TestMu Conference is Back! Future of Testing + AI
How to use mov32 method of x86 Package
Best Syzkaller code snippet using x86.mov32
pseudo.go
Source:pseudo.go 
...13 Pseudo: true,14 generator: func(cfg *iset.Config, r *rand.Rand) []byte {15 gen := makeGen(cfg, r)16 msr := msrs[r.Intn(len(msrs))]17 gen.mov32(regECX, msr)18 gen.byte(0x0f, 0x32) // rdmsr19 return gen.text20 },21 },22 {23 Name: "PSEUDO_WRMSR",24 Mode: 1<<iset.ModeLast - 1,25 Priv: true,26 Pseudo: true,27 generator: func(cfg *iset.Config, r *rand.Rand) []byte {28 gen := makeGen(cfg, r)29 msr := msrs[r.Intn(len(msrs))]30 v := iset.GenerateInt(cfg, r, 8)31 gen.mov32(regECX, msr)32 gen.mov32(regEAX, uint32(v>>0))33 gen.mov32(regEDX, uint32(v>>32))34 gen.byte(0x0f, 0x30) // wrmsr35 return gen.text36 },37 },38 {39 Name: "PSEUDO_PCI_READ",40 Mode: 1<<iset.ModeLast - 1,41 Priv: true,42 Pseudo: true,43 generator: func(cfg *iset.Config, r *rand.Rand) []byte {44 gen := makeGen(cfg, r)45 addr, port, size := pciAddrPort(r)46 gen.out32(0xcf8, addr)47 gen.in(port, size)48 return gen.text49 },50 },51 {52 Name: "PSEUDO_PCI_WRITE",53 Mode: 1<<iset.ModeLast - 1,54 Priv: true,55 Pseudo: true,56 generator: func(cfg *iset.Config, r *rand.Rand) []byte {57 gen := makeGen(cfg, r)58 addr, port, size := pciAddrPort(r)59 val := iset.GenerateInt(cfg, r, 4)60 gen.out32(0xcf8, addr)61 gen.out(port, uint32(val), size)62 return gen.text63 },64 },65 {66 Name: "PSEUDO_PORT_READ",67 Mode: 1<<iset.ModeLast - 1,68 Priv: true,69 Pseudo: true,70 generator: func(cfg *iset.Config, r *rand.Rand) []byte {71 gen := makeGen(cfg, r)72 port := ports[r.Intn(len(ports))]73 gen.in(port, r.Intn(3))74 return gen.text75 },76 },77 {78 Name: "PSEUDO_PORT_WRITE",79 Mode: 1<<iset.ModeLast - 1,80 Priv: true,81 Pseudo: true,82 generator: func(cfg *iset.Config, r *rand.Rand) []byte {83 gen := makeGen(cfg, r)84 port := ports[r.Intn(len(ports))]85 val := iset.GenerateInt(cfg, r, 4)86 gen.out(port, uint32(val), r.Intn(3))87 return gen.text88 },89 },90 {91 Name: "PSEUDO_XOR_CR",92 Mode: 1<<iset.ModeLast - 1,93 Priv: true,94 Pseudo: true,95 generator: func(cfg *iset.Config, r *rand.Rand) []byte {96 gen := makeGen(cfg, r)97 cr := controlRegisters[r.Intn(len(controlRegisters))]98 var v uint3299 if cr == 8 {100 v = uint32(r.Intn(15) + 1)101 } else {102 bit := controlRegistersBits[cr][r.Intn(len(controlRegistersBits[cr]))]103 v = 1 << bit104 }105 gen.readCR(cr)106 gen.xor32(regEAX, v)107 gen.writeCR(cr)108 return gen.text109 },110 },111 {112 Name: "PSEUDO_XOR_EFER",113 Mode: 1<<iset.ModeLast - 1,114 Priv: true,115 Pseudo: true,116 generator: func(cfg *iset.Config, r *rand.Rand) []byte {117 gen := makeGen(cfg, r)118 gen.mov32(regECX, eferMSR)119 gen.byte(0x0f, 0x32) // rdmsr120 bit := eferBits[r.Intn(len(eferBits))]121 gen.xor32(regEAX, 1<<bit)122 gen.byte(0x0f, 0x30) // wrmsr123 return gen.text124 },125 },126 {127 Name: "PSEUDO_SET_BREAK",128 Mode: 1<<iset.ModeLast - 1,129 Priv: true,130 Pseudo: true,131 generator: func(cfg *iset.Config, r *rand.Rand) []byte {132 gen := makeGen(cfg, r)133 br := uint8(r.Intn(4))134 loc := uint32(r.Intn(4))135 typ := uint32(r.Intn(16))136 addr := iset.GenerateInt(cfg, r, 8)137 if cfg.Mode == iset.ModeLong64 {138 gen.mov64(regRAX, addr)139 } else {140 gen.mov32(regEAX, uint32(addr))141 }142 gen.writeDR(br)143 gen.readDR(7)144 gen.xor32(regEAX, loc<<(br*2)|typ<<(16+br*4))145 gen.writeDR(7)146 return gen.text147 },148 },149 {150 Name: "PSEUDO_LOAD_SEG",151 Mode: 1<<iset.ModeLast - 1,152 Priv: true,153 Pseudo: true,154 generator: func(cfg *iset.Config, r *rand.Rand) []byte {155 gen := makeGen(cfg, r)156 sel := randSelector(r)157 if cfg.Mode == iset.ModeReal16 {158 sel = uint16(iset.GenerateInt(cfg, r, 8)) >> 4159 }160 reg := uint8(r.Intn(6))161 gen.mov16(regAX, sel)162 gen.byte(0x8e, 0xc0|(reg<<3)) // MOV %ax, %seg163 return gen.text164 },165 },166 {167 Name: "PSEUDO_FAR_JMP",168 Mode: 1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,169 Priv: true,170 Pseudo: true,171 generator: func(cfg *iset.Config, r *rand.Rand) []byte {172 gen := makeGen(cfg, r)173 sel := randSelector(r)174 off := iset.GenerateInt(cfg, r, 4)175 if cfg.Mode == iset.ModeLong64 {176 gen.mov32toSPaddr(uint32(sel), 0)177 gen.mov32toSPaddr(uint32(off), 2)178 if r.Intn(2) == 0 {179 gen.byte(0xff, 0x2c, 0x24) // ljmp (%rsp)180 } else {181 gen.byte(0xff, 0x1c, 0x24) // lcall (%rsp)182 }183 } else {184 if r.Intn(2) == 0 {185 gen.byte(0xea) // ljmp $imm16, $imm16/32186 } else {187 gen.byte(0x9a) // lcall $imm16, $imm16/32188 }189 if cfg.Mode == iset.ModeProt16 {190 gen.imm16(uint16(off))191 } else {192 gen.imm32(uint32(off))193 }194 gen.imm16(sel)195 }196 return gen.text197 },198 },199 {200 Name: "PSEUDO_LTR_LLDT",201 Mode: 1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,202 Priv: true,203 Pseudo: true,204 generator: func(cfg *iset.Config, r *rand.Rand) []byte {205 gen := makeGen(cfg, r)206 sel := randSelector(r)207 gen.mov16(regAX, sel)208 if r.Intn(2) == 0 {209 gen.byte(0x0f, 0x00, 0xd8) // ltr %ax210 } else {211 gen.byte(0x0f, 0x00, 0xd0) // lldt %ax212 }213 return gen.text214 },215 },216 {217 Name: "PSEUDO_LGIDT",218 Mode: 1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,219 Priv: true,220 Pseudo: true,221 generator: func(cfg *iset.Config, r *rand.Rand) []byte {222 gen := makeGen(cfg, r)223 limit := uint32(iset.GenerateInt(cfg, r, 2))224 base := uint32(iset.GenerateInt(cfg, r, 4))225 gen.mov32toSPaddr(limit, 0)226 gen.mov32toSPaddr(base, 2)227 gen.mov32toSPaddr(0, 6)228 gen.addr32()229 if r.Intn(2) == 0 {230 gen.byte(0x0f, 0x01, 0x14, 0x24) // lgdt (%rsp)231 } else {232 gen.byte(0x0f, 0x01, 0x1c, 0x24) // lidt (%rsp)233 }234 return gen.text235 },236 },237 {238 Name: "PSEUDO_HYPERCALL",239 Mode: 1<<iset.ModeLong64 | 1<<iset.ModeProt32 | 1<<iset.ModeProt16,240 Priv: true,241 Pseudo: true,242 generator: func(cfg *iset.Config, r *rand.Rand) []byte {243 gen := makeGen(cfg, r)244 switch r.Intn(2) {245 case 0:246 gen.mov32(regEAX, 1) // KVM_HC_VAPIC_POLL_IRQ247 case 1:248 gen.mov32(regEAX, 5) // KVM_HC_KICK_CPU249 gen.mov32(regECX, uint32(iset.GenerateInt(cfg, r, 4))) // APIC ID250 default:251 panic("bad")252 }253 if r.Intn(2) == 0 {254 gen.byte(0x0f, 0x01, 0xd9) // vmmcall255 } else {256 gen.byte(0x0f, 0x01, 0xc1) // vmcall257 }258 return gen.text259 },260 },261}262const (263 regAL = iota264 regAX265 regEAX266 regRAX267 regCL268 regCX269 regECX270 regRCX271 regDL272 regDX273 regEDX274 regRDX275)276type generator struct {277 mode iset.Mode278 r *rand.Rand279 text []byte280}281func makeGen(cfg *iset.Config, r *rand.Rand) *generator {282 return &generator{283 mode: cfg.Mode,284 r: r,285 }286}287func (gen *generator) byte(v ...uint8) {288 gen.text = append(gen.text, v...)289}290func (gen *generator) imm16(v uint16) {291 gen.byte(byte(v>>0), byte(v>>8))292}293func (gen *generator) imm32(v uint32) {294 gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24))295}296func (gen *generator) imm64(v uint64) {297 gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24),298 byte(v>>32), byte(v>>40), byte(v>>48), byte(v>>56))299}300func (gen *generator) operand16() {301 switch gen.mode {302 case iset.ModeLong64, iset.ModeProt32:303 gen.byte(0x66)304 case iset.ModeProt16, iset.ModeReal16:305 default:306 panic("bad mode")307 }308}309func (gen *generator) operand32() {310 switch gen.mode {311 case iset.ModeLong64, iset.ModeProt32:312 case iset.ModeProt16, iset.ModeReal16:313 gen.byte(0x66)314 default:315 panic("bad mode")316 }317}318func (gen *generator) addr32() {319 switch gen.mode {320 case iset.ModeLong64, iset.ModeProt32:321 case iset.ModeProt16, iset.ModeReal16:322 gen.byte(0x67)323 default:324 panic("bad mode")325 }326}327func (gen *generator) mov8(reg int, v uint8) {328 switch reg {329 case regAL:330 gen.byte(0xb0)331 case regCL:332 gen.byte(0xb1)333 case regDL:334 gen.byte(0xb2)335 default:336 panic("unknown register")337 }338 gen.byte(v)339}340func (gen *generator) mov16(reg int, v uint16) {341 gen.operand16()342 switch reg {343 case regAX:344 gen.byte(0xb8)345 case regCX:346 gen.byte(0xb9)347 case regDX:348 gen.byte(0xba)349 default:350 panic("unknown register")351 }352 gen.imm16(v)353}354func (gen *generator) mov32(reg int, v uint32) {355 gen.operand32()356 switch reg {357 case regEAX:358 gen.byte(0xb8)359 case regECX:360 gen.byte(0xb9)361 case regEDX:362 gen.byte(0xba)363 default:364 panic("unknown register")365 }366 gen.imm32(v)367}368func (gen *generator) mov64(reg int, v uint64) {369 if gen.mode != iset.ModeLong64 {370 panic("bad mode")371 }372 gen.byte(0x48)373 switch reg {374 case regRAX:375 gen.byte(0xb8)376 case regRCX:377 gen.byte(0xb9)378 case regRDX:379 gen.byte(0xba)380 default:381 panic("unknown register")382 }383 gen.imm64(v)384}385// movl $v, off(%rsp).386func (gen *generator) mov32toSPaddr(v uint32, off uint8) {387 gen.addr32()388 gen.operand32()389 gen.byte(0xc7, 0x44, 0x24, off)390 gen.imm32(v)391}392func (gen *generator) xor32(reg int, v uint32) {393 gen.operand32()394 switch reg {395 case regEAX:396 gen.byte(0x35)397 default:398 panic("unknown register")399 }400 gen.imm32(v)401}402func (gen *generator) readCR(cr uint8) {403 if cr < 8 {404 // MOV %crN, %eax/%rax405 gen.byte(0x0f, 0x20, 0xc0|cr<<3)406 } else if cr < 16 {407 // MOV %crN, %eax/%rax408 gen.byte(0x44, 0x0f, 0x20, 0xc0|(cr-8)<<3)409 } else {410 panic("bad cr")411 }412}413func (gen *generator) writeCR(cr uint8) {414 if cr < 8 {415 // MOV %eax/%rax, %crN416 gen.byte(0x0f, 0x22, 0xc0|cr<<3)417 } else if cr < 16 {418 // MOV %eax/%rax, %crN419 gen.byte(0x44, 0x0f, 0x22, 0xc0|(cr-8)<<3)420 } else {421 panic("bad cr")422 }423}424func (gen *generator) readDR(dr uint8) {425 if dr >= 8 {426 panic("bad dr")427 }428 // MOV %drN, %eax/%rax429 gen.byte(0x0f, 0x21, 0xc0|dr<<3)430}431func (gen *generator) writeDR(dr uint8) {432 if dr >= 8 {433 panic("bad dr")434 }435 // MOV %eax/%rax, %drN436 gen.byte(0x0f, 0x23, 0xc0|dr<<3)437}438func (gen *generator) in8(port uint16) {439 gen.mov16(regDX, port)440 gen.byte(0xec) // in %al, %dx441}442func (gen *generator) in16(port uint16) {443 gen.mov16(regDX, port)444 gen.operand16()445 gen.byte(0xed) // in %ax, %dx446}447func (gen *generator) in32(port uint16) {448 gen.mov16(regDX, port)449 gen.operand32()450 gen.byte(0xed) // in %eax, %dx451}452func (gen *generator) in(port uint16, size int) {453 switch size {454 case 0:455 gen.in8(port)456 case 1:457 gen.in16(port)458 case 2:459 gen.in32(port)460 default:461 panic("bad size")462 }463}464func (gen *generator) out8(port uint16, v uint8) {465 gen.mov16(regDX, port)466 gen.mov8(regAL, v)467 gen.byte(0xee) // out %dx, %al468}469func (gen *generator) out16(port, v uint16) {470 gen.mov16(regDX, port)471 gen.mov16(regAX, v)472 gen.operand16()473 gen.byte(0xef) // out %dx, %ax474}475func (gen *generator) out32(port uint16, v uint32) {476 gen.mov16(regDX, port)477 gen.mov32(regEAX, v)478 gen.operand32()479 gen.byte(0xef) // out %dx, %eax480}481func (gen *generator) out(port uint16, v uint32, size int) {482 switch size {483 case 0:484 gen.out8(port, uint8(v))485 case 1:486 gen.out16(port, uint16(v))487 case 2:488 gen.out32(port, v)489 default:490 panic("bad size")491 }...
ldpe.go
Source:ldpe.go
1// Copyright 2010 The Go Authors. All rights reserved.2// Use of this source code is governed by a BSD-style3// license that can be found in the LICENSE file.4// Package loadpe implements a PE/COFF file reader.5package loadpe6import (7 "cmd/internal/bio"8 "cmd/internal/objabi"9 "cmd/internal/sys"10 "cmd/oldlink/internal/loader"11 "cmd/oldlink/internal/sym"12 "debug/pe"13 "encoding/binary"14 "errors"15 "fmt"16 "io"17 "sort"18 "strings"19)20const (21 // TODO: the Microsoft doco says IMAGE_SYM_DTYPE_ARRAY is 3 (same with IMAGE_SYM_DTYPE_POINTER and IMAGE_SYM_DTYPE_FUNCTION)22 IMAGE_SYM_UNDEFINED = 023 IMAGE_SYM_ABSOLUTE = -124 IMAGE_SYM_DEBUG = -225 IMAGE_SYM_TYPE_NULL = 026 IMAGE_SYM_TYPE_VOID = 127 IMAGE_SYM_TYPE_CHAR = 228 IMAGE_SYM_TYPE_SHORT = 329 IMAGE_SYM_TYPE_INT = 430 IMAGE_SYM_TYPE_LONG = 531 IMAGE_SYM_TYPE_FLOAT = 632 IMAGE_SYM_TYPE_DOUBLE = 733 IMAGE_SYM_TYPE_STRUCT = 834 IMAGE_SYM_TYPE_UNION = 935 IMAGE_SYM_TYPE_ENUM = 1036 IMAGE_SYM_TYPE_MOE = 1137 IMAGE_SYM_TYPE_BYTE = 1238 IMAGE_SYM_TYPE_WORD = 1339 IMAGE_SYM_TYPE_UINT = 1440 IMAGE_SYM_TYPE_DWORD = 1541 IMAGE_SYM_TYPE_PCODE = 3276842 IMAGE_SYM_DTYPE_NULL = 043 IMAGE_SYM_DTYPE_POINTER = 0x1044 IMAGE_SYM_DTYPE_FUNCTION = 0x2045 IMAGE_SYM_DTYPE_ARRAY = 0x3046 IMAGE_SYM_CLASS_END_OF_FUNCTION = -147 IMAGE_SYM_CLASS_NULL = 048 IMAGE_SYM_CLASS_AUTOMATIC = 149 IMAGE_SYM_CLASS_EXTERNAL = 250 IMAGE_SYM_CLASS_STATIC = 351 IMAGE_SYM_CLASS_REGISTER = 452 IMAGE_SYM_CLASS_EXTERNAL_DEF = 553 IMAGE_SYM_CLASS_LABEL = 654 IMAGE_SYM_CLASS_UNDEFINED_LABEL = 755 IMAGE_SYM_CLASS_MEMBER_OF_STRUCT = 856 IMAGE_SYM_CLASS_ARGUMENT = 957 IMAGE_SYM_CLASS_STRUCT_TAG = 1058 IMAGE_SYM_CLASS_MEMBER_OF_UNION = 1159 IMAGE_SYM_CLASS_UNION_TAG = 1260 IMAGE_SYM_CLASS_TYPE_DEFINITION = 1361 IMAGE_SYM_CLASS_UNDEFINED_STATIC = 1462 IMAGE_SYM_CLASS_ENUM_TAG = 1563 IMAGE_SYM_CLASS_MEMBER_OF_ENUM = 1664 IMAGE_SYM_CLASS_REGISTER_PARAM = 1765 IMAGE_SYM_CLASS_BIT_FIELD = 1866 IMAGE_SYM_CLASS_FAR_EXTERNAL = 68 /* Not in PECOFF v8 spec */67 IMAGE_SYM_CLASS_BLOCK = 10068 IMAGE_SYM_CLASS_FUNCTION = 10169 IMAGE_SYM_CLASS_END_OF_STRUCT = 10270 IMAGE_SYM_CLASS_FILE = 10371 IMAGE_SYM_CLASS_SECTION = 10472 IMAGE_SYM_CLASS_WEAK_EXTERNAL = 10573 IMAGE_SYM_CLASS_CLR_TOKEN = 10774 IMAGE_REL_I386_ABSOLUTE = 0x000075 IMAGE_REL_I386_DIR16 = 0x000176 IMAGE_REL_I386_REL16 = 0x000277 IMAGE_REL_I386_DIR32 = 0x000678 IMAGE_REL_I386_DIR32NB = 0x000779 IMAGE_REL_I386_SEG12 = 0x000980 IMAGE_REL_I386_SECTION = 0x000A81 IMAGE_REL_I386_SECREL = 0x000B82 IMAGE_REL_I386_TOKEN = 0x000C83 IMAGE_REL_I386_SECREL7 = 0x000D84 IMAGE_REL_I386_REL32 = 0x001485 IMAGE_REL_AMD64_ABSOLUTE = 0x000086 IMAGE_REL_AMD64_ADDR64 = 0x000187 IMAGE_REL_AMD64_ADDR32 = 0x000288 IMAGE_REL_AMD64_ADDR32NB = 0x000389 IMAGE_REL_AMD64_REL32 = 0x000490 IMAGE_REL_AMD64_REL32_1 = 0x000591 IMAGE_REL_AMD64_REL32_2 = 0x000692 IMAGE_REL_AMD64_REL32_3 = 0x000793 IMAGE_REL_AMD64_REL32_4 = 0x000894 IMAGE_REL_AMD64_REL32_5 = 0x000995 IMAGE_REL_AMD64_SECTION = 0x000A96 IMAGE_REL_AMD64_SECREL = 0x000B97 IMAGE_REL_AMD64_SECREL7 = 0x000C98 IMAGE_REL_AMD64_TOKEN = 0x000D99 IMAGE_REL_AMD64_SREL32 = 0x000E100 IMAGE_REL_AMD64_PAIR = 0x000F101 IMAGE_REL_AMD64_SSPAN32 = 0x0010102 IMAGE_REL_ARM_ABSOLUTE = 0x0000103 IMAGE_REL_ARM_ADDR32 = 0x0001104 IMAGE_REL_ARM_ADDR32NB = 0x0002105 IMAGE_REL_ARM_BRANCH24 = 0x0003106 IMAGE_REL_ARM_BRANCH11 = 0x0004107 IMAGE_REL_ARM_SECTION = 0x000E108 IMAGE_REL_ARM_SECREL = 0x000F109 IMAGE_REL_ARM_MOV32 = 0x0010110 IMAGE_REL_THUMB_MOV32 = 0x0011111 IMAGE_REL_THUMB_BRANCH20 = 0x0012112 IMAGE_REL_THUMB_BRANCH24 = 0x0014113 IMAGE_REL_THUMB_BLX23 = 0x0015114 IMAGE_REL_ARM_PAIR = 0x0016115)116// TODO(crawshaw): de-duplicate these symbols with cmd/internal/ld, ideally in debug/pe.117const (118 IMAGE_SCN_CNT_CODE = 0x00000020119 IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040120 IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080121 IMAGE_SCN_MEM_DISCARDABLE = 0x02000000122 IMAGE_SCN_MEM_EXECUTE = 0x20000000123 IMAGE_SCN_MEM_READ = 0x40000000124 IMAGE_SCN_MEM_WRITE = 0x80000000125)126// TODO(brainman): maybe just add ReadAt method to bio.Reader instead of creating peBiobuf127// peBiobuf makes bio.Reader look like io.ReaderAt.128type peBiobuf bio.Reader129func (f *peBiobuf) ReadAt(p []byte, off int64) (int, error) {130 ret := ((*bio.Reader)(f)).MustSeek(off, 0)131 if ret < 0 {132 return 0, errors.New("fail to seek")133 }134 n, err := f.Read(p)135 if err != nil {136 return 0, err137 }138 return n, nil139}140func Load(l *loader.Loader, arch *sys.Arch, syms *sym.Symbols, input *bio.Reader, pkg string, length int64, pn string) (textp []*sym.Symbol, rsrc *sym.Symbol, err error) {141 lookup := func(name string, version int) *sym.Symbol {142 return l.LookupOrCreate(name, version, syms)143 }144 return load(arch, lookup, syms.IncVersion(), input, pkg, length, pn)145}146func LoadOld(arch *sys.Arch, syms *sym.Symbols, input *bio.Reader, pkg string, length int64, pn string) (textp []*sym.Symbol, rsrc *sym.Symbol, err error) {147 return load(arch, syms.Lookup, syms.IncVersion(), input, pkg, length, pn)148}149// load loads the PE file pn from input.150// Symbols are written into syms, and a slice of the text symbols is returned.151// If an .rsrc section is found, its symbol is returned as rsrc.152func load(arch *sys.Arch, lookup func(string, int) *sym.Symbol, localSymVersion int, input *bio.Reader, pkg string, length int64, pn string) (textp []*sym.Symbol, rsrc *sym.Symbol, err error) {153 sectsyms := make(map[*pe.Section]*sym.Symbol)154 sectdata := make(map[*pe.Section][]byte)155 // Some input files are archives containing multiple of156 // object files, and pe.NewFile seeks to the start of157 // input file and get confused. Create section reader158 // to stop pe.NewFile looking before current position.159 sr := io.NewSectionReader((*peBiobuf)(input), input.Offset(), 1<<63-1)160 // TODO: replace pe.NewFile with pe.Load (grep for "add Load function" in debug/pe for details)161 f, err := pe.NewFile(sr)162 if err != nil {163 return nil, nil, err164 }165 defer f.Close()166 // TODO return error if found .cormeta167 // create symbols for mapped sections168 for _, sect := range f.Sections {169 if sect.Characteristics&IMAGE_SCN_MEM_DISCARDABLE != 0 {170 continue171 }172 if sect.Characteristics&(IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA) == 0 {173 // This has been seen for .idata sections, which we174 // want to ignore. See issues 5106 and 5273.175 continue176 }177 name := fmt.Sprintf("%s(%s)", pkg, sect.Name)178 s := lookup(name, localSymVersion)179 switch sect.Characteristics & (IMAGE_SCN_CNT_UNINITIALIZED_DATA | IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE | IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE) {180 case IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ: //.rdata181 s.Type = sym.SRODATA182 case IMAGE_SCN_CNT_UNINITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE: //.bss183 s.Type = sym.SNOPTRBSS184 case IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE: //.data185 s.Type = sym.SNOPTRDATA186 case IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ: //.text187 s.Type = sym.STEXT188 default:189 return nil, nil, fmt.Errorf("unexpected flags %#06x for PE section %s", sect.Characteristics, sect.Name)190 }191 if s.Type != sym.SNOPTRBSS {192 data, err := sect.Data()193 if err != nil {194 return nil, nil, err195 }196 sectdata[sect] = data197 s.P = data198 }199 s.Size = int64(sect.Size)200 sectsyms[sect] = s201 if sect.Name == ".rsrc" {202 rsrc = s203 }204 }205 // load relocations206 for _, rsect := range f.Sections {207 if _, found := sectsyms[rsect]; !found {208 continue209 }210 if rsect.NumberOfRelocations == 0 {211 continue212 }213 if rsect.Characteristics&IMAGE_SCN_MEM_DISCARDABLE != 0 {214 continue215 }216 if rsect.Characteristics&(IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA) == 0 {217 // This has been seen for .idata sections, which we218 // want to ignore. See issues 5106 and 5273.219 continue220 }221 rs := make([]sym.Reloc, rsect.NumberOfRelocations)222 for j, r := range rsect.Relocs {223 rp := &rs[j]224 if int(r.SymbolTableIndex) >= len(f.COFFSymbols) {225 return nil, nil, fmt.Errorf("relocation number %d symbol index idx=%d cannot be large then number of symbols %d", j, r.SymbolTableIndex, len(f.COFFSymbols))226 }227 pesym := &f.COFFSymbols[r.SymbolTableIndex]228 gosym, err := readpesym(arch, lookup, f, pesym, sectsyms, localSymVersion)229 if err != nil {230 return nil, nil, err231 }232 if gosym == nil {233 name, err := pesym.FullName(f.StringTable)234 if err != nil {235 name = string(pesym.Name[:])236 }237 return nil, nil, fmt.Errorf("reloc of invalid sym %s idx=%d type=%d", name, r.SymbolTableIndex, pesym.Type)238 }239 rp.Sym = gosym240 rp.Siz = 4241 rp.Off = int32(r.VirtualAddress)242 switch arch.Family {243 default:244 return nil, nil, fmt.Errorf("%s: unsupported arch %v", pn, arch.Family)245 case sys.I386, sys.AMD64:246 switch r.Type {247 default:248 return nil, nil, fmt.Errorf("%s: %v: unknown relocation type %v", pn, sectsyms[rsect], r.Type)249 case IMAGE_REL_I386_REL32, IMAGE_REL_AMD64_REL32,250 IMAGE_REL_AMD64_ADDR32, // R_X86_64_PC32251 IMAGE_REL_AMD64_ADDR32NB:252 rp.Type = objabi.R_PCREL253 rp.Add = int64(int32(binary.LittleEndian.Uint32(sectdata[rsect][rp.Off:])))254 case IMAGE_REL_I386_DIR32NB, IMAGE_REL_I386_DIR32:255 rp.Type = objabi.R_ADDR256 // load addend from image257 rp.Add = int64(int32(binary.LittleEndian.Uint32(sectdata[rsect][rp.Off:])))258 case IMAGE_REL_AMD64_ADDR64: // R_X86_64_64259 rp.Siz = 8260 rp.Type = objabi.R_ADDR261 // load addend from image262 rp.Add = int64(binary.LittleEndian.Uint64(sectdata[rsect][rp.Off:]))263 }264 case sys.ARM:265 switch r.Type {266 default:267 return nil, nil, fmt.Errorf("%s: %v: unknown ARM relocation type %v", pn, sectsyms[rsect], r.Type)268 case IMAGE_REL_ARM_SECREL:269 rp.Type = objabi.R_PCREL270 rp.Add = int64(int32(binary.LittleEndian.Uint32(sectdata[rsect][rp.Off:])))271 case IMAGE_REL_ARM_ADDR32:272 rp.Type = objabi.R_ADDR273 rp.Add = int64(int32(binary.LittleEndian.Uint32(sectdata[rsect][rp.Off:])))274 case IMAGE_REL_ARM_BRANCH24:275 rp.Type = objabi.R_CALLARM276 rp.Add = int64(int32(binary.LittleEndian.Uint32(sectdata[rsect][rp.Off:])))277 }278 }279 // ld -r could generate multiple section symbols for the280 // same section but with different values, we have to take281 // that into account282 if issect(pesym) {283 rp.Add += int64(pesym.Value)284 }285 }286 sort.Sort(sym.RelocByOff(rs[:rsect.NumberOfRelocations]))287 s := sectsyms[rsect]288 s.R = rs289 s.R = s.R[:rsect.NumberOfRelocations]290 }291 // enter sub-symbols into symbol table.292 for i, numaux := 0, 0; i < len(f.COFFSymbols); i += numaux + 1 {293 pesym := &f.COFFSymbols[i]294 numaux = int(pesym.NumberOfAuxSymbols)295 name, err := pesym.FullName(f.StringTable)296 if err != nil {297 return nil, nil, err298 }299 if name == "" {300 continue301 }302 if issect(pesym) {303 continue304 }305 if int(pesym.SectionNumber) > len(f.Sections) {306 continue307 }308 if pesym.SectionNumber == IMAGE_SYM_DEBUG {309 continue310 }311 var sect *pe.Section312 if pesym.SectionNumber > 0 {313 sect = f.Sections[pesym.SectionNumber-1]314 if _, found := sectsyms[sect]; !found {315 continue316 }317 }318 s, err := readpesym(arch, lookup, f, pesym, sectsyms, localSymVersion)319 if err != nil {320 return nil, nil, err321 }322 if pesym.SectionNumber == 0 { // extern323 if s.Type == sym.SDYNIMPORT {324 s.SetPlt(-2) // flag for dynimport in PE object files.325 }326 if s.Type == sym.SXREF && pesym.Value > 0 { // global data327 s.Type = sym.SNOPTRDATA328 s.Size = int64(pesym.Value)329 }330 continue331 } else if pesym.SectionNumber > 0 && int(pesym.SectionNumber) <= len(f.Sections) {332 sect = f.Sections[pesym.SectionNumber-1]333 if _, found := sectsyms[sect]; !found {334 return nil, nil, fmt.Errorf("%s: %v: missing sect.sym", pn, s)335 }336 } else {337 return nil, nil, fmt.Errorf("%s: %v: sectnum < 0!", pn, s)338 }339 if sect == nil {340 return nil, rsrc, nil341 }342 if s.Outer != nil {343 if s.Attr.DuplicateOK() {344 continue345 }346 return nil, nil, fmt.Errorf("%s: duplicate symbol reference: %s in both %s and %s", pn, s.Name, s.Outer.Name, sectsyms[sect].Name)347 }348 sectsym := sectsyms[sect]349 s.Sub = sectsym.Sub350 sectsym.Sub = s351 s.Type = sectsym.Type352 s.Attr |= sym.AttrSubSymbol353 s.Value = int64(pesym.Value)354 s.Size = 4355 s.Outer = sectsym356 if sectsym.Type == sym.STEXT {357 if s.Attr.External() && !s.Attr.DuplicateOK() {358 return nil, nil, fmt.Errorf("%s: duplicate symbol definition", s.Name)359 }360 s.Attr |= sym.AttrExternal361 }362 }363 // Sort outer lists by address, adding to textp.364 // This keeps textp in increasing address order.365 for _, sect := range f.Sections {366 s := sectsyms[sect]367 if s == nil {368 continue369 }370 if s.Sub != nil {371 s.Sub = sym.SortSub(s.Sub)372 }373 if s.Type == sym.STEXT {374 if s.Attr.OnList() {375 return nil, nil, fmt.Errorf("symbol %s listed multiple times", s.Name)376 }377 s.Attr |= sym.AttrOnList378 textp = append(textp, s)379 for s = s.Sub; s != nil; s = s.Sub {380 if s.Attr.OnList() {381 return nil, nil, fmt.Errorf("symbol %s listed multiple times", s.Name)382 }383 s.Attr |= sym.AttrOnList384 textp = append(textp, s)385 }386 }387 }388 return textp, rsrc, nil389}390func issect(s *pe.COFFSymbol) bool {391 return s.StorageClass == IMAGE_SYM_CLASS_STATIC && s.Type == 0 && s.Name[0] == '.'392}393func readpesym(arch *sys.Arch, lookup func(string, int) *sym.Symbol, f *pe.File, pesym *pe.COFFSymbol, sectsyms map[*pe.Section]*sym.Symbol, localSymVersion int) (*sym.Symbol, error) {394 symname, err := pesym.FullName(f.StringTable)395 if err != nil {396 return nil, err397 }398 var name string399 if issect(pesym) {400 name = sectsyms[f.Sections[pesym.SectionNumber-1]].Name401 } else {402 name = symname403 switch arch.Family {404 case sys.AMD64:405 if name == "__imp___acrt_iob_func" {406 // Do not rename __imp___acrt_iob_func into __acrt_iob_func,407 // because __imp___acrt_iob_func symbol is real408 // (see commit b295099 from git://git.code.sf.net/p/mingw-w64/mingw-w64 for details).409 } else {410 name = strings.TrimPrefix(name, "__imp_") // __imp_Name => Name411 }412 case sys.I386:413 if name == "__imp____acrt_iob_func" {414 // Do not rename __imp____acrt_iob_func into ___acrt_iob_func,415 // because __imp____acrt_iob_func symbol is real416 // (see commit b295099 from git://git.code.sf.net/p/mingw-w64/mingw-w64 for details).417 } else {418 name = strings.TrimPrefix(name, "__imp_") // __imp_Name => Name419 }420 if name[0] == '_' {421 name = name[1:] // _Name => Name422 }423 }424 }425 // remove last @XXX426 if i := strings.LastIndex(name, "@"); i >= 0 {427 name = name[:i]428 }429 var s *sym.Symbol430 switch pesym.Type {431 default:432 return nil, fmt.Errorf("%s: invalid symbol type %d", symname, pesym.Type)433 case IMAGE_SYM_DTYPE_FUNCTION, IMAGE_SYM_DTYPE_NULL:434 switch pesym.StorageClass {435 case IMAGE_SYM_CLASS_EXTERNAL: //global436 s = lookup(name, 0)437 case IMAGE_SYM_CLASS_NULL, IMAGE_SYM_CLASS_STATIC, IMAGE_SYM_CLASS_LABEL:438 s = lookup(name, localSymVersion)439 s.Attr |= sym.AttrDuplicateOK440 default:441 return nil, fmt.Errorf("%s: invalid symbol binding %d", symname, pesym.StorageClass)442 }443 }444 if s != nil && s.Type == 0 && (pesym.StorageClass != IMAGE_SYM_CLASS_STATIC || pesym.Value != 0) {445 s.Type = sym.SXREF446 }447 if strings.HasPrefix(symname, "__imp_") {448 s.SetGot(-2) // flag for __imp_449 }450 return s, nil451}...
mov32
Using AI Code Generation
1import "fmt"2type x86 struct {3}4func (x *x86) mov32() int32 {5}6func main() {7 x := x86{a: 10, b: 20}8 fmt.Println(x.mov32())9}
mov32
Using AI Code Generation
1import (2func main() {3 x.Mov32(0x12345678, 0x12345678)4 fmt.Println(x)5}6import (7func main() {8 x.Mov32(0x12345678, 0x12345678)9 x.Mov32(0x12345678, 0x12345678)10 fmt.Println(x)11}12import (13func main() {14 x.Mov32(0x12345678, 0x12345678)15 x.Mov32(0x12345678, 0x12345678)16 x.Mov32(0x12345678, 0x12345678)17 fmt.Println(x)18}
mov32
Using AI Code Generation
1import (2type Win32_Processor struct {3}4type Win32_PhysicalMemory struct {5}6type Win32_Battery struct {7}8type Win32_VideoController struct {9}10type Win32_OperatingSystem struct {11}12type Win32_ComputerSystem struct {13}14type Win32_Keyboard struct {15}16type Win32_PointingDevice struct {17}18type Win32_DiskDrive struct {19}20type Win32_DiskPartition struct {21}22type Win32_LogicalDisk struct {23}24type Win32_LogicalDiskToPartition struct {25}
mov32
Using AI Code Generation
1import (2type X86 struct {3}4func (x *X86) mov32(from, to int) {5 fmt.Println("mov32 called")6}7func main() {8 pretty.Println(x)9 x.mov32(1, 2)10}11import (12type X86 struct {13}14func (x *X86) mov32(from, to int) {15 fmt.Println("mov32 called")16}17func main() {18 pretty.Println(x)19 x.mov32(1, 2)20}21import (22type X86 struct {23}24func (x *X86) mov32(from, to int) {25 fmt.Println("mov32 called")26}27func main() {28 pretty.Println(x)29 x.mov32(1, 2)30}31import (32type X86 struct {33}34func (x *X86) mov32(from, to int) {35 fmt.Println("mov32 called")36}37func main() {38 pretty.Println(x)39 x.mov32(1, 2)40}41import (42type X86 struct {43}44func (x *X86) mov32(from, to int) {45 fmt.Println("mov32 called")46}47func main() {48 pretty.Println(x)49 x.mov32(1, 2)50}
Automation Testing Tutorials
Learn to execute automation testing from scratch with LambdaTest Learning Hub. Right from setting up the prerequisites to run your first automation test, to following best practices and diving deeper into advanced test scenarios. LambdaTest Learning Hubs compile a list of step-by-step guides to help you be proficient with different test automation frameworks i.e. Selenium, Cypress, TestNG etc.
LambdaTest Learning Hubs:
- JUnit Tutorial
- TestNG Tutorial
- Webdriver Tutorial
- WebDriverIO Tutorial
- Protractor Tutorial
- Selenium 4 Tutorial
- Jenkins Tutorial
- NUnit Tutorial
- Jest Tutorial
- Playwright Tutorial
- Cypress Tutorial
- PyTest Tutorial
YouTube
You could also refer to video tutorials over LambdaTest YouTube channel to get step by step demonstration from industry experts.
Run Syzkaller automation tests on LambdaTest cloud grid
Perform automation testing on 3000+ real desktop and mobile devices online.
Try LambdaTest Now !!
Get 100 minutes of automation test minutes FREE!!
Was this article helpful?
