mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-10 01:29:59 +00:00
141 lines
3.1 KiB
Text
141 lines
3.1 KiB
Text
# ZeroOpFunc2 no input and returns a number
|
|
.ZeroOpFunc2->rdtsc rdtscp lbr_save lbr_dump lbr_print lbr_restore lbr_check
|
|
|
|
# OneOpFunc1 input is a number and returns a number.
|
|
.OneOpFunc1->poi db dd dw dq neg hi low not check_address strlen wcslen disassemble_len disassemble_len32 disassemble_len64 interlocked_increment interlocked_decrement reference physical_to_virtual virtual_to_physical poi_pa hi_pa low_pa db_pa dd_pa dw_pa dq_pa lbr_restore_by_filter
|
|
|
|
# TwoOpFunc1 inputs are two numbers and returns a number.
|
|
.TwoOpFunc1->ed eb eq interlocked_exchange interlocked_exchange_add wcscmp eb_pa ed_pa eq_pa
|
|
|
|
# ThreeOpFunc1 inputs are three numbers and returns a number.
|
|
.ThreeOpFunc1->interlocked_compare_exchange
|
|
|
|
# OneOpFunc3 input is a number or a string and returns a number.
|
|
.OneOpFunc3->strlen
|
|
|
|
# TwoOpFunc3 the two inputs are numbers or strings and returns a number.
|
|
.TwoOpFunc3->strcmp
|
|
|
|
# ThreeOpFunc3 the first two inputs are numbers or strings and the third input is a number and returns a number.
|
|
.ThreeOpFunc3->memcmp strncmp
|
|
|
|
# OneOpFunc4 input is a number or a wstring and returns a number.
|
|
.OneOpFunc4->wcslen
|
|
|
|
# TwoOpFunc4 the two inputs are numbers or wstrings and returns a number.
|
|
.TwoOpFunc4->wcscmp
|
|
|
|
# ThreeOpFunc4 the first two inputs are numbers or wstrings and the third input is a number and returns a number.
|
|
.ThreeOpFunc4->wcsncmp
|
|
|
|
.OperatorsOneOperand->inc dec reference dereference
|
|
|
|
S->BE
|
|
|
|
|
|
BE->B1
|
|
|
|
|
|
B1->B1 || B2 @OR
|
|
B1->B2
|
|
|
|
|
|
B2->B2 && B3 @AND
|
|
B2->B3
|
|
|
|
B3->B3 | B4 @OR
|
|
B3->B4
|
|
|
|
B4->B4 ^ B5 @XOR
|
|
B4->B5
|
|
|
|
B5->B5 & B6 @AND
|
|
B5->B6
|
|
|
|
B6->CMP
|
|
|
|
CMP->CMP > EXP @GT
|
|
CMP->CMP < EXP @LT
|
|
CMP->CMP >= EXP @EGT
|
|
CMP->CMP <= EXP @ELT
|
|
CMP->CMP == EXP @EQUAL
|
|
CMP->CMP != EXP @NEQ
|
|
CMP->EXP
|
|
|
|
EXP->E3
|
|
|
|
E3->E3 >> E4 @ASR
|
|
E3->E3 << E4 @ASL
|
|
E3->E4
|
|
|
|
E4->E4 + E5 @ADD
|
|
E4->E4 - E5 @SUB
|
|
E4->E5
|
|
|
|
E5->E5 / E10 @DIV
|
|
E5->E5 % E10 @MOD
|
|
E5->E5 * E10 @MUL
|
|
E5->E10
|
|
|
|
E10->E12
|
|
E10->- E12 @NEG
|
|
E10->+ E12
|
|
E10->~ E12 @NOT
|
|
E10->* E12 @POI
|
|
E10->& E12 @REFERENCE
|
|
|
|
|
|
E12->.ZeroOpFunc2 ( ) @.ZeroOpFunc2
|
|
E12->.OneOpFunc1 ( EXP ) @.OneOpFunc1
|
|
E12->.TwoOpFunc1 ( EXP , EXP ) @.TwoOpFunc2
|
|
E12->.ThreeOpFunc1 ( EXP , EXP , EXP ) @.ThreeOpFunc1
|
|
E12->.OneOpFunc3 ( StringNumber ) @.OneOpFunc3
|
|
E12->.TwoOpFunc3 ( StringNumber , StringNumber ) @.TwoOpFunc3
|
|
E12->.ThreeOpFunc3 ( StringNumber , StringNumber , EXP ) @.ThreeOpFunc3
|
|
E12->.OneOpFunc4 ( WstringNumber ) @.OneOpFunc4
|
|
E12->.TwoOpFunc4 ( WstringNumber , WstringNumber ) @.TwoOpFunc4
|
|
E12->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXP ) @.ThreeOpFunc4
|
|
|
|
E12->( BE )
|
|
|
|
# Types must have '_' at the first
|
|
E12->_register @PUSH
|
|
E12->_global_id @PUSH
|
|
E12->_local_id @PUSH
|
|
E12->_function_parameter_id @PUSH
|
|
|
|
E12->ARRAY1
|
|
|
|
|
|
|
|
# numbers
|
|
E12->_hex @PUSH
|
|
E12->_decimal @PUSH
|
|
E12->_octal @PUSH
|
|
E12->_binary @PUSH
|
|
E12->_pseudo_register @PUSH
|
|
|
|
|
|
E12->E13 ( VA2 ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITH_RETURNING_VALUE
|
|
E13->_function_id @PUSH
|
|
|
|
VA2->eps
|
|
VA2->EXP VA3
|
|
VA3->, EXP VA3
|
|
VA3->eps
|
|
|
|
STRING->_string @PUSH
|
|
WSTRING->_wstring @PUSH
|
|
|
|
StringNumber->EXP
|
|
StringNumber->STRING
|
|
|
|
WstringNumber->EXP
|
|
WstringNumber->WSTRING
|
|
|
|
|
|
ARRAY1->ARRAY2 ARRAY3 ARRAY4 @ARRAY_INDEX_READ
|
|
ARRAY2->_local_id @PUSH
|
|
ARRAY3->[ EXP ] @ARRAY_DIM_NUMBER
|
|
ARRAY4->ARRAY3 ARRAY4
|
|
ARRAY4->eps
|