor32(regEAX, 1<<bit)122			gen.byte(0x0f, 0x30) // wrmsr123			return gen.text124		},125	},126	{127		Name:   "PSEUDO_SET_BREAK",128		Mode:   1<<iset.ModeLast - 1,129		Priv:   true,130		Pseudo: true,131		generator: func(cfg *iset.Config, r *rand.Rand) []byte {132			gen := makeGen(cfg, r)133			br := uint8(r.Intn(4))134			loc := uint32(r.Intn(4))135			typ := uint32(r.Intn(16))136			addr := iset.GenerateInt(cfg, r, 8)137			if cfg.Mode == iset.ModeLong64 {138				gen.mov64(regRAX, addr)139			} else {140				gen.mov32(regEAX, uint32(addr))141			}142			gen.writeDR(br)143			gen.readDR(7)144			gen.xor32(regEAX, loc<<(br*2)|typ<<(16+br*4))145			gen.writeDR(7)146			return gen.text147		},148	},149	{150		Name:   "PSEUDO_LOAD_SEG",151		Mode:   1<<iset.ModeLast - 1,152		Priv:   true,153		Pseudo: true,154		generator: func(cfg *iset.Config, r *rand.Rand) []byte {155			gen := makeGen(cfg, r)156			sel := randSelector(r)157			if cfg.Mode == iset.ModeReal16 {158				sel = uint16(iset.GenerateInt(cfg, r, 8)) >> 4159			}160			reg := uint8(r.Intn(6))161			gen.mov16(regAX, sel)162			gen.byte(0x8e, 0xc0|(reg<<3)) // MOV %ax, %seg163			return gen.text164		},165	},166	{167		Name:   "PSEUDO_FAR_JMP",168		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,169		Priv:   true,170		Pseudo: true,171		generator: func(cfg *iset.Config, r *rand.Rand) []byte {172			gen := makeGen(cfg, r)173			sel := randSelector(r)174			off := iset.GenerateInt(cfg, r, 4)175			if cfg.Mode == iset.ModeLong64 {176				gen.mov32toSPaddr(uint32(sel), 0)177				gen.mov32toSPaddr(uint32(off), 2)178				if r.Intn(2) == 0 {179					gen.byte(0xff, 0x2c, 0x24) // ljmp (%rsp)180				} else {181					gen.byte(0xff, 0x1c, 0x24) // lcall (%rsp)182				}183			} else {184				if r.Intn(2) == 0 {185					gen.byte(0xea) // ljmp $imm16, $imm16/32186				} else {187					gen.byte(0x9a) // lcall $imm16, $imm16/32188				}189				if cfg.Mode == iset.ModeProt16 {190					gen.imm16(uint16(off))191				} else {192					gen.imm32(uint32(off))193				}194				gen.imm16(sel)195			}196			return gen.text197		},198	},199	{200		Name:   "PSEUDO_LTR_LLDT",201		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,202		Priv:   true,203		Pseudo: true,204		generator: func(cfg *iset.Config, r *rand.Rand) []byte {205			gen := makeGen(cfg, r)206			sel := randSelector(r)207			gen.mov16(regAX, sel)208			if r.Intn(2) == 0 {209				gen.byte(0x0f, 0x00, 0xd8) // ltr %ax210			} else {211				gen.byte(0x0f, 0x00, 0xd0) // lldt %ax212			}213			return gen.text214		},215	},216	{217		Name:   "PSEUDO_LGIDT",218		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,219		Priv:   true,220		Pseudo: true,221		generator: func(cfg *iset.Config, r *rand.Rand) []byte {222			gen := makeGen(cfg, r)223			limit := uint32(iset.GenerateInt(cfg, r, 2))224			base := uint32(iset.GenerateInt(cfg, r, 4))225			gen.mov32toSPaddr(limit, 0)226			gen.mov32toSPaddr(base, 2)227			gen.mov32toSPaddr(0, 6)228			gen.addr32()229			if r.Intn(2) == 0 {230				gen.byte(0x0f, 0x01, 0x14, 0x24) // lgdt (%rsp)231			} else {232				gen.byte(0x0f, 0x01, 0x1c, 0x24) // lidt (%rsp)233			}234			return gen.text235		},236	},237	{238		Name:   "PSEUDO_HYPERCALL",239		Mode:   1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,240		Priv:   true,241		Pseudo: true,242		generator: func(cfg *iset.Config, r *rand.Rand) []byte {243			gen := makeGen(cfg, r)244			switch r.Intn(2) {245			case 0:246				gen.mov32(regEAX, 1) // KVM_HC_VAPIC_POLL_IRQ247			case 1:248				gen.mov32(regEAX, 5)                                   // KVM_HC_KICK_CPU249				gen.mov32(regECX, uint32(iset.GenerateInt(cfg, r, 4))) // APIC ID250			default:251				panic("bad")252			}253			if r.Intn(2) == 0 {254				gen.byte(0x0f, 0x01, 0xd9) // vmmcall255			} else {256				gen.byte(0x0f, 0x01, 0xc1) // vmcall257			}258			return gen.text259		},260	},261}262const (263	regAL = iota264	regAX265	regEAX266	regRAX267	regCL268	regCX269	regECX270	regRCX271	regDL272	regDX273	regEDX274	regRDX275)276type generator struct {277	mode iset.Mode278	r    *rand.Rand279	text []byte280}281func makeGen(cfg *iset.Config, r *rand.Rand) *generator {282	return &generator{283		mode: cfg.Mode,284		r:    r,285	}286}287func (gen *generator) byte(v ...uint8) {288	gen.text = append(gen.text, v...)289}290func (gen *generator) imm16(v uint16) {291	gen.byte(byte(v>>0), byte(v>>8))292}293func (gen *generator) imm32(v uint32) {294	gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24))295}...

Automation Testing Tutorials

Learn to execute automation testing from scratch with LambdaTest Learning Hub. Right from setting up the prerequisites to run your first automation test, to following best practices and diving deeper into advanced test scenarios. LambdaTest Learning Hubs compile a list of step-by-step guides to help you be proficient with different test automation frameworks i.e. Selenium, Cypress, TestNG etc.