mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-08-23 07:25:29 +00:00
195 lines
6.2 KiB
Text
195 lines
6.2 KiB
Text
# ThreeOpFunc1 inputs are three numbers and returns a number.
|
|
.ThreeOpFunc1->interlocked_compare_exchange
|
|
|
|
# ThreeOpFunc2 inputs are three numbers and returns no value.
|
|
.ThreeOpFunc2->event_inject_error_code memcpy
|
|
|
|
# TwoOpFunc1 inputs are two numbers and returns a number.
|
|
.TwoOpFunc1->ed eb eq interlocked_exchange interlocked_exchange_add
|
|
|
|
# TwoOpFunc2 inputs are two numbers and returns no value
|
|
.TwoOpFunc2->spinlock_lock_custom_wait event_inject
|
|
|
|
# OneOpFunc1 input is a number and returns a number.
|
|
.OneOpFunc1->poi db dd dw dq neg hi low not check_address disassemble_len disassemble_len32 disassemble_len64 interlocked_increment interlocked_decrement reference physical_to_virtual virtual_to_physical
|
|
|
|
# OneOpFunc2 input is a number.
|
|
.OneOpFunc2->print formats event_enable event_disable event_clear test_statement spinlock_lock spinlock_unlock event_sc
|
|
|
|
# OneOpFunc3 input is a number or a string and returns a number.
|
|
.OneOpFunc3->strlen
|
|
|
|
# TwoOpFunc3 the two inputs are numbers or strings and returns a number.
|
|
.TwoOpFunc3->strcmp
|
|
|
|
# ThreeOpFunc3 the first two inputs are numbers or strings and the third input is a number and returns a number.
|
|
.ThreeOpFunc3->memcmp
|
|
|
|
# OneOpFunc4 input is a number or a wstring and returns a number.
|
|
.OneOpFunc4->wcslen
|
|
|
|
# TwoOpFunc4 the two inputs are numbers or wstrings and returns a number.
|
|
.TwoOpFunc4->wcscmp
|
|
|
|
.ZeroOpFunc1->pause flush event_trace_step event_trace_step_in event_trace_step_out event_trace_instrumentation_step event_trace_instrumentation_step_in
|
|
|
|
.VarArgFunc1->printf
|
|
|
|
.OperatorsTwoOperand->or xor and asr asl add sub mul div mod gt lt egt elt equal neq
|
|
.OperatorsOneOperand->inc dec reference dereference
|
|
|
|
.SemantiRules->start_of_if jmp jz jnz jmp_to_end_and_jzcompleted end_of_if start_of_while end_of_while vargstart mov start_of_do_while start_of_do_while_commands end_of_do_while start_of_for for_inc_dec start_of_for_ommands end_of_if ignore_lvalue
|
|
|
|
.Registers->rax eax ax ah al rcx ecx cx ch cl rdx edx dx dh dl rbx ebx bx bh bl rsp esp sp spl rbp ebp bp bpl rsi esi si sil rdi edi di dil r8 r8d r8w r8h r8l r9 r9d r9w r9h r9l r10 r10d r10w r10h r10l r11 r11d r11w r11h r11l r12 r12d r12w r12h r12l r13 r13d r13w r13h r13l r14 r14d r14w r14h r14l r15 r15d r15w r15h r15l ds es fs gs cs ss rflags eflags flags cf pf af zf sf tf if df of iopl nt rf vm ac vif vip id rip eip ip idtr ldtr gdtr tr cr0 cr2 cr3 cr4 cr8 dr0 dr1 dr2 dr3 dr6 dr7
|
|
|
|
.PseudoRegisters->pid tid pname core proc thread peb teb ip buffer context tag id stage
|
|
|
|
S->STATEMENT S
|
|
S->{ STATEMENT S }
|
|
S->eps
|
|
|
|
|
|
STATEMENT->IF_STATEMENT
|
|
STATEMENT->WHILE_STATEMENT
|
|
STATEMENT->DO_WHILE_STATEMENT
|
|
STATEMENT->FOR_STATEMENT
|
|
STATEMENT->ASSIGNMENT_STATEMENT ;
|
|
STATEMENT->CALL_FUNC_STATEMENT ;
|
|
STATEMENT->break @BREAK ;
|
|
STATEMENT->continue @CONTINUE ;
|
|
|
|
|
|
|
|
ASSIGNMENT_STATEMENT->L_VALUE ASSIGNMENT_STATEMENT'
|
|
ASSIGNMENT_STATEMENT'->++ @INC
|
|
ASSIGNMENT_STATEMENT'->-- @DEC
|
|
ASSIGNMENT_STATEMENT'->= EXPRESSION @MOV
|
|
CALL_FUNC_STATEMENT->.OneOpFunc2 ( EXPRESSION @.OneOpFunc2 )
|
|
CALL_FUNC_STATEMENT->.VarArgFunc1 ( STRING @VARGSTART VA @.VarArgFunc1 )
|
|
CALL_FUNC_STATEMENT->.ZeroOpFunc1 ( @.ZeroOpFunc1 )
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc2 ( EXPRESSION , EXPRESSION @.TwoOpFunc2 )
|
|
CALL_FUNC_STATEMENT->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.OneOpFunc3 ( StringNumber @.OneOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 ) @IGNORE_LVALUE
|
|
CALL_FUNC_STATEMENT->.ThreeOpFunc2 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc2 )
|
|
|
|
VA->, EXPRESSION VA
|
|
VA->eps
|
|
|
|
IF_STATEMENT->if @START_OF_IF ( BOOLEAN_EXPRESSION ) @JZ { S } ELSIF_STATEMENT ELSE_STATEMENT @END_OF_IF END_OF_IF
|
|
ELSIF_STATEMENT->elsif @JMP_TO_END_AND_JZCOMPLETED ( BOOLEAN_EXPRESSION ) @JZ { S } ELSIF_STATEMENT
|
|
ELSIF_STATEMENT->@JMP_TO_END_AND_JZCOMPLETED ELSIF_STATEMENT'
|
|
ELSIF_STATEMENT'->eps
|
|
ELSE_STATEMENT->else { S }
|
|
ELSE_STATEMENT->eps
|
|
END_OF_IF->eps
|
|
|
|
|
|
|
|
WHILE_STATEMENT->while @START_OF_WHILE ( BOOLEAN_EXPRESSION ) @START_OF_WHILE_COMMANDS { S @END_OF_WHILE }
|
|
DO_WHILE_STATEMENT->do @START_OF_DO_WHILE { S } while ( BOOLEAN_EXPRESSION ) @END_OF_DO_WHILE ;
|
|
|
|
FOR_STATEMENT->for ( SIMPLE_ASSIGNMENT ; @START_OF_FOR BOOLEAN_EXPRESSION ; @FOR_INC_DEC INC_DEC ) { @START_OF_FOR_COMMANDS S @END_OF_FOR }
|
|
SIMPLE_ASSIGNMENT->L_VALUE = EXPRESSION @MOV SIMPLE_ASSIGNMENT'
|
|
SIMPLE_ASSIGNMENT->eps
|
|
SIMPLE_ASSIGNMENT'->eps
|
|
|
|
|
|
INC_DEC->L_VALUE INC_DEC'
|
|
INC_DEC'->++ @INC
|
|
INC_DEC'->-- @DEC
|
|
INC_DEC'->= EXPRESSION @MOV SIMPLE_ASSIGNMENT'
|
|
|
|
INC_DEC'->eps
|
|
|
|
BOOLEAN_EXPRESSION->eps
|
|
|
|
|
|
EXPRESSION->E1 E0'
|
|
E0'->| E1 @OR E0'
|
|
E0'->eps
|
|
|
|
|
|
E1->E2 E1'
|
|
E1'->^ E2 @XOR E1'
|
|
E1'->eps
|
|
|
|
E2->E3 E2'
|
|
E2'->& E3 @AND E2'
|
|
E2'->eps
|
|
|
|
E3->E4 E3'
|
|
E3'->>> E4 @ASR E3'
|
|
E3'-><< E4 @ASL E3'
|
|
E3'->eps
|
|
|
|
|
|
|
|
E4->E5 E4'
|
|
E4'->+ E5 @ADD E4'
|
|
E4'->- E5 @SUB E4'
|
|
E4'->eps
|
|
|
|
E5->E12 E5'
|
|
E5'->/ E12 @DIV E5'
|
|
E5'->% E12 @MOD E5'
|
|
E5'->* E12 @MUL E5'
|
|
E5'->eps
|
|
|
|
|
|
|
|
|
|
|
|
E12->.OneOpFunc1 ( EXPRESSION @.OneOpFunc1 )
|
|
E12->.TwoOpFunc1 ( EXPRESSION , EXPRESSION @.TwoOpFunc1 )
|
|
E12->.ThreeOpFunc1 ( EXPRESSION , EXPRESSION , EXPRESSION @.ThreeOpFunc1 )
|
|
E12->.OneOpFunc3 ( StringNumber @.OneOpFunc3 )
|
|
E12->.TwoOpFunc3 ( StringNumber , StringNumber @.TwoOpFunc3 )
|
|
E12->.ThreeOpFunc3 ( StringNumber , StringNumber , EXPRESSION @.ThreeOpFunc3 )
|
|
E12->.OneOpFunc4 ( WstringNumber @.OneOpFunc4 )
|
|
E12->.TwoOpFunc4 ( WstringNumber , WstringNumber @.TwoOpFunc4 )
|
|
|
|
E12->( EXPRESSION )
|
|
|
|
|
|
# Types must have '_' at the first
|
|
E12->@PUSH _register
|
|
E12->@PUSH _local_id
|
|
E12->@PUSH _global_id
|
|
|
|
|
|
# numbers
|
|
E12->@PUSH _hex
|
|
E12->@PUSH _decimal
|
|
E12->@PUSH _octal
|
|
E12->@PUSH _binary
|
|
|
|
|
|
E12->@PUSH _pseudo_register
|
|
|
|
E12->- E12 @NEG
|
|
E12->+ E12
|
|
E12->~ E12 @NOT
|
|
E12->* E12 @POI
|
|
E12->& E12 @REFERENCE
|
|
|
|
|
|
|
|
|
|
|
|
STRING->@PUSH _string
|
|
WSTRING->@PUSH _wstring
|
|
L_VALUE->@PUSH _global_id
|
|
L_VALUE->@PUSH _local_id
|
|
L_VALUE->@PUSH _register
|
|
|
|
StringNumber->EXPRESSION
|
|
StringNumber->STRING
|
|
WstringNumber->EXPRESSION
|
|
WstringNumber->WSTRING
|
|
|