Skip to content

Instantly share code, notes, and snippets.

@eira-fransham
Last active March 15, 2019 09:53
Show Gist options
  • Save eira-fransham/be58f60cf2e6f063a57a09ae8ff99f75 to your computer and use it in GitHub Desktop.
Save eira-fransham/be58f60cf2e6f063a57a09ae8ff99f75 to your computer and use it in GitHub Desktop.
; rdi = vmctx
mov [rsp + 0x20], rdi
; eax = callee_idx
mov eax, 0
mov [rsp + 0x34], eax
mov rax, [rsp + 0x20]
; eax = vmctx->tables[table_idx].len
mov eax, [rax + 0x68]
; ecx = callee_idx
mov ecx, [rsp + 0x34]
; vmctx->tables[table_idx].len is `vmctx_vmtable_definition_current_elements(table_idx)` in
; `VMOffsets`
; if (callee_idx < vmctx->tables[table_idx].len) goto .Lcont0
cmp ecx, eax
jb .Lcont0
ud2
.Lcont0:
; eax = callee_idx
mov eax, [rsp + 0x34]
mov eax, eax
; rcx = vmctx
mov rcx, [rsp + 0x20]
; vmctx->tables[table_idx].base is `vmctx_vmtable_definition_base(table_idx)` in
; `VMOffsets`
; rcx = vmctx->tables[table_idx].base
mov rcx, [rcx + 0x60]
mov edx, 0x18
; rax = callee_idx * sizeof(VMTableEntry)
imul rax, rdx
mov [rsp + 0x18], rax
; rax = vmctx
mov rax, [rsp + 0x20]
; `signature_ids` maps local type ids to global type ids
; `vmctx->signature_ids[signature_idx]` is `vmctx_vmshared_signature_id(signature_idx)`
; eax = vmctx->signature_ids[signature_idx]
mov eax, [rax]
mov [rsp + 0x30], eax
; rax = callee_idx * sizeof(VMCallerCheckedAnyFunc)
mov rax, [rsp + 0x18]
; `(vmctx->tables[table_idx].base)[callee_idx].type_index` is `vmctx_vmtable_definition_base(table_idx) +
; callee_idx * size_of_vmcaller_checked_anyfunc + vmcaller_checked_anyfunc_type_index` in `VMOffsets`
; eax = (vmctx->tables[table_idx].base)[callee_idx].type_index
mov eax, [rcx + rax + 8]
; edx = vmctx->signature_ids[signature_idx]
mov edx, [rsp + 0x30]
; if ((vmctx->tables[table_idx].base)[callee_idx].type_index == vmctx->signature_ids[signature_idx])
; goto .Lcont1
cmp eax, edx
je .Lcont1
ud2
.Lcont1:
; rax = callee_idx * sizeof(VMTableEntry)
mov rax, [rsp + 0x18]
; `(vmctx->tables[table_idx].base)[callee_idx].func_ptr` is `vmctx_vmtable_definition_base(table_idx) +
; callee_idx * size_of_vmcaller_checked_anyfunc + vmcaller_checked_anyfunc_func_ptr` in `VMOffsets`
; rax = (vmctx->tables[table_idx].base)[callee_idx].func_ptr
mov rax, [rcx + rax]
; rdx = callee_idx * 0x18
mov rdx, [rsp + 0x18]
; `(vmctx->tables[table_idx].base)[callee_idx].vmctx` is `vmctx_vmtable_definition_base(table_idx) +
; callee_idx * size_of_vmcaller_checked_anyfunc + vmcaller_checked_anyfunc_vmctx` in `VMOffsets`
; rcx = (vmctx->tables[table_idx].base)[callee_idx].vmctx
mov rcx, [rcx + rdx + 0x10]
mov rdi, rcx
call rax
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment