-
1
-
2
-
3
-
4
-
5
-
6
-
7
-
8
-
9
-
10
-
11
-
12
-
13
-
14
-
15
-
16
-
17
-
18
-
19
-
20
-
21
-
22
-
23
-
24
-
25
-
26
-
27
-
28
-
29
-
30
-
31
-
32
-
33
-
34
-
35
-
36
-
37
-
38
-
39
-
40
-
41
-
42
-
43
-
44
-
45
-
46
-
47
-
48
-
49
-
50
-
51
-
52
-
53
-
54
-
55
-
56
-
57
-
58
-
59
-
60
-
61
-
62
-
63
-
64
-
65
-
66
-
67
-
68
-
69
-
70
-
71
-
72
-
73
-
74
-
75
-
76
-
77
-
78
-
79
-
80
-
81
-
82
-
83
-
84
-
85
-
86
-
87
-
88
-
89
-
90
-
91
-
92
-
93
-
94
-
95
-
96
-
97
-
98
-
99
-
100
-
101
-
102
-
103
-
104
-
105
-
106
-
107
-
108
-
109
-
110
-
111
-
112
-
113
-
114
-
115
-
116
-
117
-
118
-
119
-
120
-
121
-
122
-
123
-
124
-
125
-
126
-
127
-
128
-
129
-
130
-
131
-
132
-
133
-
134
-
135
-
136
-
137
-
138
-
139
-
140
-
141
-
142
-
143
-
144
-
145
-
146
-
147
-
148
-
149
-
150
-
151
-
152
-
153
-
154
-
155
-
156
-
157
-
158
-
159
-
160
-
161
-
162
-
163
-
164
-
165
-
166
-
167
-
168
-
169
-
170
-
171
-
172
-
173
-
174
-
175
-
176
-
177
-
178
-
179
-
180
-
181
-
182
-
183
-
184
-
185
-
186
-
187
-
188
-
189
-
190
-
191
-
192
-
193
-
194
-
195
-
196
-
197
-
198
-
199
-
200
-
201
-
202
-
203
-
204
-
205
-
206
-
207
-
208
-
209
-
210
-
211
-
212
-
213
-
214
-
215
-
216
-
217
-
218
-
219
-
220
-
221
-
222
-
223
-
224
-
225
-
226
-
227
-
228
-
229
-
230
-
231
-
232
-
233
-
234
-
235
-
236
-
237
-
238
-
239
-
240
-
241
-
242
-
243
-
244
-
245
-
246
-
247
-
248
-
249
-
250
-
251
-
252
-
253
-
254
-
255
-
256
-
257
-
258
-
259
-
260
-
261
-
262
-
263
-
264
-
265
-
266
-
267
-
268
-
269
-
270
-
271
-
272
-
273
-
274
-
275
-
276
-
277
-
278
-
279
-
280
-
281
-
282
-
283
-
284
-
285
-
286
-
287
-
288
-
289
-
290
-
291
-
292
-
293
-
294
-
295
-
296
-
297
-
298
-
299
-
300
-
301
-
302
-
303
-
304
-
305
-
306
-
307
-
308
-
309
-
310
-
311
-
312
-
313
-
314
-
315
-
316
-
317
-
318
-
319
-
320
-
321
-
322
-
323
-
324
-
325
-
326
-
327
-
328
-
329
-
330
-
331
-
332
-
333
-
334
-
335
-
336
-
337
-
338
-
339
-
340
-
341
-
342
-
343
-
344
-
345
-
346
-
347
-
348
-
349
-
350
-
351
-
352
-
353
-
354
-
355
-
356
-
357
-
358
-
359
-
360
-
361
-
362
-
363
-
364
-
365
-
366
-
367
-
368
-
369
-
370
-
371
-
372
-
373
-
374
-
375
-
376
-
377
-
378
-
379
-
380
-
381
-
382
-
383
-
384
-
385
-
386
-
387
-
388
-
389
-
390
-
391
-
392
-
393
-
394
-
395
-
396
-
397
-
398
-
399
-
400
-
401
-
402
-
403
-
404
-
405
-
406
-
407
-
408
-
409
-
410
-
411
-
412
-
413
-
414
-
415
-
416
-
417
-
418
-
419
-
420
-
421
-
422
-
423
-
424
-
425
-
426
-
427
-
428
-
429
-
430
-
431
-
432
-
433
-
434
-
435
-
436
-
437
-
438
-
439
-
440
-
441
-
442
-
443
-
444
-
445
-
446
-
447
-
448
-
449
-
450
-
451
-
452
-
453
-
454
-
455
-
456
-
457
-
458
-
459
-
460
-
461
-
462
-
463
-
464
-
465
-
466
-
467
-
468
-
469
-
470
-
471
-
472
-
473
-
474
-
475
-
476
-
477
-
478
-
479
-
480
-
481
-
482
-
483
-
484
-
485
-
486
-
487
-
488
-
489
-
490
-
491
-
492
-
493
-
494
-
495
-
496
-
497
-
498
-
499
-
500
-
501
-
502
-
503
-
504
-
505
-
506
-
507
-
508
-
509
-
510
-
511
-
512
-
513
-
514
-
515
-
516
-
517
-
518
-
519
-
520
-
521
-
522
-
523
-
524
-
525
-
526
-
527
-
528
-
529
-
530
-
531
-
532
-
533
-
534
-
535
-
536
-
537
-
538
-
539
-
540
-
541
-
542
-
543
-
544
-
545
-
546
-
547
-
548
-
549
-
550
-
551
-
552
-
553
-
554
-
555
-
556
-
557
-
558
-
559
-
560
-
561
-
562
-
563
-
564
-
565
-
566
-
567
-
568
-
569
-
570
-
571
-
572
-
573
-
574
-
575
-
576
-
577
-
578
-
579
-
580
-
581
-
582
-
583
-
584
-
585
-
586
-
587
-
588
-
589
-
590
-
591
-
592
-
593
-
594
-
595
-
596
-
597
-
598
-
599
-
600
-
601
-
602
-
603
-
604
-
605
-
606
-
607
-
608
-
609
-
610
-
611
-
612
-
613
-
614
-
615
-
616
-
617
-
618
-
619
-
620
-
621
-
622
-
623
-
624
-
625
-
626
-
627
-
628
-
629
-
630
-
631
-
632
-
633
-
634
-
635
-
636
-
637
-
638
-
639
-
640
-
641
-
642
-
643
-
644
-
645
-
646
-
647
-
648
-
649
-
650
-
651
-
652
-
653
-
654
-
655
-
656
-
657
-
658
-
659
-
660
-
661
-
662
-
663
-
664
-
665
-
666
-
667
-
668
-
669
-
670
-
671
-
672
-
673
-
674
-
675
-
676
-
677
-
678
-
679
-
680
-
681
-
682
-
683
-
684
-
685
-
686
-
687
package rardecode
import (
"encoding/binary"
"errors"
)
const (
// vm flag bits
flagC = 1 // Carry
flagZ = 2 // Zero
flagS = 0x80000000 // Sign
maxCommands = 25000000 // maximum number of commands that can be run in a program
vmRegs = 8 // number if registers
vmSize = 0x40000 // memory size
vmMask = vmSize - 1
)
var (
errInvalidVMInstruction = errors.New("rardecode: invalid vm instruction")
)
type vm struct {
ip uint32 // instruction pointer
ipMod bool // ip was modified
fl uint32 // flag bits
r [vmRegs]uint32 // registers
m []byte // memory
}
func (v *vm) setIP(ip uint32) {
v.ip = ip
v.ipMod = true
}
// execute runs a list of commands on the vm.
func (v *vm) execute(cmd []command) {
v.ip = 0 // reset instruction pointer
for n := 0; n < maxCommands; n++ {
ip := v.ip
if ip >= uint32(len(cmd)) {
return
}
ins := cmd[ip]
ins.f(v, ins.bm, ins.op) // run cpu instruction
if v.ipMod {
// command modified ip, don't increment
v.ipMod = false
} else {
v.ip++ // increment ip for next command
}
}
}
// newVM creates a new RAR virtual machine using the byte slice as memory.
func newVM(mem []byte) *vm {
v := new(vm)
if cap(mem) < vmSize+4 {
v.m = make([]byte, vmSize+4)
copy(v.m, mem)
} else {
v.m = mem[:vmSize+4]
for i := len(mem); i < len(v.m); i++ {
v.m[i] = 0
}
}
v.r[7] = vmSize
return v
}
type operand interface {
get(v *vm, byteMode bool) uint32
set(v *vm, byteMode bool, n uint32)
}
// Immediate Operand
type opI uint32
func (op opI) get(v *vm, bm bool) uint32 { return uint32(op) }
func (op opI) set(v *vm, bm bool, n uint32) {}
// Direct Operand
type opD uint32
func (op opD) get(v *vm, byteMode bool) uint32 {
if byteMode {
return uint32(v.m[op])
}
return binary.LittleEndian.Uint32(v.m[op:])
}
func (op opD) set(v *vm, byteMode bool, n uint32) {
if byteMode {
v.m[op] = byte(n)
} else {
binary.LittleEndian.PutUint32(v.m[op:], n)
}
}
// Register Operand
type opR uint32
func (op opR) get(v *vm, byteMode bool) uint32 {
if byteMode {
return v.r[op] & 0xFF
}
return v.r[op]
}
func (op opR) set(v *vm, byteMode bool, n uint32) {
if byteMode {
v.r[op] = (v.r[op] & 0xFFFFFF00) | (n & 0xFF)
} else {
v.r[op] = n
}
}
// Register Indirect Operand
type opRI uint32
func (op opRI) get(v *vm, byteMode bool) uint32 {
i := v.r[op] & vmMask
if byteMode {
return uint32(v.m[i])
}
return binary.LittleEndian.Uint32(v.m[i:])
}
func (op opRI) set(v *vm, byteMode bool, n uint32) {
i := v.r[op] & vmMask
if byteMode {
v.m[i] = byte(n)
} else {
binary.LittleEndian.PutUint32(v.m[i:], n)
}
}
// Base Plus Index Indirect Operand
type opBI struct {
r uint32
i uint32
}
func (op opBI) get(v *vm, byteMode bool) uint32 {
i := (v.r[op.r] + op.i) & vmMask
if byteMode {
return uint32(v.m[i])
}
return binary.LittleEndian.Uint32(v.m[i:])
}
func (op opBI) set(v *vm, byteMode bool, n uint32) {
i := (v.r[op.r] + op.i) & vmMask
if byteMode {
v.m[i] = byte(n)
} else {
binary.LittleEndian.PutUint32(v.m[i:], n)
}
}
type commandFunc func(v *vm, byteMode bool, op []operand)
type command struct {
f commandFunc
bm bool // is byte mode
op []operand
}
var (
ops = []struct {
f commandFunc
byteMode bool // supports byte mode
nops int // number of operands
jop bool // is a jump op
}{
{mov, true, 2, false},
{cmp, true, 2, false},
{add, true, 2, false},
{sub, true, 2, false},
{jz, false, 1, true},
{jnz, false, 1, true},
{inc, true, 1, false},
{dec, true, 1, false},
{jmp, false, 1, true},
{xor, true, 2, false},
{and, true, 2, false},
{or, true, 2, false},
{test, true, 2, false},
{js, false, 1, true},
{jns, false, 1, true},
{jb, false, 1, true},
{jbe, false, 1, true},
{ja, false, 1, true},
{jae, false, 1, true},
{push, false, 1, false},
{pop, false, 1, false},
{call, false, 1, true},
{ret, false, 0, false},
{not, true, 1, false},
{shl, true, 2, false},
{shr, true, 2, false},
{sar, true, 2, false},
{neg, true, 1, false},
{pusha, false, 0, false},
{popa, false, 0, false},
{pushf, false, 0, false},
{popf, false, 0, false},
{movzx, false, 2, false},
{movsx, false, 2, false},
{xchg, true, 2, false},
{mul, true, 2, false},
{div, true, 2, false},
{adc, true, 2, false},
{sbb, true, 2, false},
{print, false, 0, false},
}
)
func mov(v *vm, bm bool, op []operand) {
op[0].set(v, bm, op[1].get(v, bm))
}
func cmp(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
r := v1 - op[1].get(v, bm)
if r == 0 {
v.fl = flagZ
} else {
v.fl = 0
if r > v1 {
v.fl = flagC
}
v.fl |= r & flagS
}
}
func add(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
r := v1 + op[1].get(v, bm)
v.fl = 0
signBit := uint32(flagS)
if bm {
r &= 0xFF
signBit = 0x80
}
if r < v1 {
v.fl |= flagC
}
if r == 0 {
v.fl |= flagZ
} else if r&signBit > 0 {
v.fl |= flagS
}
op[0].set(v, bm, r)
}
func sub(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
r := v1 - op[1].get(v, bm)
v.fl = 0
if r == 0 {
v.fl = flagZ
} else {
v.fl = 0
if r > v1 {
v.fl = flagC
}
v.fl |= r & flagS
}
op[0].set(v, bm, r)
}
func jz(v *vm, bm bool, op []operand) {
if v.fl&flagZ > 0 {
v.setIP(op[0].get(v, false))
}
}
func jnz(v *vm, bm bool, op []operand) {
if v.fl&flagZ == 0 {
v.setIP(op[0].get(v, false))
}
}
func inc(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) + 1
if bm {
r &= 0xFF
}
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func dec(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) - 1
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func jmp(v *vm, bm bool, op []operand) {
v.setIP(op[0].get(v, false))
}
func xor(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) ^ op[1].get(v, bm)
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func and(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) & op[1].get(v, bm)
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func or(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) | op[1].get(v, bm)
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func test(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) & op[1].get(v, bm)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
}
func js(v *vm, bm bool, op []operand) {
if v.fl&flagS > 0 {
v.setIP(op[0].get(v, false))
}
}
func jns(v *vm, bm bool, op []operand) {
if v.fl&flagS == 0 {
v.setIP(op[0].get(v, false))
}
}
func jb(v *vm, bm bool, op []operand) {
if v.fl&flagC > 0 {
v.setIP(op[0].get(v, false))
}
}
func jbe(v *vm, bm bool, op []operand) {
if v.fl&(flagC|flagZ) > 0 {
v.setIP(op[0].get(v, false))
}
}
func ja(v *vm, bm bool, op []operand) {
if v.fl&(flagC|flagZ) == 0 {
v.setIP(op[0].get(v, false))
}
}
func jae(v *vm, bm bool, op []operand) {
if v.fl&flagC == 0 {
v.setIP(op[0].get(v, false))
}
}
func push(v *vm, bm bool, op []operand) {
v.r[7] -= 4
opRI(7).set(v, false, op[0].get(v, false))
}
func pop(v *vm, bm bool, op []operand) {
op[0].set(v, false, opRI(7).get(v, false))
v.r[7] += 4
}
func call(v *vm, bm bool, op []operand) {
v.r[7] -= 4
opRI(7).set(v, false, v.ip+1)
v.setIP(op[0].get(v, false))
}
func ret(v *vm, bm bool, op []operand) {
r7 := v.r[7]
if r7 >= vmSize {
v.setIP(0xFFFFFFFF) // trigger end of program
} else {
v.setIP(binary.LittleEndian.Uint32(v.m[r7:]))
v.r[7] += 4
}
}
func not(v *vm, bm bool, op []operand) {
op[0].set(v, bm, ^op[0].get(v, bm))
}
func shl(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
v2 := op[1].get(v, bm)
r := v1 << v2
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
if (v1<<(v2-1))&0x80000000 > 0 {
v.fl |= flagC
}
}
func shr(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
v2 := op[1].get(v, bm)
r := v1 >> v2
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
if (v1>>(v2-1))&0x1 > 0 {
v.fl |= flagC
}
}
func sar(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
v2 := op[1].get(v, bm)
r := uint32(int32(v1) >> v2)
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
if (v1>>(v2-1))&0x1 > 0 {
v.fl |= flagC
}
}
func neg(v *vm, bm bool, op []operand) {
r := 0 - op[0].get(v, bm)
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r&flagS | flagC
}
}
func pusha(v *vm, bm bool, op []operand) {
sp := opD(v.r[7])
for _, r := range v.r {
sp = (sp - 4) & vmMask
sp.set(v, false, r)
}
v.r[7] = uint32(sp)
}
func popa(v *vm, bm bool, op []operand) {
sp := opD(v.r[7])
for i := 7; i >= 0; i-- {
v.r[i] = sp.get(v, false)
sp = (sp + 4) & vmMask
}
}
func pushf(v *vm, bm bool, op []operand) {
v.r[7] -= 4
opRI(7).set(v, false, v.fl)
}
func popf(v *vm, bm bool, op []operand) {
v.fl = opRI(7).get(v, false)
v.r[7] += 4
}
func movzx(v *vm, bm bool, op []operand) {
op[0].set(v, false, op[1].get(v, true))
}
func movsx(v *vm, bm bool, op []operand) {
op[0].set(v, false, uint32(int8(op[1].get(v, true))))
}
func xchg(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
op[0].set(v, bm, op[1].get(v, bm))
op[1].set(v, bm, v1)
}
func mul(v *vm, bm bool, op []operand) {
r := op[0].get(v, bm) * op[1].get(v, bm)
op[0].set(v, bm, r)
}
func div(v *vm, bm bool, op []operand) {
div := op[1].get(v, bm)
if div != 0 {
r := op[0].get(v, bm) / div
op[0].set(v, bm, r)
}
}
func adc(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
fc := v.fl & flagC
r := v1 + op[1].get(v, bm) + fc
if bm {
r &= 0xFF
}
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
if r < v1 || (r == v1 && fc > 0) {
v.fl |= flagC
}
}
func sbb(v *vm, bm bool, op []operand) {
v1 := op[0].get(v, bm)
fc := v.fl & flagC
r := v1 - op[1].get(v, bm) - fc
if bm {
r &= 0xFF
}
op[0].set(v, bm, r)
if r == 0 {
v.fl = flagZ
} else {
v.fl = r & flagS
}
if r > v1 || (r == v1 && fc > 0) {
v.fl |= flagC
}
}
func print(v *vm, bm bool, op []operand) {
// TODO: ignore print for the moment
}
func decodeArg(br *rarBitReader, byteMode bool) (operand, error) {
n, err := br.readBits(1)
if err != nil {
return nil, err
}
if n > 0 { // Register
n, err = br.readBits(3)
return opR(n), err
}
n, err = br.readBits(1)
if err != nil {
return nil, err
}
if n == 0 { // Immediate
if byteMode {
n, err = br.readBits(8)
} else {
m, err := br.readUint32()
return opI(m), err
}
return opI(n), err
}
n, err = br.readBits(1)
if err != nil {
return nil, err
}
if n == 0 {
// Register Indirect
n, err = br.readBits(3)
return opRI(n), err
}
n, err = br.readBits(1)
if err != nil {
return nil, err
}
if n == 0 {
// Base + Index Indirect
n, err = br.readBits(3)
if err != nil {
return nil, err
}
i, err := br.readUint32()
return opBI{r: uint32(n), i: i}, err
}
// Direct addressing
m, err := br.readUint32()
return opD(m & vmMask), err
}
func fixJumpOp(op operand, off int) operand {
n, ok := op.(opI)
if !ok {
return op
}
if n >= 256 {
return n - 256
}
if n >= 136 {
n -= 264
} else if n >= 16 {
n -= 8
} else if n >= 8 {
n -= 16
}
return n + opI(off)
}
func readCommands(br *rarBitReader) ([]command, error) {
var cmds []command
for {
code, err := br.readBits(4)
if err != nil {
return cmds, err
}
if code&0x08 > 0 {
n, err := br.readBits(2)
if err != nil {
return cmds, err
}
code = (code<<2 | n) - 24
}
if code >= len(ops) {
return cmds, errInvalidVMInstruction
}
ins := ops[code]
var com command
if ins.byteMode {
n, err := br.readBits(1)
if err != nil {
return cmds, err
}
com.bm = n > 0
}
com.f = ins.f
if ins.nops > 0 {
com.op = make([]operand, ins.nops)
com.op[0], err = decodeArg(br, com.bm)
if err != nil {
return cmds, err
}
if ins.nops == 2 {
com.op[1], err = decodeArg(br, com.bm)
if err != nil {
return cmds, err
}
} else if ins.jop {
com.op[0] = fixJumpOp(com.op[0], len(cmds))
}
}
cmds = append(cmds, com)
}
}