public static bool ShouldCheckInstruction(X86InstructionId id)
{
return(new List <X86InstructionId> {
X86InstructionId.X86_INS_CALL,
X86InstructionId.X86_INS_JAE,
X86InstructionId.X86_INS_JA,
X86InstructionId.X86_INS_JBE,
X86InstructionId.X86_INS_JB,
X86InstructionId.X86_INS_JCXZ,
X86InstructionId.X86_INS_JECXZ,
X86InstructionId.X86_INS_JE,
X86InstructionId.X86_INS_JGE,
X86InstructionId.X86_INS_JG,
X86InstructionId.X86_INS_JL,
X86InstructionId.X86_INS_JMP,
X86InstructionId.X86_INS_JNO,
X86InstructionId.X86_INS_JNP,
X86InstructionId.X86_INS_JNS,
X86InstructionId.X86_INS_JO,
X86InstructionId.X86_INS_JP,
X86InstructionId.X86_INS_JRCXZ,
X86InstructionId.X86_INS_JS,
X86InstructionId.X86_INS_PUSH,
X86InstructionId.X86_INS_PUSHAL,
X86InstructionId.X86_INS_PUSHAW,
X86InstructionId.X86_INS_PUSHF,
X86InstructionId.X86_INS_PUSHFD,
X86InstructionId.X86_INS_PUSHFQ,
X86InstructionId.X86_INS_MOV,
}.Contains(id));
}
private void ps4KernelDlSymRetrieveSymbols(Byte[] buffer)
{
using (CapstoneX86Disassembler disassembler = CapstoneDisassembler.CreateX86Disassembler(X86DisassembleMode.Bit64))
{
disassembler.EnableInstructionDetails = true;
disassembler.DisassembleSyntax = DisassembleSyntax.Intel;
//disassembler.EnableSkipDataMode = true;
X86Instruction[] instructions = disassembler.Disassemble(buffer);
int i = 0;
foreach (X86Instruction instruction in instructions)
{
i++;
X86Instruction lastInsn = (i > 1) ? instructions[i - 2] : null;
long address = instruction.Address;
X86InstructionId id = instruction.Id;
String curr_instruction = GetInstructionTxt(instruction);
String last_instruction = GetInstructionTxt(lastInsn);
//if (address == 0x14362)
// MessageBox.Show(curr_instruction);
if (!instruction.IsSkippedData)
{
String ps4KernelDlSym = GetMemoryAddress((UInt64)ps4KernelDlSym_offset).ToString("x");
//if (instruction.Operand.Contains(ps4KernelDlSym))
// MessageBox.Show("call to ps4KernelDlSym: " + curr_instruction);
//if(id == X86InstructionId.X86_INS_MOVABS)
// MessageBox.Show("moveabs: " + curr_instruction);
//MessageBox.Show(ps4KernelDlSym);
if (instruction.Operand.Contains(ps4KernelDlSym) && id == X86InstructionId.X86_INS_MOVABS)
{
String ps4KernelDlSym_call = instructions[i + 1].Operand;//instructions[i + 1].Id == X86InstructionId.X86_INS_CALL ?
string last_operand = lastInsn.Operand;
if (lastInsn.Id == X86InstructionId.X86_INS_MOVABS)
{
String symbolReg = "";
var symbolName = ParseSymbolReference(lastInsn, out symbolReg);
if (symbolName != "")
{
sympool.Add(lastInsn.Address, symbolName);//ps4KernelDlSym_Symbols.Add(symbolName);
}
// after we have got a symbol, find for near ps4KernelDlSym references
var targetReg = instructions[i].Operand;
var targetBytes = instructions[i].Bytes;
//MessageBox.Show(targetReg);
//MessageBox.Show(GetInstructionTxt(instructions[i+1]));
for (int x = i + 2; x < instructions.Count(); x++)
{
var instruct = instructions[x];
if (instruct == null || instruct.IsSkippedData || instruct.Id == X86InstructionId.X86_INS_RET || instruct.Id == X86InstructionId.X86_INS_MOVABS & instruct.Operand.Split(',')[0] == targetReg)//GetInstructionTxt(instruct).Contains("ret"))
{
break;
}
if (instruct.Id == X86InstructionId.X86_INS_CALL)// && instruct.Operand == ps4KernelDlSym_call.Split(',')[0])
{
//MessageBox.Show(GetInstructionTxt(instruct));
//MessageBox.Show(instruct.Operand + "\n\n" + ps4KernelDlSym_call);
var reg = instruct.Operand;
var prev_sym_reg = symbolReg;
if (reg == targetReg & (symbolName = ParseSymbolReference(instructions[x - 1], out symbolReg)) != "")
{
if (targetBytes.SequenceEqual(instruct.Bytes))//if ((symbolName = ParseSymbolReference(instructions[x - 1], out symbolReg)) != "")
{
if (symbolReg == prev_sym_reg)
{
sympool.Add(instructions[x - 1].Address, symbolName);
/*
* var addr = GetMemoryAddress((ulong)instructions[x - 1].Address) - 0x1000;
* Clipboard.SetText(addr.ToString("X2"));
* MessageBox.Show("Addr: " + addr.ToString("X2") + ", " + symbolName + "\n\n" + GetInstructionTxt(instructions[x-1]));
*/
}
//MessageBox.Show(last_instruction + "\n" + curr_instruction + "\n\n" + GetInstructionTxt(instructions[x-1]) + "\n" + GetInstructionTxt(instruct), "Near " + symbolName);
}
}
//MessageBox.Show(curr_instruction + "\n" + GetInstructionTxt(instruct));
}
//MessageBox.Show(last_instruction + "\n" + curr_instruction + "\n\n" + targetReg);
}
}
/*else if (id == X86InstructionId.X86_INS_CALL)
* {
* MessageBox.Show(last_instruction + "\n" + curr_instruction);
* }*/
}
}
}
}
}