public static U30 CalcScopeDepth(byte[] code)
{
ClearFlags();
uint i = 0;
uint n = (uint)code.Length;
int scopeDepth = 0;
int maxScopeDepth = 0;
while (i < n)
{
AVM2Command cmd = null;
try
{
cmd = Translator.ToCommand(code[i++]);
}
catch (Exception)
{
DebugUtil.DumpOpUntilError(code);
throw new Exception(String.Format("Can not translate {0} correct at {1}.", code[i - 1], i - 1));
}
if (null == cmd)
{
throw new Exception();
}
i += cmd.ReadParameters(code, i);
switch (cmd.OpCode)
{
case (byte)Op.PushScope:
case (byte)Op.PushWith:
scopeDepth++;
break;
case (byte)Op.PopScope:
scopeDepth--;
break;
}
if (scopeDepth > maxScopeDepth)
{
maxScopeDepth = scopeDepth;
}
}
U30 result = new U30();
result.Value = (uint)maxScopeDepth;
return(result);
}
public Instruction(string command, ParserInformation debugInfo)
{
_debugInfo = debugInfo;
char[] separators = { ' ' };
string[] tokens = command.Split(separators, 2);
AVM2Command cmd = Translator.ToCommand(tokens[0]);
if (cmd == null)
{
throw new InstructionException(InstructionException.Type.InvalidSyntax, _debugInfo);
}
if (tokens.Length == 1 && cmd.ParameterCount > 0)
{
throw new InstructionException(InstructionException.Type.NotEnoughArguments, _debugInfo);
}
else
{
if (tokens.Length == 2)
{
separators[0] = ',';
string[] args = tokens[1].Split(separators, 0xff);
if (args.Length > cmd.ParameterCount)
{
throw new InstructionException(InstructionException.Type.TooManyArguments, _debugInfo);
}
else if (args.Length < cmd.ParameterCount)
{
throw new InstructionException(InstructionException.Type.NotEnoughArguments, _debugInfo);
}
_arguments = new List <string>();
if (cmd.ParameterCount != 0)
{
for (int i = 0; i < args.Length; ++i)
{
_arguments.Add(args[i].Trim());
}
}
}
}
_cmd = cmd;
}
protected void FormatCommand(uint address, AVM2Command cmd)
{
string output = "";
output += String.Format("{0:X4}\t", address);
output += cmd.StringRepresentation + "\t\t";
if (cmd.StringRepresentation.Length < 8)
{
output += "\t";
}
int n = cmd.Parameters.Count;
int m = n - 1;
for (int i = 0; i < n; ++i)
{
object t = cmd.Parameters[i];
if (t is byte)
{
output += String.Format("{0}", (byte)t);
}
else if (t is S24)
{
output += String.Format("{0}", ((S24)t).Value);
}
else if (t is U30)
{
output += String.Format("{0}", ((U30)t).Value);
}
else if (t is U32)
{
output += String.Format("{0}", ((U30)t).Value);
}
if (i != m)
{
output += ", ";
}
}
output += "\r\n";
_output.Add(output);
}
public static void CheckInlineFlag(Abc46 abc, MethodBodyInfo body)
{
byte[] code = body.Code;
uint i = 0;
uint n = (uint)code.Length;
while (i < n)
{
AVM2Command command = Translator.ToCommand(code[i++]);
i += command.ReadParameters(code, i);
if (command.OpCode == (byte)Op.FindPropertyStrict)
{
string name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value]));
if (CompilerInline.inlineMarker == name)
{
body.IsInline = true;
return;
}
}
}
}
protected uint GetUInt(AVM2Command cmd, int paramIndex)
{
return(((U32)_abc.ConstantPool.UIntTable[(int)((U30)cmd.Parameters[paramIndex]).Value]).Value);
}
protected void PatchBody(Abc46 abc, MethodBodyInfo body, int bodyId)
{
AVM2Command command;
AVM2Command inlineCommand;
Dictionary <string, Label> labels = new Dictionary <string, Label>();
ArrayList instructions = new ArrayList();
Label label;
string labelId;
byte[] il = body.Code;
uint i = 0;
uint n = (uint)il.Length;
uint addr;
string name;
bool hasManualMaxStack = false;
uint manualMaxStackValue = 0;
bool patchBody = false;
//bool parseInline = false;
_labelUtil.Clear();
//
// We will convert the bytecode into a format that the As3c compiler can understand.
// When converting labels we will use a ':' in front of them instead of a '.' char for
// the ones "defined" by the ASC so that we have unique names (label syntax is .label)
//
while (i < n)
{
addr = i;
if (_labelUtil.IsMarked(addr))
{
labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id);
label = new Label(labelId);
labels.Add(labelId, label);
instructions.Add(label);
}
command = Translator.ToCommand(il[i++]);
if (null == command)
{
throw new Exception("Unknown opcode detected.");
}
i += command.ReadParameters(il, i);
switch (command.OpCode)
{
case (byte)Op.Label:
labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id);
label = new Label(labelId);
labels.Add(labelId, label);
instructions.Add(label);
break;
case (byte)Op.IfEqual:
case (byte)Op.IfFalse:
case (byte)Op.IfGreaterEqual:
case (byte)Op.IfGreaterThan:
case (byte)Op.IfLessEqual:
case (byte)Op.IfLowerThan:
case (byte)Op.IfNotEqual:
case (byte)Op.IfNotGreaterEqual:
case (byte)Op.IfNotGreaterThan:
case (byte)Op.IfNotLowerEqual:
case (byte)Op.IfNotLowerThan:
case (byte)Op.IfStrictEqual:
case (byte)Op.IfStrictNotEqual:
case (byte)Op.IfTrue:
case (byte)Op.Jump:
// Convert label offset to label reference ...
S24 offset = (S24)command.Parameters[0];
command.Parameters[0] = String.Format(":{0}:", _labelUtil.GetLabelAt((uint)(addr + 1 + offset.Length + offset.Value)).id);
instructions.Add(command);
break;
case (byte)Op.GetLex:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value]));
//Console.WriteLine("Called GetLex {0}", name);
instructions.Add(command);
break;
case (byte)Op.FindPropertyStrict:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value]));
#region INLINE Block
if (inlineWrapper == name)
{
bool parse = true;
patchBody = true;
#if DEBUG
Console.WriteLine("[i] Parsing inline block in method {0}", body.Method.Value);
#endif
while (parse && i < n)
{
inlineCommand = Translator.ToCommand(il[i++]);
if (null == inlineCommand)
{
throw new Exception("Unknown opcode detected.");
}
i += inlineCommand.ReadParameters(il, i);
switch (inlineCommand.OpCode)
{
//
// Debug instructions are kept even if they are in an inline block
//
case (byte)Op.Debug:
case (byte)Op.DebugFile:
case (byte)Op.DebugLine:
instructions.Add(inlineCommand);
break;
//
// Strings are treated as labels -- but make sure it is actually one!
//
case (byte)Op.PushString:
labelId = ((StringInfo)abc.ConstantPool.StringTable[(int)((U30)inlineCommand.Parameters[0])]).ToString();
if (labelId.IndexOf('.') != 0 || labelId.IndexOf(':') != (labelId.Length - 1))
{
throw new Exception(String.Format("Invalid string \"{0}\" in an inline block. Labels have the format \".labelName:\"", labelId));
}
labelId = labelId.Substring(0, labelId.Length - 1);
label = new Label(labelId);
labels.Add(labelId, label);
instructions.Add(label);
break;
//
// GetLex is the one that will bring public::de.popforge.asm::Op on the stack
//
case (byte)Op.GetLex:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value]));
if (inlineKeyword != name)
{
throw new Exception("Malformed inline block. GetLex call with invalid parameters");
}
List <AVM2Command> args = new List <AVM2Command>();
AVM2Command userCommand = null;
uint argc;
while (i < n)
{
AVM2Command arg = Translator.ToCommand(il[i++]);
if (null == arg)
{
throw new Exception("Unknown opcode detected.");
}
i += arg.ReadParameters(il, i);
if ((byte)Op.CallProperty == arg.OpCode)
{
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)arg.Parameters[0]).Value]));
userCommand = Translator.ToCommand(name, true);
argc = ((U30)arg.Parameters[1]).Value;
if (null == userCommand)
{
throw new Exception(String.Format("Unknown command {0}.", name));
}
break;
}
args.Add(arg);
}
if (null == userCommand)
{
throw new Exception("Malformed inline block.");
}
instructions.Add(new Instruction(abc, userCommand, args));
break;
case (byte)Op.CallPropertyVoid:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value]));
if (inlineWrapper == name)
{
parse = false;
}
else
{
throw new Exception("Malformed inline block. Method calls are not accepted ...");
}
break;
}
}
#if DEBUG
Console.WriteLine("[+] Inline block parsed");
#endif
}
#endregion
#region INLINE Marker
else if (inlineMarker == name)
{
#if DEBUG
Console.WriteLine("[i] Body {0} has been marked as inline", body.Method.Value);
#endif
bool parse = true;
while (parse && i < n)
{
inlineCommand = Translator.ToCommand(il[i++]);
if (null == inlineCommand)
{
throw new Exception("Unknown opcode detected.");
}
i += inlineCommand.ReadParameters(il, i);
switch (inlineCommand.OpCode)
{
case (byte)Op.CallPropertyVoid:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value]));
if (inlineMarker == name)
{
parse = false;
}
else
{
throw new Exception("Malformed inline block. Method calls are not accepted ...");
}
break;
}
}
#if DEBUG
Console.WriteLine("[+] Inline marker parsed.");
#endif
patchBody = true;
}
#endregion
#region MAX_STACK Marker
else if (inlineMaxStack == name)
{
#if DEBUG
Console.WriteLine("[i] Body {0} has a manual maximum stack set.", body.Method.Value);
#endif
bool parse = true;
uint maxStackValue = 0;
bool hasMaxValue = false;
while (parse && i < n)
{
inlineCommand = Translator.ToCommand(il[i++]);
if (null == inlineCommand)
{
throw new Exception("Unknown opcode detected.");
}
i += inlineCommand.ReadParameters(il, i);
switch (inlineCommand.OpCode)
{
case (byte)Op.PushByte:
maxStackValue = (uint)((byte)inlineCommand.Parameters[0]);
hasMaxValue = true;
break;
case (byte)Op.PushShort:
maxStackValue = (uint)((U30)inlineCommand.Parameters[0]);
hasMaxValue = true;
break;
case (byte)Op.PushInt:
maxStackValue = (uint)((S32)abc.ConstantPool.IntTable[(int)((U30)inlineCommand.Parameters[0]).Value]).Value;
hasMaxValue = true;
break;
case (byte)Op.PushDouble:
throw new Exception("Max stack has to be an integer constant.");
case (byte)Op.CallPropertyVoid:
name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value]));
if (inlineMaxStack == name)
{
parse = false;
}
else
{
throw new Exception("Malformed inline block. Method calls are not accepted ...");
}
break;
}
}
#if DEBUG
Console.WriteLine("[+] MaxStack marker parsed.");
#endif
if (hasMaxValue)
{
hasManualMaxStack = true;
manualMaxStackValue = maxStackValue;
}
patchBody = true;
}
#endregion
else
{
instructions.Add(command);
}
break;
default:
instructions.Add(command);
break;
}
}
if (patchBody)
{
//
// We have to patch this function ...
// Note: We do not change the initScopeDepth
//
#if DEBUG
Console.WriteLine("[i] Patching body (id: {0})", bodyId);
#endif
CompilerAs3c compAs3c = new CompilerAs3c();
compAs3c.Compile(abc, instructions, labels, false);
// Now .. only patch if we find a correct stack!
U30 maxStack;
if (!hasManualMaxStack)
{
maxStack = ByteCodeAnalyzer.CalcMaxStack(compAs3c.Code);
}
else
{
maxStack = (U30)manualMaxStackValue;
}
if (hasManualMaxStack || 0 == (ByteCodeAnalyzer.Flags & ByteCodeAnalyzer.InvalidStack))
{
MethodInfo method = (MethodInfo)abc.Methods[(int)body.Method.Value];
body.MaxStack = maxStack;
body.MaxScopeDepth = body.InitScopeDepth + ByteCodeAnalyzer.CalcScopeDepth(compAs3c.Code);
U30 minLocalCount = method.ParameterCount;
U30 maxLocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code);
if (maxLocalCount.Value > minLocalCount.Value)
{
body.LocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code);
}
//else <- we would have unused parameters in a function...
body.Code = compAs3c.Code;
}
else
{
//
// What else? We will display warnings automatically but what about
// telling the guy in which function he has an invalid stack?
//
}
#if DEBUG
Console.WriteLine("[+] Body patched");
#endif
}
}
public void Compile(Abc46 abc, ArrayList instructions, Dictionary <string, Label> labels, bool patchMath)
{
#if DEBUG
//Console.WriteLine("[i] Starting to compile method body ...");
#endif
//
// Create buffer
//
MemoryStream buffer = new MemoryStream();
BinaryWriter output = new BinaryWriter(buffer);
//
// Convert compiler instructions to IL.
//
Instruction instruction;
Label label;
List <ReplaceInformation> replaceList = new List <ReplaceInformation>();
bool hasLocalMath = false;
uint mathRegister = 0;
U30 mathMultiName = new U30();
AVM2Command mathCommand = null;
AVM2Command lastCommand = null;
for (int i = 0, n = instructions.Count; i < n; ++i)
{
if (instructions[i] is Label)
{
label = (Label)instructions[i];
label.Address = (uint)buffer.Position;
if (!label.Referenced)
{
output.Write((byte)Op.Label);
}
}
else if (instructions[i] is AVM2Command)
{
AVM2Command command = (AVM2Command)instructions[i];
output.Write((byte)command.OpCode);
switch (command.OpCode)
{
case (byte)Op.IfEqual:
case (byte)Op.IfFalse:
case (byte)Op.IfGreaterEqual:
case (byte)Op.IfGreaterThan:
case (byte)Op.IfLessEqual:
case (byte)Op.IfLowerThan:
case (byte)Op.IfNotEqual:
case (byte)Op.IfNotGreaterEqual:
case (byte)Op.IfNotGreaterThan:
case (byte)Op.IfNotLowerEqual:
case (byte)Op.IfNotLowerThan:
case (byte)Op.IfStrictEqual:
case (byte)Op.IfStrictNotEqual:
case (byte)Op.IfTrue:
case (byte)Op.Jump:
string labelId = (string)command.Parameters[0];
try
{
label = labels[labelId];
}
catch (Exception)
{
Console.WriteLine("[-] WARNING: Jumping to an unknown label");
continue;
}
if (label.HasAddress)
{
int offset = (int)(label.Address - ((uint)buffer.Position + 3));
Primitives.WriteS24(output, offset);
}
else
{
replaceList.Add(new ReplaceInformation((uint)buffer.Position, label, false));
Primitives.WriteS24(output, 0);
}
label.Referenced = true;
break;
case (byte)Op.GetLex:
if (patchMath)
{
string lexName = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value]));
//
// If getlex public::Math is called we will repalce it with
// a get_local N where Math will be stored.
//
if (("public::Math" == lexName || "Math" == lexName) && (null != lastCommand) && (lastCommand.OpCode != (byte)Op.SetLocal))
{
#if DEBUG
Console.WriteLine("[i] Found call to Math class ...");
#endif
if (!hasLocalMath)
{
mathMultiName = (U30)command.Parameters[0];
U30 currentMaxLocal = ByteCodeAnalyzer.CalcLocalCount(instructions);
#if DEBUG
Console.WriteLine(String.Format("[i] Math register will be {0}", currentMaxLocal.Value));
#endif
if (currentMaxLocal.Value < 4)
{
int val = (int)currentMaxLocal.Value;
mathCommand = Translator.ToCommand((byte)(0xd0 + val));
}
else
{
mathCommand = Translator.ToCommand((byte)Op.GetLocal);
mathCommand.Parameters.Add(currentMaxLocal);
}
mathRegister = currentMaxLocal.Value;
hasLocalMath = true;
}
output.Seek(-1, SeekOrigin.Current);
output.Write((byte)mathCommand.OpCode);
if (mathCommand.OpCode == (byte)Op.GetLocal)
{
mathCommand.WriteParameters(output);
}
}
else
{
command.WriteParameters(output);
}
}
else
{
command.WriteParameters(output);
}
break;
default:
command.WriteParameters(output);
break;
}
lastCommand = command;
}
else if (instructions[i] is Instruction)
{
instruction = (Instruction)instructions[i];
output.Write(instruction.Command.OpCode);
switch (instruction.Command.OpCode)
{
case (byte)Op.PushShort:
Primitives.WriteU30(output, (U30)Convert.ToInt32(instruction.Arguments[0]));
break;
case (byte)Op.AsType:
case (byte)Op.Coerce:
case (byte)Op.DeleteProperty:
case (byte)Op.FindProperty:
case (byte)Op.FindPropertyStrict:
case (byte)Op.GetDescendants:
case (byte)Op.GetLex:
case (byte)Op.GetProperty:
case (byte)Op.GetSuper:
case (byte)Op.InitProperty:
case (byte)Op.IsType:
case (byte)Op.SetProperty:
case (byte)Op.PushNamespace:
Primitives.WriteU30(output, NameUtil.GetMultiname(abc, instruction.Arguments[0]));
break;
case (byte)Op.CallProperty:
case (byte)Op.CallPropertyLex:
case (byte)Op.CallPropertyVoid:
case (byte)Op.CallSuper:
case (byte)Op.CallSuperVoid:
case (byte)Op.ConstructProperty:
Primitives.WriteU30(output, NameUtil.GetMultiname(abc, instruction.Arguments[0]));
Primitives.WriteU30(output, Convert.ToUInt32(instruction.Arguments[1]));
break;
case (byte)Op.NewClass:
Primitives.WriteU30(output, NameUtil.GetClass(abc, instruction.Arguments[0]));
break;
case (byte)Op.PushDouble:
Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveDouble(Convert.ToDouble(instruction.Arguments[0].Replace('.', ','))));
break;
case (byte)Op.PushInt:
Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveInt((S32)Convert.ToInt32(instruction.Arguments[0])));
break;
case (byte)Op.PushUInt:
Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveUInt((U32)Convert.ToUInt32(instruction.Arguments[0])));
break;
case (byte)Op.DebugFile:
case (byte)Op.PushString:
if (instruction.Arguments[0].StartsWith("\"") && instruction.Arguments[0].EndsWith("\"")) //TODO fix ugly hack
{
Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveString(instruction.Arguments[0].Substring(1, instruction.Arguments[0].Length - 2)));
}
else
{
Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveString(instruction.Arguments[0]));
}
break;
case (byte)Op.IfEqual:
case (byte)Op.IfFalse:
case (byte)Op.IfGreaterEqual:
case (byte)Op.IfGreaterThan:
case (byte)Op.IfLessEqual:
case (byte)Op.IfLowerThan:
case (byte)Op.IfNotEqual:
case (byte)Op.IfNotGreaterEqual:
case (byte)Op.IfNotGreaterThan:
case (byte)Op.IfNotLowerEqual:
case (byte)Op.IfNotLowerThan:
case (byte)Op.IfStrictEqual:
case (byte)Op.IfStrictNotEqual:
case (byte)Op.IfTrue:
case (byte)Op.Jump:
//
// Solve label offset
//
string labelId = null;
try
{
labelId = instruction.Arguments[0];
}
catch (Exception)
{
Console.WriteLine("[-] WARNING: Jumping to an unknown label");
continue;
}
//
// Make sure the label exsists.
//
if (!labels.ContainsKey(labelId))
{
#if DEBUG
Console.WriteLine("[-] Label \"{0}\" is missing ...", labelId);
#endif
throw new InstructionException(InstructionException.Type.LabelMissing, instruction.DebugInfo);
}
label = labels[labelId];
if (label.HasAddress)
{
//
// We already have the label address. This is a negative jump offset.
//
int offset = (int)(label.Address - ((uint)buffer.Position + 3));
Primitives.WriteS24(output, offset);
}
else
{
//
// We do not know the label address. This is a positive jump offset.
// Mark label to be solved afterwards and write a placeholder ...
//
replaceList.Add(new ReplaceInformation((uint)buffer.Position, label, false));
Primitives.WriteS24(output, 0);
}
label.Referenced = true;
break;
default:
if (0 < instruction.Command.ParameterCount)
{
try
{
foreach (string argument in instruction.Arguments)
{
output.Write((byte)Convert.ToByte(argument));
}
}
catch (Exception)
{
throw new InstructionException(InstructionException.Type.UnknownType, instruction.DebugInfo);
}
}
break;
}
lastCommand = instruction.Command;
}
}
int labelOffset = 0;
#region Add automatically generated code
//
// Add local variable containing Math
//
if (patchMath && hasLocalMath)
{
#if DEBUG
Console.WriteLine("[i] Body has local Math");
#endif
int mathAddress = 2;
int lastOpCode = -1;
int opCode = -1;
long lastPosition = output.BaseStream.Position;
output.BaseStream.Seek(0, SeekOrigin.Begin);
while (((opCode = output.BaseStream.ReadByte()) != -1))
{
if (lastOpCode == (byte)Op.GetLocal0 && opCode == (byte)Op.PushScope)
{
break;
}
lastOpCode = opCode;
}
mathAddress = (int)output.BaseStream.Position;
output.BaseStream.Seek(lastPosition, SeekOrigin.Begin);
#if DEBUG
//Console.WriteLine("[i] Dump Before:");
//DebugUtil.Dump((MemoryStream)output.BaseStream);
#endif
InsertByte(output, mathAddress);
InsertByte(output, mathAddress);
labelOffset += 2;
int byteCoundMulti = 0;
while (byteCoundMulti < mathMultiName.Length)
{
byteCoundMulti++;
labelOffset++;
InsertByte(output, mathAddress);
}
if (mathRegister > 3)
{
#if DEBUG
Console.WriteLine("[i] Adding extra register");
#endif
int byteCount = 0;
while (byteCount < ((U30)mathRegister).Length + 1)
{
++byteCount;
++labelOffset;
InsertByte(output, mathAddress);
}
}
output.Seek(mathAddress, SeekOrigin.Begin);
AVM2Command getLexCommand = Translator.ToCommand((byte)Op.GetLex);
getLexCommand.Parameters.Add(mathMultiName);
output.Write((byte)getLexCommand.OpCode);
getLexCommand.WriteParameters(output);
if (mathRegister > 3)
{
AVM2Command setLocalCommand = Translator.ToCommand((byte)Op.SetLocal);
setLocalCommand.Parameters.Add((U30)mathRegister);
output.Write((byte)setLocalCommand.OpCode);
setLocalCommand.WriteParameters(output);
}
else
{
output.Write((byte)(0xd4 + mathRegister));
}
#if DEBUG
//Console.WriteLine("[i] Dump After:");
//DebugUtil.Dump((MemoryStream)output.BaseStream);
#endif
output.Seek(0, SeekOrigin.End);
output.Flush();
}
#endregion
//
// Solve remainig labels
//
for (int i = 0, n = replaceList.Count; i < n; ++i)
{
ReplaceInformation replaceInfo = replaceList[i];
label = replaceInfo.label;
if (!label.Referenced || !label.HasAddress)
{
Console.WriteLine("[-] Warning: Label {0} has never been defined or used ...", label.Identifier);
continue;
}
if (replaceInfo.lookUpSwitch)
{
//
// LookUpSwitch with special offset calculation
//
throw new Exception("IMPLEMENT ME!");
}
else
{
//
// Simple jump
//
int offset = (int)(label.Address - ((uint)replaceInfo.address + 3));
buffer.Seek(replaceInfo.address + labelOffset, SeekOrigin.Begin);
Primitives.WriteS24(output, offset);
}
}
//
// Convert stream to byte[]
//
buffer.Seek(0, SeekOrigin.Begin);
BinaryReader reader = new BinaryReader(buffer);
_code = reader.ReadBytes((int)buffer.Length);
//
// Clean up
//
reader.Close();
buffer.Dispose();
#if DEBUG
//Console.WriteLine("[i] Done compiling method body ...");
#endif
}
protected MethodInfo GetMethod(AVM2Command cmd, int paramIndex)
{
return((MethodInfo)_abc.Methods[(int)((U30)cmd.Parameters[paramIndex]).Value]);
}
protected StringInfo GetString(AVM2Command cmd, int paramIndex)
{
return((StringInfo)(_abc.ConstantPool.StringTable[(int)((U30)cmd.Parameters[paramIndex]).Value]));
}
protected NamespaceInfo GetNamespace(AVM2Command cmd, int paramIndex)
{
return((NamespaceInfo)(_abc.ConstantPool.NamespaceTable[(int)((U30)cmd.Parameters[paramIndex]).Value]));
}
protected MultinameInfo GetMultiname(AVM2Command cmd, int paramIndex)
{
return((MultinameInfo)(_abc.ConstantPool.MultinameTable[(int)((U30)cmd.Parameters[paramIndex]).Value]));
}
protected double GetDouble(AVM2Command cmd, int paramIndex)
{
return((double)_abc.ConstantPool.DoubleTable[(int)((U30)cmd.Parameters[paramIndex]).Value]);
}
public Instruction(Abc46 abc, AVM2Command command, List <AVM2Command> arguments)
{
_cmd = command;
_arguments = new List <string>();
for (int i = 0; i < arguments.Count; ++i)
{
AVM2Command argument = arguments[i];
switch (argument.OpCode)
{
case (byte)Op.PushByte:
_arguments.Add(((byte)argument.Parameters[0]).ToString());
break;
case (byte)Op.PushShort:
_arguments.Add(((U30)argument.Parameters[0]).Value.ToString());
break;
case (byte)Op.PushDouble:
_arguments.Add(((double)(abc.ConstantPool.DoubleTable[(int)((U30)argument.Parameters[0])])).ToString());
break;
case (byte)Op.PushInt:
_arguments.Add(((S32)(abc.ConstantPool.IntTable[(int)((U30)argument.Parameters[0])])).Value.ToString());
Console.WriteLine("My arguments are now: {0}", _arguments);
break;
case (byte)Op.PushUInt:
_arguments.Add(((U32)(abc.ConstantPool.DoubleTable[(int)((U30)argument.Parameters[0])])).Value.ToString());
break;
case (byte)Op.PushString:
_arguments.Add(((StringInfo)(abc.ConstantPool.StringTable[(int)((U30)argument.Parameters[0])])).ToString());
break;
case (byte)Op.GetLocal0:
if ((byte)Op.GetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.GetLocal0;
}
else if ((byte)Op.SetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.SetLocal0;
}
else
{
_arguments.Add("0");
}
break;
case (byte)Op.GetLocal1:
if ((byte)Op.GetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.GetLocal1;
}
else if ((byte)Op.SetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.SetLocal1;
}
else
{
_arguments.Add("1");
}
break;
case (byte)Op.GetLocal2:
if ((byte)Op.GetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.GetLocal2;
}
else if ((byte)Op.SetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.SetLocal2;
}
else
{
_arguments.Add("2");
}
break;
case (byte)Op.GetLocal3:
if ((byte)Op.GetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.GetLocal3;
}
else if ((byte)Op.SetLocal == _cmd.OpCode)
{
_cmd.OpCode = (byte)Op.SetLocal3;
}
else
{
_arguments.Add("3");
}
break;
case (byte)Op.GetLocal:
_arguments.Add(((int)((U30)argument.Parameters[0])).ToString());
break;
default:
#if DEBUG
Console.WriteLine("[-] Parameter type {0} not handled ...", argument.StringRepresentation);
#endif
break;
}
}
}
protected void FormatCommand(uint address, AVM2Command cmd)
{
string output = "";
//output += String.Format("{0:X4}\t", address);
//output += String.Format("{0}\t", address);
if (((byte)Op.Label == cmd.OpCode) || _labels.IsMarked(address))
{
output += String.Format("\r\n.label{0}:\r\n", _labels.GetLabelAt(address).id);
}
output += "\t" + cmd.StringRepresentation + "\t\t";
if (cmd.StringRepresentation.Length < 8)
{
output += "\t";
}
int n = cmd.Parameters.Count;
int m = n - 1;
switch (cmd.OpCode)
{
// Param 1: U30 -> Multiname
case (byte)Op.AsType:
case (byte)Op.Coerce:
case (byte)Op.DeleteProperty:
case (byte)Op.FindProperty:
case (byte)Op.FindPropertyStrict:
case (byte)Op.GetDescendants:
case (byte)Op.GetLex:
case (byte)Op.GetSuper:
case (byte)Op.InitProperty:
case (byte)Op.IsType:
case (byte)Op.SetProperty:
output += NameUtil.ResolveMultiname(_abc, GetMultiname(cmd, 0));
break;
case (byte)Op.GetProperty:
output += NameUtil.ResolveMultiname(_abc, GetMultiname(cmd, 0));
break;
// Param 1: U30 -> Multiname
// Param 2: Param count
case (byte)Op.CallProperty:
case (byte)Op.CallPropertyLex:
case (byte)Op.CallPropertyVoid:
case (byte)Op.CallSuper:
case (byte)Op.CallSuperVoid:
case (byte)Op.ConstructProperty:
output += NameUtil.ResolveMultiname(_abc, GetMultiname(cmd, 0));
output += ", " + ((U30)cmd.Parameters[1]).Value.ToString();
break;
// Param 1: U30 -> MethodInfo
// Param 2: Param count
case (byte)Op.CallStatic:
output += ((StringInfo)(_abc.ConstantPool.StringTable[(int)GetMethod(cmd, 0).Name.Value])).ToString();
output += ", " + ((U30)cmd.Parameters[1]).Value.ToString();
break;
// Param 1: U30 -> InstanceInfo
case (byte)Op.NewClass:
InstanceInfo ii = (InstanceInfo)_abc.Instances[(int)((U30)cmd.Parameters[0]).Value];
output += NameUtil.ResolveClass(_abc, ii);
break;
// Param 1: ?
case (byte)Op.PushNamespace:
output += GetNamespace(cmd, 0);
break;
// Param 1: U30 -> DoubleTable
case (byte)Op.PushDouble:
//TODO fix this and do not use replace...
output += GetDouble(cmd, 0).ToString().Replace(',', '.');
break;
// Param 1: U30 -> IntTable
case (byte)Op.PushInt:
output += GetInt(cmd, 0);
break;
// Param 1: U30 -> UIntTable
case (byte)Op.PushUInt:
output += GetUInt(cmd, 0);
break;
// Param 1: U30 -> StringTable
case (byte)Op.DebugFile:
case (byte)Op.PushString:
output += '"' + GetString(cmd, 0).ToString() + '"';
break;
// Param 1: ?
case (byte)Op.NewFunction:
output += ((U30)cmd.Parameters[0]).Value + " ;call to anonymous method " + ((U30)cmd.Parameters[0]).Value;
break;
// Param 1: S24 -> Jump Offset
case (byte)Op.IfEqual:
case (byte)Op.IfFalse:
case (byte)Op.IfGreaterEqual:
case (byte)Op.IfGreaterThan:
case (byte)Op.IfLessEqual:
case (byte)Op.IfLowerThan:
case (byte)Op.IfNotEqual:
case (byte)Op.IfNotGreaterEqual:
case (byte)Op.IfNotGreaterThan:
case (byte)Op.IfNotLowerEqual:
case (byte)Op.IfNotLowerThan:
case (byte)Op.IfStrictEqual:
case (byte)Op.IfStrictNotEqual:
case (byte)Op.IfTrue:
case (byte)Op.Jump:
S24 offset = (S24)cmd.Parameters[0];
// addr + (1byte opcode) + (offset byte length) + (offset value)
output += String.Format(".label{0}", _labels.GetLabelAt((uint)(address + 1 + offset.Length + offset.Value)).id) + "\r\n";
break;
case (byte)Op.LookupSwitch:
S24 defaultLabel = (S24)cmd.Parameters[0];
U30 count = (U30)cmd.Parameters[1];
output += String.Format(".label{0}", _labels.GetLabelAt((uint)(address + defaultLabel.Value)).id) + ", ";
for (int i = 0, o = (int)count.Value + 1; i < o; ++i)
{
S24 offsetLabel = (S24)cmd.Parameters[2 + i];
output += String.Format(".label{0}", _labels.GetLabelAt((uint)(address + offsetLabel.Value)).id);
if (i != o - 1)
{
output += ", ";
}
}
output += "\r\n";
break;
default:
for (int i = 0; i < n; ++i)
{
object t = cmd.Parameters[i];
if (t is byte)
{
output += String.Format("{0}", (byte)t);
}
else if (t is S24)
{
output += String.Format("{0}", ((S24)t).Value);
}
else if (t is U30)
{
output += String.Format("{0}", ((U30)t).Value);
}
else if (t is U32)
{
output += String.Format("{0}", ((U32)t).Value);
}
if (i != m)
{
output += ", ";
}
}
break;
}
output += "\r\n";
_output.Add(output);
}
public static U30 CalcLocalCount(ArrayList instructions)
{
ClearFlags();
int i = 0;
int n = instructions.Count;
uint local = 0;
uint maxLocal = 0;
while (i < n)
{
AVM2Command avm2Command = null;
if (instructions[i] is Instruction)
{
avm2Command = ((Instruction)instructions[i]).Command;
}
else if (instructions[i] is AVM2Command)
{
avm2Command = (AVM2Command)instructions[i];
}
else if (instructions[i] is Label)
{
++i;
continue;
}
else
{
throw new Exception("Unknown instruction type.");
}
switch (avm2Command.OpCode)
{
case (byte)Op.Debug:
byte type = (byte)avm2Command.Parameters[0];
if (1 == type)
{
local = (byte)avm2Command.Parameters[2] + 1U;
}
break;
case (byte)Op.SetLocal:
case (byte)Op.GetLocal:
U30 register = (U30)avm2Command.Parameters[0];
local = register.Value + 1U;
break;
case (byte)Op.SetLocal0:
case (byte)Op.GetLocal0:
local = 1;
break;
case (byte)Op.SetLocal1:
case (byte)Op.GetLocal1:
local = 2;
break;
case (byte)Op.SetLocal2:
case (byte)Op.GetLocal2:
local = 3;
break;
case (byte)Op.SetLocal3:
case (byte)Op.GetLocal3:
local = 4;
break;
}
if (local > maxLocal)
{
maxLocal = local;
}
++i;
}
U30 result = new U30();
result.Value = maxLocal;
return(result);
}
public static U30 CalcMaxStack(byte[] code)
{
ClearFlags();
uint i = 0;
uint n = (uint)code.Length;
int stack = 0;
int maxStack = 0;
bool corrupt = false;
uint j = 0;
List <ConditionalJump> jumps = new List <ConditionalJump>();
List <uint> unconditionalJumps = new List <uint>();
ConditionalJump cj;
int jumpIndex = 0;
do
{
while (i < n)
{
AVM2Command cmd = null;
try
{
cmd = Translator.ToCommand(code[i++]);
}
catch (Exception)
{
DebugUtil.DumpOpUntilError(code);
throw new Exception(String.Format("Can not translate {0} correct at {1}.", code[i - 1], i - 1));
}
if (null == cmd)
{
throw new Exception();
}
i += cmd.ReadParameters(code, i);
// There are a couple of opcodes marked "incorrect" with a comment.
// The explanation is: If the index in the multiname array is a RTQName
// there could be a namspace and/or namespace set on the stack as well
// that would be popped.
//
// We do not take that in account here - in the worst case that a namespace
// and namespace set is present it could add +2 to the max sack if the
// stack is greater than the one we already have.
//
// In the calculation of the possible max stack we will therefore only remove
// the number of arguments from the current value. If there are no arguments
// the opcode will be listed here as incorrect without any following calculation.
//
// Although this is not a problem for the Flash Player. It is just not very
// nice...
switch (cmd.OpCode)
{
case (byte)Op.Jump:
if (!unconditionalJumps.Contains(i))
{
unconditionalJumps.Add(i);
i = (uint)((int)i + (int)((S24)cmd.Parameters[0]).Value);
}
else
{
//LOOP BAAM!
}
break;
case (byte)Op.PushByte:
case (byte)Op.PushDouble:
case (byte)Op.PushFalse:
case (byte)Op.PushInt:
case (byte)Op.PushNamespace:
case (byte)Op.PushNaN:
case (byte)Op.PushNull:
case (byte)Op.PushShort:
case (byte)Op.PushString:
case (byte)Op.PushTrue:
case (byte)Op.PushUInt:
case (byte)Op.PushUndefined:
case (byte)Op.Dup:
case (byte)Op.FindProperty: //incorrect
case (byte)Op.FindPropertyStrict: //incorrect
case (byte)Op.GetGlobalScope:
case (byte)Op.GetGlobalSlot:
case (byte)Op.GetLex:
case (byte)Op.GetLocal:
case (byte)Op.GetLocal0:
case (byte)Op.GetLocal1:
case (byte)Op.GetLocal2:
case (byte)Op.GetLocal3:
case (byte)Op.GetScopeObject:
case (byte)Op.HasNext2:
case (byte)Op.NewActivation:
case (byte)Op.NewCatch:
case (byte)Op.NewFunction:
++stack;
break;
case (byte)Op.IfFalse:
case (byte)Op.IfTrue:
--stack;
cj = new ConditionalJump();
cj.offset = (S24)cmd.Parameters[0];
cj.pos = i;
cj.stack = stack;
if (!ContainsJumpFrom(jumps, cj))
{
jumps.Add(cj);
}
break;
case (byte)Op.Add:
case (byte)Op.AddInt:
case (byte)Op.AsTypeLate:
case (byte)Op.BitAnd:
case (byte)Op.BitOr:
case (byte)Op.BitXor:
case (byte)Op.Divide:
case (byte)Op.DefaultXmlNamespaceLate:
case (byte)Op.Equals:
case (byte)Op.GreaterEquals:
case (byte)Op.GreaterThan:
case (byte)Op.HasNext:
case (byte)Op.In:
case (byte)Op.InstanceOf:
case (byte)Op.IsTypeLate:
case (byte)Op.LessEquals:
case (byte)Op.LessThan:
case (byte)Op.LeftShift:
case (byte)Op.Modulo:
case (byte)Op.Multiply:
case (byte)Op.MultiplyInt:
case (byte)Op.NextName:
case (byte)Op.NextValue:
case (byte)Op.Pop:
case (byte)Op.PushScope: //pop from stack, push to scope stack
case (byte)Op.PushWith: //pop from stack, push to scope stack
case (byte)Op.ReturnValue:
case (byte)Op.RightShift:
case (byte)Op.SetLocal:
case (byte)Op.SetLocal0:
case (byte)Op.SetLocal1:
case (byte)Op.SetLocal2:
case (byte)Op.SetLocal3:
case (byte)Op.SetGlobalSlot:
case (byte)Op.StrictEquals:
case (byte)Op.Subtract:
case (byte)Op.SubtractInt:
case (byte)Op.Throw:
case (byte)Op.UnsignedRightShift:
--stack;
break;
case (byte)Op.LookupSwitch:
--stack;
for (int k = 2; k < cmd.ParameterCount; ++k)
{
cj.offset = (S24)cmd.Parameters[k];
cj.pos = i;
cj.stack = stack;
if (!ContainsJumpFrom(jumps, cj))
{
jumps.Add(cj);
}
}
break;
case (byte)Op.IfEqual:
case (byte)Op.IfGreaterEqual:
case (byte)Op.IfGreaterThan:
case (byte)Op.IfLessEqual:
case (byte)Op.IfLowerThan:
case (byte)Op.IfNotEqual:
case (byte)Op.IfNotGreaterEqual:
case (byte)Op.IfNotGreaterThan:
case (byte)Op.IfNotLowerEqual:
case (byte)Op.IfNotLowerThan:
case (byte)Op.IfStrictEqual:
case (byte)Op.IfStrictNotEqual:
stack -= 2;
cj = new ConditionalJump();
cj.offset = (S24)cmd.Parameters[0];
cj.pos = i;
cj.stack = stack;
if (!ContainsJumpFrom(jumps, cj))
{
jumps.Add(cj);
}
break;
case (byte)Op.InitProperty:
case (byte)Op.SetProperty: //incorrect
case (byte)Op.SetSlot:
case (byte)Op.SetSuper: //incorrect
stack -= 2;
break;
case (byte)Op.Call:
case (byte)Op.ConstructSuper:
stack -= 1 + (int)((U30)cmd.Parameters[0]);
break;
case (byte)Op.Construct:
stack -= (int)((U30)cmd.Parameters[0]);;
break;
case (byte)Op.NewArray:
stack -= (int)((U30)cmd.Parameters[0]) - 1;
break;
case (byte)Op.CallMethod:
case (byte)Op.CallProperty: //incorrect
case (byte)Op.CallPropertyLex: //incorrect
case (byte)Op.CallPropertyVoid: //incorrect
case (byte)Op.CallStatic:
case (byte)Op.CallSuper: //incorrect
case (byte)Op.CallSuperVoid: //incorrect
case (byte)Op.ConstructProperty:
stack -= (int)((U30)cmd.Parameters[1]);
break;
case (byte)Op.NewObject:
stack -= ((int)((U30)cmd.Parameters[0])) << 1;
break;
//case (byte)Op.DeleteProperty://incorrect
//case (byte)Op.GetDescendants://incorrect
//case (byte)Op.GetProperty://incorrect
//case (byte)Op.GetSuper://incorrect
// break;
}
if (stack < 0)
{
RaiseFlag(InvalidStack);
corrupt = true;
Console.WriteLine("[-] Warning: Stack underflow error at operation {0} (#{1})...", cmd.StringRepresentation, j);
}
if (stack > maxStack)
{
maxStack = stack;
}
++j;
}
if (jumpIndex < jumps.Count)
{
ConditionalJump nextScan = jumps[jumpIndex++];
i = (uint)((int)nextScan.pos + (int)nextScan.offset);
stack = nextScan.stack;
}
else
{
break;
}
} while (true);
U30 result = new U30();
result.Value = (uint)maxStack;
if (corrupt)
{
DebugUtil.DumpOpUntilError(code);
}
return(result);
}
public static U30 CalcLocalCount(byte[] code)
{
ClearFlags();
uint i = 0;
uint n = (uint)code.Length;
uint local = 0;
uint maxLocal = 0;
while (i < n)
{
AVM2Command cmd = null;
try
{
cmd = Translator.ToCommand(code[i++]);
}
catch (Exception)
{
DebugUtil.DumpOpUntilError(code);
throw new Exception(String.Format("Can not translate {0} correct at {1}.", code[i - 1], i - 1));
}
if (null == cmd)
{
throw new Exception();
}
i += cmd.ReadParameters(code, i);
switch (cmd.OpCode)
{
case (byte)Op.Debug:
byte type = (byte)cmd.Parameters[0];
if (1 == type)
{
local = (byte)cmd.Parameters[2] + 1U;
}
break;
case (byte)Op.SetLocal:
case (byte)Op.GetLocal:
U30 register = (U30)cmd.Parameters[0];
local = register.Value + 1U;
break;
case (byte)Op.SetLocal0:
case (byte)Op.GetLocal0:
local = 1;
break;
case (byte)Op.SetLocal1:
case (byte)Op.GetLocal1:
local = 2;
break;
case (byte)Op.SetLocal2:
case (byte)Op.GetLocal2:
local = 3;
break;
case (byte)Op.SetLocal3:
case (byte)Op.GetLocal3:
local = 4;
break;
}
if (local > maxLocal)
{
maxLocal = local;
}
}
U30 result = new U30();
result.Value = maxLocal;
return(result);
}
