MCPcopy Create free account
hub / github.com/beefytech/Beef / GetDbgBreakKind

Method GetDbgBreakKind

IDEHelper/X86.cpp:586–670  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

584}
585
586DbgBreakKind X86CPU::GetDbgBreakKind(uint32 address, DbgModuleMemoryCache* memoryCache, int32* regs, int32* outObjectPtr)
587{
588 // We've looking for a CMP BYTE PTR [<reg>], -0x80
589 // if <reg> is R12 then encoding takes an extra 2 bytes
590 X86Instr inst;
591 for (int checkLen = 5; checkLen >= 3; checkLen--)
592 {
593 int offset = -3 - checkLen;
594
595 if (!Decode(address + offset, memoryCache, &inst))
596 continue;
597
598 if (inst.GetLength() != checkLen)
599 continue;
600
601 const MCInstrDesc& instDesc = mInstrInfo->get(inst.mMCInst.getOpcode());
602 if (!instDesc.isCompare())
603 continue;
604
605 auto immediateType = (instDesc.TSFlags & llvm::X86II::ImmMask);
606 if ((immediateType == llvm::X86II::Imm8) && (inst.mMCInst.getNumOperands() == 2))
607 {
608 // We're checking for a TEST [<reg>], 1
609 if (inst.mMCInst.getOpcode() != llvm::X86::TEST8ri)
610 continue;
611 auto immOp = inst.mMCInst.getOperand(1);
612 if (!immOp.isImm())
613 continue;
614 if (immOp.getImm() != 1)
615 continue;
616 return DbgBreakKind_ArithmeticOverflow;
617 }
618
619 if ((immediateType == 0) || (inst.mMCInst.getNumOperands() < 6))
620 continue;
621
622 auto form = (instDesc.TSFlags & llvm::X86II::FormMask);
623
624 auto baseReg = inst.mMCInst.getOperand(llvm::X86::AddrBaseReg);
625 /*auto scaleAmt = inst.mMCInst.getOperand(llvm::X86::AddrScaleAmt);
626 auto indexReg = inst.mMCInst.getOperand(llvm::X86::AddrIndexReg);
627 auto addrDisp = inst.mMCInst.getOperand(llvm::X86::AddrDisp);*/
628
629 auto immOp = inst.mMCInst.getOperand(5);
630 if (!immOp.isImm())
631 continue;
632 if (immOp.getImm() != -0x80)
633 continue;
634
635 int regNum = ConvertRegNum(baseReg);
636 if (regNum == -1)
637 continue;
638
639 *outObjectPtr = (uint64)regs[regNum];
640
641 return DbgBreakKind_ObjectAccess;
642 }
643

Callers 1

CheckNonDebuggerBreakMethod · 0.45

Calls 3

ConvertRegNumFunction · 0.70
GetLengthMethod · 0.45
getMethod · 0.45

Tested by

no test coverage detected