X-Git-Url: https://notaz.gp2x.de/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=tools%2Ftranslate.c;h=cca300f1759fde203fe33e48d798e9402aece34d;hb=7a3c55553ae875cfc821e347867e08266a03f13c;hp=0db05e8c787327f4241dfe1b864a81a806b72e77;hpb=6135d8e6925883dd9d4bd6f836bf469bf2ee2b3e;p=ia32rtools.git diff --git a/tools/translate.c b/tools/translate.c index 0db05e8..cca300f 100644 --- a/tools/translate.c +++ b/tools/translate.c @@ -4,21 +4,28 @@ * * This work is licensed under the terms of 3-clause BSD license. * See COPYING file in the top-level directory. + * + * recognized asm hint comments: + * sctattr - function attributes (see code) + * sctend - force end of function/chunk + * sctpatch:

- replace current asm line with

+ * sctproto:

- prototype of ref'd function or struct + * sctref - variable is referenced, make global + * sctskip_start - start of skipped code chunk (inclusive) + * sctskip_end - end of skipped code chunk (inclusive) */ #define _GNU_SOURCE #include #include #include +#include +#include #include "my_assert.h" #include "my_str.h" #include "common.h" -#define ARRAY_SIZE(x) (sizeof(x) / sizeof(x[0])) -#define IS(w, y) !strcmp(w, y) -#define IS_START(w, y) !strncmp(w, y, strlen(y)) - #include "protoparse.h" static const char *asmfn; @@ -54,7 +61,7 @@ enum op_flags { OPF_EBP_S = (1 << 13), /* ebp used as scratch here, not BP */ OPF_DF = (1 << 14), /* DF flag set */ OPF_ATAIL = (1 << 15), /* tail call with reused arg frame */ - OPF_32BIT = (1 << 16), /* 32bit division */ + OPF_32BIT = (1 << 16), /* enough to do 32bit for this op */ OPF_LOCK = (1 << 17), /* op has lock prefix */ OPF_VAPUSH = (1 << 18), /* vararg ptr push (as call arg) */ OPF_DONE = (1 << 19), /* already fully handled by analysis */ @@ -62,7 +69,9 @@ enum op_flags { OPF_NOREGS = (1 << 21), /* don't track regs of this op */ OPF_FPUSH = (1 << 22), /* pushes x87 stack */ OPF_FPOP = (1 << 23), /* pops x87 stack */ - OPF_FSHIFT = (1 << 24), /* x87 stack shift is actually needed */ + OPF_FPOPP = (1 << 24), /* pops x87 stack twice */ + OPF_FSHIFT = (1 << 25), /* x87 stack shift is actually needed */ + OPF_FINT = (1 << 26), /* integer float op arg */ }; enum op_op { @@ -70,6 +79,8 @@ enum op_op { OP_NOP, OP_PUSH, OP_POP, + OP_PUSHA, + OP_POPA, OP_LEAVE, OP_MOV, OP_LEA, @@ -79,11 +90,14 @@ enum op_op { OP_NOT, OP_XLAT, OP_CDQ, + OP_BSWAP, OP_LODS, OP_STOS, OP_MOVS, OP_CMPS, OP_SCAS, + OP_RDTSC, + OP_CPUID, OP_STD, OP_CLD, OP_RET, @@ -104,6 +118,7 @@ enum op_op { OP_ADC, OP_SBB, OP_BSF, + OP_BSR, OP_INC, OP_DEC, OP_NEG, @@ -124,6 +139,7 @@ enum op_op { OP_FILD, OP_FLDc, OP_FST, + OP_FIST, OP_FADD, OP_FDIV, OP_FMUL, @@ -136,10 +152,24 @@ enum op_op { OP_FISUB, OP_FIDIVR, OP_FISUBR, + OP_FCOM, + OP_FNSTSW, + OP_FCHS, + OP_FCOS, + OP_FPATAN, + OP_FPTAN, + OP_FSIN, + OP_FSQRT, + OP_FXCH, + OP_FYL2X, // mmx OP_EMMS, // pseudo-ops for lib calls + OPP_ALLSHL, + OPP_ALLSHR, OPP_FTOL, + OPP_CIPOW, + OPP_ABORT, // undefined OP_UD2, }; @@ -179,7 +209,7 @@ struct parsed_opr { unsigned int type_from_var:1; // .. in header, sometimes wrong unsigned int size_mismatch:1; // type override differs from C unsigned int size_lt:1; // type override is larger than C - unsigned int had_ds:1; // had ds: prefix + unsigned int segment:7; // had segment override (enum segment) const struct parsed_proto *pp; // for OPT_LABEL unsigned int val; char name[NAMELEN]; @@ -213,6 +243,7 @@ struct parsed_op { // (OPF_CC) - points to one of (OPF_FLAGS) that affects cc op // OP_PUSH - points to OP_POP in complex push/pop graph // OP_POP - points to OP_PUSH in simple push/pop pair +// OP_FCOM - needed_status_word_bits | (is_z_check << 16) struct parsed_equ { char name[64]; @@ -249,21 +280,34 @@ enum ida_func_attr { IDAFA_FPD = (1 << 5), }; +// sctattr enum sct_func_attr { SCTFA_CLEAR_SF = (1 << 0), // clear stack frame SCTFA_CLEAR_REGS = (1 << 1), // clear registers (mask) + SCTFA_RM_REGS = (1 << 2), // don't emit regs (mask) + SCTFA_NOWARN = (1 << 3), // don't try to detect problems + SCTFA_ARGFRAME = (1 << 4), // copy all args to a struct, in order }; enum x87_const { X87_CONST_1 = 1, - X87_CONST_2T, - X87_CONST_2E, + X87_CONST_L2T, + X87_CONST_L2E, X87_CONST_PI, X87_CONST_LG2, X87_CONST_LN2, X87_CONST_Z, }; +enum segment { + SEG_CS = 1, + SEG_DS, + SEG_SS, + SEG_ES, + SEG_FS, + SEG_GS, +}; + // note: limited to 32k due to p_argnext #define MAX_OPS 4096 #define MAX_ARG_GRP 2 @@ -283,13 +327,18 @@ static int g_bp_frame; static int g_sp_frame; static int g_stack_frame_used; static int g_stack_fsz; +static int g_seh_found; +static int g_seh_size; static int g_ida_func_attr; static int g_sct_func_attr; static int g_stack_clear_start; // in dwords static int g_stack_clear_len; static int g_regmask_init; +static int g_regmask_rm; static int g_skip_func; static int g_allow_regfunc; +static int g_allow_user_icall; +static int g_nowarn_reguse; static int g_quiet_pp; static int g_header_mode; @@ -307,6 +356,9 @@ static int g_header_mode; if (!(cond)) ferr(op_, "assertion '%s' failed\n", #cond); \ } while (0) +#define IS_OP_INDIRECT_CALL(op_) \ + ((op_)->op == OP_CALL && (op_)->operand[0].type != OPT_LABEL) + const char *regs_r32[] = { "eax", "ebx", "ecx", "edx", "esi", "edi", "ebp", "esp", // not r32, but list here for easy parsing and printing @@ -328,10 +380,15 @@ enum x86_regs { }; #define mxAX (1 << xAX) +#define mxBX (1 << xBX) #define mxCX (1 << xCX) #define mxDX (1 << xDX) +#define mxSP (1 << xSP) #define mxST0 (1 << xST0) #define mxST1 (1 << xST1) +#define mxST1_0 (mxST1 | mxST0) +#define mxST7_2 (0xfc << xST0) +#define mxSTa (0xff << xST0) // possible basic comparison types (without inversion) enum parsed_flag_op { @@ -378,12 +435,12 @@ static int check_segment_prefix(const char *s) return 0; switch (s[0]) { - case 'c': return 1; - case 'd': return 2; - case 's': return 3; - case 'e': return 4; - case 'f': return 5; - case 'g': return 6; + case 'c': return SEG_CS; + case 'd': return SEG_DS; + case 's': return SEG_SS; + case 'e': return SEG_ES; + case 'f': return SEG_FS; + case 'g': return SEG_GS; default: return 0; } } @@ -459,7 +516,7 @@ static int parse_indmode(char *name, int *regmask, int need_c_cvt) } if ('0' <= w[0] && w[0] <= '9') { - number = parse_number(w); + number = parse_number(w, 0); printf_number(d, sizeof(cvtbuf) - (d - cvtbuf), number); continue; } @@ -491,12 +548,12 @@ static int is_reg_in_str(const char *s) } static const char *parse_stack_el(const char *name, char *extra_reg, - int early_try) + int *base_val, int early_try) { const char *p, *p2, *s; char *endp = NULL; char buf[32]; - long val; + long val = -1; int len; if (g_bp_frame || early_try) @@ -545,23 +602,27 @@ static const char *parse_stack_el(const char *name, char *extra_reg, if (p == NULL) aerr("%s IDA stackvar not set?\n", __func__); } - if (!('0' <= *s && *s <= '9')) { - aerr("%s IDA stackvar offset not set?\n", __func__); - return NULL; - } - if (s[0] == '0' && s[1] == 'x') - s += 2; - len = p - s; - if (len < sizeof(buf) - 1) { - strncpy(buf, s, len); - buf[len] = 0; - val = strtol(buf, &endp, 16); - if (val == 0 || *endp != 0) { - aerr("%s num parse fail for '%s'\n", __func__, buf); - return NULL; + if ('0' <= *s && *s <= '9') { + if (s[0] == '0' && s[1] == 'x') + s += 2; + len = p - s; + if (len < sizeof(buf) - 1) { + strncpy(buf, s, len); + buf[len] = 0; + errno = 0; + val = strtol(buf, &endp, 16); + if (val == 0 || *endp != 0 || errno != 0) { + aerr("%s num parse fail for '%s'\n", __func__, buf); + return NULL; + } } + p++; + } + else { + // probably something like [esp+arg_4+2] + p = s; + val = 0; } - p++; } else p = name + 4; @@ -569,6 +630,8 @@ static const char *parse_stack_el(const char *name, char *extra_reg, if ('0' <= *p && *p <= '9') return NULL; + if (base_val != NULL) + *base_val = val; return p; } @@ -596,6 +659,9 @@ static int guess_lmod_from_name(struct parsed_opr *opr) static int guess_lmod_from_c_type(enum opr_lenmod *lmod, const struct parsed_type *c_type) { + static const char *qword_types[] = { + "uint64_t", "int64_t", "__int64", + }; static const char *dword_types[] = { "uint32_t", "int", "_DWORD", "UINT_PTR", "DWORD", "WPARAM", "LPARAM", "UINT", "__int32", @@ -644,6 +710,13 @@ static int guess_lmod_from_c_type(enum opr_lenmod *lmod, } } + for (i = 0; i < ARRAY_SIZE(qword_types); i++) { + if (IS(n, qword_types[i])) { + *lmod = OPLM_QWORD; + return 1; + } + } + return 0; } @@ -738,9 +811,7 @@ static int parse_operand(struct parsed_opr *opr, opr->type = OPT_LABEL; ret = check_segment_prefix(label); if (ret != 0) { - if (ret >= 5) - aerr("fs/gs used\n"); - opr->had_ds = 1; + opr->segment = ret; label += 3; } strcpy(opr->name, label); @@ -789,10 +860,10 @@ static int parse_operand(struct parsed_opr *opr, ret = check_segment_prefix(words[w]); if (ret != 0) { - if (ret >= 5) - aerr("fs/gs used\n"); - opr->had_ds = 1; + opr->segment = ret; memmove(words[w], words[w] + 3, strlen(words[w]) - 2); + if (ret == SEG_FS && IS(words[w], "0")) + g_seh_found = 1; } strcpy(opr->name, words[w]); @@ -803,11 +874,12 @@ static int parse_operand(struct parsed_opr *opr, aerr("[] parse failure\n"); parse_indmode(opr->name, regmask_indirect, 1); - if (opr->lmod == OPLM_UNSPEC && parse_stack_el(opr->name, NULL, 1)) + if (opr->lmod == OPLM_UNSPEC + && parse_stack_el(opr->name, NULL, NULL, 1)) { // might be an equ struct parsed_equ *eq = - equ_find(NULL, parse_stack_el(opr->name, NULL, 1), &i); + equ_find(NULL, parse_stack_el(opr->name, NULL, NULL, 1), &i); if (eq) opr->lmod = eq->lmod; @@ -829,7 +901,7 @@ static int parse_operand(struct parsed_opr *opr, else if (('0' <= words[w][0] && words[w][0] <= '9') || words[w][0] == '-') { - number = parse_number(words[w]); + number = parse_number(words[w], 0); opr->type = OPT_CONST; opr->val = number; printf_number(opr->name, sizeof(opr->name), number); @@ -887,7 +959,7 @@ static const struct { { "repz", OPF_REP|OPF_REPZ }, { "repne", OPF_REP|OPF_REPNZ }, { "repnz", OPF_REP|OPF_REPNZ }, - { "lock", OPF_LOCK }, // ignored for now.. + { "lock", OPF_LOCK }, }; #define OPF_CJMP_CC (OPF_JMP|OPF_CJMP|OPF_CC) @@ -904,6 +976,8 @@ static const struct { { "nop", OP_NOP, 0, 0, 0 }, { "push", OP_PUSH, 1, 1, 0 }, { "pop", OP_POP, 1, 1, OPF_DATA }, + { "pusha",OP_PUSHA, 0, 0, 0 }, + { "popa", OP_POPA, 0, 0, OPF_DATA }, { "leave",OP_LEAVE, 0, 0, OPF_DATA }, { "mov" , OP_MOV, 2, 2, OPF_DATA }, { "lea", OP_LEA, 2, 2, OPF_DATA }, @@ -913,6 +987,7 @@ static const struct { { "not", OP_NOT, 1, 1, OPF_DATA }, { "xlat", OP_XLAT, 0, 0, OPF_DATA }, { "cdq", OP_CDQ, 0, 0, OPF_DATA }, + { "bswap",OP_BSWAP, 1, 1, OPF_DATA }, { "lodsb",OP_LODS, 0, 0, OPF_DATA }, { "lodsw",OP_LODS, 0, 0, OPF_DATA }, { "lodsd",OP_LODS, 0, 0, OPF_DATA }, @@ -928,6 +1003,8 @@ static const struct { { "scasb",OP_SCAS, 0, 0, OPF_DATA|OPF_FLAGS }, { "scasw",OP_SCAS, 0, 0, OPF_DATA|OPF_FLAGS }, { "scasd",OP_SCAS, 0, 0, OPF_DATA|OPF_FLAGS }, + { "rdtsc",OP_RDTSC, 0, 0, OPF_DATA }, + { "cpuid",OP_CPUID, 0, 0, OPF_DATA }, { "std", OP_STD, 0, 0, OPF_DATA }, // special flag { "cld", OP_CLD, 0, 0, OPF_DATA }, { "add", OP_ADD, 2, 2, OPF_DATA|OPF_FLAGS }, @@ -948,6 +1025,7 @@ static const struct { { "adc", OP_ADC, 2, 2, OPF_DATA|OPF_FLAGS|OPF_CC, PFO_C }, { "sbb", OP_SBB, 2, 2, OPF_DATA|OPF_FLAGS|OPF_CC, PFO_C }, { "bsf", OP_BSF, 2, 2, OPF_DATA|OPF_FLAGS }, + { "bsr", OP_BSR, 2, 2, OPF_DATA|OPF_FLAGS }, { "inc", OP_INC, 1, 1, OPF_DATA|OPF_FLAGS }, { "dec", OP_DEC, 1, 1, OPF_DATA|OPF_FLAGS }, { "neg", OP_NEG, 1, 1, OPF_DATA|OPF_FLAGS }, @@ -1022,11 +1100,18 @@ static const struct { { "setnle", OP_SCC, 1, 1, OPF_DATA|OPF_CC, PFO_LE, 1 }, // x87 { "fld", OP_FLD, 1, 1, OPF_FPUSH }, - { "fild", OP_FILD, 1, 1, OPF_FPUSH }, + { "fild", OP_FILD, 1, 1, OPF_FPUSH|OPF_FINT }, { "fld1", OP_FLDc, 0, 0, OPF_FPUSH }, + { "fldl2t", OP_FLDc, 0, 0, OPF_FPUSH }, + { "fldl2e", OP_FLDc, 0, 0, OPF_FPUSH }, + { "fldpi", OP_FLDc, 0, 0, OPF_FPUSH }, + { "fldlg2", OP_FLDc, 0, 0, OPF_FPUSH }, + { "fldln2", OP_FLDc, 0, 0, OPF_FPUSH }, { "fldz", OP_FLDc, 0, 0, OPF_FPUSH }, - { "fstp", OP_FST, 1, 1, OPF_FPOP }, { "fst", OP_FST, 1, 1, 0 }, + { "fstp", OP_FST, 1, 1, OPF_FPOP }, + { "fist", OP_FIST, 1, 1, OPF_FINT }, + { "fistp", OP_FIST, 1, 1, OPF_FPOP|OPF_FINT }, { "fadd", OP_FADD, 0, 2, 0 }, { "faddp", OP_FADD, 0, 2, OPF_FPOP }, { "fdiv", OP_FDIV, 0, 2, 0 }, @@ -1039,17 +1124,36 @@ static const struct { { "fdivrp", OP_FDIVR, 0, 2, OPF_FPOP }, { "fsubr", OP_FSUBR, 0, 2, 0 }, { "fsubrp", OP_FSUBR, 0, 2, OPF_FPOP }, - { "fiadd", OP_FIADD, 1, 1, 0 }, - { "fidiv", OP_FIDIV, 1, 1, 0 }, - { "fimul", OP_FIMUL, 1, 1, 0 }, - { "fisub", OP_FISUB, 1, 1, 0 }, - { "fidivr", OP_FIDIVR, 1, 1, 0 }, - { "fisubr", OP_FISUBR, 1, 1, 0 }, + { "fiadd", OP_FIADD, 1, 1, OPF_FINT }, + { "fidiv", OP_FIDIV, 1, 1, OPF_FINT }, + { "fimul", OP_FIMUL, 1, 1, OPF_FINT }, + { "fisub", OP_FISUB, 1, 1, OPF_FINT }, + { "fidivr", OP_FIDIVR, 1, 1, OPF_FINT }, + { "fisubr", OP_FISUBR, 1, 1, OPF_FINT }, + { "fcom", OP_FCOM, 0, 1, 0 }, + { "fcomp", OP_FCOM, 0, 1, OPF_FPOP }, + { "fcompp", OP_FCOM, 0, 0, OPF_FPOPP }, + { "fucom", OP_FCOM, 0, 1, 0 }, + { "fucomp", OP_FCOM, 0, 1, OPF_FPOP }, + { "fucompp",OP_FCOM, 0, 0, OPF_FPOPP }, + { "fnstsw", OP_FNSTSW, 1, 1, OPF_DATA }, + { "fchs", OP_FCHS, 0, 0, 0 }, + { "fcos", OP_FCOS, 0, 0, 0 }, + { "fpatan", OP_FPATAN, 0, 0, OPF_FPOP }, + { "fptan", OP_FPTAN, 0, 0, OPF_FPUSH }, + { "fsin", OP_FSIN, 0, 0, 0 }, + { "fsqrt", OP_FSQRT, 0, 0, 0 }, + { "fxch", OP_FXCH, 1, 1, 0 }, + { "fyl2x", OP_FYL2X, 0, 0, OPF_FPOP }, // mmx { "emms", OP_EMMS, 0, 0, OPF_DATA }, { "movq", OP_MOV, 2, 2, OPF_DATA }, // pseudo-ops for lib calls + { "_allshl",OPP_ALLSHL }, + { "_allshr",OPP_ALLSHR }, { "_ftol", OPP_FTOL }, + { "_CIpow", OPP_CIPOW }, + { "abort", OPP_ABORT }, // must be last { "ud2", OP_UD2 }, }; @@ -1147,6 +1251,7 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) case OP_INC: case OP_DEC: case OP_NEG: + case OP_BSWAP: // more below.. op->regmask_src |= op->regmask_dst; break; @@ -1227,6 +1332,16 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) op->regmask_dst = op->regmask_src; break; + case OP_RDTSC: + op->regmask_dst = mxAX | mxDX; + break; + + case OP_CPUID: + // for now, ignore ecx dep for eax={4,7,b,d} + op->regmask_src = mxAX; + op->regmask_dst = mxAX | mxBX | mxCX | mxDX; + break; + case OP_LOOP: op->regmask_dst = 1 << xCX; // fallthrough @@ -1249,20 +1364,26 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) // fallthrough case OP_MUL: // singleop mul - op->regmask_src |= op->regmask_dst; - op->regmask_dst = (1 << xDX) | (1 << xAX); if (op->operand[0].lmod == OPLM_UNSPEC) op->operand[0].lmod = OPLM_DWORD; + op->regmask_src = mxAX | op->regmask_dst; + op->regmask_dst = mxAX; + if (op->operand[0].lmod != OPLM_BYTE) + op->regmask_dst |= mxDX; break; case OP_DIV: case OP_IDIV: // we could set up operands for edx:eax, but there is no real need to // (see is_opr_modified()) - op->regmask_src |= op->regmask_dst; - op->regmask_dst = (1 << xDX) | (1 << xAX); if (op->operand[0].lmod == OPLM_UNSPEC) op->operand[0].lmod = OPLM_DWORD; + op->regmask_src = mxAX | op->regmask_dst; + op->regmask_dst = mxAX; + if (op->operand[0].lmod != OPLM_BYTE) { + op->regmask_src |= mxDX; + op->regmask_dst |= mxDX; + } break; case OP_SHL: @@ -1317,6 +1438,8 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) break; case OP_CALL: + // needed because of OPF_DATA + op->regmask_src |= op->regmask_dst; // trashed regs must be explicitly detected later op->regmask_dst = 0; break; @@ -1335,13 +1458,24 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) op->regmask_dst |= mxST0; if (IS(words[op_w] + 3, "1")) op->operand[0].val = X87_CONST_1; + else if (IS(words[op_w] + 3, "l2t")) + op->operand[0].val = X87_CONST_L2T; + else if (IS(words[op_w] + 3, "l2e")) + op->operand[0].val = X87_CONST_L2E; + else if (IS(words[op_w] + 3, "pi")) + op->operand[0].val = X87_CONST_PI; + else if (IS(words[op_w] + 3, "lg2")) + op->operand[0].val = X87_CONST_LG2; + else if (IS(words[op_w] + 3, "ln2")) + op->operand[0].val = X87_CONST_LN2; else if (IS(words[op_w] + 3, "z")) op->operand[0].val = X87_CONST_Z; else - aerr("TODO\n"); + aerr("fld what?\n"); break; case OP_FST: + case OP_FIST: op->regmask_src |= mxST0; break; @@ -1372,10 +1506,36 @@ static void parse_op(struct parsed_op *op, char words[16][256], int wordc) case OP_FISUB: case OP_FIDIVR: case OP_FISUBR: + case OP_FCHS: + case OP_FCOS: + case OP_FSIN: + case OP_FSQRT: + case OP_FXCH: op->regmask_src |= mxST0; op->regmask_dst |= mxST0; break; + case OP_FPATAN: + case OP_FYL2X: + op->regmask_src |= mxST0 | mxST1; + op->regmask_dst |= mxST0; + break; + + case OP_FPTAN: + aerr("TODO\n"); + break; + + case OP_FCOM: + op->regmask_src |= mxST0; + if (op->operand_cnt == 0) { + op->operand_cnt = 1; + op->operand[0].type = OPT_REG; + op->operand[0].lmod = OPLM_QWORD; + op->operand[0].reg = xST1; + op->regmask_src |= mxST1; + } + break; + default: break; } @@ -1656,16 +1816,15 @@ static struct parsed_equ *equ_find(struct parsed_op *po, const char *name, *extra_offs = 0; namelen = strlen(name); - p = strchr(name, '+'); + p = strpbrk(name, "+-"); if (p != NULL) { namelen = p - name; if (namelen <= 0) ferr(po, "equ parse failed for '%s'\n", name); - if (IS_START(p, "0x")) - p += 2; + errno = 0; *extra_offs = strtol(p, &endp, 16); - if (*endp != 0) + if (*endp != 0 || errno != 0) ferr(po, "equ parse failed for '%s'\n", name); } @@ -1685,7 +1844,7 @@ static struct parsed_equ *equ_find(struct parsed_op *po, const char *name, static int is_stack_access(struct parsed_op *po, const struct parsed_opr *popr) { - return (parse_stack_el(popr->name, NULL, 0) + return (parse_stack_el(popr->name, NULL, NULL, 0) || (g_bp_frame && !(po->flags & OPF_EBP_S) && IS_START(popr->name, "ebp"))); } @@ -1709,15 +1868,15 @@ static void parse_stack_access(struct parsed_op *po, p = name + 4; if (IS_START(p, "0x")) p += 2; + errno = 0; offset = strtoul(p, &endp, 16); if (name[3] == '-') offset = -offset; - if (*endp != 0) + if (*endp != 0 || errno != 0) ferr(po, "ebp- parse of '%s' failed\n", name); } else { - bp_arg = parse_stack_el(name, ofs_reg, 0); - snprintf(g_comment, sizeof(g_comment), "%s", bp_arg); + bp_arg = parse_stack_el(name, ofs_reg, NULL, 0); eq = equ_find(po, bp_arg, &offset); if (eq == NULL) ferr(po, "detected but missing eq\n"); @@ -1735,11 +1894,47 @@ static void parse_stack_access(struct parsed_op *po, } *offset_out = offset; - *stack_ra_out = stack_ra; + if (stack_ra_out) + *stack_ra_out = stack_ra; if (bp_arg_out) *bp_arg_out = bp_arg; } +static int parse_stack_esp_offset(struct parsed_op *po, + const char *name, int *offset_out) +{ + char ofs_reg[16] = { 0, }; + struct parsed_equ *eq; + const char *bp_arg; + char *endp = NULL; + int base_val = 0; + int offset = 0; + + if (strstr(name, "esp") == NULL) + return -1; + bp_arg = parse_stack_el(name, ofs_reg, &base_val, 0); + if (bp_arg == NULL) { + // just plain offset? + if (!IS_START(name, "esp+")) + return -1; + errno = 0; + offset = strtol(name + 4, &endp, 0); + if (endp == NULL || *endp != 0 || errno != 0) + return -1; + *offset_out = offset; + return 0; + } + + if (ofs_reg[0] != 0) + return -1; + eq = equ_find(po, bp_arg, &offset); + if (eq == NULL) + ferr(po, "detected but missing eq\n"); + offset += eq->offset; + *offset_out = base_val + offset; + return 0; +} + static int stack_frame_access(struct parsed_op *po, struct parsed_opr *popr, char *buf, size_t buf_size, const char *name, const char *cast, int is_src, int is_lea) @@ -1748,20 +1943,23 @@ static int stack_frame_access(struct parsed_op *po, const char *prefix = ""; const char *bp_arg = NULL; char ofs_reg[16] = { 0, }; + char argname[8]; int i, arg_i, arg_s; int unaligned = 0; int stack_ra = 0; int offset = 0; int retval = -1; int sf_ofs; - int lim; - if (po->flags & OPF_EBP_S) + if (g_bp_frame && (po->flags & OPF_EBP_S) + && !(po->regmask_src & mxSP)) ferr(po, "stack_frame_access while ebp is scratch\n"); parse_stack_access(po, name, ofs_reg, &offset, &stack_ra, &bp_arg, is_lea); + snprintf(g_comment, sizeof(g_comment), "%s", bp_arg); + if (offset > stack_ra) { arg_i = (offset - stack_ra - 4) / 4; @@ -1776,7 +1974,7 @@ static int stack_frame_access(struct parsed_op *po, snprintf(buf, buf_size, "%sap", cast); return -1; } - ferr(po, "offset %d (%s,%d) doesn't map to any arg\n", + ferr(po, "offset 0x%x (%s,%d) doesn't map to any arg\n", offset, bp_arg, arg_i); } if (ofs_reg[0] != 0) @@ -1795,17 +1993,20 @@ static int stack_frame_access(struct parsed_op *po, popr->is_ptr = g_func_pp->arg[i].type.is_ptr; retval = i; + snprintf(argname, sizeof(argname), "%sa%d", + g_sct_func_attr & SCTFA_ARGFRAME ? "af." : "", i + 1); + switch (popr->lmod) { case OPLM_BYTE: if (is_lea) ferr(po, "lea/byte to arg?\n"); if (is_src && (offset & 3) == 0) - snprintf(buf, buf_size, "%sa%d", - simplify_cast(cast, "(u8)"), i + 1); + snprintf(buf, buf_size, "%s%s", + simplify_cast(cast, "(u8)"), argname); else - snprintf(buf, buf_size, "%sBYTE%d(a%d)", - cast, offset & 3, i + 1); + snprintf(buf, buf_size, "%sBYTE%d(%s)", + cast, offset & 3, argname); break; case OPLM_WORD: @@ -1816,18 +2017,18 @@ static int stack_frame_access(struct parsed_op *po, if (!is_src) { if (offset & 2) ferr(po, "problematic arg store\n"); - snprintf(buf, buf_size, "%s((char *)&a%d + 1)", - simplify_cast(cast, "*(u16 *)"), i + 1); + snprintf(buf, buf_size, "%s((char *)&%s + 1)", + simplify_cast(cast, "*(u16 *)"), argname); } else ferr(po, "unaligned arg word load\n"); } else if (is_src && (offset & 2) == 0) - snprintf(buf, buf_size, "%sa%d", - simplify_cast(cast, "(u16)"), i + 1); + snprintf(buf, buf_size, "%s%s", + simplify_cast(cast, "(u16)"), argname); else - snprintf(buf, buf_size, "%s%sWORD(a%d)", - cast, (offset & 2) ? "HI" : "LO", i + 1); + snprintf(buf, buf_size, "%s%sWORD(%s)", + cast, (offset & 2) ? "HI" : "LO", argname); break; case OPLM_DWORD: @@ -1839,28 +2040,36 @@ static int stack_frame_access(struct parsed_op *po, if (offset & 3) { unaligned = 1; if (is_lea) - snprintf(buf, buf_size, "(u32)&a%d + %d", - i + 1, offset & 3); + snprintf(buf, buf_size, "(u32)&%s + %d", + argname, offset & 3); else if (!is_src) ferr(po, "unaligned arg store\n"); else { // mov edx, [ebp+arg_4+2]; movsx ecx, dx - snprintf(buf, buf_size, "%s(a%d >> %d)", - prefix, i + 1, (offset & 3) * 8); + snprintf(buf, buf_size, "%s(%s >> %d)", + prefix, argname, (offset & 3) * 8); } } else { - snprintf(buf, buf_size, "%s%sa%d", - prefix, is_lea ? "&" : "", i + 1); + snprintf(buf, buf_size, "%s%s%s", + prefix, is_lea ? "&" : "", argname); } break; + case OPLM_QWORD: + ferr_assert(po, !(offset & 7)); + if (cast[0]) + prefix = cast; + snprintf(buf, buf_size, "%s%s%s", + prefix, is_lea ? "&" : "", argname); + break; + default: ferr(po, "bp_arg bad lmod: %d\n", popr->lmod); } if (unaligned) - snprintf(g_comment, sizeof(g_comment), "%s unaligned", bp_arg); + strcat(g_comment, " unaligned"); // common problem guess_lmod_from_c_type(&tmp_lmod, &g_func_pp->arg[i].type); @@ -1883,8 +2092,7 @@ static int stack_frame_access(struct parsed_op *po, g_stack_frame_used = 1; sf_ofs = g_stack_fsz + offset; - lim = (ofs_reg[0] != 0) ? -4 : 0; - if (offset > 0 || sf_ofs < lim) + if (ofs_reg[0] == 0 && (offset > 0 || sf_ofs < 0)) ferr(po, "bp_stack offset %d/%d\n", offset, g_stack_fsz); if (is_lea) @@ -1928,8 +2136,9 @@ static int stack_frame_access(struct parsed_op *po, case OPLM_QWORD: ferr_assert(po, !(sf_ofs & 7)); ferr_assert(po, ofs_reg[0] == 0); - // float callers set is_lea - ferr_assert(po, is_lea); + // only used for x87 int64/float, float sets is_lea + if (!is_lea && (po->flags & OPF_FINT)) + prefix = "*(s64 *)&"; snprintf(buf, buf_size, "%ssf.q[%d]", prefix, sf_ofs / 8); break; @@ -1949,7 +2158,7 @@ static void check_func_pp(struct parsed_op *po, int ret, i; if (pp->argc_reg != 0) { - if (/*!g_allow_regfunc &&*/ !pp->is_fastcall) { + if (!g_allow_user_icall && !pp->is_fastcall) { pp_print(buf, sizeof(buf), pp); ferr(po, "%s: unexpected reg arg in icall: %s\n", pfx, buf); } @@ -1972,7 +2181,7 @@ static void check_func_pp(struct parsed_op *po, } static const char *check_label_read_ref(struct parsed_op *po, - const char *name) + const char *name, int *is_import) { const struct parsed_proto *pp; @@ -1983,9 +2192,20 @@ static const char *check_label_read_ref(struct parsed_op *po, if (pp->is_func) check_func_pp(po, pp, "ref"); + if (is_import != NULL) + *is_import = pp->is_import; + return pp->name; } +static void check_opr(struct parsed_op *po, struct parsed_opr *popr) +{ + if (popr->segment == SEG_FS) + ferr(po, "fs: used\n"); + if (popr->segment == SEG_GS) + ferr(po, "gs: used\n"); +} + static char *out_src_opr(char *buf, size_t buf_size, struct parsed_op *po, struct parsed_opr *popr, const char *cast, int is_lea) @@ -1993,9 +2213,12 @@ static char *out_src_opr(char *buf, size_t buf_size, char tmp1[256], tmp2[256]; char expr[256]; const char *name; + int is_import = 0; char *p; int ret; + check_opr(po, popr); + if (cast == NULL) cast = ""; @@ -2063,7 +2286,11 @@ static char *out_src_opr(char *buf, size_t buf_size, break; case OPT_LABEL: - name = check_label_read_ref(po, popr->name); + name = check_label_read_ref(po, popr->name, &is_import); + if (is_import) + // for imported data, asm is loading the offset + goto do_offset; + if (cast[0] == 0 && popr->is_ptr) cast = "(u32)"; @@ -2079,7 +2306,8 @@ static char *out_src_opr(char *buf, size_t buf_size, break; case OPT_OFFSET: - name = check_label_read_ref(po, popr->name); + do_offset: + name = check_label_read_ref(po, popr->name, NULL); if (cast[0] == 0) cast = "(u32)"; if (is_lea) @@ -2110,6 +2338,8 @@ static char *out_src_opr(char *buf, size_t buf_size, static char *out_dst_opr(char *buf, size_t buf_size, struct parsed_op *po, struct parsed_opr *popr) { + check_opr(po, popr); + switch (popr->type) { case OPT_REG: switch (popr->lmod) { @@ -2167,21 +2397,45 @@ static char *out_src_opr_u32(char *buf, size_t buf_size, return out_src_opr(buf, buf_size, po, popr, NULL, 0); } -static char *out_src_opr_float(char *buf, size_t buf_size, - struct parsed_op *po, struct parsed_opr *popr) +static char *out_opr_float(char *buf, size_t buf_size, + struct parsed_op *po, struct parsed_opr *popr, int is_src, + int need_float_stack) { const char *cast = NULL; char tmp[256]; + union { + float f; + int i; + } u; switch (popr->type) { case OPT_REG: - if (popr->reg < xST0 || popr->reg > xST7) - ferr(po, "bad reg: %d\n", popr->reg); + if (popr->reg < xST0 || popr->reg > xST7) { + // func arg + ferr_assert(po, po->op == OP_PUSH); + ferr_assert(po, popr->lmod == OPLM_DWORD); + snprintf(buf, buf_size, "*(float *)&%s", opr_reg_p(po, popr)); + break; + } - snprintf(buf, buf_size, "f_st%d", popr->reg - xST0); + if (need_float_stack) { + if (popr->reg == xST0) + snprintf(buf, buf_size, "f_st[f_stp & 7]"); + else + snprintf(buf, buf_size, "f_st[(f_stp + %d) & 7]", + popr->reg - xST0); + } + else + snprintf(buf, buf_size, "f_st%d", popr->reg - xST0); break; case OPT_REGMEM: + if (popr->lmod == OPLM_QWORD && is_stack_access(po, popr)) { + stack_frame_access(po, popr, buf, buf_size, + popr->name, "", is_src, 0); + break; + } + // fallthrough case OPT_LABEL: case OPT_OFFSET: switch (popr->lmod) { @@ -2196,7 +2450,17 @@ static char *out_src_opr_float(char *buf, size_t buf_size, break; } out_src_opr(tmp, sizeof(tmp), po, popr, "", 1); - snprintf(buf, buf_size, "*((%s *)%s)", cast, tmp); + snprintf(buf, buf_size, "*(%s *)(%s)", cast, tmp); + break; + + case OPT_CONST: + // only for func float args pushes + ferr_assert(po, po->op == OP_PUSH); + u.i = po->operand[0].val; + if (ceilf(u.f) == u.f) + snprintf(buf, buf_size, "%.1ff", u.f); + else + snprintf(buf, buf_size, "%.8ff", u.f); break; default: @@ -2206,11 +2470,16 @@ static char *out_src_opr_float(char *buf, size_t buf_size, return buf; } +static char *out_src_opr_float(char *buf, size_t buf_size, + struct parsed_op *po, struct parsed_opr *popr, int need_float_stack) +{ + return out_opr_float(buf, buf_size, po, popr, 1, need_float_stack); +} + static char *out_dst_opr_float(char *buf, size_t buf_size, - struct parsed_op *po, struct parsed_opr *popr) + struct parsed_op *po, struct parsed_opr *popr, int need_float_stack) { - // same? - return out_src_opr_float(buf, buf_size, po, popr); + return out_opr_float(buf, buf_size, po, popr, 0, need_float_stack); } static void out_test_for_cc(char *buf, size_t buf_size, @@ -2224,7 +2493,7 @@ static void out_test_for_cc(char *buf, size_t buf_size, switch (pfo) { case PFO_Z: - case PFO_BE: // CF=1||ZF=1; CF=0 + case PFO_BE: // CF==1||ZF==1; CF=0 snprintf(buf, buf_size, "(%s%s %s 0)", cast, expr, is_inv ? "!=" : "=="); break; @@ -2235,18 +2504,29 @@ static void out_test_for_cc(char *buf, size_t buf_size, scast, expr, is_inv ? ">=" : "<"); break; - case PFO_LE: // ZF=1||SF!=OF; OF=0 + case PFO_LE: // ZF==1||SF!=OF; OF=0 snprintf(buf, buf_size, "(%s%s %s 0)", scast, expr, is_inv ? ">" : "<="); break; + case PFO_C: // CF=0 + case PFO_O: // OF=0 + snprintf(buf, buf_size, "(%d)", !!is_inv); + break; + + case PFO_P: // PF==1 + snprintf(buf, buf_size, "(%sdo_parity(%s))", + is_inv ? "!" : "", expr); + break; + default: ferr(po, "%s: unhandled parsed_flag_op: %d\n", __func__, pfo); } } static void out_cmp_for_cc(char *buf, size_t buf_size, - struct parsed_op *po, enum parsed_flag_op pfo, int is_inv) + struct parsed_op *po, enum parsed_flag_op pfo, int is_inv, + int is_neg) { const char *cast, *scast, *cast_use; char buf1[256], buf2[256]; @@ -2280,8 +2560,13 @@ static void out_cmp_for_cc(char *buf, size_t buf_size, out_src_opr(buf1, sizeof(buf1), po, &po->operand[0], cast_use, 0); if (po->op == OP_DEC) snprintf(buf2, sizeof(buf2), "1"); - else - out_src_opr(buf2, sizeof(buf2), po, &po->operand[1], cast_use, 0); + else { + char cast_op2[64]; + snprintf(cast_op2, sizeof(cast_op2) - 1, "%s", cast_use); + if (is_neg) + strcat(cast_op2, "-"); + out_src_opr(buf2, sizeof(buf2), po, &po->operand[1], cast_op2, 0); + } switch (pfo) { case PFO_C: @@ -2349,7 +2634,7 @@ static void out_cmp_test(char *buf, size_t buf_size, po->operand[0].lmod, buf3); } else if (po->op == OP_CMP) { - out_cmp_for_cc(buf, buf_size, po, pfo, is_inv); + out_cmp_for_cc(buf, buf_size, po, pfo, is_inv, 0); } else ferr(po, "%s: unhandled op: %d\n", __func__, po->op); @@ -2423,8 +2708,9 @@ static const char *op_to_c(struct parsed_op *po) // note: this skips over calls and rm'd stuff assuming they're handled // so it's intended to use at one of final passes +// exception: doesn't skip OPF_RSAVE stuff static int scan_for_pop(int i, int opcnt, int magic, int reg, - int depth, int flags_set) + int depth, int seen_noreturn, int save_level, int flags_set) { struct parsed_op *po; int relevant; @@ -2438,16 +2724,28 @@ static int scan_for_pop(int i, int opcnt, int magic, int reg, po->cc_scratch = magic; if (po->flags & OPF_TAIL) { - if (po->op == OP_CALL) { - if (po->pp != NULL && po->pp->is_noreturn) - // assume no stack cleanup for noreturn - return 1; + if (po->op == OP_CALL && po->pp != NULL && po->pp->is_noreturn) { + // msvc sometimes generates stack cleanup code after + // noreturn, set a flag and continue + seen_noreturn = 1; + + // ... but stop if there is another path to next insn - + // if msvc skipped something stack tracking may mess up + if (i + 1 < opcnt && g_labels[i + 1] != NULL) + goto out; } - return -1; // deadend + else + goto out; } - if (po->flags & (OPF_RMD|OPF_DONE|OPF_FARG)) + if (po->flags & OPF_FARG) continue; + if (po->flags & (OPF_RMD|OPF_DONE)) { + if (!(po->flags & OPF_RSAVE)) + continue; + // reprocess, there might be another push in some "parallel" + // path that took a pop what we should also take + } if ((po->flags & OPF_JMP) && po->op != OP_CALL) { if (po->btj != NULL) { @@ -2455,7 +2753,7 @@ static int scan_for_pop(int i, int opcnt, int magic, int reg, for (j = 0; j < po->btj->count; j++) { check_i(po, po->btj->d[j].bt_i); ret |= scan_for_pop(po->btj->d[j].bt_i, opcnt, magic, reg, - depth, flags_set); + depth, seen_noreturn, save_level, flags_set); if (ret < 0) return ret; // dead end } @@ -2465,7 +2763,7 @@ static int scan_for_pop(int i, int opcnt, int magic, int reg, check_i(po, po->bt_i); if (po->flags & OPF_CJMP) { ret |= scan_for_pop(po->bt_i, opcnt, magic, reg, - depth, flags_set); + depth, seen_noreturn, save_level, flags_set); if (ret < 0) return ret; // dead end } @@ -2487,6 +2785,13 @@ static int scan_for_pop(int i, int opcnt, int magic, int reg, } else if (po->op == OP_POP) { if (relevant && depth == 0) { + if (flags_set == 0 && save_level > 0) { + ret = scan_for_pop(i + 1, opcnt, magic, reg, + depth, seen_noreturn, save_level - 1, flags_set); + if (ret != 1) + // no pop for other levels, current one must be false + return -1; + } po->flags |= flags_set; return 1; } @@ -2494,7 +2799,9 @@ static int scan_for_pop(int i, int opcnt, int magic, int reg, } } - return -1; +out: + // for noreturn, assume msvc skipped stack cleanup + return seen_noreturn ? 1 : -1; } // scan for 'reg' pop backwards starting from i @@ -2544,8 +2851,9 @@ static int scan_for_rsave_pop_reg(int i, int magic, int reg, int set_flags) return -1; } - // nothing interesting on this path - return 0; + // nothing interesting on this path, + // still return ret for something recursive calls could find + return ret; } static void find_reachable_exits(int i, int opcnt, int magic, @@ -2596,7 +2904,8 @@ static int scan_for_pop_ret(int i, int opcnt, int reg, int set_flags) { static int exits[MAX_EXITS]; static int exit_count; - int j, ret; + int found = 0; + int e, j, ret; if (!set_flags) { exit_count = 0; @@ -2606,13 +2915,23 @@ static int scan_for_pop_ret(int i, int opcnt, int reg, int set_flags) } for (j = 0; j < exit_count; j++) { - ret = scan_for_rsave_pop_reg(exits[j], i + opcnt * 16 + set_flags, + e = exits[j]; + ret = scan_for_rsave_pop_reg(e, i + opcnt * 16 + set_flags, reg, set_flags); - if (ret == -1) - return -1; + if (ret != -1) { + found |= ret; + continue; + } + if (ops[e].op == OP_CALL && ops[e].pp != NULL + && ops[e].pp->is_noreturn) + { + // assume stack cleanup was skipped + continue; + } + return -1; } - return 1; + return found; } // scan for one or more pop of push @@ -2981,8 +3300,11 @@ static int scan_for_mod_opr0(struct parsed_op *po_test, return -1; } -static int scan_for_flag_set(int i, int magic, int *branched, - int *setters, int *setter_cnt) +static int try_resolve_const(int i, const struct parsed_opr *opr, + int magic, unsigned int *val); + +static int scan_for_flag_set(int i, int opcnt, int magic, + int *branched, int *setters, int *setter_cnt) { struct label_ref *lr; int ret; @@ -3001,7 +3323,7 @@ static int scan_for_flag_set(int i, int magic, int *branched, lr = &g_label_refs[i]; for (; lr->next; lr = lr->next) { check_i(&ops[i], lr->i); - ret = scan_for_flag_set(lr->i, magic, + ret = scan_for_flag_set(lr->i, opcnt, magic, branched, setters, setter_cnt); if (ret < 0) return ret; @@ -3012,7 +3334,7 @@ static int scan_for_flag_set(int i, int magic, int *branched, i = lr->i; continue; } - ret = scan_for_flag_set(lr->i, magic, + ret = scan_for_flag_set(lr->i, opcnt, magic, branched, setters, setter_cnt); if (ret < 0) return ret; @@ -3022,6 +3344,20 @@ static int scan_for_flag_set(int i, int magic, int *branched, if (ops[i].flags & OPF_FLAGS) { setters[*setter_cnt] = i; (*setter_cnt)++; + + if (ops[i].flags & OPF_REP) { + struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xCX); + unsigned int uval; + + ret = try_resolve_const(i, &opr, i + opcnt * 7, &uval); + if (ret != 1 || uval == 0) { + // can't treat it as full setter because of ecx=0 case, + // also disallow delayed compare + *branched = 1; + continue; + } + } + return 0; } @@ -3221,12 +3557,18 @@ static void scan_fwd_set_flags(int i, int opcnt, int magic, int flags) } static const struct parsed_proto *try_recover_pp( - struct parsed_op *po, const struct parsed_opr *opr, int *search_instead) + struct parsed_op *po, const struct parsed_opr *opr, + int is_call, int *search_instead) { const struct parsed_proto *pp = NULL; char buf[256]; char *p; + if (po->pp != NULL && (po->flags & OPF_DATA)) { + // hint given in asm + return po->pp; + } + // maybe an arg of g_func? if (opr->type == OPT_REGMEM && is_stack_access(po, opr)) { @@ -3260,10 +3602,12 @@ static const struct parsed_proto *try_recover_pp( if (arg == g_func_pp->argc) ferr(po, "stack arg %d not in prototype?\n", arg_i); - pp = g_func_pp->arg[arg].fptr; - if (pp == NULL) - ferr(po, "icall sa: arg%d is not a fptr?\n", arg + 1); - check_func_pp(po, pp, "icall arg"); + pp = g_func_pp->arg[arg].pp; + if (is_call) { + if (pp == NULL) + ferr(po, "icall arg: arg%d has no pp\n", arg + 1); + check_func_pp(po, pp, "icall arg"); + } } else if (opr->type == OPT_REGMEM && strchr(opr->name + 1, '[')) { // label[index] @@ -3344,19 +3688,19 @@ static void scan_for_call_type(int i, const struct parsed_opr *opr, } if (i == g_func_pp->argc) return; - pp = g_func_pp->arg[i].fptr; + pp = g_func_pp->arg[i].pp; if (pp == NULL) ferr(po, "icall: arg%d (%s) is not a fptr?\n", i + 1, g_func_pp->arg[i].reg); check_func_pp(po, pp, "icall reg-arg"); } else - pp = try_recover_pp(po, opr, NULL); + pp = try_recover_pp(po, opr, 1, NULL); if (*pp_found != NULL && pp != NULL && *pp_found != pp) { if (!IS((*pp_found)->ret_type.name, pp->ret_type.name) || (*pp_found)->is_stdcall != pp->is_stdcall - || (*pp_found)->is_fptr != pp->is_fptr + //|| (*pp_found)->is_fptr != pp->is_fptr || (*pp_found)->argc != pp->argc || (*pp_found)->argc_reg != pp->argc_reg || (*pp_found)->argc_stack != pp->argc_stack) @@ -3488,6 +3832,13 @@ static int get_pp_arg_regmask_dst(const struct parsed_proto *pp) return regmask | mxAX; } +static int are_ops_same(struct parsed_op *po1, struct parsed_op *po2) +{ + return po1->op == po2->op && po1->operand_cnt == po2->operand_cnt + && memcmp(po1->operand, po2->operand, + sizeof(po1->operand[0]) * po1->operand_cnt) == 0; +} + static void resolve_branches_parse_calls(int opcnt) { static const struct { @@ -3497,13 +3848,19 @@ static void resolve_branches_parse_calls(int opcnt) unsigned int regmask_src; unsigned int regmask_dst; } pseudo_ops[] = { - { "__ftol", OPP_FTOL, OPF_FPOP, mxST0, mxAX | mxDX }, + { "__allshl", OPP_ALLSHL, OPF_DATA, mxAX|mxDX|mxCX, mxAX|mxDX }, + { "__allshr", OPP_ALLSHR, OPF_DATA, mxAX|mxDX|mxCX, mxAX|mxDX }, + { "__ftol", OPP_FTOL, OPF_FPOP, mxST0, mxAX | mxDX }, + // more precise? Wine gets away with just __ftol handler + { "__ftol2", OPP_FTOL, OPF_FPOP, mxST0, mxAX | mxDX }, + { "__CIpow", OPP_CIPOW, OPF_FPOP, mxST0|mxST1, mxST0 }, }; const struct parsed_proto *pp_c; struct parsed_proto *pp; struct parsed_data *pd; struct parsed_op *po; const char *tmpname; + enum op_op prev_op; int i, l; int ret; @@ -3533,8 +3890,21 @@ static void resolve_branches_parse_calls(int opcnt) else if (po->operand[0].type == OPT_LABEL) { tmpname = opr_name(po, 0); - if (IS_START(tmpname, "loc_")) - ferr(po, "call to loc_*\n"); + if (IS_START(tmpname, "loc_")) { + if (!g_seh_found) + ferr(po, "call to loc_*\n"); + // eliminate_seh() must take care of it + continue; + } + if (IS(tmpname, "__alloca_probe")) + continue; + if (IS(tmpname, "__SEH_prolog")) { + ferr_assert(po, g_seh_found == 0); + g_seh_found = 2; + continue; + } + if (IS(tmpname, "__SEH_epilog")) + continue; // convert some calls to pseudo-ops for (l = 0; l < ARRAY_SIZE(pseudo_ops); l++) { @@ -3565,8 +3935,10 @@ static void resolve_branches_parse_calls(int opcnt) if (pp != NULL) { if (pp->is_fptr) check_func_pp(po, pp, "fptr var call"); - if (pp->is_noreturn) + if (pp->is_noreturn) { po->flags |= OPF_TAIL; + po->flags &= ~OPF_ATAIL; // most likely... + } } po->pp = pp; continue; @@ -3589,8 +3961,10 @@ static void resolve_branches_parse_calls(int opcnt) && IS(po->operand[0].name, g_labels[l])) { if (l == i + 1 && po->op == OP_JMP) { - // yet another alignment type.. - po->flags |= OPF_RMD|OPF_DONE; + // yet another alignment type... + po->flags |= OPF_RMD | OPF_DONE; + po->flags &= ~OPF_JMP; + po->op = OP_NOP; break; } add_label_ref(&g_label_refs[l], i); @@ -3611,139 +3985,476 @@ static void resolve_branches_parse_calls(int opcnt) tailcall: po->op = OP_CALL; po->flags |= OPF_TAIL; - if (i > 0 && ops[i - 1].op == OP_POP) + prev_op = i > 0 ? ops[i - 1].op : OP_UD2; + if (prev_op == OP_POP) + po->flags |= OPF_ATAIL; + if (g_stack_fsz + g_bp_frame == 0 && prev_op != OP_PUSH + && (g_func_pp == NULL || g_func_pp->argc_stack > 0)) + { po->flags |= OPF_ATAIL; + } i--; // reprocess } } -static void scan_prologue_epilogue(int opcnt) +static int resolve_origin(int i, const struct parsed_opr *opr, + int magic, int *op_i, int *is_caller); +static void set_label(int i, const char *name); + +static void eliminate_seh_writes(int opcnt) { - int ecx_push = 0, esp_sub = 0; - int found; - int i, j, l; + const struct parsed_opr *opr; + char ofs_reg[16]; + int offset; + int i; - if (ops[0].op == OP_PUSH && IS(opr_name(&ops[0], 0), "ebp") - && ops[1].op == OP_MOV - && IS(opr_name(&ops[1], 0), "ebp") - && IS(opr_name(&ops[1], 1), "esp")) - { - g_bp_frame = 1; - ops[0].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - ops[1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - i = 2; + // assume all sf writes above g_seh_size to be seh related + // (probably unsafe but oh well) + for (i = 0; i < opcnt; i++) { + if (ops[i].op != OP_MOV) + continue; + opr = &ops[i].operand[0]; + if (opr->type != OPT_REGMEM) + continue; + if (!is_stack_access(&ops[i], opr)) + continue; - if (ops[2].op == OP_SUB && IS(opr_name(&ops[2], 0), "esp")) { - g_stack_fsz = opr_const(&ops[2], 1); - ops[2].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - i++; - } - else { - // another way msvc builds stack frame.. - i = 2; - while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) { - g_stack_fsz += 4; - ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - ecx_push++; - i++; - } - // and another way.. - if (i == 2 && ops[i].op == OP_MOV && ops[i].operand[0].reg == xAX - && ops[i].operand[1].type == OPT_CONST - && ops[i + 1].op == OP_CALL - && IS(opr_name(&ops[i + 1], 0), "__alloca_probe")) - { - g_stack_fsz += ops[i].operand[1].val; - ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - i++; - ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - i++; - } - } + offset = 0; + parse_stack_access(&ops[i], opr->name, ofs_reg, &offset, + NULL, NULL, 0); + if (offset < 0 && offset >= -g_seh_size) + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + } +} - found = 0; - do { - for (; i < opcnt; i++) - if (ops[i].flags & OPF_TAIL) - break; - j = i - 1; - if (i == opcnt && (ops[j].flags & OPF_JMP)) { - if (ops[j].bt_i != -1 || ops[j].btj != NULL) - break; - i--; - j--; - } +static void eliminate_seh_finally(int opcnt) +{ + const char *target_name = NULL; + const char *return_name = NULL; + int exits[MAX_EXITS]; + int exit_count = 0; + int call_i = -1; + int target_i = -1; + int return_i = -1; + int tgend_i = -1; + int i; - if ((ops[j].op == OP_POP && IS(opr_name(&ops[j], 0), "ebp")) - || ops[j].op == OP_LEAVE) - { - ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - } - else if (ops[i].op == OP_CALL && ops[i].pp != NULL - && ops[i].pp->is_noreturn) - { - // on noreturn, msvc sometimes cleans stack, sometimes not - i++; - found = 1; - continue; - } - else if (!(g_ida_func_attr & IDAFA_NORETURN)) - ferr(&ops[j], "'pop ebp' expected\n"); + for (i = 0; i < opcnt; i++) { + if (ops[i].op != OP_CALL) + continue; + if (!IS_START(opr_name(&ops[i], 0), "loc_")) + continue; + if (target_name != NULL) + ferr(&ops[i], "multiple finally calls? (last was %s)\n", + target_name); + target_name = opr_name(&ops[i], 0); + call_i = i; - if (g_stack_fsz != 0) { - if (ops[j].op == OP_LEAVE) - j--; - else if (ops[j].op == OP_POP - && ops[j - 1].op == OP_MOV - && IS(opr_name(&ops[j - 1], 0), "esp") - && IS(opr_name(&ops[j - 1], 1), "ebp")) - { - ops[j - 1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - j -= 2; - } - else if (!(g_ida_func_attr & IDAFA_NORETURN)) - { - ferr(&ops[j], "esp restore expected\n"); - } + if (g_labels[i + 1] == NULL) + set_label(i + 1, "seh_fin_done"); + return_name = g_labels[i + 1]; + return_i = i + 1; + } - if (ecx_push && j >= 0 && ops[j].op == OP_POP - && IS(opr_name(&ops[j], 0), "ecx")) - { - ferr(&ops[j], "unexpected ecx pop\n"); - } - } + if (call_i == -1) + // no finally block + return; - found = 1; - i++; - } while (i < opcnt); + // find finally code (bt_i is not set because it's call) + for (i = 0; i < opcnt; i++) { + if (g_labels[i] == NULL) + continue; + if (!IS(g_labels[i], target_name)) + continue; - if (!found) - ferr(ops, "missing ebp epilogue\n"); - return; + ferr_assert(&ops[i], target_i == -1); + target_i = i; + } + ferr_assert(&ops[0], target_i != -1); + + find_reachable_exits(target_i, opcnt, target_i + opcnt * 24, + exits, &exit_count); + ferr_assert(&ops[target_i], exit_count == 1); + ferr_assert(&ops[target_i], ops[exits[0]].op == OP_RET); + tgend_i = exits[0]; + + // convert to jumps, link + ops[call_i].op = OP_JMP; + ops[call_i].bt_i = target_i; + add_label_ref(&g_label_refs[target_i], call_i); + + ops[tgend_i].op = OP_JMP; + ops[tgend_i].flags &= ~OPF_TAIL; + ops[tgend_i].flags |= OPF_JMP; + ops[tgend_i].bt_i = return_i; + ops[tgend_i].operand_cnt = 1; + ops[tgend_i].operand[0].type = OPT_LABEL; + snprintf(ops[tgend_i].operand[0].name, NAMELEN, "%s", return_name); + add_label_ref(&g_label_refs[return_i], tgend_i); + + // rm seh finally entry code + for (i = target_i - 1; i >= 0; i--) { + if (g_labels[i] != NULL && g_label_refs[i].i != -1) + return; + if (ops[i].flags & OPF_CJMP) + return; + if (ops[i].flags & (OPF_JMP | OPF_TAIL)) + break; } - - // non-bp frame - i = 0; - while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) { + for (i = target_i - 1; i >= 0; i--) { + if (ops[i].flags & (OPF_JMP | OPF_TAIL)) + break; ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - g_stack_fsz += 4; - ecx_push++; - i++; } +} - for (; i < opcnt; i++) { - if (ops[i].op == OP_PUSH || (ops[i].flags & (OPF_JMP|OPF_TAIL))) - break; +static void eliminate_seh(int opcnt) +{ + int i, j, k, ret; + + for (i = 0; i < opcnt; i++) { + if (ops[i].op != OP_MOV) + continue; + if (ops[i].operand[0].segment != SEG_FS) + continue; + if (!IS(opr_name(&ops[i], 0), "0")) + continue; + + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + if (ops[i].operand[1].reg == xSP) { + for (j = i - 1; j >= 0; j--) { + if (ops[j].op != OP_PUSH) + continue; + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + g_seh_size += 4; + if (ops[j].operand[0].val == ~0) + break; + if (ops[j].operand[0].type == OPT_REG) { + k = -1; + ret = resolve_origin(j, &ops[j].operand[0], + j + opcnt * 22, &k, NULL); + if (ret == 1) + ops[k].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + } + } + if (j < 0) + ferr(ops, "missing seh terminator\n"); + } + else { + k = -1; + ret = resolve_origin(i, &ops[i].operand[1], + i + opcnt * 23, &k, NULL); + if (ret == 1) + ops[k].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + } + } + + eliminate_seh_writes(opcnt); + eliminate_seh_finally(opcnt); +} + +static void eliminate_seh_calls(int opcnt) +{ + int epilog_found = 0; + int i; + + g_bp_frame = 1; + g_seh_size = 0x10; + + i = 0; + ferr_assert(&ops[i], ops[i].op == OP_PUSH + && ops[i].operand[0].type == OPT_CONST); + g_stack_fsz = g_seh_size + ops[i].operand[0].val; + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + + i++; + ferr_assert(&ops[i], ops[i].op == OP_PUSH + && ops[i].operand[0].type == OPT_OFFSET); + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + + i++; + ferr_assert(&ops[i], ops[i].op == OP_CALL + && IS(opr_name(&ops[i], 0), "__SEH_prolog")); + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + + for (i++; i < opcnt; i++) { + if (ops[i].op != OP_CALL) + continue; + if (!IS(opr_name(&ops[i], 0), "__SEH_epilog")) + continue; + + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + epilog_found = 1; + } + ferr_assert(ops, epilog_found); + + eliminate_seh_writes(opcnt); + eliminate_seh_finally(opcnt); +} + +// check for prologue of many pushes and epilogue with pops +static void check_simple_sequence(int opcnt, int *fsz) +{ + int found = 0; + int seq_len; + int seq_p; + int seq[4]; + int reg; + int i, j; + + for (i = 0; i < opcnt && i < ARRAY_SIZE(seq); i++) { + if (ops[i].op != OP_PUSH || ops[i].operand[0].type != OPT_REG) + break; + reg = ops[i].operand[0].reg; + if (reg != xBX && reg != xSI && reg != xDI && reg != xBP) + break; + for (j = 0; j < i; j++) + if (seq[j] == reg) + break; + if (j != i) + // probably something else is going on here + break; + seq[i] = reg; + } + seq_len = i; + if (seq_len == 0) + return; + + for (; i < opcnt && seq_len > 0; i++) { + if (!(ops[i].flags & OPF_TAIL)) + continue; + + for (j = i - 1, seq_p = 0; j >= 0 && seq_p < seq_len; j--) { + if (ops[j].op != OP_POP || ops[j].operand[0].type != OPT_REG) + break; + if (ops[j].operand[0].reg != seq[seq_p]) + break; + seq_p++; + } + found = seq_len = seq_p; + } + if (!found) + return; + + for (i = 0; i < seq_len; i++) + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + + for (; i < opcnt && seq_len > 0; i++) { + if (!(ops[i].flags & OPF_TAIL)) + continue; + + for (j = i - 1, seq_p = 0; j >= 0 && seq_p < seq_len; j--) { + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + seq_p++; + } + } + + // unlike pushes after sub esp, + // IDA treats pushes like this as part of var area + *fsz += seq_len * 4; +} + +static int scan_prologue(int i, int opcnt, int *ecx_push, int *esp_sub) +{ + const char *name; + int j, len, ret; + + for (; i < opcnt; i++) + if (!(ops[i].flags & OPF_DONE)) + break; + + while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) { + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + g_stack_fsz += 4; + (*ecx_push)++; + i++; + } + + for (; i < opcnt; i++) { + if (i > 0 && g_labels[i] != NULL) + break; + if (ops[i].flags & (OPF_JMP|OPF_TAIL)) + break; + if (ops[i].flags & OPF_DONE) + continue; + if (ops[i].op == OP_PUSH) + break; if (ops[i].op == OP_SUB && ops[i].operand[0].reg == xSP && ops[i].operand[1].type == OPT_CONST) { - g_stack_fsz = ops[i].operand[1].val; + g_stack_fsz += opr_const(&ops[i], 1); + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + i++; + *esp_sub = 1; + break; + } + if (ops[i].op == OP_LEA && ops[i].operand[0].reg == xSP + && ops[i].operand[1].type == OPT_REGMEM + && IS_START(ops[i].operand[1].name, "esp-")) + { + name = ops[i].operand[1].name; + ret = sscanf(name, "esp-%x%n", &j, &len); + ferr_assert(&ops[i], ret == 1 && len == strlen(name)); + g_stack_fsz += j; ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - esp_sub = 1; + i++; + *esp_sub = 1; break; } + if (ops[i].op == OP_MOV && ops[i].operand[0].reg == xAX + && ops[i].operand[1].type == OPT_CONST) + { + for (j = i + 1; j < opcnt; j++) + if (!(ops[j].flags & OPF_DONE)) + break; + if (ops[j].op == OP_CALL + && IS(opr_name(&ops[j], 0), "__alloca_probe")) + { + g_stack_fsz += opr_const(&ops[i], 1); + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + i = j + 1; + *esp_sub = 1; + break; + } + } + } + + return i; +} + +static void scan_prologue_epilogue(int opcnt, int *stack_align) +{ + int ecx_push = 0, esp_sub = 0, pusha = 0; + int sandard_epilogue; + int found, ret, len; + int push_fsz = 0; + int i, j, l; + + if (g_seh_found == 2) { + eliminate_seh_calls(opcnt); + return; + } + if (g_seh_found) { + eliminate_seh(opcnt); + // ida treats seh as part of sf + g_stack_fsz = g_seh_size; + esp_sub = 1; + } + + if (ops[0].op == OP_PUSH && IS(opr_name(&ops[0], 0), "ebp") + && ops[1].op == OP_MOV + && IS(opr_name(&ops[1], 0), "ebp") + && IS(opr_name(&ops[1], 1), "esp")) + { + g_bp_frame = 1; + ops[0].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + ops[1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + + for (i = 2; i < opcnt; i++) + if (!(ops[i].flags & OPF_DONE)) + break; + + if (ops[i].op == OP_PUSHA) { + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + pusha = 1; + i++; + } + + if (ops[i].op == OP_AND && ops[i].operand[0].reg == xSP + && ops[i].operand[1].type == OPT_CONST) + { + l = ops[i].operand[1].val; + j = ffs(l) - 1; + if (j == -1 || (l >> j) != -1) + ferr(&ops[i], "unhandled esp align: %x\n", l); + if (stack_align != NULL) + *stack_align = 1 << j; + ops[i].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + i++; + } + + i = scan_prologue(i, opcnt, &ecx_push, &esp_sub); + + found = 0; + do { + for (; i < opcnt; i++) + if (ops[i].flags & OPF_TAIL) + break; + j = i - 1; + if (i == opcnt && (ops[j].flags & OPF_JMP)) { + if (ops[j].bt_i != -1 || ops[j].btj != NULL) + break; + i--; + j--; + } + + sandard_epilogue = 0; + if (ops[j].op == OP_POP && IS(opr_name(&ops[j], 0), "ebp")) + { + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + // the standard epilogue is sometimes even used without a sf + if (ops[j - 1].op == OP_MOV + && IS(opr_name(&ops[j - 1], 0), "esp") + && IS(opr_name(&ops[j - 1], 1), "ebp")) + sandard_epilogue = 1; + } + else if (ops[j].op == OP_LEAVE) + { + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + sandard_epilogue = 1; + } + else if (ops[i].op == OP_CALL && ops[i].pp != NULL + && ops[i].pp->is_noreturn) + { + // on noreturn, msvc sometimes cleans stack, sometimes not + i++; + found = 1; + continue; + } + else if (!(g_ida_func_attr & IDAFA_NORETURN)) + ferr(&ops[j], "'pop ebp' expected\n"); + + if (g_stack_fsz != 0 || sandard_epilogue) { + if (ops[j].op == OP_LEAVE) + j--; + else if (sandard_epilogue) // mov esp, ebp + { + ops[j - 1].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + j -= 2; + } + else if (!(g_ida_func_attr & IDAFA_NORETURN)) + { + ferr(&ops[j], "esp restore expected\n"); + } + + if (ecx_push && j >= 0 && ops[j].op == OP_POP + && IS(opr_name(&ops[j], 0), "ecx")) + { + ferr(&ops[j], "unexpected ecx pop\n"); + } + } + + if (pusha) { + if (ops[j].op == OP_POPA) + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + else + ferr(&ops[j], "popa expected\n"); + } + + found = 1; + i++; + } while (i < opcnt); + + if (!found) + ferr(ops, "missing ebp epilogue\n"); + return; } + // non-bp frame + check_simple_sequence(opcnt, &push_fsz); + i = scan_prologue(0, opcnt, &ecx_push, &esp_sub); + if (ecx_push && !esp_sub) { // could actually be args for a call.. for (; i < opcnt; i++) @@ -3765,7 +4476,8 @@ static void scan_prologue_epilogue(int opcnt) ferr(&ops[i], "unhandled prologue\n"); // recheck - i = g_stack_fsz = ecx_push = 0; + i = ecx_push = 0; + g_stack_fsz = g_seh_size; while (ops[i].op == OP_PUSH && IS(opr_name(&ops[i], 0), "ecx")) { if (!(ops[i].flags & OPF_RMD)) break; @@ -3781,11 +4493,11 @@ static void scan_prologue_epilogue(int opcnt) { g_sp_frame = 1; - i++; do { for (; i < opcnt; i++) if (ops[i].flags & OPF_TAIL) break; + j = i - 1; if (i == opcnt && (ops[j].flags & OPF_JMP)) { if (ops[j].bt_i != -1 || ops[j].btj != NULL) @@ -3793,9 +4505,28 @@ static void scan_prologue_epilogue(int opcnt) i--; j--; } + else if (i < opcnt && (ops[i].flags & OPF_ATAIL)) { + // skip arg updates for arg-reuse tailcall + for (; j >= 0; j--) { + if (ops[j].op != OP_MOV) + break; + if (ops[j].operand[0].type == OPT_REGMEM + && strstr(ops[j].operand[0].name, "arg_") != NULL) + continue; + if (ops[j].operand[0].type == OPT_REG) + continue; // assume arg-reg mov + break; + } + } + + for (; j >= 0; j--) { + if ((ops[j].flags & (OPF_RMD | OPF_DONE | OPF_NOREGS)) != + (OPF_RMD | OPF_DONE | OPF_NOREGS)) + break; + } - if (ecx_push > 0) { - for (l = 0; l < ecx_push; l++) { + if (ecx_push > 0 && !esp_sub) { + for (l = 0; l < ecx_push && j >= 0; l++) { if (ops[j].op == OP_POP && IS(opr_name(&ops[j], 0), "ecx")) /* pop ecx */; else if (ops[j].op == OP_ADD @@ -3806,27 +4537,58 @@ static void scan_prologue_epilogue(int opcnt) l += ops[j].operand[1].val / 4 - 1; } else - ferr(&ops[j], "'pop ecx' expected\n"); + break; ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; j--; } - if (l != ecx_push) + if (l != ecx_push) { + if (i < opcnt && ops[i].op == OP_CALL + && ops[i].pp != NULL && ops[i].pp->is_noreturn) + { + // noreturn tailcall with no epilogue + i++; + found = 1; + continue; + } ferr(&ops[j], "epilogue scan failed\n"); + } found = 1; } if (esp_sub) { - if (ops[j].op != OP_ADD - || !IS(opr_name(&ops[j], 0), "esp") - || ops[j].operand[1].type != OPT_CONST - || ops[j].operand[1].val != g_stack_fsz) - ferr(&ops[j], "'add esp' expected\n"); + if (ops[j].op == OP_ADD + && IS(opr_name(&ops[j], 0), "esp") + && ops[j].operand[1].type == OPT_CONST) + { + if (ops[j].operand[1].val < g_stack_fsz) + ferr(&ops[j], "esp adj is too low (need %d)\n", g_stack_fsz); - ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; - ops[j].operand[1].val = 0; // hack for stack arg scanner - found = 1; + ops[j].operand[1].val -= g_stack_fsz; // for stack arg scanner + if (ops[j].operand[1].val == 0) + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + found = 1; + } + else if (ops[j].op == OP_LEA && ops[j].operand[0].reg == xSP + && ops[j].operand[1].type == OPT_REGMEM + && IS_START(ops[j].operand[1].name, "esp+")) + { + const char *name = ops[j].operand[1].name; + ret = sscanf(name, "esp+%x%n", &l, &len); + ferr_assert(&ops[j], ret == 1 && len == strlen(name)); + ferr_assert(&ops[j], l <= g_stack_fsz); + ops[j].flags |= OPF_RMD | OPF_DONE | OPF_NOREGS; + found = 1; + } + else if (i < opcnt && ops[i].op == OP_CALL + && ops[i].pp != NULL && ops[i].pp->is_noreturn) + { + // noreturn tailcall with no epilogue + found = 1; + } + else + ferr(&ops[j], "'add esp' expected\n"); } i++; @@ -3835,6 +4597,10 @@ static void scan_prologue_epilogue(int opcnt) if (!found) ferr(ops, "missing esp epilogue\n"); } + + if (g_stack_fsz != 0) + // see check_simple_sequence + g_stack_fsz += push_fsz; } // find an instruction that changed opr before i op @@ -3848,10 +4614,6 @@ static int resolve_origin(int i, const struct parsed_opr *opr, struct label_ref *lr; int ret = 0; - if (ops[i].cc_scratch == magic) - return 0; - ops[i].cc_scratch = magic; - while (1) { if (g_labels[i] != NULL) { lr = &g_label_refs[i]; @@ -3880,10 +4642,9 @@ static int resolve_origin(int i, const struct parsed_opr *opr, continue; if (*op_i >= 0) { - if (*op_i == i) + if (*op_i == i || are_ops_same(&ops[*op_i], &ops[i])) return ret | 1; - // XXX: could check if the other op does the same return -1; } @@ -3902,10 +4663,6 @@ static int resolve_last_ref(int i, const struct parsed_opr *opr, struct label_ref *lr; int ret = 0; - if (ops[i].cc_scratch == magic) - return 0; - ops[i].cc_scratch = magic; - while (1) { if (g_labels[i] != NULL) { lr = &g_label_refs[i]; @@ -3936,6 +4693,45 @@ static int resolve_last_ref(int i, const struct parsed_opr *opr, } } +// adjust datap of all reachable 'op' insns when moving back +// returns 1 if at least 1 op was found +// returns -1 if path without an op was found +static int adjust_prev_op(int i, enum op_op op, int magic, void *datap) +{ + struct label_ref *lr; + int ret = 0; + + if (ops[i].cc_scratch == magic) + return 0; + ops[i].cc_scratch = magic; + + while (1) { + if (g_labels[i] != NULL) { + lr = &g_label_refs[i]; + for (; lr != NULL; lr = lr->next) { + check_i(&ops[i], lr->i); + ret |= adjust_prev_op(lr->i, op, magic, datap); + } + if (i > 0 && LAST_OP(i - 1)) + return ret; + } + + i--; + if (i < 0) + return -1; + + if (ops[i].cc_scratch == magic) + return 0; + ops[i].cc_scratch = magic; + + if (ops[i].op != op) + continue; + + ops[i].datap = datap; + return 1; + } +} + // find next instruction that reads opr // *op_i must be set to -1 by the caller // on return, *op_i is set to first referencer insn @@ -3978,11 +4774,13 @@ static int find_next_read(int i, int opcnt, } if (!is_opr_read(opr, po)) { - if (is_opr_modified(opr, po) - && (po->op == OP_CALL - || ((po->flags & OPF_DATA) - && po->operand[0].lmod == OPLM_DWORD))) + int full_opr = 1; + if (opr->type == OPT_REG && po->operand[0].type == OPT_REG + && opr->reg == po->operand[0].reg && (po->flags & OPF_DATA)) { + full_opr = po->operand[0].lmod >= opr->lmod; + } + if (is_opr_modified(opr, po) && full_opr) { // it's overwritten return ret; } @@ -3994,30 +4792,229 @@ static int find_next_read(int i, int opcnt, if (*op_i >= 0) return -1; - *op_i = i; - return 1; + *op_i = i; + return 1; + } + + return 0; +} + +static int find_next_read_reg(int i, int opcnt, int reg, + enum opr_lenmod lmod, int magic, int *op_i) +{ + struct parsed_opr opr = OPR_INIT(OPT_REG, lmod, reg); + + *op_i = -1; + return find_next_read(i, opcnt, &opr, magic, op_i); +} + +// find next instruction that reads opr +// *op_i must be set to -1 by the caller +// on return, *op_i is set to first flag user insn +// returns 1 if exactly 1 flag user is found +static int find_next_flag_use(int i, int opcnt, int magic, int *op_i) +{ + struct parsed_op *po; + int j, ret = 0; + + for (; i < opcnt; i++) + { + if (ops[i].cc_scratch == magic) + return ret; + ops[i].cc_scratch = magic; + + po = &ops[i]; + if (po->op == OP_CALL) + return -1; + if (po->flags & OPF_JMP) { + if (po->btj != NULL) { + // jumptable + for (j = 0; j < po->btj->count; j++) { + check_i(po, po->btj->d[j].bt_i); + ret |= find_next_flag_use(po->btj->d[j].bt_i, opcnt, + magic, op_i); + } + return ret; + } + + if (po->flags & OPF_RMD) + continue; + check_i(po, po->bt_i); + if (po->flags & OPF_CJMP) + goto found; + else + i = po->bt_i - 1; + continue; + } + + if (!(po->flags & OPF_CC)) { + if (po->flags & OPF_FLAGS) + // flags changed + return ret; + if (po->flags & OPF_TAIL) + return ret; + continue; + } + +found: + if (*op_i >= 0) + return -1; + + *op_i = i; + return 1; + } + + return 0; +} + +static int try_resolve_const(int i, const struct parsed_opr *opr, + int magic, unsigned int *val) +{ + int s_i = -1; + int ret; + + ret = resolve_origin(i, opr, magic, &s_i, NULL); + if (ret == 1) { + i = s_i; + if (ops[i].op != OP_MOV && ops[i].operand[1].type != OPT_CONST) + return -1; + + *val = ops[i].operand[1].val; + return 1; + } + + return -1; +} + +static int resolve_used_bits(int i, int opcnt, int reg, + int *mask, int *is_z_check) +{ + struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_WORD, reg); + int j = -1, k = -1; + int ret; + + ret = find_next_read(i, opcnt, &opr, i + opcnt * 20, &j); + if (ret != 1) + return -1; + + find_next_read(j + 1, opcnt, &opr, i + opcnt * 20 + 1, &k); + if (k != -1) { + fnote(&ops[j], "(first read)\n"); + ferr(&ops[k], "TODO: bit resolve: multiple readers\n"); + } + + if (ops[j].op != OP_TEST || ops[j].operand[1].type != OPT_CONST) + ferr(&ops[j], "TODO: bit resolve: not a const test\n"); + + ferr_assert(&ops[j], ops[j].operand[0].type == OPT_REG); + ferr_assert(&ops[j], ops[j].operand[0].reg == reg); + + *mask = ops[j].operand[1].val; + if (ops[j].operand[0].lmod == OPLM_BYTE + && ops[j].operand[0].name[1] == 'h') + { + *mask <<= 8; + } + ferr_assert(&ops[j], (*mask & ~0xffff) == 0); + + *is_z_check = 0; + ret = find_next_flag_use(j + 1, opcnt, i + opcnt * 20 + 2, &k); + if (ret == 1) + *is_z_check = ops[k].pfo == PFO_Z; + + return 0; +} + +static const struct parsed_proto *resolve_deref(int i, int magic, + struct parsed_opr *opr, int level) +{ + struct parsed_opr opr_s = OPR_INIT(OPT_REG, OPLM_DWORD, 0); + const struct parsed_proto *pp = NULL; + int from_caller = 0; + char s_reg[4]; + int offset = 0; + int len = 0; + int j = -1; + int k = -1; + int reg; + int ret; + + ret = sscanf(opr->name, "%3s+%x%n", s_reg, &offset, &len); + if (ret != 2 || len != strlen(opr->name)) { + ret = sscanf(opr->name, "%3s%n", s_reg, &len); + if (ret != 1 || len != strlen(opr->name)) + return NULL; } - return 0; -} + reg = char_array_i(regs_r32, ARRAY_SIZE(regs_r32), s_reg); + if (reg < 0) + return NULL; -static int try_resolve_const(int i, const struct parsed_opr *opr, - int magic, unsigned int *val) -{ - int s_i = -1; - int ret; + opr_s.reg = reg; + ret = resolve_origin(i, &opr_s, i + magic, &j, NULL); + if (ret != 1) + return NULL; - ret = resolve_origin(i, opr, magic, &s_i, NULL); - if (ret == 1) { - i = s_i; - if (ops[i].op != OP_MOV && ops[i].operand[1].type != OPT_CONST) - return -1; + if (ops[j].op == OP_MOV && ops[j].operand[1].type == OPT_REGMEM + && strlen(ops[j].operand[1].name) == 3 + && ops[j].operand[0].lmod == OPLM_DWORD + && ops[j].pp == NULL // no hint + && level == 0) + { + // allow one simple dereference (com/directx) + reg = char_array_i(regs_r32, ARRAY_SIZE(regs_r32), + ops[j].operand[1].name); + if (reg < 0) + return NULL; + opr_s.reg = reg; + ret = resolve_origin(j, &opr_s, j + magic, &k, NULL); + if (ret != 1) + return NULL; + j = k; + } + if (ops[j].op != OP_MOV || ops[j].operand[0].lmod != OPLM_DWORD) + return NULL; - *val = ops[i].operand[1].val; - return 1; + if (ops[j].pp != NULL) { + // type hint in asm + pp = ops[j].pp; + } + else if (ops[j].operand[1].type == OPT_REGMEM) { + pp = try_recover_pp(&ops[j], &ops[j].operand[1], 0, NULL); + if (pp == NULL) { + // maybe structure ptr in structure + pp = resolve_deref(j, magic, &ops[j].operand[1], level + 1); + } + } + else if (ops[j].operand[1].type == OPT_LABEL) + pp = proto_parse(g_fhdr, ops[j].operand[1].name, g_quiet_pp); + else if (ops[j].operand[1].type == OPT_REG) { + // maybe arg reg? + k = -1; + ret = resolve_origin(j, &ops[j].operand[1], i + magic, + &k, &from_caller); + if (ret != 1 && from_caller && k == -1 && g_func_pp != NULL) { + for (k = 0; k < g_func_pp->argc; k++) { + if (g_func_pp->arg[k].reg == NULL) + continue; + if (IS(g_func_pp->arg[k].reg, ops[j].operand[1].name)) { + pp = g_func_pp->arg[k].pp; + break; + } + } + } } - return -1; + if (pp == NULL) + return NULL; + if (pp->is_func || pp->is_fptr || !pp->type.is_struct) { + if (offset != 0) + ferr(&ops[j], "expected struct, got '%s %s'\n", + pp->type.name, pp->name); + return NULL; + } + + return proto_lookup_struct(g_fhdr, pp->type.name, offset); } static const struct parsed_proto *resolve_icall(int i, int opcnt, @@ -4025,11 +5022,6 @@ static const struct parsed_proto *resolve_icall(int i, int opcnt, { const struct parsed_proto *pp = NULL; int search_advice = 0; - int offset = -1; - char name[256]; - char s_reg[4]; - int reg, len; - int ret; *multi_src = 0; *pp_i = -1; @@ -4037,67 +5029,14 @@ static const struct parsed_proto *resolve_icall(int i, int opcnt, switch (ops[i].operand[0].type) { case OPT_REGMEM: // try to resolve struct member calls - ret = sscanf(ops[i].operand[0].name, "%3s+%x%n", - s_reg, &offset, &len); - if (ret == 2 && len == strlen(ops[i].operand[0].name)) - { - reg = char_array_i(regs_r32, ARRAY_SIZE(regs_r32), s_reg); - if (reg >= 0) { - struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, reg); - int j = -1; - ret = resolve_origin(i, &opr, i + opcnt * 19, &j, NULL); - if (ret != 1) - break; - if (ops[j].op == OP_MOV && ops[j].operand[1].type == OPT_REGMEM - && ops[j].operand[0].lmod == OPLM_DWORD - && ops[j].pp == NULL) // no hint - { - // allow one simple dereference (directx) - reg = char_array_i(regs_r32, ARRAY_SIZE(regs_r32), - ops[j].operand[1].name); - if (reg < 0) - break; - struct parsed_opr opr2 = OPR_INIT(OPT_REG, OPLM_DWORD, reg); - int k = -1; - ret = resolve_origin(j, &opr2, j + opcnt * 19, &k, NULL); - if (ret != 1) - break; - j = k; - } - if (ops[j].op != OP_MOV) - break; - if (ops[j].operand[0].lmod != OPLM_DWORD) - break; - if (ops[j].pp != NULL) { - // type hint in asm - pp = ops[j].pp; - } - else if (ops[j].operand[1].type == OPT_REGMEM) { - // allow 'hello[ecx]' - assume array of same type items - ret = sscanf(ops[j].operand[1].name, "%[^[][e%2s]", - name, s_reg); - if (ret != 2) - break; - pp = proto_parse(g_fhdr, name, g_quiet_pp); - } - else if (ops[j].operand[1].type == OPT_LABEL) - pp = proto_parse(g_fhdr, ops[j].operand[1].name, g_quiet_pp); - else - break; - if (pp == NULL) - break; - if (pp->is_func || pp->is_fptr || !pp->type.is_struct) { - pp = NULL; - break; - } - pp = proto_lookup_struct(g_fhdr, pp->type.name, offset); - } + pp = resolve_deref(i, i + opcnt * 19, &ops[i].operand[0], 0); + if (pp != NULL) break; - } // fallthrough case OPT_LABEL: case OPT_OFFSET: - pp = try_recover_pp(&ops[i], &ops[i].operand[0], &search_advice); + pp = try_recover_pp(&ops[i], &ops[i].operand[0], + 1, &search_advice); if (!search_advice) break; // fallthrough @@ -4253,6 +5192,9 @@ static struct parsed_proto *process_call(int i, int opcnt) ferr(po, "too many args for '%s'\n", tmpname); } if (pp->argc_stack > adj / 4) { + if (pp->is_noreturn) + // assume no stack adjust was emited + goto out; fnote(po, "(this call)\n"); ferr(&ops[ret], "stack tracking failed for '%s': %x %x\n", tmpname, pp->argc_stack * 4, adj); @@ -4265,14 +5207,103 @@ static struct parsed_proto *process_call(int i, int opcnt) ferr(po, "missing esp_adjust for vararg func '%s'\n", pp->name); +out: return pp; } -static int collect_call_args_early(struct parsed_op *po, int i, - struct parsed_proto *pp, int *regmask) +static void mark_float_arg(struct parsed_op *po, + struct parsed_proto *pp, int arg, int *regmask_ffca) +{ + po->p_argnext = -1; + po->p_argnum = arg + 1; + ferr_assert(po, pp->arg[arg].datap == NULL); + pp->arg[arg].datap = po; + po->flags |= OPF_DONE | OPF_FARGNR | OPF_FARG; + if (regmask_ffca != NULL) + *regmask_ffca |= 1 << arg; +} + +static int check_for_stp(int i, int i_to) +{ + struct parsed_op *po; + + for (; i < i_to; i++) { + po = &ops[i]; + if (po->op == OP_FST) + return i; + if (g_labels[i] != NULL || (po->flags & OPF_JMP)) + return -1; + if (po->op == OP_CALL || po->op == OP_PUSH || po->op == OP_POP) + return -1; + if (po->op == OP_ADD && po->operand[0].reg == xSP) + return -1; + } + + return -1; +} + +static int collect_call_args_no_push(int i, struct parsed_proto *pp, + int *regmask_ffca) +{ + struct parsed_op *po; + int offset = 0; + int base_arg; + int j, arg; + int ret; + + for (base_arg = 0; base_arg < pp->argc; base_arg++) + if (pp->arg[base_arg].reg == NULL) + break; + + for (j = i; j > 0; ) + { + ferr_assert(&ops[j], g_labels[j] == NULL); + j--; + + po = &ops[j]; + ferr_assert(po, po->op != OP_PUSH); + if (po->op == OP_FST) + { + if (po->operand[0].type != OPT_REGMEM) + continue; + ret = parse_stack_esp_offset(po, po->operand[0].name, &offset); + if (ret != 0) + continue; + if (offset < 0 || offset >= pp->argc_stack * 4 || (offset & 3)) { + //ferr(po, "offset %d, %d args\n", offset, pp->argc_stack); + continue; + } + + arg = base_arg + offset / 4; + mark_float_arg(po, pp, arg, regmask_ffca); + } + else if (po->op == OP_SUB && po->operand[0].reg == xSP + && po->operand[1].type == OPT_CONST) + { + po->flags |= OPF_RMD | OPF_DONE | OPF_FARGNR | OPF_FARG; + break; + } + } + + for (arg = base_arg; arg < pp->argc; arg++) { + ferr_assert(&ops[i], pp->arg[arg].reg == NULL); + po = pp->arg[arg].datap; + if (po == NULL) + ferr(&ops[i], "arg %d/%d not found\n", arg, pp->argc); + if (po->operand[0].lmod == OPLM_QWORD) + arg++; + } + + return 0; +} + +static int collect_call_args_early(int i, struct parsed_proto *pp, + int *regmask, int *regmask_ffca) { + struct parsed_op *po; int arg, ret; - int j; + int offset; + int j, k; for (arg = 0; arg < pp->argc; arg++) if (pp->arg[arg].reg == NULL) @@ -4285,20 +5316,23 @@ static int collect_call_args_early(struct parsed_op *po, int i, return -1; j--; - if (ops[j].op == OP_CALL) + po = &ops[j]; + if (po->op == OP_CALL) return -1; - else if (ops[j].op == OP_ADD && ops[j].operand[0].reg == xSP) + else if (po->op == OP_ADD && po->operand[0].reg == xSP) return -1; - else if (ops[j].op == OP_POP) + else if (po->op == OP_POP) return -1; - else if (ops[j].flags & OPF_CJMP) + else if (po->flags & OPF_CJMP) return -1; - else if (ops[j].op == OP_PUSH) { - if (ops[j].flags & (OPF_FARG|OPF_FARGNR)) - return -1; - ret = scan_for_mod(&ops[j], j + 1, i, 1); - if (ret >= 0) + else if (po->op == OP_PUSH) { + if (po->flags & (OPF_FARG|OPF_FARGNR)) return -1; + if (!g_header_mode) { + ret = scan_for_mod(po, j + 1, i, 1); + if (ret >= 0) + return -1; + } if (pp->arg[arg].type.is_va_list) return -1; @@ -4308,6 +5342,17 @@ static int collect_call_args_early(struct parsed_op *po, int i, if (pp->arg[arg].reg == NULL) break; } + else if (po->op == OP_SUB && po->operand[0].reg == xSP + && po->operand[1].type == OPT_CONST) + { + if (po->flags & (OPF_RMD|OPF_DONE)) + return -1; + if (po->operand[1].val != pp->argc_stack * 4) + ferr(po, "unexpected esp adjust: %d\n", + po->operand[1].val * 4); + ferr_assert(po, pp->argc - arg == pp->argc_stack); + return collect_call_args_no_push(i, pp, regmask_ffca); + } } if (arg < pp->argc) @@ -4326,10 +5371,24 @@ static int collect_call_args_early(struct parsed_op *po, int i, { ops[j].p_argnext = -1; ferr_assert(&ops[j], pp->arg[arg].datap == NULL); - pp->arg[arg].datap = &ops[j]; - if (ops[j].operand[0].type == OPT_REG) - *regmask |= 1 << ops[j].operand[0].reg; + k = check_for_stp(j + 1, i); + if (k != -1) { + // push ecx; fstp dword ptr [esp] + ret = parse_stack_esp_offset(&ops[k], + ops[k].operand[0].name, &offset); + if (ret == 0 && offset == 0) { + if (!pp->arg[arg].type.is_float) + ferr(&ops[i], "arg %d should be float\n", arg + 1); + mark_float_arg(&ops[k], pp, arg, regmask_ffca); + } + } + + if (pp->arg[arg].datap == NULL) { + pp->arg[arg].datap = &ops[j]; + if (regmask != NULL && ops[j].operand[0].type == OPT_REG) + *regmask |= 1 << ops[j].operand[0].reg; + } ops[j].flags |= OPF_RMD | OPF_DONE | OPF_FARGNR | OPF_FARG; ops[j].flags &= ~OPF_RSAVE; @@ -4344,9 +5403,31 @@ static int collect_call_args_early(struct parsed_op *po, int i, return 0; } +static int sync_argnum(struct parsed_op *po, int argnum) +{ + struct parsed_op *po_tmp; + + // see if other branches don't have higher argnum + for (po_tmp = po; po_tmp != NULL; ) { + if (argnum < po_tmp->p_argnum) + argnum = po_tmp->p_argnum; + // note: p_argnext is active on current collect_call_args only + po_tmp = po_tmp->p_argnext >= 0 ? &ops[po_tmp->p_argnext] : NULL; + } + + // make all argnums consistent + for (po_tmp = po; po_tmp != NULL; ) { + if (po_tmp->p_argnum != 0) + po_tmp->p_argnum = argnum; + po_tmp = po_tmp->p_argnext >= 0 ? &ops[po_tmp->p_argnext] : NULL; + } + + return argnum; +} + static int collect_call_args_r(struct parsed_op *po, int i, - struct parsed_proto *pp, int *regmask, int *save_arg_vars, - int *arg_grp, int arg, int magic, int need_op_saving, int may_reuse) + struct parsed_proto *pp, int *regmask, int *arg_grp, + int arg, int argnum, int magic, int need_op_saving, int may_reuse) { struct parsed_proto *pp_tmp; struct parsed_op *po_tmp; @@ -4354,7 +5435,6 @@ static int collect_call_args_r(struct parsed_op *po, int i, int need_to_save_current; int arg_grp_current = 0; int save_args_seen = 0; - int save_args; int ret = 0; int reg; char buf[32]; @@ -4365,7 +5445,7 @@ static int collect_call_args_r(struct parsed_op *po, int i, return -1; } - for (; arg < pp->argc; arg++) + for (; arg < pp->argc; arg++, argnum++) if (pp->arg[arg].reg == NULL) break; magic = (magic & 0xffffff) | (arg << 24); @@ -4391,8 +5471,8 @@ static int collect_call_args_r(struct parsed_op *po, int i, check_i(&ops[j], lr->i); if ((ops[lr->i].flags & (OPF_JMP|OPF_CJMP)) != OPF_JMP) may_reuse = 1; - ret = collect_call_args_r(po, lr->i, pp, regmask, save_arg_vars, - arg_grp, arg, magic, need_op_saving, may_reuse); + ret = collect_call_args_r(po, lr->i, pp, regmask, arg_grp, + arg, argnum, magic, need_op_saving, may_reuse); if (ret < 0) return ret; } @@ -4406,8 +5486,8 @@ static int collect_call_args_r(struct parsed_op *po, int i, continue; } need_op_saving = 1; - ret = collect_call_args_r(po, lr->i, pp, regmask, save_arg_vars, - arg_grp, arg, magic, need_op_saving, may_reuse); + ret = collect_call_args_r(po, lr->i, pp, regmask, arg_grp, + arg, argnum, magic, need_op_saving, may_reuse); if (ret < 0) return ret; } @@ -4420,8 +5500,8 @@ static int collect_call_args_r(struct parsed_op *po, int i, pp_tmp = ops[j].pp; if (pp_tmp == NULL) - ferr(po, "arg collect hit unparsed call '%s'\n", - ops[j].operand[0].name); + ferr(po, "arg collect %d/%d hit unparsed call '%s'\n", + arg, pp->argc, ops[j].operand[0].name); if (may_reuse && pp_tmp->argc_stack > 0) ferr(po, "arg collect %d/%d hit '%s' with %d stack args\n", arg, pp->argc, opr_name(&ops[j], 0), pp_tmp->argc_stack); @@ -4465,8 +5545,9 @@ static int collect_call_args_r(struct parsed_op *po, int i, ops[j].p_argnext = po_tmp - ops; pp->arg[arg].datap = &ops[j]; + argnum = sync_argnum(&ops[j], argnum); + need_to_save_current = 0; - save_args = 0; reg = -1; if (ops[j].operand[0].type == OPT_REG) reg = ops[j].operand[0].reg; @@ -4476,25 +5557,15 @@ static int collect_call_args_r(struct parsed_op *po, int i, need_to_save_current = (ret >= 0); } if (need_op_saving || need_to_save_current) { - // mark this push as one that needs operand saving - ops[j].flags &= ~OPF_RMD; - if (ops[j].p_argnum == 0) { - ops[j].p_argnum = arg + 1; - save_args |= 1 << arg; - } - else if (ops[j].p_argnum < arg + 1) { - // XXX: might kill valid var.. - //*save_arg_vars &= ~(1 << (ops[j].p_argnum - 1)); - ops[j].p_argnum = arg + 1; - save_args |= 1 << arg; - } + // mark this arg as one that needs operand saving + pp->arg[arg].is_saved = 1; - if (save_args_seen & (1 << (ops[j].p_argnum - 1))) { + if (save_args_seen & (1 << (argnum - 1))) { save_args_seen = 0; arg_grp_current++; if (arg_grp_current >= MAX_ARG_GRP) ferr(&ops[j], "out of arg groups (arg%d), f %s\n", - ops[j].p_argnum, pp->name); + argnum, pp->name); } } else if (ops[j].p_argnum == 0) @@ -4530,7 +5601,7 @@ static int collect_call_args_r(struct parsed_op *po, int i, { ops[k].flags |= OPF_RMD | OPF_NOREGS | OPF_DONE; ops[j].flags |= OPF_RMD | OPF_NOREGS | OPF_VAPUSH; - save_args &= ~(1 << arg); + pp->arg[arg].is_saved = 0; reg = -1; } else @@ -4546,23 +5617,27 @@ static int collect_call_args_r(struct parsed_op *po, int i, ops[k].flags |= OPF_RMD | OPF_DONE; ops[j].flags |= OPF_RMD; ops[j].p_argpass = ret + 1; - save_args &= ~(1 << arg); + pp->arg[arg].is_saved = 0; reg = -1; } } } } - *save_arg_vars |= save_args; + if (pp->arg[arg].is_saved) { + ops[j].flags &= ~OPF_RMD; + ops[j].p_argnum = argnum; + } // tracking reg usage if (reg >= 0) *regmask |= 1 << reg; arg++; + argnum++; if (!pp->is_unresolved) { // next arg - for (; arg < pp->argc; arg++) + for (; arg < pp->argc; arg++, argnum++) if (pp->arg[arg].reg == NULL) break; } @@ -4590,22 +5665,28 @@ static int collect_call_args_r(struct parsed_op *po, int i, } static int collect_call_args(struct parsed_op *po, int i, - struct parsed_proto *pp, int *regmask, int *save_arg_vars, - int magic) + struct parsed_proto *pp, int *regmask, int magic) { // arg group is for cases when pushes for // multiple funcs are going on struct parsed_op *po_tmp; - int save_arg_vars_current = 0; int arg_grp = 0; int ret; int a; - ret = collect_call_args_r(po, i, pp, regmask, - &save_arg_vars_current, &arg_grp, 0, magic, 0, 0); + ret = collect_call_args_r(po, i, pp, regmask, &arg_grp, + 0, 1, magic, 0, 0); if (ret < 0) return ret; + if (pp->is_unresolved) { + pp->argc += ret; + pp->argc_stack += ret; + for (a = 0; a < pp->argc; a++) + if (pp->arg[a].type.name == NULL) + pp->arg[a].type.name = strdup("int"); + } + if (arg_grp != 0) { // propagate arg_grp for (a = 0; a < pp->argc; a++) { @@ -4615,22 +5696,10 @@ static int collect_call_args(struct parsed_op *po, int i, po_tmp = pp->arg[a].datap; while (po_tmp != NULL) { po_tmp->p_arggrp = arg_grp; - if (po_tmp->p_argnext > 0) - po_tmp = &ops[po_tmp->p_argnext]; - else - po_tmp = NULL; + po_tmp = po_tmp->p_argnext >= 0 ? &ops[po_tmp->p_argnext] : NULL; } } } - save_arg_vars[arg_grp] |= save_arg_vars_current; - - if (pp->is_unresolved) { - pp->argc += ret; - pp->argc_stack += ret; - for (a = 0; a < pp->argc; a++) - if (pp->arg[a].type.name == NULL) - pp->arg[a].type.name = strdup("int"); - } return ret; } @@ -4641,7 +5710,6 @@ static void reg_use_pass(int i, int opcnt, unsigned char *cbits, int *regmask_init, int regmask_arg) { struct parsed_op *po; - unsigned int mask; int already_saved; int regmask_new; int regmask_op; @@ -4683,6 +5751,8 @@ static void reg_use_pass(int i, int opcnt, unsigned char *cbits, && !g_func_pp->is_userstack && po->operand[0].type == OPT_REG) { + int save_level = 0; + reg = po->operand[0].reg; ferr_assert(po, reg >= 0); @@ -4691,11 +5761,14 @@ static void reg_use_pass(int i, int opcnt, unsigned char *cbits, if (regmask_now & (1 << reg)) { already_saved = regmask_save_now & (1 << reg); flags_set = OPF_RSAVE | OPF_DONE; + save_level++; } - ret = scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, 0); + ret = scan_for_pop(i + 1, opcnt, i + opcnt * 3, + reg, 0, 0, save_level, 0); if (ret == 1) { - scan_for_pop(i + 1, opcnt, i + opcnt * 4, reg, 0, flags_set); + scan_for_pop(i + 1, opcnt, i + opcnt * 4, + reg, 0, 0, save_level, flags_set); } else { ret = scan_for_pop_ret(i + 1, opcnt, po->operand[0].reg, 0); @@ -4733,28 +5806,22 @@ static void reg_use_pass(int i, int opcnt, unsigned char *cbits, // don't need eax, will do "return f();" or "f(); return;" po->regmask_dst &= ~(1 << xAX); else { - struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xAX); - j = -1; - find_next_read(i + 1, opcnt, &opr, i + opcnt * 17, &j); + find_next_read_reg(i + 1, opcnt, xAX, OPLM_DWORD, + i + opcnt * 17, &j); if (j == -1) // not used po->regmask_dst &= ~(1 << xAX); } } + + // not "full stack" mode and have something in stack + if (!(regmask_now & mxST7_2) && (regmask_now & mxST1_0)) + ferr(po, "float stack is not empty on func call\n"); } if (po->flags & OPF_NOREGS) continue; - if (po->flags & OPF_FPUSH) { - if (regmask_now & mxST1) - ferr(po, "TODO: FPUSH on active ST1\n"); - if (regmask_now & mxST0) - po->flags |= OPF_FSHIFT; - mask = mxST0 | mxST1; - regmask_now = (regmask_now & ~mask) | ((regmask_now & mxST0) << 1); - } - // if incomplete register is used, clear it on init to avoid // later use of uninitialized upper part in some situations if ((po->flags & OPF_DATA) && po->operand[0].type == OPT_REG @@ -4787,22 +5854,50 @@ static void reg_use_pass(int i, int opcnt, unsigned char *cbits, } } + if (po->flags & OPF_FPUSH) { + if (regmask_now & mxST1) + regmask_now |= mxSTa; // switch to "full stack" mode + if (regmask_now & mxSTa) + po->flags |= OPF_FSHIFT; + if (!(regmask_now & mxST7_2)) { + regmask_now = + (regmask_now & ~mxST1_0) | ((regmask_now & mxST0) << 1); + } + } + regmask_now |= regmask_op; *regmask |= regmask_now; // released regs - if (po->flags & OPF_FPOP) { - mask = mxST0 | mxST1; - if (!(regmask_now & mask)) + if (po->flags & OPF_FPOPP) { + if ((regmask_now & mxSTa) == 0) ferr(po, "float pop on empty stack?\n"); - if (regmask_now & mxST1) + if (regmask_now & mxST7_2) + po->flags |= OPF_FSHIFT; + if (!(regmask_now & mxST7_2)) + regmask_now &= ~mxST1_0; + } + else if (po->flags & OPF_FPOP) { + if ((regmask_now & mxSTa) == 0) + ferr(po, "float pop on empty stack?\n"); + if (regmask_now & (mxST7_2 | mxST1)) po->flags |= OPF_FSHIFT; - regmask_now = (regmask_now & ~mask) | ((regmask_now & mxST1) >> 1); + if (!(regmask_now & mxST7_2)) { + regmask_now = + (regmask_now & ~mxST1_0) | ((regmask_now & mxST1) >> 1); + } } if (po->flags & OPF_TAIL) { - if (regmask_now & (mxST0 | mxST1)) - ferr(po, "float regs on tail: %x\n", regmask_now); + if (!(regmask_now & mxST7_2)) { + if (get_pp_arg_regmask_dst(g_func_pp) & mxST0) { + if (!(regmask_now & mxST0)) + ferr(po, "no st0 on float return, mask: %x\n", + regmask_now); + } + else if (regmask_now & mxST1_0) + ferr(po, "float regs on tail: %x\n", regmask_now); + } // there is support for "conditional tailcall", sort of if (!(po->flags & OPF_CC)) @@ -4829,7 +5924,7 @@ static void pp_insert_reg_arg(struct parsed_proto *pp, const char *reg) pp->argc_reg++; } -static void output_std_flags(FILE *fout, struct parsed_op *po, +static void output_std_flag_z(FILE *fout, struct parsed_op *po, int *pfomask, const char *dst_opr_text) { if (*pfomask & (1 << PFO_Z)) { @@ -4837,6 +5932,11 @@ static void output_std_flags(FILE *fout, struct parsed_op *po, lmod_cast_u(po, po->operand[0].lmod), dst_opr_text); *pfomask &= ~(1 << PFO_Z); } +} + +static void output_std_flag_s(FILE *fout, struct parsed_op *po, + int *pfomask, const char *dst_opr_text) +{ if (*pfomask & (1 << PFO_S)) { fprintf(fout, "\n cond_s = (%s%s < 0);", lmod_cast_s(po, po->operand[0].lmod), dst_opr_text); @@ -4844,6 +5944,13 @@ static void output_std_flags(FILE *fout, struct parsed_op *po, } } +static void output_std_flags(FILE *fout, struct parsed_op *po, + int *pfomask, const char *dst_opr_text) +{ + output_std_flag_z(fout, po, pfomask, dst_opr_text); + output_std_flag_s(fout, po, pfomask, dst_opr_text); +} + enum { OPP_FORCE_NORETURN = (1 << 0), OPP_SIMPLE_ARGS = (1 << 1), @@ -4886,9 +5993,11 @@ static void output_pp(FILE *fout, const struct parsed_proto *pp, for (i = 0; i < pp->argc; i++) { if (i > 0) fprintf(fout, ", "); - if (pp->arg[i].fptr != NULL && !(flags & OPP_SIMPLE_ARGS)) { + if (pp->arg[i].pp != NULL && pp->arg[i].pp->is_func + && !(flags & OPP_SIMPLE_ARGS)) + { // func pointer - output_pp(fout, pp->arg[i].fptr, 0); + output_pp(fout, pp->arg[i].pp, 0); } else if (pp->arg[i].type.is_retreg) { fprintf(fout, "u32 *r_%s", pp->arg[i].reg); @@ -4898,6 +6007,9 @@ static void output_pp(FILE *fout, const struct parsed_proto *pp, if (!pp->is_fptr) fprintf(fout, " a%d", i + 1); } + + if (pp->arg[i].type.is_64bit) + i++; } if (pp->is_vararg) { if (i > 0) @@ -4928,23 +6040,33 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) char buf1[256], buf2[256], buf3[256], cast[64]; struct parsed_proto *pp, *pp_tmp; struct parsed_data *pd; - unsigned int uval; int save_arg_vars[MAX_ARG_GRP] = { 0, }; unsigned char cbits[MAX_OPS / 8]; - int cond_vars = 0; + const char *float_type; + const char *float_st0; + const char *float_st1; + int need_float_stack = 0; + int need_float_sw = 0; // status word int need_tmp_var = 0; int need_tmp64 = 0; + int cond_vars = 0; int had_decl = 0; int label_pending = 0; - int regmask_save = 0; // regs saved/restored in this func + int need_double = 0; + int stack_align = 0; + int stack_fsz_adj = 0; + int lock_handled = 0; + int regmask_save = 0; // used regs saved/restored in this func int regmask_arg; // regs from this function args (fastcall, etc) int regmask_ret; // regs needed on ret int regmask_now; // temp int regmask_init = 0; // regs that need zero initialization int regmask_pp = 0; // regs used in complex push-pop graph + int regmask_ffca = 0; // float function call args int regmask = 0; // used regs int pfomask = 0; int found = 0; + int dead_dst; int no_output; int i, j, l; int arg; @@ -4953,6 +6075,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) g_bp_frame = g_sp_frame = g_stack_fsz = 0; g_stack_frame_used = 0; + g_seh_size = 0; if (g_sct_func_attr & SCTFA_CLEAR_REGS) regmask_init = g_regmask_init; @@ -4970,7 +6093,21 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) // pass2: // - handle ebp/esp frame, remove ops related to it - scan_prologue_epilogue(opcnt); + scan_prologue_epilogue(opcnt, &stack_align); + + // handle a case where sf size is unalignment, but is + // placed in a way that elements are still aligned + if (g_stack_fsz & 4) { + for (i = 0; i < g_eqcnt; i++) { + if (g_eqs[i].lmod != OPLM_QWORD) + continue; + if (!(g_eqs[i].offset & 4)) { + g_stack_fsz += 4; + stack_fsz_adj = 4; + } + break; + } + } // pass3: // - remove dead labels @@ -4998,10 +6135,12 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) { pp = process_call_early(i, opcnt, &j); if (pp != NULL) { - if (!(po->flags & OPF_ATAIL)) + if (!(po->flags & OPF_ATAIL)) { // since we know the args, try to collect them - if (collect_call_args_early(po, i, pp, ®mask) != 0) + ret = collect_call_args_early(i, pp, ®mask, ®mask_ffca); + if (ret != 0) pp = NULL; + } } if (pp != NULL) { @@ -5027,8 +6166,11 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) // - process calls, stage 2 // - handle some push/pop pairs // - scan for STD/CLD, propagate DF + // - try to resolve needed x87 status word bits for (i = 0; i < opcnt; i++) { + int mask, z_check; + po = &ops[i]; if (po->flags & OPF_RMD) continue; @@ -5040,8 +6182,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) { // since we know the args, collect them - collect_call_args(po, i, pp, ®mask, save_arg_vars, - i + opcnt * 2); + collect_call_args(po, i, pp, ®mask, i + opcnt * 2); } // for unresolved, collect after other passes } @@ -5064,16 +6205,39 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (po->flags & OPF_DONE) continue; - if (po->op == OP_PUSH && !(po->flags & OPF_FARG) - && !(po->flags & OPF_RSAVE) && po->operand[0].type == OPT_CONST) - { - scan_for_pop_const(i, opcnt, i + opcnt * 12); - } - else if (po->op == OP_POP) + switch (po->op) { + case OP_PUSH: + if (!(po->flags & OPF_FARG) && !(po->flags & OPF_RSAVE) + && po->operand[0].type == OPT_CONST) + { + scan_for_pop_const(i, opcnt, i + opcnt * 12); + } + break; + + case OP_POP: scan_pushes_for_pop(i, opcnt, ®mask_pp); - else if (po->op == OP_STD) { + break; + + case OP_STD: po->flags |= OPF_DF | OPF_RMD | OPF_DONE; scan_propagate_df(i + 1, opcnt); + break; + + case OP_FNSTSW: + need_float_sw = 1; + if (po->operand[0].type != OPT_REG || po->operand[0].reg != xAX) + ferr(po, "TODO: fnstsw to mem\n"); + ret = resolve_used_bits(i + 1, opcnt, xAX, &mask, &z_check); + if (ret != 0) + ferr(po, "fnstsw resolve failed\n"); + ret = adjust_prev_op(i, OP_FCOM, i + opcnt * 21, + (void *)(long)(mask | (z_check << 16))); + if (ret != 1) + ferr(po, "failed to find fcom: %d\n", ret); + break; + + default: + break; } } @@ -5084,10 +6248,13 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) reg_use_pass(0, opcnt, cbits, regmask_init, ®mask, 0, ®mask_save, ®mask_init, regmask_arg); + need_float_stack = !!(regmask & mxST7_2); + // pass7: // - find flag set ops for their users // - do unresolved calls // - declare indirect functions + // - other op specific processing for (i = 0; i < opcnt; i++) { po = &ops[i]; @@ -5098,7 +6265,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) { int setters[16], cnt = 0, branched = 0; - ret = scan_for_flag_set(i, i + opcnt * 6, + ret = scan_for_flag_set(i, opcnt, i + opcnt * 6, &branched, setters, &cnt); if (ret < 0 || cnt <= 0) ferr(po, "unable to trace flag setter(s)\n"); @@ -5152,43 +6319,54 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) cond_vars |= 1 << PFO_C; } - if (po->op == OP_CMPS || po->op == OP_SCAS) { + switch (po->op) { + case OP_CMPS: + case OP_SCAS: cond_vars |= 1 << PFO_Z; - } - else if (po->op == OP_MUL - || (po->op == OP_IMUL && po->operand_cnt == 1)) - { + break; + + case OP_MUL: if (po->operand[0].lmod == OPLM_DWORD) need_tmp64 = 1; - } - else if (po->op == OP_CALL) { + break; + + case OP_IMUL: + if (po->operand_cnt == 1 && po->operand[0].lmod == OPLM_DWORD) + need_tmp64 = 1; + break; + + case OP_CALL: // note: resolved non-reg calls are OPF_DONE already pp = po->pp; ferr_assert(po, pp != NULL); if (pp->is_unresolved) { int regmask_stack = 0; - collect_call_args(po, i, pp, ®mask, save_arg_vars, - i + opcnt * 2); + collect_call_args(po, i, pp, ®mask, i + opcnt * 2); // this is pretty rough guess: // see ecx and edx were pushed (and not their saved versions) for (arg = 0; arg < pp->argc; arg++) { - if (pp->arg[arg].reg != NULL) + if (pp->arg[arg].reg != NULL && !pp->arg[arg].is_saved) continue; tmp_op = pp->arg[arg].datap; if (tmp_op == NULL) ferr(po, "parsed_op missing for arg%d\n", arg); - if (tmp_op->p_argnum == 0 && tmp_op->operand[0].type == OPT_REG) + if (tmp_op->operand[0].type == OPT_REG) regmask_stack |= 1 << tmp_op->operand[0].reg; } - if (!((regmask_stack & (1 << xCX)) - && (regmask_stack & (1 << xDX)))) + // quick dumb check for potential reg-args + for (j = i - 1; j >= 0 && ops[j].op == OP_MOV; j--) + if (ops[j].operand[0].type == OPT_REG) + regmask_stack &= ~(1 << ops[j].operand[0].reg); + + if ((regmask_stack & (mxCX|mxDX)) != (mxCX|mxDX) + && ((regmask | regmask_arg) & (mxCX|mxDX))) { if (pp->argc_stack != 0 - || ((regmask | regmask_arg) & ((1 << xCX)|(1 << xDX)))) + || ((regmask | regmask_arg) & (mxCX|mxDX))) { pp_insert_reg_arg(pp, "ecx"); pp->is_fastcall = 1; @@ -5196,7 +6374,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) regmask |= 1 << xCX; } if (pp->argc_stack != 0 - || ((regmask | regmask_arg) & (1 << xDX))) + || ((regmask | regmask_arg) & mxDX)) { pp_insert_reg_arg(pp, "edx"); regmask_init |= 1 << xDX; @@ -5208,27 +6386,69 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (pp->argc_stack > 0) pp->is_stdcall = 1; } - } - else if (po->op == OP_MOV && po->operand[0].pp != NULL - && po->operand[1].pp != NULL) - { - // = offset - if ((po->operand[1].pp->is_func || po->operand[1].pp->is_fptr) - && !IS_START(po->operand[1].name, "off_")) + if (!(po->flags & OPF_TAIL) + && !(g_sct_func_attr & SCTFA_NOWARN) && !g_nowarn_reguse) + { + // treat al write as overwrite to avoid many false positives + if (IS(pp->ret_type.name, "void") || pp->ret_type.is_float) { + find_next_read_reg(i + 1, opcnt, xAX, OPLM_BYTE, + i + opcnt * 25, &j); + if (j != -1) { + fnote(po, "eax used after void/float ret call\n"); + fnote(&ops[j], "(used here)\n"); + } + } + if (!strstr(pp->ret_type.name, "int64")) { + find_next_read_reg(i + 1, opcnt, xDX, OPLM_BYTE, + i + opcnt * 26, &j); + // indirect calls are often guessed, don't warn + if (j != -1 && !IS_OP_INDIRECT_CALL(&ops[j])) { + fnote(po, "edx used after 32bit ret call\n"); + fnote(&ops[j], "(used here)\n"); + } + } + j = 1; + // msvc often relies on callee not modifying 'this' + for (arg = 0; arg < pp->argc; arg++) { + if (pp->arg[arg].reg && IS(pp->arg[arg].reg, "ecx")) { + j = 0; + break; + } + } + if (j != 0) { + find_next_read_reg(i + 1, opcnt, xCX, OPLM_BYTE, + i + opcnt * 27, &j); + if (j != -1 && !IS_OP_INDIRECT_CALL(&ops[j])) { + fnote(po, "ecx used after call\n"); + fnote(&ops[j], "(used here)\n"); + } + } + } + break; + + case OP_MOV: + if (po->operand[0].pp != NULL && po->operand[1].pp != NULL) { - if (!po->operand[0].pp->is_fptr) - ferr(po, "%s not declared as fptr when it should be\n", - po->operand[0].name); - if (pp_cmp_func(po->operand[0].pp, po->operand[1].pp)) { - pp_print(buf1, sizeof(buf1), po->operand[0].pp); - pp_print(buf2, sizeof(buf2), po->operand[1].pp); - fnote(po, "var: %s\n", buf1); - fnote(po, "func: %s\n", buf2); - ferr(po, "^ mismatch\n"); + // = offset + if ((po->operand[1].pp->is_func || po->operand[1].pp->is_fptr) + && !IS_START(po->operand[1].name, "off_")) + { + if (!po->operand[0].pp->is_fptr) + ferr(po, "%s not declared as fptr when it should be\n", + po->operand[0].name); + if (pp_cmp_func(po->operand[0].pp, po->operand[1].pp)) { + pp_print(buf1, sizeof(buf1), po->operand[0].pp); + pp_print(buf2, sizeof(buf2), po->operand[1].pp); + fnote(po, "var: %s\n", buf1); + fnote(po, "func: %s\n", buf2); + ferr(po, "^ mismatch\n"); + } } } - } - else if (po->op == OP_DIV || po->op == OP_IDIV) { + break; + + case OP_DIV: + case OP_IDIV: if (po->operand[0].lmod == OPLM_DWORD) { // 32bit division is common, look for it if (po->op == OP_DIV) @@ -5242,23 +6462,66 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) } else need_tmp_var = 1; - } - else if (po->op == OP_CLD) + break; + + case OP_CLD: po->flags |= OPF_RMD | OPF_DONE; - else if (po->op == OPP_FTOL) { - struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xDX); - j = -1; - find_next_read(i + 1, opcnt, &opr, i + opcnt * 18, &j); + break; + + case OP_RCL: + case OP_RCR: + case OP_XCHG: + need_tmp_var = 1; + break; + + case OP_FLD: + if (po->operand[0].lmod == OPLM_QWORD) + need_double = 1; + break; + + case OP_RDTSC: + case OPP_ALLSHL: + case OPP_ALLSHR: + need_tmp64 = 1; + break; + + case OPP_FTOL: + find_next_read_reg(i + 1, opcnt, xDX, OPLM_DWORD, + i + opcnt * 18, &j); if (j == -1) po->flags |= OPF_32BIT; + break; + + default: + break; } + } - if (po->op == OP_RCL || po->op == OP_RCR || po->op == OP_XCHG) - need_tmp_var = 1; + // pass8: final adjustments + for (i = 0; i < opcnt; i++) + { + po = &ops[i]; + if (po->flags & (OPF_RMD|OPF_DONE)) + continue; + + if (po->op != OP_FST && po->p_argnum > 0) + save_arg_vars[po->p_arggrp] |= 1 << (po->p_argnum - 1); + + // correct for "full stack" mode late enable + if ((po->flags & (OPF_PPUSH|OPF_FPOP|OPF_FPOPP)) + && need_float_stack) + po->flags |= OPF_FSHIFT; } + float_type = need_double ? "double" : "float"; + float_st0 = need_float_stack ? "f_st[f_stp & 7]" : "f_st0"; + float_st1 = need_float_stack ? "f_st[(f_stp + 1) & 7]" : "f_st1"; + // output starts here + if (g_seh_found) + fprintf(fout, "// had SEH\n"); + // define userstack size if (g_func_pp->is_userstack) { fprintf(fout, "#ifndef US_SZ_%s\n", g_func_pp->name); @@ -5285,6 +6548,9 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (pp->is_fptr && !(pp->name[0] != 0 && pp->is_arg)) { if (pp->name[0] != 0) { + if (IS_START(pp->name, "guess")) + pp->is_guessed = 1; + memmove(pp->name + 2, pp->name, strlen(pp->name) + 1); memcpy(pp->name, "i_", 2); @@ -5340,6 +6606,9 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) // declare stack frame, va_arg if (g_stack_fsz) { + if (stack_fsz_adj) + fprintf(fout, " // stack_fsz_adj %d\n", stack_fsz_adj); + fprintf(fout, " union { u32 d[%d];", (g_stack_fsz + 3) / 4); if (g_func_lmods & (1 << OPLM_WORD)) fprintf(fout, " u16 w[%d];", (g_stack_fsz + 1) / 2); @@ -5347,10 +6616,37 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) fprintf(fout, " u8 b[%d];", g_stack_fsz); if (g_func_lmods & (1 << OPLM_QWORD)) fprintf(fout, " double q[%d];", (g_stack_fsz + 7) / 8); + + if (stack_align > 8) + ferr(ops, "unhandled stack align of %d\n", stack_align); + else if (stack_align == 8) + fprintf(fout, " u64 align;"); fprintf(fout, " } sf;\n"); had_decl = 1; } + if ((g_sct_func_attr & SCTFA_ARGFRAME) && g_func_pp->argc_stack) { + fprintf(fout, " struct { u32 "); + for (i = j = 0; i < g_func_pp->argc; i++) { + if (g_func_pp->arg[i].reg != NULL) + continue; + if (j++ != 0) + fprintf(fout, ", "); + fprintf(fout, "a%d", i + 1); + } + fprintf(fout, "; } af = {\n "); + for (i = j = 0; i < g_func_pp->argc; i++) { + if (g_func_pp->arg[i].reg != NULL) + continue; + if (j++ != 0) + fprintf(fout, ", "); + if (g_func_pp->arg[i].type.is_ptr) + fprintf(fout, "(u32)"); + fprintf(fout, "a%d", i + 1); + } + fprintf(fout, "\n };\n"); + } + if (g_func_pp->is_userstack) { fprintf(fout, " u32 fake_sf[US_SZ_%s / 4];\n", g_func_pp->name); fprintf(fout, " u32 *esp = &fake_sf[sizeof(fake_sf) / 4];\n"); @@ -5387,7 +6683,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) } // declare normal registers - regmask_now = regmask & ~regmask_arg; + regmask_now = regmask & ~regmask_arg & ~g_regmask_rm; regmask_now &= ~(1 << xSP); if (regmask_now & 0x00ff) { for (reg = 0; reg < 8; reg++) { @@ -5413,18 +6709,30 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) } } // ... x87 - if (regmask_now & 0xff0000) { - for (reg = 16; reg < 24; reg++) { - if (regmask_now & (1 << reg)) { - fprintf(fout, " double f_st%d", reg - 16); - if (regmask_init & (1 << reg)) - fprintf(fout, " = 0"); - fprintf(fout, ";\n"); - had_decl = 1; + if (need_float_stack) { + fprintf(fout, " %s f_st[8];\n", float_type); + fprintf(fout, " int f_stp = 0;\n"); + had_decl = 1; + } + else { + if (regmask_now & 0xff0000) { + for (reg = 16; reg < 24; reg++) { + if (regmask_now & (1 << reg)) { + fprintf(fout, " %s f_st%d", float_type, reg - 16); + if (regmask_init & (1 << reg)) + fprintf(fout, " = 0"); + fprintf(fout, ";\n"); + had_decl = 1; + } } } } + if (need_float_sw) { + fprintf(fout, " u16 f_sw;\n"); + had_decl = 1; + } + if (regmask_save) { for (reg = 0; reg < 8; reg++) { if (regmask_save & (1 << reg)) { @@ -5446,6 +6754,15 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) } } + if (regmask_ffca) { + for (reg = 0; reg < 32; reg++) { + if (regmask_ffca & (1 << reg)) { + fprintf(fout, " %s fs_%d;\n", float_type, reg + 1); + had_decl = 1; + } + } + } + // declare push-pop temporaries if (regmask_pp) { for (reg = 0; reg < 8; reg++) { @@ -5517,6 +6834,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (po->flags & OPF_RMD) continue; + lock_handled = 0; no_output = 0; #define assert_operand_cnt(n_) \ @@ -5582,32 +6900,6 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) pfomask = po->pfomask; - if (po->flags & (OPF_REPZ|OPF_REPNZ)) { - struct parsed_opr opr = OPR_INIT(OPT_REG, OPLM_DWORD, xCX); - ret = try_resolve_const(i, &opr, opcnt * 7 + i, &uval); - - if (ret != 1 || uval == 0) { - // we need initial flags for ecx=0 case.. - if (i > 0 && ops[i - 1].op == OP_XOR - && IS(ops[i - 1].operand[0].name, - ops[i - 1].operand[1].name)) - { - fprintf(fout, " cond_z = "); - if (pfomask & (1 << PFO_C)) - fprintf(fout, "cond_c = "); - fprintf(fout, "0;\n"); - } - else if (last_arith_dst != NULL) { - out_src_opr_u32(buf3, sizeof(buf3), po, last_arith_dst); - out_test_for_cc(buf1, sizeof(buf1), po, PFO_Z, 0, - last_arith_dst->lmod, buf3); - fprintf(fout, " cond_z = %s;\n", buf1); - } - else - ferr(po, "missing initial ZF\n"); - } - } - switch (po->op) { case OP_MOV: @@ -5691,6 +6983,12 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) strcpy(g_comment, "cdq"); break; + case OP_BSWAP: + assert_operand_cnt(1); + out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]); + fprintf(fout, " %s = __builtin_bswap32(%s);", buf1, buf1); + break; + case OP_LODS: if (po->flags & OPF_REP) { assert_operand_cnt(3); @@ -5714,9 +7012,10 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) fprintf(fout, " for (; ecx != 0; ecx--, edi %c= %d)\n", (po->flags & OPF_DF) ? '-' : '+', lmod_bytes(po, po->operand[1].lmod)); - fprintf(fout, " %sedi = eax;", + fprintf(fout, " %sedi = eax;\n", lmod_cast_u_ptr(po, po->operand[1].lmod)); - strcpy(g_comment, "rep stos"); + fprintf(fout, " barrier();"); + strcpy(g_comment, "^ rep stos"); } else { assert_operand_cnt(2); @@ -5738,8 +7037,10 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) " for (; ecx != 0; ecx--, edi %c= %d, esi %c= %d)\n", l, j, l, j); fprintf(fout, - " %sedi = %sesi;", buf1, buf1); - strcpy(g_comment, "rep movs"); + " %sedi = %sesi;\n", buf1, buf1); + // this can overwrite many variables + fprintf(fout, " barrier();"); + strcpy(g_comment, "^ rep movs"); } else { assert_operand_cnt(2); @@ -5757,7 +7058,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (po->flags & OPF_REP) { assert_operand_cnt(3); fprintf(fout, - " for (; ecx != 0; ecx--) {\n"); + " while (ecx != 0) {\n"); if (pfomask & (1 << PFO_C)) { // ugh.. fprintf(fout, @@ -5768,6 +7069,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) " cond_z = (%sesi == %sedi); esi %c= %d, edi %c= %d;\n", buf1, buf1, l, j, l, j); fprintf(fout, + " ecx--;\n" " if (cond_z %s 0) break;\n", (po->flags & OPF_REPZ) ? "==" : "!="); fprintf(fout, @@ -5795,12 +7097,13 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (po->flags & OPF_REP) { assert_operand_cnt(3); fprintf(fout, - " for (; ecx != 0; ecx--) {\n"); + " while (ecx != 0) {\n"); fprintf(fout, " cond_z = (%seax == %sedi); edi %c= %d;\n", lmod_cast_u(po, po->operand[1].lmod), lmod_cast_u_ptr(po, po->operand[1].lmod), l, j); fprintf(fout, + " ecx--;\n" " if (cond_z %s 0) break;\n", (po->flags & OPF_REPZ) ? "==" : "!="); fprintf(fout, @@ -5820,6 +7123,16 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) delayed_flag_op = NULL; break; + case OP_RDTSC: + fprintf(fout, " tmp64 = ext_rdtsc();\n"); + fprintf(fout, " edx = tmp64 >> 32;\n"); + fprintf(fout, " eax = tmp64;"); + break; + + case OP_CPUID: + fprintf(fout, " ext_cpuid(&eax, &ebx, &ecx, &edx);"); + break; + // arithmetic w/flags case OP_AND: if (po->operand[1].type == OPT_CONST && !po->operand[1].val) @@ -5993,9 +7306,13 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) propagate_lmod(po, &po->operand[0], &po->operand[1]); if (IS(opr_name(po, 0), opr_name(po, 1))) { // special case for XOR - if (pfomask & (1 << PFO_BE)) { // weird, but it happens.. - fprintf(fout, " cond_be = 1;\n"); - pfomask &= ~(1 << PFO_BE); + int z = PFOB_O | PFOB_C | PFOB_S | (1 << PFO_L); + for (j = 0; j <= PFO_LE; j++) { + if (pfomask & (1 << j)) { + fprintf(fout, " cond_%s = %d;\n", + parsed_flag_op_names[j], (1 << j) & z ? 0 : 1); + pfomask &= ~(1 << j); + } } fprintf(fout, " %s = 0;", out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0])); @@ -6031,6 +7348,12 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) delayed_flag_op = NULL; break; } + if (pfomask & (1 << PFO_LE)) { + out_cmp_for_cc(buf1, sizeof(buf1), po, PFO_LE, 0, 1); + fprintf(fout, " cond_%s = %s;\n", + parsed_flag_op_names[PFO_LE], buf1); + pfomask &= ~(1 << PFO_LE); + } goto dualop_arith; case OP_SUB: @@ -6043,7 +7366,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (j == PFO_Z || j == PFO_S) continue; - out_cmp_for_cc(buf1, sizeof(buf1), po, j, 0); + out_cmp_for_cc(buf1, sizeof(buf1), po, j, 0, 0); fprintf(fout, " cond_%s = %s;\n", parsed_flag_op_names[j], buf1); pfomask &= ~(1 << j); @@ -6074,15 +7397,20 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) break; case OP_BSF: + case OP_BSR: + // on SKL, if src is 0, dst is left unchanged assert_operand_cnt(2); + out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]); out_src_opr_u32(buf2, sizeof(buf2), po, &po->operand[1]); - fprintf(fout, " %s = %s ? __builtin_ffs(%s) - 1 : 0;", - out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]), - buf2, buf2); - output_std_flags(fout, po, &pfomask, buf1); + output_std_flag_z(fout, po, &pfomask, buf2); + if (po->op == OP_BSF) + snprintf(buf3, sizeof(buf3), "__builtin_ffs(%s) - 1", buf2); + else + snprintf(buf3, sizeof(buf3), "31 - __builtin_clz(%s)", buf2); + fprintf(fout, " if (%s) %s = %s;", buf2, buf1, buf3); last_arith_dst = &po->operand[0]; delayed_flag_op = NULL; - strcat(g_comment, " bsf"); + strcat(g_comment, po->op == OP_BSF ? " bsf" : " bsr"); break; case OP_DEC: @@ -6093,7 +7421,7 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (j == PFO_Z || j == PFO_S || j == PFO_C) continue; - out_cmp_for_cc(buf1, sizeof(buf1), po, j, 0); + out_cmp_for_cc(buf1, sizeof(buf1), po, j, 0, 0); fprintf(fout, " cond_%s = %s;\n", parsed_flag_op_names[j], buf1); pfomask &= ~(1 << j); @@ -6108,9 +7436,18 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]); if (po->operand[0].type == OPT_REG) { + ferr_assert(po, !(po->flags & OPF_LOCK)); strcpy(buf2, po->op == OP_INC ? "++" : "--"); fprintf(fout, " %s%s;", buf1, buf2); } + else if (po->flags & OPF_LOCK) { + out_src_opr(buf2, sizeof(buf2), po, &po->operand[0], "", 1); + fprintf(fout, " __sync_fetch_and_%s((%s *)(%s), 1);", + po->op == OP_INC ? "add" : "sub", + lmod_type_u(po, po->operand[0].lmod), buf2); + strcat(g_comment, " lock"); + lock_handled = 1; + } else { strcpy(buf2, po->op == OP_INC ? "+" : "-"); fprintf(fout, " %s %s= 1;", buf1, buf2); @@ -6127,10 +7464,11 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) lmod_cast_s(po, po->operand[0].lmod), buf2); last_arith_dst = &po->operand[0]; delayed_flag_op = NULL; - if (pfomask & (1 << PFO_C)) { + if (pfomask & PFOB_C) { fprintf(fout, "\n cond_c = (%s != 0);", buf1); - pfomask &= ~(1 << PFO_C); + pfomask &= ~PFOB_C; } + output_std_flags(fout, po, &pfomask, buf1); break; case OP_IMUL: @@ -6295,9 +7633,10 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) fprintf(fout, "%s%s = %s;\n", buf3, pp->name, out_src_opr(buf1, sizeof(buf1), po, &po->operand[0], "(void *)", 0)); - if (pp->is_unresolved) - fprintf(fout, "%sunresolved_call(\"%s:%d\", %s);\n", - buf3, asmfn, po->asmln, pp->name); + } + if (pp->is_fptr && (pp->is_unresolved || pp->is_guessed)) { + fprintf(fout, "%sunresolved_call(\"%s:%d\", %s);\n", + buf3, asmfn, po->asmln, pp->name); } fprintf(fout, "%s", buf3); @@ -6322,7 +7661,11 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) fprintf(fout, "(u32)"); } else if (po->regmask_dst & mxST0) { - fprintf(fout, "f_st0 = "); + ferr_assert(po, po->flags & OPF_FPUSH); + if (need_float_stack) + fprintf(fout, "f_st[--f_stp & 7] = "); + else + fprintf(fout, "f_st0 = "); } } @@ -6332,10 +7675,13 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) pp->has_structarg ? "_sa" : ""); if (po->flags & OPF_ATAIL) { - if (pp->argc_stack != g_func_pp->argc_stack - || (pp->argc_stack > 0 - && pp->is_stdcall != g_func_pp->is_stdcall)) - ferr(po, "incompatible tailcall\n"); + int check_compat = + g_func_pp->is_stdcall && g_func_pp->argc_stack > 0; + check_compat |= pp->argc_stack > 0; + if (check_compat + && (pp->argc_stack != g_func_pp->argc_stack + || pp->is_stdcall != g_func_pp->is_stdcall)) + ferr(po, "incompatible arg-reuse tailcall\n"); if (g_func_pp->has_retreg) ferr(po, "TODO: retreg+tailcall\n"); @@ -6373,6 +7719,13 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (pp->arg[arg].reg != NULL) { if (pp->arg[arg].type.is_retreg) fprintf(fout, "&%s", pp->arg[arg].reg); + else if (IS(pp->arg[arg].reg, "ebp") + && g_bp_frame && !(po->flags & OPF_EBP_S)) + { + // rare special case + fprintf(fout, "%s(u32)&sf.b[sizeof(sf)]", cast); + strcat(g_comment, " bp_ref"); + } else fprintf(fout, "%s%s", cast, pp->arg[arg].reg); continue; @@ -6386,14 +7739,42 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (tmp_op->flags & OPF_VAPUSH) { fprintf(fout, "ap"); } + else if (tmp_op->op == OP_FST) { + fprintf(fout, "fs_%d", tmp_op->p_argnum); + if (tmp_op->operand[0].lmod == OPLM_QWORD) + arg++; + } + else if (pp->arg[arg].type.is_64bit) { + ferr_assert(po, tmp_op->p_argpass == 0); + ferr_assert(po, !pp->arg[arg].is_saved); + ferr_assert(po, !pp->arg[arg].type.is_float); + ferr_assert(po, cast[0] == 0); + out_src_opr(buf1, sizeof(buf1), + tmp_op, &tmp_op->operand[0], cast, 0); + tmp_op = pp->arg[++arg].datap; + ferr_assert(po, tmp_op != NULL); + out_src_opr(buf2, sizeof(buf2), + tmp_op, &tmp_op->operand[0], cast, 0); + fprintf(fout, "((u64)(%s) << 32) | (%s)", + buf2, buf1); + } else if (tmp_op->p_argpass != 0) { + ferr_assert(po, !pp->arg[arg].type.is_float); fprintf(fout, "a%d", tmp_op->p_argpass); } - else if (tmp_op->p_argnum != 0) { + else if (pp->arg[arg].is_saved) { + ferr_assert(po, tmp_op->p_argnum > 0); + ferr_assert(po, !pp->arg[arg].type.is_float); fprintf(fout, "%s%s", cast, saved_arg_name(buf1, sizeof(buf1), tmp_op->p_arggrp, tmp_op->p_argnum)); } + else if (pp->arg[arg].type.is_float) { + ferr_assert(po, !pp->arg[arg].type.is_64bit); + fprintf(fout, "%s", + out_src_opr_float(buf1, sizeof(buf1), + tmp_op, &tmp_op->operand[0], need_float_stack)); + } else { fprintf(fout, "%s", out_src_opr(buf1, sizeof(buf1), @@ -6462,7 +7843,10 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) g_func_pp->arg[arg].reg, g_func_pp->arg[arg].reg); } - if (!(regmask_ret & (1 << xAX))) { + if (regmask_ret & mxST0) { + fprintf(fout, " return %s;", float_st0); + } + else if (!(regmask_ret & mxAX)) { if (i != opcnt - 1 || label_pending) fprintf(fout, " return;"); } @@ -6541,59 +7925,130 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) no_output = 1; break; + // pseudo ops + case OPP_ALLSHL: + case OPP_ALLSHR: + fprintf(fout, " tmp64 = ((u64)edx << 32) | eax;\n"); + fprintf(fout, " tmp64 = (s64)tmp64 %s LOBYTE(ecx);\n", + po->op == OPP_ALLSHL ? "<<" : ">>"); + fprintf(fout, " edx = tmp64 >> 32; eax = tmp64;"); + strcat(g_comment, po->op == OPP_ALLSHL + ? " allshl" : " allshr"); + break; + // x87 case OP_FLD: - if (po->flags & OPF_FSHIFT) - fprintf(fout, " f_st1 = f_st0;\n"); - if (po->operand[0].type == OPT_REG - && po->operand[0].reg == xST0) - { - strcat(g_comment, " fld st"); - break; + if (need_float_stack) { + out_src_opr_float(buf1, sizeof(buf1), + po, &po->operand[0], 1); + if (po->regmask_src & mxSTa) { + fprintf(fout, " f_st[(f_stp - 1) & 7] = %s; f_stp--;", + buf1); + } + else + fprintf(fout, " f_st[--f_stp & 7] = %s;", buf1); + } + else { + if (po->flags & OPF_FSHIFT) + fprintf(fout, " f_st1 = f_st0;"); + if (po->operand[0].type == OPT_REG + && po->operand[0].reg == xST0) + { + strcat(g_comment, " fld st"); + break; + } + fprintf(fout, " f_st0 = %s;", + out_src_opr_float(buf1, sizeof(buf1), + po, &po->operand[0], 0)); } - fprintf(fout, " f_st0 = %s;", - out_src_opr_float(buf1, sizeof(buf1), po, &po->operand[0])); strcat(g_comment, " fld"); break; case OP_FILD: - if (po->flags & OPF_FSHIFT) - fprintf(fout, " f_st1 = f_st0;\n"); - fprintf(fout, " f_st0 = (double)%s;", - out_src_opr(buf1, sizeof(buf1), po, &po->operand[0], - lmod_cast(po, po->operand[0].lmod, 1), 0)); + out_src_opr(buf1, sizeof(buf1), po, &po->operand[0], + lmod_cast(po, po->operand[0].lmod, 1), 0); + snprintf(buf2, sizeof(buf2), "(%s)%s", float_type, buf1); + if (need_float_stack) { + fprintf(fout, " f_st[--f_stp & 7] = %s;", buf2); + } + else { + if (po->flags & OPF_FSHIFT) + fprintf(fout, " f_st1 = f_st0;"); + fprintf(fout, " f_st0 = %s;", buf2); + } strcat(g_comment, " fild"); break; case OP_FLDc: - if (po->flags & OPF_FSHIFT) - fprintf(fout, " f_st1 = f_st0;\n"); - fprintf(fout, " f_st0 = "); + if (need_float_stack) + fprintf(fout, " f_st[--f_stp & 7] = "); + else { + if (po->flags & OPF_FSHIFT) + fprintf(fout, " f_st1 = f_st0;"); + fprintf(fout, " f_st0 = "); + } switch (po->operand[0].val) { - case X87_CONST_1: fprintf(fout, "1.0;"); break; - case X87_CONST_Z: fprintf(fout, "0.0;"); break; - default: ferr(po, "TODO\n"); break; + case X87_CONST_1: fprintf(fout, "1.0;"); break; + case X87_CONST_L2T: fprintf(fout, "3.321928094887362;"); break; + case X87_CONST_L2E: fprintf(fout, "M_LOG2E;"); break; + case X87_CONST_PI: fprintf(fout, "M_PI;"); break; + case X87_CONST_LG2: fprintf(fout, "0.301029995663981;"); break; + case X87_CONST_LN2: fprintf(fout, "M_LN2;"); break; + case X87_CONST_Z: fprintf(fout, "0.0;"); break; + default: ferr_assert(po, 0); break; } break; case OP_FST: - if ((po->flags & OPF_FPOP) && po->operand[0].type == OPT_REG - && po->operand[0].reg == xST0) - { + if (po->flags & OPF_FARG) { + // store to stack as func arg + snprintf(buf1, sizeof(buf1), "fs_%d", po->p_argnum); + dead_dst = 0; + } + else { + out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0], + need_float_stack); + dead_dst = po->operand[0].type == OPT_REG + && po->operand[0].reg == xST0; + } + if (!dead_dst) + fprintf(fout, " %s = %s;", buf1, float_st0); + if (po->flags & OPF_FSHIFT) { + if (need_float_stack) + fprintf(fout, " f_stp++;"); + else + fprintf(fout, " f_st0 = f_st1;"); + } + if (dead_dst && !(po->flags & OPF_FSHIFT)) no_output = 1; - break; + else + strcat(g_comment, " fst"); + break; + + case OP_FIST: + fprintf(fout, " %s = %s%s;", + out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0]), + lmod_cast(po, po->operand[0].lmod, 1), float_st0); + if (po->flags & OPF_FSHIFT) { + if (need_float_stack) + fprintf(fout, " f_stp++;"); + else + fprintf(fout, " f_st0 = f_st1;"); } - fprintf(fout, " %s = f_st0;", - out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0])); - if (po->flags & OPF_FSHIFT) - fprintf(fout, "\n f_st0 = f_st1;"); - strcat(g_comment, " fst"); + strcat(g_comment, " fist"); break; case OP_FADD: case OP_FDIV: case OP_FMUL: case OP_FSUB: + out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0], + need_float_stack); + out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1], + need_float_stack); + dead_dst = (po->flags & OPF_FPOP) + && po->operand[0].type == OPT_REG + && po->operand[0].reg == xST0; switch (po->op) { case OP_FADD: j = '+'; break; case OP_FDIV: j = '/'; break; @@ -6601,27 +8056,55 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) case OP_FSUB: j = '-'; break; default: j = 'x'; break; } - if (po->flags & OPF_FSHIFT) { - fprintf(fout, " f_st0 = f_st1 %c f_st0;", j); + if (need_float_stack) { + if (!dead_dst) + fprintf(fout, " %s %c= %s;", buf1, j, buf2); + if (po->flags & OPF_FSHIFT) + fprintf(fout, " f_stp++;"); } else { - fprintf(fout, " %s %c= %s;", - out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0]), - j, - out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1])); + if (po->flags & OPF_FSHIFT) { + // note: assumes only 2 regs handled + if (!dead_dst) + fprintf(fout, " f_st0 = f_st1 %c f_st0;", j); + else + fprintf(fout, " f_st0 = f_st1;"); + } + else if (!dead_dst) + fprintf(fout, " %s %c= %s;", buf1, j, buf2); } + no_output = (dead_dst && !(po->flags & OPF_FSHIFT)); break; case OP_FDIVR: case OP_FSUBR: - if (po->flags & OPF_FSHIFT) - snprintf(buf1, sizeof(buf1), "f_st0"); - else - out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0]); - fprintf(fout, " %s = %s %c %s;", buf1, - out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1]), - po->op == OP_FDIVR ? '/' : '-', - out_src_opr_float(buf3, sizeof(buf3), po, &po->operand[0])); + out_dst_opr_float(buf1, sizeof(buf1), po, &po->operand[0], + need_float_stack); + out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1], + need_float_stack); + out_src_opr_float(buf3, sizeof(buf3), po, &po->operand[0], + need_float_stack); + dead_dst = (po->flags & OPF_FPOP) + && po->operand[0].type == OPT_REG + && po->operand[0].reg == xST0; + j = po->op == OP_FDIVR ? '/' : '-'; + if (need_float_stack) { + if (!dead_dst) + fprintf(fout, " %s = %s %c %s;", buf1, buf2, j, buf3); + if (po->flags & OPF_FSHIFT) + fprintf(fout, " f_stp++;"); + } + else { + if (po->flags & OPF_FSHIFT) { + if (!dead_dst) + fprintf(fout, " f_st0 = f_st0 %c f_st1;", j); + else + fprintf(fout, " f_st0 = f_st1;"); + } + else if (!dead_dst) + fprintf(fout, " %s = %s %c %s;", buf1, buf2, j, buf3); + } + no_output = (dead_dst && !(po->flags & OPF_FSHIFT)); break; case OP_FIADD: @@ -6635,29 +8118,159 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) case OP_FISUB: j = '-'; break; default: j = 'x'; break; } - fprintf(fout, " f_st0 %c= (double)%s;", j, + fprintf(fout, " %s %c= (%s)%s;", float_st0, + j, float_type, out_src_opr(buf1, sizeof(buf1), po, &po->operand[0], lmod_cast(po, po->operand[0].lmod, 1), 0)); break; case OP_FIDIVR: case OP_FISUBR: - fprintf(fout, " f_st0 = %s %c f_st0;", - out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1]), - po->op == OP_FIDIVR ? '/' : '-'); + fprintf(fout, " %s = %s %c %s;", float_st0, + out_src_opr_float(buf2, sizeof(buf2), po, &po->operand[1], + need_float_stack), + po->op == OP_FIDIVR ? '/' : '-', float_st0); + break; + + case OP_FCOM: { + int mask, z_check; + ferr_assert(po, po->datap != NULL); + mask = (long)po->datap & 0xffff; + z_check = ((long)po->datap >> 16) & 1; + out_src_opr_float(buf1, sizeof(buf1), po, &po->operand[0], + need_float_stack); + if (mask == 0x0100 || mask == 0x0500) { // C0 -> < + fprintf(fout, " f_sw = %s < %s ? 0x0100 : 0;", + float_st0, buf1); + } + else if (mask == 0x4000 || mask == 0x4400) { // C3 -> = + fprintf(fout, " f_sw = %s == %s ? 0x4000 : 0;", + float_st0, buf1); + } + else if (mask == 0x4100) { // C3, C0 + if (z_check) { + fprintf(fout, " f_sw = %s <= %s ? 0x4100 : 0;", + float_st0, buf1); + strcat(g_comment, " z_chk_det"); + } + else { + fprintf(fout, " f_sw = %s == %s ? 0x4000 : " + "(%s < %s ? 0x0100 : 0);", + float_st0, buf1, float_st0, buf1); + } + } + else + ferr(po, "unhandled sw mask: %x\n", mask); + if (po->flags & OPF_FSHIFT) { + if (need_float_stack) { + if (po->flags & OPF_FPOPP) + fprintf(fout, " f_stp += 2;"); + else + fprintf(fout, " f_stp++;"); + } + else { + ferr_assert(po, !(po->flags & OPF_FPOPP)); + fprintf(fout, " f_st0 = f_st1;"); + } + } + break; + } + + case OP_FNSTSW: + fprintf(fout, " %s = f_sw;", + out_dst_opr(buf1, sizeof(buf1), po, &po->operand[0])); + break; + + case OP_FCHS: + fprintf(fout, " %s = -%s;", float_st0, float_st0); + break; + + case OP_FCOS: + fprintf(fout, " %s = cos%s(%s);", float_st0, + need_double ? "" : "f", float_st0); + break; + + case OP_FPATAN: + if (need_float_stack) { + fprintf(fout, " %s = atan%s(%s / %s);", float_st1, + need_double ? "" : "f", float_st1, float_st0); + fprintf(fout, " f_stp++;"); + } + else { + fprintf(fout, " f_st0 = atan%s(f_st1 / f_st0);", + need_double ? "" : "f"); + } + break; + + case OP_FYL2X: + if (need_float_stack) { + fprintf(fout, " %s = %s * log2%s(%s);", float_st1, + float_st1, need_double ? "" : "f", float_st0); + fprintf(fout, " f_stp++;"); + } + else { + fprintf(fout, " f_st0 = f_st1 * log2%s(f_st0);", + need_double ? "" : "f"); + } + strcat(g_comment, " fyl2x"); + break; + + case OP_FSIN: + fprintf(fout, " %s = sin%s(%s);", float_st0, + need_double ? "" : "f", float_st0); + break; + + case OP_FSQRT: + fprintf(fout, " %s = sqrt%s(%s);", float_st0, + need_double ? "" : "f", float_st0); + break; + + case OP_FXCH: + dead_dst = po->operand[0].type == OPT_REG + && po->operand[0].reg == xST0; + if (!dead_dst) { + out_src_opr_float(buf1, sizeof(buf1), po, &po->operand[0], + need_float_stack); + fprintf(fout, " { %s t = %s; %s = %s; %s = t; }", float_type, + float_st0, float_st0, buf1, buf1); + strcat(g_comment, " fxch"); + } + else + no_output = 1; break; case OPP_FTOL: ferr_assert(po, po->flags & OPF_32BIT); - fprintf(fout, " eax = (s32)f_st0;"); - if (po->flags & OPF_FSHIFT) - fprintf(fout, "\n f_st0 = f_st1;"); + fprintf(fout, " eax = (s32)%s;", float_st0); + if (po->flags & OPF_FSHIFT) { + if (need_float_stack) + fprintf(fout, " f_stp++;"); + else + fprintf(fout, " f_st0 = f_st1;"); + } strcat(g_comment, " ftol"); break; + case OPP_CIPOW: + if (need_float_stack) { + fprintf(fout, " %s = pow%s(%s, %s);", float_st1, + need_double ? "" : "f", float_st1, float_st0); + fprintf(fout, " f_stp++;"); + } + else { + fprintf(fout, " f_st0 = pow%s(f_st1, f_st0);", + need_double ? "" : "f"); + } + strcat(g_comment, " CIpow"); + break; + + case OPP_ABORT: + fprintf(fout, " do_skip_code_abort();"); + break; + // mmx case OP_EMMS: - strcpy(g_comment, " (emms)"); + fprintf(fout, " do_emms();"); break; default: @@ -6694,6 +8307,9 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) if (pfomask != 0) ferr(po, "missed flag calc, pfomask=%x\n", pfomask); + if ((po->flags & OPF_LOCK) && !lock_handled) + ferr(po, "unhandled lock\n"); + // see is delayed flag stuff is still valid if (delayed_flag_op != NULL && delayed_flag_op != po) { if (is_any_opr_modified(delayed_flag_op, po, 0)) @@ -6705,7 +8321,8 @@ static void gen_func(FILE *fout, FILE *fhdr, const char *funcn, int opcnt) last_arith_dst = NULL; } - label_pending = 0; + if (!no_output) + label_pending = 0; } if (g_stack_fsz && !g_stack_frame_used) @@ -6746,10 +8363,14 @@ struct func_prototype { char name[NAMELEN]; int id; int argc_stack; - int regmask_dep; + int regmask_dep; // likely register args + int regmask_use; // used registers int has_ret:3; // -1, 0, 1: unresolved, no, yes + unsigned int has_ret64:1; unsigned int dep_resolved:1; unsigned int is_stdcall:1; + unsigned int eax_pass:1; // returns without touching eax + unsigned int ptr_taken:1; // pointer taken of this func struct func_proto_dep *dep_func; int dep_func_cnt; const struct parsed_proto *pp; // seed pp, if any @@ -6760,6 +8381,9 @@ struct func_proto_dep { struct func_prototype *proto; int regmask_live; // .. at the time of call unsigned int ret_dep:1; // return from this is caller's return + unsigned int has_ret:1; // found from eax use after return + unsigned int has_ret64:1; + unsigned int ptr_taken:1; // pointer taken, not a call }; static struct func_prototype *hg_fp; @@ -6811,10 +8435,14 @@ static struct func_proto_dep *hg_fp_find_dep(struct func_prototype *fp, return NULL; } -static void hg_fp_add_dep(struct func_prototype *fp, const char *name) +static void hg_fp_add_dep(struct func_prototype *fp, const char *name, + unsigned int ptr_taken) { + struct func_proto_dep * dep; + // is it a dupe? - if (hg_fp_find_dep(fp, name)) + dep = hg_fp_find_dep(fp, name); + if (dep != NULL && dep->ptr_taken == ptr_taken) return; if ((fp->dep_func_cnt & 0xff) == 0) { @@ -6825,6 +8453,7 @@ static void hg_fp_add_dep(struct func_prototype *fp, const char *name) sizeof(fp->dep_func[0]) * 0x100); } fp->dep_func[fp->dep_func_cnt].name = strdup(name); + fp->dep_func[fp->dep_func_cnt].ptr_taken = ptr_taken; fp->dep_func_cnt++; } @@ -6861,7 +8490,7 @@ static void hg_ref_add(const char *name) // - calculate reg deps static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, struct func_prototype *fp, int regmask_save, int regmask_dst, - int *regmask_dep, int *has_ret) + int *regmask_dep, int *regmask_use, int *has_ret) { struct func_proto_dep *dep; struct parsed_op *po; @@ -6887,7 +8516,8 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, for (j = 0; j < po->btj->count; j++) { check_i(po, po->btj->d[j].bt_i); gen_hdr_dep_pass(po->btj->d[j].bt_i, opcnt, cbits, fp, - regmask_save, regmask_dst, regmask_dep, has_ret); + regmask_save, regmask_dst, regmask_dep, regmask_use, + has_ret); } return; } @@ -6895,7 +8525,8 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, check_i(po, po->bt_i); if (po->flags & OPF_CJMP) { gen_hdr_dep_pass(po->bt_i, opcnt, cbits, fp, - regmask_save, regmask_dst, regmask_dep, has_ret); + regmask_save, regmask_dst, regmask_dep, regmask_use, + has_ret); } else { i = po->bt_i - 1; @@ -6917,11 +8548,13 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, if (po->flags & OPF_DONE) continue; - ret = scan_for_pop(i + 1, opcnt, i + opcnt * 2, reg, 0, 0); + ret = scan_for_pop(i + 1, opcnt, i + opcnt * 2, + reg, 0, 0, 0, 0); if (ret == 1) { regmask_save |= 1 << reg; po->flags |= OPF_RMD; - scan_for_pop(i + 1, opcnt, i + opcnt * 3, reg, 0, OPF_RMD); + scan_for_pop(i + 1, opcnt, i + opcnt * 3, + reg, 0, 0, 0, OPF_RMD); continue; } } @@ -6931,8 +8564,11 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, po->regmask_dst |= 1 << xAX; dep = hg_fp_find_dep(fp, po->operand[0].name); - if (dep != NULL) + if (dep != NULL) { dep->regmask_live = regmask_save | regmask_dst; + if (g_bp_frame && !(po->flags & OPF_EBP_S)) + dep->regmask_live |= 1 << xBP; + } } else if (po->op == OP_RET) { if (po->operand_cnt > 0) { @@ -6944,9 +8580,7 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, } } - // if has_ret is 0, there is uninitialized eax path, - // which means it's most likely void func - if (*has_ret != 0 && (po->flags & OPF_TAIL)) { + if (!fp->eax_pass && (po->flags & OPF_TAIL)) { if (po->op == OP_CALL) { j = i; ret = 1; @@ -6961,14 +8595,27 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, if (ret != 1 && from_caller) { // unresolved eax - probably void func *has_ret = 0; + fp->eax_pass = 1; } else { if (j >= 0 && ops[j].op == OP_CALL) { - dep = hg_fp_find_dep(fp, ops[j].operand[0].name); - if (dep != NULL) - dep->ret_dep = 1; - else - *has_ret = 1; + if (ops[j].pp != NULL && !ops[j].pp->is_unresolved) { + int call_has_ret = !IS(ops[j].pp->ret_type.name, "void"); + if (ops[j].pp->is_noreturn) { + // could be some fail path + if (*has_ret == -1) + *has_ret = call_has_ret; + } + else + *has_ret = call_has_ret; + } + else { + dep = hg_fp_find_dep(fp, ops[j].operand[0].name); + if (dep != NULL) + dep->ret_dep = 1; + else + *has_ret = 1; + } } else *has_ret = 1; @@ -6986,23 +8633,29 @@ static void gen_hdr_dep_pass(int i, int opcnt, unsigned char *cbits, l, regmask_dst, regmask_save, po->flags); #endif *regmask_dep |= l; + *regmask_use |= (po->regmask_src | po->regmask_dst) + & ~regmask_save; regmask_dst |= po->regmask_dst; - if (po->flags & OPF_TAIL) - return; + if (po->flags & OPF_TAIL) { + if (!(po->flags & OPF_CC)) // not cond. tailcall + return; + } } } static void gen_hdr(const char *funcn, int opcnt) { - int save_arg_vars[MAX_ARG_GRP] = { 0, }; unsigned char cbits[MAX_OPS / 8]; const struct parsed_proto *pp_c; struct parsed_proto *pp; struct func_prototype *fp; + struct func_proto_dep *dep; struct parsed_op *po; + const char *tmpname; int regmask_dummy = 0; int regmask_dep; + int regmask_use; int max_bp_offset = 0; int has_ret; int i, j, l; @@ -7017,6 +8670,7 @@ static void gen_hdr(const char *funcn, int opcnt) g_bp_frame = g_sp_frame = g_stack_fsz = 0; g_stack_frame_used = 0; + g_seh_size = 0; // pass1: // - resolve all branches @@ -7025,11 +8679,12 @@ static void gen_hdr(const char *funcn, int opcnt) // pass2: // - handle ebp/esp frame, remove ops related to it - scan_prologue_epilogue(opcnt); + scan_prologue_epilogue(opcnt, NULL); // pass3: // - remove dead labels // - collect calls + // - collect function ptr refs for (i = 0; i < opcnt; i++) { if (g_labels[i] != NULL && g_label_refs[i].i == -1) { @@ -7043,22 +8698,26 @@ static void gen_hdr(const char *funcn, int opcnt) if (po->op == OP_CALL) { if (po->operand[0].type == OPT_LABEL) - hg_fp_add_dep(fp, opr_name(po, 0)); + hg_fp_add_dep(fp, opr_name(po, 0), 0); else if (po->pp != NULL) - hg_fp_add_dep(fp, po->pp->name); + hg_fp_add_dep(fp, po->pp->name, 0); + } + else if (po->op == OP_MOV && po->operand[1].type == OPT_OFFSET) { + tmpname = opr_name(po, 1); + if (IS_START(tmpname, "p_") || IS_START(tmpname, "sub_")) + hg_fp_add_dep(fp, tmpname, 1); + } + else if (po->op == OP_PUSH && po->operand[0].type == OPT_OFFSET) { + tmpname = opr_name(po, 0); + if (IS_START(tmpname, "p_") || IS_START(tmpname, "sub_")) + hg_fp_add_dep(fp, tmpname, 1); } } // pass4: - // - remove dead labels // - handle push /pop pairs for (i = 0; i < opcnt; i++) { - if (g_labels[i] != NULL && g_label_refs[i].i == -1) { - free(g_labels[i]); - g_labels[i] = NULL; - } - po = &ops[i]; if (po->flags & (OPF_RMD|OPF_DONE)) continue; @@ -7081,7 +8740,7 @@ static void gen_hdr(const char *funcn, int opcnt) if (pp != NULL) { if (!(po->flags & OPF_ATAIL)) // since we know the args, try to collect them - if (collect_call_args_early(po, i, pp, ®mask_dummy) != 0) + if (collect_call_args_early(i, pp, NULL, NULL) != 0) pp = NULL; } @@ -7126,18 +8785,34 @@ static void gen_hdr(const char *funcn, int opcnt) if (!pp->is_unresolved && !(po->flags & OPF_ATAIL)) { // since we know the args, collect them - ret = collect_call_args(po, i, pp, ®mask_dummy, save_arg_vars, - i + opcnt * 1); + ret = collect_call_args(po, i, pp, ®mask_dummy, + i + opcnt * 1); + } + if (!(po->flags & OPF_TAIL) + && po->operand[0].type == OPT_LABEL) + { + dep = hg_fp_find_dep(fp, opr_name(po, 0)); + ferr_assert(po, dep != NULL); + // treat al write as overwrite to avoid many false positives + find_next_read_reg(i + 1, opcnt, xAX, OPLM_BYTE, + i + opcnt * 25, &j); + if (j != -1) + dep->has_ret = 1; + find_next_read_reg(i + 1, opcnt, xDX, OPLM_BYTE, + i + opcnt * 26, &j); + if (j != -1 && !IS_OP_INDIRECT_CALL(&ops[j])) + dep->has_ret64 = 1; } } } // pass7 - memset(cbits, 0, sizeof(cbits)); - regmask_dep = 0; + memset(cbits, 0, (opcnt + 7) / 8); + regmask_dep = regmask_use = 0; has_ret = -1; - gen_hdr_dep_pass(0, opcnt, cbits, fp, 0, 0, ®mask_dep, &has_ret); + gen_hdr_dep_pass(0, opcnt, cbits, fp, 0, 0, + ®mask_dep, ®mask_use, &has_ret); // find unreachable code - must be fixed in IDA for (i = 0; i < opcnt; i++) @@ -7152,8 +8827,11 @@ static void gen_hdr(const char *funcn, int opcnt) // noreturn OS functions break; } - if (ops[i].op != OP_NOP) + if (!(ops[i].flags & OPF_RMD) + && ops[i].op != OP_NOP && ops[i].op != OPP_ABORT) + { ferr(&ops[i], "unreachable code\n"); + } } for (i = 0; i < g_eqcnt; i++) { @@ -7168,7 +8846,8 @@ static void gen_hdr(const char *funcn, int opcnt) fp->argc_stack--; } - fp->regmask_dep = regmask_dep & ~(1 << xSP); + fp->regmask_dep = regmask_dep & ~((1 << xSP) | mxSTa); + fp->regmask_use = regmask_use; fp->has_ret = has_ret; #if 0 printf("// has_ret %d, regmask_dep %x\n", @@ -7183,28 +8862,40 @@ static void gen_hdr(const char *funcn, int opcnt) static void hg_fp_resolve_deps(struct func_prototype *fp) { struct func_prototype fp_s; - int dep; + struct func_proto_dep *dep; + int regmask_dep; int i; // this thing is recursive, so mark first.. fp->dep_resolved = 1; for (i = 0; i < fp->dep_func_cnt; i++) { - strcpy(fp_s.name, fp->dep_func[i].name); - fp->dep_func[i].proto = bsearch(&fp_s, hg_fp, hg_fp_cnt, + dep = &fp->dep_func[i]; + + strcpy(fp_s.name, dep->name); + dep->proto = bsearch(&fp_s, hg_fp, hg_fp_cnt, sizeof(hg_fp[0]), hg_fp_cmp_name); - if (fp->dep_func[i].proto != NULL) { - if (!fp->dep_func[i].proto->dep_resolved) - hg_fp_resolve_deps(fp->dep_func[i].proto); + if (dep->proto != NULL) { + if (dep->ptr_taken) { + dep->proto->ptr_taken = 1; + continue; + } + + if (!dep->proto->dep_resolved) + hg_fp_resolve_deps(dep->proto); - dep = ~fp->dep_func[i].regmask_live - & fp->dep_func[i].proto->regmask_dep; - fp->regmask_dep |= dep; + regmask_dep = ~dep->regmask_live + & dep->proto->regmask_dep; + fp->regmask_dep |= regmask_dep; // printf("dep %s %s |= %x\n", fp->name, - // fp->dep_func[i].name, dep); + // fp->dep_func[i].name, regmask_dep); - if (fp->has_ret == -1 && fp->dep_func[i].ret_dep) - fp->has_ret = fp->dep_func[i].proto->has_ret; + if (dep->has_ret && (dep->proto->regmask_use & mxAX)) + dep->proto->has_ret = 1; + if (dep->has_ret64 && (dep->proto->regmask_use & mxDX)) + dep->proto->has_ret64 = 1; + if (fp->has_ret == -1 && dep->ret_dep) + fp->has_ret = dep->proto->has_ret; } } } @@ -7219,11 +8910,8 @@ static void do_func_refs_from_data(void) strcpy(fp_s.name, hg_refs[i]); fp = bsearch(&fp_s, hg_fp, hg_fp_cnt, sizeof(hg_fp[0]), hg_fp_cmp_name); - if (fp == NULL) - continue; - - if (fp->argc_stack != 0 && (fp->regmask_dep & (mxCX | mxDX))) - fp->regmask_dep |= mxCX | mxDX; + if (fp != NULL) + fp->ptr_taken = 1; } } @@ -7273,9 +8961,17 @@ static void output_hdr_fp(FILE *fout, const struct func_prototype *fp, regmask_dep = fp->regmask_dep; argc_normal = fp->argc_stack; + if (fp->ptr_taken && regmask_dep + && (regmask_dep & ~(mxCX|mxDX)) == 0) + { + if ((regmask_dep & mxDX) || fp->argc_stack > 0) + regmask_dep |= mxCX | mxDX; + } - fprintf(fout, "%-5s", fp->pp ? fp->pp->ret_type.name : - (fp->has_ret ? "int" : "void")); + fprintf(fout, "%-5s", + fp->pp ? fp->pp->ret_type.name : + fp->has_ret64 ? "__int64" : + fp->has_ret ? "int" : "void"); if (regmask_dep && (fp->is_stdcall || fp->argc_stack > 0) && (regmask_dep & ~mxCX) == 0) { @@ -7283,8 +8979,9 @@ static void output_hdr_fp(FILE *fout, const struct func_prototype *fp, argc_normal++; regmask_dep = 0; } - else if (regmask_dep && (fp->is_stdcall || fp->argc_stack == 0) - && (regmask_dep & ~(mxCX | mxDX)) == 0) + else if ((regmask_dep == (mxCX | mxDX) + && (fp->is_stdcall || fp->argc_stack == 0)) + || (regmask_dep == mxCX && fp->argc_stack == 0)) { fprintf(fout, " __fastcall "); if (!(regmask_dep & (1 << xDX)) && fp->argc_stack == 0) @@ -7375,6 +9072,12 @@ static void output_hdr(FILE *fout) // adjust functions referenced from data segment do_func_refs_from_data(); + // final adjustments + for (i = 0; i < hg_fp_cnt; i++) { + if (hg_fp[i].eax_pass && (hg_fp[i].regmask_dep & mxAX)) + hg_fp[i].has_ret = 1; + } + // note: messes up .proto ptr, don't use //qsort(hg_fp, hg_fp_cnt, sizeof(hg_fp[0]), hg_fp_cmp_id); @@ -7480,10 +9183,14 @@ static int ida_xrefs_show_need(FILE *fasm, char *p, long pos; p = strrchr(p, ';'); - if (p != NULL && *p == ';' && IS_START(p + 2, "DATA XREF: ")) { - p += 13; - if (is_xref_needed(p, rlist, rlist_len)) + if (p != NULL && *p == ';') { + if (IS_START(p + 2, "sctref")) return 1; + if (IS_START(p + 2, "DATA XREF: ")) { + p += 13; + if (is_xref_needed(p, rlist, rlist_len)) + return 1; + } } pos = ftell(fasm); @@ -7502,6 +9209,12 @@ static int ida_xrefs_show_need(FILE *fasm, char *p, p = strrchr(p, ';'); p += 2; + + if (IS_START(p, "sctref")) { + found_need = 1; + break; + } + // it's printed once, but no harm to check again if (IS_START(p, "DATA XREF: ")) p += 11; @@ -7695,7 +9408,7 @@ static int cmp_chunks(const void *p1, const void *p2) return strcmp(c1->name, c2->name); } -static void scan_ahead(FILE *fasm) +static void scan_ahead_for_chunks(FILE *fasm) { char words[2][256]; char line[256]; @@ -7776,7 +9489,8 @@ int main(int argc, char *argv[]) char *sctproto = NULL; int in_func = 0; int pending_endp = 0; - int skip_func = 0; + int skip_code = 0; + int skip_code_end = 0; int skip_warned = 0; int eq_alloc; int verbose = 0; @@ -7787,7 +9501,7 @@ int main(int argc, char *argv[]) int pi = 0; int i, j; int ret, len; - char *p; + char *p, *p2; int wordc; for (arg = 1; arg < argc; arg++) { @@ -7795,6 +9509,10 @@ int main(int argc, char *argv[]) verbose = 1; else if (IS(argv[arg], "-rf")) g_allow_regfunc = 1; + else if (IS(argv[arg], "-uc")) + g_allow_user_icall = 1; + else if (IS(argv[arg], "-wu")) + g_nowarn_reguse = 1; else if (IS(argv[arg], "-m")) multi_seg = 1; else if (IS(argv[arg], "-hdr")) @@ -7804,12 +9522,14 @@ int main(int argc, char *argv[]) } if (argc < arg + 3) { - printf("usage:\n%s [-v] [-rf] [-m] <.c> <.asm> [rlist]*\n" + printf("usage:\n%s [options] <.c> <.asm> [rlist]*\n" "%s -hdr <.asm> [rlist]*\n" "options:\n" " -hdr - header generation mode\n" " -rf - allow unannotated indirect calls\n" + " -uc - allow ind. calls/refs to __usercall\n" " -m - allow multiple .text sections\n" + " -wu - don't warn about bad reg use\n" "[rlist] is a file with function names to skip," " one per line\n", argv[0], argv[0]); @@ -7839,6 +9559,8 @@ int main(int argc, char *argv[]) memset(words, 0, sizeof(words)); for (; arg < argc; arg++) { + int skip_func = 0; + frlist = fopen(argv[arg], "r"); my_assert_not(frlist, NULL); @@ -7870,7 +9592,6 @@ int main(int argc, char *argv[]) } rlist[rlist_len++] = strdup(words[0]); } - skip_func = 0; fclose(frlist); frlist = NULL; @@ -7951,6 +9672,9 @@ int main(int argc, char *argv[]) static const char *attrs[] = { "clear_sf", "clear_regmask", + "rm_regmask", + "nowarn", + "argframe", }; // parse manual attribute-list comment @@ -7974,6 +9698,9 @@ int main(int argc, char *argv[]) else if (i == 1) // clear_regmask= ret = sscanf(p, "=%x%n", &g_regmask_init, &j) + 1; + else if (i == 2) + // rm_regmask= + ret = sscanf(p, "=%x%n", &g_regmask_rm, &j) + 1; if (ret < 2) { anote("unparsed attr value: %s\n", p); break; @@ -8031,7 +9758,7 @@ int main(int argc, char *argv[]) if (addr > f_addr && !scanned_ahead) { //anote("scan_ahead caused by '%s', addr %lx\n", // g_func, addr); - scan_ahead(fasm); + scan_ahead_for_chunks(fasm); scanned_ahead = 1; func_chunks_sorted = 0; } @@ -8053,22 +9780,48 @@ parse_words: if (*p != 0 && *p != ';') aerr("too many words\n"); - // alow asm patches in comments + if (skip_code_end) { + skip_code_end = 0; + skip_code = 0; + } + + // allow asm patches in comments if (*p == ';') { + // skip IDA's forced non-removable comment + if (!IS_START(p, "; sct") && (p2 = strchr(p + 1, ';'))) + p = p2; + } + if (*p == ';' && IS_START(p, "; sct")) { if (IS_START(p, "; sctpatch:")) { p = sskip(p + 11); if (*p == 0 || *p == ';') continue; goto parse_words; // lame } - if (IS_START(p, "; sctproto:")) { - sctproto = strdup(p + 11); - } else if (IS_START(p, "; sctend")) { end = 1; if (!pending_endp) break; } + else if (g_skip_func) + /* ignore remaining attrs */; + else if (IS_START(p, "; sctproto:")) { + sctproto = strdup(p + 11); + } + else if (IS_START(p, "; sctskip_start")) { + if (in_func) { + if (!skip_code) { + ops[pi].op = OPP_ABORT; + ops[pi].asmln = asmln; + pi++; + } + skip_code = 1; + } + } + else if (IS_START(p, "; sctskip_end")) { + if (skip_code) + skip_code_end = 1; + } } if (wordc == 0) { @@ -8137,7 +9890,7 @@ do_pending_endp: if (pd->type == OPT_OFFSET) pd->d[pd->count].u.label = strdup(words[i]); else - pd->d[pd->count].u.val = parse_number(words[i]); + pd->d[pd->count].u.val = parse_number(words[i], 0); pd->d[pd->count].bt_i = -1; pd->count++; } @@ -8158,9 +9911,11 @@ do_pending_endp: g_stack_clear_start = 0; g_stack_clear_len = 0; g_regmask_init = 0; + g_regmask_rm = 0; skip_warned = 0; g_skip_func = 0; g_func[0] = 0; + g_seh_found = 0; func_chunks_used = 0; func_chunk_i = -1; if (pi != 0) { @@ -8208,9 +9963,11 @@ do_pending_endp: if (!IS(g_func, words[0])) aerr("endp '%s' while in_func '%s'?\n", words[0], g_func); + if (skip_code) + aerr("endp '%s' while skipping code\n", words[0]); if ((g_ida_func_attr & IDAFA_THUNK) && pi == 1 - && ops[0].op == OP_JMP && ops[0].operand[0].had_ds) + && ops[0].op == OP_JMP && ops[0].operand[0].segment) { // import jump g_skip_func = 1; @@ -8275,7 +10032,7 @@ do_pending_endp: continue; } - if (!in_func || g_skip_func) { + if (!in_func || g_skip_func || skip_code) { if (!skip_warned && !g_skip_func && g_labels[pi] != NULL) { if (verbose) anote("skipping from '%s'\n", g_labels[pi]); @@ -8314,7 +10071,7 @@ do_pending_endp: else aerr("bad lmod: '%s'\n", words[2]); - g_eqs[g_eqcnt].offset = parse_number(words[4]); + g_eqs[g_eqcnt].offset = parse_number(words[4], 0); g_eqcnt++; continue; }