Skip to content

Instantly share code, notes, and snippets.

@alexhude

alexhude/aarch64_cryptoextension_ida7.diff

Created November 4, 2017 10:08
Show Gist options
  • Save alexhude/5811e9f355d871262c4dc33676ef86e9 to your computer and use it in GitHub Desktop.
Save alexhude/5811e9f355d871262c4dc33676ef86e9 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
aarch64_cryptoextension_ida7.diff
diff --git a/aarch64_cryptoextension.cpp b/aarch64_cryptoextension.cpp
index ed167e3..6dd5309 100644
--- a/aarch64_cryptoextension.cpp
+++ b/aarch64_cryptoextension.cpp
@@ -5,6 +5,22 @@
#include <kernwin.hpp>
#include <allins.hpp>
+#if (IDA_SDK_VERSION < 700) && defined(__X64__)
+ #error Incompatible SDK version. Please use SDK 7.0 or higher
+#elif (IDA_SDK_VERSION >= 700) && !defined(__X64__)
+ #error Incompatible SDK version. Please use SDK 6.95 or lower
+#endif
+
+#if IDA_SDK_VERSION >= 700
+ #define idaapi_hook_cb_ret_t ssize_t
+ #define idaapi_get_dword get_dword
+ #define op_dtype dtype
+#else
+ #define idaapi_hook_cb_ret_t int
+ #define idaapi_get_dword get_long
+ #define op_dtype dtyp
+#endif
+
#ifndef __EA64__
#error This extension only makes sense in a 64bit context
#endif
@@ -12,8 +28,6 @@
#define MAGIC_ACTIVATED 333
#define MAGIC_DEACTIVATED 777
-static ea_t ea;
-
inline bool is_arm64_ea(ea_t ea)
{
segment_t *seg = getseg(ea);
@@ -30,9 +44,9 @@ inline bool is_arm64_ea(ea_t ea)
#define S0 93
#define V0 163
-static size_t ana(void)
+static size_t ana(insn_t* inst)
{
- uint32_t code = get_long(ea++);
+ uint32_t code = idaapi_get_dword(inst->ea);
uint32_t Rn, Rd, Rm;
if ((code & 0xFFFF0C00) == 0x4E280800) {
@@ -41,52 +55,52 @@ static size_t ana(void)
Rd += V0;
Rn += V0;
if ((code & 0xF000) == 0x5000) {
- cmd.itype = ARM_aesd;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.simd_sz = 1;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 1;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_aesd;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.simd_sz = 1;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 1;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xF000) == 0x4000) {
- cmd.itype = ARM_aese;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.simd_sz = 1;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 1;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_aese;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.simd_sz = 1;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 1;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xF000) == 0x7000) {
- cmd.itype = ARM_aesimc;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.simd_sz = 1;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 1;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_aesimc;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.simd_sz = 1;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 1;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xF000) == 0x6000) {
- cmd.itype = ARM_aesmc;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.simd_sz = 1;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 1;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_aesmc;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.simd_sz = 1;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 1;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
}
} else if ((code & 0xFFE0FC00) == 0x5E000000) {
@@ -96,32 +110,32 @@ static size_t ana(void)
Rd += Q0;
Rn += S0;
Rm += V0;
- cmd.itype = ARM_sha1c;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_dword;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha1c;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_dword;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFFFFC00) == 0x5E280800) {
Rn = (code >> 5) & 31;
Rd = (code) & 31;
Rd += S0;
Rn += S0;
- cmd.itype = ARM_sha1h;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_dword;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_dword;
+ inst->itype = ARM_sha1h;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_dword;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_dword;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E002000) {
Rn = (code >> 5) & 31;
@@ -130,18 +144,18 @@ static size_t ana(void)
Rd += Q0;
Rn += S0;
Rm += V0;
- cmd.itype = ARM_sha1m;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_dword;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha1m;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_dword;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E001000) {
Rn = (code >> 5) & 31;
@@ -150,18 +164,18 @@ static size_t ana(void)
Rd += Q0;
Rn += S0;
Rm += V0;
- cmd.itype = ARM_sha1p;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_dword;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha1p;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_dword;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E003000) {
Rn = (code >> 5) & 31;
@@ -170,36 +184,36 @@ static size_t ana(void)
Rd += V0;
Rn += V0;
Rm += V0;
- cmd.itype = ARM_sha1su0;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.simd_sz = 3;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 3;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha1su0;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.simd_sz = 3;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 3;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFFFFC00) == 0x5E281800) {
Rn = (code >> 5) & 31;
Rd = (code) & 31;
Rd += V0;
Rn += V0;
- cmd.itype = ARM_sha1su1;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.simd_sz = 3;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 3;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_sha1su1;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.simd_sz = 3;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 3;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E005000) {
Rn = (code >> 5) & 31;
@@ -208,18 +222,18 @@ static size_t ana(void)
Rd += Q0;
Rn += Q0;
Rm += V0;
- cmd.itype = ARM_sha256h2;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha256h2;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E004000) {
Rn = (code >> 5) & 31;
@@ -228,34 +242,34 @@ static size_t ana(void)
Rd += Q0;
Rn += Q0;
Rm += V0;
- cmd.itype = ARM_sha256h;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha256h;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFFFFC00) == 0x5E282800) {
Rn = (code >> 5) & 31;
Rd = (code) & 31;
Rd += V0;
Rn += V0;
- cmd.itype = ARM_sha256su0;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.simd_sz = 3;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 3;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
+ inst->itype = ARM_sha256su0;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.simd_sz = 3;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 3;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
return 4;
} else if ((code & 0xFFE0FC00) == 0x5E006000) {
Rn = (code >> 5) & 31;
@@ -264,38 +278,45 @@ static size_t ana(void)
Rd += V0;
Rn += V0;
Rm += V0;
- cmd.itype = ARM_sha256su1;
- cmd.cond = cAL;
- cmd.Op1.type = o_reg;
- cmd.Op1.reg = Rd;
- cmd.Op1.simd_sz = 3;
- cmd.Op1.dtyp = dt_byte16;
- cmd.Op2.type = o_reg;
- cmd.Op2.simd_sz = 3;
- cmd.Op2.reg = Rn;
- cmd.Op2.dtyp = dt_byte16;
- cmd.Op3.type = o_reg;
- cmd.Op3.simd_sz = 3;
- cmd.Op3.reg = Rm;
- cmd.Op3.dtyp = dt_byte16;
+ inst->itype = ARM_sha256su1;
+ inst->cond = cAL;
+ inst->Op1.type = o_reg;
+ inst->Op1.reg = Rd;
+ inst->Op1.simd_sz = 3;
+ inst->Op1.op_dtype = dt_byte16;
+ inst->Op2.type = o_reg;
+ inst->Op2.simd_sz = 3;
+ inst->Op2.reg = Rn;
+ inst->Op2.op_dtype = dt_byte16;
+ inst->Op3.type = o_reg;
+ inst->Op3.simd_sz = 3;
+ inst->Op3.reg = Rm;
+ inst->Op3.op_dtype = dt_byte16;
return 4;
}
return 0;
}
-static int idaapi aarch64_extension_callback(void * user_data, int event_id, va_list va)
+static idaapi_hook_cb_ret_t idaapi aarch64_extension_callback(void * user_data, int event_id, va_list va)
{
switch (event_id)
{
- case processor_t::custom_ana:
+ case processor_t::ev_ana_insn:
{
- ea = cmd.ea;
- if (is_arm64_ea(ea)) {
- size_t length = ana();
+ #if IDA_SDK_VERSION >= 700
+ #define ret inst->size
+ insn_t* inst = va_arg(va, insn_t *);
+ #else
+ #define ret 2
+ insn_t* inst = &cmd;
+ #endif
+
+ if (is_arm64_ea(inst->ea)) {
+ size_t length = ana(inst);
if (length)
{
- cmd.size = (uint16)length;
- return 2;
+ inst->size = (uint16)length;
+ return ret;
}
}
}
@@ -328,7 +349,11 @@ void idaapi term(void)
unhook_from_notification_point(HT_IDP, aarch64_extension_callback);
}
+#if IDA_SDK_VERSION >= 700
+bool idaapi run(size_t /*arg*/)
+#else
void idaapi run(int /*arg*/)
+#endif
{
if (enabled) {
unhook_from_notification_point(HT_IDP, aarch64_extension_callback);
@@ -339,6 +364,10 @@ void idaapi run(int /*arg*/)
aarch64_node.create(node_name);
aarch64_node.altset(0, enabled ? MAGIC_ACTIVATED : MAGIC_DEACTIVATED);
info("AUTOHIDE NONE\n" "AArch64 crypto extension processor extender now is %s", enabled ? "enabled" : "disabled");
+
+#if IDA_SDK_VERSION >= 700
+ return true;
+#endif
}
//--------------------------------------------------------------------------
diff --git a/makefile b/makefile
index c03a888..28f4d07 100644
--- a/makefile
+++ b/makefile
@@ -2,8 +2,4 @@ PROC=aarch64_cryptoextension
include ../plugin.mak
# MAKEDEP dependency list ------------------
-$(F)aarch64_cryptoextension$(O) : $(I)area.hpp $(I)bitrange.hpp $(I)bytes.hpp $(I)fpro.h \
- $(I)funcs.hpp $(I)ida.hpp $(I)idp.hpp $(I)kernwin.hpp \
- $(I)lines.hpp $(I)llong.hpp $(I)loader.hpp $(I)nalt.hpp \
- $(I)netnode.hpp $(I)pro.h $(I)segment.hpp $(I)ua.hpp \
- $(I)xref.hpp aarch64_cryptoextension.cpp
+$(F)aarch64_cryptoextension$(O) : $(I)idp.hpp aarch64_cryptoextension.cpp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment