MCPcopy Create free account
hub / github.com/beefytech/Beef / GetDbgBreakKind

Method GetDbgBreakKind

IDEHelper/X64.cpp:995–1079  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

993}
994
995DbgBreakKind X64CPU::GetDbgBreakKind(uint64 address, DbgModuleMemoryCache* memoryCache, int64* regs, int64* outObjectPtr)
996{
997 // We've looking for a CMP BYTE PTR [<reg>], -0x80
998 // if <reg> is R12 then encoding takes an extra 2 bytes
999 X64Instr inst;
1000 for (int checkLen = 5; checkLen >= 3; checkLen--)
1001 {
1002 int offset = -3 - checkLen;
1003
1004 if (!Decode(address + offset, memoryCache, &inst))
1005 continue;
1006
1007 if (inst.GetLength() != checkLen)
1008 continue;
1009
1010 const MCInstrDesc &instDesc = mInstrInfo->get(inst.mMCInst.getOpcode());
1011 if (!instDesc.isCompare())
1012 continue;
1013
1014 auto immediateType = (instDesc.TSFlags & llvm::X86II::ImmMask);
1015 if ((immediateType == llvm::X86II::Imm8) && (inst.mMCInst.getNumOperands() == 2))
1016 {
1017 // We're checking for a TEST [<reg>], 1
1018 if (inst.mMCInst.getOpcode() != llvm::X86::TEST8ri)
1019 continue;
1020 auto immOp = inst.mMCInst.getOperand(1);
1021 if (!immOp.isImm())
1022 continue;
1023 if (immOp.getImm() != 1)
1024 continue;
1025 return DbgBreakKind_ArithmeticOverflow;
1026 }
1027
1028 if ((immediateType == 0) || (inst.mMCInst.getNumOperands() < 6))
1029 continue;
1030
1031 auto form = (instDesc.TSFlags & llvm::X86II::FormMask);
1032
1033 auto baseReg = inst.mMCInst.getOperand(llvm::X86::AddrBaseReg);
1034 /*auto scaleAmt = inst.mMCInst.getOperand(llvm::X86::AddrScaleAmt);
1035 auto indexReg = inst.mMCInst.getOperand(llvm::X86::AddrIndexReg);
1036 auto addrDisp = inst.mMCInst.getOperand(llvm::X86::AddrDisp);*/
1037
1038 auto immOp = inst.mMCInst.getOperand(5);
1039 if (!immOp.isImm())
1040 continue;
1041 if (immOp.getImm() != -0x80)
1042 continue;
1043
1044 int regNum = ConvertRegNum(baseReg);
1045 if (regNum == -1)
1046 continue;
1047
1048 *outObjectPtr = (uint64)regs[regNum];
1049
1050 return DbgBreakKind_ObjectAccess;
1051 }
1052

Callers

nothing calls this directly

Calls 3

ConvertRegNumFunction · 0.70
GetLengthMethod · 0.45
getMethod · 0.45

Tested by

no test coverage detected