# ThreeOpFunc1 inputs are three numbers and returns a number. .ThreeOpFunc1->interlocked_compare_exchange # ThreeOpFunc2 inputs are three numbers and returns no value. .ThreeOpFunc2->event_inject_error_code memcpy # TwoOpFunc1 inputs are two numbers and returns a number. .TwoOpFunc1->ed eb eq interlocked_exchange interlocked_exchange_add # TwoOpFunc2 inputs are two numbers and returns no value .TwoOpFunc2->spinlock_lock_custom_wait event_inject # OneOpFunc1 input is a number and returns a number. .OneOpFunc1->poi db dd dw dq neg hi low not check_address disassemble_len disassemble_len32 disassemble_len64 interlocked_increment interlocked_decrement reference physical_to_virtual virtual_to_physical # OneOpFunc2 input is a number. .OneOpFunc2->print formats event_enable event_disable event_clear test_statement spinlock_lock spinlock_unlock event_sc # OneOpFunc3 input is a number or a string and returns a number. .OneOpFunc3->strlen # TwoOpFunc3 the two inputs are numbers or strings and returns a number. .TwoOpFunc3->strcmp # ThreeOpFunc3 the first two inputs are numbers or strings and the third input is a number and returns a number. .ThreeOpFunc3->memcmp strncmp # ThreeOpFunc4 the first two inputs are numbers or wstrings and the third input is a number and returns a number. .ThreeOpFunc4->wcsncmp # OneOpFunc4 input is a number or a wstring and returns a number. .OneOpFunc4->wcslen # TwoOpFunc4 the two inputs are numbers or wstrings and returns a number. .TwoOpFunc4->wcscmp .ZeroOpFunc1->pause flush event_trace_step event_trace_step_in event_trace_step_out event_trace_instrumentation_step event_trace_instrumentation_step_in .VarArgFunc1->printf .OperatorsTwoOperand->or xor and asr asl add sub mul div mod gt lt egt elt equal neq .OperatorsOneOperand->inc dec reference dereference .SemantiRules->jmp jz jnz mov start_of_do_while start_of_do_while_commands end_of_do_while start_of_for for_inc_dec start_of_for_ommands end_of_if ignore_lvalue push pop call ret .Registers->rax eax ax ah al rcx ecx cx ch cl rdx edx dx dh dl rbx ebx bx bh bl rsp esp sp spl rbp ebp bp bpl rsi esi si sil rdi edi di dil r8 r8d r8w r8h r8l r9 r9d r9w r9h r9l r10 r10d r10w r10h r10l r11 r11d r11w r11h r11l r12 r12d r12w r12h r12l r13 r13d r13w r13h r13l r14 r14d r14w r14h r14l r15 r15d r15w r15h r15l ds es fs gs cs ss rflags eflags flags cf pf af zf sf tf if df of iopl nt rf vm ac vif vip id rip eip ip idtr ldtr gdtr tr cr0 cr2 cr3 cr4 cr8 dr0 dr1 dr2 dr3 dr6 dr7 .PseudoRegisters->pid tid pname core proc thread peb teb ip buffer context event_tag event_id event_stage date time S->STATEMENT S S->{ STATEMENT S } S->eps STATEMENT->IF_STATEMENT STATEMENT->WHILE_STATEMENT STATEMENT->DO_WHILE_STATEMENT STATEMENT->FOR_STATEMENT STATEMENT->L_VALUE L_VALUE2 STATEMENT->CALL_FUNC_STATEMENT ; STATEMENT->break @BREAK ; STATEMENT->continue @CONTINUE ; STATEMENT->VARIABLE_TYPE3 S2->STATEMENT2 S2 S2->{ STATEMENT2 S2 } S2->eps STATEMENT2->IF_STATEMENT STATEMENT2->WHILE_STATEMENT STATEMENT2->DO_WHILE_STATEMENT STATEMENT2->FOR_STATEMENT STATEMENT2->L_VALUE L_VALUE2 STATEMENT2->CALL_FUNC_STATEMENT ; STATEMENT2->break @BREAK ; STATEMENT2->continue @CONTINUE ; STATEMENT2->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE = EXPRESSION @MOV ; STATEMENT2->return RETURN ; RETURN->eps @RETURN_OF_USER_DEFINED_FUNCTION_WITHOUT_VALUE RETURN->EXPRESSION @RETURN_OF_USER_DEFINED_FUNCTION_WITH_VALUE .ScriptVariableType->void bool char short int long unsigned signed float double VARIABLE_TYPE1->@PUSH _script_variable_type VARIABLE_TYPE2->VARIABLE_TYPE1 VARIABLE_TYPE2 VARIABLE_TYPE2->eps VARIABLE_TYPE3->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE VARIABLE_TYPE4 VARIABLE_TYPE4->= EXPRESSION @MOV ; # define function VARIABLE_TYPE4->@START_OF_USER_DEFINED_FUNCTION ( VARIABLE_TYPE5 ) { S2 @END_OF_USER_DEFINED_FUNCTION } VARIABLE_TYPE5->eps VARIABLE_TYPE5->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE @FUNCTION_PARAMETER VARIABLE_TYPE6 VARIABLE_TYPE6->, VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE @FUNCTION_PARAMETER VARIABLE_TYPE6 VARIABLE_TYPE6->eps # L_VALUE2 is to decide whether is assignment or call user-defined function L_VALUE2->ASSIGNMENT_STATEMENT' ; L_VALUE2->@CALL_USER_DEFINED_FUNCTION ( CALL_USER_DEFINED_FUNCTION_PARAMETER ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITHOUT_RETURNING_VALUE ; CALL_USER_DEFINED_FUNCTION_PARAMETER->eps CALL_USER_DEFINED_FUNCTION_PARAMETER->EXPRESSION @CALL_USER_DEFINED_FUNCTION_PARAMETER CALL_USER_DEFINED_FUNCTION_PARAMETER2 CALL_USER_DEFINED_FUNCTION_PARAMETER2->, EXPRESSION @CALL_USER_DEFINED_FUNCTION_PARAMETER CALL_USER_DEFINED_FUNCTION_PARAMETER2 CALL_USER_DEFINED_FUNCTION_PARAMETER2->eps ASSIGNMENT_STATEMENT'->++ @INC ASSIGNMENT_STATEMENT'->-- @DEC ASSIGNMENT_STATEMENT'->= EXPRESSION @MOV CALL_FUNC_STATEMENT->.OneOpFunc2 ( EXPRESSION @.OneOpFunc2 ) CALL_FUNC_STATEMENT->.VarArgFunc1 ( STRING @VARGSTART VA @.VarArgFunc1 ) CALL_FUNC_STATEMENT->.ZeroOpFunc1 ( @.ZeroOpFunc1 ) CALL_FUNC_STATEMENT->.TwoOpFunc2 ( EXPRESSION , EXPRESSION @.TwoOpFunc2 ) CALL_FUNC_STATEMENT->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.OneOpFunc3 ( StringNumber @.OneOpFunc3 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 ) @IGNORE_LVALUE CALL_FUNC_STATEMENT->.ThreeOpFunc2 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc2 ) CALL_FUNC_STATEMENT->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXPRESSION @.ThreeOpFunc4 ) @IGNORE_LVALUE VA->, EXPRESSION VA VA->eps IF_STATEMENT->if @START_OF_IF ( BOOLEAN_EXPRESSION ) @JZ { S2 } ELSIF_STATEMENT ELSE_STATEMENT @END_OF_IF END_OF_IF ELSIF_STATEMENT->elsif @JMP_TO_END_AND_JZCOMPLETED ( BOOLEAN_EXPRESSION ) @JZ { S2 } ELSIF_STATEMENT ELSIF_STATEMENT->@JMP_TO_END_AND_JZCOMPLETED ELSIF_STATEMENT' ELSIF_STATEMENT'->eps ELSE_STATEMENT->else { S2 } ELSE_STATEMENT->eps END_OF_IF->eps WHILE_STATEMENT->while @START_OF_WHILE ( BOOLEAN_EXPRESSION ) @START_OF_WHILE_COMMANDS { S2 @END_OF_WHILE } DO_WHILE_STATEMENT->do @START_OF_DO_WHILE { S2 } while ( BOOLEAN_EXPRESSION ) @END_OF_DO_WHILE ; FOR_STATEMENT->for ( SIMPLE_ASSIGNMENT ; @START_OF_FOR BOOLEAN_EXPRESSION ; @FOR_INC_DEC INC_DEC ) { @START_OF_FOR_COMMANDS S2 @END_OF_FOR } SIMPLE_ASSIGNMENT->VARIABLE_TYPE1 VARIABLE_TYPE2 L_VALUE = EXPRESSION @MOV SIMPLE_ASSIGNMENT' SIMPLE_ASSIGNMENT->L_VALUE = EXPRESSION @MOV SIMPLE_ASSIGNMENT' SIMPLE_ASSIGNMENT->eps SIMPLE_ASSIGNMENT'->eps INC_DEC->L_VALUE INC_DEC' INC_DEC'->++ @INC INC_DEC'->-- @DEC INC_DEC'->= EXPRESSION @MOV SIMPLE_ASSIGNMENT' INC_DEC'->eps BOOLEAN_EXPRESSION->eps EXPRESSION->E1 E0' E0'->| E1 @OR E0' E0'->eps E1->E2 E1' E1'->^ E2 @XOR E1' E1'->eps E2->E3 E2' E2'->& E3 @AND E2' E2'->eps E3->E4 E3' E3'->>> E4 @ASR E3' E3'-><< E4 @ASL E3' E3'->eps E4->E5 E4' E4'->+ E5 @ADD E4' E4'->- E5 @SUB E4' E4'->eps E5->E12 E5' E5'->/ E12 @DIV E5' E5'->% E12 @MOD E5' E5'->* E12 @MUL E5' E5'->eps E12->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 ) E12->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 ) E12->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 ) E12->.OneOpFunc3 ( StringNumber @.OneOpFunc3 ) E12->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 ) E12->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 ) E12->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 ) E12->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 ) E12->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXPRESSION @.ThreeOpFunc4 ) E12->( EXPRESSION ) E12->L_VALUE E13 E13->eps E13->@CALL_USER_DEFINED_FUNCTION ( CALL_USER_DEFINED_FUNCTION_PARAMETER ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITH_RETURNING_VALUE # numbers E12->@PUSH _hex E12->@PUSH _decimal E12->@PUSH _octal E12->@PUSH _binary E12->@PUSH _pseudo_register E12->- E12 @NEG E12->+ E12 E12->~ E12 @NOT E12->* E12 @POI E12->& E12 @REFERENCE # Types must have '_' at the first STRING->@PUSH _string WSTRING->@PUSH _wstring L_VALUE->@PUSH _global_id L_VALUE->@PUSH _local_id L_VALUE->@PUSH _register L_VALUE->@PUSH _function_parameter_id StringNumber->EXPRESSION StringNumber->STRING WstringNumber->EXPRESSION WstringNumber->WSTRING